@sema-agent/core 7.17.0 → 7.17.2

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 7.17.2 — 2026-09-13
+
+### Fix — the directories the prompt advertises as writable feed the write gate's exemption through the request (#749; cli B-102; server S-261; @server @cli)
+- **Before.** Two seats judged one fact. The root fence's advertised-writable-directory seat (#691) admits the memory engine's write home — that admission is exactly what licenses the `# Memory` instruction's "write to it directly with the Write tool". The deployment's write gate (`createFsWriteGatePolicy`) knew nothing about it: the seat is minted inside prepare and its class is not exported, so under the manual-mode default (`defaultWrite: "ask"`, i.e. the `default` / `auto` / `acceptEdits` tiers) every write the prompt had just invited raised an approval card — an entry plus its index, two cards for one remembered fact. The only workaround open to a deployment was to copy the memory home into `exemptDirs`, making it a SECOND author of a list the fence already owns.
+- **After (one rule).** The seat is the single source and it travels on the call. `ToolCallRequest.advertisedWritableRoots` (optional, additive, read-only) carries the seat's admitted CANONICAL roots — the memory write home, the deployment's scratchpad — stamped by the Runner beside the live-cwd stamp at every adjudication seat and read live off the seat's own getter. `createFsWriteGatePolicy` checks it ahead of `exemptDirs` / `acceptDirs`: same verdict (allow, never asked), same containment comparison, same fold. The advertised roots are compared **frozen** — the seat admits only canonical spellings and `resolveKey`'s root fence compares its admitted roots exactly as they stand, so this gate must too. Re-resolving them per call would follow whatever the name points at AT ADJUDICATION TIME: replacing an admitted memory home with a symlink to the workspace (no race needed — any moment between two calls) would move the exemption domain onto the whole workspace and turn every ordinary source write from `ask` into `allow`. The CONFIGURED domains keep their per-call resolution, because they are deployment-authored text (a relative spelling, a path that did not exist at wiring time) rather than admitted keys. Nothing else changes — a sensitive-path `deny` composed alongside still outranks it, an unresolvable target still fails closed to `ask`, and an ABSENT or EMPTY list is NO exemption (never a wildcard). `FsWriteGatePolicyOptions` gains no option: the seat belongs to the request, not to the construction.
+- **The stamp is a frozen copy.** One helper mints the field at every station (`advertisedWritableRootsSeat`, beside the field's own declaration — the `callFaceSeat` shape), and it hands out `Object.freeze([...seat.roots])`. The seat's getter returns its own admission ledger and `combinePolicies` walks every layer with ONE request object, so a layer handed the live array could append to the very domain the gate exempts — for that call and every later one. `readonly` is a compile-time word; the freeze is the runtime one. (A layer REPLACING the whole field on the shared request is the pre-existing shape `cwd`, `budget` and `face` already live with; that belongs to the fold, not to this seat.)
+- **Stamp seats (five).** `prepare-ask-lane.ts` (the live gate), `prepare-park-ask.ts` (the parked call's projection re-adjudication), and `run-leg.ts` ×3 (the resume belts: the approver-edit recheck, the deny-narrowing lane, the persisted-rule lane). The last two are tightening-only lanes that never read the field; they are stamped so the field's own sentence — the Runner stamps it on every policy adjudication of the run — is true and cannot drift. `Prepared` carries the seat so the resume belts adjudicate against the same list the live gate used.
+- **For consumers.** @server: **zero changes to take this** — a run whose prompt advertises a memory home stops asking about writes into it, on your existing gate wiring. Your `exemptDirs: [scratchpadDir]` stays legal and correct; it is now redundant for any directory the seat already admits, and `isExempt` is untouched (it is still consulted after the domain checks). Do NOT add the memory home to `exemptDirs` — that is the second-writer shape this closes. @cli: the counter-control for B-102 is that an interactive `default`-tier run that stores a memory entry no longer raises a card for it; a probe that pinned that card reds.
+- Pins: `test/backlog749-advertised-roots-feed-write-gate.test.ts` (the gate unit: inside/outside/absent/empty/symlink-escape/unresolvable, an admitted root REPLACED by a symlink after admission not moving the domain, and the sensitive-path deny still outranking; the Runner end-to-end on a real memory wiring: the memory write lands with zero asks while an ordinary in-root write still asks exactly once, with the stamp positively observed on the adjudicated request; the structural invariant that every Runner line stamping `cwd` also stamps the seat, five stations, all through the one helper; the helper's frozen copy, and a greedy policy layer composed ahead of the gate failing to widen it).
+
+### Fix — a here-document or here-string is a reader's stdin, not a file: the read-evidence scan counts operands (#751; test [7111]; @cli @server)
+- **Before.** The read-evidence scan behind the shell read boundary (the rule that a command the grammar refused whole is mandated only when it may read) counted a listed path reader by NAME: `cat <<'EOF' > out.txt` — the everyday heredoc write — and `wc -l <<< "x"` raised a mandated ask under the default doctrine while `tr … <<< hello` did not (`tr` reads no path).
+- **After (one rule, a whitelist).** A refused command is exempt from the mandate only when every part of it is a shape the scan fully understands and none of them reads a file outside the walk's reach — everything else, including any token the scan does not understand, is read evidence. Exempt shapes, per segment: a program that reads no path (`echo`, `tee out.txt <<EOF`, `python3 - <<'EOF'`, an unlisted program); `cat` / `wc` with a payload-free flag cluster whose input is a here-document, a here-string or a literal in-root stdin file (`cat <<'EOF' > out.txt`, `wc -l <<< "x"`, `cat < secret`); a directory change (after which every relative stdin literal in the command is unjudged). A substitution body (`$(…)`, backticks, `<(…)`) is judged on its own — green under the compound walk (`echo $(cat src/a)`, `VAR=$(cat src/a)`) or exempt under the whitelist (`echo $(date)`) — and a here-document body is text. Mandated: a stdin source outside the root, deny-listed, expanded anywhere in its spelling or relative after a `cd`/`pushd` (`cat < /etc/passwd`, `cat < .${K}rc`, `pushd /etc; cat < hosts`); any listed reader other than `cat`/`wc` fed by a here-string (`sed -e'r/etc/passwd' <<< x`, `grep -f x <<< y`); an option that may carry a file (`cat -`, `sed -fsecret`); a reader inside a substitution that reads outside the root (`echo x$(cat /etc/hosts)`); a re-entry (`bash -c "$CMD"`, `eval`); an unterminated here-document. A shell re-entry program (`sh -c …`, `bash script.sh`, `eval …`, `source x`, `. x`), bare or behind a launcher, runs its argument as commands the walk never sees: refused whole and mandated on both seats (the 7.17.0–7.17.1 walk read it as an unlisted program and the boundary seat vouched it). `refusedCommandMayRead(command, allow, boundary)` is the complement of `refusedCommandExempt`. **Residual, disclosed (#753):** the exemption is a hand-written parser beside the compound walk's lexer; five adversarial rounds closed twenty-one corners (heredoc delimiters and bodies, quoting, substitutions, launchers, moved bases, option payloads); the class is open by construction until the whitelist runs over the compound lexer itself.
