@passioncode-ai/passioncode 0.2.45 → 0.2.46

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-slots.mjs

@@ -0,0 +1,180 @@
+// The board responder's slot records (FAA-155, FAA-163): the generation it holds each slot at, a move to another
+// session and its take-back, and a capability whose enroll was refused, retried on its own. Part of the board
+// connector (FAA-65, layer L4); Responder (fabric-board-session.mjs) extends SlotKeeper.
+import { BoardError, LEASE_SECONDS, isInt, isObj } from './fabric-board-shapes.mjs';
+
+// The answer may have been stored: send it again with the same key (BoardError).
+export const LOST = ['unreachable', 'session-ended'];
+
+/** A lost call is sent again this long before the lease it keeps would lapse (FAA-77, finding 38). */
+export const LEASE_MARGIN_SECONDS = 10;
+
+/** How long a held slot waits before it asks again: doubling from the poll interval, never past this. */
+export const HOLD_RETRY_MAX_SECONDS = 900;
+
+/** Refusals that are about the board session, not one capability: they end recovery and go to the responder's fault. */
+export const SESSION_CODES = Object.freeze(new Set(['unreachable', 'session-ended', 'not_authorized', 'authority_changed', 'credential', 'no-epoch',
+  'schema-unsupported', 'checkpoint', 'receipt-shape', 'idempotency_conflict', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol', 'not_available']));
+
+/** The slot methods of Responder, which owns every field they read (checkpoint, slots, project, locked). */
+export class SlotKeeper {
+  // -- a slot moved to another session (FAA-155, DEC-0140 PR-2) --
+  /** The generation this responder holds the slot at, kept beside its checkpoint; a failed write is retried at the next receipt. */
+  heldAt(capability, generation) {
+    this.note(capability, { project: this.project, generation });
+    this.confirmed[capability] = generation;
+    delete this.said[`board.slot.refused:${capability}`]; // held again: a later refusal is said again
+    delete this.said[`board.slot.contested:${capability}`]; // and a later contest, by enroll or replace
+  }
+
+  /** The slot record, best effort: one that cannot be written now is written at the next receipt. */
+  note(capability, record) {
+    try {
+      this.checkpoint.slot(capability, record);
+    } catch {
+      // the request steps fail closed on their own
+    }
+  }
+
+  /**
+   * An enroll or replace is recorded with its key before it is sent, so a lost answer is never read as a move; a refusal
+   * drops the record, a receipt replaces it (heldAt), a record that cannot be written is skipped.
+   */
+  async ask(capability, op, args) {
+    let held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project) return this.call(op, args); // no record: nothing a lost answer could be mistaken for
+    const slot = this.slots[capability] ?? {};
+    if (op === 'com.enroll' && slot.state === 'held' && slot.generation === held.generation
+      && this.now() - (slot.renewedAt ?? 0) < LEASE_SECONDS - LEASE_MARGIN_SECONDS && !('asking' in held)) {
+      return this.call(op, args); // a live holder's renew cannot change its generation: nothing to record
+    }
+    if (isObj(held.asking)) {
+      // An earlier lost ask is settled first; it may show the slot moved.
+      if (await this.gone(capability)) throw new BoardError('fenced', `The ${capability} slot moved to another session.`, false, op);
+      held = this.checkpoint.slots[capability] ?? {};
+    }
+    try {
+      this.checkpoint.slot(capability, { ...held, asking: { op, args } });
+    } catch {
+      return this.call(op, args);
+    }
+    try {
+      return await this.call(op, args);
+    } catch (e) {
+      if (!LOST.includes(e.code)) this.note(capability, held);
+      throw e;
+    }
+  }
+
+  /**
+   * Asks a lost enroll or replace again under its key. `repeated: true`: it landed, the generation is ours. Else it ran
+   * only now: if the slot had moved past the record (`before`), the record stays and the move is read (the slot just
+   * taken lapses unused). A refusal or an odd receipt drops the record; a lost answer keeps it.
+   */
+  async replay(capability, held, before) {
+    const { asking, ...rest } = held;
+    let record = rest;
+    if (isObj(asking) && ['com.enroll', 'com.responder_replace'].includes(asking.op)) {
+      try {
+        const answer = this.receipt(asking.op, await this.call(asking.op, asking.args));
+        const generation = answer.slot?.generation;
+        const moved = isInt(before, 1) && isInt(rest.generation, 1) && before > rest.generation;
+        if (isInt(generation, 1) && (answer.repeated === true || !moved)) record = { project: this.project, generation };
+      } catch (e) {
+        if (LOST.includes(e.code)) throw e;
+        if (e.code === 'idempotency_window_expired') record = {}; // a retired epoch: unknown, so a first start, no move
+      }
+    }
+    this.note(capability, Object.keys(record).length ? record : null);
+    return record;
+  }
+
+  /**
+   * True when com.status shows the slot's generation past the one recorded held: the operator or another session moved
+   * it. The slot is left `moved`. No record, another Project's, an odd value or no later generation: false.
+   */
+  async gone(capability, status = null) {
