@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/mcp.d.ts

@@ -168,7 +168,7 @@ export interface MaterializedMcp {
      * A consumer (service) surfacing it as session status must understand that. `toolNames` are the namespaced
      * (`<server>__<tool>`) names exposed.
      *
-     * RB-437-a — READ THIS AS A SNAPSHOT, NOT A HEARTBEAT. `status` is the connect-time verdict and is never
+     * READ THIS AS A SNAPSHOT, NOT A HEARTBEAT. `status` is the connect-time verdict and is never
      * rewritten: a server that dies mid-task still reads `connected` here, because that IS what happened at
      * materialize. The one live bit is {@link McpServerStatus.transportClosed} (set if and when core observes
      * the transport go away — see its own note for the reach). For an authoritative answer about a server's
@@ -231,7 +231,7 @@ export interface McpRefreshResult {
      */
     error?: string;
     /**
-     * #381 — present when this entry's `tools/list` walk did NOT reach the end of pagination. `tools` is
+     * Present when this entry's `tools/list` walk did NOT reach the end of pagination. `tools` is
      * then a MERGE: everything the partial listing did return, plus the previously-mounted entries whose
      * absence it cannot prove (so the consumer's replace-the-whole-prefix swap withdraws nothing, and
      * `removed: []` describes a roster that really lost nothing). Absent on a complete walk and on every
@@ -267,7 +267,7 @@ export interface McpServerStatus {
     delivered?: McpDelivered;
     httpStatus?: number;
     /**
-     * RB-437-a — set to `true` once core OBSERVES this server's transport close during the task; absent
+     * Set to `true` once core OBSERVES this server's transport close during the task; absent
      * otherwise (never `false`: absence means "no close was observed", which is not the same as "alive").
      * It mirrors exactly the flag core's own fail-fast path keys on, so `transportClosed === true` also
      * means every further call to this server's tools/resources is refused without dialing.
@@ -376,7 +376,7 @@ export declare function mcpStartupTimeoutMs(): number | undefined;
  *  (see {@link MCP_SPEC_ERROR_CODE_NAMES}). */
 export declare function describeMcpSpecErrorCode(code: unknown): string | undefined;
 /**
- * RB-437-c — the SDK stamps `MCP error <code>: ` onto an McpError's message IN ITS CONSTRUCTOR, and it
+ * The SDK stamps `MCP error <code>: ` onto an McpError's message IN ITS CONSTRUCTOR, and it
  * does so at BOTH ends of the wire: a server built on an MCP SDK throws an McpError, its already-stamped
  * `.message` goes out as the JSON-RPC `error.message`, and the client constructs its own McpError over
  * that string — so the failure reaches the model as `MCP error -32602: MCP error -32602: …`. Collapse a
@@ -582,7 +582,7 @@ export declare function classifyDirReadInvalidParams(message: string): "not_foun
  */
 export declare function listEntryFingerprint(entry: unknown): string | undefined;
 /**
- * #381 — walk a paginated MCP list method to the END (`{cursor?}` → `{items, nextCursor?}`), bounded.
+ * Walk a paginated MCP list method to the END (`{cursor?}` → `{items, nextCursor?}`), bounded.
