@sema-agent/core 5.45.0 → 5.46.0

package/dist/core/memory-engine/frontmatter.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { MEMORY_ORIGIN_CAUSES } from "./types.js";
 const FM_FENCE = "---";
 const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,63}$/;
 export function isValidEntryId(value) {
@@ -28,8 +29,12 @@ export function parseEntryFile(text) {
     const provRaw = [];
     const provUnknown = [];
     const prov = {};
+    let inOrigin = false;
+    const originRaw = [];
+    const originUnknown = [];
+    const orig = {};
     for (let i = 1; i < end; i++) {
-        const line = lines[i];
+        const line = lines[i] ?? "";
         const trimmed = line.trim();
         if (trimmed === "")
             continue;
@@ -37,6 +42,7 @@ export function parseEntryFile(text) {
         if (!indented) {
             inMetadata = false;
             inProvenance = false;
+            inOrigin = false;
         }
         if (inMetadata) {
             const m = /^\s+type:\s*(.+?)\s*$/.exec(line);
@@ -72,11 +78,35 @@ export function parseEntryFile(text) {
             inMetadata = true;
             continue;
         }
+        if (inOrigin) {
+            originRaw.push(line);
+            const m = /^\s+([A-Za-z][A-Za-z0-9_-]*):\s*(.*?)\s*$/.exec(line);
+            if (m) {
+                const [, k = "", v = ""] = m;
+                if (k === "taint")
+                    orig.taint = v;
+                else if (k === "cause")
+                    orig.cause = v;
+                else if (k === "at")
+                    orig.at = /^-?\d+(\.\d+)?$/.test(v) ? Number(v) : Number.NaN;
+                else
+                    originUnknown.push(line);
+            }
+            else {
+                originUnknown.push(line);
+            }
+            continue;
+        }
         if (/^provenance:\s*$/.test(trimmed)) {
             inProvenance = true;
             provRaw.push(line);
             continue;
         }
+        if (/^origin:\s*$/.test(trimmed) && originRaw.length === 0) {
+            inOrigin = true;
+            originRaw.push(line);
+            continue;
+        }
         const kv = /^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*?)\s*$/.exec(trimmed);
         if (!kv || indented) {
             extra.push(line);
@@ -126,6 +156,15 @@ export function parseEntryFile(text) {
             extra.push(...provRaw);
         }
     }
+    if (originRaw.length > 0) {
+        if (orig.taint === "external" && typeof orig.at === "number" && Number.isFinite(orig.at) && (orig.cause === undefined || MEMORY_ORIGIN_CAUSES.includes(orig.cause))) {
+            fm.origin = { taint: "external", ...(orig.cause !== undefined ? { cause: orig.cause } : {}), at: orig.at };
+            extra.push(...originUnknown);
+        }
+        else {
+            extra.push(...originRaw);
+        }
+    }
     if (extra.length > 0)
         fm.extra = extra;
     let body = lines.slice(end + 1).join("\n");
@@ -149,6 +188,9 @@ export function serializeEntryFile(entry) {
     }
     if (fm.trust !== undefined)
         lines.push(`trust: ${fm.trust}`);
+    if (fm.origin !== undefined) {
+        lines.push("origin:", `  taint: ${fm.origin.taint}`, ...(fm.origin.cause !== undefined ? [`  cause: ${fm.origin.cause}`] : []), `  at: ${fm.origin.at}`);
+    }
     if (fm.extra)
         lines.push(...fm.extra);
     lines.push(FM_FENCE, "");
@@ -168,9 +210,107 @@ export function computeEntryRev(entry) {
         ...(fm.provenance !== undefined || fm.trust !== undefined
             ? [fm.trust ?? null, fm.provenance !== undefined ? [fm.provenance.kind, fm.provenance.path, fm.provenance.contentHash, fm.provenance.ingestedAt] : null]
             : []),
+        ...(fm.origin !== undefined ? [["origin", fm.origin.taint, fm.origin.cause ?? null, fm.origin.at]] : []),
