@remnic/core 9.29.0 → 9.30.0

package/dist/{chunk-FCDWWCLX.js → chunk-RGIWINDN.js}

@@ -13,7 +13,7 @@ import {
   TombstoneStore,
   buildRetiredFactTombstoneInputs,
   collectRetiredMemoriesForRebuild
-} from "./chunk-2QMKMVHH.js";
+} from "./chunk-QNWXCJ76.js";
 import {
   computeSupersessionKey,
   normalizeSupersessionKey,
@@ -42,13 +42,10 @@ import {
   readMaybeEncryptedLines,
   readMemoryActionEventRowsFromLines,
   serializeLifecycleAppendPayload
-} from "./chunk-OFHFH655.js";
+} from "./chunk-MJCGLM25.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-EGGE52UU.js";
-import {
-  withHeldFileLock
-} from "./chunk-WL5EBRDH.js";
 import {
   rewriteProjectedEntityReferences,
   rewriteProjectedMemoryEntityReference
@@ -57,15 +54,6 @@ import {
   assertPathInsideRoot,
   pathIsInside
 } from "./chunk-GCASGYIO.js";
-import {
-  markProjectedMemoryPathInvalid,
-  openProjectionReadonly,
-  readProjectedGovernanceRecord,
-  readProjectedMemoryBrowse,
-  readProjectedMemoryState,
-  readProjectedMemoryTimeline,
-  updateProjectedMemoryPath
-} from "./chunk-3CSX3ETE.js";
 import {
   inferMemoryStatus,
   isArchivedMemoryPath,
@@ -91,6 +79,26 @@ import {
   parseFaithfulnessField,
   serializeFaithfulnessFields
 } from "./chunk-JYIJNNN3.js";
+import {
+  CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
+  ContentHashIndex,
+  FactHashIndexNotAuthoritativeError,
+  TombstoneBlockedCaptureIndexHost,
+  buildExplicitCaptureDedupKey,
+  parseTombstoneBlockedOfflineSyncMemory
+} from "./chunk-FBUE6PD3.js";
+import {
+  withHeldFileLock
+} from "./chunk-FFAZ2XFU.js";
+import {
+  markProjectedMemoryPathInvalid,
+  openProjectionReadonly,
+  readProjectedGovernanceRecord,
+  readProjectedMemoryBrowse,
+  readProjectedMemoryState,
+  readProjectedMemoryTimeline,
+  updateProjectedMemoryPath
+} from "./chunk-3CSX3ETE.js";
 import {
   composeMemoryEnvelope,
   isSealedMemoryEnvelope,
@@ -126,10 +134,6 @@ import {
   getInFlightRead,
   setInFlightRead
 } from "./chunk-PDJTHRAW.js";
-import {
-  computeContentHash,
-  normalizeContent
-} from "./chunk-W5H6ZRPT.js";
 import {
   isConsolidationOperator,
   isValidDerivedFromEntry
@@ -164,9 +168,8 @@ import {
   probeEncryptedRegularFileHeader,
   readMaybeEncryptedFile,
   readMaybeEncryptedFileBuffer,
-  writeMaybeEncryptedFile,
-  writeMaybeEncryptedFileFromChunks
-} from "./chunk-AIK5W3IW.js";
+  writeMaybeEncryptedFile
+} from "./chunk-5TFP4CUL.js";
 import {
   isErrnoCode
 } from "./chunk-5UZXUTVO.js";
@@ -208,16 +211,16 @@ import {
   readdir as readdir5,
   readFile as readFile2,
   realpath as realpath3,
-  stat as stat3,
+  stat as stat2,
   writeFile as writeFile2,
-  mkdir as mkdir2,
+  mkdir,
   unlink as unlink3,
   appendFile,
   open
 } from "fs/promises";
 import { appendFileSync, createReadStream, mkdirSync, readFileSync as readFileSync2, statSync } from "fs";
 import { createHash as createHash5 } from "crypto";
-import path10 from "path";
+import path9 from "path";
 
 // src/storage/memory-read-store.ts
 import { lstat, readdir, realpath, stat } from "fs/promises";
@@ -1478,7 +1481,15 @@ function resolveHistoricalEntityCanonicalId(normalized, mappings) {
 var EntityCanonicalIdMigrationStateSchema = z.object({
   version: z.literal(ENTITY_CANONICAL_ID_MIGRATION_VERSION),
   complete: z.boolean(),
-  mappings: z.record(z.string().min(1))
+  mappings: z.record(z.string().min(1)),
+  /**
+   * Pairs the migration refused to resolve, PARKED rather than dropped.
+   * Deleting the record would strand the collision: once an operator removes
+   * the legacy file, no later scan can rediscover the mapping, so references
+   * still naming the legacy id would never be rewritten. Optional so a journal
+   * written by an older build still parses.
+   */
+  blocked: z.record(z.string().min(1)).optional()
 });
 async function fingerprintPath(filePath) {
   let fileStat;
@@ -1642,26 +1653,26 @@ function assertSafeEntityId(entityId) {
   }
 }
 async function assertNotSymlink(filePath, label) {
-  let stat4;
+  let stat3;
   try {
-    stat4 = await lstat2(filePath);
+    stat3 = await lstat2(filePath);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return;
     throw error;
   }
-  if (stat4.isSymbolicLink()) {
+  if (stat3.isSymbolicLink()) {
     throw new Error(`Refusing entity canonical-id migration through symlink: ${label}.`);
   }
 }
 async function assertNotMemorySymlink(filePath) {
-  let stat4;
+  let stat3;
   try {
-    stat4 = await lstat2(filePath);
+    stat3 = await lstat2(filePath);
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return;
     throw error;
   }
-  if (stat4.isSymbolicLink()) {
+  if (stat3.isSymbolicLink()) {
     throw new Error(`Refusing entity canonical-id migration through symlinked memory: ${filePath}.`);
   }
 }
@@ -1682,9 +1693,10 @@ async function readSafeEntityEntries(entitiesDir) {
   }
   return entries;
 }
-async function discoverMappings(deps, knownMappings = {}) {
+async function discoverMappings(deps, knownMappings = {}, blocked = /* @__PURE__ */ new Map()) {
   const mappings = {};
   const canonicalOwners = /* @__PURE__ */ new Map();
+  blocked.clear();
   const entityEntries = await readSafeEntityEntries(deps.entitiesDir);
   for (const entry of entityEntries) {
     if (!entry.endsWith(".md")) continue;
@@ -1710,18 +1722,20 @@ async function discoverMappings(deps, knownMappings = {}) {
     if (canonicalExists) {
       const canonicalContent2 = await deps.readStorageSecureFile(canonicalPath);
       if (entityContent !== canonicalContent2) {
-        throw new Error(`Cannot migrate legacy entity id ${legacyId}: ${canonicalId} already exists.`);
+        blocked.set(legacyId, canonicalId);
+        continue;
       }
     }
-    const previousOwner = canonicalOwners.get(canonicalId);
-    if (previousOwner !== void 0 && previousOwner !== legacyId) {
-      throw new Error(
-        `Cannot migrate legacy entity ids ${previousOwner} and ${legacyId}: both normalize to ${canonicalId}.`
-      );
-    }
-    canonicalOwners.set(canonicalId, legacyId);
+    canonicalOwners.set(canonicalId, [...canonicalOwners.get(canonicalId) ?? [], legacyId]);
     mappings[legacyId] = canonicalId;
   }
+  for (const [canonicalId, claimants] of canonicalOwners) {
+    if (claimants.length < 2) continue;
+    for (const legacyId of claimants) {
+      blocked.set(legacyId, canonicalId);
+      delete mappings[legacyId];
+    }
+  }
   return mappings;
 }
 async function rewriteReferences(deps, mappings, refreshLock) {
@@ -1923,7 +1937,16 @@ function mergeDiscoveredMappings(existing, discovered) {
   for (const [legacyId, canonicalId] of Object.entries(discovered)) {
     const previousMapping = merged[legacyId];
     if (previousMapping !== void 0 && previousMapping !== canonicalId) {
-      throw new Error(`Legacy entity id ${legacyId} changed canonical target during migration.`);
+      let hop = canonicalId;
+      const seen = /* @__PURE__ */ new Set();
+      while (hop !== void 0 && hop !== previousMapping && !seen.has(hop)) {
+        seen.add(hop);
+        hop = merged[hop];
+      }
+      if (hop !== previousMapping) {
+        throw new Error(`Legacy entity id ${legacyId} changed canonical target during migration.`);
+      }
+      continue;
     }
     if (previousMapping === void 0 && wouldCreateMappingCycle(merged, legacyId, canonicalId)) continue;
     const previousOwner = canonicalOwners.get(canonicalId);
@@ -1978,7 +2001,7 @@ async function migrateEntityFilePair(deps, legacyId, canonicalId, refreshMigrati
         deps.isEncryptedStorageFile(canonicalPath)
       ]);
       if (legacyContent !== canonicalContent2) {
-        throw new Error(`Cannot migrate legacy entity id ${legacyId}: ${canonicalId} already exists.`);
+        return { deferred: false, progressed: false, blocked: true };
       }
       if (legacyEncrypted && !canonicalEncrypted) {
         if (!await refreshMigrationLock() || !await refreshEntityLock()) {
@@ -2055,6 +2078,46 @@ async function migrateLegacyEntityCanonicalIds(deps) {
           mappings: {}
         };
       }
+      const blocked = /* @__PURE__ */ new Map();
+      const finish = () => {
+        if (blocked.size > 0) {
+          const pairs = [...blocked].map(([legacyId, canonicalId]) => `${legacyId} -> ${canonicalId}`).join(", ");
+          log.warn(
+            `entity canonical-id migration skipped ${blocked.size} unresolvable pair(s): ${pairs}. Both files were kept and the legacy id still resolves; merge or delete one side to migrate it.`
+          );
+        }
+        return deps.readMigrationFingerprint?.();
+      };
+      const pruneBlocked = async () => {
+        const current = state;
+        if (!current) return false;
+        let revived = false;
+        const parked = { ...current.blocked ?? {} };
+        const active = {};
+        for (const [legacyId, canonicalId] of Object.entries(current.mappings)) {
+          if (!blocked.has(legacyId)) active[legacyId] = canonicalId;
+        }
+        for (const [legacyId, canonicalId] of blocked) parked[legacyId] = canonicalId;
+        for (const [legacyId, canonicalId] of Object.entries(parked)) {
+          if (blocked.has(legacyId)) continue;
+          delete parked[legacyId];
+          if (active[legacyId] !== void 0) continue;
+          const legacyPath = deps.resolveEntityFilePath(legacyId);
+          if (legacyPath !== null && await fileExists(legacyPath)) continue;
+          active[legacyId] = canonicalId;
+          revived = true;
+        }
+        const collapsed = collapseMappings(active);
+        for (const [legacyId, canonicalId] of Object.entries(parked)) {
+          const moved = collapsed[canonicalId];
+          if (moved !== void 0 && moved !== legacyId) parked[legacyId] = moved;
+        }
+        const same = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([key, value]) => b[key] === value);
+        if (same(collapsed, current.mappings) && same(parked, current.blocked ?? {})) return revived;
+        state = { ...current, mappings: collapsed, blocked: parked };
+        await writeState(deps, state);
+        return revived;
+      };
       const previousMappings = state.mappings;
       const collapsedMappings = collapseMappings(previousMappings);
       const mappingsChanged = Object.keys(collapsedMappings).length !== Object.keys(previousMappings).length || Object.entries(collapsedMappings).some(
@@ -2065,11 +2128,12 @@ async function migrateLegacyEntityCanonicalIds(deps) {
         if (!await lock.refresh()) throw new Error("Lost entity canonical-id migration lock.");
         const discoveredBefore = rejectMappingCycles(
           state.mappings,
-          await discoverMappings(deps, state.mappings)
+          await discoverMappings(deps, state.mappings, blocked)
         );
+        await pruneBlocked();
         const mergedBefore = collapseMappings(mergeDiscoveredMappings(state.mappings, discoveredBefore));
         if (state.complete && Object.keys(discoveredBefore).length === 0 && !mappingsChanged) {
-          if (Object.keys(state.mappings).length === 0) return deps.readMigrationFingerprint?.();
+          if (Object.keys(state.mappings).length === 0) return finish();
           const rewroteColdMemory2 = await rewriteKnownReferences(
             deps,
             state.mappings,
@@ -2079,7 +2143,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
           deps.invalidateAllMemoriesCache();
           if (rewroteColdMemory2) deps.invalidateColdMemoriesCache();
           deps.bumpMemoryStatusVersion();
-          return deps.readMigrationFingerprint?.();
+          return finish();
         }
         if (state.complete || Object.keys(discoveredBefore).length > 0 || Object.keys(mergedBefore).length !== Object.keys(state.mappings).length) {
           state = { ...state, complete: false, mappings: mergedBefore };
@@ -2089,11 +2153,12 @@ async function migrateLegacyEntityCanonicalIds(deps) {
