@sema-agent/core 5.36.0 → 5.37.0

package/dist/core/memory-engine/file-backend.d.ts

@@ -23,6 +23,271 @@ export declare function scanEntryFiles(dir: string, opts?: {
     /** Harvest gate hook: called for every path the scan SKIPS, with why (backend scans ignore it). */
     onSkip?: (path: string, kind: "symlink" | "depth" | "nonmd" | "dotfile" | "unreadable") => void;
 }): ScannedEntryFile[];
+/** design/178 v2-b §3.3(b) — the explicit erasure selector (each form resolves to an explicit id
+ *  list before anything is deleted; there is no whole-store selector). */
+export type ErasureSelect = {
+    ids: readonly string[];
+} | {
+    scope: string;
+} | {
+    sessionId: string;
+};
+/** design/178 v2-b §3.3(c) — one erased row's coordinates (the snapshot's tagged binding law,
+ *  without the account-trace extras: a wire validator refuses hybrid objects). */
+export type ErasedBinding = {
+    state: "bound";
+    scope: string;
+    slug: string;
+} | {
+    state: "unbound";
+};
+/** The input of the erasure lane (engine host API `eraseMemoryEntries` and the File capability face
+ *  `eraseWithEvidence` share it; the File face ignores `allowUnevidenced` — with the evidence
+ *  capability present there is nothing to degrade to). */
+export interface EraseMemoryEntriesInput {
+    /** Idempotency identity, caller-minted (challenge-family law: the engine never mints one). */
+    requestId: string;
+    select: ErasureSelect;
+    /** Evidence-capability-ABSENT degradation opt-in (engine lane only; default = loud refusal). */
+    allowUnevidenced?: boolean;
+}
+/**
+ * design/178 v2-b §3.3(c) — the erasure attestation (the deliverable a compliance caller archives).
+ * Every claim is black-box re-checkable: an `erased` row is verified by `committedSnapshotOf(id)`
+ * answering `"absent"`, the chain containing its `evidenceEv` delete row, and `getByIds([id])`
+ * answering empty.
+ */
+export interface MemoryErasureAttestation {
+    /** Version envelope — a consumer reading `v > 1` must refuse, never reinterpret. */
+    v: 1;
+    requestId: string;
+    at: number;
+    /** `"complete"` ⇔ conflicts empty ∧ every pinned id ∈ erased ∪ erasedPreviously ∪ (notFound with
+     *  `custodyState === "complete"`). Everything else is `"partial"` (replay converges it). */
+    status: "complete" | "partial";
+    /** `"journal"` = the File evidence path; `"none"` = the explicit `allowUnevidenced` degradation
+     *  lane (always present — a silent downgrade is the forbidden shape). */
+    evidenceCapability: "journal" | "none";
+    /** The evidence chain's integrity as read at assembly (v2-a custody tri-state law). `"damaged"`
+     *  ⇒ every notFound row carries `historyUnknown` and `erasedPreviously` is never produced ("no
+     *  row" cannot be historically judged over a chain with a known hole). */
+    custodyState: "complete" | "damaged" | "capability-absent";
+    /** The selector, echoed verbatim. */
+    select: ErasureSelect;
+    /** sha256 hex of the selector's canonical JSON — equals the anchor row's (`"none"` mode: computed
+     *  for this call only; there is no anchor to reconcile against). */
+    selectHash: string;
+    /** The pinned id set (= the anchor row's `ids`; a replay reads it back, never re-resolves). */
+    resolvedIds: string[];
+    erased: Array<{
+        id: string;
+        rev: string;
+        binding: ErasedBinding;
+        /** The delete evidence row's `ev` — absent in `"none"` mode. */
+        evidenceEv?: string;
+        /** Distinct census-confirmed projection files this transaction physically deleted (the sweep
+         *  arm can answer >1: stray copies and P≥2 unbound duplicates are all removed). */
+        projectionsRemoved: number;
+        /** Contributing sessions (pre-capture ∪ the same-lock lineage capture-and-clear; `"none"` mode
+         *  answers `[]`). NON-durable beyond the chain's pre-capture: a replay after a crash carries
+         *  the chain's set — honest downgrade, never a fabricated rebuild. */
+        sessions: string[];
+    }>;
+    /** No row at judgment time and not claimable as erased under THIS request. Covers never-existed /
+     *  organically deleted / deleted by another request — the chain can distinguish them, the
+     *  attestation does not pretend to. `historyUnknown` ⇔ `custodyState !== "complete"`. */
+    notFound: Array<{
+        id: string;
+        historyUnknown?: true;
+    }>;
+    /** Chain-read rows: an origin-ABSENT delete row carrying THIS requestId (per-request judgment —
