@sema-agent/core 7.39.1 → 7.39.2

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## 7.39.2 — 2026-10-03
+
+**Hard-breaking changes:** none.
+
+**Closed sets:** none. **Package exports:** +0 / −0.
+
+### A refused `resumeAt` request leaves the session where it was (#1298; behavior (refusal path: the branch is written back; one refusal judged earlier); +0 exports) (@server @cli @test)
+
+- **Before (v7.39.1).** A `resumeAt` request branched the session at the acquire — a durable `leaf` entry — and prepare could still refuse afterwards. Every such refusal kept the branch, while a caller reads a refusal as "nothing happened": its next turn continued on the moved leaf, i.e. the conversation was rolled back with nobody asking. The ticket's shape (server S-991): two turns with `fileHistory: "disabled"`, then `resumeAt` = the first user message + `restoreFiles: true` ⇒ `rewind_snapshot.unresolvable` with the leaf at the anchor (memory and file stores, `runTask` and `runTaskStream`); `resumeAtMode: "before"` the same, the leaf at the anchor's parent. The same held for every other refusal after the branch, measured on v7.39.1: a lineage child's `rewind.child_scope_unsupported`, an execution-env factory that throws (an env that cannot be provisioned), a caller tool of the reserved offload-reader name (`config.reserved_tool_name`), worktree isolation that cannot be honored (`isolation.unavailable`), and `model.extraBody` carrying `max_completion_tokens` (`config.extra_body_output_cap`; that one also left the session view cached).
+- **Now.** One rule: the session leg of prepare's throw cleanup writes a `resumeAt` branch back before it drops the session view — the acquire phase's own failure path while the branch is still inside it, the driver's `forgetOnThrow` once it was handed over (every refusal path after the acquire already runs it). The leaf returns to where the request found it; refusal codes, messages and the success path (its writes, its frames) are unchanged. The write-back only takes back what this request wrote: the leaf must sit on the branch leaf or on entries this prepare appended above it (the storage watch records their ids, so the prepare's own entries after the branch — a reminder mark, an epoch pin — do not stop it), and the write is conditional on the leaf it verified. A leaf another writer moved in the meantime — onto an entry of its own, even one the prepare later appended on top of, or anywhere off the branch — keeps that write: nothing is orphaned, and `onError` (phase `config`) says so in one sentence naming both leaves — `resumeAt: prepare refused this request but could not put session "<id>" back — its leaf stays at "<leaf>" (the request found it at "<leaf>"), so the next turn continues from there: <cause>`. The write-back is a bounded cleanup leg like the others, and so are the acquire phase's own two `forget` calls (a store that never answers is reported as a teardown timeout and does not hold the refusal; a write-back still pending past the bound does not start its write when it wakes — one whose storage write is already in flight cannot be called back, the storage contract carries no cancellation). `config.extra_body_output_cap` is judged before the acquire with the other refusals the request alone decides: a request refused by it never touches the session (no branch, no write-back, the log byte for byte as it was).
+- **User-visible fix.** A rewind that is refused (no file history at that point, a sandbox that does not come up, a configuration error) no longer silently rewinds the conversation: the next turn continues where the user left off.
+- **Who is hurt.** Nobody who reads a refusal as "nothing happened". A tool counting session entries after a refused request sees two `leaf` entries (the branch and its write-back) where it saw one — the leaf is restored, the log bytes are not (refusals judged before the acquire stay byte-identical). A partial restore that is refused (`rewind.restore_failed`, or a partial outcome without `acceptPartialRestore`) leaves the files it already converged converged while the leaf now goes back; the error's per-file ledger lists them, and re-running the same request converges both (before: the leaf stayed at the anchor). A request carrying `max_completion_tokens` together with another fault the acquire judges (`resume.session_not_found`, a `resume_at.*` refusal) now reports `config.extra_body_output_cap` first. A deployment without `onError` does not hear a write-back that could not land (the same channel every other failure of prepare's failure path uses).
+- **Compensation.** None needed for a caller that treats a refusal as a refusal. A tool that counted entries should read the leaf (`getLeafId()`), not the entry count.
+- **Consumers.** server — S-991's two cells read `after.leaf` `toBe(before.leaf)`; no server code depends on the old reading. cli — a refused rewind no longer moves the conversation the shell shows on its next turn. test — the shapes above.
+- **Not changed, stated.** A durable resume's rewind to its checkpoint's leaf is not a branch this writes back: it is the point every resume of that checkpoint starts from, and what a refused resume leaves of the checkpoint is the resume path's own contract, unchanged here. A refusal that comes from a throwing deployment sink or an adapter contract violation in the stretch between the acquire and the session cleanup's first leg (an `onError` that throws at the offload-namespace or reserved-`extraBody`-key note, an `executionEnv.canonicalPath` that throws on a delegated child's explicit `cwd`) still leaves the branch and the cached view — those paths have no session cleanup at all.
+- Pins: `test/backlog1298-resume-at-leaf-untouched-on-refusal.test.ts` — ①⑧ the ticket's shape, memory and file stores, `runTask` and `runTaskStream`; ② `before` mode; ⑤ the next plain turn still sees turn 2; ⑥ the lineage child scope; ⑨–⑪ the env factory, the reserved tool name, isolation; ⑫ the output cap before the acquire (byte-identical log); ⑬ the acquire phase's own failure path after the branch; ⑮ a prepare-own write after the branch, then a refusal; ⑯ a foreign append inside the window with the prepare's own append on top — kept, and named; ⑰ a write-back that never settles — the refusal still returns, a teardown timeout is reported, no write starts later; ⑲ a store `forget` that never settles on the acquire phase's failure path — the refusal still returns, the branch already written back; ⑱ a write racing the write-back's check is not overwritten; ⑭ a foreign leaf move inside the window — kept, and named on `onError`; positive controls ③ (a recorded anchor restores and branches) and ④ (`resumeAt` without `restoreFiles` branches, `conversation_only`); ⑦ the two bundled stores' `canRestore` and `restore`'s `not_found` answer the same question. Every refusal cell read the leaf moved on v7.39.1. `test/backlog1206-new-session-lock.test.ts` ⑤ / ⑦ take the reserved tool name as their "refused after the acquire" trigger (the output cap no longer is one).
