@staix/agent-mem 0.21.0 → 0.22.1

package/src/memory/sync-placement-capture.ts

@@ -18,6 +18,10 @@ import { validatePruneRow, type PruneSourceRow, type PruneRow } from "./prune.ts
 import { shardKeyHash, SHARD_SCHEMA } from "./shard.ts";
 import { SyncPlacementJournalError, placementKeyId, type PlacementKey } from "./sync-placement-journal-format.ts";
 import type { Entry } from "./store.ts";
+import { assertPlacementRuntime } from "./sync-placement-guard.ts";
+import { activationSourceMarkers, assertPlacementActivationOwner, type PlacementActivationOwner, type PlacementActivationCaptureProof } from "./sync-placement-activation-proof.ts";
+import { readEffectiveSyncPlacementWriters, writerBoundPlacementContextHash, writerInventoryEvidence, type EffectiveSyncPlacementWriters } from "./sync-placement-effective-writers.ts";
+import { SharedWriterRevisionError } from "./sync-placement-writer-revision-format.ts";
 
 /** Host authentication/compatibility facts are re-read at every effect boundary, never inferred from a session marker. */
 export interface PlacementCapturePort {
@@ -35,10 +39,22 @@ export interface PlacementCapture {
   /** Diagnostic inventory only; these rows never enter the ordinary transport/capture row map implicitly. */
   specialRows: Map<string, PlacementSpecialSourceRow>;
   sourceRowsByRealm: Map<string, readonly PruneSourceRow[]>;
+  writerInventory?:EffectiveSyncPlacementWriters;
   assertCurrent(): void;
   /** Under live writer fences, inode/ctime/size checks protect the already-hashed prefixes across callbacks without reparsing rows. */
   assertUnchanged(): void;
 }
+export function placementCaptureContextHash(capture:Pick<PlacementCapture,"context"|"writerInventory">):string{return writerBoundPlacementContextHash(capture.context,capture.writerInventory);}
+export interface PlacementActivationMarkerSnapshot {
+  profileText: string; shardsText: string; profileStamp: [string,string,string,string,string]; shardsStamp: [string,string,string,string,string];
+}
+/** Source facts only: no writer attestation, quiescence claim or effect authority. */
+export interface PlacementSourcePreview {
+  home: string; base: Omit<SyncPlacementActivationContext, "writers" | "legacySyncQuiesced">;
+  activeHead?: string; markerHash: string; markers: PlacementActivationMarkerSnapshot; directories: string[]; prefixes: PlacementPublicationSource[];
+  rows: Map<string, PlacementSourceRow>; specialRows: Map<string, PlacementSpecialSourceRow>;
+  sourceRowsByRealm: Map<string, readonly PruneSourceRow[]>; assertSourcesUnchanged(): void;
+}
 function fail(code: "changed" | "invalid" | "bound" = "changed"): never { throw new SyncPlacementJournalError(code); }
 const digest = (bytes: Uint8Array | string) => createHash("sha256").update(bytes).digest("hex");
 const stamp = (s: BigIntStats) => [s.dev, s.ino, s.size, s.mtimeNs, s.ctimeNs].map(String);
@@ -50,7 +66,7 @@ function ownedDirectory(dir: string): BigIntStats {
 }
 /** ponytail: capture is capped at 256 metadata objects and 8 MiB/20000 source rows across all realms.
  * Larger homes need a reviewed chunked activation proof; no input is silently omitted at this ceiling. */
-function capture(homeInput: string, port: PlacementCapturePort, selected?: readonly PlacementRealm[], pending: readonly PlacementPendingSource[] = []): Omit<PlacementCapture, "assertCurrent"> {
+function sourcePreview(homeInput: string, selected?: readonly PlacementRealm[], pending: readonly PlacementPendingSource[] = [], policyVersion?: string, ownerProof?: PlacementActivationCaptureProof, sourceOwner?:PlacementActivationOwner): PlacementSourcePreview {
   let selection: PlacementRealm[] | undefined;
   if (selected !== undefined) {
     if (!Array.isArray(selected) || types.isProxy(selected) || selected.length > 256) fail("bound");
@@ -58,11 +74,8 @@ function capture(homeInput: string, port: PlacementCapturePort, selected?: reado
     selection = copied.map(realm => validatePlacementKey({ realm, id: "0".repeat(32), rowHash: "0".repeat(64) }).realm);
     if (!selection.length || new Set(selection.map(realm => canonicalJSON(realm))).size !== selection.length) fail();
   }
-  // All host callouts precede filesystem capture: a callback cannot alter input after its final proof.
-  const attestation = memoryPolicySnapshot(port.attest()), policyVersion = port.policyVersion?.();
-  if (!attestation) fail();
-  if (port.policyVersion && typeof policyVersion !== "string") fail();
   const home = realPath(homeInput), root = ownedDirectory(home);
+  if(sourceOwner)assertPlacementActivationOwner(sourceOwner,home);
   let metadataObjects = 0, metadataBytes = 0;
   const facts: unknown[] = [], sourceChecks: (() => void)[] = [];
   const pendingByPath = new Map(pending.map(item => [canonicalJSON(item.realm)+":"+item.pathHash,item]));
@@ -90,7 +103,17 @@ function capture(homeInput: string, port: PlacementCapturePort, selected?: reado
     const input = bytes(file, optional); if (!input) return undefined;
     return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input));
   };
-  const rawProfile = json(join(home, "profile.json")), rawShards = json(join(home, "shards.json"));
+  const markerStart = facts.length;
+  const profileBytes = bytes(join(home, "profile.json"))!, shardsBytes = bytes(join(home, "shards.json"))!;
+  const actualMarkers: PlacementActivationMarkerSnapshot = { profileText: profileBytes.toString("utf8"), shardsText: shardsBytes.toString("utf8"),
