@securecoms/agent-bridge 0.26.6 → 0.28.0

package/dist/bridge-agent.d.ts

@@ -33,6 +33,9 @@ import { type OwnerAuthorityStore, type OwnerPin } from "@agentvault/connect-cli
 import type { BridgeConfig } from "./config.js";
 import { LatencyRecorder } from "./latency.js";
 import type { AttachmentMeta, VaultRefEntry } from "./attachments.js";
+import { type Embedder } from "./memory/embedder/client.js";
+import { type RecallItem, type RecallTapCapture } from "./memory/recall/recall-book.js";
+import { type MemoryNoteResultFrame } from "./memory/note-frames.js";
 import { type ChatMessage } from "./voice/fast-prompt.js";
 import { VOICE_CALL_START_MARKER } from "./voice/prompt-compiler.js";
 import { type VaultListNode, type VaultReadExpectations } from "./vault.js";
@@ -114,7 +117,54 @@ export interface BridgeAuthorization {
      * audience owner_dm or on this mark, nothing else.
      */
     readonly relay_speaker?: "owner";
+    /**
+     * Markdown memory 7a (spec §8.3, OQ-B): true ONLY on authorizationFor's
+     * ownerDirect branch with memoryProvider "securecoms": the channel's pinned
+     * owner (never "anomalous") typed this turn in their DM, the roster is
+     * fresh at the held epoch and group (or the DM is cycle-fresh), and the
+     * owner-DM kill switch is on. Present only when true. An OFFER HINT: the
+     * bridge's W1 to W8 are the gate. Never set on the ownerRelayed branch
+     * (OQ-C, Eric approved 2026-10-06): voice turns read notes, never write,
+     * and never on any turn with a relay speaker claim (review I-1).
+     * NOT a tool grant: it is not, and must never be, in `tool_grants`.
+     * Reaches only the per-tool runtime consumer: withConsumerGrants strips it
+     * for a harness socket and the HTTP/SSE paths (review m-3).
+     */
+    readonly memory_write?: true;
 }
+/**
+ * Spec §8.2: what ws-server tells applyMemoryNote about the socket a
+ * memory_note frame arrived on. Read live: W2 is re-evaluated after awaits.
+ */
+export interface MemoryNoteContext {
+    /**
+     * THIS socket's in-flight record for a message id (the original, never the
+     * consumer copy) and the token of that delivery. A nack, backoff and
+     * redelivery on the same socket reuses the record object but gets a new
+     * token (review m-1).
+     */
+    lookup(messageId: string): {
+        record: BridgeMessage;
+        token: number;
+    } | undefined;
+    /** The socket's own session facts (OQ-J): consumer and the sticky harness claim. */
+    readonly session: {
+        readonly consumer: "runtime" | "unknown";
+        readonly harnessClaimed?: boolean;
+    };
+    /** The delivery token of the frame's message id, captured when the frame arrived; undefined when not in flight. */
+    token: number | undefined;
+    /** Per-socket request ids still being decided (M-2). At most MAX_PENDING_NOTE_REQUESTS (review m-3). */
+    pendingRequests: Set<string>;
+    /**
+     * 7b spec §9.1 (H5): the recall ids shown with THIS socket's delivery of `messageId` that carries
+     * `token`, else undefined. Task 18 fix round 1 (M2): the caller passes `ctx.token`, the token captured
+     * when the frame ARRIVED, never the token read after an await.
+     */
+    shownRecall(messageId: string, token: number | undefined): ReadonlySet<number> | undefined;
+}
+/** Review m-3: pending memory_note requests per socket; a frame beyond this refuses `invalid` with no echo. */
+export declare const MAX_PENDING_NOTE_REQUESTS = 8;
 export interface BridgeMessage {
     channel_id: string;
     message_id: string;
@@ -142,6 +192,27 @@ export interface BridgeMessage {
      * @mention filter reads (not recomputed differently).
