wicked-crew 0.7.19 → 0.7.21

package/dist/api/routes.d.ts

@@ -4,6 +4,7 @@ import { CoreAdapter } from '../core/adapter.js';
 import { type GateCache } from './gate-cache.js';
 import type { ElicitationCache } from './elicitation-cache.js';
 import { QeGateCache } from '../qe/gate-events.js';
+import type { ConformanceRule, SteeringType } from '../core/types.js';
 import { SeatHealthTracker } from './seat-health.js';
 import { type ProjectRoutesDeps } from '../projects/routes.js';
 import { InteractiveBridgePool } from '../interactive/bridge-pool.js';
@@ -18,6 +19,30 @@ import { DeliveryDerivationCache } from './delivery-cache.js';
 import { type DeliverExec, type WorktreeReprovisioner } from './post-hoc-deliver.js';
 import { type AuthMode } from './auth.js';
 export { API_PREFIX } from './api-prefix.js';
+/**
+ * Map an APPROVED policy proposal (estate `proposal.approve` → `handed_off`) into a steering
+ * ConformanceRule (DES-MEM-FACETED-001 §5.2). A policy proposal's `kind_type` is
+ * `policy:<steering_type>` and its `payload` is `{ rule, severity }`; estate writes NOTHING for it
+ * (the AW-11 "no rules.write on estate" invariant) and hands the payload back for crew — the ONE
+ * governed rules-write path — to land. Returns the rule to upsert plus the resolved steering type,
+ * or a loud `error` string when the proposal cannot be shaped into a valid rule (a malformed
+ * `kind_type` / missing `rule` / out-of-enum `severity`) — the caller reports it as a failed
+ * landing, never a silent drop (the crew#388 anti-silent-loss doctrine).
+ *
+ * The rule id is DETERMINISTIC (`proposal:<id>`) so a re-driven landing UPSERTS the same rule
+ * (idempotent) instead of minting a duplicate; it sits OUTSIDE the reserved `PAT-/POL-` namespace,
+ * which UI/chat/proposal-authored rules are free to do (INV-C1). The rule carries NO `effect`
+ * (recall-only — exactly what `{rule, severity}` supports: an enforcement rule would need a
+ * non-blank `applies_to`, which the payload does not carry, and INV-S3 fails such a rule closed).
+ * `steering_type` is validated against the vocabulary here so the engine's INV-S1 never rejects it
+ * as an unknown page.
+ */
+export declare function policyProposalToRule(proposalId: string, kindType: string, payload: unknown, facets: Record<string, string> | undefined): {
+    rule: ConformanceRule;
+    steeringType: SteeringType;
+} | {
+    error: string;
+};
 /**
  * The launch body. Every field but `problem` is optional, which is what made stripping dangerous:
  * omitting one is a legitimate request that gets an engine default, so a MISSPELLED one was

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAG5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmBnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA+J7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ;;;gGAGgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;EAEpB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;4CAIwC;IACxC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA2vFN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAG5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAInD,OAAO,KAAK,EAEV,eAAe,EAYf,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA6E7C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GACzC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAkD3E;AAkFD;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ;;;gGAGgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;EAEpB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;4CAIwC;IACxC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA81FN"}

package/dist/api/routes.js

@@ -100,6 +100,70 @@ function isStringRecord(v) {
         !Array.isArray(v) &&
         Object.values(v).every((x) => typeof x === 'string'));
 }
+/**
+ * Map an APPROVED policy proposal (estate `proposal.approve` → `handed_off`) into a steering
+ * ConformanceRule (DES-MEM-FACETED-001 §5.2). A policy proposal's `kind_type` is
+ * `policy:<steering_type>` and its `payload` is `{ rule, severity }`; estate writes NOTHING for it
+ * (the AW-11 "no rules.write on estate" invariant) and hands the payload back for crew — the ONE
+ * governed rules-write path — to land. Returns the rule to upsert plus the resolved steering type,
+ * or a loud `error` string when the proposal cannot be shaped into a valid rule (a malformed
+ * `kind_type` / missing `rule` / out-of-enum `severity`) — the caller reports it as a failed
+ * landing, never a silent drop (the crew#388 anti-silent-loss doctrine).
