seisin 0.4.0 → 0.4.2

package/src/mcp.js

@@ -31,7 +31,7 @@ import { loadConfig, findConfig } from "./config.js";
 import { inspect } from "./inspect.js";
 import { explain, ownersOf } from "./owners.js";
 import { settingsFor } from "./srt.js";
-import { pending, requestsPath, grantFor, refuseIfBarred, markStale } from "./requests.js";
+import { pending, requestsPath, grantFor, refuseIfBarred, markStale, shellId } from "./requests.js";
 import { read, logPath } from "./log.js";
 import { causesOf } from "./serve.js";
 import { walls, wasted } from "./walls.js";
@@ -100,13 +100,22 @@ const TOOLS = [
     name: "seisin_causes",
     description:
       "Denials grouped by what was denied — by path, and one level coarser by the name at " +
-      "the end of it — with how many are on paths no role owns. This is the question " +
-      "`seisin_activity` cannot answer: the raw log has the events, this has them counted " +
-      "against the policy as it stands, so a cause that has been granted since stops " +
-      "counting. Reach for it before proposing a change: a day that is three quarters one " +
-      "filename is a tooling problem, and the same volume spread across unrelated paths is " +
-      "a question about who owns what. Read-only.",
-    inputSchema: { type: "object", properties: { limit: { type: "number" } } },
+      "the end of it — over the whole log, or since an ISO date. The counts are history: " +
+      "what was refused. What is measured against the policy as it stands is where each " +
+      "path is now — `standing`: unowned (a decision nobody has made), owned, protected " +
+      "(closed to every role on purpose, nothing to grant) or outside (a port, a key, or " +
+      "outside the repository) — and, per cause, `stillRefused`, how many of the roles " +
+      "that hit it would hit it today. `seisin_activity` has the raw events; this has " +
+      "them read against the policy. Reach for it before proposing a change: a day that " +
+      "is three quarters one filename is a tooling problem, and the same volume spread " +
+      "across unrelated unowned paths is a question about who owns what. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number" },
+        since: { type: "string", description: "ISO date; only refusals at or after it" },
+      },
+    },
   },
   {
     name: "seisin_walls",
@@ -127,8 +136,10 @@ const TOOLS = [
       "does not grant. The approval is a human action in another channel.",
     inputSchema: {
       type: "object",
-      properties: { number: { type: "number", description: "position in seisin_requests" } },
-      required: ["number"],
+      properties: {
+        id: { type: "string", description: "the request's id from seisin_requests — preferred: it does not move when the queue does" },
+        number: { type: "number", description: "position in seisin_requests (legacy; the draft still names the id)" },
+      },
     },
   },
 ];
@@ -166,6 +177,8 @@ const HANDLERS = {
     // not enforced is documentation.
     if (action !== "read" && action !== "write" && action !== "mcp")
       throw new Error(`action must be "read", "write" or "mcp", got ${JSON.stringify(action)}`);
+    if (typeof role !== "string" || !role)
+      throw new Error("role must be a non-empty string");
     if (typeof target !== "string" || !target)
       throw new Error("target must be a non-empty path");
     const cfg = config();
@@ -182,14 +195,14 @@ const HANDLERS = {
     const queue = markStale(pending(requestsPath(cfg.root)), read(logPath(cfg.root)));
     return {
       pending: queue.map((r, i) => ({
-        number: i + 1, role: r.role, action: r.action,
+        number: i + 1, id: r.key, role: r.role, action: r.action,
         wants: r.grant, ownedBy: r.owners, asked: r.times, lastAsked: r.last,
         ...(r.stale ? { stale: `not asked again in ${r.stale.runs} runs of ${r.role} since` } : {}),
       })),
       // Said in the payload and not only in the tool description, because a
       // model reading this is deciding what to do next.
       note: queue.length
-        ? "Approving is not available through MCP. Tell the operator to run: seisin grant <number>"
+        ? "Approving is not available through MCP. Tell the operator to run: seisin grant '<id>'"
         : "nothing waiting",
     };
   },
@@ -203,13 +216,21 @@ const HANDLERS = {
    * and asks it to re-derive the grouping — without the policy, which is the
    * half that makes the grouping mean anything.
    */
-  seisin_causes({ limit }) {
+  seisin_causes({ limit, since }) {
     const cfg = config();
-    const c = causesOf(cfg, read(logPath(cfg.root), { limit: 4000 }));
+    // The whole log, as the console reads it. This read the last 4000 lines
+    // after the console had stopped doing so, and the two then disagreed about
+    // the same log — 3,999 refusals here against 6,630 there, measured — with
+    // nothing telling the agent its window was half of the person's.
+    const t = since ? Date.parse(since) : NaN;
+    const from = Number.isNaN(t) ? null : new Date(t).toISOString();
+    const c = causesOf(cfg, read(logPath(cfg.root), from ? { since: from } : {}));
     return {
       total: c.total,
       distinct: c.distinct,
+      ...(from && { since: from }),
       unowned: c.unowned,
+      standing: c.standing,
       families: c.families,
       causes: typeof limit === "number" ? c.causes.slice(0, limit) : c.causes,
     };
@@ -237,12 +258,23 @@ const HANDLERS = {
     return { entries: read(logPath(cfg.root), { role, verdict, limit: n }) };
   },
 
