test(memory): desktop+390 browser proof; fix stale posture and cross-agent reads

The @core p5-memory browser spec proves the BF Memory plant room end to
end with console-error, pageerror, requestfailed, and 400+ capture plus
recorded sensitive-mutation bodies: one lamp by stable id, the global
plant landing with honest per-assistant posture, exact posture and
Staff-card drill-ins, the honest unconfigured panel, every drill-in
section with the card-to-Reasoning-to-citation chain, exact runtime
defaults save and source sync bodies, the lane-policy save as one
full-routing write through the shared authority, elevator relanding,
the eleventh-shortcut byte-for-byte full-canvas refusal with all ten
earlier shortcuts genuinely pinned, config-only pin with honest repeat,
live hide/show sync, door execution, reload persistence, the disabled
and restored door truth, the MP room mark with an elementFromPoint
no-cover proof, per-section 390px containment, and zero horizontal
overflow. Thirteen screenshots were captured and individually reviewed.

The proof surfaced two real defects, both fixed test-first: Memory's
posture presented a stale routing snapshot after a Front Desk save (the
controller now reloads when the shared authority's routing config
changes), and a derived agent-selection flip could pair the new agent
with the previous agent's card, atom, graph, turn, or citation ids in
detail requests (every visible list is now gated on its payload's own
agent identity). The mock gateway gained faithful lanes/status and
memory sources/sync endpoints derived from the live runtime config.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: EmergentKnowledgeGroup

apps/mission-control/e2e/mockGateway.mjs

@@ -2887,6 +2887,61 @@ function getAgentMemoryStatusPayload(agent) {
   return cloneSeed(lane.status);
 }
 
+/**
+ * Lane runtime statuses derive from the live runtime routing config so the
+ * browser proof exercises the same identity boundaries as production: only
+ * enabled assignments from enabled humans produce lanes, and only for the
+ * exact requested agent.
+ */
+function buildAgentMemoryLaneStatuses(agent) {
+  const routing = runtimeConfig.routing;
+  if (!routing.enabled) {
+    return [];
+  }
+  const enabledHumans = new Set(
+    routing.human_identities
+      .filter((human) => human.enabled)
+      .map((human) => human.human_identity_id)
+  );
+  const bound = Boolean(
+    agent.memory_binding?.enabled && getAgentMemoryLane(agent.agent_id)
+  );
+  return routing.assistant_assignments
+    .filter(
+      (assignment) =>
+        assignment.enabled &&
+        assignment.assistant_agent_id === agent.agent_id &&
+        enabledHumans.has(assignment.human_identity_id)
+    )
+    .map((assignment) => {
+      const policy =
+        routing.lane_memory_policies.find(
+          (item) =>
+            item.human_identity_id === assignment.human_identity_id &&
+            item.assistant_agent_id === agent.agent_id
+        ) ?? null;
+      const configured = policy?.memory_mode ?? "inherit_runtime";
+      const effective =
+        configured === "inherit_runtime" ? "mno_with_local_sources" : configured;
+      return {
+        human_identity_id: assignment.human_identity_id,
+        assistant_agent_id: agent.agent_id,
+        lane_id:
+          policy?.lane_id ??
+          `lane-${assignment.human_identity_id}-${agent.agent_id}`,
+        configured_memory_mode: configured,
+        effective_memory_mode: effective,
+        source: bound ? "managed_lane" : "memory_off",
+        status: bound ? "available" : "unconfigured",
+        detail: bound
+          ? "Lane runtime is live against the assistant's memory binding."
+          : "This assistant has no memory binding, so the lane runs without shared memory.",
+        local_memory_sources: policy ? [...policy.local_memory_sources] : [],
+        orchestration: null,
+      };
+    });
+}
+
 function sendAgentMemoryJson(res, agentId, data) {
   const lane = getAgentMemoryLane(agentId);
   const bindingId =
@@ -4034,6 +4089,61 @@ async function routeRequest(req, res) {
     return;
   }
 
+  const agentMemoryLaneStatusMatch = requestUrl.pathname.match(
+    /^\/api\/v1\/agents\/([^/]+)\/memory\/lanes\/status$/
+  );
+  if (req.method === "GET" && agentMemoryLaneStatusMatch) {
+    const agentId = decodeURIComponent(agentMemoryLaneStatusMatch[1]);
+    const agent = agents.find((item) => item.agent_id === agentId);
+    if (!agent) {
+      sendJson(res, 404, { error: "agent not found" });
+      return;
+    }
+    sendJson(res, 200, { items: buildAgentMemoryLaneStatuses(agent) });
+    return;
+  }
+
+  if (
+    req.method === "POST" &&
+    requestUrl.pathname === "/api/v1/memory/sources/sync"
+  ) {
+    const payload = await readJson(req);
+    const humanId =
+      typeof payload.human_identity_id === "string"
+        ? payload.human_identity_id
+        : "";
+    const assistantId =
+      typeof payload.assistant_agent_id === "string"
+        ? payload.assistant_agent_id
+        : "";
+    let sources = Array.isArray(payload.sources) ? payload.sources : null;
+    if (!sources) {
+      if (humanId && assistantId) {
+        const policy = runtimeConfig.routing.lane_memory_policies.find(
+          (item) =>
+            item.human_identity_id === humanId &&
+            item.assistant_agent_id === assistantId
+        );
+        sources =
+          policy && policy.local_memory_sources.length > 0
+            ? policy.local_memory_sources
+            : runtimeConfig.memory.memory_md_sources;
+      } else {
+        sources = runtimeConfig.memory.memory_md_sources;
+      }
+    }
+    const syncedAt = Date.now();
+    const items = sources.map((sourcePath, index) => ({
+      source_path: sourcePath,
+      note_id: `memory-note-${index + 1}`,
+      status: "synced",
+      detail: null,
+      synced_at: syncedAt,
+    }));
+    sendJson(res, 200, { items, synced: items.length, failed: 0 });
+    return;
+  }
+
   const agentMemoryCardsMatch = requestUrl.pathname.match(
     /^\/api\/v1\/agents\/([^/]+)\/memory\/cards$/
   );