@sema-agent/core 5.58.0 → 5.59.0

package/dist/core/memory-engine/engine.d.ts

@@ -1,11 +1,11 @@
 import type { EngineNotice } from "../types.js";
-import { type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
+import { type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
 import { foreignDanglingSessionAccounts, type EffectiveSettlement, type HoldRow } from "./delegation-settlement.js";
 import { type OriginClearanceRow } from "./origin-clearance.js";
 import { type CommittedBinding, type EraseMemoryEntriesInput, type MemoryErasureAttestation, type TransferEvidence } from "./file-backend.js";
 import { type MemoryExportBundle, type MemoryImportReport } from "./export-bundle.js";
 import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionMarkOutcome, type SessionPollutionRecord } from "./layout.js";
-import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemoryEntry, MemoryEntryOrigin, MemorySessionHandle, ScanFinding } from "./types.js";
+import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemoryEntry, MemoryEntryOrigin, MemoryScopeEnumeration, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
  * (bench/cc-parity-toolsuite/reminders/live-capture-main-session-2026-07-08.md §12), with the
@@ -514,6 +514,36 @@ export interface ConsolidationPlanSummary {
     directed?: number;
     intents?: number;
 }
+/**
+ * design/376 slice ③ (#436) — one plan's MEMBER-LEVEL fold evidence
+ * ({@link MemoryEngine.readConsolidationPlanFoldEvidence}'s answer): which entry ids this plan's
+ * APPLIED products attest as superseded. Discriminated so an unreadable plan can never be told
+ * apart from an empty one by accident.
+ */
+export type ConsolidationPlanFoldEvidence = {
+    state: "ok";
+    scope: string;
+    /** The commit call's requestId, frozen on the plan — the durable run-attribution anchor
+     *  (the driver's per-cycle requestIds share the run's prefix, so a cycle whose receipt was
+     *  lost to a crash is still attributable to its run through the plan file). */
+    requestId: string;
+    planState: ConsolidationPlanFile["state"];
+    /** Every supersession-edge target of an APPLIED product, deduplicated and sorted. Products
+     *  still pending/conflicted attest nothing — the store never saw their edges land. */
+    supersededTargets: string[];
+} | {
+    state: "absent";
+} | {
+    state: "corrupt";
+    detail: string;
+    /** Present when the plan FILE parsed and only its product frontmatter is damaged (the deep
+     *  per-product walk's corrupt arm): the frozen attribution anchors survive the damage, so a
+     *  caller can still attribute the damaged plan to a run — the conservation wall uses this
+     *  to fail closed ONLY on a run-owned damaged plan while a foreign/historical one is
+     *  skipped with disclosure. Absent when the file itself is unreadable/unparseable. */
+    scope?: string;
+    requestId?: string;
+};
 /** §2.2 — the recommendation notice, minted off the harvest report's advisory member (the runner's
  *  hold-notice consumption point is its natural home). Undefined ⇔ this harvest crossed no edge. */
 export declare function memoryConsolidationRecommendedNotice(report: HarvestReport, sessionId?: string): EngineNotice | undefined;
@@ -956,10 +986,18 @@ export declare class MemoryEngine {
     }>;
     /**
      * §1.2-2/§1.2-3 — verb ②: mechanical acceptance + plan FREEZE + apply-to-terminal. Structural
-     * violations (scan findings, out-of-snapshot attribution, caps, the instruction hard gate, the
-     * supersession fuse) refuse the WHOLE plan — zero partial freeze; per-product eligibility drift
-     * (an input's rev moved / an input got challenged between snapshot and freeze) refuses THAT
-     * product with a disclosed reason while the rest freeze (§1.2-2 冻结时资格复验).
+     * violations (out-of-snapshot attribution, caps, the instruction hard gate, the supersession
+     * fuse, an empty plan) refuse the WHOLE plan — zero partial freeze. Per-product refusals, each
+     * disclosed on the receipt (`products.refused`): eligibility drift (an input's rev moved / an
+     * input got challenged between snapshot and freeze, §1.2-2 冻结时资格复验) AND scan findings
+     * (design/376 C-2① — the explicit revision of 339 §1.2-2's whole-plan clause: one product's
+     * refused bytes must not permanently deny service to every other fold in the plan). The scan
+     * seat keeps two whole-plan backstops: the scan-refusal fuse (C-2②, {@link scanRefusalCeiling})
+     * refuses a plan saturated with scan-refused products, and a plan the freeze emptied entirely
+     * refuses rather than settling as a vacuous completed run (C-2③ — completion writes `lastRunAt`
+     * and stamps the full eligible set into the fingerprint, blinding every later incremental
+     * snapshot). Intent (directed) scan findings stay whole-plan: intents are host-authored, not
+     * driver products.
      */
     commitConsolidationPlan(cycleToken: string, proposal: ConsolidationProposal, opts: {
         requestId: string;
@@ -1009,7 +1047,12 @@ export declare class MemoryEngine {
      * ABANDONED explicitly (audited; never a silent drop — unfulfilled and given-up stay two
      * distinguishable account facts, G24) and the seat releases; `retry` = the plan's unfulfilled
      * intents re-judge NOW into a NEW plan (fresh freeze, fresh baseRevs — the ONE authorized
-     * re-judgment point) which applies immediately. Both audited by requestId.
+     * re-judgment point) which applies immediately. A retry with NOTHING to re-judge (a
