@ijfw/memory-server 1.5.0 → 1.5.3

package/src/memory/auto-linker.js

@@ -101,7 +101,11 @@ function applyProposal(db, entry, proposal) {
       }
     }
   });
-  tx();
+  // F-LENS2-01: use IMMEDIATE so all facts-table sister-writers acquire the
+  // RESERVED lock in the same order — no DEFERRED→IMMEDIATE upgrade collision
+  // when another writer (storeFactBitemporal, dream-pipeline, obsidian-parser)
+  // holds the lock.
+  tx.immediate();
   return { links_added: linksAdded, neighbor_tags_added: neighborTagsAdded };
 }
 
@@ -149,4 +153,119 @@ export async function autoLink(db, entry, opts = {}) {
   return { skipped: false, neighbors, proposal, applied };
 }
 
-export default { autoLink };
+// v1.5.1 R5-1.2 -- one-time M2 (A-Mem auto-link) backfill for memory written
+// during v1.5.0, when autoLink was NOT wired into the production write path.
+//
+// UNLIKE the M1 backfill (free, always-on), M2 backfill makes one LLM call
+// per row -- backfilling over a large memory can cost real money. So M2
+// backfill is OPT-IN and budget-gated:
+//
+//   - IJFW_AUTOLINK_OFF=1            -> backfill is a no-op (kill switch)
+//   - IJFW_AUTOLINK_BACKFILL!=1      -> backfill is a no-op by default
+//                                       (M1-always, M2-opt-in is the safe
+//                                        default per R5-1.2)
+//   - IJFW_AUTOLINK_BUDGET_USD unset -> backfill is a no-op. A budget MUST be
+//     OR <= 0                           explicitly configured. The per-call
+//                                       llm-call.js path treats an unset
+//                                       budget as "uncapped"; for a bulk
+//                                       backfill that is unsafe -- a large
+//                                       memory could spend without bound. So
+//                                       the backfill REQUIRES a positive cap.
+//   - no API key                    -> backfill is a no-op (autoLink skips)
+//
+// The per-row autoLink call independently re-checks the SAME env gates (off /
+// budget / key), so even mid-run the backfill respects a budget that drops to
+// zero or a kill switch that flips. Returns aggregate counts.
+export async function backfillAutoLink(db, opts = {}) {
+  if (!db || typeof db.prepare !== 'function') {
+    throw new Error('backfillAutoLink: db handle is invalid.');
+  }
+  const force = opts.force === true;
+  // Opt-in gate: M2 backfill only runs when explicitly enabled. M1 backfill
+  // (obsidian-parser.js) is the always-on default; M2 costs money so it is
+  // off unless the operator opts in via IJFW_AUTOLINK_BACKFILL=1.
+  if (!force && process.env.IJFW_AUTOLINK_BACKFILL !== '1') {
+    return { skipped: true, reason: 'backfill_not_enabled', rows: 0 };
+  }
+  if (process.env.IJFW_AUTOLINK_OFF === '1') {
+    return { skipped: true, reason: 'autolink_off', rows: 0 };
+  }
+  // Budget cap is MANDATORY for the backfill. An unset budget means
+  // llm-call.js runs uncapped -- fine for one-off write-time autoLink, but a
+  // bulk backfill over thousands of rows would spend without bound. Refuse
+  // unless the operator has set a positive IJFW_AUTOLINK_BUDGET_USD.
+  const budget = process.env.IJFW_AUTOLINK_BUDGET_USD;
+  if (budget === undefined || !(Number(budget) > 0)) {
+    return {
+      skipped: true,
+      reason: budget === undefined ? 'budget_not_set' : 'budget_exhausted',
+      rows: 0,
+    };
+  }
+  const hasKey = !!(process.env.IJFW_AUTOLINK_API_KEY || process.env.ANTHROPIC_API_KEY);
+  if (!hasKey) {
+    return { skipped: true, reason: 'no_key', rows: 0 };
+  }
+
+  const batchSize = Math.max(1, opts.batchSize || 200);
+  const result = {
+    skipped: false, rows: 0, linked: 0, links_added: 0,
+    neighbor_tags_added: 0, stopped_early: false,
+  };
+  let lastId = 0;
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    let batch;
+    try {
+      batch = db
+        .prepare(
+          'SELECT id, body FROM memory_entries WHERE id > ? ORDER BY id ASC LIMIT ?',
+        )
+        .all(lastId, batchSize);
+    } catch {
+      break;
+    }
+    if (!batch || batch.length === 0) break;
+    for (const row of batch) {
+      lastId = row.id;
+      if (typeof row.body !== 'string' || row.body.length === 0) continue;
+      // Per-row re-check: a budget that drops to zero or a kill switch that
+      // flips mid-run stops the backfill before the next paid call. autoLink
+      // itself ALSO re-checks, but stopping here avoids the wasted SELECT.
+      if (process.env.IJFW_AUTOLINK_OFF === '1') {
+        result.stopped_early = true;
+        return result;
+      }
+      const b = process.env.IJFW_AUTOLINK_BUDGET_USD;
+      if (b === undefined || !(Number(b) > 0)) {
+        result.stopped_early = true;
+        return result;
+      }
+      result.rows += 1;
+      let res;
+      try {
+        res = await autoLink(db, { id: row.id, body: row.body });
+      } catch {
+        continue;
+      }
+      if (res && res.skipped) {
+        // autoLink skipped (budget exhausted / off / no key / parse fail).
+        // budget_exhausted + autolink_off mean stop the whole run.
+        if (res.reason === 'budget_exhausted' || res.reason === 'autolink_off') {
+          result.stopped_early = true;
+          return result;
+        }
+        continue;
+      }
+      result.linked += 1;
+      if (res && res.applied) {
+        result.links_added += res.applied.links_added || 0;
+        result.neighbor_tags_added += res.applied.neighbor_tags_added || 0;
+      }
+    }
+    if (batch.length < batchSize) break;
+  }
+  return result;
+}
+
+export default { autoLink, backfillAutoLink };

