@sema-agent/core 5.46.0 → 5.48.0

package/dist/core/memory-engine/engine.js

@@ -1,12 +1,17 @@
-import { closeSync, constants as fsConstants, existsSync, fchmodSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { closeSync, constants as fsConstants, existsSync, fchmodSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
 import { uuidv7 } from "../../internal/harness.js";
 import { MAX_MEMORY_BYTES, composeMemoryBlock, firstSentence } from "../memory.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { formatMemoryAge } from "../memory-recall.js";
-import { committedOriginOf, computeEntryRev, hasOriginFormExtra, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenOrigin } from "./frontmatter.js";
+import { committedOriginOf, computeEntryRev, hasOriginFormExtra, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenOrigin } from "./frontmatter.js";
+import { MEMORY_PROVENANCE_RECALL_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow } from "./provenance-wording.js";
 import { isInstructionEntry } from "./header-hints.js";
+import { classifySessionSettlements, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, } from "./delegation-settlement.js";
+import { noReplaceRestore } from "./delegation-settlement.js";
+import { openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
 import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, readIndexRevs, writeIndexRevs, bumpScanFuse, canonicalize, claimRootScope, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, isContainedIn, markSessionPolluted, readSessionPollution, recordRetrievedAccount, writeFileNoFollow, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, resolveChallengeEvent, stageLineagePending, } from "./layout.js";
@@ -36,6 +41,25 @@ export function buildMemoryInstruction(memoryDir, instructionFileName) {
     return MEMORY_INSTRUCTION_TEMPLATE.replaceAll("{{MEMORY_DIR}}", () => dir).replaceAll("{{INSTRUCTION_FILE}}", () => instructionFileName ?? "CLAUDE.md");
 }
 export const MEMORY_RECALL_DISCIPLINE = "Before answering questions about earlier work, decisions, dates, people, or the user's preferences, look them up: `memory_search` finds entries by keyword and `memory_get` reads a full entry — the injected memory index only lists what exists. When a lookup comes up empty, say that you checked memory and found nothing instead of guessing.";
+export function memoryRecallDisciplineSegment(provenance) {
+    return provenance === "carry" ? `${MEMORY_RECALL_DISCIPLINE} ${MEMORY_PROVENANCE_RECALL_SENTENCE}` : MEMORY_RECALL_DISCIPLINE;
+}
+export function entryFileHeadCarriesOrigin(absPath, maxBytes = 64 * 1024) {
+    try {
+        const fd = openSync(absPath, "r");
+        try {
+            const buf = Buffer.alloc(maxBytes);
+            const n = readSync(fd, buf, 0, maxBytes, 0);
+            return committedOriginOf(parseEntryFile(buf.subarray(0, n).toString("utf8")).frontmatter) !== undefined;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return false;
+    }
+}
 export const MEMORY_PREFERENCE_DISCIPLINE = "When the user confirms a stored preference or fact still holds, refresh that entry's `last-confirmed: <YYYY-MM-DD>` frontmatter line (add it when absent). When you save a preference, add an `applies-when: <context>` frontmatter line naming when it applies. Both are plain frontmatter lines — write them yourself; nothing fills them in for you.";
 export const MEMORY_ANNOUNCEMENT_READONLY_PLANE_CODA = "The notices immediately above concern a READ-ONLY memory store: any guidance in them to record, update, or tombstone an entry cannot be applied to that store this session — surface it to the user instead of claiming it done.";
 export const MEMORY_ANNOUNCEMENT_READONLY_CODA = "The memory store itself is not writable this session, so any guidance above to record, update, or tombstone a memory entry cannot be applied here — surface it to the user instead of claiming it done.";
@@ -48,6 +72,7 @@ export const STUB_ARCHIVED_LINE = "[body archived — request hydration by listi
 export const DEFAULT_MAX_MEMORY_FILES = 500;
 export const DEFAULT_HARVEST_DEADLINE_MS = 5_000;
 export const DEFAULT_HARVEST_FILE_BUDGET = 2_000;
+export const DEFAULT_HOLD_SETTLE_TIMEOUT_MS = 72 * 60 * 60 * 1000;
 export const MASS_DELETION_FUSE_RATIO = 0.5;
 let indexCaptureSeq = 0;
 export function memorySessionPollutedNotice(input) {
@@ -82,6 +107,14 @@ export function pollutionContainmentCounts(report) {
 }
 export function memoryHarvestQuarantinedNotice(input) {
     const reason = input.reason !== undefined ? inlineUntrusted(input.reason, 200) : undefined;
+    if (input.count === 0 && input.indexRolledBack === true) {
+        return {
+            code: "memory.harvest_quarantined",
+            message: `Memory harvest rolled the derived index (MEMORY.md) back to its materialize-time baseline${reason !== undefined ? ` (${reason})` : ""}: ` +
+                `this session's index prose additions were captured to control-plane quarantine and not retained. No entry files were withheld.`,
+            detail: { count: 0, moved: 0, escalated: 0, indexRolledBack: true, ...(reason !== undefined ? { reason } : {}), ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}) },
+        };
+    }
     const lead = input.provenance === "carry"
         ? `Memory harvest withheld instruction-form files for this externally exposed session${reason !== undefined ? ` (${reason})` : ""} (ordinary entries committed with an external-origin marker): `
         : `Memory harvest committed nothing for this polluted session${reason !== undefined ? ` (${reason})` : ""}: `;
@@ -103,6 +136,39 @@ export function memoryHarvestQuarantinedNotice(input) {
         },
     };
 }
+export function memoryHoldNotices(report, sessionId) {
+    const c = report.containment;
+    if (c === undefined)
+        return [];
+    const caps = (paths) => paths.slice(0, 20).map((p) => inlineUntrusted(p, 160));
+    const notices = [];
+    if (c.heldInstruction.length > 0) {
+        notices.push({
+            code: "memory.hold_opened",
+            message: `Memory harvest HELD ${c.heldInstruction.length} instruction-form entry file(s): this session's delegation outcome ` +
+                `is still pending, so instruction entries wait off the model-visible plane and commit automatically once every ` +
+                `delegation settles clean (a dirty or expired settlement disposes them to quarantine, announced; resolveHold is the host valve).`,
+            detail: { count: c.heldInstruction.length, paths: caps(c.heldInstruction), ...(sessionId !== undefined ? { sessionId } : {}) },
+        });
+    }
+    if (c.releasedHolds.length > 0) {
+        notices.push({
+            code: "memory.hold_released",
+            message: `Memory harvest RELEASED ${c.releasedHolds.length} held instruction entry file(s) — their writer sessions settled clean (or a host valve released them) and the entries re-walked the full gate set and committed.`,
+            detail: { count: c.releasedHolds.length, paths: caps(c.releasedHolds), ...(sessionId !== undefined ? { sessionId } : {}) },
+        });
+    }
+    if (c.disposedHolds.length > 0) {
+        notices.push({
+            code: "memory.hold_disposed",
+            message: `Memory harvest DISPOSED ${c.disposedHolds.length} held instruction entry file(s) to control-plane quarantine ` +
+                `(terminals: ${[...new Set(c.disposedHolds.map((d) => d.terminal))].join(", ")}). An "expired" terminal is a TIMEOUT, not a ` +
+                `conviction — resolveHold(holdId, "release") commits such an entry with a "static"-cause marker after host review; the bytes are never silently dropped.`,
