@sema-agent/core 7.54.1 → 7.56.0

package/dist/prompts/default.d.ts

@@ -17,7 +17,7 @@ export declare const SUBAGENT_DELIVERY_NOTES: string;
 /**
  * Memory **safety** rules — a STANDALONE prompt asset, NOT injected by core. The flag-driven injection
  * (`memoryEnabled`/`consolidationEnabled` → a `memory.safety` constitution block) was retired in
- * RB-482 #16 along with both flags; the engine now injects the CC-verbatim `# Memory` instruction via
+ * RB-482 #16 along with both flags; the engine now injects the `# Memory` instruction via
  * the memory engine's `injection.block` instead. A deployment composing its own prompt is responsible
  * for including this block, and should treat it as non-suppressible: it carries the load-bearing
  * constraints (declarative-fact-not-command + the no-secrets rule + the
@@ -71,8 +71,8 @@ export declare const EXECUTION_ENVIRONMENT_OPEN_READS: string;
 /** The isolated-worktree notice, composed only when the task really runs in an isolated git worktree. */
 export declare const WORKTREE_NOTICE: string;
 /**
- * RB-314 — CC 2.1.220 `atp` (@597127 (cli250.js:44534)) VERBATIM. Rides the variable `# Environment` tail (see
- * {@link buildEnvironmentContext}), which is exactly where 220 emits it: both env-block assemblers
+ * RB-314 — Rides the variable `# Environment` tail (see
+ * {@link buildEnvironmentContext}), which is exactly where the reference emits it: both env-block assemblers
  * (@596927 `IMy`, @596976 `OMy`) push `worktree ? atp : null` directly after the isolated-copy
  * directive. Deliberately NOT folded into {@link WORKTREE_NOTICE}: that block is composed only for
  * `isolation: "worktree"` spawns, while the hazard belongs to ANY run whose cwd is a linked worktree
@@ -120,7 +120,7 @@ export interface EnvironmentFacts {
     /** design/99 §E14 — the working tree's toplevel (`git rev-parse --show-toplevel`). Lets the agent/shell know
      *  it may be in a linked worktree rather than the main checkout. */
     gitWorktreeRoot?: string;
-    /** design/119 (CC 198): cwd is a LINKED git worktree (git-dir ≠ git-common-dir) — an isolated copy. */
+    /** design/119: cwd is a LINKED git worktree (git-dir ≠ git-common-dir) — an isolated copy. */
     isLinkedWorktree?: boolean;
     /** design/119 (CC --add-dir parity): extra directories the file tools may access (canonical). */
     additionalDirectories?: readonly string[];
@@ -164,7 +164,7 @@ export interface EnvironmentFacts {
     /** A1 — outbound-network posture; `none` renders an explicit downloads-will-fail caveat (TB
      *  autopsy 2026-07-05: agents burned budget retrying downloads in a no-egress sandbox). */
     sandboxEgress?: "none" | "allowlist" | "full";
-    /** H4 (CC 2.1.198 git snapshot) — the pre-rendered {@link buildGitSnapshot} block. env-tail
+    /** H4 — the pre-rendered {@link buildGitSnapshot} block. env-tail
      *  migration (#254 shape): NO LONGER RENDERED by {@link buildEnvironmentContext} — the snapshot is
      *  the turn-dynamic git view and rides the `git_status` frame (re-sent only when the rendered view
      *  changes); the field remains as a structured data carrier for callers that assembled it. */
@@ -185,17 +185,17 @@ export interface EnvironmentFacts {
      * it twice could drift). Renders ONE neutral declarative line; absent ⇒ nothing renders.
      */
     externalContentTarget?: boolean;
-    /** CC 2.1.198 `MZn` Scratchpad port (system-prompt diff 档 2026-07-08 §13, 活体逐字双证) — the
+    /** Scratchpad port — the
      *  session-scoped temp directory the agent should use instead of `/tmp` (parallel tasks/multi-tenant
