@remnic/core 9.54.3 → 9.54.5

package/src/orchestration/recall-search-pipeline.test.ts

@@ -108,6 +108,47 @@ test("recall safety derives sourceConnector exclusively from the hydrated memory
   }
 });
 
+test("recall safety keeps support passport records out of generic recall", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-passport-recall-"));
+  try {
+    const coordinator = await makeCoordinator(memoryDir);
+    const card = {
+      path: "preferences/support-card.md",
+      content: "Give me time to answer.",
+      frontmatter: {
+        status: "active",
+        tags: ["support-passport-card"],
+        created: "2026-07-19T00:00:00.000Z",
+        updated: "2026-07-19T00:00:00.000Z",
+      },
+    } as unknown as MemoryFile;
+    const audit = {
+      path: "corrections/support-card-audit.md",
+      content: "Superseded: Give me time to answer.",
+      frontmatter: {
+        status: "active",
+        tags: ["support-passport-audit"],
+        created: "2026-07-19T00:00:00.000Z",
+        updated: "2026-07-19T00:00:00.000Z",
+      },
+    } as unknown as MemoryFile;
+    const candidates = [result("default", card.path), result("default", audit.path)];
+    const memoryByPath = new Map([
+      [`default\0${card.path}`, card],
+      [`default\0${audit.path}`, audit],
+    ]);
+
+    assert.deepEqual(coordinator.filterSearchResultsByRecallSafety(candidates, memoryByPath), []);
+    assert.deepEqual(
+      coordinator.filterSearchResultsByRecallSafety(candidates, memoryByPath, { allowDedicatedSurface: true }),
+      [],
+      "a generic-recall override must not disclose owner-controlled support records",
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
 test("recall safety partitions tool-scoped memories by requesting connector", async () => {
   const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-connector-partition-"));
   try {

package/src/orchestration/recall-search-pipeline.ts

@@ -70,6 +70,7 @@ import {
 } from "../orchestrator.js";
 import { isActivityDigestPath } from "./orchestrator-helpers.js";
 import { isGenericRecallExcludedPath, isTopLevelArchivePath } from "./generic-recall-paths.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 export interface RecallSearchPipelineDeps {
   applyMemoryWorthRerank(
@@ -1091,6 +1092,7 @@ export class RecallSearchPipelineCoordinator {
     let forgottenFilteredCount = 0;
     let blockedPathFilteredCount = 0;
     let connectorPartitionFilteredCount = 0;
+    let supportPassportFilteredCount = 0;
     const filtered: QmdSearchResult[] = [];
     for (const r of results) {
       if (options?.blockedPaths && resultHasKey(options.blockedPaths, r)) {
@@ -1127,6 +1129,11 @@ export class RecallSearchPipelineCoordinator {
           continue;
         }
 
+        if (isSupportPassportPrivateMemory(memory)) {
+          supportPassportFilteredCount += 1;
+          continue;
+        }
+
         if (
           options?.allowLifecycleFiltered !== true &&
           shouldFilterLifecycleRecallCandidate(memory.frontmatter, {
@@ -1223,6 +1230,11 @@ export class RecallSearchPipelineCoordinator {
         `connector partition filter removed ${connectorPartitionFilteredCount} tool-scoped candidates from recall`,
       );
     }
+    if (supportPassportFilteredCount > 0) {
+      log.debug(
+        `support passport filter removed ${supportPassportFilteredCount} owner-controlled records from generic recall`,
+      );
+    }
     if (lifecycleFilteredCount > 0) {
       log.debug(
         `lifecycle retrieval filter removed ${lifecycleFilteredCount} stale/archived candidates`,

package/src/orchestration/semantic-consolidation-coordinator.ts

@@ -51,6 +51,7 @@ import type { PluginConfig, MemoryFile, AgentPersonaModelConfig } from "../types
 import { log } from "../logger.js";
 import { composeMemoryEnvelope } from "../write-envelope.js";
 import { resolveConversationContextCapabilities } from "../capabilities.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 
 /** Dependencies injected by the orchestrator. All stable references or
  *  live accessors. */
@@ -110,7 +111,7 @@ export class SemanticConsolidationCoordinator {
 
     log.info("[semantic-consolidation] starting run");
 
-    const allMemories = await targetStorage.readAllMemories();
+    const allMemories = excludeSupportPassportPrivateMemories(await targetStorage.readAllMemories());
     if (allMemories.length < 10) {
       log.debug("[semantic-consolidation] too few memories, skipping");
       return result;

package/src/orchestration/tier-migration-coordinator.ts

@@ -19,28 +19,22 @@
 
 import path from "node:path";
 
