@try-works/dsh-recursive-mode 0.4.9 → 0.6.0

package/src/memory.ts

@@ -24,7 +24,19 @@ import { join } from 'node:path'
 // P3b: the counters, passed IN rather than read here, so a caller decides where the evidence comes from.
 import { type FeedbackBook, feedbackBonus } from './memory-feedback.ts'
 
-export const MEMORY_KINDS = ['domains', 'patterns', 'episodes', 'skills'] as const
+/**
+ * ⚠ `training` IS IN THIS LIST BECAUSE IT IS THE KIND THE PLUGIN'S OWN TRAINING PATH WRITES.
+ *
+ * The phase-8 trigger (`training.ts`) writes `memory/training/<task-type>.md` and advertises that path in
+ * `memory/MEMORY.md`; the shipped router (`references/bodies/memory-router.md`) tells an agent to load "the
+ * relevant docs under `/.recursive/memory/training/`". With `training` absent from this list the loader
+ * COULD NOT SEE THE SHARDS THE TRIGGER WROTE — the writer's own output was unreachable by the reader, so
+ * "the plane's next run scores it" (README §10) was not true of exactly the shards training produces.
+ *
+ * `incidents/` and `archive/` stay out deliberately: `archive/` is historical by the router's own definition,
+ * and widening retrieval to `incidents/` is a separate ranking decision that this change does not make.
+ */
+export const MEMORY_KINDS = ['domains', 'patterns', 'episodes', 'training', 'skills'] as const
 
 export type MemoryKind = (typeof MEMORY_KINDS)[number]
 
@@ -193,7 +205,29 @@ export function entryAppliesTo(entry: MemoryEntry): string[] {
 }
 
 /** The registry the loader starts from: the router, not the plane. */
-export const MEMORY_INDEX_FILE = 'memory/MEMORY.md'
+export const MEMORY_INDEX_FILE = '.recursive/memory/MEMORY.md'
+
+/**
+ * Where the plane may live under a workspace root, in PREFERENCE order.
+ *
+ * ⚠ THE MEASURED DEFECT THIS FIXES. `defaultMemoryList` used to join `memory/<kind>/` straight onto the
+ * root it was handed — i.e. `<root>/memory/` — and that directory EXISTS IN NO REAL WORKSPACE. `bootstrap.ts`
+ * scaffolds the plane at `<root>/.recursive/memory/`, `ts-lint.ts` lints it there, and the review bundle reads
+ * it there; this loader alone looked beside it. Measured live on a workspace whose `.recursive/memory/` was
+ * scaffolded and whose `<root>/memory/` did not exist: `selectMemory` reported "the memory plane is empty"
+ * over a plane that was there, every phase of every run — and the training shards `training.ts` writes were
+ * therefore unreachable by the loader that is supposed to score them.
+ *
+ * ⚠ PREFER, THEN FALL BACK — NEVER MERGE. This is the rule `readFeedback` already follows for its own moved
+ * sidecar (`memory-feedback.ts`: `FEEDBACK_FILE` then `LEGACY_FEEDBACK_FILE`): the current location wins, and
+ * the earlier one is consulted ONLY when the current one yields nothing, because two snapshots of one shard
+ * added together would count a shard twice and a duplicated shard would outrank a real one.
+ *
+ * ⚠ AND IT MAKES THE CALLER'S CONVENTION IRRELEVANT. Passing the workspace root resolves
+ * `<root>/.recursive/memory/`; passing `.recursive` itself resolves through the second entry. Both are
+ * accepted, which is what README §6 means by "using `.recursive` as the root is selected again".
+ */
+export const MEMORY_PLANE_BASES = ['.recursive/memory', 'memory'] as const
 
