@staix/agent-mem 0.12.0 → 0.14.0

package/src/memory/commands.ts

@@ -1,6 +1,8 @@
+import { cliAttribution, noteDisplayActor } from "./cli-attribution.ts";
 import { extractNodes, GOAL_STATES, KINDS, MemoryStore, setMachineLabel, type GoalState, type GoalView, type Kind, type Tier, type View } from "./store.ts";
 import { syncMemory, type SyncOptions } from "./sync.ts";
-import { importClaudeMem } from "./import.ts";
+import { importClaudeMem, type ImportResult, type WorkStateImportResult, type CaptureImportResult } from "./import.ts";
+import { facts, label, PLAIN, type Style } from "./style.ts";
 import { memoryProjectKey, projectChain } from "./project.ts";
 import { recallForViews, recallGraph, recallRows, recallShow } from "./recall.ts";
 import type { GoalPromotionReport } from "./goal-promotion.ts";
@@ -47,8 +49,8 @@ export interface GoalCommandOptions {
 }
 
 /**
- * #258: the memory commands, straight on the machine's store (no host needed; agent-hub exposes the same as `ahub memory`). Reading is anyone's; promote, demote, forget,
- * supersede and rebuild are a person's (the identity gate refuses agent shells).
+ * #258: the memory commands, straight on the machine's store (no host needed; agent-hub exposes the same as `ahub memory`). Callers provide read visibility, retained-history intent and write policy;
+ * ordinary CLI calls carry scoped attribution while library calls keep their existing defaults.
  */
 /** The usage line of the memory commands under `name` (`amem` by default; agent-hub passes `ahub memory`). */
 export const memoryUsage = (name: string = AMEM_NAMES.memory): string => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
@@ -58,10 +60,39 @@ export const goalUsage = (name: string = AMEM_NAMES.goal): string => `usage: ${n
 export const GOAL_USAGE = goalUsage();
 
 const fail = (message: string): never => { throw new Error(message); };
+
+/** A person-facing aggregate receipt; import results and their JSON representation stay untouched. */
+export function claudeMemImportText(notes: ImportResult, work: WorkStateImportResult, capture?: CaptureImportResult,
+  options: { captureDays?: number; restart?: boolean } = {}, s: Style = PLAIN): string {
+  const more = notes.more || work.more || capture?.more === true;
+  const row = (name: string, result: { read: number; added: number; more: boolean }, skipped: number, spooled?: number) =>
+    `${label(s, result.more || (spooled ?? 0) > 0 ? "attention" : "ok")} ${name}: ${facts({ read: String(result.read), added: String(result.added), skipped: String(skipped), spooled: spooled === undefined ? "n/a" : String(spooled) })}${result.more ? "; more remain" : ""}`;
+  const noteSkipped = notes.read - notes.added, workSkipped = work.read - work.added;
+  const otherNotes = Math.max(0, noteSkipped - notes.skipped.model - notes.skipped.pii - notes.skipped.secret);
+  const duplicateWork = Math.max(0, workSkipped - work.skipped.invalid - work.skipped.policy);
+  const lines = [`amem import claude-mem: ${more ? s.attention("run again") : s.ok("complete")}`,
+    row("notes", notes, noteSkipped),
+    `  skipped reasons: ${facts({ model: notes.skipped.model, PII: notes.skipped.pii, secret: notes.skipped.secret, "empty/malformed/already imported": otherNotes }) || "none"}`,
+    row("work lists", work, workSkipped),
+    `  skipped reasons: ${facts({ invalid: work.skipped.invalid, policy: work.skipped.policy, "already imported": duplicateWork }) || "none"}`];
+  if (capture) {
+    lines.push(row("capture", capture, capture.skipped, capture.spooled));
+    if (capture.skipped) lines.push(`  skipped reasons: combined ${capture.skipped} (empty/invalid, policy or already imported; no breakdown reported)`);
+  } else lines.push(`${label(s, "skipped")} capture: not requested (use --capture-days N for recent capture)`);
+  lines.push(more ? options.restart
+    ? "Next action: run the same import command again without --restart, keeping all other arguments, until all receipts are complete."
+    : "Next action: run the same import command again until all receipts are complete."
+    : capture?.spooled ? `Next action: ${capture.spooled} capture ${capture.spooled === 1 ? "row was" : "rows were"} spooled while busy; the next capture write (hook event or import adding capture rows) replays them.`
+      : "Next action: none; all requested import receipts are complete.");
+  if (capture && options.captureDays !== undefined) lines.push(`Capture window: last ${options.captureDays} days. Widening --capture-days later requires --restart.`);
+  if (options.restart) lines.push("Restart: selected cursors replayed from the start; existing import receipts prevent duplicates.");
+  return lines.join("\n");
+}
+
 const one = (v: View) => `${v.id.slice(0, 8)}  ${v.at.slice(0, 16).replace("T", " ")}  ${v.tier.padEnd(5)} ${v.kind.padEnd(8)} ${v.peer.padEnd(8)} ${v.scope === "shared" ? "shared " : ""}${`${v.title ? `${v.title}: ` : ""}${v.text}`.replace(/\s+/g, " ").slice(0, 100)}${v.supersededBy ? `  (superseded by ${v.supersededBy.slice(0, 8)})` : ""}`;
 function detail(v: View): string[] {
   return [`${v.id}  ${v.kind}, ${v.tier}-term${v.expiresAt ? ` until ${v.expiresAt}` : ""}, ${v.scope}`, `by ${v.peer} on machine ${v.machine}, ${v.at}, project ${v.project}${v.task ? `, task ${v.task}` : ""}`,
-    ...(v.promotedFrom ? [`promoted from ${v.promotedFrom}`] : []), ...(v.supersededBy ? [`superseded by ${v.supersededBy}`] : []), ...(v.about.length ? [`about: ${v.about.join(", ")}`] : []), "", ...(v.title ? [v.title] : []), v.text];
+    ...(cliAttribution() ? [`actor: ${noteDisplayActor(v.peer)}, peer: ${v.peer}`] : []), ...(v.promotedFrom ? [`promoted from ${v.promotedFrom}`] : []), ...(v.supersededBy ? [`superseded by ${v.supersededBy}`] : []), ...(v.about.length ? [`about: ${v.about.join(", ")}`] : []), "", ...(v.title ? [v.title] : []), v.text];
 }
 