     ]);
     return createHash("sha256").update(canonical, "utf8").digest("hex").slice(0, 16);
 }
+const ORIGIN_FORM_LINE_RE = /^\s*origin\s*:/;
+export function hasOriginFormExtra(fm) {
+    return fm.extra !== undefined && fm.extra.some((line) => ORIGIN_FORM_LINE_RE.test(line));
+}
+function walkExtraOrigin(extra) {
+    if (extra === undefined)
+        return { carriers: 0, first: undefined };
+    let carriers = 0;
+    let inBlock = false;
+    let blockIndex = 0;
+    let taint;
+    let cause;
+    let at;
+    for (const line of extra) {
+        const trimmed = line.trim();
+        if (/^origin\s*:\s*$/.test(trimmed)) {
+            carriers += 1;
+            inBlock = true;
+            blockIndex += 1;
+            continue;
+        }
+        if (ORIGIN_FORM_LINE_RE.test(line) && !inBlock) {
+            carriers += 1;
+            continue;
+        }
+        if (!/^\s/.test(line))
+            inBlock = false;
+        if (!inBlock || blockIndex !== 1)
+            continue;
+        const m = /^\s+([A-Za-z][A-Za-z0-9_-]*):\s*(.*?)\s*$/.exec(line);
+        if (m === null)
+            continue;
+        const [, k = "", v = ""] = m;
+        if (k === "taint" && taint === undefined)
+            taint = v;
+        else if (k === "cause" && cause === undefined)
+            cause = v;
+        else if (k === "at" && at === undefined)
+            at = /^-?\d+(\.\d+)?$/.test(v) ? Number(v) : Number.NaN;
+    }
+    if (carriers === 0)
+        return { carriers: 0, first: undefined };
+    if (taint === "external" && typeof at === "number" && Number.isFinite(at) && (cause === undefined || MEMORY_ORIGIN_CAUSES.includes(cause))) {
+        return { carriers, first: { taint: "external", ...(cause !== undefined ? { cause: cause } : {}), at } };
+    }
+    return { carriers, first: { taint: "external", at: 0 } };
+}
+export function committedOriginOf(fm) {
+    if (fm.origin !== undefined)
+        return { taint: fm.origin.taint, ...(fm.origin.cause !== undefined ? { cause: fm.origin.cause } : {}), at: fm.origin.at };
+    if (!hasOriginFormExtra(fm))
+        return undefined;
+    return walkExtraOrigin(fm.extra).first ?? { taint: "external", at: 0 };
+}
+export function originEquals(a, b) {
+    if (a === undefined || b === undefined)
+        return a === b;
+    return a.taint === b.taint && a.cause === b.cause && a.at === b.at;
+}
+export function ambiguousOriginRepresentation(fm) {
+    const { carriers, first } = walkExtraOrigin(fm.extra);
+    const total = carriers + (fm.origin !== undefined ? 1 : 0);
+    if (total <= 1)
+        return false;
+    if (total === 2 && fm.origin !== undefined && carriers === 1)
+        return !originEquals(fm.origin, first);
+    return true;
+}
+export function stripModelWrittenOrigin(fm) {
+    let stripped = false;
+    if (fm.origin !== undefined) {
+        delete fm.origin;
+        stripped = true;
+    }
+    if (fm.extra !== undefined && fm.extra.some((line) => ORIGIN_FORM_LINE_RE.test(line))) {
+        const kept = [];
+        let inBlock = false;
+        for (const line of fm.extra) {
+            if (ORIGIN_FORM_LINE_RE.test(line)) {
+                inBlock = /^\s*origin\s*:\s*$/.test(line);
+                stripped = true;
+                continue;
+            }
+            if (inBlock && /^\s/.test(line)) {
+                stripped = true;
+                continue;
+            }
+            inBlock = false;
+            kept.push(line);
+        }
+        if (kept.length > 0)
+            fm.extra = kept;
+        else
+            delete fm.extra;
+    }
+    return stripped;
+}
 export function entryFromFile(text, id, slug, scope) {
     const parsed = parseEntryFile(text);
     const entry = { id, slug, frontmatter: parsed.frontmatter, body: parsed.body, rev: "", scope };

