@dsh-enhanced/personal-memory 0.1.6 → 0.1.12

package/lib/store.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { isAbsolute } from 'node:path';
+import { validatePreferenceMemoryPromotionCancellationRequest, withPreferenceMemoryPromotionCancellationReceiptDigest, withPreferenceMemoryPromotionResultDigest, } from '@dsh-enhanced/assistant-growth-contract';
 import { APPROVAL_DISPLAY_BUDGET } from '@dsh-enhanced/assistant-policy';
 import { MemoryDatabaseError, openMemoryDatabase } from './sqlite.js';
 import { tokenizeMemory } from './tokenize.js';
@@ -11,7 +12,146 @@ export class MemoryStoreError extends Error {
         this.name = 'MemoryStoreError';
     }
 }
-function normalizeIdentity(identity) {
+const SHA_256 = /^[0-9a-f]{64}$/u;
+function boundedText(value, label, maxBytes = 512) {
+    if (typeof value !== 'string' || value.normalize('NFC').trim() !== value || value === ''
+        || Buffer.byteLength(value, 'utf8') > maxBytes) {
+        throw new MemoryStoreError('invalid-identity', `${label} is invalid`);
+    }
+    return value;
+}
+export function memoryPrincipalDigest(principal) {
+    return createHash('sha256').update(boundedText(principal, 'memory principal', 4_096)).digest('hex');
+}
+export function normalizeMemoryOwnerNamespace(namespace) {
+    if (typeof namespace !== 'object' || namespace === null || !SHA_256.test(namespace.principalDigest)) {
+        throw new MemoryStoreError('invalid-identity', 'memory owner namespace is invalid');
+    }
+    if (namespace.mode === 'delivery') {
+        if (!Number.isSafeInteger(namespace.principalVersion) || namespace.principalVersion < 1) {
+            throw new MemoryStoreError('invalid-identity', 'memory Delivery namespace version is invalid');
+        }
+        return Object.freeze({
+            mode: 'delivery',
+            principalDigest: namespace.principalDigest,
+            principalRecordId: boundedText(namespace.principalRecordId, 'memory principal record id'),
+            principalVersion: namespace.principalVersion,
+        });
+    }
+    if (namespace.mode === 'headless') {
+        if (!Number.isSafeInteger(namespace.lineageVersion) || namespace.lineageVersion < 1) {
+            throw new MemoryStoreError('invalid-identity', 'memory headless namespace version is invalid');
+        }
+        return Object.freeze({
+            mode: 'headless',
+            principalDigest: namespace.principalDigest,
+            lineageId: boundedText(namespace.lineageId, 'memory headless lineage id'),
+            lineageVersion: namespace.lineageVersion,
+        });
+    }
+    throw new MemoryStoreError('invalid-identity', 'memory owner namespace mode is invalid');
+}
+export function memoryOwnerNamespaceKey(namespace) {
+    const normalized = normalizeMemoryOwnerNamespace(namespace);
+    const durableIdentity = normalized.mode === 'delivery'
+        ? {
+            mode: normalized.mode,
+            principalRecordId: normalized.principalRecordId,
+            principalVersion: normalized.principalVersion,
+        }
+        : {
+            mode: normalized.mode,
+            principalDigest: normalized.principalDigest,
+            lineageId: normalized.lineageId,
+            lineageVersion: normalized.lineageVersion,
+        };
+    return createHash('sha256').update(stableJson(durableIdentity)).digest('hex');
+}
+function namespaceColumns(namespace) {
+    const normalized = normalizeMemoryOwnerNamespace(namespace);
+    return {
+        namespaceMode: normalized.mode,
+        namespaceKey: memoryOwnerNamespaceKey(normalized),
+        principalDigest: normalized.principalDigest,
+        principalRecordId: normalized.mode === 'delivery' ? normalized.principalRecordId : '',
+        principalVersion: normalized.mode === 'delivery' ? normalized.principalVersion : 0,
+        headlessLineageId: normalized.mode === 'headless' ? normalized.lineageId : '',
+        headlessLineageVersion: normalized.mode === 'headless' ? normalized.lineageVersion : 0,
+    };
+}
+function namespaceSqlValues(namespace) {
+    return [
+        namespace.namespaceMode,
+        namespace.namespaceKey,
+        namespace.principalDigest,
+        namespace.namespaceMode === 'delivery' ? namespace.principalRecordId : null,
+        namespace.namespaceMode === 'delivery' ? namespace.principalVersion : null,
+        namespace.namespaceMode === 'headless' ? namespace.headlessLineageId : null,
+        namespace.namespaceMode === 'headless' ? namespace.headlessLineageVersion : null,
+    ];
+}
+function namespaceFromRow(row) {
+    if (row.namespace_mode === 'legacy-quarantine' || row.principal_digest === null) {
+        throw new MemoryStoreError('invalid-identity', 'legacy memory owner namespace is quarantined');
+    }
+    const namespace = row.namespace_mode === 'delivery'
+        ? {
+            mode: 'delivery',
+            principalDigest: row.principal_digest,
+            principalRecordId: row.principal_record_id,
+            principalVersion: row.principal_version,
+        }
+        : {
+            mode: 'headless',
+            principalDigest: row.principal_digest,
+            lineageId: row.headless_lineage_id,
+            lineageVersion: row.headless_lineage_version,
+        };
+    const normalized = normalizeMemoryOwnerNamespace(namespace);
+    if (memoryOwnerNamespaceKey(normalized) !== row.namespace_key) {
+        throw new MemoryStoreError('invalid-identity', 'stored memory owner namespace digest is invalid');
+    }
+    return normalized;
+}
+function namespaceMatchesRow(row, namespace) {
+    return row.namespace_key === memoryOwnerNamespaceKey(namespace);
+}
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right, 'en'))
+        .map(([key, nested]) => [key, stableValue(nested)]));
+}
+function stableJson(value) {
+    return JSON.stringify(stableValue(value));
+}
+function validatePromotionReference(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value.promotionGeneration) || value.promotionGeneration < 1
+        || !Number.isSafeInteger(value.ownerGeneration) || value.ownerGeneration < 1
+        || !SHA_256.test(value.requestDigest)
+        || typeof value.scope !== 'object' || value.scope === null
+        || !isAbsolute(value.scope.workspace)) {
+        throw new MemoryStoreError('invalid-entry', 'memory promotion reference is invalid');
+    }
+    return Object.freeze({
+        promotionId: boundedText(value.promotionId, 'memory promotion id'),
+        promotionGeneration: value.promotionGeneration,
+        requestDigest: value.requestDigest,
+        ownerGeneration: value.ownerGeneration,
+        scope: Object.freeze({
+            workspace: value.scope.workspace,
+            preset: boundedText(value.scope.preset, 'memory promotion preset'),
+        }),
+        ...(value.prePolicyStatus === undefined ? {} : {
+            prePolicyStatus: value.prePolicyStatus,
+        }),
+    });
+}
+function normalizeIdentity(identity, namespace) {
     if (identity.owner !== 'user' && identity.owner !== 'agent') {
         throw new MemoryStoreError('invalid-identity', 'memory owner must be user or agent');
     }
@@ -35,6 +175,7 @@ function normalizeIdentity(identity) {
         throw new MemoryStoreError('invalid-identity', 'user-owned memory must not carry an agent preset');
     }
     return {
+        ...namespaceColumns(namespace),
         owner: identity.owner,
         scope: identity.scope,
         workspace: identity.workspace ?? '',
@@ -51,7 +192,11 @@ function normalizeAgentContext(context) {
     if (context.agentPreset.trim() === '') {
         throw new MemoryStoreError('invalid-identity', 'memory search requires a non-empty agent preset');
     }
-    return { workspace: context.workspace, agentPreset: context.agentPreset };
+    return {
+        workspace: context.workspace,
+        agentPreset: context.agentPreset,
+        namespace: normalizeMemoryOwnerNamespace(context.namespace),
+    };
 }
 function publicIdentity(identity) {
     return {
@@ -81,16 +226,19 @@ function contentHash(content) {
 export function hashMemoryMutation(mutation) {
     return createHash('sha256').update(JSON.stringify(mutation)).digest('hex');
 }
+export function hashMemoryProposalIntent(input) {
+    return createHash('sha256').update(stableJson({
+        mutation: input.mutation,
+        namespace: normalizeMemoryOwnerNamespace(input.namespace),
+        promotion: validatePromotionReference(input.promotion) ?? null,
+        ttlMs: input.ttlMs,
+        notAfter: input.notAfter,
+        dispatch: input.dispatch ?? null,
+    })).digest('hex');
+}
 export function missingPolicyProposalId(proposalId, ttlMs, dispatch) {
-    const canonicalDispatch = dispatch === undefined
