@volter/supercode-teams 0.3.157 → 0.3.159

package/README.md

@@ -61,11 +61,32 @@ the source boundary and the remaining runtime qualification.
 The connector's redaction memo keeps serialized redacted JSON, with at most
 200,000 entries and 32 MiB of accounted string payload (two bytes per code unit,
 including keys and digests). An entry over 1 MiB is not retained. Oldest entries
-are evicted to fit; cache misses still go through the redaction worker. These are
+are evicted to fit; cache misses use a held digest observed under the same checked
+redaction basis, or go through the redaction worker. These are
 memo bounds, not total connector memory limits. The
 [source investigation](../../docs/evidence/connector-redaction-memo-2026-10-08.md)
 does not attribute the observed process peak or claim a measured runtime improvement.
 
+Memo entries are discarded when the observed custody/rules basis changes. A
+capture and its worker use one matching custody snapshot; a basis mismatch
+rejects the capture before queueing and leaves it owed for retry. Older basis
+labels cannot authorize held-digest reuse.
+[Source boundary and qualification](../../docs/evidence/connector-redaction-basis-2026-10-08.md).
+
+Session captures reread the custody registry and declared files before each
+transfer, including rate-limit retries. A stale queued capture is retained
+locally and replaced by a fresh full capture; its carried prefix, parts and
+native references are not reused. Original artifact files stay held until a
+replacement commit acknowledges the native bundle too. Other queued sessions
+can proceed. `supercode teams status` and `supercode auth status` show the holds
+and explain that registration does not purge already transferred or published
+data. A Teams administrator uses `TeamsClient.purgeSessionText` / `POST
+/api/v1/teams/:team/sessions/purge` for retrospective session-text cleanup.
+Direct writes after the last check and requests already in flight have **no
+bounded exposure time**. This is capture-transfer source behavior, with runtime
+and single-machine qualification still open.
+[Transfer scope and retained obligations](../../docs/evidence/connector-custody-egress-2026-10-08.md).
+
 `supercode teams rpc mail.statistics` reads local storage counts and import/retention receipts. It is refused remotely
 and through the app door. Writer groups count stored envelope copies, not call attempts or quotas; database page
 counts exclude physical WAL size. Successful imports record their actual source reads, bytes, batch sizes and time.

package/bin/workspace/sync-status.mjs

@@ -8,6 +8,15 @@ const reason = item => `${item.code ? `${item.code}: ` : ''}${item.message}`;
 export function syncStatusLines(sync, { indent = '  ' } = {}) {
   if (!sync) return [];
   const lines = [];
+  if(sync.custody_notice)lines.push(`Custody  ${sync.custody_notice}`);
+  const holds=sync.redaction_held??[];
+  if(holds.length){
+    lines.push(`Custody holds (${holds.length} capture${holds.length===1?'':'s'} retained locally):`);
+    const labels={owed:'fresh full capture owed',native_owed:'replacement native bundle owed',blocked:'payload refused; waiting for source, rule or custody change',cleanup:'replacement committed; local cleanup pending'};
+    for(const item of holds.slice(0,SHOWN))lines.push(`${indent}${item.harness} ${item.session_id} · ${item.capture_id} · ${when(item.at)} · ${labels[item.state]??item.state}${item.replacement?` · replacement ${item.replacement}`:''}`);
+    if(holds.length>SHOWN)lines.push(`${indent}… and ${holds.length-SHOWN} more (--json lists them all)`);
+  }
+  if(sync.redaction_held_unread?.length)lines.push(`Custody holds unread (${sync.redaction_held_unread.length}); original files and all artifact spills retained, inspect --json`);
   const problems = sync.not_syncing ?? [];
   if (problems.length) {
     lines.push(`Not syncing (${problems.length} session${problems.length === 1 ? '' : 's'}, most recent first):`);

package/bin/workspace.mjs

@@ -402,9 +402,9 @@ async function authCommand({ flags, sub = 'status', rest, home, contexts, output
     if (!account.context) return say(account.others.length ? `Team     none current · saved: ${account.others.join(', ')} (supercode auth switch NAME)` : 'Team     none (supercode login)');
     say(`Team     ${account.team} · ${new URL(account.origin).host}${account.reachable ? '' : ' · unreachable'}${account.others.length ? ` · also: ${account.others.join(', ')} (supercode auth switch)` : ''}`);
     say(account.machine ? `Machine  ${account.machine.name} · ${account.machine.connection ?? 'unknown'} · sharing ${account.machine.folder ?? '?'}${account.machine.service ? ` (${account.machine.service})` : ' (runs while `teams connect` does)'}` : 'Machine  not connected (supercode teams connect)');
-    // Only trouble (a session not syncing, an error in the last day) is worth lines here; `teams status` shows the rest.
+    // Custody's published-history boundary is part of account status even without a failed capture.
     const sync = account.machine?.sync;
-    if (sync?.not_syncing.length || sync?.not_bound?.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
+    if (sync?.custody_notice || sync?.not_syncing.length || sync?.not_bound?.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
     return;
   }
   if (sub === 'switch') {

package/connector/index.d.ts

@@ -65,8 +65,9 @@ export interface ConnectorConfigurationValue {
 
 export interface SyncErrorSummary { code: string | null; message: string; at: number }
 export interface SyncProblem extends SyncErrorSummary { harness: string; session_id: string; rule_id: string | null }
+export interface RedactionHoldStatus { capture_id: string; harness: string; session_id: string; rule_id: string | null; at: number | null; state: 'owed' | 'native_owed' | 'blocked' | 'cleanup'; replacement?: string }
 /** What `supercode teams status` shows: sessions not syncing (most recent first) and the last error; null without state. */
-export declare function readSyncStatus(stateDir: string): { not_syncing: SyncProblem[]; not_bound: { harness: string; session_id: string; reason: string }[]; not_bound_count: number; last_error: SyncErrorSummary | null; queued_captures: number } | null;
+export declare function readSyncStatus(stateDir: string): { custody_notice: string; redaction_held: RedactionHoldStatus[]; redaction_held_unread: { name: string; error: string }[]; not_syncing: SyncProblem[]; not_bound: { harness: string; session_id: string; reason: string }[]; not_bound_count: number; last_error: SyncErrorSummary | null; queued_captures: number } | null;
 
 export declare class TeamsConnector {
   constructor(options: TeamsConnectorOptions);

package/connector/index.mjs

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, writeFileSync, renameSync, existsSync, chmodSy
 import { realpathSync } from './path.mjs';
 import { redactionBasis } from '@volter/teams/redact';
 import { Redactor } from './redactor.mjs';
+import { RedactionHolds } from './redaction-holds.mjs';
 import { basename, dirname, join, sep } from 'node:path';
 
