@volter/supercode-teams 0.3.158 → 0.3.160

package/README.md

@@ -70,10 +70,23 @@ does not attribute the observed process peak or claim a measured runtime improve
 Memo entries are discarded when the observed custody/rules basis changes. A
 capture and its worker use one matching custody snapshot; a basis mismatch
 rejects the capture before queueing and leaves it owed for retry. Older basis
-labels cannot authorize held-digest reuse. Custody still refreshes on its existing
-30-second interval; queued and published captures are not retroactively redacted.
+labels cannot authorize held-digest reuse.
 [Source boundary and qualification](../../docs/evidence/connector-redaction-basis-2026-10-08.md).
 
+Session captures reread the custody registry and declared files before each
+transfer, including rate-limit retries. A stale queued capture is retained
+locally and replaced by a fresh full capture; its carried prefix, parts and
+native references are not reused. Original artifact files stay held until a
+replacement commit acknowledges the native bundle too. Other queued sessions
+can proceed. `supercode teams status` and `supercode auth status` show the holds
+and explain that registration does not purge already transferred or published
+data. A Teams administrator uses `TeamsClient.purgeSessionText` / `POST
+/api/v1/teams/:team/sessions/purge` for retrospective session-text cleanup.
+Direct writes after the last check and requests already in flight have **no
+bounded exposure time**. This is capture-transfer source behavior, with runtime
+and single-machine qualification still open.
+[Transfer scope and retained obligations](../../docs/evidence/connector-custody-egress-2026-10-08.md).
+
 `supercode teams rpc mail.statistics` reads local storage counts and import/retention receipts. It is refused remotely
 and through the app door. Writer groups count stored envelope copies, not call attempts or quotas; database page
 counts exclude physical WAL size. Successful imports record their actual source reads, bytes, batch sizes and time.

package/bin/workspace/sync-status.mjs

@@ -8,6 +8,15 @@ const reason = item => `${item.code ? `${item.code}: ` : ''}${item.message}`;
 export function syncStatusLines(sync, { indent = '  ' } = {}) {
   if (!sync) return [];
   const lines = [];
+  if(sync.custody_notice)lines.push(`Custody  ${sync.custody_notice}`);
+  const holds=sync.redaction_held??[];
+  if(holds.length){
+    lines.push(`Custody holds (${holds.length} capture${holds.length===1?'':'s'} retained locally):`);
+    const labels={owed:'fresh full capture owed',native_owed:'replacement native bundle owed',blocked:'payload refused; waiting for source, rule or custody change',cleanup:'replacement committed; local cleanup pending'};
+    for(const item of holds.slice(0,SHOWN))lines.push(`${indent}${item.harness} ${item.session_id} · ${item.capture_id} · ${when(item.at)} · ${labels[item.state]??item.state}${item.replacement?` · replacement ${item.replacement}`:''}`);
+    if(holds.length>SHOWN)lines.push(`${indent}… and ${holds.length-SHOWN} more (--json lists them all)`);
+  }
+  if(sync.redaction_held_unread?.length)lines.push(`Custody holds unread (${sync.redaction_held_unread.length}); original files and all artifact spills retained, inspect --json`);
   const problems = sync.not_syncing ?? [];
   if (problems.length) {
     lines.push(`Not syncing (${problems.length} session${problems.length === 1 ? '' : 's'}, most recent first):`);

package/bin/workspace.mjs

@@ -402,9 +402,9 @@ async function authCommand({ flags, sub = 'status', rest, home, contexts, output
     if (!account.context) return say(account.others.length ? `Team     none current · saved: ${account.others.join(', ')} (supercode auth switch NAME)` : 'Team     none (supercode login)');
     say(`Team     ${account.team} · ${new URL(account.origin).host}${account.reachable ? '' : ' · unreachable'}${account.others.length ? ` · also: ${account.others.join(', ')} (supercode auth switch)` : ''}`);
     say(account.machine ? `Machine  ${account.machine.name} · ${account.machine.connection ?? 'unknown'} · sharing ${account.machine.folder ?? '?'}${account.machine.service ? ` (${account.machine.service})` : ' (runs while `teams connect` does)'}` : 'Machine  not connected (supercode teams connect)');
-    // Only trouble (a session not syncing, an error in the last day) is worth lines here; `teams status` shows the rest.
+    // Custody's published-history boundary is part of account status even without a failed capture.
     const sync = account.machine?.sync;
-    if (sync?.not_syncing.length || sync?.not_bound?.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
+    if (sync?.custody_notice || sync?.not_syncing.length || sync?.not_bound?.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
     return;
   }
   if (sub === 'switch') {

package/connector/index.d.ts

@@ -65,8 +65,9 @@ export interface ConnectorConfigurationValue {
 
 export interface SyncErrorSummary { code: string | null; message: string; at: number }
 export interface SyncProblem extends SyncErrorSummary { harness: string; session_id: string; rule_id: string | null }
+export interface RedactionHoldStatus { capture_id: string; harness: string; session_id: string; rule_id: string | null; at: number | null; state: 'owed' | 'native_owed' | 'blocked' | 'cleanup'; replacement?: string }
 /** What `supercode teams status` shows: sessions not syncing (most recent first) and the last error; null without state. */
-export declare function readSyncStatus(stateDir: string): { not_syncing: SyncProblem[]; not_bound: { harness: string; session_id: string; reason: string }[]; not_bound_count: number; last_error: SyncErrorSummary | null; queued_captures: number } | null;
+export declare function readSyncStatus(stateDir: string): { custody_notice: string; redaction_held: RedactionHoldStatus[]; redaction_held_unread: { name: string; error: string }[]; not_syncing: SyncProblem[]; not_bound: { harness: string; session_id: string; reason: string }[]; not_bound_count: number; last_error: SyncErrorSummary | null; queued_captures: number } | null;
 
 export declare class TeamsConnector {
   constructor(options: TeamsConnectorOptions);

package/connector/index.mjs

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, writeFileSync, renameSync, existsSync, chmodSy
 import { realpathSync } from './path.mjs';
 import { redactionBasis } from '@volter/teams/redact';
 import { Redactor } from './redactor.mjs';
+import { RedactionHolds } from './redaction-holds.mjs';
 import { basename, dirname, join, sep } from 'node:path';
 
