@remnic/core 10.0.49 → 10.0.50

package/dist/{chunk-LWRIGKFM.js → chunk-A5L5KGDI.js}

@@ -81,6 +81,7 @@ function assertSafeEntityId(entityId) {
 // src/storage/entity-canonical-id-references.ts
 import { statSync } from "fs";
 import path2 from "path";
+import { z } from "zod";
 import {
   closeSync,
   constants,
@@ -141,6 +142,22 @@ function readJournalFileNoFollow(statePath) {
     closeSync(fd);
   }
 }
+var CompletedJournalAttestationSchema = z.object({
+  version: z.literal(1),
+  complete: z.literal(true),
+  completionFingerprint: z.string()
+});
+async function entityCanonicalIdMigrationCompleted(stateDir, readFingerprint) {
+  const result = readJournalFileNoFollow(path2.join(stateDir, ENTITY_CANONICAL_ID_MIGRATION_FILE));
+  if (result.kind !== "ok") return false;
+  try {
+    const parsed = CompletedJournalAttestationSchema.safeParse(JSON.parse(result.raw));
+    if (!parsed.success) return false;
+    return parsed.data.completionFingerprint === await readFingerprint();
+  } catch {
+    return false;
+  }
+}
 async function appendCanonicalizedTombstone(stateDir, input, currentIds, append, revoke, label) {
   let refIds = currentIds();
   let identity = canonicalizeTombstoneIdentity(input.entityRef, input.supersessionKey, refIds);
@@ -398,6 +415,7 @@ export {
   withRawEntityPageMutation,
   assertSafeEntityId,
   ENTITY_CANONICAL_ID_MIGRATION_FILE,
+  entityCanonicalIdMigrationCompleted,
   appendCanonicalizedTombstone,
   memoizedJournalCompletion,
   HistoricalEntityCanonicalIdCache,
@@ -416,4 +434,4 @@ export {
   repairContentAfterJournalMove,
   repairContentAfterJournalMoveSync
 };
-//# sourceMappingURL=chunk-LWRIGKFM.js.map
+//# sourceMappingURL=chunk-A5L5KGDI.js.map

