@sema-agent/core 5.65.0 → 7.0.0

package/dist/core/permission-rule-session.d.ts

@@ -0,0 +1,124 @@
+/**
+ * design/382 §4.3 — the SESSION-RULE OVERLAY: where a `{kind:"session"}` scoped allow rule lives.
+ *
+ * A session authorization's home is the session's own state — never the persisted store. The rows are
+ * ordinary {@link PersistedAllowRule}s (scope `session`), so every read-side consumer — the gate's
+ * conjunction arm, the coverage table, the consent prepare — takes them through the ONE eligibility
+ * predicate with zero second judges: the merge point splices overlay rows IN FRONT of the persisted
+ * `list()` (the §4.1 narrowest-first reporting order: session > project > global), and everything
+ * downstream is unchanged.
+ *
+ * ## The contract (design/382 §8-Q6, settled here)
+ *
+ * TWO verbs, and deliberately no third:
+ *  · `read(sessionId)` — the live rows of ONE session, session-scoped, that session's only.
+ *  · `apply(sessionId, add)` — land one redeemed authorization. Idempotent BY DOT (the redemption
+ *    replay contract: `alreadyRedeemed` marks the dot as RECORDED, not the overlay as LANDED, so a
+ *    replay must RE-APPLY, and this verb is what makes re-applying safe); refuses `session_ended`
+ *    once the session's lifetime epoch is sealed — a late in-flight write after termination must not
+ *    revive an authorization for a session that no longer exists.
+ *
+ * There is deliberately NO delete verb: a session row is not individually deletable — it dies with
+ * its session (design/382 §10, ruled). Termination is the HOST's act on its own implementation (see
+ * {@link InMemorySessionRuleOverlay.endSession}), not an engine verb.
+ *
+ * ## Lifecycle and durability
+ *
+ * The overlay lives WITH the session: a host that parks/checkpoints a session serializes its rows
+ * beside it and rehydrates them on resume (`snapshotSession`/`restoreSession` on the reference
+ * implementation) — that is how a session authorization survives a park without ever touching the
+ * persisted store, and why it still ends when the session ends. `sessionId` uniqueness is the host's
+ * duty (the `principal` posture): reusing an id declares "the same session".
+ *
+ * ## What this is NOT
+ *
+ * Not a store backend: no dots are minted here (the redemption leg mints the audit dot exactly as the
+ * store leg does), no tombstones exist here, nothing here syncs. Every durable entrance — write
+ * deltas, sync in both directions, at-rest bytes — refuses or drops a session row
+ * (`permission-rule-store.ts`, the durable two-member face); this module is the OTHER side of that
+ * wall, and the wall is the design.
+ */
+import type { PersistedAllowRule, RuleAdd, PersistedRuleMatch, PersistedRuleTool } from "./permission-rule-model.js";
+/** One redeemed authorization landing in a session's overlay: the rule's canonical shape plus the
+ *  redemption's own add (dot + provenance) — the same fields a `redemption-add` delta carries, minus
+ *  the scope (the verb's `sessionId` IS the scope, constructed here so a caller cannot land a row
+ *  whose scope names a different session than the one it addressed). */
+export interface SessionRuleOverlayAdd {
+    rule: string;
+    tool: PersistedRuleTool;
+    match: PersistedRuleMatch;
+    command: string;
+    add: RuleAdd;
+}
+/** What one overlay apply answered. `session_ended` is the epoch fence speaking: the write arrived at
+ *  (or after) termination and landed nothing — the redemption reports the member `refused`. */
+export type SessionRuleOverlayApplyResult = {
+    landed: true;
+} | {
+    refused: "session_ended";
+};
+/**
+ * The host-provided seam the consent lane and the gate's rule lane consume
+ * (`RuleConsentDeps.sessionRules`, `RunnerDeps.sessionPermissionRules`). See the module doc for the
+ * contract; {@link InMemorySessionRuleOverlay} is the reference implementation and the semantics.
