@remnic/core 10.0.91 → 10.0.93

package/src/storage/content-hash-index.ts

@@ -3,7 +3,7 @@
 // rebuild saves plus the deferred durable-retry machinery. storage.ts imports
 // these back and re-exports the class + companion types that were previously
 // part of its public API.
-import { mkdir, stat } from "node:fs/promises";
+import { mkdir, stat, utimes } from "node:fs/promises";
 import path from "node:path";
 import { computeContentHash, normalizeContent } from "../content-hash.js";
 import { log } from "../logger.js";
@@ -291,6 +291,25 @@ export class ContentHashIndex {
     );
   }
 
+  /**
+   * Change the durable file's mtime without touching its content. A publish
+   * that throws or stays deferred leaves the file as it was, so a peer that
+   * already synced it keeps answering authoritative MISSes for deltas this
+   * instance holds only in memory (#3355). A new stamp makes every holder of the
+   * old fingerprint, this instance included, fail the freshness check and
+   * confirm against the corpus. Best effort: a file that cannot be stamped
+   * leaves the callers' existing retry and rebuild paths as the only repair.
+   */
+  private async invalidatePeerFreshness(): Promise<void> {
+    try {
+      const { mtimeMs } = await stat(this.filePath);
+      const bumped = new Date(Math.max(Date.now(), mtimeMs + 1));
+      await utimes(this.filePath, bumped, bumped);
+    } catch (err) {
+      log.debug(`content-hash index: could not invalidate peer freshness of ${this.filePath}: ${err}`);
+    }
+  }
+
   /** Check if content already exists in the index. */
   has(content: string): boolean {
     return this.hashes.has(ContentHashIndex.computeHash(content));
@@ -473,9 +492,15 @@ export class ContentHashIndex {
             `content-hash index: lock not acquired for ${this.filePath}; deferring reconcile save (dirty retained, scheduling durable retry)`
           );
           this.scheduleReconcileRetry();
+          await this.invalidatePeerFreshness();
           return;
         }
-        await publish();
+        try {
+          await publish();
+        } catch (err) {
+          await this.invalidatePeerFreshness();
+          throw err;
+        }
         if (this.dirty) {
           // A concurrent add()/remove() landed during publish's disk awaits, so
           // deltas remain unpersisted (PR #2016 thread SD7Tj). Arm a bounded

package/src/storage-fact-hash-publish-failure.test.ts

@@ -0,0 +1,87 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { StorageManager } from "./storage.js";
+import { ContentHashIndex } from "./storage/content-hash-index.js";
+
+const FACT = "the quarterly budget was approved by the board";
+const CONTENDED_LOCK_OPTIONS = { maxWaitMs: 40, pollMs: 10, retryMaxAttempts: 2, retryBaseMs: 10 };
+
+async function withMemoryDir(run: (dir: string) => Promise<void>): Promise<void> {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-fact-hash-publish-"));
+  try {
+    await run(dir);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** Hold the fact-hash index lock the way a peer mid-publish does; returns the release. */
+async function holdIndexLock(dir: string): Promise<() => Promise<void>> {
+  const lockPath = path.join(dir, "state", "fact-hashes.txt.lock");
+  await mkdir(path.dirname(lockPath), { recursive: true });
+  await writeFile(lockPath, `99999 peer-owner ${new Date().toISOString()}\n`);
+  return () => rm(lockPath, { force: true });
+}
+
+test("a publish that throws leaves peers revalidating instead of trusting the old file (#3355)", async () => {
+  await withMemoryDir(async (dir) => {
+    const stateDir = path.join(dir, "state");
+    const peer = new ContentHashIndex(stateDir);
+    peer.add("seed fact");
+    await peer.saveMergingWithDisk();
+    assert.equal(await peer.isDiskFingerprintCurrent(), true, "the peer starts in sync with the file");
+
+    const writer = new ContentHashIndex(
+      stateDir,
+      () => null,
+      () => {
+        throw new Error("write key unavailable");
+      },
+    );
+    await writer.load();
+    writer.add("pending fact");
+    await assert.rejects(writer.saveMergingWithDisk(), /write key unavailable/);
+
+    assert.equal(writer.hasPendingChanges, true, "the failed addition stays pending in the writer");
+    assert.equal(
+      await peer.isDiskFingerprintCurrent(),
+      false,
+      "the file did not change, yet the peer must stop trusting its snapshot",
+    );
+  });
+});
+
+test("a writeMemory whose publish stays deferred does not leave a peer answering an authoritative MISS (#3355)", async () => {
+  await withMemoryDir(async (dir) => {
+    const peer = new StorageManager(dir);
+    const writer = new StorageManager(dir);
+    peer.factHashIndexLockOptions = CONTENDED_LOCK_OPTIONS;
+    writer.factHashIndexLockOptions = CONTENDED_LOCK_OPTIONS;
+    assert.deepEqual(
+      await peer.lookupContentHash(FACT),
+      { present: false, authoritative: true },
+      "the peer starts with an authoritative, empty index",
+    );
+
+    const release = await holdIndexLock(dir);
+    const written = await writer.writeMemory("fact", FACT);
+    assert.ok(written.id, "the memory is durable, so the write still succeeds");
+
+    const duringContention = await peer.lookupContentHash(FACT);
+    assert.ok(
+      duringContention.present || !duringContention.authoritative,
+      `a peer must not report an authoritative MISS for a fact on disk: ${JSON.stringify(duringContention)}`,
+    );
+
+    await release();
+    assert.deepEqual(
+      await peer.lookupContentHash(FACT),
+      { present: true, authoritative: true },
+      "once the lock is free the peer rebuilds from the corpus and sees the fact",
+    );
+    await writer.lookupContentHash(FACT);
+  });
+});