package/dist/chunk-A5L5KGDI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/storage/entity-canonical-id-lock.ts","../src/storage/entity-id-safety.ts","../src/storage/entity-canonical-id-references.ts"],"sourcesContent":["import { appendFileSync, mkdirSync, realpathSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { invalidateForScope } from \"../memory-cache.js\";\nimport { serializeMutations, withHeldFileLock } from \"../utils/serialize-mutations.js\";\n\nconst ENTITY_CANONICAL_ID_MUTATION_LOCK_STALE_MS = 60_000;\nconst ENTITY_CANONICAL_ID_MUTATION_LOCK_MAX_WAIT_MS = 300_000;\n\nexport function isEntityPagePath(baseDir: string, filePath: string): boolean {\n  if (path.extname(filePath) !== \".md\") return false;\n  const parentDir = path.dirname(path.resolve(filePath));\n  const entitiesDir = path.resolve(baseDir, \"entities\");\n  if (parentDir === entitiesDir) return true;\n  try {\n    return realpathSync(parentDir) === path.join(realpathSync(baseDir), \"entities\");\n  } catch {\n    return false;\n  }\n}\n\nfunction recordRawEntityMutation(baseDir: string, stateDir: string): void {\n  invalidateForScope(baseDir, \"entity-write\");\n  mkdirSync(stateDir, { recursive: true });\n  appendFileSync(path.join(stateDir, \".entity-mutation-version.log\"), \"x\");\n}\n\nexport function withEntityCanonicalMutationLock<T>(\n  stateDir: string,\n  task: (refreshLock: () => Promise<boolean>) => Promise<T>,\n): Promise<T> {\n  const lockPath = path.join(stateDir, \"entity-canonical-id-mutation.lock\");\n  return serializeMutations(lockPath, () =>\n    withHeldFileLock(\n      lockPath,\n      {\n        staleMs: ENTITY_CANONICAL_ID_MUTATION_LOCK_STALE_MS,\n        maxWaitMs: ENTITY_CANONICAL_ID_MUTATION_LOCK_MAX_WAIT_MS,\n      },\n      async (acquired, lock) => {\n        if (!acquired) throw new Error(\"Timed out waiting for entity mutation lock.\");\n        return task(() => lock.refresh());\n      },\n    ),\n  );\n}\n\nexport async function withRawEntityPageMutation<T>(\n  baseDir: string,\n  filePath: string,\n  task: (refreshLock: () => Promise<boolean>) => Promise<T>,\n): Promise<T> {\n  if (!isEntityPagePath(baseDir, filePath)) {\n    return task(async () => true);\n  }\n  const stateDir = path.join(baseDir, \"state\");\n  return withEntityCanonicalMutationLock(stateDir, async (refreshLock) => {\n    try {\n      return await task(refreshLock);\n    } finally {\n      recordRawEntityMutation(baseDir, stateDir);\n    }\n  });\n}\n","const UNSAFE_ENTITY_ID_PATTERN = /[\\/\\\\\\p{Cc}\\p{Zl}\\p{Zp}]/u;\n\nexport function assertSafeEntityId(entityId: string): void {\n  if (UNSAFE_ENTITY_ID_PATTERN.test(entityId)) {\n    throw new Error(\"Refusing unsafe entity id containing a path separator or control character.\");\n  }\n}\n","import { statSync } from \"node:fs\";\n/**\n * Write-boundary surface of the entity canonical-id migration (issue #2213).\n *\n * The migration itself (entity-canonical-id-migration.ts) renames legacy\n * entity files and rewrites references ONCE, to convergence, then retires.\n * Everything here exists so nothing can re-introduce a legacy reference\n * afterwards without the migration having to rescan the corpus:\n *\n * - store-mediated writes canonicalize the caller-supplied `entityRef`\n *   ({@link canonicalizeEntityRefOption});\n * - bulk writers that persist raw record bytes (capsule import/merge)\n *   canonicalize the frontmatter line ({@link canonicalizeEntityRefFrontmatter});\n * - raw-byte writers that CANNOT parse what they write (offline sync,\n *   consolidation-undo, governance restores) request one bounded\n *   reconciliation pass instead ({@link requestEntityCanonicalIdReconcile}).\n */\nimport path from \"node:path\";\nimport { z } from \"zod\";\nimport {\n  closeSync,\n  constants,\n  fstatSync,\n  lstatSync,\n  realpathSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { randomUUID } from \"node:crypto\";\nimport { log } from \"../logger.js\";\nimport { isErrnoCode } from \"../utils/errno.js\";\nimport { RECALL_FALLBACK_DIRS } from \"../utils/category-dir.js\";\nimport { withEntityCanonicalMutationLock } from \"./entity-canonical-id-lock.js\";\nimport { assertSafeEntityId } from \"./entity-id-safety.js\";\nimport { normalizeSupersessionKey } from \"../temporal-supersession.js\";\n\nexport const ENTITY_CANONICAL_ID_MIGRATION_FILE = \"entity-canonical-id-migration-v1.json\";\n\n/**\n * Parse a journal document into a mapping table. A document without a valid\n * `mappings` object is a LEGITIMATELY empty table; an unreadable/unparsable\n * document THROWS so callers can distinguish \"empty\" from \"failed\".\n */\nfunction parseJournalMappings(raw: string): Readonly<Record<string, string>> {\n  const parsed: unknown = JSON.parse(raw);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed) || !(\"mappings\" in parsed)) return {};\n  const mappings = parsed.mappings;\n  if (!mappings || typeof mappings !== \"object\" || Array.isArray(mappings)) return {};\n  // Null prototype: journal-supplied ids like `constructor` must be own\n  // entries, never collide with Object.prototype (Codex P2, round 20).\n  const cleaned: Record<string, string> = Object.create(null) as Record<string, string>;\n  for (const [legacyId, canonicalId] of Object.entries(mappings)) {\n    if (legacyId.length > 0 && typeof canonicalId === \"string\" && canonicalId.length > 0) {\n      assertSafeEntityId(legacyId);\n      assertSafeEntityId(canonicalId);\n      cleaned[legacyId] = canonicalId;\n    }\n  }\n  return cleaned;\n}\n\n/** Whether the journal says its migration completed. Throws like the mapping parser. */\nfunction parseJournalComplete(raw: string): boolean {\n  // SAFETY: JSON.parse output is unknown; the shape is validated on access.\n  const parsed = JSON.parse(raw) as { complete?: unknown };\n  return parsed !== null && parsed.complete === true;\n}\n\ntype JournalRead =\n  | { kind: \"ok\"; raw: string; key: string }\n  | { kind: \"missing\" }\n  | { kind: \"refused\" }\n  | { kind: \"error\" };\n\n/**\n * Open the journal WITHOUT following symlinks and read content + identity\n * from the same opened inode (repo rule: reject symlink traversal from\n * memory directories). O_NOFOLLOW makes the open refuse a symlinked FINAL\n * component (ELOOP); the parent `state/` directory is verified AFTER the\n * open, together with a path↔fd identity pairing, so a parent swapped\n * around the open cannot hold: a swap still in place fails the parent\n * lstat, and a swap reverted fails the dev/ino pairing against the real\n * journal. Platforms without O_NOFOLLOW get the same post-open checks.\n */\nfunction readJournalFileNoFollow(statePath: string): JournalRead {\n  let fd: number;\n  try {\n    fd = openSync(statePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));\n  } catch (error) {\n    if (isErrnoCode(error, \"ENOENT\")) return { kind: \"missing\" };\n    if (isErrnoCode(error, \"ELOOP\")) return { kind: \"refused\" };\n    return { kind: \"error\" };\n  }\n  try {\n    const s = fstatSync(fd);\n    if (!s.isFile()) return { kind: \"refused\" };\n    const parent = lstatSync(path.dirname(statePath));\n    if (parent.isSymbolicLink() || !parent.isDirectory()) return { kind: \"refused\" };\n    const l = lstatSync(statePath);\n    if (l.isSymbolicLink() || l.dev !== s.dev || l.ino !== s.ino) return { kind: \"refused\" };\n    return {\n      kind: \"ok\",\n      raw: readFileSync(fd, \"utf-8\"),\n      key: `${s.dev}:${s.ino}:${s.mtimeMs}:${s.ctimeMs}:${s.size}`,\n    };\n  } catch {\n    return { kind: \"error\" };\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/** The journal fields completion attestation needs; extra journal fields are ignored. */\nconst CompletedJournalAttestationSchema = z.object({\n  version: z.literal(1),\n  complete: z.literal(true),\n  completionFingerprint: z.string(),\n});\n\n/** Skip compatibility scans only when journal completion attests to the live inputs. */\nexport async function entityCanonicalIdMigrationCompleted(\n  stateDir: string,\n  readFingerprint: () => Promise<string>,\n): Promise<boolean> {\n  const result = readJournalFileNoFollow(path.join(stateDir, ENTITY_CANONICAL_ID_MIGRATION_FILE));\n  if (result.kind !== \"ok\") return false;\n  try {\n    const parsed = CompletedJournalAttestationSchema.safeParse(JSON.parse(result.raw));\n    if (!parsed.success) return false;\n    return parsed.data.completionFingerprint === await readFingerprint();\n  } catch {\n    return false;\n  }\n}\n\nexport function loadHistoricalEntityCanonicalIds(stateDir: string): Readonly<Record<string, string>> {\n  const result = readJournalFileNoFollow(path.join(stateDir, ENTITY_CANONICAL_ID_MIGRATION_FILE));\n  if (result.kind !== \"ok\") return {};\n  try {\n    return parseJournalMappings(result.raw);\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Append a tombstone with its identity canonicalized against the CURRENT\n * journal, then recheck: a peer publishing a mapping inside the\n * resolve-to-append window would leave the guard under the legacy id while\n * lookups canonicalize. Each identity change appends the replacement FIRST\n * (AGENTS.md §14 — the retired fact must never be without an active guard),\n * then revokes the superseded one — a park makes the prior canonical\n * claimant a distinct entity, and a stale keyed guard under it would\n * suppress that entity's facts. When the journal will not settle, one final\n * replacement runs under the entity MUTATION lock (parks publish under it).\n */\nexport async function appendCanonicalizedTombstone(\n  stateDir: string,\n  input: { entityRef?: string; supersessionKey?: string },\n  currentIds: () => Readonly<Record<string, string>>,\n  append: (identity: TombstoneIdentity) => Promise<string | null>,\n  revoke: (tombstoneId: string) => Promise<unknown>,\n  label: string,\n): Promise<string | null> {\n  let refIds = currentIds();\n  let identity = canonicalizeTombstoneIdentity(input.entityRef, input.supersessionKey, refIds);\n  let result = await append(identity);\n  const replaceIfChanged = async (next: TombstoneIdentity): Promise<boolean> => {\n    if (next.entityRef === identity.entityRef && next.supersessionKey === identity.supersessionKey) {\n      return false;\n    }\n    identity = next;\n    const superseded = result;\n    result = await append(next);\n    if (superseded !