@sema-agent/core 5.48.0 → 5.49.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 5.49.0 — 2026-08-20
+
+### Added
+- **`Runner.swapModels({models, tiers?})`** — the model-catalog hot-generation seat: switching
+  models is now a zero-restart operation. Atomic (the candidate is tier-expanded and validated
+  first; a failed swap leaves the current generation byte-identical); in-flight tasks finish on
+  their prepare-resolved models (natural snapshot — documented divergence window = exactly the
+  in-flight lifetime); `tiers` omitted keeps current bindings re-applied over the new models.
+  Announced via `config.models_swapped` (key counts only). Consumers: a deployment that deferred
+  model-catalog changes to a process restart can retire that arm.
+- design/337 (escalation/advisor mode) — the strategy repository becomes real cross-session
+  infrastructure:
+  - **`FileStrategyStore`** (persistence twin; per-strategy files under hashed scope dirs, atomic
+    writes, corrupt-entry quarantine, read-side hardening incl. symlink refusal and byte-bounded
+    reads) aggregated as `FileStorageBackend.strategyStore`.
+  - **CJK retrieval fixed**: term extraction shares the memory tokenizer (alnum runs + CJK
+    bigrams/unigrams) — a pure-CJK strategy was stored but never retrievable; old hits preserved
+    via a legacy acceptance arm.
+  - `TeacherRunResult.strategiesInjected` (id-level injection audit); store faults contained
+    (an optimization's failure no longer kills the run; disclosed via
+    `TeacherConfig.onStrategyStoreIncident`); injected strategies ride inside the untrusted
+    fence; write-side validation doors (`strategy.entry_invalid`); `seedStrategies` two-phase
+    batch install. Export surface +7, additive.
+- Conformance clause 31: an AMBIGUOUS origin representation (disagreeing carriers) is refused on
+  add and update by every backend; agreeing multi-carrier shapes stay legal (the refusal keys on
+  disagreement — serialization closure). The bundled File backend already refused; the clause is
+  the machine face proving all backends answer alike, and it caught the reference template
+  lacking the refusal the moment it landed (template fixed in the same commit).
+
+### Fixed
+- A 13-finding memory-engine hardening batch (post-release scan of the 5.47 window; all
+  externally disclosed):
+  - **Dual-root deployments regain the hold-notice family**: `mergeHarvestReports` now merges
+    `HarvestReport.containment` (booleans OR, lists concatenated) — under a two-plane scope
+    contract the entire `memory.hold_*` family and the index-rollback announce arm were
+    structurally unreachable.
+  - Hold lifecycle: a refused instruction intake finalizes its row (no resurrection by
+    reconciliation); a failed expired-hold release announces once and consumes its verdict
+    (generation-keyed — no infinite re-fire); disposal reporting rides the one signal path.
+  - Origin clearance: a foreign deletion is no longer read as "our tombstone committed"
+    (`tombstonedAt` sidecar; bare absence refuses with custody retained); a concurrent on-disk
+    edit is not overwritten by the clearance re-record (divergence guard, byte-equality
+    exemption for pristine projections); a challenged entry cannot be washed through the resume
+    path.
+  - Read side: the recall-taint judge accepts the Read tool's `path` argument spelling; the
+    marked-projection index drop judges path tokens per occurrence (an innocent clean entry
+    whose name merely contains a marked path no longer over-drops); a read-only plane under
+    carry injects the treated index text; index-drop rewrites are announced when they land.
+  - The opaque handle/search rows no longer carry a model-authored entry id verbatim (digest
+    re-mint on marked commits; the passive-face zero-model-text contract now holds).
+  - `memory_search`'s header states band order truthfully on mixed-band pages (single-band and
+    off pages byte-identical).
+- The transcript-integrity notice keys its once-latch by (scope, handle) and carries `scope` in
+  the detail — multi-tenant attribution without reverse lookup.
+
+### Notes
+- Behavior narrowings (all refusals in existing coded families, disclosed): clearEntryOrigin
+  gains three refusals (divergence / bare-absence / challenged-resume); marked adds do not adopt
+  model-supplied ids; a failed expired-hold release stops re-firing after one loud announcement;
+  refused intakes finalize. Two optional sidecar row members (`OriginClearanceRow.tombstonedAt`,
+  `HoldRow.resolvedAt`) — strict coercers accept old rows. No BREAKING changes; no export
+  removals.
+
 ## 5.48.0 — 2026-08-20
 