+ */
+export interface SessionRuleOverlay {
+    /** The live session-scoped rows of ONE session. An ended (or never-written) session reads as `[]`. */
+    read(sessionId: string): Promise<readonly PersistedAllowRule[]>;
+    /** Land one redeemed authorization — idempotent by dot, refused once the session ended. */
+    apply(sessionId: string, add: SessionRuleOverlayAdd): Promise<SessionRuleOverlayApplyResult>;
+}
+/**
+ * The reference overlay — in-memory, per-process, the semantics every host implementation must keep:
+ *
+ *  · APPLY is idempotent by dot identity (a replayed redemption re-submits its recorded dot and
+ *    changes nothing — the store's `foldDelta` discipline, verbatim);
+ *  · TERMINATION seals FIRST, clears SECOND ({@link endSession}): the sealed-set membership is the
+ *    session's lifetime epoch, flipped atomically before any state is dropped, so an in-flight write
+ *    that lost the race lands on the seal and answers `session_ended` — never on a half-cleared
+ *    session, and never as a row that outlives its session (design/382 §4.3, the r2-⑥ fence);
+ *  · a sealed session never reopens — `apply` and `restoreSession` both refuse it, so "session ended"
+ *    is a one-way fact exactly like a quarantined dot's;
+ *  · SNAPSHOT/RESTORE ({@link snapshotSession}/{@link restoreSession}) are the park/resume carriage:
+ *    the host serializes a session's rows into its checkpoint and rehydrates them on resume. Restore
+ *    is fail-closed on shape — every row must be a session row of THE session being restored (a
+ *    checkpoint is host-owned bytes, and a global row smuggled through this door would ride the
+ *    merge point straight into adjudication).
+ */
+export declare class InMemorySessionRuleOverlay implements SessionRuleOverlay {
+    private readonly rows;
+    private readonly sealed;
+    /** How many times one session's row set has CHANGED. Reading a caller-owned value runs caller code,
+     *  so a verb that reads its argument and then replaces a session's rows wholesale must be able to
+     *  tell that something landed in between — otherwise it overwrites a grant that was already answered
+     *  `landed:true`, and a consent nobody withdrew stops existing. Bumped by every landing, restore and
+     *  termination; read across `restoreSession`'s snapshot. */
+    private readonly epochs;
+    private bumpEpoch;
+    read(sessionId: string): Promise<readonly PersistedAllowRule[]>;
+    apply(sessionId: string, add: SessionRuleOverlayAdd): Promise<SessionRuleOverlayApplyResult>;
+    /**
+     * The termination transfer: SEAL the lifetime epoch first (one atomic membership flip — after this
+     * line every in-flight `apply` holding this id answers `session_ended`), THEN drop the rows. The
+     * order is the whole fence: clear-then-seal would leave a window in which a late write re-grows a
+     * rule set for a session that is already gone. Idempotent; a never-seen id seals to the same place.
+     */
+    endSession(sessionId: string): void;
+    /** The park half of the checkpoint carriage: this session's rows, serializable as-is. */
+    snapshotSession(sessionId: string): Promise<readonly PersistedAllowRule[]>;
+    /**
+     * The resume half. Fail-closed on every axis: a sealed session never rehydrates (termination is
+     * one-way), and every row must be a well-formed SESSION row of exactly this session — anything else
+     * in the checkpoint bytes is refused whole, loudly, because the merge point trusts this overlay to
+     * serve only what its contract says it holds.
+     *
+     * The rows also pass the SAME `normalizePersistedRule` re-projection the sync face runs on store
+     * rows (rule text parses, canonical spelling, stored tool/match/command agree with the text): this
+     * door takes host-owned checkpoint bytes with no redemption validator in front of them, and a row
+     * the engine could not re-project would otherwise sit one merge away from adjudication. Rows this
+     * overlay landed itself always pass — {@link InMemorySessionRuleOverlay.apply} runs the same screen,
+     * so the two doors agree on what a session row is and a snapshot of this overlay always restores —
+     * which is what makes a refusal here foreign damage, refused whole.
