dos-kernel 0.28.0__tar.gz → 0.29.0__tar.gz

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dos-kernel
-Version: 0.28.0
+Version: 0.29.0
 Summary: Dispatch Operating System — the domain-free trust substrate for fleets of autonomous agents (verdict spine, ship oracle, structured refusal, lane arbiter, correlation spine).
 Author: Anthony Chaudhary
 License: MIT
@@ -128,7 +128,7 @@ install is one small Python package.
 > entries there undoes it. (No runtime detected? It says so and lists the
 > names to pick from — it never guesses.)
 
-<sub>**v0.28.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
+<sub>**v0.29.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
 smoke run · the only runtime dependency is **PyYAML** · **MIT**.</sub>
 
 > 🧭 **Where to go next:** the [why & evidence](https://github.com/anthony-chaudhary/dos-kernel/blob/master/docs/guide/why-a-referee.md) (plain-words story, the 20-lines-of-bash answer, what's proven),
@@ -370,6 +370,21 @@ verdict vocabulary, from the agent's tool call to your dashboard.
 
 *Next level up — run it every day: [Operating a fleet](#operating-a-fleet).*
 
+## From the same team
+
+DOS is one of three open tools from [Anthony Chaudhary](https://github.com/anthony-chaudhary)
+for running AI agents you can actually trust — at three different moments:
+
+- **[fak — the agent kernel](https://github.com/anthony-chaudhary/fak)** — DOS reads *what an
+  agent already did* (after the fact, from git and other witnesses it can't forge); `fak` governs
+  *what an agent is allowed to do* as it happens. A single static Go binary that fronts your token
+  engine and adjudicates every tool call at the boundary — capability gate, tool-result
+  quarantine, audit trail — the inline gate to DOS's out-of-loop referee. `go install
+  github.com/anthony-chaudhary/fak/cmd/fak@latest` · [docs](https://anthony-chaudhary.github.io/fak/).
+- **[Diffgram](https://github.com/diffgram/diffgram)** — the AI datastore for human supervision of
+  AI *data* (labeling, workflow, catalog). Where DOS and `fak` supervise the *agents*, Diffgram
+  supervises the *data* they learn from and produce.
+
 ## Citation
 
 The ideas here are written up in a paper — *"Verification Is All You Need — But

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/README.md

@@ -74,7 +74,7 @@ install is one small Python package.
 > entries there undoes it. (No runtime detected? It says so and lists the
 > names to pick from — it never guesses.)
 
-<sub>**v0.28.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
+<sub>**v0.29.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
 smoke run · the only runtime dependency is **PyYAML** · **MIT**.</sub>
 
 > 🧭 **Where to go next:** the [why & evidence](https://github.com/anthony-chaudhary/dos-kernel/blob/master/docs/guide/why-a-referee.md) (plain-words story, the 20-lines-of-bash answer, what's proven),
@@ -316,6 +316,21 @@ verdict vocabulary, from the agent's tool call to your dashboard.
 
 *Next level up — run it every day: [Operating a fleet](#operating-a-fleet).*
 
+## From the same team
+
+DOS is one of three open tools from [Anthony Chaudhary](https://github.com/anthony-chaudhary)
+for running AI agents you can actually trust — at three different moments:
+
+- **[fak — the agent kernel](https://github.com/anthony-chaudhary/fak)** — DOS reads *what an
+  agent already did* (after the fact, from git and other witnesses it can't forge); `fak` governs
+  *what an agent is allowed to do* as it happens. A single static Go binary that fronts your token
+  engine and adjudicates every tool call at the boundary — capability gate, tool-result
+  quarantine, audit trail — the inline gate to DOS's out-of-loop referee. `go install
+  github.com/anthony-chaudhary/fak/cmd/fak@latest` · [docs](https://anthony-chaudhary.github.io/fak/).
+- **[Diffgram](https://github.com/diffgram/diffgram)** — the AI datastore for human supervision of
+  AI *data* (labeling, workflow, catalog). Where DOS and `fak` supervise the *agents*, Diffgram
+  supervises the *data* they learn from and produce.
+
 ## Citation
 