+            detail: { count: c.disposedHolds.length, disposed: c.disposedHolds.slice(0, 20).map((d) => ({ path: inlineUntrusted(d.relPath, 160), terminal: d.terminal })), ...(sessionId !== undefined ? { sessionId } : {}) },
+        });
+    }
+    return notices;
+}
 export class MemoryEngine {
     backend;
     memoryDir;
@@ -114,6 +180,7 @@ export class MemoryEngine {
     maxDepth;
     harvestDeadlineMs;
     harvestFileBudget;
+    holdSettleTimeoutMs;
     provenance;
     onIncident;
     backendPinnedRoot;
@@ -142,8 +209,27 @@ export class MemoryEngine {
         this.maxDepth = opts.maxDepth ?? DEFAULT_MAX_ENTRY_DEPTH;
         this.harvestDeadlineMs = opts.harvestDeadlineMs ?? DEFAULT_HARVEST_DEADLINE_MS;
         this.harvestFileBudget = opts.harvestFileBudget ?? DEFAULT_HARVEST_FILE_BUDGET;
+        if (opts.holdSettleTimeoutMs !== undefined && (typeof opts.holdSettleTimeoutMs !== "number" || !Number.isFinite(opts.holdSettleTimeoutMs) || opts.holdSettleTimeoutMs <= 0)) {
+            const got = typeof opts.holdSettleTimeoutMs === "number" ? String(opts.holdSettleTimeoutMs) : opts.holdSettleTimeoutMs === null ? "null" : typeof opts.holdSettleTimeoutMs;
+            const e = new Error(`MemoryEngineOptions.holdSettleTimeoutMs must be a finite positive number of milliseconds when present (got ${got}) — an unevaluable settlement window is refused loudly, never folded to the default.`);
+            e.code = "config.memory_hold_timeout";
+            throw e;
+        }
+        this.holdSettleTimeoutMs = opts.holdSettleTimeoutMs ?? DEFAULT_HOLD_SETTLE_TIMEOUT_MS;
         this.onIncident = opts.onIncident;
     }
+    discloseSessionAccountIncident(what, cause) {
+        const sink = this.onIncident;
+        if (sink === undefined)
+            return;
+        try {
+            const e = new Error(`memory session account: ${what}${cause !== undefined ? `: ${cause instanceof Error ? cause.message : String(cause)}` : ""}`);
+            e.code = "memory.session_account_failed";
+            sink(e);
+        }
+        catch {
+        }
+    }
     discloseAnnounceFailure(stage, cause) {
         const sink = this.onIncident;
         if (sink === undefined)
@@ -756,6 +842,7 @@ export class MemoryEngine {
         ensureDirExists(this.memoryDir);
         ensureDirExists(this.controlDir);
         const restricted = opts?.adoptionRestricted === true;
+        let sessionAccountFailed = false;
         const readBackend = restricted
             ? (this.backend.restrictedAdoptionView?.({ audit: true, writeScope }) ?? this.backend)
             : this.backend;
@@ -768,6 +855,112 @@ export class MemoryEngine {
             scopeDirs.set(writeScope, registerScope(this.memoryDir, this.controlDir, writeScope));
         for (const [scope, dir] of scopeDirs)
             this.chmodScopeTree(dir, 0o755, 0o644, { excludeTopDirs: this.siblingScopeDirNames(dir, scope) });
+        if (this.provenance === "carry" && opts?.sessionId !== undefined && writeScope !== null && !restricted) {
+            let accountFailed = false;
+            try {
+                const foreign = foreignDanglingSessionAccounts(this.controlDir, opts.sessionId);
+                const unattributed = [];
+                if (foreign.length > 0) {
+                    const wroot = canonicalize(scopeDirFor(this.memoryDir, this.controlDir, writeScope));
+                    let committedRevs;
+                    const snapFace = this.backend.committedSnapshotsOfScopes;
+                    if (snapFace === undefined) {
+                        this.discloseSessionAccountIncident("the backend exposes no committed-snapshot face — the id-bearing crash-residue arms are degraded to the id-less arm for this materialize", undefined);
+                    }
+                    if (snapFace !== undefined) {
+                        const snap = await snapFace.call(this.backend, [writeScope]);
+                        if (snap.complete && snap.rows !== undefined) {
+                            committedRevs = new Map(snap.rows.map((r) => [r.id, r.rev]));
+                        }
+                        else {
+                            this.discloseSessionAccountIncident("the committed snapshot was contended/incomplete — the id-bearing residue arm is degraded to id-less for this materialize", undefined);
+                        }
+                    }
+                    for (const f of scanEntryFiles(wroot, { maxDepth: this.maxDepth })) {
+                        const canonical = canonicalize(f.path);
+                        if (canonical !== wroot && !canonical.startsWith(`${wroot}${sep}`))
+                            continue;
+                        const text = readSafe(canonical);
+                        if (text === undefined)
+                            continue;
+                        const rel = relative(this.memoryDir, canonical);
+                        if (rel === MEMORY_INDEX_FILENAME || rel.endsWith(`${sep}${MEMORY_INDEX_FILENAME}`))
+                            continue;
+                        const parsed = parseEntryFile(text);
+                        const uncommitted = parsed.id === undefined || (committedRevs !== undefined && !committedRevs.has(parsed.id));
+                        if (uncommitted) {
+                            unattributed.push(rel);
+                            continue;
+                        }
+                        if (parsed.id !== undefined && committedRevs !== undefined) {
+                            const committedRev = committedRevs.get(parsed.id);
+                            const diskRev = computeEntryRev({ id: parsed.id, frontmatter: parsed.frontmatter, body: parsed.body });
+                            if (committedRev !== undefined && diskRev !== committedRev) {
+                                const committed = await this.committedContentFor(parsed.id);
+                                if (committed !== undefined && committed !== text) {
+                                    let captured = false;
+                                    const captureName = `${this.now()}-residue-${parsed.id}.md`;
+                                    const capturePath = join(this.controlDir, QUARANTINE_DIR, captureName);
+                                    try {
+                                        ensureDirExists(join(this.controlDir, QUARANTINE_DIR));
+                                        writeFileSync(capturePath, text, { encoding: "utf8", flag: "wx" });
+                                        captured = readFileSync(capturePath, "utf8") === text;
+                                    }
+                                    catch {
+                                        captured = false;
+                                    }
+                                    let restoredCommitted = false;
+                                    if (captured) {
+                                        const stagingPath = `${capturePath}.staging`;
+                                        try {
+                                            renameSync(canonical, stagingPath);
+                                            if (readFileSync(stagingPath, "utf8") === text) {
+                                                writeFileNoFollow(canonical, committed);
+                                                restoredCommitted = true;
+                                                try {
+                                                    unlinkSync(stagingPath);
+                                                }
+                                                catch {
+                                                }
+                                            }
