@sema-agent/core 7.24.4 → 7.25.0

package/dist/core/task-registry-shared.js

@@ -101,14 +101,25 @@ export function spoolDropNote(acct) {
         return "[!] an unknown amount of earlier output was permanently dropped before this window (buffer evicted)\n";
     return "";
 }
+export const TASK_OUTPUT_REPLAY_KINDS = ["full", "cursor"];
+export const REPLAY_FACE = {
+    full: { stdout: "stdout (full, re-readable)", stdoutWhenGapped: "stdout (re-readable spool — INCOMPLETE, see note above)", stderr: "stderr" },
+    cursor: { stdout: "new stdout", stdoutWhenGapped: undefined, stderr: "new stderr" },
+};
+export const SPOOL_REPLAY = "full";
+export const INCREMENT_REPLAY = "cursor";
+export function stdoutHeadingOf(replay, gapDisclosed) {
+    const face = REPLAY_FACE[replay];
+    return gapDisclosed ? (face.stdoutWhenGapped ?? face.stdout) : face.stdout;
+}
 export function renderSpoolBody(spool, opts) {
     const timedOutClause = spool.timedOut === true ? ` (timed out after ${spool.timeoutSec !== undefined ? `${spool.timeoutSec}s` : "its background time budget"})` : "";
     const displayStatus = (spool.exitCode !== undefined ? `exited(code ${spool.exitCode})` : opts.running ? "running" : opts.handleStatus) + timedOutClause;
     const rolledNote = spool.rolledChars > 0 ? `[!] ${spool.rolledChars} earlier char(s) dropped from the spool (memory bound)${opts.rolledExtraClause}\n` : "";
     const droppedNote = spoolDropNote(spool);
-    const stdoutHeading = droppedNote !== "" || opts.drainNote !== "" ? "stdout (re-readable spool — INCOMPLETE, see note above)" : "stdout (full, re-readable)";
+    const stdoutHeading = stdoutHeadingOf(SPOOL_REPLAY, droppedNote !== "" || opts.drainNote !== "");
     return (`status: ${displayStatus}\n${rolledNote}${droppedNote}${opts.drainNote}--- ${stdoutHeading} ---\n${opts.shape(spool.stdout) || "(none)"}\n` +
-        `--- stderr ---\n${opts.shape(spool.stderr) || "(none)"}`);
+        `--- ${REPLAY_FACE[SPOOL_REPLAY].stderr} ---\n${opts.shape(spool.stderr) || "(none)"}`);
 }
 export function droppedGapNote(spool) {
     if ((spool.droppedBytes ?? 0) > 0)

