@evomap/evolver-core 2.0.0-beta.1 → 2.0.0-beta.11

package/dist/assetstore/provenance.js

@@ -3,9 +3,13 @@
 // by asset_id, NOT a field on the asset: asset_id = sha256(canonicalize(asset)), and "how we got it" metadata
 // must not enter the content hash (#30.2), or it would break content-addressing. Trust-first by construction:
 // selection defaults to trusted-only; an untrusted asset is promoted to trusted only by an explicit, logged act.
-import { appendFileSync, closeSync, existsSync, openSync, readFileSync, readSync, mkdirSync, statSync, truncateSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { normalizeForPut } from './provider.js';
+import { assertCapsuleGeneBinding, normalizeForPut, supportsAtomicConditionalPut, validateConditionalPutResult, } from './provider.js';
+import { appendUtf8Durable, assertAssetStoreDirectory, ensureAssetStoreDirectory, readUtf8Regular, regularFileFingerprint, truncateUtf8SuffixDurable, withAssetStoreLock, } from './assetStoreStorage.js';
+import { assertTrustSidecarHealthy, parseProvenanceRecord, parseSidecarJsonl, } from './assetSidecarRecords.js';
+function immutableRecord(record) {
+    return Object.freeze({ ...record });
+}
 /**
  * Append-only JSONL sidecar (last-write-wins) at <baseDir>/provenance.jsonl. Default for an asset with NO
  * record = trusted: the only local writers (cycleEngine self-produce, v1 migration) are trusted and never
@@ -14,81 +18,113 @@ import { normalizeForPut } from './provider.js';
 export class ProvenanceStore {
     now;
     path;
+    lockPath;
     index = new Map();
-    loaded = false;
+    fileState = null;
     constructor(baseDir, now = Date.now) {
         this.now = now;
+        ensureAssetStoreDirectory(baseDir);
         this.path = join(baseDir, 'provenance.jsonl');
+        this.lockPath = join(baseDir, '.assetstore.lock');
     }
-    load() {
-        if (this.loaded)
-            return;
-        if (existsSync(this.path)) {
-            for (const line of readFileSync(this.path, 'utf8').split('\n')) {
-                if (!line.trim())
-                    continue;
-                try {
-                    const r = JSON.parse(line);
-                    if (r.assetId)
-                        this.index.set(r.assetId, r);
-                }
-                catch { /* skip corrupt line */ }
-            }
+    rebuildIndex(state) {
+        const next = new Map();
+        const raw = state === 'missing' ? null : readUtf8Regular(this.path);
+        if (raw !== null) {
+            const parsed = parseSidecarJsonl(raw, parseProvenanceRecord);
+            assertTrustSidecarHealthy('provenance', parsed);
+            for (const record of parsed.records)
+                next.set(record.assetId, immutableRecord(record));
         }
-        this.loaded = true;
+        this.index.clear();
+        for (const [assetId, record] of next)
+            this.index.set(assetId, record);
+        this.fileState = state;
+    }
+    refreshUnderLock() {
+        const state = regularFileFingerprint(this.path);
+        if (state !== this.fileState)
+            this.rebuildIndex(state);
+    }
+    withFreshRead(read) {
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            return read(this.index);
+        });
+    }
+    appendUnderLock(full) {
+        const stored = immutableRecord(full);
+        appendUtf8Durable(this.path, `${JSON.stringify(stored)}\n`);
+        this.index.set(stored.assetId, stored);
+        this.fileState = regularFileFingerprint(this.path);
+        return stored;
     }
     /** Record provenance for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec) {
-        this.load();
         const full = { ...rec, at: rec.at ?? new Date(this.now()).toISOString() };
-        mkdirSync(dirname(this.path), { recursive: true });
-        appendFileSync(this.path, `${JSON.stringify(full)}\n`);
-        this.index.set(full.assetId, full);
-        return full;
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            return this.appendUnderLock(full);
+        });
     }
     rollbackLast(rec) {
         const line = `${JSON.stringify(rec)}\n`;
-        const lineBytes = Buffer.byteLength(line, 'utf8');
         try {
-            if (!existsSync(this.path))
-                return;
-            const stat = statSync(this.path);
-            if (!stat.isFile() || stat.size < lineBytes)
-                return;
-            const offset = stat.size - lineBytes;
-            const buf = Buffer.alloc(lineBytes);
-            const fd = openSync(this.path, 'r');
-            try {
-                readSync(fd, buf, 0, lineBytes, offset);
-            }
-            finally {
-                closeSync(fd);
-            }
-            if (buf.toString('utf8') !== line)
-                return;
-            truncateSync(this.path, offset);
-            this.index.clear();
-            this.loaded = false;
+            assertAssetStoreDirectory(dirname(this.path));
+            withAssetStoreLock(this.lockPath, () => {
+                if (!truncateUtf8SuffixDurable(this.path, line)) {
+                    this.refreshUnderLock();
+                    return;
+                }
+                this.rebuildIndex(regularFileFingerprint(this.path));
+            });
         }
         catch {
             this.index.clear();
-            this.loaded = false;
+            this.fileState = null;
         }
     }
     get(assetId) {
-        this.load();
-        return this.index.get(assetId) ?? null;
+        return this.withFreshRead((index) => index.get(assetId) ?? null);
     }
