@remnic/core 9.69.33 → 9.69.35

package/dist/{chunk-HV7OY4DM.js → chunk-5VAF4ID4.js}

@@ -1,3 +1,9 @@
+import {
+  TombstoneStore,
+  applyTombstoneResurrectionGate,
+  buildRetiredFactTombstoneInputs,
+  collectRetiredMemoriesForRebuild
+} from "./chunk-46WM6JX2.js";
 import {
   WEARABLES_DIR_NAME,
   escapeSegmentText,
@@ -9,22 +15,25 @@ import {
   unescapeSegmentText,
   unescapeSpeakerLabel
 } from "./chunk-UHVXE24Y.js";
-import {
-  TombstoneStore,
-  applyTombstoneResurrectionGate,
-  buildRetiredFactTombstoneInputs,
-  collectRetiredMemoriesForRebuild
-} from "./chunk-46WM6JX2.js";
 import {
   normalizeQmdResultPath
-} from "./chunk-J7HFPA6O.js";
+} from "./chunk-Y63ZFP4X.js";
 import {
   withholdToolScopedFromSharedNamespace
 } from "./chunk-S2V7RUCL.js";
+import {
+  OKF_QUESTION_TYPE,
+  assertNotOkfReservedBasename,
+  okfTypeForEntityKind,
+  okfTypeForMemory
+} from "./chunk-PCEYGOSL.js";
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-SO7SV523.js";
+} from "./chunk-4MDKNUV4.js";
+import {
+  createMemorySnapshot
+} from "./chunk-S2HLHAZ4.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -33,9 +42,6 @@ import {
   rewriteProjectedEntityReferences,
   rewriteProjectedMemoryEntityReference
 } from "./chunk-MRPOZBJC.js";
-import {
-  createMemorySnapshot
-} from "./chunk-S2HLHAZ4.js";
 import {
   rotateMarkdownFileToArchive
 } from "./chunk-DM2T26WE.js";
@@ -51,7 +57,7 @@ import {
 import {
   parseFaithfulnessField,
   serializeFaithfulnessFields
-} from "./chunk-DCJ3YFIC.js";
+} from "./chunk-S2ULTQZR.js";
 import {
   DeletionRevisionStore,
   TombstoneBlockedCaptureIndexHost,
@@ -59,9 +65,12 @@ import {
   buildExplicitCaptureDedupKey,
   invalidationCommitFingerprint,
   isQueuedReviewMemory,
+  isValidManagedStoragePath,
+  nextCasRevisionIso,
   parseTombstoneBlockedOfflineSyncMemory,
-  tombstoneBlocked
-} from "./chunk-H272ZPQ3.js";
+  tombstoneBlocked,
+  withCasCommitReceipt
+} from "./chunk-SHEHQBCG.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -105,11 +114,6 @@ import {
   normalizeSupersessionKey,
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
-import {
-  composeMemoryEnvelope,
-  isSealedMemoryEnvelope,
-  sealedWriteToLegacyArgs
-} from "./chunk-3QQTXYZ6.js";
 import {
   clearMemoryCache,
   getCachedEntities,
@@ -187,6 +191,14 @@ import {
   isArchivedMemoryPath,
   toMemoryPathRel
 } from "./chunk-7RJUVTVF.js";
+import {
+  isSupportPassportPrivateMemory
+} from "./chunk-PWPIERBM.js";
+import {
+  composeMemoryEnvelope,
+  isSealedMemoryEnvelope,
+  sealedWriteToLegacyArgs
+} from "./chunk-LSLCFCCQ.js";
 import {
   CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
   ContentHashIndex,
@@ -198,9 +210,6 @@ import {
 import {
   withHeldFileLock
 } from "./chunk-FFAZ2XFU.js";
-import {
-  isSupportPassportPrivateMemory
-} from "./chunk-EEOUMG3J.js";
 import {
   assemblePersistedBody,
   storedContentIdentityCandidates,
@@ -252,17 +261,17 @@ import {
 import {
   lstat as lstat3,
   readdir as readdir6,
-  readFile as readFile2,
+  readFile as readFile3,
   realpath as realpath3,
   stat as stat3,
   writeFile as writeFile2,
-  mkdir,
-  unlink as unlink4,
+  mkdir as mkdir2,