+    let held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project || (!isInt(held.generation, 1) && !('asking' in held))) return false;
+    let now = ((status ?? await this.status()).responders ?? []).find((r) => isObj(r) && r.capability === capability)?.generation;
+    if ('asking' in held) held = await this.replay(capability, held, now); // its own lost ask first
+    if (isInt(held.moved, 1) /* a recorded move stays until takeBack */ && !(isInt(now, 1) && now > (held.generation ?? now))) now = held.moved;
+    if (!isInt(now, 1) || !isInt(held.generation, 1) || now <= held.generation) {
+      if (isInt(now, 1) && isInt(held.generation, 1) && !('moved' in held)) this.confirmed[capability] = held.generation; // com.status shows it unmoved (0.56.0 seam r3)
+      return false;
+    }
+    // On the fence queue (FAA-158): a fenced call in flight lands first, and a takeBack meanwhile wins.
+    return this.locked(() => this.moved(capability, held, now));
+  }
+
+  /** The slot moved past `held` to `now`: stop its work, keep its accepted requests held, say it once. */
+  moved(capability, held, now) {
+    const record = this.checkpoint.slots[capability] ?? {};
+    if (record.project !== this.project || record.generation !== held.generation) return false; // a takeBack forgot it
+    if (this.current?.entry.capability === capability) {
+      this.current.ctx.stopped = true;
+      this.current = null;
+    }
+    for (const entry of Object.values(this.checkpoint.entries).filter((e) => e.capability === capability).map((e) => ({ ...e }))) {
+      if (entry.step === 'claimed') this.checkpoint.drop(entry.request); // the move returned the claim to the queue
+      else if (!['unknown', 'lapsed'].includes(entry.step)) {
+        // Begun: outcome_unknown, which the slot's holder reconciles. Accepted: held on the board, continued only by a
+        // transfer if the slot is this service's again; never a com.responder_replace on its own.
+        entry.step = entry.effect ? 'unknown' : 'lapsed';
+        this.checkpoint.put(entry);
+      }
+    }
+    this.toResume = this.toResume.filter((r) => this.checkpoint.entries[r]?.capability !== capability);
+    this.slots[capability] = { state: 'moved', generation: now, renewedAt: this.now() };
+    delete this.confirmed[capability];
+    if (!('moved' in held)) { // once, even across restarts
+      this.emit('board.slot.moved', 'warning', `The ${capability} slot on this Project moved to another session. This service stopped answering it there and left its accepted work \`accepted\` (work begun is the new holder's to settle). Its take-back action brings the slot back once the other session lets it go, or at a later restart or reconnect while accepted work waits; a restart alone does not. Without it, ask its maintainer.`, { notify: true, episode: capability, capability, generation: now, held: held.generation });
+      this.note(capability, { ...held, moved: now }); // said again at the next start if it cannot be written
+    }
+    return true;
+  }
+
+  /**
+   * The operator's act, never the kit's: forget that a capability's slot moved away. In the same board session the next
+   * tick enrolls once the slot is free; a reconnect with held work takes it back at once by a transfer (FAA-155).
+   */
+  takeBack(capability) {
+    if (!this.capabilities.includes(capability)) throw new BoardError('invalid_arguments', `This responder does not answer ${capability}.`);
+    this.checkpoint.slot(capability, null);
+    if (this.slots[capability]?.state === 'moved') this.slots[capability] = { state: 'contested', renewedAt: 0 };
+    delete this.said['board.slot.moved'];
+  }
+
+  // -- one capability's refusal (FAA-163) --
+  /**
+   * An enroll or replace of one capability was refused: its accepted work waits `lapsed` (a transfer takes it back once
+   * the slot is held) and the capability asks again after a doubling pause; the others go on.
+   */
+  retryLater(capability, entries, e) {
+    if (this.slots[capability]?.state === 'held') return; // the replace landed: what failed came after it
+    for (const entry of entries) {
+      if (!['unknown', 'lapsed'].includes(entry.step)) {
+        entry.step = 'lapsed';
+        this.checkpoint.put(entry);
+      }
+    }
+    const slot = this.slots[capability] ?? {};
+    const tries = slot.state === 'retry' ? (slot.tries ?? 0) + 1 : 1;
+    const wait = Math.min(HOLD_RETRY_MAX_SECONDS, this.holdDelay * 2 ** (tries - 1));
+    this.slots[capability] = { state: 'retry', tries, retryAt: this.now() + wait, renewedAt: this.now() };
+    if (!SESSION_CODES.has(e.code)) { // once per episode (saidAs), also after a silent session refusal // a refusal of the board session is the fault's to say
+      this.emit('board.slot.refused', 'warning', `Fabric refused to give this service the ${capability} slot (${e.code}); it asks again later. Its other capabilities go on.`, { episode: capability, saidAs: `board.slot.refused:${capability}`, capability, reason: e.code });
+    }
+  }
+
+  /** Runs one capability's enroll or replace (FAA-163): a refusal of the board session is raised after the capability is left to retry. */
+  async settle(capability, act, entries = []) {
+    try {
+      await act();
+    } catch (e) {
+      if (!(e instanceof BoardError)) throw e;
+      this.retryLater(capability, entries, e);
+      if (SESSION_CODES.has(e.code)) throw e;
+    }
+  }
+}