+
+**Hard-breaking changes:** none.
+
+**Closed sets:** none. **Package exports:** +0 / −0.
+
+### A damaged session-rules file refuses the read and the write instead of reading as "no rules" (#1299; behavior (tighten); +0 exports) (@server @cli @test)
+
+- **Before (v7.39.1).** `FileSessionPolicyStore` answered `null` — "no rules" — to a keyed read (`getRules`, and the read `putRules` makes first) of a session-rules file that was unparseable, not a JSON object, or the wrong shape (a missing or non-numeric `rev`, a non-string-array rule field), and told only the `onCorruptRead` sink. Session rules only ever tighten, so the row IS the restriction: a torn file dropped it. On a real Runner a session with `toolDeny: ["probe"]` and a torn file ran `probe` on 3 of 3 turns and finished `completed`. `putRules` over such a file overwrote the damaged bytes into a new lineage. A file that could not be READ at all (`EACCES`, `EISDIR`) already threw the raw errno error, and the server's SQL twin of this store throws on a bad row (as the server reports it).
+- **Now.** A rules file that is present but cannot be served as rules is refused: `getRules` and `putRules` reject with `SessionPolicyError`, code `corrupt` (an existing member — no closed-set change), whose message names the session, the grade (`unreadable` / `unparseable` / `malformed`), the reason, and the two ways out: fix the file, or delete it (deleting is an explicit "no rules" and gives up the rules the file held). **The message names no on-disk location** — it reaches end users through a host's error body; the file's absolute path goes to `onCorruptRead` only (the same sink as before), which is where an operator reads it. One refusal for all three grades; the raw errno error of an unreadable file is replaced by it. `onCorruptRead` still fires — now alongside the refusal. A file that is ABSENT (`ENOENT`) is still "no rules": `getRules` answers `null` with no disclosure and the first `putRules` stamps rev 1. `putRules` refuses before it writes anything and leaves the damaged file and the key's high-water mark byte-identical, for an operator write too; the old overwrite-into-a-new-lineage path is gone. On a Runner the task ends `failed` with terminal `code: "corrupt"` at prepare, before the first turn (`stats.turns` 0), and no tool runs; a parked approval resumed over a damaged file fails the same way, its checkpoint stays `pending`, and it resumes once the file is repaired; a leg whose file tears MID-RUN keeps enforcing the row it already enforces (unchanged).
+- **User-visible fix.** A local deployment whose session-rules file is torn or hand-edited into a bad shape no longer runs the session unrestricted: the task stops, and the message names the file and how to recover.
+- **Who is hurt.** A local (file-backed) deployment holding a damaged session-rules file: that session's tasks now fail until the file is fixed or deleted — they used to run without the restriction. A host that treated `getRules` returning `null` from this store as "no rules" for a damaged file now meets a throw (the SQL twin already threw). A host that relied on `putRules` writing over a torn file as the repair: delete the file first. A host that branched on the raw `EACCES` / `EISDIR` error from `getRules` now gets `SessionPolicyError` (`code: "corrupt"`, `message` carries the errno word).
+- **Compensation.** Fix the file (put a valid row back) or delete it; both are the operator's and both are named in the refusal. After a delete the key's next write continues past the high-water mark and the same lineage, so a leg that is already enforcing the old row takes that write as a continuation (KL-1299-b). The `onCorruptRead` coordinates (`path`, `reason`, `sessionId`, `principal`) are unchanged.
+- **Consumers.** server — the local lane's `getRules` now throws on a damaged file, matching `session-policy-store-sql.ts` (as the server reports it); the server's `corrupt-read-f-seats-s990` seat flips from "answers null" to "rejects `corrupt`". cli / client-core — a task whose session-rules file is damaged ends with the existing terminal `{ kind: "failed", code: "corrupt", message }`; no new field.
+- **Not changed, stated.** `listBySession` still skips a damaged row and discloses it (one bad row of any session must not fail every session's enumeration; KL-1299-a). The high-water mark's refusals (`SessionPolicyError` `corrupt` on an unreadable mark) and the erase's torn-row handling are as before. The in-memory store has no file to damage. Two neighbouring faces still turn a damaged row into "no rules" and are recorded, not fixed here: the data-root rebind leaves an unparseable row under the old key (KL-1299-d), and another session's `deleteBySession` sweeps a torn row of a different session (KL-1299-e).
+- Pins: `test/backlog1299-session-policy-corrupt-read-refuses.test.ts` — ①② nine damaged forms refuse `getRules` with code, grade, both exits, no on-disk path in the message, disclosure kept (the path on the sink) (red on v7.39.1: all read `null`); ③ an unreadable file (a directory in its place; `chmod 000`, env-only — skipped under a root uid) refuses with the same code (red on v7.39.1: raw errno); ④ absence is still `null` / rev 1 (green on both); ⑤ a good row still reads (green on both); ⑥ `putRules` refuses on a damaged file, plain and operator, bytes of row and mark unchanged (red on v7.39.1: it overwrote); ⑥b both ways out work; ⑥c the enumeration keeps its tolerance; ⑦ the real Runner lane — `failed` / `corrupt` before any turn, `probe` never runs (red on v7.39.1: `completed`, 3 of 3), the absent-file and intact-row controls, the mid-run tear keeps the enforced row, and the parked-approval resume stays pending and completes after repair. Four older pins that encoded the fail-open flip: `test/file-session-policy-store.test.ts` (4), `test/backlog1003-1000-session-policy-row-shape.test.ts` (P1 ×5, P5c), `test/backlog7250-review-fixes.test.ts` (R9, R10).
+
 ## 7.39.1 — 2026-10-03
 
