@sema-agent/core 7.49.5 → 7.50.0

package/dist/core/lsp.js

@@ -1,8 +1,13 @@
 import { uriToPath } from "./lsp-protocol.js";
-import { anchorSpelling, foldRedundantPathSegments, pathFamilyOf } from "../tools/fs/safety.js";
+import { anchorSpelling, foldRedundantPathSegments, pathFamilyOf, resolveKey, violationDetails, violationText } from "../tools/fs/safety.js";
+import { seatForCall, sensitivePathDenyList } from "../tools/fs/read-deny.js";
+import { pathTargetBaseOf } from "./effective-path-target.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
+import { pathTargetOf } from "./tool-registry.js";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "./tools.js";
 import { toolFace } from "./tool-catalog-entries.js";
+import { thrownText } from "./thrown-value.js";
 export const LSP_OPERATIONS = [
     "goToDefinition", "findReferences", "hover", "documentSymbol", "workspaceSymbol",
     "goToImplementation", "prepareCallHierarchy", "incomingCalls", "outgoingCalls",
@@ -73,6 +78,63 @@ export function resolveLspPath(filePath, cwd) {
         return foldRedundantPathSegments(filePath);
     return foldRedundantPathSegments(anchorSpelling(pathFamilyOf({ root: cwd }), cwd, filePath));
 }
+const LSP_PATH_TARGET = pathTargetOf("LSP");
+export function lspBaseOf(readFace, env) {
+    return pathTargetBaseOf(LSP_PATH_TARGET, readFace !== undefined ? { root: readFace.rootCanonical, cwd: readFace.cwdRef?.current } : { cwd: env?.cwd });
+}
+function judgeLspRead(env, face, spelling, signal, admitted) {
+    return resolveKey(env, face.rootCanonical, spelling, signal, lspBaseOf(face), face.roots, admitted, face.readDeny, face.face);
+}
+const LSP_UNBINDABLE = "this environment cannot bind a read to the file that was checked";
+export function lspReadGateOf(env, face, authorizedKey) {
+    const exempt = authorizedKey === undefined ? undefined : (key) => key === authorizedKey;
+    const keyOf = async (filePath, signal) => {
+        const r = await judgeLspRead(env, face, filePath, signal, exempt).catch(() => undefined);
+        return r?.ok === true ? r.key : undefined;
+    };
+    return async (filePath, signal) => {
+        await face.ready?.(undefined, signal);
+        const key = await keyOf(filePath, signal);
+        if (key === undefined)
+            return { ok: false, reason: "the read boundary refuses this file" };
+        if (env.openBound === undefined)
+            return { ok: false, reason: LSP_UNBINDABLE };
+        let held;
+        try {
+            held = await env.openBound(key, signal);
+        }
+        catch (e) {
+            return { ok: false, reason: thrownText(e) };
+        }
+        if (!held.ok)
+            return { ok: false, reason: held.error.message };
+        if ((await keyOf(filePath, signal)) !== key) {
+            await held.value.close();
+            return { ok: false, reason: "it resolved to a different file while it was being checked" };
+        }
+        return { ok: true, key, object: held.value };
+    };
+}
+export async function lspListedWithheld(env, face, uris, signal) {
+    const out = new Map();
+    if (face.readDeny === undefined || uris.length === 0)
+        return out;
+    await face.ready?.(undefined, signal);
+    const distinct = [...new Set(uris)];
+    const unreadable = { unreadable: true };
+    const judgeOne = async (uri) => {
+        const r = await resolveKey(env, face.rootCanonical, uriToPath(uri), signal, undefined, face.roots, undefined, face.readDeny, "open");
+        if (r.ok)
+            return undefined;
+        return r.violation.code === "read_path_denied" && r.violation.pattern !== undefined ? { pattern: r.violation.pattern } : unreadable;
+    };
+    const batch = Promise.all(distinct.map(async (uri) => [uri, await judgeOne(uri).catch(() => unreadable)]));
+    const judged = await withGateTimeout(batch, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "lspListedPaths").catch(() => undefined);
+    for (const [uri, withholding] of judged ?? distinct.map((uri) => [uri, unreadable]))
+        if (withholding !== undefined)
+            out.set(uri, withholding);
+    return out;
+}
 export const MAX_LSP_FILE_BYTES = 10 * 1000 * 1000;
 function fmt(result, ctx) {
     switch (result.kind) {
@@ -139,10 +201,67 @@ async function filterIgnored(result, isIgnored) {
     }
     return result;
 }
+async function withholdDenied(result, withheldOf) {
+    if (result.kind !== "locations" && result.kind !== "symbols")
+        return { result, note: "" };
+    const entries = result.kind === "locations" ? result.locations : result.symbols;
+    const withheld = await withheldOf(entries.map((e) => e.uri));
+    const patterns = [];
+    let denied = 0;
+    let unreadable = 0;
+    const keeps = (uri) => {
+        const w = withheld.get(uri);
+        if (w === undefined)
+            return true;
+        if ("pattern" in w) {
+            denied += 1;
+            if (!patterns.includes(w.pattern))
+                patterns.push(w.pattern);
+        }
+        else
+            unreadable += 1;
+        return false;
+    };
+    const kept = result.kind === "locations" ? { kind: "locations", locations: result.locations.filter((l) => keeps(l.uri)) } : { kind: "symbols", symbols: result.symbols.filter((s) => keeps(s.uri)) };
+    const n = (k) => `${k} result${k === 1 ? "" : "s"}`;
+    const note = (denied > 0 ? `\n[note: ${n(denied)} in files matching ${sensitivePathDenyList(patterns)} ${denied === 1 ? "was" : "were"} withheld]` : "") +
+        (unreadable > 0 ? `\n[note: ${n(unreadable)} withheld: the file${unreadable === 1 ? "" : "s"} could not be resolved to be judged against the read deny list]` : "");
+    return { result: kept, note };
+}
+const factsOfFileError = (code) => (code === "not_found" ? "missing" : code === "invalid" ? "not_a_file" : undefined);
+async function heldTargetFacts(env, key, signal) {
+    if (env.openBound === undefined)
+        return undefined;
