@dsh-enhanced/preference-learning 0.1.7 → 0.1.12

package/lib/store.js

@@ -1,7 +1,8 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { isAbsolute, resolve } from 'node:path';
+import { PREFERENCE_MEMORY_PROMOTION_KEY, PREFERENCE_MEMORY_PROMOTION_RENDERER_ID, PREFERENCE_MEMORY_PROMOTION_VALUE, validatePreferenceMemoryPromotionRequest, validatePreferenceMemoryPromotionCancellationReceipt, validatePreferenceMemoryPromotionCancellationRequest, validatePreferenceMemoryPromotionResult, validatePreferenceMemoryPromotionSubmissionReceipt, withPreferenceMemoryPromotionRequestDigest, withPreferenceMemoryPromotionCancellationDigest, } from '@dsh-enhanced/assistant-growth-contract';
 import { catalogSelection, preferenceCatalog, renderCatalogPreference, } from './catalog.js';
-import { openPreferenceDatabase, preferenceSchemaVersion } from './sqlite.js';
+import { openPreferenceDatabase, preferencePromotionCancellationUpgradeBindingDigest, preferenceSchemaVersion, } from './sqlite.js';
 import { preferenceActorTrustLevels, preferenceInterpretationTrustLevels, preferenceRollbackReasons, preferenceSignalSources, preferenceSignalStances, } from './types.js';
 export class PreferenceStoreError extends Error {
     code;
@@ -44,6 +45,36 @@ function safeTimestamp(value, label) {
     }
     return value;
 }
+export function canonicalPreferenceAdmissionCursor(value) {
+    if (typeof value !== 'object' || value === null) {
+        throw new PreferenceStoreError('invalid-input', 'admission cursor is invalid');
+    }
+    const epoch = boundedText(value.epoch, 'admissionCursor.epoch', 32);
+    if (!/^[0-9a-f]{32}$/u.test(epoch)) {
+        throw new PreferenceStoreError('invalid-input', 'admissionCursor.epoch must be a 32-character lowercase hexadecimal identifier');
+    }
+    if (!Number.isSafeInteger(value.sequence) || value.sequence < 1) {
+        throw new PreferenceStoreError('invalid-input', 'admissionCursor.sequence must be a positive safe integer');
+    }
+    return Object.freeze({ epoch, sequence: value.sequence });
+}
+function preferencePrincipalDigest(value) {
+    const principalId = boundedText(value, 'principalId', 500);
+    return createHash('sha256')
+        .update('preference-scope-principal-v1\0')
+        .update(principalId)
+        .digest('hex');
+}
+function canonicalPreferencePrincipalLineage(value) {
+    if (typeof value !== 'object' || value === null) {
+        throw new PreferenceStoreError('invalid-input', 'principal lineage is invalid');
+    }
+    const principalRecordId = boundedText(value.principalRecordId, 'principalRecordId', 500);
+    if (!Number.isSafeInteger(value.principalVersion) || value.principalVersion < 1) {
+        throw new PreferenceStoreError('invalid-input', 'principalVersion must be a positive safe integer');
+    }
+    return Object.freeze({ principalRecordId, principalVersion: value.principalVersion });
+}
 export function canonicalPreferenceScope(input) {
     const workspace = boundedText(input.workspace, 'scope.workspace', 4_096);
     if (!isAbsolute(workspace))
@@ -62,6 +93,34 @@ export function canonicalPreferenceScope(input) {
 function payloadHash(value) {
     return createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }
+function exactT1PreferenceKey(value) {
+    if (typeof value !== 'string' || !Object.hasOwn(preferenceCatalog, value)) {
+        throw new PreferenceStoreError('invalid-input', 'preferenceKey is not an exact Host catalog key');
+    }
+    const key = value;
+    if (preferenceCatalog[key].riskTier !== 'T1') {
+        throw new PreferenceStoreError('forbidden-tier', 'owner rollback only accepts Host catalog T1 keys');
+    }
+    return key;
+}
+function explanationFromRow(row) {
+    const key = exactT1PreferenceKey(row.preference_key);
+    try {
+        catalogSelection(key, row.candidate_value);
+    }
+    catch {
+        throw new PreferenceStoreError('conflict', 'T1 explanation row is outside the Host catalog');
+    }
+    return Object.freeze({
+        key,
+        value: row.candidate_value,
+        state: row.effect_state,
+        version: row.version,
+        supportingSignals: row.supporting_signals,
+        contradictingSignals: row.contradicting_signals,
+        evidenceMass: row.evidence_mass,
+    });
+}
 function signalFromRow(row) {
     return Object.freeze({
         id: row.id,
@@ -100,6 +159,89 @@ function hypothesisFromRow(row) {
         updatedAt: row.updated_at,
     });
 }
+function promotionRequestFromRow(row) {
+    return validatePreferenceMemoryPromotionRequest({
+        contractVersion: 1,
+        promotionId: row.promotion_id,
+        promotionGeneration: row.promotion_generation,
+        requestDigest: row.request_digest,
+        idempotencyKey: row.idempotency_key,
+        scope: { workspace: row.workspace, preset: row.preset },
+        principalId: row.principal_id,
+        principalLineage: {
+            principalRecordId: row.principal_lineage_id,
+            principalVersion: row.principal_lineage_version,
+        },
+        ownerGeneration: row.owner_generation,
+        hypothesis: {
+            id: row.hypothesis_id,
+            key: row.hypothesis_key,
+            value: row.hypothesis_value,
+            version: row.hypothesis_version,
+            confidenceBps: row.confidence_bps,
+            contradictionBps: row.contradiction_bps,
+            supportingSignals: row.supporting_signals,
+            distinctSignalSources: row.distinct_signal_sources,
+            evidenceMass: row.evidence_mass,
+        },
+        rendererId: row.renderer_id,
+        observedAt: row.observed_at,
+        deadlineAt: row.deadline_at,
+    });
+}
+function promotionFromRow(row) {
+    return Object.freeze({
+        request: promotionRequestFromRow(row),
+        state: row.state,
+        ...(row.memory_proposal_id === null ? {} : { memoryProposalId: row.memory_proposal_id }),
+        ...(row.submission_receipt_digest === null
+            ? {} : { submissionReceiptDigest: row.submission_receipt_digest }),
+        ...(row.terminal_result_version === null
+            ? {} : { terminalResultVersion: row.terminal_result_version }),
+        ...(row.terminal_receipt_digest === null
+            ? {} : { terminalReceiptDigest: row.terminal_receipt_digest }),
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    });
+}
+function promotionResultFromRow(row) {
+    const common = {
+        contractVersion: 1,
+        promotionId: row.promotion_id,
+        promotionGeneration: row.promotion_generation,
+        requestDigest: row.request_digest,
+        resultVersion: row.result_version,
+        status: row.status,
+        occurredAt: row.occurred_at,
+        receiptDigest: row.receipt_digest,
+    };
+    if (row.status === 'confirmed') {
+        return validatePreferenceMemoryPromotionResult({
+            ...common,
+            memoryProposalId: row.memory_proposal_id,
+            memoryProposalVersion: row.memory_proposal_version,
+            memoryRecordId: row.memory_record_id,
+            memoryRecordVersion: row.memory_record_version,
+            memoryRecordDigest: row.memory_record_digest,
+        });
+    }
+    if (row.status === 'rejected') {
+        return validatePreferenceMemoryPromotionResult({
+            ...common,
+            rejectionKind: row.rejection_kind,
+            memoryProposalId: row.memory_proposal_id,
+            memoryProposalVersion: row.memory_proposal_version,
+        });
+    }
+    if (row.status === 'expired' || row.status === 'conflicted') {
+        return validatePreferenceMemoryPromotionResult({
+            ...common,
+            memoryProposalId: row.memory_proposal_id,
+            memoryProposalVersion: row.memory_proposal_version,
+        });
+    }
+    return validatePreferenceMemoryPromotionResult(common);
+}
 function hypothesisId(scopeKey, preferenceKey, candidateValue) {
     return `pref-hyp-${createHash('sha256')
         .update(`preference-hypothesis-v1\0${scopeKey}\0${preferenceKey}\0${candidateValue}`)
@@ -118,16 +260,22 @@ function assertSignalProvenance(input) {
         && !['owner-authenticated', 'delegated-authenticated'].includes(input.actorTrust)) {
         throw new PreferenceStoreError('invalid-input', 'signed-ui-feedback requires authenticated actor trust');
     }
+    if (input.source === 'delivery-observation' && input.actorTrust === 'owner-authenticated'
+        && input.interpretationTrust !== 'behavioral-inference') {
+        throw new PreferenceStoreError('invalid-input', 'owner delivery-observation requires behavioral interpretation');
+    }
 }
 /**
- * Only an authenticated owner's explicit, typed feedback can unlock an
- * automatic T1 effect. Lower-trust observations remain useful shadow evidence
- * and contradictions, but no amount of repetition can promote them by itself.
+ * Only Delivery-attested owner evidence can unlock an automatic T1 effect.
+ * Behavioral evidence is limited to the private completed-turn lane; the
+ * public observation surface is always system-attested and remains ineligible.
  */
 function isActivationEligibleSignal(signal) {
     return signal.actor_trust === 'owner-authenticated'
-        && ['explicit-selection', 'typed-feedback'].includes(signal.interpretation_trust)
-        && ['direct-owner-feedback', 'signed-ui-feedback'].includes(signal.source);
+        && ((['explicit-selection', 'typed-feedback'].includes(signal.interpretation_trust)
+            && ['direct-owner-feedback', 'signed-ui-feedback'].includes(signal.source))
+            || (signal.interpretation_trust === 'behavioral-inference'
+                && signal.source === 'delivery-observation'));
 }
 export class PreferenceStore {
     #database;
@@ -141,18 +289,1163 @@ export class PreferenceStore {
             signalTtlMs: options.signalTtlMs,
             hypothesisTtlMs: options.hypothesisTtlMs,
             minSignalsForActivation: options.minSignalsForActivation,
+            minBehavioralSignalsForActivation: options.minBehavioralSignalsForActivation ?? 6,
             minConfidenceBps: options.minConfidenceBps,
             maxContradictionBps: options.maxContradictionBps,
             maxActiveOverlays: options.maxActiveOverlays,
             maxReviewHypotheses: options.maxReviewHypotheses,
             maxOverlayBytes: options.maxOverlayBytes,
+            minSignalsForPromotion: options.minSignalsForPromotion ?? 3,
+            minConfidenceBpsForPromotion: options.minConfidenceBpsForPromotion ?? 8_500,
+            maxContradictionBpsForPromotion: options.maxContradictionBpsForPromotion ?? 1_500,
+            promotionProposalTtlMs: options.promotionProposalTtlMs ?? 604_800_000,
         });
     }
     appendSignal(input) {
         return this.appendSignals([input])[0];
     }
+    /**
+     * Materialize every currently eligible low-sensitivity T2 hypothesis into a
+     * durable promotion plus proposal outbox row in the same SQLite transaction.
+     * Eligibility requires repeated evidence from at least two independent
+     * interpretation/source channels; one signal can never emit a proposal.
+     */
+    enqueueEligibleMemoryPromotions(scopeInput, principalIdInput, owner) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const principalId = boundedText(principalIdInput, 'principalId', 500);
+        const principalDigest = preferencePrincipalDigest(principalId);
+        if (principalDigest !== owner.principalDigest) {
+            throw new PreferenceStoreError('conflict', 'promotion principal does not match owner fence');
+        }
+        const now = this.#now();
+        const created = [];
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            this.#assertScopeLearningActiveInTransaction(canonical);
+            this.#refreshScopeInTransaction(canonical.scopeKey, canonical.scope, now);
+            const candidates = this.#database.prepare(`
+        SELECT hypothesis.*, (
+          SELECT COUNT(DISTINCT signal.interpretation_trust || ':' || signal.source)
+          FROM preference_signals signal
+          WHERE signal.scope_key = hypothesis.scope_key
+            AND signal.preference_key = hypothesis.preference_key
+            AND signal.candidate_value = hypothesis.candidate_value
+            AND signal.stance = 'support'
+            AND signal.actor_trust = 'owner-authenticated'
+            AND signal.interpretation_trust IN ('explicit-selection', 'typed-feedback')
+            AND signal.source IN ('direct-owner-feedback', 'signed-ui-feedback')
+            AND signal.occurred_at >= ?
+        ) AS distinct_signal_sources
+        FROM preference_hypotheses hypothesis
+        WHERE hypothesis.scope_key = ?
+          AND hypothesis.preference_key = ? AND hypothesis.candidate_value = ?
+          AND hypothesis.risk_tier = 'T2' AND hypothesis.claim_state = 'proposed'
+          AND hypothesis.effect_state = 'inactive' AND hypothesis.expires_at > ?
+          AND hypothesis.supporting_signals >= ?
+          AND hypothesis.confidence_bps >= ?
+          AND hypothesis.contradiction_bps <= ?
+        ORDER BY hypothesis.updated_at, hypothesis.id
+      `).all(Math.max(0, now - this.#options.signalTtlMs), canonical.scopeKey, PREFERENCE_MEMORY_PROMOTION_KEY, PREFERENCE_MEMORY_PROMOTION_VALUE, now, this.#options.minSignalsForPromotion, this.#options.minConfidenceBpsForPromotion, this.#options.maxContradictionBpsForPromotion);
+            for (const row of candidates) {
+                // Multiple copies of the same typed feedback path are correlated. The
+                // first release demands at least two separately attested channels.
+                if (row.distinct_signal_sources < 2)
+                    continue;
+                const prior = this.#database.prepare(`
+          SELECT * FROM preference_memory_promotions
+          WHERE scope_key = ? AND hypothesis_id = ?
+          ORDER BY promotion_generation DESC LIMIT 1
+        `).get(canonical.scopeKey, row.id);
+                if (prior !== undefined && prior.hypothesis_version === row.version
+                    && prior.owner_generation === owner.generation
+                    && prior.principal_lineage_id === owner.principalLineageId
+                    && prior.principal_lineage_version === owner.principalLineageVersion
+                    && prior.state !== 'cancelled')
+                    continue;
+                const promotionId = `pref-promotion-${createHash('sha256')
+                    .update(`preference-memory-promotion-v1\0${canonical.scopeKey}\0${row.id}`)
+                    .digest('hex')}`;
+                const generationFloor = this.#database.prepare(`
+          SELECT MAX(promotion_generation) AS generation FROM (
+            SELECT promotion_generation FROM preference_memory_promotions
+              WHERE promotion_id = ?
+            UNION ALL
+            SELECT promotion_generation FROM preference_memory_promotion_cancellations
+              WHERE promotion_id = ?
+          )
+        `).get(promotionId, promotionId);
+                const promotionGeneration = (generationFloor.generation ?? 0) + 1;
+                const idempotencyKey = `preference-memory-promotion:${promotionId}:g${promotionGeneration}`;
+                const deadlineAt = Math.min(row.expires_at, now + this.#options.promotionProposalTtlMs);
+                if (deadlineAt <= now)
+                    continue;
+                const request = validatePreferenceMemoryPromotionRequest(withPreferenceMemoryPromotionRequestDigest({
+                    contractVersion: 1,
+                    promotionId,
+                    promotionGeneration,
+                    idempotencyKey,
+                    scope: { workspace: row.workspace, preset: row.preset },
+                    principalId,
+                    principalLineage: {
+                        principalRecordId: owner.principalLineageId,
+                        principalVersion: owner.principalLineageVersion,
+                    },
+                    ownerGeneration: owner.generation,
+                    hypothesis: {
+                        id: row.id,
+                        key: PREFERENCE_MEMORY_PROMOTION_KEY,
+                        value: PREFERENCE_MEMORY_PROMOTION_VALUE,
+                        version: row.version,
+                        confidenceBps: row.confidence_bps,
+                        contradictionBps: row.contradiction_bps,
+                        supportingSignals: row.supporting_signals,
+                        distinctSignalSources: row.distinct_signal_sources,
+                        evidenceMass: row.evidence_mass,
+                    },
+                    rendererId: PREFERENCE_MEMORY_PROMOTION_RENDERER_ID,
+                    observedAt: now,
+                    deadlineAt,
+                }));
+                this.#database.prepare(`
+          INSERT INTO preference_memory_promotions(
+            promotion_id, promotion_generation, scope_key, scope_digest, workspace, preset,
+            principal_id, principal_digest, principal_lineage_id, principal_lineage_version,
+            owner_generation, hypothesis_id, hypothesis_key, hypothesis_value,
+            hypothesis_version, confidence_bps, contradiction_bps, supporting_signals,
+            distinct_signal_sources, evidence_mass, renderer_id, observed_at, deadline_at,
+            request_digest, idempotency_key, state, created_at, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+            'pending', ?, ?)
+        `).run(request.promotionId, request.promotionGeneration, canonical.scopeKey, canonical.scopeDigest, request.scope.workspace, request.scope.preset, request.principalId, principalDigest, request.principalLineage.principalRecordId, request.principalLineage.principalVersion, request.ownerGeneration, request.hypothesis.id, request.hypothesis.key, request.hypothesis.value, request.hypothesis.version, request.hypothesis.confidenceBps, request.hypothesis.contradictionBps, request.hypothesis.supportingSignals, request.hypothesis.distinctSignalSources, request.hypothesis.evidenceMass, request.rendererId, request.observedAt, request.deadlineAt, request.requestDigest, request.idempotencyKey, now, now);
+                this.#database.prepare(`
+          INSERT INTO preference_memory_promotion_outbox(
+            promotion_id, promotion_generation, state, attempt_count, next_attempt_at,
+            submitted_at, last_error, updated_at
+          ) VALUES (?, ?, 'pending', 0, ?, NULL, NULL, ?)
