@equationalapplications/core-llm-wiki 5.1.1 → 5.2.1

package/dist/index.js

@@ -45,6 +45,24 @@ async function setupDatabase(db, prefix) {
     CREATE INDEX IF NOT EXISTS ${prefix}entries_source_hash_idx ON ${prefix}entries(entity_id, source_hash) WHERE source_hash IS NOT NULL;
     CREATE INDEX IF NOT EXISTS ${prefix}entries_updated_idx ON ${prefix}entries(updated_at DESC);
 
+    -- source_ref_index: per-(entity, source_hash) record of the canonical sourceRef
+    -- currently holding that hash. The partial UNIQUE index on (entity_id, source_hash)
+    -- WHERE deleted_at IS NULL enforces the sourceRef-level TOCTOU-race invariant;
+    -- entries-level uniqueness cannot express it because a single ingestDocument call
+    -- writes N facts that all share (entity_id, source_ref, source_hash). See
+    -- docs/superpowers/specs/2026-08-07-dependabot-concurrency-release-hygiene-design.md \xA7B1.
+    CREATE TABLE IF NOT EXISTS ${prefix}source_ref_index (
+      id TEXT PRIMARY KEY,
+      entity_id TEXT NOT NULL,
+      source_hash TEXT NOT NULL,
+      source_ref TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      deleted_at INTEGER
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS ${prefix}idx_source_ref_hash
+      ON ${prefix}source_ref_index (entity_id, source_hash)
+      WHERE deleted_at IS NULL;
+
     CREATE TABLE IF NOT EXISTS ${prefix}tasks (
       id TEXT PRIMARY KEY,
       entity_id TEXT NOT NULL,
@@ -149,6 +167,12 @@ var SQLITE_RESULT_CODE_NAMES = {
   26: "SQLITE_NOTADB",
   27: "SQLITE_NOTICE",
   28: "SQLITE_WARNING",
+  // Extended result codes (https://sqlite.org/rescode.html#extended_result_code_list).
+  // 2067 = SQLITE_CONSTRAINT_UNIQUE — raised when a UNIQUE index/PRIMARY KEY
+  // rejects an INSERT/UPDATE; expo-sqlite reports this as a numeric "Error code N:"
+  // prefix and we normalize it back to the symbolic name so callers can branch on
+  // the same string the rest of the ecosystem uses.
+  2067: "SQLITE_CONSTRAINT_UNIQUE",
   100: "SQLITE_ROW",
   101: "SQLITE_DONE"
 };
@@ -175,6 +199,15 @@ var WikiBusyError = class extends Error {
     this.entityId = entityId;
   }
 };
+var WikiDuplicateHashError = class extends Error {
+  constructor(params) {
+    super(`Duplicate source hash for entity ${params.entityId}; another ref already holds this content`);
+    this.name = "WikiDuplicateHashError";
+    this.canonical = params.canonical;
+    this.sourceHash = params.sourceHash;
+    this.entityId = params.entityId;
+  }
+};
 var WikiTransactionError = class extends Error {
   constructor(message, options) {
     super(message, options);
@@ -368,6 +401,61 @@ var MIGRATIONS = [
         );
       }
     }
+  },
+  {
+    version: 9,
+    description: "add_source_ref_index",
+    run: async (db, prefix) => {
+      const duplicates = await db.getAllAsync(
+        `SELECT entity_id, source_hash, COUNT(DISTINCT source_ref) AS n_refs
+         FROM ${prefix}entries
+         WHERE deleted_at IS NULL AND source_hash IS NOT NULL
+         GROUP BY entity_id, source_hash
+         HAVING COUNT(DISTINCT source_ref) > 1`
+      );
+      if (duplicates.length > 0) {
+        const sample = duplicates.slice(0, 5).map((d) => `(entity_id=${d.entity_id}, source_hash=${d.source_hash.slice(0, 12)}\u2026, n_refs=${d.n_refs})`).join(", ");
+        throw new Error(
+          `Migration v9 (add_source_ref_index) failed: existing live rows have multiple sourceRefs sharing a hash. Found ${duplicates.length} duplicate (entity_id, source_hash) groups. First ${Math.min(5, duplicates.length)}: ${sample}. Resolve each by calling forget({ sourceRef: <loser> }) for the offending sourceRef, then re-run setup.`
+        );
+      }
+      await db.execAsync(
+        `CREATE TABLE IF NOT EXISTS ${prefix}source_ref_index (
+          id TEXT PRIMARY KEY,
+          entity_id TEXT NOT NULL,
+          source_hash TEXT NOT NULL,
+          source_ref TEXT NOT NULL,
+          created_at INTEGER NOT NULL,
+          deleted_at INTEGER
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS ${prefix}idx_source_ref_hash
+          ON ${prefix}source_ref_index (entity_id, source_hash)
+          WHERE deleted_at IS NULL;`
+      );
+      await db.execAsync(
+        `INSERT OR IGNORE INTO ${prefix}source_ref_index (id, entity_id, source_hash, source_ref, created_at, deleted_at)
+         SELECT
+           'sri:' || entity_id || ':' || source_hash,
+           entity_id,
+           source_hash,
+           source_ref,
+           updated_at,
+           NULL
+         FROM (
+           SELECT
+             entity_id, source_hash, source_ref, updated_at,
+             ROW_NUMBER() OVER (
+               PARTITION BY entity_id, source_hash
+               ORDER BY updated_at ASC, id ASC
+             ) AS rn
+           FROM ${prefix}entries
+           WHERE deleted_at IS NULL
+             AND source_hash IS NOT NULL
+             AND source_ref IS NOT NULL
+         ) ranked
+         WHERE rn = 1;`
+      );
+    }
   }
 ];
 for (let i = 1; i < MIGRATIONS.length; i++) {
@@ -1080,12 +1168,154 @@ var EntryRepository = class extends BaseRepository {
     const row = await executor.getFirstAsync(
       `SELECT source_hash FROM ${this.prefix}entries
        WHERE entity_id = ? AND source_ref = ? AND deleted_at IS NULL
-       ORDER BY updated_at DESC
+       ORDER BY updated_at DESC, id ASC
        LIMIT 1`,
       [entityId, sourceRef]
     );
     return row?.source_hash ?? null;
   }
+  /**
+   * Batch version of {@link findLatestSourceHash}. Returns a Map covering every
+   * requested ref, where the value is the source_hash from the row with the
+   * most-recently-updated live fact for that ref, or null when no live row exists.
