@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/memory-engine/layout.d.ts

@@ -513,13 +513,21 @@ export interface QuarantineOutcome {
  * without native bindings. What this buys is the leaf variant, which is the cheap one; the ancestor
  * variant stays open and is recorded with the rest of the family rather than papered over.
  *
- * Throws like `writeFileSync`, including ELOOP when the final component IS a symlink. A HARD link is the
- * same tamper by other means — the file's bytes live under a second name, possibly outside the store, and
- * an in-place write would change them there too — so an opened file with more than one name is refused
- * the same way, before anything is truncated (the check reads the opened descriptor: no window). The
- * write itself goes through `writeFileSync` on the open descriptor, which writes every byte or throws —
- * a bare `writeSync` may short-write, and reporting a truncated restore as contained (after the
- * truncation already destroyed the destination) is the failure this guard exists to prevent.
+ * Throws like `writeFileSync`, including ELOOP when the final component IS a symlink, and EACCES for a
+ * file whose own bits refuse the write. A write changes only the NAME it writes. A file with one name is
+ * rewritten in place (its inode and mode stay). A HARD link is the same tamper as a symlink by other
+ * means — the file's bytes live under a second name, possibly outside the store, and an in-place write
+ * would change them there too — so a file the open finds with more names is never written in place.
+ * One such name is the engine's own: a staging name a no-replace restore stopped between its `link` and
+ * its `unlink` left beside the file; it is removed first ({@link dropStagingSecondNames}), the interrupted
+ * restore's last step. A file that still has another name gets a new file under THIS name, written the
+ * way the store commits a file ({@link atomicWriteFileSync}: an exclusive no-follow sibling, 0o600,
+ * renamed over this name); the other names keep their file, its bytes and its mode. Residual: a path
+ * replaced by another file between the open and that rename is replaced again (the window every
+ * rename-based store write has). The in-place write goes through `writeFileSync` on the open descriptor,
+ * which writes every byte or throws — a bare `writeSync` may short-write, and reporting a truncated
+ * restore as contained (after the truncation already destroyed the destination) is the failure this
+ * guard exists to prevent.
  */
 export declare function writeFileNoFollow(path: string, content: string): void;
 /** {@link writeFileNoFollow}'s NO-REPLACE twin: write `content` only if nothing is at `path`. `"written"`
@@ -529,6 +537,48 @@ export declare function writeFileNoFollow(path: string, content: string): void;
  *  it refuses a symlink at the final component on its own (POSIX `EEXIST` on a link, dangling or not),
  *  so the twin's no-follow property is kept without a second check. */
 export declare function writeFileNoReplace(path: string, content: string): "written" | "kept";
+/** THE minter of every staging name the engine puts beside a plane file while it is displaced:
+ *  `<owner>.staging-<ms>-<pid>-<seq>`. One grammar for every site, so one recognizer
+ *  ({@link stagingNamePattern}) knows the names the engine can have left beside a seat. */
+export declare function mintStagingName(owner: string, now: () => number): string;
+/** The grammar {@link mintStagingName} and {@link claimStaging} write, as a recognizer — of ONE owner's
+ *  generations when `owner` is given; otherwise of every staging name an engine has minted beside a seat,
+ *  for the two owners it mints them for: an instruction hold (`hold-<ms>-<12 hex>`) and a crash-residue