 /** A path in its real form: its nearest existing ancestor resolved (a file inside a folder this process may not read is
@@ -46,8 +47,9 @@ const covers=(root,cwd)=>{
 };
 // An error of the connection itself (the outbox, authentication, the server), not of one session.
 const connectionError=error=>Boolean(error?.outbox||error?.status===401||error?.status===403||error?.status>=500);
-const retryCapture=error=>connectionError(error)||error?.code==='redaction_basis_changed';
+const retryCapture=error=>connectionError(error)||['redaction_basis_changed','custody_unreadable'].includes(error?.code);
 const sameError=(a,b)=>a!=null&&b!=null&&a.code===b.code&&a.message===b.message;
+const CUSTODY_NOTICE='Custody registration does not purge data already transferred or published. A Teams administrator can purge session text through POST /api/v1/teams/:team/sessions/purge (TeamsClient.purgeSessionText). A direct file edit after the last transfer check, or a request already in flight, has no bounded exposure time.';
 const errorSummary=(error,at)=>error==null?null:{code:typeof error.code==='string'?error.code:null,message:String(error.message??error).slice(0,500),at};
 /** The sync status a connector keeps in its state directory (see TeamsConnector#syncStatus); null when it has none. */
 export function readSyncStatus(stateDir){
@@ -55,7 +57,7 @@ export function readSyncStatus(stateDir){
   const status=state?.sync_status;
   // Sessions this machine could not bind to the agent their launch named (bindAgentSessions): waiting, or refused for good.
   const agentSessions=Object.entries(state?.agent_sessions??{}).filter(([,item])=>item?.state==='pending'||item?.state==='refused').map(([session,item])=>({session,agent:item.agent,state:item.state,reason:item.error?.message??null}));
-  return {agent_sessions_unbound:agentSessions,index_unread:Object.values(status?.index_unread??{}).flat(),not_syncing:Array.isArray(status?.problems)?status.problems:[],not_bound:Array.isArray(status?.unbound)?status.unbound:[],not_bound_count:Number.isSafeInteger(status?.unbound_count)?status.unbound_count:(Array.isArray(status?.unbound)?status.unbound.length:0),last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:(()=>{try{return readdirSync(join(stateDir,'outbox')).filter(name=>name.endsWith('.json')).length;}catch{return 0;}})()};
+  return {custody_notice:CUSTODY_NOTICE,redaction_held:status?.redaction_held??[],redaction_held_unread:status?.redaction_held_unread??[],agent_sessions_unbound:agentSessions,index_unread:Object.values(status?.index_unread??{}).flat(),not_syncing:Array.isArray(status?.problems)?status.problems:[],not_bound:Array.isArray(status?.unbound)?status.unbound:[],not_bound_count:Number.isSafeInteger(status?.unbound_count)?status.unbound_count:(Array.isArray(status?.unbound)?status.unbound.length:0),last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:(()=>{try{return readdirSync(join(stateDir,'outbox')).filter(name=>name.endsWith('.json')).length;}catch{return 0;}})()};
 }
 // A tool call still running when the core reads a session has no result yet; the core answers it with a synthesized
 // placeholder (crates/interchange session/helpers.rs ensure_tool_results_paired: a `tool` message for that call id,
@@ -93,11 +95,14 @@ const itemSpills=item=>(item.artifacts??[]).filter(artifact=>artifact.spill).map
  * folded state writes them out again (TeamsConnector#loadEntries).
  */
 export function foldConnectorState(stateDir){
+  if(existsSync(join(stateDir,'redaction-held'))&&readdirSync(join(stateDir,'redaction-held')).some(name=>/^\d+\.json$/.test(name)))throw new Error('retained custody captures prevent folding state for an older connector; resolve the visible redaction holds first');
   const path=join(stateDir,'connector.json'),state=JSON.parse(readFileSync(path,'utf8'));
   const origins=join(stateDir,'origins'),outbox=join(stateDir,'outbox'),files=dir=>existsSync(dir)?readdirSync(dir).filter(name=>name.endsWith('.json')).sort():[];
+  if(state.outbox?.some(item=>item.redaction_hold))throw new Error('a custody-flagged capture prevents folding state for an older connector');
   if(state.origins||state.outbox)return {origins:Object.keys(state.origins??{}).length,captures:(state.outbox??[]).length,folded:false};
   state.origins={};for(const name of files(origins)){const {key,origin}=JSON.parse(readFileSync(join(origins,name),'utf8'));state.origins[key]=origin;}
   state.outbox=files(outbox).map(name=>JSON.parse(readFileSync(join(outbox,name),'utf8')));delete state.outbox_sequence;
+  if(state.outbox.some(item=>item.redaction_hold))throw new Error('a custody-flagged capture prevents folding state for an older connector');
   atomic(path,JSON.stringify(state,null,2)+'\n');
   for(const dir of [origins,outbox])rmSync(dir,{recursive:true,force:true});
   return {origins:Object.keys(state.origins).length,captures:state.outbox.length,folded:true};
@@ -112,11 +117,12 @@ export function foldConnectorState(stateDir){
 const REDACTED_MEMO=200000,REDACTED_MEMO_BYTES=32*1024*1024,REDACTED_MEMO_ENTRY_BYTES=1024*1024;
 const redactions=new Map();
 let redactionBytes=0,redactionMemoBasis=null;
+const freshRedactionBasis=()=>redactionBasis(undefined,{fresh:true});
 function useRedactionMemo(basis){
   if(redactionMemoBasis!==basis){redactions.clear();redactionBytes=0;redactionMemoBasis=basis;}
 }
 function requireRedactionBasis(basis){
-  if(redactionBasis()!==basis)throw Object.assign(new Error('redaction basis changed; capture needs fresh redaction'),{code:'redaction_basis_changed'});
+  if(freshRedactionBasis()!==basis)throw Object.assign(new Error('redaction basis changed; capture needs fresh redaction'),{code:'redaction_basis_changed'});
 }
 // Older queued/committed captures could label a result with the basis read after its worker returned. They do not
 // establish the checked observation needed for held-digest reuse, even when that old label equals today's basis.
@@ -246,7 +252,7 @@ export class TeamsConnector {
       for(const dir of [origins,outbox])rmSync(dir,{recursive:true,force:true});
       for(const dir of [origins,outbox])mkdirSync(dir,{recursive:true,mode:0o700});
       for(const [key,origin] of Object.entries(this.state.origins??{}))atomic(join(origins,`${hash(key).slice(0,32)}.json`),JSON.stringify({key,origin}));
-      this.state.outbox_sequence=0;
+      this.state.outbox_sequence=existsSync(join(this.stateDir,'redaction-held'))?readdirSync(join(this.stateDir,'redaction-held')).filter(name=>/^\d+\.json$/.test(name)).reduce((sequence,name)=>Math.max(sequence,Number(name.slice(0,-5))),0):0;
       for(const item of this.state.outbox??[])atomic(join(outbox,`${String(++this.state.outbox_sequence).padStart(12,'0')}.json`),JSON.stringify(item));
       delete this.state.origins;delete this.state.outbox;atomic(this.statePath,JSON.stringify(this.state,null,2)+'\n');
     }
@@ -263,6 +269,9 @@ export class TeamsConnector {
     for(const name of readdirSync(outbox).filter(name=>name.endsWith('.json')).sort()){try{this.outbox.push(Object.assign(JSON.parse(readFileSync(join(outbox,name),'utf8')),{[QUEUED_FILE]:name}));}catch(error){this.outboxUnread.push({name,error:String(error?.message??error)});}}
     // the sequence is past every queued capture's name on disk, read or unread, so no new one takes an unread one's
     for(const name of readdirSync(outbox)){const n=Number(/^(\d+)\.json$/.exec(name)?.[1]);if(Number.isSafeInteger(n)&&n>(this.state.outbox_sequence??0))this.state.outbox_sequence=n;}
+    this.redactionHolds=new RedactionHolds({stateDir:this.stateDir,atomic,saved:this.state.redaction_holds});