-  seisin_draft_grant({ number }) {
-    if (!Number.isInteger(Number(number)) || Number(number) < 1)
-      throw new Error("number must be a positive integer from seisin_requests");
+  seisin_draft_grant({ id, number } = {}) {
     const cfg = config();
-    const req = pending(requestsPath(cfg.root))[Number(number) - 1];
-    if (!req) throw new Error(`no pending request #${number}`);
+    const queue = pending(requestsPath(cfg.root));
+    let req;
+    if (typeof id === "string" && id) {
+      req = queue.find((r) => r.key === id);
+      if (!req) throw new Error(`request ${id} is not pending`);
+    } else {
+      if (!Number.isInteger(Number(number)) || Number(number) < 1)
+        throw new Error("id (preferred) or number from seisin_requests is required");
+      req = queue[Number(number) - 1];
+      if (!req) throw new Error(`no pending request #${number}`);
+    }
+    // The command is written against the id, whatever was asked with: a
+    // number is a position in a queue agents keep writing to, and the person
+    // runs this later, against the queue as it is then.
+    const ref = shellId(req.key);
 
     // The same refusal `seisin grant` and the console apply, asked here first.
     // Without it this drafted, as approvable, a request that `never_writes`
@@ -255,7 +287,7 @@ const HANDLERS = {
         ownedBy: req.owners,
         applyWith: null,
         note: "Not approvable as it stands: never_writes wins over writes. Decline it with " +
-          `\`seisin decline ${number}\`, or remove the never_writes entry if the subtraction is wrong.`,
+          `\`seisin decline ${ref}\`, or remove the never_writes entry if the subtraction is wrong.`,
       };
     }
     const field = req.action === "read" ? "keys" : "writes";
@@ -263,7 +295,8 @@ const HANDLERS = {
       wouldAdd: { role: req.role, field, value: req.grant },
       preview: `[roles.${req.role}]\n${field} = [ …, "${req.grant}" ]   # asked ${req.times}×`,
       ownedBy: req.owners,
-      applyWith: `seisin grant ${number} --reason "<why>"`,
+      id: req.key,
+      applyWith: `seisin grant ${ref} --reason "<why>"`,
       note: "Not applied. seisin's MCP server writes nothing — a person runs the command above.",
     };
   },
@@ -284,7 +317,10 @@ function handle(message, { write, version }) {
   const reply = (id, result) => send({ jsonrpc: "2.0", id, result });
   const fail = (id, code, msg) => send({ jsonrpc: "2.0", id, error: { code, message: msg } });
 
-  const { id, method, params = {} } = message;
+  const { id, method } = message;
+  // `?? {}` so an explicit null params (not just missing) does not crash the
+  // dispatcher and leave the request unanswered.
+  const params = message.params ?? {};
 
