@sema-agent/core 5.36.0 → 5.38.0

package/dist/core/memory-engine/file-backend.js

@@ -1,11 +1,11 @@
-import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, relative } from "node:path";
 import { jaccardDistance, termSet } from "../memory-vector.js";
 import { MAX_MEMORY_BYTES } from "../memory.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { computeEntryRev, entryFromFile, isValidEntryId, parseEntryFile, serializeEntryFile } from "./frontmatter.js";
-import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, atomicWriteFileSync, quarantineAndTombstone, claimRootScope, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, isContainedIn, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, writeAllSync, } from "./layout.js";
+import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, claimRootScope, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, isContainedIn, lineageContributionsOfSession, readLineageRecord, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, writeAllSync, } from "./layout.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 export const MEMORY_INDEX_FILENAME = "MEMORY.md";
 export const DEFAULT_MAX_ENTRY_DEPTH = 3;
@@ -62,10 +62,98 @@ export function scanEntryFiles(dir, opts = {}) {
     walk(dir, 0);
     return out;
 }
+export function canonicalJsonStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map((v) => (v === undefined || typeof v === "function" || typeof v === "symbol" ? "null" : canonicalJsonStringify(v))).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const rec = value;
+        const keys = Object.keys(rec)
+            .filter((k) => rec[k] !== undefined)
+            .sort();
+        return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJsonStringify(rec[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+export function erasureSelectHash(select) {
+    return createHash("sha256").update(`${canonicalJsonStringify(select)}\n`, "utf8").digest("hex");
+}
+export function erasureRequestInvalid(input) {
+    if (!input || typeof input !== "object")
+        return "input is not an object";
+    if (typeof input.requestId !== "string" || input.requestId.length === 0)
+        return "requestId is required (idempotency identity — a retry must reuse it; the engine never mints one)";
+    const sel = input.select;
+    if (!sel || typeof sel !== "object" || Array.isArray(sel))
+        return "select is not an object";
+    const rec = sel;
+    const keys = Object.keys(rec);
+    const kind = keys[0];
+    if (keys.length !== 1 || (kind !== "ids" && kind !== "scope" && kind !== "sessionId"))
+        return "select must carry exactly one of ids/scope/sessionId";
+    if (kind === "ids") {
+        const list = Array.isArray(rec.ids) ? rec.ids : undefined;
+        if (list === undefined)
+            return "select.ids is not an array";
+        const seen = new Set();
+        for (const id of list) {
+            if (typeof id !== "string" || id.length === 0)
+                return "select.ids carries a non-string/empty id";
+            if (seen.has(id))
+                return "select.ids carries a duplicate id (the pinned set is a set — deduplicate before calling)";
+            seen.add(id);
+        }
+    }
+    else {
+        const v = rec[kind];
+        if (typeof v !== "string" || v.length === 0)
+            return `select.${kind} is not a non-empty string`;
+    }
+    if (input.allowUnevidenced !== undefined && typeof input.allowUnevidenced !== "boolean")
+        return "allowUnevidenced must be a boolean when present";
+    return undefined;
+}
+function erasureCodedError(message, code) {
+    const e = new Error(message);
+    e.code = code;
+    return e;
+}
+function cloneErasureSelect(select) {
+    if ("ids" in select)
+        return { ids: [...select.ids] };
+    if ("scope" in select)
+        return { scope: select.scope };
+    return { sessionId: select.sessionId };
+}
+export function captureErasureInput(input) {
+    if (!input || typeof input !== "object")
+        return input;
+    const requestId = input.requestId;
+    const allowUnevidenced = input.allowUnevidenced;
+    const rawSel = input.select;
+    let select;
+    if (rawSel && typeof rawSel === "object" && !Array.isArray(rawSel)) {
+        const s = rawSel;
+        const captured = {};
+        for (const k of Object.keys(s)) {
+            const v = s[k];
+            captured[k] = Array.isArray(v) ? [...v] : v;
+        }
+        select = captured;
+    }
+    else {
+        select = rawSel;
+    }
+    return { requestId, select, ...(allowUnevidenced !== undefined ? { allowUnevidenced } : {}) };
+}
+class AuditSnapshotContendedError extends Error {
+}
+class AuditObservationUnstableError extends Error {
+}
 const LEDGER_FILE = "revs.json";
 const LEDGER_SCHEMA_VERSION = 2;
 const LEDGER_V1_BACKUP_FILE = "revs.v1.json.bak";
 const TRANSFERS_FILE = "transfers.jsonl";
+const CHAIN_DEGRADED_FILE = "transfers.chain-degraded.json";
 const JOURNAL_FILE = "journal.json";
 const TXN_LOCK_STALE_MS = 30_000;
 const TXN_LOCK_WAIT_MS = 15_000;
@@ -113,7 +201,7 @@ function bindRowTracked(rows, id, next, transfers, channel) {
     rows[id] = row;
 }
 function cloneRows(rows) {
-    const out = {};
+    const out = Object.create(null);
     for (const [id, row] of rowsEntries(rows))
         out[id] = { ...row, ...(row.prev !== undefined ? { prev: { ...row.prev } } : {}) };
     return out;
@@ -130,7 +218,7 @@ function validateLedgerRowsV2(rowsRaw, path) {
     if (!rowsRaw || typeof rowsRaw !== "object" || Array.isArray(rowsRaw)) {
         throw new ControlPlaneCorruptError(`committed-rev ledger rows have the wrong shape: ${path}`);
     }
-    const out = {};
+    const out = Object.create(null);
     for (const [id, rowRaw] of Object.entries(rowsRaw)) {
         if (!rowRaw || typeof rowRaw !== "object" || Array.isArray(rowRaw)) {
             throw new ControlPlaneCorruptError(`committed-rev ledger row ${JSON.stringify(id)} has the wrong shape: ${path}`);
@@ -197,7 +285,7 @@ function parseLedgerText(raw, path) {
         }
         return { form: "v2", rows, envelopeExtras };
     }
-    const rows = {};
+    const rows = Object.create(null);
     for (const [k, v] of Object.entries(rec)) {
         if (typeof v !== "string") {
             throw new ControlPlaneCorruptError(`committed-rev ledger entry ${JSON.stringify(k)} is not a string: ${path}`);
@@ -206,6 +294,7 @@ function parseLedgerText(raw, path) {
     }
     return { form: "v1", rows };
 }
+const KNOWN_TRANSFER_CHANNELS = new Set(["adopted-move", "applyPatches-move", "migration-bind", "migration", "delete", "erasure-anchor", "erasure-request"]);
 function transferEventInvalid(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return "event is not an object";
@@ -218,8 +307,36 @@ function transferEventInvalid(raw) {
         if (!b || typeof b !== "object" || Array.isArray(b))
             return true;
         const r = b;
-        return typeof r.scope !== "string" || typeof r.slug !== "string";
+        if (typeof r.scope !== "string" || r.scope.length === 0)
+            return true;
+        return typeof r.slug !== "string" || slugEscapes(r.slug);
+    };
+    const idListInvalid = (v, what) => {
+        const list = Array.isArray(v) ? v : undefined;
+        if (list === undefined)
+            return `${what} is not an array`;
+        const seen = new Set();
+        for (const id of list) {
+            if (typeof id !== "string" || id.length === 0)
+                return `${what} carries a non-string/empty id`;
+            if (seen.has(id))
+                return `${what} carries a duplicate id`;
+            seen.add(id);
+        }
+        return undefined;
     };
+    if ((e.origin !== undefined) !== (e.srcEv !== undefined))
+        return "'origin' and 'srcEv' must appear together (import rows carry both; local rows carry neither)";
+    if (e.origin !== undefined && (typeof e.origin !== "string" || e.origin.length === 0))
+        return "non-string/empty 'origin'";
+    if (e.srcEv !== undefined && (typeof e.srcEv !== "string" || e.srcEv.length === 0))
+        return "non-string/empty 'srcEv'";
+    if (e.redacted !== undefined) {
+        if (e.redacted !== true)
+            return "'redacted', when present, must be literal true";
+        if (e.origin === undefined)
+            return "'redacted' requires the import pair (origin/srcEv) — a local row is never redacted";
+    }
     if (e.channel === "migration") {
         if (typeof e.boundRows !== "number" || !Number.isInteger(e.boundRows))
             return "migration summary missing integer 'boundRows'";
@@ -243,6 +360,91 @@ function transferEventInvalid(raw) {
         }
         return undefined;
     }
+    if (e.channel === "delete") {
+        if (typeof e.id !== "string" || e.id.length === 0)
+            return "delete event missing 'id'";
+        if (typeof e.rev !== "string" || e.rev.length === 0)
+            return "delete event missing 'rev'";
+        if (e.boundRows !== undefined || e.unboundRows !== undefined || e.to !== undefined || e.select !== undefined)
+            return "delete event must not carry boundRows/unboundRows/to/select";