 /** A path in its real form: its nearest existing ancestor resolved (a file inside a folder this process may not read is
@@ -46,7 +47,9 @@ const covers=(root,cwd)=>{
 };
 // An error of the connection itself (the outbox, authentication, the server), not of one session.
 const connectionError=error=>Boolean(error?.outbox||error?.status===401||error?.status===403||error?.status>=500);
+const retryCapture=error=>connectionError(error)||['redaction_basis_changed','custody_unreadable'].includes(error?.code);
 const sameError=(a,b)=>a!=null&&b!=null&&a.code===b.code&&a.message===b.message;
+const CUSTODY_NOTICE='Custody registration does not purge data already transferred or published. A Teams administrator can purge session text through POST /api/v1/teams/:team/sessions/purge (TeamsClient.purgeSessionText). A direct file edit after the last transfer check, or a request already in flight, has no bounded exposure time.';
 const errorSummary=(error,at)=>error==null?null:{code:typeof error.code==='string'?error.code:null,message:String(error.message??error).slice(0,500),at};
 /** The sync status a connector keeps in its state directory (see TeamsConnector#syncStatus); null when it has none. */
 export function readSyncStatus(stateDir){
@@ -54,7 +57,7 @@ export function readSyncStatus(stateDir){
   const status=state?.sync_status;
   // Sessions this machine could not bind to the agent their launch named (bindAgentSessions): waiting, or refused for good.
   const agentSessions=Object.entries(state?.agent_sessions??{}).filter(([,item])=>item?.state==='pending'||item?.state==='refused').map(([session,item])=>({session,agent:item.agent,state:item.state,reason:item.error?.message??null}));
-  return {agent_sessions_unbound:agentSessions,index_unread:Object.values(status?.index_unread??{}).flat(),not_syncing:Array.isArray(status?.problems)?status.problems:[],not_bound:Array.isArray(status?.unbound)?status.unbound:[],not_bound_count:Number.isSafeInteger(status?.unbound_count)?status.unbound_count:(Array.isArray(status?.unbound)?status.unbound.length:0),last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:(()=>{try{return readdirSync(join(stateDir,'outbox')).filter(name=>name.endsWith('.json')).length;}catch{return 0;}})()};
+  return {custody_notice:CUSTODY_NOTICE,redaction_held:status?.redaction_held??[],redaction_held_unread:status?.redaction_held_unread??[],agent_sessions_unbound:agentSessions,index_unread:Object.values(status?.index_unread??{}).flat(),not_syncing:Array.isArray(status?.problems)?status.problems:[],not_bound:Array.isArray(status?.unbound)?status.unbound:[],not_bound_count:Number.isSafeInteger(status?.unbound_count)?status.unbound_count:(Array.isArray(status?.unbound)?status.unbound.length:0),last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:(()=>{try{return readdirSync(join(stateDir,'outbox')).filter(name=>name.endsWith('.json')).length;}catch{return 0;}})()};
 }
 // A tool call still running when the core reads a session has no result yet; the core answers it with a synthesized
 // placeholder (crates/interchange session/helpers.rs ensure_tool_results_paired: a `tool` message for that call id,
@@ -92,11 +95,14 @@ const itemSpills=item=>(item.artifacts??[]).filter(artifact=>artifact.spill).map
  * folded state writes them out again (TeamsConnector#loadEntries).
  */
 export function foldConnectorState(stateDir){
+  if(existsSync(join(stateDir,'redaction-held'))&&readdirSync(join(stateDir,'redaction-held')).some(name=>/^\d+\.json$/.test(name)))throw new Error('retained custody captures prevent folding state for an older connector; resolve the visible redaction holds first');
   const path=join(stateDir,'connector.json'),state=JSON.parse(readFileSync(path,'utf8'));
   const origins=join(stateDir,'origins'),outbox=join(stateDir,'outbox'),files=dir=>existsSync(dir)?readdirSync(dir).filter(name=>name.endsWith('.json')).sort():[];
+  if(state.outbox?.some(item=>item.redaction_hold))throw new Error('a custody-flagged capture prevents folding state for an older connector');
   if(state.origins||state.outbox)return {origins:Object.keys(state.origins??{}).length,captures:(state.outbox??[]).length,folded:false};
   state.origins={};for(const name of files(origins)){const {key,origin}=JSON.parse(readFileSync(join(origins,name),'utf8'));state.origins[key]=origin;}
   state.outbox=files(outbox).map(name=>JSON.parse(readFileSync(join(outbox,name),'utf8')));delete state.outbox_sequence;
+  if(state.outbox.some(item=>item.redaction_hold))throw new Error('a custody-flagged capture prevents folding state for an older connector');
   atomic(path,JSON.stringify(state,null,2)+'\n');
   for(const dir of [origins,outbox])rmSync(dir,{recursive:true,force:true});
   return {origins:Object.keys(state.origins).length,captures:state.outbox.length,folded:true};
@@ -105,12 +111,22 @@ export function foldConnectorState(stateDir){
 // observed, a baseline, the carried prefix) is of that form: a digest of the local text named a prefix the server never
 // held, every carry was refused, and each session holding a secret went whole on every pass. A message is redacted
 // in the connector's redaction worker, with a bounded digest memo: no body for one without a secret (most), serialized
-// redacted JSON for one with. Evicted or oversized values are redacted again. Each loaded message's digest (of the form
+// redacted JSON for one with. A miss uses the same-basis held-digest proof or redacts again. Each loaded message's digest (of the form
 // sent) is taken once and read where needed. The byte budget counts two bytes per retained string code unit, including
 // keys and digests; the entry bound separately limits Map/record overhead. Neither is a total-process heap bound.
 const REDACTED_MEMO=200000,REDACTED_MEMO_BYTES=32*1024*1024,REDACTED_MEMO_ENTRY_BYTES=1024*1024;
 const redactions=new Map();
-let redactionBytes=0;
+let redactionBytes=0,redactionMemoBasis=null;
+const freshRedactionBasis=()=>redactionBasis(undefined,{fresh:true});
+function useRedactionMemo(basis){
+  if(redactionMemoBasis!==basis){redactions.clear();redactionBytes=0;redactionMemoBasis=basis;}
+}
+function requireRedactionBasis(basis){
+  if(freshRedactionBasis()!==basis)throw Object.assign(new Error('redaction basis changed; capture needs fresh redaction'),{code:'redaction_basis_changed'});
+}
+// Older queued/committed captures could label a result with the basis read after its worker returned. They do not
+// establish the checked observation needed for held-digest reuse, even when that old label equals today's basis.
+const checkedRedactionBasis=basis=>`checked-v1:${basis}`;
 const sentDigests=new WeakMap();
 const digestOf=message=>{let digest=sentDigests.get(message);if(digest===undefined){digest=hash(canonicalJson(message.value));sentDigests.set(message,digest);}return digest;};
 function remember(digest,redacted){
@@ -236,7 +252,7 @@ export class TeamsConnector {
       for(const dir of [origins,outbox])rmSync(dir,{recursive:true,force:true});
       for(const dir of [origins,outbox])mkdirSync(dir,{recursive:true,mode:0o700});
       for(const [key,origin] of Object.entries(this.state.origins??{}))atomic(join(origins,`${hash(key).slice(0,32)}.json`),JSON.stringify({key,origin}));
-      this.state.outbox_sequence=0;
+      this.state.outbox_sequence=existsSync(join(this.stateDir,'redaction-held'))?readdirSync(join(this.stateDir,'redaction-held')).filter(name=>/^\d+\.json$/.test(name)).reduce((sequence,name)=>Math.max(sequence,Number(name.slice(0,-5))),0):0;
       for(const item of this.state.outbox??[])atomic(join(outbox,`${String(++this.state.outbox_sequence).padStart(12,'0')}.json`),JSON.stringify(item));
       delete this.state.origins;delete this.state.outbox;atomic(this.statePath,JSON.stringify(this.state,null,2)+'\n');
     }
@@ -253,6 +269,9 @@ export class TeamsConnector {
     for(const name of readdirSync(outbox).filter(name=>name.endsWith('.json')).sort()){try{this.outbox.push(Object.assign(JSON.parse(readFileSync(join(outbox,name),'utf8')),{[QUEUED_FILE]:name}));}catch(error){this.outboxUnread.push({name,error:String(error?.message??error)});}}
     // the sequence is past every queued capture's name on disk, read or unread, so no new one takes an unread one's
     for(const name of readdirSync(outbox)){const n=Number(/^(\d+)\.json$/.exec(name)?.[1]);if(Number.isSafeInteger(n)&&n>(this.state.outbox_sequence??0))this.state.outbox_sequence=n;}
+    this.redactionHolds=new RedactionHolds({stateDir:this.stateDir,atomic,saved:this.state.redaction_holds});
+    for(const name of [...this.redactionHolds.items.keys(),...this.redactionHolds.unread.map(item=>item.name)]){const n=Number(name.slice(0,-5));if(Number.isSafeInteger(n)&&n>(this.state.outbox_sequence??0))this.state.outbox_sequence=n;}
+    this.updateRedactionHolds();
   }
   /**
    * Where a Codex rollout past the display window is read from: the origin's window_start while it holds (the same
@@ -281,6 +300,33 @@ export class TeamsConnector {
