@sigrun/sigrun 0.6.0 → 0.7.0

package/dist/curation/targets.js

@@ -13,7 +13,16 @@
  * extension's unlisted direct write tools (a "remember this" path the
  * extension owns itself) are never intercepted, never gated, never
  * undone by the curator.
+ *
+ * `SKILL_MANAGE_READ_ACTIONS` (exported for the A8 wrap and the tool
+ * itself — ONE literal, the A7 dedupe): the `skill_manage` actions that
+ * are safe anywhere (`list`/`view` pass through outside a curator run).
  */
+/** `skill_manage`'s read actions — safe anywhere, never intercepted. */
+export const SKILL_MANAGE_READ_ACTIONS = new Set([
+    "list",
+    "view",
+]);
 /**
  * The registered tool names that are curation tools by core ownership.
  * Exported for the A8 wrap feed's seed (the feed starts with the core
@@ -63,6 +72,7 @@ export class CurationRegistry {
 export function buildCurationRegistry(bindings) {
     const targets = [];
     const seen = new Set();
+    const toolOwner = new Map();
     for (const binding of bindings) {
         for (const target of binding.targets) {
             const id = `${binding.extension}:${target.name}`;
@@ -70,6 +80,17 @@ export function buildCurationRegistry(bindings) {
                 throw new Error(`duplicate curation target id "${id}" — the loader already rejected this; a second arrival is a boot bug`);
             }
             seen.add(id);
+            // A tool names ONE target (A8): two targets listing the same
+            // tool make `byTool` first-wins arbitrary and an undoReview
+            // silently un-actionable for the shadowed target. Fail loud
+            // at boot, the same discipline as the duplicate-id check.
+            for (const tool of target.tools) {
+                const owner = toolOwner.get(tool);
+                if (owner !== undefined) {
+                    throw new Error(`curation tool "${tool}" is listed by both ${owner} and ${id} — a tool names one curation target`);
+                }
+                toolOwner.set(tool, id);
+            }
             targets.push({ ...target, id, extension: binding.extension });
         }
     }

package/dist/curation/wrap.js

@@ -41,7 +41,7 @@ import { copyJson } from "@earendil-works/chord";
 import { defineDoc, LiveDoc } from "@earendil-works/pi-durable";
 import { authorOfSubmission } from "./attribution.js";
 import { curationRun } from "./run-doc.js";
-import { CORE_CURATION_TOOLS } from "./targets.js";
+import { CORE_CURATION_TOOLS, SKILL_MANAGE_READ_ACTIONS } from "./targets.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
 /** The answer an owner-authored call receives (contract text). */
 export const HINT_NOTED_TEXT = "Noted. The curator will review this after your reply.";
@@ -63,11 +63,6 @@ export const HintsDoc = defineDoc({
     fork: "current",
     initial: () => ({ hints: [] }),
 });
-/** `skill_manage`'s read actions — safe anywhere, never intercepted. */
-const SKILL_MANAGE_READ_ACTIONS = new Set([
-    "list",
-    "view",
-]);
 /**
  * Whether one call passes through to the original outside a curator
  * run: only `skill_manage`'s read actions. Every other curation-tool

package/dist/extension.d.ts

@@ -330,12 +330,14 @@ export type CurationSkillChange = {
 };
 /**
  * One change-feed entry (structural mirror of the store's `FeedEntry`).
- * The undo-relevant fields (`before`, `after`) are opaque version ids.
+ * `id`, `before` and `after` are commit SHAs in the user's curation
+ * history repo (tabs+skills Task 9); `actor` widens to include
+ * `"outside"` for catch-up commits the store itself did not author.
  */
 export type CurationFeedEntry = {
     readonly id: string;
     readonly at: string;
-    readonly actor: "curator" | "agent" | "user";
+    readonly actor: "curator" | "agent" | "user" | "outside";
     readonly action: string;
     readonly skill: string;
     readonly reason?: string;
@@ -655,7 +657,14 @@ interface NotificationEventBase {
     readonly user: string | undefined;
     readonly title: string;
     readonly body: string;
-    /** `${server.publicUrl}/#/c/<conversationId>` when `server.publicUrl` is set; absent otherwise. */
+    /**
+     * A deep link into the webui, only ever set when `server.publicUrl` is
+     * configured: `${server.publicUrl}/#/c/<conversationId>` for
+     * conversation-carrying events, or the
+     * `${server.publicUrl}/#/ext/<slug>/<view>` link for an extension
+     * notice whose target is a declared view (with `?params=` when the
+     * target carries params). Absent otherwise.
+     */
     readonly url?: string;
 }
 /** One notification core delivers to every registered notifier (best-effort). */

