@remnic/core 9.69.22 → 9.69.24

package/dist/{chunk-DP4EBV7C.js → chunk-WMLEPWMO.js}

@@ -3,10 +3,17 @@ import {
 } from "./chunk-KJTKLXTH.js";
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-XSGUMQQQ.js";
 import {
   assertInjectedStorageRooted
-} from "./chunk-JRRQ747T.js";
+} from "./chunk-TBXAY2SS.js";
+import {
+  displayErrorDetail
+} from "./chunk-RL6NEVXT.js";
+import {
+  copyExistingFileToBackup,
+  writeFileAtomically
+} from "./chunk-AW4QUFQF.js";
 import {
   MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS,
   buildLifecycleEventsForMemory,
@@ -16,19 +23,15 @@ import {
   memoryLifecycleLedgerLockPath,
   sortMemoryLifecycleEvents
 } from "./chunk-7RJUVTVF.js";
-import {
-  displayErrorDetail
-} from "./chunk-RL6NEVXT.js";
-import {
-  copyExistingFileToBackup,
-  writeFileAtomically
-} from "./chunk-AW4QUFQF.js";
 import {
   withHeldFileLock
 } from "./chunk-FFAZ2XFU.js";
 import {
   probeEncryptedRegularFileHeader
-} from "./chunk-ET2CNMLD.js";
+} from "./chunk-JN72EPOE.js";
+import {
+  isErrnoCode
+} from "./chunk-KNA3BXXL.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -36,9 +39,6 @@ import {
 // src/maintenance/rebuild-memory-lifecycle-ledger.ts
 import path from "path";
 import { stat } from "fs/promises";
-function isNodeError(err) {
-  return typeof err === "object" && err !== null && "code" in err;
-}
 function lifecycleRowBytes(event) {
   return Buffer.byteLength(`${JSON.stringify(event)}
 `, "utf8");
@@ -72,7 +72,7 @@ async function backupExistingLedger(memoryDir, outputPath, now) {
   try {
     await stat(outputPath);
   } catch (err) {
-    if (isNodeError(err) && err.code === "ENOENT") {
+    if (isErrnoCode(err, "ENOENT")) {
       return void 0;
     }
     throw err;
@@ -206,7 +206,7 @@ async function rebuildMemoryLifecycleLedger(options) {
         currentEncrypted = await probeEncryptedRegularFileHeader(outputPath);
         priorRawBuffer = await storage.readMemoryLifecycleLedgerRawBufferForCompaction();
       } catch (err) {
-        if (!isNodeError(err) || err.code !== "ENOENT") throw err;
+        if (!isErrnoCode(err, "ENOENT")) throw err;
       }
       const forceEncrypt = secureRewrite && currentEncrypted && storage.isSecureStoreUnlocked();
       const replacementEncrypted = secureRewrite && (storage.willEncryptStateWrites() || forceEncrypt);
@@ -260,4 +260,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-DP4EBV7C.js.map
+//# sourceMappingURL=chunk-WMLEPWMO.js.map

package/dist/chunk-WMLEPWMO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/maintenance/rebuild-memory-lifecycle-ledger.ts"],"sourcesContent":["import path from \"node:path\";\nimport { stat } from \"node:fs/promises\";\nimport { StorageManager } from \"../storage.js\";\nimport { assertInjectedStorageRooted } from \"./projection-support.js\";\nimport { log } from \"../logger.js\";\nimport { displayErrorDetail } from \"../runtime/better-sqlite.js\";\nimport type { MemoryLifecycleEvent } from \"../types.js\";\nimport { toBackupStamp } from \"./backup-stamp.js\";\nimport { copyExistingFileToBackup, writeFileAtomically } from \"./atomic-file.js\";\nimport {\n  buildLifecycleEventsForMemory,\n  compareMemoryLifecycleEvents,\n  sortMemoryLifecycleEvents,\n  isFrontmatterDerivedLifecycleEventType,\n  memoryLifecycleEventProjectionIdentity,\n  memoryLifecycleLedgerLockPath,\n  MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS,\n} from \"../memory-lifecycle-ledger-utils.js\";\nimport { withHeldFileLock, type HeldFileLockOptions, type HeldFileLockController } from \"../utils/serialize-mutations.js\";\nimport { probeEncryptedRegularFileHeader } from \"../secure-store/secure-fs.js\";\nimport { isErrnoCode } from \"../utils/errno.js\";\n\n\nexport interface RebuildMemoryLifecycleLedgerOptions {\n  memoryDir: string;\n  dryRun?: boolean;\n  now?: Date;\n  /**\n   * Active storage context (issue #1910). When provided, memories are read\n   * through it (so encrypted-at-rest memories in a secure-store deployment are\n   * decrypted with the live key) and the rebuilt ledger is rewritten through\n   * its secure writer (so it stays encrypted at rest). Its `dir` MUST equal\n   * `memoryDir`. When omitted, a fresh plaintext `StorageManager` is used and\n   * the ledger is written as plaintext — the CLI default.\n   */\n  storage?: StorageManager;\n  /**\n   * Preserve append-only lifecycle events that have no frontmatter equivalent\n   * (issue #1910). `buildLifecycleEventsForMemory` only reconstructs\n   * `created`/`updated`/`superseded`/`archived` from frontmatter, so a bare\n   * rebuild silently drops history like `explicit_capture_accepted`,\n   * `explicit_capture_queued`, `imported`, `promoted`, `merged`, `restored`,\n   * and `rejected`. When true, the existing ledger's non-reconstructable rows\n   * are read (via the same secure/permissive `readAllMemoryLifecycleEvents`\n   * path), merged with the rebuilt rows, deduplicated by `eventId`, and sorted\n   * canonically. Background auto-compaction sets this so it never loses events;\n   * the manual/CLI repair rebuild leaves it off (reconstruct purely from\n   * frontmatter).\n   */\n  preserveExistingEvents?: boolean;\n  /**\n   * Override the ledger-lock acquisition timing (issue #2033). Only\n   * `maxWaitMs`/`pollMs` are honored; `staleMs` stays fixed at\n   * `MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS`. Used by tests to force the\n   * lock-acquisition-failure branch (`acquired=false`) deterministically\n   * without a multi-second wait.