@sema-agent/core 7.7.0 → 7.9.0

package/dist/core/memory-engine/tools.js

@@ -6,6 +6,7 @@ import { formatMemoryAge } from "../memory-recall.js";
 import { committedOriginOf } from "./frontmatter.js";
 import { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_INDEX_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, MEMORY_SEARCH_BAND_ORDER_HEADER } from "./provenance-wording.js";
 import { deriveSupersededSet, memorySupersededNote, MEMORY_SEARCH_SUPERSEDED_TAG } from "./consolidation.js";
+import { toolFace } from "../tool-catalog-entries.js";
 export const MEMORY_SEARCH_TOOL_NAME = "memory_search";
 export const MEMORY_GET_TOOL_NAME = "memory_get";
 export const MEMORY_INDEX_TOOL_NAME = "memory_index";
@@ -175,11 +176,8 @@ export function createMemoryEngineTools(opts) {
     };
     const searchTool = {
         name: MEMORY_SEARCH_TOOL_NAME,
+        ...toolFace("memory-search"),
         description: carry ? `${SEARCH_DESCRIPTION}\n\n${MEMORY_PROVENANCE_SEARCH_SENTENCE}` : SEARCH_DESCRIPTION,
-        effect: "read",
-        offload: false,
-        contentOrigin: "local",
-        contract: { contractId: "core.memory_search@1", implementationRevision: "6" },
         parameters: Type.Object({
             query: Type.String({ description: "Keywords to look for (lexical match against entry names, descriptions and bodies)." }),
             limit: Type.Optional(Type.Number({ description: `Maximum hits to return (default ${MEMORY_SEARCH_DEFAULT_LIMIT}, max ${MEMORY_SEARCH_MAX_LIMIT}).` })),
@@ -319,11 +317,8 @@ export function createMemoryEngineTools(opts) {
     };
     const getTool = {
         name: MEMORY_GET_TOOL_NAME,
+        ...toolFace("memory-get"),
         description: GET_DESCRIPTION,
-        effect: "read",
-        offload: false,
-        contentOrigin: "local",
-        contract: { contractId: "core.memory_get@1", implementationRevision: "6" },
         parameters: Type.Object({
             id: Type.Optional(Type.String({ description: "Entry id (exact lookup). Pass either id or slug, not both." })),
             slug: Type.Optional(Type.String({ description: "Entry slug (its file path without .md). Ambiguous across scopes unless scope is also passed." })),
@@ -545,11 +540,8 @@ export function createMemoryEngineTools(opts) {
     };
     const indexTool = {
         name: MEMORY_INDEX_TOOL_NAME,
+        ...toolFace("memory-index"),
         description: carry ? `${INDEX_DESCRIPTION}\n\n${MEMORY_PROVENANCE_INDEX_SENTENCE}` : INDEX_DESCRIPTION,
-        effect: "read",
-        offload: false,
-        contentOrigin: "local",
-        contract: { contractId: "core.memory_index@1", implementationRevision: "1" },
         parameters: Type.Object({
             offset: Type.Optional(Type.Number({ description: "Zero-based row offset into the listing (default 0) — pass the previous page's footer value to continue." })),
             limit: Type.Optional(Type.Number({ description: `Maximum rows for this page (default ${MEMORY_INDEX_PAGE_ROWS}, max ${MEMORY_INDEX_MAX_PAGE_ROWS}).` })),

package/dist/core/permission-rule-consent.d.ts

@@ -27,11 +27,14 @@
  * this by editing a file backend's file. That is the settings-file trust model, stated rather than
  * defended against: for a file backend, host = user, no more and no less.
