Module taint 

The session taint (design pz21 §1.7): which untrusted origins the session the Instance serves has read.

• Writer: only the origin step of the release point, from the call’s origin ledger (record). Admissions outside a tool call (egress checks, detached store writes) never taint.
• Active session: the MCP server binds the session it serves at the start of every call (bind); active_view is what origin::session_taint() returns. A taint recorded before the first bind is held without a session id and carried into the bound session.
• Write-through: a change is saved at once to a sidecar next to the session file (<id>.taint), not on the session’s save cadence, so a crash between the read and the next save cannot untaint the session. Loading a session merges the sidecar into SessionState.taint.
• Overflow is sticky: nothing is dropped silently; a ref that cannot be recorded marks the whole session, and so does a change the bounded lock could not take in time.
• Locking: ACTIVE is a bounded lock (LOCK_ORDERING L148), held only to merge or copy the in-memory taint; sidecar reads and writes run after it is released.

Functions

active_session_id

The id of the session bound last, if any.

active_view

The active session’s taint, read-only.

bind

Bind the session the Instance serves now. A different session replaces the active taint with its own (loaded with the session); the same session keeps the union, and a taint recorded before any session was bound is carried into it and saved, so nothing recorded is ever lost.

record

Add delta to the active session’s taint and persist a change at once. Without a bound session the taint is held process-wide (a CLI run, a test) and carried into the session bound next.

snapshot

The active session’s taint. A lock timeout reads as overflowed.

snapshot_for

The taint of session_id when it is the active session.