@sema-agent/core 7.30.0 → 7.31.0

package/dist/core/memory-engine/layer-observations.js

@@ -0,0 +1,148 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { relative, sep } from "node:path";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { scanEntryFiles } from "./entry-scan.js";
+import { entryFromFile, parseEntryFile } from "./frontmatter.js";
+import { ControlPlaneCorruptError, canonicalize, lockedStrictUpdate, readStrictSidecar, scopeDirFor } from "./layout.js";
+export const LAYER_OBSERVATIONS_FILE = "layer-observations.json";
+const WHAT = "memory layer-observation table";
+const str = (v) => typeof v === "string" && v.length > 0;
+function coerce(raw) {
+    if (raw === undefined)
+        return { version: 1, rows: [] };
+    const rec = raw;
+    if (typeof rec !== "object" || rec === null || rec.version !== 1 || !Array.isArray(rec.rows))
+        throw new ControlPlaneCorruptError(`${WHAT} has the wrong shape or an unrecognized version — refusing (fail-closed)`);
+    const rows = rec.rows;
+    for (const r of rows) {
+        const row = r;
+        if (typeof row !== "object" || row === null || !str(row.scope) || !str(row.rel) || (row.entryId !== undefined && !str(row.entryId)) || !str(row.observedRev) || (row.rev !== undefined && (row.entryId === undefined || !str(row.rev))) || (row.sessionId !== undefined && !str(row.sessionId)) || typeof row.observedAt !== "number" || !Number.isFinite(row.observedAt) || (row.undecided !== undefined && (row.undecided !== true || row.entryId === undefined || row.rev !== undefined)) || (row.observationId !== undefined && (!str(row.observationId) || row.undecided !== true))) {
+            throw new ControlPlaneCorruptError(`${WHAT}: a row is malformed — refusing (fail-closed; an unevaluable row must not read as "no unexpected write")`);
+        }
+    }
+    return rec;
+}
+const keyOf = (o) => o.entryId === undefined
+    ? JSON.stringify([null, o.scope, o.rel, o.observedRev])
+    : o.undecided === true
+        ? JSON.stringify([o.entryId, { undecided: true }, o.observedRev, o.scope, o.rel, o.sessionId ?? null, o.observedAt, o.observationId ?? null])
+        : JSON.stringify([o.entryId, o.rev ?? null, o.observedRev]);
+const contentKey = (entryId, observedRev) => JSON.stringify([entryId, observedRev]);
+export function recordLayerObservations(controlDir, rows) {
+    if (rows.length === 0)
+        return;
+    lockedStrictUpdate(controlDir, LAYER_OBSERVATIONS_FILE, WHAT, coerce, (rec) => {
+        const byKey = new Map(rec.rows.map((r) => [keyOf(r), r]));
+        for (const r of rows)
+            if (!byKey.has(keyOf(r)))
+                byKey.set(keyOf(r), { ...r });
+        return { next: { version: 1, rows: [...byKey.values()] }, result: undefined };
+    });
+}
+export function layerObservationLookup(controlDir) {
+    const rows = coerce(readStrictSidecar(controlDir, LAYER_OBSERVATIONS_FILE, WHAT)).rows;
+    const ids = new Set(rows.flatMap((r) => (r.entryId !== undefined ? [r.entryId] : [])));
+    const byKey = new Map(rows.map((r) => [keyOf(r), r]));
+    const undecidedByContent = new Map(rows.flatMap((r) => (r.undecided === true && r.entryId !== undefined ? [[contentKey(r.entryId, r.observedRev), r]] : [])));
+    return {
+        covers: (entryId) => ids.has(entryId),
+        find: (entryId, rev, observedRev) => ids.has(entryId) ? (byKey.get(keyOf({ scope: "", rel: "", entryId, rev, observedRev })) ?? undecidedByContent.get(contentKey(entryId, observedRev))) : undefined,
+        findNote: (scope, rel, digest) => byKey.get(keyOf({ scope, rel, observedRev: digest })),
+    };
+}
+export function observedDivergenceNotice(rel, served, undecided = false) {
+    const file = JSON.stringify(inlineUntrusted(rel));
+    if (undecided)