  *
  * Every spec-standard MCP list method is paginated the same way: absence of `nextCursor` means "that
  * was the last page". A single request therefore returns the WHOLE list only for servers that choose

package/dist/core/mcp.js

@@ -1,5 +1,6 @@
 import { redactSecrets } from "./untrusted-egress.js";
-import { announceEnvKnob, __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
+import { __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
+import { resolveEnvBudget } from "./env-budget.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -31,18 +32,7 @@ export function resolveMcpDeclaredResultSize(meta) {
     return Math.min(declared, MCP_META_RESULT_SIZE_CAP);
 }
 function mcpMaxOutputTokens() {
-    const rawEnv = process.env.MAX_MCP_OUTPUT_TOKENS;
-    if (rawEnv === undefined)
-        return MCP_OUTPUT_TOKENS_DEFAULT;
-    const raw = rawEnv.trim();
-    if (raw === "")
-        return MCP_OUTPUT_TOKENS_DEFAULT;
-    const n = parseWholeNumber(raw);
-    if (n === undefined || n <= 0) {
-        announceEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
-        return MCP_OUTPUT_TOKENS_DEFAULT;
-    }
-    return n;
+    return resolveEnvBudget(process.env.MAX_MCP_OUTPUT_TOKENS, { name: "MAX_MCP_OUTPUT_TOKENS", unit: "tokens", default: MCP_OUTPUT_TOKENS_DEFAULT });
 }
 function mcpTruncationNote(limitTokens) {
     return (`\n\n[OUTPUT TRUNCATED - exceeded ${limitTokens} token limit]\n\n` +
@@ -114,45 +104,11 @@ export function truncateMcpErrorText(s) {
 export const MCP_TOOL_TIMEOUT_DEFAULT_MS = 100_000_000;
 export const MCP_ENV_MS_MIN = 1_000;
 export const MCP_ENV_MS_MAX = 2_147_483_647;
-const ENV_SCIENTIFIC_RE = /^[+-]?(\d+(\.\d*)?|\.\d+)[eE][+-]?\d+$/;
-const ENV_GROUPED_RE = /^[+-]?\d{1,3}([_,\u00A0\u202F ])\d{3}(?:\1\d{3})*$/;
-const ENV_GROUP_SEPARATORS_RE = /[_,\u00A0\u202F ]/g;
-const ENV_NUMERIC_MAX_LEN = 32;
-function parseWholeNumber(raw) {
-    if (/^[+-]?\d+$/.test(raw)) {
-        const n = Number(raw);
-        return Number.isSafeInteger(n) ? n : undefined;
-    }
-    if (raw.length > ENV_NUMERIC_MAX_LEN)
-        return undefined;
-    if (ENV_SCIENTIFIC_RE.test(raw)) {
-        const n = Number(raw);
-        return Number.isSafeInteger(n) ? n : undefined;
-    }
-    if (ENV_GROUPED_RE.test(raw))
-        return parseInt(raw.replace(ENV_GROUP_SEPARATORS_RE, ""), 10);
-    return undefined;
-}
 export function __resetMcpEnvAnnouncements() {
     __resetEnvKnobAnnouncements();
 }
 function parseEnvMs(name) {
-    const rawEnv = process.env[name];
-    if (rawEnv === undefined)
-        return undefined;
-    const raw = rawEnv.trim();
-    if (raw === "")
-        return undefined;
-    const n = parseWholeNumber(raw);
-    if (n === undefined || n <= 0) {
-        announceEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
-        return undefined;
-    }
-    const clamped = Math.min(Math.max(n, MCP_ENV_MS_MIN), MCP_ENV_MS_MAX);
-    if (clamped !== n) {
-        announceEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
-    }
-    return clamped;
+    return resolveEnvBudget(process.env[name], { name, unit: "milliseconds", default: undefined, min: MCP_ENV_MS_MIN, max: MCP_ENV_MS_MAX });
 }
 export function mcpToolTimeoutMs() {
     return parseEnvMs("MCP_TOOL_TIMEOUT") ?? MCP_TOOL_TIMEOUT_DEFAULT_MS;

package/dist/core/memory-engine/delegation-settlement.d.ts

@@ -144,32 +144,54 @@ export declare function replayExternalSettlementEffects(controlDir: string, inpu
     sessionId: string;
 }>;
 export declare const SESSION_ACCOUNTS_FILE = "session-accounts.json";
+/** One member of the sticky set: the ledger form `(scope, rel)` — `rel` relative to the scope's
+ *  home, `/`-separated. Location-free, so a home move never re-keys the membership. */
+export interface UnattributedMember {
+    scope: string;
+    rel: string;
+}
 export interface SessionAccountRow {
     sessionId: string;
     openedAt: number;
-    /** The STICKY unattributed set (rel paths), frozen at materialize (§3.6 归属判据): pre-existing,
-     *  uncommitted files seen while a FOREIGN dangling open row stood. Membership never shrinks on
-     *  later writes (the r3-5 sticky law); it clears only when the row is re-opened with a fresh
-     *  classification (the residue was adjudicated by an intervening harvest). */
-    unattributed: string[];
+    /** The STICKY unattributed set, frozen at materialize (§3.6 归属判据): pre-existing, uncommitted
+     *  files seen while a FOREIGN dangling open row stood. Membership never shrinks on later writes
