saf: name the borrowed hand and lock owner

Make the laptop and phone obey the same principal map: Souvie, Annie/Aster, and Vanguard are dedicated residents; Kitty, Gem, and Hal knowingly borrow Casey's UID. Their live posture is regenerated from actual credentials for every model request, outside memory, replay, and compaction.\n\nTake the lock boundary out of all of them. Casey authenticates, agents may request, and the dedicated souveraine-session principal holds the hostile pre-unlock edge with only Ambient and Revealable reach.

saf/memory/02-replay.md

@@ -64,6 +64,26 @@ bulk of older tool-result output with an explicit cleared marker, keeping the
 recent results intact. The typed record is compacted first; replay projects the
 result afterward.
 
+## Current authority never replays
+
+Identity memory says who an agent understands herself to be. It cannot say
+which Unix principal is handling this request now. Every model request receives
+a fresh runtime-principal system block described in
+[agent principals](../identity/02-agent-principal.md): dedicated resident,
+intentional borrowed-user mode, actual UID, expected account, node, and drift.
+
+That block is synthesized from current process and admission facts after
+history replay. It is not stored as assistant or user text, not committed to
+the agent's memfs, and not an input to compaction. Resume recomputes it. A mode
+switch recomputes it. Ani and Aster receive the same `annie` account fact;
+Kitty, Gem, and Hal receive the explicit warning that they are borrowing
+Casey's Unix authority.
+
+This is the same invariant as reasoning: a typed system fact must not be
+flattened into speech. A stale replay must never convince a borrowed mode that
+it owns Casey's permissions, or convince an unadmitted resident that it has
+the account it was meant to receive.
+
 ## Three properties that are load-bearing
 
 All three were learned from failures, and all look like details until they