+   *
+   * The SQL uses ROW_NUMBER() OVER (PARTITION BY source_ref ORDER BY updated_at
+   * DESC, id ASC) — NOT MAX(source_hash). Aggregation with MAX(source_hash) is
+   * wrong because MAX computes independently across grouped rows; the hash must
+   * come from the exact row that wins MAX(updated_at). The `id ASC` tie-break
+   * keeps selection deterministic when two live rows share `updated_at`.
+   *
+   * Source refs are de-duplicated and processed in chunks so the per-query bind
+   * parameter count stays under SQLite's `SQLITE_MAX_VARIABLE_NUMBER` (default
+   * 999, leaving one slot for `entity_id`).
+   *
+   * Empty input is a synchronous early return with zero SQL calls.
+   */
+  async findLatestSourceHashes(entityId, sourceRefs, tx) {
+    const out = /* @__PURE__ */ new Map();
+    if (sourceRefs.length === 0) return out;
+    const dedupedRefs = Array.from(new Set(sourceRefs));
+    for (const ref of dedupedRefs) {
+      out.set(ref, null);
+    }
+    const executor = this.getExecutor(tx);
+    const chunkLimit = Math.max(1, this.chunkSize - 1);
+    for (let i = 0; i < dedupedRefs.length; i += chunkLimit) {
+      const chunk = dedupedRefs.slice(i, i + chunkLimit);
+      const placeholders = chunk.map(() => "?").join(",");
+      const rows = await executor.getAllAsync(
+        `WITH ranked AS (
+           SELECT source_ref, source_hash,
+                  ROW_NUMBER() OVER (
+                    PARTITION BY source_ref
+                    ORDER BY updated_at DESC, id ASC
+                  ) as rn
+           FROM ${this.prefix}entries
+           WHERE entity_id = ? AND source_ref IN (${placeholders}) AND deleted_at IS NULL
+         )
+         SELECT source_ref, source_hash
+         FROM ranked
+         WHERE rn = 1`,
+        [entityId, ...chunk]
+      );
+      for (const r of rows) {
+        out.set(r.source_ref, r.source_hash);
+      }
+    }
+    return out;
+  }
+  /**
+   * Return the live source_refs for an entity that hold the given source_hash.
+   * Used by the ingestDocument duplicate-hash guard and by hosts auditing
+   * duplicate-content collisions. Sorted `COLLATE BINARY` so the canonical
+   * ref (the code-unit-minimum of the set) is stable across deploys.
+   */
+  async findSourceRefsByHash(entityId, sourceHash, tx) {
+    const executor = this.getExecutor(tx);
+    const rows = await executor.getAllAsync(
+      `SELECT source_ref FROM ${this.prefix}entries
+       WHERE entity_id = ? AND source_hash = ? AND deleted_at IS NULL
+         AND source_ref IS NOT NULL
+       GROUP BY source_ref
+       ORDER BY source_ref COLLATE BINARY`,
+      [entityId, sourceHash]
+    );
+    return rows.map((r) => r.source_ref);
+  }
+  /**
+   * Per-sourceRef rollup for an entity: one row per live source_ref, with the
+   * most-recently-updated live hash (NOT the lexically-max hash) and a live
+   * fact count.
+   *
+   * The hash comes from the same row that wins ROW_NUMBER() over updated_at
+   * DESC, so a ref with multiple live hashes (e.g. from import) reports the
+   * latest one — matching single-doc `findLatestSourceHash` semantics.
+   *
+   * Sort is COLLATE BINARY: locale-dependent ordering re-mints identity on
+   * every deploy, which is the bug this whole section exists to prevent.
+   */
+  async listSourceRefs(entityId, tx) {
+    const executor = this.getExecutor(tx);
+    const rows = await executor.getAllAsync(
+      `WITH ranked AS (
+         SELECT source_ref, source_hash, updated_at,
+                ROW_NUMBER() OVER (
+                  PARTITION BY source_ref
+                  ORDER BY updated_at DESC, id ASC
+                ) AS rn,
+                COUNT(*) OVER (PARTITION BY source_ref) AS fact_count
+         FROM ${this.prefix}entries
+         WHERE entity_id = ? AND deleted_at IS NULL AND source_ref IS NOT NULL
+       )
+       SELECT source_ref,
+              source_hash       AS source_hash,
+              fact_count        AS fact_count,
+              updated_at        AS last_ingested_at
+       FROM ranked
+       WHERE rn = 1
+       ORDER BY source_ref COLLATE BINARY`,
+      [entityId]
+    );
+    return rows.map((r) => ({
+      sourceRef: r.source_ref,
+      sourceHash: r.source_hash,
+      factCount: Number(r.fact_count),
+      lastIngestedAt: Number(r.last_ingested_at)
+    }));
+  }
+  /**
+   * Count live entries for an entity across all source_refs/source_hashes.
+   * Used by forget({ dryRun, clearAll: true }).
+   */
+  async countLiveByEntityId(entityId, tx) {
+    const executor = this.getExecutor(tx);
+    const row = await executor.getFirstAsync(
+      `SELECT COUNT(*) AS cnt FROM ${this.prefix}entries
+     WHERE entity_id = ? AND deleted_at IS NULL`,
+      [entityId]
+    );
+    return row?.cnt ?? 0;
+  }
+  /**
+   * Count live entries matching a source filter (either or both may be null).
+   * Used by forget({ dryRun: true }) with sourceRef/sourceHash.
