Boot and recovery surfaces never load the seat markdown memory layer

[RE-SCOPED 2026-07-22 — mechanism landed; residue = anchor diagnostic + migration]

The original premise ("the layer cannot self-load") is superseded by merged substrate: #15697 (PR #15736) ships the identity-anchor mechanism — Kimi injects MEMORY_LAYER_BOOT_FILES = ['MEMORY.md', 'identity.md'] on the first UserPromptSubmit and once after PostCompact; OpenCode carries the same boot set through instructions. What remains in THIS ticket is only the anchor-specific diagnostic + existing-seat migration residue, re-scoped after Euclid's peer-role convergence (IC_kwDODSospM8AAAABLRQQUw). The earlier procedural-pointer proposal (and its turnPresence-based AC2) is withdrawn.

Context

Three recorded occurrences of the same failure mode: a fresh session lost identity-bearing and operational facts that were already written down in the seat's persistent markdown layer (2026-07-20 + 2026-07-21 sign-off drops; the GH_TOKEN re-teach). A fourth occurred 2026-07-22 pre-mechanism. The operator's framing: "friction->gold means: how can we ensure that future sessions do not suffer the same way?"

The Problem (residue, post-mechanism)

The mechanism exists and self-loads — but it is deliberately fail-open: a broken hook, an unreadable memory dir, or a harness that declines the stdout admission fails silently, indistinguishable from a session that simply never had a layer. The canonical boot/recovery surfaces have no honest way to detect that state, and the one tempting proxy is wrong:

• who_is_online's turnPresence.fresh observes the turnPresenceHook (five events, --env-file-provisioned) — a different script from the identity-anchor hook (two events, no env). It can be fresh while the anchor hook is missing, malformed, or its stdout never admitted. Proxy evidence certifies the wrong mechanism (peer-role correction, accepted).
• The anchor path emits its own context coordinate: <seat-memory-layer source="…" trigger="session-boot|post-compact-reload"> plus the MEMORY.md / identity.md sections. That marker's presence in-context is the honest proof; its absence routes to identity-anchor diagnosis.
• The old procedural "read identity + field-notes as the primary mechanism" wording must be retired outright, not kept as a fallback that silently becomes the real path again (and restoring field-notes.md to the boot set would regress the merged load-budget decision).

The Fix (narrowed, post-convergence)

1. Startup/recovery diagnostic: canonical boot/recovery surfaces name the <seat-memory-layer …> marker + the two boot-file sections as the proof the mechanical load reached context, asserted BEFORE the first public artifact.
2. Failure routing: marker absent → inspect the emitted identity-anchor hook / config.toml [[hooks]] entries / sentinel state dir; presence absent → separately inspect turnPresenceHook / #15658-class wiring. The two never collapse.
3. Sunset: retire the generic item-0 procedural read. A sunset self-DM mentions the layer only when the anchor is known degraded or a seat migration is in progress; otherwise the canonical mechanism owns the load (no per-handover duplication).
4. Existing-seat migration (Iris): operational facts migrate into self-sufficient hot-index lines pointing at bearer-authored detail files; detail files do NOT join the always-loaded set.

Acceptance Criteria

• AC1: AGENTS_STARTUP.md (or the recovery skill's sequence) names the <seat-memory-layer> marker + MEMORY.md/identity.md sections as the boot load proof, with the retirement condition inline (native harness memory slot).
• AC2: the failure-routing split is written down (marker-absent → identity-anchor diagnosis; presence-absent → #15658-class), and no surface describes turnPresence.fresh as memory-layer proof.
• AC3: session-sunset-workflow.md Step 8 drops the generic item-0 read; the conditional mention (degraded anchor / migration) is the only sunset reference.
• AC4: the Iris seat's MEMORY.md carries the operational facts as self-sufficient pointer lines (migration receipt on this ticket).
• AC5 (post-merge) [L3-deferred — post-merge live-seat transcript needed]: a fresh-boot transcript shows the harness load proof in context (Kimi: the <seat-memory-layer> marker + sections; OpenCode: the boot files' content via instructions); a post-compaction recovery transcript shows trigger="post-compact-reload" (Kimi) or the re-loaded content (OpenCode).

Out of Scope

• Any second loader or competing mechanism (#15697's mechanism is the only one).
• SKILL.md top-level growth or AGENTS.md turn-loaded accretion.
• A service-owned delivery receipt for the anchor hook (the residual observability gap — procedural marker checks are the honest posture until/if the harness exposes admission receipts).
• field-notes.md or any detail file joining the always-loaded boot set.

Avoided Traps

• Proxy-evidence healthcheck — turnPresence.fresh proves a sibling hook, never the anchor hook's stdout admission (the peer-role correction this re-scope is folded from).
• Procedural fallback kept "just in case" — a documented manual read silently becomes the real path again; the mechanism must be the only path.
• Detail files in the boot set — the 27.2KB all-loaded regression the Grace reshape exists to prevent; durable facts live as hot-index lines with pointers.
• Retrofit the marker into a mechanical healthcheck claim — the hook is fail-open with no admission receipt; procedural observability named as such beats false mechanical confidence.

Related

• #15697 (superseding mechanism — generators + birth wiring + hook, merged) · PR #15736
• #15658 (turn-presence provisioning — the SEPARATE hook this ticket no longer leans on)
• Euclid's peer-role convergence: IC_kwDODSospM8AAAABLRQQUw · the re-scope proposal it corrected: IC_kwDODSospM8AAAABLQw7ww

Origin Session ID: eb9be68e-9401-4ecd-9762-ef519b4091ed · re-scoped in session 004ae595-0152-4994-a61e-623b3f383e78.

Retrieval Hint: "seat memory layer anchor marker seat-memory-layer diagnostic failure routing identity-anchor hook silence"