@sema-agent/core 7.30.1 → 7.31.1

package/dist/core/memory-engine/entry-scan.d.ts

@@ -0,0 +1,23 @@
+/** Files/dirs the entry scan never treats as entries: the derived index, dotfiles (`.hydrate`,
+ *  transaction staging files), and anything not `.md`. */
+export declare const MEMORY_INDEX_FILENAME = "MEMORY.md";
+/** Default nesting depth cap under a scope dir (CC memory is flat; a small allowance for topic dirs). */
+export declare const DEFAULT_MAX_ENTRY_DEPTH = 3;
+/** One on-disk entry file the scan found. */
+export interface ScannedEntryFile {
+    /** Absolute path. */
+    path: string;
+    /** Slug = path relative to the scope dir, without `.md` (may contain `/` for nested topics). */
+    slug: string;
+}
+/**
+ * Enumerate a scope dir's entry files (depth-capped, symlinks skipped, dotfiles/index/non-`.md`
+ * ignored). Shared by the backend and the engine's harvest scan so the two can never disagree on
+ * what counts as an entry file. A scope dir is that scope's home and nothing else — no other
+ * scope's directory can lie under it, so there is nothing to exclude.
+ */
+export declare function scanEntryFiles(dir: string, opts?: {
+    maxDepth?: number;
+    /** Harvest gate hook: called for every path the scan SKIPS, with why (backend scans ignore it). */
+    onSkip?: (path: string, kind: "symlink" | "depth" | "nonmd" | "dotfile" | "unreadable") => void;
+}): ScannedEntryFile[];

package/dist/core/memory-engine/entry-scan.js

@@ -0,0 +1,55 @@
+import { lstatSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
+export const MEMORY_INDEX_FILENAME = "MEMORY.md";
+export const DEFAULT_MAX_ENTRY_DEPTH = 3;
+export function scanEntryFiles(dir, opts = {}) {
+    const maxDepth = opts.maxDepth ?? DEFAULT_MAX_ENTRY_DEPTH;
+    const out = [];
+    const walk = (d, depth) => {
+        let names;
+        try {
+            names = readdirSync(d);
+        }
+        catch {
+            if (d !== dir)
+                opts.onSkip?.(d, "unreadable");
+            return;
+        }
+        for (const name of names.sort()) {
+            if (name.startsWith(".") || name === MEMORY_INDEX_FILENAME) {
+                if (name.startsWith("."))
+                    opts.onSkip?.(join(d, name), "dotfile");
+                continue;
+            }
+            const p = join(d, name);
+            let st;
+            try {
+                st = lstatSync(p);
+            }
+            catch {
+                opts.onSkip?.(p, "unreadable");
+                continue;
+            }
+            if (st.isSymbolicLink()) {
+                opts.onSkip?.(p, "symlink");
+                continue;
+            }
+            if (st.isDirectory()) {
+                if (depth + 1 <= maxDepth)
+                    walk(p, depth + 1);
+                else
+                    opts.onSkip?.(p, "depth");
+                continue;
+            }
+            if (!st.isFile())
+                continue;
+            if (!name.endsWith(".md")) {
+                opts.onSkip?.(p, "nonmd");
+                continue;
+            }
+            out.push({ path: p, slug: relative(dir, p).replace(/\.md$/, "") });
+        }
+    };
+    walk(dir, 0);
+    return out;
+}

package/dist/core/memory-engine/file-backend.d.ts

@@ -1,29 +1,7 @@
 import { scopeDirName, type ChallengeEvent, type MemoryPartitionIncidentSink } from "./layout.js";
 import type { MemoryBundleImportPlan, MemoryImportReport } from "./export-bundle.js";
 import type { HarvestRejection, MemoryBackend, MemoryEntry, MemoryEntryHeader, MemoryScopeEnumeration, NotePatch, PatchReport, ScoredMemoryEntry } from "./types.js";
-/** Files/dirs the entry scan never treats as entries: the derived index, dotfiles (`.hydrate`,
- *  transaction staging files), and anything not `.md`. */
-export declare const MEMORY_INDEX_FILENAME = "MEMORY.md";
-/** Default nesting depth cap under a scope dir (CC memory is flat; a small allowance for topic dirs). */
-export declare const DEFAULT_MAX_ENTRY_DEPTH = 3;
-/** One on-disk entry file the scan found. */
-export interface ScannedEntryFile {
-    /** Absolute path. */
-    path: string;
-    /** Slug = path relative to the scope dir, without `.md` (may contain `/` for nested topics). */
-    slug: string;
-}
-/**
- * Enumerate a scope dir's entry files (depth-capped, symlinks skipped, dotfiles/index/non-`.md`
- * ignored). Shared by the backend and the engine's harvest scan so the two can never disagree on
- * what counts as an entry file. A scope dir is that scope's home and nothing else — no other
- * scope's directory can lie under it, so there is nothing to exclude.
