@sema-agent/core 7.48.0 → 7.49.0

package/dist/tools/fs/program-read-model.js

@@ -66,8 +66,8 @@ export function isInertBuiltin(name) {
     const b = programRow(name)?.builtin;
     return b === "inert" || b === "declaration";
 }
-export function movesBaseUnfollowed(name) {
-    return programRow(name)?.movesBase === "unfollowed";
+export function movesBaseByStack(name) {
+    return programRow(name)?.movesBase === "stack";
 }
 export function longOptionNameOf(tok) {
     if (!tok.startsWith("--") || tok.length === 2)
@@ -979,21 +979,6 @@ export function programLanguageOf(row) {
             return r.language;
     return undefined;
 }
-export function printedText(row, args) {
-    const words = args.filter((a) => a !== undefined);
-    if (row?.prints === undefined || words.length !== args.length)
-        return undefined;
-    const events = readArgRoles(row, words);
-    const from = events.find((e) => e.kind === "operand" || e.kind === "dash-word-operand")?.at ?? words.length;
-    if (events.some((e) => e.at < from && e.kind === "option" && e.reading === "speculative"))
-        return undefined;
-    const printed = words.slice(from);
-    if (printed.some((w) => w.includes("\\")))
-        return undefined;
-    if (row.prints === "words")
-        return printed.join(" ");
-    return printed.length === 1 && !printed[0].includes("%") ? printed[0] : undefined;
-}
 export function wordsReadBySomeImplementations(row, args) {
     if (row === undefined || row.grammars.length < 2)
         return new Set();
@@ -1034,7 +1019,7 @@ export function moduleTailOf(row, args) {
 }
 function steppableLauncherOption(row, tok) {
     const m = tok.startsWith("--") ? (tok.includes("=") ? undefined : mergedTable(row, "long").get(tok.slice(2))) : tok.length === 2 && tok.startsWith("-") ? mergedTable(row, "short").get(tok[1]) : undefined;
-    if (m === undefined || m.spec.value?.kind === "shell-text" || (m.spec.value?.kind === "path" && m.spec.value.base !== undefined))
+    if (m === undefined || m.spec.value?.kind === "shell-text")
         return undefined;
     return m.arity !== "disputed" || takesNoWordBare(row, tok) ? m : undefined;
 }
@@ -1085,6 +1070,27 @@ export function launcherOptionPathRole(row, tok) {
     const role = readLauncherOption(row, tok)?.valued?.spec.value;
     return role?.kind === "path" ? role : undefined;
 }
+export function launcherOptionMovesBase(row, tok) {
+    const moves = (m) => m?.spec.value?.kind === "path" && m.spec.value.base !== undefined;
+    if (tok === "-" || tok === "--")
+        return false;
+    if (tok.startsWith("--")) {
+        const eq = tok.indexOf("=");
+        return moves(steppableLauncherOption(row, eq > 2 ? tok.slice(0, eq) : tok));
+    }
+    if (!/^-[^-]/.test(tok))
+        return false;
+    for (let i = 1; i < tok.length; i++) {
+        const m = steppableLauncherOption(row, `-${tok[i]}`);
+        if (m === undefined)
+            return false;
+        if (moves(m))
+            return true;
+        if (m.arity !== 0)
+            return false;
+    }
+    return false;
+}
 export function launcherOptionStep(row, tok) {
     return readLauncherOption(row, tok)?.step;
 }
@@ -1267,12 +1273,16 @@ export function messageWords(program, words, programIndex) {
     const j = programIndex + 1 + found.at;
     const sub = found.row.grammars[0];
     const settled = (k) => words[k] !== undefined && words[k].expands === false;
+    const oneArgument = (k) => {
+        const pieces = words[k]?.word?.expansions ?? [];
+        return pieces.length > 0 && pieces.every((p) => p.expansion?.kind === "command" && p.expansion.yields === "one");
+    };
     const longValues = Object.entries(sub.long).filter(([, s]) => s.arity === 1);
     let pending;
     for (let k = j + 1; k < words.length; k++) {
         const w = words[k].folded;
         if (pending !== undefined) {
-            if (pending === "message" && settled(k))
+            if (pending === "message" && (settled(k) || oneArgument(k)))
                 out.add(k);
             pending = undefined;
             continue;

package/dist/tools/fs/program-read-model.rows.d.ts

@@ -1,17 +1,3 @@
-/**
- * The rows of the program read model (`program-read-model.ts` is the schema and the readers). One row per program
- * bash can run at a segment's program position, grouped by family. Every row is DATA: adding a program, an option or
- * an implementation is a row edit, never a reader branch.
