@tpsdev-ai/flair 0.18.0 → 0.20.0

package/dist/cli.js

@@ -7123,7 +7123,7 @@ memory.command("add [content]").requiredOption("--agent <id>")
     .option("--summary <text>", "agent-set multi-sentence dense compression (3-tier chain: subject → summary → content; ops-wkoh)")
     .option("--subject <text>", "one-line title / entity this memory is about")
     .option("--derived-from <csv>", "Comma-separated source Memory IDs this memory was distilled/reflected from (sets Memory.derivedFrom; used by the `rem rapid` reflection loop)")
-    .option("--visibility <value>", "Memory visibility (sets Memory.visibility). Use 'office' to share office-wide with every team agent; omit (default) to keep it private to this agent (flair#509)")
+    .option("--visibility <value>", "Writer-controlled sharing intent (sets Memory.visibility): 'private' (owner-only, never visible to a grant-holder) or 'shared' (visible to owner + any agent holding a read/search MemoryGrant). Omit to use the server's durability-keyed default: permanent/persistent -> shared, standard/ephemeral -> private (flair#509, ops-2dm3)")
     .action(async (contentArg, opts) => {
     const content = contentArg ?? opts.content;
     if (!content) {

package/dist/resources/Admin.js

@@ -1,12 +1,24 @@
 import { Resource } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /Admin — friendly redirect to /AdminDashboard.
  *
  * Operators bookmark or type the bare /Admin path. Without this resource
  * they hit a 404 and assume the admin UI is broken. The dashboard is the
  * canonical landing surface; redirect there.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): the /Admin* pathname
+ * gate in auth-middleware.ts only 401s when there's NO Authorization header
+ * at all (or Basic creds don't resolve to a real user) — a validly-verified
+ * TPS-Ed25519 agent that is NOT an admin, or a valid-but-non-super_user Basic
+ * user, currently sails through the middleware with no admin resource-level
+ * check at all. allowRead closes that gap the same way WorkspaceLatest.ts /
+ * MemoryReindex.ts already gate their own custom (non-@table) Resources.
  */
 export class Admin extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         return new Response("", {
             status: 302,

package/dist/resources/AdminConnectors.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminConnectors — OAuth clients and active sessions.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminConnectors extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const clients = [];
         try {

package/dist/resources/AdminDashboard.js

@@ -1,9 +1,18 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminDashboard — admin home page with system overview.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts for why
+ * this closes a real gap, not just belt-and-suspenders — a verified
+ * non-admin agent could otherwise read full instance stats (principal/agent/
+ * memory/relationship counts) with no admin check at all.
  */
 export class AdminDashboard extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         let principalCount = 0;
         let memoryCount = 0;

package/dist/resources/AdminIdp.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminIdp — enterprise IdP configuration management.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminIdp extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const idps = [];
         try {

package/dist/resources/AdminInstance.js

@@ -4,6 +4,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * Resolve the public URL operators reach this Flair on.
  *
@@ -83,8 +84,13 @@ function resolveVersion() {
 }
 /**
  * GET /AdminInstance — instance info, public key, version.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminInstance extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const version = resolveVersion();
         // Pass the request through so URL resolution can derive from

