@sema-agent/core 5.58.0 → 5.60.0

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -22,7 +22,7 @@
  */
 import type { EngineNotice } from "../types.js";
 import { type ConsolidationGateRow, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
-import { type ConsolidationPlanSummary } from "./engine.js";
+import { type ConsolidationPlanFoldEvidence, type ConsolidationPlanSummary } from "./engine.js";
 import { mintLlmConsolidationPlan, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationFoldState, type DistillerChatFn, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract } from "./distiller.js";
 export declare const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 /** §1.6-4 — the mint archive: what was shown to the model and what it answered, verbatim, per run
@@ -114,10 +114,14 @@ export declare function readConsolidationDriverRun(controlDir: string, scope: st
  *  run row's `planArchive` (written under the attempt guard) names the one that counts. */
 export declare function distillerPlanArchiveName(runId: string, attempt: number): string;
 export declare function archiveDistillerPlan(controlDir: string, runId: string, plan: LlmConsolidationPlan, attempt?: number): string;
-/** The engine face this verb consumes — `MemoryEngine` satisfies it structurally. */
+/** The engine face this verb consumes — `MemoryEngine` satisfies it structurally.
+ *  (`readConsolidationPlanFoldEvidence` joined in design/376 slice ③, #436: the conservation
+ *  wall's terminal witness is member-level, so the face is REQUIRED — an engine without it could
+ *  only offer the store-delta counts an interleaved fold can numerically offset.) */
 export interface ConsolidationDriverEngine extends ConsolidationDriveEngine {
     readConsolidationGate(scope: string): ConsolidationGateRow | undefined;
     listConsolidationPlans(): ConsolidationPlanSummary[];
+    readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     readConsolidationFoldState(scope: string): Promise<ConsolidationFoldState>;
     readonly controlPlaneRoot: string;
 }

package/dist/core/memory-engine/consolidation-driver.js

@@ -182,6 +182,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
         return settle("parked", undefined, parkedSeat);
     }
     let staleResidue = [];
+    let staleResidueMemberIds = new Set();
     const distill = async (candidates, snapshot, s) => {
         if (run.planCache === undefined) {
             let minted;
@@ -233,11 +234,12 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             writeDriverRun(controlDir, run);
             archiveDistillerPlan(controlDir, run.runId, plan, run.attempt);
         }
+        const offered = new Map();
+        for (const c of candidates)
+            if (typeof c?.entry?.id === "string")
+                offered.set(c.entry.id, c.entry.rev);
+        staleResidueMemberIds = new Set();
         staleResidue = (run.planCache?.products ?? []).flatMap((p) => {
-            const offered = new Map();
-            for (const c of candidates)
-                if (typeof c?.entry?.id === "string")
-                    offered.set(c.entry.id, c.entry.rev);
             const ids = p.inputIds ?? [];
             const live = ids.filter((id) => offered.has(id));
             if (live.length === 0)
@@ -245,7 +247,11 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             const stale = p.inputRevs !== undefined && live.some((id) => p.inputRevs[id] !== undefined && offered.get(id) !== p.inputRevs[id]);
             const vanished = live.length < ids.length;
             const unanchored = p.inputRevs === undefined;
-            return stale || vanished || unanchored ? [{ name: p.name, targets: live.length }] : [];
+            if (!(stale || vanished || unanchored))
+                return [];
+            for (const id of live)
+                staleResidueMemberIds.add(id);
+            return [{ name: p.name, targets: live.length }];
         });
         const replayView = run.planCache !== undefined && run.planCache.products.some((p) => p.inputRevs === undefined)
             ? { ...run.planCache, products: run.planCache.products.filter((p) => p.inputRevs !== undefined) }
@@ -329,6 +335,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     const writeResidue = run.writeFailures.map((w) => ({ name: w.key, targets: w.members }));
     const driverResidue = [...staleResidue, ...writeResidue];
     if (drive.converged) {
+        const plannedIds = [...new Set((run.planCache?.products ?? []).flatMap((p) => p.inputIds ?? []))];
         const plannedMembers = (run.planCache?.products ?? []).reduce((a, p) => a + (p.inputIds?.length ?? 0), 0);
         const rowAccount = run.entriesSuperseded ?? 0;
         const storeAccount = run.foldBaseline !== undefined ? Math.max(0, drive.foldState.after.superseded - run.foldBaseline.superseded) : rowAccount;
@@ -339,6 +346,24 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             run.residue = driverResidue;