== null) {\n      try {\n        await revoke(superseded);\n      } catch (err) {\n        log.warn(`failed to revoke superseded tombstone ${superseded} for ${label}: ${err}`);\n      }\n    }\n    return true;\n  };\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    const fresh = currentIds();\n    if (fresh === refIds) return result;\n    refIds = fresh;\n    if (!(await replaceIfChanged(canonicalizeTombstoneIdentity(input.entityRef, input.supersessionKey, fresh)))) {\n      return result;\n    }\n  }\n  await withEntityCanonicalMutationLock(stateDir, async () => {\n    await replaceIfChanged(canonicalizeTombstoneIdentity(input.entityRef, input.supersessionKey, currentIds()));\n  });\n  return result;\n}\n\n/**\n * Journal mapping table keyed by the journal FILE's identity, so a long-lived\n * StorageManager never canonicalizes against a stale snapshot after ANY other\n * writer changes the journal — a peer process completing a migration, or\n * `pruneBlocked()` parking a contested mapping (which rewrites the journal\n * without bumping any shared version). `writeState` publishes via\n * temp-file-plus-rename, so every journal write swaps the inode and the key\n * always moves — the identity is taken from the fstat of the SAME opened\n * inode the content is read from (no stat→read window). Reload cost is one\n * open per lookup and one journal parse per actual change.\n *\n * Failure semantics: last-known data is served ONLY for the SAME state dir\n * (module-level instances can face several stores — another store's table\n * must never leak in), and a failed read/parse never commits the journal's\n * identity, so the next lookup retries instead of caching an empty table\n * under a valid key.\n */\n\n/** Journal lookup result: mapping table plus its completion flag. */\nexport type HistoricalEntityIdsEntry = {\n  mappings: Readonly<Record<string, string>>;\n  complete: boolean;\n};\n\n\n\n/**\n * Memoized journal-completion view keyed on the journal file's stat identity.\n * entityList consults completion once per listed entity; without this each\n * consult re-opens and re-reads the journal (quadratic I/O on large corpora).\n */\nexport function memoizedJournalCompletion(\n  cache: HistoricalEntityCanonicalIdCache,\n  stateDir: () => string,\n): () => boolean {\n  let memo: { key: string; complete: boolean } | undefined;\n  return (): boolean => {\n    let key = \"missing\";\n    try {\n      const journalPath = path.join(stateDir(), ENTITY_CANONICAL_ID_MIGRATION_FILE);\n      const j = statSync(journalPath);\n      key = `${j.dev}:${j.ino}:${j.mtimeMs}:${j.ctimeMs}:${j.size}`;\n    } catch {\n      key = \"missing\";\n    }\n    if (memo && memo.key === key) return memo.complete;\n    const entry = cache.getEntry(stateDir());\n    memo = { key, complete: entry.complete };\n    return memo.complete;\n  };\n}\n\nexport class HistoricalEntityCanonicalIdCache {\n  private mappings: Readonly<Record<string, string>> = {};\n  private complete = false;\n  private key: string | null = null;\n  private stateDir: string | null = null;\n\n  get(stateDir: string): Readonly<Record<string, string>> {\n    return this.getEntry(stateDir).mappings;\n  }\n\n\n  /** Table plus the journal's completion flag, cached under one identity. */\n  getEntry(stateDir: string): HistoricalEntityIdsEntry {\n    const lastKnownMappings = this.stateDir === stateDir ? this.mappings : {};\n    const lastKnownComplete = this.stateDir === stateDir ? this.complete : false;\n    const lastKnown: HistoricalEntityIdsEntry = { mappings: lastKnownMappings, complete: lastKnownComplete };\n    const result = readJournalFileNoFollow(path.join(stateDir, ENTITY_CANONICAL_ID_MIGRATION_FILE));\n    if (result.kind === \"refused\") {\n      // Symlinked/non-regular journal: never follow it, never adopt its\n      // identity — serve this store's last-known table. If it later becomes\n      // a regular file its identity differs from the stored key and reloads.\n      log.warn(\"ignoring non-regular entity canonical-id journal (symlink refused)\");\n      return lastKnown;\n    }\n    if (result.kind === \"error\") {\n      // A TRANSIENT open/read failure (EACCES/EIO) must not dump a valid\n      // table for {}: a write during the outage would skip canonicalization\n      // AND its post-write identity check would compare equal. Serve this\n      // store's last-known table; only a genuine ENOENT means \"no journal\".\n      return lastKnown;\n    }\n    const key = result.kind === \"missing\" ? \"missing\" : result.key;\n    if (key !== this.key || stateDir !== this.stateDir) {\n      let table: Readonly<Record<string, string>> = {};\n      let complete = false;\n      if (result.kind === \"ok\") {\n        try {\n          table = parseJournalMappings(result.raw);\n          complete = parseJournalComplete(result.raw);\n        } catch {\n          // Parse failed under a VALID identity: do not commit the key —\n          // the next lookup retries instead of pinning an empty table.\n          return lastKnown;\n        }\n      }\n      this.mappings = table;\n      this.complete = complete;\n      this.key = key;\n      this.stateDir = stateDir;\n    }\n    return { mappings: this.mappings, complete: this.complete };\n  }\n}\n\nexport function resolveHistoricalEntityCanonicalId(\n  normalized: string,\n  mappings: Readonly<Record<string, string>>,\n): string {\n  let current = normalized;\n  const seen = new Set<string>();\n  while (!seen.has(current)) {\n    seen.add(current);\n    // Own properties only: an unmapped id like `constructor` must not read\n    // Object.prototype and return a function (Codex P2, round 20).\n    const next = Object.hasOwn(mappings, current) ? mappings[current] : undefined;\n    if (!next || next === current) break;\n    current = next;\n  }\n  return current;\n}\n\n/**\n * Canonicalize the `entityRef` a memory-write caller supplied (issue #2213).\n *\n * Extraction and capture callers pass whatever id the LLM or user produced,\n * which can name a legacy id this migration already renamed. Resolving at the\n * WRITE boundary means store-mediated writes can never re-introduce legacy\n * references — which is what let the completed migration retire its recurring\n * full-corpus reference rewrite. It also keeps write-time tombstone lookups on\n * the same id space as migrated tombstones. Unknown ids pass through verbatim.\n */\nexport function canonicalizeEntityRefOption<T extends { entityRef?: string }>(\n  options: T,\n  mappings: Readonly<Record<string, string>>,\n): T {\n  // Non-strings (absent, or a JS caller's null/junk) pass through untouched:\n  // this boundary canonicalizes ids, it does not take over input validation\n  // the write path never performed — serialization already drops falsy refs.\n  if (typeof options.entityRef !== \"string\") return options;\n  return { ...options, entityRef: resolveHistoricalEntityCanonicalId(options.entityRef, mappings) };\n}\n\n/**\n * Canonicalize the effective `entityRef:` line inside a raw memory record's\n * leading frontmatter block (issue #2213). Bulk writers that persist record\n * bytes verbatim — capsule import/merge — are a write boundary too: a capsule\n * can carry pre-migration memories whose refs the target's completed journal\n * already renamed, and no later reconciliation pass exists to absorb them.\n *\n * Line selection mirrors the frontmatter parser and the migration's own\n * serializer: the LAST `entityRef` key wins (indentation tolerated), its\n * indent is preserved, and CRLF records keep their line endings. The closing\n * delimiter must be a standalone `---` line. Non-frontmatter content, records\n * without an `entityRef` line, and ids the journal does not map all pass\n * through byte-identical.\n */\nexport function canonicalizeEntityRefFrontmatter(\n  content: string,\n  mappings: Readonly<Record<string, string>>,\n): string {\n  if (Object.keys(mappings).length === 0) return content;\n  const loc = locateEntityRefLine(content);\n  if (loc === null) return content;\n  const canonical = resolveHistoricalEntityCanonicalId(loc.value, mappings);\n  if (canonical === loc.value) return content;\n  const line = loc.lines[loc.index]!;\n  const indent = /^\\s*/.exec(line)?.[0] ?? \"\";\n  loc.lines[loc.index] = `${indent}entityRef: ${canonical}${line.endsWith(\"\\r\") ? \"\\r\" : \"\"}`;\n  return loc.lines.join(\"\\n\") + content.slice(loc.closeIndex);\n}\n\n/** The raw `entityRef` value in a record's leading frontmatter, or null. */\nexport function readEntityRefFromFrontmatter(content: string): string | null {\n  return locateEntityRefLine(content)?.value ?? null;\n}\n\nfunction locateEntityRefLine(\n  content: string,\n): { lines: string[]; index: number; value: string; closeIndex: number } | null {\n  if (!/^---\\r?\\n/.test(content)) return null;\n  const close = /\\r?\\n---(?:\\r?\\n|$)/g;\n  close.lastIndex = content.indexOf(\"\\n\") + 1;\n  const closeMatch = close.exec(content);\n  if (!closeMatch) return null;\n  const lines = content.slice(0, closeMatch.index).split(\"\\n\");\n  let index = -1;\n  for (let i = 1; i < lines.length; i += 1) {\n    if (/^\\s*entityRef\\s*:/.test(lines[i] ?? \"\")) index = i;\n  }\n  if (index === -1) return null;\n  const line = lines[index]!;\n  const value = line.slice(line.indexOf(\":\") + 1).replace(/\\r$/, \"\").trim();\n  if (value.length === 0) return null;\n  return { lines, index, value, closeIndex: closeMatch.index };\n}\n\n/**\n * Reconcile-pending marker (issue #2213). Raw-byte memory writers that CANNOT\n * canonicalize inline — offline-sync file replication (opaque, possibly\n * encrypted buffers), consolidation-undo restores, governance-run restores —\n * touch this marker instead. The next migration invocation honors it by\n * running ONE bounded reference-reconciliation pass over the completed\n * journal's retained mappings, then clears it. This replaces the retired\n * every-run corpus rewrite with a signal that fires only when a raw writer\n * actually landed unvetted bytes.