           if (!await lock.refresh()) throw new Error("Lost entity canonical-id migration lock.");
           const discoveredAfter2 = rejectMappingCycles(
             state.mappings,
-            await discoverMappings(deps, state.mappings)
+            await discoverMappings(deps, state.mappings, blocked)
           );
-          if (Object.keys(discoveredAfter2).length === 0) {
+          const revivedInRescan = await pruneBlocked();
+          if (Object.keys(discoveredAfter2).length === 0 && !revivedInRescan) {
             await writeState(deps, { ...state, complete: true });
-            return deps.readMigrationFingerprint?.();
+            return finish();
           }
           state = {
             ...state,
@@ -2114,9 +2179,8 @@ async function migrateLegacyEntityCanonicalIds(deps) {
               canonicalId,
               () => lock.refresh()
             );
-            if (result.deferred) {
-              deferredMappings.push([legacyId, canonicalId]);
-            }
+            if (result.blocked) blocked.set(legacyId, canonicalId);
+            else if (result.deferred) deferredMappings.push([legacyId, canonicalId]);
             progressed ||= result.progressed;
           }
           if (deferredMappings.length === 0) break;
@@ -2128,6 +2192,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
           }
           pendingMappings = deferredMappings;
         }
+        await pruneBlocked();
         const rewroteColdMemory = await rewriteKnownReferences(
           deps,
           state.mappings,
@@ -2140,11 +2205,12 @@ async function migrateLegacyEntityCanonicalIds(deps) {
         if (!await lock.refresh()) throw new Error("Lost entity canonical-id migration lock.");
         const discoveredAfter = rejectMappingCycles(
           state.mappings,
-          await discoverMappings(deps, state.mappings)
+          await discoverMappings(deps, state.mappings, blocked)
         );
-        if (Object.keys(discoveredAfter).length === 0) {
+        const revivedAfterRewrite = await pruneBlocked();
+        if (Object.keys(discoveredAfter).length === 0 && !revivedAfterRewrite) {
           await writeState(deps, { ...state, complete: true });
-          return deps.readMigrationFingerprint?.();
+          return finish();
         }
         state = {
           ...state,
@@ -4112,14 +4178,14 @@ var FusionArtifactStore = class {
    */
   async assertFusionDirNotSymlinked() {
     const fusionDir = path7.join(this.wearablesDir, FUSION_DIR_NAME);
-    let stat4;
+    let stat3;
     try {
-      stat4 = await this.io.lstat(fusionDir);
+      stat3 = await this.io.lstat(fusionDir);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
-    if (stat4.isSymbolicLink) {
+    if (stat3.isSymbolicLink) {
       throw new Error(
         "wearable fusion dir '_fusion' is a symbolic link \u2014 refusing to follow it even when it resolves inside the memory dir (AGENTS.md pattern #3)"
       );
@@ -4551,14 +4617,14 @@ var MeetingRecordStore = class {
     return path8.join(this.meetingsDir, first);
   }
   async assertNotSymlink(target, kind) {
-    let stat4;
+    let stat3;
     try {
-      stat4 = await this.io.lstat(target);
+      stat3 = await this.io.lstat(target);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
-    if (stat4.isSymbolicLink) {
+    if (stat3.isSymbolicLink) {
       const label = path8.relative(this.memoryDir, target) || MEETINGS_DIR_NAME;
       throw new Error(
         `meetings ${kind} '${label}' is a symbolic link \u2014 refusing to follow it even when it resolves inside the memory dir (AGENTS.md pattern #3)`
@@ -4975,471 +5041,6 @@ function isEntitySynthesisStale(entity) {
   return entity.timeline.length > entity.synthesisTimelineCount || structuredFactCount > (entity.synthesisStructuredFactCount ?? 0) || structuredFactDigest !== storedStructuredFactDigest;
 }
 
-// src/storage/content-hash-index.ts
-import { mkdir, stat as stat2 } from "fs/promises";
-import path9 from "path";
-var CONTENT_HASH_INDEX_LOCK_STALE_MS = 3e4;
-var CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS = 5;
-var CONTENT_HASH_INDEX_RETRY_BASE_MS = 500;
-var CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS = 5e3;
-var FactHashIndexNotAuthoritativeError = class extends Error {
-  constructor(stateDir) {
-    super(
-      `fact-hash index is not authoritative: the cross-process rebuild lock for ${stateDir} could not be acquired within the bounded retry budget`
-    );
-    this.name = "FactHashIndexNotAuthoritativeError";
-  }
-};
-var ContentHashIndex = class _ContentHashIndex {
-  hashes = /* @__PURE__ */ new Set();
-  dirty = false;
-  /**
-   * Hashes explicitly removed since the last successful save (issue #1909 review
-   * round 8 thread 3). Tracked separately so `saveMergingWithDisk` can be
-   * removal-AWARE: under the file lock it reads the latest on-disk set, DROPS
-   * these, then unions our additions — so a removal batch cannot resurrect a
-   * hash (union alone would) and cannot clobber a concurrent extraction's
-   * appended hash (blind overwrite would). Consumed + cleared by every save.
-   */
-  removed = /* @__PURE__ */ new Set();
-  /**
-   * Hashes added by THIS instance since the last successful save (issue #1909
-   * review round 9 finding 3). Tracked separately from the loaded snapshot so a
-   * reconciling save publishes `(on-disk \ removed) ∪ added` — it re-applies only
-   * OUR additions, never the stale loaded entries. Without this, seeding the
-   * merge from `this.hashes` (loaded ∪ added) would resurrect a hash a peer
-   * removed on disk while this instance held a stale snapshot.
-   */
-  added = /* @__PURE__ */ new Set();
-  filePath;
-  secureStoreKeyProvider;
-  secureStoreWriteKeyProvider;
-  memoryDir;
-  lockOptions;
-  /**
-   * Deferred reconcile-save durable-retry state (issue #1909 / PR #2016). At
-   * most ONE retry is ever armed (`reconcileRetryTimer` is the reentrancy guard)
-   * so successive timed-out saves cannot stack duplicate/parallel retries.
-   * `reconcileRetryBarrier` resolves when the chain settles (published or gave
-   * up) — awaited by tests and any caller wanting the eventual result.
-   */
-  reconcileRetryTimer = null;
-  reconcileRetryAttempts = 0;
-  reconcileRetryBarrier = null;
-  reconcileRetryResolve = null;
-  /**
-   * On-disk fingerprint (mtime + byte size) of `fact-hashes.txt` captured at the
-   * last point THIS instance's in-memory set matched disk — after `load()`,
-   * `save()`, or a reconcile publish (PR #2016 review). A peer process that
-   * advances the durable index changes this fingerprint;
-   * {@link isDiskFingerprintCurrent} compares a single cheap `stat` against it so
-   * a stale-but-"authoritative" snapshot is detected without an O(file-size)
-   * re-read on the hot path.
-   */
-  lastSyncedFingerprint = null;
-  constructor(stateDir, secureStoreKeyProvider = () => null, secureStoreWriteKeyProvider = secureStoreKeyProvider, memoryDir = path9.dirname(stateDir), lockOptions = {}) {
-    this.filePath = path9.join(stateDir, "fact-hashes.txt");
-    this.secureStoreKeyProvider = secureStoreKeyProvider;
-    this.secureStoreWriteKeyProvider = secureStoreWriteKeyProvider;
-    this.memoryDir = memoryDir;
-    this.lockOptions = lockOptions;
-  }
-  /** Load existing hashes from disk. Safe to call multiple times. */
-  async load() {
-    try {
-      const raw = await readMaybeEncryptedFile(this.filePath, this.secureStoreKeyProvider(), this.memoryDir);
-      for (const line of raw.split("\n")) {
-        const trimmed = line.trim();
-        if (trimmed.length > 0) {
-          this.hashes.add(trimmed);
-        }
-      }
-      log.debug(`content-hash index: loaded ${this.hashes.size} hashes`);
-    } catch (err) {
-      if (err instanceof SecureStoreLockedError) throw err;
-      if (!isErrnoCode(err, "ENOENT")) throw err;
-      log.debug("content-hash index: no existing index \u2014 starting fresh");
-    }
-    await this.captureSyncedFingerprint();
-  }
-  /** Cheap `stat` of the durable index file; null when it does not exist yet. */
-  async statIndexFile() {
-    try {
-      const s = await stat2(this.filePath);
-      return { mtimeMs: s.mtimeMs, size: s.size };
-    } catch (err) {
-      if (isErrnoCode(err, "ENOENT")) return null;
-      throw err;
-    }
-  }
-  /** Record the current on-disk fingerprint as this instance's synced baseline. */
-  async captureSyncedFingerprint() {
-    try {
-      this.lastSyncedFingerprint = await this.statIndexFile();
-    } catch (err) {
-      this.lastSyncedFingerprint = null;
-      log.debug(`content-hash index: could not fingerprint ${this.filePath}: ${err}`);
-    }
-  }
-  /**
-   * True when the durable index file is unchanged since this instance last
-   * synced it (load / save / reconcile). False when a peer advanced it, when the
-   * file appeared or vanished, or when freshness cannot be established (stat
-   * error) — the caller then treats the in-memory snapshot as non-authoritative
-   * and confirms a dedup miss against the durable corpus (PR #2016 review). One
-   * `stat`, never an O(file-size) read, so the hot path stays cheap.
-   */
-  async isDiskFingerprintCurrent() {
-    let current;
-    try {
-      current = await this.statIndexFile();
-    } catch {
-      return false;
-    }
-    const last = this.lastSyncedFingerprint;
-    if (last === null || current === null) {
-      return last === null && current === null;
-    }
-    return current.mtimeMs === last.mtimeMs && current.size === last.size;
-  }
-  /** Check if content already exists in the index. */
-  has(content) {
-    return this.hashes.has(_ContentHashIndex.computeHash(content));
-  }
-  /** Add content hash to the index. */
-  add(content) {
-    const hash = _ContentHashIndex.computeHash(content);
-    this.removed.delete(hash);
-    this.hashes.add(hash);
-    this.added.add(hash);
-    this.dirty = true;
-  }
-  get size() {
-    return this.hashes.size;
-  }
-  /** Clear all loaded hashes so the next save rewrites the index from scratch. */
-  clear() {
-    if (this.hashes.size > 0) {
-      this.hashes.clear();
-    }
-    this.added.clear();
-    this.removed.clear();
-    this.cancelReconcileRetry();
-    this.dirty = true;
-  }
-  /** Persist index to disk if changed (plain whole-file overwrite). */
-  async save() {
-    if (!this.dirty) return;
-    await mkdir(path9.dirname(this.filePath), { recursive: true });
-    const publishedAdded = new Set(this.added);
-    const publishedRemoved = new Set(this.removed);
-    const serialized = [...this.hashes].join("\n") + "\n";
-    await writeMaybeEncryptedFile(
-      this.filePath,
-      serialized,
-      this.secureStoreWriteKeyProvider(),
-      {},
-      this.memoryDir
-    );
-    for (const h of publishedAdded) this.added.delete(h);
-    for (const h of publishedRemoved) this.removed.delete(h);
-    this.dirty = this.added.size > 0 || this.removed.size > 0;
-    await this.captureSyncedFingerprint();
-    if (this.dirty) {
-      this.scheduleReconcileRetry();
-    } else {
-      this.cancelReconcileRetry();
-    }
-    log.debug(`content-hash index: saved ${this.hashes.size} hashes`);
-  }
-  /**
-   * Persist the index by RECONCILING with the latest on-disk state under a
-   * cross-process lock (issue #1909). Used by the extraction-persist batch save
-   * for BOTH append and removal batches, so appends and removals to the same
-   * index serialize against each other:
-   *   final = (on-disk \ this.removed) ∪ this.added
-   * Note it re-applies only OUR local additions (`added`), NOT the loaded
-   * snapshot (review round 9 finding 3): seeding from `this.hashes` would
-   * resurrect a hash a peer removed on disk while we held a stale snapshot. This
-   * preserves a concurrent writer's appended hashes (a blind overwrite would
-   * drop them), never resurrects a removed hash, and never loses our additions.
