@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/safety-merge-corpus.js

@@ -178,11 +178,27 @@ export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
     {
         name: "inert-deny-entry-removed-safe",
         intent: "removing a deny entry the grammar reads that names nothing (a wildcard peer, a `__` name with no protocol prefix) relaxes nothing — the comparison reads the EFFECTIVE entries on both sides",
-        prior: { toolDeny: ["Bash", "mcp__*", "github__x"] },
+        prior: { toolDeny: ["Bash", "mcp__git*", "github__x"] },
         next: { toolDeny: ["Bash"] },
         loosens: false,
         reasons: [],
     },
+    {
+        name: "whole-protocol-deny-removed-loosened",
+        intent: "`mcp__*` and `mcp__*__*` in a deny list name every tool of every MCP server: removing either lifts a real deny, unlike a wildcard in another peer segment (which names nothing)",
+        prior: { toolDeny: ["Bash", "mcp__*"] },
+        next: { toolDeny: ["Bash"] },
+        loosens: true,
+        reasons: ['removed toolDeny "mcp__*"'],
+    },
+    {
+        name: "whole-protocol-deny-both-spellings-removed-loosened",
+        intent: "each whole-protocol spelling is its own deny entry: dropping one while keeping the other still removes an entry the base layer wrote",
+        prior: { toolDeny: ["mcp__*", "mcp__*__*"] },
+        next: { toolDeny: ["mcp__*"] },
+        loosens: true,
+        reasons: ['removed toolDeny "mcp__*__*"'],
+    },
     {
         name: "unreadable-deny-prior-loosened",
         intent: "rules whose toolDeny holds an entry no rule grammar reads (an empty entry) cannot be read and refuse every call — an override that can be read loosens them",

package/dist/core/same-plain-value.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The conservative value-sameness proof the park mint reads when it decides whether a fidelity projection
+ * moved a value, and whether a policy's rewrite names the very value about to be filed. A leaf: no imports.
+ */
+/**
+ * CONSERVATIVE "these two are provably the same value" for deciding whether a
+ * {@link import("./checkpoint-store.js").encodeAtFidelity} projection moved anything, and whether a policy's
+ * rewrite names the very value about to be filed.
+ *
+ * Deliberately NOT the binding hash, which is the wrong instrument for this question in two directions:
+ * it folds `-0` onto `0` (a real projection change the policy may care about, invisible to the hash), and
+ * it is a digest, so a collision would read as sameness. `Object.is` at the leaves keeps the `-0`
+ * distinction; comparing own-key SETS keeps the dropped `undefined`-valued key visible.
+ *
+ * Conservative on purpose — the answer it must never give wrongly is TRUE, because both callers read
+ * TRUE as "nothing moved / the policy named this very value" and act by filing. So sameness has to be
+ * PROVED, not merely un-disproved:
+ *  - the PROTOTYPES must match and be the plain-object or array one. `[object Object]` is not proof of
+ *    a plain object — a class instance and a null-prototype object both report it, and a tool executing
+ *    the arguments can observe inherited behaviour. (Neither input to the projection comparison can be
+ *    such a value: `structuredClone` and `JSON.parse` both produce plain data. A policy's rewrite can.)
+ *  - own keys are compared with `Reflect.ownKeys` and POSITIONALLY, so a SYMBOL key or a non-enumerable
+ *    property on one side is a difference rather than an invisible extra, and so is a different order
+ *    (which `Object.keys`, `JSON.stringify` and any tool iterating its arguments can see).
+ *  - properties are compared through their DESCRIPTORS — every flag, so a frozen object is not the
+ *    mutable value a JSON decode produces — and an accessor on either side answers FALSE without being
+ *    read: an approval decision must not be made by running deployment code, and what a getter returns
+ *    need not be the same twice.
+ *  - reference TOPOLOGY counts: two properties that share one object are not two properties holding
+ *    equal objects, and a JSON round trip is precisely what turns the first into the second.
+ *  - what it CANNOT prove on its own is that the value it inspected answers ordinary reads the way its
+ *    descriptors did — a Proxy reports the target's descriptors and can return anything from a `get`.
+ *    A caller comparing a value it did not construct must first establish that it is an inert data
+ *    graph (the capture clone does exactly that, and refuses a Proxy outright).
+ *  - any brand outside plain object/array that is not already reference-identical answers FALSE (a Date
+ *    is never the string a JSON codec leaves behind, a Map is never the `{}`), and so does any
+ *    inspection that throws.
+ * An uncertain answer therefore costs a policy consultation or a park, never a silently filed value.
+ */
+export declare function samePlainValue(a: unknown, b: unknown): boolean;

