@remnic/core 9.52.2 → 9.53.0

package/src/storage.ts

@@ -13,7 +13,11 @@ import {
 } from "node:fs/promises";
 import { appendFileSync, createReadStream, mkdirSync, readFileSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { normalizeContent, computeContentHash } from "./content-hash.js";
+import {
+  computeContentHash,
+  computeLegacyContentHash,
+  normalizeContent,
+} from "./content-hash.js";
 import { raceAbort } from "./abort-error.js";
 import { checkCorpusReadAbort, type CorpusReadOptions } from "./corpus-read-cancellation.js";
 import { selectArtifactMatches, type ArtifactSearchOptions } from "./artifact-search.js";
@@ -115,7 +119,6 @@ import {
   sortStructuredSectionsBySchema,
 } from "./entity-schema.js";
 import {
-  hasCitation,
   hasCitationForTemplate,
   stripCitationForTemplate,
   DEFAULT_CITATION_FORMAT,
@@ -1058,7 +1061,7 @@ const FACT_HASH_INDEX_REBUILD_RETRY_BASE_MS = 50;
 // the coding surfaces + wearable service). Imported here so internal callers
 // (snapshotBeforeWrite, snapshotForProvenance) resolve, and re-exported to
 // keep the public storage API stable for existing callers (wearables, dist).
-import { assemblePersistedBody, stripAttributesSuffix } from "./structured-attributes.js";
+import { assemblePersistedBody, storedContentIdentityCandidates, stripAttributesSuffix } from "./structured-attributes.js";
 export { stripAttributesSuffix };
 
 // `normalizeAttributePairs` moved to ./structured-attributes.ts (issue #1989
@@ -3009,22 +3012,51 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
   }
 
   private buildTombstoneStore(): TombstoneStore {
+    let sourcePathsPromise: Promise<string[]> | undefined;
+    let sourceContentsByIdPromise: Promise<Map<string, readonly string[]>> | undefined;
     const options: TombstoneStoreOptions = {
       enabled: this.tombstonesConfig.enabled,
       semanticMatch: this.tombstonesConfig.semanticMatch,
       semanticThreshold: this.tombstonesConfig.semanticThreshold,
-      // Wire the SAME helpers the dedup index uses (rule 23 / checklist §13):
-      // hashContent = ContentHashIndex.computeHash, normalizeText =
-      // ContentHashIndex.normalizeContent. Importing them here (not copying)
-      // guarantees the tombstone tiers can never drift from dedup.
       hashContent: ContentHashIndex.computeHash,
       normalizeText: ContentHashIndex.normalizeContent,
+      sourceContentsForMemoryIds: async (sourceMemoryIds) => {
+        const requested = new Set(sourceMemoryIds);
+        const sourcePaths = await (sourcePathsPromise ??=
+          this.memoryReadStore.collectTombstoneMigrationPaths());
+        const directPaths = sourcePaths.filter((filePath) =>
+          requested.has(path.basename(filePath, ".md"))
+        );
+        const contents = new Map<string, readonly string[]>();
+        for (const memory of await this.readParsedMemoriesFromPaths(directPaths, 50)) {
+          const id = memory.frontmatter.id;
+          if (requested.has(id) && !contents.has(id)) {
+            contents.set(id, this.storedContentIdentityCandidates(memory.content));
+          }
+        }
+        if (contents.size === requested.size) return contents;
+        sourceContentsByIdPromise ??= (async () => {
+          const allContents = new Map<string, readonly string[]>();
+          for (const memory of await this.readParsedMemoriesFromPaths(sourcePaths, 50)) {
+            const id = memory.frontmatter.id;
+            if (!allContents.has(id)) {
+              allContents.set(id, this.storedContentIdentityCandidates(memory.content));
+            }
+          }
+          return allContents;
+        })();
+        const allContents = await sourceContentsByIdPromise;
+        for (const id of requested) {
+          const content = allContents.get(id);
+          if (content !== undefined) contents.set(id, content);
+        }
+        return contents;
+      },
     };
     const io: TombstoneFileIo = {
       read: (filePath) => this.readStorageSecureFile(filePath),
       append: (filePath, content) => this.appendStorageSecureFile(filePath, content),
       write: (filePath, content) => this.writeStorageSecureFile(filePath, content),
-      // stat lets the store own its cross-process staleness probe (#1579).
       stat: (filePath) => statSync(filePath),
     };
     return new TombstoneStore(this.tombstonesPath, this.tombstonesConfig.namespace, options, io);
@@ -3263,13 +3295,14 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     }
     this.factHashIndexAuthoritative = false;
     this.factHashIndexAuthoritativePromise = (async () => {
-      // Round 11: ALWAYS rebuild the fact-hash index from the durable corpus on
-      // first use per process — no on-disk "ready" marker is written or trusted,
-      // so a deferred write, crash, or multi-process interleave can never leave a
-      // stale index trusted. The scan AND publish run under the SAME per-index
-      // cross-process lock the reconciling saves use (rebuildUnderLock), so the
-      // rebuild can never overwrite a peer's newer lock-merged or deferred
-      // additions with an unlocked overwrite.
+      // ALWAYS rebuild the index from the durable corpus on first use per
+      // process, preserving the #2016 crash/restart invariant. Markerless
+      // legacy indexes additionally require body-derived hashes because their
+      // frontmatter.contentHash values may use the old normalizer.
+      //
+      // The scan and publish run under the SAME per-index cross-process lock
+      // used by reconcile saves, so migration cannot overwrite a peer's newer
+      // additions with an unlocked write.
       //
       // PR #2016 (findings 1-2): bounded-retry the LOCKED rebuild so transient
       // contention (a peer mid reconcile-save) clears within a short budget
@@ -3284,7 +3317,9 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
       const baseMs = this.factHashIndexLockOptions.retryBaseMs ?? FACT_HASH_INDEX_REBUILD_RETRY_BASE_MS;
       let published = false;
       for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-        published = await factHashIndex.rebuildUnderLock(() => this.rebuildFactHashIndexFromCorpus(factHashIndex));
+        published = await factHashIndex.rebuildUnderLock(() =>
+          this.rebuildFactHashIndexFromCorpus(factHashIndex)
+        );
         if (published || attempt === maxAttempts - 1) break;
         const wait = Math.min(baseMs * 2 ** attempt, CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);
         await new Promise<void>((resolve) => setTimeout(resolve, wait));
@@ -3346,17 +3381,16 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
       // citation-strip reconstruction below, hashing the stored persist body
       // (title + steps) exactly as buildProcedurePersistBody registered it.
       if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") continue;
-      const hash = this.corpusRegisteredHash(memory);
-      if (hash === null) {
-        // Body carries a citation from an unknown/custom template we cannot
-        // safely strip — skip rather than register a wrong hash. A
-        // false-negative miss beats a wrong entry that would permanently
-        // suppress legitimate duplicate writes (see corpusRegisteredHash).
+      const hashes = this.corpusRegisteredHashes(memory);
+      if (hashes.length === 0) {
+        // Skip bodies whose configured citation cannot be stripped safely.
         legacyRecovered++;
         continue;
       }
-      factHashIndex.addByHash(hash);
-      if (memory.frontmatter.category === "fact") this.factOnlyHashes.add(hash);
+      for (const hash of hashes) {
+        factHashIndex.addByHash(hash);
+        if (memory.frontmatter.category === "fact") this.factOnlyHashes.add(hash);
+      }
     }
     if (legacyRecovered > 0) {
       log.info(
@@ -3364,39 +3398,28 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
       );
     }
   }
-  /**
-   * The content-hash the corpus rebuild registers for `memory`, or null when the
-   * body carries a citation from an unknown/custom template that cannot be
-   * safely stripped. Shared by the authoritative rebuild and the fact-only
-   * corpus confirmation (`hasFactContentHash`) so both derive the identical
-   * hash for a given stored body.
-   *
-   * Preference order:
-   *  1. frontmatter.contentHash — the raw pre-citation hash writeMemory records
-   *     for facts (issue #369 round 8); matches hasFactContentHash(rawFact).
