@ngockhoale/ukit 3.4.1 → 3.4.3

package/src/core/codeintel/retriever.js

@@ -5,7 +5,7 @@ import { createHash } from 'node:crypto';
 import { withFileLock } from '../fileOps.js';
 import { getArtifactPath, INDEX_ARTIFACTS, INDEX_SCHEMA_VERSION, normalizeRelative } from '../../index/paths.js';
 import { loadRuntimeConfig } from '../runtimeConfig.js';
-import { createEdge, getSemanticProvider, IndexFileSyntaxProvider } from './providers.js';
+import { createEdge, getSemanticProvider } from './providers.js';
 import { createSemanticProvider } from './semanticProvider.js';
 import { createEmbeddingProvider } from './vectorProvider.js';
 
@@ -14,6 +14,13 @@ import { createEmbeddingProvider } from './vectorProvider.js';
 // codeIntel.retriever.weights). merge:'concat' preserves the exact C26
 // sequential ordering as an escape hatch. A missing/failing lane is skipped
 // and the reason lands in `omitted` — never fatal, never fabricated anchors.
+// C92-F-04: `fileSet` is the path allow-list built from files.json, and every
+// lane applies the same rule — a path is accepted iff fileSet.has(path). An
+// UNREADABLE files.json (missing or schema-mismatched) makes the gate
+// unavailable: retrieve() refuses and names the artifact in `omitted` instead
+// of treating an empty allow-list as "allow everything" (fail closed, not
+// fail open). A readable-but-empty files.json is a genuinely empty universe —
+// also closed — which is distinguishable via the `omitted` entries.
 
 const DEFAULT_LIMIT = 20;
 const DEFAULT_BM25 = { k1: 1.2, b: 0.75 };
@@ -123,7 +130,7 @@ function symbolLane(symbolItems, normalizedQuery, fileSet) {
   for (const sym of symbolItems) {
     if (!sym?.name || !sym?.filePath || seen.has(sym.filePath)) continue;
     if (sym.name === normalizedQuery || sym.name.toLowerCase() === normalizedQuery.toLowerCase()) {
-      if (fileSet.size === 0 || fileSet.has(sym.filePath)) {
+      if (fileSet.has(sym.filePath)) {
         seen.add(sym.filePath);
         lane.push(laneEntry(
           sym.filePath,
@@ -136,7 +143,7 @@ function symbolLane(symbolItems, normalizedQuery, fileSet) {
   return lane;
 }
 
-function bm25Lane(fileItems, symbolItems, queryTokens, bm25) {
+function bm25Lane(fileItems, symbolItems, queryTokens, bm25, fileSet) {
   if (queryTokens.length === 0) return null;
   const docs = new Map();
   for (const item of fileItems) {
@@ -144,7 +151,9 @@ function bm25Lane(fileItems, symbolItems, queryTokens, bm25) {
     docs.set(item.filePath, tokenize(item.filePath));
   }
   for (const sym of symbolItems) {
-    if (!sym?.filePath) continue;
+    // C92-F-04: symbol rows for paths outside the files.json universe must
+    // not create emit-table docs — the gate is fileSet.has(path) for all lanes.
+    if (!sym?.filePath || !fileSet.has(sym.filePath)) continue;
     const doc = docs.get(sym.filePath) ?? [];
     doc.push(...tokenize(sym.name));
     docs.set(sym.filePath, doc);
@@ -189,7 +198,7 @@ async function semanticLane(rootDir, normalizedQuery, config, fileSet, snapshotI
     if (!target) continue;
     const rel = path.isAbsolute(target) ? normalizeRelative(rootDir, target) : target;
     if (seen.has(rel)) continue;
-    if (fileSet.size > 0 && !fileSet.has(rel)) continue;
+    if (!fileSet.has(rel)) continue;
     seen.add(rel);
     lane.push(laneEntry(rel, `semantic ${edge.kind ?? 'match'} for "${normalizedQuery}"`));
   }
@@ -199,7 +208,7 @@ async function semanticLane(rootDir, normalizedQuery, config, fileSet, snapshotI
 // Vector lane (SPEC §2/§3): dep-free hashed embedding provider; mirrors the
 // semantic lane. Edges' `to` carries "file:0" — reduce to a ranked file list.
 async function vectorLane(rootDir, normalizedQuery, config, fileSet, snapshotId) {
-  const provider = createEmbeddingProvider({ projectRoot: rootDir, config });
+  const provider = embeddingProviderFor(rootDir, config);
   if (!provider || provider.name === 'null' || typeof provider.resolve !== 'function') {
     return { lane: null, why: 'unavailable' };
   }
@@ -222,13 +231,37 @@ async function vectorLane(rootDir, normalizedQuery, config, fileSet, snapshotId)
     if (!target) continue;
     const rel = path.isAbsolute(target) ? normalizeRelative(rootDir, target) : target;
     if (seen.has(rel)) continue;
-    if (fileSet.size > 0 && !fileSet.has(rel)) continue;
+    if (!fileSet.has(rel)) continue;
     seen.add(rel);
     lane.push(laneEntry(rel, `vector ${edge.kind ?? 'match'} for "${normalizedQuery}"`));
   }
   return { lane, why: lane.length === 0 ? 'no-match' : null };
 }
 