+    for(const name of [...this.redactionHolds.items.keys(),...this.redactionHolds.unread.map(item=>item.name)]){const n=Number(name.slice(0,-5));if(Number.isSafeInteger(n)&&n>(this.state.outbox_sequence??0))this.state.outbox_sequence=n;}
+    this.updateRedactionHolds();
   }
   /**
    * Where a Codex rollout past the display window is read from: the origin's window_start while it holds (the same
@@ -291,6 +300,33 @@ export class TeamsConnector {
   // every beat does not rewrite connector.json every beat. Its time stays that of its first occurrence in the run.
   set lastError(error){this.lastErrorValue=error;const status=this.syncStatus(),summary=errorSummary(error,this.clock.nowMs());if(sameError(status.last_error,summary))return;status.last_error=summary;this.saveQuietly();}
   syncStatus(){const status=this.state.sync_status??={problems:[],last_error:null};status.problems??=[];return status;}
+  updateRedactionHolds(){
+    this.state.redaction_holds=this.redactionHolds.saved();
+    const status=this.syncStatus();status.redaction_held=this.redactionHolds.status();status.redaction_held_unread=this.redactionHolds.unread;
+  }
+  observeCustodyBasis(){
+    const basis=freshRedactionBasis();
+    if(this.state.custody_basis!==basis){this.state.custody_basis=basis;process.stderr.write(`supercode teams: ${CUSTODY_NOTICE}\n`);this.saveQuietly();}
+    return basis;
+  }
+  requireCaptureTransfer(item){
+    const basis=this.observeCustodyBasis();
+    if(item.redaction_hold||item.redactionBasis!==checkedRedactionBasis(basis))throw Object.assign(new Error('queued capture needs fresh custody redaction; retained locally for fresh capture'),{code:item.redaction_hold?.code??'redaction_basis_changed'});
+    return basis;
+  }
+  async guardCaptureTransfer(item,json){
+    const basis=this.requireCaptureTransfer(item);
+    this.redactor??=new Redactor();
+    await this.redactor.run('custody_assert',[json],{basis,fresh:true});
+    // request invokes this synchronously after the worker answer, with no intervening await before fetch.
+    return ()=>this.requireCaptureTransfer(item);
+  }
+  holdQueuedCapture(item,error){
+    this.redactionHolds.hold(item,item[QUEUED_FILE],this.clock.nowMs(),error.code);
+    this.outbox.shift(); // Its spill references move to the hold; unqueue would release them.
+    this.updateRedactionHolds();this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id},error);
+    this.oweCapture({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id},error);this.save();
+  }
   saveQuietly(){try{this.save();}catch{}}
   noteSessionProblem({harness,nativeSessionId,ruleId=null},error){
     const status=this.syncStatus(),at=this.clock.nowMs(),summary=errorSummary(error,at);
@@ -305,7 +341,7 @@ export class TeamsConnector {
   clearSessionProblem(harness,nativeSessionId){
     const status=this.state.sync_status;if(!status?.problems?.some(item=>item.harness===harness&&item.session_id===nativeSessionId))return;
     status.problems=status.problems.filter(item=>!(item.harness===harness&&item.session_id===nativeSessionId));this.saveQuietly();
-  } async request(method,path,body){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);let response;for(let attempt=0;;attempt++){response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:AbortSignal.any([this.abort.signal, AbortSignal.timeout(30_000)])});
+  } async request(method,path,body,{beforeTransfer}={}){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);let response;for(let attempt=0;;attempt++){if(beforeTransfer){const finalCheck=await beforeTransfer(json);finalCheck();}response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:AbortSignal.any([this.abort.signal, AbortSignal.timeout(30_000)])});
     // A rate limit is waited out (the server says how long; the same idempotency key makes the retry safe), so a
     // large first sync slows down instead of failing its pass and restarting the connector.
     if(response.status!==429||attempt>=5)break;// The server names the wait in error.details (wire.mjs validationFailure); a Retry-After header is the fallback.
@@ -664,7 +700,9 @@ export class TeamsConnector {
     const {locator,descriptor,harness,nativeSessionId,ruleId,epoch}=options,key=`${harness}:${nativeSessionId}`;
     if(!this.sessionLive(key,ruleId,epoch))return;
     // A session whose store has not changed since this rule last committed it is in sync, whatever it last failed.
-    let captured=true;const changed=this.sessionChanged(options);if(!changed)this.clearSessionProblem(harness,nativeSessionId);
+    let captured=true,changed;
+    try{changed=this.sessionChanged(options);}catch(error){if(retryCapture(error))this.oweCapture(options,error);else this.noteSessionProblem(options,error);return;}
+    if(!changed)this.clearSessionProblem(harness,nativeSessionId);
     // A store this process may not read (macOS denies a launchd job a removable volume, whatever the owner granted the
     // terminal) is said once with its path and skipped.
     if(this.unreadable?.has(key))captured=false;
@@ -791,6 +829,9 @@ export class TeamsConnector {
   }
   sessionChanged(options){
     const stamp=this.sessionStamp(options);options.stamp=stamp;
+    const custodyKey=`${options.harness}:${options.nativeSessionId}`;
+    if(this.redactionHolds.items.size&&this.redactionHolds.blocked(custodyKey,stamp,options.ruleRevision,checkedRedactionBasis(this.observeCustodyBasis())))return false;
+    if(this.redactionHolds.needed(custodyKey))return true;
     if(stamp===null||this.outbox.length)return true;
     const rule=options.configuration?.rules?.find(item=>item.id===options.ruleId&&item.revision===options.ruleRevision&&item.state==='active');if(!rule)return true;
     const configured=rule.backfill??options.backfill??'all',mode=typeof configured==='string'?configured:configured.mode;
@@ -843,6 +884,7 @@ export class TeamsConnector {
     if(this.spillRefs)return this.spillRefs;
     const refs=this.spillRefs=new Map(),add=name=>refs.set(name,(refs.get(name)??0)+1);
     for(const item of this.outbox)for(const name of itemSpills(item))add(name);
+    for(const name of this.redactionHolds.spills())add(name);
     return refs;
   }
   retainSpills(names){const refs=this.spillHolders();for(const name of names){refs.set(name,(refs.get(name)??0)+1);this.freshSpills?.delete(name);}}
@@ -856,7 +898,7 @@ export class TeamsConnector {
    * whoever else held it. A file kept so is held by nothing counted and goes at the first start whose inventory is whole.
    */
   removeSpill(name){
-    if(this.outboxUnread?.length){this.spillProblem(`${name} was kept: ${this.outboxUnread.length} queued capture(s) could not be read and may name it`);return false;}
+    if(this.outboxUnread?.length||this.redactionHolds.unread.length){this.spillProblem(`${name} was kept: a queued or custody-held capture could not be read and may name it`);return false;}
     try{unlinkSync(join(this.spillDir(),name));return true;}
     catch(error){if(error?.code==='ENOENT')return true;this.spillProblem(`${name} could not be removed: ${error?.message??error}`);return false;}
   }
@@ -874,9 +916,9 @@ export class TeamsConnector {
   removeUnheldSpills(){
     const status=this.syncStatus();delete status.spill_cleanup;
     // only against a complete inventory of the outbox: a queued capture this process could not read may name any file
-    if(this.outboxUnread.length){
+    if(this.outboxUnread.length||this.redactionHolds.unread.length){
       status.outbox_unread=this.outboxUnread.map(({name,error})=>`${name}: ${error}`);