-   *  2. Reconstruct from the stored body: strip the "[Attributes: …]" suffix
-   *     writeMemory appends for structuredAttributes (registration hashed the
-   *     raw canonical content WITHOUT it — a no-op when absent), then strip a
-   *     recognised citation and hash the bare body, or hash a citation-free
-   *     body as-is.
-   *  3. A body with a citation from an unknown/custom template → null: a
-   *     false-negative miss beats a wrong hash that would permanently suppress
-   *     legitimate duplicate writes.
-   */
-  private corpusRegisteredHash(memory: MemoryFile): string | null {
-    if (memory.frontmatter.contentHash) {
-      return memory.frontmatter.contentHash;
-    }
-    const content = stripAttributesSuffix(memory.content);
-    const stripped = stripCitationForTemplate(content, this.citationTemplate);
-    if (stripped !== content) {
-      return ContentHashIndex.computeHash(sanitizeMemoryContent(stripped).text);
-    }
-    if (!hasCitation(content)) {
-      return ContentHashIndex.computeHash(sanitizeMemoryContent(content).text);
-    }
-    return null;
+  private storedContentIdentityCandidates(content: string): string[] {
+    return storedContentIdentityCandidates(content, (value) =>
+      hasCitationForTemplate(value, this.citationTemplate) ? stripCitationForTemplate(value, this.citationTemplate) : value
+    );
+  }
+
+  /** Returns the current body identity while preserving explicit external identities. */
+  private corpusRegisteredHashes(memory: MemoryFile): string[] {
+    const persistedHash = memory.frontmatter.contentHash;
+    const candidates = this.storedContentIdentityCandidates(memory.content)
+      .map((content) => sanitizeMemoryContent(content).text);
+    const currentHashes = candidates.map((content) => ContentHashIndex.computeHash(content));
+    if (persistedHash && currentHashes.includes(persistedHash)) return [persistedHash];
+    if (!persistedHash) return [currentHashes[0] ?? ContentHashIndex.computeHash("")];
+    const legacyMatches = candidates.filter(
+      (content) => computeLegacyContentHash(content) === persistedHash
+    );
+    return legacyMatches.length > 0
+      ? [...new Set(legacyMatches.map((content) => ContentHashIndex.computeHash(content)))]
+      : [persistedHash];
   }
+
   private get questionsDir(): string {
     return path.join(this.baseDir, "questions");
   }
@@ -3787,10 +3810,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     let tombstoneBlocked = false;
     let gateRef: string | undefined;
     let statusBeforeBlock: MemoryFrontmatter["status"];
-    // Closure so the post-persist repair can RE-RUN it when a journal move
-    // changed the final entityRef: a verdict is only valid for the ref it was
-    // computed under, so reset and re-evaluate (parked mappings fall BACK to
-    // the legacy claimant; entity-independent tiers re-block in the lookup).
+    // Re-run after journal moves that change the final entityRef.
     const applyTombstoneGate = async (): Promise<void> => {
       if (tombstoneBlocked) {
         if (fm.entityRef === gateRef) return;
@@ -3799,11 +3819,9 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
         delete fm.blockedBy;
         delete fm.tombstoneBlockTier;
       }
-      // Status semantics (thread ObteQ: pending_review candidates included,
-      // terminal statuses respected) live in applyTombstoneResurrectionGate.
       if (category !== "fact" || factHashSourceForTombstone === null) return;
       const statusBefore = fm.status;
-      const match = await this.entityRefRepair.gate(fm, factHashSourceForTombstone, options.structuredAttributes);
+      const match = await this.entityRefRepair.gate(fm, sanitized.text, options.structuredAttributes);
       if (match) {
         gateRef = fm.entityRef;
         statusBeforeBlock = statusBefore;
@@ -3980,34 +3998,28 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     for (const memory of existing) {
       if (memory.frontmatter.category !== "fact") continue;
       if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") continue;
-      if (this.corpusRegisteredHash(memory) === targetHash) return true;
+      if (this.corpusRegisteredHashes(memory).includes(targetHash)) return true;
     }
     return false;
   }
 
-  private factContentHashForRemoval(memory: MemoryFile): string | null {
-    if (memory.frontmatter.category !== "fact") return null;
-    if (typeof memory.frontmatter.contentHash === "string" && memory.frontmatter.contentHash.length > 0) {
-      return memory.frontmatter.contentHash;
-    }
-    const configuredHashSource = stripCitationMarkersForHashRemoval(memory.content, this.citationTemplate);
-    const hashSource =
-      configuredHashSource !== memory.content
-        ? configuredHashSource
-        : stripDefaultCitationMarkersWithoutRegex(memory.content);
-    return ContentHashIndex.computeHash(sanitizeMemoryContent(hashSource).text);
+  private factContentHashesForRemoval(memory: MemoryFile): string[] {
+    if (memory.frontmatter.category !== "fact") return [];
+    return this.corpusRegisteredHashes(memory);
   }
 
   private async addActiveFactContentHash(memory: MemoryFile): Promise<void> {
     if (memory.frontmatter.category !== "fact") return;
     if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") return;
-    const hash = this.factContentHashForRemoval(memory);
-    if (!hash) return;
+    const hashes = this.factContentHashesForRemoval(memory);
+    if (hashes.length === 0) return;
 
     await this.ensureFactHashIndexAuthoritative();
     const factHashIndex = await this.getFactHashIndex();
-    factHashIndex.addByHash(hash);
-    this.factOnlyHashes.add(hash);
+    for (const hash of hashes) {
+      factHashIndex.addByHash(hash);
+      this.factOnlyHashes.add(hash);
+    }
     // PR #2016 thread SDzOP: flush through the SAME cross-process locked
     // reconcile the write/batch/rebuild paths use, never the unlocked whole-file
     // save() — an unlocked overwrite drops a concurrent extraction's appended
@@ -4045,16 +4057,19 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
   private async syncFactHashIndexAfterRewrite(before: MemoryFile, after: MemoryFile): Promise<void> {
     if (before.frontmatter.category !== "fact" && after.frontmatter.category !== "fact") return;
 
-    const beforeHash = this.factContentHashForRemoval(before);
-    const afterHash = this.factContentHashForRemoval(after);
+    const beforeHashes = this.factContentHashesForRemoval(before);
+    const afterHashes = this.factContentHashesForRemoval(after);
     const beforeStatus = inferMemoryStatus(before.frontmatter, before.path);
     const afterStatus = inferMemoryStatus(after.frontmatter, after.path);
-    if (beforeHash === afterHash && beforeStatus === afterStatus) return;
+    const hashesChanged =
+      beforeHashes.length !== afterHashes.length ||
+      beforeHashes.some((hash, index) => hash !== afterHashes[index]);
+    if (!hashesChanged && beforeStatus === afterStatus) return;
 
-    if (beforeStatus === "active" && beforeHash && (beforeHash !== afterHash || afterStatus !== "active")) {
+    if (beforeStatus === "active" && beforeHashes.length > 0 && (hashesChanged || afterStatus !== "active")) {
       await this.removeFactContentHashesForMemories([before]);
     }
-    if (afterStatus === "active" && afterHash && (beforeHash !== afterHash || beforeStatus !== "active")) {