      */
     sender_is_agent?: boolean;
+    /**
+     * Audit r2 N-L3 (PR-1): this turn is a voice transcript. W8 never quotes
+     * such a record. Present only when true. Set when either holds:
+     *   - the turn is relay-attributed (`speaker` set). `speaker` is honoured
+     *     only from a sender the server roster marks `is_relay`, so on this path
+     *     the mark does not depend on the body. The room relay's `sendTurn`
+     *     (connect-room-relay/src/turns.ts) also sets `transcribed: true`, and
+     *     the hosted voice worker reaches the bridge only through that relay;
+     *   - the E2E body says `transcribed: true`. The owner's own web client sets
+     *     it on an on-device transcript (connect-web MessagingShell.tsx
+     *     `sendConfirmedVoiceToChannel`, reached from CallPanel's
+     *     `sendAgentMessage` via `confirmedSendBody`).
+     * LIMITATION (spec §15): on the owner-device path the mark is an
+     * UNAUTHENTICATED claim in the body. A modified or legacy client, or a
+     * device added under the owner's identity by a compromised server (the
+     * ADR-0010 gap), can send speech-derived text without it, and the bridge
+     * then treats it as typed. That adds no capability (the sender could type
+     * the same words), so the mark is fail-closed but not a cryptographic
+     * guarantee.
+     */
+    transcribed?: true;
     /**
      * Track 5: materialized attachment metadata for `artifact_share` messages.
      * Each entry corresponds to one downloaded+decrypted file saved to disk.
@@ -251,6 +322,26 @@ export interface BridgeAgentDeps {
      * it undefined and gets homedir().
      */
     home?: string;
+    /**
+     * 7b Task 15: the embedder. Tests inject a fake. Undefined in the production construction (`hostMachine`, no
+     * `home`) builds the real EmbedderClient; undefined anywhere else gets INERT_EMBEDDER, so no test reaches a real one
+     * (Task 19 fix M2: a test that injects neither no longer builds a real client on the developer's homedir()).
+     */
+    embedder?: Embedder;
+    /**
+     * 7b Task 19 fix M2: true only in the production construction (bin.ts). This agent owns machine-level state under
+     * homedir(): the call heartbeat (~/.securecoms/run/voice-call), the model marker and GC (~/.securecoms/models) and
+     * the one-second maintenance timer that drives them. A test that injects `home` gets the same, under its temp home.
+     * A construction with neither (most direct test constructions) touches none of those paths.
+     *
+     * Library callers: omit it and semantic recall stays inert (INERT_EMBEDDER: the report says `preparing` or
+     * `off`, no model is downloaded or loaded, no call heartbeat is written and other bridges' background work is
+     * never paused by this one). Pass `true` only for the one process per agent that should own those paths, as
+     * bin.ts does. host-machine.arch.test.ts pins bin.ts as the only production construction.