package/src/memory/benchmark.js

@@ -37,10 +37,11 @@
 //                                     stale_visible_with_flag: bool }
 //                                   sanity proof the warm filter still gates.
 //
-// What this harness does NOT do (yet -- on the v1.5.0 backlog):
+// What this harness does NOT do (yet -- folded into the v1.6.0 IJFW Brain
+// workstream alongside the cold-tier vector index):
 //   - cross-tier promotion timing (hot->warm happens at first search; warm
-//     never promotes to cold without a model). Future T23+ work owns the
-//     bi-temporal + decay-on-retrieval axes.
+//     never promotes to cold without a model). The v1.6.0 Brain work owns
+//     the bi-temporal + decay-on-retrieval axes.
 //   - multi-writer throughput. Single-writer is the published norm because
 //     SQLite's BEGIN IMMEDIATE queue dominates; that's already covered by
 //     test-memory-fts5.js's concurrent-writers test.

package/src/memory/layout-migrations/001-visible-layer.js

@@ -0,0 +1,131 @@
+// IJFW v1.5.2.1 -- fs-layout migration 001: visible ijfw/ layer.
+//
+// Lives in src/memory/layout-migrations/ (NOT src/memory/migrations/). This
+// directory is reserved for filesystem-layout migrations — they reshape on-disk
+// directory layout and track version via sentinel files (see
+// brain/layout-sentinel.js), NOT via SQLite user_version. The SQL
+// migration-runner deliberately rejects files declaring SQL=false (F3 root
+// cause: when SQL and fs-layout migrations coexist, an accidental copy-paste
+// can brick schema migrations). These files are statically registered in
+// layout-migrations/index.js and invoked by server.js at startup.
+//
+// Trident F-B3 safety:
+//  - acquires withLayoutLock (serializes concurrent migrations)
+//  - freshness gate refuses if any .md mtime < 30s old (concurrent writer)
+//  - sentinel flipped LAST so a crash mid-copy leaves v1 + a recoverable retry
+//  - copy-not-move keeps legacy .ijfw/ paths intact for one-version fallback
+
+import {
+  existsSync, mkdirSync, statSync, readdirSync, cpSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import {
+  readLayoutVersion, writeLayoutVersion, withLayoutLock,
+} from '../../brain/layout-sentinel.js';
+
+const FRESHNESS_MS = 30_000;
+
+const SCAFFOLD_DIRS = [
+  ['ijfw', 'dump', 'inbox'],
+  ['ijfw', 'dump', 'processed'],
+  ['ijfw', 'wiki', 'concepts'],
+  ['ijfw', 'wiki', 'entities'],
+  ['ijfw', 'wiki', 'decisions'],
+  ['ijfw', 'wiki', 'milestones'],
+];
+
+function walkMd(dir) {
+  if (!existsSync(dir)) return [];
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walkMd(p));
+    else if (entry.isFile() && entry.name.endsWith('.md')) out.push(p);
+  }
+  return out;
+}
+
+function findFreshFiles(repoRoot) {
+  const cutoff = Date.now() - FRESHNESS_MS;
+  const candidates = [
+    ...walkMd(join(repoRoot, '.ijfw', 'memory')),
+    ...walkMd(join(repoRoot, '.ijfw', 'sessions')),
+  ];
+  return candidates.filter((p) => statSync(p).mtimeMs >= cutoff);
+}
+
+export const DESCRIPTION =
+  'fs-layout v2 -- visible ijfw/ + scaffolded dump/wiki dirs (NOT a SQL migration)';
+
+export async function up(repoRoot) {
+  if (readLayoutVersion(repoRoot) >= 2) {
+    return { skipped: true, reason: 'already-migrated' };
+  }
+  return await withLayoutLock(repoRoot, async () => {
+    if (readLayoutVersion(repoRoot) >= 2) {
