@sema-agent/core 7.38.0 → 7.38.1

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 7.38.1 — 2026-10-02
+
+**Hard-breaking changes:** none.
+
+**Closed sets:** none. **Package exports:** +0 / −0.
+
+### Home-anchored read-deny rows are placed under the account home as well as the child's `HOME` (#1244; behavior (tighten: the read deny table); +0 exports) (@server @cli @client-core @test)
+
+- **Before (v7.38.0).** The home-anchored rows of the read deny table (`~/.sema/settings.json`, `~/.ssh`, `~/.aws`, …) were placed under one home: the `HOME` the shell child receives (`ExecutionEnv.homeDir`; `NodeExecutionEnv` reads it off `shellEnv` over the inherited environment). A host that handed the child a temporary `HOME` moved the whole fence with it — the user's real home directory (the account database's, `os.userInfo().homedir`) held no row, and the structured read tools and the shell read station served `~/.sema/settings.json` there.
+- **Now.** `declaredReadDenyHomes` returns the declared home and, when its lexically normalized spelling differs, the account home. The home set is fixed ONCE per placement — the Runner's (per run), the library-direct toolkit's own, or a host's explicit `readDenyHomes` taken as the home set (the account database is then not asked and no home is added) — and every home of the set, looked up or listed, is anchored at its spelling and at its canonical spelling where the environment answered one — and every judgment reads that set: a judge carries the home views of the placement it was compiled at, so a path spelled through a firmlink or a bind mount of a home is respelled at the home without asking the account again. The Runner hands its tool band that placement itself — the very home list it returned carries its views — so the band never reads the homes a second time; a band handed any other list with the placement's links (a copy) holds its home-anchored rows at every location and says so on `console.warn` (an engine defect, never a silent narrower view). The DECLARED home keeps the v7.38.0 law: its probes wait the gate bound, a placement whose declared home did not answer holds the rows at every location and is asked again, and its directory chain is asked again by every judgment until it answers (a home created after the run began is read once it exists); its views stay under every answer of the account lookup, also under no answer, so a user's deny rule and the write face meet its aliases as in v7.38.0. The ACCOUNT home (and every entry of an explicit list that is not the declared home) is best effort and bounded: its canonical spelling, its identity chain and where its rows' heads lead are read once per placement under one 2000 ms bound; what answered is kept and only what did not is lost, that home's alone — a canonical spelling that answered anchors the rows there at once; a chain that did not answer leaves a path through an alias of the home judged as spelled, a head that did not answer adds no linked location, until the next placement; a canonical spelling that did not answer leaves the rows at the home's spelling alone — the placement stays whole, and one `console.warn` line says so. In the chain a directory that is a home (read off the home's own canonical directory, where its identity answered) keeps the home's own spelling over an ancestor's. A head under a spelling that is no directory — a file, a symlink to a file, a device node, a socket: the environment's path resolution answers `not_directory` — has nothing below it (an answer; before, only a plain file counted: a `HOME` that is a symlink to a file left the placement not whole, replayed on every call). The `~` expansion base is unchanged: `ExecutionEnv.homeDir` stays the directory the child's own `~` names. An environment that declares no absolute home still places nothing (a home-anchored row then holds its run anywhere); the account home is no stand-in for it.
+- **Who is hurt.** A read of a file under the account home that matches a home-anchored row (`~/.sema/settings.json`, `~/.ssh/…`, `~/.aws/…`) while the child's `HOME` is elsewhere: refused (`read_path_denied`) where it was served. A host that lists `readDenyHomes` itself sees the same placement, and its views now cover every listed home (v7.38.0 respelled aliases of the declared home only: an alias spelling of another listed home was served); its explicit list stays a legal channel and can be withdrawn once it carries nothing the default does not. A remote or sandboxed leg gets the engine host's account home as one more anchor: a row over a path that may not exist there. A deployment whose account lookup fails for a reason other than "no passwd row" gets the over-strict placement above (rows held at every location) until the lookup answers. A hung account home makes a placement wait up to 2 s more, once per placement (the Runner's tool band judges with the run's placement and reads no home again). A host that passes BOTH `readDenyHomes` and `readDenyHomeLinks` (a hand-built pair) is now taken for the engine's own handoff of a placement it cannot find: the home-anchored rows are held at every location and `console.warn` names it (v7.38.0 placed the rows at the listed homes); no sibling host makes that call — pass `readDenyHomes` alone and let the toolkit resolve where the heads lead. No sibling host lists one today: server's only home seat is the execution environment's `homeDir` (`boot/execution-env.ts`), so its deployments get the account home from this default with no change on its side.
+- **Compensation.** None needed for the common case (`HOME` equals the account home: one home, nothing changes). A deployment that really reads a file under its own account home that a row names lists the row in `readDenyBuiltinExclude`.
+- **Known limit (KL-1244-a).** The account lookup has three answers, the split the environment's `canonicalPath` already meets, and NOTHING is kept for the process: every placement asks afresh, and a placement's judgments never ask. A home places. **No account home** — `os.userInfo()` throws the libuv "no passwd row" error (`info.code === "ENOENT"`, a container that runs an arbitrary uid; also a directory service that is down and says so) or answers a non-absolute path — places the rows under the declared home alone, a whole placement; the missing row is not a fault and does not warn (a non-absolute answer warns once). A library-direct toolkit does not place again after a whole placement, so an account home that answers later is not placed for that toolkit's lifetime; the Runner's next run places it. **No answer** on the first placement — any other failure, whatever the error object looks like — says so once on `console.warn` and yields an EMPTY home list (`readDenyHomesOf`, `declaredReadDenyHomes`), the engine's rule for "no home known": the home-anchored rows hold their run at every location until the lookup answers (the project's own `.sema/settings.json` is refused too — over-strict, recoverable) and the placement is asked again at the next placement; the home views keep the declared home meanwhile. `readDenyHomesOf` returns `[]` both when the environment declares no home and when the lookup has no answer, so a host cannot tell them apart and should not cache the list: take it at every mount, or omit `readDenyHomes` and let the toolkit place itself. A toolkit whose table has no home-anchored row places nothing and its views read the declared home (or the list it is handed) without asking the account. A structured notice would be a closed-set row; a minor release carries it.
+- **Known limit (KL-1244-b).** An auxiliary home loses, until the next placement, exactly the parts that did not answer within its 2000 ms bound: a chain that did not answer — paths through an alias of it are judged as spelled; a head that did not answer — no linked location for it; a canonical spelling that did not answer — the rows sit at its spelling alone (neither its canonical spelling nor its linked targets are guarded). The next placement is the Runner's next run; a library-direct toolkit does not place again for that. A directory the probes may not enter (EACCES) is no answer: as the declared home it leaves the placement not whole (replayed per call; the rows stay at its spellings). **Known limit (KL-1244-d).** The public `judgeShellRead` has no placement to read — the boundary's deny seats are the host's own compile and the input carries no home list — so its views read the declared home and the account home looked up for that call; rows the host placed at another home get no alias views there (as in v7.38.0, whose public judgment read the declared home only); an optional input seat comes with a minor. **Known limit (KL-1244-c).** A user's own `~/` persisted permission rule (`Read(~/.aws/**)` …) still resolves against the environment's declared home only (`prepare-task.ts`, `prepare-policy-chain.ts`, `permission-rule-lanes.ts`); under a temporary `HOME` such a rule does not cover the real home directory. The built-in read deny table does.
+- Pins: `test/backlog1244-passwd-home.test.ts` — ① Read / `cat` / Grep / the library-direct toolkit over the account home with a temporary child `HOME` (baseline: served); ② the child's own `HOME` still guarded; ③ one home when both are the same; ④ the `~` expansion base is the child's `HOME`; ⑤ the lookup's answers — (i) ENOENT: declared home alone, whole, silent, the project's settings read; (ii) no answer on a direct toolkit: rows held anywhere, said once, placed again on the next read; (iii) the same on the Runner lane, per run; (iv) the views read the placement's homes — the declared home's chain under every answer, read once per placement, the account home's only when it answered; (v) every reader of the home list is empty under no answer, and a toolkit built from `readDenyHomesOf` holds the rows anywhere (the account home's file, the declared home's file and the project's settings refused, a plain file read), then carries both homes once the lookup answers; (vi) the `~` base is still the child's `HOME`; (vii) the failure is classified totally (an `info` / `message` getter or `toString` that throws, an unprintable value, a console that throws) and the tool call still ends with a frame; a non-absolute answer is a bad value, said once; ⑥ no declared home ⇒ no placement; ⑦ the account home reached through a mount that the declared home lies below (Read / `cat` / Grep refused; the view of a path through the mount is the account home's spelling), also when the declared home's own identity probe fails; ⑧ the placement read the account home, then the lookup fails (EMFILE): the alias spellings of both homes are still refused (toolkit and Runner), nothing is kept for the process and a placement's judgments ask the account 0 times, an account home that does not exist or is a plain file is an answer (the chain read once, the placement whole). `test/backlog1244-home-view-snapshot.test.ts` (baseline car-7381: 10 of 11 red) — T1–T3 a placement that answered (ENOENT / a bad value) then a failing lookup: the declared home's alias refused (toolkit, Runner: Read / `cat` / Grep); R3a an explicit `[H, A]` under a lookup that never answers: both aliases refused, the account asked 0 times; R3b an account home whose path probe hangs: the first judgment ends under 3 s, the declared home's alias and the account home's own file refused, the project's settings read, the Runner's run not failed; R3c an account home whose probe fails: probed by the placement only, the project's settings read; Q1 under no answer a user's Read deny rule and an Edit deny rule (the write face) meet the declared home's alias; Q2 a declared home created after the placement is read once it exists; N a declared home that is a symlink to a file, a device node or a socket: a whole placement, not replayed; a directory the probe may not enter is no answer; R2 an account home that answers after a whole placement is not placed by the toolkit (the account not asked), the Runner's next run places it; R4 the account home's probe answers the run's placement and fails afterwards: Read / Grep / Glob through its alias refused on the Runner lane, its chain read once per run; a carried copy of the list holds the rows anywhere and is named; a host's own list is read once by the toolkit itself; R6 a host's list `[H, A-link]` whose A-link answers its canonical spelling while its chain and heads are slow: Read / Grep of A-real refused, the anchors carry A-real; a symlinked declared home in a list is anchored at its canonical spelling too; a list of real directories is placed at exactly the list; R5 a symlinked account home whose canonical spelling answers at once and whose chain is slow: anchored at the real path (a Grep over the link, a Read and a `cat` of the real path refused), a canonical probe that hangs leaves the spelling alone, `readDenyHomesOf` lists the placement's anchors. `test/backlog-r2-default-tiers.test.ts` asserts the whole homes list.
+
+### The text-repair lane's fallback tool-call id never carries the tool's name (#1219; behavior (the id's shape); +0 exports) (@server @test)
+
+- **Before (v7.38.0).** `repairTextToolCalls` minted `repair_<tool name>_<body>`. A roster name is only length-bounded (1–128), so a non-ASCII name or a 120-character name made an id outside the admitted shape that every native lane's id is held to, with no fold and no notice.
+- **Now.** The prefix is the constant `repair_` (as `toolu_` / `call_` are): `repair_<opaque body>`, in the admitted shape, kept verbatim by `admitToolCallId`; the id no longer names the tool. Off by default (`createOpenAIBrain({ repairTextToolCalls: true })`).
+- **Who is hurt.** A consumer that parsed a repaired call's tool name out of its id, or matched `^repair_<name>_`. Nothing in the engine does.
+- **Compensation.** Read the call's `name`.
+- Pins: `test/backlog1219-repair-fallback-id.test.ts` (non-ASCII, 120-character, fold-separator and space names; the openai lane end to end); `test/brain-protocol-coverage.test.ts` re-pinned.
+
+### Docs: which of a call's names a host's own by-name policy reads (#1220; docs only; +0 exports)
+
+`docs/INTEGRATION-CORE.md` §4.6f: a tightening policy (deny, ask, require approval) reads the whole of `ruleNamesOf(req)`; a loosening one (allow, auto-approve) reads `toolName`, the wire name. No code change; `ruleNamesOf` was already exported.
+
+### Contract sentence: the `crashed` cause of `task.user_steer_undrained` (docs only) (@server @cli @client-core)
+
+- `USER_STEER_UNDRAINED_CAUSES` member `crashed` now reads "accepted by the serving layer and not confirmed consumed before the process died" (was "never consumed"). A live leg gives the serving layer no evidence that a steer reached the model, so the arm cannot claim the steer was never consumed; a consumer must not tell the person to re-send without checking the run's transcript. No code, word or shape change. The consumption evidence itself is a separate change (#1273).
+
+
 ## 7.38.0 — 2026-10-01
 