package/dist/resources/AdminMemory.js

@@ -1,5 +1,6 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminMemory                browse + search memories (list view)
  * GET /AdminMemory?id=<id>        per-memory detail view with full provenance pane
@@ -19,8 +20,15 @@ import { layout, htmlResponse, esc } from "./admin-layout.js";
  * "memory that follows the agent across orchestrators" — the provenance pane
  * makes that legible: every memory shows where it came from, what it derived
  * from, what it superseded, and which peer it synced from.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts — this
+ * page surfaces full memory content across ALL agents, so the gap it closes
+ * matters more here than on the other Admin* pages.
  */
 export class AdminMemory extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         // Harper v5 does not populate this.request on Resource subclasses —
         // getContext() is the only reliable path (ops-sal4: the previous
@@ -334,7 +342,7 @@ export class AdminMemory extends Resource {
         <dl style="display:grid;grid-template-columns:200px 1fr;gap:6px;margin-top:8px;font-family:ui-monospace,SF Mono,monospace;font-size:0.85em">
           <dt style="color:#666">id</dt><dd>${esc(m.id)}</dd>
           <dt style="color:#666">contentHash</dt><dd>${esc(m.contentHash ?? "—")}</dd>
-          <dt style="color:#666">visibility</dt><dd>${esc(m.visibility ?? "private")}</dd>
+          <dt style="color:#666">visibility</dt><dd>${esc(m.visibility ?? "shared (no field — pre-migration default)")}</dd>
         </dl>
       </div>
     `;

package/dist/resources/AdminPrincipals.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminPrincipals — list all principals with kind, trust, status.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminPrincipals extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const principals = [];
         try {

package/dist/resources/Integration.js

@@ -1,7 +1,8 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Integration records are agent-owned. Auth: the non-rejecting gate annotates the
  * request; this resource self-enforces (resolveAgentAuth → internal/agent/anonymous).
@@ -12,6 +13,50 @@ export class Integration extends databases.flair.Integration {
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts/Relationship.ts). Closes the same P0 leak: Harper
+     * routes `GET /Integration/<id>` to get() and the collection describe
+     * (`GET /Integration`) outside search(), so neither was gated before this
+     * fix — an anonymous caller got a 200 with full record content. Per-record
+     * ownership scoping happens in get() below; the collection scope is still
+     * in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * integration ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner
+        // scoping). Only a genuine by-id get is ownership-checked below — see
+        // Memory.ts's get() for the full rationale (same bug class).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await this._auth();
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own integrations.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.agentId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
@@ -66,7 +111,12 @@ export class Integration extends databases.flair.Integration {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id);
         }
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner id, which would otherwise defeat
+        // the `if (!record)` check below and mis-route a genuinely-missing
+        // record into the FORBIDDEN branch instead of a clean super.delete(id)
+        // no-op. Mirrors Memory.ts's delete() — same rationale, same fix.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id);
         if (record.agentId !== auth.agentId) {