package/dist/core/memory-engine/header-hints.d.ts

@@ -25,6 +25,23 @@ export interface V2HeaderHints {
     /** `applies-when: <free text>` — non-empty free text, trimmed. */
     appliesWhen?: string;
 }
+/**
+ * design/336 §4.1 — the MECHANICAL instruction-form predicate (deliberately zero semantic judgment:
+ * no model, no content heuristics — SOTA R4's LLM-judge ban). An entry is instruction-form ⇔
+ *  - `metadata.type === "feedback"` (the declared behavior-correction type), OR
+ *  - its v2 header hints declare an injection/trigger privilege: `pinned` / `triggers` /
+ *    `applies-when` (the three hints whose whole purpose is automatic or conditional injection;
+ *    `last-confirmed` is bookkeeping and does not count).
+ * Escape analysis: an entry that declares none of these rides the ordinary-entry row — where the
+ * origin-marker floor governs — so NOT declaring buys no privilege; declaring buys injection
+ * privilege AND walks through the exposure hard gate with it. ONE exported predicate on purpose:
+ * the write side (harvest hard gate) and any read-side consumer must judge through the same
+ * function, never through re-implementations that can drift.
+ */
+export declare function isInstructionEntry(fm: {
+    type?: string;
+    extra?: readonly string[];
+}): boolean;
 /** Read the v2 header hints out of an entry's preserved-verbatim `extra` lines. First well-formed
  *  occurrence of each key wins (duplicate lines are model bookkeeping noise, not a merge input). */
 export declare function readV2HeaderHints(extra: readonly string[] | undefined): V2HeaderHints;

package/dist/core/memory-engine/header-hints.js

@@ -1,5 +1,11 @@
 const LINE_RE = /^\s*([A-Za-z][A-Za-z0-9_-]*):\s*(.*?)\s*$/;
 const ISO_DATE_PREFIX_RE = /^\d{4}-\d{2}-\d{2}(?:$|[T\s])/;
+export function isInstructionEntry(fm) {
+    if (fm.type === "feedback")
+        return true;
+    const hints = readV2HeaderHints(fm.extra);
+    return hints.pinned !== undefined || hints.triggers !== undefined || hints.appliesWhen !== undefined;
+}
 export function readV2HeaderHints(extra) {
     const out = {};
     if (extra === undefined)

package/dist/core/memory-engine/index.d.ts

@@ -4,9 +4,10 @@ export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_S
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, type ScannedEntryFile, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, type MemoryExportSnapshot, } from "./file-backend.js";
 export { computeBundleSectionHashes, computeMemoryBundleHash, memoryBundleInvalid, type MemoryExportBundle, type MemoryImportReport, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, } from "./export-bundle.js";
 export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAppendResult, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, } from "./layout.js";
-export { readV2HeaderHints, type V2HeaderHints } from "./header-hints.js";
-export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, type ParsedEntryFile } from "./frontmatter.js";
-export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
+export { readV2HeaderHints, isInstructionEntry, type V2HeaderHints } from "./header-hints.js";
+export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, type ParsedEntryFile } from "./frontmatter.js";
+export { MEMORY_ORIGIN_CAUSES } from "./types.js";
+export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, } from "./memory-backend-contract.js";
 export { SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, } from "./scope-contract.js";
 export { migrateScope, type MigrateScopeReport } from "./migrate.js";

package/dist/core/memory-engine/index.js

@@ -4,8 +4,9 @@ export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_S
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, erasureSelectHash, } from "./file-backend.js";
 export { computeBundleSectionHashes, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
 export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, } from "./layout.js";
-export { readV2HeaderHints } from "./header-hints.js";
-export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile } from "./frontmatter.js";
+export { readV2HeaderHints, isInstructionEntry } from "./header-hints.js";
+export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals } from "./frontmatter.js";
+export { MEMORY_ORIGIN_CAUSES } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, } from "./memory-backend-contract.js";
 export { SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, } from "./scope-contract.js";
 export { migrateScope } from "./migrate.js";