 export async function rawMemoryCommand(args: string[], cwd: string, opts: MemoryCommandOptions): Promise<string> {
@@ -77,7 +108,11 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
   if (args.includes("--explain") && (opts.person !== true || opts.rankedSearch !== true || opts.explainSearch !== true)) fail("score explanation requires ranked search and person intent");
   for (let index = rest.indexOf("--explain"); index >= 0; index = rest.indexOf("--explain")) rest.splice(index, 1);
   const store = opts.store ?? opts.open();
-  const actor = "user";
+  const actor = cliAttribution()?.actor ?? "user";
+  const visibleTarget = (view: View | undefined, id: string): View => {
+    if (cliAttribution()?.actor === "agent" && (!view || !opts.readable([view]).some(row => row.id === view.id))) fail("Memory operation unavailable or refused; no partial result is shown.");
+    return need(view, id);
+  };
   const project = opts.project ?? memoryProjectKey(cwd);
   const need = (v: View | undefined, id: string) => v ?? fail(`no memory entry ${id} (${names.memory} list shows the ids)`);
   // #15 D4: this command is bound to one project. Crossing projects is the person's `amem search --all-projects`; here the flags would otherwise read as query words.
@@ -146,11 +181,14 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
         const node = !start.includes(":") || start.startsWith("mem:") ? g.nodes[0]!.id : start;
         return json ? JSON.stringify(g, null, 2) : [`${g.nodes.length} nodes, ${g.edges.length} edges around ${node}`, ...g.edges.map((e) => `${e.from} -${e.rel}-> ${e.to}`)].join("\n");
       }
-      case "promote": { const v = need(store.get(rest[0] ?? fail(usage), project), rest[0]!); if (v.supersededBy) fail(`${v.id.slice(0, 8)} is replaced by ${v.supersededBy.slice(0, 8)}: promote that one instead`); const id = store.promote(v.id, actor, project) ?? fail(v.project !== project ? `${v.id.slice(0, 8)} is another project's note: promote it from that project` : `${v.id.slice(0, 8)} stays short-term: it holds a secret, matches a PII pattern or is about a private path`); return id === v.id ? `${v.id.slice(0, 8)} is already long-term` : `promoted to long-term as ${id.slice(0, 8)}`; }
-      case "demote": { const v = need(store.get(rest[0] ?? fail(usage), project), rest[0]!); if (v.tier !== "long") return `${v.id.slice(0, 8)} is already short-term`; store.demote(v.id, actor, project); return `demoted ${v.id.slice(0, 8)}: it expires ${store.get(v.id, project)?.expiresAt ?? "with its short-term lifetime"}`; }
-      case "forget": { const v = need(store.forget(rest[0] ?? fail(usage), actor, project), rest[0]!); return `forgot ${v.id.slice(0, 8)}${v.local ? "" : "; it stays in the sync remote's git history until a person rewrites it (docs/memory.md)"}`; }
+      case "promote": { const v = visibleTarget(store.get(rest[0] ?? fail(usage), project), rest[0]!); if (v.supersededBy) fail(`${v.id.slice(0, 8)} is replaced by ${v.supersededBy.slice(0, 8)}: promote that one instead`); const id = store.promote(v.id, actor, project) ?? fail(v.project !== project ? `${v.id.slice(0, 8)} is another project's note: promote it from that project` : `${v.id.slice(0, 8)} stays short-term: it holds a secret, matches a PII pattern or is about a private path`); return id === v.id ? `${v.id.slice(0, 8)} is already long-term` : `promoted to long-term as ${id.slice(0, 8)}`; }
+      case "demote": { const v = visibleTarget(store.get(rest[0] ?? fail(usage), project), rest[0]!); if (v.tier !== "long") return `${v.id.slice(0, 8)} is already short-term`; store.demote(v.id, actor, project); return `demoted ${v.id.slice(0, 8)}: it expires ${store.get(v.id, project)?.expiresAt ?? "with its short-term lifetime"}`; }
+      case "forget": { const target = visibleTarget(store.get(rest[0] ?? fail(usage), project), rest[0]!);
+        if (cliAttribution()?.actor === "agent") for (const member of store.forgetTargets(target.id, project)) visibleTarget(member, member.id);
+        const v = need(store.forget(target.id, actor, project), rest[0]!); return `forgot ${v.id.slice(0, 8)}${v.local ? "" : "; it stays in the sync remote's git history until a person rewrites it (docs/memory.md)"}`; }
       case "supersede": {
         if (rest.length !== 2) fail(`usage: ${names.memory} supersede <old> <new>`);
+        if (cliAttribution()?.actor === "agent") for (const id of rest) visibleTarget(store.get(id, project), id);
         return store.supersede(rest[0]!, rest[1]!, actor, project) ? `${rest[0]} is superseded by ${rest[1]}` : fail(`both ids must name different entries, and the newer one must reach as far: shared for a shared entry, long-term for a long-term one (${names.memory} promote it first)`);
       }
       case "sync": {
@@ -159,11 +197,19 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
         const r = await syncMemory(store, { ...opts.sync, ...(remote ? { remote } : {}) });
         if (json) return JSON.stringify(r, null, 2);
         if (!r.ok) fail(`${names.memory} sync: ${r.error}`);
+        if (r.pruneApplication) {
+          const a = r.pruneApplication;
+          return `synced${r.pushed ? " and pushed" : ""}: ${r.entries} long-term entries transported; ${a.proofComplete} prune proofs complete, ${a.projectionActive ?? "pending"} foreign projections active, ${a.nativeApplied ?? "pending"} native prunes applied, ${a.held} held${r.warning ? `\nnote: ${r.warning}` : ""}`;
+        }
         return `synced${r.pushed ? " and pushed" : ""}: ${r.entries} long-term entries visible here${r.warning ? `\nnote: ${r.warning}` : ""}`;
       }
       case "dedupe": {
         const apply = rest.includes("--apply");
         if (rest.some(arg => arg !== "--apply")) fail(`usage: ${names.memory} dedupe [--apply] [--json]`);
+        if (cliAttribution()?.actor === "agent") {
+          const preview = store.dedupe(project, false);
+          for (const group of preview.groups) { for (const view of group.members) visibleTarget(view, view.id); visibleTarget(store.get(group.target, project), group.target); }
+        }
         const result = store.dedupe(project, apply);
         if (json) return JSON.stringify(result, null, 2);
         return [result.groups.length ? `${result.groups.length} duplicate import group(s)${apply ? `; appended ${result.applied} supersede operation(s)` : "; use --apply to reconcile"}` : "no duplicate import groups to reconcile",
@@ -188,6 +234,11 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
         return pending.length ? pending.map((x) => `${x.id.slice(0, 8)}  ${x.from.slice(0, 8)} ${x.rel} ${x.to.slice(0, 8)}  (suggested by a model ${x.at}; not evidence until confirmed)`).join("\n") : "no edge suggestions waiting";
       }
       case "confirm": case "reject": {
+        if (cliAttribution()?.actor === "agent") {
+          const matches = store.suggestions(project).filter(row => row.id === rest[0] || row.id.startsWith(rest[0] ?? ""));
+          if (matches.length !== 1) fail("Memory operation unavailable or refused; no partial result is shown.");
+          for (const id of [matches[0]!.from, matches[0]!.to]) visibleTarget(store.get(id, project), id);
+        }
         const x = store.judge(rest[0] ?? fail(`usage: ${names.memory} ${sub} <suggestion id>`), sub, actor, project) ?? fail(`no suggestion ${rest[0]} (${names.memory} suggestions lists them)`);
         return `${sub === "confirm" ? "confirmed" : "rejected"}: ${x.from.slice(0, 8)} ${x.rel} ${x.to.slice(0, 8)}`;
       }
@@ -217,6 +268,7 @@ function leaseText(g: GoalView, me: string, goal: string): string {
  * person's. A peer links its own board task with hub_task_propose's `goal`.
  */
 export async function rawGoalCommand(args: string[], cwd: string, opts: GoalCommandOptions): Promise<string> {
+  const actor = cliAttribution()?.actor ?? "user";
   const json = args.includes("--json");
   const rest = args.filter((a) => a !== "--json");
   const take = (name: string) => { const out: string[] = []; for (let i = rest.indexOf(name); i >= 0; i = rest.indexOf(name)) { out.push(rest[i + 1] ?? fail(`${name} needs a value`)); rest.splice(i, 2); } return out; };
@@ -251,7 +303,7 @@ export async function rawGoalCommand(args: string[], cwd: string, opts: GoalComm
         const shared = rest.includes("--shared");
         const title = rest.filter((a) => a !== "--shared").join(" ").trim() || fail(usage);
         if (!clean(title, milestones)) fail("a long-term task syncs to every machine: this one holds a secret, a PII pattern or a private path and is not saved");
-        const id = store.goal({ project, scope: shared ? "shared" : "project", title, milestones, dependsOn: depends, actor: "user" });
+        const id = store.goal({ project, scope: shared ? "shared" : "project", title, milestones, dependsOn: depends, actor });
         return `long-term task ${id.slice(0, 8)} created: ${title}`;
       }
       case "link": {
@@ -264,7 +316,7 @@ export async function rawGoalCommand(args: string[], cwd: string, opts: GoalComm
         const g = need(rest[0]);
         const state = (sub === "done" ? "done" : rest[1]) as GoalState;
         if (!GOAL_STATES.includes(state)) fail(`the state is one of ${GOAL_STATES.join(", ")}`);
-        store.goalState(g.id, state, "user");
+        store.goalState(g.id, state, actor);
         if (state === "done" && opts.onDone) {
           const current = store.goalOf(g.id, project);
           if (!current || current.id !== g.id || current.state !== "done") return fail("goal state changed before promotion offering");
@@ -276,7 +328,7 @@ export async function rawGoalCommand(args: string[], cwd: string, opts: GoalComm
       }
       case "take": {
         const g = need(rest[0]);
-        const r = store.take(g.id, "user", { force: rest.includes("--force") });
+        const r = store.take(g.id, actor, { force: rest.includes("--force") });
         if (!r.ok) fail(`held by machine ${r.holder.slice(0, 8)} until ${r.until}; wait for it to expire or take it over with --force`);
         return `this machine holds long-term task ${g.id.slice(0, 8)} until ${r.until}${rest.includes("--force") ? " (earlier claims are void)" : ""}`;
       }

