@remnic/core 10.0.13 → 10.0.15

package/dist/{chunk-Y3VDGK2O.js → chunk-4SCZZ3U7.js}

@@ -14,13 +14,17 @@ import {
   applyTombstoneResurrectionGate,
   buildRetiredFactTombstoneInputs,
   collectRetiredMemoriesForRebuild
-} from "./chunk-LZKOVXMX.js";
+} from "./chunk-TRMJ6BYC.js";
 import {
   normalizeQmdResultPath
-} from "./chunk-A2E4WNW4.js";
+} from "./chunk-MWWAQXZ6.js";
 import {
   withholdToolScopedFromSharedNamespace
 } from "./chunk-S2V7RUCL.js";
+import {
+  isMalformedEntityRecord,
+  isPopulatedUnnamedEntityRecord
+} from "./chunk-PPUNC7UX.js";
 import {
   parseOfflineSyncDigestCache
 } from "./chunk-X3724WL4.js";
@@ -31,6 +35,9 @@ import {
 import {
   createMemorySnapshot
 } from "./chunk-S2HLHAZ4.js";
+import {
+  rotateMarkdownFileToArchive
+} from "./chunk-DM2T26WE.js";
 import {
   closeContinuityIncidentRecord,
   createContinuityIncidentRecord,
@@ -41,30 +48,26 @@ import {
   upsertContinuityLoopInMarkdown
 } from "./chunk-LDXUBPMO.js";
 import {
-  rotateMarkdownFileToArchive
-} from "./chunk-DM2T26WE.js";
+  parseFaithfulnessField,
+  serializeFaithfulnessFields
+} from "./chunk-2DT7PIDZ.js";
 import {
   parseProvenanceSources,
   parseProvenanceTag,
   reconcileProvenanceRead,
   serializeProvenanceFields
 } from "./chunk-FF6N7BXC.js";
-import {
-  parseFaithfulnessField,
-  serializeFaithfulnessFields
-} from "./chunk-2DT7PIDZ.js";
 import {
   CasRevisionHost,
   DeletionRevisionStore,
   TombstoneBlockedCaptureIndexHost,
-  buildCapturePathLockIdentity,
-  buildExplicitCaptureDedupKey,
   invalidationCommitFingerprint,
-  isQueuedReviewMemory,
   parseTombstoneBlockedOfflineSyncMemory,
-  tombstoneBlocked,
   withCasCommitReceipt
-} from "./chunk-YYO447A7.js";
+} from "./chunk-JNIVZNIB.js";
+import {
+  normalizeEntityName
+} from "./chunk-YXZG5TVN.js";
 import {
   matchEntitySchemaSection,
   normalizeEntityStructuredSection,
@@ -83,17 +86,18 @@ import {
   normalizeProjectionTags
 } from "./chunk-SCU65EZI.js";
 import {
-  normalizeEntityName
-} from "./chunk-YXZG5TVN.js";
+  checkCorpusReadAbort
+} from "./chunk-6MKLMEBE.js";
 import {
   detectLanguageHint
 } from "./chunk-3WU7XOFN.js";
 import {
-  checkCorpusReadAbort
-} from "./chunk-6MKLMEBE.js";
+  isConsolidationOperator,
+  isValidDerivedFromEntry
+} from "./chunk-G7D6GZ5J.js";
 import {
   createVersion
-} from "./chunk-QZZPUREO.js";
+} from "./chunk-3GYSZHMT.js";
 import {
   attachInFlightReader,
   beginCoalescedScan,
@@ -115,7 +119,7 @@ import {
   requestEntityCanonicalIdReconcileSync,
   resolveHistoricalEntityCanonicalId,
   withEntityCanonicalMutationLock
-} from "./chunk-4NDWE44P.js";
+} from "./chunk-NZFFGO5O.js";
 import {
   computeSupersessionKey,
   normalizeSupersessionKey,
@@ -125,12 +129,11 @@ import {
   entityMentionEpoch
 } from "./chunk-7CT3AI52.js";
 import {
-  isConsolidationOperator,
-  isValidDerivedFromEntry
-} from "./chunk-G7D6GZ5J.js";
-import {
-  parseOriginClass
-} from "./chunk-23G5P7TA.js";
+  buildCapturePathLockIdentity,
+  buildExplicitCaptureDedupKey,
+  isQueuedReviewMemory,
+  tombstoneBlocked
+} from "./chunk-6EDW54SQ.js";
 import {
   clearMemoryCache,
   getCachedEntities,
@@ -144,6 +147,9 @@ import {
   updateCacheOnDelete,
   updateCacheOnWrite
 } from "./chunk-C64XATK7.js";
+import {
+  parseOriginClass
+} from "./chunk-23G5P7TA.js";
 import {
   selectArtifactMatches
 } from "./chunk-Z7L72ZHL.js";
@@ -156,12 +162,12 @@ import {
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-QWWMS4AE.js";
+} from "./chunk-3MO4LWYU.js";
 import {
   composeMemoryEnvelope,
   isSealedMemoryEnvelope,
   sealedWriteToLegacyArgs
-} from "./chunk-OFCHT2TN.js";
+} from "./chunk-5LRV557D.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitationForTemplate,
@@ -182,7 +188,7 @@ import {
   readMemoryActionEventRowsFromLines,
   readProjectionRebuiltAt,
   serializeLifecycleAppendPayload
-} from "./chunk-FQD2KPQH.js";
+} from "./chunk-P55FACBG.js";
 import {
   assertMemoryFrontmatterId,
   warnProjectionFallback
@@ -211,7 +217,7 @@ import {
   CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
   ContentHashIndex,
