seisin 0.4.0 → 0.4.2

package/README.md

@@ -38,7 +38,7 @@ says why, and a test holds one half of it.
 
 **The honest parts** · [How it holds](#how-it-holds) · [What it is not](#what-it-is-not) · [Why not a container](#why-not-a-container) · [Prior art](#prior-art) · [Status](#status)
 
-**Deeper** · [Keys](docs/keys.md) · [Agents](docs/agents.md) · [Day one](docs/first-day.md) · [Scratch](docs/scratch.md) · [Glossary](docs/glossary.md) · [What it has been put through](docs/what-it-has-been-put-through.md) · [Field notes](docs/field-notes.md) · [Decisions](docs/decisions.md) · [Permission requests](docs/permission-requests.md) · [Contributing](CONTRIBUTING.md)
+**Deeper** · [Keys](docs/keys.md) · [Agents](docs/agents.md) · [Day one](docs/first-day.md) · [Scratch](docs/scratch.md) · [Glossary](docs/glossary.md) · [What it has been put through](docs/what-it-has-been-put-through.md) · [Field notes](docs/field-notes.md) · [OpenShell compatibility](docs/openshell.md) · [Decisions](docs/decisions.md) · [nono backend contract](docs/nono-backend.md) · [Permission requests](docs/permission-requests.md) · [Contributing](CONTRIBUTING.md)
 
 </details>
 
@@ -161,8 +161,8 @@ fixtures:
 
 And three things that outweigh all of the above:
 
-1. **It is days old and has one author.** Around three thousand lines that nobody has
-   audited except its writer and one field report. "Secure" is not a word earned that fast.
+1. **It is young and has one author.** The first public release was September 2026, and the
+   implementation is still moving quickly. "Secure" is not a word earned by size or test count.
 2. **The enforcement is someone else's beta.** `sandbox-runtime` describes itself as a
    research preview with an evolving API. A hole there is a hole here.
 3. **Two platforms tested, by one person, on one machine each.**
@@ -672,7 +672,7 @@ This space already has good work, and seisin is not the first thing here:
 - [`anthropics/sandbox-runtime`](https://github.com/anthropics/sandbox-runtime) — the enforcement. seisin is a thin thing on top of a serious one.
 - [`kornysietsma/claude-code-permissions-hook`](https://github.com/kornysietsma/claude-code-permissions-hook) — granular `PreToolUse` rules, one global policy.
 - [`XuebinMa/agent-guard`](https://github.com/XuebinMa/agent-guard) — a permission-enforcement SDK, also one global policy.
-- [`NVIDIA/OpenShell`](https://github.com/NVIDIA/openshell) — a runtime that sandboxes an agent with Landlock and seccomp, under a declarative policy. Serious, and the closest thing here by weight.
+- [`NVIDIA/OpenShell`](https://github.com/NVIDIA/openshell) — a runtime that sandboxes an agent with Landlock and seccomp, under a declarative policy. Serious, and the closest thing here by weight. It was evaluated as a possible backend; [the measured compatibility decision](docs/openshell.md) explains why it is currently an execution target candidate rather than a drop-in replacement.
 - [`dredozubov/hazmat`](https://github.com/dredozubov/hazmat) — runs the agent as a different system user, with `pf` rules and snapshots.
 - [`nolabs-ai/nono`](https://github.com/nolabs-ai/nono) — a kernel sandbox for agents on the host (Seatbelt, Landlock), with per-tool child sandboxes, a credential proxy with endpoint filtering, approval webhooks and a tamper-evident audit log. The most complete sandbox here, and on a Mac the one that enforces through the same kernel seisin does. `nono why` explains *which rule* denied something and how to allow it; it has no notion of *whose* it was.
 - *Directory ownership* is recommended in half the multi-agent write-ups. As far as I could find, nobody enforces it, and nobody names the owner in the refusal. That gap is the reason for this repo.
@@ -692,25 +692,21 @@ They compose rather than compete: the agent seisin confines could be running ins
 them.
 