+        `).run(request.promotionId, request.promotionGeneration, now, now);
+                const inserted = this.#database.prepare(`
+          SELECT * FROM preference_memory_promotions
+          WHERE promotion_id = ? AND promotion_generation = ?
+        `).get(request.promotionId, request.promotionGeneration);
+                created.push(promotionFromRow(inserted));
+            }
+            this.#database.exec('COMMIT');
+            return Object.freeze(created);
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    listPendingMemoryPromotions(limit) {
+        this.#assertOpen();
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+            throw new PreferenceStoreError('invalid-input', 'promotion outbox limit must be between 1 and 1000');
+        }
+        const rows = this.#database.prepare(`
+      SELECT promotion.*, outbox.state AS outbox_state, outbox.attempt_count,
+        outbox.next_attempt_at, outbox.last_error
+      FROM preference_memory_promotion_outbox outbox
+      JOIN preference_memory_promotions promotion
+        ON promotion.promotion_id = outbox.promotion_id
+          AND promotion.promotion_generation = outbox.promotion_generation
+      WHERE outbox.state IN ('pending', 'retry_wait') AND outbox.next_attempt_at <= ?
+      ORDER BY outbox.next_attempt_at, outbox.updated_at, promotion.promotion_id
+      LIMIT ?
+    `).all(this.#now(), limit);
+        return Object.freeze(rows.map((row) => {
+            const stored = promotionFromRow(row);
+            return Object.freeze({
+                request: stored.request,
+                state: row.outbox_state === 'retry_wait' ? 'retry_wait' : 'pending',
+                ...(stored.memoryProposalId === undefined ? {} : { memoryProposalId: stored.memoryProposalId }),
+                ...(stored.submissionReceiptDigest === undefined
+                    ? {} : { submissionReceiptDigest: stored.submissionReceiptDigest }),
+                ...(stored.terminalResultVersion === undefined
+                    ? {} : { terminalResultVersion: stored.terminalResultVersion }),
+                ...(stored.terminalReceiptDigest === undefined
+                    ? {} : { terminalReceiptDigest: stored.terminalReceiptDigest }),
+                createdAt: stored.createdAt,
+                updatedAt: stored.updatedAt,
+                attemptCount: row.attempt_count,
+                nextAttemptAt: row.next_attempt_at,
+                ...(row.last_error === null ? {} : { lastError: row.last_error }),
+            });
+        }));
+    }
+    settleMemoryPromotionSubmission(input) {
+        this.#assertOpen();
+        const request = validatePreferenceMemoryPromotionRequest(input.request);
+        if ((input.receipt === undefined) === (input.retryError === undefined)) {
+            throw new PreferenceStoreError('invalid-input', 'promotion submission needs exactly one outcome');
+        }
+        const receipt = input.receipt === undefined
+            ? undefined
+            : validatePreferenceMemoryPromotionSubmissionReceipt(input.receipt, request);
+        const retryError = input.retryError === undefined
+            ? undefined
+            : boundedText(input.retryError, 'promotion retry error', 500);
+        const now = this.#now();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const current = this.#promotionRow(request.promotionId, request.promotionGeneration);
+            if (current.request_digest !== request.requestDigest) {
+                throw new PreferenceStoreError('idempotency-conflict', 'promotion request identity changed');
+            }
+            if (current.state === 'cancelled' || this.#isPromotionTerminal(current.state)) {
+                this.#database.exec('COMMIT');
+                return promotionFromRow(current);
+            }
+            const outbox = this.#database.prepare(`
+        SELECT state, attempt_count FROM preference_memory_promotion_outbox
+        WHERE promotion_id = ? AND promotion_generation = ?
+      `).get(request.promotionId, request.promotionGeneration);
+            if (outbox === undefined)
+                throw new PreferenceStoreError('conflict', 'promotion has no outbox row');
+            if (outbox.state === 'submitted') {
+                if (receipt === undefined
+                    || current.memory_proposal_id !== receipt.memoryProposalId
+                    || current.submission_receipt_digest !== receipt.receiptDigest) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'promotion submission replay changed');
+                }
+            }
+            else if (receipt !== undefined) {
+                this.#database.prepare(`
+          UPDATE preference_memory_promotions
+          SET state = 'submitted', memory_proposal_id = ?, submission_receipt_digest = ?, updated_at = ?
+          WHERE promotion_id = ? AND promotion_generation = ?
+            AND request_digest = ? AND state IN ('pending', 'retry_wait')
+        `).run(receipt.memoryProposalId, receipt.receiptDigest, now, request.promotionId, request.promotionGeneration, request.requestDigest);
+                this.#database.prepare(`
+          UPDATE preference_memory_promotion_outbox
+          SET state = 'submitted', attempt_count = attempt_count + 1, submitted_at = ?,
+            last_error = NULL, updated_at = ?
+          WHERE promotion_id = ? AND promotion_generation = ?
+            AND state IN ('pending', 'retry_wait')
+        `).run(now, now, request.promotionId, request.promotionGeneration);
+            }
+            else {
+                const attempt = outbox.attempt_count + 1;
+                const delay = Math.min(60_000, 250 * (2 ** Math.min(attempt - 1, 8)));
+                this.#database.prepare(`
+          UPDATE preference_memory_promotion_outbox
+          SET state = 'retry_wait', attempt_count = ?, next_attempt_at = ?,
+            last_error = ?, updated_at = ?
+          WHERE promotion_id = ? AND promotion_generation = ?
+            AND state IN ('pending', 'retry_wait')
+        `).run(attempt, now + delay, retryError, now, request.promotionId, request.promotionGeneration);
+            }
+            this.#database.exec('COMMIT');
+            return promotionFromRow(this.#promotionRow(request.promotionId, request.promotionGeneration));
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /**
+     * Project one branded Personal Memory terminal result. The projection and
+     * immutable result receipt commit together. A committed terminal receipt is
+     * authoritative for exact replay/conflict checks; otherwise a cancellation
+     * tombstone wins over a delayed result, preventing owner ABA or forget
+     * resurrection.
+     */
+    projectMemoryPromotionResult(input) {
+        this.#assertOpen();
+        const result = validatePreferenceMemoryPromotionResult(input);
+        const now = this.#now();
+        if (result.occurredAt > now) {
+            throw new PreferenceStoreError('invalid-input', 'promotion result occurredAt is in the future');
+        }
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const cancellation = this.#database.prepare(`
+        SELECT request_digest, reason, state FROM preference_memory_promotion_cancellations
+        WHERE promotion_id = ? AND promotion_generation = ?
+      `).get(result.promotionId, result.promotionGeneration);
+            if (cancellation !== undefined && cancellation.reason !== 'superseded') {
+                if (cancellation.request_digest !== result.requestDigest) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'cancelled promotion identity changed');
+                }
+                if (cancellation.state !== 'cancelled') {
+                    throw new PreferenceStoreError('conflict', 'promotion compensation is not complete');
+                }
+                this.#database.exec('COMMIT');
+                return Object.freeze({
+                    contractVersion: 1,
+                    promotionId: result.promotionId,
+                    promotionGeneration: result.promotionGeneration,
+                    resultVersion: result.resultVersion,
+                    receiptDigest: result.receiptDigest,
+                    outcome: 'cancelled',
+                });
+            }
+            const existing = this.#database.prepare(`
+        SELECT * FROM preference_memory_promotion_results
+        WHERE promotion_id = ? AND promotion_generation = ?
+      `).get(result.promotionId, result.promotionGeneration);
+            if (existing !== undefined) {
+                const stored = promotionResultFromRow(existing);
+                if (stored.resultVersion !== result.resultVersion
+                    || stored.requestDigest !== result.requestDigest
+                    || stored.receiptDigest !== result.receiptDigest) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'promotion terminal result changed');
+                }
+                this.#database.exec('COMMIT');
+                return Object.freeze({
+                    contractVersion: 1,
+                    promotionId: result.promotionId,
+                    promotionGeneration: result.promotionGeneration,
+                    resultVersion: result.resultVersion,
+                    receiptDigest: result.receiptDigest,
+                    outcome: 'replayed',
+                });
+            }
+            const promotion = this.#database.prepare(`
+        SELECT * FROM preference_memory_promotions
+        WHERE promotion_id = ? AND promotion_generation = ?
+      `).get(result.promotionId, result.promotionGeneration);
+            if (promotion === undefined) {
+                throw new PreferenceStoreError('not-found', 'promotion result has no request ledger entry');
+            }
+            validatePreferenceMemoryPromotionResult(result, promotionRequestFromRow(promotion));
+            if (promotion.state === 'cancelled') {
+                this.#recordPromotionCancellationInTransaction(promotion, 'superseded', now);
+                this.#database.exec('COMMIT');
+                return Object.freeze({
+                    contractVersion: 1,
+                    promotionId: result.promotionId,
+                    promotionGeneration: result.promotionGeneration,
+                    resultVersion: result.resultVersion,
+                    receiptDigest: result.receiptDigest,
+                    outcome: 'cancelled',
+                });
+            }
+            if (this.#isPromotionTerminal(promotion.state)) {
+                throw new PreferenceStoreError('conflict', 'promotion terminal state has no matching receipt');
+            }
+            if (promotion.state !== 'submitted'
+                || promotion.memory_proposal_id === null
+                || promotion.submission_receipt_digest === null) {
+                throw new PreferenceStoreError('conflict', 'promotion result arrived before request submission');
+            }
+            if (result.status !== 'stale-owner'
+                && result.memoryProposalId !== promotion.memory_proposal_id) {
+                throw new PreferenceStoreError('idempotency-conflict', 'promotion result changed Memory proposal identity');
+            }
+            const currentOwner = this.#database.prepare(`
+        SELECT 1 AS present FROM preference_scope_principals
+        WHERE scope_key = ? AND principal_digest = ?
+          AND principal_lineage_id = ? AND principal_lineage_version = ?
+          AND generation = ? AND purge_pending = 0 AND admission_cursor_epoch IS NOT NULL
+      `).get(promotion.scope_key, promotion.principal_digest, promotion.principal_lineage_id, promotion.principal_lineage_version, promotion.owner_generation);
+            if (currentOwner === undefined) {
+                this.#cancelPromotionInTransaction(promotion, 'owner-rotated', now);
+                this.#database.exec('COMMIT');
+                return Object.freeze({
+                    contractVersion: 1,
+                    promotionId: result.promotionId,
+                    promotionGeneration: result.promotionGeneration,
+                    resultVersion: result.resultVersion,
+                    receiptDigest: result.receiptDigest,
+                    outcome: 'cancelled',
+                });
+            }
+            if (result.status === 'confirmed' || result.status === 'rejected') {
+                const hypothesis = this.#database.prepare(`
+          SELECT * FROM preference_hypotheses
+          WHERE id = ? AND scope_key = ?
+        `).get(promotion.hypothesis_id, promotion.scope_key);
+                if (hypothesis === undefined || hypothesis.version !== promotion.hypothesis_version
+                    || hypothesis.preference_key !== promotion.hypothesis_key
+                    || hypothesis.candidate_value !== promotion.hypothesis_value
+                    || hypothesis.risk_tier !== 'T2' || hypothesis.effect_state !== 'inactive'
+                    || hypothesis.claim_state !== 'proposed') {
+                    throw new PreferenceStoreError('conflict', 'promotion result no longer matches the exact proposed hypothesis');
+                }
+                const nextVersion = hypothesis.version + 1;
+                const claimState = result.status;
+                const changedHypothesis = this.#database.prepare(`
+          UPDATE preference_hypotheses
+          SET claim_state = ?, version = ?, updated_at = ?
+          WHERE id = ? AND scope_key = ? AND version = ?
+            AND claim_state = 'proposed' AND effect_state = 'inactive'
+        `).run(claimState, nextVersion, now, hypothesis.id, hypothesis.scope_key, hypothesis.version);
+                if (changedHypothesis.changes !== 1) {
+                    throw new PreferenceStoreError('conflict', 'promotion hypothesis projection lost its CAS');
+                }
+                this.#transition(hypothesis, claimState, 'inactive', result.status === 'rejected' ? 'owner-rejected' : 'evidence-updated', nextVersion, now);
+            }
+            const confirmed = result.status === 'confirmed' ? result : undefined;
+            const rejected = result.status === 'rejected' ? result : undefined;
+            const failed = result.status === 'expired' || result.status === 'conflicted' ? result : undefined;
+            this.#database.prepare(`
+        INSERT INTO preference_memory_promotion_results(
+          promotion_id, promotion_generation, result_version, request_digest, receipt_digest,
+          status, rejection_kind, memory_proposal_id, memory_proposal_version,
+          memory_record_id, memory_record_version, memory_record_digest, occurred_at, projected_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(result.promotionId, result.promotionGeneration, result.resultVersion, result.requestDigest, result.receiptDigest, result.status, rejected?.rejectionKind ?? null, confirmed?.memoryProposalId ?? rejected?.memoryProposalId
+                ?? failed?.memoryProposalId ?? null, confirmed?.memoryProposalVersion ?? rejected?.memoryProposalVersion
+                ?? failed?.memoryProposalVersion ?? null, confirmed?.memoryRecordId ?? null, confirmed?.memoryRecordVersion ?? null, confirmed?.memoryRecordDigest ?? null, result.occurredAt, now);
+            const changed = this.#database.prepare(`
+        UPDATE preference_memory_promotions
+        SET state = ?, terminal_result_version = ?, terminal_receipt_digest = ?, updated_at = ?
+        WHERE promotion_id = ? AND promotion_generation = ? AND state = 'submitted'
+          AND request_digest = ?
+      `).run(result.status, result.resultVersion, result.receiptDigest, now, result.promotionId, result.promotionGeneration, result.requestDigest);
+            if (changed.changes !== 1) {
+                throw new PreferenceStoreError('conflict', 'promotion state changed during result projection');
+            }
+            this.#database.exec('COMMIT');
+            return Object.freeze({
+                contractVersion: 1,
+                promotionId: result.promotionId,
+                promotionGeneration: result.promotionGeneration,
+                resultVersion: result.resultVersion,
+                receiptDigest: result.receiptDigest,
+                outcome: 'applied',
+            });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    getMemoryPromotion(promotionIdInput, promotionGeneration) {
+        this.#assertOpen();
+        const promotionId = boundedText(promotionIdInput, 'promotionId', 500);
+        if (!Number.isSafeInteger(promotionGeneration) || promotionGeneration < 1) {
+            throw new PreferenceStoreError('invalid-input', 'promotionGeneration is invalid');
+        }
+        const row = this.#database.prepare(`
+      SELECT * FROM preference_memory_promotions
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(promotionId, promotionGeneration);
+        return row === undefined ? undefined : promotionFromRow(row);
+    }
+    listPendingMemoryPromotionCancellations(limit) {
+        this.#assertOpen();
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+            throw new PreferenceStoreError('invalid-input', 'promotion cancellation limit must be between 1 and 1000');
+        }
+        const rows = this.#database.prepare(`
+      SELECT * FROM preference_memory_promotion_cancellations
+      WHERE state IN ('pending', 'retry_wait') AND next_attempt_at <= ?
+      ORDER BY next_attempt_at, updated_at, promotion_id LIMIT ?
+    `).all(this.#now(), limit);
+        return Object.freeze(rows.map(row => {
+            const request = validatePreferenceMemoryPromotionCancellationRequest({
+                contractVersion: 1,
+                promotionId: row.promotion_id,
+                promotionGeneration: row.promotion_generation,
+                requestDigest: row.request_digest,
+                principalLineage: {
+                    principalRecordId: row.principal_lineage_id,
+                    principalVersion: row.principal_lineage_version,
+                },
+                ownerGeneration: row.owner_generation,
+                reason: row.reason,
+                occurredAt: row.cancelled_at,
+                cancellationDigest: row.cancellation_digest,
+            });
+            if (row.upgrade_binding_digest !== this.#cancellationUpgradeBindingDigest(request)) {
+                throw new PreferenceStoreError('idempotency-conflict', 'promotion cancellation binding changed');
+            }
+            return request;
+        }));
+    }
+    settleMemoryPromotionCancellation(input) {
+        this.#assertOpen();
+        const request = validatePreferenceMemoryPromotionCancellationRequest(input.request);
+        if ((input.receipt === undefined) === (input.retryError === undefined)) {
+            throw new PreferenceStoreError('invalid-input', 'promotion cancellation needs exactly one outcome');
+        }
+        const receipt = input.receipt === undefined
+            ? undefined
+            : validatePreferenceMemoryPromotionCancellationReceipt(input.receipt, request);
+        const retryError = input.retryError === undefined
+            ? undefined
+            : boundedText(input.retryError, 'promotion cancellation retry error', 500);
+        if (receipt?.outcome === 'already-confirmed' && request.reason !== 'superseded') {
+            throw new PreferenceStoreError('conflict', 'privacy cancellation requires Memory compensation');
+        }
+        const now = this.#now();
+        const current = this.#database.prepare(`
+      SELECT * FROM preference_memory_promotion_cancellations
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(request.promotionId, request.promotionGeneration);
+        if (current === undefined || current.request_digest !== request.requestDigest
+            || current.cancellation_digest !== request.cancellationDigest) {
+            throw new PreferenceStoreError('idempotency-conflict', 'promotion cancellation identity changed');
+        }
+        const upgradeBindingDigest = this.#cancellationUpgradeBindingDigest(request);
+        if (current.upgrade_binding_digest !== upgradeBindingDigest) {
+            throw new PreferenceStoreError('idempotency-conflict', 'promotion cancellation binding changed');
+        }
+        if (current.state === 'cancelled' || current.state === 'already-confirmed') {
+            if (receipt !== undefined && current.receipt_digest !== receipt.receiptDigest) {
+                throw new PreferenceStoreError('idempotency-conflict', 'promotion cancellation receipt changed');
+            }
+            return;
+        }
+        if (receipt !== undefined) {
+            const changed = this.#database.prepare(`
+        UPDATE preference_memory_promotion_cancellations
+        SET state = ?, attempt_count = attempt_count + 1, receipt_digest = ?,
+          principal_lineage_id = ?, principal_lineage_version = 1, owner_generation = 1,
+          last_error = NULL, updated_at = ?
