@sema-agent/core 5.57.0 → 5.59.0

package/dist/core/memory-engine/engine.d.ts

@@ -1,11 +1,11 @@
 import type { EngineNotice } from "../types.js";
-import { type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type MemoryConsolidationOptions } from "./consolidation.js";
+import { type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
 import { foreignDanglingSessionAccounts, type EffectiveSettlement, type HoldRow } from "./delegation-settlement.js";
 import { type OriginClearanceRow } from "./origin-clearance.js";
 import { type CommittedBinding, type EraseMemoryEntriesInput, type MemoryErasureAttestation, type TransferEvidence } from "./file-backend.js";
 import { type MemoryExportBundle, type MemoryImportReport } from "./export-bundle.js";
 import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionMarkOutcome, type SessionPollutionRecord } from "./layout.js";
-import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemoryEntry, MemoryEntryOrigin, MemorySessionHandle, ScanFinding } from "./types.js";
+import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemoryEntry, MemoryEntryOrigin, MemoryScopeEnumeration, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
  * (bench/cc-parity-toolsuite/reminders/live-capture-main-session-2026-07-08.md §12), with the
@@ -251,7 +251,7 @@ export interface MemoryInjection {
      *  session's harvest / the backend's read-side external-change detection). Already rendered into
      *  {@link block}; exposed raw for observability/tests. Absent when the queue was empty. */
     announcements?: MemoryAnnouncement[];
-    /** The RENDERED announcements segment of {@link block} (design/142 S2b, codex H11): dual-root
+    /** The RENDERED announcements segment of {@link block} (design/142 S2b): dual-root
      *  merging composes from STRUCTURED fields — never by re-parsing `block` (whose instruction/index
      *  segments contain blank lines a split would shred). Absent when the queue was empty. */
     announceBlock?: string;
@@ -485,7 +485,7 @@ export interface ConsolidationReconcileReport {
         state: "completed" | "conflict";
     };
     releasedOrphanSeat?: string;
-    /** codex r2 — a seat whose plan file is absent but whose claim is YOUNGER than the freeze grace:
+    /** a seat whose plan file is absent but whose claim is YOUNGER than the freeze grace:
      *  a live commit is (very likely) mid-freeze; reconcile leaves it alone and reports it here. */
     seatInFlight?: string;
     corruptPlan?: {
@@ -514,6 +514,36 @@ export interface ConsolidationPlanSummary {
     directed?: number;
     intents?: number;
 }
+/**
+ * design/376 slice ③ (#436) — one plan's MEMBER-LEVEL fold evidence
+ * ({@link MemoryEngine.readConsolidationPlanFoldEvidence}'s answer): which entry ids this plan's
+ * APPLIED products attest as superseded. Discriminated so an unreadable plan can never be told
+ * apart from an empty one by accident.
+ */
+export type ConsolidationPlanFoldEvidence = {
+    state: "ok";
+    scope: string;
+    /** The commit call's requestId, frozen on the plan — the durable run-attribution anchor
+     *  (the driver's per-cycle requestIds share the run's prefix, so a cycle whose receipt was
+     *  lost to a crash is still attributable to its run through the plan file). */
+    requestId: string;
+    planState: ConsolidationPlanFile["state"];
+    /** Every supersession-edge target of an APPLIED product, deduplicated and sorted. Products
+     *  still pending/conflicted attest nothing — the store never saw their edges land. */
+    supersededTargets: string[];
+} | {
+    state: "absent";
+} | {
+    state: "corrupt";
+    detail: string;
+    /** Present when the plan FILE parsed and only its product frontmatter is damaged (the deep
+     *  per-product walk's corrupt arm): the frozen attribution anchors survive the damage, so a
+     *  caller can still attribute the damaged plan to a run — the conservation wall uses this
+     *  to fail closed ONLY on a run-owned damaged plan while a foreign/historical one is
+     *  skipped with disclosure. Absent when the file itself is unreadable/unparseable. */
+    scope?: string;
+    requestId?: string;
+};
 /** §2.2 — the recommendation notice, minted off the harvest report's advisory member (the runner's
  *  hold-notice consumption point is its natural home). Undefined ⇔ this harvest crossed no edge. */
 export declare function memoryConsolidationRecommendedNotice(report: HarvestReport, sessionId?: string): EngineNotice | undefined;
@@ -543,6 +573,28 @@ export declare function memoryConsolidationConflictNotice(input: {
     planId: string;
     scope: string;
 }): EngineNotice;
+/**
+ * design/376 §1.6-2 — the ADVISORY notice for a driver run that stopped short of its fixpoint
+ * (`memory.consolidation_incomplete`). Partial folds are measurably worse than no fold (currency
+ * queries regress to the unconsolidated baseline while the residue stays buried), so a run that
+ * committed some cycles and stopped must be visible as a TRANSITIONAL state — without this code an
+ * operator sees only a trail of `_committed` notices and cannot tell a settled library from one
+ * mid-fold. `stop` takes its value from the ONE closed set the run receipt uses
+ * ({@link ConsolidationRunStopReason}); the two channels never carry different vocabularies.