   // A notification has no id and takes no answer. Replying to one is a protocol
   // error that some clients tolerate and others hang on.
@@ -310,8 +346,11 @@ function handle(message, { write, version }) {
     case "tools/list":
       return reply(id, { tools: TOOLS });
     case "tools/call": {
-      const fn = HANDLERS[params.name];
-      if (!fn) return fail(id, -32602, `unknown tool "${params.name}"`);
+      // hasOwn, not a bare lookup: `params.name` of "constructor" or
+      // "hasOwnProperty" would otherwise resolve to a function on Object's
+      // prototype and be invoked as a tool.
+      const fn = Object.hasOwn(HANDLERS, params.name) ? HANDLERS[params.name] : null;
+      if (typeof fn !== "function") return fail(id, -32602, `unknown tool ${JSON.stringify(params.name)}`);
       try {
         const result = fn(params.arguments ?? {});
         // Content, not a bare object: every client renders `content`, and only

package/src/notify.js

@@ -24,7 +24,7 @@
  */
 import { readFileSync } from "node:fs";
 import { basename, join } from "node:path";
-import { keyOf, pending, requestsPath, grantFor } from "./requests.js";
+import { keyOf, pending, requestsPath, grantFor, shellId } from "./requests.js";
 
 export const FORMATS = ["text", "json", "slack"];
 export const ENV_URL = "SEISIN_NOTIFY_URL";
@@ -46,13 +46,13 @@ export function message(config, req, number, format = "text") {
   const owner = req.owners?.length ? `It belongs to ${req.owners.join(", ")}.` : "Nobody owns it.";
   const text =
     `seisin (${basename(config.root)}): ${req.role} was refused ${req.action} on ${req.target}. ${owner} ` +
-    `Approve: seisin grant ${number} · decline: seisin decline ${number}`;
+    `Approve: seisin grant ${shellId(keyOf(req))} · decline: seisin decline ${shellId(keyOf(req))}`;
   if (format === "slack") return { type: "application/json", body: JSON.stringify({ text }) };
   if (format === "json")
     return {
       type: "application/json",
       body: JSON.stringify({
-        text, repo: basename(config.root), number, role: req.role, action: req.action,
+        text, repo: basename(config.root), number, id: keyOf(req), role: req.role, action: req.action,
         target: req.target, owners: req.owners ?? [], grant: grantFor(req),
       }),
     };

package/src/owners.js

@@ -10,7 +10,8 @@
  * agents have to read each other's code to do anything useful. Keys are the
  * exception, and they are handled separately below.
  */
-import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { protectedBy } from "./surface.js";
 
@@ -45,7 +46,7 @@ export function covers(glob, path) {
   // The path itself, or anything beneath it. The `/` is load-bearing: without
   // it `src/api` would also cover `src/apifoo.ts`, which the kernel does not.
   if (m.prefix !== null) return p === m.prefix || p.startsWith(m.prefix + "/");
-  return m.re.test(p);
+  return matchGlob(m.glob, p);
 }
 
