feat(runtime-host): establish canonical Memory authority

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.

[M4n5ter]

English

Summary

This PR establishes the Runtime Host boundary for transparent local Memory:

• one authenticated, lease-bound writer for MEMORY.md, PENDING.md, and public backup candidates;
• one CAS-fenced MemoryBundle commit boundary for canonical and pending state;
• durable, fail-closed transaction recovery;
• bounded typed memory.query and memory.mutate operations;
• policy-gated, session-correct prompt projection;
• bounded upload, connection, drain, and unknown-outcome handling.

This is part of the M3 extraction tracked by #1167 and follows the ownership and lifecycle direction in #853.

Authority and protocol

• MEMORY.md and PENDING.md form one revisioned bundle, so proposal approval cannot publish only half of its state.
• Only the first maka-memory metadata comment in a section is authoritative; later metadata comments cannot replace canonical status or scope.
• Accepted operations enter the Interactive root owner before waiting on the serialized mutation lane.
• Recovery accepts only the recorded basis or target generation and fails closed on conflicting external state.
• Post-decision publication uncertainty returns commit_outcome_unknown and requests Host drain.
• The protocol preserves the 128 KiB document limit through revision-pinned pages and 32 KiB raw chunks rather than oversized transport frames.
• Backup candidates carry their own revision, and restore checks both the bundle revision and selected candidate revision.
• Uploads are bound to the Host Epoch and connection, with bounded count, aggregate size, and lifetime.
• Commit revalidates size, SHA-256, UTF-8, Memory syntax, secret redaction, and the expected revision.

Policy and product boundary

• Memory reads and prompt projection use the shared policy activation gate.
• Memory and Runtime Policy mutations share one mutation barrier.
• Disabled and incognito access fail closed.
• Session-scoped entries persist their canonical Session identity and are projected only to that Session.
• Connection teardown, policy changes, abort, and expiry reclaim incomplete uploads.
• Host drain rejects new work immediately, lets accepted mutations settle, and then reclaims remaining staged uploads.
• Existing transparent Markdown paths, legacy metadata, default content, safe-mode behavior, backup candidates, and restore history remain supported.

This slice does not switch the production Desktop or TUI owner. Production adapter wiring and removal of embedded writers remain later cutover work. It also does not introduce a generic file, blob, Store, or transaction RPC.

Non-cooperating writers that retain an already-open file descriptor remain outside the Store's concurrency guarantee. Before production activation, raw writers for the same Interactive root must be routed through the Host or removed.

Validation

• Biome passes for all 37 changed files.
• Core: 1,193 tests passed.
• Storage: 803 tests passed; one existing Windows-only test skipped.
• Runtime Host: 355 tests passed.
• Desktop: 2,945 tests passed, including console, accessibility, and copy checks.
• Root typecheck, production build, and git diff --check pass.

简体中文

概要

本 PR 为透明本地 Memory 建立 Runtime Host 边界：

• 为 MEMORY.md、PENDING.md 与公开 backup candidate 建立唯一、经过认证且受 lease 约束的 writer；
• 为 canonical 与 pending 状态建立一个受 CAS 约束的 MemoryBundle 提交边界；
• 提供 durable、fail-closed 的 transaction recovery；
• 提供有界 typed memory.query 与 memory.mutate operation；
• 提供受 policy gate 约束且 session-correct 的 prompt projection；
• 对 upload、connection、drain 与 unknown outcome 建立有界处理。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership 与 lifecycle 方向。

Authority 与协议

• MEMORY.md 与 PENDING.md 组成一个 revisioned bundle，proposal approval 不会只发布一半状态。
• 每个 section 只有第一条 maka-memory metadata comment 具备权威性；后续 metadata comment 不能替换 canonical status 或 scope。
• 已接纳操作会在等待串行 mutation lane 前进入 Interactive root owner。
• Recovery 只接受已记录的 basis 或 target generation，并在外部状态冲突时 fail closed。
• durable decision 之后出现 publication uncertainty 时返回 commit_outcome_unknown，并请求 Host drain。
• 协议通过绑定 revision 的分页与 32 KiB raw chunk 保留 128 KiB document 上限，避免产生超出 transport 限制的 frame。
• Backup candidate 带有独立 revision；restore 同时检查 bundle revision 与所选 candidate revision。
• Upload 绑定 Host Epoch 与 connection，并限制数量、总大小和生命周期。
• Commit 会重新验证大小、SHA-256、UTF-8、Memory 语法、secret redaction 与 expected revision。

Policy 与产品边界

• Memory read 与 prompt projection 经过 shared policy activation gate。
• Memory mutation 与 Runtime Policy mutation 共用一个 mutation barrier。
• disabled 与 incognito access 均 fail closed。
• session-scoped entry 持久化 canonical Session identity，并且只向所属 Session 投影。
• connection teardown、policy change、abort 与 expiry 都会回收未完成的 upload。
• Host drain 会立即拒绝新工作，等待已接纳 mutation settle，然后回收剩余 staged upload。
• 继续支持现有透明 Markdown 路径、legacy metadata、默认内容、safe-mode 行为、backup candidate 与 restore history。

本 slice 不切换 production Desktop 或 TUI owner。Production adapter 接线与 embedded writer 删除仍属于后续 cutover。本 PR 也不增加 generic file、blob、Store 或 transaction RPC。

已经持有打开 file descriptor 的非协作 writer 不在 Store 的并发保证内。Production activation 前，同一 Interactive root 下的 raw writer 必须路由到 Host，或被删除。

验证

• 全部 37 个 changed file 通过 Biome。
• Core：1,193 项测试通过。
• Storage：803 项测试通过；另有 1 项既有 Windows-only skip。
• Runtime Host：355 项测试通过。
• Desktop：2,945 项测试通过，包括 console、accessibility 与 copy 检查。
• 根级 typecheck、production build 与 git diff --check 通过。

[Astro-Han]

Approved. This keeps the production entry points unchanged, reuses the existing root-lease and policy-activation seams, and does not add a generic Store or file RPC. The two-document transaction and chunked upload both follow from concrete product and transport constraints, so I would keep the current boundary.

I found three non-blocking edge cases worth following up:

• The Markdown parser accepts every maka-memory metadata comment in a section, so a later comment in the content can replace the canonical scope or status. Only the first metadata line should be authoritative.
• A no-op raw replacement can rewrite a backup without advancing the bundle revision. A client may then restore a different backup from the one it previously queried. Giving each backup candidate a revision and checking it during restore would close that race.
• beginDrain() clears staged uploads before accepted mutations have finished waiting on the shared lane. A queued replace_commit can therefore return upload_not_found during shutdown. Upload cleanup should wait for accepted operations to settle.

None of these need to block this M3 slice. Each should get a focused regression test before production activation.

[M4n5ter]

Addressed all three follow-up edge cases in 0cabf50ce: first-metadata authority, revision-fenced backup restore, and drain-safe staged uploads. Focused and full affected test suites, typecheck, build, Biome, and diff checks all pass. A maintainer re-review would be appreciated.