@sema-agent/core 7.47.0 → 7.48.0

package/CHANGELOG.md

@@ -1,3 +1,57 @@
+## 7.48.0 — 2026-10-10
+
+**Docs and tooling (zero behavior).** `docs/ARCHITECTURE-LAYERS.md` — the layering constitution (five layers + the L−1 primitives layer, rules R1–R8, six placement tests, gates G1–G3; adopted as drafted, C-R318, #1469; mirrored in the shared audits), with the reference-adapter positioning note (`src/examples/adapters/pg-adapter.ts`) and the `docs/ARCHITECTURE.md` storage line rewritten under it (one contract, several implementations is the legal shape; a second contract of the same name is the defect). Comments and docs say `web-admin` where they said the retired names (C-R325, #1499; historical records and the fixture env names that mirror server's real keys are unchanged). `scripts/verify-debts.mjs --rc-gate` resolves the shared ledger through the main checkout via the one git seam and refuses with exit 1 when no ledger is found (#1477; a release-candidate tree under /private/tmp used to pass vacuously).
+
+**Shell read family (#1461 #1459 #1460 #1446 #1452 #1463 #1424 #1466) —** hard-breaking: none; closed sets: 0; exports: 0 added / 0 removed; `SHELL_WRAPPER_TABLE` (exported constant): the `watch` row gains its option sets (the projection of its two implementations' grammar rows; `-d`, which they read differently, is left out). Behavior: narrowing, with four loosenings named below (each open to veto; #1461 names two) and one plan-level reading (#1452).
+
+- **#1461 one value table (narrowing; open to veto).** A segment is read once per combination of one value for each name its words may hold several values of; in each reading a settled word is its value for every reader — the program position (`P=rm; "$P" -rf <root>`: `dangerous_delete` on every arm; was `ordinary`, run under a `Bash` allow and under bypassPermissions), a launcher's fields, a re-entered text, an operand, a pipe's printed text. An unquoted value of words splits into its fields (`X="<root> zz"; sudo -s rm -rf $X`: `dangerous_delete`; was `probe`). The recursive-forced-removal text check reads a value's safe-root reference as the reference it is (`X='$PWD'; sudo -s rm -rf "$X"` ≡ `sudo -s rm -rf '$PWD'`: `unverifiable_delete`). **Loosening:** an unquoted value is no longer an unresolved read unless it holds a backslash, a `~` or an extglob parenthesis (a quote, `$`, brace or `!` in it is a character: bash re-reads none) — a multi-word one is split into its fields, and each field is read as a word of its own under the same identity rule as a written word (named by its text, its `NAME=value` shape kept), never as syntax (`X="for <root>/apple"; $X` runs a program named `for`; no field is a loop, block, control word, `coproc` or assignment), by every reader, the removal guard included: `cat $X` with `X='a b'` reads `a` and `b`; removing the task root still asks (`X="-- <root>"; rm -rf $X`, `X="-v <root>"; rm -rf $X`, `X="-rf <root>"; rm $X`, `command rm $X`: `dangerous_delete`, as `rm -rf -- <root>`; were `unverifiable_delete` / `probe`), and `X='if=a of=b'; dd $X` reads `a`; `X=ls; su root -c "$X"` is no longer a runtime-script `dangerous_delete` (the script is `ls`). The lexer's command position is the one reading of "is this word syntax", and it now covers `coproc`: the word after `coproc`, and after `coproc NAME`, stands at command position (bash's grammar), so `coproc [NAME] [[ 0 -eq 'a[$(cat <key>)]' ]]` / `(( … ))` / `{ …; }` plan the nested command the arithmetic or group runs, as on 7.47.0 (without it, `coproc [[ 0 -eq 'a[$(rm -rf <root>)]' ]]` would run without a removal card under a `Bash` allow rule and under bypassPermissions, and the protected-file read inside the same form would still be denied — through the operand reading alone).
+- **#1459 every launcher field asks the value table (narrowing).** `su -c` / `runuser -c` / `watch` / `bash -c` hand every established value (were: one) — a link to a denied file named by any value is refused.
+- **#1460 the fold counts distinct names; no sample (narrowing).** Names are read in the order the words read them while the readings stay within 64; a name past that is unknown, every value it held a deny floor — carried into the shell a launcher starts. The 7.47.0 diagonal sample is gone: `sudo -s "$P" -rf "$X"` nine × nine with `rm` and the root off the diagonal is `dangerous_delete` (was `probe`, run under bypassPermissions). A loop nested in a body (`do for x in …`) now binds its name (was unknown: the test-[9595] double `for` loop asked `probe`). **Loosening:** such a loop's reads are now established (a read-only nested loop over in-root files no longer asks the read-face `probe`: it runs under a `Bash` allow or bypassPermissions without a card; the default arm still asks, `ordinary`).
+- **#1446 one launcher reading: getopt clusters (narrowing).** A launcher option cluster is read as getopt reads it (`sudo -iu root rm -rf ~`, `sudo -su root …`, `env -iu FOO rm -rf ~`: `dangerous_delete`; were a decline run under bypassPermissions) — its command-line letter too: the rest of the word, or the next word, is the command line it runs (`env -vS 'rm -rf ~'`, `env -iS'rm -rf ~'`: `dangerous_delete`; were run under a `Bash` allow and bypassPermissions on 7.47.0 as well).
+- **#1452 `watch` declares its options, procps and BusyBox (narrowing).** procps: `-n` / `--interval`, `-q` / `--equexit`, `-s` / `--shotsdir` (a directory it writes into) take a value, `-d` / `--differences` one only attached (`-dn` is `-d` holding `n`), `-x` / `--exec` run the program; BusyBox: `-d` / `-t` switches, `-n` a value. `--` ends the options; each implementation's words from its first operand on are a shell text, read (an implementation that rejects an option reads none): `watch -n 1 'rm -rf ~'` (was `probe`, run under bypassPermissions), `watch -dn 1 'rm -rf ~'`, `watch -dn rm -rf ~`: `dangerous_delete`. A launcher's option is told apart by its spelling — a short switch in front (`watch -d 'rm -rf ~'`, `-c`, `-b`, `-t -d`, `-d=permanent`) no longer reads as `-x`, nor `su -f` as `-l`. **Plan only:** `watch -n 5 ls -l` names `ls -l` as its text (was a program named `5`); the lane still asks `probe` for it, as on 7.47.0.
+- **#1463 a shell run as another user starts with that user's home (narrowing; message change).** `sudo -i`, `su` / `runuser` (not `-m` / `-p`), `doas -s`: `HOME` is the target's (root: `/root`, macOS `/var/root`; another user: unknown); `sudo -s`: the caller's or the target's (sudoers policy); a login shell (`sudo -i`, `su -` / `-l`) stands in that home (`sudo -i rm -rf ../etc`: `dangerous_delete`; was `probe`, run under bypassPermissions). `sudo -i rm -rf ~`, `su root -c 'rm -rf ~'` now card the top-level `/root` (were: the caller's home). KL-1421-a retired.
+- **#1424 standard input flows (narrowing; open to veto).** A group's members read the pipe that feeds the group (`echo 'rm -rf ~' | { true; bash; }`); a `-c` text reads its shell's input (`bash -c 'bash' <<EOF`); a shell's process-substitution script file (`bash <(…)`) and a shell whose argv a stream fills in (`… | xargs -I{} bash -c '{}'`) run a script built when the command runs (`dangerous_delete`, `runtime_script`) — also for a harmless text (`ls | xargs -I{} sh -c 'echo {}'`).