 **Hard-breaking changes:** none.

package/dist/core/runner/branch-writeback.d.ts

@@ -0,0 +1,38 @@
+import type { SessionStorage } from "../session.js";
+/** The entries this prepare appended through the watched storage — recorded once a branch is armed (`ids` set). */
+export interface OwnAppends {
+    ids: Set<string> | undefined;
+}
+/** The branch a `resumeAt` acquire wrote: the watched storage, the leaf the request found, the leaf it set, and the own appends since. */
+export interface ResumeAtBranch {
+    storage: SessionStorage;
+    leafBefore: string | null;
+    leafSet: string | null;
+    own: OwnAppends;
+}
+/**
+ * Wrap a storage so a `SessionError("conflict")` from any append/leaf write flips `ref.hit`, and every append
+ * that lands is recorded on `own` while a branch is armed. The harness flattens a mid-run storage failure into
+ * a generic error (and, since a lost CAS makes every subsequent append fail, even its failure-reporting append
+ * fails) — so the conflict code is gone by the time the task result is assembled. Catching it here, at the
+ * storage boundary, keeps it recoverable as `TaskResult.errorCode = "conflict"`. Per-task and non-mutating (a
+ * Proxy over the shared storage), so it never stacks across tasks on a cached session.
+ */
+export declare function detectConflicts(storage: SessionStorage, ref: {
+    hit: boolean;
+}, own: OwnAppends): SessionStorage;
+/**
+ * Put a refused prepare's `resumeAt` branch back: the leaf returns to `leafBefore` when it still sits on the
+ * branch leaf or on this prepare's own appends above it, and the write is conditional on the leaf just
+ * verified. A no-op when the leaf is already there. Throws a sentence naming both leaves when the leaf is
+ * not this request's to take back or the write cannot land. `signal` aborted before the write starts ⇒ no
+ * write (the caller's bound expired and the view is being dropped); a storage write already in flight cannot
+ * be called back — the storage contract carries no cancellation.
+ */
+export declare function writeBranchBack(branch: ResumeAtBranch, sessionId: string, signal?: AbortSignal): Promise<void>;
+/**
+ * The session cleanup's write-back leg: {@link writeBranchBack} bounded like every other cleanup leg (a throw or
+ * a timeout goes to `report`, never to the caller). A write-back still pending when the bound expires does not
+ * START its write afterwards — the view it would write through is being dropped.
+ */
+export declare function settleBranchWriteBack(branch: ResumeAtBranch, sessionId: string, label: string, report: (err: Error) => void): Promise<void>;

package/dist/core/runner/branch-writeback.js

@@ -0,0 +1,58 @@
+import { isSessionConflict } from "../session.js";
+import { thrownText } from "../thrown-value.js";
+import { settleTeardownLeg } from "./teardown-bounded.js";
+export function detectConflicts(storage, ref, own) {
+    const guard = (fn, landed) => async (...args) => {
+        try {
+            const out = await fn(...args);
+            landed(args);
+            return out;
+        }
+        catch (err) {
+            if (isSessionConflict(err)) {
+                ref.hit = true;
+            }
+            throw err;
+        }
+    };
+    return new Proxy(storage, {
+        get(target, prop, receiver) {
+            const value = Reflect.get(target, prop, receiver);
+            if (typeof value !== "function") {
+                return value;
+            }
+            const bound = value.bind(target);
+            if (prop === "appendEntry")
+                return guard(bound, (args) => own.ids?.add(args[0].id));
+            if (prop === "setLeafId")
+                return guard(bound, () => undefined);
+            return bound;
+        },
+    });
+}
+export async function writeBranchBack(branch, sessionId, signal) {
+    let now;
+    try {
+        now = await branch.storage.getLeafId();
+        if (now === branch.leafBefore)
+            return;
+        const ids = branch.own.ids ?? new Set();
+        for (let at = now, steps = 0; at !== branch.leafSet; steps++) {
+            if (at === null || steps > ids.size || !ids.has(at))
+                throw new Error("another writer moved the leaf past the entries this request wrote");
+            at = (await branch.storage.getEntry(at))?.parentId ?? null;
+        }
+        if (signal?.aborted === true)
+            return;
+        await branch.storage.setLeafId(branch.leafBefore, { expectedLeafId: now });
+    }
+    catch (err) {
+        const shown = (id) => (id === undefined ? "(unreadable)" : id === null ? "(empty)" : `"${id}"`);
+        throw new Error(`resumeAt: prepare refused this request but could not put session "${sessionId}" back — its leaf stays at ${shown(now)} (the request found it at ${shown(branch.leafBefore)}), so the next turn continues from there: ${thrownText(err)}`);
+    }
+}
+export async function settleBranchWriteBack(branch, sessionId, label, report) {
+    const ac = new AbortController();
+    await settleTeardownLeg(() => writeBranchBack(branch, sessionId, ac.signal), label, report);
+    ac.abort();
+}