+ *  capture (`<ms>-residue-<entry id>.md`), whose `<ms>-residue-<id>.md.staging` of 7.55.0 and earlier is
+ *  included (a name already on disk does not lose its owner with an upgrade). A prefix or a bare
+ *  `.staging-` suffix would adopt any name a writer chose on the strength of its spelling. Minted and
+ *  recognised side by side so the two cannot drift. */
+export declare function stagingNamePattern(owner?: string): RegExp;
+/** Take exclusive hold of a staged name by an atomic same-directory rename to a name minted HERE: the
+ *  staged name lives in a WRITABLE directory, so a plain read-then-unlink could delete a replacement that
+ *  landed between the two while reporting success over the earlier bytes. After the claim, what the rename
+ *  moved is what every later read and unlink addresses. Returns the claim when it took, the original when
+ *  the directory refused it (a hardening, not a precondition — a caller that removes on the strength of
+ *  the claim checks which one it got). Residual: a writer enumerating the directory can still replace the
+ *  CLAIM name before it is read — nothing Node's `fs` closes that, and the window is narrower than the one
+ *  it replaces. */
+export declare function claimStaging(stagingPath: string): string;
+/** Whether `path` names the file `ref` describes: a regular file on the same device with the same inode,
+ *  read without following a link at `path`. */
+export declare function isSameFile(path: string, ref: {
+    readonly dev: number;
+    readonly ino: number;
+}): boolean;
+/**
+ * Remove every staging name an engine minted ({@link stagingNamePattern}) beside `seat` that is another
+ * name of the file `opened` describes — the un-dropped half of a no-replace restore stopped between its
+ * `link` and its `unlink`. Called by a write about to replace that file's bytes: removing the name loses
+ * nothing the write itself does not overwrite, and touches only names in the engine's staging grammar (a name
+ * is read as the engine's own by its spelling and by being the same file, so a hard link someone made and
+ * spelled that way goes too; every other hard-link copy, snapshot name and planted link stays, with its file).
+ * Not claimed first: a claim is a `rename`, which replaces whatever already stands at the claim name.
+ * Residual: a file put at that minted name between the check and the removal is removed — only a writer of
+ * this directory can put it there, and it can remove the name itself. Answers how many names went.
+ */
+export declare function dropStagingSecondNames(seat: string, opened: {
+    readonly dev: number;
+    readonly ino: number;
+}): number;
 /**
  * The ONE way a committed baseline goes back after {@link quarantineAndTombstone} emptied its seat —
  * the inverse half of that function, beside it so the removal word and its readers stay in one module.
@@ -1272,7 +1322,9 @@ export declare function writeAllSync(fd: number, data: string): void;
  *  is not fsync'd (stores/file/fs-atomic.ts has the dir-fsync variant for stores that need it), so
  *  a crash in that window can resurface the old content. Sidecars tolerate that (they are rebuilt
  *  or re-derived); do not route data that can't through here. Throws on failure (fail-closed: a
- *  sidecar that cannot be written must not be silently skipped). */
+ *  sidecar that cannot be written must not be silently skipped). The tmp file is created EXCLUSIVELY and
+ *  no-follow: a name already standing there (a link or a file somebody placed) is an `EEXIST` refusal,
+ *  never a file this write truncates or writes through. */
 export declare function atomicWriteFileSync(path: string, data: string): void;
 /** Content-gated {@link atomicWriteFileSync} for a DERIVED/control-plane file: a byte-identical
  *  rewrite (the common case on a repeat mount over an unchanged store) is skipped entirely, so the

