@remnic/core 9.45.3 → 9.45.4

package/dist/{chunk-E6PNLPGJ.js → chunk-FZP32336.js}

@@ -15,6 +15,9 @@ import {
   buildRetiredFactTombstoneInputs,
   collectRetiredMemoriesForRebuild
 } from "./chunk-ENTCVTQR.js";
+import {
+  withholdToolScopedFromSharedNamespace
+} from "./chunk-S2V7RUCL.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitation,
@@ -23,28 +26,7 @@ import {
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-J7VGGECD.js";
-import {
-  ProjectionLedgerLagManager,
-  appendLifecycleEventsSerialized,
-  drainPendingLifecycleLedgerForSync,
-  drainPendingLifecycleLedgerIfAny,
-  formatProjectionAge,
-  readAllLifecycleEventsFromLedger,
-  readAllLifecycleEventsFromLedgerBuffer,
-  readBoundedLifecycleEventsFromLedger,
-  readMaybeEncryptedLines,
-  readMemoryActionEventRowsFromLines,
-  readProjectionRebuiltAt,
-  serializeLifecycleAppendPayload
-} from "./chunk-WUNIWKY4.js";
-import {
-  namespaceIdentityFromToken
-} from "./chunk-EGGE52UU.js";
-import {
-  assertMemoryFrontmatterId,
-  warnProjectionFallback
-} from "./chunk-ZA53AZND.js";
+} from "./chunk-DZPFMQZ7.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -53,15 +35,6 @@ import {
   rewriteProjectedEntityReferences,
   rewriteProjectedMemoryEntityReference
 } from "./chunk-WRJVB3C2.js";
-import {
-  assertPathInsideRoot,
-  pathIsInside
-} from "./chunk-GCASGYIO.js";
-import {
-  inferMemoryStatus,
-  isArchivedMemoryPath,
-  toMemoryPathRel
-} from "./chunk-7RJUVTVF.js";
 import {
   rotateMarkdownFileToArchive
 } from "./chunk-DM2T26WE.js";
@@ -80,14 +53,12 @@ import {
 } from "./chunk-JYIJNNN3.js";
 import {
   TombstoneBlockedCaptureIndexHost,
+  buildCapturePathLockIdentity,
   buildExplicitCaptureDedupKey,
-  parseTombstoneBlockedOfflineSyncMemory
-} from "./chunk-RVLJEII5.js";
-import {
-  CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
-  ContentHashIndex,
-  FactHashIndexNotAuthoritativeError
-} from "./chunk-S5SLVSVY.js";
+  isQueuedReviewMemory,
+  parseTombstoneBlockedOfflineSyncMemory,
+  tombstoneBlocked
+} from "./chunk-SYUBB3WM.js";
 import {
   composeMemoryEnvelope,
   isSealedMemoryEnvelope,
@@ -97,14 +68,6 @@ import {
   assemblePersistedBody,
   stripAttributesSuffix
 } from "./chunk-R3DJVOSM.js";
-import {
-  markProjectedMemoryPathInvalid,
-  readProjectedGovernanceRecord,
-  readProjectedMemoryBrowse,
-  readProjectedMemoryState,
-  readProjectedMemoryTimeline,
-  updateProjectedMemoryPath
-} from "./chunk-3CSX3ETE.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -114,7 +77,7 @@ import {
 } from "./chunk-G7D6GZ5J.js";
 import {
   createVersion
-} from "./chunk-DLVPUX7U.js";
+} from "./chunk-7YKVM5H3.js";
 import {
   clearInFlightReads,
   deleteInFlightRead,
@@ -128,21 +91,20 @@ import {
   ENTITY_CANONICAL_ID_RECONCILE_MARKER,
   HistoricalEntityCanonicalIdCache,
   appendCanonicalizedTombstone,
+  assertSafeEntityId,
+  canonicalizeEntityRefFrontmatter,
   canonicalizeEntityRefOption,
   reconcileIfJournalMovedSync,
   repairEntityRefAfterJournalMove,
   requestEntityCanonicalIdReconcileSync,
   resolveHistoricalEntityCanonicalId,
   withEntityCanonicalMutationLock
-} from "./chunk-4J7G5SY4.js";
+} from "./chunk-NZBZ7IS2.js";
 import {
   computeSupersessionKey,
   normalizeSupersessionKey,
   supersessionKeysForFact
 } from "./chunk-DNHVPZOD.js";
-import {
-  withHeldFileLock
-} from "./chunk-FFAZ2XFU.js";
 import {
   clearMemoryCache,
   getCachedEntities,
@@ -161,15 +123,61 @@ import {
   parseProvenanceTag,
   reconcileProvenanceRead,
   serializeProvenanceFields
-} from "./chunk-5I4M26Q7.js";
+} from "./chunk-QBSFOKY6.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
 import {
   matchEntitySchemaSection,
   normalizeEntityStructuredSection,
   sortStructuredSectionsBySchema
 } from "./chunk-ZIKENA2C.js";
 import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
+  ProjectionLedgerLagManager,
+  appendLifecycleEventsSerialized,
+  drainPendingLifecycleLedgerForSync,
+  drainPendingLifecycleLedgerIfAny,
+  formatProjectionAge,
+  readAllLifecycleEventsFromLedger,
+  readAllLifecycleEventsFromLedgerBuffer,
+  readBoundedLifecycleEventsFromLedger,
+  readMaybeEncryptedLines,
+  readMemoryActionEventRowsFromLines,
+  readProjectionRebuiltAt,
+  serializeLifecycleAppendPayload
+} from "./chunk-ELIL2A37.js";
+import {
+  namespaceIdentityFromToken
+} from "./chunk-EGGE52UU.js";
+import {
+  assertMemoryFrontmatterId,
+  warnProjectionFallback
+} from "./chunk-ZA53AZND.js";
+import {
+  inferMemoryStatus,
+  isArchivedMemoryPath,
+  toMemoryPathRel
+} from "./chunk-7RJUVTVF.js";
+import {
+  assertPathInsideRoot,
+  pathIsInside
+} from "./chunk-GCASGYIO.js";
+import {
+  CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
+  ContentHashIndex,
+  FactHashIndexNotAuthoritativeError
+} from "./chunk-BQIFZ2MP.js";
+import {
+  markProjectedMemoryPathInvalid,
+  readProjectedGovernanceRecord,
+  readProjectedMemoryBrowse,
+  readProjectedMemoryState,
+  readProjectedMemoryTimeline,
+  updateProjectedMemoryPath
+} from "./chunk-3CSX3ETE.js";
+import {
+  withHeldFileLock
+} from "./chunk-FFAZ2XFU.js";
 import {
   parseFlexibleIsoTimestamp
 } from "./chunk-P7FMDTKL.js";
@@ -187,7 +195,7 @@ import {
   readMaybeEncryptedFile,
   readMaybeEncryptedFileBuffer,
   writeMaybeEncryptedFile
-} from "./chunk-5TFP4CUL.js";
+} from "./chunk-XQ3HXAQH.js";
 import {
   isErrnoCode
 } from "./chunk-5UZXUTVO.js";
@@ -206,6 +214,7 @@ import {
   readdir as readdir5,
   readFile as readFile2,
   realpath as realpath3,
+  rename as rename2,
   stat as stat2,
   writeFile as writeFile2,
   mkdir,
@@ -213,26 +222,22 @@ import {
   appendFile,
   open
 } from "fs/promises";
-import { appendFileSync, createReadStream, mkdirSync, readFileSync, statSync } from "fs";
-import { createHash as createHash5 } from "crypto";
-import path8 from "path";
+import { appendFileSync, createReadStream, mkdirSync, statSync } from "fs";
+import { createHash as createHash6, randomUUID as randomUUID2 } from "crypto";
+import path9 from "path";
 
 // src/storage/memory-read-store.ts
 import { lstat, readdir, realpath, stat } from "fs/promises";
 import path from "path";
 
 // src/storage/memory-frontmatter-metadata.ts
-var rawFrontmatterByMemory = /* @__PURE__ */ new WeakMap();
-function extractRawFrontmatter(raw) {
-  return raw.match(/^---\n([\s\S]*?)\n---\n?/)?.[1] ?? null;
-}
+var rawDocumentByMemory = /* @__PURE__ */ new WeakMap();
 function rememberRawFrontmatter(owner, raw) {
-  const frontmatter = extractRawFrontmatter(raw);
-  if (frontmatter !== null) rawFrontmatterByMemory.set(owner, frontmatter);
+  if (/^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/.test(raw)) rawDocumentByMemory.set(owner, raw);
   return owner;
 }
-function readRawFrontmatter(owner) {
-  return rawFrontmatterByMemory.get(owner);
+function readRawMemoryDocument(owner) {
+  return rawDocumentByMemory.get(owner);
 }
 
 // src/storage/memory-read-store.ts
@@ -1718,8 +1723,11 @@ var EntityStore = class {
    */
   async readAllEntityFiles() {
     const currentVersion = this.deps.getMemoryStatusVersion();
-    const schemaCacheKey = buildEntitySchemaCacheKey(this.deps.entitySchemas);
-    const cacheKey = `${this.deps.getEntityCacheSecureStoreKey()}\0${schemaCacheKey}`;
+    const cacheKey = [
+      this.deps.getEntityCacheSecureStoreKey(),
+      buildEntitySchemaCacheKey(this.deps.entitySchemas),
+      this.deps.getEntityMutationVersion()
+    ].join("\0");
     const cached = getCachedEntities(this.deps.baseDir, currentVersion, cacheKey);
     if (cached) return cached;
     try {
@@ -2161,7 +2169,7 @@ var IdentityContinuityStore = class {
 };
 
 // src/storage/entity-canonical-id-migration.ts
-import { randomUUID } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import {
   access,
   lstat as lstat2,
@@ -2204,16 +2212,50 @@ async function fingerprintPath(filePath) {
   }
   return fileStat ? `${fileStat.dev}:${fileStat.ino}:${fileStat.mtimeMs}:${fileStat.ctimeMs}:${fileStat.size}` : "missing";
 }
+async function fingerprintEntityEntries(entitiesDir) {
+  let names;
+  try {
+    names = (await readdir4(entitiesDir)).filter((name) => path4.extname(name) === ".md").sort();
+  } catch (error) {
+    if (isErrnoCode(error, "ENOENT")) return "missing";
+    throw error;
+  }
+  const hash = createHash("sha256");
+  for (const name of names) {
+    hash.update(`${name.length}:${name}:`);
+    try {
+      const entry = await lstat2(path4.join(entitiesDir, name), { bigint: true });
+      hash.update(`${entry.dev}:${entry.ino}:${entry.size}:${entry.mtimeNs}:${entry.ctimeNs}`);
+    } catch (error) {
+      if (!isErrnoCode(error, "ENOENT")) throw error;
+      hash.update("missing");
+    }
+    hash.update("\n");
+  }
+  return hash.digest("hex");
+}
 async function getFingerprint(baseDir, entitiesDir, getEntityMutationVersion) {
-  const [entityFingerprint, aliasFingerprint, reconcileFingerprint, consumingFingerprint] = await Promise.all([
+  const [
+    entityDirectoryFingerprint,
+    entityEntriesFingerprint,
+    aliasFingerprint,
+    reconcileFingerprint,
+    consumingFingerprint
+  ] = await Promise.all([
     fingerprintPath(entitiesDir),
+    fingerprintEntityEntries(entitiesDir),
     fingerprintPath(path4.join(baseDir, "config", "aliases.json")),
     fingerprintPath(path4.join(baseDir, "state", ENTITY_CANONICAL_ID_RECONCILE_MARKER)),
-    // A `.consuming` generation stranded by a crashed PEER process must also
-    // re-invoke a live runner whose cached fingerprint predates it.
     fingerprintPath(path4.join(baseDir, "state", ENTITY_CANONICAL_ID_RECONCILE_CONSUMING_MARKER))
   ]);
-  return [entityFingerprint, aliasFingerprint, reconcileFingerprint, consumingFingerprint, getEntityMutationVersion()].join(":");
+  return [
+    entityDirectoryFingerprint,
+    entityEntriesFingerprint,
+    aliasFingerprint,
+    reconcileFingerprint,
+    consumingFingerprint,
+    getEntityMutationVersion()
+  ].join(":");
 }
 async function validateRoots(baseDir, entitiesDir, stateDir, archiveDir) {
   let baseStat;
@@ -2311,6 +2353,12 @@ async function readState(deps) {
   }
   const result = EntityCanonicalIdMigrationStateSchema.safeParse(parsed);
   if (!result.success) throw new Error("Invalid entity canonical-id migration state.");
+  for (const mappings of [result.data.mappings, result.data.blocked ?? {}]) {
+    for (const [legacyId, canonicalId] of Object.entries(mappings)) {
+      assertSafeEntityId(legacyId);
+      assertSafeEntityId(canonicalId);
+    }
+  }
   return result.data;
 }
 async function writeState(deps, state) {
@@ -2347,11 +2395,6 @@ async function sameFileIdentity(leftPath, rightPath) {
     throw error;
   }
 }
-function assertSafeEntityId(entityId) {
-  if (/[\/\\\0]/.test(entityId)) {
-    throw new Error(`Refusing entity canonical-id migration through unsafe entity id: ${entityId}.`);
-  }
-}
 async function assertNotSymlink(filePath, label) {
   let stat3;
   try {
@@ -3137,25 +3180,14 @@ var EntityCanonicalIdMigrationRunner = class {
 
