@sema-agent/core 7.49.5 → 7.50.1

package/dist/core/runner/prepare-lsp.d.ts

@@ -1,10 +1,11 @@
 /**
  * PrepareTask's LSP phase, verbatim from the driver: the manager fold (spec > deps), the
- * LSP tool mount over the per-task env with its git-ignore filter, the diagnostics lane behind its four
- * preconditions (a manager whose sessions feed a registry, write-capable hands, not opted out), the run-scoped
+ * LSP tool mount over the per-task env with its git-ignore filter and the leg's read face, the diagnostics lane behind its
+ * four preconditions (a manager whose sessions feed a registry, write-capable hands, not opted out), the run-scoped
  * registry key, and the edit nudge (raw path → the SAME resolution the tool leg uses → registry reset +
- * session didChange). No manager, or no hands (the manifest still reports the seat, `mounted: false`), ⇒ nothing mounts and
- * both lane seats are undefined. The interface is the dependency list the segment had implicitly.
+ * session didChange through the read face). No manager, or no read face (a hands-less leg; the manifest still reports the
+ * seat, `mounted: false`), ⇒ nothing mounts and both lane seats are undefined. The interface is the dependency list the
+ * segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
  * fork-governance note before it and the memory trio's occupancy read after it (a stretch
@@ -12,9 +13,9 @@
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
+import { type LspListedWithholding, type LspReadFace } from "../lsp.js";
 import type { LspDiagnosticsRegistry } from "../lsp-diagnostics.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
-import type { Prepared } from "./contracts.js";
 import { RosterBuilder } from "../tool-roster.js";
 export interface PrepareLspInput {
     /** borrowed-readonly — the REBOUND spec. Read: `lspManager` (the per-task manager, outranks the deployment's),
@@ -25,18 +26,16 @@ export interface PrepareLspInput {
     /** borrowed-readonly — the run's resolved env: the tool's in-env server and git-ignore filter, and the
      *  session lookup the nudge performs. */
     executionEnv: ExecutionEnv;
-    /** borrowed-readonly — the SETTLED task root: the tool's git-ignore root, and the nudge's resolution base when
-     *  no cwd is tracked. */
+    /** borrowed-readonly — the SETTLED task root: the tool's git-ignore root. */
     taskRootFinal: string;
-    /** borrowed-readonly — whether a real fs env is present (the tool mount's and the lane's hands precondition). */
-    handsEnabled: boolean;
+    /** borrowed-readonly — the leg's read face (the hands phase's root, read roots, deny table, containment face, tracked
+     *  cwd and file read station admission), present exactly when hands mounted: LSP mounts only under it, and the tool,
+     *  the nudge and the diagnostics lane read every file through it. */
+    readFace: LspReadFace | undefined;
     /** borrowed-readonly — the acquired session id: the run's key into the deployment-shared registry. */
     sessionId: string;
-    /** borrowed-readonly — the tracked-cwd cell the hands band writes; the nudge READS `current` per call as its
-     *  resolution base (identity is the contract — the band's `cd` handling writes this exact cell). */
-    handsCwdRef: Prepared["cwdRef"];
     /** borrowed-mutable — the run's roster builder (identity is the contract). Writer here: ONE mount (the LSP tool)
-     *  when a manager exists and the leg has hands. */
+     *  when a manager and a read face exist. */
     roster: RosterBuilder;
     /** borrowed-mutable — the env-hand membership set the read-posture observer projects; writer here: `add("LSP")`
      *  on the mount. */
@@ -48,6 +47,9 @@ export interface PrepareLspResult {
     lspDiagnostics: LspDiagnosticsRegistry | undefined;
     /** owned — the edit nudge (raw path in), or undefined when the lane is not live. */
     nudgeLspOnEdit: ((rawPath: string) => void) | undefined;
+    /** owned — the files of a drain the read face withholds (`lspListedWithheld`: every view, fail-closed; kept files
+     *  absent), or undefined when the lane is not live. */
+    withheldDiagnosticsOf: ((uris: readonly string[]) => Promise<ReadonlyMap<string, LspListedWithholding>>) | undefined;
     /** borrowed-readonly — the run's registry key (= the session id): one run per session, released at the terminal. */
     lspRunIdent: string;
     /** Did a MANAGER seat resolve? The manifest's LSP-section presence condition, from the ONE fold that decided the mount. */ managerWired: boolean;

package/dist/core/runner/prepare-lsp.js

@@ -1,28 +1,28 @@
-import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
+import { createLspTool, gitCheckIgnoreFilter, lspBaseOf, lspListedWithheld, lspReadGateOf, resolveLspPath } from "../lsp.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { RosterBuilder } from "../tool-roster.js";
