@sema-agent/core 7.26.2 → 7.27.0

package/dist/core/tool-policy.js

@@ -414,11 +414,31 @@ export function createApprovalPolicy(opts) {
                 if (signal?.aborted) {
                     return attest({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)` }, settledByNobody("task_aborted"));
                 }
+                if (typeof ok === "object" && ok !== null) {
+                    const reading = readApproverOutcomeObject(ok, req.toolName, "none");
+                    if (reading.kind === "refused")
+                        return attest({ action: "deny", message: reading.message }, reading.settlement);
+                    if (reading.kind === "deny") {
+                        return attest({
+                            action: "deny",
+                            message: reading.word === "policy"
+                                ? policyRefusalMessage(req.toolName, undefined, reading.note)
+                                : reading.word === "timeout"
+                                    ? `no one answered the approval request for "${req.toolName}" — the approver reported its own window elapsed with no answer; denied fail-closed${reading.note !== undefined ? `\nReviewer note:\n${delimitUntrusted("reviewer note", reading.note, REVIEWER_NOTE_MAX_BODY)}` : ""}`
+                                    : `approval denied for "${req.toolName}"${reading.note !== undefined ? `\nReviewer note:\n${delimitUntrusted("reviewer note", reading.note, REVIEWER_NOTE_MAX_BODY)}` : ""}`,
+                        }, reading.settlement);
+                    }
+                    return attest({ action: "allow" }, reading.settlement);
+                }
                 const okRaw = ok;
                 if (okRaw === true)
                     return attest({ action: "allow" }, settledByPerson("human_allowed", undefined));
                 if (okRaw !== false) {
-                    return attest({ action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)` }, settledByNobody("approver_contract"));
+                    return attest({
+                        action: "deny",
+                        message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed ` +
+                            `(this policy's \`approve\` returns true, false, or the {allow, settledBy?, reason?, approver?} outcome object)`,
+                    }, settledByNobody("approver_contract"));
                 }
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByPerson("human_refused", undefined));
             }
@@ -1134,6 +1154,78 @@ function detachLateAskWait(wait, onLate) {
     })
         .catch(() => undefined);
 }
+function readApproverOutcomeObject(ok, toolName, editLane) {
+    const refused = (message, settlement) => ({ kind: "refused", message, settlement });
+    let supplied;
+    let allowed;
+    let suppliedEdit;
+    let suppliedApprover;
+    try {
+        supplied = ok.settledBy;
+        allowed = ok.allow;
+        suppliedEdit = ok.updatedInput;
+        suppliedApprover = ok.approver;
+    }
+    catch (err) {
+        return refused(`the approver's outcome for "${toolName}" could not be read (${describeThrown(err)}) — denied fail-closed`, settledByNobody("approver_contract"));
+    }
+    if (typeof allowed !== "boolean") {
+        return refused(`the approver for "${toolName}" returned an object whose allow is not a boolean ` +
+            `(got ${allowed === null ? "null" : typeof allowed}) — a verdict is exactly true or false; denied fail-closed`, settledByNobody("approver_contract"));
+    }
+    if (supplied !== undefined && supplied !== "human" && supplied !== "timeout" && supplied !== "policy") {
+        return refused(`the approver for "${toolName}" reported settledBy "${typeof supplied === "string" ? containThrownText(supplied) : supplied === null ? "null" : typeof supplied}", which is outside what a synchronous ` +
+            `approver may self-report — it is exactly "human", "timeout" or "policy" (or omitted); denied fail-closed`, settledByNobody("approver_contract"));
+    }
+    const settledWord = supplied === "timeout" ? "timeout" : supplied === "policy" ? "policy" : "human";
+    const attribution = screenApproverAttribution(suppliedApprover);
+    if (attribution.defect !== undefined) {
+        return refused(`the approver for "${toolName}" reported an attribution this seam refuses: ${attribution.defect}; denied fail-closed`, settledByNobody("approver_contract"));
+    }
+    if (settledWord !== "human" && allowed === true) {
+        return refused(`the approver for "${toolName}" returned an allow settled by "${settledWord}" — only a person approves, and that word ` +
+            `names a wait that ended with nobody judging: it cannot be what approved a call; denied fail-closed ` +
+            `(report "${settledWord}" with allow:false, or allow with settledBy "human"/omitted)`, settledByNobody("approver_contract"));
