superlocalmemory 3.8.13 → 4.0.0

package/src/superlocalmemory/core/remember_runtime.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import logging
 import re
 import threading
 import uuid
@@ -36,6 +37,14 @@ from superlocalmemory.core.remember_admission import (
     RememberReceipt,
     RememberService,
 )
+from superlocalmemory.core.transactions.concrete_owners import (
+    REQUIRED_ADMISSION_OWNERS,
+)
+from superlocalmemory.core.transactions.obligations import ObligationLedger
+from superlocalmemory.core.transactions.owners import (
+    ObligationKind,
+    OperationContext,
+)
 from superlocalmemory.storage.admission_codec import MachineKeyCommandCodec
 from superlocalmemory.storage.admission_journal import (
     Actor,
@@ -47,6 +56,11 @@ from superlocalmemory.storage.admission_journal import (
     TerminalAdmissionError,
 )
 from superlocalmemory.storage.database import DatabaseManager
+from superlocalmemory.storage.generation_fence import (
+    admitted_epoch,
+    clear_admission_epoch,
+    record_admission_epoch,
+)
 from superlocalmemory.storage.write_coordinator import (
     CommandConflictError,
     CommandKind,
@@ -64,11 +78,33 @@ Materializer = Callable[
     list[str] | tuple[str, ...] | MaterializationResult,
 ]
 
+logger = logging.getLogger("superlocalmemory.core.remember_runtime")
+_OBLIGATION_LEDGER = ObligationLedger()
+
+
+def _obligation_schema_present(conn) -> bool:
+    row = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name='projection_obligations'"
+    ).fetchone()
+    if row is None:
+        return False
+    columns = {r[1] for r in conn.execute("PRAGMA table_info(projection_obligations)")}
+    return "context_digest" in columns
+
 
 class CanonicalRememberUnavailable(RuntimeError):
     """The daemon cannot accept a bounded canonical remember request."""
 
 
+class DaemonAlreadyServing(RuntimeError):
+    """A healthy SLM daemon is already serving; this instance should exit 0.
+
+    Raised by ``CanonicalRememberRuntime.start()`` (H2) when the writer claim
+    fails AND a health-verified daemon is responding on the configured port.
+    Caught by ``unified_daemon.py`` lifespan → ``sys.exit(0)``.
+    """
+
+
 class CanonicalMutationConflict(ValueError):
     """A mutation retry key was reused for different immutable input."""
 
@@ -102,6 +138,54 @@ def validate_deterministic_admission(
         raise AdmissionPayloadError("content rejected by deterministic ingest policy")
 
 
+# ---------------------------------------------------------------------------
+# H2 — graceful single-instance helpers (keep all I/O in stdlib; no imports
+# from the server layer to avoid circular dependencies with core).
+# ---------------------------------------------------------------------------
+
+def _get_daemon_port() -> int:
+    """Return the HTTP port this daemon instance listens on.
+
+    Reads ``SLM_DAEMON_PORT`` from the environment (set by ``unified_daemon``
+    at startup) and falls back to the conventional default of 8765.
+    """
+    import os
+
+    raw = os.environ.get("SLM_DAEMON_PORT", "")
+    try:
+        return int(raw)
+    except (ValueError, TypeError):
+        return 8765
+
+
+def _slm_health_check(port: int) -> bool:
+    """Return True iff a healthy SLM daemon responds on *port* within 2 s."""
+    import urllib.request
+
+    try:
+        with urllib.request.urlopen(
+            f"http://127.0.0.1:{port}/health", timeout=2
+        ) as resp:
+            return int(resp.status) == 200
+    except Exception:
+        return False
+
+
+def _boot_self_heal(data_dir: Path) -> None:
+    """Run the H1 stale-artifact reaper.  Fail-soft — never blocks startup."""
+    try:
+        from superlocalmemory.infra.self_heal import reap_stale_artifacts
+
+        report = reap_stale_artifacts(data_dir)
+        if report["removed"]:
+            logger.info(
+                "remember_runtime self-heal: removed %d stale artifact(s)",
+                len(report["removed"]),
+            )
+    except Exception as exc:
+        logger.debug("remember_runtime self-heal failed (non-fatal): %s", exc)
+
+
 class _CoordinatorAdapter:
     """Translate the journal service's narrow protocol into typed commands."""
 