-      this.spillProblem(`${this.outboxUnread.length} queued capture(s) could not be read (${this.outboxUnread[0].name}: ${this.outboxUnread[0].error}); no spill file is removed until every queued capture is read`);
+      this.spillProblem('a queued or custody-held capture could not be read; no spill file is removed until their inventory is complete');
       return;
     }
     delete status.outbox_unread;
@@ -901,7 +943,7 @@ export class TeamsConnector {
   // Each loaded message in the form sent: the memo's; the loaded one itself when the server holds it unchanged under
   // this redaction basis (its digest is among those last observed); else what the redaction worker makes of it, all of
   // a capture's new messages in one request. A digest is taken once per message, of the form sent.
-  async sentMessages(raw,previous,basis=redactionBasis()){
+  async sentMessages(raw,previous,basis=freshRedactionBasis()){
     requireRedactionBasis(basis);useRedactionMemo(basis);
     const held=previous?.redaction_basis===checkedRedactionBasis(basis)&&previous?.observed_digests?.length?new Set(previous.observed_digests):null;
     const out=new Array(raw.length),missing=[];
@@ -915,7 +957,7 @@ export class TeamsConnector {
       this.redactor??=new Redactor();
       if(!this.redactionCounted){this.redactionCounted=true;this.syncStatus().redaction={since:new Date(this.clock.nowMs()).toISOString(),batches:0,messages:0,bytes:0,worker_ms:0,main_ms:0,max_main_ms:0};}
       // The worker is sent each new message's canonical JSON and answers only those redaction changed.
-      let started=performance.now();const texts=missing.map(([,,text])=>text),pending=this.redactor.run('canonical',texts,{basis});let mainMs=performance.now()-started;
+      let started=performance.now();const texts=missing.map(([,,text])=>text),pending=this.redactor.run('canonical',texts,{basis,fresh:true});let mainMs=performance.now()-started;
       const changed=await pending;started=performance.now();
       // Another connector/capture can run while this worker answers. Never store its result under a later basis.
       requireRedactionBasis(basis);useRedactionMemo(basis);
@@ -938,10 +980,11 @@ export class TeamsConnector {
     const files=translated.files?.length?translated.files:[{path:translated.suggested_filename??defaultName,content:translated.content,role:'primary'}];
     if(files.filter(file=>file.role==='primary').length!==1)throw Object.assign(new Error('native codec bundle must contain exactly one primary file'),{code:'fidelity_unavailable'});
     let total=0;const spilled=[];
-    this.redactor??=new Redactor();const texts=await this.redactor.run('texts',files.map(file=>file.content),{basis});
+    this.redactor??=new Redactor();const texts=await this.redactor.run('texts',files.map(file=>file.content),{basis,fresh:true});
+    const [metadata]=await this.redactor.run('values',[{paths:files.map(file=>file.path),residue:translated.residue??[]}],{basis,fresh:true});
     if(basis!==undefined)requireRedactionBasis(basis);
-    for(const [index,file] of files.entries()){const bytes=Buffer.from(texts[index],'utf8');total+=bytes.length;if(total>256*1024*1024)throw Object.assign(new Error('native artifact bundle exceeds 256 MiB'),{code:'request_too_large'});spilled.push({path:file.path,role:file.role,...this.spill(bytes)});}
-    return {fidelity:translated.fidelity,residue:translated.residue??[],files:spilled};
+    for(const [index,file] of files.entries()){const bytes=Buffer.from(texts[index],'utf8');total+=bytes.length;if(total>256*1024*1024)throw Object.assign(new Error('native artifact bundle exceeds 256 MiB'),{code:'request_too_large'});spilled.push({path:metadata.paths[index],role:file.role,...this.spill(bytes)});}
+    return {fidelity:translated.fidelity,residue:metadata.residue,files:spilled};
   }
   // The outbox artifacts and native_bundle of one capture from a spilled bundle; every capture gets fresh upload ids.
   bundleArtifacts(bundle,harness){
@@ -1074,10 +1117,10 @@ export class TeamsConnector {
       let started=null;
       try{
         const seen=this.origins[key]?.capture_stamps?.[options.ruleId];
-        // an unchanged stamp satisfies the messages, not a native bundle still owed and ready to be taken
+        // An unchanged stamp cannot satisfy a held full capture or a native bundle ready to be taken.
         const artifact=(()=>{try{return statSync(realpathSync(options.locator.storage.path));}catch{return null;}})();
         const nativeOwed=Boolean(this.origins[key]?.native_deferred&&artifact&&this.nativeReady(key,artifact));
-        if(options.live&&!nativeOwed&&seen?.rule_revision===options.ruleRevision&&seen.stamp===this.sessionStamp(options))continue;
+        if(options.live&&!nativeOwed&&!this.redactionHolds.needed(key)&&seen?.rule_revision===options.ruleRevision&&seen.stamp===this.sessionStamp(options))continue;
         const artifactBefore=statSync(realpathSync(options.locator.storage.path));
         // A session is loaded again no sooner than ten times its last load took (a 0.5 s load: every 5 s; a load
         // that takes minutes: every LARGE_CAPTURE_EVERY_MS), so a live session streams while the lanes stay light.
@@ -1140,13 +1183,14 @@ export class TeamsConnector {
     }
     // The turns typed through a door here are labelled before redaction, which then reads them as sent.
     const raw=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});this.labelTurns(key,loaded.messages??loaded.turns??[],raw);
-    const basis=redactionBasis();let messages=await this.sentMessages(raw,previous,basis);const loadedMessages=messages;
+    const basis=this.observeCustodyBasis();let messages=await this.sentMessages(raw,previous,basis);const loadedMessages=messages;
+    const recapturing=this.redactionHolds.needed(key);
     if (harness === 'codex' && loaded.total_message_count > messages.length) coverage = { ...coverage, completeness: 'partial', reasons: [...new Set([...coverage.reasons, 'prefix_not_captured'])] };
     // A session published without its native bundle is captured again, with the same messages, once the bundle can be built.
     const nativeWanted=configuration.native_capture!==false&&backfillPolicy.mode==='all'&&typeof this.core.translateSession==='function'&&!((artifactBefore?.size??0)>NATIVE_MAX_BYTES);
     const retryNative=Boolean(previous?.native_deferred&&nativeWanted&&artifactBefore?.isFile()&&!previous?.baseline&&this.nativeReady(key,artifactBefore));
     const unchanged=previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&digestOf(message)===previous.observed_digests?.[index]);
-    if(unchanged&&!retryNative){requireRedactionBasis(basis);this.origins[key]={...previous,redaction_basis:checkedRedactionBasis(basis)};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);await this.publishSessionProfile(key);return null;}
+    if(unchanged&&!retryNative&&!recapturing){requireRedactionBasis(basis);this.origins[key]={...previous,redaction_basis:checkedRedactionBasis(basis)};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);await this.publishSessionProfile(key);return null;}
     let effectivePrevious=previous;const clearBaseline=backfillPolicy.mode==='all';
     // A `none` rule keeps back the history recorded before it became active (the server's capture_after), not
     // whatever a session holds when first seen: a session begun after the rule is published from its first message.
@@ -1185,7 +1229,7 @@ export class TeamsConnector {
     const begin={native_session_id:nativeSessionId,harness,generation,sequence,capture_id:captureId,previous_digest:effectivePrevious?.digest??null,visibility,rule_id:ruleId,rule_revision:ruleRevision};
