@sema-agent/core 7.31.0 → 7.32.0

package/dist/tools/fs/shell-read-establish.js

@@ -145,14 +145,14 @@ export function establishShellReadsLexically(plan, boundary) {
     }
     return { plan, reads, nested, roots: boundary.roots };
 }
-export function createShellReadEstablisher(env, readRoots) {
+export function createShellReadEstablisher(env, readRoots, opts) {
     const lexicalOnly = boundaryIsTheSandbox(env);
     const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
     const family = pathFamilyOf({ root: readRoots[0] ?? "/" });
     const SEP = family === "posix" ? /\// : /[\\/]/;
     const TRAILING_SEP = family === "posix" ? /\/+$/ : /[\\/]+$/;
     const joinUnder = (dir, name) => `${dir.replace(TRAILING_SEP, "")}/${name}`;
-    let rootsOnce;
+    let rootsOnce = opts?.rootsCanonical === true ? Promise.resolve(readRoots) : undefined;
     const canonicalRoots = async (signal) => {
         rootsOnce ??= (async () => {
             const out = [];

package/dist/tools/fs/shell-read-plan.d.ts

@@ -62,8 +62,8 @@ export interface ReadCandidate {
      *  A deny row is a floor, so the judge resolves the spelling against these for deny rows ONLY — never to
      *  establish a read. `cd sub && cd $'\x2e' && cat <deny row under sub>` (bash: `cd .`) is refused through it. */
     readonly floorBases?: readonly string[];
-    /** A home word the plan does not place (the text may rebind `HOME`, or it sits in a value): spelled with the DECLARED
-     *  home. A deny row is a floor: the judge reads it for deny rows ONLY, never to establish a read. */
+    /** A home word the plan does not place (the text may rebind `HOME`, it sits in a value, or it is a literal tilde the
+     *  program may expand itself): spelled with the DECLARED home. The judge reads it for deny rows ONLY. */
     readonly floorSpelled?: string;
     /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
     readonly denyOnly?: true;