@@ -152,6 +236,7 @@ class CanonicalRememberRuntime:
         self._writer = writer
         self._materialize = materialize or _materialization_is_not_available
         self._binding_lock = threading.RLock()
+        self._generation = 0
         self.coordinator = WriteCoordinator(db.db_path, owner_id=owner_id)
         self.journal = AdmissionJournal(
             journal_path,
@@ -159,6 +244,7 @@ class CanonicalRememberRuntime:
         )
         self._service = RememberService(self.journal, _CoordinatorAdapter(self.coordinator))
         self._started = False
+        self._obligation_schema_ok: bool | None = None
 
     @classmethod
     def for_engine(cls, engine: Any) -> "CanonicalRememberRuntime":
@@ -181,13 +267,72 @@ class CanonicalRememberRuntime:
         )
 
     def start(self) -> None:
-        """Claim writer ownership, install the handler, then recover journal work."""
+        """Claim writer ownership, install the handler, then recover journal work.
+
+        H2 / G-01+G-05 — bounded graceful single-instance:
+
+        When ``claim_ownership()`` fails (another process holds the portalocker
+        flock), we enter a bounded retry loop (≤ 5 attempts, ~1 s between each,
+        total ≤ ~6 s) rather than immediately crashing or silently giving up.
+        This handles the race between a healthy daemon's HTTP-server bind and our
+        health check — the holder may be alive but not yet responding.
+
+        Per-iteration logic:
+          (a) ``claim_ownership()`` succeeds → break and proceed (holder died).
+          (b) ``_slm_health_check(port)`` is True → raise ``DaemonAlreadyServing``
+              (caught by ``unified_daemon.py`` lifespan → ``sys.exit(0)``).
+          (c) First iteration only → run ``_boot_self_heal()`` to clear
+              provably-dead metadata artifacts, then continue.
+
+        After the loop exhausts all attempts without claiming the lock, we know
+        a live process is holding the portalocker flock.  Raise
+        ``DaemonAlreadyServing`` (NOT ``CanonicalRememberUnavailable``) so the
+        daemon exits cleanly rather than crashing with a traceback.
+
+        INVARIANT: ``claim_ownership()`` (portalocker OS flock) is the sole
+        writer-integrity gate.  We never bypass it, never signal or kill a live
+        process.
+        """
+        import time as _time
+
         if self._started:
             return
         if not self.coordinator.claim_ownership():
-            raise CanonicalRememberUnavailable(
-                "another daemon owns the canonical memory writer"
-            )
+            port = _get_daemon_port()
+            _self_heal_done = False
+            _MAX_ATTEMPTS = 5
+
+            for _attempt in range(_MAX_ATTEMPTS):
+                if _attempt > 0:
+                    _time.sleep(1.0)
+
+                # (a) Re-try the claim — holder may have died in the gap.
+                if self.coordinator.claim_ownership():
+                    break  # claimed → proceed to handler registration
+
+                # (b) Health-verified owner → exit gracefully.
+                if _slm_health_check(port):
+                    raise DaemonAlreadyServing(
+                        f"another healthy SLM daemon is already serving"
+                        f" on port {port}"
+                    )
+
+                # (c) First iteration only: clear provably-dead stale artifacts.
+                if not _self_heal_done:
+                    logger.info(
+                        "remember_runtime: writer claim failed, no healthy"
+                        " daemon on port %d; running self-heal (attempt %d/%d)",
+                        port, _attempt + 1, _MAX_ATTEMPTS,
+                    )
+                    _boot_self_heal(self.coordinator.db_path.parent)
+                    _self_heal_done = True
+            else:
+                # Loop exhausted: a live process holds the portalocker flock.
+                # Exit cleanly — never crash with a traceback.
+                raise DaemonAlreadyServing(
+                    f"another SLM daemon holds the writer lock after"
+                    f" {_MAX_ATTEMPTS} attempts on port {port}"
+                )
         try:
             self.coordinator.register_handler(CommandKind.ADMISSION, self._handle_admission)
             self.coordinator.register_handler(CommandKind.DELETE_FACT, self._handle_mutation)
@@ -241,11 +386,13 @@ class CanonicalRememberRuntime:
             self._db = db
             self._profile_id = profile_id
             self._writer = writer
+            self._generation += 1
         try:
             self.replay_pending()
         except BaseException:
             with self._binding_lock:
                 self._db, self._profile_id, self._writer = previous
+                self._generation -= 1
             raise
 
