deepstrike 0.2.74__tar.gz → 0.2.75__tar.gz

{deepstrike-0.2.74 → deepstrike-0.2.75}/Cargo.lock

@@ -254,7 +254,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-core"
-version = "0.2.74"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-tokenizer",
@@ -268,7 +268,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-node"
-version = "0.2.74"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -280,7 +280,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-py"
-version = "0.2.74"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -291,10 +291,11 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-sdk"
-version = "0.2.74"
+version = "0.2.75"
 dependencies = [
  "async-stream",
  "async-trait",
+ "base64 0.22.1",
  "bytes",
  "compact_str",
  "deepstrike-core",
@@ -327,7 +328,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-tokenizer"
-version = "0.2.74"
+version = "0.2.75"
 dependencies = [
  "pretty_assertions",
  "tiktoken-rs",
@@ -335,7 +336,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-wasm"
-version = "0.2.74"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-core",

{deepstrike-0.2.74 → deepstrike-0.2.75}/Cargo.toml

@@ -3,13 +3,13 @@ resolver = "2"
 members = ["crates/deepstrike-core", "crates/deepstrike-tokenizer", "crates/deepstrike-py"]
 
 [workspace.package]
-version = "0.2.74"
+version = "0.2.75"
 edition = "2024"
 repository = "https://github.com/kongusen/deepstrike"
 
 [workspace.dependencies]
-deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.74" }
-deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.74" }
+deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.75" }
+deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.75" }
 notify = "6"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

{deepstrike-0.2.74 → deepstrike-0.2.75}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepstrike
-Version: 0.2.74
+Version: 0.2.75
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: anyio>=4.0

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/context/manager.rs

@@ -994,6 +994,17 @@ impl ContextManager {
             .is_none()
     }
 
+    /// A refused `skill` activation: withdraw the `skill:<name>` knowledge the host staged for it,
+    /// unless the skill is already active under an earlier admission.
+    pub fn retract_refused_skill(&mut self, name: &str) -> bool {
+        if self.active_skills.contains_key(name) {
+            return false;
+        }
+        self.partitions
+            .knowledge
+            .retract_staged(&format!("skill:{name}"))
+    }
+
     /// K3: deactivate a skill — the toolset re-widens at the next `emit_call_llm` (an epoch event,
     /// same cache cost class as activation) and the skill's `skill:<name>` knowledge pin is marked
     /// for the next boundary sweep. Errs-open: not-active is a no-op (returns false).

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/context/partitions.rs

@@ -209,6 +209,29 @@ impl KnowledgePartition {
         }))
     }
 
+    /// Withdraw content staged under `key` for something the kernel then refused (a skill whose
+    /// activation was rejected). A freshly appended entry has never been rendered, so it is dropped
+    /// outright; an existing entry keeps its rendered bytes, loses the staged upsert, and leaves at
+    /// the next boundary. Returns whether anything was withdrawn.
+    pub fn retract_staged(&mut self, key: &str) -> bool {
+        let Some(index) = self
+            .entries
+            .iter()
+            .position(|entry| entry.key.as_deref() == Some(key))
+        else {
+            return false;
+        };
+        let entry = &mut self.entries[index];
+        if entry.pending.take().is_some() {
+            entry.evict_at_boundary = true;
+            return true;
+        }
+        let tokens = entry.tokens;
+        self.entries.remove(index);
+        self.token_count = self.token_count.saturating_sub(tokens);
+        true
+    }
+
     /// Mark the keyed entry for removal at the next boundary. Errs-open: unknown key is a no-op.
     /// Returns whether a matching entry was marked.
     pub fn remove(&mut self, key: &str) -> bool {