+// C92-F-10: reuse the embedding provider across retrieve() calls for the same
+// (projectRoot, embedding config) so its doc-vector cache survives between
+// queries — a fresh provider per call re-embeds the whole corpus every time.
+// Bounded: insertion-ordered LRU over at most PROVIDER_CACHE_MAX instances.
+const PROVIDER_CACHE_MAX = 16;
+const embeddingProviders = new Map();
+
+function embeddingProviderFor(rootDir, config) {
+  const embedding = config?.codeIntel?.embedding;
+  const key = `${rootDir}\n${embedding?.provider ?? 'hashed'}\n${embedding?.dimensions ?? 'default'}`;
+  let provider = embeddingProviders.get(key);
+  if (provider) {
+    embeddingProviders.delete(key);
+    embeddingProviders.set(key, provider);
+    return provider;
+  }
+  provider = createEmbeddingProvider({ projectRoot: rootDir, config });
+  embeddingProviders.set(key, provider);
+  if (embeddingProviders.size > PROVIDER_CACHE_MAX) {
+    embeddingProviders.delete(embeddingProviders.keys().next().value);
+  }
+  return provider;
+}
+
 function rrfMerge(lanes, weights, rrfK) {
   const scores = new Map();
   const meta = new Map();
@@ -361,6 +394,17 @@ export async function retrieve(projectRoot, query, { mode = 'search', limit, sna
     return { anchors: [], evidence: [], relations: [], omitted };
   }
 
+  // C92-F-04 (fail closed): files.json is the path allow-list. When it is
+  // missing or schema-mismatched the gate is UNAVAILABLE, and an empty
+  // allow-list must not be read as "allow everything" — refuse the retrieval
+  // and name the unusable artifact so callers can distinguish a complete
+  // result from a degraded one.
+  if (!filesArtifact) {
+    omitted.push({ what: INDEX_ARTIFACTS.files, why: 'index-unavailable' });
+    omitted.push({ what: 'retrieval', why: 'path-gate-unavailable' });
+    return { anchors: [], evidence: [], relations: [], omitted };
+  }
+
   const fileItems = filesArtifact?.items ?? [];
   const symbolItems = symbolsArtifact?.items ?? [];
   const fileSet = new Set(fileItems.map((f) => f.filePath));
@@ -374,26 +418,15 @@ export async function retrieve(projectRoot, query, { mode = 'search', limit, sna
   const exact = exactLane(fileItems, normalizedQuery, queryBase);
   if (exact.length > 0) lanes.set('exact', exact);
 
-  // Lane 2 — symbol-name match via the syntax provider (index-file fallback).
-  const provider = new IndexFileSyntaxProvider({ rootDir });
+  // Lane 2 — symbol-name match against the symbols.json universe.
   if (!symbolsArtifact) {
     omitted.push({ what: 'symbol-lane', why: 'index-missing' });
   }
   const symbol = symbolLane(symbolItems, normalizedQuery, fileSet);
   if (symbol.length > 0) lanes.set('symbol', symbol);
-  // Enrich anchors with provider symbols when the lane matched (best-effort).
-  for (const entry of symbol) {
-    try {
-      if (provider.supports(entry.path)) {
-        await provider.symbols(entry.path);
-      }
-    } catch {
-      // Provider enrichment is best-effort; anchors already stand.
-    }
-  }
 