package/dist/core/task-registry.js

@@ -8,7 +8,7 @@ import { createSafeNotifier } from "./safe-notify.js";
 import { stripCwdSentinel } from "../tools/fs/fs-shared.js";
 import { registerMonitorLane, pollMonitorLane, stopMonitorLane } from "./task-registry-monitor.js";
 import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task-registry-workflow.js";
-import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
+import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, stdoutHeadingOf, REPLAY_FACE, SPOOL_REPLAY, INCREMENT_REPLAY, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
 export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
 import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, backgroundAgentCycleSeqLane, activeDelegationHandlesLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
@@ -1075,6 +1075,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                     details: {
                         status: running ? "running" : handle.status,
                         exitCode: spool.exitCode,
+                        replay: SPOOL_REPLAY,
                         ...(spool.droppedBytes !== undefined ? { bytesDroppedBeforeCursor: spool.droppedBytes } : {}),
                         ...(spool.timedOut === true ? { timedOut: true, ...(spool.timeoutSec !== undefined ? { timeoutSec: spool.timeoutSec } : {}) } : {}),
                     },
@@ -1099,12 +1100,13 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                 if (r.error.code === "not_found")
                     return noTask(requestedId, runningAgentFooterLane(this.core, access));
                 const retrieval_status = r.error.code === "timeout" ? "timeout" : "not_ready";
-                const salvaged = stdout.length > 0 || stderr.length > 0
+                const carriedOutput = stdout.length > 0 || stderr.length > 0;
+                const salvaged = carriedOutput
                     ? `\n--- output accumulated before the error ---\n${clipTaskOutput(stdout, handle.outputFile)}${stderr ? `\n--- stderr ---\n${clipTaskOutput(stderr, handle.outputFile)}` : ""}`
                     : "";
                 return {
                     content: `Error (TaskOutput): ${r.error.message}${salvaged}`,
-                    details: { task_id: handle.id, type: "background_bash", status: handle.status, retrieval_status, error: r.error.code },
+                    details: { task_id: handle.id, type: "background_bash", status: handle.status, retrieval_status, ...(carriedOutput ? { details: { replay: INCREMENT_REPLAY } } : {}), error: r.error.code },
                     isError: true,
                 };
             }
@@ -1125,8 +1127,8 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                 const displayStatus = (r.value.status === "exited" ? `exited(code ${r.value.exitCode})` : r.value.status) + timedOutClause;
                 const droppedNote = spoolDropNote(dropAcct) +
                     (rolledChars > 0 ? `[!] ${rolledChars} accumulated char(s) dropped from the middle during the blocked wait (memory bound)\n` : "");
-                const body = `status: ${displayStatus}\n${droppedNote}--- new stdout ---\n${shape(stdout) || "(none)"}\n` +
-                    `--- new stderr ---\n${shape(stderr) || "(none)"}`;
+                const body = `status: ${displayStatus}\n${droppedNote}--- ${stdoutHeadingOf(INCREMENT_REPLAY, droppedNote !== "")} ---\n${shape(stdout) || "(none)"}\n` +
+                    `--- ${REPLAY_FACE[INCREMENT_REPLAY].stderr} ---\n${shape(stderr) || "(none)"}`;
                 return {
                     content: delimitUntrusted(`TaskOutput ${handle.id}`, body),
                     details: {
@@ -1139,6 +1141,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                         details: {
                             status: r.value.status,
                             exitCode: r.value.exitCode,
+                            replay: INCREMENT_REPLAY,
                             bytesDroppedBeforeCursor: dropAcct.droppedBytes ?? 0,
                             ...(r.value.timedOut === true ? { timedOut: true, ...(r.value.timeoutSec !== undefined ? { timeoutSec: r.value.timeoutSec } : {}) } : {}),
                         },

package/dist/core/task-spec.d.ts

@@ -783,9 +783,12 @@ export interface TaskSpec {
     /**
      * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
-     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
-     * auto-allow probe, the compaction attachment reader and the `bash_readonly` shell mounted by
-     * {@link handsReadOnly} — one deny judge for every read face) in BOTH containment modes. Add-only at
+     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the compaction attachment reader) and
+     * by the shell READ STATION under every doctrine — the full shell (`Bash`, `Monitor`, whatever
+     * {@link shellGate} says) and the `bash_readonly` shell mounted by {@link handsReadOnly} alike: a
+     * deny-listed shell read is REFUSED at the gate (`deniedBy: "read_boundary"`), never asked, with the same
+     * sentence the structured faces refuse with — one deny judge for every read face — in BOTH containment
+     * modes. Add-only at
      * the task layer: entries here UNION with the active built-ins and the deployment's
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration
@@ -873,8 +876,12 @@ export interface TaskSpec {
      *  - `"always"`: every `bash` command tightens to an `irreversible_ask` durable suspend (fail-closed; the
      *    correct default for an unattended/supervisor deployment with no classifier).
      *  - `"classify"`: mark `bash` `irreversibility:"maybe"` with {@link import("../tools/fs/index.js").bashReversibilityProbe}
-     *    — a provably-benign single allowlisted read-only command (no operators) auto-allows; everything else
-     *    (writes, egress, pipes, unknown commands) tightens to ask. An egress command (e.g. `curl`) suspends under
+     *    — the SHAPE classifier alone: a provably-benign single allowlisted read-only command (no operators)
+     *    auto-allows; everything else (writes, egress, pipes, unknown commands) tightens to ask. WHERE a command
+     *    reads is not this doctrine's question under any value: the gate's shell read station judges every
+     *    shell call's read candidates against the deny set and the containment roots (a deny-listed read is
+     *    refused, an out-of-root read is a mandated ask) whether `shellGate` is `"off"`, `"classify"` or
+     *    `"always"`. An egress command (e.g. `curl`) suspends under
      *    the IRREVERSIBLE axis (the shell mark is irreversibility, not egress) — the kind is non-budgetable either
      *    way, so the budget resolver still never auto-approves it; the axis label is informational.
      *    NOT unconditional: a POSITIVE per-tool mark on the shell tool keeps its seat — an explicit

