@remnic/core 9.54.4 → 9.54.6

package/src/maintenance/memory-governance.ts

@@ -7,6 +7,7 @@ import { RECALL_FALLBACK_DIRS } from "../utils/category-dir.js";
 import { bumpMemoryCorpusVersionForDir } from "../memory-corpus-version.js";
 import { assertPathInsideRoot } from "../utils/path-containment.js";
 import { requestEntityCanonicalIdReconcile } from "../storage/entity-canonical-id-references.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 
 export type MemoryGovernanceMode = "shadow" | "apply";
 export type MemoryGovernanceReasonCode =
@@ -830,7 +831,9 @@ export async function runMemoryGovernance(
         updatedAfter,
       })
     : undefined;
-  const memories = memoryWindow?.memories ?? await storage.readAllMemories();
+  const memories = excludeSupportPassportPrivateMemories(
+    memoryWindow?.memories ?? await storage.readAllMemories(),
+  );
   const reviewQueue = await buildReviewQueue(options.memoryDir, storage, memories, now, {
     malformedCandidateFiles: memoryWindow?.filePaths,
   });

package/src/maintenance/pattern-reinforcement.test.ts

@@ -328,6 +328,26 @@ test("runPatternReinforcement: skips out-of-scope categories", async () => {
   assert.equal(writes.length, 0);
 });
 
+test("runPatternReinforcement: excludes support-passport private records", async () => {
+  const content = "Give me advance notice before plans change.";
+  const passport = makeMemory({
+    id: "passport-card",
+    content,
+    tags: ["support-passport-card"],
+  });
+  const publicPreference = makeMemory({ id: "public-preference", content });
+  const { stub, writes } = makeStorageStub([passport, publicPreference]);
+
+  const result = await runPatternReinforcement(stub, {
+    categories: ["preference"],
+    minCount: 2,
+    now: frozenNow,
+  });
+
+  assert.equal(result.clustersFound, 0);
+  assert.deepEqual(writes, []);
+});
+
 test("runPatternReinforcement: counts both active and already-superseded members; only writes to active duplicates", async () => {
   const dupContent = "mixed status cluster";
   const memories = [

package/src/maintenance/pattern-reinforcement.ts

@@ -35,6 +35,7 @@
 import { clusterByKey } from "../procedural/reinforcement-core.js";
 import { buildRetiredFactTombstoneInputs, type TombstoneReason, type TombstoneCreatedBy } from "../lifecycle/tombstones.js";
 import { supersessionKeysForFact } from "../temporal-supersession.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 import type {
   MemoryFile,
   MemoryFrontmatter,
@@ -225,7 +226,7 @@ export async function runPatternReinforcement(
     return emptyResult();
   }
 
-  const memories = await storage.readAllMemories();
+  const memories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
 
   // Cluster across BOTH active and already-superseded memories so a
   // canonical that has previously absorbed duplicates still gets

package/src/maintenance/rebuild-memory-projection.ts

@@ -44,6 +44,7 @@ import {
 } from "../memory-projection-format.js";
 import { openBetterSqlite3 } from "../runtime/better-sqlite.js";
 import { commitPreparedFileAtomically } from "./atomic-file.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 export interface RebuildMemoryProjectionOptions {
   memoryDir: string;
@@ -204,6 +205,7 @@ function toCurrentStateRow(memoryDir: string, memory: MemoryFile): MemoryProject
     lastAccessed: memory.frontmatter.lastAccessed,
     tags: normalizeProjectionTags(memory.frontmatter.tags),
     preview: normalizeProjectionPreview(memory.content),
+    privateRecord: isSupportPassportPrivateMemory(memory),
   };
 }
 
@@ -406,6 +408,7 @@ function serializeCurrentStateRow(row: MemoryProjectionCurrentState): string {
     lastAccessed: row.lastAccessed ?? null,
     tags: row.tags ?? [],
     preview: row.preview ?? "",
+    privateRecord: row.privateRecord === true,
   });
 }
 
