@sema-agent/core 5.38.0 → 5.40.0

package/dist/core/memory-engine/index.d.ts

@@ -1,7 +1,8 @@
 export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, } from "./tools.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
-export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, type ScannedEntryFile, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, } from "./file-backend.js";
+export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, type ScannedEntryFile, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, type MemoryExportSnapshot, } from "./file-backend.js";
+export { computeBundleSectionHashes, computeMemoryBundleHash, memoryBundleInvalid, type MemoryExportBundle, type MemoryImportReport, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, } from "./export-bundle.js";
 export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAppendResult, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, } from "./layout.js";
 export { readV2HeaderHints, type V2HeaderHints } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, type ParsedEntryFile } from "./frontmatter.js";

package/dist/core/memory-engine/index.js

@@ -2,6 +2,7 @@ export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, } from "./tools.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, erasureSelectHash, } from "./file-backend.js";
+export { computeBundleSectionHashes, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
 export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, } from "./layout.js";
 export { readV2HeaderHints } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile } from "./frontmatter.js";

package/dist/core/memory-engine/layout.d.ts

@@ -284,6 +284,25 @@ export declare function markSessionPolluted(controlDir: string, sessionId: strin
  *  record stands in. Only ABSENCE is clean, so a control plane that cannot be stat'ed at all reads
  *  clean for every session rather than disabling memory deployment-wide. */
 export declare function readSessionPollution(controlDir: string, sessionId: string): SessionPollutionRecord | undefined;
+/**
+ * design/178 v2-c §3-3 — enumerate EVERY durable pollution marker (the export snapshot's pollution
+ * face; `readSessionPollution` stays the per-session read). Same fail-closed record posture as the
+ * per-session read: a marker file that exists but cannot be read or parsed answers a synthesized
+ * record, never a silent omission (corruption must not launder the state out of an export). An
+ * absent marker directory is the genuine empty state (ENOENT-only); any OTHER enumeration failure
+ * THROWS — a listing that silently dropped markers would export a package that launders pollution.
+ */
+export declare function listSessionPollution(controlDir: string): Record<string, SessionPollutionRecord>;
+/**
+ * design/178 v2-c §5.3 — the STRICT durable pollution import. Deliberately NOT
+ * `markSessionPolluted`: that leg is best-effort-with-disclosure and mints its own `at`, so a
+ * bundle's source record (the governance fact being carried) could neither land verbatim nor prove
+ * durability. This leg writes the SOURCE record verbatim (`wx`); on EEXIST it reads the standing
+ * record back and COMPARES — equal = converged no-op, different = the destination's first-mark-wins
+ * record stands and the divergence is REPORTED (`"divergent"`), never silently absorbed. Any other
+ * write failure THROWS (the import aborts with its latch standing — §1-2⑤).
+ */
