@sema-agent/core 5.45.0 → 5.47.0

package/dist/core/memory-engine/export-bundle.d.ts

@@ -1,5 +1,5 @@
 import { type TransferEvidence } from "./file-backend.js";
-import type { MemoryEntry } from "./types.js";
+import { type MemoryEntry } from "./types.js";
 /** One exported challenge event (unresolved generations only). Generations are DESTINATION-minted:
  *  the bundle deliberately carries no generation number — the importing store re-mints events under
  *  its own idempotent namespace and allocates generations there. */
@@ -15,6 +15,10 @@ export interface BundlePollutedSession {
     sessionId: string;
     at: number;
     reason: string;
+    /** design/336 — the record's structured mechanical cause, carried verbatim (absent = the source
+     *  record predates the vocabulary or genuinely recorded none; the destination's mints then fall
+     *  back to "observed"). */
+    cause?: import("./types.js").MemoryOriginCause;
 }
 /** One exported committed lineage contribution (verbatim `lastRev`/`lastAt`). */
 export interface BundleLineageRow {
@@ -22,6 +26,11 @@ export interface BundleLineageRow {
     sessionId: string;
     lastRev: string;
     lastAt: number;
+    /** design/336 — the contribution's content carries its external-origin marker (see
+     *  {@link import("./layout.js").LineageContribution.marked}). MUST travel with the row: dropping
+     *  it re-quarantines the source's tag-admissions at the destination (the import pollution sweep
+     *  challenges unmarked contributions of imported polluted sessions). */
+    marked?: true;
 }
 /**
  * design/178 v2 §4.3 + v2-c §6 — the governance-complete export bundle. The governance section is

package/dist/core/memory-engine/export-bundle.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
 import { canonicalJsonStringify } from "./file-backend.js";
 import { computeEntryRev } from "./frontmatter.js";
+import { MEMORY_ORIGIN_CAUSES } from "./types.js";
+import { ambiguousOriginRepresentation, committedOriginOf } from "./frontmatter.js";
 export const BUNDLE_SECTION_KEYS = ["meta", "entries", "governance", "residuals"];
 function sha256Line(text) {
     return createHash("sha256").update(`${text}\n`, "utf8").digest("hex");
@@ -69,6 +71,15 @@ function entryInvalid(raw, scopes) {
             return `entry ${JSON.stringify(e.id)} frontmatter.provenance is malformed`;
         }
     }
+    if (fm.origin !== undefined) {
+        const o = fm.origin;
+        if (!isRecord(o) || o.taint !== "external" || typeof o.at !== "number" || !Number.isFinite(o.at) || (o.cause !== undefined && !(typeof o.cause === "string" && MEMORY_ORIGIN_CAUSES.includes(o.cause)))) {
+            return `entry ${JSON.stringify(e.id)} frontmatter.origin is malformed`;
+        }
+    }
+    if (ambiguousOriginRepresentation(fm)) {
+        return `entry ${JSON.stringify(e.id)} carries conflicting or duplicated origin representations (ambiguous marker representation)`;
+    }
     const recomputed = computeEntryRev({ id: e.id, frontmatter: fm, body: e.body });
     if (recomputed !== e.rev)
         return `entry ${JSON.stringify(e.id)} rev ${JSON.stringify(e.rev)} does not equal its recomputed content rev ${JSON.stringify(recomputed)} (forged or corrupted package)`;
@@ -156,6 +167,8 @@ export function memoryBundleInvalid(raw, opts = {}) {
             return "polluted-session row has no at";
         if (typeof raw2.reason !== "string")
             return "polluted-session row has no reason";
+        if (raw2.cause !== undefined && !(typeof raw2.cause === "string" && MEMORY_ORIGIN_CAUSES.includes(raw2.cause)))
+            return "polluted-session row cause is not a known spelling";
         if (pollutedIds.has(raw2.sessionId))
             return `bundle.governance.pollutedSessions carries sessionId ${JSON.stringify(raw2.sessionId)} twice (bad package)`;
         pollutedIds.add(raw2.sessionId);
@@ -175,6 +188,14 @@ export function memoryBundleInvalid(raw, opts = {}) {
             return "lineage row has no lastRev";
         if (typeof raw2.lastAt !== "number")
             return "lineage row has no lastAt";
+        if (raw2.marked !== undefined && raw2.marked !== true)
+            return "lineage row marked is not the literal true";
+        if (raw2.marked === true) {
+            const carried = entriesArr.find((e) => e.id === raw2.entryId);
+            if (carried !== undefined && committedOriginOf(carried.frontmatter) === undefined) {
+                return `bundle.governance.lineage row (${String(raw2.entryId)}, ${String(raw2.sessionId)}) claims marked:true but the carried entry has no origin marker (dishonest package)`;