package/dist/core/memory-engine/layout.d.ts

@@ -1,4 +1,4 @@
-import type { MemoryAnnouncement } from "./types.js";
+import { type MemoryAnnouncement } from "./types.js";
 /** Cursor sidecar for the design/84 Seam B pair on the FileBackend (`{ [scope]: cursor }`). B3: control plane. */
 export declare const CURSORS_FILE = "cursors.json";
 /** The control-plane subdir name under a key dir — ONE spelling for every derivation and for the
@@ -285,6 +285,11 @@ export declare const SESSION_POLLUTION_DIR = "session-pollution";
 export interface SessionPollutionRecord {
     at: number;
     reason: string;
+    /** design/336 §2.2 — the structured mechanical cause of the exposure (the value an origin marker
+     *  minted off this record carries). ADDITIVE: records written before the field existed read as
+     *  honestly cause-less (the mint then falls back to `"observed"`); old readers narrow-take the
+     *  two fields they know. */
+    cause?: import("./types.js").MemoryOriginCause;
 }
 /**
  * Mark `sessionId` polluted (idempotent; the FIRST record wins — `wx` create refuses overwrite).
@@ -299,7 +304,7 @@ export interface SessionPollutionRecord {
  * stays polluted for this process either way).
  */
 export type SessionPollutionMarkOutcome = "created" | "existed" | "unpersisted";
-export declare function markSessionPolluted(controlDir: string, sessionId: string, reason: string, now: () => number): SessionPollutionMarkOutcome;
+export declare function markSessionPolluted(controlDir: string, sessionId: string, reason: string, now: () => number, cause?: import("./types.js").MemoryOriginCause): SessionPollutionMarkOutcome;
 /** Read the durable pollution record for `sessionId` (undefined = no marker).
  *  A marker that EXISTS still reads as polluted whether or not its bytes can be read or parsed
  *  (fail-closed: neither corruption nor an unreadable node may launder the state) — a synthesized
@@ -360,6 +365,11 @@ export declare const CHALLENGED_HISTORY_FILE = "usage-challenged-history.json";
 export interface LineageContribution {
     lastRev: string;
     lastAt: number;
+    /** design/336 — carried from the staged row at promotion: the contribution's content (at
+     *  `lastRev`) carries its external-origin marker, so the pollution retroaction sweeps owe it no
+     *  challenge (the account travels with the entry). Absence = unmarked content — the sweeps'
+     *  domain (older vintages read as unmarked, the conservative side). */
+    marked?: true;
 }
 /** One staged (pre-commit) row: an entry this transaction WOULD commit. `kind: "latch-only"` marks
  *  a bundle-import SYNTHETIC latch row (design/178 v2-c §1): it withholds the id on the model-visible
@@ -370,6 +380,12 @@ export interface LineagePendingRow {
     entryId: string;
     rev: string;
     kind?: "latch-only";
+    /** design/336 — set ⇔ the staged content CARRIES its external-origin marker (`frontmatter.origin`
+     *  in the very rev this row names): the exposure account travels WITH the entry, so promotion
+     *  settlement owes it no pollution challenge (challenging it would re-quarantine a tag-admission
+     *  at the read face). Absence = the row's content is unmarked (older vintages included) — the
+     *  conservative side: an unmarked row of a marked session is challenged. */
+    marked?: true;
 }
 /** One staged transaction: rows land BEFORE `applyPatches`; the commit credential lands after it
  *  succeeds; promotion consumes both. A pending txn without a credential is the crash window —
@@ -406,6 +422,10 @@ export interface LineagePromotion {
     entryId: string;
     sessionId: string;
     rev: string;
+    /** design/336 — carried through from {@link LineagePendingRow.marked}: the promoted content
+     *  already carries its external-origin marker, so promotion settlement skips the pollution
+     *  challenge for it. */
+    marked?: true;
 }
 /** Promote a CREDENTIALED pending transaction: rows named by the credential's applied set join the
  *  committed contribution set (deduped by (entryId, sessionId) — a repeat pair refreshes
@@ -473,6 +493,8 @@ export declare function lineageLatchedIds(controlDir: string): Set<string>;
 export declare function lineageContributionsOfSession(controlDir: string, sessionId: string): Array<{
     entryId: string;
     lastRev: string;
+    lastAt: number;
+    marked?: true;
 }>;
 /** design/178 v2-a §1.3 — the BY-ENTRY lineage account, from ONE parse of the ledger (the
  *  by-session read's transpose; the committed set is keyed by entryId, so the index is O(1) after
@@ -538,6 +560,7 @@ export declare function importLineageCommitted(controlDir: string, rows: Readonl
     sessionId: string;
     lastRev: string;
     lastAt: number;
+    marked?: true;
 }>): LineageImportDivergence[];
 /** Full-ledger read (tests / host observability). Throws on corruption. */
 export declare function readLineageRecord(controlDir: string): {