package/dist/core/tool-catalog-entries.js

@@ -154,6 +154,7 @@ export const ENGINE_CARDS = Object.freeze({
     a2a: "src/core/a2a.ts",
     path_not_in_root: "src/tools/fs/safety.ts",
     read_path_denied: "src/tools/fs/safety.ts",
+    readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {

package/dist/core/tool-spec.d.ts

@@ -1180,7 +1180,7 @@ export interface ToolExecuteContext {
      */
     onTaskNotification?: (n: import("./task-notification.js").TaskNotificationPayload, opts?: {
         priority?: import("./task-notification.js").SystemInjectionPriority;
-    }) => void;
+    }) => unknown;
     /**
      * design/99 (nested-subagent live observability): the host run's OPT-IN display sink — a deployment sets it (via
      * `RunInternals.onForwardEvent`) to receive a SUBAGENT's live `task_progress` ticks that otherwise stay in the

package/dist/core/wiring-manifest.d.ts

@@ -432,8 +432,8 @@ export interface WiringFacts {
     parkDurableApprovalOptIn: boolean;
     /** `undefined` = unresolved at this half (per-principal runtime caps are a prepare-time fact). */
     parkForceDurableGate?: boolean;
-    /** `undefined` = unresolved at this half (the irreversible/egress tool vocabulary is assembled in
-     *  prepare). */
+    /** `undefined` = unresolved at this half (the irreversible/egress tool vocabulary and the shell read station —
+     *  the three sources of a mandated ask — are assembled in prepare). */
     parkSafetyVocabularyArmed?: boolean;
     /** Present iff `parkCapable` (the resolved checkpoint store's declaration). */
     checkpointDurability?: StoreDurability;

package/dist/engine/loop/agent-loop.js

@@ -1325,7 +1325,7 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
                 };
             }
             if (beforeResult?.block) {
-                const blocked = createErrorToolResult(beforeResult.reason || "Tool execution was blocked");
+                const blocked = createErrorToolResult(beforeResult.reason || "Tool execution was blocked", beforeResult.details !== undefined ? { details: beforeResult.details } : undefined);
                 if (beforeResult.haltRemaining !== undefined) {
                     return { kind: "immediate", result: blocked, isError: true, halt: beforeResult.haltRemaining };
                 }

package/dist/engine/loop/types.d.ts

@@ -83,6 +83,10 @@ export type AgentToolCall = Extract<AssistantMessage["content"][number], {
 export interface BeforeToolCallResult {
     block?: boolean;
     reason?: string;
+    /** With `block`: the structured details the refusing layer minted, attached to the error result the loop
+     *  builds from `reason` (a `{ type, code, … }` card reaches `tool_end.structured` / `errorCode` exactly as a
+     *  tool's own refusal would). Ignored without `block`. */
+    details?: unknown;
     updatedInput?: unknown;
     haltRemaining?: HaltRemainingDirective;
 }