+import { resolveQmdCapabilities } from "../capabilities.js";
+import { type CompoundingEngine, defaultTierMigrationCycleBudget } from "../compounding/engine.js";
 // StorageManager type comes from the package barrel (type-only) so this
 // module does not add a direct storage.ts import (#1533 ratchet).
 import type { StorageManager } from "../index.js";
-import type { SearchBackend } from "../search/port.js";
-import { TierMigrationExecutor } from "../tier-migration.js";
-import { decideTierTransition, type MemoryTier } from "../tier-routing.js";
-import {
+import { log } from "../logger.js";
+import type {
+  TierMigrationCycleSummary,
+  TierMigrationStatusSnapshot,
   TierMigrationStatusStore,
-  type TierMigrationCycleSummary,
-  type TierMigrationStatusSnapshot,
 } from "../recall-state.js";
-import {
-  type CompoundingEngine,
-  defaultTierMigrationCycleBudget,
-} from "../compounding/engine.js";
-import {
-  applyUtilityPromotionRuntimePolicy,
-  type UtilityRuntimeValues,
-} from "../utility-runtime.js";
-import type { PluginConfig, MemoryFile } from "../types.js";
-import { log } from "../logger.js";
-import { resolveQmdCapabilities } from "../capabilities.js";
+import type { SearchBackend } from "../search/port.js";
+import { TierMigrationExecutor } from "../tier-migration.js";
+import { type MemoryTier, decideTierTransition } from "../tier-routing.js";
+import type { MemoryFile, PluginConfig } from "../types.js";
+import { type UtilityRuntimeValues, applyUtilityPromotionRuntimePolicy } from "../utility-runtime.js";
 
 /** Dependencies injected by the orchestrator. All stable references or live
  *  accessors (the orchestrator reassigns `qmd` to NoopSearchBackend and
@@ -91,7 +85,7 @@ export class TierMigrationCoordinator {
       dryRun?: boolean;
       limitOverride?: number;
       force?: boolean;
-    },
+    }
   ): Promise<TierMigrationCycleSummary> {
     const { config, tierMigrationStatus } = this.deps;
     const dryRun = options?.dryRun === true;
@@ -110,11 +104,7 @@ export class TierMigrationCoordinator {
       if (persistSkipped) await tierMigrationStatus.recordCycle(skipped);
       return skipped;
     }
-    if (
-      trigger === "maintenance" &&
-      !resolveQmdCapabilities(config).qmdTierAutoBackfill &&
-      options?.force !== true
-    ) {
+    if (trigger === "maintenance" && !resolveQmdCapabilities(config).qmdTierAutoBackfill && options?.force !== true) {
       const skipped: TierMigrationCycleSummary = {
         trigger,
         scanned: 0,
@@ -147,15 +137,9 @@ export class TierMigrationCoordinator {
     const budget =
       this.deps.getCompounding()?.tierMigrationCycleBudget(budgetTrigger) ??
       defaultTierMigrationCycleBudget(config, budgetTrigger);
-    const limit =
-      options?.limitOverride !== undefined
-        ? Math.max(0, Math.floor(options.limitOverride))
-        : budget.limit;
+    const limit = options?.limitOverride !== undefined ? Math.max(0, Math.floor(options.limitOverride)) : budget.limit;
     const nowMs = Date.now();
-    if (
-      options?.force !== true &&
-      nowMs - this.lastRunAtMs < budget.minIntervalMs
-    ) {
+    if (options?.force !== true && nowMs - this.lastRunAtMs < budget.minIntervalMs) {
       const skipped: TierMigrationCycleSummary = {
         trigger,
         scanned: 0,
@@ -177,28 +161,17 @@ export class TierMigrationCoordinator {
         demotionValueThreshold: config.qmdTierDemotionValueThreshold,
         promotionValueThreshold: config.qmdTierPromotionValueThreshold,
       },
-      this.deps.getUtilityRuntimeValues(),
+      this.deps.getUtilityRuntimeValues()
     );
 