 The ideas here are written up in a paper — *"Verification Is All You Need — But

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 # src/), and the console scripts stay `dos` / `dos-mcp` — only the pip-install /
 # dependency-pin name is `dos-kernel`. See SECURITY.md "Supply chain".
 name = "dos-kernel"
-version = "0.28.0"
+version = "0.29.0"
 description = "Dispatch Operating System — the domain-free trust substrate for fleets of autonomous agents (verdict spine, ship oracle, structured refusal, lane arbiter, correlation spine)."
 # The PyPI project page renders this. Point it at the README so the page isn't
 # blank below the metadata (twine warns when it's missing). PyPI resolves

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/src/dos/__init__.py

@@ -46,7 +46,7 @@ try:
 
     __version__ = _pkg_version("dos-kernel")
 except Exception:  # pragma: no cover - source-tree / not-installed fallback
-    __version__ = "0.28.0"
+    __version__ = "0.29.0"
 
 from dos import config  # noqa: F401  (re-export the seam as the package entry)
 from dos.config import (  # noqa: F401

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/src/dos/account_auth.py

@@ -138,6 +138,36 @@ class AccountAuthSpec:
             out[self.token_env] = token
         return out
 
+    def launch_env(
+        self,
+        account: object | None = None,
+        *,
+        config_dir: str | None = None,
+        token: Optional[str] = None,
+    ) -> dict[str, str]:
+        """The env-override to (re)launch a worker as one seat of this agent.
+
+        The SINGLE builder every consumer uses — the launcher and the rotate-on-wall
+        handoff (docs/386 §4) — so neither branches on the agent NAME. It prefers this
+        spec's disk-aware ``launch_env_fn`` (a CAPABILITY, not a name: Claude's docs/380
+        ``env_for``, which defers to a fresh ``.credentials.json`` rather than freezing a
+        static token into a live session) when it is set AND an ``account`` object is
+        supplied; otherwise it falls to the pure ``env_overrides`` floor built from
+        ``config_dir`` (+ optional ``token``). A consumer reads ``spec.launch_env_fn``
+        ONLY through this method, never ``if kind == "claude"`` (the vendor-blindness
+        litmus).
+
+        Fail-LOUD by design: a ``launch_env_fn`` that raises (Claude's ``OriginError`` on
+        a missing/logged-out config dir) propagates — launching under the WRONG or empty
+        identity is the hazard this contract exists to prevent, so it must fail, never
+        emit a logged-out env. ``account`` is opaque (the callable's own type); the
+        kernel does not import it.
+        """
+        if self.launch_env_fn is not None and account is not None:
+            env = self.launch_env_fn(account)
+            return dict(env) if isinstance(env, dict) else {}
+        return self.env_overrides(config_dir or "", token=token)
+
 
 # --------------------------------------------------------------------------- #
 # By-name resolution — in-tree driver first, then the dos.account_auth group.

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/src/dos/admission.py

@@ -1,7 +1,7 @@
 """The admission-predicate seam — Axis 3 of hackability: pluggable safety hooks (ADM, docs/73).
 
-The arbiter's admission logic — `_lease_blocks` + the ≤30 % soft-overlap
-tree-disjointness rule (`lane_overlap.overlap_verdict`) — is the kernel's
+The arbiter's admission logic — known-tree intersection plus shared/exclusive
+lock compatibility, with the legacy ratio scorer still selectable by config — is the kernel's
 **safety element**: it is what stops two agents editing the same files
 concurrently. That logic used to be fixed. A workspace could not add its own
 admission rule ("refuse a new lease when over the monthly token budget,"
@@ -158,19 +158,18 @@ class AdmissionRequest:
     tree: tuple[str, ...]
     command: str = ""
     arg_values: tuple[str, ...] = ()
+    mode: str = ""
 
 
 class DisjointnessPredicate:
     """The built-in tree-disjointness predicate — today's fixed admission rule,
     now the FIRST registered predicate.
 