package/src/summarizer-shutdown.test.ts

@@ -0,0 +1,195 @@
+// Shutdown-signal behavioral tests for HourlySummarizer: an aborted
+// summarizer must abort its in-flight local LLM call (the abort reaches the
+// client stub) and must refuse to start new summary work once aborted.
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import { initLogger, resetLogger } from "./logger.js";
+import { HourlySummarizer } from "./summarizer.js";
+import type { LocalLlmChatCompletionOptions } from "./local-llm-helpers.js";
+import type { TranscriptEntry } from "./types.js";
+
+function createConfig(memoryDir: string, extended = false) {
+  return parseConfig({
+    openaiApiKey: "sk-test",
+    memoryDir,
+    workspaceDir: path.join(memoryDir, "workspace"),
+    localLlmEnabled: true,
+    localLlmModel: "test-local-model",
+    localLlmUrl: "http://127.0.0.1:9",
+    localLlmTimeoutMs: 600_000,
+    localLlmRetry5xxCount: 1,
+    localLlmRetryBackoffMs: 30_000,
+    hourlySummariesEnabled: true,
+    hourlySummariesExtendedEnabled: extended,
+    debug: false,
+  });
+}
+
+interface LlmStub {
+  calls: { signal: AbortSignal | undefined }[];
+}
+
+function stubLocalLlm(summarizer: HourlySummarizer, stub: LlmStub): void {
+  // SAFETY: localLlm is a private field, stubbed at the established field
+  // seam with the client's real call shape; the stub parks until its caller
+  // signal aborts (real transport behavior), mirroring a wedged local LLM.
+  (summarizer as any).localLlm = {
+    chatCompletion: async (
+      messages: Array<{ role: string; content: string }>,
+      options: LocalLlmChatCompletionOptions,
+    ): Promise<null> => {
+      void messages;
+      stub.calls.push({ signal: options.signal });
+      const { promise, reject } = Promise.withResolvers<null>();
+      const onAbort = (): void => {
+        reject(new DOMException("This operation was aborted", "AbortError"));
+      };
+      const signal = options.signal;
+      if (signal) {
+        if (signal.aborted) onAbort();
+        else signal.addEventListener("abort", onAbort, { once: true });
+      }
+      return await promise;
+    },
+  };
+}
+
+async function withTestDeadline<T>(promise: Promise<T>, timeoutMs: number, label: string): Promise<T> {
+  const { promise: deadline, reject } = Promise.withResolvers<never>();
+  const timer = setTimeout(() => reject(new Error(`${label}: test deadline exceeded (${timeoutMs}ms)`)), timeoutMs);
+  timer.unref?.();
+  try {
+    return await Promise.race([promise, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function quietLogger(): void {
+  initLogger({ info() {}, warn() {}, error() {}, debug() {} }, false);
+}
+
+function entriesFor(): TranscriptEntry[] {
+  return [
+    {
+      role: "user",
+      content: "bounded shutdown summarizer test entry",
+      timestamp: new Date(Date.now() - 3_600_000).toISOString(),
+      sessionKey: "sess-summary-shutdown",
+      turnId: "turn-shutdown-1",
+    },
+  ];
+}
+
+test("aborting the shutdown signal aborts an in-flight generateSummary and reaches the LLM stub", async () => {
+  quietLogger();
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-summary-shutdown-inflight-"));
+  const stub: LlmStub = { calls: [] };
+  try {
+    const controller = new AbortController();
+    const summarizer = new HourlySummarizer(
+      createConfig(memoryDir),
+      undefined,
+      undefined,
+      undefined,
+      controller.signal,
+    );