 /** Progressive disclosure defaults, matching the parent (`--max-docs` 3, `--max-items` 10). */
 export const MAX_MEMORY_DOCS = 3
@@ -298,12 +332,19 @@ function defaultMemoryRead(path: string): string | null {
 }
 
 function defaultMemoryList(root: string, kind: string): readonly string[] {
-  const dir = join(root, 'memory', kind)
-  try {
-    return readdirSync(dir)
-      .filter((name) => name.endsWith('.md'))
-      .map((name) => join(dir, name))
-  } catch {
-    return []
+  // Preference order, never merged: see {@link MEMORY_PLANE_BASES}. A kind with no readable shard in the
+  // scaffolded plane falls through to the earlier location, which is how a caller that rooted the plane at
+  // `memory/` directly (and how the training writer's own call site) keeps working.
+  for (const base of MEMORY_PLANE_BASES) {
+    const dir = join(root, base, kind)
+    try {
+      const files = readdirSync(dir)
+        .filter((name) => name.endsWith('.md'))
+        .map((name) => join(dir, name))
+      if (files.length > 0) return files
+    } catch {
+      // An absent or unreadable directory is a missing advantage, not a failed load.
+    }
   }
+  return []
 }

package/src/phase-rules.ts

@@ -227,6 +227,119 @@ const SECTION_MAP: Record<string, string[]> = {
   ],
 }
 
+/* -------------------------------------------------------------------------- */
+/* T40 — THE PHASE-8 MEMORY WRITE, AS A RULE                                  */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * T40 — `.recursive/memory/`, the plane THIS plugin writes, and the phase-8 step that was prose.
+ *
+ * ⚠ WHY THIS EXISTS, MEASURED. Three completed runs in a live workspace left `.recursive/memory/`
+ * exactly as `bootstrap.ts` scaffolded it: `MEMORY.md` and the skill docs were still the
+ * bootstrap-created placeholders, while run 03's `08-memory-impact.md` had its
+ * "Write the durable ones to memory, with provenance" box TICKED and its `Inputs` line naming
+ * ANOTHER plugin's store (`memory_search` / `memory_status` is dsh-memory, not this plugin). So the
+ * phase declared its memory step done against a system this plugin does not own, and the plugin's
+ * own learning never activated — the owner's words: *"the agent should write to .recursive/memory/
+ * in phase 8, that's a hard requirement that needs to be enforced"*.
+ *
+ * ⚠ THE FIX IS A FACT, NOT A STRONGER SENTENCE. A prose step is ticked by the agent that would have
+ * had to do it, which is exactly what happened. What follows is the same requirement in the form the
+ * workflow can CHECK: a path under the plane, declared in the artifact, whose own text on disk
+ * carries this run's provenance (`Source-Runs`). "The run wrote its durable memory" then stops being
+ * a claim about the run's intentions and becomes a claim about files.
+ *
+ * ⚠ WHY IT IS NOT IN `SECTION_MAP`, deliberately: that map is byte-parity with the canonical
+ * linter's `get_artifact_required_sections` (`tests/phase-rules.parity.spec.ts` pins all twelve
+ * lists), and a section added there would be a parity break dressed up as a feature. The requirement
+ * rides on a section the canonical template ALREADY scaffolds — `## Affected Memory Docs` — plus a
+ * field the plane's own linter already requires, so the artifact shape stays canonical.
+ */
+export const PHASE8_MEMORY_ARTIFACT = '08-memory-impact.md'
+
+/** The plane, repo-relative. The trailing slash is what every guard here tests for. */
+export const MEMORY_PLANE_PREFIX = '.recursive/memory/'
+
+/** The canonical section the declaration goes in — present in every scaffolded phase-8 artifact. */
+export const PHASE8_MEMORY_SECTION = 'Affected Memory Docs'
+
+/**
+ * Where a durable doc may be filed, and the `Type` the memory-plane linter requires for it.
+ *
+ * ⚠ EVERY `dir` IS THE REAL PLANE, `.recursive/memory/…`, AND NOT A `memory/…` RELATIVE FORM. Measured:
+ * `bootstrap.ts` scaffolds the plane under `.recursive/`, `ts-lint.ts` lints it there, and the phase-8
+ * artifact cites it there — while the training trigger's own write seam joins its `memory/…` paths onto
+ * the workspace root, i.e. `<root>/memory/`, a directory that exists in no real workspace (the reader
+ * side of that defect was fixed in `memory.ts`; the writer side is `runtime.ts`'s seam and is reported,
+ * not edited). This table names the location a WRITE must land in, so it names the plane.
+ *
+ * ⚠ `skill` SHARES `pattern`'s Type ON PURPOSE: `/.recursive/memory/skills/patterns/` is where a
+ * promoted skill lesson ships (`bootstrap.ts` scaffolds three docs there), and the linter's allowed
+ * Types are `index|domain|pattern|incident|episode` — there is no `skill` Type to declare.