+ *
+ * The message branches on `cyclesDone` (truthfulness, both arms pinned): a run that stopped at
+ * the door — a parked seat, a failed mint — committed NOTHING, and its line says the library is
+ * unchanged by this run rather than asserting a partial fold this run never produced. (The
+ * PARTIAL-fold claim stays a per-run statement; whether the library was already mid-fold from an
+ * earlier run is the gate's account, not this line's.)
+ */
+export declare function memoryConsolidationIncompleteNotice(input: {
+    scope: string;
+    runId: string;
+    stop: ConsolidationRunStopReason;
+    residueProducts: number;
+    cyclesDone: number;
+}): EngineNotice;
 /** The refusal's notice dialect (the verb itself throws the coded {@link ConsolidationRefusedError};
  *  a host converting the throw into its notice stream uses this one spelling). */
 export declare function memoryConsolidationRefusedNotice(input: {
@@ -934,10 +986,18 @@ export declare class MemoryEngine {
     }>;
     /**
      * §1.2-2/§1.2-3 — verb ②: mechanical acceptance + plan FREEZE + apply-to-terminal. Structural
-     * violations (scan findings, out-of-snapshot attribution, caps, the instruction hard gate, the
-     * supersession fuse) refuse the WHOLE plan — zero partial freeze; per-product eligibility drift
-     * (an input's rev moved / an input got challenged between snapshot and freeze) refuses THAT
-     * product with a disclosed reason while the rest freeze (§1.2-2 冻结时资格复验).
+     * violations (out-of-snapshot attribution, caps, the instruction hard gate, the supersession
+     * fuse, an empty plan) refuse the WHOLE plan — zero partial freeze. Per-product refusals, each
+     * disclosed on the receipt (`products.refused`): eligibility drift (an input's rev moved / an
+     * input got challenged between snapshot and freeze, §1.2-2 冻结时资格复验) AND scan findings
+     * (design/376 C-2① — the explicit revision of 339 §1.2-2's whole-plan clause: one product's
+     * refused bytes must not permanently deny service to every other fold in the plan). The scan
+     * seat keeps two whole-plan backstops: the scan-refusal fuse (C-2②, {@link scanRefusalCeiling})
+     * refuses a plan saturated with scan-refused products, and a plan the freeze emptied entirely
+     * refuses rather than settling as a vacuous completed run (C-2③ — completion writes `lastRunAt`
+     * and stamps the full eligible set into the fingerprint, blinding every later incremental
+     * snapshot). Intent (directed) scan findings stay whole-plan: intents are host-authored, not
+     * driver products.
      */
     commitConsolidationPlan(cycleToken: string, proposal: ConsolidationProposal, opts: {
         requestId: string;
@@ -987,7 +1047,12 @@ export declare class MemoryEngine {
      * ABANDONED explicitly (audited; never a silent drop — unfulfilled and given-up stay two
      * distinguishable account facts, G24) and the seat releases; `retry` = the plan's unfulfilled
      * intents re-judge NOW into a NEW plan (fresh freeze, fresh baseRevs — the ONE authorized
-     * re-judgment point) which applies immediately. Both audited by requestId.
+     * re-judgment point) which applies immediately. A retry with NOTHING to re-judge (a
+     * products-only conflict plan, or every unfulfilled intent already credentialed) refuses
+     * instead of settling a vacuous completed run — C-2③'s empty-plan law at this corridor's door
+     * (the completion would burn the time gate and stamp the original cycle's eligible map into
+     * the fingerprint); `discard` is the exit that releases the seat without wearing the
+     * completed-run label. Both audited by requestId.
      */
     resolveConsolidationPlan(planId: string, action: "discard" | "retry", opts: {
         requestId: string;
@@ -1003,9 +1068,77 @@ export declare class MemoryEngine {
     private reconstructIntentsForRetry;
     /** §6.2 — host read face: every plan's summary (audit enumeration, zero model surface). */
     listConsolidationPlans(): ConsolidationPlanSummary[];
+    /**
+     * design/376 slice ③ (#436) — host read face: one plan's MEMBER-LEVEL fold evidence (which ids
+     * its APPLIED products supersede). This is the conservation wall's terminal witness: the
+     * driver's other two witnesses (per-cycle row delta, since-open store delta) are both
+     * store-COUNT readings, and an unrelated fold interleaved into the run's scope can numerically
+     * offset a planned member that was deleted mid-run — masking the shortfall behind a balanced
+     * count. Member identity cannot be offset: a planned member either appears among some
+     * run-attributed plan's applied supersession targets, sits in named residue, or the run must
+     * not wear the converged label. Committed plan-file read, side-effect-free; the answer carries
+     * the plan's frozen `requestId` so a caller can attribute plans to a run even across the
+     * commit→receipt crash window (the plan file is durable before any receipt is).