+     *  another request's delete of the id answers notFound, never a claim). Present only when
+     *  non-empty; never produced in `"none"` mode or over a damaged chain. */
+    erasedPreviously?: Array<{
+        id: string;
+        ev: string;
+        at: number;
+        /** The pre-delete binding from the most recent same-request delete row that RECORDED one —
+         *  carried so a REPLAY can still run the index-line sweep (the ledger row is gone; the evidence
+         *  row is the only surviving source of the projection path). `ev`/`at` come from the MOST RECENT
+         *  same-request delete row (which may be a later, binding-less re-erase). Absent in THREE cases:
+         *  no same-request delete row ever recorded a binding (unbound / pre-v2-form), or the recorded
+         *  path is OCCUPIED now (a live account row binds that scope+slug, or bytes exist at the path —
+         *  the binding is known but suppressed: the index line there belongs to the occupant, and a
+         *  consumer must not read absence as "no residue possible"). */
+        from?: {
+            scope: string;
+            slug: string;
+        };
+    }>;
+    /** Per-id planning-stage faults (io/plan errors under the lock — there is no CAS loser inside a
+     *  single lock span). Non-fatal; a replay converges them. */
+    conflicts: Array<{
+        id: string;
+        reason: string;
+    }>;
+    residuals: {
+        /** Quarantine files whose frontmatter id is in the pinned set (preserve-not-delete: the
+         *  attestation enumerates, an explicit second action clears). */
+        quarantineHits: string[];
+        /** Quarantine files that could not be attributed (fragments / non-entry shapes) — the honest
+         *  bound of the enumeration. */
+        quarantineOpaque: number;
+        /** Derived MEMORY.md index files that may STILL carry a line naming an erased entry, because
+         *  the erase-time index sweep could not read or rewrite them (a non-file at the index path, a
+         *  non-ENOENT read failure, or a refused write — an entry may carry a parenthesized failure
+         *  detail). Present only when non-empty. Minted by the ENGINE lane
+         *  (`MemoryEngine.eraseMemoryEntries` — the derived index is the engine's plane; this backend
+         *  face answers without the seat). The next successful materialize's rebuild also clears
+         *  orphaned lines, but a one-off compliance erasure cannot count on one — hence the disclosure
+         *  instead of a silent clean residual set. */
+        indexUncleared?: string[];
+        /** Propagation boundary, self-declared always: deletion is a THIS-store fact; remote-peer
+         *  convergence is the sync deployment's half to prove. */
+        propagation: "local-store-only";
+    };
+}
+/** Canonical JSON (recursively sorted keys, no whitespace) — the erasure protocol's ONE comparison
+ *  and hash basis: `selectHash` complains bind to it, and evidence rows are written/compared in this
+ *  form so a re-serialized import (key order changed by a middle layer) still compares equal. */
+export declare function canonicalJsonStringify(value: unknown): string;
+/** sha256 hex over the selector's canonical JSON + LF — the replay-identity judge (§4.6) and the
+ *  anchor validator's recomputation basis (a 64-hex shape check alone would let a forged anchor swap
+ *  the selector under a kept hash). */
+export declare function erasureSelectHash(select: ErasureSelect): string;
+/** Erasure input validation, shared by the engine host API and the File capability face (one rule
+ *  set — the selector the anchor row echoes verbatim must pass the anchor's own validator, so the
+ *  entry check and the chain check are the same predicate). Returns the violation, or undefined. */
+export declare function erasureRequestInvalid(input: EraseMemoryEntriesInput): string | undefined;
+/**
+ * Snapshot the erasure input into PLAIN data by reading every accessor exactly once (round-2 #3/#5):
+ * validation and use must observe the SAME value, so an accessor-backed (getter/Proxy) selector or
+ * requestId cannot pass validation on read #1 and yield a different (unvalidated) set on read #2.
+ * The returned object is inert — its `requestId` is a captured primitive and its `select` is a fresh
+ * plain object. Malformed shapes (a non-object select, or one with several/no keys) capture as-is so
+ * the validator that runs next reports them; the capture never throws.