     /** No record → trusted (local default); a record → its trusted flag. */
     isTrusted(assetId) {
-        this.load();
-        const r = this.index.get(assetId);
-        return r ? r.trusted : true;
+        return this.withFreshRead((index) => index.get(assetId)?.trusted ?? true);
+    }
+    /** One linearizable trust snapshot for bounded batch readers. */
+    snapshot() {
+        return this.withFreshRead((index) => new Map(index));
+    }
+    /** Compare and append one trust decision under the same cross-process lock. */
+    changeTrust(assetId, trusted, by, reason) {
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            const current = this.index.get(assetId) ?? null;
+            if (current?.trusted === trusted)
+                return { changed: false, record: current };
+            const full = {
+                assetId,
+                source: current?.source ?? 'local',
+                trusted,
+                at: new Date(this.now()).toISOString(),
+                decision: trusted ? 'promoted' : 'revoked',
+                decidedBy: by,
+                ...(trusted ? { promotedBy: by } : {}),
+                reason,
+            };
+            return { changed: true, record: this.appendUnderLock(full) };
+        });
     }
     /** Explicit, audited untrusted→trusted promotion. Appends a new trusted record carrying who/why. */
     promote(assetId, by, reason) {
-        const cur = this.get(assetId);
-        return this.mark({ assetId, source: cur?.source ?? 'hub', trusted: true, promotedBy: by, reason });
+        return this.changeTrust(assetId, true, by, reason).record;
+    }
+    /** Explicit, audited trusted-to-untrusted revocation. A record-less asset is local by default. */
+    revoke(assetId, by, reason) {
+        return this.changeTrust(assetId, false, by, reason).record;
     }
 }
 /**
@@ -99,11 +135,54 @@ export class ProvenanceStore {
 export async function ingestUntrusted(store, prov, record, source = 'hub') {
     const normalized = normalizeForPut(record);
     const mark = prov.mark({ assetId: normalized.record.asset_id, source, trusted: false });
-    try {
-        return await store.put(record);
+    const result = await store.put(record);
+    // A thrown write has an ambiguous outcome: the asset may have reached disk before the acknowledgement was
+    // lost. Keep the untrusted marker in that case so a persisted Hub asset can never fall through the default
+    // no-record => trusted policy. Only an explicit no-write result is safe to roll back.
+    if (!result.stored)
+        prov.rollbackLast(mark);
+    return result;
+}
+/**
+ * Hub → local-pool landing for an asset whose content does NOT hash to its declared asset_id. The hub
+ * demonstrably rewrites delivered payloads (injected `validation`, wholesale `payload_backfill_reason`
+ * synthesis — evolver-v2#570), which breaks {@link ingestUntrusted}'s normalizeForPut self-consistency check
+ * even though the loop's own in-run reuse already consumes hub content without re-verifying it (adapter
+ * `hubReuse.ts`). Rather than hard-reject a save the operator explicitly asked for, freeze the asset under its
+ * declared (network) asset_id via `putFrozen` and mark it untrusted in the sidecar with an explicit reason.
+ * Trust-first still holds (#30.1): selection defaults to trusted-only, so an unverified asset never silently
+ * enters the reasoning pool — it lands where the operator put it and stays flagged until an explicit,
+ * audited promotion. `reason` records WHY verification was waived (e.g. hub rewrite vs synthesized payload).
+ */
+export async function ingestUnverified(store, prov, record, reason, source = 'hub') {
+    if (typeof store.putFrozen !== 'function') {
+        // Only a content-addressed local pool receives hub reuse writes; a provider that cannot freeze a
+        // hash-inconsistent record cannot preserve the network id, so fail loudly rather than silently restamp it.
+        throw new Error('ingestUnverified requires a store that implements putFrozen');
     }
-    catch (err) {
+    // putFrozen bypasses normalizeForPut, so re-assert the M3-4 Capsule↔gene binding here — a hash-mismatched
+    // Capsule with an empty gene must still fail closed on the frozen path, exactly as it does on the verified one.
+    assertCapsuleGeneBinding(record);
+    const mark = prov.mark({ assetId: record.asset_id, source, trusted: false, reason });
+    const result = await store.putFrozen(record);
+    // Mirror ingestUntrusted: only an explicit no-write result (dedup) is safe to roll the marker back; a
+    // thrown write has an ambiguous on-disk outcome and must keep the untrusted marker.
+    if (!result.stored)
         prov.rollbackLast(mark);
-        throw err;
+    return result;
+}
+/**
+ * Conditional variant used by Hub sync to reject a logical-id collision without ever allowing a Hub record
+ * to become implicitly trusted. Providers that cannot make the condition atomically are rejected here.
+ */
+export async function ingestUntrustedConditional(store, prov, record, options, source = 'hub') {
+    if (!supportsAtomicConditionalPut(store)) {
+        throw new Error('asset store does not support conditional writes');
     }
+    const normalized = normalizeForPut(record);
+    const mark = prov.mark({ assetId: normalized.record.asset_id, source, trusted: false });
+    const result = validateConditionalPutResult(await store.putConditional(record, options), normalized.record.asset_id, options);
+    if (!result.stored)
+        prov.rollbackLast(mark);
+    return result;
 }