- */
-export declare function scanEntryFiles(dir: string, opts?: {
-    maxDepth?: number;
-    /** Harvest gate hook: called for every path the scan SKIPS, with why (backend scans ignore it). */
-    onSkip?: (path: string, kind: "symlink" | "depth" | "nonmd" | "dotfile" | "unreadable") => void;
-}): ScannedEntryFile[];
+export { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles, type ScannedEntryFile } from "./entry-scan.js";
 /** design/178 v2-b §3.3(b) — the explicit erasure selector (each form resolves to an explicit id
  *  list before anything is deleted; there is no whole-store selector). */
 export type ErasureSelect = {
@@ -375,6 +353,8 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  NEVER under {@link directoryRoot}, always on the config-root side even for an in-repo memory dir.
      *  The engine picks this up (like `directoryRoot`) so both sides share ONE control plane. */
     readonly controlPlaneRoot: string;
+    /** {@link directoryRoot}'s physical form at construction — the root every act on a store path is judged against. */
+    private readonly physicalRoot;
     /** Injected clock (opus 1.258 LOW: match the engine's `this.now` determinism discipline). */
     private readonly now;
     /** The construction-time incident sink (partition adoption, layout adoption on the standalone faces). */
@@ -701,6 +681,19 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  §3.1 ⓪ (r5-①): "no lock" is ENOENT-only — a stat FAILURE folded into "nobody is committing"
      *  let a transient EIO run the unlocked recovery (and its staged sweep) over a live transaction. */
     private txnInFlight;
+    /**
+     * The act gate for store paths ({@link storeTargetEscape}) over `ops`' writes and deletes — shadow
+     * ops name control-plane files, not store paths. Refuses with `memory.target_outside_store` at the
+     * first op that would land outside the store, naming the op and where it resolves. Runs over a
+     * whole batch before its commit marker (no journal is written; a caller that staged files removes
+     * them) and per op at the act itself; past the marker a refusal keeps the journal, which replays
+     * once the path resolves inside the store again.
+     */
+    private refuseEscapingTargets;
+    /** At the head of every face (both recovery legs, the lock-free faces' layout seat, the adoption face):
+     *  the store root still resolves to the directory this backend opened. A root re-pointed since would
+     *  carry every read, adoption, sweep and restore — not only the journal's acts — into another directory. */
+    private assertRootIntact;
     /** Remove orphaned `.stage-*` files (a crash BEFORE the journal rename = clean rollback: nothing
      *  was committed, the staged tmps are litter). Dotfiles are invisible to entry scans regardless. */
     private sweepStagedFiles;
@@ -737,6 +730,14 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  the probe classifies those inline and keeps going — a store with a lingering copy never
      *  contends for the writer lock on every read. */
     private readScope;
+    /** #1076b — the observation-table door of the adopting read: bytes a session recorded appearing
+     *  while it held this layer read-only are never adopted. Gate-failing bytes are not taken here —
+     *  the inbound gate's containment keeps its door. A hit is announced, the committed copy stands in
+     *  when this path is the entry's bound projection, and the disk is left as found (the account it
+     *  is judged against is current — the scan sees to that). The notice is deduplicated against what
+     *  is still queued, so every session that meets the file is told once. Returns whether the file
+     *  was settled (the caller moves on). */
+    private settledAsObserved;
     /**
      * design-A RB-5 ([A3]) — the read-side whitewash gate, shared by the bound-here divergence lane
      * and the move+edit lane so the two can never drift: an out-of-session disk change (git pull /
@@ -846,6 +847,13 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      * WRITES ARE REFUSED, loudly — a view handed to a write path is a defect, not a fallback.