 // src/storage/memory-migration-serialization.ts
 function serializeMemoryWithEntityRef(memory, entityRef, fallback) {
-  const rawFrontmatter = readRawFrontmatter(memory);
-  if (rawFrontmatter === void 0) return fallback(memory, entityRef);
-  const lines = rawFrontmatter.split("\n");
-  let entityRefLine = -1;
-  for (let index = 0; index < lines.length; index += 1) {
-    if (/^\s*entityRef\s*:/.test(lines[index] ?? "")) entityRefLine = index;
-  }
-  if (entityRefLine >= 0) {
-    const indent = lines[entityRefLine].match(/^\s*/)?.[0] ?? "";
-    lines[entityRefLine] = `${indent}entityRef: ${entityRef}`;
-  } else {
-    lines.push(`entityRef: ${entityRef}`);
-  }
-  return `---
-${lines.join("\n")}
----
-
-${memory.content}
-`;
+  const rawDocument = readRawMemoryDocument(memory);
+  if (rawDocument === void 0) return fallback(memory, entityRef);
+  const currentEntityRef = memory.frontmatter.entityRef;
+  if (currentEntityRef === void 0) return fallback(memory, entityRef);
+  if (currentEntityRef === entityRef) return rawDocument;
+  const rewritten = canonicalizeEntityRefFrontmatter(rawDocument, { [currentEntityRef]: entityRef });
+  if (rewritten !== rawDocument) return rewritten;
+  return fallback(memory, entityRef);
 }
 function createMemoryEntityRefSerializer(serializeFrontmatter2) {
   return (memory, entityRef) => serializeMemoryWithEntityRef(
@@ -3168,6 +3200,90 @@ ${fallbackMemory.content}
   );
 }
 
+// src/storage/entity-alias-config.ts
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  realpathSync
+} from "fs";
+import path5 from "path";
+function resolveSafeAliasRoots(baseDir, configDir) {
+  let baseStat;
+  try {
+    baseStat = lstatSync(baseDir);
+  } catch (error) {
+    if (isErrnoCode(error, "ENOENT")) return void 0;
+    throw error;
+  }
+  if (baseStat.isSymbolicLink() || !baseStat.isDirectory()) {
+    throw new Error(`Refusing unsafe entity alias memory root: ${baseDir}.`);
+  }
+  let configStat;
+  try {
+    configStat = lstatSync(configDir);
+  } catch (error) {
+    if (isErrnoCode(error, "ENOENT")) return void 0;
+    throw error;
+  }
+  if (configStat.isSymbolicLink() || !configStat.isDirectory()) {
+    throw new Error(`Refusing unsafe entity alias config root: ${configDir}.`);
+  }
+  const memoryRoot = realpathSync(baseDir);
+  assertPathInsideRoot(memoryRoot, realpathSync(configDir), configDir);
+  return memoryRoot;
+}
+function readEntityAliasConfigSync(baseDir) {
+  const configDir = path5.join(baseDir, "config");
+  const aliasPath = path5.join(configDir, "aliases.json");
+  let memoryRoot = resolveSafeAliasRoots(baseDir, configDir);
+  if (memoryRoot === void 0) return void 0;
+  let aliasPreflight;
+  try {
+    aliasPreflight = lstatSync(aliasPath);
+  } catch (error) {
+    if (isErrnoCode(error, "ENOENT")) return void 0;
+    throw error;
+  }
+  if (aliasPreflight.isSymbolicLink() || !aliasPreflight.isFile()) {
+    throw new Error(`Refusing unsafe entity alias config file: ${aliasPath}.`);
+  }
+  let fd;
+  try {
+    fd = openSync(
+      aliasPath,
+      constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0)
+    );
+  } catch (error) {
+    if (isErrnoCode(error, "ENOENT")) {
+      resolveSafeAliasRoots(baseDir, configDir);
+      return void 0;
+    }
+    if (isErrnoCode(error, "ELOOP")) {
+      throw new Error(`Refusing unsafe entity alias config file: ${aliasPath}.`);
+    }
+    throw error;
+  }
+  try {
+    const opened = fstatSync(fd);
+    memoryRoot = resolveSafeAliasRoots(baseDir, configDir);
+    if (memoryRoot === void 0) {
+      throw new Error(`Refusing unsafe entity alias config root: ${configDir}.`);
+    }
+    const aliasStat = lstatSync(aliasPath);
+    if (!opened.isFile() || aliasStat.isSymbolicLink() || !aliasStat.isFile() || aliasStat.dev !== opened.dev || aliasStat.ino !== opened.ino) {
+      throw new Error(`Refusing unsafe entity alias config file: ${aliasPath}.`);
+    }
+    assertPathInsideRoot(memoryRoot, realpathSync(aliasPath), aliasPath);
+    return readFileSync(fd, "utf-8");
+  } finally {
+    closeSync(fd);
+  }
+}
+
 // src/utils/yaml-scalar.ts
 function decodeYamlScalar(value) {
   const trimmed = value.trim();
@@ -3183,9 +3299,9 @@ function decodeYamlScalar(value) {
 }
 
 // src/orchestration/qmd-result-resolver.ts
-import path5 from "path";
+import path6 from "path";
 function qmdCollectionPathParts(resultPath) {
-  if (!resultPath || path5.isAbsolute(resultPath)) return null;
+  if (!resultPath || path6.isAbsolute(resultPath)) return null;
   const normalized = resultPath.replace(/\\/g, "/").replace(/^\/+/, "");
   const slashIndex = normalized.indexOf("/");
   if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return null;
@@ -3198,9 +3314,9 @@ function qmdCollectionPathParts(resultPath) {
 }
 function qmdResultPathCandidates(storageDir, resultPath) {
   const candidates = /* @__PURE__ */ new Set();
-  const storageRoot = path5.resolve(storageDir);
+  const storageRoot = path6.resolve(storageDir);
   const addCandidate = (candidate) => {
-    const resolved = path5.resolve(candidate);
+    const resolved = path6.resolve(candidate);
     if (isPathInsideStorageRoot(storageRoot, resolved)) {
       candidates.add(resolved);
     }
@@ -3208,18 +3324,18 @@ function qmdResultPathCandidates(storageDir, resultPath) {
   const addRelativeCandidates = (relativePath) => {
     const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
     if (!normalized) return;
-    addCandidate(path5.join(storageRoot, normalized));
+    addCandidate(path6.join(storageRoot, normalized));
     if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
-      addCandidate(path5.join(storageRoot, "facts", normalized));
+      addCandidate(path6.join(storageRoot, "facts", normalized));
     }
   };
-  if (path5.isAbsolute(resultPath)) {
+  if (path6.isAbsolute(resultPath)) {
     addCandidate(resultPath);
-    const relative2 = path5.relative(storageRoot, path5.resolve(resultPath));
-    if (relative2 && !relative2.startsWith("..") && !path5.isAbsolute(relative2)) {
-      const normalized = relative2.split(path5.sep).join("/");
+    const relative2 = path6.relative(storageRoot, path6.resolve(resultPath));
+    if (relative2 && !relative2.startsWith("..") && !path6.isAbsolute(relative2)) {
+      const normalized = relative2.split(path6.sep).join("/");
       if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
-        addCandidate(path5.join(storageRoot, "facts", normalized));
+        addCandidate(path6.join(storageRoot, "facts", normalized));
       }
     }
   } else {
@@ -3254,7 +3370,7 @@ var QmdResultResolver = class {
       const seenStorageDirs = /* @__PURE__ */ new Set();
       const addStorage = (storage) => {
         const storageDir = storageDirOrNull(storage);
-        const storageKey = storageDir ? path5.resolve(storageDir) : `storage-without-dir-${storages.length}`;
+        const storageKey = storageDir ? path6.resolve(storageDir) : `storage-without-dir-${storages.length}`;
         if (seenStorageDirs.has(storageKey)) return;
         seenStorageDirs.add(storageKey);
         storages.push(storage);
@@ -3284,7 +3400,7 @@ var QmdResultResolver = class {
           continue;
         }
         try {
-          const coldRoot = path5.join(storageDir, "cold");
+          const coldRoot = path6.join(storageDir, "cold");
           for (const candidate of qmdResultPathCandidates(
             coldRoot,
             parts.relativePath
@@ -3343,9 +3459,9 @@ var QmdResultResolver = class {
           error: err.message
         });
       }
-      if (!path5.isAbsolute(resultPath)) return null;
+      if (!path6.isAbsolute(resultPath)) return null;
     }
-    if (path5.isAbsolute(resultPath)) {
+    if (path6.isAbsolute(resultPath)) {
       if (!fallbackStorageDir) {
         return await fallbackStorage.readMemoryByPath(resultPath);
       }
@@ -3385,7 +3501,7 @@ var QmdResultResolver = class {
     );
     if (!memory) return null;
     let ownerNamespace = null;
-    if (path5.isAbsolute(memory.path)) {
+    if (path6.isAbsolute(memory.path)) {
       const ownerStorage = await this.storageForAbsoluteQmdResultPath(
         memory.path,
         fallbackStorage,
@@ -3409,17 +3525,17 @@ var QmdResultResolver = class {
     };
   }
   async storageForAbsoluteQmdResultPath(resultPath, fallbackStorage, recallNamespaces = []) {
-    const resolvedPath = path5.resolve(resultPath);
+    const resolvedPath = path6.resolve(resultPath);
     const config = this.getConfig();
-    const memoryRoot = path5.resolve(config.memoryDir);
-    const namespacesRoot = path5.join(memoryRoot, "namespaces");
+    const memoryRoot = path6.resolve(config.memoryDir);
+    const namespacesRoot = path6.join(memoryRoot, "namespaces");
     const fallbackStorageDir = storageDirOrNull(fallbackStorage);
     const matches = [];
     const seenDirs = /* @__PURE__ */ new Set();
     const maybeAddStorage = (storage, namespace) => {
       const storageDir = storageDirOrNull(storage);
       if (!storageDir) return;
-      const candidateRoot = path5.resolve(storageDir);
+      const candidateRoot = path6.resolve(storageDir);
       if (seenDirs.has(candidateRoot)) return;
       if (!isPathInsideStorageRoot(candidateRoot, resolvedPath)) return;
       if (candidateRoot === memoryRoot && isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
@@ -3437,7 +3553,7 @@ var QmdResultResolver = class {
       candidateNamespaces.add(ns);
     }
     if (isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
-      const relativeToNamespaces = path5.relative(namespacesRoot, resolvedPath);
+      const relativeToNamespaces = path6.relative(namespacesRoot, resolvedPath);
       const [namespaceSegment] = relativeToNamespaces.split(/[\\/]/);
       if (namespaceSegment) {
         candidateNamespaces.add(
@@ -3981,7 +4097,7 @@ function collectSpeakers(tagged) {
 }
 
 // src/wearables/fusion/fuse.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var FUSION_ID_PREFIX = "fusion";
 var FUSION_ALGO_VERSION = "2026-07-12-1";
 function canonicalInputsKey(date, inputs) {
@@ -4010,7 +4126,7 @@ function canonicalInputsKey(date, inputs) {
       ])
     ])
   ];
-  return createHash("sha256").update(JSON.stringify(record), "utf-8").digest("hex");
+  return createHash2("sha256").update(JSON.stringify(record), "utf-8").digest("hex");
 }
 function configFingerprint(options, sources) {
   const proximityGapMs = options.proximityGapMs ?? DEFAULT_PROXIMITY_GAP_MS;
@@ -4025,7 +4141,7 @@ function canonicalDayKey(date, inputs, options, algoVersion = FUSION_ALGO_VERSIO
     options,
     inputs.map((conv) => conv.source)
   );
-  return createHash("sha256").update(inputsKey).update("\n").update(fingerprint).update("\n").update(algoVersion).digest("hex");
+  return createHash2("sha256").update(inputsKey).update("\n").update(fingerprint).update("\n").update(algoVersion).digest("hex");
 }
 function buildProvenance(cluster, proximityGapMs, windowToleranceMs) {
   return {
@@ -4085,11 +4201,11 @@ function fuseDay(date, inputs, options = {}) {
 }
 