     def remember(
@@ -256,6 +403,9 @@ class CanonicalRememberRuntime:
             raise CanonicalRememberUnavailable("canonical remember writer is not ready")
         if deadline_ms < 1 or deadline_ms > 2_000:
             raise ValueError("deadline_ms must be between 1 and 2000")
+        with self._binding_lock:
+            admitted = self._generation
+        record_admission_epoch(request.profile_id, request.idempotency_key, admitted)
         try:
             return self._service.remember(request, actor, deadline_ms=deadline_ms)
         except (
@@ -266,6 +416,8 @@ class CanonicalRememberRuntime:
             raise CanonicalRememberUnavailable(
                 "canonical remember is temporarily unavailable"
             ) from exc
+        finally:
+            clear_admission_epoch(request.profile_id, request.idempotency_key)
 
     def replay_pending(self) -> int:
         """Finish prepared/dispatched journal entries before publishing readiness."""
@@ -442,6 +594,9 @@ class CanonicalRememberRuntime:
             db = self._db
             if request.profile_id != self._profile_id:
                 raise ValueError("admission command targets a different profile")
+            expected = admitted_epoch(request.profile_id, request.idempotency_key)
+            if expected is not None and expected != self._generation:
+                raise ValueError("admission command epoch is stale")
             ingestion_request = IngestionRequest(
                 content=request.content,
                 profile_id=request.profile_id,
@@ -469,6 +624,7 @@ class CanonicalRememberRuntime:
                     receipt = command_impl.submit(ingestion_request)
                 except IngestionRejectedError as exc:
                     raise CommandRejectedError() from exc
+                self._record_projection_obligations(conn, request, receipt)
         return WriteResult.from_receipt(
             command,
             {
@@ -481,6 +637,47 @@ class CanonicalRememberRuntime:
             },
         )
 
+    def _record_projection_obligations(self, conn, request, receipt) -> None:
+        """Record per-owner APPLY obligations for the admitted facts.
+
+        Fail-closed: raises RuntimeError if M033 is absent.  This is
+        intentional — a successful remember() without a corresponding
+        obligation record would make projection audits permanently incomplete.
+        Back-compat: installs without M033 must run migrations first.
+
+        Schema negative cache: ``_obligation_schema_ok`` is re-checked on
+        every call while False so that hot migrations (M033 applied while the
+        runtime is running) are detected without a restart.  Once the schema
+        is confirmed present the value is cached True for the lifetime of the
+        runtime instance.
+
+        Cross-process erasure fence: distributed, multi-writer erasure fencing
+        is intentionally SCOPED OUT of V4.  Single-process SQLite WAL provides
+        adequate isolation for the current deployment model.  See
+        docs/architecture/erasure-fence-deferred.md for the deferred design.
+        """
+        fact_ids = tuple(getattr(receipt, "fact_ids", ()) or ())
+        if not fact_ids:
+            return
+        # Re-check while False so a hot M033 migration is picked up without
+        # requiring a daemon restart.  Cache True permanently once confirmed.
+        if not self._obligation_schema_ok:
+            self._obligation_schema_ok = _obligation_schema_present(conn)
+        if not self._obligation_schema_ok:
+            raise RuntimeError(
+                "projection_obligations schema is absent; "
+                "run migrations (M033) before ingesting facts"
+            )
+        context = OperationContext(
+            operation_id=receipt.operation_id,
+            profile_id=request.profile_id,
+            subject_id=receipt.operation_id,
+            fact_ids=fact_ids,
+        )
+        _OBLIGATION_LEDGER.record_many(
+            conn, context, REQUIRED_ADMISSION_OWNERS, ObligationKind.APPLY,
+        )
+
     def _handle_mutation(self, conn, capability, command: WriteCommand) -> WriteResult:
         """Run only deterministic SQLite mutation statements under the writer."""
         payload = command.payload
@@ -708,5 +905,6 @@ def _thaw_command_value(value: Any) -> Any:
 __all__ = [
     "CanonicalRememberRuntime",
     "CanonicalRememberUnavailable",
+    "DaemonAlreadyServing",
     "validate_deterministic_admission",
 ]

package/src/superlocalmemory/core/remote_mode.py

@@ -49,13 +49,28 @@ def is_remote_mode() -> bool:
 
 
 def mcp_stateless() -> bool:
-    """True iff the MCP transport should run stateless (no session id required).
+    """True iff the MCP Streamable-HTTP transport should run fully stateless.
 
