@remnic/core 9.65.1 → 9.65.3

package/dist/{access-service-B1Lbb-nQ.d.ts → access-service-DkaIG3n8.d.ts}

@@ -1,41 +1,41 @@
-import { b as NamespaceRecord } from './catalog-DjVhJoRM.js';
-import { P as PluginConfig, C as CodingContext, x as MemoryCategory, G as GatewayConfig, M as MemoryFile, aG as DaySummaryResult, o as RecallDisclosure, R as RecallPlanMode, K as MemoryLifecycleEvent, E as EntityFile, z as MemoryStatus, p as SourceConnectorProvenance, bd as DreamsStatusResult, D as DreamsPhase, a as DreamsRunResult } from './types-BrEzuxPA.js';
-import { S as ScopePlan, E as EngramAccessNamespaceWritableRequest, W as WritableNamespaceResult } from './access-namespace-preflight-BKUnKsBv.js';
-import { S as StorageManager } from './storage-B9lbNTYE.js';
+import { P as PluginConfig, C as CodingContext, M as MemoryFile, y as MemoryCategory, G as GatewayConfig, N as MemorySubject, au as SubjectGuardMode, aI as DaySummaryResult, o as RecallDisclosure, R as RecallPlanMode, K as MemoryLifecycleEvent, E as EntityFile, w as MemoryStatus, p as SourceConnectorProvenance, bj as DreamsStatusResult, D as DreamsPhase, a as DreamsRunResult } from './types-BxAcOl5Q.js';
+import { O as Orchestrator, I as IntentDebugSnapshot, G as GraphRecallSnapshot, P as PatternReinforcementResult } from './orchestrator-Bvq1-RQs.js';
+import { S as ScopeProfileLayerResolution, a as ScopeProfilePromotionResolution, R as ResolvedScopeProfilePlan } from './scope-profiles-DLrRxFWR.js';
+import { S as StorageManager } from './storage-BIDzuKIn.js';
+import { a as SemanticDedupLookup } from './semantic-BalR6EXU.js';
+import { LocalLlmClient } from './local-llm.js';
+import { FallbackLlmClient } from './fallback-llm.js';
+import { TrustZoneStoreStatus, TrustZoneName, TrustZoneRecordKind, TrustZoneSourceClass, TrustZoneProvenanceScore, TrustZonePromotionResult, TrustZoneDemoSeedResult } from './trust-zones.js';
+import { LcmMessagePartInput, MessagePartSourceFormat } from './message-parts/index.js';
+import { RecallRequest, ObserveRequest } from './access-schema.js';
+import { z } from 'zod';
+import { ResolveSecretRefFn } from './resolve-auth-token.js';
+import { RecallContextComposition } from './recall-context-composition.js';
+import { RecallXraySnapshot } from './recall-xray.js';
+import { Readable, Writable } from 'node:stream';
+import { ActionConfidenceInput, ActionConfidenceResult } from './action-confidence.js';
+import { OfflineSyncFileState, OfflineSyncSnapshot, OfflineSyncFileRecord, OfflineSyncFileContentChunk, OfflineSyncApplyFileContentChunkResult, OfflineSyncApplyChangesetResult } from './offline-sync.js';
+import { LiveConnectorsRunSummary } from './live-connectors-runner.js';
+import { readMemoryGovernanceRunArtifact } from './maintenance/memory-governance.js';
+import { LastRecallSnapshot } from './recall-state.js';
+import { W as WearablesService, c as MeetingsListResult, b as MeetingsGetResult, a as MeetingsDayBuildSummary } from './service-GkYyVfm9.js';
+import { MemoryOutcomeKind, RecordMemoryOutcomeResult } from './memory-worth-outcomes.js';
+import { BudgetWarning } from './cross-namespace-budget.js';
+import { AnomalyDetectorResult } from './recall-audit-anomaly.js';
 import { a as Peer, b as PeerProfile } from './types-B1VHaf2w.js';
+import { ImportCapsuleOptions, ImportCapsuleResult } from './transfer/capsule-import.js';
+import { b as NamespaceRecord } from './catalog-CX2BZEJh.js';
+import { S as ScopePlan, E as EngramAccessNamespaceWritableRequest, W as WritableNamespaceResult } from './access-namespace-preflight-B7Usyz-K.js';
 import { RecallExplainJsonPayload } from './recall-explain-renderer.js';
 import { CitationUsageRequest, CitationUsageResult } from './access-citation.js';
 import { EngramAccessHealthResponse } from './access-health-types.js';
-import { ResolveSecretRefFn } from './resolve-auth-token.js';
-import { O as Orchestrator, I as IntentDebugSnapshot, G as GraphRecallSnapshot, P as PatternReinforcementResult } from './orchestrator-DzCaxNS4.js';
-import { BudgetWarning } from './cross-namespace-budget.js';
 import { ExplicitCaptureInput } from './explicit-capture.js';
-import { LiveConnectorsRunSummary } from './live-connectors-runner.js';
-import { readMemoryGovernanceRunArtifact } from './maintenance/memory-governance.js';
-import { W as WearablesService, c as MeetingsListResult, b as MeetingsGetResult, a as MeetingsDayBuildSummary } from './service-_qgST_0y.js';
-import { AnomalyDetectorResult } from './recall-audit-anomaly.js';
 import { WearablesMeetingsScope } from './access-wearables-meetings-surface.js';
 import { GraphSnapshotRequest, GraphSnapshotResponse } from './graph-snapshot.js';
-import { S as ScopeProfileLayerResolution, a as ScopeProfilePromotionResolution, R as ResolvedScopeProfilePlan } from './scope-profiles-CEMZz0t5.js';
-import { RecallContextComposition } from './recall-context-composition.js';
-import { LastRecallSnapshot } from './recall-state.js';
-import { TrustZoneStoreStatus, TrustZoneName, TrustZoneRecordKind, TrustZoneSourceClass, TrustZoneProvenanceScore, TrustZonePromotionResult, TrustZoneDemoSeedResult } from './trust-zones.js';
-import { FallbackLlmClient } from './fallback-llm.js';
-import { LocalLlmClient } from './local-llm.js';
-import { z } from 'zod';
 import { OfflineSyncManifestStreamResponse } from './access-offline-manifest.js';
-import { ActionConfidenceInput, ActionConfidenceResult } from './action-confidence.js';
 import { CapsuleListEntry } from './capsule-cli.js';
-import { S as SemanticDedupLookup } from './semantic-TddhF0y7.js';
-import { MemoryOutcomeKind, RecordMemoryOutcomeResult } from './memory-worth-outcomes.js';
-import { LcmMessagePartInput, MessagePartSourceFormat } from './message-parts/index.js';
-import { RecallRequest, ObserveRequest } from './access-schema.js';
-import { OfflineSyncFileState, OfflineSyncSnapshot, OfflineSyncFileRecord, OfflineSyncFileContentChunk, OfflineSyncApplyFileContentChunkResult, OfflineSyncApplyChangesetResult } from './offline-sync.js';
-import { RecallXraySnapshot } from './recall-xray.js';
-import { Readable, Writable } from 'node:stream';
 import { withHeldFileLock } from './utils/serialize-mutations.js';
 import { ExportCapsuleOptions, ExportCapsuleResult } from './transfer/capsule-export.js';
-import { ImportCapsuleOptions, ImportCapsuleResult } from './transfer/capsule-import.js';
 import './access-errors.js';
 
 /**
@@ -321,6 +321,10 @@ interface ProcedureStatsReport {
     counts: ProcedureStatusCounts;
     recent: ProcedureStatsRecent;
     config: ProcedureStatsConfigSnapshot;
+    /** ISO timestamp of the last library-maintenance run marker, or null (issue #2370). */
+    lastMaintenanceAt: string | null;
+    /** Active procedures currently carrying a `needsRepair` flag (issue #2370). */
+    needsRepairFlags: number;
 }
 /**
  * Read all memories from storage and tally procedures by status + recency.
@@ -337,6 +341,98 @@ declare function computeProcedureStats(options: {
  */
 declare function formatProcedureStatsText(report: ProcedureStatsReport): string;
 
+/**
+ * Procedure library health maintenance (issue #2370).
+ *
+ * The library-health loop the agent-memory survey describes: consume the
+ * telemetry Remnic already records (Memory Worth counters, access
+ * timestamps, causal trajectories) and propose merge / repair-flag /
+ * retire transitions for ACTIVE procedure memories.
+ *
+ * Shadow-first contract (mirrors `memory_governance_run`): the default run
+ * mode produces a JSON report and writes NOTHING — not even the run
+ * marker. Applying requires `apply: true` AND
+ * `procedural.maintenance.enabled: true`.
+ *
+ * Actions, evaluated in this order per run:
+ *   1. Merge   — cluster active procedures by normalized trigger phrase +
+ *                step signature; most-recently-updated member becomes the
+ *                canonical, the rest are superseded pointing at it. The
+ *                canonical is stamped with the issue-#687 frontmatter
+ *                contract (`reinforcement_count`, `last_reinforced_at`,
+ *                `derived_via`, `derived_from`) so `patterns explain` reads
+ *                procedure canonicals unchanged. A user-edited body never
+ *                merges — the cluster is flagged instead.
+ *   2. Repair  — flag (never rewrite) procedures whose `ProcedureStep`
+ *                toolCall tools no longer appear in recent causal
+ *                trajectories, via `structuredAttributes.needsRepair`.
+ *   3. Retire  — demote to `archived` when failure-dominant past the
+ *                configured thresholds, or idle past `retireIdleDays` with
+ *                zero recorded outcomes. Demotion, never deletion; page
+ *                versioning snapshots every overwrite. User-edited
+ *                procedures are exempt and flagged instead.
