@staix/agent-mem 0.8.0 → 0.9.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-mem",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Bounded project memory tools and seven deterministic capture hooks, without a resident worker.",
   "mcpServers": {
     "agent-mem": {

package/README.md

@@ -2,7 +2,7 @@
 
 Curated memory with append-only JSONL logs, a derived SQLite index, short- and long-term tiers, a typed graph, goals with leases, and git sync between machines. Extracted from [agent-hub](https://github.com/STAIxBWLB/agent-hub), with compatible storage and entry IDs.
 
-Version: 0.8.0. Requires Bun 1.4.2 or later; no runtime dependencies.
+Version: 0.9.1. Requires Bun 1.4.2 or later; no runtime dependencies.
 
 ## Quick start
 
@@ -284,6 +284,8 @@ Successful native project identities have a private, bounded derived cache (128
 
 Intake runs at the end of each Codex, Kimi and Pi session once `amem setup <cli> --apply` has registered it. Sync is off unless you ask for it: amem registers no sync hook and runs nothing between sessions. To sync on your own schedule, call `amem sync --if-due` from your shell (for example an EXIT trap in `~/.zshrc`; it needs a terminal). It syncs at most hourly, backs off 15 minutes doubling to a day after failures, stops after 30 seconds, and does nothing without a remote set by `amem sync --remote <private git url>`. `--force` skips the schedule and the backoff.
 
+Split-home sync durably holds verified foreign-generation prunes with a "held, not applied" warning while unrelated sync continues; targets can remain visible, and full cross-generation removal remains a separate ceiling (see [the sync contract](docs/contracts.md#per-shard-private-sync-15-t3)).
+
 ## Native transcript intake
 
 `amem ingest` reads existing Codex, Kimi or Pi transcripts and writes screened deterministic capture rows, never curated notes. Run it from the project to bind intake to that working directory; the CLI exposes no project/home override or policy bypass:
@@ -367,7 +369,7 @@ Real migration remains blocked until the separately reviewed generation-capable
 
 ## Curated shard migration (#15 T2)
 
-`amem migrate --shards` moves the curated single home into `projects/<key-hash>/` and `user/` through a resumable generation journal. The original single-home log bytes are never rewritten. A populated selected generation is supported and keeps its generation ID. Each shard keeps private legacy inputs in read-only `legacy/`, public-main inputs in read-only `legacy-main/`, and generation-born rows in its own `log/` and `local/`. It has its own `index.db`, `search.db` and mutation lock; original IDs, hashes, placement and own/local/public provenance are preserved. The source generation bytes stay unchanged. Immutable prune proofs are validated before effects; a multi-shard prune is translated into one deterministic row per shard, with a receipt naming the original row. Existing capture and `work/` directories are not migration inputs and are left untouched. `catalog.db` remains derived and rebuildable, now including curated entry counts and last use. Split curated stores sync the opened canonical project and user overlay to separate private-remote refs (`amem/p/<key-hash>` and `amem/u`) with `amem sync --policy-free`; unopened projects and machine data are not fetched. Original IDs and attribution survive independent generations. Foreign-generation prune rows refuse the whole sync before publication/import; cross-generation tombstone sync remains the explicit T3 ceiling (see `docs/contracts.md`, "Per-shard private sync").
+`amem migrate --shards` moves the curated single home into `projects/<key-hash>/` and `user/` through a resumable generation journal. The original single-home log bytes are never rewritten. A populated selected generation is supported and keeps its generation ID. Each shard keeps private legacy inputs in read-only `legacy/`, public-main inputs in read-only `legacy-main/`, and generation-born rows in its own `log/` and `local/`. It has its own `index.db`, `search.db` and mutation lock; original IDs, hashes, placement and own/local/public provenance are preserved. The source generation bytes stay unchanged. Immutable prune proofs are validated before effects; a multi-shard prune is translated into one deterministic row per shard, with a receipt naming the original row. Existing capture and `work/` directories are not migration inputs and are left untouched. `catalog.db` remains derived and rebuildable, now including curated entry counts and last use. Split curated stores sync the opened canonical project and user overlay to separate private-remote refs (`amem/p/<key-hash>` and `amem/u`) with `amem sync --policy-free`; unopened projects and machine data are not fetched. Original IDs and attribution survive independent generations. See `docs/contracts.md`, "Per-shard private sync", for prune transport and application boundaries.
 
 Before splitting a live home, every installed host must open it through `openShardStore({ project })` or the explicit user shard. Plain `new MemoryStore()` refuses any split marker, including an interrupted split, so it cannot silently keep writing the old layout. No host capability registry currently exists; migration preflight output states that limitation. Do not release T2 for agent-hub use until its memory factory is integrated with `openShardStore` and that host version is installed. Existing unannounced older builds remain the documented unchanged-source ceiling.
 
@@ -413,7 +415,7 @@ The frozen nine-tool contract for dotfiles#255 and maru#458:
 
 Search/show/timeline label capture as recall with `evidence: false`; capture never enters the curated graph. Policy screens complete rows before selection, limits or graph construction. The standalone secret screen, private flags, PII patterns and deny paths compose with a host's stricter policy through `createMemoryMcp({cwd, base, policy})`. Screening errors fail closed. `base` is the exact memory root; historical library `home` options still name its parent. Scope and profile changes refuse further access instead of silently reopening another store. Graph reads retain the 5,000-row curated ceiling; work-list reads stream the complete ordered history without an operation-count ceiling, applying policy before latest-value reduction. The working state scales with the current result, not historical payloads. The graph ceiling is an operational bound, not an exposed count of unscreened data. Graphs cover curated-note relationships, not goal/suggestion tables.
 
-`WorkListStore` writes `projects/<key-hash>/work/` with its own append log, derived index and lock. Scalar fields reduce by latest value, null clears, list status `done` closes, and item status is `todo|doing|done|dropped`. Work lists are outside generation selection and capture eviction. `amem import claude-mem` additionally imports `work_state_entries` only through persisted person-reviewed D2 aliases, preserving source DB bytes and stable replay receipts; JSON keeps observation fields and adds `work` counts/cursor.
+`WorkListStore` writes `projects/<key-hash>/work/` with its own append log, derived index and lock. Scalar fields reduce by latest value, null clears, list status `done` closes, and item status is `todo|doing|done|dropped`. Work lists are outside generation selection and capture eviction. `amem import claude-mem` additionally imports `work_state_entries` only through persisted person-reviewed D2 aliases, preserving source DB bytes and stable replay receipts; JSON keeps observation fields and adds `work` counts/cursor. `--capture-days N` also imports observations and session summaries from the last N days into machine-local capture under the same aliases, with read/added/spooled/skipped counts, stable replay receipts and the configured capture cap and retention. Widening N after an earlier import requires `--restart` to revisit rows below the saved cursor. Chroma vectors are never read.
 
