@sema-agent/core 5.65.0 → 7.0.0

package/dist/core/memory-engine/file-backend.d.ts

@@ -474,6 +474,36 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     private enqueueExternalItems;
     /** One-shot dedup for adopting-face notices (see {@link adoptionNoticeKeys}). */
     private announceAdoptionNotice;
+    /**
+     * §3.4 — the standing unbound-row disclosure, in ONE spelling for BOTH faces that carry it (the
+     * harvest preflight `checkControlPlane` and the restricted sweep `auditRestrictedDivergence` used
+     * to hold drifting hand-built copies of this sentence; the sweep's copy had lost the remediation
+     * clause, which is if anything MORE apt there — a restricted session has no write channel of its
+     * own to converge the row).
+     *
+     * De-duplicated against what is ALREADY QUEUED, not against a per-instance latch. The repeat this
+     * closes was not merely noise: the queue is bounded ({@link MEMORY_ANNOUNCEMENTS_MAX}), so a
+     * long-lived instance with one stuck row folded REAL notices out of it to make room for copies of
+     * this one. But the latch the sibling adoption notices use ({@link announceAdoptionNotice}) is the
+     * wrong instrument HERE, twice over, and both were found in review:
+     *  · a backend instance is a RUNNER-level dependency reused across every session it serves, so a
+     *    per-instance latch would announce the standing condition to the first session and then hold
+     *    its peace forever — turning a flood into silence, against this disclosure's own contract
+     *    (「the STATE does not go silent」). The queue is DRAINED at each session's first injection, so
+     *    "is an identical line still pending?" is exactly the right question: no repeat within a
+     *    session, one fresh statement in every session that has not yet been told.
+     *  · a latch key would have to encode the id set, and ledger row ids are arbitrary external
+     *    strings (a comma is legal) — `join(",")` makes `["a,b","c"]` and `["a","b,c"]` the same key,
+     *    so a real change of state could be suppressed. Comparing the RENDERED LINE has no such seam:
+     *    two states that render the same sentence are, to every consumer, the same statement.
+     *
+     * The test runs INSIDE the queue's own locked read-modify-write
+     * ({@link enqueueMemoryAnnouncement}'s `supersedesPrefix`), not as a peek followed by an append: a
+     * peek-then-enqueue would race a concurrent drain, and two processes could both peek-miss and both
+     * append. Fail-open like every announce site — an unwritable queue never fails an operation that
+     * had something to say.
+     */
+    private announceUnboundRows;
     /** Resolve a binding's absolute projection path WITHOUT registering anything (probes must stay
      *  side-effect-free; `scopeDir` would register an unknown scope name from a hand-edited row). */
     private bindingAbsPath;

package/dist/core/memory-engine/file-backend.js

@@ -179,6 +179,7 @@ function deleteRow(rows, id) {
 function hasUnboundRows(rows) {
     return rowsEntries(rows).some(([id]) => rowsBinding(rows, id) === undefined);
 }
+const UNBOUND_DISCLOSURE_PREFIX = "memory ledger has ";
 function unboundRowIds(rows) {
     return rowsEntries(rows)
         .filter(([id]) => rowsBinding(rows, id) === undefined)
@@ -570,13 +571,8 @@ export class FileMemoryEngineBackend {
         registeredScopes(this.controlPlaneRoot);
         if (this.persistedSchemaVersion === "v1" || hasUnboundRows(this.loadLedger()))
             this.tryOpportunisticMigrate();
-        const rows = this.loadLedger();
-        if (this.persistedSchemaVersion === "v2" && hasUnboundRows(rows)) {
-            const ids = unboundRowIds(rows);
-            this.enqueueExternalItems([
-                `memory ledger has ${ids.length} unbound row(s) (no derivable committed projection): ${ids.slice(0, 8).join(", ")}${ids.length > 8 ? ", …" : ""} — v2 binding guarantees do not cover them until they converge (duplicate projections need an unrestricted harvest or manual removal)`,
-            ]);
-        }
+        if (this.persistedSchemaVersion === "v2")
+            this.announceUnboundRows(this.loadLedger());
     }
     drainInboundFindings() {
         const out = this.inboundFindings;
@@ -642,6 +638,15 @@ export class FileMemoryEngineBackend {
         this.adoptionNoticeKeys.add(key);
         this.enqueueExternalItems([item]);
     }
+    announceUnboundRows(rows) {
+        const ids = unboundRowIds(rows);
+        const item = ids.length === 0 ? undefined : `${UNBOUND_DISCLOSURE_PREFIX}${ids.length} unbound row(s) (no derivable committed projection): ${ids.slice(0, 8).join(", ")}${ids.length > 8 ? ", …" : ""} — v2 binding guarantees do not cover them until they converge (duplicate projections need an unrestricted harvest or manual removal)`;
+        try {
+            enqueueMemoryAnnouncement(this.controlPlaneRoot, { kind: "external", at: this.now(), items: item === undefined ? [] : [item] }, { supersedesPrefix: UNBOUND_DISCLOSURE_PREFIX });
+        }
+        catch {
+        }
+    }
     bindingAbsPath(binding) {
         return join(scopeDirFor(this.directoryRoot, this.controlPlaneRoot, binding.scope), `${binding.slug}.md`);
     }
@@ -2033,12 +2038,8 @@ export class FileMemoryEngineBackend {
         if (this.persistedSchemaVersion === "v1" || hasUnboundRows(this.loadLedger()))
             this.tryOpportunisticMigrate();
         const rows = { ...this.loadLedger() };
-        if (this.persistedSchemaVersion === "v2" && hasUnboundRows(rows)) {
-            const unboundIds = unboundRowIds(rows);
-            this.enqueueExternalItems([
-                `memory ledger has ${unboundIds.length} unbound row(s) (no derivable committed projection): ${unboundIds.slice(0, 8).join(", ")}${unboundIds.length > 8 ? ", …" : ""} — v2 binding guarantees do not cover them until they converge`,
-            ]);
-        }
+        if (this.persistedSchemaVersion === "v2")
+            this.announceUnboundRows(rows);
         const present = new Map();
         let complete = true;
         for (const scope of Object.keys(registeredScopes(this.controlPlaneRoot))) {

