@sema-agent/core 7.30.1 → 7.31.1

package/dist/core/engine-notice.d.ts

@@ -277,6 +277,10 @@ export interface EngineNotice {
      *  - `"config.execution_env_capability_invalid"` — a remote env DECLARES a boolean capability key
      *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
      *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
+     *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy withheld one or more
+     *    secret-shaped keys from a spawned child's environment (a tool's shell, or a language server).
+     *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
+     *    `detail: { names }` — every withheld key's name, never a value.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the

package/dist/core/governance-codes.d.ts

@@ -119,7 +119,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -37,6 +37,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.restore_withheld",
     "memory.project_scope_absent",
     "memory.projection_failed",
+    "memory.observation_settlement_unavailable",
     "memory.consolidation_disabled",
     "memory.consolidation_gated",
     "memory.consolidation_busy",
@@ -82,6 +83,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.capture_optout_unpersisted",
     "memory.capture_optout_unavailable",
     "memory.capture_optout_sweep_failed",
+    "memory.target_outside_store",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {
@@ -125,6 +127,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.durable_gate_unavailable",
     "config.peer_admission_out_of_range",
     "config.peer_lane_unmounted",
+    "config.secret_env_scrubbed",
     "peer.inbound_disposition",
     "peer.held_settled",
     "peer.idle_subscription",
@@ -217,6 +220,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_face_invalid": "operator",
     "config.peer_lane_unmounted": "operator",
     "config.peer_admission_out_of_range": "operator",
+    "config.secret_env_scrubbed": "operator",
     "peer.inbound_disposition": "user",
     "peer.held_settled": "user",
     "peer.idle_subscription": "user",

package/dist/core/memory-engine/data-plane.d.ts

@@ -32,7 +32,9 @@ export interface RemoteMemoryBaseline {
     readonlyDirs?: string[];
 }
 export interface RemoteMaterialization {
-    /** Ship these into the sandbox memory root (the deployment owns the transport + any chmod). */
+    /** Ship these into the sandbox memory root (the deployment owns the transport). `readonly` is the
+     *  session's policy, enforced by {@link harvestFilesToPatches}' `readonly_layer` rejection; whether
+     *  to also set permission bits on its own volume is the deployment's call — the engine sets none. */
     files: Array<RemoteMemoryFile & {
         readonly: boolean;
     }>;

package/dist/core/memory-engine/data-plane.js

@@ -2,7 +2,7 @@ import { uuidv7 } from "../../internal/harness.js";
 import { firstSentence } from "../memory.js";
 import { computeEntryRev, parseEntryFile, serializeEntryFile } from "./frontmatter.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
-import { MEMORY_INDEX_FILENAME } from "./file-backend.js";
+import { MEMORY_INDEX_FILENAME } from "./entry-scan.js";
 import { scopeDirName } from "./layout.js";
 export const REMOTE_HARVEST_PER_FILE_BYTES = 100 * 1024;
 export const REMOTE_MASS_DELETION_FUSE_RATIO = 0.5;

package/dist/core/memory-engine/delegation-settlement.d.ts

@@ -153,6 +153,19 @@ export interface UnattributedMember {
 export interface SessionAccountRow {
     sessionId: string;
     openedAt: number;
+    /** The scope this session writes (its write home) — the layer it is a live writer of until
+     *  `terminatedAt` ({@link openLayerWriters}). Absent on rows written before the field. */
+    writeScope?: string;
+    /** The session's leg ENDED here: its terminal harvest returned (whatever it admitted — a refused,
+     *  zero-admission or budget-deferred pass ends the leg all the same), or the host valve closed the
+     *  row. A lifecycle fact, independent of `closedAt` (every full harvest closes the account — a
+     *  checkpoint harvest too — while the session may keep writing); cleared when a resume re-opens
+     *  the row. */
+    terminatedAt?: number;
+    /** The LEG that holds the row now: minted by the materialize that opened (or re-opened) it and
+     *  carried on that mount's handle. A close or a leg end made for another leg — an earlier leg
+     *  whose harvest finished after a resume re-opened the row — is not this leg's and is not written. */
+    leg?: string;
     /** The STICKY unattributed set, frozen at materialize (§3.6 归属判据): pre-existing, uncommitted
      *  files seen while a FOREIGN dangling open row stood. Membership never shrinks on later writes
      *  (the sticky law); it clears only when the row is re-opened with a fresh classification (the
@@ -175,6 +188,20 @@ export declare function convertV1SidecarKeys(controlDir: string): void;
 /** The dangling-trigger read: open rows (and unadjudicated closes) belonging to OTHER sessions.