+     */
+    hostMachine?: boolean;
+    /** 7b Task 15 (E1 delta M5): injected platform, default process.platform. */
+    platform?: NodeJS.Platform;
     /** Injectable so tests can assert recorded stages; defaults to a fresh one. */
     latency?: LatencyRecorder;
     /**
@@ -1063,10 +1154,113 @@ export declare class BridgeAgent {
     /** The ONE follow-up cycle every trigger during the in-flight cycle shares. */
     private ingestFollowUp;
     private runtimeConfigTimer?;
+    /** Semantic memory 7b (spec §5.4, audit r2 H-A): the hourly left-channel purge. */
+    private membershipSweepTimer?;
+    /** 7b Task 15 (spec §5.3): the hourly recall prune, modelled on the membership sweep. */
+    private recallPruneTimer?;
+    private recallPruneWork;
+    private readonly platform;
+    private readonly embedder;
+    /** 7b Task 16: the recall index (the single writer, I8: reached only from tapRecall). */
+    private readonly recall;
+    /** 7b Task 19 (spec §8, H1, ruling P-1): this identity's call heartbeat, and every identity's for the pause. */
+    private readonly heartbeat;
+    /** 7b Task 19 (spec §8): lazy re-embed of pending rows (never an insert; I8 untouched). */
+    private readonly reembed;
+    /** 7b Task 19: the one-second maintenance timer (heartbeat refresh, re-embed, daily marker and GC). */
+    private recallMaintenanceTimer?;
+    private recallMaintenanceWork;
+    private maintenanceTickN;
+    /** The previous re-embed tick did work: poll again next second instead of waiting for the minute. */
+    private reembedHot;
+    private lastModelUpkeepAt;
+    /** Fix L3: the marker is touched on the first tick with recall on, then daily, independent of the GC cadence. */
+    private lastMarkerTouchAt;
+    /** Fix M2: BridgeAgentDeps.hostMachine, or an injected home (see there). */
+    private readonly machinePaths;
+    /** Spec §19 LOW (Federal pre-flight notice): logged once per process. */
+    private modelDownloadNoticeLogged;
+    /**
+     * 7b Task 16 (spec §4 M1, fix H-1): turns restored from runtime_inbox at
+     * boot AND turns the boot drain ingested before the boot refetch settled;
+     * tapped once by reindexRestoredTurns after it.
+     */
+    private readonly deferredRecallIds;
+    /** 7b fix H-2: recall epochs captured at receipt in the ingest cycle, consumed by stageSealed (cleared at cycle end). */
+    private readonly recallReceipt;
+    /** 7b fix H-2: the persisted receipt epochs of each staged turn (like ingestGeneration; deleted at ack). */
+    private readonly recallStageEpochs;
+    /** 7b Task 16: in-flight fire-and-forget index taps; close() waits for them (bounded). */
+    private readonly recallTapWork;
+    /**
+     * Final-review item 2: conversations whose `audience` skip was already logged in this process. A room (or any
+     * conversation the owner-DM gate refuses) refuses every turn the same way, so the line is written once per
+     * conversation per process, not once per inbound message. Bounded: cleared when it reaches 4096 entries.
+     */
+    private readonly recallAudienceLogged;
+    /** Off until a payload arrives (spec §5.3: before the first payload of a process, recall neither indexes nor reads nor purges). */
+    private recallConfig;
+    /** The membership sweep now running, if any; close() waits for it (bounded). */
+    private membershipSweepWork;
+    /** Task 13 fix round LOW 3: when each channel last delivered an inbound row to this process. */
+    private readonly lastInboundAt;
+    private readonly membershipSweeper;
     private readonly listeners;
     private startedAt;
     private readonly store;
     private readonly memory;
+    /**
+     * Markdown memory 7a: the one owner of every note mutation and of the
+     * delivery cache (spec §6.3, §7.2). One per store, so one per identity.
+     */
+    private readonly notes;
+    /**
+     * Fix round 1 (concern 1): the applied clear generation when each pending
+     * runtime turn was FIRST staged (W7b compares it). Keyed by message id,
+     * persisted inside the sealed runtime_inbox payload and restored with it;
+     * never a BridgeMessage field. Removed when the turn is acked or shed.
+     */
+    private readonly ingestGeneration;
+    /** Spec §11.2 (OQ-L): set by refetchRuntimeConfig (Task 8); notes are on until a payload says otherwise. */
+    private memoryConfig;
+    /**
+     * Task 8 fix round 1 (review I-1, N-L5): set once the BOOT refetch has
+     * returned, on success or failure. Until then prepareNotesForTurn only
+     * fills and never runs the legacy import: the boot drain pulls turns before
+     * the boot refetch, and an import there would move facts into notes that a
+     * clear issued while the machine was offline then deletes for good.
+     * warmRestoredNotes runs the import for the buffered (drained) turns after.