\n */\nexport const ENTITY_CANONICAL_ID_RECONCILE_MARKER = \"entity-canonical-id-reconcile.pending\";\n/** The generation a migration run renamed aside for consumption; a crash can strand it. */\nexport const ENTITY_CANONICAL_ID_RECONCILE_CONSUMING_MARKER = `${ENTITY_CANONICAL_ID_RECONCILE_MARKER}.consuming`;\n\nexport function requestEntityCanonicalIdReconcileSync(stateDir: string): void {\n  const markerPath = path.join(stateDir, ENTITY_CANONICAL_ID_RECONCILE_MARKER);\n  const temporary = `${markerPath}.${process.pid}.${randomUUID()}.tmp`;\n  try {\n    // Never write THROUGH a symlinked marker OR a symlinked state dir (repo\n    // rule: reject symlink traversal from memory directories). The parent is\n    // lstat-verified as a real directory — direct restore/import callers can\n    // reach this helper without validateRoots() — and temp-file-plus-rename\n    // handles the final component: rename() replaces a planted link ITSELF\n    // rather than following it, with no O_NOFOLLOW dependency.\n    const parent = lstatSync(stateDir);\n    if (parent.isSymbolicLink() || !parent.isDirectory()) {\n      log.warn(`refusing to write entity canonical-id reconcile marker: ${stateDir} is not a real directory`);\n      return;\n    }\n    const parentRealPath = realpathSync(stateDir);\n    writeFileSync(temporary, `${new Date().toISOString()}\\n`, { mode: 0o600 });\n    // Revalidate the parent between the temp write and publication (Codex\n    // P2, round 20): a state-dir swapped for a symlink after the check above\n    // would have landed the temp file through the link. Node has no openat,\n    // so the residual window is the realpath→rename gap — this recheck\n    // reduces check-then-use to the platform primitive's own atomicity.\n    const recheck = lstatSync(stateDir);\n    if (recheck.isSymbolicLink() || !recheck.isDirectory() || realpathSync(stateDir) !== parentRealPath) {\n      rmSync(temporary, { force: true });\n      log.warn(`refusing to publish entity canonical-id reconcile marker: ${stateDir} changed during write`);\n      return;\n    }\n    renameSync(temporary, markerPath);\n  } catch (error) {\n    rmSync(temporary, { force: true });\n    // Best effort by design: a marker failure must not fail the restore/sync\n    // that requested it (AGENTS.md §4). The reference stays legacy-but-readable\n    // until the next mapping change.\n    log.warn(`could not request entity canonical-id reconcile: ${error}`);\n  }\n}\n\nexport async function requestEntityCanonicalIdReconcile(stateDir: string): Promise<void> {\n  requestEntityCanonicalIdReconcileSync(stateDir);\n}\n\n/**\n * Post-persist TOCTOU guard (issue #2213). A writer resolves `entityRef`\n * against one journal generation, then awaits (snapshots, locks, fsyncs)\n * before its bytes land — a peer migration can publish AND finish its final\n * reference scan inside that window, leaving the just-written file behind.\n * Callers pass the mapping table captured at resolve time plus a fresh cache\n * read taken AFTER the write: the cache returns the identical object while\n * the journal file is unchanged, so an identity mismatch means the journal\n * moved mid-write and one bounded reconcile pass is requested.\n */\nexport function reconcileIfJournalMovedSync(\n  stateDir: string,\n  idsAtResolve: Readonly<Record<string, string>>,\n  idsAfterWrite: Readonly<Record<string, string>>,\n): void {\n  if (idsAtResolve === idsAfterWrite) return;\n  requestEntityCanonicalIdReconcileSync(stateDir);\n}\n\nexport async function reconcileIfJournalMoved(\n  stateDir: string,\n  idsAtResolve: Readonly<Record<string, string>>,\n  idsAfterWrite: Readonly<Record<string, string>>,\n): Promise<void> {\n  reconcileIfJournalMovedSync(stateDir, idsAtResolve, idsAfterWrite);\n}\n\n/**\n * Classify a raw write target for entity-reference handling (issue #2213):\n * - `\"memory\"` — hot recall / cold / archive record whose FRONTMATTER\n *   `entityRef` the writer must canonicalize at the write (and repair after).\n * - `\"entity\"` — an `entities/` page. Its migrated surface is relationship\n *   TARGETS in the body, which only `rewriteRelationshipTargets` understands;\n *   raw writers persist bytes faithfully and request the bounded reconcile\n *   pass instead of attempting a frontmatter rewrite.\n * - `\"outside\"` — transcripts, profiles, runtime state, and every other file\n *   outside the migration's scan scope: write byte-identical, no marker.\n */\nexport type EntityRefWritePathKind = \"memory\" | \"entity\" | \"outside\";\n\nexport function classifyEntityRefWritePath(baseDir: string, filePath: string): EntityRefWritePathKind {\n  if (!filePath.endsWith(\".md\")) return \"outside\";\n  const rel = path.relative(baseDir, filePath);\n  if (rel.startsWith(\"..\") || path.isAbsolute(rel)) return \"outside\";\n  const top = rel.split(path.sep)[0] ?? \"\";\n  if (top === \"entities\") return \"entity\";\n  return RECALL_FALLBACK_DIRS.includes(top) || top === \"cold\" || top === \"archive\" ? \"memory\" : \"outside\";\n}\n\n/** True when `filePath` is in the migration's scan scope at all. */\nexport function pathMayCarryEntityRefs(baseDir: string, filePath: string): boolean {\n  return classifyEntityRefWritePath(baseDir, filePath) !== \"outside\";\n}\n\n/**\n * Canonicalize a tombstone's identity fields at the append chokepoint\n * (issue #2213): emitters (forget, temporal supersession, pattern\n * reinforcement, supersede) build inputs from records that may have been\n * read before a peer migration completed. The supersession key embeds the\n * NORMALIZED entity segment (`entity::attr`), so it is re-prefixed when the\n * ref moved — otherwise the keyed guard lands in the legacy id space while\n * write-time lookups canonicalize, and a paraphrase resurrects.\n */\nexport interface TombstoneIdentity {\n  entityRef: string | undefined;\n  supersessionKey: string | undefined;\n}\n\nexport function canonicalizeTombstoneIdentity(\n  entityRef: string | undefined,\n  supersessionKey: string | undefined,\n  refIds: Readonly<Record<string, string>>,\n): TombstoneIdentity {\n  if (typeof entityRef !== \"string\") return { entityRef, supersessionKey };\n  const canonical = resolveHistoricalEntityCanonicalId(entityRef, refIds);\n  if (canonical === entityRef) return { entityRef, supersessionKey };\n  if (supersessionKey) {\n    const stalePrefix = `${normalizeSupersessionKey(entityRef)}::`;\n    if (supersessionKey.startsWith(stalePrefix)) {\n      supersessionKey = `${normalizeSupersessionKey(canonical)}::${supersessionKey.slice(stalePrefix.length)}`;\n    }\n  }\n  return { entityRef: canonical, supersessionKey };\n}\n\n/**\n * Post-persist repair (issue #2213): when the journal moved across a persist,\n * re-resolve the caller's ORIGINAL ref against the fresh table and rewrite\n * the file in place (bounded). When the journal will not settle, take the\n * entity MUTATION lock — parks/removals (the direction the reconcile pass\n * cannot repair, because the removed mapping is gone from the table) publish\n * under it — settle once, then request the marker for additive moves only.\n */\nexport async function repairEntityRefAfterJournalMove(options: {\n  stateDir: string;\n  currentIds: () => Readonly<Record<string, string>>;\n  idsAtResolve: Readonly<Record<string, string>>;\n  rawRef: string;\n  frontmatter: { entityRef?: string };\n  rewrite: () => Promise<void>;\n}): Promise<void> {\n  let refIds = options.idsAtResolve;\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    const fresh = options.currentIds();\n    if (fresh === refIds) return;\n    refIds = fresh;\n    const desired = resolveHistoricalEntityCanonicalId(options.rawRef, fresh);\n    if (desired === options.frontmatter.entityRef) return;\n    options.frontmatter.entityRef = desired;\n    await options.rewrite();\n  }\n  await withEntityCanonicalMutationLock(options.stateDir, async () => {\n    const desired = resolveHistoricalEntityCanonicalId(options.rawRef, options.currentIds());\n    if (desired !== options.frontmatter.entityRef) {\n      options.frontmatter.entityRef = desired;\n      await options.rewrite();\n    }\n  });\n  await requestEntityCanonicalIdReconcile(options.stateDir);\n}\n\n/**\n * Content-form counterpart of {@link repairEntityRefAfterJournalMove} for\n * async writers that persist raw record bytes (capsule import/merge,\n * binary-lifecycle redirects): same bounded loop, same locked settle.\n */\nexport async function repairContentAfterJournalMove(options: {\n  stateDir: string;\n  cache: HistoricalEntityCanonicalIdCache;\n  idsAtWrite: Readonly<Record<string, string>>;\n  rawContent: string;\n  lastWritten: string;\n  rewrite: (content: string) => Promise<void>;\n}): Promise<void> {\n  let refIds = options.idsAtWrite;\n  let written = options.lastWritten;\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    const fresh = options.cache.get(options.stateDir);\n    if (fresh === refIds) return;\n    refIds = fresh;\n    const desired = canonicalizeEntityRefFrontmatter(options.rawContent, fresh);\n    if (desired === written) return;\n    written = desired;\n    await options.rewrite(desired);\n  }\n  await withEntityCanonicalMutationLock(options.stateDir, async () => {\n    const desired = canonicalizeEntityRefFrontmatter(options.rawContent, options.cache.get(options.stateDir));\n    if (desired !== written) {\n      written = desired;\n      await options.rewrite(desired);\n    }\n  });\n  await requestEntityCanonicalIdReconcile(options.stateDir);\n}\n\n/**\n * Sync variant (space promotion, curation, review actions). Sync callers\n * cannot take the async mutation lock, so exhaustion surfaces a retryable\n * error after requesting the marker — a silent return could leave the bytes\n * on a parked canonical claimant the reconcile pass cannot restore.