package/dist/assetstore/provider.d.ts

@@ -10,6 +10,24 @@ export interface PutResult {
     stored: boolean;
     verified: boolean;
 }
+export type ConditionalPutStatus = 'stored' | 'already_exists' | 'logical_collision';
+export interface ConditionalPutOptions {
+    /** Only explicit force-like callers may keep multiple content versions for the same type + logical id. */
+    allowLogicalCollision?: boolean;
+}
+export interface ConditionalPutResult extends PutResult {
+    status: ConditionalPutStatus;
+    logicalId?: string;
+    collisionWithAssetId?: string;
+}
+export type InvalidConditionalPutResultReason = 'malformed_result' | 'asset_id_mismatch' | 'inconsistent_status' | 'invalid_collision' | 'collision_bypass';
+export declare class InvalidConditionalPutResultError extends Error {
+    readonly reason: InvalidConditionalPutResultReason;
+    readonly code = "INVALID_CONDITIONAL_PUT_RESULT";
+    constructor(reason: InvalidConditionalPutResultReason);
+}
+/** Validate an injected provider response before callers treat it as an explicit write/no-write decision. */
+export declare function validateConditionalPutResult(value: unknown, expectedAssetId: string, options?: ConditionalPutOptions): ConditionalPutResult;
 export interface SearchQuery {
     kind?: AssetKind;
     signalsAny?: string[];
@@ -24,10 +42,26 @@ export interface SearchQuery {
  */
 export interface AssetStoreProvider {
     put(asset: AssetRecord): Promise<PutResult>;
+    /** Optional atomic capability; use supportsAtomicConditionalPut() before calling through this interface. */
+    putConditional?(asset: AssetRecord, options?: ConditionalPutOptions): Promise<ConditionalPutResult>;
     get(assetId: string): Promise<AssetRecord | null>;
+    /** Optional direct lookup for non-content-addressed logical ids. Callers must handle 0, 1, or multiple matches. */
+    findByLogicalId?(id: string, limit?: number): Promise<AssetRecord[]>;
+    /**
+     * Optional frozen write: store the record under its OWN declared asset_id without recomputing or
+     * normalizing it (bypasses {@link normalizeForPut}'s self-consistency check). Only providers backing a
+     * content-addressed local pool implement it. Callers that must preserve a hash-inconsistent asset —
+     * v1 migration import, and unverified hub reuse of a hub-rewritten payload (see `ingestUnverified`) —
+     * feature-detect it rather than assuming it exists.
+     */
+    putFrozen?(record: AssetRecord): Promise<PutResult>;
     search(query: SearchQuery): Promise<AssetRecord[]>;
     list(kind?: AssetKind, limit?: number): Promise<AssetRecord[]>;
 }
+export type AtomicConditionalPutProvider = AssetStoreProvider & {
+    putConditional(asset: AssetRecord, options?: ConditionalPutOptions): Promise<ConditionalPutResult>;
+};
+export declare function supportsAtomicConditionalPut(provider: AssetStoreProvider): provider is AtomicConditionalPutProvider;
 export declare class AssetIdMismatchError extends Error {
     readonly claimed: string;
     readonly actual: string;
@@ -36,6 +70,12 @@ export declare class AssetIdMismatchError extends Error {
 export declare class CapsuleGeneBindingError extends Error {
     constructor();
 }
+/**
+ * M3-4 强绑定校验: Capsule.gene 必须非空(否则一条无来源基因的经验会污染选择池).
+ * 抽成独立 helper 以便 normalizeForPut(校验落库路径)与 ingestUnverified(冻结落库路径,
+ * 绕过 normalizeForPut)共用同一条不变量,不让降级路径把绑定校验漏掉.
+ */
+export declare function assertCapsuleGeneBinding(asset: AssetRecord): void;
 /**
  * 落库前规范化(共享给各 provider): 计算/校验 asset_id + 强绑定校验.
  * - 缺 asset_id → 计算填入(verified=false 表示非入参自带).

package/dist/assetstore/provider.js

@@ -1,4 +1,54 @@
 import { computeAssetId, verifyAssetId } from '../wire/index.js';