@@ -691,8 +694,7 @@ function readProjectedCurrentRows(
           memory_kind,
           access_count,
           last_accessed,
-          ${selectExpressions.tagsJson},
-          ${selectExpressions.previewText}
+          ${selectExpressions.tagsJson}, ${selectExpressions.previewText}, ${selectExpressions.privateRecord}
         FROM memory_current
       `).all() as Array<Record<string, unknown>>;
 
@@ -788,9 +790,8 @@ function writeProjectionDb(
         memory_kind,
         access_count,
         last_accessed,
-        tags_json,
-        preview_text
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        tags_json, preview_text, private_record
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
 
     const insertTimeline = db.prepare(`
@@ -899,9 +900,8 @@ function writeProjectionDb(
           row.confidenceTier,
           row.memoryKind ?? null,
           row.accessCount ?? null,
-          row.lastAccessed ?? null,
-          JSON.stringify(row.tags ?? []),
-          row.preview ?? "",
+          row.lastAccessed ?? null, JSON.stringify(row.tags ?? []), row.preview ?? "",
+          row.privateRecord === true ? 1 : 0,
         );
       }
 

package/src/mcp-read-only-tools.ts

@@ -61,4 +61,7 @@ export const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {
   codegraph_get_snippet: true,
   codegraph_get_architecture: true,
   codegraph_search_code: true,
+  support_passport_memory_preview: true,
+  support_passport_cards_list: true,
+  support_passport_grants_list: true,
 };

package/src/memory-projection-store.ts

@@ -20,12 +20,11 @@ import {
   type BetterSqlite3Database,
 } from "./runtime/better-sqlite.js";
 
-export const MEMORY_PROJECTION_SCHEMA_VERSION = 3;
+export const MEMORY_PROJECTION_SCHEMA_VERSION = 4;
 
 export interface ProjectedMemoryBrowseOptions {
-  query?: string;
-  status?: string;
-  category?: string;
+  query?: string; status?: string; category?: string;
+  excludeTags?: readonly string[]; excludePrivateRecords?: boolean;
   sort?: "updated_desc" | "updated_asc" | "created_desc" | "created_asc";
   limit: number;
   offset: number;
@@ -154,15 +153,15 @@ function migrateProjectionSchemaIfNeeded(memoryDir: string): void {
 }
 
 export function memoryCurrentSelectExpressions(db: BetterSqlite3Database): {
-  tagsJson: string;
-  previewText: string;
-  hasPathValid: boolean;
+  tagsJson: string; previewText: string; hasPathValid: boolean;
+  privateRecord: string; hasPrivateRecord: boolean;
 } {
   const columns = listTableColumns(db, "memory_current");
   return {
     tagsJson: columns.has("tags_json") ? "tags_json" : `'[]' AS tags_json`,
-    previewText: columns.has("preview_text") ? "preview_text" : `'' AS preview_text`,
-    hasPathValid: columns.has("path_valid"),
+    previewText: columns.has("preview_text") ? "preview_text" : `'' AS preview_text`, hasPathValid: columns.has("path_valid"),
+    privateRecord: columns.has("private_record") ? "private_record" : "0 AS private_record",
+    hasPrivateRecord: columns.has("private_record"),
   };
 }
 
@@ -192,7 +191,8 @@ export function initializeMemoryProjectionDb(db: BetterSqlite3Database): void {
       access_count INTEGER,
       last_accessed TEXT,
       tags_json TEXT NOT NULL DEFAULT '[]',
-      preview_text TEXT NOT NULL DEFAULT ''
+      preview_text TEXT NOT NULL DEFAULT '',
+      private_record INTEGER NOT NULL DEFAULT 0 CHECK (private_record IN (0, 1))
     );
 
     CREATE INDEX IF NOT EXISTS idx_memory_current_status
@@ -428,6 +428,7 @@ const REQUIRED_MEMORY_CURRENT_COLUMNS = [
   "created_at",
   "updated_at",
   "entity_ref",
+  "private_record",
 ] as const;
 
 function assertProjectionSchemaReadable(db: BetterSqlite3Database): void {
@@ -698,6 +699,7 @@ export function parseCurrentRow(
     lastAccessed: typeof row.last_accessed === "string" ? row.last_accessed : undefined,
     tags: parseStringArray(row.tags_json),
     preview: typeof row.preview_text === "string" ? row.preview_text : "",
+    privateRecord: row.private_record === 1,
   };
 }
 