-   *
-   * Hardening:
-   *  - Dirty short-circuit (round 7 finding 3): when this instance neither added
-   *    nor removed anything this run, skip the O(file) read+rewrite entirely.
-   *  - Cross-process lock (round 7 finding 2): serialize the read→reconcile→write
-   *    window on a per-file advisory lock. If the lock is NOT acquired (timeout),
-   *    do NOT publish (round 9 finding 2): keep `dirty` set AND schedule a bounded
-   *    durable background retry (PR #2016) that keeps re-attempting the locked
-   *    publish until the deferred additions land — never an unlocked write that
-   *    could clobber a peer, and never a silent "batch save complete" that leaves
-   *    the addition in this process's memory only.
-   */
-  async saveMergingWithDisk() {
-    if (!this.dirty) return;
-    await mkdir(path9.dirname(this.filePath), { recursive: true });
-    const publish = async () => {
-      const publishedAdded = new Set(this.added);
-      const publishedRemoved = new Set(this.removed);
-      const merged = new Set(publishedAdded);
-      try {
-        const raw = await readMaybeEncryptedFile(
-          this.filePath,
-          this.secureStoreKeyProvider(),
-          this.memoryDir
-        );
-        for (const line of raw.split("\n")) {
-          const trimmed = line.trim();
-          if (trimmed.length > 0 && !publishedRemoved.has(trimmed)) merged.add(trimmed);
-        }
-      } catch (err) {
-        if (err instanceof SecureStoreLockedError) throw err;
-        if (!isErrnoCode(err, "ENOENT")) throw err;
-      }
-      await mkdir(path9.dirname(this.filePath), { recursive: true });
-      await writeMaybeEncryptedFile(
-        this.filePath,
-        [...merged].join("\n") + "\n",
-        this.secureStoreWriteKeyProvider(),
-        {},
-        this.memoryDir
-      );
-      for (const h of publishedAdded) this.added.delete(h);
-      for (const h of publishedRemoved) this.removed.delete(h);
-      for (const h of this.added) merged.add(h);
-      for (const h of this.removed) merged.delete(h);
-      this.hashes = merged;
-      this.dirty = this.added.size > 0 || this.removed.size > 0;
-      await this.captureSyncedFingerprint();
-    };
-    await withHeldFileLock(
-      `${this.filePath}.lock`,
-      {
-        staleMs: CONTENT_HASH_INDEX_LOCK_STALE_MS,
-        ...this.lockOptions.maxWaitMs !== void 0 ? { maxWaitMs: this.lockOptions.maxWaitMs } : {},
-        ...this.lockOptions.pollMs !== void 0 ? { pollMs: this.lockOptions.pollMs } : {}
-      },
-      async (acquired) => {
-        if (!acquired) {
-          log.warn(
-            `content-hash index: lock not acquired for ${this.filePath}; deferring reconcile save (dirty retained, scheduling durable retry)`
-          );
-          this.scheduleReconcileRetry();
-          return;
-        }
-        await publish();
-        if (this.dirty) {
-          this.scheduleReconcileRetry();
-        } else {
-          this.cancelReconcileRetry();
-        }
-      }
-    );
-    log.debug(`content-hash index: reconcile-saved ${this.hashes.size} hashes`);
-  }
-  /**
-   * Rebuild-and-publish the index from an authoritative source (the durable
-   * corpus) under the SAME per-file cross-process lock the reconciling
-   * append/removal saves (`saveMergingWithDisk`) use (issue #1909 / PR #2016).
-   * The `populate` callback runs WHILE the lock is held and MUST repopulate this
-   * index from the corpus (`clear()` then `addByHash(...)` for every corpus
-   * hash); the rebuilt set is then published with a plain overwrite that is now
-   * serialized against every locked writer.
-   *
-   * This closes the finding where the previous unlocked clear→scan→save() could
-   * overwrite a peer's newer lock-merged or deferred additions: a locked writer
-   * that committed BEFORE the rebuild acquired the lock has its memory `.md` on
-   * disk and is re-scanned; one that commits AFTER the rebuild releases
-   * reconciles its additions on top of the freshly-published set. No union with
-   * the raw on-disk file is performed, so the rebuild keeps its
-   * garbage-collection property (orphaned hashes for deleted memories drop).
-   *
-   * Lock-acquisition failure is explicit and non-destructive: `populate` is NOT
-   * run and nothing is written (never an unlocked overwrite). Returns true when
-   * the rebuild was published under the lock, false when the lock timed out —
-   * the caller keeps the index non-authoritative and retries on next use. Uses
-   * the same non-reentrant file lock as the reconcile path, so it can never
-   * deadlock with the deferred reconcile-retry: a concurrent locked writer (or a
-   * fired retry) simply yields `acquired=false` after the bounded wait.
-   */
-  async rebuildUnderLock(populate) {
-    await mkdir(path9.dirname(this.filePath), { recursive: true });
-    let published = false;
-    await withHeldFileLock(
-      `${this.filePath}.lock`,
-      {
-        staleMs: CONTENT_HASH_INDEX_LOCK_STALE_MS,
-        ...this.lockOptions.maxWaitMs !== void 0 ? { maxWaitMs: this.lockOptions.maxWaitMs } : {},
-        ...this.lockOptions.pollMs !== void 0 ? { pollMs: this.lockOptions.pollMs } : {}
-      },
-      async (acquired) => {
-        if (!acquired) {
-          log.warn(
-            `content-hash index: lock not acquired for ${this.filePath}; deferring authoritative rebuild (index left non-authoritative, retried on next use)`
-          );
-          return;
-        }
-        await populate();
-        await this.save();
-        published = true;
-      }
-    );
-    return published;
-  }
-  /**
-   * True while a background durable reconcile-save retry is armed (PR #2016).
-   * Test/introspection hook.
-   */
-  get hasPendingReconcileRetry() {
-    return this.reconcileRetryTimer !== null;
-  }
-  /**
-   * Resolve once any armed background reconcile-save retry chain has settled —
-   * either it published the deferred additions, or it exhausted its bounded
-   * attempts and fell back to the corpus-rebuild safety net. Resolves
-   * immediately when nothing is armed. Lets a caller (or a test) await the
-   * eventual durability outcome of a lock-timed-out save.
-   */
-  async whenReconcileRetrySettled() {
-    await (this.reconcileRetryBarrier ?? Promise.resolve());
-  }
-  /**
-   * Drive any deferred lock-timeout reconcile save to completion INLINE at a
-   * lifecycle boundary (PR #2016 finding 3). The background retry timer is
-   * `unref`'d so it never keeps a long-lived daemon alive — but a short-lived
-   * writer (a one-shot CLI) can exit before it fires, leaving a durable fact
-   * `.md` whose hash never reached `fact-hashes.txt` for peers that already
-   * built their in-memory index. `orchestrator.destroy()` calls this so the
-   * addition publishes before the process exits; long-lived hosts only reach it
-   * at their own shutdown, so their in-flight retries keep running in the
-   * background until then. Bounded by the same attempt ceiling as the background
-   * retry; a permanently contended lock falls back to the corpus-rebuild-on-
-   * restart safety net (the fact `.md` is already durable). No deadlock: each
-   * attempt is the same non-reentrant, bounded-wait file lock.
-   */
-  async flushReconcileRetry() {
-    if (!this.dirty) return;
-    const maxAttempts = this.lockOptions.retryMaxAttempts ?? CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS;
-    const baseMs = this.lockOptions.retryBaseMs ?? CONTENT_HASH_INDEX_RETRY_BASE_MS;
-    for (let attempt = 0; this.dirty && attempt < maxAttempts; attempt += 1) {
-      if (this.reconcileRetryTimer) {
-        clearTimeout(this.reconcileRetryTimer);
-        this.reconcileRetryTimer = null;
-      }
-      await this.saveMergingWithDisk();
-      if (!this.dirty) break;
-      if (attempt < maxAttempts - 1) {
-        const wait = Math.min(baseMs * 2 ** attempt, CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);
-        await new Promise((resolve3) => setTimeout(resolve3, wait));
-      }
-    }
-    if (this.reconcileRetryTimer) {
-      clearTimeout(this.reconcileRetryTimer);
-      this.reconcileRetryTimer = null;
-    }
-    this.reconcileRetryAttempts = 0;
-    this.settleReconcileRetry();
-  }
-  /**
-   * Schedule ONE bounded, exponentially-backed-off background retry of the
-   * deferred reconcile save (PR #2016). Reentrant-safe: an already-armed timer
-   * short-circuits, so successive timed-out saves never stack duplicate retries.
-   * When attempts are exhausted the chain settles without publishing — the
-   * durable fact `.md` is on disk and a process restart rebuilds the index from
-   * the corpus, so this degrades to that safety net, never a fatal failure.
-   */
-  scheduleReconcileRetry() {
-    if (this.reconcileRetryTimer) return;
-    const maxAttempts = this.lockOptions.retryMaxAttempts ?? CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS;
-    if (this.reconcileRetryAttempts >= maxAttempts) {
-      log.warn(
-        `content-hash index: exhausted ${maxAttempts} deferred reconcile-save retries for ${this.filePath}; ${this.added.size} addition(s) remain dirty in-memory (a process restart rebuilds the index from the durable corpus)`
-      );
-      this.reconcileRetryAttempts = 0;
-      this.settleReconcileRetry();
-      return;
-    }
-    if (!this.reconcileRetryBarrier) {
-      this.reconcileRetryBarrier = new Promise((resolve3) => {
-        this.reconcileRetryResolve = resolve3;
-      });
-    }
-    const attempt = this.reconcileRetryAttempts + 1;
-    const baseMs = this.lockOptions.retryBaseMs ?? CONTENT_HASH_INDEX_RETRY_BASE_MS;
-    const delay = Math.min(baseMs * 2 ** (attempt - 1), CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);
-    this.reconcileRetryTimer = setTimeout(() => {
-      this.reconcileRetryTimer = null;
-      this.reconcileRetryAttempts = attempt;
-      void this.saveMergingWithDisk().catch((err) => {
-        log.warn(`content-hash index: deferred reconcile-save retry failed for ${this.filePath}: ${err}`);
-      }).finally(() => {
-        if (this.dirty && !this.reconcileRetryTimer) this.settleReconcileRetry();
-      });
-    }, delay);
-    this.reconcileRetryTimer.unref?.();
-  }
-  /** Cancel any armed reconcile-save retry and settle the barrier (a publish landed). */
-  cancelReconcileRetry() {
-    if (this.reconcileRetryTimer) {
-      clearTimeout(this.reconcileRetryTimer);
-      this.reconcileRetryTimer = null;
-    }
-    this.reconcileRetryAttempts = 0;
-    this.settleReconcileRetry();
-  }
-  /** Resolve and clear the retry barrier if one is outstanding. */
-  settleReconcileRetry() {
-    const resolve3 = this.reconcileRetryResolve;
-    this.reconcileRetryBarrier = null;
-    this.reconcileRetryResolve = null;
-    resolve3?.();
-  }
-  /** Remove a hash from the index (used when archiving/deleting). */
-  remove(content) {
-    const hash = _ContentHashIndex.computeHash(content);
-    this.added.delete(hash);
-    this.removed.add(hash);
-    this.hashes.delete(hash);
-    this.dirty = true;
-  }
-  /**
-   * Remove a pre-computed SHA-256 hash directly from the index without
-   * re-hashing.  Use this when the caller already holds the stored hash
-   * (e.g. `memory.frontmatter.contentHash`) to avoid the double-hash bug
-   * where `remove(hash)` would compute `hash(hash)` and never match the
-   * entry.