+     */
+    restoreSession(sessionId: string, rows: readonly PersistedAllowRule[]): Promise<void>;
+}

package/dist/core/permission-rule-session.js

@@ -0,0 +1,121 @@
+import { isValidConsentScope, normalizePersistedRule } from "./permission-rule-store.js";
+function isValidOverlayAdd(add) {
+    const a = add;
+    if (typeof a?.dot?.actor !== "string" || a.dot.actor === "" || typeof a.dot.counter !== "number" || !Number.isFinite(a.dot.counter))
+        return false;
+    if (a.origin !== "user" && a.origin !== "imported-cc" && a.origin !== "starter")
+        return false;
+    return typeof a.createdAt === "string";
+}
+export class InMemorySessionRuleOverlay {
+    rows = new Map();
+    sealed = new Set();
+    epochs = new Map();
+    bumpEpoch(sessionId) {
+        this.epochs.set(sessionId, (this.epochs.get(sessionId) ?? 0) + 1);
+    }
+    async read(sessionId) {
+        return structuredClone(this.rows.get(sessionId) ?? []);
+    }
+    async apply(sessionId, add) {
+        if (this.sealed.has(sessionId))
+            return { refused: "session_ended" };
+        add = structuredClone(add);
+        if (this.sealed.has(sessionId))
+            return { refused: "session_ended" };
+        if (!isValidOverlayAdd(add?.add)) {
+            throw new Error("SessionRuleOverlay.apply was handed a malformed add (dot/origin/createdAt) — evidence this shape cannot vouch for must not install");
+        }
+        const scope = { kind: "session", sessionId };
+        if (!isValidConsentScope(scope)) {
+            throw new Error("SessionRuleOverlay.apply was addressed with an unusable session id — a session nobody can name is not a scope a grant can live under");
+        }
+        const projected = { rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [add.add] };
+        if ("reject" in normalizePersistedRule(projected)) {
+            throw new Error("SessionRuleOverlay.apply was handed a row whose text/metadata do not survive the canonical re-projection — a row the engine cannot re-project can never adjudicate, and would refuse its own restore");
+        }
+        const rows = this.rows.get(sessionId) ?? [];
+        if (!this.rows.has(sessionId))
+            this.rows.set(sessionId, rows);
+        const sameDotAs = (a) => a.dot.actor === add.add.dot.actor && a.dot.counter === add.add.dot.counter;
+        for (const [heldSession, heldRows] of this.rows) {
+            const holder = heldRows.find((r) => r.adds.some(sameDotAs));
+            if (holder !== undefined && (heldSession !== sessionId || holder.rule !== add.rule)) {
+                throw new Error(`SessionRuleOverlay.apply: dot ${add.add.dot.actor}#${add.add.dot.counter} already vouches for another grant — a dot identifies one add of one (rule, session), ever`);
+            }
+        }
+        const existing = rows.find((r) => r.rule === add.rule);
+        if (existing === undefined) {
+            rows.push({ rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [structuredClone(add.add)] });
+            this.bumpEpoch(sessionId);
+            return { landed: true };
+        }
+        if (!existing.adds.some((a) => a.dot.actor === add.add.dot.actor && a.dot.counter === add.add.dot.counter)) {
+            existing.adds.push(structuredClone(add.add));
+            this.bumpEpoch(sessionId);
+        }
+        return { landed: true };
+    }
+    endSession(sessionId) {
+        this.sealed.add(sessionId);
+        this.rows.delete(sessionId);
+        this.bumpEpoch(sessionId);
+    }
+    async snapshotSession(sessionId) {
+        return this.read(sessionId);
+    }
+    async restoreSession(sessionId, rows) {
+        if (this.sealed.has(sessionId)) {
+            throw new Error(`session "${sessionId}" has ended — a sealed session's authorizations cannot be restored (termination is one-way)`);
+        }
+        const epochBeforeRead = this.epochs.get(sessionId) ?? 0;
+        rows = structuredClone(rows);
+        if (this.sealed.has(sessionId)) {
+            throw new Error(`session "${sessionId}" has ended — a sealed session's authorizations cannot be restored (termination is one-way)`);
+        }
+        if ((this.epochs.get(sessionId) ?? 0) !== epochBeforeRead) {
+            throw new Error(`restoreSession("${sessionId}") raced a landing on the same session — refusing the whole restore (this door replaces the session's rows, and a grant that already answered landed must not be erased by a resume)`);
+        }
+        for (const r of rows) {
+            const scope = r?.scope;
+            if (scope?.kind !== "session" || scope.sessionId !== sessionId || !isValidConsentScope(scope)) {