   FactHashIndexNotAuthoritativeError
-} from "./chunk-KI6UOSNR.js";
+} from "./chunk-DEY7B77Y.js";
 import {
   computeLegacyContentHash
 } from "./chunk-5FVVY2EB.js";
@@ -225,7 +231,7 @@ import {
 } from "./chunk-5GKPFL3S.js";
 import {
   withHeldFileLock
-} from "./chunk-EHRE7ZG3.js";
+} from "./chunk-5B5WYAHQ.js";
 import {
   parseFlexibleIsoTimestamp
 } from "./chunk-P7FMDTKL.js";
@@ -239,6 +245,11 @@ import {
   isAbortError,
   raceAbort
 } from "./chunk-BTTPKDIL.js";
+import {
+  isMacOsReplicationJunkBasename,
+  warnIgnoredMacOsReplicationJunk,
+  withoutMacOsReplicationJunk
+} from "./chunk-QUIRIG2P.js";
 import {
   isPathInsideStorageRoot,
   resolveSafeStoragePath
@@ -267,10 +278,10 @@ import {
 
 // src/storage.ts
 import {
-  lstat as lstat3,
+  lstat as lstat4,
   readdir as readdir6,
   readFile as readFile2,
-  realpath as realpath3,
+  realpath as realpath4,
   stat as stat3,
   writeFile as writeFile2,
   mkdir,
@@ -436,6 +447,12 @@ function isPropagatableReadError(err) {
   const code = err.code;
   return typeof code === "string" && code !== "ENOENT";
 }
+function isStoreEntityMarkdown(baseDir, filePath) {
+  if (!filePath.endsWith(".md")) return false;
+  const relative2 = path3.relative(baseDir, filePath);
+  if (relative2.length === 0 || relative2.startsWith("..") || path3.isAbsolute(relative2)) return false;
+  return relative2.split(path3.sep)[0] === "entities";
+}
 var MemoryReadStore = class {
   constructor(deps) {
     this.deps = deps;
@@ -453,7 +470,7 @@ var MemoryReadStore = class {
     } else {
       try {
         const entries = await readdir(this.deps.wearablesDir, { withFileTypes: true });
-        sources = entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+        sources = entries.filter((entry) => entry.isDirectory() && !isMacOsReplicationJunkBasename(entry.name)).map((entry) => entry.name);
       } catch (err) {
         if (err.code === "ENOENT") return [];
         throw err;
@@ -469,7 +486,7 @@ var MemoryReadStore = class {
         throw err;
       }
       for (const entry of entries) {
-        if (!entry.endsWith(".md")) continue;
+        if (isMacOsReplicationJunkBasename(entry) || !entry.endsWith(".md")) continue;
         const date = entry.slice(0, -3);
         if (!isValidTranscriptDate(date)) continue;
         days.push({ source, date });
@@ -496,6 +513,7 @@ var MemoryReadStore = class {
           const entries = await readdir(dir, { withFileTypes: true });
           for (const entry of entries) {
             checkCorpusReadAbort(options);
+            if (isMacOsReplicationJunkBasename(entry.name)) continue;
             const fullPath = path3.join(dir, entry.name);
             if (entry.isDirectory()) {
               await readDir(fullPath);
@@ -575,6 +593,7 @@ var MemoryReadStore = class {
       for (const entry of entries) {
         checkCorpusReadAbort(options);
         if (entry.isSymbolicLink()) continue;
+        if (isMacOsReplicationJunkBasename(entry.name)) continue;
         const fullPath = path3.join(dir, entry.name);
         if (entry.isDirectory()) {
           subdirs.push(fullPath);
@@ -706,6 +725,7 @@ var MemoryReadStore = class {
         const entries = await readdir(dir, { withFileTypes: true });
         const subdirs = [];
         for (const entry of entries) {
+          if (isMacOsReplicationJunkBasename(entry.name)) continue;
           const fullPath = path3.join(dir, entry.name);
           if (entry.isDirectory()) {
             subdirs.push(fullPath);
@@ -730,6 +750,9 @@ var MemoryReadStore = class {
   async readMemoryByPath(filePath) {
     try {
       const raw = await readMaybeEncryptedFile(filePath, this.deps._secureStoreKey, this.deps.baseDir);
+      if (isStoreEntityMarkdown(this.deps.baseDir, filePath) && isPopulatedUnnamedEntityRecord(raw)) {
+        return null;
+      }
       const parsed = parseFrontmatter(raw);
       if (parsed) {
         return rememberRawFrontmatter({
@@ -742,8 +765,7 @@ var MemoryReadStore = class {
           content: parsed.content
         }, raw);
       }