  *  These are what arm the unattributed residue classification at a session's materialize. */
 export declare function foreignDanglingSessionAccounts(controlDir: string, selfSessionId: string): SessionAccountRow[];
+/** The live writers of the store's layers, as the account knows them: every row other than the one
+ *  held by `selfLeg` (the asking mount's own leg — another leg of the same session is another
+ *  writer) whose session's leg has not ended (no `terminatedAt` — running, or ended without
+ *  a terminal close, e.g. a crash), by its write scope. A row written before the write scope was
+ *  recorded (the engine then closed the account at every full harvest, so its close cannot say
+ *  whether the leg ended) reads as before: live while never closed, counted in `unscoped` — a
+ *  writer of an unknown layer. Sessions that open no row (no session id, provenance "off", an
+ *  adoption-restricted mount) are not visible here. */
+export declare function openLayerWriters(controlDir: string, selfLeg: string | undefined): {
+    scopes: Set<string>;
+    unscoped: number;
+};
+/** The leg that holds `sessionId`'s account row (undefined ⇔ no row, or a row without one). */
+export declare function sessionAccountLeg(controlDir: string, sessionId: string): string | undefined;
 /** The membership question the harvest asks per file: is `(scope, rel)` in the session's sticky
  *  set? A session carrying members the conversion could not attribute answers yes for every seat. */
 export interface SessionUnattributedSet {
@@ -189,6 +216,8 @@ export declare function openSessionAccount(controlDir: string, input: {
     sessionId: string;
     now: () => number;
     unattributed: readonly UnattributedMember[];
+    writeScope?: string;
+    leg?: string;
 }): void;
 /** The current session's sticky unattributed set (the harvest's residue-arm input). */
 export declare function sessionUnattributedSet(controlDir: string, sessionId: string): SessionUnattributedSet;
@@ -203,13 +232,25 @@ export declare function sessionUnattributedSet(controlDir: string, sessionId: st
  *  condition and does not hold the close, but the caller DISCLOSES any standing deferral beside it
  *  (a close over id-less deferred files must not read as a clean full pass).
  *
- *  Returns whether a row was actually closed: absent ⇒ `false` (a session that never opened an
+ *  Returns what happened ({@link SessionAccountWrite}): `"absent"` (a session that never opened an
  *  account — e.g. an adoption-restricted materialize — has no close, and the caller's disclosure
- *  must not claim one). */
+ *  must not claim one), or `"stale"` when `leg` names a mount that no longer holds the row. */
 export declare function closeSessionAccount(controlDir: string, input: {
     sessionId: string;
     now: () => number;
-}): boolean;
+    leg?: string;
+}): SessionAccountWrite;
+/** What a close / leg end did: wrote the row, found none, or found the row held by ANOTHER leg (the
+ *  caller's leg is over — a resume re-opened the row — so nothing was written). */
+export type SessionAccountWrite = "written" | "absent" | "stale";
+/** Record that the session's leg ended ({@link SessionAccountRow.terminatedAt}). Touches nothing
+ *  else — `closedAt` stays whatever the harvests made it. `leg` (the caller's mount) must hold the
+ *  row: a leg that is over does not end the one that re-opened it. */
+export declare function terminateSessionAccount(controlDir: string, input: {
+    sessionId: string;
+    now: () => number;
+    leg?: string;
+}): SessionAccountWrite;
 /** The host valve for a dangling row (advisory; §3.6 — dangling rows never auto-expire). The
  *  close is `closed-unadjudicated` (r7-3): it stops the row dangling but the residue arm keeps
  *  firing until a full-domain harvest closes normally. `requestId` required (audit, #123). */

package/dist/core/memory-engine/delegation-settlement.js

@@ -242,6 +242,8 @@ function malformedAccountRow(row) {