package/dist/core/same-plain-value.js

@@ -0,0 +1,49 @@
+const MAX_SAME_VALUE_DEPTH = 256;
+export function samePlainValue(a, b) {
+    return sameValueAt(a, b, 0, new Map(), new Map());
+}
+function sameValueAt(a, b, depth, aToB, bToA) {
+    if (Object.is(a, b))
+        return true;
+    if (depth >= MAX_SAME_VALUE_DEPTH)
+        return false;
+    if (a === null || b === null || typeof a !== "object" || typeof b !== "object")
+        return false;
+    try {
+        const pairedWithA = aToB.get(a);
+        const pairedWithB = bToA.get(b);
+        if (pairedWithA !== undefined || pairedWithB !== undefined)
+            return pairedWithA === b && pairedWithB === a;
+        aToB.set(a, b);
+        bToA.set(b, a);
+        const proto = Object.getPrototypeOf(a);
+        if (proto !== Object.getPrototypeOf(b))
+            return false;
+        if (proto !== Object.prototype && proto !== Array.prototype)
+            return false;
+        if (Object.isExtensible(a) !== Object.isExtensible(b))
+            return false;
+        const ka = Reflect.ownKeys(a);
+        const kb = Reflect.ownKeys(b);
+        if (ka.length !== kb.length)
+            return false;
+        for (const [i, k] of ka.entries()) {
+            if (k !== kb[i])
+                return false;
+            const da = Object.getOwnPropertyDescriptor(a, k);
+            const db = Object.getOwnPropertyDescriptor(b, k);
+            if (da === undefined || db === undefined)
+                return false;
+            if (!("value" in da) || !("value" in db))
+                return false;
+            if (da.enumerable !== db.enumerable || da.writable !== db.writable || da.configurable !== db.configurable)
+                return false;
+            if (!sameValueAt(da.value, db.value, depth + 1, aToB, bToA))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/scheduler.d.ts

@@ -111,7 +111,7 @@ export interface ScheduledTaskSummary {
     /** 下次触发的 epoch ms（cron/at 可算；daemon 提供）。 */
     nextRunMs?: number;
     /** 执行形态回显（{@link ScheduledIntent.mode}）。ScheduleWakeup 的 stop:true 靠它定位要取消的 pending
-     *  wakeup（cron/task 意图不受 stop 影响——CC 206 D9 语义）。老 backend 不回 = undefined（工具壳以
+     *  wakeup（cron/task 意图不受 stop 影响）。老 backend 不回 = undefined（工具壳以
      *  label 兜底过滤）。 */
     mode?: "task" | "session-wakeup";
     /** [c209-D2]：生命周期层级回显（{@link ScheduledIntent.lifetime}）——缺了它，任务创建后就再无

package/dist/core/sensitive-path-policy.d.ts

@@ -23,7 +23,7 @@ import type { ToolPolicy } from "./tool-policy.js";
 export declare function agentConfigDenyPatterns(): readonly string[];
 /**
  * RECOMMENDED default pattern set for {@link createSensitivePathPolicy} (additive export).
- * NO upstream verbatim anchor exists (cc-anchors/2.1.209 carries no sensitive/dangerous file-pattern
+ * NO upstream anchor exists (the anchor set carries no sensitive/dangerous file-pattern
  * material), so this is an ENGINEERING-CONSENSUS set — each line states its tradeoff. The factory's
  * default behavior is unchanged (no implicit default list; wiring this set is the caller's opt-in:
  * `createSensitivePathPolicy({ patterns: RECOMMENDED_SENSITIVE_PATTERNS, … })`).

package/dist/core/sensitive-path-policy.js

@@ -134,7 +134,7 @@ export function createSensitivePathPolicy(opts) {
         const fold = CASE_INSENSITIVE_FS ? "ascii" : "none";
         const lower = (segs) => (CASE_INSENSITIVE_FS ? segs.map((seg) => seg.replace(/[A-Z]/g, (c) => c.toLowerCase())) : segs);
         const anchors = [configRoot, ...(env === undefined ? [] : await canonicalDataRootKeys(env, [configRoot], signal))].map((root) => lower(agentConfigDirSegments(root)));
-        return configRows.map(({ raw, tail }) => ({ ...(compileSegmentPattern(tail, fold) ?? { raw, segments: [], foldAscii: CASE_INSENSITIVE_FS }), raw, anchors, rootedOnly: true }));
+        return configRows.map(({ raw, tail }) => ({ ...(compileSegmentPattern(tail, fold) ?? { raw, segments: [], fold }), raw, anchors, rootedOnly: true }));
     };
     const rowsOf = async (env, signal) => [...guardRows, ...(await configTwins(env, signal)).map(rowOf)];
     const unstampedRoots = Object.freeze(dataRootSpellings(undefined));