-    Delegates the both-known scoring to a resolved `overlap_policy.OverlapPolicy`
-    (default `PrefixOverlapPolicy`, AND-ed under the deterministic prefix floor),
-    while owning the empty-tree asymmetry itself. With the default policy the
-    floor-AND reproduces `lane_overlap.overlap_verdict` exactly, so routing the
-    arbiter's collision check through `run_predicates([DisjointnessPredicate()])`
-    stays byte-for-byte behavior-preserving (the load-bearing litmus: the entire
-    existing arbiter/overlap suite is green through this path).
+    Delegates the both-known scoring to a resolved `overlap_policy.OverlapPolicy`.
+    The default is `LockModeOverlapPolicy`: EXCLUSIVE/EXCLUSIVE intersections
+    refuse at zero tolerance while SHARED/SHARED intersections admit. The legacy
+    `PrefixOverlapPolicy` is still selectable explicitly, where it is AND-ed under
+    the deterministic prefix floor.
 
     The **empty-tree rules** (asymmetric on the lease side) are owned HERE, not in
     the policy — they are soundness invariants about *unknown blast radius*, not a
@@ -184,13 +183,13 @@ class DisjointnessPredicate:
       * both known → delegate to the policy via `admissible_under_floor`.
 
     ``policy`` is the scorer for the both-known case. It defaults to the built-in
-    `PrefixOverlapPolicy` (pure, no I/O — so a `DisjointnessPredicate()` with no
-    args is pure and byte-identical to the old inline rule). A boundary caller
+    `LockModeOverlapPolicy` (pure, no I/O). A boundary caller
     (`built_in_predicates`) resolves a workspace's declared `dos.overlap_policies`
     plugin and passes it in here — the resolve-at-the-boundary, I/O-free-hot-path
     discipline `SelfModifyPredicate`'s `runtime_files` already uses. Whatever the
-    policy is, `admissible_under_floor` AND-s it under the unforgeable prefix floor,
-    so a misbehaving policy can only refuse-more, never admit a collision.
+    non-lock policy is, `admissible_under_floor` AND-s it under the unforgeable
+    prefix floor, so a misbehaving scorer can only refuse-more, never admit a
+    legacy prefix collision.
     """
 
     name = "disjointness"
@@ -200,13 +199,13 @@ class DisjointnessPredicate:
         # same leaf `admission` already imports — no cycle, but keep it local so a
         # default-constructed predicate has zero extra import cost on the hot path).
         if policy is None:
-            from dos.overlap_policy import PrefixOverlapPolicy
-            policy = PrefixOverlapPolicy()
+            from dos.overlap_policy import LockModeOverlapPolicy
+            policy = LockModeOverlapPolicy()
         self._policy = policy
 
     def __call__(self, request: AdmissionRequest, live_lease: dict,
                  config: object) -> AdmissionVerdict:
-        from dos.overlap_policy import admissible_under_floor
+        from dos.overlap_policy import admissible_under_floor, lock_mode_decision
         requested_tree = list(request.tree)
         lease_tree = list(live_lease.get("tree") or [])
         if not lease_tree:
@@ -218,7 +217,15 @@ class DisjointnessPredicate:
                 f"{live_lease.get('lane')!r} — unknown blast radius is never "
                 f"safe to admit concurrently."
             )
-        ov = admissible_under_floor(self._policy, requested_tree, lease_tree, config)
+        if getattr(self._policy, "name", "") == "lock_modes":
+            ov = lock_mode_decision(
+                requested_tree,
+                lease_tree,
+                requested_mode=request.mode,
+                lease_mode=live_lease.get("mode", live_lease.get("lock_mode", "")),
+            )
+        else:
+            ov = admissible_under_floor(self._policy, requested_tree, lease_tree, config)
         if ov.admissible:
             return AdmissionVerdict.admit()
         return AdmissionVerdict.refuse(
@@ -390,10 +397,10 @@ def built_in_predicates(*, workspace=None, config=None) -> list[AdmissionPredica
 
