@remnic/core 9.51.1 → 9.52.1

package/src/storage/supersession-side-effects.ts

@@ -3,11 +3,12 @@ import {
   type TombstoneCreatedBy,
   type TombstoneReason,
 } from "../lifecycle/tombstones.js";
-import { supersessionKeysForFact } from "../temporal-supersession.js";
+import { log } from "../logger.js";
 import { stripCitationForTemplate } from "../source-attribution.js";
+import { supersessionKeysForFact } from "../temporal-supersession.js";
 import type { MemoryFile, MemoryFrontmatter } from "../types.js";
 import { composeMemoryEnvelope, type SealedMemoryEnvelope } from "../write-envelope.js";
-import { log } from "../logger.js";
+import { hasSupersessionAudit } from "./supersession-audit.js";
 
 type TombstoneInput = {
   reason: TombstoneReason;
@@ -16,6 +17,7 @@ type TombstoneInput = {
   rawContent: string;
   entityRef?: string;
   supersessionKey?: string;
+  operationKey?: string;
   createdAt?: string;
   contentHash?: string;
 };
@@ -25,40 +27,45 @@ export interface SupersessionSideEffectOptions {
   newMemoryId: string;
   reason: string;
   now: string;
+  operationId: string;
+  exactReplay: boolean;
   currentBefore: MemoryFile;
   updatedFm: MemoryFrontmatter;
   citationTemplate: string;
+  correctionsDir: string;
+  readMemoryByPath: (filePath: string) => Promise<MemoryFile | null>;
   isColdOrArchiveTierPath: (memoryPath: string) => boolean;
   invalidateColdMemoriesCache: () => void;
+  invalidateAllMemoriesCache: () => void;
   bumpMemoryCorpusVersion: () => void;
   appendLifecycleEvent: () => Promise<void>;
   bumpMemoryStatusVersion: () => void;
+  hasExactTombstone: (input: TombstoneInput) => Promise<boolean>;
   appendTombstone: (input: TombstoneInput) => Promise<string | null>;
-  writeSealedMemory: (envelope: SealedMemoryEnvelope, extras: { lineage: [string, string] }) => Promise<unknown>;
+  writeSealedMemory: (
+    envelope: SealedMemoryEnvelope,
+    extras: { lineage: [string, string]; sourceMemoryId: string }
+  ) => Promise<unknown>;
 }
 
-export async function runSupersessionSideEffects(options: SupersessionSideEffectOptions): Promise<void> {
+export async function runSupersessionSideEffects(options: SupersessionSideEffectOptions): Promise<boolean> {
   const {
     oldMemoryId,
     newMemoryId,
     reason,
     now,
+    operationId,
+    exactReplay,
     currentBefore,
     updatedFm,
     citationTemplate,
-    isColdOrArchiveTierPath,
-    invalidateColdMemoriesCache,
-    bumpMemoryCorpusVersion,
-    appendLifecycleEvent,
-    bumpMemoryStatusVersion,
-    appendTombstone,
-    writeSealedMemory,
   } = options;
   try {
-    if (isColdOrArchiveTierPath(currentBefore.path)) invalidateColdMemoriesCache();
-    bumpMemoryCorpusVersion();
-    await appendLifecycleEvent();
-    bumpMemoryStatusVersion();
+    if (options.isColdOrArchiveTierPath(currentBefore.path)) options.invalidateColdMemoriesCache();
+    if (exactReplay) options.invalidateAllMemoriesCache();
+    else options.bumpMemoryCorpusVersion();
+    await options.appendLifecycleEvent();
+    options.bumpMemoryStatusVersion();
     log.debug(`superseded memory ${oldMemoryId} by ${newMemoryId}: ${reason}`);
 
     if (currentBefore.frontmatter.category === "fact") {
@@ -75,23 +82,43 @@ export async function runSupersessionSideEffects(options: SupersessionSideEffect
           createdBy: "contradiction_resolution",
           createdAt: now,
           supersessionKeysForFact,
-        },
+        }
       )) {
-        await appendTombstone(input);
+        const exactInput = { ...input, operationKey: operationId };
+        const exists = (await options.hasExactTombstone(exactInput)) || (await options.hasExactTombstone(input));
+        if (!exists) await options.appendTombstone(exactInput);
       }
     }
 