package/dist/core/memory-engine/layout.js

@@ -6,6 +6,7 @@ import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { MEMORY_ORIGIN_CAUSES } from "./types.js";
 import { physicalPathOf, physicalPathOfExisting, priorCallerCasedPathOf } from "../physical-path.js";
 import { thrownLabel, thrownText } from "../thrown-value.js";
+import { egressText } from "../untrusted-egress.js";
 const SCOPES_FILE = "scopes.json";
 export const CURSORS_FILE = "cursors.json";
 export const CONTROL_PLANE_DIR = ".engine";
@@ -1137,16 +1138,20 @@ export const QUARANTINE_DIR = "quarantine";
 const DELETED_TOMBSTONE = "---\ndeleted: true\n---\n";
 export function writeFileNoFollow(path, content) {
     const fd = openSync(path, O_WRONLY | O_CREAT | O_NOFOLLOW, 0o644);
+    let names;
     try {
-        const links = fstatSync(fd).nlink;
-        if (links > 1)
-            throw Object.assign(new Error(`${path} has ${links} names (a hard link) — a write through one name changes the file under the others; not written`), { path });
-        ftruncateSync(fd, 0);
-        writeFileSync(fd, content, "utf8");
+        const opened = fstatSync(fd);
+        names = opened.nlink > 1 && dropStagingSecondNames(path, opened) > 0 ? fstatSync(fd).nlink : opened.nlink;
+        if (names <= 1) {
+            ftruncateSync(fd, 0);
+            writeFileSync(fd, content, "utf8");
+        }
     }
     finally {
         closeSync(fd);
     }
+    if (names > 1)
+        atomicWriteFileSync(path, content);
 }
 export function writeFileNoReplace(path, content) {
     let fd;
@@ -1166,6 +1171,61 @@ export function writeFileNoReplace(path, content) {
     }
     return "written";
 }
+let stagingSeq = 0;
+export function mintStagingName(owner, now) {
+    stagingSeq += 1;
+    return `${owner}.staging-${now()}-${process.pid}-${stagingSeq}`;
+}
+export function stagingNamePattern(owner) {
+    const head = owner === undefined
+        ? String.raw `(?:hold-\d+-[0-9a-f]{12}\.staging-\d+-\d+-\d+|\d+-residue-[^/]+\.md\.staging(?:-\d+-\d+-\d+)?)`
+        : String.raw `${owner.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\.staging-\d+-\d+-\d+`;
+    return new RegExp(String.raw `^${head}(?:\.claim-\d+-\d+)*$`);
+}
+export function claimStaging(stagingPath) {
+    stagingSeq += 1;
+    const claimed = `${stagingPath}.claim-${process.pid}-${stagingSeq}`;
+    try {
+        renameSync(stagingPath, claimed);
+        return claimed;
+    }
+    catch {
+        return stagingPath;
+    }
+}
+export function isSameFile(path, ref) {
+    try {
+        const st = lstatSync(path);
+        return st.isFile() && st.dev === ref.dev && st.ino === ref.ino;
+    }
+    catch {
+        return false;
+    }
+}
+export function dropStagingSecondNames(seat, opened) {
+    const dir = dirname(seat);
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    const minted = stagingNamePattern();
+    let dropped = 0;
+    for (const name of names) {
+        const at = join(dir, name);
+        if (name === basename(seat) || !minted.test(name) || !isSameFile(at, opened))
+            continue;
+        try {
+            unlinkSync(at);
+            dropped += 1;
+        }
+        catch {
+        }
+    }
+    return dropped;
+}
 function readForVerification(path, maxBytes) {
     let fd;
     try {
@@ -1408,6 +1468,7 @@ function readSidecarJson(controlDir, fileName) {
     }
     return undefined;
 }
+const mintedItems = (items) => items.map((item) => egressText("same-principal", item));
 function coerceAnnouncements(raw) {
     const rec = { folded: 0, queue: [] };
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
@@ -1429,7 +1490,7 @@ function coerceAnnouncements(raw) {
                     at: a.at,
                     ...(typeof a.sessionId === "string" ? { sessionId: a.sessionId } : {}),
                     ...(typeof a.reportId === "string" ? { reportId: a.reportId } : {}),
-                    items: a.items,
+                    items: mintedItems(a.items),
                 });
             }
         }
@@ -1437,7 +1498,8 @@ function coerceAnnouncements(raw) {
     return rec;
 }
 export function enqueueMemoryAnnouncement(controlDir, ann, opts) {
-    const family = opts?.supersedesPrefix;
+    ann = { ...ann, items: mintedItems(ann.items) };
+    const family = opts?.supersedesPrefix === undefined ? undefined : egressText("same-principal", opts.supersedesPrefix);
     if (ann.items.length === 0 && family === undefined)
         return;
     lockedJournaledUpdate(controlDir, ANNOUNCEMENTS_FILE, (current) => {
@@ -2628,7 +2690,7 @@ export function writeAllSync(fd, data) {
 export function atomicWriteFileSync(path, data) {
     ensureDirExists(dirname(path));
     const tmp = join(dirname(path), `.tmp-${process.pid}-${Math.random().toString(36).slice(2, 10)}`);
-    const fd = openSync(tmp, "w", 0o600);
+    const fd = openSync(tmp, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, 0o600);
     try {
         writeAllSync(fd, data);
         fsyncSync(fd);

package/dist/core/model-seat.d.ts

@@ -49,9 +49,16 @@ export type RoleSpec = ModelRef | {
     select?: import("./select-model.js").ModelCriteria;
     thinking?: ThinkingLevel;
     /**
-     * Optional preset system prompt for this role (e.g. {@link CODE_AGENT_PROMPT} for a dev role).
-     * Used only when the task does not supply its own `TaskSpec.systemPrompt`. Lets coding roles run
-     * a coding prompt while other roles keep the neutral default — without touching the global default.
+     * The role's preset role base, by WORD: which catalog role base (`core/role.base` variant) tasks of this role
+     * are assembled for — `"code"` for a coding role — and their host role. Same closed set and door as
+     * `TaskSpec.promptRole` (`HOST_ROLES`; outside it ⇒ `config.prompt_selector_invalid`, naming `roles.<role>.promptRole`).
+     * The preset applies only when the task names no role base of its own (neither `promptRole` nor `systemPrompt`):
+     * the first source that names one — task, then this preset, then an engine spawner's child persona — decides it.
+     */
+    promptRole?: import("../prompt-assembly/catalog/schema.js").HostRole;
+    /**
+     * The role's preset role base, by TEXT (it replaces the base `promptRole` selects; the role is `promptRole`, else
+     * `general`). Same precedence as `promptRole`: used only when the task names no role base of its own.
      */
     systemPrompt?: string;
 };