+- **#1466 the judge sees every name bash opens (narrowing).** A part of a pattern word (an attached option value, `if=` / `NAME=` values) carries the word's widened pattern (`grep --file=["!"a]* x`, `grep -f["!"a]* x`, `dd if=["!"a]*` refused where they reach a denied link); a `[:` / `[=` / `[.` that forms no unit is a member as bash reads it, and a class holding one is widened (`[[:alpha]]`, `[[:a]x/y:]`, `[a[=b]c=]` — bash 3.2's literal name and 5.3's match both judged); an array element's floor carries its pattern; an unquoted value's glob characters form its pattern (`X='<root>/["!"a]*'; cat $X`) and an expansion inside brackets forms the class from its value (`X=/; cat [${X}a]*`); the pattern is formed once the whole field has expanded — a value's `[` and a literal's `]` form one class (`X='['; cat ${X}a]pple` refused where `apple` is a denied link), a value split inside brackets hands its words (`X=" <root> "; rm -rf [${X}]`: `dangerous_delete`; was `probe`, run under bypassPermissions), a quoted `-` there is a member, never a range. **Loosening:** an unquoted value with glob characters is no longer an unresolved read (a pattern over in-root names no longer asks the read-face `probe`: it runs under a `Bash` allow or bypassPermissions without a card; the default arm still asks, `ordinary`). KL-7470-c / KL-7470-d retired.
+
+**Package exports** (`npm run handoff:diff v7.47.0 HEAD`): +0 / −0 for the four items below (no export added or removed; one exported function, `normalizeRules`, throws where it used to return, and one exported type, `ReadDenyEntry`, documents a spelling it always accepted).
+
+### Session rules: a bucket that is not a list of strings is refused — a bare `"rm"` was stored as `["r","m"]` (#1471; behavior narrowing: string-shaped rules are now rejected) (@server)
+
+- **Before (v7.47.0).** `normalizeRules` spread whatever a bucket held: `commandDeny: "rm"` became `["r","m"]` — a deny of two commands that do not exist, so `rm` ran — and `allowDirs: "/x"` threw a raw `.map is not a function`. Both bundled stores' `putRules` stored the result.
+- **Now.** `normalizeRules` reads each of the five buckets (`toolAllow`, `toolDeny`, `commandAllow`, `commandDeny`, `allowDirs`) through one reader and throws a `TypeError` (`session rules commandDeny must be an array of strings, got a string …`) for a bucket that is not an array of strings — a bare string, `null`, an object, an array holding a non-string, or an array holding an empty or white-space-only entry (`""` is a string and no name; `allowDirs: [""]` used to be stored as `"."`) — the last in the same sentence family (`… got an array holding an empty or blank entry — a rule list is written as a list of names`), no new code. Both stores' `putRules` call it before they judge names, tighten or persist anything, so the write rejects and nothing is stored: no row, no high-water mark, no rev taken (an existing row keeps its rev and its list; pinned for a shape refusal, an empty / blank entry, a retired name and an unmintable name, on both stores). The refusal is not a `SessionPolicyError` code (the four-word code set is unchanged). Absent / `undefined` buckets stay absent; `[]` is a list.
+- **Who is hurt.** A host that handed rules as a string, with non-string entries, or with an empty entry (for example a list split from an empty setting, `"".split(",")` is `[""]`) — now a `TypeError` from `putRules` / `normalizeRules` instead of a stored dead list. Callers of `normalizeRules` outside the bundled stores (read from the server tree: its SQL session-policy store and session sync) throw on a malformed record where they stored characters. A row an older release already stored as characters (or holding `""`) stays as written; an operator write replaces it (a non-operator write reads the removed entries as a loosening — `loosenReasons`; the judge answers `current` for `""`, so a stored empty `toolDeny` entry is not removable by the session's owner).
+- **Compensation.** Write `commandDeny: ["rm"]`.
+- Pins: `test/backlog7480-smallfix.test.ts` #1471 ①②.
+
+### A protocol name with an empty tool segment (`mcp__srv__`) is judged `unmintable_segment`, not `current` (#1400; behavior narrowing: a rule that guarded nothing in silence is now refused or announced) (@server @cli)
+
+- **Before (v7.47.0).** `judgeRuleToolName("mcp__srv__", roster)` answered `current` and `compileAllowEntry("mcp__srv__", "deny" | "allow", roster)` compiled a `tool` row named `mcp__srv__` — a row no tool is minted under, with no notice. `APPROVAL_DENY=mcp__srv__` read as "deny the server" and guarded nothing.
+- **Now.** A protocol name that ends in the separator (an empty tool segment, in every namespace of the protocol table) answers the existing `unmintable_segment` verdict, with a one-line `guidance` naming the empty tool segment and the two spellings (`<prefix><peer>` for every tool of a peer, `<prefix><peer>__<tool>` for one tool) and no `currentName`. No new verdict word (the closed set stays four). It is judged before the peer's spelling, so no suggested rewrite is itself dead. Its readers answer as for the empty peer: a session-rule write is refused (`SessionPolicyError` `legacy_tool_name`, `detail.verdict: "unmintable_segment"`); a run whose tool policy or stored session row holds the name fails at prepare (`config.legacy_tool_name`); an `allowedTools` / `disallowed-tools` entry read against a roster is announced as `tool_name`, and the notice says "a namespaced name with a segment the engine never mints" (was "a peer segment …"). The roster-less compile still reads the grammar alone (as it does for the empty peer).
+- **Who is hurt.** A deployment, policy or stored session row that holds `mcp__<server>__` / `a2a__<peer>__`: a run that started with the dead entry now fails at prepare (a session write is refused); a stored row's owner takes the entry out with an ordinary write (removing it is not a loosening).
+- **Compensation.** Write `mcp__<server>` to cover the whole server, `mcp__<server>__<tool>` for one tool.
+- **Consumers.** server — the one question `namespaced-rule-name.ts` kept for this name (server's file; the ledger names it) can go once it takes this build.
+- Pins: `test/backlog7480-smallfix.test.ts` #1400 ①②③.
+
+### `workflow_run.error` is secret-redacted where the engine mints it (#1472; behavior change: credential-shaped text in a failed run's `error` is now `[redacted…]`) (@server)
+
+- **Before (v7.47.0).** `runWorkflow` minted `WorkflowRun.error` from the thrown text unredacted while `result` went through `redactSecrets`; the file run store (`DB_BACKEND=local`) wrote `error` to disk as it came, and a SQL store had to redact it again on its own.