+    if (afterStatus === "active" && afterHashes.length > 0 && (hashesChanged || beforeStatus !== "active")) {
       await this.addActiveFactContentHash(after);
     }
   }
@@ -4067,11 +4082,10 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
         .map((memory) => memory.frontmatter.id)
         .filter((id): id is string => typeof id === "string" && id.length > 0)
     );
-    const removedHashes = new Map<MemoryFile, string>();
+    const removedHashes = new Set<string>();
     for (const memory of memories) {
-      const hash = this.factContentHashForRemoval(memory);
-      if (hash) {
-        removedHashes.set(memory, hash);
+      for (const hash of this.factContentHashesForRemoval(memory)) {
+        removedHashes.add(hash);
       }
     }
     if (removedHashes.size === 0) return;
@@ -4082,13 +4096,12 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
       if (memory.frontmatter.category !== "fact") continue;
       if (removedIds.has(memory.frontmatter.id)) continue;
       if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") continue;
-      const hash = this.factContentHashForRemoval(memory);
-      if (hash) {
+      for (const hash of this.factContentHashesForRemoval(memory)) {
         remainingActiveHashes.add(hash);
       }
     }
 
-    for (const hash of removedHashes.values()) {
+    for (const hash of removedHashes) {
       if (!remainingActiveHashes.has(hash)) {
         factHashIndex.removeByHash(hash);
         this.factOnlyHashes.delete(hash);
@@ -4117,8 +4130,9 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
    */
   removeFactOnlyHashForMemory(memory: MemoryFile): void {
     if (memory.frontmatter.category !== "fact") return;
-    const hash = this.factContentHashForRemoval(memory);
-    if (hash) this.factOnlyHashes.delete(hash);
+    for (const hash of this.factContentHashesForRemoval(memory)) {
+      this.factOnlyHashes.delete(hash);
+    }
   }
 
   async isFactContentHashAuthoritative(): Promise<boolean> {

package/src/structured-attributes.ts

@@ -39,6 +39,17 @@ export function stripAttributesSuffix(content: string): string {
   if (inner.includes("]") || inner.includes("\n")) return content.trim();
   return trimmed.slice(0, markerIndex).trim();
 }
+
+/** Return stored-body identity forms, from raw semantic content to full body. */
+export function storedContentIdentityCandidates(
+  content: string,
+  stripCitation: (value: string) => string,
+): string[] {
+  const fullBody = content.trim();
+  const bodyWithoutAttributes = stripAttributesSuffix(fullBody);
+  const rawBody = stripCitation(bodyWithoutAttributes);
+  return [...new Set([rawBody, bodyWithoutAttributes, fullBody])];
+}
 // ---------------------------------------------------------------------------
 // Persisted-body assembly (issue #1989 PR2)
 // ---------------------------------------------------------------------------

package/dist/chunk-BQIFZ2MP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/storage/content-hash-index.ts"],"sourcesContent":["// Content-hash dedup index for facts, extracted from storage.ts (issue #1909 /\n// PR #2016 write-hot-paths). Self-contained: cross-process locked reconcile /\n// rebuild saves plus the deferred durable-retry machinery. storage.ts imports\n// these back and re-exports the class + companion types that were previously\n// part of its public API.\nimport { mkdir, stat } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { log } from \"../logger.js\";\nimport { isErrnoCode } from \"../utils/errno.js\";\nimport { withHeldFileLock } from \"../utils/serialize-mutations.js\";\nimport { normalizeContent, computeContentHash } from \"../content-hash.js\";\nimport {\n  SecureStoreLockedError,\n  readMaybeEncryptedFile,\n  writeMaybeEncryptedFile,\n} from \"../secure-store/secure-fs.js\";\n\n/**\n * Stale threshold (ms) for the per-file advisory lock guarding a fact-hash\n * index merge-save (issue #1909 review round 7). The critical section is a\n * single read+atomic-rewrite of one index file (≤ a few MB), so a holder older\n * than this is treated as crashed. Generous to tolerate slow/encrypted disks\n * without breaking a legitimately in-progress publish.\n */\nconst CONTENT_HASH_INDEX_LOCK_STALE_MS = 30_000;\n\n/**\n * Durable-retry policy for a deferred content-hash reconcile save whose\n * cross-process lock acquire timed out (issue #1909 / PR #2016). When the lock\n * is contended past `withHeldFileLock`'s bounded wait, the added hashes are held\n * only in this process's memory; relying on \"some later batch save\" is not\n * durable (the run may be the last before idle/shutdown), and a long-lived peer\n * that already built its authoritative in-memory index will not see the write.\n * So we schedule a bounded, exponentially-backed-off background retry that keeps\n * re-attempting the locked publish until it lands. Bounded because the durable\n * fact `.md` is already on disk and a process restart rebuilds the index from\n * the corpus regardless — exhausting retries degrades to that rebuild safety\n * net, never to data loss or a fatal append failure.\n */\nconst CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS = 5;\n/** Base backoff (ms) before the first deferred reconcile-save retry; doubles each attempt. */\nconst CONTENT_HASH_INDEX_RETRY_BASE_MS = 500;\n/** Ceiling (ms) for the exponential reconcile-save retry backoff. */\nexport const CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS = 5_000;\n\n/**\n * Tuning for {@link ContentHashIndex} cross-process lock waits and the\n * deferred reconcile-save durable retry (issue #1909 / PR #2016). All optional;\n * production uses the module defaults. Tests inject small values so the\n * lock-timeout + retry path is exercised deterministically without real\n * multi-second waits.\n */\nexport interface ContentHashIndexLockOptions {\n  /** Bounded wait to acquire the per-file advisory lock; passed to `withHeldFileLock` (default 5000ms). */\n  readonly maxWaitMs?: number;\n  /** Poll interval while waiting for a busy lock (default 50ms). */\n  readonly pollMs?: number;\n  /** Base backoff before the first deferred-save retry (default 500ms). */\n  readonly retryBaseMs?: number;\n  /** Max deferred-save retries before falling back to the corpus-rebuild safety net (default 5). */\n  readonly retryMaxAttempts?: number;\n}\n\n/**\n * Thrown when the fact-hash index cannot be made authoritative — the\n * cross-process rebuild lock could not be acquired within the bounded retry\n * budget (PR #2016). Callers that require an authoritative dedup answer surface\n * this instead of silently trusting a stale loaded snapshot.\n */\nexport class FactHashIndexNotAuthoritativeError extends Error {\n  constructor(stateDir: string) {\n    super(\n      `fact-hash index is not authoritative: the cross-process rebuild lock for ${stateDir} could not be acquired within the bounded retry budget`,\n    );\n    this.name = \"FactHashIndexNotAuthoritativeError\";\n  }\n}\n\ntype DiskFingerprint = {\n  mtimeMs: number;\n  size: number;\n  dev: number;\n  ino: number;\n  ctimeMs: number;\n  birthtimeMs: number;\n};\nexport interface ContentHashPathEntry {\n  readonly path: string;\n  readonly contentHash: string;\n}\n\n/**\n * Content-hash dedup index for facts.\n * Normalizes content (lowercase, strip punctuation, collapse whitespace),\n * computes SHA-256, and stores hashes in a line-delimited file.\n * Prevents writing semantically identical facts.