@sema-agent/core 5.58.0 → 5.59.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 5.59.0 — 2026-08-24
+
+### BREAKING (narrow, named)
+- **`ConsolidationDriverEngine` requires `readConsolidationPlanFoldEvidence`** (the member-level
+  conservation wall's read face). `MemoryEngine` satisfies it as before; a custom driver-engine stub
+  must add the member (compile error otherwise). Default-off feature shipped one version ago —
+  blast radius is stub authors only.
+
+### Changed — consolidation safety narrowings (design/376 slice ③; default-off face, all fail-closed)
+- **Member-level conservation wall**: a run whose planned members were deleted/excluded/folded by
+  another writer mid-run now settles `driver_failed` naming the missing ids, where a numeric offset
+  previously produced a false `converged`. Attribution uses the exact plan-frozen cycle-id grammar
+  (prefix-shadow ids cannot re-satisfy a member). Count witnesses remain the fast pass.
+- **C-2 scan-refusal reach**: scan findings refuse per PRODUCT (disclosed; whole-plan refusal past
+  `min(floor(0.25×submitted), 8)` — knobs `scanRefusalRatioCap`/`scanRefusalMaxPerPlan`, bad values
+  refuse loudly); an empty or frozen-empty plan refuses instead of settling a vacuous completed;
+  refused input ids are excluded from the completion fingerprint and ride the plan file under a
+  bidirectional v2⇔member version gate (a pre-field worker parks loudly on a v2 plan instead of
+  settling wrong). WIDENING, named: refused products' edges no longer trip the supersession fuse.
+- **C-3 instruction-form hard gate is unconditional**: a clean visible set refuses instruction-form
+  products by default (previously committed), naming the host escape hatch
+  `consolidation.allowInstructionProducts: true` (screened exactly-true; opens the clean arm only —
+  a marked set refuses with no opening knob).
+- Registry reads are journal-aware (a committed journal wins; an unreadable journal throws
+  fail-closed instead of serving a clean-looking stale registry).
+
+### Added
+- **`NOTICE_AUDIENCE` registry (closed)**: `ENGINE_NOTICE_CODES` is the 27-code catalog,
+  `NOTICE_AUDIENCE` answers for every member (8 user / 19 operator) in compile-time lockstep both
+  directions; `task.user_steer_undrained`/`task.user_followup_undrained` now carry `sessionId`
+  filled from the real run; catalog/code/audience types root-exported for downstream table diffing.
+- **`AskRequest.hasBidiControls`** presence bit (additive): minted at the ask throat over
+  execution-snapshot args + tool preview for the directional-control class (U+061C/200E/200F/
+  202A-202E/2066-2069); presence-only (never `false`; absence covers budget exhaustion), zero
+  rewriting; the scan charges every character — values, object keys, Map keys, inherited names —
+  through ONE bounded reader (node budget + 1M code-unit allowance). Plus
+  **`renderUntrustedCommandText`** root export: the lossy DISPLAY baseline for raw command bytes
+  (strips Cf, folds controls to spaces, code-point cap with ellipsis; identity stays on raw).
+- **Read faces**: `readConsolidationGateState` (present|absent|corrupt-with-detail; legacy face
+  byte-unchanged), `readConsolidationPlanFoldEvidence` (ok/absent/corrupt; applied-only edges),
+  `MemoryEngine.listMemoryScopes()`/File-backend `listScopes()` with the `supported` discriminator
+  (a backend that cannot enumerate answers `supported:false` with a reason, never `[]`).
+- **Export tiers v1**: the export-surface snapshot carries a machine-readable `tiers` column
+  (stable/advanced/internal; self-declared heuristic) with a three-leg gate (every live export
+  tiered, no stale rows, live derivation ≡ frozen column).
+- `OriginClearanceRow`/`OriginClearanceEvent` root type exports (server design/316 car-B compile
+  prerequisite). Export surface 1749 → 1758, all additive.
+
 ## 5.58.0 — 2026-08-24
 
