@vellumai/assistant 0.11.2 → 0.11.3-dev.202608080427.92f668a

package/src/plugins/defaults/memory/__tests__/memory-retrospective-prompt.test.ts

@@ -3,6 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
+import { MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT } from "../memory-retrospective-constants.js";
 import {
   buildForkInstruction,
   type ForkInstructionArgs,
@@ -47,7 +48,7 @@ Two dedup sources to skip:
 1. Anything semantically captured in <already_remembered> above (from prior retrospective passes).
 2. Anything you already called \`remember\` on inline within your review window — those appear as \`tool_use\` blocks with \`name: "remember"\` in your history.
 
-For everything else in your review window, use the \`remember\` tool on facts, plans, decisions, preferences, names, dates, felt moments, corrections, commitments, or anything else concrete and worth carrying forward. When several facts are worth saving, pass them all as an array to a single \`remember\` call rather than calling it once per fact. If nothing new is worth saving, say "Nothing new to save." and stop.
+For everything else in your review window, use the \`remember\` tool on facts, plans, decisions, preferences, names, dates, felt moments, corrections, commitments, or anything else concrete and worth carrying forward. When several facts are worth saving, pass them all as an array to a single \`remember\` call rather than calling it once per fact. If nothing new is worth saving, reply with exactly "Nothing new to save." and stop.
 `);
   });
 
@@ -120,7 +121,7 @@ For everything else in your review window, use the \`remember\` tool on facts, p
     expect(out).not.toContain("PROCEDURE");
     expect(
       out.endsWith(
-        'If nothing new is worth saving, say "Nothing new to save." and stop.\n',
+        'If nothing new is worth saving, reply with exactly "Nothing new to save." and stop.\n',
       ),
     ).toBe(true);
   });
@@ -175,7 +176,32 @@ describe("promptOverridePath", () => {
     writeFileSync(overridePath, "Just remember the good parts.\n");
     expect(
       buildForkInstruction(makeArgs({ promptOverridePath: overridePath })),
-    ).toBe("Just remember the good parts.\n");
+    ).toBe(
+      "Just remember the good parts.\n\n\n" +
+        `If nothing new is worth saving, reply with exactly "${MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT}" and stop.`,
+    );
+  });
+
+  test("an override that drops the no-findings mandate still carries the finalizer's exact-reply contract", () => {
+    // The finalizer advances a no-findings window only on a persisted reply
+    // that trims to exactly MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT. An
+    // override author who never read that code would otherwise stall every
+    // no-findings window forever, so the mandate must survive any override.
+    const overridePath = join(dir, "mandate-free.md");
+    writeFileSync(
+      overridePath,
+      "Review the window and save what matters. If nothing matters, do nothing.\n",
+    );
+    const out = buildForkInstruction(
+      makeArgs({ promptOverridePath: overridePath }),
+    );
+    expect(out).toContain(
+      `reply with exactly "${MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT}"`,
+    );
+    // The mandate references the same constant the finalizer compares
+    // against, so the two cannot drift; guard the constant's exact value here
+    // to make an accidental rewording loud.
+    expect(MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT).toBe("Nothing new to save.");
   });
 
   test("missing override file falls back to the bundled rendering", () => {
@@ -200,3 +226,13 @@ describe("promptOverridePath", () => {
     expect(out).not.toContain("SENSITIVE FILE CONTENTS");
   });
 });
+
+// The finalizer's explicit-no-findings gate matches persisted assistant text
+// against MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT by strict equality, and the
+// bundled instruction is what teaches the model to emit it. This guard fails
+// if either side drifts.
+test("bundled template mandates the exact no-findings sentinel the finalizer matches", () => {
+  expect(RETROSPECTIVE_INSTRUCTION_TEMPLATE).toContain(
+    `reply with exactly "${MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT}" and stop.`,
+  );
+});

package/src/plugins/defaults/memory/__tests__/memory-retrospective-provider-path.test.ts