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/governance/pipeline.rs

@@ -14,6 +14,8 @@ pub struct GovernancePipeline {
     pub veto: VetoAuthority,
     pub rate_limiter: RateLimiter,
     pub constraints: ConstraintValidator,
+    /// Withhold statically denied tools from the provider surface (see [`Self::denies_tool`]).
+    pub hide_denied_tools: bool,
 }
 
 fn severity(v: &GovernanceVerdict) -> u8 {
@@ -32,9 +34,28 @@ impl GovernancePipeline {
             veto: VetoAuthority::new(),
             rate_limiter: RateLimiter::default(),
             constraints: ConstraintValidator::new(),
+            hide_denied_tools: false,
         }
     }
 
+    /// Whether every call to `name` is denied regardless of its arguments or timing — a veto or a
+    /// `deny` permission. Argument constraints and rate limits are per-call, and `ask_user` is a
+    /// runtime decision, so none of them make a tool statically unusable.
+    pub fn denies_tool(&self, name: &str) -> bool {
+        let probe = ToolCall {
+            id: "governance-surface".into(),
+            name: name.into(),
+            arguments: serde_json::Value::Null,
+        };
+        matches!(
+            self.veto.check(&probe),
+            Some(GovernanceVerdict::Deny { .. })
+        ) || matches!(
+            self.permission.check(&probe),
+            Some(GovernanceVerdict::Deny { .. })
+        )
+    }
+
     /// Set the current timestamp for rate limiting.
     pub fn set_time(&mut self, now_ms: u64) {
         self.rate_limiter.set_time(now_ms);

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/mm/memory.rs

@@ -393,6 +393,65 @@ pub struct MemoryRecallLifecycle {
     pub last_recalled_at: u64,
 }
 
+/// What the host's store holds for one record it just recalled — the only input the recall
+/// lifecycle needs. The store reports state; it never reports the *next* state.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryRecallPrior {
+    pub record_id: String,
+    #[serde(default)]
+    pub recall_count: u64,
+    #[serde(default)]
+    pub pinned: bool,
+}
+
+/// A recalled record whose count crossed the promotion threshold on this recall (M4).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryPromotion {
+    pub record_id: String,
+    pub recall_count: u64,
+}
+
+/// M3/M4 · the one derivation of a recall's lifecycle, shared by the model's `query_memory`
+/// syscall and every host recall route.
+///
+/// Each distinct record counts once per derivation however many hits named it, so a prefetch that
+/// issues several overlapping queries cannot inflate a count. Promotion is edge-triggered — it is
+/// suggested on the recall that crosses the threshold, never again on later ones — and a pinned
+/// record is never suggested, because it is already where a promotion would put it.
+pub fn derive_recall_lifecycle(
+    priors: &[MemoryRecallPrior],
+    recalled_at: u64,
+    promotion_threshold: Option<u64>,
+) -> (Vec<MemoryRecallLifecycle>, Vec<MemoryPromotion>) {
+    let mut seen = std::collections::BTreeSet::new();
+    let mut recalls = Vec::with_capacity(priors.len());
+    let mut promotions = Vec::new();
+    for prior in priors {
+        if !seen.insert(prior.record_id.as_str()) {
+            continue;
+        }
+        let recall_count = prior.recall_count.saturating_add(1);
+        recalls.push(MemoryRecallLifecycle {
+            record_id: prior.record_id.clone(),
+            recall_count,
+            last_recalled_at: recalled_at,
+        });
+        if let Some(threshold) = promotion_threshold
+            && !prior.pinned
+            && prior.recall_count < threshold
+            && recall_count >= threshold
+        {
+            promotions.push(MemoryPromotion {
+                record_id: prior.record_id.clone(),
+                recall_count,
+            });
+        }
+    }
+    (recalls, promotions)
+}
+
 /// Memory validation error.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "error_kind", rename_all = "snake_case")]
@@ -770,4 +829,52 @@ mod tests {
         ));
         assert_eq!(store.len(), 1);
     }
+
+    fn prior(record_id: &str, recall_count: u64, pinned: bool) -> MemoryRecallPrior {
+        MemoryRecallPrior {
+            record_id: record_id.into(),
+            recall_count,
+            pinned,
+        }
+    }
+
+    #[test]
+    fn a_recall_counts_each_record_once_and_suggests_promotion_only_on_the_crossing() {
+        let (recalls, promotions) = derive_recall_lifecycle(
+            &[
+                prior("crossing", 2, false),
+                prior("crossing", 2, false),
+                prior("already_past", 3, false),
+                prior("pinned", 2, true),
+                prior("fresh", 0, false),
+            ],
+            42,
+            Some(3),
+        );
+        assert_eq!(
+            recalls
+                .iter()
+                .map(|recall| (recall.record_id.as_str(), recall.recall_count))
+                .collect::<Vec<_>>(),
+            vec![
+                ("crossing", 3),
+                ("already_past", 4),
+                ("pinned", 3),
+                ("fresh", 1)
+            ]
+        );
+        assert!(recalls.iter().all(|recall| recall.last_recalled_at == 42));
+        assert_eq!(
+            promotions,
+            vec![MemoryPromotion {
+                record_id: "crossing".into(),
+                recall_count: 3
+            }]
+        );
+        assert!(
+            derive_recall_lifecycle(&[prior("crossing", 2, false)], 1, None)
+                .1
+                .is_empty()
+        );
+    }
 }