package/dist/resources/Memory.js

@@ -1,12 +1,26 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
-import { isAdmin, resolveAgentAuth } from "./agent-auth.js";
+import { isAdmin, resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
-import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, isConservativeMatch, } from "./dedup.js";
+import { resolveReadScope } from "./memory-read-scope.js";
+import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, cosineSimilarity, isConservativeMatch, } from "./dedup.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+/**
+ * Owner ids a non-admin agent may READ (resolveAllowedOwners) and the full
+ * read-scope condition + private-exclusion predicate (resolveReadScope) now
+ * live in ./memory-read-scope.ts — the ONE centralized helper every
+ * cross-agent Memory read path (search()/get() here, SemanticSearch.ts,
+ * MemoryBootstrap.ts, auth-middleware.ts's by-id guard) resolves its scope
+ * through, so the scoping rule cannot drift per-path again (ops-nzxa: a
+ * SemanticSearch inline `visibility === "office"` OR-clause leaked office
+ * memories to any authenticated agent because the rule had scattered). See
+ * that module's doc for the migration invariant (no-visibility-field reads
+ * as "shared", never "private").
+ */
 /**
  * ─── Server-side conservative-duplicate gate (memory-integrity fix) ──────────
  *
@@ -72,7 +86,59 @@ async function findConservativeDedupMatch(ctx, agentId, contentText, embedding,
         }
         if (!top)
             return null;
-        const cosine = 1 - (top.$distance ?? 1);
+        // ─── ops-ume4: Harper's cosine-sort query omits $distance for a SINGLETON
+        // result set ─────────────────────────────────────────────────────────────
+        // Initial working theory was a per-agentId HNSW "cold-start" (first-ever
+        // query cold, second query warm) and the initially-recommended fix was a
+        // same-query retry. Empirically FALSIFIED: a plain retry of the identical
+        // query, 8x with 300ms delays (2.4s total), never recovered a `$distance`
+        // for a genuinely singleton candidate set (exactly one record matching
+        // `agentId equals X AND archived not_equal true`). The actual trigger,
+        // confirmed by direct probing: when this query's post-filter result set
+        // has exactly ONE matching record, `$distance` comes back `undefined` for
+        // it — regardless of how many prior queries have run for that agentId,
+        // how long you wait, or how many other agentIds/records already exist in
+        // the table. The moment a SECOND matching record exists, `$distance` is
+        // populated correctly on the very first query ever issued for that
+        // agentId — no warm-up needed. In practice the singleton case is exactly
+        // an agent's SECOND-ever memory (compared against their first) — the most
+        // common real-world trigger for this bug, and why it looked "permanent
+        // per-agent for the first near-dup query."
+        //
+        // Also NOT a query-shape/conditions issue: the `{operator:"or"}` wrap
+        // SemanticSearch.ts uses elsewhere is unrelated, and neither raising
+        // `limit` past 1 nor changing the conditions shape changes the result —
+        // confirmed empirically. Harper's SORT ordering is correct even in the
+        // singleton case (the right record comes back as `top`); only the
+        // numeric `$distance` annotation is missing. Also confirmed: selecting
+        // "embedding" directly on THIS sort-by-embedding query does not help
+        // either — it comes back as a bare scalar (Harper appears to special-case
+        // the sort attribute in `select`), not the stored vector.
+        //
+        // Fix: when `$distance` is undefined, fetch the ONE candidate's full
+        // record by id (a plain point lookup — not a vector-sort query, so
+        // unaffected by the quirk above) and compute cosine similarity ourselves
+        // in JS from its real stored `embedding` vector against this write's own
+        // `embedding` (this function's parameter), via the same math Harper would
+        // have used (dedup.ts's cosineSimilarity, Harper-free and unit-tested).
+        // This sidesteps the underlying engine quirk entirely rather than
+        // depending on its timing, and works identically whether this is the
+        // agent's first query ever or its thousandth. Never suppresses the write
+        // either way: if the candidate's embedding is somehow also missing (e.g.
+        // a legacy record written before embeddings existed), `cosineSimilarity`
+        // returns 0 — the same safe "no match" signal the pre-fix `?? 1`
+        // fallback produced.
+        let cosine;
+        if (top.$distance !== undefined) {
+            cosine = 1 - top.$distance;
+        }
+        else {
+            console.error("Memory.findConservativeDedupMatch: $distance undefined on a singleton cosine result (ops-ume4) — " +