+            }
+        }
         const key = `${raw2.entryId}\u0000${raw2.sessionId}`;
         if (lineagePairs.has(key))
             return `bundle.governance.lineage carries (${raw2.entryId}, ${raw2.sessionId}) twice (bad package)`;

package/dist/core/memory-engine/file-backend.d.ts

@@ -323,11 +323,13 @@ export interface MemoryExportSnapshot {
         sessionId: string;
         lastRev: string;
         lastAt: number;
+        marked?: true;
     }>;
     pollutedSessions: Array<{
         sessionId: string;
         at: number;
         reason: string;
+        cause?: import("./types.js").MemoryOriginCause;
     }>;
     quarantined: string[];
     quarantineOpaque: number;
@@ -419,6 +421,14 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     private adoptionNoticeKeys;
     /** Test seam (§7.4 r4-④ arm): force a post-commit-point transfer-append failure. */
     private transfersAppendFault?;
+    /** Test seam (#262 ③/#191 review r1 fence pins): runs inside `recoverJournal` between the redo
+     *  replay and the commit-boundary ownership re-assertion — a test flips the lock owner (or swaps
+     *  the journal) here to exercise the mid-replay steal arms. Production leaves it unset. */
+    private recoveryCommitProbe?;
+    /** Test seam (#262 ③/#191 review r2): runs inside the torn-tail heal between the marker work and
+     *  the pre-truncation ownership re-assertion — a test flips the lock owner here to prove the
+     *  chain is never truncated after an ownership loss. Production leaves it unset. */
+    private chainHealProbe?;
     /** Test seam (v2-c §3-2 fence pins): runs INSIDE the export composite's mutex hold, after the
      *  data reads and before the second fingerprint — a test injects a governance-face write here to
      *  exercise the drift-retry and the three-round refusal. Production leaves it unset. */
@@ -511,11 +521,23 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     /** Is the durable chain-degradation marker in place? Presence is ENOENT-only-absent (a probe
      *  failure is never read as "not degraded" — fail-closed). */
     private chainDegradedMarkerPresent;
-    /** §3-4 r6 — mint the chain-degradation marker DURABLY (wx + fsync + read-back verification).
-     *  Idempotent on an existing marker. Throws when the marker cannot be proven on disk — the caller
-     *  (the heal) must then ABORT with the chain untouched: truncating first would reopen the exact
-     *  window this marker closes ("chain reads complete, no marker" after an out-of-band tear). */
+    /** §3-4 r6 — mint the chain-degradation marker DURABLY (wx + fsync data + fsync DIRECTORY +
+     *  read-back verification). Idempotent on an existing marker. Throws when the marker cannot be
+     *  proven on disk — the caller (the heal) must then ABORT with the chain untouched: truncating
+     *  first would reopen the exact window this marker closes ("chain reads complete, no marker"
+     *  after an out-of-band tear). */
     private mintChainDegradedMarker;
+    /** backlog #270 — make a just-created control-plane directory ENTRY power-loss durable: open the
+     *  control-plane root and fsync it. Fail-closed on failure: the one caller (the marker mint) must
+     *  abort its heal with the chain byte-untouched — an unproven marker must never authorize a
+     *  truncation, and the abort leaves the SAFER state either way (the standing marker or the still-
+     *  visible tear both re-enter the heal on the next chain read). Platform notes: Node's fsync maps
+     *  to fsync(2) — on macOS a full power-loss guarantee would additionally need F_FULLFSYNC
+     *  (fcntl), which Node cannot reach; this is the same accepted bar as every other fsync in this
+     *  store. On win32 a directory cannot be opened as an fd (fs.open rejects directories there), so
+     *  the entry-durability half is structurally out of reach — an explicit documented arm, not a
+     *  swallowed error; NTFS metadata journaling is the (weaker) cover that platform gets. */
+    private fsyncControlPlaneDir;
     /**
      * Read the WHOLE evidence chain in order (validated, collision-checked), healing a TORN TAIL (a
      * crash mid-append): the fragment is quarantined for evidence, the sound prefix stands (lines are
@@ -530,6 +552,13 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      * Same-`ev` collision law (§4.4, read-time arm): canonical-form-equal duplicates are tolerated
      * (append-idempotency residue); DIFFERENT payloads under one ev are fail-closed — an event id is
      * one identity, and a reader must never pick a side by file order.