     The **overlap policy** (the both-known disjointness scorer) is resolved HERE
     too, at the boundary, and threaded into `DisjointnessPredicate(policy=…)` — so
-    the pure `arbitrate` never does the discovery I/O that resolving a non-`prefix`
+    the pure `arbitrate` never does the discovery I/O that resolving a third-party
     policy needs. With no `config` (or a config naming no policy / the built-in
-    `prefix`), `active_overlap_policy` returns `PrefixOverlapPolicy` with NO
-    discovery, so the default predicate list is byte-identical to before the seam.
+    `lock_modes`), `active_overlap_policy` returns `LockModeOverlapPolicy` with NO
+    discovery, so the default predicate list uses the sound S/X lock-mode rule.
     A workspace that declares `dos.toml [overlap] policy = "import-graph"` (or sets
     `config.overlap_policy_name`) gets its plugin resolved and AND-ed under the
     deterministic prefix floor inside the predicate.

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/src/dos/answer_shape.py

@@ -42,9 +42,13 @@ The three states (mutually exclusive):
                         viability length, and matches no disqualifying marker. Shaped
                         like an answer. (NOT a claim of correctness — see the boundary.)
   * ``NON_ANSWER``    — structurally disqualified: empty/whitespace-only, below the
-                        viability floor, OR matches a declared non-answer marker (a
+                        viability floor, OVER the verbosity ceiling, degenerated into a
+                        repeating loop, OR matches a declared non-answer marker (a
                         process/CoT-log signature, a bare-refusal signature, a stub).
-                        The q_025 catch. The dangerous case a grounding gate misses.
+                        The q_025 catch (the stub/CoT end) PLUS the opposite failures the
+                        same shape guard should see — the runaway/padded dump and the
+                        decode-degeneration loop (the verbosity/drift end). The dangerous
+                        case a grounding gate misses.
   * ``INDETERMINATE`` — no policy supplied, or the text is non-trivial but the policy
                         cannot disqualify it on shape — the abstain floor. The semantic
                         "is it a good answer?" residue goes here, to a JUDGE / HUMAN.
@@ -116,6 +120,34 @@ class AnswerShapePolicy:
     (the RAG app's q_025 leaked-CoT was 5,780 chars, so length alone never catches that;
     the *markers* do — length catches the opposite failure, the empty/stub end).
 
+    ``max_viable_chars`` is the SYMMETRIC ceiling — the verbosity/bloat end the floor
+    can't see. Above it, a non-empty output is a runaway/padded generation, structurally
+    not a focused answer (the q_025 leaked-CoT was *long*; gross length is itself a
+    structural tell once a host declares its budget). Default ``0`` DISABLES the ceiling
+    (no upper bound) — exactly like the floor's default-1 only-empty behavior, the host
+    declares the threshold; the kernel never guesses a length budget (the "ceiling fixed
+    by the source, never inferred from content" rule, docs/156 §3.2). Still SHAPE, not
+    quality: a host setting a ceiling is declaring "in my domain an answer over N chars
+    is structurally a dump", the same kind of host call as setting ``min_viable_chars``.
+
+    ``max_repeat_ratio`` is the DEGENERATION guard — the drift-into-a-loop failure where
+    a generation collapses into repeating the same line/sentence (the classic decode
+    degeneration, and the most common *mechanism* of padded verbosity). It is the
+    fraction of repeated (non-distinct) units the output may carry before it is
+    structurally a non-answer: ``repeat_ratio = (n_units - n_distinct) / n_units`` over
+    the segmented units (see ``_repeat_ratio``). Above the threshold ⇒ NON_ANSWER.
+    Default ``0.0`` DISABLES it (the fail-safe UNDER-disqualify direction — the kernel
+    ships the *mechanism*, the host opts in with a threshold like ``0.5``). Mechanically
+    checkable and domain-free, so it stays inside the SHAPE boundary: a text that is
+    mostly the same sentence over and over is not an answer regardless of the topic.
+
+    ⚠ SCOPE IT TO PROSE. The metric is the fraction of EXACT (stripped+casefolded)
+    duplicate units — content-blind, not semantic. So a list/table/CSV/log channel whose
+    rows legitimately repeat a short literal (``- N/A`` ten times, a ``| --- |`` rule)
+    will read as high-ratio and be disqualified. That is WHY it defaults off and the host
+    opts in: point ``max_repeat_ratio`` at free-prose answer channels, not at structured
+    output, where exact-row repetition is a feature, not degeneration.
+
     ``non_answer_patterns`` is the host's closed set of disqualifying regexes — a
     process/CoT-log signature, a bare-refusal signature, a tool-call dump. Matched
     case-insensitively, in a `search` (anywhere in the text). The kernel ships a generic
@@ -133,6 +165,8 @@ class AnswerShapePolicy:
     """
 
