@sema-agent/core 5.48.0 → 5.50.0

package/dist/core/memory-engine/engine.js

@@ -9,12 +9,12 @@ import { formatMemoryAge } from "../memory-recall.js";
 import { committedOriginOf, computeEntryRev, hasOriginFormExtra, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenOrigin } from "./frontmatter.js";
 import { MEMORY_PROVENANCE_RECALL_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow } from "./provenance-wording.js";
 import { isInstructionEntry } from "./header-hints.js";
-import { classifySessionSettlements, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, } from "./delegation-settlement.js";
+import { classifySessionSettlements, clearHoldResolution, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, } from "./delegation-settlement.js";
 import { noReplaceRestore } from "./delegation-settlement.js";
-import { openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
+import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
-import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, readIndexRevs, writeIndexRevs, bumpScanFuse, canonicalize, claimRootScope, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, isContainedIn, markSessionPolluted, readSessionPollution, recordRetrievedAccount, writeFileNoFollow, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, resolveChallengeEvent, stageLineagePending, } from "./layout.js";
+import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, readIndexRevs, writeIndexRevs, bumpScanFuse, canonicalize, claimRootScope, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, isContainedIn, markSessionPolluted, readSessionPollution, recordRetrievedAccount, writeFileNoFollow, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
 import { scanMemoryFileName, scanMemoryWrite, scanRemediation } from "./scan.js";
 export const MEMORY_INSTRUCTION_TEMPLATE = `# Memory
 
@@ -876,6 +876,8 @@ export class MemoryEngine {
                             this.discloseSessionAccountIncident("the committed snapshot was contended/incomplete — the id-bearing residue arm is degraded to id-less for this materialize", undefined);
                         }
                     }
+                    const debtByRel = new Map(readProjectionDebts(this.controlDir).map((r) => [r.relPath, r.entryId]));
+                    const canonicalMemoryDir = canonicalize(this.memoryDir);
                     for (const f of scanEntryFiles(wroot, { maxDepth: this.maxDepth })) {
                         const canonical = canonicalize(f.path);
                         if (canonical !== wroot && !canonical.startsWith(`${wroot}${sep}`))
@@ -883,11 +885,20 @@ export class MemoryEngine {
                         const text = readSafe(canonical);
                         if (text === undefined)
                             continue;
-                        const rel = relative(this.memoryDir, canonical);
+                        const rel = relative(canonicalMemoryDir, canonical);
                         if (rel === MEMORY_INDEX_FILENAME || rel.endsWith(`${sep}${MEMORY_INDEX_FILENAME}`))
                             continue;
                         const parsed = parseEntryFile(text);
-                        const uncommitted = parsed.id === undefined || (committedRevs !== undefined && !committedRevs.has(parsed.id));
+                        const debtEntryId = parsed.id === undefined ? debtByRel.get(relative(canonicalMemoryDir, canonical)) : undefined;
+                        let debtAttributed = false;
+                        if (debtEntryId !== undefined) {
+                            const proj = await this.debtCommittedProjection(debtEntryId);
+                            if (proj.state === "unknown") {
+                                throw new Error(`the committed state for debt-bound file ${rel} could not be read during crash-residue attribution — refusing to classify on a fault`);
+                            }
+                            debtAttributed = proj.state === "valid" && proj.scope === writeScope && proj.slug === f.slug;
+                        }
+                        const uncommitted = (parsed.id === undefined && !debtAttributed) || (parsed.id !== undefined && committedRevs !== undefined && !committedRevs.has(parsed.id));
                         if (uncommitted) {
                             unattributed.push(rel);
                             continue;
@@ -1029,6 +1040,20 @@ export class MemoryEngine {
                 handle.baseIds.set(path, entry.id);
             }
         }
+        {
+            const debts = readProjectionDebts(this.controlDir);
+            if (debts.length > 0) {
+                const projectedIdByRel = new Map(handle.materialized.filter((m) => !m.stub).map((m) => [m.relPath, m.id]));
+                const healed = debts.filter((r) => projectedIdByRel.get(r.relPath) === r.entryId).map((r) => ({ relPath: r.relPath, entryId: r.entryId }));
+                if (healed.length > 0) {
+                    try {
+                        settleProjectionDebts(this.controlDir, healed);
+                    }
+                    catch {
+                    }
+                }
+            }
+        }
         const indexGate = this.gateDerivedIndex(handle);
