@manyoars/oars 0.4.0 → 0.5.1

package/dist/sessions/pool-command.js

@@ -1,7 +1,9 @@
-// `oars pool`: the only part of the sessions code that talks to a remote. The server is the one named by flag or environment, else the Many Oars pool; nothing leaves until a command that sends is run or, after covenant acceptance, the nightly task sends. Sign-in runs the provider's device flow here and reads no harness token; a session leaves only as a skeleton of a closed list of fields, each value redacted first, and only after the exclusion check found it clean. Local capture, recall,
+// `oars pool`: the only part of the sessions code that talks to a remote. The server is the one named by flag or environment, else the Many Oars pool; nothing leaves until a command that sends is run or, after covenant acceptance, the detached sender (hook-bin.js nightly) sends. Sign-in runs the provider's device flow here and reads no harness token; a session leaves only as a skeleton of a closed list of fields, each value redacted first, and only after the exclusion check found it clean. Local capture, recall,
 // and reads never come through here.
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { createInterface } from 'node:readline';
 import { emitOf } from '../telemetry/emit.js';
 import { CliError, exitCodeForProblem, ExitCode, unreachableError } from '../errors.js';
 import { compileAllow } from './allow.js';
@@ -9,27 +11,36 @@ import { makeCoverage, readCoverageSetting, writeCoverageSetting } from './cover
 import { checkSession, exclusionPaths, lastWritten, loadTerms, transcriptFilesOf } from './exclusion.js';
 import { localNames, makeRedactor, REDACTION_VERSION, redactTranscript } from './redact.js';
 import { recordSend, recordWire, newTally, tallyBatch } from '../telemetry/wire.js';
-import { discardStale, FIELD_ROWS, fieldsOf, heldBatches, lockedBatch, markShown, outboxFolder, partsOf, removeBatchesExcept, removeBatchOf, staleBatches, unchangedBytes, writeBatch } from './pool-outbox.js';
-import { HARNESSES, hasEnded, ORG_SIZES, REPO_VISIBILITIES, SESSION_IDLE_HOURS, isBundleVersion, isHarness, parseSkeleton, sessionsOf, skeletonOf, VOCAB_VERSION, verifyBundle } from './pool-wire.js';
-import { carriedDeltas, markDeltasSent, placedOf, sentDeltas } from './pool-delta.js';
+import { discardStale, FIELD_ROWS, fieldsOf, heldAcross, lockedAcross, rescanPulled, machineKeys, markShown, noteMachineKey, outboxFolder, partsOf, pulledAt, removeBatchesExcept, removeBatchOf, staleBatches, unchangedBytes, writeBatch } from './pool-outbox.js';
+import { deriveConsequences } from './recall-consequence.js';
+import { readRecalls } from './recall-object.js';
+import { HARNESSES, hasEnded, ORG_SIZES, REPO_VISIBILITIES, SESSION_IDLE_HOURS, isBundleVersion, isHarness, parseSkeleton, recommendationsOf, sessionsOf, skeletonOf, unpinnedKid, VOCAB_VERSION, verifyBundle } from './pool-wire.js';
+import { carriedDeltas, heldDeltas, keptDeltas, markDeltasSent, placedOf, sentDeltas } from './pool-delta.js';
 import { Masker, printed, TRANSPORT_HEADERS, waitWords } from './pool-print.js';
-import { rawAllowed, sendsOf } from './pool-choices.js';
+import { rawAllowed, rawStale, sendsOf } from './pool-choices.js';
 import { heldRaw, rawParts, removeRawExcept, writeRaw } from './pool-raw.js';
 import { SendLockBusy, withSendLock } from './pool-send-lock.js';
-import { markSent, sentLog } from './pool-sent.js';
+import { markSent, retirePulled, sentLog } from './pool-sent.js';
 import { shellReader } from './projection.js';
 import { isVocabularyExpired, REGISTRY_MAX_AGE_DAYS, VOCAB_SNAPSHOT_DATE } from './public-vocabulary.js';
 import { contentHash, FIRST_ORDER_FAMILIES } from './read.js';
 import { isObject, keptReplica, loadSignIns, numberIn, replicaFile, signInOf, signInsFile, textIn } from './pool-replica.js';
 import { CAPTURE_VERSION, harnessOf as sessionHarness } from './schema.js';
-import { loadStore, readRedactDomains, readSkeletons, readState, updatePoolChoices } from './store.js';
+import { machineIdOf } from './machine-ids.js';
+import { machineOf } from './machine.js';
+import { scanCache } from './machine-scan-cache.js';
+import { loadStore, localSalt, readRedactDomains, readSkeletons, readState, updatePoolChoices } from './store.js';
 import { runGit } from './survival.js';
 import { vocabulary } from './vocab-load.js';
+import { mkdirOwnerOnly, writeOwnerOnly } from './owner-only.js';
 const LOGIN = 'pool-login';
+const LOGOUT = 'pool-logout';
 export const DEPOSIT = 'pool-deposit';
 const OUTBOX = 'pool-outbox';
 const POOL_DEPOSITS = '/v1/deposits';
 const FETCH = 'pool-fetch';
+const EXPORT = 'pool-export';
+const PROVE = 'pool-prove';
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
 export const POOL_PROVIDERS = ['github', 'google'];
 const DEFAULT_INTERVAL_SEC = 5;
@@ -87,10 +98,10 @@ const outgoing = (deps, server, path, init) => {
 /** One call to the pool. A redirect is an error: it could carry a batch or a token somewhere the checks on the named server never saw. */
 export const ask = (deps, step, server, path, init, via) => {
     const request = outgoing(deps, server, path, init);
-    return via === undefined ? send(deps, step, request, init.show) : via(request);
+    return via === undefined ? send(deps, step, request, init.show, init.binary === true) : via(request);
 };
 /** Prints the request when asked to, then sends exactly those headers and that body. */
-const send = async (deps, step, request, show) => {
+const send = async (deps, step, request, show, binary = false) => {
     if (show !== undefined)
         deps.io.stderr(`${printed(request, show)}
 `);
@@ -103,7 +114,7 @@ const send = async (deps, step, request, show) => {
     }
     let body;
     try {
-        body = await response.json();
+        body = binary && response.status === 200 ? new Uint8Array(await response.arrayBuffer()) : await response.json();
     }
     catch {
         body = undefined;
@@ -113,113 +124,150 @@ const send = async (deps, step, request, show) => {
 /** The sender `deposit --send` uses when none is given: the request goes out over the network as built. The loopback test passes it to read what reaches the socket. */
 export const networkSender = (deps, step) => (request) => send(deps, step, request, undefined);
 /** The server's named refusal, as a failure: its `error` is the problem's code in `--json`. */
-const refusal = (step, { status, body }) => {
+export const refusal = (step, { status, body }) => {
     const code = isObject(body) ? textIn(body, 'error') : undefined;
     const message = (isObject(body) ? textIn(body, 'message') : undefined) ?? `The pool answered HTTP ${String(status)}.`;
     return new CliError(message, exitCodeForProblem(status, code === undefined ? undefined : { code }), step, { title: message, status, ...(code === undefined ? {} : { code }) });
 };
-const PROVIDER_FLOWS = new Map([
-    ['github', { deviceUrl: 'https://github.com/login/device/code', tokenUrl: 'https://github.com/login/oauth/access_token', scope: '', clientIdVar: 'OARS_GITHUB_CLIENT_ID' }],
-    ['google', { deviceUrl: 'https://oauth2.googleapis.com/device/code', tokenUrl: 'https://oauth2.googleapis.com/token', scope: 'openid', clientIdVar: 'OARS_GOOGLE_CLIENT_ID', secretVar: 'OARS_GOOGLE_CLIENT_SECRET' }],
-]);
-const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
-/** The provider's side of the flow, read from the environment. An unset value stops the command before anything is sent, and names what is missing. */
-const configOf = (env, provider) => {
-    const set = (name) => (env[name] === undefined || env[name] === '' ? undefined : env[name]);
-    const clientId = set(provider.clientIdVar);
-    if (clientId === undefined)
-        throw usage(`Set ${provider.clientIdVar} to the client ID of the Many Oars OAuth app; it is not set.`, LOGIN);
-    const clientSecret = provider.secretVar === undefined ? undefined : set(provider.secretVar);
-    if (provider.secretVar !== undefined && clientSecret === undefined)
-        throw usage(`Set ${provider.secretVar} to the client secret of the Many Oars OAuth app; it is not set.`, LOGIN);
-    return { clientId, clientSecret };
-};
-/** One form POST to a provider, printed before it is sent. The provider answers JSON on whatever status it chooses (Google's pending poll is a 428), so the caller reads the body and not the status. */
-const askProvider = (deps, url, form, masker) => {
-    const headers = [['user-agent', `oars/${deps.version}`], ['accept', 'application/json'], ['content-type', 'application/x-www-form-urlencoded'], ...TRANSPORT_HEADERS];
-    return send(deps, LOGIN, { method: 'POST', url: new URL(url), headers, body: new URLSearchParams(form).toString() }, masker);
-};
-const deviceOf = ({ body }) => {
-    // Google names the link `verification_url`, against the RFC's `verification_uri`.