package/dist/core/session-policy-store.d.ts

@@ -8,10 +8,12 @@
  * must match this InMemory one byte-for-byte — a cross-backend equivalence test is the contract).
  *
  * Safety model:
- * - **tighten-only by default**: a NORMAL write may only ADD denies / NARROW allowlists / NARROW allowDirs. A
- *   write that LOOSENS (removes a deny, widens an allowlist/allowDirs) is REFUSED unless it is an OPERATOR
- *   write. core has NO role system — `operator` is a boolean the caller FREEZES from a verified principal
- *   (mirrors `steer.trusted`); core never adjudicates operator-ness, it only honors the flag.
+ * - **tighten-only below what an operator wrote**: a NORMAL write may not loosen the row's operator part
+ *   ({@link StoredSessionRules.operatorRules}: what the last operator write set; absent, the whole row) — above it, it
+ *   may take back what normal writes added (a deny, its own allowlist or allowDirs narrowing). The one `putRules` is
+ *   the write port and the delete port alike: a rule leaves every gate that reads the row when the row stops holding it.
+ *   core has NO role system — `operator` is a boolean the caller FREEZES from a verified principal (mirrors
+ *   `steer.trusted`); core never adjudicates operator-ness, it only honors the flag.
  * - **CAS rev** (optimistic concurrency): a `putRules` with a stale `expectedRev` is rejected, so two replicas
  *   can't lose an update (mirrors the checkpoint store's `resolve` OCC).
  * - **one grammar**: the two rule buckets hold rule ENTRIES — the grammar every entry list reads, through its one reader
@@ -60,10 +62,25 @@ export type SessionRuleEntryField = {
  *    `*`, one more name no tool carried, which voided nothing beside it;
  *  - 1, the one entry reader taking its tool name from the lenient rule parser (trimmed before a `(`, any character but a
  *    blank, a parenthesis or a control / format character);
- *  - 2, the rule syntax's tool-name head (`ruleSpellingOf`): a name is read as written, in the characters names are minted in.
+ *  - 2, the rule syntax's tool-name head (`ruleSpellingOf`): a name is read as written, in the characters names are minted in;
+ *  - 3, the whole-protocol names (`mcp__*`, `mcp__*__*`, see `wholeProtocolOf`) read as a deny rule in `toolDeny` — every tool of the
+ *    protocol — where grammar 2 read them as an entry that names nothing. An engine of grammar 2 given a row written in grammar 3
+ *    refuses it ({@link grammarOf}) rather than read the deny as nothing;
+ *  - 4, the delegation tool's type rules (`Agent(<subagent_type>)`) read as a rule on the agent type the call runs — where grammar 3
+ *    read them as an entry with no rule form (and its write judge refused one) — and a Bash pattern (`Bash(git * main)`, a star
+ *    anywhere but the two trailing markers) reads as the `pattern` match form — where grammar 3 had no form for it — so an engine of
+ *    grammar 3 given a row written in grammar 4 refuses it rather than read an `Agent(…)` or `Bash(<pattern>)` deny as nothing.
  * An entry this grammar reads as no rule in a row an earlier grammar wrote reads as `earlier_grammar` ({@link compileSessionRuleBucket}).
+ *
+ * The persisted rule store stamps the same number on each bucket it writes (and the rule-sync wire on each state it sends):
+ * a stored rule's text is a `Tool(content)` entry read by the same parser, so every revision of what such a text means is a
+ * revision counted here. A revision that touches only the entry list (a tool-name head, a protocol name) moves the persisted
+ * stamp too, and an engine before it then refuses a bucket it could have read — the refusing side. The persisted store keeps
+ * no earlier reading: its rows are read in this grammar whatever stamp at or below it they carry, so a revision that changes
+ * what an existing persisted rule text means owes that store a reading of its earlier stamps, as {@link earlierGrammarReads}
+ * is for entries. Every stamp is judged by {@link readRuleGrammarStamp}.
  */
-export declare const SESSION_RULES_GRAMMAR = 2;
+export declare const SESSION_RULES_GRAMMAR = 4;
 /** {@link SessionPermissionRules} plus the monotonic `rev` the store stamps (the OCC key). */
 export interface StoredSessionRules extends SessionPermissionRules {
     rev: number;
@@ -75,18 +92,31 @@ export interface StoredSessionRules extends SessionPermissionRules {
     /** The rule grammar the row's entries are read in ({@link SESSION_RULES_GRAMMAR}), stamped by the write judge. Absent =
      *  a row stored before the stamp: grammar 0. */
     grammar?: number;
+    /** The row's OPERATOR PART: the buckets (and their grammar) the last operator write set — the line a non-operator write
+     *  may not loosen ({@link judgeSessionRulesWrite}). Minted by the write judge alone, and present only once a non-operator