+                throw new Error(`restoreSession("${sessionId}") was handed a row that is not a session row of that session — refusing the whole restore (a foreign-scope row through this door would reach adjudication)`);
+            }
+            if ("reject" in normalizePersistedRule(r)) {
+                throw new Error(`restoreSession("${sessionId}") was handed a row whose text/metadata do not survive the canonical re-projection — refusing the whole restore (a row the engine cannot re-project must not reach adjudication)`);
+            }
+        }
+        const ownDotRule = new Map();
+        for (const held of this.rows.get(sessionId) ?? []) {
+            for (const h of held.adds)
+                ownDotRule.set(`${h.dot.actor}#${h.dot.counter}`, held.rule);
+        }
+        const seenDots = new Map();
+        for (const r of rows) {
+            if (!Array.isArray(r.adds) || r.adds.length === 0 || !r.adds.every(isValidOverlayAdd)) {
+                throw new Error(`restoreSession("${sessionId}") was handed a row with malformed add evidence — refusing the whole restore (an add whose dot/origin cannot be read is not a consent anyone can audit)`);
+            }
+            for (const a of r.adds) {
+                const key = `${a.dot.actor}#${a.dot.counter}`;
+                const holder = seenDots.get(key);
+                if (holder !== undefined && holder !== r.rule) {
+                    throw new Error(`restoreSession("${sessionId}"): dot ${key} vouches for two different rules — refusing the whole restore`);
+                }
+                seenDots.set(key, r.rule);
+                const ownHolder = ownDotRule.get(key);
+                if (ownHolder !== undefined && ownHolder !== r.rule) {
+                    throw new Error(`restoreSession("${sessionId}"): dot ${key} is live in this session under a different rule — a restore may replay a grant, never reassign its dot; refusing the whole restore`);
+                }
+                for (const [heldSession, heldRows] of this.rows) {
+                    if (heldSession === sessionId)
+                        continue;
+                    if (heldRows.some((held) => held.adds.some((h) => h.dot.actor === a.dot.actor && h.dot.counter === a.dot.counter))) {
+                        throw new Error(`restoreSession("${sessionId}"): dot ${key} already vouches for another live session's grant — refusing the whole restore`);
+                    }
+                }
+            }
+        }
+        this.rows.set(sessionId, rows);
+        this.bumpEpoch(sessionId);
+    }
+}

package/dist/core/permission-rule-store.d.ts

@@ -215,7 +215,8 @@ export interface WritablePermissionRuleStore extends PermissionRuleStore {
 }
 /** The writer of a store, or `undefined` when the backend is read-only from the engine's side. */
 export declare function writerOf(store: PermissionRuleStore): PermissionRuleWriter | undefined;
-/** Do two scopes name the same place? */
+/** Do two scopes name the same place? Three members (design/382 §4.1): global, project-by-root,
+ *  session-by-sessionId. */
 export declare function sameScope(a: RuleScope, b: RuleScope): boolean;
 /**
  * Apply tombstones to a raw persisted set: an add survives iff its dot appears in no tombstone for the
@@ -238,6 +239,33 @@ export declare function addDotsOf(rules: readonly PersistedAllowRule[]): RuleDot
  * Every backend calls this before appending a tombstone.
  */
 export declare function assertDeleteDeltaCarriesNoAdd(delta: RuleDeleteDelta): void;
+/**
+ * design/382 §4.3 — the DURABLE-scope gate of the two direct write arms, shared by every backend
+ * (the `assertDeleteDeltaCarriesNoAdd` doctrine: the check is executed, not merely intended, because a
+ * union does not constrain a JavaScript caller's payload).
+ *
+ * A `redemption-add` whose scope — or a `tighten-delete` whose tombstone's scope — is a session scope
+ * refuses LOUDLY with the typed code `unsupported.session_scope_store`: a session authorization's home
+ * is the session's own overlay, and a session TOMBSTONE is equally unspellable here — session rows are
+ * not individually deletable (they die with their session, design/382 §10), so a tombstone naming one
+ * is either a foreign writer's fabrication or a caller wiring fault, and both deserve the loud arm.
+ * The third arm (`sync-join`) is NOT gated here: its session rows are per-row DROPPED AND DISCLOSED by
+ * {@link screenRuleSyncState} (a peer's damage must not veto a whole round the way a local caller's
+ * bug must), and a session-scoped QUARANTINE instruction throws inside {@link applySyncJoin} itself.