-    const [deviceCode, userCode, verificationUri] = isObject(body) ? [textIn(body, 'device_code'), textIn(body, 'user_code'), textIn(body, 'verification_uri') ?? textIn(body, 'verification_url')] : [];
-    // A provider that refuses here (GitHub's `device_flow_disabled`, Google's `invalid_client`) is how an unfinished OAuth app shows, so its word goes to the operator.
-    const refusal = isObject(body) ? textIn(body, 'error') : undefined;
-    if (refusal !== undefined) {
-        const title = `The provider refused the sign-in: ${refusal}.`;
-        throw new CliError(title, ExitCode.AUTH, LOGIN, { code: 'login_refused', title });
-    }
+const startedOf = ({ body }) => {
+    const [handle, userCode, verificationUrl] = isObject(body) ? [textIn(body, 'handle'), textIn(body, 'userCode'), textIn(body, 'verificationUrl')] : [];
     // `openBrowser` parses the link before it returns its promise, so one that cannot parse has to stop here or it throws past the login's catch.
-    if (!isObject(body) || deviceCode === undefined || userCode === undefined || verificationUri === undefined || !URL.canParse(verificationUri))
-        throw new CliError('The provider did not start a sign-in.', ExitCode.UNEXPECTED, LOGIN);
+    if (!isObject(body) || handle === undefined || userCode === undefined || verificationUrl === undefined || !URL.canParse(verificationUrl))
+        throw new CliError('The pool did not start a sign-in.', ExitCode.UNEXPECTED, LOGIN);
     // An interval of 0 or below would poll with no wait and never run out the clock, so it takes the default like a missing one.
     const interval = numberIn(body, 'interval');
-    return { deviceCode, userCode, verificationUri, intervalMs: (interval === undefined || interval <= 0 ? DEFAULT_INTERVAL_SEC : interval) * 1000, expiresMs: (numberIn(body, 'expires_in') ?? DEFAULT_EXPIRY_SEC) * 1000 };
-};
-/** Polls the provider's token route until the operator approves, and returns the provider's token. Time is counted in the waits asked for, so a machine that slept through the code still gets one poll that says it expired. */
-const awaitToken = async (deps, provider, config, device, masker) => {
-    let { intervalMs } = device;
-    const form = [['client_id', config.clientId], ['device_code', device.deviceCode], ['grant_type', DEVICE_GRANT]];
-    if (config.clientSecret !== undefined)
-        form.push(['client_secret', config.clientSecret]);
-    for (let waited = 0; waited < device.expiresMs; waited += intervalMs) {
+    return { handle, userCode, verificationUrl, intervalMs: (interval === undefined || interval <= 0 ? DEFAULT_INTERVAL_SEC : interval) * 1000, expiresMs: (numberIn(body, 'expiresIn') ?? DEFAULT_EXPIRY_SEC) * 1000 };
+};
+/** The two lines the operator compares with `accounts.proved_at` (GDPR Art. 12(6)): the account, and the proof time in milliseconds exactly as the pool stored it. */
+const proofLines = (account, provedAt) => `account: ${account}
+provedAt: ${String(provedAt)}`;
+/** The pool refused a sign-in because the account is closed, and kept the sign-in as proof of control: the refusal carries the account and the time, and the failure prints both, text and `--json`, so the person can send them to the operator who asks for proof. Undefined for any other refusal. */
+const closedProof = (reply) => {
+    const body = reply.body;
+    const account = isObject(body) ? textIn(body, 'account') : undefined;
+    const provedAt = isObject(body) ? numberIn(body, 'provedAt') : undefined;
+    if (reply.status !== 403 || !isObject(body) || textIn(body, 'error') !== 'account_closed' || account === undefined || provedAt === undefined)
+        return undefined;
+    const refused = refusal(LOGIN, reply);
+    const detail = `The operator will ask for these two lines when you write to privacy@manyoars.com:
+${proofLines(account, provedAt)}`;
+    return new CliError(refused.message, refused.exitCode, LOGIN, { ...refused.problem, detail }, { account, provedAt });
+};
+/** Polls the pool until the person approves, and returns the pool's answer with the credential. Time is counted in the waits asked for, so a machine that slept through the code still gets one poll that says it expired. */
+const awaitCredential = async (deps, server, started, show) => {
+    let { intervalMs } = started;
+    for (let waited = 0; waited < started.expiresMs; waited += intervalMs) {
         await deps.sleep(intervalMs);
-        const { body } = await askProvider(deps, provider.tokenUrl, form, masker);
-        if (!isObject(body))
-            throw new CliError('The provider answered a sign-in poll with no body.', ExitCode.UNEXPECTED, LOGIN);
-        const accessToken = textIn(body, 'access_token');
-        if (accessToken !== undefined)
-            return accessToken;
-        const error = textIn(body, 'error') ?? 'no_token';
-        if (error === 'slow_down')
+        const reply = await ask(deps, LOGIN, server, '/v1/login/poll', { body: { handle: started.handle }, show });
+        if (reply.status !== 200 || !isObject(reply.body))
+            throw closedProof(reply) ?? refusal(LOGIN, reply);
+        const status = textIn(reply.body, 'status');
+        if (status === 'authorized')
+            return reply;
+        if (status === 'slow_down')
             intervalMs += SLOW_DOWN_MS;
-        else if (error === 'expired_token')
+        else if (status === 'expired')
             break;
-        else if (error !== 'authorization_pending') {
-            const title = `The provider refused the sign-in: ${error}.`;
+        else if (status === 'denied') {
+            const title = 'The provider refused the sign-in: access_denied.';
             throw new CliError(title, ExitCode.AUTH, LOGIN, { code: 'login_refused', title });
         }
+        else if (status !== 'pending')
+            throw new CliError('The pool answered a sign-in poll with a state this client does not know.', ExitCode.UNEXPECTED, LOGIN);
     }
     const title = 'The sign-in code expired. Run oars pool login again.';
     throw new CliError(title, ExitCode.AUTH, LOGIN, { code: 'EXPIRED_TOKEN', title });
 };
 /**
- * `oars pool login` (spec Section 1.4): the device flow runs here, against the provider, and the pool sees only the provider's token, once, and answers its own credential. Every request prints before it is sent, with the device code, the provider's token,
- * and the credential masked as `<credential: n bytes>`. A client ID, scope, grant type, and Google's `client_secret` print as they are: none is secret.
+ * `oars pool login` (spec Section 1.4): the pool runs the provider's device flow and this client only shows the code and polls the pool, so no provider token, device code, client ID, or secret is ever here. With `--verbose`, every request, which goes to the pool alone,
+ * prints before it is sent, with the login handle and the credential masked as `<credential: n bytes>`; without it, a failure's cause is the first line printed.
  */
 export const poolLogin = async (deps, options) => {
     const { storeDir } = runtimeOf(deps);
     const server = poolServer(deps.env, LOGIN, options.server);
     const { provider } = options;
-    const flow = PROVIDER_FLOWS.get(provider ?? '');
-    if (provider === undefined || flow === undefined)
+    if (provider === undefined || POOL_PROVIDERS.every((name) => name !== provider))
         throw usage(`The provider is one of ${POOL_PROVIDERS.join(', ')}.`, LOGIN);
-    const config = configOf(deps.env, flow);
     const saved = await loadSignIns(storeDir, LOGIN);
     const masker = new Masker();
-    const device = deviceOf(await askProvider(deps, flow.deviceUrl, [['client_id', config.clientId], ['scope', flow.scope]], masker));
-    masker.add(device.deviceCode);
-    deps.io.stderr(`To sign in, open ${device.verificationUri}\nand confirm the code ${device.userCode}\n`);
-    await deps.openBrowser(device.verificationUri).catch(() => {
+    // The raw request is for a person debugging a pool; without `--verbose` a failure's one-line cause is the first thing printed.
+    const show = options.verbose === true ? masker : undefined;
+    const startReply = await ask(deps, LOGIN, server, '/v1/login/start', { body: { provider }, show });
+    if (startReply.status !== 200)
+        throw refusal(LOGIN, startReply);
+    const started = startedOf(startReply);
+    masker.add(started.handle);
+    deps.io.stderr(`To sign in, open ${started.verificationUrl}\nand confirm the code ${started.userCode}\n`);
+    await deps.openBrowser(started.verificationUrl).catch(() => {
         deps.io.stderr('Could not open a browser; open the link above yourself.\n');
     });
-    const accessToken = await awaitToken(deps, flow, config, device, masker);
-    masker.add(accessToken);
-    const reply = await ask(deps, LOGIN, server, '/v1/login', { body: { provider, token: accessToken }, show: masker });
-    if (reply.status !== 200)
-        throw refusal(LOGIN, reply);
+    const reply = await awaitCredential(deps, server, started, show);
     const signIn = signInOf(isObject(reply.body) ? { ...reply.body, server } : undefined);
     if (signIn === undefined)
         throw new CliError('The pool answered a sign-in with no account, token, or signing key.', ExitCode.UNEXPECTED, LOGIN);
     const known = saved.find((entry) => entry.server === server);
-    // The key is trusted once, here, and never replaced by a later login: a server that swaps it could otherwise sign anything it likes.