+     *
+     * `fenceToken` (#262 ③/#191 review r1) — this "read" MUTATES on a torn tail (quarantine + marker
+     * + truncation), so a caller whose entry assert is far behind it (the recovery leg's validation
+     * reads sit after unbounded parsing work) passes its lock token and the heal re-verifies
+     * ownership immediately before its first mutation: a recoverer stolen from mid-validation must
+     * not truncate a chain the stealer is appending to. Callers whose entry assert is adjacent keep
+     * their documented assert→act residue and may omit it.
      */
     private readTransferChain;
     /** The chain's ev → canonical-payload map (§4.4 upgraded load shape — the append path compares
@@ -871,6 +900,7 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     /** Lexical floor (design/138 §2.1): `1 - Jaccard` distance over name+description+body, ascending. */
     search(query: string, scopes: readonly string[], opts?: {
         limit?: number;
+        exposureBands?: boolean;
     }): Promise<ScoredMemoryEntry[]>;
     private searchFrom;
     /**

package/dist/core/memory-engine/file-backend.js

@@ -4,7 +4,7 @@ import { dirname, join, relative } from "node:path";
 import { jaccardDistance, termSet } from "../memory-vector.js";
 import { MAX_MEMORY_BYTES } from "../memory.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { computeEntryRev, entryFromFile, isValidEntryId, parseEntryFile, serializeEntryFile } from "./frontmatter.js";
+import { ambiguousOriginRepresentation, committedOriginOf, computeEntryRev, entryFromFile, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile } from "./frontmatter.js";
 import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, claimRootScope, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, stageImportLatch, writeAllSync, } from "./layout.js";
 import { screenInboundEntries } from "./data-plane.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
@@ -540,6 +540,8 @@ export class FileMemoryEngineBackend {
     unboundRowsKnown = false;
     adoptionNoticeKeys = new Set();
     transfersAppendFault;
+    recoveryCommitProbe;
+    chainHealProbe;
     exportFaceProbe;
     deletedIdsDigest;
     inboundFindings = [];
@@ -735,11 +737,18 @@ export class FileMemoryEngineBackend {
         const tryMkdir = () => {
             try {
                 mkdirSync(this.controlPlaneRoot, { recursive: true });
+            }
+            catch (err) {
+                throw new ControlPlaneCorruptError(`memory control-plane root could not be created (${err.code ?? "io error"}) at ${this.controlPlaneRoot} — a lock-acquisition fault is not contention; deferring recovery/migration on it would be silent (fail-closed)`, { cause: err });
+            }
+            try {
                 mkdirSync(lockDir);
                 return true;
             }
-            catch {
-                return false;
+            catch (err) {
+                if (err.code === "EEXIST")
+                    return false;
+                throw new ControlPlaneCorruptError(`memory txn lock could not be created (${err.code ?? "io error"}) at ${lockDir} — a lock-acquisition fault is not contention; deferring recovery/migration on it would be silent (fail-closed)`, { cause: err });
             }
         };
         let acquired = tryMkdir();
@@ -748,7 +757,22 @@ export class FileMemoryEngineBackend {
             try {
                 mtimeMs = statSync(lockDir).mtimeMs;
             }
-            catch {
+            catch (err) {
+                if (err.code !== "ENOENT") {
+                    throw new ControlPlaneCorruptError(`memory txn lock state could not be probed (${err.code ?? "io error"}) at ${lockDir} — a probe failure is not contention (fail-closed)`, { cause: err });
+                }
+                let occupant;
+                try {
+                    occupant = lstatSync(lockDir);
+                }
+                catch (lerr) {
+                    if (lerr.code !== "ENOENT") {
+                        throw new ControlPlaneCorruptError(`memory txn lock re-probe failed (${lerr.code ?? "io error"}) at ${lockDir} — a probe failure is not contention (fail-closed)`, { cause: lerr });
+                    }
+                }
+                if (occupant !== undefined && !occupant.isDirectory()) {
+                    throw new ControlPlaneCorruptError(`memory txn lock path is occupied by an invalid node (a dangling symlink?) at ${lockDir} — not contention and not a release race; remove the occupant (fail-closed)`, { cause: err });
+                }
                 mtimeMs = undefined;
             }