@@ -0,0 +1,493 @@
+/**
+ * LUM-3013 regression: the retrospective's fail-closed advancement gate must
+ * hold through the REAL producer chain, not just against a mocked wake.
+ *
+ * These tests run the real `memoryRetrospectiveJob` handler → the real
+ * `wakeAgentForOpportunity` (runtime/agent-wake.ts, NOT mocked) → a
+ * conversation double whose `agentLoop` is a real `AgentLoop` driven by a
+ * scripted fake `Provider`. Only the provider and the daemon/persistence
+ * boundaries are test doubles, so the chain exercises the actual mechanism
+ * behind the bug:
+ *
+ *   - `AgentLoop.run` SWALLOWS provider rejections: the outer catch
+ *     (agent/loop.ts, `onEvent({ type: "error" })` + `stopTurn("error")`)
+ *     returns normally with the history unchanged.
+ *   - The wake then finds no tail output and takes its silent no-op branch
+ *     (agent-wake.ts), returning `{ invoked: true, producedToolCalls: false }`.
+ *   - `invoked: true` alone must therefore NOT advance
+ *     `memory_retrospective_state`: the handler re-reads the fork's persisted
+ *     rows (`collectRetrospectiveRunEvidence` → `loadRetrospectiveRunMessages`
+ *     → `getMessages`) and only advances when a durable memory-writing
+ *     `tool_use` (`remember` / `scaffold_managed_skill`) was persisted by THIS
+ *     run.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mock state. Reset between tests.
+// ---------------------------------------------------------------------------
+
+const SOURCE_ID = "src-conv-1";
+const FORK_ID = "fork-conv-1";
+
+let stateUpserts: Array<{
+  conversationId: string;
+  lastProcessedMessageId: string;
+  lastRunAt: number;
+  rememberedLog?: string[];
+}> = [];
+let lastRunAtBumps: Array<{ conversationId: string; lastRunAt: number }> = [];
+
+let newMessages: Array<{
+  id: string;
+  createdAt: number;
+  role?: string;
+  content?: string | Array<Record<string, unknown>>;
+  metadata?: string | null;
+}> = [];
+
+/**
+ * Persisted message rows, keyed by conversation id. `addMessage` appends here
+ * and `getMessages` reads it back. The same store serves the handler's
+ * instruction staging, the wake's tail persistence, and the finalizer's
+ * durable-evidence read, so the evidence gate sees exactly what the real
+ * producer chain persisted.
+ */
+type PersistedRow = {
+  role: string;
+  content: string;
+  createdAt: number;
+  metadata: string | null;
+};
+let messageStores: Record<string, PersistedRow[]> = {};
+let persistedMessageCounter = 0;
+
+let deletedConversationIds: string[] = [];
+let forkCalls: Array<{ conversationId: string; throughMessageId?: string }> =
+  [];
+
+// ---------------------------------------------------------------------------
+// Retrospective-side mocks (mirroring memory-retrospective-job.test.ts, but
+// WITHOUT mocking ../../../../runtime/agent-wake.js: the wake runs real).
+// ---------------------------------------------------------------------------
+
+mock.module("../memory-retrospective-state.js", () => ({
+  getRetrospectiveState: (_id: string) => null,
+  upsertRetrospectiveState: (args: {
+    conversationId: string;
+    lastProcessedMessageId: string;
+    lastRunAt: number;
+    rememberedLog?: string[];
+  }) => {
+    stateUpserts.push(args);
+  },
+  bumpRetrospectiveLastRunAt: (conversationId: string, lastRunAt: number) => {
+    lastRunAtBumps.push({ conversationId, lastRunAt });
+  },
+  appendToRememberedLog: (existing: string[], newEntries: string[]) => [
+    ...existing,
+    ...newEntries,
+  ],
+}));
+
+mock.module("../find-most-recent-retrospective-for.js", () => ({
+  findMostRecentRetrospectiveFor: (_id: string) => null,
+}));
+
+mock.module("../../../../persistence/conversation-crud.js", () => ({
+  getMessagesAfter: (_id: string, _afterId: string | null) => newMessages,
+  getMessages: (id: string) => messageStores[id] ?? [],
+  // `defaultResolveTarget` in the REAL wake reads the FORK id's row for the
+  // archived check, so both rows carry archivedAt/createdAt. The fork's
+  // "user" source makes `loadRetrospectiveRunMessages` treat every persisted
+  // row as the run's own (legacy-kind), the simplest faithful setup here.
+  getConversation: (id: string) => {
+    if (id === FORK_ID) {
+      return {
+        source: "user",
+        forkParentMessageId: null,
+        title: "Fork",
+        archivedAt: null,
+        createdAt: "2026-01-01T00:00:00.000Z",
+      };
+    }
+    return {
+      source: "user",