\n */\nexport class ContentHashIndex {\n  private hashes: Set<string> = new Set();\n  private dirty = false;\n  /**\n   * Hashes explicitly removed since the last successful save (issue #1909 review\n   * round 8 thread 3). Tracked separately so `saveMergingWithDisk` can be\n   * removal-AWARE: under the file lock it reads the latest on-disk set, DROPS\n   * these, then unions our additions — so a removal batch cannot resurrect a\n   * hash (union alone would) and cannot clobber a concurrent extraction's\n   * appended hash (blind overwrite would). Consumed + cleared by every save.\n   */\n  private removed: Set<string> = new Set();\n  /**\n   * Hashes added by THIS instance since the last successful save (issue #1909\n   * review round 9 finding 3). Tracked separately from the loaded snapshot so a\n   * reconciling save publishes `(on-disk \\ removed) ∪ added` — it re-applies only\n   * OUR additions, never the stale loaded entries. Without this, seeding the\n   * merge from `this.hashes` (loaded ∪ added) would resurrect a hash a peer\n   * removed on disk while this instance held a stale snapshot.\n   */\n  private added: Set<string> = new Set();\n  private readonly filePath: string;\n  private readonly secureStoreKeyProvider: () => Buffer | null;\n  private readonly secureStoreWriteKeyProvider: () => Buffer | null;\n  private readonly memoryDir: string;\n  private readonly lockOptions: ContentHashIndexLockOptions;\n  /**\n   * Deferred reconcile-save durable-retry state (issue #1909 / PR #2016). At\n   * most ONE retry is ever armed (`reconcileRetryTimer` is the reentrancy guard)\n   * so successive timed-out saves cannot stack duplicate/parallel retries.\n   * `reconcileRetryBarrier` resolves when the chain settles (published or gave\n   * up) — awaited by tests and any caller wanting the eventual result.\n   */\n  private reconcileRetryTimer: NodeJS.Timeout | null = null;\n  private reconcileRetryAttempts = 0;\n  private reconcileRetryBarrier: Promise<void> | null = null;\n  private reconcileRetryResolve: (() => void) | null = null;\n  /**\n   * On-disk fingerprint captured at the last point THIS instance's in-memory\n   * set matched disk — after `load()`, `save()`, or a reconcile publish. A peer\n   * process that advances the durable index changes its file generation even\n   * when byte size and mtime collide, so the freshness check remains safe\n   * without an O(file-size) read on the hot path.\n   */\n  private lastSyncedFingerprint: DiskFingerprint | null = null;\n\n  constructor(\n    stateDir: string,\n    secureStoreKeyProvider: () => Buffer | null = () => null,\n    secureStoreWriteKeyProvider: () => Buffer | null = secureStoreKeyProvider,\n    memoryDir: string = path.dirname(stateDir),\n    lockOptions: ContentHashIndexLockOptions = {}\n  ) {\n    this.filePath = path.join(stateDir, \"fact-hashes.txt\");\n    this.secureStoreKeyProvider = secureStoreKeyProvider;\n    this.secureStoreWriteKeyProvider = secureStoreWriteKeyProvider;\n    this.memoryDir = memoryDir;\n    this.lockOptions = lockOptions;\n  }\n\n  /** Load existing hashes from disk. Safe to call multiple times. */\n  async load(): Promise<void> {\n    try {\n      const raw = await readMaybeEncryptedFile(this.filePath, this.secureStoreKeyProvider(), this.memoryDir);\n      for (const line of raw.split(\"\\n\")) {\n        const trimmed = line.trim();\n        if (trimmed.length > 0) {\n          this.hashes.add(trimmed);\n        }\n      }\n      log.debug(`content-hash index: loaded ${this.hashes.size} hashes`);\n    } catch (err) {\n      if (err instanceof SecureStoreLockedError) throw err;\n      if (!isErrnoCode(err, \"ENOENT\")) throw err;\n      log.debug(\"content-hash index: no existing index — starting fresh\");\n    }\n    // The loaded set now reflects the on-disk file — baseline the fingerprint so\n    // a later peer write is detectable (PR #2016 review).\n    await this.captureSyncedFingerprint();\n  }\n\n  /** Cheap `stat` of the durable index file; null when it does not exist yet. */\n  private async statIndexFile(): Promise<DiskFingerprint | null> {\n    try {\n      const s = await stat(this.filePath);\n      return {\n        mtimeMs: s.mtimeMs,\n        size: s.size,\n        dev: s.dev,\n        ino: s.ino,\n        ctimeMs: s.ctimeMs,\n        birthtimeMs: s.birthtimeMs,\n      };\n    } catch (err) {\n      if (isErrnoCode(err, \"ENOENT\")) return null;\n      throw err;\n    }\n  }\n\n  /** Record the current on-disk fingerprint as this instance's synced baseline. */\n  private async captureSyncedFingerprint(): Promise<void> {\n    try {\n      this.lastSyncedFingerprint = await this.statIndexFile();\n    } catch (err) {\n      // A stat failure other than ENOENT leaves no baseline; the next freshness\n      // check reports non-current and the caller confirms against the corpus.\n      this.lastSyncedFingerprint = null;\n      log.debug(`content-hash index: could not fingerprint ${this.filePath}: ${err}`);\n    }\n  }\n\n  /**\n   * True when the durable index file is unchanged since this instance last\n   * synced it (load / save / reconcile). False when a peer advanced it, when\n   * the file appeared or vanished, or when freshness cannot be established\n   * (stat error) — the caller then treats the in-memory snapshot as\n   * non-authoritative and confirms a dedup miss against the durable corpus.\n   * The stat includes file identity and generation metadata so same-size,\n   * same-mtime atomic replacements are detected without reading the file body.\n   */\n  async isDiskFingerprintCurrent(): Promise<boolean> {\n    let current: DiskFingerprint | null;\n    try {\n      current = await this.statIndexFile();\n    } catch {\n      return false;\n    }\n    const last = this.lastSyncedFingerprint;\n    if (last === null || current === null) {\n      return last === null && current === null;\n    }\n    return (\n      current.mtimeMs === last.mtimeMs &&\n      current.size === last.size &&\n      current.dev === last.dev &&\n      current.ino === last.ino &&\n      current.ctimeMs === last.ctimeMs &&\n      current.birthtimeMs === last.birthtimeMs\n    );\n  }\n\n  /** Check if content already exists in the index. */\n  has(content: string): boolean {\n    return this.hashes.has(ContentHashIndex.computeHash(content));\n  }\n\n  /** Add content hash to the index. */\n  add(content: string): void {\n    const hash = ContentHashIndex.computeHash(content);\n    // A re-add supersedes a pending removal of the same hash (round 8 thread 3).\n    this.removed.delete(hash);\n    // Record OUR durable delta even when the local snapshot already holds the\n    // hash (PR #2016 thread SD-nG): local membership can be STALE — a peer\n    // removed this hash on disk while this instance kept it in memory. Skipping\n    // `added`/`dirty` on that path let the reconciling save compute\n    // (on-disk \\ removed) ∪ added and silently drop the reintroduced hash, so\n    // the peer never saw it again. Set semantics keep this idempotent (no\n    // duplicate entries) and the `removed.delete` above preserves remove/add\n    // ordering.\n    this.hashes.add(hash);\n    this.added.add(hash);\n    this.dirty = true;\n  }\n\n  get size(): number {\n    return this.hashes.size;\n  }\n\n  /** Clear all loaded hashes so the next save rewrites the index from scratch. */\n  clear(): void {\n    if (this.hashes.size > 0) {\n      this.hashes.clear();\n    }\n    // A full clear is always paired with a plain overwrite save() (rebuild);\n    // pending per-hash add/remove deltas are subsumed by writing the rebuilt set.