\n */\nexport function repairContentAfterJournalMoveSync(options: {\n  stateDir: string;\n  cache: HistoricalEntityCanonicalIdCache;\n  idsAtWrite: Readonly<Record<string, string>>;\n  rawContent: string;\n  lastWritten: string;\n  rewrite: (content: string) => void;\n}): void {\n  let refIds = options.idsAtWrite;\n  let written = options.lastWritten;\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    const fresh = options.cache.get(options.stateDir);\n    if (fresh === refIds) return;\n    refIds = fresh;\n    const desired = canonicalizeEntityRefFrontmatter(options.rawContent, fresh);\n    if (desired === written) return;\n    written = desired;\n    options.rewrite(desired);\n  }\n  requestEntityCanonicalIdReconcileSync(options.stateDir);\n  throw new Error(\n    \"entity canonical-id journal kept changing during post-write repair; retry the write\",\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB,WAAW,oBAAoB;AACxD,OAAO,UAAU;AAIjB,IAAM,6CAA6C;AACnD,IAAM,gDAAgD;AAE/C,SAAS,iBAAiB,SAAiB,UAA2B;AAC3E,MAAI,KAAK,QAAQ,QAAQ,MAAM,MAAO,QAAO;AAC7C,QAAM,YAAY,KAAK,QAAQ,KAAK,QAAQ,QAAQ,CAAC;AACrD,QAAM,cAAc,KAAK,QAAQ,SAAS,UAAU;AACpD,MAAI,cAAc,YAAa,QAAO;AACtC,MAAI;AACF,WAAO,aAAa,SAAS,MAAM,KAAK,KAAK,aAAa,OAAO,GAAG,UAAU;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,wBAAwB,SAAiB,UAAwB;AACxE,qBAAmB,SAAS,cAAc;AAC1C,YAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AACvC,iBAAe,KAAK,KAAK,UAAU,8BAA8B,GAAG,GAAG;AACzE;AAEO,SAAS,gCACd,UACA,MACY;AACZ,QAAM,WAAW,KAAK,KAAK,UAAU,mCAAmC;AACxE,SAAO;AAAA,IAAmB;AAAA,IAAU,MAClC;AAAA,MACE;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,WAAW;AAAA,MACb;AAAA,MACA,OAAO,UAAU,SAAS;AACxB,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,6CAA6C;AAC5E,eAAO,KAAK,MAAM,KAAK,QAAQ,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,SACA,UACA,MACY;AACZ,MAAI,CAAC,iBAAiB,SAAS,QAAQ,GAAG;AACxC,WAAO,KAAK,YAAY,IAAI;AAAA,EAC9B;AACA,QAAM,WAAW,KAAK,KAAK,SAAS,OAAO;AAC3C,SAAO,gCAAgC,UAAU,OAAO,gBAAgB;AACtE,QAAI;AACF,aAAO,MAAM,KAAK,WAAW;AAAA,IAC/B,UAAE;AACA,8BAAwB,SAAS,QAAQ;AAAA,IAC3C;AAAA,EACF,CAAC;AACH;;;AC9DA,IAAM,2BAA2B;AAE1B,SAAS,mBAAmB,UAAwB;AACzD,MAAI,yBAAyB,KAAK,QAAQ,GAAG;AAC3C,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACF;;;ACNA,SAAS,gBAAgB;AAiBzB,OAAOA,WAAU;AACjB,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,gBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAQpB,IAAM,qCAAqC;AAOlD,SAAS,qBAAqB,KAA+C;AAC3E,QAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,KAAK,EAAE,cAAc,QAAS,QAAO,CAAC;AACvG,QAAM,WAAW,OAAO;AACxB,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AAGlF,QAAM,UAAkC,uBAAO,OAAO,IAAI;AAC1D,aAAW,CAAC,UAAU,WAAW,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC9D,QAAI,SAAS,SAAS,KAAK,OAAO,gBAAgB,YAAY,YAAY,SAAS,GAAG;AACpF,yBAAmB,QAAQ;AAC3B,yBAAmB,WAAW;AAC9B,cAAQ,QAAQ,IAAI;AAAA,IACtB;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,qBAAqB,KAAsB;AAElD,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,SAAO,WAAW,QAAQ,OAAO,aAAa;AAChD;AAkBA,SAAS,wBAAwB,WAAgC;AAC/D,MAAI;AACJ,MAAI;AACF,SAAK,SAAS,WAAW,UAAU,YAAY,UAAU,cAAc,EAAE;AAAA,EAC3E,SAAS,OAAO;AACd,QAAI,YAAY,OAAO,QAAQ,EAAG,QAAO,EAAE,MAAM,UAAU;AAC3D,QAAI,YAAY,OAAO,OAAO,EAAG,QAAO,EAAE,MAAM,UAAU;AAC1D,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,MAAI;AACF,UAAM,IAAI,UAAU,EAAE;AACtB,QAAI,CAAC,EAAE,OAAO,EAAG,QAAO,EAAE,MAAM,UAAU;AAC1C,UAAM,SAAS,UAAUC,MAAK,QAAQ,SAAS,CAAC;AAChD,QAAI,OAAO,eAAe,KAAK,CAAC,OAAO,YAAY,EAAG,QAAO,EAAE,MAAM,UAAU;AAC/E,UAAM,IAAI,UAAU,SAAS;AAC7B,QAAI,EAAE,eAAe,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAK,QAAO,EAAE,MAAM,UAAU;AACvF,WAAO;AAAA,MACL,MAAM;AAAA,MACN,KAAK,aAAa,IAAI,OAAO;AAAA,MAC7B,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,OAAO,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI;AAAA,IAC5D;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACF;AAGA,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,UAAU,EAAE,QAAQ,IAAI;AAAA,EACxB,uBAAuB,EAAE,OAAO;AAClC,CAAC;AAGD,eAAsB,oCACpB,UACA,iBACkB;AAClB,QAAM,SAAS,wBAAwBA,MAAK,KAAK,UAAU,kCAAkC,CAAC;AAC9F,MAAI,OAAO,SAAS,KAAM,QAAO;AACjC,MAAI;AACF,UAAM,SAAS,kCAAkC,UAAU,KAAK,MAAM,OAAO,GAAG,CAAC;AACjF,QAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,WAAO,OAAO,KAAK,0BAA0B,MAAM,gBAAgB;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAuBA,eAAsB,6BACpB,UACA,OACA,YACA,QACA,QACA,OACwB;AACxB,MAAI,SAAS,WAAW;AACxB,MAAI,WAAW,8BAA8B,MAAM,WAAW,MAAM,iBAAiB,MAAM;AAC3F,MAAI,SAAS,MAAM,OAAO,QAAQ;AAClC,QAAM,mBAAmB,OAAO,SAA8C;AAC5E,QAAI,KAAK,cAAc,SAAS,aAAa,KAAK,oBAAoB,SAAS,iBAAiB;AAC9F,aAAO;AAAA,IACT;AACA,eAAW;AACX,UAAM,aAAa;AACnB,aAAS,MAAM,OAAO,IAAI;AAC1B,QAAI,eAAe,MAAM;AACvB,UAAI;AACF,cAAM,OAAO,UAAU;AAAA,MACzB,SAAS,KAAK;AACZ,YAAI,KAAK,yCAAyC,UAAU,QAAQ,KAAK,KAAK,GAAG,EAAE;AAAA,MACrF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,QAAQ,WAAW;AACzB,QAAI,UAAU,OAAQ,QAAO;AAC7B,aAAS;AACT,QAAI,CAAE,MAAM,iBAAiB,8BAA8B,MAAM,WAAW,MAAM,iBAAiB,KAAK,CAAC,GAAI;AAC3G,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,gCAAgC,UAAU,YAAY;AAC1D,UAAM,iBAAiB,8BAA8B,MAAM,WAAW,MAAM,iBAAiB,WAAW,CAAC,CAAC;AAAA,EAC5G,CAAC;AACD,SAAO;AACT;AAiCO,SAAS,0BACd,OACA,UACe;AACf,MAAI;AACJ,SAAO,MAAe;AACpB,QAAI,MAAM;AACV,QAAI;AACF,YAAM,cAAcC,MAAK,KAAK,SAAS,GAAG,kCAAkC;AAC5E,YAAM,IAAI,SAAS,WAAW;AAC9B,YAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,OAAO,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI;AAAA,IAC7D,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,QAAQ,KAAK,QAAQ,IAAK,QAAO,KAAK;AAC1C,UAAM,QAAQ,MAAM,SAAS,SAAS,CAAC;AACvC,WAAO,EAAE,KAAK,UAAU,MAAM,SAAS;AACvC,WAAO,KAAK;AAAA,EACd;AACF;AAEO,IAAM,mCAAN,MAAuC;AAAA,EACpC,WAA6C,CAAC;AAAA,EAC9C,WAAW;AAAA,EACX,MAAqB;AAAA,EACrB,WAA0B;AAAA,EAElC,IAAI,UAAoD;AACtD,WAAO,KAAK,SAAS,QAAQ,EAAE;AAAA,EACjC;AAAA;AAAA,EAIA,SAAS,UAA4C;AACnD,UAAM,oBAAoB,KAAK,aAAa,WAAW,KAAK,WAAW,CAAC;AACxE,UAAM,oBAAoB,KAAK,aAAa,WAAW,KAAK,WAAW;AACvE,UAAM,YAAsC,EAAE,UAAU,mBAAmB,UAAU,kBAAkB;AACvG,UAAM,SAAS,wBAAwBA,MAAK,KAAK,UAAU,kCAAkC,CAAC;AAC9F,QAAI,OAAO,SAAS,WAAW;AAI7B,UAAI,KAAK,oEAAoE;AAC7E,aAAO;AAAA,IACT;AACA,QAAI,OAAO,SAAS,SAAS;AAK3B,aAAO;AAAA,IACT;AACA,UAAM,MAAM,OAAO,SAAS,YAAY,YAAY,OAAO;AAC3D,QAAI,QAAQ,KAAK,OAAO,aAAa,KAAK,UAAU;AAClD,UAAI,QAA0C,CAAC;AAC/C,UAAI,WAAW;AACf,UAAI,OAAO,SAAS,MAAM;AACxB,YAAI;AACF,kBAAQ,qBAAqB,OAAO,GAAG;AACvC,qBAAW,qBAAqB,OAAO,GAAG;AAAA,QAC5C,QAAQ;AAGN,iBAAO;AAAA,QACT;AAAA,MACF;AACA,WAAK,WAAW;AAChB,WAAK,WAAW;AAChB,WAAK,MAAM;AACX,WAAK,WAAW;AAAA,IAClB;AACA,WAAO,EAAE,UAAU,KAAK,UAAU,UAAU,KAAK,SAAS;AAAA,EAC5D;AACF;AAEO,SAAS,mCACd,YACA,UACQ;AACR,MAAI,UAAU;AACd,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,CAAC,KAAK,IAAI,OAAO,GAAG;AACzB,SAAK,IAAI,OAAO;AAGhB,UAAM,OAAO,OAAO,OAAO,UAAU,OAAO,IAAI,SAAS,OAAO,IAAI;AACpE,QAAI,CAAC,QAAQ,SAAS,QAAS;AAC/B,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAYO,SAAS,4BACd,SACA,UACG;AAIH,MAAI,OAAO,QAAQ,cAAc,SAAU,QAAO;AAClD,SAAO,EAAE,GAAG,SAAS,WAAW,mCAAmC,QAAQ,WAAW,QAAQ,EAAE;AAClG;AAgBO,SAAS,iCACd,SACA,UACQ;AACR,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG,QAAO;AAC/C,QAAM,MAAM,oBAAoB,OAAO;AACvC,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,YAAY,mCAAmC,IAAI,OAAO,QAAQ;AACxE,MAAI,cAAc,IAAI,MAAO,QAAO;AACpC,QAAM,OAAO,IAAI,MAAM,IAAI,KAAK;AAChC,QAAM,SAAS,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK;AACzC,MAAI,MAAM,IAAI,KAAK,IAAI,GAAG,MAAM,cAAc,SAAS,GAAG,KAAK,SAAS,IAAI,IAAI,OAAO,EAAE;AACzF,SAAO,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,MAAM,IAAI,UAAU;AAC5D;AAGO,SAAS,6BAA6B,SAAgC;AAC3E,SAAO,oBAAoB,OAAO,GAAG,SAAS;AAChD;AAEA,SAAS,oBACP,SAC8E;AAC9E,MAAI,CAAC,YAAY,KAAK,OAAO,EAAG,QAAO;AACvC,QAAM,QAAQ;AACd,QAAM,YAAY,QAAQ,QAAQ,IAAI,IAAI;AAC1C,QAAM,aAAa,MAAM,KAAK,OAAO;AACrC,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,QAAQ,QAAQ,MAAM,GAAG,WAAW,KAAK,EAAE,MAAM,IAAI;AAC3D,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,QAAI,oBAAoB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAG,SAAQ;AAAA,EACxD;AACA,MAAI,UAAU,GAAI,QAAO;AACzB,QAAM,OAAO,MAAM,KAAK;AACxB,QAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,EAAE,QAAQ,OAAO,EAAE,EAAE,KAAK;AACxE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,SAAO,EAAE,OAAO,OAAO,OAAO,YAAY,WAAW,MAAM;AAC7D;AAYO,IAAM,uCAAuC;AAE7C,IAAM,iDAAiD,GAAG,oCAAoC;AAE9F,SAAS,sCAAsC,UAAwB;AAC5E,QAAM,aAAaA,MAAK,KAAK,UAAU,oCAAoC;AAC3E,QAAM,YAAY,GAAG,UAAU,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC;AAC9D,MAAI;AAOF,UAAM,SAAS,UAAU,QAAQ;AACjC,QAAI,OAAO,eAAe,KAAK,CAAC,OAAO,YAAY,GAAG;AACpD,UAAI,KAAK,2DAA2D,QAAQ,0BAA0B;AACtG;AAAA,IACF;AACA,UAAM,iBAAiBC,cAAa,QAAQ;AAC5C,kBAAc,WAAW,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAMzE,UAAM,UAAU,UAAU,QAAQ;AAClC,QAAI,QAAQ,eAAe,KAAK,CAAC,QAAQ,YAAY,KAAKA,cAAa,QAAQ,MAAM,gBAAgB;AACnG,aAAO,WAAW,EAAE,OAAO,KAAK,CAAC;AACjC,UAAI,KAAK,6DAA6D,QAAQ,uBAAuB;AACrG;AAAA,IACF;AACA,eAAW,WAAW,UAAU;AAAA,EAClC,SAAS,OAAO;AACd,WAAO,WAAW,EAAE,OAAO,KAAK,CAAC;AAIjC,QAAI,KAAK,oDAAoD,KAAK,EAAE;AAAA,EACtE;AACF;AAEA,eAAsB,kCAAkC,UAAiC;AACvF,wCAAsC,QAAQ;AAChD;AAYO,SAAS,4BACd,UACA,cACA,eACM;AACN,MAAI,iBAAiB,cAAe;AACpC,wCAAsC,QAAQ;AAChD;AAuBO,SAAS,2BAA2B,SAAiB,UAA0C;AACpG,MAAI,CAAC,SAAS,SAAS,KAAK,EAAG,QAAO;AACtC,QAAM,MAAMC,MAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,IAAI,WAAW,IAAI,KAAKA,MAAK,WAAW,GAAG,EAAG,QAAO;AACzD,QAAM,MAAM,IAAI,MAAMA,MAAK,GAAG,EAAE,CAAC,KAAK;AACtC,MAAI,QAAQ,WAAY,QAAO;AAC/B,SAAO,qBAAqB,SAAS,GAAG,KAAK,QAAQ,UAAU,QAAQ,YAAY,WAAW;AAChG;AAGO,SAAS,uBAAuB,SAAiB,UAA2B;AACjF,SAAO,2BAA2B,SAAS,QAAQ,MAAM;AAC3D;AAgBO,SAAS,8BACd,WACA,iBACA,QACmB;AACnB,MAAI,OAAO,cAAc,SAAU,QAAO,EAAE,WAAW,gBAAgB;AACvE,QAAM,YAAY,mCAAmC,WAAW,MAAM;AACtE,MAAI,cAAc,UAAW,QAAO,EAAE,WAAW,gBAAgB;AACjE,MAAI,iBAAiB;AACnB,UAAM,cAAc,GAAG,yBAAyB,SAAS,CAAC;AAC1D,QAAI,gBAAgB,WAAW,WAAW,GAAG;AAC3C,wBAAkB,GAAG,yBAAyB,SAAS,CAAC,KAAK,gBAAgB,MAAM,YAAY,MAAM,CAAC;AAAA,IACxG;AAAA,EACF;AACA,SAAO,EAAE,WAAW,WAAW,gBAAgB;AACjD;AAUA,eAAsB,gCAAgC,SAOpC;AAChB,MAAI,SAAS,QAAQ;AACrB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,QAAQ,QAAQ,WAAW;AACjC,QAAI,UAAU,OAAQ;AACtB,aAAS;AACT,UAAM,UAAU,mCAAmC,QAAQ,QAAQ,KAAK;AACxE,QAAI,YAAY,QAAQ,YAAY,UAAW;AAC/C,YAAQ,YAAY,YAAY;AAChC,UAAM,QAAQ,QAAQ;AAAA,EACxB;AACA,QAAM,gCAAgC,QAAQ,UAAU,YAAY;AAClE,UAAM,UAAU,mCAAmC,QAAQ,QAAQ,QAAQ,WAAW,CAAC;AACvF,QAAI,YAAY,QAAQ,YAAY,WAAW;AAC7C,cAAQ,YAAY,YAAY;AAChC,YAAM,QAAQ,QAAQ;AAAA,IACxB;AAAA,EACF,CAAC;AACD,QAAM,kCAAkC,QAAQ,QAAQ;AAC1D;AAOA,eAAsB,8BAA8B,SAOlC;AAChB,MAAI,SAAS,QAAQ;AACrB,MAAI,UAAU,QAAQ;AACtB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,QAAQ,QAAQ,MAAM,IAAI,QAAQ,QAAQ;AAChD,QAAI,UAAU,OAAQ;AACtB,aAAS;AACT,UAAM,UAAU,iCAAiC,QAAQ,YAAY,KAAK;AAC1E,QAAI,YAAY,QAAS;AACzB,cAAU;AACV,UAAM,QAAQ,QAAQ,OAAO;AAAA,EAC/B;AACA,QAAM,gCAAgC,QAAQ,UAAU,YAAY;AAClE,UAAM,UAAU,iCAAiC,QAAQ,YAAY,QAAQ,MAAM,IAAI,QAAQ,QAAQ,CAAC;AACxG,QAAI,YAAY,SAAS;AACvB,gBAAU;AACV,YAAM,QAAQ,QAAQ,OAAO;AAAA,IAC/B;AAAA,EACF,CAAC;AACD,QAAM,kCAAkC,QAAQ,QAAQ;AAC1D;AAQO,SAAS,kCAAkC,SAOzC;AACP,MAAI,SAAS,QAAQ;AACrB,MAAI,UAAU,QAAQ;AACtB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,QAAQ,QAAQ,MAAM,IAAI,QAAQ,QAAQ;AAChD,QAAI,UAAU,OAAQ;AACtB,aAAS;AACT,UAAM,UAAU,iCAAiC,QAAQ,YAAY,KAAK;AAC1E,QAAI,YAAY,QAAS;AACzB,cAAU;AACV,YAAQ,QAAQ,OAAO;AAAA,EACzB;AACA,wCAAsC,QAAQ,QAAQ;AACtD,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;","names":["path","realpathSync","path","path","realpathSync","path"]}