-        ? null
-        : {
-            sourceId: dispatch.sourceId,
-            bindingId: dispatch.bindingId,
-            workspace: dispatch.workspace,
-            principal: dispatch.principal,
-        };
-    const fingerprint = createHash('sha256').update(JSON.stringify({
+    const canonicalDispatch = dispatch ?? null;
+    const fingerprint = createHash('sha256').update(stableJson({
         proposalId,
         ttlMs,
         dispatch: canonicalDispatch,
@@ -131,6 +279,20 @@ export class MemoryStore {
         this.#closed = true;
         this.#database.close();
     }
+    resolveProposalNotAfter(namespace, idempotencyKey, ttlMs, requested) {
+        const key = memoryOwnerNamespaceKey(namespace);
+        const existing = this.#proposalByIdempotencyKey(key, idempotencyKey)
+            ?? this.#proposalIntentByIdempotencyKey(key, idempotencyKey);
+        if (existing !== undefined)
+            return existing.not_after;
+        const now = this.#now();
+        const notAfter = requested ?? now + ttlMs;
+        if (!Number.isSafeInteger(now) || !Number.isSafeInteger(ttlMs) || ttlMs <= 0
+            || !Number.isSafeInteger(notAfter) || notAfter < 0 || notAfter > now + ttlMs) {
+            throw new MemoryStoreError('invalid-entry', 'proposal deadline is invalid');
+        }
+        return notAfter;
+    }
     #transaction(operation) {
         this.#database.exec('BEGIN IMMEDIATE');
         try {
@@ -143,20 +305,20 @@ export class MemoryStore {
             throw error;
         }
     }
-    get(identity, id) {
-        const columns = normalizeIdentity(identity);
+    get(namespace, identity, id) {
+        const columns = normalizeIdentity(identity, namespace);
         const row = this.#selectRecord(columns, id);
         if (row === undefined || row.status !== 'active' || this.#expired(row))
             return undefined;
         return this.#toRecord(row);
     }
-    list(identity, options = {}) {
-        const columns = normalizeIdentity(identity);
+    list(namespace, identity, options = {}) {
+        const columns = normalizeIdentity(identity, namespace);
         const rows = this.#database.prepare(`
       SELECT * FROM memory_records
-      WHERE owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
+      WHERE namespace_key = ? AND owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
       ORDER BY created_at ASC, id ASC
-    `).all(columns.owner, columns.scope, columns.workspace, columns.agentPreset);
+    `).all(columns.namespaceKey, columns.owner, columns.scope, columns.workspace, columns.agentPreset);
         return rows
             .filter(row => row.status === 'removed' ? options.includeRemoved === true : !this.#expired(row))
             .map(row => this.#toRecord(row));
@@ -183,11 +345,14 @@ export class MemoryStore {
         SUM(CASE WHEN status = 'removed' THEN 1 ELSE 0 END) AS removed_records,
         SUM(CASE WHEN status = 'active' AND expires_at IS NOT NULL AND expires_at <= ? THEN 1 ELSE 0 END) AS expired_records
       FROM memory_records
+      WHERE namespace_mode <> 'legacy-quarantine'
     `).get(now, now);
         const proposals = this.#database.prepare(`
       SELECT
-        (SELECT COUNT(*) FROM memory_proposals WHERE status = 'pending')
-        + (SELECT COUNT(*) FROM memory_proposal_intents) AS count
+        (SELECT COUNT(*) FROM memory_proposals
+          WHERE namespace_mode <> 'legacy-quarantine' AND status = 'pending')
+        + (SELECT COUNT(*) FROM memory_proposal_intents
+          WHERE namespace_mode <> 'legacy-quarantine') AS count
     `).get();
         return {
             activeRecords: row.active_records ?? 0,
@@ -205,7 +370,23 @@ export class MemoryStore {
         const normalizedQuery = normalizeContent(request.query).normalize('NFKC').toLocaleLowerCase('en-US');
         const queryTokens = tokenizeMemory(normalizedQuery);
         const queryTokenSet = new Set(queryTokens);
-        const records = this.#visibleRecords(context);
+        const validKinds = new Set(['experience', 'fact', 'instruction', 'preference']);
+        const validTrusts = new Set(['agent-observed', 'external', 'user-confirmed']);
+        const validSensitivities = new Set(['private', 'sensitive']);
+        const requireFilter = (values, allowed, label) => {
+            if (values === undefined)
+                return undefined;
+            if (!Array.isArray(values) || values.length === 0 || values.some(value => !allowed.has(value))) {
+                throw new MemoryStoreError('invalid-entry', `memory search ${label} filter is invalid`);
+            }
+            return new Set(values);
+        };
+        const kinds = requireFilter(request.kinds, validKinds, 'kind');
+        const trusts = requireFilter(request.trusts, validTrusts, 'trust');
+        const sensitivities = requireFilter(request.sensitivities, validSensitivities, 'sensitivity');
+        const records = this.#visibleRecords(context).filter(record => (kinds === undefined || kinds.has(record.kind))
+            && (trusts === undefined || trusts.has(record.trust))
+            && (sensitivities === undefined || sensitivities.has(record.sensitivity)));
         const candidates = records.flatMap((record) => {
             const recordTokens = this.#tokens(record.id);
             const matchedTokens = recordTokens.filter(token => queryTokenSet.has(token));
@@ -300,9 +481,9 @@ export class MemoryStore {
             records: Object.freeze(records),
         });
     }
-    normalizeMutation(mutation, options = {}) {
+    normalizeMutation(mutation, options) {
         const preflight = options.preflight !== false;
-        const columns = normalizeIdentity(mutation.identity);
+        const columns = normalizeIdentity(mutation.identity, options.namespace);
         const identity = publicIdentity(columns);
         if (mutation.op === 'add') {
             const entry = this.#publicEntry(this.#validateEntry(mutation.entry));
@@ -344,10 +525,14 @@ export class MemoryStore {
     }
     prepareProposalIntent(input) {
         const mutationJson = JSON.stringify(input.mutation);
+        const namespace = namespaceColumns(input.namespace);
+        const promotion = validatePromotionReference(input.promotion);
+        const promotionJson = promotion === undefined ? null : JSON.stringify(promotion);
+        const dispatchJson = input.dispatch === undefined ? null : stableJson(input.dispatch);
         const diff = JSON.stringify(input.mutation, null, 2);
         if (input.proposalId.trim() === '' || input.idempotencyKey.trim() === ''
             || input.requester.trim() === '' || input.principal.trim() === ''
-            || !/^[0-9a-f]{64}$/u.test(input.mutationHash)
+            || input.mutationHash !== hashMemoryProposalIntent(input)
             || !Number.isSafeInteger(input.ttlMs) || input.ttlMs <= 0
             || Buffer.byteLength(`personal-memory:${input.idempotencyKey}`, 'utf8') > 512
             || Buffer.byteLength(input.requester, 'utf8') > 512
@@ -355,6 +540,9 @@ export class MemoryStore {
             || Buffer.byteLength(diff, 'utf8') > APPROVAL_DISPLAY_BUDGET.maxDiffBytes) {
             throw new MemoryStoreError('invalid-entry', 'proposal intent fields are invalid');
         }
+        if (input.namespace.principalDigest !== memoryPrincipalDigest(input.principal)) {
+            throw new MemoryStoreError('invalid-identity', 'proposal principal does not match its owner namespace');
+        }
         if (input.dispatch !== undefined
             && (input.dispatch.sourceId.trim() === '' || input.dispatch.bindingId.trim() === ''
                 || !isAbsolute(input.dispatch.workspace) || input.dispatch.principal !== input.principal
@@ -365,10 +553,20 @@ export class MemoryStore {
             throw new MemoryStoreError('invalid-entry', 'proposal intent dispatch route is invalid');
         }
         return this.#transaction(() => {
+            if (promotion !== undefined) {
+                const cancellation = this.#promotionCancellation(promotion.promotionId, promotion.promotionGeneration);
+                if (cancellation !== undefined) {
+                    this.#assertCancellationMatchesPromotion(cancellation, promotion, input.namespace);
+                    return Object.freeze({
+                        kind: 'cancelled',
+                        receipt: this.#cancellationReceiptFromRow(cancellation, 'replayed'),
+                    });
+                }
+            }
             // The proposal and its creation intent live in separate tables. Resolve
             // both under the same write lock so another process cannot attach a local
             // proposal between an absence check and this intent insert.