package/dist/core/memory-engine/layout.js

@@ -3,6 +3,7 @@ const { O_WRONLY, O_CREAT, O_TRUNC, O_NOFOLLOW, O_EXCL } = fsConstants;
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { MEMORY_ORIGIN_CAUSES } from "./types.js";
 const SCOPES_FILE = "scopes.json";
 export const CURSORS_FILE = "cursors.json";
 export const CONTROL_PLANE_DIR = ".engine";
@@ -734,11 +735,11 @@ export const SESSION_POLLUTION_DIR = "session-pollution";
 function pollutionPath(controlDir, sessionId) {
     return join(controlDir, SESSION_POLLUTION_DIR, `${encodeURIComponent(sessionId)}.json`);
 }
-export function markSessionPolluted(controlDir, sessionId, reason, now) {
+export function markSessionPolluted(controlDir, sessionId, reason, now, cause) {
     const path = pollutionPath(controlDir, sessionId);
     try {
         ensureDirExists(dirname(path));
-        const record = { at: now(), reason };
+        const record = { at: now(), reason, ...(cause !== undefined ? { cause } : {}) };
         writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
         return "created";
     }
@@ -764,8 +765,10 @@ export function readSessionPollution(controlDir, sessionId) {
         if (parsed !== null && typeof parsed === "object") {
             const at = parsed.at;
             const reason = parsed.reason;
+            const cause = parsed.cause;
+            const knownCause = typeof cause === "string" && MEMORY_ORIGIN_CAUSES.includes(cause) ? cause : undefined;
             if (typeof at === "number" && typeof reason === "string")
-                return { at, reason };
+                return { at, reason, ...(knownCause !== undefined ? { cause: knownCause } : {}) };
         }
     }
     catch {
@@ -804,7 +807,7 @@ export function importSessionPollution(controlDir, sessionId, record) {
     const path = pollutionPath(controlDir, sessionId);
     ensureDirExists(dirname(path));
     try {
-        writeFileSync(path, `${JSON.stringify({ at: record.at, reason: record.reason }, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+        writeFileSync(path, `${JSON.stringify({ at: record.at, reason: record.reason, ...(record.cause !== undefined ? { cause: record.cause } : {}) }, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
         return "written";
     }
     catch (err) {
@@ -976,6 +979,8 @@ function coerceLineage(raw) {
             if (!row || typeof row !== "object" || typeof row.lastRev !== "string" || typeof row.lastAt !== "number") {
                 throw badShape(`committed[${JSON.stringify(entryId)}][${JSON.stringify(sid)}]`);
             }
+            if (row.marked !== undefined && row.marked !== true)
+                throw badShape(`committed[${JSON.stringify(entryId)}][${JSON.stringify(sid)}] marked`);
         }
     }
     for (const [txnId, t] of Object.entries(r.pending)) {
@@ -991,6 +996,8 @@ function coerceLineage(raw) {
                 throw badShape(`pending[${JSON.stringify(txnId)}] row`);
             if (p.kind !== undefined && p.kind !== "latch-only")
                 throw badShape(`pending[${JSON.stringify(txnId)}] row kind`);
+            if (p.marked !== undefined && p.marked !== true)
+                throw badShape(`pending[${JSON.stringify(txnId)}] row marked`);
         }
         if (txn.credential !== undefined) {
             const c = txn.credential;
@@ -1049,8 +1056,8 @@ export function promoteLineagePending(controlDir, txnId, now) {
             if (!applied.has(row.entryId))
                 continue;
             const sessions = (rec.committed[row.entryId] ??= Object.create(null));
-            sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at };
