aimeat 2.7.0 → 3.0.0

package/dist/src/mcp/workspaces.js

@@ -1,5 +1,8 @@
-import { randomUUID } from 'node:crypto';
 import { z } from 'zod';
+import { canWriteNamespaceRule, readOrganismConfig, createOrganismHelpers, fresherRec } from '../routes/organisms/shared.js';
+import { registerWorkspaceCreateTool } from './workspace-create.js';
+import { checkOrganismNamespaceAccess } from '../services/organism-namespace-access.js';
+import { archivedRefusal, checkWorkspaceWriteLimits } from '../services/workspace-write-guards.js';
 import { parseGAII, isSameOwner } from '../utils/gaii.js';
 import { annotationsFor } from './annotations.js';
 import { descriptionFor } from './catalog/shape.js';
@@ -7,13 +10,13 @@ import { validateMemoryWrite } from '../services/schema-validator.js';
 import { checkDeleteGuard } from '../services/write-guards.js';
 import { authorizeRead } from '../services/access-guard.js';
 import { buildOrganismOverview, buildWorkspaceOverview, entryTitle } from '../services/structure-overview.js';
-import { updateWorkspaceMeta, WorkspaceMetaError, normalizeObjectTypes, isMemoryBackedSpace, listOrganismWorkspaceEntries, backfillManifestEnvelope } from '../services/workspace-meta.js';
-import { emitChange, emitMemoryWritten } from '../services/event-bus.js';
+import { updateWorkspaceMeta, WorkspaceMetaError, isMemoryBackedSpace, listOrganismWorkspaceEntries } from '../services/workspace-meta.js';
+import { emitChange } from '../services/event-bus.js';
 import { updateOrganismStructure } from '../services/structure-snapshot.js';
 import { normalizeDocValueImages } from '../services/doc-images.js';
 import { normalizeWriteItems, resolveWriteItem, MAX_BATCH_ITEMS } from '../services/workspace-write-items.js';
+import { findWorkspaceRecord, writeWorkspaceRecord, deleteWorkspaceInstance } from '../services/workspace-write.js';
 import { grantWorkspaceRole, revokeWorkspaceRole as revokeWsRoleSvc } from '../services/workspace-roles.js';
-import { listVersionRefs, maxVersionOf, pruneVersionsAfterPublish } from '../services/workspace-versions.js';
 import { registerWorkspaceMemberTools } from './workspace-members.js';
 import { registerWorkspaceTransferTool } from './workspace-transfer.js';
 import { aiProvenanceInputs, toDeclaredProvenance } from './ai-provenance-input.js';
@@ -22,6 +25,13 @@ import { provenanceForWrite } from '../services/ai-provenance.js';
 import { memoryContentBytes } from '../routes/memory/shared.js';
 import { logger } from '../utils/logger.js';
 export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emitResourceUpdated, _emitResourceListChanged) {
+    // The organism route helpers, built from the same factory routes/organisms/organisms.ts uses.
+    // Publishing a draft, reopening one and appending the gate's decision entry are the SAME
+    // operations POST /v1/organisms/:id/publish and /revert perform, and they are already written as
+    // plain functions that take identities and return a result rather than an HTTP response — so
+    // this door calls them and renders the answer as text, instead of carrying a second copy that
+    // drifted apart on the audit trail, the draft owner and the cross-owner draft lookup.
+    const H = createOrganismHelpers(config, storage);
     const agentGaii = getAgentGaii();
     const parsed = parseGAII(agentGaii);
     const ownerName = parsed ? parsed.owner : agentGaii;
@@ -72,48 +82,27 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
         const m = await storage.getMembership(orgId, ownerName);
         return m && m.status === 'active' ? null : 'Not an active member of this organism';
     }
-    /** Pick the freshest of two records for the same key: higher version wins, then newer updatedAt.