+     * products-only conflict plan, or every unfulfilled intent already credentialed) refuses
+     * instead of settling a vacuous completed run — C-2③'s empty-plan law at this corridor's door
+     * (the completion would burn the time gate and stamp the original cycle's eligible map into
+     * the fingerprint); `discard` is the exit that releases the seat without wearing the
+     * completed-run label. Both audited by requestId.
      */
     resolveConsolidationPlan(planId: string, action: "discard" | "retry", opts: {
         requestId: string;
@@ -1025,9 +1068,44 @@ export declare class MemoryEngine {
     private reconstructIntentsForRetry;
     /** §6.2 — host read face: every plan's summary (audit enumeration, zero model surface). */
     listConsolidationPlans(): ConsolidationPlanSummary[];
+    /**
+     * design/376 slice ③ (#436) — host read face: one plan's MEMBER-LEVEL fold evidence (which ids
+     * its APPLIED products supersede). This is the conservation wall's terminal witness: the
+     * driver's other two witnesses (per-cycle row delta, since-open store delta) are both
+     * store-COUNT readings, and an unrelated fold interleaved into the run's scope can numerically
+     * offset a planned member that was deleted mid-run — masking the shortfall behind a balanced
+     * count. Member identity cannot be offset: a planned member either appears among some
+     * run-attributed plan's applied supersession targets, sits in named residue, or the run must
+     * not wear the converged label. Committed plan-file read, side-effect-free; the answer carries
+     * the plan's frozen `requestId` so a caller can attribute plans to a run even across the
+     * commit→receipt crash window (the plan file is durable before any receipt is).
+     *
+     * SCOPE of the attestation, disclosed (an outside review probed it; recorded as the designed
+     * limit rather than patched): this is the committed HISTORICAL fact "this plan's edge landed" —
+     * it does not re-derive whether the edge still stands NOW. A target edit or a carrier challenge
+     * later SUSPENDS the edge (`deriveSupersededSet`'s revival law), and a competing writer may
+     * re-fold the revived member before the run's next snapshot; the attestation still exempts it
+     * and the run keeps its converged label. That label stays materially true in every reachable
+     * arm: the member's content is preserved in THIS run's committed carrier either way, the store
+     * is at a fixpoint (re-covered by a standing edge, or explicitly tombstoned), and the next full
+     * mint re-judges the live world. A LIVE-standing re-derivation here would instead false-red the
+     * honestly converged re-covered case, and the ruled evidence form is the per-plan applied edge.
+     */
+    readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     /** §6.2 — host read face: one scope's gate row (undefined when the store has no row — reading
-     *  never creates the file, so the OFF deployment stays byte-identical, G1). */
+     *  never creates the file, so the OFF deployment stays byte-identical, G1). A corrupt store
+     *  ALSO answers undefined here — this face cannot distinguish the two; a consumer that needs
+     *  the difference reads {@link readConsolidationGateState} (#437②). */
     readConsolidationGate(scope: string): ConsolidationGateRow | undefined;
+    /**
+     * design/376 slice ③ (#437②) — host read face: one scope's gate row as a DISCRIMINATED answer.
+     * The undiscriminated face above folds a corrupt store into `undefined`, so a healthy never-run
+     * scope and a store every verb will refuse fail-closed were indistinguishable to an operator or
+     * a scheduling read. `present` carries the row; `absent` = readable store, no row (reading never
+     * creates the file — the OFF deployment stays byte-identical, G1); `corrupt` carries the
+     * refusal detail. Additive; the undiscriminated face is unchanged.
+     */
+    readConsolidationGateState(scope: string): ConsolidationGateRead;
     /**
      * design/376 片② — host read face: one scope's committed FOLD STATE, in the freeze's own
      * accounting (`active` counts entries neither superseded nor excluded — byte-for-byte the
@@ -1050,6 +1128,17 @@ export declare class MemoryEngine {
      * (design/376 §1.6-4); path knowledge is not authority — nothing here bypasses a verb.
      */
     get controlPlaneRoot(): string;
+    /**
+     * design/376 slice ③ (#437③) — host read face: the store's scope enumeration, capability-probed
+     * on the backend (`listScopes`, the audit-face probe family). A backend WITHOUT the face
+     * answers `supported: false` — never an empty array: "cannot enumerate" and "hosts no scopes"
+     * must stay two different answers, or every audit sweep over a non-enumerating backend would
+     * silently claim a clean store. The File backend derives the answer from the store root's
+     * durable scope registry (store-level fact — never a session roster); the SQL twins gain the
+     * face through the store-contracts extension (separate ticket). A supporting backend's corrupt
+     * registry THROWS fail-closed — the same reason an unsupported one never reads as empty.
+     */
+    listMemoryScopes(): Promise<MemoryScopeEnumeration>;
     /** The committed, side-effect-free audit read: the adoption-restricted committed view when the
      *  backend offers one (zero-copy File — ledger+shadow, no disk adoption), else the non-adopting
      *  retrieval view (copy-out File), else the backend itself (Pg/TiDB shapes — naturally committed