 ### Added

package/dist/agents/agent-transcript-tool.d.ts

@@ -31,7 +31,7 @@ export interface AgentTranscriptToolOptions {
     /** Subagent transcript persistence — the declared-durability integrity-gap disclosure sink (see
      *  the SendMessage twin): a durable row with a bound sessionId whose session store attests
      *  not_found. Announced once per (handle, process); absent ⇒ the honest per-call degrade alone. */
-    onTranscriptIntegrityGap?: (handle: string) => void;
+    onTranscriptIntegrityGap?: (handle: string, scope: string | undefined) => void;
 }
 /**
  * Residual observability (lane C) — build the MODEL-VISIBLE **AgentTranscript** tool: read the last N tool steps of a

package/dist/agents/agent-transcript-tool.js

@@ -64,7 +64,7 @@ export function createAgentTranscriptTool(opts) {
                 }
                 catch (e) {
                     if (e?.code === "not_found") {
-                        announceTranscriptIntegrityGapOnce(id, opts.onTranscriptIntegrityGap);
+                        announceTranscriptIntegrityGapOnce(id, access.scope, opts.onTranscriptIntegrityGap);
                     }
                     return undefined;
                 }

package/dist/agents/send-message-tool.d.ts

@@ -128,12 +128,12 @@ export interface SendMessageToolOptions {
     uplinkRecipient?: PeerSelfRef;
     /**
      * Subagent transcript persistence — the "declared durability contradicted by reality" disclosure
-     * sink: called (at most once per handle per process, {@link announceTranscriptIntegrityGapOnce})
+     * sink: called (at most once per (scope, handle) per process, {@link announceTranscriptIntegrityGapOnce})
      * when a durable row with a bound sessionId meets a session store that attests `not_found`. The
      * first-party mount wires an EngineNotice (`delegation.transcript_integrity`); absent ⇒ the
      * per-call honest refusal is the only loudness (unchanged behavior).
      */
-    onTranscriptIntegrityGap?: (handle: string) => void;
+    onTranscriptIntegrityGap?: (handle: string, scope: string | undefined) => void;
 }
 /** RB-382 — max chars of the `summary` arg (the short recap label, distinct from `message`'s much
  *  larger {@link UPLINK_RESULT_MAX}) before ITS OWN truncation. Exported for direct unit-testing only

package/dist/agents/send-message-tool.js

@@ -292,7 +292,7 @@ export function createSendMessageTool(opts) {
                         catch (e) {
                             await rollbackDrain();
                             if (e?.code === "not_found") {
-                                announceTranscriptIntegrityGapOnce(handle, opts.onTranscriptIntegrityGap);
+                                announceTranscriptIntegrityGapOnce(handle, scope, opts.onTranscriptIntegrityGap);
                                 return queueFullReceipt(`No transcript found for agent ${handle}, so a revival cannot drain the backlog.`);
                             }
                             return queueFullReceipt(`Its transcript store did not answer (${e instanceof Error ? e.message : String(e)}) — this send did not start a backlog drain; a later resend will try again.`);
@@ -391,7 +391,7 @@ export function createSendMessageTool(opts) {
                     catch (e) {
                         await rollback();
                         if (e?.code === "not_found") {
-                            announceTranscriptIntegrityGapOnce(handle, opts.onTranscriptIntegrityGap);
+                            announceTranscriptIntegrityGapOnce(handle, scope, opts.onTranscriptIntegrityGap);
                             return {
                                 content: `Message not sent: no transcript found for agent ${handle} — it cannot be revived. Launch a new agent with the needed context instead.`,
                                 details: { error: "resume.session_not_found", to },