-     *  Guards every workspace read/write against a key that has forked into duplicate-owner copies. */
-    const fresher = (a, b) => {
-        if (!a)
-            return b;
-        if (b.version !== a.version)
-            return b.version > a.version ? b : a;
-        return (b.updatedAt ?? '') >= (a.updatedAt ?? '') ? b : a;
-    };
-    /** Find the FRESHEST existing record at an EXACT key, whichever identity owns it. Memory is keyed by
-     *  (ownerGaii, key); a key ever written under two identities (a GHII and an agent GAII) has duplicate
-     *  copies — carry the freshest forward and collapse the rest (see collapseTo). */
-    const findByKey = async (key) => {
-        const { items } = await storage.listAllMemory({ prefix: key, limit: 20 });
-        return items.filter(r => r.key === key).reduce((best, r) => fresher(best, r), null);
-    };
-    /** Delete every copy of `key` NOT owned by `keepOwner` — collapses a forked key back to one owner. */
-    const collapseTo = async (key, keepOwner) => {
-        const { items } = await storage.listAllMemory({ prefix: key, limit: 20 });
-        await Promise.all(items
-            .filter(r => r.key === key && r.ownerGaii !== keepOwner)
-            .map(r => storage.deleteMemory(r.ownerGaii, r.key).catch(err => { logger.warn('collapseTo: best-effort collapse', { error: String(err) }); })));
-    };
-    /** Write workspace CONTENT under the member's GHII — ONE owner per key, so a record never forks into
-     *  per-agent duplicates that the read path then has to disambiguate. Author/attribution is preserved
-     *  on the immutable `.version.N` records (writerGaii) and the activity timeline, so collapsing the
-     *  current-state owner onto the GHII costs no attribution. `owner` is overridable only for META that
-     *  must stay under a specific identity. A legacy copy under a different identity is collapsed away. */
-    const writeRecord = async (key, value, prev, owner = ownerGhii, aiProvenanceId) => {
-        const now = new Date().toISOString();
-        await storage.setMemory({
-            key, ownerGaii: owner, value, visibility: prev?.visibility ?? 'private', tags: prev?.tags ?? [], ttlHours: null,
-            // TARGET-058. Attached, never inherited from `prev`: a new value is new content, so
-            // carrying the previous record's id forward would leave a statement standing about bytes
-            // it was never about. Passed only for CONTENT writes — the section index and the other
-            // meta writes below make no claim about authorship, so they carry no statement either.
-            ...(aiProvenanceId ? { aiProvenanceId } : {}),
-            version: prev ? prev.version + 1 : 1, createdAt: prev?.createdAt ?? now, updatedAt: now,
-        });
-        if (prev && prev.ownerGaii !== owner)
-            await collapseTo(key, owner);
-    };
+    /**
+     * The caller's role in an organism, for the meta.* rule. denyReason answers "may they be here at
+     * all"; this answers "may they change the structure", and the two are different questions —
+     * publishing over the manifest or the config is not the same act as writing a document.
+     *
+     * An organism AGENT (org.agentGaiis) acts for the organism itself and is treated as a member;
+     * it does not inherit creator or admin, so it cannot publish into meta.* either.
+     */
+    async function memberRoleOf(orgId) {
+        const m = await storage.getMembership(orgId, ownerName);
+        if (m && m.status === 'active')
+            return m.role;
+        const org = await storage.getOrganism(orgId);
+        return org?.agentGaiis?.includes(agentGaii) ? 'member' : null;
+    }
+    /** The freshest record at an EXACT key, whichever identity owns it — services/workspace-write.ts. */
+    const findByKey = (key) => findWorkspaceRecord(storage, key);
+    /** Write one workspace record: ONE owner per key, forked copies collapsed, and the fan-out every
+     *  other write surface runs. The whole of it is services/workspace-write.ts; `owner` defaults to
+     *  the member GHII and is named explicitly only for META that must stay under a given identity. */
+    const writeRecord = (key, value, prev, owner = ownerGhii, aiProvenanceId) => writeWorkspaceRecord({ storage, config }, { key, value, owner, prev, aiProvenanceId });
     // ── workspace-access helpers (shared with the GET/POST workspace-access routes) ──
     const bareOwner = (gaii) => (gaii.includes('#') ? gaii.split('#')[1] : gaii).split('@')[0];
     /** Find a workspace's registry entry across every member's registry. */
@@ -143,32 +132,25 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
         const m = await storage.getMembership(orgId, ownerName);
         return m && m.status === 'active' ? m.role : null;
     };
-    /** May the caller WRITE this workspace's content? The creator's own owner (incl. its agents) always
-     *  can; another member needs a granted workspace-contribution consent. Mirrors workspaceAccessMiddleware
-     *  so the MCP-serve write path enforces the SAME per-workspace gate as the REST path (no looser side). */
+    /**
+     * May the caller WRITE this workspace's content?
