@sema-agent/core 7.24.4 → 7.25.1

package/dist/core/gate-fold.js

@@ -48,6 +48,24 @@ export async function runGateFold(pass) {
             ...(pass.hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
         };
     }
+    if ((pass.decision.action === "allow" || pass.decision.action === "ask") && input.shellReadCheck !== undefined) {
+        const station = input.shellReadCheck;
+        const judged = station.judge(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
+        if (judged !== null) {
+            let verdict;
+            try {
+                verdict = await withGateTimeout(judged, boundedAwaitDeadlineMs(), pass.callSignal ?? input.abortSignal, "shellReadStation");
+            }
+            catch (err) {
+                const kind = gateWaitFailureOf(err);
+                if (kind !== "aborted" && input.abortSignal?.aborted !== true) {
+                    traceHookCrash(input, new Error(`shell read station ${kind === "timeout" ? "timed out" : "threw"} for tool "${toolName}" (toolCallId ${toolCallId}) — where this call reads could not be established: ${thrownText(err)}`), notifier);
+                }
+                verdict = station.unanswered(toolName, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
+            }
+            applyShellReadVerdict(pass, verdict, toolName, input.shellGated === true);
+        }
+    }
     if (input.egress && pass.decision.action === "allow") {
         pass.decision = {
             action: "ask",
@@ -59,6 +77,14 @@ export async function runGateFold(pass) {
     const alreadyAsking = pass.decision.action === "ask";
     if ((pass.decision.action === "allow" || alreadyAsking) && (input.irreversibility === "always" || input.irreversibility === "maybe")) {
         let tighten = !alreadyAsking;
+        const withdrawStationOffer = () => {
+            if (alreadyAsking && pass.shellReadOffer === true && pass.decision.action === "ask" && pass.decision.probeReadRootCandidate !== undefined) {
+                const { probeReadRootCandidate: _withdrawn, ...kept } = pass.decision;
+                pass.decision = kept;
+            }
+        };
+        if (input.irreversibility === "always" || !input.reversibilityProbe)
+            withdrawStationOffer();
         let probeReason;
         let probeCause;
         let probeMandated;
@@ -80,11 +106,13 @@ export async function runGateFold(pass) {
                     if (verdict?.boundaryDeclined === true)
                         pass.probeBoundaryDeclined = true;
                     probeReadRootCandidate = normalizeReadRootCandidate(verdict?.readRootCandidate);
+                    withdrawStationOffer();
                 }
             }
             catch (err) {
                 reversible = false;
                 pass.probeUnanswered = true;
+                withdrawStationOffer();
                 if (input.abortSignal?.aborted !== true)
                     traceHookCrash(input, err, notifier);
             }
@@ -140,3 +168,60 @@ export async function runGateFold(pass) {
     }
     return await pass.afterFold(pass);
 }
+function shellReadAskMessage(toolName, finding) {
+    return finding === "outside_roots"
+        ? `tool "${toolName}" reads outside the directories allowed for this session — explicit approval required`
+        : `tool "${toolName}" reads where the session's read boundary could not establish what is read — explicit approval required`;
+}
+function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
+    const account = verdict.sentence !== undefined && verdict.sentence.trim().length > 0 ? inlineUntrusted(verdict.sentence, PROBE_REASON_MAX) : undefined;
+    switch (verdict.disposition) {
+        case "vouch":
+            return;
+        case "refuse":
+            pass.decision = { action: "deny", message: verdict.sentence ?? `tool "${toolName}" reads what the session's read boundary refuses` };
+            pass.deniedBy = "read_boundary";
+            if (verdict.details !== undefined)
+                pass.denyDetails = verdict.details;
+            return;
+        case "mandated": {
+            if (verdict.details !== undefined)
+                pass.shellReadDetails = verdict.details;
+            if (pass.decision.action !== "allow") {
+                if (pass.decision.action === "ask")
+                    pass.decision = { ...pass.decision, probeMandated: true };
+                return;
+            }
+            const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
+            pass.decision = {
+                action: "ask",
+                message: shellReadAskMessage(toolName, verdict.finding),
+                decisionReason: "safety",
+                probeMandated: true,
+                ...(account !== undefined ? { probeReason: account } : {}),
+                ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
+            };
+            if (candidate !== undefined)
+                pass.shellReadOffer = true;
+            pass.tightenedBy = shellGated ? "shell_gate" : "safety";
+            return;
+        }
+        case "ordinary": {
+            if (pass.decision.action === "allow") {
+                pass.decision = {
+                    action: "ask",
+                    message: shellReadAskMessage(toolName, verdict.finding),
+                    decisionReason: "safety",
+                    ...(account !== undefined ? { probeReason: account } : {}),
+                };
+                pass.tightenedBy = shellGated ? "shell_gate" : "safety";
+            }
+            pass.probeBoundaryDeclined = true;
+            return;
+        }
+        default: {
+            const exhaustive = verdict.disposition;
+            return exhaustive;
+        }
+    }
+}