package/dist/index.d.ts

@@ -100,7 +100,7 @@ export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, CheckResult, } from "./core/property-harness.js";
-export { bashReversibilityProbe, bashReadBoundaryProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
+export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
@@ -132,7 +132,9 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
+NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -201,7 +203,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * allowed and widening is not.
  */
 export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type AddResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleTightenAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
@@ -277,6 +279,7 @@ export { workflowJournalStoreContract } from "./core/store-contracts/workflow-jo
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, mailboxCrossProcessContract, type MailboxCrossProcessContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
+export { PEER_DIRECTORY_CONTRACT_SCOPE, peerDirectoryContract, type PeerDirectoryContractHooks } from "./core/store-contracts/peer-directory-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsInput, } from "./core/task-registry-agent.js";
 export type { UnifiedTaskResult } from "./core/task-registry-shared.js";

package/dist/index.js

@@ -78,7 +78,7 @@ export { runExecGate } from "./core/exec-gate.js";
 export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
-export { bashReversibilityProbe, bashReadBoundaryProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
+export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, } from "./tools/fs/index.js";
@@ -107,7 +107,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -159,7 +159,7 @@ export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoMo
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
 export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
+export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
@@ -233,6 +233,7 @@ export { workflowJournalStoreContract } from "./core/store-contracts/workflow-jo
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, mailboxCrossProcessContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
+export { PEER_DIRECTORY_CONTRACT_SCOPE, peerDirectoryContract } from "./core/store-contracts/peer-directory-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";
 export { FileBackgroundAgentStore } from "./stores/file/background-agent-store.js";

package/dist/prompts/coordinator.d.ts

@@ -2,7 +2,8 @@
  * design/147 S3b — the teammate communication addendum (CC 2.1.212
  * `TEAMMATE_SYSTEM_PROMPT_ADDENDUM`, pretty.js:322948, sema-ized): composed for a NAMED delegated
  * child (`core/mode.teammate` section, admit = facts.teammateEnabled — the CC injection condition
- * `agentId && agentName && teamName` maps to sema's named-spawn internals chain). Divergences:
+ * `agentId && agentName && teamName` maps to sema's named-spawn internals chain; sema keeps no team
+ * name — one implicit team per session, keyed by the root session). Divergences:
  * CC's "task system"/"team lead" wording maps to sema's `"main"` reserved lane (the spawning
  * conversation); and the capability sentences track the shipped contract (S2a
  * delivered mid-run delivery): a message to a RUNNING teammate is queued and reaches it at its next

package/dist/stores/file/adoption/adopt.js

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { adoptFilePermissionRuleStore } from "../permission-rule-adopt.js";
 import { BootLock, atomicWriteFile, ensureDir, sanitizeScope } from "../fs-atomic.js";
+import { SESSION_POLICY_MARK_SUFFIX, readSessionPolicyMark } from "../session-policy-store.js";
 import { thrownText } from "../../../core/thrown-value.js";
 import { AdoptionError, NOT_MIGRATED_BY_DESIGN, readRootAdoptionFile, writeRootAdoptionFile, } from "./marker.js";
 const CONFIG_ACCOUNT_FILE = "adoption-configs.json";
@@ -194,6 +195,10 @@ function rewriteSessionPolicyRows(root, fromPrincipal, toPrincipal) {
     for (const file of files) {
         if (!file.endsWith(".json"))
             continue;
+        if (file.endsWith(SESSION_POLICY_MARK_SUFFIX)) {
+            carrySessionPolicyMark(dir, tmpDir, file, fromPrincipal, toPrincipal);
+            continue;
+        }
         const source = join(dir, file);
         let raw;
         try {
@@ -218,8 +223,9 @@ function rewriteSessionPolicyRows(root, fromPrincipal, toPrincipal) {
             continue;
         if (typeof row.__sid !== "string")
             continue;
+        const stem = sanitizeScope(JSON.stringify([row.__sid, toPrincipal]));
         const rewritten = JSON.stringify({ ...row, __principal: toPrincipal });
-        const target = join(dir, `${sanitizeScope(JSON.stringify([row.__sid, toPrincipal]))}.json`);
+        const target = join(dir, `${stem}.json`);
         if (existsSync(target)) {
             if (readFileSync(target, "utf8") === rewritten) {
                 removeIfPresent(source);
@@ -235,6 +241,22 @@ function rewriteSessionPolicyRows(root, fromPrincipal, toPrincipal) {
     }
     return rows;
 }
+function carrySessionPolicyMark(dir, tmpDir, file, fromPrincipal, toPrincipal) {
+    const source = join(dir, file);
+    const mark = readSessionPolicyMark(source);
+    if (mark === null)
+        return;
+    if (mark.__principal !== fromPrincipal)
+        return;
+    if (typeof mark.__sid !== "string")
+        return;
+    const target = join(dir, `${sanitizeScope(JSON.stringify([mark.__sid, toPrincipal]))}${SESSION_POLICY_MARK_SUFFIX}`);
+    const there = readSessionPolicyMark(target);
+    const merged = there === null ? mark.__hwm : Math.max(mark.__hwm, there.__hwm);
+    const mergedGen = Math.max(mark.__gen ?? 0, there?.__gen ?? 0);
+    atomicWriteFile(tmpDir, target, JSON.stringify({ ...mark, __principal: toPrincipal, __hwm: merged, __gen: mergedGen }));
+    removeIfPresent(source);
+}
 function removeIfPresent(path) {
     try {
         unlinkSync(path);