+    stubLocalLlm(summarizer, stub);
+
+    const hourStart = new Date(Date.now() - 3_600_000);
+    hourStart.setMinutes(0, 0, 0);
+    const pending = summarizer.generateSummary("sess-summary-shutdown", hourStart, entriesFor());
+
+    await withTestDeadline((async () => {
+      while (stub.calls.length === 0) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+    })(), 5_000, "LLM stub to be entered");
+    controller.abort();
+
+    const result = await withTestDeadline(pending, 2_000, "in-flight summarizer abort");
+    assert.equal(result, null);
+    assert.equal(stub.calls.length, 1, "no second LLM attempt may start after abort");
+    assert.equal(stub.calls[0]?.signal?.aborted, true, "the shutdown abort must reach the LLM stub");
+  } finally {
+    resetLogger();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("an already-aborted summarizer refuses to start new work and never contacts the LLM", async () => {
+  quietLogger();
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-summary-shutdown-refuse-"));
+  const stub: LlmStub = { calls: [] };
+  try {
+    const controller = new AbortController();
+    controller.abort();
+    const summarizer = new HourlySummarizer(
+      createConfig(memoryDir),
+      undefined,
+      undefined,
+      undefined,
+      controller.signal,
+    );
+    stubLocalLlm(summarizer, stub);
+
+    const hourStart = new Date(Date.now() - 3_600_000);
+    hourStart.setMinutes(0, 0, 0);
+    await assert.rejects(
+      summarizer.generateSummary("sess-summary-shutdown", hourStart, entriesFor()),
+    );
+    assert.equal(stub.calls.length, 0, "aborted summarizer must not start new LLM work");
+  } finally {
+    resetLogger();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+for (const extended of [false, true]) {
+  test(`a shutdown abort during the local call does not start a gateway call (${extended ? "extended" : "standard"} summary)`, async () => {
+    quietLogger();
+    const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-summary-shutdown-gateway-"));
+    const stub: LlmStub = { calls: [] };
+    let gatewayCalls = 0;
+    try {
+      const controller = new AbortController();
+      const summarizer = new HourlySummarizer(
+        createConfig(memoryDir, extended),
+        undefined,
+        undefined,
+        undefined,
+        controller.signal,
+      );
+      stubLocalLlm(summarizer, stub);
+      // SAFETY: fallbackLlm is a private field, stubbed at the same field seam
+      // as localLlm; the stub counts gateway calls and returns no result.
+      (summarizer as any).fallbackLlm = {
+        parseWithSchema: async (): Promise<null> => {
+          gatewayCalls += 1;
+          return null;
+        },
+      };
+
+      const hourStart = new Date(Date.now() - 3_600_000);
+      hourStart.setMinutes(0, 0, 0);
+      const pending = summarizer.generateSummary("sess-summary-shutdown", hourStart, entriesFor());
+      await withTestDeadline((async () => {
+        while (stub.calls.length === 0) {
+          await new Promise((resolve) => setTimeout(resolve, 10));
+        }
+      })(), 5_000, "LLM stub to be entered");
+      controller.abort();
+
+      assert.equal(await withTestDeadline(pending, 2_000, "in-flight summarizer abort"), null);
+      assert.equal(gatewayCalls, 0, "no gateway call may start after the shutdown abort");
+    } finally {
+      resetLogger();
+      await rm(memoryDir, { recursive: true, force: true });
+    }
+  });
+}