package/dist/core/memory-engine/engine.js

@@ -9,7 +9,7 @@ import { formatMemoryAge } from "../memory-recall.js";
 import { committedDistilledOf, committedOriginOf, computeEntryRev, distilledEquals, hasDistilledFormExtra, hasOriginFormExtra, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenDistilled, stripModelWrittenOrigin } from "./frontmatter.js";
 import { MEMORY_PROVENANCE_RECALL_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow } from "./provenance-wording.js";
 import { isInstructionEntry } from "./header-hints.js";
-import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSOLIDATION_SEAT_FREEZE_GRACE_MS, consolidationTypeEligible, deriveProductSlug, deriveSupersededSet, isValidConsolidationPlanId, listConsolidationPlanIds, productAddPatch, quarantineCorruptPlan, readConsolidationGateFile, readConsolidationPlan, readIntentCredentials, recordActiveSetBaseline, recordConsolidationSession, recordIntentCredentials, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, writeConsolidationPlan, } from "./consolidation.js";
+import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSOLIDATION_SEAT_FREEZE_GRACE_MS, consolidationTypeEligible, deriveProductSlug, deriveSupersededSet, isValidConsolidationPlanId, listConsolidationPlanIds, productAddPatch, quarantineCorruptPlan, readConsolidationGateFile, readConsolidationPlan, readIntentCredentials, recordActiveSetBaseline, recordConsolidationSession, recordIntentCredentials, scanRefusalCeiling, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, writeConsolidationPlan, } from "./consolidation.js";
 import { classifySessionSettlements, clearHoldResolution, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, } from "./delegation-settlement.js";
 import { noReplaceRestore } from "./delegation-settlement.js";
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
@@ -2656,6 +2656,9 @@ export class MemoryEngine {
             else if (p.inputs.length > screened.maxInputsPerProduct)
                 reasons.push(`product #${i}: ${p.inputs.length} inputs > maxInputsPerProduct ${screened.maxInputsPerProduct}`);
         }
+        if (proposal.products.length === 0 && intents.length === 0) {
+            reasons.push("empty plan: zero products and zero directed intents — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)");
+        }
         if (reasons.length > 0)
             throw new ConsolidationRefusedError("memory.consolidation_refused", "memory consolidation plan refused (structural)", reasons);
         const planId = uuidv7();
@@ -2737,21 +2740,7 @@ export class MemoryEngine {
             }
         }
         const activeSetSize = headers.filter((h) => !superseded.has(h.id) && !exclusions.has(h.id)).length;
-        const edgeTargets = new Set();
-        for (const p of proposal.products)
-            for (const i2 of p.inputs)
-                if (i2.supersede === true)
-                    edgeTargets.add(i2.id);
         const ceiling = supersessionFuseCeiling(activeSetSize, screened);
-        if (edgeTargets.size > ceiling) {
-            wholeReasons.push(`supersession fuse: ${edgeTargets.size} distinct targets > ceiling ${ceiling} (active set ${activeSetSize}, ratio ${screened.supersedeRatioCap}, floor ${screened.supersedeAbsoluteFloor}, N-1 unconditional)`);
-            try {
-                enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation plan for scope ${inlineUntrusted(scope, 80)} REFUSED by the supersession fuse (${edgeTargets.size} targets over the ${ceiling} ceiling)`] });
-            }
-            catch (err) {
-                this.discloseAnnounceFailure("consolidation fuse enqueue", err);
-            }
-        }
         let visibleMarked = snapshot.marked;
         if (!visibleMarked) {
             const inputIds = [...new Set(proposal.products.flatMap((p) => p.inputs.map((i2) => i2.id)))];
@@ -2761,12 +2750,18 @@ export class MemoryEngine {
         const foldedOrigin = visibleMarked ? { taint: "external", cause: "derived", at } : undefined;
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
-            if (visibleMarked && isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) })) {
-                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26)`);
+            if (!isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) }))
+                continue;
+            if (visibleMarked) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26; no option opens this arm)`);
+            }
+            else if (!screened.allowInstructionProducts) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — instruction-form consolidation products are refused unconditionally by default (a consolidation must not mint privileged entries out of ordinary notes); the host escape hatch is consolidation.allowInstructionProducts: true`);
             }
         }
         const assembled = [];
         const refusedProducts = [];
+        const scanRefused = [];
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
             const drift = [];
@@ -2813,11 +2808,31 @@ export class MemoryEngine {
             const nameFinding = scanMemoryFileName(`${slug}.md`);
             const findings = [...(nameFinding !== undefined ? [nameFinding] : []), ...scanMemoryWrite(serializeEntryFile(entry), { maxBytes: this.perFileBytes })];
             if (findings.length > 0) {
-                wholeReasons.push(`product #${i}: scan gate (${findings.map((f) => `${f.code}: ${f.reason}`).join("; ")})`);
+                const reason = `scan gate (${findings.map((f) => `${f.code}: ${f.reason}`).join("; ")})`;
+                refusedProducts.push({ index: i, reason });
+                scanRefused.push({ index: i, reason });
                 continue;
             }