             if (mtimeMs !== undefined && this.now() - mtimeMs > TXN_LOCK_STALE_MS) {
@@ -757,7 +781,10 @@ export class FileMemoryEngineBackend {
                     statSync(ownerPath);
                     tokenPresent = true;
                 }
-                catch {
+                catch (err) {
+                    if (err.code !== "ENOENT") {
+                        throw new ControlPlaneCorruptError(`memory txn lock owner token could not be probed (${err.code ?? "io error"}) at ${ownerPath} — a probe failure is not a mid-acquisition (fail-closed)`, { cause: err });
+                    }
                 }
                 if (tokenPresent) {
                     const tomb = join(this.controlPlaneRoot, `txn.lock.stale-${randomUUID()}`);
@@ -766,7 +793,10 @@ export class FileMemoryEngineBackend {
                         renameSync(lockDir, tomb);
                         stolen = true;
                     }
-                    catch {
+                    catch (err) {
+                        if (err.code !== "ENOENT") {
+                            throw new ControlPlaneCorruptError(`memory txn lock stale-steal rename failed (${err.code ?? "io error"}) at ${lockDir} — a rename fault is not a lost race (fail-closed)`, { cause: err });
+                        }
                     }
                     if (stolen) {
                         rmSync(tomb, { recursive: true, force: true });
@@ -819,7 +849,7 @@ export class FileMemoryEngineBackend {
         if (lock === undefined)
             return;
         try {
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             this.migrateLockedIfNeeded(lock.token);
         }
         finally {
@@ -892,8 +922,10 @@ export class FileMemoryEngineBackend {
             fd = openSync(path, "wx", 0o600);
         }
         catch (err) {
-            if (err.code === "EEXIST")
+            if (err.code === "EEXIST") {
+                this.fsyncControlPlaneDir();
                 return;
+            }
             throw new ControlPlaneCorruptError(`evidence-chain degradation marker could not be created at ${path} (${err.code ?? "io error"}) — heal aborted, the chain is unchanged (fail-closed)`);
         }
         try {
@@ -903,11 +935,32 @@ export class FileMemoryEngineBackend {
         finally {
             closeSync(fd);
         }
+        this.fsyncControlPlaneDir();
         if (readControlFileOrAbsent(path, "evidence-chain degradation marker") === undefined) {
             throw new ControlPlaneCorruptError(`evidence-chain degradation marker vanished after its write at ${path} — heal aborted, the chain is unchanged (fail-closed)`);
         }
     }
-    readTransferChain() {
+    fsyncControlPlaneDir() {
+        if (process.platform === "win32")
+            return;
+        let dfd;
+        try {
+            dfd = openSync(this.controlPlaneRoot, "r");
+        }
+        catch (err) {
+            throw new ControlPlaneCorruptError(`evidence-chain degradation marker's directory could not be opened for fsync (${err.code ?? "io error"}) at ${this.controlPlaneRoot} — heal aborted, the chain is unchanged (fail-closed: an unproven marker must not authorize a truncation)`, { cause: err });
+        }
+        try {
+            fsyncSync(dfd);
+        }
+        catch (err) {
+            throw new ControlPlaneCorruptError(`evidence-chain degradation marker's directory entry could not be fsynced (${err.code ?? "io error"}) at ${this.controlPlaneRoot} — heal aborted, the chain is unchanged (fail-closed: an unproven marker must not authorize a truncation)`, { cause: err });
+        }
+        finally {
+            closeSync(dfd);
+        }
+    }
+    readTransferChain(fenceToken) {
         const path = join(this.controlPlaneRoot, TRANSFERS_FILE);
         const raw = readControlFileOrAbsent(path, "transfer evidence log");
         const out = [];
@@ -940,6 +993,8 @@ export class FileMemoryEngineBackend {
                     }
                 }
                 const outOfBand = !journalHasPendingEvidence;
+                if (fenceToken !== undefined)
+                    this.assertTxnLockOwnership(fenceToken);
                 let fragmentPath;
                 try {
                     ensureDirExists(join(this.controlPlaneRoot, QUARANTINE_DIR));
@@ -951,6 +1006,9 @@ export class FileMemoryEngineBackend {
                 }
                 if (outOfBand)
                     this.mintChainDegradedMarker(fragmentPath);
+                this.chainHealProbe?.();
+                if (fenceToken !== undefined)
+                    this.assertTxnLockOwnership(fenceToken);
                 try {