-            promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev });
+            sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at, ...(row.marked === true ? { marked: true } : {}) };
+            promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev, ...(row.marked === true ? { marked: true } : {}) });
         }
         delete rec.pending[txnId];
         return { next: rec, result: promoted };
@@ -1075,8 +1082,8 @@ export function adjudicateLineagePending(controlDir, txnId, action, now) {
             if (applied !== undefined && !applied.has(row.entryId))
                 continue;
             const sessions = (rec.committed[row.entryId] ??= Object.create(null));
-            sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at };
-            promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev });
+            sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at, ...(row.marked === true ? { marked: true } : {}) };
+            promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev, ...(row.marked === true ? { marked: true } : {}) });
         }
         delete rec.pending[txnId];
         return { next: rec, result: promoted };
@@ -1099,8 +1106,8 @@ export function reconcileLineage(controlDir, now) {
                     continue;
                 at ??= now();
                 const sessions = (rec.committed[row.entryId] ??= Object.create(null));
-                sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at };
-                promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev });
+                sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at, ...(row.marked === true ? { marked: true } : {}) };
+                promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev, ...(row.marked === true ? { marked: true } : {}) });
             }
             delete rec.pending[txnId];
             changed = true;
@@ -1182,7 +1189,7 @@ export function lineageContributionsOfSession(controlDir, sessionId) {
     for (const [entryId, sessions] of Object.entries(rec.committed)) {
         const c = Object.prototype.hasOwnProperty.call(sessions, sessionId) ? sessions[sessionId] : undefined;
         if (c !== undefined)
-            out.push({ entryId, lastRev: c.lastRev });
+            out.push({ entryId, lastRev: c.lastRev, lastAt: c.lastAt, ...(c.marked === true ? { marked: true } : {}) });
     }
     return out;
 }
@@ -1262,12 +1269,18 @@ export function importLineageCommitted(controlDir, rows) {
             const sessions = (rec.committed[row.entryId] ??= Object.create(null));
             const standing = Object.prototype.hasOwnProperty.call(sessions, row.sessionId) ? sessions[row.sessionId] : undefined;
             if (standing === undefined || row.lastAt > standing.lastAt) {
-                sessions[row.sessionId] = { lastRev: row.lastRev, lastAt: row.lastAt };
+                sessions[row.sessionId] = { lastRev: row.lastRev, lastAt: row.lastAt, ...(row.marked === true ? { marked: true } : {}) };
                 changed = true;
                 continue;
             }
             if (row.lastAt === standing.lastAt && row.lastRev !== standing.lastRev) {
                 divergence.push({ entryId: row.entryId, sessionId: row.sessionId, kept: "destination" });
+                continue;
+            }
+            if (row.lastAt === standing.lastAt && row.lastRev === standing.lastRev && row.marked === true && standing.marked !== true) {
+                sessions[row.sessionId] = { ...standing, marked: true };
+                changed = true;
+                continue;
             }
         }
         return { ...(changed ? { next: rec } : {}), result: divergence };