- *
- * How a row is written:
- *  · an option is declared with its arity and, where it is known, the ROLE of its value; a value whose role is not
- *    known is declared by arity alone, and every reader then reads that option the speculative way;
- *  · where two implementations of one program disagree, the row carries one grammar per implementation, and the
- *    readers combine them (a short letter whose arity they dispute is read as nothing; a disputed long name as
- *    optional-valued; a spelling one implementation does not declare is one it rejects, opening nothing);
- *  · a row is checked against the real binaries by the gate (`test/program-read-model.binary-gate.test.ts`);
- *    a row the gate cannot run says why in `witness`.
- */
 import type { ProgramRow } from "./program-read-model.js";
 /** The time a launcher waits (`timeout 5s …`): a number with an optional unit. */
 export declare const DURATION_SPELLING: RegExp;

package/dist/tools/fs/program-read-model.rows.js

@@ -1,3 +1,4 @@
+import { shellWordsOf } from "../../shell/shell-words.js";
 const READ = { kind: "path", effect: "read" };
 const WRITE = { kind: "path", effect: "write" };
 const CREATED = { kind: "path", effect: "create" };
@@ -504,7 +505,7 @@ const git = {
 const noPath = (key, rest, extra = {}) => ({ key, grammars: [], operands: { rest }, witness: BINARY, ...extra });
 const BUILTIN_ONLY = { declared: "a shell builtin with no binary of its own on every host: its words are read by the shell" };
 const noPathRows = [
-    noPath("pwd", LABEL, { builtin: "inert" }), noPath("echo", LABEL, { builtin: "inert", grammars: [grammar(switches("neE"), {}, { afterFirstOperand: "operands" })], prints: "words" }), noPath("printf", LABEL, { grammars: [grammar({ v: val(BINDS_NAME) })], prints: "format" }), noPath("whoami", LABEL), noPath("uname", LABEL),
+    noPath("pwd", LABEL, { builtin: "inert" }), noPath("echo", LABEL, { builtin: "inert", grammars: [grammar(switches("neE"), {}, { afterFirstOperand: "operands" })] }), noPath("printf", LABEL, { grammars: [grammar({ v: val(BINDS_NAME) })] }), noPath("whoami", LABEL), noPath("uname", LABEL),
     noPath("which", LABEL), noPath("basename", LABEL), noPath("dirname", LABEL),
     { key: "tr", grammars: [], operands: { rest: LABEL, stdinBelow: "always" }, witness: BINARY },
     noPath("cal", COUNT), noPath("uptime", LABEL), noPath("id", LABEL), noPath("groups", LABEL), noPath("nproc", LABEL), noPath("locale", LABEL),
@@ -583,6 +584,7 @@ const stdinReaders = [
 ];
 const SYNTAX = { declared: "shell syntax, not a program: read by the lexer" };
 const block = (key, g = []) => ({ key, grammars: g, syntax: "block", witness: SYNTAX });
+const BLOCK_GRAMMARS = { "[[": [grammar({ v: val(BINDS_NAME) })] };
 export const PROGRAM_ROWS = [
     head, tail, cut, grepRow("grep"), grepRow("egrep"), grepRow("fgrep"), diff, cmp, sed, date, tar, find, curl,
     ls, walker("du", "names", true), walker("rg", "contents", false), walker("tree", "names", true), walker("ag", "contents", false), walker("ack", "contents", false),
@@ -622,11 +624,9 @@ export const PROGRAM_ROWS = [
     ...nameBinders,
     ...["make", "gmake", "bmake", "cmake", "ninja", "meson"].map(assignmentNotPaths),
     containerRuntime("docker"), containerRuntime("podman"),
-    { key: "pushd", grammars: [], movesBase: "unfollowed", witness: BUILTIN_ONLY },
-    { key: "popd", grammars: [], movesBase: "unfollowed", witness: BUILTIN_ONLY },
+    ...[...shellWordsOf("stack_mover")].map((key) => ({ key, grammars: [], movesBase: "stack", witness: BUILTIN_ONLY })),
     ...SHELLS.map((s) => shellRow(s, "c-option", BINARY, [SHELL_GRAMMARS[s]], "script")),
     shellRow("eval", "words", BUILTIN_ONLY), shellRow("source", "file-operand", BUILTIN_ONLY), shellRow(".", "file-operand", BUILTIN_ONLY), shellRow("parallel", "non-option-words", BINARY, [], "script"),
     ...codeBodyRows,
-    ...["for", "select", "case", "esac", "fi", "done", "function", "coproc", "]]", "in"].map((k) => block(k)),
-    block("[[", [grammar({ v: val(BINDS_NAME) })]),
+    ...[...shellWordsOf("block")].map((k) => block(k, BLOCK_GRAMMARS[k])),
 ];

package/dist/tools/fs/read-deny-home.d.ts

@@ -15,68 +15,54 @@ export declare function declaredReadDenyHomes(env: Pick<ExecutionEnv, "homeDir">