      */
     retrievalView(): MemoryBackend;
+    /** #1076b — the lock-free retrieval face serves no recorded divergence either (side-effect-free, so
+     *  no notice): the committed copy stands in at the entry's bound projection, anything else is
+     *  withheld. The table is read per call; the account only when it names one of these ids. */
+    private withoutObserved;
+    /** The committed rows read afresh from disk (no cache install), or undefined when the account
+     *  cannot be read — a fault, never folded into "no rows". */
+    private committedRowsOrFault;
     /** Dedup keys for divergence findings the restricted view already recorded: one materialize reads
      *  a scope several times (listHeaders, then getByIds per scope), and a checkpoint-cadence harvest
      *  re-audits the same still-pending state — without the key, one untouched divergence would mint

package/dist/core/memory-engine/file-backend.js

@@ -1,4 +1,4 @@
-import { existsSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync, utimesSync } from "node:fs";
+import { existsSync, fstatSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync, utimesSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, relative } from "node:path";
 import { jaccardDistance, termSet } from "../memory-vector.js";
@@ -6,63 +6,13 @@ import { MAX_MEMORY_BYTES } from "../memory.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { ambiguousOriginRepresentation, committedDistilledOf, committedOriginOf, computeEntryRev, distilledEquals, entryFromFile, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile } from "./frontmatter.js";
 import { convertV1SidecarKeys } from "./delegation-settlement.js";
-import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, writeAllSync, } from "./layout.js";
+import { layerObservationLookup, observedDivergenceNotice } from "./layer-observations.js";
+import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles } from "./entry-scan.js";
+import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, writeAllSync, } from "./layout.js";
 import { screenInboundEntries } from "./data-plane.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 import { thrownText } from "../thrown-value.js";
-export const MEMORY_INDEX_FILENAME = "MEMORY.md";
-export const DEFAULT_MAX_ENTRY_DEPTH = 3;
-export function scanEntryFiles(dir, opts = {}) {
-    const maxDepth = opts.maxDepth ?? DEFAULT_MAX_ENTRY_DEPTH;
-    const out = [];
-    const walk = (d, depth) => {
-        let names;
-        try {
-            names = readdirSync(d);
-        }
-        catch {
-            if (d !== dir)
-                opts.onSkip?.(d, "unreadable");
-            return;
-        }
-        for (const name of names.sort()) {
-            if (name.startsWith(".") || name === MEMORY_INDEX_FILENAME) {
-                if (name.startsWith("."))
