@sema-agent/core 7.26.3 → 7.28.0

package/dist/stores/file/tool-result-store.js

@@ -3,12 +3,15 @@ import { readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance, ToolResultRefConflictError, } from "../../core/tool-result-store.js";
 import { ensureDir, sanitizePathComponent, writeThenLink } from "./fs-atomic.js";
+import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 export class FileToolResultStore {
     dir;
-    constructor(root) {
+    discloseCorrupt;
+    constructor(root, opts) {
         assertAdoptionBootGate(root, "FileToolResultStore");
         this.dir = join(root, "tool-results");
+        this.discloseCorrupt = guardCorruptSink(opts?.onCorruptRead);
         ensureDir(this.dir);
     }
     locate(ref) {
@@ -59,15 +62,26 @@ export class FileToolResultStore {
         return this.readOwnerFile(ref, { loud: false });
     }
     readOwnerFile(ref, opts) {
+        const ownerPath = (() => {
+            try {
+                return this.ownerPathFor(ref);
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        if (ownerPath === undefined)
+            return undefined;
         let raw;
         try {
-            raw = readFileSync(this.ownerPathFor(ref), "utf8");
+            raw = readFileSync(ownerPath, "utf8");
         }
         catch (err) {
             if (err.code === "ENOENT")
                 return undefined;
             if (opts.loud)
                 throw err;
+            this.discloseCorrupt?.({ path: ownerPath, reason: `unreadable owner sidecar (${err.code ?? "unknown"}) — read as unowned` });
             return undefined;
         }
         const parsed = parseOwnerRecord(raw);
@@ -76,6 +90,7 @@ export class FileToolResultStore {
         if (opts.loud) {
             throw new Error(`tool-result store: owner record for ref ${JSON.stringify(ref)} is present but unreadable — refusing to write over it`);
         }
+        this.discloseCorrupt?.({ path: ownerPath, reason: "not-an-object: owner sidecar is present but is not an owner record — read as unowned" });
         return undefined;
     }
     writeOwnerFile(ref, provenance) {

package/dist/stores/file/workflow-journal-store.d.ts

@@ -1,4 +1,5 @@
 import { type WorkflowJournalEntry, type WorkflowJournalStore, type ResumeClaimArgs } from "../../core/workflow-journal-store.js";
+import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 /**
  * SVC-2 — the shared size bound for a journaled workflow-agent entry, so ALL backends answer an oversize
  * TaskResult with the SAME refusal (no dialect divergence). Inlined from service's `workflow-journal-limits` on
@@ -46,6 +47,12 @@ export declare const RESUME_CLAIM_SWEEP_INTERVAL_MS = 60000;
  * stays well clear of that handover rather than adding a second unlinker to it.
  */
 export declare const RESUME_CLAIM_REAP_GRACE_MS: number;
+export interface FileWorkflowJournalStoreOptions {
+    /** Disclosure seat for a ledger line this store DROPPED on replay (not JSON, not a record, or a record
+     *  with none of this ledger's members) — a resume that silently finds "nothing to replay" re-runs the
+     *  work with no signal. Never fires on a missing ledger; swallow-guarded. */
+    onCorruptRead?: (info: CorruptReadInfo) => void;
+}
 export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
     private readonly fsyncEnabled;
     private readonly dir;
@@ -65,7 +72,9 @@ export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
      *  ledger per append (a journaled result can be MBs; a many-agent workflow would go O(n²) on disk). One replay
      *  discovers it; every later append compares against the cache. */
     private get scopes();
-    constructor(root: string, fsyncEnabled?: boolean);
+    /** The swallow-guarded corrupt-read seat (undefined = the old silent tolerance). */
+    private readonly discloseCorrupt;
+    constructor(root: string, fsyncEnabled?: boolean, opts?: FileWorkflowJournalStoreOptions);
     private pathFor;
     /** CC local form: the run's on-disk journal path for the notification diagnostics line.
      *  Traversal-shaped ids (LLM-controlled on some paths) degrade to undefined, never throw. */

