Eilodon
diff --git a/‎crates/calm-core/src/authority/snapshot.rs‎
Lines changed: 119 additions & 2 deletions b/‎crates/calm-core/src/authority/snapshot.rs‎
Lines changed: 119 additions & 2 deletions
diff --git a/‎crates/calm-core/src/config.rs‎
Lines changed: 145 additions & 0 deletions b/‎crates/calm-core/src/config.rs‎
Lines changed: 145 additions & 0 deletions
diff --git a/‎crates/calm-core/src/graph/coreness.rs‎
Lines changed: 16 additions & 0 deletions b/‎crates/calm-core/src/graph/coreness.rs‎
Lines changed: 16 additions & 0 deletions
@@ -199,8 +199,31 @@ impl EvidenceSnapshot {
         project_root: &Path,
         state_conn: &Connection,
     ) -> rusqlite::Result<Self> {
-        let mut snapshot = Self::compute(conn, project_root)?;
-        if let Some(recorded) = Self::load(state_conn, &snapshot.snapshot_id)?
+        // Wave 6 (audit follow-up, P0-A): inlines `compute`'s own drift
+        // derivation instead of calling it, so this function can tell
+        // WHETHER `live_mtime_drift` is what produced a `Degraded` result --
+        // that distinction is the whole fix. `live_mtime_drift` closes a
+        // real, currently-observed lag window (disk changed, DB not
+        // reindexed yet); a recorded snapshot from BEFORE that change can
+        // share the same `snapshot_id` (content-addressed over DB rows
+        // only, which haven't moved) and must never be allowed to silently
+        // overturn what this call just observed live. Without this
+        // distinction, the block below would re-promote a live-drifted
+        // `Degraded` straight back to a stale `Reconciled`, and
+        // `mint_review_authority_for_edit_context` would mint an authority
+        // on a false freshness guarantee that survives all the way to
+        // `edit.rs`'s spend-time check.
+        let catalog = InputCatalog::for_project(project_root);
+        let drift = index_input_drift(conn, &catalog)?;
+        let mut freshness_class = drift_to_freshness(drift);
+        let live_drifted =
+            freshness_class == FreshnessClass::Current && live_mtime_drift(conn, project_root)?;
+        if live_drifted {
+            freshness_class = FreshnessClass::Degraded;
+        }
+        let mut snapshot = Self::build(conn, project_root, freshness_class)?;
+        if !live_drifted
+            && let Some(recorded) = Self::load(state_conn, &snapshot.snapshot_id)?
             && recorded.freshness_class > snapshot.freshness_class
         {
             snapshot.freshness_class = recorded.freshness_class;
@@ -392,6 +415,26 @@ fn live_mtime_drift(conn: &Connection, project_root: &Path) -> rusqlite::Result<
             return Ok(true);
         }
     }
+    // Wave 6 (audit follow-up, P0-A.3): a brand-new source file added to
+    // disk since the last index has no `file_index` row at all, so the
+    // loop above -- which only ever iterates EXISTING rows -- can't see it.
+    // A live-tree-walk fix (compare `collect_source_files`'s live path set
+    // against `file_index`) was implemented and then REVERTED after it
+    // broke 7 existing tests, all with the same root cause: this
+    // codebase's own test fixtures routinely `std::fs::write` a file and
+    // insert directly into `symbols`/persist a reconciled InputCatalog
+    // WITHOUT a matching `file_index` row (a fast test-setup shortcut, not
+    // a bug in the tests). That revealed a real, unresolved semantic
+    // question, not just a test-fixture inconvenience: `index_input_drift`
+    // (and therefore `Current`/`Reconciled`) was designed to answer "does
+    // the index match disk" for config/context fingerprints specifically,
+    // not "has every matching file actually been read into `file_index`" --
+    // conflating the two would also fire on the normal, transient,
+    // non-adversarial case of a freshly-added file the watcher hasn't
+    // debounced yet, at every risk tier, not just the ones that actually
+    // need Reconciled-strength freshness. Left as a documented, deliberate
+    // residual pending a real design decision (e.g. a distinct signal
+    // rather than folding into this boolean), not silently dropped.
     Ok(false)
 }
 
@@ -893,6 +936,80 @@ mod tests {
         assert_ne!(after_change.freshness_class, FreshnessClass::Reconciled);
     }
 