+- **Now.** The failure branch passes the thrown text through the same `redactSecrets` (same `[redacted…]` markers) — no length bound is added. The thrown value itself reaches the caller untouched. In-memory and file stores hold the redacted text; a store that redacts a second time changes nothing (the redactor is idempotent on its own output — pinned).
+- **Who is hurt.** A consumer that matched a credential-shaped fragment inside `run.error`. Rows an older release already wrote stay as written.
+- **Consumers.** server — its own pass at the SQL store's write (`workflow-run-store-sql.ts:91`) is now a second pass over already-redacted text; it stays until the 7.49.0 fixture union settles ONE detection table — the two tables are not supersets of each other today ([9588]: each side passes patterns the other catches), so retiring it now would drop the server-only patterns (#1468 phase two).
+- Pins: `test/backlog7480-smallfix.test.ts` #1472.
+
+### `readDenyPatterns`: a pattern that opens with `/` is rooted (#1442; behavior narrowing: the row now names that one location, not that tail at any depth) (@server @cli)
+
+- **Before (v7.47.0).** `normalizeEntry` stripped the leading `/` and the row matched its segments at ANY depth (ASCII-folded): a deployment's `/app/config-lkg.json` also blocked a user repo's `<anything>/app/config-lkg.json` — Read refused it, Grep silently left it out, the rg legs excluded `!**/app/config-lkg.json`.
+- **Now.** A pattern that opens with `/` (and whose first segment is not the home word) is **rooted**: its run starts at the first segment of an absolute path — `/app/config-lkg.json` and what lies under it, nothing at depth. The mechanism is the home word's (`anchors` + `rootedOnly`), the case rule is the entry's `caseSensitive` knob (default ASCII-folded), `*` stays one segment. The canonical entry text keeps the leading `/` (`effectiveReadDenyPatterns`, the persisted entries), so `/a/b` and `a/b` are two rows and `//a//b/` is `/a/b`; `/~/x` is still the home word (`~/x`). A path spelling that is not absolute is not judged by a rooted row (the resolved key is). A rooted row carries no rg exclusion glob (`unexcludableUnder`): a Grep whose scope is relative, above or at the row does not use the rg exclusion and judges with the matcher — the route a `~/` row already takes (read from `search.ts`; the Grep cell below runs it). The built-in table has no row that opens with `/` (additive). **A rooted row is placed where its literal head leads, as a `~/` row is**: the head (the run's segments before the first `*`) is resolved in the execution environment the way the read faces mint their keys, and where a component of it is a symlink or a mount point the row is placed at the target too, the rest of its run matched below it — so `/app/config-lkg.json` with `/app` a link to `/data/app` also refuses a direct read of `/data/app/config-lkg.json`, and the deployment names the declared spelling alone. It is one machine (`linkedLocationsOf`, `read-deny-home.ts`) with a second row builder (`readDenyRootLinksOf`, beside `readDenyHomeLinksOf`) and the one `linked` arm in `compileReadDeny`; the placement reads it whether or not a home answered, a head the environment does not answer leaves the placement not whole (asked again, as for a `~/` row), a head with nothing below it or none at all (`/*.json`) adds nothing. The module-internal functions `readDenyRootLinksOf` / `isRootedReadDenyPattern` are not package exports.
+- **Who is hurt.** A deployment whose `readDenyPatterns` row opens with `/` and that relied on the any-depth reading (for example a row meant to guard a mounted path under several parents): it now guards the exact absolute location only. A win32 path keeps its drive segment (`C:`), so a `/…` row does not name it (read from the matcher; not run on win32). A checkpoint written by an older release holds the stripped, any-depth form and resumes with it beside the new rooted row (the union, wider; inferred from the resume seat's addition list).
+- **Compensation.** Spell the row without the leading `/` to keep the any-depth reading; write `/…` for the exact location. A deployment need not list the declared spelling and the realpath both: the placement adds the target of a link. server's two rows derived from the config path (declared spelling and realpath) are exact locations now and the second is redundant but harmless (@server).
+- **Known limits.** The placement resolves a row's literal head only. A link BELOW the head, under a wildcard run (`/app/*.json` with `/app/secret.json` a link to `/vault/key`), is not enumerated: the row refuses the spelling that names the link and not a direct read of `/vault/key` — the same for a `~/` row, and not a regression (the any-depth row did not refuse it either); name the target to guard it. A rooted head under a directory the engine may not enter leaves a library mount's placement not whole, asked again at the next placement (a `~/` head's law).
+- Pins: `test/backlog7480-smallfix.test.ts` #1442 ①②③④ (③ is the real Read and Grep through the production toolkit; ④ is the placement: the link's target through the toolkit, a wildcard rest, the Runner's carried placement, the held-anywhere path and an unanswered head; `~/` row placed today as the premise).
+
+**Pins and mutations.** `test/backlog7480-smallfix.test.ts` (80 cells, r2 included; with each ticket's domain files put back to the base `5c7d569b9` the pin reads 13 / 12 / 3 / 12 red for #1471 / #1400 / #1472 / #1442, and 6 more red for the #1442 placement alone, every control cell green). Mutations (`.gate-logs/criteria-7480-mutations.md`, per fixture, each one's expected-red fixtures hit and its controls kept): M1471a–e, g–k (validation off; a bare string accepted as one rule; one bucket unchecked, twice; non-string entries accepted; a sparse array's hole skipped; r2: empty / blank entries accepted, names judged after the store's write, in both stores), M1400a–g (the arm off; arm after the peer rewrite; bare peer also flagged; mcp only; a new verdict word; the verdict set gains a word; the allow layer ignores the verdict), M1472a–b (unredacted; length-bounded), M1442a–f, h (leading `/` stripped; `rootedOnly` dropped; unanchored; home word loses precedence; persisted check on the old spelling; case fold lost; rg globs minted), MP1–MP7 (the placement: linked arm skips rooted rows; the main path drops the rooted answer; the held-anywhere path omits it; the places-nothing test ignores rooted rows; the head ignores its first star; `whole` ignores the rooted heads; an emptied `anchored`). `test/read-deny.test.ts` "separator spellings canonicalize ONCE" is re-pinned (its first entry `/corp-secrets` was the old any-depth reading; it is `corp-secrets//` now).
+- **Rollback.** A checkpoint 7.48.0 writes carries a `/…` row in its rooted, canonical form; a worker on core 7.47.x resuming it refuses (`checkpoint.invalid_outcome`, reason `read_face_damaged` — the older screen holds every persisted deny entry to its own canonicality bar) and the checkpoint stays pending. Roll back only when no parked task holds such a checkpoint, or resume them on 7.48.0 first (@server).
+
 ## 7.47.0 — 2026-10-09
 