     this.inFlight = true;
     try {
-      const coldStorage = this.deps.createColdStorage(
-        path.join(storage.dir, "cold"),
-      );
-      const [hotMemories, coldMemories] = await Promise.all([
-        storage.readAllMemories(),
-        coldStorage.readAllMemories(),
-      ]);
+      const coldStorage = this.deps.createColdStorage(path.join(storage.dir, "cold"));
+      const [hotMemories, coldMemories] = await Promise.all([storage.readAllMemories(), coldStorage.readAllMemories()]);
       const now = new Date();
       const scanLimit = Math.max(0, Math.floor(budget.scanLimit));
-      const hotScanLimit = Math.min(
-        hotMemories.length,
-        Math.ceil(scanLimit * 0.75),
-      );
-      const coldScanLimit = Math.min(
-        coldMemories.length,
-        Math.max(0, scanLimit - hotScanLimit),
-      );
+      const hotScanLimit = Math.min(hotMemories.length, Math.ceil(scanLimit * 0.75));
+      const coldScanLimit = Math.min(coldMemories.length, Math.max(0, scanLimit - hotScanLimit));
       const toTimestamp = (memory: MemoryFile): number =>
         Date.parse(memory.frontmatter.updated ?? memory.frontmatter.created);
       const hotCandidates = hotMemories
@@ -215,8 +188,7 @@ export class TierMigrationCoordinator {
         storage,
         qmd: this.deps.getQmd(),
         hotCollection: config.qmdCollection,
-        coldCollection:
-          config.qmdColdCollection ?? `${config.qmdCollection}-cold`,
+        coldCollection: config.qmdColdCollection ?? `${config.qmdCollection}-cold`,
         autoEmbed: resolveQmdCapabilities(config).qmdAutoEmbed,
       });
 
@@ -225,12 +197,7 @@ export class TierMigrationCoordinator {
       let demoted = 0;
       for (const candidate of candidates) {
         if (migrated >= limit) break;
-        const decision = decideTierTransition(
-          candidate.memory,
-          candidate.tier,
-          policy,
-          now,
-        );
+        const decision = decideTierTransition(candidate.memory, candidate.tier, policy, now);
         if (!decision.changed) continue;
 
         if (!dryRun) {
@@ -249,7 +216,7 @@ export class TierMigrationCoordinator {
 
       if (!dryRun) this.lastRunAtMs = Date.now();
       log.debug(
-        `tier migration cycle completed: trigger=${trigger} scanned=${candidates.length} migrated=${migrated} limit=${limit}${dryRun ? " dryRun=true" : ""}`,
+        `tier migration cycle completed: trigger=${trigger} scanned=${candidates.length} migrated=${migrated} limit=${limit}${dryRun ? " dryRun=true" : ""}`
       );
       const summary: TierMigrationCycleSummary = {
         trigger,

package/src/orchestration/workspace-ops.test.ts

@@ -1,9 +1,46 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm } from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
+import { StorageManager } from "../storage.js";
 import { WorkspaceOpsCoordinator, type WorkspaceOpsDeps } from "./workspace-ops.js";
 import type { AccessTrackingEntry, PluginConfig } from "../types.js";
 
+test("gatherTodayFacts excludes support passport cards from day-summary input", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-workspace-passport-"));
+  try {
+    await mkdir(root, { recursive: true });
+    const storage = new StorageManager(root);
+    await storage.writeMemory("preference", "Private support statement", {
+      tags: ["support-passport-card"],
+      source: "support-passport",
+    });
+    await storage.writeMemory("fact", "Public project update", {
+      source: "test",
+    });
+    const coordinator = new WorkspaceOpsCoordinator({
+      config: {
+        defaultNamespace: "default",
+        daySummaryTimezone: "UTC",
+      } as unknown as PluginConfig,
+      storageRouter: {
+        storageFor: async () => storage,
+      },
+    } as unknown as WorkspaceOpsDeps);
+
+    const gathered = await coordinator.gatherTodayFacts(undefined, {
+      now: new Date(),
+      timeZone: "UTC",
+    });
+
+    assert.equal(gathered.includes("Private support statement"), false);
+    assert.equal(gathered.includes("Public project update"), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("flushAccessTracking keeps duplicate memory IDs scoped by memory path", async () => {
   const defaultPath = path.join("/memory", "namespaces", "default", "facts", "same-id.md");
   const sharedPath = path.join("/memory", "namespaces", "shared", "facts", "same-id.md");