+                "falling back to a manual cosine computation from the candidate's stored embedding", { agentId, candidateId: top.id });
+            const fullCandidate = await withDetachedTxn(ctx, () => databases.flair.Memory.get(top.id));
+            const candidateEmbedding = Array.isArray(fullCandidate?.embedding) ? fullCandidate.embedding : [];
+            cosine = cosineSimilarity(embedding, candidateEmbedding);
+        }
         const confidence = computeMatchConfidence(contentText, top.content, cosine);
         if (!isConservativeMatch(confidence.cosine, confidence.lexical, cosineThreshold, lexicalThreshold)) {
             return null;
@@ -230,7 +296,81 @@ async function closeSupersededIfNeeded(ctx, content, methodLabel) {
             "(ops-a4t5 — observable, not silent; new record is safely written, old record remains active until retried)", { method: methodLabel, supersededId: content.supersedes, newRecordId: content.id, err });
     }
 }
+/**
+ * ─── Durability-keyed default visibility (ops-2dm3 Layer 1, part A) ─────────
+ *
+ * Writer intent: an explicit `visibility` on the write ALWAYS overrides this
+ * (callers check `content.visibility == null` before calling this). When
+ * unset, the default is keyed off durability — a durable write (the agent
+ * chose to make this stick around) defaults to shared; anything else
+ * defaults to private. "absent" durability (not yet defaulted by the caller)
+ * falls into the private branch, matching the spec's
+ * "standard|ephemeral|absent → private".
+ */
+function defaultVisibilityForDurability(durability) {
+    return durability === "permanent" || durability === "persistent" ? "shared" : "private";
+}
 export class Memory extends databases.flair.Memory {
+    /**
+     * Self-authorize now that the global gate is non-rejecting. Closes the P0
+     * leak: Harper routes `GET /Memory/<id>` to get() and the collection
+     * describe (`GET /Memory`) to a path outside search() — neither was gated
+     * before this fix, so an anonymous caller got a 200 with full record
+     * content / schema even though search() (and the write paths) correctly
+     * 401/403'd. Per-record ownership/grant scoping happens in get() below;
+     * the collection scope is still in search().
+     *
+     * allowCreate/allowUpdate/allowDelete are deliberately NOT added here:
+     * post()/put()/delete() already self-enforce per-agent ownership inline
+     * (resolveAgentAuth + explicit agentId checks in post()/put(), and the
+     * isAdmin durability check in delete()). Adding allow* on top of that,
+     * unverified, risks regressing owner writes/deletes on a P0 security fix
+     * that is scoped to the read leak — left as-is on purpose.
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * memory ids.
+     */
+    async get(target) {
+        // Collection / query reads — the `GET /Memory/?<query>` form and the bare
+        // collection — arrive as a RequestTarget with `isCollection === true`, and
+        // are governed by search() (same owner/grant scoping). Only a genuine by-id
+        // get is ownership-checked below. Without this guard, get() would receive
+        // the query's RequestTarget, super.get() would return the (truthy) result
+        // set, the single-record check would find no `.agentId` on it, and a valid
+        // authenticated self-query would 404 (regression caught by the auth-
+        // middleware e2e "TPS-Ed25519 on GET /Memory/?agentId=X → 200"). A by-id
+        // get (RequestTarget with isCollection false, or a bare id) falls through.
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const ctx = this.getContext?.();
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own memories (any visibility), or a granted
+        // owner's SHARED memories — never that owner's private ones (ops-2dm3
+        // Layer 1 private-exclusion). Centralized in resolveReadScope() so this
+        // and search() below cannot drift.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        const scope = await resolveReadScope(auth.agentId);
+        if (!scope.isAllowed(record))
+            return NOT_FOUND();
+        return record;
+    }
     /**
      * Override search() to scope collection GETs by authenticated agent.
      *
@@ -256,23 +396,12 @@ export class Memory extends databases.flair.Memory {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Non-admin agent: scope to own + granted owners.
+        // Non-admin agent: scope to own (any visibility) + granted owners' SHARED
+        // memories only (ops-2dm3 Layer 1 private-exclusion). Centralized in
+        // resolveReadScope() so get() above and search() here cannot drift.
         const authAgent = auth.agentId;
-        const allowedOwners = [authAgent];
-        try {
-            for await (const grant of databases.flair.MemoryGrant.search({
-                conditions: [{ attribute: "granteeId", comparator: "equals", value: authAgent }],
-            })) {
-                if (grant.ownerId && (grant.scope === "read" || grant.scope === "search")) {
-                    allowedOwners.push(grant.ownerId);