 ### BREAKING (design/375 case A — per-segment batch consent; ships as one window, no compatibility arms)

package/dist/brain/route-adjudicator.d.ts

@@ -174,7 +174,13 @@ export declare function adjudicateDerivedRoute(args: {
  */
 export declare function sameRouteIdentity(a: Pick<Model, "id" | "baseUrl">, b: Pick<Model, "id" | "baseUrl">): boolean;
 /** The `route.fallback_to_primary` announcement — one shared shape for every derived-leg seat, so
- *  a consumer can rely on `detail.{seat, from, to, cause}` regardless of which seat fell back. */
+ *  a consumer can rely on `detail.{seat, from, to, cause}` regardless of which seat fell back.
+ *
+ *  `sessionId` (#433, additive): the swap happened while resolving ONE run's seats, so the run is
+ *  what an operator correlates the line against ("which task ran on the fallback model"). The
+ *  AUDIENCE stays `"operator"` — the fix is a credential/catalog fix, and no end user can act on it;
+ *  attribution is a routing key, not an entitlement. Omitted when a caller has no session in hand,
+ *  never fabricated. */
 export declare function fallbackToPrimaryNotice(args: {
     seat: string;
     from: string;
@@ -182,6 +188,7 @@ export declare function fallbackToPrimaryNotice(args: {
     verdict: Extract<RouteAdjudication, {
         ok: false;
     }>;
+    sessionId?: string;
 }): EngineNotice;
 /** The auth carriers of a header bag, canonicalized (case-fold name → value, sorted) — the
  *  Model-visible credential fingerprint used by catalog-change disclosure (a same-name entry whose

package/dist/brain/route-adjudicator.js

@@ -173,7 +173,14 @@ export function fallbackToPrimaryNotice(args) {
         code: "route.fallback_to_primary",
         message: `derived model "${args.from}" (${args.seat}) is not routable (${args.verdict.code}) — ` +
             `falling back to the primary model "${args.to}". ${args.verdict.detail.fixHint}`,
-        detail: { seat: args.seat, from: args.from, to: args.to, cause: args.verdict.code, fixHint: args.verdict.detail.fixHint },
+        detail: {
+            seat: args.seat,
+            from: args.from,
+            to: args.to,
+            cause: args.verdict.code,
+            fixHint: args.verdict.detail.fixHint,
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+        },
     };
 }
 export function authCarrierFingerprint(headers) {

package/dist/core/governance-codes.d.ts

@@ -68,15 +68,42 @@ export type RuleSyncDropReason = keyof typeof RULE_SYNC_DROP_CODES;
  *  fence arm / local screening). `own_actor_forged` is inbound-only by construction. */
 export type RuleQuarantineReason = Exclude<RuleSyncDropReason, "own_actor_forged">;
 /**
- * The presentation-tier registry (the server's wire whitelist retires into this
- * table once shipped): WHO a notice code is for. `"user"` = a session-scoped disclosure the end
- * user of that session should see (safe to project onto the session's event stream); `"operator"`
- * = a deployment/config/ops fact for whoever runs the process. Presentation tier is a property of
- * the CODE (closed set, one code one tier) — never of an individual emission, which is why this is
- * a registry and not an EngineNotice field. Codes absent from the table read as `"operator"`
- * (the conservative default: never push an unclassified code at an end user).
- * Orthogonal to {@link NON_GOVERNANCE_MEMORY_CODES} (a retry-semantics table, not presentation).
+ * WHO a notice code is for. `"user"` = a session-scoped disclosure the end user of that session is
+ * entitled to see (safe to project onto that session's event stream); `"operator"` = a
+ * deployment/config/ops fact for whoever runs the process.
+ *
+ * Two values, deliberately. "Can this notice be routed to a session" is NOT an audience value — it
+ * is the presence of `EngineNotice.sessionId`, a per-EMISSION fact. A third value would fold a
+ * routing property into an entitlement vocabulary, and the two answer different questions: several
+ * codes below carry a session attribution while the person entitled to the fact is still the
+ * operator (a failed offload write, a routing fallback, a consolidation recommendation).
+ */
+export type NoticeAudience = "user" | "operator";
+/**
+ * The CLOSED catalog of EngineNotice codes this engine mints — the enumeration half of the
+ * presentation registry below, and the thing a consumer's own audience table can be diffed against
+ * (that is the point of exporting it: a downstream table with a row missing, or a row for a code
+ * this engine no longer mints, is a mechanically detectable disagreement rather than an argument).
+ *
+ * Kept in LOCKSTEP with {@link NOTICE_AUDIENCE} by the compiler (`satisfies Record<EngineNoticeCode,
+ * …>` below: a catalog entry with no audience row, or an audience row for a non-member, is a tsc
+ * error — a mirrored enumeration that is only checked at runtime is a mirror that drifts). The
+ * other half — "is the catalog itself still complete?" — cannot be a type: `EngineNotice.code` is
+ * declared `string` (a host may forward its own), so the gate test (governance-codes.test.ts) scans
+ * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
+ * no longer minted.
+ */
+export declare const ENGINE_NOTICE_CODES: readonly ["config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.injection_priority_unimplemented", "tool_result.offload_put_failed"];
+/** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
+ *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
+ *  sink is a supported shape, and narrowing that field would break it. */
+export type EngineNoticeCode = (typeof ENGINE_NOTICE_CODES)[number];
+/**
+ * The presentation-tier registry — see {@link NOTICE_AUDIENCE_TABLE} for the per-row judgment.
+ * The exported TYPE stays the open `Record<string, …>` on purpose: a consumer indexing it with a
+ * runtime string (a code off a wire, a host's own) must keep compiling. The lockstep with
+ * {@link ENGINE_NOTICE_CODES} is enforced on the table above, where narrowing costs nobody anything.
  */
-export declare const NOTICE_AUDIENCE: Readonly<Record<string, "user" | "operator">>;
+export declare const NOTICE_AUDIENCE: Readonly<Record<string, NoticeAudience>>;
 /** The audience for `code` — table lookup with the conservative `"operator"` default. */
-export declare function noticeAudienceOf(code: string): "user" | "operator";
+export declare function noticeAudienceOf(code: string): NoticeAudience;