+   */
+  async countLiveBySource(entityId, sourceRef, sourceHash, tx) {
+    const executor = this.getExecutor(tx);
+    let q = `SELECT COUNT(*) AS cnt FROM ${this.prefix}entries
+           WHERE entity_id = ? AND deleted_at IS NULL`;
+    const args = [entityId];
+    if (sourceRef !== null) {
+      q += ` AND source_ref = ?`;
+      args.push(sourceRef);
+    }
+    if (sourceHash !== null) {
+      q += ` AND source_hash = ?`;
+      args.push(sourceHash);
+    }
+    const row = await executor.getFirstAsync(q, args);
+    return row?.cnt ?? 0;
+  }
   async findMetadataByIds(ids, tx) {
     if (ids.length === 0) return [];
     const executor = this.getExecutor(tx);
@@ -1381,6 +1611,57 @@ var OutboxRepository = class extends BaseRepository {
   }
 };
 
+// src/repositories/SourceRefIndexRepository.ts
+var SourceRefIndexRepository = class extends BaseRepository {
+  /**
+   * Idempotent insert: the partial UNIQUE index catches concurrent inserts for
+   * the same (entity_id, source_hash). The caller (IngestionService) catches
+   * the resulting SQLITE_CONSTRAINT_UNIQUE and translates it to the per-mode
+   * duplicate-hash outcome. Runtime IDs use the `sri_` prefix to avoid
+   * collision with the deterministic `sri:<entity>:<hash>` IDs used by the v9
+   * backfill (the colon separator keeps the two ID spaces disjoint).
+   */
+  async upsert(entityId, sourceHash, sourceRef, tx) {
+    const executor = this.getExecutor(tx);
+    await executor.runAsync(
+      `INSERT INTO ${this.prefix}source_ref_index (id, entity_id, source_hash, source_ref, created_at, deleted_at)
+       VALUES (?, ?, ?, ?, ?, NULL)`,
+      [generateId("sri_"), entityId, sourceHash, sourceRef, Date.now()]
+    );
+  }
+  /**
+   * Idempotent soft-delete of the live row for (entity_id, source_ref).
+   * Called at the start of every ingestDocument to remove the prior run's
+   * index row, so the new upsert doesn't collide with itself. No-op when the
+   * row is already soft-deleted or never existed.
+   */
+  async softDeleteByEntityAndSourceRef(entityId, sourceRef, tx) {
+    const executor = this.getExecutor(tx);
+    const now = Date.now();
+    const result = await executor.runAsync(
+      `UPDATE ${this.prefix}source_ref_index
+       SET deleted_at = ?, created_at = ?
+       WHERE entity_id = ? AND source_ref = ? AND deleted_at IS NULL`,
+      [now, now, entityId, sourceRef]
+    );
+    return result.changes;
+  }
+  /**
+   * Returns the live sourceRef holding the given hash, or null when no live
+   * row exists. Used by the IngestionService pre-check (line 82) and the
+   * catch-and-translate canonical lookup (line 212).
+   */
+  async findActiveByEntityAndHash(entityId, sourceHash, tx) {
+    const executor = this.getExecutor(tx);
+    const row = await executor.getFirstAsync(
+      `SELECT source_ref FROM ${this.prefix}source_ref_index
+       WHERE entity_id = ? AND source_hash = ? AND deleted_at IS NULL`,
+      [entityId, sourceHash]
+    );
+    return row?.source_ref ?? null;
+  }
+};
+
 // src/repositories/TaskRepository.ts
 function mapRowToTask(row) {
   return {
@@ -1637,6 +1918,18 @@ var TaskRepository = class extends BaseRepository {
     }
     return result.changes;
   }
+  /**
+   * Count live tasks for an entity. Used by forget({ dryRun, clearAll: true }).
+   */
+  async countLiveByEntityId(entityId, tx) {
+    const executor = this.getExecutor(tx);
+    const row = await executor.getFirstAsync(
+      `SELECT COUNT(*) AS cnt FROM ${this.prefix}tasks
+     WHERE entity_id = ? AND deleted_at IS NULL`,
+      [entityId]
+    );
+    return row?.cnt ?? 0;
+  }
 };
 
 // src/repositories/EventRepository.ts
@@ -2412,6 +2705,19 @@ var JobManager = class {
     this.prefix = prefix;
     this.activeMaintenanceJobs = /* @__PURE__ */ new Set();
     this.activeIngestJobs = /* @__PURE__ */ new Map();
+    /**
+     * Per-(entityId, sourceHash) promise-chain lock. Serializes ingest races
+     * at the application level (the v9 partial UNIQUE index enforces it at
+     * the DB level as defense-in-depth). Two callers holding the same hash
+     * see FIFO order; different hashes never block one another.
+     *
+     * Keyed `${entityId}\0${sourceHash}` so distinct (entityId, sourceHash)
+     * pairs can never share a lock. A raw concatenation would let
+     * ("ab", "c…") collide with ("a", "bc…"); the NUL separator makes that
+     * impossible because neither component can contain NUL (entityIds are
+     * user-supplied identifiers; sourceHashes are hex digests).
+     */
+    this.hashLocks = /* @__PURE__ */ new Map();
     this.statusSubscribers = /* @__PURE__ */ new Map();
     /**
      * Lookup table for acquireLock/releaseLock's dynamic-dispatch branch.
@@ -2429,6 +2735,51 @@ var JobManager = class {
       ontologyBackfill: (id) => this._ontologyBackfillKey(id)
     };
   }
+  _hashLockKey(entityId, sourceHash) {
+    return `${entityId}\0${sourceHash}`;
+  }
+  /**
+   * Acquire a promise-chain lock scoped to one `(entityId, sourceHash)` pair.
+   * Returns a zero-argument release closure that removes the current tail
+   * from the chain. Releasing is idempotent so a holder that double-fires
+   * (e.g. on a finally that races an explicit release) cannot unblock
+   * the next holder prematurely.