 `amem vault-candidates --json` and the MCP read tool select durable long-term notes under current policy, excluding task/review/PR/CI progress and already-linked entries. The deterministic status filter covers English status phrases and can miss paraphrased or other-language status text; candidates require person review. No vault is opened, indexed or written. Library `recordVaultLink` records an exact-entry hash and relative Markdown path in a generation-only local append op; it survives index rebuild and shard migration, stays machine-local, and does not change shared-v1 schemas or sync semantics. There is no MCP link writer.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-mem",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Curated, shared memory for coding agents: append-only logs, a derived index, tiers and a typed graph.",
   "license": "MIT",
   "type": "module",

package/src/cli.ts

@@ -11,7 +11,7 @@ import { serveMcp, writeConfirmed } from "./mcp.ts";
 import { createStandalonePolicy } from "./memory/policy.ts";
 import { configuredPolicy, configuredPolicyOptions, loadAmemConfig, repoConfigRoot } from "./memory/config.ts";
 import { vaultCandidates } from "./memory/vault.ts";
-import { importClaudeMemWorkState } from "./memory/import.ts";
+import { importClaudeMemCapture, importClaudeMemWorkState } from "./memory/import.ts";
 import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, readSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { MemoryStore, looksSecret, machineId, openShardStore, type StoreOptions } from "./memory/store.ts";
@@ -549,7 +549,7 @@ export async function runCli(argv: readonly string[], context: CliContext = {}):
     return options["--json"] ? JSON.stringify(result, null, 2) : `${result.dryRun ? "preview (nothing evicted; add --confirm):\n" : ""}${gcText(result)}`;
   }
   if (sub === "import" && ["claude-auto", "codex"].includes(parsed.path[1] ?? "")) {
-    for (const flag of ["--db", "--limit", "--restart"]) if (options[flag] !== undefined) throw new Error(`${flag} only applies to import claude-mem`);
+    for (const flag of ["--db", "--limit", "--restart", "--capture-days"]) if (options[flag] !== undefined) throw new Error(`${flag} only applies to import claude-mem`);
     const source = parsed.path[1] as ExternalMemorySource, policy = policyOf();
     const result = await importExternalMemory({ base: memoryHome(), project: boundProject(), source, cwd: policyCwd, env: context.env ?? process.env,
       ...(typeof options["--from"] === "string" ? { from: options["--from"] } : {}), policy: value => policy.screenStandalone(value) });
@@ -724,7 +724,14 @@ export async function runCli(argv: readonly string[], context: CliContext = {}):
   }
   // Only a real attempt is stamped: a local refusal (lock held, no remote, policy, usage) is not, and a future stamp is no history (src/memory/sync-cadence.ts).
   const stampSync = (error: string | undefined, cause?: StopCause) => { if (syncOutcome(error, cause) !== "local") recordSyncAttempt(syncHome, error === undefined, Date.now()); };
-  const syncArgs = args.filter(arg => arg !== "--if-due" && arg !== "--force");
+  const captureImport = sub === "import" && parsed.path[1] === "claude-mem", captureDays = options["--capture-days"] === undefined ? undefined : Number(options["--capture-days"]);
+  if (captureImport && captureDays !== undefined && (!Number.isSafeInteger(captureDays) || captureDays <= 0)) throw new Error("--capture-days takes a positive integer");
+  const captureArgs = new Set<number>();
+  if (captureImport) for (let index = 0; index < args.length; index++) {
+    if (args[index] === "--capture-days") { captureArgs.add(index); captureArgs.add(index + 1); }
+    else if (args[index]?.startsWith("--capture-days=")) captureArgs.add(index);
+  }
+  const syncArgs = args.filter((arg, index) => arg !== "--if-due" && arg !== "--force" && !captureArgs.has(index));
   let output: string;
   const stop = ifDue ? stopSignal(context.syncDeadlineMs ?? SYNC_IF_DUE_DEADLINE_MS, process) : undefined;
   try {
@@ -747,10 +754,11 @@ export async function runCli(argv: readonly string[], context: CliContext = {}):
     if (options["--json"]) { try { const result = JSON.parse(output) as { ok?: unknown; error?: unknown }; if (result.ok === false) failure = typeof result.error === "string" ? result.error : "sync failed"; } catch { /* not a sync result */ } }
     stampSync(failure, stop?.cause());
   }
-  if (sub === "import" && parsed.path[1] === "claude-mem") {
-    const policy = configured;
-    const work = await importClaudeMemWorkState({ base: memoryHome(), project: boundProject(), policy: row => policy.screen(row), ...(options["--db"] ? { db: String(options["--db"]) } : {}), ...(options["--limit"] ? { limit: Number(options["--limit"]) } : {}), restart: options["--restart"] === true });
-    return options["--json"] ? JSON.stringify({ ...JSON.parse(output), work }, null, 2) : `${output}\nwork lists: ${JSON.stringify(work)}`;
+  if (captureImport) {
+    const policy = configured, db = options["--db"] ? { db: String(options["--db"]) } : {}, limit = options["--limit"] ? { limit: Number(options["--limit"]) } : {}, restart = options["--restart"] === true;
+    const work = await importClaudeMemWorkState({ base: memoryHome(), project: boundProject(), policy: row => policy.screen(row), ...db, ...limit, restart });
+    const capture = captureDays === undefined ? undefined : await importClaudeMemCapture({ base: memoryHome(), project: boundProject(), cwd, days: captureDays, ...db, ...limit, restart, policy: { host: policy } });
+    return options["--json"] ? JSON.stringify({ ...JSON.parse(output), work, ...(capture ? { capture } : {}) }, null, 2) : `${output}\nwork lists: ${JSON.stringify(work)}${capture ? `\ncapture: ${JSON.stringify(capture)}` : ""}`;
   }
   return !options["--json"] && receipt.bridgeStatus
     ? `${output}\n(legacy malformed lines skipped: ${receipt.bridgeStatus.skippedRows})` : output;