package/dist/agents/teacher.d.ts

@@ -1,5 +1,5 @@
 import type { Runner } from "../core/runner/runtask.js";
-import type { StrategyStore } from "../core/strategy-store.js";
+import { type StrategyOrigin, type StrategyStore, type StrategyStoreIncident } from "../core/strategy-store.js";
 import type { ModelRef, TaskResult, TaskSpec } from "../core/types.js";
 /**
  * Teacher mode (escalation cascade): a cheap "student" does the work; a strong "teacher" is consulted
@@ -85,6 +85,17 @@ export interface TeacherConfig {
     minConfidenceToStore?: number;
     /** Inject retrieved strategies into the objective. Default true when a store+scope are set. */
     injectStrategies?: boolean;
+    /**
+     * Disclosure sink for a strategy-store failure this loop CONTAINED (store-fault containment): a
+     * `find` that failed injects nothing, a `save` that failed stores nothing — neither ever fails the
+     * task (the repository is an optimization; an optimization's fault must not kill the work it was
+     * optimizing) — but each is disclosed here so a broken store is discoverable. The one exception
+     * stays loud: an error carrying a `config.`-prefixed code (an illegal `retrieveK` etc.) is a
+     * PROGRAMMER error and rethrows — containing it would silence the validation door entirely.
+     * Callback faults are themselves contained (safe-notify posture); absent ⇒ `console.warn`, once
+     * per op kind.
+     */
+    onStrategyStoreIncident?: (i: StrategyStoreIncident) => void;
 }
 export type EscalationTrigger = "stuck" | "blocked" | "failed" | "verify-fail";
 export interface TeacherAdvice {
@@ -105,6 +116,19 @@ export interface EscalationRecord {
 export interface TeacherRunResult extends TaskResult {
     /** Escalations that occurred during this run (empty if the student succeeded alone). */
     escalations: EscalationRecord[];
+    /**
+     * Audit trail of the strategies retrieved into the student's objective for THIS run — id-level (the
+     * text is not copied; the id is the join key into the store), with each entry's stored timestamp and
+     * provenance stamp. Lets a host connect "what was injected" to "how the run ended" offline, which is
+     * the only way retrieval-induced degradation is ever measurable. PRESENT iff ≥1 strategy was
+     * injected; ABSENT means no store was configured, injection was disabled, retrieval matched nothing,
+     * or the find failed (a failure additionally raises `onStrategyStoreIncident`).
+     */
+    strategiesInjected?: Array<{
+        id: string;
+        ts: string;
+        origin?: StrategyOrigin;
+    }>;
     /** Usage spent on the teacher (advisor), separate from the student's `stats` (which includes the
      *  cheap helper monitor/verifier calls). `tasks` = teacher runs (escalation asks + any takeover).
      *  `humanReview` = the HITL-gate burden of the teacher's runs (notably a takeover that hit an approval