+   *
+   * Documented ordering: ingest acquires the hash lock FIRST, then the
+   * synchronous sourceRef ingest lock, and the release closure unwinds in
+   * the opposite order (sourceRef first, hash second). Hash-then-sourceRef
+   * is required because the v9 partial UNIQUE index conflicts on the
+   * (entity_id, source_hash) pair regardless of source_ref, so two callers
+   * with DIFFERENT source_refs racing the same hash are the exact case the
+   * TOCTOU race fix needs to serialize.
+   *
+   * Mechanics: each holder owns a private `released` promise that resolves
+   * only when THIS holder calls release(). The map stores the holder's
+   * `released` promise as the "tail" — the NEXT caller awaits that tail
+   * via `previous = this.hashLocks.get(key)`. The current caller gets
+   * their unique release function once `previous` (the prior holder's
+   * release signal) settles, so each holder is guaranteed a UNIQUE release
+   * closure bound to their own `released` promise.
+   */
+  acquireHashLock(entityId, sourceHash) {
+    const key = this._hashLockKey(entityId, sourceHash);
+    const previous = this.hashLocks.get(key) ?? Promise.resolve();
+    let resolveReleased;
+    const released = new Promise((resolve) => {
+      resolveReleased = resolve;
+    });
+    let fired = false;
+    const release = () => {
+      if (fired) return;
+      fired = true;
+      if (this.hashLocks.get(key) === released) {
+        this.hashLocks.delete(key);
+      }
+      resolveReleased();
+    };
+    this.hashLocks.set(key, released);
+    return previous.then(() => release);
+  }
   _pruneKey(entityId) {
     return `${this.prefix}:${entityId}:prune`;
   }
@@ -2614,6 +2965,19 @@ var JobManager = class {
         return this.activeMaintenanceJobs.has(this.lockKeyFns[operation](entityId)) || this.activeMaintenanceJobs.has(this._pruneKey(entityId)) || this._isReembedActive(entityId) || this._isImportActiveFor(entityId) || this._isForgetActiveFor(entityId);
       case "prune":
         return this.activeMaintenanceJobs.has(this._pruneKey(entityId)) || this.activeMaintenanceJobs.has(this._librarianKey(entityId)) || this.activeMaintenanceJobs.has(this._healKey(entityId)) || this.activeMaintenanceJobs.has(this._ontologyBackfillKey(entityId)) || this._isReembedActive(entityId) || this._isIngestActiveFor(entityId) || this._isImportActiveFor(entityId) || this._isForgetActiveFor(entityId);
+      case "reembed":
+        return this.activeMaintenanceJobs.has(this._reembedKey(entityId)) || this.activeMaintenanceJobs.has(this._globalReembedKey()) || this.activeMaintenanceJobs.has(this._pruneKey(entityId)) || this.activeMaintenanceJobs.has(this._librarianKey(entityId)) || this.activeMaintenanceJobs.has(this._healKey(entityId)) || this.activeMaintenanceJobs.has(this._ontologyBackfillKey(entityId)) || this._isIngestActiveFor(entityId) || this._isImportActiveFor(entityId) || this._isForgetActiveFor(entityId);
+      case "global_reembed":
+        return this.activeMaintenanceJobs.has(this._globalReembedKey()) || this._isAnyMaintenanceActiveWithSuffix(":reembed") || this._isAnyMaintenanceActiveWithSuffix(":prune") || this._isAnyMaintenanceActiveWithSuffix(":librarian") || this._isAnyMaintenanceActiveWithSuffix(":heal") || this._isAnyMaintenanceActiveWithSuffix(":ontologyBackfill") || this.activeIngestJobs.size > 0 || this._isAnyMaintenanceActiveWithSuffix(":import") || this._isAnyMaintenanceActiveWithSuffix(":forget");
+      case "import":
+      case "forget": {
+        const selfKey = operation === "import" ? this._importKey(entityId) : this._forgetKey(entityId);
+        return this.activeMaintenanceJobs.has(selfKey) || this.activeMaintenanceJobs.has(this._librarianKey(entityId)) || this.activeMaintenanceJobs.has(this._healKey(entityId)) || this.activeMaintenanceJobs.has(this._ontologyBackfillKey(entityId)) || this.activeMaintenanceJobs.has(this._pruneKey(entityId)) || this._isReembedActive(entityId) || this._isIngestActiveFor(entityId) || this._isImportActiveFor(entityId) || this._isForgetActiveFor(entityId);
+      }
+      case "global_import":
+        return this.activeMaintenanceJobs.has(this._globalImportKey());
+      case "ingest":
+        return this._hasIngestJob(entityId) || this.activeMaintenanceJobs.has(this._pruneKey(entityId)) || this._isReembedActive(entityId) || this._isImportActiveFor(entityId) || this._isForgetActiveFor(entityId);
       default:
         return false;
     }
@@ -2629,6 +2993,38 @@ var JobManager = class {
     this._notifyStatusSubscribers(entityId);
     return true;
   }
+  /**
+   * Centralized ingest lock acquisition. Acquires the hash lock FIRST
+   * (FIFO across callers racing the same hash), then the synchronous
+   * sourceRef ingest lock (rejects cross-entity conflicts and busy
+   * operations). Returns a single zero-argument release closure that
+   * unwinds in the opposite order — sourceRef first, hash second — so
+   * the sourceRef lock is freed the instant its work is done and only
+   * the hash lock keeps serializing the duplicate-content race window.
+   *
+   * On a sourceRef conflict (WikiBusyError thrown synchronously by the
+   * underlying acquireLock) the hash lock is released BEFORE the error
+   * propagates, so the next caller in the hash chain is not held up by
+   * a request that never reached the DB.
+   */
+  async acquireIngestLocks(entityId, sourceRef, sourceHash) {
+    const releaseHash = await this.acquireHashLock(entityId, sourceHash);
+    let sourceLockAcquired = false;
+    try {
+      this.acquireLock("ingest", entityId, sourceRef);
+      sourceLockAcquired = true;
+    } catch (err) {
+      releaseHash();
+      throw err;
+    }
+    return () => {
+      try {
+        if (sourceLockAcquired) this.releaseLock("ingest", entityId, sourceRef);
+      } finally {
+        releaseHash();
+      }
+    };
+  }
   /**
    * Validates then acquires global + per-entity import locks atomically.