 **Erratum (docs; 7.43.0 compensation).** The 7.43.0 compensation sentence «finish a parked task on a worker of the release that parked it» named a way out without its cost: that release reads the twin / retired `disallowed-tools` entry as nothing too, so the tool the entry meant to deny runs there with no refusal (KL-1372-b). Finishing there is a choice to run that task without that deny; the recovering way out is to expire the task and submit it again with the entry corrected. `docs/INTEGRATION-CORE.md` says so now. Reported by the test lane ([9368] ④).

package/dist/core/allow-entry.js

@@ -405,7 +405,7 @@ export function inertEntryPhrase(e) {
             case "unprefixed_namespace":
                 return 'tool_name: a "__" name with no protocol prefix';
             case "unmintable_segment":
-                return `tool_name: a peer segment the engine never mints${spelling !== undefined ? `, write "${spelling}"` : ""}`;
+                return `tool_name: a namespaced name with a segment the engine never mints${spelling !== undefined ? `, write "${spelling}"` : ""}`;
             default: {
                 const exhaustive = e.verdict;
                 return exhaustive;

package/dist/core/checkpoint-store.d.ts

@@ -1231,7 +1231,7 @@ export interface CheckpointState {
      * [c209-C] Q5 — the listing frames' announced NAME-SETS at suspend (agent types / skills the model
      * has actually been shown this run, committed on first-frame delivery or intact boundary survival).
      * A resume leg seeds its producers from these names and DIFFS the current roster/skill set against
-     * them, so cross-leg drift (config-center roster change between suspend and resume) is announced as
+     * them, so cross-leg drift (web-admin roster change between suspend and resume) is announced as
      * a delta frame at the first boundary instead of silently swallowed — the exact event the listing
      * eviction from the cached prefix exists to serve. Names only, never contents (a description change
      * on a surviving name is deliberately not re-announced — name-keyed diff, agent_listing parity).

package/dist/core/mcp-server-spec.d.ts

@@ -9,7 +9,7 @@ import type { ToolContentOrigin, ToolEffect } from "./tool-spec.js";
 import type { ToolFamily, ToolPathTarget, ToolRenderHints, ToolRuleFace } from "./tool-face.js";
 /** Definition of an MCP server to connect to for the duration of one task, then discard. */
 export interface McpServerSpec {
-    /** Stable name; tool names are namespaced as `<name>__<tool>` to avoid collisions. */
+    /** Stable name; tool names are namespaced as `mcp__<server>__<tool>` (the protocol prefix, then this name as the peer segment) to avoid collisions. */
     name: string;
     /**
      * Where this declaration CAME FROM, in the declaring side's own words (a shell's `plugin` / `user` /

package/dist/core/runner/park-commit.d.ts

@@ -33,7 +33,7 @@ export declare const DEFAULT_UNATTENDED_APPROVAL_TTL_MS: number;
  * A caller-supplied TTL is only a TTL if it is a finite, positive number.
  * `TaskSpec.durableApproval.ttlMs` / `resourceSuspend.ttlMs` are typed as a bare `number`, and the mint
  * arithmetic was `Date.now() + ttlMs` with NO validation — so `Number(process.env.APPROVAL_TTL_MS)` on an
- * unset/malformed env var (a config-center miss, an upstream arithmetic slip) silently produced
+ * unset/malformed env var (a web-admin miss, an upstream arithmetic slip) silently produced
  * `deadline = NaN`. Every reaper comparison is `deadline <= cutoff`, and `NaN <= anything` is FALSE, so a
  * checkpoint that LOOKS bounded (it carries a ttlMs and a deadline) became permanently IMMORTAL: no reap
  * cutoff, however far in the future, could ever expire it → a pinned session + a stranded paused VM, and

