@sema-agent/core 5.58.0 → 5.60.0

package/dist/core/memory-engine/engine.js

@@ -9,7 +9,7 @@ import { formatMemoryAge } from "../memory-recall.js";
 import { committedDistilledOf, committedOriginOf, computeEntryRev, distilledEquals, hasDistilledFormExtra, hasOriginFormExtra, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenDistilled, stripModelWrittenOrigin } from "./frontmatter.js";
 import { MEMORY_PROVENANCE_RECALL_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow } from "./provenance-wording.js";
 import { isInstructionEntry } from "./header-hints.js";
-import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSOLIDATION_SEAT_FREEZE_GRACE_MS, consolidationTypeEligible, deriveProductSlug, deriveSupersededSet, isValidConsolidationPlanId, listConsolidationPlanIds, productAddPatch, quarantineCorruptPlan, readConsolidationGateFile, readConsolidationPlan, readIntentCredentials, recordActiveSetBaseline, recordConsolidationSession, recordIntentCredentials, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, writeConsolidationPlan, } from "./consolidation.js";
+import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSOLIDATION_SEAT_FREEZE_GRACE_MS, consolidationTypeEligible, deriveProductSlug, deriveSupersededSet, isValidConsolidationPlanId, listConsolidationPlanIds, productAddPatch, quarantineCorruptPlan, readConsolidationGateFile, readConsolidationPlan, readIntentCredentials, recordActiveSetBaseline, recordConsolidationSession, recordIntentCredentials, scanRefusalCeiling, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, writeConsolidationPlan, } from "./consolidation.js";
 import { classifySessionSettlements, clearHoldResolution, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, } from "./delegation-settlement.js";
 import { noReplaceRestore } from "./delegation-settlement.js";
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
@@ -2656,6 +2656,9 @@ export class MemoryEngine {
             else if (p.inputs.length > screened.maxInputsPerProduct)
                 reasons.push(`product #${i}: ${p.inputs.length} inputs > maxInputsPerProduct ${screened.maxInputsPerProduct}`);
         }
+        if (proposal.products.length === 0 && intents.length === 0) {
+            reasons.push("empty plan: zero products and zero directed intents — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)");
+        }
         if (reasons.length > 0)
             throw new ConsolidationRefusedError("memory.consolidation_refused", "memory consolidation plan refused (structural)", reasons);
         const planId = uuidv7();
@@ -2737,21 +2740,7 @@ export class MemoryEngine {
             }
         }
         const activeSetSize = headers.filter((h) => !superseded.has(h.id) && !exclusions.has(h.id)).length;
-        const edgeTargets = new Set();
-        for (const p of proposal.products)
-            for (const i2 of p.inputs)
-                if (i2.supersede === true)
-                    edgeTargets.add(i2.id);
         const ceiling = supersessionFuseCeiling(activeSetSize, screened);
-        if (edgeTargets.size > ceiling) {
-            wholeReasons.push(`supersession fuse: ${edgeTargets.size} distinct targets > ceiling ${ceiling} (active set ${activeSetSize}, ratio ${screened.supersedeRatioCap}, floor ${screened.supersedeAbsoluteFloor}, N-1 unconditional)`);
-            try {
-                enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation plan for scope ${inlineUntrusted(scope, 80)} REFUSED by the supersession fuse (${edgeTargets.size} targets over the ${ceiling} ceiling)`] });
-            }
-            catch (err) {
-                this.discloseAnnounceFailure("consolidation fuse enqueue", err);
-            }
-        }
         let visibleMarked = snapshot.marked;
         if (!visibleMarked) {
             const inputIds = [...new Set(proposal.products.flatMap((p) => p.inputs.map((i2) => i2.id)))];
@@ -2761,12 +2750,18 @@ export class MemoryEngine {
         const foldedOrigin = visibleMarked ? { taint: "external", cause: "derived", at } : undefined;
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
-            if (visibleMarked && isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) })) {
-                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26)`);
+            if (!isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) }))