-      const normalizedPath = filePath.split(path3.sep).join("/");
-      if (normalizedPath.includes("/entities/") && filePath.endsWith(".md")) {
+      if (isStoreEntityMarkdown(this.deps.baseDir, filePath)) {
         const entity = parseEntityFile(raw, this.deps.entitySchemas);
         if (!entity.name) return null;
         const nameWithoutExt = path3.basename(filePath, ".md");
@@ -929,7 +951,7 @@ var MemoryReadStore = class {
       const files = await readdir(this.deps.questionsDir);
       const questions = [];
       for (const file of files) {
-        if (!file.endsWith(".md")) continue;
+        if (isMacOsReplicationJunkBasename(file) || !file.endsWith(".md")) continue;
         const filePath = path3.join(this.deps.questionsDir, file);
         const raw = await readMaybeEncryptedFile(filePath, this.deps._secureStoreKey, this.deps.baseDir);
         const parsed = this.deps.parseQuestionFile(raw, filePath);
@@ -1733,13 +1755,15 @@ function selfDeps(self) {
 }
 
 // src/storage/entity-store.ts
-import { readdir as readdir2, unlink } from "fs/promises";
+import { lstat as lstat2, readdir as readdir2, realpath as realpath2, unlink } from "fs/promises";
 import path5 from "path";
 var EntityStore = class {
   constructor(deps) {
     this.deps = deps;
   }
   deps;
+  /** Filename → file identity of the last indexable check. Unchanged files are not reread. */
+  entityIndexableCache = /* @__PURE__ */ new Map();
   /** Normalize an entity name using this store's alias table. */
   normalizeEntityName(raw, type) {
     return normalizeEntityName(raw, type, this.deps.userAliases);
@@ -1964,12 +1988,121 @@ var EntityStore = class {
       return "";
     }
   }
-  /** Return sorted list of entity filenames (without .md extension) */
+  /**
+   * True when `entities/` is a real directory inside this memory root.
+   * `realpath` on a symlinked root would treat the link target as trusted,
+   * so the check uses `lstat` first and refuses the scan when the root
+   * itself is a symlink.
+   */
+  async isTrustedEntitiesRoot() {
+    let rootStat;
+    try {
+      rootStat = await lstat2(this.deps.entitiesDir);
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) return false;
+      throw err;
+    }
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) return false;
+    let memoryRoot;
+    let entitiesReal;
+    try {
+      memoryRoot = await realpath2(this.deps.baseDir);
+      entitiesReal = await realpath2(this.deps.entitiesDir);
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) return false;
+      throw err;
+    }
+    return pathIsInside(memoryRoot, entitiesReal);
+  }
+  /**
+   * Entity directory listing with macOS replication junk removed.
+   * One summary warning per directory and count, shared with migration.
+   * A symlinked entities root yields an empty list and is not read.
+   */
+  async readEntityDirectoryNames() {
+    if (!await this.isTrustedEntitiesRoot()) return [];
+    const entries = await readdir2(this.deps.entitiesDir);
+    const { kept, ignored } = withoutMacOsReplicationJunk(entries, (name) => name);
+    warnIgnoredMacOsReplicationJunk(this.deps.entitiesDir, ignored, (message) => {
+      log.warn(`entity load ${message}`);
+    });
+    return kept;
+  }
+  /**
+   * A directory entry is readable only when it is a regular file.
+   * Symlinks, FIFOs, and devices are skipped before any read. The entities
+   * root is refused separately, before the directory is listed.
+   */
+  async isContainedRegularEntityFile(file) {
+    const filePath = path5.join(this.deps.entitiesDir, file);
+    let entryStat;
+    try {
+      entryStat = await lstat2(filePath);
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) return false;
+      throw err;
+    }
+    return !entryStat.isSymbolicLink() && entryStat.isFile();
+  }
+  /**
+   * Malformed entity files stay on disk (startup must not relocate them)
+   * and stay out of merge, so a fragment merge cannot delete them.
+   * Unchanged files reuse the previous result so a name listing does not
+   * reread the whole directory on every extraction write.