\n   */\n  lockOptions?: Pick<HeldFileLockOptions, \"maxWaitMs\" | \"pollMs\">;\n  /**\n   * Upper bound (bytes) on the rewritten ledger when preserving events (issue\n   * #2033). A preserving compaction carries over ALL append-only history, which\n   * — if the history alone is large — could leave the rewritten ledger over the\n   * whole-file read/decrypt cap (STATE_FILE_MAX_DECRYPT_BYTES), the exact\n   * unreadable-ledger failure compaction exists to prevent. When set and the\n   * preserved payload would exceed it, the OLDEST rows are dropped from the\n   * active ledger until it fits; because the full pre-compaction ledger is\n   * copied verbatim to the timestamped backup first, those rows are archived,\n   * not lost. Ignored when `preserveExistingEvents` is off (a frontmatter-only\n   * rebuild is already bounded by the corpus). `0`/undefined disables bounding.\n   */\n  maxLedgerBytes?: number;\n}\n\nexport interface SkippedLifecycleBlankIdMemory {\n  path: string;\n}\n\nexport interface SkippedDuplicateLifecycleEvent {\n  eventId: string;\n  keptPath: string;\n  skippedPath: string;\n}\n\nexport interface RebuildMemoryLifecycleLedgerResult {\n  dryRun: boolean;\n  scannedMemories: number;\n  rebuiltRows: number;\n  outputPath: string;\n  backupPath?: string;\n  skippedBlankIdMemories: SkippedLifecycleBlankIdMemory[];\n  skippedDuplicateEvents: SkippedDuplicateLifecycleEvent[];\n  /**\n   * Count of existing-ledger rows carried over beyond the frontmatter\n   * reconstruction (only set when `preserveExistingEvents` is on; issue #1910):\n   * append-only history with no frontmatter equivalent, plus any\n   * frontmatter-derived row that raced in after the corpus scan and so was not\n   * reproduced by the reconstruction (#2033).\n   */\n  preservedAppendOnlyRows?: number;\n  /**\n   * Count of oldest rows dropped from the ACTIVE ledger to keep it under\n   * `maxLedgerBytes` (issue #2033). They remain in the verbatim timestamped\n   * backup, so this is a bound-and-archive, not a loss. Set only when bounding\n   * actually trimmed rows.\n   */\n  archivedOverflowRows?: number;\n  /**\n   * Whether the active ledger was actually backed up and rewritten (issue #2033\n   * thread PRRT_kwDORJXyws6SExst). A preserving write-mode rebuild that would\n   * reproduce the current ledger byte-for-byte (same decrypted content AND same\n   * at-rest format) skips the backup+rewrite, so callers can distinguish a real\n   * compaction from a no-op and avoid re-archiving an unchanged ledger every\n   * interval. `true` for every dry run's non-write preview is never set — only\n   * write-mode results carry it; defaults to `false` when no rewrite happened.\n   */\n  rewritten?: boolean;\n}\n\n/** Serialized on-disk size (bytes, incl. trailing newline) of one ledger row. */\nfunction lifecycleRowBytes(event: MemoryLifecycleEvent): number {\n  return Buffer.byteLength(`${JSON.stringify(event)}\\n`, \"utf8\");\n}\n\n/**\n * Keep the NEWEST canonically-ordered events whose serialized payload fits\n * strictly under `cap` bytes (issue #2033). Recency is by `timestamp` (newest\n * first), tie-broken by the canonical comparator, so a large append-only\n * history is trimmed to its most recent rows rather than to a single memoryId\n * group (the ledger's on-disk order is by memoryId then time).\n *\n * A row too large to fit the remaining budget is SKIPPED, and scanning\n * continues to older rows that still fit — one oversized (or future-dated,\n * hence recency-first) row cannot truncate the entire older history. The kept\n * subset is returned in the input's canonical order; the caller relies on the\n * verbatim backup to retain the dropped rows.\n */\nexport function boundLifecycleEventsToByteCap(\n  events: MemoryLifecycleEvent[],\n  cap: number,\n): { kept: MemoryLifecycleEvent[]; dropped: number } {\n  if (!(cap > 0)) return { kept: events, dropped: 0 };\n  const sizes = new Map<MemoryLifecycleEvent, number>();\n  let total = 0;\n  for (const event of events) {\n    const bytes = lifecycleRowBytes(event);\n    sizes.set(event, bytes);\n    total += bytes;\n  }\n  if (total <= cap) return { kept: events, dropped: 0 };\n  const byRecency = [...events].sort((a, b) => {\n    if (a.timestamp !== b.timestamp) return b.timestamp.localeCompare(a.timestamp);\n    return -compareMemoryLifecycleEvents(a, b);\n  });\n  const keep = new Set<MemoryLifecycleEvent>();\n  let running = 0;\n  for (const event of byRecency) {\n    const bytes = sizes.get(event)!;\n    if (running + bytes > cap) continue; // skip this row, keep scanning older rows that still fit\n    running += bytes;\n    keep.add(event);\n  }\n  const kept = events.filter((event) => keep.has(event));\n  return { kept, dropped: events.length - kept.length };\n}\n\nexport async function backupExistingLedger(\n  memoryDir: string,\n  outputPath: string,\n  now: Date,\n): Promise<string | undefined> {\n  try {\n    await stat(outputPath);\n  } catch (err) {\n    if (isErrnoCode(err, \"ENOENT\")) {\n      return undefined;\n    }\n    throw err;\n  }\n\n  const backupPath = path.join(\n    memoryDir,\n    \"archive\",\n    \"memory-lifecycle-ledger\",\n    toBackupStamp(now),\n    \"state\",\n    \"memory-lifecycle-ledger.jsonl\",\n  );\n  return backupPath;\n}\n\nexport async function rebuildMemoryLifecycleLedger(\n  options: RebuildMemoryLifecycleLedgerOptions,\n): Promise<RebuildMemoryLifecycleLedgerResult> {\n  const dryRun = options.dryRun !