+        WHERE promotion_id = ? AND promotion_generation = ?
+          AND state IN ('pending', 'retry_wait') AND upgrade_binding_digest = ?
+      `).run(receipt.outcome === 'already-confirmed' ? 'already-confirmed' : 'cancelled', receipt.receiptDigest, `redacted-${createHash('sha256').update(request.principalLineage.principalRecordId).digest('hex')}`, now, request.promotionId, request.promotionGeneration, upgradeBindingDigest);
+            if (changed.changes !== 1) {
+                throw new PreferenceStoreError('conflict', 'promotion cancellation changed during settlement');
+            }
+            return;
+        }
+        const attempt = current.attempt_count + 1;
+        const delay = Math.min(60_000, 250 * (2 ** Math.min(attempt - 1, 8)));
+        this.#database.prepare(`
+      UPDATE preference_memory_promotion_cancellations
+      SET state = 'retry_wait', attempt_count = ?, next_attempt_at = ?,
+        last_error = ?, updated_at = ?
+      WHERE promotion_id = ? AND promotion_generation = ?
+          AND state IN ('pending', 'retry_wait') AND upgrade_binding_digest = ?
+    `).run(attempt, now + delay, retryError, now, request.promotionId, request.promotionGeneration, upgradeBindingDigest);
+    }
+    /**
+     * Monotonic content-free owner fence for a Delivery scope. A delayed event
+     * from an older principal is acknowledged as ignored instead of reclaiming
+     * the scope after a newer owner has started using it.
+     */
+    ensureScopePrincipal(scopeInput, principalIdInput, occurredAtInput, lineageInput, admissionCursorInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const principalDigest = preferencePrincipalDigest(principalIdInput);
+        const occurredAt = safeTimestamp(occurredAtInput, 'occurredAt');
+        const lineage = canonicalPreferencePrincipalLineage(lineageInput);
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        const now = this.#now();
+        let result;
+        let purgeGeneration;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const current = this.#database.prepare(`
+        SELECT principal_digest, principal_lineage_id, principal_lineage_version,
+          generation, claimed_at, purge_pending, admission_cursor_epoch,
+          lineage_claim_sequence, admission_high_water, learning_paused, paused_at
+        FROM preference_scope_principals WHERE scope_key = ?
+      `).get(canonical.scopeKey);
+            if (current !== undefined && current.principal_digest === principalDigest
+                && current.principal_lineage_id === lineage.principalRecordId
+                && current.principal_lineage_version === lineage.principalVersion
+                && current.admission_cursor_epoch === admissionCursor.epoch) {
+                purgeGeneration = current.purge_pending === 1 ? current.generation : undefined;
+                result = Object.freeze({
+                    accepted: true,
+                    scopeKey: canonical.scopeKey,
+                    principalDigest,
+                    principalLineageId: lineage.principalRecordId,
+                    principalLineageVersion: lineage.principalVersion,
+                    generation: current.generation,
+                    reset: false,
+                });
+            }
+            else if (current !== undefined && current.admission_cursor_epoch === null) {
+                // Schema v5 had no owner-row lineage and schema v6 had no durable Inbox
+                // order. Neither can prove that its evidence predates a pause/forget or
+                // belongs to this exact Delivery instance. The first v7 claim is always
+                // a privacy reset, even when the external principal and lineage happen
+                // to match.
+                const preservePaused = current.principal_digest === principalDigest
+                    && current.principal_lineage_id === lineage.principalRecordId
+                    && current.principal_lineage_version === lineage.principalVersion
+                    && current.learning_paused === 1;
+                this.#deleteScopeDataInTransaction(canonical.scopeKey, canonical.scopeDigest);
+                const generation = current.generation + 1;
+                const changed = this.#database.prepare(`
+          UPDATE preference_scope_principals
+          SET scope_digest = ?, principal_digest = ?, generation = ?, claimed_at = ?, updated_at = ?,
+            principal_lineage_id = ?, principal_lineage_version = ?,
+            purge_pending = 1,
+            learning_paused = ?, paused_at = ?,
+            control_version = control_version + 1, ignore_events_through = -1,
+            admission_cursor_epoch = ?, lineage_claim_sequence = ?,
+            admission_high_water = NULL, admission_high_water_kind = NULL,
+            ignore_events_through_sequence = NULL
+          WHERE scope_key = ? AND generation = ? AND admission_cursor_epoch IS NULL
+        `).run(canonical.scopeDigest, principalDigest, generation, occurredAt, now, lineage.principalRecordId, lineage.principalVersion, preservePaused ? 1 : 0, preservePaused ? current.paused_at : null, admissionCursor.epoch, admissionCursor.sequence, canonical.scopeKey, current.generation);
+                if (changed.changes !== 1) {
+                    throw new PreferenceStoreError('conflict', 'legacy scope principal adoption lost its generation');
+                }
+                purgeGeneration = generation;
+                result = Object.freeze({
+                    accepted: true,
+                    scopeKey: canonical.scopeKey,
+                    principalDigest,
+                    principalLineageId: lineage.principalRecordId,
+                    principalLineageVersion: lineage.principalVersion,
+                    generation,
+                    reset: true,
+                });
+            }
+            else if (current !== undefined
+                && current.principal_digest === principalDigest
+                && current.principal_lineage_id === lineage.principalRecordId
+                && current.principal_lineage_version === lineage.principalVersion) {
+                // An epoch change for one exact lineage is impossible in the Delivery
+                // contract. Never sort opaque epochs or silently rebind it.
+                result = Object.freeze({
+                    accepted: false,
+                    scopeKey: canonical.scopeKey,
+                    principalDigest: current.principal_digest,
+                    principalLineageId: current.principal_lineage_id ?? 'legacy-owner-lineage',
+                    principalLineageVersion: current.principal_lineage_version ?? 1,
+                    generation: current.generation,
+                    reset: false,
+                });
+            }
+            else if (current !== undefined
+                && current.admission_cursor_epoch === admissionCursor.epoch
+                && admissionCursor.sequence <= Math.max(current.lineage_claim_sequence ?? 0, current.admission_high_water ?? 0)) {
+                result = Object.freeze({
+                    accepted: false,
+                    scopeKey: canonical.scopeKey,
+                    principalDigest: current.principal_digest,
+                    principalLineageId: current.principal_lineage_id ?? 'legacy-owner-lineage',
+                    principalLineageVersion: current.principal_lineage_version ?? 1,
+                    generation: current.generation,
+                    reset: false,
+                });
+            }
+            else {
+                this.#deleteScopeDataInTransaction(canonical.scopeKey, canonical.scopeDigest);
+                const generation = (current?.generation ?? 0) + 1;
+                if (current === undefined) {
+                    this.#database.prepare(`
+            INSERT INTO preference_scope_principals(
+              scope_key, scope_digest, principal_digest, generation,
+              claimed_at, purge_pending, updated_at,
+              principal_lineage_id, principal_lineage_version,
+              learning_paused, paused_at, control_version, ignore_events_through,
+              admission_cursor_epoch, lineage_claim_sequence,
+              admission_high_water, admission_high_water_kind,
+              ignore_events_through_sequence
+            ) VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?, 0, NULL, 1, -1, ?, ?, NULL, NULL, NULL)
+          `).run(canonical.scopeKey, canonical.scopeDigest, principalDigest, generation, occurredAt, now, lineage.principalRecordId, lineage.principalVersion, admissionCursor.epoch, admissionCursor.sequence);
+                }
+                else {
+                    this.#database.prepare(`
+            UPDATE preference_scope_principals
+            SET scope_digest = ?, principal_digest = ?, generation = ?,
+              claimed_at = ?, purge_pending = 1, updated_at = ?,
+              principal_lineage_id = ?, principal_lineage_version = ?,
+              learning_paused = 0, paused_at = NULL,
+              control_version = control_version + 1, ignore_events_through = -1,
+              admission_cursor_epoch = ?, lineage_claim_sequence = ?,
+              admission_high_water = NULL, admission_high_water_kind = NULL,
+              ignore_events_through_sequence = NULL
+            WHERE scope_key = ? AND generation = ? AND principal_digest = ?
+          `).run(canonical.scopeDigest, principalDigest, generation, occurredAt, now, lineage.principalRecordId, lineage.principalVersion, admissionCursor.epoch, admissionCursor.sequence, canonical.scopeKey, current.generation, current.principal_digest);
+                }
+                purgeGeneration = generation;
+                result = Object.freeze({
+                    accepted: true,
+                    scopeKey: canonical.scopeKey,
+                    principalDigest,
+                    principalLineageId: lineage.principalRecordId,
+                    principalLineageVersion: lineage.principalVersion,
+                    generation,
+                    reset: current !== undefined,
+                });
+            }
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+        if (purgeGeneration !== undefined) {
+            this.#truncateWalForPrivacy();
+            this.#database.exec('BEGIN IMMEDIATE');
+            try {
+                const cleared = this.#database.prepare(`
+          UPDATE preference_scope_principals
+          SET purge_pending = 0, updated_at = ?
+          WHERE scope_key = ? AND principal_digest = ? AND generation = ? AND purge_pending = 1
+        `).run(now, canonical.scopeKey, principalDigest, purgeGeneration);
+                if (cleared.changes !== 1) {
+                    throw new PreferenceStoreError('conflict', 'scope principal purge lost its exact generation');
+                }
+                this.#database.exec('COMMIT');
+            }
+            catch (error) {
+                this.#database.exec('ROLLBACK');
+                throw error;
+            }
+        }
+        return result;
+    }
+    scopePrincipalMatches(scopeInput, principalIdInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const principalDigest = preferencePrincipalDigest(principalIdInput);
+        return this.#database.prepare(`
+      SELECT 1 AS present FROM preference_scope_principals
+      WHERE scope_key = ? AND principal_digest = ? AND purge_pending = 0
+        AND admission_cursor_epoch IS NOT NULL
+    `).get(canonical.scopeKey, principalDigest) !== undefined;
+    }
+    scopePrincipalFence(scopeInput, principalIdInput, lineageInput, expectedGeneration) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const principalDigest = preferencePrincipalDigest(principalIdInput);
+        const lineage = canonicalPreferencePrincipalLineage(lineageInput);
+        if (expectedGeneration !== undefined
+            && (!Number.isSafeInteger(expectedGeneration) || expectedGeneration < 1)) {
+            throw new PreferenceStoreError('invalid-input', 'expected owner generation is invalid');
+        }
+        const row = this.#database.prepare(`
+      SELECT generation FROM preference_scope_principals
+      WHERE scope_key = ? AND principal_digest = ?
+        AND principal_lineage_id = ? AND principal_lineage_version = ?
+        AND purge_pending = 0 AND admission_cursor_epoch IS NOT NULL
+    `).get(canonical.scopeKey, principalDigest, lineage.principalRecordId, lineage.principalVersion);
+        if (row === undefined || (expectedGeneration !== undefined && row.generation !== expectedGeneration)) {
+            return undefined;
+        }
+        return Object.freeze({
+            scopeKey: canonical.scopeKey,
+            principalDigest,
+            principalLineageId: lineage.principalRecordId,
+            principalLineageVersion: lineage.principalVersion,
+            generation: row.generation,
+        });
+    }
+    scopeLearningStatus(scopeInput, owner) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const status = this.#scopeLearningStatusInTransaction(canonical, owner);
+            this.#database.exec('COMMIT');
+            return status;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    scopeAcceptsEvent(scopeInput, owner, admissionCursorInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const accepted = this.#admitEventCursorInTransaction(canonical, owner, admissionCursor);
+            this.#database.exec('COMMIT');
+            return accepted;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    setScopeLearningPaused(scopeInput, owner, paused, admissionCursorInput, occurredAtInput, idempotencyKeyInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const occurredAt = safeTimestamp(occurredAtInput, 'occurredAt');
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        const rawIdempotencyKey = boundedText(idempotencyKeyInput, 'idempotencyKey', 500);
+        const idempotencyKey = `pref-owner-control-${createHash('sha256')
+            .update(`preference-owner-control-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
+        const action = paused ? 'pause' : 'resume';
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            principalDigest: owner.principalDigest,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+            generation: owner.generation,
+            action,
+            admissionCursor,
+        });
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const replay = this.#database.prepare(`
+        SELECT * FROM preference_owner_control_receipts
+        WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (replay !== undefined) {
+                if (replay.payload_hash !== hash) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'learning control idempotency key was reused');
+                }
+                const state = this.#ownerControlStateFromReceipt(replay);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: replay.result_applied === 1, replayed: true, state });
+            }
+            const current = this.#database.prepare(`
+        SELECT admission_cursor_epoch, lineage_claim_sequence,
+          admission_high_water, admission_high_water_kind,
+          ignore_events_through_sequence, learning_paused, control_version
+        FROM preference_scope_principals WHERE scope_key = ?
+      `).get(canonical.scopeKey);
+            const fresh = this.#controlCursorIsFresh(current, admissionCursor);
+            const controlVersion = fresh ? current.control_version + 1 : current.control_version;
+            const ignoreEventsThroughSequence = fresh
+                ? Math.max(current.ignore_events_through_sequence ?? 0, admissionCursor.sequence)
+                : current.ignore_events_through_sequence;
+            if (fresh) {
+                const changed = this.#database.prepare(`
+          UPDATE preference_scope_principals
+          SET learning_paused = ?, paused_at = ?, control_version = ?,
+            ignore_events_through = MAX(ignore_events_through, ?),
+            ignore_events_through_sequence = ?, admission_high_water = ?,
+            admission_high_water_kind = 'control', updated_at = ?
+          WHERE scope_key = ? AND principal_digest = ?
+            AND principal_lineage_id = ? AND principal_lineage_version = ?
+            AND generation = ? AND purge_pending = 0
+            AND admission_cursor_epoch = ? AND admission_high_water IS ?
+        `).run(paused ? 1 : 0, paused ? occurredAt : null, controlVersion, occurredAt, ignoreEventsThroughSequence, admissionCursor.sequence, this.#now(), canonical.scopeKey, owner.principalDigest, owner.principalLineageId, owner.principalLineageVersion, owner.generation, admissionCursor.epoch, current.admission_high_water);
+                if (changed.changes !== 1) {
+                    throw new PreferenceStoreError('conflict', 'learning control owner cursor changed');
+                }
+            }
+            const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+            this.#insertOwnerControlReceipt({
+                idempotencyKey,
+                hash,
+                canonical,
+                owner,
+                action,
+                admissionCursor,
+                applied: fresh,
+                state,
+                occurredAt,
+            });
+            this.#database.exec('COMMIT');
+            return Object.freeze({ applied: fresh, replayed: false, state });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    recordScopeLearningStatus(scopeInput, owner, admissionCursorInput, occurredAtInput, idempotencyKeyInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        const occurredAt = safeTimestamp(occurredAtInput, 'occurredAt');
+        const rawIdempotencyKey = boundedText(idempotencyKeyInput, 'idempotencyKey', 500);
+        const idempotencyKey = `pref-owner-control-${createHash('sha256')
+            .update(`preference-owner-control-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            principalDigest: owner.principalDigest,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+            generation: owner.generation,
+            action: 'status',
+            admissionCursor,
+        });
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const replay = this.#database.prepare(`
+        SELECT * FROM preference_owner_control_receipts WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (replay !== undefined) {
+                if (replay.payload_hash !== hash) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'learning control idempotency key was reused');
+                }
+                const state = this.#ownerControlStateFromReceipt(replay);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: replay.result_applied === 1, replayed: true, state });
+            }
+            const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+            if (!this.#readCursorCanObserveCurrent(current, admissionCursor)) {
+                const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: false, replayed: false, state });
+            }
+            // Status is an authenticated read, not an ordering barrier. Advancing
+            // the admission high-water here could discard an older Agent turn that
+            // was already running but had not yet committed its projection.