+                                            else if (noReplaceRestore(stagingPath, canonical) === "stranded") {
+                                                this.discloseSessionAccountIncident(`a concurrent write to ${rel} landed during residue containment and could not be restored — its bytes are preserved at quarantine/${captureName}.staging`, undefined);
+                                            }
+                                        }
+                                        catch {
+                                        }
+                                    }
+                                    else {
+                                        this.discloseSessionAccountIncident(`the crash-residue edit of ${rel} could not be captured to quarantine — the divergent bytes were left in place (the inbound gate adjudicates them)`, undefined);
+                                    }
+                                    try {
+                                        enqueueMemoryAnnouncement(this.controlDir, {
+                                            kind: "external",
+                                            at: this.now(),
+                                            items: [
+                                                restoredCommitted
+                                                    ? `crash residue: an edit of committed memory entry ${quoteId(rel)} pre-existed this session under an unresolved foreign session account — its writer cannot be attributed, so the edit bytes were captured to control-plane quarantine (${captureName}) and the committed content restored (host review adjudicates the edit)`
+                                                    : `crash residue: an edit of committed memory entry ${quoteId(rel)} pre-existed this session under an unresolved foreign session account and could NOT be fully contained — the divergent/newer bytes were left in place (or preserved beside the capture) for the ordinary inbound gate`,
+                                            ],
+                                        });
+                                    }
+                                    catch (annErr) {
+                                        this.discloseAnnounceFailure("session-account residue", annErr);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                openSessionAccount(this.controlDir, { sessionId: opts.sessionId, now: this.now, unattributed });
+            }
+            catch (err) {
+                accountFailed = true;
+                this.discloseSessionAccountIncident("crash-residue attribution is degraded for this session (the harvest boundary refuses fail-closed while this stands)", err);
+            }
+            if (accountFailed)
+                sessionAccountFailed = true;
+        }
         const allScopes = [...scopeDirs.keys()];
         const headers = await readBackend.listHeaders(allScopes);
         const entries = await readBackend.getByIds(headers.map((h) => h.id));
@@ -791,6 +984,7 @@ export class MemoryEngine {
             indexBaselineLines: 0,
             indexText: "",
             ...(restricted ? { adoptionRestricted: true } : {}),
+            ...(sessionAccountFailed ? { sessionAccountFailed: true } : {}),
         };
         if (writeScope !== null)
             ensureDirExists(handle.writableRoot);
@@ -955,6 +1149,18 @@ export class MemoryEngine {
         const mintOrigin = () => ({ taint: "external", cause: pollutionCause ?? "observed", at: this.now() });
         const lineageSessionId = opts?.sessionId;
         const startedAt = this.now();
+        let sessionPending = false;
+        let pendingSettleIds = [];
+        let unattributedSet = new Set();
+        const containment = { indexRolledBack: false, quarantinedInstruction: [], heldInstruction: [], releasedHolds: [], disposedHolds: [] };
+        const signalContainment = (fill) => {
+            fill(containment);
+            report.containment = containment;
+        };
+        const pushDistinct = (arr, rel) => {
+            if (!arr.includes(rel))
+                arr.push(rel);
+        };
         const report = {
             ok: true,
             patches: { add: 0, update: 0, delete: 0 },
@@ -981,6 +1187,11 @@ export class MemoryEngine {
                 report.warnings.push(opts.admitNothing.reason);
             return report;
         }
+        if (carry && handle.sessionAccountFailed === true) {
+            report.ok = false;
+            report.incident = { kind: "sidecar_corrupt", detail: "memory session account could not be opened at materialize — the crash-residue classification for this session never persisted, so the harvest refuses fail-closed (repair the control plane and re-materialize)" };
+            return report;
+        }
         try {
             this.backend.checkControlPlane?.();
         }
@@ -990,6 +1201,34 @@ export class MemoryEngine {
             return report;
         }
         try {
+            if (carry) {
+                reconcileHolds(this.controlDir, { memoryDir: this.memoryDir, now: this.now });
+                const newlyExpired = expireOverdueSettlements(this.controlDir, { timeoutMs: this.holdSettleTimeoutMs, now: this.now });
+                if (newlyExpired.length > 0) {
+                    report.warnings.push(`${newlyExpired.length} delegation settlement row(s) passed the ${this.holdSettleTimeoutMs}ms window without settling and are now EXPIRED — a timeout, not a conviction: the affected sessions' unprovable windows close exposed, their held instruction entries dispose to quarantine (resolveHold can still release one with a "static"-cause marker), and resolveSettlement can overturn the expiry with an audited ruling`);
+                }
+                replayExternalSettlementEffects(this.controlDir, { carry, now: this.now });
+                const settled = await this.settleDueHolds(handle, report);
+                for (const rel of settled.released)
+                    signalContainment((c) => pushDistinct(c.releasedHolds, rel));
+                for (const d of settled.disposed)
+                    signalContainment((c) => c.disposedHolds.push(d));
+                if (lineageSessionId !== undefined) {
+                    const rows = sessionSettlements(this.controlDir, lineageSessionId);
+                    const cls = classifySessionSettlements(rows);
+                    if (cls.state === "exposed") {
+                        if (pollutedReason === undefined) {
+                            pollutedReason = cls.reason ?? "the session's delegation settlement account holds an external, unattestable or expired row";
+                            pollutionCause = cls.cause;
+                        }
+                    }
+                    else if (cls.state === "pending") {
+                        sessionPending = true;
+                        pendingSettleIds = rows.filter((r) => r.effective === "pending").map((r) => r.row.settleId);
+                    }
+                    unattributedSet = sessionUnattributedSet(this.controlDir, lineageSessionId);
+                }
+            }
             const rec = reconcileLineage(this.controlDir, this.now);
             this.settlePromotions(rec.promoted);
             for (const u of rec.undecidable) {
@@ -1056,7 +1295,8 @@ export class MemoryEngine {
         const withheldWhy = carry
             ? "this session is marked externally exposed and this file is instruction-form (type: feedback, or pinned/triggers/applies-when header lines) — instruction-form entries from exposed sessions are withheld for host review"
