@hraness/oh 0.3.2 → 0.4.1

package/dist/memory.js

@@ -190,7 +190,7 @@ var OH_GRAPH_LIMITS_V1 = Object.freeze({
   recordBytes: 1024 * 1024,
   recordsPerSnapshot: 65536
 });
-var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = [
+var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = Object.freeze([
   "activity",
   "assertion",
   "context",
@@ -209,7 +209,7 @@ var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = [
   "type-membership",
   "view",
   "vocabulary"
-];
+]);
 var KNOWLEDGE_GRAPH_RECORD_KEYS_V1 = [
   "dependencies",
   "key",
@@ -422,6 +422,141 @@ class OhRecordCodecRegistry {
     return this.#sealed;
   }
 }
+// src/errors.ts
+var OH_OPERATION_SIZE_ERROR_CODE_V1 = "oh.operation-size.v1";
+var OH_CONFLICT_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhConflictError/v1");
+var OH_DEPENDENCY_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhDependencyError/v1");
+var OH_INTEGRITY_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhIntegrityError/v1");
+var OH_OPERATION_SIZE_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhOperationSizeError/v1");
+var OH_PROFILE_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhProfileError/v1");
+function immutableOwnValue(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor !== undefined && descriptor.get === undefined && descriptor.set === undefined && descriptor.configurable === false && descriptor.writable === false ? descriptor.value : undefined;
+}
+function brandNativeError(value, brand) {
+  Object.defineProperty(value, brand, {
+    configurable: false,
+    enumerable: false,
+    value: true,
+    writable: false
+  });
+}
+function hasNativeErrorBrand(value, brand) {
+  try {
+    return Error.isError(value) && immutableOwnValue(value, brand) === true;
+  } catch {
+    return false;
+  }
+}
+function hasNativeSubclassInstance(constructor, value) {
+  return Function.prototype[Symbol.hasInstance].call(constructor, value);
+}
+function isOhConflictError(value) {
+  return hasNativeErrorBrand(value, OH_CONFLICT_ERROR_BRAND_V1);
+}
+
+class OhConflictError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhConflictError ? isOhConflictError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhConflictError";
+    brandNativeError(this, OH_CONFLICT_ERROR_BRAND_V1);
+  }
+}
+function isOhIntegrityError(value) {
+  return hasNativeErrorBrand(value, OH_INTEGRITY_ERROR_BRAND_V1);
+}
+
+class OhIntegrityError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhIntegrityError ? isOhIntegrityError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhIntegrityError";
+    brandNativeError(this, OH_INTEGRITY_ERROR_BRAND_V1);
+  }
+}
+function isOhDependencyError(value) {
+  return hasNativeErrorBrand(value, OH_DEPENDENCY_ERROR_BRAND_V1);
+}
+
+class OhDependencyError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhDependencyError ? isOhDependencyError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhDependencyError";
+    brandNativeError(this, OH_DEPENDENCY_ERROR_BRAND_V1);
+  }
+}
+function isOhProfileError(value) {
+  return hasNativeErrorBrand(value, OH_PROFILE_ERROR_BRAND_V1);
+}
+
+class OhProfileError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhProfileError ? isOhProfileError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhProfileError";
+    brandNativeError(this, OH_PROFILE_ERROR_BRAND_V1);
+  }
+}
+function isOhOperationSizeError(value) {
+  try {
+    if (!Error.isError(value) || !(value instanceof RangeError))
+      return false;
+    const operationBytes = immutableOwnValue(value, "operationBytes");
+    const maximumOperationBytes = immutableOwnValue(value, "maximumOperationBytes");
+    return immutableOwnValue(value, OH_OPERATION_SIZE_ERROR_BRAND_V1) === true && immutableOwnValue(value, "code") === OH_OPERATION_SIZE_ERROR_CODE_V1 && Number.isSafeInteger(operationBytes) && operationBytes > 0 && Number.isSafeInteger(maximumOperationBytes) && maximumOperationBytes > 0 && operationBytes > maximumOperationBytes;
+  } catch {
+    return false;
+  }
+}
+
+class OhOperationSizeError extends RangeError {
+  static [Symbol.hasInstance](value) {
+    return this === OhOperationSizeError ? isOhOperationSizeError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(operationBytes, maximumOperationBytes) {
+    if (!Number.isSafeInteger(operationBytes) || operationBytes < 1 || !Number.isSafeInteger(maximumOperationBytes) || maximumOperationBytes < 1 || operationBytes <= maximumOperationBytes) {
+      throw new TypeError("Invalid Oh operation size refusal.");
+    }
+    super(`The ${operationBytes}-byte operation exceeds the host-declared ${maximumOperationBytes}-byte canonical bound.`);
+    this.name = "OhOperationSizeError";
+    Object.defineProperties(this, {
+      [OH_OPERATION_SIZE_ERROR_BRAND_V1]: {
+        configurable: false,
+        enumerable: false,
+        value: true,
+        writable: false
+      },
+      code: {
+        configurable: false,
+        enumerable: true,
+        value: OH_OPERATION_SIZE_ERROR_CODE_V1,
+        writable: false
+      },
+      maximumOperationBytes: {
+        configurable: false,
+        enumerable: true,
+        value: maximumOperationBytes,
+        writable: false
+      },
+      operationBytes: {
+        configurable: false,
+        enumerable: true,
+        value: operationBytes,
+        writable: false
+      }
+    });
+  }
+}
 // src/operation.ts
 var OH_OPERATION_MAX_BYTES_V1 = 64 * 1024 * 1024;
 function parsePayload(value) {
@@ -469,13 +604,18 @@ function parsePayload(value) {
     v: 1
   } : null;
 }
-function createOhOperationV1(input) {
+function createOhOperationV1(input, options = {}) {
+  const maximumOperationBytes = options.maximumOperationBytes ?? OH_OPERATION_MAX_BYTES_V1;
+  if (!Number.isSafeInteger(maximumOperationBytes) || maximumOperationBytes < 1 || maximumOperationBytes > OH_OPERATION_MAX_BYTES_V1) {
+    throw new TypeError("Invalid Oh operation byte bound.");
+  }
   const payload = parsePayload(input);
   if (payload === null)
     throw new TypeError("Invalid Oh operation payload.");
   const operation = { ...payload, operationSha256: canonicalSha256(payload) };
-  if (Buffer.byteLength(canonicalJson(operation), "utf8") > OH_OPERATION_MAX_BYTES_V1) {
-    throw new RangeError("Oh operation exceeds its canonical byte limit.");
+  const operationBytes = Buffer.byteLength(canonicalJson(operation), "utf8");
+  if (operationBytes > maximumOperationBytes) {
+    throw new OhOperationSizeError(operationBytes, maximumOperationBytes);
   }
   return operation;
 }
@@ -489,33 +629,6 @@ function parseOhOperationV1(value) {
 }
 
 // src/store.ts
-class OhConflictError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhConflictError";
-  }
-}
-
-class OhIntegrityError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhIntegrityError";
-  }
-}
-
-class OhDependencyError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhDependencyError";
-  }
-}
-
-class OhProfileError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhProfileError";
-  }
-}
 var OH_CANONICAL_STORE_PROFILE_V1 = createOhStoreProfileV1({
   applicationProfileSha256: null,
   capabilities: {
@@ -828,6 +941,8 @@ function transitionOhSnapshotV1(input) {
     sequence: head.sequence + 1,
     spaceId,
     v: 1
+  }, input.maximumOperationBytes === undefined ? {} : {
+    maximumOperationBytes: input.maximumOperationBytes
   });
   const nextHead = {
     generation: operation.sequence,
@@ -1057,6 +1172,7 @@ class OhSemanticBundleIngressV1 {
 
 // src/memory.ts
 import { createHmac, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+import { isProxy } from "node:util/types";
 
 // src/memory-pages.ts
 var OH_MEMORY_PAGE_FORMAT_V1 = "oh.memory-page.v1";
@@ -2706,6 +2822,9 @@ function isOhProjectionRecordKindV1(value) {
 var OH_MEMORY_FORMAT_VERSION_V1 = 1;
 var OH_MEMORY_CONFLICT_POLICY_V1 = "visible-conflicts.v1";
 var OH_MEMORY_LIMITS_V1 = Object.freeze({
+  detachedCanonicalBreadth: 65536,
+  detachedCanonicalDepth: 128,
+  detachedCanonicalNodes: 1048576,
   explainCapabilityEntryBytes: 32 * 1024 * 1024,
   explainCapabilities: 256,
   explainCapabilityLifetimeMs: 15 * 60 * 1000,
@@ -2745,6 +2864,40 @@ var OH_MEMORY_QUERY_LIMITS_V2 = Object.freeze({
   minimumPageBytes: 64 * 1024,
   requestBytes: 80 * 1024
 });
+
+class OhMemoryContinuationError extends OhIntegrityError {
+  constructor(reason, message) {
+    super(message);
+    this.name = "OhMemoryContinuationError";
+    Object.defineProperties(this, {
+      code: { configurable: false, enumerable: true, value: "memory-continuation", writable: false },
+      reason: { configurable: false, enumerable: true, value: reason, writable: false }
+    });
+  }
+}
+var OH_MEMORY_AUTHORITY_LIMITS_V1 = Object.freeze({
+  adoptionReplacements: 128,
+  adoptionRequestBytes: OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes + 192 * 1024,
+  canonicalAdvanceOperations: 16384,
+  canonicalAdvancePages: 64,
+  canonicalChangeFeedPage: 1000,
+  canonicalChangeFeedPageBytes: 64 * 1024 * 1024,
+  retainedExplanationRoutes: OH_MEMORY_LIMITS_V1.explainCapabilities,
+  reportedAdoptionConflicts: 128
+});
+
+class OhMemoryAdoptionConflictError extends OhConflictError {
+  constructor(conflict) {
+    super("The nominated records conflict with the current canonical memory head.");
+    this.name = "OhMemoryAdoptionConflictError";
+    Object.defineProperty(this, "conflict", {
+      configurable: false,
+      enumerable: true,
+      value: immutableClone(conflict),
+      writable: false
+    });
+  }
+}
 var builtInFactPolicy = Object.freeze({
   extractorSha256: OH_MEMORY_COMPOSITE_FACT_EXTRACTOR_V1.extractorSha256,
   factPackId: OH_MEMORY_COMPOSITE_FACT_EXTRACTOR_V1.factPackId,
@@ -2771,6 +2924,149 @@ function immutableClone(value) {
   }
   return value;
 }
+function canonicalStringByteLength(value, label, path, maximumBytes) {
+  let bytes = 2;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) {
+        throw new TypeError(`${label} contains invalid Unicode at ${path}.`);