+  unlink as unlink5,
   appendFile,
-  open
+  open as open2
 } from "fs/promises";
 import { appendFileSync, createReadStream, mkdirSync, statSync as statSync2 } from "fs";
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 
 // src/preferences/drift-types.ts
 function serializeDriftProvenance(fm) {
@@ -1667,59 +1676,6 @@ function extractFrontmatterValue(frontmatter, key) {
   return null;
 }
 
-// src/okf/type-mapping.ts
-import path5 from "path";
-var OKF_TYPE_BY_CATEGORY = Object.freeze({
-  fact: "Memory Fact",
-  decision: "Decision",
-  preference: "Preference",
-  commitment: "Commitment",
-  relationship: "Relationship",
-  principle: "Principle",
-  moment: "Moment",
-  skill: "Skill",
-  correction: "Correction",
-  rule: "Rule"
-});
-var OKF_TYPE_FALLBACK = "Memory";
-function okfTypeForCategory(category) {
-  return OKF_TYPE_BY_CATEGORY[category] ?? OKF_TYPE_FALLBACK;
-}
-function okfTypeForMemory(fm) {
-  return fm.artifactType ? "Artifact" : okfTypeForCategory(fm.category);
-}
-var OKF_TYPE_BY_ENTITY_KIND = Object.freeze({
-  person: "Person",
-  company: "Company",
-  organization: "Organization",
-  project: "Project",
-  topic: "Topic",
-  technology: "Technology",
-  place: "Place",
-  event: "Event"
-});
-function okfTypeForEntityKind(kind) {
-  const normalized = kind?.trim().toLowerCase();
-  return normalized !== void 0 && OKF_TYPE_BY_ENTITY_KIND[normalized] || "Entity";
-}
-var OKF_PROFILE_TYPE = "Profile";
-var OKF_QUESTION_TYPE = "Question";
-var OKF_DECISION_RECORD_TYPE = "Decision Record";
-var OKF_ARCHITECTURE_CARD_TYPE = "Architecture Card";
-var OKF_CODE_MODULE_TYPE = "Code Module";
-var OKF_RESERVED_BASENAMES = Object.freeze({
-  "index.md": true,
-  "log.md": true
-});
-function assertNotOkfReservedBasename(filePath) {
-  const basename = path5.basename(filePath);
-  if (OKF_RESERVED_BASENAMES[basename] === true) {
-    throw new Error(
-      `OKF reserved basename '${basename}' is not a valid memory file target (${filePath}); OKF \xA76/\xA77 reserves it for bundle-level files.`
-    );
-  }
-}
-
 // src/storage/context-transform-ledger.ts
 async function appendContextTransformRecords(host, records) {
   if (records.length === 0) return 0;
@@ -1766,7 +1722,7 @@ function selfDeps(self) {
 
 // src/storage/entity-store.ts
 import { readdir as readdir2, unlink } from "fs/promises";
-import path6 from "path";
+import path5 from "path";
 var EntityStore = class {
   constructor(deps) {
     this.deps = deps;
@@ -1786,7 +1742,7 @@ var EntityStore = class {
   async readEntityForMutation(name, method, historicalIds) {
     const canonical = resolveHistoricalEntityCanonicalId(name, historicalIds);
     for (const candidate of canonical === name ? [name] : [canonical, name]) {
-      const filePath = path6.join(this.deps.entitiesDir, `${candidate}.md`);
+      const filePath = path5.join(this.deps.entitiesDir, `${candidate}.md`);
       try {
         const entity = parseEntityFile(await this.deps.readStorageSecureFile(filePath), this.deps.entitySchemas);
         return { filePath, entity };
@@ -1811,7 +1767,7 @@ var EntityStore = class {
    * `mutate` returns false to skip the write. Resolves true when written.
