@remnic/core 9.3.728 → 9.3.730

package/src/orchestrator.ts

@@ -99,6 +99,8 @@ import {
 } from "./fallback-llm.js";
 import { MaintenanceScheduler } from "./orchestration/maintenance.js";
 import { TierMigrationCoordinator } from "./orchestration/tier-migration-coordinator.js";
+import { ExtractionQueueCoordinator } from "./orchestration/extraction-queue-coordinator.js";
+import { CompressionGuidelineCoordinator } from "./orchestration/compression-guideline-coordinator.js";
 import {
   runLiveConnectorsOnce,
   type LiveConnectorsRunSummary,
@@ -171,7 +173,6 @@ import {
 import { SessionObserverState } from "./session-observer-state.js";
 import {
   abortError as sharedAbortError,
-  isAbortError,
   throwIfAborted as sharedThrowIfAborted,
 } from "./abort-error.js";
 import { CODEX_THREAD_KEY_PREFIX } from "./thread-key.js";
@@ -224,10 +225,8 @@ import { parseMemoryActionEligibilityContext } from "./schemas.js";
 import { evaluateMemoryActionPolicy } from "./memory-action-policy.js";
 import {
   buildCompressionGuidelinesMarkdown as buildCompressionGuidelinesMarkdownV2,
-  computeCompressionGuidelineCandidate,
-  refineCompressionGuidelineCandidateSemantically,
-  renderCompressionGuidelinesMarkdown,
 } from "./compression-optimizer.js";
+export { formatCompressionGuidelinesForRecall } from "./orchestration/compression-guideline-coordinator.js";
 import { createRecallSectionMetricRecorder } from "./recall-qos.js";
 import { BoxBuilder, type BoxFrontmatter } from "./boxes.js";
 import { classifyMemoryKind } from "./himem.js";
@@ -270,9 +269,13 @@ import {
   resolveCapabilities,
   resolveGraphConstructionCapabilities,
   resolveMemoryLifecycleCapabilities,
+  resolveIndexingCapabilities,
+  resolveCreationMemoryCapabilities,
   type CapabilitySet,
   type GraphConstructionCapabilitySet,
   type MemoryLifecycleCapabilitySet,
+  type IndexingCapabilitySet,
+  type CreationMemoryCapabilitySet,
 } from "./capabilities.js";
 import { DEFAULT_TAXONOMY } from "./taxonomy/index.js";
 import {
@@ -1202,30 +1205,6 @@ export function buildCompressionGuidelinesMarkdown(
   return buildCompressionGuidelinesMarkdownV2(events, generatedAtIso);
 }
 
-export function formatCompressionGuidelinesForRecall(
-  raw: string,
-  maxLines: number = 5,
-): string | null {
-  if (typeof raw !== "string" || raw.trim().length === 0) return null;
-  const sectionMatch = raw.match(
-    // End the section at `\n## ` or end-of-string. Plain $ (not \s*$): the
-    // \s* branch overlapped the lazy body and backtracked polynomially
-    // (CodeQL js/polynomial-redos). Captured lines are trimmed/filtered below,
-    // so trailing whitespace handling is unchanged.
-    /## Suggested Guidelines\s*\n([\s\S]*?)(?:\n##\s+|$)/i,
-  );
-  if (!sectionMatch) return null;
-
-  const lines = sectionMatch[1]
-    .split("\n")
-    .map((line) => line.trim())
-    .filter((line) => line.startsWith("- "))
-    .slice(0, Math.max(1, Math.floor(maxLines)));
-  if (lines.length === 0) return null;
-
-  return lines.join("\n");
-}
-
 export function filterRecallCandidates(
   candidates: QmdSearchResult[],
   options: {
@@ -1916,6 +1895,7 @@ export class Orchestrator {
   readonly handleHistory: RecallHandleHistoryStore;
   readonly tierMigrationStatus: TierMigrationStatusStore;
   readonly tierMigrationCoordinator: TierMigrationCoordinator;
+  readonly compressionGuidelineCoordinator: CompressionGuidelineCoordinator;
   /**
    * In-memory X-ray snapshot from the most recent `recall()` call that
    * was invoked with `xrayCapture: true` (issue #570 PR 1).  Scope is
@@ -2021,10 +2001,14 @@ export class Orchestrator {
     suppressedReasonCounts: Record<string, number>;
   } = { detected: 0, queued: 0, autoApplied: 0, suppressedReasonCounts: {} };
 
-  // Background serial queue for extractions (agent_end optimization)
-  // Queue stores promises that resolve when extraction should run
-  private extractionQueue: Array<() => Promise<void>> = [];
-  private queueProcessing = false;
+  /**
+   * Background serial extraction queue coordinator (issue #1526 — moved
+   * from inline `extractionQueue`/`queueProcessing` fields). Owns queue
+   * state + scheduling + the serial drain + failure classification; the
+   * orchestrator builds each task closure in `queueBufferedExtraction` and
+   * hands it to `enqueue`.
+   */
+  readonly extractionQueueCoordinator: ExtractionQueueCoordinator;
   private heartbeatObserverChains = new Map<string, Promise<void>>();
   private recentExtractionFingerprints = new Map<string, number>();
   private readonly consolidationObservers = new Set<
@@ -2991,6 +2975,8 @@ export class Orchestrator {
       namespaceSearchRouter: this.namespaceSearchRouter,
       namespaceCatalog: this.namespaceCatalog,
     });
+    // Issue #1526: background extraction queue lives on its own coordinator.
+    this.extractionQueueCoordinator = new ExtractionQueueCoordinator();
     const conversationIndexRuntime = createConversationIndexRuntime(config, {
       getQmd: () => this.conversationQmd,
       getFaiss: () => this.conversationFaiss,
@@ -3027,6 +3013,12 @@ export class Orchestrator {
       getCompounding: () => this.compounding,
       createColdStorage: (parentDir) => new StorageManager(parentDir),
     });
+    this.compressionGuidelineCoordinator = new CompressionGuidelineCoordinator({
+      config,
+      getStorage: () => this.storage,
+      fastChatCompletion: (messages, options) =>
+        this.fastChatCompletion(messages, options),
+    });
     this.sessionObserver = new SessionObserverState({
       memoryDir: config.memoryDir,
       debounceMs: config.sessionObserverDebounceMs ?? 120_000,
@@ -3468,6 +3460,31 @@ export class Orchestrator {
         // never break initialization (rule #13, #40).
         await this.namespaceCatalog.registerConfiguredNamespaces().catch(() => undefined);
       }
+      // #1713 Item 2: recover stale `applying` correction plans left behind
+      // by a process that died mid-apply. Best-effort — a failure here must
+      // never block initialization (rule 13). Runs for every configured
+      // namespace since correction plans can exist in any of them.
+      try {
+        // #1713 Item 2 + P2 (cursor): sweep ALL known namespaces — configured
+        // + catalog-discovered — so stale applying plans in derived namespaces
+        // (coding-scoped, session-derived) are also recovered.
+        const correctionNamespaces = new Set(this.configuredNamespaceList());
+        if (this.namespaceCatalog.enabled) {
+          try {
+            for (const rec of await this.namespaceCatalog.listNamespaces()) {
+              correctionNamespaces.add(rec.namespace);
+            }
+          } catch { /* best-effort */ }
+        }
+        const recovered = await this.passiveCorrectionService().recoverStaleApplyingPlans(
+          [...correctionNamespaces],
+        );
+        if (recovered > 0) {
+          log.info(`correction: recovered ${recovered} stale applying plan(s) on startup`);
+        }
+      } catch (staleErr) {
+        log.debug(`correction: stale-plan recovery skipped: ${staleErr instanceof Error ? staleErr.message : String(staleErr)}`);
+      }
       await this.relevance.load();
       await this.negatives.load();
       await this.lastRecall.load();
@@ -3750,7 +3767,7 @@ export class Orchestrator {
     await Promise.all(cacheWarmups);
     if (signal.aborted) return;
 