package/dist/core/memory-engine/frontmatter.d.ts

@@ -56,6 +56,27 @@ export declare function extraOriginCarriers(extra: readonly string[] | undefined
  * so a committed multi-carrier shape always answers the one agreed value.
  */
 export declare function committedOriginOf(fm: Pick<MemoryEntryFrontmatter, "origin" | "extra">): MemoryEntryOrigin | undefined;
+/**
+ * design/383 §1.6 — the CONSOLIDATION exposure predicate: is this entry's content untrusted for
+ * the purpose of the distillation fold? TWO axes, not one:
+ *  - a committed external-origin marker ({@link committedOriginOf}) — the design/336 axis;
+ *  - `trust: "untrusted"` — the design-A C-5 repo-ingest marker, which an ingested repo file can
+ *    carry with NO origin marker at all. Such an entry is untrusted content by the same law that
+ *    makes it un-whitewashable (the single-value marker has no `"trusted"` spelling to escalate
+ *    to), and the origin-only predicate sorted it into the CLEAN arm — its bytes then authored
+ *    clean products, and those products committed unmarked. That is exactly the marked-ingress
+ *    laundering window the exposure partition exists to close.
+ *
+ * The direction is deliberately conservative (over-marking): an entry judged marked here is
+ * withheld from the clean arm and its products carry `external/derived`. Nothing here proves an
+ * unmarked entry clean — absence of both markers means "never judged exposed", as always.
+ *
+ * This is the consolidation lane's judgment only. The READ-face treatment (opaque handles, band
+ * ordering, the `MemoryEntryHeader.exposure` backend fact) stays on the origin axis alone: those
+ * faces answer "does the store carry an origin marker", a data question a third-party backend
+ * already answers, and widening them is a backend-contract change this predicate does not make.
+ */
+export declare function consolidationExposedFrontmatter(fm: Pick<MemoryEntryFrontmatter, "origin" | "extra" | "trust">): boolean;
 /** Deep equality over the origin marker (every member, absence included) — the immutability law's
  *  comparator: a downgraded cause or a rewritten `at` is as refused as a strip. */
 export declare function originEquals(a: MemoryEntryOrigin | undefined, b: MemoryEntryOrigin | undefined): boolean;
@@ -106,7 +127,7 @@ export declare function distilledEquals(a: MemoryEntryDistilled | undefined, b:
  * design/339 §1.4.2-1 — the harvest-side STRIP of model-written distilled bytes (typed field AND
  * distilled-form `extra` lines): the block is minted by the consolidation plan freeze EXCLUSIVELY —
  * whatever a file on the model-writable plane says about its own lineage/supersession is not
- * evidence (a model-writable edge would be the delete-attack channel add-only exists to close).
+ * evidence (a model-writable edge would be the covert-delete channel add-only exists to close).
  * Same seat and same disclosure discipline as {@link stripModelWrittenOrigin}. MUTATES the given
  * (already-copied) frontmatter; returns true ⇔ anything was stripped.
  */