+ *
+ * The session member is the LOUD, typed arm; the rest of the face is executed too. A scope that is
+ * neither member in well-formed shape — `{kind:"project", root:""}` above all, which `pathWithinRoot`
+ * turns into base `/` so the row crosses every project boundary — is a caller wiring fault, refused
+ * with the untyped loud arm the sibling {@link assertDeleteDeltaCarriesNoAdd} uses (no closed-set code
+ * names it: it is nobody's supported request). The sync arm already refuses the same shape inbound
+ * ({@link applySyncJoin} runs {@link isValidDurableScope} on every joined row), so this closes the
+ * matching direct-write door rather than inventing a new rule.
+ *
+ * Exported with the backend contract for the same OPEN-SET duty {@link isValidDurableScope} names:
+ * any lane — host-side import doors included — that writes rows into a persisted store carries the
+ * durable two-member face.
+ */
+export declare function assertWriteDeltaScopeDurable(delta: RuleAddDelta | RuleDeleteDelta): void;
 /**
  * The state one sync round exchanges: raw adds (tombstoned dots NOT pre-filtered) plus tombstones.
  * The live view is always DERIVED (`applyTombstones`); the join below never deletes anything.
@@ -291,6 +319,27 @@ export interface RuleSyncLandingReport {
      *  a dropped tombstone may have covered them — they re-arrive once the peer's state is clean). */
     withheldAdds: number;
 }
+/**
+ * design/382 §4.3 — the CONSENT face's scope validity: the union's full three members, their shapes
+ * executed (a project scope with an empty root would admit every cwd, wider than global, through
+ * `pathWithinRoot`'s base construction; an empty sessionId would be a session nobody can name).
+ * Read by the consent protocol's entries (prepare's explicit-scope gate, the record integrity walk),
+ * and exported for the server's consent-projection twin. NEVER by a durable entrance — that face is
+ * {@link isValidDurableScope}, and keeping the two as separate named tables is the design's point:
+ * a session row leaking toward the store must meet an explicit refusal at every door, not a shared
+ * table someone widened for the other face's sake.
+ */
+export declare function isValidConsentScope(scope: RuleScope): boolean;
+/**
+ * design/382 §4.3 — the DURABLE face's scope validity: the two members a persisted row may carry,
+ * `{global, project}`. A session scope is a WELL-FORMED consent scope that is structurally not a
+ * durable one — session authorizations live in the session's own overlay and die with it; letting one
+ * into the store (or the sync wire, or the at-rest bytes) would give it exactly the afterlife the
+ * dimension is defined not to have. Exported for the server's rule-sync validator (same face, same
+ * two members) and for any host-side lane that writes rows into a persisted store — the OPEN-SET
+ * duty (design/382 §10): every such entrance, present or future, carries this face.
+ */
+export declare function isValidDurableScope(scope: RuleScope): boolean;
 /** Is `dot` at or below the frontier? Absent actor ⇒ not below (a frontier never covers what it never saw). */
 export declare function dotAtOrBelowFrontier(dot: RuleDot, frontier: RuleSyncFrontier): boolean;
 /**
@@ -314,7 +363,21 @@ export declare function normalizePersistedRule(r: PersistedAllowRule): {
 } | {
     reject: Extract<RuleSyncDropReason, "invalid_rule_text" | "metadata_mismatch">;
 };
-/** The normalization half exposed for the DISCLOSURE layer: which records a join would refuse, and why. */
+/** The normalization half exposed for the DISCLOSURE layer: which records a join would refuse, and why.
+ *
+ *  design/382 §4.3 — this screen carries the SESSION member of the durable face on every JOIN leg
+ *  (inbound state, local state, both sides of the pure join): a rule or tombstone row carrying a
+ *  session scope is dropped and reported (`session_scope_not_durable`), never landed and never allowed
+ *  to veto the round the way a malformed tombstone does. Dropping a session TOMBSTONE cannot widen:
+ *  tombstones remove adds only under the SAME (rule, scope), and every session-scope add is dropped by
+ *  this same screen — the #176 "its cover is not load-bearing" argument, one scope over.
