seisin 0.2.0 → 0.4.0

package/README.md

@@ -1,12 +1,13 @@
 # seisin
 
-[![test](https://github.com/carlostapiaolguin3-stack/seisin/actions/workflows/test.yml/badge.svg)](https://github.com/carlostapiaolguin3-stack/seisin/actions/workflows/test.yml)
+[![test](https://github.com/carlostapiacl/seisin/actions/workflows/test.yml/badge.svg)](https://github.com/carlostapiacl/seisin/actions/workflows/test.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/carlostapiacl/seisin/badge)](https://scorecard.dev/viewer/?uri=github.com/carlostapiacl/seisin)
 [![npm](https://img.shields.io/npm/v/seisin?color=222)](https://www.npmjs.com/package/seisin)
 [![license](https://img.shields.io/badge/license-MIT-222)](LICENSE)
 [![node](https://img.shields.io/badge/node-%E2%89%A518-222)](package.json)
 [![no dependencies](https://img.shields.io/badge/dependencies-1-222)](package.json)
 
-**[The short version, with the demos playing →](https://carlostapiaolguin3-stack.github.io/seisin/)** · this page is the long one.
+**[The short version, with the demos playing →](https://carlostapiacl.github.io/seisin/)** · this page is the long one.
 
 > **seisin** *(n.)* — the legal possession of a piece of land. Not who owns it on paper: who holds it now.
 
@@ -57,9 +58,9 @@ flowchart LR
     style H fill:#eef,stroke:#66c
 ```
 
-**The kernel says no. seisin says whose.** That second half is the whole thing: every other
-permission layer in this space answers *yes* or *no*, and a refusal that also names an owner
-turns a dead end into a handoff.
+**The kernel says no. seisin says whose.** That second half is the whole thing: other
+permission layers in this space answer *yes* or *no*, or at best *which rule* said no — and a
+refusal that also names an owner turns a dead end into a handoff.
 
 ![seisin denying a write outside a role's territory, then naming the owner](docs/img/demo.gif)
 
@@ -76,7 +77,7 @@ $ seisin run frontend -- sh -c 'echo // fix >> src/api/orders.ts'
     seisin grant <n> [--reason "…"]   ·   seisin decline <n> [--reason "…"]
 ```
 
-**Whose it was, at the moment it was denied.** Every other permission layer in this space answers *yes* or *no*. Answering **"no, and it belongs to `backend`"** turns a block into a handoff — and one a person can approve in a command, rather than a line somebody has to remember to go and read.
+**Whose it was, at the moment it was denied.** Other permission layers answer *yes* or *no*, and the good ones say which rule it was and how to widen it. Answering **"no, and it belongs to `backend`"** turns a block into a handoff — and one a person can approve in a command, rather than a line somebody has to remember to go and read.
 
 The kernel is what denies; the name comes from the policy. That first line is all the boundary itself can say — no path, no reason, nothing to read afterwards — so seisin reads the refusal out of the kernel's own log and answers the question it leaves open. On Linux only the hook can do that; [the ask is upstream](docs/upstream/cli-violations.md) as [issue #582](https://github.com/anthropics/sandbox-runtime/issues/582).
 
@@ -249,6 +250,47 @@ role, including the ones whose whole job is to have nothing to reach.
 > **Use an HTTPS remote for git**, and run SSH deploys outside the confined turn.
 > [Why, exactly, and whose gap it is →](docs/decisions.md#ssh-does-not-work-and-it-is-not-seisin-that-decided-that)
 