   // Lane 3 — BM25-lite over file/symbol tokens.
-  const bm25 = bm25Lane(fileItems, symbolItems, queryTokens, defaults.bm25);
+  const bm25 = bm25Lane(fileItems, symbolItems, queryTokens, defaults.bm25, fileSet);
   if (bm25 === null) {
     if (exact.length === 0 && symbol.length === 0) {
       omitted.push({ what: 'bm25-lane', why: 'empty-query-tokens' });

package/src/core/codeintel/router.js

@@ -35,7 +35,13 @@ const TRIVIAL_RE = /\b(typo|label|rename|spacing|toggle|whitespace|comment fix|s
 const ERROR_RE = /\b(error|exception|stack ?trace|bug|crash|failing|fails|failure|regression|TypeError|ReferenceError|SyntaxError|ENOENT|segfault)\b/i;
 const EXPLORE_RE = /\b(where|how does|how do|find|explore|understand|what does|which file|locate|handled)\b/i;
 const DEEP_FLOW_RE = /\b(refactor|migrate|migration|flow|end[- ]?to[- ]?end|trace|across|pipeline|lifecycle)\b/i;
-const ANALOGY_RE = /\b(similar to|analogy|like\b|same as|pattern|equivalent)\b/i;
+// C92-F-09: bare `like\b` matched the most common English filler verb ("I
+// would like to…"), misrouting everyday prompts to analogy. Keep only
+// comparative uses: quantifier + like ("something/anything like X") and
+// behaviour-verb + like ("behaves/looks/works like X"). "like <determiner>"
+// is deliberately excluded — "I'd like the docs updated" is a polite request,
+// not a similarity probe.
+const ANALOGY_RE = /\b(similar to|analogy|same as|pattern|equivalent)\b|\b(?:something|anything|nothing) like\b|\b(?:looks?|behav(?:e|es)|acts?|works?|performs?|functions?|feels?) like\b/i;
 const PATH_RE = /(?:[\w.-]+\/)+[\w.-]+|[\w.-]+\.(?:js|ts|mjs|cjs|jsx|tsx|py|rb|go|rs|java|md|json|yml|yaml|css|html|sh)\b/gi;
 
 // English slash-words that look like paths to PATH_RE but never are —
@@ -90,24 +96,28 @@ function decide(prompt, { hasError = false, filesHinted } = {}) {
     return { mode: 'impact', reasons };
   }
 
-  // Rule 5 — open-ended exploration wording.
+  // Rule 5 — analogy / pattern-search wording (C92-F-09): similarity intent is
+  // the more specific signal, so it wins over generic explore/find wording and
+  // over cross-cutting deep_flow wording. The regex no longer matches a bare
+  // verb "like" — only comparative idioms ("similar to", "same as", "something
+  // like X", "behaves like X").
+  if (ANALOGY_RE.test(prompt)) {
+    reasons.push('similar-to / analogy pattern-search wording');
+    return { mode: 'analogy', reasons };
+  }
+
+  // Rule 6 — open-ended exploration wording.
   if (EXPLORE_RE.test(prompt)) {
     reasons.push('open-ended where/how/find/explore wording');
     return { mode: 'explore', reasons };
   }
 
-  // Rule 6 — cross-cutting refactor/migrate/flow wording.
+  // Rule 7 — cross-cutting refactor/migrate/flow wording.
   if (DEEP_FLOW_RE.test(prompt)) {
     reasons.push('cross-cutting refactor/migrate/flow wording');
     return { mode: 'deep_flow', reasons };
   }
 
-  // Rule 7 — analogy / pattern search wording.
-  if (ANALOGY_RE.test(prompt)) {
-    reasons.push('similar-to / analogy pattern-search wording');
-    return { mode: 'analogy', reasons };
-  }
-
   // Rule 8 — fallback: single-file verb (single hinted file or lone path mention).
   if (hintedFiles.length === 1 || hasPathMention(prompt)) {
     reasons.push('fallback: single-file hint');

package/src/core/codeintel/summaries.js

@@ -2,7 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 
 import { getSyntaxProvider, IndexFileSyntaxProvider } from './providers.js';
-import { resolveProjectRelativePath } from '../fileOps.js';
+import { resolveProjectPathReal } from '../fileOps.js';
 