package/dist/core/memory-engine/memory-backend-contract.js

@@ -243,6 +243,71 @@ export async function memoryBackendContract(hooks) {
         assert.strictEqual(after.frontmatter.trust, "untrusted");
         assert.strictEqual(after.rev, next.rev, "provenance participates in the rev (computeEntryRev closure)");
     });
+    defer("design/336: origin marker round-trips; strip/rewrite refused across update, re-add, guard add and same-batch delete+re-add; committed tombstone is the legal exit", async () => {
+        const b = await hooks.make();
+        const origin = { taint: "external", cause: "observed", at: 1700000000500 };
+        const base = {
+            id: "id-origin-001",
+            scope: "s1",
+            slug: "marked-note",
+            frontmatter: { name: "marked-note", description: "written by an exposed session", origin },
+            body: "marked body v1",
+            rev: "",
+        };
+        base.rev = computeEntryRev(base);
+        const repAdd = await b.applyPatches([{ op: "add", id: base.id, entry: base }]);
+        assert.deepStrictEqual(repAdd.conflicts, []);
+        const stored = (await b.getByIds([base.id]))[0];
+        assert.deepStrictEqual(stored.frontmatter.origin, origin, "origin must survive storage (round-trip)");
+        assert.strictEqual(stored.rev, base.rev, "origin participates in the rev (computeEntryRev closure)");
+        const mkStripped = () => {
+            const e = { ...base, frontmatter: { name: "marked-note", description: "written by an exposed session" }, rev: "" };
+            e.rev = computeEntryRev(e);
+            return e;
+        };
+        const rep1 = await b.applyPatches([{ op: "update", id: base.id, entry: mkStripped(), baseRev: base.rev }]);
+        assert.strictEqual(rep1.applied.length, 0, "an origin-stripping update must not apply");
+        assert.match(rep1.conflicts[0]?.reason ?? "", /malformed patch refused/);
+        const rewritten = { ...base, frontmatter: { ...base.frontmatter, origin: { taint: "external", cause: "static", at: 1 } }, rev: "" };
+        rewritten.rev = computeEntryRev(rewritten);
+        const rep2 = await b.applyPatches([{ op: "update", id: base.id, entry: rewritten, baseRev: base.rev }]);
+        assert.strictEqual(rep2.applied.length, 0, "an origin-rewriting update must not apply");
+        assert.match(rep2.conflicts[0]?.reason ?? "", /malformed patch refused/);
+        const rep3 = await b.applyPatches([{ op: "add", id: base.id, entry: mkStripped() }]);
+        assert.strictEqual(rep3.applied.length, 0, "an origin-stripping re-add must not apply");
+        assert.match(rep3.conflicts[0]?.reason ?? "", /malformed patch refused/);
+        const rep4 = await b.applyPatches([{ op: "add", id: base.id, entry: mkStripped(), guard: "absent" }]);
+        assert.strictEqual(rep4.applied.length, 0, "an origin-stripping guard add must not apply");
+        assert.match(rep4.conflicts[0]?.reason ?? "", /malformed patch refused/);
+        const rep5 = await b.applyPatches([
+            { op: "delete", id: base.id, baseRev: base.rev },
+            { op: "add", id: base.id, entry: mkStripped() },
+        ]);
+        const readd = rep5.conflicts.find((c) => c.op === "add");
+        assert.ok(readd !== undefined, "the same-batch unmarked re-add must be refused");
+        assert.match(readd.reason, /malformed patch refused/);
+        const survivors = await b.getByIds([base.id]);
+        if (survivors.length > 0) {
+            assert.deepStrictEqual(survivors[0].frontmatter.origin, origin, "a surviving entry keeps its marker verbatim");
+        }
+        if (survivors.length > 0) {
+            const repDel = await b.applyPatches([{ op: "delete", id: base.id }]);
+            assert.deepStrictEqual(repDel.conflicts.filter((c) => c.op === "delete"), [], "the tombstone itself applies");
+        }
+        const fresh = mkStripped();
+        const rep6 = await b.applyPatches([{ op: "add", id: base.id, entry: fresh }]);
+        assert.deepStrictEqual(rep6.conflicts, [], "after a committed tombstone, the id starts an unmarked life");
+        assert.strictEqual((await b.getByIds([base.id]))[0]?.frontmatter.origin, undefined);
+        const b2 = await hooks.make();
+        const m0 = { ...base, id: "id-origin-002", rev: "" };
+        m0.rev = computeEntryRev(m0);
+        await b2.applyPatches([{ op: "add", id: m0.id, entry: m0 }]);
+        const m1 = { ...m0, body: "marked body v2", rev: "" };
+        m1.rev = computeEntryRev(m1);
+        const rep7 = await b2.applyPatches([{ op: "update", id: m0.id, entry: m1, baseRev: m0.rev }]);
+        assert.deepStrictEqual(rep7.conflicts, []);
+        assert.deepStrictEqual((await b2.getByIds([m0.id]))[0]?.frontmatter.origin, origin, "the conforming update carries the marker forward verbatim");
+    });
     defer("projection authority: getByIds carries the OWNING scope; other scopes never list the entry", async () => {
         const b = await hooks.make();
         const e = entry("id-auth-0001", "s1", "authored", "authored body", { name: "Authored" });

package/dist/core/memory-engine/sync-client.d.ts

@@ -1,5 +1,5 @@
 import { type MemorySyncCursor } from "./sync.js";
-import type { MemoryBackend, MemoryEntry, PatchReport } from "./types.js";
+import { type MemoryBackend, type MemoryEntry, type PatchReport } from "./types.js";
 /** The injected HTTP seam — core never bundles a fetch. The deployment maps `path` (e.g.
  *  `/v1/memory/sync/user%3Aalice`) onto its server base URL, attaches auth, and returns the
  *  DECODED JSON body of a 2xx response; any non-2xx / network failure should THROW (the round then