+ *
+ * Deliberately NOT part of `runMemoryGovernance` — same isolation decision
+ * as procedure mining (docs/procedural-memory.md).
+ */
+
+type ProcedureLibraryStorage = {
+    readAllMemories: () => Promise<MemoryFile[]>;
+    writeMemoryFrontmatter: (memory: MemoryFile, patch: Record<string, unknown>, extras?: Record<string, unknown>) => Promise<unknown>;
+    archiveMemory: (memory: MemoryFile, opts: {
+        at: Date;
+        actor: string;
+        reasonCode: string;
+        ruleVersion?: string;
+        relatedMemoryIds?: string[];
+    }) => Promise<string | null>;
+};
+type ProcedureMaintenanceActionKind = "merge" | "retire" | "flag_repair" | "flag_user_edited";
+type ProcedureMaintenanceReasonCode = "merge_duplicate_signature" | "retire_failure_dominant" | "retire_idle" | "needs_repair_stale_tools" | "user_edited_protected";
+interface ProcedureMaintenanceEvidence {
+    memoryId: string;
+    mwSuccess: number;
+    mwFail: number;
+    lastAccessed: string | null;
+    updated: string | null;
+}
+interface ProcedureMaintenanceAction {
+    action: ProcedureMaintenanceActionKind;
+    reasonCode: ProcedureMaintenanceReasonCode;
+    /** Canonical first for merges; otherwise the single targeted memory. */
+    memoryIds: string[];
+    canonicalId?: string;
+    reason: string;
+    evidence: ProcedureMaintenanceEvidence[];
+}
+interface ProcedureLibraryMaintenanceReport {
+    schemaVersion: 1;
+    generatedAt: string;
+    mode: "shadow" | "apply";
+    scannedProcedures: number;
+    proposed: ProcedureMaintenanceAction[];
+    applied: ProcedureMaintenanceAction[];
+    appliedCount: number;
+    skippedReason?: "procedural_disabled" | "maintenance_disabled";
+}
+interface ProcedureMaintenanceMarker {
+    schemaVersion: 1;
+    lastRunAt: string;
+    lastApplyAt: string | null;
+    appliedCount: number;
+}
+/**
+ * Run one library-health maintenance pass over the procedures in a storage.
+ * Shadow mode performs NO writes (not even the state marker).
+ */
+declare function runProcedureLibraryMaintenance(options: {
+    storage: ProcedureLibraryStorage;
+    memoryDir: string;
+    config: PluginConfig;
+    apply?: boolean;
+    now?: Date;
+}): Promise<ProcedureLibraryMaintenanceReport>;
+
 interface ConsoleBufferState {
     /** Number of turns currently held in the default buffer slot. */
     turnsCount: number;
@@ -933,24 +1029,24 @@ declare const SupportPassportDraftCardSchema: z.ZodEffects<z.ZodObject<{
     category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
     sourceMemoryIds: z.ZodArray<z.ZodString, "many">;
 }, "strict", z.ZodTypeAny, {
+    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     title: string;
     sourceMemoryIds: string[];
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     statement: string;
 }, {
+    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     title: string;
     sourceMemoryIds: string[];
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     statement: string;
 }>, {
+    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     title: string;
     sourceMemoryIds: string[];
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     statement: string;
 }, {
+    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     title: string;
     sourceMemoryIds: string[];
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
     statement: string;
 }>;
 declare const SupportPassportDraftOutputSchema: z.ZodObject<{
@@ -960,38 +1056,38 @@ declare const SupportPassportDraftOutputSchema: z.ZodObject<{
         category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
         sourceMemoryIds: z.ZodArray<z.ZodString, "many">;
     }, "strict", z.ZodTypeAny, {
+        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         title: string;
         sourceMemoryIds: string[];
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         statement: string;
     }, {
+        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         title: string;
         sourceMemoryIds: string[];
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         statement: string;
     }>, {
+        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         title: string;
         sourceMemoryIds: string[];
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         statement: string;
     }, {
+        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         title: string;
         sourceMemoryIds: string[];
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         statement: string;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
     cards: {
+        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         title: string;
         sourceMemoryIds: string[];
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         statement: string;
     }[];
 }, {
     cards: {
+        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         title: string;
         sourceMemoryIds: string[];
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
         statement: string;
     }[];
 }>;
@@ -1037,20 +1133,20 @@ declare const SupportPassportAnswerOutputSchema: z.ZodEffects<z.ZodObject<{
     citedCardIds: z.ZodArray<z.ZodString, "many">;
     coverage: z.ZodEnum<["grounded", "not_in_guide"]>;
 }, "strict", z.ZodTypeAny, {
-    answer: string;
     coverage: "grounded" | "not_in_guide";
+    answer: string;
     citedCardIds: string[];
 }, {
-    answer: string;
     coverage: "grounded" | "not_in_guide";
+    answer: string;
     citedCardIds: string[];
 }>, {
-    answer: string;
     coverage: "grounded" | "not_in_guide";
+    answer: string;
     citedCardIds: string[];
 }, {
-    answer: string;
     coverage: "grounded" | "not_in_guide";
+    answer: string;
     citedCardIds: string[];
 }>;
 declare const SupportPassportAnswerModelInputSchema: z.ZodObject<{
@@ -1066,38 +1162,38 @@ declare const SupportPassportAnswerModelInputSchema: z.ZodObject<{
             category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
             updatedAt: z.ZodEffects<z.ZodString, string, string>;
         }, "strict", z.ZodTypeAny, {
-            title: string;
             category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+            title: string;
             updatedAt: string;
             cardId: string;
             statement: string;
         }, {
-            title: string;
             category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+            title: string;
             updatedAt: string;
             cardId: string;
             statement: string;
         }>, "many">;
     }, "strict", z.ZodTypeAny, {
-        schemaVersion: 1;
         expiresAt: string;
+        schemaVersion: 1;
         updatedAt: string;
         grantId: string;
         cards: {
-            title: string;
             category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+            title: string;
             updatedAt: string;
             cardId: string;
             statement: string;
         }[];
     }, {
-        schemaVersion: 1;
         expiresAt: string;
+        schemaVersion: 1;
         updatedAt: string;
         grantId: string;
         cards: {
-            title: string;
             category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+            title: string;
             updatedAt: string;
             cardId: string;
             statement: string;
@@ -1107,13 +1203,13 @@ declare const SupportPassportAnswerModelInputSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     question: string;
     guide: {
-        schemaVersion: 1;
         expiresAt: string;
+        schemaVersion: 1;
         updatedAt: string;
         grantId: string;
         cards: {
-            title: string;
             category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+            title: string;
             updatedAt: string;
             cardId: string;
             statement: string;
@@ -1122,13 +1218,13 @@ declare const SupportPassportAnswerModelInputSchema: z.ZodObject<{
 }, {
     question: string;
     guide: {
-        schemaVersion: 1;
         expiresAt: string;
+        schemaVersion: 1;
         updatedAt: string;
         grantId: string;
         cards: {
-            title: string;
             category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+            title: string;
             updatedAt: string;
             cardId: string;
             statement: string;
@@ -1226,6 +1322,285 @@ declare class SupportPassportModelAdapter {
     private invokeRoute;
 }
 
+type ReviewDeckChoice = "keep" | "prepare_fix" | "not_true";
+type ReviewDeckRisk = "reversible";
+interface ReviewDeckEvidence {
+    sourceMemoryId?: string;
+    sourceDate?: string;
+    excerpt?: string;
+    relation: "supports" | "conflicts" | "origin";
+}
+interface ReviewDeckItem {
+    schemaVersion: 1;
+    itemId: string;
+    source: "review";
+    sourceId: string;
+    memoryId?: string;
+    content: string;
+    category?: string;
+    lifecycleState?: string;
+    confidence?: number;
+    confidenceTier?: string;
+    reviewReason: string;
+    reviewReasonLabel: string;
+    supportCount: number;
+    provenance: readonly ReviewDeckEvidence[];
+    allowedChoices: readonly ReviewDeckChoice[];
+    choiceRisk: Readonly<Record<ReviewDeckChoice, ReviewDeckRisk | "unavailable">>;
+    namespace: string;
+    revision: string;
+}
+interface ReviewDeckPage {
+    schemaVersion: 1;
+    items: readonly ReviewDeckItem[];
+    nextCursor?: string;
+    total: number;
+}
+type ReviewDeckActionRequest = {
+    schemaVersion: 1;
+    itemId: string;
+    revision: string;
+    action: "keep" | "not_true";
+    idempotencyKey: string;
+} | {
+    schemaVersion: 1;
+    itemId: string;
+    revision: string;
+    action: "prepare_fix";
+    correctionText: string;
+    idempotencyKey: string;
+};
+interface ReviewDeckActionReceipt {
+    schemaVersion: 1;
+    receiptId: string;
+    itemId: string;
+    action: "keep" | "not_true" | "prepare_fix" | "undo";
+    outcome: "planned" | "applied" | "conflict" | "failed";
+    effect: string;
+    undoAvailable: boolean;
+    appliedRevision?: string;
+    correctionPlanId?: string;
+    correctionPreview?: unknown;
+}
+interface ReviewDeckUndoRequest {
+    schemaVersion: 1;
+    receiptId: string;
+    expectedRevision: string;
+    idempotencyKey: string;
+}
+interface ReviewDeckSourceRow {
+    itemId: string;
+    filePath: string;
+    fileContent: string;
+    revision: string;
+    content: string;
+    category?: string;
+    confidence?: number;
+    confidenceTier?: string;
+    reviewReason: string;
+    created: string;
+    source?: string;
+    blockedBy?: string;
+    lifecycleState?: string;
+    context?: string;
+}
+interface ReviewDeckSnapshot {
+    corpusVersion: string;
+    total: number;
+    rows: readonly ReviewDeckSourceRow[];
+}
+interface ReviewDeckCursorScope {
+    principalDigest: string;
+    namespace: string;
+    filterDigest: string;
+    corpusVersion: string;
+}
+declare class ReviewDeckCursorError extends Error {
+    constructor(message?: string);
+}
+declare function computeReviewItemRevision(fileContent: string): string;
+declare function projectReviewDeckItem(row: ReviewDeckSourceRow, namespace: string): ReviewDeckItem;
+declare function compareReviewDeckRows(a: ReviewDeckSourceRow, b: ReviewDeckSourceRow): number;
+declare function encodeReviewDeckCursor(scope: ReviewDeckCursorScope, lastSortKey: string): string;
+declare function decodeReviewDeckCursor(cursor: string, scope: ReviewDeckCursorScope): string;
+declare function buildReviewDeckPage(rows: readonly ReviewDeckSourceRow[], opts: {
+    scope: ReviewDeckCursorScope;
+    cursor?: string;
+    limit: number;
+}): ReviewDeckPage;
+
+interface ReviewDeckSurfaceDeps {
+    readonly orchestrator: Orchestrator;
+    resolveReadableNamespace(namespace: string | undefined, principal?: string): string;
+    writableNamespaceFor(namespace: string | undefined, sessionKey: string | undefined, authenticatedPrincipal?: string): string;
+    correctionPlan(request: CorrectionRequest, opts?: {
+        abortSignal?: AbortSignal;
+    }): Promise<CorrectionPlan>;
+}
+declare class ReviewDeckSurface {
+    private readonly deps;
+    constructor(deps: ReviewDeckSurfaceDeps);
+    list(opts: {
+        namespace?: string;
+        principal?: string;
+        cursor?: string;
+        limit: number;
+    }): Promise<ReviewDeckPage>;
+    action(req: ReviewDeckActionRequest, opts: {
+        namespace?: string;
+        principal?: string;
+        signal?: AbortSignal;
+    }): Promise<ReviewDeckActionReceipt>;
+    undo(req: ReviewDeckUndoRequest, opts: {
+        namespace?: string;
+        principal?: string;
+        signal?: AbortSignal;
+    }): Promise<ReviewDeckActionReceipt>;
+    private mutationContext;
+}
+
+/**
+ * Single input-validation and error boundary for the CLI/MCP/HTTP access
+ * surfaces (issue #1525, epic #1520 Phase 1).