-    if (this.config.conversationIndexEnabled && this.conversationIndexBackend) {
+    if (resolveIndexingCapabilities(this.config).conversationIndex && this.conversationIndexBackend) {
       try {
         const init = await this.conversationIndexBackend.initialize();
         if (!init.enabled) {
@@ -4560,7 +4577,7 @@ export class Orchestrator {
         }
 
         // Write the canonical memory
-        const canonicalId = await targetStorage.writeMemory(
+        const { id: canonicalId, tombstoneBlocked: canonicalBlocked } = await targetStorage.writeMemory(
           newest.frontmatter.category,
           canonicalContent,
           {
@@ -4577,6 +4594,12 @@ export class Orchestrator {
             derivedVia: operator,
           },
         );
+        if (canonicalBlocked) {
+          // #1645: canonical matched a tombstone (pending_review). Don't archive
+          // the sources — consolidation must never delete the only active copy.
+          log.info(`[semantic-consolidation] cluster in "${cluster.category}" tombstone-blocked — keeping ${cluster.memories.length} source(s) active (pending_review ${canonicalId})`);
+          continue;
+        }
         canonicalWriteCompleted = true;
 
         result.memoriesConsolidated++;
@@ -4603,7 +4626,7 @@ export class Orchestrator {
             try {
               await this.embeddingFallback.removeFromIndex(m.frontmatter.id);
               if (
-                this.config.queryAwareIndexingEnabled &&
+                resolveIndexingCapabilities(this.config).queryAwareIndexing &&
                 m.path &&
                 m.frontmatter?.created
               ) {
@@ -4720,15 +4743,8 @@ export class Orchestrator {
   }
 
   async waitForExtractionIdle(timeoutMs: number = 60_000): Promise<boolean> {
-    const started = Date.now();
-    while (this.queueProcessing || this.extractionQueue.length > 0) {
-      if (Date.now() - started > timeoutMs) {
-        log.warn(`waitForExtractionIdle timed out after ${timeoutMs}ms`);
-        return false;
-      }
-      await new Promise((resolve) => setTimeout(resolve, 50));
-    }
-    return true;
+    // Issue #1526: queue state + idle wait moved to ExtractionQueueCoordinator.
+    return this.extractionQueueCoordinator.waitForIdle(timeoutMs);
   }
 
   async waitForConsolidationIdle(timeoutMs: number = 60_000): Promise<boolean> {
@@ -5649,7 +5665,7 @@ export class Orchestrator {
     const lastUpdateAt =
       lastUpdateAtMs > 0 ? new Date(lastUpdateAtMs).toISOString() : null;
 
-    if (!this.config.conversationIndexEnabled) {
+    if (!resolveIndexingCapabilities(this.config).conversationIndex) {
       return {
         enabled: false,
         backend: this.config.conversationIndexBackend,
@@ -5689,7 +5705,7 @@ export class Orchestrator {
     const lastUpdateAt =
       lastUpdateAtMs > 0 ? new Date(lastUpdateAtMs).toISOString() : null;
 
-    if (!this.config.conversationIndexEnabled) {
+    if (!resolveIndexingCapabilities(this.config).conversationIndex) {
       return {
         enabled: false,
         backend: this.config.conversationIndexBackend,
@@ -5751,7 +5767,7 @@ export class Orchestrator {
     retryAfterMs?: number;
     embedded?: boolean;
   }> {
-    if (!this.config.conversationIndexEnabled) {
+    if (!resolveIndexingCapabilities(this.config).conversationIndex) {
       return { chunks: 0, skipped: true, reason: "disabled", embedded: false };
     }
     const enforceMinInterval = opts?.enforceMinInterval !== false;
@@ -5812,7 +5828,7 @@ export class Orchestrator {
     embedded?: boolean;
     rebuilt?: boolean;
   }> {
-    if (!this.config.conversationIndexEnabled) {
+    if (!resolveIndexingCapabilities(this.config).conversationIndex) {
       return {
         chunks: 0,
         skipped: true,
@@ -6417,7 +6433,7 @@ export class Orchestrator {
     prompt: string,
     recallNamespaces: string[],
   ): Promise<QueryAwarePrefilter> {
-    if (!this.config.queryAwareIndexingEnabled || !prompt.trim()) {
+    if (!resolveIndexingCapabilities(this.config).queryAwareIndexing || !prompt.trim()) {
       return {
         candidatePaths: null,
         temporalFromDate: null,
@@ -9209,7 +9225,7 @@ export class Orchestrator {
     const workProductsPromise = (async (): Promise<string | null> => {
       const t0 = Date.now();
       if (
-        !this.config.creationMemoryEnabled ||
+        !resolveCreationMemoryCapabilities(this.config).creationMemory ||
         !this.config.workProductRecallEnabled ||
         !this.isRecallSectionEnabled(
           "work-products",
@@ -9284,7 +9300,7 @@ export class Orchestrator {
     const queryAwarePrefilterPromise =
       (async (): Promise<QueryAwarePrefilter> => {
         const t0 = Date.now();
-        if (!this.config.queryAwareIndexingEnabled || !prompt.trim()) {
+        if (!resolveIndexingCapabilities(this.config).queryAwareIndexing || !prompt.trim()) {
           recordRecallSectionMetric({
             section: "queryAware",
             priority: "enrichment",
@@ -10030,7 +10046,7 @@ export class Orchestrator {
     const conversationRecallPromise = (async (): Promise<string | null> => {
       const t0 = Date.now();
       if (
-        !this.config.conversationIndexEnabled ||
+        !resolveIndexingCapabilities(this.config).conversationIndex ||
         queryPolicy.skipConversationRecall ||
         !this.isRecallSectionEnabled("conversation-recall", true)
       ) {
@@ -13165,7 +13181,7 @@ export class Orchestrator {
       }, remainingMs);
     }
 
-    this.extractionQueue.push(async () => {
+    this.extractionQueueCoordinator.enqueue(async () => {
       if (settled) return;
       if (
         typeof extractionDeadlineMs === "number" &&
@@ -13196,13 +13212,6 @@ export class Orchestrator {
       }
     });
 
-    if (!this.queueProcessing) {
-      this.queueProcessing = true;
-      this.processQueue().catch((err) => {
-        this.logExtractionQueueFailure(err, "processor");
-        this.queueProcessing = false;
-      });
-    }
     log.debug(`queued extraction from ${reason}`);
   }
 