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -16,13 +16,15 @@
  *
  * Throws pass through unchanged: `resume.session_not_found` (requireExisting fail-loud mapping),
  * the `resume_at.*` target-validation refusals, and — after the bounded re-wake budget — the
- * session conflict itself.
+ * session conflict itself. A throw after a `resumeAt` branch landed first writes that branch back
+ * (`settleBranchWriteBack`); on success the branch is handed over with the session.
  */
 import { StoredSession } from "../session.js";
 import type { AcquiredSession, SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import type { TaskSpec, ToolEffect } from "../types.js";
 import type { PrepareResume } from "./contracts.js";
+import { type ResumeAtBranch } from "./branch-writeback.js";
 export interface PrepareAcquireReconcileInput {
     /** borrowed-mutable (service port) — the deployment's session store. This phase's verbs on it are
      *  the acquire/forget half of the session resource protocol: `acquire` per attempt, `forget` to
@@ -52,8 +54,10 @@ export interface PrepareAcquireReconcileInput {
      *  absent seat; nothing in the phase's control flow depends on it. Computed by the driver (which
      *  holds `deps`) rather than here, keeping this slice's input the narrow Pick its contract says. */
     durableParkGap?: string;
+    /** borrowed-readonly — the incident channel for this phase's own cleanup legs: a `resumeAt` branch it could not write back, a forget that did not settle. */
+    report?: (err: Error, sessionId: string) => void;
 }
-/** The phase's outputs (four-class form). All five are fresh bindings —
+/** The phase's outputs (four-class form). All six are fresh bindings —
  *  the driver destructures them into consts, so a consumer moved ahead of this call is a lexical
  *  error, which is the static guarantee the extraction keeps. */
 export interface PrepareAcquireReconcileResult {
@@ -75,6 +79,9 @@ export interface PrepareAcquireReconcileResult {
      *  SUCCEEDS (a conflict-losing attempt re-wakes and re-derives the whole set from the fresh
      *  branch), and stays empty for a fresh session / a clean one with nothing to reconcile. */
     wakeRecovered: RecoveredOrphan[];
+    /** owned (handed over with the session) — the `resumeAt` branch this phase wrote, absent when it wrote
+     *  none; the driver's throw cleanup writes it back on any later prepare refusal. */
+    branch: ResumeAtBranch | undefined;
 }
 /** The B-3 phase body — the acquire+reconcile slice, verbatim (see the module header for the contract). */
 export declare function prepareAcquireReconcile(input: PrepareAcquireReconcileInput): Promise<PrepareAcquireReconcileResult>;