+     *  (the sticky law); it clears only when the row is re-opened with a fresh classification (the
+     *  residue was adjudicated by an intervening harvest). */
+    unattributed: UnattributedMember[];
+    /** The v1 members (memory-dir-relative paths) the registry could not attribute at the one-time
+     *  conversion. Kept, never dropped; while any stands, EVERY membership question about
+     *  this session answers "unattributed" (over-marking is the safe direction). */
+    unattributable?: string[];
     closedAt?: number;
     /** r7-3 — the host valve closed this row WITHOUT adjudication: it stops dangling but keeps
      *  triggering the residue arm until the next FULL-domain harvest closes an account normally
      *  (an unadjudicated close must not launder the residue window it covered). */
     unadjudicated?: true;
 }
+/** The one-time v1 key-form conversions of the three engine sidecars, in one call (each in its own
+ *  lock, each idempotent). The layout adoption runs this before any later scope registration can
+ *  change what a v1 key's first segment names. */
+export declare function convertV1SidecarKeys(controlDir: string): void;
 /** The dangling-trigger read: open rows (and unadjudicated closes) belonging to OTHER sessions.
  *  These are what arm the unattributed residue classification at a session's materialize. */
 export declare function foreignDanglingSessionAccounts(controlDir: string, selfSessionId: string): SessionAccountRow[];
+/** The membership question the harvest asks per file: is `(scope, rel)` in the session's sticky
+ *  set? A session carrying members the conversion could not attribute answers yes for every seat. */
+export interface SessionUnattributedSet {
+    has(scope: string, rel: string): boolean;
+    /** True when no seat can answer yes (no members, none unattributable). */
+    readonly empty: boolean;
+}
+export declare function emptyUnattributedSet(): SessionUnattributedSet;
 /** Open (or re-open, on a same-session resume) the session's account row, persisting the sticky
  *  unattributed classification frozen at THIS materialize. */
 export declare function openSessionAccount(controlDir: string, input: {
     sessionId: string;
     now: () => number;
-    unattributed: readonly string[];
+    unattributed: readonly UnattributedMember[];
 }): void;
 /** The current session's sticky unattributed set (the harvest's residue-arm input). */
-export declare function sessionUnattributedSet(controlDir: string, sessionId: string): Set<string>;
+export declare function sessionUnattributedSet(controlDir: string, sessionId: string): SessionUnattributedSet;
 /** Close the session's account row — called ONLY after a FULL-domain harvest (zero BUDGET-deferred
  *  files, i.e. `HarvestReport.degraded` absent): a partial harvest's close would launder the deferred
  *  residue window (§3.6 序则②). A normal full close also clears every standing `unadjudicated` flag
@@ -209,8 +231,10 @@ export interface HoldRow {
     op: "add" | "update";
     /** CAS anchor at capture time (update form): release refuses to blind-write over a later edit. */
     baseRev?: string;
-    /** Path relative to the memory dir (the plane seat the file was removed from). */
-    relPath: string;
+    /** The plane seat the file was removed from, in the ledger form: relative to the write scope's
+     *  home (`<memoryDir>/<label>`), `/`-separated — `${slug}.md`. Location-free, so a home move never
+     *  re-keys a hold. */
+    rel: string;
     /** The entry slug (path relative to the scope dir, sans `.md`) — the release leg's projection
      *  identity and its filename-scan input. */
     slug: string;
@@ -263,7 +287,8 @@ export declare function noReplaceRestore(stagingPath: string, destPath: string):
  */
 export declare function openInstructionHold(controlDir: string, input: {
     sessionId: string;
-    relPath: string;
+    /** The seat in the ledger form (relative to the write scope's home). */
+    rel: string;
     absPath: string;
     content: string;
     entryId?: string;
@@ -290,11 +315,11 @@ export declare function openInstructionHold(controlDir: string, input: {
  *    (the file stays on the plane and walks the ordinary/§3.6 arms; never "capture whatever is
  *    there now" — that would hold a third writer's bytes under the first writer's account);
  *  - `capturing` + custody absent + plane file gone ⇒ `capture_lost` (nothing to hold).
