wicked-crew 0.7.18 → 0.7.20

package/dist/api/routes.d.ts

@@ -193,6 +193,17 @@ export declare const OpenPathSchema: z.ZodObject<{
     path: string;
     runId?: string | undefined;
 }>;
+/** `POST /memory/retire` body (DES-MEM-FACETED-001). `scope_prefix` is REQUIRED and, after trim,
+ *  non-empty (enforced in the route so the 400 names the total-wipe guard): estate `memory.erase`
+ *  is subtree-scoped and refuses an empty prefix. `.strict()` for the FINDING-031 posture — an
+ *  unknown field is a 400, never silently ignored into a broader erase than the caller sent. */
+export declare const RetireMemorySchema: z.ZodObject<{
+    scope_prefix: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    scope_prefix: string;
+}, {
+    scope_prefix: string;
+}>;
 /** The actor/audit deps (task #88) — threaded from `createServer`. */
 export interface SecurityDeps {
     audit: AuditLog;
@@ -247,10 +258,12 @@ export interface RuntimeDeps {
      *  Injectable so route tests never shell out to git; defaults to {@link gitReprovisionWorktree}. */
     reprovisionWorktree?: WorktreeReprovisioner;
     openWithOs?: (target: string) => Promise<void>;
-    /** The estate-MCP proposal-queue client behind `/proposals*` (DES-MEM-FACETED-001 §5.0).
-     *  Injectable so route tests never spawn `wicked-estate-mcp`; defaults to the real spawn-per-call
-     *  client (NON-`--readonly`, `WICKED_MEMORY_DB` pinned to the operator global store). */
-    callEstateProposalTool?: (tool: string, args: Record<string, unknown>) => Promise<unknown>;
+    /** The estate-MCP client behind `/proposals*` AND `/memory*` (DES-MEM-FACETED-001) — one seam for
+     *  every operator-facing estate tool (`proposal.*` + `memory.recall`/`memory.coverage`/
+     *  `memory.erase`). Injectable so route tests never spawn `wicked-estate-mcp`; defaults to the
+     *  real spawn-per-call client (NON-`--readonly`, `WICKED_MEMORY_DB` pinned to the operator global
+     *  store — memory.erase is a WRITE). */
+    callEstateTool?: (tool: string, args: Record<string, unknown>) => Promise<unknown>;
     /** Seat sign-in presence probe (seat sign-in) — injectable so route tests never read the
      *  developer's real dotfiles. Defaults to the file/env heuristic in seat-signin.ts. */
     signedIn?: (seatKey: string, workerConfigRoot?: string) => boolean | null;

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAG5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAenD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgG7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;6FAEyF;IACzF,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA2mFN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAG5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmBnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA6J7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ;;;gGAGgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;EAEpB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;4CAIwC;IACxC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA2wFN"}

package/dist/api/routes.js

@@ -14,7 +14,7 @@ import { buildAcceptanceView, resolveRunWorkflow } from '../qe/acceptance.js';
 import { buildEvidenceBundle, coreUnitId, evidenceFilename } from './evidence.js';
 import { outputUnavailableReason, resolveUnit, unitKeysFor } from './unit-output.js';
 import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
-import { callEstateProposalTool, EstateMcpError } from '../core/estate-mcp-client.js';
+import { callEstateTool, EstateMcpError } from '../core/estate-mcp-client.js';
 import { SeatHealthTracker } from './seat-health.js';
 import { applyWorkerConfigRoot, signedInHeuristic } from './seat-signin.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
@@ -87,6 +87,58 @@ function invalidBody(err, what) {
         : what;
     return { error, details: err.issues };
 }
+/** First value of a possibly-repeated query param, WITHOUT trimming — `''` is PRESERVED because a
+ *  blank `scope`/`scope_prefix` is meaningful to estate (root / whole-subtree), unlike an omitted
+ *  one. Returns undefined only when the param is absent. */
+function firstQueryValue(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+/** A JSON object whose every value is a string (a facet/intent tuple, axis→value). */
+function isStringRecord(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        !Array.isArray(v) &&
+        Object.values(v).every((x) => typeof x === 'string'));
+}
+/** A JSON object whose every value is a number (a coverage breakdown map). */
+function isNumberRecord(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        !Array.isArray(v) &&
+        Object.values(v).every((x) => typeof x === 'number'));
+}
+/**
+ * Shape one estate `memory.list` item (`{ memory_id, scope, content, tier, facets, created_at }`)
+ * into the wire {@link MemoryItem}. `memory.list` (the management browse) surfaces per-item
+ * `facets` — the reason the surface can filter by facet at all; `score` is absent (list is not
+ * relevance-ranked) and simply omitted. String fields missing on the wire degrade to `''` rather
+ * than throwing on one item. (The same shape parses a `memory.recall` item unchanged — recall
+ * carries no facets, so `facets` degrades to `{}`.)