+ *
+ * Every operation that crosses the access-service facade passes through ONE
+ * registry entry: a zod-validated request envelope, a shared error mapper,
+ * and the "reject invalid input and list valid options" behavior that
+ * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented
+ * per handler. The three surfaces become thin adapters — one operation
+ * definition, three transports — so a validation fix lands everywhere at
+ * once.
+ *
+ * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`
+ * prefix. Session/namespace tenancy stays in the handler layer (resolved via
+ * ScopePlan #1521); the boundary validates SHAPE, not tenancy.
+ */
+
+/**
+ * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,
+ * and the CLI command that expose the same operation. Add to this union as
+ * each domain-group migration PR (memory ops → connectors → namespaces …)
+ * lands; the fitness test in `access-surface-catalog.test.ts` treats the
+ * registered set as the migration state.
+ */
+declare const OPERATION_NAMES: readonly ["memory_get", "memory_search", "external_wiki_search", "memory_store", "coding_decision", "coding_architecture", "codegraph_index", "codegraph_list_projects", "codegraph_delete_project", "codegraph_index_status", "codegraph_search_graph", "codegraph_trace_path", "codegraph_detect_changes", "codegraph_query_graph", "codegraph_get_schema", "codegraph_get_snippet", "codegraph_get_architecture", "codegraph_search_code", "codegraph_manage_adr", "codegraph_ingest_traces", "memory_correct_plan", "memory_correct_apply", "coding_delta", "recall", "recall_explain", "set_coding_context", "recall_tier_explain", "recall_xray", "who_knows", "promotion_candidates", "namespace_writable", "wearables_status", "wearables_sync", "transcript_day", "transcript_search", "transcript_memories", "meetings_list", "meetings_get", "meetings_build", "action_confidence", "chatgpt_memory_inspector", "day_summary", "capsule_export", "capsule_import", "capsule_list", "memory_governance_run", "entity_synthesis_run", "procedure_mining_run", "pattern_reinforcement_run", "procedural_stats", "procedure_library_maintenance", "memory_timeline", "suggestion_submit", "entity_get", "review_queue_list", "correction_pending", "observe", "lcm_search", "lcm_compaction_flush", "extraction_force_flush", "lcm_compaction_record", "continuity_audit_generate", "continuity_incident_open", "continuity_incident_close", "continuity_incident_list", "continuity_loop_add_or_update", "continuity_loop_review", "identity_anchor_get", "identity_anchor_update", "memory_identity", "work_task", "work_project", "work_board", "shared_context_write_output", "shared_feedback_record", "shared_priorities_append", "relay_mission_append", "relay_mission_read", "shared_context_cross_signals_run", "shared_context_curate_daily", "compounding_weekly_synthesize", "compounding_promote_candidate", "compression_guidelines_optimize", "compression_guidelines_activate", "memory_profile", "memory_entities_list", "memory_questions", "memory_last_recall", "memory_intent_debug", "memory_qmd_debug", "memory_graph_explain", "graph_snapshot", "memory_feedback", "memory_promote", "memory_outcome", "memory_action_apply", "context_checkpoint", "briefing", "review_list", "review_resolve", "contradiction_scan_run", "preference_drift_scan", "memory_summarize_hourly", "conversation_index_update", "profiling_report", "graph_edge_decay_run", "live_connectors_run", "peer_list", "peer_get", "peer_set", "peer_delete", "peer_profile_get", "peer_forget", "console_state", "dreams_status", "dreams_run", "support_passport_memory_preview", "support_passport_cards_list", "support_passport_draft_create", "support_passport_drafts_generate", "support_passport_card_replace", "support_passport_card_approve", "support_passport_card_reject", "support_passport_card_withdraw", "support_passport_grant_create", "support_passport_grants_list", "support_passport_grant_revoke", "support_passport_grant_read", "support_passport_grant_ask", "adapters_status", "offline_sync_snapshot", "offline_sync_snapshot_stream", "offline_sync_files", "offline_sync_file_content", "offline_sync_apply_file_content", "offline_sync_apply", "lcm_status", "memory_list", "recall_timings", "entity_list", "maintenance_status", "quality_status", "trust_zones_status", "trust_zones_records", "review_disposition", "review_deck_list", "review_deck_action", "review_deck_undo", "trust_zones_promote", "trust_zones_demo_seed", "citations_observed", "contradiction_detail", "graph_events", "chat_message", "chat_events"];
+/**
+ * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,
+ * and the CLI command that expose the same operation. Derived from
+ * {@link OPERATION_NAMES} (single source of truth) so the runtime catalog
+ * used for token-capability validation cannot drift from the type. The
+ * fitness test in `access-surface-catalog.test.ts` treats the registered set
+ * as the migration state.
+ */
+type OperationName = (typeof OPERATION_NAMES)[number];
+/**
+ * Per-call context. `service` is the facade the handler delegates to; the
+ * boundary never reaches past it. `authenticatedPrincipal` is resolved by
+ * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary
+ * runs, so handlers stay principal-source-agnostic. `hooks` carries
+ * transport-level callbacks (e.g. HTTP write-quota enforcement) that must
+ * fire atomically inside the service call; surfaces that have no such hook
+ * leave it undefined.
+ */
+interface OperationContext {
+    readonly service: EngramAccessService;
+    readonly authenticatedPrincipal?: string;
+    readonly operatorPrincipal?: string;
+    /** Per-request cancellation supplied by transports that own a request lifecycle. */
+    readonly abortSignal?: AbortSignal;
+    /** Server-resolved connector identity (Phase 1 provenance). Set by the HTTP auth boundary from the matched token's connector; flows to write handlers so frontmatter records which connector submitted the memory. Client-supplied values are always overridden. */
+    readonly sourceConnector?: string;
+    readonly hooks?: OperationHooks;
+}
+/**
+ * Transport-level callbacks a handler forwards into the service call. Kept
+ * narrow on purpose: the boundary owns validation + dispatch shape, not
+ * transport policy. Add fields here only when a surface genuinely needs a
+ * callback the service itself consumes.
+ */
+interface OperationHooks {
+    /** HTTP write-quota gate; throws to reject the write when exhausted. */
+    readonly enforceWriteQuota?: () => void | Promise<void>;
+    /** Commit-boundary accounting for writes that can fail after durability. */
+    readonly recordWriteCommit?: () => void;
+}
+interface OperationSpec<In, Out> {
+    /** Canonical operation id; matches an {@link OperationName}. */
+    readonly name: OperationName;
+    readonly description: string;
+    /** Zod schema validating the raw request envelope. */
+    readonly schema: z.ZodType<In>;
+    /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */
+    readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;
+    /**
+     * Marks an operation as inherently FLEET-WIDE / global — it runs across ALL
+     * namespaces (or against a single non-namespaced global layer) and carries no
+     * `namespace` argument, so the MCP `tools/call` effective-namespace chokepoint
+     * never applies. When set, {@link defineOperation}'s run wrapper rejects any
+     * namespace-SCOPED token (fail closed) via assertFleetWideOperationAllowed
+     * BEFORE the handler — no side effect on denial. Unrestricted/legacy tokens
+     * (cron, internal callers, no capability record) are unaffected (issue #1850).