+    }
+    if (allowed !== true) {
+        let reasonText;
+        try {
+            const suppliedReason = ok.reason;
+            if (suppliedReason !== undefined && typeof suppliedReason !== "string") {
+                return refused(`the approver for "${toolName}" attached a reason that is not a plain string ` +
+                    `(got ${suppliedReason === null ? "null" : typeof suppliedReason}) — a deny note is the decider's plain text; denied fail-closed`, settledByNobody("approver_contract"));
+            }
+            reasonText = typeof suppliedReason === "string" ? suppliedReason : undefined;
+        }
+        catch (err) {
+            return refused(`the approver for "${toolName}" attached a reason that could not be read (${describeThrown(err)}) — denied fail-closed`, settledByNobody("approver_contract"));
+        }
+        const note = decidersNote(reasonText);
+        return {
+            kind: "deny",
+            word: settledWord,
+            note,
+            settlement: settledWord === "timeout"
+                ? { kind: "approval_window_expired", who: { party: "host" }, when: Date.now() }
+                : settledWord === "policy"
+                    ? settledByNobody("policy_refused")
+                    : settledByPerson("human_refused", attribution.approver, note),
+        };
+    }
+    if (suppliedEdit === undefined)
+        return { kind: "allow", edit: undefined, settlement: settledByPerson("human_allowed", attribution.approver) };
+    if (editLane === "none") {
+        return refused(`the approver for "${toolName}" attached an edit (updatedInput) on a seat that has no lane to adjudicate one — ` +
+            `this seat's answer is the deployment POLICY's verdict, and an edit arriving through it would execute without the ` +
+            `re-adjudication an approver's edit gets; denied fail-closed (approve or refuse what was shown, and route edits ` +
+            `through the run's approver seat)`, settledByNobody("approver_contract"));
+    }
+    const edit = tryCloneArgs(suppliedEdit);
+    if (!edit.ok) {
+        return refused(`the approved edit for "${toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`, settledByNobody("presentation_failed"));
+    }
+    return { kind: "allow", edit: { value: edit.value }, settlement: settledByPerson("human_allowed", attribution.approver) };
+}
 async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (onAsk === "allow") {
         if (req.requiresRealApproval === true) {
@@ -1229,113 +1321,24 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
         };
     }
     if (typeof ok === "object" && ok !== null) {
-        let supplied;
-        let allowed;
-        let suppliedEdit;
-        let suppliedApprover;
-        try {
-            supplied = ok.settledBy;
-            allowed = ok.allow;
-            suppliedEdit = ok.updatedInput;
-            suppliedApprover = ok.approver;
-        }
-        catch (err) {
-            return {
-                action: "deny",
-                message: `the approver's outcome for "${req.toolName}" could not be read (${describeThrown(err)}) — denied fail-closed`,
-                decisionReason: "mode",
-                settlement: settledByNobody("approver_contract"),
-            };
-        }
-        if (typeof allowed !== "boolean") {
+        const reading = readApproverOutcomeObject(ok, req.toolName, "readjudicated");
+        if (reading.kind === "refused")
+            return { action: "deny", message: reading.message, decisionReason: "mode", settlement: reading.settlement };
+        if (reading.kind === "deny") {
             return {
                 action: "deny",
-                message: `the approver for "${req.toolName}" returned an object whose allow is not a boolean ` +
-                    `(got ${allowed === null ? "null" : typeof allowed}) — a verdict is exactly true or false; denied fail-closed`,
+                message: reading.word === "timeout"
+                    ? `approval for "${req.toolName}" was not answered before the approver's own window elapsed: ${req.message}${reading.note !== undefined ? `\nReviewer note:\n${delimitUntrusted("reviewer note", reading.note, REVIEWER_NOTE_MAX_BODY)}` : ""}`
+                    : reading.word === "policy"
+                        ? policyRefusalMessage(req.toolName, req.message, reading.note)
+                        : humanRefusalMessage(req, reading.note),
                 decisionReason: "mode",
-                settlement: settledByNobody("approver_contract"),
-            };
-        }
-        if (supplied !== undefined && supplied !== "human" && supplied !== "timeout" && supplied !== "policy") {
-            return {
-                action: "deny",
