@agentcomms/resend 0.24.0 → 0.26.0

package/dist/{send-CNNEFUeO.mjs → send-1tzjQOn0.mjs}

@@ -9,10 +9,11 @@ import { styleText } from "node:util";
 import { homedir, platform, userInfo } from "node:os";
 import { accessSync, constants as constants$1, lstatSync, readFileSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
+import { gunzipSync } from "node:zlib";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$2 = "0.24.0";
+const VERSION$2 = "0.26.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +202,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-BY5xNUZa.mjs
+//#region ../core/dist/update-check-C3j1VxDg.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -4447,9 +4448,6 @@ function isBehind(version, latest) {
 function isPlainVersion(value) {
 	return typeof value === "string" && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value);
 }
-function isPrerelease(version) {
-	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
-}
 /**
 * Whether `version` is within a package's `engines` range: true or false, or null when the range is not one this reads.
 *
@@ -7815,6 +7813,24 @@ function parseConfig(text, source = "config.json") {
 	if (!parsed.success) throw new CommsError("CONFIG", `${source} is invalid: ${describeIssues(parsed.error, naming === 1 ? 1 : 2)}`);
 	return parsed.data;
 }
+/**
+* How a config write waits for the config lock: five seconds for each holder, thirty seconds in all.
+*
+* The lock is a queue. Every send prepare, claim and approval on every channel runs `ensureSendEpochConfig` first, and
+* while a legacy drain is open that is a config write or two per call, so an agent's parallel calls across several MCP
+* servers arrive at this lock together, each holding it for one read, check and fsynced rename (and the drain's, for a
+* list of the approvals too). Counted from when each waiter began, the lock's five seconds were a budget for the whole
+* line ahead: on the Windows runner a line of twelve writes gave up at the ninth, "another agent-communications process
+* is holding", while the lock was being handed on exactly as it should be. A holder there took about half a second, and
+* on Windows a rename alone may retry for one. Counted per holder, as Resend's throttle and Gmail's history caches count
+* theirs, a write gives up only on a holder that keeps the lock for the whole five seconds: the stuck lock the timeout is
+* for. The lock is polled rather than queued, so thirty seconds in all bounds the rest, and leaves room inside the minute
+* an MCP client waits for a tool call.
+*/
+const CONFIG_WRITE_LOCK = {
+	timeoutPerHolder: true,
+	maxWaitMs: 3e4
+};
 var ConfigStore = class {
 	path;
 	#lockPath;
@@ -7835,6 +7851,10 @@ var ConfigStore = class {
 	#namesMigrateAgain(why) {
 		return handoffSentence(requiredHandoffs(this.#handoffs).core(["names", "migrate"]), (command) => `Run ${command} again ${why}.`, { instead: `Call comms_names_migrate again ${why}.` });
 	}
+	/** Runs `fn` holding the config lock, waited for as a write waits for it (`CONFIG_WRITE_LOCK`). */
+	#withWriteLock(fn) {
+		return withFileLock(this.#lockPath, fn, CONFIG_WRITE_LOCK);
+	}
 	/** The current config; an empty one when the file does not exist yet. */
 	async load() {
 		let key;
@@ -7861,7 +7881,7 @@ var ConfigStore = class {
 		let committed;
 		let result;
 		try {
-			result = await withFileLock(this.#lockPath, async () => {
+			result = await this.#withWriteLock(async () => {
 				options.signal?.throwIfAborted();
 				this.#cache = null;
 				const current = structuredClone(await this.load());
@@ -12976,7 +12996,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.24.0";
+const VERSION = "0.26.0";
 /**
 * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
 *
@@ -14349,7 +14369,7 @@ const PER_WORKSPACE = {
 	"agentLabel.slackStyles": "app",
 	"agentLabel.slackIcons": "your Slack photo"
 };
-function recordOf$1(value) {
+function recordOf$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 /**
@@ -14359,7 +14379,7 @@ function recordOf$1(value) {
 */
 function perWorkspace(field, before, after) {
 	const none = PER_WORKSPACE[field];
-	const [was, now] = [recordOf$1(before ?? {}), recordOf$1(after ?? {})];
+	const [was, now] = [recordOf$2(before ?? {}), recordOf$2(after ?? {})];
 	if (none === void 0 || was === void 0 || now === void 0) return void 0;
 	const value = (record, name) => Object.hasOwn(record, name) ? String(record[name]) : none;
 	const moved = [.../* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])].filter((name) => value(was, name) !== value(now, name)).sort();
@@ -14372,7 +14392,7 @@ function perWorkspace(field, before, after) {
 * commas. A level one side does not list allows everything there. Undefined for a value of another shape.
 */
 function perLevel(field, before, after) {
-	const [was, now] = [recordOf$1(before ?? {}), recordOf$1(after ?? {})];
+	const [was, now] = [recordOf$2(before ?? {}), recordOf$2(after ?? {})];
 	if (field !== "behaviour.rules" || was === void 0 || now === void 0) return void 0;
 	const value = (record, level) => Object.hasOwn(record, level) ? String(record[level]) : "everything";
 	const levels = [.../* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])].sort();
@@ -14990,7 +15010,7 @@ const OUTCOMES = [
 	"unknown"
 ];
 const isString = (value) => typeof value === "string";
-const isTime$2 = (value) => isString(value) && ISO.test(value) && !Number.isNaN(Date.parse(value));
+const isTime$3 = (value) => isString(value) && ISO.test(value) && !Number.isNaN(Date.parse(value));
 /** One line as an entry, or null when it is not one this release wrote. */
 function entryOf(line) {
 	let raw;
@@ -15001,7 +15021,7 @@ function entryOf(line) {
 	}
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
 	const entry = raw;
-	if (!isTime$2(entry.at)) return null;
+	if (!isTime$3(entry.at)) return null;
 	if (entry.kind === "use") {
 		if (![
 			"standingId",
@@ -15033,7 +15053,7 @@ function entryOf(line) {
 	if (entry.kind === "outcome") {
 		if (!isString(entry.childId) || !isString(entry.outcome) || !OUTCOMES.includes(entry.outcome)) return null;
 		if (!isString(entry.notice) || entry.link !== void 0 && !isString(entry.link)) return null;
-		if (entry.actAt !== void 0 && !isTime$2(entry.actAt)) return null;
+		if (entry.actAt !== void 0 && !isTime$3(entry.actAt)) return null;
 		return {
 			kind: "outcome",
 			at: entry.at,
@@ -15478,7 +15498,7 @@ function updateJobSupported(platform) {
 function updateJobMarkerPath(stateDir) {
 	return join(stateDir, "update-job.json");
 }
-const isTime$1 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+const isTime$2 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
 /** The record, or null when there is none — or none this release can read, which is treated as none. */
 async function readUpdateJobMarker(stateDir) {
 	let parsed;
@@ -15493,11 +15513,11 @@ async function readUpdateJobMarker(stateDir) {
 		platform: record.platform,
 		installedAt: record.installedAt,
 		label: record.label,
-		...isTime$1(record.lastRun) ? { lastRun: record.lastRun } : {}
+		...isTime$2(record.lastRun) ? { lastRun: record.lastRun } : {}
 	};
 }
 function within$1(at, now, intervalMs) {
-	if (at === void 0 || !isTime$1(at)) return false;
+	if (at === void 0 || !isTime$2(at)) return false;
 	const since = now.getTime() - Date.parse(at);
 	return since >= -3e5 && since < intervalMs;
 }
@@ -15578,7 +15598,7 @@ const NOTICE_OUTCOMES = [
 function readBackgroundNotice(value) {
 	if (typeof value !== "object" || value === null) return null;
 	const { at, outcome, version, text } = value;
-	if (!isTime(at) || !NOTICE_OUTCOMES.includes(outcome) || typeof text !== "string") return null;
+	if (!isTime$1(at) || !NOTICE_OUTCOMES.includes(outcome) || typeof text !== "string") return null;
 	return {
 		at,
 		outcome,
@@ -15607,7 +15627,7 @@ const EMPTY_UPDATE_CHECK = Object.freeze({
 function updateCheckPath(stateDir) {
 	return join(stateDir, UPDATE_CHECK_FILE);
 }
-const isTime = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+const isTime$1 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
 const isWords = (value) => Array.isArray(value) && value.every((word) => typeof word === "string");
 function readRelease(value) {
 	if (typeof value !== "object" || value === null) return null;
@@ -15640,17 +15660,17 @@ async function readUpdateCheck(stateDir) {
 	}
 	const held = typeof parsed === "object" && parsed !== null ? parsed : {};
 	return {
-		lastChecked: isTime(held.lastChecked) ? held.lastChecked : null,
+		lastChecked: isTime$1(held.lastChecked) ? held.lastChecked : null,
 		latest: isPlainVersion(held.latest) ? held.latest : null,
 		behind: typeof held.behind === "boolean" ? held.behind : null,
 		current: readCurrent(held.current),
 		lastError: typeof held.lastError === "string" ? held.lastError.slice(0, 300) : null,
-		snoozedUntil: isTime(held.snoozedUntil) ? held.snoozedUntil : null,
-		checking: isTime(held.checking) ? held.checking : null,
-		commandNoticeAt: isTime(held.commandNoticeAt) ? held.commandNoticeAt : null,
-		noticeAt: isTime(held.noticeAt) ? held.noticeAt : null,
-		pausedAt: isTime(held.pausedAt) ? held.pausedAt : null,
-		pausedUntil: isTime(held.pausedUntil) ? held.pausedUntil : null,
+		snoozedUntil: isTime$1(held.snoozedUntil) ? held.snoozedUntil : null,
+		checking: isTime$1(held.checking) ? held.checking : null,
+		commandNoticeAt: isTime$1(held.commandNoticeAt) ? held.commandNoticeAt : null,
+		noticeAt: isTime$1(held.noticeAt) ? held.noticeAt : null,
+		pausedAt: isTime$1(held.pausedAt) ? held.pausedAt : null,
+		pausedUntil: isTime$1(held.pausedUntil) ? held.pausedUntil : null,
 		release: readRelease(held.release),
 		securityAsked: isPlainVersion(held.securityAsked) ? held.securityAsked : null,
 		securityShown: readSecurityShown(held.securityShown),
@@ -15659,11 +15679,41 @@ async function readUpdateCheck(stateDir) {
 	};
 }
 /**
+* How every writer of the record takes the lock beside it: 2 s for each holder, and 15 s in all (design 2026-10-22, R2).