package/dist/core/governance-codes.js

@@ -84,14 +84,65 @@ export const RULE_SYNC_DROP_CODES = {
     below_gc_frontier: "local-quarantined",
     server_rejected: "local-quarantined",
 };
-export const NOTICE_AUDIENCE = {
+export const ENGINE_NOTICE_CODES = [
+    "config.env_timeout_discarded",
+    "config.materialize_env_discarded",
+    "config.models_swapped",
+    "config.read_face_deployment_clamped",
+    "config.tool_model_gate_removed",
+    "config.tool_model_gate_unknown_class",
+    "config.tool_model_gate_env_invalid",
+    "delegation.transcript_integrity",
+    "mcp.revocation_probe_failed",
+    "workflow.governance_key_stripped",
+    "memory.session_polluted",
+    "memory.harvest_quarantined",
+    "memory.delegation_static_mark_waived",
+    "memory.hold_opened",
+    "memory.hold_released",
+    "memory.hold_disposed",
+    "memory.consolidation_recommended",
+    "memory.consolidation_committed",
+    "memory.consolidation_conflict",
+    "memory.consolidation_incomplete",
+    "memory.consolidation_refused",
+    "route.fallback_to_primary",
+    "route.base_url_changed_key_unchanged",
+    "task.user_steer_undrained",
+    "task.user_followup_undrained",
+    "task.injection_priority_unimplemented",
+    "tool_result.offload_put_failed",
+];
+const NOTICE_AUDIENCE_TABLE = {
     "memory.session_polluted": "user",
     "memory.harvest_quarantined": "user",
     "memory.delegation_static_mark_waived": "user",
     "memory.hold_opened": "user",
     "memory.hold_released": "user",
     "memory.hold_disposed": "user",
+    "task.user_steer_undrained": "user",
+    "task.user_followup_undrained": "user",
+    "config.env_timeout_discarded": "operator",
+    "config.materialize_env_discarded": "operator",
+    "config.models_swapped": "operator",
+    "config.read_face_deployment_clamped": "operator",
+    "config.tool_model_gate_removed": "operator",
+    "config.tool_model_gate_unknown_class": "operator",
+    "config.tool_model_gate_env_invalid": "operator",
+    "delegation.transcript_integrity": "operator",
+    "mcp.revocation_probe_failed": "operator",
+    "workflow.governance_key_stripped": "operator",
+    "memory.consolidation_recommended": "operator",
+    "memory.consolidation_committed": "operator",
+    "memory.consolidation_conflict": "operator",
+    "memory.consolidation_incomplete": "operator",
+    "memory.consolidation_refused": "operator",
+    "route.fallback_to_primary": "operator",
+    "route.base_url_changed_key_unchanged": "operator",
+    "task.injection_priority_unimplemented": "operator",
+    "tool_result.offload_put_failed": "operator",
 };
+export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;
 export function noticeAudienceOf(code) {
     return NOTICE_AUDIENCE[code] ?? "operator";
 }