             : "this session invoked a tool classified as an external content source, so its memory changes were not committed";
-        const containPollutedRecord = async (f) => {
+        const containPollutedRecord = async (f, whyOverride) => {
+            const why = whyOverride ?? withheldWhy;
             const rel = f.rel;
             if (f.canonical !== handle.writableRoot && !f.canonical.startsWith(`${handle.writableRoot}${sep}`)) {
                 report.rejections.push({ path: rel, code: "outside_root", reason: "file resolves outside the writable memory root (containment gate, fail-closed)" });
@@ -1075,7 +1315,7 @@ export class MemoryEngine {
                     report.rejections.push({
                         path: rel,
                         code: "polluted",
-                        reason: `memory write withheld: ${withheldWhy} (archived-body stub; ${stubCaptured && sq.removed ? "file moved to quarantine for host review, and the next session re-projects the stub" : "containment incomplete — the edited stub may still be on the model-visible plane"})`,
+                        reason: `memory write withheld: ${why} (archived-body stub; ${stubCaptured && sq.removed ? "file moved to quarantine for host review, and the next session re-projects the stub" : "containment incomplete — the edited stub may still be on the model-visible plane"})`,
                     });
                     if (sq.detail !== undefined || !sq.removed || !stubCaptured) {
                         const detail = `${sq.detail ?? (stubCaptured ? "suspect content still on the model-visible plane" : "quarantine capture failed")}${sq.removed ? "" : " — NOT contained"}`;
@@ -1106,7 +1346,7 @@ export class MemoryEngine {
             report.rejections.push({
                 path: rel,
                 code: "polluted",
-                reason: `memory write withheld: ${withheldWhy} (${captured && contained ? "file moved to quarantine for host review" : captured ? "quarantine copy captured; removal from the model-visible plane incomplete" : "quarantine copy FAILED; file removal " + (contained ? "succeeded" : "incomplete")})`,
+                reason: `memory write withheld: ${why} (${captured && contained ? "file moved to quarantine for host review" : captured ? "quarantine copy captured; removal from the model-visible plane incomplete" : "quarantine copy FAILED; file removal " + (contained ? "succeeded" : "incomplete")})`,
             });
             if (q.detail !== undefined || !contained || !captured) {
                 const parts = [q.detail, !captured ? "quarantine capture failed" : undefined].filter((x) => x !== undefined);
@@ -1120,11 +1360,11 @@ export class MemoryEngine {
             const canonicalIndex = canonicalize(pollutedIndexPath);
             if (canonicalIndex !== pollutedIndexPath && !canonicalIndex.startsWith(`${handle.writableRoot}${sep}`)) {
                 report.warnings.push("memory index NOT restored: its path resolves outside the writable memory root (containment gate, fail-closed)");
-                return;
+                return false;
             }
             const indexNow = readSafe(pollutedIndexPath);
             if (indexNow === undefined || indexNow === handle.indexText)
-                return;
+                return false;
             let indexCaptureLanded = false;
             try {
                 const dest = join(this.controlDir, QUARANTINE_DIR, `${this.now()}-polluted-${MEMORY_INDEX_FILENAME}`);
@@ -1137,15 +1377,18 @@ export class MemoryEngine {
             try {
                 writeFileNoFollow(pollutedIndexPath, handle.indexText);
                 report.warnings.push(`memory index restored to its pre-session state — this session's index additions were not retained (session polluted; ${indexCaptureLanded ? "the removed text was captured to quarantine" : "the quarantine capture did NOT land — the removed text is gone"})`);
+                return true;
             }
             catch (err) {
                 report.warnings.push(`memory index could NOT be restored to its pre-session state: ${err instanceof Error ? err.message : String(err)}`);
+                return false;
             }
         };
         const containPollutedDomain = async () => {
             for (const f of records)
                 await containPollutedRecord(f);
-            restorePollutedIndex();
+            if (restorePollutedIndex())
+                signalContainment((c) => (c.indexRolledBack = true));
             report.warnings.push(`memory harvest committed nothing this session: ${inlineUntrusted(pollutedReason, 200)}`);
         };
         const containExposedInstructionDomain = async () => {
@@ -1158,10 +1401,13 @@ export class MemoryEngine {
                         instruction = committedFm !== undefined && isInstructionEntry(committedFm);
                     }
                 }
-                if (instruction)
+                if (instruction) {
                     await containPollutedRecord(f);
+                    signalContainment((c) => pushDistinct(c.quarantinedInstruction, f.rel));
+                }
             }
-            restorePollutedIndex();
+            if (restorePollutedIndex())
+                signalContainment((c) => (c.indexRolledBack = true));
             report.warnings.push(`memory harvest refused by an incident while this session is marked externally exposed — no entries were committed; instruction-form files were withheld and the derived index rolled back: ${inlineUntrusted(pollutedReason, 200)}`);
         };
         for (const m of handle.materialized.filter((x) => x.readonly)) {
@@ -1340,8 +1586,54 @@ export class MemoryEngine {
                     report.warnings.push(`${rel}: origin-form frontmatter written on the model-visible plane was not adopted — the external-origin marker is engine-authored (the engine's own record of this session decides it)`);
                 }
             }
-            if (carry && pollutedReason !== undefined && (isInstructionEntry(fm) || (committedFmHere !== undefined && isInstructionEntry(committedFmHere)))) {
+            const instructionForm = carry && (isInstructionEntry(fm) || (committedFmHere !== undefined && isInstructionEntry(committedFmHere)));
+            if (instructionForm && unattributedSet.has(rel)) {
+                await containPollutedRecord(f, "this file pre-existed the session under an unresolved foreign session account (crash residue) and is instruction-form — its writer cannot be attributed, so it is withheld for host review");
+                signalContainment((c) => pushDistinct(c.quarantinedInstruction, rel));
+                continue;
+            }
+            if (instructionForm && pollutedReason !== undefined) {
                 await containPollutedRecord(f);
+                signalContainment((c) => pushDistinct(c.quarantinedInstruction, rel));
+                continue;
+            }
+            if (instructionForm && sessionPending && lineageSessionId !== undefined) {
+                const held = openInstructionHold(this.controlDir, {
+                    sessionId: lineageSessionId,
+                    relPath: rel,
+                    absPath: f.canonical,
+                    content: f.text,
+                    ...(committedIdHere !== undefined ? { entryId: committedIdHere } : {}),
+                    op: baseId !== undefined ? "update" : "add",
+                    ...(baseId !== undefined && revByBasePath.get(f.canonical) !== undefined ? { baseRev: revByBasePath.get(f.canonical) } : {}),
+                    slug: f.slug,
+                    scope: writeScope,
+                    settleIds: pendingSettleIds,
+                    now: this.now,