    * Validates all entities before acquiring any lock (same as current importDump semantics).
@@ -3069,18 +3465,19 @@ var DEFAULT_CHUNK_OVERLAP = 400;
 
 // src/services/IngestionService.ts
 var IngestionService = class {
-  constructor(db, prefix, options, entryRepo, searchService, jobManager, embeddingService, promptService, ontologyService) {
+  constructor(db, prefix, options, entryRepo, sourceRefIndexRepo, searchService, jobManager, embeddingService, promptService, ontologyService) {
     this.db = db;
     this.prefix = prefix;
     this.options = options;
     this.entryRepo = entryRepo;
+    this.sourceRefIndexRepo = sourceRefIndexRepo;
     this.searchService = searchService;
     this.jobManager = jobManager;
     this.embeddingService = embeddingService;
     this.ontologyService = ontologyService;
     this.promptService = promptService ?? new PromptService(this.options.config?.prompts);
   }
-  async ingestDocument(entityId, params) {
+  async ingestDocument(entityId, params, opts) {
     const sourceRef = normalizeSourceRef(params.sourceRef);
     if (!sourceRef) throw new Error("Invalid sourceRef");
     const sourceHash = normalizeSourceHash(params.sourceHash);
@@ -3096,8 +3493,18 @@ var IngestionService = class {
     if (typeof params.documentChunk !== "string") {
       throw new Error(`documentChunk must be a string, received ${typeof params.documentChunk}`);
     }
-    this.jobManager.acquireLock("ingest", entityId, sourceRef);
+    const releaseIngestLocks = await this.jobManager.acquireIngestLocks(entityId, sourceRef, sourceHash);
     try {
+      const onDuplicateHash = opts?.onDuplicateHash ?? "ingest";
+      if (onDuplicateHash !== "ingest") {
+        const canonical = await this.sourceRefIndexRepo.findActiveByEntityAndHash(entityId, sourceHash);
+        if (canonical !== null && canonical !== sourceRef) {
+          if (onDuplicateHash === "throw") {
+            throw new WikiDuplicateHashError({ canonical, sourceHash, entityId });
+          }
+          return { truncated: false, chunks: 0, duplicateOf: canonical };
+        }
+      }
       const { chunks, truncated } = chunkText(params.documentChunk, maxChunkLength, chunkOverlap);
       if (chunks.length === 0) return { truncated: false, chunks: 0 };
       const chunkResults = await withConcurrency(
@@ -3133,68 +3540,81 @@ var IngestionService = class {
       const now = Date.now();
       const insertedFacts = [];
       const deletedSourceFactIds = [];
-      await this.db.withTransactionAsync(async (tx) => {
-        deletedSourceFactIds.push(...await this.entryRepo.findIdsBySource(entityId, sourceRef, null, tx, false));
-        await this.entryRepo.softDeleteBySource(entityId, tx, sourceRef, null);
-        const titleIndex = /* @__PURE__ */ new Map();
-        const pendingEdges = [];
-        const existingFacts = await this.entryRepo.findRecentByEntityId(entityId, 500, tx);
-        for (const existing of existingFacts) {
-          titleIndex.set(normalizeTitleKey(existing.title), {
-            id: existing.id,
-            okf_type: existing.okf_type ?? null
-          });
-        }
-        let ontologyState = await this.ontologyService?.getEffectiveState(entityId, tx) ?? { mode: "off", manifest: { node_types: [], edge_types: [] } };
-        let { mode, manifest } = ontologyState;
-        for (const { facts, ontology_updates } of orderedChunkFacts) {
-          if (mode === "emergent" && ontology_updates && this.ontologyService) {
-            manifest = await this.ontologyService.mergeEmergentUpdates(entityId, ontology_updates, tx);
-            ontologyState = await this.ontologyService.getEffectiveState(entityId, tx);
-            mode = ontologyState.mode;
+      try {
+        await this.db.withTransactionAsync(async (tx) => {
+          deletedSourceFactIds.push(...await this.entryRepo.findIdsBySource(entityId, sourceRef, null, tx, false));
+          await this.entryRepo.softDeleteBySource(entityId, tx, sourceRef, null);
+          await this.sourceRefIndexRepo.softDeleteByEntityAndSourceRef(entityId, sourceRef, tx);
+          await this.sourceRefIndexRepo.upsert(entityId, sourceHash, sourceRef, tx);
+          const titleIndex = /* @__PURE__ */ new Map();
+          const pendingEdges = [];
+          const existingFacts = await this.entryRepo.findRecentByEntityId(entityId, 500, tx);
+          for (const existing of existingFacts) {
+            titleIndex.set(normalizeTitleKey(existing.title), {
+              id: existing.id,
+              okf_type: existing.okf_type ?? null
+            });
           }
-          for (const fact of facts) {
-            const ontologyFact = fact;
-            const normalized = this.ontologyService?.validateAndNormalizeFact(ontologyFact, manifest) ?? { okf_type: null, edges: [] };
-            const id = generateId("fact_");
-            const wikiFact = {
-              id,
-              entity_id: entityId,
-              title: fact.title,
-              body: fact.body,
-              tags: fact.tags,
-              confidence: fact.confidence,
-              source_type: "immutable_document",
-              source_hash: sourceHash,
-              source_ref: sourceRef,
-              created_at: now,
-              updated_at: now,
-              last_accessed_at: null,
-              access_count: 0,
-              deleted_at: null,
-              okf_type: normalized.okf_type
-            };
-            await this.entryRepo.upsert(wikiFact, tx);
-            insertedFacts.push({ id, entity_id: entityId, title: fact.title, body: fact.body, tags: JSON.stringify(fact.tags) });
-            titleIndex.set(normalizeTitleKey(fact.title), { id, okf_type: normalized.okf_type });
-            if (normalized.edges.length > 0) {
-              pendingEdges.push({ sourceId: id, sourceType: normalized.okf_type, edges: normalized.edges });
+          let ontologyState = await this.ontologyService?.getEffectiveState(entityId, tx) ?? { mode: "off", manifest: { node_types: [], edge_types: [] } };
+          let { mode, manifest } = ontologyState;
+          for (const { facts, ontology_updates } of orderedChunkFacts) {
+            if (mode === "emergent" && ontology_updates && this.ontologyService) {
+              manifest = await this.ontologyService.mergeEmergentUpdates(entityId, ontology_updates, tx);
+              ontologyState = await this.ontologyService.getEffectiveState(entityId, tx);
+              mode = ontologyState.mode;
+            }
+            for (const fact of facts) {