package/src/commands-table.ts

@@ -76,9 +76,9 @@ export const COMMANDS: Record<string, CommandDefinition> = {
   sync: { description: "Sync a private remote (--if-due: only when the schedule and the failure backoff allow it; --force ignores both)", options: { ...json, ...policy, "--remote": text("Private git URL"),
     "--if-due": flag("Sync only when due (hourly after a success, 15 minutes doubling to a day after failures); stops after 30 seconds"), "--force": flag("With --if-due: ignore the schedule and the backoff") }, mutates: true, policyFree: true },
   machine: { description: "Show or label this machine", options: { ...json, "--label": text("Machine label") }, mutates: "label" },
-  import: { description: "Import external memory", options: { ...json, ...policy, "--db": { description: "SQLite database file", value: "path" }, "--limit": text("Maximum observations"), "--restart": flag("Restart import cursor") }, mutates: true, policyFree: true,
+  import: { description: "Import external memory", options: { ...json, ...policy, "--db": { description: "SQLite database file", value: "path" }, "--limit": text("Maximum observations"), "--restart": flag("Restart import cursor"), "--capture-days": text("Import recent claude-mem observations and summaries into capture") }, mutates: true, policyFree: true,
     commands: {
-      "claude-mem": { description: "Import claude-mem observations", options: { "--db": { description: "SQLite database file", value: "path" }, "--limit": text("Maximum observations"), "--restart": flag("Restart import cursor") } },
+      "claude-mem": { description: "Import claude-mem observations", options: { "--db": { description: "SQLite database file", value: "path" }, "--limit": text("Maximum observations"), "--restart": flag("Restart import cursor"), "--capture-days": text("Import recent observations and summaries into capture") } },
       "claude-auto": { description: "Import Claude Code auto memory as review candidates; CLAUDE.md and AGENTS.md stay excluded", options: { "--from": { description: "Claude projects directory (default ~/.claude/projects)", value: "path" } } },
       codex: { description: "Import Codex memories as review candidates; originals stay unchanged", options: { "--from": { description: "Codex memories directory (default ~/.codex/memories)", value: "path" } } },
     } },

package/src/memory/capture.ts

@@ -359,7 +359,7 @@ export class CaptureStore {
     this.db.run("CREATE TRIGGER IF NOT EXISTS rows_ad AFTER DELETE ON rows BEGIN INSERT INTO fts (fts, rowid, body) VALUES ('delete', old.id, old.excerpt); END");
     this.db.run("CREATE TRIGGER IF NOT EXISTS rows_au AFTER UPDATE ON rows BEGIN INSERT INTO fts (fts, rowid, body) VALUES ('delete', old.id, old.excerpt); INSERT INTO fts (rowid, body) VALUES (new.id, new.excerpt); END");
     // Rows written before FTS existed (or before a platform gained it) are indexed once; triggers keep it level.
-    if (!had && (this.db.query("SELECT COUNT(*) AS n FROM rows").get() as { n: number }).n > 0) this.db.run("INSERT INTO fts (fts) VALUES ('rebuild')");
+    if (!had && (this.db.query("SELECT COUNT(*) AS n FROM rows").get() as { n: number }).n > 0) this.db.run("INSERT INTO fts (rowid, body) SELECT id, excerpt FROM rows");
   }
 
   private mcpReady = false;

package/src/memory/commands.ts

@@ -47,7 +47,7 @@ export interface GoalCommandOptions {
  * supersede and rebuild are a person's (the identity gate refuses agent shells).
  */
 /** The usage line of the memory commands under `name` (`amem` by default; agent-hub passes `ahub memory`). */
-export const memoryUsage = (name: string = AMEM_NAMES.memory): string => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
+export const memoryUsage = (name: string = AMEM_NAMES.memory): string => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
 export const MEMORY_USAGE = memoryUsage();
 /** The usage line of the goal commands under `name` (`amem goal` by default; agent-hub passes `ahub goal`). */
 export const goalUsage = (name: string = AMEM_NAMES.goal): string => `usage: ${name} [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]`;
@@ -154,7 +154,7 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
         const db = flag("--db"), limit = flag("--limit");
         const restart = rest.includes("--restart");
         if (restart) rest.splice(rest.indexOf("--restart"), 1);
-        if (rest[0] !== "claude-mem" || rest.length !== 1) fail(`usage: ${names.memory} import claude-mem [--db <path>] [--limit N] [--restart]`);
+        if (rest[0] !== "claude-mem" || rest.length !== 1) fail(`usage: ${names.memory} import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N]`);
         if (limit && !(Number(limit) > 0)) fail("--limit takes a positive number");
         const isPii = opts.importPolicy();
         const key = opts.project ?? memoryProjectKey(cwd);

package/src/memory/import.ts

@@ -7,6 +7,11 @@ import { join } from "node:path";
 import { KINDS, looksSecret, type Kind, type MemoryStore } from "./store.ts";
 import { aliasedKeys, resolveAlias } from "./shard.ts";
 import { WorkListStore, type WorkListFields, type WorkListPolicy } from "./work-lists.ts";
+import { CaptureStore, type CaptureInput } from "./capture.ts";
+import { CAPTURE_MAX_EXCERPT } from "./capture-input.ts";
+import { configuredPolicyOptions } from "./config.ts";
+import { createStandalonePolicy, type StandalonePolicyOptions } from "./policy.ts";
+import { stripPrivateSpans } from "./private-spans.ts";
 