     min_viable_chars: int = 1
+    max_viable_chars: int = 0
+    max_repeat_ratio: float = 0.0
     non_answer_patterns: tuple[str, ...] = ()
     answer_markers: tuple[str, ...] = ()
 
@@ -193,6 +227,35 @@ class AnswerShapeVerdict:
         }
 
 
+# The minimum number of segmented units before a repeat ratio is meaningful. Below it
+# there is too little signal to call degeneration, so the guard ABSTAINS (under-
+# disqualify — the same fail-safe direction as `_safe_search`). A short Q&A like
+# "Yes. No. Yes." must never trip the loop guard; a real degeneration repeats many times.
+_MIN_REPEAT_UNITS = 4
+
+# Segment on sentence terminators OR newlines, so a degeneration is caught whether it
+# repeats one-unit-per-line or many-sentences-on-one-line.
+_UNIT_SPLIT = re.compile(r"[.!?\n]+")
+
+
+def _repeat_ratio(text: str) -> tuple[float, int]:
+    """The fraction of REPEATED (non-distinct) units in ``text``, and the unit count.
+
+    Splits ``text`` into units on sentence terminators / newlines, normalizes each
+    (stripped + casefolded), drops empties, and returns
+    ``((n_units - n_distinct) / n_units, n_units)``. A clean answer with all-distinct
+    units scores ~0; a generation that has collapsed into repeating one line/sentence
+    approaches 1. PURE; returns ``(0.0, n)`` when there are too few units to judge (the
+    caller's `_MIN_REPEAT_UNITS` floor makes that an abstain, never a disqualification).
+    """
+    units = [u.strip().casefold() for u in _UNIT_SPLIT.split(text)]
+    units = [u for u in units if u]
+    n = len(units)
+    if n < 2:
+        return 0.0, n
+    return (n - len(set(units))) / n, n
+
+
 def _safe_search(pattern: str, text: str) -> bool:
     """Case-insensitive `re.search`, fail-safe to False on a bad pattern.
 
@@ -224,12 +287,18 @@ def classify(
       2. ``text`` empty / whitespace-only  → NON_ANSWER (nothing was delivered).
       3. ``len(text) < min_viable_chars``  → NON_ANSWER (below the viability floor — a
                                              stub / ack token, not an answer).
-      4. a ``non_answer_patterns`` hit     → NON_ANSWER (a process/CoT-log / bare-refusal
+      4. ``max_viable_chars`` set AND
+         ``len(text) > max_viable_chars``  → NON_ANSWER (over the verbosity/bloat ceiling
+                                             — a runaway/padded dump, not a focused answer).
+      5. a ``non_answer_patterns`` hit     → NON_ANSWER (a process/CoT-log / bare-refusal
                                              / tool-dump signature — the q_025 catch).
-      5. ``answer_markers`` non-empty AND
+      6. ``max_repeat_ratio`` set AND the
+         repeat ratio exceeds it           → NON_ANSWER (degenerated into a loop — the
+                                             same line/sentence over and over; drift).
+      7. ``answer_markers`` non-empty AND
          none matched                      → INDETERMINATE (the strict host required a
                                              positive answer marker and found none; abstain).
-      6. otherwise                         → ANSWER_SHAPED (no disqualifier; shaped like
+      8. otherwise                         → ANSWER_SHAPED (no disqualifier; shaped like
                                              an answer — NOT a claim of correctness).
 