-                message: `the approver for "${req.toolName}" reported settledBy "${typeof supplied === "string" ? containThrownText(supplied) : supplied === null ? "null" : typeof supplied}", which is outside what a synchronous ` +
-                    `approver may self-report — it is exactly "human", "timeout" or "policy" (or omitted); denied fail-closed`,
-                decisionReason: "mode",
-                settlement: settledByNobody("approver_contract"),
-            };
-        }
-        const settledWord = supplied === "timeout" ? "timeout" : supplied === "policy" ? "policy" : "human";
-        const attribution = screenApproverAttribution(suppliedApprover);
-        if (attribution.defect !== undefined) {
-            return {
-                action: "deny",
-                message: `the approver for "${req.toolName}" reported an attribution this seam refuses: ${attribution.defect}; denied fail-closed`,
-                decisionReason: "mode",
-                settlement: settledByNobody("approver_contract"),
-            };
-        }
-        if (settledWord !== "human" && allowed === true) {
-            return {
-                action: "deny",
-                message: `the approver for "${req.toolName}" returned an allow settled by "${settledWord}" — only a person approves, and that word ` +
-                    `names a wait that ended with nobody judging: it cannot be what approved a call; denied fail-closed ` +
-                    `(report "${settledWord}" with allow:false, or allow with settledBy "human"/omitted)`,
-                decisionReason: "mode",
-                settlement: settledByNobody("approver_contract"),
-            };
-        }
-        if (allowed !== true) {
-            let reasonText;
-            try {
-                const suppliedReason = ok.reason;
-                if (suppliedReason !== undefined && typeof suppliedReason !== "string") {
-                    return {
-                        action: "deny",
-                        message: `the approver for "${req.toolName}" attached a reason that is not a plain string ` +
-                            `(got ${suppliedReason === null ? "null" : typeof suppliedReason}) — a deny note is the decider's plain text; denied fail-closed`,
-                        decisionReason: "mode",
-                        settlement: settledByNobody("approver_contract"),
-                    };
-                }
-                reasonText = typeof suppliedReason === "string" ? suppliedReason : undefined;
-            }
-            catch (err) {
-                return {
-                    action: "deny",
-                    message: `the approver for "${req.toolName}" attached a reason that could not be read (${describeThrown(err)}) — denied fail-closed`,
-                    decisionReason: "mode",
-                    settlement: settledByNobody("approver_contract"),
-                };
-            }
-            const note = decidersNote(reasonText);
-            return {
-                action: "deny",
-                message: settledWord === "timeout"
-                    ? `approval for "${req.toolName}" was not answered before the approver's own window elapsed: ${req.message}${note !== undefined ? `\nReviewer note:\n${delimitUntrusted("reviewer note", note, REVIEWER_NOTE_MAX_BODY)}` : ""}`
-                    : settledWord === "policy"
-                        ? policyRefusalMessage(req.toolName, req.message, note)
-                        : humanRefusalMessage(req, note),
-                decisionReason: "mode",
-                settlement: settledWord === "timeout"
-                    ? { kind: "approval_window_expired", who: { party: "host" }, when: Date.now() }
-                    : settledWord === "policy"
-                        ? settledByNobody("policy_refused")
-                        : settledByPerson("human_refused", attribution.approver, note),
-            };
-        }
-        if (suppliedEdit === undefined)
-            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settlement: settledByPerson("human_allowed", attribution.approver) };
-        const edit = tryCloneArgs(suppliedEdit);
-        if (!edit.ok) {
-            return {
-                action: "deny",
-                message: `the approved edit for "${req.toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`,
-                decisionReason: "mode",
-                settlement: settledByNobody("presentation_failed"),
+                settlement: reading.settlement,
             };
         }
-        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settlement: settledByPerson("human_allowed", attribution.approver) };
+        if (reading.edit === undefined)
+            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settlement: reading.settlement };
+        return { action: "allow", updatedInput: reading.edit.value, decisionReason: "mode", settlement: reading.settlement };
     }
     const okRaw = ok;
     if (okRaw === true)