-    const auditEnvelope = composeMemoryEnvelope(
+    const auditBody = `Superseded: ${currentBefore.content}\n\nReason: ${reason}`;
+    const auditExists = await hasSupersessionAudit(
       {
-        content: `Superseded: ${currentBefore.content}\n\nReason: ${reason}`,
-        category: "correction",
-        confidence: 1.0,
-        tags: ["supersession", "auto-resolved"],
+        correctionsDir: options.correctionsDir,
+        readMemoryByPath: options.readMemoryByPath,
       },
-      { source: "contradiction-detection" },
+      oldMemoryId,
+      newMemoryId,
+      auditBody
     );
-    await writeSealedMemory(auditEnvelope, { lineage: [oldMemoryId, newMemoryId] });
+    if (!auditExists) {
+      const auditEnvelope = composeMemoryEnvelope(
+        {
+          content: auditBody,
+          category: "correction",
+          confidence: 1,
+          tags: ["supersession", "auto-resolved"],
+        },
+        { source: "contradiction-detection" }
+      );
+      await options.writeSealedMemory(auditEnvelope, {
+        lineage: [oldMemoryId, newMemoryId],
+        sourceMemoryId: oldMemoryId,
+      });
+    }
+    options.invalidateAllMemoriesCache();
+    return true;
   } catch (err) {
-    log.error(`failed to supersede memory ${oldMemoryId}:`, err);
+    log.error(`supersession side effects failed for ${oldMemoryId}:`, err);
+    return false;
   }
 }

package/src/storage-contract/failure-semantics.test.ts

@@ -29,6 +29,18 @@ test("failure-semantics: readAllMemories on a fresh (empty) dir returns [] not n
     await cleanup();
   }
 });
+test("failure-semantics: readArchivedMemories surfaces archive readdir errors", async () => {
+  const { storage, baseDir, cleanup } = await makeStorage();
+  try {
+    await writeFile(path.join(baseDir, "archive"), "archive is not a directory", "utf-8");
+    await assert.rejects(
+      storage.readArchivedMemories(),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOTDIR",
+    );
+  } finally {
+    await cleanup();
+  }
+});
 
 test("failure-semantics: getMemoryById on empty store returns null (not throw)", async () => {
   const { storage, cleanup } = await makeStorage();

package/src/storage-contract/round-trip.test.ts

@@ -12,12 +12,13 @@
  */
 
 import assert from "node:assert/strict";
-import { utimes } from "node:fs/promises";
+import { mkdir, readFile, rm, symlink, utimes, writeFile } from "node:fs/promises";
 import path from "node:path";
 import type { MemoryCategory } from "../types.js";
 import test from "node:test";
 
 import { StorageManager } from "../storage.js";
+import { SecureStoreLockedError } from "../secure-store/secure-fs.js";
 import {
   ALL_CATEGORY_DIRS,
   ALL_CATEGORY_KEYS,
@@ -25,7 +26,7 @@ import {
   RECALL_NON_MEMORY_DIRS,
   categoryDirName,
 } from "../utils/category-dir.js";
-import { makeStorage } from "./harness.js";
+import { makeStorage, rawMemoryMarkdown } from "./harness.js";
 
 /**
  * The singular category keys writeMemory accepts, minus "entity" (entities use
@@ -141,6 +142,165 @@ test("round-trip: invalidateMemory returns false for a non-existent id (not a th
   }
 });
 