    */
   async mutateEntityFile(name, method, mutate) {
-    const stateDir = path6.join(this.deps.baseDir, "state");
+    const stateDir = path5.join(this.deps.baseDir, "state");
     return withEntityCanonicalMutationLock(stateDir, async () => {
       for (let attempt = 0; attempt < 3; attempt += 1) {
         const idsAtResolve = this.deps.currentHistoricalIds();
@@ -1866,7 +1822,7 @@ var EntityStore = class {
   async writeEntity(name, type, facts, options = {}) {
     await this.deps.ensureDirectories();
     return withEntityCanonicalMutationLock(
-      path6.join(this.deps.baseDir, "state"),
+      path5.join(this.deps.baseDir, "state"),
       () => this.writeEntityUnlocked(name, type, facts, options)
     );
   }
@@ -1887,7 +1843,7 @@ var EntityStore = class {
       log.debug(`fuzzy match: "${normalized}" \u2192 existing "${match}"`);
       normalized = match;
     }
-    const filePath = path6.join(this.deps.entitiesDir, `${normalized}.md`);
+    const filePath = path5.join(this.deps.entitiesDir, `${normalized}.md`);
     let entity = {
       name,
       type,
@@ -2008,7 +1964,7 @@ var EntityStore = class {
   /** Re-serialize every entity file into the compiled-truth timeline shape. */
   async migrateEntityFilesToCompiledTruthTimeline() {
     const entityNames = await this.listEntityNames();
-    const stateDir = path6.join(this.deps.baseDir, "state");
+    const stateDir = path5.join(this.deps.baseDir, "state");
     let migrated = 0;
     for (const entityName of entityNames) {
       const wrote = await withEntityCanonicalMutationLock(stateDir, async () => {
@@ -2035,12 +1991,12 @@ var EntityStore = class {
    */
   async updateEntitySynthesis(name, synthesis, options = {}) {
     return withEntityCanonicalMutationLock(
-      path6.join(this.deps.baseDir, "state"),
+      path5.join(this.deps.baseDir, "state"),
       () => this.updateEntitySynthesisUnlocked(name, synthesis, options)
     );
   }
   async updateEntitySynthesisUnlocked(name, synthesis, options = {}) {
-    const filePath = path6.join(this.deps.entitiesDir, `${name}.md`);
+    const filePath = path5.join(this.deps.entitiesDir, `${name}.md`);
     let entity;
     try {
       const content = await this.deps.readStorageSecureFile(filePath);
@@ -2098,7 +2054,7 @@ var EntityStore = class {
         const results = await Promise.all(
           batch.map(async (entry) => {
             try {
-              return await this.deps.readStorageSecureFile(path6.join(this.deps.entitiesDir, entry));
+              return await this.deps.readStorageSecureFile(path5.join(this.deps.entitiesDir, entry));
             } catch (err) {
               if (err instanceof SecureStoreLockedError) throw err;
               if (!isErrnoCode(err, "ENOENT")) throw err;
@@ -2173,7 +2129,7 @@ ${rows.join("\n")}
    */
   async mergeFragmentedEntities() {
     return withEntityCanonicalMutationLock(
-      path6.join(this.deps.baseDir, "state"),
+      path5.join(this.deps.baseDir, "state"),
       () => this.mergeFragmentedEntitiesUnlocked()
     );
   }
@@ -2218,7 +2174,7 @@ ${rows.join("\n")}
           extraSections: []
         };
         for (const file of files) {
-          const filePath = path6.join(this.deps.entitiesDir, file);
+          const filePath = path5.join(this.deps.entitiesDir, file);
           try {
             const content = await this.deps.readStorageSecureFile(filePath);
             const parsed = parseEntityFile(content, this.deps.entitySchemas);
@@ -2371,11 +2327,11 @@ ${rows.join("\n")}
         }
         mergedEntity.created = mergedEntity.created || mergedEntity.updated || (/* @__PURE__ */ new Date()).toISOString();
         mergedEntity.updated = mergedEntity.updated || (/* @__PURE__ */ new Date()).toISOString();
-        const canonicalPath = path6.join(this.deps.entitiesDir, `${canonical}.md`);
+        const canonicalPath = path5.join(this.deps.entitiesDir, `${canonical}.md`);
         await this.deps.writeStorageSecureFile(canonicalPath, serializeEntityFile(mergedEntity, this.deps.entitySchemas, this.deps.okfConformanceEnabled()));
         this.deps.bumpEntityMutationVersion();
         for (const file of files) {
-          const filePath = path6.join(this.deps.entitiesDir, file);
+          const filePath = path5.join(this.deps.entitiesDir, file);
           if (filePath !== canonicalPath) {
             try {
               await unlink(filePath);
@@ -2393,6 +2349,494 @@ ${rows.join("\n")}
   }
 };
 
+// src/storage/cas-revision-store.ts
+import { createHash, randomUUID } from "crypto";
+import { mkdir, open, readFile, rename, unlink as unlink2 } from "fs/promises";
+import path6 from "path";
+var CAS_REVISION_LOCK_STALE_MS = 6e4;
+var CAS_REVISION_LOCK_MAX_WAIT_MS = 12e4;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function isDigestOrNullOrUndefined(value) {
+  if (value === void 0 || value === null) return true;
+  return typeof value === "string" && SHA256_HEX.test(value);
+}
+function pendingWriteHasLanded(view) {
+  if (view.writeLanded === true) return true;
+  if (view.writeLanded === false) return false;
+  return view.expectedDigest !== void 0;
+}
+var CasRevisionStore = class {
+  baseDir;