 // Deterministic extractive summaries (SPEC §7/§8, CI-304) — the L3 detail tier.
 // No model calls, no clock/random, no new deps. File reads are bounded to the
@@ -18,7 +18,9 @@ const DECL_RE = /^\s*(?:export\s+default\s+|export\s+)?(?:async\s+)?(?:function\
 
 async function readHead(rootDir, relPath) {
   try {
-    const abs = resolveProjectRelativePath(rootDir, relPath);
+    // Post-realpath containment: a symlinked path that passes the lexical
+    // check but resolves outside the root must never reach fs.readFile.
+    const abs = await resolveProjectPathReal(rootDir, relPath);
     if (!abs) return null;
     const content = await fs.readFile(abs, 'utf8');
     return { content, lines: content.split('\n').slice(0, MAX_READ_LINES), bytes: Buffer.byteLength(content, 'utf8') };
@@ -54,7 +56,6 @@ function docblockFirstSentence(lines, endIndex = lines.length) {
       }
     }
     const text = block.join(' ').replace(/\s+/g, ' ').trim();
-    if (!text) return null;
     const m = text.match(/^.+?[.!?](?:\s|$)/);
     return (m ? m[0] : text).trim();
   }

package/src/core/codeintel/vectorProvider.js

@@ -9,9 +9,19 @@ import { createEdge } from './providers.js';
 // no deps — real embeddings plug in later through the injectable `loader`
 // seam (config.codeIntel.embedding.provider === 'auto'), degrading to the
 // hashed provider on ANY failure. Never throws.
+// C92-F-10: corpus doc vectors are cached on the provider instance (bounded —
+// EMBED_CACHE_MAX docs) and scoring streams docs one at a time, so a query no
+// longer re-embeds the corpus or holds every vector live at once. Retrievals
+// share one provider per (rootDir, embedding config) via retriever.js
+// embeddingProviderFor, which is what lets this cache pay off across calls.
 
 const DEFAULT_DIMENSIONS = 256;
 const DEFAULT_LIMIT = 20;
+// Doc-vector cache bound (C92-F-10): ~2 KiB per cached 256-dim vector, so the
+// cap keeps the cache near ~8 MiB per provider instance. On overflow the cache
+// resets (doc texts are content-addressed, so eviction can only cost a
+// re-embed — never a wrong score).
+const EMBED_CACHE_MAX = 4096;
 
 function fnv1a(str) {
   let h = 0x811c9dc5;
@@ -97,6 +107,19 @@ export class HashedEmbeddingProvider {
     this._embedFn = typeof embedFn === 'function' ? embedFn : null;
   }
 
+  // Doc-vector cache: docText → vector. Doc texts are content-addressed, so a
+  // stale key can never alias onto different content; index churn only costs a
+  // re-embed of the changed doc text.
+  async #embedDoc(text) {
+    if (!this._docVec) this._docVec = new Map();
+    const cached = this._docVec.get(text);
+    if (cached) return cached;
+    const vec = await this.embed(text);
+    if (this._docVec.size >= EMBED_CACHE_MAX) this._docVec.clear();
+    this._docVec.set(text, vec);
+    return vec;
+  }
+
   async available() {
     return true;
   }
@@ -139,10 +162,13 @@ export class HashedEmbeddingProvider {
         docs.set(sym.filePath, `${docs.get(sym.filePath) ?? sym.filePath} ${sym.name}`);
       }
       const snapshot = ctx?.snapshot ?? null;
-      const scored = await Promise.all([...docs.entries()].map(async ([filePath, docText]) => ({
-        filePath,
-        score: cosineSimilarity(queryVec, await this.embed(docText)),
-      })));
+      // C92-F-10: score docs one at a time (cached vectors reused; at most one
+      // embed is ever in flight) rather than Promise.all over the corpus, which
+      // kept every 256-float vector live simultaneously.
+      const scored = [];
+      for (const [filePath, docText] of docs) {
+        scored.push({ filePath, score: cosineSimilarity(queryVec, await this.#embedDoc(docText)) });
+      }
       return scored
         .filter((entry) => entry.score > 0)
         .sort((a, b) => b.score - a.score || a.filePath.localeCompare(b.filePath))

package/src/core/compact/index.js

@@ -101,12 +101,19 @@ export function compactContextBlock(
           forceFirstCount: (header ? 1 : 0) + normalizedAnchorLines.length,
         },
       ).join('\n').trim();
-      validationMode = 'forced-anchors';
+      // 'forced-anchors' means every anchor is present — verify it. When the block
+      // budget cannot hold them all, the mode must report the shortfall instead of
+      // claiming an anchor-complete block that silently dropped the tail anchors
+      // (C92-H-03: the dropped tail used to be memory-bridge + ask-before-drop).
+      validationMode = findMissingAnchors(text, normalizedAnchorLines).length === 0
+        ? 'forced-anchors'
+        : 'anchor-shortfall';
     }
   }
 
   const tokensBefore = estimateTokenCount(rawText);
   const tokensAfter = estimateTokenCount(text);
+  const missingAnchors = findMissingAnchors(text, normalizedAnchorLines);
 
   return {
     text,
@@ -115,6 +122,7 @@ export function compactContextBlock(
     savedTokens: Math.max(0, tokensBefore - tokensAfter),
     validationMode,
     anchorCount: normalizedAnchorLines.length,
+    missingAnchors,
   };
 }
 