+test("round-trip: invalidation does not record commit proof by default", async () => {
+  const { storage, cleanup } = await makeStorage();
+  try {
+    const { id } = await storage.writeMemory("fact", "proof source");
+    const snapshot = await storage.getMemoryById(id);
+    assert.ok(snapshot);
+
+    assert.equal(await storage.invalidateMemory(id), true);
+    assert.equal(await storage.hasCommittedInvalidation(snapshot), false);
+    const explicitOff = await storage.writeMemory("fact", "proof source with explicit off");
+    const explicitSnapshot = await storage.getMemoryById(explicitOff.id);
+    assert.ok(explicitSnapshot);
+    assert.equal(
+      await storage.invalidateMemory(explicitOff.id, undefined, { recordCommitProof: false }),
+      true,
+    );
+    assert.equal(await storage.hasCommittedInvalidation(explicitSnapshot), false);
+  } finally {
+    await cleanup();
+  }
+});
+
+test("round-trip: invalidation commit proof survives restart and rejects a changed snapshot", async () => {
+  const { storage, baseDir, cleanup } = await makeStorage();
+  try {
+    const { id } = await storage.writeMemory("fact", "proof source", {
+      tags: ["proof"],
+    });
+    const snapshot = await storage.getMemoryById(id);
+    assert.ok(snapshot);
+
+    assert.equal(await storage.invalidateMemory(id, undefined, { recordCommitProof: true }), true);
+    assert.equal(await storage.hasCommittedInvalidation(snapshot), true);
+
+    const restarted = new StorageManager(baseDir);
+    assert.equal(await restarted.hasCommittedInvalidation(snapshot), true);
+    assert.equal(
+      await restarted.hasCommittedInvalidation({
+        ...snapshot,
+        frontmatter: {
+          ...snapshot.frontmatter,
+          accessCount: 99,
+          lastAccessed: "2026-08-09T12:00:00.000Z",
+        },
+      }),
+      true,
+    );
+    assert.equal(
+      await restarted.hasCommittedInvalidation({
+        ...snapshot,
+        content: "changed source",
+      }),
+      false,
+    );
+  } finally {
+    await cleanup();
+  }
+});
+test("round-trip: a post-delete failure retains the committed invalidation proof", async () => {
+  const { storage, cleanup } = await makeStorage();
+  try {
+    const { id } = await storage.writeMemory("fact", "proof survives post-delete failure");
+    const snapshot = await storage.getMemoryById(id);
+    assert.ok(snapshot);
+    const managedStorage = storage as unknown as {
+      deleteManagedStorageFile: (filePath: string) => Promise<boolean>;
+      rebuildTombstoneBlockedCaptureAfterInvalidation: (ownedMarker?: string) => Promise<void>;
+    };
+    const originalDelete = managedStorage.deleteManagedStorageFile;
+    managedStorage.deleteManagedStorageFile = async (filePath) => originalDelete.call(storage, filePath);
+    managedStorage.rebuildTombstoneBlockedCaptureAfterInvalidation = async () => {
+      throw new Error("synthetic post-delete failure");
+    };
+
+    assert.equal(
+      await storage.invalidateMemory(id, snapshot, { recordCommitProof: true }),
+      false,
+    );
+    assert.equal(await storage.readMemoryByPath(snapshot.path), null);
+    assert.equal(await storage.hasCommittedInvalidation(snapshot), true);
+  } finally {
+    await cleanup();
+  }
+});
+
+test("round-trip: dependency propagation queue rejects symlinks in root, parent, and target paths", async () => {
+  const { storage, baseDir, cleanup } = await makeStorage("remnic-dependency-queue-symlink-");
+  const rootLink = path.join(path.dirname(baseDir), `${path.basename(baseDir)}-root-link`);
+  const parentTarget = path.join(path.dirname(baseDir), `${path.basename(baseDir)}-parent-target`);
+  const parentLink = path.join(baseDir, "queue-parent-link");
+  const targetFile = path.join(path.dirname(baseDir), `${path.basename(baseDir)}-target.json`);
+  const targetLink = path.join(baseDir, "queue-target-link.json");
+  const payload = JSON.stringify({ value: "synthetic" });
+  try {
+    await symlink(baseDir, rootLink, "dir");
+    const storageWithSymlinkRoot = storage as unknown as { baseDir: string };
+    const originalBaseDir = storageWithSymlinkRoot.baseDir;
+    try {
+      storageWithSymlinkRoot.baseDir = rootLink;
+      const rootQueuePath = path.join(rootLink, "state", "dependency-propagation", "ready", "job.json");
+      await assert.rejects(() => storage.readDependencyPropagationQueueFile(rootQueuePath));
+      await assert.rejects(() => storage.writeDependencyPropagationQueueFile(rootQueuePath, payload));
+    } finally {
+      storageWithSymlinkRoot.baseDir = originalBaseDir;
+    }
+
+    await mkdir(parentTarget, { recursive: true });
+    await symlink(parentTarget, parentLink, "dir");
+    const parentQueuePath = path.join(parentLink, "job.json");
+    await assert.rejects(() => storage.readDependencyPropagationQueueFile(parentQueuePath));
+    await assert.rejects(() => storage.writeDependencyPropagationQueueFile(parentQueuePath, payload));
+
+    await writeFile(targetFile, payload, "utf8");
+    await symlink(targetFile, targetLink);
+    await assert.rejects(() => storage.readDependencyPropagationQueueFile(targetLink));
+    await assert.rejects(() => storage.writeDependencyPropagationQueueFile(targetLink, payload));
+  } finally {
+    await rm(rootLink, { recursive: true, force: true });
+    await rm(parentLink, { recursive: true, force: true });
+    await rm(parentTarget, { recursive: true, force: true });
+    await rm(targetLink, { force: true });
+    await rm(targetFile, { force: true });
+    await cleanup();
+  }
+});
+
+test("dependency propagation queue storage encrypts payload and fails closed while locked", async () => {
+  const { storage, baseDir, cleanup } = await makeStorage("remnic-dependency-queue-storage-");
+  const queuePath = path.join(baseDir, "state", "dependency-propagation", "ready", "job.json");
+  const payload = JSON.stringify({ secret: "synthetic queue payload" });
+  const key = Buffer.alloc(32, 37);
+  try {
+    storage.setSecureStoreRequired(true);
+    storage.setSecureStoreKey(key);
+    await storage.writeDependencyPropagationQueueFile(queuePath, payload);
+
+    const raw = await readFile(queuePath, "utf8");
+    assert.doesNotMatch(raw, /synthetic queue payload/);
+
+    const unlocked = new StorageManager(baseDir);
+    unlocked.setSecureStoreRequired(true);
+    unlocked.setSecureStoreKey(key);
+    assert.equal(await unlocked.readDependencyPropagationQueueFile(queuePath), payload);
+
+    const locked = new StorageManager(baseDir);
+    locked.setSecureStoreRequired(true);
+    await assert.rejects(
+      () => locked.readDependencyPropagationQueueFile(queuePath),
+      SecureStoreLockedError,
+    );
+    await assert.rejects(
+      () => locked.writeDependencyPropagationQueueFile(queuePath, payload),
+      SecureStoreLockedError,
+    );
+  } finally {
+    await cleanup();
+  }
+});
+
 test("round-trip: getMemoryById returns null for a non-existent id", async () => {
   const { storage, cleanup } = await makeStorage();
   try {
@@ -163,6 +323,28 @@ test("round-trip: readMemoryByPath returns null for a non-existent path", async
   }
 });
 