@@ -760,7 +762,8 @@ export function readProjectedMemoryState(
             access_count,
             last_accessed,
             ${currentSelect.tagsJson},
-            ${currentSelect.previewText}
+            ${currentSelect.previewText},
+            ${currentSelect.privateRecord}
           FROM memory_current
           WHERE memory_id = ?
         `,
@@ -820,38 +823,33 @@ export function readProjectedMemoryBrowse(
 ): ProjectedMemoryBrowsePage | null {
   return withProjectionReadonly(memoryDir, (db) => {
     const normalizedQuery = options.query?.trim().toLowerCase() ?? "";
-
     const currentSelect = memoryCurrentSelectExpressions(db);
+    if ((options.excludeTags?.length ?? 0) > 0 && currentSelect.tagsJson.startsWith("'[]'"))
+      throw new Error("tag exclusions require tags_json");
+    if (options.excludePrivateRecords && !currentSelect.hasPrivateRecord)
+      throw new Error("private-record exclusions require private_record");
     const whereClauses: string[] = [];
     const params: unknown[] = [];
-
-    if (options.status) {
-      whereClauses.push("status = ?");
-      params.push(options.status);
+    if (options.status) { whereClauses.push("status = ?"); params.push(options.status); }
+    if (options.category) { whereClauses.push("category = ?"); params.push(options.category); }
+    for (const tag of options.excludeTags ?? []) {
+      whereClauses.push("NOT EXISTS (SELECT 1 FROM json_each(memory_current.tags_json) WHERE value = ?)");
+      params.push(tag);
     }
-    if (options.category) {
-      whereClauses.push("category = ?");
-      params.push(options.category);
-    }
-    const sort = options.sort ?? "updated_desc";
+    if (options.excludePrivateRecords) whereClauses.push("private_record = 0");
     const orderBySql = (() => {
-      switch (sort) {
+      switch (options.sort ?? "updated_desc") {
         case "updated_asc":
           return "updated_at ASC, created_at ASC, memory_id ASC";
         case "created_desc":
           return "created_at DESC, updated_at DESC, memory_id ASC";
         case "created_asc":
           return "created_at ASC, updated_at ASC, memory_id ASC";
-        case "updated_desc":
         default:
           return "updated_at DESC, created_at DESC, memory_id ASC";
       }
     })();
-    const whereSql = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
-
     if (normalizedQuery) {
-      // Full-content search still examines every eligible row so totals and
-      // matches stay exact, but iteration keeps memory use proportional to the page.
       const queryWhereClauses = currentSelect.hasPathValid
         ? [...whereClauses, ...projectedBrowsePathSqlClauses(), "path_valid = 1"]
         : whereClauses;