+     *
+     * SCOPE of the attestation, disclosed (an outside review probed it; recorded as the designed
+     * limit rather than patched): this is the committed HISTORICAL fact "this plan's edge landed" —
+     * it does not re-derive whether the edge still stands NOW. A target edit or a carrier challenge
+     * later SUSPENDS the edge (`deriveSupersededSet`'s revival law), and a competing writer may
+     * re-fold the revived member before the run's next snapshot; the attestation still exempts it
+     * and the run keeps its converged label. That label stays materially true in every reachable
+     * arm: the member's content is preserved in THIS run's committed carrier either way, the store
+     * is at a fixpoint (re-covered by a standing edge, or explicitly tombstoned), and the next full
+     * mint re-judges the live world. A LIVE-standing re-derivation here would instead false-red the
+     * honestly converged re-covered case, and the ruled evidence form is the per-plan applied edge.
+     */
+    readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     /** §6.2 — host read face: one scope's gate row (undefined when the store has no row — reading
-     *  never creates the file, so the OFF deployment stays byte-identical, G1). */
+     *  never creates the file, so the OFF deployment stays byte-identical, G1). A corrupt store
+     *  ALSO answers undefined here — this face cannot distinguish the two; a consumer that needs
+     *  the difference reads {@link readConsolidationGateState} (#437②). */
     readConsolidationGate(scope: string): ConsolidationGateRow | undefined;
+    /**
+     * design/376 slice ③ (#437②) — host read face: one scope's gate row as a DISCRIMINATED answer.
+     * The undiscriminated face above folds a corrupt store into `undefined`, so a healthy never-run
+     * scope and a store every verb will refuse fail-closed were indistinguishable to an operator or
+     * a scheduling read. `present` carries the row; `absent` = readable store, no row (reading never
+     * creates the file — the OFF deployment stays byte-identical, G1); `corrupt` carries the
+     * refusal detail. Additive; the undiscriminated face is unchanged.
+     */
+    readConsolidationGateState(scope: string): ConsolidationGateRead;
+    /**
+     * design/376 片② — host read face: one scope's committed FOLD STATE, in the freeze's own
+     * accounting (`active` counts entries neither superseded nor excluded — byte-for-byte the
+     * denominator `commitConsolidationPlan` re-derives for the supersession fuse). The driver plans
+     * UNDER the fuse instead of discovering it as a refusal, and every count it publishes is a store
+     * delta read through here — the fuse denominator and the published counts are store facts, never
+     * driver assumptions. Side-effect-free committed read; an unreadable governance overlay refuses
+     * coded (a silently wrong denominator would mis-schedule every remaining cycle).
+     */
+    readConsolidationFoldState(scope: string): Promise<{
+        active: number;
+        superseded: number;
+        products: number;
+    }>;
+    /**
+     * Host read face: the engine's RESOLVED control-plane directory (the same coordinate a
+     * directory-pinned backend already publishes as `controlPlaneRoot`; this accessor answers it
+     * after the engine's own precedence — backend pin > constructor argument > derived default).
+     * The shipped consolidation driver keeps its run account and mint archives in this plane
+     * (design/376 §1.6-4); path knowledge is not authority — nothing here bypasses a verb.
+     */
+    get controlPlaneRoot(): string;
+    /**
+     * design/376 slice ③ (#437③) — host read face: the store's scope enumeration, capability-probed
+     * on the backend (`listScopes`, the audit-face probe family). A backend WITHOUT the face
+     * answers `supported: false` — never an empty array: "cannot enumerate" and "hosts no scopes"
+     * must stay two different answers, or every audit sweep over a non-enumerating backend would
+     * silently claim a clean store. The File backend derives the answer from the store root's
+     * durable scope registry (store-level fact — never a session roster); the SQL twins gain the
+     * face through the store-contracts extension (separate ticket). A supporting backend's corrupt
+     * registry THROWS fail-closed — the same reason an unsupported one never reads as empty.