+   */
+  async isIndexableEntityMarkdown(file) {
+    const filePath = path5.join(this.deps.entitiesDir, file);
+    let entryStat;
+    try {
+      entryStat = await lstat2(filePath);
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) return false;
+      throw err;
+    }
+    if (entryStat.isSymbolicLink() || !entryStat.isFile()) return false;
+    const identity = `${entryStat.dev}:${entryStat.ino}:${entryStat.mtimeMs}:${entryStat.size}`;
+    const cached = this.entityIndexableCache.get(file);
+    if (cached?.identity === identity) return cached.ok;
+    try {
+      const content = await this.deps.readStorageSecureFile(filePath);
+      const parsed = parseEntityFile(content, this.deps.entitySchemas);
+      const ok = parsed.name.trim().length > 0 && parsed.type.trim().length > 0;
+      this.entityIndexableCache.set(file, { identity, ok });
+      return ok;
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
+      return false;
+    }
+  }
+  /**
+   * Sorted entity filenames (without .md). Malformed records stay on disk
+   * and are omitted, so extraction, matching, and entity list cannot reuse them.
+   */
   async listEntityNames() {
     try {
-      const entries = await readdir2(this.deps.entitiesDir);
-      return entries.filter((e) => e.endsWith(".md")).map((e) => e.replace(".md", "")).sort();
-    } catch {
+      const entries = await this.readEntityDirectoryNames();
+      const mdFiles = entries.filter((e) => e.endsWith(".md"));
+      const names = [];
+      const batchSize = 100;
+      for (let i = 0; i < mdFiles.length; i += batchSize) {
+        const resolved = await Promise.all(mdFiles.slice(i, i + batchSize).map(async (file) => {
+          try {
+            if (!await this.isIndexableEntityMarkdown(file)) return null;
+          } catch (err) {
+            if (err instanceof SecureStoreLockedError) throw err;
+            return null;
+          }
+          return file.slice(0, -3);
+        }));
+        for (const name of resolved) {
+          if (name) names.push(name);
+        }
+      }
+      names.sort();
+      return names;
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
       return [];
     }
   }
@@ -1981,8 +2114,10 @@ var EntityStore = class {
     for (const entityName of entityNames) {
       const wrote = await withEntityCanonicalMutationLock(stateDir, async () => {
         const raw = await this.readEntity(entityName);
-        if (!raw) return false;
-        const serialized = serializeEntityFile(parseEntityFile(raw, this.deps.entitySchemas), this.deps.entitySchemas, this.deps.okfConformanceEnabled());
+        if (!raw || isMalformedEntityRecord(raw)) return false;
+        const parsed = parseEntityFile(raw, this.deps.entitySchemas);
+        if (!parsed.name.trim() || !parsed.type.trim()) return false;
+        const serialized = serializeEntityFile(parsed, this.deps.entitySchemas, this.deps.okfConformanceEnabled());
         if (raw.trimEnd() === serialized.trimEnd()) return false;
         const filePath = this.deps.resolveEntityFilePath(entityName);
         if (filePath === null) return false;
@@ -2055,7 +2190,7 @@ var EntityStore = class {
     const cached = getCachedEntities(this.deps.baseDir, currentVersion, cacheKey);
     if (cached) return cached;
     try {
-      const entries = await readdir2(this.deps.entitiesDir);
+      const entries = await this.readEntityDirectoryNames();
       const mdFiles = entries.filter((e) => e.endsWith(".md"));
       if (mdFiles.length === 0) return [];
       const BATCH_SIZE = 100;
@@ -2066,6 +2201,7 @@ var EntityStore = class {
         const results = await Promise.all(
           batch.map(async (entry) => {
             try {
+              if (!await this.isContainedRegularEntityFile(entry)) return null;
               return await this.deps.readStorageSecureFile(path5.join(this.deps.entitiesDir, entry));
             } catch (err) {
               if (err instanceof SecureStoreLockedError) throw err;
@@ -2075,7 +2211,10 @@ var EntityStore = class {
           })
         );
         for (const content of results) {
-          if (content !== null) entities.push(parseEntityFile(content, this.deps.entitySchemas));
+          if (content === null) continue;
+          const entity = parseEntityFile(content, this.deps.entitySchemas);
+          if (!entity.name.trim() || !entity.type.trim()) continue;
+          entities.push(entity);
         }
       }
       checkCorpusReadAbort(options);
@@ -2148,8 +2287,13 @@ ${rows.join("\n")}
   async mergeFragmentedEntitiesUnlocked() {
     let merged = 0;
     try {
-      const entries = await readdir2(this.deps.entitiesDir);
-      const mdFiles = entries.filter((e) => e.endsWith(".md"));