@@ -13270,62 +13279,6 @@ export class Orchestrator {
     return true;
   }
 
-  /**
-   * Background serial queue processor.
-   * Processes extractions one at a time to avoid race conditions.
-   * Called automatically when items are queued.
-   */
-  private async processQueue(): Promise<void> {
-    while (this.extractionQueue.length > 0) {
-      const task = this.extractionQueue.shift();
-      if (task) {
-        try {
-          await task();
-        } catch (err) {
-          this.logExtractionQueueFailure(err, "task");
-        }
-      }
-    }
-
-    this.queueProcessing = false;
-  }
-
-  /**
-   * Classify + log a failure from either the per-task catch inside
-   * `processQueue()` or the outer `processQueue().catch(...)` in
-   * `queueBufferedExtraction()`.  Issue #549: `throwIfRecallAborted`
-   * (used throughout `runExtraction`) raises an Error whose `name` is
-   * `"AbortError"`.  That path fires when `before_reset` aborts a
-   * queued task to avoid duplicate extraction — it is intentional
-   * cancellation, not a failure.  Downgrading the log to debug
-   * prevents spurious `error`-level lines that routinely appear
-   * right next to a successful `persisted: N facts, M entities` log
-   * and that confuse operators into thinking extraction is broken.
-   * Genuine extraction failures (network, parse, I/O) still log at
-   * `error`.
-   *
-   * Source differentiates the two call sites so the log message
-   * names the right layer (`task` vs `processor`).
-   */
-  private logExtractionQueueFailure(
-    err: unknown,
-    source: "task" | "processor",
-  ): void {
-    const aborted =
-      source === "task"
-        ? "background extraction task aborted (session transition)"
-        : "background extraction queue processor aborted (session transition)";
-    const failed =
-      source === "task"
-        ? "background extraction task failed"
-        : "background extraction queue processor failed";
-    if (isAbortError(err)) {
-      log.debug(aborted);
-    } else {
-      log.error(failed, err);
-    }
-  }
-
   /**
    * Passive correction capture (issue #1581) — detects corrections expressed
    * passively in conversation turns and routes them to the Correction Contract
@@ -14237,6 +14190,10 @@ export class Orchestrator {
           sharedProfileLayer.writable &&
           sharedPromotionTarget?.authorized,
       );
+    // #1713: hoist namespaces-enabled once for the scope-routing mirrors
+    // (pre-judge + write-loop) so no new scattered config.*Enabled read is
+    // introduced (ratchet scatteredConfigFlagReads; see #1523).
+    const namespacesEnabled = this.config.namespacesEnabled;
     const profileAutoPromotionAllows = (
       category: string,
       confidence: number,
@@ -14369,7 +14326,7 @@ export class Orchestrator {
             }
             continue;
           }
-          const promotedId = await targetStorage.writeMemory(
+          const targetPromotion = await targetStorage.writeMemory(
             options.category as any,
             citedContent,
             {
@@ -14395,7 +14352,11 @@ export class Orchestrator {
               ...(options.provenance ? { provenance: options.provenance } : {}),
             },
           );
+          const promotedId = targetPromotion.id;
+          // #1645: if the TARGET namespace's own tombstone blocked this promotion,
+          // the row lands pending_review — do NOT supersede active target memories.
           if (
+            !targetPromotion.tombstoneBlocked &&
             lifecycleCaps.temporalSupersession &&
             options.category === "fact" &&
             options.entityRef &&
@@ -14417,19 +14378,23 @@ export class Orchestrator {
               );
             }
           }
-          trackPersistedId(targetStorage, promotedId, { includeReturnedIds: false });
-          await this.indexPersistedMemory(targetStorage, promotedId);
-          trackBehaviorSignals(
-            targetStorage,
-            buildBehaviorSignalsForMemory({
-              memoryId: promotedId,
-              category: options.category as any,
-              content: options.content,
-              namespace: target.namespace,
-              confidence: options.confidence,
-              source: "extraction",
-            }),
-          );
+          // #1645 TV6: a tombstone-blocked promotion is pending_review (no
+          // active copy) — skip catalog/index/behavior like postWriteGuard.
+          if (!targetPromotion.tombstoneBlocked) {
+            trackPersistedId(targetStorage, promotedId, { includeReturnedIds: false });
+            await this.indexPersistedMemory(targetStorage, promotedId);
+            trackBehaviorSignals(
+              targetStorage,
+              buildBehaviorSignalsForMemory({
+                memoryId: promotedId,
+                category: options.category as any,
+                content: options.content,
+                namespace: target.namespace,
+                confidence: options.confidence,
+                source: "extraction",
+              }),
+            );
+          }
         } catch (err) {
           log.warn(
             `persistExtraction: ${target.target} promotion failed open for ${options.sourceMemoryId}: ${err}`,
@@ -14688,7 +14653,7 @@ export class Orchestrator {
             return;
           }
         }
-        const promotedId = await sharedStorage.writeMemory(
+        const sharedPromotion = await sharedStorage.writeMemory(
           options.category as any,
           citedContent,
           {
@@ -14715,6 +14680,9 @@ export class Orchestrator {
             ...(options.provenance ? { provenance: options.provenance } : {}),
           },
         );
+        const promotedId = sharedPromotion.id;
+        // #1645: if the shared namespace's own tombstone blocked this promotion,
+        // leave the row pending_review but do NOT supersede active shared memories.
         // PR #402 Finding 3 fix: run temporal supersession against the shared
         // namespace after the promoted write lands so stale shared-namespace
         // copies of the same entity attribute are retired.  Without this,
@@ -14722,6 +14690,7 @@ export class Orchestrator {
         // shared recall continues returning the stale state.  Reuses the same
         // applyTemporalSupersession helper — no logic duplication.
         if (
+          !sharedPromotion.tombstoneBlocked &&
           lifecycleCaps.temporalSupersession &&
           options.entityRef &&
           options.structuredAttributes &&
@@ -14751,21 +14720,24 @@ export class Orchestrator {
         // the same promotion pass. The hot-path source-namespace touch uses a
         // different storage dir, so this does not double-count the source.
         // Best-effort and failure-tolerant — it must never crash the promotion.
-        trackPersistedId(sharedStorage, promotedId, {
-          includeReturnedIds: false,
-        });
-        await this.indexPersistedMemory(sharedStorage, promotedId);
-        trackBehaviorSignals(
-          sharedStorage,
-          buildBehaviorSignalsForMemory({
-            memoryId: promotedId,
-            category: options.category as any,
-            content: options.content,
-            namespace: this.config.sharedNamespace,
-            confidence: options.confidence,
-            source: "extraction",
-          }),
-        );
+        // #1645 TV6: same guard as the profile-target promotion above.
+        if (!sharedPromotion.tombstoneBlocked) {
+          trackPersistedId(sharedStorage, promotedId, {
+            includeReturnedIds: false,
+          });
+          await this.indexPersistedMemory(sharedStorage, promotedId);
+          trackBehaviorSignals(
+            sharedStorage,
+            buildBehaviorSignalsForMemory({
+              memoryId: promotedId,
+              category: options.category as any,
+              content: options.content,
+              namespace: this.config.sharedNamespace,
+              confidence: options.confidence,
+              source: "extraction",
+            }),
+          );
+        }
       } catch (err) {
         log.warn(
           `persistExtraction: shared promotion failed open for ${options.sourceMemoryId}: ${err}`,
@@ -14992,6 +14964,10 @@ export class Orchestrator {
     // these pre-computed results so routing is evaluated exactly once per
     // fact (no duplicated logic).
     const preRoutedCategories: Array<string | undefined> = new Array(facts.length);
+    // #1713 Item 1: collect routed target namespaces so the pre-judge redaction
+    // filter can consult rules from cross-namespace targets, not just the source.
+    // #1713 P2 (cursor): track per-fact routed namespace for per-fact pre-judge rules
+    const preRoutedNamespaceByFact: Array<string | undefined> = new Array(facts.length);
     if (routeRules.length > 0) {
       for (let fi = 0; fi < facts.length; fi++) {
         const f = facts[fi];
@@ -15011,6 +14987,9 @@ export class Orchestrator {
           if (selected?.target.category) {
             preRoutedCategories[fi] = selected.target.category;
           }
+          if (selected?.target.namespace) {
+            preRoutedNamespaceByFact[fi] = selected.target.namespace;
+          }
         } catch {
           // Fail-open: routing errors fall through to the extracted category.
         }
@@ -15033,10 +15012,18 @@ export class Orchestrator {
     // into the caller's buffer-retention decision.
     this.lastPersistExtractionDeferredCount = 0;
     if (lifecycleCaps.extractionJudge) {
-      // #1669 P1: pre-filter redacted facts from judge candidates so never-store
-      // content is not persisted as judge training data.
+      // #1669 P1 + #1713 Item 1: pre-filter redacted facts from judge candidates
+      // so never-store content is not persisted as judge training data.
+      // Consult source + shared + routed target namespace rules so a
+      // never-store pattern registered under a cross-namespace target is
+      // caught at the batch pre-filter point, not just at the persist gate.
       let preJudgeRedactionRules: CompiledRedactionRule[] = [];
-      try { preJudgeRedactionRules = await redactionRulesFor(storage.dir); } catch { /* fail open */ }
+      try {
+        // #1713: base rules are source-only. Per-fact routed target rules
+        // (including shared when a fact is routed there) are checked in the
+        // fact loop, matching the write-time gate's per-fact scoping exactly.
+        preJudgeRedactionRules = await redactionRulesFor(storage.dir);
+      } catch { /* fail open */ }
       try {
         const judgeCandidates: JudgeCandidate[] = [];
         const candidateToFactIndex: number[] = [];
@@ -15077,10 +15064,42 @@ export class Orchestrator {
           ) {
             continue;
           }
-          if (preJudgeRedactionRules.length > 0) {
+          // #1713 P2 (cursor): per-fact rules — load this fact's routed target
+          // namespace rules FIRST, then check. This catches target-only rules
+          // even when the base (source+shared) rules are empty (threads acc58c42
+          // + PBJEe/PBKAj).
+          let factRedactionRules = preJudgeRedactionRules;
+          let factNs = preRoutedNamespaceByFact[fi];
+          // #1713 (codex PRRT_kwDORJXyws6PBj5X): scope classification can route
+          // a scope=global fact to the shared namespace independent of routing
+          // rules. If so, the pre-judge filter must consult the shared
+          // namespace's rules too, or a never-store pattern under shared is
+          // missed at pre-judge and only caught at the write gate — letting the
+          // content reach the extraction judge/training path. Mirror the write
+          // loop's scope-routing conditions exactly.
+          if (
+            !factNs &&
+            lifecycleCaps.extractionScopeClassification &&
+            namespacesEnabled &&
+            f.scope === "global" &&
+            profileAllowsSharedWrites &&
+            this.storageDirNamespace(storage.dir) !== this.config.sharedNamespace
+          ) {
+            factNs = this.config.sharedNamespace;
+          }
+          if (factNs) {
+            try {
+              const factDir = (await this.storageRouter.storageFor(factNs)).dir;
+              if (factDir !== storage.dir) {
+                const targetRules = await redactionRulesFor(factDir);
+                if (targetRules.length) factRedactionRules = [...preJudgeRedactionRules, ...targetRules];
+              }
+            } catch { /* fail open */ }
+          }
+          if (factRedactionRules.length > 0) {
             const rc = f.content + (f.structuredAttributes ? " " + JSON.stringify(f.structuredAttributes) : "")
               + (f.procedureSteps ? " " + f.procedureSteps.map((s) => `${s.intent} ${s.expectedOutcome ?? ""} ${s.toolCall ? `${s.toolCall.kind} ${s.toolCall.signature}` : ""}`.trim()).join(" ") : "");
-            if (contentMatchesRedactionRules(rc, preJudgeRedactionRules)) continue;
+            if (contentMatchesRedactionRules(rc, factRedactionRules)) continue;
           }
           judgeCandidates.push({
             text: f.content,
@@ -15310,7 +15329,7 @@ export class Orchestrator {
       // extractionScopeClassificationEnabled.
       if (
         lifecycleCaps.extractionScopeClassification &&
-        this.config.namespacesEnabled &&
+        namespacesEnabled &&
         fact.scope === "global" &&
         !routedNamespaceExplicit
       ) {
@@ -15667,6 +15686,16 @@ export class Orchestrator {
       // `supersedes` is intentionally left unset to avoid retiring the old
       // memory without user confirmation).
       let contradictionDetected = false;
+      // #1645: hoist the contradiction result so the deferred auto-resolve
+      // (post-write, gated on tombstone status) can read its fields.
+      let contradiction: {
+        supersededId: string;
+        confidence: number;
+        reason: string;
+        supersededPath: string;
+        supersededCreated: string;
+        supersededTags: string[];
+      } | null | undefined;
 