@@ -167,6 +175,7 @@ function buildCompactedContextLines(
   const seen = new Set();
   let usedTokens = 0;
   let nonEmptyCount = 0;
+  let forcedRemaining = forceFirstCount;
 
   for (const line of sourceLines) {
     const compressed = compressLine(line);
@@ -180,12 +189,18 @@ function buildCompactedContextLines(
     }
 
     const tokens = estimateTokenCount(compressed);
-    const forceLine = nonEmptyCount < forceFirstCount;
+    // Forced lines (header + anchors) are the first `forceFirstCount` distinct
+    // non-empty source lines: they bypass the line cap and the soft token budget —
+    // dropping a forced anchor would silently break the anchor contract this
+    // function exists to enforce. The quota is consumed on the candidate itself,
+    // whether or not it fits, so a dropped forced anchor never slides its slot
+    // onto a following content line.
+    const forceLine = forcedRemaining > 0;
+    if (forceLine) {
+      forcedRemaining -= 1;
+    }
     const wouldExceedLines = nonEmptyCount >= maxLines;
 
-    // Forced lines (header + anchors) are guaranteed placement: they bypass the
-    // line cap — dropping a forced anchor would silently break the anchor
-    // contract this function exists to enforce.
     if ((!forceLine && wouldExceedLines) || (!forceLine && selected.length > 0 && (usedTokens + tokens) > maxTokens)) {
       break;
     }
@@ -195,8 +210,11 @@ function buildCompactedContextLines(
       : compressed;
     const selectedTokens = estimateTokenCount(selectedLine);
 
+    // A forced line whose remaining slice of hardTokenCap is empty used to break
+    // the loop, dropping every anchor after it. Keep going so later anchors still
+    // get their chance — the caller reports whichever anchors never landed.
     if (!selectedLine) {
-      break;
+      continue;
     }
 
     selected.push(selectedLine);
@@ -204,7 +222,6 @@ function buildCompactedContextLines(
     usedTokens += selectedTokens;
     nonEmptyCount += 1;
   }
-
   if (selected.length === 0) {
     return compressMarkdownLines(sourceLines, {
       maxTokens,

package/src/core/compact/threshold.js

@@ -469,12 +469,18 @@ export async function buildCompactThresholds(config = {}) {
   const hardCapTokens = negotiated
     ? Math.max(1, Math.min(shippedHardCap, negotiated.capTokens))
     : shippedHardCap;
-  // An explicit operator tokenThreshold is honored as-is; otherwise the advisory phase is
-  // derived from the negotiating cap so it can never sit above the cap it precedes.
+  // An explicit operator tokenThreshold is honoured but still clamped under the
+  // negotiated cap: an advisory soft/hard pair sitting at or above hardCapTokens can
+  // never fire, because context-hardcap-gate.sh already refuses tools at the cap
+  // (C92-H-01 — on a default install tokenThreshold is the shipped 150k default, not a
+  // real operator choice, so this is correcting a number, not overriding intent).
   const softThreshold = explicitSoftThreshold > 0
-    ? Math.max(1, explicitSoftThreshold)
+    ? Math.max(1, Math.min(explicitSoftThreshold, hardCapTokens - 1))
     : Math.max(1, Math.round(hardCapTokens * SOFT_TO_CAP_RATIO));
-  const hardThreshold = Math.max(softThreshold + 1, Math.round(softThreshold * 1.6));
+  const hardThreshold = Math.min(
+    hardCapTokens,
+    Math.max(softThreshold + 1, Math.round(softThreshold * 1.6)),
+  );
   const baselineTokens = Math.max(120, Math.min(18_000, Math.round(softThreshold * 0.18)));
 