   // every beat does not rewrite connector.json every beat. Its time stays that of its first occurrence in the run.
   set lastError(error){this.lastErrorValue=error;const status=this.syncStatus(),summary=errorSummary(error,this.clock.nowMs());if(sameError(status.last_error,summary))return;status.last_error=summary;this.saveQuietly();}
   syncStatus(){const status=this.state.sync_status??={problems:[],last_error:null};status.problems??=[];return status;}
+  updateRedactionHolds(){
+    this.state.redaction_holds=this.redactionHolds.saved();
+    const status=this.syncStatus();status.redaction_held=this.redactionHolds.status();status.redaction_held_unread=this.redactionHolds.unread;
+  }
+  observeCustodyBasis(){
+    const basis=freshRedactionBasis();
+    if(this.state.custody_basis!==basis){this.state.custody_basis=basis;process.stderr.write(`supercode teams: ${CUSTODY_NOTICE}\n`);this.saveQuietly();}
+    return basis;
+  }
+  requireCaptureTransfer(item){
+    const basis=this.observeCustodyBasis();
+    if(item.redaction_hold||item.redactionBasis!==checkedRedactionBasis(basis))throw Object.assign(new Error('queued capture needs fresh custody redaction; retained locally for fresh capture'),{code:item.redaction_hold?.code??'redaction_basis_changed'});
+    return basis;
+  }
+  async guardCaptureTransfer(item,json){
+    const basis=this.requireCaptureTransfer(item);
+    this.redactor??=new Redactor();
+    await this.redactor.run('custody_assert',[json],{basis,fresh:true});
+    // request invokes this synchronously after the worker answer, with no intervening await before fetch.
+    return ()=>this.requireCaptureTransfer(item);
+  }
+  holdQueuedCapture(item,error){
+    this.redactionHolds.hold(item,item[QUEUED_FILE],this.clock.nowMs(),error.code);
+    this.outbox.shift(); // Its spill references move to the hold; unqueue would release them.
+    this.updateRedactionHolds();this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id},error);
+    this.oweCapture({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id},error);this.save();
+  }
   saveQuietly(){try{this.save();}catch{}}
   noteSessionProblem({harness,nativeSessionId,ruleId=null},error){
     const status=this.syncStatus(),at=this.clock.nowMs(),summary=errorSummary(error,at);
@@ -295,7 +341,7 @@ export class TeamsConnector {
   clearSessionProblem(harness,nativeSessionId){
     const status=this.state.sync_status;if(!status?.problems?.some(item=>item.harness===harness&&item.session_id===nativeSessionId))return;
     status.problems=status.problems.filter(item=>!(item.harness===harness&&item.session_id===nativeSessionId));this.saveQuietly();
-  } async request(method,path,body){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);let response;for(let attempt=0;;attempt++){response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:AbortSignal.any([this.abort.signal, AbortSignal.timeout(30_000)])});
+  } async request(method,path,body,{beforeTransfer}={}){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);let response;for(let attempt=0;;attempt++){if(beforeTransfer){const finalCheck=await beforeTransfer(json);finalCheck();}response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:AbortSignal.any([this.abort.signal, AbortSignal.timeout(30_000)])});
     // A rate limit is waited out (the server says how long; the same idempotency key makes the retry safe), so a
     // large first sync slows down instead of failing its pass and restarting the connector.
     if(response.status!==429||attempt>=5)break;// The server names the wait in error.details (wire.mjs validationFailure); a Retry-After header is the fallback.
@@ -654,15 +700,16 @@ export class TeamsConnector {
     const {locator,descriptor,harness,nativeSessionId,ruleId,epoch}=options,key=`${harness}:${nativeSessionId}`;
     if(!this.sessionLive(key,ruleId,epoch))return;
     // A session whose store has not changed since this rule last committed it is in sync, whatever it last failed.
-    let captured=true;const changed=this.sessionChanged(options);if(!changed)this.clearSessionProblem(harness,nativeSessionId);
+    let captured=true,changed;
+    try{changed=this.sessionChanged(options);}catch(error){if(retryCapture(error))this.oweCapture(options,error);else this.noteSessionProblem(options,error);return;}
+    if(!changed)this.clearSessionProblem(harness,nativeSessionId);
     // A store this process may not read (macOS denies a launchd job a removable volume, whatever the owner granted the
     // terminal) is said once with its path and skipped.
     if(this.unreadable?.has(key))captured=false;
     else if(changed&&!this.predatesWindow(options))try{await this.capture({...options,live:Boolean(this.watched?.has(key))});}catch(error){
       if(this.abort.signal.aborted)return;
-      // An error of the connection itself (the outbox, authentication, the server): the outbox's own retry takes it, and
-      // this session's capture stays owed until a flush passes (it may have failed before it was queued)
-      if(connectionError(error)){this.oweCapture(options,error);return;}
+      // A connection failure or a changed redaction basis keeps this session owed; the existing retry wake re-reads it.
+      if(retryCapture(error)){this.oweCapture(options,error);return;}
       captured=false;this.noteSessionProblem(options,error);
       if(!this.noteUnreadable(options,error))process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} not synced: ${error.message}\n`);
     }
@@ -782,6 +829,9 @@ export class TeamsConnector {
   }
   sessionChanged(options){
     const stamp=this.sessionStamp(options);options.stamp=stamp;
+    const custodyKey=`${options.harness}:${options.nativeSessionId}`;
+    if(this.redactionHolds.items.size&&this.redactionHolds.blocked(custodyKey,stamp,options.ruleRevision,checkedRedactionBasis(this.observeCustodyBasis())))return false;
+    if(this.redactionHolds.needed(custodyKey))return true;
     if(stamp===null||this.outbox.length)return true;
     const rule=options.configuration?.rules?.find(item=>item.id===options.ruleId&&item.revision===options.ruleRevision&&item.state==='active');if(!rule)return true;
     const configured=rule.backfill??options.backfill??'all',mode=typeof configured==='string'?configured:configured.mode;
@@ -834,6 +884,7 @@ export class TeamsConnector {
     if(this.spillRefs)return this.spillRefs;
     const refs=this.spillRefs=new Map(),add=name=>refs.set(name,(refs.get(name)??0)+1);
     for(const item of this.outbox)for(const name of itemSpills(item))add(name);
+    for(const name of this.redactionHolds.spills())add(name);
     return refs;
   }
   retainSpills(names){const refs=this.spillHolders();for(const name of names){refs.set(name,(refs.get(name)??0)+1);this.freshSpills?.delete(name);}}
@@ -847,7 +898,7 @@ export class TeamsConnector {
    * whoever else held it. A file kept so is held by nothing counted and goes at the first start whose inventory is whole.
    */
   removeSpill(name){
-    if(this.outboxUnread?.length){this.spillProblem(`${name} was kept: ${this.outboxUnread.length} queued capture(s) could not be read and may name it`);return false;}
+    if(this.outboxUnread?.length||this.redactionHolds.unread.length){this.spillProblem(`${name} was kept: a queued or custody-held capture could not be read and may name it`);return false;}
     try{unlinkSync(join(this.spillDir(),name));return true;}
     catch(error){if(error?.code==='ENOENT')return true;this.spillProblem(`${name} could not be removed: ${error?.message??error}`);return false;}
   }
@@ -865,9 +916,9 @@ export class TeamsConnector {
   removeUnheldSpills(){
     const status=this.syncStatus();delete status.spill_cleanup;
     // only against a complete inventory of the outbox: a queued capture this process could not read may name any file
-    if(this.outboxUnread.length){
+    if(this.outboxUnread.length||this.redactionHolds.unread.length){
       status.outbox_unread=this.outboxUnread.map(({name,error})=>`${name}: ${error}`);
-      this.spillProblem(`${this.outboxUnread.length} queued capture(s) could not be read (${this.outboxUnread[0].name}: ${this.outboxUnread[0].error}); no spill file is removed until every queued capture is read`);
+      this.spillProblem('a queued or custody-held capture could not be read; no spill file is removed until their inventory is complete');
       return;
     }
     delete status.outbox_unread;
@@ -892,8 +943,9 @@ export class TeamsConnector {
   // Each loaded message in the form sent: the memo's; the loaded one itself when the server holds it unchanged under
   // this redaction basis (its digest is among those last observed); else what the redaction worker makes of it, all of
   // a capture's new messages in one request. A digest is taken once per message, of the form sent.
-  async sentMessages(raw,previous){
-    const basis=redactionBasis(),held=previous?.redaction_basis===basis&&previous?.observed_digests?.length?new Set(previous.observed_digests):null;
