@event4u/agent-config 16.1.0 → 16.3.0

package/src/scripts/_lib/neighbour_scan.ts

@@ -0,0 +1,122 @@
+/**
+ * The shape scan a neighbour skill body passes before any of it may be indexed.
+ *
+ * SCAN BEFORE INJECT. A foreign `SKILL.md` is a file another package put on
+ * disk, and the ranker reaches it through the catalogue union. Nothing about
+ * being in `~/.claude/skills` makes its prose safe to fold into a term index
+ * whose output names skills to a model — the body is untrusted content in the
+ * sense `untrusted-input-defense` means it, and the floor here is the same one
+ * that rule states: it is data until something has looked at it.
+ *
+ * THE SHAPES ARE THE ONES THIS SUITE ALREADY SCANS ITS OWN CORPUS WITH. Four
+ * `security_lint` checks, reused as functions rather than re-implemented
+ * (decision D3 of the lane): instruction smuggling, hidden Unicode, mixed-script
+ * confusables and dangerous frontmatter. Re-declaring their patterns here would
+ * create a second copy to drift against the first, and the first is the one CI
+ * keeps honest.
+ *
+ * ANY FINDING REFUSES THE BODY — severity is NOT the discriminator. In the
+ * corpus linters, `HIGH` fails a build and `MED` warns, because the corpus is
+ * this package's own prose and a warning there is a maintainer's to weigh. A
+ * neighbour body is nobody's to weigh at rank time, and the cost of refusing is
+ * known and small: the skill still RANKS, by its name, with the finding kind
+ * printed. Risk-register row 4 is exactly this trade and resolves the same way —
+ * a shell snippet can be an installer skill's whole point, so the skill is never
+ * hidden, only un-indexed.
+ *
+ * WHY THIS IS NOT IMPORTED BY THE RANKER. It pulls four linter modules and,
+ * through one of them, `node:child_process`. The ranker runs inside the shared
+ * hook bundle on `user_prompt_submit`, where every byte is paid by every concern
+ * on every dispatch and `check_hook_bundle_composition` holds the ceiling. So
+ * the scan runs in the census CLI and its verdict reaches the ranker as a cached
+ * record — see `neighbour_census.scanVerdict`, where a missing record is a
+ * refusal rather than a pass.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import * as sl from './security_lint.js';
+import { fileDigest, type ScanCache, type ScanRecord } from './skill_origin.js';
+import { _scan as scanSmuggling } from '../lint_instruction_smuggling.js';
+import { _scan as scanHiddenUnicode } from '../lint_hidden_unicode.js';
+import { _scan as scanConfusables } from '../lint_confusables.js';
+import { _scan as scanFrontmatter } from '../lint_skill_frontmatter_safety.js';
+
+/** The shape checks, in the order their findings are reported. */
+const SHAPES: ReadonlyArray<readonly [string, (sf: sl.ScannedFile) => sl.Finding[]]> = [
+    ['instruction-smuggling', scanSmuggling],
+    ['dangerous-frontmatter', scanFrontmatter],
+    ['hidden-unicode', scanHiddenUnicode],
+    ['mixed-script-confusable', scanConfusables],
+];
+
+export interface ScanResult {
+    /** `null` when every shape passed; otherwise the first finding's check id. */
+    kind: string | null;
+    /** Every finding, for a report that wants more than the first kind. */
+    findings: sl.Finding[];
+}
+
+/**
+ * Scan one `SKILL.md`.
+ *
+ * An unreadable file is a refusal, not a pass (`unreadable`): a body nobody
+ * could open is in exactly the state this gate exists to keep out of the index,
+ * and returning `kind: null` for it would make an IO error look like a clean
+ * scan. A THROWING check is reported under its own id rather than swallowed, for
+ * the same reason.
+ */
+export function scanNeighbourBody(skillMdPath: string): ScanResult {
+    let sf: sl.ScannedFile;
+    try {
+        sf = sl.scan_file(skillMdPath);
+    } catch {
+        return { kind: 'unreadable', findings: [] };
+    }
+    const findings: sl.Finding[] = [];
+    for (const [id, scan] of SHAPES) {
+        try {
+            findings.push(...scan(sf));
+        } catch {
+            findings.push(
+                new sl.Finding(sf.rel, 0, id, 'HIGH', 'shape check threw on this body', 1.0),
+            );
+        }
+    }
+    return { kind: findings.length === 0 ? null : (findings[0] as sl.Finding).check, findings };
+}
+
+/**
+ * Record what the scan found, for the ranker to read on the hook path.
+ *
+ * The digest is the FILE's, not the finding's: the ranker re-digests the body it
+ * is about to index and compares, so a body edited after its scan reads as
+ * `digest-changed` and goes back to name-only ranking until the census runs
+ * again. That compare is the whole mechanism behind "a changed digest rescans
+ * first" — without it a one-time pass would keep clearing a file forever.
+ *
+ * A write failure is reported to the caller rather than thrown: the scan is
+ * correct either way, and a read-only report directory must not fail a census.
+ */
+export function writeScanCache(file: string, entries: readonly ScanRecord[]): boolean {
+    const payload: ScanCache = {
+        schema_version: 1,
+        entries: [...entries].sort((a, b) => (a.qualified < b.qualified ? -1 : 1)),
+    };
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`, 'utf-8');
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+/** A `ScanRecord` for one file, digest included. */
+export function scanRecordFor(qualified: string, skillMdPath: string): ScanRecord {
+    return {
+        qualified,
+        digest: fileDigest(skillMdPath) ?? '',
+        unscanned: scanNeighbourBody(skillMdPath).kind,
+    };
+}