+     *
+     * The rule is services/organism-namespace-access.ts, the one the HTTP door answers to. This used
+     * to be a local retelling of it, and the retelling was looser in two places that mattered:
+     * a workspace with no registry entry returned true outright ("bootstrap"), so any active
+     * member's agent wrote into an unregistered workspace the HTTP door refuses; and it never asked
+     * whether the caller was an ORGANISM agent, which may write under .shared. and nowhere else, so
+     * one wrote workspace content here that /v1/memory answers 403 to.
+     */
     const canWriteWs = async (orgId, ws) => {
-        const entry = await findWsEntry(orgId, ws);
-        if (!entry)
-            return true; // no registry yet (bootstrap) — membership already checked
-        if (entry.createdBy === ownerName)
-            return true; // the workspace's own creator (or its agent)
-        // Write requires the creator's 'contributor' role grant — and ONLY that, so the creator can
-        // revoke write by removing the grant. A 'viewer' grant gives read only (not matched here). The
-        // role is granted to the OWNER (recipient ghii:owner@node), so all the owner's agents inherit it.
-        const creatorGhii = `${entry.createdBy}@${config.nodeId}`;
-        const myRecipient = `ghii:${ownerName}@${config.nodeId}`;
-        const pattern = `organism.${orgId}.w.${ws}.**`;
-        const grants = await storage.listConsents(creatorGhii, { status: 'active' });
-        return grants.some(c => c.purpose === 'workspace-contributor' && c.dataPattern === pattern && c.recipient === myRecipient);
-    };
-    /** Create a consent grant if no equivalent active one exists (idempotent). */
-    const ensureConsent = async (owner, dataPattern, recipient, purpose) => {
-        const existing = await storage.listConsents(owner, { status: 'active' });
-        if (existing.some(c => c.dataPattern === dataPattern && c.recipient === recipient))
-            return;
-        const now = new Date().toISOString();
-        await storage.createConsent({ id: randomUUID(), ownerGaii: owner, dataPattern, recipient, purpose, scope: 'private', expires: null, status: 'active', grantedAt: now, revokedAt: null });
+        const refusal = await checkOrganismNamespaceAccess({ storage, config }, {
+            principal: agentGaii, owner: ownerName, roles: ['agent'],
+        }, `${wsRoot(orgId, ws)}.probe`, 'write');
+        return refusal === null;
     };
+    /** Create a consent grant if no equivalent active one exists (idempotent) — the same function the
+     *  workspace-access REST routes call, so the request half of membership has one implementation. */
+    const ensureConsent = H.ensureConsent;
     // ── Workspace member roles: viewer = read, contributor = read+write, as a consent the workspace
     //    CREATOR owns on organism.{id}.w.{ws}.**. Delegates to the ONE shared service so the MCP tools,
     //    the REST routes, and the invite-accept path share a single authority path (no ad-hoc fork). ──
@@ -242,9 +224,9 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
                 const role = parts.slice(1).join('.');
                 const slot = inst.get(parts[0]) ?? {};
                 if (role === '' || role === 'latest')
-                    slot.latest = fresher(slot.latest, r);
+                    slot.latest = fresherRec(slot.latest, r);
                 else if (role === 'draft')
-                    slot.draft = fresher(slot.draft, r);
+                    slot.draft = fresherRec(slot.draft, r);
                 inst.set(parts[0], slot);
             }
             spaces.set(ot.name, { ot, inst });
@@ -360,15 +342,32 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
                 return fail(`${batch ? `items[${i}]: ` : ''}Draft rejected by schema: ` + JSON.stringify(valid.errors));
             planned.push({ key, v, item });
         }
+        // Archived is read-only. This path had no check, so an agent kept filing drafts into a
+        // workspace the owner had closed, and the view then showed fresh material in something
+        // marked finished.
+        const wsArchived = await archivedRefusal(storage, `${root}.`);
+        if (wsArchived)
+            return fail(wsArchived);
+        // And the RECORD's own archive flag, which is a separate fact from the workspace's:
+        // "this document is finished" was honoured by /v1/memory and not by a draft written here.