+    profileStamp: [...(facts[markerStart] as [string,PlacementActivationMarkerSnapshot["profileStamp"],string])[1]], shardsStamp: [...(facts[markerStart+1] as [string,PlacementActivationMarkerSnapshot["shardsStamp"],string])[1]] };
+  const markers = ownerProof ? activationSourceMarkers(ownerProof,home,actualMarkers) : actualMarkers;
+  if (ownerProof) {
+    facts[markerStart] = [join(home,"profile.json"),markers.profileStamp,digest(Buffer.from(markers.profileText))];
+    facts[markerStart+1] = [join(home,"shards.json"),markers.shardsStamp,digest(Buffer.from(markers.shardsText))];
+  }
+  const decodeMarker = (text: string): unknown => JSON.parse(new TextDecoder("utf-8",{fatal:true}).decode(Buffer.from(text)));
+  const rawProfile = decodeMarker(markers.profileText) as { schema?: string }, rawShards = decodeMarker(markers.shardsText);
   let activeHead: string | undefined;
   let base: ReturnType<typeof validatePlacementBaseV2>;
   if (rawProfile?.schema === PLACEMENT_PROFILE_SCHEMA) {
@@ -109,7 +132,11 @@ function capture(homeInput: string, port: PlacementCapturePort, selected?: reado
   const machine = json(join(home, "machine.json"));
   if (machine?.id !== base.shards.machine.id) fail();
   // An in-flight migration/prune is never accepted as a stable placement source.
-  for (const name of ["profile.lock", PUBLIC_PRUNE_INTENT]) if (lstatSync(join(home, name), { throwIfNoEntry: false })) fail();
+  for (const name of ["profile.lock", PUBLIC_PRUNE_INTENT]) {
+    if (name === "profile.lock" && ownerProof) continue; // The module-private proof validated this exact live owner and sealed intent.
+    if(name==="profile.lock"&&sourceOwner){assertPlacementActivationOwner(sourceOwner,home);continue;}
+    if (lstatSync(join(home,name),{throwIfNoEntry:false})) fail();
+  }
   const reader = new SegmentReader(16 * 1024 * 1024, { maxSourceBytes: 8 * 1024 * 1024, maxRows: 20000 });
   const rows = new Map<string, PlacementSourceRow>(), specialRows = new Map<string, PlacementSpecialSourceRow>(), sourceRowsByRealm = new Map<string, readonly PruneSourceRow[]>();
   const directories = [home], prefixes: PlacementPublicationSource[] = [];
@@ -242,29 +269,68 @@ function capture(homeInput: string, port: PlacementCapturePort, selected?: reado
   if (selection && realms.length !== selection.length) fail();
   const defaults = memoryPolicySnapshot({ names: DENY_NAMES, segments: DENY_SEGMENTS }); if (!defaults) fail();
   const configuration = loadAmemConfig(home).config;
-  const context: SyncPlacementActivationContext = { ...base, homeHash: hashJSON([home, String(root.dev), String(root.ino), String(root.uid)]), sourceHash: hashJSON(facts),
-    aliasesHash: digest(aliases ?? Buffer.alloc(0)), policyHash: hashJSON({ config: configuration, defaults, policyVersion }), realms,
-    writers: attestation.writers, legacySyncQuiesced: attestation.legacySyncQuiesced };
-  // Reuse the closed stage-1 context validator, including writer/version/realm bounds.
+  const contextBase: PlacementSourcePreview["base"] = { ...base,
+    homeHash: hashJSON([home, String(root.dev), String(root.ino), String(root.uid)]), sourceHash: hashJSON(facts),
+    aliasesHash: digest(aliases ?? Buffer.alloc(0)), policyHash: hashJSON({ config: configuration, defaults, policyVersion }), realms };
+  // ponytail: passive checks rely on native inode/size/ctime identity for the hashed prefixes.
+  // Immutable descriptor-bound source blocks are the upgrade path for hostile same-user raw writers.
+  const assertSourcesUnchanged = () => {
+    try {
+      const currentDefaults = memoryPolicySnapshot({ names: DENY_NAMES, segments: DENY_SEGMENTS });
+      if (!currentDefaults || hashJSON({ config: configuration, defaults: currentDefaults, policyVersion }) !== contextBase.policyHash) fail();
+      const now = ownedDirectory(home); if (now.dev !== root.dev || now.ino !== root.ino) fail();
+      for (const check of sourceChecks) check();
+      if (ownerProof) activationSourceMarkers(ownerProof,home,actualMarkers);
+      if(sourceOwner)assertPlacementActivationOwner(sourceOwner,home);
+    } catch { fail(); }
+  };
+  return { home, base: contextBase, assertSourcesUnchanged, ...(activeHead ? { activeHead } : {}), markerHash, markers,
+    directories: directories.sort(), prefixes, rows, specialRows, sourceRowsByRealm };
+}
+/** Read-only preview shares the source collector, without fabricating a quiescence attestation. */
+export function previewSyncPlacementSources(home: string): PlacementSourcePreview {
+  return previewSources(home);
+}
+/** Internal renewal inventory under the exact live home/profile/mutation owner; no marker virtualization. */
+export function previewOwnedSyncPlacementSources(home:string,owner:PlacementActivationOwner):PlacementSourcePreview {
+  assertPlacementActivationOwner(owner,home);return previewSources(home,owner);
+}
+function previewSources(home:string,owner?:PlacementActivationOwner):PlacementSourcePreview {
+  try { assertPlacementRuntime(home); const preview = sourcePreview(home,undefined,[],undefined,undefined,owner); preview.assertSourcesUnchanged(); return preview; }
+  catch (error) {
+    if (error && typeof error === "object" && !types.isProxy(error)) {
+      if (error instanceof SyncPlacementJournalError) throw error;
+      if (error instanceof SegmentReadBudgetError) return fail("bound");
+    }
+    return fail();
+  }
+}