+        return `change NOT adopted yet: ${file} changed while a session held its layer read-only, and whether a commit backs it could not be established — re-judged once a writing session can read the committed account`;
+    return served
+        ? `change NOT adopted: ${file} was written while a session held its layer read-only — memory serves the committed version, not these bytes`
+        : `file NOT adopted: ${file} appeared while a session held its layer read-only — it is not memory; left on disk for review`;
+}
+export function undecidedLayerObservations(controlDir) {
+    return coerce(readStrictSidecar(controlDir, LAYER_OBSERVATIONS_FILE, WHAT)).rows.filter((r) => r.undecided === true);
+}
+function ordinaryRow(r, rev) {
+    return {
+        scope: r.scope,
+        rel: r.rel,
+        ...(r.entryId !== undefined ? { entryId: r.entryId } : {}),
+        ...(rev !== undefined ? { rev } : {}),
+        observedRev: r.observedRev,
+        ...(r.sessionId !== undefined ? { sessionId: r.sessionId } : {}),
+        observedAt: r.observedAt,
+    };
+}
+export function settleUndecidedLayerObservations(controlDir, verdicts) {
+    if (verdicts.size === 0)
+        return;
+    const byKey = new Map([...verdicts].map(([row, v]) => [keyOf(row), v]));
+    lockedStrictUpdate(controlDir, LAYER_OBSERVATIONS_FILE, WHAT, coerce, (rec) => {
+        const next = new Map();
+        for (const r of rec.rows) {
+            const v = r.undecided === true ? byKey.get(keyOf(r)) : undefined;
+            if (v === "backed")
+                continue;
+            const settled = v === undefined ? r : ordinaryRow(r, v.rev);
+            if (!next.has(keyOf(settled)))
+                next.set(keyOf(settled), settled);
+        }
+        return { next: { version: 1, rows: [...next.values()] }, result: undefined };
+    });
+}
+export function layerDigest(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
+function readText(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readOnlyLayerCensus(homes) {
+    const files = new Map();
+    for (const home of homes) {
+        for (const f of scanEntryFiles(home)) {
+            const path = canonicalize(f.path);
+            const text = readText(path);
+            if (text !== undefined)
+                files.set(path, layerDigest(text));
+        }
+    }
+    return files;
+}
+export function readOnlyLayerCandidates(memoryDir, controlDir, handle) {
+    const census = handle.layerBaseline;
+    if (census === undefined)
+        return [];
+    const out = [];
+    for (const scope of new Set(handle.scopes)) {
+        if (scope === handle.writeScope)
+            continue;
+        const home = canonicalize(scopeDirFor(memoryDir, controlDir, scope));
+        for (const f of scanEntryFiles(home)) {
+            const path = canonicalize(f.path);
+            const text = readText(path);
+            if (text === undefined || (path !== home && !path.startsWith(`${home}${sep}`)))
+                continue;
+            const digest = layerDigest(text);
+            if (census.get(path) === digest)
+                continue;
+            const id = parseEntryFile(text).id;
+            const rel = relative(home, path).split(sep).join("/");
+            out.push({ path, scope, rel, slug: f.slug, digest, ...(id !== undefined ? { id, observedRev: entryFromFile(text, id, f.slug, scope).rev } : { observedRev: digest }) });
+        }
+    }
+    return out;
+}
+export function landedUndecided(batch) {
+    return batch?.landed === true ? batch.undecided : [];
+}
+export function sameObservation(a, b) {
+    return keyOf(a) === keyOf(b);
+}
+export function observationBacked(row, committed) {
+    return committed !== undefined && committed.scope === row.scope && committed.slug === row.rel.replace(/\.md$/, "") && committed.rev === row.observedRev;
+}