package/dist/stores/file/workflow-journal-store.js

@@ -2,7 +2,8 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { callKeyOrdinal } from "../../core/workflow-journal-store.js";
-import { AppendLog } from "./fs-atomic.js";
+import { AppendLog, readJsonlRecords } from "./fs-atomic.js";
+import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { canonicalStoreKey, sanitizePathComponent, writeThenLink } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 import { assertJournalEntryFits } from "../../core/workflow-journal-store.js";
@@ -32,8 +33,10 @@ export class FileWorkflowJournalStore {
     get scopes() {
         return this.shared.scopes;
     }
-    constructor(root, fsyncEnabled = true) {
+    discloseCorrupt;
+    constructor(root, fsyncEnabled = true, opts) {
         this.fsyncEnabled = fsyncEnabled;
+        this.discloseCorrupt = guardCorruptSink(opts?.onCorruptRead);
         assertAdoptionBootGate(root, "FileWorkflowJournalStore");
         this.dir = join(root, "workflow-journal");
         mkdirSync(this.dir, { recursive: true, mode: 0o700 });
@@ -72,18 +75,11 @@ export class FileWorkflowJournalStore {
             return undefined;
         let scope;
         const byOrdinal = new Map();
-        for (const line of readFileSync(path, "utf8").split("\n")) {
-            if (!line.trim())
+        for (const rec of readJsonlRecords(path, this.discloseCorrupt)) {
+            if (typeof rec.callKey !== "string" || typeof rec.scope !== "string" || !Number.isFinite(rec.ordinal)) {
+                this.discloseCorrupt?.({ path, reason: "missing-required: a journal line carries no callKey/scope pair (skipped; the rest of the replay is intact)" });
                 continue;
-            let rec;
-            try {
-                rec = JSON.parse(line);
             }
-            catch {
-                continue;
-            }
-            if (typeof rec.callKey !== "string" || typeof rec.scope !== "string")
-                continue;
             scope = scope ?? rec.scope;
             if (rec.scope !== scope)
                 continue;

package/dist/stores/file/workflow-run-store.d.ts

@@ -1,10 +1,13 @@
 import { type WorkflowRunListByScopeOptions, type WorkflowRunStore, type WorkflowRunSummary } from "../../core/workflow-run-store.js";
 import type { WorkflowRun } from "../../orchestration/workflow.js";
+import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 export interface FileWorkflowRunStoreOptions {
     /** When false, a ledger append is NOT fsync'd (the observability store is non-engine-critical). Default true. */
     fsync?: boolean;
     /** Compact the ledger into a snapshot once it exceeds this many events (then truncate). Default 1000. */
     compactEvery?: number;
+    /** The observability ledger's seat; see {@link import("./shared-ledger.js").LedgerPaths.onCorruptRead}. */
+    onCorruptRead?: (info: CorruptReadInfo) => void;
 }
 export declare class FileWorkflowRunStore implements WorkflowRunStore {
     private readonly fsyncEnabled;

package/dist/stores/file/workflow-run-store.js

@@ -2,7 +2,9 @@ import { join } from "node:path";
 import { assertRetentionPolicy } from "../../core/retention-policy.js";
 import { WorkflowRunStoreError, isTerminalWorkflowStatus, nextWorkflowRunOnUpdate, queryWorkflowRuns, } from "../../core/workflow-run-store.js";
 import { SharedLedgerTable } from "./shared-ledger.js";
+import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
+const isRunRow = (x) => x !== null && typeof x === "object" && typeof x.id === "string";
 const runLedgers = new SharedLedgerTable({
     label: "workflow-run ledger",
     keyOf: (run) => run.id,
@@ -13,6 +15,13 @@ const runLedgers = new SharedLedgerTable({
         }
         runs.set(ev.id, ev.run);
     },
+    judgeRow: isRunRow,
+    judgeEvent: (x) => {
+        const ev = x;
+        if (typeof ev.id !== "string")
+            return false;
+        return ev.t === "delete" ? true : isRunRow(ev.run);
+    },
 });
 export class FileWorkflowRunStore {
     fsyncEnabled;
@@ -30,6 +39,7 @@ export class FileWorkflowRunStore {
         this.ledger = runLedgers.acquire({
             dir,
             tmpDir: join(root, "tmp"),
+            ...(opts.onCorruptRead !== undefined ? { onCorruptRead: guardCorruptSink(opts.onCorruptRead) } : {}),
             ledgerPath: join(dir, "runs.jsonl"),
             snapshotPath: join(dir, "runs.snapshot.jsonl"),
         });