 *One detail worth knowing before you compare, and it is about placement rather than quality.
-Read from [OpenShell's support matrix][osm] on 2026-09-21, not measured here: macOS is a
-supported platform, and on it "these kernel modules run inside the Docker Desktop Linux VM,
-not on the host kernel". So on a Mac, OpenShell confines an agent inside a Linux VM, and
-seisin confines a process on the host through Seatbelt. Both are kernel enforcement; they are
-not the same kernel, and which one you want depends on whether the thing you are protecting is
-on the host. seisin [says where each of its own claims was
-measured](docs/what-it-has-been-put-through.md#where-each-claim-was-actually-run).*
-
-[osm]: https://docs.nvidia.com/openshell/reference/support-matrix
+OpenShell was [evaluated here on 2026-09-27](docs/openshell.md), through its Docker driver on
+an Intel Mac. That confines an agent inside Docker Desktop's Linux VM; seisin confines a
+process on the host through Seatbelt. OpenShell also offers other drivers, including a local
+microVM path on supported Apple Silicon Macs. These are kernel-enforced boundaries, but not
+the same kernel or workspace, and which one you want depends on what you are protecting.*
 
 ## Status
 
-`0.4.0`, 470 tests, of which **26 need `@anthropic-ai/sandbox-runtime` installed**
+`0.4.2`, 500 tests, of which **26 need `@anthropic-ai/sandbox-runtime` installed**
 and run real commands through the real kernel — and CI fails if the sandbox half *skips*, because
 a green run that quietly tested nothing looks exactly like a real one. That is not hypothetical:
 those eighteen skipped on Linux for a day, behind a runtime check that looked for the global
 install and missed the bundled one, and hid a defect that broke `seisin run` on that platform
-entirely. **326/326 on macOS 15 and on `ubuntu-latest` under bubblewrap**, nothing skipped on
-either, Node 18/20/22 in CI at every push — and 225/225 the same way on Debian 12.15
+entirely. **500 tests on macOS 15, 499 passing and 1 skipped** (it is Linux-only) — 2026-09-29;
+`ubuntu-latest` under bubblewrap runs the same suite, Node 18/20/22/24 in CI at every push — and 225/225 the same way on Debian 12.15
 with bubblewrap 0.8.0, the last time the suite was run in Docker.
 [Which claim was measured where](docs/what-it-has-been-put-through.md#where-each-claim-was-actually-run),
 and [what running agents behind it cost the people using it](docs/field-notes.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it blocks it tells you whose file it was.",
   "keywords": [
     "ai-agents",

package/src/commands/init.js

@@ -42,11 +42,19 @@ export function discover(root) {
     if (paths.length)
       return {
         source: p,
-        roles: [...new Set(paths)].slice(0, 8).map((g, i) => ({
-          name: g.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "") || `role-${i + 1}`,
-          writes: [g.endsWith("/") ? g + "**" : g],
-          keys: [],
-        })),
+        roles: [...new Set(paths)].slice(0, 8).map((g, i) => {
+          // CODEOWNERS anchors a leading "/" at the repo root; seisin's writes
+          // are already repo-relative, so a literal "/apps/**" would ask the
+          // kernel for the machine's /apps and make `explain` (which reads it as
+          // outside the repo) disagree with what the profile grants. Strip the
+          // anchor. A trailing "/" means a directory, so it becomes "/**".
+          const rel = g.replace(/^\/+/, "");
+          return {
+            name: rel.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "") || `role-${i + 1}`,
+            writes: [rel.endsWith("/") ? rel + "**" : rel],
+            keys: [],
+          };
+        }),
       };
   }
 

package/src/commands/log.js

@@ -10,7 +10,7 @@
  */
 import { createReadStream, watch as watchDir } from "node:fs";
 import { dirname, relative } from "node:path";
-import { read, logPath, size, verifyLog } from "../log.js";
+import { read, logPath, size, verifyLog, LOG_NAME } from "../log.js";
 import { renderEntry, C, out } from "../render.js";
 