-                }
-            }
-        }
-        catch { /* MemoryGrant table not yet populated — ignore */ }
-        // Build the agentId scope condition
-        const agentIdCondition = allowedOwners.length === 1
-            ? { attribute: "agentId", comparator: "equals", value: allowedOwners[0] }
-            : { conditions: allowedOwners.map(id => ({ attribute: "agentId", comparator: "equals", value: id })), operator: "or" };
+        const scope = await resolveReadScope(authAgent);
+        const agentIdCondition = scope.condition;
         // Harper passes `query` as a RequestTarget (extends URLSearchParams) or a
         // conditions array. For URL-based GET /Memory?... calls, URL params are no
         // longer translated to conditions here — callers should use
@@ -321,6 +450,16 @@ export class Memory extends databases.flair.Memory {
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
         content.archived = content.archived ?? false;
+        // ─── Default visibility (durability-keyed) — ops-2dm3 Layer 1, part A ────
+        // post() only ever creates a NEW record — patchRecord/supersede-close/
+        // retrievalCount bumps all route through put() instead (see put()'s
+        // pre-existing-record guard below), so there is no "don't overwrite an
+        // existing record's visibility" concern here. Explicit visibility on the
+        // write ALWAYS overrides; only stamp the default when the caller left it
+        // unset. permanent|persistent → shared; standard|ephemeral|absent → private.
+        if (content.visibility === undefined || content.visibility === null) {
+            content.visibility = defaultVisibilityForDurability(content.durability);
+        }
         // Validate derivedFrom source IDs exist (best-effort, non-blocking)
         if (Array.isArray(content.derivedFrom) && content.derivedFrom.length > 0) {
             const now = content.createdAt;
@@ -438,6 +577,26 @@ export class Memory extends databases.flair.Memory {
         // Set defaults that post() sets — put() is also used for new records via CLI
         content.archived = content.archived ?? false;
         content.createdAt = content.createdAt ?? now;
+        // Fetch the pre-existing record (if any) ONCE — reused below both to
+        // decide whether this PUT is a fresh create (dedup gate applies, default
+        // visibility stamped) or an update/patch (dedup-bypassed, visibility left
+        // untouched). See the dedup-gate block further down for why an existing
+        // id skips the gate; the SAME "does a record already exist" check gates
+        // the visibility default (ops-2dm3 Layer 1 part A): patchRecord/supersede-
+        // close/retrievalCount bumps all route through put() with a MERGED
+        // `{...existing, ...patch}` payload, and must never have their stored
+        // visibility overwritten by a default recomputed from that merged content
+        // — only a genuinely NEW id gets the default stamped.
+        const preExisting = content.id
+            ? await databases.flair.Memory.get(content.id).catch(() => null)
+            : null;
+        // ─── Default visibility (durability-keyed) — ops-2dm3 Layer 1, part A ────
+        // Explicit visibility on the write ALWAYS overrides; only stamp the
+        // default when the caller left it unset AND this is a fresh record.
+        // permanent|persistent → shared; standard|ephemeral|absent → private.
+        if (!preExisting && (content.visibility === undefined || content.visibility === null)) {
+            content.visibility = defaultVisibilityForDurability(content.durability);
+        }
         // supersedes: optional reference to the ID of the memory this one
         // replaces. Validates shape + cross-agent-write authorization (shared
         // with post() — see validateAndAuthorizeSupersedes doc for why PUT needs
@@ -481,7 +640,6 @@ export class Memory extends databases.flair.Memory {
             delete content.lexicalThreshold;
         }
         else if (content.id) {
-            const preExisting = await databases.flair.Memory.get(content.id).catch(() => null);
             if (!preExisting) {
                 dedupMatch = await runDedupGate(ctx, content);
             }
@@ -523,7 +681,15 @@ export class Memory extends databases.flair.Memory {
         return buildWriteResponse(content, result, dedupMatch);
     }
     async delete(id) {
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner/non-granted id, which would
+        // otherwise short-circuit the `record.durability === "permanent"` check
+        // below (a Response has no .durability) and silently bypass the
+        // admin-only permanent-delete guard for cross-agent deletes. This keeps
+        // delete()'s own pre-existing ownership/admin logic exactly as it was
+        // before the read-gate fix — the read-scoping override must not leak
+        // into delete()'s internal record lookup.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id);
         if (record.durability === "permanent") {