memory: cross-agent Tier-3 memory bleed = Worldtree defect (reported)

Lofn recalls Sindra's memories because WT writes Tier-3 memory scoped
end_user-only (no agent_self); ratatoskr stores/filters faithfully and
needs no change. Reported to worldtree-dev (thread 01KXRY8V1C...);
fork-relevant (memory isolation inherits this WT axis).

persistent-memory.md

@@ -76,6 +76,21 @@ auth via infra-ops `ENGINE_TOKEN`. Deploy: `irv-ml1:8201`, WireGuard-only. Canon
 `vh/arbo:docs/rest-api.md` v1.4.27 + auto-served `/openapi.json`. comfy-dev offered a concrete t2i
 walkthrough + will coordinate the token when we smoke.
 
+**⚠️ Cross-agent Tier-3 memory BLEED — WORLDTREE defect (found via debug surface 2026-07-17; reported to
+worldtree-dev, reply pending).** Loaded Lofn (Tier-1) in the memory explorer under end_user `ratatoskr-tui`
+→ saw **Sindra's** chunks, and a live Lofn turn **recalled Vuong's name** (a Sindra fact). ROOT: WT writes
+Tier-3 memory scoped `{"end_user": "ratatoskr-tui"}`, `worldtree_scope: "end_user"`, **NO `agent_self`** —
+`agent_id: "ratatoskr:sindra"` rides as record metadata only, not isolation scope. So every agent under one
+end_user shares the pool. **NOT a ratatoskr defect:** our v0.6 lattice {end_user,group,tenant,agent_self} +
+`_matches_scope` support agent_self; `upsert_many` stores scope verbatim (no strip/inject); read-path proof —
+Lofn getting Sindra's chunks means WT's retrieval `scope_all` ALSO omits agent_self (else `_scope_subset`
+excludes agent_self-less records → Lofn would get nothing). FIX is WT's: stamp `agent_self` on Tier-3 writes
++ include it in turn-retrieval scope_all; ratatoskr enforces the moment it arrives, zero change. Likely the
+known per-(user,character) isolation gap (#172). Thread `01KXRY8V1C30R3HGFCTKHPA4PR`. **FORK RELEVANCE:** the
+fork's memory isolation inherits this same WT axis — don't design around it, it's Worldtree's to close.
+Explorer nuance: its agent filter is LENIENT (excludes a chunk only if it CARRIES a conflicting agent_self),
+so agent_self-less chunks show under any agent — a faithful display of user-shared data, not a separate bug.
+
 **✅ Cross-session name-recall arc COMPLETE + SHIPPED (v0.20.11→v0.20.15, pushed).** person-prime `scan`
 verb + `mark_superseded` verb both shipped, deployed to :8392, and live-verified; **WT #364 closed
 end-to-end both sides; Sindra durably recalls Vuong's name** (the "name unknown" negatives are RETIRED