package/dist/core/gate-lanes.js

@@ -11,7 +11,7 @@ import { catalogRuleFaceOf } from "./tool-registry.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
-import { createGateDeadline, awaitWriteProtectionJudgment } from "./gate-bounded-await.js";
+import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
 function isPlainOwnRecord(x) {
     try {
@@ -691,6 +691,28 @@ export async function runGateLanes(pass) {
                         pass.deniedBy = "write_protection";
                     }
                 }
+                if (editDenied === undefined && input.shellReadCheck !== undefined) {
+                    const station = input.shellReadCheck;
+                    const judged = station.judge(toolName, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
+                    if (judged !== null) {
+                        let verdict;
+                        try {
+                            verdict = await withGateTimeout(judged, boundedAwaitDeadlineMs(), callSignal ?? input.abortSignal, "shellReadStation");
+                        }
+                        catch {
+                            verdict = station.unanswered(toolName, "the read station could not answer");
+                        }
+                        if (verdict.disposition !== "vouch") {
+                            editDenied = {
+                                action: "deny",
+                                message: verdict.sentence ?? `the approved edit for "${toolName}" reads where the read boundary does not vouch — denied fail-closed; re-submit the command as a fresh call and answer its card`,
+                            };
+                            pass.deniedBy = "read_boundary";
+                            if (verdict.details !== undefined)
+                                pass.denyDetails = verdict.details;
+                        }
+                    }
+                }
                 pass.decision = editDenied ?? { ...pass.decision, updatedInput: editArgs };
             }
             else if (pass.decision.action === "allow" && pass.decision.updatedInput === undefined && resolved.presentedInput !== undefined) {

package/dist/core/gate-outcome.d.ts

@@ -154,8 +154,11 @@ export type SettlementRefusalTableCoversEveryKind = AssertAllKeysHandled<Exclude
  *    path that no approval covers.
  *  - `ask_resolution` — the ask's own settlement is the refusal (a person said no, a window elapsed,
  *    nobody could be asked…); the detail is on {@link GateOutcome.settlement}.
+ *  - `read_boundary` — the shell read station refused: a deny-listed read (refused on every seat, with no
+ *    ask), a read the read-only shell face may not make, or a rewritten / re-established command whose reads
+ *    no longer are what a person approved.
  */
-export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
+export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution", "read_boundary"];
 export type DeniedBy = (typeof DENIED_BY_VALUES)[number];
 /** Membership test for {@link DeniedBy}. */
 export declare function isDeniedBy(v: unknown): v is DeniedBy;
@@ -165,7 +168,8 @@ export declare function isDeniedBy(v: unknown): v is DeniedBy;
  *  classifier, plan mode and compliance run before any ask exists, and `ask_resolution` IS the
  *  settlement, not a veto of it. `persisted_rule` = a person's own standing DENY row (their settings'
  *  deny list, imported) — the personal-store sibling of `org`, and like it re-judged on an edited
- *  command. */
+ *  command. `read_boundary` vetoes too: the rewrite re-judge and the pre-spawn re-establishment run after
+ *  the person's yes, on bytes or targets the person never saw. */
 export declare const DENIED_BY_MAY_VETO: {
     readonly policy: true;
     readonly hook: true;
@@ -176,6 +180,7 @@ export declare const DENIED_BY_MAY_VETO: {
     readonly compliance: false;
     readonly write_protection: true;
     readonly ask_resolution: false;
+    readonly read_boundary: true;
 };
 /** Compile-time fence: `never` while every deny layer has a veto row. */
 export type VetoTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_VETO>>;
@@ -209,6 +214,7 @@ export declare const DENIED_BY_MAY_CARRY_CAUSE: {
     readonly compliance: false;
     readonly write_protection: false;
     readonly ask_resolution: false;
+    readonly read_boundary: false;
 };
 /** Compile-time fence: `never` while every deny layer has a cause row. */
 export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_CARRY_CAUSE>>;