  *  gave no answer, or where the declared home's own probe did not answer (ask again later). */
 export declare function readDenyHomesOf(env: Pick<ExecutionEnv, "homeDir" | "canonicalPath">, signal?: AbortSignal): Promise<string[]>;
 /**
- * Where the home-anchored rows of a table LEAD beyond the home's own spellings, keyed by the row's pattern — the
- * `linked` argument of `compileReadDeny`. For each row, its LITERAL HEAD (`readDenyRunHead`: the run's segments before
- * the first one carrying `*`) is spelled under each home and resolved the way the read faces mint their keys
- * (`canonicalizeTarget`: the longest existing prefix resolved, the rest rejoined); a location that differs from every
- * home's own spelling of the head is where one of the head's segments is a link, and the row is placed there too.
- *  · a head that resolves to its own spelling under a home adds nothing (the row is already placed there);
+ * Where a table's deny rows LEAD past the places their own runs anchor them, keyed by the row's pattern — the `linked`
+ * argument of `compileReadDeny`. ONE constructor for every anchor ({@link ReadDenyRowAnchor}): the rows the anchor
+ * places, each row's LITERAL HEAD ({@link literalHeadOf}) spelled under each of the anchor's places and resolved the way the
+ * read faces mint their keys (`canonicalizeTarget`: the longest existing prefix resolved, the rest rejoined); a location
+ * that differs from the spellings the row is already anchored at is where one of the head's segments is a link (`~/.sema`
+ * into a dotfiles directory, `/app` a link to `/data/app`), and the row is placed there too.
+ *  · a head that resolves to its own spelling at an anchored place adds nothing (the row is already placed there);
  *  · a head under a spelling that is no directory (a segment of it is a file, a symlink to a file, a device node or a
  *    socket — the environment answers `not_directory` for the head) has nothing below it: an answer that adds nothing;
  *  · any other head that cannot be resolved (an unanswered or refused probe — a directory the probe may not enter — a
- *    probe that throws) adds nothing, and the answer is not WHOLE (`whole: false`): the row stays placed at the home's
- *    spellings until the mount places again;
- *  · a row whose head is empty (`~/.sema.*`) has no location to resolve and adds nothing;
+ *    probe that throws) adds nothing, and the answer is not WHOLE (`whole: false`): the row stays at the places its run
+ *    anchors until the mount places again;
  *  · the heads are resolved together, so one placement waits at most one probe bound — or, with `deadline` (an absolute
  *    time), each head until then: a head still unresolved at the deadline is a head that did not answer;
  *  · read per placement — a link created afterwards is followed from the next placement on.
  */
-export declare function readDenyHomeLinksOf(env: ExecutionEnv, entries: readonly {
+export declare function readDenyLinksOf(env: ExecutionEnv, entries: readonly {
     readonly pattern: string;
     readonly caseSensitive?: boolean;
-}[], homes: readonly string[], signal?: AbortSignal, deadline?: number): Promise<{
+}[], anchor: ReadDenyRowAnchor, signal?: AbortSignal, deadline?: number): Promise<{
     readonly linked: Map<string, string[]>;
     readonly whole: boolean;
 }>;
 /**
- * Where the ROOTED rows of a table (`/app/config-lkg.json`, read-deny.ts) lead — the same `linked` answer
- * {@link readDenyHomeLinksOf} gives for home-anchored rows, by the same machine ({@link linkedLocationsOf}): the row's
- * LITERAL HEAD is spelled under the root and resolved the way the read faces mint their keys, and a location that differs
- * from the spelling is where one of the head's segments is a link (`/app` a link to `/data/app`) — the row is placed
- * there too, so a read of the link's target meets it. The laws are `readDenyHomeLinksOf`'s: a head that resolves to its own
- * spelling adds nothing, a head with nothing below it adds nothing, a head the environment does not answer adds
- * nothing and the answer is not WHOLE, a row whose head is empty (`/*.json`) has no location to resolve. A root is no
- * home, so the answer does not depend on the homes: it is read whether or not a home answered.