+        if (e.from !== undefined && bindingInvalid(e.from))
+            return "delete event has a malformed 'from'";
+        if (e.req !== undefined && (typeof e.req !== "string" || e.req.length === 0))
+            return "delete event has a non-string/empty 'req'";
+        if (e.sessions !== undefined) {
+            const sessions = Array.isArray(e.sessions) ? e.sessions : undefined;
+            if (sessions === undefined || sessions.some((s) => typeof s !== "string"))
+                return "delete event has a malformed 'sessions'";
+            if (e.req === undefined)
+                return "delete event carries 'sessions' without 'req' (only the request leg captures lineage)";
+        }
+        if ((e.legacyId !== undefined) === isValidEntryId(e.id)) {
+            return e.legacyId !== undefined ? "legacyId claimed for a well-formed entry id (downgrade laundering refused)" : "delete event for a non-entry-id ledger key must declare legacyId";
+        }
+        if (e.legacyId !== undefined && e.legacyId !== true)
+            return "legacyId, when present, must be literal true";
+        if (e.legacyId !== undefined && e.from !== undefined)
+            return "legacyId and 'from' are mutually exclusive (a legacy row has no derivable projection)";
+        return undefined;
+    }
+    if (e.channel === "erasure-anchor") {
+        if (typeof e.req !== "string" || e.req.length === 0)
+            return "erasure anchor missing 'req'";
+        if (e.id !== undefined || e.from !== undefined || e.to !== undefined || e.scope !== undefined || e.boundRows !== undefined)
+            return "erasure anchor must not carry id/from/to/scope/boundRows";
+        const sel = e.select;
+        if (!sel || typeof sel !== "object" || Array.isArray(sel))
+            return "erasure anchor 'select' is not an object";
+        const selRec = sel;
+        const selKeys = Object.keys(selRec);
+        if (selKeys.length !== 1 || (selKeys[0] !== "ids" && selKeys[0] !== "scope" && selKeys[0] !== "sessionId"))
+            return "erasure anchor 'select' must carry exactly one of ids/scope/sessionId";
+        if (selKeys[0] === "ids") {
+            const bad = idListInvalid(selRec.ids, "'select.ids'");
+            if (bad !== undefined)
+                return bad;
+        }
+        else if (typeof selRec[selKeys[0]] !== "string" || selRec[selKeys[0]].length === 0) {
+            return `erasure anchor 'select.${selKeys[0]}' is not a non-empty string`;
+        }
+        if (e.selectHash !== erasureSelectHash(sel))
+            return "erasure anchor 'selectHash' does not equal the selector's canonical hash";
+        const idsBad = idListInvalid(e.ids, "erasure anchor 'ids'");
+        if (idsBad !== undefined)
+            return idsBad;
+        const nfBad = idListInvalid(e.notFound, "erasure anchor 'notFound'");
+        if (nfBad !== undefined)
+            return nfBad;
+        const pinned = new Set(e.ids);
+        for (const id of e.notFound) {
+            if (!pinned.has(id))
+                return "erasure anchor 'notFound' is not a subset of 'ids'";
+        }
+        if (selKeys[0] === "ids") {
+            const selIds = selRec.ids;
+            const anchorIds = e.ids;
+            if (selIds.length !== anchorIds.length || selIds.some((id, i) => anchorIds[i] !== id)) {
+                return "erasure anchor 'ids' does not equal the ids-selector's verbatim id list (a pinned set the selector never named)";
+            }
+        }
+        return undefined;
+    }
+    if (e.channel === "erasure-request") {
+        if (typeof e.req !== "string" || e.req.length === 0)
+            return "erasure request row missing 'req'";
+        if (e.id !== undefined || e.from !== undefined || e.to !== undefined || e.select !== undefined || e.notFound !== undefined)
+            return "erasure request row must not carry id/from/to/select/notFound";
+        if (typeof e.scope !== "string" || e.scope.length === 0)
+            return "erasure request row missing 'scope'";
+        if (typeof e.selectHash !== "string" || !/^[0-9a-f]{64}$/.test(e.selectHash))
+            return "erasure request row 'selectHash' is not a sha256 hex";
+        const idsBad = idListInvalid(e.ids, "erasure request row 'ids'");
+        if (idsBad !== undefined)
+            return idsBad;
+        if (e.ids.length === 0)
+            return "erasure request row carries an empty 'ids' (a projection row exists only for a scope with bound ids)";
+        return undefined;
+    }
     return `unknown channel ${JSON.stringify(e.channel)}`;
 }
 function readControlFileOrAbsent(path, what) {
@@ -314,6 +516,7 @@ export class FileMemoryEngineBackend {
     unboundRowsKnown = false;
     adoptionNoticeKeys = new Set();
     transfersAppendFault;
+    deletedIdsDigest;
     inboundFindings = [];
     batchScan;
     constructor(dir, opts = {}) {
@@ -365,7 +568,7 @@ export class FileMemoryEngineBackend {
         const path = join(this.controlPlaneRoot, LEDGER_FILE);
         const raw = readControlFileOrAbsent(path, "committed-rev ledger");
         if (raw === undefined) {
-            this.ledger = {};
+            this.ledger = Object.create(null);
             this.persistedSchemaVersion = "v2";
             this.unboundRowsKnown = false;
             return this.ledger;
@@ -391,7 +594,7 @@ export class FileMemoryEngineBackend {
         this.unboundRowsKnown = hasUnboundRows(this.ledger);
     }
     persistLedgerV1(rows) {
-        const map = {};
+        const map = Object.create(null);
         for (const [id, row] of rowsEntries(rows))
             map[id] = row.rev;
         atomicWriteFileSync(join(this.controlPlaneRoot, LEDGER_FILE), `${JSON.stringify(map, null, 2)}\n`);
@@ -610,7 +813,7 @@ export class FileMemoryEngineBackend {
             return;
         }
         const now = this.now();
-        const next = {};
+        const next = Object.create(null);
         const bound = [];
         const unbound = [];
         const events = [];
@@ -654,12 +857,38 @@ export class FileMemoryEngineBackend {
                 : `memory ledger unbound row(s) converged to bound: ${bound.slice(0, 8).join(", ")}${bound.length > 8 ? ", …" : ""}`,
         ]);
     }
-    readTransferEvs() {
+    chainDegradedMarkerPresent() {
+        return readControlFileOrAbsent(join(this.controlPlaneRoot, CHAIN_DEGRADED_FILE), "evidence-chain degradation marker") !== undefined;
+    }
+    mintChainDegradedMarker(fragmentPath) {
+        const path = join(this.controlPlaneRoot, CHAIN_DEGRADED_FILE);
+        let fd;
+        try {
+            fd = openSync(path, "wx", 0o600);
+        }
+        catch (err) {
+            if (err.code === "EEXIST")
+                return;
+            throw new ControlPlaneCorruptError(`evidence-chain degradation marker could not be created at ${path} (${err.code ?? "io error"}) — heal aborted, the chain is unchanged (fail-closed)`);
+        }
+        try {
+            writeAllSync(fd, `${JSON.stringify({ at: this.now(), ...(fragmentPath !== undefined ? { fragment: fragmentPath } : {}) }, null, 2)}\n`);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        if (readControlFileOrAbsent(path, "evidence-chain degradation marker") === undefined) {
+            throw new ControlPlaneCorruptError(`evidence-chain degradation marker vanished after its write at ${path} — heal aborted, the chain is unchanged (fail-closed)`);
+        }
+    }
+    readTransferChain() {
         const path = join(this.controlPlaneRoot, TRANSFERS_FILE);
         const raw = readControlFileOrAbsent(path, "transfer evidence log");
-        const evs = new Set();
+        const out = [];
         if (raw === undefined)
-            return evs;
+            return out;
+        const byEv = new Map();
         const lines = raw.split("\n");
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
@@ -671,29 +900,149 @@ export class FileMemoryEngineBackend {
             }
             catch {
                 const isTail = lines.slice(i + 1).every((l) => l === "");
-                if (isTail) {
+                if (!isTail)
+                    throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is unparseable (not a torn tail — fail-closed): ${path}`);
+                let journalHasPendingEvidence = false;
+                const jraw = readControlFileOrAbsent(join(this.controlPlaneRoot, JOURNAL_FILE), "transaction journal");
+                if (jraw !== undefined) {
                     try {
-                        ensureDirExists(join(this.controlPlaneRoot, QUARANTINE_DIR));
-                        atomicWriteFileSync(join(this.controlPlaneRoot, QUARANTINE_DIR, `transfers-torn-tail-${this.now()}.fragment`), line);
-                        atomicWriteFileSync(path, lines.slice(0, i).join("\n") + (i > 0 ? "\n" : ""));
+                        const jparsed = JSON.parse(jraw);
+                        const jt = typeof jparsed === "object" && jparsed !== null ? jparsed.transfers : undefined;
+                        journalHasPendingEvidence = Array.isArray(jt) && jt.length > 0;
                     }
                     catch {