+*
+* Every server's tool call takes this lock for its refresh, so on a busy machine a writer often waits behind several
+* holders in turn, each holding it for a moment. Counted from the start of the wait, 2 s was a budget for that whole
+* queue, and a writer at the back of it gave up while the lock was being handed on exactly as it should be: a
+* person's update was installed and its record dropped. Counted per holder, a writer gives up only on one holder that
+* kept the lock for 2 s, which is a stuck lock; 15 s bounds a queue that never empties, as config writes are bounded.
+*/
+const UPDATE_CHECK_LOCK = Object.freeze({
+	timeoutPerHolder: true,
+	timeoutMs: 2e3,
+	maxWaitMs: 15e3
+});
+/**
+* How a notice takes the lock: 2 s in all, counted from the start of the wait, however often it changes hands meanwhile.
+*
+* A notice is best effort. Deciding a tool call's or a command's line, the security line in a preview, and recording
+* the person's answer to that line take the lock only for what is said, and each runs while a person or an agent
+* waits. Waited out holder by holder, as `UPDATE_CHECK_LOCK` waits, a busy machine's queue of refreshes held them for
+* up to 15 s. Busy past 2 s, a notice decides nothing this time, and a later call says it.
+*
+* Claiming the day's check is best effort too: busy past 2 s, nothing is claimed, and a later process claims it (0.26.0
+* review B). The claim's function is not named here: this comment ships in WhatsApp's bundle, which carries none of the
+* checker, not even its name (`packages/whatsapp/test/update-gate.test.ts`).
+*/
+const UPDATE_NOTICE_LOCK = Object.freeze({ timeoutMs: 2e3 });
+/**
 * Reads the record, changes it and writes it back, under a lock beside it, atomically — so a server recording a check
 * and a person's "not now" arriving at the same moment each keep what the other wrote. Returns what `change` returned
 * alongside the record written; `change` returning `null` writes nothing.
+*
+* `lock` is how long to wait for the lock: `UPDATE_CHECK_LOCK`, for a record that matters, unless a notice or the
+* day's claim passes `UPDATE_NOTICE_LOCK`. Busy past it, this throws LOCK_TIMEOUT, and nothing is written.
 */
-async function changeUpdateCheck(stateDir, change) {
+async function changeUpdateCheck(stateDir, change, lock = UPDATE_CHECK_LOCK) {
 	return withFileLock(join(stateDir, ".update-check.lock"), async () => {
 		const current = await readUpdateCheck(stateDir);
 		const next = change(current);
@@ -15678,7 +15728,7 @@ async function changeUpdateCheck(stateDir, change) {
 			result: next.result,
 			written: true
 		};
-	}, { timeoutMs: 2e3 });
+	}, lock);
 }
 /**
 * Whether the check is due: never asked, asked a day or more ago, or — a clock that went back — asked more than a few
@@ -15938,7 +15988,7 @@ async function securityAnswered(stateDir, approvalId) {
 				securityAsked: record.securityShown.version,
 				securityShown: null
 			} };
-		});
+		}, UPDATE_NOTICE_LOCK);
 	} catch {}
 }
 /** A local time as a person reads it in a preview: `2026-09-29 00:00`. */
@@ -16500,34 +16550,47 @@ function releaseIntegrity(packument, version) {
 	return typeof integrity === "string" && integrity.trim() !== "" ? integrity : null;
 }
 /**
-* What a release's core manifest declares under `agentcommsRelease` (U5): a security fix, and a decision it needs from
-* the person — as flags only. The decision's own words are never read out: they are the registry's, and an update says
-* that one is needed in its own words. A declaration this release cannot read waits for the person: it may be the
-* decision it cannot see.
+* What a release's core manifest declares under `agentcommsRelease` (U5, design 2026-10-22 §8.1): a security fix, a
+* decision it needs from the person, and the newest release up to it that needed one — as flags and a plain version
+* only. The manifest is the one in the release's verified tarball (`release-declarations.ts`, design 2026-10-22 P1),
+* never the registry's copy. The decision's own words are never read out: an update says that one is needed in its own
+* words. A declaration this release cannot read waits for the person, as it may be the decision it cannot see: a field
+* that is not an object, a `needsDecision` that is not false, or a `needsDecisionSince` that is not a plain version.
 */
 function releaseDeclaration(manifest) {
 	const declared = manifest?.agentcommsRelease;
 	if (declared === void 0 || declared === null) return {
 		security: false,
-		needsDecision: false
+		needsDecision: false,
+		needsDecisionSince: null
 	};
 	if (typeof declared !== "object" || Array.isArray(declared)) return {
 		security: false,
-		needsDecision: true
+		needsDecision: true,
+		needsDecisionSince: null
 	};
-	const { security, needsDecision } = declared;
+	const { security, needsDecision, needsDecisionSince } = declared;
+	const since = isPlainVersion(needsDecisionSince) ? needsDecisionSince : null;
 	return {
 		security: security === true,
-		needsDecision: !(needsDecision === void 0 || needsDecision === null || needsDecision === false)
+		needsDecision: needsDecisionSince !== void 0 && since === null || !(needsDecision === void 0 || needsDecision === null || needsDecision === false),
+		needsDecisionSince: since
 	};
 }
 /**
-* Every release the registry lists after `from`, up to and including `to`, oldest first: what an update takes this
-* machine past. Prereleases are left out — no update installs one — and so is anything that is not a version, or that
-* carries build metadata, which no published version does.
+* The release a machine running `from` must decide on before it runs `declared` (design 2026-10-22 §8.1), or null when
+* there is none: `declared` itself when it declares `needsDecision`; otherwise the release its `needsDecisionSince`
+* names, when that is after `from` — a decision this machine has not taken. One at or before `from` was taken when
+* that release was installed. Nothing else counts: no release the registry lists, hidden or added, decides anything.
+* A `from` that is not known, or not a version, cannot be shown to be past it, so it waits; a `since` after
+* `declared`, which no release check lets through, is said as `declared`.