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -22,7 +22,7 @@
  */
 import type { EngineNotice } from "../types.js";
 import { type ConsolidationGateRow, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
-import { type ConsolidationPlanSummary } from "./engine.js";
+import { type ConsolidationPlanFoldEvidence, type ConsolidationPlanSummary } from "./engine.js";
 import { mintLlmConsolidationPlan, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationFoldState, type DistillerChatFn, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract } from "./distiller.js";
 export declare const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 /** §1.6-4 — the mint archive: what was shown to the model and what it answered, verbatim, per run
@@ -114,10 +114,14 @@ export declare function readConsolidationDriverRun(controlDir: string, scope: st
  *  run row's `planArchive` (written under the attempt guard) names the one that counts. */
 export declare function distillerPlanArchiveName(runId: string, attempt: number): string;
 export declare function archiveDistillerPlan(controlDir: string, runId: string, plan: LlmConsolidationPlan, attempt?: number): string;
-/** The engine face this verb consumes — `MemoryEngine` satisfies it structurally. */
+/** The engine face this verb consumes — `MemoryEngine` satisfies it structurally.
+ *  (`readConsolidationPlanFoldEvidence` joined in design/376 slice ③, #436: the conservation
+ *  wall's terminal witness is member-level, so the face is REQUIRED — an engine without it could
+ *  only offer the store-delta counts an interleaved fold can numerically offset.) */
 export interface ConsolidationDriverEngine extends ConsolidationDriveEngine {
     readConsolidationGate(scope: string): ConsolidationGateRow | undefined;
     listConsolidationPlans(): ConsolidationPlanSummary[];
+    readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     readConsolidationFoldState(scope: string): Promise<ConsolidationFoldState>;
     readonly controlPlaneRoot: string;
 }