+                continue;
+            if (visibleMarked) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26; no option opens this arm)`);
+            }
+            else if (!screened.allowInstructionProducts) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — instruction-form consolidation products are refused unconditionally by default (a consolidation must not mint privileged entries out of ordinary notes); the host escape hatch is consolidation.allowInstructionProducts: true`);
             }
         }
         const assembled = [];
         const refusedProducts = [];
+        const scanRefused = [];
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
             const drift = [];
@@ -2813,11 +2808,31 @@ export class MemoryEngine {
             const nameFinding = scanMemoryFileName(`${slug}.md`);
             const findings = [...(nameFinding !== undefined ? [nameFinding] : []), ...scanMemoryWrite(serializeEntryFile(entry), { maxBytes: this.perFileBytes })];
             if (findings.length > 0) {
-                wholeReasons.push(`product #${i}: scan gate (${findings.map((f) => `${f.code}: ${f.reason}`).join("; ")})`);
+                const reason = `scan gate (${findings.map((f) => `${f.code}: ${f.reason}`).join("; ")})`;
+                refusedProducts.push({ index: i, reason });
+                scanRefused.push({ index: i, reason });
                 continue;
             }
             assembled.push(entry);
         }
+        const edgeTargets = new Set();
+        for (const e of assembled)
+            for (const i2 of e.frontmatter.distilled?.inputs ?? [])
+                if (i2.superseded === true)
+                    edgeTargets.add(i2.id);
+        if (edgeTargets.size > ceiling) {
+            wholeReasons.push(`supersession fuse: ${edgeTargets.size} distinct targets > ceiling ${ceiling} (active set ${activeSetSize}, ratio ${screened.supersedeRatioCap}, floor ${screened.supersedeAbsoluteFloor}, N-1 unconditional)`);
+            try {
+                enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at, items: [`memory consolidation plan for scope ${inlineUntrusted(scope, 80)} REFUSED by the supersession fuse (${edgeTargets.size} targets over the ${ceiling} ceiling)`] });
+            }
+            catch (err) {
+                this.discloseAnnounceFailure("consolidation fuse enqueue", err);
+            }
+        }
+        const scanCeiling = scanRefusalCeiling(proposal.products.length, screened);
+        if (scanRefused.length > scanCeiling) {
+            wholeReasons.push(`scan-refusal fuse: ${scanRefused.length} of ${proposal.products.length} product(s) failed the write scan > ceiling ${scanCeiling} (ratio ${screened.scanRefusalRatioCap}, per-plan max ${screened.scanRefusalMaxPerPlan}) — ${scanRefused.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}`);
+        }
         const directed = [];
         const intents = proposal.intents ?? [];
         const targetIds = intents.map((it) => it.entryId);
@@ -2875,6 +2890,9 @@ export class MemoryEngine {
                 directed.push({ intentRequestId: intent.requestId, op: "update", id: intent.entryId, baseRev: committed.rev, plannedPostRev: terminal.rev, entry: terminal, state: "pending" });
             }
         }
+        if (wholeReasons.length === 0 && assembled.length === 0 && directed.length === 0) {
+            wholeReasons.push(`empty plan after freeze: every product was refused (${refusedProducts.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}) — a plan with nothing left to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)`);
+        }
         if (wholeReasons.length > 0)
             throw new ConsolidationRefusedError("memory.consolidation_refused", "memory consolidation plan refused", wholeReasons);
         try {
@@ -2888,8 +2906,9 @@ export class MemoryEngine {
                 throw err;
             throw new ConsolidationRefusedError("memory.consolidation_gate_corrupt", `memory consolidation refused: the gate store could not be re-read at the freeze boundary (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
         }
+        const freezeRefusedInputIds = [...new Set(refusedProducts.flatMap((r) => (proposal.products[r.index]?.inputs ?? []).map((i2) => i2.id)))].sort();