+            const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+            this.#insertOwnerControlReceipt({
+                idempotencyKey,
+                hash,
+                canonical,
+                owner,
+                action: 'status',
+                admissionCursor,
+                applied: true,
+                state,
+                occurredAt,
+            });
+            this.#database.exec('COMMIT');
+            return Object.freeze({ applied: true, replayed: false, state });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /** Receipt-backed, content-free T1 ledger view for one exact owner lineage. */
+    explainScopeLearning(scopeInput, owner, admissionCursorInput, occurredAtInput, idempotencyKeyInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        const occurredAt = safeTimestamp(occurredAtInput, 'occurredAt');
+        const rawIdempotencyKey = boundedText(idempotencyKeyInput, 'idempotencyKey', 500);
+        const idempotencyKey = `pref-owner-control-${createHash('sha256')
+            .update(`preference-owner-control-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            principalDigest: owner.principalDigest,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+            generation: owner.generation,
+            action: 'explain',
+            admissionCursor,
+        });
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const replay = this.#database.prepare(`
+        SELECT * FROM preference_owner_control_receipts WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (replay !== undefined) {
+                if (replay.payload_hash !== hash || replay.action !== 'explain') {
+                    throw new PreferenceStoreError('idempotency-conflict', 'learning explain idempotency key was reused');
+                }
+                const explanation = this.#ownerControlExplanationFromReceipt(replay);
+                const state = this.#ownerControlStateFromReceipt(replay);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: replay.result_applied === 1, replayed: true, state, explanation });
+            }
+            const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+            if (!this.#readCursorCanObserveCurrent(current, admissionCursor)) {
+                const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: false, replayed: false, state, explanation: Object.freeze([]) });
+            }
+            // Deliberately do not refresh/reconcile hypotheses here. Explain is a
+            // ledger read and must not advance cursors or mutate preference state.
+            const rows = this.#database.prepare(`
+        SELECT * FROM preference_hypotheses
+        WHERE scope_key = ? AND risk_tier = 'T1'
+        ORDER BY preference_key ASC, candidate_value ASC, id ASC
+      `).all(canonical.scopeKey);
+            const explanation = Object.freeze(rows.map(explanationFromRow));
+            const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+            this.#insertOwnerControlReceipt({
+                idempotencyKey,
+                hash,
+                canonical,
+                owner,
+                action: 'explain',
+                admissionCursor,
+                applied: true,
+                state,
+                explanation,
+                occurredAt,
+            });
+            this.#database.exec('COMMIT');
+            return Object.freeze({ applied: true, replayed: false, state, explanation });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /** Receipt-backed, stable export snapshot for the exact current owner scope. */
+    exportScopeLearning(scopeInput, owner, admissionCursorInput, occurredAtInput, idempotencyKeyInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        const occurredAt = safeTimestamp(occurredAtInput, 'occurredAt');
+        const rawIdempotencyKey = boundedText(idempotencyKeyInput, 'idempotencyKey', 500);
+        const idempotencyKey = `pref-owner-control-${createHash('sha256')
+            .update(`preference-owner-control-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            principalDigest: owner.principalDigest,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+            generation: owner.generation,
+            action: 'export',
+            format: 'dsh-preference-learning',
+            version: 1,
+            admissionCursor,
+        });
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const replay = this.#database.prepare(`
+        SELECT * FROM preference_owner_control_receipts WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (replay !== undefined) {
+                if (replay.payload_hash !== hash || replay.action !== 'export') {
+                    throw new PreferenceStoreError('idempotency-conflict', 'learning export idempotency key was reused');
+                }
+                const records = this.#ownerControlExplanationFromReceipt(replay);
+                const state = this.#ownerControlStateFromReceipt(replay);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: replay.result_applied === 1, replayed: true, state, records });
+            }
+            const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+            if (!this.#readCursorCanObserveCurrent(current, admissionCursor)) {
+                const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+                this.#database.exec('COMMIT');
+                return Object.freeze({ applied: false, replayed: false, state, records: Object.freeze([]) });
+            }
+            // Like explain, export is a ledger read. It neither reconciles state nor
+            // advances the admission high-water for already-running earlier turns.
+            const rows = this.#database.prepare(`
+        SELECT * FROM preference_hypotheses
+        WHERE scope_key = ? AND risk_tier = 'T1'
+        ORDER BY preference_key ASC, candidate_value ASC, id ASC
+      `).all(canonical.scopeKey);
+            const records = Object.freeze(rows.map(explanationFromRow));
+            const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+            this.#insertOwnerControlReceipt({
+                idempotencyKey,
+                hash,
+                canonical,
+                owner,
+                action: 'export',
+                admissionCursor,
+                applied: true,
+                state,
+                explanation: records,
+                occurredAt,
+            });
+            this.#database.exec('COMMIT');
+            return Object.freeze({ applied: true, replayed: false, state, records });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /** Atomically fence older projections and CAS-roll back the active value for one T1 key. */
+    rollbackScopeLearningKey(scopeInput, owner, preferenceKeyInput, admissionCursorInput, occurredAtInput, idempotencyKeyInput) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const preferenceKey = exactT1PreferenceKey(preferenceKeyInput);
+        const admissionCursor = canonicalPreferenceAdmissionCursor(admissionCursorInput);
+        const occurredAt = safeTimestamp(occurredAtInput, 'occurredAt');
+        const rawIdempotencyKey = boundedText(idempotencyKeyInput, 'idempotencyKey', 500);
+        const idempotencyKey = `pref-owner-control-${createHash('sha256')
+            .update(`preference-owner-control-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            principalDigest: owner.principalDigest,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+            generation: owner.generation,
+            action: 'rollback',
+            preferenceKey,
+            admissionCursor,
+        });
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const replay = this.#database.prepare(`
+        SELECT * FROM preference_owner_control_receipts WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (replay !== undefined) {
+                if (replay.payload_hash !== hash || replay.action !== 'rollback'
+                    || replay.target_preference_key !== preferenceKey) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'learning rollback idempotency key was reused');
+                }
+                const state = this.#ownerControlStateFromReceipt(replay);
+                this.#database.exec('COMMIT');
+                return Object.freeze({
+                    applied: replay.result_applied === 1,
+                    replayed: true,
+                    state,
+                    rolledBack: replay.result_rolled_back === 1,
+                    ...(replay.result_rolled_back_version === null
+                        ? {}
+                        : { rolledBackVersion: replay.result_rolled_back_version }),
+                });
+            }
+            const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+            const fresh = this.#controlCursorIsFresh(current, admissionCursor);
+            let rolledBack = false;
+            let rolledBackVersion;
+            if (fresh) {
+                const active = this.#database.prepare(`
+          SELECT * FROM preference_hypotheses
+          WHERE scope_key = ? AND preference_key = ?
+            AND risk_tier = 'T1' AND effect_state = 'active'
+        `).get(canonical.scopeKey, preferenceKey);
+                if (active !== undefined) {
+                    rolledBackVersion = active.version + 1;
+                    const changed = this.#database.prepare(`
+            UPDATE preference_hypotheses SET
+              claim_state = 'rejected', effect_state = 'rolled-back',
+              rolled_back_at = ?, updated_at = ?, version = ?
+            WHERE id = ? AND scope_key = ? AND preference_key = ?
+              AND version = ? AND effect_state = 'active'
+          `).run(occurredAt, occurredAt, rolledBackVersion, active.id, canonical.scopeKey, preferenceKey, active.version);
+                    if (changed.changes !== 1) {
+                        throw new PreferenceStoreError('conflict', 'learning rollback hypothesis CAS lost');
+                    }
+                    this.#transition(active, 'rejected', 'rolled-back', 'owner-rejected', rolledBackVersion, occurredAt);
+                    rolledBack = true;
+                }
+                const controlVersion = current.control_version + 1;
+                const ignoreEventsThroughSequence = Math.max(current.ignore_events_through_sequence ?? 0, admissionCursor.sequence);
+                const changed = this.#database.prepare(`
+          UPDATE preference_scope_principals
+          SET control_version = ?, ignore_events_through = MAX(ignore_events_through, ?),
+            ignore_events_through_sequence = ?, admission_high_water = ?,
+            admission_high_water_kind = 'control', updated_at = ?
+          WHERE scope_key = ? AND principal_digest = ?
+            AND principal_lineage_id = ? AND principal_lineage_version = ?
+            AND generation = ? AND purge_pending = 0
+            AND admission_cursor_epoch = ? AND admission_high_water IS ?
+        `).run(controlVersion, occurredAt, ignoreEventsThroughSequence, admissionCursor.sequence, this.#now(), canonical.scopeKey, owner.principalDigest, owner.principalLineageId, owner.principalLineageVersion, owner.generation, admissionCursor.epoch, current.admission_high_water);
+                if (changed.changes !== 1) {
+                    throw new PreferenceStoreError('conflict', 'learning rollback owner cursor changed');
+                }
+            }
+            const state = this.#scopeLearningStatusInTransaction(canonical, owner, false);
+            this.#insertOwnerControlReceipt({
+                idempotencyKey,
+                hash,
+                canonical,
+                owner,
+                action: 'rollback',
+                preferenceKey,
+                admissionCursor,
+                applied: fresh,
+                state,
+                rolledBack,
+                ...(rolledBackVersion === undefined ? {} : { rolledBackVersion }),
+                occurredAt,
+            });
+            this.#database.exec('COMMIT');
+            return Object.freeze({
+                applied: fresh,
+                replayed: false,
+                state,
+                rolledBack,
+                ...(rolledBackVersion === undefined ? {} : { rolledBackVersion }),
+            });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
     /** Atomically record one small producer batch and reconcile each affected key once. */
-    appendSignals(inputs) {
+    appendSignals(inputs, options = {}) {
         this.#assertOpen();
         if (!Array.isArray(inputs) || inputs.length < 1 || inputs.length > 16) {
             throw new PreferenceStoreError('invalid-input', 'preference signal batch must contain 1-16 entries');
@@ -163,21 +1456,55 @@ export class PreferenceStore {
         if (uniqueIdempotency.size !== normalizedBatch.length) {
             throw new PreferenceStoreError('invalid-input', 'preference signal batch contains duplicate idempotency keys');
         }
+        const exactCorrections = options.exactCorrections ?? [];
+        const exactByIndex = new Map();
+        for (const correction of exactCorrections) {
+            if (!Number.isSafeInteger(correction.signalIndex) || correction.signalIndex < 0
+                || correction.signalIndex >= normalizedBatch.length || exactByIndex.has(correction.signalIndex)) {
+                throw new PreferenceStoreError('invalid-input', 'exact correction signal index is invalid');
+            }
+            exactByIndex.set(correction.signalIndex, Object.freeze({
+                signalIndex: correction.signalIndex,
+                sourceInboxId: boundedText(correction.sourceInboxId, 'sourceInboxId', 500),
+                replyOutboxId: boundedText(correction.replyOutboxId, 'replyOutboxId', 500),
+            }));
+        }
         this.#database.exec('BEGIN IMMEDIATE');
         try {
+            let ownerAdmissionAccepted = true;
+            if (options.ownerFence !== undefined) {
+                const canonical = canonicalPreferenceScope(normalizedBatch[0].scope);
+                if (normalizedBatch.some(signal => signal.scopeKey !== canonical.scopeKey)) {
+                    throw new PreferenceStoreError('conflict', 'owner-fenced signal batch spans multiple scopes');
+                }
+                if (options.admissionCursor === undefined) {
+                    throw new PreferenceStoreError('invalid-input', 'owner-fenced signal batches require a Delivery admission cursor');
+                }
+                ownerAdmissionAccepted = this.#admitEventCursorInTransaction(canonical, options.ownerFence, canonicalPreferenceAdmissionCursor(options.admissionCursor));
+            }
             const storedSignals = [];
+            const storedSignalsByIndex = [];
+            const storedSignalRows = [];
             const affected = new Map();
-            for (const normalized of normalizedBatch) {
+            for (let index = 0; index < normalizedBatch.length; index += 1) {
+                const normalized = normalizedBatch[index];
                 const hash = payloadHash(normalized);
                 const replay = this.#database.prepare('SELECT * FROM preference_signals WHERE idempotency_key = ?').get(normalized.idempotencyDigest);
                 if (replay !== undefined) {
                     if (replay.payload_hash !== hash) {
                         throw new PreferenceStoreError('idempotency-conflict', 'preference signal idempotency key was reused with different content');
                     }
-                    storedSignals.push(signalFromRow(replay));
+                    const replayed = signalFromRow(replay);
+                    storedSignals.push(replayed);
+                    storedSignalsByIndex[index] = replayed;
+                    storedSignalRows[index] = replay;
                     continue;
                 }
-                const forgottenThrough = this.#forgottenThrough(normalized.scopeDigest);
+                if (!ownerAdmissionAccepted)
+                    continue;
+                const forgottenThrough = options.ownerFence === undefined
+                    ? this.#forgottenThrough(normalized.scopeDigest)
+                    : undefined;
                 if (forgottenThrough !== undefined && normalized.occurredAt <= forgottenThrough) {
                     throw new PreferenceStoreError('scope-forgotten', 'signal predates the durable scope forget boundary');
                 }
@@ -192,17 +1519,33 @@ export class PreferenceStore {
                 const stored = this.#database.prepare('SELECT * FROM preference_signals WHERE id = ?')
                     .get(id);
                 storedSignals.push(signalFromRow(stored));
+                storedSignalsByIndex[index] = signalFromRow(stored);
+                storedSignalRows[index] = stored;
                 if (normalized.riskTier === 'T1' || normalized.riskTier === 'T2') {
                     affected.set(`${normalized.scopeKey}\0${normalized.preferenceKey}`, {
                         scopeKey: normalized.scopeKey,
                         scope: normalized.scope,
                         preferenceKey: normalized.preferenceKey,
                         trigger: stored,
+                        allowGlobalOwnerCorrection: !exactByIndex.has(index),
                     });
                 }
             }
             for (const entry of affected.values()) {
-                this.#reconcileKey(entry.scopeKey, entry.scope, entry.preferenceKey, now, entry.trigger);
+                this.#reconcileKey(entry.scopeKey, entry.scope, entry.preferenceKey, now, entry.trigger, entry.allowGlobalOwnerCorrection);
+            }
+            for (const [index, correction] of exactByIndex) {
+                const signal = storedSignalRows[index];
+                const stored = storedSignalsByIndex[index];
+                if (signal === undefined || stored === undefined)
+                    continue;
+                this.#applyExposureCorrectionInTransaction({
+                    signal,
+                    sourceInboxId: correction.sourceInboxId,
+                    replyOutboxId: correction.replyOutboxId,
+                    occurredAt: stored.occurredAt,
+                    now,
+                });
             }
             this.#database.exec('COMMIT');
             return storedSignals;
@@ -212,96 +1555,323 @@ export class PreferenceStore {
             throw error;
         }
     }
-    list(scopeInput, limit = this.#options.maxReviewHypotheses) {
+    list(scopeInput, limit = this.#options.maxReviewHypotheses, principalIdInput, lineageInput) {
         this.#assertOpen();
         if (!Number.isSafeInteger(limit) || limit < 1 || limit > this.#options.maxReviewHypotheses) {
             throw new PreferenceStoreError('invalid-input', `hypothesis limit must be between 1 and ${this.#options.maxReviewHypotheses}`);
         }
         const canonical = canonicalPreferenceScope(scopeInput);
+        const principalDigest = principalIdInput === undefined
+            ? undefined
+            : preferencePrincipalDigest(principalIdInput);
+        if ((principalDigest === undefined) !== (lineageInput === undefined)) {
+            throw new PreferenceStoreError('invalid-input', 'scoped preference listing requires both external principal and exact lineage');
+        }
+        const lineage = lineageInput === undefined
+            ? undefined
+            : canonicalPreferencePrincipalLineage(lineageInput);
         this.#refreshScope(canonical.scopeKey, canonical.scope, this.#now());
         const rows = this.#database.prepare(`
-      SELECT * FROM preference_hypotheses
-      WHERE scope_key = ?
+      SELECT hypothesis.* FROM preference_hypotheses AS hypothesis
+      WHERE hypothesis.scope_key = ?
+        AND (? IS NULL OR EXISTS (
+          SELECT 1 FROM preference_scope_principals AS owner
+          WHERE owner.scope_key = hypothesis.scope_key
+            AND owner.principal_digest = ? AND owner.purge_pending = 0
+            AND (? IS NULL OR (
+              owner.principal_lineage_id = ? AND owner.principal_lineage_version = ?
+            ))
+            AND owner.admission_cursor_epoch IS NOT NULL
+        ))
       ORDER BY CASE effect_state
         WHEN 'active' THEN 0 WHEN 'shadow' THEN 1 WHEN 'inactive' THEN 2
         WHEN 'suppressed' THEN 3 ELSE 4 END,
         confidence_bps DESC, updated_at DESC, id DESC
       LIMIT ?
-    `).all(canonical.scopeKey, limit);
+    `).all(canonical.scopeKey, principalDigest ?? null, principalDigest ?? null, lineage?.principalRecordId ?? null, lineage?.principalRecordId ?? null, lineage?.principalVersion ?? null, limit);
         return rows.map(hypothesisFromRow);
     }
-    get(scopeInput, hypothesisIdInput) {
+    get(scopeInput, hypothesisIdInput, principalIdInput, lineageInput) {
         this.#assertOpen();
         const canonical = canonicalPreferenceScope(scopeInput);
         const id = boundedText(hypothesisIdInput, 'hypothesisId', 200);
         this.#refreshScope(canonical.scopeKey, canonical.scope, this.#now());
-        const row = this.#database.prepare('SELECT * FROM preference_hypotheses WHERE id = ? AND scope_key = ?').get(id, canonical.scopeKey);
+        const principalDigest = principalIdInput === undefined
+            ? undefined
+            : preferencePrincipalDigest(principalIdInput);
+        if ((principalDigest === undefined) !== (lineageInput === undefined)) {
+            throw new PreferenceStoreError('invalid-input', 'scoped preference lookup requires both external principal and exact lineage');
+        }
+        const lineage = lineageInput === undefined
+            ? undefined
+            : canonicalPreferencePrincipalLineage(lineageInput);
+        const row = this.#database.prepare(`
+      SELECT hypothesis.* FROM preference_hypotheses AS hypothesis
+      WHERE hypothesis.id = ? AND hypothesis.scope_key = ?