   return {
@@ -607,6 +613,9 @@ export function resolveThresholdCompactBudget({
 // this shape (raw JSON readers) still see a coherent state.
 // Mirrors template_project/.claude/ukit/runtime/compact-threshold.mjs — keep in lockstep.
 const PRESSURE_SESSIONS_MAX = 8;
+// C90-16: sessionless writers (omp tool events without session_id/transcript)
+// accumulate here — never on the newest sibling's record.
+const SESSIONLESS_PRESSURE_BUCKET = '_sessionless';
 
 function normalizeSessionId(value) {
   const id = typeof value === 'string' ? value.trim() : '';
@@ -627,12 +636,20 @@ function readPressureDocument(raw) {
   return raw && typeof raw === 'object' ? { default: raw } : {};
 }
 
-function pickPressureSession(sessions, sessionId) {
+function pickPressureSession(sessions, sessionId, { forWrite = false } = {}) {
   if (sessionId) {
     // A session id that has no record yet starts clean — it must not inherit another
     // session's totals, and the other way round nothing here touches that session.
     return { id: sessionId, record: sessions[sessionId] ?? null };
   }
+  if (forWrite) {
+    // C90-16: a writer without a session id must never accumulate onto the
+    // newest sibling's record — cross-session pressure corruption survives a
+    // SessionStart reset and wedges that session's hard-cap gate. Sessionless
+    // mutations accumulate on a dedicated bucket instead, even when the
+    // document holds no records yet.
+    return { id: SESSIONLESS_PRESSURE_BUCKET, record: sessions[SESSIONLESS_PRESSURE_BUCKET] ?? null };
+  }
   const entries = Object.entries(sessions);
   if (!entries.length) {
     return { id: 'default', record: null };
@@ -669,11 +686,22 @@ export async function buildCompactPressureState(rawState = null, config = {}) {
   const rawSoftThreshold = finiteNumber(rawState?.softThreshold, 0);
   const rawHardThreshold = finiteNumber(rawState?.hardThreshold, 0);
   if (!finiteNumber(config?.compact?.tokenThreshold, 0) && rawSoftThreshold > 0) {
-    thresholds.softThreshold = rawSoftThreshold;
-    thresholds.hardThreshold = rawHardThreshold > rawSoftThreshold
-      ? rawHardThreshold
-      : Math.max(rawSoftThreshold + 1, Math.round(rawSoftThreshold * 1.6));
-    thresholds.baselineTokens = Math.max(120, Math.min(18_000, Math.round(thresholds.softThreshold * 0.18)));
+    // A persisted pair is only honoured while it still sits inside the negotiated cap.
+    // The record outlives capacity negotiation: an install that ran before the record
+    // existed, or before the model was verified, carries thresholds tuned for the
+    // shipped 500k ceiling — restoring them re-pins the advisory ABOVE the live
+    // hardCapTokens forever (C92-H-02). Falling through keeps the freshly derived
+    // pair, which is also what the rewritten record persists, so the file self-heals.
+    if (rawSoftThreshold < thresholds.hardCapTokens) {
+      thresholds.softThreshold = rawSoftThreshold;
+      thresholds.hardThreshold = Math.min(
+        thresholds.hardCapTokens,
+        rawHardThreshold > rawSoftThreshold
+          ? rawHardThreshold
+          : Math.max(rawSoftThreshold + 1, Math.round(rawSoftThreshold * 1.6)),
+      );
+      thresholds.baselineTokens = Math.max(120, Math.min(18_000, Math.round(thresholds.softThreshold * 0.18)));
+    }
   }
   const recentPrompts = (Array.isArray(rawState?.recentPrompts) ? rawState.recentPrompts : [])
     .map((entry) => normalizePromptEntry(entry))
@@ -1017,17 +1045,23 @@ export async function buildThresholdCompactPlan({
   const compacted = compactContextBlock(rawLines, {
     maxTokens: budget.maxTokens,
     maxLines: budget.maxLines,
+    // Guardrail anchors are listed FIRST: under hard pressure the block budget may
+    // not fit every anchor, and the lines that protect the user (ask-before-drop)
+    // and the session (memory bridge) are the ones that must never be the tail
+    // casualty (C92-H-03).
     anchorLines: [
       thresholdLine,
+      askBeforeDropLine,
+      memoryBridgeLine,
       routeLine,
       previousLine,
       outputLine,
-      memoryBridgeLine,
-      askBeforeDropLine,
     ].filter(Boolean),
     maxAnchors: 6,
   });
 