+        for (const [i, p] of planned.entries()) {
+            const rowArchived = await archivedRefusal(storage, `${root}.`, { ownerGhii, key: p.key });
+            if (rowArchived)
+                return fail(`${batch ? `items[${i}]: ` : ''}${rowArchived}`);
+        }
+        const overLimit = await checkWorkspaceWriteLimits(storage, config, ownerGhii, planned, i => (batch ? `items[${i}]: ` : ''));
+        if (overLimit)
+            return fail(overLimit);
         const written = [];
         let lastProvenanceId;
         for (const { key, v, item } of planned) {
-            // TARGET-058. A workspace record is a memory record, but this tool writes straight to
-            // storage rather than through /v1/memory, so it inherited nothing: an agent's
-            // workspace write carried no provenance at all. It goes through the same one decision
-            // function every other write surface uses. Per ITEM, not per call — a batch of twenty
-            // records is twenty different sets of bytes, and one record covering all of them
-            // would be a statement about content it cannot identify.
+            // TARGET-058. A workspace record is a memory record, and this path does not go through
+            // /v1/memory (one owner per key, which a general write would undo), so for a long time
+            // it inherited nothing and an agent's workspace write carried no provenance at all. It
+            // goes through the same one decision function every other write surface uses. Per
+            // ITEM, not per call — a batch of twenty records is twenty different sets of bytes,
+            // and one record covering all of them would be a statement about content it cannot
+            // identify.
             const provenanceId = await provenanceForWrite(storage, {
                 principal: agentGaii,
                 content: memoryContentBytes(v),
@@ -414,91 +413,72 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
         const deny = await denyReason(organism_id);
         if (deny)
             return fail(deny);
-        const cfg = await storage.getMemory(ownerGhii, `organism.${organism_id}.meta.config`);
-        const gate = cfg?.value?.gates?.publish?.enabled;
+        const role = await memberRoleOf(organism_id);
+        if (!role || !canWriteNamespaceRule(role, namespace)) {
+            return fail('Admin/creator role required to publish in a meta.* namespace');
+        }
+        const archived = await archivedRefusal(storage, `${wsRoot(organism_id, ws)}.`);
+        if (archived)
+            return fail(archived);
+        // Read across every owner, as routes/organisms/shared.ts does. The config normally
+        // belongs to the organism's creator, so the per-owner read this used to do returned
+        // nothing for any OTHER member — the gate read as absent and the publish went through.
+        const cfg = await readOrganismConfig(storage, organism_id);
+        const gate = cfg?.gates?.publish?.enabled;
         if (gate)
             return fail('Publishing requires human approval (the publish gate is on). Leave it as a draft for the owner to review and publish.');
         const base = `${wsRoot(organism_id, ws)}.${namespace}.${id}`;
-        // Value-free version handling: the scan skips `.version.N` rows (their full values were
-        // loaded just to find maxN); the version numbers come from the key names alone below.
-        const { items } = await storage.listAllMemory({ prefix: `${base}.`, limit: 2000, excludeVersionRows: true });
-        // The draft may have been written by a sibling agent of the same owner (shell/REST path
-        // stores under the agent's own GAII), so accept any same-owner draft, not just ownerGhii's.
-        const draft = items.filter(r => r.key === `${base}.draft` && (r.ownerGaii === ownerGhii || isSameOwner(r.ownerGaii, ownerGhii)))
-            .reduce((best, r) => fresher(best, r), null);
-        if (!draft)
-            return fail(`No draft at ${base}.draft`);
-        // Safety net for drafts written before the write-path normalizer (or by other clients): scope
-        // embedded images to this workspace + rewrite to /v1/pub before they become the published copy.