 /**
@@ -68,7 +69,7 @@ function matcherOf(glob) {
   if (m) return m;
   let g = normalize(glob);
   if (glob.endsWith("/")) g += "/**";
-  m = WILD.test(g) ? { prefix: null, re: toRegExp(g) } : { prefix: g, re: null };
+  m = WILD.test(g) ? { prefix: null, glob: g } : { prefix: g, glob: null };
   if (GLOBS.size >= MAX_CACHED) GLOBS.clear();
   GLOBS.set(glob, m);
   return m;
@@ -126,18 +127,66 @@ export function normalize(s) {
  * must not: covering one file too many costs an argument, covering one too few
  * is the hole. When the two readings disagree, this one takes the wider set.
  */
-function toRegExp(glob) {
-  const out = glob
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-    .replace(/\/\*\*$/, "\u0001")
-    .replace(/\*\*\//g, "\u0002")
-    .replace(/\*\*/g, "\u0003")
-    .replace(/\*/g, "[^/]*")
-    .replace(/\?/g, "[^/]")
-    .replace(/\u0001/g, "(?:/.*)?")
-    .replace(/\u0002/g, "(?:.*/)?")
-    .replace(/\u0003/g, ".*");
-  return new RegExp("^" + out + "$");
+/**
+ * Does `glob` cover `path`? A linear matcher, not a regular expression.
+ *
+ * The regex form (`**` → `.*`, `**\/` → `(?:.*\/)?`) put several unbounded `.*`
+ * next to literals, and on a long path that does not match, the engine
+ * backtracks catastrophically: measured on a crafted glob, 9 `**` took ~26 s
+ * and 11 hung for over a minute. Since a request's target — which an agent
+ * chooses — becomes a glob here (`grantFor`), that is a denial-of-service on the
+ * hook and on `explain`. This matcher is memoised on (glob index, path index),
+ * so its cost is bounded by their product and no input backtracks.
+ *
+ * Same wildcards as before: `?` one non-`/`, `*` a run of non-`/`, `**` any run
+ * including `/`, `**\/` zero or more whole directories, a trailing `/**` the
+ * subtree. Characters are compared literally; nothing is treated as regex.
+ */
+function matchGlob(glob, path) {
+  const G = glob.length, P = path.length;
+  // memo[gi * (P+1) + pi]: 0 unknown, 1 true, 2 false. One flat array, reused.
+  const memo = new Uint8Array((G + 1) * (P + 1));
+  const at = (gi, pi) => {
+    for (;;) {
+      const key = gi * (P + 1) + pi;
+      const seen = memo[key];
+      if (seen) return seen === 1;
+      let res;
+      if (gi === G) { res = pi === P; }
+      else if (glob[gi] === "*" && glob[gi + 1] === "*") {
+        if (glob[gi + 2] === "/") {
+          // `**/` = zero or more whole directories: empty, or any chars ending
+          // at a `/` then the rest.
+          if (at(gi + 3, pi)) res = true;
+          else if (pi < P) {
+            if (path[pi] === "/" && at(gi + 3, pi + 1)) res = true;
+            else { memo[key] = 2; pi++; continue; }   // consume one char, stay on `**/`
+          } else res = false;
+        } else {
+          // `**` = any run including `/` (also covers `**` at the very end,
+          // where `at(gi+2, pi)` requires pi to reach the end).
+          if (at(gi + 2, pi)) res = true;
+          else if (pi < P) { memo[key] = 2; pi++; continue; }  // consume one char, stay on `**`
+          else res = false;
+        }
+      } else if (glob[gi] === "/" && glob[gi + 1] === "*" && glob[gi + 2] === "*" && gi + 3 === G) {
+        // trailing `/**`: the directory itself, or anything beneath it.
+        res = pi === P || path[pi] === "/";
+      } else if (glob[gi] === "*") {
+        // `*` = a run of non-`/`.
+        if (at(gi + 1, pi)) res = true;
+        else if (pi < P && path[pi] !== "/") { memo[key] = 2; pi++; continue; }
+        else res = false;
+      } else if (glob[gi] === "?") {
+        res = pi < P && path[pi] !== "/" && at(gi + 1, pi + 1);
+      } else {
+        res = pi < P && glob[gi] === path[pi] && at(gi + 1, pi + 1);
+      }
+      memo[key] = res ? 1 : 2;
+      return res;
+    }
+  };
+  return at(0, 0);
 }
 
 /** Is this path inside a `.git` directory (git's metadata, not a working file)? */
@@ -166,6 +215,82 @@ export function ownersOf(config, path) {
     .map((r) => r.name);
 }
 