+     */
+    readonly fleetWide?: boolean;
+    /**
+     * Alternate op allow-list: when set, the token may invoke this operation if
+     * its ops allow-list permits ANY of these ops (instead of the default rule
+     * that requires the op's own {@link name}). Lets a read-only diagnostic be
+     * granted by the write ops it diagnoses — e.g. `namespace_writable` is
+     * runnable by any token permitted to `observe`/`memory_store`, so a token
+     * minted before the diagnostic op existed can still call it. Unrestricted /
+     * legacy tokens (no ops axis) are unaffected. Keeps the boundary and any HTTP
+     * transport for the same op enforcing ONE policy.
+     */
+    readonly allowedByOps?: readonly OperationName[];
+}
+interface BoundOperation<In = unknown, Out = unknown> {
+    readonly spec: OperationSpec<In, Out>;
+    /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */
+    readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;
+}
+/**
+ * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans
+ * and the string spellings clients send ("true"/"false"/"1"/"0"/"yes"/"no"/
+ * "on"/"off", case-insensitive). Rejects anything else loudly — `Boolean("false")`
+ * would silently be `true`, which is the bug rule 36 exists to prevent.
+ *
+ * `undefined`/`null`/`""` → `undefined`, so callers can keep treating an
+ * absent flag as "use the default" without a separate presence check.
+ */
+declare function coerceBooleanLike(value: unknown): boolean | undefined;
+/**
+ * Coerce + validate a positive integer from a numeric string or number
+ * (rule 28). Loosely-typed MCP/CLI clients send `"5"`; `typeof saved === "number"`
+ * on read-back would reject it later, so we coerce at the edge and reject
+ * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).
+ *
+ * `undefined`/`null`/`""` → `undefined`.
+ */
+declare function coercePositiveInteger(value: unknown, label: string): number | undefined;
+/**
+ * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;
+ * ad-hoc regex drifts. `undefined`/`null`/`""` → `undefined`.
+ */
+declare function normalizeOptionalPath(value: unknown): string | undefined;
+/**
+ * Turn a zod failure into an {@link EngramAccessInputError} whose message
+ * names the offending field and — for enum/union issues — lists the valid
+ * options, so the caller can correct rather than guess (rule 51).
+ */
+declare function formatZodIssues(error: z.ZodError): string;
+declare function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out>;
+/** Look up a registered operation by canonical name. */
+declare function getOperation(name: OperationName): BoundOperation | undefined;
+/** Whether a probe must authorize an operation's effective namespace. */
+declare function operationRequiresAuthorizedNamespace(name: OperationName): boolean;
+/** Whether an operation resolves its namespace from the authenticated principal. */
+declare function operationUsesPrincipalNamespace(name: OperationName): boolean;
+/** All registered operation names. */
+declare function listRegisteredOperations(): readonly OperationName[];
+/** Test-only: clear the registry so pilot definitions can be re-registered. */
+declare function __resetRegistryForTest(): void;
+
 declare const SUPPORT_PASSPORT_CARD_CATEGORIES: readonly ["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"];
 declare const SUPPORT_PASSPORT_CARD_STATUSES: readonly ["pending_review", "active", "rejected", "superseded", "archived"];
 declare const SupportPassportCardCategorySchema: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
@@ -1245,23 +1620,23 @@ declare const SupportPassportCardSchema: z.ZodObject<{
     reviewBy: z.ZodEffects<z.ZodString, string, string>;
     revision: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    title: string;
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
+    title: string;
     updatedAt: string;
+    revision: string;
     cardId: string;
     statement: string;
     reviewBy: string;
-    revision: string;
 }, {
-    title: string;
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
+    title: string;
     updatedAt: string;
+    revision: string;
     cardId: string;
     statement: string;
     reviewBy: string;
-    revision: string;
 }>;
 declare const SupportPassportCardListSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
     cardId: z.ZodString;
@@ -1273,41 +1648,41 @@ declare const SupportPassportCardListSchema: z.ZodEffects<z.ZodArray<z.ZodObject
     reviewBy: z.ZodEffects<z.ZodString, string, string>;
     revision: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    title: string;
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
+    title: string;
     updatedAt: string;
+    revision: string;
     cardId: string;
     statement: string;
     reviewBy: string;
-    revision: string;
 }, {
-    title: string;
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
+    title: string;
     updatedAt: string;
+    revision: string;
     cardId: string;
     statement: string;
     reviewBy: string;
-    revision: string;
 }>, "many">, {
-    title: string;
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
+    title: string;
     updatedAt: string;
+    revision: string;
     cardId: string;
     statement: string;
     reviewBy: string;
-    revision: string;
 }[], {
-    title: string;
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
+    title: string;
     updatedAt: string;
+    revision: string;
     cardId: string;
     statement: string;
     reviewBy: string;
-    revision: string;
 }[]>;
 declare const SupportPassportListCardsInputSchema: z.ZodObject<{
     principal: z.ZodString;
@@ -1323,14 +1698,14 @@ declare const SupportPassportManualDraftInputSchema: z.ZodObject<{
     category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
     reviewBy: z.ZodEffects<z.ZodString, string, string>;
 }, "strict", z.ZodTypeAny, {
-    title: string;
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    title: string;
     statement: string;
     reviewBy: string;
     principal: string;
 }, {
-    title: string;
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    title: string;
     statement: string;
     reviewBy: string;
     principal: string;
@@ -1362,8 +1737,8 @@ declare const SupportPassportReplaceCardInputSchema: z.ZodObject<{
     category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
     reviewBy: z.ZodEffects<z.ZodString, string, string>;
 }, "strict", z.ZodTypeAny, {
-    title: string;
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    title: string;
     cardId: string;
     statement: string;
     reviewBy: string;
@@ -1371,8 +1746,8 @@ declare const SupportPassportReplaceCardInputSchema: z.ZodObject<{
     expectedRevision: string;
     reasonCode?: string | undefined;
 }, {
-    title: string;
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    title: string;
     cardId: string;
     statement: string;
     reviewBy: string;
@@ -1403,11 +1778,11 @@ declare const SupportPassportGrantCardRefSchema: z.ZodObject<{
     cardId: z.ZodString;
     revision: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    cardId: string;
     revision: string;
-}, {
     cardId: string;
+}, {
     revision: string;
+    cardId: string;
 }>;
 declare const SupportPassportGrantStateSchema: z.ZodEffects<z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
@@ -1421,73 +1796,73 @@ declare const SupportPassportGrantStateSchema: z.ZodEffects<z.ZodObject<{
         cardId: z.ZodString;
         revision: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        cardId: string;
         revision: string;
-    }, {
         cardId: string;
+    }, {
         revision: string;
+        cardId: string;
     }>, "many">;
     createdAt: z.ZodEffects<z.ZodString, string, string>;
     expiresAt: z.ZodEffects<z.ZodString, string, string>;
     revokedAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strict", z.ZodTypeAny, {
-    schemaVersion: 1;
+    namespace: string;
     createdAt: string;
     expiresAt: string;
-    namespace: string;
+    schemaVersion: 1;
     stateVersion: number;
     grantId: string;
     principalHash: string;
     ownerLockKey: string;
     secretHash: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     revokedAt?: string | undefined;
 }, {
-    schemaVersion: 1;
+    namespace: string;
     createdAt: string;
     expiresAt: string;
-    namespace: string;
+    schemaVersion: 1;
     stateVersion: number;
     grantId: string;
     principalHash: string;
     ownerLockKey: string;
     secretHash: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     revokedAt?: string | undefined;
 }>, {
-    schemaVersion: 1;
+    namespace: string;
     createdAt: string;
     expiresAt: string;
-    namespace: string;
+    schemaVersion: 1;
     stateVersion: number;
     grantId: string;
     principalHash: string;
     ownerLockKey: string;
     secretHash: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     revokedAt?: string | undefined;
 }, {
-    schemaVersion: 1;
+    namespace: string;
     createdAt: string;
     expiresAt: string;
-    namespace: string;
+    schemaVersion: 1;
     stateVersion: number;
     grantId: string;
     principalHash: string;
     ownerLockKey: string;
     secretHash: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     revokedAt?: string | undefined;
 }>;
@@ -1497,43 +1872,43 @@ declare const SupportPassportCreateGrantInputSchema: z.ZodEffects<z.ZodObject<{
         cardId: z.ZodString;
         revision: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        cardId: string;
         revision: string;
-    }, {
         cardId: string;
+    }, {
         revision: string;
+        cardId: string;
     }>, "many">;
     expiresAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     durationMs: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     principal: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }, {
     principal: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }>, {
     principal: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }, {
     principal: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
@@ -1544,43 +1919,43 @@ declare const SupportPassportCreateGrantRequestSchema: z.ZodEffects<z.ZodObject<
         cardId: z.ZodString;
         revision: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        cardId: string;
         revision: string;
-    }, {
         cardId: string;
+    }, {
         revision: string;
+        cardId: string;
     }>, "many">;
     expiresAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     durationMs: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }>, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
@@ -1591,43 +1966,43 @@ declare const SupportPassportOwnerCreateGrantRequestSchema: z.ZodEffects<z.ZodOb
         cardId: z.ZodString;
         revision: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        cardId: string;
         revision: string;
-    }, {
         cardId: string;
+    }, {
         revision: string;
+        cardId: string;
     }>, "many">;
     expiresAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     durationMs: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }>, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