-   */
-  removeByHash(hash) {
-    this.added.delete(hash);
-    this.removed.add(hash);
-    this.hashes.delete(hash);
-    this.dirty = true;
-  }
-  /**
-   * Add a pre-computed SHA-256 hash directly to the index without re-hashing.
-   * Use this when the caller already holds the stored hash
-   * (e.g. `memory.frontmatter.contentHash`) so that the index records the raw
-   * content hash rather than re-hashing the citation-annotated body.
-   *
-   * @internal Only called from `StorageManager.ensureFactHashIndexAuthoritative`.
-   * Not part of the public API — prefer `add(content)` for external callers.
-   */
-  addByHash(hash) {
-    this.removed.delete(hash);
-    this.hashes.add(hash);
-    this.added.add(hash);
-    this.dirty = true;
-  }
-  /** Normalize content (delegates to content-hash.ts for a single source of truth). */
-  static normalizeContent(content) {
-    return normalizeContent(content);
-  }
-  /** Compute SHA-256 hash (delegates to content-hash.ts for a single source of truth). */
-  static computeHash(content) {
-    return computeContentHash(content);
-  }
-};
-
 // src/storage.ts
 var ARTIFACT_SEARCH_STOPWORDS = /* @__PURE__ */ new Set([
   "a",
@@ -6064,17 +5665,17 @@ function inferEntityTypeFromContent(content) {
 }
 var KNOWN_ENTITY_FILENAME_PREFIXES = /* @__PURE__ */ new Set(["company", "other", "person", "place", "project", "tool", "topic"]);
 function inferEntityTypeFromFilename(pathRel) {
-  const basename = path10.basename(pathRel, ".md").toLowerCase();
+  const basename = path9.basename(pathRel, ".md").toLowerCase();
   const separator = basename.indexOf("-");
   if (separator <= 0) return void 0;
   const candidate = basename.slice(0, separator);
   return KNOWN_ENTITY_FILENAME_PREFIXES.has(candidate) ? candidate : void 0;
 }
 function normalizeFrontmatterForPath(frontmatter, pathRel, content = "") {
-  const normalizedPath = pathRel.split(path10.sep).join("/");
+  const normalizedPath = pathRel.split(path9.sep).join("/");
   let normalizedFrontmatter = frontmatter;
   if (normalizedPath === "entities" || normalizedPath.startsWith("entities/") || normalizedPath.includes("/entities/")) {
-    const basename = path10.basename(pathRel, ".md");
+    const basename = path9.basename(pathRel, ".md");
     const inferredType = inferEntityTypeFromContent(content) || inferEntityTypeFromFilename(pathRel) || "entity";
     const existingTags = Array.isArray(frontmatter.tags) ? frontmatter.tags : [];
     normalizedFrontmatter = {
@@ -6534,8 +6135,9 @@ function parseExtractionRetryStateEntries(raw) {
   }
   return valid;
 }
-var StorageManager3 = class _StorageManager {
+var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndexHost {
   constructor(baseDir, entitySchemas, hotMemoriesCacheEnabledOverride) {
+    super();
     this.baseDir = baseDir;
     this.entitySchemas = entitySchemas;
     this.hotMemoriesCacheEnabled = hotMemoriesCacheEnabledOverride ?? _StorageManager.hotMemoriesCacheDefaultByDir.get(baseDir) ?? _StorageManager.hotMemoriesCacheDefault;
@@ -6720,8 +6322,8 @@ var StorageManager3 = class _StorageManager {
   }
   /** Whether `filePath` resolves to `stateDir` itself or a path contained in it. */
   isStateFilePath(filePath) {
-    const rel = path10.relative(this.stateDir, path10.resolve(filePath));
-    return rel === "" || !rel.startsWith("..") && !path10.isAbsolute(rel);
+    const rel = path9.relative(this.stateDir, path9.resolve(filePath));
+    return rel === "" || !rel.startsWith("..") && !path9.isAbsolute(rel);
   }
   // ── Tombstone store (issue #1579) ───────────────────────────────────────
   // Instance-scoped (rule 11) + namespace-scoped (rule 42) tombstone index.
@@ -6838,8 +6440,8 @@ var StorageManager3 = class _StorageManager {
    * /srv/cold/remnic), skipping the patch and stranding a stale hot entry.
    */
   isColdOrArchiveTierPath(p) {
-    const rel = path10.relative(this.baseDir, p);
-    return rel === "cold" || rel === "archive" || rel.startsWith(`cold${path10.sep}`) || rel.startsWith(`archive${path10.sep}`);
+    const rel = path9.relative(this.baseDir, p);
+    return rel === "cold" || rel === "archive" || rel.startsWith(`cold${path9.sep}`) || rel.startsWith(`archive${path9.sep}`);
   }
   /**
    * Mark the secure-store as required for this storage instance.
@@ -6926,7 +6528,7 @@ var StorageManager3 = class _StorageManager {
         void 0,
         this.baseDir
       );
-      const rel = path10.relative(this.baseDir, filePath).split(path10.sep).join("/");
+      const rel = path9.relative(this.baseDir, filePath).split(path9.sep).join("/");
       return `${rel}:${version.versionId}`;
     } catch (err) {
       log.warn(
@@ -7006,13 +6608,13 @@ var StorageManager3 = class _StorageManager {
   }
   identityFilePath(workspaceDir, namespace) {
     const rawNamespace = typeof namespace === "string" ? namespace.trim() : "";
-    if (!rawNamespace) return path10.join(workspaceDir, "IDENTITY.md");
+    if (!rawNamespace) return path9.join(workspaceDir, "IDENTITY.md");
     const safeNamespace = rawNamespace.replace(/[^a-zA-Z0-9._-]/g, "-");
-    return path10.join(workspaceDir, `IDENTITY.${safeNamespace}.md`);
+    return path9.join(workspaceDir, `IDENTITY.${safeNamespace}.md`);
   }
   versionFilePath(kind) {
     const fileName = kind === "memory-status" ? ".memory-status-version.log" : kind === "artifact-write" ? ".artifact-write-version.log" : kind === "cold-write" ? ".cold-write-version.log" : ".memory-corpus-version.log";
-    return path10.join(this.stateDir, fileName);
+    return path9.join(this.stateDir, fileName);
   }
   bumpSharedVersion(kind, fallbackMap) {
     const filePath = this.versionFilePath(kind);
@@ -7104,7 +6706,7 @@ var StorageManager3 = class _StorageManager {
   // memories.
   // -------------------------------------------------------------------------
   get wearablesDir() {
-    return path10.join(this.baseDir, WEARABLES_DIR_NAME);
+    return path9.join(this.baseDir, WEARABLES_DIR_NAME);
   }
   /**
    * Resolve the on-disk path for a source/day transcript. Throws on
@@ -7120,7 +6722,7 @@ var StorageManager3 = class _StorageManager {
     if (!isValidTranscriptDate(date)) {
       throw new Error(`invalid wearable transcript date '${String(date)}' \u2014 expected YYYY-MM-DD`);
     }
-    return path10.join(this.wearablesDir, sourceId, `${date}.md`);
+    return path9.join(this.wearablesDir, sourceId, `${date}.md`);
   }
   async writeWearableDayTranscript(sourceId, date, serialized) {
     const targetPath = this.wearableTranscriptPath(sourceId, date);
@@ -7236,25 +6838,25 @@ var StorageManager3 = class _StorageManager {
     });
   }
   get factsDir() {
-    return path10.join(this.baseDir, "facts");
+    return path9.join(this.baseDir, "facts");
   }
   get correctionsDir() {
-    return path10.join(this.baseDir, "corrections");
+    return path9.join(this.baseDir, "corrections");
   }
   get proceduresDir() {
-    return path10.join(this.baseDir, "procedures");
+    return path9.join(this.baseDir, "procedures");
   }
   get reasoningTracesDir() {
-    return path10.join(this.baseDir, "reasoning-traces");
+    return path9.join(this.baseDir, "reasoning-traces");
   }
   get entitiesDir() {
-    return path10.join(this.baseDir, "entities");
+    return path9.join(this.baseDir, "entities");
   }
   resolveEntityFilePath(name) {
     if (typeof name !== "string") return null;
-    const filePath = path10.resolve(this.entitiesDir, `${name}.md`);
-    const relative2 = path10.relative(this.entitiesDir, filePath);
-    if (relative2 === "" || relative2.startsWith("..") || path10.isAbsolute(relative2)) {
+    const filePath = path9.resolve(this.entitiesDir, `${name}.md`);
+    const relative2 = path9.relative(this.entitiesDir, filePath);
+    if (relative2 === "" || relative2.startsWith("..") || path9.isAbsolute(relative2)) {
       return null;
     }
     return filePath;
@@ -7268,17 +6870,11 @@ var StorageManager3 = class _StorageManager {
       this.notifyCatalogWriteForPath(filePath);
     });
   }
-  writeStorageSecureFileChunks(filePath, chunks) {
-    const writeKey = this.resolveWriteKey();
-    return writeMaybeEncryptedFileFromChunks(filePath, chunks, writeKey, {}, this.baseDir).then(() => {
-      this.notifyCatalogWriteForPath(filePath);
-    });
-  }
   assertManagedStoragePath(filePath, method) {
-    const resolved = path10.resolve(filePath);
-    const base = path10.resolve(this.baseDir);
-    const rel = path10.relative(base, resolved);
-    if (rel === "" || rel === ".." || rel.startsWith(`..${path10.sep}`) || path10.isAbsolute(rel)) {
+    const resolved = path9.resolve(filePath);
+    const base = path9.resolve(this.baseDir);
+    const rel = path9.relative(base, resolved);
+    if (rel === "" || rel === ".." || rel.startsWith(`..${path9.sep}`) || path9.isAbsolute(rel)) {
       throw new Error(`${method}: file path escapes memory dir`);
     }
     return resolved;
@@ -7289,8 +6885,8 @@ var StorageManager3 = class _StorageManager {
   }
   async digestOfflineSyncFile(filePath) {
     const target = this.assertManagedStoragePath(filePath, "storage.digestOfflineSyncFile");
-    const st = await stat3(target);
-    const relPath = path10.relative(this.baseDir, target).split(path10.sep).join("/");
+    const st = await stat2(target);
+    const relPath = path9.relative(this.baseDir, target).split(path9.sep).join("/");
     const cache = await this.loadOfflineSyncDigestCache();
     const cached = cache.get(relPath);
     if (cached && cached.statBytes === st.size && cached.mtimeMs === st.mtimeMs && cached.ctimeMs === st.ctimeMs && !cached.encrypted) {
@@ -7351,7 +6947,7 @@ var StorageManager3 = class _StorageManager {
         const bytes = typeof record.bytes === "number" ? record.bytes : NaN;
         const sha256 = typeof record.sha256 === "string" ? record.sha256 : "";
         const encrypted = record.encrypted === true;
-        if (cachePath.length === 0 || cachePath === ".." || cachePath.startsWith("../") || path10.isAbsolute(cachePath) || !Number.isFinite(statBytes) || !Number.isFinite(mtimeMs) || !Number.isFinite(ctimeMs) || !Number.isFinite(bytes) || !/^[a-f0-9]{64}$/i.test(sha256)) {
+        if (cachePath.length === 0 || cachePath === ".." || cachePath.startsWith("../") || path9.isAbsolute(cachePath) || !Number.isFinite(statBytes) || !Number.isFinite(mtimeMs) || !Number.isFinite(ctimeMs) || !Number.isFinite(bytes) || !/^[a-f0-9]{64}$/i.test(sha256)) {
           continue;
         }
         cache.set(cachePath, { statBytes, mtimeMs, ctimeMs, encrypted, sha256, bytes });
@@ -7393,7 +6989,7 @@ var StorageManager3 = class _StorageManager {
       const cache = this.offlineSyncDigestCache;
       if (!cache) return;
       const entries = [...cache.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([entryPath, entry]) => ({ path: entryPath, ...entry }));
-      await mkdir2(path10.dirname(this.offlineSyncDigestCachePath), { recursive: true });
+      await mkdir(path9.dirname(this.offlineSyncDigestCachePath), { recursive: true });
       await writeFile2(this.offlineSyncDigestCachePath, `${JSON.stringify({ version: 1, entries })}
 `, "utf-8");
     }).catch((err) => {
@@ -7412,40 +7008,10 @@ var StorageManager3 = class _StorageManager {
       await handle.close();
     }
   }
-  async writeOfflineSyncFile(filePath, content) {
-    const target = this.assertManagedStoragePath(filePath, "storage.writeOfflineSyncFile");
-    await this.writeStorageSecureFile(target, content);
-    await this.invalidateAfterOfflineSyncMutation(target);
-  }
   async writeOfflineSyncStagingFile(filePath, content) {
     const target = this.assertManagedStoragePath(filePath, "storage.writeOfflineSyncStagingFile");
     await this.writeStorageSecureFile(target, content);
   }
-  async writeOfflineSyncFileChunks(filePath, chunks) {
-    const target = this.assertManagedStoragePath(filePath, "storage.writeOfflineSyncFileChunks");
-    await this.writeStorageSecureFileChunks(target, chunks);
-    await this.invalidateAfterOfflineSyncMutation(target);
-  }
-  async deleteOfflineSyncFile(filePath) {
-    const target = this.assertManagedStoragePath(filePath, "storage.deleteOfflineSyncFile");
-    await unlink3(target).catch((error) => {
-      if (isErrnoCode(error, "ENOENT")) return;
-      throw error;
-    });
-    await this.invalidateAfterOfflineSyncMutation(target);
-  }
-  async invalidateAfterOfflineSyncMutation(filePath) {
-    this.invalidateAllMemoriesCache();
-    this.invalidateKnowledgeIndexCache();
-    this.factHashIndexAuthoritative = false;
-    if (filePath.includes(`${path10.sep}cold${path10.sep}`)) {
-      this.invalidateColdMemoriesCache();
-    }
-    if (filePath.includes(`${path10.sep}artifacts${path10.sep}`)) {
-      this.bumpArtifactWriteVersion();
-    }
-    this.bumpMemoryStatusVersion();
-  }
   createContentHashIndex() {
     return new ContentHashIndex(
       this.stateDir,
@@ -7481,7 +7047,7 @@ var StorageManager3 = class _StorageManager {
   async isEncryptedFileHeader(filePath) {
     let st;
     try {
-      st = await stat3(filePath);
+      st = await stat2(filePath);
     } catch (err) {
       if (isErrnoCode(err, "ENOENT")) return false;
       throw err;
@@ -7512,7 +7078,7 @@ var StorageManager3 = class _StorageManager {
   }
   async appendStorageSecureFileUnlocked(filePath, content) {
     const writeKey = this.resolveWriteKey();
-    await mkdir2(path10.dirname(filePath), { recursive: true });
+    await mkdir(path9.dirname(filePath), { recursive: true });
     if (writeKey === null) {
       try {
         if (await this.isEncryptedFileHeader(filePath)) {
@@ -7538,13 +7104,13 @@ var StorageManager3 = class _StorageManager {
     this.notifyCatalogWriteForPath(filePath);
   }
   get stateDir() {
-    return path10.join(this.baseDir, "state");
+    return path9.join(this.baseDir, "state");
   }
   get offlineSyncDigestCachePath() {
-    return path10.join(this.baseDir, ".offline-sync", "digest-cache.v1.json");
+    return path9.join(this.baseDir, ".offline-sync", "digest-cache.v1.json");
   }
   get entitySynthesisQueuePath() {
-    return path10.join(this.stateDir, "entity-synthesis-queue.json");
+    return path9.join(this.stateDir, "entity-synthesis-queue.json");
   }
   // ── Tombstone store access (issue #1579) ─────────────────────────────────
   /**
@@ -7554,7 +7120,7 @@ var StorageManager3 = class _StorageManager {
    * helpers are injected into the store).