                     atomicWriteFileSync(path, lines.slice(0, i).join("\n") + (i > 0 ? "\n" : ""));
                 }
@@ -1110,21 +1168,22 @@ export class FileMemoryEngineBackend {
             closeSync(fd);
         }
     }
-    recoverJournal(opts = {}) {
-        if (opts.unlocked) {
+    recoverJournal(fence) {
+        if (fence.token === undefined) {
             if (this.txnInFlight())
                 return;
             const lock = this.tryAcquireTxnLockSync();
             if (lock === undefined)
                 return;
             try {
-                this.recoverJournal();
+                this.recoverJournal({ token: lock.token });
             }
             finally {
                 lock.release();
             }
             return;
         }
+        const fenceToken = fence.token;
         const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
         const raw = readControlFileOrAbsent(jp, "transaction journal");
         if (raw !== undefined) {
@@ -1205,7 +1264,7 @@ export class FileMemoryEngineBackend {
                 if (hasV1)
                     throw new ControlPlaneCorruptError(`transaction journal carries transfers with a v1 snapshot (impossible form): ${jp}`);
                 if (journalEvs.size > 0) {
-                    for (const row of this.readTransferChain()) {
+                    for (const row of this.readTransferChain(fenceToken)) {
                         const j = journalEvs.get(row.ev);
                         if (j !== undefined && j !== row.canonical) {
                             throw new ControlPlaneCorruptError(`transaction journal event id ${JSON.stringify(row.ev)} collides with a DIFFERENT payload already on the evidence chain (fail-closed before redo): ${jp}`);
@@ -1242,7 +1301,7 @@ export class FileMemoryEngineBackend {
                         }
                     }
                     if (e.req !== undefined && !anchorRows.some((a) => a.req === e.req)) {
-                        chainAnchors ??= this.readTransferChain()
+                        chainAnchors ??= this.readTransferChain(fenceToken)
                             .map((r) => r.parsed)
                             .filter((p) => p.channel === "erasure-anchor" && p.origin === undefined);
                         const matching = chainAnchors.filter((p) => p.req === e.req);
@@ -1254,7 +1313,7 @@ export class FileMemoryEngineBackend {
                 }
                 const chainAnchorEvsByReq = new Map();
                 if (anchorRows.length > 0) {
-                    for (const p of (chainAnchors ??= this.readTransferChain()
+                    for (const p of (chainAnchors ??= this.readTransferChain(fenceToken)
                         .map((r) => r.parsed)
                         .filter((p) => p.channel === "erasure-anchor" && p.origin === undefined))) {
                         const set = chainAnchorEvsByReq.get(p.req) ?? new Set();
@@ -1332,6 +1391,7 @@ export class FileMemoryEngineBackend {
                     }
                 }
             }
+            this.assertTxnLockOwnership(fenceToken);
             for (const op of journal.ops) {
                 try {
                     if (op.kind === "write" && op.content !== undefined) {
@@ -1354,6 +1414,8 @@ export class FileMemoryEngineBackend {
                     throw new ControlPlaneCorruptError(`transaction journal replay failed on op kind=${op.kind} target=${JSON.stringify(op.target)} (${code ?? (err instanceof Error ? err.message : String(err))}) — the journal is kept at ${jp}; an I/O failure retries at the next construction, a persistent fault needs the explicit control-plane rebuild path`);
                 }
             }
+            this.recoveryCommitProbe?.();
+            this.assertTxnLockOwnership(fenceToken);
             if (hasV2) {
                 this.ledger = snapshotRows;
                 this.envelopeExtras = snapshotExtras;
@@ -1366,8 +1428,15 @@ export class FileMemoryEngineBackend {
                 this.persistedSchemaVersion = "v1";
                 this.persistLedgerV1(snapshotRows);
             }
-            rmSync(jp, { force: true });
+            if (typeof journal.txn === "string") {
+                this.closeJournalIfOurs(journal.txn);
+            }
+            else {
+                this.assertTxnLockOwnership(fenceToken);
+                rmSync(jp, { force: true });
+            }
         }
+        this.assertTxnLockOwnership(fenceToken);
         this.sweepStagedFiles();
     }
     txnInFlight() {
@@ -1452,6 +1521,9 @@ export class FileMemoryEngineBackend {
         if (first !== undefined) {