-            const proposalByKey = this.#proposalByIdempotencyKey(input.idempotencyKey);
+            const proposalByKey = this.#proposalByIdempotencyKey(namespace.namespaceKey, input.idempotencyKey);
             const proposalById = this.#proposal(input.proposalId);
             if (proposalByKey !== undefined || proposalById !== undefined) {
                 const existing = proposalByKey ?? proposalById;
@@ -376,8 +574,9 @@ export class MemoryStore {
                 // possible aliases before returning/raising outside the transaction so
                 // poison work cannot permanently occupy the reconcile lane.
                 this.#database.prepare(`
-          DELETE FROM memory_proposal_intents WHERE id = ? OR idempotency_key = ?
-        `).run(input.proposalId, input.idempotencyKey);
+          DELETE FROM memory_proposal_intents
+          WHERE id = ? OR (namespace_key = ? AND idempotency_key = ?)
+        `).run(input.proposalId, namespace.namespaceKey, input.idempotencyKey);
                 const sameRow = proposalByKey === undefined || proposalById === undefined
                     || proposalByKey.id === proposalById.id;
                 if (!sameRow || !this.#proposalMatchesPrepareInput(existing, input, mutationJson)) {
@@ -385,7 +584,7 @@ export class MemoryStore {
                 }
                 return Object.freeze({ kind: 'proposal', proposal: this.#toProposal(existing) });
             }
-            const intentByKey = this.#proposalIntentByIdempotencyKey(input.idempotencyKey);
+            const intentByKey = this.#proposalIntentByIdempotencyKey(namespace.namespaceKey, input.idempotencyKey);
             const intentById = this.#proposalIntent(input.proposalId);
             if (intentByKey !== undefined || intentById !== undefined) {
                 const existing = intentByKey ?? intentById;
@@ -402,21 +601,25 @@ export class MemoryStore {
             }
             // Keep the mutation preflight in the same transaction as the absence
             // checks. Final application still repeats every CAS/duplicate check.
-            const preflight = this.normalizeMutation(input.mutation);
+            const preflight = this.normalizeMutation(input.mutation, { namespace: input.namespace });
             if (JSON.stringify(preflight) !== mutationJson) {
                 throw new MemoryStoreError('invalid-entry', 'proposal mutation is not canonical');
             }
             const now = this.#now();
-            if (!Number.isSafeInteger(now) || !Number.isSafeInteger(now + input.ttlMs)) {
+            const notAfter = input.notAfter;
+            if (!Number.isSafeInteger(now) || !Number.isSafeInteger(now + input.ttlMs)
+                || !Number.isSafeInteger(notAfter) || notAfter < 0 || notAfter > now + input.ttlMs
+                || (notAfter <= now && promotion?.prePolicyStatus === undefined)) {
                 throw new MemoryStoreError('invalid-entry', 'proposal intent deadline exceeds the safe timestamp range');
             }
             this.#database.prepare(`
         INSERT INTO memory_proposal_intents(
-          id, idempotency_key, requester, principal, mutation_hash, mutation_json, ttl_ms,
-          dispatch_source_id, dispatch_binding_id, dispatch_workspace, dispatch_principal,
+          id, namespace_mode, namespace_key, principal_digest, principal_record_id, principal_version,
+          headless_lineage_id, headless_lineage_version, idempotency_key, requester,
+          principal, mutation_hash, mutation_json, promotion_json, ttl_ms, not_after, dispatch_json,
           created_at, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(input.proposalId, input.idempotencyKey, input.requester, input.principal, input.mutationHash, mutationJson, input.ttlMs, input.dispatch?.sourceId ?? null, input.dispatch?.bindingId ?? null, input.dispatch?.workspace ?? null, input.dispatch?.principal ?? null, now, now);
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(input.proposalId, ...namespaceSqlValues(namespace), input.idempotencyKey, input.requester, input.principal, input.mutationHash, mutationJson, promotionJson, input.ttlMs, notAfter, dispatchJson, now, now);
             return Object.freeze({
                 kind: 'intent',
                 intent: this.#toProposalIntent(this.#requiredProposalIntent(input.proposalId)),
@@ -431,7 +634,9 @@ export class MemoryStore {
     listProposalIntents(limit) {
         this.#validateProposalListLimit(limit);
         const rows = this.#database.prepare(`
-      SELECT * FROM memory_proposal_intents ORDER BY updated_at, id LIMIT ?
+      SELECT * FROM memory_proposal_intents
+      WHERE namespace_mode <> 'legacy-quarantine'
+      ORDER BY updated_at, id LIMIT ?
     `).all(limit);
         return rows.map(row => this.#toProposalIntent(row));
     }
@@ -444,7 +649,7 @@ export class MemoryStore {
     `).run(now, now, proposalId);
     }
     /** Fail closed after Policy atomically abandons or rejects exact recovery. */
-    conflictProposalIntent(proposalId) {
+    conflictProposalIntent(proposalId, promotion) {
         return this.#transaction(() => {
             const existing = this.#proposal(proposalId);
             if (existing !== undefined) {
@@ -454,29 +659,44 @@ export class MemoryStore {
                 this.#database.prepare(`
           DELETE FROM memory_proposal_intents WHERE id = ? AND idempotency_key = ?
         `).run(existing.id, existing.idempotency_key);
-                return { proposal: this.#toProposal(existing), replayed: true };
+                const proposal = this.#toProposal(existing);
+                if (promotion !== undefined)
+                    this.#enqueuePromotionResult(proposal, undefined, promotion);
+                return { proposal, replayed: true };
             }
             const intent = this.#requiredProposalIntent(proposalId);
-            const expiresAt = intent.created_at + intent.ttl_ms;
+            const expiresAt = intent.not_after;
             if (!Number.isSafeInteger(expiresAt)) {
                 throw new MemoryStoreError('invalid-entry', 'proposal intent expiry exceeds the safe timestamp range');
             }
-            return this.#materializeProposalIntentConflict(intent, expiresAt, this.#now());
+            const settled = this.#materializeProposalIntentConflict(intent, expiresAt, this.#now());
+            const terminal = promotion ?? (settled.proposal.promotion === undefined
+                ? undefined
+                : settled.proposal.promotion);
+            if (terminal !== undefined)
+                this.#enqueuePromotionResult(settled.proposal, undefined, terminal);
+            return settled;
         });
     }
     saveProposal(input) {
-        if (!Number.isSafeInteger(input.expiresAt) || !Number.isSafeInteger(input.version) || input.version <= 0) {
+        const namespace = namespaceColumns(input.namespace);
+        const promotion = validatePromotionReference(input.promotion);
+        if (!Number.isSafeInteger(input.expiresAt) || !Number.isSafeInteger(input.notAfter)
+            || input.expiresAt > input.notAfter || !Number.isSafeInteger(input.version) || input.version <= 0) {
             throw new MemoryStoreError('invalid-entry', 'proposal expiry and version must be safe integers');
         }
         return this.#transaction(() => {
-            const existing = this.#proposalByIdempotencyKey(input.idempotencyKey);
+            const existing = this.#proposalByIdempotencyKey(namespace.namespaceKey, input.idempotencyKey);
             if (existing !== undefined) {
                 const same = existing.id === input.proposalId
                     && existing.policy_proposal_id === input.policyProposalId
                     && existing.requester === input.requester
                     && existing.principal === input.principal
+                    && existing.namespace_key === namespace.namespaceKey
                     && existing.mutation_hash === input.mutationHash
-                    && existing.expires_at === input.expiresAt;
+                    && existing.not_after === input.notAfter
+                    && existing.expires_at === input.expiresAt
+                    && existing.promotion_json === (promotion === undefined ? null : JSON.stringify(promotion));
                 if (!same)
                     throw new MemoryStoreError('idempotency-conflict', 'proposal key was used for another mutation');
                 this.#database.prepare('DELETE FROM memory_proposal_intents WHERE id = ?').run(input.proposalId);
@@ -485,10 +705,12 @@ export class MemoryStore {
             const now = this.#now();
             this.#database.prepare(`
         INSERT INTO memory_proposals(
-          id, policy_proposal_id, idempotency_key, requester, principal,
-          mutation_hash, mutation_json, status, expires_at, created_at, updated_at, version
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)
-      `).run(input.proposalId, input.policyProposalId, input.idempotencyKey, input.requester, input.principal, input.mutationHash, JSON.stringify(input.mutation), input.expiresAt, now, now, input.version);
+          id, namespace_mode, namespace_key, principal_digest, principal_record_id, principal_version,
+          headless_lineage_id, headless_lineage_version, policy_proposal_id, idempotency_key,
+          requester, principal, mutation_hash, mutation_json, promotion_json, status, not_after, expires_at,
+          created_at, updated_at, version
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?)