package/dist/tools/artifact/local-stub.js

@@ -1,7 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
-import {} from "../../core/artifact-host.js";
+import { ARTIFACT_HOST_FAILURE_CODES, } from "../../core/artifact-host.js";
 import { physicalPathOf } from "../../core/physical-path.js";
 import { acquireStoreDirLock } from "../../stores/file/fs-atomic.js";
 import { normalizePublishedPath } from "./artifact-tool.js";
@@ -25,6 +25,18 @@ const isRow = (x, key) => {
         return false;
     return r.files.every((f) => f !== null && typeof f === "object" && typeof f.path === "string" && normalizePublishedPath(f.path).ok && Number.isSafeInteger(f.bytes));
 };
+const isAttempt = (x) => {
+    if (x === null || typeof x !== "object" || Array.isArray(x))
+        return false;
+    const a = x;
+    if ("ref" in a) {
+        const r = a.ref;
+        return r !== null && typeof r === "object" && typeof r.url === "string" && typeof r.slug === "string" && typeof r.version === "string";
+    }
+    if (typeof a.code !== "string" || !ARTIFACT_HOST_FAILURE_CODES.includes(a.code))
+        return false;
+    return a.code === "conflict" ? typeof a.slug === "string" && typeof a.currentVersion === "string" : typeof a.message === "string";
+};
 function parseLedger(text, path) {
     let parsed;
     try {
@@ -40,6 +52,9 @@ function parseLedger(text, path) {
     for (const [key, row] of Object.entries(l.artifacts))
         if (!isRow(row, key))
             throw new Error(`artifact stub ledger is corrupt (bad artifact row): ${path}`);
+    for (const attempt of Object.values(l.attempts))
+        if (!isAttempt(attempt))
+            throw new Error(`artifact stub ledger is corrupt (bad attempt record): ${path}`);
     return { v: 1, artifacts: { ...l.artifacts }, attempts: { ...l.attempts } };
 }
 function fsyncDirBestEffort(dir) {

package/dist/tools/fs/bash-program-position.d.ts

@@ -8,7 +8,7 @@
  * readable, minted into one sentence by {@link programPositionRefusalSentence}. Reading less than this reader
  * does (an option skipped, a chain member missed) is how one face used to vouch for a program another refused.
  */
-import type { SegmentTokens } from "./bash-lexer.js";
+import { SHELL_CONTROL_PREFIXES, type SegmentTokens } from "../../shell/lex.js";
 /** The verdict every unresolvable / out-of-root / unbounded finding ends on. The findings differ in what
  *  they found; the consequence is one consequence, and a copy that drifts reads as a second rule. */
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
@@ -35,9 +35,7 @@ export declare function writtenAssignmentPrefix(token: string): {
     readonly appends: boolean;
     readonly settlesWholeName: boolean;
 } | undefined;
-/** Shell control words that stand BEFORE a command: transparent for the boundary walk (the command behind them is
- *  judged). */
-export declare const SHELL_CONTROL_PREFIXES: ReadonlySet<string>;
+export { SHELL_CONTROL_PREFIXES };
 /** Shell block words that name no command of their own (a loop head, a block close, a case head). */
 export declare const SHELL_BLOCK_WORDS: ReadonlySet<string>;
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program

package/dist/tools/fs/bash-program-position.js

@@ -1,3 +1,4 @@
+import { SHELL_CONTROL_PREFIXES } from "../../shell/lex.js";
 export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
@@ -12,7 +13,7 @@ export function writtenAssignmentPrefix(token) {
     const bracket = written.indexOf("[");
     return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
 }
-export const SHELL_CONTROL_PREFIXES = new Set(["!", "if", "then", "elif", "else", "while", "until", "do", "time"]);
+export { SHELL_CONTROL_PREFIXES };
 export const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
 export function isBareControlWord(toks, i, words) {
     const word = toks.folded[i];

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -1,4 +1,4 @@
-import { type SegmentTokens, type ShellSegmentConnector } from "./bash-lexer.js";
+import { type SegmentTokens, type ShellSegmentConnector } from "../../shell/lex.js";
 /**
  * Bare command names `bash_readonly` permits out of the box, ALSO the default reversible set for the
  * The {@link import("./fs-bash.js").bashReversibilityProbe} classifier. **Coarse first filter, NOT a security
@@ -31,7 +31,7 @@ import { type SegmentTokens, type ShellSegmentConnector } from "./bash-lexer.js"
  * value-taking options defeat the stdin-floor operand count without a per-verb option-value model
  * — those are a follow-on slice, not a silent drop.
  */
-export type { ShellSegmentConnector } from "./bash-lexer.js";
+export type { ShellSegmentConnector } from "../../shell/lex.js";
 export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
 /**
  * The verbs the CLASSIFY face admits ON TOP of the shared list ({@link bashClassifyDefaultAllow}) —