package/dist/core/safety-axis-vocab.d.ts

@@ -2,7 +2,7 @@
  * `SAFETY_AXIS_VOCABULARY` — the PUBLISHED safety-axis vocabulary as a zero-logic, zero-runtime-dependency DATA
  * artifact (pure string / number / boolean literal constants).
  *
- * **design/99 center control-plane seam (2026-06-27).** The sema-registry control plane's per-field
+ * **design/99 center control-plane seam (2026-06-27).** The web-admin control plane's per-field
  * safety-classification table lives in `@sema-agent/registry-core` and, for every safety-critical config field, cites a
  * core axis VALUE (e.g. `effect: "write"`, `irreversibility: "always"`). That contract package **must not depend on
  * `@sema-agent/core` (the engine) at runtime** — so it dev-imports THIS const (test-only) and runs a conformance test

package/dist/core/safety-merge-corpus.d.ts

@@ -1,6 +1,6 @@
 import type { SessionPermissionRules } from "./session-policy-store.js";
 /**
- * design/99 (sema-registry center control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
+ * design/99 (web-admin control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
  * for the safety-domain MERGE predicate {@link loosenReasons}.
  *
  * THE SEAM. The center control-plane's ConfigBundle merger is a DISPATCHER: for any field it classifies

package/dist/core/session-policy-store.d.ts

@@ -67,7 +67,7 @@ export interface SessionRuleNameRefusal {
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
  *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
  *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev; the fourth
- *  code = a tool-name bucket names a retired name, a prefix-less `__` name or a peer segment no mint spells
+ *  code = a tool-name bucket names a retired name, a prefix-less `__` name or a segment no mint spells (an empty one, or a peer spelled otherwise)
  *  ({@link assertSessionRuleNamesCurrent}) — `detail` is present on that code and only on it. */
 export declare class SessionPolicyError extends Error {
     readonly code: "conflict" | "loosen_forbidden" | "corrupt" | "legacy_tool_name";
@@ -121,7 +121,8 @@ export interface SessionPolicyStore {
     /** Write the rules for a key: CAS on `expectedRev`, then the name judge ({@link assertSessionRuleNamesCurrent} —
      *  operator writes included), then, for a non-operator write over an existing row, the
      *  tighten-only check ({@link loosenReasons}) — both against the names the deployment declares it mounts its own
-     *  tools under. */
+     *  tools under. A bucket that is not a list of strings (a bare `"rm"` for `commandDeny`) throws a `TypeError` from
+     *  {@link normalizeRules} before any of those is judged, and nothing is written. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
      * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
@@ -172,7 +173,9 @@ export interface SessionPolicyStore {
  */
 declare function lexWithin(root: string, p: string): boolean;
 /** Normalize a rules object's `allowDirs` (lexical `posix.normalize`) so stored rules are `..`-free and the
- *  tighten diff compares the same canonical-ish form the runtime resolves. */
+ *  tighten diff compares the same canonical-ish form the runtime resolves. Every bucket must be a list of strings
+ *  ({@link ruleList}); a bucket that is not one throws `TypeError`, so neither bundled store (nor a durable twin that
+ *  normalizes through this function) can store a rule list the matcher would read differently from the one written. */
 export declare function normalizeRules(rules: SessionPermissionRules): SessionPermissionRules;
 /**
  * Pure tighten-only diff: the reasons `next` LOOSENS `prior` (empty ⇒ `next` is a pure tightening or no-op).

package/dist/core/session-policy-store.js

@@ -75,18 +75,36 @@ function lexWithin(root, p) {
         return true;
     return np === nr || np.startsWith(nr + "/");
 }
+function ruleList(field, value) {
+    if (value === undefined)
+        return undefined;
+    const refuse = (got) => {
+        throw new TypeError(`session rules ${field} must be an array of strings, got ${got} — a rule list is written as a list of names (["rm"], not "rm")`);
+    };
+    if (Array.isArray(value) && Array.from(value).every((entry) => typeof entry === "string")) {
+        if (value.some((entry) => entry.trim() === ""))
+            refuse("an array holding an empty or blank entry");
+        return value;
+    }
+    return refuse(Array.isArray(value) ? "an array holding an entry that is not a string" : value === null ? "null" : `a ${typeof value}`);
+}
 export function normalizeRules(rules) {
     const out = {};
-    if (rules.toolAllow !== undefined)
-        out.toolAllow = [...rules.toolAllow];
-    if (rules.toolDeny !== undefined)
-        out.toolDeny = [...rules.toolDeny];
-    if (rules.commandAllow !== undefined)
-        out.commandAllow = [...rules.commandAllow];
-    if (rules.commandDeny !== undefined)
-        out.commandDeny = [...rules.commandDeny];
-    if (rules.allowDirs !== undefined)
-        out.allowDirs = rules.allowDirs.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/");
+    const toolAllow = ruleList("toolAllow", rules.toolAllow);
+    const toolDeny = ruleList("toolDeny", rules.toolDeny);
+    const commandAllow = ruleList("commandAllow", rules.commandAllow);
+    const commandDeny = ruleList("commandDeny", rules.commandDeny);
+    const allowDirs = ruleList("allowDirs", rules.allowDirs);
+    if (toolAllow !== undefined)
+        out.toolAllow = [...toolAllow];
+    if (toolDeny !== undefined)
+        out.toolDeny = [...toolDeny];
+    if (commandAllow !== undefined)
+        out.commandAllow = [...commandAllow];
+    if (commandDeny !== undefined)
+        out.commandDeny = [...commandDeny];
+    if (allowDirs !== undefined)
+        out.allowDirs = allowDirs.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/");
     return out;
 }
 export function loosenReasons(prior, next, mountedToolNames = NO_DECLARED_TOOLS) {