 // src/wearables/fusion/store.ts
-import { createHash as createHash2 } from "crypto";
-import * as path6 from "path";
+import { createHash as createHash3 } from "crypto";
+import * as path7 from "path";
 var FUSION_KIND = "wearable-fusion";
 function hashFusionBody(conversations) {
-  return createHash2("sha256").update(JSON.stringify(conversations), "utf-8").digest("hex");
+  return createHash3("sha256").update(JSON.stringify(conversations), "utf-8").digest("hex");
 }
 function composeFusionDayMeta(date, conversations, sources, contentHash, fusedAt) {
   return {
@@ -4273,7 +4389,7 @@ var FusionArtifactStore = class {
         `invalid wearable fusion date '${String(date)}' \u2014 expected YYYY-MM-DD`
       );
     }
-    return path6.join(this.wearablesDir, FUSION_DIR_NAME, `${date}.md`);
+    return path7.join(this.wearablesDir, FUSION_DIR_NAME, `${date}.md`);
   }
   async writeFusedDay(date, serialized) {
     const filePath = this.fusedDayPath(date);
@@ -4310,7 +4426,7 @@ var FusionArtifactStore = class {
   }
   /** List dates with stored fused artifacts, newest first. */
   async listFusedDays() {
-    const fusionDir = path6.join(this.wearablesDir, FUSION_DIR_NAME);
+    const fusionDir = path7.join(this.wearablesDir, FUSION_DIR_NAME);
     await this.assertPathContained(fusionDir);
     let entries;
     try {
@@ -4354,10 +4470,10 @@ var FusionArtifactStore = class {
     try {
       rootReal = await this.io.realpath(this.memoryDir);
     } catch {
-      rootReal = path6.resolve(this.memoryDir);
+      rootReal = path7.resolve(this.memoryDir);
     }
     await this.assertNoEscape(rootReal, this.wearablesDir);
-    await this.assertNoEscape(rootReal, path6.dirname(targetPath));
+    await this.assertNoEscape(rootReal, path7.dirname(targetPath));
     await this.assertNoEscape(rootReal, targetPath);
     await this.assertFusionDirNotSymlinked();
   }
@@ -4371,7 +4487,7 @@ var FusionArtifactStore = class {
    * (a fresh write creates a real directory lexically under the root).
    */
   async assertFusionDirNotSymlinked() {
-    const fusionDir = path6.join(this.wearablesDir, FUSION_DIR_NAME);
+    const fusionDir = path7.join(this.wearablesDir, FUSION_DIR_NAME);
     let stat3;
     try {
       stat3 = await this.io.lstat(fusionDir);
@@ -4506,8 +4622,8 @@ function reconstructFusionInputs(date, dayTranscripts) {
 }
 
 // src/meetings/store.ts
-import { createHash as createHash3 } from "crypto";
-import * as path7 from "path";
+import { createHash as createHash4 } from "crypto";
+import * as path8 from "path";
 var MEETINGS_DIR_NAME = "meetings";
 var MEETING_KIND = "meeting";
 var MEETING_FORMAT_VERSION = 1;
@@ -4537,7 +4653,7 @@ function canonicalContent(base, fused) {
   });
 }
 function composeMeetingRecord(base, fused) {
-  const contentHash = createHash3("sha256").update(canonicalContent(base, fused), "utf-8").digest("hex");
+  const contentHash = createHash4("sha256").update(canonicalContent(base, fused), "utf-8").digest("hex");
   return {
     ...base,
     ...fused,
@@ -4676,7 +4792,7 @@ var MeetingRecordStore = class {
   constructor(memoryDir, io) {
     this.memoryDir = memoryDir;
     this.io = io;
-    this.meetingsDir = path7.join(memoryDir, MEETINGS_DIR_NAME);
+    this.meetingsDir = path8.join(memoryDir, MEETINGS_DIR_NAME);
   }
   memoryDir;
   io;
@@ -4692,7 +4808,7 @@ var MeetingRecordStore = class {
     if (idDate !== date) {
       throw new Error(`meeting id '${id}' does not belong to date '${date}'`);
     }
-    return path7.join(this.meetingsDir, date, `${id}.md`);
+    return path8.join(this.meetingsDir, date, `${id}.md`);
   }
   /** Idempotently persist a record: skip the write when contentHash is unchanged. */
   async saveMeetingRecord(record) {
@@ -4723,7 +4839,7 @@ var MeetingRecordStore = class {
     if (!isValidTranscriptDate(date)) {
       throw new Error(`invalid meeting date '${String(date)}' \u2014 expected YYYY-MM-DD`);
     }
-    const dayDir = path7.join(this.meetingsDir, date);
+    const dayDir = path8.join(this.meetingsDir, date);
     await this.assertPathContained(dayDir);
     let entries;
     try {
@@ -4791,10 +4907,10 @@ var MeetingRecordStore = class {
     try {
       rootReal = await this.io.realpath(this.memoryDir);
     } catch {
-      rootReal = path7.resolve(this.memoryDir);
+      rootReal = path8.resolve(this.memoryDir);
     }
     await this.assertNoEscape(rootReal, this.meetingsDir);
-    await this.assertNoEscape(rootReal, path7.dirname(targetPath));
+    await this.assertNoEscape(rootReal, path8.dirname(targetPath));
     await this.assertNoEscape(rootReal, targetPath);
     await this.assertNotSymlink(this.meetingsDir, "directory");
     const dayDir = this.dayDirWithin(targetPath);
@@ -4804,11 +4920,11 @@ var MeetingRecordStore = class {
   /** The `<meetings>/<date>` directory on the path to `targetPath`, or null when
    *  `targetPath` is the meetings root itself. */
   dayDirWithin(targetPath) {
-    const rel = path7.relative(this.meetingsDir, targetPath);
-    if (rel === "" || rel.startsWith("..") || path7.isAbsolute(rel)) return null;
-    const first = rel.split(path7.sep)[0];
+    const rel = path8.relative(this.meetingsDir, targetPath);
+    if (rel === "" || rel.startsWith("..") || path8.isAbsolute(rel)) return null;
+    const first = rel.split(path8.sep)[0];
     if (first === void 0 || first.length === 0) return null;
-    return path7.join(this.meetingsDir, first);
+    return path8.join(this.meetingsDir, first);
   }
   async assertNotSymlink(target, kind) {
     let stat3;
@@ -4819,7 +4935,7 @@ var MeetingRecordStore = class {
       throw err;
     }
     if (stat3.isSymbolicLink) {
-      const label = path7.relative(this.memoryDir, target) || MEETINGS_DIR_NAME;
+      const label = path8.relative(this.memoryDir, target) || MEETINGS_DIR_NAME;
       throw new Error(
         `meetings ${kind} '${label}' is a symbolic link \u2014 refusing to follow it even when it resolves inside the memory dir (AGENTS.md pattern #3)`
       );
@@ -4923,7 +5039,7 @@ function stripCitationMarkersForHashRemoval(value, template) {
 }
 