+        AND (? IS NULL OR EXISTS (
+          SELECT 1 FROM preference_scope_principals AS owner
+          WHERE owner.scope_key = hypothesis.scope_key
+            AND owner.principal_digest = ? AND owner.purge_pending = 0
+            AND (? IS NULL OR (
+              owner.principal_lineage_id = ? AND owner.principal_lineage_version = ?
+            ))
+            AND owner.admission_cursor_epoch IS NOT NULL
+        ))
+    `).get(id, canonical.scopeKey, principalDigest ?? null, principalDigest ?? null, lineage?.principalRecordId ?? null, lineage?.principalRecordId ?? null, lineage?.principalVersion ?? null);
         return row === undefined ? undefined : hypothesisFromRow(row);
     }
-    activate(scopeInput, hypothesisIdInput, expectedVersion) {
+    /**
+     * Return the first hypothesis that would pass activate() at this instant.
+     * The deterministic ordering is only a planning hint: activate() still
+     * repeats every predicate under BEGIN IMMEDIATE and exact-version CAS.
+     */
+    activationCandidate(scopeInput, owner) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const now = this.#now();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            this.#assertScopeLearningActiveInTransaction(canonical);
+            this.#refreshScopeInTransaction(canonical.scopeKey, canonical.scope, now);
+            const rows = this.#database.prepare(`
+        SELECT * FROM preference_hypotheses
+        WHERE scope_key = ?
+        ORDER BY confidence_bps DESC, supporting_signals DESC, updated_at DESC, id ASC
+      `).all(canonical.scopeKey);
+            const row = rows.find(candidate => this.#activationError(candidate, canonical.scopeKey, now) === undefined);
+            this.#database.exec('COMMIT');
+            return row === undefined ? undefined : hypothesisFromRow(row);
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    activate(scopeInput, hypothesisIdInput, expectedVersion, owner) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const id = boundedText(hypothesisIdInput, 'hypothesisId', 200);
+        if (!Number.isSafeInteger(expectedVersion) || expectedVersion < 1) {
+            throw new PreferenceStoreError('invalid-input', 'expectedVersion must be a positive safe integer');
+        }
+        const now = this.#now();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            this.#assertScopeLearningActiveInTransaction(canonical);
+            this.#refreshScopeInTransaction(canonical.scopeKey, canonical.scope, now);
+            const row = this.#database.prepare('SELECT * FROM preference_hypotheses WHERE id = ? AND scope_key = ?').get(id, canonical.scopeKey);
+            if (row === undefined)
+                throw new PreferenceStoreError('not-found', 'preference hypothesis was not found');
+            if (row.version !== expectedVersion)
+                throw new PreferenceStoreError('conflict', 'hypothesis version changed');
+            const activationError = this.#activationError(row, canonical.scopeKey, now);
+            if (activationError !== undefined)
+                throw activationError;
+            const nextVersion = row.version + 1;
+            this.#database.prepare(`
+        UPDATE preference_hypotheses
+        SET effect_state = 'active', activated_at = ?, updated_at = ?, version = ?
+        WHERE id = ? AND version = ?
+      `).run(now, now, nextVersion, row.id, row.version);
+            this.#transition(row, row.claim_state, 'active', 'activated', nextVersion, now);
+            const updated = this.#database.prepare('SELECT * FROM preference_hypotheses WHERE id = ?')
+                .get(row.id);
+            this.#database.exec('COMMIT');
+            return hypothesisFromRow(updated);
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /**
+     * Apply currently-ready catalog T1 hypotheses with the same exact CAS used
+     * by the manual surface. The bounded loop is crash-replay safe: a later run
+     * simply observes already-active rows and continues.
+     */
+    activateReady(scopeInput, limit = this.#options.maxActiveOverlays, ownerFence) {
+        this.#assertOpen();
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > this.#options.maxActiveOverlays) {
+            throw new PreferenceStoreError('invalid-input', 'automatic activation limit is invalid');
+        }
+        const scope = canonicalPreferenceScope(scopeInput).scope;
+        const activated = [];
+        for (let index = 0; index < limit; index += 1) {
+            const candidate = this.activationCandidate(scope, ownerFence);
+            if (candidate === undefined)
+                break;
+            try {
+                activated.push(this.activate(scope, candidate.id, candidate.version, ownerFence));
+            }
+            catch (error) {
+                if (error instanceof PreferenceStoreError
+                    && ['conflict', 'not-ready'].includes(error.code))
+                    break;
+                throw error;
+            }
+        }
+        return activated;
+    }
+    /** Bounded restart/maintenance recovery for signals committed before activation. */
+    activateReadyScopes(limit) {
+        this.#assertOpen();
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5_000) {
+            throw new PreferenceStoreError('invalid-input', 'automatic scope activation limit is invalid');
+        }
+        const rows = this.#database.prepare(`
+      SELECT h.scope_key, h.workspace, h.preset,
+        owner.principal_digest, owner.principal_lineage_id,
+        owner.principal_lineage_version, owner.generation
+      FROM preference_hypotheses h
+      INNER JOIN preference_scope_principals owner
+        ON owner.scope_key = h.scope_key AND owner.purge_pending = 0
+          AND owner.learning_paused = 0 AND owner.admission_cursor_epoch IS NOT NULL
+      WHERE h.risk_tier = 'T1' AND h.claim_state = 'tentative' AND h.effect_state = 'shadow'
+        AND EXISTS (
+          SELECT 1 FROM preference_signals s
+          WHERE s.scope_key = h.scope_key AND s.actor_trust = 'owner-authenticated'
+            AND ((s.interpretation_trust IN ('explicit-selection', 'typed-feedback')
+              AND s.source IN ('direct-owner-feedback', 'signed-ui-feedback'))
+              OR (s.interpretation_trust = 'behavioral-inference'
+                AND s.source = 'delivery-observation'))
+        )
+      GROUP BY h.scope_key, h.workspace, h.preset,
+        owner.principal_digest, owner.principal_lineage_id,
+        owner.principal_lineage_version, owner.generation
+      ORDER BY MAX(h.updated_at) DESC, h.scope_key ASC
+      LIMIT ?
+    `).all(limit);
+        let activated = 0;
+        for (const row of rows) {
+            const scope = { workspace: row.workspace, preset: row.preset };
+            const ownerFence = Object.freeze({
+                scopeKey: row.scope_key,
+                principalDigest: row.principal_digest,
+                principalLineageId: row.principal_lineage_id,
+                principalLineageVersion: row.principal_lineage_version,
+                generation: row.generation,
+            });
+            try {
+                activated += this.activateReady(scope, this.#options.maxActiveOverlays, ownerFence).length;
+            }
+            catch (error) {
+                // A newer authenticated owner may rotate this scope after the bounded
+                // scan but before activation. The exact generation check inside each
+                // activation transaction makes that race a safe no-op for this pass.
+                if (error instanceof PreferenceStoreError && error.code === 'conflict')
+                    continue;
+                throw error;
+            }
+        }
+        return activated;
+    }
+    /**
+     * Activate one exact hypothesis and commit a fixed-run receipt in the same
+     * writer transaction. A lost response can therefore be replayed after a
+     * restart without relaxing the original evidence gate or CAS.
+     */
+    activateHostOnce(scopeInput, hypothesisIdInput, expectedVersion, operationIdInput, owner, newMutationEnabled = true) {
         this.#assertOpen();
         const canonical = canonicalPreferenceScope(scopeInput);
         const id = boundedText(hypothesisIdInput, 'hypothesisId', 200);
         if (!Number.isSafeInteger(expectedVersion) || expectedVersion < 1) {
             throw new PreferenceStoreError('invalid-input', 'expectedVersion must be a positive safe integer');
         }
+        const operationId = boundedText(operationIdInput, 'operationId', 500);
+        const idempotencyKey = `pref-host-activate-idem-${createHash('sha256')
+            .update(`preference-host-activation-idempotency-v1\0${operationId}`).digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            hypothesisId: id,
+            expectedVersion,
+            idempotencyKey,
+            ownerGeneration: owner.generation,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+        });
         const now = this.#now();
         this.#database.exec('BEGIN IMMEDIATE');
         try {
+            // The current exact owner fence is always checked before looking up a
+            // receipt. This prevents an A -> B -> A owner rotation from replaying an
+            // old generation's success. Once that fence is proven, however, an
+            // already-committed receipt is authoritative: pause/disable/readiness
+            // changes happened after the mutation and must not turn a lost response
+            // into an ambiguous Recovery result.
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const prior = this.#database.prepare(`
+        SELECT payload_hash, scope_digest, hypothesis_id, expected_version, result_version,
+          owner_generation, principal_lineage_id, principal_lineage_version
+        FROM preference_host_activation_receipts WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (prior !== undefined) {
+                if (prior.payload_hash !== hash || prior.scope_digest !== canonical.scopeDigest
+                    || prior.hypothesis_id !== id || prior.expected_version !== expectedVersion
+                    || prior.owner_generation !== owner.generation
+                    || prior.principal_lineage_id !== owner.principalLineageId
+                    || prior.principal_lineage_version !== owner.principalLineageVersion) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'Host activation operation identity was reused for another exact target');
+                }
+                this.#database.exec('COMMIT');
+                return Object.freeze({
+                    hypothesisId: prior.hypothesis_id,
+                    expectedVersion: prior.expected_version,
+                    resultVersion: prior.result_version,
+                    ownerGeneration: prior.owner_generation,
+                    principalLineageId: prior.principal_lineage_id,
+                    principalLineageVersion: prior.principal_lineage_version,
+                    replayed: true,
+                });
+            }
+            if (!newMutationEnabled) {
+                throw new PreferenceStoreError('disabled', 'preference learning is disabled');
+            }
+            this.#assertScopeLearningActiveInTransaction(canonical);
             this.#refreshScopeInTransaction(canonical.scopeKey, canonical.scope, now);
             const row = this.#database.prepare('SELECT * FROM preference_hypotheses WHERE id = ? AND scope_key = ?').get(id, canonical.scopeKey);
             if (row === undefined)
                 throw new PreferenceStoreError('not-found', 'preference hypothesis was not found');
             if (row.version !== expectedVersion)
                 throw new PreferenceStoreError('conflict', 'hypothesis version changed');
-            if (row.risk_tier !== 'T1') {
-                throw new PreferenceStoreError('forbidden-tier', 'only Host-catalog T1 hypotheses can activate automatically');
-            }
-            if (row.claim_state !== 'tentative' || row.effect_state !== 'shadow') {
-                throw new PreferenceStoreError('not-ready', 'hypothesis is not in an activatable shadow state');
-            }
-            if (row.expires_at <= now
-                || row.supporting_signals < this.#options.minSignalsForActivation
-                || row.confidence_bps < this.#options.minConfidenceBps
-                || row.contradiction_bps > this.#options.maxContradictionBps) {
-                throw new PreferenceStoreError('not-ready', 'hypothesis has insufficient current evidence');
-            }
-            const latestSelection = this.#latestActivationEligibleSignal(canonical.scopeKey, row.preference_key, now);
-            if (latestSelection?.stance !== 'support'
-                || latestSelection.candidate_value !== row.candidate_value) {
-                throw new PreferenceStoreError('not-ready', 'hypothesis is not the owner\'s latest explicit selection');
-            }
-            const activeCount = this.#database.prepare(`
-        SELECT COUNT(*) AS count FROM preference_hypotheses
-        WHERE scope_key = ? AND effect_state = 'active'
-      `).get(canonical.scopeKey).count;
-            if (activeCount >= this.#options.maxActiveOverlays) {
-                throw new PreferenceStoreError('not-ready', 'scope reached the active preference hard cap');
-            }
-            const sameKey = this.#database.prepare(`
-        SELECT id FROM preference_hypotheses
-        WHERE scope_key = ? AND preference_key = ? AND effect_state = 'active'
-      `).get(canonical.scopeKey, row.preference_key);
-            if (sameKey !== undefined)
-                throw new PreferenceStoreError('conflict', 'another value for this key is active');
-            const nextVersion = row.version + 1;
-            this.#database.prepare(`
+            const activationError = this.#activationError(row, canonical.scopeKey, now);
+            if (activationError !== undefined)
+                throw activationError;
+            const resultVersion = row.version + 1;
+            const updated = this.#database.prepare(`
         UPDATE preference_hypotheses
         SET effect_state = 'active', activated_at = ?, updated_at = ?, version = ?
-        WHERE id = ? AND version = ?
-      `).run(now, now, nextVersion, row.id, row.version);
-            this.#transition(row, row.claim_state, 'active', 'activated', nextVersion, now);
-            const updated = this.#database.prepare('SELECT * FROM preference_hypotheses WHERE id = ?')
-                .get(row.id);
+        WHERE id = ? AND scope_key = ? AND version = ?
+      `).run(now, now, resultVersion, row.id, canonical.scopeKey, row.version);
+            if (updated.changes !== 1) {
+                throw new PreferenceStoreError('conflict', 'hypothesis activation CAS lost');
+            }
+            this.#transition(row, row.claim_state, 'active', 'activated', resultVersion, now);
+            this.#database.prepare(`
+        INSERT INTO preference_host_activation_receipts(
+          idempotency_key, payload_hash, scope_digest, hypothesis_id,
+          expected_version, result_version, occurred_at, owner_generation,
+          principal_lineage_id, principal_lineage_version
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(idempotencyKey, hash, canonical.scopeDigest, row.id, row.version, resultVersion, now, owner.generation, owner.principalLineageId, owner.principalLineageVersion);
             this.#database.exec('COMMIT');
-            return hypothesisFromRow(updated);
+            return Object.freeze({
+                hypothesisId: row.id,
+                expectedVersion: row.version,
+                resultVersion,
+                ownerGeneration: owner.generation,
+                principalLineageId: owner.principalLineageId,
+                principalLineageVersion: owner.principalLineageVersion,
+                replayed: false,
+            });
         }
         catch (error) {
             this.#database.exec('ROLLBACK');
             throw error;
         }
     }
-    rollback(scopeInput, hypothesisIdInput, expectedVersion, reasonInput) {
+    rollback(scopeInput, hypothesisIdInput, expectedVersion, reasonInput, principalIdInput) {
         this.#assertOpen();
         const canonical = canonicalPreferenceScope(scopeInput);
         const id = boundedText(hypothesisIdInput, 'hypothesisId', 200);
@@ -312,6 +1882,7 @@ export class PreferenceStore {
         const now = this.#now();
         this.#database.exec('BEGIN IMMEDIATE');
         try {
+            this.#assertScopePrincipalInTransaction(canonical, principalIdInput);
             const row = this.#database.prepare('SELECT * FROM preference_hypotheses WHERE id = ? AND scope_key = ?').get(id, canonical.scopeKey);
             if (row === undefined)
                 throw new PreferenceStoreError('not-found', 'preference hypothesis was not found');
@@ -338,17 +1909,71 @@ export class PreferenceStore {
         }
     }
     overlay(scopeInput) {
+        return this.overlaySnapshot(scopeInput).text;
+    }
+    overlaySnapshot(scopeInput, principalIdInput, lineageInput) {
         this.#assertOpen();
         const canonical = canonicalPreferenceScope(scopeInput);
-        this.#refreshScope(canonical.scopeKey, canonical.scope, this.#now());
-        const rows = this.#database.prepare(`
-      SELECT * FROM preference_hypotheses
-      WHERE scope_key = ? AND effect_state = 'active' AND risk_tier = 'T1'
-      ORDER BY preference_key ASC, id ASC
-      LIMIT ?
-    `).all(canonical.scopeKey, this.#options.maxActiveOverlays);
-        if (rows.length === 0)
-            return undefined;
+        const principalDigest = principalIdInput === undefined
+            ? undefined
+            : preferencePrincipalDigest(principalIdInput);
+        const lineage = lineageInput === undefined
+            ? undefined
+            : canonicalPreferencePrincipalLineage(lineageInput);
+        let rows;
+        let ownerFence;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            if (principalDigest !== undefined) {
+                const owner = this.#database.prepare(`
+          SELECT generation, principal_lineage_id, principal_lineage_version,
+            learning_paused, admission_cursor_epoch
+          FROM preference_scope_principals
+          WHERE scope_key = ? AND principal_digest = ? AND purge_pending = 0
+            AND (? IS NULL OR (principal_lineage_id = ? AND principal_lineage_version = ?))