+ */
+export declare function captureErasureInput(input: EraseMemoryEntriesInput): EraseMemoryEntriesInput;
+/**
+ * design/178 v2-a §1.3 — ONE `transfers.jsonl` evidence row on the PUBLIC audit face, as an OPEN
+ * discriminated form: the base keys (`ev` — the row's unique identity, `channel` — the event kind,
+ * `at` — ms epoch) are the contract; everything else is variant payload surfaced through the index
+ * signature. Known channels today (each validated in full by the store's own rule set):
+ *  - `"adopted-move"` / `"applyPatches-move"`: an ownership transfer of one id — payload
+ *    `{ id, from: {scope, slug}, to: {scope, slug} }`;
+ *  - `"migration-bind"`: an unbound row converging to a binding — payload `{ id, to }` (`from`
+ *    optional: honest absence, an unbound row has no prior coordinates);
+ *  - `"migration"`: the one-shot v1→v2 baseline summary — payload `{ boundRows, unboundRows }`
+ *    (store management history, never per-entry custody).
+ * `channel` is deliberately `string`, not a closed union: later releases append new variants to the
+ * SAME chain (one custody chain, one recovery protocol — never a second evidence file), and a closed
+ * union would break every consumer at the source level on each addition. CONSUMER OBLIGATION: tolerate
+ * unknown channels (report/skip/display raw — never an exhaustive `switch` that throws); the per-id
+ * custody read passes them through so a chain written by a newer engine still answers here.
+ */
+export interface TransferEvidence {
+    /** Unique event id (the append-idempotency key of the evidence chain). */
+    ev: string;
+    /** Event kind — open on purpose; see the known-channel table above. */
+    channel: string;
+    /** ms epoch of the event. */
+    at: number;
+    /** Variant payload (known channels documented above; unknown channels' payload rides verbatim). */
+    [key: string]: unknown;
+}
+/**
+ * design/178 v2-a §1.3 — the committed-account BINDING half of one ledger row, shared verbatim by
+ * {@link CommittedEntrySnapshot} and `EntryProvenanceAccount.binding` (one tagged definition — never
+ * a look-alike copy: an untagged `{scope, slug}` beside `{state: "unbound"}` can be satisfied by one
+ * hybrid object under both readings). `"unbound"` is a LEGAL transitional state (a v1→v2 migration
+ * row whose projection could not be derived), never a refusal.
+ */
+export type CommittedBinding = {
+    state: "bound";
+    scope: string;
+    slug: string;
+    at?: number;
+    prev?: {
+        scope: string;
+        slug: string;
+        at: number;
+    };
+} | {
+    state: "unbound";
+};
+/**
+ * design/178 v2-a §1.3 — the AUDIT SNAPSHOT of one entry's committed account: the account half
+ * (`rev` + {@link CommittedBinding}) and the content half are SEPARATE, because the account's
+ * authority is the ledger row while the content may be independently unavailable — an auditor asking
+ * "where is this entry bound, at which rev" gets the account facts even when no committed carrier
+ * can be produced ("cannot read it" must never collapse into "it does not exist").
+ *  - `state: "absent"` — the account has NO row for this id (never a throw, never a guess);
+ *  - `content.state: "present"` — the committed entry is servable: the committed bytes (control-plane
+ *    shadow; for a pre-shadow row, the in-place projection at the bound coordinates carrying the
+ *    committed rev) with the projection carrier in place at the bound address;
+ *  - `content.state: "unavailable"` — the row exists (binding/rev answered) but no committed carrier
+ *    serves it: `"shadowless-legacy"` = no shadow copy exists and the bound projection cannot vouch
+ *    (missing/divergent/foreign id); `"carrier-missing"` = the projection carrier is not in place at
+ *    the committed address (deleted or squatted out-of-band) or the shadow cannot carry the
+ *    committed rev — including every UNBOUND row (no committed address exists to mint
+ *    `MemoryEntry.scope`/`slug` from; the shadow bytes, where present, stay readable via
+ *    `readCommittedShadow`).
+ */
+export type CommittedEntrySnapshot = {
+    state: "absent";
+    id: string;
+} | {
+    state: "row";
+    id: string;
+    rev: string;
+    binding: CommittedBinding;
+    content: {
+        state: "present";
+        entry: MemoryEntry;
+    } | {
+        state: "unavailable";
+        reason: "shadowless-legacy" | "carrier-missing";
+    };
+};
+/**
+ * design/178 v2-a §1.3 — the LEDGER-DRIVEN scope enumeration's return form. `rows` carries every
+ * BOUND row whose `binding.scope` is in the requested set (the account is the enumeration authority
+ * — a shadow-backed row whose projection was deleted out-of-band is still answered; a disk scan
+ * would miss it). `unbound` is the STORE-LEVEL appendix of unbound row ids (they have no scope to
+ * belong to — the enumerating consumer disposes of them explicitly: an export lists them as
+ * residuals, an erasure scope-selector never resolves them). `complete: false` means a stable
+ * committed snapshot could not be taken (the journal-quiescence fence stayed contended past its
+ * bound) and the caller must FAIL CLOSED — a partial answer is never dressed as a full one; the
+ * union is DISCRIMINATED on `complete` so the incomplete arm cannot even carry rows to misread.