-                        throw new ControlPlaneCorruptError(`transfer evidence log has a torn tail that could not be quarantined: ${path}`);
+                        journalHasPendingEvidence = false;
                     }
-                    this.enqueueExternalItems([`transfer evidence log had a torn tail (crash mid-append) — the fragment is quarantined and the sound prefix stands: ${TRANSFERS_FILE}`]);
-                    break;
                 }
-                throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is unparseable (not a torn tail — fail-closed): ${path}`);
+                const outOfBand = !journalHasPendingEvidence;
+                let fragmentPath;
+                try {
+                    ensureDirExists(join(this.controlPlaneRoot, QUARANTINE_DIR));
+                    fragmentPath = join(this.controlPlaneRoot, QUARANTINE_DIR, `transfers-torn-tail-${this.now()}.fragment`);
+                    atomicWriteFileSync(fragmentPath, line);
+                }
+                catch {
+                    throw new ControlPlaneCorruptError(`transfer evidence log has a torn tail that could not be quarantined: ${path}`);
+                }
+                if (outOfBand)
+                    this.mintChainDegradedMarker(fragmentPath);
+                try {
+                    atomicWriteFileSync(path, lines.slice(0, i).join("\n") + (i > 0 ? "\n" : ""));
+                }
+                catch {
+                    throw new ControlPlaneCorruptError(`transfer evidence log has a torn tail that could not be healed (truncation failed): ${path}`);
+                }
+                this.enqueueExternalItems([
+                    outOfBand
+                        ? `transfer evidence log had a torn tail with NO transaction journal beside it (out-of-band damage) — the fragment is quarantined, the sound prefix stands, and the chain is durably marked degraded: new id-bearing files are refused adoption until an explicit rebuild clears ${CHAIN_DEGRADED_FILE}`
+                        : `transfer evidence log had a torn tail (crash mid-append) — the fragment is quarantined and the sound prefix stands: ${TRANSFERS_FILE}`,
+                ]);
+                break;
             }
             const invalid = transferEventInvalid(parsed);
             if (invalid !== undefined)
                 throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is invalid (${invalid}): ${path}`);
-            evs.add(parsed.ev);
+            const rec = parsed;
+            const ev = rec.ev;
+            const canonical = canonicalJsonStringify(rec);
+            const prior = byEv.get(ev);
+            if (prior !== undefined) {
+                if (prior !== canonical) {
+                    throw new ControlPlaneCorruptError(`transfer evidence log carries event id ${JSON.stringify(ev)} twice with DIFFERENT payloads (line ${i + 1}) — one ev is one identity; refusing to pick a side (fail-closed): ${path}`);
+                }
+                continue;
+            }
+            byEv.set(ev, canonical);
+            out.push({ ev, canonical, parsed: rec });
+        }
+        return out;
+    }
+    readTransferEvents() {
+        const out = new Map();
+        for (const row of this.readTransferChain())
+            out.set(row.ev, row.canonical);
+        return out;
+    }
+    deletedIdsDigestLocked() {
+        const path = join(this.controlPlaneRoot, TRANSFERS_FILE);
+        let fp;
+        try {
+            const st = statSync(path);
+            fp = `${st.size}:${st.mtimeMs}`;
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return { state: "complete", ids: new Set() };
+            throw new ControlPlaneCorruptError(`transfer evidence log could not be probed (${err.code ?? "io error"}) at ${path} — a probe failure is not an empty chain (fail-closed)`);
+        }
+        const cached = this.deletedIdsDigest;
+        if (cached !== undefined && cached.fp === fp)
+            return { state: cached.state, ids: cached.ids };
+        const raw = readControlFileOrAbsent(path, "transfer evidence log");
+        if (raw === undefined)
+            return { state: "complete", ids: new Set() };
+        let state = "complete";
+        const ids = new Set();
+        const lines = raw.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (line === undefined || line === "")
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                if (lines.slice(i + 1).every((l) => l === "")) {
+                    state = "damaged";
+                    break;
+                }
+                throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is unparseable (not a torn tail — fail-closed): ${path}`);
+            }
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is not an object (fail-closed): ${path}`);
+            }
+            const e = parsed;
+            if (KNOWN_TRANSFER_CHANNELS.has(e.channel)) {
+                const invalid = transferEventInvalid(parsed);
+                if (invalid !== undefined)
+                    throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is invalid (${invalid}): ${path}`);
+                if (e.channel === "delete")
+                    ids.add(e.id);
+            }
+        }
+        this.deletedIdsDigest = { fp, state, ids };
+        return { state, ids };
+    }
+    resurrectionBackstopVerdict(id) {
+        const digest = this.deletedIdsDigestLocked();
+        if (digest.ids.has(id))
+            return "erased";
+        if (digest.state === "damaged" || this.chainDegradedMarkerPresent())
+            return "degraded";
+        return "clear";
+    }
+    retrievalDeletedIds() {
+        return this.deletedIdsDigestLocked().ids;
+    }
+    freshCommittedRowsPure() {
+        try {
+            const raw = readControlFileOrAbsent(join(this.controlPlaneRoot, LEDGER_FILE), "committed-rev ledger");
+            if (raw === undefined)
+                return Object.create(null);
+            const parsed = parseLedgerText(raw, join(this.controlPlaneRoot, LEDGER_FILE));
+            return parsed.form === "v2" ? parsed.rows : Object.create(null);
+        }
+        catch (err) {
+            const code = err.code ?? (err instanceof ControlPlaneCorruptError ? "corrupt" : "io error");
+            this.announceAdoptionNotice(`retrieval-ledger-fault|${code}`, `memory retrieval guard: the committed-rev ledger could not be read on the lock-free retrieval face (${err instanceof Error ? err.message : String(err)}) — ` +
+                `ids carrying delete evidence are WITHHELD from retrieval (a legitimate re-add cannot be verified over an unreadable account) until the fault clears; ` +
+                `entries with no delete evidence serve normally`);
+            return Object.create(null);
         }
-        return evs;
     }
     precheckTransfersAppendable() {
-        this.readTransferEvs();
+        this.readTransferEvents();
         const fd = openSync(join(this.controlPlaneRoot, TRANSFERS_FILE), "a", 0o600);
         closeSync(fd);
     }
@@ -701,13 +1050,35 @@ export class FileMemoryEngineBackend {
         if (events.length === 0)
             return;
         this.transfersAppendFault?.();
-        const existing = this.readTransferEvs();
-        const missing = events.filter((e) => !existing.has(e.ev));
-        if (missing.length === 0)
+        const existing = this.readTransferEvents();
+        const batch = new Map();
+        const toWrite = [];
+        for (const e of events) {
+            const canonical = canonicalJsonStringify(e);
+            const inBatch = batch.get(e.ev);
+            if (inBatch !== undefined) {
+                if (inBatch !== canonical) {
+                    throw new ControlPlaneCorruptError(`transfer evidence batch mints event id ${JSON.stringify(e.ev)} twice with DIFFERENT payloads — one ev is one identity (minting bug, fail-closed)`);
+                }
+                continue;
+            }
+            batch.set(e.ev, canonical);
+            const onChain = existing.get(e.ev);
+            if (onChain !== undefined) {
+                if (onChain !== canonical) {
+                    throw new ControlPlaneCorruptError(`transfer evidence append collides on event id ${JSON.stringify(e.ev)}: the chain already carries a DIFFERENT payload under it — one ev is one identity (fail-closed)`);
+                }
+                continue;
+            }
+            toWrite.push(canonical);
+        }
+        if (toWrite.length === 0)
             return;
+        const raw = readControlFileOrAbsent(join(this.controlPlaneRoot, TRANSFERS_FILE), "transfer evidence log");
+        const needsSeparator = raw !== undefined && raw.length > 0 && !raw.endsWith("\n");
         const fd = openSync(join(this.controlPlaneRoot, TRANSFERS_FILE), "a", 0o600);
         try {
-            writeAllSync(fd, missing.map((e) => `${JSON.stringify(e)}\n`).join(""));
+            writeAllSync(fd, (needsSeparator ? "\n" : "") + toWrite.map((c) => `${c}\n`).join(""));
             fsyncSync(fd);
         }
         finally {
@@ -715,9 +1086,21 @@ export class FileMemoryEngineBackend {
         }
     }
     recoverJournal(opts = {}) {
-        const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