-    if (known !== undefined && known.signingKey.x !== signIn.signingKey.x)
-        throw new CliError(`${server} now signs with a different key than the one pinned at your first login. Nothing was saved. If the pool really did change its key, remove ${server} from ${signInsFile(storeDir)} and sign in again.`, ExitCode.AUTH, LOGIN, { code: 'signing_key_changed', title: 'The pool signing key changed.' });
-    await mkdir(storeDir, { recursive: true });
-    await writeFile(signInsFile(storeDir), `${JSON.stringify([...saved.filter((entry) => entry !== known), signIn])}\n`, { mode: 0o600 });
+    // A key is trusted once, here, under the id the pool names it by, and never replaced: a server that swaps the key behind an id it already holds could otherwise sign anything it likes. A server cannot add an id either: a new id enters only in a release of oars (RELEASE_KEYS, docs/pool.md), so a server at this URL that names one is refused.
+    const held = known?.signingKeys ?? {};
+    for (const [kid, key] of Object.entries(signIn.signingKeys)) {
+        if (Object.hasOwn(held, kid) && held[kid]?.x !== key.x) {
+            const message = `${server} now signs with a different key than the one pinned for ${kid} at your first login. Nothing was saved. If the pool really did change this key, remove ${server} from ${signInsFile(storeDir)} and sign in again.`;
+            throw new CliError(message, ExitCode.AUTH, LOGIN, { code: 'signing_key_changed', title: 'The pool signing key changed.', detail: message });
+        }
+    }
+    const unpinned = known === undefined ? undefined : unpinnedKid(held, signIn.signingKeys);
+    if (unpinned !== undefined) {
+        const message = `${server} signs with the key ${unpinned}, which this machine never pinned for it and this release of oars does not ship. Nothing was saved. Upgrade with npm install -g @manyoars/oars; if the pool really did rotate its key, remove ${server} from ${signInsFile(storeDir)} and sign in again.`;
+        throw new CliError(message, ExitCode.AUTH, LOGIN, { code: 'signing_key_unpinned', title: 'The pool signing key is not pinned.', detail: message });
+    }
+    // Only the keys already held are kept on a repeat login: a key the server offers under a released id is never stored beside the release's own.
+    const pinned = { ...signIn, signingKeys: known === undefined ? signIn.signingKeys : held };
+    await mkdirOwnerOnly(storeDir);
+    await writeOwnerOnly(signInsFile(storeDir), `${JSON.stringify([...saved.filter((entry) => entry !== known), pinned])}\n`);
     return { document: { ok: true, server, account: signIn.account, expiresAt: signIn.expiresAt }, text: `Signed in to ${server} as ${signIn.account}.` };
 };
+/** The pool is not answering: it could not be reached, or a gateway in front of it says so. */
+const poolDown = (status) => status === 502 || status === 503 || status === 504;
+/**
+ * `oars pool logout` (S8): revokes this machine's credential at the pool (`DELETE /v1/login`), then removes the local entry. A pool that cannot be reached does not keep the entry: the person asked to be signed out here, so the entry
+ * goes and the output says the credential was not revoked there (it lapses on its own, and a login past the pool's cap revokes the oldest). A refusal for any other reason keeps the entry, so the command can be run again.
+ */
+export const poolLogout = async (deps, options) => {
+    const { storeDir } = runtimeOf(deps);
+    const server = poolServer(deps.env, LOGOUT, options.server);
+    const saved = await loadSignIns(storeDir, LOGOUT);
+    const known = saved.find((entry) => entry.server === server);
+    if (known === undefined)
+        return { document: { ok: true, server, revoked: false, removed: false }, text: `Not signed in to ${server}.` };
+    // The request prints before it is sent with the credential masked, as every other pool request does.
+    const credential = new Masker();
+    credential.add(known.token);
+    let reply;
+    try {
+        reply = await ask(deps, LOGOUT, server, '/v1/login', { method: 'DELETE', token: known.token, show: credential });
+    }
+    catch (error) {
+        if (!(error instanceof CliError) || error.exitCode !== ExitCode.UNREACHABLE)
+            throw error;
+    }
+    if (reply !== undefined && reply.status !== 204 && reply.status !== 401 && !poolDown(reply.status))
+        throw refusal(LOGOUT, reply);
+    await writeOwnerOnly(signInsFile(storeDir), `${JSON.stringify(saved.filter((entry) => entry !== known))}\n`);
+    const revoked = reply?.status === 204;
+    const text = revoked
+        ? `Signed out of ${server}: the credential is revoked there and removed here.`
+        : reply?.status === 401
+            ? `Signed out of ${server}: the pool had already revoked the credential, and it is removed here.`
+            : `Signed out of ${server} here, but the pool could not be reached, so the credential was not revoked there. It lapses on its own.`;
+    return { document: { ok: true, server, revoked, removed: true }, text };
+};
+const REGION_FLAG = '--in-eu-eea-uk';
+const REGION_QUESTION = 'Are you in the EU, the EEA, or the UK? (yes/no)';
+const regionOf = (text) => {
+    const answer = text?.trim().toLowerCase();
+    return answer === 'yes' || answer === 'no' ? answer : undefined;
+};
 /** A send stops here when the server is closed or wants a covenant accepted, before the batch is read for the last time. */
-const openCovenant = async (deps, server, token, accept, via) => {
+const openCovenant = async (deps, server, token, accept, region, via) => {
     const reply = await ask(deps, DEPOSIT, server, '/v1/covenant', { token }, via);
     if (reply.status !== 200 || !isObject(reply.body))
         throw refusal(DEPOSIT, reply);
@@ -228,15 +276,80 @@ const openCovenant = async (deps, server, token, accept, via) => {
         const title = 'This pool is not taking deposits: its covenant is not published.';
         throw new CliError(title, ExitCode.AUTH, DEPOSIT, { code: 'deposits_closed', title, status: 403 });
     }
-    if (accept !== undefined) {
-        const accepted = await ask(deps, DEPOSIT, server, '/v1/covenant/accept', { token, body: { version: accept } }, via);
-        if (accepted.status !== 200)
-            throw refusal(DEPOSIT, accepted);
+    // A flag is refused whatever the account's state: off a terminal it would be a script saying yes, and a version other than the pool's names a text this pool does not hold.
+    if (accept !== undefined && !isTerminal(deps))
+        throw usage('--accept-covenant does not accept for you: acceptance is a person typing the phrase at a terminal, and this is not one. Nothing was accepted.', DEPOSIT);
+    if (accept !== undefined && accept !== version)
+        throw usage(`--accept-covenant names covenant ${accept}, but the covenant of this pool is ${version}. Nothing was accepted.`, DEPOSIT);
+    if (Reflect.get(reply.body, 'accepted') === true)
         return;
+    const notAccepted = (title) => new CliError(title, ExitCode.AUTH, DEPOSIT, { code: 'covenant_not_accepted', title, status: 403 });
+    const screen = screenIn(reply.body);
+    if (screen === undefined)
+        throw notAccepted(`The pool has no text for covenant ${version} yet, so there is nothing to show and nothing can be accepted. Nothing was accepted.`);
+    // Assent is a person typing the phrase the screen states. A flag or a script on stdin is not one, so off a terminal nothing is asked and nothing is accepted.
+    if (!isTerminal(deps)) {
+        throw notAccepted(`Covenant ${version} is not accepted for this account. Accepting it takes a person at a terminal who reads it and types its phrase: run this command from one. Nothing was accepted.`);
+    }
+    deps.io.stderr(`\n${screen.text}\n\n> `);
+    emitOf(deps)('covenant-shown', { version });
+    // One reader for both lines: a second one opened after the first closed would lose a line the first had already taken from a pipe.
+    const lines = createInterface({ input: runtimeOf(deps).stdin, terminal: false });
+    const iterator = lines[Symbol.asyncIterator]();
+    const nextLine = async () => {
+        const next = await iterator.next();
+        return next.done === true ? undefined : next.value;
+    };
+    let answered = region;
+    try {
+        const typed = await nextLine();
+        if (typed?.trim() !== screen.phrase)
+            throw notAccepted(`${typed === undefined ? 'No phrase was typed' : 'That was not the phrase'}. To accept covenant ${version}, type exactly: ${screen.phrase}. Nothing was accepted.`);
+        if (region === undefined) {
+            deps.io.stderr(`${REGION_QUESTION} > `);
+            answered = regionOf(await nextLine());
+        }
+    }
+    finally {
+        lines.close();
+    }
+    if (answered === undefined)
+        throw notAccepted('Answer yes or no: are you in the EU, the EEA, or the UK? Nothing was accepted.');
+    const body = { version, textSha256: createHash('sha256').update(screen.text).digest('hex'), input: 'typed', client: `oars/${deps.version}`, euEeaUk: answered };
+    const accepted = await ask(deps, DEPOSIT, server, '/v1/covenant/accept', { token, body }, via);
+    if (accepted.status !== 200)
+        throw refusal(DEPOSIT, accepted);
+    // A yes to the raw prompt belongs to the covenant it was given under, and a covenant can change what that prompt covers: accepting another version asks the raw question again.