+      forkParentMessageId: null,
+      title: "Source conversation",
+      archivedAt: null,
+      createdAt: "2026-01-01T00:00:00.000Z",
+    };
+  },
+  isConversationProcessing: (_id: string) => false,
+  getConversationProcessingStartedAt: (_id: string) => null,
+  forkConversationForRetrospective: async (params: {
+    conversationId: string;
+    throughMessageId?: string;
+  }) => {
+    forkCalls.push(params);
+    return { id: FORK_ID };
+  },
+  addMessage: async (
+    conversationId: string,
+    role: string,
+    content: string,
+    _options: unknown,
+  ) => {
+    const store = (messageStores[conversationId] ??= []);
+    store.push({ role, content, createdAt: Date.now(), metadata: null });
+    persistedMessageCounter += 1;
+    return { id: `msg-${persistedMessageCounter}` };
+  },
+  deleteConversation: (id: string) => {
+    deletedConversationIds.push(id);
+  },
+  deleteConversationGently: async (id: string) => {
+    deletedConversationIds.push(id);
+    return { segmentIds: [], deletedSummaryIds: [] };
+  },
+  resolveOverrideProfile: () => undefined,
+  getConversationOverrideProfile: () => undefined,
+  provenanceFromTrustContext: () => ({}),
+  reserveMessage: async () => ({ id: "msg-reserve" }),
+}));
+
+mock.module("../../../../daemon/trust-context.js", () => ({
+  INTERNAL_GUARDIAN_TRUST_CONTEXT: {
+    sourceChannel: "vellum",
+    trustClass: "guardian",
+  },
+}));
+
+mock.module("../../../../prompts/persona-resolver.js", () => ({
+  resolveUserSlug: (_trustContext: unknown) => "alice",
+}));
+
+mock.module("../../../../persistence/jobs-store.js", () => ({
+  enqueueMemoryJob: () => "follow-up-job-id",
+  upsertMemoryRetrospectiveJob: () => {},
+}));
+
+mock.module("../../../../telemetry/watchdog-events-store.js", () => ({
+  recordWatchdogEvent: () => {},
+}));
+
+mock.module("../../../../config/memory-v3-gate.js", () => ({
+  isMemoryEnabled: (config?: { memory?: { enabled?: boolean } }) =>
+    config?.memory?.enabled !== false,
+  isV3TierActive: () => false,
+  isMemoryV3Live: () => false,
+  usesConceptPageMemory: () => false,
+}));
+
+mock.module("../../../../daemon/conversation-registry.js", () => ({
+  findConversation: (_id: string | undefined) => undefined,
+}));
+
+// ---------------------------------------------------------------------------
+// Wake-side boundary mocks (mirroring runtime/__tests__/agent-wake.test.ts,
+// with relative paths adjusted for this directory).
+// ---------------------------------------------------------------------------
+
+mock.module("../../../../persistence/conversation-disk-view.js", () => ({
+  syncMessageToDisk: () => {},
+}));
+
+mock.module("../../../../runtime/assistant-event-hub.js", () => ({
+  broadcastMessage: () => {},
+}));
+
+mock.module("../../../../runtime/sync/resource-sync-events.js", () => ({
+  publishConversationMessagesChanged: () => {},
+}));
+
+mock.module("../../../../daemon/conversation-store.js", () => ({
+  // The real wake's `defaultResolveTarget` lands here after the archived
+  // check; it must yield the live fork conversation the run executes on.
+  getOrCreateConversation: async (
+    _conversationId: string,
+    _options?: unknown,
+  ) => makeForkConversationDouble(),
+}));
+
+mock.module("../../../../config/llm-context-resolution.js", () => ({
+  resolveEffectiveContextWindow: () => ({ maxInputTokens: 200_000 }),
+}));
+
+mock.module("../../../../daemon/disk-pressure-guard.js", () => ({
+  getDiskPressureStatus: () => ({
+    enabled: false,
+    state: "disabled",
+    locked: false,
+    acknowledged: false,
+    overrideActive: false,
+    effectivelyLocked: false,
+    lockId: null,
+    usagePercent: null,
+    thresholdPercent: 95,
+    path: null,
+    lastCheckedAt: null,
+    blockedCapabilities: [],
+    error: null,
+  }),
+}));
+
+mock.module("../../../../daemon/conversation-usage.js", () => ({
+  recordUsage: () => {},
+}));
+
+mock.module("../../../../persistence/llm-request-log-store.js", () => ({
+  recordRequestLog: () => "log-id",
+  backfillMessageIdOnLogs: () => {},
+  setAgentLoopExitReasonOnLatestLog: () => {},
+  buildProviderErrorResponsePayload: (error: unknown) => ({
+    error: String(error),
+  }),
+}));
+
+import { AgentLoop } from "../../../../agent/loop.js";
+import type { Conversation } from "../../../../daemon/conversation.js";
+import type { MemoryJob } from "../../../../persistence/jobs-store.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+  SendMessageOptions,