 export function prepareLsp(input) {
-    const { spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames } = input;
+    const { spec, deps, executionEnv, taskRootFinal, readFace, sessionId, roster, envHandToolNames } = input;
     const lspManager = spec.lspManager ?? deps.lspManager;
-    if (lspManager && handsEnabled) {
-        const lspRoot = taskRootFinal;
-        roster.mount(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }), { source: "builtin", mountedBy: "hands" });
+    if (lspManager && readFace) {
+        roster.mount(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, taskRootFinal), env: executionEnv, readFace }), { source: "builtin", mountedBy: "hands" });
         envHandToolNames.add("LSP");
     }
-    const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true
+    const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && readFace !== undefined && spec.handsReadOnly !== true
         ? lspManager.diagnostics
         : undefined;
     const lspRunIdent = sessionId;
-    const nudgeLspOnEdit = lspDiagnostics
+    const nudgeLspOnEdit = lspDiagnostics && readFace
         ? (rawPath) => {
-            const baseDir = handsCwdRef?.current ?? taskRootFinal;
-            const filePath = resolveLspPath(rawPath, baseDir);
+            const filePath = resolveLspPath(rawPath, lspBaseOf(readFace));
             lspDiagnostics.fileEdited(lspRunIdent, pathToUri(filePath));
+            const gate = lspReadGateOf(executionEnv, readFace);
             void lspManager
                 .sessionFor(filePath, undefined, executionEnv)
-                .then((session) => session?.notifyFileChanged?.(filePath))
+                .then((session) => session?.notifyFileChanged?.(filePath, undefined, gate))
                 .catch(() => undefined);
         }
         : undefined;
-    return { lspDiagnostics, nudgeLspOnEdit, lspRunIdent, managerWired: lspManager !== undefined };
+    const withheldDiagnosticsOf = lspDiagnostics && readFace ? (uris) => lspListedWithheld(executionEnv, readFace, uris) : undefined;
+    return { lspDiagnostics, nudgeLspOnEdit, withheldDiagnosticsOf, lspRunIdent, managerWired: lspManager !== undefined };
 }

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -104,10 +104,11 @@ export interface PreparePolicyChainInput {
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */
     readDenyMatcher: ReadDenyMatcher | undefined;
-    /** borrowed-readonly — the run's one notice for a person's rule store that could not be read (`ruleStoreUnreadableNotice`). */
-    announceRuleStoreSkipped: (at: "prepare" | "call") => void;
-    /** borrowed-readonly — the run's one notice for rows the person's store served that were left out (`ruleRowsDroppedNotice`). */
-    announceRuleRowsDropped: (rows: import("../permission-rule-provider.js").EffectivePermissionRules["droppedRows"]) => void;
+    /** borrowed-readonly — the run's one reader of the person's rules (`person-path-rows.ts`): the lanes take each call's
+     *  pinned read from it. */
+    personRows: import("./person-path-rows.js").PersonPathRows;
+    /** borrowed-readonly — a reader of the same rows the run's cut does not end (the same notices), for the lane asked after the run. */
+    personRowsBeyondRun: import("./person-path-rows.js").PersonPathRows;
     /** borrowed-readonly — whether the question tool mounted (the lanes' question-tool exclusion). */
     questionToolMounted: boolean;
     /** borrowed-readonly — the resolved per-principal entitlements; only `forceDurableGate` (the mandate-park facility and
@@ -240,6 +241,9 @@ export interface PreparePolicyChainResult {
     grantBindingOf: GrantBindingOf;
     /** owned — the personal permission-rule lane, or undefined. */
     permissionRuleLane: PermissionRuleLanes["personal"];
+    /** owned — the same two lanes (personal and org) over the reader the run's cut does not end, for the one judgment asked after the
+     *  run has ended (the synthetic write face). */
+    ruleLanesBeyondRun: PermissionRuleLanes;
     /** owned — the org permission-rule lane (`Prepared.permissionRuleOrg`), or undefined. */
     permissionRuleOrgLane: PermissionRuleLanes["org"];
     /** owned — whether the sandbox-admission mode armed (declared isolation with its park prerequisites). */

package/dist/core/runner/prepare-policy-chain.js

@@ -23,10 +23,10 @@ import { settleReadRootGrant } from "./read-root-grant.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
-import { thrownText } from "../thrown-value.js";
+import { policyThrowLine, reportPolicyThrow } from "./policy-throw.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, announceRuleRowsDropped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, personRowsBeyondRun, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -321,7 +321,7 @@ export async function preparePolicyChain(input) {