 const flag = (argv, name) => {
@@ -50,14 +50,20 @@ function verify(config) {
   }
   const head = r.unchained ? `${r.unchained} line(s) from before the chain, then ` : "";
   const segs = r.segments > 1 ? ` across ${r.segments} segments` : "";
+  // A dropped entry leaves no hole in the chain, so it is reported on its own
+  // line rather than as a break: nothing was tampered with, but something is
+  // missing, and an intact chain must not read as a complete record.
+  const dropped = r.dropped
+    ? `  ${C.yellow}${r.dropped} entr${r.dropped === 1 ? "y was" : "ies were"} never written${C.off}  another writer held the lock too long; see ${LOG_NAME}.dropped\n`
+    : "";
   if (!r.breaks.length) {
-    out(`\n  ${C.green}intact${C.off}  ${head}${r.chained} chained line(s)${segs}\n\n`);
+    out(`\n  ${C.green}intact${C.off}  ${head}${r.chained} chained line(s)${segs}\n${dropped}\n`);
     return r;
   }
   out(`\n  ${C.red}broken${C.off}  ${head}${r.chained} chained line(s), ${r.breaks.length} break(s):\n`);
   for (const b of r.breaks.slice(0, 10))
     out(`    line ${b.line}: expected prev ${b.expected}, found ${b.found ?? "none"}\n`);
-  out(`  ${C.dim}a line was edited, removed or reordered just before each of these${C.off}\n\n`);
+  out(`  ${C.dim}a line was edited, removed or reordered just before each of these${C.off}\n${dropped}\n`);
   process.exitCode = 1;
   return r;
 }

package/src/commands/requests.js

@@ -6,10 +6,9 @@
  * person acting in a channel the agent does not have. That is the invariant the
  * whole feature rests on — see docs/permission-requests.md.
  */
-import { readFileSync, writeFileSync } from "node:fs";
-import { pending, settle, applyGrant, refuseIfBarred, requestsPath, markStale } from "../requests.js";
+import { pending, settle, applyGrant, refuseIfBarred, requestsPath, markStale, editPolicy } from "../requests.js";
 import { read, logPath } from "../log.js";
-import { C, out } from "../render.js";
+import { C, out, safe } from "../render.js";
 
 /**
  * Which request you meant — by position, or by the identity it carries.
@@ -40,16 +39,18 @@ function pick(config, n) {
     return req;
   }
 
-  const hits = queue.filter((r) => r.key === arg || r.key.startsWith(arg));
-  if (hits.length === 1) return hits[0];
-  if (!hits.length)
-    throw new Error(
-      `no pending request matches "${arg}".\n` +
-      "  Use its number, or the id printed under it by `seisin requests`.");
+  // Exactly, never by prefix. A prefix let an id that had just been settled
+  // select a newer request whose id merely starts the same (`lib` → `lib-x`),
+  // and an agent chooses the paths ids are made of.
+  const hit = queue.find((r) => r.key === arg);
+  if (hit) return hit;
+  const near = queue.filter((r) => r.key.startsWith(arg));
   throw new Error(
-    `"${arg}" matches ${hits.length} pending requests:\n` +
-    hits.slice(0, 5).map((r) => `    ${r.key}`).join("\n") +
-    "\n  Name one exactly. Choosing for you is the mistake this avoids.");
+    `no pending request has the id "${arg}".\n` +
+    (near.length
+      ? `  ${near.length} start with it:\n` + near.slice(0, 5).map((r) => `    ${r.key}`).join("\n") +
+        "\n  Name one exactly. Choosing for you is the mistake this avoids."
+      : "  Use its number, or the id printed under it by `seisin requests`."));
 }
 
 export function requests(config) {
@@ -66,11 +67,11 @@ export function renderQueue(queue) {
   queue.forEach((r, i) => {
     const owners = r.owners.length ? ` ${C.dim}(owned by ${r.owners.join(", ")})${C.off}` : ` ${C.dim}(unowned)${C.off}`;
     const times = r.times > 1 ? ` ${C.dim}· asked ${r.times}×${C.off}` : "";
-    lines.push(`    ${C.b}#${i + 1}${C.off}  ${r.role} wants ${r.action} on ${C.b}${r.grant}${C.off}${owners}${times}\n`);
-    lines.push(`        ${C.dim}first asked over ${r.target}${C.off}\n`);
+    lines.push(`    ${C.b}#${i + 1}${C.off}  ${safe(r.role)} wants ${r.action} on ${C.b}${safe(r.grant)}${C.off}${owners}${times}\n`);
+    lines.push(`        ${C.dim}first asked over ${safe(r.target)}${C.off}\n`);
       // The stable way to name it: a number is a position in a queue that agents
       // are still writing to, and this does not move when the queue does.
-      lines.push(`        ${C.dim}id ${r.key}${C.off}\n`);
+      lines.push(`        ${C.dim}id ${safe(r.key)}${C.off}\n`);
     // Marked, not moved: the number above is what `grant <n>` is typed against.
     if (r.stale)
       lines.push(`        ${C.dim}not asked again in ${r.stale.runs} runs of ${r.role} since — likely no longer needed${C.off}\n`);
@@ -123,11 +124,18 @@ export function grant(config, argv = []) {
   const reason = i === -1 ? "" : argv[i + 1] ?? "";
 
