septum 0.1.7 → 0.1.8

package/src/core/parser/extractors/nestjs-semantic.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { SemanticSliceExtractor, VerticalSliceCandidate } from "./semantic-extractor.interface.ts";
@@ -14,7 +15,7 @@ export class NestJsSemanticExtractor implements SemanticSliceExtractor {
     const pkgPath = path.join(projectRoot, "package.json");
     if (fs.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readOptionalSourceFile(pkgPath, "utf-8"));
         const deps = { ...pkg.dependencies, ...pkg.devDependencies };
         if (deps["@nestjs/core"]) return true;
       } catch {}
@@ -32,7 +33,7 @@ export class NestJsSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of controllerFiles) {
       const relPath = path.relative(projectRoot, file).replace(/\\/g, "/");
-      const content = fs.readFileSync(file, "utf-8");
+      const content = readOptionalSourceFile(file, "utf-8");
 
       // Extract @Controller('prefix')
       const controllerMatch = /@Controller\s*\(\s*['"]?([^'")]*)['"]?\s*\)[\s\S]*?export\s+class\s+([A-Za-z0-9_]+)/.exec(

package/src/core/parser/schema/providers/laravel-migration-provider.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type {
@@ -35,7 +36,7 @@ export class LaravelMigrationSchemaProvider implements StackSchemaProvider {
     for (const migFile of migrationFiles) {
       const fullPath = path.join(migrationsDir, migFile);
       try {
-        const content = fs.readFileSync(fullPath, "utf-8");
+        const content = readOptionalSourceFile(fullPath, "utf-8");
         this.extractColumnsFromMigration(content, tableName, fieldsMap);
       } catch {
         // Skip unreadable files
@@ -66,7 +67,7 @@ export class LaravelMigrationSchemaProvider implements StackSchemaProvider {
         : path.join(projectRoot, entityFilePath);
       if (fs.existsSync(fullEntityPath)) {
         try {
-          const content = fs.readFileSync(fullEntityPath, "utf-8");
+          const content = readOptionalSourceFile(fullEntityPath, "utf-8");
           const tableMatch = /protected\s+\$table\s*=\s*['"]([^'"]+)['"]/.exec(content);
           if (tableMatch) {
             return tableMatch[1];
@@ -120,7 +121,7 @@ export class LaravelMigrationSchemaProvider implements StackSchemaProvider {
     if (matched.length === 0) {
       for (const f of files) {
         try {
-          const content = fs.readFileSync(path.join(migrationsDir, f), "utf-8");
+          const content = readOptionalSourceFile(path.join(migrationsDir, f), "utf-8");
           if (
             content.includes(`Schema::create('${tableName}'`) ||
             content.includes(`Schema::create("${tableName}"`) ||

package/src/core/parser/schema/providers/prisma-schema-provider.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type {
@@ -38,7 +39,7 @@ export class PrismaSchemaProvider implements StackSchemaProvider {
     if (!schemaPath) return null;
 
     try {
-      const content = fs.readFileSync(schemaPath, "utf-8");
+      const content = readOptionalSourceFile(schemaPath, "utf-8");
       const modelRegex = new RegExp(`model\\s+${entitySymbol}\\s*\\{([^}]+)\\}`, "m");
       const match = modelRegex.exec(content);
       if (!match) return null;

package/src/core/resolver/call-graph-tracer.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../resources/source-files.ts";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, normalize, relative, resolve } from "node:path";
 import type {
@@ -86,7 +87,7 @@ export class CallGraphTracer {
       if (!existsSync(fullPath)) continue;
 
       try {
-        const content = readFileSync(fullPath, "utf-8");
+        const content = readOptionalSourceFile(fullPath, "utf-8");
         const lines = content.split("\n");
 
         for (let i = 0; i < lines.length; i++) {
@@ -414,7 +415,7 @@ export class CallGraphTracer {
           fileSymbols[0];
 
         const symbolDisplay = mainSymbol
-          ? `${mainSymbol.name}${mainSymbol.kind === "class" ? "::execute" : ""}`
+          ? mainSymbol.name
           : resolvedFile.path.split("/").pop()?.replace(/\.[^.]+$/, "") || "Module";
 
