Module scanned 

Write- and read-boundary content screening for durable memory.

ScannedMemory is a transparent decorator applied to every backend by the memory factory. It enforces [memory.policy] at the two places content crosses the persistence boundary:

• Write path (store*, store_procedural): when redact_on_write is enabled, configured categories (crate::redact) are rewritten to placeholders before persistence; then the content that would actually be stored is scanned (crate::threat). If unsafe content remains, the write is rejected before it reaches the backend (reject) or persisted and withheld at read time (block-on-read). Namespace/category policy (crate::policy_gate) is validated last; any failure aborts the write (fail-closed).
• Read path (recall*, get*, list): when threat_scan_load_time is enabled, stored entries are re-scanned and flagged entries are withheld from results. This covers rows written before scanning was enabled and rows persisted under block-on-read.

export / export_agent are data-portability and archive surfaces: they return stored rows verbatim so backups and the agent-deletion archive stay complete, and so an operator can inspect withheld rows before deleting them with forget.

Structs

ScannedMemory

Decorator that scans, redacts, and policy-gates durable memory content at the write and recall boundaries.