+ */
+function shapeMemoryItem(raw) {
+    const r = typeof raw === 'object' && raw !== null ? raw : {};
+    const str = (v) => (typeof v === 'string' ? v : '');
+    const item = {
+        id: str(r['memory_id']),
+        content: str(r['content']),
+        tier: str(r['tier']),
+        scope: str(r['scope']),
+        facets: isStringRecord(r['facets']) ? r['facets'] : {},
+    };
+    if (typeof r['score'] === 'number')
+        item.score = r['score'];
+    return item;
+}
+/** Shape the estate `memory.coverage` result (`{ total, by_tier, by_kind }`) into the wire
+ *  {@link MemoryCoverageResponse}. A shape estate never produces is an UPSTREAM fault — thrown as an
+ *  {@link EstateMcpError} (→ 502), never silently coerced to zeroes. */
+function shapeMemoryCoverage(raw) {
+    const r = typeof raw === 'object' && raw !== null ? raw : undefined;
+    if (r === undefined || typeof r['total'] !== 'number' || !isNumberRecord(r['by_tier']) || !isNumberRecord(r['by_kind'])) {
+        throw new EstateMcpError('memory.coverage returned an unexpected shape');
+    }
+    return { total: r['total'], by_tier: r['by_tier'], by_kind: r['by_kind'] };
+}
 // Closed facet vocabularies for the `GET /governance/rules` browse filters (wiki-mgmt) — the
 // wire contract's `RuleBrowseQuery`. Sets, not zod: the query is otherwise free-form and only
 // these three facets have a vocabulary to enforce.
@@ -213,6 +265,13 @@ export const OpenPathSchema = z.object({
     path: z.string().min(1),
     runId: z.string().min(1).optional(),
 }).strict();
+/** `POST /memory/retire` body (DES-MEM-FACETED-001). `scope_prefix` is REQUIRED and, after trim,
+ *  non-empty (enforced in the route so the 400 names the total-wipe guard): estate `memory.erase`
+ *  is subtree-scoped and refuses an empty prefix. `.strict()` for the FINDING-031 posture — an
+ *  unknown field is a 400, never silently ignored into a broader erase than the caller sent. */
+export const RetireMemorySchema = z.object({
+    scope_prefix: z.string(),
+}).strict();
 /**
  * A SKIN-OWNED settings key (crew#323): one lowercase segment under the `studio.` namespace,
  * e.g. `studio.appearance`, `studio.notifications`. The daemon never interprets these values —
@@ -283,10 +342,10 @@ runtime = {}) {
         });
     const deliverExec = runtime.deliverExec ?? runDeliverScript;
     const reprovisionWorktree = runtime.reprovisionWorktree ?? gitReprovisionWorktree;
-    // The estate proposal-queue client behind `/proposals*` (DES-MEM-FACETED-001 §5.0). The default
-    // is the real spawn-per-call `wicked-estate-mcp` client; route tests inject a stub so no process
-    // is ever spawned.
-    const proposalTool = runtime.callEstateProposalTool ?? callEstateProposalTool;
+    // The estate MCP client behind `/proposals*` AND `/memory*` (DES-MEM-FACETED-001) — one seam. The
+    // default is the real spawn-per-call `wicked-estate-mcp` client; route tests inject a stub so no
+    // process is ever spawned.
+    const estateTool = runtime.callEstateTool ?? callEstateTool;
     /** Repo root for a repo ref, from the registry — shared by the reprovision path below. */
     const repoRootOf = async (repoRef) => (await adapter.listRepos()).find((r) => r.id === repoRef)?.root_path;
     // The run-DTO joins (DES-UX-001 §8.2/§8.3, DES-UX-002 §7.2): `project_id` from the membership
@@ -2650,7 +2709,7 @@ runtime = {}) {
     // fault (502), kept distinct from a client mistake (400: a bad `state`/`id`, or estate's own
     // -32602 invalid-params) — the FINDING-031 posture that a malformed filter is refused, never
     // silently honored as a different request.