 /** The claude-mem store is another program's: opened read-only, never written, its locks waited on briefly. */
 export const CLAUDE_MEM_BUSY_TIMEOUT_MS = 3000;
@@ -15,6 +20,92 @@ const MODEL_ANSWER = "ahub ask (model answer)";
 
 export interface ImportResult { read: number; added: number; skipped: { model: number; pii: number; secret: number }; more: boolean; cursor: number }
 export interface WorkStateImportResult { read: number; added: number; skipped: { invalid: number; policy: number }; more: boolean; cursor: number }
+export interface CaptureImportResult { read: number; added: number; spooled: number; skipped: number; more: boolean }
+
+type ClaudeMemCaptureRow = { id: number; created_at_epoch: number; origin_device_id: string | null; origin_local_id: string | null } & Record<string, any>;
+const CLAUDE_MEM_CAPTURE_KINDS = [
+  { table: "observations", event: "observation", columns: "id, title, text, narrative, created_at_epoch" },
+  { table: "session_summaries", event: "summary", columns: "id, request, investigated, learned, completed, next_steps, notes, created_at_epoch" },
+] as const;
+type ClaudeMemCaptureKind = typeof CLAUDE_MEM_CAPTURE_KINDS[number];
+interface ClaudeMemCaptureContext {
+  db: Database; store: CaptureStore; policy: ReturnType<typeof createStandalonePolicy>;
+  aliases: string[]; project: string; sourceMachine: string; cutoff: number; limit: number;
+}
+
+function claudeMemCaptureText(row: ClaudeMemCaptureRow, kind: ClaudeMemCaptureKind): string {
+  if (kind.table === "observations") return stripPrivateSpans([row.title, row.text ?? row.narrative].filter(value => typeof value === "string" && value.trim()).join("\n")).trim();
+  const fields = [["Request", row.request], ["Investigated", row.investigated], ["Learned", row.learned], ["Completed", row.completed], ["Next steps", row.next_steps], ["Notes", row.notes]];
+  return stripPrivateSpans(fields.filter(([, value]) => typeof value === "string" && value.trim()).map(([label, value]) => `${label}: ${value}`).join("\n")).trim();
+}
+
+async function appendClaudeMemCapture(row: ClaudeMemCaptureRow, kind: ClaudeMemCaptureKind, context: ClaudeMemCaptureContext): Promise<"added" | "spooled" | "skipped"> {
+  const text = claudeMemCaptureText(row, kind);
+  if (!text || !Number.isFinite(row.created_at_epoch)) return "skipped";
+  let at: string;
+  try { at = new Date(row.created_at_epoch).toISOString(); } catch { return "skipped"; }
+  const input: CaptureInput = { project: context.project, agent: "claude-mem", event: kind.event, excerpt: text, at };
+  if (!await context.policy.screen(input)) return "skipped";
+  input.excerpt = text.slice(0, CAPTURE_MAX_EXCERPT);
+  const synced = typeof row.origin_device_id === "string" && !!row.origin_device_id && typeof row.origin_local_id === "string" && !!row.origin_local_id;
+  const receipt = createHash("sha256").update(JSON.stringify(["claude-mem", kind.table, synced ? row.origin_device_id : context.sourceMachine, synced ? row.origin_local_id : String(row.id)])).digest("hex");
+  const appended = context.store.append(input, { receipt });
+  return "spooled" in appended ? "spooled" : appended.already ? "skipped" : "added";
+}
+
+async function importClaudeMemCaptureTable(kind: ClaudeMemCaptureKind, context: ClaudeMemCaptureContext, initial: number, onCursor: (cursor: number) => void): Promise<CaptureImportResult> {
+  const result: CaptureImportResult = { read: 0, added: 0, spooled: 0, skipped: 0, more: false };
+  const columns = new Set((context.db.query(`PRAGMA table_info(${kind.table})`).all() as { name: string }[]).map(row => row.name));
+  const origin = columns.has("origin_device_id") && columns.has("origin_local_id"), where = `project IN (${context.aliases.map(() => "?").join(",")})`;
+  const max = context.db.query(`SELECT MAX(id) AS id FROM ${kind.table} WHERE ${where}`).get(...context.aliases) as { id: number | null };
+  let cursor = (max.id ?? 0) < initial ? 0 : initial; onCursor(cursor);
+  const rows = context.db.query(`SELECT ${kind.columns}${origin ? ", origin_device_id, origin_local_id" : ", NULL AS origin_device_id, NULL AS origin_local_id"} FROM ${kind.table} WHERE ${where} AND created_at_epoch >= ? AND id > ? ORDER BY id LIMIT ?`)
+    .all(...context.aliases, context.cutoff, cursor, context.limit) as ClaudeMemCaptureRow[];
+  result.read = rows.length; result.more = rows.length === context.limit;
+  for (const row of rows) {
+    result[await appendClaudeMemCapture(row, kind, context)]++;
+    cursor = row.id; onCursor(cursor);
+  }
+  return result;
+}
+
+/** Import only reviewed aliases into machine-local capture. ponytail: --limit is per source table; a merged cursor could add one combined ceiling. */
+export async function importClaudeMemCapture(opts: { base: string; project: string; cwd: string; days: number; db?: string; limit?: number; restart?: boolean; now?: number; policy?: StandalonePolicyOptions; log?: (line: string) => void }): Promise<CaptureImportResult> {
+  const file = opts.db ?? join(homedir(), ".claude-mem", "claude-mem.db"), limit = opts.limit ?? 10_000;
+  if (!existsSync(file)) throw new Error(`no claude-mem store at ${file}`);
+  if (!Number.isSafeInteger(opts.days) || opts.days <= 0) throw new Error("--capture-days takes a positive integer");
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error("--limit takes a positive integer");
+  const now = opts.now ?? Date.now(); if (!Number.isFinite(now)) throw new Error("capture import clock unavailable");
+  const project = resolveAlias(opts.base, opts.project), aliases = aliasedKeys(opts.base, project);
+  const result: CaptureImportResult = { read: 0, added: 0, spooled: 0, skipped: 0, more: false };
+  if (!aliases.length) return result;
+  const db = new Database(file, { readonly: true });
+  let store: CaptureStore | undefined, state: string | undefined;
+  const progress = new Map<string, number>();
+  try {
+    db.run(`PRAGMA busy_timeout = ${CLAUDE_MEM_BUSY_TIMEOUT_MS}`);
+    const available = CLAUDE_MEM_CAPTURE_KINDS.filter(kind => db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(kind.table));
+    if (!available.length) return result;
+    store = new CaptureStore({ memoryDir: opts.base, project, cwd: opts.cwd, now: () => now });
+    state = join(store.dir, "import-state.json");
+    const context: ClaudeMemCaptureContext = { db, store, aliases, project, limit,
+      sourceMachine: createHash("sha256").update(realPath(file)).digest("hex"), cutoff: Math.max(0, now - opts.days * 86_400_000),
+      policy: createStandalonePolicy(configuredPolicyOptions(opts.base, opts.cwd, opts.policy)) };
+    const cursors = readCursors(state);
+    for (const kind of available) {
+      const key = createHash("sha256").update(JSON.stringify([context.sourceMachine, aliases, project, kind.table])).digest("hex");
+      progress.set(key, opts.restart ? 0 : cursors[key] ?? 0);
+      const imported = await importClaudeMemCaptureTable(kind, context, progress.get(key)!, cursor => progress.set(key, cursor));
+      for (const field of ["read", "added", "spooled", "skipped"] as const) result[field] += imported[field];
+      result.more ||= imported.more;
+    }
+  } finally {
+    db.close();
+    if (state) for (const [key, cursor] of progress) writeCursor(state, key, cursor, opts.log ?? console.error);
+    store?.close();
+  }
+  return result;
+}
 