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board.mjs

@@ -31,6 +31,7 @@ export {
   EVENT_SCHEMA,
   STOP_CODES,
   HOLD_RETRY_MAX_SECONDS,
+  IDLE_LEAVE_SECONDS,
   BoardSession,
   Checkpoint,
   BoardRequest,

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-descriptor.mjs

@@ -140,7 +140,9 @@ function authorityOk(uri) {
   const port = m[2];
   return Boolean(m[1]) && (port === undefined || port === '' || (/^[0-9]{1,5}$/.test(port) && Number(port) <= 65535));
 }
-const URI_PASSWORD = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]*:[^/?#@]*@/;
+// A special scheme reads a user:password@ after any run of slashes, none included, as `new URL` does (0.56.0 seam r7).
+// To the last @, a user name may hold one; any other scheme keeps a backslash in the user information (seam r8).
+const URI_PASSWORD = /^(?:(?:[Hh][Tt][Tt][Pp][Ss]?|[Ww][Ss][Ss]?|[Ff][Tt][Pp]):[/\\]*[^/\\?#]*:[^/\\?#]*@|(?![Hh][Tt][Tt][Pp][Ss]?:|[Ww][Ss][Ss]?:|[Ff][Tt][Pp]:)[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]*:[^/?#]*@)/;
 const RESIDENCY = /^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])$/;
 
 const RUNNER_KIND_NAME = /^[a-z][a-z0-9-]{1,62}$/;
@@ -190,8 +192,8 @@ export function descriptorMemberProblems(d) {
     if ('repository' in source) {
       const repository = source.repository;
       if (!(typeof repository === 'string' && SOURCE_URI.test(repository.replace(IP_LITERAL, '$1h')))) problems.push('source.repository is a URI (RFC 3986), such as https://github.com/owner/name');
+      else if (URI_PASSWORD.test(repository)) problems.push('source.repository carries no password: it names the repository, never a credential'); // before the host
       else if (!authorityOk(repository)) problems.push('source.repository names a host, and a port of digits up to 65535 when it has one');
-      else if (URI_PASSWORD.test(repository)) problems.push('source.repository carries no password: it names the repository, never a credential');
       places.push(['/source/repository', repository]);
     }
   }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-http.mjs

@@ -54,6 +54,8 @@ export class Response {
 export function redactUrl(url) {
   let parts;
   try { parts = new URL(String(url)); } catch { return '<unparseable url>'; }
+  // Only http and https are sent; any other scheme keeps no more than its name (0.56.0 product r10).
+  if (parts.protocol !== 'http:' && parts.protocol !== 'https:') return `${parts.protocol}<redacted>`;
   return `${parts.protocol}//${parts.host}${parts.pathname}`;
 }
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop-rules.mjs