         !Number.isFinite(row.openedAt) ||
         !Array.isArray(row.unattributed) ||
         (row.closedAt !== undefined && (typeof row.closedAt !== "number" || !Number.isFinite(row.closedAt))) ||
+        (row.terminatedAt !== undefined && (typeof row.terminatedAt !== "number" || !Number.isFinite(row.terminatedAt))) ||
+        (row.leg !== undefined && !reqStr(row.leg)) ||
         (row.unadjudicated !== undefined && row.unadjudicated !== true));
 }
 function isUnattributedMember(x) {
@@ -273,6 +275,8 @@ function coerceSessionAccounts(raw) {
                 bad();
             if (row.unattributable !== undefined && (!Array.isArray(row.unattributable) || row.unattributable.some((x) => typeof x !== "string")))
                 bad();
+            if (row.writeScope !== undefined && !reqStr(row.writeScope))
+                bad();
         }
     }
     return rec.version === 1 ? { version: 1, rows: rows } : { version: 2, rows: rows };
@@ -320,6 +324,13 @@ export function foreignDanglingSessionAccounts(controlDir, selfSessionId) {
     const rec = readSessionAccountsConverted(controlDir);
     return rec.rows.filter((r) => r.sessionId !== selfSessionId && (r.closedAt === undefined || r.unadjudicated === true));
 }
+export function openLayerWriters(controlDir, selfLeg) {
+    const open = readSessionAccountsConverted(controlDir).rows.filter((r) => (selfLeg === undefined || r.leg !== selfLeg) && (r.writeScope !== undefined ? r.terminatedAt === undefined : r.closedAt === undefined));
+    return { scopes: new Set(open.flatMap((r) => (r.writeScope !== undefined ? [r.writeScope] : []))), unscoped: open.filter((r) => r.writeScope === undefined).length };
+}
+export function sessionAccountLeg(controlDir, sessionId) {
+    return readSessionAccountsConverted(controlDir).rows.find((r) => r.sessionId === sessionId)?.leg;
+}
 export function emptyUnattributedSet() {
     return { has: () => false, empty: true };
 }
@@ -330,8 +341,17 @@ export function openSessionAccount(controlDir, input) {
     lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (read) => {
         const { rec } = convertSessionAccounts(read, controlDir);
         const row = rec.rows.find((r) => r.sessionId === input.sessionId);
+        if (row !== undefined && input.writeScope !== undefined)
+            row.writeScope = input.writeScope;
+        if (row !== undefined) {
+            delete row.terminatedAt;
+            if (input.leg !== undefined)
+                row.leg = input.leg;
+            else
+                delete row.leg;
+        }
         if (row === undefined) {
-            rec.rows.push({ sessionId: input.sessionId, openedAt: input.now(), unattributed: [...input.unattributed] });
+            rec.rows.push({ sessionId: input.sessionId, openedAt: input.now(), ...(input.writeScope !== undefined ? { writeScope: input.writeScope } : {}), ...(input.leg !== undefined ? { leg: input.leg } : {}), unattributed: [...input.unattributed] });
         }
         else if (row.closedAt !== undefined && row.unadjudicated === undefined) {
             row.openedAt = input.now();
@@ -363,12 +383,26 @@ export function closeSessionAccount(controlDir, input) {
         const { rec } = convertSessionAccounts(read, controlDir);
         const row = rec.rows.find((r) => r.sessionId === input.sessionId);
         if (row === undefined)
-            return { result: false };
+            return { result: "absent" };
+        if (input.leg !== undefined && row.leg !== input.leg)
+            return { result: "stale" };
         row.closedAt = input.now();
         delete row.unadjudicated;
         for (const r of rec.rows)
             delete r.unadjudicated;
-        return { next: rec, result: true };
+        return { next: rec, result: "written" };
+    });
+}
+export function terminateSessionAccount(controlDir, input) {
+    return lockedStrictUpdate(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger", coerceSessionAccounts, (read) => {