package/src/summarizer.ts

@@ -114,20 +114,25 @@ export class HourlySummarizer {
   private fallbackLlm: FallbackLlmClient;
   private modelRegistry: ModelRegistry;
   private transcript?: TranscriptManager;
+  /** Orchestrator-owned stop signal: refuses new summaries and aborts the
+   *  in-flight local LLM call once teardown begins. */
+  private readonly shutdownSignal: AbortSignal | undefined;
 
   constructor(
     config: PluginConfig,
     gatewayConfig?: GatewayConfig,
     modelRegistry?: ModelRegistry,
-    transcript?: TranscriptManager
+    transcript?: TranscriptManager,
+    shutdownSignal?: AbortSignal
   ) {
     this.config = config;
     this.summariesDir = path.join(config.memoryDir, "summaries", "hourly");
     this.modelRegistry = modelRegistry ?? new ModelRegistry(config.memoryDir);
     this.transcript = transcript;
+    this.shutdownSignal = shutdownSignal;
 
     // Initialize local LLM client with shared model registry
-    this.localLlm = new LocalLlmClient(config, this.modelRegistry);
+    this.localLlm = new LocalLlmClient(config, this.modelRegistry, shutdownSignal);
 
     // Initialize fallback client with gateway config
     this.fallbackLlm = new FallbackLlmClient(gatewayConfig, fallbackLlmRuntimeContextFromConfig(config));
@@ -190,6 +195,7 @@ export class HourlySummarizer {
     entries: TranscriptEntry[]
   ): Promise<HourlySummary | null> {
     if (entries.length === 0) return null;
+    this.shutdownSignal?.throwIfAborted();
 
     // Format entries for the LLM
     const conversation = entries.map((e) => `[${e.role}] ${e.content}`).join("\n\n");
@@ -275,6 +281,8 @@ export class HourlySummarizer {
       }
     }
 
+    if (this.shutdownSignal?.aborted) return null;
+
     // Fall back to gateway's default AI
     log.info("summary generation: falling back to gateway default AI");
 
@@ -399,6 +407,7 @@ Respond with valid JSON matching this schema:
             maxTokens: contextSizes.maxOutputTokens,
             operation: "hourly_summary_extended",
             priority: "background",
+            signal: this.shutdownSignal,
           }
         );
         if (response?.content) {
@@ -422,6 +431,8 @@ Respond with valid JSON matching this schema:
       }
     }
 
+    if (this.shutdownSignal?.aborted) return null;
+
     try {
       const result = await this.fallbackLlm.parseWithSchema(
         [
@@ -489,6 +500,7 @@ Respond with valid JSON matching this schema:
         maxTokens: contextSizes.maxOutputTokens,
         operation: "hourly_summary",
         priority: "background",
+        signal: this.shutdownSignal,
       }
     );
 
@@ -775,6 +787,7 @@ Respond with valid JSON matching this schema:
 
   // Main entry point for cron job
   async runHourly(): Promise<HourlySummarizerRunStats> {
+    this.shutdownSignal?.throwIfAborted();
     log.debug("running hourly summary generation");
 