    */
   get tombstonesPath() {
-    return path10.join(this.stateDir, "tombstones.jsonl");
+    return path9.join(this.stateDir, "tombstones.jsonl");
   }
   /**
    * Configure the tombstone invariant for this storage instance. Installed
@@ -7683,6 +7249,28 @@ var StorageManager3 = class _StorageManager {
     });
     return await store.rebuild(retired);
   }
+  markFactHashIndexNotAuthoritative() {
+    this.factHashIndexAuthoritative = false;
+  }
+  tombstoneBlockedCaptureIndexOptions() {
+    return {
+      stateDir: this.stateDir,
+      memoryDir: this.baseDir,
+      secureStoreKeyProvider: () => this._secureStoreKey,
+      secureStoreWriteKeyProvider: () => this.resolveWriteKey(),
+      lockOptions: () => this.factHashIndexLockOptions,
+      parseMemory: (filePath, content) => parseTombstoneBlockedOfflineSyncMemory(
+        filePath,
+        content,
+        this.baseDir,
+        parseFrontmatter,
+        normalizeFrontmatterForPath,
+        toMemoryPathRel
+      ),
+      readAllMemories: () => this.readAllMemories(),
+      readAllColdMemories: () => this.readAllColdMemories()
+    };
+  }
   async getFactHashIndex() {
     if (this.factHashIndex) {
       return this.factHashIndex;
@@ -7744,9 +7332,7 @@ var StorageManager3 = class _StorageManager {
       const baseMs = this.factHashIndexLockOptions.retryBaseMs ?? FACT_HASH_INDEX_REBUILD_RETRY_BASE_MS;
       let published = false;
       for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-        published = await factHashIndex.rebuildUnderLock(
-          () => this.rebuildFactHashIndexFromCorpus(factHashIndex)
-        );
+        published = await factHashIndex.rebuildUnderLock(() => this.rebuildFactHashIndexFromCorpus(factHashIndex));
         if (published || attempt === maxAttempts - 1) break;
         const wait = Math.min(baseMs * 2 ** attempt, CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);
         await new Promise((resolve3) => setTimeout(resolve3, wait));
@@ -7772,10 +7358,7 @@ var StorageManager3 = class _StorageManager {
   async rebuildFactHashIndexFromCorpus(factHashIndex) {
     factHashIndex.clear();
     this.factOnlyHashes.clear();
-    const existing = [
-      ...await this.readAllMemories(),
-      ...await this.readAllColdMemories()
-    ];
+    const existing = [...await this.readAllMemories(), ...await this.readAllColdMemories()];
     let legacyRecovered = 0;
     for (const memory of existing) {
       if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") continue;
@@ -7827,55 +7410,55 @@ var StorageManager3 = class _StorageManager {
     return null;
   }
   get questionsDir() {
-    return path10.join(this.baseDir, "questions");
+    return path9.join(this.baseDir, "questions");
   }
   get artifactsDir() {
-    return path10.join(this.baseDir, "artifacts");
+    return path9.join(this.baseDir, "artifacts");
   }
   get identityDir() {
-    return path10.join(this.baseDir, "identity");
+    return path9.join(this.baseDir, "identity");
   }
   get identityAnchorPath() {
-    return path10.join(this.identityDir, "identity-anchor.md");
+    return path9.join(this.identityDir, "identity-anchor.md");
   }
   get identityIncidentsDir() {
-    return path10.join(this.identityDir, "incidents");
+    return path9.join(this.identityDir, "incidents");
   }
   get identityAuditsWeeklyDir() {
-    return path10.join(this.identityDir, "audits", "weekly");
+    return path9.join(this.identityDir, "audits", "weekly");
   }
   get identityAuditsMonthlyDir() {
-    return path10.join(this.identityDir, "audits", "monthly");
+    return path9.join(this.identityDir, "audits", "monthly");
   }
   get identityImprovementLoopsPath() {
-    return path10.join(this.identityDir, "improvement-loops.md");
+    return path9.join(this.identityDir, "improvement-loops.md");
   }
   get identityReflectionsPath() {
-    return path10.join(this.identityDir, "reflections.md");
+    return path9.join(this.identityDir, "reflections.md");
   }
   get profilePath() {
-    return path10.join(this.baseDir, "profile.md");
+    return path9.join(this.baseDir, "profile.md");
   }
   get memoryActionsPath() {
-    return path10.join(this.stateDir, "memory-actions.jsonl");
+    return path9.join(this.stateDir, "memory-actions.jsonl");
   }
   get memoryLifecycleLedgerPath() {
-    return path10.join(this.stateDir, "memory-lifecycle-ledger.jsonl");
+    return path9.join(this.stateDir, "memory-lifecycle-ledger.jsonl");
   }
   get compressionGuidelinesPath() {
-    return path10.join(this.stateDir, "compression-guidelines.md");
+    return path9.join(this.stateDir, "compression-guidelines.md");
   }
   get compressionGuidelineDraftPath() {
-    return path10.join(this.stateDir, "compression-guidelines.draft.md");
+    return path9.join(this.stateDir, "compression-guidelines.draft.md");
   }
   get compressionGuidelineStatePath() {
-    return path10.join(this.stateDir, "compression-guideline-state.json");
+    return path9.join(this.stateDir, "compression-guideline-state.json");
   }
   get compressionGuidelineDraftStatePath() {
-    return path10.join(this.stateDir, "compression-guideline-draft-state.json");
+    return path9.join(this.stateDir, "compression-guideline-draft-state.json");
   }
   get behaviorSignalsPath() {
-    return path10.join(this.stateDir, "behavior-signals.jsonl");
+    return path9.join(this.stateDir, "behavior-signals.jsonl");
   }
   /**
    * In-memory dedup key set for behavior-signals appends (issue #1909),
@@ -7907,7 +7490,7 @@ var StorageManager3 = class _StorageManager {
    * governance sweeps can treat it uniformly.
    */
   get bufferSurpriseLedgerPath() {
-    return path10.join(this.stateDir, "buffer-surprise-ledger.jsonl");
+    return path9.join(this.stateDir, "buffer-surprise-ledger.jsonl");
   }
   /**
    * Entity alias table loaded from THIS store's config/aliases.json.