== false;\n  const now = options.now ?? new Date();\n  const outputPath = path.join(options.memoryDir, \"state\", \"memory-lifecycle-ledger.jsonl\");\n  const storage = assertInjectedStorageRooted(\"rebuildMemoryLifecycleLedger\", options.memoryDir, options.storage) ?? new StorageManager(options.memoryDir);\n  const secureRewrite = options.storage !== undefined;\n  const tiers = [\n    await storage.readAllMemories(),\n    await storage.readAllColdMemories(),\n    await storage.readArchivedMemories(),\n  ];\n  const allMemories = tiers.flat();\n  const skippedBlankIdMemories: SkippedLifecycleBlankIdMemory[] = [];\n  const eventCandidates: Array<{ event: MemoryLifecycleEvent; path: string }> = [];\n  for (const tier of tiers) {\n    for (const memory of [...tier].sort((left, right) => left.path.localeCompare(right.path))) {\n      if (!memory.frontmatter.id.trim()) {\n        skippedBlankIdMemories.push({ path: memory.path });\n        log.warn(`lifecycle ledger rebuild skipped blank memory id: path=${memory.path}`);\n        continue;\n      }\n      for (const event of buildLifecycleEventsForMemory(memory)) {\n        eventCandidates.push({ event, path: memory.path });\n      }\n    }\n  }\n\n  const orderedEvents = sortMemoryLifecycleEvents(eventCandidates.map((candidate) => candidate.event));\n  const candidateByEvent = new Map(\n    eventCandidates.map((candidate) => [candidate.event, candidate]),\n  );\n  const keptByEventId = new Map<string, { event: MemoryLifecycleEvent; path: string }>();\n  const events: MemoryLifecycleEvent[] = [];\n  const skippedDuplicateEvents: SkippedDuplicateLifecycleEvent[] = [];\n  for (const event of orderedEvents) {\n    const candidate = candidateByEvent.get(event)!;\n    const kept = keptByEventId.get(event.eventId);\n    if (kept) {\n      skippedDuplicateEvents.push({\n        eventId: event.eventId,\n        keptPath: kept.path,\n        skippedPath: candidate.path,\n      });\n      log.warn(\n        `lifecycle ledger rebuild skipped duplicate event_id=${event.eventId}: `\n        + `kept=${kept.path} skipped=${candidate.path}`,\n      );\n      continue;\n    }\n    keptByEventId.set(event.eventId, candidate);\n    events.push(event);\n  }\n\n  let finalEvents = events;\n  let preservedAppendOnlyRows: number | undefined;\n  let archivedOverflowRows: number | undefined;\n  let backupPath: string | undefined;\n  let rewritten = false;\n  // The preserve-read + whole-file rewrite are serialized against concurrent\n  // lifecycle appends ONLY in write mode (issue #1910, codex):\n  // appendMemoryLifecycleEvents holds this same cross-process lock, so an event\n  // appended after the preserve-read but before the atomic rename waits and\n  // lands on the compacted ledger instead of being clobbered by the rename. A\n  // DRY RUN takes no lock — it reads the ledger read-only to compute the\n  // preserve/merge/byte-cap PREVIEW and never rewrites, so it must not block\n  // appends (#2033 Cursor). The corpus scan above stays outside the lock in\n  // both modes — frontmatter-derived rows come from the memory files.\n  const runLedgerCriticalSection = async (\n    acquired: boolean,\n    lock: HeldFileLockController | null,\n  ): Promise<void> => {\n    // A WRITE that read or rewrote the ledger without the lock could race a\n    // concurrent append/rewrite and lose data, so REFUSE the unlocked fallback\n    // withHeldFileLock takes on acquisition timeout (issue #2033 CodeRabbit\n    // Critical / codex). A dry run passes lock=null and acquired=true: it never\n    // reaches the rewrite, so the unlocked preview read is safe.\n    if (!dryRun && !acquired) {\n      throw new Error(\n        \"lifecycle ledger rebuild aborted: could not acquire the ledger lock within the \"\n        + \"acquisition budget; refusing to read or rewrite unlocked so a concurrent append \"\n        + \"or compaction cannot be clobbered (issue #1910).\",\n      );\n    }\n    if (options.preserveExistingEvents) {\n      // Merge the frontmatter reconstruction (`events`) with the CURRENT ledger\n      // so compaction never deletes a lifecycle row that raced the scan (issue\n      // #1910, #2033). Read the existing ledger through the uncapped BUFFER\n      // path — it decrypts with the live key when `storage` carries the secure\n      // context and bypasses the whole-file string decrypt cap, so an oversize\n      // encrypted ledger (the exact file compaction must shrink) is still\n      // readable here rather than aborting (#2033 Cursor High).\n      // preserveExistingEvents means \"never lose history\": if the current\n      // ledger genuinely cannot be read (corruption, or a locked required\n      // store), ABORT rather than rewrite from frontmatter only and silently\n      // drop that history. An absent ledger reads as [] (ENOENT swallowed\n      // downstream), so a throw here is always a real read failure.