package/dist/core/memory-engine/consolidation-driver.js

@@ -182,6 +182,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
         return settle("parked", undefined, parkedSeat);
     }
     let staleResidue = [];
+    let staleResidueMemberIds = new Set();
     const distill = async (candidates, snapshot, s) => {
         if (run.planCache === undefined) {
             let minted;
@@ -233,11 +234,12 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             writeDriverRun(controlDir, run);
             archiveDistillerPlan(controlDir, run.runId, plan, run.attempt);
         }
+        const offered = new Map();
+        for (const c of candidates)
+            if (typeof c?.entry?.id === "string")
+                offered.set(c.entry.id, c.entry.rev);
+        staleResidueMemberIds = new Set();
         staleResidue = (run.planCache?.products ?? []).flatMap((p) => {
-            const offered = new Map();
-            for (const c of candidates)
-                if (typeof c?.entry?.id === "string")
-                    offered.set(c.entry.id, c.entry.rev);
             const ids = p.inputIds ?? [];
             const live = ids.filter((id) => offered.has(id));
             if (live.length === 0)
@@ -245,7 +247,11 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             const stale = p.inputRevs !== undefined && live.some((id) => p.inputRevs[id] !== undefined && offered.get(id) !== p.inputRevs[id]);
             const vanished = live.length < ids.length;
             const unanchored = p.inputRevs === undefined;
-            return stale || vanished || unanchored ? [{ name: p.name, targets: live.length }] : [];
+            if (!(stale || vanished || unanchored))
+                return [];
+            for (const id of live)
+                staleResidueMemberIds.add(id);
+            return [{ name: p.name, targets: live.length }];
         });
         const replayView = run.planCache !== undefined && run.planCache.products.some((p) => p.inputRevs === undefined)
             ? { ...run.planCache, products: run.planCache.products.filter((p) => p.inputRevs !== undefined) }
@@ -329,6 +335,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     const writeResidue = run.writeFailures.map((w) => ({ name: w.key, targets: w.members }));
     const driverResidue = [...staleResidue, ...writeResidue];
     if (drive.converged) {
+        const plannedIds = [...new Set((run.planCache?.products ?? []).flatMap((p) => p.inputIds ?? []))];
         const plannedMembers = (run.planCache?.products ?? []).reduce((a, p) => a + (p.inputIds?.length ?? 0), 0);
         const rowAccount = run.entriesSuperseded ?? 0;
         const storeAccount = run.foldBaseline !== undefined ? Math.max(0, drive.foldState.after.superseded - run.foldBaseline.superseded) : rowAccount;
@@ -339,6 +346,24 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             run.residue = driverResidue;
             return settle("driver_failed", drive, `the drive reached a fixpoint but the account does not balance: ${plannedMembers} planned member(s), ${supersededAttested} superseded attested for this run (row account ${rowAccount}, store delta ${run.foldBaseline !== undefined ? storeAccount : "unavailable — the row predates the store anchor"}), ${residueTargets} in named residue — ${plannedMembers - accounted} member(s) left the candidate set without a fold the store attests (deleted or excluded mid-run${run.foldBaseline !== undefined ? "" : ", or folded in a window whose account write did not survive"}); their entries stand (or revive with their exclusion), and a fresh run re-mints over the current library`);
         }
+        if (plannedIds.length > 0) {
+            const evidence = collectRunFoldEvidence(engine, scope, run.requestId);
+            if (evidence.skipped.length > 0) {
+                const named = evidence.skipped.slice(0, 5).map((s) => `${s.planId} (${s.state})`).join(", ");
+                announce([
+                    `memory consolidation conservation wall for scope ${inlineUntrusted(scope, 80)}: ${evidence.skipped.length} same-scope plan file(s) answered unreadable and were SKIPPED as foreign to run ${run.runId} — they attest nothing for this run and need out-of-band repair: ${named}${evidence.skipped.length > 5 ? ", …" : ""}`,
+                ]);
+            }
+            if (evidence.unreadable !== undefined) {
+                run.residue = driverResidue;
+                return settle("driver_failed", drive, `the drive reached a fixpoint but the member-level fold evidence is incomplete: plan ${evidence.unreadable} — one of THIS run's own cycles — answered ${evidence.unreadableState} (control-plane damage on run-owned evidence, not a transient race); a converged label needs attestable members; the library stands as committed and a fresh run re-mints over the current bytes`);
+            }
+            const missing = plannedIds.filter((id) => !evidence.targets.has(id) && !staleResidueMemberIds.has(id));
+            if (missing.length > 0) {
+                run.residue = driverResidue;
+                return settle("driver_failed", drive, `the drive reached a fixpoint but ${missing.length} of ${plannedIds.length} planned member(s) left the candidate set without a fold this run's plans attest (deleted, excluded, or superseded by another writer mid-run; e.g. ${missing.slice(0, 5).join(", ")}) — a store-delta count can be numerically offset by an unrelated interleaved fold, so member identity is the final judge; the entries stand (or revive with their exclusion) and a fresh run re-mints over the current library`);
+            }
+        }
         if (driverResidue.length > 0) {
             run.residue = driverResidue;
             return settle("driver_failed", drive, `the drive reached the surviving plan's fixpoint, but the driver's own half left ${driverResidue.length} group(s) unfolded (${staleResidue.length} stale against edited inputs, ${writeResidue.length} writing-pass failure(s)) — their members stay as they were; a fresh run re-mints over the current bytes`);
@@ -356,6 +381,30 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
         return settle("parked", drive, stop.reason);
     return settle("refused", drive, stop?.reason ?? "the drive stopped without a stated reason");
 }
+function collectRunFoldEvidence(engine, scope, requestId) {
+    const cycleId = new RegExp(`^${requestId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}-c\\d+$`);
+    const targets = new Set();
+    const skipped = [];
+    for (const summary of engine.listConsolidationPlans()) {
+        if (summary.corrupt === true)
+            continue;
+        if (summary.scope !== scope)
+            continue;
+        const ev = engine.readConsolidationPlanFoldEvidence(summary.planId);
+        if (ev.state !== "ok") {
+            if (ev.state === "corrupt" && ev.requestId !== undefined && cycleId.test(ev.requestId)) {
+                return { targets, unreadable: summary.planId, unreadableState: ev.state, skipped };
+            }
+            skipped.push({ planId: summary.planId, state: ev.state });
+            continue;
+        }
+        if (ev.scope !== scope || !cycleId.test(ev.requestId))
+            continue;
+        for (const t of ev.supersededTargets)
+            targets.add(t);
+    }
+    return { targets, skipped };
+}
 async function recoverSeat(engine, scope, { sleep, windowMs }) {
     await engine.reconcileConsolidation(scope);
     let seat = engine.readConsolidationGate(scope)?.openPlanId;