+ */
+export const MEMORY_DOC_LOCATIONS = {
+  domain: { dir: '.recursive/memory/domains', type: 'domain' },
+  pattern: { dir: '.recursive/memory/patterns', type: 'pattern' },
+  incident: { dir: '.recursive/memory/incidents', type: 'incident' },
+  episode: { dir: '.recursive/memory/episodes', type: 'episode' },
+  skill: { dir: '.recursive/memory/skills/patterns', type: 'pattern' },
+} as const
+
+export type MemoryDocKind = keyof typeof MEMORY_DOC_LOCATIONS
+
+/** The field that makes a doc THIS run's. It is the phase-8 gate's entire discriminator. */
+export const MEMORY_PROVENANCE_FIELD = 'Source-Runs'
+
+/** Where a run that believes it learned nothing can always record what the run was and what it cost. */
+export const MEMORY_ALWAYS_AVAILABLE = '.recursive/memory/episodes/<run-id>.md'
+
+/**
+ * The phase-8 obligation, as data — so the pre-step reminder, the `recursive_phase` payload and the
+ * lock-time gate all describe ONE rule instead of three paraphrases of it.
+ */
+export interface Phase8MemoryWriteRule {
+  /** The artifact that must declare the write. */
+  artifact: string
+  /** The plane the write must land in, repo-relative. */
+  plane: string
+  /** The section the declaration goes in. */
+  section: string
+  /** The field a doc must carry for the write to count as THIS run's. */
+  provenanceField: string
+  /** The doc a run with nothing else to record can always write. */
+  alwaysAvailable: string
+  kinds: readonly MemoryDocKind[]
+  /** One sentence per line the pre-step reminder injects. */
+  summary: string
+  /** The full instruction, for a caller that asks for the phase's rules. */
+  instruction: string
+}
+
+export const PHASE8_MEMORY_WRITE_RULE: Phase8MemoryWriteRule = {
+  artifact: PHASE8_MEMORY_ARTIFACT,
+  plane: MEMORY_PLANE_PREFIX,
+  section: PHASE8_MEMORY_SECTION,
+  provenanceField: MEMORY_PROVENANCE_FIELD,
+  alwaysAvailable: MEMORY_ALWAYS_AVAILABLE,
+  kinds: Object.keys(MEMORY_DOC_LOCATIONS) as MemoryDocKind[],
+  summary: 'HARD: this run must have WRITTEN at least one doc under ' + MEMORY_PLANE_PREFIX
+    + ' before ' + PHASE8_MEMORY_ARTIFACT + ' locks — ' + MEMORY_ALWAYS_AVAILABLE + ' is always available — declared by path under `## '
+    + PHASE8_MEMORY_SECTION + '` and carrying `' + MEMORY_PROVENANCE_FIELD + ': <this-run-id>`; citing a shard this run did not write does not count.',
+  instruction: 'HARD REQUIREMENT, CHECKED AT LOCK: before ' + PHASE8_MEMORY_ARTIFACT + ' locks, this run must have WRITTEN at least one doc under '
+    + MEMORY_PLANE_PREFIX + ' and declared that path under `## ' + PHASE8_MEMORY_SECTION + '`. A declared path counts ONLY when the doc on disk carries `'
+    + MEMORY_PROVENANCE_FIELD + '` naming THIS run, because that is what separates "the run wrote its memory" from "the run cited someone else\'s".'
+    + ' Render the doc with the metadata the memory-plane lint requires (Type, Status, Scope, Owns-Paths, Watch-Paths, ' + MEMORY_PROVENANCE_FIELD
+    + ', Validated-At-Commit, Last-Validated, Tags): ' + MEMORY_ALWAYS_AVAILABLE + ' is always available for a run-local lesson, `.recursive/memory/domains/`,'
+    + ' `.recursive/memory/patterns/` and `.recursive/memory/incidents/` hold generalized knowledge, and `.recursive/memory/skills/patterns/` is where a promoted skill lesson belongs.'
+    + ' A doc missing a required field, or carrying a Type/Status the plane lint rejects, FAILS the memory plane — write it in the canonical shape.'
+    + ' The written path enters the run diff under ' + MEMORY_PLANE_PREFIX + ', which phase 8 OWNS in its Worktree Diff Audit and Requirement Completion Status.',
+}
+
+/** The memory-write rule for an artifact, or null when that phase owes no memory write. */
+export function phase8MemoryWriteRuleFor(fileName: string): Phase8MemoryWriteRule | null {
+  return fileName === PHASE8_MEMORY_ARTIFACT ? PHASE8_MEMORY_WRITE_RULE : null
+}
+
 /**
  * get_artifact_required_sections(file_name, workflow_profile): canonical-parity
  * required section headings for a phase artifact. Defaults to TODO + Coverage
@@ -275,6 +388,14 @@ export interface PhaseRules {
   audited: boolean
   tdd: boolean
   qa: boolean
+  /**
+   * T40 — the memory-write obligation for this phase, or null when it owes none.
+   *
+   * ⚠ IT IS PART OF THIS STRUCTURE, not a parallel table, because `runtime.phaseRules` spreads this
+   * object straight into the `recursive_phase` payload and the pre-step reminder is built from the
+   * same source: a rule that lives here is a rule the agent is actually told, in one place.
+   */
+  memoryWrite: Phase8MemoryWriteRule | null
 }
 