-                    opts.onSkip?.(join(d, name), "dotfile");
-                continue;
-            }
-            const p = join(d, name);
-            let st;
-            try {
-                st = lstatSync(p);
-            }
-            catch {
-                opts.onSkip?.(p, "unreadable");
-                continue;
-            }
-            if (st.isSymbolicLink()) {
-                opts.onSkip?.(p, "symlink");
-                continue;
-            }
-            if (st.isDirectory()) {
-                if (depth + 1 <= maxDepth)
-                    walk(p, depth + 1);
-                else
-                    opts.onSkip?.(p, "depth");
-                continue;
-            }
-            if (!st.isFile())
-                continue;
-            if (!name.endsWith(".md")) {
-                opts.onSkip?.(p, "nonmd");
-                continue;
-            }
-            out.push({ path: p, slug: relative(dir, p).replace(/\.md$/, "") });
-        }
-    };
-    walk(dir, 0);
-    return out;
-}
+export { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles } from "./entry-scan.js";
 export function canonicalJsonStringify(value) {
     if (Array.isArray(value))
         return `[${value.map((v) => (v === undefined || typeof v === "function" || typeof v === "symbol" ? "null" : canonicalJsonStringify(v))).join(",")}]`;
@@ -257,6 +207,45 @@ function validateLedgerRowsV2(rowsRaw, path) {
     }
     return out;
 }
+function parseJournal(raw, jp) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.ops))
+            throw new Error("wrong shape");
+        return parsed;
+    }
+    catch {
+        throw new ControlPlaneCorruptError(`transaction journal is unparseable: ${jp}`);
+    }
+}
+function journalLedgerSnapshot(journal, jp) {
+    const hasV2 = journal.ledger2 !== undefined;
+    const hasV1 = journal.ledger !== undefined;
+    if (hasV2 === hasV1) {
+        throw new ControlPlaneCorruptError(`transaction journal has ${hasV2 ? "both ledger snapshots" : "no ledger snapshot"} (wrong shape): ${jp}`);
+    }
+    if (hasV2) {
+        const env = journal.ledger2;
+        if (!env || typeof env !== "object" || Array.isArray(env) || env.v !== LEDGER_SCHEMA_VERSION) {
+            throw new ControlPlaneCorruptError(`transaction journal ledger2 snapshot has the wrong shape: ${jp}`);
+        }
+        const extras = {};
+        for (const [k, val] of Object.entries(env))
+            if (k !== "v" && k !== "rows")
+                extras[k] = val;
+        return { form: "v2", rows: validateLedgerRowsV2(env.rows, jp), extras };
+    }
+    const map = journal.ledger;
+    if (!map || typeof map !== "object" || Array.isArray(map))
+        throw new ControlPlaneCorruptError(`transaction journal ledger snapshot has the wrong shape: ${jp}`);
+    const rows = Object.create(null);
+    for (const [id, rev] of Object.entries(map)) {
+        if (typeof rev !== "string")
+            throw new ControlPlaneCorruptError(`transaction journal v1 ledger snapshot entry ${JSON.stringify(id)} is not a string: ${jp}`);
+        rows[id] = { rev };
+    }
+    return { form: "v1", rows };
+}
 function parseLedgerText(raw, path) {
     let parsed;
     try {
@@ -533,6 +522,7 @@ function probeProjection(absPath, id) {
 export class FileMemoryEngineBackend {
     directoryRoot;
     controlPlaneRoot;
+    physicalRoot;
     now;
     onIncident;
     ledger;
@@ -556,6 +546,7 @@ export class FileMemoryEngineBackend {
             adoptCanonicalKeyedControlDir(resolveMemoryEngineRoot(), dir, opts.onIncident);
         this.controlPlaneRoot = opts.controlDir ?? deriveControlPlaneDir(resolveMemoryEngineRoot(), dir);
         ensureDirExists(dir);
+        this.physicalRoot = landingPathOf(dir);
         ensureDirExists(this.controlPlaneRoot);
         this.recoverJournal({ unlocked: true });
         try {
@@ -588,6 +579,7 @@ export class FileMemoryEngineBackend {
         });
     }
     ensureLayout(ownerCandidate) {
+        this.assertRootIntact();
         if (!layoutNeedsAdoption(this.directoryRoot, this.controlPlaneRoot))
             return;
         const lock = this.tryAcquireTxnLockSync();
@@ -602,6 +594,7 @@ export class FileMemoryEngineBackend {
         }
     }
     async adoptRootScopeLayout(opts = {}) {
+        this.assertRootIntact();
         if (!layoutNeedsAdoption(this.directoryRoot, this.controlPlaneRoot))
             return;
         const lock = await this.acquireTxnLock();
@@ -1222,6 +1215,7 @@ export class FileMemoryEngineBackend {