package/dist/core/mods/classic-events.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The one typing of the engine's classic stations: each `classic.*` event a station raises, paired with its `e` and its
+ * answer form. Every raise site constructs its `e` against it (`dispatchClassic` / `observeClassic`), and the engine's
+ * registration form types a handler by it. Its keys are the event table's `classic.*` rows that carry a station — the key
+ * set is held to that table.
+ */
+import type { PermissionDeniedPayload, PostCompactEvent, PostToolBatchEvent, PostToolBatchResult, PostToolUseEvent, PostToolUseFailureEvent, PostToolUseFailureResult, PostToolUseResult, PreCompactEvent, PreCompactResult, PreToolUseEvent, PreToolUseResult, StopEvent, StopFailureEvent, StopHookResult, UserPromptSubmitEvent, UserPromptSubmitResult } from "../hooks.js";
+import type { MappedOn, ModRegistration } from "./kernel/index.js";
+import type { EngineDollar } from "./dollar.js";
+/** The answer of an event whose station reads none (an observation event): a chain handler passes `next(e)`'s on. */
+export type ObservedAnswer = Readonly<Record<string, never>>;
+/** Each `classic.*` event a station raises, with its `e` and its answer form. */
+export type ClassicEventMap = {
+    readonly "classic.PreToolUse": {
+        readonly e: PreToolUseEvent;
+        readonly answer: PreToolUseResult | null | false;
+    };
+    readonly "classic.PostToolUse": {
+        readonly e: PostToolUseEvent;
+        readonly answer: PostToolUseResult;
+    };
+    readonly "classic.PostToolUseFailure": {
+        readonly e: PostToolUseFailureEvent;
+        readonly answer: PostToolUseFailureResult;
+    };
+    readonly "classic.PostToolBatch": {
+        readonly e: PostToolBatchEvent;
+        readonly answer: PostToolBatchResult;
+    };
+    readonly "classic.UserPromptSubmit": {
+        readonly e: UserPromptSubmitEvent;
+        readonly answer: UserPromptSubmitResult;
+    };
+    readonly "classic.Stop": {
+        readonly e: StopEvent;
+        readonly answer: StopHookResult;
+    };
+    readonly "classic.SubagentStop": {
+        readonly e: StopEvent;
+        readonly answer: StopHookResult;
+    };
+    readonly "classic.StopFailure": {
+        readonly e: StopFailureEvent;
+        readonly answer: ObservedAnswer;
+    };
+    readonly "classic.PreCompact": {
+        readonly e: PreCompactEvent;
+        readonly answer: PreCompactResult;
+    };
+    readonly "classic.PostCompact": {
+        readonly e: PostCompactEvent;
+        readonly answer: ObservedAnswer;
+    };
+    readonly "classic.PermissionDenied": {
+        readonly e: PermissionDeniedPayload;
+        readonly answer: ObservedAnswer;
+    };
+};
+/** A `classic.*` event a station raises. */
+export type ClassicEventName = keyof ClassicEventMap;
+/**
+ * A registration on the engine's bus (`RunnerDeps.mods`, `TaskSpec.mods`): the kernel's registration form whose `on`
+ * types a handler of a `classic.*` event by {@link ClassicEventMap} — its `e`, its `next`, its answer.
+ */
+export interface EngineModRegistration extends Omit<ModRegistration<EngineDollar>, "register"> {
+    register(on: MappedOn<EngineDollar, ClassicEventMap>, options: unknown): void;
+}

package/dist/core/mods/classic-events.js

@@ -0,0 +1 @@
+export {};

package/dist/core/mods/dollar.d.ts

@@ -100,10 +100,23 @@ export interface EngineDollar extends ModDollarBase {
     };
     readonly tool: {
         list(): Promise<readonly string[]>;
+        /** `$.tool.call({ tool, ...input })`: the run's own pipeline for one call of a mounted tool (`tool-call.ts`). */
+        call(args: {
+            readonly tool: string;
+        } & Readonly<Record<string, unknown>>): Promise<ToolCallAnswer>;
     };
     readonly agent: {
         list(): Promise<readonly string[]>;
     };
 }
+/** What `$.tool.call` answers — `tool.call`'s own forms: the frozen view of the call's result, or the refusal (returned, not thrown). */
+export type ToolCallAnswer = {
+    readonly result: {
+        readonly content: readonly object[];
+        readonly isError: boolean;
+    };
+} | {
+    readonly deny: string;
+};
 /** The chain bottoms of the wave-one method events over a runner's seat view. */
 export declare function engineMethodBottoms(view: ModSeatView): ModMethodBottoms;