-        if (opts.unlocked && this.txnInFlight())
+        if (opts.unlocked) {
+            if (this.txnInFlight())
+                return;
+            const lock = this.tryAcquireTxnLockSync();
+            if (lock === undefined)
+                return;
+            try {
+                this.recoverJournal();
+            }
+            finally {
+                lock.release();
+            }
             return;
+        }
+        const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
         const raw = readControlFileOrAbsent(jp, "transaction journal");
         if (raw !== undefined) {
             let journal;
@@ -752,7 +1135,7 @@ export class FileMemoryEngineBackend {
                 const map = journal.ledger;
                 if (!map || typeof map !== "object" || Array.isArray(map))
                     throw new ControlPlaneCorruptError(`transaction journal ledger snapshot has the wrong shape: ${jp}`);
-                snapshotRows = {};
+                snapshotRows = Object.create(null);
                 for (const [id, rev] of Object.entries(map)) {
                     if (typeof rev !== "string")
                         throw new ControlPlaneCorruptError(`transaction journal v1 ledger snapshot entry ${JSON.stringify(id)} is not a string: ${jp}`);
@@ -768,16 +1151,150 @@ export class FileMemoryEngineBackend {
             if (journal.transfers !== undefined) {
                 if (!Array.isArray(journal.transfers))
                     throw new ControlPlaneCorruptError(`transaction journal transfers is not an array: ${jp}`);
+                const journalEvs = new Map();
                 for (const e of journal.transfers) {
                     const invalid = transferEventInvalid(e);
                     if (invalid !== undefined)
                         throw new ControlPlaneCorruptError(`transaction journal transfer event is invalid (${invalid}): ${jp}`);
-                    if (e.channel !== "migration" && !bindingEquals(rowsBinding(snapshotRows, e.id), e.to)) {
-                        throw new ControlPlaneCorruptError(`transaction journal transfer event for ${JSON.stringify(e.id)} disagrees with the snapshot binding: ${jp}`);
+                    if (e.origin !== undefined) {
+                        throw new ControlPlaneCorruptError(`transaction journal carries an origin-bearing (imported) transfer event — imports never ride a journal: ${jp}`);
+                    }
+                    const canonical = canonicalJsonStringify(e);
+                    const prior = journalEvs.get(e.ev);
+                    if (prior !== undefined && prior !== canonical) {
+                        throw new ControlPlaneCorruptError(`transaction journal mints event id ${JSON.stringify(e.ev)} twice with DIFFERENT payloads (fail-closed before redo): ${jp}`);
                     }
+                    journalEvs.set(e.ev, canonical);
                 }
                 if (hasV1)
                     throw new ControlPlaneCorruptError(`transaction journal carries transfers with a v1 snapshot (impossible form): ${jp}`);
+                if (journalEvs.size > 0) {
+                    for (const row of this.readTransferChain()) {
+                        const j = journalEvs.get(row.ev);
+                        if (j !== undefined && j !== row.canonical) {
+                            throw new ControlPlaneCorruptError(`transaction journal event id ${JSON.stringify(row.ev)} collides with a DIFFERENT payload already on the evidence chain (fail-closed before redo): ${jp}`);
+                        }
+                    }
+                }
+                const transfers = journal.transfers;
+                const rowPresent = (id) => Object.prototype.hasOwnProperty.call(snapshotRows, id);
+                const deleteRows = transfers.filter((t) => t.channel === "delete");
+                const anchorRows = transfers.filter((t) => t.channel === "erasure-anchor");
+                const requestRows = transfers.filter((t) => t.channel === "erasure-request");
+                let chainAnchors;
+                for (const e of transfers) {
+                    if (e.channel === "adopted-move" || e.channel === "applyPatches-move" || e.channel === "migration-bind") {
+                        if (!bindingEquals(rowsBinding(snapshotRows, e.id), e.to)) {
+                            throw new ControlPlaneCorruptError(`transaction journal transfer event for ${JSON.stringify(e.id)} disagrees with the snapshot binding: ${jp}`);
+                        }
+                        continue;
+                    }
+                    if (e.channel !== "delete")
+                        continue;
+                    if (rowPresent(e.id)) {
+                        throw new ControlPlaneCorruptError(`transaction journal delete evidence for ${JSON.stringify(e.id)} disagrees with its snapshot (the row survives) — a delete claim over a surviving row is refused: ${jp}`);
+                    }
+                    if (e.legacyId !== true) {
+                        if (!journal.ops.some((op) => op.kind === "shadow-delete" && op.target === e.id)) {
+                            throw new ControlPlaneCorruptError(`transaction journal delete evidence for ${JSON.stringify(e.id)} has no same-journal shadow-delete op (uncorrelated delete claim, fail-closed): ${jp}`);
+                        }
+                        if (e.from !== undefined) {
+                            const derived = this.bindingAbsPath(e.from);
+                            if (!journal.ops.some((op) => op.kind === "delete" && op.target === derived)) {
+                                throw new ControlPlaneCorruptError(`transaction journal delete evidence for ${JSON.stringify(e.id)} has no same-journal physical delete op at its bound projection path (an account-only delete would leave the disk copy to resurrect, fail-closed): ${jp}`);
+                            }
+                        }
+                    }
+                    if (e.req !== undefined && !anchorRows.some((a) => a.req === e.req)) {
+                        chainAnchors ??= this.readTransferChain()
+                            .map((r) => r.parsed)
+                            .filter((p) => p.channel === "erasure-anchor" && p.origin === undefined);
+                        const matching = chainAnchors.filter((p) => p.req === e.req);
+                        const pinned = matching.length === 1 ? matching[0]?.ids : undefined;
+                        if (pinned === undefined || !pinned.includes(e.id)) {
+                            throw new ControlPlaneCorruptError(`transaction journal carries a request-driven delete for ${JSON.stringify(e.id)} (req ${JSON.stringify(e.req)}) with no same-journal anchor and no matching single chain anchor pinning the id — an unanchored erasure claim is refused: ${jp}`);
+                        }
+                    }
+                }
+                const chainAnchorEvsByReq = new Map();
+                if (anchorRows.length > 0) {
+                    for (const p of (chainAnchors ??= this.readTransferChain()
+                        .map((r) => r.parsed)
+                        .filter((p) => p.channel === "erasure-anchor" && p.origin === undefined))) {
+                        const set = chainAnchorEvsByReq.get(p.req) ?? new Set();
+                        set.add(p.ev);
+                        chainAnchorEvsByReq.set(p.req, set);
+                    }
+                }
+                const anchorReqs = new Set();
+                for (const a of anchorRows) {
+                    if (anchorReqs.has(a.req))
+                        throw new ControlPlaneCorruptError(`transaction journal carries two erasure anchors for req ${JSON.stringify(a.req)} (one request, one anchor): ${jp}`);
+                    const chainEvs = chainAnchorEvsByReq.get(a.req);
+                    if (chainEvs !== undefined && [...chainEvs].some((ev) => ev !== a.ev)) {
+                        throw new ControlPlaneCorruptError(`transaction journal mints an erasure anchor for req ${JSON.stringify(a.req)} under a DIFFERENT ev than the one already on the evidence chain (one request, one anchor — spliced journal refused): ${jp}`);
+                    }
+                    anchorReqs.add(a.req);
+                    const pinned = new Set(a.ids);
+                    const reqDeletes = deleteRows.filter((d) => d.req === a.req);
+                    const seenDeleteIds = new Set();
+                    for (const d of reqDeletes) {
+                        if (!pinned.has(d.id))
+                            throw new ControlPlaneCorruptError(`transaction journal delete evidence for ${JSON.stringify(d.id)} is outside its anchor's pinned set (req ${JSON.stringify(a.req)}): ${jp}`);
+                        if (seenDeleteIds.has(d.id))
+                            throw new ControlPlaneCorruptError(`transaction journal carries two delete rows for ${JSON.stringify(d.id)} under one request (req ${JSON.stringify(a.req)}): ${jp}`);
+                        seenDeleteIds.add(d.id);
+                    }
+                    const reqProjections = requestRows.filter((r) => r.req === a.req);