+function capture(home: string, port: PlacementCapturePort, selected?: readonly PlacementRealm[], pending: readonly PlacementPendingSource[] = [], ownerProof?: PlacementActivationCaptureProof): Omit<PlacementCapture, "assertCurrent"> {
+  // All host callouts precede filesystem capture, including the final passive proof.
+  const attestation = memoryPolicySnapshot(port.attest()), policyVersion = port.policyVersion?.();
+  if (!attestation || port.policyVersion && typeof policyVersion !== "string") fail();
+  const source = sourcePreview(home, selected, pending, policyVersion, ownerProof);
+  const context: SyncPlacementActivationContext = { ...source.base, writers: attestation.writers, legacySyncQuiesced: attestation.legacySyncQuiesced };
   const validated = planSyncPlacementActivation(context, "0".repeat(64));
   context.writers = validated.writers; context.realms = validated.realms;
-  // ponytail: fast rechecks rely on held mutation fences plus native inode/size/ctime identity for the already-hashed prefixes.
-  // A hostile same-user raw writer is outside that contract; descriptor-bound immutable source blocks are the upgrade path.
+  const writerInventory=source.activeHead&&writerInventoryEvidence(source.home,source.activeHead)?readEffectiveSyncPlacementWriters(source.home):undefined;
+  if(writerInventory&&canonicalJSON(context.writers)!==canonicalJSON(writerInventory.writers))fail();
   const assertUnchanged = () => {
     try {
-    // Host callbacks run first; the final filesystem proof never invokes caller code afterwards.
-    const currentAttestation=memoryPolicySnapshot(port.attest()), currentVersion=port.policyVersion?.();
-    if(!currentAttestation) fail();
-    const checked=planSyncPlacementActivation({...context,writers:currentAttestation.writers,legacySyncQuiesced:currentAttestation.legacySyncQuiesced},"0".repeat(64));
-    const currentDefaults=memoryPolicySnapshot({names:DENY_NAMES,segments:DENY_SEGMENTS});
-    if(!currentDefaults)fail();
-    if(canonicalJSON(checked.writers)!==canonicalJSON(context.writers)||hashJSON({config:configuration,defaults:currentDefaults,policyVersion:currentVersion})!==context.policyHash) fail();
-    const now=ownedDirectory(home); if(now.dev!==root.dev||now.ino!==root.ino) fail();
-    for(const check of sourceChecks)check();
+      const currentAttestation = memoryPolicySnapshot(port.attest()), currentVersion = port.policyVersion?.();
+      if (!currentAttestation) fail();
+      const checked = planSyncPlacementActivation({ ...context, writers: currentAttestation.writers, legacySyncQuiesced: currentAttestation.legacySyncQuiesced }, "0".repeat(64));
+      if (canonicalJSON(checked.writers) !== canonicalJSON(context.writers) || currentVersion !== policyVersion) fail();
+      writerInventory?.assertCurrent();
+      if(source.activeHead&&!writerInventory&&writerInventoryEvidence(source.home,source.activeHead))fail();
+      source.assertSourcesUnchanged();
     } catch { fail(); }
   };
-  return { home, context, assertUnchanged, ...(activeHead ? { activeHead } : {}), markerHash, fingerprint: hashJSON({ context, markerHash }), directories: directories.sort(), prefixes, rows, specialRows, sourceRowsByRealm };
+  return { home: source.home, context, assertUnchanged, ...(source.activeHead ? { activeHead: source.activeHead } : {}),
+    ...(writerInventory?{writerInventory}:{}),markerHash: source.markerHash, fingerprint: hashJSON({ context, markerHash: source.markerHash,...(writerInventory?.revisionSequence?{writerRevisionHash:writerInventory.revisionHash}:{}) }), directories: source.directories,
+    prefixes: source.prefixes, rows: source.rows, specialRows: source.specialRows, sourceRowsByRealm: source.sourceRowsByRealm };
 }
+
 export function captureSyncPlacementContext(home: string, port: PlacementCapturePort, selected?: readonly PlacementRealm[], pendingInput: readonly PlacementPendingSource[] = []): PlacementCapture {
   try {
     const selection = selected === undefined ? undefined : memoryPolicySnapshot(selected);
@@ -282,6 +348,21 @@ export function captureSyncPlacementContext(home: string, port: PlacementCapture
     });
     const before = capture(home, port, selection, pending);
     return { ...before, assertCurrent: () => { try { if (capture(home, port, selection, pending).fingerprint !== before.fingerprint) fail(); } catch { fail(); } } };
+  } catch (error) {
+    if (error && typeof error === "object" && !types.isProxy(error)) {
+      if(error instanceof SharedWriterRevisionError){const code=Object.getOwnPropertyDescriptor(error,"code")?.value;if(code==="staging"||code==="pending")throw new SharedWriterRevisionError(code);}
+      if (error instanceof SyncPlacementJournalError) throw error;
+      if (error instanceof SegmentReadBudgetError) return fail("bound");
+    }
+    return fail();
+  }
+}
+
+/** Internal initial-activation capture only. Tokens require the actual profile owner, live home mutation and exact durable intent. */
+export function captureSyncPlacementActivationContext(home: string, port: PlacementCapturePort, proof: PlacementActivationCaptureProof): PlacementCapture {
+  try {
+    const before = capture(home,port,undefined,[],proof);
+    return { ...before, assertCurrent: () => { if (capture(home,port,undefined,[],proof).fingerprint !== before.fingerprint) fail(); } };
   } catch (error) {
     if (error && typeof error === "object" && !types.isProxy(error)) {
       if (error instanceof SyncPlacementJournalError) throw error;