 **Hard-breaking changes:** none.

package/dist/brain/tool-call-repair.js

@@ -42,7 +42,7 @@ function extractCall(obj, toolNames, framed) {
     }
     return {
         type: "toolCall",
-        id: mintFallbackToolCallId(`repair_${name}_`),
+        id: mintFallbackToolCallId("repair_"),
         name,
         arguments: args,
     };

package/dist/core/engine-notice.d.ts

@@ -395,7 +395,7 @@ export interface EngineNotice {
      *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, taskId?, sessionId?, runId? }`
      *    (`cause` on the steer row only, closed `USER_STEER_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
-     *    session's next run, for steers it had accepted and the dead process never consumed: their queue was the
+     *    session's next run, for steers it had accepted whose consumption was not confirmed before the process died: their queue was the
      *    serving layer's, so only it can count them. One code for both, so a consumer de-duplicating on `code` keeps
      *    one row; `sessionId` = #433's routing half for these two `"user"`-audience rows; `runId` = #499's
      *    per-run identity, the key this account is actually about — see
@@ -952,10 +952,11 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
     runId?: string;
 }, onNotice: ((notice: EngineNotice) => void) | undefined): void;
 /**
- * Why a person's steer was never consumed — `task.user_steer_undrained`'s `detail.cause`. Closed:
+ * Why a person's steer is reported as not consumed — `task.user_steer_undrained`'s `detail.cause`. Closed:
  *  · `leg_end` — the leg ended with the steer still owed (this engine mints it, at the leg's settlement);
  *  · `crashed` — the engine process ended before the leg settled, and a steer the serving layer had accepted for it was
- *    lost with the process. Only the serving layer can count that loss (the queue was its own), so the serving layer
+ *    not confirmed consumed before the process died (a live leg gives the serving layer no evidence that a steer reached
+ *    the model, so such a steer MAY have been consumed). Only the serving layer can count these (the queue was its own), so the serving layer
  *    mints this arm, before the next run of the session starts — the one member-level exception to
  *    {@link import("./governance-codes.js").NOTICE_MINTER}'s row for the code, which stays `"engine"`.
  */

package/dist/core/runner/prepare-artifact.d.ts

@@ -18,7 +18,8 @@ import type { OnAsk } from "../tool-policy.js";
 import { type ArtifactPlane } from "../artifact-host.js";
 import { RosterBuilder } from "../tool-roster.js";
 import type { AgentTool, RunnerDeps } from "../types.js";
-import type { ReadDenyMatcher, ContainmentFace } from "../../tools/fs/index.js";
+import type { ContainmentFace } from "../../tools/fs/index.js";
+import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ArtifactStoreRef } from "./read-root-grant.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareArtifactInput {
@@ -46,7 +47,7 @@ export interface PrepareArtifactInput {
      *  live set: an in-flight read-root grant widens it). */
     additionalRootsCanonical: () => readonly string[];
     /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
-    readDenyMatcher: ReadDenyMatcher | undefined;
+    readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,5 +1,6 @@
-import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type PathRuleDenyRow, type ContainmentFace } from "../../tools/fs/index.js";
+import { type BeforeWriteHook, type CwdRef, type PathRuleDenyRow, type ContainmentFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
+import { type PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ShellReadAdmission, type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
@@ -254,8 +255,8 @@ export interface PrepareHandsReadFaceResult {
      *  reader applies the same containment the hands tools do. Undefined ⇔ hands-less. */
     attachmentRootCanonical: string | undefined;
     /** owned — the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
-     *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
-    readDenyMatcher: ReadDenyMatcher | undefined;
+     *  task additions), carrying the home views of its placement. Undefined ⇔ hands-less (its consumers only exist with hands). */
+    readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
      *  boundary + shape tier + shellGate floor) is the SOLE POSITIVE source of — no explicit deployment mark on that name.
      *  The one seat every consumer reads (risk grading, the gate's tighten attribution, the persisted-rule mandate

package/dist/core/runner/prepare-hands-readface.js

@@ -313,6 +313,7 @@ export async function prepareHandsMount(input) {
                 tools: shellReadTools,
                 seatOf: () => (handsReadOnly ? "readonly" : "full_shell"),
                 boundaryOf: () => readonlyBoundary() ?? shellReadBoundary(), rootsCanonical: true,
+                homeViews: readDenyPlacement.matcher.homeViews,
             });
         }
         if (!handsReadOnly) {