package/dist/harness/boot.js

@@ -71,6 +71,7 @@ import { packagesDirOf, selfPackageRoot } from "./packages.js";
 import { resolveHelper } from "../sandbox/helper.js";
 import { launchInJail } from "../sandbox/launch.js";
 import { buildUserPolicy, defaultModuleTrees } from "../sandbox/policy.js";
+import { validateGrantPath } from "../sandbox/grants.js";
 import { lookupOsAccount } from "../sandbox/os-account.js";
 import { agentEnv } from "./agent-env.js";
 import { UserServices } from "./user-services.js";
@@ -81,10 +82,13 @@ import { createAdmissionGuard } from "./identity/users.js";
 import { sweepAccountLinks } from "./identity/link-sweep.js";
 import { effectiveOwner as resolveEffectiveOwner } from "./identity/primary-admin.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
-import { learnedSkillsDir } from "../curation/paths.js";
+import { learnedSkillsDir, userRepoSpec } from "../curation/paths.js";
 import { SkillStore } from "../curation/store.js";
 import { OverlayStore } from "../curation/overlays.js";
 import { UsageCounters } from "../curation/usage.js";
+import { GitHistory } from "../history/git.js";
+import { workspaceHistoryFor, workspaceRepoSpec, } from "../history/workspace-history.js";
+import { migrateUserCuration } from "../curation/migrate.js";
 import { buildCurationRegistry } from "../curation/targets.js";
 import { createCurationHost } from "../curation/host.js";
 import { createCurationToolFeed, wrapExtensionCurationTools, } from "../curation/wrap.js";
@@ -286,6 +290,35 @@ export async function openHarness(config, options = {}) {
         coreRoot,
         userAreas: (user) => join(roots.dataDir, "users", user),
     };
+    // Curation seal revalidation (tabs/skills Task 8): stored workspace or
+    // grant paths that fail TODAY's validator (e.g. a pre-seal record whose
+    // workspace is the bare user area, which contains curation/) are
+    // refused per use by buildUserPolicy, silently stripping the agent's
+    // tools. Boot names every such record loudly with its repair (Task 14
+    // documents PATCH /v1/users/<u> {"workspace": "<userArea>/workspace"}).
+    for (const record of identity.users.list()) {
+        if (record.workspace !== undefined) {
+            const result = validateGrantPath(record.workspace, {
+                managed: managedPaths,
+                user: record.user,
+            });
+            if (!result.ok) {
+                console.warn(`identity: user "${record.user}" workspace ${record.workspace}: ${result.reason} (agent tools unavailable until repaired; re-point to ${managedPaths.userAreas(record.user)}/workspace)`);
+            }
+        }
+        for (const grant of record.grants ?? []) {
+            const result = validateGrantPath(grant.path, {
+                managed: managedPaths,
+                user: record.user,
+                ...(grant.inheritedFrom === undefined
+                    ? {}
+                    : { inheritedFrom: grant.inheritedFrom }),
+            });
+            if (!result.ok) {
+                console.warn(`identity: user "${record.user}" grant ${grant.path}: ${result.reason} (grant refused until repaired)`);
+            }
+        }
+    }
     const userServices = new UserServices({
         launch: (policy, command, args, serviceEnv) => {
             if (helper === undefined)
@@ -410,6 +443,13 @@ export async function openHarness(config, options = {}) {
     const skillStores = new Map();
     const overlayStores = new Map();
     const usageCounters = new Map();
+    const curationHistories = new Map();
+    // Per-user migration promise (review I3): store/overlay mutations
+    // await it via their `ready` seam, so a write during a pending
+    // migration lands as its OWN commit after the import — never
+    // swallowed by the migration's discard.
+    const migrations = new Map();
+    const gitHomeDir = join(roots.stateDir, "git-home");
     const curationOf = (user) => {
         if (user === undefined)
             return undefined;
@@ -423,6 +463,34 @@ export async function openHarness(config, options = {}) {
             return undefined;
         }
         const userArea = managedPaths.userAreas(user);