package/src/memory/sync-placement-effective-writers.ts

@@ -0,0 +1,84 @@
+/** Expected inventory metadata only. Callers must still obtain fresh install attestations. */
+import { lstatSync, opendirSync } from "node:fs";
+import { join } from "node:path";
+import { hashJSON } from "./generation.ts";
+import { readPlacementRuntimeMarkers } from "./sync-placement-guard.ts";
+import { readActivePlacementBinding, type ActivePlacementBinding } from "./sync-placement-active.ts";
+import { readPlacementWriterJournalAnchors, placementWriterJournalToken } from "./sync-placement-journal-storage.ts";
+import { readWriterHistory, isWriterRenewalIntentTempName } from "./sync-placement-writer-history.ts";
+import { SharedWriterRevisionError, writerRevisionWriters, WRITER_RENEWAL_INTENT_FILE } from "./sync-placement-writer-revision-format.ts";
+import { readInitialSyncPlacementWriterLocator, SYNC_PLACEMENT_WRITER_ROOTS_FILE } from "./sync-placement-writer-roots.ts";
+import { requireWriterRenewalHomeFloor } from "./sync-placement-prerequisites.ts";
+import type { SyncPlacementWriterAttestation } from "./sync-placement-plan.ts";
+
+export interface EffectiveSyncPlacementWriters {
+  epochHash:string;activationHash:string;revisionSequence:number;revisionHash:string;roots?:readonly string[];
+  writers:readonly SyncPlacementWriterAttestation[];initialLocatorHash?:string;
+  assertCurrent():void;
+}
+function fail():never{throw new SharedWriterRevisionError("changed");}
+function active(home:string):ActivePlacementBinding {
+  const markers=readPlacementRuntimeMarkers(home),value=readActivePlacementBinding(home,markers.profile,markers.shards);if(!value)fail();return value;
+}
+const key=(value:ActivePlacementBinding)=>hashJSON({epoch:value.epoch,activation:value.activation,head:value.profile.placementHead,generation:value.profile.generation});
+const fileStamp=(home:string)=>{
+  const s=lstatSync(join(home,SYNC_PLACEMENT_WRITER_ROOTS_FILE),{bigint:true,throwIfNoEntry:false});
+  return s?[s.dev,s.ino,s.mode,s.uid,s.nlink,s.size,s.mtimeNs,s.ctimeNs].map(String).join(":"):undefined;
+};
+/** A source-only capture can bootstrap its initial fence; do not impose renewal admission on that old path. */
+export function writerInventoryEvidence(home:string,epochHash:string):boolean{
+  const scan=(dir:string,maximum:number,match:(name:string)=>boolean)=>{
+    const reader=opendirSync(dir);let count=0,found=false;try{for(;;){const e=reader.readSync();if(!e)break;if(++count>maximum)throw new SharedWriterRevisionError("bound");if(match(e.name))found=true;}}finally{reader.closeSync();}return found;
+  };
+  const outside=scan(home,20000,name=>{
+    if(name.startsWith(WRITER_RENEWAL_INTENT_FILE+".pending-")&&!isWriterRenewalIntentTempName(name))throw new SharedWriterRevisionError("invalid");
+    return name===WRITER_RENEWAL_INTENT_FILE||isWriterRenewalIntentTempName(name);
+  });
+  let dir=home;
+  for(const part of ["sync-placement","epochs",epochHash]){
+    dir=join(dir,part);const s=lstatSync(dir,{throwIfNoEntry:false});if(!s)return outside;
+    if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==process.getuid?.()||(s.mode&0o077)!==0)throw new SharedWriterRevisionError("invalid");
+  }
+  return scan(dir,255,name=>name.startsWith("writer-"))||outside;
+}
+export function readEffectiveSyncPlacementWriters(home:string):EffectiveSyncPlacementWriters {
+  const binding=active(home),bindingKey=key(binding),epochHash=binding.profile.placementHead;
+  writerInventoryEvidence(home,epochHash);
+  const history=readWriterHistory(home,{epochHash,activationHash:binding.activation.seal,homeHash:binding.epoch.homeHash,generation:binding.epoch.generation});
+  const initialStamp=fileStamp(home),initial=initialStamp===undefined?undefined:readInitialSyncPlacementWriterLocator(home);
+  if(history.sequence){
+    requireWriterRenewalHomeFloor(home);
+    if(!initial||history.current?.initialLocatorHash!==initial.seal)fail();
+  }
+  let anchorToken:string|undefined;
+  // ponytail: native inode/size/ctime identity permits prefix reuse; hostile same-user rewrites need immutable snapshot blocks.
+  const anchors=()=>{
+    if(!history.sequence)return;
+    const token=placementWriterJournalToken(home,epochHash);if(token===anchorToken)return;
+    const journal=readPlacementWriterJournalAnchors(home,epochHash);
+    if(journal.epoch.homeHash!==binding.epoch.homeHash||journal.activation.seal!==binding.activation.seal)fail();
+    for(const anchor of history.anchors){
+      if(anchor.sequence>journal.sequence||(anchor.sequence===0?epochHash:journal.records[anchor.sequence-1]?.seal)!==anchor.headHash)fail();
+    }
+    if(placementWriterJournalToken(home,epochHash)!==token)fail();anchorToken=token;
+  };
+  const assertCurrent=()=>{
+    history.assertCurrent();if(key(active(home))!==bindingKey||fileStamp(home)!==initialStamp)fail();
+    if(initial&&readInitialSyncPlacementWriterLocator(home).seal!==initial.seal)fail();
+    if(history.sequence)requireWriterRenewalHomeFloor(home);
+    anchors();history.assertCurrent();
+  };
+  anchors();assertCurrent();
+  const roots=history.current?.roots.map(root=>root.root)??initial?.roots.map(root=>root.root);
+  return{epochHash,activationHash:binding.activation.seal,revisionSequence:history.sequence,revisionHash:history.headHash,
+    writers:history.current?writerRevisionWriters(history.current):binding.activation.writers,
+    ...(roots?{roots}:{}),...(initial?{initialLocatorHash:initial.seal}:{}),assertCurrent};
+}
+/** Locators only; these paths and expected pins never replace a fresh callback. */
+export function readEffectiveSyncPlacementWriterRoots(home:string):string[]{
+  const value=readEffectiveSyncPlacementWriters(home);if(!value.roots)throw new SharedWriterRevisionError("invalid");value.assertCurrent();return[...value.roots];
+}
+/** Keep existing no-revision artifacts byte-identical while binding renewed attempts to their committed head. */
+export function writerBoundPlacementContextHash(context:unknown,inventory?:Pick<EffectiveSyncPlacementWriters,"revisionSequence"|"revisionHash">):string {
+  return inventory?.revisionSequence?hashJSON(["agent-mem.sync-placement-writer-bound-context/v1",context,inventory.revisionHash]):hashJSON(context);
+}

package/src/memory/sync-placement-guard.ts

@@ -6,12 +6,15 @@ import { join } from "node:path";
 import { LOCAL_METADATA_MAX_BYTES, legacyProfileMarkerShape, type BoundProfile } from "./generation.ts";
 import { legacyShardMarkerShape } from "./shard.ts";
 import { PLACEMENT_PROFILE_SCHEMA, PLACEMENT_SHARDS_SCHEMA, validatePlacementProfile, validatePlacementShards } from "./sync-placement-format.ts";
+import { PLACEMENT_ACTIVATION_INTENT } from "./sync-placement-activation-path.ts";
+import { profileLockRefusal, rememberProfileLockError } from "./profile-lock-diagnostic.ts";
 