 */
-function releasesBetween(packument, from, to) {
-	return Object.keys(packument.versions ?? {}).filter((version) => isVersion(version) && !isPrerelease(version) && !version.includes("+") && (compareVersions(version, from) ?? 0) > 0 && (compareVersions(version, to) ?? 1) <= 0).sort((a, b) => compareVersions(a, b) ?? 0);
+function decisionNeeded(declared, from) {
+	if (declared.needsDecision) return declared.version;
+	const since = declared.needsDecisionSince;
+	if (since === null) return null;
+	if (from !== null && (compareVersions(since, from) ?? 1) <= 0) return null;
+	return (compareVersions(since, declared.version) ?? 1) > 0 ? declared.version : since;
 }
 /** The oldest of `versions` that are versions, or null. */
 function oldestVersion(versions) {
@@ -16631,42 +16694,6 @@ async function verifyReleaseSet(sources, wanted, act = "update", noVerifierHint)
 	return verified;
 }
 /**
-* What every release after `from`, up to `latest`, declares (design 2026-10-16 U5, U7; security review of 0.20.0,
-* severity 6): a decision any of them needs — a later release that does not say so again does not end it — and whether
-* `latest` is a security fix. Each declaration acted on is verified first, with `verify`; one that does not verify, or
-* where nothing here can verify (`verify` null: a channel's process, which carries no Sigstore), counts for nothing.
-* `from` null reads `latest` alone. Throws when the registry's document cannot be read.
-*/
-async function declaredSince(registry, verify, packageName, from, latest) {
-	const { packument } = await registry(packageName);
-	const declared = (version) => releaseDeclaration(packument.versions?.[version]);
-	const range = from === null ? [] : releasesBetween(packument, from, latest);
-	const deciding = [.../* @__PURE__ */ new Set([...range, latest])].filter((version) => declared(version).needsDecision);
-	const verified = /* @__PURE__ */ new Map();
-	const check = async (version) => {
-		const known = verified.get(version);
-		if (known !== void 0) return known;
-		const integrity = releaseIntegrity(packument, version);
-		const ok = verify !== null && integrity !== null && await verify({
-			packageName,
-			version,
-			integrity
-		}).then((v) => v.ok);
-		verified.set(version, ok);
-		return ok;
-	};
-	const decisions = [];
-	for (const version of deciding) decisions.push({
-		version,
-		verified: await check(version)
-	});
-	return {
-		security: declared(latest).security && await check(latest),
-		needsDecision: decisions.some((decision) => decision.verified),
-		deciding: decisions
-	};
-}
-/**
 * Registering, pruning and listing every declared channel or service MCP server, from the core.
 *
 * `agentcomms mcp install` registers core or a declared service; `comms_server_install` registers any declared
@@ -16984,6 +17011,7 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 			});
 			const unverifiedOwn = fetches && deps.verifyRelease === void 0 && running !== void 0 && running.packageName === product.packageName && running.version === version;
 			const verified = fetches && !unverifiedOwn || checksDisk ? (await verifyReleaseSet(from, /* @__PURE__ */ new Map([[product.packageName, version]]), "install", from.registry === null || from.verify === null ? verifyInCore() : void 0)).get(product.packageName) : void 0;
+			if (request.print !== true && launcher === "npx" && target.writes && deps.verifyRelease !== void 0) await verifyReleaseSet(from, /* @__PURE__ */ new Map([[facts.npxPackage, version]]), "install");
 			planned = {
 				product,
 				install: plannedInstall(preflight),
@@ -17163,7 +17191,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.24.0"
+		version: "0.26.0"
 	};
 	const product = {
 		packageName,
@@ -17317,6 +17345,599 @@ Object.freeze([
 	"off"
 ]);
 Object.keys(STANDING_LIMITS);
+const UNPACKED_MAX_BYTES = 134217728;
+const NPM_REGISTRY = "https://registry.npmjs.org/";
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const BLOCK = 512;
+/** Where npm's own registry serves a release's tarball: `https://registry.npmjs.org/<name>/-/<file>-<version>.tgz`. */
+function canonicalTarballUrl(packageName, version) {
+	return `${NPM_REGISTRY}${packageName}/-/${packageName.split("/").at(-1) ?? packageName}-${version}.tgz`;
+}
+/** `value` as an absolute `http:` or `https:` address (against `base` when given), without a user or password. */
+function httpAddress(value, base) {
+	if (typeof value !== "string" || value.trim() === "") return null;
+	let url;
+	try {
+		url = base === void 0 ? new URL(value) : new URL(value, base);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	url.username = "";
+	url.password = "";
+	return url.href;
+}
+/**
+* `dist.tarball` of `version` when it is an absolute http(s) URL; otherwise null. A user and password in it are left
+* out: no credential is sent with a tarball request, so a mirror that needs one falls back to npm's address.
+*/
+function tarballLocation(packument, version) {
+	return httpAddress(packument.versions?.[version]?.dist?.tarball);
+}
+/**
+* The fetch a tarball is asked with, unless a caller hands in another: Node's own, asking for the bytes as they are
+* stored (`accept-encoding: identity` — otherwise it asks for a compressed transfer and decodes it), with no
+* credential and no cookie.
+*/
+const fetchTarball = (url, init) => fetch(url, {
+	...init,
+	headers: { "accept-encoding": "identity" },
+	credentials: "omit"
+});
+function discard(response) {
+	response.body?.cancel().catch(() => void 0);
+}
+/**
+* One location: its redirects followed by hand, at most five, each to http(s); its body counted as it arrives; ended
+* by its own time, or by `deadline` — the caller's — whichever is first.
+*/
+async function fetchOne(ask, url, timeoutMs, deadline) {
+	const own = AbortSignal.timeout(timeoutMs);
+	const signal = deadline === void 0 ? own : AbortSignal.any([own, deadline]);
+	let current = url;
+	try {
+		for (let redirects = 0;; redirects += 1) {
+			const response = await ask(current, {
+				redirect: "manual",
+				signal
+			});
+			if (REDIRECTS.has(response.status)) {
+				discard(response);
+				const next = httpAddress(response.headers.get("location"), current);
+				if (next === null || redirects >= 5) return {
+					ok: false,
+					problem: "download"
+				};
+				current = next;
+				continue;
+			}
+			if (!response.ok) {
+				discard(response);
+				return {
+					ok: false,
+					problem: "download"
+				};
+			}
+			const declared = Number(response.headers.get("content-length") ?? NaN);
+			if (Number.isFinite(declared) && declared > 33554432) {
+				discard(response);
+				return {
+					ok: false,
+					problem: "size"
+				};
+			}
+			if (response.body === null) return {
+				ok: true,
+				bytes: Buffer.alloc(0)
+			};
+			const reader = response.body.getReader();
+			const chunks = [];
+			let total = 0;
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				total += value.byteLength;
+				if (total > 33554432) {
+					reader.cancel().catch(() => void 0);
+					return {
+						ok: false,
+						problem: "size"
+					};
+				}
+				chunks.push(Buffer.from(value.buffer, value.byteOffset, value.byteLength));
+			}
+			return {
+				ok: true,
+				bytes: Buffer.concat(chunks, total)
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			problem: "download"
+		};
+	}
+}
+/** Of two failed downloads, the one that says more: bytes that came and were not the release's, then too many. */
+const RANK = {
+	download: 0,
+	size: 1,
+	digest: 2
+};
+/**
+* The release's tarball: from `location`, then — if that fails in any way — once from npm's canonical address, which
+* is never asked twice. Kept only when its sha512 is the verified one; otherwise the problem that says the most of the
+* two tries. A caller's `signal` ends it: what is being fetched is cut off, and nothing more is asked.