- *  - `held` + plane file REAPPEARED at the relPath ⇒ left alone (a fresh write is a fresh file —
+ *  - `held` + plane file REAPPEARED at the seat ⇒ left alone (a fresh write is a fresh file —
  *    the next harvest judges it on its own; the hold's custody bytes stay the hold's).
  */
 export declare function reconcileHolds(controlDir: string, input: {
-    memoryDir: string;
+    homeOf: (scope: string) => string;
     now: () => number;
 }): void;
 /** Dispose one held row: custody bytes move to the quarantine directory (host-auditable), the row

package/dist/core/memory-engine/delegation-settlement.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, linkSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { QUARANTINE_DIR, appendChallengeEvents, enqueueMemoryAnnouncement, ensureDirExists, lineageContributionsOfSession, lockedStrictUpdate, markSessionPolluted, readSessionPollution, readStrictSidecar, ControlPlaneCorruptError } from "./layout.js";
+import { QUARANTINE_DIR, appendChallengeEvents, enqueueMemoryAnnouncement, ensureDirExists, v1MemoryPathKeyResolver, lineageContributionsOfSession, lockedStrictUpdate, markSessionPolluted, readProjectionDebts, readSessionPollution, readStrictSidecar, ControlPlaneCorruptError } from "./layout.js";
 export const DELEGATION_SETTLEMENT_FILE = "delegation-settlement.json";
 function reqStr(v) {
     return typeof v === "string" && v.length > 0;
@@ -233,36 +233,101 @@ export function replayExternalSettlementEffects(controlDir, input) {
     return applied;
 }
 export const SESSION_ACCOUNTS_FILE = "session-accounts.json";
+function malformedAccountRow(row) {
+    return (typeof row !== "object" ||
+        row === null ||
+        !reqStr(row.sessionId) ||
+        typeof row.openedAt !== "number" ||
+        !Number.isFinite(row.openedAt) ||
+        !Array.isArray(row.unattributed) ||
+        (row.closedAt !== undefined && (typeof row.closedAt !== "number" || !Number.isFinite(row.closedAt))) ||
+        (row.unadjudicated !== undefined && row.unadjudicated !== true));
+}
+function isUnattributedMember(x) {
+    return typeof x === "object" && x !== null && reqStr(x.scope) && safeRelPath(x.rel);
+}
 function coerceSessionAccounts(raw) {
     if (raw === undefined)
-        return { version: 1, rows: [] };
+        return { version: 2, rows: [] };
     const rec = raw;
     if (typeof rec !== "object" || rec === null || !Array.isArray(rec.rows))
         throw new ControlPlaneCorruptError("memory session-account ledger has the wrong shape");
-    if (rec.version !== 1)
+    if (rec.version !== 1 && rec.version !== 2)
         throw new ControlPlaneCorruptError(`memory session-account ledger has an unrecognized version (${String(rec.version)}) — refusing (fail-closed)`);
-    for (const r of rec.rows) {
+    const bad = () => {
+        throw new ControlPlaneCorruptError("memory session-account ledger: a row is malformed — refusing (fail-closed; an unevaluable row must not read as adjudicated)");
+    };
+    const rows = rec.rows;
+    for (const r of rows) {
         const row = r;
-        if (typeof row !== "object" ||
-            row === null ||
-            !reqStr(row.sessionId) ||
-            typeof row.openedAt !== "number" ||
-            !Number.isFinite(row.openedAt) ||
-            !Array.isArray(row.unattributed) ||
-            row.unattributed.some((x) => typeof x !== "string") ||
-            (row.closedAt !== undefined && (typeof row.closedAt !== "number" || !Number.isFinite(row.closedAt))) ||
-            (row.unadjudicated !== undefined && row.unadjudicated !== true)) {
-            throw new ControlPlaneCorruptError("memory session-account ledger: a row is malformed — refusing (fail-closed; an unevaluable row must not read as adjudicated)");
+        if (malformedAccountRow(row))
+            bad();
+        const members = Array.isArray(row.unattributed) ? row.unattributed : bad();
