[pareidox]

Fixes #2642.

remember and propose accepted --memory-root but returned before reading it, and MemorySystem.add() always writes to the install's fixed memory paths. So --memory-root <test dir> exited 0 and wrote into the live PRINCIPAL_MEMORY.md. The in-process adapter had the same gap through runtime.memoryRoot. This refuses both instead of ignoring them:

• Cortex.ts allowed sets: --memory-root is removed from remember and propose, so the existing parser refuses it with exit 4 ("Unknown option for remember: --memory-root"), as CortexContract.md already promises for inapplicable options ("rejected rather than ignored").
• Cortex.ts write branch: refuses runtime.memoryRoot (exit 4) unless the caller also supplies runtime.memoryAdd, the existing test seam for writes, so tests that inject a writer keep working.
• Read commands are unchanged: status, search, timeline, get, export and rebuild still accept --memory-root, and createCortexAdapter(name, { memoryRoot }).status() still works.
• Memory/CortexContract.md: says the write commands refuse a memory root, and states the memory-entry prefix rule that Cortex.ts remember returns ok:true and exit 0 for a memory entry it silently drops (bad prefix or over 256 chars) #2641 enforces.

Why refuse rather than wire it (options and verdicts are in #2642): add() resolves fixed USER-data paths behind the boundary and tier checks, and moving them per call is a much larger change. #1526 made the same call for paths.memoryDir: "a config field that LOOKS live but isn't misleads every reader."

Example

$ bun LIFEOS/TOOLS/Cortex.ts remember --memory-root /tmp/scratch --adapter claude --allow-write \
    '{"type":"memory","actor":"principal","op":"add","content":"RELATION: x"}'
# before: exit 0, "ok":true, entry written to the install's PRINCIPAL_MEMORY.md, nothing under /tmp/scratch
# after:  exit 4, "Unknown option for remember: --memory-root", nothing written anywhere

Testing

All runs use the standalone script in #2642 (Repro section): a synthetic throwaway install under $TMPDIR with fake memory, the real Cortex.ts and CortexAdapter.ts from the tree under test, deleted on exit.

• Negative control, this branch's base (upstream/main f6ab5e0, LifeOS/install/LIFEOS): remember --memory-root <other dir> exits 0 and the entry lands in the install's own memory file (0 files in the other dir); the adapter with { memoryRoot } does the same. RED: a memory root was accepted and ignored on a write.
• This branch: both exit 4 and write nothing; propose --memory-root exits 4; status --memory-root exits 0. GREEN: writes refuse a memory root (CLI and in-process).
• Callers: no shipped code passes --memory-root or runtime.memoryRoot to a write (grep over LifeOS/ at f6ab5e0: the only TypeScript users of --memory-root/memoryRoot are the read paths in Cortex.ts, CortexBenchmark.ts and CortexHealth.ts, and nothing outside CortexAdapter.ts constructs an adapter).
• Merged with Cortex.ts remember returns ok:true and exit 0 for a memory entry it silently drops (bad prefix or over 256 chars) #2641's branch: no conflicts, and both repro scripts are green on the combined tree.
• Run on macOS 27.2 (arm64), bun 1.3.14. Not run on Linux or Windows; the change is platform-neutral TypeScript.
• Not run: the full installer on a fresh machine. The repro's synthetic install exercises the changed path end to end against this branch's files.

Notes

• Related: Cortex.ts remember returns ok:true and exit 0 for a memory entry it silently drops (bad prefix or over 256 chars) #2641 (single memory add refused when the writer would drop it). This PR's CortexContract.md change documents that rule too.