package/dist/{chunk-6TIVVOVU.js → chunk-BNJAVRNJ.js}

@@ -3,7 +3,7 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-HCPVL6SF.js";
+} from "./chunk-SJTSWG2Z.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -14,7 +14,7 @@ import {
 } from "./chunk-CMTINOFS.js";
 import {
   summarizeCorpusAndReplica
-} from "./chunk-3PVKV3XL.js";
+} from "./chunk-UNOAVHV4.js";
 import {
   readJudgeVerdictStats
 } from "./chunk-OZKOPQCM.js";
@@ -32,23 +32,23 @@ import {
 } from "./chunk-2DQ2XREU.js";
 import {
   runConsolidationProvenanceCheck
-} from "./chunk-OOOX5C4X.js";
+} from "./chunk-XL2EE5W3.js";
 import {
   reportBufferSurpriseDistribution
 } from "./chunk-YBPYIAA5.js";
 import {
   parseConfig
-} from "./chunk-KNCR7APE.js";
+} from "./chunk-QTDZ2NYC.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-PBWJVRKE.js";
+} from "./chunk-5FUDSK6Z.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-YY6PWFUC.js";
+} from "./chunk-M6TP6UYD.js";
 import {
   listNamespaces
-} from "./chunk-QFTNWDJ6.js";
+} from "./chunk-YECEEJUU.js";
 import {
   analyzeGraphHealth
 } from "./chunk-KRAMCBIW.js";
@@ -57,7 +57,7 @@ import {
 } from "./chunk-AWD36R4D.js";
 import {
   StorageManager
-} from "./chunk-6W3QH3QW.js";
+} from "./chunk-GQIYL7OD.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -1683,4 +1683,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-6TIVVOVU.js.map
+//# sourceMappingURL=chunk-BNJAVRNJ.js.map

package/dist/{chunk-CMOYD5CA.js → chunk-CCL2OXFO.js}

@@ -2,7 +2,7 @@ import {
   OFFLINE_SYNC_SNAPSHOT_FORMAT,
   filterOfflineSyncDeletionRevisions,
   iterateOfflineSyncSnapshotFileRecords
-} from "./chunk-SA6P2KS3.js";
+} from "./chunk-TEH5MDX5.js";
 import {
   computeOmittedEmbeddingGenerationPaths,
   embeddingGenerationMembership
@@ -61,4 +61,4 @@ async function buildEmbeddingAwareSnapshotStream(options) {
 export {
   buildEmbeddingAwareSnapshotStream
 };
-//# sourceMappingURL=chunk-CMOYD5CA.js.map
+//# sourceMappingURL=chunk-CCL2OXFO.js.map

package/dist/{chunk-7XFQSQYS.js → chunk-CRN3EPE2.js}

@@ -1,6 +1,6 @@
 import {
   getOperation
-} from "./chunk-O4CA53UY.js";
+} from "./chunk-IMKOJVD4.js";
 import {
   EngramAccessInputError
 } from "./chunk-3MUKQQ7A.js";
@@ -13,7 +13,8 @@ async function respondBriefingHttp(options) {
   }
   const output = await op.run(options.gatedBody, {
     service: options.service,
-    authenticatedPrincipal: options.principal
+    authenticatedPrincipal: options.principal,
+    abortSignal: options.abortSignal
   });
   options.respondJson(200, output.result);
 }
@@ -21,4 +22,4 @@ async function respondBriefingHttp(options) {
 export {
   respondBriefingHttp
 };
-//# sourceMappingURL=chunk-7XFQSQYS.js.map
+//# sourceMappingURL=chunk-CRN3EPE2.js.map

package/dist/chunk-CRN3EPE2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-http-briefing.ts"],"sourcesContent":["import { getOperation } from \"./access-boundary.js\";\nimport { EngramAccessInputError, type EngramAccessService } from \"./access-service.js\";\n\ntype JsonResponder = (status: number, payload: unknown) => void;\n\nexport interface BriefingHttpOptions {\n  /** Request body already run through the namespace gate (gatedBodyNamespace). */\n  gatedBody: Record<string, unknown>;\n  service: EngramAccessService;\n  principal: string | undefined;\n  respondJson: JsonResponder;\n  /** HTTP request lifetime; aborting it stops the briefing (issue #3139). */\n  abortSignal?: AbortSignal;\n}\n\n/**\n * POST /engram/v1/briefing — daily briefing over the access HTTP boundary.\n *\n * Dispatches the registered `briefing` boundary operation (the one the MCP\n * tool uses) so schema validation, namespace gating, and principal\n * propagation reach every HTTP briefing call — the same shape as the\n * coding/delta read dispatch. Pure read: nothing persists, so no\n * write-quota accounting. The operation result already carries both\n * renderings (markdown + json sections) in one response, letting thin\n * clients render without a CLI subprocess.\n */\nexport async function respondBriefingHttp(options: BriefingHttpOptions): Promise<void> {\n  const op = getOperation(\"briefing\");\n  if (!op) {\n    throw new EngramAccessInputError(\"access-boundary: operation not registered: briefing\");\n  }\n  // SAFETY: the built-in briefing operation returns { result }; this adapter passes it through unchanged.\n  const output = (await op.run(options.gatedBody, {\n    service: options.service,\n    authenticatedPrincipal: options.principal,\n    abortSignal: options.abortSignal,\n  })) as { result: unknown };\n  options.respondJson(200, output.result);\n}\n"],"mappings":";;;;;;;;AA0BA,eAAsB,oBAAoB,SAA6C;AACrF,QAAM,KAAK,aAAa,UAAU;AAClC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,uBAAuB,qDAAqD;AAAA,EACxF;AAEA,QAAM,SAAU,MAAM,GAAG,IAAI,QAAQ,WAAW;AAAA,IAC9C,SAAS,QAAQ;AAAA,IACjB,wBAAwB,QAAQ;AAAA,IAChC,aAAa,QAAQ;AAAA,EACvB,CAAC;AACD,UAAQ,YAAY,KAAK,OAAO,MAAM;AACxC;","names":[]}

package/dist/{chunk-3NYIXVCT.js → chunk-DMKTOCC7.js}

@@ -1,7 +1,7 @@
 import {
   canonicalCategoryForAlias,
   categoryAliasCoercion
-} from "./chunk-BMG3SAXA.js";
+} from "./chunk-Z5277JWF.js";
 
 // src/access-observe-write-category.ts
 function splitCanonicalWriteRequest(request) {
@@ -22,4 +22,4 @@ function splitCanonicalWriteRequest(request) {
 export {
   splitCanonicalWriteRequest
 };
-//# sourceMappingURL=chunk-3NYIXVCT.js.map
+//# sourceMappingURL=chunk-DMKTOCC7.js.map

package/dist/chunk-DMKTOCC7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-observe-write-category.ts"],"sourcesContent":["/**\n * Category-alias split + replay restamp for observe/write (#2829).\n * Extracted from access-observe-write-surface.ts to stay under the 1200-line cap.\n *\n * The wire schema already maps an alias to \"fact\". `rawCategory` is the\n * caller's spelling: it must not reach the write candidate or fingerprint,\n * and a replay must rebuild the note from THIS request's spelling.\n */\nimport {\n  canonicalCategoryForAlias,\n  categoryAliasCoercion,\n  reapplyCategoryCoercion,\n  type CategoryAliasCoercion,\n  type MemoryCategoryAlias,\n} from \"./access-schema.js\";\n\nexport { reapplyCategoryCoercion };\nexport { buildWithBriefingLocation } from \"./location/tagging.js\";\n\nexport function splitCanonicalWriteRequest<T extends { rawCategory?: string; category?: string }>(\n  request: T,\n): {\n  canonical: Omit<T, \"rawCategory\">;\n  categoryCoercion: CategoryAliasCoercion | undefined;\n} {\n  const { rawCategory, ...canonical } = request;\n  // #2962: a direct service caller bypasses the wire schema, so an accepted\n  // alias can still sit on `category`. Canonicalize it at the same boundary\n  // the schema's transform covers for HTTP/MCP/CLI, minting the retained\n  // spelling from the request itself. A schema-minted `rawCategory` always\n  // wins (it names the spelling the transform actually canonicalized);\n  // near-misses pass through untouched and reject at the write candidate\n  // with the attempted category echoed.\n  if (rawCategory === undefined && typeof canonical.category === \"string\") {\n    const mapped = canonicalCategoryForAlias(canonical.category);\n    if (mapped !== undefined) {\n      const from = canonical.category as MemoryCategoryAlias;\n      return {\n        canonical: { ...canonical, category: mapped } as Omit<T, \"rawCategory\">,\n        categoryCoercion: { from, to: mapped },\n      };\n    }\n  }\n  return { canonical, categoryCoercion: categoryAliasCoercion(rawCategory) };\n}\n"],"mappings":";;;;;;AAmBO,SAAS,2BACd,SAIA;AACA,QAAM,EAAE,aAAa,GAAG,UAAU,IAAI;AAQtC,MAAI,gBAAgB,UAAa,OAAO,UAAU,aAAa,UAAU;AACvE,UAAM,SAAS,0BAA0B,UAAU,QAAQ;AAC3D,QAAI,WAAW,QAAW;AACxB,YAAM,OAAO,UAAU;AACvB,aAAO;AAAA,QACL,WAAW,EAAE,GAAG,WAAW,UAAU,OAAO;AAAA,QAC5C,kBAAkB,EAAE,MAAM,IAAI,OAAO;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,WAAW,kBAAkB,sBAAsB,WAAW,EAAE;AAC3E;","names":[]}