+        if (rec.version === 1) {
+            if (members.some((x) => typeof x !== "string"))
+                bad();
         }
-    }
-    return rec;
+        else {
+            if (!members.every(isUnattributedMember))
+                bad();
+            if (row.unattributable !== undefined && (!Array.isArray(row.unattributable) || row.unattributable.some((x) => typeof x !== "string")))
+                bad();
+        }
+    }
+    return rec.version === 1 ? { version: 1, rows: rows } : { version: 2, rows: rows };
+}
+function convertSessionAccounts(read, controlDir) {
+    if (read.version === 2)
+        return { rec: read, converted: false };
+    const resolve = v1MemoryPathKeyResolver(controlDir);
+    const rows = read.rows.map((r) => {
+        const unattributed = [];
+        const unattributable = [];
+        for (const relPath of r.unattributed) {
+            const key = resolve(relPath);
+            if (key === undefined)
+                unattributable.push(relPath);
+            else
+                unattributed.push(key);
+        }
+        return {
+            sessionId: r.sessionId,
+            openedAt: r.openedAt,
+            unattributed,
+            ...(unattributable.length > 0 ? { unattributable } : {}),
+            ...(r.closedAt !== undefined ? { closedAt: r.closedAt } : {}),
+            ...(r.unadjudicated !== undefined ? { unadjudicated: r.unadjudicated } : {}),
+        };
+    });
+    return { rec: { version: 2, rows }, converted: true };
+}
+export function convertV1SidecarKeys(controlDir) {
+    readProjectionDebts(controlDir);
+    readHolds(controlDir);
+    readSessionAccountsConverted(controlDir);
+}
+function readSessionAccountsConverted(controlDir) {
+    const read = coerceSessionAccounts(readStrictSidecar(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger"));
+    if (read.version === 2)
+        return read;
+    return lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (again) => {
+        const { rec, converted } = convertSessionAccounts(again, controlDir);
+        return converted ? { next: rec, result: rec } : { result: rec };
+    });
 }
 export function foreignDanglingSessionAccounts(controlDir, selfSessionId) {
-    const rec = coerceSessionAccounts(readStrictSidecar(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger"));
+    const rec = readSessionAccountsConverted(controlDir);
     return rec.rows.filter((r) => r.sessionId !== selfSessionId && (r.closedAt === undefined || r.unadjudicated === true));
 }
+export function emptyUnattributedSet() {
+    return { has: () => false, empty: true };
+}
+function memberKey(scope, rel) {
+    return JSON.stringify([scope, rel]);
+}
 export function openSessionAccount(controlDir, input) {
-    lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (rec) => {
+    lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (read) => {
+        const { rec } = convertSessionAccounts(read, controlDir);
         const row = rec.rows.find((r) => r.sessionId === input.sessionId);
         if (row === undefined) {
             rec.rows.push({ sessionId: input.sessionId, openedAt: input.now(), unattributed: [...input.unattributed] });
@@ -276,17 +341,25 @@ export function openSessionAccount(controlDir, input) {
             row.openedAt = input.now();
             delete row.closedAt;
             delete row.unadjudicated;
-            row.unattributed = [...new Set([...row.unattributed, ...input.unattributed])];
+            const merged = new Map(row.unattributed.map((m) => [memberKey(m.scope, m.rel), m]));
+            for (const m of input.unattributed)
+                merged.set(memberKey(m.scope, m.rel), { scope: m.scope, rel: m.rel });
+            row.unattributed = [...merged.values()];
         }
         return { next: rec, result: undefined };
     });
 }