+     *  write stamped the row (it carries the part it was judged against; over no row, the part of the value it wrote when that
+     *  value is a stored row — a rev from 1 — else an empty part). ABSENT = the whole row is the operator's: an operator write, and a row stored before
+     *  the member, read fail-closed. Never enforced itself — the row's buckets are what every gate reads. */
+    operatorRules?: SessionPermissionRules & {
+        grammar: number;
+    };
 }
-/** A rules value as the shape reading hands it on ({@link readSessionRulesShape}): its buckets, and the grammar its entries
- *  are read in — resolved, so a store that serves it on beside its own counters serves the row's grammar with it. */
+/** A rules value as the shape reading hands it on ({@link readSessionRulesShape}): its buckets, the grammar its entries
+ *  are read in — resolved, so a store that serves it on beside its own counters serves the row's grammar with it — and the
+ *  row's operator part when it carries one ({@link StoredSessionRules.operatorRules}). */
 export type SessionRulesInGrammar = SessionPermissionRules & {
     grammar: number;
+    operatorRules?: SessionPermissionRules & {
+        grammar: number;
+    };
 };
 /** Options for {@link SessionPolicyStore.putRules}. */
 export interface PutRulesOptions {
     /** CAS: reject the write if the stored `rev` is not this (optimistic concurrency). Omit to skip the check. */
     expectedRev?: number;
-    /** When true, this write MAY loosen the rules (remove a deny / widen an allowlist or allowDirs). A NORMAL
-     *  (non-operator) write is TIGHTEN-ONLY. core does NOT verify operator-ness — the caller (service) FREEZES
+    /** When true, this write MAY loosen the rules (remove a deny / widen an allowlist or allowDirs), and what it writes is
+     *  the operator's whole. A NORMAL (non-operator) write may not loosen the row's operator part
+     *  ({@link StoredSessionRules.operatorRules}). core does NOT verify operator-ness — the caller (service) FREEZES
      *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
     operator?: boolean;
 }
@@ -105,7 +135,7 @@ export interface SessionRuleEntryRefusal extends AllowEntryInertDetail {
     reason: AllowEntryInertReason;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
- *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read what it stored (a row, or the
+ *  = a non-operator write tried to relax what an operator wrote; `corrupt` = a backend could not read what it stored (a row, or the
  *  erase-surviving rev mark of {@link SessionPolicyStore.deleteBySession}) and refuses rather than read it as fewer rules or
  *  stamp an unproven rev; `invalid_shape` = the rules value is not an object of buckets, each a list of strings
  *  ({@link readSessionRulesShape}); `inert_entry` = a bucket holds an entry the entry reader reads as nothing. `detail` is
@@ -142,8 +172,9 @@ export interface SessionRulesRecord {
 export interface SessionPolicyStore {
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     /** Write the rules for a key through the one write judge ({@link judgeSessionRulesWrite}): CAS on `expectedRev`, the
-     *  shape, every entry's reading (operator writes included), then, for a non-operator write over an existing row, the
-     *  tighten-only check — each refusal a {@link SessionPolicyError}, and nothing is written. */
+     *  shape, every entry's reading (operator writes included), then, for a non-operator write, the check against the row's
+     *  operator part — each refusal a {@link SessionPolicyError}, and nothing is written. The same call is the delete port: a
+     *  value without an entry takes it out of every gate that reads the row. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
      * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
@@ -193,13 +224,33 @@ export interface SessionPolicyStore {
  * backend should keep `allowDirs` to real directories; a future symlink-aware write-time canonicalize closes it.
  */
 declare function lexWithin(root: string, p: string): boolean;
+/**
+ * THE ONE JUDGE of a rule grammar stamp, whichever store carries it — a session-rules row ({@link readSessionRulesShape}),
+ * the persisted rule store's bucket and the rule-sync wire: the grammar the stamped rules are read in, or the fault that
+ * makes them unreadable. `absent` is what a missing stamp reads as (each store says what its unstamped rules were written
+ * in). A stamp is a whole number no greater than {@link SESSION_RULES_GRAMMAR}: a later grammar is one this engine cannot
+ * read the rules in, and reading them in an older one could grant what their writer refused or drop a refusal it cannot
+ * name — so they are refused WHOLE (`later`), never read in part. `rules` names the stamped rules in the sentence, `held`
+ * what they hold (`entries`, `rows`).
+ */