package/dist/{chunk-FRXS6SC7.js → chunk-EKUI7I2X.js}

@@ -76,6 +76,9 @@ async function safeReadMemories(storage, window, options = {}) {
     resultCount = memories.length;
     return memories;
   } catch (err) {
+    if (isAbortError(err) && options.signal?.aborted) {
+      throw err;
+    }
     if (err instanceof BriefingReadTimedOut) {
       outcome = "timeout";
       bestEffortLog(
@@ -99,7 +102,9 @@ async function safeReadMemories(storage, window, options = {}) {
 }
 async function readBriefingMemories(storage, window, mode, options) {
   if (mode === "windowed") {
-    const result = await storage.readMemoriesWindow({ updatedAfter: window.from });
+    const readOptions = { updatedAfter: window.from };
+    if (options.signal) readOptions.abortSignal = options.signal;
+    const result = await storage.readMemoriesWindow(readOptions);
     return result.memories;
   }
   const isCancellable = storage.supportsAbortSignal === true || storage.supportsCancellation === true || storage.cancellable === true || storage.readAllMemories?.supportsAbortSignal === true;
@@ -113,8 +118,9 @@ async function readBriefingMemories(storage, window, mode, options) {
     deadlineFired = true;
     controller.abort();
   }, deadlineMs);
+  const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
   try {
-    const memories = await storage.readAllMemories({ abortSignal: controller.signal });
+    const memories = await storage.readAllMemories({ abortSignal: signal });
     if (deadlineFired) {
       throw new BriefingReadTimedOut(deadlineMs);
     }
@@ -126,9 +132,19 @@ async function readBriefingMemories(storage, window, mode, options) {
     clearTimeout(timer);
   }
 }
+async function safeReadEntities(storage, signal) {
+  try {
+    return await storage.readAllEntityFiles({ abortSignal: signal });
+  } catch (err) {
+    if (isAbortError(err) && signal.aborted) throw err;
+    log.warn(`briefing: readAllEntityFiles failed: ${err}`);
+    return [];
+  }
+}
 
 export {
   BRIEFING_FULL_READ_FALLBACK_MS,
-  safeReadMemories
+  safeReadMemories,
+  safeReadEntities
 };
-//# sourceMappingURL=chunk-FRXS6SC7.js.map
+//# sourceMappingURL=chunk-EKUI7I2X.js.map

package/dist/chunk-EKUI7I2X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/briefing-window.ts"],"sourcesContent":["import { log } from \"./logger.js\";\nimport type { EntityFile, MemoryFile } from \"./types.js\";\nimport { isAbortError } from \"./abort-error.js\";\nimport type { CorpusReadOptions } from \"./corpus-read-cancellation.js\";\nimport type { ParsedBriefingWindow } from \"./briefing.js\";\nimport type { WindowedMemoryReadOptions } from \"./storage/windowed-memory-read.js\";\n\ntype BriefingMemoryReader = {\n  readMemoriesWindow?: (options: WindowedMemoryReadOptions) => Promise<{ memories: MemoryFile[] }>;\n  readAllMemories: ((options?: CorpusReadOptions) => Promise<MemoryFile[]>) & {\n    supportsAbortSignal?: boolean;\n  };\n  supportsAbortSignal?: boolean;\n  supportsCancellation?: boolean;\n  cancellable?: boolean;\n};\n\n/**\n * Deadline for the legacy full-read fallback (issue #2779). Storage doubles\n * that predate `readMemoriesWindow()` can only answer with a full-corpus\n * `readAllMemories()`, which is unbounded work; on a large corpus that read\n * alone can outlast the 60s MCP client timeout. Arm an AbortController with\n * this budget (well under 60s, leaving room for entity reads and follow-ups)\n * and fail open with an empty read. The deadline reaches the read as an\n * abort signal (the #2307 corpus-read contract), so the scan stops at its\n * next boundary instead of being abandoned to run on in the background.\n */\nexport const BRIEFING_FULL_READ_FALLBACK_MS = 30_000;\n\n/** Options for {@link safeReadMemories}. */\nexport interface SafeReadMemoriesOptions {\n  /** Test seam overriding {@link BRIEFING_FULL_READ_FALLBACK_MS}. */\n  fallbackDeadlineMs?: number;\n  /**\n   * Caller cancellation. The signal reaches the storage read so it stops at\n   * its next boundary, and a cancelled read is rethrown rather than degraded\n   * into an empty corpus (issue #3139).\n   */\n  signal?: AbortSignal;\n}\n\ntype BriefingReadMode = \"windowed\" | \"full-read-fallback\";\ntype BriefingReadOutcome = \"success\" | \"timeout\" | \"error\";\n\n/** Internal marker: the fallback deadline fired and the read was aborted. */\nclass BriefingReadTimedOut extends Error {\n  constructor(readonly deadlineMs: number) {\n    super(\"briefing full-read fallback timed out\");\n    this.name = \"BriefingReadTimedOut\";\n  }\n}\n\n/** Internal marker: the adapter's readAllMemories predates the signal contract. */\nclass LegacyReadUnsupported extends Error {\n  constructor() {\n    super(\"readAllMemories does not accept an abort signal\");\n    this.name = \"LegacyReadUnsupported\";\n  }\n}\n\nconst SAFE_ERROR_CLASSES: Record<string, true> = {\n  Error: true,\n  TypeError: true,\n  RangeError: true,\n  ReferenceError: true,\n  SyntaxError: true,\n  URIError: true,\n  EvalError: true,\n  AggregateError: true,\n  AbortError: true,\n  TimeoutError: true,\n  SystemError: true,\n  BriefingReadTimedOut: true,\n  LegacyReadUnsupported: true,\n  StorageError: true,\n  EngramAccessInputError: true,\n};\n\n/**\n * Sanitize adapter-controlled Error.name before structured discriminator logs\n * (issue #2827). Allow-lists known system/remnic error names and maps any\n * unrecognized or backend-controlled names to a safe bounded class (\"CustomError\").\n */\nfunction errorClass(err: unknown): string {\n  if (err instanceof Error) {\n    const name = err.name;\n    if (typeof name === \"string\" && SAFE_ERROR_CLASSES[name] === true) {\n      return name;\n    }\n    return \"CustomError\";\n  }\n  return typeof err === \"string\"\n    ? \"string\"\n    : typeof err === \"object\" && err !== null\n      ? \"object\"\n      : typeof err;\n}\n\nfunction bestEffortLog(level: \"info\" | \"warn\", message: string): void {\n  try {\n    log[level](message);\n  } catch {\n    // Diagnostics must never turn a successful or fail-open briefing read into\n    // a request failure when a host logger transport is unavailable.\n  }\n}\n\n/**\n * One structured, content-free discriminator per briefing memory read\n * (issue #2779): `mode`, `durationMs`, `count` when known, `outcome`, and on\n * failure a safe error class — never error messages or memory content.\n */\nfunction logBriefingMemoryRead(\n  mode: BriefingReadMode,\n  outcome: BriefingReadOutcome,\n  durationMs: number,\n  resultCount: number | undefined,\n  errClass: string | undefined,\n): void {\n  const fields = [\n    `mode=${mode}`,\n    `durationMs=${durationMs}`,\n    ...(resultCount === undefined ? [] : [`count=${resultCount}`]),\n    `outcome=${outcome}`,\n    ...(errClass === undefined ? [] : [`err=${errClass}`]),\n  ];\n  bestEffortLog(\"info\", `briefing: memory read ${fields.join(\" \")}`);\n}\n\n/** Read only the memories needed by a briefing, with compatibility fallback. */\nexport async function safeReadMemories(\n  storage: BriefingMemoryReader,\n  window: ParsedBriefingWindow,\n  options: SafeReadMemoriesOptions = {},\n): Promise<MemoryFile[]> {\n  const startedAt = Date.now();\n  const mode: BriefingReadMode =\n    typeof storage.readMemoriesWindow === \"function\" ? \"windowed\" : \"full-read-fallback\";\n  let outcome: BriefingReadOutcome = \"error\";\n  let resultCount: number | undefined;\n  let errClass: string | undefined;\n  try {\n    const memories = await readBriefingMemories(storage, window, mode, options);\n    outcome = \"success\";\n    resultCount = memories.length;\n    return memories;\n  } catch (err) {\n    if (isAbortError(err) && options.signal?.aborted) {\n      // Caller cancellation is not a read failure: rethrow it so the briefing\n      // rejects instead of degrading into an empty corpus (issue #3139). The\n      // own fallback deadline is reported as BriefingReadTimedOut below.\n      throw err;\n    }\n    if (err instanceof BriefingReadTimedOut) {\n      outcome = \"timeout\";\n      bestEffortLog(\n        \"warn\",\n        `briefing: memory read mode=full-read-fallback timed out after ${err.deadlineMs}ms — ` +\n          `returning no memories (storage adapter lacks readMemoriesWindow; upgrade it to ` +\n          `windowed or signal-aware reads)`,\n      );\n    } else if (err instanceof LegacyReadUnsupported) {\n      errClass = errorClass(err);\n      bestEffortLog(\n        \"warn\",\n        `briefing: memory read mode=full-read-fallback refused: readAllMemories() takes no abort ` +\n          `signal, so its scan could not be stopped at the deadline — returning no memories ` +\n          `(upgrade the storage adapter to readMemoriesWindow or a signal-aware readAllMemories)`,\n      );\n    } else {\n      errClass = errorClass(err);\n      bestEffortLog(\"warn\", `briefing: read memories failed (${errClass}) — returning no memories`);\n    }\n    return [];\n  } finally {\n    logBriefingMemoryRead(mode, outcome, Date.now() - startedAt, resultCount, errClass);\n  }\n}\n\nasync function readBriefingMemories(\n  storage: BriefingMemoryReader,\n  window: ParsedBriefingWindow,\n  mode: BriefingReadMode,\n  options: SafeReadMemoriesOptions,\n): Promise<MemoryFile[]> {\n  // A briefing only needs memories inside its lookback window. Avoid parsing\n  // the full corpus on cache misses; keep the full-read fallback for custom\n  // StorageManager-compatible callers that predate readMemoriesWindow().\n  if (mode === \"windowed\") {\n    const readOptions: WindowedMemoryReadOptions = { updatedAfter: window.from };\n    if (options.signal) readOptions.abortSignal = options.signal;\n    const result = await storage.readMemoriesWindow!(readOptions);\n    return result.memories;\n  }\n  // Refuse legacy adapters that do not explicitly declare cancellation support (#2827).\n  // Require affirmative cancellation support (`true` on one explicit marker) before fallback.\n  // Do not rely on Function.length, which is zero for default/rest/bound functions.\n  const isCancellable =\n    storage.supportsAbortSignal === true ||\n    storage.supportsCancellation === true ||\n    storage.cancellable === true ||\n    storage.readAllMemories?.supportsAbortSignal === true;\n  if (!isCancellable) {\n    throw new LegacyReadUnsupported();\n  }\n  const deadlineMs = options.fallbackDeadlineMs ?? BRIEFING_FULL_READ_FALLBACK_MS;\n  const controller = new AbortController();\n  let deadlineFired = false;\n  const timer = setTimeout(() => {\n    deadlineFired = true;\n    controller.abort();\n  }, deadlineMs);\n  const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;\n  try {\n    // Direct await, no Promise.race: the signal IS the deadline. A\n    // signal-aware read settles on abort (AbortError at its next scan\n    // boundary, #2307), so nothing is left scanning in the background once\n    // this function returns.\n    const memories = await storage.readAllMemories({ abortSignal: signal });\n    if (deadlineFired) {\n      // A double that resolves partial rows instead of rejecting on abort\n      // must not have them served as a complete corpus.\n      throw new BriefingReadTimedOut(deadlineMs);\n    }\n    return memories;\n  } catch (err) {\n    if (isAbortError(err) && deadlineFired) throw new BriefingReadTimedOut(deadlineMs);\n    throw err;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport async function safeReadEntities(\n  storage: { readAllEntityFiles(options?: CorpusReadOptions): Promise<EntityFile[]> },\n  signal: AbortSignal,\n): Promise<EntityFile[]> {\n  try {\n    return await storage.readAllEntityFiles({ abortSignal: signal });\n  } catch (err) {\n    if (isAbortError(err) && signal.aborted) throw err;\n    log.warn(`briefing: readAllEntityFiles failed: ${err}`);\n    return [];\n  }\n}\n"],"mappings":";;;;;;;;AA2BO,IAAM,iCAAiC;AAkB9C,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACvC,YAAqB,YAAoB;AACvC,UAAM,uCAAuC;AAD1B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAGA,IAAM,wBAAN,cAAoC,MAAM;AAAA,EACxC,cAAc;AACZ,UAAM,iDAAiD;AACvD,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,qBAA2C;AAAA,EAC/C,OAAO;AAAA,EACP,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,UAAU;AAAA,EACV,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,cAAc;AAAA,EACd,wBAAwB;AAC1B;AAOA,SAAS,WAAW,KAAsB;AACxC,MAAI,eAAe,OAAO;AACxB,UAAM,OAAO,IAAI;AACjB,QAAI,OAAO,SAAS,YAAY,mBAAmB,IAAI,MAAM,MAAM;AACjE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO,QAAQ,WAClB,WACA,OAAO,QAAQ,YAAY,QAAQ,OACjC,WACA,OAAO;AACf;AAEA,SAAS,cAAc,OAAwB,SAAuB;AACpE,MAAI;AACF,QAAI,KAAK,EAAE,OAAO;AAAA,EACpB,QAAQ;AAAA,EAGR;AACF;AAOA,SAAS,sBACP,MACA,SACA,YACA,aACA,UACM;AACN,QAAM,SAAS;AAAA,IACb,QAAQ,IAAI;AAAA,IACZ,cAAc,UAAU;AAAA,IACxB,GAAI,gBAAgB,SAAY,CAAC,IAAI,CAAC,SAAS,WAAW,EAAE;AAAA,IAC5D,WAAW,OAAO;AAAA,IAClB,GAAI,aAAa,SAAY,CAAC,IAAI,CAAC,OAAO,QAAQ,EAAE;AAAA,EACtD;AACA,gBAAc,QAAQ,yBAAyB,OAAO,KAAK,GAAG,CAAC,EAAE;AACnE;AAGA,eAAsB,iBACpB,SACA,QACA,UAAmC,CAAC,GACb;AACvB,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,OACJ,OAAO,QAAQ,uBAAuB,aAAa,aAAa;AAClE,MAAI,UAA+B;AACnC,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,MAAM,qBAAqB,SAAS,QAAQ,MAAM,OAAO;AAC1E,cAAU;AACV,kBAAc,SAAS;AACvB,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,KAAK,QAAQ,QAAQ,SAAS;AAIhD,YAAM;AAAA,IACR;AACA,QAAI,eAAe,sBAAsB;AACvC,gBAAU;AACV;AAAA,QACE;AAAA,QACA,iEAAiE,IAAI,UAAU;AAAA,MAGjF;AAAA,IACF,WAAW,eAAe,uBAAuB;AAC/C,iBAAW,WAAW,GAAG;AACzB;AAAA,QACE;AAAA,QACA;AAAA,MAGF;AAAA,IACF,OAAO;AACL,iBAAW,WAAW,GAAG;AACzB,oBAAc,QAAQ,mCAAmC,QAAQ,gCAA2B;AAAA,IAC9F;AACA,WAAO,CAAC;AAAA,EACV,UAAE;AACA,0BAAsB,MAAM,SAAS,KAAK,IAAI,IAAI,WAAW,aAAa,QAAQ;AAAA,EACpF;AACF;AAEA,eAAe,qBACb,SACA,QACA,MACA,SACuB;AAIvB,MAAI,SAAS,YAAY;AACvB,UAAM,cAAyC,EAAE,cAAc,OAAO,KAAK;AAC3E,QAAI,QAAQ,OAAQ,aAAY,cAAc,QAAQ;AACtD,UAAM,SAAS,MAAM,QAAQ,mBAAoB,WAAW;AAC5D,WAAO,OAAO;AAAA,EAChB;AAIA,QAAM,gBACJ,QAAQ,wBAAwB,QAChC,QAAQ,yBAAyB,QACjC,QAAQ,gBAAgB,QACxB,QAAQ,iBAAiB,wBAAwB;AACnD,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,sBAAsB;AAAA,EAClC;AACA,QAAM,aAAa,QAAQ,sBAAsB;AACjD,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,gBAAgB;AACpB,QAAM,QAAQ,WAAW,MAAM;AAC7B,oBAAgB;AAChB,eAAW,MAAM;AAAA,EACnB,GAAG,UAAU;AACb,QAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,WAAW,MAAM,CAAC,IAAI,WAAW;AAClG,MAAI;AAKF,UAAM,WAAW,MAAM,QAAQ,gBAAgB,EAAE,aAAa,OAAO,CAAC;AACtE,QAAI,eAAe;AAGjB,YAAM,IAAI,qBAAqB,UAAU;AAAA,IAC3C;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,KAAK,cAAe,OAAM,IAAI,qBAAqB,UAAU;AACjF,UAAM;AAAA,EACR,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAEA,eAAsB,iBACpB,SACA,QACuB;AACvB,MAAI;AACF,WAAO,MAAM,QAAQ,mBAAmB,EAAE,aAAa,OAAO,CAAC;AAAA,EACjE,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,KAAK,OAAO,QAAS,OAAM;AAC/C,QAAI,KAAK,wCAAwC,GAAG,EAAE;AACtD,WAAO,CAAC;AAAA,EACV;AACF;","names":[]}