+export declare function importSessionPollution(controlDir: string, sessionId: string, record: SessionPollutionRecord): "written" | "already" | "divergent";
 /** The retrieved-account sidecar (control plane): entry id → { count, lastAt }. */
 export declare const USAGE_RETRIEVED_FILE = "usage-retrieved.json";
 /** Bound on tracked ids — over the cap, the entries with the OLDEST `lastAt` are evicted first
@@ -320,10 +339,15 @@ export interface LineageContribution {
     lastRev: string;
     lastAt: number;
 }
-/** One staged (pre-commit) row: an entry this transaction WOULD commit. */
+/** One staged (pre-commit) row: an entry this transaction WOULD commit. `kind: "latch-only"` marks
+ *  a bundle-import SYNTHETIC latch row (design/178 v2-c §1): it withholds the id on the model-visible
+ *  read faces exactly like a real staged row, but it is NOT a contribution — the erasure lane's
+ *  capture-and-clear strikes it without crediting its txn's sessionId, and the host adjudication
+ *  refuses to touch its transaction (the import protocol's receipt-gated release is the only exit). */
 export interface LineagePendingRow {
     entryId: string;
     rev: string;
+    kind?: "latch-only";
 }
 /** One staged transaction: rows land BEFORE `applyPatches`; the commit credential lands after it
  *  succeeds; promotion consumes both. A pending txn without a credential is the crash window —
@@ -338,6 +362,12 @@ export interface LineagePendingTxn {
         appliedIds: string[];
         at: number;
     };
+    /** design/178 v2-c §1 — present ⇔ this txn is a bundle-import SYNTHETIC LATCH: it never promotes
+     *  (no credential is ever written), the generic adjudication REFUSES both arms on it, and the only
+     *  release channel is {@link releaseImportLatch} (durable completion-receipt precondition). An
+     *  older binary reads it as an ordinary uncredentialed pending txn and reports it undecidable —
+     *  the accepted mixed-version posture (the drain precondition of the ledger family applies). */
+    kind?: "latch-only";
 }
 /** Stage this transaction's would-commit rows BEFORE `applyPatches` (write-ahead). Throws on any
  *  write/lock/corruption failure — the caller refuses the whole harvest (fail-closed). */
@@ -373,8 +403,39 @@ export declare function reconcileLineage(controlDir: string, now: () => number):
         txnId: string;
         sessionId: string;
         entryIds: string[];
+        kind?: "latch-only";
     }>;
 };
+/** design/178 v2-c §1 — the import COMPLETION-RECEIPT directory (control plane): one `wx`-minted
+ *  JSON per bundle hash, written only after the import's governance legs all landed. Its presence
+ *  is {@link releaseImportLatch}'s hard precondition and the idempotent re-import's short-circuit
+ *  credential. */
+export declare const IMPORT_RECEIPTS_DIR = "import-receipts";
+/** The lineage txn id of a bundle import's synthetic latch (ONE latch per bundle — a re-import of
+ *  the same bundle re-stages the same txn id, which is what makes the latch idempotent). */
+export declare function importLatchTxnId(bundleHash: string): string;
+/**
+ * design/178 v2-c §1-1 — stage the bundle import's SYNTHETIC LATCH: one pending lineage txn
+ * (txnId = {@link importLatchTxnId}) whose rows name every bundle entry id, every row and the txn
+ * itself carrying the structural `kind: "latch-only"` seat. From this write until
+ * {@link releaseImportLatch}, those ids are withheld on every model-visible read face (the same