package/src/orchestration/workspace-ops.ts

@@ -33,6 +33,7 @@ import { evaluateMemoryActionPolicy } from "../memory-action-policy.js";
 import { NamespaceStorageRouter } from "../namespaces/storage.js";
 import { namespaceCollectionName } from "../namespaces/search.js";
 import { parseMemoryActionEligibilityContext } from "../schemas.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 import type { SearchBackend } from "../search/port.js";
 import { type AccessTrackingEntry, type MemoryActionEvent, type MemoryFile, type PluginConfig, confidenceTier } from "../types.js";
 import { RECALL_FALLBACK_DIRS } from "../utils/category-dir.js";
@@ -371,41 +372,16 @@ export class WorkspaceOpsCoordinator {
             const fullPath = path.join(dateDir, entry.name);
             try {
               assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);
-              const raw = await readFile(fullPath, "utf-8");
-              const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-              if (!fmMatch) continue;
-              const fmBlock = fmMatch[1];
-              const content = fmMatch[2].trim();
-              const fm: Record<string, string> = {};
-              for (const line of fmBlock.split("\n")) {
-                const colonIdx = line.indexOf(":");
-                if (colonIdx === -1) continue;
-                fm[line.slice(0, colonIdx).trim()] = line
-                  .slice(colonIdx + 1)
-                  .trim();
-              }
-              const created = fm.created || "unknown";
-              const createdAt = parseFiniteDate(created);
+              const memory = await storage.readMemoryByPath(fullPath);
+              if (!memory || isSupportPassportPrivateMemory(memory)) continue;
+              const createdAt = parseFiniteDate(memory.frontmatter.created);
               if (
                 createdAt &&
                 formatDateInTimeZone(createdAt, timeZone) !== targetLocalDate
               ) {
                 continue;
               }
-              facts.push({
-                path: fullPath,
-                frontmatter: {
-                  id: fm.id || path.basename(entry.name, ".md"),
-                  category: (fm.category as any) || "fact",
-                  created,
-                  updated: fm.updated || created,
-                  source: fm.source || "unknown",
-                  confidence: parseFloat(fm.confidence || "0.8"),
-                  confidenceTier: (fm.confidenceTier as any) || "implied",
-                  tags: [],
-                },
-                content,
-              });
+              facts.push(memory);
             } catch {
               // Skip unreadable files
             }

package/src/orchestrator.ts

@@ -1116,6 +1116,13 @@ export class Orchestrator {
     return this.storageRouter.storageFor(ns);
   }
 
+  filterPrivateSearchResults = (
+    results: QmdSearchResult[], namespaces: readonly string[] = [], preserveUnresolved = false,
+    visibilityCache?: Map<string, boolean>,
+  ) => this.qmdResultResolver.filterPrivateSearchResults(
+    results, this.storage, namespaces, preserveUnresolved, visibilityCache,
+  );
+
   private configuredNamespaceList(): string[] {
     // #1521: delegates to the scope-module resolver. The inline derivation is
     // retired so the adHocNamespaceResolutions ratchet no longer counts this
@@ -3784,14 +3791,6 @@ export class Orchestrator {
       .filter((id): id is string => id !== null);
   }
 
-  // ---------------------------------------------------------------------------
-  // Contradiction Detection (Phase 2B)
-  // ---------------------------------------------------------------------------
-
-  // ---------------------------------------------------------------------------
-  // Feedback (v2.2)
-  // ---------------------------------------------------------------------------
-
   async recordMemoryFeedback(
     memoryId: string,
     vote: "up" | "down",

package/src/storage/supersession-audit.ts

@@ -2,6 +2,7 @@ import { readdir } from "node:fs/promises";
 import type { Dirent } from "node:fs";
 import path from "node:path";
 
+import { stripAttributesSuffix } from "../structured-attributes.js";
 import type { MemoryFile } from "../types.js";
 import { isErrnoCode } from "../utils/errno.js";
 
@@ -15,6 +16,7 @@ export async function hasSupersessionAudit(
   oldMemoryId: string,
   newMemoryId: string,
   auditBody: string,
+  structuredAttributes?: Record<string, string>
 ): Promise<boolean> {
   let entries: Dirent[];
   try {
@@ -32,7 +34,11 @@ export async function hasSupersessionAudit(
       (memory.frontmatter.sourceMemoryId === oldMemoryId ||
         (memory.frontmatter.sourceMemoryId === undefined && memory.frontmatter.lineage?.includes(oldMemoryId))) &&
       memory.frontmatter.lineage?.includes(newMemoryId) &&
-      memory.content === auditBody
+      stripAttributesSuffix(memory.content) === auditBody &&
+      (structuredAttributes === undefined ||
+        Object.entries(structuredAttributes).every(
+          ([key, value]) => memory.frontmatter.structuredAttributes?.[key] === value
+        ))
     ) {
       return true;
     }