  */
-import { type EditedRuleBreadthWarning, type UncoveredSegmentDetail, type RuleOffer, type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
+import { type EditedRuleBreadthWarning, type UncoveredSegmentDetail, type RuleBehavior, type RuleOffer, type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
 import type { RuleOwner } from "./permission-rule-store.js";
 import { type PermissionRuleStoreProvider } from "./permission-rule-provider.js";
-/** One candidate rule inside an approval record: the exact text and where it would apply. */
+/** One candidate rule inside an approval record: what it says (`behavior`), the exact text and where it
+ *  would apply. A card mints `allow` candidates only (a card is one person's yes); the settings import
+ *  carries all three behaviors, each entry under the list it was read from. */
 export interface RuleCandidate {
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
 }
@@ -95,9 +98,10 @@ export interface RuleApprovalRecord {
      * as {@link StaleRuleApprovalRecord}. `3` (design/382 §3.5, B8/B7): the card batch's
      * `uncoveredDetail` seat became REQUIRED and `edited.warnings` became storable — a `schema: 2`
      * row is read back stale exactly like the pre-stamp rows before it (the short-lived-pending
-     * bargain, unchanged).
+     * bargain, unchanged). `4`: every candidate carries its `behavior` (the settings import now carries
+     * the deny/ask lists too) — a `schema: 3` row is stale by the same equality gate.
      */
-    schema: 3;
+    schema: 4;
     kind: RuleApprovalKind;
     state: "pending" | "approved" | "redeemed";
     candidates: RuleCandidate[];
@@ -167,7 +171,7 @@ export interface RuleApprovalRecord {
 }
 /**
  * design/375 §4.5 — the minimal ENVELOPE a store hands back for a durable row that predates the
- * CURRENT (`schema: 3`) record form. A typed read cannot honestly return such a row as a
+ * CURRENT (`schema: 4`) record form. A typed read cannot honestly return such a row as a
  * {@link RuleApprovalRecord}, and dropping it at the store layer would misreport "stale" as
  * corruption — so the store contract is this variant instead: `staleSchema: true` plus the
  * IDENTITY fields, which are spelled the same way in every version and therefore safe to read.
@@ -375,7 +379,7 @@ export declare function confirmRuleApproval(opts: {
 /** Why a confirmation did not land. A closed set so a host can branch (re-present, re-fetch, give up).
  *  The two `record_*` members past `record_not_found` are the durable-row gates (design/375 §4.5/§4.7),
  *  disclosed to the record's own owner only — a non-owner gets `record_not_found` for every row:
- *   - `"record_schema_stale"` — the record predates the current (`schema: 3`) form; the decision it carried
+ *   - `"record_schema_stale"` — the record predates the current (`schema: 4`) form; the decision it carried
  *     is void, and the recovery path is re-triggering the command for a fresh card (no
  *     compatibility read, no migration — `detail.message` says so);
  *   - `"record_malformed"` — the record's offer structure failed the read-side integrity checks
@@ -443,7 +447,7 @@ export type EditedRuleTextPrecheck = {
  * for a surface that wants to answer while the person is still typing instead of after a round trip.
  *
  * It is the SAME body the confirmation arm runs (`checkEditedRuleText`), which is the whole point: a
- * boundary that re-implements the check — or calls `parseAllowRuleText` directly — installs a SECOND,
+ * boundary that re-implements the check — or calls `parseRuleText` directly — installs a SECOND,
  * STRICTER judge that refuses spellings the edit face accepts (the muscle-memory `Bash(adb *)` form is
  * exactly such a case: the validator alone refuses it as a wildcard; the edit face normalizes it first).
  *
@@ -476,6 +480,7 @@ export declare function precheckEditedRuleText(text: string, command: string): E
  *  durable revision is reporting, not the landing's identity). */
 export type RedeemResult = {
     status: "redeemed";
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
     dot: RuleDot;
@@ -547,29 +552,13 @@ export interface ImportPreview {
         layer: ImportedSettingsLayer;
         found: boolean;
     }>;
+    /** The two SETTINGS LAYERS this version does not read at all. The three permission lists of the layers it
+     *  does read — allow, deny AND ask — are all imported (each candidate carries its `behavior`), so there
+     *  is no longer a "left in place" count beside them: an entry that did not become a candidate is in
+     *  `skipped` with its reason. */
     uncovered: {
         flagSettings: "not-imported-v1";
         policySettings: "not-imported-v1";
-        /**
-         * The deny/ask buckets of the layers actually read: how many entries are SITTING THERE, across all
-         * layers, that this import deliberately leaves in place (they are the tightening direction and have
-         * their own channel — importing them through a loosening lane would be the wrong door).