+  legacyMetadataPath;
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+    this.legacyMetadataPath = path6.join(baseDir, ".offline-sync", "cas-revisions.v1.json");
+  }
+  parseCasRevisionMetadata(raw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("CAS revision metadata is invalid.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("CAS revision metadata is invalid.");
+    }
+    const root = parsed;
+    if (Object.keys(root).sort().join(",") !== "revisions,version" || root.version !== 1 || !Array.isArray(root.revisions)) {
+      throw new Error("CAS revision metadata is invalid.");
+    }
+    const revisions = /* @__PURE__ */ new Map();
+    for (const rawEntry of root.revisions) {
+      if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+        throw new Error("CAS revision metadata is invalid.");
+      }
+      const entry = rawEntry;
+      if (Object.keys(entry).sort().join(",") !== "path,revision" || typeof entry.path !== "string" || !isValidManagedStoragePath(entry.path) || typeof entry.revision !== "string" || entry.revision.length === 0 || revisions.has(entry.path)) {
+        throw new Error("CAS revision metadata is invalid.");
+      }
+      revisions.set(entry.path, entry.revision);
+    }
+    return revisions;
+  }
+  async readLegacyMetadata() {
+    const baseDir = path6.resolve(this.baseDir);
+    const legacyPath = await resolveSafeStoragePath(baseDir, path6.relative(baseDir, this.legacyMetadataPath));
+    let raw;
+    try {
+      raw = await readFile(legacyPath, "utf8");
+    } catch (error) {
+      if (isErrnoCode(error, "ENOENT")) return /* @__PURE__ */ new Map();
+      throw new Error("CAS revision metadata is unavailable.");
+    }
+    return this.parseCasRevisionMetadata(raw);
+  }
+  /** #2813 (P1 A): every sidecar path is resolved (and symlink-audited)
+   * inside the memory root before it is used for a lock, read, rename, or
+   * unlink. A symlinked `.offline-sync`, `.offline-sync/cas-revisions`, or
+   * shard file makes this throw, so no sidecar traffic can follow a link
+   * out of the root. */
+  async getSafeShardInfo(relativePath) {
+    const baseDir = path6.resolve(this.baseDir);
+    const hash = createHash("sha256").update(relativePath).digest("hex");
+    const shardPath = await resolveSafeStoragePath(baseDir, ".offline-sync", "cas-revisions", `${hash}.json`);
+    const lockPath2 = await resolveSafeStoragePath(baseDir, ".offline-sync", "cas-revisions", `${hash}.json.lock`);
+    return { shardPath, lockPath: lockPath2 };
+  }
+  async readShardView(shardPath, relativePath) {
+    let raw;
+    try {
+      raw = await readFile(shardPath, "utf8");
+    } catch (error) {
+      if (isErrnoCode(error, "ENOENT")) return { kind: "missing" };
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("CAS revision shard is unreadable.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { kind: "foreign" };
+    }
+    const root = parsed;
+    if (root.state !== void 0) {
+      if (root.version !== 1 || typeof root.path !== "string" || typeof root.revision !== "string" || root.revision.length === 0 || root.state !== "pending" && root.state !== "committed" || root.previous !== void 0 && (typeof root.previous !== "string" || root.previous.length === 0) || !isDigestOrNullOrUndefined(root.baselineDigest) || !isDigestOrNullOrUndefined(root.expectedDigest) || root.writeLanded !== void 0 && typeof root.writeLanded !== "boolean") {
+        throw new Error("CAS revision shard is unreadable.");
+      }
+      const foreign = root.path !== relativePath;
+      const committedDigest = typeof root.committedDigest === "string" ? root.committedDigest : void 0;
+      return root.state === "pending" ? {
+        kind: "pending",
+        revision: root.revision,
+        previous: root.previous,
+        foreign,
+        baselineDigest: root.baselineDigest,
+        expectedDigest: root.expectedDigest,
+        ...typeof root.writeLanded === "boolean" ? { writeLanded: root.writeLanded } : {}
+      } : { kind: "committed", revision: root.revision, committedDigest, foreign };
+    }
+    if (root.version === 1 && root.path === relativePath && typeof root.revision === "string" && root.revision.length > 0) {
+      const committedDigest = typeof root.committedDigest === "string" ? root.committedDigest : void 0;
+      return { kind: "committed", revision: root.revision, committedDigest, foreign: false };
+    }
+    return { kind: "foreign" };
+  }
+  async readStandingRevision(relativePath) {
+    try {
+      return (await this.readStandingRevisionStrict(relativePath))?.revision;
+    } catch (error) {
+      log.warn(`CasRevisionStore failed to read standing revision for ${relativePath}: ${error}`);
+      return void 0;
+    }
+  }
+  /** #2813 (P1 A): strict core of {@link readStandingRevision}. Returns
+   * undefined ONLY when no receipt exists for the target — the shard is
+   * absent (or names another target) and the legacy metadata holds no
+   * entry. THROWS when the standing receipt cannot be determined: an
+   * unreadable or corrupt shard, a PENDING reservation awaiting
+   * finalization or recovery, or unreadable or invalid legacy metadata.