package/dist/core/memory-engine/frontmatter.js

@@ -326,6 +326,9 @@ export function committedOriginOf(fm) {
         return { taint: fm.origin.taint, ...(fm.origin.cause !== undefined ? { cause: fm.origin.cause } : {}), at: fm.origin.at };
     return extraOriginCarriers(fm.extra)[0];
 }
+export function consolidationExposedFrontmatter(fm) {
+    return committedOriginOf(fm) !== undefined || fm.trust === "untrusted";
+}
 export function originEquals(a, b) {
     if (a === undefined || b === undefined)
         return a === b;

package/dist/core/memory-engine/header-hints.d.ts

@@ -37,6 +37,11 @@ export interface V2HeaderHints {
  * privilege AND walks through the exposure hard gate with it. ONE exported predicate on purpose:
  * the write side (harvest hard gate) and any read-side consumer must judge through the same
  * function, never through re-implementations that can drift.
+ *
+ * NAME COLLISION, not concept parity (test B12): `pinned` here is a
+ * WRITE-SIDE safety-privilege declaration (instruction-form ⇒ exposure hard gate / quarantine),
+ * while Claude Code's `pinned` is a RECALL-side display priority (up to 4 entries surfaced in a
+ * "# Pinned memories" block). Same word, different machines — do not read one as the other.
  */
 export declare function isInstructionEntry(fm: {
     type?: string;

package/dist/core/memory-engine/index.d.ts

@@ -1,15 +1,16 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, } from "./engine.js";
-export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, type MemoryGetDetails, } from "./tools.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, } from "./engine.js";
+export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, } from "./tools.js";
 export { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_RECALL_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow, } from "./provenance-wording.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, type ScannedEntryFile, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, type MemoryExportSnapshot, } from "./file-backend.js";
 export { computeBundleSectionHashes, computeMemoryBundleHash, memoryBundleInvalid, type MemoryExportBundle, type MemoryImportReport, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, } from "./export-bundle.js";
-export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAppendResult, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, } from "./layout.js";
+export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAppendResult, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, } from "./layout.js";
 export { readV2HeaderHints, isInstructionEntry, type V2HeaderHints } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation, type ParsedEntryFile } from "./frontmatter.js";
+export { consolidationExposedFrontmatter } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
 export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
-export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
+export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type RunMemoryConsolidationOptions, } from "./consolidation-driver.js";
 export type { OriginClearanceRow, OriginClearanceEvent, OriginClearanceShadow } from "./origin-clearance.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";

package/dist/core/memory-engine/index.js

@@ -1,15 +1,16 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, } from "./engine.js";
-export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, } from "./tools.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, memoryRecallDisciplineSegment, entryFileHeadCarriesOrigin, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, } from "./engine.js";
+export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, } from "./tools.js";
 export { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_RECALL_SENTENCE, MEMORY_PROVENANCE_SEARCH_SENTENCE, memoryExposureIndexRow, parseMemoryExposureIndexRow, } from "./provenance-wording.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, erasureSelectHash, } from "./file-backend.js";
 export { computeBundleSectionHashes, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
-export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, } from "./layout.js";
+export { ControlPlaneCorruptError, deriveControlPlaneDir, deriveRepoControlPlaneDir, deriveRepoKey, deriveRepoMemoryDir, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, claimRootScope, rootScopeOf, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, } from "./layout.js";
 export { readV2HeaderHints, isInstructionEntry } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation } from "./frontmatter.js";
+export { consolidationExposedFrontmatter } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
 export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, CONSOLIDATION_RUN_STOP_REASONS, } from "./consolidation.js";
-export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, } from "./distiller.js";
+export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, } from "./consolidation-driver.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, } from "./memory-backend-contract.js";