package/dist/core/gate-outcome.js

@@ -39,7 +39,7 @@ export const SETTLEMENT_IS_REFUSAL = {
     blanket_allow_refused: true,
     task_aborted: true,
 };
-export const DENIED_BY_VALUES = ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
+export const DENIED_BY_VALUES = ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution", "read_boundary"];
 const DENIED_BY_SET = new Set(DENIED_BY_VALUES);
 export function isDeniedBy(v) {
     return DENIED_BY_SET.has(v);
@@ -54,6 +54,7 @@ export const DENIED_BY_MAY_VETO = {
     compliance: false,
     write_protection: true,
     ask_resolution: false,
+    read_boundary: true,
 };
 export const CLASSIFIER_DENY_CAUSES = ["unavailable", "parse_error"];
 const CLASSIFIER_DENY_CAUSE_SET = new Set(CLASSIFIER_DENY_CAUSES);
@@ -70,6 +71,7 @@ export const DENIED_BY_MAY_CARRY_CAUSE = {
     compliance: false,
     write_protection: false,
     ask_resolution: false,
+    read_boundary: false,
 };
 export function screenGateOutcome(g) {
     const defects = [];

package/dist/core/hooks.d.ts

@@ -732,6 +732,16 @@ export interface HookInvocationIdentity {
      *  UNTRUSTED display text (model-chosen) — already single-line-bounded at mint (same
      *  `inlineUntrusted` treatment as the `task_progress` name lane); never an identity key. */
     readonly agentName?: string;
+    /** The EXPLICIT `Agent({name})` spawn identity, when the spawn carried one — sema's teammate key
+     *  (validated at spawn: `^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`, never `main`). The same string the
+     *  child's roster row, its uplink `from` label and its `task_progress.spawnName` carry, so a hook
+     *  seat binds "which teammate" by string equality. ABSENT = an unnamed delegation (not a
+     *  teammate); {@link agentName} above stays the DISPLAY label and is never an identity key. */
+    readonly spawnName?: string;
+    /** The RESOLVED subagent type the leg was spawned as (`"general-purpose"` / `"fork"` / a roster
+     *  definition's name — the fleet row's `agentType` word, never the description). Absent on a
+     *  top-level run and on a leg whose spawner threaded no type (a workflow-lane agent). */
+    readonly agentType?: string;
     /** The spawning Agent tool call's own id, when this leg runs under one — the delegation-chain
      *  position anchor ({@link import("./types.js").TaskEvent}'s `parentToolCallId` twin). Absent on
      *  a top-level run and on a directly-started workflow child (no launching tool call — no id is
@@ -919,6 +929,11 @@ export interface ToolGateResult {
     gate?: GateOutcome;
     /** Rewritten args to execute with (re-validated by the loop); omitted when nothing rewrote. */
     updatedInput?: unknown;
+    /** A blocking refusal's structured details, when the refusing station minted any (the shell read station's
+     *  `read_path_denied` / `readonly_out_of_root` cards): the loop attaches them to the error result it mints
+     *  from `reason`, so the refusal reaches `tool_end.structured` / `errorCode` exactly as the tool's own
+     *  refusal of the same finding did. Absent on every other block. */
+    details?: unknown;
     /**
      * design/45: the gate routed a policy `ask` to a **durable suspension** (no synchronous approver).
      * `suspendAsk` already persisted the checkpoint and aborted the run; the caller records this so the
@@ -1362,6 +1377,20 @@ export interface ToolGateInput {
      * point there), a promise for a covered write. Absent ⇒ no table (`[]`) and the decision path is byte-identical.
      */
     writeProtectionCheck?: import("./write-protect.js").WriteProtectionCheck;
+    /**
+     * The shell READ STATION — ENGINE-BUILT by the hands phase (`createShellReadStation`,
+     * `src/tools/fs/shell-read-check.ts`) for the shell-running tools of this leg, never a deployment callback.
+     * Judges the FINAL args of a shell call: ONE parse of the command into its read candidates, each
+     * established against the execution environment (symlinks resolved, patterns expanded, traversal roots
+     * enumerated, within a bound) and judged by the leg's read deny seat and its containment roots. A
+     * POLICY-class member of the fold: a deny-listed read is REFUSED (`deniedBy: "read_boundary"`, composing
+     * under `deny > ask > allow`), an out-of-root or unestablishable read tightens a surviving allow to a
+     * MANDATED ask (or marks an existing ask mandated), a read the station declined to judge tightens to an
+     * ordinary ask on the classify seat and a mandated one on the off seat, and a vouched call is untouched.
+     * `null` SYNCHRONOUSLY for a call it does not cover (no suspension point there), a promise for a shell
+     * call. Absent ⇒ no station (no shell mounted) and the decision path is byte-identical.
+     */
+    shellReadCheck?: import("../tools/fs/shell-read-check.js").ShellReadCheck;
     /**
      * design/143 批2 (A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:

package/dist/core/hooks.js

@@ -167,6 +167,8 @@ export function mintHookInvocationIdentity(facts) {
         isDelegatedChild: facts.isDelegatedChild,
         ...(facts.insideFork === true ? { insideFork: true } : {}),
         ...(facts.agentName !== undefined ? { agentName: inlineUntrusted(facts.agentName.slice(0, 320), IDENTITY_AGENT_NAME_MAX) } : {}),
+        ...(facts.spawnName !== undefined ? { spawnName: inlineUntrusted(facts.spawnName.slice(0, 320), IDENTITY_AGENT_NAME_MAX) } : {}),
+        ...(facts.agentType !== undefined ? { agentType: inlineUntrusted(facts.agentType.slice(0, 320), IDENTITY_AGENT_NAME_MAX) } : {}),
         ...(facts.parentToolCallId !== undefined ? { parentToolCallId: facts.parentToolCallId } : {}),
     }));
 }

package/dist/core/mailbox-store.d.ts

@@ -25,6 +25,11 @@ export interface MailboxMessage {
 export interface MailboxPeerMeta {
     /** The sending session's id (reply routing). */
     fromSession?: string;
+    /** The delegation-tree ROOT the sender belongs to, stamped by the park seat of a session that
+     *  received the frame through its own child uplink — never by the sender. A recipient whose
+     *  session IS this root reads the record as a teammate's words (same tree = same admission as the
+     *  live uplink: the admission gate runs, the cross-session parity hold does not). */
+    fromRoot?: string;
     /** The sender's permission-mode class at send time — the drain judges parity against the RECEIVER. */
     fromMode?: MailboxPeerFromMode;
     /** The admission gate's sender key (rate/dedup axis). */

package/dist/core/mailbox-store.js

@@ -4,7 +4,7 @@ export const MAILBOX_PEER_RECORD_KINDS = ["peer_message", "idle_notice", "delive
 export const MAILBOX_PEER_NOTICE_STATES = ["held", "denied", "expired", "delivered", "refused", "dropped", "idle", "exited", "unavailable"];
 export const MAILBOX_INVALID_PEER_META_CODE = "mailbox.invalid_peer_meta";
 export const MAILBOX_CROSS_PROCESS_UNSAFE_CODE = "mailbox.cross_process_unsafe";
-const PEER_META_STRING_KEYS = ["fromSession", "senderKey", "fromScope", "gateReceiptId"];
+const PEER_META_STRING_KEYS = ["fromSession", "fromRoot", "senderKey", "fromScope", "gateReceiptId"];
 export function readMailboxPeerMeta(raw) {
     if (raw === undefined)
         return undefined;