@@ -230,13 +230,16 @@ const UNREADABLE_JOB_CAPABILITY = "The operator's mandate cannot be read for thi
  * covered, or saying the mandate expired or cannot be read; never the operator's words or `source`; with `fault`
  * mandate-capability-missing beside it when the job's capability cannot read the step, MJ-1); or {covered: false,
  * message: null} with no mandate or a T2 caller's (MD-5), with `fault` when the service's own clock does not read.
+ * Undefined and null are no mandate: a call that carried `_meta.mandate: null` passes `{}`, so it reads as
+ * mandate-malformed here as it does at the answer (FAA-178).
  */
 export function jobStep({ mandate, tier, now, self, capability, key, effect, callerAgent, spendUsd, project } = {}) {
   if (mandate === undefined || mandate === null) return { covered: false, message: null };
   if (!EFFECT_CLASSES.includes(effect)) throw new InteropError(`A job's approval step names its effect class (one of ${EFFECT_CLASSES.join(', ')}; DEC-0125).`);
   const call = { capability, action: key, effect };
-  if (typeof spendUsd === 'number') call.spendUsd = spendUsd;
-  if (typeof project === 'string') call.project = project;
+  const spend = mandateSpend(spendUsd); // read as actionGate reads it, so the start and the answer agree (FAA-139)
+  if (spend !== undefined) call.spendUsd = spend;
+  if (project !== undefined && project !== null) call.project = typeof project === 'string' ? project : UNREADABLE_PROJECT;
   const covers = { mandate, tier, now, self, call };
   if (typeof callerAgent === 'string' && callerAgent.length > 0) covers.callerAgent = callerAgent;
   const answer = mandateCovers(covers);
@@ -271,6 +274,14 @@ export function jobStep({ mandate, tier, now, self, capability, key, effect, cal
  * mandateCapability: a job's kept step's capability the mandate is read under (DEC-0141 MJ-1; the service's own input,
  * never a caller's); unusable, the refusal is operator-decision-required.
  */
+/** The project of a call whose project could not be read: never in a mandate's projects (FAA-139). */
+export const UNREADABLE_PROJECT = '\u0000unreadable';
+
+/** A spend estimate as a mandate reads it (FAA-139): a finite number stays, anything else is none (a ceiling refuses it). */
+export function mandateSpend(value) {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+
 export function actionGate({ action, tier, caller, meta, target, elicited = false, approval, actionDigest, humanStepUrl, now, self, effect, callerAgent, spendUsd, project, mandateCapability } = {}) {
   const inputs = { action, tier, caller, elicited: elicited === true, now };
   if (isObject(meta) && Object.hasOwn(meta, 'decision')) inputs.decision = meta.decision;
@@ -279,7 +290,8 @@ export function actionGate({ action, tier, caller, meta, target, elicited = fals
   }
   if (self !== undefined && self !== null && isObject(meta) && Object.hasOwn(meta, 'mandate')) {
     Object.assign(inputs, { mandate: meta.mandate, self });
-    for (const [name, value] of [['effect', effect], ['callerAgent', callerAgent], ['spendUsd', spendUsd], ['project', project], ['mandateCapability', mandateCapability]]) {
+    const read = project === undefined || project === null || typeof project === 'string' ? project : UNREADABLE_PROJECT; // fail closed (FAA-139)
+    for (const [name, value] of [['effect', effect], ['callerAgent', callerAgent], ['spendUsd', mandateSpend(spendUsd)], ['project', read], ['mandateCapability', mandateCapability]]) {
       if (value !== undefined && value !== null) inputs[name] = value;
     }
   }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop.mjs

@@ -40,6 +40,8 @@ export {
   requestMeta,
   jobStep,
   actionGate,
+  mandateSpend,
+  UNREADABLE_PROJECT,
   actionRefusalToolResult,
   usageFindings,
   usageToward,