package/dist/core/mods/extension-call.d.ts

@@ -0,0 +1,31 @@
+import { type ModBottomContext, type ModBus } from "./kernel/index.js";
+import type { ExtensionRequester } from "../task-event.js";
+/** One extension's call while it runs. */
+export interface ExtensionCall {
+    /** The leg bus the call was made on (the one {@link legBusOf} returned). */
+    readonly bus: ModBus;
+    readonly toolCallId: string;
+    /** The `$` call's context: the frames its pipeline's events are raised under, and its origin. */
+    readonly caller: ModBottomContext;
+    /** Cleared when the call's pipeline settles — the one reading of "this call is still running". */
+    readonly live: boolean;
+    /** The call's end projection refused it (its latest gate record is a refusal) — written once, by the leg's tool_end station. */
+    readonly denied: boolean;
+}
+/** The running extension call this chain carries for `bus`, when it is the call `toolCallId` names (or any, unnamed). */
+export declare function extensionCallOf(bus: object, toolCallId?: string): ExtensionCall | undefined;
+/** Who asked for the call `toolCallId` names, when it is the running extension call: the one projection every carrier of
+ *  `requestedBy` reads (the occurrence the frames are projected from, the approval card). */
+export declare function requesterOf(bus: object, toolCallId: string): {
+    readonly requestedBy?: ExtensionRequester;
+};
+/** The leg's tool_end station says the call it is closing was refused (a no-op for any call that is not the running extension call). */
+export declare function noteExtensionCallDenied(bus: object, toolCallId: string): void;
+/** Run an extension's call: `pipeline` runs with the call's record in scope; the record stops being live when it settles. */
+export declare function runExtensionCall<T>(bus: ModBus, toolCallId: string, caller: ModBottomContext, pipeline: (call: ExtensionCall) => Promise<T>): Promise<T>;
+/**
+ * The leg bus every station raises on: a dispatch inside a running extension call made on it is raised under that call's
+ * frames and origin (a raiser that names its own frames keeps them — they extend the call's); one raised under a call
+ * that has settled is refused, `failed` by the engine and said once on `report`; any other dispatch is the bus's own.
+ */
+export declare function legBusOf(bus: ModBus, report: (err: Error) => void): ModBus;

package/dist/core/mods/extension-call.js

@@ -0,0 +1,43 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { ENGINE_ORIGIN } from "./kernel/index.js";
+const store = new AsyncLocalStorage();
+export function extensionCallOf(bus, toolCallId) {
+    const c = store.getStore();
+    return c !== undefined && c.live && c.bus === bus && (toolCallId === undefined || c.toolCallId === toolCallId) ? c : undefined;
+}
+export function requesterOf(bus, toolCallId) {
+    const c = extensionCallOf(bus, toolCallId);
+    return c !== undefined ? { requestedBy: Object.freeze({ kind: "extension", name: c.caller.origin.plugin }) } : {};
+}
+export function noteExtensionCallDenied(bus, toolCallId) {
+    const c = store.getStore();
+    if (c !== undefined && c.live && c.bus === bus && c.toolCallId === toolCallId)
+        c.denied = true;
+}
+export async function runExtensionCall(bus, toolCallId, caller, pipeline) {
+    const call = { bus, toolCallId, caller, live: true, denied: false };
+    try {
+        return await store.run(call, () => pipeline(call));
+    }
+    finally {
+        call.live = false;
+    }
+}
+export function legBusOf(bus, report) {
+    const leg = {
+        records: bus.records,
+        mounted: () => bus.mounted(),
+        hasHandlers: (event, participant) => bus.hasHandlers(event, participant),
+        dispatch: (event, e, options) => {
+            const c = store.getStore();
+            if (c === undefined || c.bus !== leg || options.frames !== undefined)
+                return bus.dispatch(event, e, options);
+            if (c.live)
+                return bus.dispatch(event, e, { ...options, frames: c.caller.frames, origin: c.caller.origin });
+            const reason = `${event}: raised under extension "${c.caller.origin.plugin}"'s call ${c.toolCallId}, which has ended — an event is not raised under a call that is over`;
+            report(new Error(`engine: ${reason} — the dispatch was not run`));
+            return Promise.resolve(Object.freeze({ kind: "failed", registration: ENGINE_ORIGIN.plugin, cause: "violation", reason, skipped: Object.freeze([]) }));
+        },
+    };
+    return leg;
+}