+                    const projScopesOf = new Map();
+                    const seenProjScopes = new Set();
+                    for (const r of reqProjections) {
+                        if (seenProjScopes.has(r.scope))
+                            throw new ControlPlaneCorruptError(`transaction journal carries two erasure projection rows for scope ${JSON.stringify(r.scope)} under one request (req ${JSON.stringify(a.req)}): ${jp}`);
+                        seenProjScopes.add(r.scope);
+                        if (r.selectHash !== a.selectHash)
+                            throw new ControlPlaneCorruptError(`transaction journal erasure projection row (req ${JSON.stringify(a.req)}, scope ${JSON.stringify(r.scope)}) disagrees with its anchor's selectHash: ${jp}`);
+                        for (const id of r.ids) {
+                            if (!pinned.has(id))
+                                throw new ControlPlaneCorruptError(`transaction journal erasure projection row carries ${JSON.stringify(id)} outside its anchor's pinned set (req ${JSON.stringify(a.req)}): ${jp}`);
+                            const list = projScopesOf.get(id) ?? [];
+                            list.push(r.scope);
+                            projScopesOf.set(id, list);
+                        }
+                    }
+                    const expectedNotFound = new Set();
+                    for (const id of a.ids) {
+                        const dRows = reqDeletes.filter((d) => d.id === id);
+                        let expectScope;
+                        if (dRows.length > 0) {
+                            const withFrom = dRows.find((d) => d.from !== undefined);
+                            expectScope = withFrom?.from?.scope;
+                        }
+                        else if (rowPresent(id)) {
+                            expectScope = rowsBinding(snapshotRows, id)?.scope;
+                        }
+                        else {
+                            expectedNotFound.add(id);
+                        }
+                        const cells = projScopesOf.get(id) ?? [];
+                        if (expectScope === undefined) {
+                            if (cells.length !== 0)
+                                throw new ControlPlaneCorruptError(`transaction journal erasure partition violation: ${JSON.stringify(id)} appears in a projection row but belongs to no scope cell (req ${JSON.stringify(a.req)}): ${jp}`);
+                        }
+                        else if (cells.length !== 1 || cells[0] !== expectScope) {
+                            throw new ControlPlaneCorruptError(`transaction journal erasure partition violation: ${JSON.stringify(id)} must appear exactly once in the ${JSON.stringify(expectScope)} projection row (req ${JSON.stringify(a.req)}): ${jp}`);
+                        }
+                    }
+                    const claimedNotFound = new Set(a.notFound);
+                    if (claimedNotFound.size !== expectedNotFound.size || [...expectedNotFound].some((id) => !claimedNotFound.has(id))) {
+                        throw new ControlPlaneCorruptError(`transaction journal erasure anchor's notFound set disagrees with the journal's own terminal facts (req ${JSON.stringify(a.req)}): ${jp}`);
+                    }
+                }
+                for (const r of requestRows) {
+                    if (!anchorRows.some((a) => a.req === r.req)) {
+                        throw new ControlPlaneCorruptError(`transaction journal erasure projection row (req ${JSON.stringify(r.req)}) has no same-journal anchor — projection rows ride the first-execution journal only: ${jp}`);
+                    }
+                }
             }
             for (const op of journal.ops) {
                 try {
@@ -914,6 +1431,8 @@ export class FileMemoryEngineBackend {
         const files = scanEntryFiles(dir, { exclude: isRoot ? this.excludedSubdirNames(scope) : undefined });
         const entries = [];
         const rows = sync ? this.loadLedger() : undefined;
+        const retrievalDeleted = !sync && files.length > 0 ? this.retrievalDeletedIds() : undefined;
+        const retrievalGuard = retrievalDeleted !== undefined && retrievalDeleted.size > 0 ? { deleted: retrievalDeleted, account: this.freshCommittedRowsPure() } : undefined;
         let ledgerChanged = false;
         const adoptedExternal = [];
         const moveEvents = [];
@@ -932,6 +1451,8 @@ export class FileMemoryEngineBackend {
             if (parsed.id === undefined)
                 continue;
             let entry = entryFromFile(text, parsed.id, f.slug, scope);
+            if (retrievalGuard !== undefined && retrievalGuard.deleted.has(entry.id) && rowsRev(retrievalGuard.account, entry.id) === undefined)
+                continue;
             if (rows) {
                 const committed = rowsRev(rows, entry.id);
                 const binding = rowsBinding(rows, entry.id);
@@ -962,6 +1483,21 @@ export class FileMemoryEngineBackend {
                         return undefined;
                     if (lockToken !== undefined)
                         this.assertTxnLockOwnership(lockToken);
+                    if (committed === undefined) {
+                        const verdict = this.resurrectionBackstopVerdict(entry.id);
+                        if (verdict === "erased") {
+                            this.containInboundReject({
+                                path: relPath,
+                                code: "invalid",
+                                reason: `resurrected entry refused: id ${entry.id} carries a delete evidence row on the store's custody chain and has no committed account row — a deleted entry's bytes reappearing on disk are never re-adopted (quarantined; restoring the content is an explicit write minting a NEW id)`,
+                            }, f.path, text, entry.id, undefined);
+                            continue;
+                        }
+                        if (verdict === "degraded") {
+                            this.announceAdoptionNotice(`chain-degraded|${relPath}|${entry.rev}`, `new memory entry file ${JSON.stringify(inlineUntrusted(relPath))} is NOT adopted: the transfer evidence chain is degraded (out-of-band tail damage), so "no delete row for this id" is no longer evidence it was never deleted — the file stays on disk unserved until the chain state is explicitly rebuilt (${CHAIN_DEGRADED_FILE})`);
+                            continue;
+                        }
+                    }
                     let finding = this.inboundGate(relPath, text);
                     if (finding === undefined && committed !== undefined)
                         finding = this.whitewashInboundFinding(relPath, entry, "restored");
@@ -1603,6 +2139,7 @@ export class FileMemoryEngineBackend {
         }
     }
     async applyPatchesLocked(patches, lockToken) {
+        this.assertTxnLockOwnership(lockToken);
         this.ledger = undefined;
         this.recoverJournal();
         this.migrateLockedIfNeeded(lockToken);
@@ -1658,7 +2195,13 @@ export class FileMemoryEngineBackend {
             }
             op.staged = staged;
         }
-        const coherentTransfers = transfers.filter((e) => e.channel === "migration" || bindingEquals(rowsBinding(rows, e.id), e.to));
+        const coherentTransfers = transfers.filter((e) => {
+            if (e.channel === "migration" || e.channel === "erasure-anchor" || e.channel === "erasure-request")
+                return true;
+            if (e.channel === "delete")
+                return !Object.prototype.hasOwnProperty.call(rows, e.id);
+            return bindingEquals(rowsBinding(rows, e.id), e.to);
+        });
         this.assertTxnLockOwnership(lockToken);
         if (coherentTransfers.length > 0)
             this.precheckTransfersAppendable();
@@ -1681,9 +2224,28 @@ export class FileMemoryEngineBackend {
         this.ledger = rows;
         this.saveLedger();
         this.appendTransfers(coherentTransfers);
-        rmSync(join(this.controlPlaneRoot, JOURNAL_FILE), { force: true });
+        this.closeJournalIfOurs(txn);
         return report;
     }
+    closeJournalIfOurs(txn) {
+        const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
+        let raw;
+        try {
+            raw = readFileSync(jp, "utf8");
+        }
+        catch {
+            return;
+        }
+        try {
+            const jp = JSON.parse(raw);
+            if (typeof jp !== "object" || jp === null || jp.txn !== txn)
+                return;
+        }
+        catch {
+            return;
+        }
+        rmSync(jp, { force: true });
+    }
     planOne(patch, report, ops, rows, plannedTargets, plannedDeletes, transfers) {
         if (!isValidEntryId(patch.id)) {
             report.conflicts.push({ op: patch.op, id: patch.id, reason: `invalid_id_shape (id ${JSON.stringify(patch.id)} fails the frontmatter id contract — the read side would drop it, leaving an applied-but-invisible entry)` });
@@ -1792,6 +2354,19 @@ export class FileMemoryEngineBackend {
             ops.push({ kind: "delete", target: found.path });
             ops.push({ kind: "shadow-delete", target: patch.id });