@@ -7947,7 +7530,7 @@ var StorageManager3 = class _StorageManager {
     this.loadAliasesSync();
   }
   loadAliasesSync() {
-    const aliasPath = path10.join(this.baseDir, "config", "aliases.json");
+    const aliasPath = path9.join(this.baseDir, "config", "aliases.json");
     this.userAliases = {};
     try {
       const raw = readFileSync2(aliasPath, "utf-8");
@@ -7982,22 +7565,22 @@ var StorageManager3 = class _StorageManager {
     return completionFingerprint;
   }
   async ensureDirectories() {
-    await mkdir2(this.baseDir, { recursive: true });
+    await mkdir(this.baseDir, { recursive: true });
     await validateRoots(this.baseDir, this.entitiesDir, this.stateDir, this.archiveDir);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    await mkdir2(path10.join(this.factsDir, today), { recursive: true });
-    await mkdir2(path10.join(this.proceduresDir, today), { recursive: true });
-    await mkdir2(path10.join(this.reasoningTracesDir, today), { recursive: true });
-    await mkdir2(this.correctionsDir, { recursive: true });
-    await mkdir2(this.entitiesDir, { recursive: true });
-    await mkdir2(this.stateDir, { recursive: true });
-    await mkdir2(this.questionsDir, { recursive: true });
-    await mkdir2(this.artifactsDir, { recursive: true });
-    await mkdir2(this.identityDir, { recursive: true });
-    await mkdir2(this.identityIncidentsDir, { recursive: true });
-    await mkdir2(this.identityAuditsWeeklyDir, { recursive: true });
-    await mkdir2(this.identityAuditsMonthlyDir, { recursive: true });
-    await mkdir2(path10.join(this.baseDir, "config"), { recursive: true });
+    await mkdir(path9.join(this.factsDir, today), { recursive: true });
+    await mkdir(path9.join(this.proceduresDir, today), { recursive: true });
+    await mkdir(path9.join(this.reasoningTracesDir, today), { recursive: true });
+    await mkdir(this.correctionsDir, { recursive: true });
+    await mkdir(this.entitiesDir, { recursive: true });
+    await mkdir(this.stateDir, { recursive: true });
+    await mkdir(this.questionsDir, { recursive: true });
+    await mkdir(this.artifactsDir, { recursive: true });
+    await mkdir(this.identityDir, { recursive: true });
+    await mkdir(this.identityIncidentsDir, { recursive: true });
+    await mkdir(this.identityAuditsWeeklyDir, { recursive: true });
+    await mkdir(this.identityAuditsMonthlyDir, { recursive: true });
+    await mkdir(path9.join(this.baseDir, "config"), { recursive: true });
     await this.entityCanonicalIdMigration.ensure();
     if (this.hotMemoriesCacheEnabled && this.getMemoryCorpusVersion() === 0) {
       this.bumpMemoryCorpusVersion();
@@ -8018,12 +7601,24 @@ var StorageManager3 = class _StorageManager {
    */
   async resolveCategoryWritePath(category, id, today) {
     if (category === "correction") {
-      await mkdir2(this.correctionsDir, { recursive: true });
-      return path10.join(this.correctionsDir, `${id}.md`);
-    }
-    const datedDir = path10.join(getCategoryDir(this.baseDir, category), today);
-    await mkdir2(datedDir, { recursive: true });
-    return path10.join(datedDir, `${id}.md`);
+      await mkdir(this.correctionsDir, { recursive: true });
+      return path9.join(this.correctionsDir, `${id}.md`);
+    }
+    const datedDir = path9.join(getCategoryDir(this.baseDir, category), today);
+    await mkdir(datedDir, { recursive: true });
+    return path9.join(datedDir, `${id}.md`);
+  }
+  async findExistingTombstoneBlockedMemory(content, category, sourceConnector) {
+    const identity = buildExplicitCaptureDedupKey(content, category, sourceConnector);
+    const memories = [...await this.readAllMemories(), ...await this.readAllColdMemories()];
+    return memories.find((memory) => {
+      if (memory.frontmatter.status !== "pending_review" || !memory.frontmatter.blockedBy) return false;
+      return buildExplicitCaptureDedupKey(
+        memory.content,
+        memory.frontmatter.category,
+        memory.frontmatter.sourceConnector
+      ) === identity;
+    }) ?? null;
   }
   async writeMemory(category, content, options = {}) {
     await this.ensureDirectories();
@@ -8139,8 +7734,29 @@ var StorageManager3 = class _StorageManager {
 ${sanitized.text}
 `;
     const filePath = await this.resolveCategoryWritePath(category, id, today);
-    await this.snapshotBeforeWrite(filePath, "write");
-    await this.writeStorageSecureFile(filePath, fileContent);
+    const persistFile = async () => {
+      if (tombstoneBlocked) {
+        const duplicate = await this.findExistingTombstoneBlockedMemory(sanitized.text, category, fm.sourceConnector);
+        if (duplicate) return duplicate;
+      }
+      await this.snapshotBeforeWrite(filePath, "write");
+      await this.writeTombstoneBlockedMemory(filePath, fileContent, fm, sanitized.text, async () => {
+        this.invalidateAllMemoriesCache();
+      });
+      return null;
+    };
+    const duplicateBlocked = tombstoneBlocked ? await this.withTombstoneBlockedCaptureWriteLock(
+      persistFile,
+      buildExplicitCaptureDedupKey(sanitized.text, category, fm.sourceConnector)
+    ) : await persistFile();
+    if (duplicateBlocked) {
+      return {
+        id: duplicateBlocked.frontmatter.id,
+        tombstoneBlocked: true,
+        blockedBy: duplicateBlocked.frontmatter.blockedBy,
+        duplicateOf: duplicateBlocked.frontmatter.id
+      };
+    }
     await this.patchHotMemoriesCache({ addedPath: filePath }, "memory-create");
     this.notifyMemoryWrite(filePath);
     await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.writeMemory", {
@@ -8209,10 +7825,7 @@ ${sanitized.text}
     return await this.factContentHashPresentInCorpus(hash);
   }
   async factContentHashPresentInCorpus(targetHash) {
-    const existing = [
-      ...await this.readAllMemories(),
-      ...await this.readAllColdMemories()
-    ];
+    const existing = [...await this.readAllMemories(), ...await this.readAllColdMemories()];
     for (const memory of existing) {
       if (memory.frontmatter.category !== "fact") continue;
       if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") continue;
@@ -8328,8 +7941,8 @@ ${sanitized.text}
     await this.ensureDirectories();
     const now = /* @__PURE__ */ new Date();
     const day = now.toISOString().slice(0, 10);
-    const dir = path10.join(this.artifactsDir, day);
-    await mkdir2(dir, { recursive: true });
+    const dir = path9.join(this.artifactsDir, day);
+    await mkdir(dir, { recursive: true });
     const id = `artifact-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const fm = {
       id,
@@ -8353,7 +7966,7 @@ ${sanitized.text}
       log.warn(`artifact content rejected for ${id}; violations=${sanitized.violations.join(", ")}`);
       return "";
     }
-    const filePath = path10.join(dir, `${id}.md`);
+    const filePath = path9.join(dir, `${id}.md`);
     await this.writeStorageSecureFile(filePath, `${serializeFrontmatter(fm)}
 
 ${sanitized.text}
@@ -8624,7 +8237,7 @@ ${sanitized.text}
    * per-process in-memory cache safe across process boundaries.
    */
   invalidateColdMemoriesCache() {
-    const coldRoot = path10.join(this.baseDir, "cold");
+    const coldRoot = path9.join(this.baseDir, "cold");
     _StorageManager.coldMemoriesCache.delete(coldRoot);
     this.bumpColdWriteVersion();
     invalidateAllForDir(this.baseDir);
@@ -8726,7 +8339,7 @@ ${sanitized.text}
           return updatedMs >= updatedAfterMs ? filePath : null;
         }
         try {
-          const fileStat = await stat3(filePath);
+          const fileStat = await stat2(filePath);
           return fileStat.mtimeMs >= updatedAfterMs ? filePath : null;
         } catch {
           return filePath;
@@ -8739,7 +8352,7 @@ ${sanitized.text}
     const correctionPaths = [];
     const factPaths = [];
     for (const filePath of filePaths) {
-      if (filePath === this.correctionsDir || filePath.startsWith(`${this.correctionsDir}${path10.sep}`)) {
+      if (filePath === this.correctionsDir || filePath.startsWith(`${this.correctionsDir}${path9.sep}`)) {
         correctionPaths.push(filePath);
       } else {
         factPaths.push(filePath);
@@ -8802,7 +8415,7 @@ ${sanitized.text}
       try {
         const entries = await readdir5(dir, { withFileTypes: true });
         for (const entry of entries) {
-          const fullPath = path10.join(dir, entry.name);
+          const fullPath = path9.join(dir, entry.name);
           if (entry.isDirectory()) {
             await readDir(fullPath);
           } else if (entry.name.endsWith(".md")) {
@@ -8835,7 +8448,7 @@ ${sanitized.text}
     return this.memoryReadStore.readMemoryByPath(filePath);
   }
   resolveTierRootDir(tier) {
-    return tier === "cold" ? path10.join(this.baseDir, "cold") : this.baseDir;
+    return tier === "cold" ? path9.join(this.baseDir, "cold") : this.baseDir;
   }
   resolveMemoryDateDir(memory) {
     const preferred = memory.frontmatter.created || memory.frontmatter.updated;
@@ -8850,13 +8463,13 @@ ${sanitized.text}
   buildTierMemoryPath(memory, tier) {
     const root = this.resolveTierRootDir(tier);
     if (this.isArtifactMemory(memory)) {
-      return path10.join(root, "artifacts", this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
+      return path9.join(root, "artifacts", this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
     }
     if (memory.frontmatter.category === "correction") {
-      return path10.join(root, "corrections", `${memory.frontmatter.id}.md`);
+      return path9.join(root, "corrections", `${memory.frontmatter.id}.md`);
     }
     const dir = categoryDirName(memory.frontmatter.category);
-    return path10.join(root, dir, this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
+    return path9.join(root, dir, this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
   }
   async writeMemoryFileAtomic(targetPath, memory) {
     const fileContent = `${serializeFrontmatter(memory.frontmatter)}
@@ -8869,8 +8482,8 @@ ${memory.content}
   }
   async moveMemoryToPath(memory, targetPath) {
     await this.writeMemoryFileAtomic(targetPath, memory);
-    const sourcePath = path10.resolve(memory.path);
-    const destPath = path10.resolve(targetPath);
+    const sourcePath = path9.resolve(memory.path);
+    const destPath = path9.resolve(targetPath);
     if (sourcePath !== destPath) {
       try {
         await unlink3(memory.path);
@@ -8886,8 +8499,8 @@ ${memory.content}
   }
   async migrateMemoryToTier(memory, targetTier) {
     const targetPath = this.buildTierMemoryPath(memory, targetTier);
-    const sourcePath = path10.resolve(memory.path);
-    const destPath = path10.resolve(targetPath);
+    const sourcePath = path9.resolve(memory.path);
+    const destPath = path9.resolve(targetPath);
     if (sourcePath === destPath) {
       return { changed: false, targetPath };
     }
@@ -8914,7 +8527,7 @@ ${memory.content}
     return { changed: true, targetPath };
   }
   get archiveDir() {
-    return path10.join(this.baseDir, "archive");
+    return path9.join(this.baseDir, "archive");
   }
   /**
    * Archive a memory by moving it from facts/ to archive/YYYY-MM-DD/.
@@ -8922,48 +8535,52 @@ ${memory.content}
    * Returns the new file path on success, null on failure.