             return { path: relPath, code: first.code, reason: `inbound memory change blocked: ${first.reason} (quarantined)` };
         }
+        if (ambiguousOriginRepresentation(parseEntryFile(text).frontmatter)) {
+            return { path: relPath, code: "invalid", reason: `inbound memory change blocked: conflicting or duplicated origin representations (ambiguous external-origin marker; quarantined)` };
+        }
         return undefined;
     }
     readScope(scope, sync, probeOnly, lockToken) {
@@ -1628,17 +1700,28 @@ export class FileMemoryEngineBackend {
     whitewashInboundFinding(relPath, entry, containment) {
         const committedShadow = this.readCommittedShadow(entry.id);
         const committedFm = committedShadow !== undefined ? parseEntryFile(committedShadow).frontmatter : undefined;
-        if (committedFm?.provenance?.kind !== "repo_file")
+        if (committedFm === undefined)
             return undefined;
-        const stripsProvenance = entry.frontmatter.provenance === undefined;
-        const stripsTrust = committedFm.trust !== undefined && entry.frontmatter.trust === undefined;
-        if (!stripsProvenance && !stripsTrust)
-            return undefined;
-        return {
-            path: relPath,
-            code: "invalid",
-            reason: `inbound memory change blocked: repo_file provenance whitewash refused — the on-disk change drops ${stripsProvenance ? "provenance" : "trust"} from a repo-ingested entry ${containment === "restored" ? "(quarantined; committed content restored)" : "(quarantined)"}`,
-        };
+        if (committedFm.provenance?.kind === "repo_file") {
+            const stripsProvenance = entry.frontmatter.provenance === undefined;
+            const stripsTrust = committedFm.trust !== undefined && entry.frontmatter.trust === undefined;
+            if (stripsProvenance || stripsTrust) {
+                return {
+                    path: relPath,
+                    code: "invalid",
+                    reason: `inbound memory change blocked: repo_file provenance whitewash refused — the on-disk change drops ${stripsProvenance ? "provenance" : "trust"} from a repo-ingested entry ${containment === "restored" ? "(quarantined; committed content restored)" : "(quarantined)"}`,
+                };
+            }
+        }
+        const committedOrigin = committedOriginOf(committedFm);
+        if (committedOrigin !== undefined && !originEquals(committedOrigin, committedOriginOf(entry.frontmatter))) {
+            return {
+                path: relPath,
+                code: "invalid",
+                reason: `inbound memory change blocked: external-origin marker whitewash refused — the on-disk change strips or rewrites the origin marker of a marked entry ${containment === "restored" ? "(quarantined; committed content restored)" : "(quarantined)"}`,
+            };
+        }
+        return undefined;
     }
     adoptMoveCandidateLocked(rows, entry, absPath, slug, scope, relPath, text, committedRev, from, moveEvents, moveAnnouncements, adoptedExternal) {
         const census = this.censusProjectionsLocked();
@@ -1685,7 +1768,7 @@ export class FileMemoryEngineBackend {
         try {
             this.assertTxnLockOwnership(lock.token);
             this.ledger = undefined;
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             this.migrateLockedIfNeeded(lock.token);
             return this.readScope(scope, true, false, lock.token);
         }
@@ -2052,7 +2135,8 @@ export class FileMemoryEngineBackend {
                 scored.push({ ...headerOf(e, join(dir, `${e.slug}.md`)), score: d });
             }
         }
-        scored.sort((a, b) => a.score - b.score || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+        const band = opts?.exposureBands === true ? (h) => (h.exposure === "external" ? 1 : 0) : () => 0;
+        scored.sort((a, b) => band(a) - band(b) || a.score - b.score || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
         return scored.slice(0, limit);
     }
     async applyPatches(patches) {
@@ -2177,7 +2261,7 @@ export class FileMemoryEngineBackend {
     async applyPatchesLocked(patches, lockToken) {
         this.assertTxnLockOwnership(lockToken);
         this.ledger = undefined;
-        this.recoverJournal();
+        this.recoverJournal({ token: lockToken });
         this.migrateLockedIfNeeded(lockToken);
         const rows = cloneRows(this.loadLedger());
         const report = { applied: [], conflicts: [] };
@@ -2291,6 +2375,14 @@ export class FileMemoryEngineBackend {