package/dist/core/shell-wrapper-table.d.ts

@@ -114,8 +114,8 @@ export declare const SHELL_WRAPPER_TABLE: {
         readonly commandString: readonly [];
     };
     readonly watch: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
+        readonly valueFlags: readonly ["--equexit", "--interval", "--shotsdir", "-n", "-q", "-s"];
+        readonly flags: readonly ["--beep", "--chgexit", "--color", "--differences", "--errexit", "--exec", "--follow", "--help", "--no-color", "--no-rerun", "--no-title", "--no-wrap", "--precise", "--version", "-C", "-b", "-c", "-e", "-f", "-g", "-h", "-p", "-r", "-t", "-v", "-w", "-x"];
         readonly commandString: readonly [];
         readonly viaShell: true;
     };

package/dist/core/shell-wrapper-table.js

@@ -15,7 +15,7 @@ export const SHELL_WRAPPER_TABLE = {
     timeout: { valueFlags: ["--kill-after", "--signal", "-k", "-s"], flags: ["--foreground", "--help", "--preserve-status", "--verbose", "--version", "-v"], commandString: [], duration: true },
     stdbuf: { valueFlags: ["--error", "--input", "--output", "-e", "-i", "-o"], flags: ["--help", "--version"], commandString: [] },
     xargs: { valueFlags: ["--arg-file", "--delimiter", "--max-args", "--max-chars", "--max-procs", "--process-slot-var", "-E", "-I", "-L", "-P", "-a", "-d", "-n", "-s"], flags: ["--eof", "--exit", "--help", "--interactive", "--max-lines", "--no-run-if-empty", "--null", "--open-tty", "--replace", "--show-limits", "--verbose", "--version", "-0", "-o", "-p", "-r", "-t", "-x"], attached: ["-i", "-l"], commandString: [] },
-    watch: { valueFlags: [], flags: [], commandString: [], viaShell: true },
+    watch: { valueFlags: ["--equexit", "--interval", "--shotsdir", "-n", "-q", "-s"], flags: ["--beep", "--chgexit", "--color", "--differences", "--errexit", "--exec", "--follow", "--help", "--no-color", "--no-rerun", "--no-title", "--no-wrap", "--precise", "--version", "-C", "-b", "-c", "-e", "-f", "-g", "-h", "-p", "-r", "-t", "-v", "-w", "-x"], commandString: [], viaShell: true },
     ionice: { valueFlags: ["--class", "--classdata", "--pgid", "--pid", "--uid", "-P", "-c", "-n", "-p", "-u"], flags: ["--help", "--ignore", "--version", "-V", "-h", "-t"], commandString: [] },
     setsid: { valueFlags: [], flags: ["--ctty", "--fork", "--help", "--version", "--wait", "-c", "-f", "-w"], commandString: [] },
     taskset: { valueFlags: [], flags: ["--all-tasks", "--cpu-list", "--help", "--pid", "--version", "-a", "-c", "-p"], commandString: [], positional: /^(?:0x)?[\da-f]+$|^[\d,:-]+$/i },

package/dist/core/tool-name-aliases.d.ts

@@ -38,12 +38,13 @@ export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "u
  *  - `unprefixed_namespace` — carries the `__` namespace separator with no protocol prefix. The roster cannot clear it:
  *    a caller tool name or alias carrying `__` is refused at prepare, every engine tool name is `__`-free, and every
  *    protocol tool is minted with its prefix.
- *  - `unmintable_segment` — carries a protocol prefix, but its peer segment (the server / remote agent) is not a spelling
- *    the mint produces for any peer: the name is read as written (peers compare exactly), and every mounted tool carries
- *    the minted spelling, so the name reaches none of them. `guidance` says so in one line; `currentName` is the whole name
- *    rewritten with the spelling the mint produces (`mcp__github.com__*` → `mcp__github_com__*`), absent when the peer
- *    segment is empty and there is nothing to rewrite. The tool segment after the peer is never judged: it is a literal
- *    tool name or a glob over one, and an unmatched one is the audit's advisory.
+ *  - `unmintable_segment` — carries a protocol prefix, but a segment of it is not one the mint produces: the peer segment
+ *    (the server / remote agent) is empty or not a spelling the mint produces for any peer (the name is read as written —
+ *    peers compare exactly — and every mounted tool carries the minted spelling, so the name reaches none of them), or the
+ *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment). `guidance` says
+ *    so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
+ *    `mcp__github_com__*`), absent when a segment is empty and there is nothing to rewrite. A tool segment that is not empty
+ *    is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
  *
  * `roster` = the tool names (aliases included) the reader knows are mounted: a run's assembled roster at prepare, the
  * names a deployment DECLARES it mounts its own tools under at a session-rule store (an empty set when it declares none).
@@ -67,8 +68,8 @@ export type RuleToolNameVerdict = {
  * `undefined` for a name that is not namespaced (no protocol prefix). The peer is the first segment — EMPTY for `mcp____x` and
  * for the bare prefix, which name no peer; the tool segment is the REST of the split rejoined, so a tool whose minted segment
  * itself carries the separator (charset normalization maps `get..issue` → `get__issue`) decomposes back to one tool name, and
- * is absent when the name stops at the peer (`mcp__srv`). The one decomposition: the judgment, the covering matcher and the
- * allow-entry grammar all read a namespaced name through it.
+ * is absent when the name stops at the peer (`mcp__srv`) and EMPTY when it ends in a trailing separator (`mcp__srv__`). The
+ * one decomposition: the judgment, the covering matcher and the allow-entry grammar all read a namespaced name through it.
  */
 export declare function splitNamespacedName(name: string): {
     readonly ns: ProtocolNamespace;

package/dist/core/tool-name-aliases.js

@@ -56,6 +56,8 @@ export function splitNamespacedName(name) {
 function unmintableSegmentOf({ ns, peer, tool }) {
     if (peer === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty peer segment — no tool is minted under it` };
+    if (tool === "")
+        return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty tool segment — no tool is minted under it; write ${ns.prefix}<peer> to cover every tool of a peer, or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> for one tool` };
     const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
     if (minted === peer)
         return undefined;