+      const entries = await this.readEntityDirectoryNames();
+      const mdFiles = [];
+      for (const file of entries) {
+        if (!file.endsWith(".md")) continue;
+        if (!await this.isIndexableEntityMarkdown(file)) continue;
+        mdFiles.push(file);
+      }
       const groups = /* @__PURE__ */ new Map();
       for (const file of mdFiles) {
         const baseName = file.replace(".md", "");
@@ -2161,8 +2305,23 @@ ${rows.join("\n")}
         if (!groups.has(canonical)) groups.set(canonical, []);
         groups.get(canonical).push(file);
       }
+      const canonicalDestinationOccupied = async (canonicalName, members) => {
+        if (members.includes(canonicalName)) return false;
+        try {
+          await lstat2(path5.join(this.deps.entitiesDir, canonicalName));
+          return true;
+        } catch (err) {
+          if (isErrnoCode(err, "ENOENT")) return false;
+          throw err;
+        }
+      };
       for (const [canonical, files] of groups) {
         if (files.length <= 1) continue;
+        const canonicalName = `${canonical}.md`;
+        if (await canonicalDestinationOccupied(canonicalName, files)) {
+          log.warn(`skipped entity merge into occupied ${canonicalName}`);
+          continue;
+        }
         const mergedEntity = {
           name: "",
           type: "other",
@@ -2339,7 +2498,11 @@ ${rows.join("\n")}
         }
         mergedEntity.created = mergedEntity.created || mergedEntity.updated || (/* @__PURE__ */ new Date()).toISOString();
         mergedEntity.updated = mergedEntity.updated || (/* @__PURE__ */ new Date()).toISOString();
-        const canonicalPath = path5.join(this.deps.entitiesDir, `${canonical}.md`);
+        const canonicalPath = path5.join(this.deps.entitiesDir, canonicalName);
+        if (await canonicalDestinationOccupied(canonicalName, files)) {
+          log.warn(`skipped entity merge into occupied ${canonicalName}`);
+          continue;
+        }
         await this.deps.writeStorageSecureFile(canonicalPath, serializeEntityFile(mergedEntity, this.deps.entitySchemas, this.deps.okfConformanceEnabled()));
         this.deps.bumpEntityMutationVersion();
         for (const file of files) {
@@ -2520,10 +2683,10 @@ var IdentityContinuityStore = class {
 import { createHash, randomUUID } from "crypto";
 import {
   access,
-  lstat as lstat2,
+  lstat as lstat3,
   readFile,
   readdir as readdir4,
-  realpath as realpath2,
+  realpath as realpath3,
   rename,
   stat as statFile,
   unlink as unlink2,
@@ -2554,7 +2717,7 @@ var EntityCanonicalIdMigrationStateSchema = z.object({
 async function fingerprintPath(filePath) {
   let fileStat;
   try {
-    fileStat = await lstat2(filePath);
+    fileStat = await lstat3(filePath);
   } catch (error) {
     if (!isErrnoCode(error, "ENOENT")) throw error;
   }
@@ -2563,7 +2726,7 @@ async function fingerprintPath(filePath) {
 async function fingerprintEntityEntries(entitiesDir) {
   let names;
   try {
-    names = (await readdir4(entitiesDir)).filter((name) => path7.extname(name) === ".md").sort();
+    names = (await readdir4(entitiesDir)).filter((name) => path7.extname(name) === ".md" && !isMacOsReplicationJunkBasename(name)).sort();
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return "missing";
     throw error;
@@ -2572,7 +2735,7 @@ async function fingerprintEntityEntries(entitiesDir) {
   for (const name of names) {
     hash.update(`${name.length}:${name}:`);
     try {
-      const entry = await lstat2(path7.join(entitiesDir, name), { bigint: true });
+      const entry = await lstat3(path7.join(entitiesDir, name), { bigint: true });
       hash.update(`${entry.dev}:${entry.ino}:${entry.size}:${entry.mtimeNs}:${entry.ctimeNs}`);
     } catch (error) {
       if (!isErrnoCode(error, "ENOENT")) throw error;
@@ -2608,7 +2771,7 @@ async function getFingerprint(baseDir, entitiesDir, getEntityMutationVersion) {
 async function validateRoots(baseDir, entitiesDir, stateDir, archiveDir) {
   let baseStat;
   try {
-    baseStat = await lstat2(baseDir);
+    baseStat = await lstat3(baseDir);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return;
     throw error;
@@ -2616,7 +2779,7 @@ async function validateRoots(baseDir, entitiesDir, stateDir, archiveDir) {
   if (baseStat.isSymbolicLink() || !baseStat.isDirectory()) {
     throw new Error(`Refusing entity canonical-id migration through unsafe memory root: ${baseDir}.`);
   }
-  const memoryRoot = await realpath2(baseDir);
+  const memoryRoot = await realpath3(baseDir);
   const roots = [
     entitiesDir,
     stateDir,
@@ -2627,7 +2790,7 @@ async function validateRoots(baseDir, entitiesDir, stateDir, archiveDir) {
   for (const root of roots) {
     let rootStat;