 /**
  * Import only the source project names explicitly mapped by the person's D2 alias table. A basename or even

package/src/memory/platform.ts

@@ -49,13 +49,17 @@ export function realPath(path: string): string {
 export const DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/archive"];
 /** Regex sources, matched against a file's basename. */
 export const DENY_NAMES = ["^\\.env", "\\.pem$", "\\.key$", "^id_rsa", "^id_ed25519", "^credentials(\\.|$)", "^auth\\.json$", "^\\.netrc$", "^\\.npmrc$", "^\\.pypirc$"];
+const denyNamePatterns = new Map(DENY_NAMES.map(source => [source, new RegExp(source)]));
 
 const hasSegment = (rel: string, seg: string) => `/${rel}/`.includes(`/${seg}/`);
 
 /** True when a path names something the worker must never read, write or report. `extra`: substrings from `local.deny`. */
 export function isDenied(path: string, extra: string[] = []): boolean {
   const norm = path.split(sep).join("/");
-  return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
+  if (DENY_SEGMENTS.some((s) => hasSegment(norm, s))) return true;
+  const name = basename(norm);
+  // Reuse the fixed patterns without caching arbitrary additions to the exported list.
+  return DENY_NAMES.some((re) => (denyNamePatterns.get(re) ?? new RegExp(re)).test(name)) || extra.some((e) => e && norm.includes(e));
 }
 
 /**

package/src/memory/policy.ts

@@ -1,7 +1,7 @@
 import { posix } from "node:path";
 import { types } from "node:util";
 import { looksSecret } from "./screen.ts";
-import { isDenied } from "./platform.ts";
+import { DENY_NAMES, DENY_SEGMENTS, isDenied } from "./platform.ts";
 import { nodePath, pathCandidates } from "./project.ts";
 
 /** True means the complete value is public. Hosts may narrow, never replace, standalone policy. */
@@ -115,18 +115,38 @@ export function createStandalonePolicy(options: StandalonePolicyOptions = {}): S
   const pii = literals(descriptors.piiPatterns?.value, "PII patterns");
   const host = descriptors.host?.value as MemoryPolicy | undefined;
   if (host !== undefined && (!host || typeof host.screen !== "function")) throw new Error("invalid host policy");
+  // ponytail: retain at most 512 exact strings / 64 KiB per immutable policy configuration.
+  // Evict the batch when full; a measured need for better hit rates can upgrade this to an LRU.
+  const textChecks = new Map<string, boolean>(); let textBytes = 0;
+  let defaultDenyRevision = "";
+  const publicText = (text: string): boolean => {
+    const cached = textChecks.get(text);
+    if (cached !== undefined) return cached;
+    const check = () => {
+      if (looksSecret(text) || looksSecret(text.replace(/["']/g, ""))) return false;
+      const normalized = fold(text);
+      if (defaultPii(normalized) || pii.some(pattern => normalized.includes(pattern))) return false;
+      const candidates = normalized.includes("/") || /\.[a-z]/.test(normalized) ? pathCandidates(normalized) : [];
+      const paths = [normalized, nodePath(normalized), ...candidates, ...normalized.split(/[\s"'`(){}\[\],;:=<>]+/)];
+      return !paths.some(path => path && isDenied(posix.normalize(path), deny));
+    };
+    const allowed = check(), bytes = Buffer.byteLength(text);
+    if (bytes <= 1024) {
+      if (textChecks.size >= 512 || textBytes + bytes > 64 * 1024) { textChecks.clear(); textBytes = 0; }
+      textChecks.set(text, allowed); textBytes += bytes;
+    }
+    return allowed;
+  };
   const standalone = (value: unknown): { ok: boolean; value?: unknown } => {
     try {
+      // The exported default lists can be tightened by a host between calls.
+      const revision = JSON.stringify([DENY_NAMES, DENY_SEGMENTS]);
+      if (revision !== defaultDenyRevision) { textChecks.clear(); textBytes = 0; defaultDenyRevision = revision; }
       const complete = snapshot(value);
       if (!complete) return { ok: false };
-      for (const text of complete.texts) {
-        if (looksSecret(text) || looksSecret(text.replace(/["']/g, ""))) return { ok: false };
-        const normalized = fold(text);
-        if (defaultPii(normalized) || pii.some(pattern => normalized.includes(pattern))) return { ok: false };
-        const candidates = normalized.includes("/") || /\.[a-z]/.test(normalized) ? pathCandidates(normalized) : [];
-        const paths = [normalized, nodePath(normalized), ...candidates, ...normalized.split(/[\s"'`(){}\[\],;:=<>]+/)];
-        for (const path of paths) if (path && isDenied(posix.normalize(path), deny)) return { ok: false };
-      }
+      // Only pure text checks are reused. Shape/bounds/private flags and the host's detached
+      // snapshot are fresh on every call; no row or host verdict is cached.
+      for (const text of complete.texts) if (!publicText(text)) return { ok: false };
       return { ok: true, value: complete.value };
     } catch { return { ok: false }; }
   };

package/src/memory/shard-sync-format.ts

@@ -102,10 +102,9 @@ export function decodeShardPack(path: string, bytes: Uint8Array, realm: ShardSyn
     catch { throw new ShardSyncFormatError(label, "malformed pack row"); }
     const row = publicRow(value, label);
     if (hash(row.machine) !== match[1]) throw new ShardSyncFormatError(label, "pack author mismatch");
-    if (row.op === "prune") {
-      // ponytail: #404 needs a generation-neutral public-witness transport; never retag or skip a foreign prune.
-      if (row.generation !== generation) throw new ShardSyncFormatError(label, "foreign-generation prune");
-    } else if (row.op === "note" || row.op === "goal") {
+    // Generation is preserved in the original prune payload. Acceptance here is structural,
+    // never permission to apply it: the engine proves each original generation and holds foreign rows.
+    if (row.op === "note" || row.op === "goal") {
       if (realm.scope === "project" ? row.scope !== "project" || row.project !== realm.key : row.scope !== "shared") {
         throw new ShardSyncFormatError(label, "row scope mismatch");
       }

