@remnic/core 9.3.700 → 9.3.702

package/dist/{chunk-PQG4T5V3.js → chunk-64XXOQRW.js}

@@ -4,7 +4,10 @@ import {
 } from "./chunk-ZFXCQPNO.js";
 import {
   StorageManager
-} from "./chunk-X74FJSW7.js";
+} from "./chunk-GFIARMA7.js";
+import {
+  MutationSerializer
+} from "./chunk-LTJAMRGI.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -113,21 +116,22 @@ var NamespaceStorageRouter = class {
   // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new
   // or its dir changed, so a steady-state cache hit is a no-op for the catalog.
   notifiedResolved = /* @__PURE__ */ new Map();
-  // In-flight resolve-hook dedup (NFJV-, codex P2). The catalog's `onResolve`
-  // hook is ASYNC (it returns `registerResolved(...)`), so `notifiedResolved` is
-  // only set after the hook's promise SETTLES. Without tracking the in-flight
-  // window, a burst of `storageFor()` cache hits for the SAME namespace before
-  // the first registration finishes would each pass the `notifiedResolved` guard
-  // and fire their OWN `onResolve` — queueing N duplicate catalog touches + lock
-  // acquisitions despite the once-per-namespace intent. We therefore record the
-  // (namespace → storageDir) being registered BEFORE awaiting the hook so a
-  // concurrent call for the same pair skips firing. On SUCCESS the pair is
-  // promoted to `notifiedResolved` (future calls skip permanently); on `false`
-  // (dropped touch — e.g. rebuild-lock timeout) OR rejection the in-flight marker
-  // is CLEARED so a later `storageFor()` can RETRY the dropped registration. The
-  // entry is always removed when the promise settles, so the map cannot grow
-  // unbounded (one transient entry per concurrently-resolving namespace).
-  inFlightResolved = /* @__PURE__ */ new Map();
+  // Instance-scoped serializer for the resolve hook (issue #1524 adoption).
+  // Replaces the bespoke `inFlightResolved` marker-then-clear pattern: the
+  // serializer's per-key chain strictly orders concurrent notifications for the
+  // SAME namespace, and the task re-checks `notifiedResolved` once it runs, so a
+  // burst of cache hits before the first hook settles collapses to a single
+  // hook invocation (the once-per-namespace intent). Recovery is preserved —
+  // one rejected hook never poisons subsequent notifications for that key.
+  resolveSerializer = new MutationSerializer();
+  // (namespace, storageDir) pairs whose resolve hook is currently pending. Set SYNCHRONOUSLY in
+  // notifyResolved (before queueing) so a burst of concurrent storageFor()
+  // cache hits collapses onto the one in-flight hook instead of each enqueuing
+  // its own task. Cleared when the queued hook settles. Without this, a dropped
+  // hook (returns false on a rebuild-lock timeout) leaves notifiedResolved
+  // unset, so every queued sibling task would re-run the hook — N serial lock
+  // waits (cursor Medium 06f58a7c, codex P2).
+  inFlightResolveHooks = /* @__PURE__ */ new Set();
   // Tracks every in-flight resolve-hook promise so callers can deterministically
   // await the fire-and-forget registrations that `storageFor()` kicks off (see
   // `whenResolveHooksSettled`). Entries are removed as each hook settles, so the
@@ -184,41 +188,41 @@ var NamespaceStorageRouter = class {
   /**
    * Fire the resolve hook defensively. A hook failure (e.g. a catalog write
    * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.
+   *
+   * Issue #1524 adoption: hook invocations for the SAME namespace are now
+   * strictly ordered through the shared `MutationSerializer` rather than the
+   * bespoke `inFlightResolved` marker-then-clear pattern. The serializer
+   * guarantees one in-flight hook per namespace; a concurrent burst of
+   * `storageFor()` cache hits collapses to a single hook invocation because
+   * each queued task re-checks `notifiedResolved` before invoking the hook. A
+   * dropped (`false`) or rejected hook leaves `notifiedResolved` unset so the
+   * next `storageFor()` retries — the serializer recovers from the rejection,
+   * so a failed hook never poisons later notifications.