package/dist/core/memory-engine/layout.d.ts

@@ -261,6 +261,17 @@ export declare const canonicalize: typeof physicalPathOfExisting;
 export declare function isContainedIn(root: string, child: string): boolean;
 /** mkdir -p convenience used by the engine/backend (0o700 like the file stores). */
 export declare function ensureDirExists(dir: string): void;
+/** The one remedy every surfaced permission refusal carries — `undefined` unless `err` is a write
+ *  the file system refused on PERMISSIONS (`EACCES` / `EPERM`) at a path INSIDE `memoryDir` (a
+ *  refusal elsewhere — a control plane kept outside the store — is not this store's to fix). The
+ *  engine never changes permission bits on a store — a session's read-only layers are its policy,
+ *  not file-system state — so bits that refuse a write were set by someone else, and nothing here
+ *  clears them (an engine from 7.30.x or earlier left inherited layers read-only on disk). */
+export declare function permissionRemedyOf(err: unknown, memoryDir: string): string | undefined;
+/** Attach {@link permissionRemedyOf} to a permission refusal inside `memoryDir` — in place, so the
+ *  error keeps its class and `code` (callers branch on both), and once (an inner seat that already
+ *  named its store wins over an outer one). Any other value is returned untouched. */
+export declare function withPermissionRemedy<T>(err: T, memoryDir: string): T;
 /** B2/L4 — the control-plane subdir holding gate-rejected originals. ONE name for all three writers
  *  (engine harvest, engine derived-index rung, backend inbound gate): they write the same directory,
  *  so its name and its permissions must not depend on which of them ran first. */

package/dist/core/memory-engine/layout.js

@@ -1,4 +1,4 @@
-import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
 const { O_WRONLY, O_RDONLY, O_CREAT, O_TRUNC, O_NOFOLLOW, O_NONBLOCK, O_EXCL } = fsConstants;
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
@@ -687,10 +687,8 @@ function moveLooseContent(root, controlDir, rec, owner, label, renew, sink, resu
     const labels = new Set(Object.values(rec.scopes));
     const { names, probes } = looseRootContent(root, labels, controlDir);
     const home = join(root, label);
-    if (names.length > 0) {
+    if (names.length > 0)
         ensureScopeHome(home);
-        chmodSync(home, 0o755);
-    }
     let moved = 0;
     for (const name of names) {
         renew();
@@ -730,6 +728,24 @@ export function ensureDirExists(dir) {
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true, mode: 0o700 });
 }
+export function permissionRemedyOf(err, memoryDir) {
+    const e = typeof err === "object" && err !== null ? err : undefined;
+    if (e === undefined || (e.code !== "EACCES" && e.code !== "EPERM") || typeof e.path !== "string" || !isContainedIn(memoryDir, e.path))
+        return undefined;
+    return `file permissions refused this memory write (the engine never changes permission bits) — if an engine from 7.30.x or earlier left read-only bits on this store, run \`chmod -R u+w ${shellQuoted(memoryDir)}\` once no such engine still runs on it (an older engine sets the bits again whenever it mounts a layer read-only)`;
+}
+function shellQuoted(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+const remedied = new WeakSet();
+export function withPermissionRemedy(err, memoryDir) {
+    const remedy = permissionRemedyOf(err, memoryDir);
+    if (remedy === undefined || !(err instanceof Error) || remedied.has(err))
+        return err;
+    err.message = `${err.message} — ${remedy}`;
+    remedied.add(err);
+    return err;
+}
 export const QUARANTINE_DIR = "quarantine";
 const DELETED_TOMBSTONE = "---\ndeleted: true\n---\n";
 export function writeFileNoFollow(path, content) {