package/dist/index.d.ts

@@ -177,7 +177,12 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, 
+/** The return type of `createApprovalPolicy.approve` — a boolean, or the `AskOutcome` object minus the two
+ *  members that seat has no lane for (`"unavailable"`, a routing answer; `updatedInput`, an operator edit a
+ *  policy verdict cannot get re-adjudicated). Exported so a host can NAME it instead of deriving it through
+ *  `Parameters<typeof createApprovalPolicy>[0]["approve"]`. */
+type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL, RULE_STORE_UNREADABLE_KINDS, type RuleStoreUnreadable, isRuleStoreUnreadable } from "./core/ask-origin.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";

package/dist/stores/file/background-agent-store.d.ts

@@ -1,5 +1,9 @@
 import { type BackgroundAgentReapOptions, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentStore, type BackgroundAgentUpdateIfExpect } from "../../core/background-agent-store.js";
+import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 export interface FileBackgroundAgentStoreOptions {
+    /** This store's half of {@link import("./shared-ledger.js").LedgerPaths.onCorruptRead} — the same seat,
+     *  over the agent row model. */
+    onCorruptRead?: (info: CorruptReadInfo) => void;
     /** When false, a ledger append is NOT fsync'd. Default true. */
     fsync?: boolean;
     /** Compact the ledger into a snapshot once it exceeds this many events (then truncate). Default 1000. */

package/dist/stores/file/background-agent-store.js

@@ -1,7 +1,9 @@
 import { join } from "node:path";
 import { BackgroundAgentStoreError, STALE_RUNNING_REAP_ATTRIBUTION, assertBackgroundAgentReapOptions, queryBackgroundAgents, } from "../../core/background-agent-store.js";
 import { SharedLedgerTable } from "./shared-ledger.js";
+import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
+const isAgentRow = (x) => x !== null && typeof x === "object" && typeof x.handle === "string" && typeof x.scope === "string";
 const agentLedgers = new SharedLedgerTable({
     label: "background-agent ledger",
     keyOf: (r) => FileBackgroundAgentStore.key(r.handle, r.scope),
@@ -12,6 +14,13 @@ const agentLedgers = new SharedLedgerTable({
         }
         rows.set(ev.k, ev.r);
     },
+    judgeRow: isAgentRow,
+    judgeEvent: (x) => {
+        const ev = x;
+        if (typeof ev.k !== "string")
+            return false;
+        return ev.t === "delete" ? true : isAgentRow(ev.r);
+    },
 });
 export class FileBackgroundAgentStore {
     fsyncEnabled;
@@ -29,6 +38,7 @@ export class FileBackgroundAgentStore {
         this.ledger = agentLedgers.acquire({
             dir,
             tmpDir: join(root, "tmp"),
+            ...(opts.onCorruptRead !== undefined ? { onCorruptRead: guardCorruptSink(opts.onCorruptRead) } : {}),
             ledgerPath: join(dir, "agents.jsonl"),
             snapshotPath: join(dir, "agents.snapshot.jsonl"),
         });