\n    // Cancel any armed deferred-reconcile retry (PR #2016) so it cannot fire in\n    // the clear→rebuild→save window and union the pre-clear on-disk rows back.\n    this.added.clear();\n    this.removed.clear();\n    this.cancelReconcileRetry();\n    this.dirty = true;\n  }\n\n  /** Persist index to disk if changed (plain whole-file overwrite). */\n  async save(): Promise<void> {\n    if (!this.dirty) return;\n    await mkdir(path.dirname(this.filePath), { recursive: true });\n    // Snapshot the deltas + overwrite body THIS save publishes BEFORE the write\n    // yields the event loop. `writeMaybeEncryptedFile` materializes `serialized`\n    // eagerly, then the disk await lets a concurrent same-process add()/remove()\n    // land a late delta (PR #2016 thread PRRT_kwDORJXyws6SEBri). Clearing the\n    // LIVE added/removed sets afterward — as the previous unconditional\n    // clear()+`dirty = false` did — would drop that late hash from the index AND\n    // leave no retry, so peers never see it until a corpus rebuild. Consume only\n    // what we published; late deltas stay pending. Mirrors saveMergingWithDisk.\n    const publishedAdded = new Set<string>(this.added);\n    const publishedRemoved = new Set<string>(this.removed);\n    const serialized = [...this.hashes].join(\"\\n\") + \"\\n\";\n    await writeMaybeEncryptedFile(\n      this.filePath,\n      serialized,\n      this.secureStoreWriteKeyProvider(),\n      {},\n      this.memoryDir\n    );\n    // Consume ONLY the deltas this overwrite published; anything that arrived\n    // during the awaits above remains pending for the next save.\n    for (const h of publishedAdded) this.added.delete(h);\n    for (const h of publishedRemoved) this.removed.delete(h);\n    // Honest dirty state: true iff late deltas remain unpersisted.\n    this.dirty = this.added.size > 0 || this.removed.size > 0;\n    // This overwrite is now the on-disk state — re-baseline the freshness\n    // fingerprint so our own write is not later mistaken for a peer's (PR #2016).\n    await this.captureSyncedFingerprint();\n    if (this.dirty) {\n      // Late deltas landed mid-save: arm a bounded durable retry so they reach\n      // disk even without a further batch save — never a silent in-memory-only\n      // hash. The locked reconcile republishes only OUR delta onto the overwrite.\n      this.scheduleReconcileRetry();\n    } else {\n      // Clean overwrite supersedes any pending deferred reconcile work.\n      this.cancelReconcileRetry();\n    }\n    log.debug(`content-hash index: saved ${this.hashes.size} hashes`);\n  }\n\n  /**\n   * Persist the index by RECONCILING with the latest on-disk state under a\n   * cross-process lock (issue #1909). Used by the extraction-persist batch save\n   * for BOTH append and removal batches, so appends and removals to the same\n   * index serialize against each other:\n   *   final = (on-disk \\ this.removed) ∪ this.added\n   * Note it re-applies only OUR local additions (`added`), NOT the loaded\n   * snapshot (review round 9 finding 3): seeding from `this.hashes` would\n   * resurrect a hash a peer removed on disk while we held a stale snapshot. This\n   * preserves a concurrent writer's appended hashes (a blind overwrite would\n   * drop them), never resurrects a removed hash, and never loses our additions.\n   *\n   * Hardening:\n   *  - Dirty short-circuit (round 7 finding 3): when this instance neither added\n   *    nor removed anything this run, skip the O(file) read+rewrite entirely.\n   *  - Cross-process lock (round 7 finding 2): serialize the read→reconcile→write\n   *    window on a per-file advisory lock. If the lock is NOT acquired (timeout),\n   *    do NOT publish (round 9 finding 2): keep `dirty` set AND schedule a bounded\n   *    durable background retry (PR #2016) that keeps re-attempting the locked\n   *    publish until the deferred additions land — never an unlocked write that\n   *    could clobber a peer, and never a silent \"batch save complete\" that leaves\n   *    the addition in this process's memory only.\n   */\n  async saveMergingWithDisk(): Promise<void> {\n    if (!this.dirty) return;\n    // The advisory lock file lives beside the index — ensure the dir exists\n    // before acquiring it (the index dir may not exist on a first write).\n    await mkdir(path.dirname(this.filePath), { recursive: true });\n    const publish = async (): Promise<void> => {\n      // Snapshot the deltas this publish is responsible for. The read+rewrite\n      // below yields the event loop, so a concurrent add()/remove() can land\n      // new deltas while we await disk (PR #2016 thread SD7Tj). Consuming the\n      // LIVE sets afterward would drop those late deltas AND clear `dirty`,\n      // stranding them in no save at all. We consume only what we published;\n      // anything that arrived meanwhile stays pending for the next save.\n      const publishedAdded = new Set<string>(this.added);\n      const publishedRemoved = new Set<string>(this.removed);\n      const merged = new Set<string>(publishedAdded);\n      try {\n        const raw = await readMaybeEncryptedFile(\n          this.filePath,\n          this.secureStoreKeyProvider(),\n          this.memoryDir\n        );\n        for (const line of raw.split(\"\\n\")) {\n          const trimmed = line.trim();\n          // Keep prior/concurrent on-disk hashes EXCEPT the ones we removed.\n          if (trimmed.length > 0 && !publishedRemoved.has(trimmed)) merged.add(trimmed);\n        }\n      } catch (err) {\n        if (err instanceof SecureStoreLockedError) throw err;\n        if (!isErrnoCode(err, \"ENOENT\")) throw err;\n        // ENOENT → no on-disk index yet; write our additions as-is.\n      }\n      await mkdir(path.dirname(this.filePath), { recursive: true });\n      await writeMaybeEncryptedFile(\n        this.filePath,\n        [...merged].join(\"\\n\") + \"\\n\",\n        this.secureStoreWriteKeyProvider(),\n        {},\n        this.memoryDir\n      );\n      // Consume ONLY the deltas we just published; deltas that arrived during\n      // the awaits above remain pending.\n      for (const h of publishedAdded) this.added.delete(h);\n      for (const h of publishedRemoved) this.removed.delete(h);\n      // Fold any still-pending deltas onto the reconciled set so the in-memory\n      // view stays consistent with what the next save will publish.\n      for (const h of this.added) merged.add(h);\n      for (const h of this.removed) merged.delete(h);\n      this.hashes = merged;\n      // Honest dirty state: true iff late deltas remain to be persisted. A\n      // subsequent batch save or the shutdown flush drains them.\n      this.dirty = this.added.size > 0 || this.removed.size > 0;\n      // The reconciled set is now the on-disk state — re-baseline the freshness\n      // fingerprint (captured under the held lock) so our own publish is not\n      // later mistaken for a peer's advance (PR #2016 review).\n      await this.captureSyncedFingerprint();\n    };\n    await withHeldFileLock(\n      `${this.filePath}.lock`,\n      {\n        staleMs: CONTENT_HASH_INDEX_LOCK_STALE_MS,\n        ...(this.lockOptions.maxWaitMs !== undefined ? { maxWaitMs: this.lockOptions.maxWaitMs } : {}),\n        ...(this.lockOptions.pollMs !