+ *
+ * The rule id is DETERMINISTIC (`proposal:<id>`) so a re-driven landing UPSERTS the same rule
+ * (idempotent) instead of minting a duplicate; it sits OUTSIDE the reserved `PAT-/POL-` namespace,
+ * which UI/chat/proposal-authored rules are free to do (INV-C1). The rule carries NO `effect`
+ * (recall-only — exactly what `{rule, severity}` supports: an enforcement rule would need a
+ * non-blank `applies_to`, which the payload does not carry, and INV-S3 fails such a rule closed).
+ * `steering_type` is validated against the vocabulary here so the engine's INV-S1 never rejects it
+ * as an unknown page.
+ */
+export function policyProposalToRule(proposalId, kindType, payload, facets) {
+    const steeringType = kindType.startsWith('policy:') ? kindType.slice('policy:'.length) : '';
+    if (!STEERING_TYPES.has(steeringType)) {
+        return {
+            error: `the approved proposal's kind_type ${JSON.stringify(kindType)} does not name a steering ` +
+                `type — expected \`policy:<${STEERING_TYPE_VALUES.join('|')}>\``,
+        };
+    }
+    const body = typeof payload === 'object' && payload !== null && !Array.isArray(payload)
+        ? payload
+        : {};
+    const statement = typeof body['rule'] === 'string' ? body['rule'].trim() : '';
+    if (statement === '') {
+        return {
+            error: 'the approved policy proposal payload has no `rule` string to make a rule statement from',
+        };
+    }
+    const rawSeverity = body['severity'];
+    const severity = rawSeverity === 'info' || rawSeverity === 'warn' || rawSeverity === 'error' || rawSeverity === 'critical'
+        ? rawSeverity
+        : undefined;
+    if (rawSeverity !== undefined && severity === undefined) {
+        return {
+            error: `the approved policy proposal payload has an invalid severity ${JSON.stringify(rawSeverity)} — ` +
+                'expected info|warn|error|critical',
+        };
+    }
+    const language = facets?.['language'];
+    const rule = {
+        id: `proposal:${proposalId}`,
+        rule_type: 'policy',
+        statement,
+        // A policy proposal SHOULD carry severity; a missing one defaults to `warn` (the middle band)
+        // rather than failing the landing, but a present-but-garbage one fails loud above.
+        severity: severity ?? 'warn',
+        // REQUIRED engine-side (f32, no serde default, INV-C2 `[0,1]`); the payload carries none, so a
+        // fixed authority — the same 0.8 the steering-author landing defaults to.
+        confidence: 0.8,
+        // Only the `language` facet maps onto the engine's Targets facet object; `repo`/`project`
+        // facets have no ConformanceRule slot and are dropped (see the route's open question).
+        targets: typeof language === 'string' && language !== '' ? { language } : {},
+        provenance: { source: 'proposal', source_kinds: [] },
+        steering_type: steeringType,
+    };
+    return { rule, steeringType: steeringType };
+}
 /** A JSON object whose every value is a number (a coverage breakdown map). */
 function isNumberRecord(v) {
     return (typeof v === 'object' &&
@@ -107,14 +171,13 @@ function isNumberRecord(v) {
         !Array.isArray(v) &&
         Object.values(v).every((x) => typeof x === 'number'));
 }
-/** The broad-browse recall token budget for `GET /memory` when the caller passes no `limit` — larger
- *  than estate's own 2000 default so a browse returns a meaningful slice, not a conversational one. */
-const MEMORY_BROWSE_TOKEN_BUDGET = 8000;
 /**
- * Shape one estate `memory.recall` item (`{ memory_id, scope, content, tier, score }`) into the wire
- * {@link MemoryItem}. estate recall does NOT surface per-item facets, so `facets` defaults to `{}`
- * (mapped defensively so a future estate that DOES carry them rides through); `score` is dropped
- * when absent. String fields missing on the wire degrade to `''` rather than throwing on one item.
+ * Shape one estate `memory.list` item (`{ memory_id, scope, content, tier, facets, created_at }`)
+ * into the wire {@link MemoryItem}. `memory.list` (the management browse) surfaces per-item
+ * `facets` — the reason the surface can filter by facet at all; `score` is absent (list is not
+ * relevance-ranked) and simply omitted. String fields missing on the wire degrade to `''` rather
+ * than throwing on one item. (The same shape parses a `memory.recall` item unchanged — recall
+ * carries no facets, so `facets` degrades to `{}`.)