+  const missingAnchors = compacted.missingAnchors ?? [];
+
   return {
     active: true,
     phase,
@@ -1040,6 +1074,7 @@ export async function buildThresholdCompactPlan({
     tokensBefore: compacted.tokensBefore,
     tokensAfter: compacted.tokensAfter,
     savedTokens: compacted.savedTokens,
+    missingAnchors,
   };
 }
 
@@ -1057,7 +1092,7 @@ async function mutateCompactPressureState(projectRoot, mutator, config = {}) {
   const runtimePaths = buildRuntimePaths(projectRoot);
   return withFileLock(runtimePaths.compactPressurePath, async () => {
     const sessions = readPressureDocument(await readJsonIfExists(runtimePaths.compactPressurePath));
-    const { id, record } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId));
+    const { id, record } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId), { forWrite: true });
     const current = await buildCompactPressureState(record, config);
     const next = await mutator(current);
     const normalized = await buildCompactPressureState(next, config);
@@ -1071,7 +1106,7 @@ export async function writeCompactPressureState(projectRoot, state, config = {})
   const runtimePaths = buildRuntimePaths(projectRoot);
   return withFileLock(runtimePaths.compactPressurePath, async () => {
     const sessions = readPressureDocument(await readJsonIfExists(runtimePaths.compactPressurePath));
-    const { id } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId));
+    const { id } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId), { forWrite: true });
     const normalized = await buildCompactPressureState(state, config);
     sessions[id] = { ...normalized, updatedAt: Date.now() };
     await writeJson(runtimePaths.compactPressurePath, projectPressureDocument(sessions));

package/src/core/diffPlan.js

@@ -5,17 +5,34 @@ import { isOmpConfigTarget, mergeOmpConfig } from './ompConfigMerge.js';
 
 const GATEWAY_RESILIENCE_KEYS = new Set(Object.keys(GATEWAY_RESILIENCE_ENV_DEFAULTS));
 
-async function readFileOrNull(filePath, encoding = 'utf8') {
+// Read errors split in two: ENOENT is the ONLY state that means "absent" (→ a
+// 'create' plan). Every other error — EACCES, EISDIR, EIO, ENOTDIR — means the
+// target may exist but cannot be compared. Collapsing those into `null` would
+// look identical to "missing" and the apply step would either overwrite the
+// live file atomically with no .bak (W2-C4) or crash mid-install on a 'wx'
+// create (W2-C6). Unreadable targets get a non-write action instead.
+async function readFileOrStatus(filePath, encoding = 'utf8') {
   try {
     if (encoding === null) {
-      return await fs.readFile(filePath);
+      return { status: 'ok', content: await fs.readFile(filePath) };
     }
-    return await fs.readFile(filePath, encoding);
-  } catch {
-    return null;
+    return { status: 'ok', content: await fs.readFile(filePath, encoding) };
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      return { status: 'missing' };
+    }
+    return { status: 'unreadable', error };
   }
 }
 
+function conflictResult(entry, error) {
+  const code = error?.code ?? 'unknown';
+  console.warn(
+    `[UKit] Warning: cannot read ${entry.targetPath} (${code}) — leaving it untouched instead of treating it as absent. Fix permissions or remove it manually.`,
+  );
+  return { ...entry, exists: true, action: 'conflict', existingContent: null };
+}
+
 async function checkLinkStatus(targetPath, linkTarget) {
   try {
     const stat = await fs.lstat(targetPath);
@@ -201,33 +218,41 @@ function resolveFileAction(entry, existingContent) {
 
 // A `mergeStrategy: skip` target must never be classified as "missing" just because it
 // cannot be READ — a directory, broken symlink, FIFO/device, or unreadable (EACCES) file
-// at the seed path all mean "exists, do not touch". readFileOrNull would turn every one
-// of those into null → 'create' → an overwrite attempt. Existence for skip entries is
-// decided by lstat (no symlink follow, no device open — reading a FIFO would hang).
+// at the seed path all mean "exists, do not touch". An lstat that fails for a reason
+// OTHER than ENOENT (W2-C6: EACCES on a parent, ELOOP, ENOTDIR) proves nothing at all —
+// treating it as "absent" would send a 'create' action to apply, whose exclusive 'wx'
+// write then crashes mid-install on a target that may have been there all along.
+// Existence for skip entries is decided by lstat (no symlink follow, no device open —
+// reading a FIFO would hang).
 async function resolveSkipEntryAction(entry) {
   let stat;
   try {
     stat = await fs.lstat(entry.targetPath);
-  } catch {
-    // ENOENT (or a stat failure we cannot distinguish from it) is the only state that
-    // means "seed me"; the apply step still uses an exclusive 'wx' create for the race.
-    return { ...entry, exists: false, action: 'create', existingContent: null };
+  } catch (statError) {
+    if (statError?.code === 'ENOENT') {
+      // Truly absent — seed it. The apply step still uses an exclusive 'wx'
+      // create so a target appearing between diff and apply is not clobbered.
+      return { ...entry, exists: false, action: 'create', existingContent: null };
+    }
+    return conflictResult(entry, statError);
   }
 