+                });
+                if (held.ok) {
+                    report.warnings.push(`${rel}: instruction-form entry HELD — this session's delegation outcome is still pending (attested-only evidence standard); the file was captured off the model-visible plane and commits automatically when every delegation settles clean, disposes to quarantine on a dirty or expired settlement (resolveHold is the host valve)`);
+                    if (held.thirdWriterStranded !== undefined) {
+                        report.warnings.push(`${rel}: a concurrent writer's bytes could not be restored onto the plane while the hold was captured — they are preserved at hold/${held.thirdWriterStranded} in the memory control plane for host recovery`);
+                    }
+                    signalContainment((c) => pushDistinct(c.heldInstruction, rel));
+                    if (committedIdHere !== undefined) {
+                        const committed = await this.committedContentFor(committedIdHere);
+                        if (committed !== undefined) {
+                            try {
+                                writeFileNoFollow(f.canonical, committed);
+                                report.restored.push(rel);
+                            }
+                            catch (err) {
+                                report.warnings.push(`${rel}: the committed content could not be restored after the hold captured this session's edit — the entry is unavailable on the plane until release or the next restore: ${err instanceof Error ? err.message : String(err)}`);
+                            }
+                        }
+                    }
+                }
+                else {
+                    await containPollutedRecord(f, `this session's delegation outcome is pending and this instruction-form file could not be HELD (${held.reason}) — withheld fail-closed for host review`);
+                    signalContainment((c) => pushDistinct(c.quarantinedInstruction, rel));
+                }
                 continue;
             }
             if (fm.deleted !== true) {
@@ -1352,6 +1644,10 @@ export class MemoryEngine {
                         report.warnings.push(`${rel}: the entry's committed external-origin marker was carried in a legacy byte form — normalized into the typed origin field (the marker follows the content)`);
                     }
                 }
+                else if (carry && unattributedSet.has(rel)) {
+                    fm.origin = { taint: "external", cause: "unattributed", at: this.now() };
+                    report.warnings.push(`${rel}: this file pre-existed the session under an unresolved foreign session account (crash residue) — committed with an external-origin marker (cause "unattributed"), not under this session's name`);
+                }
                 else if (carry && pollutedReason !== undefined) {
                     fm.origin = mintOrigin();
                 }
@@ -1449,8 +1745,10 @@ export class MemoryEngine {
                             const committedFm = await this.committedFrontmatterFor(p.id);
                             if (committedFm !== undefined && isInstructionEntry(committedFm)) {
                                 const rec = records.find((r) => (handle.baseIds.get(r.canonical) ?? r.parsed.id) === p.id && r.parsed.frontmatter.deleted === true);
-                                if (rec !== undefined)
+                                if (rec !== undefined) {
                                     await containPollutedRecord(rec);
+                                    signalContainment((c) => pushDistinct(c.quarantinedInstruction, rec.rel));
+                                }
                                 continue;
                             }
                             keptPatches.push(p);
@@ -1464,8 +1762,10 @@ export class MemoryEngine {
                         if (isInstructionEntry(p.entry.frontmatter) || (committedFm !== undefined && isInstructionEntry(committedFm))) {
                             const projection = pendingProjections.find((pp) => pp.entry.id === p.id);
                             const rec = projection !== undefined ? records.find((r) => r.canonical === projection.path) : undefined;
-                            if (rec !== undefined)
+                            if (rec !== undefined) {
                                 await containPollutedRecord(rec);
+                                signalContainment((c) => pushDistinct(c.quarantinedInstruction, rec.rel));
+                            }
                             droppedIds.add(p.id);
                             continue;
                         }
@@ -1601,11 +1901,18 @@ export class MemoryEngine {
         if (drained !== undefined && drained.length > 0)
             report.inboundFindings = drained;
         if (pollutedReason !== undefined) {
-            restorePollutedIndex();
+            if (restorePollutedIndex())
+                signalContainment((c) => (c.indexRolledBack = true));
             report.warnings.push(carry
                 ? `memory entries from this externally exposed session were committed with an external-origin marker; its index prose additions were not retained: ${inlineUntrusted(pollutedReason, 200)}`
                 : `memory harvest committed nothing this session: ${inlineUntrusted(pollutedReason, 200)}`);
         }
+        else if (carry && sessionPending) {
+            if (restorePollutedIndex()) {
+                signalContainment((c) => (c.indexRolledBack = true));
+                report.warnings.push("this session's index prose additions were not retained: its delegation outcome is still pending (prose has no entry anchor for the settlement account to govern; committed entries and mechanical index lines are unaffected)");
+            }
+        }
         const indexGate = this.gateDerivedIndex(handle);
         if (indexGate !== undefined) {
             report.rejections.push(indexGate.rejection);
@@ -1615,8 +1922,344 @@ export class MemoryEngine {
         const headers = await this.backend.listHeaders([...new Set([...handle.scopes, writeScope])]);
         handle.indexText = this.rebuildIndex(handle, headers, { write: true, ignoreOnDisk: indexGate !== undefined }, report.warnings);
         await this.rebaseline(handle, new Set(report.degraded?.pending ?? []));
+        if (carry && lineageSessionId !== undefined && report.degraded === undefined) {
+            try {
+                closeSessionAccount(this.controlDir, { sessionId: lineageSessionId, now: this.now });
+            }
+            catch (err) {
+                report.warnings.push(`memory session account could not close (the dangling row keeps future crash residue attributed — over-holding, the safe side): ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         return report;
     }
+    async settleDueHolds(handle, report) {
+        const out = { released: [], disposed: [] };
+        const dispose = (row, terminal, why) => {
+            const d = disposeHold(this.controlDir, { holdId: row.holdId, terminal, now: this.now });
+            out.disposed.push({ relPath: row.relPath, terminal });
+            report.warnings.push(`held instruction entry ${row.relPath} DISPOSED (${terminal}): ${why}${d.quarantineName !== undefined ? ` — captured bytes moved to control-plane quarantine (${d.quarantineName})` : ""}`);
+        };
+        for (const row of readHolds(this.controlDir)) {
+            const valveRelease = row.resolved === "release" && (row.status === "held" || (row.status === "disposed" && row.disposition?.terminal === "expired"));
+            if (valveRelease) {