package/dist/core/memory-engine/types.d.ts

@@ -391,7 +391,9 @@ export interface MaterializedFile {
     rev: string;
     /** True when this file is a budget stub (frontmatter+description only, body archived — §2.3). */
     stub: boolean;
-    /** True when the file belongs to a read-only inherited layer (chmod-protected, never harvested as a write). */
+    /** True when the file belongs to a read-only inherited layer (read-only by this session's policy —
+     *  its file mode is left as found; never harvested as a write, a change to it is a `readonly_layer`
+     *  rejection and the committed copy is restored). */
     readonly: boolean;
 }
 /** The write face's home, for a call site that has established a write face exists (`writeScope !==
@@ -500,6 +502,28 @@ export interface MemorySessionHandle {
         files: Map<string, string>;
         index?: string;
     };
+    /**
+     * The read-only layers' census: every entry file of every layer this session holds read-only,
+     * canonical path → digest of its bytes, taken at materialize BEFORE the adopting read — what stood
+     * when this session's window opened. The harvest's observation half records, in the store's
+     * session-observation table, every id-bearing file of those layers whose bytes changed since and
+     * that no commit backs (the read side never adopts a recorded divergence); the detection half
+     * words a divergence that already stood as not this session's write. Absent ⇔ not a zero-copy
+     * mount (the observed plane is not the store the read side adopts from), or a handle minted
+     * before the field — nothing is recorded then.
+     */
+    layerBaseline?: Map<string, string>;
+    /**
+     * The session-account LEG this mount opened (minted at materialize, stored on the account row).
+     * The harvest closes the account, and a terminal harvest (or a failed prepare's release) ends the
+     * leg, only while the row still carries this leg — a resume that re-opened the row makes this
+     * mount's close / end stale, and they are not written over the later leg. Absent ⇔ this mount
+     * opened no account (no session id, provenance "off", an adoption-restricted mount, an open that
+     * failed and is known not to have landed) — nothing of an account is written for it then. An open
+     * that failed after it landed, or whose landing could not be read back, keeps its leg (every write
+     * made with it is leg-checked).
+     */
+    accountLeg?: string;
 }
 /** Stable rejection codes a harvest gate can produce (model-visible gate events — 镜头 I). */
 export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "unreadable" | "deferred" | "polluted" | "restricted_divergence" | "invalid";
@@ -539,7 +563,7 @@ export interface MemoryAnnouncement {
      *  #479's seat is that every face of one harvest names the same id, and a throat that minted its
      *  own would hand the same occurrence two values). Present on the harvest-tail enqueues (the gate
      *  items and the inbound-reject items); absent on every announcement with no report behind it
-     *  (backend adoption notices, mode-sweep notes, index-heal notes) and on a hand-built report that
+     *  (backend adoption notices, layer-census notes, index-heal and index-write notes) and on a hand-built report that
      *  carries no id — omitted, never fabricated.
      *
      *  STRUCTURE-ONLY, deliberately: {@link import("./engine.js").renderAnnouncements} does not read

package/dist/core/parent-spec-seat.d.ts

@@ -13,7 +13,7 @@ import type { Hooks } from "./hooks.js";
 import type { ToolExecuteContext } from "./tool-spec.js";
 import type { TaskSpec } from "./types.js";
 /** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
-export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "hooks" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars">;
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "hooks" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory">;
 /**
  * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
  * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
@@ -43,6 +43,8 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *  · `skillListingBudgetFraction` / `skillListingMaxDescChars` — the listing-budget knobs, the same shape for the
  *    same reason: a fraction the parent tuned is a fraction OF EACH LEG'S OWN window, so it travels as a number
  *    and every leg multiplies it by its own.
+ *  · `fileHistory` — the request's file-history off switch (`"disabled"`, its only word), for the edits its delegates
+ *    make on its behalf too. An ORDINARY member (fill law); with one word no child can author it back on.
  */
 export interface ParentSpecSeat {
     readonly principal?: string;
@@ -58,6 +60,7 @@ export interface ParentSpecSeat {
     readonly compaction?: TaskSpec["compaction"];
     readonly skillListingBudgetFraction?: number;
     readonly skillListingMaxDescChars?: number;
+    readonly fileHistory?: "disabled";
 }
 /** Mint the seat off the parent's REBOUND spec and its frozen question face (spec over deps — the caller resolves it once,
  *  the same value the parent's own question routing reads). Absent fields stay absent; `oneShot` only when `true`. */

package/dist/core/parent-spec-seat.js

@@ -12,6 +12,7 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.compaction !== undefined ? { compaction: Object.freeze({ ...spec.compaction }) } : {}),
         ...(spec.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: spec.skillListingBudgetFraction } : {}),
         ...(spec.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: spec.skillListingMaxDescChars } : {}),
+        ...(spec.fileHistory !== undefined ? { fileHistory: spec.fileHistory } : {}),
         ...(spec.memory?.enabled === false ? { memoryOff: true } : {}),
     });
 }
@@ -31,6 +32,7 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("compaction", (seat.compaction !== undefined ? { ...seat.compaction } : undefined)),
         ...fill("skillListingBudgetFraction", seat.skillListingBudgetFraction),
         ...fill("skillListingMaxDescChars", seat.skillListingMaxDescChars),
+        ...fill("fileHistory", seat.fileHistory),
         ...(seat.oneShot === true ? { oneShot: true } : {}),
         ...(seat.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : fill("memoryPersistenceCapable", seat.memoryPersistenceCapable)),
         ...(seat.memoryOff === true ? { memory: memoryTurnedOff(child.memory) } : {}),