     // Get active sessions from transcript. The scan outcome is kept LOCAL to

package/src/types.ts

@@ -273,8 +273,9 @@ export interface NativeKnowledgeOpenClawWorkspaceConfig {
  * OpenClaw resolves these at runtime via its built-in secret resolver
  * (e.g. exec providers like `kc_*` for macOS Keychain). Plugins receive
  * the raw object in `pluginConfig` and must call the gateway's resolver
- * before using the value. Standalone Remnic does NOT resolve SecretRefs;
- * operators must use plain strings or `${ENV_VAR}` expansion instead.
+ * before using the value. A live connector credential field resolves a
+ * SecretRef at poll time through the host resolver. Other surfaces still
+ * need a plain string or `${ENV_VAR}` expansion.
  */
 export interface SecretRef {
   source: string;
@@ -2539,21 +2540,20 @@ export interface LiveConnectorsConfig {
  * shape (frozen, post-validation). This interface is the pre-validation
  * shape that `parseConfig` round-trips through.
  *
- * `clientId` / `clientSecret` / `refreshToken` are stored as strings here so
- * the schema can ship in `openclaw.plugin.json` and operators can populate
- * them from a secret store (e.g. an env-substituted plist or systemd
- * EnvironmentFile). They MUST NEVER be committed to source. The repo-wide
- * privacy policy in CLAUDE.md applies.
+ * `clientId` / `clientSecret` / `refreshToken` are a plain string or a
+ * SecretRef. A SecretRef is kept verbatim here and resolved at poll time
+ * through the host resolver. They MUST NEVER be committed to source. The
+ * repo-wide privacy policy in CLAUDE.md applies.
  */
 export interface GoogleDriveLiveConnectorConfig {
   /** Master gate. Default false — operators must opt in explicitly. */
   enabled: boolean;
   /** OAuth2 client id. Populate from a secret store; never commit. */
-  clientId: string;
+  clientId: string | SecretRef;
   /** OAuth2 client secret. Populate from a secret store; never commit. */
-  clientSecret: string;
+  clientSecret: string | SecretRef;
   /** OAuth2 refresh token. Populate from a secret store; never commit. */
-  refreshToken: string;
+  refreshToken: string | SecretRef;
   /** Poll interval in ms. Default 300000 (5 min); min 1000; max 86400000 (24h). */
   pollIntervalMs: number;
   /** Optional folder-id scope. Empty array = all accessible files. */

package/src/wearables/memory-gen.test.ts

@@ -224,6 +224,26 @@ test("auto mode writes active status", async () => {
   assert.equal(writes[0].options.status, "active");
 });
 
+test("a fact write the dedup window suppressed counts as skipped, not created", async () => {
+  const { writer } = makeWriter();
+  writer.writeSealedMemory = async () => ({ duplicate: true });
+  const result = await generateWearableMemories(
+    "limitless",
+    "2026-06-10",
+    [LONG_CONVERSATION],
+    settings({ memoryMode: "auto" }),
+    REGISTRY,
+    {
+      extract: extractionReturning([
+        { category: "fact", content: "Vendor call happens tomorrow morning.", confidence: 0.8, tags: [] },
+      ]),
+      writer,
+    },
+  );
+  assert.equal(result.created, 0);
+  assert.equal(result.skippedByReason["duplicate-existing"], 1);
+});
+
 test("auto mode still refuses to write a high-impact personal claim active (#2294)", async () => {
   // `auto` has no trust scoring, and an operator may lower minConfidence to or
   // below the speculative ceiling the ambient clamp writes — which would let a

package/src/wearables/memory-gen.ts

@@ -92,6 +92,11 @@ export function memoryStatusForMode(
   return mode === "auto" || mode === "smart" ? "active" : "pending_review";
 }
 