package/dist/core/memory-engine/sync-client.js

@@ -1,8 +1,9 @@
-import { computeEntryRev, serializeEntryFile } from "./frontmatter.js";
+import { ambiguousOriginRepresentation, computeEntryRev, serializeEntryFile } from "./frontmatter.js";
 import { screenInboundEntries } from "./data-plane.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 import { MAX_MEMORY_BYTES } from "../memory.js";
 import { reconcileMemoryEntries } from "./sync.js";
+import { MEMORY_ORIGIN_CAUSES } from "./types.js";
 function memorySyncPath(scope) {
     return `/v1/memory/sync/${encodeURIComponent(scope)}`;
 }
@@ -79,6 +80,28 @@ function parseMemorySyncResponse(raw, scope, peer) {
                 !Number.isFinite(provWire["ingestedAt"]))) {
             fail('entry.frontmatter.provenance must be { kind: "repo_file", path, contentHash, ingestedAt } when present');
         }
+        const originWire = fm["origin"];
+        if (originWire !== undefined &&
+            (!isRecord(originWire) ||
+                originWire["taint"] !== "external" ||
+                typeof originWire["at"] !== "number" ||
+                !Number.isFinite(originWire["at"]) ||
+                (originWire["cause"] !== undefined && !(typeof originWire["cause"] === "string" && MEMORY_ORIGIN_CAUSES.includes(originWire["cause"]))))) {
+            fail('entry.frontmatter.origin must be { taint: "external", cause?, at } with a known cause when present');
+        }
+        const extraRaw = fm["extra"];
+        if (Array.isArray(extraRaw) && extraRaw.every((s) => typeof s === "string")) {
+            const pickedOrigin = originWire !== undefined
+                ? {
+                    taint: "external",
+                    ...(originWire["cause"] !== undefined ? { cause: originWire["cause"] } : {}),
+                    at: originWire["at"],
+                }
+                : undefined;
+            if (ambiguousOriginRepresentation({ ...(pickedOrigin !== undefined ? { origin: pickedOrigin } : {}), extra: fm["extra"] })) {
+                fail("entry.frontmatter carries conflicting or duplicated origin representations (ambiguous marker representation refused)");
+            }
+        }
         serverEntries.push({
             id: e["id"],
             slug: e["slug"],
@@ -101,6 +124,15 @@ function parseMemorySyncResponse(raw, scope, peer) {
                     }
                     : {}),
                 ...(fm["trust"] !== undefined ? { trust: "untrusted" } : {}),
+                ...(originWire !== undefined
+                    ? {
+                        origin: {
+                            taint: "external",
+                            ...(originWire["cause"] !== undefined ? { cause: originWire["cause"] } : {}),
+                            at: originWire["at"],
+                        },
+                    }
+                    : {}),
                 ...(fm["extra"] !== undefined ? { extra: [...fm["extra"]] } : {}),
             },
         });

package/dist/core/memory-engine/tools.d.ts

@@ -78,6 +78,13 @@ export interface MemoryEngineToolsOptions {
     sessionPollution?: () => {
         reason: string;
     } | undefined;
+    /**
+     * design/336 §13-3 — the provenance mode the write engine runs under, so the pollution sentence
+     * states what the mark actually DOES: under `"carry"` writes commit with an origin marker (the
+     * pre-336 "not admitted" sentence would be false); absent ≡ `"off"` keeps that sentence
+     * byte-identical. Pure display input — nothing else branches on it here.
+     */
+    provenance?: "off" | "carry";
 }
 export interface MemorySearchHit {
     id: string;

package/dist/core/memory-engine/tools.js

@@ -101,6 +101,9 @@ export function createMemoryEngineTools(opts) {
         }
         if (reason === undefined)
             return "";
+        if (opts.provenance === "carry") {
+            return ` Note: this session read external content, so memory entries it writes are saved with an external-origin marker; instruction-style entries (type: feedback, or pinned/triggers/applies-when lines) are withheld for host review instead.`;
+        }
         return ` This session is marked polluted (${inlineUntrusted(reason, 200)}): the memory it writes is not admitted to the library at harvest, so writing this down now would not make it retrievable later either.`;
     };
     const noMatch = (query) => {