       // Faithfulness gate (#1576, chatgpt P2): skip contradiction detection
       // for a pending_review fact — an unfaithful extraction in the review queue
@@ -15677,7 +15706,7 @@ export class Orchestrator {
         faithfulnessEnforceStatus !== "pending_review"
       ) {
         const targetNamespace = this.storageDirNamespace(targetStorage.dir);
-        const contradiction = await this.checkForContradiction(
+        contradiction = await this.checkForContradiction(
           fact.content,
           writeCategory,
           targetNamespace,
@@ -15699,22 +15728,10 @@ export class Orchestrator {
             strength: contradiction.confidence,
             reason: contradiction.reason,
           });
-          // Deindex the superseded memory so stale paths don't remain in
-          // index_time.json / index_tags.json after the incremental update.
-          // Only applicable when auto-resolve is on and the old memory is
-          // actually being retired; skip when manual review is required.
-          if (
-            this.config.contradictionAutoResolve &&
-            this.config.queryAwareIndexingEnabled &&
-            contradiction.supersededPath
-          ) {
-            deindexMemory(
-              this.config.memoryDir,
-              contradiction.supersededPath,
-              contradiction.supersededCreated,
-              contradiction.supersededTags,
-            );
-          }
+          // #1645: deindex + supersede are deferred to after writeMemory so the
+          // caller can gate them on the new write's tombstone status. A
+          // tombstone-blocked write (pending_review) must not deindex or retire
+          // the existing active memory — see the post-write guard below.
         }
       }
 