 export function phaseRulesFor(fileName: string, workflowProfile: string = CURRENT_WORKFLOW_PROFILE): PhaseRules {
@@ -285,6 +406,7 @@ export function phaseRulesFor(fileName: string, workflowProfile: string = CURREN
     audited: AUDITED_PHASE_FILES.has(fileName),
     tdd: fileName === '03-implementation-summary.md',
     qa: fileName === '05-manual-qa.md',
+    memoryWrite: phase8MemoryWriteRuleFor(fileName),
   }
 }
 
@@ -304,6 +426,10 @@ export function phaseLintRulesMessage(fileName: string, workflowProfile: string
     'Audited phases: end with Audit: PASS before setting Coverage/Approval PASS; record Audit Context and Audit Verdict.',
     'TDD (phase 3): declare TDD Mode: strict|pragmatic; strict requires RED + GREEN evidence paths.',
     'QA (phase 5): declare QA Execution Mode: human|agent-operated|hybrid; human/hybrid need user sign-off.',
+    // T40 — the phase-8 memory write is named HERE, once, where every other phase gate is named.
+    // Additive on purpose: the message is only ever asserted with `toContain` (r5-parity.spec.ts),
+    // so a new phase's obligation cannot be mistaken for a regression in an existing one.
+    ...(rules.memoryWrite === null ? [] : ['Memory write (phase 8, HARD): ' + rules.memoryWrite.summary]),
     '</system-reminder>',
   ]
   return lines.join('\n')
@@ -427,7 +553,24 @@ export function phaseBaselineRules(fileName: string): ToolPolicyRule[] {
       pattern: 'write*',
       verdict: 'deny',
       reason: 'phase ' + phase + ' is a documentation phase: writes outside the run tree are denied (the implementation is frozen)',
-      predicate: (_id, args, ctx) => (writesOutsideRunTree(args, ctx) ? { verdict: 'deny' } : null),
+      // ⚠ T40 — PHASE 8 CARRIES ONE CARVE-OUT, AND WITHOUT IT THE HARD REQUIREMENT IS UNSATISFIABLE.
+      //
+      // `.recursive/memory/**` is OUTSIDE `.recursive/run/<runId>/`, so this rule denied the very
+      // write phase 8 exists to make: under the shipped strict default an agent authoring its memory
+      // doc was refused as if it were editing the implementation. MEASURED, not assumed — the rule's
+      // own predicate answers `deny` for `.recursive/memory/...` in the phase whose whole job is that
+      // plane. So phase 8, and only phase 8, admits THIS PLUGIN'S OWN plane:
+      //   - the source tree stays denied (the implementation is frozen, and that is the rule's point);
+      //   - `.recursive/DECISIONS.md` / `.recursive/STATE.md` stay denied here — phases 6 and 7 own
+      //     them, and `writesOwnMemoryPlane` is deliberately narrower than `writesMemoryPlane`;
+      //   - a target that cannot be placed stays denied, because the carve-out must never fail open.
+      // ADVISORY IS UNCHANGED BY THIS: that mode coerces a `deny` into an `ask` and then into an
+      // allow-with-warning anyway, so the carve-out only changes what STRICT refuses.
+      predicate: (_id, args, ctx) => (
+        writesOutsideRunTree(args, ctx) && !(phase === '8' && writesOwnMemoryPlane(args, ctx))
+          ? { verdict: 'deny' }
+          : null
+      ),
     })
   }
 