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -10,7 +10,7 @@ import { type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContainmentFace } from "../../tools/fs/index.js";
-import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
+import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareTurnWiringInput {
@@ -70,7 +70,7 @@ export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the canonical extra read roots (the fence's root set). */
     additionalReadRootsCanonical: ReadonlyArray<string>;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the reader's withheld arm). */
-    readDenyMatcher: ReadDenyMatcher | undefined;
+    readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face, or undefined (the fence's ninth argument). */
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the kept-tail normalizer (never written here). */

package/dist/tools/fs/fs-shared.d.ts

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type FsViolation, type ReadFileState } from "./safety.js";
 import { type DecodedTextFile } from "./encoding.js";
+import { type HomeViewsCarrier } from "./read-deny-home.js";
 import { type ImageDownsampler } from "../../core/mcp.js";
 import { type EngineNotice } from "../../core/types.js";
 /**
@@ -543,7 +544,7 @@ export declare function enoentMessage(env: ExecutionEnv, key: string, cwd: strin
     matchPath(path: string): {
         pattern: string;
     } | null;
-}): Promise<string>;
+} & HomeViewsCarrier): Promise<string>;
 /** Per-task mutable working directory shared by the shell and the path-taking fs tools.
  *  Holds the RAW path (never canonicalized): bash `cd` updates `current`, and the fs tools resolve relative
  *  paths against it. Containment is still enforced per-op by resolveKey (canonicalize + within), so a `cd`

package/dist/tools/fs/fs-shared.js

@@ -345,7 +345,7 @@ export function applyContextShrinkToReadFileState(state, shrink) {
 export async function enoentMessage(env, key, cwd, signal, readDeny) {
     let msg = `File does not exist. Note: your current working directory is ${cwd}.`;
     const sep = Math.max(key.lastIndexOf("/"), key.lastIndexOf("\\"));
-    const views = readDeny !== undefined ? homeViewsOf(env, signal) : undefined;
+    const views = readDeny !== undefined ? homeViewsOf(env, readDeny, signal) : undefined;
     const denied = async (path, leaf) => {
         if (readDeny === undefined || views === undefined)
             return false;

package/dist/tools/fs/index.d.ts

@@ -186,17 +186,24 @@ export interface HandsToolkitOptions {
      *  time (never silently ignored). Deployment seat ONLY, same clamp argument as the tiers key. */
     readDenyBuiltinExclude?: readonly string[];
     /** The spellings of the execution environment's home a home-anchored deny row (`~/…`) is placed under
-     *  ({@link import("./read-deny-home.js").readDenyHomesOf}: the declared home and its canonical spelling). Absolute path
-     *  strings only — any other shape throws at wiring time, naming the seat. The Runner passes the spellings its own judge
-     *  was compiled with. */
+     *  ({@link import("./read-deny-home.js").readDenyHomesOf}: the declared home and the account home, each with its canonical
+     *  spelling). Absolute path strings only — any other shape throws at wiring time, naming the seat. The Runner passes the
+     *  spellings its own judge was compiled with. A list given here is the band's home set as is: the account database is
+     *  not asked and no home is added (each listed home is anchored at its spelling and, where the environment answers one,
+     *  its canonical spelling), and the band's home views (a path spelled through a firmlink or a bind mount of a home,
+     *  judged at the home) read this list and the environment's declared home; an entry that is not the declared home is probed once,
+     *  under a short bound of its own, and a probe of it that fails costs that entry alone. */
     readDenyHomes?: readonly string[];
     /** Where each home-anchored row's literal head leads beyond the home's spellings
      *  ({@link import("./read-deny-home.js").readDenyHomeLinksOf}, keyed by the row's pattern) — the Runner passes the
      *  locations its own judge was compiled with, so the band and the gate judge one placement.
      *  Unless a mount carries both, the band resolves the placement itself the way the Runner does (the homes it carries
-     *  are used as given; {@link import("./read-deny-home.js").placeReadDenyAtHome}), and its read tools (Read / Grep /
-     *  Glob / RepoMap) wait for that placement before they judge anything. A placement that fails leaves the home-anchored
-     *  rows held anywhere. */
+     *  are its home set — the account is not asked and no home is added;
+     *  {@link import("./read-deny-home.js").placeReadDenyAtHome}), and its read tools (Read / Grep / Glob / RepoMap) wait
+     *  for that placement before they judge anything. A placement that fails leaves the home-anchored rows held anywhere.
+     *  Carrying both is the engine's own handoff of ONE placement — its home views travel with it — so
+     *  `readDenyHomes` must then be the very list that placement returned: any other list (a copy) holds the home-anchored
+     *  rows at every location and is named on `console.warn`. */
     readDenyHomeLinks?: ReadonlyMap<string, readonly string[]>;
     /** The permission-rule rows of the deny table ({@link import("./read-deny.js").PathRuleDenyRow}, `ToolPolicy.pathDenyRules`):
      *  the read-face rows join the structured read faces' judge beside the segment rows. The Runner passes the leg's own. */

package/dist/tools/fs/index.js

@@ -16,7 +16,7 @@ import { BASH_READONLY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, readDenyBuiltinConfigOf, readDenyPatternRun } from "./read-deny.js";
 import { withGateTimeout } from "../../core/gate-bounded-await.js";
-import { placeReadDenyAtHome, readDenyPlacedLater } from "./read-deny-home.js";
+import { carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";
 import {} from "./fs-shared.js";
@@ -48,9 +48,17 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
     const compileAt = (homes, linked) => compileReadDeny(readDenyAdditions, "HandsToolkitOptions.readDenyPatterns", readDenyBuiltinCfg, readDenyRules, homes, linked);
     const unplaced = compileAt([]);
     const carried = readDenyHomes !== undefined && opts.readDenyHomeLinks !== undefined;
+    const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
+    if (carried && carriedViews === undefined)
+        sayPlacementLost();
     const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored);
-    const late = carried || placesNothing ? undefined : readDenyPlacedLater(unplaced, () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
-    const readDeny = late?.matcher ?? (carried ? compileAt(readDenyHomes, opts.readDenyHomeLinks) : unplaced);
+    const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
+    const readDeny = late?.matcher ??
+        (carried
+            ? carriedViews !== undefined
+                ? carryHomeViews(compileAt(readDenyHomes, opts.readDenyHomeLinks), carriedViews)
+                : carryHomeViews(unplaced, homeViewsAt(env, []))
+            : carryHomeViews(unplaced, homeViewsAt(env, readDenyHomes ?? [])));
     const afterPlacement = (tool) => late === undefined
         ? tool
         : {
@@ -61,7 +69,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
             },
         };
     const writeDenyCompiled = compileWriteDeny(readDenyRules);
-    const writeDeny = writeDenyCompiled.ruleRows.length > 0 ? writeDenyCompiled : undefined;
+    const writeDeny = writeDenyCompiled.ruleRows.length > 0 ? carryHomeViews(writeDenyCompiled, readDeny.homeViews) : undefined;
     const readFace = resolveContainmentFace({
         kind: "read",
         depsFace: opts.readFace,