+        `).get(canonical.scopeKey, principalDigest, lineage?.principalRecordId ?? null, lineage?.principalRecordId ?? null, lineage?.principalVersion ?? null);
+                if (owner === undefined || owner.principal_lineage_id === null
+                    || owner.principal_lineage_version === null
+                    || owner.admission_cursor_epoch === null) {
+                    this.#database.exec('COMMIT');
+                    return Object.freeze({ text: undefined, hypotheses: Object.freeze([]) });
+                }
+                ownerFence = Object.freeze({
+                    scopeKey: canonical.scopeKey,
+                    principalDigest,
+                    principalLineageId: owner.principal_lineage_id,
+                    principalLineageVersion: owner.principal_lineage_version,
+                    generation: owner.generation,
+                });
+                if (owner.learning_paused === 1) {
+                    this.#database.exec('COMMIT');
+                    return Object.freeze({
+                        text: undefined,
+                        hypotheses: Object.freeze([]),
+                        ownerFence,
+                    });
+                }
+            }
+            this.#refreshScopeInTransaction(canonical.scopeKey, canonical.scope, this.#now());
+            rows = this.#database.prepare(`
+        SELECT * FROM preference_hypotheses
+        WHERE scope_key = ? AND effect_state = 'active' AND risk_tier = 'T1'
+        ORDER BY preference_key ASC, id ASC
+        LIMIT ?
+      `).all(canonical.scopeKey, this.#options.maxActiveOverlays);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+        if (rows.length === 0) {
+            return Object.freeze({
+                text: undefined,
+                hypotheses: Object.freeze([]),
+                ...(ownerFence === undefined ? {} : { ownerFence }),
+            });
+        }
         const lines = rows.map(row => `- ${renderCatalogPreference(row.preference_key, row.candidate_value)}`);
         const rendered = [
             '<tentative_preference_overlay>',
@@ -359,30 +1984,310 @@ export class PreferenceStore {
         if (Buffer.byteLength(rendered, 'utf8') > this.#options.maxOverlayBytes) {
             throw new PreferenceStoreError('invalid-input', 'catalog overlay exceeds the configured hard byte cap');
         }
-        return rendered;
+        return Object.freeze({
+            text: rendered,
+            hypotheses: Object.freeze(rows.map(hypothesisFromRow)),
+            ...(ownerFence === undefined ? {} : { ownerFence }),
+        });
+    }
+    recordExposure(input) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(input.scope);
+        const hypothesisIdInput = boundedText(input.hypothesisId, 'hypothesisId', 200);
+        const sessionId = boundedText(input.sessionId, 'sessionId', 500);
+        const sourceEventId = boundedText(input.sourceEventId, 'sourceEventId', 500);
+        if (!Number.isSafeInteger(input.hypothesisVersion) || input.hypothesisVersion < 1) {
+            throw new PreferenceStoreError('invalid-input', 'hypothesisVersion must be a positive safe integer');
+        }
+        const idempotencyKey = `pref-exposure-${createHash('sha256')
+            .update('preference-exposure-v1\0')
+            .update(JSON.stringify([
+            canonical.scopeDigest,
+            hypothesisIdInput,
+            input.hypothesisVersion,
+            sessionId,
+            sourceEventId,
+        ]))
+            .digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            hypothesisId: hypothesisIdInput,
+            hypothesisVersion: input.hypothesisVersion,
+            sessionId,
+            sourceEventId,
+        });
+        const now = this.#now();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, input.ownerFence);
+            this.#assertScopeLearningActiveInTransaction(canonical);
+            const replay = this.#database.prepare(`
+        SELECT payload_hash FROM preference_exposures WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (replay !== undefined) {
+                if (replay.payload_hash !== hash) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'preference exposure identity was reused');
+                }
+                this.#database.exec('COMMIT');
+                return Object.freeze({ replayed: true });
+            }
+            const hypothesis = this.#database.prepare(`
+        SELECT * FROM preference_hypotheses
+        WHERE id = ? AND scope_key = ? AND version = ?
+          AND risk_tier = 'T1' AND effect_state = 'active' AND expires_at > ?
+      `).get(hypothesisIdInput, canonical.scopeKey, input.hypothesisVersion, now);
+            if (hypothesis === undefined) {
+                throw new PreferenceStoreError('conflict', 'exposure hypothesis is no longer the exact active version');
+            }
+            this.#database.prepare(`
+        INSERT INTO preference_exposures(
+          idempotency_key, payload_hash, scope_key, workspace, preset,
+          hypothesis_id, hypothesis_version, session_id, source_event_id,
+          source_inbox_id, reply_outbox_id, state, exposed_at, bound_at, expires_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, 'pending', ?, NULL, ?)
+      `).run(idempotencyKey, hash, canonical.scopeKey, canonical.scope.workspace, canonical.scope.preset, hypothesis.id, hypothesis.version, sessionId, sourceEventId, now, hypothesis.expires_at);
+            this.#database.exec('COMMIT');
+            return Object.freeze({ replayed: false });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    bindExposure(input) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(input.scope);
+        const sessionId = boundedText(input.sessionId, 'sessionId', 500);
+        const sourceEventId = boundedText(input.sourceEventId, 'sourceEventId', 500);
+        const sourceInboxId = boundedText(input.sourceInboxId, 'sourceInboxId', 500);
+        const replyOutboxId = boundedText(input.replyOutboxId, 'replyOutboxId', 500);
+        const now = this.#now();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            if (input.ownerFence !== undefined) {
+                if (input.admissionCursor === undefined) {
+                    throw new PreferenceStoreError('invalid-input', 'owner-fenced exposure binding requires a Delivery admission cursor');
+                }
+                if (!this.#admitEventCursorInTransaction(canonical, input.ownerFence, canonicalPreferenceAdmissionCursor(input.admissionCursor))) {
+                    this.#database.exec('COMMIT');
+                    return Object.freeze({ bound: 0, replayed: false });
+                }
+            }
+            else {
+                this.#assertScopePrincipalInTransaction(canonical, input.ownerFence);
+            }
+            this.#assertScopeLearningActiveInTransaction(canonical);
+            const rows = this.#database.prepare(`
+        SELECT source_inbox_id, reply_outbox_id, state FROM preference_exposures
+        WHERE scope_key = ? AND session_id = ? AND source_event_id = ?
+      `).all(canonical.scopeKey, sessionId, sourceEventId);
+            const conflict = rows.some(row => row.state === 'bound'
+                && (row.source_inbox_id !== sourceInboxId || row.reply_outbox_id !== replyOutboxId));
+            if (conflict) {
+                throw new PreferenceStoreError('idempotency-conflict', 'exposure turn was bound to another receipt');
+            }
+            const updated = this.#database.prepare(`
+        UPDATE preference_exposures
+        SET source_inbox_id = ?, reply_outbox_id = ?, state = 'bound', bound_at = ?
+        WHERE scope_key = ? AND session_id = ? AND source_event_id = ? AND state = 'pending'
+      `).run(sourceInboxId, replyOutboxId, now, canonical.scopeKey, sessionId, sourceEventId);
+            this.#database.exec('COMMIT');
+            return Object.freeze({ bound: Number(updated.changes), replayed: rows.length > 0 && updated.changes === 0 });
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    hasBoundExposure(input) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(input.scope);
+        const sourceInboxId = boundedText(input.sourceInboxId, 'sourceInboxId', 500);
+        const replyOutboxId = boundedText(input.replyOutboxId, 'replyOutboxId', 500);
+        return this.#database.prepare(`
+      SELECT 1 AS present FROM preference_exposures
+      WHERE scope_key = ? AND source_inbox_id = ? AND reply_outbox_id = ? AND state = 'bound'
+      LIMIT 1
+    `).get(canonical.scopeKey, sourceInboxId, replyOutboxId) !== undefined;
+    }
+    recordExposureCorrection(input) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(input.scope);
+        const signalId = boundedText(input.signalId, 'signalId', 200);
+        const selection = catalogSelection(input.preferenceKey, input.candidateValue);
+        const sourceInboxId = boundedText(input.sourceInboxId, 'sourceInboxId', 500);
+        const replyOutboxId = boundedText(input.replyOutboxId, 'replyOutboxId', 500);
+        const occurredAt = safeTimestamp(input.occurredAt, 'occurredAt');
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const signal = this.#database.prepare(`
+        SELECT * FROM preference_signals WHERE id = ? AND scope_key = ?
+      `).get(signalId, canonical.scopeKey);
+            if (signal === undefined || signal.preference_key !== selection.key
+                || signal.candidate_value !== selection.value || signal.occurred_at !== occurredAt) {
+                throw new PreferenceStoreError('conflict', 'exposure correction signal identity changed');
+            }
+            const inserted = this.#applyExposureCorrectionInTransaction({
+                signal,
+                sourceInboxId,
+                replyOutboxId,
+                occurredAt,
+                now: this.#now(),
+            });
+            this.#database.exec('COMMIT');
+            return inserted;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    #applyExposureCorrectionInTransaction(input) {
+        if (!isActivationEligibleSignal(input.signal)
+            || input.signal.interpretation_trust === 'behavioral-inference')
+            return 0;
+        const exposures = this.#database.prepare(`
+      SELECT exposure.hypothesis_id, exposure.hypothesis_version
+      FROM preference_exposures AS exposure
+      JOIN preference_hypotheses AS hypothesis ON hypothesis.id = exposure.hypothesis_id
+      WHERE exposure.scope_key = ? AND exposure.source_inbox_id = ?
+        AND exposure.reply_outbox_id = ? AND exposure.state = 'bound'
+        AND hypothesis.preference_key = ? AND hypothesis.candidate_value <> ?
+      ORDER BY exposure.hypothesis_id, exposure.hypothesis_version
+    `).all(input.signal.scope_key, input.sourceInboxId, input.replyOutboxId, input.signal.preference_key, input.signal.candidate_value);
+        let inserted = 0;
+        for (const exposure of exposures) {
+            inserted += Number(this.#database.prepare(`
+        INSERT OR IGNORE INTO preference_exposure_corrections(
+          signal_id, hypothesis_id, hypothesis_version,
+          source_inbox_id, reply_outbox_id, occurred_at
+        ) VALUES (?, ?, ?, ?, ?, ?)
+      `).run(input.signal.id, exposure.hypothesis_id, exposure.hypothesis_version, input.sourceInboxId, input.replyOutboxId, input.occurredAt).changes);
+            const current = this.#database.prepare(`
+        SELECT * FROM preference_hypotheses
+        WHERE id = ? AND scope_key = ? AND effect_state = 'active'
+      `).get(exposure.hypothesis_id, input.signal.scope_key);
+            if (current === undefined || current.version < exposure.hypothesis_version)
+                continue;
+            const crossedLineage = this.#database.prepare(`
+        SELECT 1 AS changed FROM preference_transitions
+        WHERE hypothesis_id = ? AND version > ? AND reason <> 'evidence-updated'
+        LIMIT 1
+      `).get(current.id, exposure.hypothesis_version) !== undefined;
+            if (crossedLineage)
+                continue;
+            const nextVersion = current.version + 1;
+            const changed = this.#database.prepare(`
+        UPDATE preference_hypotheses SET
+          claim_state = 'rejected', effect_state = 'rolled-back',
+          rolled_back_at = ?, updated_at = ?, version = ?
+        WHERE id = ? AND scope_key = ? AND version = ? AND effect_state = 'active'
+      `).run(input.now, input.now, nextVersion, current.id, input.signal.scope_key, current.version);
+            if (changed.changes !== 1) {
+                throw new PreferenceStoreError('conflict', 'exact exposure rollback CAS lost');
+            }
+            this.#transition(current, 'rejected', 'rolled-back', 'owner-rejected', nextVersion, input.now);
+        }
+        return inserted;
     }
-    forgetScope(scopeInput, idempotencyKeyInput) {
+    forgetScope(scopeInput, idempotencyKeyInput, options) {
         this.#assertOpen();
         const canonical = canonicalPreferenceScope(scopeInput);
         const rawIdempotencyKey = boundedText(idempotencyKeyInput, 'idempotencyKey', 200);
         const idempotencyKey = `pref-forget-idem-${createHash('sha256')
             .update(`preference-forget-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
         const now = this.#now();
-        const forgottenThrough = now;
+        const occurredAt = options === undefined ? now : safeTimestamp(options.occurredAt, 'occurredAt');
+        const admissionCursor = options === undefined
+            ? undefined
+            : canonicalPreferenceAdmissionCursor(options.admissionCursor);
+        const forgottenThrough = Math.max(now, occurredAt);
         const hash = payloadHash({ scopeDigest: canonical.scopeDigest, idempotencyKey });
+        const ownerReceiptKey = options === undefined
+            ? undefined
+            : `pref-owner-control-${createHash('sha256')
+                .update(`preference-owner-control-idempotency-v1\0${rawIdempotencyKey}`).digest('hex')}`;
+        const ownerReceiptHash = options === undefined
+            ? undefined
+            : payloadHash({
+                scopeDigest: canonical.scopeDigest,
+                principalDigest: options.ownerFence.principalDigest,
+                principalLineageId: options.ownerFence.principalLineageId,
+                principalLineageVersion: options.ownerFence.principalLineageVersion,
+                generation: options.ownerFence.generation,
+                action: 'forget',
+                admissionCursor,
+            });
         let result;
+        let privacyChanged = false;
         this.#database.exec('BEGIN IMMEDIATE');
         try {
-            const replay = this.#database.prepare(`
-        SELECT payload_hash, forgotten_through, deleted_signals, deleted_hypotheses
-        FROM preference_scope_tombstones WHERE idempotency_key = ?
-      `).get(idempotencyKey);
+            this.#assertScopePrincipalInTransaction(canonical, options?.ownerFence);
+            if (options !== undefined) {
+                const replay = this.#database.prepare(`
+          SELECT * FROM preference_owner_control_receipts WHERE idempotency_key = ?
+        `).get(ownerReceiptKey);
+                if (replay !== undefined) {
+                    if (replay.payload_hash !== ownerReceiptHash) {
+                        throw new PreferenceStoreError('idempotency-conflict', 'forget idempotency key was reused');
+                    }
+                    this.#database.exec('COMMIT');
+                    result = Object.freeze({
+                        applied: replay.result_applied === 1,
+                        replayed: true,
+                        forgottenThrough: Math.max(0, replay.result_forgotten_through),
+                        deletedSignals: replay.result_deleted_signals,
+                        deletedHypotheses: replay.result_deleted_hypotheses,
+                        state: this.#ownerControlStateFromReceipt(replay),
+                    });
+                    privacyChanged = replay.result_applied === 1;
+                    if (privacyChanged)
+                        this.#truncateWalForPrivacy();
+                    return result;
+                }
+                const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+                const fresh = this.#controlCursorIsFresh(current, admissionCursor);
+                if (!fresh) {
+                    const priorForget = this.#forgottenThrough(canonical.scopeDigest) ?? 0;
+                    const state = this.#scopeLearningStatusInTransaction(canonical, options.ownerFence);
+                    this.#insertOwnerControlReceipt({
+                        idempotencyKey: ownerReceiptKey,
+                        hash: ownerReceiptHash,
+                        canonical,
+                        owner: options.ownerFence,
+                        action: 'forget',
+                        admissionCursor: admissionCursor,
+                        applied: false,
+                        state,
+                        deletedSignals: 0,
+                        deletedHypotheses: 0,
+                        forgottenThrough: priorForget,
+                        occurredAt,
+                    });
+                    this.#database.exec('COMMIT');
+                    return Object.freeze({
+                        applied: false,
+                        replayed: false,
+                        forgottenThrough: priorForget,
+                        deletedSignals: 0,
+                        deletedHypotheses: 0,
+                        state,
+                    });
+                }
+            }
+            const replay = options === undefined
+                ? this.#database.prepare(`
+            SELECT payload_hash, forgotten_through, deleted_signals, deleted_hypotheses
+            FROM preference_scope_tombstones WHERE idempotency_key = ?
+          `).get(idempotencyKey)
+                : undefined;
             if (replay !== undefined) {
                 if (replay.payload_hash !== hash) {
                     throw new PreferenceStoreError('idempotency-conflict', 'forget idempotency key was reused');
                 }
                 this.#database.exec('COMMIT');
                 result = Object.freeze({
+                    applied: true,
                     replayed: true,
                     forgottenThrough: replay.forgotten_through,
                     deletedSignals: replay.deleted_signals,
@@ -390,25 +2295,85 @@ export class PreferenceStore {
                 });
             }
             else {
+                // A privacy reset must not leave historical snapshots or tombstones
+                // that disclose the deleted counts/times. The exact current forget
+                // replay was handled above; after this boundary only its new receipt
+                // and tombstone may survive.
+                this.#cancelScopePromotionsInTransaction(canonical.scopeKey, 'forget', now);
+                this.#purgeScopePromotionDetailsInTransaction(canonical.scopeKey);
+                this.#database.prepare('DELETE FROM preference_owner_control_receipts WHERE scope_digest = ?').run(canonical.scopeDigest);
+                this.#database.prepare('DELETE FROM preference_scope_tombstones WHERE scope_digest = ?').run(canonical.scopeDigest);
+                this.#database.prepare(`
+          DELETE FROM preference_exposure_corrections
+          WHERE signal_id IN (SELECT id FROM preference_signals WHERE scope_key = ?)
+            OR hypothesis_id IN (SELECT id FROM preference_hypotheses WHERE scope_key = ?)