+  async sentMessages(raw,previous,basis=freshRedactionBasis()){
+    requireRedactionBasis(basis);useRedactionMemo(basis);
+    const held=previous?.redaction_basis===checkedRedactionBasis(basis)&&previous?.observed_digests?.length?new Set(previous.observed_digests):null;
     const out=new Array(raw.length),missing=[];
     raw.forEach((message,index)=>{
       const text=canonicalJson(message.value),digest=hash(text);
@@ -905,8 +957,10 @@ export class TeamsConnector {
       this.redactor??=new Redactor();
       if(!this.redactionCounted){this.redactionCounted=true;this.syncStatus().redaction={since:new Date(this.clock.nowMs()).toISOString(),batches:0,messages:0,bytes:0,worker_ms:0,main_ms:0,max_main_ms:0};}
       // The worker is sent each new message's canonical JSON and answers only those redaction changed.
-      let started=performance.now();const texts=missing.map(([,,text])=>text),pending=this.redactor.run('canonical',texts);let mainMs=performance.now()-started;
+      let started=performance.now();const texts=missing.map(([,,text])=>text),pending=this.redactor.run('canonical',texts,{basis,fresh:true});let mainMs=performance.now()-started;
       const changed=await pending;started=performance.now();
+      // Another connector/capture can run while this worker answers. Never store its result under a later basis.
+      requireRedactionBasis(basis);useRedactionMemo(basis);
       for(const [index,digest] of missing){remember(digest,null);out[index]=raw[index];sentDigests.set(raw[index],digest);}
       for(const {index:at,value,digest:sent} of changed){
         const [index,digest]=missing[at];
@@ -920,15 +974,17 @@ export class TeamsConnector {
       cost.batches+=1;cost.messages+=missing.length;cost.bytes+=texts.reduce((n,text)=>n+text.length,0);
       cost.worker_ms=Math.round(this.redactor.workerMs);cost.main_ms=Math.round((cost.main_ms+mainMs)*10)/10;cost.max_main_ms=Math.max(cost.max_main_ms,Math.round(mainMs*10)/10);
     }
-    return out;
+    requireRedactionBasis(basis);return out;
   }
-  async spillTranslated(translated,defaultName){
+  async spillTranslated(translated,defaultName,basis){
     const files=translated.files?.length?translated.files:[{path:translated.suggested_filename??defaultName,content:translated.content,role:'primary'}];
     if(files.filter(file=>file.role==='primary').length!==1)throw Object.assign(new Error('native codec bundle must contain exactly one primary file'),{code:'fidelity_unavailable'});
     let total=0;const spilled=[];
-    this.redactor??=new Redactor();const texts=await this.redactor.run('texts',files.map(file=>file.content));
-    for(const [index,file] of files.entries()){const bytes=Buffer.from(texts[index],'utf8');total+=bytes.length;if(total>256*1024*1024)throw Object.assign(new Error('native artifact bundle exceeds 256 MiB'),{code:'request_too_large'});spilled.push({path:file.path,role:file.role,...this.spill(bytes)});}
-    return {fidelity:translated.fidelity,residue:translated.residue??[],files:spilled};
+    this.redactor??=new Redactor();const texts=await this.redactor.run('texts',files.map(file=>file.content),{basis,fresh:true});
+    const [metadata]=await this.redactor.run('values',[{paths:files.map(file=>file.path),residue:translated.residue??[]}],{basis,fresh:true});
+    if(basis!==undefined)requireRedactionBasis(basis);
+    for(const [index,file] of files.entries()){const bytes=Buffer.from(texts[index],'utf8');total+=bytes.length;if(total>256*1024*1024)throw Object.assign(new Error('native artifact bundle exceeds 256 MiB'),{code:'request_too_large'});spilled.push({path:metadata.paths[index],role:file.role,...this.spill(bytes)});}
+    return {fidelity:translated.fidelity,residue:metadata.residue,files:spilled};
   }
   // The outbox artifacts and native_bundle of one capture from a spilled bundle; every capture gets fresh upload ids.
   bundleArtifacts(bundle,harness){
@@ -956,7 +1012,7 @@ export class TeamsConnector {
       const wait=this.watched?.has(key)||options.paced?0:CAPTURE_FLOOR_MS-(now-(this.lastCaptures.get(key)??0));
       // one retry wake per session, holding each rule's latest obligation: a newer generation of a rule replaces that
       // rule's options, never another rule's; the wake runs every rule held, paced as one
-      if(wait>0){this.holdObligation(this.retryOptions??=new Map(),key,options);if(!this.captureRetry.has(key))this.captureRetry.set(key,setTimeout(()=>{this.captureRetry.delete(key);for(const latest of this.takeObligations(this.retryOptions,key))this.capture({...latest,paced:true}).catch(error=>{if(connectionError(error))this.oweCapture(latest,error);else this.lastError=error;});},wait).unref?.());return null;}
+      if(wait>0){this.holdObligation(this.retryOptions??=new Map(),key,options);if(!this.captureRetry.has(key))this.captureRetry.set(key,setTimeout(()=>{this.captureRetry.delete(key);for(const latest of this.takeObligations(this.retryOptions,key))this.capture({...latest,paced:true}).catch(error=>{if(retryCapture(error))this.oweCapture(latest,error);else this.lastError=error;});},wait).unref?.());return null;}
       this.lastCaptures.set(key,now);
       const {locator}=options,path=locator?.storage?.kind==='file'&&existsSync(locator.storage.path)?realpathSync(locator.storage.path):null;
       const artifactBefore=path?statSync(path):null,anchor=this.codexAnchor(key,artifactBefore);
@@ -1080,7 +1136,7 @@ export class TeamsConnector {
         if(this.abort.signal.aborted)return;
         // A load that failed or timed out waits like a slow one, so it does not hold its lane on every pass.
         if(started!==null)this.largeCaptures.set(key,{at:started,ms:this.clock.nowMs()-started});
-        if(connectionError(error)){this.oweCapture(options,error);continue;}
+        if(retryCapture(error)){this.oweCapture(options,error);continue;}
         this.noteSessionProblem(options,error);
         if(!this.noteUnreadable(options,error))process.stderr.write(`supercode teams: ${options.harness} session ${options.nativeSessionId} not synced: ${error.message}\n`);
       }
@@ -1127,13 +1183,14 @@ export class TeamsConnector {
     }
     // The turns typed through a door here are labelled before redaction, which then reads them as sent.
     const raw=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});this.labelTurns(key,loaded.messages??loaded.turns??[],raw);
-    let messages=await this.sentMessages(raw,previous);const loadedMessages=messages,basis=redactionBasis();
+    const basis=this.observeCustodyBasis();let messages=await this.sentMessages(raw,previous,basis);const loadedMessages=messages;
+    const recapturing=this.redactionHolds.needed(key);
     if (harness === 'codex' && loaded.total_message_count > messages.length) coverage = { ...coverage, completeness: 'partial', reasons: [...new Set([...coverage.reasons, 'prefix_not_captured'])] };
     // A session published without its native bundle is captured again, with the same messages, once the bundle can be built.
     const nativeWanted=configuration.native_capture!==false&&backfillPolicy.mode==='all'&&typeof this.core.translateSession==='function'&&!((artifactBefore?.size??0)>NATIVE_MAX_BYTES);
     const retryNative=Boolean(previous?.native_deferred&&nativeWanted&&artifactBefore?.isFile()&&!previous?.baseline&&this.nativeReady(key,artifactBefore));
     const unchanged=previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&digestOf(message)===previous.observed_digests?.[index]);
-    if(unchanged&&!retryNative){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);await this.publishSessionProfile(key);return null;}
+    if(unchanged&&!retryNative&&!recapturing){requireRedactionBasis(basis);this.origins[key]={...previous,redaction_basis:checkedRedactionBasis(basis)};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);await this.publishSessionProfile(key);return null;}
     let effectivePrevious=previous;const clearBaseline=backfillPolicy.mode==='all';
     // A `none` rule keeps back the history recorded before it became active (the server's capture_after), not
     // whatever a session holds when first seen: a session begun after the rule is published from its first message.
@@ -1172,7 +1229,7 @@ export class TeamsConnector {
     const begin={native_session_id:nativeSessionId,harness,generation,sequence,capture_id:captureId,previous_digest:effectivePrevious?.digest??null,visibility,rule_id:ruleId,rule_revision:ruleRevision};
     // Only what the server does not hold goes over the wire: the longest prefix this source last committed unchanged
     // (the outbox is empty here, so that is the session's current version) is named by its digest, not sent again.
-    const carried=this.carriedPrefix(effectivePrevious,messages,{ruleRevision,backfillMode:backfillPolicy.mode,clearBaseline});
+    const carried=recapturing?0:this.carriedPrefix(effectivePrevious,messages,{ruleRevision,backfillMode:backfillPolicy.mode,clearBaseline});