+     */
+    private bootConfigSettled;
+    /**
+     * Final review M-1: false until a config refetch has returned a payload in
+     * THIS process. Until then notes are off for reads and writes
+     * (notesProviderOn), whatever memoryConfig says: the last applied payload
+     * may have turned notes off, and that state is not persisted. Distinct from
+     * bootConfigSettled, which turns true when the boot refetch RETURNED, on
+     * success or failure (settled is not notes-on).
+     */
+    private memoryConfigConfirmed;
+    /**
+     * Final review I-1: true once a /v1/ws consumer completed a hello that
+     * declares it reads notes (MEMORY_NOTES_FEATURE) as the runtime, with no
+     * harness claim on that socket (ws-server). A 0.9.x runtime's hello does not
+     * declare it, a harness socket never qualifies, and a socket that sends no
+     * hello never does. Until then no legacy fact is moved into notes (those
+     * consumers recall facts, never notes) and the report says
+     * memory_notes: false. Per process and never reset: a runtime restart
+     * closes the socket but is not a downgrade.
+     */
+    private notesConsumerSeen;
+    /** 7b spec §7.2 Q4: a runtime socket (no harness claim) declared memory_recall at least once in this process (Task 19 reports it). */
+    private recallConsumerSeen;
+    /** Review M-1: the refetch now running, and the ONE follow-up every caller during it shares. */
+    private refetchInFlight;
+    private refetchFollowUp;
+    /** Review M-4: the (payload, applied) pair last logged as regressed. */
+    private regressedLogged;
+    /** Review M-5: an out-of-range applied generation is logged once. */
+    private generationRangeLogged;
     /** Task 2: warn-once-per-channel guard for the enclave-map fallback (below). */
     private enclaveFallbackWarned;
     /** Task 2: dedupe guard so ingestOnce writes a channel's enclave at most once
@@ -1128,6 +1322,7 @@ export declare class BridgeAgent {
      * loose until the next save.
      */
     refetchRuntimeConfig(): Promise<void>;
+    private refetchRuntimeConfigOnce;
     /**
      * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
      *
@@ -1698,6 +1893,17 @@ export declare class BridgeAgent {
      * A timeout rejects with the SDK's `FetchDeadlineError`.
      */
     private fetchBounded;
+    /** H-A rule 4 (audit r1 C2): GET /api/v1/channels/{id}; only 404 is "gone" (404, not 403, for non-members). */
+    private probeChannelMembership;
+    /** §5.4: one conversation's turns, facts, notes and recall, inside the memory mutex, with every in-memory copy. */
+    private purgeConversation;
+    /**
+     * 7b Task 17: the purged conversation's recall cache and pending map
+     * entries go too, inside the memory mutex. The purge already moved the
+     * purge and content epochs inside its transaction, so `warm` and
+     * `deliverable` refuse even before this drop runs (M-A3, M-A4).
+     */
+    private onConversationPurged;
     /** M6 (Task 11): idempotent get-or-create resolve of the enclave's hidden
      *  vault channel id — used as the fallback when a caller omits
      *  vaultChannelId. Mirrors connect-web's filesafe-api.ts resolveVaultChannel
@@ -1761,6 +1967,7 @@ export declare class BridgeAgent {
     recordMemory(input: import("@agentvault/connect-mls-store").MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;
+        dropped?: true;
     }>;
     /**
      * OpenClaw collapses text history and workspace facts into the owner's
@@ -1777,6 +1984,177 @@ export declare class BridgeAgent {
      * never falls back to the runtime's retired plaintext JSON files.
      */
     private memoryForTurn;
+    /**
+     * Spec §11.2 (OQ-L), §6.5: apply one parsed `payload.memory`. An unreadable
+     * value turns notes off and deletes nothing. A readable one goes through
+     * NotesBook.clear, which purges only on a HIGHER generation (under the note
+     * mutex) and resyncs on equal or lower; a lower one logs
+     * memory.clear_generation_regressed. Content-free logs only.
+     *
+     * While a purge is pending (the payload is above the applied generation)
+     * notes are held OFF, and they come back on only after the purge committed.