+     */
+    listMemoryScopes(): Promise<MemoryScopeEnumeration>;
     /** The committed, side-effect-free audit read: the adoption-restricted committed view when the
      *  backend offers one (zero-copy File — ledger+shadow, no disk adoption), else the non-adopting
      *  retrieval view (copy-out File), else the backend itself (Pg/TiDB shapes — naturally committed

package/dist/core/memory-engine/engine.js

@@ -9,7 +9,7 @@ import { formatMemoryAge } from "../memory-recall.js";
 import { committedDistilledOf, committedOriginOf, computeEntryRev, distilledEquals, hasDistilledFormExtra, hasOriginFormExtra, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenDistilled, stripModelWrittenOrigin } from "./frontmatter.js";
 import { MEMORY_PROVENANCE_RECALL_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow } from "./provenance-wording.js";
 import { isInstructionEntry } from "./header-hints.js";
-import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSOLIDATION_SEAT_FREEZE_GRACE_MS, consolidationTypeEligible, deriveProductSlug, deriveSupersededSet, isValidConsolidationPlanId, listConsolidationPlanIds, productAddPatch, quarantineCorruptPlan, readConsolidationGateFile, readConsolidationPlan, readIntentCredentials, recordActiveSetBaseline, recordConsolidationSession, recordIntentCredentials, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, writeConsolidationPlan, } from "./consolidation.js";
+import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSOLIDATION_SEAT_FREEZE_GRACE_MS, consolidationTypeEligible, deriveProductSlug, deriveSupersededSet, isValidConsolidationPlanId, listConsolidationPlanIds, productAddPatch, quarantineCorruptPlan, readConsolidationGateFile, readConsolidationPlan, readIntentCredentials, recordActiveSetBaseline, recordConsolidationSession, recordIntentCredentials, scanRefusalCeiling, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, writeConsolidationPlan, } from "./consolidation.js";
 import { classifySessionSettlements, clearHoldResolution, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, } from "./delegation-settlement.js";
 import { noReplaceRestore } from "./delegation-settlement.js";
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
@@ -197,6 +197,15 @@ export function memoryConsolidationConflictNotice(input) {
         detail: { planId: input.planId, scope: inlineUntrusted(input.scope, 80) },
     };
 }
+export function memoryConsolidationIncompleteNotice(input) {
+    return {
+        code: "memory.consolidation_incomplete",
+        message: input.cyclesDone === 0
+            ? `Memory consolidation run ${input.runId} for scope ${inlineUntrusted(input.scope, 80)} stopped ${input.stop} after 0 committed cycle(s) — this run made no writes and the library is unchanged by it (the stop reason names the block; a fresh run re-distills from a full snapshot).`
+            : `Memory consolidation run ${input.runId} for scope ${inlineUntrusted(input.scope, 80)} stopped ${input.stop} after ${input.cyclesDone} committed cycle(s) with ${input.residueProducts} proposed product(s) unfolded — the library is in a PARTIAL fold (committed cycles stand; the next run's full snapshot re-distills the remainder).`,
+        detail: { scope: inlineUntrusted(input.scope, 80), runId: input.runId, stop: input.stop, residueProducts: input.residueProducts, cyclesDone: input.cyclesDone },
+    };
+}
 export function memoryConsolidationRefusedNotice(input) {
     return {
         code: "memory.consolidation_refused",
@@ -2579,7 +2588,7 @@ export class MemoryEngine {
         const marked = candidates.some((c) => c.marked);
         const epoch = row?.epoch ?? 0;
         const cycleToken = createHash("sha256").update(JSON.stringify([scope, epoch, at, Object.entries(candidateRevs).sort()]), "utf8").digest("hex").slice(0, 32);
-        updateConsolidationGate(this.controlDir, (file) => {
+        const announceForce = updateConsolidationGate(this.controlDir, (file) => {
             const fresh = file.scopes[scope] ?? { sessions: { count: 0, ring: [] }, epoch: 0 };
             if (fresh.openPlanId !== undefined) {
                 throw new ConsolidationRefusedError("memory.consolidation_busy", `memory consolidation refused: plan ${fresh.openPlanId} claimed the ${JSON.stringify(scope)} seat during the snapshot read.`);
@@ -2588,10 +2597,15 @@ export class MemoryEngine {
                 throw new ConsolidationRefusedError("memory.consolidation_stale_snapshot", `memory consolidation refused: the ${JSON.stringify(scope)} watermark advanced during the snapshot read — retake the snapshot.`);
             }
             fresh.snapshot = { token: cycleToken, at, epoch, candidates: candidateRevs, eligible: eligibleRevs, marked };
+            let announce = false;
+            if (opts.force !== undefined && fresh.lastForcedRequestId !== opts.force.requestId) {
+                fresh.lastForcedRequestId = opts.force.requestId;
+                announce = true;
+            }
             file.scopes[scope] = fresh;
-            return { next: file, result: undefined };
+            return { next: file, result: announce };
         });
-        if (opts.force !== undefined) {
+        if (opts.force !== undefined && announceForce) {
             try {
                 enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation snapshot FORCED past the time/session gates for scope ${inlineUntrusted(scope, 80)} (requestId ${inlineUntrusted(opts.force.requestId, 80)})`] });