package/src/storage/supersession-side-effects.ts

@@ -31,6 +31,8 @@ export interface SupersessionSideEffectOptions {
   exactReplay: boolean;
   currentBefore: MemoryFile;
   updatedFm: MemoryFrontmatter;
+  actor?: string;
+  audit?: SupersessionAuditOptions;
   citationTemplate: string;
   correctionsDir: string;
   readMemoryByPath: (filePath: string) => Promise<MemoryFile | null>;
@@ -44,10 +46,17 @@ export interface SupersessionSideEffectOptions {
   appendTombstone: (input: TombstoneInput) => Promise<string | null>;
   writeSealedMemory: (
     envelope: SealedMemoryEnvelope,
-    extras: { lineage: [string, string]; sourceMemoryId: string }
+    extras: { actor?: string; lineage: [string, string]; sourceMemoryId: string }
   ) => Promise<unknown>;
 }
 
+export interface SupersessionAuditOptions {
+  content: string;
+  tags?: string[];
+  structuredAttributes?: Record<string, string>;
+  source?: string;
+}
+
 export async function runSupersessionSideEffects(options: SupersessionSideEffectOptions): Promise<boolean> {
   const {
     oldMemoryId,
@@ -90,7 +99,7 @@ export async function runSupersessionSideEffects(options: SupersessionSideEffect
       }
     }
 
-    const auditBody = `Superseded: ${currentBefore.content}\n\nReason: ${reason}`;
+    const auditBody = `Superseded: ${options.audit?.content ?? currentBefore.content}\n\nReason: ${reason}`;
     const auditExists = await hasSupersessionAudit(
       {
         correctionsDir: options.correctionsDir,
@@ -98,7 +107,8 @@ export async function runSupersessionSideEffects(options: SupersessionSideEffect
       },
       oldMemoryId,
       newMemoryId,
-      auditBody
+      auditBody,
+      options.audit?.structuredAttributes
     );
     if (!auditExists) {
       const auditEnvelope = composeMemoryEnvelope(
@@ -106,11 +116,13 @@ export async function runSupersessionSideEffects(options: SupersessionSideEffect
           content: auditBody,
           category: "correction",
           confidence: 1,
-          tags: ["supersession", "auto-resolved"],
+          tags: options.audit?.tags ?? ["supersession", "auto-resolved"],
+          structuredAttributes: options.audit?.structuredAttributes,
         },
-        { source: "contradiction-detection" }
+        { source: options.audit?.source ?? "contradiction-detection" }
       );
       await options.writeSealedMemory(auditEnvelope, {
+        actor: options.actor,
         lineage: [oldMemoryId, newMemoryId],
         sourceMemoryId: oldMemoryId,
       });

package/src/storage.ts

@@ -137,7 +137,7 @@ import {
   type TombstoneStats,
 } from "./lifecycle/tombstones.js";
 import { supersessionKeysForFact } from "./temporal-supersession.js";
-import { runSupersessionSideEffects } from "./storage/supersession-side-effects.js";
+import { runSupersessionSideEffects, type SupersessionAuditOptions } from "./storage/supersession-side-effects.js";
 import type {
   AccessTrackingEntry,
   BufferState,
@@ -233,6 +233,7 @@ import {
 } from "./memory-projection-store.js";
 import { inferMemoryStatus, isArchivedMemoryPath, toMemoryPathRel } from "./memory-lifecycle-ledger-utils.js";
 import { normalizeProjectionPreview, normalizeProjectionTags } from "./memory-projection-format.js";
+import { isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
 import { parseFlexibleIsoTimestamp } from "./utils/iso-timestamp.js";
 import {
   composeMemoryEnvelope,
@@ -3682,7 +3683,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     category: MemoryCategory,
     content: string,
     options: WriteMemoryOptions = {}
-  ): Promise<MemoryWriteResult> {
+  ) {
     await this.ensureDirectories();
     const rawEntityRef = options.entityRef;
     let refIds = typeof options.entityRef === "string" ? this.currentHistoricalIds() : null;
@@ -3883,6 +3884,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
         tombstoneBlocked: true,
         blockedBy: duplicateBlocked.frontmatter.blockedBy,
         duplicateOf: duplicateBlocked.frontmatter.id,
+        memory: duplicateBlocked,
       };
     }
     await this.patchHotMemoriesCache({ addedPath: filePath }, "memory-create");
@@ -3937,7 +3939,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
       }
     }
     log.debug(`wrote memory ${id} to ${filePath}`);
-    return { id, tombstoneBlocked, ...(fm.blockedBy ? { blockedBy: fm.blockedBy } : {}) };
+    return { id, tombstoneBlocked, ...(fm.blockedBy ? { blockedBy: fm.blockedBy } : {}), memory: { path: filePath, frontmatter: fm, content: sanitized.text } };
   }
 