 // src/storage/entity-timeline.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function parseEntityTimelineBullet(bullet, fallbackTimestamp) {
   const trimmed = bullet.trim();
   if (!trimmed) return null;
@@ -5295,7 +5411,7 @@ function fingerprintEntityStructuredFacts(entity) {
     (left, right) => left.key.localeCompare(right.key) || left.title.localeCompare(right.title) || left.facts.join("\n").localeCompare(right.facts.join("\n"))
   );
   if (normalizedSections.length === 0) return void 0;
-  return createHash4("sha256").update(JSON.stringify(normalizedSections)).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(normalizedSections)).digest("hex");
 }
 function isEntitySynthesisStale(entity) {
   const structuredFactCount = countEntityStructuredFacts(entity);
@@ -5346,6 +5462,15 @@ var ARTIFACT_SEARCH_STOPWORDS = /* @__PURE__ */ new Set([
   "were",
   "with"
 ]);
+var DELETION_REVISION_MAX_MTIME_MS = 864e13;
+var DELETION_REVISION_LOCK_STALE_MS = 6e4;
+var DELETION_REVISION_LOCK_MAX_WAIT_MS = 12e4;
+function isValidDeletionRevisionPath(value) {
+  return typeof value === "string" && value.length > 0 && !value.includes("\\") && !value.includes("\0") && !path9.posix.isAbsolute(value) && path9.posix.normalize(value) === value && value !== "." && value !== ".." && !value.startsWith("../");
+}
+function deletionRevisionPathIdentity(value) {
+  return value.normalize("NFC").toUpperCase().toLowerCase().replace(/\u00df/g, "ss");
+}
 function tokenizeArtifactSearchText(input) {
   return input.toLowerCase().split(/[^a-z0-9]+/i).map((t) => t.trim()).filter((t) => t.length >= 2).filter((t) => !ARTIFACT_SEARCH_STOPWORDS.has(t));
 }
@@ -5390,6 +5515,7 @@ function serializeFrontmatter(fm) {
     const safe = /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(fm.sourceConnector);
     lines.push(`sourceConnector: ${safe ? fm.sourceConnector : JSON.stringify(fm.sourceConnector)}`);
   }
+  if (fm.toolScoped === true) lines.push("toolScoped: true");
   if (fm.supersedes) lines.push(`supersedes: ${fm.supersedes}`);
   if (fm.expiresAt) lines.push(`expiresAt: ${fm.expiresAt}`);
   if (fm.lineage && fm.lineage.length > 0) {
@@ -5599,7 +5725,7 @@ function parseReinforcementCountField(raw) {
   return n;
 }
 function parseFrontmatter(raw) {
-  const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/);
   if (!match) return null;
   const fmBlock = match[1];
   const content = match[2].trim();
@@ -5773,6 +5899,7 @@ function parseFrontmatter(raw) {
       tags,
       entityRef: fm.entityRef || void 0,
       sourceConnector: fm.sourceConnector ? decodeYamlScalar(fm.sourceConnector) || void 0 : void 0,
+      toolScoped: fm.toolScoped === "true" ? true : void 0,
       supersedes: fm.supersedes || void 0,
       expiresAt: fm.expiresAt || void 0,
       lineage: lineage && lineage.length > 0 ? lineage : void 0,
@@ -5861,17 +5988,17 @@ function inferEntityTypeFromContent(content) {
 }
 var KNOWN_ENTITY_FILENAME_PREFIXES = /* @__PURE__ */ new Set(["company", "other", "person", "place", "project", "tool", "topic"]);
 function inferEntityTypeFromFilename(pathRel) {
-  const basename = path8.basename(pathRel, ".md").toLowerCase();
+  const basename = path9.basename(pathRel, ".md").toLowerCase();
   const separator = basename.indexOf("-");
   if (separator <= 0) return void 0;
   const candidate = basename.slice(0, separator);
   return KNOWN_ENTITY_FILENAME_PREFIXES.has(candidate) ? candidate : void 0;
 }
 function normalizeFrontmatterForPath(frontmatter, pathRel, content = "") {
-  const normalizedPath = pathRel.split(path8.sep).join("/");
+  const normalizedPath = pathRel.split(path9.sep).join("/");
   let normalizedFrontmatter = frontmatter;
   if (normalizedPath === "entities" || normalizedPath.startsWith("entities/") || normalizedPath.includes("/entities/")) {
-    const basename = path8.basename(pathRel, ".md");
+    const basename = path9.basename(pathRel, ".md");
     const inferredType = inferEntityTypeFromContent(content) || inferEntityTypeFromFilename(pathRel) || "entity";
     const existingTags = Array.isArray(frontmatter.tags) ? frontmatter.tags : [];
     normalizedFrontmatter = {
@@ -6519,8 +6646,8 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   }
   /** Whether `filePath` resolves to `stateDir` itself or a path contained in it. */
   isStateFilePath(filePath) {
-    const rel = path8.relative(this.stateDir, path8.resolve(filePath));
-    return rel === "" || !rel.startsWith("..") && !path8.isAbsolute(rel);
+    const rel = path9.relative(this.stateDir, path9.resolve(filePath));
+    return rel === "" || !rel.startsWith("..") && !path9.isAbsolute(rel);
   }
   // ── Tombstone store (issue #1579) ───────────────────────────────────────
   // Instance-scoped (rule 11) + namespace-scoped (rule 42) tombstone index.
@@ -6572,9 +6699,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   setSecureStoreKey(key, encryptOnWrite = true) {
     if (!this.applySecureStoreKey(key, encryptOnWrite) || key === null) return;
     void this.entityCanonicalIdMigration.triggerAfterUnlock().catch((error) => {
-      log.warn(
-        `secure-store unlock migration failed: ${error instanceof Error ? error.message : String(error)}`
-      );
+      log.warn(`secure-store unlock migration failed: ${error instanceof Error ? error.message : String(error)}`);
     });
   }
   async setSecureStoreKeyAndWait(key, encryptOnWrite = true) {
@@ -6637,8 +6762,8 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
    * /srv/cold/remnic), skipping the patch and stranding a stale hot entry.
    */
   isColdOrArchiveTierPath(p) {
-    const rel = path8.relative(this.baseDir, p);
-    return rel === "cold" || rel === "archive" || rel.startsWith(`cold${path8.sep}`) || rel.startsWith(`archive${path8.sep}`);
+    const rel = path9.relative(this.baseDir, p);
+    return rel === "cold" || rel === "archive" || rel.startsWith(`cold${path9.sep}`) || rel.startsWith(`archive${path9.sep}`);
   }
   /**
    * Mark the secure-store as required for this storage instance.
@@ -6725,7 +6850,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
         void 0,
         this.baseDir
       );
-      const rel = path8.relative(this.baseDir, filePath).split(path8.sep).join("/");
+      const rel = path9.relative(this.baseDir, filePath).split(path9.sep).join("/");
       return `${rel}:${version.versionId}`;
     } catch (err) {
       log.warn(
@@ -6805,12 +6930,12 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   }
   identityFilePath(workspaceDir, namespace) {
     const rawNamespace = typeof namespace === "string" ? namespace.trim() : "";
-    if (!rawNamespace) return path8.join(workspaceDir, "IDENTITY.md");
+    if (!rawNamespace) return path9.join(workspaceDir, "IDENTITY.md");
     const safeNamespace = rawNamespace.replace(/[^a-zA-Z0-9._-]/g, "-");
-    return path8.join(workspaceDir, `IDENTITY.${safeNamespace}.md`);
+    return path9.join(workspaceDir, `IDENTITY.${safeNamespace}.md`);
   }
   versionFilePath(kind) {
-    return path8.join(this.stateDir, `.${kind}-version.log`);
+    return path9.join(this.stateDir, `.${kind}-version.log`);
   }
   bumpSharedVersion(kind, fallbackMap) {
     const filePath = this.versionFilePath(kind);
@@ -6843,14 +6968,13 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     return this.readSharedVersion("memory-status", _StorageManager.memoryStatusVersionByDir);
   }
   /**
-   * Entity-mutation sentinel: advanced only by entity-store content writes.
-   * The migration fingerprint keys on this instead of memory-status, so
-   * supersede/archive/delete no longer re-trigger discovery scans (#2213).
+   * Entity content revision used by migration discovery and entity-page cache coherence.
    */
   getEntityMutationVersion() {
     return this.readSharedVersion("entity-mutation", _StorageManager.entityMutationVersionByDir);
   }
   bumpEntityMutationVersion() {
+    invalidateForScope(this.baseDir, "entity-write");
     this.bumpSharedVersion("entity-mutation", _StorageManager.entityMutationVersionByDir);
   }
   /**
@@ -6908,7 +7032,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   // memories.
   // -------------------------------------------------------------------------
   get wearablesDir() {
-    return path8.join(this.baseDir, WEARABLES_DIR_NAME);
+    return path9.join(this.baseDir, WEARABLES_DIR_NAME);
   }
   /**
    * Resolve the on-disk path for a source/day transcript. Throws on
@@ -6924,7 +7048,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     if (!isValidTranscriptDate(date)) {
       throw new Error(`invalid wearable transcript date '${String(date)}' \u2014 expected YYYY-MM-DD`);
     }
-    return path8.join(this.wearablesDir, sourceId, `${date}.md`);
+    return path9.join(this.wearablesDir, sourceId, `${date}.md`);
   }
   async writeWearableDayTranscript(sourceId, date, serialized) {
     const targetPath = this.wearableTranscriptPath(sourceId, date);
@@ -7040,25 +7164,25 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     });
   }
   get factsDir() {
-    return path8.join(this.baseDir, "facts");
+    return path9.join(this.baseDir, "facts");
   }
   get correctionsDir() {
-    return path8.join(this.baseDir, "corrections");
+    return path9.join(this.baseDir, "corrections");
   }
   get proceduresDir() {
-    return path8.join(this.baseDir, "procedures");
+    return path9.join(this.baseDir, "procedures");
   }
   get reasoningTracesDir() {
-    return path8.join(this.baseDir, "reasoning-traces");
+    return path9.join(this.baseDir, "reasoning-traces");
   }
   get entitiesDir() {
-    return path8.join(this.baseDir, "entities");
+    return path9.join(this.baseDir, "entities");
   }
   resolveEntityFilePath(name) {
     if (typeof name !== "string") return null;
-    const filePath = path8.resolve(this.entitiesDir, `${name}.md`);
-    const relative2 = path8.relative(this.entitiesDir, filePath);
-    if (relative2 === "" || relative2.startsWith("..") || path8.isAbsolute(relative2)) {
+    const filePath = path9.resolve(this.entitiesDir, `${name}.md`);
+    const relative2 = path9.relative(this.entitiesDir, filePath);
+    if (relative2 === "" || relative2.startsWith("..") || path9.isAbsolute(relative2)) {
       return null;
     }
     return filePath;
@@ -7073,14 +7197,186 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     });
   }
   assertManagedStoragePath(filePath, method) {
-    const resolved = path8.resolve(filePath);
-    const base = path8.resolve(this.baseDir);
-    const rel = path8.relative(base, resolved);
-    if (rel === "" || rel === ".." || rel.startsWith(`..${path8.sep}`) || path8.isAbsolute(rel)) {
+    const resolved = path9.resolve(filePath);
+    const base = path9.resolve(this.baseDir);
+    const rel = path9.relative(base, resolved);
+    if (rel === "" || rel === ".." || rel.startsWith(`..${path9.sep}`) || path9.isAbsolute(rel)) {
       throw new Error(`${method}: file path escapes memory dir`);
     }
     return resolved;
   }
+  parseDeletionRevisionMetadata(raw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("Deletion revision metadata is invalid.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Deletion revision metadata is invalid.");
+    }
+    const root = parsed;
+    if (Object.keys(root).sort().join(",") !== "deletions,version" || root.version !== 1 || !Array.isArray(root.deletions)) {
+      throw new Error("Deletion revision metadata is invalid.");
+    }
+    const revisions = /* @__PURE__ */ new Map();
+    const pathByIdentity = /* @__PURE__ */ new Map();
+    for (const rawEntry of root.deletions) {
+      if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+        throw new Error("Deletion revision metadata is invalid.");
+      }
+      const entry = rawEntry;
+      if (Object.keys(entry).sort().join(",") !== "mtimeMs,path" || !isValidDeletionRevisionPath(entry.path) || typeof entry.mtimeMs !== "number" || !Number.isFinite(entry.mtimeMs) || entry.mtimeMs < 0 || entry.mtimeMs > DELETION_REVISION_MAX_MTIME_MS || revisions.has(entry.path)) {
+        throw new Error("Deletion revision metadata is invalid.");
+      }
+      const identity = deletionRevisionPathIdentity(entry.path);
+      if (pathByIdentity.has(identity)) {
+        throw new Error("Deletion revision metadata is invalid.");
+      }
+      pathByIdentity.set(identity, entry.path);
+      revisions.set(entry.path, entry.mtimeMs);
+    }
+    return new Map([...revisions.entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0));
+  }
+  async readDeletionRevisionMetadata() {
+    let raw;
+    try {
+      raw = await readFile2(this.deletionRevisionMetadataPath, "utf8");
+    } catch (error) {
+      if (isErrnoCode(error, "ENOENT")) return /* @__PURE__ */ new Map();
+      throw new Error("Deletion revision metadata is unavailable.");
+    }
+    return this.parseDeletionRevisionMetadata(raw);
+  }
+  async writeDeletionRevisionMetadata(revisions, lock) {
+    const deletions = [...revisions.entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([entryPath, mtimeMs]) => ({ path: entryPath, mtimeMs }));
+    const metadata = { version: 1, deletions };
+    const temporaryPath = `${this.deletionRevisionMetadataPath}.${process.pid}.${randomUUID2()}.tmp`;
+    let handle = null;
+    try {
+      handle = await open(temporaryPath, "wx", 384);
+      await handle.writeFile(`${JSON.stringify(metadata)}
+`, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = null;
+      if (!await lock.refresh()) {
+        throw new Error("Deletion revision metadata lock was lost.");
+      }
+      await rename2(temporaryPath, this.deletionRevisionMetadataPath);
+    } finally {
+      if (handle !== null) await handle.close().catch(() => void 0);
+      await unlink4(temporaryPath).catch((error) => {
+        if (!isErrnoCode(error, "ENOENT")) throw error;
+      });
+    }
+  }
+  async withDeletionRevisionLock(task) {
+    return withHeldFileLock(
+      this.deletionRevisionLockPath,
+      {
+        staleMs: DELETION_REVISION_LOCK_STALE_MS,
+        maxWaitMs: DELETION_REVISION_LOCK_MAX_WAIT_MS
+      },
+      async (acquired, lock) => {
+        if (!acquired) throw new Error("Deletion revision metadata lock is unavailable.");
+        return task(lock);
+      }
+    );
+  }
+  async readDeletionRevisions() {
+    return this.withDeletionRevisionLock(async () => this.readDeletionRevisionMetadata());
+  }
+  async recordReplicatedDeletionRevision(filePath, mtimeMs) {
+    const target = this.assertManagedStoragePath(filePath, "storage.recordReplicatedDeletionRevision");
+    if (typeof mtimeMs !== "number" || !Number.isFinite(mtimeMs) || mtimeMs < 0 || mtimeMs > DELETION_REVISION_MAX_MTIME_MS) {
+      throw new Error("Deletion revision timestamp is invalid.");
+    }
+    const relativePath = path9.relative(this.baseDir, target).split(path9.sep).join("/");
+    if (!isValidDeletionRevisionPath(relativePath)) {
+      throw new Error("Deletion revision path is invalid.");
+    }
+    await this.withDeletionRevisionLock(async (lock) => {
+      const revisions = await this.readDeletionRevisionMetadata();
+      const identity = deletionRevisionPathIdentity(relativePath);
+      let existingPath;
+      for (const candidatePath of revisions.keys()) {
+        if (deletionRevisionPathIdentity(candidatePath) === identity) {
+          existingPath = candidatePath;
+          break;
+        }
+      }
+      const existingMtimeMs = existingPath === void 0 ? void 0 : revisions.get(existingPath);
+      if (existingMtimeMs !== void 0 && existingMtimeMs >= mtimeMs) return;
+      const updated = new Map(revisions);
+      if (existingPath !== void 0) updated.delete(existingPath);
+      updated.set(relativePath, mtimeMs);
+      await this.writeDeletionRevisionMetadata(updated, lock);
+    });
+  }
+  async writeManagedStorageFile(filePath, write) {
+    const target = this.assertManagedStoragePath(filePath, "storage.writeManagedStorageFile");
+    const relativePath = path9.relative(this.baseDir, target).split(path9.sep).join("/");
+    if (!isValidDeletionRevisionPath(relativePath)) {
+      throw new Error("Deletion revision path is invalid.");
+    }
+    await this.withDeletionRevisionLock(async (lock) => {
+      const before = await this.readDeletionRevisionMetadata();
+      const identity = deletionRevisionPathIdentity(relativePath);
+      const existingPath = [...before.keys()].find(
+        (candidatePath) => deletionRevisionPathIdentity(candidatePath) === identity
+      );
+      await write();
+      if (existingPath === void 0) return;
+      const updated = new Map(before);
+      updated.delete(existingPath);
+      await this.writeDeletionRevisionMetadata(updated, lock);
+    });
+  }
+  async deleteManagedStorageFile(filePath, deletionMtimeMs) {
+    const target = this.assertManagedStoragePath(filePath, "storage.deleteManagedStorageFile");
+    if (deletionMtimeMs !== void 0 && deletionMtimeMs !== null && (typeof deletionMtimeMs !== "number" || !Number.isFinite(deletionMtimeMs) || deletionMtimeMs < 0 || deletionMtimeMs > DELETION_REVISION_MAX_MTIME_MS)) {
+      throw new Error("Deletion revision timestamp is invalid.");
+    }
+    return this.withDeletionRevisionLock(async (lock) => {
+      try {
+        await lstat3(target);
+      } catch (error) {
+        if (isErrnoCode(error, "ENOENT")) return false;
+        throw error;
+      }
+      const relativePath = path9.relative(this.baseDir, target).split(path9.sep).join("/");
+      if (!isValidDeletionRevisionPath(relativePath)) {
+        throw new Error("Deletion revision path is invalid.");
+      }
+      const revision = deletionMtimeMs === null ? void 0 : deletionMtimeMs ?? Date.now();
+      const before = await this.readDeletionRevisionMetadata();
+      const identity = deletionRevisionPathIdentity(relativePath);
+      let existingPath;
+      for (const candidatePath of before.keys()) {
+        if (deletionRevisionPathIdentity(candidatePath) === identity) {
+          existingPath = candidatePath;
+          break;
+        }
+      }
+      const existing = existingPath === void 0 ? void 0 : before.get(existingPath);
+      const changed = existingPath !== void 0 && existingPath !== relativePath || (revision === void 0 ? existing !== void 0 : existing !== revision);
+      if (changed) {
+        const updated = new Map(before);
+        if (existingPath !== void 0) updated.delete(existingPath);
+        if (revision !== void 0) updated.set(relativePath, revision);
+        await this.writeDeletionRevisionMetadata(updated, lock);
+      }
+      try {
+        await unlink4(target);
+        return true;
+      } catch (error) {
+        if (changed) await this.writeDeletionRevisionMetadata(before, lock);
+        if (isErrnoCode(error, "ENOENT")) return false;
+        throw error;
+      }
+    });
+  }
   async readOfflineSyncFile(filePath) {
     const target = this.assertManagedStoragePath(filePath, "storage.readOfflineSyncFile");
     return readMaybeEncryptedFileBuffer(target, this._secureStoreKey, this.baseDir);
@@ -7088,7 +7384,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   async digestOfflineSyncFile(filePath) {
     const target = this.assertManagedStoragePath(filePath, "storage.digestOfflineSyncFile");
     const st = await stat2(target);
-    const relPath = path8.relative(this.baseDir, target).split(path8.sep).join("/");
+    const relPath = path9.relative(this.baseDir, target).split(path9.sep).join("/");
     const cache = await this.loadOfflineSyncDigestCache();
     const cached = cache.get(relPath);
     if (cached && cached.statBytes === st.size && cached.mtimeMs === st.mtimeMs && cached.ctimeMs === st.ctimeMs && !cached.encrypted) {
@@ -7102,11 +7398,11 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     if (encrypted) {
       const content = await readMaybeEncryptedFileBuffer(target, this._secureStoreKey, this.baseDir);
       digest = {
-        sha256: createHash5("sha256").update(content).digest("hex"),
+        sha256: createHash6("sha256").update(content).digest("hex"),
         bytes: content.byteLength
       };
     } else {
-      const hash = createHash5("sha256");
+      const hash = createHash6("sha256");
       let bytes = 0;
       for await (const rawChunk of createReadStream(target)) {
         const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
@@ -7149,7 +7445,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
         const bytes = typeof record.bytes === "number" ? record.bytes : NaN;
         const sha256 = typeof record.sha256 === "string" ? record.sha256 : "";
         const encrypted = record.encrypted === true;
-        if (cachePath.length === 0 || cachePath === ".." || cachePath.startsWith("../") || path8.isAbsolute(cachePath) || !Number.isFinite(statBytes) || !Number.isFinite(mtimeMs) || !Number.isFinite(ctimeMs) || !Number.isFinite(bytes) || !/^[a-f0-9]{64}$/i.test(sha256)) {
+        if (cachePath.length === 0 || cachePath === ".." || cachePath.startsWith("../") || path9.isAbsolute(cachePath) || !Number.isFinite(statBytes) || !Number.isFinite(mtimeMs) || !Number.isFinite(ctimeMs) || !Number.isFinite(bytes) || !/^[a-f0-9]{64}$/i.test(sha256)) {
           continue;
         }
         cache.set(cachePath, { statBytes, mtimeMs, ctimeMs, encrypted, sha256, bytes });
@@ -7191,7 +7487,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       const cache = this.offlineSyncDigestCache;
       if (!cache) return;
       const entries = [...cache.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([entryPath, entry]) => ({ path: entryPath, ...entry }));
-      await mkdir(path8.dirname(this.offlineSyncDigestCachePath), { recursive: true });
+      await mkdir(path9.dirname(this.offlineSyncDigestCachePath), { recursive: true });
       await writeFile2(this.offlineSyncDigestCachePath, `${JSON.stringify({ version: 1, entries })}
 `, "utf-8");
     }).catch((err) => {
@@ -7280,7 +7576,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   }
   async appendStorageSecureFileUnlocked(filePath, content) {
     const writeKey = this.resolveWriteKey();
-    await mkdir(path8.dirname(filePath), { recursive: true });
+    await mkdir(path9.dirname(filePath), { recursive: true });
     if (writeKey === null) {
       try {
         if (await this.isEncryptedFileHeader(filePath)) {
@@ -7306,13 +7602,19 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     this.notifyCatalogWriteForPath(filePath);
   }
   get stateDir() {
-    return path8.join(this.baseDir, "state");
+    return path9.join(this.baseDir, "state");
   }
   get offlineSyncDigestCachePath() {
-    return path8.join(this.baseDir, ".offline-sync", "digest-cache.v1.json");
+    return path9.join(this.baseDir, ".offline-sync", "digest-cache.v1.json");
+  }
+  get deletionRevisionMetadataPath() {
+    return path9.join(this.baseDir, ".offline-sync", "deletion-revisions.v1.json");
+  }
+  get deletionRevisionLockPath() {
+    return `${this.deletionRevisionMetadataPath}.lock`;
   }
   get entitySynthesisQueuePath() {
-    return path8.join(this.stateDir, "entity-synthesis-queue.json");
+    return path9.join(this.stateDir, "entity-synthesis-queue.json");
   }
   // ── Tombstone store access (issue #1579) ─────────────────────────────────
   /**
@@ -7322,7 +7624,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
    * helpers are injected into the store).
    */
   get tombstonesPath() {
-    return path8.join(this.stateDir, "tombstones.jsonl");
+    return path9.join(this.stateDir, "tombstones.jsonl");
   }
   /**
    * Configure the tombstone invariant for this storage instance. Installed
@@ -7619,55 +7921,55 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     return null;
   }
   get questionsDir() {
-    return path8.join(this.baseDir, "questions");
+    return path9.join(this.baseDir, "questions");
   }
   get artifactsDir() {
-    return path8.join(this.baseDir, "artifacts");
+    return path9.join(this.baseDir, "artifacts");
   }
   get identityDir() {
-    return path8.join(this.baseDir, "identity");
+    return path9.join(this.baseDir, "identity");
   }
   get identityAnchorPath() {
-    return path8.join(this.identityDir, "identity-anchor.md");
+    return path9.join(this.identityDir, "identity-anchor.md");
   }
   get identityIncidentsDir() {
-    return path8.join(this.identityDir, "incidents");
+    return path9.join(this.identityDir, "incidents");
   }
   get identityAuditsWeeklyDir() {
-    return path8.join(this.identityDir, "audits", "weekly");
+    return path9.join(this.identityDir, "audits", "weekly");
   }
   get identityAuditsMonthlyDir() {
-    return path8.join(this.identityDir, "audits", "monthly");
+    return path9.join(this.identityDir, "audits", "monthly");
   }
   get identityImprovementLoopsPath() {
-    return path8.join(this.identityDir, "improvement-loops.md");
+    return path9.join(this.identityDir, "improvement-loops.md");
   }
   get identityReflectionsPath() {
-    return path8.join(this.identityDir, "reflections.md");
+    return path9.join(this.identityDir, "reflections.md");
   }
   get profilePath() {
-    return path8.join(this.baseDir, "profile.md");
+    return path9.join(this.baseDir, "profile.md");
   }
   get memoryActionsPath() {
-    return path8.join(this.stateDir, "memory-actions.jsonl");
+    return path9.join(this.stateDir, "memory-actions.jsonl");
   }
   get memoryLifecycleLedgerPath() {
-    return path8.join(this.stateDir, "memory-lifecycle-ledger.jsonl");
+    return path9.join(this.stateDir, "memory-lifecycle-ledger.jsonl");
   }
   get compressionGuidelinesPath() {
-    return path8.join(this.stateDir, "compression-guidelines.md");
+    return path9.join(this.stateDir, "compression-guidelines.md");
   }
   get compressionGuidelineDraftPath() {
-    return path8.join(this.stateDir, "compression-guidelines.draft.md");
+    return path9.join(this.stateDir, "compression-guidelines.draft.md");
   }
   get compressionGuidelineStatePath() {
-    return path8.join(this.stateDir, "compression-guideline-state.json");
+    return path9.join(this.stateDir, "compression-guideline-state.json");
   }
   get compressionGuidelineDraftStatePath() {
-    return path8.join(this.stateDir, "compression-guideline-draft-state.json");
+    return path9.join(this.stateDir, "compression-guideline-draft-state.json");
   }
   get behaviorSignalsPath() {
-    return path8.join(this.stateDir, "behavior-signals.jsonl");
+    return path9.join(this.stateDir, "behavior-signals.jsonl");
   }
   /**
    * In-memory dedup key set for behavior-signals appends (issue #1909),
@@ -7699,7 +8001,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
    * governance sweeps can treat it uniformly.
    */
   get bufferSurpriseLedgerPath() {
-    return path8.join(this.stateDir, "buffer-surprise-ledger.jsonl");
+    return path9.join(this.stateDir, "buffer-surprise-ledger.jsonl");
   }
   /**
    * Entity alias table loaded from THIS store's config/aliases.json.
@@ -7760,25 +8062,29 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     this.loadAliasesSync();
   }
   loadAliasesSync() {
-    const aliasPath = path8.join(this.baseDir, "config", "aliases.json");
+    const aliasPath = path9.join(this.baseDir, "config", "aliases.json");
     this.userAliases = {};
+    const raw = readEntityAliasConfigSync(this.baseDir);
+    if (raw === void 0) return;
+    let parsed;
     try {
-      const raw = readFileSync(aliasPath, "utf-8");
-      const parsed = JSON.parse(raw);
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-        const cleaned = {};
-        for (const [key, value] of Object.entries(parsed)) {
-          if (typeof value === "string" && value.trim().length > 0) {
-            cleaned[key] = value;
-          }
+      parsed = JSON.parse(raw);
+    } catch {
+      log.debug("invalid config/aliases.json \u2014 using built-in aliases only");
+      return;
+    }
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      const cleaned = {};
+      for (const [key, value] of Object.entries(parsed)) {
+        if (typeof value === "string" && value.trim().length > 0) {
+          assertSafeEntityId(value);
+          cleaned[key] = value;
         }
-        this.userAliases = cleaned;
-        log.debug(`loaded ${Object.keys(cleaned).length} entity aliases from ${aliasPath}`);
-      } else {
-        log.warn(`ignoring ${aliasPath}: payload must be a JSON object mapping variant \u2192 canonical strings`);
       }
-    } catch {
-      log.debug("no config/aliases.json found \u2014 using built-in aliases only");
+      this.userAliases = cleaned;
+      log.debug(`loaded ${Object.keys(cleaned).length} entity aliases from ${aliasPath}`);
+    } else {
+      log.warn(`ignoring ${aliasPath}: payload must be a JSON object mapping variant \u2192 canonical strings`);
     }
   }
   async runLegacyEntityCanonicalIdMigration() {
@@ -7794,9 +8100,9 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     await mkdir(this.baseDir, { recursive: true });
     await validateRoots(this.baseDir, this.entitiesDir, this.stateDir, this.archiveDir);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    await mkdir(path8.join(this.factsDir, today), { recursive: true });
-    await mkdir(path8.join(this.proceduresDir, today), { recursive: true });
-    await mkdir(path8.join(this.reasoningTracesDir, today), { recursive: true });
+    await mkdir(path9.join(this.factsDir, today), { recursive: true });
+    await mkdir(path9.join(this.proceduresDir, today), { recursive: true });
+    await mkdir(path9.join(this.reasoningTracesDir, today), { recursive: true });
     await mkdir(this.correctionsDir, { recursive: true });
     await mkdir(this.entitiesDir, { recursive: true });
     await mkdir(this.stateDir, { recursive: true });
@@ -7806,7 +8112,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     await mkdir(this.identityIncidentsDir, { recursive: true });
     await mkdir(this.identityAuditsWeeklyDir, { recursive: true });
     await mkdir(this.identityAuditsMonthlyDir, { recursive: true });
-    await mkdir(path8.join(this.baseDir, "config"), { recursive: true });
+    await mkdir(path9.join(this.baseDir, "config"), { recursive: true });
     await this.entityCanonicalIdMigration.ensure();
     if (this.hotMemoriesCacheEnabled && this.getMemoryCorpusVersion() === 0) {
       this.bumpMemoryCorpusVersion();
@@ -7828,11 +8134,11 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   async resolveCategoryWritePath(category, id, today) {
     if (category === "correction") {
       await mkdir(this.correctionsDir, { recursive: true });
-      return path8.join(this.correctionsDir, `${id}.md`);
+      return path9.join(this.correctionsDir, `${id}.md`);
     }
-    const datedDir = path8.join(getCategoryDir(this.baseDir, category), today);
+    const datedDir = path9.join(getCategoryDir(this.baseDir, category), today);
     await mkdir(datedDir, { recursive: true });
-    return path8.join(datedDir, `${id}.md`);
+    return path9.join(datedDir, `${id}.md`);
   }
   async findExistingTombstoneBlockedMemory(content, category, sourceConnector) {
     const identity = buildExplicitCaptureDedupKey(content, category, sourceConnector);
@@ -7918,6 +8224,12 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     if (!sanitized.clean) {
       log.warn(`memory content sanitized for ${id}; violations=${sanitized.violations.join(", ")}`);
     }
+    if (options.toolScoped || withholdToolScopedFromSharedNamespace({
+      content: sanitized.text,
+      sourceConnector: options.sourceConnector
+    })) {
+      fm.toolScoped = true;
+    }
     let factHashSourceForTombstone = null;
     if (category === "fact") {
       const hashSource = options.contentHashSource !== void 0 && options.contentHashSource.length > 0 ? sanitizeMemoryContent(options.contentHashSource).text : sanitized.text;
@@ -7928,13 +8240,13 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       refIds = this.currentHistoricalIds();
       fm.entityRef = resolveHistoricalEntityCanonicalId(rawEntityRef, refIds);
     }
-    let tombstoneBlocked = false;
+    let tombstoneBlocked2 = false;
     let gateRef;
     let statusBeforeBlock;
     const applyTombstoneGate = async () => {
-      if (tombstoneBlocked) {
+      if (tombstoneBlocked2) {
         if (fm.entityRef === gateRef) return;
-        tombstoneBlocked = false;
+        tombstoneBlocked2 = false;
         fm.status = statusBeforeBlock;
         delete fm.blockedBy;
         delete fm.tombstoneBlockTier;
@@ -7945,7 +8257,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       if (match) {
         gateRef = fm.entityRef;
         statusBeforeBlock = statusBefore;
-        tombstoneBlocked = true;
+        tombstoneBlocked2 = true;
       }
     };
     await applyTombstoneGate();
@@ -7955,7 +8267,7 @@ ${sanitized.text}
 `;
     const filePath = await this.resolveCategoryWritePath(category, id, today);
     const persistFile = async () => {
-      if (tombstoneBlocked) {
+      if (tombstoneBlocked2) {
         const duplicate = await this.findExistingTombstoneBlockedMemory(sanitized.text, category, fm.sourceConnector);
         if (duplicate) return duplicate;
       }
@@ -7963,12 +8275,44 @@ ${sanitized.text}
       await this.writeTombstoneBlockedMemory(filePath, fileContent, fm, sanitized.text, async () => {
         this.invalidateAllMemoriesCache();
       });
+      if (refIds && typeof rawEntityRef === "string") {
+        const refBeforeRepair = fm.entityRef;
+        try {
+          await repairEntityRefAfterJournalMove({
+            stateDir: this.stateDir,
+            currentIds: () => this.currentHistoricalIds(),
+            idsAtResolve: refIds,
+            rawRef: rawEntityRef,
+            frontmatter: fm,
+            rewrite: async () => {
+              await applyTombstoneGate();
+              await this.writeTombstoneBlockedMemory(
+                filePath,
+                `${serializeFrontmatter(fm)}
+
+${sanitized.text}
+`,
+                fm,
+                sanitized.text,
+                async () => this.invalidateAllMemoriesCache()
+              );
+              this.invalidateAllMemoriesCache();
+            }
+          });
+        } catch (err) {
+          await unlink4(filePath).catch(() => void 0);
+          this.invalidateAllMemoriesCache();
+          await this.rebuildTombstoneBlockedCaptureAfterInvalidationForPath(filePath);
+          throw err;
+        }
+        await this.entityRefRepair.syncProjection(id, refBeforeRepair, fm.entityRef);
+      }
       return null;
     };
-    const duplicateBlocked = tombstoneBlocked ? await this.withTombstoneBlockedCaptureWriteLock(
-      persistFile,
+    const duplicateBlocked = await this.withTombstoneBlockedCaptureWriteLock(persistFile, [
+      buildCapturePathLockIdentity(filePath),
       buildExplicitCaptureDedupKey(sanitized.text, category, fm.sourceConnector)
-    ) : await persistFile();
+    ]);
     if (duplicateBlocked) {
       return {
         id: duplicateBlocked.frontmatter.id,
@@ -7977,37 +8321,6 @@ ${sanitized.text}
         duplicateOf: duplicateBlocked.frontmatter.id
       };
     }
-    if (refIds && typeof rawEntityRef === "string") {
-      const refBeforeRepair = fm.entityRef;
-      try {
-        await repairEntityRefAfterJournalMove({
-          stateDir: this.stateDir,
-          currentIds: () => this.currentHistoricalIds(),
-          idsAtResolve: refIds,
-          rawRef: rawEntityRef,
-          frontmatter: fm,
-          rewrite: async () => {
-            await applyTombstoneGate();
-            await this.writeTombstoneBlockedMemory(
-              filePath,
-              `${serializeFrontmatter(fm)}
-
-${sanitized.text}
-`,
-              fm,
-              sanitized.text,
-              async () => this.invalidateAllMemoriesCache()
-            );
-            this.invalidateAllMemoriesCache();
-          }
-        });
-      } catch (err) {
-        await unlink4(filePath).catch(() => void 0);
-        this.invalidateAllMemoriesCache();
-        throw err;
-      }
-      await this.entityRefRepair.syncProjection(id, refBeforeRepair, fm.entityRef);
-    }
     await this.patchHotMemoriesCache({ addedPath: filePath }, "memory-create");
     this.notifyMemoryWrite(filePath);
     await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.writeMemory", {
@@ -8021,7 +8334,7 @@ ${sanitized.text}
         ...(options.lineage ?? []).filter(Boolean)
       ]
     });
-    if (category === "fact" && !tombstoneBlocked) {
+    if (category === "fact" && !tombstoneBlocked2) {
       try {
         const factHashIndex = await this.getFactHashIndex();
         const hashText = options.contentHashSource !== void 0 && options.contentHashSource.length > 0 ? sanitizeMemoryContent(options.contentHashSource).text : sanitized.text;
@@ -8036,7 +8349,7 @@ ${sanitized.text}
       }
     }
     log.debug(`wrote memory ${id} to ${filePath}`);
-    return { id, tombstoneBlocked, ...fm.blockedBy ? { blockedBy: fm.blockedBy } : {} };
+    return { id, tombstoneBlocked: tombstoneBlocked2, ...fm.blockedBy ? { blockedBy: fm.blockedBy } : {} };
   }
   /**
    * Sealed-envelope write entry point (issue #1989 PR2).
@@ -8192,7 +8505,7 @@ ${sanitized.text}
     await this.ensureDirectories();
     const now = /* @__PURE__ */ new Date();
     const day = now.toISOString().slice(0, 10);
-    const dir = path8.join(this.artifactsDir, day);
+    const dir = path9.join(this.artifactsDir, day);
     await mkdir(dir, { recursive: true });
     const id = `artifact-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const fm = {
@@ -8210,14 +8523,15 @@ ${sanitized.text}
       intentGoal: options.intentGoal,
       intentActionType: options.intentActionType,
       intentEntityTypes: options.intentEntityTypes,
-      ...options.sourceConnector ? { sourceConnector: options.sourceConnector } : {}
+      ...options.sourceConnector ? { sourceConnector: options.sourceConnector } : {},
+      ...options.toolScoped ? { toolScoped: true } : {}
     };
     const sanitized = sanitizeMemoryContent(quote);
     if (!sanitized.clean) {
       log.warn(`artifact content rejected for ${id}; violations=${sanitized.violations.join(", ")}`);
       return "";
     }
-    const filePath = path8.join(dir, `${id}.md`);
+    const filePath = path9.join(dir, `${id}.md`);
     await this.writeStorageSecureFile(filePath, `${serializeFrontmatter(fm)}
 