+    const reset = { done: false };
+    await updatePoolChoices(runtimeOf(deps).storeDir, (choices) => {
+        if (choices.rawConsent !== 'granted' || choices.rawConsentVersion === version)
+            return;
+        choices.rawConsent = null;
+        choices.rawConsentVersion = null;
+        reset.done = true;
+    });
+    if (reset.done)
+        deps.io.stderr('Your earlier yes to the raw prompt was given under another covenant, so it no longer applies. Run oars pool raw to read the prompt and answer again.\n');
+};
+const screenIn = (body) => {
+    const screen = Reflect.get(body, 'screen');
+    const text = isObject(screen) ? textIn(screen, 'text') : undefined;
+    const link = isObject(screen) ? textIn(screen, 'link') : undefined;
+    const phrase = isObject(screen) ? textIn(screen, 'phrase') : undefined;
+    return text === undefined || link === undefined || phrase === undefined ? undefined : { text, link, phrase };
+};
+/** A person is here when input and the screen's stream are both terminals: a typed phrase counts only for a text that reached a screen. */
+export const isTerminal = (deps) => Reflect.get(runtimeOf(deps).stdin, 'isTTY') === true && runtimeOf(deps).stderr?.isTTY === true;
+/** The next line a person types, or `undefined` when the input ends first. The interface is closed after it, so the terminal is released. */
+export const lineFrom = async (input) => {
+    const lines = createInterface({ input, terminal: false });
+    try {
+        for await (const line of lines)
+            return line;
+        return undefined;
     }
-    if (Reflect.get(reply.body, 'accepted') !== true) {
-        const title = `Read covenant ${version} of this pool, then rerun with --accept-covenant ${version}.`;
-        throw new CliError(title, ExitCode.AUTH, DEPOSIT, { code: 'covenant_not_accepted', title, status: 403 });
+    finally {
+        lines.close();
     }
 };
 const excludedKey = (reason) => (reason === 'no-raw' ? 'noRaw' : reason === 'no-terms' ? 'noTerms' : reason);
@@ -257,7 +370,7 @@ const lockMessages = {
 /** The calls one batch takes, in order: one, or one per part when it is past a request's bytes. `outbox` prints these and `deposit --send` sends these, so what is printed is what is sent. */
 const callsOf = (token, bytes, hash) => {
     const parts = partsOf(bytes);
-    return parts.map((piece, at) => ({ token, bytes: piece, ...(parts.length === 1 ? {} : { part: { index: at + 1, count: parts.length, batch: hash } }) }));
+    return parts.map((piece, at) => ({ ...(token === undefined ? {} : { token }), bytes: piece, ...(parts.length === 1 ? {} : { part: { index: at + 1, count: parts.length, batch: hash } }) }));
 };
 /** One batch to the pool: a batch past one request's bytes goes in parts, in order, each answered 202 until the last completes the deposit with 201. A part sent again is harmless, so the retry covers every part alike. */
 export const postBatch = async (deps, options) => {
@@ -285,8 +398,9 @@ export const postBatch = async (deps, options) => {
  * the caller sends only for a person who did. A part sent again replaces itself, and one for an object that stands writes nothing, so a copy that failed halfway is sent again whole.
  */
 export const postRaw = async (deps, options) => {
-    const { server, token, hash, body, bytes, via } = options;
-    const extra = [['oars-redaction-version', REDACTION_VERSION], ['oars-capture-version', CAPTURE_VERSION], ['oars-raw-consent', 'granted']];
+    const { server, token, hash, body, bytes, consent, via } = options;
+    // The yes names the covenant version it answered: the pool takes it only for the version in force.
+    const extra = [['oars-redaction-version', REDACTION_VERSION], ['oars-capture-version', CAPTURE_VERSION], ['oars-raw-consent', 'granted'], ['oars-raw-consent-version', consent]];
     const parts = rawParts(body);
     for (const [at, piece] of parts.entries()) {
         const reply = await ask(deps, DEPOSIT, server, `/v1/raw/${hash}/parts/${String(at + 1)}`, { token, bytes: piece, method: 'PUT', type: 'application/x-ndjson', extra }, via);
@@ -298,7 +412,9 @@ export const postRaw = async (deps, options) => {
         throw refusal(DEPOSIT, done);
 };
 const rawNote = (consent) => consent === 'granted' ? '' : consent === 'declined' ? 'You answered no to the raw prompt; oars pool raw --consent yes changes it.' : 'None is queued until you answer the raw prompt with oars pool raw --consent yes.';
-/** `deposit --send <hash>`: the send lock the nightly task takes too, then a skip for a hash already in `sent.log`, then the batch lock, then the covenant (accepted here or before, or nothing is sent), then the request. The body is read and hashed again just before the request. */
+/** The exclusion terms in force now, re-read from the term file each time it is asked: empty when the file is missing or unreadable. */
+export const currentTerms = (deps) => loadTerms(exclusionPaths(runtimeOf(deps).projectsRoot, deps.env).terms);
+/** `deposit --send <hash>`: the send lock the detached sender (hook-bin.js nightly) takes too, then a skip for a hash already in `sent.log`, then the batch lock, then the covenant (accepted here or before, or nothing is sent), then the request. The body is read and hashed again just before the request. */
 const sendBatch = async (deps, options) => {
     const { outbox, server, token, hash } = options;
     const via = options.via ?? networkSender(deps, DEPOSIT);
@@ -309,17 +425,26 @@ const sendBatch = async (deps, options) => {
         return await withSendLock(outbox, async () => {
             // The rule the nightly follows: a hash `sent.log` holds is not posted again. Read under the lock, so two runs cannot both see it unsent.
             const sentAt = (await sentLog(outbox)).get(hash);
-            if (sentAt !== undefined)
+            if (sentAt !== undefined) {
+                await retirePulled(outbox, DEPOSIT);
                 return { document: { ok: true, server, hash, sent: false, sentAt }, text: `already sent ${hash} at ${sentAt}` };
-            const locked = await lockedBatch(outbox, hash);
+            }
+            // A pulled batch is rescanned first: one that holds a term of the file now is removed, and with no terms to check against none is sent.
+            const scan = await rescanPulled(outbox, await currentTerms(deps));
+            if (scan.removed.includes(hash))
+                throw refuse('term_excluded', 'This batch holds a term of your exclusion list now, so it was removed from the outbox and not sent.');
+            const locked = await lockedAcross(outbox, hash);
             if (!locked.ok)
                 throw refuse(locked.code, lockMessages[locked.code]);
-            await openCovenant(deps, server, token, options.acceptCovenant, via);
+            if (!scan.open && (await heldAcross(outbox)).batches.some((batch) => batch.hash === hash && batch.pulled))
+                throw refuse('terms_missing', 'This batch was held by a cloud session, and your exclusion term file is missing or empty, so it cannot be checked and was not sent.');
+            await openCovenant(deps, server, token, options.acceptCovenant, options.region, via);
             const bytes = await unchangedBytes(locked.file, hash);
             if (bytes === undefined)
                 throw refuse('batch_changed', lockMessages.batch_changed);
             await postBatch(deps, { server, token, bytes, hash, via });
             await markSent(outbox, hash, deps.now());
+            await retirePulled(outbox, DEPOSIT);
             return { document: { ok: true, server, hash, sent: true }, text: `Sent batch ${hash} to ${server}.` };
         });
     }
@@ -329,33 +454,63 @@ const sendBatch = async (deps, options) => {
         throw error;
     }
 };
+/** The covenant version the pool names, or `undefined` when it cannot be asked or names none. The route is public, so no credential goes with it. */
+const covenantOrUndefined = async (deps, server) => {
+    try {
+        const reply = await ask(deps, DEPOSIT, server, '/v1/covenant', {});
+        return reply.status === 200 && isObject(reply.body) ? textIn(reply.body, 'version') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const machineAccount = (machine) => `machine:${machine.machine ?? machine.hostClass}`;
+/** The outbox key, and the skeleton `id`, of a machine's session: from the environment's session salt (per account, not per machine), else its own name standing in for the account, which a machine has none of. The holding route names its branch by the same key. */
+export const machineKeyOf = (machine, session) => machine.sessionSalt === undefined ? contentHash([machineAccount(machine), session]) : machineIdOf(machine.sessionSalt, machine.remoteSession ?? session);
 /**
- * `oars pool deposit`: every session in the store that passes both session gates is built into a canonical batch in the outbox, and the command stops: nothing is sent. The gates run before any projection does: the folder
+ * `oars pool deposit`: every session in the store that passes both session gates is built into a canonical batch in the outbox, and the command stops: no session data is sent. The gates run before any projection does: the folder
  * allowlist, then the exclusion check. A session that fails either, or has no raw to scan, is counted and never built. A session is built only once it has ended: no transcript of it, main or subagent, has gained a line (the later of its capture
  * and its raw file's last write) for `session_idle_hours` (6 hours). One that has not is counted under `notEnded`, and any batch of it from an earlier pass is withdrawn. `--send <hash>` is the lock in `sendBatch`.