    */
   notifyResolved(namespace, storageDir) {
     const hook = this.hooks.onResolve;
     if (!hook) return;
     if (this.notifiedResolved.get(namespace) === storageDir) return;
-    if (this.inFlightResolved.get(namespace) === storageDir) return;
-    try {
-      this.inFlightResolved.set(namespace, storageDir);
-      const hookResult = Promise.resolve(hook(namespace, storageDir));
-      this.pendingResolveHooks.add(hookResult);
-      hookResult.then(
-        (persisted) => {
-          if (this.inFlightResolved.get(namespace) === storageDir) {
-            this.inFlightResolved.delete(namespace);
-          }
-          if (persisted !== false) {
-            this.notifiedResolved.set(namespace, storageDir);
-          }
-          this.pendingResolveHooks.delete(hookResult);
-        },
-        () => {
-          if (this.inFlightResolved.get(namespace) === storageDir) {
-            this.inFlightResolved.delete(namespace);
-          }
-          if (this.notifiedResolved.get(namespace) === storageDir) {
-            this.notifiedResolved.delete(namespace);
-          }
-          this.pendingResolveHooks.delete(hookResult);
+    const inFlightKey = namespace + "\0" + storageDir;
+    if (this.inFlightResolveHooks.has(inFlightKey)) return;
+    this.inFlightResolveHooks.add(inFlightKey);
+    const task = async () => {
+      if (this.notifiedResolved.get(namespace) === storageDir) return;
+      try {
+        const persisted = await Promise.resolve(hook(namespace, storageDir));
+        if (persisted !== false) {
+          this.notifiedResolved.set(namespace, storageDir);
         }
-      );
-    } catch {
-      if (this.inFlightResolved.get(namespace) === storageDir) {
-        this.inFlightResolved.delete(namespace);
+      } catch {
       }
-    }
+    };
+    const queued = this.resolveSerializer.serialize(namespace, task);
+    this.pendingResolveHooks.add(queued);
+    const cleanup = () => {
+      this.inFlightResolveHooks.delete(inFlightKey);
+      this.pendingResolveHooks.delete(queued);
+    };
+    void queued.then(cleanup, cleanup);
   }
   /**
    * Install the post-write catalog touch hook on an externally-constructed
@@ -332,4 +336,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-PQG4T5V3.js.map
+//# sourceMappingURL=chunk-64XXOQRW.js.map

package/dist/chunk-64XXOQRW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\nimport type { NamespaceCatalog } from \"./catalog.js\";\nimport { MutationSerializer } from \"../utils/serialize-mutations.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\n/**\n * Optional hooks for the storage router. `onResolve` fires whenever a namespace's\n * storage is resolved/created, so a downstream consumer (e.g. the namespace\n * catalog, issue #1499) can register the namespace. The hook MUST NOT throw into\n * the router; the router invokes it defensively and a hook failure never affects\n * storage resolution.\n *\n * The hook MAY return (or resolve to) a boolean indicating whether the\n * registration actually PERSISTED (round 6, codex P2 — NEFoX). When it resolves\n * to `false` (a dropped/no-op registration), the router does NOT mark the\n * (namespace, storageDir) pair as notified, so the next resolve RETRIES it\n * instead of suppressing it forever. A `void`/`undefined` result is treated as\n * success (legacy hooks).\n */\nexport interface NamespaceStorageRouterHooks {\n  onResolve?: (\n    namespace: string,\n    storageDir: string,\n  ) => void | boolean | Promise<void | boolean>;\n}\n\n/**\n * Resolve the runtime storage root for the configured DEFAULT namespace.\n *\n * Shared between the live router (`NamespaceStorageRouter.defaultNamespaceRoot`)\n * and the rebuildable catalog (`NamespaceCatalog.rebuildFromDisk`) so the two\n * can never diverge (CLAUDE.md rule #22/#42 — read & write paths resolve through\n * the same logic). The contract is: while legacy memory data still lives\n * directly under `memoryDir`, the default root stays `memoryDir`; only once the\n * legacy root is empty and a `namespaces/<default|token>` dir holds data does\n * the default migrate into that tokenized/legacy-named dir.\n */\nexport async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise<string> {\n  if (!config.namespacesEnabled) {\n    return config.memoryDir;\n  }\n\n  // Build the legacy default root from the NORMALIZED (trimmed) name so a\n  // whitespace-padded `defaultNamespace` still finds the live `namespaces/default`\n  // root (NIabe). `storageFor()` classifies the trimmed value as the default, and\n  // the on-disk legacy dir is created under the trimmed name; using the raw spaced\n  // name here would look for `namespaces/<spaced>` and miss the real root, falling\n  // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes\n  // internally, so the tokenized path is unaffected.