         // Prevent adding duplicate stages if already present, or add as refinement
@@ -428,7 +429,7 @@ export class CallGraphTracer {
             symbol: symbolDisplay,
             file: resolvedFile.path,
             line: mainSymbol?.line_start || 1,
-            description: `${stage.toUpperCase()}: ${symbolDisplay}`,
+            description: `${stage.toUpperCase()} (dependency): ${symbolDisplay}`,
           });
         }
 

package/src/core/resolver/path-resolver.ts

@@ -1,5 +1,5 @@
-import { existsSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, normalize, resolve } from "node:path";
+import { existsSync, statSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 
 export const PROJECT_ROOT_MARKERS = [
   "package.json",
@@ -26,6 +26,7 @@ export function canonicalizePath(targetPath: string): string {
     return targetPath;
   }
   let abs = normalize(resolve(targetPath));
+  try { if (existsSync(abs)) abs = realpathSync(abs); } catch { /* Keep lexical paths for missing or inaccessible files. */ }
   if (process.platform === "win32") {
     abs = abs.replace(/^[a-zA-Z]:/, (m) => m.toUpperCase());
   }
@@ -104,7 +105,7 @@ export function findProjectRoot(fromPath: string): string {
     // Filesystem traversal error fallback
   }
 
-  return canonicalizePath(dirname(resolve(fromPath)));
+  return canonicalizePath(existsSync(fromPath) && statSync(fromPath).isDirectory() ? fromPath : dirname(resolve(fromPath)));
 }
 
 /**
@@ -117,7 +118,8 @@ export function findProjectRoot(fromPath: string): string {
 export function resolveWorkspaceRoot(pathHint?: string): string {
   if (pathHint && typeof pathHint === "string" && pathHint.trim()) {
     const trimmed = pathHint.trim().replace(/^['"]|['"]$/g, "");
-    const candidate = findProjectRoot(trimmed);
+    const absHint = resolve(trimmed);
+    const candidate = existsSync(absHint) && statSync(absHint).isDirectory() ? canonicalizePath(absHint) : findProjectRoot(trimmed);
     if (candidate && existsSync(candidate) && !isAppHostDirectory(candidate)) {
       setLastKnownProjectRoot(candidate);
       return candidate;
@@ -145,3 +147,54 @@ export function resolveWorkspaceRoot(pathHint?: string): string {
   // Fallback if inside app host directory: keep looking in lastKnown or return cwd
   return canonicalizePath(cwd);
 }
+
+/**
+ * Verifies that candidatePath is strictly contained within workspaceRoot.
+ * Resolves symlinks (realpath) if the path exists, and checks ancestor realpath if not yet created.
+ */
+export function isPathContained(candidatePath: string, workspaceRoot: string): boolean {
+  if (!candidatePath || !workspaceRoot) return false;
+  try {
+    const canonicalWorkspace = canonicalizePath(workspaceRoot);
+    const resolvedTarget = isAbsolute(candidatePath) ? normalize(candidatePath) : resolve(canonicalWorkspace, candidatePath);
+
+    // Lexical containment
+    const relLexical = relative(canonicalWorkspace, resolvedTarget).replace(/\\/g, "/");
+    if (relLexical === ".." || relLexical.startsWith("../") || isAbsolute(relLexical)) {
+      return false;
+    }
+
+    // Realpath / symlink containment
+    if (existsSync(resolvedTarget)) {
+      const realTarget = realpathSync(resolvedTarget);
+      const relReal = relative(canonicalWorkspace, realTarget).replace(/\\/g, "/");
+      if (relReal === ".." || relReal.startsWith("../") || isAbsolute(relReal)) {
+        return false;
+      }
+    } else {
+      let cur = dirname(resolvedTarget);
+      while (!existsSync(cur)) {
+        const parent = dirname(cur);
+        if (parent === cur) break;
+        cur = parent;
+      }
+      if (existsSync(cur)) {
+        const realCur = realpathSync(cur);
+        const relCur = relative(canonicalWorkspace, realCur).replace(/\\/g, "/");
+        if (relCur === ".." || relCur.startsWith("../") || isAbsolute(relCur)) {
+          return false;
+        }
+      }
+    }
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function assertPathContained(candidatePath: string, workspaceRoot: string, contextDescription = "Path"): void {
+  if (!isPathContained(candidatePath, workspaceRoot)) {
+    throw new Error(`${contextDescription} '${candidatePath}' escapes workspace boundary '${workspaceRoot}'.`);
+  }
+}