+ *
+ *  The face's OTHER member — a durable scope that is not well-formed, `{kind:"project", root:""}`
+ *  above all — is executed on the INBOUND legs by {@link applySyncJoin} (its tombstone pre-loop and its
+ *  rule arm both run {@link isValidDurableScope}) and at the direct write arms by
+ *  {@link assertWriteDeltaScopeDurable}, not here. Stated so the boundary is readable: a LOCAL row of
+ *  that shape — reachable only by editing the at-rest bytes, or from a store written before the write
+ *  arm executed that axis — passes this screen and stays live. */
 export declare function screenRuleSyncState(state: RuleSyncState): {
     state: RuleSyncState;
     rejected: RuleSyncDrop[];

package/dist/core/permission-rule-store.js

@@ -10,7 +10,11 @@ export function writerOf(store) {
     return w !== undefined && typeof w.apply === "function" && typeof w.nextDot === "function" ? w : undefined;
 }
 export function sameScope(a, b) {
-    return a.kind === "global" ? b.kind === "global" : b.kind === "project" && a.root === b.root;
+    if (a.kind === "global")
+        return b.kind === "global";
+    if (a.kind === "session")
+        return b.kind === "session" && a.sessionId === b.sessionId;
+    return b.kind === "project" && a.root === b.root;
 }
 function sameDot(a, b) {
     return a.actor === b.actor && a.counter === b.counter;
@@ -47,7 +51,29 @@ export function assertDeleteDeltaCarriesNoAdd(delta) {
         throw new Error("a tighten-delete must carry a tombstone naming at least one observed add dot");
     }
 }
-function isValidScope(scope) {
+export function assertWriteDeltaScopeDurable(delta) {
+    const scope = delta.kind === "redemption-add" ? delta.scope : delta.tombstone?.scope;
+    if (scope?.kind === "session") {
+        const e = new Error(delta.kind === "redemption-add"
+            ? "a session-scope rule cannot enter the persisted store — its home is the session's own overlay (design/382 §4.3); refusing the redemption-add"
+            : "a session-scope tombstone cannot enter the persisted store — session rows are not individually deletable and die with their session (design/382 §4.3/§10); refusing the tighten-delete");
+        e.code = "unsupported.session_scope_store";
+        throw e;
+    }
+    if (!isValidDurableScope(scope)) {
+        throw new Error(delta.kind === "redemption-add"
+            ? "a redemption-add whose scope is not a well-formed durable scope cannot enter the persisted store (design/382 §4.3: the face is {global, project-with-a-root}) — refusing the write"
+            :
+                "a tighten-delete must carry a tombstone whose scope is a well-formed durable scope (design/382 §4.3: the face is {global, project-with-a-root}) — refusing the write");
+    }
+}
+export function isValidConsentScope(scope) {
+    const sc = scope;
+    return (sc?.kind === "global" ||
+        (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "") ||
+        (sc?.kind === "session" && typeof sc.sessionId === "string" && sc.sessionId !== ""));
+}
+export function isValidDurableScope(scope) {
     const sc = scope;
     return sc?.kind === "global" || (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "");
 }
@@ -56,7 +82,7 @@ function isValidDot(dot) {
     return typeof d?.actor === "string" && d.actor !== "" && typeof d.counter === "number" && Number.isFinite(d.counter);
 }
 function scopeKey(scope) {
-    return JSON.stringify(scope.kind === "global" ? ["g"] : ["p", scope.root]);
+    return JSON.stringify(scope.kind === "global" ? ["g"] : scope.kind === "session" ? ["s", scope.sessionId] : ["p", scope.root]);
 }
 function dotKey(dot) {
     return JSON.stringify([dot.actor, dot.counter]);
@@ -114,6 +140,11 @@ export function screenRuleSyncState(state) {
     for (const r of state.rules) {
         if (!Array.isArray(r.adds) || r.adds.length === 0)
             continue;
+        if (r.scope?.kind === "session") {
+            for (const a of r.adds)
+                rejected.push({ rule: r.rule, scope: r.scope, dot: a.dot, reason: "session_scope_not_durable" });
+            continue;
+        }
         const n = normalizePersistedRule(r);
         if ("reject" in n) {
             for (const a of r.adds)
@@ -122,7 +153,15 @@ export function screenRuleSyncState(state) {
         }
         rules.push(r);
     }
-    return { state: { rules, tombstones: state.tombstones }, rejected };
+    const tombstones = [];