         const plan = {
-            v: 1,
+            v: freezeRefusedInputIds.length > 0 ? 2 : 1,
             planId,
             scope,
             requestId: input.requestId,
@@ -2900,6 +2919,7 @@ export class MemoryEngine {
             ...(foldedOrigin !== undefined ? { foldedOrigin } : {}),
             products: assembled,
             productStates: Object.fromEntries(assembled.map((e) => [e.id, "pending"])),
+            ...(freezeRefusedInputIds.length > 0 ? { freezeRefusedInputIds } : {}),
             directed,
             intents: intents.map((it) => ({ requestId: it.requestId, state: "pending" })),
             state: "open",
@@ -3099,6 +3119,7 @@ export class MemoryEngine {
         }
         writeConsolidationPlan(this.controlDir, plan);
         const currentlyEligible = await this.settleFingerprintFilter(plan.scope);
+        const freezeRefused = new Set(plan.freezeRefusedInputIds ?? []);
         updateConsolidationGate(this.controlDir, (file) => {
             const row = file.scopes[plan.scope];
             if (row?.openPlanId !== plan.planId)
@@ -3111,6 +3132,8 @@ export class MemoryEngine {
                 if (currentlyEligible !== undefined) {
                     const fp = {};
                     for (const [id, rev] of Object.entries(row.snapshot.eligible)) {
+                        if (freezeRefused.has(id))
+                            continue;
                         if (!currentlyEligible(id, rev))
                             continue;
                         fp[id] = { rev };
@@ -3234,6 +3257,7 @@ export class MemoryEngine {
     }
     async settleGateForTerminalPlan(plan) {
         const currentlyEligible = await this.settleFingerprintFilter(plan.scope);
+        const freezeRefused = new Set(plan.freezeRefusedInputIds ?? []);
         updateConsolidationGate(this.controlDir, (file) => {
             const row = file.scopes[plan.scope];
             if (row?.openPlanId !== plan.planId)
@@ -3247,6 +3271,8 @@ export class MemoryEngine {
                     if (currentlyEligible !== undefined) {
                         const fp = {};
                         for (const [id, rev] of Object.entries(row.snapshot.eligible)) {
+                            if (freezeRefused.has(id))
+                                continue;
                             if (!currentlyEligible(id, rev))
                                 continue;
                             fp[id] = { rev };
@@ -3348,6 +3374,24 @@ export class MemoryEngine {
             throw new ConsolidationRefusedError("memory.consolidation_gate_corrupt", `memory consolidation retry refused: the intent-credential account cannot be trusted (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
         }
         const pendingIntents = plan.intents.filter((i) => i.state === "pending" && standingCredentials[i.requestId] === undefined).map((i) => i.requestId);
+        if (pendingIntents.length === 0) {
+            throw new ConsolidationRefusedError("memory.consolidation_refused", `memory consolidation retry refused: plan ${planId} has nothing to re-judge — ` +
+                (plan.intents.length === 0
+                    ? "it carries no intents (a conflicted product never rides a retry)"
+                    : "every unfulfilled intent already carries a credential (consumed by an earlier retry or a racing plan)") +
+                ` — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face); resolve with "discard" to release the seat.`);
+        }
+        const conflictProductInputIds = [];
+        for (const p of plan.products) {
+            if (plan.productStates[p.id] !== "conflict")
+                continue;
+            const inputs = p.frontmatter?.distilled?.inputs;
+            if (!Array.isArray(inputs) || inputs.some((i) => typeof i?.["id"] !== "string")) {
+                throw new ConsolidationRefusedError("memory.consolidation_refused", `memory consolidation retry refused: conflicted product ${p.id} carries no readable distilled attribution rows (every frozen product is minted with them — this is control-plane damage); the plan stays parked, resolve with "discard" (the bytes remain on the plan file for host review).`);
+            }
+            for (const i of inputs)
+                conflictProductInputIds.push(i.id);
+        }