+        const { rec } = convertSessionAccounts(read, controlDir);
+        const row = rec.rows.find((r) => r.sessionId === input.sessionId);
+        if (row === undefined)
+            return { result: "absent" };
+        if (input.leg !== undefined && row.leg !== input.leg)
+            return { result: "stale" };
+        row.terminatedAt = input.now();
+        return { next: rec, result: "written" };
     });
 }
 export function resolveSessionAccountRecord(controlDir, input) {
@@ -387,6 +421,7 @@ export function resolveSessionAccountRecord(controlDir, input) {
         }
         row.closedAt = input.now();
         row.unadjudicated = true;
+        row.terminatedAt = row.closedAt;
         return { next: rec, result: undefined };
     });
 }

package/dist/core/memory-engine/engine.d.ts

@@ -1,6 +1,6 @@
 import type { EngineNotice } from "../types.js";
 import { type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationPlanFile, type ConsolidationProposal, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
-import { foreignDanglingSessionAccounts, type EffectiveSettlement, type HoldRow } from "./delegation-settlement.js";
+import { foreignDanglingSessionAccounts, type SessionAccountWrite, type EffectiveSettlement, type HoldRow } from "./delegation-settlement.js";
 import { type OriginClearanceRow } from "./origin-clearance.js";
 import { type CommittedBinding, type EraseMemoryEntriesInput, type MemoryErasureAttestation, type TransferEvidence } from "./file-backend.js";
 import { type MemoryExportBundle, type MemoryImportReport } from "./export-bundle.js";
@@ -155,7 +155,8 @@ export declare const MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA = "Any guidance in
  * about the state itself, and a model asked "remember X" under that silence answers with a success
  * receipt for a save that never happens (the confabulated-receipt shape). This section states the
  * state instead. Mounted only where "you cannot save" is provably TRUE: by `inject()` for a
- * read-only layering (writeScope null ⇒ chmod'd tree), and by the runner for handsReadOnly (the
+ * read-only layering (writeScope null ⇒ the harvest admits nothing and the file-tool gate refuses the
+ * whole memory domain), and by the runner for handsReadOnly (the
  * shell rides the read-only band), for a declared-unavailable session (`memoryPersistenceCapable:
  * false` — where the runner's write gate also refuses the file channel, keeping the engine-refusal
  * sentence true), and for a write-less roster the persistence inference cannot vouch for. A merely
@@ -310,7 +311,7 @@ export interface MemoryEngineOptions {
     /** M7 — max files PROCESSED per harvest (default {@link DEFAULT_HARVEST_FILE_BUDGET}). */
     harvestFileBudget?: number;
     /**
-     * Where this engine's advisory incidents go. Two codes ride it:
+     * Where this engine's advisory incidents go. Codes that ride it include:
      *  - `memory.partition_split` / `memory.partition_adopt_failed` — the mount-time partition-key probe,
      *    when this engine derives its OWN control dir (no `controlDir`, backend pins none). Same seat and
      *    same reason as the file backend's option: the probe promises "never silent", and on this
@@ -319,6 +320,9 @@ export interface MemoryEngineOptions {
      *    The queue is the DISCLOSURE lane for out-of-session memory events, and its own failures used to
      *    be swallowed at four call sites: a host whose control plane went unwritable kept seeing healthy
      *    sessions while every gate/external notice was dropped on the floor.
+     *  - `memory.observation_settlement_unavailable` — once per engine, at a zero-copy materialize over a
+     *    backend without the committed-snapshot face: changes observed in read-only layers are recorded
+     *    undecided and cannot settle on it.
      * Absent ⇒ advisory-silent; neither a mount nor a harvest ever fails over this seat.