package/dist/stores/file/checkpoint-store.d.ts

@@ -1,7 +1,10 @@
 import { type ExecutionOutcomeRecordWord } from "../../core/checkpoint-execution-record.js";
 import { type Checkpoint, type PendingSteerInput, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
 import type { GateOutcome } from "../../core/gate-outcome.js";
+import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 export interface FileCheckpointStoreOptions {
+    /** This store's half of {@link import("./shared-ledger.js").LedgerPaths.onCorruptRead}. */
+    onCorruptRead?: (info: CorruptReadInfo) => void;
     /** When false, an `appendLine` for a state transition is NOT fsync'd. The checkpoint COMMIT POINT always
      *  fsyncs regardless (its crash-safety depends on it); this governs the `put` and `setPendingSteer`
      *  (steer-append) commits only — `resolve`/`reopen`/`expire` fsync unconditionally. Default true. */

package/dist/stores/file/checkpoint-store.js

@@ -3,6 +3,7 @@ import { assertAdoptionBootGate } from "./adoption/marker.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "../../core/checkpoint-execution-record.js";
 import { appendPendingSteer, CheckpointError, checkpointOccMatches, checkpointRowMatches, summarizeCheckpoint, validatePendingSteer, winnerFromOutcome, } from "../../core/checkpoint-store.js";
 import { SharedLedgerTable } from "./shared-ledger.js";
+import { guardCorruptSink } from "./corrupt-read-sink.js";
 const CHECKPOINT_LEDGER_EVENT_REGISTRY = {
     put: true,
     resolve: true,
@@ -57,10 +58,26 @@ function applyCheckpointEvent(cps, ev) {
         }
     }
 }
+const isCheckpointRow = (x) => x !== null &&
+    typeof x === "object" &&
+    typeof x.token === "string" &&
+    typeof x.scope === "string" &&
+    typeof x.status === "string";
 const checkpointLedgers = new SharedLedgerTable({
     label: "checkpoint ledger",
     keyOf: (cp) => cp.token,
     apply: applyCheckpointEvent,
+    judgeRow: isCheckpointRow,
+    judgeEvent: (x) => {
+        const ev = x;
+        if (typeof ev.t !== "string")
+            return false;
+        if (!KNOWN_CHECKPOINT_LEDGER_EVENTS.has(ev.t))
+            return true;
+        if (typeof ev.token !== "string")
+            return false;
+        return ev.t === "put" ? isCheckpointRow(ev.cp) : true;
+    },
 });
 export class FileCheckpointStore {
     durability = "durable";
@@ -83,6 +100,7 @@ export class FileCheckpointStore {
         this.ledger = checkpointLedgers.acquire({
             dir,
             tmpDir: join(root, "tmp"),
+            ...(opts.onCorruptRead !== undefined ? { onCorruptRead: guardCorruptSink(opts.onCorruptRead) } : {}),
             ledgerPath: join(dir, "checkpoints.jsonl"),
             snapshotPath: join(dir, "checkpoints.snapshot.jsonl"),
         });

package/dist/stores/file/corrupt-read-sink.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The file backend's ONE disclosure-seat guard: `@contract store.read_back_shape_judged`'s second legal
+ * posture — an absence that DISCLOSES — rides a host's `onCorruptRead`, and the guard around it was
+ * hand-written four times. Three copies contained an async sink's rejection; the mailbox's caught only a
+ * synchronous throw, so an `async` sink there became an unhandled rejection.
+ */
+/** Coordinates of one durable read a store answered as absent because the bytes were corrupt. */
+export interface CorruptReadInfo {
+    path: string;
+    reason: string;
+}
+/**
+ * Wrap a host's disclosure seat: neither a synchronous throw nor an async rejection can re-introduce the
+ * fault the fail-open avoids. `undefined` in ⇒ `undefined` out. Generic in the payload because the
+ * session-policy store discloses session coordinates rather than a path.
+ */
+/** The sink is invoked UNBOUND (`this` is undefined): pass a bound function or an arrow, never a bare
+ *  method reference — a method reading `this` throws, and the throw is contained here, so the disclosure
+ *  is silently lost rather than surfaced. */
+export declare function guardCorruptSink<I>(sink: ((info: I) => void) | undefined): ((info: I) => void) | undefined;