+test("round-trip: archive fallback skips a bad file and returns readable siblings", async () => {
+  const { storage, baseDir, cleanup } = await makeStorage("remnic-archive-fallback-");
+  try {
+    const archiveDir = path.join(baseDir, "archive", "2026-08-10");
+    await mkdir(archiveDir, { recursive: true });
+    await writeFile(
+      path.join(archiveDir, "readable.md"),
+      rawMemoryMarkdown("archived-readable", "fact", "readable archive content"),
+      "utf-8",
+    );
+    await writeFile(path.join(archiveDir, "broken.md"), "not markdown", "utf-8");
+
+    const archived = await storage.readArchivedMemories();
+    assert.deepEqual(
+      archived.map((memory) => memory.frontmatter.id),
+      ["archived-readable"],
+    );
+  } finally {
+    await cleanup();
+  }
+});
+
 test("round-trip: ALL_CATEGORY_DIRS is exactly facts + every CATEGORY_DIR_MAP value", () => {
   // ALL_CATEGORY_DIRS must contain directory NAMES (facts, decisions, ...) not
   // singular keys (fact, decision, ...). This guards the parity between

package/src/storage-deletion-revisions.test.ts

@@ -1,10 +1,31 @@
 import * as assert from "node:assert/strict";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { test } from "node:test";
+import { DeletionRevisionStore } from "./storage/deletion-revision-store.js";
+import type { MemoryFile } from "./types.js";
 import { StorageManager } from "./storage.js";
 