     const listFacts = { root: taskRootFinal, sessionId, liveCwd: () => handsCwdRef?.current, anchors: pathRuleAnchors.leg };
     const skillGrantLane = skillGrants.lane(listFacts);
     const allowEntryLanes = { request: allowedToolTables.request.lane(listFacts), deployment: allowedToolTables.deployment.lane(listFacts) };
-    const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
+    const ruleLaneConfig = {
         provider: deps.permissionRuleStore,
         localOwnerDeclared: deps.localOwnerRules === true,
         principal: spec.principal,
@@ -336,11 +336,10 @@ export async function preparePolicyChain(input) {
         questionToolName: ASK_USER_QUESTION_TOOL_NAME,
         onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
         onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
-        onStoreUnreadable: announceRuleStoreSkipped,
-        onRowsDropped: announceRuleRowsDropped,
-        signal: abortController.signal,
         stripsAllow: (rule, req) => permissionMode.current === "auto" && autoStrippedRule(rule, req),
-    });
+    };
+    const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({ ...ruleLaneConfig, rows: personRows });
+    const ruleLanesBeyondRun = createPermissionRuleLanes({ ...ruleLaneConfig, rows: personRowsBeyondRun });
     const ruleOffersOf = createRuleOffersOf({
         laneArmed: permissionRuleLane !== undefined,
         principal: spec.principal,
@@ -373,9 +372,10 @@ export async function preparePolicyChain(input) {
                 re = refuseOutOfContractDecision(await pol.check(editReq !== undefined ? await editReq : { ...creq, args: editArgs }, csignal ?? abortController.signal));
             }
             catch (err) {
+                reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy's re-check of the approved edit", creq, err, csignal ?? abortController.signal);
                 return vetoed({
                     action: "deny",
-                    message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${thrownText(err)}`,
+                    message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${policyThrowLine(err)}`,
                 });
             }
             if (re.action === "deny")
@@ -514,9 +514,10 @@ export async function preparePolicyChain(input) {
                     decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal));
                 }
                 catch (err) {
+                    reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy", creq, err, csignal ?? abortController.signal);
                     return {
                         action: "deny",
-                        message: `inherited parent policy errored for "${creq.toolName}": ${thrownText(err)}`,
+                        message: `inherited parent policy errored for "${creq.toolName}": ${policyThrowLine(err)}`,
                     };
                 }
                 if (decision.action !== "ask")
@@ -678,7 +679,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLanesBeyondRun, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-run-refs.js

@@ -19,7 +19,7 @@ export function prepareRunRefs(input) {
     const sinkWired = internals?.onForwardEvent !== undefined;
     const forwardEvent = sinkWired
         ? (e) => {
-            if (e.type === "task_progress")
+            if (e.type === "task_progress" || e.type === "task_started")
                 forwardSafely(internals, e);
             else if (spec.forwardSubagentEvents === true &&
                 (e.type === "text_delta" || e.type === "text_end" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_progress" || e.type === "tool_end")) {

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { modePolicyOf, modeRequestAfterResume, refusePermissionModeDoors } from
 import { resolveOutputStyleFrame } from "../output-style.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { emitTrace } from "../trace.js";
-import { persistedPathRowsOfTask, ruleRowsDroppedNotice, ruleStoreUnreadableNotice } from "./persisted-path-rows.js";
+import { personPathRowsOfTask, ruleRowsDroppedNotice, ruleStoreUnreadableNotice } from "./person-path-rows.js";
 import { STALL_FIRST_BYTE_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, SKILL_TOOL_NAME, createOutputTool } from "./synthetic-tools.js";
@@ -102,6 +102,7 @@ import { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { resolveTaskRootCanonical } from "./task-root-canonical.js";
 import { createStructuredProjector } from "./tool-output-projection.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
+import { createAttachmentDelivery, refuseUserAttachmentPathsWithoutWorkspace, screenUserAttachments } from "../user-attachment.js";
 function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId, overlay) {
     if (compModel === undefined)
         return;