package/dist/core/parent-spec-seat.d.ts

@@ -9,10 +9,11 @@
  * The checkpoint seat (`./checkpoint-seat.ts`) is the same shape for one field; this seat carries the rest.
  */
 import type { OnQuestion } from "./ask-question.js";
+import type { Hooks } from "./hooks.js";
 import type { ToolExecuteContext } from "./tool-spec.js";
 import type { TaskSpec } from "./types.js";
 /** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
-export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory">;
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "hooks" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory">;
 /**
  * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
  * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
@@ -22,6 +23,10 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *  · `clientContext` — the user's TZ/email facts (the child's environment block localizes the same way).
  *  · `onQuestion` — the parent's FROZEN question face (`spec.onQuestion ?? deps.onQuestion`, the value the parent's
  *    own AskUserQuestion resolves at): the child's question tool MOUNTS on it, so without it the child has no tool.
+ *  · `hooks` — the parent's SPEC-level hook seams (`spec.hooks`, the request-level lifecycle hooks a host mounts from
+ *    the user's settings). A deployment's `RunnerDeps.hooks` already serve every leg; the spec-level seams did not,
+ *    so a `stop` seat a user wired ran for the leader and never for its teammates (CC runs `SubagentStop` from the
+ *    same settings). Same law as `onQuestion`: a child's own value wins, the seat fills an unset one.
  *  · `additionalDirectories` / `additionalReadDirectories` — the fs-fence widening (deployment property).
  *  · `envFacts` — the sandbox facts (profile / egress / scratchpad).
  *  · `memoryPersistenceCapable` — the deployment's DECLARED persistence statement: `false` is a REMOVAL (floor),
@@ -34,6 +39,7 @@ export interface ParentSpecSeat {
     readonly oneShot?: true;
     readonly clientContext?: TaskSpec["clientContext"];
     readonly onQuestion?: OnQuestion;
+    readonly hooks?: Hooks;
     readonly additionalDirectories?: readonly string[];
     readonly additionalReadDirectories?: readonly string[];
     readonly envFacts?: TaskSpec["envFacts"];

package/dist/core/parent-spec-seat.js

@@ -4,6 +4,7 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.oneShot === true ? { oneShot: true } : {}),
         ...(spec.clientContext !== undefined ? { clientContext: spec.clientContext } : {}),
         ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
+        ...(spec.hooks !== undefined ? { hooks: spec.hooks } : {}),
         ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
         ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
         ...(spec.envFacts !== undefined ? { envFacts: Object.freeze({ ...spec.envFacts }) } : {}),
@@ -20,6 +21,7 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("principal", seat.principal),
         ...fill("clientContext", seat.clientContext),
         ...fill("onQuestion", seat.onQuestion),
+        ...fill("hooks", seat.hooks),
         ...fill("additionalDirectories", (seat.additionalDirectories !== undefined ? [...seat.additionalDirectories] : undefined)),
         ...fill("additionalReadDirectories", (seat.additionalReadDirectories !== undefined ? [...seat.additionalReadDirectories] : undefined)),
         ...fill("envFacts", (seat.envFacts !== undefined ? { ...seat.envFacts } : undefined)),