             return settle("driver_failed", drive, `the drive reached a fixpoint but the account does not balance: ${plannedMembers} planned member(s), ${supersededAttested} superseded attested for this run (row account ${rowAccount}, store delta ${run.foldBaseline !== undefined ? storeAccount : "unavailable — the row predates the store anchor"}), ${residueTargets} in named residue — ${plannedMembers - accounted} member(s) left the candidate set without a fold the store attests (deleted or excluded mid-run${run.foldBaseline !== undefined ? "" : ", or folded in a window whose account write did not survive"}); their entries stand (or revive with their exclusion), and a fresh run re-mints over the current library`);
         }
+        if (plannedIds.length > 0) {
+            const evidence = collectRunFoldEvidence(engine, scope, run.requestId);
+            if (evidence.skipped.length > 0) {
+                const named = evidence.skipped.slice(0, 5).map((s) => `${s.planId} (${s.state})`).join(", ");
+                announce([
+                    `memory consolidation conservation wall for scope ${inlineUntrusted(scope, 80)}: ${evidence.skipped.length} same-scope plan file(s) answered unreadable and were SKIPPED as foreign to run ${run.runId} — they attest nothing for this run and need out-of-band repair: ${named}${evidence.skipped.length > 5 ? ", …" : ""}`,
+                ]);
+            }
+            if (evidence.unreadable !== undefined) {
+                run.residue = driverResidue;
+                return settle("driver_failed", drive, `the drive reached a fixpoint but the member-level fold evidence is incomplete: plan ${evidence.unreadable} — one of THIS run's own cycles — answered ${evidence.unreadableState} (control-plane damage on run-owned evidence, not a transient race); a converged label needs attestable members; the library stands as committed and a fresh run re-mints over the current bytes`);
+            }
+            const missing = plannedIds.filter((id) => !evidence.targets.has(id) && !staleResidueMemberIds.has(id));
+            if (missing.length > 0) {
+                run.residue = driverResidue;
+                return settle("driver_failed", drive, `the drive reached a fixpoint but ${missing.length} of ${plannedIds.length} planned member(s) left the candidate set without a fold this run's plans attest (deleted, excluded, or superseded by another writer mid-run; e.g. ${missing.slice(0, 5).join(", ")}) — a store-delta count can be numerically offset by an unrelated interleaved fold, so member identity is the final judge; the entries stand (or revive with their exclusion) and a fresh run re-mints over the current library`);
+            }
+        }
         if (driverResidue.length > 0) {
             run.residue = driverResidue;
             return settle("driver_failed", drive, `the drive reached the surviving plan's fixpoint, but the driver's own half left ${driverResidue.length} group(s) unfolded (${staleResidue.length} stale against edited inputs, ${writeResidue.length} writing-pass failure(s)) — their members stay as they were; a fresh run re-mints over the current bytes`);
@@ -356,6 +381,30 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
         return settle("parked", drive, stop.reason);
     return settle("refused", drive, stop?.reason ?? "the drive stopped without a stated reason");
 }
+function collectRunFoldEvidence(engine, scope, requestId) {
+    const cycleId = new RegExp(`^${requestId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}-c\\d+$`);
+    const targets = new Set();
+    const skipped = [];
+    for (const summary of engine.listConsolidationPlans()) {
+        if (summary.corrupt === true)
+            continue;
+        if (summary.scope !== scope)
+            continue;
+        const ev = engine.readConsolidationPlanFoldEvidence(summary.planId);
+        if (ev.state !== "ok") {
+            if (ev.state === "corrupt" && ev.requestId !== undefined && cycleId.test(ev.requestId)) {
+                return { targets, unreadable: summary.planId, unreadableState: ev.state, skipped };
+            }
+            skipped.push({ planId: summary.planId, state: ev.state });
+            continue;
+        }
+        if (ev.scope !== scope || !cycleId.test(ev.requestId))
+            continue;
+        for (const t of ev.supersededTargets)
+            targets.add(t);
+    }
+    return { targets, skipped };
+}
 async function recoverSeat(engine, scope, { sleep, windowMs }) {
     await engine.reconcileConsolidation(scope);
     let seat = engine.readConsolidationGate(scope)?.openPlanId;

package/dist/core/memory-engine/consolidation.d.ts

@@ -91,6 +91,25 @@ export interface MemoryConsolidationOptions {
     maxDirectedPatchesPerPlan?: number;
     minRunIntervalMs?: number;
     minSessionsBetweenRuns?: number;
+    /** design/376 C-2② — the scan-refusal fuse's ratio leg, in (0, 1]: scan findings refuse the
+     *  affected PRODUCT (disclosed beside eligibility drift), and the whole plan refuses only when
+     *  more than max(1, ⌊ratio × submitted products⌋) of them fail the scan (the floor keeps the
+     *  per-product tolerance alive on 1-4 product plans — the drive lane's common size) — see
+     *  {@link scanRefusalCeiling}. Default 0.25. */
+    scanRefusalRatioCap?: number;
+    /** design/376 C-2② — the fuse's absolute leg (positive integer): the large-batch upper bound on
+     *  tolerated scan refusals per plan, so the ratio cannot scale the tolerance without limit.