-         *
-         * Always present, zero when the buckets are absent or empty: "this settings file has 14 deny entries
-         * we did not touch" and "there was nothing there" are different facts, and a key that appears only in
-         * the first case makes them indistinguishable for a reader who sees one preview. The count is of
-         * ENTRIES IN PLACE, not of a decision — nothing here is skipped-and-lost; `skipped` stays the list of
-         * allow-bucket entries that did not become candidates.
-         *
-         * A bucket that is PRESENT but not an array cannot be counted; it contributes 0 and is disclosed in
-         * `skipped` under the layer's path, so a zero is never the report for something unreadable. Same for
-         * a layer whose whole `permissions` member is not an object — every bucket in it reads as absent,
-         * which is exactly the shape that would otherwise report two clean zeros.
-         */
-        denyAskBuckets: {
-            deny: number;
-            ask: number;
-        };
     };
 }
 /**
@@ -591,6 +580,7 @@ export interface ImportPreview {
  */
 export type RedeemedBatchMember = {
     readonly candidateIndex: number;
+    readonly behavior: RuleBehavior;
     readonly rule: string;
     readonly scope: RuleScope;
     readonly status: "persisted" | "deduped";
@@ -598,22 +588,25 @@ export type RedeemedBatchMember = {
     readonly dot: RuleDot;
 } | {
     readonly candidateIndex: number;
+    readonly behavior: RuleBehavior;
     readonly rule: string;
     readonly scope: RuleScope;
     readonly status: "refused";
     readonly reason: string;
 };
 /**
- * Read the allow buckets of the user-editable settings layers and produce a preview plus a PENDING
- * approval record. Nothing is stored until someone confirms that record and the batch is redeemed.
- * A preview with zero importable candidates returns NO `approvalId` — there is nothing to confirm,
- * and the absence says so (design/375 §4.1).
+ * Read the THREE permission lists (allow, deny, ask) of the user-editable settings layers and produce a
+ * preview plus a PENDING approval record. Nothing is stored until someone confirms that record and the
+ * batch is redeemed. A preview with zero importable candidates returns NO `approvalId` — there is nothing
+ * to confirm, and the absence says so (design/375 §4.1).
  *
- * Only the allow bucket is IMPORTED. The deny/ask buckets are the tightening direction and have their own
- * channel; importing them through a loosening lane would be the wrong door. They are still COUNTED and
- * reported (`preview.uncovered.denyAskBuckets`): by-design-not-imported and unnoticed look identical to
- * the person confirming the batch, and only one of them is true here — the same reason the non-Bash allow
- * entries are disclosed rather than dropped silently.
+ * Every list is read through the ONE validator under its own behavior: a deny/ask entry takes the
+ * tightening floor (`Bash(node:*)` as a deny is a legitimately wide tightening and imports), an allow
+ * entry the allow floor. A content-form deny/ask so imported is the person's own standing instruction
+ * and adjudicates in the persisted-rule lane beside their allows — deny > ask > allow — instead of
+ * being escorted by a shell into a bare tool-name ask that widens `Bash(rm -r:*)` into "every Bash call
+ * asks". An entry that does not import (a spelling with no rule form, a tool the lane does not speak
+ * for, a non-string) is DISCLOSED in `skipped` with its reason and stays in the settings file.