package/dist/tools/fs/shell-read-plan.js

@@ -193,7 +193,7 @@ function segmentFacts(segment, p, decl, home, nestedPlan) {
             unresolvedRaw.add(w.raw);
     }
     const homeWithheld = home === undefined && decl.homeDir !== undefined;
-    const floor = (c) => { const f = c.expands === "unresolvable" && decl.homeDir !== undefined ? spelledWithHome(c.spelled, c.raw, decl.homeDir) : undefined; return f === undefined ? c : { ...c, floorSpelled: f }; };
+    const floor = (c) => { const f = (c.expands === "unresolvable" || c.spelled.startsWith("./~")) && decl.homeDir !== undefined ? spelledWithHome(c.spelled, c.raw, decl.homeDir) : undefined; return f === undefined ? c : { ...c, floorSpelled: f }; };
     const unsettle = (c) => floor((unresolvedRaw.has(c.raw) || (homeWithheld && c.spelled.startsWith("~"))) && c.expands !== "unresolvable" ? { ...c, expands: "unresolvable" } : c);
     const move = facts.baseMove;
     return {
@@ -268,9 +268,8 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
     const basename = program?.basename;
     const listed = basename !== undefined && (decl.readers.has(basename) || basename === "cd");
     const verb = program === undefined ? undefined : { name: program.name, basename: program.basename, listed };
-    const envOpens = basename !== undefined && !NO_PATH_OPERAND_COMMANDS.has(basename);
     for (const k of pos.assignments)
-        pushAssignment(reads, toks[k].word, "env_assignment", envOpens);
+        pushAssignment(reads, toks[k].word, "env_assignment");
     for (const l of pos.launchers) {
         const r = toks[l.index];
         if (isPathShapedToken(r.folded))
@@ -313,7 +312,7 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
                 continue;
             }
             if (r.word.assignment !== undefined) {
-                pushAssignment(reads, r.word, "env_assignment", envOpens);
+                pushAssignment(reads, r.word, "env_assignment");
                 continue;
             }
             reads.push(bare(r, "unlisted_word"));
@@ -462,7 +461,7 @@ function dedupe(reads) {
     const seen = new Set();
     const out = [];
     for (const c of reads) {
-        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}\u0000${c.denyOnly === true}`;
+        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}\u0000${c.raw}\u0000${c.denyOnly === true}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -488,7 +487,7 @@ function redirectFact(r, home) {
         return { op: r.op, direction: "in" };
     return { op: r.op, direction: "out", target: bare(readsOf([r.target], home)[0], "write_redirect_target") };
 }
-function pushAssignment(reads, w, provenance, opensValue = true) {
+function pushAssignment(reads, w, provenance) {
     const a = w.assignment;
     if (a === undefined)
         return;
@@ -498,13 +497,19 @@ function pushAssignment(reads, w, provenance, opensValue = true) {
     const named = a.value.folded === "" || (a.op === "+=" ? expandsTilde : !settled) ? undefined : value;
     if (a.value.folded === "" && settled)
         return;
-    const v = { spelled: a.value.folded, raw: a.bare ? a.value.raw : w.raw, provenance };
+    const v = { spelled: value, raw: a.bare ? a.value.raw : w.raw, provenance };
     const unsettled = provenance !== "env_assignment" ? { ...v, expands: "unresolvable" } : v.spelled.startsWith("~") && !v.spelled.includes(":") ? { ...v, expands: expandsOf(a.value) } : undefined;
-    if (!settled && opensValue && unsettled !== undefined)
+    if (!settled && unsettled !== undefined)