+*/
+async function downloadVerifiedTarball(release, location, options = {}) {
+	const ask = options.fetch ?? fetchTarball;
+	const timeoutMs = options.timeoutMs ?? 6e4;
+	const want = release.sha512.toLowerCase();
+	const canonical = canonicalTarballUrl(release.packageName, release.version);
+	const first = location === null ? null : httpAddress(location);
+	let problem = "download";
+	for (const place of first === null || first === canonical ? [canonical] : [first, canonical]) {
+		if (options.signal?.aborted) break;
+		const fetched = await fetchOne(ask, place, timeoutMs, options.signal);
+		let failed;
+		if (fetched.ok) {
+			if (createHash("sha512").update(fetched.bytes).digest("hex") === want) return fetched;
+			failed = "digest";
+		} else failed = fetched.problem;
+		if (RANK[failed] > RANK[problem]) problem = failed;
+	}
+	return {
+		ok: false,
+		problem
+	};
+}
+/** A header field's text: its bytes up to the first NUL. */
+function fieldText(header, at, width) {
+	const raw = header.subarray(at, at + width);
+	const end = raw.indexOf(0);
+	return raw.subarray(0, end === -1 ? width : end).toString("utf8");
+}
+/** A header's octal number, spaces around it allowed; null for base-256 (the high bit set) or anything not octal. */
+function octalField(header, at, width) {
+	if ((header[at] & 128) !== 0) return null;
+	const digits = fieldText(header, at, width).trim();
+	if (digits === "") return 0;
+	if (!/^[0-7]+$/.test(digits)) return null;
+	const value = Number.parseInt(digits, 8);
+	return Number.isSafeInteger(value) ? value : null;
+}
+/** The checksum ustar stores at 148: the header's byte sum, its own eight bytes read as spaces. */
+function checksumHolds(header) {
+	const stored = octalField(header, 148, 8);
+	if (stored === null) return false;
+	let sum = 0;
+	for (let at = 0; at < BLOCK; at += 1) sum += at >= 148 && at < 156 ? 32 : header[at];
+	return sum === stored;
+}
+/** A pax extended header's records, `<length> <key>=<value>\n` each; null when one is not that. */
+function paxRecords(data) {
+	const records = /* @__PURE__ */ new Map();
+	let at = 0;
+	while (at < data.length) {
+		if (data.subarray(at).every((byte) => byte === 0)) break;
+		const space = data.indexOf(32, at);
+		if (space === -1) return null;
+		const length = data.subarray(at, space).toString("latin1");
+		if (!/^[1-9]\d*$/.test(length)) return null;
+		const end = at + Number(length);
+		if (end > data.length || end <= space + 1 || data[end - 1] !== 10) return null;
+		const record = data.subarray(space + 1, end - 1).toString("utf8");
+		const equals = record.indexOf("=");
+		if (equals <= 0) return null;
+		records.set(record.slice(0, equals), record.slice(equals + 1));
+		at = end;
+	}
+	return records;
+}
+/**
+* An entry's path below `package/`, POSIX, with any leading `./` gone and empty or `.` segments dropped: `''` for the
+* folder itself. Null for anything outside `package/`, a `..` segment, or a backslash, which no npm pack writes and
+* which some file systems read as a separator.
+*/
+function belowPackage(name) {
+	let rest = name;
+	while (rest.startsWith("./")) rest = rest.slice(2);
+	if (rest.includes("\\")) return null;
+	const parts = rest.split("/");
+	if (parts[0] !== "package" || parts.includes("..")) return null;
+	return parts.slice(1).filter((part) => part !== "" && part !== ".").join("/");
+}
+function entryType(flag) {
+	if (flag === "0" || flag === "\0") return "file";
+	if (flag === "1" || flag === "2") return "link";
+	if (flag === "5") return "directory";
+	return "other";
+}
+/**
+* Every entry of a release's archive, in order: gunzipped with `node:zlib`, stopping past 128 MiB, then walked as
+* ustar — 512-byte headers, each checksum checked, to the first all-zero block. A pax `x` header's `path` and `size`,
+* and a GNU `L` long name, apply to the next entry. `package/` itself is not listed.
+*/
+function tarballEntries(gz) {
+	let tar;
+	try {
+		tar = gunzipSync(gz, { maxOutputLength: UNPACKED_MAX_BYTES });
+	} catch {
+		return {
+			ok: false,
+			problem: "gzip"
+		};
+	}
+	const broken = {
+		ok: false,
+		problem: "archive"
+	};
+	const entries = [];
+	let pax = {};
+	let longName;
+	for (let offset = 0; offset + BLOCK <= tar.length;) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		if (header.every((byte) => byte === 0)) break;
+		if (!checksumHolds(header)) return broken;
+		const ownSize = octalField(header, 124, 12);
+		if (ownSize === null) return broken;
+		const flag = String.fromCharCode(header[156]);
+		const size = flag === "x" || flag === "L" || flag === "K" || flag === "g" ? ownSize : pax.size ?? ownSize;
+		const start = offset + BLOCK;
+		if (start + size > tar.length) return broken;
+		const data = tar.subarray(start, start + size);
+		offset = start + Math.ceil(size / BLOCK) * BLOCK;
+		if (flag === "g") return broken;
+		if (flag === "x") {
+			const records = paxRecords(data);
+			if (records === null) return broken;
+			const path = records.get("path");
+			const paxSize = records.get("size");
+			if (paxSize !== void 0 && !/^\d+$/.test(paxSize)) return broken;
+			pax = {
+				...pax,
+				...path !== void 0 ? { path } : {},
+				...paxSize !== void 0 ? { size: Number(paxSize) } : {}
+			};
+			if (pax.size !== void 0 && !Number.isSafeInteger(pax.size)) return broken;
+			continue;
+		}
+		if (flag === "L") {
+			const end = data.indexOf(0);
+			longName = data.subarray(0, end === -1 ? data.length : end).toString("utf8");
+			continue;
+		}
+		if (flag === "K") continue;
+		const prefix = fieldText(header, 257, 6) === "ustar" ? fieldText(header, 345, 155) : "";
+		const own = fieldText(header, 0, 100);
+		const name = pax.path ?? longName ?? (prefix === "" ? own : `${prefix}/${own}`);
+		pax = {};
+		longName = void 0;
+		const path = belowPackage(name);
+		const type = entryType(flag);
+		if (path === null) return broken;
+		if (path === "") {
+			if (type === "directory") continue;
+			return broken;
+		}
+		entries.push({
+			path,
+			type,
+			data
+		});
+	}
+	return {
+		ok: true,
+		entries
+	};
+}
+/**
+* The release's `package/package.json`, as an object: exactly one entry by that name (in any case), a regular file of
+* at most 1 MiB, holding a JSON object. Anything else is `manifest`; an archive that cannot be walked, `archive`.
+*/
+function tarballManifest(gz) {
+	const read = tarballEntries(gz);
+	if (!read.ok) return read;
+	const none = {
+		ok: false,
+		problem: "manifest"
+	};
+	const named = read.entries.filter((entry) => entry.path.toLowerCase() === "package.json");
+	const [entry] = named;
+	if (named.length !== 1 || entry === void 0) return none;
+	if (entry.path !== "package.json" || entry.type !== "file" || entry.data.length > 1048576) return none;
+	let manifest;
+	try {
+		manifest = JSON.parse(entry.data.toString("utf8").replace(/^/, ""));
+	} catch {
+		return none;
+	}
+	if (manifest === null || typeof manifest !== "object" || Array.isArray(manifest)) return none;
+	return {
+		ok: true,
+		manifest
+	};
+}
+const REMOVED_GLOBALS_FILE = "removed-globals.json";
+function isTime(value) {
+	if (typeof value !== "string") return false;
+	const at = new Date(value);
+	return !Number.isNaN(at.getTime()) && at.toISOString() === value;
+}
+/**
+* The globals recorded for the next update to reinstall, each once: none when there is no record or it cannot be
+* read. Only a name of this suite and a plain release are read from it.
+*/
+async function readRemovedGlobals(stateDir) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(join(stateDir, REMOVED_GLOBALS_FILE), "utf8"));
+	} catch {
+		return [];
+	}
+	const listed = typeof parsed === "object" && parsed !== null ? parsed.removed : void 0;
+	if (!Array.isArray(listed)) return [];
+	const removed = [];
+	for (const item of listed) {
+		if (typeof item !== "object" || item === null) continue;
+		const { package: name, version, removedAt } = item;
+		if (typeof name !== "string" || !SUITE_NAME.test(name) || typeof version !== "string") continue;
+		if (!isPlainVersion(version) || !isTime(removedAt)) continue;
+		if (removed.some((one) => one.package === name)) continue;
+		removed.push({
+			package: name,
+			version,
+			removedAt
+		});
+	}
+	return removed;
+}
+/** A name of this suite, as npm writes one: only then is it said in a detail. */
+const SUITE_NAME = /^@agentcomms\/[a-z0-9][a-z0-9._-]{0,213}$/;
+/**
+* What a release declares — a security fix, a decision it needs from the person — read from its verified tarball, and
+* never from the registry (design 2026-10-22 P1). The registry's copy of a manifest is the registry's word: a mirror
+* could add or remove either flag on a genuine release. The tarball whose sha512 is the verified provenance digest is
+* the release's own.