 }, {
     cardIds: string[];
     cardRevisions: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     durationMs?: number | undefined;
     expiresAt?: string | undefined;
@@ -1639,36 +2014,36 @@ declare const SupportPassportOwnerGrantSchema: z.ZodObject<{
         cardId: z.ZodString;
         revision: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        cardId: string;
         revision: string;
-    }, {
         cardId: string;
+    }, {
         revision: string;
+        cardId: string;
     }>, "many">;
     createdAt: z.ZodEffects<z.ZodString, string, string>;
     expiresAt: z.ZodEffects<z.ZodString, string, string>;
     revokedAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     status: z.ZodEnum<["active", "expired", "revoked"]>;
 }, "strict", z.ZodTypeAny, {
-    status: "active" | "expired" | "revoked";
     createdAt: string;
     expiresAt: string;
+    status: "active" | "expired" | "revoked";
     stateVersion: number;
     grantId: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     revokedAt?: string | undefined;
 }, {
-    status: "active" | "expired" | "revoked";
     createdAt: string;
     expiresAt: string;
+    status: "active" | "expired" | "revoked";
     stateVersion: number;
     grantId: string;
     cards: {
-        cardId: string;
         revision: string;
+        cardId: string;
     }[];
     revokedAt?: string | undefined;
 }>;
@@ -1680,36 +2055,36 @@ declare const SupportPassportCreatedGrantSchema: z.ZodObject<{
             cardId: z.ZodString;
             revision: z.ZodString;
         }, "strict", z.ZodTypeAny, {
-            cardId: string;
             revision: string;
-        }, {
             cardId: string;
+        }, {
             revision: string;
+            cardId: string;
         }>, "many">;
         createdAt: z.ZodEffects<z.ZodString, string, string>;
         expiresAt: z.ZodEffects<z.ZodString, string, string>;
         revokedAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         status: z.ZodEnum<["active", "expired", "revoked"]>;
     }, "strict", z.ZodTypeAny, {
-        status: "active" | "expired" | "revoked";
         createdAt: string;
         expiresAt: string;
+        status: "active" | "expired" | "revoked";
         stateVersion: number;
         grantId: string;
         cards: {
-            cardId: string;
             revision: string;
+            cardId: string;
         }[];
         revokedAt?: string | undefined;
     }, {
-        status: "active" | "expired" | "revoked";
         createdAt: string;
         expiresAt: string;
+        status: "active" | "expired" | "revoked";
         stateVersion: number;
         grantId: string;
         cards: {
-            cardId: string;
             revision: string;
+            cardId: string;
         }[];
         revokedAt?: string | undefined;
     }>;
@@ -1717,28 +2092,28 @@ declare const SupportPassportCreatedGrantSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     secret: string;
     grant: {
-        status: "active" | "expired" | "revoked";
         createdAt: string;
         expiresAt: string;
+        status: "active" | "expired" | "revoked";
         stateVersion: number;
         grantId: string;
         cards: {
-            cardId: string;
             revision: string;
+            cardId: string;
         }[];
         revokedAt?: string | undefined;
     };
 }, {
     secret: string;
     grant: {
-        status: "active" | "expired" | "revoked";
         createdAt: string;
         expiresAt: string;
+        status: "active" | "expired" | "revoked";
         stateVersion: number;
         grantId: string;
         cards: {
-            cardId: string;
             revision: string;
+            cardId: string;
         }[];
         revokedAt?: string | undefined;
     };
@@ -1750,14 +2125,14 @@ declare const SupportPassportPublicCardSchema: z.ZodObject<{
     category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
     updatedAt: z.ZodEffects<z.ZodString, string, string>;
 }, "strict", z.ZodTypeAny, {
-    title: string;
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    title: string;
     updatedAt: string;
     cardId: string;
     statement: string;
 }, {
-    title: string;
     category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+    title: string;
     updatedAt: string;
     cardId: string;
     statement: string;
@@ -1774,38 +2149,38 @@ declare const SupportPassportPublicGuideSchema: z.ZodObject<{
         category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
         updatedAt: z.ZodEffects<z.ZodString, string, string>;
     }, "strict", z.ZodTypeAny, {
-        title: string;
         category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+        title: string;
         updatedAt: string;
         cardId: string;
         statement: string;
     }, {
-        title: string;
         category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+        title: string;
         updatedAt: string;
         cardId: string;
         statement: string;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
-    schemaVersion: 1;
     expiresAt: string;
+    schemaVersion: 1;
     updatedAt: string;
     grantId: string;
     cards: {
-        title: string;
         category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+        title: string;
         updatedAt: string;
         cardId: string;
         statement: string;
     }[];
 }, {
-    schemaVersion: 1;
     expiresAt: string;
+    schemaVersion: 1;
     updatedAt: string;
     grantId: string;
     cards: {
-        title: string;
         category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
+        title: string;
         updatedAt: string;
         cardId: string;
         statement: string;
@@ -1869,14 +2244,14 @@ declare const SupportPassportModelAuditRecordSchema: z.ZodEffects<z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     schemaVersion: 1;
     outcome: "error" | "success";
+    latencyMs: number;
     modelUsed: string;
     operation: "draft_cards" | "answer_question";
     route: "unavailable" | "direct" | "local" | "gateway";
-    latencyMs: number;
-    occurredAt: string;
     actorHash: string;
     subjectIdsHash: string;
     outputSchemaVersion: 1;
+    occurredAt: string;
     usage?: {
         inputTokens?: number | undefined;
         outputTokens?: number | undefined;
@@ -1886,14 +2261,14 @@ declare const SupportPassportModelAuditRecordSchema: z.ZodEffects<z.ZodObject<{
 }, {
     schemaVersion: 1;
     outcome: "error" | "success";
+    latencyMs: number;
     modelUsed: string;
     operation: "draft_cards" | "answer_question";
     route: "unavailable" | "direct" | "local" | "gateway";
-    latencyMs: number;
-    occurredAt: string;
     actorHash: string;
     subjectIdsHash: string;
     outputSchemaVersion: 1;
+    occurredAt: string;
     usage?: {
         inputTokens?: number | undefined;
         outputTokens?: number | undefined;
@@ -1903,14 +2278,14 @@ declare const SupportPassportModelAuditRecordSchema: z.ZodEffects<z.ZodObject<{
 }>, {
     schemaVersion: 1;
     outcome: "error" | "success";
+    latencyMs: number;
     modelUsed: string;
     operation: "draft_cards" | "answer_question";
     route: "unavailable" | "direct" | "local" | "gateway";
-    latencyMs: number;
-    occurredAt: string;
     actorHash: string;
     subjectIdsHash: string;
     outputSchemaVersion: 1;
+    occurredAt: string;
     usage?: {
         inputTokens?: number | undefined;
         outputTokens?: number | undefined;
@@ -1920,14 +2295,14 @@ declare const SupportPassportModelAuditRecordSchema: z.ZodEffects<z.ZodObject<{
 }, {
     schemaVersion: 1;
     outcome: "error" | "success";
+    latencyMs: number;
     modelUsed: string;
     operation: "draft_cards" | "answer_question";
     route: "unavailable" | "direct" | "local" | "gateway";
-    latencyMs: number;
-    occurredAt: string;
     actorHash: string;
     subjectIdsHash: string;
     outputSchemaVersion: 1;
+    occurredAt: string;
     usage?: {
         inputTokens?: number | undefined;
         outputTokens?: number | undefined;
@@ -2113,6 +2488,7 @@ type McpTool = {
  * header and reject requests advertising an unknown version.
  */
 declare const MCP_SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+declare const MCP_MIGRATED_OPERATIONS: Readonly<Record<string, OperationName>>;
 declare class EngramMcpServer {
     private readonly service;
     private buffer;
@@ -2332,6 +2708,137 @@ declare function handleWhoKnowsHttpQuery(deps: {
     }) => Promise<WhoKnowsResult>;
 }): Promise<WhoKnowsHttpOutcome>;
 
+/**
+ * Memory subject: user-centric vs agent-centric classification (issue #2372).
+ *
+ * Scope says WHERE a memory lives; subject says WHOM it is about — and that
+ * is what determines where it may safely go. `user` memories model one
+ * person (preferences, relationships, biography, moments, commitments);
+ * `agent` memories model how to operate (procedures, principles,
+ * tool-usage lessons, debugging strategies, environment facts with no
+ * personal content).
+ *
+ * This module owns, in one place:
+ *  - the deterministic write-time classification (category defaults with an
+ *    optional extractor override),
+ *  - the promotion guard shared by EVERY promotion surface (spaces promote
+ *    AND scope-profile promotion targets — AGENTS.md §27 uniform gating),
+ *  - read-only promotion-candidate surfacing (reuse-signaled agent-subject
+ *    memories with no equivalent in the target layer), and
+ *  - the deterministic backfill pass (shadow/apply, no LLM).
+ */
+
+declare const SUBJECT_VALUES: readonly ["user", "agent"];
+declare const SUBJECT_GUARD_MODES: readonly ["off", "warn", "enforce"];
+/** The CLI / per-call override that permits a user-subject promotion. */
+declare const SUBJECT_GUARD_OVERRIDE_FLAG = "--allow-user-subject";
+declare function isMemorySubject(value: unknown): value is MemorySubject;
+declare function isSubjectGuardMode(value: unknown): value is SubjectGuardMode;
+declare function subjectDefaultForCategory(category: MemoryCategory): MemorySubject;
+/**
+ * Resolve the write-time subject: the extractor's single-token value when it
+ * emitted a valid one, else the category default. Never reclassifies on read.
+ */
+declare function resolveWriteSubject(category: MemoryCategory, extractorValue: unknown): MemorySubject;
+/** Scope-profile promotion targets that are shared layers. */
+declare function isSharedPromotionTarget(target: string): boolean;
+interface SubjectGuardDecision {
+    action: "allow" | "warn" | "reject";
+    /** Effective subject — an absent subject resolves to "user" (fail closed, §36). */
+    effectiveSubject: MemorySubject;
+    /** Structured reason; empty string when action === "allow". */
+    reason: string;
+    /** The override that permits this promotion when action is reject/warn. */
+    override: typeof SUBJECT_GUARD_OVERRIDE_FLAG;
+}
+/**
+ * Evaluate one promotion against the subject guard. Shared by the spaces
+ * promotion workflow and the scope-profile promotion targets so the two
+ * surfaces cannot drift (issue #2372 acceptance 2, AGENTS.md §27).