+      return { skipped: true, reason: 'already-migrated' };
+    }
+    // F4: freshness gate runs INSIDE the lock so a writer cannot sneak in
+    // between gate-pass and lock-acquire. The lock holds the freshness
+    // contract for the entire copy phase.
+    const freshFiles = findFreshFiles(repoRoot);
+    if (freshFiles.length > 0) {
+      // v1.5.2.1 F2: observability — surface the deferral to stderr so an
+      // operator running `ijfw doctor` or watching server logs can see why
+      // the visible layer hasn't materialised yet. Silent skip leaves the
+      // operator wondering what happened.
+      try {
+        process.stderr.write(
+          `[ijfw layout-migrate] deferred: ${freshFiles.length} file(s) written ` +
+          `< ${FRESHNESS_MS}ms ago in .ijfw/memory or .ijfw/sessions; ` +
+          `will retry on next server start\n`
+        );
+      } catch { /* stderr may be detached */ }
+      return { skipped: true, reason: 'fresh-writes-detected', freshFiles };
+    }
+    // v1.5.2.1 F4: detect operator downgrade. If sentinel is 1 but the visible
+    // layer destination already has .md content, the operator probably flipped
+    // .ijfw/.layout-version back to 1 manually (e.g. attempting downgrade to
+    // v1.5.1). cpSync({force:false}) would silently skip the existing files
+    // and leave drift between the two layers. Refuse, log, keep sentinel at 1
+    // so the operator resolves the conflict manually.
+    const memoryDst = join(repoRoot, 'ijfw', 'memory');
+    const sessionsDst = join(repoRoot, 'ijfw', 'sessions');
+    if (walkMd(memoryDst).length > 0 || walkMd(sessionsDst).length > 0) {
+      try {
+        process.stderr.write(
+          `[ijfw layout-migrate] aborted: visible layer (ijfw/memory or ijfw/sessions) ` +
+          `already populated but sentinel=1 (downgrade detected). Resolve manually, ` +
+          `then set .ijfw/.layout-version to 2.\n`
+        );
+      } catch { /* stderr may be detached */ }
+      return { skipped: true, reason: 'downgrade-conflict' };
+    }
+    let copiedFiles = 0;
+    // FLAG-4: force:false preserves any user-authored content already at the
+    // visible-layer destination (e.g. operator following the README's
+    // "commit ijfw/ to git" advice before migration runs). errorOnExist:false
+    // means existing destination files cause the COPY of THAT file to skip
+    // silently, but the rest of the tree still copies. Behaviour: union of
+    // existing visible files (winner) + legacy hidden files (filler).
+    const memorySrc = join(repoRoot, '.ijfw', 'memory');
+    if (existsSync(memorySrc)) {
+      cpSync(memorySrc, memoryDst,
+             { recursive: true, force: false, errorOnExist: false });
+      copiedFiles += walkMd(memorySrc).length;
+    }
+    const sessionsSrc = join(repoRoot, '.ijfw', 'sessions');
+    if (existsSync(sessionsSrc)) {
+      cpSync(sessionsSrc, sessionsDst,
+             { recursive: true, force: false, errorOnExist: false });
+      copiedFiles += walkMd(sessionsSrc).length;
+    }
+    for (const parts of SCAFFOLD_DIRS) {
+      mkdirSync(join(repoRoot, ...parts), { recursive: true });
+    }
+    writeLayoutVersion(repoRoot, 2);
+    return { skipped: false, version: 2, copiedFiles, scaffoldedDirs: SCAFFOLD_DIRS.length };
+  });
+}
+
+export default { description: DESCRIPTION, up };