package/src/offline-sync-file-io.ts

@@ -0,0 +1,68 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { open } from "node:fs/promises";
+import { MAGIC_HEADER_SIZE, isEncryptedFile } from "./secure-store/secure-fs.js";
+
+export interface OfflineSyncFileTarget {
+  root: string;
+  path: string;
+  filePath: string;
+}
+
+export type OfflineSyncExcludeFile = (target: OfflineSyncFileTarget) => boolean | Promise<boolean>;
+
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw new Error("offline sync request aborted");
+}
+
+export async function shouldExcludeOfflineSyncFile(
+  excludeFile: OfflineSyncExcludeFile | undefined,
+  target: OfflineSyncFileTarget
+): Promise<boolean> {
+  return excludeFile ? await excludeFile(target) : false;
+}
+
+export async function sha256OfflineSyncFile(
+  filePath: string,
+  signal?: AbortSignal
+): Promise<{ sha256: string; bytes: number }> {
+  const hash = createHash("sha256");
+  let bytes = 0;
+  for await (const chunk of createReadStream(filePath)) {
+    throwIfAborted(signal);
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    hash.update(buffer);
+    bytes += buffer.length;
+  }
+  throwIfAborted(signal);
+  return { sha256: hash.digest("hex"), bytes };
+}
+
+export async function isEncryptedOfflineSyncFile(filePath: string): Promise<boolean> {
+  const handle = await open(filePath, "r");
+  try {
+    const header = Buffer.alloc(MAGIC_HEADER_SIZE);
+    const { bytesRead } = await handle.read(header, 0, header.length, 0);
+    return bytesRead >= MAGIC_HEADER_SIZE && isEncryptedFile(header);
+  } finally {
+    await handle.close();
+  }
+}
+
+export async function readPlainOfflineSyncFileChunk(options: {
+  filePath: string;
+  offset: number;
+  length: number;
+  bytes: number;
+}): Promise<Buffer> {
+  const chunkBytes = Math.min(options.length, options.bytes - options.offset);
+  const chunk = Buffer.alloc(chunkBytes);
+  if (chunkBytes === 0) return chunk;
+  const handle = await open(options.filePath, "r");
+  try {
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, options.offset);
+    return bytesRead === chunk.length ? chunk : chunk.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}

package/src/offline-sync.ts

@@ -1,5 +1,4 @@
 import { createHash, randomUUID } from "node:crypto";
-import { createReadStream } from "node:fs";
 import {
   lstat,
   mkdir,
@@ -17,7 +16,6 @@ import path from "node:path";
 import {
   DEFAULT_TRANSFER_EXCLUDE_DIRS,
 } from "./transfer/exclusions.js";
-import { isEncryptedFile, MAGIC_HEADER_SIZE } from "./secure-store/secure-fs.js";
 import {
   prepareSafeArchiveRoot,
   resolveSafeArchiveTarget,
@@ -27,6 +25,16 @@ import {
 } from "./transfer/fs-utils.js";
 import { parseFlexibleIsoTimestamp } from "./utils/iso-timestamp.js";
 import { DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS } from "./offline-sync-exclude-globs.js";
+import {
+  isEncryptedOfflineSyncFile,
+  readPlainOfflineSyncFileChunk,
+  sha256OfflineSyncFile,
+  shouldExcludeOfflineSyncFile,
+  type OfflineSyncExcludeFile,
+  type OfflineSyncFileTarget,
+} from "./offline-sync-file-io.js";
+
+export type { OfflineSyncExcludeFile, OfflineSyncFileTarget } from "./offline-sync-file-io.js";
 
 export const OFFLINE_SYNC_SNAPSHOT_FORMAT = "remnic.offline-sync.snapshot.v1";
 export const OFFLINE_SYNC_CHANGESET_FORMAT = "remnic.offline-sync.changeset.v1";
@@ -141,12 +149,6 @@ export interface OfflineSyncChangesetSummary {
   total: number;
 }
 
-export interface OfflineSyncFileTarget {
-  root: string;
-  path: string;
-  filePath: string;
-}
-
 export interface OfflineSyncFileDeleteTarget extends OfflineSyncFileTarget {
   mtimeMs?: number;
 }
@@ -826,7 +828,7 @@ async function readOfflineSyncFileRecord(
     digest = sha256Buffer(content);
     content = null;
   } else {
-    digest = await sha256File(options.filePath, options.signal);
+    digest = await sha256OfflineSyncFile(options.filePath, options.signal);
   }
   throwIfOfflineSyncAborted(options.signal);
   const st = await stat(options.filePath);
@@ -839,57 +841,13 @@ async function readOfflineSyncFileRecord(
   };
 }
 