package/src/scripts/_lib/neighbour_tool_use.ts

@@ -0,0 +1,189 @@
+/**
+ * The foreign-MCP-tool-name store: one writer on the post-tool hook path, one
+ * reader in the neighbour census.
+ *
+ * WHY A MODULE OF ITS OWN, AND NOT A CONSTANT IN EITHER SIDE. The writer lives
+ * in `hooks/telemetry_usage_hook.ts`, which is inlined into the shared hook
+ * bundle `check_hook_bundle_composition` caps; the reader lives in
+ * `_lib/neighbour_census.ts`, which is not. Putting the pair here lets esbuild
+ * tree-shake {@link toolsUsedByServer} out of the hook bundle while both sides
+ * still name one path — a constant copied into two files is a store that
+ * silently splits in two the first time one copy is edited.
+ *
+ * WHAT IS RECORDED, AND WHAT IS NOT. One map of `mcp__<server>__<tool>` to the
+ * ISO date it was last seen. No arguments, no responses, no session id, no
+ * project path beyond the file's own location. The names recorded are names the
+ * consumer's own `.mcp.json` already lists, and the file is written under
+ * `agents/runtime/`, which is gitignored and local-only — nothing here is sent
+ * anywhere, and no transport reads it.
+ *
+ * NOT GATED ON THE TELEMETRY OPT-IN, DELIBERATELY. `telemetry_usage_hook`'s
+ * Class-A capture is default-off because it feeds an outbound spool. This store
+ * feeds `doctor neighbours`, a local report the consumer runs on their own tree.
+ * Gating it on an org telemetry switch would make the census print `0` on every
+ * install that never enabled one — a number that looks like a measurement and is
+ * an instrumentation artifact, which is the exact failure the usage hook's own
+ * header records from the collector it replaced.
+ *
+ * GROWTH, DECLARED (scale-discipline R-A7). The store is a map keyed by tool
+ * NAME, not an append log: one entry per distinct `mcp__…` name the consumer
+ * has ever called, each rewritten in place at most once per day. The bound is
+ * therefore the size of the neighbour's tool surface — tens of entries, not a
+ * series — so it needs no TTL job. The reader applies the window; entries older
+ * than it stay on disk and stop counting, which is why a stale entry is inert
+ * rather than wrong.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** Host-side prefix of every MCP tool name: `mcp__<server>__<tool>`. */
+export const MCP_TOOL_PREFIX = 'mcp__';
+
+/**
+ * The store, relative to the project root. Gitignored; see the header.
+ *
+ * A literal with forward slashes rather than `path.join`, and the reason is
+ * measured rather than stylistic: `path.join` here is a top-level call, so the
+ * `node:path` namespace import survives into the hook bundle even though every
+ * function in this module that needs it is tree-shaken out of that bundle.
+ * `path.join(root, REL)` at each call site normalises the separator on Windows,
+ * so the only thing lost is the authoring convention.
+ */
+export const FOREIGN_TOOL_USE_REL = 'agents/runtime/neighbour-tool-use.json';
+
+/** The census window. 30 days, matching the step that asked for the number. */
+export const TOOL_USE_WINDOW_DAYS = 30;
+
+/** The filename the writer's root is the directory of. */
+const SETTINGS_FILENAME = '.agent-settings.yml';
+
+/** `YYYY-MM-DD` in UTC — the granularity the store keys on. */
+export function usageDay(now: Date): string {
+    return now.toISOString().slice(0, 10);
+}
+
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/u;
+
+/**
+ * Is this store value a day the window comparison can be trusted on?
+ *
+ * The comparison is lexicographic, which is exactly right for `YYYY-MM-DD` and
+ * quietly wrong for anything else: `'TODO'`, `'unknown'` and `'hand edited'`
+ * all sort ABOVE a real cutoff, so without this check a hand-edited or
+ * half-written store inflates the count instead of being ignored. The reader's
+ * promise is that a malformed store yields nothing, and a malformed VALUE is
+ * the likelier half of that.
+ */
+export function isUsageDay(value: unknown): value is string {
+    return typeof value === 'string' && DAY_RE.test(value);
+}
+
+/**
+ * The `.mcp.json` key as it appears inside a tool name.
+ *
+ * Hosts sanitise the key before embedding it — a server registered as
+ * `claude.ai Claude Docs` arrives as `mcp__claude_ai_Claude_Docs__…`. Normalising
+ * BOTH sides the same way is what keeps a matched count from quietly being a