      *  deployments clobber each other's `/tmp`; project checkouts collect stray temp files without it).
      *  DEPLOYMENT-supplied, and only injected when set — the deployment MUST have created (or be about to
-     *  create) the directory; core renders the CC-verbatim section with this path interpolated (§6.3:
+     *  create) the directory; core renders the section with this path interpolated (§6.3:
      *  never advertise a directory the task doesn't have). */
     scratchpadDir?: string;
 }
 /**
- * CC 2.1.198 `# Scratchpad Directory` section (bundle `MZn`, L590674; 活体 2026-07-08 byte-match) with the
- * path parameterized for the deployment. Wording is verbatim CC — including the closing permission-prompts
+ * The `# Scratchpad Directory` section with the
+ * path parameterized for the deployment. Wording as in the reference — including the closing permission-prompts
  * sentence, which holds for sema too (an approval-gated deployment normally allowlists its own scratchpad) —
  * PLUS one sema-added ephemerality sentence (ruled 2026-08-05): sema deployments run under durable suspend /
  * multi-replica serving where the scratchpad is a local-disk copy that does NOT survive a cross-replica
@@ -204,22 +204,22 @@ export interface EnvironmentFacts {
  * in a directory that can vanish mid-task. Volatility magnitude only — no serving-layer mechanism names.
  */
 export declare function buildScratchpadSection(scratchpadDir: string): string;
-/** CC 2.1.198 `Juo` — the git status truncation bound (chars) for {@link buildGitSnapshot}. */
+/** The git status truncation bound (chars) for {@link buildGitSnapshot}. */
 export declare const GIT_STATUS_MAX_CHARS = 2000;
-/** The CC-verbatim first paragraph of the git snapshot (CC 2.1.198 `Quo` head sentence). Kept as a
+/** The first paragraph of the git snapshot. Kept as a
  *  named constant so the git-status FRAME renderer (the snapshot's carrier since the env-tail
  *  migration) can swap exactly this paragraph for its own update-semantics preamble — under the
  *  frame protocol the snapshot IS re-sent when the visible view changes, so the "will not update"
  *  claim would be false there. {@link buildGitSnapshot} itself still renders it byte-exact. */
 export declare const GIT_SNAPSHOT_CC_PREAMBLE = "This is the git status at the start of the conversation. Note that this status is a snapshot in time, and will not update during the conversation.";
 /**
- * H4 — the CC 2.1.198 ENV git snapshot block (B1/B2; template + truncation copy verified against
- * observed Claude Code v2.1.198 behavior). Pure renderer — the Runner gathers the raw values through the
+ * H4 — the ENV git snapshot block (B1/B2).
+ * Pure renderer — the Runner gathers the raw values through the
  * ExecutionEnv seam (remote = the container's repo) and calls this once per prepareTask (a durable
  * resume re-prepares → re-snapshots, CC new-session 同型). env-tail migration (#254 shape): the
  * rendered block now feeds the `git_status` TURN FRAME (src/core/runner/git-status-frame.ts, which
  * swaps the {@link GIT_SNAPSHOT_CC_PREAMBLE} for an update-semantics preamble) instead of the
- * `# Environment` system-prompt section — the template body itself stays CC-verbatim.
+ * `# Environment` system-prompt section — the template body itself is unchanged.
  *
  * Sanitization (deliberate CC deviation — CC injects raw): status/log/branch/user are REPO-controlled
  * text (filenames, commit subjects, an untrusted clone's config) landing in the TRUSTED prompt region →