package/dist/tools/fs/read-deny-home.d.ts

@@ -1,12 +1,18 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PathFamily } from "./safety.js";
 import { type ReadDenyMatcher } from "./read-deny.js";
-/** The environment's DECLARED home as an anchor list: `[homeDir]` when it declares an absolute one, else `[]` (no
- *  home — a home-anchored row then holds its run anywhere, see `compileReadDeny`). */
+/** The one bound every probe of an AUXILIARY home shares within one placement (see the module head): long enough for a
+ *  local directory's canonical spelling, its chain of identities and its rows' heads, short enough that a hung home
+ *  costs a placement seconds, not the gate's bound. */
+export declare const AUXILIARY_HOME_PROBE_MS = 2000;
+/** {@link declaredReadDenyHomesAnswered}'s anchor list. */
 export declare function declaredReadDenyHomes(env: Pick<ExecutionEnv, "homeDir">): string[];
-/** The declared home and, where the environment's canonical spelling of it differs (a home reached through a
- *  symlink), that spelling too: the faces judge canonical keys beside the spelled views, so a row placed only at
- *  the spelled home would never meet a canonical key. A home the environment cannot resolve keeps its spelling. */
+/** The declared home and the account home ({@link declaredReadDenyHomes}) and, where the environment's canonical
+ *  spelling of one differs (a home reached through a symlink), that spelling too: the faces judge canonical keys beside
+ *  the spelled views, so a row placed only at the spelled home would never meet a canonical key. A home the
+ *  environment cannot resolve keeps its spelling — the account home's probe waits at most {@link AUXILIARY_HOME_PROBE_MS}.
+ *  `[]` — the rows hold their run at every location — where the environment declares no home, where the account lookup
+ *  gave no answer, or where the declared home's own probe did not answer (ask again later). */
 export declare function readDenyHomesOf(env: Pick<ExecutionEnv, "homeDir" | "canonicalPath">, signal?: AbortSignal): Promise<string[]>;
 /**
  * Where the home-anchored rows of a table LEAD beyond the home's own spellings, keyed by the row's pattern — the
@@ -15,16 +21,20 @@ export declare function readDenyHomesOf(env: Pick<ExecutionEnv, "homeDir" | "can
  * (`canonicalizeTarget`: the longest existing prefix resolved, the rest rejoined); a location that differs from every
  * home's own spelling of the head is where one of the head's segments is a link, and the row is placed there too.
  *  · a head that resolves to its own spelling under a home adds nothing (the row is already placed there);
- *  · a head that cannot be resolved (an unanswered or refused probe, a probe that throws) adds nothing, and the answer
- *    is not WHOLE (`whole: false`): the row stays placed at the home's spellings until the mount places again;
+ *  · a head under a spelling that is no directory (a segment of it is a file, a symlink to a file, a device node or a
+ *    socket — the environment answers `not_directory` for the head) has nothing below it: an answer that adds nothing;
+ *  · any other head that cannot be resolved (an unanswered or refused probe — a directory the probe may not enter — a
+ *    probe that throws) adds nothing, and the answer is not WHOLE (`whole: false`): the row stays placed at the home's
+ *    spellings until the mount places again;
  *  · a row whose head is empty (`~/.sema.*`) has no location to resolve and adds nothing;
- *  · the heads are resolved together, so one placement waits at most one probe bound;
+ *  · the heads are resolved together, so one placement waits at most one probe bound — or, with `deadline` (an absolute
+ *    time), each head until then: a head still unresolved at the deadline is a head that did not answer;
  *  · read per placement — a link created afterwards is followed from the next placement on.
  */
 export declare function readDenyHomeLinksOf(env: ExecutionEnv, entries: readonly {
     readonly pattern: string;
     readonly caseSensitive?: boolean;
-}[], homes: readonly string[], signal?: AbortSignal): Promise<{
+}[], homes: readonly string[], signal?: AbortSignal, deadline?: number): Promise<{
     readonly linked: Map<string, string[]>;
     readonly whole: boolean;
 }>;
@@ -38,15 +48,81 @@ export declare function whereItLeads(env: ExecutionEnv, at: string, family?: Pat
  *  placed narrower than that base's own canonical spelling. The whole walk waits at most one bounded-await deadline.
  *  `undefined` when no prefix answers in time. */
 export declare function whereItsAnsweredPrefixLeads(env: ExecutionEnv, at: string, family?: PathFamily, signal?: AbortSignal): Promise<string | undefined>;
-/** One mount's read-deny judge with its home-anchored rows placed: at the home's spellings (`homes` when the mount
- *  carries them, else {@link readDenyHomesOf}, under the tree's bounded-await deadline — an environment that cannot
- *  answer rejects the placement instead of holding it open) and where their heads lead ({@link readDenyHomeLinksOf}).
- *  `whole` says whether the home and every head answered. A home the environment did not answer for places nothing:
- *  the rows are held anywhere (`compile([])`, the rule for a row that cannot be placed) rather than at a spelling that
- *  may miss the home's canonical one. `compile` is the mount's own compile over the two; the rows' patterns are read
- *  off its compile at the homes alone. */
+/** The environment surface a home view reads. */
+export type HomeViewEnv = Pick<ExecutionEnv, "homeDir" | "canonicalPath" | "fileIdentity">;
+/**
+ * The HOME VIEWS of one placement — the one reader every face that judges a deny row by location uses (the structured
+ * read and write tools' target judgment, the shell station's establishment, the search walker, the ripgrep leg's output
+ * check and its scope choice). A judge carries the source its placement made ({@link HomeViewsCarrier}); a judgment
+ * takes one {@link HomeViews} from it ({@link homeViewsOf}).
+ *
+ * The view of a path is the path itself when it IS a directory on a home's chain (each home's canonical spelling and
+ * each of its ancestors, matched by {@link ExecutionEnv.fileIdentity}) — that directory's canonical spelling — and
+ * otherwise its parent's view with its own name rejoined. One identity keeps ONE spelling, and a row is placed at a
+ * HOME's spelling: a directory that IS a home (its own identity answered) keeps the home's own spelling over an
+ * ancestor's (a declared home below a mount of the account home meets the account home's identity at an ancestor); a
+ * home whose own identity did not answer has no directory to claim. Homes in order: the declared home, then the
+ * auxiliary homes. The homes are the placement's:
+ *  · the DECLARED home (`env.homeDir`, no lookup) is always among them — whatever the account lookup answered — and its
+ *    chain is read by the first judgment that asks, kept once every level answered, and asked again by the next
+ *    judgment otherwise (a home that does not exist yet is read once it does);
+ *  · each AUXILIARY home's chain is the one its placement read, once ({@link AUXILIARY_HOME_PROBE_MS}); a chain that did
+ *    not answer stays unanswered for that placement.
+ */
+export interface HomeViewSource {
+    /** The home views of one judgment (a tool call, a command's establishment, one search): a view per directory is read
+     *  once and shared by every path below it. */
+    views(signal?: AbortSignal): HomeViews;
+}
+/** A judgment's views. `of` answers the view only where it differs from the path as spelled; `undefined` otherwise, and
+ *  wherever it cannot be read: no `fileIdentity` seat, no home, a level of the path whose identity fails (the path is
+ *  judged as spelled, never wider). A level that does not exist (a write's missing tail) takes its parent's view.
+ *  `leaf: "file"` skips the path's own identity (a file is never a directory on the chain). */
+export interface HomeViews {
+    of(path: string, opts?: {
+        readonly leaf?: "file";
+    }): Promise<string | undefined>;
+}
+/** A judge that carries the home views of the placement its rows were compiled at. */
+export interface HomeViewsCarrier {
+    readonly homeViews?: HomeViewSource;
+}
+/** A read deny judge with its placement's home views. */
+export type PlacedReadDenyMatcher = ReadDenyMatcher & {
+    readonly homeViews: HomeViewSource;
+};
+/** The views of the placement that returned `homes` — the very list object, as the engine hands it on (the Runner's
+ *  tool band). `undefined` for any other list: a copy, or a host's own. A mount that was handed the engine's placement
+ *  and cannot find its views has lost it: an engine defect, which the mount names ({@link sayPlacementLost}) and answers
+ *  by holding its home-anchored rows at every location — never by reading the homes a second time. */
+export declare function placementViewsOf(homes: readonly string[]): HomeViewSource | undefined;
+/** The line a mount says when the engine handed it a home list that is not its placement's (an engine defect, said every
+ *  time: no latch). */
+export declare function sayPlacementLost(): void;
+/** The home views over a home list fixed now — a mount that places nothing itself (a toolkit handed its placement, or
+ *  one whose table has no home-anchored row) and the public shell judgment: the declared home, and every entry of
+ *  `homes` that is not the declared home as an auxiliary home, read once, at once. */
+export declare function homeViewsAt(env: HomeViewEnv, homes: readonly string[]): HomeViewSource;
+/** The home views of one judgment, off the judge it judges with: the views of the judge's placement. A judge that
+ *  carries none (one built outside a mount) reads the declared home alone. */
+export declare function homeViewsOf(env: HomeViewEnv, judge: HomeViewsCarrier | undefined, signal?: AbortSignal): HomeViews;
+/** A judge with the home views `source` gives it. */
+export declare function carryHomeViews<T extends object>(judge: T, source: HomeViewSource): T & {
+    readonly homeViews: HomeViewSource;
+};
+/** One mount's read-deny judge with its home-anchored rows placed, and the home views of that placement:
+ *  · the HOME SET — `homes` when the mount carries a list (the account is not asked and no home is added), else the
+ *    declared home and the account lookup's answer ({@link declaredReadDenyHomes}); every home of the set is anchored at
+ *    its spelling and, where the environment answered one, its canonical spelling — one rule for both forms;
+ *  · the DECLARED home's canonical spelling under the tree's gate bound, and its rows' heads ({@link readDenyHomeLinksOf}):
+ *    a declared home, or a head under it, that did not answer leaves the placement not WHOLE — and an account lookup
+ *    with no answer, or a declared home that did not answer, places nothing: the rows are held anywhere (`compile([])`)
+ *    rather than at a spelling that may miss the home's canonical one;
+ *  · each AUXILIARY home (see the module head) read once under {@link AUXILIARY_HOME_PROBE_MS} — its spellings, its
+ *    chain, its rows' heads — at the same time; whatever of it did not answer costs that home alone and never `whole`.
+ *  `compile` is the mount's own compile; the rows' patterns are read off its compile at no home. */
 export declare function placeReadDenyAtHome(env: ExecutionEnv, compile: (homes: readonly string[], linked?: ReadonlyMap<string, readonly string[]>) => ReadDenyMatcher, homes?: readonly string[], signal?: AbortSignal): Promise<{
-    readonly matcher: ReadDenyMatcher;
+    readonly matcher: PlacedReadDenyMatcher;
     readonly homes: readonly string[];
     readonly linked: ReadonlyMap<string, readonly string[]>;
     readonly whole: boolean;
@@ -58,36 +134,13 @@ export declare function placeReadDenyAtHome(env: ExecutionEnv, compile: (homes:
  * (either way) and, while no placement has come back WHOLE (a failed one, or one with a head that did not answer),
  * places again first — an unanswered lookup is never kept as the answer. A failed placement leaves the table it
  * replaced (the rows held anywhere, or an earlier placement), never unplaced-and-narrow. The mount holds its read faces
- * until `ready()`.
+ * until `ready()`. The judge's home views are the latest settled placement's: a judgment that asks for one waits for the
+ * placement in flight (it never starts one).
  */
-export declare function readDenyPlacedLater(unplaced: ReadDenyMatcher, place: () => Promise<{
-    readonly matcher: ReadDenyMatcher;
+export declare function readDenyPlacedLater(unplaced: PlacedReadDenyMatcher, place: () => Promise<{
+    readonly matcher: PlacedReadDenyMatcher;
     readonly whole: boolean;
 }>): {
-    readonly matcher: ReadDenyMatcher;
+    readonly matcher: PlacedReadDenyMatcher;
     readonly ready: () => Promise<void>;
 };
-/** The environment surface a home view reads. */
-export type HomeViewEnv = Pick<ExecutionEnv, "homeDir" | "canonicalPath" | "fileIdentity">;
-/**
- * A path's HOME VIEW — the one reader every face that judges a deny row by location uses (the structured read and
- * write tools' target judgment, the shell station's establishment, the search walker, the ripgrep leg's output check
- * and its scope choice). The view of a path is the path itself when it IS a directory on the home's chain (the
- * canonical home and each of its ancestors, matched by {@link ExecutionEnv.fileIdentity}) — that directory's
- * canonical spelling — and otherwise its parent's view with its own name rejoined. `of` answers the view only where
- * it differs from the path as spelled; `undefined` otherwise, and wherever it cannot be read:
- *  · the environment declares no home, no `fileIdentity`, or its home does not resolve ⇒ no view (the spelling form);
- *    a home, or a level of its chain, that could not be read is asked again by the next judgment — an unanswered
- *    lookup is never kept as the answer;
- *  · a level that does not exist (a write's missing tail) has no identity of its own and takes its parent's view;
- *  · any other failure at a level stops the view there: the path is judged as spelled, never wider.
- * `leaf: "file"` skips the path's own identity (a file is never a directory on the chain).
- */
-export interface HomeViews {
-    of(path: string, opts?: {
-        readonly leaf?: "file";
-    }): Promise<string | undefined>;
-}
-/** The home views of one judgment (a tool call, a command's establishment, one search): a view per directory is read
- *  once and shared by every path below it. */
-export declare function homeViewsOf(env: HomeViewEnv, signal?: AbortSignal): HomeViews;