+export declare function readRuleGrammarStamp(stamp: unknown, absent: number, words: {
+    readonly rules: string;
+    readonly held: string;
+}): {
+    grammar: number;
+} | {
+    got: string;
+    sentence: string;
+    later?: true;
+};
 /**
  * THE ONE SHAPE READING of a rules value — what every station that takes one reads it through: the write (incoming rules),
  * a store's read-back of its own rows, the tighten comparison's prior, the run-time layer's served row. A rules value is an
  * object whose keys are buckets ({@link SessionPermissionRules}); each bucket present is a list of strings (`allowDirs`: of
  * non-blank strings — a directory is no blank). A bucket's TYPE is all this reads: what an entry means is the entry reader's,
  * in the grammar the value is written in ({@link grammarOf}), handed on as `grammar`. The store's counters (`rev`, `gen`) are
- * passed over, and a key holding `undefined` holds nothing. Anything else is a fault, named by key and by TYPE, never by value —
+ * passed over, the row's operator part is read as rules of its own and handed on ({@link readOperatorPart}), and a key
+ * holding `undefined` holds nothing. Anything else is a fault, named by key and by TYPE, never by value —
  * a bare string is never one rule and never its characters (`"rm"` spread into `["r","m"]`), and a key outside the buckets is
  * never dropped (a dropped deny is a deny nobody enforces).
  */
@@ -277,14 +328,18 @@ export declare function earlierGrammarAnnouncer(sink: ((entries: readonly string
  * the rules to stamp, or a {@link SessionPolicyError}, in this order — `conflict` (a stale `expectedRev` against `prior`'s rev),
  * `invalid_shape` ({@link normalizeRules}), `inert_entry` (an entry that reads as nothing in the grammar the rules are written
  * in; operator writes included — a rule that names nothing guards nothing whoever writes it), then, for a non-operator write
- * over an existing row, `loosen_forbidden` ({@link loosenReasons}) — or `corrupt` when that prior cannot be read as rules,
- * which the comparison never reads as fewer. The rules to stamp carry `grammar` = {@link SESSION_RULES_GRAMMAR}: what passed
- * the judge means the same in this engine's grammar, and THIS is the one place the stamp is minted, so every store that
- * stores what the judge returns keeps it. `mountedToolNames` = the store's declaration ({@link SessionPolicyStoreOptions.mountedToolNames}).
+ * over a row, `loosen_forbidden` ({@link loosenReasons}) against the row's OPERATOR PART ({@link StoredSessionRules.operatorRules};
+ * absent, the whole row) — or `corrupt` when that prior cannot be read as rules, which the comparison never reads as fewer.
+ * Over no row there is no rev to compare and no tighten gate, and a judge called with `prior = null` (a host's pre-read of a
+ * value's shape and entries) answers only those two content refusals. Below what an operator wrote nothing moves; above it,
+ * a non-operator takes back what non-operator writes added. The
+ * rules to stamp carry `grammar` = {@link SESSION_RULES_GRAMMAR} — what passed the judge means the same in this engine's
+ * grammar — and, from a non-operator write, the operator part it was judged against: over no row, the value's own when it is a
+ * stored row handed in ({@link isStoredRow}), else an empty one (an operator write's whole value is the operator's, so it
+ * carries none). THIS is the one place both stamps are minted, so every store that stores what the judge
+ * returns keeps them. `mountedToolNames` = the store's declaration ({@link SessionPolicyStoreOptions.mountedToolNames}).
  */
-export declare function judgeSessionRulesWrite(prior: StoredSessionRules | null, rules: unknown, opts: PutRulesOptions | undefined, mountedToolNames?: ReadonlySet<string>): SessionPermissionRules & {
-    grammar: number;
-};
+export declare function judgeSessionRulesWrite(prior: StoredSessionRules | null, rules: unknown, opts: PutRulesOptions | undefined, mountedToolNames?: ReadonlySet<string>): SessionRulesInGrammar;
 /**
  * Pure tighten-only diff: the reasons `next` LOOSENS `prior` (empty ⇒ `next` is a pure tightening or no-op), over the EFFECTIVE
  * entries of each rule bucket — the list as the run-time layer enforces it ({@link effectiveEntries}). Rules whose toolDeny holds
@@ -321,7 +376,7 @@ export declare function continuesLineage(a: {
 }): boolean;
 /**
  * In-process default {@link SessionPolicyStore} (single-replica). A deployment that needs cross-replica
- * durability supplies its own backend with the SAME CAS-rev + tighten-only semantics. Single-threaded JS makes
+ * durability supplies its own backend with the SAME CAS-rev + write-judge semantics. Single-threaded JS makes
  * the read-check-write trivially atomic here; a durable backend folds it into a CAS WHERE clause.
  */
 export declare class InMemorySessionPolicyStore implements SessionPolicyStore {