@@ -15829,7 +15846,7 @@ export class Orchestrator {
               ? stripCitationForTemplate(fact.content, citationTemplate)
               : fact.content;
           const citedChunkedContent = applyInlineCitation(rawChunkedContent);
-          const parentId = await targetStorage.writeMemory(
+          const parentWrite = await targetStorage.writeMemory(
             writeCategory,
             citedChunkedContent,
             {
@@ -15856,6 +15873,20 @@ export class Orchestrator {
               ...(fact.provenance ? { provenance: fact.provenance } : {}),
             },
           );
+          const parentId = parentWrite.id;
+          // #1645: surface the tombstone block and gate active post-write paths
+          // (chunks, supersession, shared promotion, graph/artifact) like #1576.
+          const tombstoneBlocked = parentWrite.tombstoneBlocked;
+          const postWriteGuard =
+            faithfulnessEnforceStatus === "pending_review" || tombstoneBlocked;
+          // #1645: defer contradiction auto-resolve until tombstone status is
+          // known (see applyDeferredContradictionResolve).
+          await this.applyDeferredContradictionResolve(
+            contradiction,
+            targetStorage,
+            parentId,
+            postWriteGuard,
+          );
           try {
             // Write individual chunks with parent reference
             for (const chunk of chunkResult.chunks) {
@@ -15903,7 +15934,13 @@ export class Orchestrator {
                   // fact's verdict + enforce status so a pending_review fact
                   // is not indexed as active through its chunks (chatgpt P2).
                   ...(faithfulnessFm ? { faithfulness: faithfulnessFm } : {}),
-                  ...(faithfulnessEnforceStatus ? { status: faithfulnessEnforceStatus } : {}),
+                  // #1645 (OchiE): inherit pending_review + blockedBy so no chunk lands active.
+                  ...(postWriteGuard
+                    ? { status: "pending_review" as const }
+                    : (faithfulnessEnforceStatus ? { status: faithfulnessEnforceStatus } : {})),
+                  ...(tombstoneBlocked && parentWrite.blockedBy
+                    ? { blockedBy: parentWrite.blockedBy }
+                    : {}),
                   // Claim-level provenance (issue #1575 PR 2): mirror the
                   // parent's spans onto each chunk so a chunk surfaced
                   // independently (memory_get/x-ray on a chunk ID) preserves
@@ -15930,24 +15967,28 @@ export class Orchestrator {
             `chunked memory ${parentId} into ${chunkResult.chunks.length} chunks`,
           );
           trackPersistedId(targetStorage, parentId, {
-            pendingReview: faithfulnessEnforceStatus === "pending_review",
+            pendingReview: postWriteGuard,
           });
           // #1576 (cursor Medium): keep pending_review ids out of threadEpisodeIdsForGraph — else later active facts build thread-predecessor edges to an unfaithful memory.
           if (
-            faithfulnessEnforceStatus !== "pending_review" &&
+            !postWriteGuard &&
             threadEpisodeIdsForGraph &&
             !threadEpisodeIdsForGraph.includes(parentId)
           ) {
             threadEpisodeIdsForGraph.push(parentId);
           }
-          await this.indexPersistedMemory(targetStorage, parentId);
+          // #1645: same gate as the non-chunked path — a blocked chunked parent
+          // must not enter the embedding-fallback index (resurrection).
+          if (!postWriteGuard) {
+            await this.indexPersistedMemory(targetStorage, parentId);
+          }
           // PR #402 Thread 1 fix: run source-namespace temporal supersession for
           // chunked writes, matching the non-chunked path.  Without this the
           // source namespace retains stale facts that should have been superseded.
           // Faithfulness gate (#1576, cursor High): skip supersession for a
           // pending_review fact — an unfaithful extraction in the review queue
           // must NOT retire older active memories.
-          if (faithfulnessEnforceStatus !== "pending_review") {
+          if (!postWriteGuard) {
             try {
               const supersessionEntityRef =
                 typeof (fact as any).entityRef === "string"
@@ -15972,7 +16013,7 @@ export class Orchestrator {
           // Faithfulness gate (#1576, chatgpt P2): do not promote a
           // pending_review fact to shared/profile — it must enter the review
           // queue without active copies that bypass the gate.
-          if (faithfulnessEnforceStatus !== "pending_review") await promoteMemoryToShared({
+          if (!postWriteGuard) await promoteMemoryToShared({
             sourceStorage: targetStorage,
             category: writeCategory,
             content: fact.content,
@@ -16007,7 +16048,13 @@ export class Orchestrator {
               hasCitationForTemplate(fact.content, citationTemplate)
                 ? stripCitationForTemplate(fact.content, citationTemplate)
                 : fact.content;
-            await this.addContentHashDedup(targetStorage, canonicalChunkedContent);
+            // #1645: do NOT register a tombstone-blocked fact's content in the
+            // dedup index — writeMemory already skipped it (rule 44). Re-adding
+            // would let the next extraction dedup-skip the tombstone chokepoint
+            // and silently ban the retired content (no pending_review row).
+            if (!tombstoneBlocked) {
+              await this.addContentHashDedup(targetStorage, canonicalChunkedContent);
+            }
           } catch (err) {
             log.warn(
               `content-hash dedup registration failed for chunked memory ${parentId}: ${err}`,
@@ -16020,14 +16067,18 @@ export class Orchestrator {
             // into boxBuilder.onExtraction() or threading.processTurn(), which
             // only expect canonical parent memory IDs.  Call indexPersistedMemory
             // directly for embedding-fallback sync of each chunk document.
-            await this.indexPersistedMemory(targetStorage, chunkId);
+            // #1645: chunks inherit pending_review under postWriteGuard — don't
+            // index them into the embedding fallback (resurrection).
+            if (!postWriteGuard) {
+              await this.indexPersistedMemory(targetStorage, chunkId);
+            }
           }
           try {
             if (
               this.config.verbatimArtifactsEnabled &&
               this.config.verbatimArtifactCategories.includes(writeCategory) &&
               fact.confidence >= this.config.verbatimArtifactsMinConfidence &&
-              faithfulnessEnforceStatus !== "pending_review"
+              !postWriteGuard
             ) {
               // Reuse citedChunkedContent so the artifact carries the same citation
               // timestamp as the parent memory write above (Fix #3 — duplicate-citation).
@@ -16042,7 +16093,7 @@ export class Orchestrator {
               });
             }
             // v8.2: graph edge building for chunked memories. #1576: skip pending_review.
-            if (graphCaps.multiGraphMemory && faithfulnessEnforceStatus !== "pending_review") {
+            if (graphCaps.multiGraphMemory && !postWriteGuard) {
               try {
                 const graphContext = await ensureGraphContext(targetStorage);
                 const entityRef =
@@ -16144,7 +16195,7 @@ export class Orchestrator {
           ? buildProcedurePersistBody(fact.content, fact.procedureSteps)
           : fact.content;
       const citedFactContent = applyInlineCitation(rawPersistBody);
-      const memoryId = await targetStorage.writeMemory(
+      const factWrite = await targetStorage.writeMemory(
         writeCategory,
         citedFactContent,
         {
@@ -16176,6 +16227,20 @@ export class Orchestrator {
           ...(fact.provenance ? { provenance: fact.provenance } : {}),
         },
       );
+      const memoryId = factWrite.id;
+      // #1645: surface the tombstone block; gate active post-write paths like #1576
+      // so a blocked fact creates no active shared copy / supersession / graph entry.
+      const tombstoneBlocked = factWrite.tombstoneBlocked;
+      const postWriteGuard =
+        faithfulnessEnforceStatus === "pending_review" || tombstoneBlocked;
+      // #1645: defer contradiction auto-resolve until tombstone status is
+      // known (see applyDeferredContradictionResolve).
+      await this.applyDeferredContradictionResolve(
+        contradiction,
+        targetStorage,
+        memoryId,
+        postWriteGuard,
+      );
       if (routedRuleId) {
         log.debug(
           `routing applied for memory ${memoryId}: rule=${routedRuleId} category=${writeCategory} storage=${targetStorage.dir}`,
@@ -16186,7 +16251,7 @@ export class Orchestrator {
       // key that has a conflicting value. Faithfulness gate (#1576, cursor
       // High): skip for a pending_review fact — an unfaithful extraction in
       // the review queue must NOT retire older active memories.
-      if (faithfulnessEnforceStatus !== "pending_review") {
+      if (!postWriteGuard) {
         try {
           const supersessionEntityRef =
             typeof (fact as any).entityRef === "string"
@@ -16218,19 +16283,25 @@ export class Orchestrator {
           }),
         );
         trackPersistedId(targetStorage, memoryId, {
-          pendingReview: faithfulnessEnforceStatus === "pending_review",
+          pendingReview: postWriteGuard,
         });
         if (
-          faithfulnessEnforceStatus !== "pending_review" &&
+          !postWriteGuard &&
           threadEpisodeIdsForGraph &&
           !threadEpisodeIdsForGraph.includes(memoryId)
         ) {
           threadEpisodeIdsForGraph.push(memoryId);
         }
-        await this.indexPersistedMemory(targetStorage, memoryId);
+        // #1645: a tombstone-blocked / pending_review fact must NOT enter the
+        // embedding-fallback index — otherwise embedding recall surfaces the
+        // pending_review row (resurrection). Gate on postWriteGuard like the
+        // surrounding supersession / promotion / graph paths.
+        if (!postWriteGuard) {
+          await this.indexPersistedMemory(targetStorage, memoryId);
+        }
         // Faithfulness gate (#1576, chatgpt P2): skip promotion for a
         // pending_review fact so no active shared/profile copy bypasses the gate.
-        if (faithfulnessEnforceStatus !== "pending_review") await promoteMemoryToShared({
+        if (!postWriteGuard) await promoteMemoryToShared({
           sourceStorage: targetStorage,
           category: writeCategory,
           content: fact.content,
@@ -16260,7 +16331,7 @@ export class Orchestrator {
           ...(fact.provenance ? { provenance: fact.provenance } : {}),
         });
         // v8.2: graph edge building (fail-open). #1576: skip pending_review facts.
-        if (graphCaps.multiGraphMemory && faithfulnessEnforceStatus !== "pending_review") {
+        if (graphCaps.multiGraphMemory && !postWriteGuard) {
           try {
             const graphContext = await ensureGraphContext(targetStorage);
             const entityRef =
@@ -16304,7 +16375,7 @@ export class Orchestrator {
           this.config.verbatimArtifactsEnabled &&
           this.config.verbatimArtifactCategories.includes(writeCategory) &&
           fact.confidence >= this.config.verbatimArtifactsMinConfidence &&
-          faithfulnessEnforceStatus !== "pending_review"
+          !postWriteGuard
         ) {
           // Reuse citedFactContent so the artifact carries the same citation
           // timestamp as the memory write above (Fix #3 — duplicate-citation).
@@ -16331,7 +16402,11 @@ export class Orchestrator {
             writeCategory === "procedure"
               ? buildProcedurePersistBody(fact.content, fact.procedureSteps)
               : canonicalFactContent;
-          await this.addContentHashDedup(targetStorage, hashRegisterKey);
+          // #1645: do NOT register a tombstone-blocked fact's content in the dedup
+          // index (rule 44 defeat) — see chunked path comment.
+          if (!tombstoneBlocked) {
+            await this.addContentHashDedup(targetStorage, hashRegisterKey);
+          }
         } catch (err) {
           log.warn(
             `content-hash dedup registration failed for memory ${memoryId}: ${err}`,
@@ -16681,7 +16756,7 @@ export class Orchestrator {
     // Enabling only parallelRetrievalEnabled without queryAwareIndexingEnabled would silently
     // produce an empty temporal index, leaving the temporal agent with no data to work from.
     if (
-      !this.config.queryAwareIndexingEnabled &&
+      !resolveIndexingCapabilities(this.config).queryAwareIndexing &&
       !caps.parallelRetrieval
     )
       return;
@@ -16796,7 +16871,7 @@ export class Orchestrator {
 