package/src/memory/consolidate.ts

@@ -28,14 +28,15 @@ export class ConsolidationProposalError extends Error {
 const modelAnswer = (row: View) => row.peer === "amem-model" || row.text.startsWith("Model answer:");
 /** On-demand candidate writes only. Every source is screened once under one policy and source revision. */
 export async function proposeConsolidation(store: MemoryStore, candidates: CandidateStore, options: ConsolidationOptions): Promise<ConsolidationReport> {
-  if (options.actor !== "person") throw Error("consolidation requires person intent");
+  const actor = options.actor;
+  if (actor !== "person" && actor !== "agent") throw Error("invalid consolidation actor");
   if (options.allowed?.() === false) throw Error("consolidation unavailable");
   if (realPath(candidates.dir) !== realPath(store.profile.home)) throw Error("consolidation requires its own candidate home");
   const project = options.project, version = options.policyVersion(), policy = options.policy();
   if (!project.trim() || typeof version !== "string") throw Error("consolidation context unavailable");
   const sourceCurrent = store.beginRecallRead();
   const check = () => {
-    if (options.actor !== "person" || options.project !== project || options.allowed?.() === false || options.policyVersion() !== version) throw Error("consolidation context changed");
+    if (options.actor !== actor || options.project !== project || options.allowed?.() === false || options.policyVersion() !== version) throw Error("consolidation context changed");
     options.assertCurrent?.(); sourceCurrent();
   };
   check();

package/src/memory/decay-review.ts

@@ -74,7 +74,7 @@ export function decayPreview(store: MemoryStore, project: string, options: Decay
     return { project, profile: hashJSON(store.profile), days, at: new Date(now).toISOString(), cutoff: new Date(cutoff).toISOString(), demoteExpiresAt: store.shortExpiry(), entries: entries.slice(0, DECAY_PREVIEW_LIMIT), withheld, citedExemptions: counters === undefined ? null : citedExemptions, truncated: entries.length > DECAY_PREVIEW_LIMIT, citationHistory: "unknown" };
   });
 }
-/** Duplicate-group forgetting requires a separate person group review, never an implicit decay expansion. */
+/** Duplicate-group forgetting requires a separate group review, never an implicit decay expansion. */
 export function assertExactDecayForget(store: MemoryStore, ids: readonly string[], project: string): void {
   store.withDeferredPromotions(() => {
     for (const id of ids) {
@@ -104,10 +104,10 @@ export class DecayApplyError extends Error {
 }
 /** The host shows this exact plan; every selected revision/eligibility is rechecked before any append. */
 export function applyDecay(store: MemoryStore, plan: DecayPlan, options: DecayApplyOptions): { action: "demote" | "forget"; ids: string[]; expiresAt?: string } {
-  if (options.actor !== "person") throw Error("decay apply requires person authority");
+  if (options.actor !== "person" && options.actor !== "agent") throw Error("decay apply requires a valid actor");
   options.assertCurrent?.();
   const ids = options.ids === undefined ? plan.entries.map(entry => entry.target.id) : idsOf(options.ids);
-  if ((options.ids === undefined || options.forget) && options.confirmed !== true) throw Error("decay bulk/forget apply requires explicit person confirmation");
+  if ((options.ids === undefined || options.forget) && options.confirmed !== true) throw Error("decay bulk/forget apply requires explicit confirmation");
   if (hashJSON(store.profile) !== plan.profile || ids.some(id => !plan.entries.some(entry => entry.target.id === id))) throw Error("decay preview binding changed or target was not previewed");
   const action = options.forget ? "forget" : "demote";
   if (!ids.length) return { action, ids };
@@ -126,7 +126,7 @@ export function applyDecay(store: MemoryStore, plan: DecayPlan, options: DecayAp
     for (let index = 0; index < ids.length; index++) {
       const id = ids[index]!;
       try {
-        const result = options.forget ? store.forget(id, "person", plan.project, true) : store.demote(id, "person", plan.project, plan.demoteExpiresAt);
+        const result = options.forget ? store.forget(id, options.actor, plan.project, true) : store.demote(id, options.actor, plan.project, plan.demoteExpiresAt);
         if (!result) throw Error("decay target outcome unavailable");
         applied.push(id);
       } catch (error) { throw new DecayApplyError({ action, applied: [...applied], failed: id, remaining: ids.slice(index + 1), ...expiry }, error); }