package/dist/core/session-policy-store.js

@@ -9,7 +9,8 @@ const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs:
 const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
 const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
 const STORE_STAMPS = new Set(["rev", "gen", "grammar"]);
-export const SESSION_RULES_GRAMMAR = 2;
+const OPERATOR_PART = "operatorRules";
+export const SESSION_RULES_GRAMMAR = 4;
 export class SessionPolicyError extends Error {
     code;
     detail;
@@ -53,18 +54,26 @@ function lexWithin(root, p) {
         return true;
     return np === nr || np.startsWith(nr + "/");
 }
+function isStoredRow(value) {
+    const rev = value.rev;
+    return typeof rev === "number" && Number.isInteger(rev) && rev >= 1;
+}
 function grammarOf(value) {
     const stamp = value.grammar;
+    return readRuleGrammarStamp(stamp, stamp === undefined && isStoredRow(value) ? 0 : SESSION_RULES_GRAMMAR, { rules: "session rules", held: "entries" });
+}
+export function readRuleGrammarStamp(stamp, absent, words) {
     if (stamp === undefined)
-        return { grammar: value.rev !== undefined ? 0 : SESSION_RULES_GRAMMAR };
+        return { grammar: absent };
     if (typeof stamp !== "number" || !Number.isInteger(stamp) || stamp < 0) {
         const got = typeof stamp === "number" ? "a number that is not a whole number of 0 or more" : valueTypeLabel(stamp);
-        return { got, sentence: `session rules carry a grammar stamp that is ${got} — the stamp is the whole number of the rule grammar the rules were written in (this engine reads grammar ${SESSION_RULES_GRAMMAR})` };
+        return { got, sentence: `${words.rules} carry a grammar stamp that is ${got} — the stamp is the whole number of the rule grammar the rules were written in (this engine reads grammar ${SESSION_RULES_GRAMMAR})` };
     }
     if (stamp > SESSION_RULES_GRAMMAR) {
         return {
             got: `${stamp}, a grammar newer than this engine's (${SESSION_RULES_GRAMMAR})`,
-            sentence: `session rules were written in rule grammar ${stamp}, newer than this engine reads (grammar ${SESSION_RULES_GRAMMAR}) — refusing rather than read their entries in an older grammar; an engine that reads grammar ${stamp} reads them`,
+            sentence: `${words.rules} were written in rule grammar ${stamp}, newer than this engine reads (grammar ${SESSION_RULES_GRAMMAR}) — refusing rather than read their ${words.held} in an older grammar; an engine that reads grammar ${stamp} reads them`,
+            later: true,
         };
     }
     return { grammar: stamp };
@@ -82,6 +91,13 @@ export function readSessionRulesShape(value) {
     for (const [key, v] of Object.entries(value)) {
         if (STORE_STAMPS.has(key) || v === undefined)
             continue;
+        if (key === OPERATOR_PART) {
+            const part = readOperatorPart(v);
+            if ("fault" in part)
+                return part;
+            rules.operatorRules = part.rules;
+            continue;
+        }
         if (!Object.hasOwn(SESSION_RULE_BUCKETS, key)) {
             return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) matches a command whose first word is rm)`);
         }
@@ -100,6 +116,20 @@ export function readSessionRulesShape(value) {
     }
     return { rules };
 }
+function readOperatorPart(value) {
+    const read = readSessionRulesShape(value);
+    if ("fault" in read) {
+        const field = read.fault.field === "" ? OPERATOR_PART : `${OPERATOR_PART}.${read.fault.field}`;
+        return { fault: { field, got: read.fault.got }, sentence: `the session rules' operator part: ${read.sentence}` };
+    }
+    const { operatorRules: nested, ...part } = read.rules;
+    const unstamped = value.grammar === undefined;
+    if (unstamped || nested !== undefined) {
+        const got = unstamped ? "rules without a grammar stamp" : "an operator part of its own";
+        return { fault: { field: OPERATOR_PART, got }, sentence: `session rules carry an operator part holding ${got} — the part is the rules the last operator write set, stamped with their grammar by the write judge` };
+    }
+    return { rules: part };
+}
 export function normalizeRules(rules) {
     return canonicalRules(shapeOrRefuse(rules));
 }
@@ -284,17 +314,29 @@ export function judgeSessionRulesWrite(prior, rules, opts, mountedToolNames = NO
     const read = shapeOrRefuse(rules);
     const clean = canonicalRules(read);
     assertEntriesRead(read, mountedToolNames);
-    if (prior !== null && opts?.operator !== true) {
-        const stored = readSessionRulesShape(prior);
-        if ("fault" in stored) {
-            throw new SessionPolicyError("corrupt", `the stored session rules cannot be read as rules (${stored.sentence}) — refusing to judge a non-operator write against them as fewer rules; an operator write replaces them`);
-        }
-        const loosens = loosenReasons(stored.rules, clean, mountedToolNames);
-        if (loosens.length > 0) {
-            throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
-        }
+    if (opts?.operator === true)
+        return { ...clean, grammar: SESSION_RULES_GRAMMAR };
+    if (prior === null) {
+        return { ...clean, grammar: SESSION_RULES_GRAMMAR, operatorRules: isStoredRow(rules) ? operatorPartOf(read) : { grammar: SESSION_RULES_GRAMMAR } };
+    }
+    const operatorRules = operatorPartOf(readStoredOrRefuse(prior));
+    const loosens = loosenReasons(operatorRules, clean, mountedToolNames);
+    if (loosens.length > 0) {
+        throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may not loosen what an operator wrote; refused: ${loosens.join("; ")}`);
+    }
+    return { ...clean, grammar: SESSION_RULES_GRAMMAR, operatorRules };
+}
+function operatorPartOf(read) {
+    const { operatorRules, ...whole } = read;
+    const part = operatorRules ?? whole;
+    return { ...canonicalRules(part), grammar: part.grammar };
+}
+function readStoredOrRefuse(prior) {
+    const stored = readSessionRulesShape(prior);
+    if ("fault" in stored) {
+        throw new SessionPolicyError("corrupt", `the stored session rules cannot be read as rules (${stored.sentence}) — refusing to judge a non-operator write against them as fewer rules; an operator write replaces them`);
     }
-    return { ...clean, grammar: SESSION_RULES_GRAMMAR };
+    return stored.rules;
 }
 export function loosenReasons(priorValue, nextValue, mountedToolNames = NO_DECLARED_TOOLS) {
     const shapeOf = (side, value) => {