+    const held = await env.openBound(key, signal).catch(() => undefined);
+    if (held === undefined)
+        return undefined;
+    if (!held.ok)
+        return factsOfFileError(held.error.code);
+    try {
+        if (held.value.kind === "directory")
+            return "not_a_file";
+        const size = await held.value.size();
+        return size.ok ? { size: size.value } : undefined;
+    }
+    finally {
+        await held.value.close();
+    }
+}
+async function namedTargetFacts(env, target, signal) {
+    const info = await env.fileInfo(target, signal);
+    if (!info.ok)
+        return factsOfFileError(info.error.code);
+    if (info.value.kind === "directory")
+        return "not_a_file";
+    return info.value.kind === "file" ? { size: info.value.size } : undefined;
+}
 const POSITION_OPS = new Set([
     "goToDefinition", "findReferences", "hover", "goToImplementation", "prepareCallHierarchy", "incomingCalls", "outgoingCalls",
 ]);
 export function createLspTool(manager, opts = {}) {
+    const faceSeat = opts.readFace;
+    if (faceSeat !== undefined && opts.env === undefined)
+        throw new TypeError("createLspTool: LspToolOptions.readFace needs the env it reads through (LspToolOptions.env)");
     return defineTool({
         name: "LSP",
         ...toolFace("lsp"),
@@ -173,6 +292,8 @@ export function createLspTool(manager, opts = {}) {
             query: Type.Optional(Type.String({ description: "Symbol query for workspaceSymbol (may be empty to browse broadly)." })),
         }),
         execute: async (args, ctx) => {
+            await faceSeat?.ready?.(ctx.toolCallId, ctx.signal);
+            const readFace = faceSeat === undefined ? undefined : { ...faceSeat, readDeny: seatForCall(faceSeat.readDeny, ctx.toolCallId), roots: seatForCall(faceSeat.roots, ctx.toolCallId), ready: undefined };
             const { operation, filePath, line, character, query } = args;
             if (POSITION_OPS.has(operation) && (line === undefined || character === undefined)) {
                 return errorResult(`Error (LSP): the "${operation}" operation needs both line and character.`);
@@ -184,18 +305,24 @@ export function createLspTool(manager, opts = {}) {
             if (operation === "workspaceSymbol" && wsQuery === undefined) {
                 return errorResult(`Error (LSP): the "workspaceSymbol" operation needs a query.`);
             }
-            const target = resolveLspPath(filePath, opts.env?.cwd);
-            if (opts.env) {
-                const info = await opts.env.fileInfo(target, ctx.signal);
-                if (!info.ok && info.error.code === "not_found")
-                    return errorResult(`Error (LSP): File does not exist: ${filePath}`);
-                if (!info.ok && info.error.code === "invalid")
-                    return errorResult(`Error (LSP): Path is not a file: ${filePath}`);
-                if (info.ok && info.value.kind === "directory")
-                    return errorResult(`Error (LSP): Path is not a file: ${filePath}`);
-                if (info.ok && info.value.kind === "file" && info.value.size > MAX_LSP_FILE_BYTES) {
-                    return `File too large for LSP analysis (${Math.ceil(info.value.size / 1e6)}MB exceeds 10MB limit)`;
-                }
+            const target = resolveLspPath(filePath, lspBaseOf(readFace, opts.env));
+            let gate;
+            let judgedKey;
+            if (readFace !== undefined && opts.env !== undefined) {
+                const admitted = readFace.admitted;
+                const r = await judgeLspRead(opts.env, readFace, filePath, ctx.signal, admitted && ((key) => admitted(ctx.toolCallId, key)));
+                if (!r.ok)
+                    return errorResult(violationText("LSP", r.violation), violationDetails(r.violation));
+                judgedKey = r.key;
+                gate = lspReadGateOf(opts.env, readFace, r.key);
+            }
+            const facts = opts.env === undefined ? undefined : judgedKey !== undefined ? await heldTargetFacts(opts.env, judgedKey, ctx.signal) : await namedTargetFacts(opts.env, target, ctx.signal);
+            if (facts === "missing")
+                return errorResult(`Error (LSP): File does not exist: ${filePath}`);
+            if (facts === "not_a_file")
+                return errorResult(`Error (LSP): Path is not a file: ${filePath}`);
+            if (facts !== undefined && facts.size > MAX_LSP_FILE_BYTES) {
+                return `File too large for LSP analysis (${Math.ceil(facts.size / 1e6)}MB exceeds 10MB limit)`;
             }
             const session = await manager.sessionFor(target, ctx.signal, opts.env);
             if (!session) {
@@ -203,9 +330,12 @@ export function createLspTool(manager, opts = {}) {
                 return `LSP is unavailable for "${filePath}" (${why}). Fall back to Grep/Read for this lookup.`;
             }
             const seamCharacter = character !== undefined ? character - 1 : undefined;
-            const result = await session.request(operation, { filePath: target, line, character: seamCharacter, symbol: wsQuery }, ctx.signal);
-            const final = toModelBase(await filterIgnored(result, opts.isPathIgnored));
-            const text = fmt(final, { operation, filePath });
+            const result = await session.request(operation, { filePath: target, line, character: seamCharacter, symbol: wsQuery }, ctx.signal, gate);
+            const ignored = await filterIgnored(result, opts.isPathIgnored);
+            const env = opts.env;
+            const kept = readFace !== undefined && env !== undefined ? await withholdDenied(ignored, (uris) => lspListedWithheld(env, readFace, uris, ctx.signal)) : { result: ignored, note: "" };
+            const final = toModelBase(kept.result);
+            const text = fmt(final, { operation, filePath }) + kept.note;
             return final.kind === "none" && final.reason !== undefined && LSP_ERROR_REASONS.has(final.reason) ? errorResult(text) : text;
         },
     });