     // Only what the server does not hold goes over the wire: the longest prefix this source last committed unchanged
     // (the outbox is empty here, so that is the session's current version) is named by its digest, not sent again.
-    const carried=this.carriedPrefix(effectivePrevious,messages,{ruleRevision,backfillMode:backfillPolicy.mode,clearBaseline});
+    const carried=recapturing?0:this.carriedPrefix(effectivePrevious,messages,{ruleRevision,backfillMode:backfillPolicy.mode,clearBaseline});
     if(carried)begin.carry={count:carried,digest:carryDigest(messages.slice(0,carried))};
     const sent=carried?messages.slice(carried):messages;
     const parts=captureParts(captureId,sent);
@@ -1214,7 +1258,7 @@ export class TeamsConnector {
           const translated=(await this.core.translateSession({locator,target_harness:harness},{timeoutMs:translateTimeoutMs})).artifact;
           if(fileStamp(statSync(artifactSource))===onDisk)bundle={stamp:onDisk,...await this.spillTranslated(translated,basename(artifactSource),basis)};
         }catch(error){
-          if(this.abort.signal.aborted||error?.code==='redaction_basis_changed')throw error;
+          if(this.abort.signal.aborted||['redaction_basis_changed','custody_unreadable'].includes(error?.code))throw error;
           this.lastError=error;process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} published without its native bundle: ${error.message}\n`);
           // The same file is not translated again; a write to it clears this.
           if(this.sessionLive(key,ruleId,epoch)){this.state.native_failed[key]=onDisk;this.save();}
@@ -1224,13 +1268,16 @@ export class TeamsConnector {
       if(bundle&&fileStamp(statSync(artifactSource))!==onDisk)bundle=null;
       if(bundle)({artifacts,nativeBundle}=this.bundleArtifacts(bundle,harness));else nativeDeferred=true;
       // A retry that still has no bundle would republish the same messages for nothing.
-      if(unchanged&&!nativeBundle){requireRedactionBasis(basis);this.origins[key]={...previous,redaction_basis:checkedRedactionBasis(basis)};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);this.armNativeIdle(key);return null;}
+      if(unchanged&&!nativeBundle&&!recapturing){requireRedactionBasis(basis);this.origins[key]={...previous,redaction_basis:checkedRedactionBasis(basis)};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);this.armNativeIdle(key);return null;}
     }else if(sqliteSource&&nativeWanted&&!effectivePrevious?.baseline){
       const translated=(await this.core.translateSession({locator,target_harness:harness},{timeoutMs:translateTimeoutMs})).artifact;
       const digest=entries=>hash(canonicalJson((entries.messages??entries.turns??[]).map(entry=>entry.value??entry)));if(digest(await this.core.session(locator).load())!==digest(loaded))throw Object.assign(new Error('native session changed while it was being captured'),{code:'resync_required'});
       ({artifacts,nativeBundle}=this.bundleArtifacts(await this.spillTranslated(translated,`${nativeSessionId}.json`,basis),harness));
     }
-    const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',title:descriptor?.title??null,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
+    // Descriptive metadata shares the capture's custody snapshot too. Structural identifiers cannot be rewritten;
+    // the request guard refuses them if they themselves contain a custody value.
+    this.redactor??=new Redactor();const [metadata]=await this.redactor.run('values',[{title:descriptor?.title??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage}],{basis,fresh:true});
+    const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',...metadata,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
     const digestCommit={...commit};delete digestCommit.digest;commit.digest=hash(canonicalJson({begin,parts,commit:digestCommit}));
     // A session gone or no longer covered while it loaded queues nothing (its spilled bundle, held by nothing, goes at the next start).
     if(!this.sessionLive(key,ruleId,epoch))return null;
@@ -1419,19 +1466,19 @@ export class TeamsConnector {
     item.commit={...item.commit,capture_id:captureId,parts:item.parts.length};
     const digestCommit={...item.commit};delete digestCommit.digest;item.commit.digest=hash(canonicalJson({begin:item.begin,parts:item.parts,commit:digestCommit}));this.rewriteQueued(item);this.save();
   }
-  async sendCapture(item){const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);if(begun.state==='committed')return begun.receipt;for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);
+  async sendCapture(item){const request=(method,path,body)=>this.request(method,path,body,{beforeTransfer:json=>this.guardCaptureTransfer(item,json)});const begun=await request('POST',`/sources/${this.sourceId}/captures`,item.begin);if(begun.state==='committed')return begun.receipt;for(const part of item.parts)await request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);
     // A capture queued by an older connector holds its chunks inline; a current one reads them from its spill file.
     for(const artifact of item.artifacts??[])for(const chunk of artifact.spill?this.spilledChunks(artifact):artifact.chunks){
       if(!chunk)throw Object.assign(new Error('a spilled native artifact changed on disk while it was sent'),{code:'resync_required'});
       const path=`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`;
       let reused=false;
       if(this.chunkReuse!==false)try{
-        await this.request('PUT',path,{upload_id:chunk.upload_id,index:chunk.index,sha256:chunk.sha256,reuse:true});reused=true;this.chunkReuse=true;
+        await request('PUT',path,{upload_id:chunk.upload_id,index:chunk.index,sha256:chunk.sha256,reuse:true});reused=true;this.chunkReuse=true;
       }catch(error){
         if(error.code==='invalid_request'&&error.status===400)this.chunkReuse=false; // older server
         else if(error.code!=='chunk_missing')throw error;
       }
-      if(!reused)await this.request('PUT',path,chunk);
+      if(!reused)await request('PUT',path,chunk);
       this.state.native_transfer??={sent_bytes:0,reused_bytes:0,chunks:0};
       this.state.native_transfer[reused?'reused_bytes':'sent_bytes']+=Buffer.byteLength(chunk.bytes_base64,'base64');
       this.state.native_transfer.chunks++;
@@ -1442,7 +1489,7 @@ export class TeamsConnector {
       transfer.chunks++;transfer.at=this.clock.nowMs();
       for(const expired of Object.keys(transfers).sort((a,b)=>transfers[b].at-transfers[a].at).slice(128))delete transfers[expired];
     }
-    const receipt=await this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);
+    const receipt=await request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);
     const transfer=this.state.native_transfers?.[`${item.begin.harness}:${item.begin.native_session_id}`];
     if(transfer&&item.artifacts?.length){transfer.captures++;transfer.last_bundle_bytes=item.commit.artifacts.reduce((sum,a)=>sum+a.byte_length,0);}
     return receipt;}
@@ -1457,15 +1504,33 @@ export class TeamsConnector {
     if(!Array.isArray(configuration?.rules))return false;
     return !configuration.rules.some(rule=>rule.id===item.begin.rule_id&&rule.revision===item.begin.rule_revision&&rule.state==='active');
   }