         if (indexGate !== undefined) {
             if (!indexGate.contained)
@@ -1044,9 +1069,22 @@ export class MemoryEngine {
                 this.discloseAnnounceFailure("index-gate enqueue", err);
             }
         }
-        const indexText = this.rebuildIndex(handle, headers, { write: writeScope !== null && !restricted, ignoreOnDisk: indexGate !== undefined || restricted });
+        const materializeHealWarnings = [];
+        const indexWrite = writeScope !== null && !restricted;
+        const indexText = this.rebuildIndex(handle, headers, { write: indexWrite, ignoreOnDisk: indexGate !== undefined || restricted }, materializeHealWarnings);
         handle.indexBaselineLines = countIndexLines(indexText);
         handle.indexText = indexText;
+        if (indexWrite && handle.indexOnDiskUntrusted !== true) {
+            const dropNotes = materializeHealWarnings.filter((w) => w.includes("opaque external-origin handle"));
+            if (dropNotes.length > 0) {
+                try {
+                    enqueueMemoryAnnouncement(this.controlDir, { kind: "gate", at: this.now(), items: capItems(dropNotes.map((w) => `index note: ${inlineUntrusted(w, 200)}`)) });
+                }
+                catch (err) {
+                    this.discloseAnnounceFailure("materialize index-heal enqueue", err);
+                }
+            }
+        }
         for (const [scope, dir] of scopeDirs) {
             if (scope === writeScope)
                 continue;
@@ -1062,7 +1100,7 @@ export class MemoryEngine {
         const instruction = writeChannel ? buildMemoryInstruction(handle.writableRoot) : "";
         const readOnlyNotice = handle.writeScope === null ? MEMORY_READONLY_NOTICE : undefined;
         const indexPath = join(handle.writableRoot, MEMORY_INDEX_FILENAME);
-        const onDisk = handle.indexOnDiskUntrusted === true || handle.adoptionRestricted === true ? undefined : readSafe(indexPath);
+        const onDisk = handle.indexOnDiskUntrusted === true || handle.adoptionRestricted === true || (handle.writeScope === null && this.provenance === "carry") ? undefined : readSafe(indexPath);
         const indexText = onDisk !== undefined && onDisk.trim() !== "" ? onDisk : handle.indexText;
         const truncated = truncateIndex(indexText);
         const index = composeMemoryBlock(truncated, handle.writeScope ?? handle.scopes[0] ?? "memory");
@@ -1495,9 +1533,21 @@ export class MemoryEngine {
         for (const [p, id] of idByBasePath)
             if (!handle.fileToScope.get(p) || handle.fileToScope.get(p) === handle.writeScope)
                 basePathById.set(id, p);
+        let projectionDebts;
+        try {
+            projectionDebts = new Map(readProjectionDebts(this.controlDir).map((r) => [r.relPath, { entryId: r.entryId, rev: r.rev }]));
+        }
+        catch (err) {
+            report.ok = false;
+            report.incident = { kind: "sidecar_corrupt", detail: `memory projection-debt ledger unreadable: ${err instanceof Error ? err.message : String(err)}` };
+            return report;
+        }
+        const debtClears = [];
+        const staleReplacedDebts = new Map();
         const patches = [];
         const pendingProjections = [];
         const idsAddedThisHarvest = new Set();
+        const modelIdAdds = new Set();
         let processed = 0;
         for (let i = 0; i < kept.length; i++) {
             const f = kept[i];
@@ -1514,8 +1564,12 @@ export class MemoryEngine {
                 continue;
             }
             const fastBaseId = idByBasePath.get(f.canonical);
-            if (fastBaseId !== undefined && !stubByPath.has(f.canonical) && revOfText(f.text, fastBaseId) === revByBasePath.get(f.canonical))
+            if (fastBaseId !== undefined && !stubByPath.has(f.canonical) && revOfText(f.text, fastBaseId) === revByBasePath.get(f.canonical)) {
+                const fastDebt = projectionDebts.get(rel);
+                if (fastDebt !== undefined && fastDebt.entryId === fastBaseId)
+                    await this.repairProjectionSeat(rel, f.canonical, fastBaseId, debtClears);
                 continue;
+            }
             processed++;
             if (pollutedReason !== undefined && !carry) {
                 await containPollutedRecord(f);
@@ -1571,8 +1625,35 @@ export class MemoryEngine {
                 continue;
             }
             const parsed = f.parsed;
-            const baseId = idByBasePath.get(f.canonical);
+            let baseId = idByBasePath.get(f.canonical);
             let id = baseId ?? parsed.id;
+            let debtReconciled = false;
+            if (id === undefined && projectionDebts.size > 0) {
+                const debt = projectionDebts.get(rel);
+                if (debt !== undefined) {
+                    const committed = await this.debtCommittedProjection(debt.entryId);
+                    if (committed.state === "unknown") {
+                        report.rejections.push({
+                            path: rel,
+                            code: "deferred",
+                            reason: "memory write deferred: this file's recorded committed id could not be validated (committed state unreadable) — retried next harvest (fail-closed: a fresh mint here could duplicate the committed entry)",