package/dist/agents/teacher.js

@@ -1,4 +1,6 @@
 import { randomUUID } from "node:crypto";
+import { MAX_STRATEGY_INJECTION_TOTAL_BYTES, MAX_STRATEGY_PROBLEM_BYTES, MAX_STRATEGY_TEXT_BYTES } from "../core/strategy-store.js";
+import { createSafeNotifier, observeThenableRejection } from "../core/safe-notify.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { isDefineToolProduct, stampDefineToolBrand } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
@@ -46,31 +48,102 @@ export function parseTeacherAdvice(text) {
 export async function runWithTeacher(runner, studentSpec, teacher = {}) {
     const store = teacher.strategyStore;
     const scope = teacher.scope;
+    const incidentNotifier = createSafeNotifier();
+    const warnedIncidentOps = new Set();
+    const discloseStoreIncident = (i) => {
+        const seat = teacher.onStrategyStoreIncident;
+        if (seat) {
+            const site = `teacher.onStrategyStoreIncident.${i.op}`;
+            incidentNotifier.notify(() => observeThenableRejection(seat(i), incidentNotifier, site), site);
+        }
+        else if (!warnedIncidentOps.has(i.op)) {
+            warnedIncidentOps.add(i.op);
+            console.warn(`runWithTeacher: strategy store ${i.op} failed (contained — the run continues): ${i.error}`);
+        }
+    };
+    const isConfigCoded = (e) => typeof e?.code === "string" && (e.code).startsWith("config.");
     let spec = studentSpec;
+    let injected;
     if (store && scope && teacher.injectStrategies !== false) {
-        const found = await store.find(scope, studentSpec.objective, teacher.retrieveK ?? 3);
+        let found = [];
+        try {
+            const raw = await store.find(scope, studentSpec.objective, teacher.retrieveK ?? 3);
+            if (!Array.isArray(raw)) {
+                discloseStoreIncident({ op: "find", error: "store.find returned a non-array result — injecting nothing" });
+            }
+            else {
+                let dropped = 0;
+                for (const e of raw) {
+                    const c = e;
+                    const id = c?.id;
+                    const ts = c?.ts;
+                    const strategy = c?.strategy;
+                    if (typeof id !== "string" || typeof ts !== "string" || typeof strategy !== "string") {
+                        dropped++;
+                        continue;
+                    }
+                    const origin = c?.origin;
+                    found.push({ id, ts, strategy, ...(origin === "earned" || origin === "seeded" ? { origin } : {}) });
+                }
+                if (dropped > 0) {
+                    discloseStoreIncident({ op: "find", error: `${dropped} malformed retrieval entries dropped (id/ts/strategy must be strings)` });
+                }
+            }
+        }
+        catch (e) {
+            if (isConfigCoded(e))
+                throw e;
+            discloseStoreIncident({ op: "find", error: String(e?.message ?? e) });
+            found = [];
+        }
+        let budget = 0;
+        for (let i = 0; i < found.length; i++) {
+            budget += Buffer.byteLength(found[i].strategy, "utf8");
+            if (budget > MAX_STRATEGY_INJECTION_TOTAL_BYTES) {
+                discloseStoreIncident({
+                    op: "find",
+                    error: `injection truncated to ${i} of ${found.length} retrieved strategies — combined text exceeded ${MAX_STRATEGY_INJECTION_TOTAL_BYTES} bytes`,
+                });
+                found = found.slice(0, i);
+                break;
+            }
+        }
         if (found.length > 0) {
             const block = `[STRATEGIES from PAST, DIFFERENT tasks — they may NOT apply. If unsure, IGNORE them and proceed normally.]\n` +
-                found.map((s) => `- ${s.strategy}`).join("\n");
+                delimitUntrusted("PAST STRATEGIES (from DIFFERENT tasks; may NOT apply — verify before use)", found.map((s) => `- ${s.strategy}`).join("\n"));
             spec = { ...studentSpec, objective: `${block}\n\n${studentSpec.objective}` };
+            injected = found.map((s) => ({ id: s.id, ts: s.ts, ...(s.origin !== undefined ? { origin: s.origin } : {}) }));
         }
     }
     const result = await runTeacherCore(runner, spec, teacher);
     if (store && scope && result.status === "completed" && result.escalations.length > 0) {
         const advice = result.escalations[result.escalations.length - 1].teacher;
         if (advice.strategy && advice.confidence >= (teacher.minConfidenceToStore ?? 2)) {
-            await store.save({
-                id: randomUUID(),
-                problem: studentSpec.objective,
-                strategy: advice.strategy,
-                confidence: advice.confidence,
-                scope,
-                ts: new Date().toISOString(),
-                teacherModel: typeof teacher.model === "string" ? teacher.model : teacher.model?.id,
-            });
+            try {
+                const clip = (text, maxBytes) => {
+                    let out = text;
+                    while (Buffer.byteLength(out) > maxBytes)
+                        out = out.slice(0, -1);
+                    return out;
+                };
+                await store.save({
+                    id: randomUUID(),
+                    problem: clip(studentSpec.objective, MAX_STRATEGY_PROBLEM_BYTES),
+                    strategy: clip(advice.strategy, MAX_STRATEGY_TEXT_BYTES),
+                    confidence: Math.min(3, Math.max(0, advice.confidence)),
+                    scope,
+                    ts: new Date().toISOString(),
+                    teacherModel: typeof teacher.model === "string" ? teacher.model : teacher.model?.id,
+                });
+            }
+            catch (e) {
+                if (isConfigCoded(e))
+                    throw e;
+                discloseStoreIncident({ op: "save", error: String(e?.message ?? e) });
+            }
         }
     }
-    return result;
+    return injected !== undefined && injected.length > 0 ? { ...result, strategiesInjected: injected } : result;
 }
 async function runTeacherCore(runner, studentSpec, teacher) {
     const maxEscalations = teacher.maxEscalations ?? 3;