+ * Which rows one placement reads, and where their heads are spelled:
+ *  · `home` — the home-anchored rows (`~/…`), under each home; the row's run anchors it there;
+ *  · `root` — the ROOTED rows (`/app/config-lkg.json`, {@link isRootedReadDenyPattern}), under the filesystem root; the run
+ *    anchors it there. A root is no home: read whether or not a home answered;
+ *  · `unanchored` — the rows that open with the configuration directory's name (`~/.sema/…`, {@link agentConfigDirTail})
+ *    under each spelling of the root the host declares for that directory (`RunnerDeps.agentConfigDir`): the head BELOW
+ *    the directory name, a head that ends at it (`~/.sema/*.json`, `~/.sema`) the root itself. The row's run does not
+ *    anchor it there (it is anchored at the homes), so every location — the spelling itself and where it leads — is one
+ *    the row is placed at in addition; the row's name in every refusal is unchanged.
+ * A home or rooted row whose head is empty (`~/.sema.*`, `/*.json`) has no location to resolve and adds nothing.
  */
-export declare function readDenyRootLinksOf(env: ExecutionEnv, entries: readonly {
-    readonly pattern: string;
-    readonly caseSensitive?: boolean;
-}[], signal?: AbortSignal, deadline?: number): Promise<{
-    readonly linked: Map<string, string[]>;
-    readonly whole: boolean;
-}>;
-/**
- * Where the rows that open with the configuration directory's name (`~/.sema/…`, {@link agentConfigDirTail}) lead when
- * the host declares the directory's root (`RunnerDeps.agentConfigDir`) — the same `linked` answer
- * {@link readDenyHomeLinksOf} gives, for the same rows: the row's literal head below the directory name is spelled under
- * each spelling of the root and resolved the way the read faces mint their keys. A row is not anchored at the root by
- * its own run (it is anchored at the homes), so every location here — the spelling itself and where it leads — is one the
- * row is placed at in addition; the home spelling stays placed. The row's name in every refusal is unchanged.
- *  · a row whose run does not open with the directory's name (`~/.sema.*`, the external tools' files) adds nothing;
- *  · a row whose head ends at the directory name (`~/.sema/*.json`, `~/.sema`) is placed at the root itself, the rest of
- *    its run matched below it.
- */
-export declare function readDenyConfigRootLinksOf(env: ExecutionEnv, entries: readonly {
-    readonly pattern: string;
-    readonly caseSensitive?: boolean;
-}[], roots: readonly string[], signal?: AbortSignal, deadline?: number): Promise<{
-    readonly linked: Map<string, string[]>;
-    readonly whole: boolean;
-}>;
+export type ReadDenyRowAnchor = {
+    readonly at: "home";
+    readonly homes: readonly string[];
+} | {
+    readonly at: "root";
+} | {
+    readonly at: "unanchored";
+    readonly roots: readonly string[];
+};
 /** Where an absolute location LEADS in one environment — resolved the way the read and write faces mint their keys
  *  (`canonicalizeTarget`: the longest existing prefix resolved, the rest rejoined). `undefined` when the environment
  *  does not answer (a refused or failed probe, one that throws). The one resolution a deny row's placement reads: a
- *  home-anchored row's head ({@link readDenyHomeLinksOf}) and a rule row's head ({@link whereItsAnsweredPrefixLeads}). */
+ *  deny row's head ({@link readDenyLinksOf}) and a rule row's head ({@link whereItsAnsweredPrefixLeads}). */
 export declare function whereItLeads(env: ExecutionEnv, at: string, family?: PathFamily, signal?: AbortSignal): Promise<string | undefined>;
 /** {@link whereItLeads} with a floor: where the environment does not answer for `at` (a probe that fails), the longest
  *  prefix it does answer for is resolved and the rest rejoined — a rule row's head below a base that resolves is never
@@ -150,13 +136,13 @@ export declare function carryHomeViews<T extends object>(judge: T, source: HomeV
  *  · the HOME SET — `homes` when the mount carries a list (the account is not asked and no home is added), else the
  *    declared home and the account lookup's answer ({@link declaredReadDenyHomes}); every home of the set is anchored at
  *    its spelling and, where the environment answered one, its canonical spelling — one rule for both forms;