+/** A fact write the fact-dedup window suppressed because a concurrent writer committed the same fact first. */
+export interface WearableDuplicateWrite {
+  readonly duplicate: true;
+}
+
 /** Narrow writer interface satisfied by `StorageManager`. */
 export interface WearableMemoryWriter {
   /**
@@ -106,7 +111,7 @@ export interface WearableMemoryWriter {
       status?: MemoryStatus;
       memoryKind?: "episode" | "note" | "box" | "dream" | "procedural";
     },
-  ): Promise<MemoryWriteResult>;
+  ): Promise<MemoryWriteResult | WearableDuplicateWrite>;
   hasFactContentHash(content: string): Promise<boolean>;
   /**
    * Locate an earlier wearable write of the same content (any status).
@@ -663,7 +668,9 @@ export async function generateWearableMemories(
     // #1645: a tombstone-blocked wearable write lands pending_review (no active
     // copy) — count it as blocked, NOT created, so the sync summary and callers
     // don't report blocked content as successfully created active memories.
-    if (writeResult.tombstoneBlocked) {
+    if ("duplicate" in writeResult) {
+      skip("duplicate-existing");
+    } else if (writeResult.tombstoneBlocked) {
       result.tombstoneBlocked += 1;
     } else {
       result.created += 1;
@@ -872,11 +879,11 @@ export async function importNativeMemories(
     // #1645: a tombstone-blocked native import lands pending_review (no active
     // copy) — count it as blocked, NOT imported. Still record the provider id in
     // importedIds so the next sync doesn't re-import and duplicate the pending
-    // row; the block is permanent for this content.
-    if (nativeWriteResult.tombstoneBlocked) {
-      tombstoneBlocked += 1;
-    } else {
-      imported += 1;
+    // row; the block is permanent for this content. A write the dedup window
+    // suppressed (a concurrent writer committed the fact first) counts as neither.
+    if (!("duplicate" in nativeWriteResult)) {
+      if (nativeWriteResult.tombstoneBlocked) tombstoneBlocked += 1;
+      else imported += 1;
     }
     importedIds.push(memory.id);
   }

package/src/wearables/service.ts

@@ -13,6 +13,7 @@ import {
 } from "./corrections.js";
 import { describeErrorForOperator, WearablesInputError } from "./errors.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
+import { persistUnderFactDedupWindow } from "../orchestration/fact-dedup-window.js";
 import type { LocationConfig } from "../location/types.js";
 import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 import {
@@ -194,7 +195,19 @@ export function createWearableMemoryWriter(
   storage: WearableStorageIo,
 ): WearableMemoryGenDeps["writer"] {
   return {
-    writeSealedMemory: storage.writeSealedMemory.bind(storage),
+    writeSealedMemory: async (envelope, extras) => {
+      // Facts register in the fact hash index, so extraction and a wearable sync
+      // can commit the same new fact. Commit it under the window extraction uses
+      // and recheck the index there. Other categories keep the direct write: the
+      // index does not cover them, and the corpus scan stays outside the window.
+      if (envelope.category !== "fact") return storage.writeSealedMemory(envelope, extras);
+      const outcome = await persistUnderFactDedupWindow(
+        storage.dir,
+        () => storage.hasFactContentHash(extras.contentHashSource ?? envelope.content),
+        () => storage.writeSealedMemory(envelope, extras),
+      );
+      return outcome.suppressed ? { duplicate: true } : outcome.result;
+    },
     findWearableMemoryByContent: async (content: string) =>
       (await storage.findWearableMemoryByContent(content)) as
         | { id: string; status: import("../types.js").MemoryStatus | undefined }

package/src/wearables/storage-io.test.ts

@@ -5,7 +5,10 @@ import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { test } from "node:test";
 
+import { persistUnderFactDedupWindow } from "../orchestration/fact-dedup-window.js";
 import { StorageManager } from "../storage.js";
+import { composeMemoryEnvelope } from "../write-envelope.js";
+import { createWearableMemoryWriter } from "./service.js";
 
 function makeStorage(): { storage: StorageManager; dir: string } {
   const dir = mkdtempSync(path.join(tmpdir(), "remnic-wearable-io-"));
@@ -330,3 +333,25 @@ test("a symlinked _fusion dir that resolves INSIDE the memory dir is refused, no
     rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test("a wearable fact write loses to a fact another writer committed first and writes nothing", async () => {
+  const { storage, dir } = makeStorage();
+  try {
+    await storage.ensureDirectories();
+    const fact = "Dana moved the review meeting to Thursday afternoon.";
+    const writer = createWearableMemoryWriter(storage);
+    const envelope = composeMemoryEnvelope(
+      { content: fact, category: "fact", tags: ["wearable"] },
+      { source: "wearable:limitless" },
+    );
+    await persistUnderFactDedupWindow(storage.dir, async () => false, () => storage.writeMemory("fact", fact));
+
+    const written = await writer.writeSealedMemory(envelope, { contentHashSource: fact, status: "active" });
+
+    assert.deepEqual(written, { duplicate: true });
+    const copies = (await storage.readAllMemories()).filter((memory) => memory.content.includes(fact));
+    assert.equal(copies.length, 1, "the corpus holds one copy of the fact");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/dist/chunk-27XYV2XL.js