package/src/memory/layout-migrations/index.js

@@ -0,0 +1,50 @@
+// mcp-server/src/memory/layout-migrations/index.js
+//
+// Filesystem-layout migrations. These are NOT SQL migrations — they reshape
+// on-disk directory layout (e.g., copying internal .ijfw/memory/ to visible
+// ijfw/memory/) and track their version via sentinel files, not SQLite
+// user_version. They live in a sibling directory to migrations/ so the SQL
+// migration runner cannot accidentally load them (root cause of F1 in v1.5.2.1).
+//
+// To add a new fs-layout migration:
+//   1. Create NNN-foo.js in this directory exporting DESCRIPTION + up(repoRoot).
+//   2. Import it below and add it to LAYOUT_MIGRATIONS in version order.
+//   3. The server entry-point invokes runLayoutMigrations(repoRoot) at startup.
+
+import * as visibleLayer from './001-visible-layer.js';
+
+// L-1 (Lens 1): defense-in-depth deep freeze. ESM namespace objects ARE
+// already frozen by spec (Node throws TypeError if you Object.freeze them),
+// so we rewrap each namespace import in a plain object literal exposing the
+// minimal contract, then freeze that. Future refactors that swap a
+// namespace import for a class instance or factory keep the immutability
+// invariant rather than silently going mutable.
+function wrap(ns) {
+  return Object.freeze({
+    DESCRIPTION: ns.DESCRIPTION,
+    up: ns.up,
+  });
+}
+export const LAYOUT_MIGRATIONS = Object.freeze([wrap(visibleLayer)]);
+
+// L-2 (Lens 1): per-migration try/catch so one failing migration cannot
+// abort subsequent independent ones. Caller decides whether to bail on
+// failures (server.js __mainEntryPoint logs each failure to stderr).
+// Returns an array of { description, ok, result?, error? } in invocation
+// order — preserved even on partial failure for debugging.
+export async function runLayoutMigrations(repoRoot) {
+  const results = [];
+  for (const m of LAYOUT_MIGRATIONS) {
+    try {
+      const result = await m.up(repoRoot);
+      results.push({ description: m.DESCRIPTION, ok: true, result });
+    } catch (err) {
+      results.push({
+        description: m.DESCRIPTION,
+        ok: false,
+        error: err && err.message ? err.message : String(err),
+      });
+    }
+  }
+  return results;
+}