+              const ontologyFact = fact;
+              const normalized = this.ontologyService?.validateAndNormalizeFact(ontologyFact, manifest) ?? { okf_type: null, edges: [] };
+              const id = generateId("fact_");
+              const wikiFact = {
+                id,
+                entity_id: entityId,
+                title: fact.title,
+                body: fact.body,
+                tags: fact.tags,
+                confidence: fact.confidence,
+                source_type: "immutable_document",
+                source_hash: sourceHash,
+                source_ref: sourceRef,
+                created_at: now,
+                updated_at: now,
+                last_accessed_at: null,
+                access_count: 0,
+                deleted_at: null,
+                okf_type: normalized.okf_type
+              };
+              await this.entryRepo.upsert(wikiFact, tx);
+              insertedFacts.push({ id, entity_id: entityId, title: fact.title, body: fact.body, tags: JSON.stringify(fact.tags) });
+              titleIndex.set(normalizeTitleKey(fact.title), { id, okf_type: normalized.okf_type });
+              if (normalized.edges.length > 0) {
+                pendingEdges.push({ sourceId: id, sourceType: normalized.okf_type, edges: normalized.edges });
+              }
             }
           }
+          for (const item of pendingEdges) {
+            await this.ontologyService?.resolveAndPersistEdges(
+              entityId,
+              item.sourceId,
+              item.sourceType,
+              item.edges ?? [],
+              manifest,
+              titleIndex,
+              tx,
+              now
+            );
+          }
+        });
+      } catch (err) {
+        const sqliteCode = err instanceof WikiTransactionError ? err.sqliteErrorCode : extractSqliteCode(err);
+        if (sqliteCode !== "SQLITE_CONSTRAINT_UNIQUE") throw err;
+        const canonical = await this.sourceRefIndexRepo.findActiveByEntityAndHash(entityId, sourceHash);
+        if (canonical === null) throw err;
+        if (onDuplicateHash === "throw" || onDuplicateHash === "ingest") {
+          throw new WikiDuplicateHashError({ canonical, sourceHash, entityId });
         }
-        for (const item of pendingEdges) {
-          await this.ontologyService?.resolveAndPersistEdges(
-            entityId,
-            item.sourceId,
-            item.sourceType,
-            item.edges ?? [],
-            manifest,
-            titleIndex,
-            tx,
-            now
-          );
-        }
-      });
+        return { truncated: false, chunks: 0, duplicateOf: canonical };
+      }
       await this.searchService.sync(entityId);
       const uniqueDeletedSourceFactIds = Array.from(new Set(deletedSourceFactIds));
       for (const factId of uniqueDeletedSourceFactIds) {
@@ -3210,7 +3630,7 @@ var IngestionService = class {
       this.searchService.evictCache(entityId);
       return { truncated, chunks: chunks.length };
     } finally {
-      this.jobManager.releaseLock("ingest", entityId, sourceRef);
+      releaseIngestLocks();
     }
   }
 };
@@ -3334,11 +3754,12 @@ var HEAL_MAX_PROMPT_CHARS = 4e4;
 var HEAL_BATCH_SIZE = 25;
 var HEAL_RECHECK_MS = 7 * 24 * 60 * 60 * 1e3;
 var MaintenanceService = class {
-  constructor(db, prefix, options, entryRepo, taskRepo, eventRepo, metadataRepo, searchService, jobManager, embeddingService, promptService, ontologyService) {
+  constructor(db, prefix, options, entryRepo, sourceRefIndexRepo, taskRepo, eventRepo, metadataRepo, searchService, jobManager, embeddingService, promptService, ontologyService) {
     this.db = db;
     this.prefix = prefix;
     this.options = options;
     this.entryRepo = entryRepo;
+    this.sourceRefIndexRepo = sourceRefIndexRepo;
     this.taskRepo = taskRepo;
     this.eventRepo = eventRepo;
     this.metadataRepo = metadataRepo;
@@ -3497,10 +3918,13 @@ var MaintenanceService = class {
       this.jobManager.releaseLock(op, entityId ?? "*");
     }
   }
-  async forget(entityId, params) {
+  async forget(entityId, params, opts) {
     if (params.clearAll && (params.entryId !== void 0 || params.taskId !== void 0 || params.sourceRef !== void 0 || params.sourceHash !== void 0)) {
       throw new Error("forget() clearAll is mutually exclusive with entryId, taskId, sourceRef, and sourceHash");
     }
+    if (opts?.dryRun === true) {
+      return this.forgetDryRun(entityId, params);
+    }
     this.jobManager.acquireLock("forget", entityId);
     try {
       const now = Date.now();
@@ -3534,10 +3958,12 @@ var MaintenanceService = class {
           const entryPromise = params.entryId ? this.entryRepo.softDelete(params.entryId, entityId, tx).then((r) => r.changes > 0) : null;
           const taskDeletedPromise = params.taskId ? this.taskRepo.softDeleteById(params.taskId, entityId, tx).then((r) => r.changes > 0) : null;
           const refPromise = sourceRef || sourceHash ? this.entryRepo.softDeleteBySource(entityId, tx, sourceRef, sourceHash) : null;
+          const sourceRefIndexPromise = sourceRef ? this.sourceRefIndexRepo.softDeleteByEntityAndSourceRef(entityId, sourceRef, tx).then(() => void 0) : null;
           const [entryResult, taskResult, refResult] = await Promise.all([
             entryPromise ?? Promise.resolve(false),
             taskDeletedPromise ?? Promise.resolve(false),
-            refPromise ?? Promise.resolve(0)
+            refPromise ?? Promise.resolve(0),
+            sourceRefIndexPromise ?? Promise.resolve(void 0)
           ]);
           if (entryResult) deletedEntries++;
           if (taskResult) deletedTasks++;
@@ -3561,11 +3987,42 @@ var MaintenanceService = class {
           throw new Error(`forget(${entityId}/${factId}) failed: ANN cleanup hook rejected`, { cause: this._sanitizeRankerError(hookErr) });
         }
       }
-      return { deleted: { entries: deletedEntries, tasks: deletedTasks } };
+      return params.clearAll ? { deleted: { entries: deletedEntries, tasks: deletedTasks }, metadataReset: true } : { deleted: { entries: deletedEntries, tasks: deletedTasks } };
     } finally {
       this.jobManager.releaseLock("forget", entityId);
     }
   }
+  /**
+   * Read-only dry-run preview of {@link forget}. Returns the same shape as a
+   * real call would, without acquiring the lock, opening a transaction, staging
+   * outbox events, or firing embedding hooks. Counts may be off-by-N during a
+   * concurrent real forget — this is accepted, not considered a bug.