+- Pins: `test/backlog696-read-boundary-any-doctrine.test.ts` (eight non-objection heredoc / here-string / in-root stdin forms; six mandated stdin forms).
+
+## 7.17.1 — 2026-09-13
+
+### Narrowing — the shell read boundary never vouches a read it did not judge (#737; test [7074] G12 / G14; @server @cli @test)
+- **Before.** Under the default read doctrine (`shellGate` absent / `"off"`) the boundary seat (`bashReadBoundaryProbe`) VOUCHED every command the read faces refused whole for their grammar — an escape (`cat /etc/pass\wd`), a substitution (`echo $(cat ~/.ssh/id_rsa)`, `cat "$(…)"`), a variable operand (`cat $F`), a redirection (`cat ~/.ssh/id_rsa > /tmp/x`), a UNC spelling on a POSIX tree (`cat \\srv\share\x`): the grammar gate stopped the operand walk before any read was judged, and "refused whole" had been read as "not this seat's question". Under that doctrine no other seat asks, so those reads RAN with zero asks — a bypass of the read boundary #696 installed. An operand the walk could not RESOLVE (a `~` operand with no declared home — an `inheritEnv` allowlist that withholds HOME; a `cd` it cannot follow) was a PLAIN fail-closed verdict on both seats: under the default doctrine that is no ask at all, and under `classify` the read-only name arm cleared it (`cat` is a listed reader) — `cat ~/.ssh/id_rsa` with HOME withheld read the key under both doctrines.
+- **After (one rule, both seats).** A read the boundary did not JUDGE is MANDATED — never retired by a name-reading arm or a stored allow rule. `readBoundaryMandate` (shared by the classify seat and the boundary-only seat) mandates on the boundary's declared objections as before (deny row / recursive walk / out of root) AND on `boundaryUnjudged`: an operand it could not resolve (`CompoundReadonlyVerdict.unresolvedOperands`) or a command the grammar gate refused whole (new structural field `CompoundReadonlyVerdict.refusedWhole` — an escape, a substitution, a subshell, a redirection, a line break; what the shell would run is not knowable from the text, since a reader can be spelled `ca\t`, fed by `<` or hidden in `$(…)`, so no word scan is attempted). The boundary-only seat vouches only a command whose reads it walked and found inside; a per-segment SHAPE refusal (a write, an unlisted program, follow mode) had its operands walked and stays not this seat's question; the bounded poll-loop face is consulted the same way. Only an expansion the walk parsed but cannot enumerate (a glob) stays the ruled plain ask. The lexical operand resolver runs `win32NamespaceScreen` first: a namespace spelling the tree refuses is unresolvable, never joined under the base as a relative name (the screen the Read face already ran).
+- **Behaviour, for consumers (both doctrines).** A shell command whose text carries `$`, `` ` ``, `\`, `(`, a redirection or a line break now asks ONCE, mandated (`AskRequest.ruleOffersAbsence: "mandated"` with an armed rule lane) — including `echo $X` and `git commit -m "a\nb"`, which ran unasked before: the boundary cannot tell a harmless spelling from `cat</home/u/.ssh/id_rsa`, and the reference harness asks on every such spelling too (its read-only table refuses them all). A `~`-relative read with no single home asks once, mandated; `cat '$HOME/x'` (a literal, single-quoted `$`) asks too. Commands with no such character are unchanged. @cli: one more mandated-ask source on the default tier; a probe that pinned zero asks for a `$`/escape-carrying command reds. @server: the default lane (`shellGate` absent) is the boundary seat. @test: G12 (UNC on Bash) and G14 (HOME withheld) re-pinned as one mandated ask each on both doctrines; the bytes never flow. Finer grammar (letting a provably harmless `$VAR` spelling through without the mandate) is a follow-up, #738.
+- **Same rule, two more spellings (adversarial rounds).** An UNLISTED segment beside a listed reader (`cat ~/.ssh/id_rsa; :`) used to end the compound walk at the name check — the reader's operands were never judged and the boundary seat vouched the command; the listed segments are now walked regardless (their findings ride beside the unlisted-name sentence; the unlisted segment itself is not a reader and is not walked). A leading name the parser cannot read (`ca''t`, `cat` to the shell) is refused whole. The bounded poll-loop face gets its turn BEFORE any mandate on the boundary seat: `for i in $(seq 1 2); do cat x; sleep 1; done` is refused by the compound gate (`$(`) but is the loop face's own grammar — an in-root body is vouched as before, a home-relative read with no home is mandated. A boundary-free seat mints no boundary mandate (`echo hi > out.txt` on a seat with no roots stays the plain classifier ask). A launcher, a path-prefixed name or a pipe into an unlisted program (`env cat ~/.ssh/id_rsa`, `/bin/cat /etc/passwd`, `cat /etc/passwd | base64`, `FOO=1 cat /etc/passwd`) hid the reader from the boundary seat, which vouched: both faces refused for shape and the seat asked nothing more. It now asks the containment question over the command text alone — the classify seat's own arm (`classifyOutOfRootReadGate`, launcher- and prefix-aware) read through the shared `readBoundaryMandate` — so the two seats answer alike; a path-prefixed listed reader (`/bin/cat src/a.ts`) is walked by its basename (the boundary judges what is read, never which binary). That gate judges a launcher segment whole and fail-closed (its documented over-fire: `env rm /tmp/cache`, `env echo /etc/passwd` name an out-of-root path and gate), so under the default doctrine those now ask once too, as does a working-directory move the walk cannot model (`pushd . && echo hello` — later operands are unplaced, the gate's base-mover arm). Across the two read faces a MANDATED finding on either outranks a plain one on the other (`for i in 1 2; do cat .ssh/id_rsa; cat *.log; done`: the loop face's deny row, not the compound face's glob). A launcher segment (`command cat .ssh/id_rsa`, `sudo cat …`) is walked WHOLE against the full boundary — deny judge and home included — not only the containment-only text gate (which had let a deny-row read and a no-home `~` read through); a path-prefixed reader carries its basename into the walk's tokens so `/usr/bin/grep -r . .` keeps `grep -r`'s recursive-read reading; the containment question is asked before any plain verdict, so a glob elsewhere in the command (`cat *.log; command cat /etc/passwd`) cannot outrank an out-of-root read. A launcher is UNWRAPPED to the program it runs (past `NAME=value` words, a bare number, nested launchers) so that program's own verb reading survives — `command grep -r x .