         const face = this.committedAuditFace();
         const originalIntents = await this.reconstructIntentsForRetry(plan, pendingIntents, face);
         const retryPlanId = uuidv7();
@@ -3361,8 +3405,9 @@ export class MemoryEngine {
             file.scopes[plan.scope] = row;
             return { next: file, result: undefined };
         });
+        const inheritedRefusals = [...new Set([...(plan.freezeRefusedInputIds ?? []), ...conflictProductInputIds])].sort();
         const retryPlan = {
-            v: 1,
+            v: inheritedRefusals.length > 0 ? 2 : 1,
             planId: retryPlanId,
             scope: plan.scope,
             requestId: opts.requestId,
@@ -3371,6 +3416,7 @@ export class MemoryEngine {
             visibleMarked: false,
             products: [],
             productStates: {},
+            ...(inheritedRefusals.length > 0 ? { freezeRefusedInputIds: inheritedRefusals } : {}),
             directed: originalIntents.directed,
             intents: pendingIntents.map((r) => ({ requestId: r, state: "pending" })),
             state: "open",
@@ -3450,6 +3496,35 @@ export class MemoryEngine {
         }
         return out;
     }
+    readConsolidationPlanFoldEvidence(planId) {
+        const read = readConsolidationPlan(this.controlDir, planId);
+        if (read.state === "absent")
+            return { state: "absent" };
+        if (read.state === "corrupt")
+            return { state: "corrupt", detail: read.detail };
+        const p = read.plan;
+        const targets = new Set();
+        for (const prod of p.products) {
+            if (p.productStates[prod.id] !== "applied")
+                continue;
+            const inputs = prod.frontmatter?.distilled?.inputs;
+            const anchors = { scope: p.scope, requestId: p.requestId };
+            if (inputs === undefined)
+                return { state: "corrupt", detail: `applied product ${prod.id} carries no distilled.inputs (every frozen product is minted with its attribution rows)`, ...anchors };
+            if (!Array.isArray(inputs))
+                return { state: "corrupt", detail: `applied product ${prod.id} carries a non-array distilled.inputs`, ...anchors };
+            for (const i of inputs) {
+                if (typeof i !== "object" || i === null)
+                    return { state: "corrupt", detail: `applied product ${prod.id} carries a malformed distilled input row`, ...anchors };
+                if (i.superseded !== true)
+                    continue;
+                if (typeof i.id !== "string")
+                    return { state: "corrupt", detail: `applied product ${prod.id} carries a supersession edge without a string target id`, ...anchors };
+                targets.add(i.id);
+            }
+        }
+        return { state: "ok", scope: p.scope, requestId: p.requestId, planState: p.state, supersededTargets: [...targets].sort() };
+    }
     readConsolidationGate(scope) {
         try {
             return readConsolidationGateFile(this.controlDir).scopes[scope];
@@ -3458,6 +3533,16 @@ export class MemoryEngine {
             return undefined;
         }
     }
+    readConsolidationGateState(scope) {
+        let row;
+        try {
+            row = readConsolidationGateFile(this.controlDir).scopes[scope];
+        }
+        catch (err) {
+            return { state: "corrupt", detail: err instanceof Error ? err.message : String(err) };
+        }
+        return row !== undefined ? { state: "present", row } : { state: "absent" };
+    }
     async readConsolidationFoldState(scope) {
         const face = this.committedAuditFace();
         const headers = await face.listHeaders([scope]);
@@ -3478,6 +3563,13 @@ export class MemoryEngine {
     get controlPlaneRoot() {
         return this.controlDir;
     }
+    async listMemoryScopes() {
+        const b = this.backend;
+        if (typeof b.listScopes !== "function") {
+            return { supported: false, reason: "the backend does not implement scope enumeration (listScopes) — an absent capability must never read as an empty scope list" };
+        }
+        return await b.listScopes();
+    }
     committedAuditFace() {
         const b = this.backend;
         return b.restrictedAdoptionView?.({ audit: false }) ?? b.retrievalView?.() ?? this.backend;