package/dist/core/memory-engine/layout.d.ts

@@ -268,8 +268,31 @@ interface AnnouncementsRecord {
     folded: number;
     queue: MemoryAnnouncement[];
 }
-/** S2-B — enqueue one announcement (journaled + locked; bounded with overflow folding). */
-export declare function enqueueMemoryAnnouncement(controlDir: string, ann: MemoryAnnouncement): void;
+/**
+ * S2-B — enqueue one announcement (journaled + locked; bounded with overflow folding).
+ *
+ * `opts.supersedesPrefix` (#495) declares this announcement to be a STANDING CONDITION — one whose
+ * sentence is re-derived at every entry point until the condition clears — and names the family it
+ * belongs to by line prefix. Every queued line of that family is a STALE READING of the same
+ * condition, so the queue is made to hold exactly one of them, always the current one:
+ *   · the identical line already queued unread ⇒ no-op, and no write at all;
+ *   · otherwise every queued item with that prefix is dropped and this one appended.
+ * Merely SKIPPING a repeat is not enough, and that was the first form of this: a condition that goes
+ * A → B → A inside one unread window would leave `A, B` in the queue and a reader looking at B as the
+ * latest state — the fix for a flood turning into a wrong answer. Replacement makes the last word the
+ * true one.
+ *
+ * All of it runs INSIDE the locked read-modify-write, which is the point: a caller that peeked first
+ * and enqueued after would race a concurrent drain, and two processes could both peek-miss.
+ * Deliberately keyed on the LINE, not on a structural id — two states that render the same sentence
+ * are, to every consumer, the same statement. Deliberately opt-in: an ordinary event repeating IS
+ * news, and only its author knows which kind it is. Callers using it pass ONE item (a standing
+ * condition is one sentence), and the prefix must name the family precisely — anything else sharing
+ * it would be dropped as a stale sibling.
+ */
+export declare function enqueueMemoryAnnouncement(controlDir: string, ann: MemoryAnnouncement, opts?: {
+    supersedesPrefix?: string;
+}): void;
 /** S2-B — drain the queue (session-first inject, 时机①). Returns what was queued and resets it. */
 export declare function drainMemoryAnnouncements(controlDir: string): AnnouncementsRecord;
 /** Test/observability peek (journal-aware, non-destructive). */
@@ -330,6 +353,69 @@ export declare function listSessionPollution(controlDir: string): Record<string,
  * write failure THROWS (the import aborts with its latch standing — §1-2⑤).
  */
 export declare function importSessionPollution(controlDir: string, sessionId: string, record: SessionPollutionRecord): "written" | "already" | "divergent";
+/** Directory (under the control plane) holding one record file per capture-opted-out session. */
+export declare const SESSION_CAPTURE_OPTOUT_DIR = "session-capture-optout";
+/** The durable capture opt-out record. `reason` is host/engine-authored (the declaring channel),
+ *  never model text. */
+export interface SessionCaptureOptOutRecord {
+    at: number;
+    reason: string;
+}
+/** Outcome vocabulary shared with the pollution marker (same `wx` one-way form): `"created"` ⇔ THIS
+ *  call minted the record; `"existed"` ⇔ already recorded (a resumed session / an idempotent
+ *  re-declaration); `"unpersisted"` ⇔ the record could not be written — the CALLER must refuse to
+ *  run (design/383 §2.8: an opt-out that only holds in-process is broken by the first resume, so
+ *  "could not persist" is a named refusal, never a silent in-process-only degrade — the deliberate
+ *  divergence from the pollution marker's best-effort arm). */
+export type SessionCaptureOptOutMarkOutcome = "created" | "existed" | "unpersisted";
+/** Mark `sessionId` capture-opted-out (idempotent; the FIRST record wins — `wx` refuses overwrite). */
+export declare function markSessionCaptureOptOut(controlDir: string, sessionId: string, reason: string, now: () => number): SessionCaptureOptOutMarkOutcome;