package/dist/stores/file/corrupt-read-sink.js

@@ -0,0 +1,15 @@
+export function guardCorruptSink(sink) {
+    if (sink === undefined)
+        return undefined;
+    return (info) => {
+        try {
+            const returned = sink(info);
+            if (typeof returned?.then === "function") {
+                void Promise.resolve(returned).then(undefined, () => {
+                });
+            }
+        }
+        catch {
+        }
+    };
+}

package/dist/stores/file/file-history-store.d.ts

@@ -233,8 +233,7 @@ export declare class FileFileHistoryStore implements FileHistoryStore {
      * GC that could not run leaves a graph larger than its bound, the safer of the two directions).
      */
     private applyBoundaryRetention;
-    /** The single delivery point for the disclosure sink; swallow-guarded here so no call site has to
-     *  remember, and so a host's throwing sink cannot break the never-throw seam. */
+    /** The single delivery point for the disclosure sink. */
     private disclose;
     private scopeDir;
     private trackedPath;

package/dist/stores/file/file-history-store.js

@@ -5,6 +5,7 @@ import { thrownText } from "../../core/thrown-value.js";
 import { applyFileRestoreViaEnv, boundaryPublishVerdict, worldStillMatchesMint, captureFileBackupViaEnv, modeProvenDifferent, previewFileDelta, describeTrackKey, fileHistoryExportDigest, resolveTrackKey, trackKeyOf, validateFileHistoryExport, } from "../../core/file-history-store.js";
 import { fileHistoryBoundariesToKeep, resolveFileHistoryRetention } from "../../core/file-history-retention.js";
 import { atomicWriteFile, ensureDir, sanitizePathComponent, sanitizeScope, writeThenLink } from "./fs-atomic.js";
+import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { isAbsoluteForFamily } from "../../tools/fs/safety.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 function trackedDigest(rows) {
@@ -156,7 +157,7 @@ export class FileFileHistoryStore {
         this.scopesDir = join(this.base, "scopes");
         ensureDir(this.blobsDir);
         ensureDir(this.scopesDir);
-        this.onCorruptRead = opts?.onCorruptRead;
+        this.onCorruptRead = guardCorruptSink(opts?.onCorruptRead);
     }
     applyBoundaryRetention(scope, justCommitted) {
         if (this.boundaryKeep === null)
@@ -194,13 +195,7 @@ export class FileFileHistoryStore {
         }
     }
     disclose(path, reason) {
-        try {
-            const r = this.onCorruptRead?.({ path, reason });
-            if (typeof r?.then === "function")
-                r.then(undefined, () => { });
-        }
-        catch {
-        }
+        this.onCorruptRead?.({ path, reason });
     }
     scopeDir(scope) {
         return join(this.scopesDir, sanitizeScope(scope));

package/dist/stores/file/fs-atomic.d.ts

@@ -40,11 +40,16 @@ export declare function atomicWriteFile(tmpDir: string, target: string, bytes: s
  *    parity), so a single corrupt interior line never poisons the whole replay.
  * A missing file → `[]`. This is why JSONL beats one big JSON blob: a torn tail can never corrupt the store.
  *
+ * SHAPE (`@contract store.read_back_shape_judged`): parseability is not the judgement. Every store on this
+ * format writes ONE JSON OBJECT per line, so a line parsing to a number, string, boolean, `null` or array
+ * takes the road a torn line takes — disclosed, skipped, the replay intact — because it is the same fact:
+ * these bytes are not what this store wrote. Without it `null` made a `line.kind` test throw.
+ *
  * `onCorrupt` (optional, review-510 disclosure-seat family): fired once per skipped INTERIOR record so a
  * caller-side seat can observe real corruption — a silently-skipped record is otherwise indistinguishable
- * from "less data". The torn TAIL stays out of it by design: dying mid-write is the documented crash
- * shape this format exists to absorb, not corruption. The callback is invoked as given — a seat that
- * must not throw swallow-guards on ITS side (the stores do).
+ * from "less data"; its `reason` opens with the {@link CorruptBodyForm} word, so a sink classifies without
+ * reading prose. The torn TAIL stays out by design: dying mid-write is the crash shape this format exists
+ * to absorb. The callback is invoked as given — a seat that must not throw swallow-guards on ITS side.
  */
 export declare function readJsonlRecords<T>(path: string, onCorrupt?: (info: {
     path: string;