+ * zero: an exact-key match would report `0` for every server whose name carries
+ * a dot or a space, which reads as "never used" rather than as "never matched".
+ */
+export function serverSegment(key: string): string {
+    return key.replace(/[^A-Za-z0-9_-]/gu, '_');
+}
+
+/**
+ * Does `tool` belong to the server whose sanitised key is `segment`?
+ *
+ * Driven by the KNOWN segment rather than by parsing the tool name, and that
+ * direction is the whole correctness argument. Parsing — split at the first
+ * `__` after the prefix — is ambiguous exactly where {@link serverSegment} is
+ * lossy: `Acme Inc. Tools` sanitises to `Acme_Inc__Tools`, whose own name
+ * contains the separator, so a parser reads the server as `Acme_Inc` and the
+ * census reports `0` for a server in daily use. That is the same never-matched
+ * zero `serverSegment` exists to prevent, reintroduced one layer down. Matching
+ * against the keys `.mcp.json` actually lists cannot be ambiguous, because the
+ * candidate set is finite and known.
+ */
+export function toolBelongsTo(tool: string, segment: string): boolean {
+    if (!tool.startsWith(MCP_TOOL_PREFIX)) return false;
+    const rest = tool.slice(MCP_TOOL_PREFIX.length);
+    return rest === segment || rest.startsWith(`${segment}__`);
+}
+
+/**
+ * The directory the store lives under, from any directory inside the project.
+ *
+ * The WRITER roots the store at the directory holding `.agent-settings.yml`
+ * (`telemetry_usage_hook.readSettingsFor`), because a session started in a
+ * subdirectory would otherwise scatter one store per directory it happened to
+ * start in. The reader has to resolve the same way or it looks in the wrong
+ * place: a monorepo with settings at the repo root and `.mcp.json` under
+ * `packages/web` would report `0` for a server in daily use. The two walks are
+ * pinned equal by a fixture rather than by assertion.
+ *
+ * No settings file on any ancestor → `start`, matching the writer's own
+ * fallback.
+ */
+export function resolveStoreRoot(start: string): string {
+    let dir = path.resolve(start);
+    for (;;) {
+        try {
+            if (fs.statSync(path.join(dir, SETTINGS_FILENAME)).isFile()) return dir;
+        } catch {
+            // Not here — keep walking.
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) return path.resolve(start);
+        dir = parent;
+    }
+}
+
+/**
+ * Distinct tools seen per server inside the window, keyed by server segment.
+ *
+ * `segments` is the closed candidate set — the sanitised `.mcp.json` keys. Every
+ * one of them appears in the result, so a server with no sightings reads `0`
+ * rather than being absent. Longest segment wins where one is a prefix of
+ * another, so a tool is counted once.
+ *
+ * A missing, unreadable or malformed store yields all-zero — true of what was
+ * observed. It does not mean the server was unused, and the census says so next
+ * to the number.
+ */
+export function toolsUsedByServer(
+    projectRoot: string,
+    now: Date,
+    segments: Iterable<string>,
+): Map<string, number> {
+    const known = [...new Set(segments)].sort((a, b) => b.length - a.length);
+    const counts = new Map<string, number>(known.map((s) => [s, 0]));
+    if (known.length === 0) return counts;
+
+    let decoded: unknown;
+    try {
+        const root = resolveStoreRoot(projectRoot);
+        decoded = JSON.parse(fs.readFileSync(path.join(root, FOREIGN_TOOL_USE_REL), 'utf-8'));
+    } catch {
+        return counts;
+    }
+    if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) return counts;
+
+    const today = usageDay(now);
+    // Inclusive of both ends, so the span is WINDOW days and not WINDOW+1: a
+    // floor computed at `now - 30d` would count 31 distinct days under a field
+    // named `tools_used_30d`.
+    const floor = usageDay(new Date(now.getTime() - (TOOL_USE_WINDOW_DAYS - 1) * 86_400_000));
+
+    for (const [tool, seen] of Object.entries(decoded as Record<string, unknown>)) {
+        // A future date is as much a sign of a bad write as a malformed one,
+        // and without the upper bound a single `9999-01-01` counts forever.
+        if (!isUsageDay(seen) || seen < floor || seen > today) continue;
+        for (const segment of known) {
+            if (toolBelongsTo(tool, segment)) {
+                counts.set(segment, (counts.get(segment) ?? 0) + 1);
+                break;
+            }
+        }
+    }
+    return counts;
+}

