Proof

Quarantining a belief moves its vector into a different k-means tree — it is not a WHERE clause hiding a row.

VECTOR INDEX memories_vec_idx (workspace_id, status, embedding)

CockroachDB maintains a separate tree per distinct prefix value, so (workspace_id, status) gives tenant isolation and quarantine isolation from the same mechanism.

Even if every line of Python were bypassed, the database still refuses to store a belief holding authority its source cannot justify.

CONSTRAINT capability_requires_integrity CHECK (
  (capability_ceiling = 'informational')
  OR (capability_ceiling = 'suppressive' AND integrity_level >= 3)
  OR (capability_ceiling = 'actuating'   AND integrity_level >= 4)
)

Enforced twice on purpose: memory/lattice.py rejects before a connection opens, this CHECK is the backstop.

Detection, arbitration, the state change, and the audit entry commit or abort together — there is no window where a belief changed status but the ledger doesn't say so.

BEGIN;
  SELECT ... FOR UPDATE (workspace_id, subject_key, predicate)
  -- supersede / quarantine / adjudicate
  INSERT INTO memory_ledger (prev_hash -> entry_hash)
COMMIT;   -- SERIALIZABLE, with a real 40001 retry loop

tests/test_concurrent_admission.py forces genuine 40001 SerializationFailures and asserts the retry loop absorbs them.

What the agent believed at decision time is recovered from the database's own MVCC history — not from a log this project wrote about itself.

SELECT ... FROM memories
AS OF SYSTEM TIME '<decisions.decided_hlc>'
WHERE workspace_id = ...

decided_hlc is cluster_logical_timestamp() captured at decision time, never now().

entry_hash = sha256(prev_hash || canonical_json(payload)). Rewrite any committed payload and the chain stops re-deriving at that exact sequence number.

SELECT seq, payload, prev_hash, entry_hash FROM memory_ledger ...

tests/test_auditor.py mutates a payload behind the gate's back and asserts the auditor reports the break at the right seq.