+/**
+ * Where a refused target stands against the policy as it is now.
+ *
+ * One of four, and only the last one is a decision somebody has to make:
+ *
+ *   outside    not a place in the map at all — a port, a key directory, or a
+ *              path outside the repository, which no `writes` reaches
+ *   protected  closed to every role on purpose (surface.js); the boundary
+ *              working, with nothing to grant
+ *   owned      some role's territory today
+ *   unowned    in the repository, ownable, and nobody claims it
+ *
+ * Computed from the policy, never from the `owners` a log line carries. That
+ * value is what was true the day of the refusal; every grant made since makes
+ * it more wrong, so a screen reading it gets worse the more seisin is used the
+ * way it is meant to be. Measured on one deployment: the console said 1,178 of
+ * 1,486 refused paths had no owner; against the policy of that day it was 316.
+ * The rest had been claimed since, were protected, or were not paths at all.
+ */
+export function standing(config, entry) {
+  const target = entry.target;
+  if (entry.kind === "network")
+    return { kind: "outside", owners: [], why: "a port or a socket, which no role owns" };
+  if (entry.kind === "key")
+    return { kind: "outside", owners: [], why: "a key directory, closed on purpose" };
+  const guard = protectedBy(config, target);
+  if (guard) return { kind: "protected", owners: [], why: guard.why };
+  if (target.startsWith("/")) {
+    const root = config.root?.endsWith("/") ? config.root : `${config.root}/`;
+    if (!config.root || !target.startsWith(root))
+      return { kind: "outside", owners: [], why: "outside the repository, where no role's territory reaches" };
+  }
+  const owners = ownersOf(config, target);
+  return { kind: owners.length ? "owned" : "unowned", owners };
+}
+
+/**
+ * `standing`, remembered while the policy stays the same.
+ *
+ * The console asks for its whole state every two seconds, and a real log has
+ * well over a thousand distinct refused paths: classifying all of them costs
+ * most of a second each time (measured: ~400 ms in protectedBy, ~335 ms in
+ * ownersOf), on a call that already took about that long. What a path's
+ * standing depends on is the policy file, so that is the key. It also depends,
+ * a little, on the disk — on Linux a control file is protected only once it
+ * exists — so the memory is dropped after a minute as well, which bounds how
+ * stale an answer can be without paying for it on every poll.
+ *
+ * A config that was not read from a file (tests, embedders) gets a memory for
+ * this call only.
+ */
+const STANDING_TTL = 60_000;
+let standingMemo = { key: null, at: 0, map: new Map() };
+
+export function standingOf(config, { now = Date.now() } = {}) {
+  let map;
+  let key = null;
+  try {
+    if (config.path) key = `${config.path}\u0000${createHash("sha256").update(readFileSync(config.path)).digest("hex")}`;
+  } catch {
+    key = null;
+  }
+  if (key === null) map = new Map();
+  else {
+    if (standingMemo.key !== key || now - standingMemo.at > STANDING_TTL)
+      standingMemo = { key, at: now, map: new Map() };
+    map = standingMemo.map;
+  }
+  return (entry) => {
+    const k = `${entry.kind ?? ""}\u0000${entry.target}`;
+    let s = map.get(k);
+    if (!s) map.set(k, (s = standing(config, entry)));
+    return s;
+  };
+}
+
 /**
  * The `never_writes` entries the kernel will actually be given for this role.
  *

package/src/render.js

@@ -25,6 +25,17 @@ export const C =
       }
     : { dim: "", b: "", off: "", red: "", green: "", yellow: "", blue: "" };
 
+/**
+ * A value chosen by an agent (a target, a grant, an id) made safe to print.
+ *
+ * `target` and the id built from it are strings the agent picked, and they were
+ * written to the terminal raw. Terminal escape sequences (ESC, CR, other C0
+ * controls) let such a string repaint the line a person reads before approving.
+ * On disk they are already JSON-escaped; this is for the screen. Stripped, not
+ * rendered, so what shows is the literal path with the control bytes removed.
+ */
+export const safe = (s) => String(s ?? "").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+
 export const out = (s) => process.stdout.write(s);
 export const err = (s) => process.stderr.write(s);
 
@@ -125,7 +136,7 @@ export function renderReport(report) {
 /** The `explain` answer, as text. Takes what `owners.explain()` returns. */
 export function renderVerdict(role, action, target, verdict) {
   const head = verdict.allowed ? `${C.green}allowed${C.off}` : `${C.yellow}denied${C.off}`;
-  return `\n  ${head}  ${C.b}${role}${C.off} ${action} ${target}\n  ${C.dim}${verdict.reason}${C.off}\n\n`;
+  return `\n  ${head}  ${C.b}${role}${C.off} ${action} ${safe(target)}\n  ${C.dim}${safe(verdict.reason)}${C.off}\n\n`;
 }
 
 /* ── the log ──────────────────────────────────────────────────────────── */
@@ -149,7 +160,7 @@ export function renderEntry(e) {
   // about a run, a reader needs to know which line is which without going to
   // the file — so the one that carries more weight is the one that is marked.
   const from = e.source === "kernel" ? `  ${C.dim}[kernel]${C.off}` : "";
-  return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off} ${e.action} ${e.target}${owners}${from}\n`;
+  return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off} ${e.action} ${safe(e.target)}${owners}${from}\n`;
 }
 
 /* ── the scan ─────────────────────────────────────────────────────────── */

package/src/requests.js

@@ -27,10 +27,11 @@
  * deleted — it is followed by a line saying what happened to it.
  */
 import { neverWrites, isGitMetadata, covers } from "./owners.js";
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { STATE_DIR, tomlString } from "./layout.js";
 import { send } from "./spool.js";
+import { withLock } from "./log.js";
 
 export const REQUESTS_NAME = "requests.jsonl";
 