+ *
+ *  - mode "off", non-shared targets, agent-subject memories, and explicit
+ *    `allowUserSubject` overrides all allow.
+ *  - a `user`-subject memory (or a memory with NO subject — fail closed)
+ *    promoted to a shared layer warns under "warn" and rejects under
+ *    "enforce", with the override named in the reason (§39: never a silent
+ *    accept).
+ */
+declare function evaluateSubjectGuard(params: {
+    subject: MemorySubject | undefined;
+    sharedTarget: boolean;
+    mode: SubjectGuardMode;
+    allowUserSubject?: boolean;
+}): SubjectGuardDecision;
+type PromotionReuseSignal = "reinforcement" | "memory_worth" | "access_count";
+interface PromotionCandidate {
+    id: string;
+    path: string;
+    category: MemoryCategory;
+    content: string;
+    accessCount: number;
+    reinforcementCount: number;
+    mwSuccess: number;
+    mwFail: number;
+    reuseSignal: PromotionReuseSignal;
+}
+/** Default reuse-signal threshold for `accessCount` (config `promotionCandidates.minAccessCount`). */
+declare const PROMOTION_CANDIDATES_DEFAULT_MIN_ACCESS = 3;
+/** Canonical content form for target-equivalence checks (same normalize pipeline as dedup). */
+declare function promotionCandidateKey(content: string): string;
+/**
+ * List `subject: "agent"` memories that (a) are active, (b) show a reuse
+ * signal (`reinforcement_count > 0` OR `mw_success > mw_fail` OR
+ * `accessCount >= minAccessCount`), and (c) have no equivalent already in
+ * the promotion target layer (content-hash check via the dedup normalizer).
+ * Pure over the two memory lists; callers resolve namespaces.
+ */
+declare function computePromotionCandidates(options: {
+    memories: MemoryFile[];
+    targetMemories: MemoryFile[];
+    minAccessCount: number;
+    limit?: number;
+}): PromotionCandidate[];
+interface PromotionCandidatesResult {
+    namespace: string;
+    targetNamespace: string;
+    minAccessCount: number;
+    candidates: PromotionCandidate[];
+}
+declare const PROMOTION_CANDIDATES_MCP_TOOLS: McpTool[];
+/**
+ * Storage surface the backfill needs (mirrors pattern-reinforcement's
+ * structural interface so tests can pass an in-memory stub).
+ * `writeMemoryFrontmatter` invalidates caches and syncs the fact-hash index
+ * (§25/§31), so a stamped memory is immediately discoverable.
+ */
+interface SubjectBackfillStorage {
+    readAllMemories(): Promise<MemoryFile[]>;
+    writeMemoryFrontmatter(memory: MemoryFile, patch: Partial<MemoryFile["frontmatter"]>): Promise<boolean>;
+}
+interface SubjectBackfillReport {
+    mode: "shadow" | "apply";
+    scanned: number;
+    stamped: number;
+    alreadyStamped: number;
+    stamps: Array<{
+        id: string;
+        category: MemoryCategory;
+        subject: MemorySubject;
+        path: string;
+    }>;
+}
+/**
+ * Stamp `subject` on memories that have none, using ONLY the deterministic
+ * category defaults (never an LLM, never reclassifying an existing subject —
+ * issue #2372 §1.3). `shadow` reports the intended stamps without writing;
+ * `apply` writes through `writeMemoryFrontmatter`, which invalidates the
+ * memory caches and re-syncs the fact-hash index.
+ */
+declare function backfillMemorySubjects(options: {
+    storage: SubjectBackfillStorage;
+    mode: "shadow" | "apply";
+}): Promise<SubjectBackfillReport>;
+
 declare abstract class SupportPassportAccessServiceBase {
     private _supportPassportSurface;
     abstract get configRef(): PluginConfig;
@@ -3061,6 +3568,7 @@ declare class EngramAccessService extends SupportPassportAccessServiceBase {
     private readonly corpusWatermarkCache;
     private readonly replicaDivergenceMonitor;
     private readonly injectedSupportPassportGatewayRoute;
+    readonly reviewDeckEnabled: boolean;
     /** AccessObserveWriteSurface (access-service decomposition). Lazy; selfDeps live wiring. */
     private _accessObserveWriteSurface;
     private get accessObserveWriteSurface();
@@ -3070,6 +3578,8 @@ declare class EngramAccessService extends SupportPassportAccessServiceBase {
     /** AccessAdminOpsSurface (access-service decomposition). Lazy; selfDeps live wiring. */
     private _accessAdminOpsSurface;
     private get accessAdminOpsSurface();
+    private _reviewDeckSurface;
+    private get reviewDeckSurface();
     /** AccessRecallSurface (access-service decomposition). Lazy; selfDeps live wiring. */
     private _accessRecallSurface;
     private get accessRecallSurface();
@@ -3080,6 +3590,7 @@ declare class EngramAccessService extends SupportPassportAccessServiceBase {
     constructor(orchestrator: Orchestrator, options?: {
         resolveSecretRef?: ResolveSecretRefFn | null;
         supportPassportGatewayRoute?: SupportPassportModelRoute | null;
+        reviewDeckEnabled?: boolean;
     });
     get supportPassportGatewayRouteRef(): SupportPassportModelRoute | null;
     get briefingEnabled(): boolean;
@@ -3264,6 +3775,18 @@ declare class EngramAccessService extends SupportPassportAccessServiceBase {
         namespace?: string;
         authenticatedPrincipal?: string;
     }): Promise<WhoKnowsResult>;
+    /**
+     * Read-only promotion-candidate surfacing (issue #2372): agent-subject,
+     * active, reuse-signaled memories in the caller's namespace with no
+     * equivalent in the target layer. No auto-promotion — callers use the
+     * existing promotion commands.
+     */
+    promotionCandidates(request: {
+        namespace?: string;
+        targetNamespace?: string;
+        limit?: number;
+        authenticatedPrincipal?: string;
+    }): Promise<PromotionCandidatesResult>;
     memoryStore(request: EngramAccessMemoryStoreRequest, hooks?: {
         enforceWriteQuota?: () => void | Promise<void>;
     }): Promise<EngramAccessWriteResponse>;
@@ -3445,6 +3968,28 @@ declare class EngramAccessService extends SupportPassportAccessServiceBase {
     }, principal?: string): Promise<ProcedureStatsReport & {
         namespace: string;
     }>;
+    /**
+     * Procedure library health maintenance (issue #2370). Shadow-first: the
+     * gate is checked BEFORE any storage read, so `maintenance.enabled=false`
+     * returns `{ enabled: false }` having touched nothing but config. Apply
+     * mode additionally requires `apply: true`; `dryRun: true` forces shadow.
+     *
+     * The authenticated principal (never a client-supplied actor) drives the
+     * namespace via the same writable resolver `procedureMiningRun` uses, so
+     * cross-tenant writes are impossible.