+     * A purge that throws therefore leaves notes off (fail closed); it is
+     * caught here (review M-2) so the rest of the config still applies and
+     * reports, and the next refetch retries it. A refetch that fails before
+     * this point keeps the last applied state.
+     */
+    private applyPayloadMemory;
+    /** Spec §5.3 (H3): mode state lives in the store; level-triggered after every refetch. Never throws. */
+    private applyRecallModeFromPayload;
+    /** A retention change or a prune removed rows: drop the vector caches. Called only inside notes.exclusive. */
+    private onRecallRetentionChangedLocked;
+    /** Markdown mode deleted every row: drop the caches and the per-message map. Called only inside notes.exclusive. */
+    private onRecallPurgedAllLocked;
+    /**
+     * 7b spec §7.1, §7.2: Q1 (config half) and Q2 here, then the 150 ms bound
+     * inside RecallBook.prepare. Called beside prepareNotesForTurn, before the
+     * turn is staged. The receipt epochs (Task 16 fix H-2) narrow the capture:
+     * the in-cycle receipt, else the persisted staging marks; marks that exist
+     * but lack an epoch give no recall (fail closed). Never throws.
+     */
+    private prepareRecallForTurn;
+    /** ws flush (synchronous). Q1 to Q3 and Q6 again at delivery, on the ORIGINAL message; Q4 lives in withConsumerRecall. */
+    recallForDelivery(m: BridgeMessage): readonly RecallItem[] | undefined;
+    /** ws-server: a runtime socket with no harness claim declared memory_recall. */
+    noteRecallConsumer(): void;
+    /** @internal test seam */
+    recallWarm(c: string): Promise<void>;
+    /** @internal test seam */
+    recallCacheWarm(c: string): boolean;
+    /** @internal test seam */
+    recallDeliverable(id: string, c: string): readonly RecallItem[] | undefined;
+    /** I1 and Q1's config half (spec §4, §7.2): provider, payload semantic, kill switch, store enabled. */
+    private recallProviderOn;
+    /**
+     * Spec §4: the tap's capture, synchronous, taken before the tap's first
+     * await (fact 5: the ingest stamp is deleted at ack). The purge and mode
+     * epochs are the ones persisted at staging, captured at RECEIPT (Task 14,
+     * audit r2 M-A; fix H-2), so a purge or a mode change after receipt, even
+     * across a restart, refuses the insert. A missing value is -1, which no
+     * real epoch equals: the tap skips it (`purged` / `epoch`), fail closed.
+     */
+    captureRecallTap(messageId: string, channelId: string): RecallTapCapture;
+    /** One content-free skip line (reason class only). */
+    private logRecallSkip;
+    /**
+     * The single writer (I8). Gates I1 to I5 here, in spec §4 table order; I6
+     * (capture half) here, and I6, I7, M-A and I9 again inside the store
+     * transaction. A skip logs only its reason class. Never throws.
+     */
+    private tapRecall;
+    /** Fire-and-forget tap from the ingest cycle; tracked so close() and tests can wait for it. */
+    private spawnRecallTap;
+    /** @internal test seam: resolves once every in-flight ingest tap has settled. */
+    settleRecallTaps(): Promise<void>;
+    /**
+     * Spec §4 M1: after the boot refetch settles, tap the deferred turns: those
+     * restored from runtime_inbox (a crash between staging and the tap) and
+     * those the boot drain ingested before the recall config was known (fix
+     * H-1). I9 absorbs a first run that committed. The authorization is the
+     * frozen mark; I1 is re-read here; the capture carries the persisted
+     * receipt epochs (fix H-2). A turn no longer held logs `stamp_missing`.
+     */
+    private reindexRestoredTurns;
+    /**
+     * Spec §5.3 hourly prune; audit r1 H5: inside the memory mutex, and a prune
+     * that deleted rows drops the vector caches. Never throws.
+     * @internal test seam
+     */
+    runRecallPruneTick(): Promise<void>;
+    /**
+     * 7b Task 19, the one-second maintenance tick minus the heartbeat refresh (the timer does that). Never throws.
