@remnic/core 9.3.719 → 9.3.720

package/src/capabilities-cluster-b.test.ts

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import {
+  resolveAccessSetupCapabilities,
+  type AccessSetupCapabilitySet,
+} from "./capabilities.js";
+
+/**
+ * Parity tests for the access-setup capability set (issue #1566 Cluster B).
+ *
+ * Every access-setup capability field must project from its `<field>Enabled`
+ * config flag, and the default-off semantics for both flags must be preserved.
+ */
+
+const ACCESS_FIELD_TO_FLAG: Record<keyof AccessSetupCapabilitySet, string> = {
+  recallCrossNamespaceBudget: "recallCrossNamespaceBudgetEnabled",
+  recallAuditAnomalyDetection: "recallAuditAnomalyDetectionEnabled",
+};
+
+const ACCESS_FIELDS = Object.keys(ACCESS_FIELD_TO_FLAG) as Array<
+  keyof AccessSetupCapabilitySet
+>;
+
+test("resolveAccessSetupCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(ACCESS_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const accessCaps = resolveAccessSetupCapabilities(config);
+
+  for (const field of ACCESS_FIELDS) {
+    const flag = ACCESS_FIELD_TO_FLAG[field];
+    assert.equal(
+      accessCaps[field],
+      (config as unknown as Record<string, boolean>)[flag],
+      `accessCaps.${field} must equal config.${flag} (true variant)`,
+    );
+  }
+});
+
+test("resolveAccessSetupCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(ACCESS_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const accessCaps = resolveAccessSetupCapabilities(config);
+
+  for (const field of ACCESS_FIELDS) {
+    assert.equal(
+      accessCaps[field],
+      false,
+      `accessCaps.${field} must be false when its flag is false`,
+    );
+  }
+});
+
+test("resolveAccessSetupCapabilities preserves default-off semantics when flags are undefined", () => {
+  // parseConfig with no overrides exercises the documented defaults. Both
+  // access-setup flags default to false.
+  const config = parseConfig({});
+  const accessCaps = resolveAccessSetupCapabilities(config);
+
+  assert.equal(
+    accessCaps.recallCrossNamespaceBudget,
+    false,
+    "recallCrossNamespaceBudget must default to false",
+  );
+  assert.equal(
+    accessCaps.recallAuditAnomalyDetection,
+    false,
+    "recallAuditAnomalyDetection must default to false",
+  );
+});
+
+test("resolveAccessSetupCapabilities returns a frozen object", () => {
+  const accessCaps = resolveAccessSetupCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(accessCaps), true, "AccessSetupCapabilitySet must be frozen");
+});

package/src/capabilities.test.ts

@@ -2,7 +2,12 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import { parseConfig } from "./config.js";
-import { resolveCapabilities, type CapabilitySet } from "./capabilities.js";
+import {
+  resolveCapabilities,
+  resolveAccessSetupCapabilities,
+  type CapabilitySet,
+  type AccessSetupCapabilitySet,
+} from "./capabilities.js";
 
 /**
  * Characterization tests for the recall-operation CapabilitySet (issue #1523).
@@ -22,6 +27,7 @@ const FIELD_TO_FLAG: Record<keyof CapabilitySet, string> = {
   rerankCache: "rerankCacheEnabled",
   recallDirectAnswer: "recallDirectAnswerEnabled",
   recallMemoryWorthFilter: "recallMemoryWorthFilterEnabled",
+  recallTrustScore: "trustScoreEnabled",
   recallMmr: "recallMmrEnabled",
   recallReasoningTraceBoost: "recallReasoningTraceBoostEnabled",
   recallPlannerLlm: "recallPlannerLlmEnabled",
@@ -30,6 +36,10 @@ const FIELD_TO_FLAG: Record<keyof CapabilitySet, string> = {
   graphRecall: "graphRecallEnabled",
   graphAssistInFullMode: "graphAssistInFullModeEnabled",
   graphExpandedIntent: "graphExpandedIntentEnabled",
+  // Issue #1566 Cluster C: mixed-operation flags.
+  rerank: "rerankEnabled",
+  harmonicRetrieval: "harmonicRetrievalEnabled",
+  parallelRetrieval: "parallelRetrievalEnabled",
 };
 