package/src/core/resources/ignore.ts

@@ -0,0 +1,35 @@
+export function shouldIgnoreSourcePath(filePath: string, ignorePatterns: string[]): boolean {
+    if (filePath.replace(/\\/g, "/").split("/").some(segment => ["node_modules", "vendor", ".git", ".septum", ".strata", ".codegraph", "dist", "build", ".output", ".nuxt", ".next", ".cache", "coverage", ".turbo"].includes(segment))) return true;
+    const normPath = filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    for (const pattern of ignorePatterns) {
+      const normPattern = pattern.replace(/\\/g, "/").replace(/^\.\//, "").trim();
+      if (!normPattern) continue;
+
+      if (normPattern === "*" || normPattern === "**") {
+        return true;
+      }
+
+      if (normPath === normPattern) return true;
+
+      if (normPattern.endsWith("/**")) {
+        const prefix = normPattern.slice(0, -3);
+        if (normPath === prefix || normPath.startsWith(prefix + "/")) return true;
+      } else if (normPattern.endsWith("/*")) {
+        const prefix = normPattern.slice(0, -2);
+        if (normPath === prefix || normPath.startsWith(prefix + "/")) return true;
+      } else if (normPath.startsWith(normPattern + "/")) {
+        return true;
+      }
+
+      if (normPattern.startsWith("*.") && normPath.endsWith(normPattern.slice(1))) {
+        return true;
+      }
+
+      const segments = normPath.split("/");
+      if (segments.includes(normPattern)) {
+        return true;
+      }
+    }
+    return false;
+  }
+

package/src/core/resources/limits.ts

@@ -0,0 +1,14 @@
+export const RESOURCE_LIMITS = Object.freeze({
+  workspaces: 4,
+  workspaceIdleMs: 10 * 60_000,
+  watches: 2048,
+  pendingPaths: 1000,
+  debounceMs: 300,
+  pollMs: 5000,
+  verifyMs: 60_000,
+  sourceBytes: 2 * 1024 * 1024,
+  batchFiles: 50,
+  batchBytes: 1024 * 1024,
+  maxQueuePending: 50,
+  shutdownMs: 5000,
+});