  */
 function shapeMemoryItem(raw) {
     const r = typeof raw === 'object' && raw !== null ? raw : {};
@@ -2745,23 +2808,95 @@ runtime = {}) {
         }
     });
     // POST /proposals/:id/approve → proposal.approve →
-    //   { outcome:'promoted', active_id }  — a MEMORY proposal, now an active memory (complete);
-    //   { outcome:'handed_off', payload }  — a POLICY proposal, returned VERBATIM.
+    //   { outcome:'promoted', active_id }              — a MEMORY proposal, now an active memory (complete);
+    //   { outcome:'handed_off', payload, landing }     — a POLICY proposal, LANDED here as a steering rule.
+    //
+    // The policy→steering landing (DES-MEM-FACETED-001 §5.2): estate performs NO rules-write (the
+    // AW-11 invariant) — it marks the proposal approved and hands its `{ rule, severity }` payload
+    // back, and CREW is the one governed rules-write path. On a `handed_off` outcome we recover the
+    // proposal's `kind_type` (which carries the `policy:<steering_type>` the approve response does
+    // NOT echo), shape a `ConformanceRule` from it, and upsert it via the single-writer actor. The
+    // posture mirrors the steering-author landing (crew#388): the estate decision (approve) already
+    // stands, so a landing failure is reported LOUD in-band as `landing.outcome:"failed"` — never a
+    // 500, never the silent no-op that crew#388 exists to end — and `payload` is still returned for
+    // backward compatibility. The MEMORY path is UNTOUCHED: a `promoted` outcome returns immediately
+    // with no extra estate call and no landing.
     app.post(`${V}/proposals/:id/approve`, { config: { manifest: { responseType: 'ApproveProposalResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
-        const { id } = req.params;
-        if (id.trim() === '') {
+        // Normalize ONCE and use the trimmed value throughout — an id like `%20pol1%20`
+        // decodes to a padded, non-empty string that would otherwise ride upstream as-is
+        // and into `proposal:<id>` derivations.
+        const id = req.params.id.trim();
+        if (id === '') {
             return reply.code(400).send({ error: '`id` is required' });
         }
+        let approved;
         try {
-            // TODO: route handed_off policy payload to steering (crew steering-write, DES-MEM-FACETED-001
-            // §5.2). Policy→steering routing is OUT OF SCOPE here: a `handed_off` outcome is passed
-            // through as-is for a later steering-write to consume; memory proposals return `promoted` and
-            // need nothing more.
-            return (await estateTool('proposal.approve', { id }));
+            approved = (await estateTool('proposal.approve', { id }));
         }
         catch (err) {
             return estateUpstreamError(reply, err);
         }
+        // MEMORY proposal (or any future non-policy outcome): estate already promoted it — pass through
+        // verbatim, exactly as before. No extra estate round-trip on the memory path.
+        if (approved.outcome !== 'handed_off') {
+            return approved;
+        }
+        // POLICY proposal — land the handed-off payload as a steering rule.
+        const landFailed = (error) => {
+            audit.record('governance.steering.landing_failed', actorOf(req), {
+                detail: { proposalId: id, error },
+            });
+            return { outcome: 'handed_off', payload: approved.payload, landing: { outcome: 'failed', error } };
+        };
+        // A pre-steering engine would SILENTLY DROP `steering_type` and the other steering fields
+        // (ConformanceRule has no deny_unknown_fields), persisting a rule that enforces differently than
+        // authored — the same guard POST /governance/rules applies. Fail loud (before any further estate
+        // round-trip), persist nothing.
+        if (!adapter.steeringSupported()) {
+            return landFailed(`${new SteeringUnsupportedError('Landing an approved policy proposal').message} — the ` +
+                `installed engine would silently drop the rule's steering fields; upgrade wicked-core-ts (>= 0.7.5)`);
+        }
+        // Recover the proposal's `kind_type` + `facets`: `proposal.approve` does not echo them, and the
+        // steering type lives ONLY in `kind_type` (`policy:<type>`). The proposal is `approved` now, so
+        // read it back from the approved queue.