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/chain_validator/mod.rs

@@ -2097,6 +2097,8 @@ mod tests {
                             ),
                             tokens: Some(64),
                             tool_call_id: None,
+                            is_error: false,
+                            tool_calls: Vec::new(),
                         })
                         .collect(),
                     ..InitialContext::default()
@@ -2184,6 +2186,7 @@ mod tests {
                                     Vec::new()
                                 },
                                 tool_call_id: None,
+                                is_error: false,
                                 tokens: None,
                             },
                             observed_input_tokens: None,

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/observation.rs

@@ -76,6 +76,14 @@ pub enum KernelObservation {
         subject: Option<String>,
         reason: String,
     },
+    /// A model `skill` syscall the kernel admitted. Hosts pin the skill's content only on this
+    /// fact, never on the raw call: activation is a capability mutation the kernel adjudicates.
+    SkillAdmitted {
+        turn: u32,
+        name: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        expires_at_turn: Option<u32>,
+    },
     CapabilityChanged {
         turn: u32,
         #[serde(default, skip_serializing_if = "Vec::is_empty")]

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/command.rs

@@ -43,6 +43,12 @@ pub enum HostCommand {
     ApplySkillActivation(ApplySkillActivationCommand),
     ApplyPolicyPatch(ApplyPolicyPatchCommand),
     UpdateDeadline(UpdateDeadlineCommand),
+    /// §22.13 · a memory write the host authored while this operation runs (a session extract, a
+    /// semantic archive summary). The host still performs the I/O; the kernel is the one that says
+    /// whether the write may happen, by the same validation rule and the same rolling write quota
+    /// the model's `write_memory` syscall answers to. A refusal is journaled as
+    /// `memory_validation_failed`; an admitted write journals nothing and the host persists it.
+    AdmitMemoryWrite(AdmitMemoryWriteCommand),
 }
 
 /// Cancellation. The operation id lives in the envelope and is **not** repeated here: the
@@ -181,6 +187,16 @@ pub struct SeedKnowledgeCommand {
     pub entries: Vec<KnowledgeEntry>,
 }
 
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AdmitMemoryWriteCommand {
+    /// The host's record id, named by the audit fact when the write is refused.
+    pub record_id: String,
+    pub name: String,
+    /// UTF-8 byte length of the content the host intends to persist.
+    pub content_bytes: u32,
+}
+
 /// §13.2 · skill activation state. Both directions in one command so a swap is atomic.
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -265,6 +281,11 @@ pub struct GovernancePolicy {
     pub rate_limits: Vec<RateLimitSpec>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub constraints: Vec<ParamConstraint>,
+    /// Withhold tools this policy statically denies (veto or `deny` permission) from the provider
+    /// surface, and say so once in the knowledge slot. The kernel decides the hidden set with the
+    /// same rules that enforce the calls, so the surface and the gate cannot disagree.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub hide_denied_tools: Option<bool>,
 }
 