+                        });
+                        continue;
+                    }
+                    if (committed.state === "valid" && committed.scope === writeScope && committed.slug === f.slug) {
+                        baseId = debt.entryId;
+                        id = debt.entryId;
+                        idByBasePath.set(f.canonical, debt.entryId);
+                        revByBasePath.set(f.canonical, debt.rev);
+                        debtReconciled = true;
+                        report.warnings.push(`${rel}: reconciled to its committed entry — a prior harvest committed this file but the id write-back did not land; the projection is repaired through the ordinary update lane, never re-admitted as a duplicate`);
+                    }
+                    else {
+                        debtClears.push({ relPath: rel, entryId: debt.entryId });
+                        staleReplacedDebts.set(rel, debt.entryId);
+                    }
+                }
+            }
             const minted = id === undefined;
             if (id === undefined)
                 id = uuidv7();
@@ -1666,9 +1747,13 @@ export class MemoryEngine {
                 continue;
             }
             if (baseId !== undefined) {
-                if (revOfText(f.text, id) === revByBasePath.get(f.canonical))
+                if (revOfText(f.text, id) === revByBasePath.get(f.canonical)) {
+                    const seatDebt = projectionDebts.get(rel);
+                    if (seatDebt !== undefined && seatDebt.entryId === id)
+                        await this.repairProjectionSeat(rel, f.canonical, id, debtClears);
                     continue;
-                pendingProjections.push({ path: f.canonical, entry, needed: minted || parsed.id !== id || needsCompletion(parsed, fm) });
+                }
+                pendingProjections.push({ path: f.canonical, entry, needed: minted || parsed.id !== id || needsCompletion(parsed, fm), ...(debtReconciled ? { idCompletion: true } : {}) });
                 patches.push({ op: "update", id, entry, ...(revByBasePath.get(f.canonical) !== undefined ? { baseRev: revByBasePath.get(f.canonical) } : {}) });
                 continue;
             }
@@ -1698,8 +1783,30 @@ export class MemoryEngine {
                 entry.rev = computeEntryRev(entry);
                 report.warnings.push(`${rel}: frontmatter id ${reboundId} already has a projection (${renamedFrom !== undefined ? relative(handle.memoryDir, renamedFrom) : "another new file in this harvest"}) — a copy is not a rename, so this file was committed as a NEW entry with a fresh id; the existing entry was left untouched`);
             }
-            pendingProjections.push({ path: f.canonical, entry, needed: minted || reboundId !== undefined || needsCompletion(parsed, fm) });
+            let remintedId;
+            if (fm.origin !== undefined && parsed.id !== undefined && reboundId === undefined) {
+                const idless = serializeEntryFile({ id: "", frontmatter: fm, body: parsed.body }).replace(/^id:[ \t]*$\r?\n/m, "");
+                try {
+                    writeFileNoFollow(f.canonical, idless);
+                }
+                catch (err) {
+                    report.rejections.push({
+                        path: rel,
+                        code: "filename",
+                        reason: `memory write blocked: an external-origin commit does not adopt the file's model-written entry id and its frontmatter could not be rewritten (${err instanceof Error ? err.message : String(err)}) — remove the "id:" line so it can be committed under an engine-minted id`,
+                    });
+                    continue;
+                }
+                remintedId = parsed.id;
+                id = uuidv7();
+                entry.id = id;
+                entry.rev = computeEntryRev(entry);
+                report.warnings.push(`${rel}: the file's model-written id was not adopted for this external-origin commit — committed under an engine-minted id (a marked entry's index/search handles carry no model-authored bytes)`);
+            }
+            pendingProjections.push({ path: f.canonical, entry, needed: minted || reboundId !== undefined || remintedId !== undefined || needsCompletion(parsed, fm), ...(minted || reboundId !== undefined || remintedId !== undefined ? { idCompletion: true } : {}) });
             idsAddedThisHarvest.add(entry.id);
+            if (parsed.id !== undefined && entry.id === parsed.id)
+                modelIdAdds.add(entry.id);
             patches.push({ op: "add", id: entry.id, entry });
         }
         let patchReport;
@@ -1775,6 +1882,33 @@ export class MemoryEngine {
                             for (const pp of pendingProjections)
                                 if (pp.entry.id === p.id)
                                     pp.needed = true;
+                            if (p.op === "add" && modelIdAdds.has(p.id)) {
+                                const projection = pendingProjections.find((pp) => pp.entry.id === p.id);
+                                const flipRec = projection !== undefined ? records.find((r) => r.canonical === projection.path) : undefined;