+   * Fail-open callers collapse the throw into undefined; truthful callers
+   * ({@link readRevisionStatus}) report `unavailable` so a transaction can
+   * refuse instead of mistaking the failure for absence. */
+  async readStandingRevisionStrict(relativePath) {
+    const { shardPath } = await this.getSafeShardInfo(relativePath);
+    const view = await this.readShardView(shardPath, relativePath);
+    if (view.kind === "pending") {
+      throw new Error(
+        `CAS revision receipt for ${relativePath} is pending finalization (recovery needed).`
+      );
+    }
+    if (view.kind === "committed" && !view.foreign) {
+      return { revision: view.revision, committedDigest: view.committedDigest };
+    }
+    const legacyMap = await this.readLegacyMetadata();
+    const legacyRev = legacyMap.get(relativePath);
+    return legacyRev === void 0 ? void 0 : { revision: legacyRev };
+  }
+  async writeShard(shardPath, relativePath, revision, lock, state, previous, evidence) {
+    let payload;
+    if (state === "committed") {
+      payload = { version: 1, path: relativePath, revision, state };
+      if (evidence?.committedDigest !== void 0) {
+        payload.committedDigest = evidence.committedDigest;
+      }
+    } else {
+      payload = { version: 1, path: relativePath, revision, state };
+      if (previous !== void 0) payload.previous = previous;
+      if (evidence !== void 0) {
+        if (evidence.baselineDigest !== void 0) payload.baselineDigest = evidence.baselineDigest;
+        if (evidence.expectedDigest !== void 0) payload.expectedDigest = evidence.expectedDigest;
+        if (evidence.writeLanded !== void 0) payload.writeLanded = evidence.writeLanded;
+      }
+    }
+    const baseDir = path6.resolve(this.baseDir);
+    const temporaryPath = await resolveSafeStoragePath(
+      baseDir,
+      path6.relative(baseDir, `${shardPath}.${process.pid}.${randomUUID()}.tmp`)
+    );
+    let handle = null;
+    try {
+      await mkdir(path6.dirname(shardPath), { recursive: true });
+      handle = await open(temporaryPath, "wx", 384);
+      await handle.writeFile(`${JSON.stringify(payload)}
+`, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = null;
+      if (!await lock.refresh()) {
+        throw new Error("CAS revision shard lock was lost.");
+      }
+      await rename(temporaryPath, shardPath);
+    } finally {
+      if (handle !== null) {
+        await handle.close().catch((error) => {
+          log.warn("failed to close CAS revision shard temporary file", error);
+        });
+      }
+      await unlink2(temporaryPath).catch((error) => {
+        if (!isErrnoCode(error, "ENOENT")) {
+          log.warn("failed to clean up CAS revision shard temporary file", error);
+        }
+      });
+    }
+  }
+  async resolveRelativePath(filePath) {
+    const baseDir = path6.resolve(this.baseDir);
+    const target = await resolveSafeStoragePath(baseDir, path6.relative(baseDir, path6.resolve(baseDir, filePath)));
+    return path6.relative(baseDir, target).split(path6.sep).join("/");
+  }
+  async withShardLock(relativePath, task) {
+    const { lockPath: lockPath2 } = await this.getSafeShardInfo(relativePath);
+    return await withHeldFileLock(
+      lockPath2,
+      { staleMs: CAS_REVISION_LOCK_STALE_MS, maxWaitMs: CAS_REVISION_LOCK_MAX_WAIT_MS },
+      async (acquired, lock) => {
+        if (!acquired) throw new Error("CAS revision lock is unavailable.");
+        return await task(lock);
+      }
+    );
+  }
+  /** The target's standing revision token, or undefined when no receipt was
+   * ever minted for it. Fail-open on storage/read errors. */
+  async readRevision(filePath) {
+    try {
+      const relativePath = await this.resolveRelativePath(filePath);
+      return await this.readStandingRevision(relativePath);
+    } catch (error) {
+      log.warn(`CasRevisionStore.readRevision failed for ${filePath}: ${error}`);
+      return void 0;
+    }
+  }
+  /** #2813 (P1 A): the truthful standing-receipt read. `absent` means no
+   * receipt was ever minted for the target — undefined semantics stay
+   * correct for those records. `unavailable` means the sidecar could not