package/dist/{chunk-N6EM7ESC.js → chunk-EKYWZYZJ.js}

@@ -18,13 +18,13 @@ import {
 } from "./chunk-3HSRWJTC.js";
 import {
   respondDeepRecall
-} from "./chunk-CPBYKOTC.js";
+} from "./chunk-6ZQX3R66.js";
 import {
   handleSupportPassportOwnerHttp
-} from "./chunk-LCHFINL4.js";
+} from "./chunk-N7FNCE7F.js";
 import {
   buildSupportPassportPublicRequestHandler
-} from "./chunk-FOKTW6GY.js";
+} from "./chunk-EWBXMGXR.js";
 import {
   handleMcpGetSse
 } from "./chunk-SRT6SHVZ.js";
@@ -37,14 +37,14 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-OD7ZXCUF.js";
+} from "./chunk-UXGXJUZ5.js";
 import {
   handleRecallWhyHttpQuery,
   handleRecallXrayHttpQuery
 } from "./chunk-FC3ZFEXF.js";
 import {
   RelayMissionStoreError
-} from "./chunk-KMTMMBEB.js";
+} from "./chunk-ZNRTHYYW.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -61,10 +61,10 @@ import {
   optionalNamespaceKindQueryParam,
   optionalQueryString,
   positiveIntQueryParam
-} from "./chunk-V4GPFCJ7.js";
+} from "./chunk-5G53JSRO.js";
 import {
   respondBriefingHttp
-} from "./chunk-7XFQSQYS.js";
+} from "./chunk-CRN3EPE2.js";
 import {
   maybeHandleLifecycleFlush
 } from "./chunk-2BPPGNAQ.js";
@@ -75,20 +75,23 @@ import {
   authorizationProbeNamespaces,
   authorizationProbeRequiresPrincipalNamespace,
   probeOperationAuthorization
-} from "./chunk-WQFHHJWK.js";
+} from "./chunk-UALXWWGN.js";
 import {
   getOperation,
   resolveQueryNamespaceWritablePreflight
-} from "./chunk-O4CA53UY.js";
+} from "./chunk-IMKOJVD4.js";
 import {
   handleWhoKnowsHttpQuery
-} from "./chunk-AGCEJDG2.js";
+} from "./chunk-HPNXS6W6.js";
 import {
   isTrustZoneName
 } from "./chunk-JWX2Q6HS.js";
 import {
   subscribeGraphEvents
 } from "./chunk-DEUNUKTD.js";
+import {
+  BriefingTimeoutError
+} from "./chunk-X2KO4FK5.js";
 import {
   CorrectionContractError
 } from "./chunk-ETSJD5IV.js";
@@ -102,7 +105,7 @@ import {
 } from "./chunk-PARM6OYL.js";
 import {
   validateRequest
-} from "./chunk-BMG3SAXA.js";
+} from "./chunk-Z5277JWF.js";
 import {
   peerManifestRevision
 } from "./chunk-QYAXMXOB.js";
@@ -117,7 +120,7 @@ import {
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-} from "./chunk-SA6P2KS3.js";
+} from "./chunk-TEH5MDX5.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-C5LWPYS3.js";
@@ -893,6 +896,10 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
       res.once("close", abortDisconnectedRequest);
       correlationIdStore.run(correlationId, () => {
         void this.handle(req, res, correlationId, abortController.signal).catch((err) => {
+          if (err instanceof BriefingTimeoutError) {
+            this.respondJson(res, 504, { error: err.message, code: "briefing_timeout" });
+            return;
+          }
           if (isAbortError(err)) {
             if (!res.destroyed && !res.writableEnded) {
               res.end();
@@ -2040,7 +2047,8 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
         gatedBody: this.gatedBodyNamespace(req, await this.readJsonBody(req)),
         service: this.service,
         principal: this.resolveRequestPrincipal(req),
-        respondJson: (status, payload) => this.respondJson(res, status, payload)
+        respondJson: (status, payload) => this.respondJson(res, status, payload),
+        abortSignal
       });
       return;
     }
@@ -3565,4 +3573,4 @@ export {
   resolveDefaultAdminConsolePublicDir,
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-N6EM7ESC.js.map
+//# sourceMappingURL=chunk-EKYWZYZJ.js.map