   refuseIfBarred(config, req);
-  const before = readFileSync(config.path, "utf8");
-  const { toml, changed } = applyGrant(before, req, reason);
+  // Under a lock, and written atomically: a concurrent grant (another terminal
+  // or the console) must not clobber this one. See editPolicy.
+  let changed;
+  try {
+    ({ changed } = editPolicy(config, (before) => applyGrant(before, req, reason)));
+  } catch (e) {
+    if (e.code === "ELOCKED")
+      throw new Error("another grant is in progress — run this again in a moment");
+    throw e;
+  }
   if (!changed) throw new Error(`${req.role} already has ${req.grant} — nothing to add`);
 
-  writeFileSync(config.path, toml);
   settle(requestsPath(config.root), req.key, "granted", reason);
   out(
     `\n  ${C.green}granted${C.off}  ${req.role} → ${C.b}${req.grant}${C.off}\n` +

package/src/commands/run.js

@@ -75,8 +75,21 @@ export async function run(config, argv) {
    */
   const split = argv.indexOf("--");
   const role = argv[0];
-  const mine = split === -1 ? argv.slice(1) : argv.slice(1, split);
-  const cmd = split === -1 ? argv.slice(1) : argv.slice(split + 1);
+  let mine, cmd;
+  if (split !== -1) {
+    mine = argv.slice(1, split);
+    cmd = argv.slice(split + 1);
+  } else {
+    // No `--`: seisin's own flags are the leading `-options` only. From the
+    // first token that is not an option, everything is the command — its own
+    // flags are its business. `seisin run x echo hi --observe` used to read
+    // `--observe` as seisin's and put the run in observe mode; now that flag
+    // belongs to `echo`, and observe needs `seisin run x --observe -- echo hi`.
+    let i = 1;
+    while (i < argv.length && argv[i].startsWith("-")) i++;
+    mine = argv.slice(1, i);
+    cmd = argv.slice(i);
+  }
   if (!role || cmd.length === 0) throw new Error("usage: seisin run <role> -- <command...>");
   if (!config.roles[role])
     throw new Error(`unknown role "${role}". Known: ${Object.keys(config.roles).join(", ")}`);

package/src/config.js

@@ -52,6 +52,8 @@ function dict() {
   return Object.create(null);
 }
 
+const isTable = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
 /** Read a property only if the object actually has it. */
 export function own(obj, key) {
   return obj && Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : undefined;
@@ -88,8 +90,12 @@ export function parseToml(text) {
           `A later block would silently override the earlier one — put every setting for ` +
           `${tableName} in one place.`);
       seenTables.add(tableName);
-      table = tableName.split(".").reduce((node, key) => {
+      table = tableName.split(".").reduce((node, key, k, parts) => {
         if (!Object.prototype.hasOwnProperty.call(node, key)) node[key] = dict();
+        else if (!isTable(node[key]))
+          throw new Error(
+            `${CONFIG_NAME}:${i + 1}: [${tableName}] — "${parts.slice(0, k + 1).join(".")}" is already ` +
+            `a value, not a table. One name cannot be both.`);
         return node[key];
       }, out);
       continue;
@@ -99,9 +105,18 @@ export function parseToml(text) {
     if (!pair) throw new Error(`${CONFIG_NAME}:${i + 1}: cannot read "${raw.trim()}"`);
 