- *  · the DECLARED home's canonical spelling under the tree's gate bound, and its rows' heads ({@link readDenyHomeLinksOf}):
+ *  · the DECLARED home's canonical spelling under the tree's gate bound, and its rows' heads ({@link readDenyLinksOf}):
  *    a declared home, or a head under it, that did not answer leaves the placement not WHOLE — and an account lookup
  *    with no answer, or a declared home that did not answer, places nothing: the rows are held anywhere (`compile([])`)
  *    rather than at a spelling that may miss the home's canonical one;
  *  · each AUXILIARY home (see the module head) read once under {@link AUXILIARY_HOME_PROBE_MS} — its spellings, its
  *    chain, its rows' heads — at the same time; whatever of it did not answer costs that home alone and never `whole`;
- *  · the ROOTED rows' heads ({@link readDenyRootLinksOf}), read whether or not a home answered: a head that did not answer
+ *  · the ROOTED rows' heads ({@link readDenyLinksOf}), read whether or not a home answered: a head that did not answer
  *    leaves the placement not WHOLE, and a placement that held the rows anywhere still places them.
  *  `compile` is the mount's own compile; the rows' patterns are read off its compile at no home. */
 export declare function placeReadDenyAtHome(env: ExecutionEnv, compile: (homes: readonly string[], linked?: ReadonlyMap<string, readonly string[]>) => ReadDenyMatcher, homes?: readonly string[], signal?: AbortSignal, configRoot?: string): Promise<{

package/dist/tools/fs/read-deny-home.js

@@ -1,8 +1,9 @@
 import { userInfo } from "node:os";
-import { canonicalizeTarget, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
+import { canonicalizeTarget, isAbsoluteForFamily, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "../../core/gate-bounded-await.js";
 import { thrownText } from "../../core/thrown-value.js";
 import { agentConfigDirTail } from "../../core/agent-config-dir.js";
+import { validatePath } from "../../core/effective-path-target.js";
 import { isRootedReadDenyPattern, readDenyPatternRun, readDenyRunHead } from "./read-deny.js";
 export const AUXILIARY_HOME_PROBE_MS = 2_000;
 const said = new Set();
@@ -36,8 +37,9 @@ function valueText(v) {
 function accountHomeOf() {
     try {
         const home = userInfo().homedir;
-        if (typeof home === "string" && isAbsolutePathForm(home))
-            return { state: "home", home };
+        const valid = validatePath(home, { intent: "validate-coordinate" });
+        if (valid !== undefined)
+            return { state: "home", home: valid };
         sayOnce("bad_value", `read-deny homes: the account home lookup answered ${valueText(home)}, not an absolute path — home-anchored read-deny rows are placed under the environment's declared home only.`);
         return { state: "none" };
     }
@@ -49,8 +51,7 @@ function accountHomeOf() {
     }
 }
 function declaredHomeOf(env) {
-    const home = env.homeDir;
-    return home !== undefined && isAbsolutePathForm(home) ? home : undefined;
+    return validatePath(env.homeDir, { intent: "validate-coordinate" });
 }
 function declaredReadDenyHomesAnswered(env) {
     const home = declaredHomeOf(env);
@@ -105,56 +106,43 @@ function sayAuxiliary(what, subject = "auxiliary") {
     }
     sayOnce("auxiliary", `read-deny homes: a home beside the environment's declared home did not answer its probes within ${AUXILIARY_HOME_PROBE_MS} ms (${what}) — its home-anchored read-deny rows sit at its spelling only, and a path through an alias of it is judged as spelled, until the next placement.`);
 }
-export async function readDenyHomeLinksOf(env, entries, homes, signal, deadline) {
-    const rows = [];
-    for (const { pattern, caseSensitive } of entries) {
-        const { homeAnchored, run } = readDenyPatternRun(pattern);
-        if (!homeAnchored)
-            continue;
-        const head = literalHeadOf(run);
-        if (head.length === 0)
-            continue;
-        const spelled = homes.map((home) => normalizeAbsPathLexically(joinForFamily(pathFamilyOf({ root: home }), home, head)));
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: spelled });
-    }
-    return await linkedLocationsOf(env, rows, signal, deadline);
+export async function readDenyLinksOf(env, entries, anchor, signal, deadline) {
+    return await linkedLocationsOf(env, anchoredRowsOf(entries, anchor), signal, deadline);