package/dist/scenarios/full-body.d.ts

@@ -10,9 +10,9 @@ import type { ToolSpec, RoleSpec } from "../core/types.js";
  * `prepareTask` when the trusted assembler wires those deps/flags. This bundle is only the caller-composed factories.
  */
 export interface CodeToolsConfig {
-    /** web_fetch policy. 🔴 `allowHosts` stays UNSET by default — passing `[]` would refuse ALL hosts (truthy empty,
-     *  `web.ts` `if (allowHosts && !allowlisted)`), breaking single-tenant TOC web fetch. A MULTI-TENANT deployment
-     *  MUST pass an explicit allowlist; the SSRF floor (`isPrivateHost`) applies regardless. */
+    /** web_fetch's factory options (fetch seam, byte / time caps, summarizer). Which hosts it may reach is NOT one of them: that is the
+     *  deployment's host floor (`RunnerDeps.hostFloor`, every structured egress, read from the run on every hop) — a MULTI-TENANT
+     *  deployment declares one there; the private-network floor applies regardless. */
     webFetch?: WebFetchConfig;
     /** WebSearch backend (BRAIN/model-service leg). Absent ⇒ WebSearch is not assembled (core ships no backend). */
     webSearch?: WebSearchConfig;
@@ -20,14 +20,14 @@ export interface CodeToolsConfig {
      *  surface as the leader's own instances (one `TaskListStore`), bounded by what the spawning run mounts and trimmed
      *  by the spawn tier (`SubagentToolOptions.inheritedTools`). Tools composed BESIDE the bundle are not inherited: a
      *  host hands those per spawn through `subagent.extraTools`, behind its own gates.
-     *  合车复审修③: when this carries NO explicit `systemPrompt`, the assembler defaults it to
-     *  `CODE_SYSTEM_PROMPT` — a code-scenario child holds Bash/Write side-effect tools, so it keeps the code
+     *  合车复审修③: when this names NO role base (neither `promptRole` nor `systemPrompt`), the assembler defaults it
+     *  to `promptRole: "code"` — a code-scenario child holds Bash/Write side-effect tools, so it keeps the code
      *  constitution (snapshot-before-mutate / destructive-op care / git discipline) instead of falling to the
      *  lean SUBAGENT_PROMPT (the G1 default, which is the right upstream-anchor shape only for bare
-     *  general-purpose delegation). Pass an explicit `systemPrompt` here to override. */
+     *  general-purpose delegation). Pass an explicit `promptRole` / `systemPrompt` here to override. */
     subagent?: SubagentToolOptions;
     /**
-     * TodoWrite (CONTEXT leg). Default true, BUT mutually exclusive with the task-list family (CC 209
+     * TodoWrite (CONTEXT leg). Default true, BUT mutually exclusive with the task-list family (
      * parity: TodoWrite is enabled only when the task list is off). With `taskList` on (the default),
      * TodoWrite is NOT mounted even when `todoWrite: true` is set explicitly — the exclusion gate wins;
      * pass `taskList: false` to get TodoWrite back. `todoWrite: false` always drops it.
@@ -36,8 +36,8 @@ export interface CodeToolsConfig {
      */
     todoWrite?: boolean;
     /**
-     * design/119 → CC209 对齐批B B3: the structured task-list family (TaskCreate/TaskGet/TaskUpdate/
-     * TaskList — stable ids, status transitions, dependencies). Default TRUE (CC 209 alignment: the task
+     * design/119 → B3: the structured task-list family (TaskCreate/TaskGet/TaskUpdate/
+     * TaskList — stable ids, status transitions, dependencies). Default TRUE (the task
      * list is on unless explicitly disabled, and TodoWrite is its off-state fallback — the two families
      * are mutually exclusive, never co-mounted). Only an explicit `taskList: false` reverts to the
      * TodoWrite shape.
@@ -47,7 +47,7 @@ export interface CodeToolsConfig {
      */
     taskList?: boolean;
     /**
-     * design/147 §6 D2 (CC 2.1.216 shared team task list): a shared {@link TaskListStore} for the
+     * design/147 §6 D2 (shared team task list): a shared {@link TaskListStore} for the
      * task-list family. Mount the SAME instance into each teammate's bundle to share one team task
      * list (the `owner` claim semantics come alive); absent ⇒ the private per-run list (unchanged
      * default). Ignored when `taskList: false`. This bundle's own Agent children share it by inheritance.
@@ -58,15 +58,15 @@ export interface CodeToolsConfig {
  * Single-source bundle of the `code` scenario's `spec.tools`-class tools, so each deployment doesn't re-wire it
  * (the single-source discipline: a scenario is data — a named bundle).
  * Profile-as-data — the engine iterates `spec.tools` branch-free; nothing keys off the scenario name. A trusted
- * assembler (service) calls this, sets `systemPrompt = CODE_SYSTEM_PROMPT` (or `role = CODE_ROLE`) +
+ * assembler (service) calls this, sets `promptRole = "code"` (or `roles.default = CODE_ROLE`) +
  * `enablePlanMode:true`, and wires the deps seams (executionEnv/onQuestion/lspManager/skillSpecs/memoryStore/
  * selfOrchestration) — that is what makes a run the `code` scenario. Returns ONLY the caller-composed tools.
  */
 export declare function assembleCodeTools(cfg?: CodeToolsConfig): ToolSpec[];
 /**
- * RoleSpec preset for the `code` scenario's coding role. Selected via the existing
- * `spec.systemPrompt ?? resolvedRole.systemPrompt` chain (no new field, no new conditional). `thinking:"high"` is a
- * sensible floor; the assembler/SDK can raise it (effort→thinking) per request. The global DEFAULT_SYSTEM_PROMPT
- * stays neutral.
+ * RoleSpec preset for the `code` scenario's coding role: the catalog's coding role base by word (`promptRole:
+ * "code"`), the role-base decision's second source — it applies when the task names no role base of its own.
+ * `thinking:"high"` is a sensible floor; the assembler/SDK can raise it (effort→thinking) per request. The global
+ * DEFAULT_SYSTEM_PROMPT stays neutral.
  */
 export declare const CODE_ROLE: RoleSpec;