  */
 export declare function prepareCcImport(opts: {
     layers: CcImportLayer[];

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
 import { effectiveOrThrow } from "./permission-rule-provider.js";
 import { errText, isValidConsentScope, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
@@ -8,7 +8,7 @@ export class InMemoryRuleApprovalRecordStore {
         const r = this.rows.get(id);
         if (r === undefined)
             return undefined;
-        if (r.schema !== 3) {
+        if (r.schema !== 4) {
             return {
                 staleSchema: true,
                 id: r.id,
@@ -122,6 +122,12 @@ function approvalRecordDamageOf(rec) {
             if (typeof cand !== "object" || cand === null || typeof cand.rule !== "string") {
                 return `offer ${at} references candidate ${member}, which is not a candidate row`;
             }
+            if (!isRuleBehavior(cand.behavior)) {
+                return `offer ${at} references candidate ${member}, whose behavior is not one of ${RULE_BEHAVIORS.join("/")}`;
+            }
+            if (rec.kind === "card" && cand.behavior !== "allow") {
+                return `card offer ${at} references candidate ${member}, a ${cand.behavior} rule — a card mints allow candidates only`;
+            }
             if (!isValidConsentScope(cand.scope)) {
                 return `offer ${at} references candidate ${member}, whose scope is not a consent-face scope (global, project, or session)`;
             }
@@ -198,10 +204,11 @@ function approvalRecordDamageOf(rec) {
 }
 export function ruleOffersOfRecord(rec) {
     const tripleOf = (index) => {
-        const text = rec.candidates[index]?.rule;
-        if (text === undefined)
+        const cand = rec.candidates[index];
+        const text = cand?.rule;
+        if (cand === undefined || text === undefined)
             throw new Error(`approval-record offer references candidate ${index}, which the record does not carry`);
-        const parsed = parseAllowRuleText(text);
+        const parsed = parseRuleText(text, cand.behavior);
         if ("reject" in parsed) {
             throw new Error(`approval-record candidate ${index} does not parse as a rule (${parsed.reject.code}) — refusing to render it as one`);
         }
@@ -318,7 +325,7 @@ export async function prepareCardApproval(opts) {
         if (claimedBy.has(text))
             throw new Error(`engine defect: rule "${text}" was minted into two offers on one card`);
         const index = candidates.length;
-        candidates.push({ rule: text, scope });
+        candidates.push({ behavior: "allow", rule: text, scope });
         claimedBy.set(text, index);
         return index;
     };
@@ -336,7 +343,7 @@ export async function prepareCardApproval(opts) {
     const record = {
         id: mintId(opts.deps, "rar"),
         ...recordIdentityOf(owner),
-        schema: 3,
+        schema: 4,
         kind: "card",
         state: "pending",
         rev: 0,
@@ -427,7 +434,7 @@ function normalizeEditedSpelling(text) {
     return `${head}(${body}:*)`;
 }
 function parseSubmittedSpelling(text) {
-    return parseAllowRuleText(normalizeEditedSpelling(text));
+    return parseRuleText(normalizeEditedSpelling(text), "allow");
 }
 function checkEditedRuleText(text, command) {
     const parsed = parseSubmittedSpelling(text);
@@ -514,7 +521,7 @@ async function confirmEditedCandidate(rec, edit, deps) {
         ...rec,
         rev: rec.rev + 1,
         state: "approved",
-        candidates: [...rec.candidates, { rule: checked.canonicalRule, scope }],
+        candidates: [...rec.candidates, { behavior: "allow", rule: checked.canonicalRule, scope }],
         offers: [...rec.offers, { kind: "single", candidate: index }],
         selectedOffer: rec.offers.length,
         edited: { index, text: edit.text, at: nowIso(deps), ...(checked.warnings !== undefined ? { warnings: checked.warnings.map((w) => w.code) } : {}) },
@@ -559,7 +566,8 @@ export async function redeemRuleTicket(opts) {
     if (!offerMembersOf(chosenOffer).includes(parsed.index)) {
         return { status: "refused", reason: "the ticket names an option the person did not choose" };
     }
-    const parsedRule = parseAllowRuleText(candidate.rule);
+    const siblingsOf = candidate.behavior === "allow" ? { rec, offer: chosenOffer, index: parsed.index } : undefined;
+    const parsedRule = parseRuleText(candidate.rule, candidate.behavior);
     if ("reject" in parsedRule)