-        const draftValue = await normalizeDocValueImages(storage, config, draft.value, ownerName, `${organism_id}/${ws}`);
-        const valid = await validateMemoryWrite(`${base}.latest`, draftValue, storage, { viaPublish: true, expectedVersion: expected_version ?? null });
-        if (!valid.valid)
-            return fail('Publish refused: ' + JSON.stringify(valid.errors));
-        const versionRefs = await listVersionRefs(storage, base);
-        const maxN = maxVersionOf(versionRefs);
-        const now = new Date().toISOString();
-        const tags = draft.tags ?? [];
-        const existingLatest = items.filter(r => r.key === `${base}.latest`).reduce((best, r) => fresher(best, r), null);
-        // Change-guard: an unchanged re-publish (a contract agent re-publishes the same draft on every
-        // poll/status cycle) must NOT append a byte-identical .version.N. Consume the draft and return
-        // without touching .latest or firing the Tracked-Response/structure side effects.
-        if (existingLatest && JSON.stringify(existingLatest.value) === JSON.stringify(draftValue)) {
-            await storage.deleteMemory(draft.ownerGaii, `${base}.draft`);
-            emitChange('organisms');
-            return ok({ published: base, version: maxN, skipped: true });
+        // The publish itself: the same publishDraft POST /v1/organisms/:id/publish calls. It reads
+        // the draft, scopes its embedded images, validates through the write guards with the
+        // optimistic lock, honours the manifest's `versioned` flag, skips a byte-identical
+        // re-publish, writes `.version.N` under the publisher and `.latest` under the member GHII,
+        // prunes past the retention window and consumes the draft. This tool used to do all of it
+        // again, and the copy had drifted: it refused a co-member's draft with "No draft at …"
+        // where the web door published it.
+        const result = await H.publishDraft(organism_id, ws, namespace, id, writerGaii, expected_version ?? null);
+        if (!result.ok) {
+            return fail(result.code === 'NO_DRAFT'
+                ? `No draft at ${base}.draft`
+                : 'Publish refused: ' + JSON.stringify(result.violations));
         }
-        // Honour the manifest's `versioned` flag (default true): a transient space (e.g. a request queue)
-        // declared `versioned:false` keeps only .latest — no immutable per-publish history.
-        const publishOt = (await readManifest(organism_id, ws))?.objectTypes?.find(o => o.namespace === namespace);
-        const versioned = publishOt?.versioned !== false;
-        const n = maxN + 1;
-        // TARGET-058. Publishing MOVES the content, so the statement about how it was made moves
-        // with it. Without this the draft carried a record and `.latest` — the copy the workspace
-        // read serves and the visible label renders from — carried none, so publishing was where
-        // an agent-written record quietly became origin-unstated. Carried rather than re-minted:
-        // the record says how the content was MADE, and publishing does not change that. Same
-        // caveat as the REST path in routes/organisms/shared.ts — an image-URL rewrite above can
-        // leave the record's contentHash describing the draft bytes rather than the published ones.
-        const provenanceId = draft.aiProvenanceId ?? undefined;
-        // Attribution: the immutable .version.N snapshot is authored by the PUBLISHER (writerGaii).
-        // The .latest pointer (current state) is owned by a member's GHII — ONE owner per key, so it
-        // never forks into per-agent duplicates that a read then has to disambiguate. Preserve the
-        // record's existing owner (normalised to their GHII — never a raw agent GAII); a brand-new
-        // record is owned by the caller's GHII. collapseTo removes any copy left under another identity.
-        const latestOwner = existingLatest ? `${bareOwner(existingLatest.ownerGaii)}@${config.nodeId}` : ownerGhii;
-        if (versioned) {
-            await storage.setMemory({ key: `${base}.version.${n}`, ownerGaii: writerGaii, value: draftValue, ...(provenanceId ? { aiProvenanceId: provenanceId } : {}), visibility: draft.visibility, tags, ttlHours: null, version: 1, createdAt: now, updatedAt: now });
-            // Retention: prune history beyond the space's window (append-only spaces never pruned).
-            await pruneVersionsAfterPublish(storage, config, { refs: versionRefs, publishedN: n, ot: publishOt });
-        }
-        await storage.setMemory({ key: `${base}.latest`, ownerGaii: latestOwner, value: draftValue, ...(provenanceId ? { aiProvenanceId: provenanceId } : {}), visibility: draft.visibility, tags, ttlHours: null, version: (existingLatest?.version ?? 0) + 1, createdAt: existingLatest?.createdAt ?? now, updatedAt: now });
-        await collapseTo(`${base}.latest`, latestOwner);
-        await storage.deleteMemory(draft.ownerGaii, `${base}.draft`);
         emitChange('organisms');
-        // Memory Contracts (reactive): publishing a watched record (e.g. a bug → status:done)
-        // fires Tracked Response evaluation. Gated O(1) on the track-registry in the subscriber.