     Returns an `AnswerShapeVerdict`; NEVER raises. Remember the boundary: a `NON_ANSWER`
@@ -268,6 +337,18 @@ def classify(
                     f"answer (NON_ANSWER)"),
         )
 
+    ceiling = int(policy.max_viable_chars)
+    if ceiling > 0 and len(stripped) > ceiling:
+        return AnswerShapeVerdict(
+            state=AnswerShape.NON_ANSWER,
+            length=n,
+            matched="",
+            reason=(f"output is {len(stripped)} non-space chars, over the verbosity "
+                    f"ceiling of {ceiling} — a runaway/padded dump, not a focused "
+                    f"answer (NON_ANSWER; a SHAPE call on the host's length budget, "
+                    f"not a correctness judgment)"),
+        )
+
     for pat in policy.non_answer_patterns:
         if _safe_search(pat, raw):
             return AnswerShapeVerdict(
@@ -279,6 +360,20 @@ def classify(
                         f"answer (the grounded-but-not-an-answer catch, docs/156 §4)"),
             )
 
+    repeat_cap = float(policy.max_repeat_ratio)
+    if repeat_cap > 0.0:
+        ratio, units = _repeat_ratio(raw)
+        if units >= _MIN_REPEAT_UNITS and ratio > repeat_cap:
+            return AnswerShapeVerdict(
+                state=AnswerShape.NON_ANSWER,
+                length=n,
+                matched="",
+                reason=(f"output repeat ratio {ratio:.2f} over {units} units exceeds "
+                        f"the degeneration cap of {repeat_cap:.2f} — collapsed into "
+                        f"repeating the same line/sentence (NON_ANSWER; a structural "
+                        f"loop/drift tell, not a correctness judgment)"),
+            )
+
     if policy.answer_markers:
         if not any(_safe_search(m, raw) for m in policy.answer_markers):
             return AnswerShapeVerdict(

{dos_kernel-0.28.0 → dos_kernel-0.29.0}/src/dos/arbiter.py

@@ -23,13 +23,14 @@ would later stand on.
 
 What this arbiter *is*, named after its mechanism rather than the "lane" metaphor:
 a **lock manager whose granularity is a glob-set** — a lane is a *leased
-predicate-lock over a region of the workspace*, admitted by predicate-disjointness
-(`_tree.prefixes_collide` is the predicate-intersection test; the soft-overlap
-ratio in `lane_overlap` is a *loosened lock-compatibility function*, not a
-swim-lane fudge). The capability-lattice above is then **the same primitive over a
-richer predicate algebra than path-prefixes** — a new `prefixes_collide`, not a new
-arbiter. See `docs/89_the-lane-is-a-region-lock.md` (which is also the forward
-litmus for what belongs in here: a region-lock property, never a swim-lane one).
+predicate-lock over a region of the workspace*, admitted by predicate-intersection
+plus lock compatibility (`lock_modes`: SHARED/SHARED may coexist; anything with
+EXCLUSIVE needs tree-disjointness). The legacy soft-overlap ratio remains a
+configurable scorer, but it is no longer the default admission floor. The
+capability-lattice above is then **the same primitive over a richer predicate
+algebra than path-prefixes** — a new `prefixes_collide`, not a new arbiter. See
+`docs/89_the-lane-is-a-region-lock.md` (which is also the forward litmus for what
+belongs in here: a region-lock property, never a swim-lane one).
 """
 
 from __future__ import annotations
@@ -98,9 +99,10 @@ def _lease_blocks(requested_tree: list[str], lease_tree: list[str]) -> bool:
         is never safe).
       * both empty → does NOT block (lone-loop safe).
 