+     * - Once a day (and on the first tick): touch this identity's model marker while recall is on and the files are
+     *   on disk, then GC model trees this manifest does not name and no marker has used for 30 days (spec §6.4 item 6).
+     * - Re-embed (spec §8) while recall is on: every minute, and every second while the previous tick did work.
+     * @internal test seam
+     */
+    runRecallMaintenanceTick(n: number): Promise<void>;
+    /**
+     * Spec §9.2 (Task 19): capability versus state, plus the H6 hold count and the newest completed sweep time
+     * (Task 13 carry). Pure reads: never starts, connects or spawns the embedder (plan audit r1 LOW).
+     */
+    private reportedRecall;
+    private reportedRecallState;
+    /**
+     * Review M-5: the report key only for a value the backend accepts
+     * (0..MAX_CLEAR_GENERATION); otherwise the key is omitted, so one bad
+     * mirror value cannot 422 the whole report, and the event logs once.
+     */
+    private reportedClearGeneration;
+    /**
+     * W1 and R1: the provider is securecoms, a config payload has arrived in
+     * this process (final review M-1), and the parsed payload keeps notes on.
+     */
+    private notesProviderOn;
+    /**
+     * Final review I-1: ws-server calls this when a socket completes a hello as
+     * the runtime (no harness claim) that declares MEMORY_NOTES_FEATURE. The
+     * first one also refetches the runtime config, so the report says
+     * memory_notes: true now rather than at the next 6-hour refetch.
+     */
+    noteNotesConsumer(): void;
+    /**
+     * R2 (spec §7.3): the frozen marks that only the full owner predicate in
+     * authorizationFor sets. `memory_write` (the pinned owner typed this turn)
+     * or `relay_speaker === "owner"` (the pinned owner spoke it through the
+     * relay; read only, never write, OQ-C). Strict `=== true` / `=== "owner"`:
+     * `audience === "owner_dm"` alone is not enough (§0.1 item 7).
+     *
+     * Review I-1 (spec §8.3): the owner-DM kill switch is re-checked HERE, at
+     * read time, and so is the provider (R1). A turn restored from
+     * runtime_inbox carries the marks frozen by the previous process; with
+     * SECURECOMS_OWNER_DM_DEFAULT_GRANTS now off, or the provider no longer
+     * securecoms, it gets no notes, and the boot warm runs no legacy import.
+     */
+    private notesReadable;
+    /** The applied clear generation, for a socket that gets no notes (R5 decided first, review m-2). */
+    notesAppliedGeneration(): number;
+    /**
+     * ws-server flush (synchronous). R1 to R3 here; R5 in withConsumerNotes; R4
+     * holds because nothing else calls this. Reads only the generation-checked
+     * cache (N-M1): a miss gives no notes. `generation` is the applied clear
+     * generation the socket records for W7b.
+     */
+    notesForDelivery(m: BridgeMessage): {
+        notes?: string;
+        generation: number;
+    };
+    /**
+     * §7.2 Warm and §10 import, BEFORE the turn is staged. Never throws.
+     * The import runs only for a `memory_write` turn (M-6: owner-DM channels
+     * only); the turn's own frozen authorization is the proof NotesBook checks.
+     */
+    private prepareNotesForTurn;
+    /**
+     * §7.2 + N-L5: after the boot refetch applied any clear, warm each channel
+     * holding an R2-eligible restored turn, before start() returns (bin.ts
+     * attaches /v1/ws only after start()). `this.buffer` also holds the turns
+     * the boot drain pulled; their prepare ran fill-only (review I-1), so the
+     * legacy import for them runs here, after the purge.