package/dist/tools/fs/read-deny-home.js

@@ -1,23 +1,106 @@
+import { userInfo } from "node:os";
 import { canonicalizeTarget, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "../../core/gate-bounded-await.js";
+import { thrownText } from "../../core/thrown-value.js";
 import { readDenyPatternRun, readDenyRunHead } from "./read-deny.js";
-export function declaredReadDenyHomes(env) {
-    const home = env.homeDir;
-    return home !== undefined && isAbsolutePathForm(home) ? [home] : [];
+export const AUXILIARY_HOME_PROBE_MS = 2_000;
+const said = new Set();
+function sayOnce(kind, line) {
+    if (said.has(kind))
+        return;
+    said.add(kind);
+    try {
+        console.warn(line);
+    }
+    catch {
+    }
 }
-export async function readDenyHomesOf(env, signal) {
-    return (await readDenyHomesAnswered(env, signal)).homes;
+function isNoAccountRow(e) {
+    try {
+        const info = typeof e === "object" && e !== null ? e.info : undefined;
+        return typeof info === "object" && info !== null && info.code === "ENOENT";
+    }
+    catch {
+        return false;
+    }
 }
-async function readDenyHomesAnswered(env, signal) {
-    const home = declaredReadDenyHomes(env)[0];
+function valueText(v) {
+    try {
+        return JSON.stringify(v) ?? String(v);
+    }
+    catch {
+        return typeof v;
+    }
+}
+function accountHomeOf() {
+    try {
+        const home = userInfo().homedir;
+        if (typeof home === "string" && isAbsolutePathForm(home))
+            return { state: "home", home };
+        sayOnce("bad_value", `read-deny homes: the account home lookup answered ${valueText(home)}, not an absolute path — home-anchored read-deny rows are placed under the environment's declared home only.`);
+        return { state: "none" };
+    }
+    catch (e) {
+        if (isNoAccountRow(e))
+            return { state: "none" };
+        sayOnce("unanswered", `read-deny homes: the account home could not be read (${thrownText(e)}) — home-anchored read-deny rows hold their run at every location until the lookup answers.`);
+        return { state: "unanswered" };
+    }
+}
+function declaredHomeOf(env) {
+    const home = env.homeDir;
+    return home !== undefined && isAbsolutePathForm(home) ? home : undefined;
+}
+function declaredReadDenyHomesAnswered(env) {
+    const home = declaredHomeOf(env);
     if (home === undefined)
         return { homes: [], whole: true };
-    const canonical = await env.canonicalPath(home, signal);
-    if (canonical.ok)
-        return { homes: canonical.value !== home ? [home, canonical.value] : [home], whole: true };
-    return { homes: [home], whole: canonical.error.code === "not_found" || canonical.error.code === "not_directory" };
+    const account = accountHomeOf();
+    if (account.state === "unanswered")
+        return { homes: [], whole: false };
+    if (account.state === "none" || normalizeAbsPathLexically(account.home) === normalizeAbsPathLexically(home))
+        return { homes: [home], whole: true };
+    return { homes: [home, account.home], whole: true };
+}
+export function declaredReadDenyHomes(env) {
+    return declaredReadDenyHomesAnswered(env).homes;
+}
+function isDeclared(declared, home) {
+    return declared !== undefined && normalizeAbsPathLexically(home) === normalizeAbsPathLexically(declared);
 }
-export async function readDenyHomeLinksOf(env, entries, homes, signal) {
+async function homeSpellingsOf(env, home, signal) {
+    try {
+        const canonical = await env.canonicalPath(home, signal);
+        if (canonical.ok)
+            return { spellings: canonical.value !== home ? [home, canonical.value] : [home], canonical: canonical.value, answered: true };
+        return { spellings: [home], answered: canonical.error.code === "not_found" || canonical.error.code === "not_directory" };
+    }
+    catch {
+        return { spellings: [home], answered: false };
+    }
+}
+export async function readDenyHomesOf(env, signal) {
+    const listed = declaredReadDenyHomesAnswered(env);
+    const [declared, ...auxiliary] = listed.homes;
+    if (!listed.whole || declared === undefined)
+        return [];
+    const [own, ...others] = await Promise.all([
+        homeSpellingsOf(env, declared, signal),
+        ...auxiliary.map((home) => until(homeSpellingsOf(env, home, signal), Date.now() + AUXILIARY_HOME_PROBE_MS, signal).then((r) => r ?? { spellings: [home], answered: false })),
+    ]);
+    if (!own.answered)
+        return [];
+    if (others.some((r) => !r.answered))
+        sayAuxiliary("its path probe did not answer");
+    return [...new Set([...own.spellings, ...others.flatMap((r) => r.spellings)])];
+}
+async function until(work, deadline, signal) {
+    return await withGateTimeout(work, Math.max(0, deadline - Date.now()), signal, "auxiliaryHome").catch(() => undefined);
+}
+function sayAuxiliary(what) {
+    sayOnce("auxiliary", `read-deny homes: a home beside the environment's declared home did not answer its probes within ${AUXILIARY_HOME_PROBE_MS} ms (${what}) — its home-anchored read-deny rows sit at its spelling only, and a path through an alias of it is judged as spelled, until the next placement.`);
+}
+export async function readDenyHomeLinksOf(env, entries, homes, signal, deadline) {
     const rows = [];
     const familyOf = new Map();
     for (const { pattern, caseSensitive } of entries) {
@@ -35,7 +118,8 @@ export async function readDenyHomeLinksOf(env, entries, homes, signal) {
         });
         rows.push({ pattern, caseSensitive: caseSensitive === true, spelled });
     }
-    const resolved = new Map(await Promise.all([...familyOf].map(async ([at, family]) => [at, await whereItLeads(env, at, family, signal)])));
+    const leadOf = async (at, family) => (await whereItLeads(env, at, family, signal)) ?? ((await holdsNothingBelow(env, at, signal)) ? at : undefined);
+    const resolved = new Map(await Promise.all([...familyOf].map(async ([at, family]) => [at, deadline === undefined ? await leadOf(at, family) : await until(leadOf(at, family), deadline, signal)])));
     const out = new Map();
     const whole = [...resolved.values()].every((location) => location !== undefined);
     for (const { pattern, caseSensitive, spelled } of rows) {
@@ -52,6 +136,10 @@ export async function readDenyHomeLinksOf(env, entries, homes, signal) {
     }
     return { linked: out, whole };
 }
+async function holdsNothingBelow(env, at, signal) {
+    const probe = await withGateTimeout(Promise.resolve().then(() => env.canonicalPath(at, signal)), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHead").catch(() => undefined);
+    return probe !== undefined && !probe.ok && probe.error.code === "not_directory";
+}
 export async function whereItLeads(env, at, family = pathFamilyOf({ root: at }), signal) {
     try {
         const key = await canonicalizeTarget(env, at, signal, family);
@@ -77,17 +165,189 @@ export async function whereItsAnsweredPrefixLeads(env, at, family = pathFamilyOf
     };
     return await withGateTimeout(walk(), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "ruleRowHead").catch(() => undefined);
 }
+const NO_CHAIN = { ancestors: [], whole: false };
+async function chainAbove(env, identity, canonical, signal, deadline) {
+    let own;
+    const ancestors = [];
+    let whole = true;
+    for (let dir = normalizeAbsPathLexically(canonical), first = true;; first = false) {
+        const id = deadline === undefined ? await identityOf(env, identity, dir, signal) : await until(identityOf(env, identity, dir, signal), deadline, signal);
+        if (id === undefined && deadline !== undefined && Date.now() >= deadline) {
+            whole = false;
+            break;
+        }
+        if (id?.ok !== true)
+            whole = false;
+        else if (first)
+            own = { dir, id: id.value };
+        else
+            ancestors.push({ dir, id: id.value });
+        const parent = normalizeAbsPathLexically(`${dir}/..`);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return { ...(own !== undefined ? { own } : {}), ancestors, whole };
+}
+async function identityOf(env, identity, path, signal) {
+    try {
+        return await identity.call(env, path, signal);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readAuxiliaryHome(env, home, opts, signal) {
+    const deadline = Date.now() + AUXILIARY_HOME_PROBE_MS;
+    const spelled = await until(homeSpellingsOf(env, home, signal), deadline, signal);
+    let reading;
+    if (spelled?.canonical === undefined) {
+        const answered = spelled?.answered === true;
+        reading = { place: [home], chain: answered ? { ancestors: [], whole: true } : NO_CHAIN, linked: new Map(), answered };
+    }
+    else {
+        const place = spelled.spellings;
+        const identity = env.fileIdentity;
+        const [chain, heads] = await Promise.all([
+            typeof identity === "function" ? chainAbove(env, identity, spelled.canonical, signal, deadline) : Promise.resolve({ ancestors: [], whole: true }),
+            opts.entries !== undefined ? readDenyHomeLinksOf(env, opts.entries, place, signal, deadline) : Promise.resolve({ linked: new Map(), whole: true }),
+        ]);
+        reading = { place, chain, linked: heads.linked, answered: chain.whole && heads.whole };
+    }
+    if (!reading.answered)
+        sayAuxiliary("a probe did not answer");
+    return reading;
+}
+function homeViewSourceOver(env, auxiliary) {
+    const declared = declaredHomeOf(env);
+    const identity = env.fileIdentity;
+    let declaredChain;
+    const readDeclared = () => {
+        if (declared === undefined || typeof identity !== "function")
+            return Promise.resolve(NO_CHAIN);
+        if (declaredChain === undefined) {
+            const reading = withGateTimeout((async () => {
+                const spelled = await homeSpellingsOf(env, declared);
+                return spelled.canonical === undefined ? NO_CHAIN : await chainAbove(env, identity, spelled.canonical);
+            })(), DEFAULT_GATE_AWAIT_TIMEOUT_MS, undefined, "homeChain").catch(() => NO_CHAIN);
+            declaredChain = reading;
+            void reading.then((c) => {
+                if (!c.whole && declaredChain === reading)
+                    declaredChain = undefined;
+            });
+        }
+        return declaredChain;
+    };
+    return {
+        views(signal) {
+            let index;
+            const indexOf = () => (index ??= (async () => {
+                const chains = [await readDeclared(), ...(await Promise.all(auxiliary)).map((a) => a.chain)];
+                const out = new Map();
+                for (const { own } of chains)