+*
+* What was read is kept per integrity, content-free — the version, the integrity, the two flags and the release a
+* needed decision is carried from (design 2026-10-22 §8.1), never a word of the manifest — in
+* `<state>/release-declarations.json`, so neither the daily check nor the background run downloads a release it read.
+* A declaration that cannot be read is unknown: it is never cached, so the next check or run tries it again, and the
+* caller fails closed. The cache saves downloads, not verification: the caller verifies the release first, every time.
+*/
+const DECLARATIONS_FILE = "release-declarations.json";
+const LOCK_FILE = ".release-declarations.lock";
+const INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+function declarationsPath(stateDir) {
+	return join(stateDir, DECLARATIONS_FILE);
+}
+/**
+* A record as the cache keeps it, or null for anything else: only these five keys, each of its type. One without
+* `needsDecisionSince`, as a build before it was carried wrote, is no record: it costs a download, never a decision.
+*/
+function recordOf(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const { version, integrity, security, needsDecision, needsDecisionSince } = value;
+	if (!isVersion(version) || typeof integrity !== "string" || !INTEGRITY.test(integrity)) return null;
+	if (typeof security !== "boolean" || typeof needsDecision !== "boolean") return null;
+	if (needsDecisionSince !== null && !isPlainVersion(needsDecisionSince)) return null;
+	return {
+		version,
+		integrity,
+		security,
+		needsDecision,
+		needsDecisionSince
+	};
+}
+/** The cache's records; a file that is missing or cannot be read counts as empty. */
+async function readCache(stateDir) {
+	try {
+		const listed = JSON.parse(await readFile(declarationsPath(stateDir), "utf8"))?.declarations;
+		if (!Array.isArray(listed)) return [];
+		return listed.map(recordOf).filter((record) => record !== null);
+	} catch {
+		return [];
+	}
+}
+/**
+* Adds one record, under the cache's lock, to the file as it is then — so two processes reading at once each keep
+* the other's — keeping the newest 64. Best effort: a write that fails changes no answer, and costs a download later.
+*/
+async function remember(stateDir, record) {
+	try {
+		await withFileLock(join(stateDir, LOCK_FILE), async () => {
+			const declarations = [...(await readCache(stateDir)).filter((one) => one.integrity !== record.integrity || one.version !== record.version), record].slice(-64);
+			await writeFileAtomic(declarationsPath(stateDir), `${JSON.stringify({ declarations }, null, 2)}\n`);
+		});
+	} catch {}
+}
+/**
+* What a verified release declares: from the cache, by its integrity and version, or else from its tarball — the bytes
+* whose sha512 is `provenance.sha512`, from `location` or npm's canonical address — whose `package/package.json` must
+* name the release itself. Unknown, with the problem, when it cannot be read, or when `signal` ends the read first. A
+* known declaration is cached unless `writeCache` is false (a dry run); an unknown one never is.
+*/
+async function readVerifiedDeclaration(provenance, location, options) {
+	const { version } = provenance;
+	const integrity = `sha512-${Buffer.from(provenance.sha512, "hex").toString("base64")}`;
+	const hit = (await readCache(options.stateDir)).find((record) => record.integrity === integrity && record.version === version);
+	if (hit !== void 0) {
+		const { security, needsDecision, needsDecisionSince } = hit;
+		return {
+			known: true,
+			version,
+			security,
+			needsDecision,
+			needsDecisionSince,
+			from: "cache"
+		};
+	}
+	const download = await downloadVerifiedTarball({
+		packageName: provenance.package,
+		version,
+		sha512: provenance.sha512
+	}, location, {
+		...options.fetch !== void 0 ? { fetch: options.fetch } : {},
+		...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
+		...options.signal !== void 0 ? { signal: options.signal } : {}
+	});
+	if (!download.ok) return {
+		known: false,
+		version,
+		problem: download.problem
+	};
+	const read = tarballManifest(download.bytes);
+	if (!read.ok) return {
+		known: false,
+		version,
+		problem: read.problem
+	};
+	if (read.manifest.name !== provenance.package || read.manifest.version !== version) return {
+		known: false,
+		version,
+		problem: "identity"
+	};
+	const { security, needsDecision, needsDecisionSince } = releaseDeclaration(read.manifest);
+	if (options.writeCache !== false) await remember(options.stateDir, {
+		version,
+		integrity,
+		security,
+		needsDecision,
+		needsDecisionSince
+	});
+	return {
+		known: true,
+		version,
+		security,
+		needsDecision,
+		needsDecisionSince,
+		from: "tarball"
+	};
+}
+/**
+* What the release an update goes to declares, believed only from its verified tarball (design 2026-10-22 P1, P2,
+* §8.1): for the daily check's record, `update --check`, and the by-hand update's preview.
+*
+* Only that one release is read. A needed decision is carried forward from release to release in core's
+* `agentcommsRelease.needsDecisionSince`, which the release check holds to the changelog, so the release an update goes
+* to says itself whether a release on the way needed one: which versions the registry lists decides nothing. A registry
+* or mirror that leaves out the release needing a decision, adds an unverifiable one, or lists five hundred, changes no
+* fact and costs no request.
+*
+* The registry's document is read once, for that release's integrity and where its tarball is — never for what it
+* declares: a registry or a mirror can add or remove either flag on a genuine release. The release is verified, and
+* then its declaration read (`readVerifiedDeclaration`) from the bytes whose sha512 its verified provenance signs. One
+* that does not verify, that the registry gives no integrity for, whose tarball cannot be read, or whose read is cut off
+* by its deadline is *unknown*, and counts for nothing either way: neither a security fix nor its absence, neither a
+* decision nor none.
+*
+* Only core reads these, since only core carries the verifier: a channel's process reads none (`releaseFactsReader`).
+* No Sigstore here, and nothing runs when this module is loaded: WhatsApp's bundle, which reaches the module that
+* imports this one, drops it.
+*/
+/**
+* How long a check gives its target's declaration — its document, its verification and its tarball, from both places —
+* before it counts it unknown (review B of 0.26.0, finding 2). A check runs under a claim of `UPDATE_CHECK_LEASE_MS`,
+* two minutes, which also holds the registry's ten seconds for `latest`, `npm ls`'s minute and up to 15 seconds for
+* the record's lock: 30 seconds beside them still records inside the lease, where a tarball's two tries of a minute
+* each did not, and the check's finding was dropped as superseded.
+*/
+const DECLARATION_DEADLINE_MS = 3e4;
+/**
+* What `version` declares, read from its verified tarball, and nothing of any other release. Unknown when the
+* registry's document cannot be read or gives no integrity for it, when it does not verify, when its tarball cannot be
+* read, or when `signal` ends the read first. Never throws.
+*/
+async function targetDeclaration(sources, packageName, version, options = {}) {
+	const unknown = {
+		known: false,
+		version
+	};
+	try {
+		const { packument } = await sources.registry(packageName);
+		const integrity = releaseIntegrity(packument, version);
+		if (integrity === null || options.signal?.aborted) return unknown;
+		const verdict = await sources.verify({
+			packageName,
+			version,
+			integrity
+		});
+		if (!verdict.ok || options.signal?.aborted) return unknown;
+		const read = await readVerifiedDeclaration(verdict.provenance, tarballLocation(packument, version), {
+			stateDir: sources.stateDir,
+			...sources.tarballs !== void 0 ? { fetch: sources.tarballs } : {},
+			...options.signal !== void 0 ? { signal: options.signal } : {}
+		});
+		if (!read.known) return unknown;
+		const { security, needsDecision, needsDecisionSince } = read;
+		return {
+			known: true,
+			version,
+			security,
+			needsDecision,
+			needsDecisionSince
+		};
+	} catch {
+		return unknown;
+	}
+}
+/**
+* `read`, given `deadlineMs` at most: unknown once that has passed, and the read cut off then — never a guess of
+* `false`. The timer is cleared as soon as the read is done.