+     */
+    procedureLibraryMaintenance(request: {
+        namespace?: string;
+        apply?: boolean;
+        dryRun?: boolean;
+        authenticatedPrincipal?: string;
+    }, principal?: string): Promise<{
+        enabled: false;
+    } | {
+        enabled: true;
+        namespace: string;
+        report: ProcedureLibraryMaintenanceReport;
+    }>;
     memorySummarizeHourly(): Promise<{
         ok: true;
         message: string;
@@ -4083,6 +4628,9 @@ declare class EngramAccessService extends SupportPassportAccessServiceBase {
         reason: string;
         actor?: never;
     }): Promise<MemoryPromotionResult>;
+    reviewDeckList(opts: Parameters<ReviewDeckSurface["list"]>[0]): Promise<ReviewDeckPage>;
+    reviewDeckAction(...args: Parameters<ReviewDeckSurface["action"]>): Promise<ReviewDeckActionReceipt>;
+    reviewDeckUndo(...args: Parameters<ReviewDeckSurface["undo"]>): Promise<ReviewDeckActionReceipt>;
 }
 
-export { type SupportPassportAnswerOutput as $, type AccessProfilingReportRequest as A, type CodegraphSurfaceResponse as B, type CodingScopedWriteInput as C, type DecisionSurfaceRequest as D, type EngramAccessReviewQueueResponse as E, type EngramAccessRecallResponse as F, type EngramAccessRecallRequest as G, type EngramAccessMemorySummary as H, type EngramAccessSetCodingContextRequest as I, type McpTool as J, EngramMcpServer as K, type ProcedureStatsRecent as L, type MemoryPromotionTargetKind as M, type ProcedureStatsReport as N, type ProcedureStatusCounts as O, type ProcedureStatsConfigSnapshot as P, SUPPORT_PASSPORT_CARD_STATUSES as Q, SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS as R, SUPPORT_PASSPORT_CARD_CATEGORIES as S, SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES as T, SUPPORT_PASSPORT_NOT_IN_GUIDE_ANSWER as U, SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH as V, type WhoKnowsResult as W, SupportPassportAccessSurface as X, type SupportPassportAccessSurfaceDependencies as Y, type SupportPassportAnswerModelInput as Z, SupportPassportAnswerModelInputSchema as _, type AccessProfilingReportResponse as a, SupportPassportReplaceCardInputSchema as a$, SupportPassportAnswerOutputSchema as a0, type SupportPassportAnswerResult as a1, type SupportPassportCard as a2, type SupportPassportCardCategory as a3, SupportPassportCardCategorySchema as a4, SupportPassportCardListSchema as a5, type SupportPassportCardMutationInput as a6, SupportPassportCardMutationInputSchema as a7, SupportPassportCardSchema as a8, type SupportPassportCardServiceDependencies as a9, SupportPassportMemoryIdSchema as aA, type SupportPassportMemoryPreview as aB, SupportPassportModelAdapter as aC, type SupportPassportModelAdapterOptions as aD, type SupportPassportModelAuditRecord as aE, SupportPassportModelAuditRecordSchema as aF, type SupportPassportModelAuditSink as aG, SupportPassportModelAuditStore as aH, SupportPassportModelCallError as aI, type SupportPassportModelClients as aJ, type SupportPassportModelFailureMetadata as aK, type SupportPassportModelMessage as aL, type SupportPassportModelResultMetadata as aM, type SupportPassportModelRoute as aN, type SupportPassportModelRouteKind as aO, type SupportPassportModelRouteResult as aP, type SupportPassportModelUsage as aQ, SupportPassportNamespaceSchema as aR, type SupportPassportOwnerCreateGrantRequest as aS, SupportPassportOwnerCreateGrantRequestSchema as aT, type SupportPassportOwnerGrant as aU, SupportPassportOwnerGrantSchema as aV, type SupportPassportOwnerScope as aW, SupportPassportPublicCardSchema as aX, type SupportPassportPublicGuide as aY, SupportPassportPublicGuideSchema as aZ, type SupportPassportReplaceCardInput as a_, type SupportPassportCardStatus as aa, SupportPassportCardStatusSchema as ab, SupportPassportCardTitleSchema as ac, type SupportPassportCreateGrantInput as ad, SupportPassportCreateGrantInputSchema as ae, type SupportPassportCreateGrantRequest as af, SupportPassportCreateGrantRequestSchema as ag, type SupportPassportCreateGrantResult as ah, type SupportPassportCreatedGrant as ai, SupportPassportCreatedGrantSchema as aj, type SupportPassportDraftCard as ak, SupportPassportDraftCardSchema as al, type SupportPassportDraftModelInput as am, SupportPassportDraftModelInputSchema as an, SupportPassportDraftOutputSchema as ao, type SupportPassportDraftResult as ap, SupportPassportError as aq, type SupportPassportErrorCode as ar, type SupportPassportGrantCardRef as as, SupportPassportGrantCardRefSchema as at, type SupportPassportGrantState as au, SupportPassportGrantStateSchema as av, SupportPassportListCardsInputSchema as aw, SupportPassportListGrantsInputSchema as ax, type SupportPassportManualDraftInput as ay, SupportPassportManualDraftInputSchema as az, type EngramAccessCapsuleListResponse as b, type EngramAccessScopeDebug as b$, type SupportPassportRevokeGrantInput as b0, SupportPassportRevokeGrantInputSchema as b1, type SupportPassportRevokeGrantResult as b2, SupportPassportSourceMemoryIdSchema as b3, WHO_KNOWS_AUTHORSHIP_BONUS as b4, WHO_KNOWS_DEFAULT_LIMIT as b5, WHO_KNOWS_MAX_EVIDENCE as b6, WHO_KNOWS_MAX_LIMIT as b7, WHO_KNOWS_MCP_TOOLS as b8, type WhoKnowsEntity as b9, type EngramAccessEntityResponse as bA, type EngramAccessEntitySummary as bB, type EngramAccessLcmCompactionRecordRequest as bC, type EngramAccessLcmStatusResponse as bD, type EngramAccessMaintenanceResponse as bE, type EngramAccessMemoryBrowseRequest as bF, type EngramAccessMemoryBrowseResponse as bG, type EngramAccessMemoryRecord as bH, type EngramAccessObserveMessage as bI, type EngramAccessOfflineSyncApplyFileContentRequest as bJ, type EngramAccessOfflineSyncApplyFileContentResponse as bK, type EngramAccessOfflineSyncApplyRequest as bL, type EngramAccessOfflineSyncApplyResponse as bM, type EngramAccessOfflineSyncFileContentRequest as bN, type EngramAccessOfflineSyncFileContentResponse as bO, type EngramAccessOfflineSyncFilesRequest as bP, type EngramAccessOfflineSyncFilesResponse as bQ, type EngramAccessOfflineSyncFinalizeConvergenceRequest as bR, type EngramAccessOfflineSyncFinalizeConvergenceResponse as bS, type EngramAccessOfflineSyncManifestRequest as bT, type EngramAccessOfflineSyncSnapshotRequest as bU, type EngramAccessOfflineSyncSnapshotResponse as bV, type EngramAccessQualityResponse as bW, type EngramAccessRecallExplainRequest as bX, type EngramAccessRecallExplainResponse as bY, type EngramAccessReviewDispositionRequest as bZ, type EngramAccessReviewDispositionResponse as b_, type WhoKnowsEvidence as ba, type WhoKnowsHit as bb, type WhoKnowsHttpOutcome as bc, type WhoKnowsStorage as bd, acceptsSupportPassportModelResponse as be, buildSupportPassportDirectGatewayConfig as bf, computeProcedureStats as bg, computeSupportPassportCardRevision as bh, computeWhoKnows as bi, createSupportPassportModelAdapter as bj, formatProcedureStatsText as bk, handleWhoKnowsHttpQuery as bl, hashSupportPassportAuditValues as bm, loadWhoKnowsEntities as bn, resolveSupportPassportModelRoutePlan as bo, tokenizeTopic as bp, validateWhoKnowsInput as bq, type EngramAccessLcmCompactionFlushRequest as br, type ExtractionForceFlushDelegate as bs, delegateExtractionForceFlush as bt, MCP_SUPPORTED_PROTOCOL_VERSIONS as bu, ENGRAM_ACCESS_WRITE_SCHEMA_VERSION as bv, type EngramAccessActionConfidenceRequest as bw, type EngramAccessActionConfidenceResponse as bx, type EngramAccessDaySummaryRequest as by, type EngramAccessEntityListResponse as bz, type MemoryPromotionResult as c, type EngramAccessTimelineResponse as c0, type EngramAccessTrustZoneBrowseRequest as c1, type EngramAccessTrustZoneBrowseResponse as c2, type EngramAccessTrustZoneDemoSeedRequest as c3, type EngramAccessTrustZoneDemoSeedResponse as c4, type EngramAccessTrustZonePromoteRequest as c5, type EngramAccessTrustZonePromoteResponse as c6, type EngramAccessTrustZoneRecordSummary as c7, type EngramAccessTrustZoneStatusResponse as c8, type EngramAccessWriteEnvelope as c9, buildProjectedGovernanceProposedActions as ca, hasGroupedGovernanceActions as cb, shapeMemorySummary as cc, type EngramAccessExtractionForceFlushRequest as d, type EngramAccessExtractionForceFlushResponse as e, EngramAccessService as f, type EngramAccessLcmCompactionFlushResponse as g, type EngramAccessLcmCompactionRecordResponse as h, type EngramAccessOfflineSyncSnapshotStreamResponse as i, type EngramAccessLcmSearchRequest as j, type EngramAccessLcmSearchResponse as k, type MemoryScopePlan as l, type EngramAccessMemoryStoreRequest as m, type EngramAccessSuggestionSubmitRequest as n, type EngramAccessBriefingRequest as o, type EngramAccessBriefingResponse as p, type EngramAccessWriteResponse as q, type EngramAccessObserveRequest as r, type EngramAccessObserveResponse as s, type ArchitectureSurfaceRequest as t, type ArchitectureSurfaceResponse as u, type DecisionSurfaceResponse as v, type DeltaSurfaceRequest as w, type DeltaSurfaceResponse as x, type EngramAccessMemoryResponse as y, type CodegraphSurfaceRequest as z };