             assembled.push(entry);
         }
+        const edgeTargets = new Set();
+        for (const e of assembled)
+            for (const i2 of e.frontmatter.distilled?.inputs ?? [])
+                if (i2.superseded === true)
+                    edgeTargets.add(i2.id);
+        if (edgeTargets.size > ceiling) {
+            wholeReasons.push(`supersession fuse: ${edgeTargets.size} distinct targets > ceiling ${ceiling} (active set ${activeSetSize}, ratio ${screened.supersedeRatioCap}, floor ${screened.supersedeAbsoluteFloor}, N-1 unconditional)`);
+            try {
+                enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation plan for scope ${inlineUntrusted(scope, 80)} REFUSED by the supersession fuse (${edgeTargets.size} targets over the ${ceiling} ceiling)`] });
+            }
+            catch (err) {
+                this.discloseAnnounceFailure("consolidation fuse enqueue", err);
+            }
+        }
+        const scanCeiling = scanRefusalCeiling(proposal.products.length, screened);
+        if (scanRefused.length > scanCeiling) {
+            wholeReasons.push(`scan-refusal fuse: ${scanRefused.length} of ${proposal.products.length} product(s) failed the write scan > ceiling ${scanCeiling} (ratio ${screened.scanRefusalRatioCap}, per-plan max ${screened.scanRefusalMaxPerPlan}) — ${scanRefused.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}`);
+        }
         const directed = [];
         const intents = proposal.intents ?? [];
         const targetIds = intents.map((it) => it.entryId);
@@ -2875,6 +2890,9 @@ export class MemoryEngine {
                 directed.push({ intentRequestId: intent.requestId, op: "update", id: intent.entryId, baseRev: committed.rev, plannedPostRev: terminal.rev, entry: terminal, state: "pending" });
             }
         }
+        if (wholeReasons.length === 0 && assembled.length === 0 && directed.length === 0) {
+            wholeReasons.push(`empty plan after freeze: every product was refused (${refusedProducts.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}) — a plan with nothing left to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)`);
+        }
         if (wholeReasons.length > 0)
             throw new ConsolidationRefusedError("memory.consolidation_refused", "memory consolidation plan refused", wholeReasons);
         try {
@@ -2888,8 +2906,9 @@ export class MemoryEngine {
                 throw err;
             throw new ConsolidationRefusedError("memory.consolidation_gate_corrupt", `memory consolidation refused: the gate store could not be re-read at the freeze boundary (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
         }
+        const freezeRefusedInputIds = [...new Set(refusedProducts.flatMap((r) => (proposal.products[r.index]?.inputs ?? []).map((i2) => i2.id)))].sort();
         const plan = {
-            v: 1,
+            v: freezeRefusedInputIds.length > 0 ? 2 : 1,
             planId,
             scope,
             requestId: input.requestId,
@@ -2900,6 +2919,7 @@ export class MemoryEngine {
             ...(foldedOrigin !== undefined ? { foldedOrigin } : {}),
             products: assembled,
             productStates: Object.fromEntries(assembled.map((e) => [e.id, "pending"])),
+            ...(freezeRefusedInputIds.length > 0 ? { freezeRefusedInputIds } : {}),
             directed,
             intents: intents.map((it) => ({ requestId: it.requestId, state: "pending" })),
             state: "open",
@@ -3099,6 +3119,7 @@ export class MemoryEngine {
         }
         writeConsolidationPlan(this.controlDir, plan);
         const currentlyEligible = await this.settleFingerprintFilter(plan.scope);
+        const freezeRefused = new Set(plan.freezeRefusedInputIds ?? []);
         updateConsolidationGate(this.controlDir, (file) => {
             const row = file.scopes[plan.scope];
             if (row?.openPlanId !== plan.planId)
@@ -3111,6 +3132,8 @@ export class MemoryEngine {
                 if (currentlyEligible !== undefined) {
                     const fp = {};
                     for (const [id, rev] of Object.entries(row.snapshot.eligible)) {
+                        if (freezeRefused.has(id))
+                            continue;
                         if (!currentlyEligible(id, rev))
                             continue;
                         fp[id] = { rev };
@@ -3234,6 +3257,7 @@ export class MemoryEngine {
     }
     async settleGateForTerminalPlan(plan) {
         const currentlyEligible = await this.settleFingerprintFilter(plan.scope);
+        const freezeRefused = new Set(plan.freezeRefusedInputIds ?? []);
         updateConsolidationGate(this.controlDir, (file) => {
             const row = file.scopes[plan.scope];
             if (row?.openPlanId !== plan.planId)
@@ -3247,6 +3271,8 @@ export class MemoryEngine {
                     if (currentlyEligible !== undefined) {
                         const fp = {};
                         for (const [id, rev] of Object.entries(row.snapshot.eligible)) {
+                            if (freezeRefused.has(id))
+                                continue;
                             if (!currentlyEligible(id, rev))
                                 continue;
                             fp[id] = { rev };
@@ -3348,6 +3374,24 @@ export class MemoryEngine {
             throw new ConsolidationRefusedError("memory.consolidation_gate_corrupt", `memory consolidation retry refused: the intent-credential account cannot be trusted (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
         }
         const pendingIntents = plan.intents.filter((i) => i.state === "pending" && standingCredentials[i.requestId] === undefined).map((i) => i.requestId);