         }
     }
     recoverJournal(fence) {
+        this.assertRootIntact();
         if (fence.token === undefined) {
             if (this.txnInFlight())
                 return;
@@ -1240,44 +1234,9 @@ export class FileMemoryEngineBackend {
         const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
         const raw = readControlFileOrAbsent(jp, "transaction journal");
         if (raw !== undefined) {
-            let journal;
-            try {
-                const parsed = JSON.parse(raw);
-                if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.ops))
-                    throw new Error("wrong shape");
-                journal = parsed;
-            }
-            catch {
-                throw new ControlPlaneCorruptError(`transaction journal is unparseable: ${jp}`);
-            }
-            const hasV2 = journal.ledger2 !== undefined;
-            const hasV1 = journal.ledger !== undefined;
-            if (hasV2 === hasV1) {
-                throw new ControlPlaneCorruptError(`transaction journal has ${hasV2 ? "both ledger snapshots" : "no ledger snapshot"} (wrong shape): ${jp}`);
-            }
-            let snapshotRows;
-            let snapshotExtras;
-            if (hasV2) {
-                const env = journal.ledger2;
-                if (!env || typeof env !== "object" || Array.isArray(env) || env.v !== LEDGER_SCHEMA_VERSION) {
-                    throw new ControlPlaneCorruptError(`transaction journal ledger2 snapshot has the wrong shape: ${jp}`);
-                }
-                snapshotRows = validateLedgerRowsV2(env.rows, jp);
-                snapshotExtras = {};
-                for (const [k, val] of Object.entries(env))
-                    if (k !== "v" && k !== "rows")
-                        snapshotExtras[k] = val;
-            }
-            else {
-                const map = journal.ledger;
-                if (!map || typeof map !== "object" || Array.isArray(map))
-                    throw new ControlPlaneCorruptError(`transaction journal ledger snapshot has the wrong shape: ${jp}`);
-                snapshotRows = Object.create(null);
-                for (const [id, rev] of Object.entries(map)) {
-                    if (typeof rev !== "string")
-                        throw new ControlPlaneCorruptError(`transaction journal v1 ledger snapshot entry ${JSON.stringify(id)} is not a string: ${jp}`);
-                    snapshotRows[id] = { rev };
-                }
+            const journal = parseJournal(raw, jp);
+            const { rows: snapshotRows, extras: snapshotExtras, form: snapshotForm } = journalLedgerSnapshot(journal, jp);
+            if (snapshotForm === "v1") {
                 try {
                     const diskRaw = readControlFileOrAbsent(join(this.controlPlaneRoot, LEDGER_FILE), "committed-rev ledger");
                     const diskParsed = diskRaw !== undefined ? JSON.parse(diskRaw) : undefined;
@@ -1314,7 +1273,7 @@ export class FileMemoryEngineBackend {
                     }
                     journalEvs.set(e.ev, canonical);
                 }
-                if (hasV1)
+                if (snapshotForm === "v1")
                     throw new ControlPlaneCorruptError(`transaction journal carries transfers with a v1 snapshot (impossible form): ${jp}`);
                 if (journalEvs.size > 0) {
                     for (const row of this.readTransferChain(fenceToken)) {
@@ -1445,7 +1404,10 @@ export class FileMemoryEngineBackend {
                 }
             }
             this.assertTxnLockOwnership(fenceToken);
+            const replayAt = `the journal replay (journal kept at ${jp})`;
+            this.refuseEscapingTargets(journal.ops, replayAt);
             for (const op of journal.ops) {
+                this.refuseEscapingTargets([op], replayAt);
                 try {
                     if (op.kind === "write" && op.content !== undefined) {
                         atomicWriteFileSync(op.target, op.content);
@@ -1464,12 +1426,12 @@ export class FileMemoryEngineBackend {
                 }
                 catch (err) {
                     const code = err.code;
-                    throw new ControlPlaneCorruptError(`transaction journal replay failed on op kind=${op.kind} target=${JSON.stringify(op.target)} (${code ?? (thrownText(err))}) — the journal is kept at ${jp}; an I/O failure retries at the next construction, a persistent fault needs the explicit control-plane rebuild path`);