+        let proposal;
+        try {
+            const listed = (await estateTool('proposal.list', { state: 'approved' }));
+            proposal = listed.proposals.find((p) => p.id === id);
+        }
+        catch (err) {
+            return landFailed(`the policy proposal was approved but its record could not be re-read to land a steering ` +
+                `rule (${message(err)}); land it by hand via POST ${V}/governance/rules`);
+        }
+        if (proposal === undefined || typeof proposal.kind_type !== 'string') {
+            return landFailed(`the policy proposal was approved but could not be found in the approved queue to recover ` +
+                `its steering type; land it by hand via POST ${V}/governance/rules`);
+        }
+        const built = policyProposalToRule(id, proposal.kind_type, approved.payload, isStringRecord(proposal.facets) ? proposal.facets : undefined);
+        if ('error' in built) {
+            return landFailed(built.error);
+        }
+        try {
+            await adapter.upsertConformanceRule(built.rule);
+        }
+        catch (err) {
+            return landFailed(`the store refused the steering rule derived from the approved policy proposal: ${message(err)}`);
+        }
+        audit.record('governance.rule.upserted', actorOf(req), {
+            detail: {
+                id: built.rule.id,
+                source: 'proposal',
+                via: 'proposal-approve',
+                steeringType: built.steeringType,
+                proposalId: id,
+            },
+        });
+        const landing = {
+            outcome: 'landed',
+            ruleId: built.rule.id,
+            steering_type: built.steeringType,
+        };
+        return { outcome: 'handed_off', payload: approved.payload, landing };
     });
     // POST /proposals/:id/reject → proposal.reject → { ok: true }.
     app.post(`${V}/proposals/:id/reject`, { config: { manifest: { responseType: 'RejectProposalResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
@@ -2779,38 +2914,41 @@ runtime = {}) {
     // ── Memory management (governed-knowledge surface, DES-MEM-FACETED-001) ───────
     // Browse + retire the EXISTING operator memory store — the studio counterpart to /proposals:
     // proposals DECIDE learnings not yet stored; these MANAGE what already is. The estate memory
-    // tools live ONLY on the estate MCP (memory.recall / memory.coverage / memory.erase), reached
+    // tools live ONLY on the estate MCP (memory.list / memory.coverage / memory.erase), reached
     // through the SAME `estateTool` seam and `estateUpstreamError` ladder as /proposals — a client
     // mistake (non-integer limit, malformed facets JSON, empty retire scope_prefix, or estate's own
     // -32602 invalid-params) is a 400; an upstream estate/transport fault, or a malformed estate
     // response, is a 502.
     //
     // GRANULARITY, stated honestly (the estate contract, not a convenience wrapper):
-    //   • BROWSE is query-based. estate has no "list all"; `memory.recall` returns a token-budgeted,
-    //     relevance-ranked slice. Broad browse = an empty `query` + `scope_prefix` (subtree filter,
-    //     "" = every memory) + a large token budget. `limit` IS that token budget — estate exposes no
-    //     row-count cap — so it bounds the SIZE of the slice, not a memory count.
-    //   • recall returns { memory_id, scope, content, tier, score } and does NOT surface per-item
-    //     facets, so MemoryItem.facets is always {} (mapped defensively for a future estate).
+    //   • BROWSE lists the COMPLETE in-scope set. `memory.list` (DES-MEM-FACETED-001) returns every
+    //     memory under `scope_prefix` ("" / omitted = all), each carrying its facets — NOT
+    //     relevance-ranked or facet-intent-filtered. This is why an operator can see faceted memories
+    //     at all: `memory.recall` retrieves nothing for an empty query and EXCLUDES faceted memories
+    //     under empty intent, so it can never inventory the store. `query`/`facets`/`limit` are then
+    //     applied HERE as post-filters over that complete set (see below) — filtering, not retrieval.
+    //   • list returns { memory_id, scope, content, tier, facets, created_at }; facets ride through to
+    //     MemoryItem.facets, powering the surface's facet filter.
     //   • RETIRE is SUBTREE-scoped, never per-id. estate exposes NO per-memory delete: `memory.erase`
     //     hard-deletes EVERY memory whose scope equals or descends from `scope_prefix`, and refuses an
     //     empty prefix (a total-wipe guard). So retire takes a `scope_prefix` and reports how many
     //     memories the subtree wipe removed — the UI must show the operator the subtree, not one row.
-    // GET /memory?query=&scope=&scope_prefix=&facets=<json>&limit= → memory.recall → { memories }.