+   * be read OR a reservation is pending finalization; callers that
+   * transact on receipt identity MUST refuse rather than treat the
+   * failure as absence. */
+  async readRevisionStatus(filePath) {
+    try {
+      const relativePath = await this.resolveRelativePath(filePath);
+      const standing = await this.readStandingRevisionStrict(relativePath);
+      return standing === void 0 ? { status: "absent" } : {
+        status: "present",
+        revision: standing.revision,
+        ...standing.committedDigest !== void 0 ? { committedDigest: standing.committedDigest } : {}
+      };
+    } catch (error) {
+      return { status: "unavailable", reason: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  /** #2813 (P1 C): reserve the NEXT revision token as a durable PENDING
+   * marker under the target's shard lock — the write-ahead record of a
+   * receipt transaction. The token is strictly greater than the standing
+   * token (max(clock, prev + 1ms)), so two commits can never share a
+   * receipt — not within one millisecond, not across a backward clock
+   * step. Refuses while another reservation is pending (recovery needed)
+   * or the standing receipt cannot be determined. The caller MUST either
+   * `commit` after its durable write lands or `abort` when it fails.
+   * #2807: the marker records the reserve-time fingerprint (`baselineDigest`)
+   * and optional expected post-write fingerprint (`expectedDigest`) with
+   * `writeLanded: false`. {@link recoverPendingRevision} decides crashes
+   * before or after the memory write from that evidence. */
+  async beginRevisionTransaction(filePath, expectedContent) {
+    const relativePath = await this.resolveRelativePath(filePath);
+    return await this.withShardLock(relativePath, async (lock) => {
+      const standingInfo = await this.readStandingRevisionStrict(relativePath);
+      const standing = standingInfo?.revision;
+      const next = nextCasRevisionIso(standing);
+      const baselineDigest = await this.digestDurableFile(relativePath);
+      const expectedDigest = expectedContent != null ? this.digestContent(expectedContent) : void 0;
+      const { shardPath } = await this.getSafeShardInfo(relativePath);
+      await this.writeShard(shardPath, relativePath, next, lock, "pending", standing, {
+        baselineDigest,
+        ...expectedDigest !== void 0 ? { expectedDigest } : {},
+        writeLanded: false
+      });
+      return {
+        pendingRevision: next,
+        writeLanded: () => this.recordPendingWriteLanded(relativePath, next),
+        commit: () => this.finalizeRevisionTransaction(relativePath, next, "commit"),
+        abort: () => this.finalizeRevisionTransaction(relativePath, next, "abort")
+      };
+    });
+  }
+  digestContent(content) {
+    const bytes = typeof content === "string" ? Buffer.from(content, "utf8") : content;
+    return createHash("sha256").update(bytes).digest("hex");
+  }
+  async digestDurableFile(filePath) {
+    const relativePath = await this.resolveRelativePath(filePath);
+    const baseDir = path6.resolve(this.baseDir);
+    const target = await resolveSafeStoragePath(baseDir, relativePath);
+    let bytes;
+    try {
+      bytes = await readFile(target);
+    } catch (error) {
+      if (isErrnoCode(error, "ENOENT")) return null;
+      throw new Error(
+        `CAS revision evidence: durable memory file ${relativePath} is unreadable: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    return createHash("sha256").update(bytes).digest("hex");
+  }
+  /** #2807: mark the reserved write as landed. Verifies a pre-recorded
+   * expected digest against the durable file, or records the file digest
+   * when none was reserved. Sets `writeLanded: true`. Idempotent. */
+  async recordPendingWriteLanded(relativePath, token) {
+    await this.withShardLock(relativePath, async (lock) => {
+      const { shardPath } = await this.getSafeShardInfo(relativePath);
+      const view = await this.readShardView(shardPath, relativePath);
+      if (view.kind !== "pending" || view.foreign || view.revision !== token) {
+        throw new Error(