+A role can also give something back. `never_writes` subtracts from its own `writes`, and it
+wins however wide the grant is:
+
+```toml
+[roles.backend]
+writes       = ["services/api/**"]
+never_writes = ["services/api/.git/index.lock"]   # works in a worktree; the canonical index is not its business
+```
+
+It is per role on purpose — there is no global version, because a global deny on a lock file
+breaks every role that legitimately commits there. A refusal it causes says so by name and
+leaves **no request** in the queue: approving one would undo a subtraction somebody wrote. An
+entry that no `writes` of the same role covers, or a misspelling like `never_write`, is named
+by `seisin check` instead of being ignored.
+
+A role that starts a server — a dev server, the backend an end-to-end test drives — needs
+`local_binding = true`. Listening is off by default and per role: most roles never start one.
+It is wider than the name: the role can also listen on every interface and **connect to every
+port on localhost**, so anything listening there without authentication is within its reach.
+`seisin check` says this next to the role. That is macOS: on Linux each role already has a
+private loopback, serves without the key, and reaches nothing on the host either way.
+
+If a role only needs to *reach* a local service, name the ports instead:
+`local_ports = [8001, 8081]`. The role reaches those and nothing else on localhost, on macOS
+and Linux. The sandbox's proxy enforces the list, so the client has to use the proxy. curl,
+Node's `fetch` and Python's `urllib` do. A database driver or a raw socket don't, and get
+refused. For Chromium, pass Playwright's `proxy` option from `HTTP_PROXY`; on macOS it also
+needs `--single-process` to start. A listed port is open to anything that speaks `CONNECT`, not
+just HTTP, so list the service, not the protocol.
+
+`mcp = ["playwright"]` lists the MCP servers a role may load; `mcp = []` means none, and no
+key means the policy doesn't say. seisin declares this and `explain` answers it
+(`seisin explain qa mcp tradingview`), but the servers are started by the agent's CLI, so the
+launcher has to apply it. With Claude Code: `--mcp-config` holding only those servers, plus
+`--strict-mcp-config`.
+
+Refused connections are logged too: `connect tcp:<port>` (the kernel gives the port, not the
+host) or the socket path, once per target per run. `seisin walls` says whether the port is
+missing from `local_ports`, listed but dialled directly, or a socket. No request is filed: a
+port isn't anyone's territory. macOS only.
+
 `seisin init` will propose this from whatever your repo already says: `.claude/agents/`, then `CODEOWNERS`, then a blank start. It **proposes** — a generated policy you did not read is not a policy.
 
 ## What will look like a bug on the first day
@@ -354,6 +396,24 @@ writes = ["src/api/**"]   # granted 2026-09-12 · asked 3× · "frontend owns ch
 person applies it, in a terminal or in the console. That asymmetry is deliberate and it is
 the reason the MCP server exists at all.
 
+**A person hears about it.** With `[notify]`, the parent process sends one message per new
+request — the role, the path, whose it is, and `seisin grant <n>` — to ntfy, Slack or any
+webhook. The URL lives in a key directory no role declares (`url_file`) or in the parent's
+`SEISIN_NOTIFY_URL`; written plainly into `seisin.toml`, which every role can read, it refuses to
+load, because whoever reads it can send you a fake "approve".
+
+```toml
+[notify]
+url_file = ".secrets/notify-url.txt"   # e.g. https://ntfy.sh/<your-topic>
+format   = "text"                      # or "slack", "json"
+```
+
+**And so does the agent.** `seisin wire` installs the hook for four events. Before a tool call
+it explains a refusal it can see coming; after a command fails it reads the kernel's own refusal
+from the log and tells the agent whose the path was and how many times it has been refused —
+the half PreToolUse never sees; and when a session starts, resumes or is compacted it hands the
+agent its territory and its walls, before the first one.
+
 **[How a denial becomes a request, why it deduplicates, and what a grant records →](docs/permission-requests.md)**
 
 ## Ask your own assistant
@@ -614,12 +674,13 @@ This space already has good work, and seisin is not the first thing here:
 - [`XuebinMa/agent-guard`](https://github.com/XuebinMa/agent-guard) — a permission-enforcement SDK, also one global policy.
 - [`NVIDIA/OpenShell`](https://github.com/NVIDIA/openshell) — a runtime that sandboxes an agent with Landlock and seccomp, under a declarative policy. Serious, and the closest thing here by weight.
 - [`dredozubov/hazmat`](https://github.com/dredozubov/hazmat) — runs the agent as a different system user, with `pf` rules and snapshots.
+- [`nolabs-ai/nono`](https://github.com/nolabs-ai/nono) — a kernel sandbox for agents on the host (Seatbelt, Landlock), with per-tool child sandboxes, a credential proxy with endpoint filtering, approval webhooks and a tamper-evident audit log. The most complete sandbox here, and on a Mac the one that enforces through the same kernel seisin does. `nono why` explains *which rule* denied something and how to allow it; it has no notion of *whose* it was.
 - *Directory ownership* is recommended in half the multi-agent write-ups. As far as I could find, nobody enforces it, and nobody names the owner in the refusal. That gap is the reason for this repo.
 