   /**
@@ -3959,7 +3961,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
    * `envelope.sourceReason` is access-layer metadata with no frontmatter
    * field and is deliberately not persisted here.
    */
-  async writeSealedMemory(envelope: SealedMemoryEnvelope, extras: SealedWriteExtras = {}): Promise<MemoryWriteResult> {
+  async writeSealedMemory(envelope: SealedMemoryEnvelope, extras: SealedWriteExtras = {}) {
     if (!isSealedMemoryEnvelope(envelope)) {
       throw new Error(
         "writeSealedMemory: value is not a valid sealed memory envelope (fails the composeMemoryEnvelope contract)"
@@ -6636,21 +6638,18 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     return updated;
   }
 
-  /**
-   * Get a memory by its ID.
-   */
   async getMemoryById(id: string): Promise<MemoryFile | null> {
     const memories = await this.readAllMemories();
     return memories.find((m) => m.frontmatter.id === id) ?? null;
   }
 
-  /**
-   * Resolve existing active memory IDs to their on-disk paths.
-   *
-   * Uses a lightweight directory scan (collectActiveMemoryPaths) that reads
-   * file names without parsing frontmatter — much cheaper than readAllMemories()
-   * for citation usage tracking and other existence checks.
-   */
+  async getMemoryByIdIncludingArchived(id: string): Promise<MemoryFile | null> {
+    const active = await this.getMemoryById(id);
+    return active ?? (await this.readAllColdMemories()).find((memory) => memory.frontmatter.id === id) ??
+      (await this.readArchivedMemories()).find((memory) => memory.frontmatter.id === id) ?? null;
+  }
+
+  /** Resolve existing active memory IDs through a lightweight directory scan. */
   async findExistingMemoryPaths(
     ids: string[],
     preferredPaths: Map<string, string[]> = new Map()
@@ -6751,6 +6750,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
       lastAccessed: memory.frontmatter.lastAccessed,
       tags: normalizeProjectionTags(memory.frontmatter.tags),
       preview: normalizeProjectionPreview(memory.content),
+      privateRecord: isSupportPassportPrivateMemory(memory),
     };
   }
 
@@ -6916,9 +6916,9 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     reason: string,
     supersessionMetadata?: Pick<MemoryFrontmatter, "supersessionCause" | "invalidatedBy">,
     options: {
-      requireActive?: boolean;
-      acceptExactReplay?: boolean;
+      actor?: string; requireActive?: boolean; acceptExactReplay?: boolean;
       expectedSnapshot?: Pick<MemoryFile, "content" | "frontmatter"> & Partial<Pick<MemoryFile, "path">>;
+      audit?: SupersessionAuditOptions;
     } = {},
   ): Promise<boolean> {
     const matchesSupersession = (memory: MemoryFile): boolean =>
@@ -7061,6 +7061,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
         exactReplay,
         currentBefore,
         updatedFm,
+        actor: options.actor, audit: options.audit,
         citationTemplate: this.citationTemplate,
         correctionsDir: this.correctionsDir,
         readMemoryByPath: (filePath) => this.readMemoryByPath(filePath),
@@ -7093,7 +7094,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
             memoryId: oldMemoryId,
             eventType: "superseded",
             timestamp: supersededAt,
-            actor: "storage.supersedeMemory",
+            actor: options.actor ?? "storage.supersedeMemory",
             reasonCode: reason,
             before: exactReplay ? { ...beforeState, status: "active" } : beforeState,
             after: afterState,
@@ -7107,14 +7108,12 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
         writeSealedMemory: (envelope, extras) => this.writeSealedMemory(envelope, extras),
       });
       return sideEffectsComplete || options.acceptExactReplay !== true;
-
     } catch (err) {
       log.error(`failed to supersede memory ${oldMemoryId}:`, err);
       return false;
     }
   }
 
-
   private get summariesDir(): string {
     return path.join(this.baseDir, "summaries");
   }