     // Build a lookup map from the already-loaded corpus to avoid repeated
     // readAllMemories() scans inside getMemoryById for pre-action deindex reads.
-    const memoryLookup = this.config.queryAwareIndexingEnabled
+    const memoryLookup = resolveIndexingCapabilities(this.config).queryAwareIndexing
       ? new Map(allMemories.map((m) => [m.frontmatter.id, m]))
       : null;
 
@@ -16804,7 +16879,7 @@ export class Orchestrator {
       switch (item.action) {
         case "INVALIDATE": {
           // Capture path/frontmatter before invalidation for index cleanup
-          const toInvalidate = this.config.queryAwareIndexingEnabled
+          const toInvalidate = resolveIndexingCapabilities(this.config).queryAwareIndexing
             ? (memoryLookup?.get(item.existingId) ?? null)
             : null;
           if (await this.storage.invalidateMemory(item.existingId)) {
@@ -16852,7 +16927,7 @@ export class Orchestrator {
             // updateMemory() only changes content/updated/supersedes/lineage — path, created, and tags
             // are preserved, so the temporal/tag index entry for the survivor is already correct.
             // Capture before invalidation for index cleanup
-            const toMergeInvalidate = this.config.queryAwareIndexingEnabled
+            const toMergeInvalidate = resolveIndexingCapabilities(this.config).queryAwareIndexing
               ? (memoryLookup?.get(item.mergeWith) ?? null)
               : null;
             if (await this.storage.invalidateMemory(item.mergeWith)) {
@@ -16938,7 +17013,7 @@ export class Orchestrator {
     if (deletedCommitments.length > 0) {
       memoryItemMutated = true;
       log.info(`cleaned ${deletedCommitments.length} expired commitments`);
-      if (this.config.queryAwareIndexingEnabled) {
+      if (resolveIndexingCapabilities(this.config).queryAwareIndexing) {
         for (const m of deletedCommitments) {
           deindexMemory(
             this.config.memoryDir,
@@ -16951,9 +17026,9 @@ export class Orchestrator {
     }
 