 ${sanitized.text}
@@ -8308,12 +8622,7 @@ ${sanitized.text}
     });
     if (newBullets.length === 0) return;
     if (!existing) {
-      const content = [
-        "# Behavioral Profile",
-        "",
-        ...newBullets.map((b) => `- ${b}`),
-        ""
-      ].join("\n");
+      const content = ["# Behavioral Profile", "", ...newBullets.map((b) => `- ${b}`), ""].join("\n");
       await this.writeProfile(content);
     } else {
       const withBullets = existing.trimEnd() + "\n" + newBullets.map((b) => `- ${b}`).join("\n") + "\n";
@@ -8488,7 +8797,7 @@ ${sanitized.text}
    * per-process in-memory cache safe across process boundaries.
    */
   invalidateColdMemoriesCache() {
-    const coldRoot = path8.join(this.baseDir, "cold");
+    const coldRoot = path9.join(this.baseDir, "cold");
     _StorageManager.coldMemoriesCache.delete(coldRoot);
     this.bumpColdWriteVersion();
     invalidateAllForDir(this.baseDir);
@@ -8548,15 +8857,18 @@ ${sanitized.text}
             const raw = await readMaybeEncryptedFile(fullPath, this._secureStoreKey, this.baseDir);
             const parsed = parseFrontmatter(raw);
             if (!parsed) return null;
-            return rememberRawFrontmatter({
-              path: fullPath,
-              frontmatter: normalizeFrontmatterForPath(
-                parsed.frontmatter,
-                toMemoryPathRel(this.baseDir, fullPath),
-                parsed.content
-              ),
-              content: parsed.content
-            }, raw);
+            return rememberRawFrontmatter(
+              {
+                path: fullPath,
+                frontmatter: normalizeFrontmatterForPath(
+                  parsed.frontmatter,
+                  toMemoryPathRel(this.baseDir, fullPath),
+                  parsed.content
+                ),
+                content: parsed.content
+              },
+              raw
+            );
           } catch (err) {
             if (err instanceof SecureStoreLockedError) throw err;
             return null;
@@ -8603,7 +8915,7 @@ ${sanitized.text}
     const correctionPaths = [];
     const factPaths = [];
     for (const filePath of filePaths) {
-      if (filePath === this.correctionsDir || filePath.startsWith(`${this.correctionsDir}${path8.sep}`)) {
+      if (filePath === this.correctionsDir || filePath.startsWith(`${this.correctionsDir}${path9.sep}`)) {
         correctionPaths.push(filePath);
       } else {
         factPaths.push(filePath);
@@ -8666,7 +8978,7 @@ ${sanitized.text}
       try {
         const entries = await readdir5(dir, { withFileTypes: true });
         for (const entry of entries) {
-          const fullPath = path8.join(dir, entry.name);
+          const fullPath = path9.join(dir, entry.name);
           if (entry.isDirectory()) {
             await readDir(fullPath);
           } else if (entry.name.endsWith(".md")) {
@@ -8674,15 +8986,20 @@ ${sanitized.text}
               const raw = await readMaybeEncryptedFile(fullPath, this._secureStoreKey, this.baseDir);
               const parsed = parseFrontmatter(raw);
               if (parsed) {
-                memories.push(rememberRawFrontmatter({
-                  path: fullPath,
-                  frontmatter: normalizeFrontmatterForPath(
-                    parsed.frontmatter,
-                    toMemoryPathRel(this.baseDir, fullPath),
-                    parsed.content
-                  ),
-                  content: parsed.content
-                }, raw));
+                memories.push(
+                  rememberRawFrontmatter(
+                    {
+                      path: fullPath,
+                      frontmatter: normalizeFrontmatterForPath(
+                        parsed.frontmatter,
+                        toMemoryPathRel(this.baseDir, fullPath),
+                        parsed.content
+                      ),
+                      content: parsed.content
+                    },
+                    raw
+                  )
+                );
               }
             } catch (err) {
               if (err instanceof SecureStoreLockedError) throw err;
@@ -8699,7 +9016,7 @@ ${sanitized.text}
     return this.memoryReadStore.readMemoryByPath(filePath);
   }
   resolveTierRootDir(tier) {
-    return tier === "cold" ? path8.join(this.baseDir, "cold") : this.baseDir;
+    return tier === "cold" ? path9.join(this.baseDir, "cold") : this.baseDir;
   }
   resolveMemoryDateDir(memory) {
     const preferred = memory.frontmatter.created || memory.frontmatter.updated;
@@ -8714,13 +9031,13 @@ ${sanitized.text}
   buildTierMemoryPath(memory, tier) {
     const root = this.resolveTierRootDir(tier);
     if (this.isArtifactMemory(memory)) {
-      return path8.join(root, "artifacts", this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
+      return path9.join(root, "artifacts", this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
     }
     if (memory.frontmatter.category === "correction") {
-      return path8.join(root, "corrections", `${memory.frontmatter.id}.md`);
+      return path9.join(root, "corrections", `${memory.frontmatter.id}.md`);
     }
     const dir = categoryDirName(memory.frontmatter.category);
-    return path8.join(root, dir, this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
+    return path9.join(root, dir, this.resolveMemoryDateDir(memory), `${memory.frontmatter.id}.md`);
   }
   async writeMemoryFileAtomic(targetPath, memory) {
     const refIdsAtWrite = this.currentHistoricalIds();
@@ -8767,43 +9084,55 @@ ${memory.content}
     this.notifyCatalogWrite();
   }
   async moveMemoryToPath(memory, targetPath) {
-    await this.writeMemoryFileAtomic(targetPath, memory);
-    const sourcePath = path8.resolve(memory.path);
-    const destPath = path8.resolve(targetPath);
-    if (sourcePath !== destPath) {
-      try {
-        await unlink4(memory.path);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (!message.includes("ENOENT")) {
-          throw err;
+    await this.withTombstoneBlockedMemoryPathLock(
+      memory.path,
+      async (current) => {
+        if (current?.frontmatter.id !== memory.frontmatter.id) {
+          throw new Error(`memory ${memory.frontmatter.id} changed before its tier move`);
         }
-      }
-      this.invalidateAllMemoriesCache();
-      updateProjectedMemoryPath(this.baseDir, memory.frontmatter.id, toMemoryPathRel(this.baseDir, targetPath));
-    }
+        const destination = await this.readMemoryByPath(targetPath);
+        const coordinate = tombstoneBlocked(current.frontmatter) || isQueuedReviewMemory(current) || destination !== null && tombstoneBlocked(destination.frontmatter) || isQueuedReviewMemory(destination);
+        const index = this.getTombstoneBlockedCaptureIndex();
+        const marker = coordinate ? await index.prepareWrite() : void 0;
+        let durable = false;
+        try {
+          if (destination?.frontmatter.id === current.frontmatter.id) {
+            await this.deleteManagedStorageFile(current.path);
+            durable = true;
+            this.invalidateAllMemoriesCache();
+            updateProjectedMemoryPath(this.baseDir, current.frontmatter.id, toMemoryPathRel(this.baseDir, targetPath));
+          } else {
+            await this.writeMemoryFileAtomic(targetPath, current);
+            durable = true;
+            const sourcePath = path9.resolve(current.path);
+            const destPath = path9.resolve(targetPath);
+            if (sourcePath !== destPath) {
+              await this.deleteManagedStorageFile(current.path);
+              this.invalidateAllMemoriesCache();
+              updateProjectedMemoryPath(
+                this.baseDir,
+                current.frontmatter.id,
+                toMemoryPathRel(this.baseDir, targetPath)
+              );
+            }
+          }
+          if (marker !== void 0) await this.rebuildTombstoneBlockedCaptureAfterInvalidation(marker);
+        } catch (error) {
+          if (marker !== void 0 && !durable) await index.discardWrite(marker).catch(() => index.markUntrusted());
+          if (marker !== void 0 && durable) index.markUntrusted();
+          throw error;
+        }
+      },
+      [targetPath]
+    );
   }
   async migrateMemoryToTier(memory, targetTier) {
     const targetPath = this.buildTierMemoryPath(memory, targetTier);
-    const sourcePath = path8.resolve(memory.path);
-    const destPath = path8.resolve(targetPath);
+    const sourcePath = path9.resolve(memory.path);
+    const destPath = path9.resolve(targetPath);
     if (sourcePath === destPath) {
       return { changed: false, targetPath };
     }
-    const existing = await this.readMemoryByPath(targetPath);
-    if (existing?.frontmatter.id === memory.frontmatter.id) {
-      try {
-        await unlink4(memory.path);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (!message.includes("ENOENT")) {
-          throw err;
-        }
-      }
-      updateProjectedMemoryPath(this.baseDir, memory.frontmatter.id, toMemoryPathRel(this.baseDir, targetPath));
-      this.bumpMemoryStatusVersion();
-      return { changed: false, targetPath };
-    }
     await this.moveMemoryToPath(memory, targetPath);
     this.invalidateAllMemoriesCache();
     if (targetTier === "cold") {
@@ -8813,7 +9142,7 @@ ${memory.content}
     return { changed: true, targetPath };
   }
   get archiveDir() {
-    return path8.join(this.baseDir, "archive");
+    return path9.join(this.baseDir, "archive");
   }
   /**
    * Archive a memory by moving it from facts/ to archive/YYYY-MM-DD/.
@@ -8825,7 +9154,7 @@ ${memory.content}
       try {
         const now = lifecycle?.at ?? /* @__PURE__ */ new Date();
         const today = now.toISOString().slice(0, 10);
-        const destDir = path8.join(this.archiveDir, today);
+        const destDir = path9.join(this.archiveDir, today);
         await mkdir(destDir, { recursive: true });
         const refIdsAtWrite = this.currentHistoricalIds();
         const updatedFm = canonicalizeEntityRefOption(
@@ -8841,7 +9170,7 @@ ${memory.content}
 