package/dist/core/memory-engine/consolidation.d.ts

@@ -91,6 +91,25 @@ export interface MemoryConsolidationOptions {
     maxDirectedPatchesPerPlan?: number;
     minRunIntervalMs?: number;
     minSessionsBetweenRuns?: number;
+    /** design/376 C-2② — the scan-refusal fuse's ratio leg, in (0, 1]: scan findings refuse the
+     *  affected PRODUCT (disclosed beside eligibility drift), and the whole plan refuses only when
+     *  more than max(1, ⌊ratio × submitted products⌋) of them fail the scan (the floor keeps the
+     *  per-product tolerance alive on 1-4 product plans — the drive lane's common size) — see
+     *  {@link scanRefusalCeiling}. Default 0.25. */
+    scanRefusalRatioCap?: number;
+    /** design/376 C-2② — the fuse's absolute leg (positive integer): the large-batch upper bound on
+     *  tolerated scan refusals per plan, so the ratio cannot scale the tolerance without limit.
+     *  Default 8 (the point where the 0.25 ratio hands over at 32 submitted products — the family's
+     *  "小 N" quantification; below that the ratio leg alone governs). */
+    scanRefusalMaxPerPlan?: number;
+    /** design/376 C-3 — the EXPLICIT escape hatch for the unconditional instruction-form gate:
+     *  instruction-form consolidation products (`type: "feedback"` / v2 hint carriers) are refused
+     *  by default REGARDLESS of the visible set's markers — a clean-set instruction product is the
+     *  model-reachable privilege route (N ordinary notes in, one instruction entry out). `true` is
+     *  the only accepted value (a posture declaration, like {@link multiNode}); it opens the
+     *  CLEAN-set arm only — a marked visible set refuses instruction forms under the laundering
+     *  hard gate no matter what (privilege and hard gate enter and exit through one door). */
+    allowInstructionProducts?: true;
     /** D-13a — the multi-node POSTURE declaration: present ⇒ `lease` must be injected (constructor
      *  refusal otherwise). Multi-node without declaring is OUT OF CONTRACT (structurally
      *  undetectable — the declaration turns a silent omission into an explicit choice). */
@@ -113,6 +132,8 @@ export declare const CONSOLIDATION_DEFAULTS: {
     readonly maxDirectedPatchesPerPlan: 32;
     readonly minRunIntervalMs: number;
     readonly minSessionsBetweenRuns: 5;
+    readonly scanRefusalRatioCap: 0.25;
+    readonly scanRefusalMaxPerPlan: 8;
 };
 /**
  * §2.2 — the HARD throttle floor: even a `force` run cannot start a second same-scope run within
@@ -142,6 +163,9 @@ export interface ScreenedConsolidationOptions {
     maxDirectedPatchesPerPlan: number;
     minRunIntervalMs: number;
     minSessionsBetweenRuns: number;
+    scanRefusalRatioCap: number;
+    scanRefusalMaxPerPlan: number;
+    allowInstructionProducts: boolean;
     multiNode: boolean;
     lease?: ConsolidationLeaseSeat;
 }
@@ -159,6 +183,21 @@ export declare function screenConsolidationOptions(raw: MemoryConsolidationOptio
 /** §1.2-2 — the supersession fuse ceiling: min(N-1, max(floor, ⌊ratio×N⌋)); N ≤ 1 ⇒ 0 (one plan
  *  may NEVER empty the active set — the N-1 ceiling is unconditional, G21). */
 export declare function supersessionFuseCeiling(activeSetSize: number, opts: Pick<ScreenedConsolidationOptions, "supersedeRatioCap" | "supersedeAbsoluteFloor">): number;
+/**
+ * design/376 C-2② — the scan-refusal fuse ceiling: how many scan-refused products ONE plan may
+ * carry before the whole plan refuses instead of committing around them.
+ * `min(max(1, ⌊ratio × submitted⌋), absolute max)`; the ratio leg governs small plans, the
+ * absolute leg is the large-batch upper bound, and the FLOOR of one keeps C-2①'s per-product
+ * tolerance alive at the drive lane's common plan sizes — under the default 0.25 ratio a bare
+ * floor answers 0 for every ≤3-product plan, so one stray refused product re-killed the whole
+ * plan there, exactly the shape C-2① was adopted to remove (an adopted review finding). The
+ * floor is NOT a hole for the fully-refused tiny plan: a plan whose every product is refused
+ * (and which carries no directed work) still dies at the freeze-emptied C-2③ backstop, never a