package/dist/scenarios/full-body.js

@@ -2,7 +2,7 @@ import { webFetchToolSpec, createWebSearchTool } from "../tools/web.js";
 import { createTodoWriteTool } from "../tools/todo.js";
 import { createTaskListTools } from "../tools/task-list.js";
 import { createSubagentTool } from "../agents/subagent.js";
-import { CODE_SYSTEM_PROMPT } from "../prompts/default.js";
+import { namesRoleBase } from "../prompt-assembly/role-base.js";
 export function assembleCodeTools(cfg = {}) {
     const web = [webFetchToolSpec(cfg.webFetch ?? {})];
     if (cfg.webSearch)
@@ -19,13 +19,14 @@ export function assembleCodeTools(cfg = {}) {
     }
     const tools = [...web];
     if (cfg.subagent) {
+        const roleBase = namesRoleBase(cfg.subagent) ? {} : { promptRole: "code" };
         tools.push(createSubagentTool({
             ...cfg.subagent,
-            systemPrompt: cfg.subagent.systemPrompt ?? CODE_SYSTEM_PROMPT,
+            ...roleBase,
             inheritedTools: cfg.subagent.inheritedTools ?? [...web, ...scaffolds],
         }));
     }
     tools.push(...scaffolds);
     return tools;
 }
-export const CODE_ROLE = { systemPrompt: CODE_SYSTEM_PROMPT, thinking: "high" };
+export const CODE_ROLE = { promptRole: "code", thinking: "high" };

package/dist/shell/lex.js

@@ -1169,6 +1169,7 @@ function scan(source, connectorsAreText, segments, level, list) {
     let assignmentSeen = false;
     let subscriptsClosed = false;
     let commandWord;
+    let arithParens = 0;
     let w = new WordBuilder();
     const next = (j) => past(source, j + 1);
     const quotedBy = () => (inSingle || inDouble ? regionBy : undefined);
@@ -1503,7 +1504,7 @@ function scan(source, connectorsAreText, segments, level, list) {
             take(ch, i);
             continue;
         }
-        if (ch === "#" && !w.started) {
+        if (ch === "#" && !w.started && arithParens === 0) {
             const nl = source.indexOf("\n", i);
             i = nl < 0 ? source.length : nl - 1;
             continue;
@@ -1531,6 +1532,14 @@ function scan(source, connectorsAreText, segments, level, list) {
             const r = endWord() ?? operandOwed(i);
             if (r !== undefined)
                 return r;
+            if (ch === "(") {
+                if (arithParens > 0)
+                    arithParens++;
+                else if (split && source[next(i)] === "(")
+                    arithParens = 1;
+            }
+            else if (arithParens > 0)
+                arithParens--;
             current().tokens.push({ kind: "group", op: ch });
             resetPosition();
             continue;

package/dist/stores/file/adoption/adopt.d.ts

@@ -56,7 +56,8 @@
  * file half ships the freeze face, the acceptance face and the rebind legs.
  */
 import type { PermissionRuleSyncTransport } from "../../../core/permission-rule-sync.js";
-import { type AdoptionReceipt, type AdoptionSource, type AffectedDeploymentConfig } from "./marker.js";
+import { type AdoptionReceipt, type AffectedDeploymentConfig } from "./marker.js";
+import { type RuleOwner } from "../../../core/rule-owner.js";
 /** The per-leg context handed to a carriage leg: rows the far side REFUSES go here — preserved and
  *  disclosed, never deleted (design/183 §7.2). Quarantining never fails the leg. */
 export interface AdoptionCarriageLegContext {
@@ -79,7 +80,7 @@ export interface AdoptionCarriageLeg {
 export interface AdoptLocalDataRootOptions {
     /** The data root (the directory `FileStorageBackend` and the independent file stores build over). */
     root: string;
-    from: AdoptionSource;
+    from: RuleOwner;
     toPrincipal: string;
     /** The claim REFERENCE for the new identity's credentials (minted by the server; design/183 §4.3).
      *  A reference, never the credential bytes — the marker file is a plain-text sidecar. */
@@ -141,7 +142,7 @@ export type AdoptionStatus = {
     state: "none";
 } | {
     state: "in-flight";
-    from: AdoptionSource;
+    from: RuleOwner;
     toPrincipal: string;
     phase: 2 | 3 | 4 | 5;
 } | {