+                const released = await this.releaseHold(handle, report, row, { valve: true });
+                if (released !== undefined)
+                    out.released.push(released);
+                continue;
+            }
+            if (row.status !== "held")
+                continue;
+            if (row.resolved === "discard") {
+                dispose(row, "discarded", "the host valve resolved this hold as discard");
+                continue;
+            }
+            const marker = this.sessionPollution(row.sessionId);
+            const rows = sessionSettlements(this.controlDir, row.sessionId);
+            if (marker !== undefined || rows.some((r) => r.effective === "external")) {
+                dispose(row, "dirty", marker !== undefined ? "the writer session is marked externally exposed" : "a delegation of the writer session settled with an observed external attestation");
+                continue;
+            }
+            if (rows.some((r) => r.effective === "unattestable" || r.effective === "expired")) {
+                dispose(row, "expired", "the writer session's delegation window closed UNPROVABLE (a timeout or an unattestable delivery — not a conviction); resolveHold(holdId, \"release\") commits the entry with a \"static\"-cause marker after host review");
+                continue;
+            }
+            if (rows.some((r) => r.effective === "pending"))
+                continue;
+            const released = await this.releaseHold(handle, report, row, { valve: false });
+            if (released !== undefined)
+                out.released.push(released);
+        }
+        return out;
+    }
+    async releaseHold(handle, report, row, opts) {
+        const disposeOut = (terminal, why) => {
+            const d = disposeHold(this.controlDir, { holdId: row.holdId, terminal, now: this.now });
+            report.warnings.push(`held instruction entry ${row.relPath} DISPOSED (${terminal}): ${why}${d.quarantineName !== undefined ? ` — captured bytes moved to control-plane quarantine (${d.quarantineName})` : ""}`);
+            report.containment ??= { indexRolledBack: false, quarantinedInstruction: [], heldInstruction: [], releasedHolds: [], disposedHolds: [] };
+            report.containment.disposedHolds.push({ relPath: row.relPath, terminal });
+            return undefined;
+        };
+        const content = readHoldCustody(this.controlDir, row);
+        if (content === undefined)
+            return disposeOut("capture_lost", "the captured bytes are missing or fail their digest — nothing verifiable to commit");
+        const findings = [];
+        const nameFinding = scanMemoryFileName(`${row.slug}.md`);
+        if (nameFinding !== undefined)
+            findings.push(nameFinding);
+        findings.push(...scanMemoryWrite(content));
+        if (findings.length > 0)
+            return disposeOut("discarded", `the release re-scan refused it (${findings[0].code}: ${findings[0].reason})`);
+        if (Buffer.byteLength(content, "utf8") > this.perFileBytes)
+            return disposeOut("discarded", `the captured file is over the ${this.perFileBytes}-byte cap`);
+        if (this.sessionPollution(row.sessionId) !== undefined)
+            return disposeOut("discarded", "the writer session's pollution marker landed before the release could commit");
+        const parsed = parseEntryFile(content);
+        const fm = { ...parsed.frontmatter };
+        if (stripModelWrittenOrigin(fm)) {
+            report.warnings.push(`${row.relPath}: origin-form frontmatter in the held bytes was not adopted — the external-origin marker is engine-authored`);
+        }
+        const committedFm = row.entryId !== undefined ? await this.committedFrontmatterFor(row.entryId) : undefined;
+        const committedOrigin = committedFm !== undefined ? committedOriginOf(committedFm) : undefined;
+        if (fm.deleted !== true) {
+            if (committedOrigin !== undefined)
+                fm.origin = committedOrigin;
+            else if (opts.valve)
+                fm.origin = { taint: "external", cause: "static", at: this.now() };
+        }
+        if (fm.name === undefined)
+            fm.name = row.slug.split("/").pop();
+        if (fm.description === undefined && fm.deleted !== true)
+            fm.description = firstSentence(parsed.body) || undefined;
+        const id = row.entryId ?? (parsed.id !== undefined && isValidEntryId(parsed.id) ? parsed.id : `h${createHash("sha256").update(row.holdId, "utf8").digest("hex").slice(0, 31)}`);
+        const entry = { id, slug: row.slug, frontmatter: fm, body: parsed.body, rev: "", scope: row.scope };
+        entry.rev = computeEntryRev(entry);
+        const patch = row.op === "update" && row.entryId !== undefined
+            ? { op: "update", id: row.entryId, entry, ...(row.baseRev !== undefined ? { baseRev: row.baseRev } : {}) }
+            : { op: "add", id: entry.id, entry, guard: "absent" };
+        const txnId = uuidv7();
+        try {
+            stageLineagePending(this.controlDir, txnId, row.sessionId, [{ entryId: patch.id, rev: entry.rev, ...(fm.origin !== undefined ? { marked: true } : {}) }], this.now);
+        }
+        catch (err) {
+            report.warnings.push(`held instruction entry ${row.relPath} could not stage its lineage row — kept HELD for the next harvest: ${err instanceof Error ? err.message : String(err)}`);
+            return undefined;
+        }
+        let patchReport;
+        try {
+            patchReport = await this.backend.applyPatches([patch]);
+        }
+        catch (err) {
+            try {
+                discardLineagePending(this.controlDir, txnId);
+            }
+            catch {
+            }
+            report.warnings.push(`held instruction entry ${row.relPath} could not commit (backend refused) — kept HELD for the next harvest: ${err instanceof Error ? err.message : String(err)}`);
+            return undefined;
+        }
+        if (patchReport.conflicts.length > 0) {
+            try {
+                discardLineagePending(this.controlDir, txnId);
+            }
+            catch {
+            }
+            let alreadyApplied = false;
+            const snapFace = this.backend.committedSnapshotOf;
+            if (snapFace !== undefined) {
+                try {
+                    const snap = await snapFace.call(this.backend, patch.id);
+                    alreadyApplied = snap.state === "row" && snap.rev === entry.rev && snap.binding?.scope === row.scope && (snap.binding?.slug === undefined || snap.binding.slug === row.slug);
+                }
+                catch {
+                    alreadyApplied = false;
+                }
+            }
+            if (alreadyApplied) {
+                markHoldReleased(this.controlDir, { holdId: row.holdId, now: this.now });
+                report.warnings.push(`held instruction entry ${row.relPath} was already committed by an earlier release attempt (crash-idempotent retry) — marked released`);
+                return row.relPath;
+            }
+            return disposeOut("conflict", `the entry moved since capture (${patchReport.conflicts[0].reason}) — never blind-written; the captured bytes stay in quarantine for the host to reconcile`);
+        }
+        try {
+            recordLineageCredential(this.controlDir, txnId, patchReport.applied.filter((a) => a.op !== "delete").map((a) => a.id), this.now);
+            const promoted = promoteLineagePending(this.controlDir, txnId, this.now);
+            this.settlePromotions(promoted);
+        }
+        catch (err) {