+        let history = curationHistories.get(user);
+        if (history === undefined) {
+            history = new GitHistory(userRepoSpec(userArea), {
+                gitHome: gitHomeDir,
+                now: () => clockNow(),
+                log: (line) => console.warn(`curation history (${user}): ${line}`),
+            });
+            curationHistories.set(user, history);
+        }
+        // Migration (tabs+skills Task 9): the boot sweep below covers the
+        // directory users boot saw; a user created AFTER boot migrates on
+        // this first construction. Never-in-a-render: curationOf is the
+        // store factory, not a render path.
+        if (!migrations.has(user)) {
+            // Once per process: the settled promise STAYS in the map. The
+            // "nothing" branch writes the marker itself (review C1), so the
+            // on-disk state guards restarts; the in-process map guards
+            // within one boot. Only a FAILURE re-arms (the next curationOf
+            // retries).
+            const migration = migrateUserCuration(userArea, history).then(() => undefined, (error) => {
+                console.warn(`curation migration (${user}) failed: ${String(error)}`);
+                migrations.delete(user);
+            });
+            migrations.set(user, migration);
+        }
+        const ready = async () => {
+            await migrations.get(user);
+        };
         let store = skillStores.get(user);
         if (store === undefined) {
             store = new SkillStore({
@@ -441,6 +509,8 @@ export async function openHarness(config, options = {}) {
                     return undefined;
                 },
                 userExists: () => identity.users.get(user) !== undefined,
+                history,
+                ready,
             });
             skillStores.set(user, store);
         }
@@ -450,7 +520,8 @@ export async function openHarness(config, options = {}) {
                 userArea,
                 user,
                 userExists: () => identity.users.get(user) !== undefined,
-                feed: store,
+                history,
+                ready,
             });
             overlayStores.set(user, overlays);
         }
@@ -468,8 +539,55 @@ export async function openHarness(config, options = {}) {
             });
             usageCounters.set(user, usage);
         }
-        return { store, overlays, usage };
+        return { store, overlays, usage, history };
+    };
+    // Workspace skills history (tabs+skills Task 10): the SECOND repo per
+    // user — `<workspace>/skills` under git, caught up on settle. Cached
+    // per (user, workspace path): a changed path is a new instance on the
+    // same gitDir, so one log follows the user across workspace moves.
+    const workspaceHistories = new Map();
+    const workspaceHistoryOf = (user) => {
+        const workspace = workspaceService?.workspaceRoot(user);
+        return workspaceHistoryFor(user, workspace, {
+            cache: workspaceHistories,
+            create: (resolved) => {
+                const history = new GitHistory(workspaceRepoSpec(managedPaths.userAreas(user), resolved), {
+                    gitHome: gitHomeDir,
+                    now: () => clockNow(),
+                    log: (line) => console.warn(`workspace history (${user}): ${line}`),
+                });
+                // Task 12 race fix: settle the repo AT CONSTRUCTION, not on
+                // first use. Two concurrent first-uses (the view's catch-up +
+                // a write) each run prepare()'s init before either's commit:
+                // the later init lands between the earlier init and ITS
+                // commit — status reads an empty index, and the write lands
+                // with no commit. An eager empty catchUp (no-op on an
+                // existing repo, the import commit on a fresh one) makes
+                // every later use see a settled repo. Awaited BEFORE the
+                // instance returns so no first use can interleave with the
+                // init. Fail-soft like everything here: errors warn, never
+                // throw.
+                void (async () => {
+                    try {