 const FIELDS = Object.keys(FIELD_TO_FLAG) as Array<keyof CapabilitySet>;

package/src/capabilities.ts

@@ -38,6 +38,8 @@ export interface CapabilitySet {
   readonly recallDirectAnswer: boolean;
   /** `recallMemoryWorthFilterEnabled` — Memory-Worth score reweighting. */
   readonly recallMemoryWorthFilter: boolean;
+  /** `trustScoreEnabled` — unified TrustScore recall stage (issue #1577). */
+  readonly recallTrustScore: boolean;
   /** `recallMmrEnabled` — maximal-marginal-relevance diversification. */
   readonly recallMmr: boolean;
   /** `recallReasoningTraceBoostEnabled` — boost reasoning-trace memories. */
@@ -54,6 +56,13 @@ export interface CapabilitySet {
   readonly graphAssistInFullMode: boolean;
   /** `graphExpandedIntentEnabled` — promote broad-intent asks to graph mode. */
   readonly graphExpandedIntent: boolean;
+  // --- Issue #1566 Cluster C: mixed-operation flags (recall + summarizer/CLI/writes) ---
+  /** `rerankEnabled` — optional LLM reranking of recall candidates. */
+  readonly rerank: boolean;
+  /** `harmonicRetrievalEnabled` — abstraction-node harmonic retrieval tier. */
+  readonly harmonicRetrieval: boolean;
+  /** `parallelRetrievalEnabled` — three-agent parallel retrieval (DirectFact + Contextual + Temporal). */
+  readonly parallelRetrieval: boolean;
 }
 
 /**
@@ -72,6 +81,9 @@ export function resolveCapabilities(config: PluginConfig): CapabilitySet {
     rerankCache: config.rerankCacheEnabled,
     recallDirectAnswer: config.recallDirectAnswerEnabled,
     recallMemoryWorthFilter: config.recallMemoryWorthFilterEnabled,
+    // Issue #1577: TrustScore subsumes the Memory Worth multiplier when on;
+    // the orchestrator runs exactly one of the two (mutual exclusion, rule 39).
+    recallTrustScore: config.trustScoreEnabled === true,
     recallMmr: config.recallMmrEnabled,
     recallReasoningTraceBoost: config.recallReasoningTraceBoostEnabled,
     recallPlannerLlm: config.recallPlannerLlmEnabled,
@@ -82,6 +94,10 @@ export function resolveCapabilities(config: PluginConfig): CapabilitySet {
     // migrated call sites used (`!== false` = default-on, `=== true` = default-off).
     graphAssistInFullMode: config.graphAssistInFullModeEnabled !== false,
     graphExpandedIntent: config.graphExpandedIntentEnabled === true,
+    // Issue #1566 Cluster C: mixed-operation flags resolved once per recall op.
+    rerank: config.rerankEnabled,
+    harmonicRetrieval: config.harmonicRetrievalEnabled,
+    parallelRetrieval: config.parallelRetrievalEnabled,
   });
 }
 