` is `grep -r`, `command cd .claude; cat settings.json` moves the base; an option where the program would stand (`sudo -u root cat …`, `env -u X cat …`) is refused whole (its meaning needs the launcher's option table). Shell control words that precede a command (`! cat …`, `if …; then cat …; fi`, `while …; do cat …`) are transparent: the command behind them is judged; bare block words (`for …`, `fi`, `done`) name no reader. A control word counts only when bash sees it BARE — `'if' cd sub; cat ../secret` runs a program named `if`, the directory never changes and the read lands on the root's parent, so the quoted spelling is a command name the parser refuses whole; and a cd behind a control word or a launcher inside a loop body (`for i in 1 2; do ! cd ..; cat secret; done`) still moves the base per iteration — the loop face models every beat, where a single pass saw only the first. A command the grammar refused WHOLE is mandated only when it MAY READ — a listed path reader, a shell re-entry (`bash -c "$CMD"`), a substitution where the program name stands (`$C /etc/passwd`), a stdin redirection from a non-literal source (`cat < $F`), or a literal path token outside the roots — while a refused command with no read in it (`echo hi > out.txt`, a function definition, a heredoc into an interpreter) is the boundary's non-objection and the classify seat's own plain ask; a control word in front of a listed reader (`time cat x`) is walked but never auto-allowed on the classify seat.
+- **Not changed (ruled).** Globs and recursive walks without a deny judge stay plain asks on both seats (no filesystem expansion); the `Read` face (already refused the UNC spelling by name); the classifier's own sentences.
+- **Same rule, the write guard (server [7083] ②).** `createSensitivePathPolicy` answered `allow` for a target its canonicalizer REFUSED (a UNC spelling on a POSIX tree — `\\host\share\.env` — was `deny` under 7.16.0's lexical join and became `allow` once #653 refused the spelling by name; only the unresolvable-symlink arm denied). One arm now: a target the guard could not resolve is a target it did not judge ⇒ `deny`, the message naming the cause (`unc_on_posix_tree`, or the symlink sentence). @server: the sandbox lane's `sensitivePatterns` cell for the UNC spelling reads `deny` again. Pin: `test/sensitive-path-policy.test.ts`.
+- **Seat type (server [7083] ①).** `RunInternals.workflowParkedResume[].outcome` is OPTIONAL, as the tool face `WorkflowParkedResume.outcome` already was — `{ runId, token }` alone is the acknowledgement that settles a not-pending token (#652 obligation ③); the type had lagged the contract, so a host could not reach the acknowledgement form without a cast.
+- Pins: `test/backlog696-read-boundary-any-doctrine.test.ts` (the UNREAD halves; refused-whole legs incl. `cat</etc/passwd` and `ca\t /etc/passwd` mandated on both seats; shape refusals still vouched on the boundary seat; the loop face's variable operand), `test/backlog714-home-expansion-precise.test.ts` (Runner real load path: HOME withheld ⇒ one mandated ask and the key never read; the literal `'$HOME/…'` spelling; the unresolved-operand legs mandated on both seats).
+
+### Fix — a core-minted tool declares its content-origin class on every mounting seat (#747; cli B-103; @server @cli)
+- **Before.** A core definition mounted through a host's own `tools` seat (`TaskCreate` and its siblings, `LSP`) carried no declared content-origin class, so the memory session's classifier took the fail-closed branch reserved for a tool nobody described (`isCallerTool` ⇒ `external`): one `TaskCreate` call marked the session's memory polluted (`memory.session_polluted`), every entry it wrote carried an external-origin marker under the default `carry` provenance, and instruction-form files were withheld.
+- **After (one rule).** The catalog face is the one source of a definition's class: `toolFace(id)` carries `contentOrigin` — the catalog's declared class (`execution` for Bash, `external` for the web tools) or `local` — so every core factory product says what it is, whichever seat mounts it. A host-authored tool that declares nothing is still classed `external` fail-closed (unchanged; negative control pinned).
+- Pins: `test/backlog747-builtin-content-origin-declared.test.ts` (every catalog face carries a class; the task-list products read `local` on the caller lane; the undeclared host tool stays `external`).
+
+### P3 batch — mechanical (#719/#722/#724/#733/#734/#720②/#725; no BREAKING)
+- **#719** Repeated `MemoryEngine.materialize` over an unchanged store no longer rewrites MEMORY.md, `index-revs.json` or `scopes.json` (mtime churn only, byte-identical content): `writeIfChanged` (content-gated `atomicWriteFileSync`, `src/core/memory-engine/layout.ts`) backs `writeIndexRevs` and `commitScopesRecord`'s journal/file dance, and the MEMORY.md write-back re-reads the live file (no-follow) before writing. Lock/heartbeat files are unchanged (still call `atomicWriteFileSync` directly). Pin: `test/backlog719-derived-write-idempotence.test.ts`.
+- **#722** `TaskResult.stats.usageMissing` now follows the exact law #711 minted for the `turn_end` wire frame: a turn with NO usage frame at all (`onTurnEnd`, `run-harness-handlers.ts`) sets `stats.usageMissing = true`, not only the brain-flagged branch (a message that HAS a `usage` object carrying its own `usageMissing`, #692 C-b) — closing the gap where a fully-missing turn's counted zeros read as a free turn at the task-result face while the same turn's wire frame already said unknown. Pin: `test/backlog722-stats-usage-missing.test.ts`.
+- **#724** (additive) `formatWorkflowRun`'s poll result now populates `details.errorCode` from `WorkflowRun.errorCode` (#688 C4) for a failed workflow run — the same key `serveDurableAgentRow` already populates for a failed `background_agent` row. Before, the run-level machine code reached only the `content` JSON text, so a consumer reading `TaskOutput.details.errorCode` (client-core / cli's workflow panel run row, cli L-235) got nothing for a workflow run. Pin: `test/backlog724-workflow-error-code-structural.test.ts`. Wire row: `docs/wire-consumption/unreleased-724.md` @cli @server.
+- **#733** `durableParkOptInDeclared` (`src/core/tool-policy.ts`, beside the sibling `durableMandateSourceOf` it is deliberately not a live-seat-narrowed test) folds the two hand-written `spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true` copies in `prepare-question-face.ts`'s `durableQuestionFace` and `prepare-policy-chain.ts`'s `mandatedCallFloats` onto one predicate — pure refactor, no behavior change (each conjunct these two conditions AND against, the question-park-store presence and the checkpoint-store presence, is untouched). Pin: `test/backlog733-durable-park-opt-in-declared.test.ts`.
+- **#734** `parkLaneArmed` (`src/orchestration/workflow.ts`) folds three separately-spelled "store present and checkpointStore is a real store object" tests (the `checkpointStore`-without-`store` entry guard, the `defaultDurableApproval`-without-both entry guard, and `assertChildParkSeat`'s "does this run have any park seat at all") onto one predicate — pure refactor, byte-identical behavior (the #642/#652 park-lane suites pass unchanged). Pin: `test/backlog734-park-lane-armed.test.ts`.