+ * dirty-latch consumption real staged rows get) — a crash anywhere inside the import leaves the
+ * withhold standing (durable pending row), and re-staging the same bundle is an idempotent
+ * overwrite with identical content. Never credentialed, never promoted.
+ */
+export declare function stageImportLatch(controlDir: string, bundleHash: string, rows: ReadonlyArray<{
+    entryId: string;
+    rev: string;
+}>, now: () => number): string;
+/**
+ * design/178 v2-c §1-2⑥ — the ONE latch release channel. Hard precondition: the durable completion
+ * receipt for the bundle is IN PLACE (`import-receipts/<bundleHash>.json`, minted after the
+ * governance legs all landed) — absent receipt ⇒ loud refusal, the latch stands, and convergence is
+ * re-running the same bundle import. Receipt-presence is ENOENT-only-absent (a probe failure never
+ * reads as "no receipt" — fail-closed). Idempotent: an already-released (absent) txn is a no-op;
+ * a NON-latch txn under the id is refused (this is never a generic discard).
+ */
+export declare function releaseImportLatch(controlDir: string, txnId: string): void;
 /** The DIRTY-LATCH set: every entry id named by ANY pending row (credentialed or not). While an id
  *  is latched, its model-visible read faces (index mechanical rows / memory_search / memory_get)
  *  refuse — "the account is not settled, the content does not go on the table". Throws on a
@@ -429,6 +490,33 @@ export declare function clearLineageForEntries(controlDir: string, entryIds: rea
  * carries the chain's pre-captured set (honest downgrade, never a fabricated rebuild).
  */
 export declare function captureAndClearLineageForEntries(controlDir: string, entryIds: readonly string[]): Map<string, string[]>;
+/** One (entryId, sessionId) pair whose imported value LOST to the destination's standing row —
+ *  design/178 v2-c §5.1's disclosure seat (kept is always "destination": the in-account fact is
+ *  never overwritten by an equal-time divergent import, only reported). */
+export interface LineageImportDivergence {
+    entryId: string;
+    sessionId: string;
+    kept: "destination";
+}
+/**
+ * design/178 v2-c §5.1 — the lineage FIDELITY importer: write bundle lineage rows into the
+ * committed set VERBATIM (`lastRev`/`lastAt` carried byte-for-byte — the promote leg mints its own
+ * `now` and is therefore unusable for carriage). Deterministic same-key merge, idempotent under
+ * re-import of the same bundle:
+ *  - destination has no (entryId, sessionId) row ⇒ the source row lands verbatim;
+ *  - both present, source `lastAt` is GREATER ⇒ source wins ("last contribution" is a time-axis
+ *    fact); destination greater ⇒ destination stands (no divergence — the merge is deterministic);
+ *  - equal `lastAt`, equal `lastRev` ⇒ no-op; equal `lastAt`, DIFFERENT `lastRev` ⇒ the
+ *    destination row stands and the pair is reported (first-mark-wins side: an in-account fact is
+ *    never rewritten by an外来 package; the disagreement must not be silent).
+ * Throws on a corrupt ledger (fail-closed family).
+ */
+export declare function importLineageCommitted(controlDir: string, rows: ReadonlyArray<{
+    entryId: string;
+    sessionId: string;
+    lastRev: string;
+    lastAt: number;
+}>): LineageImportDivergence[];
 /** Full-ledger read (tests / host observability). Throws on corruption. */
 export declare function readLineageRecord(controlDir: string): {
     committed: Record<string, Record<string, LineageContribution>>;