 export function sessionUnattributedSet(controlDir, sessionId) {
-    const rec = coerceSessionAccounts(readStrictSidecar(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger"));
-    return new Set(rec.rows.find((r) => r.sessionId === sessionId)?.unattributed ?? []);
+    const row = readSessionAccountsConverted(controlDir).rows.find((r) => r.sessionId === sessionId);
+    if (row === undefined)
+        return emptyUnattributedSet();
+    const all = (row.unattributable?.length ?? 0) > 0;
+    const keys = new Set(row.unattributed.map((m) => memberKey(m.scope, m.rel)));
+    return { has: (scope, rel) => all || keys.has(memberKey(scope, rel.split("\\").join("/"))), empty: !all && keys.size === 0 };
 }
 export function closeSessionAccount(controlDir, input) {
-    return lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (rec) => {
+    return lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (read) => {
+        const { rec } = convertSessionAccounts(read, controlDir);
         const row = rec.rows.find((r) => r.sessionId === input.sessionId);
         if (row === undefined)
             return { result: false };
@@ -303,7 +376,8 @@ export function resolveSessionAccountRecord(controlDir, input) {
         e.code = "memory.session_account_resolve_unattributed";
         throw e;
     }
-    lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (rec) => {
+    lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (read) => {
+        const { rec } = convertSessionAccounts(read, controlDir);
         const row = rec.rows.find((r) => r.sessionId === input.sessionId);
         if (row === undefined) {
             const e = new Error(`resolveSessionAccount: unknown sessionId ${JSON.stringify(input.sessionId)}`);
@@ -321,21 +395,23 @@ const HOLD_STATUSES = new Set(["capturing", "held", "released", "disposed"]);
 const HOLD_TERMINALS = new Set(["dirty", "expired", "conflict", "discarded", "capture_lost"]);
 function coerceHolds(raw) {
     if (raw === undefined)
-        return { version: 1, rows: [] };
+        return { version: 2, rows: [] };
     const rec = raw;
     if (typeof rec !== "object" || rec === null || !Array.isArray(rec.rows))
         throw new ControlPlaneCorruptError("memory instruction-hold ledger has the wrong shape");
-    if (rec.version !== 1)
+    if (rec.version !== 1 && rec.version !== 2)
         throw new ControlPlaneCorruptError(`memory instruction-hold ledger has an unrecognized version (${String(rec.version)}) — refusing (fail-closed)`);
-    for (const r of rec.rows) {
+    const v1 = rec.version === 1;
+    const rows = [];
+    const raws = rec.rows;
+    for (const r of raws) {
         const row = r;
         if (typeof row !== "object" ||
             row === null ||
             !reqStr(row.holdId) ||
             !reqStr(row.sessionId) ||
             (row.op !== "add" && row.op !== "update") ||
-            !reqStr(row.relPath) ||
-            !reqStr(row.slug) ||
+            !safeRelPath(row.slug) ||
             !reqStr(row.scope) ||
             !reqStr(row.captureName) ||
             !reqStr(row.contentDigest) ||
@@ -350,15 +426,28 @@ function coerceHolds(raw) {
             (row.entryId !== undefined && typeof row.entryId !== "string") ||
             (row.baseRev !== undefined && typeof row.baseRev !== "string") ||
             (row.op === "update" && (!reqStr(row.entryId) || !reqStr(row.baseRev))) ||
-            !safeRelPath(row.relPath) ||
+            (v1 ? !safeRelPath(row.relPath) : !safeRelPath(row.rel)) ||
             !safeBasename(row.captureName)) {
             throw new ControlPlaneCorruptError("memory instruction-hold ledger: a row is malformed — refusing (fail-closed; an unevaluable hold must not read as settled)");
         }
+        if (v1) {
+            const { relPath: _relPath, ...rest } = row;
+            rows.push({ ...rest, rel: `${row.slug}.md` });