package/dist/stores/file/permission-rule-store.js

@@ -311,7 +311,9 @@ class FileDurableRulePartition {
             }
             const next = delta.kind === "redemption-add"
                 ? (assertWriteDeltaScopeDurable(delta), assertRedemptionNotQuarantined(cur.quarantined ?? [], delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
-                : (assertWriteDeltaScopeDurable(delta), assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
+                : delta.kind === "tighten-add"
+                    ? (assertWriteDeltaScopeDurable(delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
+                    : (assertWriteDeltaScopeDurable(delta), assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
             if (!this.writeAndVerify(next)) {
                 throw new Error("the permission-rule store did not survive its own write; the change was not committed");
             }

package/dist/stores/file/session-policy-store.d.ts

@@ -15,6 +15,32 @@ export interface FileSessionPolicyStoreOptions {
      *  Never fires on plain ENOENT. Swallow-guarded: a throwing sink cannot re-introduce the fault. */
     onCorruptRead?: (info: SessionPolicyCorruptReadInfo) => void;
 }
+/**
+ * The suffix that tells a MARK file apart from a rules ROW in the shared directory — injective by
+ * construction, not by convention: `sanitizeScope` ends every row's basename with a 64-hex digest, so the
+ * character before a row's `.json` is always a hex digit and no row can be spelled `*.hwm.json`. Every sweep
+ * of this directory tests it FIRST: a mark must never be listed as a row, nor judged as crash litter.
+ */
+export declare const SESSION_POLICY_MARK_SUFFIX = ".hwm.json";
+/** What one mark file carries: the number, plus the row's attribution fields (the filename is a one-way hash,
+ *  so those are the only way a sweep can tell whose mark it is). Attribution is OPTIONAL on the read side —
+ *  this store always writes it, a hand-written file need not, and a mark with no owner is simply nobody's. */
+export interface StoredHighWaterMark {
+    __hwm: number;
+    /** The lineage the key's NEXT row starts (bumped by every erase); absent = 0 (a mark written before lineages). */
+    __gen?: number;
+    __sid?: string;
+    __principal?: string | null;
+}
+/**
+ * The ONE reader of a mark file — the number it holds, or `null` when there is no file (the ordinary state of
+ * a key nobody erased). Every other outcome is a refusal, and that is the point: for a ROW "unreadable"
+ * degrades to "absent" and costs nothing, while for a mark absence reads as ZERO, which is precisely the
+ * rollback the erase contract forbids. Bytes that are not a mark raise `SessionPolicyError("corrupt")` naming
+ * the file; an IO failure propagates as it already does for a row. Exported because ownership adoption moves
+ * these files too, and a second, more tolerant reader over there is how the guarantee goes quietly missing.
+ */
+export declare function readSessionPolicyMark(path: string): StoredHighWaterMark | null;
 export declare class FileSessionPolicyStore implements SessionPolicyStore {
     private readonly dir;
     private readonly onCorruptRead;
@@ -40,6 +66,11 @@ export declare class FileSessionPolicyStore implements SessionPolicyStore {
      *  composite key, so distinct keys never collide on disk). On a local-owner-adopted root the
      *  anonymous lane resolves to the adopted principal's key (#132 — see {@link anonymousAlias}). */
     private pathFor;
+    /** The shared, injective stem of a key's two files — the row (`<stem>.json`) and its mark
+     *  (`<stem>${MARK_SUFFIX}`), so the pair can never drift onto different keys. */
+    private basenameFor;
+    private markPathFor;
+    private writeMarkFile;
     private read;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;