\n      let existing: MemoryLifecycleEvent[];\n      try {\n        existing = await storage.readAllMemoryLifecycleEventsForCompaction();\n      } catch (err) {\n        throw new Error(\n          `lifecycle ledger rebuild aborted: cannot read existing events to preserve `\n          + `(${displayErrorDetail(err) || \"unknown error\"})`,\n        );\n      }\n      // The corpus scan (`events`) runs OUTSIDE the lock and is therefore a\n      // stale snapshot; `existing` is read here under the lock and is\n      // authoritative for what the ledger holds at rewrite time. A\n      // frontmatter-derived row (created/updated/superseded/archived) is safe to\n      // collapse into the reconstruction ONLY when the scan actually reproduced\n      // the same logical event — same (memoryId, eventType, timestamp), which is\n      // exactly what the live append stamps (fm.created/updated/...) and what\n      // makeRebuiltMemoryLifecycleEvent emits. A frontmatter-derived row whose\n      // content key the reconstruction did NOT produce raced in after the scan\n      // (a memory created/updated between the scan and this locked read); the\n      // reconstruction has no equivalent, so dropping it by eventType alone\n      // would delete it. Preserve it instead, deduped by content key so a\n      // retried append of the same logical event still collapses to one. Rows\n      // that are not frontmatter-derived are append-only history with no\n      // reconstruction — always carried over, deduped by eventId in the merge.\n      const reconstructedKeys = new Set(events.map(memoryLifecycleEventProjectionIdentity));\n      const racedFrontmatterByKey = new Map<string, MemoryLifecycleEvent>();\n      const appendOnly: MemoryLifecycleEvent[] = [];\n      for (const event of existing) {\n        if (!isFrontmatterDerivedLifecycleEventType(event.eventType)) {\n          appendOnly.push(event);\n          continue;\n        }\n        const key = memoryLifecycleEventProjectionIdentity(event);\n        if (reconstructedKeys.has(key)) continue; // collapsed into reconstruction\n        if (!racedFrontmatterByKey.has(key)) racedFrontmatterByKey.set(key, event);\n      }\n      const mergedById = new Map<string, MemoryLifecycleEvent>();\n      for (const event of sortMemoryLifecycleEvents([\n        ...events,\n        ...racedFrontmatterByKey.values(),\n        ...appendOnly,\n      ])) {\n        if (!mergedById.has(event.eventId)) mergedById.set(event.eventId, event);\n      }\n      finalEvents = [...mergedById.values()];\n      preservedAppendOnlyRows = finalEvents.length - events.length;\n      // Bound the rewritten ledger so a preserving compaction can never leave it\n      // over the whole-file read/decrypt cap (#2033). This must run whenever a\n      // cap is set — NOT only when `existing.length > 0`: an oversized on-disk\n      // ledger whose every row fails validation reads as `existing === []`, yet\n      // `finalEvents` (the frontmatter reconstruction) can itself exceed the cap.\n      // Overflow (oldest) rows are dropped from the active ledger but survive\n      // both in the timestamped backup (a verbatim copy when the ledger is\n      // plaintext, re-encrypted under the backup path's own AAD when it is\n      // encrypted so it still decrypts there, #2033) and, for frontmatter-derived\n      // rows, in the memory files they were reconstructed from — so a later full\n      // rebuild regenerates them.\n      if (options.maxLedgerBytes && options.maxLedgerBytes > 0) {\n        const bounded = boundLifecycleEventsToByteCap(finalEvents, options.maxLedgerBytes);\n        if (bounded.dropped > 0) {\n          finalEvents = bounded.kept;\n          archivedOverflowRows = bounded.dropped;\n          log.warn(\n            `lifecycle ledger rebuild bounded to ${options.maxLedgerBytes} bytes: `\n            + `dropped ${bounded.dropped} oldest row(s) from the active ledger `\n            + `(preserved in the backup) to stay under the read/decrypt cap.`,\n          );\n        }\n      }\n    }\n\n    // Re-assert the lock immediately before the destructive active-ledger\n    // rewrite. Everything above (the preserve read, merge, sort, byte-cap\n    // bound, and JSON serialize) is CPU-bound and blocks the event loop, so the\n    // timer heartbeat inside withHeldFileLock cannot refresh the lock's mtime;\n    // a peer that judged the lock stale within the 30s window could have broken\n    // it and appended to the current ledger. `lock.refresh()` (a) reports the\n    // lock LOST so we ABORT rather than rename our compacted file over that\n    // peer's append, and (b) when still held, re-stamps the mtime so the bounded\n    // write below cannot itself be judged stale mid-rename (issue #1910/#2033).\n    const abortIfLockLost = async (): Promise<void> => {\n      if (lock && await lock.refresh()) return;\n      throw new Error(\n        \"lifecycle ledger rebuild aborted: lost the ledger lock during the compaction \"\n        + \"rewrite (a peer stale-broke it while the event loop was blocked by CPU-bound \"\n        + \"merge/serialize); refusing to clobber a concurrent append (issue #1910/#2033).\",\n      );\n    };\n    if (!dryRun) {\n      const payload = finalEvents.map((event) => JSON.stringify(event)).join(\"\\n\");\n      const content = payload.length > 0 ? `${payload}\\n` : \"\";\n      // No-op skip (#2033 thread PRRT_kwDORJXyws6SExst): a preserving rebuild\n      // bounds the ACTIVE ledger to the read/decrypt cap, so a VALID ledger that\n      // sits above the configured compaction trigger but below the cap would\n      // otherwise be rewritten to identical content and re-archived on every\n      // maintenance interval — unbounded growth of archive/memory-lifecycle-ledger\n      // plus pointless disk/CPU churn. Skip the backup+rewrite when it would\n      // change neither the logical (decrypted) content NOR the at-rest format.