             const deletedBinding = rowsBinding(rows, patch.id);
+            if (deletedBinding !== undefined) {
+                const derived = this.bindingAbsPath(deletedBinding);
+                if (derived !== found.path)
+                    ops.push({ kind: "delete", target: derived });
+            }
+            transfers.push({
+                ev: randomUUID(),
+                channel: "delete",
+                id: patch.id,
+                ...(deletedBinding !== undefined ? { from: deletedBinding } : {}),
+                rev: currentRev,
+                at: this.now(),
+            });
             deleteRow(rows, patch.id);
             plannedDeletes.set(patch.id, deletedBinding);
             report.applied.push({ op: "delete", id: patch.id, slug: found.entry.slug });
@@ -1825,6 +2400,490 @@ export class FileMemoryEngineBackend {
         }
         return undefined;
     }
+    async eraseWithEvidence(input) {
+        const captured = captureErasureInput(input);
+        const bad = erasureRequestInvalid(captured);
+        if (bad !== undefined)
+            throw erasureCodedError(`eraseWithEvidence: ${bad}`, "config.memory_erasure_request");
+        const requestId = captured.requestId;
+        const select = captured.select;
+        const lock = await this.acquireTxnLock();
+        try {
+            this.assertTxnLockOwnership(lock.token);
+            this.ledger = undefined;
+            this.recoverJournal();
+            this.migrateLockedIfNeeded(lock.token);
+            const rows = cloneRows(this.loadLedger());
+            const chain = this.readTransferChain();
+            const degraded = this.chainDegradedMarkerPresent();
+            const custodyState = degraded ? "damaged" : "complete";
+            const selectHash = erasureSelectHash(select);
+            const now = this.now();
+            const localAnchors = chain.filter((r) => r.parsed.channel === "erasure-anchor" && r.parsed.origin === undefined && r.parsed.req === requestId);
+            if (localAnchors.length > 1) {
+                throw new ControlPlaneCorruptError(`erasure request ${JSON.stringify(requestId)} has ${localAnchors.length} anchors on the evidence chain — a second anchor cannot be minted by this store (the lock-held chain check runs first), so the chain was spliced out of band; refusing to pick one by file order (a human adjudicates)`);
+            }
+            const priorAnchor = localAnchors[0]?.parsed;
+            if (priorAnchor !== undefined && priorAnchor.selectHash !== selectHash) {
+                throw erasureCodedError(`eraseWithEvidence: requestId ${JSON.stringify(requestId)} was first executed with a DIFFERENT selector — a requestId names ONE request (pinned set ${JSON.stringify(priorAnchor.selectHash)}, this call ${JSON.stringify(selectHash)}); use a new requestId for a new selector`, "memory.erasure_selector_mismatch");
+            }
+            const replay = priorAnchor !== undefined;
+            let census;
+            const takeCensus = () => {
+                if (census === undefined) {
+                    census = this.censusProjectionsLocked();
+                    if (!census.complete) {
+                        throw erasureCodedError("eraseWithEvidence: the store-wide projection census could not read every scope — an erasure attestation cannot claim a clean delete over a store that cannot be fully read; fix the filesystem fault and retry (nothing was deleted, nothing was recorded)", "memory.erasure_census_incomplete");
+                    }
+                }
+                return census;
+            };
+            const rowPresent = (id) => Object.prototype.hasOwnProperty.call(rows, id);
+            let resolvedIds;
+            if (replay) {
+                resolvedIds = [...priorAnchor.ids];
+            }
+            else if ("ids" in select) {
+                resolvedIds = [...select.ids];
+            }
+            else if ("scope" in select) {
+                const scope = select.scope;
+                const ledgerIds = rowsEntries(rows)
+                    .filter(([id]) => rowsBinding(rows, id)?.scope === scope)
+                    .map(([id]) => id);
+                const ghostIds = [...takeCensus().byId.entries()]
+                    .filter(([id, projections]) => !rowPresent(id) && projections.some((p) => p.scope === scope))
+                    .map(([id]) => id);
+                resolvedIds = [...new Set([...ledgerIds, ...ghostIds])].sort();
+            }
+            else {
+                resolvedIds = lineageContributionsOfSession(this.controlPlaneRoot, select.sessionId)
+                    .map((c) => c.entryId)
+                    .sort();
+            }
+            const priorDeletes = new Map();
+            for (const r of chain) {
+                if (r.parsed.channel === "delete" && r.parsed.origin === undefined && r.parsed.req === requestId && typeof r.parsed.id === "string") {
+                    const rawFrom = r.parsed.from;
+                    const from = rawFrom !== undefined && typeof rawFrom.scope === "string" && typeof rawFrom.slug === "string" ? { scope: rawFrom.scope, slug: rawFrom.slug } : undefined;
+                    const prev = priorDeletes.get(r.parsed.id);
+                    priorDeletes.set(r.parsed.id, { ev: r.ev, at: r.parsed.at, ...(from !== undefined ? { from } : prev?.from !== undefined ? { from: prev.from } : {}) });
+                }
+            }
+            const transfers = [];
+            const ops = [];
+            const erased = [];
+            const erasedPreviously = [];
+            const notFoundRows = [];
+            const conflicts = [];
+            const rowIds = resolvedIds.filter((id) => rowPresent(id));
+            const accountAbsentIds = resolvedIds.filter((id) => !rowPresent(id));
+            if (rowIds.some((id) => isValidEntryId(id)) || accountAbsentIds.length > 0)
+                takeCensus();
+            const censusOf = (id) => census?.byId.get(id) ?? [];
+            const unledgeredLiveIds = accountAbsentIds.filter((id) => censusOf(id).length > 0);
+            const trulyAbsentIds = accountAbsentIds.filter((id) => censusOf(id).length === 0);
+            if (!replay) {
+                transfers.push({ ev: randomUUID(), channel: "erasure-anchor", req: requestId, select: cloneErasureSelect(select), selectHash, ids: [...resolvedIds], notFound: trulyAbsentIds, at: now });
+                const byScope = new Map();
+                for (const id of rowIds) {
+                    if (!isValidEntryId(id))
+                        continue;
+                    const binding = rowsBinding(rows, id);
+                    if (binding === undefined)
+                        continue;
+                    const list = byScope.get(binding.scope) ?? [];
+                    list.push(id);
+                    byScope.set(binding.scope, list);
+                }
+                for (const scope of [...byScope.keys()].sort()) {
+                    transfers.push({ ev: randomUUID(), channel: "erasure-request", req: requestId, scope, selectHash, ids: byScope.get(scope) ?? [], at: now });
+                }
+            }
+            const lineageCommitted = resolvedIds.length > 0 ? readLineageRecord(this.controlPlaneRoot).committed : {};
+            const preSessionsOf = (id) => Object.prototype.hasOwnProperty.call(lineageCommitted, id) ? Object.keys(lineageCommitted[id] ?? {}).sort() : [];
+            for (const id of rowIds) {
+                const row = rows[id];
+                if (row === undefined)
+                    continue;
+                const preSessions = preSessionsOf(id);
+                if (!isValidEntryId(id)) {
+                    const ev = randomUUID();
+                    transfers.push({ ev, channel: "delete", id, rev: row.rev, req: requestId, sessions: preSessions, legacyId: true, at: now });
+                    deleteRow(rows, id);
+                    erased.push({ id, rev: row.rev, binding: { state: "unbound" }, evidenceEv: ev, projectionsRemoved: 0, sessions: preSessions });
+                    continue;
+                }
+                try {
+                    const binding = rowsBinding(rows, id);
+                    const idOps = [{ kind: "shadow-delete", target: id }];
+                    const targets = new Set();
+                    if (binding !== undefined)
+                        targets.add(this.bindingAbsPath(binding));
+                    const censusProjections = censusOf(id);
+                    for (const p of censusProjections)
+                        targets.add(this.bindingAbsPath(p));
+                    for (const t of targets)
+                        idOps.push({ kind: "delete", target: t });
+                    const ev = randomUUID();
+                    transfers.push({ ev, channel: "delete", id, ...(binding !== undefined ? { from: binding } : {}), rev: row.rev, req: requestId, sessions: preSessions, at: now });
+                    ops.push(...idOps);
+                    deleteRow(rows, id);
+                    erased.push({
+                        id,
+                        rev: row.rev,