package/dist/stores/file/session-policy-store.js

@@ -1,4 +1,4 @@
-import { readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { loosenReasons, normalizeRules, stripRev, SessionPolicyError, } from "../../core/session-policy-store.js";
 import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
@@ -9,6 +9,37 @@ function containSinkThenable(r) {
         });
     }
 }
+export const SESSION_POLICY_MARK_SUFFIX = ".hwm.json";
+const MARK_SUFFIX = SESSION_POLICY_MARK_SUFFIX;
+export function readSessionPolicyMark(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    const refuse = (fault) => {
+        throw new SessionPolicyError("corrupt", `session rules high-water mark ${fault}: ${path} — refusing rather than restart this key's rev from zero. Deleting that file is the repair, and it gives up the number it was holding.`);
+    };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return refuse("is unparseable");
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return refuse("is not a JSON object");
+    const mark = parsed;
+    if (typeof mark.__hwm !== "number" || !Number.isFinite(mark.__hwm))
+        return refuse("carries no numeric value");
+    if (mark.__gen !== undefined && (typeof mark.__gen !== "number" || !Number.isInteger(mark.__gen) || mark.__gen < 0))
+        return refuse("carries a lineage that is not a whole number");
+    return mark;
+}
 export class FileSessionPolicyStore {
     dir;
     onCorruptRead;
@@ -33,9 +64,19 @@ export class FileSessionPolicyStore {
         this.disclose({ sessionId, ...(principal !== undefined ? { principal } : {}), path: this.pathFor(sessionId, principal), reason });
     }
     pathFor(sessionId, principal) {
+        return join(this.dir, `${this.basenameFor(sessionId, principal)}.json`);
+    }
+    basenameFor(sessionId, principal) {
         const effective = principal ?? this.anonymousAlias;
         const composite = JSON.stringify([sessionId, effective ?? null]);
-        return join(this.dir, `${sanitizeScope(composite)}.json`);
+        return sanitizeScope(composite);
+    }
+    markPathFor(sessionId, principal) {
+        return join(this.dir, `${this.basenameFor(sessionId, principal)}${MARK_SUFFIX}`);
+    }
+    writeMarkFile(path, rev, sessionId, principal, gen) {
+        const mark = { __hwm: rev, __gen: gen, __sid: sessionId, __principal: principal };
+        atomicWriteFile(join(this.dir, "tmp"), path, JSON.stringify(mark));
     }
     read(sessionId, principal) {
         let raw;
@@ -54,8 +95,12 @@ export class FileSessionPolicyStore {
                 return null;
             }
             const r = parsed;
-            if (r.rev !== undefined && (typeof r.rev !== "number" || !Number.isFinite(r.rev))) {
-                this.discloseCorrupt(sessionId, principal, "non-numeric rev");
+            if (typeof r.rev !== "number" || !Number.isFinite(r.rev) || r.rev < 1) {
+                this.discloseCorrupt(sessionId, principal, "rev is not a positive number");
+                return null;
+            }
+            if (r.gen !== undefined && (typeof r.gen !== "number" || !Number.isInteger(r.gen) || r.gen < 0)) {
+                this.discloseCorrupt(sessionId, principal, "gen is not a whole number");
                 return null;
             }
             const strArr = (x) => x === undefined || (Array.isArray(x) && x.every((e) => typeof e === "string"));
@@ -88,8 +133,13 @@ export class FileSessionPolicyStore {