-        emitMemoryWritten(latestOwner, `${base}.latest`);
-        void updateOrganismStructure(storage, config, organism_id, { event: 'content published', actor: writerGaii }).catch(err => { logger.warn('publishOt: timeline best-effort', { error: String(err) }); });
-        return ok({ published: base, version: n });
+        // A no-op re-publish (a contract agent re-publishes the same draft every poll cycle) left
+        // no new version, so it earns no audit entry and no timeline snapshot either.
+        if (result.skipped)
+            return ok({ published: base, version: result.version, skipped: true });
+        // The gate/Prove trail. Without this the organism's decision log recorded web publishes
+        // and not agent publishes, so the trail read as if nothing shipped on the days an agent
+        // did the work.
+        await H.writeDecision(organism_id, writerGaii, `published ${namespace}.${id} v${result.version}`, [`${namespace}.${id}`]);
+        void updateOrganismStructure(storage, config, organism_id, { event: 'content published', actor: writerGaii }).catch(err => { logger.warn('publish: timeline best-effort', { error: String(err) }); });
+        // Activation: published workspace content is the account's first durable output whichever
+        // door produced it. Fire-and-forget — measuring a publish must never fail it.
+        void import('../services/onboarding-funnel.js')
+            .then(m => m.recordActivation(storage, config, ownerName, 'workspace'))
+            .catch(err => { logger.warn('publish: activation marker is best-effort', { error: String(err) }); });
+        return ok({ published: base, version: result.version });
     });
     // ── aimeat_workspace_revert_to_draft ──
     mcp.tool('aimeat_workspace_revert_to_draft', descriptionFor('aimeat_workspace_revert_to_draft'), { organism_id: z.string(), ws: z.string(), namespace: z.string(), id: z.string() }, annotationsFor('aimeat_workspace_revert_to_draft'), async ({ organism_id, ws, namespace, id }) => {
         const deny = await denyReason(organism_id);
         if (deny)
             return fail(deny);
+        const revertRole = await memberRoleOf(organism_id);
+        if (!revertRole || !canWriteNamespaceRule(revertRole, namespace)) {
+            return fail('Admin/creator role required to reopen a meta.* record');
+        }
         const base = `${wsRoot(organism_id, ws)}.${namespace}.${id}`;
-        // Reopening needs only .draft/.latest/bare — never the `.version.N` history values.
-        const { items } = await storage.listAllMemory({ prefix: `${base}.`, limit: 2000, excludeVersionRows: true });
-        if (items.find(r => r.key === `${base}.draft`))
-            return fail(`A draft already exists at ${base}.draft — edit it directly instead of reopening.`);
-        // The published current state is the FRESHEST .latest (guarding a forked key), or the bare key.
-        const latest = items.filter(r => r.key === `${base}.latest`).reduce((best, r) => fresher(best, r), null)
-            ?? items.find(r => r.key === base) ?? null;
-        if (!latest)
-            return fail(`No published record at ${base}.latest to reopen.`);
-        const now = new Date().toISOString();
-        // Draft (current-state) owned by the member's GHII — one owner per key (see writeRecord).
-        await storage.setMemory({ key: `${base}.draft`, ownerGaii: ownerGhii, value: latest.value, visibility: latest.visibility, tags: latest.tags ?? [], ttlHours: null, version: 1, createdAt: now, updatedAt: now });
+        // The same revertToDraft POST /v1/organisms/:id/revert calls: copy `.latest` (or the bare
+        // key) into `.draft` and refuse to clobber a draft already in progress. The reopened draft
+        // is owned by the member GHII rather than the calling agent's GAII — one owner per key, as
+        // every other current-state write in this file. The REST door passes its raw session
+        // identity here, which is why a web-reopened draft can land under an agent GAII.