+      }
+      bytes += 4;
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new TypeError(`${label} contains invalid Unicode at ${path}.`);
+    } else if (code === 34 || code === 92 || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) {
+      bytes += 2;
+    } else if (code <= 31) {
+      bytes += 6;
+    } else if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else {
+      bytes += 3;
+    }
+    if (bytes > maximumBytes) {
+      throw new RangeError(`${label} exceeds its canonical byte bound.`);
+    }
+  }
+  return bytes;
+}
+function detachCanonicalData(value, label, maximumBytes) {
+  const ancestors = new Set;
+  let bytes = 0;
+  let nodes = 0;
+  const spendBytes = (count) => {
+    bytes += count;
+    if (bytes > maximumBytes)
+      throw new RangeError(`${label} exceeds its canonical byte bound.`);
+  };
+  const detach = (candidate, path, depth) => {
+    if (depth > OH_MEMORY_LIMITS_V1.detachedCanonicalDepth) {
+      throw new RangeError(`${label} exceeds its canonical nesting depth bound.`);
+    }
+    nodes += 1;
+    if (nodes > OH_MEMORY_LIMITS_V1.detachedCanonicalNodes) {
+      throw new RangeError(`${label} exceeds its canonical node bound.`);
+    }
+    if (candidate === null) {
+      spendBytes(4);
+      return candidate;
+    }
+    if (typeof candidate === "boolean") {
+      spendBytes(candidate ? 4 : 5);
+      return candidate;
+    }
+    if (typeof candidate === "string") {
+      spendBytes(canonicalStringByteLength(candidate, label, path, maximumBytes - bytes));
+      return candidate;
+    }
+    if (typeof candidate === "number") {
+      if (!Number.isFinite(candidate) || Object.is(candidate, -0)) {
+        throw new TypeError(`${label} contains a noncanonical number at ${path}.`);
+      }
+      spendBytes(utf8ByteLength(canonicalJson(candidate)));
+      return candidate;
+    }
+    if (typeof candidate !== "object") {
+      throw new TypeError(`${label} contains a non-JSON value at ${path}.`);
+    }
+    if (isProxy(candidate))
+      throw new TypeError(`${label} contains a proxy at ${path}.`);
+    if (ancestors.has(candidate))
+      throw new TypeError(`${label} contains a cycle at ${path}.`);
+    ancestors.add(candidate);
+    try {
+      if (Array.isArray(candidate)) {
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(candidate, "length");
+        const length = lengthDescriptor?.value;
+        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0) {
+          throw new TypeError(`${label} contains an invalid array at ${path}.`);
+        }
+        if (length > OH_MEMORY_LIMITS_V1.detachedCanonicalBreadth) {
+          throw new RangeError(`${label} exceeds its canonical breadth bound.`);
+        }
+        if (length > OH_MEMORY_LIMITS_V1.detachedCanonicalNodes - nodes) {
+          throw new RangeError(`${label} exceeds its canonical node bound.`);
+        }
+        spendBytes(2 + Math.max(0, length - 1));
+        const keys2 = Reflect.ownKeys(candidate);
+        if (keys2.length !== length + 1 || !keys2.includes("length") || keys2.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length))) {
+          throw new TypeError(`${label} contains a non-data array at ${path}.`);
+        }
+        const detached3 = [];
+        for (let index = 0;index < length; index += 1) {
+          const descriptor = Object.getOwnPropertyDescriptor(candidate, String(index));
+          if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+            throw new TypeError(`${label} contains a non-data array entry at ${path}[${index}].`);
+          }
+          detached3.push(detach(descriptor.value, `${path}[${index}]`, depth + 1));
+        }
+        return Object.freeze(detached3);
+      }
+      const prototype = Object.getPrototypeOf(candidate);
+      if (prototype !== Object.prototype && prototype !== null) {
+        throw new TypeError(`${label} contains a non-plain object at ${path}.`);
+      }
+      const keys = Reflect.ownKeys(candidate);
+      if (keys.some((key) => typeof key !== "string")) {
+        throw new TypeError(`${label} contains a symbol property at ${path}.`);
+      }
+      if (keys.length > OH_MEMORY_LIMITS_V1.detachedCanonicalBreadth) {
+        throw new RangeError(`${label} exceeds its canonical breadth bound.`);
+      }
+      if (keys.length > OH_MEMORY_LIMITS_V1.detachedCanonicalNodes - nodes) {
+        throw new RangeError(`${label} exceeds its canonical node bound.`);
+      }
+      spendBytes(2 + Math.max(0, keys.length - 1));
+      const detached2 = {};
+      for (const key of keys) {
+        spendBytes(canonicalStringByteLength(key, label, `${path}.<key>`, maximumBytes - bytes - 1) + 1);
+        const descriptor = Object.getOwnPropertyDescriptor(candidate, key);
+        if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+          throw new TypeError(`${label} contains a non-data property at ${path}.${key}.`);
+        }
+        Object.defineProperty(detached2, key, {
+          configurable: false,
+          enumerable: true,
+          value: detach(descriptor.value, `${path}.${key}`, depth + 1),
+          writable: false
+        });
+      }
+      return Object.freeze(detached2);
+    } finally {
+      ancestors.delete(candidate);
+    }
+  };
+  const detached = detach(value, "$root", 0);
+  const canonical = canonicalJson(detached);
+  if (utf8ByteLength(canonical) !== bytes) {
+    throw new OhIntegrityError(`${label} canonical byte accounting did not reproduce its snapshot.`);
+  }
+  return Object.freeze({ canonical, value: detached });
+}
 function compareText(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -2804,8 +3100,43 @@ function laneIdentity(value) {
     v: 1
   });
 }
-function datasetForSnapshot(binding, snapshot) {
-  const projectionSnapshot = createOhProjectionSnapshotV1({
+function parseDetachedStoreHead(value, label) {
+  const head = parseOhHeadV1(detachCanonicalData(value, `${label} head`, 4 * 1024).value);
+  if (head === null)
+    throw new OhIntegrityError(`${label} returned an invalid head.`);
+  return immutableClone(head);
+}
+function parseDetachedStoreSnapshot(value, label, expectedHead, spaceId) {
+  const detachedSnapshot = detachCanonicalData(value, `${label} snapshot`, OH_MEMORY_LIMITS_V1.snapshotBytesPerLane);
+  if (!isPlainRecord(detachedSnapshot.value) || !hasExactKeys(detachedSnapshot.value, ["head", "records", "v"]) || detachedSnapshot.value.v !== 1 || !Array.isArray(detachedSnapshot.value.records)) {
+    throw new OhIntegrityError(`${label} returned an invalid snapshot envelope.`);
+  }
+  const detached = detachedSnapshot.value;
+  const detachedHead = parseOhHeadV1(detached.head);
+  if (detachedHead === null)
+    throw new OhIntegrityError(`${label} returned an invalid snapshot head.`);
+  const snapshot = immutableClone({
+    head: detachedHead,
+    records: detached.records,
+    v: 1
+  });
+  if (!exactHead(snapshot.head, expectedHead)) {
+    throw new OhIntegrityError(`${label} snapshot differs from its pinned head.`);
+  }
+  let projectionSnapshot;
+  try {
+    projectionSnapshot = createOhProjectionSnapshotV1({
+      head: snapshot.head,
+      records: snapshot.records,
+      spaceId
+    });
+  } catch {
+    throw new OhIntegrityError(`${label} returned invalid snapshot records.`);
+  }
+  return Object.freeze({ projectionSnapshot, snapshot });
+}
+function datasetForSnapshot(binding, snapshot, validatedProjectionSnapshot) {
+  const projectionSnapshot = validatedProjectionSnapshot ?? createOhProjectionSnapshotV1({
     head: snapshot.head,
     records: snapshot.records,
     spaceId: binding.spaceId
@@ -2820,40 +3151,21 @@ function datasetForSnapshot(binding, snapshot) {
   return { dataset, projectionSnapshot };
 }
 async function readLane(authority, lane, expectedHead) {
-  const returnedHead = expectedHead ?? await authority.store.head();
-  const head = parseOhHeadV1(immutableClone(returnedHead));
-  if (head === null)
-    throw new OhIntegrityError(`The ${lane} store returned an invalid head.`);
+  const label = `The ${lane} store`;
+  const head = expectedHead === undefined ? parseDetachedStoreHead(await authority.store.head(), label) : immutableClone(expectedHead);
   const returnedSnapshot = await authority.store.snapshot({
     head: { operationSha256: head.operationSha256, sequence: head.sequence },
     maximumRecords: OH_MEMORY_LIMITS_V1.maximumRecordsPerLane
   });
-  if (!isPlainRecord(returnedSnapshot) || !hasExactKeys(returnedSnapshot, ["head", "records", "v"]) || returnedSnapshot.v !== 1 || !Array.isArray(returnedSnapshot.records)) {
-    throw new OhIntegrityError(`The ${lane} store returned an invalid snapshot envelope.`);
-  }
-  const detached = immutableClone(returnedSnapshot);
-  const detachedHead = parseOhHeadV1(detached.head);
-  if (detachedHead === null)
-    throw new OhIntegrityError(`The ${lane} store returned an invalid snapshot head.`);
-  const snapshot = immutableClone({
-    head: detachedHead,
-    records: detached.records,
-    v: 1
-  });
-  if (!exactHead(snapshot.head, head)) {
-    throw new OhIntegrityError(`The ${lane} snapshot differs from its pinned head.`);
-  }
-  if (utf8ByteLength(canonicalJson(snapshot)) > OH_MEMORY_LIMITS_V1.snapshotBytesPerLane) {
-    throw new RangeError(`The ${lane} memory snapshot exceeds its canonical byte bound.`);
-  }
-  const projected = datasetForSnapshot(authority.binding, snapshot);
+  const parsed = parseDetachedStoreSnapshot(returnedSnapshot, label, head, authority.binding.spaceId);
+  const projected = datasetForSnapshot(authority.binding, parsed.snapshot, parsed.projectionSnapshot);
   return Object.freeze({
     authorityId: authority.authorityId,
     binding: authority.binding,
     dataset: projected.dataset,
     lane,
     projectionSnapshot: projected.projectionSnapshot,
-    snapshot
+    snapshot: parsed.snapshot
   });
 }
 function syntheticKey(lane, recordSha256) {
@@ -3167,32 +3479,93 @@ function resolveNominationRoutes(routes) {
   return resolved;
 }