+   *
+   * `metadataReset` mirrors the real call: only `clearAll: true` returns true,
+   * because only `clearAll` actually resets the metadata checkpoint.
+   * `standard` (sourceRef/sourceHash) returns no metadataReset field, just like
+   * the real call. `entryId`/`taskId` selectors are rejected with a clear error
+   * (the spec keeps dry-run narrow).
+   */
+  async forgetDryRun(entityId, params) {
+    if (params.entryId !== void 0 || params.taskId !== void 0) {
+      throw new Error("forget({ dryRun: true }) does not support entryId/taskId selectors; use sourceRef/sourceHash or clearAll");
+    }
+    if (params.clearAll) {
+      const entries2 = await this.entryRepo.countLiveByEntityId(entityId);
+      const tasks = await this.taskRepo.countLiveByEntityId(entityId);
+      return { deleted: { entries: entries2, tasks }, metadataReset: true };
+    }
+    const sourceRef = params.sourceRef !== void 0 ? normalizeSourceRef(params.sourceRef) : null;
+    if (params.sourceRef !== void 0 && !sourceRef) throw new Error("Invalid sourceRef");
+    const sourceHash = params.sourceHash !== void 0 ? normalizeSourceHash(params.sourceHash) : null;
+    if (params.sourceHash !== void 0 && !sourceHash) throw new Error("Invalid sourceHash (must be 64-char hex string)");
+    if (sourceRef === null && sourceHash === null) {
+      return { deleted: { entries: 0, tasks: 0 } };
+    }
+    const entries = await this.entryRepo.countLiveBySource(entityId, sourceRef, sourceHash);
+    return { deleted: { entries, tasks: 0 } };
+  }
   /** Core librarian pass (locks handled by {@link runLibrarian}). Package-internal orchestration hook. */
   async doRunLibrarian(entityId, promptOverride) {
     const events = await this.eventRepo.getRecent(entityId, 50);
@@ -4289,6 +4746,15 @@ var ImportExportService = class {
         const safeTitle = clip(String(fact.title ?? ""), IMPORT_TITLE_MAX);
         const safeBody = clip(String(fact.body ?? ""), IMPORT_BODY_MAX);
         clippedTextByFactId.set(fact.id, { title: safeTitle, body: safeBody });
+        let normalizedSourceRef = null;
+        if (fact.source_ref !== null && fact.source_ref !== void 0) {
+          normalizedSourceRef = normalizeSourceRef(fact.source_ref);
+          if (normalizedSourceRef === null) {
+            throw new Error(
+              `importDump: invalid source_ref ${JSON.stringify(fact.source_ref)} for entity "${entityId}" fact "${fact.id}" (must normalize to a non-empty string; see ingestDocument's sourceRef validation)`
+            );
+          }
+        }
         const factObj = {
           id: fact.id,
           entity_id: entityId,
@@ -4298,7 +4764,7 @@ var ImportExportService = class {
           confidence: fact.confidence,
           source_type: sourceType,
           source_hash: fact.source_hash,
-          source_ref: fact.source_ref,
+          source_ref: normalizedSourceRef,
           created_at: fact.created_at,
           updated_at: safeUpdatedAt,
           last_accessed_at: fact.last_accessed_at,
@@ -5474,6 +5940,7 @@ var WikiMemory = class {
     }
     this.outboxRepo = new OutboxRepository(this.db, this.prefix, !!options.config?.enableOutbox);
     this.entryRepo = new EntryRepository(this.db, this.prefix, this.outboxRepo);
+    this.sourceRefIndexRepo = new SourceRefIndexRepository(this.db, this.prefix);
     this.taskRepo = new TaskRepository(this.db, this.prefix, this.outboxRepo);
     this.eventRepo = new EventRepository(this.db, this.prefix);
     this.edgeRepo = new EdgeRepository(this.db, this.prefix);
@@ -5492,6 +5959,7 @@ var WikiMemory = class {
       this.prefix,
       this.options,
       this.entryRepo,
+      this.sourceRefIndexRepo,
       this.searchService,
       this.jobManager,
       this.embeddingService,
@@ -5503,6 +5971,7 @@ var WikiMemory = class {
       this.prefix,
       this.options,
       this.entryRepo,
+      this.sourceRefIndexRepo,
       this.taskRepo,
       this.eventRepo,
       this.metadataRepo,
@@ -5567,6 +6036,7 @@ var WikiMemory = class {
       promptService: this.promptService,
       graphTraversalService: this.graphTraversalService,
       entryRepo: this.entryRepo,
+      sourceRefIndexRepo: this.sourceRefIndexRepo,
       metadataRepo: this.metadataRepo,
       jobManager: this.jobManager
     };
@@ -5616,19 +6086,71 @@ var WikiMemory = class {
     });
     await this.searchService.sync();
   }
-  async hasChanged(entityId, sourceRef, sourceHash) {
-    const normalizedRef = normalizeSourceRef(sourceRef);
-    if (!normalizedRef) {
-      throw new Error(`Invalid sourceRef: ${JSON.stringify(sourceRef)}`);
-    }
-    const normalizedHash = normalizeSourceHash(sourceHash);
-    if (!normalizedHash) {
-      throw new Error(`Invalid sourceHash: must be a 64-character hex string (normalized to lowercase)`);
-    }
-    const storedHash = await this.entryRepo.findLatestSourceHash(entityId, normalizedRef);
-    if (storedHash === null) return true;