+     *  Default 8 (the point where the 0.25 ratio hands over at 32 submitted products — the family's
+     *  "小 N" quantification; below that the ratio leg alone governs). */
+    scanRefusalMaxPerPlan?: number;
+    /** design/376 C-3 — the EXPLICIT escape hatch for the unconditional instruction-form gate:
+     *  instruction-form consolidation products (`type: "feedback"` / v2 hint carriers) are refused
+     *  by default REGARDLESS of the visible set's markers — a clean-set instruction product is the
+     *  model-reachable privilege route (N ordinary notes in, one instruction entry out). `true` is
+     *  the only accepted value (a posture declaration, like {@link multiNode}); it opens the
+     *  CLEAN-set arm only — a marked visible set refuses instruction forms under the laundering
+     *  hard gate no matter what (privilege and hard gate enter and exit through one door). */
+    allowInstructionProducts?: true;
     /** D-13a — the multi-node POSTURE declaration: present ⇒ `lease` must be injected (constructor
      *  refusal otherwise). Multi-node without declaring is OUT OF CONTRACT (structurally
      *  undetectable — the declaration turns a silent omission into an explicit choice). */
@@ -113,6 +132,8 @@ export declare const CONSOLIDATION_DEFAULTS: {
     readonly maxDirectedPatchesPerPlan: 32;
     readonly minRunIntervalMs: number;
     readonly minSessionsBetweenRuns: 5;
+    readonly scanRefusalRatioCap: 0.25;
+    readonly scanRefusalMaxPerPlan: 8;
 };
 /**
  * §2.2 — the HARD throttle floor: even a `force` run cannot start a second same-scope run within
@@ -142,6 +163,9 @@ export interface ScreenedConsolidationOptions {
     maxDirectedPatchesPerPlan: number;
     minRunIntervalMs: number;
     minSessionsBetweenRuns: number;
+    scanRefusalRatioCap: number;
+    scanRefusalMaxPerPlan: number;
+    allowInstructionProducts: boolean;
     multiNode: boolean;
     lease?: ConsolidationLeaseSeat;
 }
@@ -159,6 +183,21 @@ export declare function screenConsolidationOptions(raw: MemoryConsolidationOptio
 /** §1.2-2 — the supersession fuse ceiling: min(N-1, max(floor, ⌊ratio×N⌋)); N ≤ 1 ⇒ 0 (one plan
  *  may NEVER empty the active set — the N-1 ceiling is unconditional, G21). */
 export declare function supersessionFuseCeiling(activeSetSize: number, opts: Pick<ScreenedConsolidationOptions, "supersedeRatioCap" | "supersedeAbsoluteFloor">): number;
+/**
+ * design/376 C-2② — the scan-refusal fuse ceiling: how many scan-refused products ONE plan may
+ * carry before the whole plan refuses instead of committing around them.
+ * `min(max(1, ⌊ratio × submitted⌋), absolute max)`; the ratio leg governs small plans, the
+ * absolute leg is the large-batch upper bound, and the FLOOR of one keeps C-2①'s per-product
+ * tolerance alive at the drive lane's common plan sizes — under the default 0.25 ratio a bare
+ * floor answers 0 for every ≤3-product plan, so one stray refused product re-killed the whole
+ * plan there, exactly the shape C-2① was adopted to remove (an adopted review finding). The
+ * floor is NOT a hole for the fully-refused tiny plan: a plan whose every product is refused
+ * (and which carries no directed work) still dies at the freeze-emptied C-2③ backstop, never a
+ * quiet mostly-no-op — what the floor tolerates is exactly one refused product beside at least
+ * one survivor. Submitted count = the proposal's product count (per THIS plan, never a
+ * cross-run tally).