+                                if (flipRec === undefined) {
+                                    droppedIds.add(p.id);
+                                    report.warnings.push(`entry ${p.id} was withdrawn from this commit: its projection record could not be located for the marked-commit id re-mint — the file stays on disk and the next harvest re-judges it`);
+                                    continue;
+                                }
+                                const idless = serializeEntryFile({ id: "", frontmatter: p.entry.frontmatter, body: p.entry.body }).replace(/^id:[ \t]*$\r?\n/m, "");
+                                try {
+                                    writeFileNoFollow(flipRec.canonical, idless);
+                                }
+                                catch (err) {
+                                    report.rejections.push({
+                                        path: flipRec.rel,
+                                        code: "filename",
+                                        reason: `memory write blocked: an external-origin commit does not adopt the file's model-written entry id and its frontmatter could not be rewritten (${err instanceof Error ? err.message : String(err)}) — remove the "id:" line so it can be committed under an engine-minted id`,
+                                    });
+                                    droppedIds.add(p.id);
+                                    continue;
+                                }
+                                p.entry.id = uuidv7();
+                                p.entry.rev = computeEntryRev(p.entry);
+                                p.id = p.entry.id;
+                                projection.idCompletion = true;
+                                report.warnings.push(`${flipRec.rel}: the file's model-written id was not adopted for this external-origin commit — committed under an engine-minted id (a marked entry's index/search handles carry no model-authored bytes)`);
+                            }
                         }
                         keptPatches.push(p);
                     }
@@ -1807,6 +1941,68 @@ export class MemoryEngine {
                         }
                     }
                 }
+                const debtStage = pendingProjections
+                    .filter((p) => p.idCompletion === true)
+                    .map((p) => {
+                    const relPath = relative(handle.memoryDir, p.path);
+                    const replaces = staleReplacedDebts.get(relPath);
+                    return { relPath, entryId: p.entry.id, rev: p.entry.rev, ...(replaces !== undefined ? { replaces } : {}) };
+                });
+                if (debtStage.length > 0) {
+                    let refusedStage = [];
+                    try {
+                        refusedStage = stageProjectionDebts(this.controlDir, debtStage, this.now).refused;
+                    }
+                    catch (err) {
+                        report.warnings.push(`memory projection-debt staging failed — duplicate-admission protection for this harvest's id write-backs is degraded (a failed write-back could re-admit its file as a duplicate until the next materialize repairs the plane): ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    if (refusedStage.length > 0) {
+                        const refusedIds = new Set(refusedStage.map((r) => r.entryId));
+                        for (let i = patches.length - 1; i >= 0; i--) {
+                            const p = patches[i];
+                            if (p.op !== "delete" && refusedIds.has(p.id))
+                                patches.splice(i, 1);
+                        }
+                        for (let i = pendingProjections.length - 1; i >= 0; i--) {
+                            const proj = pendingProjections[i];
+                            if (refusedIds.has(proj.entry.id)) {
+                                idByBasePath.delete(proj.path);
+                                revByBasePath.delete(proj.path);
+                                pendingProjections.splice(i, 1);
+                            }
+                        }
+                        for (const r of refusedStage) {
+                            report.rejections.push({
+                                path: r.relPath,
+                                code: "deferred",
+                                reason: "memory write deferred: a concurrent writer's projection-debt claim stands at this seat — retried next harvest (committing without a protected id write-back could duplicate the concurrent entry)",
+                            });
+                            report.warnings.push(`${r.relPath}: earlier notes about this file committing under a fresh id are superseded — its commit was WITHDRAWN this harvest (deferred to the next)`);
+                        }
+                        if (lineageArmed) {
+                            const remaining = patches.filter((p) => p.op !== "delete" && p.entry !== undefined).map((p) => ({ entryId: p.id, rev: p.entry.rev, ...(p.entry.frontmatter.origin !== undefined ? { marked: true } : {}) }));
+                            if (remaining.length > 0) {