+                    throw new ControlPlaneCorruptError(`transaction journal replay failed on op kind=${op.kind} target=${JSON.stringify(op.target)} (${code ?? (thrownText(err))}) — the journal is kept at ${jp}; ${permissionRemedyOf(err, this.directoryRoot) ?? "an I/O failure retries at the next construction, a persistent fault needs the explicit control-plane rebuild path"}`);
                 }
             }
             this.recoveryCommitProbe?.();
             this.assertTxnLockOwnership(fenceToken);
-            if (hasV2) {
+            if (snapshotForm === "v2") {
                 this.ledger = snapshotRows;
                 this.envelopeExtras = snapshotExtras;
                 this.persistedSchemaVersion = "v2";
@@ -1503,6 +1465,24 @@ export class FileMemoryEngineBackend {
             throw new ControlPlaneCorruptError(`txn lock state could not be probed (${code ?? "io error"}) at ${this.txnLockDir()} — a probe failure is not "no writer" (fail-closed)`);
         }
     }
+    refuseEscapingTargets(ops, at) {
+        for (const op of ops) {
+            if (op.kind !== "write" && op.kind !== "delete")
+                continue;
+            for (const path of op.staged === undefined ? [op.target] : [op.target, op.staged]) {
+                const escape = storeTargetEscape(this.physicalRoot, path);
+                if (escape === undefined)
+                    continue;
+                throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: ${at} refused a ${op.kind} of ${op.target}${path === op.target ? "" : ` (its staged file ${path})`} — ${escape}; not performed`, TARGET_OUTSIDE_STORE);
+            }
+        }
+    }
+    assertRootIntact() {
+        const now = landingPathOf(this.directoryRoot);
+        if (now === this.physicalRoot)
+            return;
+        throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: the store root ${this.directoryRoot} now resolves to ${now}, not ${this.physicalRoot} where this backend opened it — refused; open a new backend on the directory you mean`, TARGET_OUTSIDE_STORE);
+    }
     sweepStagedFiles() {
         const walk = (d, depth) => {
             let names;
@@ -1589,6 +1569,9 @@ export class FileMemoryEngineBackend {
         const moveEvents = [];
         const moveAnnouncements = [];
         const skippedUnreadable = [];
+        let table;
+        const observed = () => (table ??= layerObservationLookup(this.controlPlaneRoot));
+        let freshAccount;
         for (const f of files) {
             let text;
             try {
@@ -1608,6 +1591,12 @@ export class FileMemoryEngineBackend {
                 const committed = rowsRev(rows, entry.id);
                 const binding = rowsBinding(rows, entry.id);
                 const relPath = relative(this.directoryRoot, f.path);
+                if (probeOnly === true && observed().covers(entry.id)) {
+                    const fresh = (freshAccount ??= this.committedRowsOrFault() ?? null);
+                    const freshBinding = fresh !== null ? rowsBinding(fresh, entry.id) : undefined;
+                    if (fresh === null || rowsRev(fresh, entry.id) !== committed || freshBinding?.scope !== binding?.scope || freshBinding?.slug !== binding?.slug)
+                        return undefined;
+                }
                 if (committed !== undefined && binding !== undefined && !(binding.scope === scope && binding.slug === f.slug)) {
                     const probe = probeProjection(this.bindingAbsPath(binding), entry.id);
                     if (probe === "present") {
@@ -1618,6 +1607,8 @@ export class FileMemoryEngineBackend {
                         this.announceAdoptionNotice(`bindprobe|${relPath}`, `committed entry ${entry.id} appears at ${JSON.stringify(inlineUntrusted(relPath))} but is bound to ${JSON.stringify(inlineUntrusted(this.bindingRelPath(binding)))}, and the bound projection could not be probed conclusively (a read failure, or a foreign file at that address — not ENOENT) — nothing is served or adopted this pass`);
                         continue;
                     }
+                    if (this.settledAsObserved(observed(), entries, entry, relPath, f.slug, scope, committed, binding, text, "quarantined-only"))
+                        continue;
                     if (probeOnly)
                         return undefined;
                     if (lockToken !== undefined)
@@ -1630,6 +1621,8 @@ export class FileMemoryEngineBackend {
                     continue;