-  async flushOutbox(){let latest=null;while(this.outbox.length){const item=this.outbox[0];let receipt;this.dropLostArtifacts(item);this.refitParts(item);try{receipt=await this.sendCapture(item);}catch(error){if(error.code==='storage_pressure'&&this.deferNativeUnderPressure(item))continue;if(error.status===409&&error.code==='carry_mismatch'){const key=`${item.begin.harness}:${item.begin.native_session_id}`;this.lastError=error;process.stderr.write(`supercode teams: the server does not hold what a capture of ${item.begin.harness} session ${item.begin.native_session_id} carried; it is sent whole again\n`);this.unqueue();if(this.origins[key])this.origins[key]={...this.origins[key],observed_keys:[],observed_digests:[],carry_refused:true,capture_stamps:{}};this.save();this.resee(key);continue;}if(error.status===409&&error.code==='batch_gap'&&error.details&&Number.isSafeInteger(error.details.sequence)){
+  async flushOutbox(){let latest=null;while(this.outbox.length){const item=this.outbox[0];let receipt;try{this.requireCaptureTransfer(item);this.dropLostArtifacts(item);this.refitParts(item);receipt=await this.sendCapture(item);}catch(error){
+        // A failed request may have awaited long enough to observe a different policy. Retain its whole original
+        // before an existing server-error branch can drop a part, native reference or queued item.
+        if(!['redaction_basis_changed','redaction_capture_unsafe'].includes(error.code))try{this.requireCaptureTransfer(item);}catch(changed){error=changed;}
+        if(['redaction_basis_changed','redaction_capture_unsafe'].includes(error.code)){this.holdQueuedCapture(item,error);continue;}
+        if(error.code==='storage_pressure'&&this.deferNativeUnderPressure(item))continue;
+        if(error.status===409&&error.code==='carry_mismatch'){const key=`${item.begin.harness}:${item.begin.native_session_id}`;this.lastError=error;process.stderr.write(`supercode teams: the server does not hold what a capture of ${item.begin.harness} session ${item.begin.native_session_id} carried; it is sent whole again\n`);this.unqueue();if(this.origins[key])this.origins[key]={...this.origins[key],observed_keys:[],observed_digests:[],carry_refused:true,capture_stamps:{}};this.save();this.resee(key);continue;}if(error.status===409&&error.code==='batch_gap'&&error.details&&Number.isSafeInteger(error.details.sequence)){
           // The server holds a different last capture of this session than this connector recorded (a capture it
           // committed while the connector stopped before recording it, for one): this connector takes the server's
           // revision, drops the stale capture and sends the session whole again at once (resee).
           const key=`${item.begin.harness}:${item.begin.native_session_id}`,expected=error.details;this.lastError=error;
           process.stderr.write(`supercode teams: ${item.begin.harness} session ${item.begin.native_session_id} resumes at the server's revision ${expected.generation}/${expected.sequence}; it is sent whole again\n`);
           this.unqueue();this.origins[key]={...this.origins[key],generation:expected.generation,sequence:expected.sequence-1,digest:expected.digest??null,observed_keys:[],observed_digests:[],carry_refused:true,capture_stamps:{}};this.save();this.resee(key);continue;}
-        if(error.status===400&&error.code==='invalid_request'||error.status===413){this.lastError=error;this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id??null},error);(this.droppedCaptures??=new Set()).add(`${item.begin.harness}:${item.begin.native_session_id}`);if(error.status===413)(this.state.set_aside??={})[`${item.begin.harness}:${item.begin.native_session_id}`]={at:this.clock.nowMs(),rule_revision:item.begin.rule_revision??null,reason:error.message};process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id} the server refused${error.status===413?' (one message is larger than a request may be)':' as malformed'}: ${error.message}\n`);this.unqueue();this.save();continue;}if(!await this.ruleRejected(item,error))throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.unqueue();this.save();continue;}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,redaction_basis:item.redactionBasis??null,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.nativeDeferred)next.native_deferred=true;else delete next.native_deferred;if(item.windowStart)next.window_start=item.windowStart;else delete next.window_start;if(!item.begin.carry)delete next.carry_refused;if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.origins[key]=next;this.unqueue();this.save();// A queued capture is often flushed by another session's capture: its own session's problem ends with it.
-this.clearSessionProblem(item.begin.harness,item.begin.native_session_id);
+        if(error.status===400&&error.code==='invalid_request'||error.status===413){this.lastError=error;this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id??null},error);(this.droppedCaptures??=new Set()).add(`${item.begin.harness}:${item.begin.native_session_id}`);if(error.status===413)(this.state.set_aside??={})[`${item.begin.harness}:${item.begin.native_session_id}`]={at:this.clock.nowMs(),rule_revision:item.begin.rule_revision??null,reason:error.message};process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id} the server refused${error.status===413?' (one message is larger than a request may be)':' as malformed'}: ${error.message}\n`);this.unqueue();this.save();continue;}
+        const rejected=await this.ruleRejected(item,error);
+        try{this.requireCaptureTransfer(item);}catch(changed){if(['redaction_basis_changed','redaction_capture_unsafe'].includes(changed.code)){this.holdQueuedCapture(item,changed);continue;}throw changed;}
+        if(!rejected)throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.unqueue();this.save();continue;}
+      // A commit already issued may finish after custody changes. Its receipt advances the origin, but its local
+      // original remains held and owed; registration gives this source no authority to purge the published revision.
+      let current=true;
+      try{this.requireCaptureTransfer(item);}catch(error){if(!['redaction_basis_changed','redaction_capture_unsafe'].includes(error.code))throw error;this.holdQueuedCapture(item,error);current=false;}
+      const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,redaction_basis:item.redactionBasis??null,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.nativeDeferred)next.native_deferred=true;else delete next.native_deferred;if(item.windowStart)next.window_start=item.windowStart;else delete next.window_start;if(!item.begin.carry)delete next.carry_refused;if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.origins[key]=next;
+      if(current){
+        if(receipt?.capture_id===item.begin.capture_id&&receipt.digest===item.commit.digest)this.redactionHolds.settle(key,item,receipt,names=>this.releaseSpills(names));
+        this.updateRedactionHolds();this.unqueue();this.clearSessionProblem(item.begin.harness,item.begin.native_session_id);
+      }
+      this.save();
       // The commit is what records (or settles) a native bundle still owed: its wait is armed here.
       this.armNativeIdle(key);latest=receipt;}this.flushBackoff=null;return latest;}
   stop(){void this.redactor?.close();this.daemon?.off?.('sessionActivityEvent',this.activityEvent);this.daemon?.off?.('sessionIndexEvent',this.indexEvent);this.daemon?.off?.('exit',this.daemonExit);clearTimeout(this.flushTimer);if(this.activitySubscription)void this.daemon?.unsubscribeSessionActivity?.(this.activitySubscription).catch(()=>{});for(const feed of this.feeds?.values()??[])void this.daemon?.unsubscribeSessionIndex?.(feed.subscription).catch(()=>{});for(const timer of this.idleTimers?.values()??[])clearTimeout(timer);try{this.flushState();}catch{}if(this.timer)clearInterval(this.timer);if(this.heartbeatTimer)clearInterval(this.heartbeatTimer);this.abort.abort();return this.nativeEffects.close();}