 function parseQueryRequest(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, ["programId", "v"]) || value.v !== 1)
+  const detached = detachCanonicalData(value, "The named memory query", OH_MEMORY_QUERY_LIMITS_V2.requestBytes).value;
+  if (!isPlainRecord(detached) || !hasExactKeys(detached, ["programId", "v"]) || detached.v !== 1)
     throw new TypeError("Invalid named memory query.");
-  const programId = safeCode(value.programId, 128);
+  const programId = safeCode(detached.programId, 128);
   if (programId === null)
     throw new TypeError("Invalid named memory query identity.");
   return { programId };
 }
 function parseExplainRequest(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, ["resultSha256", "row", "token", "v"]) || value.v !== 1 || typeof value.token !== "string" || value.token.length !== 43 || !Number.isSafeInteger(value.row) || value.row < 0) {
+  const detached = detachCanonicalData(value, "The memory explanation request", OH_MEMORY_QUERY_LIMITS_V2.requestBytes).value;
+  if (!isPlainRecord(detached) || !hasExactKeys(detached, ["resultSha256", "row", "token", "v"]) || detached.v !== 1 || typeof detached.token !== "string" || detached.token.length !== 43 || !Number.isSafeInteger(detached.row) || detached.row < 0) {
     throw new TypeError("Invalid memory explanation request.");
   }
-  const resultSha256 = parseSha256Hex(value.resultSha256);
+  const resultSha256 = parseSha256Hex(detached.resultSha256);
   if (resultSha256 === null)
     throw new TypeError("Invalid memory explanation result identity.");
-  return { resultSha256, row: value.row, token: value.token };
+  return { resultSha256, row: detached.row, token: detached.token };
 }
 function parseNominationRequest(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, ["nominationId", "roots", "v"]) || value.v !== 1 || !Array.isArray(value.roots) || value.roots.length < 1 || value.roots.length > OH_DEPENDENCY_CLOSURE_LIMITS_V1.roots) {
+  const detached = detachCanonicalData(value, "The memory nomination request", OH_MEMORY_QUERY_LIMITS_V2.requestBytes * 8).value;
+  if (!isPlainRecord(detached) || !hasExactKeys(detached, ["nominationId", "roots", "v"]) || detached.v !== 1 || !Array.isArray(detached.roots) || detached.roots.length < 1 || detached.roots.length > OH_DEPENDENCY_CLOSURE_LIMITS_V1.roots) {
     throw new TypeError("Invalid memory nomination request.");
   }
-  const nominationId = safeCode(value.nominationId, 128);
-  const roots = value.roots.map((root) => safeCode(root, 512)).sort();
+  const nominationId = safeCode(detached.nominationId, 128);
+  const roots = detached.roots.map((root) => safeCode(root, 512)).sort();
   if (nominationId === null || roots.some((root) => root === null) || new Set(roots).size !== roots.length)
     throw new TypeError("Invalid memory nomination identity.");
   return { nominationId, roots };
 }
+function parseDetachedMemoryNominationV1(value) {
+  try {
+    const keys = ownDataKeysV2(value, 7, "The memory nomination");
+    if (keys.length !== 7 || ![
+      "closure",
+      "destinationPurpose",
+      "nominationId",
+      "nominationSha256",
+      "source",
+      "status",
+      "v"
+    ].every((key) => keys.includes(key)))
+      return null;
+    const record = value;
+    if (record.status !== "prepared" || record.v !== 1)
+      return null;
+    const closure = parseOhDependencyClosureV1(record.closure);
+    const destinationPurpose = safeCode(record.destinationPurpose, 256);
+    const nominationId = safeCode(record.nominationId, 128);
+    const nominationSha256 = parseSha256Hex(record.nominationSha256);
+    if (closure === null || destinationPurpose === null || nominationId === null || nominationSha256 === null || closure.binding.profile.profileKind !== "working" || [...ownDataKeysV2(record.source, 5, "The memory nomination source")].sort().join("\x00") !== ["authorityId", "bindingSha256", "head", "lane", "v"].sort().join("\x00"))
+      return null;
+    const sourceRecord = record.source;
+    if (sourceRecord.lane !== "working" || sourceRecord.v !== 1)
+      return null;
+    const authorityIdValue = safeCode(sourceRecord.authorityId, 128);
+    const bindingSha256 = parseSha256Hex(sourceRecord.bindingSha256);
+    const head = parseOhHeadV1(sourceRecord.head);
+    if (authorityIdValue === null || bindingSha256 === null || head === null || bindingSha256 !== closure.binding.bindingSha256 || !exactHead(head, closure.head))
+      return null;
+    const source = {
+      authorityId: authorityIdValue,
+      bindingSha256,
+      head,
+      lane: "working",
+      v: 1
+    };
+    const payload = {
+      closure,
+      destinationPurpose,
+      nominationId,
+      source,
+      status: "prepared",
+      v: 1
+    };
+    return canonicalSha256(payload) === nominationSha256 ? immutableClone({ ...payload, nominationSha256 }) : null;
+  } catch {
+    return null;
+  }
+}
+function parseOhMemoryNominationV1(value) {
+  try {
+    const detached = detachCanonicalData(value, "The memory nomination", OH_MEMORY_AUTHORITY_LIMITS_V1.adoptionRequestBytes);
+    return parseDetachedMemoryNominationV1(detached.value);
+  } catch {
+    return null;
+  }
+}
 function isoInstant(date) {
   const value = date.toISOString();
   if (parseCanonicalInstantV1(value) === null)
@@ -3226,13 +3599,11 @@ async function createOhMemoryAgentV1(options) {
   }
   const canonicalBinding = bindingFor(canonicalStore, options.canonical.expectedBindingSha256, "canonical");
   const workingBinding = bindingFor(workingStore, options.working.expectedBindingSha256, "working");
-  const expectedCanonicalHead = parseOhHeadV1(options.canonical.expectedHead);
-  if (expectedCanonicalHead === null)
-    throw new TypeError("Invalid pinned canonical memory head.");
+  const expectedCanonicalHead = parseMemoryAuthorityHead(options.canonical.expectedHead, "pinned canonical");
   const programs = resolvePrograms(options.programs);
   const extractors = resolveExtractors(options.extractors ?? []);
   const nominationRoutes = resolveNominationRoutes(options.nominationRoutes ?? []);
-  const ingress = new OhSemanticBundleIngressV1(workingStore, workingCodecs);
+  const ingress = new OhSemanticBundleIngressV1(capacityGuardedWorkingStore(workingStore, workingBinding), workingCodecs);
   const now = options.now ?? (() => new Date);
   const monotonicNow = options.monotonicNow ?? (() => performance.now());
   const capabilityLifetime = options.explainCapabilityLifetimeMs ?? OH_MEMORY_LIMITS_V1.explainCapabilityLifetimeMs;
@@ -3268,13 +3639,11 @@ async function createOhMemoryAgentV1(options) {
       explanationBytes -= stored.bytes;
   };
   const remember = async (value) => {
-    if (utf8ByteLength(canonicalJson(value)) > OH_MEMORY_LIMITS_V1.rememberBytes) {
-      throw new RangeError("The memory semantic bundle exceeds its canonical byte bound.");
-    }
-    if (!isPlainRecord(value) || !hasExactKeys(value, ["expectedHead", "puts", "requestId", "tombstones", "v"]) || value.v !== 1) {
+    const detached = detachCanonicalData(value, "The memory semantic bundle", OH_MEMORY_LIMITS_V1.rememberBytes).value;
+    if (!isPlainRecord(detached) || !hasExactKeys(detached, ["expectedHead", "puts", "requestId", "tombstones", "v"]) || detached.v !== 1) {
       throw new TypeError("Invalid memory remember request.");
     }
-    const requestId = safeCode(value.requestId, 128);
+    const requestId = safeCode(detached.requestId, 128);
     if (requestId === null)
       throw new TypeError("Invalid memory remember request identity.");
     const operationId = `memory_${canonicalSha256({
@@ -3283,15 +3652,19 @@ async function createOhMemoryAgentV1(options) {
       requestId,
       v: 1
     }).slice(0, 48)}`;
-    const operation = await ingress.commit({
+    const returnedOperation = await ingress.commit({
       actorId: memoryActorId,
-      expectedHead: value.expectedHead,
+      expectedHead: detached.expectedHead,
       instant: isoInstant(new Date(wallClock())),
       operationId,
-      puts: value.puts,
-      tombstones: value.tombstones,
+      puts: detached.puts,
+      tombstones: detached.tombstones,
       v: 1
     });
+    const operation = parseOhOperationV1(detachCanonicalData(returnedOperation, "The returned working memory operation", OH_MEMORY_LIMITS_V1.rememberBytes * 2).value);
+    if (operation === null || operation.actorId !== memoryActorId || operation.operationId !== operationId || operation.spaceId !== workingBinding.spaceId) {
+      throw new OhIntegrityError("The working authority returned a different memory operation.");
+    }
     const head = {
       generation: operation.sequence,
       graphRevisionSha256: operation.graphRevisionSha256,
@@ -3428,13 +3801,14 @@ async function createOhMemoryAgentV1(options) {
     const route = nominationRoutes.get(request.nominationId);
     if (route === undefined)
       throw new TypeError("Unknown named memory nomination route.");
-    const head = parseOhHeadV1(immutableClone(await workingStore.head()));
+    const head = parseOhHeadV1(detachCanonicalData(await workingStore.head(), "The working nomination store head", 4 * 1024).value);
     if (head === null)
       throw new OhIntegrityError("The working nomination store returned an invalid head.");
-    const closure = await workingStore.exportDependencyClosure({ head: {
+    const returnedClosure = await workingStore.exportDependencyClosure({ head: {
       operationSha256: head.operationSha256,
       sequence: head.sequence
     }, roots: request.roots });
+    const closure = detachCanonicalData(returnedClosure, "The working nomination closure", OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes).value;
     const verified = verifyOhDependencyClosureAgainstV1(closure, { binding: workingBinding, head });
     if (!verified.ok)
       throw new OhIntegrityError("The working nomination closure failed exact verification.");
@@ -3460,6 +3834,21 @@ async function createOhMemoryAgentV1(options) {
   };
   return Object.freeze({ explain, nominate, query, remember });