package/src/scripts/_lib/obligations.ts

@@ -44,7 +44,9 @@ import {
     session_state_file,
     update_json_under_lock,
 } from '../hooks/state_io.js';
+import { manifest_path } from './installed_tools.js';
 import { type EnforcementClass, is_enforcement_class } from './obligation_frequency.js';
+import { hasSentinel } from './repo_root.js';
 
 /**
  * Directory holding one ledger file per session.
@@ -61,6 +63,77 @@ export function statePathFor(session_id: string): string {
     return session_state_file(OBLIGATION_STATE_DIR, session_id);
 }
 
+/**
+ * WHICH KIND OF TREE WROTE A ROW — the whole vocabulary, and nothing else.
+ *
+ * `obligation-settle-shadow-bar` is read off `agents/runtime/state/obligations/`,
+ * which is one machine's gitignored runtime state. That scope bound lives in the
+ * claim's prose and in a roadmap paragraph, and in nothing a reader of the rows
+ * can compute. A reading that clears the pre-registered floor would therefore be
+ * quotable as evidence about a population nobody separated. This field makes the
+ * separation a property of the DATA, so the split is computable from the ledger
+ * alone rather than asserted beside it.
+ *
+ * THREE VALUES, CLOSED, AND A UNION OF LITERALS ON PURPOSE. The record gains one
+ * enumerated field and no `payload`, `notes` or `extra` slot, so the privacy
+ * property is the SHAPE and not a scrubber somebody has to keep correct — the
+ * same by-construction posture `artifact-engagement-recording` states for the
+ * telemetry event. A type that cannot hold a path cannot leak one.
+ *
+ * WHAT IT DELIBERATELY IS NOT. Not a path, not a username, not a hostname, not a
+ * machine id, not a git remote. The obvious implementation of "which tree wrote
+ * this" is the resolved root's filesystem path, which on a developer machine
+ * carries an account name — and because the bar is read by QUOTING rows, one such
+ * field would make every row already written unquotable rather than scrubbable.
+ * So the field carries a ROLE: what kind of tree this is, never which one.
+ */
+export type WriterRole =
+    /** The tree carries this package's own `package.json` sentinel — a maintainer checkout. */
+    | 'package'
+    /** Not the package, but an install manifest is present — a consumer project. */
+    | 'consumer'
+    /** Neither marker resolved. An honest absence, never a default. */
+    | 'unknown';
+
+/** The closed set, in one place, so a reader and a writer cannot disagree. */
+export const WRITER_ROLES: readonly WriterRole[] = ['package', 'consumer', 'unknown'];
+
+/** Narrowing guard for a value read back off disk. */
+export function isWriterRole(value: unknown): value is WriterRole {
+    return typeof value === 'string' && (WRITER_ROLES as readonly string[]).includes(value);
+}
+
+/**
+ * Classify the root this ledger lives under.
+ *
+ * ORDER IS THE CONTRACT. `package` is tested FIRST, because a maintainer checkout
+ * routinely also carries the install artifacts a consumer has — this repository
+ * installs itself — and a consumer-first test would label the maintainer tree
+ * `consumer` on exactly the machine the bar is being read from. The sentinel is
+ * `hasSentinel` from `repo_root.ts` rather than a second `package.json` reader:
+ * the sentinel name lives in one place or it drifts.
+ *
+ * `consumer` keys on the INSTALL MANIFEST (`agents/installed-tools.lock`, via the
+ * canonical `manifest_path` so the `AGENT_CONFIG_INSTALLED_TOOLS` override is
+ * honoured) and not on `.agent-settings.yml`. The settings file is something a
+ * human writes by hand; the lock is written by the installer and by nothing else.
+ * A weaker marker would buy coverage by guessing, which is the one thing this
+ * field may not do.
+ *
+ * NEVER THROWS. A probe that cannot stat returns `unknown`, which is a real
+ * answer — the ledger's contract is that an instrument missing a reading is
+ * cheaper than a refused turn, and a classifier is no exception.
+ */
+export function resolveWriterRole(root: string): WriterRole {
+    try {
+        if (hasSentinel(root)) return 'package';
+        if (fs.existsSync(manifest_path(root))) return 'consumer';
+    } catch {
+        return 'unknown';
+    }
+    return 'unknown';
+}
+
 /**
  * One rule delivered into this session, with the class its frontmatter declares.
  *
@@ -75,8 +148,21 @@ export interface DeliveredRow {
     readonly cls: EnforcementClass;
     /** ISO-8601, second precision. */
     readonly at: string;
+    /** Which kind of tree wrote this. Stamped here, never supplied — see {@link WriterInput}. */
+    readonly writer: WriterRole;
 }
 
+/**
+ * What a CALLER offers, for every row type: the stored shape minus its writer.
+ *
+ * The writer is stamped by the append functions from the `root` they were
+ * already given, and is deliberately not part of any caller's input. A caller
+ * that could supply it could supply the wrong one — and a provenance field a
+ * caller can set is a provenance field, not provenance. Making it unsettable is
+ * cheaper than any check that it was set correctly.
+ */
+export type WriterInput<T> = Omit<T, 'writer'>;
+
 /**
  * One obligation discharged this session.
  *
@@ -92,6 +178,8 @@ export interface DischargeRow {
     /** What observed it — a concern name, so a reader can go and check. */
     readonly by: string;
     readonly at: string;
+    /** Which kind of tree wrote this. Stamped, never supplied. */
+    readonly writer: WriterRole;
 }
 
 /**
@@ -109,6 +197,14 @@ export interface ShadowRow {
     readonly attempt: number;
     /** Always true today: a row is only written when the detector would refuse. */
     readonly would_refuse: boolean;
+    /**
+     * Which kind of tree wrote this. Stamped, never supplied.
+     *
+     * The shadow array is the one the pre-registered bar actually counts, so
+     * this is the field that turns "the corpus is one machine" from a sentence
+     * in a claim into something a reader can compute off the rows.
+     */
+    readonly writer: WriterRole;
 }
 
 /** The on-disk shape of one session's ledger. */
@@ -125,10 +221,11 @@ interface SerialisedRow {
     rule: string;
     class: string;
     at: string;
+    writer: WriterRole;
 }
 
 function serialise(row: DeliveredRow): SerialisedRow {
-    return { rule: row.rule, class: row.cls, at: row.at };
+    return { rule: row.rule, class: row.cls, at: row.at, writer: row.writer };
 }
 