package/dist/core/memory-engine/file-backend.d.ts

@@ -1,6 +1,6 @@
 import { scopeDirName, type ChallengeEvent, type MemoryPartitionIncidentSink } from "./layout.js";
 import type { MemoryBundleImportPlan, MemoryImportReport } from "./export-bundle.js";
-import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
+import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, MemoryScopeEnumeration, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
 /** Files/dirs the entry scan never treats as entries: the derived index, dotfiles (`.hydrate`,
  *  transaction staging files), and anything not `.md`. */
 export declare const MEMORY_INDEX_FILENAME = "MEMORY.md";
@@ -756,6 +756,18 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      * while a live holder exists ({@link txnInFlight}), which now covers adoption holds too.
      */
     private readScopeAdopting;
+    /**
+     * design/376 slice ③ (#437③) — the File leg's scope-enumeration capability face: every scope
+     * this store has hosted, derived from the store root's durable scope registry (the control
+     * plane's `scopes.json` — the one source that can invert a scope's sanitized directory label
+     * back to its name; a listing of raw subdirectories could not). Side-effect-free committed
+     * read; a corrupt/unreadable registry THROWS its fail-closed refusal — enumeration over an
+     * untrustworthy registry must never answer an empty (= clean-looking) list. Honest residual,
+     * disclosed: the registry records scopes as they are first touched THROUGH this control plane,
+     * so a hand-assembled tree's never-touched scope dirs appear here only once a caller first
+     * names them — store-level fact, session-roster-free either way.
+     */
+    listScopes(): MemoryScopeEnumeration;
     listHeaders(scopes: readonly string[]): Promise<MemoryEntryHeader[]>;
     private listHeadersFrom;
     getByIds(ids: readonly string[]): Promise<MemoryEntry[]>;

package/dist/core/memory-engine/file-backend.js

@@ -1780,6 +1780,9 @@ export class FileMemoryEngineBackend {
             lock.release();
         }
     }
+    listScopes() {
+        return { supported: true, scopes: Object.keys(registeredScopes(this.controlPlaneRoot)).sort() };
+    }
     async listHeaders(scopes) {
         return this.listHeadersFrom(scopes, (s) => this.readScopeAdopting(s));
     }

package/dist/core/memory-engine/index.d.ts

@@ -1,4 +1,4 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, } from "./engine.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, type MemoryGetDetails, } from "./tools.js";
 export { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_RECALL_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow, } from "./provenance-wording.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
@@ -8,11 +8,12 @@ export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlane
 export { readV2HeaderHints, isInstructionEntry, type V2HeaderHints } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation, type ParsedEntryFile } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
-export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
+export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
 export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type RunMemoryConsolidationOptions, } from "./consolidation-driver.js";
+export type { OriginClearanceRow, OriginClearanceEvent } from "./origin-clearance.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
-export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
+export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryScopeEnumeration, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, } from "./memory-backend-contract.js";
 export { SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, } from "./scope-contract.js";
 export { migrateScope, type MigrateScopeReport } from "./migrate.js";

package/dist/core/memory-engine/layout.js

@@ -303,21 +303,35 @@ export function dirCaseFolds(dir) {
 }
 function readScopesRecord(controlDir) {
     const path = join(controlDir, SCOPES_FILE);
+    const journalPath = `${path}.journal`;
     let raw;
+    let sourcePath = journalPath;
     try {
-        raw = readFileSync(path, "utf8");
+        raw = readFileSync(journalPath, "utf8");
     }
     catch (err) {
-        if (err.code === "ENOENT")
-            return {};
-        throw new ControlPlaneCorruptError(`scope registry unreadable (${err.code ?? "io error"}): ${path}`, { cause: err });
+        if (err.code !== "ENOENT") {
+            throw new ControlPlaneCorruptError(`scope registry journal unreadable (${err.code ?? "io error"}) — a committed next state may exist that cannot be proven: ${journalPath}`, { cause: err });
+        }
+        raw = undefined;
+    }
+    if (raw === undefined) {
+        sourcePath = path;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return {};
+            throw new ControlPlaneCorruptError(`scope registry unreadable (${err.code ?? "io error"}): ${path}`, { cause: err });
+        }
     }
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new ControlPlaneCorruptError(`scope registry is unparseable: ${path}`);
+        throw new ControlPlaneCorruptError(`scope registry is unparseable: ${sourcePath}`);
     }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new ControlPlaneCorruptError(`scope registry has the wrong shape: ${path}`);
@@ -351,7 +365,7 @@ function lockedScopesUpdate(controlDir, fn) {
     const lock = `${file}.lock`;
     const token = acquireSidecarLock(lock, { onDeadline: "throw" });
     try {
-        rollForwardSidecar(file, journal);
+        rollForwardStrictSidecar(file, journal);
         const rec = readScopesRecord(controlDir);
         const { next, result } = fn(rec);
         if (next !== undefined) {