package/dist/core/mcp.js

@@ -19,6 +19,7 @@ import { sliceHeadSafe, sliceTailSafe } from "./surrogate-safe-slice.js";
 import { truncateError } from "./tool-errors.js";
 import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "./reminder-disclosure.js";
+import { MARKED_BLOCK_AFTER_DATA } from "./reminder-mint.js";
 import { resolveMcpDeclaredResultSize, resolveMcpRequiresUserInteraction } from "./mcp-tool-meta.js";
 export { resolveMcpDeclaredResultSize } from "./mcp-tool-meta.js";
 import { withContentOrigin } from "./memory-engine/content-origin.js";
@@ -1797,7 +1798,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                     if (d.defused)
                         textIdx.forEach((ci, si) => (content[ci] = { type: "text", text: d.segments[si] }));
                     if (d.trailer !== undefined)
-                        content.push({ type: "text", text: d.trailer });
+                        content.push({ type: "text", text: `${MARKED_BLOCK_AFTER_DATA}${d.trailer}` });
                 }
                 if (sc !== undefined)
                     return { content, details: { type: "mcp", structuredContent: sc }, terminate: false };

package/dist/core/media-byte-cap.d.ts

@@ -1,4 +1,5 @@
 import type { AgentMessage } from "../internal/harness-types.js";
+import type { DocumentContent, ImageContent } from "../internal/llm.js";
 /**
  * Aggregate MEDIA (image) byte budget — the multimodal sibling of {@link AGGREGATE_TOOL_RESULT_BUDGET_CHARS}
  * (which only counts TEXT, design/64 §17.2). batch-C added image reads (`Read` → `ImageContent`); each is bounded
@@ -14,6 +15,19 @@ import type { AgentMessage } from "../internal/harness-types.js";
 /** Default aggregate inline-media budget (bytes). Generous — only the pathological "N parallel huge image reads"
  *  case strips. Bounds the request while leaving normal multimodal use untouched. Overridable per-deployment. */
 export declare const AGGREGATE_MEDIA_BUDGET_BYTES: number;
+/** The one reading of a deployment's media budget (`RunnerDeps.mediaByteCapBytes`, screened by {@link checkedMediaByteCap}
+ *  at `new Runner`), for both of its readers — the request strip below and the `tool_end.output` projection: absent ⇒
+ *  {@link AGGREGATE_MEDIA_BUDGET_BYTES}; a finite positive number ⇒ itself; `0` or `Infinity` ⇒ no budget, `Infinity`
+ *  (a direct caller of {@link capAggregateMediaBytes} that passes a negative or `NaN` meets the same no-op). */
+export declare function mediaBudgetBytes(cap: number | undefined): number;
+/** The deployment's media budget, screened once at `new Runner`: absent, a non-negative number of bytes, or `Infinity`
+ *  (`0` and `Infinity` both mean "no budget"). A non-number, `NaN` or a negative is refused (`config.invalid_argument`),
+ *  never read as "no budget". */
+export declare function checkedMediaByteCap(value: unknown, seat: string): void;
+/** Decoded byte size of a base64 media payload (4 base64 chars ≈ 3 bytes). Approximate — fine for a budget.
+ *  PDF read: `document` blocks (base64 PDFs) count against the SAME aggregate budget — same class of inline
+ *  media bytes, same unbounded-accumulation failure mode. */
+export declare function imageBytes(b: ImageContent | DocumentContent): number;
 /** Telemetry for one strip pass (mirrors CC's `tengu_media_byte_cap_stripped` fields). */
 export interface MediaStripInfo {
     totalBytes: number;