+        `).run(canonical.scopeKey, canonical.scopeKey);
+                this.#database.prepare('DELETE FROM preference_exposures WHERE scope_key = ?').run(canonical.scopeKey);
                 const hypothesisIds = this.#database.prepare('SELECT id FROM preference_hypotheses WHERE scope_key = ?').all(canonical.scopeKey);
                 for (const entry of hypothesisIds) {
                     this.#database.prepare('DELETE FROM preference_transitions WHERE hypothesis_id = ?').run(entry.id);
                 }
                 const deletedHypotheses = Number(this.#database.prepare('DELETE FROM preference_hypotheses WHERE scope_key = ?').run(canonical.scopeKey).changes);
                 const deletedSignals = Number(this.#database.prepare('DELETE FROM preference_signals WHERE scope_key = ?').run(canonical.scopeKey).changes);
+                if (options !== undefined) {
+                    const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+                    const changed = this.#database.prepare(`
+            UPDATE preference_scope_principals
+            SET ignore_events_through = MAX(ignore_events_through, ?),
+              ignore_events_through_sequence = ?,
+              admission_high_water = ?, admission_high_water_kind = 'control',
+              control_version = control_version + 1, updated_at = ?
+            WHERE scope_key = ? AND principal_digest = ?
+              AND principal_lineage_id = ? AND principal_lineage_version = ?
+              AND generation = ? AND purge_pending = 0
+              AND admission_cursor_epoch = ? AND admission_high_water IS ?
+          `).run(forgottenThrough, admissionCursor.sequence, admissionCursor.sequence, now, canonical.scopeKey, options.ownerFence.principalDigest, options.ownerFence.principalLineageId, options.ownerFence.principalLineageVersion, options.ownerFence.generation, admissionCursor.epoch, current.admission_high_water);
+                    if (changed.changes !== 1) {
+                        throw new PreferenceStoreError('conflict', 'forget owner fence changed');
+                    }
+                }
                 this.#database.prepare(`
           INSERT INTO preference_scope_tombstones(
             id, scope_digest, idempotency_key, payload_hash, forgotten_through,
             recorded_at, deleted_signals, deleted_hypotheses
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
         `).run(`pref-forget-${randomUUID()}`, canonical.scopeDigest, idempotencyKey, hash, forgottenThrough, now, deletedSignals, deletedHypotheses);
+                if (options !== undefined) {
+                    const state = this.#scopeLearningStatusInTransaction(canonical, options.ownerFence);
+                    this.#insertOwnerControlReceipt({
+                        idempotencyKey: ownerReceiptKey,
+                        hash: ownerReceiptHash,
+                        canonical,
+                        owner: options.ownerFence,
+                        action: 'forget',
+                        admissionCursor: admissionCursor,
+                        applied: true,
+                        state,
+                        deletedSignals,
+                        deletedHypotheses,
+                        forgottenThrough,
+                        occurredAt,
+                    });
+                    result = Object.freeze({
+                        applied: true,
+                        replayed: false,
+                        forgottenThrough,
+                        deletedSignals,
+                        deletedHypotheses,
+                        state,
+                    });
+                }
+                else {
+                    result = Object.freeze({
+                        applied: true,
+                        replayed: false,
+                        forgottenThrough,
+                        deletedSignals,
+                        deletedHypotheses,
+                    });
+                }
                 this.#database.exec('COMMIT');
-                result = Object.freeze({
-                    replayed: false,
-                    forgottenThrough,
-                    deletedSignals,
-                    deletedHypotheses,
-                });
+                privacyChanged = true;
             }
         }
         catch (error) {
@@ -418,7 +2383,8 @@ export class PreferenceStore {
         // A logical DELETE is not a privacy boundary while old pages remain in
         // WAL. Secure-delete wipes the database pages; TRUNCATE proves those
         // deletion frames have also been checkpointed before success is reported.
-        this.#truncateWalForPrivacy();
+        if (privacyChanged || result.applied)
+            this.#truncateWalForPrivacy();
         return result;
     }
     health() {
@@ -467,6 +2433,24 @@ export class PreferenceStore {
           LIMIT ?
         )
       `).run(threshold, limit).changes);
+            this.#database.prepare(`
+        DELETE FROM preference_exposures
+        WHERE idempotency_key IN (
+          SELECT idempotency_key FROM preference_exposures
+          WHERE expires_at < ?
+          ORDER BY expires_at ASC, idempotency_key ASC
+          LIMIT ?
+        )
+      `).run(this.#now(), limit);
+            this.#database.prepare(`
+        DELETE FROM preference_exposure_corrections
+        WHERE NOT EXISTS (
+          SELECT 1 FROM preference_exposures e
+          WHERE e.hypothesis_id = preference_exposure_corrections.hypothesis_id
+            AND e.hypothesis_version = preference_exposure_corrections.hypothesis_version
+            AND e.reply_outbox_id = preference_exposure_corrections.reply_outbox_id
+        )
+      `).run();
             this.#database.exec('COMMIT');
         }
         catch (error) {
@@ -479,6 +2463,83 @@ export class PreferenceStore {
         this.#truncateWalForPrivacy();
         return Object.freeze({ deletedSignals });
     }
+    /**
+     * Delete at most one expired signal from one exact Host scope. The operation
+     * receipt commits with the deletion, so a crash/retry cannot consume a second
+     * row under the same fixed-run step identity.
+     */
+    maintainScopeOnce(scopeInput, operationIdInput, owner) {
+        this.#assertOpen();
+        const canonical = canonicalPreferenceScope(scopeInput);
+        const operationId = boundedText(operationIdInput, 'operationId', 500);
+        const idempotencyKey = `pref-host-maint-idem-${createHash('sha256')
+            .update(`preference-host-maintenance-idempotency-v1\0${operationId}`).digest('hex')}`;
+        const hash = payloadHash({
+            scopeDigest: canonical.scopeDigest,
+            idempotencyKey,
+            ownerGeneration: owner.generation,
+            principalLineageId: owner.principalLineageId,
+            principalLineageVersion: owner.principalLineageVersion,
+        });
+        const now = this.#now();
+        const threshold = Math.max(0, now - this.#options.signalTtlMs);
+        let result;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#assertScopePrincipalInTransaction(canonical, owner);
+            const prior = this.#database.prepare(`
+        SELECT payload_hash, scope_digest, deleted_signals, owner_generation,
+          principal_lineage_id, principal_lineage_version
+        FROM preference_host_maintenance_receipts WHERE idempotency_key = ?
+      `).get(idempotencyKey);
+            if (prior !== undefined) {
+                if (prior.payload_hash !== hash || prior.scope_digest !== canonical.scopeDigest
+                    || prior.owner_generation !== owner.generation
+                    || prior.principal_lineage_id !== owner.principalLineageId
+                    || prior.principal_lineage_version !== owner.principalLineageVersion) {
+                    throw new PreferenceStoreError('idempotency-conflict', 'Host maintenance operation identity was reused for another scope');
+                }
+                result = Object.freeze({
+                    deletedSignals: prior.deleted_signals,
+                    replayed: true,
+                    ownerGeneration: owner.generation,
+                    principalLineageId: owner.principalLineageId,
+                    principalLineageVersion: owner.principalLineageVersion,
+                });
+            }
+            else {
+                const deletedSignals = Number(this.#database.prepare(`
+          DELETE FROM preference_signals
+          WHERE id IN (
+            SELECT id FROM preference_signals
+            WHERE scope_key = ? AND occurred_at < ?
+            ORDER BY occurred_at ASC, id ASC
+            LIMIT 1
+          )
+        `).run(canonical.scopeKey, threshold).changes);
+                this.#database.prepare(`
+          INSERT INTO preference_host_maintenance_receipts(
+            idempotency_key, payload_hash, scope_digest, deleted_signals, occurred_at,
+            owner_generation, principal_lineage_id, principal_lineage_version
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(idempotencyKey, hash, canonical.scopeDigest, deletedSignals, now, owner.generation, owner.principalLineageId, owner.principalLineageVersion);
+                result = Object.freeze({
+                    deletedSignals,
+                    replayed: false,
+                    ownerGeneration: owner.generation,
+                    principalLineageId: owner.principalLineageId,
+                    principalLineageVersion: owner.principalLineageVersion,
+                });
+            }
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+        this.#truncateWalForPrivacy();
+        return result;
+    }
     close() {
         if (this.#closed)
             return;
@@ -545,7 +2606,7 @@ export class PreferenceStore {
         for (const { preference_key: key } of keys)
             this.#reconcileKey(scopeKey, scope, key, now);
     }
-    #reconcileKey(scopeKey, scope, key, now, triggerSignal) {
+    #reconcileKey(scopeKey, scope, key, now, triggerSignal, allowGlobalOwnerCorrection = true) {
         const signals = this.#database.prepare(`
       SELECT * FROM preference_signals
       WHERE scope_key = ? AND preference_key = ? AND occurred_at >= ?
@@ -620,11 +2681,20 @@ export class PreferenceStore {
             let rolledBackAt = prior.rolled_back_at;
             let version = prior.version;
             let transitionReason;
-            const ownerCorrection = triggerSignal !== undefined
+            const ownerCorrection = allowGlobalOwnerCorrection && triggerSignal !== undefined
                 && latestSelection?.id === triggerSignal.id
                 && isActivationEligibleSignal(triggerSignal)
+                && triggerSignal.interpretation_trust !== 'behavioral-inference'
                 && ((triggerSignal.stance === 'support' && triggerSignal.candidate_value !== candidate)
                     || (triggerSignal.stance === 'contradict' && triggerSignal.candidate_value === candidate));
+            const behavioralCorrection = triggerSignal !== undefined
+                && latestSelection?.id === triggerSignal.id
+                && triggerSignal.interpretation_trust === 'behavioral-inference'
+                && triggerSignal.source === 'delivery-observation'
+                && triggerSignal.stance === 'support'
+                && triggerSignal.candidate_value !== candidate
+                && this.#behavioralSupportingCount(scopeKey, key, triggerSignal.candidate_value, now) >= this.#options.minBehavioralSignalsForActivation
+                && evidence.contradictionBps > this.#options.maxContradictionBps;
             const ownerReselected = triggerSignal !== undefined
                 && latestSelection?.id === triggerSignal.id
                 && isActivationEligibleSignal(triggerSignal)
@@ -643,6 +2713,13 @@ export class PreferenceStore {
                 version += 1;
                 transitionReason = 'owner-rejected';
             }
+            else if (effectState === 'active' && behavioralCorrection) {
+                claimState = 'rejected';
+                effectState = 'rolled-back';
+                rolledBackAt = now;
+                version += 1;
+                transitionReason = 'contradicted';
+            }
             else if (entry.riskTier === 'T1'
                 && ['rejected', 'expired'].includes(claimState)
                 && ownerReselected
@@ -678,6 +2755,24 @@ export class PreferenceStore {
         WHERE id = ?
       `).run(claimState, effectState, evidence.confidenceBps, evidence.contradictionBps, evidence.supportingSignals, evidence.contradictingSignals, evidence.mass, expiresAt, activatedAt, rolledBackAt, version, now, prior.id);
             this.#transition(prior, claimState, effectState, transitionReason, version, now);
+            if (entry.riskTier === 'T2') {
+                const promotions = this.#database.prepare(`
+          SELECT * FROM preference_memory_promotions
+          WHERE scope_key = ? AND hypothesis_id = ?
+            AND state IN ('pending', 'submitted')
+        `).all(scopeKey, prior.id);
+                for (const promotion of promotions) {
+                    if (claimState === 'expired') {
+                        this.#cancelPromotionInTransaction(promotion, 'superseded', now);
+                    }
+                    else if (candidate !== promotion.hypothesis_value
+                        || version !== promotion.hypothesis_version
+                        || evidence.confidenceBps < this.#options.minConfidenceBpsForPromotion
+                        || evidence.contradictionBps > this.#options.maxContradictionBpsForPromotion) {
+                        this.#cancelPromotionInTransaction(promotion, 'superseded', now);
+                    }
+                }
+            }
         }
     }
     #evidenceForCandidate(signals, candidate, now) {
@@ -727,12 +2822,76 @@ export class PreferenceStore {
       SELECT * FROM preference_signals
       WHERE scope_key = ? AND preference_key = ? AND occurred_at >= ?
         AND actor_trust = 'owner-authenticated'
-        AND interpretation_trust IN ('explicit-selection', 'typed-feedback')
-        AND source IN ('direct-owner-feedback', 'signed-ui-feedback')
-      ORDER BY occurred_at DESC, recorded_at DESC, rowid DESC
+        AND ((interpretation_trust IN ('explicit-selection', 'typed-feedback')
+          AND source IN ('direct-owner-feedback', 'signed-ui-feedback'))
+          OR (interpretation_trust = 'behavioral-inference' AND source = 'delivery-observation'))
+      ORDER BY CASE interpretation_trust
+        WHEN 'explicit-selection' THEN 0
+        WHEN 'typed-feedback' THEN 1
+        ELSE 2
+      END ASC, occurred_at DESC, recorded_at DESC, rowid DESC
       LIMIT 1
     `).get(scopeKey, key, Math.max(0, now - this.#options.signalTtlMs));
     }
+    /** Shared, transaction-local gate for both planning and activation. */
+    #activationError(row, scopeKey, now) {
+        if (row.risk_tier !== 'T1') {
+            return new PreferenceStoreError('forbidden-tier', 'only Host-catalog T1 hypotheses can activate automatically');
+        }
+        if (row.claim_state !== 'tentative' || row.effect_state !== 'shadow') {
+            return new PreferenceStoreError('not-ready', 'hypothesis is not in an activatable shadow state');
+        }
+        const latestSelection = this.#latestActivationEligibleSignal(scopeKey, row.preference_key, now);
+        if (latestSelection?.stance !== 'support'
+            || latestSelection.candidate_value !== row.candidate_value) {
+            return new PreferenceStoreError('not-ready', 'hypothesis is not the owner\'s controlling selection');
+        }
+        const isExplicit = latestSelection.interpretation_trust === 'explicit-selection';
+        const isBehavioral = latestSelection.interpretation_trust === 'behavioral-inference';
+        const requiredSignals = isBehavioral
+            ? this.#options.minBehavioralSignalsForActivation
+            : this.#options.minSignalsForActivation;
+        const supportingSignals = isBehavioral
+            ? this.#behavioralSupportingCount(scopeKey, row.preference_key, row.candidate_value, now)
+            : row.supporting_signals;
+        if (row.expires_at <= now
+            || (!isExplicit && supportingSignals < requiredSignals)
+            || (!isExplicit && !isBehavioral && row.confidence_bps < this.#options.minConfidenceBps)
+            || (!isExplicit && !isBehavioral && row.contradiction_bps > this.#options.maxContradictionBps)) {
+            return new PreferenceStoreError('not-ready', 'hypothesis has insufficient current evidence');
+        }
+        const activeCount = this.#database.prepare(`
+      SELECT COUNT(*) AS count FROM preference_hypotheses
+      WHERE scope_key = ? AND effect_state = 'active'
+    `).get(scopeKey).count;
+        if (activeCount >= this.#options.maxActiveOverlays) {
+            return new PreferenceStoreError('not-ready', 'scope reached the active preference hard cap');
+        }
+        const sameKey = this.#database.prepare(`
+      SELECT id FROM preference_hypotheses
+      WHERE scope_key = ? AND preference_key = ? AND effect_state = 'active'
+    `).get(scopeKey, row.preference_key);
+        if (sameKey !== undefined) {
+            return new PreferenceStoreError('conflict', 'another value for this key is active');
+        }
+        return undefined;
+    }
+    #behavioralSupportingCount(scopeKey, key, candidateValue, now) {
+        const rows = this.#database.prepare(`
+      SELECT candidate_value, stance FROM preference_signals
+      WHERE scope_key = ? AND preference_key = ? AND actor_trust = 'owner-authenticated'
+        AND interpretation_trust = 'behavioral-inference'
+        AND source = 'delivery-observation' AND occurred_at >= ?
+      ORDER BY occurred_at DESC, recorded_at DESC, rowid DESC
+    `).all(scopeKey, key, Math.max(0, now - this.#options.signalTtlMs));
+        let streak = 0;
+        for (const row of rows) {
+            if (row.stance !== 'support' || row.candidate_value !== candidateValue)
+                break;
+            streak += 1;
+        }
+        return streak;
+    }
     #transition(prior, claimState, effectState, reason, version, occurredAt) {
         this.#database.prepare(`
       INSERT INTO preference_transitions(
@@ -748,6 +2907,343 @@ export class PreferenceStore {
     `).get(scopeDigest);
         return row.forgotten_through ?? undefined;
     }
+    #promotionRow(promotionId, promotionGeneration) {
+        const row = this.#database.prepare(`
+      SELECT * FROM preference_memory_promotions
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(promotionId, promotionGeneration);
+        if (row === undefined)
+            throw new PreferenceStoreError('not-found', 'promotion was not found');
+        return row;
+    }
+    #isPromotionTerminal(state) {
+        return ['confirmed', 'rejected', 'expired', 'conflicted', 'stale-owner'].includes(state);
+    }
+    #recordPromotionCancellationInTransaction(row, reason, now) {
+        const request = validatePreferenceMemoryPromotionCancellationRequest(withPreferenceMemoryPromotionCancellationDigest({
+            contractVersion: 1,
+            promotionId: row.promotion_id,
+            promotionGeneration: row.promotion_generation,
+            requestDigest: row.request_digest,
+            principalLineage: {
+                principalRecordId: row.principal_lineage_id,
+                principalVersion: row.principal_lineage_version,
+            },
+            ownerGeneration: row.owner_generation,
+            reason,
+            occurredAt: now,
+        }));
+        const upgradeBindingDigest = this.#cancellationUpgradeBindingDigest(request);
+        const existing = this.#database.prepare(`
+      SELECT * FROM preference_memory_promotion_cancellations
+      WHERE promotion_id = ? AND promotion_generation = ?