+export class InvalidConditionalPutResultError extends Error {
+    reason;
+    code = 'INVALID_CONDITIONAL_PUT_RESULT';
+    constructor(reason) {
+        super(`invalid conditional put result: ${reason}`);
+        this.reason = reason;
+        this.name = 'InvalidConditionalPutResultError';
+    }
+}
+/** Validate an injected provider response before callers treat it as an explicit write/no-write decision. */
+export function validateConditionalPutResult(value, expectedAssetId, options) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new InvalidConditionalPutResultError('malformed_result');
+    }
+    const result = value;
+    const status = result['status'];
+    const collisionWithAssetId = result['collisionWithAssetId'];
+    if (typeof result['asset_id'] !== 'string'
+        || typeof result['stored'] !== 'boolean'
+        || typeof result['verified'] !== 'boolean'
+        || (status !== 'stored' && status !== 'already_exists' && status !== 'logical_collision')
+        || (result['logicalId'] !== undefined
+            && (typeof result['logicalId'] !== 'string'
+                || !result['logicalId'].trim()
+                || result['logicalId'] !== result['logicalId'].trim()))
+        || (collisionWithAssetId !== undefined
+            && (typeof collisionWithAssetId !== 'string'
+                || !collisionWithAssetId.trim()
+                || collisionWithAssetId !== collisionWithAssetId.trim()))) {
+        throw new InvalidConditionalPutResultError('malformed_result');
+    }
+    if (result['asset_id'] !== expectedAssetId) {
+        throw new InvalidConditionalPutResultError('asset_id_mismatch');
+    }
+    if (result['stored'] !== (status === 'stored')) {
+        throw new InvalidConditionalPutResultError('inconsistent_status');
+    }
+    const allowLogicalCollision = options?.allowLogicalCollision === true;
+    if (status === 'logical_collision'
+        && (!collisionWithAssetId || collisionWithAssetId === expectedAssetId || allowLogicalCollision)) {
+        throw new InvalidConditionalPutResultError('invalid_collision');
+    }
+    if (status === 'stored' && collisionWithAssetId && !allowLogicalCollision) {
+        throw new InvalidConditionalPutResultError('collision_bypass');
+    }
+    return value;
+}
+export function supportsAtomicConditionalPut(provider) {
+    return typeof provider.putConditional === 'function';
+}
 export class AssetIdMismatchError extends Error {
     claimed;
     actual;
@@ -12,6 +62,18 @@ export class AssetIdMismatchError extends Error {
 export class CapsuleGeneBindingError extends Error {
     constructor() { super('Capsule.gene 必须非空或显式 "ad-hoc" 哨兵 (批注#28/M3-4)'); this.name = 'CapsuleGeneBindingError'; }
 }
+/**
+ * M3-4 强绑定校验: Capsule.gene 必须非空(否则一条无来源基因的经验会污染选择池).
+ * 抽成独立 helper 以便 normalizeForPut(校验落库路径)与 ingestUnverified(冻结落库路径,
+ * 绕过 normalizeForPut)共用同一条不变量,不让降级路径把绑定校验漏掉.
+ */
+export function assertCapsuleGeneBinding(asset) {
+    if (asset.type !== 'Capsule')
+        return;
+    const gene = asset.gene;
+    if (typeof gene !== 'string' || gene.length === 0)
+        throw new CapsuleGeneBindingError();
+}
 /**
  * 落库前规范化(共享给各 provider): 计算/校验 asset_id + 强绑定校验.
  * - 缺 asset_id → 计算填入(verified=false 表示非入参自带).
@@ -19,11 +81,7 @@ export class CapsuleGeneBindingError extends Error {
  * - Capsule.gene 必须非空(M3-4 强绑定).
  */
 export function normalizeForPut(asset) {
-    if (asset.type === 'Capsule') {
-        const gene = asset.gene;
-        if (typeof gene !== 'string' || gene.length === 0)
-            throw new CapsuleGeneBindingError();
-    }
+    assertCapsuleGeneBinding(asset);
     const actual = computeAssetId(asset);
     if (actual === null)
         throw new Error('computeAssetId 失败: 资产非对象');