 ### One sentence to tell these apart, because the names all sound the same
 
-**OpenShell and hazmat isolate the agent from your machine. seisin separates roles from each
-other inside one repository, and when it blocks something it names the owner.**
+**OpenShell, hazmat and nono isolate the agent from your machine. seisin separates roles from
+each other inside one repository, and when it blocks something it names the owner.**
 
 Those are different problems and the first one is not the one this solves. If what you want
 is "this agent cannot touch anything outside its box", they do that and OpenShell does it
@@ -643,7 +704,7 @@ measured](docs/what-it-has-been-put-through.md#where-each-claim-was-actually-run
 
 ## Status
 
-`0.2.0`, 326 tests, of which **26 need `@anthropic-ai/sandbox-runtime` installed**
+`0.4.0`, 470 tests, of which **26 need `@anthropic-ai/sandbox-runtime` installed**
 and run real commands through the real kernel — and CI fails if the sandbox half *skips*, because
 a green run that quietly tested nothing looks exactly like a real one. That is not hypothetical:
 those eighteen skipped on Linux for a day, behind a runtime check that looked for the global
@@ -664,7 +725,8 @@ already done:
 | **Windows** | the runtime has a backend. seisin has never been pointed at it, and no CI runner covers it |
 | **Deleting inside your own territory** | not covered, and not coverable here — the ask is upstream as [issue #545](https://github.com/anthropics/sandbox-runtime/issues/545), open and unanswered since 2026-09-13, [with the measurement behind it](docs/upstream/denyUnlink.md) and [a demo](docs/demo/) |
 | **`init` heuristics** | it reads `.claude/agents/` then `CODEOWNERS`. Every other convention is a guess nobody has made yet |
-| **SSH inside a turn** | the transport exists — the runtime's SOCKS proxy filters by `(port, host)` — and the `ProxyCommand` it wires up cannot authenticate to it, so `git` over SSH dies at the handshake. [The ask](docs/upstream/ssh-proxycommand.md) is written and verified, not filed. Use an HTTPS remote |
+| **SSH inside a turn** | the `ProxyCommand` the runtime sets can't authenticate to its own proxy, so `git` over SSH fails at the handshake. Fix upstream: [PR #516](https://github.com/anthropics/sandbox-runtime/pull/516). Use an HTTPS remote |
+| **A browser inside a role (macOS)** | Chromium only starts with `--single-process`, which is unstable with several browsers. Fix upstream: [PR #598](https://github.com/anthropics/sandbox-runtime/pull/598). [Measurement](docs/upstream/mach-register.md) |
 
 Every word above has one meaning, listed in [the glossary](docs/glossary.md) — the boundary
 **denies**, a person **declines**, seisin **refuses** a config it cannot enforce. A tool whose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it blocks it tells you whose file it was.",
   "keywords": [
     "ai-agents",
@@ -17,13 +17,13 @@
   ],
   "license": "MIT",
   "author": "Carlos Tapia",
-  "homepage": "https://carlostapiaolguin3-stack.github.io/seisin/",
+  "homepage": "https://carlostapiacl.github.io/seisin/",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/carlostapiaolguin3-stack/seisin.git"
+    "url": "git+https://github.com/carlostapiacl/seisin.git"
   },
   "bugs": {
-    "url": "https://github.com/carlostapiaolguin3-stack/seisin/issues"
+    "url": "https://github.com/carlostapiacl/seisin/issues"
   },
   "type": "module",
   "bin": {
@@ -39,10 +39,11 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "^0.0.76"
+    "@anthropic-ai/sandbox-runtime": "0.0.77"
   },
   "scripts": {
-    "test": "node --test test/*.test.js"
+    "test": "node --test test/*.test.js",
+    "prepublishOnly": "npm test"
   },
   "main": "./src/index.js",
   "exports": {