package/dist/core/park-selfcheck.js

@@ -74,6 +74,7 @@ function syntheticCheckpoint(scope) {
             preview: { probe: true, note: "park wiring self-check display stub" },
             previewWithheld: "oversize",
             requiresRealApproval: true,
+            mandated: true,
             denialLimitFallback: { consecutive: 3, total: 3, limit: "consecutive", autoDenyAfterMs: 0 },
             origin: "denial_limit_fallback",
             batchToolCallIds: [`${scope}:call`],

package/dist/core/runner/announce-once-ledger.d.ts

@@ -1,4 +1,6 @@
 import type { AnnouncedListingSnapshot, AnnouncedListingSnapshotInput, AnnouncedMcpFailure } from "../../internal/harness.js";
+import type { SessionTreeEntry } from "../../internal/harness-types.js";
+import type { DateAnchorRead } from "./contracts.js";
 import type { McpDroppedTool, McpServerStatus } from "../mcp.js";
 import type { RunnerDeps } from "../types.js";
 /** Upper bound on the advisory-digest arm kept in the record (oldest dropped past it). A digest is
@@ -96,3 +98,27 @@ export declare function loadAnnounceOnceLedger(session: AnnounceOnceSession, che
  *  present-only arms, copied; `undefined` when nothing was announced on any face (the resume seed
  *  then falls to the lower rungs — unchanged contract). */
 export declare function serializeAnnouncedListings(ref: AnnouncedListingSnapshotInput): AnnouncedListingSnapshot | undefined;
+/** The custom-entry kind that carries the session's date anchor (engine-owned; never model-visible). */
+export declare const DATE_ANCHOR_CUSTOM_TYPE = "engine:date-anchor";
+/**
+ * Read the session's date anchor off the active branch: the nearest anchor entry NEWER than the nearest
+ * compaction, honored only when it was written for that same segment. An anchor written by a leg whose
+ * prefix predates a compaction that landed in between therefore reads as absent — the one rule that makes a
+ * compaction re-anchor the date. An unreadable branch returns undefined (the leg renders today, writes nothing).
+ */
+export declare function readDateAnchor(session: {
+    getBranch(): Promise<ReadonlyArray<SessionTreeEntry>>;
+}): Promise<DateAnchorRead | undefined>;
+/**
+ * The anchor write a leg owes when it settles, or undefined: owed when prepare found no anchor for the segment
+ * (the leg rendered today) or the model has since been told a newer date; never after an unreadable branch.
+ * Best-effort — a lost write costs one re-rendered prefix or one repeated reminder next leg, never a wrong date.
+ */
+export declare function owedDateAnchor(session: {
+    appendCustomEntry(customType: string, data?: unknown): Promise<string>;
+}, seat: {
+    legDate: string;
+    anchor: DateAnchorRead | undefined;
+} | undefined, state: {
+    announcedDate: string;
+} | undefined): (() => Promise<void>) | undefined;