package/dist/core/background-agent-store.d.ts

@@ -170,7 +170,7 @@ export interface BackgroundAgentRecord {
 export declare const REVIVED_ROW_CLEARED_FIELDS: readonly ["settledAt", "stoppedBy", "completionId", "finalOutput", "finalOutputFull", "error", "errorCode", "errorRetryable", "errorKind", "errorRetryAfterMs", "resultIsPartial", "summary", "recentSteps", "editedFiles", "usage"];
 /** Erase {@link REVIVED_ROW_CLEARED_FIELDS} from a record a revival is about to write back. */
 export declare function clearRevivedRowTerminalPayload(record: BackgroundAgentRecord): void;
-export declare function announceTranscriptIntegrityGapOnce(handle: string, sink: ((handle: string) => void) | undefined): void;
+export declare function announceTranscriptIntegrityGapOnce(handle: string, scope: string | undefined, sink: ((handle: string, scope: string | undefined) => void) | undefined): void;
 /** Content-free projection for list reads (design/151 HIGH-1: `summary`/`finalOutput`/`recentSteps`
  *  and friends NEVER ride a list — content is get-by-handle only, behind the full predicate). */
 export interface BackgroundAgentRowSummary {

package/dist/core/background-agent-store.js

@@ -22,14 +22,15 @@ export function clearRevivedRowTerminalPayload(record) {
         delete record[field];
 }
 const transcriptIntegrityAnnounced = new Set();
-export function announceTranscriptIntegrityGapOnce(handle, sink) {
+export function announceTranscriptIntegrityGapOnce(handle, scope, sink) {
     if (sink === undefined)
         return;
-    if (transcriptIntegrityAnnounced.has(handle))
+    const key = `${scope ?? ""}\u0000${handle}`;
+    if (transcriptIntegrityAnnounced.has(key))
         return;
-    transcriptIntegrityAnnounced.add(handle);
+    transcriptIntegrityAnnounced.add(key);
     try {
-        sink(handle);
+        sink(handle, scope);
     }
     catch {
     }

package/dist/core/memory-engine/delegation-settlement.d.ts

@@ -221,6 +221,11 @@ export interface HoldRow {
     };
     /** Host valve verdict awaiting the next harvest ("release" commits with cause "static"). */
     resolved?: "release" | "discard";
+    /** The verdict's GENERATION (strictly increases on every re-resolution): the settle leg's
+     *  consumed-verdict exit clears only the exact generation it read, so a host re-resolution
+     *  racing a failing release attempt is never erased by the stale attempt's cleanup. Absent on
+     *  rows resolved before the member existed (a generation-less clear matches those). */
+    resolvedAt?: number;
 }
 export declare function readHolds(controlDir: string): HoldRow[];
 /** ATOMIC no-replace restore of a staged file onto a plane path (adversarial round 2: an
@@ -308,6 +313,28 @@ export declare function resolveHoldRecord(controlDir: string, input: {
     requestId: string;
     now: () => number;
 }): void;
+/**
+ * Consume a standing valve verdict WITHOUT any other transition — the settle leg's exit for a
+ * valve release that FAILED on an already-disposed row (an expired hold whose release hit a
+ * judgment refusal: lost custody, re-scan refusal, CAS conflict). `disposeHold` is a no-op there
+ * (the row is already terminal), so leaving `resolved` standing would re-run the identical failing
+ * release — and re-announce a disposal that never happened — on every subsequent harvest, forever.
+ * Clearing it returns the row to its plain disposed/expired state: the failure is disclosed by the
+ * caller, custody/quarantine bytes stay addressable, and `resolveHold(holdId, "release")` remains
+ * admissible after the host reconciles. GENERATION-KEYED: only the exact verdict generation the
+ * caller read is cleared — a host re-resolution that landed while the failing attempt was in
+ * flight is a NEWER generation and stands (the stale attempt's cleanup must not erase a live host
+ * action). A generation-less verdict (a row written before the member existed) is consumable
+ * against a generation-less read — every CURRENT writer mints a generation, so the only verdict
+ * such a clear can erase is one written by a PRE-generation writer racing on the same control
+ * plane: the standing mixed-version-writer class the upgrade-order duty prices, kept consumable
+ * on purpose (refusing it would revive the forever-re-firing valve loop for every verdict minted
+ * before the upgrade). Idempotent; unknown/verdict-less/other-generation rows are a no-op.
+ */
+export declare function clearHoldResolution(controlDir: string, input: {
+    holdId: string;
+    ifResolvedAt: number | undefined;
+}): void;
 /** Read one hold's custody bytes (release leg + expired-release valve). Returns undefined when
  *  the custody file is gone or fails its digest — the caller records capture_lost, never commits
  *  unverified bytes. For an expired-released row the bytes may already sit in quarantine