-    Enabled by ``SLM_REMOTE=1`` (umbrella) or ``SLM_MCP_STATELESS=1`` (granular).
-    Stateless mode lets any gateway/hub forward ``tools/call`` without replaying
-    the ``Mcp-Session-Id`` handshake — the fix for issue #39 Issue 3.
+    **Default is True** (mcp 2.0.0 fully-stateless contract). Stateless mode
+    lets any gateway/hub forward ``tools/call`` without replaying the
+    ``Mcp-Session-Id`` handshake (issue #39 Issue 3) and is required for
+    ``Client(mode="auto")`` discover probes to stay connection-safe.
+
+    Opt-out: set ``SLM_MCP_STATEFUL=1`` to force stateful Streamable-HTTP
+    (session IDs; event store still unused unless the caller passes one).
+    ``SLM_REMOTE`` / ``SLM_MCP_STATELESS`` remain recognized as positive
+    signals but are no longer required — the default is already stateless.
+
+    Application-level ``session_init`` / ``close_session`` are orthogonal
+    (session_id is a string parameter persisted in the memories table).
     """
-    return is_remote_mode() or _is_truthy(os.environ.get("SLM_MCP_STATELESS"))
+    if _is_truthy(os.environ.get("SLM_MCP_STATEFUL")):
+        return False
+    # Explicit SLM_MCP_STATELESS=0/false still honoured as opt-out when set.
+    raw = os.environ.get("SLM_MCP_STATELESS")
+    if raw is not None and raw.strip() != "":
+        return _is_truthy(raw)
+    return True
 
 
 def _allowlist_entries() -> list[str]:

package/src/superlocalmemory/core/store_pipeline.py

@@ -22,6 +22,7 @@ if TYPE_CHECKING:
     from superlocalmemory.core.hooks import HookRegistry
     from superlocalmemory.storage.database import DatabaseManager
 
+from superlocalmemory.storage.erasure_fence import is_erasing
 from superlocalmemory.storage.models import (
     AtomicFact,
     FactType,
@@ -271,6 +272,111 @@ def _upsert_fact_vectors(fact, profile_id, ann_index, vector_store, embedder=Non
         )
 