package/dist/core/tool-policy.js

@@ -725,7 +725,7 @@ function assignmentTokenSpan(tokens, i) {
     return 1;
 }
 function valueIsOpaque(value, assigned, safeVars) {
-    const v = value.replace(/["']/g, "");
+    const v = value.replace(/["']/g, "").replace(/\\(.)/g, "$1");
     if (v.includes("$(") || v.includes("`"))
         return true;
     if (/\$[@*#!?0-9-]/.test(v))
@@ -734,11 +734,12 @@ function valueIsOpaque(value, assigned, safeVars) {
         return true;
     for (const vm of v.matchAll(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g)) {
         const ref = vm[1];
-        if (!assigned.has(ref) && !safeVars.has(ref))
+        if (!assigned.has(ref) && !(safeVars.has(ref) && safeRootBelow(v.slice((vm.index ?? 0) + vm[0].length))))
             return true;
     }
     return false;
 }
+const safeRootBelow = (after) => /^\/[^*?[\]]+$/.test(after) && !after.split("/").includes("..");
 export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVERIFIABLE_DELETE_SAFE_VARS)) {
     const assigned = new Set();
     const assignedEscapesRoot = new Set();
@@ -887,9 +888,7 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
                     return `\`rm\` recursive+force target ${raw} resolves through ${name}, whose in-window value climbs above a known-safe root (\`..\`) — the deleted path cannot be verified from this command`;
                 }
                 if (safeVars.has(name)) {
-                    const after = targetNorm.slice((vm.index ?? 0) + vm[0].length);
-                    const escapesRoot = after.split("/").includes("..");
-                    if (/^\/[^*?[\]]+$/.test(after) && !escapesRoot)
+                    if (safeRootBelow(targetNorm.slice((vm.index ?? 0) + vm[0].length)))
                         continue;
                 }
                 return `\`rm\` recursive+force target ${raw} references $${name}, which has no assignment in this command — an empty or unexpected value could make this a home-directory or filesystem-root wipe`;

package/dist/orchestration/workflow.js

@@ -16,7 +16,7 @@ import { isWorkflowRunActive, closeWorkflowChannel, markWorkflowActive, publishW
 import { isDurablePause } from "../agents/suspend-guard.js";
 import { RUNNING_AGENT_OBSERVE_EVERY_BEATS } from "../config/defaults.js";
 import { boundInputHashOf } from "../core/canonical-json.js";
-import { boundedRedactedSummary } from "../core/untrusted-egress.js";
+import { boundedRedactedSummary, redactSecrets } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { deniedToolNamesOf } from "../core/runner/sub-agent-deny-lists.js";
@@ -2420,7 +2420,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             run.endedAt = now();
             if (parkedLeg !== undefined && !thrownIs(err, WorkflowAgentParkedError))
                 err = parkedError();
-            run.error = thrownText(err);
+            run.error = redactSecrets(thrownText(err));
             closeAbandonedAgents(run.endedAt);
             {
                 let thrownCode;

package/dist/prompt-assembly/types.d.ts

@@ -146,7 +146,7 @@ export interface PackSectionDeclaration {
     /**
      * design/147 epoch declaration axis (ruling a): `"provider"` marks a section whose text came
      * from the typed `stableBlocks` lane (incl. the provider-assembled pass-through role) — the SELECTOR
-     * for the epoch artifactDigest's declaration input, so a config-center publish (declaration bytes
+     * for the epoch artifactDigest's declaration input, so a web-admin publish (declaration bytes
      * change) re-pins sessions at the next legal boundary. NOT a digest-disclosure gate
      * (that stays {@link declaredContentHash}-only): epoch digests are one-way hashes over the payload.
      */

package/dist/shell/lex.js

@@ -541,10 +541,24 @@ class WordBuilder {
             return at;
         };
         const unitCloses = new Map([":", "=", "."].map((d) => [d, unitClose(d)]));
+        const lettersEnd = new Array(nf + 1).fill(nf);
+        for (let f = nf - 1; f >= 0; f--) {
+            const lower = text.charCodeAt(f) | 0x20;
+            lettersEnd[f] = lower >= 0x61 && lower <= 0x7a && readableAt(f) ? lettersEnd[f + 1] : f;
+        }
+        const unitEndAt = (f) => {
+            if (!(readableAt(f) && text[f] === "[" && readableAt(f + 1)))
+                return -1;
+            const d = text[f + 1];
+            const end = unitCloses.get(d)?.[f + 2] ?? -1;
+            if (end < 0)
+                return -1;
+            return d === ":" ? (end > f + 2 && lettersEnd[f + 2] === end ? end : -1) : end === f + 3 ? end : -1;
+        };
         const nextBracketClose = new Array(nf + 2).fill(-1);
         const nextSlash = new Array(nf + 1).fill(nf);
         for (let f = nf - 1; f >= 0; f--) {
-            const unitEnd = readableAt(f) && text[f] === "[" && readableAt(f + 1) ? unitCloses.get(text[f + 1] ?? "")?.[f + 2] ?? -1 : -1;
+            const unitEnd = unitEndAt(f);
             nextBracketClose[f] = readableAt(f) && text[f] === "]" ? f : unitEnd >= 0 ? nextBracketClose[unitEnd + 2] : nextBracketClose[f + 1];
             nextSlash[f] = text[f] === "/" ? f : nextSlash[f + 1];
         }
@@ -584,7 +598,7 @@ class WordBuilder {
                 for (let m = k + 1; m < close && !widened; m++)
                     widened = this.rawQuoted[m] !== undefined;
                 for (let f = j; f < closeAt && !widened; f++)
-                    widened = readableAt(f) && text[f] === "[" && readableAt(f + 1) && (unitCloses.get(text[f + 1] ?? "")?.[f + 2] ?? -1) >= 0;
+                    widened = readableAt(f) && text[f] === "[" && readableAt(f + 1) && (text[f + 1] === ":" || text[f + 1] === "=" || text[f + 1] === ".");
                 const from = this.foldedOf(k);
                 const to = this.foldedOf(close + 1);
                 if (!expands && widened)
@@ -748,6 +762,7 @@ function scan(source, connectorsAreText) {
     let acceptable = true;
     let timeGrammar;
     let definitionName = false;
+    let coprocWord;
     let afterLeadingRedirect = false;
     let assignmentSeen = false;
     let subscriptsClosed = false;
@@ -761,7 +776,7 @@ function scan(source, connectorsAreText) {
         w.opaque(source.slice(from, to), SUBSTITUTION_PLACEHOLDER, by, from, to, { kind, yields: kind === "command" && by === undefined ? "many" : "one", body });
         current().substitutions.push(body);
     };
-    const resetPosition = () => { acceptable = true; commandWord = undefined; afterLeadingRedirect = false; assignmentSeen = false; subscriptsClosed = false; timeGrammar = undefined; definitionName = false; };
+    const resetPosition = () => { acceptable = true; commandWord = undefined; afterLeadingRedirect = false; assignmentSeen = false; subscriptsClosed = false; timeGrammar = undefined; definitionName = false; coprocWord = undefined; };
     const endWord = () => {
         if (!w.started)
             return undefined;
@@ -816,6 +831,11 @@ function scan(source, connectorsAreText) {
         }
         if (acceptable && bare && (SHELL_CONTROL_PREFIXES.has(word.folded) || GROUP_WORDS.has(word.folded))) {
             timeGrammar = word.folded === "time" ? "opt" : undefined;
+            coprocWord = undefined;
+            return undefined;
+        }
+        if (acceptable && bare && word.folded === "coproc") {
+            coprocWord = "head";
             return undefined;
         }
         if (acceptable && bare && timeGrammar === "opt" && word.folded === "-p") {
@@ -829,10 +849,16 @@ function scan(source, connectorsAreText) {
         timeGrammar = undefined;
         if (word.assignment !== undefined && word.assignment.bare && acceptable) {
             assignmentSeen = true;
+            coprocWord = undefined;
             return undefined;
         }
-        if (acceptable)
+        if (acceptable && coprocWord !== "name")
             commandWord = bare ? word.folded : undefined;
+        if (coprocWord === "head") {
+            coprocWord = "name";
+            return undefined;
+        }
+        coprocWord = undefined;
         acceptable = false;
         return undefined;
     };