 }
 const ROOT = "/";
-export async function readDenyRootLinksOf(env, entries, signal, deadline) {
-    const rows = [];
-    for (const { pattern, caseSensitive } of entries) {
-        if (!isRootedReadDenyPattern(pattern))
-            continue;
-        const head = literalHeadOf(pattern);
-        if (head.length === 0)
-            continue;
-        const spelled = [normalizeAbsPathLexically(joinForFamily(pathFamilyOf({ root: ROOT }), ROOT, head))];
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: spelled });
-    }
-    return await linkedLocationsOf(env, rows, signal, deadline);
-}
 function literalHeadOf(run) {
     return run.split("/").filter(Boolean).slice(0, readDenyRunHead(run)).join("/");
 }
-export async function readDenyConfigRootLinksOf(env, entries, roots, signal, deadline) {
-    return await linkedLocationsOf(env, configRootRowsOf(entries, roots), signal, deadline);
-}
-function configRootRowsOf(entries, roots) {
+function anchoredRowsOf(entries, anchor) {
+    const places = anchor.at === "home" ? anchor.homes : anchor.at === "root" ? [ROOT] : anchor.roots;
     const rows = [];
     for (const { pattern, caseSensitive } of entries) {
-        const { homeAnchored, run } = readDenyPatternRun(pattern);
-        const tail = homeAnchored ? agentConfigDirTail(run, caseSensitive === true) : undefined;
-        if (tail === undefined)
+        const head = rowHeadOf(pattern, caseSensitive === true, anchor);
+        if (head === undefined)
             continue;
-        const head = literalHeadOf(tail);
-        const spelled = roots.map((root) => normalizeAbsPathLexically(head.length === 0 ? root : joinForFamily(pathFamilyOf({ root }), root, head)));
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: [] });
+        const spelled = places.map((place) => normalizeAbsPathLexically(head.length === 0 ? place : joinForFamily(pathFamilyOf({ root: place }), place, head)));
+        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: anchor.at === "unanchored" ? [] : spelled });
     }
     return rows;
 }
+function rowHeadOf(pattern, caseSensitive, anchor) {
+    if (anchor.at === "root") {
+        const head = isRootedReadDenyPattern(pattern) ? literalHeadOf(pattern) : "";
+        return head.length > 0 ? head : undefined;
+    }
+    const { homeAnchored, run } = readDenyPatternRun(pattern);
+    if (!homeAnchored)
+        return undefined;
+    if (anchor.at === "unanchored") {
+        const tail = agentConfigDirTail(run, caseSensitive);
+        return tail === undefined ? undefined : literalHeadOf(tail);
+    }
+    const head = literalHeadOf(run);
+    return head.length > 0 ? head : undefined;
+}
 function configRootSpelledLinks(entries, roots) {
     const out = new Map();
-    for (const { pattern, spelled } of configRootRowsOf(entries, roots))
+    for (const { pattern, spelled } of anchoredRowsOf(entries, { at: "unanchored", roots }))
         out.set(pattern, [...new Set(spelled)]);
     return out;
 }
@@ -259,9 +247,7 @@ async function readAuxiliaryHome(env, home, opts, signal) {
             typeof identity === "function" ? chainAbove(env, identity, spelled.canonical, signal, deadline) : Promise.resolve({ ancestors: [], whole: true }),
             opts.entries === undefined
                 ? Promise.resolve({ linked: new Map(), whole: true })
-                : opts.configRoot === true
-                    ? readDenyConfigRootLinksOf(env, opts.entries, place, signal, deadline)
-                    : readDenyHomeLinksOf(env, opts.entries, place, signal, deadline),
+                : readDenyLinksOf(env, opts.entries, opts.configRoot === true ? { at: "unanchored", roots: place } : { at: "home", homes: place }, signal, deadline),
         ]);
         reading = { place, chain, linked: heads.linked, answered: chain.whole && heads.whole };
     }
@@ -337,7 +323,7 @@ function homeViewSourceOver(env, auxiliary) {
             };
             return {
                 async of(path, opts) {
-                    if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsolutePathForm(path))
+                    if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsoluteForFamily("own", path))
                         return undefined;
                     const spelled = normalizeAbsPathLexically(path);
                     const view = await viewOf(spelled, opts?.leaf === "file");