         return { status: "refused", reason: `${parsedRule.reject.code}: ${parsedRule.reject.message}` };
     let store;
@@ -587,12 +595,29 @@ export async function redeemRuleTicket(opts) {
             const theirs = again === undefined || isStale(again) ? undefined : again.redeemedDots?.[parsed.index];
             if (theirs === undefined)
                 return { status: "refused", reason: "the approval record changed state concurrently" };
-            return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot: theirs, recordId: rec.id, kind: rec.kind, replay: true });
+            return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot: theirs, recordId: rec.id, kind: rec.kind, replay: true, ...(siblingsOf !== undefined ? { siblingsOf } : {}) });
         }
     }
-    return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot, recordId: rec.id, kind: rec.kind, replay: known !== undefined });
+    return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot, recordId: rec.id, kind: rec.kind, replay: known !== undefined, ...(siblingsOf !== undefined ? { siblingsOf } : {}) });
 }
 const REDEEM_MAX_ATTEMPTS = 8;
+async function tighteningSiblingsStand(rec, offer, index, store, durableSnapshot) {
+    for (const member of offerMembersOf(offer)) {
+        if (member === index)
+            continue;
+        const sibling = rec.candidates[member];
+        if (sibling === undefined || sibling.behavior === "allow")
+            continue;
+        const dot = rec.redeemedDots?.[member];
+        if (dot === undefined)
+            return false;
+        const view = sibling.scope.kind === "session" ? await effectiveOrThrow(store, { sessionId: sibling.scope.sessionId }) : durableSnapshot;
+        const live = view.rules.some((r) => r.behavior === sibling.behavior && r.rule === sibling.rule && sameScope(r.scope, sibling.scope) && r.adds.some((a) => a.dot.actor === dot.actor && a.dot.counter === dot.counter));
+        if (!live)
+            return false;
+    }
+    return true;
+}
 async function applyRedemption(args) {
     let store;
     try {
@@ -608,7 +633,14 @@ async function applyRedemption(args) {
     for (let attempt = 0; attempt < REDEEM_MAX_ATTEMPTS; attempt++) {
         let rev;
         try {
-            rev = (await effectiveOrThrow(store)).rev;
+            const snapshot = await effectiveOrThrow(store);
+            rev = snapshot.rev;
+            if (args.siblingsOf !== undefined && !(await tighteningSiblingsStand(args.siblingsOf.rec, args.siblingsOf.offer, args.siblingsOf.index, store, snapshot))) {
+                return {
+                    status: "refused",
+                    reason: "withheld: this allow belongs to a batch whose deny/ask members do not all stand in the store — an allow must not stand wider than the list that was confirmed; redeem the batch (redeemRuleBatch) so the tightening members land first, or draw a fresh card",
+                };
+            }
         }
         catch (err) {
             return { status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` };
@@ -617,6 +649,7 @@ async function applyRedemption(args) {
         try {
             res = await writer.apply({
                 kind: "redemption-add",
+                behavior: args.parsedRule.behavior,
                 rule: args.parsedRule.rule,
                 scope: args.candidate.scope,
                 tool: args.parsedRule.tool,
@@ -639,7 +672,7 @@ async function applyRedemption(args) {
             };
         }
         if (!("conflict" in res)) {
-            return { status: "redeemed", rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
+            return { status: "redeemed", behavior: args.parsedRule.behavior, rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
         }
     }
     return { status: "refused", reason: `optimistic-concurrency retries exhausted after ${REDEEM_MAX_ATTEMPTS} attempts` };
@@ -654,7 +687,6 @@ export async function prepareCcImport(opts) {
     const skipped = [];
     const translated = [];
     const layers = [];
-    const denyAskBuckets = { deny: 0, ask: 0 };
     for (const layer of opts.layers) {
         let raw;
         try {
@@ -700,66 +732,55 @@ export async function prepareCcImport(opts) {
             });
             continue;
         }
-        for (const bucket of ["deny", "ask"]) {
-            const entries = permissions?.[bucket];
-            if (Array.isArray(entries))
-                denyAskBuckets[bucket] += entries.length;
-            else if (entries !== undefined && entries !== null) {