     if(carried)begin.carry={count:carried,digest:carryDigest(messages.slice(0,carried))};
     const sent=carried?messages.slice(carried):messages;
     const parts=captureParts(captureId,sent);
@@ -1199,9 +1256,9 @@ export class TeamsConnector {
         // translated for this capture alone: its spilled files live while the capture is queued (outbox-only)
         try{
           const translated=(await this.core.translateSession({locator,target_harness:harness},{timeoutMs:translateTimeoutMs})).artifact;
-          if(fileStamp(statSync(artifactSource))===onDisk)bundle={stamp:onDisk,...await this.spillTranslated(translated,basename(artifactSource))};
+          if(fileStamp(statSync(artifactSource))===onDisk)bundle={stamp:onDisk,...await this.spillTranslated(translated,basename(artifactSource),basis)};
         }catch(error){
-          if(this.abort.signal.aborted)throw error;
+          if(this.abort.signal.aborted||['redaction_basis_changed','custody_unreadable'].includes(error?.code))throw error;
           this.lastError=error;process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} published without its native bundle: ${error.message}\n`);
           // The same file is not translated again; a write to it clears this.
           if(this.sessionLive(key,ruleId,epoch)){this.state.native_failed[key]=onDisk;this.save();}
@@ -1211,17 +1268,21 @@ export class TeamsConnector {
       if(bundle&&fileStamp(statSync(artifactSource))!==onDisk)bundle=null;
       if(bundle)({artifacts,nativeBundle}=this.bundleArtifacts(bundle,harness));else nativeDeferred=true;
       // A retry that still has no bundle would republish the same messages for nothing.
-      if(unchanged&&!nativeBundle){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);this.armNativeIdle(key);return null;}
+      if(unchanged&&!nativeBundle&&!recapturing){requireRedactionBasis(basis);this.origins[key]={...previous,redaction_basis:checkedRedactionBasis(basis)};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);this.armNativeIdle(key);return null;}
     }else if(sqliteSource&&nativeWanted&&!effectivePrevious?.baseline){
       const translated=(await this.core.translateSession({locator,target_harness:harness},{timeoutMs:translateTimeoutMs})).artifact;
       const digest=entries=>hash(canonicalJson((entries.messages??entries.turns??[]).map(entry=>entry.value??entry)));if(digest(await this.core.session(locator).load())!==digest(loaded))throw Object.assign(new Error('native session changed while it was being captured'),{code:'resync_required'});
-      ({artifacts,nativeBundle}=this.bundleArtifacts(await this.spillTranslated(translated,`${nativeSessionId}.json`),harness));
+      ({artifacts,nativeBundle}=this.bundleArtifacts(await this.spillTranslated(translated,`${nativeSessionId}.json`,basis),harness));
     }
-    const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',title:descriptor?.title??null,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
+    // Descriptive metadata shares the capture's custody snapshot too. Structural identifiers cannot be rewritten;
+    // the request guard refuses them if they themselves contain a custody value.
+    this.redactor??=new Redactor();const [metadata]=await this.redactor.run('values',[{title:descriptor?.title??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage}],{basis,fresh:true});
+    const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',...metadata,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
     const digestCommit={...commit};delete digestCommit.digest;commit.digest=hash(canonicalJson({begin,parts,commit:digestCommit}));
     // A session gone or no longer covered while it loaded queues nothing (its spilled bundle, held by nothing, goes at the next start).
     if(!this.sessionLive(key,ruleId,epoch))return null;
-    this.queue({begin,parts,commit,artifacts,windowStart:anchor,clearBaseline,backfillMode:backfillPolicy.mode,stamp,nativeDeferred,observed:{keys:loadedMessages.map(message=>message.native_key),digests:loadedMessages.map(digestOf)},redactionBasis:basis});this.save();const receipt=await this.flushSerial();await this.publishSessionProfile(key);return receipt;
+    requireRedactionBasis(basis);
+    this.queue({begin,parts,commit,artifacts,windowStart:anchor,clearBaseline,backfillMode:backfillPolicy.mode,stamp,nativeDeferred,observed:{keys:loadedMessages.map(message=>message.native_key),digests:loadedMessages.map(digestOf)},redactionBasis:checkedRedactionBasis(basis)});this.save();const receipt=await this.flushSerial();await this.publishSessionProfile(key);return receipt;
   }
   /**
    * One session's oldest observation published. A session Teams refused (lineage not declared yet, or any error) is
@@ -1318,13 +1379,13 @@ export class TeamsConnector {
    */
   scheduleFlush(error){
     if(this.flushTimer||this.abort.signal.aborted||(!this.outbox.length&&!this.owed?.size))return;
-    if(this.flushBackoff==null)process.stderr.write(`supercode teams: ${this.outbox.length} queued capture(s) and ${this.owed?.size??0} session capture(s) wait for the server (${error?.message??'not sent'}); tried again with backoff\n`);
+    if(this.flushBackoff==null)process.stderr.write(`supercode teams: ${this.outbox.length} queued capture(s) and ${this.owed?.size??0} session capture(s) wait to retry (${error?.message??'not sent'}); tried again with backoff\n`);
     this.flushBackoff=Math.min(300000,(this.flushBackoff??2500)*2);
     this.flushTimer=setTimeout(()=>{this.flushTimer=null;void this.flush().catch(failure=>{this.lastError=failure;this.scheduleFlush(failure);});},this.flushBackoff);this.flushTimer.unref?.();
   }
   /**
-   * A capture that failed on the connection, wherever it ran (a pass, a floor's wake, a large lane): its session's
-   * capture is owed until a flush passes (it may have failed before it was queued), and the outbox's wake is armed
+   * A capture that failed on the connection or a changed redaction basis, wherever it ran (a pass, a floor's wake,
+   * a large lane): its session's capture is owed until a flush passes (it may have failed before it was queued), and the wake is armed
    * for it even when nothing is queued.
    */
   oweCapture(options,error){
@@ -1341,7 +1402,7 @@ export class TeamsConnector {
   async flushSerial(){
     let receipt;
     try{receipt=await this.flushOutbox();}catch(error){throw Object.assign(error,{outbox:true});}
-    // the connection answers again: every session whose capture failed on it is captured now
+    // Every owed session is re-read, including one whose redaction basis changed before queueing.
     if(this.owed?.size){const owed=[...this.owed];this.owed.clear();for(const key of owed)this.resee(key);}
     return receipt;
   }
@@ -1405,19 +1466,19 @@ export class TeamsConnector {
     item.commit={...item.commit,capture_id:captureId,parts:item.parts.length};
     const digestCommit={...item.commit};delete digestCommit.digest;item.commit.digest=hash(canonicalJson({begin:item.begin,parts:item.parts,commit:digestCommit}));this.rewriteQueued(item);this.save();
   }
-  async sendCapture(item){const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);if(begun.state==='committed')return begun.receipt;for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);
+  async sendCapture(item){const request=(method,path,body)=>this.request(method,path,body,{beforeTransfer:json=>this.guardCaptureTransfer(item,json)});const begun=await request('POST',`/sources/${this.sourceId}/captures`,item.begin);if(begun.state==='committed')return begun.receipt;for(const part of item.parts)await request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);
     // A capture queued by an older connector holds its chunks inline; a current one reads them from its spill file.
     for(const artifact of item.artifacts??[])for(const chunk of artifact.spill?this.spilledChunks(artifact):artifact.chunks){
       if(!chunk)throw Object.assign(new Error('a spilled native artifact changed on disk while it was sent'),{code:'resync_required'});
       const path=`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`;
       let reused=false;
       if(this.chunkReuse!==false)try{
-        await this.request('PUT',path,{upload_id:chunk.upload_id,index:chunk.index,sha256:chunk.sha256,reuse:true});reused=true;this.chunkReuse=true;
+        await request('PUT',path,{upload_id:chunk.upload_id,index:chunk.index,sha256:chunk.sha256,reuse:true});reused=true;this.chunkReuse=true;
       }catch(error){
         if(error.code==='invalid_request'&&error.status===400)this.chunkReuse=false; // older server
         else if(error.code!=='chunk_missing')throw error;
       }
-      if(!reused)await this.request('PUT',path,chunk);
+      if(!reused)await request('PUT',path,chunk);
       this.state.native_transfer??={sent_bytes:0,reused_bytes:0,chunks:0};
       this.state.native_transfer[reused?'reused_bytes':'sent_bytes']+=Buffer.byteLength(chunk.bytes_base64,'base64');