package/src/core/resources/source-files.ts

@@ -0,0 +1,62 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { closeSync, fstatSync, openSync, readSync, statSync } from 'node:fs';
+import { relative } from 'node:path';
+import { computeContentHash } from "../ingestion/hasher.ts";
+import { RESOURCE_LIMITS } from './limits.ts';
+
+export interface SkippedSourceFile { path: string; reason: 'file_too_large' }
+export class SourceFileLimitError extends Error {
+  constructor(public readonly filePath: string) { super(`Source file exceeds ${RESOURCE_LIMITS.sourceBytes} bytes: ${filePath}`); }
+}
+export interface SourceReadFingerprint { path: string; hash: string; size: number; mtime: number }
+const reads = new AsyncLocalStorage<{skipped: Map<string, SkippedSourceFile>; inputs: Map<string, SourceReadFingerprint>}>();
+
+// Read at most the admission limit, even if the file grows after stat.
+export function readSourceFile(filePath: string, _encoding?: string): string {
+  const fd = openSync(filePath, 'r');
+  try {
+    const size = fstatSync(fd).size;
+    if (size > RESOURCE_LIMITS.sourceBytes) throw new SourceFileLimitError(filePath);
+    let buffer = Buffer.allocUnsafe(Math.min(Math.max(size + 1, 4096), RESOURCE_LIMITS.sourceBytes + 1));
+    let count = 0;
+    while (true) {
+      const read = readSync(fd, buffer, count, buffer.length - count, null);
+      if (!read) return buffer.toString('utf8', 0, count);
+      count += read;
+      if (count > RESOURCE_LIMITS.sourceBytes) throw new SourceFileLimitError(filePath);
+      if (count === buffer.length) {
+        const expanded = Buffer.allocUnsafe(Math.min(buffer.length * 2, RESOURCE_LIMITS.sourceBytes + 1));
+        buffer.copy(expanded, 0, 0, count);
+        buffer = expanded;
+      }
+    }
+  } finally { closeSync(fd); }
+}
+
+export function readOptionalSourceFile(filePath: string, encoding?: string): string {
+  try {
+    const content = readSourceFile(filePath, encoding);
+    const collector = reads.getStore();
+    if (collector) {
+      const stat = statSync(filePath);
+      collector.inputs.set(filePath, {path:filePath,hash:computeContentHash(content),size:stat.size,mtime:stat.mtimeMs});
+    }
+    return content;
+  }
+  catch (error) {
+    if (!(error instanceof SourceFileLimitError)) throw error;
+    const collector = reads.getStore();
+    if (!collector) throw error;
+    collector.skipped.set(filePath, { path: filePath, reason: 'file_too_large' });
+    const stat = statSync(filePath);
+    collector.inputs.set(filePath, {path:filePath,hash:'file_too_large',size:stat.size,mtime:stat.mtimeMs});
+    return '';
+  }
+}
+
+export async function collectSourceSkips<T>(root: string, read: () => Promise<T>): Promise<{ value: T; skipped: SkippedSourceFile[]; inputs: SourceReadFingerprint[] }> {
+  const collector = {skipped: new Map<string, SkippedSourceFile>(), inputs: new Map<string, SourceReadFingerprint>()};
+  const value = await reads.run(collector, read);
+  const rel = (file: {path:string}) => relative(root, file.path).replace(/\\/g, '/');
+  return {value, skipped:[...collector.skipped.values()].map(file => ({...file,path:rel(file)})), inputs:[...collector.inputs.values()].map(file => ({...file,path:rel(file)}))};
+}

package/src/core/resources/work-queue.ts

@@ -0,0 +1,74 @@
+import { RESOURCE_LIMITS } from "./limits.ts";
+
+/** One mutation/parse lane per server; failures do not poison later work. */
+export class SerialWorkQueue {
+  private tail: Promise<void> = Promise.resolve();
+  private pending = 0;
+  private readonly maxPending: number;
+
+  constructor(maxPending = RESOURCE_LIMITS.maxQueuePending) {
+    this.maxPending = maxPending;
+  }
+
+  get pendingCount(): number {
+    return this.pending;
+  }
+
+  run<T>(work: () => Promise<T>, signal?: AbortSignal): Promise<T> {
+    if (signal?.aborted) {
+      return Promise.reject(signal.reason ?? new Error("Request was cancelled before queueing"));
+    }
+
+    if (this.pending >= this.maxPending) {
+      const busyError = new Error(`Server is busy: request admission limit (${this.maxPending}) exceeded. Retry after current tasks finish.`);
+      (busyError as any).code = "SERVER_BUSY";
+      return Promise.reject(busyError);
+    }
+
+    this.pending++;
+
+    return new Promise<T>((resolve, reject) => {
+      let cancelled = false;
+
+      const abortHandler = () => {
+        cancelled = true;
+        reject(signal?.reason ?? new Error("Request was cancelled while queued"));
+      };
+
+      if (signal) {
+        signal.addEventListener("abort", abortHandler, { once: true });
+      }
+
+      const execute = async () => {
+        if (signal) {
+          signal.removeEventListener("abort", abortHandler);
+        }
+        if (cancelled || signal?.aborted) {
+          if (!cancelled) {
+            reject(signal?.reason ?? new Error("Request was cancelled before execution"));
+          }
+          return;
+        }
+
+        try {
+          const res = await work();
+          resolve(res);
+        } catch (err) {
+          reject(err);
+        }
+      };
+
+      const next = this.tail.then(execute, execute);
+      this.tail = next.finally(() => {
+        this.pending--;
+        if (this.pending === 0) {
+          this.tail = Promise.resolve();
+        }
+      });
+    });
+  }
+
+  drain(): Promise<void> {
+    return this.tail;
+  }
+}

package/src/core/session/session-manager.ts

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
+import type { SeptumRepository } from "../database/repository.ts";
 import type { ActiveFeatureSession } from "../../types/index.ts";
 import { SeptumDatabase } from "../database/client.ts";
 