package/dist/core/memory-engine/layout.js

@@ -766,6 +766,48 @@ export function readSessionPollution(controlDir, sessionId) {
     }
     return { at: 0, reason: "pollution marker present but unreadable (kept fail-closed)" };
 }
+export function listSessionPollution(controlDir) {
+    const dir = join(controlDir, SESSION_POLLUTION_DIR);
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new ControlPlaneCorruptError(`session pollution markers could not be enumerated (${err.code ?? "io error"}) at ${dir} — an enumeration failure is not an empty set (fail-closed)`, { cause: err });
+    }
+    const out = Object.create(null);
+    for (const name of names.sort()) {
+        if (!name.endsWith(".json"))
+            continue;
+        let sessionId;
+        try {
+            sessionId = decodeURIComponent(name.slice(0, -".json".length));
+        }
+        catch {
+            continue;
+        }
+        const rec = readSessionPollution(controlDir, sessionId);
+        if (rec !== undefined)
+            out[sessionId] = rec;
+    }
+    return out;
+}
+export function importSessionPollution(controlDir, sessionId, record) {
+    const path = pollutionPath(controlDir, sessionId);
+    ensureDirExists(dirname(path));
+    try {
+        writeFileSync(path, `${JSON.stringify({ at: record.at, reason: record.reason }, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+        return "written";
+    }
+    catch (err) {
+        if (!(err instanceof Error && "code" in err && err.code === "EEXIST"))
+            throw err;
+    }
+    const standing = readSessionPollution(controlDir, sessionId);
+    return standing !== undefined && standing.at === record.at && standing.reason === record.reason ? "already" : "divergent";
+}
 export const USAGE_RETRIEVED_FILE = "usage-retrieved.json";
 export const USAGE_RETRIEVED_MAX_IDS = 4096;
 function coerceRetrievedAccount(raw) {
@@ -932,10 +974,14 @@ function coerceLineage(raw) {
         if (!txn || typeof txn !== "object" || typeof txn.sessionId !== "string" || typeof txn.at !== "number" || !Array.isArray(txn.rows)) {
             throw badShape(`pending[${JSON.stringify(txnId)}]`);
         }
+        if (txn.kind !== undefined && txn.kind !== "latch-only")
+            throw badShape(`pending[${JSON.stringify(txnId)}] kind`);
         for (const row of txn.rows) {
             const p = row;
             if (!p || typeof p !== "object" || typeof p.entryId !== "string" || typeof p.rev !== "string")
                 throw badShape(`pending[${JSON.stringify(txnId)}] row`);
+            if (p.kind !== undefined && p.kind !== "latch-only")
+                throw badShape(`pending[${JSON.stringify(txnId)}] row kind`);
         }
         if (txn.credential !== undefined) {
             const c = txn.credential;
@@ -1006,6 +1052,9 @@ export function adjudicateLineagePending(controlDir, txnId, action, now) {
         const txn = rec.pending[txnId];
         if (txn === undefined)
             return { result: [] };
+        if (isLatchOnlyTxn(txn)) {
+            throw new ControlPlaneCorruptError(`memory lineage ledger: pending transaction ${txnId} is a bundle-import latch — it cannot be ${action === "promote" ? "promoted (its rows are not contributions)" : "discarded (its withhold guards not-yet-governed imported entries)"}; re-run the same bundle import to converge it (releaseImportLatch is receipt-gated)`);
+        }
         if (action === "discard") {
             delete rec.pending[txnId];
             return { next: rec, result: [] };
@@ -1032,7 +1081,7 @@ export function reconcileLineage(controlDir, now) {
         let changed = false;
         for (const [txnId, txn] of Object.entries(rec.pending)) {
             if (txn.credential === undefined) {
-                undecidable.push({ txnId, sessionId: txn.sessionId, entryIds: txn.rows.map((r) => r.entryId) });
+                undecidable.push({ txnId, sessionId: txn.sessionId, entryIds: txn.rows.map((r) => r.entryId), ...(isLatchOnlyTxn(txn) ? { kind: "latch-only" } : {}) });
                 continue;
             }
             const applied = new Set(txn.credential.appliedIds);
@@ -1050,6 +1099,66 @@ export function reconcileLineage(controlDir, now) {
         return { ...(changed ? { next: rec } : {}), result: { promoted, undecidable } };
     });
 }
+function isLatchOnlyTxn(txn) {
+    if (txn.kind === "latch-only")
+        return true;
+    return txn.rows.some((row) => row.kind === "latch-only");