+export { type ProcedureMaintenanceReasonCode as $, type AccessProfilingReportRequest as A, type BoundOperation as B, type CodingScopedWriteInput as C, type DecisionSurfaceRequest as D, type EngramAccessReviewQueueResponse as E, type CodegraphSurfaceResponse as F, type EngramAccessRecallResponse as G, type EngramAccessRecallRequest as H, type EngramAccessMemorySummary as I, type EngramAccessSetCodingContextRequest as J, type McpTool as K, type ReviewDeckSnapshot as L, type MemoryPromotionTargetKind as M, EngramMcpServer as N, type OperationName as O, type PromotionCandidatesResult as P, OPERATION_NAMES as Q, type ReviewDeckSourceRow as R, type SubjectBackfillReport as S, PROMOTION_CANDIDATES_DEFAULT_MIN_ACCESS as T, PROMOTION_CANDIDATES_MCP_TOOLS as U, type ProcedureLibraryMaintenanceReport as V, type WhoKnowsResult as W, type ProcedureMaintenanceAction as X, type ProcedureMaintenanceActionKind as Y, type ProcedureMaintenanceEvidence as Z, type ProcedureMaintenanceMarker as _, type AccessProfilingReportResponse as a, SupportPassportGrantStateSchema as a$, type ProcedureStatsConfigSnapshot as a0, type ProcedureStatsRecent as a1, type ProcedureStatsReport as a2, type ProcedureStatusCounts as a3, type PromotionCandidate as a4, type PromotionReuseSignal as a5, type ReviewDeckActionReceipt as a6, type ReviewDeckActionRequest as a7, type ReviewDeckChoice as a8, ReviewDeckCursorError as a9, SupportPassportCardCategorySchema as aA, SupportPassportCardListSchema as aB, type SupportPassportCardMutationInput as aC, SupportPassportCardMutationInputSchema as aD, SupportPassportCardSchema as aE, type SupportPassportCardServiceDependencies as aF, type SupportPassportCardStatus as aG, SupportPassportCardStatusSchema as aH, SupportPassportCardTitleSchema as aI, type SupportPassportCreateGrantInput as aJ, SupportPassportCreateGrantInputSchema as aK, type SupportPassportCreateGrantRequest as aL, SupportPassportCreateGrantRequestSchema as aM, type SupportPassportCreateGrantResult as aN, type SupportPassportCreatedGrant as aO, SupportPassportCreatedGrantSchema as aP, type SupportPassportDraftCard as aQ, SupportPassportDraftCardSchema as aR, type SupportPassportDraftModelInput as aS, SupportPassportDraftModelInputSchema as aT, SupportPassportDraftOutputSchema as aU, type SupportPassportDraftResult as aV, SupportPassportError as aW, type SupportPassportErrorCode as aX, type SupportPassportGrantCardRef as aY, SupportPassportGrantCardRefSchema as aZ, type SupportPassportGrantState as a_, type ReviewDeckCursorScope as aa, type ReviewDeckEvidence as ab, type ReviewDeckItem as ac, type ReviewDeckPage as ad, type ReviewDeckRisk as ae, type ReviewDeckUndoRequest as af, SUBJECT_GUARD_MODES as ag, SUBJECT_GUARD_OVERRIDE_FLAG as ah, SUBJECT_VALUES as ai, SUPPORT_PASSPORT_CARD_CATEGORIES as aj, SUPPORT_PASSPORT_CARD_STATUSES as ak, SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS as al, SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES as am, SUPPORT_PASSPORT_NOT_IN_GUIDE_ANSWER as an, SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH as ao, type SubjectBackfillStorage as ap, type SubjectGuardDecision as aq, SupportPassportAccessSurface as ar, type SupportPassportAccessSurfaceDependencies as as, type SupportPassportAnswerModelInput as at, SupportPassportAnswerModelInputSchema as au, type SupportPassportAnswerOutput as av, SupportPassportAnswerOutputSchema as aw, type SupportPassportAnswerResult as ax, type SupportPassportCard as ay, type SupportPassportCardCategory as az, type EngramAccessCapsuleListResponse as b, isMemorySubject as b$, SupportPassportListCardsInputSchema as b0, SupportPassportListGrantsInputSchema as b1, type SupportPassportManualDraftInput as b2, SupportPassportManualDraftInputSchema as b3, SupportPassportMemoryIdSchema as b4, type SupportPassportMemoryPreview as b5, SupportPassportModelAdapter as b6, type SupportPassportModelAdapterOptions as b7, type SupportPassportModelAuditRecord as b8, SupportPassportModelAuditRecordSchema as b9, WHO_KNOWS_AUTHORSHIP_BONUS as bA, WHO_KNOWS_DEFAULT_LIMIT as bB, WHO_KNOWS_MAX_EVIDENCE as bC, WHO_KNOWS_MAX_LIMIT as bD, WHO_KNOWS_MCP_TOOLS as bE, type WhoKnowsEntity as bF, type WhoKnowsEvidence as bG, type WhoKnowsHit as bH, type WhoKnowsHttpOutcome as bI, type WhoKnowsStorage as bJ, acceptsSupportPassportModelResponse as bK, backfillMemorySubjects as bL, buildReviewDeckPage as bM, buildSupportPassportDirectGatewayConfig as bN, compareReviewDeckRows as bO, computeProcedureStats as bP, computePromotionCandidates as bQ, computeReviewItemRevision as bR, computeSupportPassportCardRevision as bS, computeWhoKnows as bT, createSupportPassportModelAdapter as bU, decodeReviewDeckCursor as bV, encodeReviewDeckCursor as bW, evaluateSubjectGuard as bX, formatProcedureStatsText as bY, handleWhoKnowsHttpQuery as bZ, hashSupportPassportAuditValues as b_, type SupportPassportModelAuditSink as ba, SupportPassportModelAuditStore as bb, SupportPassportModelCallError as bc, type SupportPassportModelClients as bd, type SupportPassportModelFailureMetadata as be, type SupportPassportModelMessage as bf, type SupportPassportModelResultMetadata as bg, type SupportPassportModelRoute as bh, type SupportPassportModelRouteKind as bi, type SupportPassportModelRouteResult as bj, type SupportPassportModelUsage as bk, SupportPassportNamespaceSchema as bl, type SupportPassportOwnerCreateGrantRequest as bm, SupportPassportOwnerCreateGrantRequestSchema as bn, type SupportPassportOwnerGrant as bo, SupportPassportOwnerGrantSchema as bp, type SupportPassportOwnerScope as bq, SupportPassportPublicCardSchema as br, type SupportPassportPublicGuide as bs, SupportPassportPublicGuideSchema as bt, type SupportPassportReplaceCardInput as bu, SupportPassportReplaceCardInputSchema as bv, type SupportPassportRevokeGrantInput as bw, SupportPassportRevokeGrantInputSchema as bx, type SupportPassportRevokeGrantResult as by, SupportPassportSourceMemoryIdSchema as bz, type MemoryPromotionResult as c, type EngramAccessTrustZoneBrowseRequest as c$, isSharedPromotionTarget as c0, isSubjectGuardMode as c1, loadWhoKnowsEntities as c2, projectReviewDeckItem as c3, promotionCandidateKey as c4, resolveSupportPassportModelRoutePlan as c5, resolveWriteSubject as c6, runProcedureLibraryMaintenance as c7, subjectDefaultForCategory as c8, tokenizeTopic as c9, type EngramAccessLcmCompactionRecordRequest as cA, type EngramAccessLcmStatusResponse as cB, type EngramAccessMaintenanceResponse as cC, type EngramAccessMemoryBrowseRequest as cD, type EngramAccessMemoryBrowseResponse as cE, type EngramAccessMemoryRecord as cF, type EngramAccessObserveMessage as cG, type EngramAccessOfflineSyncApplyFileContentRequest as cH, type EngramAccessOfflineSyncApplyFileContentResponse as cI, type EngramAccessOfflineSyncApplyRequest as cJ, type EngramAccessOfflineSyncApplyResponse as cK, type EngramAccessOfflineSyncFileContentRequest as cL, type EngramAccessOfflineSyncFileContentResponse as cM, type EngramAccessOfflineSyncFilesRequest as cN, type EngramAccessOfflineSyncFilesResponse as cO, type EngramAccessOfflineSyncFinalizeConvergenceRequest as cP, type EngramAccessOfflineSyncFinalizeConvergenceResponse as cQ, type EngramAccessOfflineSyncManifestRequest as cR, type EngramAccessOfflineSyncSnapshotRequest as cS, type EngramAccessOfflineSyncSnapshotResponse as cT, type EngramAccessQualityResponse as cU, type EngramAccessRecallExplainRequest as cV, type EngramAccessRecallExplainResponse as cW, type EngramAccessReviewDispositionRequest as cX, type EngramAccessReviewDispositionResponse as cY, type EngramAccessScopeDebug as cZ, type EngramAccessTimelineResponse as c_, validateWhoKnowsInput as ca, type EngramAccessLcmCompactionFlushRequest as cb, type ExtractionForceFlushDelegate as cc, delegateExtractionForceFlush as cd, type OperationContext as ce, type OperationHooks as cf, type OperationSpec as cg, __resetRegistryForTest as ch, coerceBooleanLike as ci, coercePositiveInteger as cj, defineOperation as ck, formatZodIssues as cl, getOperation as cm, listRegisteredOperations as cn, normalizeOptionalPath as co, operationRequiresAuthorizedNamespace as cp, operationUsesPrincipalNamespace as cq, MCP_MIGRATED_OPERATIONS as cr, MCP_SUPPORTED_PROTOCOL_VERSIONS as cs, ENGRAM_ACCESS_WRITE_SCHEMA_VERSION as ct, type EngramAccessActionConfidenceRequest as cu, type EngramAccessActionConfidenceResponse as cv, type EngramAccessDaySummaryRequest as cw, type EngramAccessEntityListResponse as cx, type EngramAccessEntityResponse as cy, type EngramAccessEntitySummary as cz, type EngramAccessExtractionForceFlushRequest as d, type EngramAccessTrustZoneBrowseResponse as d0, type EngramAccessTrustZoneDemoSeedRequest as d1, type EngramAccessTrustZoneDemoSeedResponse as d2, type EngramAccessTrustZonePromoteRequest as d3, type EngramAccessTrustZonePromoteResponse as d4, type EngramAccessTrustZoneRecordSummary as d5, type EngramAccessTrustZoneStatusResponse as d6, type EngramAccessWriteEnvelope as d7, buildProjectedGovernanceProposedActions as d8, hasGroupedGovernanceActions as d9, shapeMemorySummary as da, type EngramAccessExtractionForceFlushResponse as e, EngramAccessService as f, type EngramAccessLcmCompactionFlushResponse as g, type EngramAccessLcmCompactionRecordResponse as h, type EngramAccessOfflineSyncSnapshotStreamResponse as i, type EngramAccessLcmSearchRequest as j, type EngramAccessLcmSearchResponse as k, type MemoryScopePlan as l, type EngramAccessMemoryStoreRequest as m, type EngramAccessSuggestionSubmitRequest as n, type EngramAccessBriefingRequest as o, type EngramAccessBriefingResponse as p, type EngramAccessWriteResponse as q, type EngramAccessObserveRequest as r, type EngramAccessObserveResponse as s, type ArchitectureSurfaceRequest as t, type ArchitectureSurfaceResponse as u, type DecisionSurfaceResponse as v, type DeltaSurfaceRequest as w, type DeltaSurfaceResponse as x, type EngramAccessMemoryResponse as y, type CodegraphSurfaceRequest as z };