\n  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);\n  const tokenizedNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityToken(config.defaultNamespace),\n  );\n  const tokenizedHasData =\n    (await exists(tokenizedNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n  const nsDir = tokenizedHasData\n    ? tokenizedNsDir\n    : (await exists(legacyNsDir))\n      ? legacyNsDir\n      : tokenizedNsDir;\n  return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))\n    ? nsDir\n    : config.memoryDir;\n}\n\n/**\n * Resolve the runtime storage root for ANY namespace exactly as the live router\n * would (`NamespaceStorageRouter.namespaceRoot`). Shared so the rebuildable\n * catalog records the SAME on-disk root the router routes to — a recall/read\n * touch must not guess `namespaces/<token>` when the router actually serves a\n * legacy raw-name dir or a migrated default root (CLAUDE.md rule #22/#42; round\n * 4, cursor Medium). The default namespace delegates to `resolveDefaultNamespaceRoot`;\n * every other namespace prefers the tokenized root when it has a storage marker,\n * else a legacy raw-name dir when present, else the tokenized root.\n */\nexport async function resolveNamespaceStorageRoot(\n  config: PluginConfig,\n  namespace: string,\n): Promise<string> {\n  if (!config.namespacesEnabled) return config.memoryDir;\n  // Compare on NORMALIZED identity so a whitespace-padded configured default name\n  // still routes to the default root rather than a tokenized non-default dir\n  // (NH-FH). The catalog keys records by the same normalized identity.\n  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {\n    return resolveDefaultNamespaceRoot(config);\n  }\n  const legacyRoot = resolveNamespaceDir(config.memoryDir, namespace);\n  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(namespace));\n  if (\n    (await exists(tokenizedRoot)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))\n  ) {\n    return tokenizedRoot;\n  }\n  return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;\n}\n\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction\n  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +\n  // append) on every cache hit grows `namespaces.jsonl` without bound between\n  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new\n  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.\n  private readonly notifiedResolved = new Map<string, string>();\n  // Instance-scoped serializer for the resolve hook (issue #1524 adoption).\n  // Replaces the bespoke `inFlightResolved` marker-then-clear pattern: the\n  // serializer's per-key chain strictly orders concurrent notifications for the\n  // SAME namespace, and the task re-checks `notifiedResolved` once it runs, so a\n  // burst of cache hits before the first hook settles collapses to a single\n  // hook invocation (the once-per-namespace intent). Recovery is preserved —\n  // one rejected hook never poisons subsequent notifications for that key.\n  private readonly resolveSerializer = new MutationSerializer();\n  // (namespace, storageDir) pairs whose resolve hook is currently pending. Set SYNCHRONOUSLY in\n  // notifyResolved (before queueing) so a burst of concurrent storageFor()\n  // cache hits collapses onto the one in-flight hook instead of each enqueuing\n  // its own task. Cleared when the queued hook settles. Without this, a dropped\n  // hook (returns false on a rebuild-lock timeout) leaves notifiedResolved\n  // unset, so every queued sibling task would re-run the hook — N serial lock\n  // waits (cursor Medium 06f58a7c, codex P2).\n  private readonly inFlightResolveHooks = new Set<string>();\n  // Tracks every in-flight resolve-hook promise so callers can deterministically\n  // await the fire-and-forget registrations that `storageFor()` kicks off (see\n  // `whenResolveHooksSettled`). Entries are removed as each hook settles, so the\n  // set holds at most one promise per concurrently-resolving namespace.\n  private readonly pendingResolveHooks = new Set<Promise<unknown>>();\n  // Pending post-write catalog touch promises (#1522). Like pendingResolveHooks,\n  // lets tests await fire-and-forget write touches deterministically.\n  private readonly pendingWriteTouches = new Set<Promise<unknown>>();\n\n  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`\n  // normalizes its input, so default-namespace branches must compare against the\n  // normalized config default too — otherwise a whitespace-padded configured\n  // default name routes the default namespace to a tokenized non-default root.\n  private readonly defaultNamespaceIdentity: string;\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly hooks: NamespaceStorageRouterHooks = {},\n    /** Catalog reference for post-write/read touches (issue #1522 chokepoint). */\n    private readonly catalog?: NamespaceCatalog,\n  ) {\n    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  }\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!this.config.namespacesEnabled) return this.config.memoryDir;\n    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return resolveNamespaceStorageRoot(this.config, namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.defaultNamespaceIdentity) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    }\n\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    // #1522: install the post-write catalog touch at the chokepoint — every\n    // successful write on this StorageManager records the namespace touch.\n    this.bindCatalogWriteHook(sm, ns);\n    // #1579: apply the tombstone non-resurrection config so every namespace\n    // storage enforces the invariant at its own writeMemory chokepoint.