package/dist/stores/file/adoption/adopt.js

@@ -7,6 +7,8 @@ import { SESSION_POLICY_MARK_SUFFIX, attributeSessionPolicyRow, judgeSessionPoli
 import { SessionPolicyError } from "../../../core/session-policy-store.js";
 import { thrownText } from "../../../core/thrown-value.js";
 import { AdoptionError, NOT_MIGRATED_BY_DESIGN, readRootAdoptionFile, writeRootAdoptionFile, } from "./marker.js";
+import { readRuleOwner, ruleOwnerText, sameRuleOwner } from "../../../core/rule-owner.js";
+import { principalNameOf } from "../../../core/principal-name.js";
 const CONFIG_ACCOUNT_FILE = "adoption-configs.json";
 function baselineConfigs(toPrincipal) {
     return [
@@ -282,12 +284,6 @@ const ZERO_ACTION_STORES = [
 ];
 const SESSION_POLICY_LEG = "session-policy";
 const CARRIAGE_BIT_PREFIX = "carriage:";
-function sameSource(a, b) {
-    return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
-}
-function sourceText(o) {
-    return o.kind === "principal" ? `principal "${o.principal}"` : "the local owner";
-}
 function receiptFromTerminal(root, adopted) {
     const account = readConfigAccountEvidence(root);
     const accountBinds = account !== undefined && account.adoptionId === adopted.immutableReport.adoptionId;
@@ -325,33 +321,34 @@ function answerFromExisting(root, existing, from, toPrincipal) {
     if (existing === undefined)
         return undefined;
     if ("adopted" in existing) {
-        if (existing.adopted.toPrincipal === toPrincipal && sameSource(existing.adopted.from, from)) {
+        if (existing.adopted.toPrincipal === toPrincipal && sameRuleOwner(existing.adopted.from, from)) {
             return receiptFromTerminal(root, existing.adopted);
         }
-        throw new AdoptionError("adoption_retarget", `this data root already carries a completed adoption (${sourceText(existing.adopted.from)} → "${existing.adopted.toPrincipal}") — ` +
+        throw new AdoptionError("adoption_retarget", `this data root already carries a completed adoption (${ruleOwnerText(existing.adopted.from)} → "${existing.adopted.toPrincipal}") — ` +
             `a second adoption of the same root is a multi-tenant transfer, not a shape this protocol supports`);
     }
-    if (existing.marker.toPrincipal !== toPrincipal || !sameSource(existing.marker.from, from)) {
+    if (existing.marker.toPrincipal !== toPrincipal || !sameRuleOwner(existing.marker.from, from)) {
         throw new AdoptionError("adoption_in_flight_mismatch", `an adoption toward "${existing.marker.toPrincipal}" is already in flight in this data root (phase ${existing.marker.phase}) — ` +
             `refusing to start a different one (resume the original, or repair the marker by hand)`);
     }
     return undefined;
 }
 export async function adoptLocalDataRoot(opts) {
-    if (typeof opts.toPrincipal !== "string" || opts.toPrincipal === "") {
-        throw new AdoptionError("adoption_bad_request", "adoptLocalDataRoot requires the adopting principal — adoption is the act of giving this data root an identity");
+    if (principalNameOf(opts.toPrincipal) === undefined) {
+        throw new AdoptionError("adoption_bad_request", "adoptLocalDataRoot requires the adopting principal, a principal name — adoption is the act of giving this data root an identity");
     }
-    if (opts.from.kind === "principal" && (typeof opts.from.principal !== "string" || opts.from.principal === "")) {
-        throw new AdoptionError("adoption_bad_request", "a principal-form source requires a non-empty principal — local-single-user identity is the local-owner kind, never an empty string");
+    const from = readRuleOwner(opts.from);
+    if (from === undefined) {
+        throw new AdoptionError("adoption_bad_request", "the adoption source must be the local-owner kind or a principal owner whose principal is a principal name — local-single-user identity is the local-owner kind, never a blank string");
     }
-    if (opts.from.kind === "principal" && opts.from.principal === opts.toPrincipal) {
+    if (from.kind === "principal" && from.principal === opts.toPrincipal) {
         throw new AdoptionError("adoption_bad_request", `the data root already belongs to "${opts.toPrincipal}" — there is nothing to adopt`);
     }
     if (typeof opts.credentials.ref !== "string" || opts.credentials.ref === "") {
         throw new AdoptionError("adoption_bad_request", "the credentials claim ref must be a non-empty reference (the claim is what makes the new identity redeemable)");
     }
-    if (opts.from === null || typeof opts.from !== "object" || opts.credentials === null || typeof opts.credentials !== "object") {
-        throw new AdoptionError("adoption_bad_request", "adoptLocalDataRoot requires `from` and `credentials` objects");
+    if (opts.credentials === null || typeof opts.credentials !== "object") {
+        throw new AdoptionError("adoption_bad_request", "adoptLocalDataRoot requires a `credentials` object");
     }
     if (opts.additionalConfigs !== undefined && !Array.isArray(opts.additionalConfigs)) {
         throw new AdoptionError("adoption_bad_request", "additionalConfigs must be an array when supplied");
@@ -368,9 +365,6 @@ export async function adoptLocalDataRoot(opts) {
     if (opts.onError !== undefined && typeof opts.onError !== "function") {
         throw new AdoptionError("adoption_bad_request", "`onError` must be callable when supplied");
     }
-    if (opts.from.kind !== "local-owner" && opts.from.kind !== "principal") {
-        throw new AdoptionError("adoption_bad_request", "the adoption source must be the local-owner kind or a named principal");
-    }
     if (opts.credentials.issuedBy !== "server") {
         throw new AdoptionError("adoption_bad_request", `the credentials claim must be server-issued (got issuedBy: ${JSON.stringify(opts.credentials.issuedBy)}) — the server mints the new identity`);