+ */
+export declare function scanRefusalCeiling(submittedProducts: number, opts: Pick<ScreenedConsolidationOptions, "scanRefusalRatioCap" | "scanRefusalMaxPerPlan">): number;
 /** §3.1 — the type axis of the eligibility predicate: episodic entries are read-only evidence
  *  (never candidates, never supersession/directed targets, A-7); procedural promotion is a v3
  *  follow-on ticket. Unknown/absent types are ordinary semantic notes — eligible. */
@@ -231,6 +270,24 @@ export declare function updateConsolidationGate<T>(controlDir: string, fn: (file
 export declare function readConsolidationGateFile(controlDir: string): ConsolidationGateFile;
 /** True ⇔ the gate store file exists at all (G1's zero-file pin reads this negatively). */
 export declare function consolidationGateFileExists(controlDir: string): boolean;
+/**
+ * design/376 slice ③ (#437②) — the gate read face's DISCRIMINATED answer
+ * ({@link import("./engine.js").MemoryEngine.readConsolidationGateState}): `present` carries the
+ * row; `absent` means the store is readable and simply has no row for the scope (a never-run
+ * scope, or no gate file at all); `corrupt` means the store cannot be trusted and carries the
+ * refusal detail. The undiscriminated `readConsolidationGate` face folds corrupt into `undefined`
+ * — an operator (or a driver's scheduling read) could not tell a healthy never-run scope from a
+ * store every verb will refuse fail-closed.
+ */
+export type ConsolidationGateRead = {
+    state: "present";
+    row: ConsolidationGateRow;
+} | {
+    state: "absent";
+} | {
+    state: "corrupt";
+    detail: string;
+};
 /**
  * §2.2 — the engine-minted session count (harvest-tail bookkeeping; ≤1 row write per terminal
  * harvest; the OFF mode never calls this — D-9a zero-write). Returns the recommendation edge:
@@ -304,7 +361,15 @@ export interface ConsolidationDirectedPatch {
 }
 export type ConsolidationPlanState = "open" | "applying" | "completed" | "conflict" | "discarded";
 export interface ConsolidationPlanFile {
-    v: 1;
+    /** Plan schema version. `2` ⇔ the plan carries {@link freezeRefusedInputIds} — that member is a
+     *  LOAD-BEARING settle input (C-2④ keeps the named ids out of the completion fingerprint), and
+     *  a reader that predates it would accept the file as v1, ignore the member, and settle a
+     *  fingerprint that stamps the refused members (silently blinding the incremental face — the
+     *  exact hole the field closes). Version-gating the member makes such a reader answer its
+     *  "unrecognized version" corrupt arm instead: the plan parks loudly for the valve, never
+     *  settles wrong (mixed-fleet crash window between the durable plan write and gate settlement).
+     *  Plans without the member stay v1 — zero noise on the common path. */
+    v: 1 | 2;
     planId: string;
     scope: string;
     requestId: string;
@@ -318,6 +383,13 @@ export interface ConsolidationPlanFile {
     /** Frozen products — FULL entry bytes (id/frontmatter incl. distilled + origin/body/rev). */
     products: MemoryEntry[];
     productStates: Record<string, "pending" | "applied" | "conflict">;
+    /** design/376 C-2④ — the declared input ids of every product the FREEZE refused (scan findings
+     *  and eligibility drift alike). Settlement keeps these ids OUT of the completion fingerprint:
+     *  a scan-refused input's rev never moved, so stamping it would make every later incremental
+     *  snapshot read it as unchanged and never offer it again — the refused member must stay a
+     *  candidate. Absent on plans frozen before the field existed, and on plans with nothing
+     *  refused (either way the settle filter simply has nothing extra to exclude). */
+    freezeRefusedInputIds?: string[];
     directed: ConsolidationDirectedPatch[];
     intents: Array<{
         requestId: string;

package/dist/core/memory-engine/consolidation.js

@@ -40,6 +40,8 @@ export const CONSOLIDATION_DEFAULTS = {
     maxDirectedPatchesPerPlan: 32,
     minRunIntervalMs: 24 * 60 * 60 * 1000,
     minSessionsBetweenRuns: 5,
+    scanRefusalRatioCap: 0.25,
+    scanRefusalMaxPerPlan: 8,
 };
 export const CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS = 60_000;
 export const CONSOLIDATION_SESSION_RING_MAX = 64;
@@ -70,12 +72,18 @@ export function screenConsolidationOptions(raw, provenance) {