+    #[test]
+    fn compute_with_recorded_freshness_does_not_revive_a_stale_reconciled_over_live_drift() {
+        // Wave 6 (audit follow-up, P0-A): the actual dangerous scenario --
+        // content is genuinely unchanged according to the DB
+        // (source_catalog_digest/snapshot_id unchanged, since nothing has
+        // been reindexed), but the file changed ON DISK in the meantime.
+        // Before this fix, the recorded Reconciled row (same snapshot_id,
+        // because that digest never saw the disk-only change) would
+        // silently overwrite the live-derived Degraded right back to
+        // Reconciled -- letting `mint_review_authority_for_edit_context`
+        // mint an authority on a false freshness guarantee. The sibling
+        // test above (`..._falls_back_to_live_drift_when_content_changed_
+        // since`) does NOT cover this despite its name: it mutates
+        // file_index directly, which flips snapshot_id and makes the
+        // recorded-lookup miss entirely -- a different, already-safe path.
+        use crate::indexer::refresh::{InputCatalog, persist_index_input_snapshot};
+        let root = tmp_project();
+        let file_path = root.path().join("a.rs");
+        std::fs::write(&file_path, "fn a() {}").unwrap();
+        let indexed_mtime = crate::indexer::pipeline::mtime_secs(&file_path);
+
+        let conn = Connection::open_in_memory().unwrap();
+        init_db(&conn).unwrap();
+        conn.execute(
+            "INSERT INTO file_index (path, hash, last_indexed, mtime) \
+             VALUES ('a.rs', 'h1', 0, ?1)",
+            params![indexed_mtime],
+        )
+        .unwrap();
+        persist_index_input_snapshot(&conn, &InputCatalog::for_project(root.path())).unwrap();
+
+        let state = state_conn();
+
+        // Record a real full reconciliation for this exact content (same
+        // snapshot_id the DB currently reflects) -- the legitimate case
+        // `compute_with_recorded_freshness` exists to serve.
+        let reconciled =
+            EvidenceSnapshot::compute_after_reconciliation(&conn, root.path()).unwrap();
+        reconciled.persist(&state).unwrap();
+
+        // Sanity: right now (no live drift yet), the recorded Reconciled
+        // DOES correctly apply -- this is the upgrade path that must keep
+        // working after the fix.
+        let still_fresh =
+            EvidenceSnapshot::compute_with_recorded_freshness(&conn, root.path(), &state).unwrap();
+        assert_eq!(still_fresh.freshness_class, FreshnessClass::Reconciled);
+
+        // Mutate the file ON DISK ONLY -- no reindex, so file_index (and
+        // therefore snapshot_id) stays byte-for-byte identical to what was
+        // just recorded as Reconciled above.
+        std::thread::sleep(std::time::Duration::from_millis(20));
+        std::fs::write(
+            &file_path,
+            "fn a() { /* changed on disk, not reindexed */ }",
+        )
+        .unwrap();
+
+        let after_live_change =
+            EvidenceSnapshot::compute_with_recorded_freshness(&conn, root.path(), &state).unwrap();
+        assert_eq!(
+            after_live_change.snapshot_id, reconciled.snapshot_id,
+            "snapshot_id is content-addressed over file_index DB rows only -- a \
+             live-disk-only change must NOT flip it (this assertion proves the \
+             test is actually exercising the dangerous path, not the already-safe \
+             snapshot_id-changed path the sibling test above covers)"
+        );
+        assert_eq!(
+            after_live_change.freshness_class,
+            FreshnessClass::Degraded,
+            "a live-disk-only change must not be silently revived back to \
+             Reconciled by a stale recorded snapshot sharing the same snapshot_id"
+        );
+    }
+
     #[test]
     fn live_disk_mtime_drift_downgrades_current_to_degraded() {
         use crate::indexer::refresh::{InputCatalog, persist_index_input_snapshot};
 
@@ -188,6 +188,29 @@ pub struct HubThresholdConfig {
     pub coreness_pct: f64,
 }
 