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,5 +1,5 @@
 import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf } from "./safety.js";
-import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "./bash-lexer.js";
+import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "../../shell/lex.js";
 import { COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, ASSIGNMENT_PREFIX, readProgramPosition, writtenAssignmentPrefix, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,7 @@ import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { allFindings, decideShellRead, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { normalizeReadRootCandidate } from "../../core/read-root-candidate.js";
-import { wordsOf, lexShellText } from "./bash-lexer.js";
+import { wordsOf, lexShellText } from "../../shell/lex.js";
 function containmentDetails(paths) {
     return { type: "readonly_out_of_root", code: "readonly_out_of_root", paths };
 }

package/dist/tools/fs/shell-read-establish.js

@@ -98,7 +98,17 @@ function lexicalReadsOf(candidate, boundary) {
     }
     const bases = basesFor(candidate, boundary);
     if (bases === "unmodelled") {
-        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is relative to a working directory this command's text does not settle` }];
+        const floors = candidate.floorBases ?? [boundary.cwd ?? boundary.roots[0] ?? ""];
+        const spellings = [candidate.spelled];
+        for (const floorBase of floors) {
+            const viaFloor = floorBase === "" ? undefined : resolveOperandSpellings(floorBase, candidate.spelled, boundary.homeDir);
+            if (viaFloor === undefined)
+                continue;
+            spellings.push(viaFloor.folded);
+            if (viaFloor.spelled !== undefined)
+                spellings.push(viaFloor.spelled);
+        }
+        return [{ candidate, established: "unestablishable", spellings, cause: `"${candidate.raw}" is relative to a working directory this command's text does not settle` }];
     }
     const out = [];
     const seen = new Set();

package/dist/tools/fs/shell-read-plan.d.ts

@@ -4,7 +4,7 @@
  * The read boundary today re-derives "which words may be read" at several sites (the compound walk, the
  * containment-only gate, the refused-command whitelist, the execute-time recheck), each with its own idea
  * of launchers, option slots, redirections and re-entry. This module is the single extraction those sites
- * are to consume: a pure, zero-I/O function over the lenient lexer (`bash-lexer.ts`) and the program-position
+ * are to consume: a pure, zero-I/O function over the lenient lexer (`src/shell/lex.ts`) and the program-position
  * reader (`bash-program-position.ts`), returning every path word a command MAY read, each tagged with its
  * PROVENANCE (why it is a candidate) and the working-directory candidates it is relative to. Establishment
  * (`shell-read-establish.ts`) and judgment are downstream; nothing here decides allow/ask/deny.
@@ -26,7 +26,7 @@
  *    otherwise loses the base for what follows.
  * Every ambiguity resolves toward MORE candidates, never fewer.
  */
-import { type LenientConnector, type LexedRedirect, type LexedWord } from "./bash-lexer.js";
+import { type LenientConnector, type LexedRedirect, type LexedWord } from "../../shell/lex.js";
 import { type ShellScanDecline } from "./bash-program-position.js";
 /** WHY a word is a read candidate — a closed set, registered in `docs/CLOSED-SETS.md`. */
 export declare const READ_CANDIDATE_PROVENANCES: readonly ["operand", "option_value", "stdin_redirect", "write_redirect_target", "env_assignment", "unlisted_word", "traversal_root", "cd_target", "program_path", "script_slot_file"];
@@ -55,6 +55,11 @@ export interface ReadCandidate {
      *  EMPTY for an absolute or home-rooted spelling; `"unmodelled"` for a relative word in a segment whose base the
      *  text does not settle (an unfollowable move before it, a loop this parser cannot count) — it cannot be placed. */
     readonly bases: readonly string[] | "unmodelled";
+    /** Only beside `bases: "unmodelled"`: the working directories the text was certainly standing in when it LOST
+     *  track (the reachable candidate set at the unprovable move; the declared cwd when nothing had moved yet).
+     *  A deny row is a floor, so the judge resolves the spelling against these for deny rows ONLY — never to
+     *  establish a read. `cd sub && cd $'\x2e' && cat <deny row under sub>` (bash: `cd .`) is refused through it. */
+    readonly floorBases?: readonly string[];
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {

package/dist/tools/fs/shell-read-plan.js

@@ -1,4 +1,4 @@
-import { lexShellText, substitutionsInHeredocBody, wordsOf, literalTildeSpelling, SUBSTITUTION_PLACEHOLDER, } from "./bash-lexer.js";
+import { lexShell, PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, UNRESOLVED_VIEW, substitutionsInHeredocBody, wordsOf, literalTildeSpelling, SUBSTITUTION_PLACEHOLDER, } from "../../shell/lex.js";
 import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, writtenAssignmentPrefix, } from "./bash-program-position.js";
 import { ASSIGNMENT_VALUE_NOT_PATHS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, assignmentWordPayload, attachedOptionPayloads, foldHomeVariableSpelling, resolveOperandLexically, hasUnquotedExpansionMetachar, hasUnquotedGlobMetachar, inlineProgramClause, interpreterKey, isPathShapedToken, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
 import { isAbsolutePathForm } from "./safety.js";
@@ -16,14 +16,25 @@ export const READ_CANDIDATE_PROVENANCES = [
 ];
 const NESTING_MAX = 4;
 const BASE_CANDIDATE_MAX = 256;
+function firstRefusedUnresolvedSentence(lexed) {
+    for (const segment of lexed.segments) {
+        for (const token of segment.tokens) {
+            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
+            if (word?.unresolved !== undefined && UNRESOLVED_VIEW[word.unresolved] === "refuse")
+                return UNRESOLVED_SENTENCE[word.unresolved];
+        }
+    }
+    return undefined;
+}
 export function planShellReads(command, decl, depth = 0) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
     if (depth > NESTING_MAX)
         return { segments: [], unreadable: `command text nested more than ${NESTING_MAX} levels deep`, shape };
     const homeReassigned = /(^|[\s;&|(){}`])(?:export\s+)?HOME\+?=/.test(command);
-    const lexed = lexShellText(foldHomeVariableSpelling(command, homeReassigned ? undefined : decl.homeDir), { mode: "lenient" });
-    if ("reject" in lexed)
-        return { segments: [], unreadable: lexed.reject, shape };
+    const lexed = lexShell(foldHomeVariableSpelling(command, homeReassigned ? undefined : decl.homeDir), { mode: "lenient" });
+    if ("parseFailure" in lexed)
+        return { segments: [], unreadable: PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason], shape };
+    const unreadable = firstRefusedUnresolvedSentence(lexed);
     const nestedPlan = (text) => planShellReads(text, decl, depth + 1);
     const projected = lexed.segments.map((segment) => projectSegment(segment));
     const facts = projected.map((p, si) => segmentFacts(lexed.segments[si], p, decl, nestedPlan));
@@ -34,6 +45,11 @@ export function planShellReads(command, decl, depth = 0) {
     const unmodelled = facts.map(() => false);
     let candidates = [{ base: decl.cwd, skippedCd: -1 }];
     let baseLost = false;
+    let floorBases;
+    const loseBase = (reachable) => {
+        baseLost = true;
+        floorBases ??= [...new Set(reachable.map((c) => c.base))];
+    };
     let andRunStart = 0;
     let crossedAllAnd = true;
     let crossedAnyOr = false;
@@ -68,7 +84,7 @@ export function planShellReads(command, decl, depth = 0) {
         if (move === undefined || baseLost)
             return;
         if (typeof move.target === "string" || move.target.expands !== false) {
-            baseLost = true;
+            loseBase(reachable);
             return;
         }
         const target = move.target.spelled;
@@ -78,7 +94,7 @@ export function planShellReads(command, decl, depth = 0) {
             if (c.skippedCd < andRunStart) {
                 const moved = joinBase(c.base, target, decl.homeDir);
                 if (moved === undefined) {
-                    baseLost = true;
+                    loseBase(reachable);
                     return;
                 }
                 branched.push({ base: moved, skippedCd: c.skippedCd });
@@ -93,7 +109,7 @@ export function planShellReads(command, decl, depth = 0) {
         }
         const next = [...byBase.values()];
         if (next.length > BASE_CANDIDATE_MAX)
-            baseLost = true;
+            loseBase(reachable);
         else
             candidates = next;
     };