             }
@@ -2642,6 +2656,9 @@ export class MemoryEngine {
             else if (p.inputs.length > screened.maxInputsPerProduct)
                 reasons.push(`product #${i}: ${p.inputs.length} inputs > maxInputsPerProduct ${screened.maxInputsPerProduct}`);
         }
+        if (proposal.products.length === 0 && intents.length === 0) {
+            reasons.push("empty plan: zero products and zero directed intents — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)");
+        }
         if (reasons.length > 0)
             throw new ConsolidationRefusedError("memory.consolidation_refused", "memory consolidation plan refused (structural)", reasons);
         const planId = uuidv7();
@@ -2723,21 +2740,7 @@ export class MemoryEngine {
             }
         }
         const activeSetSize = headers.filter((h) => !superseded.has(h.id) && !exclusions.has(h.id)).length;
-        const edgeTargets = new Set();
-        for (const p of proposal.products)
-            for (const i2 of p.inputs)
-                if (i2.supersede === true)
-                    edgeTargets.add(i2.id);
         const ceiling = supersessionFuseCeiling(activeSetSize, screened);
-        if (edgeTargets.size > ceiling) {
-            wholeReasons.push(`supersession fuse: ${edgeTargets.size} distinct targets > ceiling ${ceiling} (active set ${activeSetSize}, ratio ${screened.supersedeRatioCap}, floor ${screened.supersedeAbsoluteFloor}, N-1 unconditional)`);
-            try {
-                enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation plan for scope ${inlineUntrusted(scope, 80)} REFUSED by the supersession fuse (${edgeTargets.size} targets over the ${ceiling} ceiling)`] });
-            }
-            catch (err) {
-                this.discloseAnnounceFailure("consolidation fuse enqueue", err);
-            }
-        }
         let visibleMarked = snapshot.marked;
         if (!visibleMarked) {
             const inputIds = [...new Set(proposal.products.flatMap((p) => p.inputs.map((i2) => i2.id)))];
@@ -2747,12 +2750,18 @@ export class MemoryEngine {
         const foldedOrigin = visibleMarked ? { taint: "external", cause: "derived", at } : undefined;
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
-            if (visibleMarked && isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) })) {
-                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26)`);
+            if (!isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) }))
+                continue;
+            if (visibleMarked) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26; no option opens this arm)`);
+            }
+            else if (!screened.allowInstructionProducts) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — instruction-form consolidation products are refused unconditionally by default (a consolidation must not mint privileged entries out of ordinary notes); the host escape hatch is consolidation.allowInstructionProducts: true`);
             }
         }
         const assembled = [];
         const refusedProducts = [];
+        const scanRefused = [];
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
             const drift = [];
@@ -2799,11 +2808,31 @@ export class MemoryEngine {
             const nameFinding = scanMemoryFileName(`${slug}.md`);
             const findings = [...(nameFinding !== undefined ? [nameFinding] : []), ...scanMemoryWrite(serializeEntryFile(entry), { maxBytes: this.perFileBytes })];
             if (findings.length > 0) {
-                wholeReasons.push(`product #${i}: scan gate (${findings.map((f) => `${f.code}: ${f.reason}`).join("; ")})`);
+                const reason = `scan gate (${findings.map((f) => `${f.code}: ${f.reason}`).join("; ")})`;
+                refusedProducts.push({ index: i, reason });
+                scanRefused.push({ index: i, reason });
                 continue;
             }
             assembled.push(entry);
         }
+        const edgeTargets = new Set();
+        for (const e of assembled)
+            for (const i2 of e.frontmatter.distilled?.inputs ?? [])
+                if (i2.superseded === true)
+                    edgeTargets.add(i2.id);
+        if (edgeTargets.size > ceiling) {
+            wholeReasons.push(`supersession fuse: ${edgeTargets.size} distinct targets > ceiling ${ceiling} (active set ${activeSetSize}, ratio ${screened.supersedeRatioCap}, floor ${screened.supersedeAbsoluteFloor}, N-1 unconditional)`);
+            try {
+                enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation plan for scope ${inlineUntrusted(scope, 80)} REFUSED by the supersession fuse (${edgeTargets.size} targets over the ${ceiling} ceiling)`] });
+            }
+            catch (err) {
+                this.discloseAnnounceFailure("consolidation fuse enqueue", err);
+            }
+        }
+        const scanCeiling = scanRefusalCeiling(proposal.products.length, screened);
+        if (scanRefused.length > scanCeiling) {
+            wholeReasons.push(`scan-refusal fuse: ${scanRefused.length} of ${proposal.products.length} product(s) failed the write scan > ceiling ${scanCeiling} (ratio ${screened.scanRefusalRatioCap}, per-plan max ${screened.scanRefusalMaxPerPlan}) — ${scanRefused.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}`);
+        }
         const directed = [];
         const intents = proposal.intents ?? [];
         const targetIds = intents.map((it) => it.entryId);