+*/
+async function withinDeadline(read, version, deadlineMs = DECLARATION_DEADLINE_MS) {
+	const controller = new AbortController();
+	let timer;
+	const passed = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			controller.abort();
+			resolve({
+				known: false,
+				version
+			});
+		}, deadlineMs);
+	});
+	try {
+		return await Promise.race([read(controller.signal), passed]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* What the release declares for a machine whose oldest release is `from` (design 2026-10-22 §8.1): its own security
+* flag, and a decision when it declares one or carries one after `from` (`decisionNeeded`).
+*/
+function declaredFor(declared, from) {
+	if (!declared.known) return {
+		security: null,
+		needsDecision: null,
+		deciding: null,
+		unread: true
+	};
+	const deciding = decisionNeeded(declared, from);
+	return {
+		security: declared.security,
+		needsDecision: deciding !== null,
+		deciding,
+		unread: false
+	};
+}
+/** The record's facts for `version`: null unless its declaration was read. */
+function factsOf(version, declared) {
+	const { security, needsDecision } = declared;
+	return security === null || needsDecision === null ? null : {
+		version,
+		security,
+		needsDecision
+	};
+}
 /**
 * Bringing a machine to the latest release, from a terminal (`agentcomms update`) or a chat (`comms_update`).
 *
@@ -17485,6 +18106,7 @@ async function inspect(core, env, deps) {
 			package: server.args.some((arg) => arg.startsWith(`${facts.npxPackage}@`)) ? facts.npxPackage : facts.packageName
 		};
 	});
+	const removedGlobals = (await readRemovedGlobals(core.paths.stateDir)).filter((one) => PUBLISHED_NAMES.includes(one.package));
 	let installed = {};
 	try {
 		const listed = await (deps.globalPackages ?? (() => npmGlobalPackages(env, PUBLISHED_NAMES)))();
@@ -17502,6 +18124,7 @@ async function inspect(core, env, deps) {
 		wanted.add(entry.package);
 	}
 	for (const name of Object.keys(installed)) wanted.add(name);
+	for (const removed of removedGlobals) wanted.add(removed.package);
 	const latest = await latestReleases([...wanted].sort(), deps.latestVersion ?? ((name) => npmLatestVersion(name, { env })));
 	let config = null;
 	try {
@@ -17603,16 +18226,19 @@ async function inspect(core, env, deps) {
 	}
 	const globals = [];
 	for (const name of PUBLISHED_NAMES) {
-		const version = installed[name];
+		const removed = removedGlobals.find((one) => one.package === name);
+		const version = installed[name] ?? removed?.version;
 		const newestRelease = latest[name];
 		if (version === void 0 || newestRelease === void 0) continue;
+		const reinstall = removed !== void 0 && !isBehind(version, newestRelease);
 		const item = {
 			kind: "global",
 			package: name,
 			version,
-			latest: newestRelease
+			latest: newestRelease,
+			...reinstall ? { reinstall: true } : {}
 		};
-		if (isBehind(version, newestRelease)) {
+		if (reinstall || isBehind(version, newestRelease)) {
 			behind.push(item);
 			globals.push(item);
 		} else upToDate.push(item);
@@ -17647,54 +18273,87 @@ async function inspect(core, env, deps) {
 */
 async function updateCheck(core, env, deps = {}, claim) {
 	const { report } = await inspect(core, env, deps);
-	await recordFound(core, env, report, deps, null, claim, await releaseOf(report, env, deps));
+	await recordFound(core, env, report, deps, null, claim, await releaseOf(core, report, env, deps));
 	return report;
 }
 /**
-* What the latest release's core manifest declares, for the daily check's file — or null, where it is not to be read
-* or could not be: never a reason for the check to fail. Read only for a release newer than nothing — a counted one.
+* What the latest release's core manifest declares, for the daily check's file, as its verified tarball says (design
+* 2026-10-22 P1, §8.1): the facts when it was read; null when this check read it and it could not be read; and
+* undefined where this process reads none — a channel's, with no verifier, or a test's stand-in registry (P2). For
+* null and undefined alike the record keeps what core's verified check found of the same version, and otherwise makes
+* no claim. Never a reason for the check to fail.
 */
-async function releaseOf(report, env, deps) {
+async function releaseOf(core, report, env, deps) {
 	const latest = report.latest[CORE_PACKAGE$1];
-	if (latest === void 0 || !isPlainVersion(latest)) return null;
-	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps);
-	if (read === null) return null;
+	if (latest === void 0 || !isPlainVersion(latest)) return void 0;
+	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps, core.paths.stateDir);
+	if (read === null) return void 0;
 	try {
-		return {
+		const facts = await read(CORE_PACKAGE$1, latest, oldestHere(report));
+		return facts === null ? null : {
 			version: latest,
-			...await read(CORE_PACKAGE$1, latest, oldestHere(report))
+			security: facts.security,
+			needsDecision: facts.needsDecision
 		};
 	} catch {
 		return null;
 	}
 }
 /**
-* The oldest release this machine runs, as the report saw it — what every release after it is read for: the core
-* answering, and every registration, runtime and global package behind.
+* The oldest release this machine runs, as the report saw it — what a decision the latest carries is counted from: the
+* core answering, and every registration, runtime and global package behind.
 */
 function oldestHere(report) {
 	return oldestVersion([report.core, ...report.behind.map((item) => item.version)]);
 }
 /**
-* The daily check's and `update --check`'s reader of what releases declare (`declaredSince`): the registry handed in,
-* or the one npm reads — but only beside the registry's own `latest`: a test with a stand-in `latestVersion` hands in
-* `releaseFacts` itself, or none is read. With the verifier handed in, and none where none was: a channel's process
-* carries no Sigstore, so what it reads counts for nothing. Each package's document is read once, however often asked.
-*/
-function releaseFactsReader(env, deps) {
-	if (deps.latestVersion !== void 0) return null;
-	const read = deps.registry ?? npmRegistry(env);
-	const documents = /* @__PURE__ */ new Map();
-	const registry = (packageName) => {
-		const known = documents.get(packageName) ?? read(packageName);
-		documents.set(packageName, known);
-		return known;
+* The daily check's and `update --check`'s reader of what a release declares (design 2026-10-22 P1, §8.1): the release
+* verified, then its declaration read from its tarball and cached in `stateDir`; its facts for each machine's `from`,
+* or null when it could not be read (`factsOf`). Nothing of any other release is read: a needed decision is carried in
+* the release itself.
+*
+* Each release is read once however often it is asked — the check asks once for the core answering, and again for the
+* oldest release it finds here — and known or unknown, the answer stands for the reader's life: an unreadable tarball
+* is asked for at most twice in a check, at its location and at npm's own address (review B of 0.26.0, finding 2).
+* And the read is given `deadlineMs` at most (`DECLARATION_DEADLINE_MS` unless a test gives another), and stops at
+* `deadline` — a time, by `Date.now()` — when that comes first: the day's check passes its claim's time plus
+* `DECLARATION_DEADLINE_MS`, well inside the claim, however late its ask began. After it the read is unknown — never
+* false — and cut off, and one not started by then is not started at all, so the check records what it found while
+* its claim is still its own.
+*
+* The registry handed in, or the one npm reads — but only beside the registry's own `latest`: a test with a stand-in
+* `latestVersion` hands in `releaseFacts` itself, or none is read. And only with a verifier (P2): a channel's process
+* carries no Sigstore, so it reads nothing a release declares — no document, no tarball — and its check keeps what
+* core's verified check recorded.
+*/
+function releaseFactsReader(env, deps, stateDir, options = {}) {
+	const verify = deps.verifyRelease;
+	if (deps.latestVersion !== void 0 || verify === void 0) return null;
+	const sources = {
+		registry: deps.registry ?? npmRegistry(env),
+		verify,
+		stateDir,
+		tarballs: deps.tarballs
+	};
+	const declarations = /* @__PURE__ */ new Map();
+	const declarationOf = (packageName, version) => {
+		const key = `${packageName}@${version}`;
+		let read = declarations.get(key);
+		if (read === void 0) {
+			const left = Math.min(options.deadlineMs ?? 3e4, options.deadline === void 0 ? Number.POSITIVE_INFINITY : options.deadline - Date.now());
+			read = left > 0 ? withinDeadline((signal) => targetDeclaration(sources, packageName, version, { signal }), version, left) : Promise.resolve({
+				known: false,
+				version
+			});
+			declarations.set(key, read);
+		}
+		return read;
 	};
 	return async (packageName, version, from = null) => {
-		const { security, needsDecision } = await declaredSince(registry, deps.verifyRelease ?? null, packageName, from, version);
-		return {
-			security,
-			needsDecision
+		const facts = factsOf(version, declaredFor(await declarationOf(packageName, version), from));
+		return facts === null ? null : {
+			security: facts.security,
+			needsDecision: facts.needsDecision
 		};
 	};
 }
@@ -17730,25 +18389,34 @@ const registrationKey = (entry) => [
 * when this is that background check's own finding, is the claim it was made under: the finding is dropped when the
 * file no longer holds it, because something newer — a check a person asked for, an update — was written meanwhile.