@@ -57,6 +58,17 @@ export function keyOf({ role, action, target }) {
 }
 
 /** The glob a grant would add, derived from what was asked. */
+/**
+ * A request's id as one shell word, for the commands seisin suggests.
+ *
+ * The id carries a path an agent chose, so it is single-quoted whole and any
+ * quote inside it is closed and escaped: pasting the suggestion runs `seisin
+ * grant` on that request and nothing else.
+ */
+export function shellId(key) {
+  return `'${String(key).replace(/'/g, `'\\''`)}'`;
+}
+
 export function grantFor({ action, target }) {
   const t = typeof target === "string" ? target : "";
   // A key keeps its directory when it has one. Stripping it turned a request
@@ -283,6 +295,32 @@ export function refuseIfBarred(config, request) {
       `rewrite another owner's history. Decline it; a role that needs to commit gets a worktree of its own.`);
 }
 
+/**
+ * Apply one policy edit under a lock, and write it atomically.
+ *
+ * `grant` and the console both did read → applyGrant → write with no lock, so
+ * two approvals racing (a person at the CLI and one on the console, or two
+ * terminals) lost one edit: the queue marked both granted while `seisin.toml`
+ * kept only the last writer's change (measured: 39 of 40 concurrent pairs). The
+ * lock serialises them — it already survives a writer that died holding it
+ * (see log.js) — and the write goes to a temp file then renames over the config,
+ * so a crash mid-write cannot leave a half-written, partly-privileged policy.
+ *
+ * `mutate(toml)` returns `{ toml, changed }`. Nothing is written when unchanged.
+ */
+export function editPolicy(config, mutate, { waitMs = 10000 } = {}) {
+  return withLock(config.path, () => {
+    const before = readFileSync(config.path, "utf8");
+    const result = mutate(before);
+    if (result.changed) {
+      const tmp = `${config.path}.tmp-${process.pid}`;
+      writeFileSync(tmp, result.toml);
+      renameSync(tmp, config.path);
+    }
+    return result;
+  }, { waitMs });
+}
+
 export function applyGrant(toml, request, note = "") {
   const field = request.action === "read" ? "keys" : "writes";
   const header = new RegExp(`^\\[roles\\.${escapeRe(request.role)}\\]\\s*$`, "m");
@@ -295,9 +333,8 @@ export function applyGrant(toml, request, note = "") {
   const to = next ? from + next.index : toml.length;
   const section = toml.slice(from, to);
 
-  const line = new RegExp(`^(${field}\\s*=\\s*)\\[([^\\]]*)\\]`, "m");
-  const m = line.exec(section);
-  if (!m)
+  const open = new RegExp(`^${field}\\s*=\\s*\\[`, "m").exec(section);
+  if (!open)
     throw new Error(
       `[roles.${request.role}] has no ${field} list to grant into. ` +
       `Add \`${field} = []\` to that section first — seisin will not write it into another role's block.`
@@ -309,20 +346,60 @@ export function applyGrant(toml, request, note = "") {
   // loads, after they approved something, is its own kind of broken.
   tomlString(request.grant);   // refuses what the format cannot hold
 
-  const items = (m[2].match(/"[^"]*"/g) ?? []).map((s) => s.slice(1, -1));
-  if (items.includes(request.grant)) return { toml, changed: false };
+  const start = open.index + open[0].length;
+  const list = scanList(section, start);
+  if (list.items.includes(request.grant)) return { toml, changed: false };
 
+  /**
+   * Appended, never rebuilt.
+   *
+   * The list used to be re-written from every quoted string between its
+   * brackets — comments included. `"src/web/**",  # was "src/**"` came back as
+   * two grants, so approving anything also granted what a comment mentioned,
+   * and the reason an approver typed (quoted in the provenance comment) became
+   * a path on the next approval. Every earlier provenance comment was lost on
+   * the way. Now the items are the strings outside comments, what is there is
+   * left as it is, and the new entry goes last. The reason is set off with
+   * «», never a double quote, so no older reader can take it for a value.
+   */
+  let inner = section.slice(start, list.end).replace(/\s+$/, "");
+  if (list.lastItemEnd !== null && !list.commaAfterLast) {
+    const at = list.lastItemEnd - start;
+    inner = inner.slice(0, at) + "," + inner.slice(at);
+  }
   const stamp = `# granted ${new Date().toISOString().slice(0, 10)} · asked ${request.times}×` +
-                `${note ? ` · "${cleanReason(note)}"` : ""}`;
-  const body = [...items, request.grant]
-    .map((v) => `  "${v}"${v === request.grant ? `,   ${stamp}` : ","}`)
-    .join("\n")
-    .replace(/,(\s*#[^\n]*)?$/, "$1");
-
-  const edited = section.replace(line, `$1[\n${body}\n]`);
+                `${note ? ` · «${cleanReason(note)}»` : ""}`;
+  const edited = section.slice(0, start) + `${inner}\n  "${request.grant}"   ${stamp}\n]` + section.slice(list.end + 1);
   return { toml: toml.slice(0, from) + edited + toml.slice(to), changed: true };
 }
 