package/src/memory/shard-sync.ts

@@ -1,5 +1,5 @@
 import { randomBytes, createHash } from "node:crypto";
-import { constants, closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readSync, rmSync, writeSync } from "node:fs";
+import { constants, closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readSync, renameSync, rmSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { canonicalJSON, fsyncDirectory, hashJSON, readProfileJSON } from "./generation.ts";
 import { generationSyncLock } from "./generation-sync.ts";
@@ -14,8 +14,14 @@ import type { Entry, MemoryStore } from "./store.ts";
 const OID = /^[a-f0-9]{40}$/, PACK = /^rows\/[a-f0-9]{64}\/[a-f0-9]{64}\.jsonl$/;
 const digest = (bytes: string | Uint8Array): string => createHash("sha256").update(bytes).digest("hex");
 const zero = "0".repeat(40);
+// The descriptor is at most 64 KiB and an original prune at most 16 KiB; keep receipt parsing bounded.
+const HOLD_MAX_BYTES = 128 * 1024;
 type PendingPrune = { plan: PrunePlan; row: PruneRow; line: string; offset: number; prefixHash: string };
-type Target = { store: MemoryStore; realm: ShardSyncRealm; rows: Map<string, ShardSyncRow>; fetched: Set<string>; sources: PruneSourceRow[]; pending: PendingPrune[]; generation: string; local?: string; remote?: string; commit?: string };
+type HoldSource = { ref: string; commit: string; pack: string; blob: string };
+type HoldReceipt = { schema: "agent-mem.prune-hold/v1"; remote: string; realm: ShardSyncRealm; receivingGeneration: string; row: PruneRow; payloadHash: string; source: HoldSource };
+type Hold = { file: string; bytes: Buffer };
+type SyncPhase = "published" | "hold-written" | "hold-installed" | "imported";
+type Target = { store: MemoryStore; realm: ShardSyncRealm; rows: Map<string, ShardSyncRow>; fetched: Set<string>; sources: PruneSourceRow[]; pending: PendingPrune[]; origins: Map<string, HoldSource>; holds: Hold[]; generation: string; local?: string; remote?: string; commit?: string };
 class SyncRefusal extends Error {}
 function refuse(reason: string): never { throw new SyncRefusal(reason); }
 function directory(path: string): void {
@@ -146,8 +152,10 @@ function provePrunes(targets: readonly Target[]): void {
     }
     const snapshot: PruneSnapshot = { rows: [...sources.values()], expiries: [] };
     const prunes = [...target.rows.values()].filter((row): row is PruneRow => row.op === "prune");
-    const proof = reducePruneRows(prunes.map(row => ({ row, placement: "synced" as const })), snapshot, target.generation);
-    if (proof.invalid || proof.pending.length) refuse(`${shardSyncLabel(target.realm)}: prune lacks complete public witnesses`);
+    for (const generation of new Set(prunes.map(row => row.generation))) {
+      const proof = reducePruneRows(prunes.filter(row => row.generation === generation).map(row => ({ row, placement: "synced" as const })), snapshot, generation);
+      if (proof.invalid || proof.pending.length) refuse(`${shardSyncLabel(target.realm)}: prune lacks complete public witnesses`);
+    }
   }
 }
 function installPack(store: MemoryStore, bytes: Buffer): void {
@@ -176,7 +184,7 @@ function importRows(target: Target): void {
   for (const pending of target.pending) {
     port.persistPrunePlan(pending.plan); port.appendPrune(pending.row, pending.line, pending.plan.seal); resumed.add(pending.row.id);
   }
-  for (const row of target.rows.values()) if (row.op === "prune") {
+  for (const row of target.rows.values()) if (row.op === "prune" && row.generation === target.generation) {
     if (resumed.has(row.id)) continue;
     // A transport imports an already-authored person row without changing its author or generation.
     // Native durable-plan append confirms fsync even for an already parsed id after a crash.
@@ -186,8 +194,104 @@ function importRows(target: Target): void {
   port.refresh();
 }
 