package/src/memory/doctor.ts

@@ -1,9 +1,10 @@
-import { copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { Database } from "bun:sqlite";
 import { sessionStartBrief } from "../session-brief.ts";
 import { pendingSummary } from "./candidate-pending.ts";
+import { readCaptureDrops } from "./metrics.ts";
 import { walkShards } from "./catalog.ts";
 import { loadAmemConfig, repoConfigRoot } from "./config.ts";
 import { readSelector } from "./generation.ts";
@@ -26,7 +27,7 @@ import { nextSyncAt, readSyncState, remoteConfigured, syncDue, usableState } fro
 export type SectionStatus = "ok" | "attention" | "skipped" | "unavailable";
 export type Section<T extends object = Record<string, unknown>> = { status: SectionStatus } & T;
 export const DOCTOR_SCHEMA = "amem.doctor/v1";
-export const CLIS = ["claude", "codex", "kimi", "pi"] as const;
+export const CLIS = ["claude", "codex", "kimi", "pi", "qwen"] as const;
 export type Cli = typeof CLIS[number];
 /** A CLI whose last capture is older than this is called stale. */
 export const CAPTURE_STALE_MS = 7 * 86400_000;
@@ -54,6 +55,8 @@ export interface DoctorReport {
   project: string;
   sections: {
     duplicates: Section; stale: Section; candidates: Section; capture: Section; brief: Section; index: Section; readers: Section; policy: Section; cadence: Section;
+    /** Added after v1 shipped (#132); additive, so the schema stays amem.doctor/v1. */
+    drops: Section;
   };
 }
 
@@ -84,8 +87,10 @@ class TooBig extends Error {}
 function copyTree(from: string, to: string, budget: { bytes: number }, skipNames: ReadonlySet<string> = new Set()): void {
   mkdirSync(to, { recursive: true, mode: 0o700 });
   for (const name of readdirSync(from)) {
-    if (SKIP.test(name) || skipNames.has(name)) continue;
+    const proofObject = basename(from) === "public-prune-objects" && /^[a-f0-9]{40}\.git$/.exec(name)?.[0] === name;
+    if (SKIP.test(name) && !proofObject || skipNames.has(name)) continue;
     const source = join(from, name), stat = lstatSync(source);
+    if (proofObject && !stat.isFile()) throw new Error("a public prune object is not a plain file");
     if (stat.isSymbolicLink()) throw new Error("the memory home holds a link where a plain file or directory is expected");
     if (stat.isDirectory()) copyTree(source, join(to, name), budget, skipNames);
     else if (stat.isFile()) { budget.bytes += stat.size; if (budget.bytes > COPY_LIMIT_BYTES) throw new TooBig(); copyFileSync(source, join(to, name)); }
@@ -100,6 +105,14 @@ function copyCurated(options: DoctorOptions, layout: Layout, scratch: string, bu
     const stat = statSync(join(home, name)); budget.bytes += stat.size; if (budget.bytes > COPY_LIMIT_BYTES) throw new TooBig();
     copyFileSync(join(home, name), join(scratch, name));
   }
+  const selected = readSelector(home).selector;
+  if (selected?.schema === "agent-mem.profile/v2") {
+    const name = `${selected.pruneInputSetHash}.json`, source = join(home, "public-prune-input-sets", name), stat = lstatSync(source);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new Error("the committed public prune view is not a plain file");
+    budget.bytes += stat.size; if (budget.bytes > COPY_LIMIT_BYTES) throw new TooBig();
+    const directory = join(scratch, "public-prune-input-sets"); mkdirSync(directory, { mode: 0o700 });
+    copyFileSync(source, join(directory, name)); chmodSync(join(directory, name), 0o600);
+  }
   if (layout === "split") {
     for (const key of [options.project, ...options.aliases]) {
       const dir = shardDir(home, key);
@@ -219,7 +232,7 @@ function captureSection(options: DoctorOptions): Section {
     const needs = registered ? state !== "fresh" : state === "stale";
     if (needs) attention.push(cli);
     clis[cli] = { hook: registered ? "registered" : "manual", ...(registered ? { hookEvidence: "setup receipt" } : {}), ...(phase === "prepared" ? { setup: "prepared, not applied" } : {}), capture: state, lastCaptureAt: last, rows: entry?.rows ?? 0,
-      ...(needs || (!registered && state === "never") ? { hint: registered ? `the ${cli} hook is registered but its capture is ${state}: open a session${cli === "claude" ? "" : `, or run amem ingest ${cli}`}` : cli === "claude" ? "run amem setup claude --apply to register the capture hooks" : `run amem setup ${cli} --apply, or amem ingest ${cli} by hand` } : {}) };
+      ...(needs || (!registered && state === "never") ? { hint: registered ? cli === "codex" && state === "never" ? "the codex hook is registered but has never captured: approve it in Codex's /hooks trust review (setup never grants hook trust), then open a session" : `the ${cli} hook is registered but its capture is ${state}: open a session${cli === "claude" ? "" : `, or run amem ingest ${cli}`}` : cli === "claude" ? "run amem setup claude --apply to register the capture hooks" : `run amem setup ${cli} --apply, or amem ingest ${cli} by hand` } : {}) };
   }
   return { status: !readable ? "unavailable" : attention.length ? "attention" : "ok", ...(readable ? {} : { reason: "a capture database could not be read" }), clis };
 }
@@ -271,6 +284,17 @@ function policySection(options: DoctorOptions): Section {
   } catch (error) { return unavailable(message(error)); }
 }
 