+        const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
+        for (const behavior of RULE_BEHAVIORS) {
+            const entries = permissions?.[behavior];
+            if (entries === undefined || entries === null)
+                continue;
+            if (!Array.isArray(entries)) {
                 skipped.push({
                     rule: layer.path,
-                    reason: `settings ${bucket} bucket is not an array — its entries could not be counted for the not-imported report (it stays in the settings file either way)`,
+                    reason: `settings ${behavior} bucket is not an array — no entry in it could be read (it stays in the settings file either way)`,
                 });
-            }
-        }
-        const allow = permissions?.allow;
-        if (!Array.isArray(allow))
-            continue;
-        const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
-        for (const entry of allow) {
-            if (typeof entry !== "string") {
-                skipped.push({ rule: String(entry), reason: "settings entry is not a string" });
                 continue;
             }
-            if (entry.startsWith("Read(")) {
-                const parsed = parseAllowRuleText(entry);
-                if ("reject" in parsed) {
+            for (const entry of entries) {
+                if (typeof entry !== "string") {
+                    skipped.push({ rule: String(entry), reason: `settings ${behavior} entry is not a string` });
+                    continue;
+                }
+                if (behavior === "allow" && entry.startsWith("Read(") && "reject" in parseRuleText(entry, behavior)) {
                     skipped.push({
                         rule: entry,
                         reason: "unsupported.form: only the Read(//abs-dir/**) directory form imports in v1 — this entry stays in the settings file, unimported",
                     });
                     continue;
                 }
-                if (!candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope))) {
-                    candidates.push({ rule: parsed.rule.rule, scope });
-                }
-                continue;
-            }
-            if (!entry.startsWith("Bash(")) {
-                const reason = /^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)
-                    ? "unsupported.tool: only Bash(...) command rules and Read(//abs-dir/**) directory rules import in v1 — this entry stays in the settings file, unimported"
-                    : /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
+                if (!/^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)) {
+                    const reason = /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
                         ? "unsupported.form: a bare tool-name entry is a name-set item, not a command rule — it stays in the settings file, unimported"
                         : "unsupported.form: not a command rule spelling this version imports — it stays in the settings file, unimported";
-                skipped.push({ rule: entry, reason });
-                continue;
-            }
-            const parsed = parseAllowRuleText(entry);
-            if ("reject" in parsed) {
-                skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
-                continue;
+                    skipped.push({ rule: entry, reason });
+                    continue;
+                }
+                const parsed = parseRuleText(entry, behavior);
+                if ("reject" in parsed) {
+                    skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
+                    continue;
+                }
+                if (candidates.some((c) => c.behavior === behavior && c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
+                    continue;
+                candidates.push({ behavior, rule: parsed.rule.rule, scope });
             }
-            if (candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
-                continue;
-            candidates.push({ rule: parsed.rule.rule, scope });
         }
     }
-    const preview = { candidates, skipped, translated, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } };
+    const preview = { candidates, skipped, translated, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS } };
     if (candidates.length === 0)
         return { preview };
     const record = {
         id: mintId(opts.deps, "rar"),
         ...recordIdentityOf(owner),
-        schema: 3,