package/dist/assetstore/reviewFilter.js

@@ -30,11 +30,14 @@ export function provenanceStoreForStore(store) {
  */
 export async function listApprovedGenes(store, review, maxGenes, provenance = provenanceStoreForStore(store)) {
     const all = await store.list('Gene', GENE_SCAN_LIMIT);
+    const trust = provenance.snapshot();
+    const reviewed = review.snapshot();
     const approved = [];
     for (const g of all) {
-        if (!provenance.isTrusted(String(g.asset_id)))
+        if (trust.get(String(g.asset_id))?.trusted === false)
             continue; // hub-untrusted → withhold until promoted
-        if (!review.isApproved(String(g.asset_id)))
+        const reviewRecord = reviewed.get(String(g.asset_id));
+        if (reviewRecord !== undefined && reviewRecord.state !== 'approved')
             continue; // quarantined/rejected draft → withhold
         approved.push(g);
         if (approved.length >= maxGenes)

package/dist/assetstore/reviewLedger.d.ts

@@ -18,13 +18,17 @@ export interface ReviewRecord {
 export declare class ReviewLedger {
     private readonly now;
     private readonly path;
+    private readonly lockPath;
     private readonly index;
-    private sig;
+    private fileState;
     constructor(baseDir: string, now?: () => number);
     private static isHuman;
     /** Which record wins for an asset_id: a human decision beats a quarantine; otherwise the later one wins. */
     private static keep;
-    private load;
+    private rebuildIndex;
+    private refreshUnderLock;
+    private withFreshRead;
+    private appendUnderLock;
     /** Record a review-state for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec: Omit<ReviewRecord, 'at'> & {
         at?: string;
@@ -50,6 +54,14 @@ export declare class ReviewLedger {
      * asset list, so a draft awaiting approval is never missed behind a store-list cutoff.
      */
     records(): ReviewRecord[];
+    /** One linearizable review snapshot for bounded batch readers. */
+    snapshot(): ReadonlyMap<string, ReviewRecord>;
     /** No record → approved (default eligible); a record → approved only when its state is 'approved'. */
     isApproved(assetId: string): boolean;
+    /**
+     * True only when a human approval record exists. Safety-sensitive consumers such as AntiGene warning
+     * injection must fail closed when review state is absent; unlike cycle/migrate-authored Genes, an unreviewed
+     * negative-memory asset must never inherit the ledger's backward-compatible "no record = eligible" default.
+     */
+    isExplicitlyApproved(assetId: string): boolean;
 }