+        if (pendingIntents.length === 0) {
+            throw new ConsolidationRefusedError("memory.consolidation_refused", `memory consolidation retry refused: plan ${planId} has nothing to re-judge — ` +
+                (plan.intents.length === 0
+                    ? "it carries no intents (a conflicted product never rides a retry)"
+                    : "every unfulfilled intent already carries a credential (consumed by an earlier retry or a racing plan)") +
+                ` — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face); resolve with "discard" to release the seat.`);
+        }
+        const conflictProductInputIds = [];
+        for (const p of plan.products) {
+            if (plan.productStates[p.id] !== "conflict")
+                continue;
+            const inputs = p.frontmatter?.distilled?.inputs;
+            if (!Array.isArray(inputs) || inputs.some((i) => typeof i?.["id"] !== "string")) {
+                throw new ConsolidationRefusedError("memory.consolidation_refused", `memory consolidation retry refused: conflicted product ${p.id} carries no readable distilled attribution rows (every frozen product is minted with them — this is control-plane damage); the plan stays parked, resolve with "discard" (the bytes remain on the plan file for host review).`);
+            }
+            for (const i of inputs)
+                conflictProductInputIds.push(i.id);
+        }
         const face = this.committedAuditFace();
         const originalIntents = await this.reconstructIntentsForRetry(plan, pendingIntents, face);
         const retryPlanId = uuidv7();
@@ -3361,8 +3405,9 @@ export class MemoryEngine {
             file.scopes[plan.scope] = row;
             return { next: file, result: undefined };
         });
+        const inheritedRefusals = [...new Set([...(plan.freezeRefusedInputIds ?? []), ...conflictProductInputIds])].sort();
         const retryPlan = {
-            v: 1,
+            v: inheritedRefusals.length > 0 ? 2 : 1,
             planId: retryPlanId,
             scope: plan.scope,
             requestId: opts.requestId,
@@ -3371,6 +3416,7 @@ export class MemoryEngine {
             visibleMarked: false,
             products: [],
             productStates: {},
+            ...(inheritedRefusals.length > 0 ? { freezeRefusedInputIds: inheritedRefusals } : {}),
             directed: originalIntents.directed,
             intents: pendingIntents.map((r) => ({ requestId: r, state: "pending" })),
             state: "open",
@@ -3450,6 +3496,35 @@ export class MemoryEngine {
         }
         return out;
     }
+    readConsolidationPlanFoldEvidence(planId) {
+        const read = readConsolidationPlan(this.controlDir, planId);
+        if (read.state === "absent")
+            return { state: "absent" };
+        if (read.state === "corrupt")
+            return { state: "corrupt", detail: read.detail };
+        const p = read.plan;
+        const targets = new Set();
+        for (const prod of p.products) {
+            if (p.productStates[prod.id] !== "applied")
+                continue;
+            const inputs = prod.frontmatter?.distilled?.inputs;
+            const anchors = { scope: p.scope, requestId: p.requestId };
+            if (inputs === undefined)
+                return { state: "corrupt", detail: `applied product ${prod.id} carries no distilled.inputs (every frozen product is minted with its attribution rows)`, ...anchors };
+            if (!Array.isArray(inputs))
+                return { state: "corrupt", detail: `applied product ${prod.id} carries a non-array distilled.inputs`, ...anchors };
+            for (const i of inputs) {
+                if (typeof i !== "object" || i === null)
+                    return { state: "corrupt", detail: `applied product ${prod.id} carries a malformed distilled input row`, ...anchors };
+                if (i.superseded !== true)
+                    continue;
+                if (typeof i.id !== "string")
+                    return { state: "corrupt", detail: `applied product ${prod.id} carries a supersession edge without a string target id`, ...anchors };
+                targets.add(i.id);
+            }
+        }
+        return { state: "ok", scope: p.scope, requestId: p.requestId, planState: p.state, supersededTargets: [...targets].sort() };
+    }
     readConsolidationGate(scope) {
         try {
             return readConsolidationGateFile(this.controlDir).scopes[scope];
@@ -3458,6 +3533,16 @@ export class MemoryEngine {
             return undefined;
         }
     }
+    readConsolidationGateState(scope) {
+        let row;
+        try {
+            row = readConsolidationGateFile(this.controlDir).scopes[scope];
+        }
+        catch (err) {
+            return { state: "corrupt", detail: err instanceof Error ? err.message : String(err) };
+        }
+        return row !== undefined ? { state: "present", row } : { state: "absent" };
+    }
     async readConsolidationFoldState(scope) {
         const face = this.committedAuditFace();
         const headers = await face.listHeaders([scope]);
@@ -3478,6 +3563,13 @@ export class MemoryEngine {
     get controlPlaneRoot() {
         return this.controlDir;
     }
+    async listMemoryScopes() {
+        const b = this.backend;
+        if (typeof b.listScopes !== "function") {
+            return { supported: false, reason: "the backend does not implement scope enumeration (listScopes) — an absent capability must never read as an empty scope list" };
+        }
+        return await b.listScopes();
+    }
     committedAuditFace() {
         const b = this.backend;
         return b.restrictedAdoptionView?.({ audit: false }) ?? b.retrievalView?.() ?? this.backend;