@@ -481,6 +624,24 @@ function memoryPlanePath(abs: string): boolean {
   return /\/(decisions|state)\.md$/i.test(normalized) || /\/\.recursive\/memory(\/|$)/.test(normalized)
 }
 
+/**
+ * True when the call writes `.recursive/memory/**` — THIS PLUGIN'S OWN plane, and nothing else.
+ *
+ * ⚠ DELIBERATELY NARROWER THAN {@link writesMemoryPlane}, which also matches `DECISIONS.md` and
+ * `STATE.md`: phase 8's carve-out (T40) is about durable memory, not about handing phase 8 the two
+ * planes phases 6-7 own.
+ *
+ * ⚠ AND AN UNRESOLVABLE TARGET IS `false` HERE — the OPPOSITE of every other fail-closed answer in
+ * this file, because this is the PERMISSIVE branch: `true` means "do not deny", so a path the rules
+ * cannot place must not be admitted by it. "We could not tell where this lands" is a reason to
+ * refuse, never a reason to allow.
+ */
+function writesOwnMemoryPlane(args: Record<string, unknown>, ctx: ToolPolicyContext): boolean {
+  const abs = baselineTarget(args, ctx)
+  if (abs === 'unresolvable') return false
+  return /\/\.recursive\/memory(\/|$)/.test(abs.replace(/\\/g, '/'))
+}
+
 /**
  * Resolve a tool-target path to an absolute path. Mirrors enforcement.ts's
  * resolution rules: an absolute path stays as it is; a relative path resolves

package/src/policy-globs.ts

@@ -41,7 +41,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs'
 import { basename, dirname, join, resolve } from 'node:path'
-import { getLockStatus, getPrerequisiteBlockers } from './lock.ts'
+import { getLockStatus, getPrerequisiteBlockers, type PrerequisiteBlocker } from './lock.ts'
 import { getMdFieldValue } from './status.ts'
 import { phaseNumberForArtifact, policyTargetPath, resolveFrom } from './phase-rules.ts'
 
@@ -58,12 +58,29 @@ export interface Decision {
   kind: Verdict
   reason?: string
   rule?: string
+  /**
+   * THE FACTS THE PREDICATE DECIDED FROM, when it read any. The lock-order rule resolves the
+   * artifact's prerequisites from disk, and the layer that turns this decision into a refusal
+   * needs those same facts to build the caller's recovery options. Carrying them is what makes
+   * "the guard already has them" true: a second `getPrerequisiteBlockers` call from the denial
+   * would re-read a run tree that is on disk and unlocked, and could answer differently.
+   *
+   * Absent for every rule that decides on its pattern alone, and absent when the predicate read
+   * nothing — so its presence means "this refusal was decided from these blockers", not "the
+   * policy mentions blockers".
+   */
+  blockers?: readonly PrerequisiteBlocker[]
 }
 
 /**
  * Extra facts a rule predicate may need. `args` is always the tool call's
  * arguments; the run coordinates are present only when the caller has them
  * (a guard call from a real session does; a pure policy unit test need not).
+ *
+ * ⚠ `runId` IS NOT DECORATION: the lock-order rule puts it in the refusal (`[run: <id>]`), so a refusal
+ * names the run whose tree it was decided from. It is the run the guard RESOLVED for this call — the run
+ * the call named when it named a usable one, otherwise the active run (see `resolveGuardRunId` in
+ * `enforcement.ts`) — never a second, independently-derived answer.
  */
 export interface ToolPolicyContext {
   args: Record<string, unknown>
@@ -99,6 +116,12 @@ export interface ToolPolicyContext {
 export interface ToolPolicyPredicateMatch {
   verdict: Verdict
   detail?: string
+  /**
+   * The blockers the predicate READ, when it read any (see `Decision.blockers`). Optional and
+   * additive: a predicate that decided from something else returns none, and the engine's
+   * verdict is unchanged either way.
+   */
+  blockers?: readonly PrerequisiteBlocker[]
 }
 