+function createDeletionRevisionStore(baseDir: string): DeletionRevisionStore {
+  const metadataDir = path.join(baseDir, ".offline-sync");
+  return new DeletionRevisionStore({
+    baseDir,
+    deletionRevisionMetadataPath: path.join(metadataDir, "deletion-revisions.v1.json"),
+    invalidationCommitMetadataPath: path.join(metadataDir, "invalidation-commits.v1.json"),
+    deletionRevisionLockPath: path.join(metadataDir, "deletion-revisions.v1.json.lock"),
+    assertManagedStoragePath: (filePath) => path.resolve(filePath),
+  });
+}
+
+function proofMemory(id = "memory-1"): MemoryFile {
+  return {
+    path: `facts/${id}.md`,
+    content: "proof source",
+    frontmatter: { id },
+  } as MemoryFile;
+}
+
 test("storage persists the actual revision time for a successful path deletion", async () => {
   const root = await mkdtemp(path.join(os.tmpdir(), "remnic-deletion-revision-"));
   try {
@@ -89,3 +110,194 @@ test("storage merges a known replicated deletion revision for an already-absent
     await rm(root, { recursive: true, force: true });
   }
 });
+
+test("deletion revision and proof stores reject a symlinked storage root", async () => {
+  const outside = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-root-outside-"));
+  const rootLink = path.join(path.dirname(outside), `${path.basename(outside)}-link`);
+  try {
+    await symlink(outside, rootLink, "dir");
+    const store = createDeletionRevisionStore(rootLink);
+
+    await assert.rejects(store.readDeletionRevisions(), /must not pass through a symlink/);
+    await assert.rejects(store.recordCommittedInvalidation(proofMemory()), /must not pass through a symlink/);
+    await assert.rejects(
+      lstat(path.join(outside, ".offline-sync")),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOENT",
+    );
+  } finally {
+    await rm(rootLink, { force: true });
+    await rm(outside, { recursive: true, force: true });
+  }
+});
+
+test("deletion revision and proof stores reject a symlinked metadata parent before outside writes", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-parent-root-"));
+  const outside = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-parent-outside-"));
+  try {
+    await symlink(outside, path.join(root, ".offline-sync"), "dir");
+    const store = createDeletionRevisionStore(root);
+
+    await assert.rejects(
+      store.recordReplicatedDeletionRevision(path.join(root, "facts", "deleted.md"), 2000),
+      /must not pass through a symlink/,
+    );
+    await assert.rejects(store.recordCommittedInvalidation(proofMemory()), /must not pass through a symlink/);
+    await assert.rejects(
+      lstat(path.join(outside, "deletion-revisions.v1.json")),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOENT",
+    );
+    await assert.rejects(
+      lstat(path.join(outside, "invalidation-commits.v1.json")),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOENT",
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+    await rm(outside, { recursive: true, force: true });
+  }
+});
+
+test("deletion revision and proof stores reject symlinked metadata targets before outside reads or writes", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-target-root-"));
+  const outside = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-target-outside-"));
+  const deletionSentinel = path.join(outside, "deletion-sentinel");
+  const proofSentinel = path.join(outside, "proof-sentinel");
+  try {
+    const metadataDir = path.join(root, ".offline-sync");
+    await mkdir(metadataDir, { recursive: true });
+    await writeFile(deletionSentinel, "deletion sentinel");
+    await writeFile(proofSentinel, "proof sentinel");
+    await symlink(deletionSentinel, path.join(metadataDir, "deletion-revisions.v1.json"));
+    await symlink(proofSentinel, path.join(metadataDir, "invalidation-commits.v1.json"));
+    const store = createDeletionRevisionStore(root);
+
+    await assert.rejects(store.readDeletionRevisions(), /must not pass through a symlink/);
+    await assert.rejects(
+      store.recordCommittedInvalidation(proofMemory()),
+      /must not pass through a symlink/,
+    );
+    assert.equal(await readFile(deletionSentinel, "utf8"), "deletion sentinel");
+    assert.equal(await readFile(proofSentinel, "utf8"), "proof sentinel");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+    await rm(outside, { recursive: true, force: true });
+  }
+});
+
+test("managed deletion and write reject a symlinked storage-file parent before outside access", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-file-root-"));
+  const outside = await mkdtemp(path.join(os.tmpdir(), "remnic-symlink-file-outside-"));
+  const outsideDeleted = path.join(outside, "deleted.md");
+  const outsideWritten = path.join(outside, "written.md");
+  try {