         reads.push(unsettled);
     const substitutes = a.value.expansions.some((p) => p.expansion?.kind === "command" || p.expansion?.kind === "process" || p.expansion?.kind === "arithmetic");
     if (named !== undefined && !substitutes)
         reads.push({ spelled: named, raw: w.raw, provenance, expands: expandsOf(w) });
+    if (a.value.folded.includes(":"))
+        for (const m of a.value.folded.split(":"))
+            if (m !== "") {
+                const r = readOfText(m);
+                reads.push({ spelled: r.folded, raw: r.raw, provenance, expands: r.expands, denyOnly: true });
+            }
     if (a.form === "compound")
         for (const e of compoundArrayElements(a.value))
             reads.push({ spelled: e.folded, raw: e.raw, provenance, expands: e.expands, ...(e.denyOnly === true ? { denyOnly: true } : {}) });
@@ -527,7 +532,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
         expanding.add(j);
         reads.push(bare(toks[j], j === argvStart ? "program_path" : provenance));
         if (j < argvStart)
-            pushAssignment(reads, toks[j].word, "env_assignment", slotVerb !== undefined && !noPathOperands);
+            pushAssignment(reads, toks[j].word, "env_assignment");
         else if (j > argvStart && !declaredNotPaths)
             pushAssignment(reads, toks[j].word, provenance);
     }
@@ -605,7 +610,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
         }
         reads.push(bare(r, j === argvStart ? "program_path" : provenance));
         if (j < argvStart)
-            pushAssignment(reads, r.word, "env_assignment", slotVerb !== undefined && !noPathOperands);
+            pushAssignment(reads, r.word, "env_assignment");
         else if (!declaredNotPaths)
             pushAssignment(reads, r.word, provenance);
     }

package/dist/tools/fs/shell-read-word.d.ts

@@ -25,10 +25,11 @@ export declare function readsOf(words: readonly LexedWord[], home: string | unde
 export declare const rewritten: (r: Read) => boolean;
 /** The reading of a text that came out of a word (a sed script's file operand): one shell word, or unresolvable. */
 export declare function readOfText(text: string): Read;
-/** A home-rooted candidate spelled with `home`: a leading `~` / `~/` (a literal tilde is spelled `./~` before this
- *  point, so a leading `~` IS the expansion), or a `$HOME` / `${HOME}` word as {@link homeExpansionOf} reads it —
- *  read off the VALUE's pieces when the word is assignment-shaped (`A="$HOME/x"`, `dd if="$HOME/x"`: the candidate is
- *  the value, quotes kept); `undefined` for any other (`~user`, a payload, a word that is no home word). */
+/** A home-rooted candidate spelled with `home`: a leading `~` / `~/` — the shell's expansion, or the literal-tilde
+ *  spelling `./~` of one it leaves alone (quoted, escaped, after an option's `=`), which the program it reaches may
+ *  expand itself — or a `$HOME` / `${HOME}` word as {@link homeExpansionOf} reads it, read off the VALUE's pieces when
+ *  the word is assignment-shaped (`A="$HOME/x"`, `dd if="$HOME/x"`: the candidate is the value, quotes kept);
+ *  `undefined` for any other (`~user`, a word that is no home word). */
 export declare function spelledWithHome(spelled: string, raw: string, home: string): string | undefined;
 /** A function definition's head names nothing that runs here and is dropped from a segment's tokens, in place:
  *  `NAME ( )` (an identifier), and `function NAME [( )]` — a bare `function` at command position, a name of any