package/dist/core/runner/announce-once-ledger.js

@@ -112,3 +112,40 @@ export function serializeAnnouncedListings(ref) {
     };
     return Object.keys(out).length > 0 ? out : undefined;
 }
+export const DATE_ANCHOR_CUSTOM_TYPE = "engine:date-anchor";
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+function normalizeDateAnchor(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const { prefixDate, announcedDate, segment } = v;
+    if (typeof prefixDate !== "string" || !ISO_DATE.test(prefixDate) || typeof announcedDate !== "string" || !ISO_DATE.test(announcedDate))
+        return undefined;
+    if (segment !== null && (typeof segment !== "string" || segment.length > 200))
+        return undefined;
+    return { prefixDate, announcedDate, segment };
+}
+export async function readDateAnchor(session) {
+    let branch;
+    try {
+        branch = await session.getBranch();
+    }
+    catch {
+        return undefined;
+    }
+    let found;
+    let i = branch.length - 1;
+    for (; i >= 0 && branch[i].type !== "compaction"; i--) {
+        const e = branch[i];
+        if (found === undefined && e.type === "custom" && e.customType === DATE_ANCHOR_CUSTOM_TYPE)
+            found = normalizeDateAnchor(e.data);
+    }
+    const segment = i >= 0 ? branch[i].id : null;
+    return { current: found !== undefined && found.segment === segment ? { prefixDate: found.prefixDate, announcedDate: found.announcedDate } : undefined, segment };
+}
+export function owedDateAnchor(session, seat, state) {
+    const read = seat?.anchor;
+    if (read === undefined || state === undefined || read.current?.announcedDate === state.announcedDate)
+        return undefined;
+    const data = { prefixDate: seat.legDate, announcedDate: state.announcedDate, segment: read.segment };
+    return () => session.appendCustomEntry(DATE_ANCHOR_CUSTOM_TYPE, data).then(() => undefined, () => undefined);
+}

package/dist/core/runner/contracts.d.ts

@@ -176,11 +176,22 @@ export interface CommittedPause {
     scope: string;
     gatedCallId?: string;
 }
+/** The session's date anchor as prepare read it off the branch. The system-prefix date is frozen per
+ *  SEGMENT — from session start, or from the latest landed compaction, to the next one. */
+export interface DateAnchorRead {
+    /** The anchor written for the current segment; undefined ⇒ the leg renders today and anchors it. */
+    current: {
+        prefixDate: string;
+        announcedDate: string;
+    } | undefined;
+    /** The current segment: the nearest compaction entry's id, null before the first compaction. */
+    segment: string | null;
+}
 /**
  * One engine frame whose commit waits for the receipt of the message carrying it.
  *
  * @contract frames.commit_on_receipt — an engine-minted frame that rides a user message (the git-status
- * frame, an `agent_listing` or `skills_listing` frame) is recorded as announced ONLY when the run loop's
+ * frame, an `agent_listing`, `skills_listing` or `date_change` frame) is recorded as announced ONLY when the run loop's
  * `message_end` walk sees a persisted user entry whose text equals the carrying text it was registered
  * with; every receipt with that text settles on that one entry. Until then nothing is recorded — a
  * message that never reaches the transcript (a pre-append failure, a suppressed or undrained steer, a
@@ -193,7 +204,7 @@ export interface FrameReceipt {
     text: string;
     /** Which frame this receipt settles. A boundary collector must not render a listing whose receipt is
      *  still pending (the frame is queued, not yet in the transcript). */
-    source: "git_status" | "agent_listing" | "skills_listing";
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -344,7 +355,7 @@ export interface Prepared {
      *  than a snapshot, so the throw-path backstop terminal reports the same ledger the ordinary
      *  assembly would. Always present on Prepared; independent of whether a fileHistoryStore is wired. */
     editedFilesSnapshot: () => TaskResult["editedFiles"];
-    /** The run's turn-start boundary seat (present iff a fileHistoryStore is wired and
+    /** The run's turn-start boundary seat (present iff the run records file history into a wired store and
      *  the run mounts a real fs env). runtask calls begin() at the first committed user entry and
      *  awaits settle() at the lease close + the finish tail. */
     fileHistoryBoundary?: FileHistoryBoundarySeat;
@@ -623,6 +634,9 @@ export interface Prepared {
         /** Merged injection across all planes (single-root sessions: identical to engine.inject(handle)). */
         inject: () => import("../memory-engine/engine.js").MemoryInjection;
         harvest: (phase?: "checkpoint" | "terminal") => Promise<HarvestReport | undefined>;
+        /** End this mount's session leg WITHOUT a harvest: the run that mounted it will never reach its
+         *  terminal harvest (a prepare that failed after the mount). Never throws. */
+        release: () => void;
         /**
          * The session's capture opt-out face (the `TaskStream.optOutMemoryCapture`
          * verb's target; host-API only — no tool face reads it, §2.6). `flip` re-adjudicates the
@@ -1027,10 +1041,13 @@ export interface Prepared {
     /** The date-flip detector seam: `legDate` = the date frozen
      *  into this leg's system prefix; `today()` = the boundary-time LOCAL date (user-zone-bound closure).
      *  The run loop feeds both to the `date_change` attachment producer; the prefix itself never
-     *  re-renders mid-leg (cache preservation, CC parity). Present only when the prompt carries a date. */
+     *  re-renders mid-leg (cache preservation, CC parity). Present only when the prompt carries a date.
+     *  `anchor` = the session's date anchor as prepare read it (undefined ⇒ the branch was unreadable
+     *  and the leg writes none); the settle lane persists it when it is new or the announced date moved. */
     dateChange?: {
         legDate: string;
         today: () => string;
+        anchor: DateAnchorRead | undefined;
     };
     /** [A2] C-4 (design-A §4) — the loadProjectMemory snapshot's declared instruction sources
      *  (`ProjectMemoryLoad.instructionSources`): the probe input AND the lane's per-path baseline
@@ -2066,7 +2083,7 @@ export interface RunInternals {
      * re-exposes the SAME triple on its own ctx, so every same-tree descendant of a root session — at
      * any depth — lands in the root session's scope (the fixed point), while a descendant on another
      * tree (worktree isolation, explicit `cwd`, a fresh per-task sandbox) becomes the root of its own
-     * subtree's history. Absent on a top-level run, on a run with no live history store, and on a
+     * subtree's history. Absent on a top-level run, on a run that records no file history, and on a
      * tier-3 revival (the reviver's lineage says nothing about the revived row's tree).
      */
     fileHistoryLineage?: {