+ */
+export type CommittedScopeSnapshots = {
+    complete: true;
+    rows: Array<Extract<CommittedEntrySnapshot, {
+        state: "row";
+    }>>;
+    unbound: string[];
+} | {
+    complete: false;
+};
+/**
+ * design/178 v2-a §1.3 — the per-id custody read's return form. `"damaged"` covers every chain whose
+ * integrity is impeached while a sound reading still exists to answer with: a torn tail (crash
+ * mid-append — the sound prefix IS the answer and the file is NOT touched: inspection and repair are
+ * separate duties; the recovery leg quarantines the fragment, and an audit read that "helpfully"
+ * rewrites the evidence it is auditing has destroyed its own subject), the evidence-loss cross-check
+ * (a prev-bearing ledger row beside a chain with zero events for the id), and the ev-identity law
+ * (one `ev` under two DIFFERENT payloads — the chain was spliced/corrupted out of band; the store's
+ * own write path refuses to operate on it, so custody must never read it back as `"complete"`).
+ * `reason` carries the impeachment detail when one is known (today: the ev-identity arm); its
+ * absence means the damage form speaks for itself (torn tail / evidence loss).
+ * `"capability-absent"` never originates here — it is the ENGINE's honest answer for a backend
+ * without this capability face.
+ */
+export interface EntryCustodyReport {
+    state: "complete" | "damaged";
+    events: TransferEvidence[];
+    reason?: string;
+}
 /** Construction options for {@link FileMemoryEngineBackend}. */
 export interface FileMemoryEngineBackendOptions {
     /** ⚠️ 分家坑(service 报告 2026-07-09):不显式传时,控制平面按无参 `resolveMemoryEngineRoot()`
@@ -104,6 +369,13 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     private adoptionNoticeKeys;
     /** Test seam (§7.4 r4-④ arm): force a post-commit-point transfer-append failure. */
     private transfersAppendFault?;
+    /** v2-b §3-4 — the resurrection backstop's chain digest, keyed by the evidence log's stat
+     *  fingerprint (size + mtimeMs — append-only growth and a torn-tail shrink both move `size`).
+     *  NEVER a mount-lifetime cache: the fingerprint is re-verified under the txn mutex on every
+     *  consultation, so a sibling process's erasure invalidates it (r3: a B-process erasure must not
+     *  leave an A-process adopting off the old deleted-id set). The digest carries its chainState —
+     *  a damaged read caches as damaged, never as a bare (falsely reassuring) id set. */
+    private deletedIdsDigest;
     /** B2 — inbound-gate findings accumulated by read-side syncs; the engine drains them into
      *  `HarvestReport.inboundFindings` at harvest. */
     private inboundFindings;
@@ -182,19 +454,97 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      * is a no-op version check.
      */
     private migrateLockedIfNeeded;
-    /** Read the evidence log's event ids, healing a TORN TAIL (a crash mid-append): the fragment is
-     *  quarantined for evidence, the sound prefix stands (lines are self-contained — damage never
-     *  spreads backward). Any NON-tail corruption is fail-closed (B3 family). */
-    private readTransferEvs;
+    /** Is the durable chain-degradation marker in place? Presence is ENOENT-only-absent (a probe
+     *  failure is never read as "not degraded" — fail-closed). */
+    private chainDegradedMarkerPresent;
+    /** §3-4 r6 — mint the chain-degradation marker DURABLY (wx + fsync + read-back verification).
+     *  Idempotent on an existing marker. Throws when the marker cannot be proven on disk — the caller
+     *  (the heal) must then ABORT with the chain untouched: truncating first would reopen the exact
+     *  window this marker closes ("chain reads complete, no marker" after an out-of-band tear). */
+    private mintChainDegradedMarker;
+    /**
+     * Read the WHOLE evidence chain in order (validated, collision-checked), healing a TORN TAIL (a
+     * crash mid-append): the fragment is quarantined for evidence, the sound prefix stands (lines are
+     * self-contained — damage never spreads backward). Any NON-tail corruption is fail-closed (B3
+     * family). Two heal forms (§3-4 r5/r6):
+     *  - transaction journal PRESENT beside the tear = the honest crash form — the committed-pending
+     *    protocol re-appends the lost row from the journal, so the healed chain is genuinely complete;
+     *  - journal ABSENT = out-of-band tail damage — the lost row is unrecoverable, so the heal mints
+     *    the durable {@link CHAIN_DEGRADED_FILE} marker BEFORE it truncates (write order is
+     *    load-bearing: isolate fragment → marker wx + read-back → only then truncate; a marker
+     *    failure aborts the heal with the chain byte-untouched).