         maxDirectedPatchesPerPlan: num("maxDirectedPatchesPerPlan", raw.maxDirectedPatchesPerPlan, (n) => Number.isInteger(n) && n >= 1, "a positive integer"),
         minRunIntervalMs: num("minRunIntervalMs", raw.minRunIntervalMs, (n) => n > 0, "a positive number of milliseconds"),
         minSessionsBetweenRuns: num("minSessionsBetweenRuns", raw.minSessionsBetweenRuns, (n) => Number.isInteger(n) && n >= 0, "a non-negative integer"),
+        scanRefusalRatioCap: num("scanRefusalRatioCap", raw.scanRefusalRatioCap, (n) => n > 0 && n <= 1, "a number in (0, 1]"),
+        scanRefusalMaxPerPlan: num("scanRefusalMaxPerPlan", raw.scanRefusalMaxPerPlan, (n) => Number.isInteger(n) && n >= 1, "a positive integer"),
+        allowInstructionProducts: raw.allowInstructionProducts === true,
         multiNode: raw.multiNode === true,
         ...(raw.lease !== undefined ? { lease: raw.lease } : {}),
     };
     if (raw.multiNode !== undefined && raw.multiNode !== true) {
         throw coded(`MemoryEngineOptions.consolidation.multiNode must be exactly true when present (a posture declaration, not a boolean knob).`, "config.memory_consolidation");
     }
+    if (raw.allowInstructionProducts !== undefined && raw.allowInstructionProducts !== true) {
+        throw coded(`MemoryEngineOptions.consolidation.allowInstructionProducts must be exactly true when present (a posture declaration, not a boolean knob — absent means the instruction-form gate stays closed).`, "config.memory_consolidation");
+    }
     if (screened.multiNode && screened.lease === undefined) {
         throw coded(`MemoryEngineOptions.consolidation.multiNode declared without a lease seat — a multi-node deployment MUST inject the host's global lease (the local plan-seat CAS does not reach across nodes). Inject consolidation.lease or remove the multiNode declaration.`, "config.memory_consolidation_lease_required");
     }
@@ -89,6 +97,11 @@ export function supersessionFuseCeiling(activeSetSize, opts) {
         return 0;
     return Math.min(activeSetSize - 1, Math.max(opts.supersedeAbsoluteFloor, Math.floor(opts.supersedeRatioCap * activeSetSize)));
 }
+export function scanRefusalCeiling(submittedProducts, opts) {
+    if (submittedProducts <= 0)
+        return 0;
+    return Math.min(Math.max(1, Math.floor(opts.scanRefusalRatioCap * submittedProducts)), opts.scanRefusalMaxPerPlan);
+}
 export function consolidationTypeEligible(type) {
     return type !== "episodic" && type !== "procedural";
 }
@@ -186,7 +199,7 @@ function planShapeInvalid(raw, planId) {
     if (typeof raw !== "object" || raw === null)
         return "not an object";
     const p = raw;
-    if (p["v"] !== 1)
+    if (p["v"] !== 1 && p["v"] !== 2)
         return "unrecognized version";
     if (p["planId"] !== planId)
         return "planId mismatch";
@@ -248,6 +261,13 @@ function planShapeInvalid(raw, planId) {
     }
     if (!p["directed"].every((d) => intentIds.has(d.intentRequestId)))
         return "directed patch references an undeclared intent";
+    const freezeRefused = p["freezeRefusedInputIds"];
+    if (freezeRefused !== undefined && (!Array.isArray(freezeRefused) || !freezeRefused.every((x) => typeof x === "string"))) {
+        return "malformed freezeRefusedInputIds";
+    }
+    if ((p["v"] === 2) !== (freezeRefused !== undefined)) {
+        return p["v"] === 2 ? "v2 plan without its freezeRefusedInputIds member" : "freezeRefusedInputIds on a v1 plan";
+    }
     if (!Array.isArray(p["audit"]))
         return "malformed audit trail";
     return undefined;

package/dist/core/memory-engine/content-origin.d.ts

@@ -22,13 +22,22 @@
  * does not, the default is EXTERNAL (fail-closed: unknown = external), overridable only through the
  * explicit `TaskSpec.memory.trustedTools` allowlist. A core-mounted built-in without a declaration
  * defaults local: core owns those definitions, and the fail-closed default exists for tools core
- * CANNOT vouch for, not for its own.
+ * CANNOT vouch for, not for its own. A declaration is honored only when it SPELLS a member of the
+ * closed vocabulary — an unreadable one is not a declaration.
+ *
+ * The three tier names are BOUNDARY-RELATIVE, not statements about topology: `"local"` means "does
+ * not bring content from outside the deployment's trust boundary", which a unix socket to another
+ * process the deployment itself runs satisfies and a loopback HTTP call to somebody else's service
+ * does not. Distance is not the axis; whose content it is, is.