package/dist/core/session-reconcile.d.ts

@@ -92,13 +92,13 @@ export interface ReconcileReport {
  */
 export declare function findOrphanToolCalls(messages: AgentMessage[], suspendedBatch?: ReadonlySet<string>): OrphanToolCall[];
 /**
- * backlog #389 伴生 (D-2) — CC 2.1.223's interruption markers, VERBATIM (`$U`/`CR` @ `CC:151120-151121`,
+ * backlog #389 伴生 (D-2) — the reference's interruption markers, as is (
  * minted as a USER message by `Jce` @ `CC:640141-640154`). CC mints one on every abort whose reason is
  * outside `{"interrupt","refusal-fallback-edit"}` — and the interactive Esc / remote cancel, which is
  * what `TaskStream.interrupt()` corresponds to, is precisely on the minting side (`CC:1033698-1033733`).
  * The suppressed reason is the one case where the user's own replacement message is already the context.
  *
- * Taken verbatim rather than reworded: this string is an INPUT to later reasoning in CC (its own
+ * Taken as is rather than reworded: this string is an INPUT to later reasoning in CC (its own
  * "interrupted then immediately retried the same action" rule reads it back), and the constitution's
  * standing rule is that a question CC has answered is answered in CC's form.
  */

package/dist/core/session-store.d.ts

@@ -1,4 +1,4 @@
-import { type SessionPlacementRecord, type SessionRepo } from "../internal/harness.js";
+import { type Session, type SessionHead, type SessionPlacementRecord, type SessionRepo } from "../internal/harness.js";
 import { type AcquiredSession, type PlacedSessionRow, type SessionPlacement, type SessionStore, type SessionStoreSummary } from "./session.js";
 import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
@@ -117,29 +117,27 @@ export declare class TtlSessionStore implements SessionStore {
         olderThanMs?: number;
         scope?: string;
     }) => Promise<PlacedSessionRow[]>;
+    /** The by-id head read ({@link SessionStore.headOf}): the repo's own, verbatim — the row is the repo's, never this cache's, and a read
+     *  racing a delete answers either generation (it never waits on one). Present only when the backing repo answers it (absence means no
+     *  by-id head read, and so no ownership pair for an authorizer). */
+    readonly headOf?: (sessionId: string) => Promise<SessionHead | undefined>;
+    /** The repo's head read as this store's own decisions read the row through it (the cache check, the existence check), held
+     *  privately so the store's reading of its rows is the repo's whatever a host does with the face. */
+    private readonly repoHead?;
     private repo;
     private entries;
-    /** Session-ownership rows (the multi-tenant admission capability face — see SessionStore.ownerOf).
-     *  Deliberately NOT part of `entries`: an evicted-but-durable session (`forget` / evict:"forget")
-     *  still EXISTS, and its ownership row outliving the cache entry is what keeps a live session from
-     *  reading as `undefined` (= re-claimable by anyone). Rows die only when the repo's history does. */
-    private owners;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) share one session. */
     private pending;
-    /** Subagent transcript persistence — placed ids whose durable deletion FAILED: the
-     *  placed fact for the retry lives HERE, not on a retained cache entry, because the repo may have
-     *  torn down the shared session authority before its removal failed (the File repo closes the
-     *  append fd pre-rmSync) — a retained entry would serve a session whose log is closed while the
-     *  file still exists (append → log_closed, transcript revival broken until restart). The entry is
-     *  dropped instead, so a re-acquire replays a FRESH authority from disk; success clears the row. */
+    /** Subagent transcript persistence — placed ids whose durable deletion FAILED. Not a reading of placement: the row is that
+     *  (see `rowIsPlaced`). It makes a later cold `release` read the row whatever the repo or the store's declaration, and it is never
+     *  believed in the row's place: a read that faults deletes nothing. No cache entry is retained instead, because the repo may have torn down the shared session
+     *  authority before its removal failed (the File repo closes the append fd pre-rmSync): a retained entry would serve a closed log. */
     private pendingPlacedDeletes;
-    /** Subagent transcript persistence — placed deletions IN FLIGHT: acquire awaits the
-     *  settlement before resolving the id, because the repo's delete tears down the shared session
-     *  authority mid-flight — an acquire racing the await window could capture (or rebuild and then
-     *  lose) an authority the delete is about to close, and the caller would hold a session whose
-     *  first append answers log_closed while the file still exists. The gate is per-id and bounded by
-     *  the delete's own settlement (both outcomes release it). */
-    private deletingPlaced;
+    /** Releases (and idle-sweep deletes) IN FLIGHT that may delete the row: acquire and register — the two that resolve or write the row —
+     *  await the settlement, because the repo's delete tears down the shared session authority mid-flight — an acquire racing the await window could capture (or rebuild
+     *  and then lose) an authority the delete is about to close, and the caller would hold a session whose first append answers
+     *  log_closed while the file still exists. The gate is per-id and bounded by the release's own settlement (both outcomes release it). */
+    private releasing;
     /** Sessions pinned by a design/45 checkpoint — skipped by idle sweep until unpinned (B6/§5). */
     private pinned;
     private defaultTtlMs;
@@ -151,6 +149,10 @@ export declare class TtlSessionStore implements SessionStore {
         requireExisting?: boolean;
         placement?: SessionPlacement;
     }): Promise<AcquiredSession>;
+    /** Whether a cached view is still the occupant the row holds: the row's head, read in one read, names the same occupant as the cached
+     *  session (`compareOccupants` — unknown is never the same). Over a repo with no head read there is nothing to read the row with, and
+     *  the view is served as it is. */
+    private cachedViewStands;
     /** The placement admission ({@link admitSessionPlacement}) for this store, judged on every resolution path. The
      *  partition declaration is a getter over this store's live field, so it is read where the admission judges the
      *  mirror direction (after the request's own members, and only then) — never captured at construction. */
@@ -179,8 +181,34 @@ export declare class TtlSessionStore implements SessionStore {
      * fork capability mounts (it was INERT before — the durable repo had `fork` but the store never exposed it).
      */
     fork(sourceId: string, owner?: string | null): Promise<string | null>;
-    /** Drop a session from the live set. With a durable repo (`evict: "forget"`) the history is kept. */
+    /** Drop a session from the live set. With a durable repo (`evict: "forget"`) the history is kept. A release that rejects leaves the
+     *  session where it was: the store keeps no view of it and retries nothing on its own, and a placed row is found again by the