+     * Same-`ev` collision law (§4.4, read-time arm): canonical-form-equal duplicates are tolerated
+     * (append-idempotency residue); DIFFERENT payloads under one ev are fail-closed — an event id is
+     * one identity, and a reader must never pick a side by file order.
+     */
+    private readTransferChain;
+    /** The chain's ev → canonical-payload map (§4.4 upgraded load shape — the append path compares
+     *  PAYLOADS, never mere membership). */
+    private readTransferEvents;
+    /**
+     * v2-b §3-4 — the deleted-id digest behind the resurrection backstop: every `delete` evidence
+     * row's id (LOCAL AND IMPORTED — an origin filter here would disarm exactly the cross-store
+     * anti-resurrection evidence a custody import carries; the origin distinction belongs to the
+     * replay/anchor judgments alone), read WITHOUT healing (a backstop that rewrites the chain it
+     * consults has destroyed its own evidence; a torn tail answers `"damaged"` with the file
+     * byte-untouched). Non-tail corruption stays the fail-closed throw. Unknown channels are
+     * tolerated (open-form law). Must be called with the txn mutex held — the stat fingerprint is
+     * the cross-process staleness judge, and holding the lock is what makes "fingerprint unchanged
+     * ⇒ digest current" sound.
+     */
+    private deletedIdsDigestLocked;
+    /**
+     * v2-b §3-4 — the CHAIN-LEVEL resurrection backstop's verdict for one NEW id-bearing disk file
+     * (an id with no committed account row) meeting the adopting read:
+     *  - `"erased"` — the chain carries a delete evidence row for the id: the bytes are a deleted
+     *    entry resurfacing (whatever journal shape produced the "account gone, disk copy back"
+     *    scene), refused + quarantined — restoration is an EXPLICIT write with a new id, never a
+     *    disk replant;
+     *  - `"degraded"` — the chain cannot prove the deleted set (durable degradation marker, or a
+     *    live torn tail): "the id is not on the chain" is no evidence on an incomplete chain, so
+     *    EVERY new id-bearing file is refused adoption (left on disk, not served) until the explicit
+     *    rebuild clears the state — the same epistemic rule a custody import's completeness
+     *    precondition applies;
+     *  - `"clear"` — adoption proceeds normally.
+     * `applyPatches` adds are NOT consulted here (host authority — an explicit add of a previously
+     * erased id is a legitimate new commit).
+     */
+    private resurrectionBackstopVerdict;
+    /** v2-b §3-4 — the LOCK-FREE retrieval face of the deleted-id set (retrievalView / batch-plan
+     *  locateById). Reuses the fingerprint-cached digest: a deleted id's replanted bytes never reach
+     *  the retrieval face either. Best-effort by construction — a lock-free reader carries the same
+     *  cross-process staleness the whole retrieval face does, and a degraded chain filters only its
+     *  known deleted set (it never refuses-all here — retrieval must stay a plane report). */
+    private retrievalDeletedIds;
+    /** v2-b §3-4 (round-3 #1) — a PURE, fresh read of the committed ledger rows for the retrieval
+     *  backstop's account check: bytes → parsed rows, installing no read cache and no schema memo — so
+     *  the guard's account view is as fresh as its chain digest,
+     *  never a stale instance cache paired with a fresh deletion read. A v1-form or absent ledger
+     *  answers empty (a v1 store has no delete rows to police anyway). FAULT DIRECTION, stated
+     *  truthfully (rescan corrected the original note, which claimed the opposite): a read/parse
+     *  FAULT also answers empty, and with an empty account the consuming filter WITHHOLDS every id
+     *  on the delete list — conservative on purpose (a host re-add cannot be distinguished from a
+     *  replant over an unreadable account, and serving bytes that carry delete evidence during a
+     *  fault window would reopen exactly the resurrection the backstop exists to close). No erase
+     *  CLAIM is minted (nothing is attested); entries with no delete evidence keep serving. The
+     *  fault is DISCLOSED on the announcement lane (坏值响亮度 — the pre-fix swallow was silent),
+     *  once per fault code per mount. */
+    private freshCommittedRowsPure;
     /** §1.1 commit-point honesty: any failure BEFORE the journal write must refuse the whole
-     *  transaction cleanly — so the append target's writability (and the log's soundness) is probed
-     *  here, never discovered after the point of no return. */
+     *  transaction cleanly — so the append target's writability (and the log's soundness, ev-collision
+     *  law included) is probed here, never discovered after the point of no return. */
     private precheckTransfersAppendable;
     /** Append evidence events, idempotent by `ev` (the recovery leg re-runs this for a journal whose
-     *  append crashed). The ONLY failure class here is I/O — never capacity: a size threshold would
-     *  freeze legitimate moves behind a full log, so growth is disclosed, not refused. A failure
-     *  AFTER the commit point is COMMITTED-PENDING (the caller keeps the journal and throws — calling
-     *  it "refused" would invite a retry of a transaction the next recovery completes anyway). */
+     *  append crashed). Rows land in CANONICAL form (sorted keys) so idempotency and collision checks
+     *  compare one representation across writers and re-serializing middle layers. Three collision
+     *  checks (§4.4): read-time (inside {@link readTransferChain}), batch-time (one batch minting two
+     *  identities for one ev is a minting bug — fail-closed), append-time (an ev already on the chain
+     *  with a DIFFERENT payload is corruption, named; equal = idempotent skip). Behavior narrowed,
+     *  disclosed: the pre-v2b reader silently skipped/overwrote same-ev rows regardless of payload.