     let [, key, value] = pair;
-    // An array may span lines; keep pulling until the brackets balance.
+    // An array may span lines; keep pulling until the brackets balance. Only
+    // the new line is searched: searching the whole growing value made an
+    // unclosed array of 100k lines take 20 s to be refused.
     if (value.startsWith("[") && !value.includes("]")) {
-      while (!value.includes("]") && i + 1 < lines.length) value += " " + stripComment(lines[++i]).trim();
+      const parts = [value];
+      let closed = false;
+      while (!closed && i + 1 < lines.length) {
+        const next = stripComment(lines[++i]).trim();
+        parts.push(next);
+        closed = next.includes("]");
+      }
+      value = parts.join(" ");
     }
     if (FORBIDDEN.has(key))
       throw new Error(`${CONFIG_NAME}:${i + 1}: "${key}" is a reserved name and cannot be a setting.`);
@@ -111,6 +126,20 @@ export function parseToml(text) {
         `${CONFIG_NAME}:${i + 1}: "${key}" is set twice in [${tableName || "the root"}]. ` +
         `The second would win, which is not a thing a permission file should do quietly.`);
     seenKeys.add(seen);
+    /**
+     * A key may not be a table that is declared elsewhere, in either order.
+     *
+     * `[roles.a]` with `network = []`, then `[roles]` and `a = true` forty lines
+     * down, used to replace the whole role with `true`: its `network = []` came
+     * back as "not set", which means the global allow list. `check` said
+     * nothing. It is the "last one wins" this parser refuses everywhere else,
+     * arriving by a different spelling.
+     */
+    if (Object.prototype.hasOwnProperty.call(table, key))
+      throw new Error(
+        `${CONFIG_NAME}:${i + 1}: "${key}" in [${tableName || "the root"}] is already the table ` +
+        `[${tableName ? tableName + "." : ""}${key}]. One name cannot be both — the value would replace ` +
+        `everything that table says.`);
     table[key] = readValue(value, i + 1);
   }
   return out;
@@ -255,9 +284,10 @@ function readValue(value, lineNo) {
 export function readIsolate(v) {
   if (v === true || v === "home") return "home";
   if (v === "credentials") return "credentials";
-  // Anything else is off, including a misspelling. A permission tool must not
-  // read a word it does not know as a stronger setting than the reader meant.
-  return false;
+  if (v === false || v === undefined) return false;
+  throw new Error(
+    `runtime.isolate must be false, true, "credentials", or "home", not ${JSON.stringify(v)}. ` +
+    `An unknown value cannot silently turn credential isolation off.`);
 }
 
 export function loadConfig(path) {
@@ -269,6 +299,16 @@ export function loadConfig(path) {
   // they prevent is invisible in review — the config reads one way and the
   // policy is another.
   const roles = own(parsed, "roles") ?? {};
+  // `roles = "x"` or `roles = [...]` at the root, or `[roles]` with `a = true`,
+  // would read as roles named "0", "1" or "a" with no settings of their own —
+  // and a role with nothing set gets the global defaults.
+  if (!isTable(roles))
+    throw new Error(`${path}: "roles" must be tables — [roles.<name>] — not ${JSON.stringify(roles)}`);
+  for (const [name, r] of Object.entries(roles))
+    if (!isTable(r))
+      throw new Error(
+        `${path}: roles.${name} = ${JSON.stringify(r)} — a role is a table, [roles.${name}], ` +
+        `with its settings under it.`);
 
   /**
    * A role is a leaf. `[roles.a.b]` is a typo, with certainty.
@@ -295,6 +335,19 @@ export function loadConfig(path) {
   }
   const names = Object.keys(roles);
   if (names.length === 0) throw new Error(`${path}: no [roles.<name>] sections found`);
+  // Case-colliding names would share a HOME under `isolate = "home"` on a
+  // case-insensitive disk (APFS), so `dev` and `Dev` would read each other's
+  // secrets while `check` said nothing. Refuse the ambiguity at load.
+  {
+    const byLower = new Map();
+    for (const n of names) {
+      const k = n.toLowerCase();
+      if (byLower.has(k))
+        throw new Error(`${path}: roles "${byLower.get(k)}" and "${n}" differ only in case. ` +
+          `On a case-insensitive disk they would share an isolated HOME. Rename one.`);
+      byLower.set(k, n);
+    }
+  }
 
   // One directory or several. Several is the common case once a repo has more
   // than one kind of secret, and making people flatten them to satisfy the tool
@@ -323,7 +376,7 @@ export function loadConfig(path) {
 
   for (const name of names) {
     const r = own(roles, name);
-    const writes = asArray(own(r, "writes"), `roles.${name}.writes`);
+    const writes = assertNotAbsolute(asArray(own(r, "writes"), `${path}: roles.${name}.writes`), `${path}: roles.${name}.writes`);
     const keys = asArray(own(r, "keys"), `roles.${name}.keys`);
     // Read once, here, so every consumer sees the same answer about what an
     // entry is. `keys` itself stays the array of strings that was written: it
@@ -614,6 +667,25 @@ function readNeverWrites(value, where) {
   return list;
 }
 