package/dist/tools/fs/shell-read-word.js

@@ -20,8 +20,9 @@ export function readOfText(text) {
     return { word, raw: text, folded: text, expands: expandsOf(word) };
 }
 export function spelledWithHome(spelled, raw, home) {
-    if (spelled.startsWith("~"))
-        return /^~(?:\/|$)/.test(spelled) ? `${home}${spelled.slice(1)}` : undefined;
+    const tilde = spelled.startsWith("./~") ? spelled.slice(2) : spelled;
+    if (tilde.startsWith("~"))
+        return /^~(?:\/|$)/.test(tilde) ? `${home}${tilde.slice(1)}` : undefined;
     if (!raw.includes("HOME"))
         return undefined;
     const w = readOfText(raw).word;

package/dist/tools/monitor.d.ts

@@ -73,10 +73,11 @@ export interface MonitorToolOptions {
      *  spawns a shell command too, so what it runs is what the station judged, re-established before the watch
      *  spawns. Absent ⇒ no station judged this mount; nothing is re-established. */
     shellReadAdmission?: ShellReadAdmission;
-    /** RB-465-b (HRD-PTL-3 残件): spec-level retain (`TaskSpec.retainBackgroundProcesses`) — the SECOND
-     *  retain lane, OR-composed with the env capability at the teardown sweep. Without this bit the mount
-     *  could only see the env lane, so a deployment retaining per spec still got the "session ends it"
-     *  wording in the persistent-watch receipt. Purely a RECEIPT input — enforcement stays at the sweep. */
+    /** RB-465-b (HRD-PTL-3 残件): spec-level retain (`TaskSpec.retainBackgroundProcesses`) — the task lane of
+     *  THE retain predicate (`retainsBackgroundProcesses`), OR-composed with the env capability. Read twice,
+     *  by the same predicate: the persistent-watch receipt's wording, and the row's `retained` mark at
+     *  registration (so the session reap and the exit-boundary hard face judge the row the way the receipt
+     *  described it). */
     retainBackgroundProcesses?: boolean;
     /** The task root in the SAME canonical spelling `createBashTool` is built with, so a dead-cwd self-heal
      *  lands both tools on one directory. Absent ⇒ the diagnosis says it has no reset target, rather than

package/dist/tools/monitor.js

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
-import { hasBackgroundShell } from "../core/background-shell.js";
+import { envDeclaresRetain, hasBackgroundShell, retainsBackgroundProcesses } from "../core/background-shell.js";
 import { MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, } from "../core/task-registry.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
 import { isDeadCwd, diagnoseDeadCwd } from "./fs/dead-cwd.js";
@@ -101,6 +101,7 @@ export function createMonitorTool(env, opts) {
                     persistent: isPersistent,
                     ...(sessionScoped ? { sessionScoped: true } : {}),
                     ...(isPersistent ? {} : { timeoutMs }),
+                    ...(opts.retainBackgroundProcesses !== undefined ? { retainBackgroundProcesses: opts.retainBackgroundProcesses } : {}),
                     ...(onNotify !== undefined ? { onEvent: (n) => onNotify(n, { priority: "next" }) } : {}),
                     ...(opts.timers !== undefined ? { timers: opts.timers } : {}),
                     ...(opts.batchWindowMs !== undefined ? { batchWindowMs: opts.batchWindowMs } : {}),
@@ -135,12 +136,12 @@ export function createMonitorTool(env, opts) {
             const persistentBudget = bgTimeout !== undefined
                 ? `the execution environment's background time budget ends the watch after ${bgTimeout}s`
                 : `the execution environment's background time budget still applies`;
-            const retainedByEnv = env.backgroundCapabilities.retainBackgroundProcesses === true;
+            const retainedByEnv = envDeclaresRetain(env);
             const retainedBySpec = opts.retainBackgroundProcesses === true;
-            const retained = retainedByEnv || retainedBySpec;
+            const retained = retainsBackgroundProcesses({ env: retainedByEnv, task: retainedBySpec });
             const persistentAnchor = sessionScoped
                 ? retained
-                    ? ". This run retains background processes (environment capability or task spec), so at the run teardown the watch is marked retained and " +
+                    ? ". This run retains background processes (environment capability or task spec), so the watch is retained and " +
                         "survives the session's release: only your TaskStop, the command's own exit, or that budget end it."
                     : "; it runs until then, until you stop it, or until the session ends."
                 : retained