+      `).run(input.proposalId, ...namespaceSqlValues(namespace), input.policyProposalId, input.idempotencyKey, input.requester, input.principal, input.mutationHash, JSON.stringify(input.mutation), promotion === undefined ? null : JSON.stringify(promotion), input.notAfter, input.expiresAt, now, now, input.version);
             this.#database.prepare('DELETE FROM memory_proposal_intents WHERE id = ?').run(input.proposalId);
             return { proposal: this.#toProposal(this.#requiredProposal(input.proposalId)), replayed: false };
         });
@@ -504,7 +726,8 @@ export class MemoryStore {
     listPendingProposals(limit) {
         this.#validateProposalListLimit(limit);
         const rows = this.#database.prepare(`
-      SELECT * FROM memory_proposals WHERE status = 'pending'
+      SELECT * FROM memory_proposals
+      WHERE namespace_mode <> 'legacy-quarantine' AND status = 'pending'
       ORDER BY updated_at, id LIMIT ?
     `).all(limit);
         return rows.map(row => this.#toProposal(row));
@@ -517,14 +740,211 @@ export class MemoryStore {
       WHERE id = ? AND status = 'pending'
     `).run(now, now, proposalId);
     }
+    listPendingPromotionResults(limit) {
+        this.#validateProposalListLimit(limit);
+        const rows = this.#database.prepare(`
+      SELECT * FROM memory_promotion_results
+      WHERE state = 'pending' ORDER BY updated_at, promotion_id, promotion_generation LIMIT ?
+    `).all(limit);
+        return rows.map(row => this.#toPromotionResult(row));
+    }
+    getPromotionResult(promotionId, promotionGeneration, resultVersion) {
+        if (!Number.isSafeInteger(promotionGeneration) || promotionGeneration < 1
+            || !Number.isSafeInteger(resultVersion) || resultVersion < 1) {
+            throw new MemoryStoreError('invalid-entry', 'memory promotion result identity is invalid');
+        }
+        const row = this.#database.prepare(`
+      SELECT * FROM memory_promotion_results
+      WHERE promotion_id = ? AND promotion_generation = ? AND result_version = ?
+    `).get(boundedText(promotionId, 'memory promotion id'), promotionGeneration, resultVersion);
+        return row === undefined ? undefined : this.#toPromotionResult(row);
+    }
+    getProposalByPromotion(promotionId, promotionGeneration) {
+        if (!Number.isSafeInteger(promotionGeneration) || promotionGeneration < 1) {
+            throw new MemoryStoreError('invalid-entry', 'memory promotion identity is invalid');
+        }
+        const id = boundedText(promotionId, 'memory promotion id');
+        const match = (json) => {
+            if (json === null)
+                return undefined;
+            const reference = validatePromotionReference(JSON.parse(json));
+            return reference?.promotionId === id && reference.promotionGeneration === promotionGeneration
+                ? reference
+                : undefined;
+        };
+        for (const row of this.#database.prepare(`
+      SELECT * FROM memory_proposals WHERE promotion_json IS NOT NULL ORDER BY updated_at, id
+    `).all()) {
+            const reference = match(row.promotion_json);
+            if (reference !== undefined)
+                return Object.freeze({
+                    kind: 'proposal',
+                    proposal: this.#toProposal(row),
+                    requestDigest: reference.requestDigest,
+                    namespace: namespaceFromRow(row),
+                });
+        }
+        for (const row of this.#database.prepare(`
+      SELECT * FROM memory_proposal_intents WHERE promotion_json IS NOT NULL ORDER BY updated_at, id
+    `).all()) {
+            const reference = match(row.promotion_json);
+            if (reference !== undefined)
+                return Object.freeze({
+                    kind: 'intent',
+                    proposal: this.#toProposalIntent(row),
+                    requestDigest: reference.requestDigest,
+                    namespace: namespaceFromRow(row),
+                });
+        }
+        return undefined;
+    }
+    cancelPromotionBeforeOrAfterSubmit(input) {
+        const request = validatePreferenceMemoryPromotionCancellationRequest(input);
+        return this.#transaction(() => {
+            const existing = this.#promotionCancellation(request.promotionId, request.promotionGeneration);
+            if (existing !== undefined) {
+                const privacyEscalation = existing.reason === 'superseded' && request.reason !== 'superseded';
+                if (privacyEscalation) {
+                    this.#assertCancellationTargetMatchesRequest(existing, request);
+                    const result = this.#database.prepare(`
+            SELECT * FROM memory_promotion_results
+            WHERE promotion_id = ? AND promotion_generation = ?
+          `).get(request.promotionId, request.promotionGeneration);
+                    if (result?.status === 'confirmed') {
+                        this.#assertCancellationMatchesResult(request, result);
+                        this.#compensateConfirmedPromotion(request, result);
+                    }
+                    const receipt = this.#cancellationReceipt(request, 'cancelled');
+                    const now = this.#now();
+                    this.#database.prepare(`
+            UPDATE memory_promotion_cancellations SET
+              cancellation_digest = ?, reason = ?, occurred_at = ?, receipt_digest = ?, updated_at = ?
+            WHERE promotion_id = ? AND promotion_generation = ? AND reason = 'superseded'
+          `).run(request.cancellationDigest, request.reason, request.occurredAt, receipt.receiptDigest, now, request.promotionId, request.promotionGeneration);
+                    return Object.freeze({ outcome: 'cancelled', receipt });
+                }
+                this.#assertCancellationIdentityMatchesRequest(existing, request);
+                const validStoredReceipt = this.#validStoredCancellationReceipt(existing);
+                if (!validStoredReceipt) {
+                    throw new MemoryStoreError('idempotency-conflict', 'promotion cancellation receipt changed');
+                }
+                const result = this.#database.prepare(`
+          SELECT * FROM memory_promotion_results
+          WHERE promotion_id = ? AND promotion_generation = ?
+        `).get(request.promotionId, request.promotionGeneration);
+                if (result?.status === 'confirmed' && request.reason !== 'superseded') {
+                    this.#assertCancellationMatchesResult(request, result);
+                    this.#compensateConfirmedPromotion(request, result);
+                }
+                const legacyPrivacyAlreadyConfirmed = request.reason !== 'superseded'
+                    && existing.receipt_digest === this.#cancellationReceiptFromRow(existing, 'already-confirmed').receiptDigest;
+                if (legacyPrivacyAlreadyConfirmed) {
+                    if (result?.status !== 'confirmed') {
+                        throw new MemoryStoreError('idempotency-conflict', 'legacy privacy cancellation lost its confirmed result');
+                    }
+                    const receipt = this.#cancellationReceipt(request, 'cancelled');
+                    this.#database.prepare(`
+            UPDATE memory_promotion_cancellations SET receipt_digest = ?, updated_at = ?
+            WHERE promotion_id = ? AND promotion_generation = ? AND receipt_digest = ?
+          `).run(receipt.receiptDigest, this.#now(), request.promotionId, request.promotionGeneration, existing.receipt_digest);
+                    return Object.freeze({ outcome: 'cancelled', receipt });
+                }
+                const receipt = this.#cancellationReceiptFromRow(existing, 'replayed');
+                return Object.freeze({ outcome: 'replayed', receipt });
+            }
+            const result = this.#database.prepare(`
+        SELECT * FROM memory_promotion_results
+        WHERE promotion_id = ? AND promotion_generation = ?