-async function sha256File(filePath: string, signal?: AbortSignal): Promise<OfflineSyncFileDigest> {
-  const hash = createHash("sha256");
-  let bytes = 0;
-  for await (const chunk of createReadStream(filePath)) {
-    throwIfOfflineSyncAborted(signal);
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    hash.update(buffer);
-    bytes += buffer.length;
-  }
-  throwIfOfflineSyncAborted(signal);
-  return {
-    sha256: hash.digest("hex"),
-    bytes,
-  };
-}
-
-async function fileIsSecureStoreEncrypted(filePath: string): Promise<boolean> {
-  const handle = await open(filePath, "r");
-  try {
-    const header = Buffer.alloc(MAGIC_HEADER_SIZE);
-    const { bytesRead } = await handle.read(header, 0, header.length, 0);
-    return bytesRead >= MAGIC_HEADER_SIZE && isEncryptedFile(header);
-  } finally {
-    await handle.close();
-  }
-}
-
-async function readPlainFileContentChunk(options: {
-  filePath: string;
-  offset: number;
-  length: number;
-  bytes: number;
-}): Promise<Buffer> {
-  const chunkBytes = Math.min(options.length, options.bytes - options.offset);
-  const chunk = Buffer.alloc(chunkBytes);
-  if (chunkBytes === 0) return chunk;
-  const handle = await open(options.filePath, "r");
-  try {
-    const { bytesRead } = await handle.read(chunk, 0, chunk.length, options.offset);
-    return bytesRead === chunk.length ? chunk : chunk.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
-
 export async function* iterateOfflineSyncSnapshotFileRecords(options: {
   root: string;
   includeContent?: boolean;
   includeTranscripts?: boolean;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -924,6 +882,11 @@ export async function* iterateOfflineSyncSnapshotFileRecords(options: {
         continue;
       }
       if (!entry.isFile()) continue;
+      if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+        root: root.abs,
+        path: relPosix,
+        filePath: abs,
+      })) continue;
       yield await readOfflineSyncFileRecord({
         root,
         relPath: relPosix,
@@ -948,6 +911,7 @@ export async function buildOfflineSyncSnapshot(options: {
   now?: Date;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -995,6 +959,7 @@ export async function buildOfflineSyncSnapshotFromBase(options: {
   now?: Date;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -1039,6 +1004,11 @@ export async function buildOfflineSyncSnapshotFromBase(options: {
         continue;
       }
       if (!entry.isFile()) continue;
+      if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+        root: root.abs,
+        path: relPosix,
+        filePath: abs,
+      })) continue;
       const st = await stat(abs);
       const baseEntry = base.get(relPosix);
       if (
@@ -1094,6 +1064,7 @@ export async function buildOfflineSyncSnapshotForPaths(options: {
   now?: Date;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -1130,6 +1101,13 @@ export async function buildOfflineSyncSnapshotForPaths(options: {
       throw error;
     });
     if (!st || st.isSymbolicLink() || !st.isFile()) continue;
+    if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+      root: root.abs,
+      path: relPath,
+      filePath,
+    })) {
+      throw new Error(`offline sync snapshot path is excluded: ${relPath}`);
+    }
     files.push(await readOfflineSyncFileRecord({
       root,
       relPath,
@@ -1169,6 +1147,7 @@ export async function readOfflineSyncFileContentChunk(options: {
   length?: number;
   includeTranscripts?: boolean;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -1209,12 +1188,19 @@ export async function readOfflineSyncFileContentChunk(options: {
   if (!st || st.isSymbolicLink() || !st.isFile()) {
     throw new Error(`offline sync file content path not found: ${relPath}`);
   }
-  const encrypted = await fileIsSecureStoreEncrypted(filePath);
+  if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+    root: root.abs,
+    path: relPath,
+    filePath,
+  })) {
+    throw new Error(`offline sync file content path is excluded: ${relPath}`);
+  }
+  const encrypted = await isEncryptedOfflineSyncFile(filePath);
   if (!encrypted) {
     if (offset > st.size) {
       throw new Error(`offset must be <= file size for ${relPath}`);
     }
-    const chunk = await readPlainFileContentChunk({
+    const chunk = await readPlainOfflineSyncFileChunk({
       filePath,
       offset,
       length: requestedLength,
@@ -2017,7 +2003,7 @@ async function readLocalFileState(options: {
     const content = await options.readFile({ root: options.rootAbs, path: options.relPath, filePath });
     digest = sha256Buffer(content);
   } else {
-    digest = await sha256File(filePath, options.signal);
+    digest = await sha256OfflineSyncFile(filePath, options.signal);
   }
   throwIfOfflineSyncAborted(options.signal);
   return {

package/src/orchestration/consolidation-run.ts

@@ -67,6 +67,7 @@ import type {
   PluginConfig,
   RecallSectionConfig,
 } from "../types.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 
 /** Dependencies injected by the orchestrator. Stable references or live
  *  accessors — lazy getters for mutable fields tests reassign
@@ -449,7 +450,7 @@ export class ConsolidationRunCoordinator {
     }
     await this.pruneHarmonicStores(storage);
 