      */
     onIncident?: MemoryPartitionIncidentSink;
@@ -343,8 +347,8 @@ export interface MemoryInjection {
     /** CC `# Memory` section (system-authority instruction — §0.3 逐字 surface). Empty for a read-only
      *  layering (no write channel to instruct). */
     instruction: string;
-    /** Present exactly when this is a read-only LAYERING (writeScope null — the tree is chmod'd
-     *  read-only, so no tool writes into it whatever the roster): the {@link MEMORY_READONLY_NOTICE}
+    /** Present exactly when this is a read-only LAYERING (writeScope null — the harvest admits
+     *  nothing from this session, whatever the roster writes): the {@link MEMORY_READONLY_NOTICE}
      *  section stating that memory cannot be saved to, so the model declines "remember X" instead of
      *  issuing a confabulated success receipt. NOT set for `writeToolMounted:false` over a writable
      *  scope — there only the instruction-named tool is absent, other roster tools can still write the
@@ -829,6 +833,8 @@ export interface SessionMemoryStatus {
 export declare class MemoryEngine {
     private readonly backend;
     private readonly memoryDir;
+    /** {@link memoryDir}'s physical form as this engine first mounted it; every later mount compares, never re-resolves. */
+    private mountedRoot;
     private readonly controlDir;
     private readonly now;
     private readonly perScopeBudgetBytes;
@@ -843,6 +849,7 @@ export declare class MemoryEngine {
     private readonly provenance;
     /** {@link MemoryEngineOptions.onIncident} — the advisory disclosure seat (partition + announce codes). */
     private readonly onIncident;
+    private unsettleableDisclosed;
     /** A backend-pinned directory (FileBackend zero-copy detection). */
     private readonly backendPinnedRoot?;
     constructor(opts: MemoryEngineOptions);
@@ -858,6 +865,94 @@ export declare class MemoryEngine {
     get provenanceMode(): "off" | "carry";
     /** {@link MemoryEngineOptions.consolidation}, screened — undefined ⇔ the protocol is OFF. */
     private readonly consolidation?;
+    /**
+     * Record that this mount's leg of `sessionId` ended — its terminal harvest returned or threw, or
+     * the run that mounted it will never harvest (a prepare that failed after the mount). Writer
+     * liveness (`SessionAccountRow.terminatedAt`) is the session's lifecycle, so this is the one mint
+     * of it besides the host valve. Only the leg the handle opened is ended (`"stale"`: a resume
+     * re-opened the row, and the later leg is still live). A record that cannot be written leaves the
+     * row reading live (restores of its layer withheld) and is disclosed, never silent.
+     */
+    endSessionLeg(handle: MemorySessionHandle, sessionId: string): SessionAccountWrite | undefined;
+    private endLeg;
+    /** design/336 §3.6 (slice 2) — the session-account incident channel (`memory.session_account_failed`):
+     *  a degraded residue classification is DISCLOSED, never quiet (the behavioral fail-closed half —
+     *  harvest refusing on `handle.sessionAccountFailed` — is enforced at the write boundary). */
+    private discloseSessionAccountIncident;
+    /** Read-only layer integrity, DETECTION half — run on every harvest path, before any exit. A
+     *  read-only layer is this session's POLICY (the file-tool gate refuses writes into it; nothing on
+     *  disk enforces it), so a layer file that differs from what this session was served is a
+     *  `readonly_layer` rejection whatever the arm — unless its bytes EQUAL the committed copy: then a
+     *  session that may write this layer committed them while this one ran (the same transactional
+     *  proof the restricted committed view reads), and there is nothing to reject or put back.
+     *  Returns what the RESTORE half may put back ({@link restoreReadOnlyLayers}): only a session that
+     *  may commit ever restores, and only once the harvest's fail-closed preflights (journal recovery
+     *  included) passed — a session that admits nothing (read-only layering, capture opt-out,
+     *  persistence declared unavailable, an indeterminate capture state) only detects and reports: it
+     *  never adjudicates a shared layer on disk, and the boundary audit of that arm names the same
+     *  divergence on the inbound channel. */
+    private detectReadOnlyLayerChanges;
+    /** The committed copy of `id` read WITHOUT an adopting sync: a File backend's ordinary `getByIds`
+     *  adopts pending disk edits across every registered scope, which a session that admits nothing
+     *  must never trigger — its committed view (`restrictedAdoptionView`, audit off) is read instead.