\n    this.applyTombstonesConfig(sm, ns);\n    this.cache.set(ns, sm);\n    this.notifyResolved(ns, root);\n    return sm;\n  }\n\n  /**\n   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write\n   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.\n   *\n   * Issue #1524 adoption: hook invocations for the SAME namespace are now\n   * strictly ordered through the shared `MutationSerializer` rather than the\n   * bespoke `inFlightResolved` marker-then-clear pattern. The serializer\n   * guarantees one in-flight hook per namespace; a concurrent burst of\n   * `storageFor()` cache hits collapses to a single hook invocation because\n   * each queued task re-checks `notifiedResolved` before invoking the hook. A\n   * dropped (`false`) or rejected hook leaves `notifiedResolved` unset so the\n   * next `storageFor()` retries — the serializer recovers from the rejection,\n   * so a failed hook never poisons later notifications.\n   */\n  private notifyResolved(namespace: string, storageDir: string): void {\n    const hook = this.hooks.onResolve;\n    if (!hook) return;\n    // Permanent dedup: skip once we've SUCCESSFULLY notified this exact\n    // (namespace, storageDir). A changed dir (rare: migration/realignment)\n    // still re-fires once. The mark is set ONLY AFTER the hook succeeds, so a\n    // dropped registration (e.g. rebuild-lock timeout) is RETRIED on the next\n    // cache hit instead of being suppressed forever (round 6, cursor Medium —\n    // ND3EJ).\n    if (this.notifiedResolved.get(namespace) === storageDir) return;\n    // In-flight dedup (cursor Medium 06f58a7c, codex P2): if a hook for THIS\n    // namespace is already pending, collapse this call onto it instead of\n    // enqueueing another task. The serializer strictly orders queued tasks, but\n    // ordering alone is not enough — when the first hook returns `false`\n    // (dropped touch, e.g. rebuild-lock timeout), `notifiedResolved` stays\n    // unset, so each queued sibling task would pass its re-check and re-run the\n    // hook. With the real catalog hook each retry can spend the full lock wait,\n    // so N cache hits during a rebuild leave N serial background lock attempts.\n    // Collapsing here means at most ONE hook runs per in-flight registration;\n    // its result (set `notifiedResolved` on success, leave unset on drop)\n    // decides whether a LATER `storageFor()` retries — collapsing loses\n    // nothing because the drop is already retried on the next cache hit.\n    // Keyed by the composite (namespace, storageDir) so a CHANGED dir\n    // (migration/realignment) for the same namespace still gets its own hook —\n    // it is NOT collapsed onto the old dir's pending registration (cursor\n    // Medium, codex P2).\n    const inFlightKey = namespace + \"\\u0000\" + storageDir;\n    if (this.inFlightResolveHooks.has(inFlightKey)) return;\n    this.inFlightResolveHooks.add(inFlightKey);\n    // Queue through the serializer. Concurrent calls for the same namespace\n    // strictly order here; the 2nd call's task runs only after the 1st's hook\n    // settles, by which point `notifiedResolved` is either set (no-op) or still\n    // unset (retry). The returned promise is tracked for\n    // `whenResolveHooksSettled()`. Rejections from the task body are caught so\n    // they never reach the caller (best-effort hook contract); the serializer's\n    // recovered tail still lets subsequent notifications run.\n    const task = async (): Promise<void> => {\n      // Re-check after queueing: a prior task in this same chain may have just\n      // marked the pair as notified.\n      if (this.notifiedResolved.get(namespace) === storageDir) return;\n      try {\n        // Hook may be sync or async; Promise.resolve normalizes both. A result\n        // of `false` means the registration was dropped/no-op (e.g. rebuild-lock\n        // timeout) — leave notifiedResolved UNSET so the next storageFor retries\n        // (round 6, codex P2 — NEFoX). `void`/`undefined` is success for legacy\n        // hooks. A rejection leaves notifiedResolved unset for the same reason.\n        const persisted = await Promise.resolve(hook(namespace, storageDir));\n        if (persisted !== false) {\n          this.notifiedResolved.set(namespace, storageDir);\n        }\n      } catch {\n        // Best-effort: a hook failure MUST NOT crash storage resolution. Leave\n        // notifiedResolved unset so a later storageFor retries the registration.\n      }\n    };\n    const queued = this.resolveSerializer.serialize(namespace, task);\n    this.pendingResolveHooks.add(queued);\n    // Clear the in-flight marker when the hook settles so a subsequent\n    // storageFor() can retry after a drop, or short-circuit via notifiedResolved\n    // after a success.\n    const cleanup = (): void => {\n      this.inFlightResolveHooks.delete(inFlightKey);\n      this.pendingResolveHooks.delete(queued);\n    };\n    void queued.then(cleanup, cleanup);\n  }\n\n  /**\n   * Install the post-write catalog touch hook on an externally-constructed\n   * StorageManager (issue #1522). Used by the orchestrator for the legacy\n   * default-namespace storage (`this.storage`) that bypasses the router.