+            report.warnings.push(`released hold ${row.relPath}: lineage settlement failed after commit — the entry stays latched until a later harvest reconciles: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        markHoldReleased(this.controlDir, { holdId: row.holdId, now: this.now });
+        const abs = join(this.memoryDir, row.relPath);
+        if (existsSync(abs)) {
+            const canonical = canonicalize(abs);
+            const text = readSafe(canonical);
+            if (text !== undefined) {
+                handle.baseIds.set(canonical, patch.id);
+                handle.baseRevs.set(canonical, computeEntryRev({ id: patch.id, frontmatter: parseEntryFile(text).frontmatter, body: parseEntryFile(text).body }));
+                handle.fileToScope.set(canonical, row.scope);
+                if (!handle.materialized.some((m) => m.path === canonical)) {
+                    handle.materialized.push({ path: canonical, relPath: row.relPath, scope: row.scope, id: patch.id, slug: row.slug, rev: handle.baseRevs.get(canonical), stub: false, readonly: false });
+                }
+            }
+        }
+        report.warnings.push(`held instruction entry ${row.relPath} RELEASED and committed${opts.valve ? ' with a "static"-cause external-origin marker (a host-valve release is not a cleanliness proof)' : " unmarked (every delegation of its writer session settled clean)"}`);
+        return row.relPath;
+    }
+    resolveSettlement(settleId, to, requestId) {
+        resolveSettlementRecord(this.controlDir, { settleId, to, requestId, now: this.now });
+    }
+    resolveHold(holdId, action, requestId) {
+        resolveHoldRecord(this.controlDir, { holdId, action, requestId, now: this.now });
+    }
+    resolveSessionAccount(sessionId, requestId) {
+        resolveSessionAccountRecord(this.controlDir, { sessionId, requestId, now: this.now });
+    }
+    get controlPlaneDir() {
+        return this.controlDir;
+    }
+    readDelegationSettlements() {
+        return effectiveSettlements(this.controlDir);
+    }
+    readInstructionHolds() {
+        return readHolds(this.controlDir);
+    }
+    readDanglingSessionAccounts(selfSessionId) {
+        return foreignDanglingSessionAccounts(this.controlDir, selfSessionId);
+    }
+    committedAuditFace() {
+        const b = this.backend;
+        return b.restrictedAdoptionView?.({ audit: false }) ?? b.retrievalView?.() ?? this.backend;
+    }
+    static originClearRefusal(code, message) {
+        const e = new Error(message);
+        e.code = code;
+        throw e;
+    }
+    async listExternalOriginEntries(scopes) {
+        const face = this.committedAuditFace();
+        const headers = await face.listHeaders(scopes);
+        const entries = await face.getByIds(headers.filter((h) => h.exposure === "external").map((h) => h.id));
+        const requested = new Set(scopes);
+        const out = [];
+        for (const e of entries) {
+            if (!requested.has(e.scope))
+                continue;
+            const origin = committedOriginOf(e.frontmatter);
+            if (origin === undefined)
+                continue;
+            out.push({ id: e.id, slug: e.slug, scope: e.scope, origin, provenance: await this.provenanceOf(e.id) });
+        }
+        return out;
+    }
+    listOriginClearances() {
+        return readOriginClearances(this.controlDir);
+    }
+    async clearEntryOrigin(entryId, input) {
+        if (typeof input.requestId !== "string" || input.requestId.length === 0) {
+            MemoryEngine.originClearRefusal("memory.origin_clear_unattributed", "clearEntryOrigin requires a non-empty requestId (the audit attribution of who cleared) — refused, never defaulted.");
+        }
+        if (typeof input.reason !== "string" || input.reason.length === 0) {
+            MemoryEngine.originClearRefusal("memory.origin_clear_invalid", "clearEntryOrigin requires a non-empty reason (the host's stated ground rides the audit row) — refused, never defaulted.");
+        }
+        const pending = readOriginClearances(this.controlDir).find((r) => r.entryId === entryId && r.status === "pending");
+        if (pending !== undefined)
+            return await this.completeOriginClearance(pending, input.requestId);
+        const face = this.committedAuditFace();
+        const [committed] = await face.getByIds([entryId]);
+        if (committed === undefined || committed.frontmatter.deleted === true) {
+            MemoryEngine.originClearRefusal("memory.origin_clear_unknown", `clearEntryOrigin: no committed memory entry ${JSON.stringify(entryId.slice(0, 80))}.`);
+        }
+        const origin = committedOriginOf(committed.frontmatter);
+        if (origin === undefined) {
+            MemoryEngine.originClearRefusal("memory.origin_clear_not_marked", `clearEntryOrigin: entry ${JSON.stringify(entryId.slice(0, 80))} carries no external-origin marker — nothing to clear.`);
+        }
+        if (this.readChallengeExclusions().has(entryId)) {
+            MemoryEngine.originClearRefusal("memory.origin_clear_challenged", `clearEntryOrigin: entry ${JSON.stringify(entryId.slice(0, 80))} is challenged/latched — adjudicate the challenge first (the clear valve is not a challenge exit).`);
+        }
+        const fm = { ...committed.frontmatter, ...(committed.frontmatter.extra !== undefined ? { extra: [...committed.frontmatter.extra] } : {}) };
+        stripModelWrittenOrigin(fm);
+        const cleared = { id: committed.id, slug: committed.slug, scope: committed.scope, frontmatter: fm, body: committed.body, rev: "" };
+        cleared.rev = computeEntryRev(cleared);
+        const row = {
+            clearanceId: uuidv7(),
+            entryId,
+            scope: committed.scope,
+            slug: committed.slug,
+            baseRev: committed.rev,
+            origin,
+            requestId: input.requestId,
+            reason: input.reason,
+            at: this.now(),
+            entryText: serializeEntryFile(cleared),
+        };
+        openOriginClearance(this.controlDir, row);
+        return await this.completeOriginClearance({ ...row, status: "pending", events: [] }, input.requestId);
+    }
+    async completeOriginClearance(row, requestId) {
+        const fail = (code, detail, keepPending) => {
+            try {
+                settleOriginClearance(this.controlDir, { clearanceId: row.clearanceId, to: "failed", requestId, eventId: uuidv7(), now: this.now, detail, ...(keepPending ? { keepPending: true } : {}) });
+            }
+            catch {
+            }
+            MemoryEngine.originClearRefusal(code, `clearEntryOrigin ${JSON.stringify(row.entryId.slice(0, 80))}: ${detail}`);
+        };
+        const parsed = parseEntryFile(row.entryText);
+        const cleared = { id: row.entryId, slug: row.slug, scope: row.scope, frontmatter: parsed.frontmatter, body: parsed.body, rev: "" };
+        cleared.rev = computeEntryRev(cleared);
+        const [current] = await this.committedAuditFace().getByIds([row.entryId]);
+        if (current === undefined || committedOriginOf(current.frontmatter) !== undefined) {
+            if (parsed.id !== row.entryId || committedOriginOf(parsed.frontmatter) !== undefined) {
+                const what = parsed.id !== row.entryId ? "the custody bytes carry a different entry id" : "an origin form survived in the custody bytes";
+                fail("memory.origin_clear_failed", `the clearance row's custody text failed its identity/cleared-state validation (${what}) — refusing to act on it. ` +
+                    (current === undefined
+                        ? "The row stays PENDING (the tombstone has committed and the row's entryText is the recovery seat — repair it, or recover the bytes by hand)."