+    await writeFile(outsideDeleted, "must remain");
+    await symlink(outside, path.join(root, "facts"), "dir");
+    const store = createDeletionRevisionStore(root);
+
+    await assert.rejects(
+      store.deleteManagedStorageFile(path.join(root, "facts", "deleted.md")),
+      /must not pass through a symlink/,
+    );
+    await assert.rejects(
+      store.writeManagedStorageFile(path.join(root, "facts", "written.md"), async () => {
+        await writeFile(outsideWritten, "must not write");
+      }),
+      /must not pass through a symlink/,
+    );
+    assert.equal(await readFile(outsideDeleted, "utf8"), "must remain");
+    await assert.rejects(
+      lstat(outsideWritten),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOENT",
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+    await rm(outside, { recursive: true, force: true });
+  }
+});
+test("failed proof rollback stays quarantined and fails closed", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-invalidation-proof-quarantine-"));
+  try {
+    const store = createDeletionRevisionStore(root);
+    const memory = proofMemory("quarantine-memory");
+    await store.recordCommittedInvalidation(memory);
+    const internal = store as unknown as {
+      writeInvalidationCommitMetadata: (...args: unknown[]) => Promise<void>;
+    };
+    internal.writeInvalidationCommitMetadata = async () => {
+      throw new Error("synthetic proof rollback failure");
+    };
+
+    await assert.rejects(
+      store.clearCommittedInvalidation(memory),
+      /synthetic proof rollback failure/,
+    );
+    assert.equal(await store.hasCommittedInvalidation(memory), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+test("proof quarantine is instance-scoped and does not mask durable proof in another store", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-invalidation-proof-quarantine-instance-"));
+  try {
+    const writer = createDeletionRevisionStore(root);
+    const reader = createDeletionRevisionStore(root);
+    const memory = proofMemory("instance-scoped-quarantine");
+    await writer.recordCommittedInvalidation(memory);
+
+    const internal = writer as unknown as {
+      writeInvalidationCommitMetadata: (...args: unknown[]) => Promise<void>;
+    };
+    internal.writeInvalidationCommitMetadata = async () => {
+      throw new Error("synthetic proof rollback failure");
+    };
+
+    await assert.rejects(
+      writer.clearCommittedInvalidation(memory),
+      /synthetic proof rollback failure/,
+    );
+    assert.equal(await writer.hasCommittedInvalidation(memory), false);
+    assert.equal(await reader.hasCommittedInvalidation(memory), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+test("failed proof rollback quarantine stays bounded and fails closed after the cap", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-invalidation-proof-quarantine-cap-"));
+  try {
+    const store = createDeletionRevisionStore(root);
+    const internal = store as unknown as {
+      invalidationProofQuarantine: Set<string>;
+      writeInvalidationCommitMetadata: (...args: unknown[]) => Promise<void>;
+    };
+    const originalWrite = internal.writeInvalidationCommitMetadata;
+    for (let index = 0; index <= 1024; index += 1) {
+      const memory = proofMemory(`bounded-quarantine-${index}`);
+      await store.recordCommittedInvalidation(memory);
+      internal.writeInvalidationCommitMetadata = async () => {
+        throw new Error("synthetic proof rollback failure");
+      };
+      await assert.rejects(store.clearCommittedInvalidation(memory), /synthetic proof rollback failure/);
+      internal.writeInvalidationCommitMetadata = originalWrite;
+    }
+
+    const quarantinedBeforeOverflow = proofMemory("bounded-quarantine-0");
+    assert.equal(await store.hasCommittedInvalidation(quarantinedBeforeOverflow), false);
+
+    const recordedAfterOverflow = proofMemory("recorded-after-quarantine-cap");
+    await store.recordCommittedInvalidation(recordedAfterOverflow);
+    assert.equal(await store.hasCommittedInvalidation(recordedAfterOverflow), true);
+    internal.writeInvalidationCommitMetadata = async () => {
+      throw new Error("synthetic post-overflow rollback failure");
+    };
+    await assert.rejects(
+      store.clearCommittedInvalidation(recordedAfterOverflow),
+      /synthetic post-overflow rollback failure/,
+    );
+    assert.equal(await store.hasCommittedInvalidation(recordedAfterOverflow), false);
+    internal.writeInvalidationCommitMetadata = originalWrite;
+    await store.recordCommittedInvalidation(recordedAfterOverflow);
+    assert.equal(await store.hasCommittedInvalidation(recordedAfterOverflow), true);
+    assert.equal(internal.invalidationProofQuarantine.size, 1024);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});