+          `CAS revision evidence recording refused for ${relativePath}: the pending marker does not match the reserved token.`
+        );
+      }
+      if (pendingWriteHasLanded(view) && view.writeLanded !== false) return;
+      const currentDigest = await this.digestDurableFile(relativePath);
+      if (view.expectedDigest !== void 0 && currentDigest !== view.expectedDigest) {
+        throw new Error(
+          `CAS revision evidence recording refused for ${relativePath}: the durable file does not match the reserved expected digest.`
+        );
+      }
+      await this.writeShard(shardPath, relativePath, token, lock, "pending", view.previous, {
+        baselineDigest: view.baselineDigest === void 0 ? null : view.baselineDigest,
+        expectedDigest: view.expectedDigest !== void 0 ? view.expectedDigest : currentDigest,
+        writeLanded: true
+      });
+    });
+  }
+  async finalizeRevisionTransaction(relativePath, token, outcome) {
+    await this.withShardLock(relativePath, async (lock) => {
+      const { shardPath } = await this.getSafeShardInfo(relativePath);
+      const view = await this.readShardView(shardPath, relativePath);
+      if (view.kind === "pending" && !view.foreign && view.revision === token) {
+        if (outcome === "commit") {
+          const committedDigest = view.expectedDigest ?? await this.digestDurableFile(relativePath);
+          await this.writeShard(shardPath, relativePath, token, lock, "committed", void 0, {
+            committedDigest
+          });
+        } else if (view.previous !== void 0) {
+          await this.writeShard(shardPath, relativePath, view.previous, lock, "committed");
+        } else {
+          await unlink2(shardPath);
+        }
+        return;
+      }
+      if (outcome === "commit" && view.kind === "committed" && !view.foreign && view.revision === token) {
+        return;
+      }
+      if (outcome === "abort" && view.kind === "missing") {
+        return;
+      }
+      throw new Error(
+        `CAS revision transaction ${outcome} refused for ${relativePath}: the pending marker does not match the reserved token.`
+      );
+    });
+  }
+  /** #2813 (P1 C): recovery for a reservation left PENDING by a crash or a
+   * failed publication. The caller supplies the KNOWN outcome of the
+   * durable memory write: `fileWriteLanded` publishes the pending token as
+   * the COMMITTED receipt; otherwise the reservation is discarded and the
+   * previous standing token restored. Idempotent — an already-committed or
+   * absent shard is reported, not mutated. */
+  async reconcilePendingRevision(filePath, fileWriteLanded) {
+    const relativePath = await this.resolveRelativePath(filePath);
+    return await this.withShardLock(relativePath, async (lock) => {
+      const { shardPath } = await this.getSafeShardInfo(relativePath);
+      const view = await this.readShardView(shardPath, relativePath);
+      if (view.kind === "committed") return "committed";
+      if (view.kind !== "pending") return "absent";
+      if (view.foreign) {
+        throw new Error(
+          `CAS revision pending marker for ${relativePath} names another target; manual recovery is required.`
+        );
+      }
+      if (fileWriteLanded) {
+        const committedDigest = view.expectedDigest ?? await this.digestDurableFile(relativePath);
+        await this.writeShard(shardPath, relativePath, view.revision, lock, "committed", void 0, {
+          committedDigest
+        });
+      } else if (view.previous !== void 0) {
+        await this.writeShard(shardPath, relativePath, view.previous, lock, "committed");
+      } else {
+        await unlink2(shardPath);
+      }
+      return "reconciled";
+    });
+  }
+  /** #2807 (P1): evidence-based recovery for a reservation left PENDING by
+   * a crash between reserve and finalize. Under the shard lock, the durable
+   * file's current fingerprint is compared against the marker:
+   * - matches `expectedDigest` → publish the pending token as COMMITTED;
+   * - matches `baselineDigest` (including both absent) → abort and restore;
+   * - anything else THROWS. Recovery never guesses.