 
+class _TombstoneReadError(Exception):
+    pass
+
+
+def _fact_is_tombstoned(db: DatabaseManager, profile_id: str, fact_id: str) -> bool:
+    try:
+        rows = db.execute(
+            "SELECT 1 FROM projection_tombstones "
+            "WHERE profile_id = ? AND fact_id = ? LIMIT 1",
+            (profile_id, fact_id),
+        )
+        return bool(rows)
+    except Exception as exc:
+        raise _TombstoneReadError(
+            f"tombstone check failed for {fact_id[:16]}: {type(exc).__name__}: {exc}"
+        ) from exc
+
+
+def _residue_table_exists(db: DatabaseManager, name: str) -> bool:
+    try:
+        return bool(db.execute(
+            "SELECT 1 FROM sqlite_master WHERE type='table' AND name = ? LIMIT 1",
+            (name,),
+        ))
+    except Exception:
+        # Cannot determine existence: treat as present so the residue probe runs
+        # and fails closed rather than silently reporting "no residue".
+        return True
+
+
+def _read_tombstoned_with_retry(
+    db: DatabaseManager, profile_id: str, fact_id: str, attempts: int = 3,
+) -> bool:
+    last: _TombstoneReadError | None = None
+    for _ in range(max(1, attempts)):
+        try:
+            return _fact_is_tombstoned(db, profile_id, fact_id)
+        except _TombstoneReadError as exc:
+            last = exc
+    raise last if last is not None else _TombstoneReadError("tombstone read failed")
+
+
+def _vector_residue_present(db: DatabaseManager, fact_id: str) -> bool:
+    uncertain = False
+    for table in ("embedding_metadata", "vector_row_map"):
+        if not _residue_table_exists(db, table):
+            continue
+        try:
+            if db.execute(
+                f"SELECT 1 FROM {table} WHERE fact_id = ? LIMIT 1", (fact_id,)
+            ):
+                return True
+        except Exception:
+            uncertain = True
+    return uncertain
+
+
+def _drop_resurrected_facts(
+    db: DatabaseManager,
+    profile_id: str,
+    stored_ids: list[str],
+    vector_store: Any,
+    ann_index: Any,
+    retrieval_engine: Any,
+) -> list[str]:
+    survivors: list[str] = []
+    for fid in stored_ids:
+        try:
+            tombstoned = _read_tombstoned_with_retry(db, profile_id, fid)
+        except _TombstoneReadError as exc:
+            if is_erasing(profile_id, fid):
+                # Tombstone unreadable but the in-process fence confirms an
+                # erasure is in flight — clean up rather than leave residue.
+                tombstoned = True
+            else:
+                logger.error(
+                    "Tombstone read error in drop_resurrected for %s, deferring: %s",
+                    fid[:16], exc,
+                )
+                continue
+        if not tombstoned:
+            survivors.append(fid)
+            continue
+        vec_store_ok = vector_store is not None and getattr(vector_store, "available", False)
+        try:
+            if vec_store_ok:
+                vector_store.delete(fid)
+            if ann_index is not None and hasattr(ann_index, "remove"):
+                ann_index.remove(fid)
+            bm25 = getattr(retrieval_engine, "_bm25", None) if retrieval_engine else None
+            if bm25 is not None and hasattr(bm25, "remove_fact"):
+                bm25.remove_fact(fid)
+            db.delete_bm25_tokens_for_fact(fid)
+            db.delete_fact(fid, profile_id=profile_id)
+        except Exception as exc:
+            logger.warning("resurrection undo failed for %s: %s", fid[:16], exc)
+        if _vector_residue_present(db, fid):
+            logger.error(
+                "resurrection undo incomplete for %s: vector residue remains "
+                "(vec_store_available=%s); tombstone preserved",
+                fid[:16], vec_store_ok,
+            )
+    return survivors
+
+
 # ---------------------------------------------------------------------------
 # run_store  (was MemoryEngine.store)
 # ---------------------------------------------------------------------------
@@ -533,6 +639,17 @@ def run_store(
 
     stored_ids: list[str] = []
     for fact in facts:
+        try:
+            if _fact_is_tombstoned(db, profile_id, fact.fact_id):
+                continue
+        except _TombstoneReadError as _tse:
+            logger.error(
+                "Tombstone read error for %s, deferring ingestion: %s",
+                fact.fact_id[:16], _tse,
+            )
+            continue
+        if is_erasing(profile_id, fact.fact_id):
+            continue
         fact = enrich_fact(
             fact, record, profile_id,
             embedder=embedder,
@@ -852,6 +969,10 @@ def run_store(
             except Exception:
                 provenance_complete = False
 
+    stored_ids = _drop_resurrected_facts(
+        db, profile_id, stored_ids, vector_store, ann_index, retrieval_engine,
+    )
+
     logger.info("Stored %d facts (session=%s)", len(stored_ids), session_id)
 
     if derivation_report is not None:
@@ -981,6 +1102,25 @@ def run_store_fact_direct(
 # run_close_session  (was MemoryEngine.close_session)
 # ---------------------------------------------------------------------------
 
+def _session_already_summarised(
+    db: DatabaseManager,
+    profile_id: str,
+    session_id: str,
+) -> bool:
+    """True if close_session already wrote temporal summaries for this session."""
+    if not session_id:
+        return False
+    try:
+        rows = db.execute(
+            "SELECT 1 FROM temporal_events "
+            "WHERE profile_id = ? AND description LIKE ? LIMIT 1",
+            (profile_id, f"Session {session_id}:%"),
+        )
+        return bool(rows)
+    except Exception:
+        return False
+
+
 def run_close_session(
     session_id: str,
     profile_id: str,
@@ -993,10 +1133,20 @@ def run_close_session(
     with session scope. Enables temporal queries like "What happened
     in session 3?"
 