+                                try {
+                                    stageLineagePending(this.controlDir, txnId, lineageSessionId, remaining, this.now);
+                                }
+                                catch (err) {
+                                    report.ok = false;
+                                    report.incident = { kind: "sidecar_corrupt", detail: `memory lineage restage refused after a withheld projection-debt seat: ${err instanceof Error ? err.message : String(err)}` };
+                                    return report;
+                                }
+                            }
+                            else {
+                                try {
+                                    discardLineagePending(this.controlDir, txnId);
+                                }
+                                catch (err) {
+                                    report.warnings.push(`memory lineage stage for withheld entries could not be discarded — their ids stay latched until the host adjudicates pending transaction ${txnId}: ${err instanceof Error ? err.message : String(err)}`);
+                                }
+                                lineageArmed = false;
+                            }
+                        }
+                    }
+                }
                 try {
                     patchReport = await this.backend.applyPatches(patches);
                 }
@@ -1876,18 +2072,44 @@ export class MemoryEngine {
         }
         const appliedIds = new Set(patchReport.applied.filter((a) => a.op !== "delete").map((a) => a.id));
         for (const p of pendingProjections) {
+            const pRel = relative(handle.memoryDir, p.path);
             if (appliedIds.has(p.entry.id)) {
-                this.writeBackProjection(p.path, p.entry, p.needed);
+                const wrote = this.writeBackProjection(p.path, p.entry, p.needed);
+                if (p.idCompletion === true) {
+                    if (wrote)
+                        debtClears.push({ relPath: pRel, entryId: p.entry.id });
+                    else {
+                        const landed = patchReport.applied.find((a) => a.id === p.entry.id)?.slug;
+                        const suffixNote = landed !== undefined && landed !== p.entry.slug ? ` NOTE: the entry landed at slug ${JSON.stringify(landed)} (collision suffix) — the seat claim will not re-bind; host reconciliation may be needed.` : "";
+                        report.warnings.push(`${pRel}: the entry committed but its id write-back FAILED — the projection-debt row stands, so the file re-binds to its committed id at the next harvest (and the next materialize repairs the plane); it is never re-admitted as a duplicate.${suffixNote}`);
+                    }
+                }
                 continue;
             }
-            const committed = await this.committedContentFor(p.entry.id);
+            const committedRead = await this.committedContentOrFault(p.entry.id);
+            const committed = committedRead.content;
+            let planeHoldsCommitted = false;
             if (committed !== undefined && readNoFollowSafe(p.path) !== committed) {
                 try {
                     writeFileNoFollow(p.path, committed);
+                    planeHoldsCommitted = true;
                 }
                 catch {
                 }
             }
+            else if (committed !== undefined) {
+                planeHoldsCommitted = true;
+            }
+            if (p.idCompletion === true && ((committed === undefined && !committedRead.fault) || planeHoldsCommitted))
+                debtClears.push({ relPath: pRel, entryId: p.entry.id });
+        }
+        if (debtClears.length > 0) {
+            try {
+                settleProjectionDebts(this.controlDir, debtClears);
+            }
+            catch (err) {
+                report.warnings.push(`memory projection-debt settlement failed — settled rows stay on the ledger (harmless: every consumption re-validates a row against the committed state before binding): ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
         try {
             clearScanFuse(this.controlDir, pendingProjections.filter((p) => appliedIds.has(p.entry.id)).map((p) => p.path));
@@ -1942,7 +2164,7 @@ export class MemoryEngine {
         for (const row of readHolds(this.controlDir)) {
             const valveRelease = row.resolved === "release" && (row.status === "held" || (row.status === "disposed" && row.disposition?.terminal === "expired"));
             if (valveRelease) {
-                const released = await this.releaseHold(handle, report, row, { valve: true });
+                const released = await this.releaseHold(handle, report, row, { valve: true, disposed: out.disposed });
                 if (released !== undefined)
                     out.released.push(released);
                 continue;
@@ -1965,7 +2187,7 @@ export class MemoryEngine {
             }
             if (rows.some((r) => r.effective === "pending"))
                 continue;
-            const released = await this.releaseHold(handle, report, row, { valve: false });
+            const released = await this.releaseHold(handle, report, row, { valve: false, disposed: out.disposed });