+/**
+ * A territory is relative to the repo root. An absolute one would ask the kernel
+ * for a path on the machine and make `explain` (which reads absolute as outside
+ * the repo) disagree with what the profile grants — see the CODEOWNERS `/apps/`
+ * case. `..` is allowed on purpose: a role legitimately writes a sibling
+ * directory (`../bitacora/...`), and it is resolved relative to the root, so a
+ * territory that climbs above it grants what it resolves to, by the operator's
+ * choice.
+ */
+function assertNotAbsolute(list, where) {
+  for (const g of list) {
+    if (typeof g !== "string" || g.trim() === "")
+      throw new Error(`${where}: every entry must be a non-empty string`);
+    if (g.startsWith("/"))
+      throw new Error(`${where}: "${g}" is absolute. Territories are relative to the repo root.`);
+  }
+  return list;
+}
+
 function asArray(value, where) {
   if (value === undefined) return [];
   if (typeof value === "string") return [value];

package/src/intake.js

@@ -161,7 +161,10 @@ export function intake({ config, role, runId, observe = false, settings, notify
     // The owners explain found: for a key that is who declares it, not who
     // writes the directory it sits in — the queue said "owned by dev" about
     // backend's key because dev writes `**`.
-    ask({ role, action: entry.action, target: entry.target, owners: v.owners });
+    // Capped like the log line above: a request's target is a path, and an
+    // uncapped one (5k+ chars were accepted) is a way to bloat the queue a
+    // person reads. 1000 is more than any real path and matches the log.
+    ask({ role, action: entry.action, target: entry.target.slice(0, 1000), owners: v.owners });
   }
 
   function fromKernel(d) {

package/src/log.js

@@ -13,7 +13,7 @@
  * tries the parent's socket first for exactly that reason; writing the file
  * directly is what happens when there is no parent, outside the box.
  */
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { basename, dirname, join } from "node:path";
 import { STATE_DIR, LOG_NAME } from "./layout.js";
@@ -47,13 +47,27 @@ export function append(file, entry) {
       // sits on disk, so verifying needs nothing but the file.
       const line = JSON.stringify({ at: new Date().toISOString(), ...entry, prev: hashOf(lastLine(file)) });
       appendFileSync(file, line + "\n");
-    });
+    }, { waitMs: envInt("SEISIN_LOG_LOCK_WAIT_MS", 6000) });
     return true;
-  } catch {
+  } catch (e) {
+    // A line that could not get the lock is gone, and a missing line does not
+    // break the chain. Say so beside the log, so `verify` can.
+    if (e?.code === "ELOCKED") {
+      try { appendFileSync(droppedPath(file), JSON.stringify({ at: new Date().toISOString(), role: entry?.role, event: entry?.event }) + "\n"); } catch {}
+    }
     return false;
   }
 }
 