+}
+export const IMPORT_RECEIPTS_DIR = "import-receipts";
+export function importLatchTxnId(bundleHash) {
+    return `import:${bundleHash}`;
+}
+function importReceiptPath(controlDir, bundleHash) {
+    return join(controlDir, IMPORT_RECEIPTS_DIR, `${bundleHash}.json`);
+}
+export function stageImportLatch(controlDir, bundleHash, rows, now) {
+    const txnId = importLatchTxnId(bundleHash);
+    lockedStrictUpdate(controlDir, LINEAGE_FILE, "memory lineage ledger", coerceLineage, (rec) => {
+        const existing = rec.pending[txnId];
+        if (existing !== undefined && !isLatchOnlyTxn(existing)) {
+            throw new ControlPlaneCorruptError(`memory lineage ledger: pending transaction ${txnId} exists and is NOT an import latch — refusing to overwrite a real staged transaction`);
+        }
+        rec.pending[txnId] = {
+            sessionId: txnId,
+            at: now(),
+            kind: "latch-only",
+            rows: rows.map((r) => ({ entryId: r.entryId, rev: r.rev, kind: "latch-only" })),
+        };
+        return { next: rec, result: undefined };
+    });
+    return txnId;
+}
+export function releaseImportLatch(controlDir, txnId) {
+    const prefix = "import:";
+    if (!txnId.startsWith(prefix) || !/^[0-9a-f]{64}$/.test(txnId.slice(prefix.length))) {
+        throw new ControlPlaneCorruptError(`releaseImportLatch: ${JSON.stringify(txnId)} is not an import-latch transaction id (import:<64-hex bundleHash>)`);
+    }
+    const receipt = importReceiptPath(controlDir, txnId.slice(prefix.length));
+    let receiptPresent;
+    try {
+        readFileSync(receipt);
+        receiptPresent = true;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw new ControlPlaneCorruptError(`releaseImportLatch: the completion receipt at ${receipt} could not be read (${err.code ?? "io error"}) — a probe failure is not absence (fail-closed), and absence would refuse the release`, { cause: err });
+        }
+        receiptPresent = false;
+    }
+    if (!receiptPresent) {
+        throw new ControlPlaneCorruptError(`releaseImportLatch: no completion receipt at ${receipt} — the import's governance legs are not proven landed, the latch stays; re-run the same bundle import to converge`);
+    }
+    lockedStrictUpdate(controlDir, LINEAGE_FILE, "memory lineage ledger", coerceLineage, (rec) => {
+        const txn = rec.pending[txnId];
+        if (txn === undefined)
+            return { result: undefined };
+        if (!isLatchOnlyTxn(txn)) {
+            throw new ControlPlaneCorruptError(`releaseImportLatch: pending transaction ${txnId} is NOT an import latch — refusing (this channel never discards a real staged transaction)`);
+        }
+        delete rec.pending[txnId];
+        return { next: rec, result: undefined };
+    });
+}
 export function lineageLatchedIds(controlDir) {
     const rec = coerceLineage(readStrictSidecar(controlDir, LINEAGE_FILE, "memory lineage ledger"));
     const out = new Set();
@@ -1134,6 +1243,27 @@ export function captureAndClearLineageForEntries(controlDir, entryIds) {
         return { ...(changed ? { next: rec } : {}), result };
     });
 }
+export function importLineageCommitted(controlDir, rows) {
+    if (rows.length === 0)
+        return [];
+    return lockedStrictUpdate(controlDir, LINEAGE_FILE, "memory lineage ledger", coerceLineage, (rec) => {
+        const divergence = [];
+        let changed = false;
+        for (const row of rows) {
+            const sessions = (rec.committed[row.entryId] ??= Object.create(null));
+            const standing = Object.prototype.hasOwnProperty.call(sessions, row.sessionId) ? sessions[row.sessionId] : undefined;
+            if (standing === undefined || row.lastAt > standing.lastAt) {
+                sessions[row.sessionId] = { lastRev: row.lastRev, lastAt: row.lastAt };
+                changed = true;
+                continue;
+            }
+            if (row.lastAt === standing.lastAt && row.lastRev !== standing.lastRev) {
+                divergence.push({ entryId: row.entryId, sessionId: row.sessionId, kept: "destination" });
+            }
+        }
+        return { ...(changed ? { next: rec } : {}), result: divergence };
+    });
+}
 export function readLineageRecord(controlDir) {
     const rec = coerceLineage(readStrictSidecar(controlDir, LINEAGE_FILE, "memory lineage ledger"));
     return { committed: rec.committed, pending: rec.pending };