package/src/cli.js

@@ -47,16 +47,17 @@ ${C.b}seisin${C.off} — give each agent its own folders and its own keys
   seisin explain <role> read|write <path>
   seisin whose <path>                   who owns it — safe to call from inside the box
   seisin scan                           find secrets outside the declared key dirs
-  seisin review                         what the log says about the policy
-  seisin walls <role>                   what that role keeps being denied, and what it cost
+  seisin review [--all]                 what the log says about the policy
+  seisin walls <role> [--all]           what that role keeps being denied, and what it cost
   seisin wire                           let the agent record what it does
   seisin requests                       what the agents asked for and cannot have
   seisin grant <n> [--reason "…"]       approve one, with its provenance
   seisin decline <n> [--reason "…"]     turn one down, and record why
   seisin log [--role r] [--verdict denied]
+  seisin log verify                     does the log's hash chain hold
   seisin watch                          follow the log live
   seisin init [--from-observations]     propose a ${CONFIG_NAME} for this repo
-  seisin ui [--port n]                  open the console, live
+  seisin ui [--port n] [--link]         open the console, live (--link reopens a running one)
   seisin mcp                            an MCP server on stdio — read-only
 
 Enforcement comes from @anthropic-ai/sandbox-runtime, which asks the OS.

package/src/commands/explain.js

@@ -5,6 +5,7 @@
  * That is the only reason the exit code is not always 0 — a denial is an answer,
  * not a failure, but a shell has one channel for both.
  */
+import { toRepoRelative } from "../paths.js";
 import { isAbsolute } from "node:path";
 import { explain } from "../owners.js";
 import { twinsOf, whereIs } from "../worktree.js";
@@ -13,9 +14,15 @@ import { renderVerdict, C, out } from "../render.js";
 export function explainCommand(config, argv = []) {
   const [role, action, target] = argv;
   if (!role || !action || !target)
-    throw new Error("usage: seisin explain <role> <read|write> <path-or-key>");
+    throw new Error("usage: seisin explain <role> <read|write|mcp> <path, key or MCP server>");
   if (!config.roles[role]) throw new Error(`unknown role "${role}"`);
 
+  if (action === "mcp") {
+    const verdict = explain(config, role, "mcp", target);
+    out(renderVerdict(role, "mcp", target, verdict));
+    return { ...verdict, worktree: [] };
+  }
+
   const verb = action.startsWith("r") ? "read" : "write";
 
   /**
@@ -34,7 +41,7 @@ export function explainCommand(config, argv = []) {
    * because that is a question about somewhere else and it still deserves its
    * honest "no owner".
    */
-  const asked = target.startsWith(config.root + "/") ? target.slice(config.root.length + 1) : target;
+  const asked = toRepoRelative(config, target);
 
   const verdict = explain(config, role, verb, asked);
   out(renderVerdict(role, verb, target, verdict));

package/src/commands/hook.js

@@ -9,6 +9,8 @@
  */
 import { findConfig, loadConfig } from "../config.js";
 import { decide } from "../hook.js";
+import { afterTool, atSessionStart } from "../diagnose.js";
+import { logPath } from "../log.js";
 import { flush } from "../spool.js";
 
 export async function hook(stdin = process.stdin, env = process.env) {
@@ -33,6 +35,15 @@ export async function hook(stdin = process.stdin, env = process.env) {
   }
   if (!config.roles[role]) return null;
 
+  // One command for every event it is wired to, so `seisin wire` adds one name.
+  // The after-the-fact and session-start halves only explain; neither decides.
+  const event_ = event.hook_event_name;
+  if (event_ === "PostToolUse" || event_ === "PostToolUseFailure") {
+    try { return await afterTool(config, role, event, { file: logPath(config.root) }); } catch { return null; }
+  }
+  if (event_ === "SessionStart") {
+    try { return atSessionStart(config, role, event, { file: logPath(config.root) }); } catch { return null; }
+  }
   const decision = decide(config, role, event, { observe: env.SEISIN_OBSERVE === "1" });
   // The entries went to a socket, and cli.js exits as soon as we return. An
   // exit does not drain a socket, so the record would be lost precisely on the

package/src/commands/log.js

@@ -10,7 +10,7 @@
  */
 import { createReadStream, watch as watchDir } from "node:fs";
 import { dirname, relative } from "node:path";
-import { read, logPath, size } from "../log.js";
+import { read, logPath, size, verifyLog } from "../log.js";
 import { renderEntry, C, out } from "../render.js";
 
 const flag = (argv, name) => {
@@ -19,6 +19,7 @@ const flag = (argv, name) => {
 };
 
 export function log(config, argv = []) {
+  if (argv[0] === "verify") return verify(config);
   const entries = read(logPath(config.root), {
     role: flag(argv, "--role"),
     verdict: flag(argv, "--verdict"),
@@ -35,6 +36,32 @@ export function log(config, argv = []) {
   return entries;
 }
 