+- **#720②** (tooling) `scripts/wire-changes.mjs`'s `closedSetMembers[]` entries carry an optional `persistedBy?: "durable-column" | "checkpoint-state" | "none"` hint, mined from the `docs/wire-consumption/*.md` corpus rather than hand-kept: present only when the entry has a removed half, absent (not `"none"`) when the corpus never mentions the set or a removed member. `removed`'s own shape (`string[]`) is unchanged. New `wireConsumptionCorpus()` export reads the current working tree's docs; `buildReport` stays pure (the corpus is a new optional parameter, default `""`). Pins: `test/wire-changes-gate.test.ts`.
+- **#725 余项** (test-only) `test/gate-negative-controls.test.ts` closes its remaining two P3 items: a citation for `flaky-guard.test.ts`'s existing G8 negative controls in the "already covered" register (it had coverage but no citation), and a new full-tree `gate:tool-names` `verify(root)` negative control (clones the real `src/` + `docs/TOOL-NAME-TABLES.json`, confirms zero problems, then plants one unregistered retired-name table site and confirms it reds naming the file) — closing the registration-reconciliation half the existing `scanFile`-only pin did not reach.
+
+### Contract — ONE physical-path canonicalizer: every face answers one spelling per directory (#700; exports +2, additive; @server @cli @test)
+- **Before.** Two canonicalizers stood over one question. The memory layout's `canonicalize` used node's JS `fs.realpathSync`, which resolves symlinks but PRESERVES the caller's casing; `ExecutionEnv.canonicalPath` used the libuv realpath, which answers with the directory entry's ON-DISK spelling. Twelve `realpathSync` stations across nine modules spelled the call three different ways (bare, `.native`, and the fs-promises form). On a case-insensitive volume a memory root configured as `…/Proj` was therefore keyed `…/Proj` by the engine's write gate and resolved to `…/proj` by the fence — the advertised-writable-directory seat saw the mismatch and refused the hole its own `# Memory` instruction taught (#691's loud `expectCanonical` skip was that divergence's compensation, not its fix).
+- **After.** `src/core/physical-path.ts` is the tree's one mint, three doors and zero options: `physicalPathOf` (sync, libuv realpath, throws on an unresolvable path), `physicalPathOfAsync` (the same libuv call, non-blocking — the `ExecutionEnv` faces take this one so a hung network mount cannot block the event loop and every abort with it), and `physicalPathOfExisting` (total: the deepest ancestor that resolves, with the missing tail rejoined, for a path that need not exist yet). Every station routes through it — spec-contract (oracle cwd + frozen-path parents), skills-directory (attachment containment), prepare-task (the isolation claim), prepare-artifact (the artifact store's root check), memory-engine/layout (`canonicalize` is now a NAME for the mint, one implementation behind both), fs-atomic (`resolveDataRoot`, `canonicalStoreKey`), the mailbox store, the cc task-list store's lock target, the workflow script store's physical containment arm, the artifact local stub's snapshot read, and `NodeExecutionEnv.canonicalPath`. A case-variant configured directory now resolves to the SAME string on the engine's key mints and on the env face, so the seat ADMITS it: one directory, one spelling, one key.
+- **Case FOLDING is not part of a path's identity** and stays where it always belonged — at the one call site that keys on it (`canonicalStoreKey`, realpath + fold). Folding a filesystem PATH names a different directory on a case-SENSITIVE volume, which is why the cc task-list store's lock target must not use the store key (RB-173's lesson, now stated once).
+- **Loud where it was silent.** The mailbox store's and the cc task-list store's private `realpathSyncSafe` (realpath with a silent lexical fallback) are gone: both canonicalize a directory they just created, so an unresolvable path is a real fault (it vanished, or an ancestor became untraversable) and now THROWS — a lexical fallback would key one physical directory two ways, which is the defect the canonicalization exists to close. The swallow arms that stay are the ones with a contract, unchanged: spec-contract's `undefined` (the frozen entry is skipped and the oracle judges), skills-directory's warn-and-skip, and the store key's lexical form of last resort (now expressed once, inside the mint).
+- **Exports (+2, additive, tier `advanced`)**: `physicalPathOf`, `physicalPathOfExisting`. @server: a host that keys its own store or gate on a directory (`boot/stores.ts`) should key it through these rather than its own realpath call — otherwise one directory can still get two keys ACROSS the process boundary, which is the same defect one repo up. No wire key, no payload shape, no notice code changes.
+- **One directory spelled two ways is not a migration.** The memory library's one-shot key migration (`migrateKeyedPartition`, both adoption directions) tested its two coordinates for identity with a STRING compare. That was sound while both mints preserved the configured casing; with the partition key now answering in the on-disk case, a case-variant configured root makes the two coordinates spell ONE directory on a case-insensitive volume — and the lexical guard read that as two, disclosing `memory.partition_split` on EVERY mount with advice to move the rows out of what is in fact the live partition and remove it (constructed and measured, then fixed in the same car). Identity is physical: the guard now canonicalizes both sides through the mint. **Upgrade (merged-tree review).** `adoptLegacyRepoDirs` also probes the spelling the layout keyed by BEFORE the one mint — link-resolved, caller-cased (`/var/TMP` keyed `-private-var-TMP`; today `-private-var-tmp`) — so a partition minted by 7.17.0 under a case-variant alias on a mixed-case-sensitivity setup is adopted onto today's key instead of silently stranded; a populated competitor is the disclosed `memory.partition_split`.
+- **Upgrade, registered rather than fixed.** The partition key this module minted before this change was the same realpath with the CALLER's casing — which, absent a symlink, is exactly the spelling `deriveDirKey` mints, so the existing adoption arm moves such a partition onto the new key as it always did. The one shape it does not cover: a symlinked ancestor whose stored target text differs in CASE from the on-disk spelling AND a memory library on a volume that does not fold case — three coordinates instead of two, and the old partition stays where it is (untouched, never merged, never deleted) while the mount starts a fresh one. Noted in `deriveRepoKey`'s own doc. On a folding library volume (the default on the platforms where the case axis exists at all) the old and new keys name ONE directory, so nothing is stranded.
+- Pins: `test/backlog700-physical-path-one-canonicalizer.test.ts` (8 cells: the on-disk spelling; layout mint = env face = async door; the seat admitting a case-variant spelling while its mismatch arm still refuses; the deepest-existing-ancestor form under a symlinked parent; folding at the store key and never in the mint; the false-split trap above; on a case-SENSITIVE volume the case cells assert spelling identity rather than skipping), a `physical-path` row in `gate:single-mint` (a realpath call outside the mint is red), `docs/LAYERING.json` (the mint on the floor), and a new parent-arm cell in `test/spec-contract.test.ts`.
+
 ## 7.17.0 — 2026-09-12
 