+ * quiet mostly-no-op — what the floor tolerates is exactly one refused product beside at least
+ * one survivor. Submitted count = the proposal's product count (per THIS plan, never a
+ * cross-run tally).
+ */
+export declare function scanRefusalCeiling(submittedProducts: number, opts: Pick<ScreenedConsolidationOptions, "scanRefusalRatioCap" | "scanRefusalMaxPerPlan">): number;
 /** §3.1 — the type axis of the eligibility predicate: episodic entries are read-only evidence
  *  (never candidates, never supersession/directed targets, A-7); procedural promotion is a v3
  *  follow-on ticket. Unknown/absent types are ordinary semantic notes — eligible. */
@@ -231,6 +270,24 @@ export declare function updateConsolidationGate<T>(controlDir: string, fn: (file
 export declare function readConsolidationGateFile(controlDir: string): ConsolidationGateFile;
 /** True ⇔ the gate store file exists at all (G1's zero-file pin reads this negatively). */
 export declare function consolidationGateFileExists(controlDir: string): boolean;
+/**
+ * design/376 slice ③ (#437②) — the gate read face's DISCRIMINATED answer
+ * ({@link import("./engine.js").MemoryEngine.readConsolidationGateState}): `present` carries the
+ * row; `absent` means the store is readable and simply has no row for the scope (a never-run
+ * scope, or no gate file at all); `corrupt` means the store cannot be trusted and carries the
+ * refusal detail. The undiscriminated `readConsolidationGate` face folds corrupt into `undefined`
+ * — an operator (or a driver's scheduling read) could not tell a healthy never-run scope from a
+ * store every verb will refuse fail-closed.
+ */
+export type ConsolidationGateRead = {
+    state: "present";
+    row: ConsolidationGateRow;
+} | {
+    state: "absent";
+} | {
+    state: "corrupt";
+    detail: string;
+};
 /**
  * §2.2 — the engine-minted session count (harvest-tail bookkeeping; ≤1 row write per terminal
  * harvest; the OFF mode never calls this — D-9a zero-write). Returns the recommendation edge:
@@ -304,7 +361,15 @@ export interface ConsolidationDirectedPatch {
 }
 export type ConsolidationPlanState = "open" | "applying" | "completed" | "conflict" | "discarded";
 export interface ConsolidationPlanFile {
-    v: 1;
+    /** Plan schema version. `2` ⇔ the plan carries {@link freezeRefusedInputIds} — that member is a
+     *  LOAD-BEARING settle input (C-2④ keeps the named ids out of the completion fingerprint), and
+     *  a reader that predates it would accept the file as v1, ignore the member, and settle a
+     *  fingerprint that stamps the refused members (silently blinding the incremental face — the
+     *  exact hole the field closes). Version-gating the member makes such a reader answer its
+     *  "unrecognized version" corrupt arm instead: the plan parks loudly for the valve, never
+     *  settles wrong (mixed-fleet crash window between the durable plan write and gate settlement).
+     *  Plans without the member stay v1 — zero noise on the common path. */
+    v: 1 | 2;
     planId: string;
     scope: string;
     requestId: string;
@@ -318,6 +383,13 @@ export interface ConsolidationPlanFile {
     /** Frozen products — FULL entry bytes (id/frontmatter incl. distilled + origin/body/rev). */
     products: MemoryEntry[];
     productStates: Record<string, "pending" | "applied" | "conflict">;
+    /** design/376 C-2④ — the declared input ids of every product the FREEZE refused (scan findings
+     *  and eligibility drift alike). Settlement keeps these ids OUT of the completion fingerprint:
+     *  a scan-refused input's rev never moved, so stamping it would make every later incremental
+     *  snapshot read it as unchanged and never offer it again — the refused member must stay a
+     *  candidate. Absent on plans frozen before the field existed, and on plans with nothing
+     *  refused (either way the settle filter simply has nothing extra to exclude). */
+    freezeRefusedInputIds?: string[];
     directed: ConsolidationDirectedPatch[];
     intents: Array<{
         requestId: string;