package/connector/redaction-holds.mjs

@@ -0,0 +1,59 @@
+// Stale captures stay on this machine while a fresh source observation replaces them. Only headers stay in memory;
+// the original parts and artifact references remain in owner-only files and are never a send queue.
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+
+export class RedactionHolds {
+  constructor({ stateDir, atomic, saved = {} }) {
+    this.directory = join(stateDir, 'redaction-held'); this.outbox = join(stateDir, 'outbox');
+    this.atomic = atomic; this.items = new Map(); this.unread = [];
+    mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+    for (const name of readdirSync(this.directory).filter(name => /^\d+\.json$/.test(name)).sort()) {
+      try {
+        const item = JSON.parse(readFileSync(join(this.directory, name), 'utf8'));
+        const header = this.header(item, name), prior = saved[name];
+        if (prior?.capture_id === header.capture_id && ['native_owed', 'cleanup', 'blocked'].includes(prior.state)) Object.assign(header, { state: prior.state, replacement: prior.replacement });
+        this.items.set(name, header);
+      } catch (error) { this.unread.push({ name, error: error?.code ?? 'unreadable_hold' }); }
+    }
+  }
+
+  header(item, name) {
+    return { name, capture_id: item.begin.capture_id, key: `${item.begin.harness}:${item.begin.native_session_id}`,
+      harness: item.begin.harness, session_id: item.begin.native_session_id, rule_id: item.begin.rule_id,
+      rule_revision: item.begin.rule_revision, at: item.redaction_hold?.at ?? null, state: item.redaction_hold?.code==='redaction_capture_unsafe'?'blocked':'owed',
+      stamp: item.stamp??null, basis: item.redactionBasis, code: item.redaction_hold?.code??'redaction_basis_changed',
+      native: Boolean(item.artifacts?.length || item.nativeDeferred),
+      spills: (item.artifacts ?? []).filter(artifact => artifact.spill).map(artifact => artifact.spill.file) };
+  }
+
+  hold(item, name, at, code) {
+    // Persist the no-send flag before moving: a crash between these steps restarts with a flagged outbox item, which
+    // the transfer guard also refuses. The move transfers its spill ownership; it must not release any references.
+    item.redaction_hold = { at, code };
+    this.atomic(join(this.outbox, name), JSON.stringify(item));
+    if(existsSync(join(this.directory,name)))throw new Error('a custody-held capture already owns this filename; original outbox item retained');
+    renameSync(join(this.outbox, name), join(this.directory, name));
+    this.items.set(name, this.header(item, name));
+  }
+
+  needed(key) { return [...this.items.values()].some(item => item.key === key && ['owed','blocked'].includes(item.state)); }
+  blocked(key, stamp, revision, basis) { return [...this.items.values()].some(item => item.key === key && item.state === 'blocked' && item.stamp === stamp && item.rule_revision === revision && item.basis === basis); }
+  spills() { return [...this.items.values()].flatMap(item => item.spills); }
+  saved() { return Object.fromEntries(this.items); }
+  status() { return [...this.items.values()].map(({ capture_id, harness, session_id, rule_id, at, state, replacement }) => ({ capture_id, harness, session_id, rule_id, at, state, replacement })); }
+
+  settle(key, capture, receipt, releaseSpills) {
+    for (const [name, held] of this.items) {
+      if (held.key !== key || held.rule_id !== capture.begin.rule_id || held.rule_revision !== capture.begin.rule_revision) continue;
+      if(capture.begin.carry&&['owed','blocked'].includes(held.state))continue;
+      held.replacement = receipt.capture_id;
+      // A receipt for messages alone does not discharge a held native bundle. The normal native-deferred retry
+      // remains owed; its original files stay held until a replacement artifact is acknowledged too.
+      if (held.native && !(capture.artifacts?.length)) { held.state = 'native_owed'; continue; }
+      try { unlinkSync(join(this.directory, name)); }
+      catch (error) { if (error?.code !== 'ENOENT') { held.state = 'cleanup'; continue; } }
+      this.items.delete(name); releaseSpills(held.spills);
+    }
+  }
+}