 ### Abstraction review of the merged tree (the 7.17.0 triple review's first leg; @server @cli @test)

package/dist/core/fs-write-gate-policy.js

@@ -31,6 +31,10 @@ export function createFsWriteGatePolicy(opts) {
             if (!canon.ok) {
                 return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})${advisory}`);
             }
+            for (const root of req.advertisedWritableRoots ?? []) {
+                if (isWithin(root, canon.key))
+                    return { action: "allow" };
+            }
             for (const dirs of [exemptDirs, acceptDirs]) {
                 if (!dirs)
                     continue;

package/dist/core/memory-engine/engine.js

@@ -4444,7 +4444,8 @@ export class MemoryEngine {
             let wrote = false;
             try {
                 mkdirSync(dirname(indexPath), { recursive: true });
-                writeFileNoFollow(indexPath, text);
+                if (readNoFollowSafe(indexPath) !== text)
+                    writeFileNoFollow(indexPath, text);
                 wrote = true;
             }
             catch {

package/dist/core/memory-engine/layout.d.ts

@@ -1,5 +1,6 @@
 import { type MemoryAnnouncement } from "./types.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
+import { physicalPathOfExisting } from "../physical-path.js";
 /** Cursor sidecar for the design/84 Seam B pair on the FileBackend (`{ [scope]: cursor }`). B3: control plane. */
 export declare const CURSORS_FILE = "cursors.json";
 /** The control-plane subdir name under a key dir — ONE spelling for every derivation and for the
@@ -32,10 +33,11 @@ export declare class ControlPlaneCorruptError extends Error {
  * Its input is the HOST-declared repo root; a model-reachable directory is keyed by
  * {@link deriveDirKey} instead, and that asymmetry is deliberate (see there).
  *
- * Known limit, registered rather than fixed (ruled 2026-08-03): on a case-INSENSITIVE volume two
- * spellings that differ only in case still mint two keys — realpath does not case-fold, and folding
- * here would MERGE two genuinely distinct repos on a case-SENSITIVE volume. This round closes the
- * symlink axis only; the case axis predates it and is unchanged.
+ * The case axis (once a known limit here) closes with the same call: the mint answers with the ON-DISK
+ * spelling, so two case-variant spellings name ONE key on a case-INSENSITIVE volume, while on a
+ * case-SENSITIVE volume they are two distinct directories and keep two (FOLDING would merge that pair).
+ * Registered, not fixed: the PREVIOUS key was this realpath with the CALLER's casing = `deriveDirKey`'s
+ * spelling, which the arm below adopts, EXCEPT under a case-varying symlink on a non-folding library.
  */
 export declare function deriveRepoKey(repoRoot: string): string;
 /** Sink for the mount-time partition-key incidents (`memory.partition_split` /
@@ -48,6 +50,9 @@ export type MemoryPartitionIncidentSink = (err: Error & {
  *  when the two mints differ its `memory/` + `.engine/` + siblings live under {@link deriveDirKey}'s
  *  dir. Move the whole partition onto the canonical key (see {@link migrateKeyedPartition}). */
 export declare function adoptLegacyRepoDirs(configRoot: string, repoRoot: string, onIncident?: MemoryPartitionIncidentSink): void;
+/** Every spelling an earlier release keyed this repo's partition by, minus today's: the resolve-only key and the
+ *  link-resolved, caller-cased key (`/var/TMP` keyed `-private-var-TMP`; today `-private-var-tmp`). */
+export declare function earlierRepoKeysOf(repoRoot: string): string[];
 /**
  * The REVERSE one-shot migration (ruled 2026-08-03): for the width of ONE release the control-plane
  * key canonicalized like the repo key does, which put a directory-pinned mount's `.engine` under the
@@ -248,8 +253,10 @@ export declare function layoutNeedsAdoption(root: string, controlDir: string): b
  *   6. commit B: the marker removed; `memory.layout_migrated` disclosed.
  */
 export declare function adoptRootScopeLayout(rootPath: string, controlDir: string, opts?: AdoptRootScopeLayoutOptions): void;
-/** Canonicalize a path for containment checks (resolves symlinks on the EXISTING prefix). */
-export declare function canonicalize(p: string): string;
+/** The memory layout's name for the tree's one physical-path mint (symlinks on the EXISTING prefix
+ *  resolved, the missing tail rejoined). ONE implementation behind both names — a second canonicalizer
+ *  here is what let a key minted by this layout name a directory the fence resolved differently. */
+export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
 /** mkdir -p convenience used by the engine/backend (0o700 like the file stores). */
@@ -976,4 +983,9 @@ export declare function writeAllSync(fd: number, data: string): void;
  *  or re-derived); do not route data that can't through here. Throws on failure (fail-closed: a