+      `).get(request.promotionId, request.promotionGeneration);
+            let outcome = 'cancelled';
+            if (result !== undefined) {
+                this.#assertCancellationMatchesResult(request, result);
+                if (result.status === 'confirmed') {
+                    if (request.reason === 'superseded')
+                        outcome = 'already-confirmed';
+                    else
+                        this.#compensateConfirmedPromotion(request, result);
+                }
+            }
+            const located = result?.status === 'confirmed'
+                ? undefined
+                : this.getProposalByPromotion(request.promotionId, request.promotionGeneration);
+            if (located !== undefined) {
+                this.#assertCancellationMatchesProposal(request, located.proposal);
+                if (located.kind === 'proposal' && located.proposal.status === 'approved') {
+                    throw new MemoryStoreError('idempotency-conflict', 'confirmed promotion lost its durable terminal result');
+                }
+                else {
+                    const terminal = located.kind === 'intent'
+                        ? this.#materializeProposalIntentConflict(this.#requiredProposalIntent(located.proposal.proposalId), located.proposal.notAfter, this.#now()).proposal
+                        : this.#conflictPendingProposalInCurrentTransaction(located.proposal.proposalId);
+                    if (terminal.promotion !== undefined) {
+                        this.#enqueuePromotionResult(terminal, undefined, terminal.promotion);
+                    }
+                }
+            }
+            const receipt = this.#cancellationReceipt(request, outcome);
+            const now = this.#now();
+            this.#database.prepare(`
+        INSERT INTO memory_promotion_cancellations(
+          promotion_id, promotion_generation, request_digest, principal_record_id, principal_version,
+          owner_generation, cancellation_digest, reason, occurred_at, receipt_digest, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(request.promotionId, request.promotionGeneration, request.requestDigest, request.principalLineage.principalRecordId, request.principalLineage.principalVersion, request.ownerGeneration, request.cancellationDigest, request.reason, request.occurredAt, receipt.receiptDigest, now, now);
+            return Object.freeze({ outcome, receipt });
+        });
+    }
+    completePromotionResult(result) {
+        return this.#transaction(() => {
+            const current = this.#requiredExactPromotionResult(result);
+            if (current.state === 'completed')
+                return false;
+            const changed = this.#database.prepare(`
+        UPDATE memory_promotion_results SET state = 'completed', updated_at = ?
+        WHERE promotion_id = ? AND promotion_generation = ? AND result_version = ?
+          AND receipt_digest = ? AND state = 'pending' AND attempt_count = ?
+      `).run(this.#now(), result.promotionId, result.promotionGeneration, result.resultVersion, result.receiptDigest, result.attemptCount);
+            if (changed.changes !== 1)
+                throw new MemoryStoreError('version-conflict', 'promotion result changed');
+            return true;
+        });
+    }
+    deferPromotionResult(result, error) {
+        if (error !== undefined && Buffer.byteLength(error, 'utf8') > 2_048) {
+            throw new MemoryStoreError('invalid-entry', 'promotion delivery error is too large');
+        }
+        return this.#transaction(() => {
+            const current = this.#requiredExactPromotionResult(result);
+            if (current.state === 'completed')
+                return false;
+            const changed = this.#database.prepare(`
+        UPDATE memory_promotion_results SET attempt_count = attempt_count + 1, last_error = ?, updated_at = ?
+        WHERE promotion_id = ? AND promotion_generation = ? AND result_version = ?
+          AND receipt_digest = ? AND state = 'pending' AND attempt_count = ?
+      `).run(error ?? null, this.#now(), result.promotionId, result.promotionGeneration, result.resultVersion, result.receiptDigest, result.attemptCount);
+            if (changed.changes !== 1)
+                throw new MemoryStoreError('version-conflict', 'promotion result changed');
+            return true;
+        });
+    }
     settleProposal(input) {
         const existing = this.#requiredProposal(input.proposalId);
+        if (existing.namespace_mode === 'legacy-quarantine') {
+            throw new MemoryStoreError('invalid-identity', 'legacy memory proposal is quarantined');
+        }
+        const promotion = input.promotion
+            ?? (existing.promotion_json === null ? undefined : {
+                ...JSON.parse(existing.promotion_json),
+            });
         if (existing.status !== 'pending') {
-            return {
+            const settled = {
                 proposal: this.#toProposal(existing),
                 ...this.#proposalRecord(existing),
                 replayed: true,
             };
+            if (promotion !== undefined)
+                this.#transaction(() => this.#enqueuePromotionResult(settled.proposal, settled.record, promotion));
+            return settled;
         }
         if (input.policyStatus !== 'approved') {
             return this.#transaction(() => {
@@ -542,8 +962,11 @@ export class MemoryStore {
           UPDATE memory_proposals SET status = ?, updated_at = ?, version = ?
           WHERE id = ? AND status = 'pending'
         `).run(input.policyStatus, this.#now(), version, input.proposalId);
+                const proposal = this.#toProposal(this.#requiredProposal(input.proposalId));
+                if (promotion !== undefined)
+                    this.#enqueuePromotionResult(proposal, undefined, promotion);
                 return {
-                    proposal: this.#toProposal(this.#requiredProposal(input.proposalId)),
+                    proposal,
                     replayed: false,
                 };
             });
@@ -561,14 +984,18 @@ export class MemoryStore {
                 const record = this.#applyMutationInCurrentTransaction({
                     ...mutation,
                     idempotencyKey: `memory-proposal:${current.id}`,
+                    namespace: namespaceFromRow(current),
                 });
                 this.#database.prepare(`
           UPDATE memory_proposals
           SET status = 'approved', result_memory_id = ?, updated_at = ?, version = ?
           WHERE id = ? AND status = 'pending'
         `).run(record.id, this.#now(), input.policyVersion, input.proposalId);
+                const proposal = this.#toProposal(this.#requiredProposal(input.proposalId));
+                if (promotion !== undefined)
+                    this.#enqueuePromotionResult(proposal, record, promotion);
                 return {
-                    proposal: this.#toProposal(this.#requiredProposal(input.proposalId)),
+                    proposal,
                     record,
                     replayed: false,
                 };
@@ -588,6 +1015,8 @@ export class MemoryStore {
           `).run(this.#now(), input.policyVersion, input.proposalId);
                 }
                 const conflicted = this.#requiredProposal(input.proposalId);
+                if (promotion !== undefined)
+                    this.#enqueuePromotionResult(this.#toProposal(conflicted), undefined, promotion);
                 return { proposal: this.#toProposal(conflicted), replayed: false };
             });
         }
@@ -596,11 +1025,12 @@ export class MemoryStore {
         return this.#transaction(() => this.#applyMutationInCurrentTransaction(mutation));
     }
     #applyMutationInCurrentTransaction(mutation) {
-        const identity = normalizeIdentity(mutation.identity);
+        const identity = normalizeIdentity(mutation.identity, mutation.namespace);
         const hash = hashMemoryMutation(this.#withoutIdempotencyKey(mutation));
         const prior = this.#database.prepare(`
-      SELECT mutation_hash, memory_id FROM memory_audit WHERE idempotency_key = ?
-    `).get(mutation.idempotencyKey);
+      SELECT mutation_hash, memory_id FROM memory_audit
+      WHERE namespace_key = ? AND idempotency_key = ?
+    `).get(identity.namespaceKey, mutation.idempotencyKey);
         if (prior !== undefined) {
             if (prior.mutation_hash !== hash) {
                 throw new MemoryStoreError('idempotency-conflict', 'idempotency key was used for another mutation');
@@ -617,9 +1047,11 @@ export class MemoryStore {
                 : this.#remove(identity, mutation.id, mutation.expectedVersion);
         this.#database.prepare(`
       INSERT INTO memory_audit(
-        idempotency_key, mutation_hash, operation, memory_id, result_version, occurred_at
-      ) VALUES (?, ?, ?, ?, ?, ?)