+/** Read the durable capture opt-out record for `sessionId` (undefined = capture is on). Fail-closed
+ *  exactly like the pollution read: a record that EXISTS but cannot be read or parsed still answers
+ *  opted-out (a synthesized record stands in) — corruption must not launder a privacy request back
+ *  into capture. Only ABSENCE reads as "capture on". A store state where existence itself cannot be
+ *  established (dir-level IO fault) THROWS — the engine's `sessionCaptureOptOutOrFault` catch turns
+ *  it into the INDETERMINATE fault axis (same fail-closed suppression, honest attribution — see the
+ *  catch below). */
+export declare function readSessionCaptureOptOut(controlDir: string, sessionId: string): SessionCaptureOptOutRecord | undefined;
+/**
+ * Enumerate EVERY durable capture opt-out record (the consolidation eligibility arm's roster read —
+ * design/383 §2.4). Same fail-closed posture as {@link listSessionPollution}: a record that exists
+ * but cannot be read answers synthesized (never silently omitted); an absent directory is the
+ * genuine empty state (ENOENT only); any OTHER enumeration failure THROWS — a listing that silently
+ * dropped records would let the distiller amplify content its author asked to withhold.
+ */
+export declare function listSessionCaptureOptOut(controlDir: string): Record<string, SessionCaptureOptOutRecord>;
+/**
+ * design/383 §2.1b — the control-plane carrier a HOST may substitute for the capture opt-out
+ * record's read/write/list (server F1: on a stateless multi-replica deployment the file form is
+ * invisible to the resume replica — "record not found" would break exactly toward capture). The
+ * core default is the file trio above, byte-identical for every deployment that supplies nothing.
+ * CONTRACT (each leg mirrors the file form's law):
+ *  - `mark` is create-only/first-record-wins and must answer `"unpersisted"` (never throw) when the
+ *    carrier cannot durably land the record;
+ *  - `read` is fail-closed: a record that exists but cannot be decoded answers a synthesized
+ *    record, never `undefined`; a store that cannot establish whether a record EXISTS (an outage)
+ *    may THROW — the engine treats a throwing read as the INDETERMINATE fault axis (commit
+ *    boundaries suppress fail-closed), which is the honest answer there: it must not fabricate a
+ *    record ("a user request that never happened") and must not answer `undefined` ("no record"
+ *    breaks exactly toward capture);
+ *  - `list` throws on an enumeration failure (an unreadable roster is not an empty one).
+ * REGISTERED COMPANION (named, not silently absent): the session-POLLUTION marker has the same
+ * cloud-form invisibility (server F1 names both). It is NOT routed through this seat in this
+ * slice because the delegation-settlement lane's consumers are contractually PURE-DATA
+ * (`controlDir` + `sessionId` coordinates that outlive any live object — see the settlement handle
+ * doc in prepare-task.ts), and a live store object cannot ride that lane; its migration needs its
+ * own seam design and is registered here rather than half-built.
+ */
+export interface SessionCaptureRecordStore {
+    mark(sessionId: string, record: SessionCaptureOptOutRecord): SessionCaptureOptOutMarkOutcome;
+    read(sessionId: string): SessionCaptureOptOutRecord | undefined;
+    list(): Record<string, SessionCaptureOptOutRecord>;
+}
+/** The core-default {@link SessionCaptureRecordStore}: the file trio over `controlDir` (single-
+ *  process / single-host deployments keep today's carrier byte-identical). */
+export declare function fileSessionCaptureRecordStore(controlDir: string): SessionCaptureRecordStore;
 /** The retrieved-account sidecar (control plane): entry id → { count, lastAt }. */
 export declare const USAGE_RETRIEVED_FILE = "usage-retrieved.json";
 /** Bound on tracked ids — over the cap, the entries with the OLDEST `lastAt` are evicted first

