Draw one regime across a page of memories (the overlay)

Every named memory's standing under ONE regime, in one call — what a graph overlay dims from. Returns the INAPPLICABLE half, which is the only half that can be stated completely: RR4 says an unscoped memory applies under every regime, so the applicable set is unbounded, while the inapplicable set is bounded by what somebody scoped. Dim what comes back; leave everything else alone.

Send memory_ids. With them the world is CLOSED and the answer mentions no memory you did not name. Without them the answer covers every live-scoped target in the workspace across EVERY namespace — the regime algebra holds no visibility dimension and must not learn one — so that mode is 403 for a namespace-restricted credential and additionally requires memories:read. The ids are forwarded verbatim: not de-duplicated, not sorted, not truncated, and requested echoes how many were sent so a client can prove it. Up to 15 000 per call, which is Kairos's own node ceiling, so a graph never has to page.

applicability uses the memory vocabulary, matching a recall hit's regime annotation: applicable, inapplicable_ended (the phase ENDED — it still applied while it ran), inapplicable_void (the phase was VOIDED — it never applied at any T), inapplicable_until_adjudicated, inapplicable_adjudicated, not_yet_applicable. regime_agnostic: true means no live scope link names this memory at all, so it applies here and everywhere — materially different from a memory explicitly scoped to this regime while the regime is active, which also applies.

An empty inapplicable MEANS "everything you asked about applies". It is never synthesized from a failure: an unreachable or uncompiled coordination fabric answers 502 or 501, so a dead fabric can never be rendered as a fully-applicable archive.

inheritance selects what a contested or voided ANCESTOR regime does to its descendants' scoped memories — none (default) is the kernel's own answer, conservative dims them. The response echoes the policy's cursor; do not compare two maps whose cursors differ.

Requires the coord:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).