package/dist/core/memory-engine/types.d.ts

@@ -246,6 +246,23 @@ export interface NotePatch {
      *  Ignored on `update`/`delete`. */
     guard?: "absent";
 }
+/**
+ * design/376 slice ③ (#437③) — a backend's scope-enumeration answer, DISCRIMINATED on purpose:
+ * "this backend cannot enumerate" and "this store hosts no scopes" must never share a spelling
+ * (an unsupported backend read as `[]` would make every audit sweep over it silently claim a
+ * clean store). The capability itself is an OPTIONAL backend face (`listScopes`, probed like the
+ * File class's audit faces): a backend without it is answered `supported: false` by
+ * `MemoryEngine.listMemoryScopes`, never an empty array. The File leg derives from the store
+ * root's durable scope registry; the SQL twins' leg is a store-contracts extension (separate
+ * ticket) — until it lands they simply do not implement the face.
+ */
+export type MemoryScopeEnumeration = {
+    supported: true;
+    scopes: string[];
+} | {
+    supported: false;
+    reason: string;
+};
 /** Result of {@link MemoryBackend.applyPatches} — applied ops + per-id CAS conflicts (reported, not thrown). */
 export interface PatchReport {
     applied: Array<{

package/dist/core/memory.d.ts

@@ -477,6 +477,16 @@ export interface NormalizedMemorySpec {
      * of the fail-closed `"external"` default. The explicit-config channel for a deployment whose custom
      * tools predate the {@link import("./types.js").ToolSpec.contentOrigin} declaration; it never
      * overrides a tool's OWN declaration. Normalized: trimmed, deduped, empties dropped.
+     *
+     * NOT the channel for MCP servers (design/378). A per-name entry here keys on the MINTED name — the
+     * host has to predict the namespacing and charset normalization — covers nothing a mid-task refresh
+     * adds, and says "exempt this undeclared tool" where the fact is "this whole server is mine".
+     * {@link import("./types.js").McpServerSpec.contentOrigin} states that fact at the entry, and being
+     * a DECLARATION it wins over this allowlist in both directions: a declared server's tools leave this
+     * list's reach entirely, an explicit `"external"` declaration included (that is the one way a
+     * deployment can pin a server's tools BEYOND this exemption). This list is not retired — it remains
+     * the in-register channel for undeclared HOST tools and for a deployment not ready to touch its
+     * server entries.
      */
     trustedTools?: string[];
     /**