 * The machine it describes was read before that, and put back it would say "update" where "restart" is right.
+*
+* Says how it went: `written`; `busy`, when the file's lock stayed held past its bound, so an update can try once
+* more (design 2026-10-22, R2); and `unchanged` for everything else — switched off, a claim given up, or a write that
+* failed for any other reason, each left as it always was.
 */
 async function recordFound(core, env, report, deps, after = null, claim, release) {
 	const latest = report.latest[CORE_PACKAGE$1];
-	if (updateCheckSwitchedOff(env) !== null || latest === void 0 || !isVersion(latest)) return;
+	if (updateCheckSwitchedOff(env) !== null || latest === void 0 || !isVersion(latest)) return "unchanged";
 	const at = (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
 	const { behind, current } = updateCheckFindings(report, latest, after);
 	const moves = movesLeft(report, after);
-	const facts = (record) => release !== void 0 ? release : record.release?.version === latest ? record.release : null;
-	await changeUpdateCheck(core.paths.stateDir, (record) => claim !== void 0 && record.checking !== claim ? null : { record: {
-		...record,
-		lastChecked: at,
-		latest,
-		behind,
-		current,
-		lastError: null,
-		checking: null,
-		release: facts(record),
-		moves
-	} }).catch(() => void 0);
+	const facts = (record) => release ?? (record.release?.version === latest ? record.release : null);
+	try {
+		const { written } = await changeUpdateCheck(core.paths.stateDir, (record) => claim !== void 0 && record.checking !== claim ? null : { record: {
+			...record,
+			lastChecked: at,
+			latest,
+			behind,
+			current,
+			lastError: null,
+			checking: null,
+			release: facts(record),
+			moves
+		} });
+		return written ? "written" : "unchanged";
+	} catch (error) {
+		return toCommsError(error).code === "LOCK_TIMEOUT" ? "busy" : "unchanged";
+	}
 }
 /**
 * How many managed registrations still name a versioned runtime once `after` is done, for the notice (design
@@ -17798,7 +18466,7 @@ function updateCheckFindings(report, latest, after = null) {
 	const globals = items.filter((item) => item.kind === "global");
 	const global = CHANNELS.filter((channel) => {
 		const name = serverFacts(channel).packageName;
-		return globals.some((item) => item.package === name && atLatest(installed.has(name) ? item.latest : item.version));
+		return globals.some((item) => item.package === name && atLatest(installed.has(name) ? item.latest : item.reinstall ? null : item.version));
 	});
 	const stillBehind = after === null ? report.behind.length > 0 : !(after.ok && after.manual.length === 0 && after.status !== "manual");
 	const unknown = report.unreadable.length > 0 || report.unpinned.length > 0;
@@ -17909,7 +18577,7 @@ async function decideNotice(options, where) {
 		};
 	};
 	if (due(await readUpdateCheck(options.core.paths.stateDir), now()) === null) return null;
-	return (await changeUpdateCheck(options.core.paths.stateDir, (record) => {
+	const decide = (record) => {
 		const at = now();
 		const decision = due(record, at);
 		if (decision === null) return null;
@@ -17933,7 +18601,8 @@ async function decideNotice(options, where) {
 				}
 			}
 		};
-	})).result ?? null;
+	};
+	return (await changeUpdateCheck(options.core.paths.stateDir, decide, UPDATE_NOTICE_LOCK)).result ?? null;
 }
 /**
 * What a background run left, when it is this process's to say: an install only to a process running a release before
@@ -18101,7 +18770,7 @@ async function securityNotice(options) {
 					record: withSecurityShown(record, now, approvalId),
 					result: now
 				};
-			});
+			}, UPDATE_NOTICE_LOCK);
 			if (decided.result === void 0) return null;
 			shown = decided.result;
 		}
@@ -18257,7 +18926,7 @@ async function checkForUpdates(core, env, options = {}) {
 			asked: false,
 			record: await readUpdateCheck(stateDir)
 		};
-		await askUnderClaim(core, env, claimedAt, options);
+		if (!(options.handOff !== void 0 && options.deps === void 0 && await handToCore(core, env, claimedAt, options.handOff, Date.now() + 12e4))) await askUnderClaim(core, env, claimedAt, options);
 		return {
 			asked: true,
 			record: await readUpdateCheck(stateDir)
@@ -18278,6 +18947,11 @@ async function checkForUpdates(core, env, options = {}) {
 * claim written before anyone asks, so of two processes that both found it a day old, one asks. The time is read under
 * the lock too: read before it, the second process's time could be earlier than the first's claim, which reads as a
 * clock gone back.
+*
+* A claim is best effort, as a notice is (`UPDATE_NOTICE_LOCK`): 2 s at most for the lock, however often it changes
+* hands meanwhile, then null, and a later process claims. Every command's and every tool call's check claims here,
+* before the person's output is done; waited out holder by holder, as a record that matters waits, a busy machine's
+* refreshes kept a finished command's process and its stdout open for up to 15 s (0.26.0 review B).
 */
 async function claimUpdateCheck(core, options = {}) {
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -18294,7 +18968,7 @@ async function claimUpdateCheck(core, options = {}) {
 			},
 			result: checking
 		};
-	}).catch(() => null))?.result ?? null;
+	}, UPDATE_NOTICE_LOCK).catch(() => null))?.result ?? null;
 }
 /**
 * The ask, under a claim already taken (`claimUpdateCheck`): the registry, then `comms_update`'s own check. What it
@@ -18319,7 +18993,7 @@ async function ask(core, env, options) {
 	*/
 	const settle = (found) => changeUpdateCheck(core.paths.stateDir, (record) => record.checking === options.claimedAt ? { record: {
 		...record,
-		...found,
+		...typeof found === "function" ? found(record) : found,
 		lastChecked: options.claimedAt,
 		checking: null
 	} } : null).catch(() => void 0);
@@ -18341,12 +19015,12 @@ async function ask(core, env, options) {
 		});
 		return;
 	}
-	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps);
-	const release = read === null ? null : await read(CORE_PACKAGE, latest, VERSION).then((facts) => ({
+	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps, core.paths.stateDir, { deadline: Date.parse(options.claimedAt) + DECLARATION_DEADLINE_MS });
+	const release = read === null ? void 0 : await read(CORE_PACKAGE, latest, VERSION).then((facts) => facts === null ? null : {
 		version: latest,
 		security: facts.security,
 		needsDecision: facts.needsDecision
-	}), () => null);
+	}, () => null);
 	try {
 		await updateCheck(core, env, {
 			...deps,
@@ -18355,13 +19029,13 @@ async function ask(core, env, options) {
 			now: options.now
 		}, options.claimedAt);
 	} catch (error) {
-		await settle({
+		await settle((record) => ({
 			latest,
 			behind: null,
 			current: null,
 			lastError: reason(error),
-			release
-		});
+			release: release ?? (record.release?.version === latest ? record.release : null)
+		}));
 	}
 }
 /**
@@ -18480,8 +19154,13 @@ function updateCheckChildEnvironment(env, platform = process.platform) {
 * message — or whatever reads that output would wait for the child as it waited for the check. Detached, so a
 * Ctrl-C at the terminal does not cut the ask short, and hidden, so Windows opens no console for it.
 *
-* When the child cannot be started — no entry to start, a program not there or not allowed — the check is asked in
-* this process instead, as it was before. It never throws.
+* A channel's command hands the ask to core's CLI first (design 2026-10-22, P2): core's command, located at the
+* channel's own version, with the same hidden command, the same claim and the same environment. Core's child verifies
+* what a release declares, which the channel's own could not.