+/** #132: capture rows hooks dropped, by reason, from the bounded rolling metrics tail (counts only; no row text is ever recorded there). */
+function dropsSection(options: DoctorOptions): Section {
+  const read = readCaptureDrops(options.home);
+  if (!read.readable) return unavailable(read.reason);   // an existing file doctor cannot read is never a healthy zero
+  // One torn line (an interrupted append) is reported, not fatal; a tail with lines of which none parses is a file doctor cannot decode.
+  if (read.lines > 0 && read.malformedLines === read.lines) return unavailable("metrics.jsonl has no decodable record in its recent tail");
+  const counts = read.counts, total = Object.values(counts).reduce((sum, n) => sum + (n ?? 0), 0);
+  return { status: total ? "attention" : "ok", window: "recent metrics tail", total, counts, ...(read.malformedLines ? { malformedLines: read.malformedLines } : {}),
+    ...(total ? { hint: "capture rows were dropped recently (see counts by reason); amem doctor --json keeps the numbers" } : {}) };
+}
+
 /** F16: which CLIs ingest at SessionEnd (setup receipts), and the person-owned sync cadence. amem registers no sync hook (a hook may not do network work). */
 function cadenceSection(options: DoctorOptions): Section {
   const ingest: Record<string, string> = {};
@@ -398,7 +422,7 @@ async function runDoctor(options: DoctorOptions): Promise<DoctorReport> {
   let sections: DoctorReport["sections"];
   try {
     await tick();
-    sections = { duplicates, stale, candidates, capture: captureSection(options), brief: await briefSection(options, curated, workBase, copyFailed), index, readers: readersSection(options), policy: policySection(options), cadence: cadenceSection(options) };
+    sections = { duplicates, stale, candidates, capture: captureSection(options), brief: await briefSection(options, curated, workBase, copyFailed), index, readers: readersSection(options), policy: policySection(options), cadence: cadenceSection(options), drops: dropsSection(options) };
     await tick();   // a signal that arrived during the last synchronous stage is handled while the guard is still installed
   } finally { try { curated?.close(); } finally { try { if (scratch) rmSync(scratch, { recursive: true, force: true }); } finally { unguard?.(); } } }
   return { schema: DOCTOR_SCHEMA, status: worst(Object.values(sections).map(section => section.status)), home: { path: options.home, source: options.homeSource }, project: options.project, sections };
@@ -407,7 +431,7 @@ async function runDoctor(options: DoctorOptions): Promise<DoctorReport> {
 /** Section order and one-line descriptions for the person-facing report (#125). */
 const SECTION_TITLE: Record<keyof DoctorReport["sections"], string> = {
   duplicates: "duplicate notes", stale: "stale path references", candidates: "review candidates", capture: "capture per CLI", brief: "session brief",
-  index: "index equals rebuild", readers: "reader leases", policy: "policy in effect", cadence: "ingest and sync cadence",
+  index: "index equals rebuild", readers: "reader leases", policy: "policy in effect", cadence: "ingest and sync cadence", drops: "recent capture drops",
 };
 
 function sectionDetail(name: string, detail: Record<string, unknown>, s: Style): string[] {
@@ -422,6 +446,11 @@ function sectionDetail(name: string, detail: Record<string, unknown>, s: Style):
     return [`ingest ${Object.entries(ingest).map(([cli, how]) => `${cli} ${how}`).join(", ")}`,
       `sync remote ${sync.remote}${sync.remote === "configured" ? `, last ok ${sync.lastOkAt ?? "never"}, failures ${sync.failures}${sync.due ? ", due" : ""}` : ""}`];
   }
+  if (name === "drops") {
+    if (detail.counts === undefined) return [];   // unavailable: only its reason is shown
+    const counts = Object.entries((detail.counts ?? {}) as Record<string, number>);
+    return [counts.length ? `${counts.map(([reason, n]) => `${reason.replaceAll("_", " ")} ${n}`).join(", ")} (recent metrics tail)` : "none in the recent metrics tail"].map(line => detail.malformedLines ? `${line}; ${detail.malformedLines} malformed lines skipped` : line);
+  }
   if (name === "brief" && typeof detail.tokens === "number") return [`${detail.tokens} of ${detail.budget} tokens${detail.coverage ? `, coverage ${facts(detail.coverage as Record<string, unknown>) || "complete"}` : ""}`];
   const { examples, ...rest } = detail;
   const line = facts(rest);

package/src/memory/generation-index.ts

@@ -1,16 +1,20 @@
-import { SHARDED_SCHEMA } from "./shard.ts";
+import { createPublicPruneReplayCache, type PublicPruneProjection } from "./public-prune-inputs.ts";
+import { readPublicPruneView, readPublicPruneViewForActivation } from "./public-prune-view.ts";
+import { SHARDED_SCHEMA, SHARDED_V2_SCHEMA } from "./shard.ts";
 import { readShardLegacySnapshot } from "./shard-bridge.ts";
 import type { Database } from "bun:sqlite";
 import { createHash } from "node:crypto";
 import { closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
-import { canonicalJSON, hashJSON, fsyncDirectory, readProfileJSON, selectorRevision, writeProfileJSON, type BoundProfile, validateVaultLinkRow, type VaultLink } from "./generation.ts";
+import { canonicalJSON, hashJSON, fsyncDirectory, readProfileJSON, selectorRevision, writeProfileJSON, type BoundProfile, validateVaultLinkRow, type VaultLink, rebindPublicPruneProfile } from "./generation.ts";
 import { legacyEntries, legacyHead, readLegacySnapshot, SegmentReader, type LegacyCheckpoint, type LegacySegment } from "./bridge.ts";
 import { reducePruneRows, validatePruneRow, type PrunePlan, type PruneRow, type PruneSnapshot, type PruneSourceRow, type PruneStorePort } from "./prune.ts";
 import { PROMOTED_KINDS, type Entry } from "./store.ts";
 