                 throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
             }
         }
-        const next = { ...clean, rev: (prior?.rev ?? 0) + 1 };
-        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: (principal ?? this.anonymousAlias) ?? null }));
+        const mark = readSessionPolicyMark(this.markPathFor(sessionId, principal));
+        const floor = Math.max(prior?.rev ?? 0, mark?.__hwm ?? 0);
+        const gen = prior?.gen ?? (existsSync(this.pathFor(sessionId, principal)) ? (mark?.__gen ?? 0) + 1 : (mark?.__gen ?? 0));
+        const next = { ...clean, rev: floor + 1, gen };
+        const attributedPrincipal = (principal ?? this.anonymousAlias) ?? null;
+        this.writeMarkFile(this.markPathFor(sessionId, principal), next.rev, sessionId, attributedPrincipal, gen);
+        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: attributedPrincipal }));
         return next;
     }
     async listBySession(sessionId) {
@@ -104,6 +154,8 @@ export class FileSessionPolicyStore {
         }
         const out = [];
         for (const file of files) {
+            if (file.endsWith(MARK_SUFFIX))
+                continue;
             if (!file.endsWith(".json"))
                 continue;
             const full = join(this.dir, file);
@@ -149,6 +201,8 @@ export class FileSessionPolicyStore {
             throw err;
         }
         for (const file of files) {
+            if (file.endsWith(MARK_SUFFIX))
+                continue;
             if (!file.endsWith(".json"))
                 continue;
             let raw;
@@ -163,6 +217,17 @@ export class FileSessionPolicyStore {
                 parsed = JSON.parse(raw);
             }
             catch {
+                const tornMarkPath = join(this.dir, `${file.slice(0, -".json".length)}${MARK_SUFFIX}`);
+                try {
+                    const tornMark = readSessionPolicyMark(tornMarkPath);
+                    if (tornMark !== null && tornMark.__sid === sessionId) {
+                        this.writeMarkFile(tornMarkPath, tornMark.__hwm, sessionId, tornMark.__principal ?? null, (tornMark.__gen ?? 0) + 1);
+                    }
+                }
+                catch (err) {
+                    if (!(err instanceof SessionPolicyError))
+                        throw err;
+                }
                 try {
                     unlinkSync(join(this.dir, file));
                 }
@@ -174,8 +239,23 @@ export class FileSessionPolicyStore {
             }
             if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
                 continue;
-            if (parsed.__sid !== sessionId)
+            const row = parsed;
+            if (row.__sid !== sessionId)
                 continue;
+            const markPath = join(this.dir, `${file.slice(0, -".json".length)}${MARK_SUFFIX}`);
+            let mark;
+            try {
+                mark = readSessionPolicyMark(markPath);
+            }
+            catch (err) {
+                if (!(err instanceof SessionPolicyError))
+                    throw err;
+                mark = undefined;
+            }
+            if (mark !== undefined) {
+                const rowRev = typeof row.rev === "number" && Number.isFinite(row.rev) ? row.rev : 0;
+                this.writeMarkFile(markPath, Math.max(mark?.__hwm ?? 0, rowRev), sessionId, row.__principal ?? null, (mark?.__gen ?? 0) + 1);
+            }
             try {
                 unlinkSync(join(this.dir, file));
             }