+                        // settle(), never a catch-up: an init that COMMITTED
+                        // would absorb a racing first edit under the init
+                        // summary (the 2026-11-03 core/skills failure).
+                        await history.settle();
+                    }
+                    catch (error) {
+                        console.warn(`workspace history (${user}) init failed: ${String(error)}`);
+                    }
+                })();
+                return history;
+            },
+        });
     };
+    // Curation history migration (tabs+skills Task 9): every directory
+    // user boot sees imports once. Users created after boot migrate on
+    // their first curationOf (the migratedUsers seam above).
+    for (const record of identity.users.list()) {
+        curationOf(record.user);
+    }
     const curationSkillsOptions = {
         ...skillsOptions,
         skillStore: (user) => curationOf(user)?.store,
@@ -665,6 +783,15 @@ export async function openHarness(config, options = {}) {
         },
     });
     perUserSlugs.push(...loadedPerUserSlugs);
+    // Fail-fast vs wait (polish A1, spec §5.2): the caller declared a
+    // server WILL bind the host bridge — mark every loaded seam host so
+    // pre-bind calls keep the bounded wait instead of rejecting at once.
+    // `createServer` repeats this on entry (idempotent) for rigs that
+    // never passed the option.
+    if (options.expectHostBridge === true) {
+        for (const host of seamHosts.values())
+            host.expectBridge();
+    }
     // The curation-target registry (curator P7): the loader's validated,
     // slug-attributed bindings folded into the ONE registry — the A8
     // wrapping feed (isCurationTool) and the A9 host.curation surface
@@ -935,6 +1062,7 @@ export async function openHarness(config, options = {}) {
         pool: sandboxPool,
         directory: identity.users,
         managed: managedPaths,
+        defaultWorkspacePath: config.workspace.path,
         ownerOf: async (conversationId, read, ctx) => (await read.snapshot(SessionMetaDoc, conversationId, ctx))?.owner,
     });
     const workspacePrefs = defaultWorkspacePrefs(config.workspace.path);
@@ -1261,15 +1389,17 @@ export async function openHarness(config, options = {}) {
             const [newest] = await listRevisions(storage, jobId, BACKGROUND_CONTEXT);
             if (newest === undefined)
                 return;
+            // Resolve once: the primary admin can move between the two reads
+            // (a live directory), so a single snapshot keeps the row
+            // self-consistent.
+            const effectiveOwner = jobEffectiveOwner(newest.owner);
             events.publish({
                 type: "job.changed",
                 job: {
                     id: jobId,
                     name: newest.spec.name,
                     source: newest.source,
-                    ...(jobEffectiveOwner(newest.owner) === undefined
-                        ? {}
-                        : { owner: jobEffectiveOwner(newest.owner) }),
+                    ...(effectiveOwner === undefined ? {} : { owner: effectiveOwner }),
                     ...(newest.sharing === undefined ? {} : { sharing: newest.sharing }),
                     schedule: newest.spec.schedule,
                     action: newest.spec.action,
@@ -1389,6 +1519,10 @@ export async function openHarness(config, options = {}) {
             for (const host of seamHosts.values())
                 host.bindBridge(bridge);
         },
+        expectHostBridge: () => {
+            for (const host of seamHosts.values())
+                host.expectBridge();
+        },
         extensionRoutes: routeBindings,
         extensionCommands: commandBindings,
         extensionSurfaces: surfaceBindings,
@@ -1399,6 +1533,9 @@ export async function openHarness(config, options = {}) {
         skillRoots: extensionSkillRoots,
         curation,
         curationHost,
+        curationOf,
+        workspaceRootOf: (owner) => workspaceService?.workspaceRoot(owner),
+        history: { workspace: workspaceHistoryOf },
         commandExpansion,
         eventBus,
         events,