  *
  * There is deliberately no "gate inactive" state: every mounted tool gets a class.
  */
 import type { ToolContentOrigin } from "../types.js";
 export interface ClassifyToolContentOriginInput {
-    /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present. */
+    /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present AND
+     *  a member of the closed vocabulary ({@link isToolContentOrigin}); a present non-member is the
+     *  unreadable-declaration case and classifies EXTERNAL. The annotation is intent, not a guarantee:
+     *  the property rides tool objects untyped. */
     declared?: ToolContentOrigin;
     /** True ⇔ the name belongs to a protocol namespace (mcp__/a2a__ …) — an external channel. */
     isProtocolTool: boolean;
@@ -37,6 +46,10 @@ export interface ClassifyToolContentOriginInput {
     /** True ⇔ `TaskSpec.memory.trustedTools` names this tool (explicit host exemption). */
     trusted: boolean;
 }
+/** The vocabulary in wire/message order — the one spelling list a refusal quotes back. */
+export declare const TOOL_CONTENT_ORIGINS: readonly ToolContentOrigin[];
+/** Runtime membership in the closed vocabulary. */
+export declare function isToolContentOrigin(value: unknown): value is ToolContentOrigin;
 export declare function classifyToolContentOrigin(input: ClassifyToolContentOriginInput): ToolContentOrigin;
 /**
  * Declare `origin` on a tool object built OUTSIDE `defineTool` — a raw AgentTool literal, which is
@@ -60,6 +73,15 @@ export interface AgentToolFace {
 export interface AgentPoolTool {
     name: string;
     aliases?: readonly string[];
+    /** The pool row's own declaration — a STATIC surface the deployment writes when it composes the
+     *  delegation tool, and the only class information this judgment has about the child's roster.
+     *
+     *  A per-entry MCP declaration (design/378, `McpServerSpec.contentOrigin`) does NOT reach here: the
+     *  pool is a declaration, not a live roster, and this judgment never sees the server entries. A
+     *  deployment that hands a declared server's `mcp__` tools to children MIRRORS the value onto the
+     *  matching pool rows; not mirroring it leaves them on the protocol arm, so the delegation reads
+     *  external and the parent over-marks — the safe direction, and the reason this is a documented
+     *  duty rather than a refusal. */
     contentOrigin?: ToolContentOrigin;
 }
 /**

package/dist/core/memory-engine/content-origin.js

@@ -1,6 +1,11 @@
+const TOOL_CONTENT_ORIGIN_SET = { external: true, execution: true, local: true };
+export const TOOL_CONTENT_ORIGINS = Object.keys(TOOL_CONTENT_ORIGIN_SET);
+export function isToolContentOrigin(value) {
+    return typeof value === "string" && Object.prototype.hasOwnProperty.call(TOOL_CONTENT_ORIGIN_SET, value);
+}
 export function classifyToolContentOrigin(input) {
     if (input.declared !== undefined)
-        return input.declared;
+        return isToolContentOrigin(input.declared) ? input.declared : "external";
     if (input.trusted)
         return "local";
     if (input.isProtocolTool)

package/dist/core/memory-engine/engine.d.ts

@@ -1,11 +1,11 @@
 import type { EngineNotice } from "../types.js";
-import { type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
+import { type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
 import { foreignDanglingSessionAccounts, type EffectiveSettlement, type HoldRow } from "./delegation-settlement.js";
 import { type OriginClearanceRow } from "./origin-clearance.js";
 import { type CommittedBinding, type EraseMemoryEntriesInput, type MemoryErasureAttestation, type TransferEvidence } from "./file-backend.js";
 import { type MemoryExportBundle, type MemoryImportReport } from "./export-bundle.js";
 import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionMarkOutcome, type SessionPollutionRecord } from "./layout.js";
-import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemoryEntry, MemoryEntryOrigin, MemorySessionHandle, ScanFinding } from "./types.js";
+import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemoryEntry, MemoryEntryOrigin, MemoryScopeEnumeration, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
  * (bench/cc-parity-toolsuite/reminders/live-capture-main-session-2026-07-08.md §12), with the
@@ -514,6 +514,36 @@ export interface ConsolidationPlanSummary {
     directed?: number;
     intents?: number;
 }
+/**
+ * design/376 slice ③ (#436) — one plan's MEMBER-LEVEL fold evidence
+ * ({@link MemoryEngine.readConsolidationPlanFoldEvidence}'s answer): which entry ids this plan's
+ * APPLIED products attest as superseded. Discriminated so an unreadable plan can never be told
+ * apart from an empty one by accident.