package/dist/stores/file/fs-atomic.js

@@ -126,15 +126,32 @@ export function readJsonlRecords(path, onCorrupt) {
         const line = parts[i];
         if (line === "")
             continue;
+        let record;
         try {
-            out.push(JSON.parse(line));
+            record = JSON.parse(line);
         }
         catch {
-            onCorrupt?.({ path, reason: `unparseable jsonl record at line ${i + 1} (skipped; the rest of the replay is intact)` });
+            onCorrupt?.({ path, reason: corruptRecordReason("torn-json", i + 1, "unparseable jsonl record") });
+            continue;
+        }
+        if (record === null || typeof record !== "object" || Array.isArray(record)) {
+            onCorrupt?.({ path, reason: corruptRecordReason("not-an-object", i + 1, `jsonl record is ${jsonTypeName(record)}, not an object`) });
+            continue;
         }
+        out.push(record);
     }
     return out;
 }
+function corruptRecordReason(form, lineNo, what) {
+    return `${form}: ${what} at line ${lineNo} (skipped; the rest of the replay is intact)`;
+}
+function jsonTypeName(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "an array";
+    return `a ${typeof value}`;
+}
 export function canonicalStoreKey(p) {
     return physicalPathOfExisting(p).toLowerCase();
 }

package/dist/stores/file/index.js

@@ -65,19 +65,19 @@ export class FileStorageBackend {
             this.fileSessions = repo;
             this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget", durability: "durable", placements: { subagent: { durability: "durable" } } });
             this.sessionStore = this.ttl;
-            this.fileCheckpoints = new FileCheckpointStore(this.root, opts.checkpoint);
+            this.fileCheckpoints = new FileCheckpointStore(this.root, { ...opts.checkpoint, ...corruptRead });
             built.push(() => this.fileCheckpoints.close());
             this.checkpointStore = this.fileCheckpoints;
             this.fileMemory = new FileMemoryStore(this.root, opts.embedder ? { embedder: opts.embedder } : {});
             built.push(() => this.fileMemory.close());
             this.memoryStore = guardedMemoryStore(this.fileMemory, opts.utilityGate);
-            this.toolResultStore = new FileToolResultStore(this.root);
+            this.toolResultStore = new FileToolResultStore(this.root, corruptRead);
             this.sessionPolicyStore = new FileSessionPolicyStore(this.root, corruptRead);
-            this.fileWorkflowJournal = new FileWorkflowJournalStore(this.root);
+            this.fileWorkflowJournal = new FileWorkflowJournalStore(this.root, true, corruptRead);
             built.push(() => this.fileWorkflowJournal.dispose());
             this.workflowJournalStore = this.fileWorkflowJournal;
             this.usageWindowStore = new FileUsageWindowStore(this.root);
-            this.fileAgentRows = new FileBackgroundAgentStore(this.root);
+            this.fileAgentRows = new FileBackgroundAgentStore(this.root, corruptRead ?? {});
             built.push(() => this.fileAgentRows.close());
             this.backgroundAgentStore = this.fileAgentRows;
             this.fileMailbox = new FileMailboxStore(this.root, corruptRead ?? {});

package/dist/stores/file/mailbox-store.d.ts

@@ -105,6 +105,9 @@ export declare class FileMailboxStore implements MailboxStore {
      * and the cache is replayed from the file. A moved INODE also swap-closes the descriptor (ring 3):
      * the next write reopens the current file instead of landing on the unlinked one.
      */
+    /** Fold ONE replayed event, disclosing a record that is not one of this box's ({@link applyEvent}
+     *  answers `false`): dropped silently it reads exactly like a shorter mailbox. */
+    private applyReplayed;
     private reconcile;
     private load;
     private commit;