package/dist/tools/todo.d.ts

@@ -2,9 +2,9 @@ import type { ToolSpec } from "../core/types.js";
 /**
  * design/102 (K-8 CC full-body) — TodoWrite parity (CONTEXT leg). A private, in-task plan the model rewrites to
  * track multi-step work. State lives in this factory's closure — FRESH per task (each `assembleCodeTools` call
- * makes its own) and torn down with the task; nothing durable, no deps, no egress. `effect:"idempotent"` because
+ * makes its own), one list per calling session (`ctx.sessionId`; upstream keys it by agent, so an Agent child sharing
+ * the instance never replaces the leader's plan); nothing durable, no deps, no egress. `effect:"idempotent"` because
  * re-sending the whole list is repeat-safe. Distinct from `present_plan` (that SUSPENDS for human review); this is
- * the model's own scratch. Returns a RAW {@link ToolSpec} pushed via `spec.tools` (prepare-task defines it) — NOT
- * mounted default-on, so it stays INERT for non-full-body runs. (A later slice may project the list to the wire.)
+ * the model's own scratch, a RAW {@link ToolSpec} pushed via `spec.tools` — NOT mounted default-on (INERT elsewhere).
  */
 export declare function createTodoWriteTool(): ToolSpec;

package/dist/tools/todo.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { errorResult } from "../core/tools.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
 export function createTodoWriteTool() {
-    let todos = [];
+    const lists = new Map();
     return {
         name: "TodoWrite",
         ...toolFace("todo-write"),
@@ -81,9 +81,10 @@ export function createTodoWriteTool() {
                 activeForm: Type.String({ minLength: 1, description: "Present-continuous form shown while in progress (e.g. \"Running the tests\")." }),
             })),
         }),
-        execute: (args) => {
+        execute: (args, ctx) => {
+            const key = ctx?.sessionId ?? "";
             const shape = (t) => ({ content: t.content, status: t.status, activeForm: t.activeForm });
-            const oldTodos = todos.map(shape);
+            const oldTodos = (lists.get(key) ?? []).map(shape);
             const written = args.todos;
             for (let i = 0; i < written.length; i++) {
                 const activeForm = written[i].activeForm;
@@ -96,7 +97,7 @@ export function createTodoWriteTool() {
                 }
             }
             const allDone = written.every((t) => t.status === "completed");
-            todos = allDone ? [] : written;
+            lists.set(key, allDone ? [] : written);
             const newTodos = written.map(shape);
             const open = written.filter((t) => t.status !== "completed").length;
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.31.0",
+  "version": "7.32.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2478,
+  "count": 2484,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -177,10 +177,12 @@
     "BackgroundAgentStoreError": "class",
     "BackgroundAgentUsage": "interface",
     "BackgroundChildEvent": "interface",
+    "BackgroundHardKillOutcome": "type",
     "BackgroundPoll": "interface",
     "BackgroundShellCapability": "interface",
     "BackgroundShellError": "class",
     "BackgroundShellErrorCode": "type",
+    "BackgroundShellHardKillReceipt": "interface",
     "BackgroundShellId": "type",
     "BackgroundShellStatus": "type",
     "BackgroundSpawnOptions": "type",
@@ -905,6 +907,7 @@
     "PERMISSION_MODE_CLASSES": "variable",
     "PERMISSION_RULE_SYNC_PATH": "variable",
     "PERMISSION_RULE_WRITER": "variable",
+    "PERSISTED_RULE_MANDATES": "variable",
     "PLAN_SYSTEM_PROMPT": "variable",
     "PLAN_WHEN_TO_USE": "variable",
     "PREFIX_INPUT_CLASSIFICATION": "variable",
@@ -1013,6 +1016,7 @@
     "PersistedRuleCoverage": "interface",
     "PersistedRuleHit": "interface",
     "PersistedRuleHitRule": "interface",
+    "PersistedRuleMandate": "type",
     "PersistedRuleMatch": "type",
     "PersistedRuleTool": "type",
     "PersistedRuleUnreadable": "interface",
@@ -1131,6 +1135,7 @@
     "ReadOnlyFlagArity": "type",
     "ReadOnlyShellVerdict": "type",
     "ReadRootGrantCandidate": "interface",
+    "ReadRootGrantScreen": "type",
     "RealApprovalGateBit": "interface",
     "ReasoningFormat": "type",
     "ReasoningIntensity": "type",
@@ -2056,6 +2061,7 @@
     "isPeerSessionId": "function",
     "isPeerSessionProcessAlive": "function",
     "isPermissionModeClass": "function",
+    "isPersistedRuleMandate": "function",
     "isPersonalScope": "function",
     "isProcessLive": "function",
     "isProtectedWrite": "function",
@@ -2657,10 +2663,12 @@
     "BackgroundAgentStoreError": "advanced",
     "BackgroundAgentUsage": "advanced",
     "BackgroundChildEvent": "advanced",
+    "BackgroundHardKillOutcome": "advanced",
     "BackgroundPoll": "advanced",
     "BackgroundShellCapability": "advanced",
     "BackgroundShellError": "advanced",
     "BackgroundShellErrorCode": "advanced",
+    "BackgroundShellHardKillReceipt": "advanced",
     "BackgroundShellId": "advanced",
     "BackgroundShellStatus": "advanced",
     "BackgroundSpawnOptions": "advanced",
@@ -3385,6 +3393,7 @@
     "PERMISSION_MODE_CLASSES": "advanced",
     "PERMISSION_RULE_SYNC_PATH": "advanced",
     "PERMISSION_RULE_WRITER": "advanced",
+    "PERSISTED_RULE_MANDATES": "advanced",
     "PLAN_SYSTEM_PROMPT": "advanced",
     "PLAN_WHEN_TO_USE": "advanced",
     "PREFIX_INPUT_CLASSIFICATION": "advanced",
@@ -3493,6 +3502,7 @@
     "PersistedRuleCoverage": "advanced",
     "PersistedRuleHit": "advanced",
     "PersistedRuleHitRule": "advanced",
+    "PersistedRuleMandate": "advanced",
     "PersistedRuleMatch": "advanced",
     "PersistedRuleTool": "advanced",
     "PersistedRuleUnreadable": "advanced",
@@ -3611,6 +3621,7 @@
     "ReadOnlyFlagArity": "advanced",
     "ReadOnlyShellVerdict": "advanced",
     "ReadRootGrantCandidate": "advanced",
+    "ReadRootGrantScreen": "advanced",
     "RealApprovalGateBit": "advanced",
     "ReasoningFormat": "advanced",
     "ReasoningIntensity": "advanced",
@@ -4536,6 +4547,7 @@
     "isPeerSessionId": "advanced",
     "isPeerSessionProcessAlive": "advanced",
     "isPermissionModeClass": "advanced",
+    "isPersistedRuleMandate": "advanced",
     "isPersonalScope": "advanced",
     "isProcessLive": "advanced",
     "isProtectedWrite": "advanced",