@@ -145,3 +161,45 @@ export function resolveGraphConstructionCapabilities(
     graphWriteSessionAdjacency: config.graphWriteSessionAdjacencyEnabled !== false,
   });
 }
+
+// ---------------------------------------------------------------------------
+// Access-setup capability set (issue #1566 Cluster B).
+//
+// These two flags gate cross-namespace recall budgeting and anomaly-detection
+// auditing. Resolved once at access-service handler entry (and the operator
+// doctor check) rather than re-derived from raw config at each site.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of access-setup feature gates (issue #1566 Cluster B).
+ *
+ * Every field is `readonly boolean`. Composition (including the default-off
+ * semantics for the optional `recallAuditAnomalyDetectionEnabled`) lives ONLY
+ * in {@link resolveAccessSetupCapabilities}.
+ */
+export interface AccessSetupCapabilitySet {
+  /** `recallCrossNamespaceBudgetEnabled` — rolling cross-namespace recall budget. */
+  readonly recallCrossNamespaceBudget: boolean;
+  /** `recallAuditAnomalyDetectionEnabled` — access-audit anomaly detection (default-off). */
+  readonly recallAuditAnomalyDetection: boolean;
+}
+
+/**
+ * Resolve the {@link AccessSetupCapabilitySet} from parsed config.
+ *
+ * Call this ONCE at access-service handler entry and thread the result down.
+ */
+export type AccessSetupConfigProjection = Pick<
+  PluginConfig,
+  "recallCrossNamespaceBudgetEnabled" | "recallAuditAnomalyDetectionEnabled"
+>;
+
+export function resolveAccessSetupCapabilities(
+  config: AccessSetupConfigProjection,
+): AccessSetupCapabilitySet {
+  return Object.freeze({
+    recallCrossNamespaceBudget: config.recallCrossNamespaceBudgetEnabled,
+    // Optional/default-off flag: preserve `=== true` semantics.
+    recallAuditAnomalyDetection: config.recallAuditAnomalyDetectionEnabled === true,
+  });
+}

package/src/cli/research-status-commands.ts

@@ -18,6 +18,7 @@
  */
 
 import type { Orchestrator } from "../orchestrator.js";
+import { resolveCapabilities } from "../capabilities.js";
 import type { CliCommand } from "../cli.js";
 import type { UtilityTelemetryEvent } from "../utility-telemetry.js";
 import {
@@ -42,6 +43,9 @@ export function registerResearchStatusCommands(
   cmd: CliCommand,
   orchestrator: Orchestrator,
 ): void {
+  // Resolve recall-operation gates once (#1566 Cluster C — harmonicRetrieval is a
+  // mixed-op flag read here on the CLI-search path as well as in recall).
+  const caps = resolveCapabilities(orchestrator.config);
 cmd
   .command("objective-state-status")
   .description("Show objective-state store status, snapshot counts, and latest stored snapshot")
@@ -111,7 +115,7 @@ cmd
     const status = await runAbstractionNodeStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       abstractionNodeStoreDir: orchestrator.config.abstractionNodeStoreDir,
-      harmonicRetrievalEnabled: orchestrator.config.harmonicRetrievalEnabled,
+      harmonicRetrievalEnabled: caps.harmonicRetrieval,
       abstractionAnchorsEnabled: orchestrator.config.abstractionAnchorsEnabled,
     });
     console.log(JSON.stringify(status, null, 2));
@@ -125,7 +129,7 @@ cmd
     const status = await runCueAnchorStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       abstractionNodeStoreDir: orchestrator.config.abstractionNodeStoreDir,
-      harmonicRetrievalEnabled: orchestrator.config.harmonicRetrievalEnabled,
+      harmonicRetrievalEnabled: caps.harmonicRetrieval,
       abstractionAnchorsEnabled: orchestrator.config.abstractionAnchorsEnabled,
     });
     console.log(JSON.stringify(status, null, 2));
@@ -147,7 +151,7 @@ cmd
     const results = await runHarmonicSearchCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       abstractionNodeStoreDir: orchestrator.config.abstractionNodeStoreDir,
-      harmonicRetrievalEnabled: orchestrator.config.harmonicRetrievalEnabled,
+      harmonicRetrievalEnabled: caps.harmonicRetrieval,
       abstractionAnchorsEnabled: orchestrator.config.abstractionAnchorsEnabled,
       query,
       maxResults: Number.isFinite(maxResults) ? maxResults : 3,