+} from "../../../../providers/types.js";
+import { ProviderError } from "../../../../util/errors.js";
+import { memoryRetrospectiveJob } from "../memory-retrospective-job.js";
+
+// ---------------------------------------------------------------------------
+// Fake provider: the ONLY seam scripted per scenario. Everything between the
+// job handler and this `sendMessage` is real production code.
+// ---------------------------------------------------------------------------
+
+let providerCalls: Array<{ messages: Message[] }> = [];
+let providerImpl: (
+  messages: Message[],
+  options?: SendMessageOptions,
+) => Promise<ProviderResponse> = async () => textOnlyResponse("unused");
+
+const fakeProvider: Provider = {
+  name: "fake-provider",
+  async sendMessage(
+    messages: Message[],
+    options?: SendMessageOptions,
+  ): Promise<ProviderResponse> {
+    providerCalls.push({ messages: [...messages] });
+    return providerImpl(messages, options);
+  },
+};
+
+function textOnlyResponse(text: string): ProviderResponse {
+  return {
+    content: [{ type: "text", text }],
+    model: "test-model",
+    usage: { inputTokens: 10, outputTokens: 5 },
+    stopReason: "end_turn",
+  };
+}
+
+function rememberToolUseResponse(): ProviderResponse {
+  return {
+    content: [
+      { type: "text", text: "Saving one fact." },
+      {
+        type: "tool_use",
+        id: "tu-1",
+        name: "remember",
+        input: { content: "provider-path fact" },
+      },
+    ],
+    model: "test-model",
+    usage: { inputTokens: 10, outputTokens: 5 },
+    stopReason: "tool_use",
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Conversation double: minimal structural stand-in for the fork the wake
+// resolves. Its `agentLoop` is a REAL AgentLoop over the fake provider; its
+// message history hydrates from the persisted store (so the instruction row
+// the handler staged is the run's baseline, exactly like a DB rehydration).
+// ---------------------------------------------------------------------------
+
+function makeForkConversationDouble(): Conversation {
+  const messages: Message[] = (messageStores[FORK_ID] ?? []).map((row) => ({
+    role: row.role as Message["role"],
+    content: JSON.parse(row.content) as Message["content"],
+  }));
+  const realLoop = new AgentLoop({
+    provider: fakeProvider,
+    systemPrompt: "test",
+    conversationId: FORK_ID,
+    // Real executor round-trip: the finalizer's durable-evidence gate
+    // requires a matching successful tool_result, so the loop must execute
+    // the remember call and persist its result exactly as production does.
+    toolExecutor: async (name: string) => {
+      if (name === "remember") {
+        return { content: "Saved.", isError: false };
+      }
+      return { content: `unknown tool ${name}`, isError: true };
+    },
+  });
+  const conversation = {
+    conversationId: FORK_ID,
+    messages,
+    getMessages: () => messages,
+    isProcessing: () => false,
+    setProcessing: (_on: boolean) => {},
+    waitForIdle: async (_opts: { timeoutMs: number }) => true,
+    drainQueue: async () => {},
+    maybeCompact: async () => null,
+    subagentAllowedTools: undefined,
+    setSubagentAllowedTools: (_tools: Set<string> | undefined) => {},
+    preactivatedSkillIds: undefined,
+    setPreactivatedSkillIds: (_ids: readonly string[] | undefined) => {},
+    trustContext: undefined,
+    setTrustContext: (_ctx: unknown) => {},
+    currentTurnTrustContext: undefined,
+    wakePersonaOverride: undefined,
+    contextWindowManager: { estimateInputTokens: () => 0 },
+    getTurnChannelContext: () => null,
+    getTurnInterfaceContext: () => null,
+    buildCurrentSystemPrompt: () => "test-system-prompt",
+    provider: { name: "fake-provider" },
+    usageStats: {},
+    modelOverride: undefined,
+    agentLoop: {
+      run: (options: Parameters<AgentLoop["run"]>[0]) => realLoop.run(options),
+    },
+  };
+  return conversation as unknown as Conversation;
+}
+
+// ---------------------------------------------------------------------------
+// Job/config helpers (shape copied from memory-retrospective-job.test.ts).
+// ---------------------------------------------------------------------------
+
+function makeConfig(): Parameters<typeof memoryRetrospectiveJob>[1] {
+  return {
+    memory: {
+      v2: { enabled: true },
+      retrospective: {
+        enabled: true,
+        keepSupersededRuns: false,
+        matchConversationProfile: false,