package/src/memory/migration-runner.js

@@ -27,9 +27,22 @@ export class SchemaVersionError extends Error {
 }
 
 // Discover and load every migration module under ./migrations/, sorted by
-// numeric prefix ascending. Each module must export VERSION (integer),
-// DESCRIPTION (string), and up(db) (function).
-async function loadMigrations() {
+// numeric prefix ascending. Each module MUST export VERSION (number),
+// DESCRIPTION (string), and up(db) (function). The filename's numeric prefix
+// MUST equal the exported VERSION (enforced below).
+//
+// SQL=false is REJECTED — fs-layout migrations live in ../layout-migrations/
+// (see v1.5.2.1 F3). The runner used to silently skip SQL=false; that escape
+// hatch was a runtime workaround for a directory-structure mistake and is
+// gone. If a file in this directory declares SQL=false, the runner fails
+// loudly so the structural error is caught at startup, not at the next
+// schema-bricking copy-paste.
+//
+// Exported (v1.5.1 W3.B) so search.js (and any other consumer that needs
+// the sync migration pipeline) can reuse the SAME discovery path instead
+// of maintaining a parallel hardcoded list. Single source of truth: drop
+// a new NNN-name.js into ./migrations/ and every consumer sees it.
+export async function loadMigrations() {
   let files;
   try {
     files = readdirSync(MIGRATIONS_DIR);
@@ -43,9 +56,30 @@ async function loadMigrations() {
   for (const f of matches) {
     const url = pathToFileURL(join(MIGRATIONS_DIR, f)).href;
     const mod = await import(url);
+    // v1.5.2.1 F3: SQL=false is no longer an in-directory escape hatch. The
+    // fs-layout migrations live in ../layout-migrations/ and are statically
+    // registered there. If anything in this directory still declares
+    // SQL=false it's a structural error (likely a misplaced fs-layout
+    // migration). Fail loudly rather than silently skip.
+    if (mod.SQL === false) {
+      throw new Error(
+        `Memory migration ${f} declares SQL=false — fs-layout migrations belong in ` +
+        `layout-migrations/, not migrations/. Move the file or remove SQL=false.`
+      );
+    }
     if (typeof mod.VERSION !== 'number' || typeof mod.up !== 'function') {
       throw new Error(`Memory migration ${f} is missing VERSION or up().`);
     }
+    // v1.5.2.1 F3.2: filename numeric prefix MUST equal exported VERSION.
+    // Catches reordering / rename mistakes immediately rather than at the
+    // next user_version comparison (where the failure mode is silent).
+    const filenamePrefix = parseInt(f.match(/^(\d+)/)[1], 10);
+    if (filenamePrefix !== mod.VERSION) {
+      throw new Error(
+        `Memory migration ${f}: filename prefix ${filenamePrefix} does not match ` +
+        `exported VERSION ${mod.VERSION}. Rename the file or fix the VERSION.`
+      );
+    }
     out.push({
       file: f,
       version: mod.VERSION,

package/src/memory/migrations/009-obsidian-backfill.js

@@ -0,0 +1,50 @@
+// IJFW v1.5.1 -- memory migration 009: M1 obsidian-index backfill.
+//
+// Source authority: Trident r5 finding 1.2 (HIGH).
+//
+// Round-4 Fix-1 (commit 3218812) wired M1 (Obsidian wikilink/tag/meta
+// indexing -- indexObsidianRelations) and M2 (A-Mem auto-linking -- autoLink)
+// into the production memory-write path (handleStore, search.js#autoIndex).
+// But the fix is forward-only: every memory_entries row written during
+// v1.5.0 -- when M1/M2 were bypassed -- has empty memory_links / memory_tags
+// / memory_meta. An existing user upgrading to v1.5.1 got auto-linking +
+// wikilink indexing only on NEW entries; their accumulated memory stayed
+// un-indexed.
+//
+// This migration runs a ONE-TIME M1 backfill: it walks every existing
+// memory_entries row and runs indexObsidianRelations over its body. M1 is:
+//   - free       -- pure markdown parse, zero LLM / network / cost
+//   - idempotent -- indexObsidianRelations does DELETE-then-INSERT per id,
+//                   so re-applying produces identical aux rows
+// which is exactly what makes it safe to run inside a schema migration: it
+// runs once (user_version gates re-application), deterministically, and a
+// crash rolls the whole txn back to user_version 8.
+//
+// M2 (autoLink) is NOT backfilled here -- it makes one LLM call per row and
+// can cost real money over a large memory. M2 backfill is opt-in via the
+// `ijfw memory reindex --m2` CLI verb, which is budget-gated (respects
+// IJFW_AUTOLINK_BUDGET_USD / IJFW_AUTOLINK_OFF / IJFW_AUTOLINK_BACKFILL).
+//
+// Ordering: migration 001 creates memory_entries; migration 006 creates
+// memory_links / memory_tags / memory_meta. Both run before 009, so by the
+// time up() executes the source table and the three aux tables all exist.
+//
+// Crash safety: the migration runner wraps up() in BEGIN IMMEDIATE.
+// backfillObsidianIndex's per-row indexObsidianRelations opens a nested
+// SQLite transaction (savepoint) -- valid inside the outer txn -- and the
+// whole thing rolls back to user_version 8 on any failure.
+
+import { backfillObsidianIndex } from '../obsidian-parser.js';
+
+export const VERSION = 9;
+export const DESCRIPTION =
+  'memory v1.5.1 -- one-time M1 obsidian-index backfill for pre-fix rows (Trident r5 1.2)';
+
+export function up(db) {
+  // backfillObsidianIndex tolerates a missing memory_entries table (returns
+  // zero counts) so a brand-new db that jumps straight to v9 is a clean
+  // no-op -- there are no pre-fix rows to backfill on a fresh install.
+  backfillObsidianIndex(db);
+}
+
+export default { version: VERSION, description: DESCRIPTION, up };