+     *  Zero-copy reads the committed shadow already, and a backend without that view has no read-side
+     *  adoption channel (its plain reads serve committed rows). */
+    private committedContentUnadopted;
+    /** Read-only layer integrity, RESTORE half (zero-copy hazard: the changed file IS the backend's
+     *  storage, and left in place a later read-side sync would adopt it as the layer's baseline). It
+     *  acts on the committed account AS IT STANDS NOW — after the preflights recovered any interrupted
+     *  transaction — never on what detection read before them: the file and its committed copy are
+     *  read again, and bytes that now equal the committed copy were a commit (the early rejection was
+     *  judged against a stale account and is withdrawn; nothing is written). A restore that could not
+     *  land is a warning, never a silent skip. */
+    private restoreReadOnlyLayers;
+    /** Read-only layer integrity, OBSERVATION half — run on every harvest path with the detection
+     *  half. Every file of a layer this session holds read-only whose bytes changed in the window
+     *  (against the materialize-time census) is a candidate; one that no commit backs at its seat is
+     *  recorded in the session-observation table, which every door into the committed account
+     *  consults: the bytes are never adopted, whoever reads next. A file this session was not served
+     *  (a new file, with or without an entry id) is rejected here; a served entry's change is the
+     *  detection half's rejection. The commit question is answered only by a committed account that
+     *  can be read whole — a pending transaction journal (a writer mid-commit, or one that died there)
+     *  makes it undecidable, never "not committed": those candidates are recorded UNDECIDED (never
+     *  adopted meanwhile) and returned; a writing session settles every undecided row once its
+     *  preflight has recovered the journal (the restore half's rule). Zero-copy only (the census is taken there): that is where the
+     *  observed plane IS the store the read side adopts from. A record that cannot be written is a
+     *  warning — the next session may then adopt the bytes, which must not happen silently. */
+    private observeReadOnlyLayers;
+    /** Write an observation batch AS JUDGED (a retry writes the same rows — same baseline, same
+     *  observation time — never a re-judgment against a later account). Only a landed batch claims
+     *  anything: its rejections now, its undecided rows' disclosure at the conclusion. A failure is
+     *  kept, and said only once no retry follows ({@link concludeObservations}). */
+    private landObservations;
+    /** Where the harvest leaves the observation half for good: a batch that never landed is said (once,
+     *  with its last failure); a landed batch's undecided rows are named. */
+    private concludeObservations;
+    /** Candidates the committed account could not answer for are named, never silently dropped. */
+    private discloseUndecidedObservations;
+    /** The settlement of undecided observation rows — run by a session that may write, right after its
+     *  preflight recovered any pending journal, each row by its own key: removed when the committed
+     *  account backs its bytes at its seat (they are committed content), otherwise pinned to the
+     *  committed rev read here — an ordinary row, retired like any other when that rev moves; a row the
+     *  account still cannot answer for stays undecided.
+     *  This session's own undecided candidates that settle
+     *  as unexpected writes and were not served become its rejections; ones still undecidable are
+     *  named. */
+    private settleUndecidedObservations;
+    /** Whether the read doors refuse this content of `entryId` now: the observation table as it stands,
+     *  against the committed rev read now. Undefined when either cannot be read. */
+    private refusedNow;
+    /** Once per engine, at a zero-copy materialize: a backend without `committedSnapshotOf` (a wrapper
+     *  that does not pass it through) records every read-only-layer change undecided, and none settles. */
+    private discloseUnsettleableObservations;
+    /** The committed row of `id`, read side-effect-free from the store's audit face: rev plus binding,
+     *  undefined when the account has no row, `"undecidable"` when the account cannot be read whole
+     *  (a pending journal, a fault, no audit face) — never a guess from a copy that carries no seat. */
+    private committedRowOf;
+    /** A caught memory-write failure as a report / incident line: its text, plus the remedy when the
+     *  file system refused it on permissions ({@link withPermissionRemedy} — the one spelling every
+     *  write seat surfaces, so no seat renders a permission refusal as a bare errno). */
+    private writeFailureText;
     /**
      * The ONE delivery point for a failed announcement-queue operation (`memory.announce_failed`, ruled
      * 2026-08-03). Every enqueue/drain call site stays fail-OPEN — a broken queue must never fail a
@@ -869,10 +964,6 @@ export declare class MemoryEngine {
      * failure produces no second-order disclosure — the alternative (announcing the announce failure)
      * would recurse through the very lane that just failed.