+        promptPath: null,
+        requireUserActivity: false,
+        sweepIntervalMs: 8 * 60 * 60 * 1000,
+        sweepLookbackMs: 7 * 24 * 60 * 60 * 1000,
+      },
+    },
+    ui: {
+      userTimezone: undefined,
+      detectedTimezone: undefined,
+    },
+  } as unknown as Parameters<typeof memoryRetrospectiveJob>[1];
+}
+
+const stubConfig = makeConfig();
+
+function makeJob(conversationId = SOURCE_ID): MemoryJob<{
+  conversationId?: string;
+}> {
+  return {
+    id: "job-1",
+    type: "memory_retrospective",
+    payload: { conversationId },
+    status: "pending",
+    attempts: 0,
+    deferrals: 0,
+    runAfter: 0,
+    lastError: null,
+    startedAt: null,
+    createdAt: 0,
+    updatedAt: 0,
+  };
+}
+
+describe("memoryRetrospectiveJob through the real wake + real agent loop", () => {
+  beforeEach(() => {
+    stateUpserts = [];
+    lastRunAtBumps = [];
+    deletedConversationIds = [];
+    forkCalls = [];
+    messageStores = {};
+    persistedMessageCounter = 0;
+    providerCalls = [];
+    providerImpl = async () => textOnlyResponse("unused");
+    newMessages = [
+      { id: "m1", createdAt: Date.parse("2026-05-11T10:00:00Z") },
+      { id: "m2", createdAt: Date.parse("2026-05-11T10:05:00Z") },
+      { id: "m3", createdAt: Date.parse("2026-05-11T10:10:00Z") },
+    ];
+  });
+
+  test("real provider rejection is classified at the wake layer and leaves the window retryable", async () => {
+    // The wake's exit-reason classifier fails a swallowed rejection before
+    // finalization (invoked: false, reason run_error), so the handler
+    // reports wake_failed. Full rejection-chain coverage (state
+    // preservation, prior-fork survival, retry consuming the window) lives
+    // in memory-retrospective-wake-chain.test.ts; this case pins only the
+    // layered outcome and that the finalizer was never reached.
+    providerImpl = async () => {
+      throw new ProviderError(
+        "This model (test-model) doesn't support image input. Remove the image or switch to a vision-capable model.",
+        "openai",
+        400,
+      );
+    };
+
+    const outcome = await memoryRetrospectiveJob(makeJob(), stubConfig);
+
+    expect(outcome.kind).toBe("wake_failed");
+    if (outcome.kind === "wake_failed") {
+      expect(outcome.reason).toBe("run_error");
+    }
+    expect(providerCalls.length).toBeGreaterThanOrEqual(1);
+    expect(stateUpserts).toHaveLength(0);
+    expect(lastRunAtBumps).toHaveLength(1);
+    expect(deletedConversationIds).toEqual([FORK_ID]);
+  });
+
+  test("durable remember persisted through the real loop advances the cursor", async () => {
+    // Scenario B: first call emits a `remember` tool_use; the loop (built
+    // without a tool executor) stops after persisting the tool-bearing
+    // assistant message, and the wake's tail persistence writes it through
+    // `addMessage`. Subsequent calls (defensive) return plain text.
+    let call = 0;
+    providerImpl = async () => {
+      call += 1;
+      return call === 1 ? rememberToolUseResponse() : textOnlyResponse("Done.");
+    };
+
+    const outcome = await memoryRetrospectiveJob(makeJob(), stubConfig);
+
+    expect(outcome.kind).toBe("invoked");
+    expect(providerCalls.length).toBeGreaterThanOrEqual(1);
+    expect(stateUpserts).toHaveLength(1);
+    expect(stateUpserts[0]!.lastProcessedMessageId).toBe("m3");
+    expect(stateUpserts[0]!.rememberedLog).toContain("provider-path fact");
+    // The durable evidence really flowed through persistence: the fork store
+    // holds the instruction row plus the wake-persisted tool_use tail.
+    const persistedRoles = messageStores[FORK_ID]!.map((row) => row.role);
+    expect(persistedRoles[0]).toBe("user");
+    expect(persistedRoles).toContain("assistant");
+    expect(lastRunAtBumps).toHaveLength(0);
+  });
+
+  test("clean empty reply through the real loop does not advance", async () => {
+    // Scenario C: the model answers with analysis text and no tool calls.
+    // The wake persists the text tail (visible output), but with zero
+    // durable memory-writing tool calls the gate must refuse to advance.
+    providerImpl = async () => textOnlyResponse("Nothing worth saving.");
+
+    const outcome = await memoryRetrospectiveJob(makeJob(), stubConfig);
+
+    expect(outcome.kind).toBe("no_usable_output");
+    expect(providerCalls.length).toBeGreaterThanOrEqual(1);
+    expect(stateUpserts).toHaveLength(0);
+  });
+});