     if (
-      this.config.creationMemoryEnabled &&
-      this.config.commitmentLedgerEnabled &&
-      this.config.commitmentLifecycleEnabled
+      resolveCreationMemoryCapabilities(this.config).creationMemory &&
+      resolveCreationMemoryCapabilities(this.config).commitmentLedger &&
+      resolveCreationMemoryCapabilities(this.config).commitmentLifecycle
     ) {
       try {
         const lifecycle = await applyCommitmentLedgerLifecycle({
@@ -16981,7 +17056,7 @@ export class Orchestrator {
     if (deletedTTL.length > 0) {
       memoryItemMutated = true;
       log.info(`cleaned ${deletedTTL.length} TTL-expired memories`);
-      if (this.config.queryAwareIndexingEnabled) {
+      if (resolveIndexingCapabilities(this.config).queryAwareIndexing) {
         for (const m of deletedTTL) {
           deindexMemory(
             this.config.memoryDir,
@@ -17259,347 +17334,26 @@ export class Orchestrator {
   async optimizeCompressionGuidelines(options?: {
     dryRun?: boolean;
     eventLimit?: number;
-  }): Promise<{
-    enabled: boolean;
-    dryRun: boolean;
-    eventCount: number;
-    previousGuidelineVersion: number | null;
-    nextGuidelineVersion: number;
-    changedRules: number;
-    semanticRefinementApplied: boolean;
-    persisted: boolean;
-    draftContentHash: string | null;
-  }> {
-    const dryRun = options?.dryRun === true;
-    const eventLimit =
-      typeof options?.eventLimit === "number"
-        ? Math.max(0, Math.floor(options.eventLimit))
-        : 500;
-
-    const [activeState, draftState] = await Promise.all([
-      this.storage.readCompressionGuidelineOptimizerState(),
-      this.storage.readCompressionGuidelineDraftState().catch(() => null),
-    ]);
-    const previousState =
-      draftState &&
-      ((activeState?.guidelineVersion ?? 0) < draftState.guidelineVersion ||
-        (activeState?.guidelineVersion ?? 0) === draftState.guidelineVersion)
-        ? draftState
-        : activeState;
-
-    if (!this.config.compressionGuidelineLearningEnabled) {
-      return {
-        enabled: false,
-        dryRun,
-        eventCount: 0,
-        previousGuidelineVersion: previousState?.guidelineVersion ?? null,
-        nextGuidelineVersion: previousState?.guidelineVersion ?? 0,
-        changedRules: 0,
-        semanticRefinementApplied: false,
-        persisted: false,
-        draftContentHash: null,
-      };
-    }
-
-    let events = await this.storage.readMemoryActionEvents(eventLimit);
-    if (eventLimit > 0) {
-      let effectiveEvents = events.filter((event) => event.dryRun !== true);
-      let fetchLimit = eventLimit;
-      while (
-        effectiveEvents.length < eventLimit &&
-        events.length === fetchLimit
-      ) {
-        fetchLimit = Math.min(fetchLimit * 2, fetchLimit + 1000);
-        if (fetchLimit <= events.length) break;
-        events = await this.storage.readMemoryActionEvents(fetchLimit);
-        effectiveEvents = events.filter((event) => event.dryRun !== true);
-      }
-      events = effectiveEvents.slice(-eventLimit);
-    }
-    const generatedAt = new Date().toISOString();
-    const candidate = computeCompressionGuidelineCandidate(events, {
-      generatedAtIso: generatedAt,
-      previousState,
-    });
-    if (candidate.eventCounts.total === 0) {
-      return {
-        enabled: true,
-        dryRun,
-        eventCount: 0,
-        previousGuidelineVersion: previousState?.guidelineVersion ?? null,
-        nextGuidelineVersion: previousState?.guidelineVersion ?? 0,
-        changedRules: 0,
-        semanticRefinementApplied: false,
-        persisted: false,
-        draftContentHash: null,
-      };
-    }
-    const refinedCandidate =
-      await refineCompressionGuidelineCandidateSemantically(candidate, {
-        enabled: this.config.compressionGuidelineSemanticRefinementEnabled,
-        timeoutMs: this.config.compressionGuidelineSemanticTimeoutMs,
-        runRefinement: async (baseline) => {
-          const prompt = [
-            "You refine compression policy suggestions conservatively.",
-            "Return JSON only in this shape:",
-            '{"updates":[{"action":"summarize_node","delta":0.02,"confidence":"medium","note":"..."}]}',
-            "Constraints:",
-            "- Keep updates sparse and conservative.",
-            "- delta must stay between -0.15 and 0.15.",
-            "- Only include actions present in the input.",
-            "Input candidate:",
-            JSON.stringify(baseline),
-          ].join("\n");
-
-          const response = await this.fastChatCompletion(
-            [
-              {
-                role: "system",
-                content: "Respond with strict JSON only. No markdown.",
-              },
-              { role: "user", content: prompt },
-            ],
-            {
-              temperature: 0.1,
-              maxTokens: 400,
-              operation: "compression_guideline_semantic_refinement",
-              priority: "background",
-            },
-          );
-
-          return this.parseCompressionSemanticRefinement(
-            response?.content ?? "",
-          );
-        },
-      });
-
-    const content = renderCompressionGuidelinesMarkdown(refinedCandidate);
-    const contentHash = createHash("sha256").update(content).digest("hex");
-    const semanticRefinementApplied =
-      JSON.stringify(refinedCandidate.ruleUpdates) !==
-      JSON.stringify(candidate.ruleUpdates);
-    const changedRules = refinedCandidate.ruleUpdates.filter(
-      (rule) => rule.delta !== 0,
-    ).length;
-
-    if (!dryRun) {
-      await this.storage.writeCompressionGuidelineDraft(content);
-      await this.storage.writeCompressionGuidelineDraftState({
-        version: refinedCandidate.optimizerVersion,
-        updatedAt: refinedCandidate.generatedAt,
-        sourceWindow: refinedCandidate.sourceWindow,
-        eventCounts: refinedCandidate.eventCounts,
-        guidelineVersion: refinedCandidate.guidelineVersion,
-        contentHash,
-        activationState: "draft",
-        actionSummaries: refinedCandidate.actionSummaries,
-        ruleUpdates: refinedCandidate.ruleUpdates,
-      });
-    }
-
-    return {
-      enabled: true,
-      dryRun,
-      eventCount: candidate.eventCounts.total,
-      previousGuidelineVersion: previousState?.guidelineVersion ?? null,
-      nextGuidelineVersion: refinedCandidate.guidelineVersion,
-      changedRules,
-      semanticRefinementApplied,
-      persisted: !dryRun,
-      draftContentHash: dryRun ? null : contentHash,
-    };
+  }) {
+    return this.compressionGuidelineCoordinator.optimizeCompressionGuidelines(options);
   }
 
   async activateCompressionGuidelineDraft(options?: {
     expectedContentHash?: string;
     expectedGuidelineVersion?: number;
-  }): Promise<{
-    enabled: boolean;
-    activated: boolean;
-    guidelineVersion: number | null;
-    reason?:
-      | "disabled"
-      | "missing_draft"
-      | "expected_revision_required"
-      | "content_hash_mismatch"
-      | "guideline_version_mismatch"
-      | "draft_changed";
-  }> {
-    if (!this.config.compressionGuidelineLearningEnabled) {
-      return {
-        enabled: false,
-        activated: false,
-        guidelineVersion: null,
-        reason: "disabled",
-      };
-    }
-
-    const draftState = await this.storage.readCompressionGuidelineDraftState();
-    if (!draftState) {
-      return {
-        enabled: true,
-        activated: false,
-        guidelineVersion: null,
-        reason: "missing_draft",
-      };
-    }
-
-    const expectedContentHash = options?.expectedContentHash?.trim();
-    const expectedGuidelineVersion = options?.expectedGuidelineVersion;
-
-    if (
-      (!expectedContentHash || expectedContentHash.length === 0) &&
-      typeof expectedGuidelineVersion !== "number"
-    ) {
-      return {
-        enabled: true,
-        activated: false,
-        guidelineVersion: null,
-        reason: "expected_revision_required",
-      };
-    }
-
-    if (expectedContentHash && draftState.contentHash !== expectedContentHash) {
-      return {
-        enabled: true,
-        activated: false,
-        guidelineVersion: null,
-        reason: "content_hash_mismatch",
-      };
-    }
-
-    if (
-      typeof expectedGuidelineVersion === "number" &&
-      draftState.guidelineVersion !== expectedGuidelineVersion
-    ) {
-      return {
-        enabled: true,
-        activated: false,
-        guidelineVersion: null,
-        reason: "guideline_version_mismatch",
-      };
-    }
-
-    const activated = await this.storage.activateCompressionGuidelineDraft({
-      ...(expectedContentHash ? { expectedContentHash } : {}),
-      ...(typeof expectedGuidelineVersion === "number"
-        ? { expectedGuidelineVersion }
-        : {}),
-    });
-    return {
-      enabled: true,
-      activated,
-      guidelineVersion: activated ? draftState.guidelineVersion : null,
-      ...(activated ? {} : { reason: "draft_changed" as const }),
-    };
+  }) {
+    return this.compressionGuidelineCoordinator.activateCompressionGuidelineDraft(options);
   }
 
+  // Issue #1526 (seam 4): compression-guideline learning moved to
+  // CompressionGuidelineCoordinator. Thin delegation keeps the
+  // consolidation-loop hook + recall-section hook call sites stable.
   private async runCompressionGuidelineLearningPass(): Promise<void> {
-    if (!this.config.compressionGuidelineLearningEnabled) return;
-    try {
-      const result = await this.optimizeCompressionGuidelines({
-        dryRun: false,
-        eventLimit: 500,
-      });
-      log.info(
-        `compression guideline learning updated (${result.eventCount} events)`,
-      );
-    } catch (err) {
-      log.warn(`compression guideline learning failed (ignored): ${err}`);
-    }
-  }
-
-  private async buildCompressionGuidelineRecallSection(): Promise<
-    string | null
-  > {
-    if (!this.config.contextCompressionActionsEnabled) return null;
-    if (!this.config.compressionGuidelineLearningEnabled) return null;
-
-    const state = await this.storage
-      .readCompressionGuidelineOptimizerState()
-      .catch(() => null);
-    if (!state || state.guidelineVersion <= 0) return null;
-
-    const raw = await this.storage
-      .readCompressionGuidelines()
-      .catch(() => null);
-    const summary = raw ? formatCompressionGuidelinesForRecall(raw, 5) : null;
-    if (!summary) return null;
-
-    return [
-      "## Active Compression Guidelines",
-      "",
-      `Guideline version: ${state.guidelineVersion}`,
-      `Updated: ${state.updatedAt}`,
-      "",
-      summary,
-    ].join("\n");
+    return this.compressionGuidelineCoordinator.runCompressionGuidelineLearningPass();
   }
 