== undefined ? { pollMs: this.lockOptions.pollMs } : {}),\n      },\n      async (acquired) => {\n        if (!acquired) {\n          // Never publish unlocked (round 9 finding 2): keep dirty AND schedule a\n          // durable background retry (PR #2016). Relying on an unguaranteed later\n          // batch save silently left the addition in this process's memory only;\n          // the retry keeps re-attempting the locked publish until the addition\n          // lands on disk.\n          log.warn(\n            `content-hash index: lock not acquired for ${this.filePath}; deferring reconcile save (dirty retained, scheduling durable retry)`,\n          );\n          this.scheduleReconcileRetry();\n          return;\n        }\n        await publish();\n        if (this.dirty) {\n          // A concurrent add()/remove() landed during publish's disk awaits, so\n          // deltas remain unpersisted (PR #2016 thread SD7Tj). Arm a bounded\n          // durable retry so they reach disk even if no further batch save comes\n          // — never leave a settled barrier over pending work.\n          this.scheduleReconcileRetry();\n        } else {\n          // Published cleanly: any pending deferred retry is now satisfied.\n          this.cancelReconcileRetry();\n        }\n      },\n    );\n    log.debug(`content-hash index: reconcile-saved ${this.hashes.size} hashes`);\n  }\n\n  /**\n   * Rebuild-and-publish the index from an authoritative source (the durable\n   * corpus) under the SAME per-file cross-process lock the reconciling\n   * append/removal saves (`saveMergingWithDisk`) use (issue #1909 / PR #2016).\n   * The `populate` callback runs WHILE the lock is held and MUST repopulate this\n   * index from the corpus (`clear()` then `addByHash(...)` for every corpus\n   * hash); the rebuilt set is then published with a plain overwrite that is now\n   * serialized against every locked writer.\n   *\n   * This closes the finding where the previous unlocked clear→scan→save() could\n   * overwrite a peer's newer lock-merged or deferred additions: a locked writer\n   * that committed BEFORE the rebuild acquired the lock has its memory `.md` on\n   * disk and is re-scanned; one that commits AFTER the rebuild releases\n   * reconciles its additions on top of the freshly-published set. No union with\n   * the raw on-disk file is performed, so the rebuild keeps its\n   * garbage-collection property (orphaned hashes for deleted memories drop).\n   *\n   * Lock-acquisition failure is explicit and non-destructive: `populate` is NOT\n   * run and nothing is written (never an unlocked overwrite). Returns true when\n   * the rebuild was published under the lock, false when the lock timed out —\n   * the caller keeps the index non-authoritative and retries on next use. Uses\n   * the same non-reentrant file lock as the reconcile path, so it can never\n   * deadlock with the deferred reconcile-retry: a concurrent locked writer (or a\n   * fired retry) simply yields `acquired=false` after the bounded wait.\n   */\n  async rebuildUnderLock(populate: () => Promise<void>): Promise<boolean> {\n    // The advisory lock file lives beside the index — ensure the dir exists\n    // before acquiring it (the index dir may not exist on a first rebuild).\n    await mkdir(path.dirname(this.filePath), { recursive: true });\n    let published = false;\n    await withHeldFileLock(\n      `${this.filePath}.lock`,\n      {\n        staleMs: CONTENT_HASH_INDEX_LOCK_STALE_MS,\n        ...(this.lockOptions.maxWaitMs !== undefined ? { maxWaitMs: this.lockOptions.maxWaitMs } : {}),\n        ...(this.lockOptions.pollMs !== undefined ? { pollMs: this.lockOptions.pollMs } : {}),\n      },\n      async (acquired) => {\n        if (!acquired) {\n          // Never publish unlocked: a concurrent locked writer holds the lock,\n          // so overwriting now could clobber its addition. Leave the index as-is\n          // and let the caller retry the authoritative rebuild on next use.\n          log.warn(\n            `content-hash index: lock not acquired for ${this.filePath}; deferring authoritative rebuild (index left non-authoritative, retried on next use)`,\n          );\n          return;\n        }\n        await populate();\n        // Publish under the held lock. save() takes no lock (no re-entrancy) and\n        // is a full overwrite that supersedes any pending add/remove deltas.\n        await this.save();\n        published = true;\n      },\n    );\n    return published;\n  }\n\n  /**\n   * True while a background durable reconcile-save retry is armed (PR #2016).\n   * Test/introspection hook.\n   */\n  get hasPendingReconcileRetry(): boolean {\n    return this.reconcileRetryTimer !== null;\n  }\n\n  /** True while this index has in-memory changes not yet published to disk. */\n  get hasPendingChanges(): boolean {\n    return this.dirty;\n  }\n\n  /**\n   * Resolve once any armed background reconcile-save retry chain has settled —\n   * either it published the deferred additions, or it exhausted its bounded\n   * attempts and fell back to the corpus-rebuild safety net. Resolves\n   * immediately when nothing is armed. Lets a caller (or a test) await the\n   * eventual durability outcome of a lock-timed-out save.\n   */\n  async whenReconcileRetrySettled(): Promise<void> {\n    await (this.reconcileRetryBarrier ?? Promise.resolve());\n  }\n\n  /**\n   * Drive any deferred lock-timeout reconcile save to completion INLINE at a\n   * lifecycle boundary (PR #2016 finding 3). The background retry timer is\n   * `unref`'d so it never keeps a long-lived daemon alive — but a short-lived\n   * writer (a one-shot CLI) can exit before it fires, leaving a durable fact\n   * `.md` whose hash never reached `fact-hashes.txt` for peers that already\n   * built their in-memory index. `orchestrator.destroy()` calls this so the\n   * addition publishes before the process exits; long-lived hosts only reach it\n   * at their own shutdown, so their in-flight retries keep running in the\n   * background until then. Bounded by the same attempt ceiling as the background\n   * retry; a permanently contended lock falls back to the corpus-rebuild-on-\n   * restart safety net (the fact `.md` is already durable). No deadlock: each\n   * attempt is the same non-reentrant, bounded-wait file lock.\n   */\n  async flushReconcileRetry(): Promise<void> {\n    if (!this.dirty) return;\n    const maxAttempts = this.lockOptions.retryMaxAttempts ?? CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS;\n    const baseMs = this.lockOptions.retryBaseMs ?? CONTENT_HASH_INDEX_RETRY_BASE_MS;\n    for (let attempt = 0; this.dirty && attempt < maxAttempts; attempt += 1) {\n      // Cancel the unref'd background timer — we drive the locked publish inline.\n      if (this.reconcileRetryTimer) {\n        clearTimeout(this.reconcileRetryTimer);\n        this.reconcileRetryTimer = null;\n      }\n      await this.saveMergingWithDisk();\n      if (!this.dirty) break;\n      if (attempt < maxAttempts - 1) {\n        const wait = Math.min(baseMs * 2 ** attempt, CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);\n        await new Promise<void>((resolve) => setTimeout(resolve, wait));\n      }\n    }\n    // Clear any timer the final saveMergingWithDisk armed and settle the barrier\n    // so awaiters unblock — the bounded inline drain has done its best.