             report.conflicts.push({ op: patch.op, id: patch.id, reason: `invalid_slug_shape (slug ${JSON.stringify(patch.entry.slug)} is empty, absolute, or path-escaping — a projection must stay inside its scope dir)` });
             return;
         }
+        if (patch.op !== "delete" && patch.entry !== undefined && ambiguousOriginRepresentation(patch.entry.frontmatter)) {
+            report.conflicts.push({
+                op: patch.op,
+                id: patch.id,
+                reason: `external-origin marker representation conflict: the entry carries conflicting or duplicated origin representations (malformed patch refused)`,
+            });
+            return;
+        }
         if (patch.op === "add") {
             const entry = patch.entry;
             if (!entry) {
@@ -2299,6 +2391,19 @@ export class FileMemoryEngineBackend {
             }
             const locatedAnywhere = this.locateById(patch.id);
             const existingAnywhere = locatedAnywhere !== undefined && plannedDeletes.has(patch.id) ? undefined : locatedAnywhere;
+            if (locatedAnywhere !== undefined) {
+                const shadowText = this.readCommittedShadow(patch.id);
+                const committedFm = shadowText !== undefined ? parseEntryFile(shadowText).frontmatter : locatedAnywhere.entry.frontmatter;
+                const committedOrigin = committedOriginOf(committedFm);
+                if (committedOrigin !== undefined && !originEquals(committedOrigin, committedOriginOf(entry.frontmatter))) {
+                    report.conflicts.push({
+                        op: "add",
+                        id: patch.id,
+                        reason: `external-origin marker whitewash refused: the add strips or rewrites the origin marker of a marked entry (malformed patch refused)`,
+                    });
+                    return;
+                }
+            }
             if (patch.guard === "absent") {
                 if (existingAnywhere) {
                     const currentRev = rowsRev(rows, patch.id) ?? existingAnywhere.entry.rev;
@@ -2376,6 +2481,15 @@ export class FileMemoryEngineBackend {
                     return;
                 }
             }
+            const committedOrigin = committedOriginOf(committedFm);
+            if (committedOrigin !== undefined && !originEquals(committedOrigin, committedOriginOf(patch.entry.frontmatter))) {
+                report.conflicts.push({
+                    op: "update",
+                    id: patch.id,
+                    reason: `external-origin marker whitewash refused: the update strips or rewrites the origin marker of a marked entry (malformed patch refused)`,
+                });
+                return;
+            }
         }
         const currentRev = rowsRev(rows, patch.id) ?? found.entry.rev;
         if (patch.baseRev !== undefined && patch.baseRev !== currentRev) {
@@ -2447,10 +2561,10 @@ export class FileMemoryEngineBackend {
         try {
             this.assertTxnLockOwnership(lock.token);
             this.ledger = undefined;
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             this.migrateLockedIfNeeded(lock.token);
             const rows = cloneRows(this.loadLedger());
-            const chain = this.readTransferChain();
+            const chain = this.readTransferChain(lock.token);
             const degraded = this.chainDegradedMarkerPresent();
             const custodyState = degraded ? "damaged" : "complete";
             const selectHash = erasureSelectHash(select);
@@ -3141,7 +3255,7 @@ export class FileMemoryEngineBackend {
         try {
             this.assertTxnLockOwnership(lock.token);
             this.ledger = undefined;
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             const rows = this.loadLedger();
             if (this.persistedSchemaVersion !== "v2") {
                 throw erasureCodedError("memory export refused: the committed-rev ledger is still schema v1 (pre-binding) — the store migrates itself at its next write/read entry or checkControlPlane; an export never triggers the migration", FileMemoryEngineBackend.EXPORT_INCOMPLETE);
@@ -3187,9 +3301,9 @@ export class FileMemoryEngineBackend {
                 const lineage = [];
                 for (const [entryId, sessions] of Object.entries(lineageRec.committed)) {
                     for (const [sessionId, c] of Object.entries(sessions))
-                        lineage.push({ entryId, sessionId, lastRev: c.lastRev, lastAt: c.lastAt });
+                        lineage.push({ entryId, sessionId, lastRev: c.lastRev, lastAt: c.lastAt, ...(c.marked === true ? { marked: true } : {}) });
                 }
-                const pollutedSessions = Object.entries(polluted).map(([sessionId, r]) => ({ sessionId, at: r.at, reason: r.reason }));