@@ -365,7 +351,7 @@ export function sayPlacementLost() {
 }
 function readAuxiliaryHomes(env, homes, opts, signal) {
     const declared = declaredHomeOf(env);
-    return [...new Set(homes.filter((h) => isAbsolutePathForm(h) && !isDeclared(declared, h)))].map((home) => readAuxiliaryHome(env, home, opts, signal));
+    return [...new Set(homes.filter((h) => isAbsoluteForFamily("own", h) && !isDeclared(declared, h)))].map((home) => readAuxiliaryHome(env, home, opts, signal));
 }
 export function homeViewsAt(env, homes) {
     return homeViewSourceOver(env, readAuxiliaryHomes(env, homes, {}));
@@ -380,7 +366,7 @@ export async function placeReadDenyAtHome(env, compile, homes, signal, configRoo
     const entries = compile([]).entries;
     const declared = declaredHomeOf(env);
     const relocated = configRoot === undefined ? undefined : readAuxiliaryHome(env, configRoot, { entries, configRoot: true }, signal);
-    const rooted = readDenyRootLinksOf(env, entries, signal);
+    const rooted = readDenyLinksOf(env, entries, { at: "root" }, signal);
     const heldAnywhere = async (whole) => {
         const linked = new Map();
         for (const map of [(await relocated)?.linked, (await rooted).linked])
@@ -400,7 +386,7 @@ export async function placeReadDenyAtHome(env, compile, homes, signal, configRoo
         declaredAt = [...new Set([...own, ...ownSpellings.spellings])];
     }
     const auxiliary = readAuxiliaryHomes(env, listed.homes, { entries }, signal);
-    const [heads, readings, root, rootedHeads] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary), relocated, rooted]);
+    const [heads, readings, root, rootedHeads] = await Promise.all([readDenyLinksOf(env, entries, { at: "home", homes: declaredAt }, signal), Promise.all(auxiliary), relocated, rooted]);
     const at = [...new Set([...declaredAt, ...readings.flatMap((r) => r.place)])];
     const linked = new Map();
     for (const map of [heads.linked, ...readings.map((r) => r.linked), ...(root === undefined ? [] : [root.linked]), rootedHeads.linked]) {

package/dist/tools/fs/read-deny.d.ts

@@ -1,3 +1,4 @@
+import { type PathGuardFold, type PathGuardRow, type PathRowsHit, type TargetViews } from "../../core/path-guard-rows.js";
 /**
  * One deny entry: a `/`-separated run of path SEGMENTS. `*` matches any run of non-separator
  * characters within one segment and is the ONLY metacharacter (everything else is literal). The run
@@ -86,28 +87,12 @@ export type PathRowReach = {
 export interface JudgedPathRow extends PathRuleDenyRow {
     readonly reach?: (absolutePath: string) => PathRowReach;
 }
-/** A call's target as a judgment reads it: the absolute spellings of its views (lexical, canonical, the leaf chain's hops —
- *  any order the caller holds), or `unreadable` when the call names a target this reading cannot locate. */
-export interface TargetViews {
-    readonly spellings: readonly string[];
-    readonly unreadable?: string;
-}
-/** What {@link pathRowsReach} found: the row, the view it met there (absent on an unreadable hold), and — when nothing was
- *  reached and some row could not be judged — the reason of the first such row. */
-export interface PathRowsHit<R> {
-    readonly row: R;
-    readonly view?: string;
-    readonly unreadable?: string;
-}
 /**
- * THE one judgment of path rule rows over a call's target, for the gate's rule lanes and the tool's deny table alike: rows
- * outer, views inner — the first row (in the caller's order) that some view reaches is the answer, so the rule a refusal
- * names does not depend on which view happened to meet it. `tighten` (deny / ask): any view reaching the row reaches it; a
- * row that cannot be judged (or a target that cannot be read) is held and answered only when no row reaches. `allow`: a
- * row admits the call only when it admits EVERY view (a link out of an allowed directory is not admitted through its
- * spelling); an unreadable target is admitted by nothing.
+ * Rule rows judged by THE one judgment ({@link judgePathRows}): each rule row read as a guarded row whose reach over a view
+ * is the rule's own reach over the view's spelling (never exemptible — a rule says exactly where it reaches). Same rows
+ * outer, views inner, same tighten / allow law as every other row; the hit names the rule row itself.