+const FOREIGN_TABLES = ["generation_foreign_inputs", "generation_foreign_rows", "generation_foreign_targets"] as const;
 const digest = (bytes: Uint8Array) => createHash("sha256").update(bytes).digest("hex");
 const fail = (): never => { throw new Error("generation input unavailable or changed; person inspection required"); };
+class PublicPruneViewChanged extends Error { constructor() { super("public prune view changed repeatedly; retry the read"); } }
 export const GENERATION_TABLES = ["generation_vault_links", "generation_rows", "generation_prunes", "generation_targets", "generation_segments", "generation_state"] as const;
 export interface GenerationIndexOptions {
   profile: BoundProfile; db: Database; now: () => number;
@@ -65,9 +69,17 @@ export class GenerationIndex {
   private fullCapture = false;
   private retainedTail = false;
   private replayProvenance = false;
+  private foreignStamp?: string;
+  private foreignCache?: { set: string; load: () => PublicPruneProjection };
   constructor(private readonly options: GenerationIndexOptions) {
     this.profile = options.profile;
     const db = options.db;
+    if (this.profile.foreignPruneFormat) {
+      db.run("CREATE TABLE IF NOT EXISTS generation_foreign_inputs (id TEXT PRIMARY KEY)");
+      db.run("CREATE TABLE IF NOT EXISTS generation_foreign_rows (id TEXT PRIMARY KEY, hash TEXT NOT NULL)");
+      db.run("CREATE TABLE IF NOT EXISTS generation_foreign_targets (id TEXT PRIMARY KEY)");
+      this.replayProvenance = true; // persistent SQLite never supplies foreign membership
+    }
     db.run("CREATE TABLE IF NOT EXISTS generation_rows (id TEXT PRIMARY KEY, line TEXT NOT NULL, local INTEGER NOT NULL, public INTEGER NOT NULL, own INTEGER NOT NULL, legacy INTEGER NOT NULL)");
     if (!(db.query("PRAGMA table_info(generation_rows)").all() as { name: string }[]).some(row => row.name === "legacy")) { db.run("ALTER TABLE generation_rows ADD COLUMN legacy INTEGER NOT NULL DEFAULT 0"); this.replayProvenance = true; }
     db.run("CREATE TABLE IF NOT EXISTS generation_vault_links (id TEXT PRIMARY KEY, target TEXT NOT NULL, row_hash TEXT NOT NULL, project TEXT NOT NULL, path TEXT NOT NULL, at TEXT NOT NULL)");
@@ -93,9 +105,14 @@ export class GenerationIndex {
   /** Authoring handles cannot read or append a partially resumed split; migration index bootstraps use captured limits. */
   private shardFrontier(): string | undefined {
     if (!this.profile.sharded || this.options.limits !== undefined) return undefined;
-    const value = readProfileJSON(join(this.profile.home, "shards.json")) as { schema?: unknown; phase?: unknown; generation?: unknown; selectorRevision?: unknown } | undefined;
-    if (!value || value.schema !== SHARDED_SCHEMA || value.phase !== "active" || value.generation !== this.profile.generation || value.selectorRevision !== this.profile.selectorRevision) return fail();
-    return hashJSON(value);
+    for (let attempt = 0; attempt < 6; attempt++) {
+      rebindPublicPruneProfile(this.profile);
+      const value = readProfileJSON(join(this.profile.home, "shards.json")) as { schema?: unknown; phase?: unknown; generation?: unknown; selectorRevision?: unknown } | undefined;
+      if (selectorRevision(this.profile.home) !== this.profile.selectorRevision) { if (this.profile.foreignPruneFormat) continue; return fail(); }
+      if (!value || value.schema !== (this.profile.foreignPruneFormat ? SHARDED_V2_SCHEMA : SHARDED_SCHEMA) || value.phase !== "active" || value.generation !== this.profile.generation || value.selectorRevision !== this.profile.selectorRevision) return fail();
+      return hashJSON(value);
+    }
+    return fail();
   }
   private capture(reader: SegmentReader = this.reader): { segments: LegacySegment[]; commit?: string } {
     const shardBefore = this.shardFrontier();
@@ -119,7 +136,7 @@ export class GenerationIndex {
       const segment = own.find(s => s.path === old.path);
       if (!segment || segment.offset < old.offset) fail();
     }
-    if (this.shardFrontier() !== shardBefore) return fail();
+    if (this.shardFrontier() !== shardBefore) { if (this.profile.foreignPruneFormat) throw new PublicPruneViewChanged(); return fail(); }
     return { segments: [...legacy, ...own], ...(commit ? { commit } : {}) };
   }
   private index(captured: { segments: LegacySegment[]; commit?: string }): void {
@@ -161,7 +178,35 @@ export class GenerationIndex {
     const reduced = reducePruneRows(prunes, snapshot, this.profile.generation!);
     db.run("DELETE FROM generation_targets");
     for (const id of [...reduced.targets].sort()) db.query("INSERT INTO generation_targets VALUES (?)").run(id);
-    this.pruned = reduced.targets;
+    this.applyForeign(true);
+    this.pruned = new Set((db.query("SELECT id FROM generation_targets").all() as {id:string}[]).map(row => row.id));
+  }
+  private applyForeign(validateRows = false): void {
+    if (!this.profile.foreignPruneFormat) return;
+    const profile = this.profile;
+    if (!profile.pruneInputSetHash || !profile.generation || !profile.sharded) return fail();
+    const view = (this.options.limits !== undefined ? readPublicPruneViewForActivation : readPublicPruneView)(profile.home, profile.pruneInputSetHash, profile.generation);
+    const key = profile.shardUser ? "user" : `project:${profile.shardKey}`, set = view.realms[key];