package/dist/core/memory-engine/memory-backend-contract.d.ts

@@ -22,7 +22,7 @@ export interface MemoryBackendContractHooks {
      * assembly answers it as capability-absent.
      */
     onOptionalMember?: (report: {
-        member: "committedSnapshotOf" | "committedSnapshotsOfScopes" | "custodyOf" | "eraseWithEvidence";
+        member: "committedSnapshotOf" | "committedSnapshotsOfScopes" | "custodyOf" | "eraseWithEvidence" | "exportSnapshotOf" | "governanceExport" | "custodyImport" | "importBundleCommit";
         status: "verified" | "absent";
     }) => void;
 }

package/dist/core/memory-engine/memory-backend-contract.js

@@ -384,6 +384,58 @@ export async function memoryBackendContract(hooks) {
         await assert.rejects(async () => erase.call(b, { requestId: "req-contract-1", select: { ids: ["id-other-7777"] } }), (err) => err.code === "memory.erasure_selector_mismatch", "a reused requestId with a different selector refuses loudly");
         hooks.onOptionalMember?.({ member: "eraseWithEvidence", status: "verified" });
     });
+    defer("design/178 v2-c optional export/import faces: export composite / governance slice / custody carriage (absent ⇒ reported)", async () => {
+        const b = await hooks.make();
+        const seats = [
+            ["exportSnapshotOf", b.exportSnapshotOf],
+            ["governanceExport", b.governanceExport],
+            ["custodyImport", b.custodyImport],
+            ["importBundleCommit", b.importBundleCommit],
+        ];
+        for (const [member, seat] of seats) {
+            assert.ok(seat === undefined || typeof seat === "function", `${member} must be undefined (absent) or a function — a non-function occupant is a defect, not absence`);
+        }
+        const e = entry("id-export-0001", "s1", "exported", "exported body", { name: "Exported" });
+        await b.applyPatches([{ op: "add", id: e.id, entry: e }]);
+        const exportSnapshotOf = typeof seats[0]?.[1] === "function" ? seats[0][1] : undefined;
+        if (exportSnapshotOf === undefined) {
+            hooks.onOptionalMember?.({ member: "exportSnapshotOf", status: "absent" });
+        }
+        else {
+            const snap = await exportSnapshotOf.call(b, ["s1"]);
+            assert.ok(typeof snap.storeId === "string" && snap.storeId.length > 0, "the export snapshot names the store identity");
+            assert.strictEqual(typeof snap.fullStore, "boolean");
+            assert.deepStrictEqual(snap.entries.map((r) => r.id), [e.id], "the composite answers the committed entries of the requested scopes");
+            assert.strictEqual(snap.entries[0]?.rev, e.rev, "entries carry the committed rev");
+            assert.ok(Array.isArray(snap.custody) && Array.isArray(snap.unbound) && Array.isArray(snap.pendingLatch));
+            hooks.onOptionalMember?.({ member: "exportSnapshotOf", status: "verified" });
+        }
+        const governanceExport = typeof seats[1]?.[1] === "function" ? seats[1][1] : undefined;
+        if (governanceExport === undefined) {
+            hooks.onOptionalMember?.({ member: "governanceExport", status: "absent" });
+        }
+        else {
+            const slice = await governanceExport.call(b, ["s1"]);
+            assert.strictEqual(slice.complete, true, "a quiet store's governance slice answers complete");
+            assert.ok(Array.isArray(slice.custody) && Array.isArray(slice.unbound));
+            hooks.onOptionalMember?.({ member: "governanceExport", status: "verified" });
+        }
+        const custodyImport = typeof seats[2]?.[1] === "function" ? seats[2][1] : undefined;
+        if (custodyImport === undefined) {
+            hooks.onOptionalMember?.({ member: "custodyImport", status: "absent" });
+        }
+        else {
+            const opts = { bundleHash: "c".repeat(64), sourceStoreId: "contract-src-store" };
+            const outcome = await custodyImport.call(b, [{ ev: "kit-del-1", channel: "delete", id: "id-ghost-kit-1", rev: "deadbeefdeadbeef", at: 1 }], opts);
+            assert.strictEqual(outcome.appended, 1, "a well-formed delete row for an absent id is carried (anti-resurrection evidence needs no living entry)");
+            assert.deepStrictEqual(outcome.withheld, []);
+            const unknown = await custodyImport.call(b, [{ ev: "kit-unk-1", channel: "kit-unknown-channel", payload: 1, at: 1 }], opts);
+            assert.strictEqual(unknown.appended, 0, "an unknown channel is never appended verbatim");
+            assert.deepStrictEqual(unknown.withheld, [{ srcEv: "kit-unk-1", channel: "kit-unknown-channel" }], "an unknown channel is withheld AND reported — never a whole-package refusal");
+            hooks.onOptionalMember?.({ member: "custodyImport", status: "verified" });
+        }
+        hooks.onOptionalMember?.({ member: "importBundleCommit", status: typeof seats[3]?.[1] === "function" ? "verified" : "absent" });
+    });
     if (!hooks.makeSibling) {
         const reason = hooks.skipCrossInstanceCas?.trim();
         if (reason) {