@@ -291,6 +292,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     const permissionModeSeat = refusePermissionModeDoors(spec);
     const outputStyleFrame = resolveOutputStyleFrame(spec.outputStyle);
     const allowedTools = screenAllowedToolsValue(spec.allowedTools, "TaskSpec.allowedTools");
+    const userAttachmentsSeat = screenUserAttachments(spec.userAttachments, { resumeLeg: resume !== undefined });
     const declaredModeAtDoor = (() => {
         const requested = modeRequestAfterResume(permissionModeSeat, recordedModeSeed(resume?.seed.inheritedGate), resume?.outcome);
         const ceiling = internals?.inheritedGate?.permissionModeCeiling?.current ?? internals?.inheritedGate?.permissionMode;
@@ -369,6 +371,8 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     }
     const rollback = createRollbackStack((e) => deps.onError?.(e, { phase: "config", sessionId }));
     const { executionEnv, ownedEnvSeat, ownedEnvObservedAt, handsEnabled, taskRootInitial, placement } = await prepareExecutionEnv({ deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback });
+    if (!handsEnabled)
+        refuseUserAttachmentPathsWithoutWorkspace(userAttachmentsSeat);
     const externalContentTargetActive = executionEnv.externalContentTarget === true || resume?.seed.externalContentTarget === true;
     const abortController = new AbortController();
     if (spec.signal?.aborted)
@@ -443,19 +447,22 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const mountedMcpNow = mcpPool !== undefined ? () => mountedMcpOf({ declared: installedPreflight.mcp, roster: roster.tools, aggregateNames: new Set(mcp.tools.filter((t) => t.mcpRemoteName === undefined).map((t) => t.name)), pool: mcpPool.pool }) : undefined;
         const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, askSeat: doors.askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { chainTop, onLeg: onLeg.chained }, checkpointSeat, checkpointScope, toolFaceSnapshot, mountsCallerTool, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         bindPermissionModeSeat(permissionMode);
-        const announceRuleStoreSkipped = ruleStoreUnreadableNotice(deps.onNotice, { sessionId, runId });
-        const announceRuleRowsDropped = ruleRowsDroppedNotice(deps.onNotice, { sessionId, runId });
-        const persistedPathRowsRead = persistedPathRowsOfTask({ deps, principal: spec.principal, sessionId, root: taskRootFinal, rootCanonical: taskRootCanonical, leads: headLeads, chainTop, taskId: hostTaskId, handsEnabled, onRowsDropped: announceRuleRowsDropped, signals: [abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])], onUnread: announceRuleStoreSkipped });
-        const persistedPathRows = persistedPathRowsRead === undefined ? { readDirectories: [], denyRows: [] } : await persistedPathRowsRead;
+        const personRowNotices = { onUnread: ruleStoreUnreadableNotice(deps.onNotice, { sessionId, runId }), onRowsDropped: ruleRowsDroppedNotice(deps.onNotice, { sessionId, runId }) };
+        const readerOf = (signals) => personPathRowsOfTask({ deps, notices: personRowNotices, principal: spec.principal, ids: { sessionId, runId, taskId: hostTaskId }, root: taskRootFinal, rootCanonical: taskRootCanonical, leads: headLeads, chainTop, occurrences: toolOccurrences, signals });
+        const personRows = readerOf([abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])]);
+        const personRowsBeyondRun = readerOf([]);
+        const primed = handsEnabled ? personRows.prime() : undefined;
+        if (primed !== undefined)
+            await primed;
         const policyDenyRows = toolPolicyPathRules([installedToolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)], legAnchors).filter((r) => r.faces.length > 0 && r.behavior === "deny");
         for (const r of policyDenyRows)
             if (r.unanchored !== undefined)
                 emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message: `the deny rule ${r.rule} needs a ${r.unanchored.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg (the gate asks)`, ts: Date.now() }));
-        const effectivePathDenyRules = [...policyDenyRows.filter((r) => r.unanchored === undefined), ...persistedPathRows.denyRows];
+        const effectivePathDenyRules = policyDenyRows.filter((r) => r.unanchored === undefined);
         const writeTargetJudgeRef = {};
         const legExemptRoots = Object.freeze(dataRootSpellings(deps.memoryEngineDir));
         const legWriteGuard = { exemptRoots: legExemptRoots, rows: toolPolicyWriteGuardRows([installedToolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)]) };