 export type ToolPolicyPredicate = (
@@ -338,7 +361,7 @@ export function evaluateToolPolicy(
       // Abstention: this rule does not govern this call, so it does not
       // participate and the next rule in precedence order decides.
       if (match === null) continue
-      return decide(rule, match.verdict, match.detail ? rule.reason + ' ' + match.detail : rule.reason)
+      return decide(rule, match.verdict, match.detail ? rule.reason + ' ' + match.detail : rule.reason, match.blockers)
     }
     return decide(rule, rule.verdict, rule.reason)
   }
@@ -347,10 +370,17 @@ export function evaluateToolPolicy(
   return { kind: 'ask', reason: 'no policy rule matches ' + id + ' - ask is the no-match default' }
 }
 
-/** One place where a rule's verdict becomes a decision, so `label` cannot drift. */
-function decide(rule: ToolPolicyRule, kind: Verdict, reason: string): Decision {
+/**
+ * One place where a rule's verdict becomes a decision, so `label` cannot drift.
+ *
+ * `blockers` rides along untouched when the predicate supplied any (see `Decision.blockers`);
+ * an EMPTY list is dropped rather than carried, so `blockers` on a decision always means "there
+ * were blockers", never "the rule looked and found none".
+ */
+function decide(rule: ToolPolicyRule, kind: Verdict, reason: string, blockers?: readonly PrerequisiteBlocker[]): Decision {
   const decision: Decision = { kind, reason }
   if (rule.label) decision.rule = rule.label
+  if (blockers !== undefined && blockers.length > 0) decision.blockers = blockers
   return decision
 }
 
@@ -419,13 +449,39 @@ export const LOCK_TOOL_NAMES = new Set(['recursive_lock', 'recursive_lock_phase'
  * sentence; the predicate adds the blocking artifact and its status, which is
  * what distinguishes a guard refusal from `lockArtifact`'s own
  * `Prerequisite blockers:` error (`tests/guard-path.spec.ts` asserts both).
+ *
+ * ⚠ ISSUE 2 (b) — AND IT NAMES THE RUN IT READ, `ctx.runId`, as `[run: <id>]`.
+ *
+ * The blockers above are read FROM A DIRECTORY (`runDir`), and until this suffix existed the refusal said
+ * only "an earlier phase must be locked first  00-requirements.md (DRAFT)" — a sentence with no run in it.
+ * That is what let a refusal MIX TWO RUNS in one payload: a call naming run-b could be judged against
+ * run-a's tree (the guard resolved the run from the filesystem, the tool from `args.runId`) and the caller
+ * was told about `00-requirements.md (DRAFT)` while the guard-decision record said `runId: run-a` and the
+ * gate-block ask said `artifact: 01-as-is.md`. The blocking artifact, the artifact the caller named and the
+ * run the record attributed it to were three answers to one question.
+ *
+ * The fix is two-sided: the guard now judges the run the CALL NAMES (see `resolveGuardRunId` in
+ * `enforcement.ts`), and this suffix makes the evaluated run part of the sentence, so the payload can be
+ * read without cross-referencing the log record — and a reader can SEE which run was read, which is what
+ * makes a future mismatch visible instead of silent.
+ *
+ * `runId` is optional because the pure policy layer may be called with no run context at all (a policy
+ * unit test, a preview probe): the sentence is then exactly what it always was, and no run is invented.
  */
-function lockOrderRule(artifact: unknown, runDir: string | undefined): ToolPolicyPredicateMatch | null {
+function lockOrderRule(artifact: unknown, runDir: string | undefined, runId?: string): ToolPolicyPredicateMatch | null {
   const name = String(artifact ?? '')
   if (!name || !runDir) return null
   const blockers = getPrerequisiteBlockers(runDir, name)
   if (blockers.length === 0) return null
-  return { verdict: 'deny', detail: blockers.map((b) => b.artifact + ' (' + b.status + ')').join(', ') }
+  const where = typeof runId === 'string' && runId.trim() !== '' ? ' [run: ' + runId.trim() + ']' : ''
+  return {
+    verdict: 'deny',
+    detail: blockers.map((b) => b.artifact + ' (' + b.status + ')').join(', ') + where,
+    // THE SAME READ, carried up rather than thrown away: the denial's recovery options are built
+    // from these blockers, and re-deriving them one layer higher would be a second filesystem
+    // answer to a question this rule has already answered.
+    blockers,
+  }
 }
 