+    // GET /memory?query=&scope_prefix=&facets=<json>&limit= → memory.list + post-filter → { memories }.
     app.get(`${V}/memory`, { config: { manifest: { responseType: 'ListMemoriesResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
         const q = req.query;
-        // `query` defaults to "" (broad browse). scope / scope_prefix forward verbatim WHEN PRESENT —
-        // a blank value is meaningful to estate (root / whole-subtree), so it is not dropped.
-        const args = { query: firstQueryValue(q.query) ?? '' };
-        const scope = firstQueryValue(q.scope);
-        if (scope !== undefined)
-            args.scope = scope;
+        // `scope_prefix` is the ONLY estate-side argument to memory.list (a subtree filter; blank /
+        // omitted = every memory). Forward verbatim WHEN PRESENT — a blank value is meaningful
+        // (whole-subtree), so it is not dropped.
+        const args = {};
         const scopePrefix = firstQueryValue(q.scope_prefix);
         if (scopePrefix !== undefined)
             args.scope_prefix = scopePrefix;
-        // `facets` is the recall `intent` tuple (axis→value). Present-but-blank is a client error
+        // `facets` narrows the COMPLETE list crew-side (after the estate fetch) to memories carrying
+        // every given axis:value (a management filter, NOT a recall intent). Present-but-blank is a
+        // client error
         // (fail-loud, never a silent no-filter — FINDING-031); a present value must parse to a JSON
-        // object of string values (estate further validates each axis and answers -32602 → 400).
+        // object of string values.
+        let facetFilter;
         const rawFacets = firstQueryValue(q.facets);
         if (rawFacets !== undefined) {
             if (rawFacets.trim() === '') {
@@ -2826,27 +2964,42 @@ runtime = {}) {
             if (!isStringRecord(parsedFacets)) {
                 return reply.code(400).send({ error: '`facets` must be a JSON object of axis:value strings' });
             }
-            args.intent = parsedFacets;
-        }
-        // `limit` is the recall token budget (estate has no row-count cap). Omitted/blank ⇒ the broad
-        // browse budget; a present value must be a positive integer (mirrors GET /audit's `limit`).
+            facetFilter = parsedFacets;
+        }
+        // `limit` caps the returned ROW count over the complete set (memory.list has no cap of its
+        // own). Omitted/blank ⇒ every matching memory; a present value must be a positive integer.
+        // NOTE: a management browse deliberately fetches the COMPLETE in-scope set before filtering —
+        // the operator memory store is operator-scale, and the studio surface filters that set
+        // client-side, so a server-side cap would hide memories from the filter. Server-side paging
+        // for a store large enough to need it is a future enhancement, not this surface's contract.
         const rawLimit = firstQueryValue(q.limit);
-        let tokenBudget = MEMORY_BROWSE_TOKEN_BUDGET;
+        let limit;
         if (rawLimit !== undefined && rawLimit.trim() !== '') {
             const n = Number(rawLimit);
             if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1) {
-                return reply.code(400).send({ error: '`limit` must be a positive integer (the recall token budget)' });
+                return reply.code(400).send({ error: '`limit` must be a positive integer' });
             }
-            tokenBudget = n;
+            limit = n;
         }
-        args.token_budget = tokenBudget;
+        // `query`, when present, is a case-insensitive CONTENT substring filter over the complete set
+        // — a management search that finds faceted memories too (unlike relevance recall).
+        const query = (firstQueryValue(q.query) ?? '').trim().toLowerCase();
         try {
-            const raw = await estateTool('memory.recall', args);
+            const raw = await estateTool('memory.list', args);
             const items = typeof raw === 'object' && raw !== null ? raw['items'] : undefined;
             if (!Array.isArray(items)) {
-                throw new EstateMcpError('memory.recall returned an unexpected shape');
+                throw new EstateMcpError('memory.list returned an unexpected shape');
+            }
+            let memories = items.map(shapeMemoryItem);
+            if (query !== '')
+                memories = memories.filter((m) => m.content.toLowerCase().includes(query));
+            if (facetFilter !== undefined) {
+                const pairs = Object.entries(facetFilter);
+                memories = memories.filter((m) => pairs.every(([k, v]) => m.facets[k] === v));
             }
-            const body = { memories: items.map(shapeMemoryItem) };
+            if (limit !== undefined)
+                memories = memories.slice(0, limit);
+            const body = { memories };
             return body;
         }
         catch (err) {