package/dist/core/memory-engine/layout.js

@@ -668,17 +668,34 @@ function coerceAnnouncements(raw) {
                 typeof a.at === "number" &&
                 Array.isArray(a.items) &&
                 a.items.every((i) => typeof i === "string")) {
-                rec.queue.push({ kind: a.kind, at: a.at, ...(typeof a.sessionId === "string" ? { sessionId: a.sessionId } : {}), items: a.items });
+                rec.queue.push({
+                    kind: a.kind,
+                    at: a.at,
+                    ...(typeof a.sessionId === "string" ? { sessionId: a.sessionId } : {}),
+                    ...(typeof a.reportId === "string" ? { reportId: a.reportId } : {}),
+                    items: a.items,
+                });
             }
         }
     }
     return rec;
 }
-export function enqueueMemoryAnnouncement(controlDir, ann) {
-    if (ann.items.length === 0)
+export function enqueueMemoryAnnouncement(controlDir, ann, opts) {
+    const family = opts?.supersedesPrefix;
+    if (ann.items.length === 0 && family === undefined)
         return;
     lockedJournaledUpdate(controlDir, ANNOUNCEMENTS_FILE, (current) => {
         const rec = coerceAnnouncements(current);
+        if (family !== undefined) {
+            const queued = rec.queue.flatMap((a) => a.items.filter((i) => i.startsWith(family)));
+            if (queued.length === ann.items.length && ann.items.every((i) => queued.includes(i)))
+                return undefined;
+            for (const a of rec.queue)
+                a.items = a.items.filter((i) => !i.startsWith(family));
+            rec.queue = rec.queue.filter((a) => a.items.length > 0);
+            if (ann.items.length === 0)
+                return rec;
+        }
         rec.queue.push(ann);
         if (rec.queue.length > MEMORY_ANNOUNCEMENTS_MAX) {
             rec.folded += rec.queue.length - MEMORY_ANNOUNCEMENTS_MAX;
@@ -831,6 +848,98 @@ export function importSessionPollution(controlDir, sessionId, record) {
     const standing = readSessionPollution(controlDir, sessionId);
     return standing !== undefined && standing.at === record.at && standing.reason === record.reason ? "already" : "divergent";
 }
+export const SESSION_CAPTURE_OPTOUT_DIR = "session-capture-optout";
+function captureOptOutPath(controlDir, sessionId) {
+    return join(controlDir, SESSION_CAPTURE_OPTOUT_DIR, `${encodeURIComponent(sessionId)}.json`);
+}
+export function markSessionCaptureOptOut(controlDir, sessionId, reason, now) {
+    const path = captureOptOutPath(controlDir, sessionId);
+    try {
+        ensureDirExists(dirname(path));
+        const record = { at: now(), reason };
+        writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+        return "created";
+    }
+    catch (err) {
+        if (err instanceof Error && "code" in err && err.code === "EEXIST")
+            return "existed";
+        return "unpersisted";
+    }
+}
+export function readSessionCaptureOptOut(controlDir, sessionId) {
+    const path = captureOptOutPath(controlDir, sessionId);
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            try {
+                lstatSync(path);
+            }
+            catch (lerr) {
+                if (lerr.code === "ENOENT")
+                    return undefined;
+                throw new ControlPlaneCorruptError(`session capture opt-out record state is INDETERMINATE (${lerr.code ?? "io error"}) at ${path} — the store cannot establish whether a record exists; consumers must suppress on the fault axis (an outage is never reported as a user request)`, { cause: lerr });
+            }
+            return { at: 0, reason: "capture opt-out record present but unreadable (kept fail-closed)" };
+        }
+        try {
+            statSync(path);
+        }
+        catch {
+            throw new ControlPlaneCorruptError(`session capture opt-out record state is INDETERMINATE (${err.code ?? "io error"}) at ${path} — the store cannot establish whether a record exists; consumers must suppress on the fault axis (an outage is never reported as a user request)`, { cause: err });
+        }
+        return { at: 0, reason: "capture opt-out record present but unreadable (kept fail-closed)" };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed !== null && typeof parsed === "object") {
+            const at = parsed.at;
+            const reason = parsed.reason;
+            if (typeof at === "number" && typeof reason === "string")
+                return { at, reason };
+        }
+    }
+    catch {
+    }
+    return { at: 0, reason: "capture opt-out record present but unreadable (kept fail-closed)" };
+}
+export function listSessionCaptureOptOut(controlDir) {
+    const dir = join(controlDir, SESSION_CAPTURE_OPTOUT_DIR);
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new ControlPlaneCorruptError(`session capture opt-out records could not be enumerated (${err.code ?? "io error"}) at ${dir} — an enumeration failure is not an empty set (fail-closed)`, { cause: err });
+    }
+    const out = Object.create(null);
+    for (const name of names.sort()) {
+        if (!name.endsWith(".json"))
+            continue;
+        let sessionId;
+        try {
+            sessionId = decodeURIComponent(name.slice(0, -".json".length));
+        }
+        catch {
+            continue;
+        }
+        const rec = readSessionCaptureOptOut(controlDir, sessionId);
+        if (rec !== undefined)
+            out[sessionId] = rec;
+    }
+    return out;
+}
+export function fileSessionCaptureRecordStore(controlDir) {
+    return {
+        mark: (sessionId, record) => markSessionCaptureOptOut(controlDir, sessionId, record.reason, () => record.at),
+        read: (sessionId) => readSessionCaptureOptOut(controlDir, sessionId),
+        list: () => listSessionCaptureOptOut(controlDir),
+    };
+}
 export const USAGE_RETRIEVED_FILE = "usage-retrieved.json";
 export const USAGE_RETRIEVED_MAX_IDS = 4096;
 function coerceRetrievedAccount(raw) {

package/dist/core/memory-engine/provenance-wording.d.ts

@@ -62,3 +62,10 @@ export declare const MEMORY_SEARCH_BAND_ORDER_HEADER = "entries without the [ext
  * memory_get instead of treating an id-only line as an empty result.
  */
 export declare const MEMORY_PROVENANCE_SEARCH_SENTENCE: string;
+/**
+ * #493 件① — the memory_index counterpart of {@link MEMORY_PROVENANCE_SEARCH_SENTENCE} (appended to
+ * the listing tool's description under "carry" only): same teaching, "rows" instead of "hits" —
+ * the enumeration face renders a marked entry as the same opaque id-only handle the search face
+ * does (§5.2's passive-face law: a marked entry's model-authored strings never ride untaxed).
+ */
+export declare const MEMORY_PROVENANCE_INDEX_SENTENCE: string;