\n    if (this.reconcileRetryTimer) {\n      clearTimeout(this.reconcileRetryTimer);\n      this.reconcileRetryTimer = null;\n    }\n    this.reconcileRetryAttempts = 0;\n    this.settleReconcileRetry();\n  }\n\n  /**\n   * Schedule ONE bounded, exponentially-backed-off background retry of the\n   * deferred reconcile save (PR #2016). Reentrant-safe: an already-armed timer\n   * short-circuits, so successive timed-out saves never stack duplicate retries.\n   * When attempts are exhausted the chain settles without publishing — the\n   * durable fact `.md` is on disk and a process restart rebuilds the index from\n   * the corpus, so this degrades to that safety net, never a fatal failure.\n   */\n  private scheduleReconcileRetry(): void {\n    if (this.reconcileRetryTimer) return; // one retry in flight — no duplicate/reentrant retries\n    const maxAttempts = this.lockOptions.retryMaxAttempts ?? CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS;\n    if (this.reconcileRetryAttempts >= maxAttempts) {\n      log.warn(\n        `content-hash index: exhausted ${maxAttempts} deferred reconcile-save retries for ${this.filePath}; ` +\n          `${this.added.size} addition(s) remain dirty in-memory (a process restart rebuilds the index from the durable corpus)`,\n      );\n      this.reconcileRetryAttempts = 0;\n      this.settleReconcileRetry();\n      return;\n    }\n    if (!this.reconcileRetryBarrier) {\n      this.reconcileRetryBarrier = new Promise<void>((resolve) => {\n        this.reconcileRetryResolve = resolve;\n      });\n    }\n    const attempt = this.reconcileRetryAttempts + 1;\n    const baseMs = this.lockOptions.retryBaseMs ?? CONTENT_HASH_INDEX_RETRY_BASE_MS;\n    const delay = Math.min(baseMs * 2 ** (attempt - 1), CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);\n    this.reconcileRetryTimer = setTimeout(() => {\n      this.reconcileRetryTimer = null;\n      this.reconcileRetryAttempts = attempt;\n      void this.saveMergingWithDisk()\n        .catch((err) => {\n          // A publish-time I/O/encryption error (not a lock timeout) is best-effort:\n          // log and let the corpus-rebuild safety net cover it rather than loop.\n          log.warn(`content-hash index: deferred reconcile-save retry failed for ${this.filePath}: ${err}`);\n        })\n        .finally(() => {\n          // If the attempt neither published (dirty cleared → cancelReconcileRetry)\n          // nor re-armed a further retry, the chain has ended — settle the barrier.\n          if (this.dirty && !this.reconcileRetryTimer) this.settleReconcileRetry();\n        });\n    }, delay);\n    this.reconcileRetryTimer.unref?.();\n  }\n\n  /** Cancel any armed reconcile-save retry and settle the barrier (a publish landed). */\n  private cancelReconcileRetry(): void {\n    if (this.reconcileRetryTimer) {\n      clearTimeout(this.reconcileRetryTimer);\n      this.reconcileRetryTimer = null;\n    }\n    this.reconcileRetryAttempts = 0;\n    this.settleReconcileRetry();\n  }\n\n  /** Resolve and clear the retry barrier if one is outstanding. */\n  private settleReconcileRetry(): void {\n    const resolve = this.reconcileRetryResolve;\n    this.reconcileRetryBarrier = null;\n    this.reconcileRetryResolve = null;\n    resolve?.();\n  }\n\n  /** Remove a hash from the index (used when archiving/deleting). */\n  remove(content: string): void {\n    const hash = ContentHashIndex.computeHash(content);\n    // Record the removal (round 8 thread 3) even when the hash is not in our\n    // in-memory set — a reconciling save must still drop it from the latest\n    // on-disk state. A removal supersedes a pending add. Always mark dirty.\n    this.added.delete(hash);\n    this.removed.add(hash);\n    this.hashes.delete(hash);\n    this.dirty = true;\n  }\n\n  /**\n   * Remove a pre-computed SHA-256 hash directly from the index without\n   * re-hashing.  Use this when the caller already holds the stored hash\n   * (e.g. `memory.frontmatter.contentHash`) to avoid the double-hash bug\n   * where `remove(hash)` would compute `hash(hash)` and never match the\n   * entry.\n   */\n  removeByHash(hash: string): void {\n    this.added.delete(hash);\n    this.removed.add(hash);\n    this.hashes.delete(hash);\n    this.dirty = true;\n  }\n\n  /**\n   * Add a pre-computed SHA-256 hash directly to the index without re-hashing.\n   * Use this when the caller already holds the stored hash\n   * (e.g. `memory.frontmatter.contentHash`) so that the index records the raw\n   * content hash rather than re-hashing the citation-annotated body.\n   *\n   * @internal Only called from `StorageManager.ensureFactHashIndexAuthoritative`.\n   * Not part of the public API — prefer `add(content)` for external callers.\n   */\n  addByHash(hash: string): void {\n    // A re-add supersedes a pending removal of the same hash.\n    this.removed.delete(hash);\n    // Record OUR durable delta even when the local snapshot already holds the\n    // hash (PR #2016 thread PRRT_kwDORJXyws6SEHve). Outside a rebuild\n    // (StorageManager.addActiveFactContentHash on reactivation) local\n    // membership can be STALE: a peer removed this hash on disk while this\n    // instance kept it in memory. Skipping added/dirty on that path let the\n    // reconciling save compute (on-disk \\ removed) ∪ added and silently drop\n    // the reintroduced hash, so the peer never saw it again. Set semantics keep\n    // this idempotent (no duplicate entries) and the removed.delete above\n    // preserves remove/add ordering. Mirrors add().\n    this.hashes.add(hash);\n    this.added.add(hash);\n    this.dirty = true;\n  }\n\n  /**\n   * Resolve a pre-computed semantic hash to one deterministic corpus path.\n   *\n   * This lookup is separate from durable hash membership: `this.hashes` stays\n   * one hash per line and `has(content)` keeps its existing raw-content contract.\n   * Reconciliation supplies short-lived manifest rows where hash and path coexist.\n   */\n  static resolvePathByHash(\n    hash: string,\n    entries: Iterable<ContentHashPathEntry>,\n  ): string | undefined {\n    const canonicalHash = hash.toLowerCase();\n    if (!/^[a-f0-9]{64}$/.test(canonicalHash)) return undefined;\n    let canonicalPath: string | undefined;\n    for (const entry of entries) {\n      if (entry.contentHash.toLowerCase() !== canonicalHash || entry.path.length === 0) continue;\n      if (canonicalPath === undefined || entry.path < canonicalPath) canonicalPath = entry.path;\n    }\n    return canonicalPath;\n  }\n\n  /** Normalize content (delegates to content-hash.ts for a single source of truth). */\n  static normalizeContent(content: string): string {\n    return normalizeContent(content);\n  }\n\n  /** Compute SHA-256 hash (delegates to content-hash.ts for a single source of truth). */\n  static computeHash(content: string): string {\n    return