     }
@@ -402,7 +396,7 @@ export async function adoptLocalDataRoot(opts) {
         }
     }
     ensureDir(opts.root);
-    const pre = answerFromExisting(opts.root, readRootAdoptionFile(opts.root), opts.from, opts.toPrincipal);
+    const pre = answerFromExisting(opts.root, readRootAdoptionFile(opts.root), from, opts.toPrincipal);
     if (pre !== undefined) {
         const account = readConfigAccountEvidence(opts.root);
         if (account !== undefined && account.adoptionId === pre.immutableReport.adoptionId)
@@ -425,7 +419,7 @@ export async function adoptLocalDataRoot(opts) {
     }
     try {
         const existing = readRootAdoptionFile(opts.root);
-        const answered = answerFromExisting(opts.root, existing, opts.from, opts.toPrincipal);
+        const answered = answerFromExisting(opts.root, existing, from, opts.toPrincipal);
         if (answered !== undefined) {
             rebuildConfigAccountIfUnbound(opts.root, answered.immutableReport);
             return receiptFromTerminal(opts.root, {
@@ -481,7 +475,7 @@ export async function adoptLocalDataRoot(opts) {
                     `They would never run, and reporting them as done would be a lie; post-adoption carriage rides each store's normal channel.`);
             }
             if (plan !== existing.marker.plan) {
-                publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, phase, plan, legBits);
+                publishMarker(opts.root, adoptionId, from, opts.toPrincipal, phase, plan, legBits);
             }
             const accountInFlight = readConfigAccount(opts.root);
             if (accountInFlight === undefined || accountInFlight.adoptionId !== adoptionId) {
@@ -496,7 +490,7 @@ export async function adoptLocalDataRoot(opts) {
             legBits = {};
             plan = { ...(offeredRulesDir !== undefined ? { rulesDir: offeredRulesDir } : {}), carriage: offeredCarriage, credentialsRef: opts.credentials.ref };
             upsertConfigAccount(opts.root, adoptionId, opts.toPrincipal, opts.additionalConfigs ?? []);
-            publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 2, plan, legBits);
+            publishMarker(opts.root, adoptionId, from, opts.toPrincipal, 2, plan, legBits);
         }
         const legs = [];
         if (phase < 3) {
@@ -505,7 +499,7 @@ export async function adoptLocalDataRoot(opts) {
                 try {
                     nested = await adoptFilePermissionRuleStore({
                         dir: opts.rules.dir,
-                        from: opts.from,
+                        from,
                         toPrincipal: opts.toPrincipal,
                         transport: opts.rules.transport,
                         ...(opts.now !== undefined ? { now: opts.now } : {}),
@@ -526,15 +520,15 @@ export async function adoptLocalDataRoot(opts) {
                 }
             }
             if (legBits[SESSION_POLICY_LEG]?.done !== true) {
-                const rows = rewriteSessionPolicyRows(opts.root, opts.from.kind === "principal" ? opts.from.principal : null, opts.toPrincipal);
+                const rows = rewriteSessionPolicyRows(opts.root, from.kind === "principal" ? from.principal : null, opts.toPrincipal);
                 legBits = { ...legBits, [SESSION_POLICY_LEG]: { done: true, rows } };
-                publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 2, plan, legBits);
+                publishMarker(opts.root, adoptionId, from, opts.toPrincipal, 2, plan, legBits);
             }
-            publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 3, plan, legBits);
+            publishMarker(opts.root, adoptionId, from, opts.toPrincipal, 3, plan, legBits);
             phase = 3;
         }
         if (phase < 4) {
-            publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 4, plan, legBits);
+            publishMarker(opts.root, adoptionId, from, opts.toPrincipal, 4, plan, legBits);
             phase = 4;
         }
         if (phase < 5) {
@@ -575,9 +569,9 @@ export async function adoptLocalDataRoot(opts) {
                         ...(quarantined > 0 ? { quarantined } : {}),
                     },
                 };
-                publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 4, plan, legBits);
+                publishMarker(opts.root, adoptionId, from, opts.toPrincipal, 4, plan, legBits);
             }
-            publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 5, plan, legBits);
+            publishMarker(opts.root, adoptionId, from, opts.toPrincipal, 5, plan, legBits);
             phase = 5;
         }
         if (plan.rulesDir !== undefined)
@@ -609,7 +603,7 @@ export async function adoptLocalDataRoot(opts) {
         }
         const immutableReport = {
             adoptionId,
-            from: opts.from,
+            from,
             toPrincipal: opts.toPrincipal,
             atMs,
             credentials: opts.credentials,
@@ -619,9 +613,9 @@ export async function adoptLocalDataRoot(opts) {
         };
         writeRootAdoptionFile(opts.root, {
             schemaVersion: 1,
-            adopted: { from: opts.from, toPrincipal: opts.toPrincipal, atMs: immutableReport.atMs, immutableReport },
+            adopted: { from, toPrincipal: opts.toPrincipal, atMs: immutableReport.atMs, immutableReport },
         });
-        return receiptFromTerminal(opts.root, { from: opts.from, toPrincipal: opts.toPrincipal, atMs: immutableReport.atMs, immutableReport });
+        return receiptFromTerminal(opts.root, { from, toPrincipal: opts.toPrincipal, atMs: immutableReport.atMs, immutableReport });
     }
     finally {
         adoptionLock.release();