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, askSeat: doors.askSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, parentSpecSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: effectivePathDenyRules }), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, delegated: delegation.isDelegatedChild });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, askSeat: doors.askSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, parentSpecSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => personRows.tablesReady().then(() => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: pathTables?.ruleRows() ?? effectivePathDenyRules })), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, delegated: delegation.isDelegatedChild });
         const tools = roster.tools;
         const pausedRef = {};
         const undeliveredContinuationRef = { current: { parkedSteers: [], orphanTasks: [] } };
@@ -594,9 +601,10 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
-        const handsReadFaceInput = { permissionMode, denyRuleRows: effectivePathDenyRules, headLeads, writeTargetJudge: () => writeTargetJudgeRef.current, persistedReadDirectories: persistedPathRows.readDirectories, handsEnabled, executionEnv, taskRootFinal, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, harnessRef, toolProgressRef, toolOccurrences, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const modelFileReaderSeat = {};
+        const handsReadFaceInput = { permissionMode, denyRuleRows: effectivePathDenyRules, headLeads, writeTargetJudge: () => writeTargetJudgeRef.current, personRows, handsEnabled, executionEnv, taskRootFinal, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, modelFileReaderSeat, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, harnessRef, toolProgressRef, toolOccurrences, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
-        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, shellReadCheck, shellReadAdmission, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
+        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, shellReadCheck, shellReadAdmission, additionalRootsCanonical, attachmentRootCanonical, readDenyMatcher, readRoots, pathTables, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
         resolvedWriteFace = handsReadFace.resolvedWriteFace;
         readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
@@ -623,8 +631,8 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
             deps.onError?.(new Error(`Fork DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowFork=false ` +
                 `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
         }
-        const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent, managerWired: lspManagerWired } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames });
-        prepareArtifact({ deps, runId, taskId: hostTaskId, sessionId, agentName: internals?.explicitAgentName, onAsk: frozenOnAsk, toolOccurrences, permissionMode, executionEnv, rootCanonical: attachmentRootCanonical, additionalRootsCanonical: () => [...additionalRootsCanonical, ...additionalReadRootsCanonical], readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, ...(handsReadFace.artifactStoreRef !== undefined ? { artifactStoreRef: handsReadFace.artifactStoreRef } : {}) });
+        const { lspDiagnostics, nudgeLspOnEdit, withheldDiagnosticsOf, lspRunIdent, managerWired: lspManagerWired } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, readFace: attachmentRootCanonical !== undefined ? { rootCanonical: attachmentRootCanonical, roots: readRoots, ready: personRows.tablesReady, ...(handsCwdRef !== undefined ? { cwdRef: handsCwdRef } : {}), ...(readDenyMatcher !== undefined ? { readDeny: readDenyMatcher } : {}), ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}), ...(handsReadFace.readAdmission !== undefined ? { admitted: handsReadFace.readAdmission } : {}) } : undefined, sessionId, roster, envHandToolNames });
+        prepareArtifact({ deps, runId, taskId: hostTaskId, sessionId, agentName: internals?.explicitAgentName, onAsk: frozenOnAsk, toolOccurrences, permissionMode, executionEnv, rootCanonical: attachmentRootCanonical, additionalRootsCanonical: readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, ...(handsReadFace.artifactStoreRef !== undefined ? { artifactStoreRef: handsReadFace.artifactStoreRef } : {}) });
         if (internals?.delegationProvenance !== undefined && resume !== undefined) {
             const live = internals.delegationProvenance.ref.current;
             const seed = resume.seed.delegationProvenance;
@@ -650,7 +658,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         }
         const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget: doors.skillListingBudget });
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
-        const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
+        const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical: (await readRoots.ready().then(readRoots)).filter((r) => !additionalRootsCanonical.includes(r)), sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