\n   */\n  bindCatalogWriteHook(sm: StorageManager, namespace: string): void {\n    sm.onCatalogWrite = () => this.touchCatalogWrite(namespace, sm.dir);\n  }\n\n  /**\n   * Install the tombstone config on an externally-constructed StorageManager\n   * (issue #1579). Mirrors `bindCatalogWriteHook` — used for the legacy\n   * default-namespace storage that bypasses the router. Router-created\n   * storages are wired inline in `storageFor()` via `applyTombstonesConfig`.\n   */\n  bindTombstonesConfig(\n    sm: StorageManager,\n    namespace: string,\n    config: { enabled: boolean; semanticMatch: boolean; semanticThreshold: number },\n  ): void {\n    this.tombstonesGlobalConfig = { ...config };\n    sm.setTombstonesConfig({ ...config, namespace });\n  }\n\n  private tombstonesGlobalConfig: {\n    enabled: boolean;\n    semanticMatch: boolean;\n    semanticThreshold: number;\n  } = { enabled: false, semanticMatch: false, semanticThreshold: 0.9 };\n\n  /**\n   * Apply the tombstone config to a router-created StorageManager. Called\n   * inline in `storageFor()` so every namespace storage enforces the\n   * non-resurrection invariant, namespace-scoped (rule 42).\n   */\n  private applyTombstonesConfig(sm: StorageManager, namespace: string): void {\n    sm.setTombstonesConfig({ ...this.tombstonesGlobalConfig, namespace });\n  }\n\n  /**\n   * Post-write catalog touch (issue #1522 chokepoint). Called by every\n   * StorageManager's post-write hook AFTER a successful write. Best-effort\n   * and failure-tolerant — a catalog error MUST NOT affect the primary write\n   * (gotcha #13, rule #40). Fire-and-forget by design.\n   */\n  private touchCatalogWrite(namespace: string, storageDir: string): void {\n    if (!this.catalog) return;\n    const touch = this.catalog\n      .markWrite(namespace, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Record a namespace read in the catalog (issue #1522 chokepoint move).\n   * Best-effort and failure-tolerant. Used by recall paths so the read touch\n   * lives in the storage layer, not at the caller.\n   */\n  recordRead(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    void this.catalog\n      .markRead(ns, { discoveredBy: \"read\", storageDir })\n      .catch(() => undefined);\n  }\n  /**\n   * Record a namespace write touch in the catalog (issue #1522). Best-effort\n   * and failure-tolerant. Used by consolidation/cleanup passes that may mutate\n   * the store via delete-only paths (e.g. entity-file merges, TTL cleanup) so\n   * the namespace's lastWriteAt stays fresh even when no explicit write went\n   * through the storage chokepoint. This is NOT a substitute for the chokepoint\n   * — it's a belt-and-suspenders for paths the chokepoint doesn't cover.\n   */\n  recordWrite(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    const touch = this.catalog\n      .markWrite(ns, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Resolve once every in-flight post-write catalog touch has settled (#1522).\n   * Mirrors `whenResolveHooksSettled()`: the StorageManager's post-write hook\n   * fires the catalog touch fire-and-forget, so tests asserting lastWriteAt\n   * moved should await this instead of racing a timer.\n   */\n  async whenWriteTouchesSettled(): Promise<void> {\n    while (this.pendingWriteTouches.size > 0) {\n      await Promise.allSettled([...this.pendingWriteTouches]);\n    }\n  }\n\n  /**\n   * Resolve once every in-flight `onResolve` registration has settled.\n   *\n   * `storageFor()` fires the resolve hook fire-and-forget, so its catalog side\n   * effect (e.g. `registerResolved(...)`) is not observable the moment\n   * `storageFor()` returns. Callers that must act on that side effect — notably\n   * tests asserting the catalog was updated — should await this instead of\n   * racing a timer. Resolves immediately when no hook is registered or nothing\n   * is in flight. The loop re-checks because a settling hook could, in\n   * principle, trigger a follow-on resolution.\n   */\n  async whenResolveHooksSettled(): Promise<void> {\n    while (this.pendingResolveHooks.size > 0) {\n      await Promise.allSettled([...this.pendingResolveHooks]);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;AASvC,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,YAAM,YAAY,KAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrB,KAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiB,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AA8CA,eAAsB,4BAA4B,QAAuC;AACvF,MAAI,CAAC,OAAO,mBAAmB;AAC7B,WAAO,OAAO;AAAA,EAChB;AASA,QAAM,kBAAkB,2BAA2B,OAAO,gBAAgB;AAC1E,QAAM,cAAc,oBAAoB,OAAO,WAAW,eAAe;AACzE,QAAM,iBAAiB;AAAA,IACrB,OAAO;AAAA,IACP,uBAAuB,OAAO,gBAAgB;AAAA,EAChD;AACA,QAAM,mBACH,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,QAAQ,mBACV,iBACC,MAAM,OAAO,WAAW,IACvB,cACA;AACN,SAAQ,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,OAAO,SAAS,IACrE,QACA,OAAO;AACb;AAYA,eAAsB,4BACpB,QACA,WACiB;AACjB,MAAI,CAAC,OAAO,kBAAmB,QAAO,OAAO;AAI7C,MAAI,2BAA2B,SAAS,MAAM,2BAA2B,OAAO,gBAAgB,GAAG;AACjG,WAAO,4BAA4B,MAAM;AAAA,EAC3C;AACA,QAAM,aAAa,oBAAoB,OAAO,WAAW,SAAS;AAClE,QAAM,gBAAgB,oBAAoB,OAAO,WAAW,uBAAuB,SAAS,CAAC;AAC7F,MACG,MAAM,OAAO,aAAa,KAC1B,MAAM,6BAA6B,eAAe,EAAE,qBAAqB,KAAK,CAAC,GAChF;AACA,WAAO;AAAA,EACT;AACA,SAAQ,MAAM,OAAO,UAAU,IAAK,aAAa;AACnD;AAEO,IAAM,yBAAN,MAA6B;AAAA,EAwClC,YACmB,QACA,QAAqC,CAAC,GAEtC,SACjB;AAJiB;AACA;AAEA;AAEjB,SAAK,2BAA2B,2BAA2B,OAAO,gBAAgB;AAAA,EACpF;AAAA,EANmB;AAAA,EACA;AAAA,EAEA;AAAA,EA3CF,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3C,oBAAoB,IAAI,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3C,uBAAuB,oBAAI,IAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvC,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA,EAGhD,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD;AAAA,EAWjB,MAAc,uBAAwC;AACpD,SAAK,wBAAwB,MAAM,4BAA4B,KAAK,MAAM;AAC1E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,KAAK,OAAO,kBAAmB,QAAO,KAAK,OAAO;AACvD,QAAI,2BAA2B,SAAS,MAAM,KAAK,0BAA0B;AAC3E,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,4BAA4B,KAAK,QAAQ,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,4BAA4B,CAAC,qBAAqB,EAAE,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,0BAA0B;AACxC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAGlC,SAAK,qBAAqB,IAAI,EAAE;AAGhC,SAAK,sBAAsB,IAAI,EAAE;AACjC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,SAAK,eAAe,IAAI,IAAI;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,eAAe,WAAmB,YAA0B;AAClE,UAAM,OAAO,KAAK,MAAM;AACxB,QAAI,CAAC,KAAM;AAOX,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AAiBzD,UAAM,cAAc,YAAY,OAAW;AAC3C,QAAI,KAAK,qBAAqB,IAAI,WAAW,EAAG;AAChD,SAAK,qBAAqB,IAAI,WAAW;AAQzC,UAAM,OAAO,YAA2B;AAGtC,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AACzD,UAAI;AAMF,cAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,WAAW,UAAU,CAAC;AACnE,YAAI,cAAc,OAAO;AACvB,eAAK,iBAAiB,IAAI,WAAW,UAAU;AAAA,QACjD;AAAA,MACF,QAAQ;AAAA,MAGR;AAAA,IACF;AACA,UAAM,SAAS,KAAK,kBAAkB,UAAU,WAAW,IAAI;AAC/D,SAAK,oBAAoB,IAAI,MAAM;AAInC,UAAM,UAAU,MAAY;AAC1B,WAAK,qBAAqB,OAAO,WAAW;AAC5C,WAAK,oBAAoB,OAAO,MAAM;AAAA,IACxC;AACA,SAAK,OAAO,KAAK,SAAS,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,IAAoB,WAAyB;AAChE,OAAG,iBAAiB,MAAM,KAAK,kBAAkB,WAAW,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,qBACE,IACA,WACA,QACM;AACN,SAAK,yBAAyB,EAAE,GAAG,OAAO;AAC1C,OAAG,oBAAoB,EAAE,GAAG,QAAQ,UAAU,CAAC;AAAA,EACjD;AAAA,EAEQ,yBAIJ,EAAE,SAAS,OAAO,eAAe,OAAO,mBAAmB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3D,sBAAsB,IAAoB,WAAyB;AACzE,OAAG,oBAAoB,EAAE,GAAG,KAAK,wBAAwB,UAAU,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,WAAmB,YAA0B;AACrE,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,QAAQ,KAAK,QAChB,UAAU,WAAW,EAAE,cAAc,SAAS,WAAW,CAAC,EAC1D,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAmB,YAA2B;AACvD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,SAAK,KAAK,QACP,SAAS,IAAI,EAAE,cAAc,QAAQ,WAAW,CAAC,EACjD,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,WAAmB,YAA2B;AACxD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,UAAM,QAAQ,KAAK,QAChB,UAAU,IAAI,EAAE,cAAc,SAAS,WAAW,CAAC,EACnD,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-YXIFA36P.js → chunk-6TAETM63.js}

@@ -10,7 +10,7 @@ import {
 import {
   planNamespaceMaintenance,
   runNamespaceMaintenanceBatchPlan
-} from "./chunk-DR2JTSLZ.js";
+} from "./chunk-JMA4RYRN.js";
 import {
   resolveHomeDir
 } from "./chunk-JUC24CTX.js";
@@ -441,4 +441,4 @@ var MaintenanceScheduler = class {
 export {
   MaintenanceScheduler
 };
-//# sourceMappingURL=chunk-YXIFA36P.js.map
+//# sourceMappingURL=chunk-6TAETM63.js.map

package/dist/{chunk-6JDGADXK.js → chunk-6VVP6NK7.js}

@@ -1,7 +1,7 @@
 import {
   StorageManager,
   normalizeEntityName
-} from "./chunk-X74FJSW7.js";
+} from "./chunk-GFIARMA7.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
@@ -870,4 +870,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-6JDGADXK.js.map
+//# sourceMappingURL=chunk-6VVP6NK7.js.map

package/dist/{chunk-FN2SM5SN.js → chunk-ABCGDW3A.js}

@@ -9,7 +9,7 @@ import {
   ProactiveExtractionResultSchema,
   ProactiveQuestionsResultSchema,
   buildProfileConsolidationResultSchema
-} from "./chunk-ROZJACKP.js";
+} from "./chunk-KKK7YTYN.js";
 import {
   normalizeReasoningTrace
 } from "./chunk-54V4BZWP.js";
@@ -36,9 +36,6 @@ import {
 import {
   normalizeProcedureSteps
 } from "./chunk-QDW3E4RD.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-FVQJYWH7.js";
 import {
   FallbackLlmClient,
   fallbackLlmRuntimeContextFromConfig,
@@ -51,6 +48,12 @@ import {
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
+import {
+  buildFactProvenance
+} from "./chunk-SK2CR6MW.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-FVQJYWH7.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
@@ -206,7 +209,13 @@ var ExtractionEngine = class {
       reasoningTrace: (() => {
         const candidate = f?.reasoningTrace && typeof f.reasoningTrace === "object" && !Array.isArray(f.reasoningTrace) ? f.reasoningTrace : f?.reasoning_trace && typeof f.reasoning_trace === "object" && !Array.isArray(f.reasoning_trace) ? f.reasoning_trace : null;
         return candidate ? normalizeReasoningTrace(candidate) ?? void 0 : void 0;
-      })()
+      })(),
+      // Issue #1575 PR 2: the LLM provides a verbatim supporting quote
+      // per fact. Optional/nullable per repo gotcha 6 (OpenAI Responses
+      // API emits null for absent optional fields). The post-parse
+      // validator (buildFactProvenance) locates this quote in the
+      // buffered turns and builds verified ProvenanceSource[] entries.