package/dist/stores/file/adoption/marker.d.ts

@@ -14,17 +14,10 @@
  *    with the same (from → toPrincipal) short-circuits to the recorded receipt) and it carries the
  *    IMMUTABLE report — the byte-stable half of every receipt.
  *
- * This module is deliberately tiny and dependency-light (node:fs + the atomic-write primitive): every
- * file store imports the gate from here, so it must never grow an import back into a store.
+ * This module is deliberately tiny and dependency-light (node:fs, the atomic-write primitive, the import-free owner
+ * reading): every file store imports the gate from here, so it must never grow an import back into a store.
  */
-/** Who the data root belonged to before adoption. Shape-identical to the rule domain's `RuleOwner`
- *  (design/182): local-single-user identity is a STRUCTURAL ABSENCE, never a sentinel string. */
-export type AdoptionSource = {
-    kind: "local-owner";
-} | {
-    kind: "principal";
-    principal: string;
-};
+import { type RuleOwner } from "../../../core/rule-owner.js";
 /** Typed refusal codes (design/183 §7.3): every adoption refusal is discriminable — from `not_found`,
  *  from a broken deployment, and from each other. */
 export type AdoptionErrorCode = 
@@ -81,7 +74,7 @@ export interface AdoptionLegReport {
 export interface AdoptionReport {
     /** Minted at phase ② — the binding anchor config-witness receipts must carry. */
     adoptionId: string;
-    from: AdoptionSource;
+    from: RuleOwner;
     toPrincipal: string;
     atMs: number;
     /** The claim REFERENCE for the new identity's credentials — never the credentials themselves (the
@@ -120,7 +113,7 @@ export type RootAdoptionFile = {
     schemaVersion: 1;
     marker: {
         adoptionId: string;
-        from: AdoptionSource;
+        from: RuleOwner;
         toPrincipal: string;
         phase: 2 | 3 | 4 | 5;
         /** The migration plan recorded at phase ② and grown MONOTONICALLY across resumes — what a
@@ -147,7 +140,7 @@ export type RootAdoptionFile = {
 } | {
     schemaVersion: 1;
     adopted: {
-        from: AdoptionSource;
+        from: RuleOwner;
         toPrincipal: string;
         atMs: number;
         immutableReport: AdoptionReport;

package/dist/stores/file/adoption/marker.js

@@ -1,5 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { readRuleOwner, sameRuleOwner } from "../../../core/rule-owner.js";
+import { principalNameOf } from "../../../core/principal-name.js";
 import { atomicWriteFile, ensureDir } from "../fs-atomic.js";
 export class AdoptionError extends Error {
     code;
@@ -26,14 +28,6 @@ export const BASELINE_CONFIG_IDENTITIES = [
     { deployment: "env", key: "REQUIRE_PRINCIPAL" },
     { deployment: "core-decl", key: "localOwnerRules" },
 ];
-function isSource(v) {
-    if (v === null || typeof v !== "object")
-        return false;
-    const s = v;
-    if (s.kind === "local-owner")
-        return true;
-    return s.kind === "principal" && typeof s.principal === "string" && s.principal !== "";
-}
 function isRootAdoptionFileShape(v) {
     if (v === null || typeof v !== "object")
         return false;
@@ -45,8 +39,8 @@ function isRootAdoptionFileShape(v) {
         if (m === null ||
             typeof m !== "object" ||
             typeof m.adoptionId !== "string" ||
-            !isSource(m.from) ||
-            typeof m.toPrincipal !== "string" ||
+            readRuleOwner(m.from) === undefined ||
+            principalNameOf(m.toPrincipal) === undefined ||
             typeof m.phase !== "number" ||
             ![2, 3, 4, 5].includes(m.phase)) {
             return false;
@@ -91,21 +85,19 @@ function isRootAdoptionFileShape(v) {
     }
     if ("adopted" in f && !("marker" in f)) {
         const a = f.adopted;
+        const from = readRuleOwner(a?.from);
         if (a === null ||
             typeof a !== "object" ||
-            !isSource(a.from) ||
-            typeof a.toPrincipal !== "string" ||
+            from === undefined ||
+            principalNameOf(a.toPrincipal) === undefined ||
             typeof a.atMs !== "number" ||
             a.immutableReport === null ||
             typeof a.immutableReport !== "object") {
             return false;
         }
         const r = a.immutableReport;
-        const sameFrom = isSource(r.from) &&
-            (r.from.kind === "local-owner"
-                ? a.from.kind === "local-owner"
-                : a.from.kind === "principal" &&
-                    r.from.principal === a.from.principal);
+        const reportFrom = readRuleOwner(r.from);
+        const sameFrom = reportFrom !== undefined && sameRuleOwner(reportFrom, from);
         const okCount = (n) => n === undefined || (typeof n === "number" && Number.isSafeInteger(n) && n >= 0);
         const configIds = new Set();
         const configsOk = Array.isArray(r.affectedDeploymentConfigs) &&