 /// Per-tool rolling-window rate limit.
@@ -558,6 +579,9 @@ impl LivePolicyPatch {
                 next.governance_policy.vetoed_tools = policy.vetoed_tools.clone();
                 next.governance_policy.rate_limits = policy.rate_limits.clone();
                 next.governance_policy.constraints = policy.constraints.clone();
+                next.governance_policy.hide_denied_tools = policy
+                    .hide_denied_tools
+                    .unwrap_or(current.governance_policy.hide_denied_tools);
                 super::config::validate_governance(
                     &next.governance_policy,
                     current.kernel_limits.collection_limits.governance_rules,

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/config.rs

@@ -659,6 +659,8 @@ pub struct ResolvedGovernancePolicy {
     pub vetoed_tools: Vec<String>,
     pub rate_limits: Vec<super::command::RateLimitSpec>,
     pub constraints: Vec<super::command::ParamConstraint>,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub hide_denied_tools: bool,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -831,6 +833,56 @@ pub struct ResolvedMemoryPolicy {
     pub promotion_recall_threshold: Option<WireU64>,
 }
 
+impl ResolvedMemoryPolicy {
+    /// The baseline every operation starts from, and the policy a host without a live operation
+    /// is judged by when it names none.
+    pub const DEFAULT: Self = Self {
+        stale_warning_days: 2,
+        retrieval_top_k: 5,
+        validation_enabled: true,
+        max_content_bytes: 10_000,
+        max_name_length: 100,
+        promotion_recall_threshold: None,
+    };
+
+    /// §22.13 · the one admission rule for a memory write, whoever proposes it.
+    ///
+    /// The model's `write_memory` syscall, a host write inside a live operation and a host write
+    /// with no operation at all are judged by this function and nothing else — historically each
+    /// SDK carried its own copy, and the copies disagreed about bytes versus characters, about
+    /// which fields were required, and about whether the model's path was checked at all.
+    ///
+    /// The content is judged by its UTF-8 byte length, so a host need not ship a body across the
+    /// boundary just to have it measured.
+    pub fn check_write(&self, name: &str, content_bytes: usize) -> Result<(), String> {
+        if !self.validation_enabled {
+            return Ok(());
+        }
+        if name.trim().is_empty() {
+            return Err("memory name must not be empty".to_string());
+        }
+        if name.chars().count() > self.max_name_length as usize {
+            return Err(format!(
+                "memory name exceeds {} characters",
+                self.max_name_length
+            ));
+        }
+        if content_bytes > self.max_content_bytes as usize {
+            return Err(format!(
+                "memory content exceeds {} bytes",
+                self.max_content_bytes
+            ));
+        }
+        Ok(())
+    }
+
+    /// The same resolution an operation's genesis applies, for a host that holds a policy but no
+    /// live operation: absent fields fall back to [`Self::DEFAULT`] and the same invariants hold.
+    pub fn resolve(policy: Option<&MemoryPolicy>) -> Result<Self, WireRejection> {
+        resolve_memory_policy(policy, &Self::DEFAULT)
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct ResolvedFeaturePolicy {
@@ -887,6 +939,7 @@ impl ConfigDefaults {
                     vetoed_tools: Vec::new(),
                     rate_limits: Vec::new(),
                     constraints: Vec::new(),
+                    hide_denied_tools: false,
                 },
                 scheduler_policy: ResolvedSchedulerPolicy {
                     critical_path_weight: 1_000_000,
@@ -948,14 +1001,7 @@ impl ConfigDefaults {
                     },
                 },
                 memory_access: None,
-                memory_policy: ResolvedMemoryPolicy {
-                    stale_warning_days: 2,
-                    retrieval_top_k: 5,
-                    validation_enabled: true,
-                    max_content_bytes: 10_000,
-                    max_name_length: 100,
-                    promotion_recall_threshold: None,
-                },
+                memory_policy: ResolvedMemoryPolicy::DEFAULT,
                 tool_catalog: Vec::new(),
                 skill_catalog: Vec::new(),
                 verification_contracts: Vec::new(),
@@ -1525,6 +1571,7 @@ fn resolve_governance(
         resolved.vetoed_tools = policy.vetoed_tools.clone();
         resolved.rate_limits = policy.rate_limits.clone();
         resolved.constraints = policy.constraints.clone();
+        resolved.hide_denied_tools = policy.hide_denied_tools.unwrap_or(false);
     }
     validate_governance(&resolved, rule_bound)?;
     Ok(resolved)
@@ -2150,6 +2197,7 @@ mod tests {
                     tool: "write".to_string(),
                     param_path: "destination".to_string(),
                 })],
+                hide_denied_tools: None,
             }),
             scheduler_policy: Some(SchedulerPolicy {
                 critical_path_weight: Some(900_000),
@@ -2440,6 +2488,7 @@ mod tests {
                         window_ms: WireU64::new(1_000),
                     }],
                     constraints: Vec::new(),
+                    hide_denied_tools: None,
                 },
             }),
             LivePolicyPatch::TightenResourceQuota(TightenResourceQuota {