+ */
+export type ConsolidationPlanFoldEvidence = {
+    state: "ok";
+    scope: string;
+    /** The commit call's requestId, frozen on the plan — the durable run-attribution anchor
+     *  (the driver's per-cycle requestIds share the run's prefix, so a cycle whose receipt was
+     *  lost to a crash is still attributable to its run through the plan file). */
+    requestId: string;
+    planState: ConsolidationPlanFile["state"];
+    /** Every supersession-edge target of an APPLIED product, deduplicated and sorted. Products
+     *  still pending/conflicted attest nothing — the store never saw their edges land. */
+    supersededTargets: string[];
+} | {
+    state: "absent";
+} | {
+    state: "corrupt";
+    detail: string;
+    /** Present when the plan FILE parsed and only its product frontmatter is damaged (the deep
+     *  per-product walk's corrupt arm): the frozen attribution anchors survive the damage, so a
+     *  caller can still attribute the damaged plan to a run — the conservation wall uses this
+     *  to fail closed ONLY on a run-owned damaged plan while a foreign/historical one is
+     *  skipped with disclosure. Absent when the file itself is unreadable/unparseable. */
+    scope?: string;
+    requestId?: string;
+};
 /** §2.2 — the recommendation notice, minted off the harvest report's advisory member (the runner's
  *  hold-notice consumption point is its natural home). Undefined ⇔ this harvest crossed no edge. */
 export declare function memoryConsolidationRecommendedNotice(report: HarvestReport, sessionId?: string): EngineNotice | undefined;
@@ -956,10 +986,18 @@ export declare class MemoryEngine {
     }>;
     /**
      * §1.2-2/§1.2-3 — verb ②: mechanical acceptance + plan FREEZE + apply-to-terminal. Structural
-     * violations (scan findings, out-of-snapshot attribution, caps, the instruction hard gate, the
-     * supersession fuse) refuse the WHOLE plan — zero partial freeze; per-product eligibility drift
-     * (an input's rev moved / an input got challenged between snapshot and freeze) refuses THAT
-     * product with a disclosed reason while the rest freeze (§1.2-2 冻结时资格复验).
+     * violations (out-of-snapshot attribution, caps, the instruction hard gate, the supersession
+     * fuse, an empty plan) refuse the WHOLE plan — zero partial freeze. Per-product refusals, each
+     * disclosed on the receipt (`products.refused`): eligibility drift (an input's rev moved / an
+     * input got challenged between snapshot and freeze, §1.2-2 冻结时资格复验) AND scan findings
+     * (design/376 C-2① — the explicit revision of 339 §1.2-2's whole-plan clause: one product's
+     * refused bytes must not permanently deny service to every other fold in the plan). The scan
+     * seat keeps two whole-plan backstops: the scan-refusal fuse (C-2②, {@link scanRefusalCeiling})
+     * refuses a plan saturated with scan-refused products, and a plan the freeze emptied entirely
+     * refuses rather than settling as a vacuous completed run (C-2③ — completion writes `lastRunAt`
+     * and stamps the full eligible set into the fingerprint, blinding every later incremental
+     * snapshot). Intent (directed) scan findings stay whole-plan: intents are host-authored, not
+     * driver products.
      */
     commitConsolidationPlan(cycleToken: string, proposal: ConsolidationProposal, opts: {
         requestId: string;
@@ -1009,7 +1047,12 @@ export declare class MemoryEngine {
      * ABANDONED explicitly (audited; never a silent drop — unfulfilled and given-up stay two
      * distinguishable account facts, G24) and the seat releases; `retry` = the plan's unfulfilled
      * intents re-judge NOW into a NEW plan (fresh freeze, fresh baseRevs — the ONE authorized
-     * re-judgment point) which applies immediately. Both audited by requestId.
+     * re-judgment point) which applies immediately. A retry with NOTHING to re-judge (a
+     * products-only conflict plan, or every unfulfilled intent already credentialed) refuses
+     * instead of settling a vacuous completed run — C-2③'s empty-plan law at this corridor's door
+     * (the completion would burn the time gate and stamp the original cycle's eligible map into
+     * the fingerprint); `discard` is the exit that releases the seat without wearing the
+     * completed-run label. Both audited by requestId.