         judgeRunToolLists({ spec, tools: roster.tools, declaredPeers: { mcp: lockedPreflight.mcp, a2a: a2a.statuses }, own: { allow: toolFaceLists.allow, exclude: toolFaceLists.exclude }, layers: toolFaceSnapshot.selector.layers, legs: toolLegs, judgedUpstream: toolListsJudged !== undefined, ownWhere: internals?.ownToolListsWhere, onceLedger, sessionId });
         const { deferred, memoryBlock, toolSearch: toolSearchPolicy } = prepareDeferClassify({ spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
         prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef });
@@ -763,7 +771,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { leg: legAnchors, chainTop }, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, announceRuleRowsDropped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLanesBeyondRun, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { leg: legAnchors, chainTop }, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, personRowsBeyondRun, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox, checkpointScope });
         const writeProtectionCheck = writeProtection.mount?.check;
         writeTargetJudgeRef.current = writeProtection.judgeWriteTarget;
@@ -781,13 +789,13 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, checkpointScope, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, stampCallTarget, advertisedWritableDirs, exemptRoots: legExemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
-        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.denyRuleRows.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
+        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, readDenyInForce: (toolCallId) => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...(pathTables?.forCall(toolCallId).ruleRows ?? handsReadFaceInput.denyRuleRows).filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
-        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
+        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, syntheticWriteVerdict, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, ruleLanesBeyondRun, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), syntheticWriteVerdict, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
         refuseLateRosterChanges(callerRoster.roster);
         rollback.commit();
         commitModeSeats(abortController.signal);

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -7,11 +7,12 @@ import { type TurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js"
 import type { PromptTextDeclaration } from "../../prompts/default.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import type { ToolPolicy } from "../tool-policy.js";
-import { type SyntheticReadJudge } from "../synthetic-read-verdict.js";
+import { type SyntheticReadJudge, type SyntheticWriteJudge } from "../synthetic-read-verdict.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContainmentFace } from "../../tools/fs/index.js";
 import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
+import type { ReadRootsSeat } from "./person-path-rows.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareTurnWiringInput {
@@ -66,11 +67,10 @@ export interface PrepareTurnWiringInput {
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the canonical attachment root, or undefined (the readers' containment fence). */
     attachmentRootCanonical: string | undefined;
-    /** borrowed-readonly — the canonical extra write roots (the fence's root set). */
-    additionalRootsCanonical: ReadonlyArray<string>;
-    /** borrowed-readonly — the canonical extra read roots (the fence's root set). */
-    additionalReadRootsCanonical: ReadonlyArray<string>;
-    /** borrowed-readonly — the compiled read-deny judge, or undefined (the reader's withheld arm). */
+    /** borrowed-readonly — the read face's root set beside the attachment root, read per use: the write roots, the read
+     *  roots with the run's grants, the person's read directories as the run read them last (no call: `ready` first). */
+    readRoots: (() => readonly string[]) & Pick<ReadRootsSeat, "ready">;
+    /** borrowed-readonly — the run's read deny table (its latest; these readers are no call), or undefined (the reader's withheld arm). */
     readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face, or undefined (the fence's ninth argument). */
     resolvedReadFace: ContainmentFace | undefined;
@@ -90,6 +90,11 @@ export interface PrepareTurnWiringInput {
     inheritedPolicies: readonly ToolPolicy[];
     /** borrowed-readonly — the person's persisted-rule lane, or undefined (a layer of the judge). */
     persistedRuleLane: Prepared["persistedRuleLane"];
+    /** borrowed-readonly — the person's and the org's lanes over the reader the run's cut does not end (the write face is asked after it). */
+    ruleLanesBeyondRun: {
+        readonly personal: Prepared["persistedRuleLane"];
+        readonly org: Prepared["permissionRuleOrg"];