@@ -116,7 +132,7 @@ export function planShellReads(command, decl, depth = 0) {
             if (frame.beats === undefined) {
                 for (let k = frame.bodyStart; k < si; k++)
                     unmodelled[k] = true;
-                baseLost = true;
+                loseBase(candidates.filter((c) => c.skippedCd < andRunStart));
                 continue;
             }
             for (let beat = 1; beat < frame.beats && !baseLost; beat++) {
@@ -133,7 +149,11 @@ export function planShellReads(command, decl, depth = 0) {
         if (f.empty)
             continue;
         const bases = unmodelled[si] ? "unmodelled" : [...basesOf[si]];
-        const withBases = (c) => ({ ...c, bases: relativeSpelling(c.spelled) ? bases : [] });
+        const floor = unmodelled[si] && floorBases !== undefined && floorBases.length > 0 ? floorBases : undefined;
+        const withBases = (c) => {
+            const relative = relativeSpelling(c.spelled);
+            return { ...c, bases: relative ? bases : [], ...(relative && floor !== undefined ? { floorBases: floor } : {}) };
+        };
         segments.push({
             text: f.text,
             connector: f.connector,
@@ -151,7 +171,7 @@ export function planShellReads(command, decl, depth = 0) {
             reach: reaches[si] ?? { andJoined: false, orBroken: false, moveProvable: false },
         });
     }
-    return { segments, shape };
+    return { segments, shape, ...(unreadable !== undefined ? { unreadable } : {}) };
 }
 function projectSegment(segment) {
     const tokens = [...segment.tokens];
@@ -178,6 +198,24 @@ function projectSegment(segment) {
     };
 }
 function segmentFacts(segment, p, decl, nestedPlan) {
+    const facts = segmentFactsRead(segment, p, decl, nestedPlan);
+    const unresolvedRaw = new Set();
+    for (const t of segment.tokens) {
+        const w = t.kind === "word" ? t : t.kind === "redirect" ? t.target : undefined;
+        if (w?.unresolved !== undefined && UNRESOLVED_VIEW[w.unresolved] === "refuse")
+            unresolvedRaw.add(w.raw);
+    }
+    if (unresolvedRaw.size === 0)
+        return facts;
+    const unsettle = (c) => (unresolvedRaw.has(c.raw) && c.expands !== "unresolvable" ? { ...c, expands: "unresolvable" } : c);
+    const move = facts.baseMove;
+    return {
+        ...facts,
+        reads: facts.reads.map(unsettle),
+        ...(move !== undefined && typeof move.target !== "string" ? { baseMove: { target: unsettle(move.target) } } : {}),
+    };
+}
+function segmentFactsRead(segment, p, decl, nestedPlan) {
     const nested = [];
     for (const body of segment.substitutions)
         nested.push(nestedPlan(body));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.26.3",
+  "version": "7.28.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -52,7 +52,7 @@
     "pretest": "npm run gate:debts",
     "test": "vitest run --exclude \"**/*.local.test.ts\"",
     "test:watch": "vitest",
-    "gate:skips": "vitest run --exclude \"**/node_modules/**\" --exclude \"**/*.local.test.ts\" --reporter=default --reporter=json --outputFile.json=.skip-report.json && node scripts/verify-skip-baseline.mjs --report .skip-report.json",
+    "gate:skips": "vitest run --exclude \"**/node_modules/**\" --exclude \"**/*.local.test.ts\" --reporter=default --reporter=json --outputFile.json=.skip-report.json && node scripts/verify-skip-baseline.mjs --report .skip-report.json --full",
     "gate:live": "node scripts/run-live-gate.mjs",
     "smoke": "tsx src/examples/smoke.ts",
     "eval": "tsx eval/run.ts",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2449,
+  "count": 2450,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -84,6 +84,7 @@
     "AggregateBudgetOptions": "interface",
     "AnthropicBrainConfig": "interface",
     "AppendLog": "class",
+    "ApprovalSeatOutcome": "type",
     "ApproverPosture": "type",
     "ArtifactAction": "type",
     "ArtifactCallContext": "interface",
@@ -2535,6 +2536,7 @@
     "AggregateBudgetOptions": "advanced",
     "AnthropicBrainConfig": "advanced",
     "AppendLog": "advanced",
+    "ApprovalSeatOutcome": "advanced",
     "ApproverPosture": "advanced",
     "ArtifactAction": "advanced",
     "ArtifactCallContext": "advanced",