+        }
+        else {
+            rows.push(row);
+        }
     }
-    return rec;
+    return { version: 2, rows };
+}
+function holdsOnDiskAreV1(raw) {
+    return typeof raw === "object" && raw !== null && raw.version === 1;
 }
 export function readHolds(controlDir) {
-    return coerceHolds(readStrictSidecar(controlDir, HOLDS_FILE, "memory instruction-hold ledger")).rows;
+    const raw = readStrictSidecar(controlDir, HOLDS_FILE, "memory instruction-hold ledger");
+    if (!holdsOnDiskAreV1(raw))
+        return coerceHolds(raw).rows;
+    return lockedStrictUpdate(controlDir, HOLDS_FILE, "memory instruction-hold ledger", coerceHolds, (again) => ({ next: again, result: again.rows }));
 }
 function sha256(buf) {
     return createHash("sha256").update(buf).digest("hex");
@@ -397,7 +486,7 @@ export function noReplaceRestore(stagingPath, destPath) {
     return "restored";
 }
 export function openInstructionHold(controlDir, input) {
-    const holdId = `hold-${input.now()}-${createHash("sha256").update(`${input.sessionId}\n${input.relPath}\n${input.content}`).digest("hex").slice(0, 12)}`;
+    const holdId = `hold-${input.now()}-${createHash("sha256").update(`${input.sessionId}\n${input.rel}\n${input.content}`).digest("hex").slice(0, 12)}`;
     const buf = Buffer.from(input.content, "utf8");
     const digest = sha256(buf);
     const captureName = `${holdId}.md`;
@@ -420,7 +509,7 @@ export function openInstructionHold(controlDir, input) {
                 ...(input.entryId !== undefined ? { entryId: input.entryId } : {}),
                 op: input.op,
                 ...(input.baseRev !== undefined ? { baseRev: input.baseRev } : {}),
-                relPath: input.relPath,
+                rel: input.rel,
                 slug: input.slug,
                 scope: input.scope,
                 captureName,
@@ -490,12 +579,12 @@ export function openInstructionHold(controlDir, input) {
 }
 export function reconcileHolds(controlDir, input) {
     const holdDir = join(controlDir, HOLD_DIR);
-    const discloseStranded = (holdId, relPath, stagingName) => {
+    const discloseStranded = (holdId, rel, stagingName) => {
         try {
             enqueueMemoryAnnouncement(controlDir, {
                 kind: "gate",
                 at: input.now(),
-                items: [`instruction hold ${holdId}: a concurrent writer's bytes for ${JSON.stringify(relPath)} could not be restored onto the plane — they are preserved at hold/${stagingName} in the memory control plane for host recovery`],
+                items: [`instruction hold ${holdId}: a concurrent writer's bytes for ${JSON.stringify(rel)} could not be restored onto the plane — they are preserved at hold/${stagingName} in the memory control plane for host recovery`],
             });
         }
         catch {
@@ -512,7 +601,7 @@ export function reconcileHolds(controlDir, input) {
                 terminalLost = true;
             }
             else {
-                const plane = join(input.memoryDir, row.relPath);
+                const plane = join(input.homeOf(row.scope), row.rel);
                 if (existsSync(plane)) {
                     try {
                         const stagingName = uniqueStagingName(row.holdId, input.now);
@@ -522,7 +611,7 @@ export function reconcileHolds(controlDir, input) {
                             unlinkSync(staging);
                         }
                         else if (noReplaceRestore(staging, plane) === "stranded") {
-                            discloseStranded(row.holdId, row.relPath, stagingName);
+                            discloseStranded(row.holdId, row.rel, stagingName);
                         }
                     }
                     catch {
@@ -531,7 +620,7 @@ export function reconcileHolds(controlDir, input) {
             }
         }
         else {
-            const plane = join(input.memoryDir, row.relPath);