 export const PLACEMENT_STAGE1_REFUSAL = "sync placement v3 requires matching durable activation metadata; keep the current compatible profile active until person-authorized activation is complete";
 export const PLACEMENT_MARKER_REFUSAL = "sync placement metadata is invalid or unsupported; person inspection and a compatible reader are required before continuing";
+export const PLACEMENT_ACTIVATION_PENDING = "sync placement activation is pending or incomplete; have the person inspect retained evidence and run amem migrate --sync-placement --resume, or --abandon only while both markers retain their original v2 bytes";
 export class SyncPlacementRuntimeError extends Error {
   readonly code: "sync_placement_not_enabled" | "sync_placement_unavailable";
-  constructor(reason: string) { super(reason); this.name = "SyncPlacementRuntimeError"; this.code = reason === PLACEMENT_STAGE1_REFUSAL ? "sync_placement_not_enabled" : "sync_placement_unavailable"; }
+  constructor(reason: string) { super(reason); this.name = "SyncPlacementRuntimeError"; this.code = reason === PLACEMENT_STAGE1_REFUSAL ? "sync_placement_not_enabled" : "sync_placement_unavailable";rememberProfileLockError(this,reason); }
 }
 class MarkerChanged extends Error {}
 const same = (left: BigIntStats, right: BigIntStats) => left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
@@ -63,15 +66,22 @@ export function placementMarkerRefusal(profile: unknown, shards: unknown): strin
 /** Selector preflight only recognizes v3. Legacy malformed/split metadata must retain its existing reader/recovery path. */
 // This narrow probe is not a data/transport gate; effects must still use the full runtime guard.
 export function placementSelectorRefusal(home: string): string | undefined {
+  const refusal=selectorRefusal(home);return refusal?profileLockRefusal(home)??refusal:undefined;
+}
+function selectorRefusal(home:string):string|undefined {
   // A durable placement fence forbids falling back to raw legacy sync after marker rollback.
   const fenced = placementFencePresent(home);
+  const pending = placementActivationPending(home);
   let profile: unknown, shards: unknown;
   try { profile = readMarker(join(home, "profile.json")); } catch { /* The original selector reader reports this legacy failure. */ }
   try { shards = readMarker(join(home, "shards.json")); } catch { /* Ordinary migration still owns malformed split-state recovery. */ }
-  if (schema(profile) !== PLACEMENT_PROFILE_SCHEMA && schema(shards) !== PLACEMENT_SHARDS_SCHEMA) return fenced ? PLACEMENT_MARKER_REFUSAL : undefined;
+  if (schema(profile) !== PLACEMENT_PROFILE_SCHEMA && schema(shards) !== PLACEMENT_SHARDS_SCHEMA) return pending ? PLACEMENT_ACTIVATION_PENDING : fenced ? PLACEMENT_MARKER_REFUSAL : undefined;
   const refusal = placementMarkerRefusal(profile, shards);
-  if (refusal !== PLACEMENT_STAGE1_REFUSAL) return refusal;
-  try { return readActivePlacementBinding(home, profile, shards) ? undefined : refusal; } catch { return PLACEMENT_MARKER_REFUSAL; }
+  if (refusal !== PLACEMENT_STAGE1_REFUSAL) return pending ? PLACEMENT_ACTIVATION_PENDING : refusal;
+  try { return readActivePlacementBinding(home, profile, shards) ? undefined : pending ? PLACEMENT_ACTIVATION_PENDING : refusal; } catch { return PLACEMENT_MARKER_REFUSAL; }
+}
+function placementActivationPending(home: string): boolean {
+  return lstatSync(join(home,PLACEMENT_ACTIVATION_INTENT),{throwIfNoEntry:false}) !== undefined;
 }
 function placementFencePresent(home: string): boolean {
   const root = lstatSync(join(home, "sync-placement"), { throwIfNoEntry: false });
@@ -82,17 +92,17 @@ function placementFencePresent(home: string): boolean {
 /** Bounded activation/view metadata only; no data/index open, cache mutation, lock or child/network call.
  * The v3 publication coordinator separately proves the complete journal, selected sources and policy. */
 export function placementRuntimeRefusal(home: string, bound?: Pick<BoundProfile,"kind"|"sharded"|"generation"|"publicationFormat"|"placementHead">): string | undefined {
-  try { const fenced = placementFencePresent(home), markers = readPlacementRuntimeMarkers(home);
+  try { const fenced = placementFencePresent(home), pending = placementActivationPending(home), markers = readPlacementRuntimeMarkers(home);
     const refusal = placementMarkerRefusal(markers.profile, markers.shards);
     if (refusal === PLACEMENT_STAGE1_REFUSAL) {
       const active=readActivePlacementBinding(home,markers.profile,markers.shards);
-      if(!active)return refusal;
+      if(!active)return pending ? PLACEMENT_ACTIVATION_PENDING : refusal;
       if(bound && (bound.kind!=="generation"||bound.sharded!==true||bound.generation!==active.profile.generation||bound.publicationFormat!==active.profile.publicationFormat||bound.placementHead!==active.profile.placementHead)) return PLACEMENT_MARKER_REFUSAL;
       return undefined;
     }
-    return refusal ?? (fenced ? PLACEMENT_MARKER_REFUSAL : undefined); }
+    return refusal ?? (pending ? PLACEMENT_ACTIVATION_PENDING : fenced ? PLACEMENT_MARKER_REFUSAL : undefined); }
   catch { return PLACEMENT_MARKER_REFUSAL; }
 }
 export function assertPlacementRuntime(home: string): void {
-  const refusal = placementRuntimeRefusal(home); if (refusal) throw new SyncPlacementRuntimeError(refusal);
+  const refusal = placementRuntimeRefusal(home); if (refusal) throw new SyncPlacementRuntimeError(profileLockRefusal(home)??refusal);
 }

package/src/memory/sync-placement-inspection.ts

@@ -25,6 +25,7 @@ import type { PlacementPublicationDecisionReason } from "./sync-placement-public
 import type { ShardSyncRealm, ShardSyncRow } from "./shard-sync-format.ts";
 import type { MemoryStore } from "./store.ts";
 import { captureInspectionPendingPrunes } from "./sync-placement-inspection-pending.ts";
+import { SharedWriterRevisionError } from "./sync-placement-writer-revision-format.ts";
 
 export interface SyncPlacementInspectionOptions {
   screen?: RowScreen;
@@ -119,7 +120,7 @@ export async function inspectSyncPlacement(store: MemoryStore, input: SyncPlacem
     const port: PlacementCapturePort = { attest: options.placementAttestation, ...(options.policyVersion ? { policyVersion: options.policyVersion } : {}) };
     const capture = captureSyncPlacementContext(home, port, targets.map(target => physical(target.realm)));
     captured = true;
-    if (capture.activeHead !== active.profile.placementHead || canonicalJSON(capture.context.writers) !== canonicalJSON(active.activation.writers)) fail("attestation-unavailable");
+    if (capture.activeHead !== active.profile.placementHead || canonicalJSON(capture.context.writers) !== canonicalJSON(capture.writerInventory?.writers??active.activation.writers)) fail("attestation-unavailable");
     phase = "journal-unavailable"; const retained = captureInspectionJournal(home, active.profile.placementHead);
     const check = () => {
       if (binding() !== beforeBinding) fail("binding-changed"); retained.assertCurrent(); capture.assertUnchanged();
@@ -219,6 +220,9 @@ export async function inspectSyncPlacement(store: MemoryStore, input: SyncPlacem
   } catch (error) {
     let reason: SyncPlacementInspectionIncompleteReason = phase;
     if (error && typeof error === "object" && !types.isProxy(error)) {
+      if(error instanceof SharedWriterRevisionError){const code=Object.getOwnPropertyDescriptor(error,"code")?.value;
+        if(code==="staging"||code==="pending")return{complete:false,reason:"journal-unavailable",nextStep:new SharedWriterRevisionError(code).message};
+      }
       if (error instanceof Incomplete) reason = error.reason;
       else if (error instanceof FormatFloorError) {
         if (error.code === "format_floor") reason = "reader-upgrade-required";