-    const proposalUpstreamError = (reply, err) => {
+    const estateUpstreamError = (reply, err) => {
         if (err instanceof EstateMcpError && err.code === -32602) {
             return reply.code(400).send({ error: err.message });
         }
@@ -2678,10 +2737,10 @@ runtime = {}) {
         if (state !== undefined)
             args.state = state;
         try {
-            return (await proposalTool('proposal.list', args));
+            return (await estateTool('proposal.list', args));
         }
         catch (err) {
-            return proposalUpstreamError(reply, err);
+            return estateUpstreamError(reply, err);
         }
     });
     // POST /proposals/:id/approve → proposal.approve →
@@ -2697,10 +2756,10 @@ runtime = {}) {
             // §5.2). Policy→steering routing is OUT OF SCOPE here: a `handed_off` outcome is passed
             // through as-is for a later steering-write to consume; memory proposals return `promoted` and
             // need nothing more.
-            return (await proposalTool('proposal.approve', { id }));
+            return (await estateTool('proposal.approve', { id }));
         }
         catch (err) {
-            return proposalUpstreamError(reply, err);
+            return estateUpstreamError(reply, err);
         }
     });
     // POST /proposals/:id/reject → proposal.reject → { ok: true }.
@@ -2710,10 +2769,154 @@ runtime = {}) {
             return reply.code(400).send({ error: '`id` is required' });
         }
         try {
-            return (await proposalTool('proposal.reject', { id }));
+            return (await estateTool('proposal.reject', { id }));
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // ── Memory management (governed-knowledge surface, DES-MEM-FACETED-001) ───────
+    // Browse + retire the EXISTING operator memory store — the studio counterpart to /proposals:
+    // proposals DECIDE learnings not yet stored; these MANAGE what already is. The estate memory
+    // tools live ONLY on the estate MCP (memory.list / memory.coverage / memory.erase), reached
+    // through the SAME `estateTool` seam and `estateUpstreamError` ladder as /proposals — a client
+    // mistake (non-integer limit, malformed facets JSON, empty retire scope_prefix, or estate's own
+    // -32602 invalid-params) is a 400; an upstream estate/transport fault, or a malformed estate
+    // response, is a 502.
+    //
+    // GRANULARITY, stated honestly (the estate contract, not a convenience wrapper):
+    //   • BROWSE lists the COMPLETE in-scope set. `memory.list` (DES-MEM-FACETED-001) returns every
+    //     memory under `scope_prefix` ("" / omitted = all), each carrying its facets — NOT
+    //     relevance-ranked or facet-intent-filtered. This is why an operator can see faceted memories
+    //     at all: `memory.recall` retrieves nothing for an empty query and EXCLUDES faceted memories
+    //     under empty intent, so it can never inventory the store. `query`/`facets`/`limit` are then
+    //     applied HERE as post-filters over that complete set (see below) — filtering, not retrieval.
+    //   • list returns { memory_id, scope, content, tier, facets, created_at }; facets ride through to
+    //     MemoryItem.facets, powering the surface's facet filter.
+    //   • RETIRE is SUBTREE-scoped, never per-id. estate exposes NO per-memory delete: `memory.erase`
+    //     hard-deletes EVERY memory whose scope equals or descends from `scope_prefix`, and refuses an
+    //     empty prefix (a total-wipe guard). So retire takes a `scope_prefix` and reports how many
+    //     memories the subtree wipe removed — the UI must show the operator the subtree, not one row.
+    // GET /memory?query=&scope_prefix=&facets=<json>&limit= → memory.list + post-filter → { memories }.
+    app.get(`${V}/memory`, { config: { manifest: { responseType: 'ListMemoriesResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const q = req.query;
+        // `scope_prefix` is the ONLY estate-side argument to memory.list (a subtree filter; blank /
+        // omitted = every memory). Forward verbatim WHEN PRESENT — a blank value is meaningful
+        // (whole-subtree), so it is not dropped.
+        const args = {};
+        const scopePrefix = firstQueryValue(q.scope_prefix);
+        if (scopePrefix !== undefined)
+            args.scope_prefix = scopePrefix;
+        // `facets` narrows the COMPLETE list crew-side (after the estate fetch) to memories carrying
+        // every given axis:value (a management filter, NOT a recall intent). Present-but-blank is a
+        // client error
+        // (fail-loud, never a silent no-filter — FINDING-031); a present value must parse to a JSON
+        // object of string values.