+     */
+    private warmRestoredNotes;
+    /**
+     * Spec §8.2: the write gate for one `memory_note` frame, fail closed, in
+     * table order: W1, well formed (and a request_id not already pending on
+     * this socket, M-2), W2, W3, W4(a), W4(b), W8, W5, then W2 and W1 once more
+     * after the await, then under the note mutex W7, W2 and W1 again after the
+     * seal and right before the synchronous commit, and W7b (the generation
+     * stamped when the turn was first staged, re-checked inside the store
+     * transaction; a turn with no stamp refuses `cleared`). Every refusal logs `memory.note_refused
+     * { reason_class }` and nothing else (§8.6); no note text, frame body or id
+     * is ever logged. Never rejects: an unexpected throw refuses with `store`.
+     *
+     * Everything that decides WHERE and WHETHER a note is written comes from
+     * the bridge-held in-flight record that `ctx.lookup` returns for THIS
+     * socket, never from the frame: the channel (W3), the frozen
+     * authorization (W4(a)), the sender (W4(b)), and the source text and the
+     * `transcribed` mark (W8). The note text that reaches NotesBook is the
+     * owner's own span, produced only by `prepareStoredNote` (W8 then W5).
+     *
+     * LEAF LOCK: heldPosition (W4(b)) is awaited BEFORE the note mutex is
+     * taken; nothing under the mutex awaits it.
+     */
+    applyMemoryNote(raw: Record<string, unknown>, ctx: MemoryNoteContext): Promise<MemoryNoteResultFrame>;
     memoryContext(conversationId: string, limit?: number): Promise<import("@agentvault/connect-mls-store").MemoryContextResult>;
     /**
      * Voice front desk, step 1 — decided SYNCHRONOUSLY inside the ingest cycle,
@@ -2107,6 +2485,8 @@ export declare class BridgeAgent {
      *   room_kill_switch         SECURECOMS_ROOM_DEFAULT_GRANTS as read at startup
      *   per_tool_consumer        a consumer that declared per-tool grant
      *                            enforcement is attached
+     *   memory_write             the turn carries memory_write (Markdown memory
+     *                            7a, spec §8.3): a boolean, never content
      */
     private logAuthzDecision;
     /**
@@ -2264,7 +2644,12 @@ export declare class BridgeAgent {
      * which Date.parse would read as LOCAL time, so a bare timestamp is UTC.
      */
     private recordRecvLag;
+    /**
+     * 7b Task 16 carry: the cycle's receipt epochs are dropped in a `finally`,
+     * so a cycle that throws leaves no stale entry for a later staging to read.
+     */
     private ingestCycle;
+    private ingestCycleBody;
     drain(channelId: string | undefined, waitSeconds: number): Promise<BridgeMessage[]>;
     /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */
     subscribe(listener: () => void): () => void;
@@ -2377,6 +2762,26 @@ export declare class BridgeAgent {
     isRuntimeMessageRetired(messageId: string): boolean;
     /** Complete the durable handoff only after the runtime explicitly acks. */
     ackRuntimeMessages(messageIds: string[]): void;
+    /**
+     * The sealed runtime_inbox payload: the message plus its ingest stamp and receipt recall epochs (never on the message object).
+     * Task 18 fix round 1: any bridge-private key already on the message is stripped first (the same splitStagedKeys), so
+     * only the bridge's own marks are persisted. A message whose W9 budget is durably spent (agent_memory_w9_spent: an ack
+     * then a backend redelivery) is staged with W9_KEY = W9_MAX, so the budget stays spent.
+     */
+    private stagedPayload;
+    /**
+     * Seal `message` into runtime_inbox with the current ingest stamp and record
+     * the stamp that is actually persisted. Task 7 n-1: a same-id re-stage is
+     * compared on the MESSAGE only, never the stamp, so a clear between two
+     * stagings of one message is not a payload conflict (which would fail the
+     * stage and leave the backend row redelivered forever). The row is not
+     * rewritten, so the FIRST staging's stamp stays authoritative: the owner's
+     * clear still covers a turn first ingested before it. A prior row with no
+     * valid stamp gets none, so its write refuses `cleared`.