package/dist/core/park-selfcheck.js

@@ -70,6 +70,7 @@ function syntheticCheckpoint(scope) {
             toolName: "SelfCheck",
             args: { probe: true, nested: { depth: 2, list: [1, 2, 3] } },
             boundInputHash: boundInputHashOf({ probe: true, nested: { depth: 2, list: [1, 2, 3] } }),
+            hasBidiControls: true,
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
 import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
@@ -115,7 +115,7 @@ function approvalRecordDamageOf(rec) {
         const seen = new Set();
         for (const member of members) {
             if (!Number.isInteger(member) || member < 0 || rec.candidates[member] === undefined) {
-                return `offer ${at} references candidate ${member}, which the record does not carry`;
+                return `offer ${at} references candidate ${escapeForDisclosure(member)}, which the record does not carry`;
             }
             const cand = rec.candidates[member];
             if (typeof cand !== "object" || cand === null || typeof cand.rule !== "string") {
@@ -138,10 +138,14 @@ function approvalRecordDamageOf(rec) {
                 }
             }
             else if (offer.segments !== undefined || offer.uncoveredSegments !== undefined) {
-                return `${rec.kind} batch offer ${at} must not carry segment metadata — there is no compound command behind it`;
+                return `${escapeForDisclosure(rec.kind)} batch offer ${at} must not carry segment metadata — there is no compound command behind it`;
             }
         }
     }
+    for (const [at] of rec.candidates.entries()) {
+        if (!claimed.has(at))
+            return `candidate ${at} belongs to no offer — every candidate row is claimed by exactly one offer`;
+    }
     return undefined;
 }
 export function ruleOffersOfRecord(rec) {
@@ -325,7 +329,7 @@ function checkEditedRuleText(text, command) {
     if (!ruleAdmitsCommand(parsed.rule, command)) {
         return {
             ok: false,
-            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${command}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
+            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${escapeForDisclosure(command)}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
         };
     }
     return { ok: true, canonicalRule: parsed.rule.rule };
@@ -342,7 +346,7 @@ export function precheckEditedRuleText(text, command) {
         throw e;
     }
     if (hasUnrenderableCharacters(command)) {
-        const e = new Error("precheckEditedRuleText takes a command this lane can read — one carrying control or format characters is not a command any card was drawn for, and the refusal line naming it would carry those bytes onto a display surface");
+        const e = new Error("precheckEditedRuleText takes a command this lane can read — one carrying control or format characters is refused at this preflight face (likelier a caller wiring fault than a card's command; the in-engine confirmation arm still judges such a card, with the command escaped on its refusal line)");
         e.code = "config.invalid_argument";
         throw e;
     }

package/dist/core/permission-rule-model.d.ts

@@ -282,6 +282,40 @@ export declare const SUGGESTION_LEXICON: readonly string[];
  * through, so an ordinary rule text reads normally. The result is length-bounded.
  */
 export declare function escapeForDisclosure(value: unknown): string;
+/**
+ * Render raw, untrusted COMMAND text for a display surface — the minimal safe baseline for the seats
+ * that carry post-rewrite command bytes verbatim ({@link SegmentRuleSuggestion.segment} is the
+ * motivating one; a card's own `command`/`args` echo has the same hazard).
+ *
+ * WHAT IT DOES, and why the two character families are not handled the same way:
+ *  · `\p{Cf}` (the bidirectional controls U+061C/U+200E/U+200F/U+202A–U+202E/U+2066–U+2069 and the
+ *    zero-width formatters ZWSP/ZWNJ/ZWJ/WORD JOINER/SOFT HYPHEN/BOM) is REMOVED. These occupy no
+ *    width, so deleting them is what makes the rendered line agree with what a reader believes they
+ *    are reading — a `rm -rf x` that DISPLAYS as something benign is exactly the deception the seat
+ *    would otherwise hand on. This is the same family
+ *    {@link import("./tool-policy.js").AskRequest.hasBidiControls} raises its warning bit for; the
+ *    bit says "the raw bytes carry them", this function is what a surface renders instead.
+ *  · Controls and line/paragraph separators (C0 incl. TAB and NEWLINE, DEL, C1, U+2028/U+2029) are
+ *    FOLDED TO A SPACE with runs collapsed, not removed: they occupy width (or a whole line), and
+ *    deleting them would glue two tokens into one word that reads as a different command. TAB is not
+ *    excepted here — a one-line display value has no use for one, and a rule text's foldable-tab
+ *    exception belongs to the VALIDATOR class, not to this one.
+ * The result is then capped by code point (never splitting a surrogate pair) with a `…` marker, and
+ * carries the shared authority-envelope neutralization every untrusted inline value gets — this text
+ * can land on a model-visible line as easily as on a human one.
+ *
+ * WHAT IT IS NOT. A DISPLAY baseline, never an identity channel and never adjudication input: the
+ * transform is LOSSY and NOT injective (two distinct commands can render identically — that is the
+ * price of a readable line). Correlate, match, store and adjudicate on the RAW bytes, which the
+ * carrying seats keep unchanged: this function neither changes what those seats contain nor what any
+ * of them means. A caller that must instead tell two hostile texts APART wants
+ * {@link escapeForDisclosure} (which escapes rather than folds, so nothing collides) or
+ * {@link hasUnrenderableCharacters} (refuse instead of render).
+ *
+ * @param text the raw untrusted text (a `String(x)` is applied to anything that is not one).
+ * @param maxLen code-point cap for the rendered result; defaults to the disclosure-line budget.
+ */
+export declare function renderUntrustedCommandText(text: unknown, maxLen?: number): string;
 /**
  * Does this text carry a character of the class {@link escapeForDisclosure} exists for — the class
  * {@link CONTROL_CHARS_RE} names? Asked by a caller that must REFUSE such a value rather than render
@@ -488,7 +522,14 @@ export interface SegmentRuleSuggestion {
     readonly command: string;
     /** The (folded) segment this suggestion came from. Raw post-rewrite command bytes — a substring
      *  of the same call's `args`/`command` values riding beside it on every surface that carries
-     *  this seat — so render it with contextual escaping, exactly like those. */
+     *  this seat — so render it with contextual escaping, exactly like those.
+     *
+     *  RAW is the contract here and does not change: this seat carries the bytes, because the bytes are
+     *  what a rule would be minted from and what a correlation keys on. The rendering side of that
+     *  contract is {@link renderUntrustedCommandText} — the shipped display baseline (bidi and
+     *  zero-width controls removed, controls/line separators folded, length capped, envelope-neutralized)
+     *  a surface can adopt instead of writing its own, since raw command bytes displayed unprocessed can
+     *  show a reader something other than what they authorize. */
     readonly segment: string;
 }
 /**