+/// Wave 6 audit closure ("Assist/Strict mode profiles"): `assist`
+/// (default, today's behavior, zero change) or `strict`. `strict` ORs a
+/// fixed profile onto the individual `EditConfig` booleans below rather
+/// than replacing them -- see `EditConfig::always_require_edit_context_effective`/
+/// `kernel_enforced_writes_effective` for exactly what it sets and why
+/// those two and not the others. Deliberately gated on the truth-kernel
+/// correctness work (P0-A/P0-B/P0-C) landing first: shipping a "strict"
+/// label on top of the pre-fix live-verification gaps would have been
+/// strict about ceremony, not about truth.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum EditMode {
+    #[default]
+    Assist,
+    Strict,
+}
+
+impl EditMode {
+    pub fn is_strict(self) -> bool {
+        matches!(self, EditMode::Strict)
+    }
+}
+
 /// Phase B (`docs/plans/2026-07-13-phase-b-incremental-graph-update.md`)
 /// Edit-tool behavior flags (`[edit]` in `.calm/config.json`).
 #[derive(Debug, Clone, Deserialize, Serialize)]
@@ -245,6 +268,11 @@ pub struct EditConfig {
     /// (2026-08-19) after being shown this exact tradeoff in plain terms;
     /// keep it default-off for every other project.
     pub elicit_via_agent_relay: bool,
+    /// Wave 6: see `EditMode`'s own doc comment. Read only through
+    /// `always_require_edit_context_effective`/`kernel_enforced_writes_effective`
+    /// below, never the raw fields above, at any new call site -- otherwise
+    /// `mode = "strict"` silently has no effect.
+    pub mode: EditMode,
 }
 
 impl Default for EditConfig {
@@ -255,10 +283,45 @@ impl Default for EditConfig {
             always_require_edit_context: false,
             kernel_enforced_writes: false,
             elicit_via_agent_relay: false,
+            mode: EditMode::Assist,
         }
     }
 }
 
+impl EditConfig {
+    /// `mode = "strict"` ORs this gate on regardless of the raw
+    /// `always_require_edit_context` field (monotonic: strict can only
+    /// ADD strictness, never remove one a project explicitly turned on).
+    /// Safe to fold into `strict` because it is a protocol-level,
+    /// client-agnostic gate (the tool's own JSON-RPC error response) --
+    /// behaves identically for every MCP client, unlike `elicit_hub_confirm`
+    /// (see below).
+    pub fn always_require_edit_context_effective(&self) -> bool {
+        self.always_require_edit_context || self.mode.is_strict()
+    }
+
+    /// Same contract as `always_require_edit_context_effective`. Safe to
+    /// fold into `strict` for the same reason: every platform without
+    /// kernel-enforced containment already falls back to the same textual
+    /// check `atomic_write` uses unconditionally, so turning this on never
+    /// makes writes fail where they previously succeeded -- see the field's
+    /// own doc comment above.
+    ///
+    /// `elicit_hub_confirm` and `elicit_via_agent_relay` deliberately have
+    /// no `_effective` counterpart and are NOT folded into `strict`:
+    /// `elicit_hub_confirm` enabled for a client that never declared
+    /// elicitation support is not a silent no-op -- `elicit_setup`
+    /// (crates/calm-server/src/tools/edit.rs) turns it into a hard
+    /// client-incapability error on every hub/high-risk edit, which would
+    /// brick edits for exactly the non-interactive automation clients most
+    /// likely to opt into `strict`. `elicit_via_agent_relay` is an
+    /// explicitly WEAKER opt-out (see its own doc comment) -- the opposite
+    /// of what `strict` means, so it must never be implied by it.
+    pub fn kernel_enforced_writes_effective(&self) -> bool {
+        self.kernel_enforced_writes || self.mode.is_strict()
+    }
+}
+
 /// `[verification]` in `.calm/config.json` -- WS-6 first slice (docs/plans/
 /// 2026-08-03-ws6-verification-pipeline-execution-plan.md). Gates whether
 /// `edit_lines`/`edit_symbol` route a transaction through
@@ -1517,6 +1580,88 @@ mod tests {
         let _ = std::fs::remove_dir_all(&tmp);
     }
 