       this.state.native_transfer.chunks++;
@@ -1428,7 +1489,7 @@ export class TeamsConnector {
       transfer.chunks++;transfer.at=this.clock.nowMs();
       for(const expired of Object.keys(transfers).sort((a,b)=>transfers[b].at-transfers[a].at).slice(128))delete transfers[expired];
     }
-    const receipt=await this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);
+    const receipt=await request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);
     const transfer=this.state.native_transfers?.[`${item.begin.harness}:${item.begin.native_session_id}`];
     if(transfer&&item.artifacts?.length){transfer.captures++;transfer.last_bundle_bytes=item.commit.artifacts.reduce((sum,a)=>sum+a.byte_length,0);}
     return receipt;}
@@ -1443,15 +1504,33 @@ export class TeamsConnector {
     if(!Array.isArray(configuration?.rules))return false;
     return !configuration.rules.some(rule=>rule.id===item.begin.rule_id&&rule.revision===item.begin.rule_revision&&rule.state==='active');
   }
-  async flushOutbox(){let latest=null;while(this.outbox.length){const item=this.outbox[0];let receipt;this.dropLostArtifacts(item);this.refitParts(item);try{receipt=await this.sendCapture(item);}catch(error){if(error.code==='storage_pressure'&&this.deferNativeUnderPressure(item))continue;if(error.status===409&&error.code==='carry_mismatch'){const key=`${item.begin.harness}:${item.begin.native_session_id}`;this.lastError=error;process.stderr.write(`supercode teams: the server does not hold what a capture of ${item.begin.harness} session ${item.begin.native_session_id} carried; it is sent whole again\n`);this.unqueue();if(this.origins[key])this.origins[key]={...this.origins[key],observed_keys:[],observed_digests:[],carry_refused:true,capture_stamps:{}};this.save();this.resee(key);continue;}if(error.status===409&&error.code==='batch_gap'&&error.details&&Number.isSafeInteger(error.details.sequence)){
+  async flushOutbox(){let latest=null;while(this.outbox.length){const item=this.outbox[0];let receipt;try{this.requireCaptureTransfer(item);this.dropLostArtifacts(item);this.refitParts(item);receipt=await this.sendCapture(item);}catch(error){
+        // A failed request may have awaited long enough to observe a different policy. Retain its whole original
+        // before an existing server-error branch can drop a part, native reference or queued item.
+        if(!['redaction_basis_changed','redaction_capture_unsafe'].includes(error.code))try{this.requireCaptureTransfer(item);}catch(changed){error=changed;}
+        if(['redaction_basis_changed','redaction_capture_unsafe'].includes(error.code)){this.holdQueuedCapture(item,error);continue;}
+        if(error.code==='storage_pressure'&&this.deferNativeUnderPressure(item))continue;
+        if(error.status===409&&error.code==='carry_mismatch'){const key=`${item.begin.harness}:${item.begin.native_session_id}`;this.lastError=error;process.stderr.write(`supercode teams: the server does not hold what a capture of ${item.begin.harness} session ${item.begin.native_session_id} carried; it is sent whole again\n`);this.unqueue();if(this.origins[key])this.origins[key]={...this.origins[key],observed_keys:[],observed_digests:[],carry_refused:true,capture_stamps:{}};this.save();this.resee(key);continue;}if(error.status===409&&error.code==='batch_gap'&&error.details&&Number.isSafeInteger(error.details.sequence)){
           // The server holds a different last capture of this session than this connector recorded (a capture it
           // committed while the connector stopped before recording it, for one): this connector takes the server's
           // revision, drops the stale capture and sends the session whole again at once (resee).
           const key=`${item.begin.harness}:${item.begin.native_session_id}`,expected=error.details;this.lastError=error;
           process.stderr.write(`supercode teams: ${item.begin.harness} session ${item.begin.native_session_id} resumes at the server's revision ${expected.generation}/${expected.sequence}; it is sent whole again\n`);
           this.unqueue();this.origins[key]={...this.origins[key],generation:expected.generation,sequence:expected.sequence-1,digest:expected.digest??null,observed_keys:[],observed_digests:[],carry_refused:true,capture_stamps:{}};this.save();this.resee(key);continue;}
-        if(error.status===400&&error.code==='invalid_request'||error.status===413){this.lastError=error;this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id??null},error);(this.droppedCaptures??=new Set()).add(`${item.begin.harness}:${item.begin.native_session_id}`);if(error.status===413)(this.state.set_aside??={})[`${item.begin.harness}:${item.begin.native_session_id}`]={at:this.clock.nowMs(),rule_revision:item.begin.rule_revision??null,reason:error.message};process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id} the server refused${error.status===413?' (one message is larger than a request may be)':' as malformed'}: ${error.message}\n`);this.unqueue();this.save();continue;}if(!await this.ruleRejected(item,error))throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.unqueue();this.save();continue;}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,redaction_basis:item.redactionBasis??null,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.nativeDeferred)next.native_deferred=true;else delete next.native_deferred;if(item.windowStart)next.window_start=item.windowStart;else delete next.window_start;if(!item.begin.carry)delete next.carry_refused;if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.origins[key]=next;this.unqueue();this.save();// A queued capture is often flushed by another session's capture: its own session's problem ends with it.
-this.clearSessionProblem(item.begin.harness,item.begin.native_session_id);
+        if(error.status===400&&error.code==='invalid_request'||error.status===413){this.lastError=error;this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id??null},error);(this.droppedCaptures??=new Set()).add(`${item.begin.harness}:${item.begin.native_session_id}`);if(error.status===413)(this.state.set_aside??={})[`${item.begin.harness}:${item.begin.native_session_id}`]={at:this.clock.nowMs(),rule_revision:item.begin.rule_revision??null,reason:error.message};process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id} the server refused${error.status===413?' (one message is larger than a request may be)':' as malformed'}: ${error.message}\n`);this.unqueue();this.save();continue;}
+        const rejected=await this.ruleRejected(item,error);
+        try{this.requireCaptureTransfer(item);}catch(changed){if(['redaction_basis_changed','redaction_capture_unsafe'].includes(changed.code)){this.holdQueuedCapture(item,changed);continue;}throw changed;}
+        if(!rejected)throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.unqueue();this.save();continue;}
+      // A commit already issued may finish after custody changes. Its receipt advances the origin, but its local
+      // original remains held and owed; registration gives this source no authority to purge the published revision.
+      let current=true;
+      try{this.requireCaptureTransfer(item);}catch(error){if(!['redaction_basis_changed','redaction_capture_unsafe'].includes(error.code))throw error;this.holdQueuedCapture(item,error);current=false;}
+      const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,redaction_basis:item.redactionBasis??null,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.nativeDeferred)next.native_deferred=true;else delete next.native_deferred;if(item.windowStart)next.window_start=item.windowStart;else delete next.window_start;if(!item.begin.carry)delete next.carry_refused;if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.origins[key]=next;
+      if(current){
+        if(receipt?.capture_id===item.begin.capture_id&&receipt.digest===item.commit.digest)this.redactionHolds.settle(key,item,receipt,names=>this.releaseSpills(names));
+        this.updateRedactionHolds();this.unqueue();this.clearSessionProblem(item.begin.harness,item.begin.native_session_id);
+      }
+      this.save();
       // The commit is what records (or settles) a native bundle still owed: its wait is armed here.
       this.armNativeIdle(key);latest=receipt;}this.flushBackoff=null;return latest;}
   stop(){void this.redactor?.close();this.daemon?.off?.('sessionActivityEvent',this.activityEvent);this.daemon?.off?.('sessionIndexEvent',this.indexEvent);this.daemon?.off?.('exit',this.daemonExit);clearTimeout(this.flushTimer);if(this.activitySubscription)void this.daemon?.unsubscribeSessionActivity?.(this.activitySubscription).catch(()=>{});for(const feed of this.feeds?.values()??[])void this.daemon?.unsubscribeSessionIndex?.(feed.subscription).catch(()=>{});for(const timer of this.idleTimers?.values()??[])clearTimeout(timer);try{this.flushState();}catch{}if(this.timer)clearInterval(this.timer);if(this.heartbeatTimer)clearInterval(this.heartbeatTimer);this.abort.abort();return this.nativeEffects.close();}