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/crash_point.rs

@@ -342,6 +342,7 @@ fn provider_result(
                     content: String::new(),
                     tool_calls: calls,
                     tool_call_id: None,
+                    is_error: false,
                     tokens: None,
                 },
                 observed_input_tokens: None,
@@ -394,6 +395,7 @@ fn provider_answer(id: &str, at: u64, effect: &EffectId, text: &str) -> WireEnve
                     content: text.to_string(),
                     tool_calls: Vec::new(),
                     tool_call_id: None,
+                    is_error: false,
                     tokens: None,
                 },
                 observed_input_tokens: None,

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/driver/effects.rs

@@ -136,7 +136,13 @@ impl CanonicalOperationDriver {
                 };
                 let turn = self.engine_mut()?.turn;
                 let mut recalled = Vec::with_capacity(queried.recalls.len());
+                let mut priors = Vec::with_capacity(queried.recalls.len());
                 for recall in &queried.recalls {
+                    priors.push(crate::mm::memory::MemoryRecallPrior {
+                        record_id: recall.record_ref.as_str().to_string(),
+                        recall_count: recall.recall_count.get(),
+                        pinned: recall.pinned,
+                    });
                     // §22.13 · the host answers with records, never with authority: the recall is
                     // rendered into history as content the model reads, and nothing about it
                     // rewrites this operation's binding, trust or provenance.
@@ -173,6 +179,33 @@ impl CanonicalOperationDriver {
                     requested_k: query.requested_k as usize,
                     requires_async_response: false,
                 });
+                // M3/M4 · the recall lifecycle is derived here, from what the store reported it held,
+                // and journaled — the host mirrors these counts and never computes them.
+                let (recalls, promotions) = crate::mm::memory::derive_recall_lifecycle(
+                    &priors,
+                    context.input.observed_at_ms.get(),
+                    context
+                        .config
+                        .memory_policy
+                        .promotion_recall_threshold
+                        .map(|threshold| threshold.get()),
+                );
+                if !recalls.is_empty() {
+                    engine.observations.push(KernelObservation::MemoryRecalled {
+                        turn,
+                        scope: binding_scope(&query.binding_id),
+                        recalls,
+                    });
+                }
+                for promotion in promotions {
+                    engine
+                        .observations
+                        .push(KernelObservation::PromotionSuggested {
+                            turn,
+                            record_id: promotion.record_id,
+                            recall_count: promotion.recall_count,
+                        });
+                }
                 let mut step = self.continue_after(context, action, root_kind)?;
                 step.focus = self.focus.clone();
                 Ok(step)

{deepstrike-0.2.74 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/driver/events.rs