package/dist/harness/event-bus.js

@@ -66,6 +66,7 @@ import { InteractionDoc, TERMINAL as INTERACTION_TERMINAL } from "./interactions
 import { AmbientDoc } from "./ambient.js";
 import { toDurableContext } from "./context.js";
 import { beginUserDeletion } from "./stores.js";
+import { HostBridgeUnavailableError } from "./seam-host.js";
 /** Project a SessionMeta doc value into the tracked basis. */
 function metaBasisOf(value) {
     const basis = {
@@ -121,6 +122,13 @@ export class EventBus {
     }
     #queueMax;
     #hookDeadlineMs;
+    /**
+     * The `${label}:${member}` pairs whose HostBridgeUnavailableError
+     * already logged (polish A1, spec §5.2): a serverless process fails
+     * fast on EVERY bridged handler call, so only the first per pair
+     * warns — repeats are swallowed (still resolving the handler slot).
+     */
+    #unavailableLogged = new Set();
     #idleThresholdMs;
     #queue = [];
     #settleHandlers = [];
@@ -1390,6 +1398,17 @@ export class EventBus {
             // A handler may throw synchronously; that is the same failure as a
             // rejected promise and must not escape into the drain loop.
             const failed = (error) => {
+                if (error instanceof HostBridgeUnavailableError) {
+                    const key = `${label}:${error.member}`;
+                    if (this.#unavailableLogged.has(key)) {
+                        finish();
+                        return;
+                    }
+                    this.#unavailableLogged.add(key);
+                    console.warn("event-bus: %s handler failed: %s (further repeats for this member suppressed)", label, error.message);
+                    finish();
+                    return;
+                }
                 console.error("event-bus: %s handler failed:", label, error);
                 finish();
             };

package/dist/harness/loader.js

@@ -1536,6 +1536,8 @@ export async function loadExtensions(specifiers, registry, options = {}) {
     // target, so a duplicate quarantines the later declarer instead of
     // shadowing (never last-wins).
     const curationIds = new Set();
+    /** The qualified target id owning each claimed curation tool (A8's one-target-per-tool rule). */
+    const curationToolOwners = new Map();
     // Channel id → slug (gateway C1): the same claimed-only-by-LOADED pattern
     // as `slugs`. Chat bindings are keyed by channel id, so a shadowing
     // adapter would inherit another adapter's chats — the collision
@@ -1770,6 +1772,10 @@ export async function loadExtensions(specifiers, registry, options = {}) {
                 // (the same name twice in one result) hits the check on
                 // its SECOND arrival, quarantining before any install.
                 const claimed = new Set();
+                // This result's tool claims (the A8 one-target rule's
+                // intra-list half — merged into the cross-extension map
+                // only when the whole result survives).
+                const claimedTools = new Map();
                 for (const target of resolved.curationTargets) {
                     const id = `${slug}:${target.name}`;
                     if (curationIds.has(id) || claimed.has(id)) {
@@ -1780,6 +1786,19 @@ export async function loadExtensions(specifiers, registry, options = {}) {
                     if (unregistered !== undefined) {
                         throw new Error(`extension "${slug}" declares curation target "${target.name}" listing tool "${unregistered}" it does not register`);
                     }
+                    // A tool names ONE target (A8): two targets — across any
+                    // extensions — listing the same tool leave `byTool`
+                    // first-wins arbitrary and the shadowed target's undos
+                    // un-actionable. Quarantine the later declarer. Intra-list
+                    // claims are LOCAL (`claimedTools`) until the whole result
+                    // validates — a quarantined extension never leaks a claim.
+                    for (const tool of target.tools) {
+                        const owner = curationToolOwners.get(tool) ?? claimedTools.get(tool);
+                        if (owner !== undefined) {
+                            throw new Error(`curation tool "${tool}" is listed by both ${owner} and ${id} — a tool names one curation target`);
+                        }
+                        claimedTools.set(tool, id);
+                    }
                 }
             }
             if (resolved.gateway !== undefined) {
@@ -1883,6 +1902,9 @@ export async function loadExtensions(specifiers, registry, options = {}) {
                 });
                 for (const target of resolved.curationTargets) {
                     curationIds.add(`${slug}:${target.name}`);
+                    for (const tool of target.tools) {
+                        curationToolOwners.set(tool, `${slug}:${target.name}`);
+                    }
                 }
             }
             if (resolved.jobs !== undefined) {