+    for (const t of state.tombstones) {
+        if (t?.scope?.kind === "session") {
+            rejected.push({ rule: t.rule, scope: t.scope, dot: t.deletedBy, reason: "session_scope_not_durable" });
+            continue;
+        }
+        tombstones.push(t);
+    }
+    return { state: { rules, tombstones }, rejected };
 }
 export function joinRuleStates(a, b) {
     const sa = screenRuleSyncState(a).state;
@@ -183,10 +222,12 @@ export function applySyncJoin(cur, delta, nowMs) {
         throw new Error("a sync-join delta must carry an inbound state with rules and tombstones arrays");
     }
     for (const t of delta.inbound.tombstones) {
+        if (t?.scope?.kind === "session")
+            continue;
         if (!Array.isArray(t?.removedDots) || t.removedDots.length === 0) {
             throw new Error("an inbound tombstone must name at least one observed add dot — refusing the whole sync-join (the client's partitioning must withhold the round's adds alongside a malformed tombstone)");
         }
-        if (!isValidScope(t.scope) || !isValidDot(t.deletedBy) || !t.removedDots.every(isValidDot)) {
+        if (!isValidDurableScope(t.scope) || !isValidDot(t.deletedBy) || !t.removedDots.every(isValidDot)) {
             throw new Error("an inbound tombstone carries a malformed scope or dot — refusing the whole sync-join (a tombstone that cannot identity-match what it deletes would land its covered adds live)");
         }
         const canonicalTomb = parseAllowRuleText(t.rule);
@@ -229,7 +270,7 @@ export function applySyncJoin(cur, delta, nowMs) {
             withheldAdds += r.adds.length;
             continue;
         }
-        if (!isValidScope(r.scope)) {
+        if (!isValidDurableScope(r.scope)) {
             for (const a of r.adds)
                 droppedInbound.push({ rule: r.rule, scope: r.scope, dot: a.dot, reason: "metadata_mismatch" });
             continue;
@@ -288,6 +329,11 @@ export function applySyncJoin(cur, delta, nowMs) {
         }
     }
     for (const q of delta.quarantine ?? []) {
+        if (q.scope?.kind === "session") {
+            const e = new Error("a quarantine instruction names a session scope — the persisted store never holds a session row (design/382 §4.3); refusing the instruction");
+            e.code = "unsupported.session_scope_store";
+            throw e;
+        }
         for (const dot of q.dots) {
             if (joined.tombstones.some((t) => sameDot(t.deletedBy, dot))) {
                 throw new Error("a quarantine instruction may not touch a tombstone — it moves adds only");
@@ -312,7 +358,7 @@ export function applySyncJoin(cur, delta, nowMs) {
             quarantined,
             observedVector: delta.observedVector !== undefined ? joinFrontiers(cur.observedVector ?? {}, delta.observedVector) : cur.observedVector,
         },
-        report: { droppedInbound, quarantined: quarantinedNow, collectedTombstones, withheldAdds },
+        report: structuredClone({ droppedInbound, quarantined: quarantinedNow, collectedTombstones, withheldAdds }),
     };
 }
 export function assertRedemptionNotQuarantined(quarantined, delta) {
@@ -327,11 +373,21 @@ export async function ruleStoreChecksum(payload) {
 }
 const REMOVE_MAX_ATTEMPTS = 8;
 export async function removePersistedRule(opts) {
-    const owner = typeof opts.principal === "string" ? { kind: "principal", principal: opts.principal } : opts.principal;
-    if (owner.kind === "local-owner" && opts.provider.forLocalOwner === undefined) {
+    const rule = opts.rule;
+    const scope = structuredClone(opts.scope);
+    const target = opts.principal;
+    const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
+    const provider = opts.provider;
+    if (scope?.kind === "session") {
+        return {
+            status: "failed",
+            error: "unsupported.session_scope_store: a session-scope rule cannot be removed through the persisted-store entry — session authorizations live in the session's own overlay and end with the session (design/382 §4.3)",
+        };
+    }
+    if (owner.kind === "local-owner" && provider.forLocalOwner === undefined) {
         return { status: "failed", error: "this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be removed through it" };
     }
-    const store = owner.kind === "local-owner" ? opts.provider.forLocalOwner() : opts.provider.forPrincipal(owner.principal);