\n      // The raw read here doubles as the source for the encrypted verbatim backup\n      // below, so the current ledger is read at most once. An absent ledger reads\n      // as ENOENT (a create is always a real change) and any other read/probe\n      // error propagates rather than masking a needed rewrite.\n      let currentEncrypted = false;\n      let priorRawBuffer: Buffer | null = null;\n      try {\n        currentEncrypted = await probeEncryptedRegularFileHeader(outputPath);\n        priorRawBuffer = await storage.readMemoryLifecycleLedgerRawBufferForCompaction();\n      } catch (err) {\n        if (!isErrnoCode(err, \"ENOENT\")) throw err;\n      }\n      // Preserve encryption at rest (#2033). An already-encrypted ledger (or its\n      // encrypted backup) MUST be rewritten encrypted even when the\n      // `secureStoreEncryptOnWrite` policy is paused — otherwise the compaction\n      // silently DOWNGRADES encrypted state to plaintext. Force encryption\n      // whenever the current ledger is encrypted and the store is unlocked (a\n      // key is available); reaching this point with an encrypted ledger already\n      // implies an unlocked store, since the raw read above decrypts and would\n      // have thrown under a locked key. A plaintext ledger keeps the ordinary\n      // policy (`willEncryptStateWrites`), so existing plaintext behavior holds.\n      const forceEncrypt =\n        secureRewrite && currentEncrypted && storage.isSecureStoreUnlocked();\n      const replacementEncrypted =\n        secureRewrite && (storage.willEncryptStateWrites() || forceEncrypt);\n      // Compare as buffers, never decoding the raw ledger to one giant string:\n      // a multi-hundred-MB decrypted ledger can exceed V8's max string length,\n      // so `priorRawBuffer.equals(...)` (byte compare) must be used, NOT\n      // `.toString()` (#2033 giant-string invariant). `content` is the freshly\n      // serialized replacement, already a string; Buffer.from() reuses it.\n      if (\n        priorRawBuffer !== null &&\n        currentEncrypted === replacementEncrypted &&\n        priorRawBuffer.equals(Buffer.from(content, \"utf8\"))\n      ) {\n        // Nothing to change: leave the active ledger and archive untouched.\n        rewritten = false;\n      } else {\n        const desiredBackup = await backupExistingLedger(options.memoryDir, outputPath, now);\n        if (secureRewrite) {\n          // Preserve encrypted-at-rest (issue #1910). The BACKUP needs care under\n          // secure-store (#2033): when the existing ledger is encrypted, its bytes\n          // are path-bound via AAD, so a byte-for-byte copy to the archive path\n          // cannot be decrypted there — it would silently orphan the overflow rows\n          // a bounded rewrite claims to preserve. Reuse the RAW decrypted ledger\n          // content read above (no event parsing, so malformed/truncated/future\n          // rows survive exactly as the plaintext verbatim copy keeps them) and\n          // re-encrypt it under the backup path's own AAD, yielding a directly\n          // decryptable backup that retains every original byte. A PLAINTEXT\n          // existing ledger is already readable, so a verbatim copy is correct.\n          // Then rewrite the active ledger through the secure writer.\n          if (desiredBackup && currentEncrypted) {\n            const rawForBackup =\n              priorRawBuffer ?? (await storage.readMemoryLifecycleLedgerRawBufferForCompaction());\n            await storage.writeMemoryLifecycleLedgerContent(rawForBackup, desiredBackup, forceEncrypt);\n            backupPath = desiredBackup;\n          } else {\n            backupPath = desiredBackup\n              ? await copyExistingFileToBackup(outputPath, desiredBackup)\n              : undefined;\n          }\n          await abortIfLockLost();\n          await storage.writeMemoryLifecycleLedgerContent(content, undefined, forceEncrypt);\n        } else {\n          await abortIfLockLost();\n          backupPath = await writeFileAtomically(outputPath, content, desiredBackup);\n        }\n        rewritten = true;\n      }\n    }\n  };\n  // Write mode holds the ledger lock across the preserve-read and atomic\n  // rewrite so a concurrent append lands on the compacted ledger instead of\n  // being clobbered. A dry run computes the SAME preserve/merge/byte-cap\n  // preview but WITHOUT the lock (read-only, no rewrite), so `rebuiltRows`,\n  // `preservedAppendOnlyRows`, and `archivedOverflowRows` report what a --write\n  // would apply while never blocking concurrent appends (#2033 Cursor). A dry\n  // run with nothing to preserve touches nothing at all.