 /**
@@ -571,7 +627,7 @@ export function builtInToolPolicyRules(): ToolPolicyRule[] {
       verdict: 'deny',
       reason: 'monotonic lock-order: an earlier phase must be locked first',
       label: 'lock-order',
-      predicate: (id, args, ctx) => (LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null),
+      predicate: (id, args, ctx) => (LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir, ctx.runId) : null),
     },
   ]
   for (const name of WRITE_TOOL_NAMES) {
@@ -630,7 +686,7 @@ export function builtInToolPolicyDefault(): ToolPolicy {
 export function attachPolicyPredicate(rule: ToolPolicyRule): ToolPolicyRule {
   if (rule.predicate) return rule
   if (rule.pattern === 'recursive_lock*') {
-    return { ...rule, predicate: (id, args, ctx) => (LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null) }
+    return { ...rule, predicate: (id, args, ctx) => (LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir, ctx.runId) : null) }
   }
   // ⚠ THE LABEL IS CONSULTED BEFORE THE PATTERN, because the phase-order rule and the
   // locked-artifact rule share EVERY write-tool pattern (see `builtInToolPolicyRules`).

package/src/recursive_ask.tool.ts

@@ -170,6 +170,54 @@ export function buildAskQuestion(gateId: AskGateId): AskQuestion {
   })
 }
 
+/**
+ * FU-7 — THE GATE-BLOCK REFUSAL PAYLOAD, BUILT IN ONE PLACE.
+ *
+ * A blocked lock is refused by TWO layers. The TOOL refuses when `lockArtifact` throws
+ * `Prerequisite blockers:`; the GUARD refuses pre-dispatch when the lock-order rule fires
+ * (`monotonic lock-order`), and under the strict default that is the layer the caller meets
+ * first. Both must hand the caller the SAME choice, so both build it HERE.
+ *
+ * ⚠ WHY NOT TWO LITERALS. `fix | reopen | abandon` is the human's way out of a blocked lock,
+ * and it existed in exactly one call site (`recursive_lock.tool.ts`). The guard's refusal moved
+ * to the default path, and a second hand-written copy of the options there would be a second
+ * answer to "what can a person do about this?": the day the options change, one of the two
+ * refusals keeps offering the old set and nothing fails. One builder, called from both.
+ *
+ * `blocked` is the refusal's OWN sentence — the guard's rule text or the tool's exception
+ * message — carried as data so the payload says what it is about without a reader having to
+ * match it against the text beside it.
+ */
+export interface GateBlockAsk extends AskQuestion {
+  gate: 'gate-block'
+  artifact: string
+  blocked: string
+}
+
+/** The payload, as the refusal carries it. Validated through `buildAskQuestion`. */
+export function buildGateBlockAsk(artifact: string, blocked: string): GateBlockAsk {
+  return { gate: 'gate-block', ...buildAskQuestion('gate-block'), artifact, blocked }
+}
+
+/**
+ * FU-7 — THE OPTIONS AS TEXT, DERIVED FROM THE PAYLOAD rather than restated.
+ *
+ * WHY A RENDERER IS NEEDED AT ALL: the harness renders a `tools/pre-execute` denial as
+ * `Error: <reason>` and drops every other field of the decision (measured in
+ * `packages/core/tools`: `content: [{ type: 'text', text: 'Error: ' + denialReason }]`), so an
+ * ask that rode along as a SIBLING field would reach the model as nothing at all — which is
+ * exactly how a strict-by-default guard made the recovery path unreachable. The refusal
+ * therefore renders the payload into the text it hands back, and it renders THIS object, so
+ * the visible sentence and the structured payload cannot disagree.
+ */
+export function renderGateBlockAsk(ask: GateBlockAsk): string {
+  const options = ask.options
+    .map((option) => option.label + (option.description === undefined ? '' : ' (' + option.description + ')'))
+    .join(' ')
+  const target = ask.artifact === '' ? 'recursive_ask gate=gate-block' : 'recursive_ask gate=gate-block artifact=' + ask.artifact
+  return ask.header + ': ' + ask.question + ' Options: ' + options + ' Answer with ' + target + '.'
+}
+
 /**
  * PHASE 0 — build the question for ANY accepted gate, including the run-start gate.
  *

package/src/recursive_lock.tool.ts

@@ -1,6 +1,6 @@
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { codeRuntimeRefusal, toolError } from './errors.ts'
-import { buildAskQuestion } from './recursive_ask.tool.ts'
+import { buildGateBlockAsk } from './recursive_ask.tool.ts'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import type { RecursiveRuntime } from './runtime.ts'
 