package/dist/assetstore/reviewLedger.js

@@ -8,8 +8,12 @@
 //
 // Default (no record) = approved/eligible: the only writer of quarantine records is `--distill`; cycle-self-
 // produced and v1-migrated genes are never quarantined, so the explore→prove loop is untouched for them.
-import { appendFileSync, existsSync, readFileSync, mkdirSync, statSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { appendUtf8Durable, assertAssetStoreDirectory, ensureAssetStoreDirectory, readUtf8Regular, regularFileFingerprint, withAssetStoreLock, } from './assetStoreStorage.js';
+import { assertTrustSidecarHealthy, parseReviewRecord, parseSidecarJsonl, } from './assetSidecarRecords.js';
+function immutableRecord(record) {
+    return Object.freeze({ ...record });
+}
 /**
  * Append-only JSONL sidecar at <baseDir>/review.jsonl. Default for an asset with NO record = approved (eligible):
  * only auto-distilled drafts are quarantined here; everything else is eligible by default.
@@ -22,11 +26,14 @@ import { join, dirname } from 'node:path';
 export class ReviewLedger {
     now;
     path;
+    lockPath;
     index = new Map();
-    sig = ''; // `${mtimeMs}:${size}` of review.jsonl at the last index build; '' = never loaded / file absent
+    fileState = null;
     constructor(baseDir, now = Date.now) {
         this.now = now;
+        ensureAssetStoreDirectory(baseDir);
         this.path = join(baseDir, 'review.jsonl');
+        this.lockPath = join(baseDir, '.assetstore.lock');
     }
     static isHuman(s) { return s === 'approved' || s === 'rejected'; }
     /** Which record wins for an asset_id: a human decision beats a quarantine; otherwise the later one wins. */
@@ -37,43 +44,50 @@ export class ReviewLedger {
             return r; // human decision always wins (and later human beats earlier)
         return ReviewLedger.isHuman(existing.state) ? existing : r; // a quarantine replaces only a prior quarantine
     }
-    // Reload-aware (not load-once): the resident `autoexec` daemon holds ONE ReviewLedger, yet an operator runs
-    // `evolver review --approve` in a SEPARATE process. Re-read review.jsonl whenever its mtime+size changed, so a
-    // live approval lifts a quarantined gene without restarting the daemon. The file is small and queried at most
-    // once per cycle, so a statSync per query is cheap. (mtime alone can collide within one ms → pair it with size.)
-    load() {
-        if (!existsSync(this.path)) {
-            this.index.clear();
-            this.sig = '';
-            return;
-        }
-        const st = statSync(this.path);
-        const sig = `${st.mtimeMs}:${st.size}`;
-        if (sig === this.sig)
-            return; // unchanged since last read → cached index is current
-        this.index.clear();
-        for (const line of readFileSync(this.path, 'utf8').split('\n')) {
-            if (!line.trim())
-                continue;
-            try {
-                const r = JSON.parse(line);
-                if (r.assetId)
-                    this.index.set(r.assetId, ReviewLedger.keep(this.index.get(r.assetId), r));
+    rebuildIndex(state) {
+        const next = new Map();
+        const raw = state === 'missing' ? null : readUtf8Regular(this.path);
+        if (raw !== null) {
+            const parsed = parseSidecarJsonl(raw, parseReviewRecord);
+            assertTrustSidecarHealthy('review', parsed);
+            for (const record of parsed.records) {
+                const frozen = immutableRecord(record);
+                next.set(record.assetId, ReviewLedger.keep(next.get(record.assetId), frozen));
             }
-            catch { /* skip corrupt line */ }
         }
-        this.sig = sig;
+        this.index.clear();
+        for (const [assetId, record] of next)
+            this.index.set(assetId, record);
+        this.fileState = state;
+    }
+    refreshUnderLock() {
+        const state = regularFileFingerprint(this.path);
+        if (state !== this.fileState)
+            this.rebuildIndex(state);
+    }
+    withFreshRead(read) {
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            return read(this.index);
+        });
+    }
+    appendUnderLock(full) {