                 }
                 if (committed !== entry.rev) {
+                    if (committed !== undefined && this.settledAsObserved(observed(), entries, entry, relPath, f.slug, scope, committed, binding, text, "restored"))
+                        continue;
                     if (probeOnly)
                         return undefined;
                     if (lockToken !== undefined)
@@ -1664,6 +1657,8 @@ export class FileMemoryEngineBackend {
                         entry = entryFromFile(shadowText, entry.id, f.slug, scope);
                     }
                     else {
+                        if (committed === undefined && this.settledAsObserved(observed(), entries, entry, relPath, f.slug, scope, committed, binding, text, "restored"))
+                            continue;
                         if (committed !== undefined)
                             adoptedExternal.push(relPath);
                         bindRowTracked(rows, entry.id, { rev: entry.rev, scope, slug: f.slug, at: this.now() }, moveEvents, "adopted-move");
@@ -1740,6 +1735,25 @@ export class FileMemoryEngineBackend {
             this.batchScan.set(scope, entries);
         return entries;
     }
+    settledAsObserved(table, out, entry, relPath, slug, scope, committed, binding, text, containment) {
+        if (!table.covers(entry.id) || this.inboundGate(relPath, text) !== undefined)
+            return false;
+        if (committed !== undefined && committed !== entry.rev && this.whitewashInboundFinding(relPath, entry, containment) !== undefined)
+            return false;
+        const hit = table.find(entry.id, committed, entry.rev);
+        if (hit === undefined)
+            return false;
+        const standIn = committed !== undefined && binding !== undefined && binding.scope === scope && binding.slug === slug ? this.readCommittedShadow(entry.id) : undefined;
+        const notice = observedDivergenceNotice(relPath, standIn !== undefined, hit.undecided === true);
+        try {
+            enqueueMemoryAnnouncement(this.controlPlaneRoot, { kind: "external", at: this.now(), items: [notice] }, { supersedesPrefix: notice });
+        }
+        catch {
+        }
+        if (standIn !== undefined)
+            out.push(entryFromFile(standIn, entry.id, slug, scope));
+        return true;
+    }
     whitewashInboundFinding(relPath, entry, containment) {
         const committedShadow = this.readCommittedShadow(entry.id);
         const committedFm = committedShadow !== undefined ? parseEntryFile(committedShadow).frontmatter : undefined;
@@ -1862,14 +1876,46 @@ export class FileMemoryEngineBackend {
             throw new Error(`memory retrieval view is read-only — ${op} must go through the backend itself`);
         };
         return {
-            listHeaders: async (scopes) => (this.ensureLayout(), this.listHeadersFrom(scopes, (s) => this.readScope(s, false))),
-            getByIds: async (ids) => (this.ensureLayout(), this.getByIdsFrom(ids, (s) => this.readScope(s, false))),
-            search: async (query, scopes, opts) => (this.ensureLayout(), this.searchFrom(query, scopes, opts, (s) => this.readScope(s, false))),
+            listHeaders: async (scopes) => (this.ensureLayout(), this.listHeadersFrom(scopes, (s) => this.withoutObserved(this.readScope(s, false), s))),
+            getByIds: async (ids) => (this.ensureLayout(), this.getByIdsFrom(ids, (s) => this.withoutObserved(this.readScope(s, false), s))),
+            search: async (query, scopes, opts) => (this.ensureLayout(), this.searchFrom(query, scopes, opts, (s) => this.withoutObserved(this.readScope(s, false), s))),
             applyPatches: async () => refuse("applyPatches"),
             getConsolidationCursor: async (scope) => this.getConsolidationCursor(scope),
             setConsolidationCursor: async () => refuse("setConsolidationCursor"),
         };
     }
+    withoutObserved(entries, scope) {
+        const table = layerObservationLookup(this.controlPlaneRoot);
+        if (!entries.some((e) => table.covers(e.id)))
+            return entries;
+        const account = this.committedRowsOrFault();
+        if (account === undefined)
+            return entries.filter((e) => !table.covers(e.id));
+        const out = [];
+        for (const e of entries) {
+            const committed = rowsRev(account, e.id);
+            const binding = rowsBinding(account, e.id);
+            const boundHere = binding !== undefined && binding.scope === scope && binding.slug === e.slug;