  */
 export const poolDeposit = async (deps, options) => {
     const runtime = runtimeOf(deps);
     const server = poolServer(deps.env, DEPOSIT, options.server);
-    const { account, token } = await signedIn(deps, runtime.storeDir, server, DEPOSIT);
+    // A machine (`OARS_HOST_CLASS`, see machine.ts) builds at every Stop and sends nothing from here, so it signs nobody in: the account part of its batch key is its own name, and the holding route's `id` replaces it.
+    const machine = machineOf(deps.env);
+    if (machine !== undefined && options.send !== undefined)
+        throw usage('A machine builds batches into its outbox and sends none: --send is for a signed-in person.', DEPOSIT);
+    const { account, token } = machine === undefined ? await signedIn(deps, runtime.storeDir, server, DEPOSIT) : { account: machineAccount(machine), token: '' };
     // A client past `registry_max_age` builds no batch (spec Section 1.3): its sessions wait in `A` and nothing is lost. This comes before anything is written or sent.
     const expired = vocabularyExpired(deps);
     if (expired !== undefined)
         throw expired;
     // Accepting the covenant is a step of sending a batch: alone it would exit 0 as though something had been sent under it.
     if (options.send === undefined && options.acceptCovenant !== undefined)
-        throw usage('--accept-covenant belongs to --send: it is accepted as a step of sending a batch. Nothing was accepted.', DEPOSIT);
+        throw usage('--accept-covenant belongs to --send: it names the covenant version expected when a person accepts before a send. Nothing was accepted.', DEPOSIT);
+    if (options.send === undefined && options.inEuEeaUk !== undefined)
+        throw usage(`${REGION_FLAG} belongs to --send: it answers the question asked when a person accepts before a send. Nothing was accepted.`, DEPOSIT);
+    const region = options.inEuEeaUk === undefined ? undefined : regionOf(options.inEuEeaUk);
+    if (options.inEuEeaUk !== undefined && region === undefined)
+        throw usage(`${REGION_FLAG} takes yes or no, not "${options.inEuEeaUk}". Nothing was accepted.`, DEPOSIT);
     const outbox = outboxFolder(runtime.storeDir, server);
+    await mkdirOwnerOnly(outbox);
     if (options.send !== undefined)
-        return sendBatch(deps, { outbox, server, token, hash: options.send, acceptCovenant: options.acceptCovenant, via: options.via });
+        return sendBatch(deps, { outbox, server, token, hash: options.send, acceptCovenant: options.acceptCovenant, region, via: options.via });
     const { terms } = exclusionPaths(runtime.projectsRoot, deps.env);
     const saved = await readState(runtime.storeDir);
+    // A yes to the raw prompt counts only for the covenant it was given under, so an interactive build asks the pool which is in force; the nightly already knows and passes it. A pool that cannot be asked, or names none, leaves it unknown and the build goes on as before.
+    const covenant = options.covenant ?? (saved.pool.rawConsent === 'granted' ? await covenantOrUndefined(deps, server) : undefined);
     const names = localNames();
+    // The key an injected block's hash is made under: this machine's salt, so the same block hashes the same in every session and the key never leaves it.
+    const injectedKey = `injected-block:${(await localSalt(runtime.storeDir)).salt}`;
     const allow = compileAllow(saved.allow);
     const discarded = await discardStale(outbox);
     const counts = { sessions: 0, batched: 0, excluded: { folder: 0, term: 0, noRaw: 0, noTerms: 0, unreadable: 0 }, off: 0, raw: { copies: 0, bytes: 0, masked: 0 }, uncaptured: 0, notEnded: 0, refused: 0, refusedFields: [], discarded, withdrawn: 0 };
     // The one gate on a name: the operator's redactor and exclusion terms (t881). Everything else the pool classes itself.
-    const gate = { redact: makeRedactor(await readRedactDomains(runtime.storeDir)), terms: await loadTerms(terms) };
+    const termList = await loadTerms(terms);
+    const gate = { redact: makeRedactor(await readRedactDomains(runtime.storeDir)), terms: termList };
+    // A Stop that names a session reads the others only to fill windows: a pass of the gate one of them made in the last minutes is not repeated.
+    const scanned = await scanCache(runtime.storeDir, contentHash(termList), deps.now);
     const built = new Set();
     const rawKept = new Set();
     // The bytes of the batches written in this pass: telemetry counts them, and the command's own document does not carry them.
@@ -370,29 +525,50 @@ export const poolDeposit = async (deps, options) => {
         counts.withdrawn += await removeBatchOf(outbox, key);
         await removeRawExcept(outbox, new Set(), key);
     };
-    for (const records of sessionsOf(await loadStore(runtime.storeDir), roots)) {
-        counts.sessions += 1;
+    // The sessions a Stop does not name that still pass the read-only gates: they only fill the windows of a delta, and are never counted, withdrawn, or built.
+    const history = [];
+    const localStore = await loadStore(runtime.storeDir);
+    for (const records of sessionsOf(localStore, roots)) {
+        // The Stop of a machine builds the one session that stopped: the others in the store belong to Stops of their own, so their batches stay as they are. They run the three read-only gates below and no more.
+        const named = options.session === undefined || records.main.session === options.session;
+        if (named)
+            counts.sessions += 1;
         // Hashed with the account, so a redeposit replaces its own batch and two accounts' copies of one session cannot be joined.
-        const key = contentHash([account, records.main.session]);
+        const key = machine === undefined ? contentHash([account, records.main.session]) : machineKeyOf(machine, records.main.session);
         if (!allow.allows(records.main.project)) {
-            counts.excluded.folder += 1;
-            await withdraw(key);
+            if (named) {
+                counts.excluded.folder += 1;
+                await withdraw(key);
+            }
             continue;
         }
         // A folder switched off sends nothing from now on; what it sent before stays where it went.
         if (sendsOf(saved.pool, records.main.project) === 'off') {
-            counts.off += 1;
-            await withdraw(key);
+            if (named) {
+                counts.off += 1;
+                await withdraw(key);
+            }
+            continue;
+        }
+        if (!named && scanned.fresh(records.main.project, records.main.session)) {
+            history.push(records);
             continue;
         }
         const verdict = await checkSession(runtime, terms, records.main.project, records.main.session);
         if (verdict.reason !== 'clean') {
-            counts.excluded[excludedKey(verdict.reason)] += 1;
-            await withdraw(key);
+            if (named) {
+                counts.excluded[excludedKey(verdict.reason)] += 1;
+                await withdraw(key);
+            }
             continue;
         }
-        // The batch of a session is built once the session and its subagents have ended; a session still in progress waits, and an earlier batch of it is withdrawn.
-        if (!hasEnded(records, deps.now(), await lastWritten(runtime, records.main.project, records.main.session))) {
+        if (!named) {
+            scanned.note(records.main.project, records.main.session);
+            history.push(records);
+            continue;
+        }
+        // The batch of a session is built once the session and its subagents have ended; a session still in progress waits, and an earlier batch of it is withdrawn. A machine's Stop is the end of a turn, not of a session: its VM may be reclaimed before the session ends, so it builds the open session as it stands.
+        if (machine === undefined && !hasEnded(records, deps.now(), await lastWritten(runtime, records.main.project, records.main.session))) {
             counts.notEnded += 1;
             await withdraw(key);
             continue;
@@ -400,13 +576,18 @@ export const poolDeposit = async (deps, options) => {
         ready.push({ records, key });
     }
     // A delta is built from the sessions that passed, carried by the batch of the session that filled its after window, and marked sent only once that batch is written: a deposit that stops first builds it again.
-    const placed = ready.flatMap(({ records }) => placedOf(records) ?? []);
+    // A cloud machine has no history of its own to compare a window against (every VM starts clean), so it carries none.
+    const placed = machine?.hostClass === 'cloud' ? [] : [...ready.map(({ records }) => records), ...history].flatMap((records) => placedOf(records) ?? []);
     const carried = carriedDeltas(account, placed, await sentDeltas(outbox));
     // The coverage bands (t871): the operator's two settings, read here, and the team band counted from the local git log. Nothing is looked up, and anything unread goes as unknown.
     const coverageOf = makeCoverage(runtime, await readCoverageSetting(runtime.storeDir), options.git ?? runGit);
+    // The recommendations each session was shown or held back from, read from the local rows with their windows, so a shown row stays shown at the pool and a session with none sends none (the pool reads that as unknown).
+    const recalls = deriveConsequences(localStore, await readRecalls(runtime.storeDir));
     for (const { records, key } of ready) {
         const delta = carried.get(records.main.session);
-        const skeleton = skeletonOf(records, key, shellReader(vocabulary()), contentHash, delta?.entries, gate, await coverageOf(records.main));
+        // A machine builds the open session at every Stop and SessionEnd, so the one it names keeps what its own earlier batch carried and takes only what is new; any other deposit builds a session once.
+        const entries = machine !== undefined && options.session !== undefined ? keptDeltas(await heldDeltas(outbox, key), delta?.entries ?? []) : delta?.entries;
+        const skeleton = skeletonOf(records, key, shellReader(vocabulary()), contentHash, entries, gate, await coverageOf(records.main), recommendationsOf(recalls, records.main.session));
         if (skeleton === null) {
             counts.uncaptured += 1;
             await withdraw(key);
@@ -421,12 +602,15 @@ export const poolDeposit = async (deps, options) => {
             await withdraw(key);
             continue;
         }
+        // Noted before the batch is written: a person's sweep that runs between the two lines would delete a batch it cannot yet tell is a machine's.