+    #[test]
+    fn edit_mode_defaults_to_assist_with_effective_accessors_matching_raw_fields() {
+        // Absent [edit].mode = "assist" = today's behavior, unchanged: the
+        // effective accessors must read identically to the raw booleans
+        // when mode never fires.
+        let d = Config::default();
+        assert_eq!(d.edit.mode, EditMode::Assist);
+        assert!(!d.edit.always_require_edit_context_effective());
+        assert!(!d.edit.kernel_enforced_writes_effective());
+    }
+
+    #[test]
+    fn edit_mode_strict_ors_the_two_protocol_gates_without_flipping_raw_fields() {
+        let tmp =
+            std::env::temp_dir().join(format!("ci_cfg_edit_mode_strict_{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        std::fs::write(tmp.join("config.json"), r#"{"edit": {"mode": "strict"}}"#).unwrap();
+        let loaded = load_config(&tmp).unwrap();
+
+        assert_eq!(loaded.edit.mode, EditMode::Strict);
+        // Raw fields stay exactly as written (nothing overrides them) --
+        // only the effective accessors change.
+        assert!(!loaded.edit.always_require_edit_context);
+        assert!(!loaded.edit.kernel_enforced_writes);
+        assert!(loaded.edit.always_require_edit_context_effective());
+        assert!(loaded.edit.kernel_enforced_writes_effective());
+
+        let diff = diff_from_default(&loaded);
+        assert!(diff.contains(&"edit.mode".to_string()), "{diff:?}");
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn edit_mode_strict_does_not_imply_elicit_hub_confirm_or_agent_relay() {
+        // See EditConfig::kernel_enforced_writes_effective's doc comment:
+        // these two are deliberately excluded from the strict compiler.
+        let tmp = std::env::temp_dir().join(format!(
+            "ci_cfg_edit_mode_strict_elicit_{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        std::fs::write(tmp.join("config.json"), r#"{"edit": {"mode": "strict"}}"#).unwrap();
+        let loaded = load_config(&tmp).unwrap();
+
+        assert!(!loaded.edit.elicit_hub_confirm);
+        assert!(!loaded.edit.elicit_via_agent_relay);
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn edit_mode_rejects_unknown_string() {
+        let tmp = std::env::temp_dir().join(format!("ci_cfg_edit_mode_bad_{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        std::fs::write(tmp.join("config.json"), r#"{"edit": {"mode": "yolo"}}"#).unwrap();
+        assert!(load_config(&tmp).is_err());
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn edit_mode_strict_can_coexist_with_an_explicit_raw_field_already_true() {
+        // Monotonic: an explicit `true` the project already set stays true
+        // regardless of mode -- strict is an OR, never a reset.
+        let tmp = std::env::temp_dir().join(format!(
+            "ci_cfg_edit_mode_strict_explicit_{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        std::fs::write(
+            tmp.join("config.json"),
+            r#"{"edit": {"mode": "assist", "always_require_edit_context": true}}"#,
+        )
+        .unwrap();
+        let loaded = load_config(&tmp).unwrap();
+        assert_eq!(loaded.edit.mode, EditMode::Assist);
+        assert!(loaded.edit.always_require_edit_context_effective());
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
     #[test]
     fn orientation_config_defaults_to_inject_and_parses_override() {
         let d = Config::default();
 
@@ -48,6 +48,22 @@ pub fn compute_coreness(conn: &Connection) -> rusqlite::Result<HashMap<String, i
         // Unrecognized confidence strings (should never happen — every
         // writer goes through `EdgeConfidence::as_str`) are treated as
         // confirmed rather than silently dropped from the stricter graph.
+        //
+        // Wave 6 (audit follow-up, P0-C, reviewed 2026-08-21): an external
+        // audit flagged both `rank() > 0` (which counts `Textual`/`Inferred`
+        // edges as "confirmed", not just `Formal`/`Resolved`) and this
+        // `unwrap_or(true)` as fail-open. Both are DELIBERATE here and were
+        // left unchanged after review — this is the "stricter" graph that
+        // feeds `is_hub`/bridge-hub gating (see the module doc comment
+        // above): failing an edge INTO "confirmed" is the conservative
+        // direction for a hub-detection false-negative guard (better to
+        // over-gate a symbol as a hub than silently miss one). This is the
+        // opposite direction from `trace.rs::weakest_route_confidence`/
+        // `path().certain`, which fail closed toward LESS confidence for
+        // the same reason applied to a different consumer (a display/
+        // certainty signal, not a safety gate) — see that file's own Wave 6
+        // fix. Do not "fix" this one the same way without re-deriving why
+        // it's inverted here.
         let is_confirmed = crate::types::EdgeConfidence::parse(&confidence)
             .map(|c| c.rank() > 0)
             .unwrap_or(true);