package/src/memory/obsidian-parser.js

@@ -84,8 +84,71 @@ export function indexObsidianRelations(db, memoryId, text) {
     for (const t of parsed.tags) insTag.run(memoryId, t.path, t.depth);
     for (const m of parsed.meta) insMeta.run(memoryId, m.key, m.value);
   });
-  tx();
+  // F-LENS2-01: use IMMEDIATE so all facts-table sister-writers acquire the
+  // RESERVED lock in the same order — no DEFERRED→IMMEDIATE upgrade collision.
+  tx.immediate();
   return parsed;
 }
 
-export default { parseObsidian, indexObsidianRelations };
+// v1.5.1 R5-1.2 -- one-time M1 backfill for memory written during v1.5.0,
+// when indexObsidianRelations was NOT wired into the production write path.
+// Round-4 Fix-1 (commit 3218812) wired M1+M2 into handleStore/autoIndex but
+// forward-only: rows already in memory_entries have empty memory_links /
+// memory_tags / memory_meta. This walks EVERY row and re-runs M1 over it.
+//
+// Safe to run over everything:
+//   - free      -- pure markdown parse, zero LLM / network
+//   - idempotent-- indexObsidianRelations clears prior aux rows per id before
+//                  re-inserting, so a re-run produces identical state
+//
+// The walk reads ids in batches so a very large memory_entries doesn't pin
+// the whole table in memory; each row's indexObsidianRelations call carries
+// its own transaction (DELETE-then-INSERT) so a single bad row never aborts
+// the rest of the backfill.
+//
+// Returns { rows, links, tags, meta } -- counts re-indexed across the run.
+export function backfillObsidianIndex(db, opts = {}) {
+  if (!db || typeof db.prepare !== 'function') {
+    throw new Error('backfillObsidianIndex: db handle is invalid.');
+  }
+  const batchSize = Math.max(1, opts.batchSize || 500);
+  const result = { rows: 0, links: 0, tags: 0, meta: 0, errors: 0 };
+  let lastId = 0;
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    let batch;
+    try {
+      batch = db
+        .prepare(
+          'SELECT id, body FROM memory_entries WHERE id > ? ORDER BY id ASC LIMIT ?',
+        )
+        .all(lastId, batchSize);
+    } catch {
+      // memory_entries missing (fresh db before migration 001) -- nothing to do.
+      break;
+    }
+    if (!batch || batch.length === 0) break;
+    for (const row of batch) {
+      lastId = row.id;
+      if (typeof row.body !== 'string' || row.body.length === 0) continue;
+      try {
+        const parsed = indexObsidianRelations(db, String(row.id), row.body);
+        result.rows += 1;
+        result.links += parsed.links.length;
+        result.tags += parsed.tags.length;
+        result.meta += parsed.meta.length;
+      } catch (e) {
+        result.errors += 1;
+        try {
+          console.error(
+            '[obsidian] backfill failed for id', row.id, ':', e?.message || e,
+          );
+        } catch { /* never throw out of the backfill */ }
+      }
+    }
+    if (batch.length < batchSize) break;
+  }
+  return result;
+}
+
+export default { parseObsidian, indexObsidianRelations, backfillObsidianIndex };

package/src/memory/reader.js

@@ -22,7 +22,8 @@ const PREVIEW_CHARS = 300;
 /** Parse YAML-style frontmatter (key: value lines between --- fences). */
 function parseFrontmatter(raw) {
   const fm = { title: null, description: null, type: null };
-  const m  = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  const stripped = String(raw).replace(/^/, '').replace(/^\s+/, '');
+  const m  = stripped.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!m) return fm;
   for (const line of m[1].split('\n')) {
     const kv = line.match(/^(\w+):\s*(.+)/);