+/**
+ * The strings of a TOML array that starts at `start` (just past its `[`),
+ * skipping comments, and where it closes. The subset has no escapes, so a
+ * string runs to the next double quote.
+ */
+function scanList(text, start) {
+  const items = [];
+  let lastItemEnd = null;
+  let commaAfterLast = false;
+  for (let i = start; i < text.length; i++) {
+    const c = text[i];
+    if (c === "#") { const nl = text.indexOf("\n", i); if (nl === -1) break; i = nl; continue; }
+    if (c === '"') {
+      const close = text.indexOf('"', i + 1);
+      if (close === -1) break;
+      items.push(text.slice(i + 1, close));
+      lastItemEnd = close + 1;
+      commaAfterLast = false;
+      i = close;
+      continue;
+    }
+    if (c === ",") { commaAfterLast = true; continue; }
+    if (c === "]") return { items, end: i, lastItemEnd, commaAfterLast };
+  }
+  throw new Error(`the ${text.slice(0, 40).trim()}… list never closes; fix the config by hand before granting`);
+}
+
 /**
  * The approver's own words, made safe to put in a config file.
  *

package/src/review.js

@@ -28,7 +28,7 @@
  * means nothing without "…in how long".
  */
 import { read, logPath } from "./log.js";
-import { covers, ownersOf } from "./owners.js";
+import { covers, standingOf } from "./owners.js";
 
 /**
  * One reading of the log against the policy.
@@ -122,7 +122,10 @@ function findings(config, entries, minDenials) {
    * than full — a consumer that has never heard of `unusedKnowable` then reports
    * nothing instead of everything, which is the direction this has to fail in.
    */
-  const knowable = entries.some((e) => e.verdict === "allowed");
+  // A disputed line is the parent saying the verdict did not match the policy
+  // — often a forged line. It is not evidence of legitimate use, so it neither
+  // makes the window knowable nor marks a territory used.
+  const knowable = entries.some((e) => e.verdict === "allowed" && !e.disputed);
 
   // Only writes. A key that is declared and not read is ordinary — most roles
   // hold a credential for the one turn a month that needs it — but a folder a
@@ -130,7 +133,7 @@ function findings(config, entries, minDenials) {
   // miss, and the only evidence anyone will ever have for removing it.
   const used = new Set();
   for (const e of entries) {
-    if (e.verdict !== "allowed" || e.action !== "write" || !e.target) continue;
+    if (e.verdict !== "allowed" || e.disputed || e.action !== "write" || !e.target) continue;
     for (const role of Object.values(config.roles))
       for (const glob of role.writes)
         if (role.name === e.role && covers(glob, e.target)) used.add(`${role.name} ${glob}`);
@@ -144,12 +147,17 @@ function findings(config, entries, minDenials) {
 
   /* ── 3. what nobody owns ────────────────────────────────────────────── */
 
+  // The same classification the console and `seisin_causes` use, so the word
+  // means one thing everywhere. A key directory is closed on purpose, a port is
+  // not a path, a protected file is closed to every role and a path outside
+  // the repository is outside every territory: none of them is a hole in the
+  // map. This used to skip keys and ports and count the rest, protected ones
+  // included, while the console counted all four — one word, two numbers.
   const unowned = new Map();
+  const standOf = standingOf(config);
   for (const e of entries) {
-    // A key directory is closed on purpose; a port or a socket is not a path
-    // anybody could own. Neither is a hole in the map.
-    if (!e.target || e.kind === "key" || e.kind === "network") continue;
-    if (ownersOf(config, e.target).length) continue;
+    if (!e.target) continue;
+    if (standOf(e).kind !== "unowned") continue;
     const dir = dirOf(e.target);
     unowned.set(dir, (unowned.get(dir) ?? 0) + 1);
   }