+      quote: typeof f?.quote === "string" && f.quote.trim().length > 0 ? f.quote : void 0
     })).filter((f) => f.content.length > 0) : [];
     const questions = Array.isArray(parsed?.questions) ? parsed.questions.map((q) => {
       if (typeof q === "string") return { question: q, context: "", priority: 0.5 };
@@ -480,7 +489,8 @@ var ExtractionEngine = class {
       `Return at most ${maxAdditional} additional high-confidence memory candidates that were omitted from the base extraction.`,
       "Only include information directly supported by the conversation. Do not speculate. Do not repeat the base extraction.",
       "Return only valid JSON with this shape:",
-      '{"facts":[{"category":"fact","content":"...","confidence":0.0,"tags":["..."],"entityRef":"optional","promptedByQuestion":"optional"}],"profileUpdates":["..."],"entities":[{"name":"...","type":"person","facts":["..."],"structuredSections":[{"key":"beliefs","title":"Beliefs","facts":["..."]}],"promptedByQuestion":"optional"}],"relationships":[{"source":"...","target":"...","label":"...","promptedByQuestion":"optional"}]}',
+      '{"facts":[{"category":"fact","content":"...","confidence":0.0,"tags":["..."],"entityRef":"optional","promptedByQuestion":"optional","quote":"optional verbatim span from a single turn"}],"profileUpdates":["..."],"entities":[{"name":"...","type":"person","facts":["..."],"structuredSections":[{"key":"beliefs","title":"Beliefs","facts":["..."]}],"promptedByQuestion":"optional"}],"relationships":[{"source":"...","target":"...","label":"...","promptedByQuestion":"optional"}]}',
+      this.config.provenance?.enabled ? '- Source quotes: For each fact, include a "quote" field with the EXACT verbatim words from the conversation that support the fact (a contiguous span from a single turn, not a paraphrase). Cap at ~300 chars.' : "",
       "",
       "Base extracted facts (do not repeat):",
       factsPreview || "(none)",
@@ -683,6 +693,54 @@ var ExtractionEngine = class {
     }
     return null;
   }
+  /**
+   * Attach claim-level provenance spans to each fact in the extraction result
+   * (issue #1575 PR 2). Runs once at write time, after sanitize + proactive
+   * pass so ALL facts (base + proactive additions) get verified spans before
+   * the result is returned for persistence.
+   *
+   * The validator locates each fact's LLM-provided `quote` in the buffered
+   * turns and builds a `ProvenanceSource[]` with verified offsets. Never
+   * throws, never drops a fact — an unverifiable span is a tagged state, not
+   * a silent failure (rule 34 spirit). When `provenance.enabled` is false,
+   * this is a no-op (byte-identical to pre-feature behavior, rule 39).