 }
+function createOhMemoryRuntimeV2(options) {
+  const capabilityLifetime = options.explainCapabilityLifetimeMs ?? OH_MEMORY_LIMITS_V1.explainCapabilityLifetimeMs;
+  if (!Number.isSafeInteger(capabilityLifetime) || capabilityLifetime < 1000 || capabilityLifetime > 60 * 60 * 1000) {
+    throw new RangeError("Invalid memory explanation capability lifetime.");
+  }
+  return {
+    capabilityLifetime,
+    explanationBytes: 0,
+    explanations: new Map,
+    lastMonotonicMs: -1,
+    lastWallClockMs: Number.NEGATIVE_INFINITY,
+    monotonicNow: options.monotonicNow ?? (() => performance.now()),
+    now: options.now ?? (() => new Date)
+  };
+}
 function ownDataKeysV2(value, maximum, label) {
   if (!isPlainRecord(value))
     throw new TypeError(`${label} must be a plain data object.`);
@@ -3599,25 +3988,48 @@ function parsePrimitiveBindingV2(value) {
   return value;
 }
 function parseQueryRequestV2(value) {
+  let detached;
+  let detachedCanonical = "";
   let keys;
   try {
-    keys = ownDataKeysV2(value, 4, "The parameterized memory query");
-  } catch {
+    const detachedData = detachCanonicalData(value, "The parameterized memory query", OH_MEMORY_QUERY_LIMITS_V2.requestBytes);
+    detached = detachedData.value;
+    detachedCanonical = detachedData.canonical;
+  } catch (error) {
+    if (error instanceof RangeError)
+      throw error;
+    if (error instanceof Error && error.message.includes("$root.bindings")) {
+      throw new TypeError("Memory bindings must be JSON primitives.");
+    }
+    throw new TypeError("Invalid parameterized memory query.");
+  }
+  try {
+    keys = ownDataKeysV2(detached, 4, "The parameterized memory query");
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("$root.bindings")) {
+      throw new TypeError("Memory bindings must be JSON primitives.");
+    }
     throw new TypeError("Invalid parameterized memory query.");
   }
   if (keys.length !== 4 || !["bindings", "continuation", "programId", "v"].every((key) => keys.includes(key))) {
     throw new TypeError("Invalid parameterized memory query.");
   }
-  const record = value;
-  if (record.v !== 2 || record.continuation !== null && typeof record.continuation !== "string") {
+  if (utf8ByteLength(detachedCanonical) > OH_MEMORY_QUERY_LIMITS_V2.requestBytes) {
+    throw new RangeError("The parameterized memory query exceeds its canonical byte bound.");
+  }
+  const record = detached;
+  if (record.v !== 2) {
     throw new TypeError("Invalid parameterized memory query.");
   }
+  if (record.continuation !== null && typeof record.continuation !== "string") {
+    throw new OhMemoryContinuationError("encoding", "Invalid memory continuation encoding.");
+  }
   const programId = safeCode(record.programId, 128);
   if (programId === null)
     throw new TypeError("Invalid parameterized memory query identity.");
   const continuation = record.continuation;
   if (typeof continuation === "string" && (continuation.length < 1 || continuation.length > OH_MEMORY_QUERY_LIMITS_V2.continuationBytes || utf8ByteLength(continuation) > OH_MEMORY_QUERY_LIMITS_V2.continuationBytes)) {
-    throw new RangeError("The memory continuation exceeds its byte bound.");
+    throw new OhMemoryContinuationError("encoding", "The memory continuation exceeds its byte bound.");
   }
   const bindingKeys = ownDataKeysV2(record.bindings, OH_MEMORY_QUERY_LIMITS_V2.bindings, "The parameterized memory query bindings");
   const bindingRecord = record.bindings;
@@ -3696,18 +4108,19 @@ function encodeContinuationV2(value, key) {
   return Object.freeze({ continuation, continuationSha256 });
 }
 function parseContinuationV2(value, key) {
-  if (value.length < 1 || utf8ByteLength(value) > OH_MEMORY_QUERY_LIMITS_V2.continuationBytes || !/^[A-Za-z0-9_-]+$/u.test(value))
-    throw new TypeError("Invalid memory continuation encoding.");
+  if (value.length < 1 || utf8ByteLength(value) > OH_MEMORY_QUERY_LIMITS_V2.continuationBytes || !/^[A-Za-z0-9_-]+$/u.test(value)) {
+    throw new OhMemoryContinuationError("encoding", "Invalid memory continuation encoding.");
+  }
   const bytes = Buffer.from(value, "base64url");
   if (bytes.toString("base64url") !== value || bytes.byteLength > OH_MEMORY_QUERY_LIMITS_V2.continuationBytes) {
-    throw new TypeError("Invalid memory continuation encoding.");
+    throw new OhMemoryContinuationError("encoding", "Invalid memory continuation encoding.");
   }
   const text = bytes.toString("utf8");
   let decoded;
   try {
     decoded = JSON.parse(text);
   } catch {
-    throw new TypeError("Invalid memory continuation JSON.");
+    throw new OhMemoryContinuationError("encoding", "Invalid memory continuation JSON.");
   }
   if (!isPlainRecord(decoded) || !hasExactKeys(decoded, [
     "bindingsSha256",
@@ -3720,8 +4133,9 @@ function parseContinuationV2(value, key) {
     "projectionResultSha256",
     "totalRows",
     "v"
-  ]) || decoded.v !== 2)
-    throw new TypeError("Invalid memory continuation payload.");
+  ]) || decoded.v !== 2) {
+    throw new OhMemoryContinuationError("encoding", "Invalid memory continuation payload.");
+  }
   const bindingsSha256 = parseSha256Hex(decoded.bindingsSha256);
   const continuationHmacSha256 = parseSha256Hex(decoded.continuationHmacSha256);
   const continuationSha256 = parseSha256Hex(decoded.continuationSha256);
@@ -3729,7 +4143,7 @@ function parseContinuationV2(value, key) {
   const programSha256 = parseSha256Hex(decoded.programSha256);
   const projectionResultSha256 = parseSha256Hex(decoded.projectionResultSha256);
   if (bindingsSha256 === null || continuationHmacSha256 === null || continuationSha256 === null || memorySha256 === null || programSha256 === null || projectionResultSha256 === null || !Number.isSafeInteger(decoded.nextOffset) || decoded.nextOffset < 1 || decoded.nextOffset > OH_MEMORY_QUERY_LIMITS_V2.maximumProgramRows || !Number.isSafeInteger(decoded.pageSize) || decoded.pageSize < 1 || decoded.pageSize > OH_MEMORY_QUERY_LIMITS_V2.maximumPageRows || !Number.isSafeInteger(decoded.totalRows) || decoded.totalRows < 1 || decoded.totalRows > OH_MEMORY_QUERY_LIMITS_V2.maximumProgramRows || decoded.nextOffset >= decoded.totalRows || decoded.nextOffset % decoded.pageSize !== 0) {
-    throw new TypeError("Invalid memory continuation identity.");
+    throw new OhMemoryContinuationError("identity", "Invalid memory continuation identity.");
   }
   const identity = {
     bindingsSha256,
@@ -3743,28 +4157,30 @@ function parseContinuationV2(value, key) {
   };
   const signed = { ...identity, continuationSha256 };
   const envelope = { ...signed, continuationHmacSha256 };
-  if (canonicalJson(envelope) !== text)
-    throw new TypeError("Invalid memory continuation payload.");
+  if (canonicalJson(envelope) !== text) {
+    throw new OhMemoryContinuationError("encoding", "Invalid memory continuation payload.");
+  }
   const expectedHmac = continuationHmacV2(key, signed);
   const receivedHmac = Buffer.from(continuationHmacSha256, "hex");
   if (!timingSafeEqual(expectedHmac, receivedHmac)) {
-    throw new OhIntegrityError("The memory continuation is not an issued capability.");
+    throw new OhMemoryContinuationError("authentication", "The memory continuation is not an issued capability.");
   }
   if (canonicalSha256(identity) !== continuationSha256) {
-    throw new OhIntegrityError("The memory continuation digest is invalid.");
+    throw new OhMemoryContinuationError("identity", "The memory continuation digest is invalid.");
   }
   return Object.freeze(signed);
 }
 function parseExplainRequestV2(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, ["pageRow", "resultSha256", "token", "v"]) || value.v !== 2 || typeof value.token !== "string" || value.token.length !== 43 || !Number.isSafeInteger(value.pageRow) || value.pageRow < 0) {
+  const detached = detachCanonicalData(value, "The V2 memory explanation request", OH_MEMORY_QUERY_LIMITS_V2.requestBytes).value;
+  if (!isPlainRecord(detached) || !hasExactKeys(detached, ["pageRow", "resultSha256", "token", "v"]) || detached.v !== 2 || typeof detached.token !== "string" || detached.token.length !== 43 || !Number.isSafeInteger(detached.pageRow) || detached.pageRow < 0) {
     throw new TypeError("Invalid V2 memory explanation request.");
   }
-  const resultSha256 = parseSha256Hex(value.resultSha256);
+  const resultSha256 = parseSha256Hex(detached.resultSha256);
   if (resultSha256 === null)
     throw new TypeError("Invalid V2 memory explanation result identity.");
-  return { pageRow: value.pageRow, resultSha256, token: value.token };
+  return { pageRow: detached.pageRow, resultSha256, token: detached.token };
 }
-async function createOhMemoryAgentV2(options) {
+async function createOhMemoryAgentV2WithRuntime(options, sharedRuntime) {
   const memoryActorId = safeCode(options.actorId, 128);
   if (memoryActorId === null)
     throw new TypeError("Invalid host-bound memory actor ID.");
@@ -3779,55 +4195,45 @@ async function createOhMemoryAgentV2(options) {
   }
   const canonicalBinding = bindingFor(canonicalStore, options.canonical.expectedBindingSha256, "canonical");
   const workingBinding = bindingFor(workingStore, options.working.expectedBindingSha256, "working");
-  const expectedCanonicalHead = parseOhHeadV1(options.canonical.expectedHead);
-  if (expectedCanonicalHead === null)
-    throw new TypeError("Invalid pinned canonical memory head.");
+  const expectedCanonicalHead = parseMemoryAuthorityHead(options.canonical.expectedHead, "pinned canonical");
   const programs = resolveProgramsV2(options.programs);
   const extractors = resolveExtractors(options.extractors ?? []);
   const nominationRoutes = resolveNominationRoutes(options.nominationRoutes ?? []);
-  const ingress = new OhSemanticBundleIngressV1(workingStore, workingCodecs);
-  const now = options.now ?? (() => new Date);
-  const monotonicNow = options.monotonicNow ?? (() => performance.now());
-  const capabilityLifetime = options.explainCapabilityLifetimeMs ?? OH_MEMORY_LIMITS_V1.explainCapabilityLifetimeMs;