package/connector/redactor.mjs

@@ -19,16 +19,22 @@ if (!isMainThread && parentPort) {
     return changed;
   };
   const { performance } = await import('node:perf_hooks');
-  parentPort.on('message', ({ id, kind, items, basis }) => {
+  const holdsCustody = (value, custody) => {
+    if (typeof value === 'string') return custody.some(({ value: secret }) => value.includes(secret));
+    if (Array.isArray(value)) return value.some((item) => holdsCustody(item, custody));
+    return value && typeof value === 'object' && Object.entries(value).some(([key, item]) => holdsCustody(key, custody) || holdsCustody(item, custody));
+  };
+  parentPort.on('message', ({ id, kind, items, basis, fresh }) => {
     // Its own busy time rides back with each answer: what redaction costs, apart from the connector's other work.
     const started = performance.now();
-    const requireBasis=()=>{if(basis!==undefined&&redactionBasis()!==basis)throw Object.assign(new Error('redaction worker basis differs from the capture; capture needs fresh redaction'),{code:'redaction_basis_changed'});};
+    const requireBasis=()=>{if(basis!==undefined&&redactionBasis(undefined,{fresh})!==basis)throw Object.assign(new Error('redaction worker basis differs from the capture; capture needs fresh redaction'),{code:'redaction_basis_changed'});};
     try {
       // All strings in this checked batch use the same custody observation, even if a batch crosses its refresh interval.
-      const snapshot=basis===undefined?null:redactionSnapshot();
+      const snapshot=basis===undefined?null:redactionSnapshot(undefined,{fresh});
       if(snapshot&&snapshot.basis!==basis)throw Object.assign(new Error('redaction worker basis differs from the capture; capture needs fresh redaction'),{code:'redaction_basis_changed'});
       requireBasis();
-      const answer = kind === 'canonical' ? changedOf(items,snapshot?.values) : items.map((item) => (kind === 'texts' ? redactText(item,undefined,snapshot?.values) : redactValue(item,undefined,snapshot?.values)));
+      if(kind==='custody_assert'&&(!snapshot||items.some(text=>holdsCustody(JSON.parse(text),snapshot.values))))throw Object.assign(new Error('capture still contains a registered custody value; fresh capture required'),{code:'redaction_capture_unsafe'});
+      const answer = kind === 'custody_assert' ? [] : kind === 'canonical' ? changedOf(items,snapshot?.values) : items.map((item) => (kind === 'texts' ? redactText(item,undefined,snapshot?.values) : redactValue(item,undefined,snapshot?.values)));
       requireBasis();
       parentPort.postMessage({ id, items: answer, busy: performance.now() - started });
     } catch (error) { parentPort.postMessage({ id, error: String(error?.message ?? error), code: error?.code }); }
@@ -45,7 +51,7 @@ export class Redactor {
       const waiter = this.waiting.get(id); if (!waiter) return;
       this.waiting.delete(id);
       this.workerMs += busy ?? 0;
-      if (error) waiter.reject(Object.assign(new Error(`redaction failed: ${error}`), { code: code === 'redaction_basis_changed' ? code : 'redaction_failed' }));
+      if (error) waiter.reject(Object.assign(new Error(`redaction failed: ${error}`), { code: ['redaction_basis_changed','redaction_capture_unsafe','custody_unreadable'].includes(code) ? code : 'redaction_failed' }));
       else waiter.resolve(items);
       if (!this.waiting.size) worker.unref();
     });
@@ -63,13 +69,14 @@ export class Redactor {
 
   /** `items` redacted, in order: `kind` 'values' (JSON values, every string in them) or 'texts'; for 'canonical' (canonical
    *  JSON texts) only the changed ones, as `{ index, value, digest }`. An optional basis must match the worker before
-   *  and after redaction; a mismatch rejects the request rather than returning stale decisions. */
-  run(kind, items, { basis } = {}) {
+   *  and after redaction; a mismatch rejects the request rather than returning stale decisions. `custody_assert`
+   *  accepts serialized request bodies and refuses a custody value anywhere in their parsed strings or keys. */
+  run(kind, items, { basis, fresh = false } = {}) {
     if (!items.length) return Promise.resolve([]);
     if (!this.worker) this.start();
     const id = this.next++;
     this.worker.ref();
-    return new Promise((resolve, reject) => { this.waiting.set(id, { resolve, reject }); this.worker.postMessage({ id, kind, items, basis }); });
+    return new Promise((resolve, reject) => { this.waiting.set(id, { resolve, reject }); this.worker.postMessage({ id, kind, items, basis, fresh }); });
   }
 
   close() { const worker = this.worker; this.worker = null; return worker ? worker.terminate().then(() => {}) : Promise.resolve(); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.158",
+  "version": "0.3.160",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -75,7 +75,7 @@
     "@volter/supercode-health": "^0.1.0",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/supercode-trace": "^0.1.0",
-    "@volter/teams": "0.2.43",
+    "@volter/teams": "0.2.44",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",