\n  if (!dryRun) {\n    await withHeldFileLock(\n      memoryLifecycleLedgerLockPath(outputPath),\n      { staleMs: MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS, ...options.lockOptions },\n      runLedgerCriticalSection,\n    );\n  } else if (options.preserveExistingEvents) {\n    await runLedgerCriticalSection(true, null);\n  }\n\n  return {\n    dryRun,\n    scannedMemories: allMemories.length,\n    rebuiltRows: finalEvents.length,\n    outputPath,\n    backupPath,\n    skippedBlankIdMemories,\n    skippedDuplicateEvents,\n    preservedAppendOnlyRows,\n    archivedOverflowRows,\n    rewritten,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,YAAY;AAsHrB,SAAS,kBAAkB,OAAqC;AAC9D,SAAO,OAAO,WAAW,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,GAAM,MAAM;AAC/D;AAeO,SAAS,8BACd,QACA,KACmD;AACnD,MAAI,EAAE,MAAM,GAAI,QAAO,EAAE,MAAM,QAAQ,SAAS,EAAE;AAClD,QAAM,QAAQ,oBAAI,IAAkC;AACpD,MAAI,QAAQ;AACZ,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,kBAAkB,KAAK;AACrC,UAAM,IAAI,OAAO,KAAK;AACtB,aAAS;AAAA,EACX;AACA,MAAI,SAAS,IAAK,QAAO,EAAE,MAAM,QAAQ,SAAS,EAAE;AACpD,QAAM,YAAY,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAC3C,QAAI,EAAE,cAAc,EAAE,UAAW,QAAO,EAAE,UAAU,cAAc,EAAE,SAAS;AAC7E,WAAO,CAAC,6BAA6B,GAAG,CAAC;AAAA,EAC3C,CAAC;AACD,QAAM,OAAO,oBAAI,IAA0B;AAC3C,MAAI,UAAU;AACd,aAAW,SAAS,WAAW;AAC7B,UAAM,QAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,UAAU,QAAQ,IAAK;AAC3B,eAAW;AACX,SAAK,IAAI,KAAK;AAAA,EAChB;AACA,QAAM,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,IAAI,KAAK,CAAC;AACrD,SAAO,EAAE,MAAM,SAAS,OAAO,SAAS,KAAK,OAAO;AACtD;AAEA,eAAsB,qBACpB,WACA,YACA,KAC6B;AAC7B,MAAI;AACF,UAAM,KAAK,UAAU;AAAA,EACvB,SAAS,KAAK;AACZ,QAAI,YAAY,KAAK,QAAQ,GAAG;AAC9B,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AAEA,QAAM,aAAa,KAAK;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,GAAG;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,SAC6C;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAClC,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,aAAa,KAAK,KAAK,QAAQ,WAAW,SAAS,+BAA+B;AACxF,QAAM,UAAU,4BAA4B,gCAAgC,QAAQ,WAAW,QAAQ,OAAO,KAAK,IAAI,eAAe,QAAQ,SAAS;AACvJ,QAAM,gBAAgB,QAAQ,YAAY;AAC1C,QAAM,QAAQ;AAAA,IACZ,MAAM,QAAQ,gBAAgB;AAAA,IAC9B,MAAM,QAAQ,oBAAoB;AAAA,IAClC,MAAM,QAAQ,qBAAqB;AAAA,EACrC;AACA,QAAM,cAAc,MAAM,KAAK;AAC/B,QAAM,yBAA0D,CAAC;AACjE,QAAM,kBAAwE,CAAC;AAC/E,aAAW,QAAQ,OAAO;AACxB,eAAW,UAAU,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,GAAG;AACzF,UAAI,CAAC,OAAO,YAAY,GAAG,KAAK,GAAG;AACjC,+BAAuB,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;AACjD,YAAI,KAAK,0DAA0D,OAAO,IAAI,EAAE;AAChF;AAAA,MACF;AACA,iBAAW,SAAS,8BAA8B,MAAM,GAAG;AACzD,wBAAgB,KAAK,EAAE,OAAO,MAAM,OAAO,KAAK,CAAC;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,0BAA0B,gBAAgB,IAAI,CAAC,cAAc,UAAU,KAAK,CAAC;AACnG,QAAM,mBAAmB,IAAI;AAAA,IAC3B,gBAAgB,IAAI,CAAC,cAAc,CAAC,UAAU,OAAO,SAAS,CAAC;AAAA,EACjE;AACA,QAAM,gBAAgB,oBAAI,IAA2D;AACrF,QAAM,SAAiC,CAAC;AACxC,QAAM,yBAA2D,CAAC;AAClE,aAAW,SAAS,eAAe;AACjC,UAAM,YAAY,iBAAiB,IAAI,KAAK;AAC5C,UAAM,OAAO,cAAc,IAAI,MAAM,OAAO;AAC5C,QAAI,MAAM;AACR,6BAAuB,KAAK;AAAA,QAC1B,SAAS,MAAM;AAAA,QACf,UAAU,KAAK;AAAA,QACf,aAAa,UAAU;AAAA,MACzB,CAAC;AACD,UAAI;AAAA,QACF,uDAAuD,MAAM,OAAO,UAC1D,KAAK,IAAI,YAAY,UAAU,IAAI;AAAA,MAC/C;AACA;AAAA,IACF;AACA,kBAAc,IAAI,MAAM,SAAS,SAAS;AAC1C,WAAO,KAAK,KAAK;AAAA,EACnB;AAEA,MAAI,cAAc;AAClB,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,YAAY;AAUhB,QAAM,2BAA2B,OAC/B,UACA,SACkB;AAMlB,QAAI,CAAC,UAAU,CAAC,UAAU;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,QAAI,QAAQ,wBAAwB;AAalC,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,QAAQ,0CAA0C;AAAA,MACrE,SAAS,KAAK;AACZ,cAAM,IAAI;AAAA,UACR,8EACM,mBAAmB,GAAG,KAAK,eAAe;AAAA,QAClD;AAAA,MACF;AAgBA,YAAM,oBAAoB,IAAI,IAAI,OAAO,IAAI,sCAAsC,CAAC;AACpF,YAAM,wBAAwB,oBAAI,IAAkC;AACpE,YAAM,aAAqC,CAAC;AAC5C,iBAAW,SAAS,UAAU;AAC5B,YAAI,CAAC,uCAAuC,MAAM,SAAS,GAAG;AAC5D,qBAAW,KAAK,KAAK;AACrB;AAAA,QACF;AACA,cAAM,MAAM,uCAAuC,KAAK;AACxD,YAAI,kBAAkB,IAAI,GAAG,EAAG;AAChC,YAAI,CAAC,sBAAsB,IAAI,GAAG,EAAG,uBAAsB,IAAI,KAAK,KAAK;AAAA,MAC3E;AACA,YAAM,aAAa,oBAAI,IAAkC;AACzD,iBAAW,SAAS,0BAA0B;AAAA,QAC5C,GAAG;AAAA,QACH,GAAG,sBAAsB,OAAO;AAAA,QAChC,GAAG;AAAA,MACL,CAAC,GAAG;AACF,YAAI,CAAC,WAAW,IAAI,MAAM,OAAO,EAAG,YAAW,IAAI,MAAM,SAAS,KAAK;AAAA,MACzE;AACA,oBAAc,CAAC,GAAG,WAAW,OAAO,CAAC;AACrC,gCAA0B,YAAY,SAAS,OAAO;AAYtD,UAAI,QAAQ,kBAAkB,QAAQ,iBAAiB,GAAG;AACxD,cAAM,UAAU,8BAA8B,aAAa,QAAQ,cAAc;AACjF,YAAI,QAAQ,UAAU,GAAG;AACvB,wBAAc,QAAQ;AACtB,iCAAuB,QAAQ;AAC/B,cAAI;AAAA,YACF,uCAAuC,QAAQ,cAAc,mBAChD,QAAQ,OAAO;AAAA,UAE9B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAWA,UAAM,kBAAkB,YAA2B;AACjD,UAAI,QAAQ,MAAM,KAAK,QAAQ,EAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,UAAU,YAAY,IAAI,CAAC,UAAU,KAAK,UAAU,KAAK,CAAC,EAAE,KAAK,IAAI;AAC3E,YAAM,UAAU,QAAQ,SAAS,IAAI,GAAG,OAAO;AAAA,IAAO;AAYtD,UAAI,mBAAmB;AACvB,UAAI,iBAAgC;AACpC,UAAI;AACF,2BAAmB,MAAM,gCAAgC,UAAU;AACnE,yBAAiB,MAAM,QAAQ,gDAAgD;AAAA,MACjF,SAAS,KAAK;AACZ,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AAAA,MACzC;AAUA,YAAM,eACJ,iBAAiB,oBAAoB,QAAQ,sBAAsB;AACrE,YAAM,uBACJ,kBAAkB,QAAQ,uBAAuB,KAAK;AAMxD,UACE,mBAAmB,QACnB,qBAAqB,wBACrB,eAAe,OAAO,OAAO,KAAK,SAAS,MAAM,CAAC,GAClD;AAEA,oBAAY;AAAA,MACd,OAAO;AACL,cAAM,gBAAgB,MAAM,qBAAqB,QAAQ,WAAW,YAAY,GAAG;AACnF,YAAI,eAAe;AAYjB,cAAI,iBAAiB,kBAAkB;AACrC,kBAAM,eACJ,kBAAmB,MAAM,QAAQ,gDAAgD;AACnF,kBAAM,QAAQ,kCAAkC,cAAc,eAAe,YAAY;AACzF,yBAAa;AAAA,UACf,OAAO;AACL,yBAAa,gBACT,MAAM,yBAAyB,YAAY,aAAa,IACxD;AAAA,UACN;AACA,gBAAM,gBAAgB;AACtB,gBAAM,QAAQ,kCAAkC,SAAS,QAAW,YAAY;AAAA,QAClF,OAAO;AACL,gBAAM,gBAAgB;AACtB,uBAAa,MAAM,oBAAoB,YAAY,SAAS,aAAa;AAAA,QAC3E;AACA,oBAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAQA,MAAI,CAAC,QAAQ;AACX,UAAM;AAAA,MACJ,8BAA8B,UAAU;AAAA,MACxC,EAAE,SAAS,uCAAuC,GAAG,QAAQ,YAAY;AAAA,MACzE;AAAA,IACF;AAAA,EACF,WAAW,QAAQ,wBAAwB;AACzC,UAAM,yBAAyB,MAAM,IAAI;AAAA,EAC3C;AAEA,SAAO;AAAA,IACL;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-3Q6RD76J.js → chunk-WQZZDN5M.js}

@@ -7,16 +7,16 @@ import {
   sha256Bytes,
   validateArchiveRelativePath
 } from "./chunk-GCGJW34D.js";