package/dist/core/media-byte-cap.js

@@ -1,6 +1,18 @@
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const AGGREGATE_MEDIA_BUDGET_BYTES = 30 * 1024 * 1024;
+export function mediaBudgetBytes(cap) {
+    const limit = cap ?? AGGREGATE_MEDIA_BUDGET_BYTES;
+    return Number.isFinite(limit) && limit > 0 ? limit : Infinity;
+}
+export function checkedMediaByteCap(value, seat) {
+    if (value === undefined || (typeof value === "number" && value >= 0))
+        return;
+    const e = new Error(`${seat} ${describeRejectedValue(value)} is not a media byte budget — expected a non-negative number of bytes (0 or Infinity: no budget), or omit it for the default ${AGGREGATE_MEDIA_BUDGET_BYTES}`);
+    e.code = "config.invalid_argument";
+    throw e;
+}
 const MEDIA_STRIPPED_MARKER = "[media removed to fit the request media budget — re-read the file if you still need to see it]";
-function imageBytes(b) {
+export function imageBytes(b) {
     return typeof b.data === "string" ? Math.floor((b.data.length * 3) / 4) : 0;
 }
 function blocksOf(m) {
@@ -8,8 +20,8 @@ function blocksOf(m) {
     return Array.isArray(content) ? content : undefined;
 }
 export function capAggregateMediaBytes(messages, opts) {
-    const { limitBytes } = opts;
-    if (!Number.isFinite(limitBytes) || limitBytes <= 0)
+    const limitBytes = mediaBudgetBytes(opts.limitBytes);
+    if (limitBytes === Infinity)
         return messages;
     let total = 0;
     for (const m of messages) {

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -21,8 +21,9 @@
  *    auto lane's task-boundary tick), never on a background schedule of core's own.
  */
 import type { EngineNotice } from "../types.js";
-import { type ConsolidationGateRow, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
+import { type ConsolidationGateRow, CONSOLIDATION_WRITE_REFUSED_CODE, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
 import { type ConsolidationPlanFoldEvidence, type ConsolidationPlanSummary } from "./engine.js";
+import type { SyntheticWriteVerdict } from "../synthetic-read-verdict.js";
 import { mintLlmConsolidationPlan, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationFoldState, type DistillerChatFn, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract } from "./distiller.js";
 export declare const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 /** §1.6-4 — the mint archive: what was shown to the model and what it answered, verbatim, per run
@@ -142,14 +143,35 @@ export interface ConsolidationDriverEngine extends ConsolidationDriveEngine {
     listConsolidationPlans(): ConsolidationPlanSummary[];
     readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     readConsolidationFoldState(scope: string): Promise<ConsolidationFoldState>;
+    /** The canonical directory a commit lands the scope's products in (the write judge's early question). */
+    consolidationWriteHome(scope: string): string;
     readonly controlPlaneRoot: string;
 }
+/** One write the judge is asked about: `path` is a file (or the library directory) of `scope`'s library, absolute and canonical. */
+export interface ConsolidationWriteTarget {
+    scope: string;
+    path: string;
+}
+/** The write judge's seat: one target in, the synthetic-write judge's verdict out (only `no_objection` permits the write). */
+export type ConsolidationWriteJudge = (target: ConsolidationWriteTarget) => Promise<SyntheticWriteVerdict> | SyntheticWriteVerdict;
+export { CONSOLIDATION_WRITE_REFUSED_CODE };
 export interface RunMemoryConsolidationOptions {
     /** The explicit model seat (design/339 §1.1: the ENGINE holds none). Build one with
      *  `openAiCompatChatSeat` or hand any JSON-only completion function. */
     chat: DistillerChatFn;
     /** The explicit model id, recorded into the run and the archive (alias spellings refuse). */
     model: string;
+    /** The write judge — REQUIRED. A run writes the library with nobody watching, so it asks the judgment a foreground write
+     *  into the same library meets: the person's standing path rules and the deployment's policy, read through the ONE judge
+     *  (`createSyntheticWriteJudge`; the Runner's auto lane passes the leg's own). It is asked in two places over the run, with the same
+     *  seat and the same refusal: once for the library directory before any claim, seat or model call (an early refusal that
+     *  spends nothing), and — the authority — where a plan is applied (a commit, a replay of a suspended plan, the drive's
+     *  recovery), at the backend's final spelling of every product before any is written: a refusal there writes nothing and
+     *  discards the plan.
+     *  Anything but `no_objection` — a deny, an ask (nobody is present to answer it), an unreadable rule source, a
+     *  throw — refuses the run with `memory.consolidation_write_refused`, and nothing is written. A host that holds no rules
+     *  says so by passing a judge that answers `no_objection`; an absent seat refuses, it never reads as "no rules". */
+    writeJudge: ConsolidationWriteJudge;
     /** Audit locator recorded into the archive when the seat is endpoint-shaped. */
     baseUrl?: string;
     /** The frozen prompt contract; default = the product v1 (dl-3 byte-identical). A different