package/dist/harness/packages.js

@@ -85,6 +85,13 @@ export const HOST_RUNTIME_MODULES = [
     "@earendil-works/pi-durable",
     "@earendil-works/chord",
     "typebox",
+    // The shared workspace is host-shipped too (wire + access contracts
+    // every extension family type against; @sigrun/recall is the first
+    // packages-dir extension importing it at RUNTIME — value imports like
+    // accessOf, not just types). Linked like the Earendil host modules so
+    // a packages-dir extension's bare `@sigrun/shared/*` import resolves
+    // against the copy the host runs (one shared, never a second copy).
+    "@sigrun/shared",
     SELF_MODULE_NAME,
 ];
 /**

package/dist/harness/reserved-sections.js

@@ -45,5 +45,7 @@ export const RESERVED_EXTENSION_SLUGS = [
     "prompts",
     "packages",
     "git",
+    "git-home",
+    "history",
     "core",
 ];

package/dist/harness/seam-host.js

@@ -29,6 +29,24 @@ export class SeamError extends Error {
         this.name = "SeamError";
     }
 }
+/**
+ * A bridge-backed `host.*` member was called in a process that will never
+ * bind the host bridge (no `createServer`, no `expectHostBridge: true`).
+ * Fails fast instead of waiting out the bind deadline: the member and the
+ * calling extension are named so the embedder can either start a server
+ * or stop calling bridged members.
+ */
+export class HostBridgeUnavailableError extends Error {
+    member;
+    caller;
+    constructor(member, caller) {
+        super(`seam host: ${member} — no server will bind the host bridge (caller: ${caller}); ` +
+            `start createServer or pass expectHostBridge: true to wait for a bind`);
+        this.name = "HostBridgeUnavailableError";
+        this.member = member;
+        this.caller = caller;
+    }
+}
 /**
  * Build the seam host for one extension. `kinds` gates writes: a record
  * whose `kind`/`key` the extension never declared is rejected — the
@@ -59,7 +77,7 @@ function syncStoreForwarder(pending, member, user) {
         },
     });
 }
-export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools, services) {
+export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools, services, options) {
     const interactionKinds = new Set(kinds.interaction ?? []);
     const ambientKinds = new Set(kinds.ambient ?? []);
     // The scoped stores view, keyed on the CURRENT identity — the same
@@ -101,31 +119,57 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
     const bridgePromise = new Promise((resolve) => {
         bridgeReleased = resolve;
     });
+    // Fail-fast vs wait (polish A1, spec §5.2): `expectBridge()` declares a
+    // server WILL bind (fanned out from `OpenedHarness.expectHostBridge`,
+    // which `createServer` calls synchronously on entry). Until then a
+    // bridge-less process is treated as a serverless embed — calls reject
+    // at once instead of stalling the full hook deadline.
+    let bridgeBound = false;
+    let bridgeExpected = false;
     // The pre-bind bound: a bridge call that waits PAST this long fails
     // loud instead of hanging forever (the jobs-task fake-clock hang's
-    // lesson). Production never sees it — `createServer` binds the bridge
-    // at boot, long inside the bound — but a serverless embed that never
-    // builds a server would otherwise await an eternally pending promise.
-    const bridgeDeadlineMs = 60_000;
+    // lesson). Only reachable when a server is expected — `createServer`
+    // binds the bridge at boot, long inside the bound. Injectable so a
+    // test can exercise the deadline without a 60-second wait.
+    const bridgeDeadlineMs = options?.bridgeDeadlineMs ?? 60_000;
     const hostBridge = async (member) => {
         await bind.harness();
-        return await Promise.race([
-            bridgePromise,
-            new Promise((_, reject) => {
-                const timer = setTimeout(() => {
-                    reject(new Error(`seam host: ${member} — the bridge never bound after ${bridgeDeadlineMs}ms; is createServer running? (caller: ${identity.name})`));
-                }, bridgeDeadlineMs);
-                // The rejection timer never keeps the process alive.
-                if (typeof timer === "object" && "unref" in timer)
-                    timer.unref();
-            }),
-        ]);
+        if (bridgeBound)
+            return await bridgePromise;
+        if (!bridgeExpected) {
+            throw new HostBridgeUnavailableError(member, identity.name);
+        }
+        // The deadline lane's timer is cleared the moment the bridge
+        // resolves — a successful bind never leaves a live 60-second
+        // rejection timer holding the process's event loop open.
+        let timer;
+        try {
+            return await Promise.race([
+                bridgePromise,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        reject(new Error(`seam host: ${member} — the bridge never bound after ${bridgeDeadlineMs}ms; is createServer running? (caller: ${identity.name})`));
+                    }, bridgeDeadlineMs);
+                    // The rejection timer never keeps the process alive.
+                    if (typeof timer === "object" && "unref" in timer)
+                        timer.unref();
+                }),
+            ]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
     };
     // The curation surface's settled bridge host (curator P6/A9): memoized
     // HERE — in the host closure — so every `host.curation` getter call (a
     // FRESH proxy per read) shares one settled reference. See the getter's
     // own comment for the sync-member discipline this serves.
     let curationHost;
+    // The surfaces fire-and-forget lane logs an unavailable bridge ONCE per
+    // member (polish A1): the same fail-fast error every call, so repeats
+    // are noise — other failures keep their per-call console.error.
+    let surfacesUnavailableLogged = false;
     return {
         get stores() {
             return { ...stores, user: userStores };
@@ -519,12 +563,23 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
                     bridge.surfaces.changed(identity.name, id, key, update);
                 })
                     .catch((error) => {
+                    if (error instanceof HostBridgeUnavailableError) {
+                        if (surfacesUnavailableLogged)
+                            return;
+                        surfacesUnavailableLogged = true;
+                        console.warn(`seam host: surfaces.changed (${identity.name}) — ${error.message} (further repeats suppressed)`);
+                        return;
+                    }
                     console.error(`seam host: surfaces.changed (${identity.name}/${id}) failed:`, error);
                 });
             },
         },
         bindBridge(bridge) {
+            bridgeBound = true;
             bridgeReleased(bridge);
         },
+        expectBridge() {
+            bridgeExpected = true;
+        },
     };
 }