package/dist/core/memory-engine/provenance-wording.js

@@ -14,3 +14,6 @@ export const MEMORY_SEARCH_BAND_ORDER_HEADER = `entries without the ${MEMORY_EXP
 export const MEMORY_PROVENANCE_SEARCH_SENTENCE = "Hits tagged [external-origin] list only the entry id (their content came from a session that was exposed to " +
     "external content): read them with memory_get by id as usual, then verify what they say against current sources " +
     "before acting on it.";
+export const MEMORY_PROVENANCE_INDEX_SENTENCE = "Rows tagged [external-origin] list only the entry id (their content came from a session that was exposed to " +
+    "external content): read them with memory_get by id as usual, then verify what they say against current sources " +
+    "before acting on it.";

package/dist/core/memory-engine/tools.d.ts

@@ -1,17 +1,22 @@
 /**
- * design/178 v1 — the two engine-memory retrieval tools (`memory_search` / `memory_get`).
+ * design/178 v1 — the engine-memory retrieval tools (`memory_search` / `memory_get`, and since
+ * #493 the `memory_index` enumeration face).
  *
  * These are the first runner-wired consumers of the `MemoryBackend.search()`/`getByIds()` contract:
- * a deterministic keyword lookup over the session's mounted scopes plus a paged full-content read.
- * Zero contract changes — the tools sit entirely ON TOP of the backend seam.
+ * a deterministic keyword lookup over the session's mounted scopes plus a paged full-content read,
+ * plus (#493) a paged enumeration of EVERY mounted entry — the completeness floor under both: any
+ * committed entry is reachable through `memory_index` regardless of the injected index's truncation
+ * window and of whether its words match the question (chaos live S2-B: out-of-window ∧ lexically
+ * disjoint was structurally unreachable). Zero contract changes — the tools sit entirely ON TOP of
+ * the backend seam.
  *
- * READ-ONLY BY STRUCTURE. Neither tool can write; the write path stays the file channel + harvest
+ * READ-ONLY BY STRUCTURE. No tool here can write; the write path stays the file channel + harvest
  * gate. Entry content returned to the model is DATA, not instructions: every body fragment rides an
  * untrusted fence (`delimitUntrusted`) and every header field a model could have authored
  * (name/description/slug/scope) is neutralized inline. Results are byte-bounded.
  *
- * THE PAIR IS ATOMIC. Each tool names the other in its description, so a half-mount would teach a
- * tool that is not there — the mount site (runner/prepare-task.ts) mounts both or neither.
+ * THE TRIO IS ATOMIC. Each tool names the others in its description, so a partial mount would teach
+ * a tool that is not there — the mount site (runner/prepare-task.ts) mounts all or none.
  *
  * RESULT ORDER IS THE BACKEND CONTRACT ORDER: ascending cosine-distance score with the
  * deterministic id tie-break, exactly what `MemoryBackend.search()` promises. Multi-plane sessions
@@ -30,11 +35,21 @@ import type { ToolSpec } from "../types.js";
 import type { MemoryBackend } from "./types.js";
 export declare const MEMORY_SEARCH_TOOL_NAME = "memory_search";
 export declare const MEMORY_GET_TOOL_NAME = "memory_get";
-/** The atomic pair, in mount order (same shape as SHARED_MEMORY_TOOL_NAMES). */
-export declare const MEMORY_ENGINE_TOOL_NAMES: readonly ["memory_search", "memory_get"];
+/** #493 件① — the enumeration face. NOT `memory_list`: that wire name (and the `core.memory_list@1`
+ *  contract id) belongs to the design/177 shared-memory store pair, and both families can mount in
+ *  one session. */
+export declare const MEMORY_INDEX_TOOL_NAME = "memory_index";
+/** The atomic trio, in mount order (same shape as SHARED_MEMORY_TOOL_NAMES). */
+export declare const MEMORY_ENGINE_TOOL_NAMES: readonly ["memory_search", "memory_get", "memory_index"];
 /** Default / maximum hit counts for one search call. */
 export declare const MEMORY_SEARCH_DEFAULT_LIMIT = 8;
 export declare const MEMORY_SEARCH_MAX_LIMIT = 20;
+/** Default / maximum rows of one memory_index page (a row is ≲600 bytes by the inline caps, so the
+ *  extremes stay well under one tool-result's budget; the per-page byte bound below is the backstop). */
+export declare const MEMORY_INDEX_PAGE_ROWS = 100;
+export declare const MEMORY_INDEX_MAX_PAGE_ROWS = 500;
+/** Byte bound of one memory_index page (rows past it defer to the next page, disclosed). */