      */
     resolveConsolidationPlan(planId: string, action: "discard" | "retry", opts: {
         requestId: string;
@@ -1025,9 +1068,44 @@ export declare class MemoryEngine {
     private reconstructIntentsForRetry;
     /** §6.2 — host read face: every plan's summary (audit enumeration, zero model surface). */
     listConsolidationPlans(): ConsolidationPlanSummary[];
+    /**
+     * design/376 slice ③ (#436) — host read face: one plan's MEMBER-LEVEL fold evidence (which ids
+     * its APPLIED products supersede). This is the conservation wall's terminal witness: the
+     * driver's other two witnesses (per-cycle row delta, since-open store delta) are both
+     * store-COUNT readings, and an unrelated fold interleaved into the run's scope can numerically
+     * offset a planned member that was deleted mid-run — masking the shortfall behind a balanced
+     * count. Member identity cannot be offset: a planned member either appears among some
+     * run-attributed plan's applied supersession targets, sits in named residue, or the run must
+     * not wear the converged label. Committed plan-file read, side-effect-free; the answer carries
+     * the plan's frozen `requestId` so a caller can attribute plans to a run even across the
+     * commit→receipt crash window (the plan file is durable before any receipt is).
+     *
+     * SCOPE of the attestation, disclosed (an outside review probed it; recorded as the designed
+     * limit rather than patched): this is the committed HISTORICAL fact "this plan's edge landed" —
+     * it does not re-derive whether the edge still stands NOW. A target edit or a carrier challenge
+     * later SUSPENDS the edge (`deriveSupersededSet`'s revival law), and a competing writer may
+     * re-fold the revived member before the run's next snapshot; the attestation still exempts it
+     * and the run keeps its converged label. That label stays materially true in every reachable
+     * arm: the member's content is preserved in THIS run's committed carrier either way, the store
+     * is at a fixpoint (re-covered by a standing edge, or explicitly tombstoned), and the next full
+     * mint re-judges the live world. A LIVE-standing re-derivation here would instead false-red the
+     * honestly converged re-covered case, and the ruled evidence form is the per-plan applied edge.
+     */
+    readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     /** §6.2 — host read face: one scope's gate row (undefined when the store has no row — reading
-     *  never creates the file, so the OFF deployment stays byte-identical, G1). */
+     *  never creates the file, so the OFF deployment stays byte-identical, G1). A corrupt store
+     *  ALSO answers undefined here — this face cannot distinguish the two; a consumer that needs
+     *  the difference reads {@link readConsolidationGateState} (#437②). */
     readConsolidationGate(scope: string): ConsolidationGateRow | undefined;
+    /**
+     * design/376 slice ③ (#437②) — host read face: one scope's gate row as a DISCRIMINATED answer.
+     * The undiscriminated face above folds a corrupt store into `undefined`, so a healthy never-run
+     * scope and a store every verb will refuse fail-closed were indistinguishable to an operator or
+     * a scheduling read. `present` carries the row; `absent` = readable store, no row (reading never
+     * creates the file — the OFF deployment stays byte-identical, G1); `corrupt` carries the
+     * refusal detail. Additive; the undiscriminated face is unchanged.
+     */
+    readConsolidationGateState(scope: string): ConsolidationGateRead;
     /**
      * design/376 片② — host read face: one scope's committed FOLD STATE, in the freeze's own
      * accounting (`active` counts entries neither superseded nor excluded — byte-for-byte the
@@ -1050,6 +1128,17 @@ export declare class MemoryEngine {
      * (design/376 §1.6-4); path knowledge is not authority — nothing here bypasses a verb.
      */
     get controlPlaneRoot(): string;
+    /**
+     * design/376 slice ③ (#437③) — host read face: the store's scope enumeration, capability-probed
+     * on the backend (`listScopes`, the audit-face probe family). A backend WITHOUT the face
+     * answers `supported: false` — never an empty array: "cannot enumerate" and "hosts no scopes"
+     * must stay two different answers, or every audit sweep over a non-enumerating backend would
+     * silently claim a clean store. The File backend derives the answer from the store root's
+     * durable scope registry (store-level fact — never a session roster); the SQL twins gain the
+     * face through the store-contracts extension (separate ticket). A supporting backend's corrupt
+     * registry THROWS fail-closed — the same reason an unsupported one never reads as empty.
+     */
+    listMemoryScopes(): Promise<MemoryScopeEnumeration>;
     /** The committed, side-effect-free audit read: the adoption-restricted committed view when the
      *  backend offers one (zero-copy File — ledger+shadow, no disk adoption), else the non-adopting
      *  retrieval view (copy-out File), else the backend itself (Pg/TiDB shapes — naturally committed