+        if (machine !== undefined)
+            await noteMachineKey(outbox, key);
         builtBytes += (await writeBatch(outbox, key, parsed.skeleton)).bytes;
         // The raw copy comes only after both gates and only with a yes to the raw prompt and a folder not at skeleton only: each transcript of the session, redacted here, before it is queued.
-        if (rawAllowed(saved.pool, records.main.project)) {
+        if (rawAllowed(saved.pool, records.main.project, covenant)) {
             let place = 0;
             for (const file of await transcriptFilesOf(runtime, records.main.project, records.main.session)) {
-                const redacted = redactTranscript(await readFile(file.path, 'utf8'), saved.redactDomains, names);
+                const redacted = redactTranscript(await readFile(file.path, 'utf8'), saved.redactDomains, names, injectedKey);
                 counts.raw.bytes += (await writeRaw(outbox, key, place, redacted.text)).bytes;
                 counts.raw.copies += 1;
                 counts.raw.masked += redacted.masked;
@@ -439,9 +623,13 @@ export const poolDeposit = async (deps, options) => {
         built.add(key);
         counts.batched += 1;
     }
-    // The batch of a session or account this store no longer holds goes too.
-    counts.withdrawn += await removeBatchesExcept(outbox, built);
-    await removeRawExcept(outbox, rawKept);
+    // The batch of a session or account this store no longer holds goes too. A machine builds one session at a time and nothing here has the others in hand, so it sweeps nothing: nothing is withdrawn but what a gate refused.
+    if (machine === undefined) {
+        // The batches a machine's Stop built in this outbox are not this pass's to withdraw: their keys cannot be recomputed here. The key log is read after the folder is listed, so a batch a machine writes during the sweep is already in it.
+        counts.withdrawn += await removeBatchesExcept(outbox, async () => new Set([...built, ...(await machineKeys(outbox)), ...(await pulledAt(outbox))]));
+        await removeRawExcept(outbox, new Set([...rawKept, ...(await machineKeys(outbox))]));
+    }
+    await scanned.save();
     counts.refusedFields = [...refusedFields].sort();
     recordWire(deps, wireTally);
     const { folder, term, noRaw, noTerms, unreadable } = counts.excluded;
@@ -454,6 +642,7 @@ export const poolDeposit = async (deps, options) => {
         ...(counts.withdrawn === 0 ? [] : [`Removed ${String(counts.withdrawn)} ${counts.withdrawn === 1 ? 'batch' : 'batches'} of sessions that no longer pass the gates, have not ended, or are no longer in the store.`]),
         ...(discarded === 0 ? [] : [`Discarded ${String(discarded)} ${discarded === 1 ? 'batch' : 'batches'} built under an older vocabulary, field list, or skeleton format.`]),
         `Raw copies queued: ${String(counts.raw.copies)} (${String(counts.raw.bytes)} bytes, ${String(counts.raw.masked)} values masked). ${rawNote(saved.pool.rawConsent)}`.trim(),
+        ...(rawStale(saved.pool, covenant) ? [`Your yes to the raw prompt was given under covenant ${saved.pool.rawConsentVersion ?? 'none'}, not ${covenant ?? ''}, so no raw copy is queued. Run oars pool raw --consent yes to answer for the covenant now in force.`] : []),
         ...(counts.off === 0 ? [] : [`${String(counts.off)} ${counts.off === 1 ? 'session' : 'sessions'} in a folder switched off: nothing of them is queued.`]),
         'Run oars pool outbox to print exactly what would be sent.',
     ];
@@ -478,7 +667,7 @@ export const poolOutbox = async (deps, options) => {
     const server = poolServer(deps.env, OUTBOX, options.server);
     const { token } = await signedIn(deps, runtime.storeDir, server, OUTBOX);
     const outbox = outboxFolder(runtime.storeDir, server);
-    const { batches, edited } = await heldBatches(outbox);
+    const { batches, edited } = await heldAcross(outbox);
     const masker = new Masker();
     masker.add(token);
     const sent = await sentLog(outbox);
@@ -562,10 +751,10 @@ export const poolFetch = async (deps, options) => {
     const { harnessVersion } = options;
     if (!isBundleVersion(harnessVersion))
         throw usage(`${harnessVersion} is not a public harness version.`, FETCH);
-    const { token, signingKey } = await signedIn(deps, storeDir, server, FETCH);
+    const { token, signingKeys } = await signedIn(deps, storeDir, server, FETCH);
     const harness = await fetchHarness(deps, storeDir, options.harness);
     const file = replicaFile(storeDir, server, harness, harnessVersion);
-    const kept = await keptReplica(file, signingKey, harness, harnessVersion);
+    const kept = await keptReplica(file, signingKeys, harness, harnessVersion);
     const credential = new Masker();
     credential.add(token);
     const reply = await ask(deps, FETCH, server, `/bundle/${harness}/${encodeURIComponent(harnessVersion)}/${encodeURIComponent(VOCAB_VERSION)}`, { token, show: credential, ...(kept?.etag === undefined ? {} : { ifNoneMatch: kept.etag }) });
@@ -592,7 +781,7 @@ export const poolFetch = async (deps, options) => {
         emit('fetch', { harness, fetches: 1 });
         throw refusal(FETCH, reply);
     }
-    const verified = await verifyBundle(reply.body, signingKey, harness, harnessVersion);
+    const verified = await verifyBundle(reply.body, signingKeys, harness, harnessVersion);
     if (!verified.ok) {
         const title = `Refused the bundle: ${verified.reason}.`;
         emit('fetch', { harness, fetches: 1 });
@@ -610,13 +799,104 @@ export const poolFetch = async (deps, options) => {
     };
 };
 const RAW = 'pool-raw';
-/** The raw prompt, in plain words: shown by `oars pool raw` until it is answered, and what the nightly send relies on. Redaction is best effort and the text says so. */
+/** The raw prompt, in plain words: shown by `oars pool raw` until it is answered, and what the detached sender relies on. Redaction is best effort and the text says so. */
 export const RAW_PROMPT = [
-    'Raw transcripts are separate from the covenant. If you say yes, then once the pool says your account accepted its covenant, the nightly task uploads a redacted copy of each full transcript of every folder you allowed, beside its skeleton, except a folder you set to skeleton only or off.',
+    'Raw copies are covered by the covenant you accepted, including its license to sell them and to train on them. If you say yes, then once the pool says your account accepted its covenant, the sender that a session-end hook or any oars command starts (at most about once an hour) uploads a redacted copy of each full transcript of every folder you allowed, beside its skeleton, except a folder you set to skeleton only or off.',
+    'Many Oars Co. may sell these copies and use them to train AI models, and it may let anyone it sells them to do the same.',
     'Redaction runs on this machine, before anything is queued, and it is best effort: it masks secret shapes it knows, emails, your username, home paths, environment values, and hosts, and it can miss a secret that has no recognizable shape or a name written in prose.',
     'It also does not catch a host with no dot, a public host name outside a link, quoted file contents and command output, a secret split across lines, images and attachments, a JSON env value, your username written another way, another person\'s hyphenated name in a project folder path, or an IPv6 address with a zone or inside a longer word, and a common-word account name is masked everywhere it appears.',
-    'Say no, or say nothing, and only skeletons go to the pool. Change your mind any time: oars pool raw --consent yes|no. A no stops later sends only; it cannot recall what was already sent.',
+    'The blocks the harness adds on its own (instruction files, memory, skill lists, the system prompt) are replaced by a short marker, but a block in a shape the redactor does not list yet, a summary the harness writes for a session you left, a file it quotes after compaction, the echo of a command you ran, a reminder the harness puts in the middle of a message, and what an agent reports back are not, and stay as written; the project folder name and working directory on each line also stay readable, apart from the masking above.',
+    'Yes is also your explicit consent to processing any health, belief, or other special category data about you that a copy holds, for these purposes. You can withdraw it at any time with oars pool raw --consent no, and that reaches copies already sent. Your access does not depend on it.',
+    'Say no, or say nothing, and only skeletons go to the pool. Change your mind any time: oars pool raw --consent yes|no. A no stops later sends. If the GDPR or the UK GDPR protects you, it also reaches copies already sent. The pool starts erasing the raw copies it already holds for you at the pool\'s next nightly run; a large account, or a busy night, can take more than one night.',
 ].join('\n');
+/** What a person types to say yes to the raw prompt: consent is a statement made at a terminal (GDPR Articles 7 and 9(2)(a)), not a flag a script can pass. */
+export const RAW_PHRASE = 'I consent to sending raw copies';
+/** The covenant version the pool has in force (`GET /v1/covenant` is public). With none published a yes cannot be tied to a covenant, so nothing is recorded. */
+const covenantInForce = async (deps) => {
+    const reply = await ask(deps, RAW, poolServer(deps.env, RAW), '/v1/covenant', {});
+    if (reply.status !== 200 || !isObject(reply.body))
+        throw refusal(RAW, reply);
+    const version = textIn(reply.body, 'version');
+    if (version === undefined) {
+        const title = 'This pool has not published its covenant, so a yes to the raw prompt cannot be tied to one. Nothing was recorded.';
+        throw new CliError(title, ExitCode.AUTH, RAW, { code: 'deposits_closed', title, status: 403 });
+    }
+    return version;
+};
+/** A yes to the raw prompt is a person typing its phrase at a terminal. The covenant in force is read first, so no one is asked to type for a pool that has none; a wrong phrase, a closed terminal, or no terminal records nothing. Returns the covenant version the yes belongs to. */
+const typedYes = async (deps) => {
+    const notRecorded = (title) => new CliError(title, ExitCode.AUTH, RAW, { code: 'raw_consent_not_given', title, status: 403 });
+    if (!isTerminal(deps))
+        throw notRecorded('Saying yes to the raw prompt takes a person at a terminal who reads it and types its phrase: run oars pool raw --consent yes from one. Nothing was recorded.');
+    const covenant = await covenantInForce(deps);
+    deps.io.stderr(`
+${RAW_PROMPT}
+
+To say yes, type exactly: ${RAW_PHRASE}
+
+> `);
+    const typed = await lineFrom(runtimeOf(deps).stdin);
+    if (typed?.trim() !== RAW_PHRASE)
+        throw notRecorded(`${typed === undefined ? 'No phrase was typed' : 'That was not the phrase'}. To say yes, type exactly: ${RAW_PHRASE}. Nothing was recorded.`);
+    return covenant;
+};
+/** The sign-in this machine holds for the pool, if any. */
+const signInAtPool = async (deps, server) => (await loadSignIns(runtimeOf(deps).storeDir, RAW)).find((found) => found.server === server);
+/** One call to `/v1/consent/raw` with the account credential; `fail` words what a pool that was not reached or refused means for the command. */
+const consentCall = async (deps, server, token, init, fail) => {
+    let reply;
+    try {
+        reply = await ask(deps, RAW, server, '/v1/consent/raw', { ...init, token });
+    }
+    catch (error) {
+        if (!(error instanceof CliError) || error.exitCode !== ExitCode.UNREACHABLE)
+            throw error;
+        throw fail(`${error.message}.`, ExitCode.UNREACHABLE);
+    }
+    if (reply.status !== 200) {
+        const refused = refusal(RAW, reply);
+        throw fail(refused.message, refused.exitCode, refused.problem);
+    }
+};
+/**
+ * After a yes is typed, tells the pool before it is saved here: once an account has withdrawn, the pool takes a yes only through this call (GDPR Article 7(3)), so a yes it never heard would only be refused at the next send.