-    let allMemories = await storage.readAllMemories();
+    let allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
     if (allMemories.length < 5) {
       return { memoriesProcessed: allMemories.length, merged, invalidated };
     }
@@ -801,7 +802,7 @@ export class ConsolidationRunCoordinator {
       // mutations for the catalog touch below (codex NThSW).
       const tierMigration = await this.deps.tierMigrationCoordinator.runCycle(storage, "maintenance");
       if (tierMigration.migrated > 0) memoryItemMutated = true;
-      allMemories = await storage.readAllMemories();
+      allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
 
       // Fact archival pass (v6.0) — move old, low-importance, rarely-accessed facts to archive/
       if (resolveRecallEnhancementCapabilities(config).factArchival) {
@@ -823,7 +824,7 @@ export class ConsolidationRunCoordinator {
     } catch (err) {
       log.warn(`deep-sleep maintenance pass failed (ignored): ${err}`);
       try {
-        allMemories = await storage.readAllMemories();
+        allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
       } catch (readErr) {
         log.warn(`deep-sleep maintenance recovery read failed: ${readErr}`);
         throw err;
@@ -862,7 +863,7 @@ export class ConsolidationRunCoordinator {
           const semResult = await this.deps.semanticConsolidationCoordinator.runSemanticConsolidation();
           let remItemsProcessed = allMemories.length;
           try {
-            allMemories = await storage.readAllMemories();
+            allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
             remItemsProcessed = allMemories.length;
           } catch (err) {
             log.warn(

package/src/orchestration/contradiction-linking-coordinator.ts

@@ -43,6 +43,7 @@ import type {
   DependencyPropagationDeliveryPort,
   DependencyPropagationPreparationToken,
 } from "./dependency-propagation-delivery.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 /** Result type of {@link ContradictionLinkingCoordinator.checkForContradiction}. */
 export interface ContradictionResult {
@@ -170,6 +171,7 @@ export class ContradictionLinkingCoordinator {
         const resultStorage = await this.storageForNamespace(resultNamespace);
         const existingMemory = await resultStorage.getMemoryById(memoryId);
         if (!existingMemory) continue;
+        if (isSupportPassportPrivateMemory(existingMemory)) continue;
         if (inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active") continue;
         const verification = await this.getExtraction().verifyContradiction(
           { content, category },
@@ -231,6 +233,9 @@ export class ContradictionLinkingCoordinator {
       ]);
       anchorSnapshot = mergeMemorySnapshots(hot, cold, resultStorage.dir);
     }
+    anchorSnapshot = anchorSnapshot?.filter(
+      (memory) => !isSupportPassportPrivateMemory(memory),
+    );
     const anchorMemoryById = anchorSnapshot
       ? new Map(anchorSnapshot.map((memory) => [memory.frontmatter.id, memory]))
       : undefined;
@@ -264,6 +269,7 @@ export class ContradictionLinkingCoordinator {
               anchorMemoryById?.get(memoryId) ?? (await resultStorage.getMemoryById(memoryId));
             if (
               !existingMemory ||
+              isSupportPassportPrivateMemory(existingMemory) ||
               inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active"
             ) continue;
             hits.push({
@@ -290,6 +296,7 @@ export class ContradictionLinkingCoordinator {
         anchorMemoryById?.get(candidate.id) ?? (await resultStorage.getMemoryById(candidate.id));
       if (
         !existingMemory ||
+        isSupportPassportPrivateMemory(existingMemory) ||
         inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active"
       ) continue;
       const verification = await this.getExtraction().verifyContradiction(