 ${current.content}
 `;
-        const destPath = path8.join(destDir, path8.basename(current.path));
+        const destPath = path9.join(destDir, path9.basename(current.path));
         const priorDest = await this.readStorageSecureFile(destPath).catch(() => null);
         await this.writeStorageSecureFile(destPath, fileContent);
         if (typeof current.frontmatter.entityRef === "string") {
@@ -8862,7 +9191,7 @@ ${current.content}
             throw err;
           }
         }
-        await unlink4(current.path);
+        if (!await this.deleteManagedStorageFile(current.path)) return null;
         markDurable();
         markProjectedMemoryPathInvalid(this.baseDir, current.frontmatter.id);
         this.invalidateAllMemoriesCache();
@@ -8940,19 +9269,16 @@ ${current.content}
     const memories = await this.readAllMemories();
     const memory = memories.find((candidate) => candidate.frontmatter.id === id);
     if (!memory) return false;
-    return await this.runTombstoneBlockedInvalidation(
-      memory,
-      async (current, rebuildMarker, markDurable) => {
-        await unlink4(current.path);
-        markDurable();
-        markProjectedMemoryPathInvalid(this.baseDir, id);
-        this.invalidateAllMemoriesCache();
-        await this.rebuildTombstoneBlockedCaptureAfterInvalidation(rebuildMarker);
-        this.bumpMemoryStatusVersion();
-        log.debug(`invalidated memory ${id}`);
-        return true;
-      }
-    );
+    return await this.runTombstoneBlockedInvalidation(memory, async (current, rebuildMarker, markDurable) => {
+      if (!await this.deleteManagedStorageFile(current.path)) return false;
+      markDurable();
+      markProjectedMemoryPathInvalid(this.baseDir, id);
+      this.invalidateAllMemoriesCache();
+      await this.rebuildTombstoneBlockedCaptureAfterInvalidation(rebuildMarker);
+      this.bumpMemoryStatusVersion();
+      log.debug(`invalidated memory ${id}`);
+      return true;
+    });
   }
   async updateMemory(id, newContent, options) {
     const memories = await this.readAllMemories();
@@ -9028,23 +9354,18 @@ ${memory.content}
 `;
     await this.writeTombstoneBlockedFrontmatter(memory, fileContent, updated, async () => {
       this.invalidateAllMemoriesCache();
-      if (memory.path.includes(`${path8.sep}cold${path8.sep}`)) {
+      if (memory.path.includes(`${path9.sep}cold${path9.sep}`)) {
         this.invalidateColdMemoriesCache();
       }
     });
     const rawMergedRef = typeof patch.entityRef === "string" ? patch.entityRef : memory.frontmatter.entityRef;
     if (refIds && typeof rawMergedRef === "string") {
-      await this.entityRefRepair.repair(
-        memory.path,
-        updated,
-        rawMergedRef,
-        refIds,
-        memory.content,
-        { onFailRestore: memory }
-      );
+      await this.entityRefRepair.repair(memory.path, updated, rawMergedRef, refIds, memory.content, {
+        onFailRestore: memory
+      });
     }
     await this.patchHotMemoriesCache({ addedPath: memory.path });
-    if (memory.path.includes(`${path8.sep}cold${path8.sep}`)) {
+    if (memory.path.includes(`${path9.sep}cold${path9.sep}`)) {
       this.invalidateColdMemoriesCache();
     }
     try {
@@ -9114,7 +9435,7 @@ ${memory.content}
     return deleted;
   }
   async loadBuffer() {
-    const bufferPath = path8.join(this.stateDir, "buffer.json");
+    const bufferPath = path9.join(this.stateDir, "buffer.json");
     try {
       const raw = await this.readStorageSecureFile(bufferPath);
       return JSON.parse(raw);
@@ -9126,11 +9447,11 @@ ${memory.content}
   }
   async saveBuffer(state) {
     await this.ensureDirectories();
-    const bufferPath = path8.join(this.stateDir, "buffer.json");
+    const bufferPath = path9.join(this.stateDir, "buffer.json");
     await this.writeStorageSecureFile(bufferPath, JSON.stringify(state, null, 2));
   }
   async loadMeta() {
-    const metaPath = path8.join(this.stateDir, "meta.json");
+    const metaPath = path9.join(this.stateDir, "meta.json");
     try {
       const raw = await this.readStorageSecureFile(metaPath);
       const parsed = JSON.parse(raw);
@@ -9163,7 +9484,7 @@ ${memory.content}
   }
   async saveMeta(state) {
     await this.ensureDirectories();
-    const metaPath = path8.join(this.stateDir, "meta.json");
+    const metaPath = path9.join(this.stateDir, "meta.json");
     await this.writeStorageSecureFile(metaPath, JSON.stringify(state, null, 2));
   }
   async appendMemoryActionEvents(events) {
@@ -9227,7 +9548,7 @@ ${memory.content}
       },
       (payload) => this.appendStorageSecureFile(target, payload),
       async () => {
-        await mkdir(path8.dirname(target), { recursive: true });
+        await mkdir(path9.dirname(target), { recursive: true });
       }
     );
   }
@@ -9325,7 +9646,7 @@ ${memory.content}
   async appendReextractJobs(events) {
     if (events.length === 0) return 0;
     await this.ensureDirectories();
-    const filePath = path8.join(this.stateDir, "reextract-jobs.jsonl");
+    const filePath = path9.join(this.stateDir, "reextract-jobs.jsonl");
     const lines = events.map((event) => JSON.stringify(event)).join("\n") + "\n";
     try {
       await this.appendStorageSecureFile(filePath, lines);
@@ -9338,7 +9659,7 @@ ${memory.content}
   }
   async readReextractJobs(limit = 200) {
     const safeLimit = Number.isFinite(limit) ? Math.max(1, Math.min(1e3, Math.floor(limit))) : 200;
-    const filePath = path8.join(this.stateDir, "reextract-jobs.jsonl");
+    const filePath = path9.join(this.stateDir, "reextract-jobs.jsonl");
     try {
       const raw = await this.readStorageSecureFile(filePath);
       const lines = raw.split("\n").filter((line) => line.trim().length > 0);
@@ -9487,7 +9808,7 @@ ${memory.content}
       return false;
     }
     if (draftState.contentHash) {
-      const contentHash = createHash5("sha256").update(draftContent).digest("hex");
+      const contentHash = createHash6("sha256").update(draftContent).digest("hex");
       if (contentHash !== draftState.contentHash) return false;
     }
     await this.writeCompressionGuidelines(draftContent);
@@ -9565,7 +9886,7 @@ ${question}
 