+     *  partition-GC leg's `listPlaced` — except one whose header is damaged, which `listPlaced` skips and every release of it rejects
+     *  (`corrupt_session`), so only manual cleanup removes it. */
     release(sessionId: string): Promise<void>;
+    /** Run a release that may delete the row while it holds the id: the gate is set before the first await, after any release already in
+     *  flight for the id, and `acquire` / `register` answer after it settles — no caller captures an authority the delete is about to tear
+     *  down (the repo closes the shared authority before its removal can fail), or writes the row mid-decision. */
+    private holdingId;
+    /** The deciding half of {@link release}, under its gate. A delete goes through the cached view only while the row still stands for it
+     *  (`cachedViewStands`); with no view, or a view of an occupant the row no longer holds (another writer deleted the row, or deleted and
+     *  created it again), the row decides — its placement read cold ({@link rowIsPlaced}) — and an unplaced row nobody here holds is left
+     *  as it is. Placement obligation 4: a placed row's release is a REAL deletion whatever the evict policy (the joint reap deletes the
+     *  agent row first and then calls this to end the transcript; a forget would strand it). A delete runs only on a read that answered
+     *  — the head read with the view still standing, or the row's own placement: a read that faults deletes nothing, and the release
+     *  rejects with it. A placed release that fails (a read or the delete) leaves the tombstone, so the retry reads the row again —
+     *  never a retained cache entry, which could serve a closed log; an unplaced view's release under `evict: "delete"` leaves nothing,
+     *  so its retry after a failed read resolves and deletes nothing. */
+    private releaseRow;
+    /** The repo's placement probe, where it has one. */
+    private placementProbe;
+    /** Whether an uncached id's row is worth reading for its placement: through the probe on a store that declares placements, and by
+     *  either means for an id whose placed deletion failed here. */
+    private rowReadMatters;
+    /** Whether the row standing under `sessionId` is placed: the repo's placement probe where it has one, else the row's own metadata,
+     *  read where {@link rowReadMatters}. Its answer retires the tombstone. A read that FAULTS answers nothing: it rejects (the release
+     *  deletes nothing and fails with it), and the tombstone stays for the next release to read the row again. */
+    private rowIsPlaced;
     /** Drop only the cached view — the repo keeps the session regardless of `evictPolicy`, so a re-acquire
      *  re-opens the SAME history (B-17: the reconcile retry / prepare-throw paths must never delete). Cost
      *  on the default in-memory repo: ONE retained session object **per forgotten id** until process end
@@ -193,19 +221,41 @@ export declare class TtlSessionStore implements SessionStore {
     pin(sessionId: string): void;
     /** Release a design/45 pin (on resume or checkpoint expiry); the session resumes normal idle eviction. */
     unpin(sessionId: string): void;
-    /** Multi-tenant admission capability (see the SessionStore contract for the three-state semantics
-     *  and the first-write-wins requirement — both are load-bearing for the deployment's owner gate). */
-    ownerOf(sessionId: string): Promise<string | null | undefined>;
-    /** First-write-wins idempotent upsert; a synchronous Map write is atomic per the contract. Makes no
-     *  authorization decision — the authorizer re-reads {@link ownerOf} and judges there. */
+    /** The owner write of the ownership pair (see the SessionStore contract): an id with no row gets one — an ordinary row recording
+     *  `owner` in its creating write, through the repo's create (the repo makes the creation first-write-wins); an id whose row exists is
+     *  left exactly as it is, whatever this call carries. Makes no authorization decision — the authorizer re-reads {@link headOf}. The
+     *  row is not cached here: it is resolved like any other row on the next `acquire`. */
     register(sessionId: string, owner: string | null): Promise<void>;
-    /** The session row's incarnation cell (see the SessionStore contract), read from the ROW through the
-     *  repo on every call — never from this cache: a cached view outlives a row another store over the
-     *  same repo deleted or recreated, and its copy would name the previous occupant. No row ⇒
-     *  `undefined`; any other repo failure rejects (a fault is not an answer). Never caches, never creates. */
-    incarnationOf(sessionId: string): Promise<string | undefined>;
+    /** Whether the repo holds a row for `sessionId` — its head read where it has one (no replay of the row's history), else an open. A
+     *  fault rejects; it is not an answer. */
+    private hasRow;
     /** Evict idle-expired sessions from the cache. Deletes durable history only when `evict: "delete"`. */
     sweep(now?: number): void;
     get size(): number;
     dispose(): void;
 }
+/**
+ * design/110 (F4) — pick the fork point so a child does NOT inherit an in-flight (uncommitted) tool call.
+ *
+ * The agent loop commits the assistant turn (`message_end` → `appendMessage`) BEFORE it executes that turn's tool
+ * calls. So while the Fork tool's own `execute` runs, the source session's LEAF is the assistant message that carries
+ * the Fork tool-call (and any sibling parallel calls) with NO tool results behind it yet. Forking the whole log would
+ * copy that orphan call into the child, and the child's wake-time `reconcileInterruptedSession` would inject an
+ * `[INTERRUPTED]` result for it — polluting the inherited context ("I called Fork → it was interrupted").
+ *
+ * Detection: the latest assistant `message` on the leaf's chain (past the tool results behind it) has a `toolCall` block
+ * (the message shape — there is NO `toolCalls` field; tool calls are content blocks) that no tool result behind it answers —
+ * the loop's own reading of an open batch (`findUnansweredToolBatch`). When so, fork at the turn's PARENT (`position:"at"`
+ * includes the parent, excludes the assistant turn) — the correct fork semantics: "inherit my context up to, but not
+ * including, the spawn call". A settled leaf (a text-only turn, or a tool turn every call of which is answered), or an
+ * unsettled assistant that is somehow a root (no `parentId`, fail-safe), forks the whole log (`{}`).
+ *
+ * Exported at the package root: the bundled store's `fork` and any other store's `fork` are the same question and must give the same
+ * answer — a backend reads the source session (`SessionRepo.open`), asks this, and hands the answer to `SessionRepo.fork` with the id
+ * and owner it mints. Forking the whole log instead copies the in-flight turn. The walk is one of the parent-chain walks, so it takes the
+ * shared guard: a leaf on a loop of tool-result messages is refused `invalid_session` (the sentence of `getPathToRoot`) instead of followed.
+ */
+export declare function settledForkOptions(source: Session): Promise<{
+    entryId?: string;
+    position?: "at";
+}>;