+                        binding: binding !== undefined ? { state: "bound", scope: binding.scope, slug: binding.slug } : { state: "unbound" },
+                        evidenceEv: ev,
+                        projectionsRemoved: censusProjections.length,
+                        sessions: preSessions,
+                    });
+                }
+                catch (err) {
+                    conflicts.push({ id, reason: `io error: ${err instanceof Error ? err.message : String(err)}` });
+                }
+            }
+            for (const id of unledgeredLiveIds) {
+                const preSessions = preSessionsOf(id);
+                try {
+                    const projections = censusOf(id);
+                    let rev = "unledgered";
+                    const first = projections[0];
+                    if (first !== undefined) {
+                        const txt = readSafe(this.bindingAbsPath(first));
+                        if (txt !== undefined)
+                            rev = computeEntryRev(entryFromFile(txt, id, first.slug, first.scope));
+                    }
+                    const idOps = [{ kind: "shadow-delete", target: id }];
+                    for (const p of projections)
+                        idOps.push({ kind: "delete", target: this.bindingAbsPath(p) });
+                    const ev = randomUUID();
+                    transfers.push({ ev, channel: "delete", id, rev, req: requestId, sessions: preSessions, at: now });
+                    ops.push(...idOps);
+                    erased.push({ id, rev, binding: { state: "unbound" }, evidenceEv: ev, projectionsRemoved: projections.length, sessions: preSessions });
+                }
+                catch (err) {
+                    conflicts.push({ id, reason: `io error: ${err instanceof Error ? err.message : String(err)}` });
+                }
+            }
+            for (const id of trulyAbsentIds) {
+                if (erased.some((e) => e.id === id))
+                    continue;
+                const prior = priorDeletes.get(id);
+                if (prior !== undefined && custodyState === "complete") {
+                    const fromFree = prior.from !== undefined &&
+                        !Object.values(rows).some((row) => row.scope === prior.from.scope && row.slug === prior.from.slug) &&
+                        !existsSync(this.bindingAbsPath({ scope: prior.from.scope, slug: prior.from.slug }));
+                    erasedPreviously.push({ id, ev: prior.ev, at: prior.at, ...(fromFree ? { from: prior.from } : {}) });
+                }
+                else {
+                    notFoundRows.push({ id, ...(custodyState !== "complete" ? { historyUnknown: true } : {}) });
+                }
+            }
+            if (ops.length > 0 || transfers.length > 0) {
+                const txn = `${Date.now()}-erase-${randomUUID().slice(0, 8)}`;
+                this.assertTxnLockOwnership(lock.token);
+                this.precheckTransfersAppendable();
+                const journal = { txn, ops, ledger2: ledgerEnvelope(rows, this.envelopeExtras), transfers };
+                atomicWriteFileSync(join(this.controlPlaneRoot, JOURNAL_FILE), JSON.stringify(journal));
+                for (const op of ops) {
+                    if (op.kind === "delete") {
+                        rmSync(op.target, { force: true });
+                    }
+                    else if (op.kind === "shadow-delete") {
+                        rmSync(this.shadowPath(op.target), { force: true });
+                    }
+                }
+                this.ledger = rows;
+                this.saveLedger();
+                this.appendTransfers(transfers);
+                this.closeJournalIfOurs(txn);
+            }
+            const late = captureAndClearLineageForEntries(this.controlPlaneRoot, resolvedIds);
+            for (const e of erased) {
+                const lateSessions = late.get(e.id);
+                if (lateSessions !== undefined && lateSessions.length > 0)
+                    e.sessions = [...new Set([...e.sessions, ...lateSessions])].sort();
+            }
+            const resolvedSet = new Set(resolvedIds);
+            const quarantineHits = [];
+            let quarantineOpaque = 0;
+            const qDir = join(this.controlPlaneRoot, QUARANTINE_DIR);
+            let qNames = [];
+            try {
+                qNames = readdirSync(qDir);
+            }
+            catch (err) {
+                if (err.code !== "ENOENT") {
+                    throw new ControlPlaneCorruptError(`erasure residual enumeration failed: the quarantine dir could not be read (${err.code ?? "io error"}) at ${qDir} — the attestation must not silently claim an empty residual set; retry after the filesystem fault clears (the deletions themselves are committed and a replay converges)`);
+                }
+            }
+            for (const name of qNames.sort()) {
+                const text = readSafe(join(qDir, name));
+                if (text === undefined) {
+                    quarantineOpaque++;
+                    continue;
+                }
+                const qid = parseEntryFile(text).id;
+                if (qid === undefined) {
+                    quarantineOpaque++;
+                    continue;
+                }
+                if (resolvedSet.has(qid))
+                    quarantineHits.push(name);
+            }
+            const claimed = new Set([...erased.map((e) => e.id), ...erasedPreviously.map((e) => e.id)]);
+            const notFoundSet = new Set(notFoundRows.map((n) => n.id));
+            const complete = conflicts.length === 0 && resolvedIds.every((id) => claimed.has(id) || (custodyState === "complete" && notFoundSet.has(id)));
+            return {
+                v: 1,
+                requestId,
+                at: now,
+                status: complete ? "complete" : "partial",
+                evidenceCapability: "journal",
+                custodyState,
+                select: cloneErasureSelect(select),
+                selectHash,
+                resolvedIds,
+                erased,
+                notFound: notFoundRows,
+                ...(erasedPreviously.length > 0 ? { erasedPreviously } : {}),
+                conflicts,
+                residuals: { quarantineHits, quarantineOpaque, propagation: "local-store-only" },
+            };
+        }
+        catch (err) {
+            this.ledger = undefined;
+            throw err;
+        }
+        finally {
+            lock.release();
+        }
+    }
+    static AUDIT_FENCE_ATTEMPTS = 6;
+    static AUDIT_FENCE_RETRY_MS = 25;
+    auditJournalPending() {
+        return readControlFileOrAbsent(join(this.controlPlaneRoot, JOURNAL_FILE), "transaction journal") !== undefined;
+    }
+    auditReadLedger() {
+        const path = join(this.controlPlaneRoot, LEDGER_FILE);
+        const raw = readControlFileOrAbsent(path, "committed-rev ledger");
+        if (raw === undefined)
+            return { raw, rows: Object.create(null) };
+        const parsed = parseLedgerText(raw, path);
+        if (parsed.form === "v1") {
+            throw new Error(`memory audit read refused: the committed-rev ledger at ${path} is still schema v1 (pre-binding) — ` +
+                `migrate first (the store migrates itself at its next uncontended write/read entry or checkControlPlane); ` +
+                `an audit read never triggers the migration`);
+        }
+        return { raw, rows: parsed.rows };
+    }
+    async auditStable(read) {
+        for (let attempt = 0; attempt < FileMemoryEngineBackend.AUDIT_FENCE_ATTEMPTS; attempt++) {
+            if (attempt > 0)
+                await new Promise((r) => setTimeout(r, FileMemoryEngineBackend.AUDIT_FENCE_RETRY_MS));
+            if (this.auditJournalPending())
+                continue;
+            const before = this.auditReadLedger();
+            let out;
+            try {
+                out = read(before.rows, attempt === FileMemoryEngineBackend.AUDIT_FENCE_ATTEMPTS - 1);
+            }
+            catch (err) {
+                if (err instanceof AuditObservationUnstableError)
+                    continue;
+                throw err;
+            }
+            if (this.auditJournalPending())
+                continue;
+            const after = readControlFileOrAbsent(join(this.controlPlaneRoot, LEDGER_FILE), "committed-rev ledger");
+            if (after !== before.raw)
+                continue;
+            return out;
+        }
+        throw new AuditSnapshotContendedError(`memory audit read refused after ${FileMemoryEngineBackend.AUDIT_FENCE_ATTEMPTS} attempts: a transaction journal stayed pending ` +
+            `(or the ledger kept advancing) across every try — the committed account cannot be snapshotted without tearing. ` +
+            `A journal that never clears is a crashed transaction: the next backend construction or locked write recovers it.`);
+    }
+    resolveCommittedContent(id, rev, binding, final) {
+        if (binding === undefined)
+            return { state: "unavailable", reason: "carrier-missing" };
+        if (!isValidEntryId(id))
+            return { state: "unavailable", reason: "carrier-missing" };