 **Context:** ${context}
 `;
-    const filePath = path8.join(this.questionsDir, `${id}.md`);
+    const filePath = path9.join(this.questionsDir, `${id}.md`);
     await this.writeStorageSecureFile(filePath, content);
     log.debug(`wrote question ${id} to ${filePath}`);
     this.invalidateQuestionsCache();
@@ -9583,7 +9904,7 @@ ${question}
     if (!match) return null;
     const frontmatterStr = match[1];
     const body = match[2].trim();
-    const id = this.extractFrontmatterValue(frontmatterStr, "id") ?? path8.basename(filePath, ".md");
+    const id = this.extractFrontmatterValue(frontmatterStr, "id") ?? path9.basename(filePath, ".md");
     const created = this.extractFrontmatterValue(frontmatterStr, "created") ?? "";
     const priority = parseFloat(this.extractFrontmatterValue(frontmatterStr, "priority") ?? "0.5");
     const resolved = this.extractFrontmatterValue(frontmatterStr, "resolved") === "true";
@@ -9639,11 +9960,11 @@ ${question}
     } catch {
     }
     const hygiene = opts?.hygiene;
-    const rotateEnabled = hygiene?.enabled === true && hygiene.rotateEnabled === true && Array.isArray(hygiene.rotatePaths) && hygiene.rotatePaths.includes(path8.basename(identityPath));
+    const rotateEnabled = hygiene?.enabled === true && hygiene.rotateEnabled === true && Array.isArray(hygiene.rotatePaths) && hygiene.rotatePaths.includes(path9.basename(identityPath));
     if (rotateEnabled) {
       const maxBytes = hygiene.rotateMaxBytes;
       if (existing.length > maxBytes) {
-        const archiveDir = path8.join(workspaceDir, hygiene.archiveDir);
+        const archiveDir = path9.join(workspaceDir, hygiene.archiveDir);
         const { newContent } = await rotateMarkdownFileToArchive({
           filePath: identityPath,
           archiveDir,
@@ -9903,40 +10224,45 @@ ${reflection}
     if (entries.length === 0) return 0;
     const memories = await this.readAllMemories();
     const memoryMap = new Map(memories.map((m) => [m.frontmatter.id, m]));
-    const memoryPathMap = new Map(memories.map((m) => [path8.resolve(m.path), m]));
+    const memoryPathMap = new Map(memories.map((m) => [path9.resolve(m.path), m]));
     let updated = 0;
     const prevVersion = this.getMemoryCorpusVersion();
     const keyId = this.hotCacheKeyId();
     const warm = this.hotMemoriesCacheEnabled && getCachedMemories(this.baseDir, prevVersion, keyId, this.hotCacheTtlMs()) !== null;
     const appliedPatches = /* @__PURE__ */ new Map();
     for (const entry of entries) {
-      const memory = entry.memoryPath ? memoryPathMap.get(path8.resolve(entry.memoryPath)) : memoryMap.get(entry.memoryId);
+      const memory = entry.memoryPath ? memoryPathMap.get(path9.resolve(entry.memoryPath)) : memoryMap.get(entry.memoryId);
       if (!memory) continue;
-      const rowIds = this.currentHistoricalIds();
-      const newFm = canonicalizeEntityRefOption(
-        { ...memory.frontmatter, accessCount: entry.newCount, lastAccessed: entry.lastAccessed },
-        rowIds
-      );
       try {
-        const fileContent = `${serializeFrontmatter(newFm)}
+        const applied = await this.withTombstoneBlockedMemoryPathLock(memory.path, async (current) => {
+          if (current?.frontmatter.id !== entry.memoryId) return null;
+          const rowIds = this.currentHistoricalIds();
+          const newFm = canonicalizeEntityRefOption(
+            { ...current.frontmatter, accessCount: entry.newCount, lastAccessed: entry.lastAccessed },
+            rowIds
+          );
+          const fileContent = `${serializeFrontmatter(newFm)}
 