             if (released !== undefined)
                 out.released.push(released);
         }
@@ -1974,9 +2196,17 @@ export class MemoryEngine {
     async releaseHold(handle, report, row, opts) {
         const disposeOut = (terminal, why) => {
             const d = disposeHold(this.controlDir, { holdId: row.holdId, terminal, now: this.now });
+            if (!d.ok) {
+                try {
+                    clearHoldResolution(this.controlDir, { holdId: row.holdId, ifResolvedAt: row.resolvedAt });
+                }
+                catch {
+                }
+                report.warnings.push(`held instruction entry ${row.relPath} valve release FAILED (${terminal}): ${why} — the standing "release" verdict was consumed (the hold keeps its earlier disposition; resolveHold can re-arm it after the cause is reconciled)`);
+                return undefined;
+            }
             report.warnings.push(`held instruction entry ${row.relPath} DISPOSED (${terminal}): ${why}${d.quarantineName !== undefined ? ` — captured bytes moved to control-plane quarantine (${d.quarantineName})` : ""}`);
-            report.containment ??= { indexRolledBack: false, quarantinedInstruction: [], heldInstruction: [], releasedHolds: [], disposedHolds: [] };
-            report.containment.disposedHolds.push({ relPath: row.relPath, terminal });
+            opts.disposed.push({ relPath: row.relPath, terminal });
             return undefined;
         };
         const content = readHoldCustody(this.controlDir, row);
@@ -2004,13 +2234,13 @@ export class MemoryEngine {
             if (committedOrigin !== undefined)
                 fm.origin = committedOrigin;
             else if (opts.valve)
-                fm.origin = { taint: "external", cause: "static", at: this.now() };
+                fm.origin = { taint: "external", cause: "static", at: row.capturedAt };
         }
         if (fm.name === undefined)
             fm.name = row.slug.split("/").pop();
         if (fm.description === undefined && fm.deleted !== true)
             fm.description = firstSentence(parsed.body) || undefined;
-        const id = row.entryId ?? (parsed.id !== undefined && isValidEntryId(parsed.id) ? parsed.id : `h${createHash("sha256").update(row.holdId, "utf8").digest("hex").slice(0, 31)}`);
+        const id = row.entryId ?? (parsed.id !== undefined && isValidEntryId(parsed.id) && fm.origin === undefined ? parsed.id : `h${createHash("sha256").update(row.holdId, "utf8").digest("hex").slice(0, 31)}`);
         const entry = { id, slug: row.slug, frontmatter: fm, body: parsed.body, rev: "", scope: row.scope };
         entry.rev = computeEntryRev(entry);
         const patch = row.op === "update" && row.entryId !== undefined
@@ -2070,7 +2300,9 @@ export class MemoryEngine {
             report.warnings.push(`released hold ${row.relPath}: lineage settlement failed after commit — the entry stays latched until a later harvest reconciles: ${err instanceof Error ? err.message : String(err)}`);
         }
         markHoldReleased(this.controlDir, { holdId: row.holdId, now: this.now });
-        const abs = join(this.memoryDir, row.relPath);
+        const landedSlug = patchReport.applied.find((a) => a.id === patch.id)?.slug ?? row.slug;
+        const landedRelPath = landedSlug === row.slug ? row.relPath : join(dirname(row.relPath), `${landedSlug.split("/").pop()}.md`);
+        const abs = join(this.memoryDir, landedRelPath);
         if (existsSync(abs)) {
             const canonical = canonicalize(abs);
             const text = readSafe(canonical);
@@ -2079,7 +2311,7 @@ export class MemoryEngine {
                 handle.baseRevs.set(canonical, computeEntryRev({ id: patch.id, frontmatter: parseEntryFile(text).frontmatter, body: parseEntryFile(text).body }));
                 handle.fileToScope.set(canonical, row.scope);
                 if (!handle.materialized.some((m) => m.path === canonical)) {
-                    handle.materialized.push({ path: canonical, relPath: row.relPath, scope: row.scope, id: patch.id, slug: row.slug, rev: handle.baseRevs.get(canonical), stub: false, readonly: false });
+                    handle.materialized.push({ path: canonical, relPath: landedRelPath, scope: row.scope, id: patch.id, slug: landedSlug, rev: handle.baseRevs.get(canonical), stub: false, readonly: false });
                 }
             }
         }
@@ -2201,12 +2433,24 @@ export class MemoryEngine {
         let landedSlug = row.slug;
         let detail;
         if (current !== undefined && committedOriginOf(current.frontmatter) !== undefined) {
+            if (this.readChallengeExclusions().has(row.entryId)) {
+                fail("memory.origin_clear_challenged", "the entry is challenged/latched — adjudicate the challenge first (the clear valve is not a challenge exit); the marked entry stands untouched and this row is terminal.", false);
+            }
             if (current.rev !== row.baseRev) {
                 fail("memory.origin_clear_conflict", `the entry moved since the clearance was judged (rev ${row.baseRev.slice(0, 12)}… → ${current.rev.slice(0, 12)}…) — call clearEntryOrigin again to re-judge (the marked entry stands untouched; this row is terminal).`, false);