+/**
+ * `seisin log verify` — does the chain hold?
+ *
+ * Exit 1 when it does not, so it can sit in CI or a pre-commit hook. Lines from
+ * before the chain existed are reported as such, not as tampering.
+ */
+function verify(config) {
+  const r = verifyLog(logPath(config.root));
+  if (r.lines === 0) {
+    out(`\n  ${C.dim}nothing recorded yet${C.off}\n\n`);
+    return r;
+  }
+  const head = r.unchained ? `${r.unchained} line(s) from before the chain, then ` : "";
+  const segs = r.segments > 1 ? ` across ${r.segments} segments` : "";
+  if (!r.breaks.length) {
+    out(`\n  ${C.green}intact${C.off}  ${head}${r.chained} chained line(s)${segs}\n\n`);
+    return r;
+  }
+  out(`\n  ${C.red}broken${C.off}  ${head}${r.chained} chained line(s), ${r.breaks.length} break(s):\n`);
+  for (const b of r.breaks.slice(0, 10))
+    out(`    line ${b.line}: expected prev ${b.expected}, found ${b.found ?? "none"}\n`);
+  out(`  ${C.dim}a line was edited, removed or reordered just before each of these${C.off}\n\n`);
+  process.exitCode = 1;
+  return r;
+}
+
 /**
  * Follows the log from wherever it is now.
  *

package/src/commands/requests.js

@@ -7,7 +7,8 @@
  * whole feature rests on — see docs/permission-requests.md.
  */
 import { readFileSync, writeFileSync } from "node:fs";
-import { pending, settle, applyGrant, requestsPath } from "../requests.js";
+import { pending, settle, applyGrant, refuseIfBarred, requestsPath, markStale } from "../requests.js";
+import { read, logPath } from "../log.js";
 import { C, out } from "../render.js";
 
 /**
@@ -52,7 +53,7 @@ function pick(config, n) {
 }
 
 export function requests(config) {
-  const queue = pending(requestsPath(config.root));
+  const queue = markStale(pending(requestsPath(config.root)), read(logPath(config.root)));
   out(renderQueue(queue));
   return queue;
 }
@@ -70,6 +71,9 @@ export function renderQueue(queue) {
       // The stable way to name it: a number is a position in a queue that agents
       // are still writing to, and this does not move when the queue does.
       lines.push(`        ${C.dim}id ${r.key}${C.off}\n`);
+    // Marked, not moved: the number above is what `grant <n>` is typed against.
+    if (r.stale)
+      lines.push(`        ${C.dim}not asked again in ${r.stale.runs} runs of ${r.role} since — likely no longer needed${C.off}\n`);
     const note = handoffNote(r.handoff);
     if (note) lines.push(`        ${C.yellow}${note}${C.off}\n`);
   });
@@ -118,6 +122,7 @@ export function grant(config, argv = []) {
   const i = argv.indexOf("--reason");
   const reason = i === -1 ? "" : argv[i + 1] ?? "";
 
+  refuseIfBarred(config, req);
   const before = readFileSync(config.path, "utf8");
   const { toml, changed } = applyGrant(before, req, reason);
   if (!changed) throw new Error(`${req.role} already has ${req.grant} — nothing to add`);

package/src/commands/review.js

@@ -20,6 +20,15 @@ import { C, out } from "../render.js";
 export function reviewCommand(config, argv = []) {
   const i = argv.indexOf("--min");
   const r = review(config, { minDenials: i === -1 ? 3 : Number(argv[i + 1]) });
+  // Ten rows per section unless --all: on a real 32-role log the full report
+  // was 1,557 lines, which nobody reads.
+  const all = argv.includes("--all");
+  const TOP = 10;
+  const cap = (list) => (all ? list : list.slice(0, TOP));
+  const more = (list) => {
+    if (!all && list.length > TOP) out(`    ${C.dim}… ${list.length - TOP} more: seisin review --all${C.off}\n`);
+  };
+  const who = (owners) => owners.length > 3 ? `${owners.slice(0, 3).join(", ")} +${owners.length - 3}` : owners.join(", ");
 