    */
   async archiveMemory(memory, lifecycle) {
-    try {
-      const now = lifecycle?.at ?? /* @__PURE__ */ new Date();
-      const today = now.toISOString().slice(0, 10);
-      const destDir = path10.join(this.archiveDir, today);
-      await mkdir2(destDir, { recursive: true });
-      const updatedFm = {
-        ...memory.frontmatter,
-        status: "archived",
-        archivedAt: now.toISOString(),
-        updated: now.toISOString()
-      };
-      const fileContent = `${serializeFrontmatter(updatedFm)}
+    const archiveCurrent = async (current, markDurable) => {
+      try {
+        const now = lifecycle?.at ?? /* @__PURE__ */ new Date();
+        const today = now.toISOString().slice(0, 10);
+        const destDir = path9.join(this.archiveDir, today);
+        await mkdir(destDir, { recursive: true });
+        const updatedFm = {
+          ...current.frontmatter,
+          status: "archived",
+          archivedAt: now.toISOString(),
+          updated: now.toISOString()
+        };
+        const fileContent = `${serializeFrontmatter(updatedFm)}
 
-${memory.content}
+${current.content}
 `;
-      const destPath = path10.join(destDir, path10.basename(memory.path));
-      await this.writeStorageSecureFile(destPath, fileContent);
-      await unlink3(memory.path);
-      markProjectedMemoryPathInvalid(this.baseDir, memory.frontmatter.id);
-      this.invalidateAllMemoriesCache();
-      await this.appendGeneratedMemoryLifecycleEventFailOpen(
-        "storage.archiveMemory",
-        {
-          memoryId: memory.frontmatter.id,
-          eventType: "archived",
-          timestamp: updatedFm.archivedAt ?? updatedFm.updated,
-          actor: lifecycle?.actor ?? "storage.archiveMemory",
-          reasonCode: lifecycle?.reasonCode,
-          before: this.summarizeLifecycleState(memory.frontmatter, memory.path),
-          after: this.summarizeLifecycleState(updatedFm, destPath),
-          relatedMemoryIds: lifecycle?.relatedMemoryIds,
-          correlationId: lifecycle?.correlationId
-        },
-        lifecycle?.ruleVersion
-      );
-      this.bumpMemoryStatusVersion();
-      log.debug(`archived memory ${memory.frontmatter.id} \u2192 ${destPath}`);
-      return destPath;
-    } catch (err) {
-      log.warn(`failed to archive memory ${memory.frontmatter.id}: ${err}`);
-      return null;
-    }
+        const destPath = path9.join(destDir, path9.basename(current.path));
+        await this.writeStorageSecureFile(destPath, fileContent);
+        await unlink3(current.path);
+        markDurable();
+        markProjectedMemoryPathInvalid(this.baseDir, current.frontmatter.id);
+        this.invalidateAllMemoriesCache();
+        await this.appendGeneratedMemoryLifecycleEventFailOpen(
+          "storage.archiveMemory",
+          {
+            memoryId: current.frontmatter.id,
+            eventType: "archived",
+            timestamp: updatedFm.archivedAt ?? updatedFm.updated,
+            actor: lifecycle?.actor ?? "storage.archiveMemory",
+            reasonCode: lifecycle?.reasonCode,
+            before: this.summarizeLifecycleState(current.frontmatter, current.path),
+            after: this.summarizeLifecycleState(updatedFm, destPath),
+            relatedMemoryIds: lifecycle?.relatedMemoryIds,
+            correlationId: lifecycle?.correlationId
+          },
+          lifecycle?.ruleVersion
+        );
+        this.bumpMemoryStatusVersion();
+        log.debug(`archived memory ${current.frontmatter.id} \u2192 ${destPath}`);
+        return destPath;
+      } catch (err) {
+        log.warn(`failed to archive memory ${current.frontmatter.id}: ${err}`);
+        return null;
+      }
+    };
+    return await this.runTombstoneBlockedArchive(memory, archiveCurrent);
   }
   async readEntities() {
     try {
@@ -9016,18 +8633,21 @@ ${memory.content}
   }
   async invalidateMemory(id) {
     const memories = await this.readAllMemories();
-    const memory = memories.find((m) => m.frontmatter.id === id);
+    const memory = memories.find((candidate) => candidate.frontmatter.id === id);
     if (!memory) return false;
-    try {
-      await unlink3(memory.path);
-      markProjectedMemoryPathInvalid(this.baseDir, id);
-      this.invalidateAllMemoriesCache();
-      this.bumpMemoryStatusVersion();
-      log.debug(`invalidated memory ${id}`);
-      return true;
-    } catch {
-      return false;
-    }
+    return await this.runTombstoneBlockedInvalidation(
+      memory,
+      async (current, rebuildMarker, markDurable) => {
+        await unlink3(current.path);
+        markDurable();
+        markProjectedMemoryPathInvalid(this.baseDir, id);
+        this.invalidateAllMemoriesCache();
+        await this.rebuildTombstoneBlockedCaptureAfterInvalidation(rebuildMarker);
+        this.bumpMemoryStatusVersion();
+        log.debug(`invalidated memory ${id}`);
+        return true;
+      }
+    );
   }
   async updateMemory(id, newContent, options) {
     const memories = await this.readAllMemories();
@@ -9051,7 +8671,9 @@ ${memory.content}
 
 ${sanitized.text}
 `;
-    await this.writeStorageSecureFile(memory.path, fileContent);
+    await this.writeTombstoneBlockedUpdate(memory, fileContent, updated, sanitized.text, async () => {
+      this.invalidateAllMemoriesCache();
+    });
     await this.patchHotMemoriesCache({ addedPath: memory.path });
     await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.updateMemory", {
       memoryId: id,
@@ -9083,9 +8705,14 @@ ${sanitized.text}
 
 ${memory.content}
 `;
-    await this.writeStorageSecureFile(memory.path, fileContent);
+    await this.writeTombstoneBlockedFrontmatter(memory, fileContent, updated, async () => {
+      this.invalidateAllMemoriesCache();
+      if (memory.path.includes(`${path9.sep}cold${path9.sep}`)) {
+        this.invalidateColdMemoriesCache();
+      }
+    });
     await this.patchHotMemoriesCache({ addedPath: memory.path });
-    if (memory.path.includes(`${path10.sep}cold${path10.sep}`)) {
+    if (memory.path.includes(`${path9.sep}cold${path9.sep}`)) {
       this.invalidateColdMemoriesCache();
     }
     try {
@@ -9138,15 +8765,14 @@ ${memory.content}
     for (const m of memories) {
       if (!m.frontmatter.expiresAt) continue;
       const expiresAt = new Date(m.frontmatter.expiresAt).getTime();
-      if (expiresAt < now) {
-        try {
-          await unlink3(m.path);
-          markProjectedMemoryPathInvalid(this.baseDir, m.frontmatter.id);
-          this.bumpMemoryCorpusVersion();
-          deleted.push(m);
-          log.debug(`cleaned expired memory ${m.frontmatter.id} (TTL expired)`);
-        } catch {
-        }
+      if (expiresAt >= now) continue;
+      const removed = await this.deleteMemoryForMaintenance(m, (current) => {
+        const currentExpiresAt = current.frontmatter.expiresAt ? new Date(current.frontmatter.expiresAt).getTime() : Number.NaN;
+        return Number.isFinite(currentExpiresAt) && currentExpiresAt < now;
+      });
+      if (removed) {
+        deleted.push(removed);
+        log.debug(`cleaned expired memory ${removed.frontmatter.id} (TTL expired)`);
       }
     }
     if (deleted.length > 0) {
@@ -9156,7 +8782,7 @@ ${memory.content}
     return deleted;
   }
   async loadBuffer() {
-    const bufferPath = path10.join(this.stateDir, "buffer.json");
+    const bufferPath = path9.join(this.stateDir, "buffer.json");
     try {
       const raw = await this.readStorageSecureFile(bufferPath);
       return JSON.parse(raw);
@@ -9168,11 +8794,11 @@ ${memory.content}
   }
   async saveBuffer(state) {
     await this.ensureDirectories();
-    const bufferPath = path10.join(this.stateDir, "buffer.json");
+    const bufferPath = path9.join(this.stateDir, "buffer.json");
     await this.writeStorageSecureFile(bufferPath, JSON.stringify(state, null, 2));
   }
   async loadMeta() {
-    const metaPath = path10.join(this.stateDir, "meta.json");
+    const metaPath = path9.join(this.stateDir, "meta.json");
     try {
       const raw = await this.readStorageSecureFile(metaPath);
       const parsed = JSON.parse(raw);
@@ -9205,7 +8831,7 @@ ${memory.content}
   }
   async saveMeta(state) {
     await this.ensureDirectories();
-    const metaPath = path10.join(this.stateDir, "meta.json");
+    const metaPath = path9.join(this.stateDir, "meta.json");
     await this.writeStorageSecureFile(metaPath, JSON.stringify(state, null, 2));
   }
   async appendMemoryActionEvents(events) {
@@ -9260,10 +8886,7 @@ ${memory.content}
    * The offline CLI uses this path-aware variant for per-namespace ledgers so
    * secure-store encryption and path-bound authentication remain consistent. */
   async drainPendingMemoryLifecycleEventsForSyncAt(ledgerPath) {
-    const target = this.assertManagedStoragePath(
-      ledgerPath,
-      "storage.drainPendingMemoryLifecycleEventsForSyncAt"
-    );
+    const target = this.assertManagedStoragePath(ledgerPath, "storage.drainPendingMemoryLifecycleEventsForSyncAt");
     return drainPendingLifecycleLedgerForSync(
       target,
       {
@@ -9272,7 +8895,7 @@ ${memory.content}
       },
       (payload) => this.appendStorageSecureFile(target, payload),
       async () => {
-        await mkdir2(path10.dirname(target), { recursive: true });
+        await mkdir(path9.dirname(target), { recursive: true });
       }
     );
   }
@@ -9304,7 +8927,7 @@ ${memory.content}
     let existingKeys;
     let identity = null;
     try {
-      const st = await stat3(this.behaviorSignalsPath);
+      const st = await stat2(this.behaviorSignalsPath);
       identity = { size: st.size, mtimeMs: st.mtimeMs };
       if (this.behaviorSignalsKeyCache && this.behaviorSignalsKeyCache.identity.size === identity.size && this.behaviorSignalsKeyCache.identity.mtimeMs === identity.mtimeMs) {
         existingKeys = this.behaviorSignalsKeyCache.keys;
@@ -9352,7 +8975,7 @@ ${memory.content}
     await this.appendStorageSecureFile(this.behaviorSignalsPath, payload);
     for (const key of pending) existingKeys.add(key);
     try {
-      const st = await stat3(this.behaviorSignalsPath);
+      const st = await stat2(this.behaviorSignalsPath);
       const expectedSize = (identity?.size ?? 0) + Buffer.byteLength(payload, "utf-8");
       if (st.size === expectedSize) {
         this.behaviorSignalsKeyCache = {
@@ -9370,7 +8993,7 @@ ${memory.content}
   async appendReextractJobs(events) {
     if (events.length === 0) return 0;
     await this.ensureDirectories();
-    const filePath = path10.join(this.stateDir, "reextract-jobs.jsonl");
+    const filePath = path9.join(this.stateDir, "reextract-jobs.jsonl");
     const lines = events.map((event) => JSON.stringify(event)).join("\n") + "\n";
     try {
       await this.appendStorageSecureFile(filePath, lines);
@@ -9383,7 +9006,7 @@ ${memory.content}
   }
   async readReextractJobs(limit = 200) {
     const safeLimit = Number.isFinite(limit) ? Math.max(1, Math.min(1e3, Math.floor(limit))) : 200;
-    const filePath = path10.join(this.stateDir, "reextract-jobs.jsonl");
+    const filePath = path9.join(this.stateDir, "reextract-jobs.jsonl");
     try {
       const raw = await this.readStorageSecureFile(filePath);
       const lines = raw.split("\n").filter((line) => line.trim().length > 0);
@@ -9463,10 +9086,7 @@ ${memory.content}
   }
   async readAllMemoryLifecycleEventsForCompaction() {
     if (!await probeEncryptedRegularFileHeader(this.memoryLifecycleLedgerPath)) {
-      return readAllLifecycleEventsFromLedger(
-        this.memoryLifecycleLedgerPath,
-        (p) => this.readStorageSecureFile(p)
-      );
+      return readAllLifecycleEventsFromLedger(this.memoryLifecycleLedgerPath, (p) => this.readStorageSecureFile(p));
     }
     return readAllLifecycleEventsFromLedgerBuffer(
       this.memoryLifecycleLedgerPath,
@@ -9597,7 +9217,7 @@ ${memory.content}
     return `${prefix}-${ts}-${rand}`;
   }
   async writeQuestion(question, context, priority) {
-    await mkdir2(this.questionsDir, { recursive: true });
+    await mkdir(this.questionsDir, { recursive: true });
     const id = this.generateId("q");
     const frontmatter = {
       id,
@@ -9613,7 +9233,7 @@ ${question}
 
 **Context:** ${context}
 `;
-    const filePath = path10.join(this.questionsDir, `${id}.md`);
+    const filePath = path9.join(this.questionsDir, `${id}.md`);
     await this.writeStorageSecureFile(filePath, content);
     log.debug(`wrote question ${id} to ${filePath}`);
     this.invalidateQuestionsCache();
@@ -9631,7 +9251,7 @@ ${question}
     if (!match) return null;
     const frontmatterStr = match[1];
     const body = match[2].trim();
-    const id = this.extractFrontmatterValue(frontmatterStr, "id") ?? path10.basename(filePath, ".md");
+    const id = this.extractFrontmatterValue(frontmatterStr, "id") ?? path9.basename(filePath, ".md");
     const created = this.extractFrontmatterValue(frontmatterStr, "created") ?? "";
     const priority = parseFloat(this.extractFrontmatterValue(frontmatterStr, "priority") ?? "0.5");
     const resolved = this.extractFrontmatterValue(frontmatterStr, "resolved") === "true";
@@ -9687,11 +9307,11 @@ ${question}
     } catch {
     }
     const hygiene = opts?.hygiene;
-    const rotateEnabled = hygiene?.enabled === true && hygiene.rotateEnabled === true && Array.isArray(hygiene.rotatePaths) && hygiene.rotatePaths.includes(path10.basename(identityPath));
+    const rotateEnabled = hygiene?.enabled === true && hygiene.rotateEnabled === true && Array.isArray(hygiene.rotatePaths) && hygiene.rotatePaths.includes(path9.basename(identityPath));
     if (rotateEnabled) {
       const maxBytes = hygiene.rotateMaxBytes;
       if (existing.length > maxBytes) {
-        const archiveDir = path10.join(workspaceDir, hygiene.archiveDir);
+        const archiveDir = path9.join(workspaceDir, hygiene.archiveDir);
         const { newContent } = await rotateMarkdownFileToArchive({
           filePath: identityPath,
           archiveDir,
@@ -9743,7 +9363,7 @@ ${reflection}
     }
   }
   async writeIdentityReflections(content) {
-    await mkdir2(this.identityDir, { recursive: true });
+    await mkdir(this.identityDir, { recursive: true });
     await this.writeStorageSecureFile(this.identityReflectionsPath, content);
   }
   async appendIdentityReflection(reflection) {
@@ -9775,7 +9395,7 @@ ${reflection}
 
 ${reflection}
 `;
-    await mkdir2(this.identityDir, { recursive: true });
+    await mkdir(this.identityDir, { recursive: true });
     await this.writeStorageSecureFile(this.identityReflectionsPath, `${existing.trimEnd()}${section}`);
     log.debug(`appended namespace-local reflection to ${this.identityReflectionsPath}`);
   }
@@ -9787,7 +9407,7 @@ ${reflection}
    * Deduplicates by target+label.