-    Both-known delegates to `dos.lane_overlap.overlap_verdict` — a ratio-only
-    soft-overlap policy (admit when ≤30 % of the requested tree shares prefixes
-    with the lease). Pure; tested in isolation.
+    Legacy helper: both-known delegates to `dos.lane_overlap.overlap_verdict`, the
+    explicit prefix/ratio scorer. The default admission path now runs through
+    `DisjointnessPredicate` and `lock_modes`; this remains for old exact callers
+    that deliberately ask the ratio question.
     """
     if not lease_tree:
         return False
@@ -112,26 +114,26 @@ def _lease_blocks(requested_tree: list[str], lease_tree: list[str]) -> bool:
 def _admission_verdict(
     *, lane: str, kind: str, tree: list[str], live_leases: list[dict],
     predicates: list[AdmissionPredicate], config: SubstrateConfig,
+    mode: str = "",
 ) -> AdmissionVerdict:
     """Run the FULL admission conjunction for a candidate lane (ADM Phase 1).
 
     The single seam every collision check in `arbitrate` now routes through: the
-    built-in `DisjointnessPredicate` (a behavior-preserving wrap of the old inline
-    `_lease_blocks` / `overlap_verdict`) PLUS `SelfModifyPredicate` PLUS any
-    workspace-discovered predicate, composed conjunctively by
-    `admission.run_predicates` (first refusal wins; all-admit ⇒ admit; a predicate
-    that raises is a fail-closed refuse). The disjointness predicate alone
-    reproduces the legacy verdict exactly, so the existing suite stays green; the
-    extra predicates can only ADD refusals (the conjunctive-only invariant), never
-    loosen, so a disjoint job-lane pair still admits.
+    built-in `DisjointnessPredicate` (default S/X lock-mode compatibility) PLUS
+    `SelfModifyPredicate` PLUS any workspace-discovered predicate, composed
+    conjunctively by `admission.run_predicates` (first refusal wins; all-admit ⇒
+    admit; a predicate that raises is a fail-closed refuse). Extra predicates can
+    only ADD refusals (the conjunctive-only invariant), never loosen, so a
+    disjoint job-lane pair still admits.
     """
-    request = AdmissionRequest(lane=lane, kind=kind, tree=tuple(tree or ()))
+    request = AdmissionRequest(lane=lane, kind=kind, tree=tuple(tree or ()), mode=mode)
     return run_predicates(predicates, request, live_leases, config)
 
 
 def _lease_collision(
     *, lane: str, kind: str, tree: list[str], live_leases: list[dict],
     predicates: list[AdmissionPredicate], config: SubstrateConfig,
+    mode: str = "",
 ) -> bool:
     """True iff admitting this candidate lane is refused by ANY predicate against
     ANY live lease — the boolean the auto-pick loops want (they only need "is this
@@ -139,7 +141,7 @@ def _lease_collision(
     `_admission_verdict` so the loops read like the old `any(_lease_blocks(...))`."""
     return not _admission_verdict(
         lane=lane, kind=kind, tree=tree, live_leases=live_leases,
-        predicates=predicates, config=config,
+        predicates=predicates, config=config, mode=mode,
     ).admitted
 
 
@@ -160,6 +162,7 @@ def arbitrate(
     class_budgets: dict[str, int] | None = None,
     live_siblings: list[dict] | None = None,
     sibling_tree_lookup: Callable[[str], list[str] | None] | None = None,
+    requested_mode: str = "",
 ) -> LaneDecision:
     """PURE admission: decide whether a loop may start, and on which lane.
 