-  if (!Number.isSafeInteger(capabilityLifetime) || capabilityLifetime < 1000 || capabilityLifetime > 60 * 60 * 1000) {
-    throw new RangeError("Invalid memory explanation capability lifetime.");
-  }
+  const ingress = new OhSemanticBundleIngressV1(capacityGuardedWorkingStore(workingStore, workingBinding), workingCodecs);
+  const runtime = sharedRuntime ?? createOhMemoryRuntimeV2(options);
   const canonical = await readLane({
     authorityId: canonicalAuthorityId,
     binding: canonicalBinding,
     store: canonicalStore
   }, "canonical", expectedCanonicalHead);
-  const explanations = new Map;
-  let explanationBytes = 0;
-  let lastMonotonicMs = -1;
-  let lastWallClockMs = Number.NEGATIVE_INFINITY;
   const wallClock = () => {
-    const milliseconds = clockMilliseconds(now);
-    if (milliseconds < lastWallClockMs)
+    const milliseconds = clockMilliseconds(runtime.now);
+    if (milliseconds < runtime.lastWallClockMs) {
       throw new OhProfileError("The memory wall clock regressed.");
-    lastWallClockMs = milliseconds;
+    }
+    runtime.lastWallClockMs = milliseconds;
     return milliseconds;
   };
   const monotonicClock = () => {
-    const milliseconds = monotonicMilliseconds(monotonicNow);
-    if (milliseconds < lastMonotonicMs)
+    const milliseconds = monotonicMilliseconds(runtime.monotonicNow);
+    if (milliseconds < runtime.lastMonotonicMs) {
       throw new OhProfileError("The memory monotonic clock regressed.");
-    lastMonotonicMs = milliseconds;
+    }
+    runtime.lastMonotonicMs = milliseconds;
     return milliseconds;
   };
   const deleteExplanation = (token) => {
-    const stored = explanations.get(token);
-    if (stored !== undefined && explanations.delete(token))
-      explanationBytes -= stored.bytes;
+    const stored = runtime.explanations.get(token);
+    if (stored !== undefined && runtime.explanations.delete(token)) {
+      runtime.explanationBytes -= stored.bytes;
+    }
   };
   const remember = async (value) => {
-    if (utf8ByteLength(canonicalJson(value)) > OH_MEMORY_LIMITS_V1.rememberBytes) {
-      throw new RangeError("The memory semantic bundle exceeds its canonical byte bound.");
-    }
-    if (!isPlainRecord(value) || !hasExactKeys(value, ["expectedHead", "puts", "requestId", "tombstones", "v"]) || value.v !== 1) {
+    const detached = detachCanonicalData(value, "The memory semantic bundle", OH_MEMORY_LIMITS_V1.rememberBytes).value;
+    if (!isPlainRecord(detached) || !hasExactKeys(detached, ["expectedHead", "puts", "requestId", "tombstones", "v"]) || detached.v !== 1) {
       throw new TypeError("Invalid memory remember request.");
     }
-    const requestId = safeCode(value.requestId, 128);
+    const requestId = safeCode(detached.requestId, 128);
     if (requestId === null)
       throw new TypeError("Invalid memory remember request identity.");
     const operationId = `memory_${canonicalSha256({
@@ -3836,15 +4242,19 @@ async function createOhMemoryAgentV2(options) {
       requestId,
       v: 1
     }).slice(0, 48)}`;
-    const operation = await ingress.commit({
+    const returnedOperation = await ingress.commit({
       actorId: memoryActorId,
-      expectedHead: value.expectedHead,
+      expectedHead: detached.expectedHead,
       instant: isoInstant(new Date(wallClock())),
       operationId,
-      puts: value.puts,
-      tombstones: value.tombstones,
+      puts: detached.puts,
+      tombstones: detached.tombstones,
       v: 1
     });
+    const operation = parseOhOperationV1(detachCanonicalData(returnedOperation, "The returned working memory operation", OH_MEMORY_LIMITS_V1.rememberBytes * 2).value);
+    if (operation === null || operation.actorId !== memoryActorId || operation.operationId !== operationId || operation.spaceId !== workingBinding.spaceId) {
+      throw new OhIntegrityError("The working authority returned a different memory operation.");
+    }
     const head = {
       generation: operation.sequence,
       graphRevisionSha256: operation.graphRevisionSha256,
@@ -3875,7 +4285,7 @@ async function createOhMemoryAgentV2(options) {
     const bound = parseBindingsV2(request.bindingsValue, program.parameters);
     const requestedContinuation = request.continuation === null ? null : parseContinuationV2(request.continuation, continuationKey);
     if (requestedContinuation !== null && (requestedContinuation.bindingsSha256 !== bound.bindingsSha256 || requestedContinuation.pageSize !== program.pageSize || requestedContinuation.programSha256 !== program.programSha256 || requestedContinuation.totalRows > program.maximumRows || requestedContinuation.nextOffset >= requestedContinuation.totalRows || requestedContinuation.nextOffset % program.pageSize !== 0)) {
-      throw new OhIntegrityError("The memory continuation does not match this exact program, binding, and page identity.");
+      throw new OhMemoryContinuationError("identity", "The memory continuation does not match this exact program, binding, and page identity.");
     }
     const boundQuery = bindQueryV2(program.query, bound.bindings);
     const working = await readLane({
@@ -3920,10 +4330,10 @@ async function createOhMemoryAgentV2(options) {
       memorySha256: canonicalSha256(identityPayload)
     });
     if (requestedContinuation !== null && (requestedContinuation.memorySha256 !== identity.memorySha256 || requestedContinuation.projectionResultSha256 !== projection.resultSha256)) {
-      throw new OhIntegrityError("The memory continuation does not match this exact source and projection identity.");
+      throw new OhMemoryContinuationError("identity", "The memory continuation does not match this exact source and projection identity.");
     }
     if (requestedContinuation !== null && (requestedContinuation.totalRows !== projection.rows.length || requestedContinuation.nextOffset >= projection.rows.length || requestedContinuation.nextOffset % program.pageSize !== 0)) {
-      throw new OhIntegrityError("The memory continuation does not match this exact row identity.");
+      throw new OhMemoryContinuationError("identity", "The memory continuation does not match this exact row identity.");
     }
     const start = requestedContinuation?.nextOffset ?? 0;
     const endExclusive = Math.min(start + program.pageSize, projection.rows.length);
@@ -3974,8 +4384,8 @@ async function createOhMemoryAgentV2(options) {
     const resultPayload = immutableClone({ ...resultIdentityPayload, continuation });
     const issuedAt = wallClock();
     const issuedAtMonotonic = monotonicClock();
-    const expiresAtMs = issuedAt + capabilityLifetime;
-    const expiresAtMonotonicMs = issuedAtMonotonic + capabilityLifetime;
+    const expiresAtMs = issuedAt + runtime.capabilityLifetime;
+    const expiresAtMonotonicMs = issuedAtMonotonic + runtime.capabilityLifetime;
     const expiresAt = isoInstant(new Date(expiresAtMs));
     const pageBytePreflight = {
       ...resultPayload,
@@ -3985,7 +4395,7 @@ async function createOhMemoryAgentV2(options) {
     if (utf8ByteLength(canonicalJson(pageBytePreflight)) > program.maximumPageBytes) {
       throw new RangeError("The V2 memory page exceeds its host-declared canonical byte bound.");
     }
-    for (const [existingToken, stored] of explanations) {
+    for (const [existingToken, stored] of runtime.explanations) {
       if (issuedAtMonotonic >= stored.expiresAtMonotonicMs)
         deleteExplanation(existingToken);
     }
@@ -4001,17 +4411,17 @@ async function createOhMemoryAgentV2(options) {
     if (storedBytes > OH_MEMORY_LIMITS_V1.explainCapabilityEntryBytes || storedBytes > OH_MEMORY_LIMITS_V1.explainCapabilityTotalBytes) {
       throw new RangeError("The V2 memory explanation exceeds its retained capability bound.");
     }
-    while (explanations.size >= OH_MEMORY_LIMITS_V1.explainCapabilities || explanationBytes + storedBytes > OH_MEMORY_LIMITS_V1.explainCapabilityTotalBytes) {
-      const oldest = explanations.keys().next().value;
+    while (runtime.explanations.size >= OH_MEMORY_LIMITS_V1.explainCapabilities || runtime.explanationBytes + storedBytes > OH_MEMORY_LIMITS_V1.explainCapabilityTotalBytes) {
+      const oldest = runtime.explanations.keys().next().value;
       if (oldest === undefined)
         break;
       deleteExplanation(oldest);
     }
     let token = randomBytes2(32).toString("base64url");
-    while (explanations.has(token))
+    while (runtime.explanations.has(token))
       token = randomBytes2(32).toString("base64url");
-    explanations.set(token, immutableClone({ ...storedPayload, bytes: storedBytes }));
-    explanationBytes += storedBytes;
+    runtime.explanations.set(token, immutableClone({ ...storedPayload, bytes: storedBytes }));
+    runtime.explanationBytes += storedBytes;
     const result = immutableClone({
       ...resultPayload,
       explainCapability: { expiresAt, token, v: 2 },
@@ -4025,7 +4435,7 @@ async function createOhMemoryAgentV2(options) {
   };
   const explain = async (value) => {
     const request = parseExplainRequestV2(value);
-    const stored = explanations.get(request.token);
+    const stored = runtime.explanations.get(request.token);
     const currentTime = monotonicClock();
     if (stored === undefined || stored.resultSha256 !== request.resultSha256 || currentTime >= stored.expiresAtMonotonicMs) {
       deleteExplanation(request.token);
@@ -4057,13 +4467,14 @@ async function createOhMemoryAgentV2(options) {
     const route = nominationRoutes.get(request.nominationId);
     if (route === undefined)
       throw new TypeError("Unknown named memory nomination route.");
-    const head = parseOhHeadV1(immutableClone(await workingStore.head()));
+    const head = parseOhHeadV1(detachCanonicalData(await workingStore.head(), "The working nomination store head", 4 * 1024).value);
     if (head === null)
       throw new OhIntegrityError("The working nomination store returned an invalid head.");
-    const closure = await workingStore.exportDependencyClosure({ head: {