package/src/plugins/defaults/memory/__tests__/memory-retrospective-wake-chain.test.ts

@@ -409,9 +409,10 @@ describe("memory retrospective wake state chain (real AgentLoop)", () => {
     expect(listRetroForksOf(fixture.sourceId)).toEqual([fixture.priorRetroId]);
 
     // (2) The window stays retryable: the same slice succeeds on retry.
-    providerScript = [
-      { response: textResponse("Reviewed. Nothing new worth saving.") },
-    ];
+    // The finalizer's usable-output gate accepts free text only when it is
+    // exactly the mandated no-findings sentinel; a verified remember write
+    // is the other accepted evidence. Use the sentinel for the control.
+    providerScript = [{ response: textResponse("Nothing new to save.") }];
     providerCallCount = 0;
     const retry = await runForkBasedRetrospective(
       fixture.sourceId,
@@ -459,7 +460,7 @@ describe("memory retrospective wake state chain (real AgentLoop)", () => {
     expect(listRetroForksOf(fixture.sourceId)).toEqual([fixture.priorRetroId]);
 
     // The window stays retryable and a usable reply consumes it.
-    providerScript = [{ response: textResponse("Reviewed; nothing new.") }];
+    providerScript = [{ response: textResponse("Nothing new to save.") }];
     providerCallCount = 0;
     const retry = await runForkBasedRetrospective(
       fixture.sourceId,

package/src/plugins/defaults/memory/__tests__/memory-tier-boundary-guard.test.ts

@@ -196,7 +196,7 @@ interface TierKeyExemption {
  *   shape.
  * - `telemetry/config-setting-snapshot.ts` (both) — reports both tier keys
  *   as-is.
- * - the six named migrations — append-only history that rewrites or reads the
+ * - the named migrations: append-only history that rewrites or reads the
  *   historical tier keys it was written for. Listed per file, not per
  *   directory: a future migration reading a tier key is a new decision and
  *   gets challenged like any other.
@@ -257,6 +257,10 @@ const TIER_KEY_READ_ALLOWLIST: readonly TierKeyExemption[] = [
     path: "src/workspace/migrations/135-copy-substrate-tunables.ts",
     keys: ["substrate", "v2"],
   },
+  {
+    path: "src/workspace/migrations/140-repair-seed-pinned-memory-v3-live.ts",
+    keys: ["v3"],
+  },
 ];
 
 /** Tier directory a plugin-root-relative path lives in, or `"spine"`. */