+    Idempotent: if temporal summaries for this session already exist,
+    returns 0 without writing duplicates.
+
     Returns number of session summary events created.
     """
     from superlocalmemory.storage.models import TemporalEvent
 
+    if not session_id:
+        return 0
+
+    if _session_already_summarised(db, profile_id, session_id):
+        logger.debug("Session %s already summarised — skip close", session_id)
+        return 0
+
     facts = db.get_all_facts(profile_id)
     session_facts = [f for f in facts if f.session_id == session_id]
     if not session_facts:

package/src/superlocalmemory/core/topic_signature.py

@@ -119,6 +119,25 @@ def compute_topic_signature(
     words = _WORD.findall(lowered)
     content_words = [w for w in words if w not in _STOPWORDS and len(w) >= 3]
 
+    # LLD-13 Track C.1 — merge entity names into content_words before
+    # computing bigrams.  An entity ID of the form "category-name" (e.g.
+    # "entity-qualixar") contributes its *name* part ("qualixar"); an ID
+    # without a hyphen (e.g. "e001") contributes the whole ID.  Words
+    # already present in content_words are silently deduplicated, so a
+    # prewarm caller and the UserPromptSubmit hook produce byte-identical
+    # signatures when the entity is already named in the prompt text.
+    # Backward-compatible: when entity_hits is empty/None the output is
+    # unchanged from the pre-LLD-13 signature.
+    if entity_hits:
+        _seen = set(content_words)
+        for _eid in entity_hits:
+            _eid_str = str(_eid)
+            _name = _eid_str.split("-", 1)[1] if "-" in _eid_str else _eid_str
+            _name_lc = _name.lower()
+            if _name_lc not in _seen and len(_name_lc) >= 3:
+                content_words.append(_name_lc)
+                _seen.add(_name_lc)
+
     # 5. Bigrams from the ORIGINAL token stream order. Preserves "foo bar"
     # vs "bar foo" distinction and resists stopword-only differentiation.
     bigrams = [f"{a}_{b}" for a, b in zip(content_words, content_words[1:])]
@@ -132,10 +151,6 @@ def compute_topic_signature(
         _canon(content_words),
         _canon(bigrams),
     ]
-    # LLD-13: append entity-hits group ONLY when non-empty. Empty/missing
-    # preserves the byte-identical v3.4.22 pre-Living-Brain signature.
-    if entity_hits:
-        groups.append(_canon([str(e) for e in entity_hits]))
     material = "\0\0".join(groups)
     return hashlib.sha256(material.encode("utf-8")).hexdigest()[:_SIG_LEN]
 

package/src/superlocalmemory/core/transactions/__init__.py

@@ -0,0 +1,78 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+
+from __future__ import annotations
+
+from superlocalmemory.core.transactions.erasure import (
+    ErasureProofRecord,
+    ErasureReceipt,
+    ErasureService,
+    ErasureState,
+    RemoveResult,
+    compute_erasure_hash,
+    fetch_receipt,
+    is_tombstoned,
+    tombstone_memory_id,
+    verify_receipt,
+    write_tombstones,
+)
+from superlocalmemory.core.transactions.manifest import (
+    CompletionManifest,
+    ManifestState,
+    OwnerEvidence,
+    build_evidence,
+    compute_envelope_hash,
+    derive_state,
+    hash_envelope_fields,
+)
+from superlocalmemory.core.transactions.obligations import (
+    Obligation,
+    ObligationConflictError,
+    ObligationLedger,
+)
+from superlocalmemory.core.transactions.owners import (
+    ObligationKind,
+    ObligationState,
+    OperationContext,
+    OwnerErasureProof,
+    OwnerHealth,
+    OwnerResult,
+    ProjectionOwner,
+    is_terminal_success,
+)
+from superlocalmemory.core.transactions.reconciler import Reconciler
+from superlocalmemory.core.transactions.service import MemoryTransactionService
+
+__all__ = [
+    "CompletionManifest",
+    "ErasureProofRecord",
+    "ErasureReceipt",
+    "ErasureService",
+    "ErasureState",
+    "ManifestState",
+    "MemoryTransactionService",
+    "Obligation",
+    "ObligationConflictError",
+    "ObligationKind",
+    "ObligationLedger",
+    "ObligationState",
+    "OperationContext",
+    "OwnerErasureProof",
+    "OwnerEvidence",
+    "OwnerHealth",
+    "OwnerResult",
+    "ProjectionOwner",
+    "Reconciler",
+    "RemoveResult",
+    "build_evidence",
+    "compute_envelope_hash",
+    "compute_erasure_hash",
+    "derive_state",
+    "fetch_receipt",
+    "hash_envelope_fields",
+    "is_terminal_success",
+    "is_tombstoned",
+    "tombstone_memory_id",
+    "verify_receipt",
+    "write_tombstones",
+]