    */
   async addEntityRelationship(name, rel) {
-    const filePath = path10.join(this.entitiesDir, `${name}.md`);
+    const filePath = path9.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
       const content = await this.readStorageSecureFile(filePath);
@@ -9810,7 +9430,7 @@ ${reflection}
    * Prepends to the beginning, prunes oldest entries beyond maxEntries.
    */
   async addEntityActivity(name, entry, maxEntries) {
-    const filePath = path10.join(this.entitiesDir, `${name}.md`);
+    const filePath = path9.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
       const content = await this.readStorageSecureFile(filePath);
@@ -9830,7 +9450,7 @@ ${reflection}
     this.invalidateKnowledgeIndexCache();
   }
   async addEntityAlias(name, alias) {
-    const filePath = path10.join(this.entitiesDir, `${name}.md`);
+    const filePath = path9.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
       const content = await this.readStorageSecureFile(filePath);
@@ -9858,7 +9478,7 @@ ${reflection}
     const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     let synthesisTimelineCount;
     try {
-      const filePath = path10.join(this.entitiesDir, `${name}.md`);
+      const filePath = path9.join(this.entitiesDir, `${name}.md`);
       const content = await this.readStorageSecureFile(filePath);
       synthesisTimelineCount = parseEntityFile(content, this.entitySchemas).timeline.length;
     } catch (err) {
@@ -9900,7 +9520,7 @@ ${reflection}
       const rightTs = latestEntityTimelineTimestamp(right.entity) ?? "";
       return compareEntityTimestamps(rightTs, leftTs);
     }).map(({ entityName }) => entityName);
-    await mkdir2(this.stateDir, { recursive: true });
+    await mkdir(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       this.entitySynthesisQueuePath,
       JSON.stringify(
@@ -9920,7 +9540,7 @@ ${reflection}
     if (queue.length === 0) return;
     const removals = new Set(entityNames);
     const nextQueue = queue.filter((name) => !removals.has(name));
-    await mkdir2(this.stateDir, { recursive: true });
+    await mkdir(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       this.entitySynthesisQueuePath,
       JSON.stringify(
@@ -9941,7 +9561,7 @@ ${reflection}
       if (!raw) continue;
       const serialized = serializeEntityFile(parseEntityFile(raw, this.entitySchemas), this.entitySchemas);
       if (raw.trimEnd() === serialized.trimEnd()) continue;
-      await this.writeStorageSecureFile(path10.join(this.entitiesDir, `${entityName}.md`), serialized);
+      await this.writeStorageSecureFile(path9.join(this.entitiesDir, `${entityName}.md`), serialized);
       migrated += 1;
     }
     if (migrated > 0) {
@@ -10007,15 +9627,18 @@ ${reflection}
       const isResolved = m.frontmatter.tags.some((t) => t === "fulfilled" || t === "expired");
       if (!isResolved) continue;
       const updatedAt = new Date(m.frontmatter.updated).getTime();
-      if (updatedAt < cutoff) {
-        try {
-          await unlink3(m.path);
-          markProjectedMemoryPathInvalid(this.baseDir, m.frontmatter.id);
-          this.bumpMemoryCorpusVersion();
-          deleted.push(m);
-          log.debug(`cleaned expired commitment ${m.frontmatter.id}`);
-        } catch {
+      if (updatedAt >= cutoff) continue;
+      try {
+        const removed = await this.deleteMemoryForMaintenance(m, (current) => {
+          const currentResolved = current.frontmatter.tags.some((tag) => tag === "fulfilled" || tag === "expired");
+          const currentUpdatedAt = new Date(current.frontmatter.updated).getTime();
+          return currentResolved && currentUpdatedAt < cutoff;
+        });
+        if (removed) {
+          deleted.push(removed);
+          log.debug(`cleaned expired commitment ${removed.frontmatter.id}`);
         }
+      } catch {
       }
     }
     if (deleted.length > 0) {
@@ -10034,14 +9657,14 @@ ${reflection}
     if (entries.length === 0) return 0;
     const memories = await this.readAllMemories();
     const memoryMap = new Map(memories.map((m) => [m.frontmatter.id, m]));
-    const memoryPathMap = new Map(memories.map((m) => [path10.resolve(m.path), m]));
+    const memoryPathMap = new Map(memories.map((m) => [path9.resolve(m.path), m]));
     let updated = 0;
     const prevVersion = this.getMemoryCorpusVersion();
     const keyId = this.hotCacheKeyId();
     const warm = this.hotMemoriesCacheEnabled && getCachedMemories(this.baseDir, prevVersion, keyId, this.hotCacheTtlMs()) !== null;
     const appliedPatches = /* @__PURE__ */ new Map();
     for (const entry of entries) {
-      const memory = entry.memoryPath ? memoryPathMap.get(path10.resolve(entry.memoryPath)) : memoryMap.get(entry.memoryId);
+      const memory = entry.memoryPath ? memoryPathMap.get(path9.resolve(entry.memoryPath)) : memoryMap.get(entry.memoryId);
       if (!memory) continue;
       const newFm = {
         ...memory.frontmatter,
@@ -10057,7 +9680,7 @@ ${memory.content}
         if (warm) {
           updateCacheOnWrite(this.baseDir, { ...memory, frontmatter: newFm }, keyId);
         }
-        appliedPatches.set(path10.resolve(memory.path), {
+        appliedPatches.set(path9.resolve(memory.path), {
           accessCount: entry.newCount,
           lastAccessed: entry.lastAccessed
         });
@@ -10073,8 +9696,11 @@ ${memory.content}
         const cur = getCachedMemories(this.baseDir, prevVersion, keyId);
         if (cur) {
           const reapplied = cur.map((m) => {
-            const patch = appliedPatches.get(path10.resolve(m.path));
-            return patch ? { ...m, frontmatter: { ...m.frontmatter, accessCount: patch.accessCount, lastAccessed: patch.lastAccessed } } : m;
+            const patch = appliedPatches.get(path9.resolve(m.path));
+            return patch ? {
+              ...m,
+              frontmatter: { ...m.frontmatter, accessCount: patch.accessCount, lastAccessed: patch.lastAccessed }
+            } : m;
           });
           setCachedMemories(this.baseDir, reapplied, produced, keyId, this.hotCacheTtlMs());
         }
@@ -10105,7 +9731,7 @@ ${memory.content}
     const pathsById = /* @__PURE__ */ new Map();
     const filePathsById = /* @__PURE__ */ new Map();
     for (const filePath of filePaths) {
-      const memoryId = path10.basename(filePath, ".md");
+      const memoryId = path9.basename(filePath, ".md");
       if (!wantedIds.has(memoryId)) continue;
       const paths = filePathsById.get(memoryId) ?? [];
       paths.push(filePath);
@@ -10116,12 +9742,8 @@ ${memory.content}
       const preferred = preferredPaths.get(id) ?? [];
       const preferredMatches = [];
       for (const preferredPath of preferred) {
-        const directCandidates = new Set(
-          qmdResultPathCandidates(this.baseDir, preferredPath)
-        );
-        const directMatch = existingPaths.find(
-          (filePath) => directCandidates.has(path10.resolve(filePath))
-        );
+        const directCandidates = new Set(qmdResultPathCandidates(this.baseDir, preferredPath));
+        const directMatch = existingPaths.find((filePath) => directCandidates.has(path9.resolve(filePath)));
         if (directMatch) {
           preferredMatches.push(directMatch);
           continue;
@@ -10133,7 +9755,7 @@ ${memory.content}
             candidates.add(candidate);
           }
         }
-        const match = existingPaths.find((filePath) => candidates.has(path10.resolve(filePath)));
+        const match = existingPaths.find((filePath) => candidates.has(path9.resolve(filePath)));
         if (match) preferredMatches.push(match);
       }
       if (preferredMatches.length > 0) {
@@ -10266,10 +9888,17 @@ ${memory.content}
 ${sanitized.text}
 `;
     const filePath = await this.resolveCategoryWritePath(category, id, today);
-    await this.writeStorageSecureFile(filePath, fileContent);
-    await this.patchHotMemoriesCache({ addedPath: filePath }, "memory-create");
-    log.debug(`wrote chunk ${id} (${chunkIndex + 1}/${chunkTotal}) to ${filePath}`);
-    return id;
+    return await this.writeTombstoneBlockedChunk(
+      filePath,
+      fileContent,
+      fm,
+      sanitized.text,
+      () => this.findExistingTombstoneBlockedMemory(sanitized.text, category, fm.sourceConnector),
+      async () => {
+        await this.patchHotMemoriesCache({ addedPath: filePath }, "memory-create");
+        log.debug(`wrote chunk ${id} (${chunkIndex + 1}/${chunkTotal}) to ${filePath}`);
+      }
+    );
   }
   /**
    * Get all chunks for a given parent memory ID.
@@ -10339,7 +9968,12 @@ ${oldMemory.content}
       const auditBody = `Superseded: ${oldMemory.content}
 
 Reason: ${reason}`;
-      const auditInput = { content: auditBody, category: "correction", confidence: 1, tags: ["supersession", "auto-resolved"] };
+      const auditInput = {
+        content: auditBody,
+        category: "correction",
+        confidence: 1,
+        tags: ["supersession", "auto-resolved"]
+      };
       const auditEnvelope = composeMemoryEnvelope(auditInput, { source: "contradiction-detection" });
       await this.writeSealedMemory(auditEnvelope, { lineage: [oldMemoryId, newMemoryId] });
       return true;
@@ -10352,14 +9986,14 @@ Reason: ${reason}`;
   // Memory Summarization (Phase 4A)
   // ---------------------------------------------------------------------------
   get summariesDir() {
-    return path10.join(this.baseDir, "summaries");
+    return path9.join(this.baseDir, "summaries");
   }
   /**
    * Write a memory summary.
    */
   async writeSummary(summary) {
-    await mkdir2(this.summariesDir, { recursive: true });
-    const filePath = path10.join(this.summariesDir, `${summary.id}.json`);
+    await mkdir(this.summariesDir, { recursive: true });
+    const filePath = path9.join(this.summariesDir, `${summary.id}.json`);
     await this.writeStorageSecureFile(filePath, JSON.stringify(summary, null, 2));
     log.debug(`wrote summary ${summary.id}`);
   }
@@ -10372,7 +10006,7 @@ Reason: ${reason}`;
       const summaries = [];
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
-        const filePath = path10.join(this.summariesDir, file);
+        const filePath = path9.join(this.summariesDir, file);
         const raw = await this.readStorageSecureFile(filePath);
         summaries.push(JSON.parse(raw));
       }
@@ -10434,8 +10068,8 @@ ${memory.content}
    * Save topic scores to meta.json.
    */
   async saveTopics(topics) {
-    const metaPath = path10.join(this.stateDir, "topics.json");
-    await mkdir2(this.stateDir, { recursive: true });
+    const metaPath = path9.join(this.stateDir, "topics.json");
+    await mkdir(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       metaPath,
       JSON.stringify({ topics, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
@@ -10446,7 +10080,7 @@ ${memory.content}
    * Load topic scores from meta.json.
    */
   async loadTopics() {
-    const metaPath = path10.join(this.stateDir, "topics.json");
+    const metaPath = path9.join(this.stateDir, "topics.json");
     try {
       const raw = await this.readStorageSecureFile(metaPath);
       return JSON.parse(raw);
@@ -10557,8 +10191,6 @@ export {
   countEntityStructuredFacts,
   fingerprintEntityStructuredFacts,
   isEntitySynthesisStale,
-  FactHashIndexNotAuthoritativeError,
-  ContentHashIndex,
   parseFrontmatterStringValue,
   parseFrontmatter,
   normalizeFrontmatterForPath,
@@ -10568,4 +10200,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-FCDWWCLX.js.map
+//# sourceMappingURL=chunk-RGIWINDN.js.map