      */
-    /** design/336 §3.6 (slice 2) — the session-account incident channel (`memory.session_account_failed`):
-     *  a degraded residue classification is DISCLOSED, never quiet (the behavioral fail-closed half —
-     *  harvest refusing on `handle.sessionAccountFailed` — is enforced at the write boundary). */
-    private discloseSessionAccountIncident;
     private discloseAnnounceFailure;
     /**
      * Record retrieval hits (entries a memory tool actually RETURNED to the model) into this engine's
@@ -1089,6 +1180,7 @@ export declare class MemoryEngine {
      * `residuals.indexUncleared`, never silently absorbed into a clean residual set.
      */
     eraseMemoryEntries(input: EraseMemoryEntriesInput): Promise<MemoryErasureAttestation>;
+    private eraseMemoryEntriesCore;
     /**
      * design/178 v2-b (rescan hardening) — the erase-time DERIVED-INDEX sweep, both lanes. MEMORY.md
      * is the engine's model-visible distillation of entry frontmatter (name + description — routinely
@@ -1199,6 +1291,7 @@ export declare class MemoryEngine {
         sessionId?: string;
         shadowNames?: ReadonlyMap<string, string>;
     }): Promise<MemorySessionHandle>;
+    private materializeCore;
     inject(handle: MemorySessionHandle, opts?: {
         writeToolMounted?: boolean;
         reminderMark?: string;
@@ -1228,6 +1321,10 @@ export declare class MemoryEngine {
      * S2-B (O-F7/C-F3): the announcement ENQUEUE rides the harvest tail INSIDE the engine — every
      * caller (checkpoint mint / task terminal) is covered without run-loop wiring, and a refused
      * harvest (incident) announces too. The enqueue is fail-open: a broken queue never fails a harvest.
+     * `opts.phase` is the CALLER's word for where the session stands: `"terminal"` ⇔ its leg ends with
+     * this harvest, which records the leg's end on the session account once the harvest returns or
+     * throws — whatever it admitted (`SessionAccountRow.terminatedAt`); anything else, absent
+     * included, leaves the writer live.
      */
     harvest(handle: MemorySessionHandle, opts?: {
         polluted?: {
@@ -1239,6 +1336,7 @@ export declare class MemoryEngine {
             reason: string;
             cause?: "capture_optout_inherited";
         };
+        phase?: "checkpoint" | "terminal";
     }): Promise<HarvestReport>;
     private harvestCore;
     /**
@@ -1272,7 +1370,8 @@ export declare class MemoryEngine {
     resolveHold(holdId: string, action: "release" | "discard", requestId: string): void;
     /** §3.6 — the session-account valve: close a dangling foreign row WITHOUT adjudication (the
      *  residue arm keeps firing until the next full-domain harvest closes normally — a valve close
-     *  must not launder the window it covers). Audited (requestId required). */
+     *  must not launder the window it covers). It also ends the session's leg (no live writer of its
+     *  layer any more). Audited (requestId required). */
     resolveSessionAccount(sessionId: string, requestId: string): void;
     /** The engine's control-plane directory (the sidecar home: pollution markers, lineage/challenge
      *  ledgers, and the design/336 settlement/hold/session accounts). Exposed so a host (and the
@@ -1679,19 +1778,27 @@ export declare class MemoryEngine {
      * @returns the rejection to report, or `undefined` when the index is clean/absent.