package/dist/core/memory-engine/consolidation-driver.js

@@ -3,7 +3,7 @@ import { uuidv7 } from "../../internal/harness.js";
 import { atomicWriteFileSync, ensureDirExists, lockedStrictUpdate, readStrictSidecar, enqueueMemoryAnnouncement, ControlPlaneCorruptError } from "./layout.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { deliverEngineNotice } from "../engine-notice.js";
-import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, recommendationUnconsumed, } from "./consolidation.js";
+import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, recommendationUnconsumed, CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError, } from "./consolidation.js";
 import { memoryConsolidationIncompleteNotice, memoryConsolidationWithheldNotice } from "./engine.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, detectCleanArmVerbatimLeak, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, normalizedCandidateRev, } from "./distiller.js";
@@ -61,6 +61,7 @@ export function archiveDistillerPlan(controlDir, runId, plan, attempt = 1) {
     atomicWriteFileSync(join(controlDir, CONSOLIDATION_DRIVER_PLANS_DIR, name), `${JSON.stringify(plan, null, 2)}\n`);
     return name;
 }
+export { CONSOLIDATION_WRITE_REFUSED_CODE };
 function driverConfigRefusal(message) {
     const e = new Error(message);
     e.code = "config.memory_consolidation_driver";
@@ -93,6 +94,33 @@ const codeOf = (err) => {
     const c = err?.code;
     return typeof c === "string" ? c : undefined;
 };
+async function refuseUnlessWriteAllowed(judge, target, consequence) {
+    let verdict;
+    let threw;
+    try {
+        verdict = await judge(target);
+    }
+    catch (err) {
+        threw = thrownText(err);
+    }
+    const answer = typeof verdict === "object" && verdict !== null ? verdict : undefined;
+    if (threw === undefined && answer?.verdict === "no_objection")
+        return;
+    const text = (v) => (typeof v === "string" && v !== "" ? inlineUntrusted(v, 200) : undefined);
+    const where = text(answer?.layer);
+    let why;
+    if (threw !== undefined)
+        why = `the write judge threw (${inlineUntrusted(threw, 200)}), so whether a standing rule forbids this write is unknown`;
+    else if (answer?.verdict === "deny")
+        why = `a standing rule layer${where !== undefined ? ` (${where})` : ""} refuses writes into this library${text(answer.message) !== undefined ? `: ${text(answer.message)}` : ""}`;
+    else if (answer?.verdict === "ask")
+        why = `a standing rule layer${where !== undefined ? ` (${where})` : ""} would ask a person before a write into this library, and a background run has nobody to answer${text(answer.message) !== undefined ? `: ${text(answer.message)}` : ""}`;
+    else if (answer?.verdict === "unanswerable")
+        why = `the write judge could not answer${where !== undefined ? ` at ${where}` : ""}${text(answer.cause) !== undefined ? ` (${text(answer.cause)})` : ""}${text(answer.reason) !== undefined ? `: ${text(answer.reason)}` : ""}, so whether a standing rule forbids this write is unknown`;
+    else
+        why = "the write judge answered something outside its closed set of verdicts";
+    throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(target.scope, 80)} (${inlineUntrusted(target.path, 200)}): ${why}${consequence !== undefined ? ` — ${consequence}` : ""}`);
+}
 const MAX_THROTTLE_WAITS_PER_SNAPSHOT = 4;
 const MAX_BUSY_WAITS = 2;
 export async function runMemoryConsolidationDriver(engine, scope, opts) {
@@ -127,7 +155,24 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     };
     const throttleWindowMs = Math.min(screened.minRunIntervalMs, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS);
     const controlDir = engine.controlPlaneRoot;
-    const parkedSeat = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs });
+    if (typeof opts.writeJudge !== "function")