-/** Sync only the borrowed canonical project and user targets. The internal third argument is a test-only observer, never a CLI/SyncOptions port. */
-export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions = {}, testOnlyUnexpectedError?: (error: unknown) => void): Promise<SyncResult> {
+/** Receipts are private, immutable transport metadata, outside every native generation reducer.
+ * ponytail: foreign targets remain visible; an explicit cross-generation apply protocol must
+ * re-prove witnesses and establish a compatible reader floor before lifting this hold ceiling. */
+const hasHoldPath = (file: string): boolean => lstatSync(file, { throwIfNoEntry: false }) !== undefined;
+function privateHoldPath(file: string, folder: boolean): void {
+  if (folder) directory(file); else regular(file);
+  if (lstatSync(file).mode & 0o077) refuse("shard sync prune holds require private permissions");
+}
+function checkPendingHold(file: string, bytes: Buffer): void {
+  privateHoldPath(file, false);
+  if (lstatSync(file).size > bytes.length || !readFileSync(file).equals(bytes.subarray(0, lstatSync(file).size))) refuse("shard sync partial prune hold conflicts with verified receipt");
+}
+function installHold(root: string, hold: Hold, phase?: (phase: SyncPhase) => void): void {
+  const parts = hold.file.slice(root.length + 1).split("/"), name = parts.pop()!;
+  let folder = root;
+  for (const part of parts) {
+    const parent = folder; folder = join(folder, part);
+    if (!hasHoldPath(folder)) mkdirSync(folder, { mode: 0o700 });
+    privateHoldPath(folder, true); fsyncDirectory(parent);
+  }
+  const file = join(folder, name), pending = file + ".pending";
+  if (hasHoldPath(file)) {
+    privateHoldPath(file, false);
+    if (!readFileSync(file).equals(hold.bytes)) refuse("shard sync immutable prune hold conflict");
+    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW); try { fsyncSync(fd); } finally { closeSync(fd); }
+    fsyncDirectory(folder); return;
+  }
+  if (hasHoldPath(pending)) checkPendingHold(pending, hold.bytes);
+  const fd = openSync(pending, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+  try {
+    // Interrupted private staging bytes may be completed; committed receipts are never rewritten.
+    let offset = 0; while (offset < hold.bytes.length) { const n = writeSync(fd, hold.bytes, offset, hold.bytes.length - offset, offset); if (n <= 0) refuse("shard sync prune hold write unavailable"); offset += n; }
+    fsyncSync(fd);
+  } finally { closeSync(fd); }
+  phase?.("hold-written");
+  // The transport mutation lock serializes this create-once rename. Unlike hard-link installation,
+  // a crash cannot leave a committed receipt with a second link that later fails validation.
+  if (hasHoldPath(file)) refuse("shard sync prune hold changed concurrently");
+  renameSync(pending, file); fsyncDirectory(folder); phase?.("hold-installed");
+}
+function holdWarning(targets: readonly Target[], root: string): string | undefined {
+  const warnings: string[] = [];
+  for (const target of targets) if (target.holds.length) {
+    const rows = [...target.rows.values()].filter((row): row is PruneRow => row.op === "prune" && row.generation !== target.generation);
+    const ids = [...new Set(rows.flatMap(row => row.targets.map(item => item.id)))].sort(), shown = ids.slice(0, 10);
+    const location = target.holds[0]!.file.slice(root.length + 1).split("/").slice(0, -2).join("/");
+    warnings.push(`${shardSyncLabel(target.realm)}: ${rows.length} foreign-generation prune(s) held, not applied; targets ${shown.join(",")}${ids.length > shown.length ? ` (+${ids.length - shown.length} more)` : ""} may remain visible; receipts shard-sync/${location}; bring this machine to the origin generation, or prune the entry here as the person`);
+  }
+  return warnings.length ? warnings.join("; ") : undefined;
+}
+
+type ProveHoldSource = (target: Target, receipt: HoldReceipt) => Promise<void>;
+async function prepareHold(root: string, url: string, target: Target, row: PruneRow, proveSource: ProveHoldSource): Promise<Hold> {
+  const source = target.origins.get(row.id);
+  if (!source || !target.remote || !target.fetched.has(row.id)) refuse(`${shardSyncLabel(target.realm)}: foreign prune has no fetched provenance`);
+  const receipt: HoldReceipt = { schema: "agent-mem.prune-hold/v1", remote: digest(url), realm: target.realm,
+    receivingGeneration: target.generation, row, payloadHash: hashJSON(row), source };
+  const folders = ["prune-holds", receipt.remote, digest(shardSyncRef(target.realm)), target.generation, row.generation];
+  let folder = root;
+  for (const name of folders) { folder = join(folder, name); if (hasHoldPath(folder)) privateHoldPath(folder, true); }
+  const file = join(folder, `${row.id}-${receipt.payloadHash}.json`);
+  let selected = receipt;
+  if (hasHoldPath(file)) {
+    privateHoldPath(file, false);
+    const value = readProfileJSON(file, HOLD_MAX_BYTES) as HoldReceipt | undefined;
+    if (!value || !value.source || Object.keys(value.source).length !== 4 || !OID.test(value.source.commit)
+      || !OID.test(value.source.blob) || !PACK.test(value.source.pack)
+      || canonicalJSON({ ...value, source }) !== canonicalJSON(receipt)) refuse(`${shardSyncLabel(target.realm)}: invalid prune hold receipt`);
+    // A receipt is evidence of a hold, never application authority. Recheck its original
+    // immutable source against this invocation's fully audited selected remote history.
+    await proveSource(target, value);
+    selected = value;
+  }
+  const bytes = Buffer.from(canonicalJSON(selected) + "\n");
+  if (bytes.length > HOLD_MAX_BYTES) refuse("shard sync prune hold exceeds metadata bound");
+  if (hasHoldPath(file) && !readFileSync(file).equals(bytes)) refuse("shard sync prune hold is not canonical");
+  if (hasHoldPath(file + ".pending")) checkPendingHold(file + ".pending", bytes);
+  return { file, bytes };
+}
+async function prepareHolds(targets: readonly Target[], root: string, url: string, proveSource: ProveHoldSource): Promise<void> {
+  for (const target of targets) {
+    target.holds = [];
+    for (const row of target.rows.values()) if (row.op === "prune" && row.generation !== target.generation) {
+      target.holds.push(await prepareHold(root, url, target, row, proveSource));
+    }
+  }
+}
+function mergePackOrigins(into: Map<string, HoldSource>, byRealm: Map<string, Map<string, HoldSource>>, rows: readonly ShardSyncRow[], source: HoldSource): void {
+  const first = byRealm.get(source.ref) ?? new Map<string, HoldSource>(); byRealm.set(source.ref, first);
+  // Oldest-first history keeps a receipt's source stable across tip advancement and partial-write retry.
+  for (const row of rows) {
+    if (!first.has(row.id)) first.set(row.id, source);
+    if (!into.has(row.id)) into.set(row.id, first.get(row.id)!);
+  }
+}
+
+/** Sync only borrowed canonical project/user targets. Internal error/phase observers are test-only, never CLI/SyncOptions ports. */
+export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions = {}, testOnlyUnexpectedError?: (error: unknown) => void, testOnlyPhase?: (phase: SyncPhase) => void): Promise<SyncResult> {
   let pushed = false, releaseTransport: (() => void) | undefined, releaseSync: (() => void) | undefined;
   const releases: (() => void)[] = [], transient: string[] = [], temporary: string[] = [];
   const fail = (error: string): SyncResult => ({ ok: false, pushed, entries: 0, error });
@@ -216,7 +320,7 @@ export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions =
     targets = borrowed.map(opened => {
       const profile = opened.profile;
       if (!profile.sharded || profile.kind !== "generation" || !profile.generation || !profile.shardUser && !profile.shardKey) refuse("shard sync target identity unavailable");
-      return { store: opened, realm: profile.shardUser ? { scope: "user" as const } : { scope: "project" as const, key: profile.shardKey! }, rows: new Map<string, ShardSyncRow>(), fetched: new Set<string>(), sources: [], pending: [], generation: profile.generation };
+      return { store: opened, realm: profile.shardUser ? { scope: "user" as const } : { scope: "project" as const, key: profile.shardKey! }, rows: new Map<string, ShardSyncRow>(), fetched: new Set<string>(), sources: [], pending: [], origins: new Map<string, HoldSource>(), holds: [], generation: profile.generation };
     });
     if (!targets.length || targets.length > 2 || targets.some(target => target.store.profile.home !== store.profile.home)
       || new Set(targets.map(target => shardSyncRef(target.realm))).size !== targets.length
@@ -280,12 +384,13 @@ export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions =
       if (identity !== object) refuse("shard sync public blob identity mismatch");
       blobCache.set(object, bytes); return bytes;
     };
-    type History = { rows: Map<string, ShardSyncRow>; files: Map<string, Buffer> };
+    type History = { rows: Map<string, ShardSyncRow>; files: Map<string, Buffer>; origins: Map<string, HoldSource> };
     // Keep only requested tips. Per-commit full row maps would make append-only history quadratic in memory.
     const histories = new Map<string, History>(), audited = new Set<string>();
+    const firstOrigins = new Map<string, Map<string, HoldSource>>();
     const treeState = async (commit: string, target: Target): Promise<History> => {
       const entries = (await required(["ls-tree", "-r", "-z", commit], "shard sync tree unavailable")).split("\0").filter(Boolean);
-      const rows = new Map<string, ShardSyncRow>(), files = new Map<string, Buffer>();
+      const rows = new Map<string, ShardSyncRow>(), files = new Map<string, Buffer>(), origins = new Map<string, HoldSource>();
       for (const entry of entries) {
         const match = /^100644 blob ([a-f0-9]{40})\t(.+)$/.exec(entry);
         if (!match || match[2] !== "shard.json" && !PACK.test(match[2]!)) refuse(`${shardSyncLabel(target.realm)}: forbidden historical tree entry`);
@@ -298,10 +403,11 @@ export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions =
           if (!pack) { pack = decodeShardPack(path, bytes, target.realm, target.generation); decoded.set(key, pack); }
           else if (!path.endsWith(`/${digest(bytes)}.jsonl`) || pack.some(row => path !== `rows/${digest(row.machine)}/${digest(bytes)}.jsonl`)) refuse(`${shardSyncLabel(target.realm)}: immutable pack path changed`);
           mergeRows(rows, pack, target.realm);
+          mergePackOrigins(origins, firstOrigins, pack, { ref: shardSyncRef(target.realm), commit, pack: path, blob: object });
         }
       }
       if (!files.has("shard.json")) refuse(`${shardSyncLabel(target.realm)}: historical descriptor missing`);
-      return { rows, files };
+      return { rows, files, origins };
     };
     const history = async (tip: string, target: Target): Promise<History> => {
       const key = `${shardSyncRef(target.realm)}:${tip}`, cached = histories.get(key); if (cached) return cached;
@@ -345,7 +451,7 @@ export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions =
         if (target.local) await required(["merge-base", "--is-ancestor", target.local, tip], `${shardSyncLabel(target.realm)}: remote history is not fast-forward`);
         const remote = await history(tip, target); target.remote = tip;
         mergeRows(target.rows, Array.from(remote.rows.values()), target.realm);
-        for (const row of remote.rows.values()) target.fetched.add(row.id);
+        for (const row of remote.rows.values()) { target.fetched.add(row.id); target.origins.set(row.id, remote.origins.get(row.id)!); }
       }
     };
     const localTargets = () => {
@@ -385,10 +491,17 @@ export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions =
         await history(target.commit, target);
       }
     };
-    localTargets(); await fetchTargets(); localTargets(); provePrunes(targets); check();
+    const proveHoldSource: ProveHoldSource = async (target, value) => {
+      await required(["merge-base", "--is-ancestor", value.source.commit, target.remote!], "shard sync prune hold source is not remote history");
+      const original = await history(value.source.commit, target), bytes = original.files.get(value.source.pack);
+      if (!bytes || createHash("sha1").update(`blob ${bytes.length}\0`).update(bytes).digest("hex") !== value.source.blob
+        || !decodeShardPack(value.source.pack, bytes, target.realm, target.generation).some(item => canonicalJSON(item) === canonicalJSON(value.row))
+        || value.source.ref !== shardSyncRef(target.realm)) refuse(`${shardSyncLabel(target.realm)}: prune hold source mismatch`);
+    };
+    localTargets(); await fetchTargets(); localTargets(); provePrunes(targets); await prepareHolds(targets, root, url, proveHoldSource); check();
     // Every selected realm, including its complete remote history/prunes, is preflighted before the first append or publication.
     for (let attempt = 0; attempt < 2; attempt++) {
-      if (attempt) { await fetchTargets(); localTargets(); provePrunes(targets); check(); }
+      if (attempt) { await fetchTargets(); localTargets(); provePrunes(targets); await prepareHolds(targets, root, url, proveHoldSource); check(); }
       await buildTargets(); check();
       const sent = await git(["push", "--atomic", "--no-follow-tags", "-q", "origin", ...targets.map(target => `${target.commit!}:${shardSyncRef(target.realm)}`)]);
       if (sent.code === 0) pushed = true;
@@ -396,13 +509,18 @@ export async function syncShardedMemory(store: MemoryStore, opts: SyncOptions =
       if (sent.code === 0) {
         pushed = true;
         // No local append before a successful atomic publication: a raced foreign prune can still refuse the entire retry safely.
-        localTargets(); provePrunes(targets); check();
+        localTargets(); provePrunes(targets); check(); testOnlyPhase?.("published");
+        // No selected ordinary/native imports can precede durable receipts for every foreign prune.
+        for (const target of targets) for (const hold of target.holds) installHold(root, hold, testOnlyPhase);
+        check();
         for (const target of targets) {
           assertCuratedShardPaths(target.store.profile.home, target.realm.scope === "user" ? { user: true } : { project: target.realm.key });
-          importRows(target);
+          importRows(target); testOnlyPhase?.("imported");
         }
         for (const target of targets) await required(["update-ref", "--no-deref", shardSyncRef(target.realm), target.commit!, target.local ?? zero], "shard sync cached ref changed concurrently");
-        return { ok: true, pushed, entries: targets.reduce((n, target) => n + [...target.rows.values()].filter(row => row.op === "note").length, 0) };
+        const warning = holdWarning(targets, root);
+        return { ok: true, pushed, entries: targets.reduce((n, target) => n + [...target.rows.values()].filter(row => row.op === "note").length, 0),
+          ...(warning ? { warning } : {}) };
       }
       if (opts.signal?.aborted) return fail("stopped");
     }