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -1,37 +1,15 @@
 import { StoredSession, isSessionConflict } from "../session.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
+import { detectConflicts, settleBranchWriteBack } from "./branch-writeback.js";
+import { settleTeardownLeg } from "./teardown-bounded.js";
 const RECONCILE_MAX_RETRIES = 3;
-function detectConflicts(storage, ref) {
-    const guard = (fn) => async (...args) => {
-        try {
-            return await fn(...args);
-        }
-        catch (err) {
-            if (isSessionConflict(err)) {
-                ref.hit = true;
-            }
-            throw err;
-        }
-    };
-    return new Proxy(storage, {
-        get(target, prop, receiver) {
-            const value = Reflect.get(target, prop, receiver);
-            if (typeof value !== "function") {
-                return value;
-            }
-            const bound = value.bind(target);
-            return prop === "appendEntry" || prop === "setLeafId"
-                ? guard(bound)
-                : bound;
-        },
-    });
-}
 export async function prepareAcquireReconcile(input) {
     const { sessions, spec, resume, toolEffects } = input;
     let acquired;
     let session;
     let conflictRef;
     let wakeRecovered = [];
+    let branch;
     for (let attempt = 0;; attempt++) {
         try {
             acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : input.placement !== undefined ? { placement: input.placement } : undefined);
@@ -46,7 +24,8 @@ export async function prepareAcquireReconcile(input) {
             throw err;
         }
         conflictRef = { hit: false };
-        session = new StoredSession(detectConflicts(acquired.session.getStorage(), conflictRef));
+        const own = { ids: undefined };
+        session = new StoredSession(detectConflicts(acquired.session.getStorage(), conflictRef, own));
         if (!spec.sessionId) {
             break;
         }
@@ -105,7 +84,10 @@ export async function prepareAcquireReconcile(input) {
                         throw e;
                     }
                 }
-                await session.getStorage().setLeafId(spec.resumeAtMode === "before" ? entry.parentId : spec.resumeAt);
+                const storage = session.getStorage(), leafBefore = await storage.getLeafId(), leafSet = spec.resumeAtMode === "before" ? entry.parentId : spec.resumeAt;
+                await storage.setLeafId(leafSet);
+                own.ids = new Set();
+                branch = { storage, leafBefore, leafSet, own };
             }
             wakeRecovered = (await reconcileInterruptedSession(session, toolEffects, resume?.suspendedBatch)).recovered;
             break;
@@ -113,13 +95,17 @@ export async function prepareAcquireReconcile(input) {
         catch (err) {
             if (isSessionConflict(err) && attempt < RECONCILE_MAX_RETRIES) {
                 if (sessions.forget) {
-                    await Promise.resolve(sessions.forget(spec.sessionId)).catch(() => undefined);
+                    const forget = sessions.forget.bind(sessions), id = spec.sessionId;
+                    await settleTeardownLeg(() => Promise.resolve(forget(id)).catch(() => undefined), "forget (acquire-reconcile re-wake leg)", (e) => input.report?.(e, id));
                 }
+                branch = undefined;
                 continue;
             }
-            await Promise.resolve(sessions.forget ? sessions.forget(acquired.sessionId) : undefined).catch(() => undefined);
+            if (branch !== undefined)
+                await settleBranchWriteBack(branch, acquired.sessionId, "resumeAt branch write-back (acquire-reconcile failure leg)", (e) => input.report?.(e, acquired.sessionId));
+            await settleTeardownLeg(() => Promise.resolve(sessions.forget ? sessions.forget(acquired.sessionId) : undefined).catch(() => undefined), "forget (acquire-reconcile failure leg)", (e) => input.report?.(e, acquired.sessionId));
             throw err;
         }
     }
-    return { acquired, session, conflictRef, wakeRecovered };
+    return { acquired, session, conflictRef, wakeRecovered, branch };
 }

package/dist/core/runner/prepare-file-history.d.ts

@@ -8,8 +8,8 @@
  * boundary seat runtask drives.
  *
  * Runs INSIDE the driver's prepare try-block, after the workspace root is FINAL (`taskRootFinal`) and the
- * env is resolved: every refusal here throws through to the driver's prepare-throw catch exactly as
- * before the move (a minted ownedEnv is destroyed there, the session view forgotten). The phase acquires
+ * env is resolved: every refusal here throws through to the driver's prepare-throw catch (a minted
+ * ownedEnv is destroyed there, a resumeAt branch written back, the session view forgotten). The phase acquires
  * no resource of its own — the two seats it returns are closures over the store the deployment owns.
  *
  * The request door (the bad-value doors and every refusal the request decides alone) lives in

package/dist/core/runner/prepare-task.js

@@ -38,6 +38,7 @@ import { preparePromptAssembly } from "./prepare-prompt-assembly.js";
 import { limitConfigError, prepareConfigDoors } from "./prepare-config-doors.js";
 import { prepareSafetyScan } from "./prepare-safety-scan.js";
 import { prepareAcquireReconcile } from "./prepare-acquire-reconcile.js";
+import { settleBranchWriteBack } from "./branch-writeback.js";
 import { prepareHandsMount, resolveHandsLessReadFace } from "./prepare-hands-readface.js";
 import { prepareWorkspaceRestore } from "./prepare-workspace-restore.js";
 import { parkContaminationMarker } from "./park-commit.js";
@@ -291,8 +292,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     let shellGatedTools = new Set();
     refuseRequireExistingWithoutSession(spec);
     refuseRegistryScopeMismatch(spec, internals);
+    if (model.extraBody !== undefined && Object.prototype.hasOwnProperty.call(model.extraBody, "max_completion_tokens")) {
+        const e = new Error(`model.extraBody supplies "max_completion_tokens" — this spelling is engine-owned (the overflow retry ` +
+            `adjusts the per-request output cap, and a constant extraBody value would override that adjustment on ` +
+            `every retry). Set the cap via limits.maxOutputTokens (per request) or model.maxTokens instead.`);
+        e.code = "config.extra_body_output_cap";
+        throw e;
+    }
     const fileHistoryRequest = resolveFileHistoryRequest(spec, deps);
-    const { acquired, session, conflictRef, wakeRecovered } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
+    const { acquired, session, conflictRef, wakeRecovered, branch } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, report: (e, id) => deps.onError?.(e, { phase: "config", sessionId: id }), ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     await holdSessionLock?.(sessionId);
     const onceLedger = await loadAnnounceOnceLedger(session, resume?.seed.announcedListings, deps.onError);
@@ -320,18 +328,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         deps.onError?.(new Error(`offload/tool-result namespace note: this run mounts in registry domain "${internals.registryScope}" but its offloaded tool results live under the TRUST identity "${offloadScope}" (principal${spec.principal === undefined ? " absent → default" : ""}). Before 2.13.0 the registry domain named this namespace too; if a deployment used registryScope as its ref-tenancy boundary, that boundary is now the principal — pass one, or read refs under "${offloadScope}".`), { phase: "config", sessionId });
     }
     defaultTaskRegistry.maybeGc();
-    const forgetOnThrow = () => forgetQuietly(sessions, sessionId);
+    const forgetOnThrow = () => branch === undefined
+        ? forgetQuietly(sessions, sessionId)
+        : settleBranchWriteBack(branch, sessionId, "resumeAt branch write-back (prepare refusal)", (e) => deps.onError?.(e, { phase: "config", sessionId })).then(() => forgetQuietly(sessions, sessionId));
     const extraBodyCollisions = reservedCollisions(model.extraBody, reservedFor(model.api));
     if (extraBodyCollisions.length > 0) {
         deps.onError?.(new Error(`model.extraBody contains reserved key(s) [${extraBodyCollisions.join(", ")}] that core owns and sets itself — they are ignored. Remove them from extraBody.`), { phase: "config", sessionId });
     }
-    if (model.extraBody !== undefined && Object.prototype.hasOwnProperty.call(model.extraBody, "max_completion_tokens")) {
-        const e = new Error(`model.extraBody supplies "max_completion_tokens" — this spelling is engine-owned (the overflow retry ` +
-            `adjusts the per-request output cap, and a constant extraBody value would override that adjustment on ` +
-            `every retry). Set the cap via limits.maxOutputTokens (per request) or model.maxTokens instead.`);
-        e.code = "config.extra_body_output_cap";
-        throw e;
-    }
     const { nestedStats, reportUsage, offloadStore, offloadReachableToolsRef, maybeOffload, firstPartyOffload, remoteToolOffload } = prepareOffloadWrappers({ spec, deps, resume, offloadScope, sessionId });
     if (offloadStore && (spec.tools ?? []).some((t) => t.name === OFFLOAD_TOOL_NAME)) {
         const e = new Error(`Tool name "${OFFLOAD_TOOL_NAME}" is reserved when large-result offload is enabled.`);