             }
             if (current.scope !== row.scope || current.slug !== row.slug) {
                 fail("memory.origin_clear_conflict", `the entry's projection moved since the clearance was judged (${JSON.stringify(row.scope)}/${JSON.stringify(row.slug.slice(0, 80))} → ${JSON.stringify(current.scope)}/${JSON.stringify(current.slug.slice(0, 80))}) — call clearEntryOrigin again to re-judge (the marked entry stands untouched; this row is terminal).`, false);
             }
+            const projText = readNoFollowSafe(join(scopeDirFor(this.memoryDir, this.controlDir, current.scope), `${current.slug}.md`));
+            let projIsPristineStub = false;
+            if (projText !== undefined) {
+                const { deleted: _stubDrop, ...currentStubFm } = current.frontmatter;
+                projIsPristineStub = projText === serializeEntryFile({ id: current.id, frontmatter: currentStubFm, body: STUB_ARCHIVED_LINE });
+            }
+            if (projText !== undefined && revOfText(projText, current.id) !== current.rev && !projIsPristineStub) {
+                fail("memory.origin_clear_conflict", "the entry's on-disk projection diverges from its committed state (an unadopted out-of-session edit stands on the plane) — the clear will not overwrite it; adopt or reconcile the divergence first, then call clearEntryOrigin again (the marked entry and the on-disk bytes both stand untouched; this row is terminal).", false);
+            }
             const del = await this.backend.applyPatches([{ op: "delete", id: row.entryId, baseRev: row.baseRev }]);
             if (del.conflicts.length > 0) {
                 const [reprobe] = await this.committedAuditFace().getByIds([row.entryId]);
@@ -2214,6 +2458,11 @@ export class MemoryEngine {
                     fail("memory.origin_clear_conflict", `the tombstone leg was refused (${(del.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — call clearEntryOrigin again to re-judge (the marked entry stands untouched; this row is terminal).`, false);
                 }
                 if (reprobe === undefined) {
+                    try {
+                        markOriginClearanceTombstoned(this.controlDir, { clearanceId: row.clearanceId, now: this.now });
+                    }
+                    catch {
+                    }
                     const add = await this.backend.applyPatches([{ op: "add", id: row.entryId, entry: cleared, guard: "absent" }]);
                     if (add.conflicts.length > 0) {
                         fail("memory.origin_clear_failed", `the re-record leg was refused (${(add.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — the row stays PENDING with the cleared bytes in its custody (entryText); call clearEntryOrigin again to resume.`, true);
@@ -2227,6 +2476,11 @@ export class MemoryEngine {
                 }
             }
             else {
+                try {
+                    markOriginClearanceTombstoned(this.controlDir, { clearanceId: row.clearanceId, now: this.now });
+                }
+                catch {
+                }
                 const add = await this.backend.applyPatches([{ op: "add", id: row.entryId, entry: cleared, guard: "absent" }]);
                 if (add.conflicts.length > 0) {
                     fail("memory.origin_clear_failed", `the re-record leg was refused (${(add.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — the row stays PENDING with the cleared bytes in its custody (entryText); call clearEntryOrigin again to resume.`, true);
@@ -2236,6 +2490,9 @@ export class MemoryEngine {
             }
         }
         else if (current === undefined) {
+            if (row.tombstonedAt === undefined) {
+                fail("memory.origin_clear_unknown", "the entry is no longer committed and this clearance never recorded a committed tombstone — the deletion is not this clearance's and stands (nothing was resurrected). The cleared bytes remain in this row's custody (entryText) for host review; this row is terminal.", false);
+            }
             const add = await this.backend.applyPatches([{ op: "add", id: row.entryId, entry: cleared, guard: "absent" }]);
             if (add.conflicts.length > 0) {
                 fail("memory.origin_clear_failed", `the resumed re-record leg was refused (${(add.conflicts[0]?.reason ?? "conflict").slice(0, 160)}) — the row stays PENDING with the cleared bytes in its custody (entryText); call clearEntryOrigin again to resume.`, true);
@@ -2361,6 +2618,28 @@ export class MemoryEngine {
         const handleCovered = new Set();
         const keptByTarget = new Map();
         const keptLines = [];
+        const foldDots = (s) => {
+            let prev = s;
+            for (let i = 0; i < 32; i++) {
+                const next = prev.replace(/\/(?:\.\/)+/g, "/").replace(/(?:^|[/\s(])(?:[^/\s()]+\/\.\.\/)+/g, (m) => (/^[/\s(]/.test(m) ? m[0] : ""));
+                if (next === prev)
+                    return next;
+                prev = next;
+            }
+            return prev;
+        };
+        const foldTarget = (t) => foldDots(t.toLowerCase());
+        const knownTargetsFolded = new Set([...expected.keys(), ...excludedTargets, ...exposedProjectionTargets].map(foldTarget));