@@ -410,18 +410,51 @@ impl CanonicalOperationDriver {
             HostCommand::RecordDynamicWorkflowReplay(fact) => {
                 self.plan_dynamic_workflow_replay(context, fact)
             }
-            HostCommand::CompleteDynamicWorkflow(_) => {
-                self.plan_dynamic_workflow_complete(context)
-            }
+            HostCommand::CompleteDynamicWorkflow(_) => self.plan_dynamic_workflow_complete(context),
             HostCommand::ApplyCapabilityPatch(patch) => self.plan_capability_patch(patch),
             HostCommand::ApplyKnowledgeMutation(mutation) => self.plan_knowledge_mutation(mutation),
             HostCommand::SeedKnowledge(seed) => self.plan_seed_knowledge(seed),
             HostCommand::ApplySkillActivation(activation) => self.plan_skill_activation(activation),
             HostCommand::ApplyPolicyPatch(patch) => self.plan_policy_patch(patch),
             HostCommand::UpdateDeadline(deadline) => self.plan_update_deadline(deadline),
+            HostCommand::AdmitMemoryWrite(admit) => self.plan_admit_memory_write(context, admit),
         }
     }
 
+    /// §22.13 · admit a host-authored memory write by the rule the model's proposals obey.
+    ///
+    /// Validation runs before metering, exactly as on the syscall path, so a write the policy
+    /// refuses spends no quota. The refusal is an audit fact rather than a fault: the content is
+    /// usually model-derived (an extraction, a summary), so a refused write is expected behaviour
+    /// and not a host bug.
+    pub(super) fn plan_admit_memory_write(
+        &mut self,
+        context: &PlanContext<'_>,
+        admit: &AdmitMemoryWriteCommand,
+    ) -> Result<PlannedStep, KernelFault> {
+        let policy = context.config.memory_policy;
+        let engine = self.engine_mut()?;
+        let refusal = match policy.check_write(&admit.name, admit.content_bytes as usize) {
+            Err(error) => Some(error),
+            Ok(()) => {
+                let disposition = engine.gate_memory_write_proposal();
+                (!disposition.is_allowed())
+                    .then(|| denial_reason(&disposition, "memory write denied"))
+            }
+        };
+        if let Some(error) = refusal {
+            let turn = engine.turn;
+            engine
+                .observations
+                .push(KernelObservation::MemoryValidationFailed {
+                    turn,
+                    record_id: admit.record_id.clone(),
+                    error,
+                });
+        }
+        Ok(self.quiet_step())
+    }
+
     /// Grow a root dynamic workflow from the host controller while keeping the same kernel-owned
     /// DAG, quota ledger, trust coercion, and spawn queue as model-authored workflow growth. The
     /// host command is only admitted for an active root workflow; it cannot bootstrap or stack a
@@ -475,7 +508,10 @@ impl CanonicalOperationDriver {
                 {
                     return Err(KernelFault::new(
                         KernelFaultCode::InvalidConfig,
-                        format!("dynamic workflow plan node {:?} cannot depend on itself", planned.node_id),
+                        format!(
+                            "dynamic workflow plan node {:?} cannot depend on itself",
+                            planned.node_id
+                        ),
                     ));
                 }
             }
@@ -485,6 +521,7 @@ impl CanonicalOperationDriver {
             nodes: append.nodes.clone(),
         };
         let core_spec = build_core_spec(&wire_spec)?;
+        ensure_fresh_node_ids(&self.node_ids, &wire_spec.nodes)?;
         let node_ids = wire_node_ids(&wire_spec);
         // A host append is the explicit append operation, even though the underlying DAG is the
         // same one used by model-authored workflow growth. Keeping the `SubmitNodes` gate and
@@ -591,7 +628,9 @@ impl CanonicalOperationDriver {
     ) -> Result<PlannedStep, KernelFault> {
         if self.root_kind != Some(RootKind::Workflow)
             || !self.engine().is_some_and(LoopStateMachine::workflow_active)
-            || !self.engine().is_some_and(LoopStateMachine::is_dynamic_workflow_open)
+            || !self
+                .engine()
+                .is_some_and(LoopStateMachine::is_dynamic_workflow_open)
         {
             return Err(KernelFault::new(
                 KernelFaultCode::InvalidAuthority,