+                    if (own !== undefined && !out.has(own.id))
+                        out.set(own.id, own.dir);
+                for (const { ancestors } of chains)
+                    for (const { dir, id } of ancestors)
+                        if (!out.has(id))
+                            out.set(id, dir);
+                return out.size > 0 ? out : undefined;
+            })());
+            const views = new Map();
+            const viewOf = (path, leafIsFile) => {
+                const key = `${leafIsFile ? "f" : "d"}:${path}`;
+                let v = views.get(key);
+                if (v === undefined) {
+                    v = (async () => {
+                        const index = await indexOf();
+                        if (index === undefined || typeof identity !== "function")
+                            return undefined;
+                        if (!leafIsFile) {
+                            const id = await identityOf(env, identity, path, signal);
+                            if (id === undefined)
+                                return undefined;
+                            if (id.ok) {
+                                const at = index.get(id.value);
+                                if (at !== undefined)
+                                    return at;
+                            }
+                            else if (id.error.code !== "not_found" && id.error.code !== "not_directory")
+                                return undefined;
+                        }
+                        const parent = normalizeAbsPathLexically(`${path}/..`);
+                        if (parent === path)
+                            return undefined;
+                        const up = await viewOf(parent, false);
+                        return up === undefined ? undefined : joinForFamily(pathFamilyOf({ root: path }), up, path.slice(parent.length).replace(/^[\\/]+/, ""));
+                    })();
+                    views.set(key, v);
+                }
+                return v;
+            };
+            return {
+                async of(path, opts) {
+                    if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsolutePathForm(path))
+                        return undefined;
+                    const spelled = normalizeAbsPathLexically(path);
+                    const view = await viewOf(spelled, opts?.leaf === "file");
+                    return view === undefined || view === spelled ? undefined : view;
+                },
+            };
+        },
+    };
+}
+const PLACEMENT_VIEWS = new WeakMap();
+function placementOf(matcher, homes, linked, whole) {
+    const list = Object.freeze([...homes]);
+    PLACEMENT_VIEWS.set(list, matcher.homeViews);
+    return { matcher, homes: list, linked, whole };
+}
+export function placementViewsOf(homes) {
+    return PLACEMENT_VIEWS.get(homes);
+}
+export function sayPlacementLost() {
+    try {
+        console.warn("read-deny homes: this tool band was handed a home list that is not the placement's own (an engine defect) — its home-anchored read-deny rows hold their run at every location, and only the declared home's views are read.");
+    }
+    catch {
+    }
+}
+export function homeViewsAt(env, homes) {
+    const declared = declaredHomeOf(env);
+    const auxiliary = [...new Set(homes.filter((h) => isAbsolutePathForm(h) && !isDeclared(declared, h)))];
+    return homeViewSourceOver(env, auxiliary.map((home) => readAuxiliaryHome(env, home, {})));
+}
+export function homeViewsOf(env, judge, signal) {
+    return (judge?.homeViews ?? homeViewsAt(env, [])).views(signal);
+}
+export function carryHomeViews(judge, source) {
+    return { ...judge, homeViews: source };
+}
 export async function placeReadDenyAtHome(env, compile, homes, signal) {
-    let at = homes;
-    if (at === undefined) {
-        const answer = await withGateTimeout(readDenyHomesAnswered(env, signal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHomes");
-        if (!answer.whole)
-            return { matcher: compile([]), homes: [], linked: new Map(), whole: false };
-        at = answer.homes;
+    const entries = compile([]).entries;
+    const declared = declaredHomeOf(env);
+    const heldAnywhere = (whole) => placementOf(carryHomeViews(compile([]), homeViewSourceOver(env, [])), [], new Map(), whole);
+    const listed = homes === undefined ? declaredReadDenyHomesAnswered(env) : { homes, whole: true };
+    if (!listed.whole)
+        return heldAnywhere(false);
+    const own = listed.homes.filter((h) => isDeclared(declared, h));
+    let declaredAt = [];
+    if (own.length > 0) {
+        const ownSpellings = await withGateTimeout(homeSpellingsOf(env, own[0], signal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHomes");
+        if (!ownSpellings.answered)
+            return heldAnywhere(false);
+        declaredAt = [...new Set([...own, ...ownSpellings.spellings])];
+    }
+    const auxiliary = listed.homes.filter((h) => !isDeclared(declared, h)).map((home) => readAuxiliaryHome(env, home, { entries }, signal));
+    const [heads, readings] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary)]);
+    const at = [...new Set([...declaredAt, ...readings.flatMap((r) => r.place)])];
+    const linked = new Map();
+    for (const map of [heads.linked, ...readings.map((r) => r.linked)]) {
+        for (const [pattern, locations] of map)
+            linked.set(pattern, [...new Set([...(linked.get(pattern) ?? []), ...locations])]);
     }
-    const atHomes = compile(at);
-    const { linked, whole } = await readDenyHomeLinksOf(env, atHomes.entries, at, signal);
-    return { matcher: linked.size === 0 ? atHomes : compile(at, linked), homes: at, linked, whole };
+    const matcher = linked.size === 0 ? compile(at) : compile(at, linked);
+    return placementOf(carryHomeViews(matcher, homeViewSourceOver(env, auxiliary)), at, linked, heads.whole);
 }
 export function readDenyPlacedLater(unplaced, place) {
     let current = unplaced;
@@ -108,6 +368,17 @@ export function readDenyPlacedLater(unplaced, place) {
         if (!whole)
             await again();
     };
+    const settled = async () => {
+        if (pending !== undefined)
+            await pending;
+        return current;
+    };
+    const homeViews = {
+        views(signal) {
+            let views;
+            return { of: async (path, opts) => await (await (views ??= settled().then((m) => m.homeViews.views(signal)))).of(path, opts) };
+        },
+    };
     const matcher = {
         get entries() {
             return current.entries;
@@ -125,101 +396,7 @@ export function readDenyPlacedLater(unplaced, place) {
         },
         unexcludableUnder: (scope) => current.unexcludableUnder?.(scope) ?? false,
         rowAtOrBelow: (path) => current.rowAtOrBelow?.(path) ?? null,
+        homeViews,
     };
     return { matcher, ready };
 }
-const HOME_CHAINS = new WeakMap();
-function homeChainOf(env) {
-    const identity = env.fileIdentity;
-    const home = declaredReadDenyHomes(env)[0];
-    if (typeof identity !== "function" || home === undefined)
-        return undefined;
-    let perEnv = HOME_CHAINS.get(env);
-    if (perEnv === undefined)
-        HOME_CHAINS.set(env, (perEnv = new Map()));
-    const known = perEnv;
-    let chain = known.get(home);
-    if (chain === undefined) {
-        const reading = withGateTimeout((async () => {
-            const canonical = await env.canonicalPath(home);
-            if (!canonical.ok)
-                return { index: undefined, whole: false };
-            const out = new Map();
-            let whole = true;
-            for (let dir = normalizeAbsPathLexically(canonical.value);;) {
-                const id = await identityOf(env, identity, dir);
-                if (id?.ok === true) {
-                    if (!out.has(id.value))
-                        out.set(id.value, dir);
-                }
-                else
-                    whole = false;
-                const parent = normalizeAbsPathLexically(`${dir}/..`);
-                if (parent === dir)
-                    break;
-                dir = parent;
-            }
-            return { index: out.size > 0 ? out : undefined, whole };
-        })(), DEFAULT_GATE_AWAIT_TIMEOUT_MS, undefined, "homeChain").catch(() => ({ index: undefined, whole: false }));
-        chain = reading;
-        known.set(home, reading);
-        const drop = () => {
-            if (known.get(home) === reading)
-                known.delete(home);
-        };
-        void reading.then((c) => (c.whole ? undefined : drop()));
-    }
-    return chain.then((c) => c.index);
-}
-async function identityOf(env, identity, path, signal) {
-    try {
-        return await identity.call(env, path, signal);
-    }
-    catch {
-        return undefined;
-    }
-}
-export function homeViewsOf(env, signal) {
-    const chain = homeChainOf(env);
-    const identity = env.fileIdentity;
-    const views = new Map();
-    const viewOf = (path, leafIsFile) => {
-        const key = `${leafIsFile ? "f" : "d"}:${path}`;
-        let v = views.get(key);
-        if (v === undefined) {
-            v = (async () => {
-                const index = await chain;
-                if (index === undefined || typeof identity !== "function")
-                    return undefined;
-                if (!leafIsFile) {
-                    const id = await identityOf(env, identity, path, signal);
-                    if (id === undefined)
-                        return undefined;
-                    if (id.ok) {
-                        const at = index.get(id.value);
-                        if (at !== undefined)
-                            return at;
-                    }
-                    else if (id.error.code !== "not_found" && id.error.code !== "not_directory")
-                        return undefined;
-                }
-                const parent = normalizeAbsPathLexically(`${path}/..`);
-                if (parent === path)
-                    return undefined;
-                const up = await viewOf(parent, false);
-                return up === undefined ? undefined : joinForFamily(pathFamilyOf({ root: path }), up, path.slice(parent.length).replace(/^[\\/]+/, ""));
-            })();
-            views.set(key, v);
-        }
-        return v;
-    };
-    return {
-        async of(path, opts) {
-            if (chain === undefined || !isAbsolutePathForm(path))
-                return undefined;
-            const spelled = normalizeAbsPathLexically(path);
-            const view = await viewOf(spelled, opts?.leaf === "file");
-            return view === undefined || view === spelled ? undefined : view;
-        },
-    };
-}