+        throw driverConfigRefusal(`runMemoryConsolidationDriver needs an explicit write judge (opts.writeJudge), got ${typeof opts.writeJudge} — a run writes the library with nobody watching, so it asks the judgment a foreground write meets before it starts; an absent seat is refused, never read as "no rules apply" (a host that holds no rules passes a judge that answers no_objection).`);
+    let libraryHome;
+    try {
+        libraryHome = engine.consolidationWriteHome(scope);
+    }
+    catch (err) {
+        throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(scope, 80)}: where this run would write could not be derived (${inlineUntrusted(thrownText(err), 200)}), so whether a standing rule forbids it is unknown — no run was started and nothing was written.`);
+    }
+    await refuseUnlessWriteAllowed(opts.writeJudge, { scope, path: libraryHome }, "no run was started and nothing was written.");
+    const writeGate = (target) => refuseUnlessWriteAllowed(opts.writeJudge, target);
+    let refusedSeat = undefined;
+    const parkedSeat = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs, writeGate }).catch((err) => {
+        if (!(err instanceof ConsolidationRefusedError) || err.code !== CONSOLIDATION_WRITE_REFUSED_CODE)
+            throw err;
+        refusedSeat = err;
+        return undefined;
+    });
     const openFold = await engine.readConsolidationFoldState(scope);
     const { row: run, resumed } = claimDriverRun(controlDir, scope, () => ({
         runId: uuidv7(),
@@ -258,6 +303,8 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     if (parkedSeat !== undefined) {
         return settle("parked", undefined, parkedSeat);
     }
+    if (refusedSeat !== undefined)
+        return settle("refused", undefined, `reconcileConsolidation refused the plan an earlier run left seated: ${refusedSeat.code}: ${refusedSeat.message}`);
     let staleResidue = [];
     let staleResidueMemberIds = new Set();
     const distill = async (candidates, snapshot, s) => {
@@ -425,7 +472,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
                     if (busyWaits >= MAX_BUSY_WAITS)
                         throw err;
                     busyWaits += 1;
-                    const parked = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs });
+                    const parked = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs, writeGate });
                     if (parked !== undefined) {
                         const e = new Error(parked);
                         e[CONSOLIDATION_SNAPSHOT_PARKED] = true;
@@ -448,6 +495,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             requestIdPrefix: run.requestId,
             maxCycles: opts.maxCycles ?? 64,
             takeSnapshot,
+            writeGate,
             onCycle: (row) => {
                 cyclesSeen.push(row);
                 if (row.committed.products > 0 || row.committed.superseded > 0)
@@ -564,8 +612,8 @@ function collectRunFoldEvidence(engine, scope, requestId) {
     }
     return { targets, skipped };
 }
-async function recoverSeat(engine, scope, { sleep, windowMs }) {
-    await engine.reconcileConsolidation(scope);
+async function recoverSeat(engine, scope, { sleep, windowMs, writeGate }) {
+    await engine.reconcileConsolidation(scope, { writeGate });
     let seat = engine.readConsolidationGate(scope)?.openPlanId;
     if (seat === undefined)
         return undefined;
@@ -574,7 +622,7 @@ async function recoverSeat(engine, scope, { sleep, windowMs }) {
         return `plan ${seat} holds the ${JSON.stringify(scope)} seat in a ${summary.corrupt === true ? "corrupt" : "conflict"} state — resolveConsolidationPlan(planId, "retry" | "discard") is the host valve; the run parks rather than stacking a second plan on the seat`;
     }
     await sleep(windowMs);
-    await engine.reconcileConsolidation(scope);
+    await engine.reconcileConsolidation(scope, { writeGate });
     seat = engine.readConsolidationGate(scope)?.openPlanId;
     if (seat === undefined)
         return undefined;