@@ -11,7 +12,8 @@ export class SessionManager {
     return process.env.SEPTUM_SESSION_ID || `process:${process.pid}`;
   }
 
-  private static mutate<T>(workspaceRoot: string, fn: () => T): T {
+  private static mutate<T>(workspaceRoot: string, fn: () => T, repo?: SeptumRepository): T {
+    if (repo) return repo.runInTransaction(fn, true);
     const db = new SeptumDatabase(join(workspaceRoot, ".septum/septum.db"));
     try {
       // Serialize ownership checks with writes across CLI and MCP processes.
@@ -24,7 +26,8 @@ export class SessionManager {
   public static saveActiveSession(
     workspaceRoot: string,
     session: ActiveFeatureSession,
-    ownerId: string = SessionManager.getOwnerId()
+    ownerId: string = SessionManager.getOwnerId(),
+    persistence?: { repo: SeptumRepository; save: () => void }
   ): void {
     SessionManager.mutate(workspaceRoot, () => {
       const current = SessionManager.getActiveSession(workspaceRoot);
@@ -37,18 +40,28 @@ export class SessionManager {
       const temporaryPath = `${sessionPath}.${randomUUID()}.tmp`;
       try {
         writeFileSync(temporaryPath, JSON.stringify({ ...session, owner_id: ownerId }, null, 2), "utf-8");
+        // Metadata and ownership use one write lock; a failed rename rolls back SQLite.
+        persistence?.save();
         renameSync(temporaryPath, sessionPath);
       } finally {
         rmSync(temporaryPath, { force: true });
       }
-    });
+    }, persistence?.repo);
   }
 
   public static getActiveSession(workspaceRoot: string): ActiveFeatureSession | null {
     const sessionPath = join(workspaceRoot, SessionManager.SESSION_FILE);
     if (!existsSync(sessionPath)) return null;
-    const parsed = JSON.parse(readFileSync(sessionPath, "utf-8")) as ActiveFeatureSession;
-    if (parsed && typeof parsed.feature_key === "string" && typeof parsed.domain === "string" && Array.isArray(parsed.touchpoints)) return parsed;
+    let parsed: any;
+    try {
+      parsed = JSON.parse(readFileSync(sessionPath, "utf-8")) as ActiveFeatureSession;
+    } catch (e: any) {
+      throw new Error(`Corrupted active feature session JSON in '${sessionPath}': ${e.message}. Release it explicitly with 'septum feature clear --force' or 'septum_feature({action: "release", force: true})'.`);
+    }
+    if (parsed && typeof parsed.feature_key === "string" && parsed.feature_key.trim() &&
+        typeof parsed.domain === "string" && parsed.domain.trim() &&
+        Array.isArray(parsed.touchpoints) && parsed.touchpoints.every((tp: unknown) => typeof tp === "string") &&
+        (parsed.owner_id === undefined || typeof parsed.owner_id === "string")) return parsed;
     throw new Error(`Invalid active feature session in '${sessionPath}'. Release it explicitly with 'septum feature clear --force'.`);
   }
 
@@ -65,7 +78,7 @@ export class SessionManager {
         const current = SessionManager.getActiveSession(workspaceRoot);
         if (current?.owner_id !== ownerId) throw new Error("Only the active session owner can release it. Use 'septum feature clear --force' for explicit recovery.");
       }
-      rmSync(sessionPath);
+      rmSync(sessionPath, { force: true });
       return true;
     });
   }

package/src/core/telemetry/telemetry.ts

@@ -56,13 +56,24 @@ export class SeptumTelemetry {
       console.error(`[Septum Telemetry SLOW_WARN] ${jsonLine}`);
     }
 