+            if ((committed === e.rev && boundHere) || table.find(e.id, committed, e.rev) === undefined) {
+                out.push(e);
+                continue;
+            }
+            const standIn = committed !== undefined && boundHere ? this.readCommittedShadow(e.id) : undefined;
+            if (standIn !== undefined)
+                out.push(entryFromFile(standIn, e.id, e.slug, scope));
+        }
+        return out;
+    }
+    committedRowsOrFault() {
+        const path = join(this.controlPlaneRoot, LEDGER_FILE);
+        try {
+            const raw = readControlFileOrAbsent(path, "committed-rev ledger");
+            return raw === undefined ? Object.create(null) : parseLedgerText(raw, path).rows;
+        }
+        catch {
+            return undefined;
+        }
+    }
     restrictedFindingKeys = new Set();
     recordRestrictedFinding(key, finding) {
         if (this.restrictedFindingKeys.has(key))
@@ -2187,6 +2233,9 @@ export class FileMemoryEngineBackend {
         try {
             return await this.applyPatchesLocked(patches, lock.token);
         }
+        catch (err) {
+            throw withPermissionRemedy(err, this.directoryRoot);
+        }
         finally {
             lock.release();
         }
@@ -2343,16 +2392,37 @@ export class FileMemoryEngineBackend {
             return report;
         }
         const txn = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const stagedFiles = [];
+        const refuseUnstaging = (batch, at) => {
+            try {
+                this.refuseEscapingTargets(batch, at);
+            }
+            catch (err) {
+                for (const f of stagedFiles) {
+                    try {
+                        const st = lstatSync(f.path);
+                        if (st.dev === f.dev && st.ino === f.ino)
+                            rmSync(f.path, { force: true });
+                    }
+                    catch {
+                    }
+                }
+                throw err;
+            }
+        };
         let n = 0;
         for (const op of ops) {
             if (op.kind !== "write" || op.content === undefined)
                 continue;
+            refuseUnstaging([op], "applyPatches (staging)");
             const staged = join(dirname(op.target), `.stage-${txn}-${n++}`);
             mkdirSync(dirname(op.target), { recursive: true });
             const fd = openSync(staged, "w", 0o600);
             try {
                 writeAllSync(fd, op.content);
                 fsyncSync(fd);
+                const st = fstatSync(fd);
+                stagedFiles.push({ path: staged, dev: st.dev, ino: st.ino });
             }
             finally {
                 closeSync(fd);
@@ -2370,8 +2440,10 @@ export class FileMemoryEngineBackend {
         if (coherentTransfers.length > 0)
             this.precheckTransfersAppendable();
         const journal = { txn, ops, ledger2: ledgerEnvelope(rows, this.envelopeExtras), ...(coherentTransfers.length > 0 ? { transfers: coherentTransfers } : {}) };
+        refuseUnstaging(ops, "applyPatches (commit point)");
         atomicWriteFileSync(join(this.controlPlaneRoot, JOURNAL_FILE), JSON.stringify(journal));
         for (const op of ops) {
+            this.refuseEscapingTargets([op], "applyPatches (after the commit point; the journal is kept)");
             if (op.kind === "write" && op.staged) {
                 renameSync(op.staged, op.target);
             }
@@ -2796,8 +2868,10 @@ export class FileMemoryEngineBackend {
                 this.assertTxnLockOwnership(lock.token);
                 this.precheckTransfersAppendable();
                 const journal = { txn, ops, ledger2: ledgerEnvelope(rows, this.envelopeExtras), transfers };
+                this.refuseEscapingTargets(ops, "eraseWithEvidence (commit point)");
                 atomicWriteFileSync(join(this.controlPlaneRoot, JOURNAL_FILE), JSON.stringify(journal));
                 for (const op of ops) {
+                    this.refuseEscapingTargets([op], "eraseWithEvidence (after the commit point; the journal is kept)");
                     if (op.kind === "delete") {
                         rmSync(op.target, { force: true });
                     }
@@ -2865,7 +2939,7 @@ export class FileMemoryEngineBackend {
         }
         catch (err) {
             this.ledger = undefined;
-            throw err;
+            throw withPermissionRemedy(err, this.directoryRoot);
         }
         finally {
             lock.release();