+        schema: 4,
         kind: "import",
         state: "pending",
         rev: 0,
@@ -785,15 +806,15 @@ export async function prepareStarterBatch(opts) {
     const owner = resolveCallerOwner(opts.principal, opts.owner, "prepareStarterBatch");
     const candidates = [];
     for (const text of STARTER_RULES) {
-        const parsed = parseAllowRuleText(text);
+        const parsed = parseRuleText(text, "allow");
         if ("reject" in parsed)
             throw new Error(`starter rule "${text}" is not a valid rule: ${parsed.reject.message}`);
-        candidates.push({ rule: parsed.rule.rule, scope: { kind: "global" } });
+        candidates.push({ behavior: "allow", rule: parsed.rule.rule, scope: { kind: "global" } });
     }
     const record = {
         id: mintId(opts.deps, "rar"),
         ...recordIdentityOf(owner),
-        schema: 3,
+        schema: 4,
         kind: "starter",
         state: "pending",
         rev: 0,
@@ -833,18 +854,30 @@ export async function redeemRuleBatch(opts) {
     }
     const members = [];
     let rev = 0;
-    for (const candidateIndex of offerMembersOf(chosenOffer)) {
+    const ordered = [...offerMembersOf(chosenOffer)].sort((a, b) => {
+        const ra = RULE_BEHAVIOR_PRECEDENCE[rec.candidates[a].behavior];
+        const rb = RULE_BEHAVIOR_PRECEDENCE[rec.candidates[b].behavior];
+        return ra !== rb ? ra - rb : a - b;
+    });
+    let tighteningFailed;
+    for (const candidateIndex of ordered) {
         const candidate = rec.candidates[candidateIndex];
-        const row = { candidateIndex, rule: candidate.rule, scope: candidate.scope };
+        const row = { candidateIndex, behavior: candidate.behavior, rule: candidate.rule, scope: candidate.scope };
+        if (candidate.behavior === "allow" && tighteningFailed !== undefined) {
+            members.push({ ...row, status: "refused", reason: `withheld: candidate ${tighteningFailed} (a deny/ask member of this batch) did not land, and an allow must not stand wider than the list that was confirmed — redeem the batch again once the store accepts the tightening member` });
+            continue;
+        }
         let alreadyThere = false;
         {
             try {
                 const snap = await effectiveOrThrow(store, candidate.scope.kind === "session" ? { sessionId: candidate.scope.sessionId } : undefined);
                 rev = snap.rev;
-                alreadyThere = snap.rules.some((r) => r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
+                alreadyThere = snap.rules.some((r) => r.behavior === candidate.behavior && r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
             }
             catch (err) {
                 members.push({ ...row, status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` });
+                if (candidate.behavior !== "allow")
+                    tighteningFailed ??= candidateIndex;
                 continue;
             }
         }
@@ -855,8 +888,25 @@ export async function redeemRuleBatch(opts) {
         });
         if (res.status === "refused") {
             members.push({ ...row, status: "refused", reason: res.reason });
+            if (candidate.behavior !== "allow")
+                tighteningFailed ??= candidateIndex;
             continue;
         }
+        if (candidate.behavior !== "allow") {
+            let live = false;
+            try {
+                const snap = await effectiveOrThrow(store, candidate.scope.kind === "session" ? { sessionId: candidate.scope.sessionId } : undefined);
+                live = snap.rules.some((r) => r.behavior === candidate.behavior && r.rule === candidate.rule && sameScope(r.scope, candidate.scope) && r.adds.some((a) => a.dot.actor === res.dot.actor && a.dot.counter === res.dot.counter));
+            }
+            catch {
+                live = false;
+            }
+            if (!live) {
+                members.push({ ...row, status: "refused", reason: `this ${candidate.behavior} member's redeemed dot ${res.dot.actor}#${res.dot.counter} is not live in the store (removed since it was redeemed) — a removed rule is not re-landed by replaying its record; a new consent is required` });
+                tighteningFailed ??= candidateIndex;
+                continue;
+            }
+        }
         rev = candidate.scope.kind === "session" ? Math.max(rev, res.rev) : res.rev;
         members.push({ ...row, status: alreadyThere ? "deduped" : "persisted", alreadyRedeemed: res.alreadyRedeemed, dot: res.dot });
     }