@@ -37,10 +37,16 @@ export function createRecursiveLockTool(recursive: RecursiveRuntime) {
         // ⚠ IT IS ATTACHED TO THE ORDERING REFUSAL SPECIFICALLY (`Prerequisite blockers:`), because that
         // is the one a human resolves. A missing run id or an already-locked artifact is a caller mistake
         // with a mechanical fix, and offering "reopen / abandon the run" for those would be noise.
+        //
+        // ⚠ AND THE PAYLOAD COMES FROM `buildGateBlockAsk`, NOT FROM A LITERAL HERE. The GUARD refuses
+        // the same ordering violation pre-dispatch (it resolves the same blockers from the same run
+        // tree) and attaches this same payload; one builder is what keeps the two refusals offering the
+        // same options. This branch still fires whenever the guard ABSTAINS — most visibly when the call
+        // names a run other than the active one, because the guard resolves the run from the filesystem.
         if (message.startsWith('Prerequisite blockers:')) {
           return {
             error: refusal,
-            ask: { gate: 'gate-block', ...buildAskQuestion('gate-block'), artifact: args.artifact ?? '', blocked: message },
+            ask: buildGateBlockAsk(args.artifact ?? '', message),
           } as unknown as JsonValue
         }
         return { error: refusal } as const

package/src/runtime.ts

@@ -32,7 +32,7 @@ import { readScratch, writeScratch, appendScratch, type ScratchTarget } from './
 import { buildReviewBundle, type ReviewBundleInput } from './review.ts'
 import { readMemoryEntries, retrieveMemory, renderMemorySection, selectMemory } from './memory.ts'
 import { readFeedback, recordInjection, settleInjections } from './memory-feedback.ts'
-import { runPhase8Trigger, resolveExtractor, spawnExtractorRunner } from './training.ts'
+import { runPhase8Trigger, resolveExtractor, spawnExtractorRunner, phase8MemoryLockRefusal } from './training.ts'
 import { buildAskQuestion, GATE_DEFAULT_ARTIFACT, pendingGateFor } from './recursive_ask.tool.ts'
 import { contractDigest } from './policy.ts'
 import type { WorkflowEngineLike } from './workflow-audit.ts'
@@ -575,14 +575,17 @@ export class RecursiveRuntime extends Service {
             // stdio a capture needs, and the response file is the parent's own interface anyway.
             runner: spawnExtractorRunner({ cwd: root, responseFile: join(runDir, 'training-response.json') }),
             write: (relativePath, content) => {
-              const target = join(root, relativePath)
+              // T40 - WRITER/READER AGREEMENT. The shards this trigger writes are memory-plane docs, so they
+              // belong under .recursive/memory/ where the plane lint, the registry and the phase-8 artifact all
+              // look - the seam previously joined them onto the workspace root, landing them OUTSIDE the plane.
+              const target = join(root, '.recursive', relativePath)
               mkdirSync(dirname(target), { recursive: true })
               writeFileSync(target, content, 'utf8')
               return relativePath
             },
             readText: (relativePath) => {
               try {
-                return readFileSync(join(root, relativePath), 'utf8')
+                return readFileSync(join(root, '.recursive', relativePath), 'utf8')
               } catch {
                 return null
               }
@@ -1881,7 +1884,7 @@ export class RecursiveRuntime extends Service {
     return coupleGateBlockToGoal(goalService as never, agent, ref, reason)
   }
 
-  /** Phase C R7: resolve the enforcement config (strict|advisory, default advisory). */
+  /** Phase C R7: resolve the enforcement config (strict|advisory, default strict). */
   get enforcementConfig(): EnforcementConfig {
     return this._enforcementConfig ?? DEFAULT_ENFORCEMENT
   }