      */
     private gateDerivedIndex;
+    /** The file backend's verdict at an act the engine itself performs on a store path ({@link
+     *  storeTargetEscape}): throws `memory.target_outside_store` when `path` would land outside `root`;
+     *  each caller's existing failure lane reports it. `root` is the mount's canonical root where a
+     *  handle exists, so a root re-pointed after the mount is judged against the one it mounted. */
+    private refuseOutsideStore;
     /** Projection write: reads the target to skip a no-op, then writes — the same check-then-use shape
      *  as the containment restores, so it takes the same no-follow write. A link at a projection path
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this
-     *  site already reports write failures by throwing, so ELOOP joins the failures it already had. */
+     *  site already reports write failures by throwing, so ELOOP joins the failures it already had. A
+     *  target whose directory resolves outside `root` (a directory on the path is a link) is refused
+     *  the same way, before anything is read or written ({@link storeTargetEscape}). */
     private writeIfChanged;
     /** Persist the canonical projection back to the session file (id minting / frontmatter completion).
      *  C-F6 (S2-0): called ONLY after the backend transaction committed — never ahead of the journal
      *  commit point. Skips the write when the disk already holds the canonical bytes (zero-copy: the
-     *  journal's own execute step wrote them, making this an idempotent no-op). Returns whether the
-     *  disk now holds the canonical bytes — the ordinary completion family stays best-effort on a
-     *  `false` (the next materialize re-projects), but the id-COMPLETION family's caller reads it to
-     *  keep the #366 projection-debt row standing (an id-less plane file must re-bind to its
-     *  committed id at the next harvest, never re-admit as a duplicate). */
+     *  journal's own execute step wrote them, making this an idempotent no-op). Returns `undefined`
+     *  when the disk now holds the canonical bytes, else the failure's text: the caller reports it
+     *  (the ordinary completion family stays recoverable — the backend commit is authoritative and the
+     *  next materialize re-projects), and the id-COMPLETION family additionally keeps the #366
+     *  projection-debt row standing (an id-less plane file must re-bind to its committed id at the
+     *  next harvest, never re-admit as a duplicate). */
     private writeBackProjection;
     /**
      * #366 — repair an id-less-but-committed seat IN PLACE (the failed write-back's retry): write the
@@ -1699,7 +1806,8 @@ export declare class MemoryEngine {
      * already proven the seat carries no unadmitted edit (rev equality against its baseline), so the
      * overwrite is content-preserving — it restores the id line, the completed frontmatter and any
      * carried marker, nothing else. A refused read/write leaves the row standing (retried next pass;
-     * the next materialize's projection loop repairs and settles it too).
+     * the next materialize's projection loop repairs and settles it too); a refused WRITE is said on
+     * `warnings`, so a seat that keeps failing is not silently retried forever.
      */
     private repairProjectionSeat;
     /**
@@ -1713,16 +1821,14 @@ export declare class MemoryEngine {
      * `getByIds` there would sync-adopt mid-harvest.
      */
     private debtCommittedProjection;
-    /** chmod a scope's entry tree (best-effort). The tree is the scope's own home and nothing else —
-     *  no other scope's directory can lie under it.
-     *
-     *  `opts.announced` is the CALLER's per-materialize ledger of paths already disclosed (#495 M-1).
-     *  One materialize sweeps each inherited tree TWICE — restore write perms at the top, re-apply
-     *  read-only at the bottom — and both passes see the same anomalies, so without it every skipped
-     *  path was enqueued twice, byte-identically. The chmod WORK still happens twice (it has to: the
-     *  modes really do change twice); only the disclosure is deduplicated. Absent ⇒ the historic
-     *  per-call behaviour (each call states everything it skipped). */
-    private chmodScopeTree;
+    /** The layer census: one walk of a scope's home per materialize, looking and never changing
+     *  anything. The tree is the scope's own home and nothing else — no other scope's directory can
+     *  lie under it. What it owes is DISCLOSURE: a link or an unreadable path inside a memory layer is
+     *  an anomaly the host should hear about, and a read-only layer has no other channel for it (the
+     *  harvest scan, which reports links for the writable scope, does not walk read-only layers at
+     *  all). Links are never followed (lstat): a linked directory would carry the walk out of the
+     *  tree. */
+    private censusScopeTree;
 }
 /** Render drained announcements as ONE engine-owned system-reminder block (the lead/frame is
  *  trusted; item identifiers were neutralized at enqueue — see {@link MemoryAnnouncement.items}). */