package/dist/core/permission-rule-consent.js

@@ -1,7 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
 import { effectiveOrThrow } from "./permission-rule-provider.js";
-import { errText, isValidConsentScope, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
+import { errText, isValidConsentScope, landRuleAdd, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
     async get(id) {
@@ -600,7 +600,6 @@ export async function redeemRuleTicket(opts) {
     }
     return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot, recordId: rec.id, kind: rec.kind, replay: known !== undefined, ...(siblingsOf !== undefined ? { siblingsOf } : {}) });
 }
-const REDEEM_MAX_ATTEMPTS = 8;
 async function tighteningSiblingsStand(rec, offer, index, store, durableSnapshot) {
     for (const member of offerMembersOf(offer)) {
         if (member === index)
@@ -630,52 +629,35 @@ async function applyRedemption(args) {
     if (writer === undefined)
         return { status: "refused", reason: "the resolved permission-rule store has no write face" };
     const origin = originOfRecordKind(args.kind);
-    for (let attempt = 0; attempt < REDEEM_MAX_ATTEMPTS; attempt++) {
-        let rev;
-        try {
-            const snapshot = await effectiveOrThrow(store);
-            rev = snapshot.rev;
-            if (args.siblingsOf !== undefined && !(await tighteningSiblingsStand(args.siblingsOf.rec, args.siblingsOf.offer, args.siblingsOf.index, store, snapshot))) {
-                return {
-                    status: "refused",
-                    reason: "withheld: this allow belongs to a batch whose deny/ask members do not all stand in the store — an allow must not stand wider than the list that was confirmed; redeem the batch (redeemRuleBatch) so the tightening members land first, or draw a fresh card",
-                };
+    const siblings = args.siblingsOf;
+    const landing = await landRuleAdd({
+        store,
+        writer,
+        delta: {
+            kind: "redemption-add",
+            behavior: args.parsedRule.behavior,
+            rule: args.parsedRule.rule,
+            scope: args.candidate.scope,
+            tool: args.parsedRule.tool,
+            match: args.parsedRule.match,
+            command: args.parsedRule.command,
+            add: { dot: args.dot, origin, createdAt: nowIso(args.deps) },
+            redemption: {
+                recordId: args.recordId,
+                ...(args.owner.kind === "principal" ? { principal: args.owner.principal } : { owner: args.owner }),
+            },
+        },
+        ...(siblings !== undefined
+            ? {
+                preflight: async (snapshot) => (await tighteningSiblingsStand(siblings.rec, siblings.offer, siblings.index, store, snapshot))
+                    ? undefined
+                    : "withheld: this allow belongs to a batch whose deny/ask members do not all stand in the store — an allow must not stand wider than the list that was confirmed; redeem the batch (redeemRuleBatch) so the tightening members land first, or draw a fresh card",
             }
-        }
-        catch (err) {
-            return { status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` };
-        }
-        let res;
-        try {
-            res = await writer.apply({
-                kind: "redemption-add",
-                behavior: args.parsedRule.behavior,
-                rule: args.parsedRule.rule,
-                scope: args.candidate.scope,
-                tool: args.parsedRule.tool,
-                match: args.parsedRule.match,
-                command: args.parsedRule.command,
-                add: { dot: args.dot, origin, createdAt: nowIso(args.deps) },
-                redemption: {
-                    recordId: args.recordId,
-                    ...(args.owner.kind === "principal" ? { principal: args.owner.principal } : { owner: args.owner }),
-                },
-            }, { expectedRev: rev });
-        }
-        catch (err) {
-            return { status: "refused", reason: `the permission-rule store refused the write: ${errText(err)}` };
-        }
-        if ("refused" in res) {
-            return {
-                status: "refused",
-                reason: "the session this authorization targets has ended — a session rule dies with its session, and a late or replayed redemption cannot revive it (re-trigger the command in a live session for a fresh card)",
-            };
-        }
-        if (!("conflict" in res)) {
-            return { status: "redeemed", behavior: args.parsedRule.behavior, rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
-        }
-    }
-    return { status: "refused", reason: `optimistic-concurrency retries exhausted after ${REDEEM_MAX_ATTEMPTS} attempts` };
+            : {}),
+    });
+    if (!landing.landed)
+        return { status: "refused", reason: landing.reason };
+    return { status: "redeemed", behavior: args.parsedRule.behavior, rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: landing.rev, alreadyRedeemed: args.replay };
 }
 function originOfRecordKind(kind) {
     return kind === "import" ? "imported-cc" : kind === "starter" ? "starter" : "user";

package/dist/core/permission-rule-provider.js

@@ -111,11 +111,12 @@ function routingWriter(durable, session) {
         nextDot: () => durable.nextDot(),
         readRaw: () => durable.readRaw(),
         apply: async (delta, opts) => {
-            const scope = delta.kind === "redemption-add" ? structuredClone(delta.scope) : undefined;
-            if (delta.kind !== "redemption-add" || scope?.kind !== "session")
+            const isAdd = delta.kind === "redemption-add" || delta.kind === "tighten-add";
+            const scope = isAdd ? structuredClone(delta.scope) : undefined;
+            if (!isAdd || scope?.kind !== "session")
                 return durable.apply(delta, opts);
             if (session === undefined) {
-                const e = new Error("a session-scope rule has nowhere to land — this deployment configured no session rule partition (createPermissionRuleStoreProvider({ session })); refusing the redemption-add");
+                const e = new Error(`a session-scope rule has nowhere to land — this deployment configured no session rule partition (createPermissionRuleStoreProvider({ session })); refusing the ${delta.kind}`);
                 e.code = "unsupported.session_scope_store";
                 throw e;
             }