package/dist/tools/fs/bash-program-position.d.ts

@@ -34,6 +34,13 @@ export { SHELL_CONTROL_PREFIXES };
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program
  *  looked up on PATH, whose failure changes nothing), so a quoted or escaped spelling never counts as one. */
 export declare function isBareControlWord(words: readonly LexedWord[], i: number, set: ReadonlySet<string>): boolean;
+/** Does the shell read this word as syntax — a reserved word, a control word, `{`, `coproc` — of `set`? Only a word
+ *  written BARE where bash reads a command's first word (the lexer's {@link LexedWord.atCommandPosition}): a quoted or
+ *  escaped spelling is a command name, and a word an expansion produced (a value, a split field) is never syntax —
+ *  bash parses the line before it expands it. The one reading every syntax reader of a command's words asks. */
+export declare function isShellSyntaxWord(w: LexedWord | undefined, set: ReadonlySet<string>): boolean;
+/** The words that head a loop over a list (`for NAME in …`, `select NAME in …`). */
+export declare const LOOP_LIST_HEADS: ReadonlySet<string>;
 /**
  * A word bash strips as an ASSIGNMENT before it chooses the program: the lexer's assignment fact, written BARE
  * (the name, the brackets and the operator unquoted — a quoted VALUE still assigns, a quoted operator is a

package/dist/tools/fs/bash-program-position.js

@@ -16,9 +16,12 @@ export function writtenAssignmentPrefix(token) {
 }
 export { SHELL_CONTROL_PREFIXES };
 export function isBareControlWord(words, i, set) {
-    const w = words[i];
-    return w !== undefined && w.raw === w.folded && set.has(w.folded);
+    return isShellSyntaxWord(words[i], set);
+}
+export function isShellSyntaxWord(w, set) {
+    return w !== undefined && w.atCommandPosition && w.raw === w.folded && set.has(w.folded);
 }
+export const LOOP_LIST_HEADS = new Set(["for", "select"]);
 export function isLeadingAssignmentWord(words, i) {
     const w = words[i];
     return w !== undefined && w.assignment !== undefined && w.assignment.bare && w.atCommandPosition;

package/dist/tools/fs/index.d.ts

@@ -187,8 +187,9 @@ export interface HandsToolkitOptions {
      *  under a short bound of its own, and a probe of it that fails costs that entry alone. The public shell judgment takes the
      *  same list as {@link import("./shell-read-check.js").ShellReadJudgeInput.readDenyHomes}. */
     readDenyHomes?: readonly string[];
-    /** Where each home-anchored row's literal head leads beyond the home's spellings
-     *  ({@link import("./read-deny-home.js").readDenyHomeLinksOf}, keyed by the row's pattern) — the Runner passes the
+    /** Where each home-anchored row's literal head leads beyond the home's spellings, and each rooted row's (`/…`) beyond its own
+     *  spelling ({@link import("./read-deny-home.js").readDenyHomeLinksOf} / {@link import("./read-deny-home.js").readDenyRootLinksOf},
+     *  keyed by the row's pattern) — the Runner passes the
      *  locations its own judge was compiled with, so the band and the gate judge one placement.
      *  Unless a mount carries both, the band resolves the placement itself the way the Runner does (the homes it carries
      *  are its home set — the account is not asked and no home is added;

package/dist/tools/fs/index.js

@@ -14,7 +14,7 @@ export * from "./read-deny.js";
 export { readDenyHomesOf } from "./read-deny-home.js";
 import { BASH_READONLY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
-import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, readDenyBuiltinConfigOf, readDenyPatternRun } from "./read-deny.js";
+import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, isRootedReadDenyPattern, readDenyBuiltinConfigOf, readDenyPatternRun } from "./read-deny.js";
 import { withGateTimeout } from "../../core/gate-bounded-await.js";
 import { carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
@@ -51,7 +51,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
     const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
     if (carried && carriedViews === undefined)
         sayPlacementLost();
-    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored);
+    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored || isRootedReadDenyPattern(e.pattern));
     const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
     const readDeny = late?.matcher ??
         (carried