     try {
-      rootStat = await lstat2(root);
+      rootStat = await lstat3(root);
     } catch (error) {
       if (isErrnoCode(error, "ENOENT")) continue;
       throw error;
@@ -2635,7 +2798,7 @@ async function validateRoots(baseDir, entitiesDir, stateDir, archiveDir) {
     if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
       throw new Error(`Refusing entity canonical-id migration through unsafe memory root: ${root}.`);
     }
-    assertPathInsideRoot(memoryRoot, await realpath2(root), root);
+    assertPathInsideRoot(memoryRoot, await realpath3(root), root);
   }
 }
 function statePath(deps) {
@@ -2645,7 +2808,7 @@ async function assertSafeMigrationStateFile(deps) {
   const migrationStatePath = statePath(deps);
   let fileStat;
   try {
-    fileStat = await lstat2(migrationStatePath);
+    fileStat = await lstat3(migrationStatePath);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return;
     throw error;
@@ -2656,15 +2819,15 @@ async function assertSafeMigrationStateFile(deps) {
     );
   }
   const [stateRoot, stateFile] = await Promise.all([
-    realpath2(deps.stateDir),
-    realpath2(migrationStatePath)
+    realpath3(deps.stateDir),
+    realpath3(migrationStatePath)
   ]);
   assertPathInsideRoot(stateRoot, stateFile, migrationStatePath);
 }
 async function assertSafeTombstoneFile(deps, tombstonePath) {
   let fileStat;
   try {
-    fileStat = await lstat2(tombstonePath);
+    fileStat = await lstat3(tombstonePath);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return false;
     throw error;
@@ -2675,8 +2838,8 @@ async function assertSafeTombstoneFile(deps, tombstonePath) {
     );
   }
   const [stateRoot, tombstoneFile] = await Promise.all([
-    realpath2(deps.stateDir),
-    realpath2(tombstonePath)
+    realpath3(deps.stateDir),
+    realpath3(tombstonePath)
   ]);
   assertPathInsideRoot(stateRoot, tombstoneFile, tombstonePath);
   return true;
@@ -2746,7 +2909,7 @@ async function sameFileIdentity(leftPath, rightPath) {
 async function assertNotSymlink(filePath, label) {
   let stat4;
   try {
-    stat4 = await lstat2(filePath);
+    stat4 = await lstat3(filePath);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return;
     throw error;
@@ -2758,7 +2921,7 @@ async function assertNotSymlink(filePath, label) {
 async function assertNotMemorySymlink(filePath) {
   let stat4;
   try {
-    stat4 = await lstat2(filePath);
+    stat4 = await lstat3(filePath);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return;
     throw error;
@@ -2774,7 +2937,7 @@ async function assertEntityContentUnchanged(deps, filePath, expectedContent, leg
   }
 }
 async function readSafeEntityEntries(entitiesDir) {
-  const rootStat = await lstat2(entitiesDir);
+  const rootStat = await lstat3(entitiesDir);
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
     throw new Error("Refusing entity canonical-id migration through a symlinked or non-directory entities root.");
   }
@@ -2784,24 +2947,30 @@ async function readSafeEntityEntries(entitiesDir) {
   }
   return entries;
 }
-async function discoverMappings(deps, knownMappings = {}, blocked = /* @__PURE__ */ new Map()) {
+async function discoverMappings(deps, knownMappings = {}, blocked = /* @__PURE__ */ new Map(), scanNotes) {
   const mappings = {};
   const canonicalOwners = /* @__PURE__ */ new Map();
   blocked.clear();
   const entityEntries = await readSafeEntityEntries(deps.entitiesDir);
   for (const entry of entityEntries) {
+    if (isMacOsReplicationJunkBasename(entry)) {
+      scanNotes?.junk.add(entry);
+      continue;
+    }
     if (!entry.endsWith(".md")) continue;
     const legacyId = entry.slice(0, -".md".length);
     assertSafeEntityId(legacyId);
     const legacyPath = deps.resolveEntityFilePath(legacyId);
     if (legacyPath === null) continue;
     const entityContent = await deps.readStorageSecureFile(legacyPath);
-    if (!/^#[ \t]+[^\r\n \t]/m.test(entityContent) || !/^\*\*Type:\*\*[ \t]*[^\r\n \t]/m.test(entityContent)) {
-      throw new Error(`Cannot migrate malformed entity file ${entry}: missing name heading or type.`);
+    if (isMalformedEntityRecord(entityContent)) {
+      scanNotes?.malformed.add(entry);
+      continue;
     }
     const entity = deps.parseEntityFile(entityContent);
     if (!entity.name.trim() || !entity.type.trim()) {
-      throw new Error(`Cannot migrate malformed entity file ${entry}: missing name or type.`);
+      scanNotes?.malformed.add(entry);
+      continue;
     }
     const canonicalId = deps.normalizeEntityName(entity.name, entity.type);
     assertSafeEntityId(canonicalId);
@@ -2950,12 +3119,14 @@ async function rewriteRelationshipTargets(deps, mappings, refreshLock) {
   let rewritten = false;