+        let facetFilter;
+        const rawFacets = firstQueryValue(q.facets);
+        if (rawFacets !== undefined) {
+            if (rawFacets.trim() === '') {
+                return reply.code(400).send({ error: '`facets` must not be empty' });
+            }
+            let parsedFacets;
+            try {
+                parsedFacets = JSON.parse(rawFacets);
+            }
+            catch {
+                return reply.code(400).send({ error: '`facets` must be a JSON object of axis:value strings' });
+            }
+            if (!isStringRecord(parsedFacets)) {
+                return reply.code(400).send({ error: '`facets` must be a JSON object of axis:value strings' });
+            }
+            facetFilter = parsedFacets;
+        }
+        // `limit` caps the returned ROW count over the complete set (memory.list has no cap of its
+        // own). Omitted/blank ⇒ every matching memory; a present value must be a positive integer.
+        // NOTE: a management browse deliberately fetches the COMPLETE in-scope set before filtering —
+        // the operator memory store is operator-scale, and the studio surface filters that set
+        // client-side, so a server-side cap would hide memories from the filter. Server-side paging
+        // for a store large enough to need it is a future enhancement, not this surface's contract.
+        const rawLimit = firstQueryValue(q.limit);
+        let limit;
+        if (rawLimit !== undefined && rawLimit.trim() !== '') {
+            const n = Number(rawLimit);
+            if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1) {
+                return reply.code(400).send({ error: '`limit` must be a positive integer' });
+            }
+            limit = n;
+        }
+        // `query`, when present, is a case-insensitive CONTENT substring filter over the complete set
+        // — a management search that finds faceted memories too (unlike relevance recall).
+        const query = (firstQueryValue(q.query) ?? '').trim().toLowerCase();
+        try {
+            const raw = await estateTool('memory.list', args);
+            const items = typeof raw === 'object' && raw !== null ? raw['items'] : undefined;
+            if (!Array.isArray(items)) {
+                throw new EstateMcpError('memory.list returned an unexpected shape');
+            }
+            let memories = items.map(shapeMemoryItem);
+            if (query !== '')
+                memories = memories.filter((m) => m.content.toLowerCase().includes(query));
+            if (facetFilter !== undefined) {
+                const pairs = Object.entries(facetFilter);
+                memories = memories.filter((m) => pairs.every(([k, v]) => m.facets[k] === v));
+            }
+            if (limit !== undefined)
+                memories = memories.slice(0, limit);
+            const body = { memories };
+            return body;
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // GET /memory/coverage?scope_prefix= → memory.coverage → { total, by_tier, by_kind }.
+    app.get(`${V}/memory/coverage`, { config: { manifest: { responseType: 'MemoryCoverageResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const q = req.query;
+        const scopePrefix = firstQueryValue(q.scope_prefix);
+        const args = {};
+        if (scopePrefix !== undefined)
+            args.scope_prefix = scopePrefix;
+        try {
+            return shapeMemoryCoverage(await estateTool('memory.coverage', args));
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // POST /memory/retire { scope_prefix } → memory.erase → { erased }. SUBTREE-scoped (no per-id
+    // delete in estate); an empty scope_prefix is refused at the route (a 400 BEFORE any spawn) — the
+    // same total-wipe guard estate enforces with -32602.
+    app.post(`${V}/memory/retire`, {
+        config: {
+            manifest: {
+                requestType: 'RetireMemoryBody',
+                responseType: 'RetireMemoryResponse',
+                statusCodes: [200, 400, 502],
+            },
+        },
+    }, async (req, reply) => {
+        const parsed = RetireMemorySchema.safeParse(req.body);
+        if (!parsed.success) {
+            return reply.code(400).send(invalidBody(parsed.error, 'Invalid retire request'));
+        }
+        const scopePrefix = parsed.data.scope_prefix.trim();
+        if (scopePrefix === '') {
+            return reply.code(400).send({
+                error: '`scope_prefix` must not be empty — memory.erase is subtree-scoped (no per-id delete) and refuses a total wipe',
+            });
+        }
+        try {
+            const raw = await estateTool('memory.erase', { scope_prefix: scopePrefix });
+            const deleted = typeof raw === 'object' && raw !== null ? raw['deleted_count'] : undefined;
+            if (typeof deleted !== 'number') {
+                throw new EstateMcpError('memory.erase returned an unexpected shape');
+            }
+            const body = { erased: deleted };
+            return body;
         }
         catch (err) {
-            return proposalUpstreamError(reply, err);
+            return estateUpstreamError(reply, err);
         }
     });
     // ── Projects (DES-PROJECT-001) — the 9-route experience-plane surface ────────