+    const store = owner.kind === "local-owner" ? provider.forLocalOwner() : provider.forPrincipal(owner.principal);
     const writer = writerOf(store);
     if (writer === undefined) {
         return { status: "failed", error: "the resolved permission-rule store has no write face — rules cannot be removed through it" };
@@ -343,11 +399,11 @@ export async function removePersistedRule(opts) {
     catch (err) {
         return { status: "failed", error: `could not read the permission-rule store: ${errText(err)}` };
     }
-    const live = snapshot.rules.filter((r) => r.rule === opts.rule && sameScope(r.scope, opts.scope));
+    const live = snapshot.rules.filter((r) => r.rule === rule && sameScope(r.scope, scope));
     const removedDots = live.flatMap((r) => r.adds.map((a) => a.dot));
     if (removedDots.length === 0)
         return { status: "no-op", rev: snapshot.rev };
-    const tombstone = { rule: opts.rule, scope: opts.scope, removedDots, deletedBy: await writer.nextDot() };
+    const tombstone = { rule, scope, removedDots, deletedBy: await writer.nextDot() };
     let expectedRev = snapshot.rev;
     let lastError = "";
     for (let attempt = 0; attempt < REMOVE_MAX_ATTEMPTS; attempt++) {
@@ -357,7 +413,7 @@ export async function removePersistedRule(opts) {
                 let stillLive = false;
                 try {
                     const after = await store.list();
-                    stillLive = after.rules.some((r) => r.rule === opts.rule && sameScope(r.scope, opts.scope) && isRuleLive(r));
+                    stillLive = after.rules.some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r));
                 }
                 catch {
                     stillLive = false;
@@ -376,7 +432,7 @@ export async function removePersistedRule(opts) {
         const after = await store.list();
         const landed = after.tombstones.some((t) => t.deletedBy.actor === tombstone.deletedBy.actor && t.deletedBy.counter === tombstone.deletedBy.counter);
         return landed
-            ? { status: "removed", rev: after.rev, stillLive: after.rules.some((r) => r.rule === opts.rule && sameScope(r.scope, opts.scope) && isRuleLive(r)) }
+            ? { status: "removed", rev: after.rev, stillLive: after.rules.some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r)) }
             : { status: "failed", error: `${reason} (read-back confirms no tombstone was written)` };
     }
     catch (err) {
@@ -407,8 +463,8 @@ export class InMemoryPermissionRuleStore {
     }
     async list() {
         return {
-            rules: applyTombstones(this.rules, this.tombstones).map((r) => ({ ...r, adds: r.adds.map((a) => ({ ...a })) })),
-            tombstones: this.tombstones.map((t) => ({ ...t })),
+            rules: structuredClone(applyTombstones(this.rules, this.tombstones)),
+            tombstones: structuredClone(this.tombstones),
             rev: this.rev,
         };
     }
@@ -427,13 +483,16 @@ export class InMemoryPermissionRuleStore {
             quarantined: this.quarantinedRows,
         }),
         apply: async (delta, opts) => {
+            delta = structuredClone(delta);
             if (opts.expectedRev !== this.rev)
                 return { conflict: true, rev: this.rev };
             if (delta.kind === "redemption-add") {
+                assertWriteDeltaScopeDurable(delta);
                 assertRedemptionNotQuarantined(this.quarantinedRows, delta);
                 this.rules = foldDelta(this.rules, delta);
             }
             else if (delta.kind === "tighten-delete") {
+                assertWriteDeltaScopeDurable(delta);
                 assertDeleteDeltaCarriesNoAdd(delta);
                 this.tombstones = [...this.tombstones, delta.tombstone];
             }

package/dist/core/permission-rule-sync.d.ts

@@ -134,6 +134,15 @@ interface ParsedRuleSyncResponse {
         dot: RuleDot;
         code: RuleRejectCode;
     }>;
+    /** design/382 §4.3 — SESSION-scope tombstones, dropped at the parse as per-row refusals (never
+     *  `undefined`-malformed): a session row can never land regardless of its dots, so classifying a
+     *  DAMAGED one as generic-malformed would withhold every valid inbound add on every round — one
+     *  peer row poisoning sync forever, the exact shape the per-row drop arm exists to avoid. */
+    sessionScopeTombstones: Array<{
+        rule: string;
+        scope: RuleScope;
+        dot: RuleDot;
+    }>;
     warnings: string[];
 }
 /**