+                const pollutedSessions = Object.entries(polluted).map(([sessionId, r]) => ({ sessionId, at: r.at, reason: r.reason, ...(r.cause !== undefined ? { cause: r.cause } : {}) }));
                 try {
                     this.assertTxnLockOwnership(lock.token);
                 }
@@ -3224,7 +3338,7 @@ export class FileMemoryEngineBackend {
         try {
             this.assertTxnLockOwnership(lock.token);
             this.ledger = undefined;
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             const rows = this.loadLedger();
             if (this.persistedSchemaVersion !== "v2")
                 return { custody: [], unbound: [], complete: false, unsliceableCustody: 0, reason: "the committed-rev ledger is still schema v1 (migrate first)" };
@@ -3259,7 +3373,7 @@ export class FileMemoryEngineBackend {
         const lock = await this.acquireTxnLock(timings);
         try {
             this.assertTxnLockOwnership(lock.token);
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             return this.custodyImportLocked(rows, opts);
         }
         finally {
@@ -3328,7 +3442,7 @@ export class FileMemoryEngineBackend {
         try {
             this.assertTxnLockOwnership(lock.token);
             this.ledger = undefined;
-            this.recoverJournal();
+            this.recoverJournal({ token: lock.token });
             this.migrateLockedIfNeeded(lock.token);
             const ctl = this.controlPlaneRoot;
             const txnId = importLatchTxnId(bundleHash);
@@ -3450,8 +3564,21 @@ export class FileMemoryEngineBackend {
             const orphanIds = new Set();
             const lineageToApply = [];
             for (const row of plan.lineage) {
-                if (eligible.has(row.entryId))
+                if (eligible.has(row.entryId)) {
+                    if (row.marked === true) {
+                        const shadow = this.readCommittedShadow(row.entryId);
+                        let committedFm = shadow !== undefined ? parseEntryFile(shadow).frontmatter : undefined;
+                        if (committedFm === undefined)
+                            committedFm = this.locateById(row.entryId)?.entry.frontmatter;
+                        if (committedFm !== undefined && committedOriginOf(committedFm) === undefined) {
+                            const { marked: _dropped, ...unmarked } = row;
+                            lineageToApply.push(unmarked);
+                            report.conflicts.push({ id: row.entryId, reason: `lineage row claims marked:true but the committed content carries no origin marker — the bit was dropped (the pollution sweep judges the contribution)` });
+                            continue;
+                        }
+                    }
                     lineageToApply.push(row);
+                }
                 else if (destKnown(row.entryId) || entryById.has(row.entryId))
                     withheldIds.add(row.entryId);
                 else
@@ -3476,14 +3603,14 @@ export class FileMemoryEngineBackend {
                 ...(c.challengedRev !== undefined ? { challengedRev: c.challengedRev } : {}),
             })));
             for (const p of [...plan.pollutedSessions].sort((a, b) => (a.sessionId < b.sessionId ? -1 : 1))) {
-                const contributions = lineageContributionsOfSession(ctl, p.sessionId);
+                const contributions = lineageContributionsOfSession(ctl, p.sessionId).filter((c) => c.marked !== true);
                 this.appendImportChallengesVerified(contributions.map((c) => ({
                     eventId: `imp-sweep:${bundleHash}:pollution:${p.sessionId}:${p.at}:${c.entryId}`,
                     entryId: c.entryId,
                     reason: `challenged: the contributing session was marked polluted`,
                     challengedRev: c.lastRev,
                 })));
-                const outcome = importSessionPollution(ctl, p.sessionId, { at: p.at, reason: p.reason });
+                const outcome = importSessionPollution(ctl, p.sessionId, { at: p.at, reason: p.reason, ...(p.cause !== undefined ? { cause: p.cause } : {}) });
                 if (outcome === "divergent")
                     report.pollutionDivergence.push({ sessionId: p.sessionId, kept: "destination" });
             }
@@ -3568,6 +3695,7 @@ function headerOf(e, path) {
         mtimeMs,
         rev: e.rev,
         sizeBytes: Buffer.byteLength(serializeEntryFile(e), "utf8"),
+        ...(committedOriginOf(e.frontmatter) !== undefined ? { exposure: "external" } : {}),
     };
 }
 function readSafe(path) {