+     *  The ONLY failure class here is I/O — never capacity: a size threshold would freeze legitimate
+     *  moves behind a full log, so growth is disclosed, not refused. A failure AFTER the commit point
+     *  is COMMITTED-PENDING (the caller keeps the journal and throws — calling it "refused" would
+     *  invite a retry of a transaction the next recovery completes anyway). */
     private appendTransfers;
     /**
      * @param opts.unlocked RB-447 (2026-07-31, hardening review) — set by the two callers that run
@@ -328,19 +678,33 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     getByIds(ids: readonly string[]): Promise<MemoryEntry[]>;
     private getByIdsFrom;
     /**
-     * design/178 §3 (ruled 2026-08-08) — a SIDE-EFFECT-FREE projection of this backend for the session's
-     * RETRIEVAL face (`memory_search` / `memory_get`).
+     * design/178 §3 (ruled 2026-08-08) — a projection of this backend for the session's RETRIEVAL
+     * face (`memory_search` / `memory_get`): NO ADOPTION, ever.
      *
      * The ordinary read path carries the inbound-adoption channel: a disk revision that disagrees with
      * the ledger is judged an out-of-session change, gated, and — when it passes — adopted as the new
      * COMMITTED baseline (ledger + shadow rewritten). That is a deliberate lifecycle synchronization
      * point, and it belongs to the engine's own moments (materialize / harvest), not to every model
      * lookup: a retrieval landing between them would otherwise COMMIT the session's own in-flight edits
-     * with no harvest gate and no pollution discipline in the way. Reads through this view resolve
-     * entries from disk without touching the ledger, the shadow, or the quarantine.
+     * with no harvest gate and no pollution discipline in the way.
      *
-     * Not running the inbound gate on this path is the point, not a concession: the view reports what
-     * is on the plane, and admitting anything stays the harvest's job.
+     * Not running the inbound gate on this path is the point, not a concession: the view reports the
+     * plane, and admitting anything stays the harvest's job. Stated exactly (v2-b trued this doc up —
+     * the pre-v2b sentence "resolves entries from disk without touching the ledger" is no longer the
+     * whole truth):
+     *  · the v2-b RESURRECTION GUARD consults the delete-evidence digest (`transfers.jsonl` stat +
+     *    parse) and — when any delete row exists — a PURE fresh read of the committed ledger, and it
+     *    WITHHOLDS an on-plane file whose id carries a delete row with no live account row (an erased
+     *    id's replanted bytes are not served through any read face; a host re-add serves). So the
+     *    view is "the plane minus proven-erased ids", and it can throw {@link ControlPlaneCorruptError}
+     *    from a fail-closed corrupt evidence log — states a pre-v2b view could not reach;
+     *  · the reads do no healing and no quarantine, and the COMMITTED-ROWS read is cache-free; the
+     *    digest read installs the instance fingerprint cache (a read cache, not a store write). The
+     *    path's write-capable hooks (rescan r3 — do not present this list as shorter): `readScope`'s
+     *    pre-existing opportunistic v1→v2 migration retry (v1-form/unbound-row stores only, design/186
+     *    §3.1), the guard's fault-disclosure enqueue (a ledger read/parse fault mints an announcement
+     *    row, once per fault code per mount), and `scopeDir`'s registry mint (listing a scope name the
+     *    registry has never seen writes its row — predates this view and rides every scope read).
      *
      * WRITES ARE REFUSED, loudly — a view handed to a write path is a defect, not a fallback.