   if (!r.entries) {
     out(`\n  ${C.dim}nothing recorded yet. Run an agent through seisin first.${C.off}\n\n`);
@@ -33,10 +42,11 @@ export function reviewCommand(config, argv = []) {
     out(`\n  ${C.b}Stopped, repeatedly${C.off}\n`);
     out(`  ${C.dim}a role blocked on the same place over and over is a policy that is wrong,${C.off}\n`);
     out(`  ${C.dim}not an agent that is misbehaving${C.off}\n\n`);
-    for (const f of r.friction) {
-      const whose = f.owners.length ? ` ${C.dim}— belongs to ${f.owners.join(", ")}${C.off}` : "";
+    for (const f of cap(r.friction)) {
+      const whose = f.owners.length ? ` ${C.dim}— belongs to ${who(f.owners)}${C.off}` : "";
       out(`    ${C.yellow}${String(f.times).padStart(4)}×${C.off}  ${C.b}${f.role}${C.off} ${f.action} ${f.where}${whose}\n`);
     }
+    more(r.friction);
     out(`\n  ${C.dim}seisin grant, or move the territory. Either way it is a decision, not noise.${C.off}\n`);
   }
 
@@ -49,12 +59,28 @@ export function reviewCommand(config, argv = []) {
    * two roles the credential directory*. Separated, the same lines read as
    * confirmation instead of as a recommendation, which is what they are.
    */
+  /**
+   * Connections, apart from both of the above: a port is not a territory, so
+   * "grant, or move the territory" does not answer it, and it is not the policy
+   * working either when the service is one the role was meant to reach.
+   */
+  if (r.connects?.length) {
+    out(`\n  ${C.b}Refused connections${C.off}\n`);
+    out(`  ${C.dim}a local port or socket the role kept dialling. Not a grant: a port goes in${C.off}\n`);
+    out(`  ${C.dim}local_ports, and a socket stays closed${C.off}\n\n`);
+    for (const c of cap(r.connects))
+      out(`    ${C.yellow}${String(c.times).padStart(4)}×${C.off}  ${C.b}${c.role}${C.off} ${c.where}\n`);
+    more(r.connects);
+    out(`\n  ${C.dim}seisin walls <role> says, per target, which of the two it is.${C.off}\n`);
+  }
+
   if (r.guarded.length) {
     out(`\n  ${C.b}Held at the keys${C.off}\n`);
     out(`  ${C.dim}a [keys] dir is closed to every role, so this is the policy working${C.off}\n`);
     out(`  ${C.dim}— not a territory drawn wrong, and never a thing to grant${C.off}\n\n`);
-    for (const g of r.guarded)
+    for (const g of cap(r.guarded))
       out(`    ${C.dim}${String(g.times).padStart(4)}×${C.off}  ${C.b}${g.role}${C.off} ${g.action} ${g.where}\n`);
+    more(r.guarded);
     out(`\n  ${C.dim}Worth a look only if a role genuinely needs one of these: that is a${C.off}\n`);
     out(`  ${C.dim}\`keys\` line for the file, never a write grant on the directory.${C.off}\n`);
   }
@@ -76,14 +102,16 @@ export function reviewCommand(config, argv = []) {
     out(`\n  ${C.b}Granted, never used${C.off}\n`);
     out(`  ${C.dim}nothing was written here in the window above. This is the only evidence${C.off}\n`);
     out(`  ${C.dim}anyone will ever have for making a permission file smaller${C.off}\n\n`);
-    for (const u of r.unused) out(`    ${C.b}${u.role}${C.off}  ${u.glob}\n`);
+    for (const u of cap(r.unused)) out(`    ${C.b}${u.role}${C.off}  ${u.glob}\n`);
+    more(r.unused);
     out(`\n  ${C.dim}A short window proves nothing. Check the dates before you delete a line.${C.off}\n`);
   }
 
   if (r.unowned.length) {
     out(`\n  ${C.b}Owned by nobody${C.off}\n`);
     out(`  ${C.dim}touched by an agent, claimed by no role — holes in the map${C.off}\n\n`);
-    for (const u of r.unowned.slice(0, 10)) out(`    ${String(u.times).padStart(4)}×  ${u.where}\n`);
+    for (const u of cap(r.unowned)) out(`    ${String(u.times).padStart(4)}×  ${u.where}\n`);
+    more(r.unowned);
   }
 
   if (!r.friction.length && !r.guarded.length && !r.unused.length && !r.unowned.length && r.unusedKnowable)