package/dist/core/memory-engine/consolidation.js

@@ -40,6 +40,8 @@ export const CONSOLIDATION_DEFAULTS = {
     maxDirectedPatchesPerPlan: 32,
     minRunIntervalMs: 24 * 60 * 60 * 1000,
     minSessionsBetweenRuns: 5,
+    scanRefusalRatioCap: 0.25,
+    scanRefusalMaxPerPlan: 8,
 };
 export const CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS = 60_000;
 export const CONSOLIDATION_SESSION_RING_MAX = 64;
@@ -70,12 +72,18 @@ export function screenConsolidationOptions(raw, provenance) {
         maxDirectedPatchesPerPlan: num("maxDirectedPatchesPerPlan", raw.maxDirectedPatchesPerPlan, (n) => Number.isInteger(n) && n >= 1, "a positive integer"),
         minRunIntervalMs: num("minRunIntervalMs", raw.minRunIntervalMs, (n) => n > 0, "a positive number of milliseconds"),
         minSessionsBetweenRuns: num("minSessionsBetweenRuns", raw.minSessionsBetweenRuns, (n) => Number.isInteger(n) && n >= 0, "a non-negative integer"),
+        scanRefusalRatioCap: num("scanRefusalRatioCap", raw.scanRefusalRatioCap, (n) => n > 0 && n <= 1, "a number in (0, 1]"),
+        scanRefusalMaxPerPlan: num("scanRefusalMaxPerPlan", raw.scanRefusalMaxPerPlan, (n) => Number.isInteger(n) && n >= 1, "a positive integer"),
+        allowInstructionProducts: raw.allowInstructionProducts === true,
         multiNode: raw.multiNode === true,
         ...(raw.lease !== undefined ? { lease: raw.lease } : {}),
     };
     if (raw.multiNode !== undefined && raw.multiNode !== true) {
         throw coded(`MemoryEngineOptions.consolidation.multiNode must be exactly true when present (a posture declaration, not a boolean knob).`, "config.memory_consolidation");
     }
+    if (raw.allowInstructionProducts !== undefined && raw.allowInstructionProducts !== true) {
+        throw coded(`MemoryEngineOptions.consolidation.allowInstructionProducts must be exactly true when present (a posture declaration, not a boolean knob — absent means the instruction-form gate stays closed).`, "config.memory_consolidation");
+    }
     if (screened.multiNode && screened.lease === undefined) {
         throw coded(`MemoryEngineOptions.consolidation.multiNode declared without a lease seat — a multi-node deployment MUST inject the host's global lease (the local plan-seat CAS does not reach across nodes). Inject consolidation.lease or remove the multiNode declaration.`, "config.memory_consolidation_lease_required");
     }
@@ -89,6 +97,11 @@ export function supersessionFuseCeiling(activeSetSize, opts) {
         return 0;
     return Math.min(activeSetSize - 1, Math.max(opts.supersedeAbsoluteFloor, Math.floor(opts.supersedeRatioCap * activeSetSize)));
 }
+export function scanRefusalCeiling(submittedProducts, opts) {
+    if (submittedProducts <= 0)
+        return 0;
+    return Math.min(Math.max(1, Math.floor(opts.scanRefusalRatioCap * submittedProducts)), opts.scanRefusalMaxPerPlan);
+}
 export function consolidationTypeEligible(type) {
     return type !== "episodic" && type !== "procedural";
 }
@@ -186,7 +199,7 @@ function planShapeInvalid(raw, planId) {
     if (typeof raw !== "object" || raw === null)
         return "not an object";
     const p = raw;
-    if (p["v"] !== 1)
+    if (p["v"] !== 1 && p["v"] !== 2)
         return "unrecognized version";
     if (p["planId"] !== planId)
         return "planId mismatch";
@@ -248,6 +261,13 @@ function planShapeInvalid(raw, planId) {
     }
     if (!p["directed"].every((d) => intentIds.has(d.intentRequestId)))
         return "directed patch references an undeclared intent";
+    const freezeRefused = p["freezeRefusedInputIds"];
+    if (freezeRefused !== undefined && (!Array.isArray(freezeRefused) || !freezeRefused.every((x) => typeof x === "string"))) {
+        return "malformed freezeRefusedInputIds";
+    }
+    if ((p["v"] === 2) !== (freezeRefused !== undefined)) {
+        return p["v"] === 2 ? "v2 plan without its freezeRefusedInputIds member" : "freezeRefusedInputIds on a v1 plan";
+    }
     if (!Array.isArray(p["audit"]))
         return "malformed audit trail";
     return undefined;