+/** Where entries that could not be written are counted. */
+export function droppedPath(file) {
+  return file + ".dropped";
+}
+
+function countLines(file) {
+  try { return readFileSync(file, "utf8").split("\n").filter((l) => l.trim()).length; } catch { return 0; }
+}
+
 /**
  * When the current segment fills, retire it and start a fresh one that still
  * chains.
@@ -156,23 +170,73 @@ function lastLine(file) {
 /**
  * One writer at a time. Several roles of a round run at once and write this
  * same file; two of them reading the same last line would fork the chain.
- * A lock left by a killed process is taken over after a few seconds.
+ *
+ * The lock names its holder (pid and a nonce). A lock whose holder is gone is
+ * taken over at once; one whose holder cannot be read is taken over once it is
+ * older than `staleMs`. The wait outlasts that age on purpose: a writer that
+ * died holding the lock can never make the next one give up, so the only entry
+ * ever dropped is one that waited on a writer still alive — and that drop is
+ * counted beside the log (see `append`), because a missing line does not break
+ * the chain and would otherwise not show.
  */
-function withLock(file, fn) {
+export function withLock(file, fn, { waitMs = 6000, staleMs = 5000 } = {}) {
   const lock = file + ".lock";
-  const deadline = Date.now() + 2000;
+  const deadline = Date.now() + waitMs;
+  const mine = `${process.pid} ${createHash("sha256").update(String(Math.random()) + Date.now()).digest("hex").slice(0, 12)}\n`;
+  let acquired = false;
   for (;;) {
     try {
-      closeSync(openSync(lock, "wx"));
+      const fd = openSync(lock, "wx");
+      try { writeSync(fd, mine); } finally { closeSync(fd); }
+      acquired = true;
       break;
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
-      try { if (Date.now() - statSync(lock).mtimeMs > 5000) { unlinkSync(lock); continue; } } catch {}
-      if (Date.now() > deadline) break;          // never block the run over bookkeeping
+      if (reapable(lock, staleMs)) continue;
+      // Never write without the lock. Doing so forks the hash chain; deleting
+      // the lock in `finally` then admits still more writers while its owner is
+      // active. The log is bookkeeping and append() may fail without taking the
+      // agent down, so dropping this entry is safer than fabricating evidence.
+      if (Date.now() > deadline) {
+        const error = new Error(`could not acquire log lock within ${waitMs} ms`);
+        error.code = "ELOCKED";
+        throw error;
+      }
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5);
     }
   }
-  try { return fn(); } finally { try { unlinkSync(lock); } catch {} }
+  try { return fn(); }
+  finally {
+    // Remove it only while it is still ours: if it was taken over, it now
+    // belongs to someone else.
+    if (acquired) try { if (readFileSync(lock, "utf8") === mine) unlinkSync(lock); } catch {}
+  }
+}
+
+/** True if the process is still there. EPERM means it is, and not ours to signal. */
+function alive(pid) {
+  try { process.kill(pid, 0); return true; }
+  catch (e) { return e.code !== "ESRCH"; }
+}
+
+/**
+ * Removes a lock whose holder is gone, and says whether it did.
+ *
+ * The content is read again just before removing it, so a waiter that decided
+ * on one lock does not remove a newer one another waiter has just taken.
+ */
+function reapable(lock, staleMs) {
+  let seen, mtime;
+  try { seen = readFileSync(lock, "utf8"); mtime = statSync(lock).mtimeMs; } catch { return true; }
+  const pid = Number(seen.split(" ")[0]);
+  const named = Number.isInteger(pid) && pid > 0;
+  // A named holder that is alive is waited on, however long it takes: its age
+  // says nothing about whether it is done. An unnamed one (an older seisin, or
+  // killed between creating the file and writing its name) goes by age.
+  const gone = named ? !alive(pid) : Date.now() - mtime > staleMs;
+  if (!gone) return false;
+  try { if (readFileSync(lock, "utf8") !== seen) return true; unlinkSync(lock); } catch {}
+  return true;
 }
 
 /**
@@ -230,7 +294,7 @@ export function verifyChain(file, seed = GENESIS) {
  */
 export function verifyLog(file) {
   const segs = logSegments(file);
-  const agg = { lines: 0, unchained: 0, chained: 0, breaks: [], segments: segs.length };
+  const agg = { lines: 0, unchained: 0, chained: 0, breaks: [], segments: segs.length, dropped: countLines(droppedPath(file)) };
   let seed = GENESIS;
   for (const seg of segs) {
     const r = walk(seg, { seed, startLine: agg.lines });
@@ -285,6 +349,14 @@ export function observed(entries) {
   const roles = new Map();
   for (const e of entries) {
     if (!e.role || !e.target) continue;
+    // A line the parent flagged as `disputed` is one whose verdict did not
+    // match the policy the run started with — either the config changed under
+    // it, or the line was not written by the hook at all. Either way it is not
+    // evidence of what the role legitimately reached for, so it must not become
+    // policy: `init --from-observations` builds `writes`/`keys` from here, and a
+    // process inside the box could otherwise send `verdict:"observed"` lines for
+    // paths outside its territory and have them proposed as its own.
+    if (e.disputed) continue;
     const r = roles.get(e.role) ?? { writes: new Set(), keys: new Set() };
     if (e.action === "read" && e.kind === "key") r.keys.add(e.target);
     else if (e.action === "write") r.writes.add(e.target);