+    const returnedClosure = await workingStore.exportDependencyClosure({ head: {
       operationSha256: head.operationSha256,
       sequence: head.sequence
     }, roots: request.roots });
+    const closure = detachCanonicalData(returnedClosure, "The working nomination closure", OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes).value;
     const verified = verifyOhDependencyClosureAgainstV1(closure, { binding: workingBinding, head });
     if (!verified.ok)
       throw new OhIntegrityError("The working nomination closure failed exact verification.");
@@ -4089,15 +4500,561 @@ async function createOhMemoryAgentV2(options) {
   };
   return Object.freeze({ explain, nominate, query, remember });
 }
+async function createOhMemoryAgentV2(options) {
+  return await createOhMemoryAgentV2WithRuntime(options);
+}
+function parseDetachedMemoryAuthorityHead(value, label) {
+  const head = parseOhHeadV1(value);
+  if (head === null)
+    throw new TypeError(`Invalid ${label} memory head.`);
+  return immutableClone(head);
+}
+function parseMemoryAuthorityHead(value, label) {
+  return parseDetachedMemoryAuthorityHead(detachCanonicalData(value, `The ${label} memory head`, 4 * 1024).value, label);
+}
+function parseCanonicalAdvanceRequest(value) {
+  const detached = detachCanonicalData(value, "The canonical memory advance request", OH_MEMORY_QUERY_LIMITS_V2.requestBytes).value;
+  if (!isPlainRecord(detached) || !hasExactKeys(detached, ["expectedHead", "nextHead", "v"]) || detached.v !== 1)
+    throw new TypeError("Invalid canonical memory advance request.");
+  return Object.freeze({
+    expectedHead: parseDetachedMemoryAuthorityHead(detached.expectedHead, "expected canonical"),
+    nextHead: parseDetachedMemoryAuthorityHead(detached.nextHead, "next canonical")
+  });
+}
+function parseAdoptionRequest(value) {
+  const detached = detachCanonicalData(value, "The memory adoption request", OH_MEMORY_AUTHORITY_LIMITS_V1.adoptionRequestBytes).value;
+  if (!isPlainRecord(detached) || !hasExactKeys(detached, ["expectedCanonicalHead", "nomination", "v"]) && !hasExactKeys(detached, ["expectedCanonicalHead", "nomination", "replacements", "v"]) || detached.v !== 1)
+    throw new TypeError("Invalid memory adoption request.");
+  const nomination = parseDetachedMemoryNominationV1(detached.nomination);
+  if (nomination === null)
+    throw new TypeError("Invalid memory adoption nomination.");
+  const replacementValues = "replacements" in detached ? detached.replacements : [];
+  if (!Array.isArray(replacementValues) || replacementValues.length > OH_MEMORY_AUTHORITY_LIMITS_V1.adoptionReplacements) {
+    throw new TypeError("Invalid memory adoption replacements.");
+  }
+  const nominatedByKey = new Map(nomination.closure.records.map((record) => [record.key, record]));
+  const replacements = replacementValues.map((replacement) => {
+    if (!isPlainRecord(replacement) || !hasExactKeys(replacement, ["expectedPriorRecordSha256", "key", "v"]) || replacement.v !== 1)
+      throw new TypeError("Invalid memory adoption replacement.");
+    const key = safeCode(replacement.key, 512);
+    const expectedPriorRecordSha256 = parseSha256Hex(replacement.expectedPriorRecordSha256);
+    const nominated = key === null ? undefined : nominatedByKey.get(key);
+    if (key === null || expectedPriorRecordSha256 === null || nominated === undefined) {
+      throw new TypeError("Invalid memory adoption replacement.");
+    }
+    return { expectedPriorRecordSha256, key, v: 1 };
+  }).sort((left, right) => compareText(left.key, right.key));
+  if (!orderedUnique(replacements, (replacement) => replacement.key)) {
+    throw new TypeError("Memory adoption replacement keys must be unique.");
+  }
+  return Object.freeze({
+    expectedCanonicalHead: parseDetachedMemoryAuthorityHead(detached.expectedCanonicalHead, "expected canonical adoption"),
+    nomination,
+    replacements: immutableClone(replacements)
+  });
+}
+function headRef(head) {
+  return Object.freeze({ operationSha256: head.operationSha256, sequence: head.sequence });
+}
+async function proveCanonicalDescendant(authority, priorHead, nextHead, requiredFirstHead) {
+  if (nextHead.sequence <= priorHead.sequence) {
+    throw new OhConflictError("The next canonical memory head is not a descendant of the current pin.");
+  }
+  const distance = nextHead.sequence - priorHead.sequence;
+  if (distance > OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalAdvanceOperations || Math.ceil(distance / OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalChangeFeedPage) > OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalAdvancePages) {
+    throw new RangeError("The canonical memory advance exceeds its total proof bound; advance in host-reviewed chunks.");
+  }
+  const through = headRef(nextHead);
+  let cursor = headRef(priorHead);
+  let pageCount = 0;
+  let reachedHead = null;
+  let firstHead = null;
+  while (cursor.sequence < through.sequence) {
+    if (pageCount >= OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalAdvancePages) {
+      throw new RangeError("The canonical memory advance exceeded its page proof bound; advance in host-reviewed chunks.");
+    }
+    pageCount += 1;
+    const remaining = through.sequence - cursor.sequence;
+    const limit = Math.min(remaining, OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalChangeFeedPage);
+    const returnedData = detachCanonicalData(await authority.store.changesSince(cursor, { limit, through }), "The canonical change-feed page", OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalChangeFeedPageBytes).value;
+    const returned = returnedData;
+    if (!isPlainRecord(returned) || !hasExactKeys(returned, ["from", "hasMore", "operations", "through", "to", "v"]) || returned.v !== 1 || typeof returned.hasMore !== "boolean" || !Array.isArray(returned.operations) || returned.operations.length > limit) {
+      throw new OhIntegrityError("The canonical change feed returned an invalid page envelope.");
+    }
+    const from = parseOhHeadRefV1(returned.from);
+    const returnedThrough = parseOhHeadV1(returned.through);
+    const returnedTo = parseOhHeadRefV1(returned.to);
+    if (from === null || returnedThrough === null || returnedTo === null || canonicalJson(from) !== canonicalJson(cursor) || !exactHead(returnedThrough, nextHead)) {
+      throw new OhIntegrityError("The canonical change feed changed its pinned bounds.");
+    }
+    let reached = cursor;
+    for (const value of returned.operations) {
+      const operation = parseOhOperationV1(value);
+      if (operation === null || operation.spaceId !== authority.binding.spaceId || operation.sequence !== reached.sequence + 1 || operation.parentOperationSha256 !== reached.operationSha256) {
+        throw new OhIntegrityError("The canonical change feed contains a gap or different authority.");
+      }
+      reached = Object.freeze({
+        operationSha256: operation.operationSha256,
+        sequence: operation.sequence
+      });
+      reachedHead = immutableClone({
+        generation: operation.sequence,
+        graphRevisionSha256: operation.graphRevisionSha256,
+        operationSha256: operation.operationSha256,
+        recordsSha256: operation.recordsSha256,
+        sequence: operation.sequence,
+        v: 1
+      });
+      firstHead ??= reachedHead;
+    }
+    if (canonicalJson(reached) !== canonicalJson(returnedTo) || returned.hasMore && returned.operations.length === 0 || returned.hasMore && reached.sequence >= through.sequence || reached.sequence > through.sequence || !returned.hasMore && canonicalJson(reached) !== canonicalJson(through)) {
+      throw new OhIntegrityError("The canonical change feed did not prove the requested descendant.");
+    }
+    cursor = reached;
+  }
+  if (reachedHead === null || !exactHead(reachedHead, nextHead)) {
+    throw new OhIntegrityError("The canonical change feed did not prove the requested full head.");
+  }
+  if (requiredFirstHead !== undefined && (firstHead === null || !exactHead(firstHead, requiredFirstHead))) {
+    throw new OhIntegrityError("The returned adoption operation is not on the current canonical path.");
+  }
+  return await readLane(authority, "canonical", nextHead);
+}
+function canonicalAdvanceReceipt(authorityIdValue, bindingSha256, priorHead, head, status) {
+  const payload = {
+    authorityId: authorityIdValue,
+    bindingSha256,
+    head,
+    priorHead,
+    status,
+    v: 1
+  };
+  return immutableClone({ ...payload, receiptSha256: canonicalSha256(payload) });
+}
+function adoptionReceipt(actorId, authorityIdValue, bindingSha256, nominationSha256, operationSha256, priorHead, head, status) {
+  const payload = {
+    actorId,
+    authorityId: authorityIdValue,
+    bindingSha256,
+    head,
+    nominationSha256,
+    operationSha256,
+    priorHead,
+    status,
+    v: 1
+  };
+  return immutableClone({ ...payload, receiptSha256: canonicalSha256(payload) });
+}
+function adoptionDifferences(snapshot, records) {
+  const canonicalByKey = new Map(snapshot.records.map((record) => [record.key, record]));
+  return immutableClone(records.flatMap((record) => {
+    const canonicalRecord = canonicalByKey.get(record.key);
+    return canonicalRecord?.recordSha256 === record.recordSha256 ? [] : [{
+      canonicalRecordSha256: canonicalRecord?.recordSha256 ?? null,
+      key: record.key,
+      nominatedRecordSha256: record.recordSha256,
+      v: 1
+    }];
+  }).sort((left, right) => compareText(left.key, right.key)));
+}
+function unauthorizedAdoptionDifferences(reviewedSnapshot, currentSnapshot, records, replacements) {
+  const reviewedByKey = new Map(reviewedSnapshot.records.map((record) => [record.key, record]));
+  const currentByKey = new Map(currentSnapshot.records.map((record) => [record.key, record]));
+  const replacementByKey = new Map(replacements.map((replacement) => [
+    replacement.key,
+    replacement.expectedPriorRecordSha256
+  ]));
+  const conflicts = records.flatMap((nominated) => {
+    const reviewed = reviewedByKey.get(nominated.key);