@@ -1,43 +0,0 @@
-import {
-  isNamespaceKind
-} from "./chunk-PUEO37QG.js";
-import {
-  EngramAccessInputError
-} from "./chunk-CJCTKL6Y.js";
-
-// src/access-http-query.ts
-function optionalQueryString(value, label) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  if (typeof value !== "string") {
-    throw new EngramAccessInputError(`${label} must be a string (got ${JSON.stringify(value)})`);
-  }
-  return value;
-}
-function nonEmptyQueryParam(value) {
-  return value !== null && value.length > 0 ? value : void 0;
-}
-function positiveIntQueryParam(value, label) {
-  if (value === null || value.length === 0) return void 0;
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed) || parsed <= 0 || !Number.isInteger(parsed)) {
-    throw new EngramAccessInputError(`${label} expects a positive integer`);
-  }
-  return parsed;
-}
-function optionalNamespaceKindQueryParam(value) {
-  if (value === null || value.length === 0) return void 0;
-  if (!isNamespaceKind(value)) {
-    throw new EngramAccessInputError(
-      "kind must be one of: default, shared, project, branch, team-project, explicit"
-    );
-  }
-  return value;
-}
-
-export {
-  optionalQueryString,
-  nonEmptyQueryParam,
-  positiveIntQueryParam,
-  optionalNamespaceKindQueryParam
-};
-//# sourceMappingURL=chunk-27XYV2XL.js.map

package/dist/chunk-27XYV2XL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/access-http-query.ts"],"sourcesContent":["import { EngramAccessInputError } from \"./access-service.js\";\nimport { isNamespaceKind, type NamespaceKind } from \"./namespaces/catalog.js\";\n\n/** Optional string field from a JSON body: absent/null/\"\" → undefined. */\nexport function optionalQueryString(value: unknown, label: string): string | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\") {\n    throw new EngramAccessInputError(`${label} must be a string (got ${JSON.stringify(value)})`);\n  }\n  return value;\n}\n\n/** Optional non-empty query param: null/\"\" → undefined. */\nexport function nonEmptyQueryParam(value: string | null): string | undefined {\n  return value !== null && value.length > 0 ? value : undefined;\n}\n\n/** Optional positive-integer query param; rejects invalid values. */\nexport function positiveIntQueryParam(value: string | null, label: string): number | undefined {\n  if (value === null || value.length === 0) return undefined;\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed) || parsed <= 0 || !Number.isInteger(parsed)) {\n    throw new EngramAccessInputError(`${label} expects a positive integer`);\n  }\n  return parsed;\n}\n\n/** Optional namespace-kind query param; rejects dead or unknown kinds. */\nexport function optionalNamespaceKindQueryParam(value: string | null): NamespaceKind | undefined {\n  if (value === null || value.length === 0) return undefined;\n  if (!isNamespaceKind(value)) {\n    throw new EngramAccessInputError(\n      \"kind must be one of: default, shared, project, branch, team-project, explicit\",\n    );\n  }\n  return value;\n}\n"],"mappings":";;;;;;;;AAIO,SAAS,oBAAoB,OAAgB,OAAmC;AACrF,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,uBAAuB,GAAG,KAAK,0BAA0B,KAAK,UAAU,KAAK,CAAC,GAAG;AAAA,EAC7F;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,OAA0C;AAC3E,SAAO,UAAU,QAAQ,MAAM,SAAS,IAAI,QAAQ;AACtD;AAGO,SAAS,sBAAsB,OAAsB,OAAmC;AAC7F,MAAI,UAAU,QAAQ,MAAM,WAAW,EAAG,QAAO;AACjD,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,KAAK,CAAC,OAAO,UAAU,MAAM,GAAG;AACxE,UAAM,IAAI,uBAAuB,GAAG,KAAK,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAGO,SAAS,gCAAgC,OAAiD;AAC/F,MAAI,UAAU,QAAQ,MAAM,WAAW,EAAG,QAAO;AACjD,MAAI,CAAC,gBAAgB,KAAK,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;","names":[]}