+        const result = await H.revertToDraft(organism_id, ws, namespace, id, ownerGhii);
+        if (!result.ok) {
+            return fail(result.code === 'DRAFT_EXISTS'
+                ? `A draft already exists at ${base}.draft — edit it directly instead of reopening.`
+                : `No published record at ${base}.latest to reopen.`);
+        }
         emitChange('organisms');
         return ok({ reopened: base });
     });
@@ -516,6 +496,13 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
         const role = await roleOf(organism_id);
         if (!role)
             return fail('You are not a member of this organism.');
+        // Archived is read-only, and structure is exactly what it protects. The web door has
+        // refused a rename, a manifest replacement, a new space or a repinned app inside an
+        // archived organism since the archive shipped; this tool checked nothing, so the owner's
+        // "this is finished" held on one surface.
+        const archived = await archivedRefusal(storage, `organism.${organism_id}.w.${ws}.`);
+        if (archived)
+            return fail(archived);
         try {
             const addParsed = parseObj(add_spaces);
             const appsParsed = parseObj(apps);
@@ -549,26 +536,10 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
         const delGuard = await checkDeleteGuard(`${base}.latest`, storage);
         if (!delGuard.valid)
             return fail('Delete refused: ' + (delGuard.errors?.[0]?.message ?? 'append-only namespace'));
-        // List the WHOLE instance: the bare key `${base}` (an un-suffixed write — which
-        // workspace_read surfaces as the current value) AND every role-suffixed key
-        // (`.latest` / `.draft` / `.version.N`). Prefix `${base}` (no trailing dot) catches the
-        // bare key too; the per-row guard then excludes sibling instances like `${base}0` /
-        // `${base}-x` so we only ever touch this exact id. (Earlier this listed `${base}.` only,
-        // so a bare-key object survived delete yet kept showing in workspace_read.)
-        const { items } = await storage.listAllMemory({ prefix: base, limit: 5000 });
-        let deleted = 0;
-        for (const r of items) {
-            if (r.key !== base && !r.key.startsWith(`${base}.`))
-                continue; // exclude sibling ids
-            // Own + same-owner records (a sibling agent's writes) are deletable; cross-owner are not.
-            if (r.ownerGaii !== ownerGhii && !isSameOwner(r.ownerGaii, ownerGhii))
-                continue;
-            const role = r.key === base ? '' : r.key.slice(base.length + 1); // '' = bare
-            if (role === '' || role === 'draft' || role === 'latest' || /^version\.\d+$/.test(role)) {
-                if (await storage.deleteMemory(r.ownerGaii, r.key))
-                    deleted++;
-            }
-        }
+        // The whole instance — the bare key plus `.draft` / `.latest` / every `.version.N`, own
+        // and same-owner only — through services/workspace-write.ts, which is the predicate the
+        // batched REST delete applies too.
+        const deleted = await deleteWorkspaceInstance(storage, { base, callerGhii: ownerGhii });
         if (deleted === 0)
             return fail(`Nothing to delete at ${base} (no record/draft/latest/version).`);
         // Best-effort: unfile the id from the document section tree (find the type by namespace).
@@ -576,7 +547,10 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
         const ot = (man?.objectTypes ?? []).find(o => o.namespace === namespace);
         if (ot) {
             const secKey = `${root}.meta.sections.${ot.name}`;
-            const secRec = await storage.getMemory(ownerGhii, secKey);
+            // Resolved across owners, as the write path resolves the same key. Reading it under
+            // the caller's own GHII found nothing whenever the section tree belonged to the
+            // workspace creator, so the tree kept the id and the delete was only half applied.
+            const secRec = await findByKey(secKey);
             const sections = secRec?.value?.sections;
             if (sections) {
                 let changed = false;
@@ -591,65 +565,15 @@ export function registerWorkspaceTools(mcp, storage, config, getAgentGaii, _emit
             }
         }
         emitChange('organisms');
+        // The structure history records creates and publishes; without this it silently skipped an
+        // agent's deletes, so a shrinking workspace had no recorded cause.