package/src/cli.ts

@@ -125,6 +125,7 @@ import {
   validateEvalBenchmarkPack,
 } from "./evals.js";
 import { analyzeGraphHealth, type GraphHealthReport } from "./graph.js";
+import { resolveGraphConstructionCapabilities } from "./capabilities.js";
 import {
   getCausalTrajectoryStoreStatus,
   type CausalTrajectoryStoreStatus,
@@ -6360,11 +6361,12 @@ export function registerCli(
         .option("--repair-guidance", "Include non-destructive repair guidance")
         .action(async (...args: unknown[]) => {
           const options = (args[0] ?? {}) as Record<string, unknown>;
+          const graphCaps = resolveGraphConstructionCapabilities(orchestrator.config);
           const report = await runGraphHealthCliCommand({
             memoryDir: orchestrator.config.memoryDir,
-            entityGraphEnabled: orchestrator.config.entityGraphEnabled,
-            timeGraphEnabled: orchestrator.config.timeGraphEnabled,
-            causalGraphEnabled: orchestrator.config.causalGraphEnabled,
+            entityGraphEnabled: graphCaps.entityGraph,
+            timeGraphEnabled: graphCaps.timeGraph,
+            causalGraphEnabled: graphCaps.causalGraph,
             includeRepairGuidance: options.repairGuidance === true,
           });
           console.log(JSON.stringify(report, null, 2));
@@ -6415,12 +6417,15 @@ export function registerCli(
         .option("--json", "Emit machine-readable JSON only")
         .action(async (...args: unknown[]) => {
           const options = (args[0] ?? {}) as Record<string, unknown>;
+          const repairGraphCaps = resolveGraphConstructionCapabilities(orchestrator.config);
           const report = await runOperatorRepair({
             config: {
               memoryDir: orchestrator.config.memoryDir,
-              entityGraphEnabled: orchestrator.config.entityGraphEnabled,
-              timeGraphEnabled: orchestrator.config.timeGraphEnabled,
-              causalGraphEnabled: orchestrator.config.causalGraphEnabled,
+              entityGraphEnabled: repairGraphCaps.entityGraph,
+              timeGraphEnabled: repairGraphCaps.timeGraph,
+              causalGraphEnabled: repairGraphCaps.causalGraph,
+              multiGraphMemoryEnabled: repairGraphCaps.multiGraphMemory,
+              graphWriteSessionAdjacencyEnabled: repairGraphCaps.graphWriteSessionAdjacency,
             },
             apply: options.apply === true,
             dryRun: options.dryRun === true,

package/src/config.ts

@@ -28,6 +28,7 @@ import type {
   SlotBehaviorConfig,
   SlotMismatchMode,
   TriggerMode,
+  TrustWeights,
 } from "./types.js";
 import { log } from "./logger.js";
 import { cloneDefaultSessionObserverBands } from "./session-observer-bands.js";
@@ -2336,6 +2337,27 @@ export function parseConfig(
       const n = coerceNumber(cfg.recallMemoryWorthHalfLifeMs);
       return n !== undefined && n >= 0 ? n : 0;
     })(),
+    // Unified TrustScore recall stage (issue #1577). Default off: the stage
+    // is absent and ranking is byte-identical to the pre-feature pipeline
+    // (rule 39). Flip the master gate via #1574 ablation evidence only.
+    trustScoreEnabled: coerceBool(cfg.trustScoreEnabled) ?? false,
+    // Epistemic rendering ships behind its own gate so scoring can land first.
+    trustScoreEpistemicRendering: coerceBool(cfg.trustScoreEpistemicRendering) ?? false,
+    // Quarantine defaults on (only effective under the master gate); keeps
+    // hard negatives out of injection but visible in X-ray (rule 34).
+    trustScoreQuarantine: coerceBool(cfg.trustScoreQuarantine) ?? true,
+    trustScoreMinMultiplier: (() => {
+      const n = coerceNumber(cfg.trustScoreMinMultiplier);
+      return n !== undefined && n >= 0 && n <= 1 ? n : 0.5;
+    })(),
+    trustScoreMaxMultiplier: (() => {
+      const n = coerceNumber(cfg.trustScoreMaxMultiplier);
+      return n !== undefined && n >= 1 && n <= 4 ? n : 1.25;
+    })(),
+    // Per-component weights. Accept a nested object from config; invalid
+    // entries (non-finite, outside [0,1]) are dropped by resolveTrustWeights,
+    // which falls back to the documented defaults (rule 51).
+    trustScoreWeights: parseTrustScoreWeights(cfg.trustScoreWeights),
     // Memory Linking (Phase 3A)
     memoryLinkingEnabled: cfg.memoryLinkingEnabled === true, // Off by default initially
     // Conversation Threading (Phase 3B)
@@ -4639,3 +4661,32 @@ function buildRecallPipelineConfig(cfg: Record<string, unknown>): RecallPipeline
 