package/src/memory/sync-placement-journal-storage.ts

@@ -14,6 +14,8 @@ import { PLACEMENT_ACTIVE_FENCE_SCHEMA, PLACEMENT_JOURNAL_MAX_RECORDS, PLACEMENT
 import { validatePlacementPublicationRoot, validatePlacementPublicationBundle, validatePlacementPublicationFact, publicationFileNames,
   PLACEMENT_PUBLICATION_RECORD_MAX_BYTES, type PlacementPublicationRoot, type PlacementPublicationBundle, type PlacementPublicationFact } from "./sync-placement-publication-plan.ts";
 import { PlacementProjection } from "./sync-placement-projection.ts";
+import { WRITER_RENEWAL_INTENT_FILE, WRITER_RENEWAL_INTENT_MAX_BYTES, WRITER_COMMIT_LOG, writerHistoryFileLimit, writerRevisionFile } from "./sync-placement-writer-revision-format.ts";
+import { isWriterRenewalIntentTempName } from "./sync-placement-writer-history.ts";
 
 export type PlacementStoragePhase = "epoch-written" | "epoch-fsync" | "activation-written" | "activation-fsync" | "fence-written" | "fence-fsync"
   | "intent-written" | "intent-fsync" | "chunk-written" | "chunk-fsync" | "intent-cleared"
@@ -53,7 +55,18 @@ function names(dir: string, maximum: number): string[] {
   finally { reader.closeSync(); }
   return result.sort();
 }
-function inventory(p: Paths): { files: Map<string, BigIntStats>; token: string } {
+function renewalIntentObjects(home:string):{count:number;token:unknown[]} {
+  const token:unknown[]=[];
+  for(const name of names(home,20000)){
+    if(name!==WRITER_RENEWAL_INTENT_FILE&&!isWriterRenewalIntentTempName(name))continue;
+    const s=lstatSync(join(home,name),{bigint:true});
+    if(!s.isFile()||s.isSymbolicLink()||s.uid!==BigInt(process.getuid?.()??-1)||(s.mode&0o777n)!==0o600n||![1n,2n].includes(s.nlink))fail();
+    if(s.size>BigInt(WRITER_RENEWAL_INTENT_MAX_BYTES))fail("bound");
+    token.push([name,String(s.dev),String(s.ino),String(s.size),String(s.nlink),String(s.mtimeNs),String(s.ctimeNs)]);
+  }
+  return{count:token.length,token};
+}
+function inventory(p: Paths): { files: Map<string, BigIntStats>; token: string; renewalObjects:number } {
   const parents: unknown[] = [];
   for (const dir of [p.home, p.root, p.epochs, p.dir]) { const stat = state(dir, true); parents.push([dir, stat ? [String(stat.dev), String(stat.ino)] : null]); }
   if (state(p.root, true)) for (const name of names(p.root, 2)) {
@@ -63,15 +76,17 @@ function inventory(p: Paths): { files: Map<string, BigIntStats>; token: string }
   const files = new Map<string, BigIntStats>();
   if (state(p.dir, true)) for (const name of names(p.dir, PLACEMENT_JOURNAL_MAX_OBJECTS - 1)) {
     const chunk = /^records-\d{5}\.jsonl$/.test(name);
-    if (!chunk && !publicationName(name) && !["epoch.json", "activation.json", "append-intent.json"].includes(name)) fail();
+    const writerLimit=writerHistoryFileLimit(name);
+    if (!chunk && !publicationName(name) && writerLimit===undefined && !["epoch.json", "activation.json", "append-intent.json"].includes(name)) fail();
     const stat = state(join(p.dir, name))!;
-    if (stat.size > BigInt(chunk || /-chunk-\d{5}\.json$/.test(name) ? PLACEMENT_JOURNAL_CHUNK_MAX_BYTES : PLACEMENT_JOURNAL_ROOT_MAX_BYTES)) fail("bound");
+    if (stat.size > BigInt(writerLimit??(chunk || /-chunk-\d{5}\.json$/.test(name) ? PLACEMENT_JOURNAL_CHUNK_MAX_BYTES : PLACEMENT_JOURNAL_ROOT_MAX_BYTES))) fail("bound");
     files.set(name, stat);
   }
   // One global active.json slot is always reserved, whether that fence exists yet or not.
-  if (files.size + 1 > PLACEMENT_JOURNAL_MAX_OBJECTS) fail("bound");
+  const renewal=renewalIntentObjects(p.home);
+  if (files.size + 1 + renewal.count > PLACEMENT_JOURNAL_MAX_OBJECTS) fail("bound");
   const fence = state(join(p.root, "active.json"));
-  return { files, token: canonicalJSON({ parents, files: [...files].map(([name, stat]) => [name, String(stat.dev), String(stat.ino), String(stat.size), String(stat.mtimeNs), String(stat.ctimeNs)]),
+  return { files, renewalObjects:renewal.count, token: canonicalJSON({ parents, renewal:renewal.token, files: [...files].map(([name, stat]) => [name, String(stat.dev), String(stat.ino), String(stat.size), String(stat.mtimeNs), String(stat.ctimeNs)]),
     fence: fence ? [String(fence.dev), String(fence.ino), String(fence.size), String(fence.mtimeNs), String(fence.ctimeNs)] : null }) };
 }
 function readOwned(file: string, maximum: number): Buffer | undefined {
@@ -152,7 +167,7 @@ function snapshot(p: Paths): Snapshot {
   if ((records.length > 0 || pendingBytes !== undefined) && (!activeFence || fencePending || activeFence.epochHash !== p.hash
     || activeFence.homeHash !== epoch.homeHash || activeFence.generation !== epoch.generation)) fail();
   if (inventory(p).token !== before.token) fail("changed");
-  return { epoch, activation: plan, records, projection, headHash: projection.headHash, sequence: projection.sequence, objects: before.files.size + 1, pending: !!pending || intentPending || fencePending, chunks, intentPending, fencePending, ...(pending ? { pendingRecordSequence: pending.record.sequence, pendingRecord: validatePlacementRecord(pending.record) } : {}), ...(pending ? { intent: pending } : {}) };
+  return { epoch, activation: plan, records, projection, headHash: projection.headHash, sequence: projection.sequence, objects: before.files.size + 1 + before.renewalObjects, pending: !!pending || intentPending || fencePending, chunks, intentPending, fencePending, ...(pending ? { pendingRecordSequence: pending.record.sequence, pendingRecord: validatePlacementRecord(pending.record) } : {}), ...(pending ? { intent: pending } : {}) };
 }
 export function readPlacementJournal(home: string, epochHash: string): PlacementJournalRead {
   return protectedIO(() => {
@@ -168,12 +183,41 @@ export function readPlacementJournal(home: string, epochHash: string): Placement
     if (inventory(p).token !== before) fail("changed"); return result;
   });
 }
+/** Writer history only needs the authoritative row prefix, including during owned publication-root writes.
+ * Full transport/recovery still uses readPlacementJournal and its reservation proof. */
+export function placementWriterJournalToken(home:string,epochHash:string):string {
+  return protectedIO(()=>{
+    const p=paths(home,epochHash),dir=state(p.dir,true);if(!dir)fail("changed");
+    const rows:unknown[]=[["directory",String(dir.dev),String(dir.ino),String(dir.mode),String(dir.uid)]];
+    for(const name of names(p.dir,PLACEMENT_JOURNAL_MAX_OBJECTS-1))if(name.startsWith("records-")||name==="append-intent.json"){
+      const s=state(join(p.dir,name));if(!s)fail("changed");
+      rows.push([name,String(s.dev),String(s.ino),String(s.mode),String(s.uid),String(s.nlink),String(s.size),String(s.mtimeNs),String(s.ctimeNs)]);
+    }
+    return canonicalJSON(rows);
+  });
+}
+export function readPlacementWriterJournalAnchors(home:string,epochHash:string):Pick<PlacementJournalRead,"epoch"|"activation"|"records"|"sequence"|"headHash"> {
+  return protectedIO(()=>{
+    const read=snapshot(paths(home,epochHash));
+    return{epoch:read.epoch,activation:read.activation,records:read.records,sequence:read.sequence,headHash:read.headHash};
+  });
+}
 function current(p: Paths, opts: PlacementStorageOptions, required: readonly string[] = []): void {
   try { assertMutationHandle(opts.mutation, p.home); } catch { return fail("busy"); }
   try { opts.assertCurrent(); } catch (error) { if (knownError(error)) throw error; return fail("changed"); }
   try { assertMutationHandle(opts.mutation, p.home); } catch { return fail("busy"); }
   const found = inventory(p), names = new Set([...found.files.keys(), ...required, ...reservedPublicationJournalNames(p)]);
-  if (names.size + 1 > PLACEMENT_JOURNAL_MAX_OBJECTS) fail("bound");
+  if(found.renewalObjects)fail("pending");
+  if (names.size + 1 + found.renewalObjects > PLACEMENT_JOURNAL_MAX_OBJECTS) fail("bound");
+}
+/** One shared budget includes the outside intent and its transient immutable-publication companion. */
+export function writerRenewalCapacity(home:string,epochHash:string,sequence:number):{objects:number;remainingObjects:number} {
+  return protectedIO(()=>{
+    const p=paths(home,epochHash),found=inventory(p),next=new Set([...found.files.keys(),...reservedPublicationJournalNames(p),WRITER_COMMIT_LOG,writerRevisionFile(sequence)]);
+    const objects=next.size+1+Math.max(2,found.renewalObjects);
+    if(objects>PLACEMENT_JOURNAL_MAX_OBJECTS)fail("bound");
+    return{objects,remainingObjects:PLACEMENT_JOURNAL_MAX_OBJECTS-objects};
+  });
 }
 function writer<T>(home: string, epochHash: string, opts: PlacementStorageOptions, work: (p: Paths) => T, incompleteAttempt?: string, preflight?: readonly string[] | ((p: Paths) => readonly string[])): T {
   return protectedIO(() => {