@@ -2861,6 +2890,9 @@ export class MemoryEngine {
                 directed.push({ intentRequestId: intent.requestId, op: "update", id: intent.entryId, baseRev: committed.rev, plannedPostRev: terminal.rev, entry: terminal, state: "pending" });
             }
         }
+        if (wholeReasons.length === 0 && assembled.length === 0 && directed.length === 0) {
+            wholeReasons.push(`empty plan after freeze: every product was refused (${refusedProducts.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}) — a plan with nothing left to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)`);
+        }
         if (wholeReasons.length > 0)
             throw new ConsolidationRefusedError("memory.consolidation_refused", "memory consolidation plan refused", wholeReasons);
         try {
@@ -2874,8 +2906,9 @@ export class MemoryEngine {
                 throw err;
             throw new ConsolidationRefusedError("memory.consolidation_gate_corrupt", `memory consolidation refused: the gate store could not be re-read at the freeze boundary (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
         }
+        const freezeRefusedInputIds = [...new Set(refusedProducts.flatMap((r) => (proposal.products[r.index]?.inputs ?? []).map((i2) => i2.id)))].sort();
         const plan = {
-            v: 1,
+            v: freezeRefusedInputIds.length > 0 ? 2 : 1,
             planId,
             scope,
             requestId: input.requestId,
@@ -2886,6 +2919,7 @@ export class MemoryEngine {
             ...(foldedOrigin !== undefined ? { foldedOrigin } : {}),
             products: assembled,
             productStates: Object.fromEntries(assembled.map((e) => [e.id, "pending"])),
+            ...(freezeRefusedInputIds.length > 0 ? { freezeRefusedInputIds } : {}),
             directed,
             intents: intents.map((it) => ({ requestId: it.requestId, state: "pending" })),
             state: "open",
@@ -3085,6 +3119,7 @@ export class MemoryEngine {
         }
         writeConsolidationPlan(this.controlDir, plan);
         const currentlyEligible = await this.settleFingerprintFilter(plan.scope);
+        const freezeRefused = new Set(plan.freezeRefusedInputIds ?? []);
         updateConsolidationGate(this.controlDir, (file) => {
             const row = file.scopes[plan.scope];
             if (row?.openPlanId !== plan.planId)
@@ -3097,6 +3132,8 @@ export class MemoryEngine {
                 if (currentlyEligible !== undefined) {
                     const fp = {};
                     for (const [id, rev] of Object.entries(row.snapshot.eligible)) {
+                        if (freezeRefused.has(id))
+                            continue;
                         if (!currentlyEligible(id, rev))
                             continue;
                         fp[id] = { rev };
@@ -3220,6 +3257,7 @@ export class MemoryEngine {
     }
     async settleGateForTerminalPlan(plan) {
         const currentlyEligible = await this.settleFingerprintFilter(plan.scope);
+        const freezeRefused = new Set(plan.freezeRefusedInputIds ?? []);
         updateConsolidationGate(this.controlDir, (file) => {
             const row = file.scopes[plan.scope];
             if (row?.openPlanId !== plan.planId)
@@ -3233,6 +3271,8 @@ export class MemoryEngine {
                     if (currentlyEligible !== undefined) {
                         const fp = {};
                         for (const [id, rev] of Object.entries(row.snapshot.eligible)) {
+                            if (freezeRefused.has(id))
+                                continue;
                             if (!currentlyEligible(id, rev))
                                 continue;
                             fp[id] = { rev };
@@ -3334,6 +3374,24 @@ export class MemoryEngine {
             throw new ConsolidationRefusedError("memory.consolidation_gate_corrupt", `memory consolidation retry refused: the intent-credential account cannot be trusted (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
         }
         const pendingIntents = plan.intents.filter((i) => i.state === "pending" && standingCredentials[i.requestId] === undefined).map((i) => i.requestId);
+        if (pendingIntents.length === 0) {
+            throw new ConsolidationRefusedError("memory.consolidation_refused", `memory consolidation retry refused: plan ${planId} has nothing to re-judge — ` +
+                (plan.intents.length === 0
+                    ? "it carries no intents (a conflicted product never rides a retry)"
+                    : "every unfulfilled intent already carries a credential (consumed by an earlier retry or a racing plan)") +
+                ` — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face); resolve with "discard" to release the seat.`);
+        }
+        const conflictProductInputIds = [];
+        for (const p of plan.products) {
+            if (plan.productStates[p.id] !== "conflict")
+                continue;
+            const inputs = p.frontmatter?.distilled?.inputs;
+            if (!Array.isArray(inputs) || inputs.some((i) => typeof i?.["id"] !== "string")) {
+                throw new ConsolidationRefusedError("memory.consolidation_refused", `memory consolidation retry refused: conflicted product ${p.id} carries no readable distilled attribution rows (every frozen product is minted with them — this is control-plane damage); the plan stays parked, resolve with "discard" (the bytes remain on the plan file for host review).`);