package/dist/core/memory-engine/delegation-settlement.js

@@ -346,6 +346,7 @@ function coerceHolds(raw) {
             !HOLD_STATUSES.has(row.status) ||
             (row.disposition !== undefined && (typeof row.disposition !== "object" || row.disposition === null || !HOLD_TERMINALS.has(row.disposition.terminal) || (row.disposition.quarantineName !== undefined && !safeBasename(row.disposition.quarantineName)))) ||
             (row.resolved !== undefined && row.resolved !== "release" && row.resolved !== "discard") ||
+            (row.resolvedAt !== undefined && (typeof row.resolvedAt !== "number" || !Number.isSafeInteger(row.resolvedAt) || row.resolvedAt < 0 || row.resolvedAt >= 2 ** 50 || row.resolved === undefined)) ||
             (row.entryId !== undefined && typeof row.entryId !== "string") ||
             (row.baseRev !== undefined && typeof row.baseRev !== "string") ||
             (row.op === "update" && (!reqStr(row.entryId) || !reqStr(row.baseRev))) ||
@@ -401,6 +402,14 @@ export function openInstructionHold(controlDir, input) {
     const digest = sha256(buf);
     const captureName = `${holdId}.md`;
     const holdDir = join(controlDir, HOLD_DIR);
+    const refuse = (reason, terminal) => {
+        try {
+            disposeHold(controlDir, { holdId, terminal, now: input.now });
+        }
+        catch {
+        }
+        return { ok: false, holdId, reason };
+    };
     try {
         lockedStrictUpdate(controlDir, HOLDS_FILE, "memory instruction-hold ledger", coerceHolds, (rec) => {
             if (rec.rows.some((r) => r.holdId === holdId))
@@ -431,10 +440,10 @@ export function openInstructionHold(controlDir, input) {
         writeFileSync(join(holdDir, captureName), buf, { flag: "wx" });
         const back = readFileSync(join(holdDir, captureName));
         if (sha256(back) !== digest)
-            return { ok: false, holdId, reason: "hold capture verification failed (written bytes do not hash to the captured digest)" };
+            return refuse("hold capture verification failed (written bytes do not hash to the captured digest)", "capture_lost");
     }
     catch (err) {
-        return { ok: false, holdId, reason: `hold capture failed: ${err instanceof Error ? err.message : String(err)}` };
+        return refuse(`hold capture failed: ${err instanceof Error ? err.message : String(err)}`, "capture_lost");
     }
     const stagingName = uniqueStagingName(holdId, input.now);
     const stagingPath = join(holdDir, stagingName);
@@ -447,7 +456,7 @@ export function openInstructionHold(controlDir, input) {
         if (code === "ENOENT") {
         }
         else {
-            return { ok: false, holdId, reason: `hold removal failed (${code ?? "rename error"}): the plane file was not moved` };
+            return refuse(`hold removal failed (${code ?? "rename error"}): the plane file was not moved`, "discarded");
         }
     }
     if (existsSync(stagingPath)) {
@@ -475,7 +484,7 @@ export function openInstructionHold(controlDir, input) {
         });
     }
     catch (err) {
-        return { ok: false, holdId, reason: `hold ledger flip refused: ${err instanceof Error ? err.message : String(err)}` };
+        return refuse(`hold ledger flip refused: ${err instanceof Error ? err.message : String(err)}`, "discarded");
     }
     return { ok: true, holdId, ...(thirdWriterStranded !== undefined ? { thirdWriterStranded } : {}) };
 }
@@ -604,6 +613,7 @@ export function markHoldReleased(controlDir, input) {
             return { result: undefined };
         r.status = "released";
         delete r.resolved;
+        delete r.resolvedAt;
         return { next: rec, result: r.captureName };
     });
     if (captureName === undefined)
@@ -638,6 +648,23 @@ export function resolveHoldRecord(controlDir, input) {
             throw e;
         }
         r.resolved = input.action;
+        const nextGeneration = Math.max(input.now(), 0, (r.resolvedAt ?? 0) + 1);
+        if (!Number.isSafeInteger(nextGeneration) || nextGeneration < 0 || nextGeneration >= 2 ** 50) {
+            const e = new Error(`resolveHold: hold ${JSON.stringify(input.holdId)} cannot mint a fresh verdict generation (${String(nextGeneration)} — an exhausted window, a deranged clock, or a corrupt ledger row) — refused, never written.`);
+            e.code = "memory.hold_resolve_invalid_state";
+            throw e;
+        }
+        r.resolvedAt = nextGeneration;
+        return { next: rec, result: undefined };
+    });
+}
+export function clearHoldResolution(controlDir, input) {
+    lockedStrictUpdate(controlDir, HOLDS_FILE, "memory instruction-hold ledger", coerceHolds, (rec) => {
+        const r = rec.rows.find((x) => x.holdId === input.holdId);
+        if (r === undefined || r.resolved === undefined || r.resolvedAt !== input.ifResolvedAt)
+            return { result: undefined };
+        delete r.resolved;
+        delete r.resolvedAt;
         return { next: rec, result: undefined };
     });
 }