  *  sidecar that cannot be written must not be silently skipped). */
 export declare function atomicWriteFileSync(path: string, data: string): void;
+/** Content-gated {@link atomicWriteFileSync} for a DERIVED/control-plane file: a byte-identical
+ *  rewrite (the common case on a repeat mount over an unchanged store) is skipped entirely, so the
+ *  file's mtime stays put. ONLY for files whose mtime carries no meaning of its own — a lock or a
+ *  heartbeat file's mtime IS its signal and must keep calling {@link atomicWriteFileSync} directly. */
+export declare function writeIfChanged(path: string, data: string): void;
 export {};

package/dist/core/memory-engine/layout.js

@@ -1,9 +1,10 @@
-import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
 const { O_WRONLY, O_CREAT, O_TRUNC, O_NOFOLLOW, O_EXCL } = fsConstants;
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { MEMORY_ORIGIN_CAUSES } from "./types.js";
+import { physicalPathOfExisting, priorCallerCasedPathOf } from "../physical-path.js";
 const SCOPES_FILE = "scopes.json";
 export const CURSORS_FILE = "cursors.json";
 export const CONTROL_PLANE_DIR = ".engine";
@@ -84,7 +85,7 @@ function migrateKeyedPartition(m) {
     };
     const splitText = `memory partition split detected for ${m.subject}: BOTH ${m.fromDir} and ${m.toDir} hold content. This session uses ${m.toDir}; the other dir is left untouched (never merged — CAS baselines would collide). If it holds the newer memory, move its rows by hand and remove it.`;
     try {
-        if (m.fromDir === m.toDir)
+        if (m.fromDir === m.toDir || canonicalize(m.fromDir) === canonicalize(m.toDir))
             return;
         if (!existsSync(m.fromDir))
             return;
@@ -113,12 +114,20 @@ function migrateKeyedPartition(m) {
     }
 }
 export function adoptLegacyRepoDirs(configRoot, repoRoot, onIncident) {
-    migrateKeyedPartition({
-        fromDir: join(configRoot, deriveDirKey(repoRoot)),
-        toDir: join(configRoot, deriveRepoKey(repoRoot)),
-        subject: repoRoot,
-        onIncident,
-    });
+    const toDir = join(configRoot, deriveRepoKey(repoRoot));
+    for (const key of earlierRepoKeysOf(repoRoot)) {
+        migrateKeyedPartition({ fromDir: join(configRoot, key), toDir, subject: repoRoot, onIncident });
+    }
+}
+export function earlierRepoKeysOf(repoRoot) {
+    const today = deriveRepoKey(repoRoot);
+    const keys = [deriveDirKey(repoRoot)];
+    try {
+        keys.push(slugifyPath(priorCallerCasedPathOf(resolve(repoRoot))));
+    }
+    catch {
+    }
+    return [...new Set(keys)].filter((k) => k !== today);
 }
 export function adoptCanonicalKeyedControlDir(configRoot, dir, onIncident) {
     migrateKeyedPartition({
@@ -403,6 +412,15 @@ function commitScopesRecord(controlDir, lock, token, next) {
     const data = `${JSON.stringify(next, null, 2)}\n`;
     const fence = () => assertSidecarLockOwnership(lock, token, "scope registry", "strict");
     fence();
+    let current;
+    try {
+        current = readFileSync(file, "utf8");
+    }
+    catch {
+        current = undefined;
+    }
+    if (current === data)
+        return;
     atomicWriteFileSync(journal, data);
     fence();
     atomicWriteFileSync(file, data);
@@ -701,18 +719,7 @@ function moveLooseContent(root, controlDir, rec, owner, label, renew, sink, resu
     writeIndexRevs(controlDir, {});
     discloseLayoutIncident(sink, "memory.layout_migrated", `memory layout adopted at ${root}: ${moved} loose entr${moved === 1 ? "y" : "ies"} moved into the home of ${JSON.stringify(owner)} (${label})${resumed ? " — an interrupted move was finished" : ""}`);
 }
-export function canonicalize(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        const parent = resolve(p, "..");
-        if (parent === p)
-            return p;
-        const rest = p.slice(parent.endsWith(sep) ? parent.length : parent.length + 1);
-        return join(canonicalize(parent), rest);
-    }
-}
+export const canonicalize = physicalPathOfExisting;
 export function isContainedIn(root, child) {
     const r = canonicalize(root);
     const c = canonicalize(child);
@@ -1034,7 +1041,7 @@ export function readIndexRevs(controlDir) {
 export function writeIndexRevs(controlDir, revs) {
     try {
         ensureDirExists(controlDir);
-        atomicWriteFileSync(join(controlDir, INDEX_REVS_FILE), `${JSON.stringify(revs, null, 2)}\n`);
+        writeIfChanged(join(controlDir, INDEX_REVS_FILE), `${JSON.stringify(revs, null, 2)}\n`);
     }
     catch {
     }
@@ -2056,3 +2063,15 @@ export function atomicWriteFileSync(path, data) {
         throw err;
     }
 }
+export function writeIfChanged(path, data) {
+    let current;
+    try {
+        current = readFileSync(path, "utf8");
+    }
+    catch {
+        current = undefined;
+    }
+    if (current === data)
+        return;
+    atomicWriteFileSync(path, data);
+}