-    `).run(mutation.idempotencyKey, hash, mutation.op, result.id, result.version, this.#now());
+        namespace_mode, namespace_key, principal_digest, principal_record_id, principal_version,
+        headless_lineage_id, headless_lineage_version, idempotency_key, mutation_hash,
+        operation, memory_id, result_version, occurred_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(...namespaceSqlValues(identity), mutation.idempotencyKey, hash, mutation.op, result.id, result.version, this.#now());
         return result;
     }
     #add(identity, input) {
@@ -630,20 +1062,22 @@ export class MemoryStore {
         const now = this.#now();
         this.#database.prepare(`
       INSERT INTO memory_records(
-        id, owner, scope, workspace, agent_preset, kind, content, content_hash,
+        id, namespace_mode, namespace_key, principal_digest, principal_record_id, principal_version,
+        headless_lineage_id, headless_lineage_version,
+        owner, scope, workspace, agent_preset, kind, content, content_hash,
         sensitivity, trust, confidence, provenance_json, supersedes, expires_at,
         status, created_at, updated_at, version
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, 1)
-    `).run(id, identity.owner, identity.scope, identity.workspace, identity.agentPreset, entry.kind, entry.content, entry.contentHash, entry.sensitivity, entry.trust, entry.confidence, JSON.stringify(entry.provenance), entry.supersedes ?? null, entry.expiresAt ?? null, now, now);
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, 1)
+    `).run(id, ...namespaceSqlValues(identity), identity.owner, identity.scope, identity.workspace, identity.agentPreset, entry.kind, entry.content, entry.contentHash, entry.sensitivity, entry.trust, entry.confidence, JSON.stringify(entry.provenance), entry.supersedes ?? null, entry.expiresAt ?? null, now, now);
         this.#replaceTokens(id, entry.content);
         return this.#toRecord(this.#selectRecord(identity, id));
     }
     #assertRecordCapacity(identity) {
         const count = this.#database.prepare(`
       SELECT COUNT(*) AS count FROM memory_records
-      WHERE owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
+      WHERE namespace_key = ? AND owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
         AND status = 'active' AND (expires_at IS NULL OR expires_at > ?)
-    `).get(identity.owner, identity.scope, identity.workspace, identity.agentPreset, this.#now());
+    `).get(identity.namespaceKey, identity.owner, identity.scope, identity.workspace, identity.agentPreset, this.#now());
         if (count.count >= this.#maxRecordsPerIdentity) {
             throw new MemoryStoreError('record-limit', 'memory identity record limit is reached');
         }
@@ -717,12 +1151,12 @@ export class MemoryStore {
     #assertNoDuplicate(identity, hash, excludedId) {
         const duplicate = this.#database.prepare(`
       SELECT id FROM memory_records
-      WHERE owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
+      WHERE namespace_key = ? AND owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
         AND content_hash = ? AND status = 'active'
         AND (expires_at IS NULL OR expires_at > ?)
         AND (? IS NULL OR id <> ?)
       LIMIT 1
-    `).get(identity.owner, identity.scope, identity.workspace, identity.agentPreset, hash, this.#now(), excludedId ?? null, excludedId ?? null);
+    `).get(identity.namespaceKey, identity.owner, identity.scope, identity.workspace, identity.agentPreset, hash, this.#now(), excludedId ?? null, excludedId ?? null);
         if (duplicate !== undefined)
             throw new MemoryStoreError('duplicate-content', 'active memory content already exists');
     }
@@ -764,8 +1198,8 @@ export class MemoryStore {
     #selectRecord(identity, id) {
         return this.#database.prepare(`
       SELECT * FROM memory_records
-      WHERE id = ? AND owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
-    `).get(id, identity.owner, identity.scope, identity.workspace, identity.agentPreset);
+      WHERE id = ? AND namespace_key = ? AND owner = ? AND scope = ? AND workspace = ? AND agent_preset = ?
+    `).get(id, identity.namespaceKey, identity.owner, identity.scope, identity.workspace, identity.agentPreset);
     }
     #validateProposalListLimit(limit) {
         if (!Number.isSafeInteger(limit) || limit <= 0 || limit > 1_000) {
@@ -776,9 +1210,10 @@ export class MemoryStore {
         return this.#database.prepare('SELECT * FROM memory_proposal_intents WHERE id = ?')
             .get(id);
     }
-    #proposalIntentByIdempotencyKey(key) {
-        return this.#database.prepare('SELECT * FROM memory_proposal_intents WHERE idempotency_key = ?')
-            .get(key);
+    #proposalIntentByIdempotencyKey(namespaceKey, key) {
+        return this.#database.prepare(`
+      SELECT * FROM memory_proposal_intents WHERE namespace_key = ? AND idempotency_key = ?
+    `).get(namespaceKey, key);
     }
     #requiredProposalIntent(id) {
         const intent = this.#proposalIntent(id);
@@ -787,72 +1222,70 @@ export class MemoryStore {
         return intent;
     }
     #materializeProposalIntentConflict(intent, expiresAt, now) {
-        const dispatch = intent.dispatch_source_id === null
+        const dispatch = intent.dispatch_json === null
             ? undefined
-            : {
-                sourceId: intent.dispatch_source_id,
-                bindingId: intent.dispatch_binding_id,
-                workspace: intent.dispatch_workspace,
-                principal: intent.dispatch_principal,
-            };
+            : JSON.parse(intent.dispatch_json);
         this.#database.prepare(`
       INSERT INTO memory_proposals(
-        id, policy_proposal_id, idempotency_key, requester, principal,
-        mutation_hash, mutation_json, status, expires_at, created_at, updated_at, version
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, 'conflicted', ?, ?, ?, 2)
-    `).run(intent.id, missingPolicyProposalId(intent.id, intent.ttl_ms, dispatch), intent.idempotency_key, intent.requester, intent.principal, intent.mutation_hash, intent.mutation_json, expiresAt, intent.created_at, now);
+        id, namespace_mode, namespace_key, principal_digest, principal_record_id, principal_version,
+        headless_lineage_id, headless_lineage_version, policy_proposal_id, idempotency_key,
+        requester, principal, mutation_hash, mutation_json, promotion_json, status, not_after, expires_at,
+        created_at, updated_at, version
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'conflicted', ?, ?, ?, ?, 2)
+    `).run(intent.id, intent.namespace_mode, intent.namespace_key, intent.principal_digest, intent.principal_record_id, intent.principal_version, intent.headless_lineage_id, intent.headless_lineage_version, missingPolicyProposalId(intent.id, intent.ttl_ms, dispatch), intent.idempotency_key, intent.requester, intent.principal, intent.mutation_hash, intent.mutation_json, intent.promotion_json, intent.not_after, expiresAt, intent.created_at, now);
         this.#database.prepare('DELETE FROM memory_proposal_intents WHERE id = ?').run(intent.id);
         return { proposal: this.#toProposal(this.#requiredProposal(intent.id)), replayed: false };
     }
     #intentDispatchMatches(row, dispatch) {
-        if (dispatch === undefined)
-            return row.dispatch_source_id === null
-                && row.dispatch_binding_id === null
-                && row.dispatch_workspace === null
-                && row.dispatch_principal === null;
-        return row.dispatch_source_id === dispatch.sourceId
-            && row.dispatch_binding_id === dispatch.bindingId
-            && row.dispatch_workspace === dispatch.workspace
-            && row.dispatch_principal === dispatch.principal;
+        return row.dispatch_json === (dispatch === undefined ? null : stableJson(dispatch));
     }
     #proposalMatchesPrepareInput(row, input, mutationJson) {
         return row.id === input.proposalId
             && row.idempotency_key === input.idempotencyKey
             && row.requester === input.requester
             && row.principal === input.principal
+            && namespaceMatchesRow(row, input.namespace)
             && row.mutation_json === mutationJson
-            && (row.mutation_hash === input.mutationHash
-                || row.mutation_hash === hashMemoryMutation(input.mutation));
+            && row.mutation_hash === input.mutationHash
+            && row.not_after === input.notAfter
+            && row.promotion_json === (input.promotion === undefined
+                ? null
+                : JSON.stringify(validatePromotionReference(input.promotion)));
     }
     #intentMatchesPrepareInput(row, input, mutationJson) {
         return row.id === input.proposalId
             && row.idempotency_key === input.idempotencyKey
             && row.requester === input.requester
             && row.principal === input.principal
+            && namespaceMatchesRow(row, input.namespace)
             && row.mutation_json === mutationJson
-            && (row.mutation_hash === input.mutationHash
-                || row.mutation_hash === hashMemoryMutation(input.mutation))
+            && row.mutation_hash === input.mutationHash
             && row.ttl_ms === input.ttlMs
+            && row.not_after === input.notAfter
+            && row.promotion_json === (input.promotion === undefined
+                ? null
+                : JSON.stringify(validatePromotionReference(input.promotion)))
             && this.#intentDispatchMatches(row, input.dispatch);
     }
     #toProposalIntent(row) {
-        const dispatch = row.dispatch_source_id === null
+        const dispatch = row.dispatch_json === null
             ? undefined
-            : Object.freeze({
-                sourceId: row.dispatch_source_id,
-                bindingId: row.dispatch_binding_id,
-                workspace: row.dispatch_workspace,
-                principal: row.dispatch_principal,
-            });
+            : Object.freeze(JSON.parse(row.dispatch_json));
+        const promotion = row.promotion_json === null
+            ? undefined
+            : Object.freeze(JSON.parse(row.promotion_json));
         return Object.freeze({
             proposalId: row.id,
             idempotencyKey: row.idempotency_key,
             requester: row.requester,
             principal: row.principal,
+            namespace: namespaceFromRow(row),
             mutationHash: row.mutation_hash,
             mutation: Object.freeze(JSON.parse(row.mutation_json)),
             ttlMs: row.ttl_ms,
+            notAfter: row.not_after,
             ...(dispatch === undefined ? {} : { dispatch }),
+            ...(promotion === undefined ? {} : { promotion }),
             createdAt: row.created_at,
             updatedAt: row.updated_at,
         });
@@ -861,9 +1294,10 @@ export class MemoryStore {
         return this.#database.prepare('SELECT * FROM memory_proposals WHERE id = ?')