+        const pathTokenAt = (folded, idx, len) => {
+            const isPathChar = (ch) => /[a-z0-9._\-/\\]/.test(ch);
+            let s = idx;
+            let e = idx + len;
+            while (s > 0 && isPathChar(folded[s - 1]))
+                s--;
+            while (e < folded.length && isPathChar(folded[e]))
+                e++;
+            return folded.slice(s, e).replace(/\.+$/, "");
+        };
         for (const line of existing.split("\n")) {
             if (carryIndex) {
                 const handleId = parseMemoryExposureIndexRow(line);
@@ -2373,18 +2652,16 @@ export class MemoryEngine {
                 }
             }
             if (carryIndex && exposedProjectionTargets.size > 0) {
-                const foldDots = (s) => {
-                    let prev = s;
-                    for (let i = 0; i < 32; i++) {
-                        const next = prev.replace(/\/(?:\.\/)+/g, "/").replace(/(?:^|[/\s(])(?:[^/\s()]+\/\.\.\/)+/g, (m) => (/^[/\s(]/.test(m) ? m[0] : ""));
-                        if (next === prev)
-                            return next;
-                        prev = next;
-                    }
-                    return prev;
-                };
                 const folded = foldDots(line.toLowerCase());
-                const hit = [...exposedProjectionTargets].find((t) => folded.includes(t.toLowerCase()));
+                const hit = [...exposedProjectionTargets].find((t) => {
+                    const tf = foldTarget(t);
+                    for (let idx = folded.indexOf(tf); idx !== -1; idx = folded.indexOf(tf, idx + 1)) {
+                        const token = pathTokenAt(folded, idx, tf.length);
+                        if (token === tf || !knownTargetsFolded.has(token))
+                            return true;
+                    }
+                    return false;
+                });
                 if (hit !== undefined) {
                     warnings?.push(`MEMORY.md index line naming ${hit} replaced by its opaque external-origin handle (the entry stays readable via memory_get)`);
                     continue;
@@ -2461,20 +2738,28 @@ export class MemoryEngine {
         return text;
     }
     async committedContentFor(id) {
+        return (await this.committedContentOrFault(id)).content;
+    }
+    async committedContentOrFault(id) {
+        let fault = false;
         const zeroCopy = this.backendPinnedRoot !== undefined && canonicalize(this.backendPinnedRoot) === canonicalize(this.memoryDir);
         if (!zeroCopy) {
             try {
                 const [entry] = await this.backend.getByIds([id]);
                 if (entry !== undefined && entry.id === id)
-                    return serializeEntryFile(entry);
+                    return { content: serializeEntryFile(entry), fault: false };
             }
             catch {
+                fault = true;
             }
         }
         const viaBackend = this.backend.readCommittedShadow?.(id);
         if (viaBackend !== undefined)
-            return viaBackend;
-        return readSafe(join(this.controlDir, "shadow", `${id}.md`));
+            return { content: viaBackend, fault: false };
+        const viaShadow = readSafe(join(this.controlDir, "shadow", `${id}.md`));
+        if (viaShadow !== undefined)
+            return { content: viaShadow, fault: false };
+        return { fault };
     }
     async committedFrontmatterFor(id) {
         const zeroCopy = this.backendPinnedRoot !== undefined && canonicalize(this.backendPinnedRoot) === canonicalize(this.memoryDir);
@@ -2567,14 +2852,45 @@ export class MemoryEngine {
     }
     writeBackProjection(path, entry, needed) {
         if (!needed)
-            return;
+            return true;
         const text = serializeEntryFile(entry);
         if (readNoFollowSafe(path) === text)
-            return;
+            return true;
         try {
             writeFileNoFollow(path, text);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async repairProjectionSeat(rel, canonical, entryId, debtClears) {
+        const committed = await this.committedContentFor(entryId);
+        if (committed === undefined)
+            return;
+        if (readNoFollowSafe(canonical) !== committed) {
+            try {
+                writeFileNoFollow(canonical, committed);
+            }
+            catch {
+                return;
+            }
+        }
+        debtClears.push({ relPath: rel, entryId });
+    }
+    async debtCommittedProjection(entryId) {
+        const zeroCopy = this.backendPinnedRoot !== undefined && canonicalize(this.backendPinnedRoot) === canonicalize(this.memoryDir);
+        if (zeroCopy)
+            return { state: "stale" };
+        const face = this.backend.retrievalView?.() ?? this.backend;
+        try {
+            const [entry] = await face.getByIds([entryId]);
+            if (entry !== undefined && entry.id === entryId)
+                return { state: "valid", scope: entry.scope, slug: entry.slug };
+            return { state: "stale" };
         }
         catch {
+            return { state: "unknown" };
         }
     }
     siblingScopeDirNames(dir, scope) {