One process writes to a store. Another reads it. Something persists across time and is consulted later by someone who did not write it.
That is memory. Not memory-like, not a memory analogue. The definition is satisfied. Whether the system has a component called "memory" is a naming question, and the naming question was never load-bearing.
Nobody chose it, either. The surface is not a store someone selected to serve this purpose — it is whatever happened to be on the other end of a grant. A team needed an agent to read a directory, so it reads a directory, and the directory is now where the institution's working state lives. Had the grant landed somewhere else, somewhere else would be the memory. It is not that the wrong surface was picked. No surface was picked.
Three things follow, and they follow structurally rather than eventually.
The surface is memory as soon as the writes persist and are read. This does not require a database. A directory of files is memory. A ticket queue is memory. A log that anything downstream parses is memory. The retention was incidental, the reads were reasonable, and the memory is real.
The surface becomes coordination as soon as more than one party writes. What agent A leaves behind conditions what agent B does, and B's output conditions A's next read. Neither has to intend this. Coordination is not something the parties decide to do; it is what a shared memory makes available whether or not they use it deliberately. Well-behaved systems coordinate through shared state constantly. That is how they get work done, which is exactly why it does not look like anything.
The surface becomes governance as soon as what it holds shapes what the parties are permitted to conclude. A store that contains a prior determination — this vendor was approved, this classification was applied, this threshold was met — is exercising authority over the next decision. It has no policy version, no authorizing identity, and no decision-time. It is not a governance system. It is governing.
That is the step worth sitting with. The other two are uncomfortable. This one is a category problem: something is doing governance work that was never constituted as governance, and therefore has none of the properties governance is required to have.
SDS.DX.005 is a different problem, and the difference is the point. That diagnosis concerns a channel embedded in generated output — controllable by the model, convertible to purposes other than the one it appears to serve, and close to undetectable from the semantic layer. Its defining property is that you cannot see it. The surfaces this note describes have the opposite property. They are on the permission list. They were reviewed. They are in the architecture diagram. Every grant that produced them is individually defensible, and no single grant is the mistake.
Covert means concealed. Latent means present and unaccounted for. Concealment is a detection problem, and detection problems attract effort. Latency attracts none, because nothing appears to be wrong.
What follows from this is open. What can be said now is that the accounting is wrong in two specific ways. Permissions are reviewed one grant at a time, and every property described here exists only between grants. And no review asks whether a resource has become the institution's memory, because that question presumes someone decided to make it one.
Nobody decided any of this. It is deciding anyway.
Reference invariants: ZTG-3 (Governed Effect Surface), SDS.DX.005 (Model-Adjacent Covert Channel), SDS.DX.009 (Multi-Agent Authority Laundering).