             .get(id);
     }
-    #proposalByIdempotencyKey(key) {
-        return this.#database.prepare('SELECT * FROM memory_proposals WHERE idempotency_key = ?')
-            .get(key);
+    #proposalByIdempotencyKey(namespaceKey, key) {
+        return this.#database.prepare(`
+      SELECT * FROM memory_proposals WHERE namespace_key = ? AND idempotency_key = ?
+    `).get(namespaceKey, key);
     }
     #requiredProposal(id) {
         const proposal = this.#proposal(id);
@@ -871,13 +1305,273 @@ export class MemoryStore {
             throw new MemoryStoreError('not-found', 'memory proposal was not found');
         return proposal;
     }
+    #promotionCancellation(id, generation) {
+        return this.#database.prepare(`
+      SELECT * FROM memory_promotion_cancellations
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(id, generation);
+    }
+    #assertCancellationMatchesPromotion(cancellation, promotion, namespace) {
+        if (namespace.mode !== 'delivery'
+            || cancellation.request_digest !== promotion.requestDigest
+            || cancellation.principal_record_id !== namespace.principalRecordId
+            || cancellation.principal_version !== namespace.principalVersion
+            || cancellation.owner_generation !== promotion.ownerGeneration) {
+            throw new MemoryStoreError('idempotency-conflict', 'cancelled promotion identity changed');
+        }
+    }
+    #assertCancellationIdentityMatchesRequest(cancellation, request) {
+        if (cancellation.request_digest !== request.requestDigest
+            || cancellation.principal_record_id !== request.principalLineage.principalRecordId
+            || cancellation.principal_version !== request.principalLineage.principalVersion
+            || cancellation.owner_generation !== request.ownerGeneration
+            || cancellation.cancellation_digest !== request.cancellationDigest
+            || cancellation.reason !== request.reason
+            || cancellation.occurred_at !== request.occurredAt) {
+            throw new MemoryStoreError('idempotency-conflict', 'promotion cancellation identity changed');
+        }
+    }
+    #assertCancellationTargetMatchesRequest(cancellation, request) {
+        if (cancellation.request_digest !== request.requestDigest
+            || cancellation.principal_record_id !== request.principalLineage.principalRecordId
+            || cancellation.principal_version !== request.principalLineage.principalVersion
+            || cancellation.owner_generation !== request.ownerGeneration) {
+            throw new MemoryStoreError('idempotency-conflict', 'promotion cancellation target changed');
+        }
+    }
+    #assertCancellationMatchesProposal(request, proposal) {
+        const promotion = proposal.promotion;
+        if (promotion === undefined || proposal.namespace.mode !== 'delivery'
+            || promotion.requestDigest !== request.requestDigest
+            || promotion.ownerGeneration !== request.ownerGeneration
+            || proposal.namespace.principalRecordId !== request.principalLineage.principalRecordId
+            || proposal.namespace.principalVersion !== request.principalLineage.principalVersion) {
+            throw new MemoryStoreError('idempotency-conflict', 'promotion cancellation does not match its proposal');
+        }
+    }
+    #assertCancellationMatchesResult(request, result) {
+        if (result.request_digest !== request.requestDigest
+            || result.principal_record_id !== request.principalLineage.principalRecordId
+            || result.principal_version !== request.principalLineage.principalVersion
+            || result.owner_generation !== request.ownerGeneration) {
+            throw new MemoryStoreError('idempotency-conflict', 'promotion cancellation does not match its result');
+        }
+    }
+    #compensateConfirmedPromotion(request, result) {
+        if (result.status !== 'confirmed' || result.memory_record_id === null
+            || result.memory_record_version === null || result.memory_record_digest === null) {
+            throw new MemoryStoreError('idempotency-conflict', 'confirmed promotion result is incomplete');
+        }
+        const prior = this.#database.prepare(`
+      SELECT * FROM memory_promotion_compensations
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(request.promotionId, request.promotionGeneration);
+        if (prior !== undefined) {
+            if (prior.request_digest !== request.requestDigest
+                || prior.cancellation_digest !== request.cancellationDigest
+                || prior.memory_proposal_id !== result.memory_proposal_id
+                || prior.memory_proposal_version !== result.memory_proposal_version
+                || prior.memory_record_id !== result.memory_record_id
+                || prior.memory_record_version !== result.memory_record_version
+                || prior.memory_record_digest !== result.memory_record_digest) {
+                throw new MemoryStoreError('idempotency-conflict', 'promotion compensation identity changed');
+            }
+            return;
+        }
+        const record = this.#database.prepare(`
+      SELECT * FROM memory_records WHERE id = ? AND namespace_key = ?
+    `).get(result.memory_record_id, result.namespace_key);
+        if (record === undefined || record.version !== result.memory_record_version
+            || record.content_hash !== result.memory_record_digest || record.status !== 'active') {
+            throw new MemoryStoreError('version-conflict', 'promotion-created Memory record changed before compensation');
+        }
+        const now = this.#now();
+        const removed = this.#database.prepare(`
+      UPDATE memory_records SET status = 'removed', updated_at = ?, version = version + 1
+      WHERE id = ? AND namespace_key = ? AND version = ? AND content_hash = ? AND status = 'active'
+    `).run(now, result.memory_record_id, result.namespace_key, result.memory_record_version, result.memory_record_digest);
+        if (removed.changes !== 1) {
+            throw new MemoryStoreError('version-conflict', 'promotion compensation lost its record CAS');
+        }
+        this.#database.prepare('DELETE FROM memory_tokens WHERE memory_id = ?').run(result.memory_record_id);
+        this.#database.prepare(`
+      INSERT INTO memory_promotion_compensations(
+        promotion_id, promotion_generation, request_digest, cancellation_digest,
+        memory_proposal_id, memory_proposal_version, memory_record_id,
+        memory_record_version, memory_record_digest, removed_record_version, compensated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(request.promotionId, request.promotionGeneration, request.requestDigest, request.cancellationDigest, result.memory_proposal_id, result.memory_proposal_version, result.memory_record_id, result.memory_record_version, result.memory_record_digest, result.memory_record_version + 1, now);
+    }
+    #cancellationReceipt(input, outcome) {
+        return withPreferenceMemoryPromotionCancellationReceiptDigest({
+            contractVersion: 1,
+            promotionId: input.promotionId,
+            promotionGeneration: input.promotionGeneration,
+            requestDigest: input.requestDigest,
+            cancellationDigest: input.cancellationDigest,
+            outcome,
+        });
+    }
+    #cancellationReceiptFromRow(row, outcome) {
+        return this.#cancellationReceipt({
+            promotionId: row.promotion_id,
+            promotionGeneration: row.promotion_generation,
+            requestDigest: row.request_digest,
+            cancellationDigest: row.cancellation_digest,
+        }, outcome);
+    }
+    #validStoredCancellationReceipt(row) {
+        return row.receipt_digest === this.#cancellationReceiptFromRow(row, 'cancelled').receiptDigest
+            || row.receipt_digest === this.#cancellationReceiptFromRow(row, 'already-confirmed').receiptDigest;
+    }
+    #conflictPendingProposalInCurrentTransaction(proposalId) {
+        const current = this.#requiredProposal(proposalId);
+        if (current.status === 'pending') {
+            this.#database.prepare(`
+        UPDATE memory_proposals SET status = 'conflicted', updated_at = ?, version = version + 1
+        WHERE id = ? AND status = 'pending'
+      `).run(this.#now(), proposalId);
+        }
+        return this.#toProposal(this.#requiredProposal(proposalId));
+    }
     #proposalRecord(row) {
         if (row.result_memory_id === null)
             return {};
         const proposal = this.#toProposal(row);
-        const record = this.#selectRecord(normalizeIdentity(proposal.mutation.identity), row.result_memory_id);
+        const record = this.#selectRecord(normalizeIdentity(proposal.mutation.identity, proposal.namespace), row.result_memory_id);
         return record === undefined ? {} : { record: this.#toRecord(record) };
     }
+    #enqueuePromotionResult(proposal, record, input) {
+        const reference = validatePromotionReference(input);