-${memory.content}
+${current.content}
 `;
-        await this.writeStorageSecureFile(memory.path, fileContent);
-        if (typeof memory.frontmatter.entityRef === "string") {
-          await this.entityRefRepair.repair(
-            memory.path,
-            newFm,
-            memory.frontmatter.entityRef,
-            rowIds,
-            memory.content,
-            { onFailRestore: memory }
-          );
-        }
+          await this.writeTombstoneBlockedFrontmatter(current, fileContent, newFm);
+          if (typeof current.frontmatter.entityRef === "string") {
+            await this.entityRefRepair.repair(
+              current.path,
+              newFm,
+              current.frontmatter.entityRef,
+              rowIds,
+              current.content,
+              { onFailRestore: current }
+            );
+          }
+          return { current, newFm };
+        });
+        if (applied === null) continue;
         if (warm) {
-          updateCacheOnWrite(this.baseDir, { ...memory, frontmatter: newFm }, keyId);
+          updateCacheOnWrite(this.baseDir, { ...applied.current, frontmatter: applied.newFm }, keyId);
         }
-        appliedPatches.set(path8.resolve(memory.path), {
+        appliedPatches.set(path9.resolve(memory.path), {
           accessCount: entry.newCount,
           lastAccessed: entry.lastAccessed
         });
@@ -9952,7 +10278,7 @@ ${memory.content}
         const cur = getCachedMemories(this.baseDir, prevVersion, keyId);
         if (cur) {
           const reapplied = cur.map((m) => {
-            const patch = appliedPatches.get(path8.resolve(m.path));
+            const patch = appliedPatches.get(path9.resolve(m.path));
             return patch ? {
               ...m,
               frontmatter: { ...m.frontmatter, accessCount: patch.accessCount, lastAccessed: patch.lastAccessed }
@@ -9987,7 +10313,7 @@ ${memory.content}
     const pathsById = /* @__PURE__ */ new Map();
     const filePathsById = /* @__PURE__ */ new Map();
     for (const filePath of filePaths) {
-      const memoryId = path8.basename(filePath, ".md");
+      const memoryId = path9.basename(filePath, ".md");
       if (!wantedIds.has(memoryId)) continue;
       const paths = filePathsById.get(memoryId) ?? [];
       paths.push(filePath);
@@ -9999,7 +10325,7 @@ ${memory.content}
       const preferredMatches = [];
       for (const preferredPath of preferred) {
         const directCandidates = new Set(qmdResultPathCandidates(this.baseDir, preferredPath));
-        const directMatch = existingPaths.find((filePath) => directCandidates.has(path8.resolve(filePath)));
+        const directMatch = existingPaths.find((filePath) => directCandidates.has(path9.resolve(filePath)));
         if (directMatch) {
           preferredMatches.push(directMatch);
           continue;
@@ -10011,7 +10337,7 @@ ${memory.content}
             candidates.add(candidate);
           }
         }
-        const match = existingPaths.find((filePath) => candidates.has(path8.resolve(filePath)));
+        const match = existingPaths.find((filePath) => candidates.has(path9.resolve(filePath)));
         if (match) preferredMatches.push(match);
       }
       if (preferredMatches.length > 0) {
@@ -10102,6 +10428,10 @@ ${memory.content}
     const validAt = normalizeMemoryWriteTimestamp("validAt", options.validAt);
     const chunkInvalidAt = normalizeMemoryWriteTimestamp("invalidAt", options.invalidAt);
     const chunkObservedAt = normalizeMemoryWriteTimestamp("observedAt", options.observedAt);
+    const sanitized = sanitizeMemoryContent(content);
+    if (!sanitized.clean) {
+      log.warn(`chunk content sanitized for ${id}; violations=${sanitized.violations.join(", ")}`);
+    }
     const fm = {
       id,
       category,
@@ -10129,44 +10459,34 @@ ${memory.content}
       ...options.faithfulness ? { faithfulness: options.faithfulness } : {},
       ...options.sources ? { sources: options.sources } : {},
       ...options.provenance ? { provenance: options.provenance } : {},
-      ...options.sourceConnector ? { sourceConnector: options.sourceConnector } : {}
+      ...options.sourceConnector ? { sourceConnector: options.sourceConnector } : {},
+      ...options.toolScoped || withholdToolScopedFromSharedNamespace({
+        content: sanitized.text,
+        sourceConnector: options.sourceConnector
+      }) ? { toolScoped: true } : {}
     };
-    const sanitized = sanitizeMemoryContent(content);
-    if (!sanitized.clean) {
-      log.warn(`chunk content sanitized for ${id}; violations=${sanitized.violations.join(", ")}`);
-    }
     const filePath = await this.resolveCategoryWritePath(category, id, today);
     const fileContent = `${serializeFrontmatter(fm)}
 
 ${sanitized.text}
 `;
-    let priorChunk = null;
-    try {
-      const priorRaw = await readMaybeEncryptedFile(filePath, this._secureStoreKey, this.baseDir);
-      const parsedPrior = parseFrontmatter(priorRaw);
-      if (parsedPrior) {
-        priorChunk = { path: filePath, frontmatter: parsedPrior.frontmatter, content: parsedPrior.content };
-      }
-    } catch {
-      priorChunk = null;
-    }
     const written = await this.writeTombstoneBlockedChunk(
       filePath,
       fileContent,
       fm,
       sanitized.text,
       () => this.findExistingTombstoneBlockedMemory(sanitized.text, category, fm.sourceConnector),
-      async () => {
+      async (priorChunk) => {
+        if (refIds && typeof rawEntityRef === "string") {
+          await this.entityRefRepair.repair(filePath, fm, rawEntityRef, refIds, sanitized.text, {
+            regateFact: true,
+            ...priorChunk ? { onFailRestore: priorChunk } : { onFailRemove: filePath }
+          });
+        }
         await this.patchHotMemoriesCache({ addedPath: filePath }, "memory-create");
         log.debug(`wrote chunk ${id} (${chunkIndex + 1}/${chunkTotal}) to ${filePath}`);
       }
     );
-    if (written === id && refIds && typeof rawEntityRef === "string") {
-      await this.entityRefRepair.repair(filePath, fm, rawEntityRef, refIds, sanitized.text, {
-        regateFact: true,
-        ...priorChunk ? { onFailRestore: priorChunk } : { onFailRemove: filePath }
-      });
-    }
     return written;
   }
   /**
@@ -10189,27 +10509,35 @@ ${sanitized.text}
     const oldMemory = memories.find((m) => m.frontmatter.id === oldMemoryId);
     if (!oldMemory) return false;
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const refIdsAtWrite = this.currentHistoricalIds();
-    const updatedFm = canonicalizeEntityRefOption(
-      { ...oldMemory.frontmatter, status: "superseded", supersededBy: newMemoryId, supersededAt: now, updated: now },
-      refIdsAtWrite
-    );
-    const fileContent = `${serializeFrontmatter(updatedFm)}
-
-${oldMemory.content}
-`;
+    let currentBefore = oldMemory;
+    let updatedFm = oldMemory.frontmatter;
     try {
-      await this.writeStorageSecureFile(oldMemory.path, fileContent);
-      if (typeof oldMemory.frontmatter.entityRef === "string") {
-        await this.entityRefRepair.repair(
-          oldMemory.path,
-          updatedFm,
-          oldMemory.frontmatter.entityRef,
-          refIdsAtWrite,
-          oldMemory.content,
-          { onFailRestore: oldMemory }
+      const written = await this.withTombstoneBlockedMemoryPathLock(oldMemory.path, async (current) => {
+        if (current?.frontmatter.id !== oldMemoryId) return false;
+        currentBefore = current;
+        const refIdsAtWrite = this.currentHistoricalIds();
+        updatedFm = canonicalizeEntityRefOption(
+          { ...current.frontmatter, status: "superseded", supersededBy: newMemoryId, supersededAt: now, updated: now },
+          refIdsAtWrite
         );
-      }
+        const fileContent = `${serializeFrontmatter(updatedFm)}
+
+${current.content}
+`;
+        await this.writeTombstoneBlockedFrontmatter(current, fileContent, updatedFm);
+        if (typeof current.frontmatter.entityRef === "string") {
+          await this.entityRefRepair.repair(
+            current.path,
+            updatedFm,
+            current.frontmatter.entityRef,
+            refIdsAtWrite,
+            current.content,
+            { onFailRestore: current }
+          );
+        }
+        return true;
+      });
+      if (!written) return false;
       this.bumpMemoryCorpusVersion();
       await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.supersedeMemory", {
         memoryId: oldMemoryId,
@@ -10217,20 +10545,20 @@ ${oldMemory.content}
         timestamp: now,
         actor: "storage.supersedeMemory",
         reasonCode: reason,
-        before: this.summarizeLifecycleState(oldMemory.frontmatter, oldMemory.path),
-        after: this.summarizeLifecycleState(updatedFm, oldMemory.path),
+        before: this.summarizeLifecycleState(currentBefore.frontmatter, currentBefore.path),
+        after: this.summarizeLifecycleState(updatedFm, currentBefore.path),
         relatedMemoryIds: [newMemoryId]
       });
       this.bumpMemoryStatusVersion();
       log.debug(`superseded memory ${oldMemoryId} by ${newMemoryId}: ${reason}`);
-      if (oldMemory.frontmatter.category === "fact") {
+      if (currentBefore.frontmatter.category === "fact") {
         for (const input of buildRetiredFactTombstoneInputs(
           {
             id: oldMemoryId,
-            content: stripCitationForTemplate(oldMemory.content, this.citationTemplate),
-            contentHash: oldMemory.frontmatter.contentHash,
+            content: stripCitationForTemplate(currentBefore.content, this.citationTemplate),
+            contentHash: currentBefore.frontmatter.contentHash,
             entityRef: updatedFm.entityRef,
-            structuredAttributes: oldMemory.frontmatter.structuredAttributes
+            structuredAttributes: currentBefore.frontmatter.structuredAttributes
           },
           {
             reason: "contradiction_resolution",
@@ -10242,7 +10570,7 @@ ${oldMemory.content}
           await this.appendTombstone(input);
         }
       }
-      const auditBody = `Superseded: ${oldMemory.content}
+      const auditBody = `Superseded: ${currentBefore.content}
 
 Reason: ${reason}`;
       const auditInput = {
@@ -10263,14 +10591,14 @@ Reason: ${reason}`;
   // Memory Summarization (Phase 4A)
   // ---------------------------------------------------------------------------
   get summariesDir() {
-    return path8.join(this.baseDir, "summaries");
+    return path9.join(this.baseDir, "summaries");
   }
   /**
    * Write a memory summary.
    */
   async writeSummary(summary) {
     await mkdir(this.summariesDir, { recursive: true });
-    const filePath = path8.join(this.summariesDir, `${summary.id}.json`);
+    const filePath = path9.join(this.summariesDir, `${summary.id}.json`);
     await this.writeStorageSecureFile(filePath, JSON.stringify(summary, null, 2));
     log.debug(`wrote summary ${summary.id}`);
   }
@@ -10283,7 +10611,7 @@ Reason: ${reason}`;
       const summaries = [];
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
-        const filePath = path8.join(this.summariesDir, file);
+        const filePath = path9.join(this.summariesDir, file);
         const raw = await this.readStorageSecureFile(filePath);
         summaries.push(JSON.parse(raw));
       }
@@ -10305,27 +10633,35 @@ Reason: ${reason}`;
       const memory = memoryMap.get(id);
       if (!memory) continue;
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const rowIds = this.currentHistoricalIds();
-      const updatedFm = canonicalizeEntityRefOption(
-        { ...memory.frontmatter, status: "archived", archivedAt: now, updated: now },
-        rowIds
-      );
+      let currentBefore = memory;
+      let updatedFm = memory.frontmatter;
       try {
-        const fileContent = `${serializeFrontmatter(updatedFm)}
+        const written = await this.withTombstoneBlockedMemoryPathLock(memory.path, async (current) => {
+          if (current?.frontmatter.id !== id) return false;
+          currentBefore = current;
+          const rowIds = this.currentHistoricalIds();
+          updatedFm = canonicalizeEntityRefOption(
+            { ...current.frontmatter, status: "archived", archivedAt: now, updated: now },
+            rowIds
+          );
+          const fileContent = `${serializeFrontmatter(updatedFm)}
 
-${memory.content}
+${current.content}
 `;
-        await this.writeStorageSecureFile(memory.path, fileContent);
-        if (typeof memory.frontmatter.entityRef === "string") {
-          await this.entityRefRepair.repair(
-            memory.path,
-            updatedFm,
-            memory.frontmatter.entityRef,
-            rowIds,
-            memory.content,
-            { onFailRestore: memory }
-          );
-        }
+          await this.writeTombstoneBlockedFrontmatter(current, fileContent, updatedFm);
+          if (typeof current.frontmatter.entityRef === "string") {
+            await this.entityRefRepair.repair(
+              current.path,
+              updatedFm,
+              current.frontmatter.entityRef,
+              rowIds,
+              current.content,
+              { onFailRestore: current }
+            );
+          }
+          return true;
+        });
+        if (!written) continue;
         this.bumpMemoryCorpusVersion();
         await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.archiveMemories", {
           memoryId: id,
@@ -10333,8 +10669,8 @@ ${memory.content}
           timestamp: updatedFm.archivedAt ?? updatedFm.updated,
           actor: "storage.archiveMemories",
           reasonCode: `summary:${summaryId}`,
-          before: this.summarizeLifecycleState(memory.frontmatter, memory.path),
-          after: this.summarizeLifecycleState(updatedFm, memory.path),
+          before: this.summarizeLifecycleState(currentBefore.frontmatter, currentBefore.path),
+          after: this.summarizeLifecycleState(updatedFm, currentBefore.path),
           relatedMemoryIds: [summaryId]
         });
         archived++;
@@ -10354,7 +10690,7 @@ ${memory.content}
    * Save topic scores to meta.json.
    */
   async saveTopics(topics) {
-    const metaPath = path8.join(this.stateDir, "topics.json");
+    const metaPath = path9.join(this.stateDir, "topics.json");
     await mkdir(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       metaPath,
@@ -10366,7 +10702,7 @@ ${memory.content}
    * Load topic scores from meta.json.
    */
   async loadTopics() {
-    const metaPath = path8.join(this.stateDir, "topics.json");
+    const metaPath = path9.join(this.stateDir, "topics.json");
     try {
       const raw = await this.readStorageSecureFile(metaPath);
       return JSON.parse(raw);
@@ -10484,4 +10820,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-E6PNLPGJ.js.map
+//# sourceMappingURL=chunk-FZP32336.js.map