   return { recallBudgetChars, pipeline };
 }
+
+/**
+ * Parse the `trustScoreWeights` config value into a {@link TrustWeights}
+ * object. Accepts a plain object of per-component numbers; non-finite or
+ * out-of-`[0,1]` entries are dropped (the scorer falls back to defaults via
+ * `resolveTrustWeights`). A non-object value yields `{}` → all defaults.
+ * Rule 51: invalid weight rejected, never silently clamped to an extreme.
+ */
+function parseTrustScoreWeights(value: unknown): TrustWeights {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const src = value as Record<string, unknown>;
+  const out: TrustWeights = {};
+  const keys: Array<keyof TrustWeights> = [
+    "memoryWorth",
+    "provenance",
+    "faithfulness",
+    "corroboration",
+    "contradiction",
+    "domainCalibration",
+    "feedback",
+    "recency",
+  ];
+  for (const key of keys) {
+    const raw = src[key as string];
+    if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 0 || raw > 1) continue;
+    (out as Record<string, number>)[key as string] = raw;
+  }
+  return out;
+}

package/src/graph-snapshot.ts

@@ -132,9 +132,9 @@ export function parseGraphSnapshotSince(raw: string | undefined): number | undef
 export async function buildGraphSnapshot(opts: {
   memoryDir: string;
   graphConfig: {
-    entityGraphEnabled: boolean;
-    timeGraphEnabled: boolean;
-    causalGraphEnabled: boolean;
+    entityGraph: boolean;
+    timeGraph: boolean;
+    causalGraph: boolean;
   };
   request: GraphSnapshotRequest;
   loadNode: GraphSnapshotNodeLoader;

package/src/graph.ts

@@ -15,6 +15,7 @@ import * as path from "node:path";
 
 import { readEdgeConfidence } from "./graph-edge-reinforcement.js";
 import { emitGraphEvent } from "./graph-events.js";
+import type { GraphConstructionCapabilitySet } from "./capabilities.js";
 
 export type GraphType = "entity" | "time" | "causal";
 
@@ -198,12 +199,12 @@ export async function readEdgesStrict(memoryDir: string, type: GraphType): Promi
  */
 export async function readAllEdges(
   memoryDir: string,
-  config: Pick<GraphConfig, "entityGraphEnabled" | "timeGraphEnabled" | "causalGraphEnabled">
+  graphCaps: Pick<GraphConstructionCapabilitySet, "entityGraph" | "timeGraph" | "causalGraph">,
 ): Promise<GraphEdge[]> {
   const parts: GraphEdge[][] = await Promise.all([
-    config.entityGraphEnabled ? readEdges(memoryDir, "entity") : Promise.resolve([]),
-    config.timeGraphEnabled ? readEdges(memoryDir, "time") : Promise.resolve([]),
-    config.causalGraphEnabled ? readEdges(memoryDir, "causal") : Promise.resolve([]),
+    graphCaps.entityGraph ? readEdges(memoryDir, "entity") : Promise.resolve([]),
+    graphCaps.timeGraph ? readEdges(memoryDir, "time") : Promise.resolve([]),
+    graphCaps.causalGraph ? readEdges(memoryDir, "causal") : Promise.resolve([]),
   ]);
   return parts.flat();
 }
@@ -396,9 +397,9 @@ export class GraphIndex {
       return this.edgeCache.allEdges;
     }
     const allEdges = await readAllEdges(this.memoryDir, {
-      entityGraphEnabled: this.cfg.entityGraphEnabled,
-      timeGraphEnabled: this.cfg.timeGraphEnabled,
-      causalGraphEnabled: this.cfg.causalGraphEnabled,
+      entityGraph: this.cfg.entityGraphEnabled,
+      timeGraph: this.cfg.timeGraphEnabled,
+      causalGraph: this.cfg.causalGraphEnabled,
     });
     this.edgeCache = { allEdges, loadedAt: Date.now() };
     return allEdges;