+   */
+  attachProvenanceToResult(result, turns) {
+    if (!this.config.provenance?.enabled) {
+      if (result.facts.length === 0) return result;
+      return {
+        ...result,
+        facts: result.facts.map((fact) => {
+          if (fact.quote === void 0) return fact;
+          const { quote: _stripped, ...rest } = fact;
+          return rest;
+        })
+      };
+    }
+    if (result.facts.length === 0) return result;
+    const provenanceTurns = turns.map((t) => ({
+      content: t.content,
+      sessionKey: t.sessionKey,
+      logicalSessionKey: t.logicalSessionKey,
+      timestamp: t.timestamp,
+      turnId: t.turnFingerprint
+    }));
+    const facts = result.facts.map((fact) => {
+      const built = buildFactProvenance(
+        fact.quote,
+        provenanceTurns,
+        this.config.provenance
+      );
+      const { quote: _stripped, ...factWithoutQuote } = fact;
+      return {
+        ...factWithoutQuote,
+        ...built.sources && built.sources.length > 0 ? { sources: built.sources } : {},
+        ...built.provenance !== "none" ? { provenance: built.provenance } : {},
+        ...built.requireSpansPending ? { requireSpansPending: true } : {}
+      };
+    });
+    return { ...result, facts };
+  }
   async extract(turns, existingEntities) {
     const substantiveTurns = turns.filter((t) => t.content.trim().length > 0);
     if (substantiveTurns.length === 0) {
@@ -735,7 +793,8 @@ var ExtractionEngine = class {
             this.emit({ kind: "llm_end", traceId, model: this.config.localLlmModel, operation: "extraction", durationMs });
             log.debug(`extraction: used local LLM \u2014 ${localResult.facts.length} facts, ${localResult.entities.length} entities`);
             const sanitized = this.sanitizeExtractionResult(localResult, messageTimestamp);
-            return await this.applyProactiveQuestionPass(conversation, sanitized);
+            const finalResult = await this.applyProactiveQuestionPass(conversation, sanitized);
+            return this.attachProvenanceToResult(finalResult, boundedTurns);
           }
           if (!this.config.localLlmFallback) {
             log.warn("extraction: local LLM failed and fallback disabled");
@@ -777,7 +836,8 @@ var ExtractionEngine = class {
             this.emit({ kind: "llm_end", traceId, model: this.config.model, operation: "extraction", durationMs });
             log.debug(`extraction: used direct client (${this.config.model}) \u2014 ${directResult.facts.length} facts, ${directResult.entities.length} entities`);
             const sanitized = this.sanitizeExtractionResult(directResult, messageTimestamp);
-            return await this.applyProactiveQuestionPass(conversation, sanitized);
+            const finalResult = await this.applyProactiveQuestionPass(conversation, sanitized);
+            return this.attachProvenanceToResult(finalResult, boundedTurns);
           }
           try {
             this.emit({
@@ -878,7 +938,8 @@ var ExtractionEngine = class {
             questions: result.questions ?? [],
             identityReflection: result.identityReflection ?? void 0
           }, messageTimestamp);
-          return await this.applyProactiveQuestionPass(conversation, sanitized);
+          const finalResult = await this.applyProactiveQuestionPass(conversation, sanitized);
+          return this.attachProvenanceToResult(finalResult, boundedTurns);
         }
         this.emit({
           kind: "llm_error",
@@ -990,7 +1051,8 @@ These are durable insights - capture them:
 === Rules ===
 - Extract only NEW information worth remembering across sessions
 - Skip transient details (file paths, current errors, temporary states, agent actions)
-- Confidence: Explicit (0.95-1.0), Implied (0.70-0.94), Inferred (0.40-0.69), Speculative (0.00-0.39)
+- Confidence: Explicit (0.95-1.0), Implied (0.70-0.94), Inferred (0.40-0.69), Speculative (0.00-0.39)${this.config.provenance?.enabled ? `
+- Source quotes: For each fact, include a "quote" field with the EXACT verbatim words from the conversation that support the fact (copy a contiguous span from a single turn, not a paraphrase). Cap at ~300 chars.` : ""}
 - Corrections get highest confidence (0.95+)
 - Each fact should be standalone and self-contained
 - Lines labelled [context user] or [context assistant] are reference context only. Use them to resolve pronouns and adjacent question/answer pairs, but do not extract a memory stated only in context lines unless a normal [user] or [assistant] line confirms or completes it.
@@ -1216,7 +1278,8 @@ Rules:
   * Explicit (0.95-1.0): Direct user statements \u2014 "I prefer X", "my name is Y"
   * Implied (0.70-0.94): Strong contextual inference \u2014 user consistently does X, clear from conversation flow
   * Inferred (0.40-0.69): Pattern recognition \u2014 reasonable guess from limited evidence
-  * Speculative (0.00-0.39): Tentative hypothesis \u2014 weak signal, needs future confirmation. Speculative memories auto-expire after 30 days if not confirmed.
+  * Speculative (0.00-0.39): Tentative hypothesis \u2014 weak signal, needs future confirmation. Speculative memories auto-expire after 30 days if not confirmed.${this.config.provenance?.enabled ? `
+- Source quotes: For each fact, include a "quote" field containing the EXACT verbatim words from the conversation that support the fact. Copy a contiguous span from a single speaker turn (not a paraphrase, not a summary). Cap at ~300 characters. This grounds every memory in the literal utterance that created it.` : ""}
 - For commitments: include any deadline or timeframe mentioned${this.config.extractionScopeClassificationEnabled ? `
 
 Scope classification:
@@ -2328,4 +2391,4 @@ ${memoryList}` }
 export {
   ExtractionEngine
 };
-//# sourceMappingURL=chunk-FN2SM5SN.js.map
+//# sourceMappingURL=chunk-ABCGDW3A.js.map