+    const expectedPriorRecordSha256 = replacementByKey.get(nominated.key);
+    const alreadyEqual = reviewed?.recordSha256 === nominated.recordSha256;
+    const authorized = reviewed === undefined ? expectedPriorRecordSha256 === undefined : alreadyEqual ? expectedPriorRecordSha256 === undefined || expectedPriorRecordSha256 === reviewed.recordSha256 : expectedPriorRecordSha256 === reviewed.recordSha256;
+    if (authorized)
+      return [];
+    return [{
+      canonicalRecordSha256: currentByKey.get(nominated.key)?.recordSha256 ?? null,
+      key: nominated.key,
+      nominatedRecordSha256: nominated.recordSha256,
+      v: 1
+    }];
+  });
+  return immutableClone(conflicts.sort((left, right) => compareText(left.key, right.key)));
+}
+async function assertWorkingCommitCapacity(store, binding, changes, head) {
+  const returnedSnapshot = await store.snapshot({
+    head: { operationSha256: head.operationSha256, sequence: head.sequence },
+    maximumRecords: OH_MEMORY_LIMITS_V1.maximumRecordsPerLane
+  });
+  const { snapshot } = parseDetachedStoreSnapshot(returnedSnapshot, "The working capacity store", head, binding.spaceId);
+  const recordsByKey = new Map(snapshot.records.map((record) => [record.key, record]));
+  for (const change of canonicalKnowledgeGraphChangesV1(changes)) {
+    if (change.kind === "put")
+      recordsByKey.set(change.record.key, change.record);
+    else
+      recordsByKey.delete(change.key);
+  }
+  if (recordsByKey.size > OH_MEMORY_LIMITS_V1.maximumRecordsPerLane) {
+    throw new RangeError("The remembered working memory would exceed its record snapshot bound.");
+  }
+  const nextSequence = snapshot.head.sequence + 1;
+  if (!Number.isSafeInteger(nextSequence)) {
+    throw new RangeError("The remembered working memory would exceed its head sequence bound.");
+  }
+  const records = [...recordsByKey.values()].sort((left, right) => compareText(left.key, right.key));
+  const placeholderDigest = canonicalSha256({ kind: "oh.memory.remember-capacity", v: 1 });
+  const prospective = {
+    head: {
+      generation: nextSequence,
+      graphRevisionSha256: placeholderDigest,
+      operationSha256: placeholderDigest,
+      recordsSha256: canonicalSha256(records.map(knowledgeGraphRecordRefV1)),
+      sequence: nextSequence,
+      v: 1
+    },
+    records,
+    v: 1
+  };
+  if (utf8ByteLength(canonicalJson(prospective)) > OH_MEMORY_LIMITS_V1.snapshotBytesPerLane) {
+    throw new RangeError("The remembered working memory would exceed its snapshot byte bound.");
+  }
+}
+function capacityGuardedWorkingStore(store, binding) {
+  const guarded = {
+    binding,
+    changesSince: async (from, options) => await store.changesSince(from, options),
+    close: async () => await store.close(),
+    commit: async (input) => {
+      const current = parseDetachedStoreHead(await store.head(), "The working capacity store");
+      if (current.generation === input.expectedHead.generation && current.operationSha256 === input.expectedHead.operationSha256)
+        await assertWorkingCommitCapacity(store, binding, input.changes, current);
+      return await store.commit(input);
+    },
+    exportDependencyClosure: async (input) => await store.exportDependencyClosure(input),
+    head: async () => await store.head(),
+    snapshot: async (options) => await store.snapshot(options),
+    verify: async () => await store.verify()
+  };
+  return Object.freeze(guarded);
+}
+function assertAdoptionSnapshotCapacity(snapshot, changedRecords) {
+  const recordsByKey = new Map(snapshot.records.map((record) => [record.key, record]));
+  for (const record of changedRecords)
+    recordsByKey.set(record.key, record);
+  if (recordsByKey.size > OH_MEMORY_LIMITS_V1.maximumRecordsPerLane) {
+    throw new RangeError("The adopted canonical memory would exceed its record snapshot bound.");
+  }
+  const nextSequence = snapshot.head.sequence + 1;
+  if (!Number.isSafeInteger(nextSequence)) {
+    throw new RangeError("The adopted canonical memory would exceed its head sequence bound.");
+  }
+  const records = [...recordsByKey.values()].sort((left, right) => compareText(left.key, right.key));
+  const placeholderDigest = canonicalSha256({ kind: "oh.memory.adoption-capacity", v: 1 });
+  const prospective = {
+    head: {
+      generation: nextSequence,
+      graphRevisionSha256: placeholderDigest,
+      operationSha256: placeholderDigest,
+      recordsSha256: canonicalSha256(records.map(knowledgeGraphRecordRefV1)),
+      sequence: nextSequence,
+      v: 1
+    },
+    records,
+    v: 1
+  };
+  if (utf8ByteLength(canonicalJson(prospective)) > OH_MEMORY_LIMITS_V1.snapshotBytesPerLane) {
+    throw new RangeError("The adopted canonical memory would exceed its canonical snapshot byte bound.");
+  }
+}
+function adoptionConflict(expectedHead, actualHead, completeConflicts) {
+  const sorted = immutableClone([...completeConflicts].sort((left, right) => compareText(left.key, right.key)));
+  const conflicts = immutableClone(sorted.slice(0, OH_MEMORY_AUTHORITY_LIMITS_V1.reportedAdoptionConflicts));
+  const conflict = immutableClone({
+    actualHead,
+    conflicts,
+    conflictsSha256: canonicalSha256({ conflicts: sorted, v: 1 }),
+    expectedHead,
+    reportedConflicts: conflicts.length,
+    totalConflicts: sorted.length,
+    truncated: conflicts.length !== sorted.length,
+    v: 1
+  });
+  return new OhMemoryAdoptionConflictError(conflict);
+}
+async function createOhMemoryAuthorityV1(options) {
+  const maximumCanonicalOperationBytes = options.maximumCanonicalOperationBytes ?? OH_OPERATION_MAX_BYTES_V1;
+  if (!Number.isSafeInteger(maximumCanonicalOperationBytes) || maximumCanonicalOperationBytes < 1 || maximumCanonicalOperationBytes > OH_OPERATION_MAX_BYTES_V1) {
+    throw new TypeError("Invalid canonical memory operation byte bound.");
+  }
+  const memoryActorId = safeCode(options.actorId, 128);
+  const adoptionActorId = safeCode(options.adoptionActorId, 128);
+  if (memoryActorId === null || adoptionActorId === null) {
+    throw new TypeError("Invalid host-bound memory authority actor ID.");
+  }
+  const canonicalStore = options.canonical.store;
+  const workingStore = options.working.store;
+  const canonicalAuthorityId = authorityId(options.canonical.authorityId);
+  const workingAuthorityId = authorityId(options.working.authorityId);
+  if (canonicalAuthorityId === workingAuthorityId) {
+    throw new OhProfileError("Working and canonical memory must be distinct physical authorities.");
+  }
+  const canonicalBinding = bindingFor(canonicalStore, options.canonical.expectedBindingSha256, "canonical");
+  const workingBinding = bindingFor(workingStore, options.working.expectedBindingSha256, "working");
+  const initialCanonicalHead = parseMemoryAuthorityHead(options.canonical.expectedHead, "initial canonical");
+  const workingCodecs = options.working.codecs;
+  const explainCapabilityLifetimeMs = options.explainCapabilityLifetimeMs;
+  const monotonicNow = options.monotonicNow;
+  const now = options.now;
+  const continuationKey = continuationKeyV2(options.continuationKey);
+  const programs = Object.freeze([...resolveProgramsV2(options.programs).values()].map((program) => immutableClone({
+    evaluation: program.evaluation,
+    maximumPageBytes: program.maximumPageBytes,
+    maximumRows: program.maximumRows,
+    pageSize: program.pageSize,
+    parameters: program.parameters,
+    programId: program.programId,
+    purpose: program.purpose,
+    query: program.query,
+    rulePack: program.rulePack,
+    v: 2
+  })));
+  const extractors = resolveExtractors(options.extractors ?? []);
+  const nominationRoutes = Object.freeze([...resolveNominationRoutes(options.nominationRoutes ?? []).values()]);
+  const routesById = new Map(nominationRoutes.map((route) => [route.nominationId, route]));
+  const runtime = createOhMemoryRuntimeV2(options);
+  const createAgentAt = async (expectedHead) => await createOhMemoryAgentV2WithRuntime({
+    actorId: memoryActorId,
+    canonical: {
+      authorityId: canonicalAuthorityId,
+      expectedBindingSha256: canonicalBinding.bindingSha256,
+      expectedHead,
+      store: canonicalStore
+    },
+    continuationKey,
+    ...explainCapabilityLifetimeMs === undefined ? {} : {
+      explainCapabilityLifetimeMs
+    },
+    extractors,
+    ...monotonicNow === undefined ? {} : { monotonicNow },
+    nominationRoutes,
+    ...now === undefined ? {} : { now },
+    programs,
+    working: {
+      authorityId: workingAuthorityId,
+      codecs: workingCodecs,
+      expectedBindingSha256: workingBinding.bindingSha256,
+      store: workingStore
+    }
+  }, runtime);
+  let activeCanonicalHead = initialCanonicalHead;
+  let activeAgent = await createAgentAt(activeCanonicalHead);
+  const agent = Object.freeze({
+    async explain(value) {
+      const selected = activeAgent;
+      return await selected.explain(value);
+    },
+    nominate(value) {
+      const selected = activeAgent;
+      return selected.nominate(value);
+    },
+    async query(value) {
+      const selected = activeAgent;
+      return await selected.query(value);
+    },
+    remember(value) {
+      const selected = activeAgent;
+      return selected.remember(value);
+    }
+  });
+  let hostTail = Promise.resolve();
+  const serialized = (operation) => {
+    const result = hostTail.then(operation);
+    hostTail = result.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return result;
+  };
+  const installCanonicalHead = async (head) => {
+    const nextAgent = await createAgentAt(head);
+    activeAgent = nextAgent;
+    activeCanonicalHead = immutableClone(head);
+  };
+  const canonicalAuthority = Object.freeze({
+    authorityId: canonicalAuthorityId,
+    binding: canonicalBinding,
+    store: canonicalStore
+  });
+  const readPhysicalCanonicalHead = async () => parseMemoryAuthorityHead(await canonicalStore.head(), "physical canonical");
+  const advanceCanonical = (value) => {
+    let request;
+    try {