package/dist/core/physical-path.d.ts

@@ -0,0 +1,37 @@
+/**
+ * THE physical path of a path — one spelling for the whole tree.
+ *
+ * A physical path is what `realpath(3)` answers: every symlink resolved and, on a case-insensitive
+ * volume, the directory entry's ON-DISK spelling. That last half is the reason this module exists.
+ * Node has two realpaths and they disagree exactly there (measured on macOS): `realpathSync.native`
+ * and `fsPromises.realpath` are the libuv call and return the disk case, while the JS `fs.realpathSync`
+ * resolves the links but PRESERVES the caller's casing. A tree that used both minted two spellings for
+ * one directory, so a key minted on one face could not be found on the other — a memory write root
+ * spelled `…/Proj` by configuration was keyed `…/Proj` by the engine's gates and resolved to `…/proj`
+ * by the execution env's fence, and the advertised-writable-directory seat had to refuse the hole its
+ * own instruction taught.
+ *
+ * Case FOLDING is not part of a path's identity and is not done here: folding a filesystem PATH names a
+ * different directory on a case-sensitive volume. A store whose in-memory KEY must fold (see
+ * `canonicalStoreKey`) folds this answer at its own call site.
+ */
+export declare function physicalPathOf(p: string): string;
+/** The spelling the memory layout keyed by BEFORE this mint — links resolved, the caller's casing kept (the JS
+ *  `fs.realpathSync`, which differs from the native call exactly there). Migration probes only: never an identity. */
+export declare function priorCallerCasedPathOf(p: string): string;
+/** The async door onto the same rule (`fsPromises.realpath` is the libuv call `realpathSync.native`
+ *  makes). The `ExecutionEnv` faces take this one: a sync realpath against a hung network mount blocks
+ *  the event loop for the mount timeout, and every pending abort with it. */
+export declare function physicalPathOfAsync(p: string): Promise<string>;
+/**
+ * {@link physicalPathOf} for a path that need not exist yet: the deepest ancestor that resolves,
+ * canonicalized, with the missing tail rejoined — so a not-yet-created target is still judged against
+ * roots that are physical paths, and a symlinked PARENT still cannot carry a write past them (the
+ * parent is exactly what gets resolved before the tail is rejoined).
+ *
+ * Total, by construction rather than by swallowing: a path with no resolvable ancestor at all has no
+ * physical form to answer with, and the absolute lexical form is that answer. Callers that must
+ * distinguish "unresolvable" from "does not exist yet" call {@link physicalPathOf} and handle the throw
+ * beside their own contract.
+ */
+export declare function physicalPathOfExisting(p: string): string;

package/dist/core/physical-path.js

@@ -0,0 +1,30 @@
+import { realpathSync } from "node:fs";
+import { realpath } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+export function physicalPathOf(p) {
+    return realpathSync.native(p);
+}
+export function priorCallerCasedPathOf(p) {
+    return realpathSync(p);
+}
+export async function physicalPathOfAsync(p) {
+    return await realpath(p);
+}
+export function physicalPathOfExisting(p) {
+    const abs = resolve(p);
+    const missingTail = [];
+    let cur = abs;
+    for (;;) {
+        try {
+            const real = physicalPathOf(cur);
+            return missingTail.length === 0 ? real : join(real, ...[...missingTail].reverse());
+        }
+        catch {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return abs;
+            missingTail.push(basename(cur));
+            cur = parent;
+        }
+    }
+}

package/dist/core/runner/contracts.d.ts

@@ -291,6 +291,8 @@ export interface Prepared {
     /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
+    /** The run's advertised-writable-directory seat (present with hands): `roots` is what the prompt advertised as writable and the fence admitted. Read live wherever a policy is adjudicated off a resumed leg, so the write gate's exemption domain is that same list. */
+    advertisedWritableDirs?: Pick<import("./advertised-writable-dirs.js").AdvertisedWritableDirs, "roots">;
     /** The ACTIVE EnterWorktree session ref (mounted with the worktree tools; undefined without
      *  real write hands). runtask's settle write reads `current` for the workspace-state entry. */
     worktreeSessionRef?: {
@@ -1517,7 +1519,7 @@ export interface RunInternals {
     workflowParkedResume?: ReadonlyArray<{
         runId: string;
         token: CheckpointToken;
-        outcome: ResumeOutcome;
+        outcome?: ResumeOutcome;
         inheritedGate?: InheritedGate;
     }>;
     /**