+        if (proposal.promotion !== undefined
+            && JSON.stringify(proposal.promotion) !== JSON.stringify(reference)) {
+            throw new MemoryStoreError('idempotency-conflict', 'promotion settlement does not match its proposal');
+        }
+        if (proposal.status === 'pending') {
+            throw new MemoryStoreError('invalid-entry', 'promotion result requires a terminal proposal');
+        }
+        const status = input.statusOverride
+            ?? (proposal.status === 'approved' ? 'confirmed' : proposal.status);
+        if ((status === 'confirmed') !== (record !== undefined)) {
+            throw new MemoryStoreError('invalid-entry', 'promotion terminal result is inconsistent');
+        }
+        const resultVersion = 1;
+        const namespace = namespaceColumns(proposal.namespace);
+        const existing = this.#database.prepare(`
+      SELECT * FROM memory_promotion_results
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(reference.promotionId, reference.promotionGeneration);
+        if (existing !== undefined) {
+            if (existing.request_digest !== reference.requestDigest
+                || existing.memory_proposal_id !== proposal.proposalId
+                || existing.status !== status
+                || existing.memory_proposal_version !== proposal.version
+                || existing.namespace_key !== namespace.namespaceKey
+                || existing.memory_record_id !== (record?.id ?? null)
+                || existing.memory_record_version !== (record?.version ?? null)
+                || existing.memory_record_digest !== (record?.contentHash ?? null)) {
+                throw new MemoryStoreError('idempotency-conflict', 'promotion result identity was reused');
+            }
+            return this.#toPromotionResult(existing);
+        }
+        const occurredAt = this.#now();
+        const common = {
+            contractVersion: 1,
+            promotionId: reference.promotionId,
+            promotionGeneration: reference.promotionGeneration,
+            requestDigest: reference.requestDigest,
+            resultVersion,
+            occurredAt,
+        };
+        const wire = status === 'stale-owner'
+            ? { ...common, status }
+            : status === 'rejected'
+                ? {
+                    ...common, status, rejectionKind: 'owner-explicit',
+                    memoryProposalId: proposal.proposalId, memoryProposalVersion: proposal.version,
+                }
+                : status === 'confirmed'
+                    ? {
+                        ...common, status, memoryProposalId: proposal.proposalId,
+                        memoryProposalVersion: proposal.version,
+                        memoryRecordId: record.id,
+                        memoryRecordVersion: record.version,
+                        memoryRecordDigest: record.contentHash,
+                    }
+                    : {
+                        ...common, status, memoryProposalId: proposal.proposalId,
+                        memoryProposalVersion: proposal.version,
+                    };
+        const receipt = withPreferenceMemoryPromotionResultDigest(wire);
+        const internal = {
+            ...receipt,
+            namespace: proposal.namespace,
+            memoryProposalId: proposal.proposalId,
+            memoryProposalVersion: proposal.version,
+            ...(record === undefined ? {} : {
+                memoryRecordId: record.id,
+                memoryRecordVersion: record.version,
+                memoryRecordDigest: record.contentHash,
+            }),
+        };
+        this.#database.prepare(`
+      INSERT INTO memory_promotion_results(
+        promotion_id, promotion_generation, request_digest, namespace_mode, namespace_key, principal_digest,
+        principal_record_id, principal_version, headless_lineage_id, headless_lineage_version, owner_generation,
+        contract_version, result_version, status, memory_proposal_id, memory_proposal_version, occurred_at,
+        receipt_digest, memory_record_id, memory_record_version, memory_record_digest, state, attempt_count,
+        last_error, created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, NULL, ?, ?)
+    `).run(reference.promotionId, reference.promotionGeneration, reference.requestDigest, ...namespaceSqlValues(namespace), reference.ownerGeneration, resultVersion, status, proposal.proposalId, proposal.version, occurredAt, internal.receiptDigest, record?.id ?? null, record?.version ?? null, record?.contentHash ?? null, occurredAt, occurredAt);
+        return this.#toPromotionResult(this.#database.prepare(`
+      SELECT * FROM memory_promotion_results WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(reference.promotionId, reference.promotionGeneration));
+    }
+    #requiredExactPromotionResult(result) {
+        const row = this.#database.prepare(`
+      SELECT * FROM memory_promotion_results WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(result.promotionId, result.promotionGeneration);
+        if (row === undefined)
+            throw new MemoryStoreError('not-found', 'promotion result was not found');
+        const current = this.#toPromotionResult(row);
+        if (current.resultVersion !== result.resultVersion || current.receiptDigest !== result.receiptDigest
+            || current.attemptCount !== result.attemptCount) {
+            throw new MemoryStoreError('version-conflict', 'promotion result changed');
+        }
+        return row;
+    }
+    #toPromotionResult(row) {
+        const namespace = namespaceFromRow(row);
+        return Object.freeze({
+            contractVersion: 1,
+            promotionId: row.promotion_id,
+            promotionGeneration: row.promotion_generation,
+            requestDigest: row.request_digest,
+            scope: this.#promotionScope(row.memory_proposal_id),
+            ownerGeneration: row.owner_generation,
+            namespace,
+            resultVersion: row.result_version,
+            status: row.status,
+            memoryProposalId: row.memory_proposal_id,
+            memoryProposalVersion: row.memory_proposal_version,
+            occurredAt: row.occurred_at,
+            receiptDigest: row.receipt_digest,
+            ...(row.memory_record_id === null ? {} : { memoryRecordId: row.memory_record_id }),
+            ...(row.memory_record_version === null ? {} : { memoryRecordVersion: row.memory_record_version }),
+            ...(row.memory_record_digest === null ? {} : { memoryRecordDigest: row.memory_record_digest }),
+            state: row.state,
+            attemptCount: row.attempt_count,
+            updatedAt: row.updated_at,
+        });
+    }
+    #promotionScope(proposalId) {
+        const row = this.#requiredProposal(proposalId);
+        if (row.promotion_json === null) {
+            throw new MemoryStoreError('invalid-entry', 'promotion result lost its durable proposal reference');
+        }
+        const reference = validatePromotionReference(JSON.parse(row.promotion_json));
+        return reference.scope;
+    }
     #toProposal(row) {
         return Object.freeze({
             proposalId: row.id,
@@ -885,20 +1579,25 @@ export class MemoryStore {
             idempotencyKey: row.idempotency_key,
             requester: row.requester,
             principal: row.principal,
+            namespace: namespaceFromRow(row),
             mutationHash: row.mutation_hash,
             mutation: Object.freeze(JSON.parse(row.mutation_json)),
             status: row.status,
+            notAfter: row.not_after,
             expiresAt: row.expires_at,
             version: row.version,
             ...(row.result_memory_id === null ? {} : { resultMemoryId: row.result_memory_id }),
+            ...(row.promotion_json === null
+                ? {}
+                : { promotion: Object.freeze(JSON.parse(row.promotion_json)) }),
         });
     }
     #visibleRecords(context) {
         return [
-            ...this.list({ owner: 'user', scope: 'user-global' }),
-            ...this.list({ owner: 'user', scope: 'workspace', workspace: context.workspace }),
-            ...this.list({ owner: 'agent', scope: 'user-global', agentPreset: context.agentPreset }),
-            ...this.list({
+            ...this.list(context.namespace, { owner: 'user', scope: 'user-global' }),
+            ...this.list(context.namespace, { owner: 'user', scope: 'workspace', workspace: context.workspace }),
+            ...this.list(context.namespace, { owner: 'agent', scope: 'user-global', agentPreset: context.agentPreset }),
+            ...this.list(context.namespace, {
                 owner: 'agent',
                 scope: 'workspace',
                 workspace: context.workspace,
@@ -926,6 +1625,7 @@ export class MemoryStore {
     #toRecord(row) {
         return Object.freeze({
             id: row.id,
+            namespace: namespaceFromRow(row),
             owner: row.owner,
             scope: row.scope,
             ...(row.workspace === '' ? {} : { workspace: row.workspace }),