@@ -559,6 +562,7 @@ def arbitrate(
         verdict = _admission_verdict(
             lane=requested_lane or "global", kind=kind, tree=requested_tree,
             live_leases=live_leases, predicates=preds, config=cfg,
+            mode=requested_mode,
         )
         if not verdict.admitted:
             return LaneDecision(
@@ -600,6 +604,7 @@ def arbitrate(
         verdict = _admission_verdict(
             lane=requested_lane, kind="cluster", tree=tree,
             live_leases=live_leases, predicates=preds, config=cfg,
+            mode=requested_mode,
         )
         if verdict.admitted:
             return LaneDecision(
@@ -617,14 +622,15 @@ def arbitrate(
         _hint_refusal["reason"] = verdict.reason
 
     # Keyword request with a NON-EMPTY tree → run the admission conjunction
-    # (disjointness + self-modify + any workspace predicate). First refusal wins;
-    # the disjointness predicate reproduces the old soft-overlap verdict exactly,
-    # so a disjoint keyword lane still admits — while a self-modifying one now
-    # refuses with the typed SELF_MODIFY reason it could not carry before.
+    # (lock-mode disjointness + self-modify + any workspace predicate). First
+    # refusal wins; a disjoint or shared/shared-compatible keyword lane admits,
+    # while a self-modifying one refuses with the typed SELF_MODIFY reason it
+    # could not carry before.
     if requested_kind == "keyword" and requested_tree:
         verdict = _admission_verdict(
             lane=requested_lane, kind="keyword", tree=requested_tree,
             live_leases=live_leases, predicates=preds, config=cfg,
+            mode=requested_mode,
         )
         if not verdict.admitted:
             reason = f"{verdict.reason} Use a free cluster lane instead."
@@ -635,7 +641,7 @@ def arbitrate(
             "acquire", lane=requested_lane, lane_kind="keyword",
             tree=requested_tree, auto_picked=False,
             reason=(f"keyword lane {requested_lane!r} admitted (disjoint or "
-                    f"under the soft-overlap threshold vs all "
+                    f"lock-mode compatible vs all "
                     f"{len(live_leases)} live lease(s))."),
         )
 
@@ -735,7 +741,8 @@ def arbitrate(
             _saw_non_budget_candidate = True
             if not _lease_collision(
                     lane=name, kind=_cand_kind, tree=tree_list,
-                    live_leases=live_leases, predicates=preds, config=cfg):
+                    live_leases=live_leases, predicates=preds, config=cfg,
+                    mode=requested_mode):
                 # FQ-449 first pass: also require sibling-disjointness. A candidate
                 # that overlaps a live sibling is skipped here so a LATER ladder
                 # lane (disjoint from both leases AND siblings) can win; the second
@@ -779,7 +786,8 @@ def arbitrate(
                 cand_tree = _cluster_tree(cand)
                 if not _lease_collision(
                         lane=cand, kind="cluster", tree=cand_tree,
-                        live_leases=live_leases, predicates=preds, config=cfg):
+                        live_leases=live_leases, predicates=preds, config=cfg,
+                        mode=requested_mode):
                     if not _admit_lane(cand, "cluster", cand_tree):
                         continue
                     return LaneDecision(
@@ -848,7 +856,8 @@ def arbitrate(
         cand_tree = _cluster_tree(cand)
         if not _lease_collision(
                 lane=cand, kind="cluster", tree=cand_tree,
-                live_leases=live_leases, predicates=preds, config=cfg):
+                live_leases=live_leases, predicates=preds, config=cfg,
+                mode=requested_mode):
             if unresolved_keyword:
                 why = _unresolved_suffix.strip()
             elif requested_lane:
@@ -867,7 +876,8 @@ def arbitrate(
                 continue
             if not _lease_collision(
                     lane=name, kind="named", tree=tree_list,
-                    live_leases=live_leases, predicates=preds, config=cfg):
+                    live_leases=live_leases, predicates=preds, config=cfg,
+                    mode=requested_mode):
                 return LaneDecision(
                     "acquire", lane=name, lane_kind="named",
                     tree=tree_list, auto_picked=True,
@@ -879,7 +889,8 @@ def arbitrate(
                 continue
             if not _lease_collision(
                     lane=plan_id, kind="derived", tree=list(tree_list),
-                    live_leases=live_leases, predicates=preds, config=cfg):
+                    live_leases=live_leases, predicates=preds, config=cfg,
+                    mode=requested_mode):
                 return LaneDecision(
                     "acquire", lane=plan_id, lane_kind="derived",
                     tree=list(tree_list), auto_picked=True,