   const entries = await readSafeEntityEntries(deps.entitiesDir);
   for (const entry of entries) {
-    if (!entry.endsWith(".md")) continue;
+    if (!entry.endsWith(".md") || isMacOsReplicationJunkBasename(entry)) continue;
     const entityPath = deps.resolveEntityFilePath(entry.slice(0, -".md".length));
     if (entityPath === null) continue;
     const observedEntityFingerprint = await fingerprintPath(entityPath);
     if (observedEntityFingerprint === "missing") continue;
-    const entity = deps.parseEntityFile(await deps.readStorageSecureFile(entityPath));
+    const entityRaw = await deps.readStorageSecureFile(entityPath);
+    if (isMalformedEntityRecord(entityRaw)) continue;
+    const entity = deps.parseEntityFile(entityRaw);
     const relationships = entity.relationships.map((relationship) => {
       const target = mappings[relationship.target];
       return target ? { ...relationship, target } : relationship;
@@ -2965,7 +3136,9 @@ async function rewriteRelationshipTargets(deps, mappings, refreshLock) {
       deps.stateDir,
       async (refreshEntityLock) => {
         if (!await refreshLock()) throw new Error("Lost entity canonical-id migration lock.");
-        const latestEntity = deps.parseEntityFile(await deps.readStorageSecureFile(entityPath));
+        const latestRaw = await deps.readStorageSecureFile(entityPath);
+        if (isMalformedEntityRecord(latestRaw)) return false;
+        const latestEntity = deps.parseEntityFile(latestRaw);
         if (await fingerprintPath(entityPath) !== observedEntityFingerprint) return false;
         const latestRelationships = latestEntity.relationships.map((relationship) => {
           const target = mappings[relationship.target];
@@ -3112,6 +3285,9 @@ async function migrateEntityFilePair(deps, legacyId, canonicalId, refreshMigrati
     const entityContent = await deps.readStorageSecureFile(legacyPath);
     await assertNotSymlink(legacyPath, legacyId);
     await assertEntityContentUnchanged(deps, legacyPath, entityContent, legacyId);
+    if (isMacOsReplicationJunkBasename(path7.basename(legacyPath)) || isMalformedEntityRecord(entityContent)) {
+      return { deferred: false, progressed: false };
+    }
     let canonicalFingerprintAfterWrite = null;
     try {
       await deps.writeStorageSecureFile(canonicalPath, entityContent, entityEncrypted);
@@ -3172,6 +3348,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
         };
       }
       const blocked = /* @__PURE__ */ new Map();
+      const scanNotes = { junk: /* @__PURE__ */ new Set(), malformed: /* @__PURE__ */ new Set() };
       const staleParked = /* @__PURE__ */ new Map();
       const finish = async () => {
         if (blocked.size > 0) {
@@ -3186,6 +3363,15 @@ async function migrateLegacyEntityCanonicalIds(deps) {
             `entity canonical-id migration dropped ${staleParked.size} mapping(s) whose entity files are gone: ${pairs}. The stale journal entries were removed; references to those legacy ids do not resolve either way.`
           );
         }
+        warnIgnoredMacOsReplicationJunk(deps.entitiesDir, scanNotes.junk.size, (message) => {
+          log.warn(`entity canonical-id migration ${message}`);
+        });
+        if (scanNotes.malformed.size > 0) {
+          const names = [...scanNotes.malformed].sort().join(", ");
+          log.warn(
+            `entity canonical-id migration skipped ${scanNotes.malformed.size} malformed entity file(s): ${names}. Each file was left in place; startup continues. Fix or remove the file to migrate it.`
+          );
+        }
         if (reconcileRequested) {
           await unlink2(consumingMarkerPath).catch((error) => {
             if (!isErrnoCode(error, "ENOENT")) throw error;
@@ -3246,7 +3432,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
         if (!await lock.refresh()) throw new Error("Lost entity canonical-id migration lock.");
         const discoveredBefore = rejectMappingCycles(
           state.mappings,
-          await discoverMappings(deps, state.mappings, blocked)
+          await discoverMappings(deps, state.mappings, blocked, scanNotes)
         );
         const revivedBefore = await pruneBlocked();
         const mergedBefore = collapseMappings(mergeDiscoveredMappings(state.mappings, discoveredBefore));
@@ -3272,7 +3458,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
           if (!await lock.refresh()) throw new Error("Lost entity canonical-id migration lock.");
           const discoveredAfter2 = rejectMappingCycles(
             state.mappings,
-            await discoverMappings(deps, state.mappings, blocked)
+            await discoverMappings(deps, state.mappings, blocked, scanNotes)
           );
           const revivedInRescan = await pruneBlocked();