package/dist/core/runner/prepare-artifact.d.ts

@@ -3,11 +3,10 @@
  * nothing and announces nothing; a seat whose declaration fails an invariant mounts nothing and announces
  * `config.artifact_host_invalid` (operator audience) so a bad wiring can never read as "no hosting"; a
  * valid seat mounts ONE `Artifact` tool assembled from the declaration, on the same optional band the LSP
- * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny,
- * read face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
- * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — the task root and both
- * classes of additional directories — because a ledger the model can edit through the fs tools is not a trust
- * boundary; a store inside one refuses the mount with the same loud notice, naming the directory and the root.
+ * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny, read
+ * face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
+ * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — a ledger the model can
+ * edit through the fs tools is not a trust boundary — and a store inside one refuses the mount, naming both.
  * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
  */
 import type { ExecutionEnv } from "../../internal/harness.js";

package/dist/core/runner/prepare-artifact.js

@@ -4,23 +4,9 @@ import { deliverEngineNotice } from "../engine-notice.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { defineTool } from "../tools.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { existsSync, realpathSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { physicalPathOfExisting } from "../physical-path.js";
 import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
-function realAncestorPath(p) {
-    const abs = resolve(p);
-    const tail = [];
-    let cur = abs;
-    while (!existsSync(cur)) {
-        const parent = dirname(cur);
-        if (parent === cur)
-            return abs;
-        tail.unshift(basename(cur));
-        cur = parent;
-    }
-    return tail.length === 0 ? realpathSync(cur) : join(realpathSync(cur), ...tail);
-}
 export function prepareArtifact(input) {
     const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
     const host = deps.artifactHost;
@@ -39,7 +25,7 @@ export function prepareArtifact(input) {
         return refuse(verdict.problem);
     const storageDir = verdict.capabilities.storageDir;
     if (storageDir !== undefined && rootCanonical !== undefined) {
-        const real = realAncestorPath(storageDir);
+        const real = physicalPathOfExisting(storageDir);
         const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
         if (inside !== undefined)
             return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -18,6 +18,7 @@
  * the orchestrator grows no branch.
  */
 import type { AgentTool } from "../../internal/harness.js";
+import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import type { AutoModeDenialTracker } from "../auto-mode.js";
 import { type Hooks } from "../hooks.js";
 import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-policy.js";
@@ -44,6 +45,8 @@ export interface PrepareAskLaneInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined (hands-less). Read per call at RUN time (`current`),
      *  never captured: the fs hand tools resolve their relative paths against this very ref. Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the run's advertised-writable-directory seat, or undefined (hands-less / nothing advertised). `roots` is read at RUN time, never captured: it is the fence's own admitted list and the write gate's exemption domain must be that same list. Not written here. */
+    advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (alias-aware
      *  lookup over whatever the roster holds when the ask is minted). Never mutated here. */
     tools: readonly AgentTool[];

package/dist/core/runner/prepare-ask-lane.js

@@ -1,6 +1,6 @@
 import { primaryActivityArg } from "../arg-summary.js";
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
-import { isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
 import { composeCallSignal, raceAbort } from "./abort-race.js";
 import { gateAskCarry, lateAskSettlementObserver } from "./denial-limit-arms.js";
 import { consumeInheritedAskGrant } from "./inherited-ask-grants.js";
@@ -55,14 +55,14 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
     const adjudicate = effectivePolicy
         ? (req, callSignal) => {
             const signal = composedCallSignal(callSignal);
-            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, signal)), signal, () => ({
+            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) }, signal)), signal, () => ({
                 action: "deny",
                 message: "policy check aborted (task timed out or cancelled)",
             }));

package/dist/core/runner/prepare-park-ask.d.ts

@@ -27,6 +27,7 @@ import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-polic
 import { type ToolResultStore } from "../tool-result-store.js";
 import type { RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
+import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
 import type { AskLane, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -92,6 +93,8 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read at park time for the re-adjudication.
      *  Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
+    advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the run's offload store, or undefined (a volatile store holding results refuses the park). */
     offloadStore: ToolResultStore | undefined;
     /** borrowed-readonly — the per-task owned env, or undefined (a non-remote per-task env refuses the park). Never destroyed. */

package/dist/core/runner/prepare-park-ask.js

@@ -7,7 +7,7 @@ import { BINDING_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtF
 import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { checkpointScopeOf } from "./checkpoint-scope.js";
@@ -22,7 +22,7 @@ class ParkRefusal extends Error {
     }
 }
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -160,6 +160,7 @@ export function prepareParkAsk(input) {
                         budget: budgetSnapshot,
                         ...callFaceSeat(req.face),
                         ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                        ...advertisedWritableRootsSeat(advertisedWritableDirs),
                     }, cutSignal)), cutSignal);
                     if (reprojectedRaced.tag === "aborted")
                         return undefined;

package/dist/core/runner/prepare-policy-chain.js

@@ -4,7 +4,7 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
@@ -143,7 +143,7 @@ export async function preparePolicyChain(input) {
         inheritedUnavailableAsks.add(toolCallId);
         return true;
     };
-    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) && markInheritedUnavailable(toolCallId);
+    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined }) && markInheritedUnavailable(toolCallId);
     const mandateUnreconstructibleDeny = (creq) => attestAskUnresolvableCause({
         action: "deny",
         message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,

package/dist/core/runner/prepare-question-face.js

@@ -1,5 +1,6 @@
 import { createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { durableParkOptInDeclared } from "../tool-policy.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -41,7 +42,7 @@ export function prepareQuestionFace(input) {
             byDelivery.set(r.deliveryId, r);
         return [...byDelivery.values()];
     };
-    const durableQuestionFace = questionParkStoreWired && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
+    const durableQuestionFace = questionParkStoreWired && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined });
     const mountedQuestionFace = liveQuestionFace !== undefined
         ? async (req, signal) => {
             const bound = contentAskBindings.get(req.toolCallId);