+    `).get(request.promotionId, request.promotionGeneration);
+        if (existing !== undefined) {
+            if (existing.upgrade_binding_digest !== upgradeBindingDigest) {
+                throw new PreferenceStoreError('idempotency-conflict', 'promotion cancellation binding changed');
+            }
+            if (existing.reason === 'superseded' && request.reason !== 'superseded') {
+                this.#database.prepare(`
+          UPDATE preference_memory_promotion_cancellations SET
+            principal_lineage_id = ?, principal_lineage_version = ?, owner_generation = ?,
+            reason = ?, cancelled_at = ?, cancellation_digest = ?, state = 'pending',
+            attempt_count = 0, next_attempt_at = ?, receipt_digest = NULL,
+            last_error = NULL, updated_at = ?
+          WHERE promotion_id = ? AND promotion_generation = ?
+            AND reason = 'superseded' AND upgrade_binding_digest = ?
+        `).run(request.principalLineage.principalRecordId, request.principalLineage.principalVersion, request.ownerGeneration, request.reason, request.occurredAt, request.cancellationDigest, now, now, request.promotionId, request.promotionGeneration, upgradeBindingDigest);
+            }
+            return;
+        }
+        this.#database.prepare(`
+      INSERT INTO preference_memory_promotion_cancellations(
+        promotion_id, promotion_generation, request_digest, principal_lineage_id,
+        principal_lineage_version, owner_generation, reason, cancelled_at,
+        cancellation_digest, state, attempt_count, next_attempt_at,
+        upgrade_binding_digest, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?, ?)
+    `).run(request.promotionId, request.promotionGeneration, request.requestDigest, request.principalLineage.principalRecordId, request.principalLineage.principalVersion, request.ownerGeneration, request.reason, request.occurredAt, request.cancellationDigest, now, upgradeBindingDigest, now);
+    }
+    #cancellationUpgradeBindingDigest(request) {
+        return preferencePromotionCancellationUpgradeBindingDigest({
+            promotionId: request.promotionId,
+            promotionGeneration: request.promotionGeneration,
+            requestDigest: request.requestDigest,
+            principalLineageId: request.principalLineage.principalRecordId,
+            principalLineageVersion: request.principalLineage.principalVersion,
+            ownerGeneration: request.ownerGeneration,
+        });
+    }
+    #cancelPromotionInTransaction(row, reason, now) {
+        this.#recordPromotionCancellationInTransaction(row, reason, now);
+        if (row.state === 'cancelled')
+            return;
+        if (this.#isPromotionTerminal(row.state))
+            return;
+        this.#database.prepare(`
+      UPDATE preference_memory_promotions SET state = 'cancelled', updated_at = ?
+      WHERE promotion_id = ? AND promotion_generation = ?
+        AND state IN ('pending', 'submitted')
+    `).run(now, row.promotion_id, row.promotion_generation);
+        this.#database.prepare(`
+      UPDATE preference_memory_promotion_outbox SET state = 'cancelled', updated_at = ?
+      WHERE promotion_id = ? AND promotion_generation = ?
+        AND state IN ('pending', 'retry_wait', 'submitted')
+    `).run(now, row.promotion_id, row.promotion_generation);
+    }
+    #cancelScopePromotionsInTransaction(scopeKey, reason, now) {
+        const rows = this.#database.prepare(`
+      SELECT * FROM preference_memory_promotions
+      WHERE scope_key = ? AND state IN ('pending', 'submitted', 'confirmed', 'cancelled')
+    `).all(scopeKey);
+        for (const row of rows)
+            this.#cancelPromotionInTransaction(row, reason, now);
+    }
+    #purgeScopePromotionDetailsInTransaction(scopeKey) {
+        this.#database.prepare(`
+      DELETE FROM preference_memory_promotion_results
+      WHERE (promotion_id, promotion_generation) IN (
+        SELECT promotion_id, promotion_generation FROM preference_memory_promotions
+        WHERE scope_key = ?
+      )
+    `).run(scopeKey);
+        this.#database.prepare(`
+      DELETE FROM preference_memory_promotion_outbox
+      WHERE (promotion_id, promotion_generation) IN (
+        SELECT promotion_id, promotion_generation FROM preference_memory_promotions
+        WHERE scope_key = ?
+      )
+    `).run(scopeKey);
+        this.#database.prepare('DELETE FROM preference_memory_promotions WHERE scope_key = ?').run(scopeKey);
+    }
+    #deleteScopeDataInTransaction(scopeKey, scopeDigest) {
+        this.#cancelScopePromotionsInTransaction(scopeKey, 'owner-rotated', this.#now());
+        // Request rows include private scope/principal material. Keep only opaque
+        // cancellation tombstones so delayed Memory receipts can be ACK-cancelled.
+        this.#purgeScopePromotionDetailsInTransaction(scopeKey);
+        this.#database.prepare('DELETE FROM preference_owner_control_receipts WHERE scope_digest = ?').run(scopeDigest);
+        this.#database.prepare('DELETE FROM preference_host_activation_receipts WHERE scope_digest = ?').run(scopeDigest);
+        this.#database.prepare('DELETE FROM preference_host_maintenance_receipts WHERE scope_digest = ?').run(scopeDigest);
+        this.#database.prepare(`
+      DELETE FROM preference_exposure_corrections
+      WHERE signal_id IN (SELECT id FROM preference_signals WHERE scope_key = ?)
+        OR hypothesis_id IN (SELECT id FROM preference_hypotheses WHERE scope_key = ?)
+    `).run(scopeKey, scopeKey);
+        this.#database.prepare('DELETE FROM preference_exposures WHERE scope_key = ?').run(scopeKey);
+        this.#database.prepare(`
+      DELETE FROM preference_transitions
+      WHERE hypothesis_id IN (SELECT id FROM preference_hypotheses WHERE scope_key = ?)
+    `).run(scopeKey);
+        this.#database.prepare('DELETE FROM preference_hypotheses WHERE scope_key = ?').run(scopeKey);
+        this.#database.prepare('DELETE FROM preference_signals WHERE scope_key = ?').run(scopeKey);
+        // Forget boundaries belong to the previous owner lineage. Retaining them
+        // would reject the new owner's exact first Inbox event as "predating" its
+        // own scope reset.
+        this.#database.prepare('DELETE FROM preference_scope_tombstones WHERE scope_digest = ?').run(scopeDigest);
+    }
+    #scopeAdmissionRowInTransaction(scopeKey) {
+        return this.#database.prepare(`
+      SELECT admission_cursor_epoch, lineage_claim_sequence,
+        admission_high_water, admission_high_water_kind,
+        ignore_events_through_sequence, learning_paused, control_version
+      FROM preference_scope_principals WHERE scope_key = ?
+    `).get(scopeKey);
+    }
+    #controlCursorIsFresh(current, admissionCursor) {
+        return current.admission_cursor_epoch === admissionCursor.epoch
+            && admissionCursor.sequence >= (current.lineage_claim_sequence ?? 1)
+            && admissionCursor.sequence > (current.admission_high_water ?? 0);
+    }
+    #readCursorCanObserveCurrent(current, admissionCursor) {
+        return current.admission_cursor_epoch === admissionCursor.epoch
+            && admissionCursor.sequence >= (current.lineage_claim_sequence ?? 1)
+            && admissionCursor.sequence > (current.ignore_events_through_sequence ?? 0);
+    }
+    #admitEventCursorInTransaction(canonical, owner, admissionCursor) {
+        this.#assertScopePrincipalInTransaction(canonical, owner);
+        const current = this.#scopeAdmissionRowInTransaction(canonical.scopeKey);
+        if (current.admission_cursor_epoch !== admissionCursor.epoch
+            || admissionCursor.sequence < (current.lineage_claim_sequence ?? 1)
+            || admissionCursor.sequence < (current.admission_high_water ?? 0)
+            || (admissionCursor.sequence === current.admission_high_water
+                && current.admission_high_water_kind !== 'event'))
+            return false;
+        if (admissionCursor.sequence > (current.admission_high_water ?? 0)) {
+            const changed = this.#database.prepare(`
+        UPDATE preference_scope_principals
+        SET admission_high_water = ?, admission_high_water_kind = 'event', updated_at = ?
+        WHERE scope_key = ? AND principal_digest = ?
+          AND principal_lineage_id = ? AND principal_lineage_version = ?
+          AND generation = ? AND purge_pending = 0
+          AND admission_cursor_epoch = ? AND admission_high_water IS ?
+      `).run(admissionCursor.sequence, this.#now(), canonical.scopeKey, owner.principalDigest, owner.principalLineageId, owner.principalLineageVersion, owner.generation, admissionCursor.epoch, current.admission_high_water);
+            if (changed.changes !== 1) {
+                throw new PreferenceStoreError('conflict', 'preference event admission cursor changed');
+            }
+        }
+        return current.learning_paused === 0
+            && admissionCursor.sequence > (current.ignore_events_through_sequence ?? 0);
+    }
+    #insertOwnerControlReceipt(input) {
+        this.#database.prepare(`
+      INSERT INTO preference_owner_control_receipts(
+        idempotency_key, payload_hash, scope_digest, principal_digest, generation,
+        action, target_preference_key, admission_cursor_epoch, admission_cursor_sequence, result_applied,
+        result_paused, result_control_version, result_admission_high_water,
+        result_ignore_events_through_sequence, result_signals, result_hypotheses,
+        result_active_overlays, result_stored_active_overlays, result_shadow_hypotheses,
+        result_deleted_signals, result_deleted_hypotheses,
+        result_forgotten_through, result_explanation_json, result_rolled_back,
+        result_rolled_back_version, occurred_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(input.idempotencyKey, input.hash, input.canonical.scopeDigest, input.owner.principalDigest, input.owner.generation, input.action, input.preferenceKey ?? null, input.admissionCursor.epoch, input.admissionCursor.sequence, input.applied ? 1 : 0, input.state.mode === 'paused' ? 1 : 0, input.state.controlVersion, input.state.admissionHighWater?.sequence ?? null, input.state.ignoreEventsThrough?.sequence ?? null, input.state.signals, input.state.hypotheses, input.state.activeOverlays, input.state.storedActiveOverlays, input.state.shadowHypotheses, input.deletedSignals ?? 0, input.deletedHypotheses ?? 0, input.forgottenThrough ?? -1, input.explanation === undefined ? null : JSON.stringify(input.explanation), input.rolledBack === true ? 1 : 0, input.rolledBackVersion ?? null, input.occurredAt);
+    }
+    #ownerControlExplanationFromReceipt(receipt) {
+        if (receipt.result_explanation_json === null) {
+            throw new PreferenceStoreError('conflict', 'learning summary receipt is missing its snapshot');
+        }
+        let value;
+        try {
+            value = JSON.parse(receipt.result_explanation_json);
+        }
+        catch {
+            throw new PreferenceStoreError('conflict', 'learning summary receipt snapshot is corrupt');
+        }
+        if (!Array.isArray(value)) {
+            throw new PreferenceStoreError('conflict', 'learning summary receipt snapshot is corrupt');
+        }
+        const explanation = value.map(entry => {
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                throw new PreferenceStoreError('conflict', 'learning summary receipt snapshot is corrupt');
+            }
+            const row = entry;
+            const key = exactT1PreferenceKey(row.key);
+            try {
+                catalogSelection(key, row.value);
+            }
+            catch {
+                throw new PreferenceStoreError('conflict', 'learning summary receipt snapshot is corrupt');
+            }
+            if (!['active', 'inactive', 'rolled-back', 'shadow', 'suppressed'].includes(row.state ?? '')
+                || !Number.isSafeInteger(row.version) || row.version < 1
+                || [row.supportingSignals, row.contradictingSignals, row.evidenceMass]
+                    .some(count => !Number.isSafeInteger(count) || count < 0)) {
+                throw new PreferenceStoreError('conflict', 'learning summary receipt snapshot is corrupt');
+            }
+            return Object.freeze({
+                key,
+                value: row.value,
+                state: row.state,
+                version: row.version,
+                supportingSignals: row.supportingSignals,
+                contradictingSignals: row.contradictingSignals,
+                evidenceMass: row.evidenceMass,
+            });
+        });
+        return Object.freeze(explanation);
+    }
+    #ownerControlStateFromReceipt(receipt) {
+        return Object.freeze({
+            mode: receipt.result_paused === 1 ? 'paused' : 'active',
+            signals: receipt.result_signals,
+            hypotheses: receipt.result_hypotheses,
+            activeOverlays: receipt.result_active_overlays,
+            storedActiveOverlays: receipt.result_stored_active_overlays,
+            shadowHypotheses: receipt.result_shadow_hypotheses,
+            controlVersion: receipt.result_control_version,
+            admissionHighWater: receipt.result_admission_high_water === null
+                ? undefined
+                : Object.freeze({
+                    epoch: receipt.admission_cursor_epoch,
+                    sequence: receipt.result_admission_high_water,
+                }),
+            ignoreEventsThrough: receipt.result_ignore_events_through_sequence === null
+                ? undefined
+                : Object.freeze({
+                    epoch: receipt.admission_cursor_epoch,
+                    sequence: receipt.result_ignore_events_through_sequence,
+                }),
+        });
+    }
+    #assertScopePrincipalInTransaction(canonical, owner) {
+        if (owner === undefined)
+            return;
+        const principalDigest = typeof owner === 'string'
+            ? preferencePrincipalDigest(owner)
+            : owner.principalDigest;
+        const generation = typeof owner === 'string' ? undefined : owner.generation;
+        if (typeof owner !== 'string'
+            && (owner.scopeKey !== canonical.scopeKey
+                || !/^[a-f0-9]{64}$/u.test(owner.principalDigest)
+                || typeof owner.principalLineageId !== 'string'
+                || owner.principalLineageId.length < 1
+                || Buffer.byteLength(owner.principalLineageId) > 500
+                || !Number.isSafeInteger(owner.principalLineageVersion)
+                || owner.principalLineageVersion < 1
+                || !Number.isSafeInteger(owner.generation) || owner.generation < 1)) {
+            throw new PreferenceStoreError('conflict', 'scope principal fence is invalid');
+        }
+        const row = this.#database.prepare(`
+      SELECT generation, principal_lineage_id, principal_lineage_version,
+        admission_cursor_epoch
+      FROM preference_scope_principals
+      WHERE scope_key = ? AND principal_digest = ? AND purge_pending = 0
+    `).get(canonical.scopeKey, principalDigest);
+        if (row === undefined || row.admission_cursor_epoch === null
+            || (generation !== undefined && (row.generation !== generation
+                || row.principal_lineage_id !== owner.principalLineageId
+                || row.principal_lineage_version !== owner.principalLineageVersion))) {
+            throw new PreferenceStoreError('conflict', 'scope principal fence changed');
+        }
+    }
+    #scopeLearningStatusInTransaction(canonical, owner, refresh = true) {
+        this.#assertScopePrincipalInTransaction(canonical, owner);
+        if (refresh)
+            this.#refreshScopeInTransaction(canonical.scopeKey, canonical.scope, this.#now());
+        const control = this.#database.prepare(`
+      SELECT learning_paused, control_version, admission_cursor_epoch,
+        admission_high_water, ignore_events_through_sequence
+      FROM preference_scope_principals WHERE scope_key = ?
+    `).get(canonical.scopeKey);
+        const counts = this.#database.prepare(`
+      SELECT
+        (SELECT COUNT(*) FROM preference_signals WHERE scope_key = ?) AS signals,
+        COUNT(*) AS hypotheses,
+        SUM(CASE WHEN effect_state = 'active' THEN 1 ELSE 0 END) AS active,
+        SUM(CASE WHEN effect_state = 'shadow' THEN 1 ELSE 0 END) AS shadow
+      FROM preference_hypotheses WHERE scope_key = ?
+    `).get(canonical.scopeKey, canonical.scopeKey);
+        return Object.freeze({
+            mode: control.learning_paused === 1 ? 'paused' : 'active',
+            signals: counts.signals,
+            hypotheses: counts.hypotheses,
+            activeOverlays: control.learning_paused === 1 ? 0 : (counts.active ?? 0),
+            storedActiveOverlays: counts.active ?? 0,
+            shadowHypotheses: counts.shadow ?? 0,
+            controlVersion: control.control_version,
+            admissionHighWater: control.admission_high_water === null
+                ? undefined
+                : Object.freeze({
+                    epoch: control.admission_cursor_epoch,
+                    sequence: control.admission_high_water,
+                }),
+            ignoreEventsThrough: control.ignore_events_through_sequence === null
+                ? undefined
+                : Object.freeze({
+                    epoch: control.admission_cursor_epoch,
+                    sequence: control.ignore_events_through_sequence,
+                }),
+        });
+    }
+    #assertScopeLearningActiveInTransaction(canonical) {
+        const row = this.#database.prepare(`
+      SELECT learning_paused FROM preference_scope_principals
+      WHERE scope_key = ? AND purge_pending = 0 AND admission_cursor_epoch IS NOT NULL
+    `).get(canonical.scopeKey);
+        if (row?.learning_paused === 1) {
+            throw new PreferenceStoreError('learning-paused', 'preference learning is paused for this scope');
+        }
+    }
     #assertOpen() {
         if (this.#closed)
             throw new PreferenceStoreError('disabled', 'preference store is closed');