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-openrouter.mjs

@@ -100,11 +100,22 @@ export class Client {
     if (!Number.isInteger(retries) || retries < 0 || retries > 5) {
       throw new OpenRouterError('retries is an integer from 0 to 5', { kind: 'config' });
     }
+    // A query or fragment would take `/chat/completions` (0.56.0 unit r19, FAA-187 (17)); refused before checkUrl, as
+    // the Python twin does, so a base checkUrl would also refuse is kind config in both (unit r27).
+    if (typeof baseUrl !== 'string') { // as Python's check_url answers a base that is not a string (unit r28)
+      throw new http.HttpError('the URL does not parse', { url: '<unparseable url>', kind: 'refused' });
+    }
+    if (/[?#]/.test(baseUrl)) {
+      throw new OpenRouterError('the base URL holds no query or fragment', { kind: 'config' });
+    }
     http.checkUrl(baseUrl);
     checkAttribution(projectId, undefined);
     Object.assign(this, { ceilingUsd, ledger, keyEnv, window, attribution, projectId, unmeasuredCallUsd, deadlineS, retries });
     this.prices = Object.fromEntries(Object.entries(prices ?? {}).map(([k, v]) => [k, { ...v }]));
-    this.baseUrl = baseUrl.replace(/\/+$/, '');
+    // The base URL as checkUrl read it: `new URL` removes tabs and line breaks anywhere and trims C0 controls and
+    // spaces from its ends, so `.../v1/ ` and `.../v1\n/` are composed as `.../v1/chat/completions`, as `new URL`
+    // composed them in 0.55.0 (0.56.0 product r20, unit r22, seam r22; the Python twin refuses what urllib cannot send).
+    this.baseUrl = baseUrl.replace(/[\t\n\r]/g, '').replace(/^[\x00-\x20]+|[\x00-\x20]+$/g, '').replace(/\/+$/, '');
     this.env = env;
     this.transport = transport;
     this.sleep = sleep ?? ((s) => new Promise((resolve) => setTimeout(resolve, s * 1000)));

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-protocols.mjs

@@ -106,6 +106,17 @@ export function feedDataFindings(page) {
   return findings;
 }
 
+/** The first place under a member that breaks the bound, for the refusal (FAA-122): `cited[0]` nests an object. */
+function tooDeep(key, member) {
+  const entries = Array.isArray(member) ? member.map((leaf, i) => [`${key}[${i}]`, leaf]) : isPlain(member) ? Object.entries(member).map(([inner, leaf]) => [`${key}.${inner}`, leaf]) : [];
+  if (entries.length > 32) return `: it has ${entries.length} entries`;
+  const bad = entries.find(([, leaf]) => !scalar(leaf));
+  if (!bad) return '';
+  const leaf = bad[1];
+  const what = typeof leaf === 'string' ? 'a string over 500 characters' : Array.isArray(leaf) ? 'a list' : isPlain(leaf) ? 'an object' : 'not a scalar';
+  return `: data.value.${bad[0]} is ${what}; nest two levels at most (flatten it into lists or members of their own)`;
+}
+
 /** DEC-0070's `data {schema, value}` as the schema bounds it, then FAC-SEM-101. */
 export function feedDataProblems(data) {
   if (!isPlain(data) || Object.keys(data).length !== 2 || !('schema' in data) || !('value' in data)) return ['data is {schema, value}'];
@@ -117,7 +128,7 @@ export function feedDataProblems(data) {
     if (scalar(member)) continue;
     if (Array.isArray(member) && member.length <= 32 && member.every(scalar)) continue;
     if (isPlain(member) && Object.keys(member).length <= 32 && Object.values(member).every(scalar)) continue;
-    problems.push(`data.value.${key} is a scalar (a string of at most 500 characters), a list of at most 32 scalars or an object of at most 32 scalar members`);
+    problems.push(`data.value.${key} is a scalar (a string of at most 500 characters), a list of at most 32 scalars or an object of at most 32 scalar members${tooDeep(key, member)}`);
   }
   if (problems.length) return problems;
   return feedDataFindings({ events: [{ data }] }).map((f) => `FAC-SEM-101: ${f.instancePath.replace('/events/0', '')} ${f.message}`);

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board.py

@@ -54,6 +54,7 @@ from fabric_board_session import (  # noqa: F401
     STOP_CODES,
     TERMINAL,
     HOLD_RETRY_MAX_SECONDS,
+    IDLE_LEAVE_SECONDS,
     BoardSession,
     Checkpoint,
     BoardRequest,

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board_link.py

@@ -30,15 +30,18 @@ class BoardSession:
     DELETE, which releases every slot it holds (DEC-0073 §5). Thread-safe; the bearer never leaves the headers."""
 