+     */
+    private stageSealed;
+    /** In-memory mirror of the persisted marks (staging and restore). */
+    private applyStagedMarks;
     private restoreRuntimeInbox;
     /**
      * Seal a runtime frame before the backend queue id may be acknowledged.

package/dist/config.d.ts

@@ -38,6 +38,13 @@ export interface BridgeConfig {
      * a backend voice-settings refetch replaces `voice` wholesale.
      */
     voiceFastPathMode?: FastPathMode;
+    /**
+     * Spec §6.6 (M6): credential `memory.model_source`. "import_only" stops every model
+     * network connection; files arrive only through `models import <dir>`. Local only:
+     * the backend cannot set it (it never writes the credential). Anything but the exact
+     * string "import_only" is "download".
+     */
+    modelSource: "download" | "import_only";
 }
 export declare const REQUIRED: readonly ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 export declare function loadConfig(opts: {

package/dist/consumer-grants.d.ts

@@ -17,6 +17,7 @@ export declare const PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
  *
  * Never mutates `m`: the buffer and in-flight records keep the original, so a
  * later per-tool consumer still receives it. The stripped copy keeps every
- * other field (audience, relay_speaker) as is.
+ * other field (audience, relay_speaker) as is, except `memory_write`, which
+ * no non-per-tool consumer ever receives (Markdown memory 7a, review m-3).
  */
 export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: boolean): BridgeMessage;

package/dist/embedder-manifest.json

@@ -0,0 +1,52 @@
+{
+  "manifest": {
+    "modelId": "minilm-l6-v2-int8",
+    "dims": 384,
+    "maxTokens": 256,
+    "pooling": "mean",
+    "normalize": true,
+    "similarityThreshold": 0.19,
+    "onnxInputs": [
+      "input_ids",
+      "attention_mask",
+      "token_type_ids"
+    ],
+    "onnxOutput": "last_hidden_state",
+    "wasmSha256": "ec8580a9d7b9476ceee52e10a7f94124e4dc71a019d666ed6d4726697c109a4d",
+    "wasmSize": 13961845,
+    "files": [
+      {
+        "name": "model.onnx",
+        "urlPath": "/models/embeddings/minilm-l6-v2-int8/afdb6f1a0e45b715d0bb9b11772f032c399babd23bfc31fed1c170afc848bdb1/model.onnx",
+        "sha256": "afdb6f1a0e45b715d0bb9b11772f032c399babd23bfc31fed1c170afc848bdb1",
+        "size": 22972370
+      },
+      {
+        "name": "vocab.txt",
+        "urlPath": "/models/embeddings/minilm-l6-v2-int8/07eced375cec144d27c900241f3e339478dec958f92fddbc551f295c992038a3/vocab.txt",
+        "sha256": "07eced375cec144d27c900241f3e339478dec958f92fddbc551f295c992038a3",
+        "size": 231508
+      },
+      {
+        "name": "LICENSE",
+        "urlPath": "/models/embeddings/minilm-l6-v2-int8/d83f8f68a86e308e30d1ddf3d1b9984500f0c39ab8a1c7d274ab2799c21155b4/LICENSE",
+        "sha256": "d83f8f68a86e308e30d1ddf3d1b9984500f0c39ab8a1c7d274ab2799c21155b4",
+        "size": 9934
+      },
+      {
+        "name": "NOTICE",
+        "urlPath": "/models/embeddings/minilm-l6-v2-int8/99446995c7800bd9ce033f24c477b00daa50f06da85e441e903f4ce1e32c7507/NOTICE",
+        "sha256": "99446995c7800bd9ce033f24c477b00daa50f06da85e441e903f4ce1e32c7507",
+        "size": 320
+      }
+    ]
+  },
+  "tokenizer": {
+    "lowercase": true,
+    "stripAccents": true,
+    "unkToken": "[UNK]",
+    "unknownDropped": false,
+    "addSpecialTokens": true,
+    "maxInputCharsPerWord": 100
+  }
+}