+    const db = this.options.db;
+    if (!set) {
+      if ((db.query("SELECT COUNT(*) AS n FROM generation_foreign_inputs").get() as {n:number}).n) return fail();
+      return;
+    }
+    if (!this.foreignCache || this.foreignCache.set !== set) this.foreignCache = { set, load: createPublicPruneReplayCache({ dir: profile.dir,
+      realm: profile.shardUser ? { scope: "user" } : { scope: "project", key: profile.shardKey! }, receivingGeneration: profile.generation, inputSetHash: set }) };
+    const proof = this.foreignCache.load();
+    if (validateRows || this.foreignStamp !== set) for (const item of db.query("SELECT id,line FROM generation_rows").all() as {id:string;line:string}[]) {
+      const expected = proof.rowHashes.get(item.id); if (expected && hashJSON(JSON.parse(item.line)) !== expected) return fail();
+    }
+    if (validateRows || this.foreignStamp !== set) {
+    for (const table of FOREIGN_TABLES) db.run(`DELETE FROM ${table}`);
+    for (const id of proof.inputs) db.query("INSERT INTO generation_foreign_inputs VALUES (?)").run(id);
+    for (const [id, hash] of proof.rowHashes) db.query("INSERT INTO generation_foreign_rows VALUES (?,?)").run(id, hash);
+    for (const id of proof.targets) db.query("INSERT INTO generation_foreign_targets VALUES (?)").run(id);
+    this.foreignStamp = set;
+    }
+    const current = new Set((db.query("SELECT id FROM generation_targets").all() as {id:string}[]).map(row => row.id));
+    for (const id of proof.targets) if (!current.has(id)) db.query("INSERT INTO generation_targets VALUES (?)").run(id);
   }
   private recordSkipped(segment: LegacySegment): void {
     this.options.db.query("INSERT INTO generation_state VALUES (?,'1') ON CONFLICT(key) DO UPDATE SET value=CAST(CAST(value AS INTEGER)+1 AS TEXT)").run(`skipped:${segment.source}:${segment.path}`);
@@ -183,12 +228,12 @@ export class GenerationIndex {
     const before = this.frontier(), db = this.options.db;
     let input: ReturnType<GenerationIndex["capture"]>;
     try { input = this.capture(reader); }
-    catch (error) { if (attempt < 5 && this.frontier() !== before) return this.refresh(attempt + 1, reader); throw error; }
+    catch (error) { if (attempt < 5 && (error instanceof PublicPruneViewChanged || this.frontier() !== before)) return this.refresh(attempt + 1, reader); throw error; }
     if (this.frontier() !== before) { if (attempt < 5) return this.refresh(attempt + 1, reader); return fail(); }
     const known = db.query("SELECT source,path,offset,hash,commit_id,stamp FROM generation_segments").all() as { source: string; path: string; offset: number; hash: string; commit_id: string | null; stamp: string | null }[];
     const currentCommit = (db.query("SELECT value FROM generation_state WHERE key='legacyCommit'").get() as { value: string } | null)?.value;
     const unchanged = known.length === input.segments.length && currentCommit === input.commit && input.segments.every(segment => known.some(row => row.source === segment.source && row.path === segment.path && row.offset === segment.offset && row.hash === segment.hash && row.commit_id === (segment.commit ?? null) && row.stamp === (segment.stamp ?? null)));
-    if (unchanged) { this.retainedTail = input.segments.some(segment => segment.tailBytes > 0); this.pruned = new Set((db.query("SELECT id FROM generation_targets").all() as { id: string }[]).map(row => row.id)); return; }
+    if (unchanged) { if (this.profile.foreignPruneFormat) db.transaction(() => this.applyForeign()).deferred(); this.retainedTail = input.segments.some(segment => segment.tailBytes > 0); this.pruned = new Set((db.query("SELECT id FROM generation_targets").all() as { id: string }[]).map(row => row.id)); return; }
     const committed = db.transaction(() => { if (this.frontier() !== before) return false; this.index(input); return true; }).immediate();
     if (!committed) { if (attempt < 5) return this.refresh(attempt + 1, reader); return fail(); }
     this.retainedTail = input.segments.some(segment => segment.tailBytes > 0);
@@ -197,11 +242,11 @@ export class GenerationIndex {
     const before = this.frontier();
     let input: ReturnType<GenerationIndex["capture"]>;
     try { this.fullCapture = true; input = this.capture(reader); }
-    catch (error) { this.fullCapture = false; if (attempt < 5 && this.frontier() !== before) return this.rebuild(attempt + 1, reader); throw error; }
+    catch (error) { this.fullCapture = false; if (attempt < 5 && (error instanceof PublicPruneViewChanged || this.frontier() !== before)) return this.rebuild(attempt + 1, reader); throw error; }
     finally { this.fullCapture = false; }
     const committed = this.options.db.transaction(() => {
       if (this.frontier() !== before) return false;
-      for (const table of ["entries", "ops", "edges", "goals", "segments", "heads", ...GENERATION_TABLES]) this.options.db.run(`DELETE FROM ${table}`);
+      for (const table of ["entries", "ops", "edges", "goals", "segments", "heads", ...GENERATION_TABLES, ...(this.profile.foreignPruneFormat ? FOREIGN_TABLES : [])]) this.options.db.run(`DELETE FROM ${table}`);
       this.index(input); return true;
     }).immediate();
     if (!committed) { if (attempt < 5) return this.rebuild(attempt + 1, reader); return fail(); }