+            }
+            for (const i of inputs)
+                conflictProductInputIds.push(i.id);
+        }
         const face = this.committedAuditFace();
         const originalIntents = await this.reconstructIntentsForRetry(plan, pendingIntents, face);
         const retryPlanId = uuidv7();
@@ -3347,8 +3405,9 @@ export class MemoryEngine {
             file.scopes[plan.scope] = row;
             return { next: file, result: undefined };
         });
+        const inheritedRefusals = [...new Set([...(plan.freezeRefusedInputIds ?? []), ...conflictProductInputIds])].sort();
         const retryPlan = {
-            v: 1,
+            v: inheritedRefusals.length > 0 ? 2 : 1,
             planId: retryPlanId,
             scope: plan.scope,
             requestId: opts.requestId,
@@ -3357,6 +3416,7 @@ export class MemoryEngine {
             visibleMarked: false,
             products: [],
             productStates: {},
+            ...(inheritedRefusals.length > 0 ? { freezeRefusedInputIds: inheritedRefusals } : {}),
             directed: originalIntents.directed,
             intents: pendingIntents.map((r) => ({ requestId: r, state: "pending" })),
             state: "open",
@@ -3436,6 +3496,35 @@ export class MemoryEngine {
         }
         return out;
     }
+    readConsolidationPlanFoldEvidence(planId) {
+        const read = readConsolidationPlan(this.controlDir, planId);
+        if (read.state === "absent")
+            return { state: "absent" };
+        if (read.state === "corrupt")
+            return { state: "corrupt", detail: read.detail };
+        const p = read.plan;
+        const targets = new Set();
+        for (const prod of p.products) {
+            if (p.productStates[prod.id] !== "applied")
+                continue;
+            const inputs = prod.frontmatter?.distilled?.inputs;
+            const anchors = { scope: p.scope, requestId: p.requestId };
+            if (inputs === undefined)
+                return { state: "corrupt", detail: `applied product ${prod.id} carries no distilled.inputs (every frozen product is minted with its attribution rows)`, ...anchors };
+            if (!Array.isArray(inputs))
+                return { state: "corrupt", detail: `applied product ${prod.id} carries a non-array distilled.inputs`, ...anchors };
+            for (const i of inputs) {
+                if (typeof i !== "object" || i === null)
+                    return { state: "corrupt", detail: `applied product ${prod.id} carries a malformed distilled input row`, ...anchors };
+                if (i.superseded !== true)
+                    continue;
+                if (typeof i.id !== "string")
+                    return { state: "corrupt", detail: `applied product ${prod.id} carries a supersession edge without a string target id`, ...anchors };
+                targets.add(i.id);
+            }
+        }
+        return { state: "ok", scope: p.scope, requestId: p.requestId, planState: p.state, supersededTargets: [...targets].sort() };
+    }
     readConsolidationGate(scope) {
         try {
             return readConsolidationGateFile(this.controlDir).scopes[scope];
@@ -3444,6 +3533,43 @@ export class MemoryEngine {
             return undefined;
         }
     }
+    readConsolidationGateState(scope) {
+        let row;
+        try {
+            row = readConsolidationGateFile(this.controlDir).scopes[scope];
+        }
+        catch (err) {
+            return { state: "corrupt", detail: err instanceof Error ? err.message : String(err) };
+        }
+        return row !== undefined ? { state: "present", row } : { state: "absent" };
+    }
+    async readConsolidationFoldState(scope) {
+        const face = this.committedAuditFace();
+        const headers = await face.listHeaders([scope]);
+        let exclusions;
+        try {
+            exclusions = this.readChallengeExclusions();
+        }
+        catch (err) {
+            throw new ConsolidationRefusedError("memory.consolidation_governance_unreadable", `memory consolidation fold-state read refused: the challenge/lineage ledger cannot be trusted (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const superseded = deriveSupersededSet(headers, { excluded: (id) => exclusions.has(id) });
+        return {
+            active: headers.filter((h) => !superseded.has(h.id) && !exclusions.has(h.id)).length,
+            superseded: superseded.size,
+            products: headers.filter((h) => h.distilled !== undefined).length,
+        };
+    }
+    get controlPlaneRoot() {
+        return this.controlDir;
+    }
+    async listMemoryScopes() {
+        const b = this.backend;
+        if (typeof b.listScopes !== "function") {
+            return { supported: false, reason: "the backend does not implement scope enumeration (listScopes) — an absent capability must never read as an empty scope list" };
+        }
+        return await b.listScopes();
+    }
     committedAuditFace() {
         const b = this.backend;
         return b.restrictedAdoptionView?.({ audit: false }) ?? b.retrievalView?.() ?? this.backend;

package/dist/core/memory-engine/file-backend.d.ts

@@ -1,6 +1,6 @@
 import { scopeDirName, type ChallengeEvent, type MemoryPartitionIncidentSink } from "./layout.js";
 import type { MemoryBundleImportPlan, MemoryImportReport } from "./export-bundle.js";
-import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