+                        : "Re-judge with a fresh clearEntryOrigin call (this row is terminal; the marked entry stands untouched)."), current === undefined);
+            }
+        }
+        let landedSlug = row.slug;
+        let detail;
+        if (current !== undefined && committedOriginOf(current.frontmatter) !== undefined) {
+            if (current.rev !== row.baseRev) {
+                fail("memory.origin_clear_conflict", `the entry moved since the clearance was judged (rev ${row.baseRev.slice(0, 12)}… → ${current.rev.slice(0, 12)}…) — call clearEntryOrigin again to re-judge (the marked entry stands untouched; this row is terminal).`, false);
+            }
+            if (current.scope !== row.scope || current.slug !== row.slug) {
+                fail("memory.origin_clear_conflict", `the entry's projection moved since the clearance was judged (${JSON.stringify(row.scope)}/${JSON.stringify(row.slug.slice(0, 80))} → ${JSON.stringify(current.scope)}/${JSON.stringify(current.slug.slice(0, 80))}) — call clearEntryOrigin again to re-judge (the marked entry stands untouched; this row is terminal).`, false);
+            }
+            const del = await this.backend.applyPatches([{ op: "delete", id: row.entryId, baseRev: row.baseRev }]);
+            if (del.conflicts.length > 0) {
+                const [reprobe] = await this.committedAuditFace().getByIds([row.entryId]);
+                if (reprobe !== undefined && committedOriginOf(reprobe.frontmatter) !== undefined) {
+                    fail("memory.origin_clear_conflict", `the tombstone leg was refused (${(del.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — call clearEntryOrigin again to re-judge (the marked entry stands untouched; this row is terminal).`, false);
+                }
+                if (reprobe === undefined) {
+                    const add = await this.backend.applyPatches([{ op: "add", id: row.entryId, entry: cleared, guard: "absent" }]);
+                    if (add.conflicts.length > 0) {
+                        fail("memory.origin_clear_failed", `the re-record leg was refused (${(add.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — the row stays PENDING with the cleared bytes in its custody (entryText); call clearEntryOrigin again to resume.`, true);
+                    }
+                    landedSlug = add.applied.find((a) => a.id === row.entryId)?.slug ?? row.slug;
+                    detail = `cleared and re-recorded at slug ${JSON.stringify(landedSlug)} (tombstone raced by a concurrent resumer)`;
+                }
+                else {
+                    landedSlug = reprobe.slug;
+                    detail = reprobe.rev === cleared.rev ? "already complete (raced by a concurrent resumer)" : "marker already absent (a later committed generation stands; custody retained on this row)";
+                }
+            }
+            else {
+                const add = await this.backend.applyPatches([{ op: "add", id: row.entryId, entry: cleared, guard: "absent" }]);
+                if (add.conflicts.length > 0) {
+                    fail("memory.origin_clear_failed", `the re-record leg was refused (${(add.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — the row stays PENDING with the cleared bytes in its custody (entryText); call clearEntryOrigin again to resume.`, true);
+                }
+                landedSlug = add.applied.find((a) => a.id === row.entryId)?.slug ?? row.slug;
+                detail = `cleared and re-recorded at slug ${JSON.stringify(landedSlug)}`;
+            }
+        }
+        else if (current === undefined) {
+            const add = await this.backend.applyPatches([{ op: "add", id: row.entryId, entry: cleared, guard: "absent" }]);
+            if (add.conflicts.length > 0) {
+                fail("memory.origin_clear_failed", `the resumed re-record leg was refused (${(add.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — the row stays PENDING with the cleared bytes in its custody (entryText); call clearEntryOrigin again to resume.`, true);
+            }
+            landedSlug = add.applied.find((a) => a.id === row.entryId)?.slug ?? row.slug;
+            detail = `resumed after interruption: re-recorded at slug ${JSON.stringify(landedSlug)}`;
+        }
+        else {
+            landedSlug = current.slug;
+            detail = current.rev === cleared.rev ? "already complete (terminal event replay)" : "marker already absent (a later committed generation stands; custody retained on this row)";
+        }
+        settleOriginClearance(this.controlDir, { clearanceId: row.clearanceId, to: "done", requestId, eventId: uuidv7(), now: this.now, detail });
+        try {
+            enqueueMemoryAnnouncement(this.controlDir, {
+                kind: "gate",
+                at: this.now(),
+                items: [`memory entry ${inlineUntrusted(row.entryId, 80)} external-origin marker CLEARED by host request ${JSON.stringify(inlineUntrusted(requestId, 80))} — re-recorded unmarked (${inlineUntrusted(detail, 160)})`],
+            });
+        }
+        catch (err) {
+            this.discloseAnnounceFailure("origin-clearance enqueue", err);
+        }
+        return { entryId: row.entryId, clearanceId: row.clearanceId, origin: row.origin, landedSlug };
+    }
     async rebaseline(handle, keepBaseline = new Set()) {
         const writeScope = handle.writeScope;
         if (writeScope === null)
@@ -1697,6 +2340,9 @@ export class MemoryEngine {
         const nextIndexRevs = {};
         const expected = new Map();
         const excludedTargets = new Set();
+        const carryIndex = this.provenance === "carry";
+        const exposedById = new Map();
+        const exposedProjectionTargets = new Set();
         for (const h of headers) {
             const repoTarget = handle.repoIndexTargets?.get(h.id);
             const target = repoTarget ?? relative(handle.writableRoot, canonicalize(join(scopeDirFor(this.memoryDir, this.controlDir, h.scope), `${h.slug}.md`)));
@@ -1704,12 +2350,46 @@ export class MemoryEngine {
                 excludedTargets.add(target);
                 continue;
             }
+            if (carryIndex && h.exposure === "external") {
+                exposedById.set(h.id, h);
+                exposedProjectionTargets.add(target);
+                continue;
+            }
             expected.set(target, h);
         }
         const covered = new Set();
+        const handleCovered = new Set();
         const keptByTarget = new Map();
         const keptLines = [];
         for (const line of existing.split("\n")) {
+            if (carryIndex) {
+                const handleId = parseMemoryExposureIndexRow(line);
+                if (handleId !== undefined) {
+                    if (exposedById.has(handleId) && !handleCovered.has(handleId) && line === memoryExposureIndexRow(handleId)) {
+                        handleCovered.add(handleId);
+                        keptLines.push(line);
+                    }
+                    continue;
+                }
+            }
+            if (carryIndex && exposedProjectionTargets.size > 0) {
+                const foldDots = (s) => {
+                    let prev = s;
+                    for (let i = 0; i < 32; i++) {
+                        const next = prev.replace(/\/(?:\.\/)+/g, "/").replace(/(?:^|[/\s(])(?:[^/\s()]+\/\.\.\/)+/g, (m) => (/^[/\s(]/.test(m) ? m[0] : ""));
+                        if (next === prev)
+                            return next;
+                        prev = next;
+                    }
+                    return prev;
+                };
+                const folded = foldDots(line.toLowerCase());
+                const hit = [...exposedProjectionTargets].find((t) => folded.includes(t.toLowerCase()));
+                if (hit !== undefined) {
+                    warnings?.push(`MEMORY.md index line naming ${hit} replaced by its opaque external-origin handle (the entry stays readable via memory_get)`);
+                    continue;
+                }
+            }
             const target = indexLineTarget(line);
             if (target === undefined) {
                 if (line.trim() !== "" || keptLines[keptLines.length - 1]?.trim() !== "")
@@ -1758,6 +2438,10 @@ export class MemoryEngine {
             keptLines.push(`- [${title}](${target})${hook} (${age})`);
             nextIndexRevs[target] = h.rev;
         }
+        for (const id of exposedById.keys()) {
+            if (!handleCovered.has(id))
+                keptLines.push(memoryExposureIndexRow(id));
+        }
         while (keptLines.length > 0 && keptLines[keptLines.length - 1].trim() === "")
             keptLines.pop();
         const text = keptLines.length > 0 ? `${keptLines.join("\n")}\n` : "";
@@ -2029,7 +2713,7 @@ function indexLineTarget(line) {
     return m?.[1];
 }
 function countIndexLines(text) {
-    return text.split("\n").filter((l) => indexLineTarget(l) !== undefined).length;
+    return text.split("\n").filter((l) => indexLineTarget(l) !== undefined || parseMemoryExposureIndexRow(l) !== undefined).length;
 }
 function revOfText(text, id) {
     const parsed = parseEntryFile(text);