package/dist/tools/fs/bash-program-position.d.ts

@@ -9,7 +9,6 @@
  * does (an option skipped, a chain member missed) is how one face used to vouch for a program another refused.
  */
 import type { SegmentTokens } from "./bash-lexer.js";
-import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** The verdict every unresolvable / out-of-root / unbounded finding ends on. The findings differ in what
  *  they found; the consequence is one consequence, and a copy that drifts reads as a second rule. */
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
@@ -169,35 +168,14 @@ export declare function readProgramPosition(toks: SegmentTokens): ProgramPositio
  *  consumer; WHICH targets are accepted is the caller's declaration, not this reader's. */
 export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTargets: ReadonlySet<string>): boolean;
 /**
- * The two ways this reader DECLINES rather than judges — a CLOSED set, because which of them a seat reads as
- * evidence is a table each seat declares against (`fs-bash.ts`, where the argument is), not a boolean buried
- * in a caller. `unreadable_program_position`: the walk cannot name the program bash will run (`env -- ls`).
+ * The two ways this reader DECLINES rather than judges — a CLOSED set (`docs/CLOSED-SETS.md`), because what a
+ * seat does with a declined segment is a ROW of the shell read decision table (`shell-read-judge.ts`, the
+ * `declined` row: the one row the seats disagree on), not a boolean buried in a caller.
+ * `unreadable_program_position`: the walk cannot name the program bash will run (`env -- ls`).
  * `stream_fed_operands`: the operands arrive on a STREAM it never saw (`… | xargs cat`). Neither names a WORD.
  */
 export declare const SHELL_SCAN_DECLINES: readonly ["unreadable_program_position", "stream_fed_operands"];
 export type ShellScanDecline = (typeof SHELL_SCAN_DECLINES)[number];
-/** The two SEAT TABLES over that set — ROW PER MEMBER behind a compile-time fence, registered in
- *  `docs/CLOSED-SETS.md` so `gate:closed-sets` is their runtime twin. The ARGUMENT for the rows is at the
- *  seats that read them (`fs-bash.ts`), which DERIVE the `Set` shape their readers take. Rows and not two
- *  sets because a derived set beside an empty literal made a third decline SILENTLY asymmetric, in the
- *  widening direction; a member with no row now reds `tsc` at both fences with the word spelled out. */
-export declare const BOUNDARY_SEAT_READS_DECLINE: {
-    readonly unreadable_program_position: true;
-    readonly stream_fed_operands: true;
-};
-/** The fence over the read-boundary seat's table: `never` while every decline has a row. */
-export type BoundarySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof BOUNDARY_SEAT_READS_DECLINE>>;
-/** The classify doctrine's table — every row `false` BY THE ARGUMENT (stated at the seat), not by omission. */
-export declare const CLASSIFY_SEAT_READS_DECLINE: {
-    readonly unreadable_program_position: false;
-    readonly stream_fed_operands: false;
-};
-/** The fence over the classify seat's table. */
-export type ClassifySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof CLASSIFY_SEAT_READS_DECLINE>>;
-/** A seat's table in the shape its readers take — the members it answers YES for. DERIVED, so the ROWS are
- *  the single source and a set can never say something its table does not. The parameter is TOTAL, not
- *  `Partial`: that stops a third seat being written `seatDeclineEvidence({})`, one level up from the fences. */
-export declare function seatDeclineEvidence(table: Record<ShellScanDecline, boolean>): ReadonlySet<ShellScanDecline>;
 /** Does a SHELL stand where this segment's program would be — as the program itself (`sh -c`), or as a launcher
  *  ROW handing its operands to one (`watch "…"`)? ONE predicate for the re-entry class, so the two spellings
  *  cannot be answered differently; which names are shells is the caller's declaration. Not a decline. */

package/dist/tools/fs/bash-program-position.js

@@ -159,17 +159,6 @@ export function argvReentryUnjudged(pos, acceptedTargets) {
     return runs === undefined || !acceptedTargets.has(runs);
 }
 export const SHELL_SCAN_DECLINES = ["unreadable_program_position", "stream_fed_operands"];
-export const BOUNDARY_SEAT_READS_DECLINE = {
-    unreadable_program_position: true,
-    stream_fed_operands: true,
-};
-export const CLASSIFY_SEAT_READS_DECLINE = {
-    unreadable_program_position: false,
-    stream_fed_operands: false,
-};
-export function seatDeclineEvidence(table) {
-    return new Set(SHELL_SCAN_DECLINES.filter((decline) => table[decline] === true));
-}
 export function programPositionRunsShell(pos, shellProgram) {
     if (pos.refusal !== undefined)
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true;