+import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, MemoryScopeEnumeration, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
 /** Files/dirs the entry scan never treats as entries: the derived index, dotfiles (`.hydrate`,
  *  transaction staging files), and anything not `.md`. */
 export declare const MEMORY_INDEX_FILENAME = "MEMORY.md";
@@ -357,7 +357,7 @@ export interface FileMemoryEngineBackendOptions {
     onIncident?: MemoryPartitionIncidentSink;
 }
 /**
- * ⚠️ DEPLOYMENT BOUNDARY (N0 定谳,channel 给service-AI.md [412],2026-07-09):this backend — and the
+ * ⚠️ DEPLOYMENT BOUNDARY (ruled 2026-07-09): this backend — and the
  * file memory engine's materialize/harvest — operates on the WORKER-HOST fs plane (node:fs), matching
  * CC's `~/.claude` host-plane memory (the only behavior anchor). It is NOT ExecutionEnv-aware: when a
  * deployment routes the model's file tools to a REMOTE sandbox (e2b/k8s/ssh/adb/local-docker), the two
@@ -756,6 +756,18 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      * while a live holder exists ({@link txnInFlight}), which now covers adoption holds too.
      */
     private readScopeAdopting;
+    /**
+     * design/376 slice ③ (#437③) — the File leg's scope-enumeration capability face: every scope
+     * this store has hosted, derived from the store root's durable scope registry (the control
+     * plane's `scopes.json` — the one source that can invert a scope's sanitized directory label
+     * back to its name; a listing of raw subdirectories could not). Side-effect-free committed
+     * read; a corrupt/unreadable registry THROWS its fail-closed refusal — enumeration over an
+     * untrustworthy registry must never answer an empty (= clean-looking) list. Honest residual,
+     * disclosed: the registry records scopes as they are first touched THROUGH this control plane,
+     * so a hand-assembled tree's never-touched scope dirs appear here only once a caller first
+     * names them — store-level fact, session-roster-free either way.
+     */
+    listScopes(): MemoryScopeEnumeration;
     listHeaders(scopes: readonly string[]): Promise<MemoryEntryHeader[]>;
     private listHeadersFrom;
     getByIds(ids: readonly string[]): Promise<MemoryEntry[]>;

package/dist/core/memory-engine/file-backend.js

@@ -1780,6 +1780,9 @@ export class FileMemoryEngineBackend {
             lock.release();
         }
     }
+    listScopes() {
+        return { supported: true, scopes: Object.keys(registeredScopes(this.controlPlaneRoot)).sort() };
+    }
     async listHeaders(scopes) {
         return this.listHeadersFrom(scopes, (s) => this.readScopeAdopting(s));
     }

package/dist/core/memory-engine/index.d.ts

@@ -1,4 +1,4 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, } from "./engine.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, type MemoryGetDetails, } from "./tools.js";
 export { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_RECALL_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow, } from "./provenance-wording.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
@@ -8,9 +8,12 @@ export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlane
 export { readV2HeaderHints, isInstructionEntry, type V2HeaderHints } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation, type ParsedEntryFile } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
-export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, } from "./consolidation.js";
+export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
+export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
+export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type RunMemoryConsolidationOptions, } from "./consolidation-driver.js";
+export type { OriginClearanceRow, OriginClearanceEvent } from "./origin-clearance.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
-export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
+export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryScopeEnumeration, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, } from "./memory-backend-contract.js";
 export { SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, } from "./scope-contract.js";
 export { migrateScope, type MigrateScopeReport } from "./migrate.js";

package/dist/core/memory-engine/index.js

@@ -1,4 +1,4 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationRefusedNotice, } from "./engine.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, } from "./tools.js";
 export { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_RECALL_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow, } from "./provenance-wording.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
@@ -8,7 +8,9 @@ export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlane
 export { readV2HeaderHints, isInstructionEntry } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
-export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, } from "./consolidation.js";
+export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, CONSOLIDATION_RUN_STOP_REASONS, } from "./consolidation.js";
+export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, } from "./distiller.js";
+export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, } from "./consolidation-driver.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, } from "./memory-backend-contract.js";
 export { SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, } from "./scope-contract.js";