package/dist/core/memory-engine/consolidation-write-gate.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The write gate, asked at the apply for every entry file a plan writes or removes: the backend's FINAL spelling of each (as its
+ * `admit`), or the one the apply knows for a backend that cannot admit. Kept beside the engine rather than in it; everything about
+ * how a refusal is shaped lives here — including what it says was written, which only the apply knows ({@link refusalNamingWritten}).
+ */
+import { ConsolidationRefusedError, type ConsolidationDirectedPatch, type ConsolidationWriteGate } from "./consolidation.js";
+import type { AdmitLandings, PatchLanding } from "./landing-admission.js";
+import type { MemoryBackend, MemoryEntry } from "./types.js";
+/** The refusal of a verb that may apply a plan and was handed no write gate — thrown before the verb claims or changes anything. */
+export declare const CONSOLIDATION_WRITE_GATE_REQUIRED_CODE = "config.memory_consolidation_write_gate";
+/** A verb that may apply a plan carries the write gate; absent, it refuses before it claims or changes anything (a host that holds
+ *  no rules passes a gate that resolves, and so says it). */
+export declare function requireWriteGate(gate: unknown, verb: string): asserts gate is ConsolidationWriteGate;
+/**
+ * Where a plan's pending directed patches write or remove files, as the store holds the entries now: an update's target and, when
+ * it moves the entry, the file it leaves; the file a delete removes. An id the store no longer holds is no write of a delete.
+ */
+export declare function directedLandings(directed: readonly ConsolidationDirectedPatch[], getByIds: (ids: readonly string[]) => Promise<MemoryEntry[]>): Promise<PatchLanding[]>;
+/** What of a plan the store already holds: products it carries (the ids are the plan's own, minted at the freeze, so the store
+ *  holding one means the plan wrote it) and directed patches whose planned state stands. */
+export interface PlanWritten {
+    readonly products: readonly PatchLanding[];
+    readonly directed: readonly string[];
+}
+/**
+ * {@link PlanWritten} for `plan`, read through `committed` once `backend` has replayed every commit it holds (a locked entry that
+ * writes nothing runs its recovery first) — what an earlier pass, which a crash or a failure cut short before its book was written,
+ * or this pass before a refusal, put in the store. Undefined when the store could not be read (a refusal then says so).
+ */
+export declare function planWritten(plan: {
+    readonly products: readonly {
+        readonly id: string;
+    }[];
+    readonly directed: readonly ConsolidationDirectedPatch[];
+}, backend: Pick<MemoryBackend, "applyPatches">, committed: Pick<MemoryBackend, "getByIds">): Promise<PlanWritten | undefined>;
+/**
+ * The write gate's refusal at the apply, completed with what the plan has written: the gate knows why it refused; the apply knows
+ * that nothing further is written and what the store already holds of the plan (`written`; undefined = could not be read).
+ */
+export declare function refusalNamingWritten(err: ConsolidationRefusedError, written: PlanWritten | undefined): ConsolidationRefusedError;
+/**
+ * The write gate as one apply's `admit`: every landing (`<slug>.md` in its scope's library directory) is put to the gate, all of
+ * them before any is written; the first refusal rejects with the gate's own error. A landing admitted once in the apply is not
+ * asked again (the apply asks its directed targets up front, and the backend names them again when it plans their batch).
+ */
+export declare function admitLandingsThrough(gate: ConsolidationWriteGate, homeOf: (scope: string) => string): AdmitLandings;