package/src/lifecycle/tombstones.test.ts

@@ -1,7 +1,9 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtemp, readFile, writeFile, rm, mkdir, appendFile } from "node:fs/promises";
+import { mkdtemp, readFile, writeFile, rm, mkdir, appendFile, utimes } from "node:fs/promises";
 import { tmpdir } from "node:os";
+import { spawn } from "node:child_process";
+import { statSync } from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import {
@@ -345,6 +347,245 @@ describe("TombstoneStore — enabled gate (rule 30)", () => {
   });
 });
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Cross-process tombstone write lock (issue #1639)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * A read-merge-write file io that simulates the secure-store append path
+ * (read encrypted → decrypt → concat → re-encrypt → atomic rename). Unlike a
+ * raw O_APPEND, this is NOT atomic across processes: two writers that each
+ * read the same contents and write back drop the other line — the exact
+ * lost-write race the #1639 cross-process lock closes. The setImmediate yield
+ * widens the race window so a missing lock would demonstrably lose entries.
+ */
+function makeReadMergeWriteIo() {
+  return {
+    read: (p: string) => readFile(p, "utf8"),
+    append: async (p: string, c: string) => {
+      await mkdir(path.dirname(p), { recursive: true });
+      let existing = "";
+      try {
+        existing = await readFile(p, "utf8");
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+      }
+      // Yield so two concurrent read-merge-write appends observably overlap
+      // when the cross-process lock is absent.
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      await writeFile(p, existing + c, "utf8");
+    },
+    write: async (p: string, c: string) => {
+      await mkdir(path.dirname(p), { recursive: true });
+      await writeFile(p, c, "utf8");
+    },
+    stat: (p: string) => statSync(p),
+  };
+}
+
+describe("TombstoneStore — cross-process write lock (issue #1639)", () => {
+  it("two processes appending concurrently produce no lost entries", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "tomb-xproc-"));
+    const moduleUrl = new URL("./tombstones.ts", import.meta.url).href;
+    const entriesPerWorker = 15;
+
+    // Worker source: plain JS, no nested template literals. Each child imports
+    // the store, points it at the shared tombstones.jsonl with a read-merge-
+    // write io, and appends N entries. The cross-process lock serializes the
+    // appends across the two processes so no entry is dropped.
+    const workerSource = [
+      "(async () => {",
+      "const { TombstoneStore } = await import(process.argv[1]);",
+      "const { mkdir, readFile, writeFile } = await import(\"node:fs/promises\");",
+      "const { statSync } = await import(\"node:fs\");",
+      "const path = await import(\"node:path\");",
+      "const { createHash } = await import(\"node:crypto\");",
+      "const dir = process.argv[2];",
+      "const workerId = Number(process.argv[3]);",
+      "const count = Number(process.argv[4]);",
+      "const filePath = path.join(dir, \"tombstones.jsonl\");",
+      "function hash(c){return createHash(\"sha256\").update(c).digest(\"hex\");}",
+      "function normalize(c){return c;}",
+      "const io = {",
+      "  read: (p) => readFile(p, \"utf8\"),",
+      "  append: async (p, c) => {",
+      "    await mkdir(path.dirname(p), { recursive: true });",
+      "    let existing = \"\";",
+      "    try { existing = await readFile(p, \"utf8\"); } catch (e) { if (e.code !== \"ENOENT\") throw e; }",
+      "    await new Promise((r) => setImmediate(r));",
+      "    await writeFile(p, existing + c, \"utf8\");",
+      "  },",
+      "  write: async (p, c) => { await mkdir(path.dirname(p), { recursive: true }); await writeFile(p, c, \"utf8\"); },",
+      "  stat: (p) => statSync(p),",
+      "};",