computeContentHash(content);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA,SAAS,OAAO,YAAY;AAC5B,OAAO,UAAU;AAkBjB,IAAM,mCAAmC;AAezC,IAAM,wCAAwC;AAE9C,IAAM,mCAAmC;AAElC,IAAM,wCAAwC;AA0B9C,IAAM,qCAAN,cAAiD,MAAM;AAAA,EAC5D,YAAY,UAAkB;AAC5B;AAAA,MACE,4EAA4E,QAAQ;AAAA,IACtF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAqBO,IAAM,mBAAN,MAAM,kBAAiB;AAAA,EACpB,SAAsB,oBAAI,IAAI;AAAA,EAC9B,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASR,UAAuB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/B,QAAqB,oBAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,sBAA6C;AAAA,EAC7C,yBAAyB;AAAA,EACzB,wBAA8C;AAAA,EAC9C,wBAA6C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7C,wBAAgD;AAAA,EAExD,YACE,UACA,yBAA8C,MAAM,MACpD,8BAAmD,wBACnD,YAAoB,KAAK,QAAQ,QAAQ,GACzC,cAA2C,CAAC,GAC5C;AACA,SAAK,WAAW,KAAK,KAAK,UAAU,iBAAiB;AACrD,SAAK,yBAAyB;AAC9B,SAAK,8BAA8B;AACnC,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,uBAAuB,KAAK,UAAU,KAAK,uBAAuB,GAAG,KAAK,SAAS;AACrG,iBAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,QAAQ,SAAS,GAAG;AACtB,eAAK,OAAO,IAAI,OAAO;AAAA,QACzB;AAAA,MACF;AACA,UAAI,MAAM,8BAA8B,KAAK,OAAO,IAAI,SAAS;AAAA,IACnE,SAAS,KAAK;AACZ,UAAI,eAAe,uBAAwB,OAAM;AACjD,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AACvC,UAAI,MAAM,6DAAwD;AAAA,IACpE;AAGA,UAAM,KAAK,yBAAyB;AAAA,EACtC;AAAA;AAAA,EAGA,MAAc,gBAAiD;AAC7D,QAAI;AACF,YAAM,IAAI,MAAM,KAAK,KAAK,QAAQ;AAClC,aAAO;AAAA,QACL,SAAS,EAAE;AAAA,QACX,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,KAAK,EAAE;AAAA,QACP,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,MACjB;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,YAAY,KAAK,QAAQ,EAAG,QAAO;AACvC,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,2BAA0C;AACtD,QAAI;AACF,WAAK,wBAAwB,MAAM,KAAK,cAAc;AAAA,IACxD,SAAS,KAAK;AAGZ,WAAK,wBAAwB;AAC7B,UAAI,MAAM,6CAA6C,KAAK,QAAQ,KAAK,GAAG,EAAE;AAAA,IAChF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,2BAA6C;AACjD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,cAAc;AAAA,IACrC,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK;AAClB,QAAI,SAAS,QAAQ,YAAY,MAAM;AACrC,aAAO,SAAS,QAAQ,YAAY;AAAA,IACtC;AACA,WACE,QAAQ,YAAY,KAAK,WACzB,QAAQ,SAAS,KAAK,QACtB,QAAQ,QAAQ,KAAK,OACrB,QAAQ,QAAQ,KAAK,OACrB,QAAQ,YAAY,KAAK,WACzB,QAAQ,gBAAgB,KAAK;AAAA,EAEjC;AAAA;AAAA,EAGA,IAAI,SAA0B;AAC5B,WAAO,KAAK,OAAO,IAAI,kBAAiB,YAAY,OAAO,CAAC;AAAA,EAC9D;AAAA;AAAA,EAGA,IAAI,SAAuB;AACzB,UAAM,OAAO,kBAAiB,YAAY,OAAO;AAEjD,SAAK,QAAQ,OAAO,IAAI;AASxB,SAAK,OAAO,IAAI,IAAI;AACpB,SAAK,MAAM,IAAI,IAAI;AACnB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA,EAGA,QAAc;AACZ,QAAI,KAAK,OAAO,OAAO,GAAG;AACxB,WAAK,OAAO,MAAM;AAAA,IACpB;AAKA,SAAK,MAAM,MAAM;AACjB,SAAK,QAAQ,MAAM;AACnB,SAAK,qBAAqB;AAC1B,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAS5D,UAAM,iBAAiB,IAAI,IAAY,KAAK,KAAK;AACjD,UAAM,mBAAmB,IAAI,IAAY,KAAK,OAAO;AACrD,UAAM,aAAa,CAAC,GAAG,KAAK,MAAM,EAAE,KAAK,IAAI,IAAI;AACjD,UAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA,KAAK,4BAA4B;AAAA,MACjC,CAAC;AAAA,MACD,KAAK;AAAA,IACP;AAGA,eAAW,KAAK,eAAgB,MAAK,MAAM,OAAO,CAAC;AACnD,eAAW,KAAK,iBAAkB,MAAK,QAAQ,OAAO,CAAC;AAEvD,SAAK,QAAQ,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,OAAO;AAGxD,UAAM,KAAK,yBAAyB;AACpC,QAAI,KAAK,OAAO;AAId,WAAK,uBAAuB;AAAA,IAC9B,OAAO;AAEL,WAAK,qBAAqB;AAAA,IAC5B;AACA,QAAI,MAAM,6BAA6B,KAAK,OAAO,IAAI,SAAS;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAM,sBAAqC;AACzC,QAAI,CAAC,KAAK,MAAO;AAGjB,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,UAAM,UAAU,YAA2B;AAOzC,YAAM,iBAAiB,IAAI,IAAY,KAAK,KAAK;AACjD,YAAM,mBAAmB,IAAI,IAAY,KAAK,OAAO;AACrD,YAAM,SAAS,IAAI,IAAY,cAAc;AAC7C,UAAI;AACF,cAAM,MAAM,MAAM;AAAA,UAChB,KAAK;AAAA,UACL,KAAK,uBAAuB;AAAA,UAC5B,KAAK;AAAA,QACP;AACA,mBAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,gBAAM,UAAU,KAAK,KAAK;AAE1B,cAAI,QAAQ,SAAS,KAAK,CAAC,iBAAiB,IAAI,OAAO,EAAG,QAAO,IAAI,OAAO;AAAA,QAC9E;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,uBAAwB,OAAM;AACjD,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AAAA,MAEzC;AACA,YAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,CAAC,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI;AAAA,QACzB,KAAK,4BAA4B;AAAA,QACjC,CAAC;AAAA,QACD,KAAK;AAAA,MACP;AAGA,iBAAW,KAAK,eAAgB,MAAK,MAAM,OAAO,CAAC;AACnD,iBAAW,KAAK,iBAAkB,MAAK,QAAQ,OAAO,CAAC;AAGvD,iBAAW,KAAK,KAAK,MAAO,QAAO,IAAI,CAAC;AACxC,iBAAW,KAAK,KAAK,QAAS,QAAO,OAAO,CAAC;AAC7C,WAAK,SAAS;AAGd,WAAK,QAAQ,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,OAAO;AAIxD,YAAM,KAAK,yBAAyB;AAAA,IACtC;AACA,UAAM;AAAA,MACJ,GAAG,KAAK,QAAQ;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,GAAI,KAAK,YAAY,cAAc,SAAY,EAAE,WAAW,KAAK,YAAY,UAAU,IAAI,CAAC;AAAA,QAC5F,GAAI,KAAK,YAAY,WAAW,SAAY,EAAE,QAAQ,KAAK,YAAY,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,OAAO,aAAa;AAClB,YAAI,CAAC,UAAU;AAMb,cAAI;AAAA,YACF,6CAA6C,KAAK,QAAQ;AAAA,UAC5D;AACA,eAAK,uBAAuB;AAC5B;AAAA,QACF;AACA,cAAM,QAAQ;AACd,YAAI,KAAK,OAAO;AAKd,eAAK,uBAAuB;AAAA,QAC9B,OAAO;AAEL,eAAK,qBAAqB;AAAA,QAC5B;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,uCAAuC,KAAK,OAAO,IAAI,SAAS;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,iBAAiB,UAAiD;AAGtE,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,QAAI,YAAY;AAChB,UAAM;AAAA,MACJ,GAAG,KAAK,QAAQ;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,GAAI,KAAK,YAAY,cAAc,SAAY,EAAE,WAAW,KAAK,YAAY,UAAU,IAAI,CAAC;AAAA,QAC5F,GAAI,KAAK,YAAY,WAAW,SAAY,EAAE,QAAQ,KAAK,YAAY,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,OAAO,aAAa;AAClB,YAAI,CAAC,UAAU;AAIb,cAAI;AAAA,YACF,6CAA6C,KAAK,QAAQ;AAAA,UAC5D;AACA;AAAA,QACF;AACA,cAAM,SAAS;AAGf,cAAM,KAAK,KAAK;AAChB,oBAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,2BAAoC;AACtC,WAAO,KAAK,wBAAwB;AAAA,EACtC;AAAA;AAAA,EAGA,IAAI,oBAA6B;AAC/B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,4BAA2C;AAC/C,WAAO,KAAK,yBAAyB,QAAQ,QAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,sBAAqC;AACzC,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,cAAc,KAAK,YAAY,oBAAoB;AACzD,UAAM,SAAS,KAAK,YAAY,eAAe;AAC/C,aAAS,UAAU,GAAG,KAAK,SAAS,UAAU,aAAa,WAAW,GAAG;AAEvE,UAAI,KAAK,qBAAqB;AAC5B,qBAAa,KAAK,mBAAmB;AACrC,aAAK,sBAAsB;AAAA,MAC7B;AACA,YAAM,KAAK,oBAAoB;AAC/B,UAAI,CAAC,KAAK,MAAO;AACjB,UAAI,UAAU,cAAc,GAAG;AAC7B,cAAM,OAAO,KAAK,IAAI,SAAS,KAAK,SAAS,qCAAqC;AAClF,cAAM,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB;AAC5B,mBAAa,KAAK,mBAAmB;AACrC,WAAK,sBAAsB;AAAA,IAC7B;AACA,SAAK,yBAAyB;AAC9B,SAAK,qBAAqB;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,yBAA+B;AACrC,QAAI,KAAK,oBAAqB;AAC9B,UAAM,cAAc,KAAK,YAAY,oBAAoB;AACzD,QAAI,KAAK,0BAA0B,aAAa;AAC9C,UAAI;AAAA,QACF,iCAAiC,WAAW,wCAAwC,KAAK,QAAQ,KAC5F,KAAK,MAAM,IAAI;AAAA,MACtB;AACA,WAAK,yBAAyB;AAC9B,WAAK,qBAAqB;AAC1B;AAAA,IACF;AACA,QAAI,CAAC,KAAK,uBAAuB;AAC/B,WAAK,wBAAwB,IAAI,QAAc,CAAC,YAAY;AAC1D,aAAK,wBAAwB;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,UAAM,UAAU,KAAK,yBAAyB;AAC9C,UAAM,SAAS,KAAK,YAAY,eAAe;AAC/C,UAAM,QAAQ,KAAK,IAAI,SAAS,MAAM,UAAU,IAAI,qCAAqC;AACzF,SAAK,sBAAsB,WAAW,MAAM;AAC1C,WAAK,sBAAsB;AAC3B,WAAK,yBAAyB;AAC9B,WAAK,KAAK,oBAAoB,EAC3B,MAAM,CAAC,QAAQ;AAGd,YAAI,KAAK,gEAAgE,KAAK,QAAQ,KAAK,GAAG,EAAE;AAAA,MAClG,CAAC,EACA,QAAQ,MAAM;AAGb,YAAI,KAAK,SAAS,CAAC,KAAK,oBAAqB,MAAK,qBAAqB;AAAA,MACzE,CAAC;AAAA,IACL,GAAG,KAAK;AACR,SAAK,oBAAoB,QAAQ;AAAA,EACnC;AAAA;AAAA,EAGQ,uBAA6B;AACnC,QAAI,KAAK,qBAAqB;AAC5B,mBAAa,KAAK,mBAAmB;AACrC,WAAK,sBAAsB;AAAA,IAC7B;AACA,SAAK,yBAAyB;AAC9B,SAAK,qBAAqB;AAAA,EAC5B;AAAA;AAAA,EAGQ,uBAA6B;AACnC,UAAM,UAAU,KAAK;AACrB,SAAK,wBAAwB;AAC7B,SAAK,wBAAwB;AAC7B,cAAU;AAAA,EACZ;AAAA;AAAA,EAGA,OAAO,SAAuB;AAC5B,UAAM,OAAO,kBAAiB,YAAY,OAAO;AAIjD,SAAK,MAAM,OAAO,IAAI;AACtB,SAAK,QAAQ,IAAI,IAAI;AACrB,SAAK,OAAO,OAAO,IAAI;AACvB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,MAAoB;AAC/B,SAAK,MAAM,OAAO,IAAI;AACtB,SAAK,QAAQ,IAAI,IAAI;AACrB,SAAK,OAAO,OAAO,IAAI;AACvB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,UAAU,MAAoB;AAE5B,SAAK,QAAQ,OAAO,IAAI;AAUxB,SAAK,OAAO,IAAI,IAAI;AACpB,SAAK,MAAM,IAAI,IAAI;AACnB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,kBACL,MACA,SACoB;AACpB,UAAM,gBAAgB,KAAK,YAAY;AACvC,QAAI,CAAC,iBAAiB,KAAK,aAAa,EAAG,QAAO;AAClD,QAAI;AACJ,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,YAAY,YAAY,MAAM,iBAAiB,MAAM,KAAK,WAAW,EAAG;AAClF,UAAI,kBAAkB,UAAa,MAAM,OAAO,cAAe,iBAAgB,MAAM;AAAA,IACvF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAO,iBAAiB,SAAyB;AAC/C,WAAO,iBAAiB,OAAO;AAAA,EACjC;AAAA;AAAA,EAGA,OAAO,YAAY,SAAyB;AAC1C,WAAO,mBAAmB,OAAO;AAAA,EACnC;AACF;","names":[]}