package/dist/stores/file/checkpoint-store.d.ts

@@ -1,6 +1,8 @@
 import { type ExecutionOutcomeRecordWord } from "../../core/checkpoint-execution-record.js";
+import { type HolderJudge } from "../../core/checkpoint-generation.js";
 import { type Checkpoint, type PendingSteerInput, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
 import type { GateOutcome } from "../../core/gate-outcome.js";
+import { type CheckpointDeleteGuard, type CheckpointOverdueCursor, type CheckpointOverdueQuery, type CheckpointPage, type CheckpointRowRead, type CheckpointSessionCursor, type CheckpointSessionQuery } from "../../core/checkpoint-queries.js";
 import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 export interface FileCheckpointStoreOptions {
     /** This store's half of {@link import("./shared-ledger.js").LedgerPaths.onCorruptRead}. */
@@ -11,6 +13,13 @@ export interface FileCheckpointStoreOptions {
     fsync?: boolean;
     /** Compact the ledger into a snapshot once it exceeds this many events (then truncate). Default 1000. */
     compactEvery?: number;
+    /** The session head read (a session store's `headOf`) {@link FileCheckpointStore.deleteSessionCheckpoints} judges its guard by;
+     *  without it the store has no `deleteSessionCheckpoints` member. */
+    sessionHeadOf?: (sessionId: string) => Promise<{
+        readonly owner: string | null;
+    } | undefined>;
+    /** The judge of a resolve's claim holder ({@link HolderJudge}); with it the store declares `fence = { holder: true }`. */
+    holderIsCurrent?: HolderJudge;
 }
 export declare class FileCheckpointStore implements CheckpointStore {
     /** design/173 §2.3 — honest declaration on the restart-survival axis the vocabulary claims: rows
@@ -34,6 +43,11 @@ export declare class FileCheckpointStore implements CheckpointStore {
     readonly execution: {
         readonly outcome: true;
     };
+    /** Declared exactly when the store was built with a `holderIsCurrent` judge. */
+    readonly fence?: {
+        readonly holder: true;
+    };
+    private readonly holderIsCurrent;
     private readonly fsyncEnabled;
     private readonly compactEvery;
     /** RB-134: the directory's ONE authority (map + token mutex + append log), joined not rebuilt. */
@@ -42,6 +56,11 @@ export declare class FileCheckpointStore implements CheckpointStore {
     private get cps();
     /** One-shot crash fault (mirrors `InMemoryCheckpointStore.testInjectFault`). */
     private fault;
+    /** The guarded {@link FileCheckpointStoreOptions.onCorruptRead} seat (the ledger's replay and this store's projection share it). */
+    private readonly discloseCorrupt;
+    private readonly ledgerPath;
+    /** Present exactly when the store was built with a session head read (`FileCheckpointStoreOptions.sessionHeadOf`). */
+    readonly deleteSessionCheckpoints?: (sessionId: string, guard: CheckpointDeleteGuard) => Promise<number>;
     constructor(root: string, opts?: FileCheckpointStoreOptions);
     /** Serialize an op behind any in-flight op on the same token (the in-process per-token async mutex). */
     private withLock;
@@ -66,6 +85,11 @@ export declare class FileCheckpointStore implements CheckpointStore {
     reap(scope: string, cutoff: number): Promise<number>;
     listByScope(scope: string): Promise<CheckpointSummary[]>;
     listScopes(): Promise<string[]>;
+    /** The listing faces' disclosure: a row read past a damage is reported through the corrupt-read seat, named by its non-secret
+     *  identity (never its token). */
+    private listingDisclose;
+    listOverdue(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    listBySession(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
     /** Force a compaction now (test/inspection). The snapshot rewrite + RB-167 closeForSwap swap that
      *  makes `replay` read the full state from the snapshot alone is the base's {@link LedgerCore.compact}. */
     compactNow(): void;