package/dist/stores/file/index.d.ts

@@ -90,9 +90,10 @@ export interface FileStorageBackendOptions {
      * per-store constructor parameter was unreachable from here, so the disclosure was wired exactly
      * nowhere for the deployments that need it most.
      *
-     * Reach TODAY: {@link FileStorageBackend.sessionPolicyStore} (rules read as ABSENT ⇒ an unconstrained
-     * task) and {@link FileStorageBackend.sessionStore}'s repo (a session listing that silently omits what
-     * it could not read). The aggregated roster and mailbox stores receive the same sink. A store that
+     * Reach TODAY: {@link FileStorageBackend.sessionPolicyStore} (an absent file ⇒ no rules; a present but
+     * unreadable / unparseable / malformed file ⇒ refused, the disclosure delivered alongside the refusal)
+     * and {@link FileStorageBackend.sessionStore}'s repo (a session listing that silently omits what it
+     * could not read). The aggregated roster and mailbox stores receive the same sink. A store that
      * grows the seat later is wired here in the same constructor.
      *
      * The payload is the UNION shape ({@link FileStorageCorruptReadInfo}): `path` + `reason` always,

package/dist/stores/file/session-policy-store.d.ts

@@ -13,8 +13,9 @@ import { type PutRulesOptions, type SessionPermissionRules, type SessionPolicySt
  * atomic write), so the read-modify-write is atomic in the one event loop — exactly the InMemory store's premise.
  * Cross-process CORRECT concurrency is the Pg/TiDB backend's job (a CAS WHERE clause), by design.
  */
-/** Coordinates of one corrupt-treated-as-absent policy read (the {@link FileSessionPolicyStoreOptions.onCorruptRead}
- *  payload). Named rather than inline so the backend option that forwards it names the SAME shape. */
+/** Coordinates of one damaged policy file the store observed (the {@link FileSessionPolicyStoreOptions.onCorruptRead}
+ *  payload): the keyed read REFUSES it, the enumeration skips it. Named rather than inline so the backend option
+ *  that forwards it names the SAME shape. */
 export interface SessionPolicyCorruptReadInfo {
     /** Always a whole-file disclosure (the {@link import("./corrupt-read-sink.js").CorruptReadInfo} level). */
     kind: "file";
@@ -25,12 +26,13 @@ export interface SessionPolicyCorruptReadInfo {
     principal?: string;
     /** Absolute path of the offending file. */
     path: string;
-    /** Which corruption grade was observed (unparseable / bad shape / unreadable). */
+    /** What was observed — the same words the refusal's message carries after its grade (unparseable / malformed / unreadable). */
     reason: string;
 }
 export interface FileSessionPolicyStoreOptions {
-    /** Disclosure sink for the corrupt-read fail-open (see {@link FileSessionPolicyStore.discloseCorrupt}).
-     *  Never fires on plain ENOENT. Swallow-guarded: a throwing sink cannot re-introduce the fault. */
+    /** Disclosure sink for a damaged rules file (see {@link FileSessionPolicyStore.refuseDamaged}): it fires WITH the
+     *  refusal on the keyed read and on its own where the enumeration skips the row. Never fires on plain ENOENT.
+     *  Swallow-guarded: a throwing sink cannot change the refusal. */
     onCorruptRead?: (info: SessionPolicyCorruptReadInfo) => void;
 }
 /**
@@ -104,12 +106,16 @@ export declare class FileSessionPolicyStore implements SessionPolicyStore {
     constructor(root: string, opts?: FileSessionPolicyStoreOptions);
     /** The one delivery point for {@link onCorruptRead}. */
     private disclose;
-    /** RB-482 top item (baggage class-4 ruling): corrupt-read fail-open is a DOCUMENTED compromise (a throwing
-     *  getRules fails the whole task; a throwing putRules self-locks the repair write) — but it must not
-     *  be a SILENT one: a deployment whose policy file was corrupted was getting an apparently normal
-     *  UNCONSTRAINED task with zero signal. Every corrupt-treated-as-absent branch discloses here
-     *  (swallow-guarded; never on a plain ENOENT, which really is absence). */
-    private discloseCorrupt;
+    /** The ONE refusal for a rules file that is PRESENT but cannot be served as rules — every damage grade lands
+     *  here (`unreadable` bytes, `unparseable` JSON, a `malformed` row), so the keyed read and the write that reads
+     *  before it answer with one voice. Session rules only TIGHTEN: a row is the restriction an operator put on the
+     *  session, so reading a damaged one as "no rules" would drop the restriction itself — the wrong direction for a
+     *  store whose every other face refuses a loosening. ABSENCE (ENOENT) is the only "no rules"; it never reaches
+     *  here. The disclosure sink fires with the refusal (swallow-guarded: a throwing sink cannot turn it back into an
+     *  answer) and is the ONLY carrier of the file's path: the thrown message reaches end users through a host's error
+     *  body, so it names no on-disk location. Two ways out, both the operator's: fix the file, or delete it — deleting is an explicit "no rules" and
+     *  gives up the rules the file held. */
+    private refuseDamaged;
     /** `(sessionId, principal)` → a safe, INJECTIVE filename (sanitizeScope appends the full sha256 of the raw
      *  composite key, so distinct keys never collide on disk). On a local-owner-adopted root the
      *  anonymous lane resolves to the adopted principal's key (#132 — see {@link anonymousAlias}). */
@@ -121,6 +127,8 @@ export declare class FileSessionPolicyStore implements SessionPolicyStore {
     private writeMarkFile;
     /** The mark as given — the erase's lineage transition rewrites a mark keeping whatever attribution it had. */
     private writeMark;
+    /** The keyed read: `null` is ABSENCE only (no file); a file that is there is served as rules or refused
+     *  ({@link refuseDamaged}) — it is never read as "no rules". */
     private read;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;