+import {
+  DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS
+} from "./chunk-AREGMX2J.js";
 import {
   isEncryptedOfflineSyncFile,
   plainFileDigest,
   readPlainOfflineSyncFileChunk,
   sha256OfflineSyncFile,
   shouldExcludeOfflineSyncFile
-} from "./chunk-DDQQY2E3.js";
-import {
-  DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS
-} from "./chunk-AREGMX2J.js";
+} from "./chunk-3BTFBQLO.js";
 import {
   CENSUS_MAX_MTIME_MS,
   isCensusMtimeMs,
@@ -1897,4 +1897,4 @@ export {
   normalizeOfflineSyncState,
   fileStatesFromSnapshot
 };
-//# sourceMappingURL=chunk-3Q6RD76J.js.map
+//# sourceMappingURL=chunk-WQZZDN5M.js.map

package/dist/{chunk-ZJWDWPX6.js → chunk-X5K5TAQZ.js}

@@ -1,9 +1,9 @@
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-UMEOXLIZ.js";
+} from "./chunk-E2P7TZTF.js";
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-XSGUMQQQ.js";
 import {
   composeLocationDayBody,
   composeLocationDayMeta,
@@ -23,7 +23,7 @@ import {
   serializeLocationDay,
   updateLocationSourceDay,
   writeLocationDay
-} from "./chunk-7GSSHAXC.js";
+} from "./chunk-NLYVH66G.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-JUOZ62Y7.js";
@@ -728,4 +728,4 @@ export {
   runLocationBackfill,
   runLocationCliCommand
 };
-//# sourceMappingURL=chunk-ZJWDWPX6.js.map
+//# sourceMappingURL=chunk-X5K5TAQZ.js.map

package/dist/{chunk-ZL3XX5LW.js → chunk-XM24CDZX.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-IN673LEP.js";
 import {
   composeSalvagedEnvelope
-} from "./chunk-N4F7ZSSG.js";
+} from "./chunk-RC5DXXWC.js";
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-XSGUMQQQ.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
@@ -1283,4 +1283,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-ZL3XX5LW.js.map
+//# sourceMappingURL=chunk-XM24CDZX.js.map

package/dist/{chunk-JTWZKNUH.js → chunk-XOVKXJEP.js}

@@ -15,11 +15,11 @@ import {
 } from "./chunk-XCB6QDL6.js";
 import {
   composeMemoryEnvelope
-} from "./chunk-WKAXBXVA.js";
+} from "./chunk-3QQTXYZ6.js";
 import {
   readJsonFile,
   writeJsonFileAtomic
-} from "./chunk-P77QX3ID.js";
+} from "./chunk-B6O2YLUR.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -876,4 +876,4 @@ export {
   isValidResolutionVerb,
   executeResolution
 };
-//# sourceMappingURL=chunk-JTWZKNUH.js.map
+//# sourceMappingURL=chunk-XOVKXJEP.js.map

package/dist/{chunk-OGTKQ5MJ.js → chunk-XSGUMQQQ.js}

@@ -14,20 +14,17 @@ import {
   applyTombstoneResurrectionGate,
   buildRetiredFactTombstoneInputs,
   collectRetiredMemoriesForRebuild
-} from "./chunk-4ZWCQJNM.js";
+} from "./chunk-46WM6JX2.js";
 import {
   normalizeQmdResultPath
-} from "./chunk-6FUMA6AA.js";
+} from "./chunk-2Z4GS5E6.js";
 import {
   withholdToolScopedFromSharedNamespace
 } from "./chunk-S2V7RUCL.js";
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-XOQGUGJL.js";
-import {
-  createMemorySnapshot
-} from "./chunk-S2HLHAZ4.js";
+} from "./chunk-SO7SV523.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -35,7 +32,10 @@ import {
 import {
   rewriteProjectedEntityReferences,
   rewriteProjectedMemoryEntityReference
-} from "./chunk-2GF27PGH.js";
+} from "./chunk-MRPOZBJC.js";
+import {
+  createMemorySnapshot
+} from "./chunk-S2HLHAZ4.js";
 import {
   rotateMarkdownFileToArchive
 } from "./chunk-DM2T26WE.js";
@@ -61,7 +61,7 @@ import {
   isQueuedReviewMemory,
   parseTombstoneBlockedOfflineSyncMemory,
   tombstoneBlocked
-} from "./chunk-LUDBXTBJ.js";
+} from "./chunk-H272ZPQ3.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -77,7 +77,7 @@ import {
 } from "./chunk-G7D6GZ5J.js";
 import {
   createVersion
-} from "./chunk-U62OK7BB.js";
+} from "./chunk-JPKK466T.js";
 import {
   attachInFlightReader,
   beginCoalescedScan,
@@ -99,7 +99,7 @@ import {
   requestEntityCanonicalIdReconcileSync,
   resolveHistoricalEntityCanonicalId,
   withEntityCanonicalMutationLock
-} from "./chunk-NNZFPYYX.js";
+} from "./chunk-R7QY5ZVB.js";
 import {
   computeSupersessionKey,
   normalizeSupersessionKey,
@@ -109,7 +109,7 @@ import {
   composeMemoryEnvelope,
   isSealedMemoryEnvelope,
   sealedWriteToLegacyArgs
-} from "./chunk-WKAXBXVA.js";
+} from "./chunk-3QQTXYZ6.js";
 import {
   clearMemoryCache,
   getCachedEntities,
@@ -123,15 +123,6 @@ import {
   updateCacheOnDelete,
   updateCacheOnWrite
 } from "./chunk-C64XATK7.js";
-import {
-  archive_mutation_version_exports,
-  bumpArchiveMutationIfChanged,
-  getArchiveMutationVersionForDir,
-  recordArchiveDelete
-} from "./chunk-W5BIQOAJ.js";
-import {
-  selectArtifactMatches
-} from "./chunk-Z7L72ZHL.js";
 import {
   parseProvenanceSources,
   parseProvenanceTag,
@@ -146,11 +137,20 @@ import {
 import {
   parseOriginClass
 } from "./chunk-6Q3ZTEF6.js";
+import {
+  archive_mutation_version_exports,
+  bumpArchiveMutationIfChanged,
+  getArchiveMutationVersionForDir,
+  recordArchiveDelete
+} from "./chunk-W5BIQOAJ.js";
+import {
+  selectArtifactMatches
+} from "./chunk-Z7L72ZHL.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitationForTemplate,
   stripCitationForTemplate
-} from "./chunk-J6A3CX5N.js";
+} from "./chunk-TG3FAM2S.js";
 import {
   ProjectionLedgerLagManager,
   appendLifecycleEventsSerialized,
@@ -165,16 +165,11 @@ import {
   readMemoryActionEventRowsFromLines,
   readProjectionRebuiltAt,
   serializeLifecycleAppendPayload
-} from "./chunk-JRRQ747T.js";
+} from "./chunk-TBXAY2SS.js";
 import {
   assertMemoryFrontmatterId,