package/dist/core/memory-engine/file-backend.d.ts

@@ -1,6 +1,6 @@
 import { scopeDirName, type ChallengeEvent, type MemoryPartitionIncidentSink } from "./layout.js";
 import type { MemoryBundleImportPlan, MemoryImportReport } from "./export-bundle.js";
-import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
+import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, MemoryScopeEnumeration, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
 /** Files/dirs the entry scan never treats as entries: the derived index, dotfiles (`.hydrate`,
  *  transaction staging files), and anything not `.md`. */
 export declare const MEMORY_INDEX_FILENAME = "MEMORY.md";
@@ -756,6 +756,18 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      * while a live holder exists ({@link txnInFlight}), which now covers adoption holds too.
      */
     private readScopeAdopting;
+    /**
+     * design/376 slice ③ (#437③) — the File leg's scope-enumeration capability face: every scope
+     * this store has hosted, derived from the store root's durable scope registry (the control
+     * plane's `scopes.json` — the one source that can invert a scope's sanitized directory label
+     * back to its name; a listing of raw subdirectories could not). Side-effect-free committed
+     * read; a corrupt/unreadable registry THROWS its fail-closed refusal — enumeration over an
+     * untrustworthy registry must never answer an empty (= clean-looking) list. Honest residual,
+     * disclosed: the registry records scopes as they are first touched THROUGH this control plane,
+     * so a hand-assembled tree's never-touched scope dirs appear here only once a caller first
+     * names them — store-level fact, session-roster-free either way.
+     */
+    listScopes(): MemoryScopeEnumeration;
     listHeaders(scopes: readonly string[]): Promise<MemoryEntryHeader[]>;
     private listHeadersFrom;
     getByIds(ids: readonly string[]): Promise<MemoryEntry[]>;