package/dist/stores/file/session-policy-store.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { loosenReasons, normalizeRules, stripRev, SessionPolicyError, } from "../../core/session-policy-store.js";
 import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
@@ -79,8 +79,10 @@ export class FileSessionPolicyStore {
     disclose(info) {
         this.onCorruptRead?.({ kind: "file", ...info });
     }
-    discloseCorrupt(sessionId, principal, reason) {
-        this.disclose({ sessionId, ...(principal !== undefined ? { principal } : {}), path: this.pathFor(sessionId, principal), reason });
+    refuseDamaged(sessionId, principal, grade, reason) {
+        const path = this.pathFor(sessionId, principal);
+        this.disclose({ sessionId, ...(principal !== undefined ? { principal } : {}), path, reason });
+        throw new SessionPolicyError("corrupt", `session rules file for ${JSON.stringify(sessionId)} is ${grade} (${reason}) — refusing rather than read the rules it held as none (session rules only tighten). Repair it: fix the file, or delete it (deleting it = explicitly no rules, and gives up the rules it held). The file's location is reported to the store's corrupt-read disclosure (onCorruptRead), not in this message.`);
     }
     pathFor(sessionId, principal) {
         return join(this.dir, `${this.basenameFor(sessionId, principal)}.json`);
@@ -107,18 +109,14 @@ export class FileSessionPolicyStore {
         catch (err) {
             if (err.code === "ENOENT")
                 return null;
-            throw err;
+            return this.refuseDamaged(sessionId, principal, "unreadable", `read failed (${err.code ?? err.name})`);
         }
         const judged = judgeSessionPolicyRowObject(raw);
-        if ("corrupt" in judged) {
-            this.discloseCorrupt(sessionId, principal, judged.corrupt.reason);
-            return null;
-        }
+        if ("corrupt" in judged)
+            return this.refuseDamaged(sessionId, principal, judged.corrupt.grade, judged.corrupt.reason);
         const shaped = judgeSessionPolicyRowShape(judged.row);
-        if ("corrupt" in shaped) {
-            this.discloseCorrupt(sessionId, principal, shaped.corrupt.reason);
-            return null;
-        }
+        if ("corrupt" in shaped)
+            return this.refuseDamaged(sessionId, principal, shaped.corrupt.grade, shaped.corrupt.reason);
         return shaped.rules;
     }
     async getRules(sessionId, principal) {
@@ -137,12 +135,11 @@ export class FileSessionPolicyStore {
             }
         }
         const mark = readSessionPolicyMark(this.markPathFor(sessionId, principal));
-        const rowFilePresent = prior === null && existsSync(this.pathFor(sessionId, principal));
-        if (mark?.__lineage === "lost" || (rowFilePresent && mark === null)) {
-            throw new SessionPolicyError("corrupt", `session rules for ${JSON.stringify(sessionId)} have no lineage evidence (${mark?.__lineage === "lost" ? "the erase left a lost-lineage mark" : "an unreadable row and no high-water mark"}) — refusing to restart the key's lineage by guessing; delete the mark${rowFilePresent ? " and the row file" : ""} to restart it`);
+        if (mark?.__lineage === "lost") {
+            throw new SessionPolicyError("corrupt", `session rules for ${JSON.stringify(sessionId)} have no lineage evidence (the erase left a lost-lineage mark) — refusing to restart the key's lineage by guessing; delete the mark to restart it`);
         }
         const floor = Math.max(prior?.rev ?? 0, mark?.__hwm ?? 0);
-        const gen = prior !== null ? (prior.gen ?? 0) : rowFilePresent ? (mark?.__gen ?? 0) + 1 : (mark?.__gen ?? 0);
+        const gen = prior !== null ? (prior.gen ?? 0) : (mark?.__gen ?? 0);
         const next = { ...clean, rev: floor + 1, gen };
         const attributedPrincipal = (principal ?? this.anonymousAlias) ?? null;
         this.writeMarkFile(this.markPathFor(sessionId, principal), next.rev, sessionId, attributedPrincipal, gen);