 /**
@@ -139,6 +236,16 @@ function serialise(row: DeliveredRow): SerialisedRow {
  * whose class is outside the closed set must not enter the ledger wearing a
  * value the vocabulary denies — `is_enforcement_class` is the gate, so a
  * future widening of the schema cannot leak in through the state file.
+ *
+ * THE WRITER IS TREATED THE OTHER WAY ROUND, and the asymmetry is deliberate. A
+ * row whose CLASS is outside the vocabulary is dropped, because the class is the
+ * row's subject matter and a row wearing a denied class is a false statement
+ * about what was delivered. A row whose WRITER is absent or unrecognised is KEPT
+ * and reads `unknown`, because the writer is provenance ABOUT a delivery that
+ * genuinely happened — dropping the row would destroy a real record to punish a
+ * missing label, and every row written before this field existed is exactly that
+ * case. `unknown` is the honest reading of both, which is why one value covers
+ * absent and unresolvable alike.
  */
 export function parseRows(loaded: unknown): DeliveredRow[] {
     if (typeof loaded !== 'object' || loaded === null) return [];
@@ -154,7 +261,8 @@ export function parseRows(loaded: unknown): DeliveredRow[] {
         if (typeof rule !== 'string' || rule === '') continue;
         if (typeof at !== 'string' || at === '') continue;
         if (!is_enforcement_class(cls)) continue;
-        out.push({ rule, cls, at });
+        const writer = e['writer'];
+        out.push({ rule, cls, at, writer: isWriterRole(writer) ? writer : 'unknown' });
     }
     return out;
 }
@@ -185,13 +293,14 @@ export function stamp(now: Date = new Date()): string {
 export function appendDelivered(
     root: string,
     session_id: string,
-    rows: readonly DeliveredRow[],
+    rows: readonly WriterInput<DeliveredRow>[],
 ): number {
     if (rows.length === 0) return 0;
     if (is_replay_mode()) return 0;
     if (session_id.trim() === '') return 0;
 
     const target = path.join(root, statePathFor(session_id));
+    const writer = resolveWriterRole(root);
     let added = 0;
     try {
         update_json_under_lock<LedgerFile>(target, (loaded) => {
@@ -201,7 +310,7 @@ export function appendDelivered(
             for (const row of rows) {
                 if (seen.has(row.rule)) continue;
                 seen.add(row.rule);
-                merged.push(serialise(row));
+                merged.push(serialise({ ...row, writer }));
                 added += 1;
             }
             if (added === 0) return null; // deliberate no-write
@@ -245,24 +354,25 @@ function carryOver(loaded: Partial<LedgerFile>): Pick<LedgerFile, 'discharged' |
 export function appendDischarge(
     root: string,
     session_id: string,
-    rows: readonly DischargeRow[],
+    rows: readonly WriterInput<DischargeRow>[],
 ): number {
     if (rows.length === 0) return 0;
     if (is_replay_mode()) return 0;
     if (session_id.trim() === '') return 0;
 
     const target = path.join(root, statePathFor(session_id));
+    const writer = resolveWriterRole(root);
     let added = 0;
     try {
         update_json_under_lock<LedgerFile>(target, (loaded) => {
             const existing = Array.isArray(loaded.discharged) ? loaded.discharged : [];
-            const key = (r: DischargeRow): string => `${r.rule}::${r.by}`;
+            const key = (r: WriterInput<DischargeRow>): string => `${r.rule}::${r.by}`;
             const seen = new Set(existing.map(key));
             const merged = [...existing];
             for (const row of rows) {
                 if (seen.has(key(row))) continue;
                 seen.add(key(row));
-                merged.push(row);
+                merged.push({ ...row, writer });
                 added += 1;
             }
             if (added === 0) return null;
@@ -320,6 +430,7 @@ export function appendShadow(
 
     const fingerprint = [...missing].sort().join('::');
     const target = path.join(root, statePathFor(session_id));
+    const writer = resolveWriterRole(root);
     let attempt = 0;
     try {
         update_json_under_lock<LedgerFile>(target, (loaded) => {
@@ -334,7 +445,7 @@ export function appendShadow(
                 discharged: Array.isArray(loaded.discharged) ? loaded.discharged : [],
                 shadow: [
                     ...existing,
-                    { at: now, missing: [...missing], attempt, would_refuse: true },
+                    { at: now, missing: [...missing], attempt, would_refuse: true, writer },
                 ],
             };
         });