+    this.appendLog(jsonLine, workspaceRoot);
+  }
+
+  public static recordMemorySample(metrics: Record<string, number>, workspaceRoot: string = process.cwd()): void {
+    const jsonLine = JSON.stringify({timestamp: new Date().toISOString(), event: "memory_sample", metrics});
+    console.error(`[Septum Memory] ${jsonLine}`);
+    this.appendLog(jsonLine, workspaceRoot);
+  }
+
+  private static appendLog(jsonLine: string, workspaceRoot: string): void {
     // Sink 2: Append-only persistent file recorder in .septum/septum.log
     try {
       const logPath = this.getLogPath(workspaceRoot);
       const logDir = dirname(logPath);
 
+      // SV-03: Do not auto-scaffold .septum directory for telemetry if workspace has not been initialized
       if (!existsSync(logDir)) {
-        mkdirSync(logDir, { recursive: true });
+        return;
       }
 
       // Check for rotation if file exceeds 2MB

package/src/core/topology/environment-detector.ts

@@ -18,8 +18,8 @@ export class EnvironmentDetector {
   ): EnvironmentTopology {
     // 1. Fetch any previously verified layers and nodes from SQLite SSOT
     const savedLayers: Partial<Record<EnvironmentLayer, EnvironmentLayerInfo>> =
-      repo && !forceRefresh ? repo.environment.getAllLayers() : {};
-    const savedNodes = repo && !forceRefresh ? repo.environment.getAllNodes() : [];
+      repo ? repo.environment.getAllLayers() : {};
+    const savedNodes = repo ? repo.environment.getAllNodes() : [];
     const savedNodeMap = new Map(savedNodes.map((n) => [n.id, n]));
 
     // 2. Perform root file-based heuristic inspection for each of the 6 layers
@@ -31,19 +31,28 @@ export class EnvironmentDetector {
     const detectedTelemetry = this.inspectTelemetryLayer(workspaceRoot);
 
     // 3. Merge layers: Database verified layers take precedence
+    const resolveLayer = (layerKey: EnvironmentLayer, detected: EnvironmentLayerInfo): EnvironmentLayerInfo => {
+      const saved = savedLayers[layerKey];
+      if (saved && saved.status === "VERIFIED") {
+        return saved;
+      }
+      return detected;
+    };
+
     const layers: Record<EnvironmentLayer, EnvironmentLayerInfo> = {
-      edge: savedLayers.edge?.status === "VERIFIED" ? savedLayers.edge : detectedEdge,
-      gateway: savedLayers.gateway?.status === "VERIFIED" ? savedLayers.gateway : detectedGateway,
-      host: savedLayers.host?.status === "VERIFIED" ? savedLayers.host : detectedHost,
-      runtime: savedLayers.runtime?.status === "VERIFIED" ? savedLayers.runtime : detectedRuntime,
-      storage: savedLayers.storage?.status === "VERIFIED" ? savedLayers.storage : detectedStorage,
-      telemetry: savedLayers.telemetry?.status === "VERIFIED" ? savedLayers.telemetry : detectedTelemetry,
+      edge: resolveLayer("edge", detectedEdge),
+      gateway: resolveLayer("gateway", detectedGateway),
+      host: resolveLayer("host", detectedHost),
+      runtime: resolveLayer("runtime", detectedRuntime),
+      storage: resolveLayer("storage", detectedStorage),
+      telemetry: resolveLayer("telemetry", detectedTelemetry),
     };
 
-    // 4. Save layers to SQLite if not already stored
+    // 4. Save layers to SQLite if not already stored (refresh only non-VERIFIED layers)
     if (repo) {
       for (const layerKey of Object.keys(layers) as EnvironmentLayer[]) {
-        if (!savedLayers[layerKey] || forceRefresh) {
+        const saved = savedLayers[layerKey];
+        if (!saved || (forceRefresh && saved.status !== "VERIFIED")) {
           repo.environment.saveLayer(layers[layerKey]);
         }
       }
@@ -231,7 +240,8 @@ export class EnvironmentDetector {
     // 7. Save detected nodes to SQLite SSOT
     if (repo) {
       for (const node of finalNodes) {
-        if (!savedNodeMap.has(node.id) || forceRefresh) {
+        const saved = savedNodeMap.get(node.id);
+        if (!saved || (forceRefresh && saved.status !== "VERIFIED")) {
           repo.environment.saveNode(node);
         }
       }