package/dist/core/memory-engine/tools.js

@@ -163,7 +163,14 @@ export function createMemoryEngineTools(opts) {
                     throw err;
                 return refusedSearch("error", GENERIC_FAILURE, "failed");
             }
-            const live = top.filter((h) => bodyById.has(h.id));
+            let terminalExclusions;
+            try {
+                terminalExclusions = planes.map((plane) => plane.challengeExclusions?.());
+            }
+            catch {
+                return refusedSearch("challenge_ledger_unavailable", "Memory search is unavailable: the challenge ledger for a mounted memory plane cannot be read (fail-closed). Report this to the operator.", "failed");
+            }
+            const live = top.filter((h) => bodyById.has(h.id) && terminalExclusions[h.planeIndex]?.has(h.id) !== true);
             if (live.length === 0) {
                 const details = { outcome: "ok", hits: [] };
                 return { content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.`, details };

package/dist/core/permission-rule-consent.d.ts

@@ -285,9 +285,9 @@ export interface CcImportLayer {
 /**
  * What the import WOULD do, shown before anyone confirms.
  *
- * `uncovered` is a two-key record, not a list: the two layers this version does not read are named in the
+ * `uncovered` is a fixed-key record, not a list: everything this version does not import is named in the
  * TYPE, so an empty list, a missing member or a duplicate is not expressible. A preview that reported only
- * the layers it read would be claiming completeness it does not have.
+ * what it read would be claiming completeness it does not have.
  */
 export interface ImportPreview {
     candidates: RuleCandidate[];
@@ -303,6 +303,26 @@ export interface ImportPreview {
     uncovered: {
         flagSettings: "not-imported-v1";
         policySettings: "not-imported-v1";
+        /**
+         * The deny/ask buckets of the layers actually read: how many entries are SITTING THERE, across all
+         * layers, that this import deliberately leaves in place (they are the tightening direction and have
+         * their own channel — importing them through a loosening lane would be the wrong door).
+         *
+         * Always present, zero when the buckets are absent or empty: "this settings file has 14 deny entries
+         * we did not touch" and "there was nothing there" are different facts, and a key that appears only in
+         * the first case makes them indistinguishable for a reader who sees one preview. The count is of
+         * ENTRIES IN PLACE, not of a decision — nothing here is skipped-and-lost; `skipped` stays the list of
+         * allow-bucket entries that did not become candidates.
+         *
+         * A bucket that is PRESENT but not an array cannot be counted; it contributes 0 and is disclosed in
+         * `skipped` under the layer's path, so a zero is never the report for something unreadable. Same for
+         * a layer whose whole `permissions` member is not an object — every bucket in it reads as absent,
+         * which is exactly the shape that would otherwise report two clean zeros.
+         */
+        denyAskBuckets: {
+            deny: number;
+            ask: number;
+        };
     };
 }
 /** What the import ACTUALLY did — a different moment and a different contract from the preview, because
@@ -320,8 +340,11 @@ export interface ImportResult {
  * Read the allow buckets of the user-editable settings layers and produce a preview plus a PENDING
  * approval record. Nothing is stored until someone confirms that record and the batch is redeemed.
  *
- * Only the allow bucket is read. The deny/ask buckets are the tightening direction and have their own
- * channel; importing them through a loosening lane would be the wrong door.
+ * Only the allow bucket is IMPORTED. The deny/ask buckets are the tightening direction and have their own
+ * channel; importing them through a loosening lane would be the wrong door. They are still COUNTED and
+ * reported (`preview.uncovered.denyAskBuckets`): by-design-not-imported and unnoticed look identical to
+ * the person confirming the batch, and only one of them is true here — the same reason the non-Bash allow
+ * entries are disclosed rather than dropped silently.
  */
 export declare function prepareCcImport(opts: {
     layers: CcImportLayer[];