+        appendUtf8Durable(this.path, `${JSON.stringify(full)}\n`);
+        const frozen = immutableRecord(full);
+        this.index.set(full.assetId, ReviewLedger.keep(this.index.get(full.assetId), frozen));
+        this.fileState = regularFileFingerprint(this.path);
+        return this.index.get(full.assetId);
     }
     /** Record a review-state for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec) {
-        this.load();
         const full = { ...rec, at: rec.at ?? new Date(this.now()).toISOString() };
-        mkdirSync(dirname(this.path), { recursive: true });
-        appendFileSync(this.path, `${JSON.stringify(full)}\n`);
-        this.index.set(full.assetId, ReviewLedger.keep(this.index.get(full.assetId), full));
-        const st = statSync(this.path); // single stat: two separate calls could straddle a concurrent same-ms append
-        this.sig = `${st.mtimeMs}:${st.size}`; // our own write is already indexed; don't force a re-read
-        return full;
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            this.appendUnderLock(full);
+            return immutableRecord(full);
+        });
     }
     /** Quarantine an auto-distilled draft: its strategy must not enter a real run until reviewed. */
     quarantine(assetId, reason = 'auto-distilled — review before use') {
@@ -87,9 +101,19 @@ export class ReviewLedger {
      * approval is inert. Returns the surviving record (the existing decision, or the new quarantine).
      */
     quarantineIfAbsent(assetId, reason = 'auto-distilled — review before use') {
-        this.load();
-        const existing = this.index.get(assetId);
-        return existing ?? this.quarantine(assetId, reason);
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            const existing = this.index.get(assetId);
+            if (existing)
+                return existing;
+            return this.appendUnderLock({
+                assetId,
+                state: 'quarantined',
+                reason,
+                at: new Date(this.now()).toISOString(),
+            });
+        });
     }
     /** Explicit, audited approval (who/why) — flips a draft to eligible. */
     approve(assetId, by, reason) {
@@ -100,8 +124,7 @@ export class ReviewLedger {
         return this.mark({ assetId, state: 'rejected', by, reason });
     }
     get(assetId) {
-        this.load();
-        return this.index.get(assetId) ?? null;
+        return this.withFreshRead((index) => index.get(assetId) ?? null);
     }
     /**
      * Every recorded review decision (resolved, reload-aware). The authoritative source of which assets are
@@ -109,13 +132,25 @@ export class ReviewLedger {
      * asset list, so a draft awaiting approval is never missed behind a store-list cutoff.
      */
     records() {
-        this.load();
-        return [...this.index.values()];
+        return [...this.snapshot().values()];
+    }
+    /** One linearizable review snapshot for bounded batch readers. */
+    snapshot() {
+        return this.withFreshRead((index) => new Map(index));
     }
     /** No record → approved (default eligible); a record → approved only when its state is 'approved'. */
     isApproved(assetId) {
-        this.load();
-        const r = this.index.get(assetId);
-        return r ? r.state === 'approved' : true;
+        return this.withFreshRead((index) => {
+            const r = index.get(assetId);
+            return r ? r.state === 'approved' : true;
+        });
+    }
+    /**
+     * True only when a human approval record exists. Safety-sensitive consumers such as AntiGene warning
+     * injection must fail closed when review state is absent; unlike cycle/migrate-authored Genes, an unreviewed
+     * negative-memory asset must never inherit the ledger's backward-compatible "no record = eligible" default.
+     */
+    isExplicitlyApproved(assetId) {
+        return this.withFreshRead((index) => index.get(assetId)?.state === 'approved');
     }
 }

package/dist/assetstore/seedGenes.d.ts

@@ -0,0 +1,3 @@
+import { type Gene } from '../wire/index.js';
+export declare const BUNDLED_HARNESS_SEED_GENES: readonly Gene[];
+export declare function bundledHarnessSeedGenesJsonl(): string;