+            const plane = join(input.homeOf(row.scope), row.rel);
             if (existsSync(plane)) {
                 const bytes = readFileSync(plane);
                 if (sha256(bytes) === row.contentDigest) {
@@ -549,7 +638,7 @@ export function reconcileHolds(controlDir, input) {
                             }
                         }
                         else if (noReplaceRestore(staging, plane) === "stranded") {
-                            discloseStranded(row.holdId, row.relPath, stagingName);
+                            discloseStranded(row.holdId, row.rel, stagingName);
                         }
                     }
                     catch {

package/dist/core/memory-engine/engine.d.ts

@@ -1186,6 +1186,10 @@ export declare class MemoryEngine {
      *  eventId anchors on the pollution record (sessionId + marked-at), so however many times this
      *  settlement replays the same pollution event, the generation is allocated once. */
     private settlePromotions;
+    /** The layout-adoption seat of a mount: a backend pinning its own directory root adopts under its
+     *  transaction lock; a copy-out projection tree and a backend without the face are adopted by the
+     *  engine directly (registry lock only — nothing else writes those trees during a mount). */
+    private adoptLayoutBeforeMount;
     materialize(scopes: readonly string[], writeScope: string | null, opts?: {
         adoptionRestricted?: boolean;
         sessionId?: string;
@@ -1242,6 +1246,9 @@ export declare class MemoryEngine {
      * Throws only on a corrupt hold/settlement ledger — the caller's fail-closed reconciliation arm
      * refuses the harvest (integrity unknown must not read as "no holds").
      */
+    /** A hold's plane seat as a memory-dir-relative path (the report/warning spelling every other
+     *  harvest path uses), derived from the ledger-form row. */
+    private holdPlaneRel;
     private settleDueHolds;
     /**
      * The release leg: re-walk the captured bytes through the FULL gate set and commit them under
@@ -1663,8 +1670,6 @@ export declare class MemoryEngine {
      * @returns the rejection to report, or `undefined` when the index is clean/absent.
      */
     private gateDerivedIndex;
-    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans; public since #691 — the runner refuses to admit a writable root that contains another scope's directory to the file tools' allowlist). */
-    readonlyDirNamesUnderRoot(handle: MemorySessionHandle): Set<string>;
     /** Projection write: reads the target to skip a no-op, then writes — the same check-then-use shape
      *  as the containment restores, so it takes the same no-follow write. A link at a projection path
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this
@@ -1699,12 +1704,8 @@ export declare class MemoryEngine {
      * `getByIds` there would sync-adopt mid-harvest.
      */
     private debtCommittedProjection;
-    /** Sibling scope subdir names under `dir` (excluded from a scope-tree walk when `dir` is the root —
-     *  a root-owning layer's chmod/restore must never touch another scope's home). */
-    private siblingScopeDirNames;
-    /** chmod a scope's entry tree (best-effort; skipRoot leaves the top dir writable — used when a
-     *  read-only layer's dir IS the shared root / an ancestor of the writable root, which must stay
-     *  traversable+writable; excludeTopDirs skips sibling scope homes under a root-owning layer).
+    /** chmod a scope's entry tree (best-effort). The tree is the scope's own home and nothing else —
+     *  no other scope's directory can lie under it.
      *
      *  `opts.announced` is the CALLER's per-materialize ledger of paths already disclosed (#495 M-1).
      *  One materialize sweeps each inherited tree TWICE — restore write perms at the top, re-apply