+      "const store = new TombstoneStore(filePath, \"default\", { enabled: true, semanticMatch: false, semanticThreshold: 0.9, hashContent: hash, normalizeText: normalize }, io);",
+      "await store.load();",
+      "for (let i = 0; i < count; i += 1) {",
+      "  await store.appendTombstone({ reason: \"correction\", createdBy: \"user_correction\", sourceMemoryId: \"w\" + workerId + \"-f\" + i, rawContent: \"worker \" + workerId + \" fact \" + i });",
+      "}",
+      "})();",
+    ].join("\n");
+
+    function runWorker(workerId: number): Promise<void> {
+      return new Promise((resolve, reject) => {
+        const child = spawn(
+          process.execPath,
+          ["--import", "tsx", "-e", workerSource, moduleUrl, dir, String(workerId), String(entriesPerWorker)],
+          { stdio: ["ignore", "pipe", "pipe"] },
+        );
+        let stderr = "";
+        child.stderr.setEncoding("utf8");
+        child.stderr.on("data", (chunk) => { stderr += chunk; });
+        child.on("error", reject);
+        child.on("close", (code) => {
+          if (code === 0) resolve();
+          else reject(new Error(`worker ${workerId} exited ${code}: ${stderr}`));
+        });
+      });
+    }
+
+    // Two genuinely concurrent processes contending on the same lockfile.
+    await Promise.all([runWorker(0), runWorker(1)]);
+
+    const raw = await readFile(path.join(dir, "tombstones.jsonl"), "utf8");
+    const fileLines = raw.split("\n").filter((l) => l.trim().length > 0);
+    // No lost entries: every line parses and the total is exactly 2 × N.
+    assert.equal(fileLines.length, entriesPerWorker * 2);
+    for (const line of fileLines) {
+      assert.doesNotThrow(() => JSON.parse(line));
+    }
+    // Every worker entry is present (none dropped by a lost write).
+    const sourceIds = new Set(fileLines.map((l) => JSON.parse(l).sourceMemoryId));
+    for (let w = 0; w < 2; w += 1) {
+      for (let i = 0; i < entriesPerWorker; i += 1) {
+        assert.ok(sourceIds.has(`w${w}-f${i}`), `missing w${w}-f${i} — lost write`);
+      }
+    }
+    // The advisory lockfile is released after the run (no lingering lock).
+    await rm(path.join(dir, "tombstones.lock"), { force: true });
+  });
+
+  it("recovers from a stale lock left by a crashed holder", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "tomb-stale-lock-"));
+    const filePath = path.join(dir, "tombstones.jsonl");
+    const lockPath = path.join(dir, "tombstones.lock");
+    // Seed a lockfile written by a (now-crashed) holder: <pid> <uuid> <iso>.
+    await mkdir(dir, { recursive: true });
+    await writeFile(
+      lockPath,
+      `${process.pid} 00000000-0000-0000-0000-000000000000 2000-01-01T00:00:00.000Z\n`,
+      "utf8",
+    );
+    // Make it older than staleMs so the next acquire breaks it.
+    const old = new Date(Date.now() - 120_000);
+    await utimes(lockPath, old, old);
+
+    const store = new TombstoneStore(
+      filePath,
+      "default",
+      { enabled: true, semanticMatch: false, semanticThreshold: 0.9, hashContent: computeHash, normalizeText: normalizeContent, lockStaleMs: 1_000 },
+      makeReadMergeWriteIo(),
+    );
+    // The append must break the stale lock, acquire a fresh one, and succeed.
+    const id = await store.appendTombstone({
+      reason: "correction",
+      createdBy: "user_correction",
+      sourceMemoryId: "fact-stale",
+      rawContent: "Recovered from a stale lock.",
+    });
+    assert.match(id, /^tomb-/);
+    // The tombstone landed durably.
+    const raw = await readFile(filePath, "utf8");
+    const lines2 = raw.split("\n").filter((l) => l.trim().length > 0);
+    assert.equal(lines2.length, 1);
+    // Our fresh lock was released on completion (the stale one was broken).
+    await rm(lockPath, { force: true });
+  });
+
+  it("rebuild preserves a peer's revocation appended before rebuild acquired the lock (cursor/codex #1639)", async () => {
+    // Regression for the rebuild race: rebuild must re-read the log under the
+    // lock (ensureFreshAgainstDisk) before computing its payload, otherwise a