package/dist/tools/fs/read-deny.d.ts

@@ -392,8 +392,8 @@ export declare function checkedReadDenyHomes(homes: unknown, seat?: string): rea
  * layer or knob.
  *
  * `homes` — the spellings of the execution environment's home directory a home-anchored entry
- * ({@link READ_DENY_HOME_WORD}) is placed under: the declared home and, where the environment's canonical
- * spelling differs, that one too (the faces judge canonical keys beside the spelled views). Absolute
+ * ({@link READ_DENY_HOME_WORD}) is placed under: the declared home, the account home and, where the environment's
+ * canonical spelling of one differs, that one too (the faces judge canonical keys beside the spelled views). Absolute
  * spellings only — any other shape refuses loudly, naming `readDenyHomes`. EMPTY = the environment declares no
  * home: a home-anchored entry then matches its run anywhere — a row that cannot be placed holds wider, never narrower.
  *

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-registry.js";
@@ -449,6 +450,7 @@ export type RootsSeat = readonly string[] | (() => readonly string[] | undefined
  */
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRoots?: RootsSeat, exactFileReadExemption?: (canonicalKey: string) => boolean, readDeny?: {
     readonly face?: "write";
+    readonly homeViews?: HomeViewSource;
     matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
         readonly aliasResolved?: boolean;
     }): {

package/dist/tools/fs/safety.js

@@ -469,7 +469,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         const judged = { aliasResolved: canon.aliasResolved === true };
         let hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical), judged);
         if (hit === null) {
-            const homeView = await homeViewsOf(env, signal).of(key);
+            const homeView = await homeViewsOf(env, readDeny, signal).of(key);
             if (homeView !== undefined)
                 hit = readDeny.matchTarget(key, homeView, judged);
         }

package/dist/tools/fs/search.d.ts

@@ -1,4 +1,5 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
+import { type HomeViewsCarrier } from "./read-deny-home.js";
 /** The JS scanner's own output ceiling, in bytes of emitted content rows. Pinned to the
  *  ripgrep leg's figure ({@link MAX_EXEC_OUTPUT_BYTES}, the exec pipe's rolling-tail bound) so the two
  *  legs cannot disagree about how much one search may return; see the collection site in {@link jsGrep}
@@ -130,7 +131,7 @@ export declare function walk(env: ExecutionEnv, root: string, start: string, ign
     matchPath(path: string): {
         pattern: string;
     } | null;
-}): Promise<WalkResult>;
+} & HomeViewsCarrier): Promise<WalkResult>;
 /** The JS-leg withholding disclosure: an empty result must stay distinguishable from
  *  searched-and-empty, so this note rides EVERY output shape when something was pruned. Distinct from
  *  {@link walkCaveat}: pruning is deliberate withholding, not incompleteness.
@@ -157,8 +158,8 @@ export interface ReadDenyWithheld {
     count?: number;
     patterns?: readonly string[];
 }
-/** The deny judge seam every search leg shares (structural subset of ReadDenyMatcher). */
-export interface ReadDenyJudge {
+/** The deny judge seam every search leg shares (structural subset of ReadDenyMatcher), with its placement's home views. */
+export interface ReadDenyJudge extends HomeViewsCarrier {
     matchPath(path: string): {
         pattern: string;
     } | null;