+ * A machine with no sign-in has no account to tell; the yes stands here and the sender asks the pool when there is one. Anything else that keeps the pool from hearing it throws, and nothing is recorded.
+ */
+const grantAtPool = async (deps, covenant) => {
+    const server = poolServer(deps.env, RAW);
+    const entry = await signInAtPool(deps, server);
+    if (entry === undefined)
+        return 'no-account';
+    const notRecorded = (why, exitCode, problem) => {
+        const title = `The pool at ${server} did not take your yes: ${why} Nothing was recorded.`;
+        return new CliError(title, exitCode, RAW, { ...problem, title });
+    };
+    if (entry.expiresAt <= deps.now())
+        throw notRecorded('your sign-in has lapsed. Run oars pool login first.', ExitCode.AUTH);
+    await consentCall(deps, server, entry.token, { method: 'PUT', body: { version: covenant } }, notRecorded);
+    return 'told';
+};
+/**
+ * After a no is saved here, tells the pool so it stops accepting raw copies from this account and records the withdrawal (GDPR Article 7(3)). A machine with no sign-in at this pool has no account there to tell, which is no failure unless it held a yes: then the pool may still hold that yes, and the command says it was not told.
+ * Anything else that keeps the pool from being told (unreachable, a lapsed sign-in, a refusal) throws, with the saved answer standing: the command exits nonzero and a rerun retries.
+ */
+const withdrawAtPool = async (deps, heldYes) => {
+    const server = poolServer(deps.env, RAW);
+    const entry = await signInAtPool(deps, server);
+    const notTold = (why, exitCode, problem) => {
+        const title = `Your no is saved here, so no raw copy leaves this machine, but the pool at ${server} was not told: ${why} Run oars pool raw --consent no again to retry.`;
+        return new CliError(title, exitCode, RAW, { ...problem, title });
+    };
+    if (entry === undefined) {
+        if (heldYes)
+            throw notTold('this machine is signed out. Run oars pool login first.', ExitCode.AUTH);
+        return 'no-account';
+    }
+    if (entry.expiresAt <= deps.now())
+        throw notTold('your sign-in has lapsed. Run oars pool login first.', ExitCode.AUTH);
+    await consentCall(deps, server, entry.token, { method: 'DELETE' }, notTold);
+    return 'told';
+};
 /** `oars pool raw`: shows the raw prompt and the answer so far; `--consent yes|no` records the answer; `--folder <entry> --mode all|skeleton|off` sets what one folder may send. */
 export const poolRaw = async (deps, options) => {
     const runtime = runtimeOf(deps);
@@ -627,9 +907,19 @@ export const poolRaw = async (deps, options) => {
     if (options.mode !== undefined && options.mode !== 'all' && options.mode !== 'skeleton' && options.mode !== 'off')
         throw usage('--mode takes all, skeleton, or off.', RAW);
     const { folder, mode } = options;
+    // A yes is tied to the covenant in force when it is given, so the pool is asked which that is before anything is stored. A no needs none.
+    const covenant = options.consent === 'yes' ? await typedYes(deps) : null;
+    const heardYes = covenant === null ? undefined : await grantAtPool(deps, covenant);
+    // What this machine held before the save: a no on a signed-out machine that held a yes, or whose earlier no never reached the pool, leaves the pool's yes standing.
+    const before = { yes: false };
     const choices = await updatePoolChoices(runtime.storeDir, (current) => {
-        if (options.consent !== undefined)
+        before.yes = current.rawConsent === 'granted' || current.withdrawalPending;
+        if (options.consent !== undefined) {
             current.rawConsent = options.consent === 'yes' ? 'granted' : 'declined';
+            current.rawConsentVersion = covenant;
+            // A no the pool has not heard stays pending until it does; a yes replaces whatever the pool was owed.
+            current.withdrawalPending = options.consent === 'no' && before.yes;
+        }
         if (folder !== undefined) {
             if (mode === 'all')
                 Reflect.deleteProperty(current.folders, folder);
@@ -637,10 +927,23 @@ export const poolRaw = async (deps, options) => {
                 current.folders[folder] = mode;
         }
     });
-    const answer = choices.rawConsent === null ? 'not answered yet: only skeletons go to the pool' : choices.rawConsent === 'granted' ? 'yes: redacted raw copies leave' : 'no: only skeletons go to the pool';
+    // The local answer is saved above, so a pool that cannot be told leaves it standing and the command fails: a rerun retries.
+    const told = options.consent === 'no' ? await withdrawAtPool(deps, before.yes) : heardYes;
+    // The pool heard the withdrawal: nothing is owed it any more.
+    if (told === 'told' && options.consent === 'no') {
+        await updatePoolChoices(runtime.storeDir, (current) => {
+            current.withdrawalPending = false;
+        });
+    }
+    const answer = choices.rawConsent === null ? 'not answered yet: only skeletons go to the pool' : choices.rawConsent === 'granted' ? `yes, given under covenant ${choices.rawConsentVersion ?? 'none'}: redacted raw copies leave while that covenant is in force` : 'no: only skeletons go to the pool';
     const switched = Object.entries(choices.folders).map(([entry, set]) => `  ${entry}: ${set === 'off' ? 'nothing sent to the pool' : 'skeletons only'}`);
-    const lines = [...(choices.rawConsent === null ? [RAW_PROMPT, ''] : []), `Raw copies: ${answer}.`, ...(switched.length === 0 ? [] : ['Folders switched down:', ...switched])];
-    return { document: { ok: true, rawConsent: choices.rawConsent, folders: choices.folders }, text: lines.join('\n') };
+    const toldLine = told === undefined
+        ? []
+        : options.consent === 'yes'
+            ? [told === 'told' ? 'The pool heard it: raw copies are accepted again from this account for the covenant in force.' : 'This machine holds no sign-in to the pool, so it told the pool nothing. Sign in with oars pool login; if you withdrew before, run this again then.']