package/dist/core/memory-engine/file-backend.js

@@ -1780,6 +1780,9 @@ export class FileMemoryEngineBackend {
             lock.release();
         }
     }
+    listScopes() {
+        return { supported: true, scopes: Object.keys(registeredScopes(this.controlPlaneRoot)).sort() };
+    }
     async listHeaders(scopes) {
         return this.listHeadersFrom(scopes, (s) => this.readScopeAdopting(s));
     }

package/dist/core/memory-engine/index.d.ts

@@ -1,4 +1,4 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, } from "./engine.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, type MemoryGetDetails, } from "./tools.js";
 export { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_RECALL_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow, } from "./provenance-wording.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
@@ -8,11 +8,12 @@ export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlane
 export { readV2HeaderHints, isInstructionEntry, type V2HeaderHints } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation, type ParsedEntryFile } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
-export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
+export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
 export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type RunMemoryConsolidationOptions, } from "./consolidation-driver.js";
+export type { OriginClearanceRow, OriginClearanceEvent } from "./origin-clearance.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
-export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
+export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryScopeEnumeration, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, } from "./memory-backend-contract.js";
 export { SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, } from "./scope-contract.js";
 export { migrateScope, type MigrateScopeReport } from "./migrate.js";

package/dist/core/memory-engine/layout.js

@@ -303,21 +303,35 @@ export function dirCaseFolds(dir) {
 }
 function readScopesRecord(controlDir) {
     const path = join(controlDir, SCOPES_FILE);
+    const journalPath = `${path}.journal`;
     let raw;
+    let sourcePath = journalPath;
     try {
-        raw = readFileSync(path, "utf8");
+        raw = readFileSync(journalPath, "utf8");
     }
     catch (err) {
-        if (err.code === "ENOENT")
-            return {};
-        throw new ControlPlaneCorruptError(`scope registry unreadable (${err.code ?? "io error"}): ${path}`, { cause: err });
+        if (err.code !== "ENOENT") {
+            throw new ControlPlaneCorruptError(`scope registry journal unreadable (${err.code ?? "io error"}) — a committed next state may exist that cannot be proven: ${journalPath}`, { cause: err });
+        }
+        raw = undefined;
+    }
+    if (raw === undefined) {
+        sourcePath = path;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return {};
+            throw new ControlPlaneCorruptError(`scope registry unreadable (${err.code ?? "io error"}): ${path}`, { cause: err });
+        }
     }
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new ControlPlaneCorruptError(`scope registry is unparseable: ${path}`);
+        throw new ControlPlaneCorruptError(`scope registry is unparseable: ${sourcePath}`);
     }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new ControlPlaneCorruptError(`scope registry has the wrong shape: ${path}`);
@@ -351,7 +365,7 @@ function lockedScopesUpdate(controlDir, fn) {
     const lock = `${file}.lock`;
     const token = acquireSidecarLock(lock, { onDeadline: "throw" });
     try {
-        rollForwardSidecar(file, journal);
+        rollForwardStrictSidecar(file, journal);
         const rec = readScopesRecord(controlDir);
         const { next, result } = fn(rec);
         if (next !== undefined) {

package/dist/core/memory-engine/types.d.ts

@@ -246,6 +246,23 @@ export interface NotePatch {
      *  Ignored on `update`/`delete`. */
     guard?: "absent";
 }
+/**
+ * design/376 slice ③ (#437③) — a backend's scope-enumeration answer, DISCRIMINATED on purpose:
+ * "this backend cannot enumerate" and "this store hosts no scopes" must never share a spelling
+ * (an unsupported backend read as `[]` would make every audit sweep over it silently claim a
+ * clean store). The capability itself is an OPTIONAL backend face (`listScopes`, probed like the
+ * File class's audit faces): a backend without it is answered `supported: false` by
+ * `MemoryEngine.listMemoryScopes`, never an empty array. The File leg derives from the store
+ * root's durable scope registry; the SQL twins' leg is a store-contracts extension (separate
+ * ticket) — until it lands they simply do not implement the face.
+ */
+export type MemoryScopeEnumeration = {
+    supported: true;
+    scopes: string[];
+} | {
+    supported: false;
+    reason: string;
+};
 /** Result of {@link MemoryBackend.applyPatches} — applied ops + per-id CAS conflicts (reported, not thrown). */
 export interface PatchReport {
     applied: Array<{