package/dist/core/runner/denial-limit-arms.d.ts

@@ -60,8 +60,8 @@ export declare function attachRebuiltDenialTrackers<T extends {
  * in headless mode"). Once per run leg (the first such fallback owns the terminal); the deny that
  * triggered it stands as that call's result. Minted once so every mint site — the main gate's seat, the
  * inherited-lane arms, and the durable resume station — stops the SAME leg through the SAME seat.
- * `abort` is the run's own abort (controller + harness), handed in because the harness is built after
- * the seat is.
+ * `abort` is the run's own abort (controller + harness — the one a cancel fires; handed in because the harness
+ * is built after the seat): the durable stop fires it before the resume leg's prompt, whose door reads it.
  *
  * TWO LANES, ONE SENTENCE. The synchronous lane reached no approver at all; the durable lane parked the
  * fallback, and the decide that came back named a settlement word the ONE table

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -75,10 +75,6 @@ export interface PrepareAcquireReconcileResult {
      *  SUCCEEDS (a conflict-losing attempt re-wakes and re-derives the whole set from the fresh
      *  branch), and stays empty for a fresh session / a clean one with nothing to reconcile. */
     wakeRecovered: RecoveredOrphan[];
-    /** owned — §E18 `"before"` mode: the validated target's parentId — the new conversation leaf, and
-     *  the E19 file-anchor walk's starting point (consumed by the rewind-restore block after env
-     *  setup). `null` outside `"before"` mode. */
-    resumeAtBeforeParentId: string | null;
 }
 /** The B-3 phase body — the acquire+reconcile slice, verbatim (see the module header for the contract). */
 export declare function prepareAcquireReconcile(input: PrepareAcquireReconcileInput): Promise<PrepareAcquireReconcileResult>;

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -32,7 +32,6 @@ export async function prepareAcquireReconcile(input) {
     let session;
     let conflictRef;
     let wakeRecovered = [];
-    let resumeAtBeforeParentId = null;
     for (let attempt = 0;; attempt++) {
         try {
             acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : input.placement !== undefined ? { placement: input.placement } : undefined);
@@ -105,7 +104,6 @@ export async function prepareAcquireReconcile(input) {
                         e.code = "resume_at.before_root_unsupported";
                         throw e;
                     }
-                    resumeAtBeforeParentId = entry.parentId;
                 }
                 await session.getStorage().setLeafId(spec.resumeAtMode === "before" ? entry.parentId : spec.resumeAt);
             }
@@ -123,5 +121,5 @@ export async function prepareAcquireReconcile(input) {
             throw err;
         }
     }
-    return { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId };
+    return { acquired, session, conflictRef, wakeRecovered };
 }