package/connector/redaction-holds.mjs

@@ -0,0 +1,59 @@
+// Stale captures stay on this machine while a fresh source observation replaces them. Only headers stay in memory;
+// the original parts and artifact references remain in owner-only files and are never a send queue.
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+
+export class RedactionHolds {
+  constructor({ stateDir, atomic, saved = {} }) {
+    this.directory = join(stateDir, 'redaction-held'); this.outbox = join(stateDir, 'outbox');
+    this.atomic = atomic; this.items = new Map(); this.unread = [];
+    mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+    for (const name of readdirSync(this.directory).filter(name => /^\d+\.json$/.test(name)).sort()) {
+      try {
+        const item = JSON.parse(readFileSync(join(this.directory, name), 'utf8'));
+        const header = this.header(item, name), prior = saved[name];
+        if (prior?.capture_id === header.capture_id && ['native_owed', 'cleanup', 'blocked'].includes(prior.state)) Object.assign(header, { state: prior.state, replacement: prior.replacement });
+        this.items.set(name, header);
+      } catch (error) { this.unread.push({ name, error: error?.code ?? 'unreadable_hold' }); }
+    }
+  }
+
+  header(item, name) {
+    return { name, capture_id: item.begin.capture_id, key: `${item.begin.harness}:${item.begin.native_session_id}`,
+      harness: item.begin.harness, session_id: item.begin.native_session_id, rule_id: item.begin.rule_id,
+      rule_revision: item.begin.rule_revision, at: item.redaction_hold?.at ?? null, state: item.redaction_hold?.code==='redaction_capture_unsafe'?'blocked':'owed',
+      stamp: item.stamp??null, basis: item.redactionBasis, code: item.redaction_hold?.code??'redaction_basis_changed',
+      native: Boolean(item.artifacts?.length || item.nativeDeferred),
+      spills: (item.artifacts ?? []).filter(artifact => artifact.spill).map(artifact => artifact.spill.file) };
+  }
+
+  hold(item, name, at, code) {
+    // Persist the no-send flag before moving: a crash between these steps restarts with a flagged outbox item, which
+    // the transfer guard also refuses. The move transfers its spill ownership; it must not release any references.
+    item.redaction_hold = { at, code };
+    this.atomic(join(this.outbox, name), JSON.stringify(item));
+    if(existsSync(join(this.directory,name)))throw new Error('a custody-held capture already owns this filename; original outbox item retained');
+    renameSync(join(this.outbox, name), join(this.directory, name));
+    this.items.set(name, this.header(item, name));
+  }
+
+  needed(key) { return [...this.items.values()].some(item => item.key === key && ['owed','blocked'].includes(item.state)); }
+  blocked(key, stamp, revision, basis) { return [...this.items.values()].some(item => item.key === key && item.state === 'blocked' && item.stamp === stamp && item.rule_revision === revision && item.basis === basis); }
+  spills() { return [...this.items.values()].flatMap(item => item.spills); }
+  saved() { return Object.fromEntries(this.items); }
+  status() { return [...this.items.values()].map(({ capture_id, harness, session_id, rule_id, at, state, replacement }) => ({ capture_id, harness, session_id, rule_id, at, state, replacement })); }
+
+  settle(key, capture, receipt, releaseSpills) {
+    for (const [name, held] of this.items) {
+      if (held.key !== key || held.rule_id !== capture.begin.rule_id || held.rule_revision !== capture.begin.rule_revision) continue;
+      if(capture.begin.carry&&['owed','blocked'].includes(held.state))continue;
+      held.replacement = receipt.capture_id;
+      // A receipt for messages alone does not discharge a held native bundle. The normal native-deferred retry
+      // remains owed; its original files stay held until a replacement artifact is acknowledged too.
+      if (held.native && !(capture.artifacts?.length)) { held.state = 'native_owed'; continue; }
+      try { unlinkSync(join(this.directory, name)); }
+      catch (error) { if (error?.code !== 'ENOENT') { held.state = 'cleanup'; continue; } }
+      this.items.delete(name); releaseSpills(held.spills);
+    }
+  }
+}