+    };
     /** borrowed-readonly — the org rule lane, or undefined (a layer of the judge). */
     orgRuleLane: Prepared["permissionRuleOrg"];
     /** borrowed-readonly — the leg's target-reading stamp, or undefined (hands-less): the visibility judge stamps its request. */
@@ -157,6 +162,8 @@ export interface PrepareTurnWiringResult {
     /** owned — the run's ONE synthetic-Read deny judge over every layer that can refuse a model's `Read` (the
      *  changed-files door reads it; a face that delivers a file the model did not ask for reads the same one). */
     syntheticReadVerdict: SyntheticReadJudge;
+    /** owned — the same layers' WRITE face (`Prepared.syntheticWriteVerdict`): an `ask` is an objection there. */
+    syntheticWriteVerdict: SyntheticWriteJudge;
     /** owned — the post-compact background-task listing (`Prepared.listBackgroundTasks`). */
     listBackgroundTasks: Prepared["listBackgroundTasks"];
     /** owned — the compaction-boundary center adoption candidate, or undefined (no source, or no adoption). */

package/dist/core/runner/prepare-turn-wiring.js

@@ -4,7 +4,8 @@ import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { createSyntheticReadJudge } from "../synthetic-read-verdict.js";
+import { createSyntheticReadJudge, createSyntheticWriteJudge } from "../synthetic-read-verdict.js";
+import { toolCallFaceOf } from "../tool-roster.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { applyContextShrinkToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
@@ -13,7 +14,7 @@ import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareTurnWiring(input) {
-    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
+    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLanesBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
     const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
     const cacheFingerprint = cacheBreakDetector
         ? { systemPrompt: systemPromptSeat.current, tools: toolsToFingerprintInputs(harnessTools) }
@@ -51,7 +52,10 @@ export function prepareTurnWiring(input) {
             try {
                 let key = path;
                 if (attachmentRootCanonical !== undefined) {
-                    const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, undefined, undefined, [...additionalRootsCanonical, ...additionalReadRootsCanonical], undefined, readDenyMatcher, resolvedReadFace);
+                    await readRoots.ready(abortController.signal);
+                    if (abortController.signal.aborted)
+                        return null;
+                    const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, abortController.signal, undefined, readRoots(), undefined, readDenyMatcher, resolvedReadFace);
                     if (!rk.ok) {
                         announceAttachmentSkip(path, rk.violation.message);
                         if (rk.violation.code === "read_path_denied" && rk.violation.pattern !== undefined) {
@@ -61,7 +65,7 @@ export function prepareTurnWiring(input) {
                     }
                     key = rk.key;
                 }
-                const r = await executionEnv.readBinaryFile(key);
+                const r = await executionEnv.readBinaryFile(key, abortController.signal);
                 if (!r.ok) {
                     announceAttachmentSkip(path, r.error.message);
                     return null;
@@ -84,7 +88,10 @@ export function prepareTurnWiring(input) {
             if (attachmentRootCanonical === undefined)
                 return path;
             try {
-                const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, undefined, handsCwdRef?.current, [...additionalRootsCanonical, ...additionalReadRootsCanonical], undefined, undefined, resolvedReadFace);
+                await readRoots.ready(abortController.signal);
+                if (abortController.signal.aborted)
+                    return path;
+                const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, abortController.signal, handsCwdRef?.current, readRoots(), undefined, undefined, resolvedReadFace);
                 return rk.ok ? rk.key : path;
             }
             catch {
@@ -102,7 +109,7 @@ export function prepareTurnWiring(input) {
     const onCompactionApplied = handsEnabled && readFileStateForCheckpoint
         ? (attachedComplete, preserveReadState) => applyContextShrinkToReadFileState(readFileStateForCheckpoint, { kind: "summarized", attachedComplete, ...(preserveReadState !== undefined ? { preserveKeys: preserveReadState } : {}) })
         : undefined;
-    const syntheticReadVerdict = createSyntheticReadJudge({
+    const syntheticLayers = {
         skillGrants,
         ...(denyNarrowingPolicy !== undefined ? { denyNarrowingPolicy } : {}),
         ...(callerPolicy !== undefined ? { callerPolicy } : {}),