package/dist/core/permission-rule-consent.js

@@ -337,12 +337,13 @@ async function applyRedemption(args) {
 function originOfRecordKind(kind) {
     return kind === "import" ? "imported-cc" : kind === "starter" ? "starter" : "user";
 }
-const IMPORT_UNCOVERED = { flagSettings: "not-imported-v1", policySettings: "not-imported-v1" };
+const IMPORT_UNCOVERED_LAYERS = { flagSettings: "not-imported-v1", policySettings: "not-imported-v1" };
 export async function prepareCcImport(opts) {
     const owner = resolveCallerOwner(opts.principal, opts.owner, "prepareCcImport");
     const candidates = [];
     const skipped = [];
     const layers = [];
+    const denyAskBuckets = { deny: 0, ask: 0 };
     for (const layer of opts.layers) {
         let raw;
         try {
@@ -356,14 +357,50 @@ export async function prepareCcImport(opts) {
             continue;
         }
         layers.push({ path: layer.path, layer: layer.layer, found: true });
-        let allow;
+        let settingsRoot;
         try {
-            allow = JSON.parse(raw)?.permissions?.allow;
+            settingsRoot = JSON.parse(raw);
         }
         catch (err) {
             skipped.push({ rule: layer.path, reason: `settings file is not valid JSON (${errText(err)})` });
             continue;
         }
+        let container;
+        if (settingsRoot === null)
+            container = undefined;
+        else if (typeof settingsRoot === "object" && !Array.isArray(settingsRoot))
+            container = settingsRoot.permissions;
+        else {
+            skipped.push({
+                rule: layer.path,
+                reason: `settings file is not a JSON object — no bucket in this layer could be read, so it is reported as unread rather than as empty (it stays in the settings file either way)`,
+            });
+            continue;
+        }
+        let permissions;
+        if (container === undefined || container === null)
+            permissions = undefined;
+        else if (typeof container === "object" && !Array.isArray(container))
+            permissions = container;
+        else {
+            skipped.push({
+                rule: layer.path,
+                reason: `settings "permissions" is not an object — no bucket in this layer could be read, so it is reported as unread rather than as empty (it stays in the settings file either way)`,
+            });
+            continue;
+        }
+        for (const bucket of ["deny", "ask"]) {
+            const entries = permissions?.[bucket];
+            if (Array.isArray(entries))
+                denyAskBuckets[bucket] += entries.length;
+            else if (entries !== undefined && entries !== null) {
+                skipped.push({
+                    rule: layer.path,
+                    reason: `settings ${bucket} bucket is not an array — its entries could not be counted for the not-imported report (it stays in the settings file either way)`,
+                });
+            }
+        }
+        const allow = permissions?.allow;
         if (!Array.isArray(allow))
             continue;
         const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
@@ -401,7 +438,7 @@ export async function prepareCcImport(opts) {
         createdAt: nowIso(opts.deps),
     };
     await opts.deps.approvals.create(record);
-    return { preview: { candidates, skipped, layers, uncovered: IMPORT_UNCOVERED }, approvalId: record.id };
+    return { preview: { candidates, skipped, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } }, approvalId: record.id };
 }
 export const STARTER_RULES = [
     "Bash(ls)",

package/dist/core/permission-rule-model.d.ts

@@ -29,7 +29,13 @@
  * here) and no leading-env-assignment stripping (`FOO=1 git status` simply does not match
  * `Bash(git status:*)`) — the last two are strict-side divergences from upstream, registered as such.
  */
-/** The one tool the v1 rule lane speaks for. The field exists on the rule so v2 can widen without a shape change. */
+/** The one tool the v1 rule lane speaks for. The field exists on the rule so v2 can widen without a shape change.
+ *
+ *  design/276 §3.3 (doctrine, for whoever widens this set): a future `SendMessage(…)`-form rule MAY
+ *  clear the peer-referral ask — that ask is classifier hesitation by construction (#144: allow rules
+ *  silence the classifier's questions, never a mandated one), so a recorded human yes is exactly what
+ *  clears it. The org/hook/matchedAskRule immunities stay: those conjuncts live in the gate's
+ *  persisted-rule lane and do not loosen with this set. */
 export type PersistedRuleTool = "Bash";
 /** v1 match forms. `"wildcard"` is reserved for v2 and is not a value this version ever produces. */
 export type PersistedRuleMatch = "exact" | "prefix";