package/src/memory/sync-placement-journal.ts

@@ -10,11 +10,12 @@ import { outboundPolicyEvaluator, type RowScreen } from "./sync-screen.ts";
 import { assertPlacementRuntime } from "./sync-placement-guard.ts";
 import { PLACEMENT_FORMAT } from "./sync-placement-format.ts";
 import { planSyncPlacementActivation, validatePlacementPlan, validateSyncPlacementActivation, type SyncPlacementActivationPlan } from "./sync-placement-plan.ts";
-import { captureSyncPlacementContext, type PlacementCapturePort, type PlacementCapture } from "./sync-placement-capture.ts";
+import { captureSyncPlacementContext, placementCaptureContextHash, type PlacementCapturePort, type PlacementCapture } from "./sync-placement-capture.ts";
 import { PLACEMENT_EPOCH_SCHEMA, placementEpochHash, placementKeyId, validatePlacementEpoch, validatePlacementKey, validatePlacementEvent,
   SyncPlacementJournalError, type PlacementEpoch, type PlacementKey, type PlacementCommittedOutcome, type PlacementAmbiguousOutcome } from "./sync-placement-journal-format.ts";
 import { rebuildPlacementProjection } from "./sync-placement-projection.ts";
 import { preparePlacementEpoch, readPlacementJournal, appendPlacementEvent } from "./sync-placement-journal-storage.ts";
+import { SharedWriterRevisionError } from "./sync-placement-writer-revision-format.ts";
 