package/dist/core/permission-rule-model.d.ts

@@ -282,6 +282,40 @@ export declare const SUGGESTION_LEXICON: readonly string[];
  * through, so an ordinary rule text reads normally. The result is length-bounded.
  */
 export declare function escapeForDisclosure(value: unknown): string;
+/**
+ * Render raw, untrusted COMMAND text for a display surface — the minimal safe baseline for the seats
+ * that carry post-rewrite command bytes verbatim ({@link SegmentRuleSuggestion.segment} is the
+ * motivating one; a card's own `command`/`args` echo has the same hazard).
+ *
+ * WHAT IT DOES, and why the two character families are not handled the same way:
+ *  · `\p{Cf}` (the bidirectional controls U+061C/U+200E/U+200F/U+202A–U+202E/U+2066–U+2069 and the
+ *    zero-width formatters ZWSP/ZWNJ/ZWJ/WORD JOINER/SOFT HYPHEN/BOM) is REMOVED. These occupy no
+ *    width, so deleting them is what makes the rendered line agree with what a reader believes they
+ *    are reading — a `rm -rf x` that DISPLAYS as something benign is exactly the deception the seat
+ *    would otherwise hand on. This is the same family
+ *    {@link import("./tool-policy.js").AskRequest.hasBidiControls} raises its warning bit for; the
+ *    bit says "the raw bytes carry them", this function is what a surface renders instead.
+ *  · Controls and line/paragraph separators (C0 incl. TAB and NEWLINE, DEL, C1, U+2028/U+2029) are
+ *    FOLDED TO A SPACE with runs collapsed, not removed: they occupy width (or a whole line), and
+ *    deleting them would glue two tokens into one word that reads as a different command. TAB is not
+ *    excepted here — a one-line display value has no use for one, and a rule text's foldable-tab
+ *    exception belongs to the VALIDATOR class, not to this one.
+ * The result is then capped by code point (never splitting a surrogate pair) with a `…` marker, and
+ * carries the shared authority-envelope neutralization every untrusted inline value gets — this text
+ * can land on a model-visible line as easily as on a human one.
+ *
+ * WHAT IT IS NOT. A DISPLAY baseline, never an identity channel and never adjudication input: the
+ * transform is LOSSY and NOT injective (two distinct commands can render identically — that is the
+ * price of a readable line). Correlate, match, store and adjudicate on the RAW bytes, which the
+ * carrying seats keep unchanged: this function neither changes what those seats contain nor what any
+ * of them means. A caller that must instead tell two hostile texts APART wants
+ * {@link escapeForDisclosure} (which escapes rather than folds, so nothing collides) or
+ * {@link hasUnrenderableCharacters} (refuse instead of render).
+ *
+ * @param text the raw untrusted text (a `String(x)` is applied to anything that is not one).
+ * @param maxLen code-point cap for the rendered result; defaults to the disclosure-line budget.
+ */
+export declare function renderUntrustedCommandText(text: unknown, maxLen?: number): string;
 /**
  * Does this text carry a character of the class {@link escapeForDisclosure} exists for — the class
  * {@link CONTROL_CHARS_RE} names? Asked by a caller that must REFUSE such a value rather than render
@@ -488,7 +522,14 @@ export interface SegmentRuleSuggestion {
     readonly command: string;
     /** The (folded) segment this suggestion came from. Raw post-rewrite command bytes — a substring
      *  of the same call's `args`/`command` values riding beside it on every surface that carries
-     *  this seat — so render it with contextual escaping, exactly like those. */
+     *  this seat — so render it with contextual escaping, exactly like those.
+     *
+     *  RAW is the contract here and does not change: this seat carries the bytes, because the bytes are
+     *  what a rule would be minted from and what a correlation keys on. The rendering side of that
+     *  contract is {@link renderUntrustedCommandText} — the shipped display baseline (bidi and
+     *  zero-width controls removed, controls/line separators folded, length capped, envelope-neutralized)
+     *  a surface can adopt instead of writing its own, since raw command bytes displayed unprocessed can
+     *  show a reader something other than what they authorize. */
     readonly segment: string;
 }
 /**