package/dist/core/memory-engine/consolidation-write-gate.js

@@ -0,0 +1,82 @@
+import { join } from "node:path";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { thrownText } from "../thrown-value.js";
+import { CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError } from "./consolidation.js";
+export const CONSOLIDATION_WRITE_GATE_REQUIRED_CODE = "config.memory_consolidation_write_gate";
+export function requireWriteGate(gate, verb) {
+    if (typeof gate === "function")
+        return;
+    throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_GATE_REQUIRED_CODE, `${verb} needs a write gate (opts.writeGate), got ${typeof gate}: it applies a plan's writes, each asked of the gate where it lands — an absent gate is refused, never read as "no rules apply"`);
+}
+async function askConsolidationWriteGate(gate, scope, file, homeOf) {
+    let path;
+    try {
+        path = join(homeOf(), file);
+    }
+    catch (err) {
+        throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(scope, 80)}: where this plan would write could not be derived (${inlineUntrusted(thrownText(err), 200)}), so whether a standing rule forbids it is unknown`);
+    }
+    try {
+        await gate({ scope, path });
+    }
+    catch (err) {
+        if (err instanceof ConsolidationRefusedError)
+            throw err;
+        throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(scope, 80)}: the write gate failed (${inlineUntrusted(thrownText(err), 200)}), so whether a standing rule forbids writing ${inlineUntrusted(path, 200)} is unknown`);
+    }
+}
+export async function directedLandings(directed, getByIds) {
+    if (directed.length === 0)
+        return [];
+    const held = new Map((await getByIds(directed.map((d) => d.id))).map((e) => [e.id, e]));
+    return directed.flatMap((d) => {
+        const at = held.get(d.id);
+        const from = at !== undefined ? [{ id: d.id, scope: at.scope, slug: at.slug }] : [];
+        if (d.op === "delete" || d.entry === undefined)
+            return from;
+        const to = { id: d.id, scope: d.entry.scope, slug: d.entry.slug };
+        return [...from.filter((f) => f.scope !== to.scope || f.slug !== to.slug), to];
+    });
+}
+export async function planWritten(plan, backend, committed) {
+    try {
+        await backend.applyPatches([]);
+        const held = new Map((await committed.getByIds([...plan.products.map((p) => p.id), ...plan.directed.map((d) => d.id)])).map((e) => [e.id, e]));
+        const products = plan.products.flatMap((p) => {
+            const e = held.get(p.id);
+            return e === undefined ? [] : [{ id: p.id, scope: e.scope, slug: e.slug }];
+        });
+        const standing = (id) => (held.get(id)?.frontmatter.deleted === true ? undefined : held.get(id));
+        const directed = plan.directed.filter((d) => (d.op === "delete" ? standing(d.id) === undefined : standing(d.id)?.rev === d.plannedPostRev)).map((d) => d.id);
+        return { products, directed };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function refusalNamingWritten(err, written) {
+    const reasonLines = err.reasons.length > 0 ? `\n${err.reasons.map((r) => `  - ${r}`).join("\n")}` : "";
+    const why = err.message.slice(0, err.message.length - reasonLines.length);
+    const stays = [
+        ...(written !== undefined && written.products.length > 0 ? [`${written.products.length} of its products — ${written.products.map((l) => inlineUntrusted(`${l.id} (${l.scope}/${l.slug}.md)`, 200)).join(", ")}`] : []),
+        ...(written !== undefined && written.directed.length > 0 ? [`${written.directed.length} of its directed changes, already in their planned state — ${written.directed.map((id) => inlineUntrusted(id, 80)).join(", ")}`] : []),
+    ];
+    const outcome = written === undefined
+        ? "nothing further of it was written, and whether any of it had been written already could not be read"
+        : stays.length === 0
+            ? "nothing of it was written"
+            : `nothing further of it was written; what had already landed stays: ${stays.join("; ")}`;
+    return new ConsolidationRefusedError(err.code, `${why} — this plan is discarded and ${outcome}.`, err.reasons);
+}
+export function admitLandingsThrough(gate, homeOf) {
+    const admitted = new Set();
+    return async (landings) => {
+        for (const l of landings) {
+            const key = `${l.scope}\u0000${l.slug}`;
+            if (admitted.has(key))
+                continue;
+            await askConsolidationWriteGate(gate, l.scope, `${l.slug}.md`, () => homeOf(l.scope));
+            admitted.add(key);
+        }
+    };
+}

package/dist/core/memory-engine/consolidation.d.ts

@@ -445,6 +445,9 @@ export interface ConsolidationPlanFile {
         state: "pending" | "settled" | "abandoned";
     }>;
     state: ConsolidationPlanState;
+    /** The token of the applier that holds this plan's application (the LAST claimer holds it; an earlier one is stale and
+     *  stops). Written by the engine at the start of each apply; absent on a plan nobody has applied yet. */
+    applier?: string;
     audit: Array<{
         at: number;
         event: string;
@@ -497,6 +500,20 @@ export declare function readIntentCredentials(controlDir: string): Record<string
 /** Derive a product's slug from its proposed name (memory filename charset; collisions are the
  *  backend's deterministic -n suffix). */
 export declare function deriveProductSlug(name: string | undefined, fallback: string): string;
+/** The refusal code of a run (or one cycle's commit) a write judge stopped. */
+export declare const CONSOLIDATION_WRITE_REFUSED_CODE = "memory.consolidation_write_refused";
+/**
+ * The write gate a plan's application may carry, asked per product with the file it lands in. It resolves iff that write is
+ * permitted and rejects with a {@link ConsolidationRefusedError} (code {@link CONSOLIDATION_WRITE_REFUSED_CODE}) otherwise.
+ * It is asked where the plan is APPLIED, whichever entry applies it (commit, `reconcileConsolidation`'s replay, the drive's
+ * recovery), at the backend's FINAL landing spelling of every product before any is written; a refusal there writes nothing and
+ * DISCARDS the plan, so a suspended plan is no grant that outlives the rule that now forbids it. Products an earlier pass of the
+ * plan landed (a crash cut it short between two products) stay; the refusal the apply throws names them.
+ */
+export type ConsolidationWriteGate = (target: {
+    scope: string;
+    path: string;
+}) => Promise<void>;
 /** The refusal error every consolidation verb throws (structured: stable `code` + the per-item
  *  disclosure list — G5/G7/G14's "结构化拒+披露" shape). */
 export declare class ConsolidationRefusedError extends Error {

package/dist/core/memory-engine/consolidation.js

@@ -359,6 +359,7 @@ export function deriveProductSlug(name, fallback) {
     const base = (name ?? "").toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "");
     return base.length > 0 ? base : fallback;
 }
+export const CONSOLIDATION_WRITE_REFUSED_CODE = "memory.consolidation_write_refused";
 export class ConsolidationRefusedError extends Error {
     code;
     reasons;