  */
-export declare function pathRowsReach<R extends JudgedPathRow>(rows: readonly R[], views: TargetViews, direction: "tighten" | "allow"): PathRowsHit<R> | undefined;
+export declare function judgeRuleRows<R extends JudgedPathRow>(rows: readonly R[], views: TargetViews, direction: "tighten" | "allow"): PathRowsHit<R> | undefined;
 /** The locations a row is also judged at (each leading part of its HEAD: the anchor's children down to the head itself,
  *  a share's root for a UNC head) — what a leg resolves once, for every row whose head it holds. */
 export declare function ruleHeadParts(rows: readonly Pick<PathRuleDenyRow, "head">[]): string[];
@@ -129,10 +114,23 @@ export declare function rowsWhereTheyLead<R extends JudgedPathRow>(rows: readonl
 export declare function locationLeadsTo(path: string, leads: ReadonlyMap<string, string | undefined>): string | undefined;
 /** {@link rowsWhereTheyLead} with each part resolved by `leadsTo` (the leg's resolution; each part once). */
 export declare function withRuleRowsWhereTheyLead<R extends JudgedPathRow>(rows: readonly R[], leadsTo: (head: string) => Promise<string | undefined>): Promise<R[]>;
+/** A rule row as a row of the one table: its name is the rule text, its reach the rule's own over a view's spelling. */
+export declare function ruleGuardRow<R extends JudgedPathRow>(rule: R): PathGuardRow & {
+    readonly rule: R;
+};
+/** A compiled segment-glob row as a row of the one table (`faces`, `polarity`, `exemptible` and `origin` are the table's). */
+export declare function segmentGuardRow(pat: CompiledSegmentPattern, columns: {
+    readonly faces: readonly DenyFace[];
+    readonly polarity: "deny" | "ask";
+    readonly exemptible: boolean;
+    readonly fold: PathGuardFold;
+    readonly origin: PathGuardRow["origin"];
+    readonly tier?: string;
+}): PathGuardRow;
 /**
  * The WRITE face of the deny table: the rule rows whose faces include `write` — the judge the shell station reads for a
  * command's write targets (a redirection, `tee`, `sed -i`, `cp` / `mv` / `touch` / `mkdir` / `rm` operands). Same row
- * type, same judgment ({@link pathRowsReach}) as the read face's rule rows; a hit names the row by its rule text.
+ * type, same judgment ({@link judgePathRows}) as the read face's rows; a hit names the row by its rule text.
  */
 export interface WriteDenyMatcher {
     /** Which face this judge is — the write tools' path resolution reads it to word and code the refusal as a write. */
@@ -412,6 +410,9 @@ export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii
 export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[], opts?: {
     readonly aliasResolved?: boolean;
 }): string | null;
+/** One entry's refusal under the deny list's entry law ({@link normalizeEntry}, the compiler's own), or `undefined` when the
+ *  entry is lawful — the law read without compiling, for a door that judges a list before anything folds it. */
+export declare function readDenyEntryProblem(entry: unknown, layer: string): string | undefined;
 /** Is a canonical pattern ROOTED — placed at the filesystem root ({@link ReadDenyEntry})? Only {@link canonicalReadDenyPattern}
  *  puts a leading `/` on a canonical pattern, so the text is the whole answer. */
 export declare function isRootedReadDenyPattern(canonical: string): boolean;
@@ -445,7 +446,7 @@ export declare function checkedReadDenyHomes(homes: unknown, seat?: string): rea
  * home: a home-anchored entry then matches its run anywhere — a row that cannot be placed holds wider, never narrower.
  *
  * `linked` — where a home-anchored or a rooted row's LITERAL HEAD ({@link readDenyRunHead}) really leads, keyed by the row's
- * pattern: the canonical locations a mount resolved (`readDenyHomeLinksOf` / `readDenyRootLinksOf`, read-deny-home.ts) where
+ * pattern: the canonical locations a mount resolved (`readDenyLinksOf`, read-deny-home.ts) where
  * one of the head's segments is a link (`~/.sema` linked into a dotfiles directory; `/app` a link to `/data/app`). The row is placed at each location too —
  * the same row, the same name in every refusal — with the rest of its run matched below it. The read faces judge
  * canonical keys, so every spelling that reaches the linked file meets the row there. Absolute locations only.