package/dist/stores/file/usage-window-store.d.ts

@@ -9,11 +9,11 @@ import { type UsageWindow, type UsageWindowReading, type UsageWindowStore } from
  * atomic replace), so the update is atomic within the one event loop — the in-memory store's premise.
  * Cross-process governance belongs to a database backend with a real transaction.
  *
- * **Corrupt records FAIL CLOSED** — deliberately the OPPOSITE of `FileSessionPolicyStore`'s fail-open. A
- * policy file is a DENY list, where absence is the safe direction; a usage window is a CEILING, where
- * absence is the unsafe direction: treating an unreadable ledger as "no usage yet" would hand the key an
- * unlimited, silent allowance — precisely what the operator wired this to prevent. A corrupt record
- * therefore refuses with `usage_window.store_corrupt` until it is repaired or removed.
+ * **Corrupt records FAIL CLOSED** — in the same direction as `FileSessionPolicyStore`'s keyed read. A
+ * policy file is a DENY list and a usage window is a CEILING; for both, reading a damaged record as "nothing
+ * there" would drop the very limit the operator wired — here an unlimited, silent allowance, precisely what
+ * the operator wired this to prevent. A corrupt record therefore refuses with `usage_window.store_corrupt`
+ * until it is repaired or removed.
  */
 export declare class FileUsageWindowStore implements UsageWindowStore {
     private readonly dir;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.39.1",
+  "version": "7.39.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.6.json

@@ -2,7 +2,7 @@
   "repo": "core",
   "version": "7.33.6",
   "from": "2341b7826a837ce1786280ed3a9b1e1d656b1d41",
-  "to": "v7.33.6",
+  "to": "af66de6b6e52c72e094d79a3308788bad6e08824",
   "added": [],
   "removed": [],
   "changed": [],
@@ -12,6 +12,50 @@
   "typeKeys": [],
   "typeKeysUnreadableArms": [],
   "typeKeysFlattenedCount": 217,
+  "signatures": [
+    {
+      "name": "isSecretEnvKey",
+      "at": [
+        "src/core/secret-env.ts:891"
+      ],
+      "from": [
+        "(key: string, value?: string, env?: NodeJS.ProcessEnv): boolean"
+      ],
+      "to": [
+        "(key: string, value?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "+optional param `platform?: NodeJS.Platform`",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "scrubSecretEnv",
+      "at": [
+        "src/core/secret-env.ts:907"
+      ],
+      "from": [
+        "(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv"
+      ],
+      "to": [
+        "(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[], platform?: NodeJS.Platform): NodeJS.ProcessEnv"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "+optional param `platform?: NodeJS.Platform`",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
   "declarationMoves": [],
   "mintMoves": [],
   "criteriaObserves": [
@@ -52,12 +96,17 @@
     }
   ],
   "consumersHint": {
-    "cli": [],
-    "server": [],
+    "cli": [
+      "isSecretEnvKey",
+      "scrubSecretEnv"
+    ],
+    "server": [
+      "isSecretEnvKey",
+      "scrubSecretEnv"
+    ],
     "sdk": [],
-    "note": "scanned cli@4e593722 server@46b7fe60 sdk@10cf14c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+    "note": "scanned cli@a7a00bd8 server@79de35f8 sdk@2756723 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
   },
   "breakingCount": 0,
-  "breakingItems": [],
-  "toResolvedAt": "2f7a1e0a72b2b8c6af18f9fb9de3620ec80c0cf6"
+  "breakingItems": []
 }

package/wire-changes/core@7.39.2.json

@@ -0,0 +1,102 @@
+{
+  "repo": "core",
+  "version": "7.39.2",
+  "from": "335797ec9feceb08277d52fd882d20f00374808f",
+  "to": "fe41b09d0494634b4adfb12e9024f67719247eec",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 220,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "Model.extraBody",
+      "assertions": [
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.executionEnvFactory",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.onError",
+      "assertions": [
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPolicyStore.getRules",
+      "assertions": [
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPolicyStore.putRules",
+      "assertions": [
+        "G6.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.rewindNotes",
+      "assertions": [
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.terminal",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.terminal.code",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.a",
+        "G5.a",
+        "G6.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.terminal.message",
+      "assertions": [
+        "G3.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskSpec.resumeAt",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@1c57a121 server@79de35f8 sdk@8ce1faa — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}