   warnProjectionFallback
 } from "./chunk-ZA53AZND.js";
-import {
-  inferMemoryStatus,
-  isArchivedMemoryPath,
-  toMemoryPathRel
-} from "./chunk-7RJUVTVF.js";
 import {
   markProjectedMemoryPathInvalid,
   readProjectedGovernanceRecord,
@@ -186,21 +181,26 @@ import {
 import {
   assertPathInsideRoot,
   pathIsInside
-} from "./chunk-GCASGYIO.js";
+} from "./chunk-C7HJ3NEI.js";
 import {
-  isSupportPassportPrivateMemory
-} from "./chunk-EEOUMG3J.js";
+  inferMemoryStatus,
+  isArchivedMemoryPath,
+  toMemoryPathRel
+} from "./chunk-7RJUVTVF.js";
 import {
   CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
   ContentHashIndex,
   FactHashIndexNotAuthoritativeError
-} from "./chunk-TVW4C7PV.js";
+} from "./chunk-NB3LRY4T.js";
+import {
+  computeLegacyContentHash
+} from "./chunk-5FVVY2EB.js";
 import {
   withHeldFileLock
 } from "./chunk-FFAZ2XFU.js";
 import {
-  computeLegacyContentHash
-} from "./chunk-5FVVY2EB.js";
+  isSupportPassportPrivateMemory
+} from "./chunk-EEOUMG3J.js";
 import {
   assemblePersistedBody,
   storedContentIdentityCandidates,
@@ -234,7 +234,7 @@ import {
   readMaybeEncryptedFile,
   readMaybeEncryptedFileBuffer,
   writeMaybeEncryptedFile
-} from "./chunk-ET2CNMLD.js";
+} from "./chunk-JN72EPOE.js";
 import {
   ALL_CATEGORY_DIRS,
   RECALL_FALLBACK_DIRS,
@@ -243,7 +243,7 @@ import {
 } from "./chunk-VS2IYZRU.js";
 import {
   isErrnoCode
-} from "./chunk-5UZXUTVO.js";
+} from "./chunk-KNA3BXXL.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -8809,11 +8809,10 @@ ${sanitized.text}
     if (memory.frontmatter.category !== "fact") return [];
     return this.corpusRegisteredHashes(memory);
   }
-  async addActiveFactContentHash(memory) {
+  /** Publish `hashes` for an ACTIVE fact through the SAME locked reconcile the write path uses. */
+  async publishActiveFactHashes(memory, hashes) {
     if (memory.frontmatter.category !== "fact") return;
     if (inferMemoryStatus(memory.frontmatter, memory.path) !== "active") return;
-    const hashes = this.factContentHashesForRemoval(memory);
-    if (hashes.length === 0) return;
     await this.ensureFactHashIndexAuthoritative();
     const factHashIndex = await this.getFactHashIndex();
     for (const hash of hashes) {
@@ -8822,19 +8821,33 @@ ${sanitized.text}
     await factHashIndex.saveMergingWithDisk();
     await factHashIndex.flushReconcileRetry();
   }
+  /**
+   * Register an EXPLICITLY computed content hash for an active fact (issue
+   * #2330 round N+16 C): the degraded merge repair indexes the COMMITTED
+   * body while the persisted `frontmatter.contentHash` is the stale
+   * PRE-merge identity. Round N+20 (B): body-coupled (`expectedContent`) —
+   * repair), so no obsolete hash lands on a newer record. No-op otherwise.
+   */
+  async registerFactContentHash(memoryId, contentHash, expectedContent) {
+    if (!contentHash) return;
+    const memory = await this.getMemoryByIdIncludingArchived(memoryId);
+    if (!memory || memory.content !== expectedContent) return;
+    await this.publishActiveFactHashes(memory, [contentHash]);
+  }
+  async addActiveFactContentHash(memory) {
+    const hashes = this.factContentHashesForRemoval(memory);
+    if (hashes.length === 0) return;
+    await this.publishActiveFactHashes(memory, hashes);
+  }
   /**
    * Re-register a fact's contentHash in the dedup index after a tombstone
-   * block is lifted on approval (issue #1579 thread ObnTy). `writeMemory`
-   * skips hash-index registration for tombstone-blocked facts (rule 44); when
-   * the review queue later promotes such a fact back to `status: active`, the
-   * hash must enter the index or the next extraction of the same content
-   * creates a second active fact. Reads the memory by id so the caller (the
-   * review CLI) does not need to re-parse the file. No-op for non-facts or
-   * facts that are not active.
+   * block is lifted on approval (issue #1579 thread ObnTy): `writeMemory`
+   * skips registration for tombstone-blocked facts (rule 44), so a promoted
+   * fact must re-enter the index or the next extraction of the same content
+   * creates a second active fact. No-op for non-facts or inactive facts.
    */
   async restoreFactHashAfterApproval(memoryId) {
-    const all = await this.readAllMemories();
-    const memory = all.find((m) => m.frontmatter.id === memoryId);
+    const memory = await this.getMemoryByIdIncludingArchived(memoryId);
     if (!memory) return;
     await this.addActiveFactContentHash(memory);
   }
@@ -8844,8 +8857,7 @@ ${sanitized.text}
     const afterHashes = this.factContentHashesForRemoval(after);
     const beforeStatus = inferMemoryStatus(before.frontmatter, before.path);
     const afterStatus = inferMemoryStatus(after.frontmatter, after.path);
-    const hashesChanged = beforeHashes.length !== afterHashes.length || beforeHashes.some((hash, index) => hash !== afterHashes[index]);
-    if (!hashesChanged && beforeStatus === afterStatus) return;
+    const hashesChanged = beforeHashes.length !== afterHashes.length || beforeHashes.some((h, i) => h !== afterHashes[i]);
     if (beforeStatus === "active" && beforeHashes.length > 0 && (hashesChanged || afterStatus !== "active")) {
       await this.removeFactContentHashesForMemories([before]);
     }
@@ -11374,4 +11386,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-OGTKQ5MJ.js.map
+//# sourceMappingURL=chunk-XSGUMQQQ.js.map