-  private parseCompressionSemanticRefinement(raw: string): {
-    updates: Array<{
-      action: MemoryActionType;
-      delta?: number;
-      confidence?: "low" | "medium" | "high";
-      note?: string;
-    }>;
-  } | null {
-    if (typeof raw !== "string" || raw.trim().length === 0) return null;
-    const trimmed = raw.trim();
-    const start = trimmed.indexOf("{");
-    const end = trimmed.lastIndexOf("}");
-    if (start === -1 || end === -1 || end <= start) return null;
-
-    try {
-      const parsed = JSON.parse(trimmed.slice(start, end + 1)) as {
-        updates?: Array<{
-          action?: unknown;
-          delta?: unknown;
-          confidence?: unknown;
-          note?: unknown;
-        }>;
-      };
-      if (!Array.isArray(parsed?.updates)) return null;
-
-      const validActions = new Set<MemoryActionType>([
-        "store_episode",
-        "store_note",
-        "update_note",
-        "create_artifact",
-        "summarize_node",
-        "discard",
-        "link_graph",
-      ]);
-
-      const updates = parsed.updates
-        .filter(
-          (item) =>
-            item &&
-            typeof item.action === "string" &&
-            validActions.has(item.action as MemoryActionType),
-        )
-        .map((item) => {
-          const confidence: "low" | "medium" | "high" | undefined =
-            item.confidence === "low" ||
-            item.confidence === "medium" ||
-            item.confidence === "high"
-              ? item.confidence
-              : undefined;
-          return {
-            action: item.action as MemoryActionType,
-            delta:
-              typeof item.delta === "number" && Number.isFinite(item.delta)
-                ? item.delta
-                : undefined,
-            confidence,
-            note: typeof item.note === "string" ? item.note : undefined,
-          };
-        });
-
-      return { updates };
-    } catch {
-      return null;
-    }
+  private async buildCompressionGuidelineRecallSection(): Promise<string | null> {
+    return this.compressionGuidelineCoordinator.buildCompressionGuidelineRecallSection();
   }
 
   private actionOutcomePriorDelta(event: MemoryActionEvent): number {
@@ -17869,7 +17623,7 @@ export class Orchestrator {
         );
         await this.embeddingFallback.removeFromIndex(memory.frontmatter.id);
         if (
-          this.config.queryAwareIndexingEnabled &&
+          resolveIndexingCapabilities(this.config).queryAwareIndexing &&
           memory.path &&
           memory.frontmatter?.created
         ) {
@@ -20254,7 +20008,7 @@ export class Orchestrator {
     );
     let temporalFromDate: string | null = null;
     let promptTags: string[] = [];
-    if (this.config.queryAwareIndexingEnabled && prompt) {
+    if (resolveIndexingCapabilities(this.config).queryAwareIndexing && prompt) {
       if (isTemporalQuery(prompt)) {
         temporalFromDate = recencyWindowFromPrompt(prompt, now);
       }
@@ -20279,7 +20033,7 @@ export class Orchestrator {
     // Scope to result paths first so cross-namespace paths don't consume the cap.
     let temporalCandidates: Set<string> | null = null;
     let tagCandidates: Set<string> | null = null;
-    if (this.config.queryAwareIndexingEnabled && prompt) {
+    if (resolveIndexingCapabilities(this.config).queryAwareIndexing && prompt) {
       const maxCandidates = this.config.queryAwareIndexingMaxCandidates;
       const capSet = (s: Set<string> | null): Set<string> | null => {
         if (!s) return null;
@@ -20388,7 +20142,7 @@ export class Orchestrator {
 
         // v8.1: Temporal + Tag index boost
         // Results that match the detected temporal window or tag query get a small additive boost.
-        if (this.config.queryAwareIndexingEnabled && r.path) {
+        if (resolveIndexingCapabilities(this.config).queryAwareIndexing && r.path) {
           if (temporalCandidates?.has(r.path)) {
             score += applyUtilityRankingRuntimeDelta(
               0.08,
@@ -20625,15 +20379,13 @@ export class Orchestrator {
         }
 
         // The new fact is newer than the existing one. When auto-resolve is
-        // enabled, immediately retire the old memory. When disabled, leave the
-        // old memory active for manual review.
-        if (this.config.contradictionAutoResolve) {
-          await resultStorage.supersedeMemory(
-            existingMemory.frontmatter.id,
-            "pending-new", // Will be updated after the new memory is written
-            verification.reasoning,
-          );
-        }
+        // enabled, the caller retires the old memory AFTER the new write lands
+        // and its tombstone status is known (#1645: defer auto-resolve until
+        // tombstone status is known — a tombstone-blocked new write must not
+        // retire the only active copy, leaving neither memory active). When
+        // disabled, the old memory stays active for manual review. The
+        // contradiction info is returned in both cases so the caller can apply
+        // the deferred retire post-write.
 
         // Return the contradiction info regardless of auto-resolve setting.
         // The caller uses this to set `contradictionDetected=true` which
@@ -20656,6 +20408,71 @@ export class Orchestrator {
     return null;
   }
 
+  /**
+   * #1645: Complete the deferred contradiction auto-resolve after writeMemory
+   * returns and the new write's tombstone status is known. Retires the old
+   * memory + deindexes it ONLY when the new write is genuinely active (not
+   * tombstone-blocked / pending_review). A blocked write must not retire the
+   * only active copy — deferring here closes the "contradictionAutoResolve
+   * supersedes before tombstone status is known" defect class.
+   */
+  private async applyDeferredContradictionResolve(
+    contradiction: {
+      supersededId: string;
+      reason: string;
+      supersededPath: string;
+      supersededCreated: string;
+      supersededTags: string[];
+    } | null | undefined,
+    storage: StorageManager,
+    newMemoryId: string,
+    postWriteGuard: boolean,
+  ): Promise<void> {
+    // #1645 yG2: clear the pre-write `supersedes` link from a blocked row so
+    // it doesn't claim to supersede a still-active memory (best-effort).
+    if (postWriteGuard && contradiction && this.config.contradictionAutoResolve) {
+      try {
+        const blockedRow = await storage.getMemoryById(newMemoryId);
+        if (blockedRow?.frontmatter?.supersedes) {
+          await storage.writeMemoryFrontmatter(blockedRow, { supersedes: undefined });
+        }
+      } catch (err) {
+        log.warn(
+          `contradiction auto-resolve supersedes clear failed for blocked ${newMemoryId}: ${err}`,
+        );
+      }
+    }
+    if (
+      !contradiction ||
+      !this.config.contradictionAutoResolve ||
+      postWriteGuard
+    ) {
+      return;
+    }
+    try {
+      await storage.supersedeMemory(
+        contradiction.supersededId,
+        newMemoryId,
+        contradiction.reason,
+      );
+      if (
+        resolveIndexingCapabilities(this.config).queryAwareIndexing &&
+        contradiction.supersededPath
+      ) {
+        deindexMemory(
+          this.config.memoryDir,
+          contradiction.supersededPath,
+          contradiction.supersededCreated,
+          contradiction.supersededTags,
+        );
+      }
+    } catch (err) {
+      log.warn(
+        `contradiction auto-resolve supersede failed for ${contradiction.supersededId}: ${err}`,
+      );
+    }
+  }
+
   // ---------------------------------------------------------------------------
   // Memory Linking (Phase 3A)
   // ---------------------------------------------------------------------------