package/dist/core/memory-engine/dual-root.js

@@ -75,5 +75,16 @@ export function mergeHarvestReports(a, b) {
     const qf = [...(a.quarantineFailures ?? []), ...(b.quarantineFailures ?? [])];
     if (qf.length > 0)
         merged.quarantineFailures = qf;
+    const ac = a.containment;
+    const bc = b.containment;
+    if (ac !== undefined || bc !== undefined) {
+        merged.containment = {
+            indexRolledBack: ac?.indexRolledBack === true || bc?.indexRolledBack === true,
+            quarantinedInstruction: [...(ac?.quarantinedInstruction ?? []), ...(bc?.quarantinedInstruction ?? [])],
+            heldInstruction: [...(ac?.heldInstruction ?? []), ...(bc?.heldInstruction ?? [])],
+            releasedHolds: [...(ac?.releasedHolds ?? []), ...(bc?.releasedHolds ?? [])],
+            disposedHolds: [...(ac?.disposedHolds ?? []), ...(bc?.disposedHolds ?? [])],
+        };
+    }
     return merged;
 }

package/dist/core/memory-engine/engine.d.ts

@@ -803,7 +803,12 @@ export declare class MemoryEngine {
      * and a re-call RESUMES it idempotently. Refusals (#123 coded, caller-shape):
      * unattributed/invalid input, unknown/unmarked entry, and a CHALLENGED entry — the clear valve
      * is not a challenge exit (adjudicate the challenge first; clearing a challenged entry would
-     * launder the exclusion through the weaker credential).
+     * launder the exclusion through the weaker credential); the challenged refusal re-judges on the
+     * RESUME path too while the marked entry stands. Two effect-half refusals (terminal, both
+     * states untouched): an on-disk projection diverging from the committed state (the clear never
+     * overwrites unadopted plane bytes — adopt/reconcile first), and a resumed row whose entry is
+     * ABSENT without a recorded committed tombstone (that absence is an independent deletion the
+     * clear never resurrects; the custody bytes stay disclosed on the terminal row).
      */
     clearEntryOrigin(entryId: string, input: {
         requestId: string;