+export declare const MEMORY_INDEX_PAGE_CAP_BYTES: number;
 /** Per-hit body-fragment bound (code points, enforced by the fence itself). */
 export declare const MEMORY_SEARCH_SNIPPET_CAP = 600;
 /** Default / maximum lines of one memory_get page. */
@@ -78,6 +93,21 @@ export interface MemoryEnginePlane {
      * settlement account's record-failure arm.
      */
     onTaintedDelivery?: (ids: readonly string[]) => void;
+    /**
+     * design/383 §1.7 — the provenance mode of the WRITE-SIDE engine that owns this plane, read off
+     * the engine itself (`MemoryEngine.provenanceMode`), never re-declared by hand. Present ⇒ the
+     * factory ASSERTS it against its own {@link MemoryEngineToolsOptions.provenance}: a wiring that
+     * writes under `"carry"` while reading under `"off"` mints origin markers no read face will ever
+     * honour (marked entries served through the clean shape, no banner, no recall-taint propagation)
+     * — the two halves are one deployment posture and a split between them is a configuration fault,
+     * refused at construction (`config.memory_provenance`) rather than discovered as a quiet leak.
+     *
+     * Scope, stated honestly: this kills CONFIGURATION divergence only. It proves nothing about
+     * whether any individual entry is classified correctly — that is the 178 fail-closed default's
+     * job, not this assertion's. Absent ⇒ no engine mode is declared for this plane (engine-direct
+     * hosts and tests) and nothing is asserted: the factory's behaviour is byte-identical to before.
+     */
+    enginePlaneProvenance?: "off" | "carry";
 }
 export interface MemoryEngineToolsOptions {
     planes: ReadonlyArray<MemoryEnginePlane>;
@@ -191,6 +221,57 @@ export interface MemoryGetDetails {
      *  supersession is disclosure/ordering, never withholding. */
     supersededBy?: string;
 }
+/**
+ * #493 件① — one row of the memory_index enumeration. The same discriminated shape law as the
+ * search hits (design/336 B5): a clean row carries the text seats, a marked row (carry mode) is an
+ * opaque id-only handle — a consumer must branch on `exposure` to touch the text seats. No score
+ * seat: the enumeration is structural, not ranked.
+ */
+export interface CleanMemoryIndexRow {
+    id: string;
+    scope: string;
+    slug: string;
+    name?: string;
+    description?: string;
+    mtimeMs: number;
+    sizeBytes: number;
+    exposure?: never;
+    /** Present ⇔ this row is SUPERSEDED (listed via `includeSuperseded`; the default face filters
+     *  such rows out) — the value is the standing carrier entry's id. */
+    supersededBy?: string;
+}
+/** The opaque marked-row handle (carry mode) — same posture as {@link ExposedMemorySearchHit}. */
+export interface ExposedMemoryIndexRow {
+    exposure: "external";
+    id: string;
+    scope: string;
+    mtimeMs: number;
+    sizeBytes: number;
+    slug?: never;
+    name?: never;
+    description?: never;
+    supersededBy?: string;
+}
+export type MemoryIndexRow = CleanMemoryIndexRow | ExposedMemoryIndexRow;
+export interface MemoryIndexDetails {
+    outcome: "ok" | "refused" | "failed";
+    reason?: string;
+    entries?: MemoryIndexRow[];
+    /** Zero-based row offset this page started at (the enumeration order is deterministic). */
+    offset?: number;
+    /** Rows on THIS page. */
+    shown?: number;
+    /** Total rows the enumeration serves (after the exclusion/superseded filters). */
+    total?: number;
+    /** Superseded rows the default face hid (absent when zero or when `includeSuperseded` was passed). */
+    supersededHidden?: number;
+    /** Present ⇔ more rows follow — pass it as the next call's `offset`. */
+    nextOffset?: number;
+    /** The listing revision this page was served against (a stateless digest of the ordered id
+     *  sequence the offsets address). Pass it back on continuation pages of a complete pass; a
+     *  mismatch refuses with reason `listing_changed` instead of silently skipping shifted rows. */
+    listingRev?: string;
+}
 /** Cut `text` to at most `maxBytes` UTF-8 bytes on a CODE POINT boundary (a byte-wise slice would
  *  strand half a character), reporting how many bytes were dropped. Unchanged text reports 0.
  *  Exported for the truncation-invariant registry — a bound-taking function has to be provable. */