+*
+* When the child cannot be started — no core, no entry to start, a program not there or not allowed, a `.cmd` that
+* would need a shell, a launcher whose Node was removed, which starts and ends at once — the next is tried: the
+* channel's own child, then the check in this process, as it was before. It never throws.
 */
 async function handUpdateCheckToChild(core, env, options) {
 	const deadline = Date.now() + TERMINAL_CHECK_WAIT_MS;
@@ -18493,59 +19172,127 @@ async function handUpdateCheckToChild(core, env, options) {
 			intervalMs: enabled.intervalMs
 		});
 		if (claimedAt === null) return;
+		if (options.handOff !== void 0 && await handToCore(core, env, claimedAt, options.handOff, deadline)) return;
 		const entry = options.entry === void 0 ? updateCheckChildEntry() : options.entry;
-		if (!(entry !== null && await startUpdateCheckChild(entry, claimedAt, core.paths, env, deadline))) await askUnderClaim(core, env, claimedAt, {
+		if (!(entry !== null && await startedSafely(options.handOff?.start ?? startCheckChild, ownChildWords(entry, claimedAt, core.paths), updateCheckChildEnvironment(env), deadline))) await askUnderClaim(core, env, claimedAt, {
 			now: options.now,
 			...options.verifyRelease ? { deps: { verifyRelease: options.verifyRelease } } : {}
 		});
 	} catch {}
 }
+/** This CLI again, as its child: the entry, every folder pinned, the hidden command and the claim. */
+function ownChildWords(entry, claimedAt, paths) {
+	const pathArgs = PATH_OPTIONS.flatMap(({ key, flag }) => [flag, paths[key]]);
+	return [
+		entry.command,
+		...entry.args,
+		...pathArgs,
+		UPDATE_CHECK_CHILD_COMMAND,
+		claimedAt
+	];
+}
+/**
+* Core's own command for `update-check-child <claimedAt>`, as the words to start: `core.handoffs.core(…)` with every
+* folder pinned, located as the channel finds core — its installed dependency, at exactly the channel's own version,
+* through the stable way in a managed runtime keeps (`locateCliCommand`). Locating checks files and runs nothing.
+*
+* Located for this process's own system, whatever shell its printed commands are quoted for: these words are started
+* here, and a managed runtime's stable launcher is started one way on Windows and another elsewhere.
+*
+* Null for core's own process, which asks itself and is never handed its own check; for a core opened without its
+* caller, which can locate nothing; and where no such core is found.
+*/
+function coreUpdateCheckWords(core, claimedAt) {
+	if (core.handoffs === void 0 || core.handoffs.caller.packageName === CORE_PACKAGE) return null;
+	try {
+		const handoff = requireHandoffs(core, process.platform).core([UPDATE_CHECK_CHILD_COMMAND, claimedAt], { downloads: true });
+		return isCommand(handoff) ? handoff.words : null;
+	} catch {
+		return null;
+	}
+}
 /**
-* Starts the child and waits, until `deadline` at most, for it to say the ask is over, or to end. False when it could
-* not be started at all; then nothing was asked, and the claim is still this process's to ask under.
+* The ask handed to core's CLI (design 2026-10-22, P2): its command located (`handOff.locate`), started with the
+* claim and this command's child environment (`handOff.start`), and waited for until `deadline`. False when there is
+* no such command, or it did not start: then nothing was asked, and the claim is still this process's to ask under. It
+* never throws.
 */
-async function startUpdateCheckChild(entry, claimedAt, paths, env, deadline) {
+async function handToCore(core, env, claimedAt, handOff, deadline) {
+	let words;
+	try {
+		words = (handOff.locate ?? coreUpdateCheckWords)(core, claimedAt);
+	} catch {
+		return false;
+	}
+	if (words === null || words.length === 0) return false;
+	return startedSafely(handOff.start ?? startCheckChild, words, updateCheckChildEnvironment(env), deadline);
+}
+/** A start's answer, with one that throws counted as not started: the fallback after it is all that is left. */
+async function startedSafely(start, words, env, deadline) {
+	try {
+		return await start(words, env, deadline) === true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Starts `words` — a program, then its arguments — detached and hidden, with no shell and `env` as given, and waits,
+* until `deadline` at most, for it to say the ask is over, or to end. False when it could not be started at all, or
+* when it ended with a code other than 0, or by a signal, before it said the ask is over — a launcher whose Node was
+* removed starts, and ends at once with 127 (0.26.0 review B). Either way nothing was asked, and the claim is still
+* this process's to ask under.
+*
+* Never through a shell: each word is one argument, as located, and nothing in them is read as a shell would read it.
+* A program only a shell could start — a Windows `.cmd` or `.bat`, which Node refuses without one (EINVAL) — is not
+* started, and the caller falls back.
+*/
+async function startCheckChild(words, env, deadline) {
+	const [command, ...args] = words;
+	if (command === void 0) return false;
 	let child;
 	try {
-		const pathArgs = PATH_OPTIONS.flatMap(({ key, flag }) => [flag, paths[key]]);
-		child = spawn(entry.command, [
-			...entry.args,
-			...pathArgs,
-			UPDATE_CHECK_CHILD_COMMAND,
-			claimedAt
-		], {
+		child = spawn(command, args, {
 			detached: true,
 			windowsHide: true,
+			shell: false,
 			stdio: [
 				"ignore",
 				"ignore",
 				"ignore",
 				"ipc"
 			],
-			env: updateCheckChildEnvironment(env)
+			env
 		});
 	} catch {
 		return false;
 	}
-	let failed = false;
-	child.on("error", () => {
-		if (child.pid === void 0) failed = true;
-	});
-	await new Promise((resolve) => {
-		const timer = setTimeout(resolve, Math.max(0, deadline - Date.now()));
-		const done = () => {
+	child.on("error", () => void 0);
+	const started = await new Promise((resolve) => {
+		const timer = setTimeout(() => resolve(true), Math.max(0, deadline - Date.now()));
+		const done = (started) => {
 			clearTimeout(timer);
-			resolve();
+			resolve(started);
 		};
-		child.once("error", done);
-		child.once("exit", done);
+		child.once("error", () => done(child.pid !== void 0));
 		child.on("message", (message) => {
-			if (message?.type === "settled") done();
+			if (message?.type === "settled") done(true);
+		});
+		let ended = null;
+		const over = () => {
+			if (ended !== null && !child.connected) done(ended.code === 0 && ended.signal === null);
+		};
+		child.once("exit", (code, signal) => {
+			ended = {
+				code,
+				signal
+			};
+			over();
 		});
+		child.once("disconnect", over);
 	});
 	if (child.connected) child.disconnect();
 	child.unref();
-	return !failed;
+	return started;
 }
 /**
 * The hidden command's work, in the child a command started (`UPDATE_CHECK_CHILD_COMMAND`): the ask, under the claim
@@ -18557,7 +19304,7 @@ async function startUpdateCheckChild(entry, claimedAt, paths, env, deadline) {
 async function runUpdateCheckChild(core, env, claimedAt, options = {}) {
 	if (claimedAt === void 0 || !Number.isFinite(Date.parse(claimedAt))) throw new CommsError("USAGE", `${UPDATE_CHECK_CHILD_COMMAND} takes the time of the claim it asks under`, { hint: handoffSentence(requireHandoffs(core).core(["update", "--check"]), (command) => `Nothing runs this but a command finishing the day’s update check; ${command} asks now.`) });
 	try {
-		if ((await readUpdateCheck(core.paths.stateDir)).checking === claimedAt) await askUnderClaim(core, env, claimedAt, options.verifyRelease ? { deps: { verifyRelease: options.verifyRelease } } : {});
+		if ((await readUpdateCheck(core.paths.stateDir)).checking === claimedAt) await askUnderClaim(core, env, claimedAt, options.deps !== void 0 ? { deps: options.deps } : {});
 	} finally {
 		settled();
 	}
@@ -18586,12 +19333,13 @@ function terminalUpdateHooks(core, env, options = {}) {
 		await handUpdateCheckToChild(core, env, {
 			now: options.now,
 			entry: options.childEntry,
-			verifyRelease: options.verifyRelease
+			verifyRelease: options.verifyRelease,
+			handOff: options.handOff
 		});
 	} };
 }
 //#endregion
-//#region ../core/dist/tool-arguments-5t8Xd2eK.mjs
+//#region ../core/dist/tool-arguments-C8Oy4uOx.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**