           if (Object.keys(discoveredAfter2).length === 0 && !revivedInRescan) {
@@ -3325,7 +3511,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
         if (!await lock.refresh()) throw new Error("Lost entity canonical-id migration lock.");
         const discoveredAfter = rejectMappingCycles(
           state.mappings,
-          await discoverMappings(deps, state.mappings, blocked)
+          await discoverMappings(deps, state.mappings, blocked, scanNotes)
         );
         const revivedAfterRewrite = await pruneBlocked();
         if (Object.keys(discoveredAfter).length === 0 && !revivedAfterRewrite) {
@@ -5388,6 +5574,7 @@ async function hasSupersessionAudit(lookup, oldMemoryId, newMemoryId, auditBody,
     throw error;
   }
   for (const entry of entries) {
+    if (isMacOsReplicationJunkBasename(entry.name)) continue;
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
     const memory = await lookup.readMemoryByPath(path12.join(lookup.correctionsDir, entry.name));
     if (memory?.frontmatter.category === "correction" && (memory.frontmatter.sourceMemoryId === oldMemoryId || memory.frontmatter.sourceMemoryId === void 0 && memory.frontmatter.lineage?.includes(oldMemoryId)) && memory.frontmatter.lineage?.includes(newMemoryId) && stripAttributesSuffix(memory.content) === auditBody && (structuredAttributes === void 0 || Object.entries(structuredAttributes).every(
@@ -7604,8 +7791,8 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       readFile: (p) => readMaybeEncryptedFile(p, this._secureStoreKey, this.baseDir),
       readDir: (d) => readdir6(d),
       deleteFile: (p) => unlink4(p),
-      realpath: (p) => realpath3(p),
-      lstat: (p) => lstat3(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() }))
+      realpath: (p) => realpath4(p),
+      lstat: (p) => lstat4(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() }))
     });
   }
   _meetingRecordStore;
@@ -7622,8 +7809,8 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       readFile: (p) => readMaybeEncryptedFile(p, this._secureStoreKey, this.baseDir),
       readDir: (d) => readdir6(d),
       deleteFile: (p) => unlink4(p),
-      realpath: (p) => realpath3(p),
-      lstat: (p) => lstat3(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() }))
+      realpath: (p) => realpath4(p),
+      lstat: (p) => lstat4(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() }))
     });
   }
   /**
@@ -8172,6 +8359,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       secureStoreKeyProvider: () => this._secureStoreKey,
       secureStoreWriteKeyProvider: () => this.resolveWriteKey(),
       lockOptions: () => this.factHashIndexLockOptions,
+      captureLockLimitSource: () => this.captureLockLimitSource(),
       parseMemory: (filePath, content) => parseTombstoneBlockedOfflineSyncMemory(
         filePath,
         content,
@@ -8184,6 +8372,16 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       readAllColdMemories: () => this.readAllColdMemories()
     };
   }
+  /**
+   * Lock-limit source for tombstone-blocked captures. Undefined until the
+   * converge path installs capture-lock limits, so an ordinary capture
+   * resolves to the legacy short bounds instead of the converge deadline.
+   */
+  captureLockLimitSource() {
+    const options = this.factHashIndexLockOptions;
+    const keys = ["captureWriteLockInitialDelayMs", "captureWriteLockMaxDelayMs", "captureWriteLockDeadlineMs", "captureWriteLockSignal"];
+    return keys.some((key) => options[key] !== void 0) ? options : void 0;
+  }
   async getFactHashIndex() {
     if (this.factHashIndex) {
       return this.factHashIndex;
@@ -9412,7 +9610,7 @@ ${sanitized.text}
     const root = this.archiveDir;
     const readDir = async (dir) => {
       try {
-        const entries = await readdir6(dir, { withFileTypes: true });
+        const entries = (await readdir6(dir, { withFileTypes: true })).filter((e) => !isMacOsReplicationJunkBasename(e.name));
         for (const entry of entries) {
           checkCorpusReadAbort(options);
           const fullPath = path13.join(dir, entry.name);
@@ -11182,7 +11380,7 @@ ${current.content}
       const files = await readdir6(this.summariesDir);
       const summaries = [];
       for (const file of files) {
-        if (!file.endsWith(".json")) continue;
+        if (isMacOsReplicationJunkBasename(file) || !file.endsWith(".json")) continue;
         const filePath = path13.join(this.summariesDir, file);
         const raw = await this.readStorageSecureFile(filePath);
         summaries.push(JSON.parse(raw));
@@ -11381,4 +11579,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-Y3VDGK2O.js.map
+//# sourceMappingURL=chunk-4SCZZ3U7.js.map