package/dist/core/runner/prepare-file-history.d.ts

@@ -1,6 +1,6 @@
 /**
  * PrepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
- * policy door, the `RunnerDeps.fileHistoryStore` bad-value door, the retired `rewindFiles` two-sense
+ * policy door, the `RunnerDeps.fileHistoryStore` / `fileHistoryCapture` and `TaskSpec.fileHistory` bad-value doors, the retired `rewindFiles` two-sense
  * split, the restoreFiles / resumeAt / rewindFilesTo combination gates, the run's history coordinates
  * (canonical root, recording scope, filesystem identity), the fork carry, the child-scope refusal, the
  * rewind RESTORE itself (anchor translation in "before" mode, the per-file ledger, partial-restore
@@ -23,12 +23,12 @@ import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 export interface PrepareFileHistoryInput {
-    /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy and the
-     *  history store (both validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError">;
-    /** borrowed-readonly — the REBOUND spec's rewind request fields (the retired `rewindFiles` spelling is
-     *  read off the same object as an unknown key) and the caller's cancel signal for the restore. */
-    spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal">;
+    /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy, the history
+     *  store and its capture switch (all validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
+    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture" | "onError">;
+    /** borrowed-readonly — the REBOUND spec's rewind request fields and off-switch word (the retired `rewindFiles`
+     *  spelling is read off the same object as an unknown key) and the caller's cancel signal for the restore. */
+    spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal" | "fileHistory">;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
      *  and for a host's own fork), read for the recording-scope decision only. */
     internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;
@@ -41,19 +41,15 @@ export interface PrepareFileHistoryInput {
     handsEnabled: boolean;
     /** borrowed-readonly — the acquired session id: the run's OWN history scope and the restore's session key. */
     sessionId: string;
-    /** borrowed-readonly — the acquired session, read for the fork lineage (`getMetadata`) and the "before"
-     *  anchor walk (`getEntry`); never written here. */
-    session: Pick<StoredSession, "getEntry" | "getMetadata">;
-    /** borrowed-readonly — §E18 "before" mode: the validated target's parentId (the acquire phase's output);
-     *  `null` outside "before" mode. */
-    resumeAtBeforeParentId: string | null;
+    /** borrowed-readonly — the acquired session, read for the fork lineage (`getMetadata`); never written here. */
+    session: Pick<StoredSession, "getMetadata">;
     /** borrowed-readonly — the run's abort controller (driver-minted); only its `signal` is read, composed
      *  with `spec.signal` for the restore. */
     abortController: AbortController;
 }
 export interface PrepareFileHistoryResult {
     /** borrowed-readonly — the hook the hands band calls before every mutation lane; `undefined` when the
-     *  machinery is not live (no store, or no real fs env). */
+     *  run does not record (no store, capture turned off by any layer, or no real fs env). */
     trackFileEdit: TrackFileEditHook | undefined;
     /** borrowed-readonly — the turn-start boundary seat runtask drives; `undefined` when not live or when
      *  this run records into its ROOT session's scope (a child mints no boundaries). */
@@ -64,8 +60,10 @@ export interface PrepareFileHistoryResult {
     /** borrowed-mutable — the non-fatal rewind disclosures (`TaskResult.rewindNotes`). Mutation owners after
      *  this call: none — every push happens inside this phase; the driver only reads it into `Prepared`. */
     rewindNotes: NonNullable<TaskResult["rewindNotes"]>;
-    /** borrowed-readonly — whether the file-history machinery is LIVE for this run (store wired AND hands). */
+    /** borrowed-readonly — whether this run RECORDS file history (store wired, no layer turned capture off, AND hands); restore reads the store seat. */
     fileHistoryEnabled: boolean;
+    /** borrowed-readonly — the manifest's word: `"on"` iff live, else `"disabled"` (whichever layer or missing half). */
+    fileHistoryFact: "on" | "disabled";
     /** borrowed-readonly — the scope this run's first-touch records land in (own session, or the root
      *  session's for a same-tree delegated child). */
     historyScope: string;