      */
@@ -492,12 +856,122 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  recovery is now authoritative; committing anyway would overwrite the stealer's transaction. */
     private assertTxnLockOwnership;
     private applyPatchesLocked;
+    /** E-3 ② — the journal CLOSE guard: re-read the fixed-path journal and remove it only while its
+     *  `.txn` names THIS transaction. A holder that stalled past the stale line and was stolen from
+     *  may reach its close after the stealer already wrote a NEW journal at the same path — a bare rm
+     *  there deletes the stealer's LIVE redo record (its crash then loses a committed transaction).
+     *  An absent/foreign/unparseable journal is simply not ours to remove: leave it (the stealer, or
+     *  the recovery leg, owns its fate). The remaining read→rm window is the same assert→act residue
+     *  the commit-point assertion accepts, stated there. */
+    private closeJournalIfOurs;
     /** Plan one patch: decide CAS/conflicts against CURRENT state, emit journal ops (no entry-file
      *  writes here — staging/execution happen in {@link applyPatches}). Every row write is BOUND
      *  (§1.1) at the coordinates the batch ACTUALLY lands — a slug collision's `-n` suffix binds the
      *  suffixed slug, the same one `applied[].slug` reports (v1's ledger had no landing awareness). */
     private planOne;
     private locateById;
+    /**
+     * design/178 v2-b §7 — request-driven erasure with evidence (capability face; probe with
+     * `typeof backend.eraseWithEvidence === "function"`). Rides the SAME txn mutex, the SAME journal
+     * shape, and the SAME recovery leg as `applyPatches` — never a second transaction protocol.
+     * Everything runs INSIDE the lock (r1: resolving a selector outside it pins a set the store can
+     * move under before the lock lands): recover → migrate → chain replay-judgment → resolution (a
+     * scope selector consults the census for membership — the account alone cannot see an
+     * unledgered-live inhabitant of the scope) → census → plan → journal (ops + ledger snapshot +
+     * evidence rows in ONE commit) → EXECUTE → ledger → evidence append → guarded journal close →
+     * lineage capture-and-clear.
+     *
+     * Replay protocol (§4.6): the first execution pins the resolved id set on an ANCHOR row; the same
+     * requestId re-executes against THAT set (never re-resolves), deletes the un-deleted remainder,
+     * and answers the cumulative view. A same-requestId call with a DIFFERENT selector is refused
+     * (`memory.erasure_selector_mismatch`); two same-req anchors on the chain are a spliced chain —
+     * refused for a human, never adjudicated by file order.
+     *
+     * This lane deletes by the ACCOUNT (ledger row), not by a physical locate: shadow-only rows
+     * (projection deleted out of band), carrier-missing rows, and unbound rows (P=0 / P≥2) are all
+     * erasable — the census sweep removes EVERY projection carrying the id (erasure needs no
+     * adjudication of which copy was real: removing all of them IS the requested outcome). A ledger
+     * key failing the entry-id contract takes the row-only arm (`legacyId` evidence; no ops — a
+     * shadow op on it would fail this store's own journal validator). The NotePatch delete lane's
+     * semantics are untouched (a shadow-only row still answers unknown-id there — pinned).
+     *
+     * Failure postures: an unreadable census refuses the WHOLE request pre-commit
+     * (`memory.erasure_census_incomplete` — "deleted clean" must not be attested over a store that
+     * cannot be fully read); per-id planning faults are non-fatal `conflicts` rows (a replay
+     * converges them); everything before the journal write refuses cleanly (F-1); every crash window
+     * after it converges through the shared recovery leg (F-2..F-5, F-13).
+     */
+    eraseWithEvidence(input: EraseMemoryEntriesInput): Promise<MemoryErasureAttestation>;
+    /** Bounded journal-quiescence fence (attempt count × retry pause). Constants, not knobs: the
+     *  contended window is the commit tail of one transaction (milliseconds); a store where it stays
+     *  contended for the full bound has a crashed/wedged writer, and the honest answer is refusal,
+     *  not a longer wait. */
+    private static readonly AUDIT_FENCE_ATTEMPTS;
+    private static readonly AUDIT_FENCE_RETRY_MS;
+    /** Is a transaction journal present right now? ENOENT-only absence (§3.1 ⓪ — a probe FAILURE is
+     *  not "no journal"; it throws the fail-closed corrupt error, never folds into quiescence). */
+    private auditJournalPending;
+    /** PURE ledger read for the audit faces: raw bytes → parsed rows, touching NOTHING on the
+     *  instance (no cache install, no schema-version memo, no v1-compat announcement) and never the
+     *  disk. A v1-form ledger is refused here — the migration belongs to the store's own entries
+     *  (construction / adopting reads / locked mutations), never to an audit read. */
+    private auditReadLedger;
+    /** Run `read` over a STABLE committed account: journal absent before and after, ledger bytes
+     *  identical across the read (closes both tear channels — the journal-first commit window and any
+     *  ledger-advancing path, the journal-free no-move adoption save included), retried up to the
+     *  bound. `read` may throw {@link AuditObservationUnstableError} on a mid-transition scene — the
+     *  loop re-observes, and the FINAL attempt receives `final: true` to answer the steady-state
+     *  reading instead. Throws {@link AuditSnapshotContendedError} when the bound exhausts.