+        const shadowRaw = readControlFileOrAbsent(this.shadowPath(id), "committed shadow copy");
+        const absPath = this.bindingAbsPath(binding);
+        if (shadowRaw !== undefined) {
+            const shadowEntry = entryFromFile(shadowRaw, id, binding.slug, binding.scope);
+            if (shadowEntry.rev !== rev) {
+                let projText;
+                try {
+                    projText = readFileSync(absPath, "utf8");
+                }
+                catch {
+                    projText = undefined;
+                }
+                if (projText !== undefined && parseEntryFile(projText).id === id) {
+                    const projEntry = entryFromFile(projText, id, binding.slug, binding.scope);
+                    if (projEntry.rev === rev)
+                        return { state: "present", entry: projEntry };
+                }
+                if (!final)
+                    throw new AuditObservationUnstableError(`shadow bytes for ${id} do not carry the committed rev — possible adoption in flight`);
+                if (this.txnInFlight()) {
+                    throw new AuditSnapshotContendedError(`memory audit read refused: shadow bytes for ${id} do not carry the committed rev while a live writer holds the txn lock — an adoption is in flight; retry when the store settles.`);
+                }
+                return { state: "unavailable", reason: "carrier-missing" };
+            }
+            return probeProjection(absPath, id) === "present" ? { state: "present", entry: shadowEntry } : { state: "unavailable", reason: "carrier-missing" };
+        }
+        let text;
+        try {
+            text = readFileSync(absPath, "utf8");
+        }
+        catch {
+            text = undefined;
+        }
+        if (text !== undefined && parseEntryFile(text).id === id) {
+            const diskEntry = entryFromFile(text, id, binding.slug, binding.scope);
+            if (diskEntry.rev === rev)
+                return { state: "present", entry: diskEntry };
+        }
+        return { state: "unavailable", reason: "shadowless-legacy" };
+    }
+    async committedSnapshotOf(id) {
+        return this.auditStable((rows, final) => {
+            const row = Object.prototype.hasOwnProperty.call(rows, id) ? rows[id] : undefined;
+            if (row === undefined)
+                return { state: "absent", id };
+            const binding = rowsBinding(rows, id);
+            return {
+                state: "row",
+                id,
+                rev: row.rev,
+                binding: this.publicBinding(row, binding),
+                content: this.resolveCommittedContent(id, row.rev, binding, final),
+            };
+        });
+    }
+    publicBinding(row, binding) {
+        if (binding === undefined)
+            return { state: "unbound" };
+        return {
+            state: "bound",
+            scope: binding.scope,
+            slug: binding.slug,
+            ...(typeof row.at === "number" ? { at: row.at } : {}),
+            ...(row.prev !== undefined ? { prev: { ...row.prev } } : {}),
+        };
+    }
+    async committedSnapshotsOfScopes(scopes) {
+        const want = new Set(scopes);
+        try {
+            return await this.auditStable((rows, final) => {
+                const out = { complete: true, rows: [], unbound: [] };
+                for (const [id, row] of rowsEntries(rows)) {
+                    const binding = rowsBinding(rows, id);
+                    if (binding === undefined) {
+                        out.unbound.push(id);
+                        continue;
+                    }
+                    if (!want.has(binding.scope))
+                        continue;
+                    out.rows.push({
+                        state: "row",
+                        id,
+                        rev: row.rev,
+                        binding: this.publicBinding(row, binding),
+                        content: this.resolveCommittedContent(id, row.rev, binding, final),
+                    });
+                }
+                return out;
+            });
+        }
+        catch (err) {
+            if (err instanceof AuditSnapshotContendedError)
+                return { complete: false };
+            throw err;
+        }
+    }
+    async custodyOf(id) {
+        const transfersPath = join(this.controlPlaneRoot, TRANSFERS_FILE);
+        for (let attempt = 0; attempt < FileMemoryEngineBackend.AUDIT_FENCE_ATTEMPTS; attempt++) {
+            if (attempt > 0)
+                await new Promise((r) => setTimeout(r, FileMemoryEngineBackend.AUDIT_FENCE_RETRY_MS));
+            if (this.auditJournalPending())
+                continue;
+            const rawBefore = readControlFileOrAbsent(transfersPath, "transfer evidence log");
+            const out = this.custodyReadPure(id, rawBefore);
+            if (out.state === "complete" && out.events.length === 0) {
+                const ledgerRaw = readControlFileOrAbsent(join(this.controlPlaneRoot, LEDGER_FILE), "committed-rev ledger");
+                if (ledgerRaw !== undefined) {
+                    const parsed = parseLedgerText(ledgerRaw, join(this.controlPlaneRoot, LEDGER_FILE));
+                    if (parsed.form === "v2" && Object.prototype.hasOwnProperty.call(parsed.rows, id) && parsed.rows[id]?.prev !== undefined) {
+                        out.state = "damaged";
+                    }
+                }
+            }
+            if (this.auditJournalPending())
+                continue;
+            if (readControlFileOrAbsent(transfersPath, "transfer evidence log") !== rawBefore)
+                continue;
+            return out;
+        }
+        throw new AuditSnapshotContendedError(`memory custody read refused after ${FileMemoryEngineBackend.AUDIT_FENCE_ATTEMPTS} attempts: a transaction journal stayed pending across ` +
+            `every try — the evidence chain may hold a committed transaction's rows not yet appended. A journal that never ` +
+            `clears is a crashed transaction: the next backend construction or locked write recovers it.`);
+    }
+    custodyReadPure(id, raw) {
+        const path = join(this.controlPlaneRoot, TRANSFERS_FILE);
+        const out = { state: "complete", events: [] };
+        if (raw === undefined)
+            return out;
+        const byEv = new Map();
+        const lines = raw.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (line === undefined || line === "")
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                if (lines.slice(i + 1).every((l) => l === "")) {
+                    out.state = "damaged";
+                    break;
+                }
+                throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is unparseable (not a torn tail — fail-closed): ${path}`);
+            }
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is not an object (fail-closed): ${path}`);
+            }
+            const e = parsed;
+            if (typeof e.ev !== "string" || e.ev.length === 0 || typeof e.channel !== "string" || e.channel.length === 0 || typeof e.at !== "number" || !Number.isInteger(e.at)) {
+                throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is missing its base keys (ev/channel/at) — fail-closed: ${path}`);
+            }
+            if (KNOWN_TRANSFER_CHANNELS.has(e.channel)) {
+                const invalid = transferEventInvalid(parsed);
+                if (invalid !== undefined)
+                    throw new ControlPlaneCorruptError(`transfer evidence log line ${i + 1} is invalid (${invalid}): ${path}`);
+            }
+            const canonical = canonicalJsonStringify(e);
+            const seen = byEv.get(e.ev);
+            if (seen !== undefined) {
+                if (seen.has(canonical))
+                    continue;
+                out.state = "damaged";
+                out.reason ??= `evidence chain carries event id ${JSON.stringify(e.ev)} twice with DIFFERENT payloads (line ${i + 1}) — one ev is one identity; the chain was spliced or corrupted out of band and this store's own write path refuses to operate on it`;
+                seen.add(canonical);
+            }
+            else {
+                byEv.set(e.ev, new Set([canonical]));
+            }
+            if (e.id === id)
+                out.events.push(e);
+        }
+        return out;
+    }
     async getConsolidationCursor(scope) {
         const cursors = this.readCursors();
         return cursors[scope];
@@ -1838,12 +2897,16 @@ export class FileMemoryEngineBackend {
         try {
             const parsed = JSON.parse(readFileSync(join(this.controlPlaneRoot, CURSORS_FILE), "utf8"));
             if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                return Object.fromEntries(Object.entries(parsed).filter(([, v]) => typeof v === "string"));
+                const out = Object.create(null);
+                for (const [k, v] of Object.entries(parsed))
+                    if (typeof v === "string")
+                        out[k] = v;
+                return out;
             }
         }
         catch {
         }
-        return {};
+        return Object.create(null);
     }
 }
 function headerOf(e, path) {