+            : [told === 'told' ? 'The pool was told: it no longer accepts raw copies from this account, keeps a record of the withdrawal, and starts erasing at the pool\'s next nightly run; a large account, or a busy night, can take more than one night.' : 'This machine holds no sign-in to the pool, so it told the pool nothing. If you said yes from another machine, sign in with oars pool login and run this again.'];
+    const lines = [...(choices.rawConsent === null ? [RAW_PROMPT, ''] : []), `Raw copies: ${answer}.`, ...toldLine, ...(switched.length === 0 ? [] : ['Folders switched down:', ...switched])];
+    return { document: { ok: true, rawConsent: choices.rawConsent, rawConsentVersion: choices.rawConsentVersion, folders: choices.folders, ...(told === undefined ? {} : { pool: told }) }, text: lines.join('\n') };
 };
 const COVERAGE = 'pool-coverage';
 /** A named value from a closed list, or a usage error that lists the members. */
@@ -667,3 +970,144 @@ export const poolCoverage = async (deps, options) => {
     const lines = [`Organization size: ${setting.orgSize}`, `Repository visibility: ${setting.repoVisibility}`, 'Both stay on this machine until a deposit states them as bands; nothing is looked up. The team band is counted from each repository\'s local git log at deposit.'];
     return { document: { ok: true, saved: changed, ...setting }, text: lines.join('\n') };
 };
+/**
+ * `oars pool prove`: the account proves control of itself with its sign-in token alone (`POST /v1/account/proof`, never a machine key), and the pool stores the time. It prints the account and the time to send, in reply to the operator's request for proof, so the operator can compare them with the stored row (GDPR Art. 12(6)). A lapsed sign-in says to run `oars pool login` first; a closed account proves by that login instead.
+ */
+export const poolProve = async (deps, options) => {
+    const { storeDir } = runtimeOf(deps);
+    const server = poolServer(deps.env, PROVE, options.server);
+    const { token } = await signedIn(deps, storeDir, server, PROVE);
+    const credential = new Masker();
+    credential.add(token);
+    const reply = await ask(deps, PROVE, server, '/v1/account/proof', { body: {}, token, show: credential });
+    if (reply.status !== 200)
+        throw refusal(PROVE, reply);
+    const account = isObject(reply.body) ? textIn(reply.body, 'account') : undefined;
+    const provedAt = isObject(reply.body) ? numberIn(reply.body, 'provedAt') : undefined;
+    if (account === undefined || provedAt === undefined)
+        throw new CliError('The pool answered a proof with no account or proof time.', ExitCode.UNEXPECTED, PROVE);
+    return {
+        document: { ok: true, server, account, provedAt },
+        text: `Proof recorded for ${account} at ${new Date(provedAt).toISOString()}. Send these two lines in reply to the privacy@manyoars.com message that asked you for proof:
+${proofLines(account, provedAt)}`,
+    };
+};
+/** What the pool's export pages say they are (`export.ts` in the pool). A page of another format or version is refused, not guessed at. */
+const EXPORT_FORMAT = 'oars-pool-account-export';
+const EXPORT_VERSION = 1;
+/** One page's file, numbered from 1 in the order the pool gave the pages. */
+const exportPageFile = (page) => `account-export-${String(page).padStart(4, '0')}.json`;
+const EXPORT_PAGE_FILE = /^account-export-(\d{4,})\.json$/;
+const exportPageOf = (body) => {
+    if (!isObject(body) || Reflect.get(body, 'format') !== EXPORT_FORMAT)
+        return 'is not an account export page';
+    const version = Reflect.get(body, 'version');
+    if (version !== EXPORT_VERSION)
+        return `is version ${String(version)}, and this client reads version ${String(EXPORT_VERSION)}`;
+    const rows = Reflect.get(body, 'rows');
+    const next = Reflect.get(body, 'next');
+    if (!Array.isArray(rows) || (next !== null && typeof next !== 'string'))
+        return 'carries no rows or no cursor';
+    const held = rows;
+    return { rows: held, next, section: Reflect.get(body, 'section') };
+};
+const plural = (count, one, many = `${one}s`) => `${String(count)} ${count === 1 ? one : many}`;
+const answered = ({ status, body }) => {
+    const message = isObject(body) ? textIn(body, 'message') : undefined;
+    return `HTTP ${String(status)}${message === undefined ? '' : `: ${message}`}`;
+};
+/** `oars pool export`: the person's own copy of what the pool holds about their account, saved to a folder (GDPR Articles 15(3) and 20). It follows the pool's cursor page by page and keeps each page as a file; with `raw` it also fetches each raw object the ledger lists that still stands. It writes nothing to the pool. A failed page stops the walk (there is no cursor past it); a failed object does not stop the others. Every failure is named in the error, with what was saved. */
+export const poolExport = async (deps, options) => {
+    const { storeDir } = runtimeOf(deps);
+    const server = poolServer(deps.env, EXPORT, options.server);
+    const { token } = await signedIn(deps, storeDir, server, EXPORT);
+    const folder = resolve(options.out);
+    await mkdirOwnerOnly(folder);
+    const credential = new Masker();
+    credential.add(token);
+    const failures = [];
+    const standing = [];
+    let erased = 0;
+    let rows = 0;
+    let pages = 0;
+    const cursors = new Set();
+    let cursor = null;
+    do {
+        const number = pages + 1;
+        const reply = await ask(deps, EXPORT, server, cursor === null ? '/v1/account/export' : `/v1/account/export?cursor=${encodeURIComponent(cursor)}`, { token, show: credential }, options.via);
+        if (reply.status !== 200) {
+            failures.push({ what: `page ${String(number)} (${answered(reply)})`, reply });
+            break;
+        }
+        const read = exportPageOf(reply.body);
+        if (typeof read === 'string') {
+            failures.push({ what: `page ${String(number)} ${read}`, code: 'export_invalid' });
+            break;
+        }
+        await writeOwnerOnly(join(folder, exportPageFile(number)), `${JSON.stringify(reply.body, null, 2)}\n`);
+        pages = number;
+        rows += read.rows.length;
+        for (const row of read.section === 'rawLedger' ? read.rows : []) {
+            const hash = isObject(row) ? textIn(row, 'sha256') : undefined;
+            if (hash === undefined || !/^[0-9a-f]{64}$/.test(hash))
+                failures.push({ what: `page ${String(number)} lists a raw object with no SHA-256`, code: 'export_invalid' });
+            else if (isObject(row) && Reflect.get(row, 'tombstone') !== null)
+                erased += 1;
+            else
+                standing.push(hash);
+        }
+        cursor = read.next;
+        if (cursor !== null && cursors.has(cursor)) {
+            failures.push({ what: `page ${String(number)} named a cursor the pool had already given`, code: 'export_invalid' });
+            break;
+        }
+        if (cursor !== null)
+            cursors.add(cursor);
+    } while (cursor !== null);
+    let saved = 0;
+    const rawFolder = join(folder, 'raw');
+    if (options.raw === true)
+        await mkdirOwnerOnly(rawFolder);
+    if (options.raw === true) {
+        for (const hash of standing) {
+            const reply = await ask(deps, EXPORT, server, `/v1/account/export/raw/${hash}`, { token, show: credential, binary: true }, options.via);
+            if (reply.status !== 200)
+                failures.push({ what: `raw object ${hash} (${answered(reply)})`, reply });
+            else if (!(reply.body instanceof Uint8Array))
+                failures.push({ what: `raw object ${hash} came with no bytes`, code: 'export_invalid' });
+            else if (createHash('sha256').update(reply.body).digest('hex') !== hash)
+                failures.push({ what: `raw object ${hash} did not hash to its name`, code: 'raw_unverified' });
+            else {
+                await writeOwnerOnly(join(rawFolder, hash), reply.body);
+                saved += 1;
+            }
+        }
+    }
+    const counts = [plural(pages, 'page'), ...(options.raw === true ? [plural(saved, 'raw object')] : [])];
+    const lead = failures[0];
+    if (lead !== undefined) {
+        const message = `The export to ${folder} is incomplete: ${failures.map(({ what }) => what).join('; ')}. Saved ${counts.join(' and ')} there.`;
+        const refused = lead.reply === undefined ? undefined : refusal(EXPORT, lead.reply);
+        throw new CliError(message, refused?.exitCode ?? ExitCode.INVALID, EXPORT, { ...(refused?.problem ?? {}), title: message, ...(lead.code === undefined ? {} : { code: lead.code }) });
+    }
+    // A shorter export than the last one leaves no page of the older one to be read as part of this.
+    for (const name of await readdir(folder)) {
+        const found = EXPORT_PAGE_FILE.exec(name);
+        if (found !== null && Number(found[1]) > pages)
+            await rm(join(folder, name));
+    }
+    // The same for raw copies: one whose object the pool has since erased must not read as a copy of something it still holds. Only a file named like a SHA-256 is ours to remove.
+    if (options.raw === true) {
+        const held = new Set(standing);
+        for (const name of await readdir(rawFolder)) {
+            if (/^[0-9a-f]{64}$/.test(name) && !held.has(name))
+                await rm(join(rawFolder, name));
+        }
+    }
+    const ledger = standing.length + erased;
+    const rawNote = options.raw === true ? (erased > 0 ? ` ${plural(erased, 'raw object')} listed in the ledger ${erased === 1 ? 'was' : 'were'} erased, so no copy of ${erased === 1 ? 'it' : 'them'} remains.` : '') : standing.length > 0 ? ` The ledger lists ${plural(ledger, 'raw object')}: run again with --raw to save your copies of the ${standing.length === 1 ? 'one' : 'ones'} that stand.` : '';
+    return {
+        document: { ok: true, server, folder, pages, rows, raw: { requested: options.raw === true, saved, erased } },
+        text: `Saved your pool export to ${folder}: ${[...counts, plural(rows, 'row')].join(', ')}.${rawNote}`,
+    };
+};