package/wire-changes/core@7.31.1.json

@@ -0,0 +1,189 @@
+{
+  "repo": "core",
+  "version": "7.31.1",
+  "from": "289b2d1998a3e890f6a8659ffc4397074ddd720a",
+  "to": "v7.31.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1094, memory store; +1 error code `memory.target_outside_store`, registered in `NON_GOVERNANCE_MEMORY_CODES`; +0 exports, +0 wire keys): an act at a memory store path is judged by where it LANDS, not by how it is spelled. One verdict — the target's DIRECTORY, resolved through every link on its existing prefix, must be the store root's physical form or inside it (the final component is not judged: the backend's `rm` removes a link standing there and `rename` replaces it, the engine's in-place writes refuse it with `ELOOP` — none follows it) — gates `FileMemoryEngineBackend.applyPatches` (per op at staging, the whole batch at the commit point, per op at each act), erasure (`MemoryEngine.eraseMemoryEntries`: commit point and act), journal replay (the whole journal before its first act, each op again at its act), and the engine's own writes at store paths: the copy-out projection, the harvest's missing-file restore, the read-only layer restore and the `MEMORY.md` index writes. The backend takes its root's physical form when it opens the store and re-checks it at the head of every face; the engine takes its memory dir's physical form at its first mount and a later mount that resolves elsewhere is refused. Separately, the engine's in-place write refuses a file with more than one name (a hard link), before anything is truncated. A refused `applyPatches` / erasure throws a plain `Error` whose `.code` is the new code — before the commit marker nothing is written and no journal is left, after it the journal is kept and replays once the path resolves inside again; a refused mount throws the code; a refused restore or index write is not performed and is reported on `HarvestReport.warnings` (or `incident.detail`) with the code, a hard-link refusal names the file. WHO IS HURT: a deployment whose store holds a directory link under its root, or a hard-linked memory file — the act that used to follow it is refused until it is removed. Known limits KL-1094-a … i."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1099, spawned-environment scrub; `SecretEnvFindingKind` +1 member `namespace-rule`, confidence `medium`; +0 exports, +0 wire keys): inside the host shell's `SEMA_` namespace, and only there, a credential word as ANY `_`-separated segment makes the name a credential (`SEMA_NAMESPACE_SECRET_RE`, over the one `CREDENTIAL_WORD` alternation the suffix rule reads, the count-word reading of `TOKENS` included) — so `SEMA_MODEL_KEY_<ENTRY>`, `SEMA_WEBSEARCH_KEY_<PROVIDER>` and `SEMA_REGISTRY_TOKEN_FILE` no longer reach a tool's child shell or a language server, and the one `config.secret_env_scrubbed` notice lists them in `detail.names`. The rule is consulted after the two exact-name lists and the suffix rule, so no existing finding changes kind, and every name outside `SEMA_` keeps its v7.31.0 verdict and kind. WHO IS HURT: a `SEMA_` name with a credential-word segment that a child needed (`SEMA_REGISTRY_TOKEN_FILE`, `SEMA_LLM_KEY_DB`, six `SEMA_CODE_*` knobs a nested `sema` reads); an `inheritEnv` allowlist, `shellEnv` / a per-exec env and a host-supplied LSP `env` still pass a name verbatim."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1100, shell read boundary; tightening only — no verdict loosens against 7.31.0; +0 exports, +0 wire keys; supersedes #1004's no-opener ruling for tilde values): three rules on one mechanism, the declared-home deny floor. (1) The opener condition leaves the assignment-value reading: an environment value with a leading tilde is placed against the declared home whether or not a program opens it, so `F=~/<deny row>; cat \"$F\"` meets the deny judge exactly as its `$HOME` and literal spellings already did. (2) A LITERAL tilde (quoted, escaped, after an option's `=`) — a relative `./~…` path to bash, but a program such as npm expands it itself — also carries its declared-home spelling as a deny-only view: refused on a deny row, never a containment question. (3) Each member of a `:` list meets the deny rows (a tilde member placed against the home); the whole value is still no containment candidate. Where no deny row is hit nothing changes. WHO IS HURT: a text whose value or literal-tilde operand names a deny row under the declared home and is never read that way is refused, as its `$HOME` and literal spellings already were (KL-1100a / KL-1100b)."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "SecretEnvFindingKind",
+      "at": [
+        "src/core/secret-env.ts:181"
+      ],
+      "newSet": false,
+      "added": [
+        "namespace-rule"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 216,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "config.secret_env_scrubbed",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.mandated",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "EngineNotice.detail",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "FileMemoryEngineBackend.applyPatches",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.incident",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.ok",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.restored",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.warnings",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryEngine.eraseMemoryEntries",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryEngine.materialize",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryErasureAttestation.status",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PatchReport.applied",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.confidence",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G2.a",
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.disposition",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.finding",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.readRootCandidate",
+      "assertions": [
+        "G3.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@c60beebe sdk@a9440f2 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 1 name(s) matched ONLY in bookkeeping files and were set aside (SecretEnvFindingKind)"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "c7c5484e2ab1b4abcba1297de62424e71306e66c"
+}