-    const normalizedStoredHash = normalizeSourceHash(storedHash);
-    return normalizedStoredHash !== normalizedHash;
+  async hasChanged(entityId, sourceRefOrEntries, sourceHashArg) {
+    if (typeof sourceRefOrEntries === "string") {
+      const sourceRef = normalizeSourceRef(sourceRefOrEntries);
+      if (!sourceRef) {
+        throw new Error(`Invalid sourceRef: ${JSON.stringify(sourceRefOrEntries)}`);
+      }
+      const sourceHash = normalizeSourceHash(sourceHashArg);
+      if (!sourceHash) {
+        throw new Error("Invalid sourceHash: must be a 64-character hex string (normalized to lowercase)");
+      }
+      const storedHash = await this.entryRepo.findLatestSourceHash(entityId, sourceRef);
+      if (storedHash === null) return true;
+      const normalizedStoredHash = normalizeSourceHash(storedHash);
+      return normalizedStoredHash !== sourceHash;
+    }
+    const entries = sourceRefOrEntries;
+    if (entries.length === 0) return [];
+    const normalized = entries.map((e) => {
+      const r = normalizeSourceRef(e.sourceRef);
+      if (!r) throw new Error(`Invalid sourceRef: ${JSON.stringify(e.sourceRef)}`);
+      const h = normalizeSourceHash(e.sourceHash);
+      if (!h) throw new Error("Invalid sourceHash: must be a 64-character hex string (normalized to lowercase)");
+      return { rawSourceRef: e.sourceRef, sourceRef: r, sourceHash: h };
+    });
+    const latestHashes = await this.entryRepo.findLatestSourceHashes(entityId, normalized.map((e) => e.sourceRef));
+    const distinctHashes = Array.from(new Set(normalized.map((e) => e.sourceHash)));
+    const dupRefs = await Promise.all(
+      distinctHashes.map((h) => this.sourceRefIndexRepo.findActiveByEntityAndHash(entityId, h))
+    );
+    const dupMap = /* @__PURE__ */ new Map();
+    for (let i = 0; i < distinctHashes.length; i++) {
+      dupMap.set(distinctHashes[i], dupRefs[i]);
+    }
+    return normalized.map((e) => {
+      const stored = latestHashes.get(e.sourceRef);
+      const changed = stored === void 0 || stored === null || normalizeSourceHash(stored) !== e.sourceHash;
+      const canonical = dupMap.get(e.sourceHash) ?? null;
+      if (canonical === null || canonical === e.sourceRef) {
+        return { sourceRef: e.rawSourceRef, changed };
+      }
+      return { sourceRef: e.rawSourceRef, changed, duplicateOf: canonical };
+    });
+  }
+  /**
+   * Returns the live source_refs for an entity, one row per ref, with the most
+   * recently-updated live `source_hash` and a live fact count. Refs are sorted
+   * `COLLATE BINARY` (no locale dependency). Used by hosts to reconcile stored
+   * state against a live source, or audit duplicate-hash collisions via
+   * `findSourceRefsByHash`.
+   */
+  async listSourceRefs(entityId) {
+    return this.entryRepo.listSourceRefs(entityId);
+  }
+  /**
+   * Returns the live source_refs for an entity that hold the given source_hash.
+   * With v9, source_ref_index is the source of truth for the sourceRef-level
+   * TOCTOU-race invariant: at most one sourceRef can hold a given
+   * (entity_id, source_hash). The result is either a single-element array
+   * (one canonical ref) or empty (no live ref holds the hash). Returned as
+   * an array to preserve the existing public-API shape used by hosts
+   * auditing duplicate-content collisions.
+   */
+  async findSourceRefsByHash(entityId, sourceHash) {
+    const canonical = await this.sourceRefIndexRepo.findActiveByEntityAndHash(entityId, sourceHash);
+    return canonical === null ? [] : [canonical];
   }
   async runPrune(entityId, options) {
     return this.maintenanceService.runPrune(entityId, options);
@@ -5715,16 +6237,16 @@ var WikiMemory = class {
   async importDump(dump, opts) {
     return this.importExportService.importDump(dump, opts);
   }
-  async forget(entityId, params) {
-    return this.maintenanceService.forget(entityId, params);
+  async forget(entityId, params, opts) {
+    return this.maintenanceService.forget(entityId, params, opts);
   }
   /**
    * @param params.promptOverride - Overrides the system prompt for this ingest call only.
    * For persistent customization, set `options.config.prompts.ingestSystemPrompt` at
    * WikiMemory construction time.
    */
-  async ingestDocument(entityId, params) {
-    return this.ingestionService.ingestDocument(entityId, params);
+  async ingestDocument(entityId, params, opts) {
+    return this.ingestionService.ingestDocument(entityId, params, opts);
   }
   /**
    * Returns up to `limit` unprocessed outbox events, oldest first.
@@ -6543,6 +7065,7 @@ exports.ONTOLOGY_BACKFILL_SYSTEM_PROMPT = ONTOLOGY_BACKFILL_SYSTEM_PROMPT;
 exports.PromptService = PromptService;
 exports.PrunePartialFailureError = PrunePartialFailureError;
 exports.WikiBusyError = WikiBusyError;
+exports.WikiDuplicateHashError = WikiDuplicateHashError;
 exports.WikiMemory = WikiMemory;
 exports.WikiTransactionError = WikiTransactionError;
 exports.chunkText = chunkText;