package/dist/core/permission-rule-model.js

@@ -1,5 +1,6 @@
 import { parsePermissionRule } from "./permission-rules.js";
 import { parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
+import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -162,6 +163,17 @@ export function escapeForDisclosure(value) {
     });
     return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
 }
+const DISPLAY_STRIP_FORMAT_RE = /\p{Cf}/gu;
+export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MAX_CHARS) {
+    let raw;
+    try {
+        raw = typeof text === "string" ? text : String(text);
+    }
+    catch {
+        return "<unprintable>";
+    }
+    return inlineUntrusted(raw.replace(DISPLAY_STRIP_FORMAT_RE, ""), maxLen);
+}
 export function hasUnrenderableCharacters(text) {
     return CONTROL_CHARS_RE.test(text);
 }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -22,6 +22,7 @@
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
+import type { ContextEditMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
@@ -119,6 +120,13 @@ export interface PrepareConfigDoorsResult {
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
+    /** owned — the validated/resolved microCompact knob (design/374; {@link resolveMicroCompactKnob}
+     *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
+     *  the deps bag is never re-read after this door. */
+    microCompactKnob: {
+        machine: ContextEditMachine;
+        clearOnRejection: boolean;
+    };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
     resolvedRole: ResolvedRole;
     /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later
@@ -163,5 +171,18 @@ export interface PrepareConfigDoorsResult {
      *  the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
 }
-/** The B-1 phase body — the config-doors slice, verbatim (see the module header for the contract). */
+/** design/374 — the microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
+ *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing (review
+ *  r3): it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
+ *  BEFORE any resource-bearing preparation — session acquisition, execution-env creation, the MCP
+ *  dial — whose external effects a late refusal's teardown cannot undo. SINGLE READ per seat, and
+ *  the CONTAINER is judged first (reviews r1/r2): an accessor-backed bag answering a legal value at
+ *  one read and junk at another must be caught by whichever read this door takes, and a
+ *  `microCompact: "cc"` / null / number / array bag makes both property reads answer undefined —
+ *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
+ *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
+export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
+    machine: ContextEditMachine;
+    clearOnRejection: boolean;
+};
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;