package/dist/core/mods/kernel/dispatch.d.ts

@@ -1,6 +1,6 @@
 import { type ModBusSide, type ModEventName, type ModSeat } from "./events.js";
 import { type ModAdmissionRecord, type ModDollarBase, type ModOrigin, type ModSeats } from "./registration.js";
-import { type ModAnswerCheck, type ModEventPayload, type ModFailureCause, type ModMatcher, type ModSkip, type ProxyProbe } from "./site-rules.js";
+import { type ModAnswerCheck, type ModAnswerRanks, type ModEventPayload, type ModFailureCause, type ModMatcher, type ModSkip, type ProxyProbe } from "./site-rules.js";
 /** A frame on the dispatch stack: a registration's own `$` call, or one of its handlers running. */
 export type ModFrame = {
     readonly kind: "dollar";
@@ -28,6 +28,13 @@ export interface ModMethodSeat {
     readonly enter?: (args: ModEventPayload) => ModEventPayload;
 }
 export type ModMethodBottoms = Partial<Record<ModEventName, ModMethodSeat>>;
+/**
+ * A callable event's host entry: what a `$` call of the event reaches. It runs whatever stands before the event and
+ * raises the event once at its own station, under `ctx.frames` and `ctx.origin` (so the caller's own handlers stay out
+ * of that raise); its answer is the call's answer (a `{ deny }` is returned, not thrown) and its throw the caller's.
+ */
+export type ModCallEntry = (args: ModEventPayload, ctx: ModBottomContext) => unknown;
+export type ModCallEntries = Partial<Record<ModEventName, ModCallEntry>>;
 export type ModDispatchOutcome = {
     readonly kind: "answered";
     readonly answer: unknown;
@@ -39,8 +46,12 @@ export type ModDispatchOutcome = {
     readonly cause: ModFailureCause;
     readonly reason: string;
     readonly skipped: readonly ModSkip[];
-} | {
+}
+/** `bottomStarted`: the chain's bottom had started when the dispatch was cancelled — on an effect event, what it did is
+ *  not known from here. */
+ | {
     readonly kind: "aborted";
+    readonly bottomStarted?: true;
 };
 /** What a participant filter sees of one mounted handler: its registration, that registration's seat, and whether it only observes. */
 export interface ModParticipant {
@@ -57,6 +68,9 @@ export interface ModDispatchOptions {
     readonly origin?: ModOrigin;
     /** The raiser's reading of an answer; an answer it refuses is a violation of the site. */
     readonly checkAnswer?: ModAnswerCheck;
+    /** The station's ranking of its answers — named by every dispatch of an event whose failure column refuses (one that
+     *  names none is not run), and read by the seat-trust law. */
+    readonly ranks?: ModAnswerRanks;
     /** Which mounted handlers take part (absent ⇒ every handler on the event). A handler it leaves out neither runs nor observes. */
     readonly participant?: (p: ModParticipant) => boolean;
 }
@@ -76,12 +90,15 @@ export interface ModBus {
     mounted(): readonly ModMountedHandler[];
     /** Whether any mounted handler hangs on `event` (among those `participant` admits) — no handler, no dispatch (the station skips the call). */
     hasHandlers(event: ModEventName, participant?: (p: ModParticipant) => boolean): boolean;
-    dispatch(event: ModEventName, e: ModEventPayload, options: ModDispatchOptions): Promise<ModDispatchOutcome>;
+    /** Raise `event` with the raiser's `e` (an object the bus receives whole, an event map's `e` as it is). */
+    dispatch(event: ModEventName, e: object, options: ModDispatchOptions): Promise<ModDispatchOutcome>;
 }
 export interface ModBusInput<D extends ModDollarBase = ModDollarBase> {
     readonly side: ModBusSide;
     readonly seats: ModSeats<D>;
     readonly bottoms: ModMethodBottoms;
+    /** The host's entries of the callable events its bus raises (absent ⇒ none: a `$` call of such an event throws). */
+    readonly entries?: ModCallEntries;
     /** Where handler failures go (the host's error channel). Never throws back into the bus. */
     readonly report: (err: Error, classification?: "observational-hook-verdict-ignored") => void;
     /** The host's one rule for turning a THROWN value into text (a handler, a `.catch` or a `register` may throw