Governed Memory for AI Agents: a shared spine with a human merge gate, in production across four deployments

AI collapsed the cost of executing project work and, in doing so, moved the bottleneck to continuity of understanding: the one thing an agent cannot supply for itself, because every session begins amnesiac. Memory stores for agents now appear weekly. Few of them answer the question an organisation has to answer before it lets agents write into its memory: who is allowed to change what we believe, and how is a wrong change undone? We report on Architect, a system in daily production use since April 2026 that answers that question structurally rather than by policy. Its contributions, in order: (1) a lifecycle-gated write contract, in which agents may deposit freely into an append-only spine but may only propose changes of state, one human merges on one surface, and authority is recomputed at the moment of application rather than at the moment of grant; (2) a set of spine invariants that make governance operative instead of descriptive: supersede-not-delete with lineage, structural refusal of malformed or unauthorised writes, human-tethered recording authority for agent personas, and provenance stamped on every unit; (3) the matter-scoped memory substrate those invariants run on, where scope attaches before any prompt, the reachability boundary doubles as the data-sovereignty boundary, a reconciler round-trips records between markdown files and a database, and a third-party AI can connect over a standard protocol and complete the full loop. We present four deployments (a multi-matter central instance, a user-bound matter, a pooled multi-tenant box and a single-tenant box) as measured on 20 August 2026: a corpus of 9,784 units, of which 6,520 are lived rather than imported, and the system's audit of its own lineage, which found 62 supersessions predating a fix, 38 of them in the wrong direction, and reversed 11 by a judge under a confidence floor while holding the other 27 for a human. We close with the frontier (automatic contradiction surfacing, as-of-t query, unit-level promotion) and show, with numbers, why the merge gate itself is the scaling bottleneck and why the answer is graduated autonomy rather than faster human review.