@@ -110,7 +117,11 @@ export function prepareTurnWiring(input) {
         ...(persistedRuleLane !== undefined ? { persistedRuleLane } : {}),
         ...(orgRuleLane !== undefined ? { orgRuleLane } : {}),
         ...(stampCallTarget !== undefined ? { stampCallTarget } : {}),
-        signal: abortController.signal,
+    };
+    const syntheticReadVerdict = createSyntheticReadJudge({ ...syntheticLayers, signal: abortController.signal });
+    const syntheticWriteVerdict = createSyntheticWriteJudge({ ...syntheticLayers, ...(ruleLanesBeyondRun.personal !== undefined ? { persistedRuleLane: ruleLanesBeyondRun.personal } : {}), ...(ruleLanesBeyondRun.org !== undefined ? { orgRuleLane: ruleLanesBeyondRun.org } : {}) }, () => {
+        const p = preparedHolder.current;
+        return { face: toolCallFaceOf(p?.toolRoster, "Write"), cwd: p?.cwdRef?.current, root: p?.handsRoot, advertisedWritableDirs: p?.advertisedWritableDirs, exemptRoots: p?.exemptRoots };
     });
     const changedFilesReadDenied = async (paths) => {
         const deadlineAt = Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
@@ -204,5 +215,5 @@ export function prepareTurnWiring(input) {
     const effectiveReadFaceObserved = carrierReadFace();
     const effectiveWriteFaceObserved = carrierWriteFace();
     const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
-    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
+    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, syntheticWriteVerdict, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
 }

package/dist/core/runner/read-root-grant.d.ts

@@ -1,40 +1,16 @@
 /** The run's IN-FLIGHT read-root grant: the one place a screened grant ({@link ReadRootGrantScreen}) widens this run's
  *  read directories (through the hands phase's {@link GrantReadRoot}, built by {@link readRootGrantOver}), the one
- *  composer of the two notices, and the home of the store-isolation rule both root admission points judge by (the
- *  Artifact phase's mount and the grant) — machinery both phases reach down for. */
+ *  composer of the two notices; the grant judges by the store-isolation rule ({@link rootAdmittingArtifactStore}). */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { ReadRootGrantCandidate } from "../types.js";
 import type { ReadRootGrantScreen } from "../read-root-grant-screen.js";
 import { type RunnerDeps } from "../types.js";
-/**
- * THE store-isolation rule, one judgment for every root admission point (the Artifact mount over the prepare-time
- * roots, an in-flight read-root grant over the granted root): a root that CONTAINS the local artifact store, lies
- * INSIDE it, or IS it hands the file tools the store's ledger and stored files. Returns the first such root, or
- * undefined.
- *
- * `storePhysical` is the store's physical path on THIS process's filesystem (`physicalPathOfExisting`, resolved
- * once per run by the Artifact phase); a root is the execution env's canonical key. The judgment touches no
- * filesystem — the grant runs after the approver's wait under the call's cut, and a synchronous lookup on a stalled
- * store mount would block the event loop past that cut. The two are compared as identities only when both spell the
- * same family (`within` reads both under the root's family); a root of the other family names a filesystem the store
- * cannot be on, and no claim is made against it.
- */
-export declare function rootAdmittingArtifactStore(storePhysical: string, rootsCanonical: readonly string[]): string | undefined;
 /** The run's cell holding the local artifact store a granted root must never admit (its physical path, as the
  *  Artifact phase resolved it): minted with the grant by the hands phase, written by the Artifact phase (the one
  *  reader of the hosting seat) once the declaration validates. */
 export interface ArtifactStoreRef {
     current: string | undefined;
-    /** The person's STANDING read grants — their persisted `Read(//dir/**)` rows, joined to the live read set at prepare —
-     *  held to the in-flight grant's store rule by {@link withdrawStandingGrantsAdmitting} once the store is known. */
-    standing?: {
-        readonly keys: readonly string[];
-        readonly readRoots: string[];
-    };
 }
-/** The store rule applied to the standing grants: each one that admits `storePhysical` leaves the live read set (so no
- *  read face reaches the store through it); returns the withdrawn keys, for the caller to announce. */
-export declare function withdrawStandingGrantsAdmitting(storePhysical: string, ref: ArtifactStoreRef): string[];
 /** Why the run's station applied no grant: the spelling did not resolve (or its lookup was cut), it no longer
  *  resolves to itself (a directory swapped for a link while the card waited), or it would admit the local artifact
  *  store (the store-isolation rule the Artifact phase judges its mount by). */