   // Only a regular, readable file can prove byte-equality for an 'unchanged' verdict.
   // Anything else — directory, symlink (valid or broken), FIFO, socket, device, or a
   // file we cannot read — is simply 'skip': present, owner-owned, hands off.
-  let existingContent = null;
-  if (stat.isFile() && !stat.isSymbolicLink()) {
-    existingContent = await readFileOrNull(
-      entry.targetPath,
-      Buffer.isBuffer(entry.renderedContent) ? null : 'utf8',
-    );
-  }
-  if (existingContent === null) {
+  if (!stat.isFile() || stat.isSymbolicLink()) {
     return { ...entry, exists: true, action: 'skip', existingContent: null };
   }
-  return resolveFileAction(entry, existingContent);
+  const read = await readFileOrStatus(
+    entry.targetPath,
+    Buffer.isBuffer(entry.renderedContent) ? null : 'utf8',
+  );
+  if (read.status !== 'ok') {
+    // 'missing' here means it vanished between lstat and read; 'unreadable'
+    // means present-but-inaccessible. Either way: owner territory, skip it.
+    return { ...entry, exists: read.status === 'unreadable', action: 'skip', existingContent: null };
+  }
+  return resolveFileAction(entry, read.content);
 }
 
 export async function diffInstallPlan(plan) {
@@ -243,11 +268,14 @@ export async function diffInstallPlan(plan) {
         return resolveSkipEntryAction(entry);
       }
 
-      const existingContent = await readFileOrNull(
+      const read = await readFileOrStatus(
         entry.targetPath,
         Buffer.isBuffer(entry.renderedContent) ? null : 'utf8',
       );
-      return resolveFileAction(entry, existingContent);
+      if (read.status === 'unreadable') {
+        return conflictResult(entry, read.error);
+      }
+      return resolveFileAction(entry, read.status === 'ok' ? read.content : null);
     }),
   );
 

package/src/core/ensureGitignore.js

@@ -73,7 +73,12 @@ function parseGitignore(content) {
  * The block spans `[startIdx, endIdx]` inclusive. The search for the closing
  * marker is bounded by the NEXT start marker, so an excision can never run past
  * a second block. If no end marker exists inside that bound the block is
- * "unterminated" and ends just before the next start marker (or at EOF).
+ * "unterminated" (C92-C-01) and its excision boundary stops at the contiguous
+ * run of canonical entries following the start marker — a `.gitignore` has no
+ * marker where a deleted `# /UKit` should end, so only exact canonical-entry
+ * lines provably written by UKit are managed. Everything else — blank lines,
+ * user comments, stale or custom rules — is user content and is never spliced
+ * out.
  *
  * @param {string[]} lines `\r`-free lines from {@link parseGitignore}
  * @param {number} [from]
@@ -94,7 +99,19 @@ function locateBlock(lines, from = 0) {
   }
 
   const terminated = endIdx !== -1;
-  return { startIdx, endIdx: terminated ? endIdx : bound - 1, terminated };
+  if (terminated) {
+    return { startIdx, endIdx, terminated };
+  }
+
+  // Unterminated: own only the contiguous canonical-entry run right after the
+  // start marker. The canonical block is regenerated in full anyway, so this
+  // run is information-free; stopping at the first non-entry line is what keeps
+  // arbitrary user rules below the header safe (C92-C-01).
+  let lastManaged = startIdx;
+  while (lastManaged + 1 < bound && UKIT_ENTRIES.includes(lines[lastManaged + 1])) {
+    lastManaged += 1;
+  }
+  return { startIdx, endIdx: lastManaged, terminated };
 }
 
 export async function ensureGitignore(projectRoot) {