package/dist/harness/workspace.js

@@ -1,7 +1,7 @@
 /** Resolve each conversation's ExecutionEnv: single-user, jailed, or fail-closed. */
 import { isAbsolute, join, resolve } from "node:path";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { buildUserPolicy } from "../sandbox/policy.js";
+import { buildUserPolicy, validateUserPath } from "../sandbox/policy.js";
 import { SandboxedExecutionEnv } from "../sandbox/sandboxed-env.js";
 import { UnavailableExecutionEnv } from "../sandbox/unavailable-env.js";
 import { selfPackageRoot } from "./packages.js";
@@ -38,6 +38,39 @@ export function createWorkspaceService(deps) {
             }
             return join(managed.userAreas(record.user), "jobs");
         },
+        workspaceRoot(owner) {
+            if (deps === undefined)
+                return undefined;
+            const { directory, managed, isolation } = deps;
+            const records = directory.list();
+            const record = selectRecord(records, owner);
+            const active = isolation.active();
+            let osAccount;
+            if (record?.osUser !== undefined) {
+                if (deps.osUsers?.available !== true)
+                    return undefined;
+                try {
+                    osAccount = (deps.lookupAccount ?? lookupOsAccount)(record.osUser);
+                }
+                catch {
+                    return undefined;
+                }
+                if (osAccount === undefined)
+                    return undefined;
+            }
+            // Rules 1+2: without active isolation a workspace root exists
+            // only in the single-record posture — forConversation resolves
+            // the same default there (and is unavailable with more users).
+            if (osAccount === undefined && !active) {
+                return records.length <= 1 ? deps.defaultWorkspacePath : undefined;
+            }
+            if (record === undefined)
+                return undefined;
+            const candidate = record.workspace ??
+                osAccount?.home ??
+                join(managed.userAreas(record.user), "workspace");
+            return validateUserPath(candidate, record, managed).ok ? candidate : undefined;
+        },
         async forConversation(conversation, prefs, read, ctx) {
             const workspace = prefs.defaultWorkspace;
             if (workspace.type !== "local") {