package/src/memory/generation.ts

@@ -1,9 +1,12 @@
+import { assertNoPublicPruneIntent, readPublicPruneView, waitForPublicPruneWriter, PUBLIC_PRUNE_INTENT } from "./public-prune-view.ts";
 import { createHash, randomBytes } from "node:crypto";
 import { types } from "node:util";
 import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { readerAdmissionDatabase } from "./mutation.ts";
 import { dirname, join } from "node:path";
 import { canonicalPath, processLiveness, processSignature, realPath } from "./platform.ts";
+import { shardDir, userShardDir } from "./shard.ts";
+import { readPublicPruneInputSetChain } from "./public-prune-input-chain.ts";
 
 export interface BoundProfile {
   kind: "shared-v1" | "generation";
@@ -12,6 +15,9 @@ export interface BoundProfile {
   dir: string;
   generation?: string;
   selectorRevision: string;
+  /** Explicit v2 projection only, never inferred from an archive or caller flag. */
+  foreignPruneFormat?: "agent-mem.public-prune-witness/v1";
+  pruneInputSetHash?: string;
   /** Sharded profiles read only their own legacy input; the root home remains the machine/selector identity. */
   legacyHome?: string;
   /** Public legacy witnesses stay distinct from same-machine private bridge input. */
@@ -21,7 +27,8 @@ export interface BoundProfile {
   shardUser?: boolean;
 }
 export type ProfileInput = "shared-v1" | { generation: string };
-export interface ProfileSelector { schema: "agent-mem.profile/v1"; kind: "shared-v1" | "generation"; generation?: string }
+export type ProfileSelector = { schema: "agent-mem.profile/v1"; kind: "shared-v1" | "generation"; generation?: string }
+  | { schema: "agent-mem.profile/v2"; kind: "generation"; generation: string; foreignPruneFormat: "agent-mem.public-prune-witness/v1"; pruneInputSetHash: string };
 export interface GenerationDescriptor { schema: "agent-mem.generation/v1"; generation: string; legacySchema: "agent-hub.memory/v1" }
 export interface GenerationSeal { schema: "agent-mem.generation-seal/v1"; generation: string; descriptorHash: string; sourceDigest: string }
 export const PROFILE_LOCK_TIMEOUT_MS = 3000;
@@ -44,16 +51,69 @@ export function readProfileJSON(path: string, limit = LOCAL_METADATA_MAX_BYTES):
   } catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; return unavailable(); }
 }
 function keys(value: object, allowed: string[]): boolean { return Object.keys(value).every(key => allowed.includes(key)); }
-export function readSelector(memoryDir: string): { selector?: ProfileSelector; revision: string } {
+function selectorSnapshot(memoryDir: string, deadline: number): { selector?: ProfileSelector; revision: string } {
+  assertNoPublicPruneIntent(memoryDir, deadline);
   const value = readProfileJSON(join(memoryDir, "profile.json"));
   if (value === undefined) return { revision: "absent" };
-  if (!value || typeof value !== "object" || Array.isArray(value) || !keys(value, ["schema", "kind", "generation"])) return unavailable();
+  if (!value || typeof value !== "object" || Array.isArray(value)) return unavailable();
   const selector = value as ProfileSelector;
-  if (selector.schema !== "agent-mem.profile/v1" || !["shared-v1", "generation"].includes(selector.kind)
-    || (selector.kind === "generation" ? !validGeneration(selector.generation) : selector.generation !== undefined)) return unavailable();
+  if (selector.schema === "agent-mem.profile/v2") {
+    if (Object.keys(selector).length !== 5 || !keys(selector, ["schema", "kind", "generation", "foreignPruneFormat", "pruneInputSetHash"])
+      || selector.kind !== "generation" || !validGeneration(selector.generation) || selector.generation.length !== 32
+      || selector.foreignPruneFormat !== "agent-mem.public-prune-witness/v1" || typeof selector.pruneInputSetHash !== "string"
+      || selector.pruneInputSetHash.length !== 64 || !/^[a-f0-9]+$/.test(selector.pruneInputSetHash)) return unavailable();
+    const shard = readProfileJSON(join(memoryDir, "shards.json")) as Record<string, unknown> | undefined;
+    if (!shard || shard.schema !== "agent-mem.shards/v2" || shard.phase !== "active" || shard.generation !== selector.generation || shard.selectorRevision !== hashJSON(selector)) return unavailable();
+    readPublicPruneView(memoryDir, selector.pruneInputSetHash, selector.generation, deadline);
+  } else if (selector.schema !== "agent-mem.profile/v1" || !keys(selector, ["schema", "kind", "generation"])
+    || !["shared-v1", "generation"].includes(selector.kind) || (selector.kind === "generation" ? !validGeneration(selector.generation) : selector.generation !== undefined)) return unavailable();
+  else if ((readProfileJSON(join(memoryDir, "shards.json")) as {schema?:unknown}|undefined)?.schema === "agent-mem.shards/v2") return unavailable();
   return { selector, revision: hashJSON(selector) };
 }
+
+/** A v2 writer can replace its two markers between individual reads. Retry its
+ * bounded completed publication rather than exposing a transient mixed pair. */
+export function readSelector(memoryDir: string, absoluteDeadline?: number): { selector?: ProfileSelector; revision: string } {
+  const deadline = Math.min(absoluteDeadline ?? Infinity, Date.now() + PROFILE_LOCK_TIMEOUT_MS);
+  for (let attempt = 0; attempt < 6 && Date.now() <= deadline; attempt++) {
+    try {
+      const result = selectorSnapshot(memoryDir, deadline); assertNoPublicPruneIntent(memoryDir, deadline);
+      const current = readProfileJSON(join(memoryDir, "profile.json"));
+      if (result.revision === (current === undefined ? "absent" : hashJSON(current))) return result;
+    } catch (error) {
+      if (error instanceof Error && error.message === "public prune view unavailable") throw error; // A spent wait budget is never restarted.
+      if (!lstatSync(join(memoryDir, PUBLIC_PRUNE_INTENT), { throwIfNoEntry: false }) && !lstatSync(join(memoryDir, "profile.lock"), { throwIfNoEntry: false })) throw error;
+      waitForPublicPruneWriter(memoryDir, deadline);
+    }
+  }
+  return unavailable();
+}
+
 export const selectorRevision = (memoryDir: string): string => readSelector(memoryDir).revision;
+/** Refresh the same shared profile object only across proved monotone same-generation v2 views.
+ * Unopened realms contribute set metadata only; their descriptors and bodies stay unopened. */
+export function rebindPublicPruneProfile(profile: BoundProfile): void {
+  if (!profile.foreignPruneFormat) return;
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const current = readSelector(profile.home), selector = current.selector;
+    if (current.revision === profile.selectorRevision) return;
+    if (!profile.sharded || profile.kind !== "generation" || !profile.generation || !profile.pruneInputSetHash
+      || selector?.schema !== "agent-mem.profile/v2" || selector.generation !== profile.generation || selector.foreignPruneFormat !== profile.foreignPruneFormat) return unavailable();
+    const previous = readPublicPruneView(profile.home, profile.pruneInputSetHash, profile.generation);
+    const next = readPublicPruneView(profile.home, selector.pruneInputSetHash, profile.generation);
+    if (!Object.keys(previous.realms).every(key => Object.hasOwn(next.realms, key))) return unavailable();
+    for (const [key, hash] of Object.entries(next.realms)) {
+      const old = previous.realms[key]; if (old === hash) continue;
+      const dir = key === "user" ? userShardDir(profile.home) : shardDir(profile.home, key.slice(8));
+      const chain = readPublicPruneInputSetChain({ dir, receivingGeneration: profile.generation, inputSetHash: hash });
+      if (old !== undefined && !chain.commitments.includes(old)) return unavailable();
+    }
+    if (readSelector(profile.home).revision !== current.revision) continue;
+    profile.selectorRevision = current.revision; profile.pruneInputSetHash = selector.pruneInputSetHash;
+    return;
+  }
+  return unavailable();
+}
 export function generationDescriptor(generation: string): GenerationDescriptor {
   if (!validGeneration(generation)) return unavailable();
   return { schema: "agent-mem.generation/v1", generation, legacySchema: "agent-hub.memory/v1" };
@@ -83,8 +143,9 @@ export function validateGeneration(memoryDir: string, generation: string): strin
 export function resolveProfile(memoryDir: string, explicit?: ProfileInput): BoundProfile {
   const home = existsSync(memoryDir) ? realPath(memoryDir) : canonicalPath(memoryDir), selected = readSelector(home);
   if (explicit !== undefined && explicit !== "shared-v1" && (!explicit || typeof explicit !== "object" || !keys(explicit, ["generation"]) || !validGeneration(explicit.generation))) return unavailable();
+  if (selected.selector?.schema === "agent-mem.profile/v2" && explicit !== undefined) return unavailable();
   const generation = explicit === "shared-v1" ? undefined : explicit?.generation ?? (selected.selector?.kind === "generation" ? selected.selector.generation : undefined);
-  return generation ? { kind: "generation", home, dir: validateGeneration(home, generation), generation, selectorRevision: selected.revision }
+  return generation ? { kind: "generation", home, dir: validateGeneration(home, generation), generation, selectorRevision: selected.revision, ...(selected.selector?.schema === "agent-mem.profile/v2" ? { foreignPruneFormat: selected.selector.foreignPruneFormat, pruneInputSetHash: selected.selector.pruneInputSetHash } : {}) }
     : { kind: "shared-v1", home, dir: home, selectorRevision: selected.revision };
 }
 
@@ -142,7 +203,12 @@ export async function withProfileLock<T>(memoryDir: string, work: () => T | Prom
       await new Promise(resolve => setTimeout(resolve, Math.min(25, Math.max(1, deadline - Date.now()))));
       continue;
     }
-    try { return await work(); }
+    try {
+      const result = work();
+      // A synchronous publisher must release its lock before a queued sync reader can block this event loop.
+      if (result !== null && (typeof result === "object" || typeof result === "function") && typeof (result as PromiseLike<T>).then === "function") return await result;
+      return result;
+    }
     finally {
       // A live owner's token cannot be reclaimed; do not remove a file another actor replaced.
       if (existsSync(file) && !lstatSync(file).isSymbolicLink() && readFileSync(file, "utf8") === owner) { unlinkSync(file); fsyncDirectory(memoryDir); }