+    // revocation a peer wrote while rebuild waited for the lock is dropped and
+    // the retired fact silently un-revokes (resurrection).
+    const dir = await mkdtemp(path.join(tmpdir(), "tomb-rebuild-race-"));
+    const filePath = path.join(dir, "tombstones.jsonl");
+    const opts = { enabled: true, semanticMatch: false, semanticThreshold: 0.9, hashContent: computeHash, normalizeText: normalizeContent };
+    const io = makeReadMergeWriteIo();
+    // Store A writes tombstone-1, then goes stale (never sees the peer write).
+    const storeA = new TombstoneStore(filePath, "default", opts, io);
+    const t1 = await storeA.appendTombstone({
+      reason: "correction",
+      createdBy: "user_correction",
+      sourceMemoryId: "fact-rebuild-1",
+      rawContent: "The DB is MySQL.",
+    });
+    // Peer (store B, same file) revokes t1 durably. Store A's in-memory index
+    // is now stale (it still thinks t1 is active).
+    const storeB = new TombstoneStore(filePath, "default", opts, io);
+    await storeB.revoke(t1, "user_correction");
+    // Store A rebuilds from a retired-memory corpus that reconstructs t1.
+    // Without the under-lock re-read, A computes existingRevocations from its
+    // stale index (empty), overwrites the file with [rebuilt-t1], and the
+    // revocation is LOST — t1 is active again (resurrection). With the fix,
+    // ensureFreshAgainstDisk reloads the revocation under the lock and rebuild
+    // preserves it.
+    await storeA.rebuild([
+      {
+        memoryId: "fact-rebuild-1",
+        rawContent: "The DB is MySQL.",
+        reason: "correction" as const,
+        createdBy: "user_correction" as const,
+        createdAt: "2026-01-01T00:00:00.000Z",
+      },
+    ]);
+    // The rebuilt file must still contain the revocation (the retired fact
+    // stays revoked, not silently un-revoked by the rebuild).
+    const raw = await readFile(filePath, "utf8");
+    const rebuiltLines = raw.split("\n").filter((l) => l.trim().length > 0);
+    const hasRevocation = rebuiltLines.some((l) => {
+      try { return JSON.parse(l).kind === "revocation"; } catch { return false; }
+    });
+    assert.ok(hasRevocation, "rebuild dropped the peer's revocation — resurrection risk");
+    // And the rebuilt store A must report the fact as revoked (lookup returns null).
+    await storeA.load();
+    assert.equal(
+      storeA.lookup({ namespace: "default", contentHash: computeHash("The DB is MySQL.") }),
+      null,
+      "revoked fact resurrected after rebuild",
+    );
+    await rm(path.join(dir, "tombstones.lock"), { force: true });
+  });
+
+  it("in-process concurrent appends still serialize under the lock", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "tomb-inproc-lock-"));
+    const filePath = path.join(dir, "tombstones.jsonl");
+    const store = new TombstoneStore(
+      filePath,
+      "default",
+      { enabled: true, semanticMatch: false, semanticThreshold: 0.9, hashContent: computeHash, normalizeText: normalizeContent },
+      makeReadMergeWriteIo(),
+    );
+    const contents = Array.from({ length: 25 }, (_, i) => `locked content ${i}`);
+    await Promise.all(
+      contents.map((c) =>
+        store.appendTombstone({
+          reason: "correction",
+          createdBy: "user_correction",
+          sourceMemoryId: `fact-${c}`,
+          rawContent: c,
+        }),
+      ),
+    );
+    await store.load();
+    const raw = await readFile(filePath, "utf8");
+    const lines3 = raw.split("\n").filter((l) => l.trim().length > 0);
+    // No lost writes despite the read-merge-write io + concurrent appends.
+    assert.equal(lines3.length, contents.length);
+    assert.equal(store.stats().count, contents.length);
+    await rm(path.join(dir, "tombstones.lock"), { force: true });
+  });
+});
+
 describe("parseTombstoneLine", () => {
   it("rejects malformed input", () => {
     assert.equal(parseTombstoneLine(""), null);