+      request = parseCanonicalAdvanceRequest(value);
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    return serialized(async () => {
+      const priorHead = activeCanonicalHead;
+      if (!exactHead(request.expectedHead, priorHead)) {
+        throw new OhConflictError("The expected canonical memory head does not match the current pin.");
+      }
+      if (exactHead(request.nextHead, priorHead)) {
+        return canonicalAdvanceReceipt(canonicalAuthorityId, canonicalBinding.bindingSha256, priorHead, priorHead, "unchanged");
+      }
+      await proveCanonicalDescendant(canonicalAuthority, priorHead, request.nextHead);
+      await installCanonicalHead(request.nextHead);
+      return canonicalAdvanceReceipt(canonicalAuthorityId, canonicalBinding.bindingSha256, priorHead, request.nextHead, "advanced");
+    });
+  };
+  const adoptNomination = (value) => {
+    let request;
+    try {
+      request = parseAdoptionRequest(value);
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    return serialized(async () => {
+      const route = routesById.get(request.nomination.nominationId);
+      if (route === undefined || route.destinationPurpose !== request.nomination.destinationPurpose) {
+        throw new OhProfileError("The memory nomination is not bound to this adoption route.");
+      }
+      if (request.nomination.source.authorityId !== workingAuthorityId || request.nomination.source.bindingSha256 !== workingBinding.bindingSha256 || request.nomination.closure.binding.bindingSha256 !== workingBinding.bindingSha256) {
+        throw new OhProfileError("The memory nomination is not from the bound working authority.");
+      }
+      const returnedReexport = await workingStore.exportDependencyClosure({
+        head: headRef(request.nomination.source.head),
+        maximumRecords: OH_DEPENDENCY_CLOSURE_LIMITS_V1.records,
+        roots: request.nomination.closure.roots
+      });
+      const reexported = detachCanonicalData(returnedReexport, "The working re-exported nomination", OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes);
+      if (reexported.canonical !== canonicalJson(request.nomination.closure)) {
+        throw new OhIntegrityError("The working authority did not re-export the nominated closure exactly.");
+      }
+      const priorHead = activeCanonicalHead;
+      const physicalHead = await readPhysicalCanonicalHead();
+      const replacementConflictsAt = async (currentLane) => {
+        if (request.replacements.length === 0)
+          return [];
+        const reviewedLane = exactHead(request.expectedCanonicalHead, currentLane.snapshot.head) ? currentLane : await readLane(canonicalAuthority, "canonical", request.expectedCanonicalHead);
+        return unauthorizedAdoptionDifferences(reviewedLane.snapshot, currentLane.snapshot, request.nomination.closure.records, request.replacements);
+      };
+      if (!exactHead(physicalHead, priorHead)) {
+        const physicalLane = await proveCanonicalDescendant(canonicalAuthority, priorHead, physicalHead);
+        const physicalDifferences = adoptionDifferences(physicalLane.snapshot, request.nomination.closure.records);
+        if (physicalDifferences.length === 0) {
+          const replacementConflicts = await replacementConflictsAt(physicalLane);
+          if (replacementConflicts.length > 0) {
+            throw adoptionConflict(request.expectedCanonicalHead, physicalHead, replacementConflicts);
+          }
+          await installCanonicalHead(physicalHead);
+          return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, null, priorHead, physicalHead, "already-present");
+        }
+        throw adoptionConflict(request.expectedCanonicalHead, physicalHead, physicalDifferences);
+      }
+      const lane = await readLane(canonicalAuthority, "canonical", priorHead);
+      const differences = adoptionDifferences(lane.snapshot, request.nomination.closure.records);
+      if (!exactHead(request.expectedCanonicalHead, priorHead)) {
+        if (differences.length === 0) {
+          const replacementConflicts = await replacementConflictsAt(lane);
+          if (replacementConflicts.length > 0) {
+            throw adoptionConflict(request.expectedCanonicalHead, priorHead, replacementConflicts);
+          }
+          return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, null, priorHead, priorHead, "already-present");
+        }
+        throw adoptionConflict(request.expectedCanonicalHead, priorHead, differences);
+      }
+      if (differences.length === 0) {
+        const replacementConflicts = await replacementConflictsAt(lane);
+        if (replacementConflicts.length > 0) {
+          throw adoptionConflict(request.expectedCanonicalHead, priorHead, replacementConflicts);
+        }
+        return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, null, priorHead, priorHead, "already-present");
+      }
+      const unauthorized = unauthorizedAdoptionDifferences(lane.snapshot, lane.snapshot, request.nomination.closure.records, request.replacements);
+      if (unauthorized.length > 0) {
+        throw adoptionConflict(request.expectedCanonicalHead, priorHead, unauthorized);
+      }
+      const changedKeys = new Set(differences.map(({ key }) => key));
+      const changedRecords = request.nomination.closure.records.filter(({ key }) => changedKeys.has(key));
+      if (changedRecords.length === 0) {
+        return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, null, priorHead, priorHead, "already-present");
+      }
+      assertAdoptionSnapshotCapacity(lane.snapshot, changedRecords);
+      const changes = canonicalKnowledgeGraphChangesV1(changedRecords.map((record) => ({ kind: "put", record, v: 1 })));
+      const operationId = `memory_adopt_${canonicalSha256({
+        actorId: adoptionActorId,
+        bindingSha256: canonicalBinding.bindingSha256,
+        nominationSha256: request.nomination.nominationSha256,
+        priorHead,
+        v: 1
+      }).slice(0, 48)}`;
+      let returnedOperation;
+      try {
+        returnedOperation = await canonicalStore.commit({
+          actorId: adoptionActorId,
+          changes,
+          expectedHead: {
+            generation: priorHead.generation,
+            operationSha256: priorHead.operationSha256
+          },
+          maximumOperationBytes: maximumCanonicalOperationBytes,
+          operationId
+        });
+      } catch (error) {
+        if (!(error instanceof OhConflictError))
+          throw error;
+        const actualHead2 = await readPhysicalCanonicalHead();
+        const actualLane = exactHead(actualHead2, priorHead) ? await readLane(canonicalAuthority, "canonical", actualHead2) : await proveCanonicalDescendant(canonicalAuthority, priorHead, actualHead2);
+        const actualDifferences = adoptionDifferences(actualLane.snapshot, request.nomination.closure.records);
+        if (actualDifferences.length === 0) {
+          if (!exactHead(actualHead2, priorHead)) {
+            await installCanonicalHead(actualHead2);
+          }
+          return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, null, priorHead, actualHead2, "already-present");
+        }
+        throw adoptionConflict(request.expectedCanonicalHead, actualHead2, actualDifferences);
+      }
+      const operation = parseOhOperationV1(detachCanonicalData(returnedOperation, "The returned canonical adoption operation", OH_MEMORY_AUTHORITY_LIMITS_V1.canonicalChangeFeedPageBytes).value);
+      if (operation === null || operation.actorId !== adoptionActorId || operation.operationId !== operationId || operation.spaceId !== canonicalBinding.spaceId || operation.parentOperationSha256 !== priorHead.operationSha256 || operation.sequence !== priorHead.sequence + 1 || canonicalJson(operation.changes) !== canonicalJson(changes)) {
+        throw new OhIntegrityError("The canonical authority returned a different adoption operation.");
+      }
+      const head = immutableClone({
+        generation: operation.sequence,
+        graphRevisionSha256: operation.graphRevisionSha256,
+        operationSha256: operation.operationSha256,
+        recordsSha256: operation.recordsSha256,
+        sequence: operation.sequence,
+        v: 1
+      });
+      const actualHead = await readPhysicalCanonicalHead();
+      if (!exactHead(actualHead, head)) {
+        const actualLane = exactHead(actualHead, priorHead) ? await readLane(canonicalAuthority, "canonical", actualHead) : await proveCanonicalDescendant(canonicalAuthority, priorHead, actualHead, head);
+        const actualDifferences = adoptionDifferences(actualLane.snapshot, request.nomination.closure.records);
+        if (actualDifferences.length !== 0) {
+          throw adoptionConflict(request.expectedCanonicalHead, actualHead, actualDifferences);
+        }
+        await installCanonicalHead(actualHead);
+        return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, null, priorHead, actualHead, "already-present");
+      }
+      await installCanonicalHead(actualHead);
+      return adoptionReceipt(adoptionActorId, canonicalAuthorityId, canonicalBinding.bindingSha256, request.nomination.nominationSha256, operation.operationSha256, priorHead, actualHead, "adopted");
+    });
+  };
+  return Object.freeze({ agent, host: Object.freeze({ adoptNomination, advanceCanonical }) });
+}
 export {
   renderOhMemoryPageMarkdownV1,
   parseOhMemoryPageValueV1,
   parseOhMemoryPageRecordV1,
   parseOhMemoryPageMarkdownV1,
+  parseOhMemoryNominationV1,
   createOhMemoryPageValueV1,
   createOhMemoryPageRecordV1,
+  createOhMemoryAuthorityV1,
   createOhMemoryAgentV2,
   createOhMemoryAgentV1,
+  OhMemoryContinuationError,
+  OhMemoryAdoptionConflictError,
   OH_MEMORY_QUERY_LIMITS_V2,
   OH_MEMORY_PAGE_RECORD_CODEC_V1,
   OH_MEMORY_PAGE_MARKDOWN_EXTENSION_V1,
@@ -4106,5 +5063,6 @@ export {
   OH_MEMORY_LIMITS_V1,
   OH_MEMORY_FORMAT_VERSION_V1,
   OH_MEMORY_CONFLICT_POLICY_V1,
-  OH_MEMORY_COMPOSITE_FACT_EXTRACTOR_V1
+  OH_MEMORY_COMPOSITE_FACT_EXTRACTOR_V1,
+  OH_MEMORY_AUTHORITY_LIMITS_V1
 };