package/dist/tools/fs/search.js

@@ -228,7 +228,7 @@ export async function walk(env, root, start, ignore, signal, deny) {
     let aborted = false;
     let denyPruned = 0;
     const denyPatterns = [];
-    const views = deny !== undefined ? homeViewsOf(env, signal) : undefined;
+    const views = deny !== undefined ? homeViewsOf(env, deny, signal) : undefined;
     const denyHit = async (path, leaf) => {
         let hit = deny?.matchPath(path);
         if (!hit && views !== undefined) {
@@ -1156,7 +1156,7 @@ function rgRecordAbsolute(base) {
     return (p) => (base === undefined || family === undefined || isAbsoluteForFamily(family, p) ? p : joinForFamily(family, base, p.replace(/^\.[\\/]/, "")));
 }
 async function rgOutputDenyTripwireAt(env, stdout, mode, deny, opts, signal) {
-    const views = homeViewsOf(env, signal);
+    const views = homeViewsOf(env, deny, signal);
     const absolute = rgRecordAbsolute(opts.base);
     const placed = new Map();
     for (const record of parseRgRecords(stdout, mode, opts.dropIncompleteTail === true)) {
@@ -1343,7 +1343,7 @@ export async function runGrepDetailed(env, root, p, signal, deny) {
             return false;
         if (deny.unexcludableUnder(scope))
             return true;
-        const view = await homeViewsOf(env, signal).of(scope);
+        const view = await homeViewsOf(env, deny, signal).of(scope);
         return view !== undefined && deny.unexcludableUnder(view);
     };
     if (!(await unexcludableUnder()) && (await detectRipgrep(env)))

package/dist/tools/fs/shell-read-check.d.ts

@@ -20,6 +20,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { violationDetails } from "./safety.js";
 import { type ShellReadPlan } from "./shell-read-plan.js";
+import { type HomeViewSource } from "./read-deny-home.js";
 import { type EstablishedRead, type ShellReadBoundary, type ShellReadDisposition, type ShellReadFinding, type ShellReadSeat } from "./shell-read-judge.js";
 import type { ReadRootGrantCandidate } from "../../core/tool-spec.js";
 import type { ToolCallLike } from "../../core/tool-registry.js";
@@ -145,6 +146,9 @@ export interface ShellReadStationOptions {
     /** `true` ⇔ every root `boundaryOf` returns is already a canonical identity (the Runner's): the station never
      *  re-resolves one, so a root swapped for a link after it was declared or granted cannot bring in the link's target. */
     readonly rootsCanonical?: boolean;
+    /** The home views of the placement the boundary's deny seats were compiled at (read-deny-home.ts) — the Runner's. Absent,
+     *  the declared home alone. */
+    readonly homeViews?: HomeViewSource;
 }
 /** What a consumer hands {@link judgeShellRead}: the command as written, the environment whose filesystem
  *  answers where its words land (symlinks resolved, patterns expanded — a `NodeExecutionEnv` over a real
@@ -191,6 +195,11 @@ export interface ShellReadJudgment {
  * LAXER where only a filesystem sees the escape (an in-root symlink pointing out vouches) and answers a
  * pattern on its spelling alone, so the two diverge in both directions.
  *
+ * A read target is also judged at its HOME VIEW (a path spelled through a firmlink or a bind mount of a home, respelled
+ * at the home): this judgment is its own placement — the views read the environment's declared home and the account
+ * home the account database answers once, for this call (`readDenyHomesOf`'s homes); the account home's probes wait at
+ * most a short bound of their own.
+ *
  * It carries NO deadline. Bounding an environment-facing wait and substituting a fail-closed verdict is the
  * gate FOLD's policy on the gate's one deadline seat; the station has never held one on either entry, and a
  * second default here would decide the same number twice and turn a slow-but-correct filesystem's true

package/dist/tools/fs/shell-read-check.js

@@ -6,6 +6,7 @@ import { NOT_AUTO_ALLOWED, programPositionRefusalSentence, readProgramPosition }
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
+import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
 import { programArgs, spellsOption } from "./shell-read-write-targets.js";
 import { allFindings, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
@@ -326,7 +327,7 @@ async function runShellReadStation(tool, command, declared, seat, readers, estab
 }
 export async function judgeShellRead(input) {
     const readers = input.readers ?? new Set(bashClassifyDefaultAllow());
-    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots), input.env, input.signal);
+    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots, { homeViews: homeViewsAt(input.env, declaredReadDenyHomes(input.env)) }), input.env, input.signal);
     const offer = normalizeReadRootCandidate(run.verdict.readRootCandidate);
     return {
         plan: run.plan,
@@ -349,7 +350,7 @@ export function createShellReadStation(opts) {
         const key = roots.join("\0");
         let e = establishers.get(key);
         if (e === undefined) {
-            e = createShellReadEstablisher(opts.env, roots, { rootsCanonical: opts.rootsCanonical === true });
+            e = createShellReadEstablisher(opts.env, roots, { rootsCanonical: opts.rootsCanonical === true, ...(opts.homeViews !== undefined ? { homeViews: opts.homeViews } : {}) });
             establishers.set(key, e);
         }
         return e;

package/dist/tools/fs/shell-read-establish.d.ts

@@ -40,6 +40,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
 import type { EstablishedRead, ShellReadBoundary } from "./shell-read-judge.js";
+import type { HomeViewSource } from "./read-deny-home.js";
 /**
  * How many directories one glob operand (or one traversal root) may enumerate, and how many names it may
  * match, before the leg gives up and answers `unestablishable`.
@@ -82,7 +83,9 @@ export declare function establishShellReadsLexically(plan: ShellReadPlan, bounda
  * The filesystem-resolving establisher for one environment and one root set. `readRoots` are the roots
  * as declared (canonical by contract); they are resolved once more per instance because the comparison is
  * against `realpath` output on both sides — an aliased root would otherwise refuse every read under itself.
+ * `homeViews`: the home views of the placement the deny seats were compiled at (read-deny-home.ts); absent, the declared home's.
  */
 export declare function createShellReadEstablisher(env: ExecutionEnv, readRoots: readonly string[], opts?: {
     readonly rootsCanonical?: boolean;
+    readonly homeViews?: HomeViewSource;
 }): ShellReadEstablisher;

package/dist/tools/fs/shell-read-establish.js

@@ -534,7 +534,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
             if (lexicalOnly)
                 return establishShellReadsLexically(plan, boundary);
             const roots = await canonicalRoots(signal);
-            return await withHomeViews(env, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
+            return await withHomeViews(env, opts, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
         },
         reestablish: async (previous, boundary, signal) => {
             if (lexicalOnly)

package/dist/tools/fs/shell-read-identity.d.ts

@@ -9,12 +9,13 @@
  */
 import type { EstablishedPlan } from "./shell-read-establish.js";
 import type { EstablishedRead } from "./shell-read-judge.js";
-import { type HomeViewEnv } from "./read-deny-home.js";
+import { type HomeViewEnv, type HomeViewsCarrier } from "./read-deny-home.js";
 /** Every read of either establishment whose candidate's settled target set differs between the two. */
 export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];
 /**
  * The establishment with every read that landed carrying its HOME VIEW (read-deny-home.ts) among its spellings, nested
  * plans included: the deny judge then places a home-anchored row wherever the target IS below the home, whatever it is
- * spelled through. A read that did not land (lexical, unestablishable) is left as it is.
+ * spelled through. The views are `placed`'s — the home views of the placement the boundary's deny seats were compiled
+ * at. A read that did not land (lexical, unestablishable) is left as it is.
  */
-export declare function withHomeViews(env: HomeViewEnv, established: EstablishedPlan, signal?: AbortSignal): Promise<EstablishedPlan>;
+export declare function withHomeViews(env: HomeViewEnv, placed: HomeViewsCarrier | undefined, established: EstablishedPlan, signal?: AbortSignal): Promise<EstablishedPlan>;

package/dist/tools/fs/shell-read-identity.js

@@ -38,8 +38,8 @@ function targetsByCandidate(e) {
 function sameTargets(a, b) {
     return a.size === b.size && [...a].every((t) => b.has(t));
 }
-export async function withHomeViews(env, established, signal) {
-    const views = homeViewsOf(env, signal);
+export async function withHomeViews(env, placed, established, signal) {
+    const views = homeViewsOf(env, placed, signal);
     const place = async (p) => {
         const reads = new Map();
         for (const [segment, rs] of p.reads) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.38.0",
+  "version": "7.38.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.38.1.json

@@ -0,0 +1,56 @@
+{
+  "repo": "core",
+  "version": "7.38.1",
+  "from": "f195abb9b3764b7d306d30ac7eee0c9ee82719f8",
+  "to": "0ee3363eac0ed4103b2598b72279b80b61f30a94",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 220,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.errorCode",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G1.d",
+        "G1.e",
+        "G1.f"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.output",
+      "assertions": [
+        "G1.a",
+        "G1.c",
+        "G1.d",
+        "G1.f"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ToolCall.id",
+      "assertions": [
+        "G2.a",
+        "G2.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@64a76326 server@61d9a1d1 sdk@925ffec — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}