     def __init__(self, grant: _hub.BoardGrant, *, timeout: float = 15.0, post: Callable[..., Any] = _hub.post_mcp):
-        self.grant, self.timeout, self.post = grant, timeout, post
+        # not above 0 is the default: the transports read 0 in opposite ways (seam r8)
+        self.grant, self.timeout, self.post = grant, timeout if timeout is not None and timeout > 0 else 15.0, post
         self.mcp_session: Optional[str] = None
         self.protocol_version = _hub.MCP_PROTOCOL_VERSION
         self._lock = threading.Lock()
         self._rpc = 0
 
-    def _send(self, body: Dict[str, Any], method: str = "POST"):
+    def _send(self, body: Dict[str, Any], method: str = "POST", timeout: Optional[float] = None):
         try:
-            return self.post(self.grant.origin, body, self.grant.bearer(), session=self.mcp_session, timeout=self.timeout,
+            return self.post(self.grant.origin, body, self.grant.bearer(), session=self.mcp_session,
+                             # none or not above 0 is the session's own: the transports read 0 in opposite ways
+                             timeout=timeout if timeout is not None and timeout > 0 else self.timeout,
                              method=method, protocol_version=self.protocol_version if self.mcp_session else None)
         except _hub.HubError as exc:
             raise BoardError("unreachable", "Fabric's hub did not answer; a write may have been stored, so send it again with "
@@ -83,15 +86,21 @@ class BoardSession:
             raise BoardError(e["code"], e["message"], e["retryable"], op=tool)
         return value
 
-    def close(self) -> None:
+    def close(self, timeout: Optional[float] = None) -> bool:
+        """Sends the DELETE (waiting `timeout` seconds at most when above 0, else the session's); True when Fabric answered it with a
+        2xx, so the slots are free now. False otherwise, a 404 (the session was already gone) included: a move made
+        before it ended may be read only at the next com.status, so the slot records stay; the lease lapses in 60 s."""
         with self._lock:
             if self.mcp_session is None:
-                return
+                return False
             try:
-                self._send({}, method="DELETE")
-            except BoardError:
-                pass  # best effort: the lease lapses in 60 s anyway
-            self.mcp_session = None
+                answer = self._send({}, method="DELETE", timeout=timeout)
+                status = answer[0] if isinstance(answer, (tuple, list)) and answer and isinstance(answer[0], int) else 0
+            except Exception:  # noqa: BLE001 - any failure is no release, as the Node twin's catch reads it
+                status = 0
+            finally:
+                self.mcp_session = None  # an answer it cannot read is no release, as the Node twin reads it
+            return 200 <= status < 300
 
 
 class Checkpoint:
@@ -158,20 +167,30 @@ class Checkpoint:
                 self.slots = slots
 
 
-    def leave(self, project: str) -> None:
-        """At a clean leave (the session's DELETE released the slots): forget the record of each slot this service held
-        for `project` with no request left in the checkpoint and not moved away. A later generation is then another
+    def leave(self, project: str, held: Dict[str, Any]) -> None:
+        """At a clean leave (the session's DELETE released the slots): forget the record of each slot this session
+        confirmed (`held`: capability to the generation it held, or com.status showed unmoved; required) at that
+        generation or below, for `project`, with no request left in the checkpoint and not moved away. A record no
+        confirmation covers (a slot that may have moved while the service was down, not yet compared with com.status)
+        stays (0.56.0 seam r2, r3). A later generation is then another
         session taking a free slot, not a move, and a kit that keeps no record (rolled back to before 0.53.0) leaves
         nothing behind that reads as one. A record that cannot be written stays."""
         busy = {e.get("capability") for e in list(self.entries.values())}
         for capability, record in list(self.slots.items()):
-            if isinstance(record, dict) and record.get("project") == project and "moved" not in record and capability not in busy:
+            if (isinstance(record, dict) and record.get("project") == project and "moved" not in record
+                    and capability not in busy and _covered(record.get("generation"), held.get(capability))):
                 try:
                     self.slot(capability, None)
                 except BoardError:
                     pass
 
 
+def _covered(recorded: Any, confirmed: Any) -> bool:
+    """A record at or below a generation this session confirmed: a lower one is a write that failed before the hold."""
+    whole = lambda v: isinstance(v, int) and not isinstance(v, bool) and v >= 1  # noqa: E731
+    return whole(recorded) and whole(confirmed) and recorded <= confirmed
+
+
 class BoardRequest:
     """A claimed request as data: never an instruction. `body` is the requester's text; `sender` its Project id and
     principal (with provenance); `artifacts` its references, unverified."""