 export interface PlacementJournalPreview { epoch: PlacementEpoch; plan: SyncPlacementActivationPlan }
 export interface PlacementAuthorizationBinding {
@@ -28,7 +29,13 @@ export interface PlacementJournalPort extends PlacementCapturePort {
 }
 function fail(code: "invalid" | "changed" | "authorization" | "policy" | "local" | "conflict" | "pending" | "busy" = "invalid"): never { throw new SyncPlacementJournalError(code); }
 function protectedCall<T>(work: () => T): T {
-  try { return work(); } catch (error) { if (error && typeof error === "object" && !types.isProxy(error) && error instanceof SyncPlacementJournalError) throw error; return fail("changed"); }
+  try { return work(); } catch (error) {
+    if(error&&typeof error==="object"&&!types.isProxy(error)){
+      if(error instanceof SyncPlacementJournalError)throw error;
+      if(error instanceof SharedWriterRevisionError){const code=Object.getOwnPropertyDescriptor(error,"code")?.value;if(code==="staging"||code==="pending")throw new SharedWriterRevisionError(code);}
+    }
+    return fail("changed");
+  }
 }
 function person(port: PlacementJournalPort, action: "prepare" | "hold" | "release", seal: string, details: Omit<PlacementAuthorizationBinding, "action" | "seal"> = {}): void {
   let authorized = false;
@@ -86,7 +93,7 @@ function active(home: string, input: PlacementEffectRequest, port: PlacementCapt
   if (capture.activeHead !== input.epochHash || journal.epoch.homeHash !== capture.context.homeHash
     || journal.epoch.generation !== (capture.context.profile as { generation: string }).generation
     || journal.activation.targetProfile.placementHead !== input.epochHash
-    || canonicalJSON(capture.context.writers) !== canonicalJSON(journal.activation.writers)
+    || canonicalJSON(capture.context.writers) !== canonicalJSON(capture.writerInventory?.writers??journal.activation.writers)
     || canonicalJSON(capture.context.realms.map(({ bindingHash: _hash, ...identity }) => identity))
       !== canonicalJSON(journal.activation.realms.map(({ bindingHash: _hash, ...identity }) => identity))) fail("changed");
   const markers = readPlacementRuntimeMarkers(capture.home), profile = validatePlacementProfile(markers.profile);
@@ -116,7 +123,7 @@ function effect(home: string, raw: PlacementEffectRequest, port: PlacementJourna
       if (!outboundPolicyEvaluator(capture.home, port.screen)(source.row as unknown as Record<string, unknown>).ok) fail("policy");
       partial = { ...fields, kind: "release" };
     } else partial = { ...fields, kind: decision.kind, outcome: decision.outcome };
-    const effectHash = hashJSON({ event: partial, expectedHead: input.expectedHead, markerHash: capture.markerHash, contextHash: hashJSON(capture.context) });
+    const effectHash = hashJSON({ event: partial, expectedHead: input.expectedHead, markerHash: capture.markerHash, contextHash: placementCaptureContextHash(capture) });
     const event = validatePlacementEvent({ ...partial, effectHash });
     if (decision.kind === "release" || decision.kind === "hold" && decision.mode === "person") person(port, decision.kind, effectHash, { epochHash: input.epochHash, key: Object.freeze({ ...input.key, realm: Object.freeze({ ...input.key.realm }) }),
       expectedHead: input.expectedHead, policyHash: capture.context.policyHash });

package/src/memory/sync-placement-prerequisites.ts

@@ -0,0 +1,50 @@
+/** Activation preflight only. Never migrates, opens an index, raises a floor or creates a home. */
+import { lstatSync } from "node:fs";
+import { realPath } from "./platform.ts";
+import { hashJSON } from "./generation.ts";
+import { assertFormatFloor, readFormatFloors } from "./formats.ts";
+import { readPlacementRuntimeMarkers } from "./sync-placement-guard.ts";
+import { readActivePlacementBinding, type ActivePlacementBinding } from "./sync-placement-active.ts";
+import { PLACEMENT_PROFILE_SCHEMA, validatePlacementBaseV2, type PlacementBaseV2 } from "./sync-placement-format.ts";
+
+export const PLACEMENT_ACTIVATION_MIN_READER = "0.21.0";
+const preview = "amem migrate --sync-placement --dry-run";
+function requireHomeFloor(home: string,minReader:string): string {
+  assertFormatFloor(home, "curated"); assertFormatFloor(home, "sync");
+  const floors = readFormatFloors(home), minimum = minReader.split(".").map(Number);
+  const adequate = floors?.some(row => {
+    if (row.surface !== "home" || !/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(row.minReader)) return false;
+    const parts = row.minReader.split(".").map(Number);
+    for (let i = 0; i < 3; i++) if (parts[i] !== minimum[i]) return parts[i]! > minimum[i]!;
+    return true;
+  });
+  if (!adequate) throw Error(`Sync placement requires a person-authored home floor of ${minReader} or later in formats.json; have the person append that record, then rerun ${preview}.`);
+  return hashJSON(floors);
+}
+export function requirePlacementHomeFloor(home:string):string{return requireHomeFloor(home,PLACEMENT_ACTIVATION_MIN_READER);}
+export function requireWriterRenewalHomeFloor(home:string):string{return requireHomeFloor(home,"0.22.0");}
+export interface PlacementActivationPrerequisites { home: string; floorHash: string; base?: PlacementBaseV2; active?: ActivePlacementBinding }
+export function requirePlacementActivationPrerequisites(input: string): PlacementActivationPrerequisites {
+  let home: string;
+  try { home = realPath(input); const stat = lstatSync(home); if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) throw Error(); }
+  catch { throw Error("Sync placement memory home is unavailable or unsafe; select an existing private memory home and rerun amem migrate --sync-placement --dry-run."); }
+  assertFormatFloor(home, "curated"); assertFormatFloor(home, "sync");
+  const markers = readPlacementRuntimeMarkers(home);
+  const shards = markers.shards as { schema?: string; phase?: string } | undefined;
+  const profile = markers.profile as { schema?: string } | undefined;
+  if (!shards || shards.schema === "agent-mem.shards/v1" && shards.phase !== "active") {
+    throw Error("Sync placement requires an active shard home; run amem migrate --shards --dry-run and complete that person-reviewed migration first.");
+  }
+  if (shards.schema === "agent-mem.shards/v1") {
+    throw Error("Sync placement requires the v2 public-prune view; run amem migrate --public-prune-view --dry-run and complete that person-reviewed migration first.");
+  }
+  if (profile?.schema === PLACEMENT_PROFILE_SCHEMA) {
+    const active = readActivePlacementBinding(home, markers.profile, markers.shards);
+    if (!active) throw Error("Sync placement activation is incomplete; inspect retained evidence and run amem migrate --sync-placement --resume.");
+    return { home, floorHash: requirePlacementHomeFloor(home), active };
+  }
+  let base: PlacementBaseV2;
+  try { base = validatePlacementBaseV2(markers.profile, markers.shards); }
+  catch { throw Error("Sync placement base metadata is invalid or unsupported; inspect the active shard/public-prune metadata before rerunning amem migrate --sync-placement --dry-run."); }
+  return { home, floorHash: requirePlacementHomeFloor(home), base };
+}