+        void updateOrganismStructure(storage, config, organism_id, { event: `deleted record ${namespace}.${id}`, actor: writerGaii }).catch(err => { logger.warn('object_delete: timeline best-effort', { error: String(err) }); });
         return ok({ deleted: base, keys: deleted });
     });
     // ── aimeat_workspace_create ──
-    mcp.tool('aimeat_workspace_create', descriptionFor('aimeat_workspace_create'), {
-        organism_id: z.string(),
-        name: z.string().describe('Workspace name'),
-        manifest: z.any().describe('The workspace manifest (objectTypes + policy) as a JSON OBJECT, not a string.'),
-        schemas: z.any().optional().describe('Map of namespace → JSON Schema for records types, as a JSON OBJECT.'),
-        readme: z.string().optional().describe('Optional markdown intro'),
-    }, annotationsFor('aimeat_workspace_create'), async ({ organism_id, name, manifest, schemas, readme }) => {
-        const deny = await denyReason(organism_id);
-        if (deny)
-            return fail(deny);
-        const man = parseObj(manifest);
-        if (!man || typeof man !== 'object' || !Array.isArray(man.objectTypes)) {
-            return fail('manifest must be an object with an objectTypes array.');
-        }
-        // Gate: reject unsupported backings + infer mode from kind BEFORE anything is written,
-        // so a misdeclared space fails the very first call instead of becoming invisible data.
-        try {
-            man.objectTypes = normalizeObjectTypes(man.objectTypes);
-        }
-        catch (e) {
-            if (e instanceof WorkspaceMetaError)
-                return fail(e.message);
-            throw e;
-        }
-        const schemaMap = (parseObj(schemas) ?? {});
-        const wsId = 'ws-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 5);
-        const root = wsRoot(organism_id, wsId);
-        const now = new Date().toISOString();
-        // 1. Lock the records schemas under the owner GHII (direct storage — bypasses the route's
-        //    owner/operator gate, which an agent token would fail).
-        for (const [namespace, schema] of Object.entries(schemaMap)) {
-            if (!schema || typeof schema !== 'object')
-                continue;
-            await storage.setSchema({ keyPattern: `${root}.${namespace}`, applyTo: 'prefix', schemaJson: schema, schemaMode: 'strict', lockedBy: ownerGhii, setAt: now, updatedAt: now });
-        }
-        // 2. Write the manifest (validated against the manifest meta-schema). Backfill the envelope
-        //    (manifestVersion/id/name/kind/status) the model routinely omits — so a create with just
-        //    objectTypes validates first try instead of bouncing off the required-field check.
-        const manifestValue = backfillManifestEnvelope(man, { orgId: organism_id, fallbackName: name });
-        const mkey = `${root}.meta.manifest`;
-        const valid = await validateMemoryWrite(mkey, manifestValue, storage);
-        if (!valid.valid)
-            return fail('Manifest rejected by schema: ' + JSON.stringify(valid.errors));
-        await writeRecord(mkey, manifestValue, null, ownerGhii); // manifest = creator meta
-        // 3. Readme.
-        const summary = man.summary;
-        await writeRecord(`${root}.meta.readme`, readme || `# ${String(man.name || name)}\n\n${typeof summary === 'string' ? summary : ''}`, null, ownerGhii);
-        // 4. Register in the workspace registry.
-        const regKey = `organism.${organism_id}.meta.workspaces`;
-        const regRec = await storage.getMemory(ownerGhii, regKey);
-        const workspaces = (regRec?.value?.workspaces) ?? [];
-        await writeRecord(regKey, { workspaces: [...workspaces, { id: wsId, name: String(name || 'Workspace').trim() || 'Workspace', createdAt: now, createdBy: ownerName }] }, regRec, ownerGhii);
-        emitChange('organisms');
-        void updateOrganismStructure(storage, config, organism_id, { event: 'workspace created', actor: writerGaii }).catch(err => { logger.warn('workspaces: timeline best-effort', { error: String(err) }); });
-        return ok({ created: true, ws: wsId, types: man.objectTypes.map(o => o.name), schemas_locked: Object.keys(schemaMap) });
-    });
+    // Extracted to workspace-create.ts (max-file-lines); registered here to preserve tool order.
+    registerWorkspaceCreateTool(mcp, storage, config, { ownerName, ownerGhii, writerGaii, ok, fail,
+        denyReason, parseObj });
     // ── aimeat_workspace_access + the member-role tools (member_grant, member_revoke, members) ──
     // Extracted to workspace-members.ts — access is the REQUEST half of the same membership
     // concern the grant tools serve. Registered here to preserve tool order.