package/connector/redactor.mjs

@@ -4,26 +4,40 @@
 import { Worker, isMainThread, parentPort } from 'node:worker_threads';
 
 if (!isMainThread && parentPort) {
-  const { redactText, redactValue } = await import('@volter/teams/redact');
+  const { redactText, redactValue, redactionBasis, redactionSnapshot } = await import('@volter/teams/redact');
   const { canonicalJson } = await import('../contracts/index.mjs');
   const { createHash } = await import('node:crypto');
   // 'canonical': each item is a message value's canonical JSON (the connector has it already, for its digest), a string
   // copied to this thread for little more than its bytes, where a value's object graph costs the connector's thread a
   // walk each way. Only what redaction changed comes back, with its new digest.
-  const changedOf = (items) => {
+  const changedOf = (items, custody) => {
     const changed = [];
     items.forEach((text, index) => {
-      const value = redactValue(JSON.parse(text)), sent = canonicalJson(value);
+      const value = redactValue(JSON.parse(text), undefined, custody), sent = canonicalJson(value);
       if (sent !== text) changed.push({ index, value, digest: createHash('sha256').update(sent).digest('hex') });
     });
     return changed;
   };
   const { performance } = await import('node:perf_hooks');
-  parentPort.on('message', ({ id, kind, items }) => {
+  const holdsCustody = (value, custody) => {
+    if (typeof value === 'string') return custody.some(({ value: secret }) => value.includes(secret));
+    if (Array.isArray(value)) return value.some((item) => holdsCustody(item, custody));
+    return value && typeof value === 'object' && Object.entries(value).some(([key, item]) => holdsCustody(key, custody) || holdsCustody(item, custody));
+  };
+  parentPort.on('message', ({ id, kind, items, basis, fresh }) => {
     // Its own busy time rides back with each answer: what redaction costs, apart from the connector's other work.
     const started = performance.now();
-    try { const answer = kind === 'canonical' ? changedOf(items) : items.map((item) => (kind === 'texts' ? redactText(item) : redactValue(item))); parentPort.postMessage({ id, items: answer, busy: performance.now() - started }); }
-    catch (error) { parentPort.postMessage({ id, error: String(error?.message ?? error) }); }
+    const requireBasis=()=>{if(basis!==undefined&&redactionBasis(undefined,{fresh})!==basis)throw Object.assign(new Error('redaction worker basis differs from the capture; capture needs fresh redaction'),{code:'redaction_basis_changed'});};
+    try {
+      // All strings in this checked batch use the same custody observation, even if a batch crosses its refresh interval.
+      const snapshot=basis===undefined?null:redactionSnapshot(undefined,{fresh});
+      if(snapshot&&snapshot.basis!==basis)throw Object.assign(new Error('redaction worker basis differs from the capture; capture needs fresh redaction'),{code:'redaction_basis_changed'});
+      requireBasis();
+      if(kind==='custody_assert'&&(!snapshot||items.some(text=>holdsCustody(JSON.parse(text),snapshot.values))))throw Object.assign(new Error('capture still contains a registered custody value; fresh capture required'),{code:'redaction_capture_unsafe'});
+      const answer = kind === 'custody_assert' ? [] : kind === 'canonical' ? changedOf(items,snapshot?.values) : items.map((item) => (kind === 'texts' ? redactText(item,undefined,snapshot?.values) : redactValue(item,undefined,snapshot?.values)));
+      requireBasis();
+      parentPort.postMessage({ id, items: answer, busy: performance.now() - started });
+    } catch (error) { parentPort.postMessage({ id, error: String(error?.message ?? error), code: error?.code }); }
   });
 }
 
@@ -33,11 +47,11 @@ export class Redactor {
   start() {
     // The connector's own node flags are not the worker's (one meant for the entry script refuses to start it).
     const worker = new Worker(new URL(import.meta.url), { execArgv: [] });
-    worker.on('message', ({ id, items, error, busy }) => {
+    worker.on('message', ({ id, items, error, code, busy }) => {
       const waiter = this.waiting.get(id); if (!waiter) return;
       this.waiting.delete(id);
       this.workerMs += busy ?? 0;
-      if (error) waiter.reject(Object.assign(new Error(`redaction failed: ${error}`), { code: 'redaction_failed' }));
+      if (error) waiter.reject(Object.assign(new Error(`redaction failed: ${error}`), { code: ['redaction_basis_changed','redaction_capture_unsafe','custody_unreadable'].includes(code) ? code : 'redaction_failed' }));
       else waiter.resolve(items);
       if (!this.waiting.size) worker.unref();
     });
@@ -54,13 +68,15 @@ export class Redactor {
   }
 
   /** `items` redacted, in order: `kind` 'values' (JSON values, every string in them) or 'texts'; for 'canonical' (canonical
-   *  JSON texts) only the changed ones, as `{ index, value, digest }`. */
-  run(kind, items) {
+   *  JSON texts) only the changed ones, as `{ index, value, digest }`. An optional basis must match the worker before
+   *  and after redaction; a mismatch rejects the request rather than returning stale decisions. `custody_assert`
+   *  accepts serialized request bodies and refuses a custody value anywhere in their parsed strings or keys. */
+  run(kind, items, { basis, fresh = false } = {}) {
     if (!items.length) return Promise.resolve([]);
     if (!this.worker) this.start();
     const id = this.next++;
     this.worker.ref();
-    return new Promise((resolve, reject) => { this.waiting.set(id, { resolve, reject }); this.worker.postMessage({ id, kind, items }); });
+    return new Promise((resolve, reject) => { this.waiting.set(id, { resolve, reject }); this.worker.postMessage({ id, kind, items, basis, fresh }); });
   }
 
   close() { const worker = this.worker; this.worker = null; return worker ? worker.terminate().then(() => {}) : Promise.resolve(); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.157",
+  "version": "0.3.159",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -75,7 +75,7 @@
     "@volter/supercode-health": "^0.1.0",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/supercode-trace": "^0.1.0",
-    "@volter/teams": "0.2.42",
+    "@volter/teams": "0.2.44",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",