+     *
+     *  CONSISTENCY CLAIM, stated precisely (adversarial-review wording pass): the answer is a
+     *  CONSISTENT committed account as observed at the fenced read — never a torn mixture of two
+     *  transactions' halves. FRESHNESS-AT-RETURN is deliberately not claimed: a lock-free reader
+     *  cannot exclude a writer whose entire commit lands in the sub-window between the last two
+     *  probes, and such an answer is simply the immediately-preceding committed state (the same
+     *  answer the call would have produced had it returned a moment earlier). Holding the store's
+     *  txn mutex would buy freshness at the cost of the audit read acquiring writer machinery (a
+     *  write, and a contention seat) — refused: an audit must not perturb the store it audits. */
+    private auditStable;
+    /** The audit faces' committed-CONTENT resolution for one row (see {@link CommittedEntrySnapshot}
+     *  for the state law). Reads only; the shadow read is fail-closed (a control-plane read FAILURE
+     *  is not absence), the projection probe is the shared side-effect-free tri-state probe. */
+    private resolveCommittedContent;
+    /**
+     * design/178 v2-a §1.3 — the per-id AUDIT SNAPSHOT (capability face; probe with
+     * `typeof backend.committedSnapshotOf === "function"`). Pure committed read under the double
+     * fence; unknown id ⇒ `{ state: "absent" }` (never a throw, never an empty guess); unbound row ⇒
+     * the account half answers with `binding: { state: "unbound" }` (legal transitional state);
+     * v1-compat store ⇒ loud refusal (migrate first); fence contention past the bound ⇒ loud refusal.
+     */
+    committedSnapshotOf(id: string): Promise<CommittedEntrySnapshot>;
+    /** One row's public {@link CommittedBinding} (shared tagged form — see the type's own doc). */
+    private publicBinding;
+    /**
+     * design/178 v2-a §1.3 — the LEDGER-DRIVEN scope enumeration (capability face). The account is
+     * the enumeration authority: every bound row whose scope is requested is answered — including
+     * shadow-only rows a disk scan would miss (`listHeaders` is an ADOPTING read and enumerates the
+     * plane; it is not an audit face). Unbound rows land in the store-level `unbound` appendix.
+     * Fence contention past the bound ⇒ `{ complete: false }` (NO data members — nothing to misread
+     * as a truncated package): the caller fails closed. Corrupt control-plane bytes and the
+     * v1-compat refusal still THROW (they are definite states, not contention).
+     */
+    committedSnapshotsOfScopes(scopes: readonly string[]): Promise<CommittedScopeSnapshots>;
+    /**
+     * design/178 v2-a §1.3 — the per-id CUSTODY read (capability face): every evidence row of
+     * `transfers.jsonl` naming this id, in file (= time) order, as OPEN {@link TransferEvidence}.
+     * PURE INSPECTION, never repair: a torn tail (crash mid-append) answers the sound prefix with
+     * `state: "damaged"` and the file is NOT touched — quarantining the fragment is the recovery
+     * leg's duty (the adopting read path), and an audit that rewrites its subject has destroyed the
+     * evidence it was asked about. Non-tail corruption stays the fail-closed throw. Unknown channels
+     * are TOLERATED and passed through (open form: a chain written by a newer engine still answers);
+     * known channels are validated by the store's own rule set. Runs under the same journal fence as
+     * the snapshot faces — a pending journal may hold committed-but-unappended evidence, and a chain
+     * read across it would be completed differently by the very next recovery.
+     */
+    custodyOf(id: string): Promise<EntryCustodyReport>;
+    /** The pure open-form evidence read behind {@link custodyOf} (no healing, no writes). `raw` is
+     *  the caller's already-fenced read of the log (undefined = absent). */
+    private custodyReadPure;
     getConsolidationCursor(scope: string): Promise<string | undefined>;
     setConsolidationCursor(scope: string, cursor: string): Promise<void>;
     private readCursors;