+   *
+   * `onlyWithWriteEvidence` is the unlocked read path. A marker whose write
+   * has not landed (`writeLanded` false, or legacy with no expectedDigest)
+   * may belong to a live writer, so it returns `reserved`. A landed marker
+   * whose file no longer matches `expectedDigest` throws ambiguity. */
+  async recoverPendingRevision(filePath, options) {
+    const relativePath = await this.resolveRelativePath(filePath);
+    return await this.withShardLock(relativePath, async (lock) => {
+      const { shardPath } = await this.getSafeShardInfo(relativePath);
+      const view = await this.readShardView(shardPath, relativePath);
+      if (view.kind === "missing" || view.kind === "foreign") return "absent";
+      if (view.kind === "committed") return view.foreign ? "absent" : "committed";
+      if (view.foreign) {
+        throw new Error(
+          `CAS revision pending marker for ${relativePath} names another target; manual recovery is required.`
+        );
+      }
+      const currentDigest = await this.digestDurableFile(relativePath);
+      const landed = pendingWriteHasLanded(view);
+      if (options?.onlyWithWriteEvidence && !landed) {
+        return "reserved";
+      }
+      if (view.expectedDigest !== void 0 && currentDigest === view.expectedDigest) {
+        await this.writeShard(shardPath, relativePath, view.revision, lock, "committed", void 0, {
+          committedDigest: view.expectedDigest
+        });
+        return "committed";
+      }
+      if (options?.onlyWithWriteEvidence) {
+        const evidence2 = view.expectedDigest === void 0 ? "the pending marker carries no crash evidence (written by an older version)" : "the durable file matches neither the expected commit fingerprint nor the reserve-time baseline";
+        throw new Error(
+          `CAS revision recovery for ${relativePath} is ambiguous: ${evidence2} (pending token ${view.revision}${view.previous !== void 0 ? `, previous ${view.previous}` : ""}). Inspect the durable file and the shard at ${shardPath}, then run reconcilePendingRevision with the known write outcome. Refusing to guess.`
+        );
+      }
+      if (view.baselineDigest !== void 0 && currentDigest === view.baselineDigest) {
+        if (view.previous !== void 0) {
+          await this.writeShard(shardPath, relativePath, view.previous, lock, "committed");
+        } else {
+          await unlink2(shardPath);
+        }
+        return "aborted";
+      }
+      const evidence = view.baselineDigest === void 0 && view.expectedDigest === void 0 ? "the pending marker carries no crash evidence (written by an older version)" : "the durable file matches neither the expected commit fingerprint nor the reserve-time baseline";
+      throw new Error(
+        `CAS revision recovery for ${relativePath} is ambiguous: ${evidence} (pending token ${view.revision}${view.previous !== void 0 ? `, previous ${view.previous}` : ""}). Inspect the durable file and the shard at ${shardPath}, then run reconcilePendingRevision with the known write outcome. Refusing to guess.`
+      );
+    });
+  }
+};
+
+// src/storage/cas-revision-host.ts
+var CasRevisionHost = class extends CasRevisionStore {
+  /** Standing CAS revision token — receipt identity, never public `updated` (#2807). Fail-open on read errors. */
+  async readCasRevision(filePath) {
+    try {
+      return await this.readRevision(filePath);
+    } catch (err) {
+      log.warn(`storage.readCasRevision failed for ${filePath}: ${err}`);
+      return void 0;
+    }
+  }
+  /** #2813 (P1 A): truthful CAS receipt probe — distinguishes a genuinely
+   * ABSENT receipt (target predates the sidecar; `undefined` semantics stay
+   * correct) from an UNAVAILABLE one (unreadable shard: receipt identity is
+   * unknown). Transactional callers that must refuse on unknown identity
+   * route here; `readCasRevision` stays fail-open for advisory reads.
+   * #2807 (P1): a PENDING marker left by a crash is lazily recovered on
+   * this first read when its evidence is decisive; a reserve-only marker
+   * may belong to a live writer and defers to the path-locked write path,
+   * and ambiguity stays `unavailable` with an actionable reason. */
+  async readCasRevisionStatus(filePath) {
+    const status = await this.readRevisionStatus(filePath);
+    if (status.status !== "unavailable" || !/pending/i.test(status.reason)) return status;
+    try {
+      const outcome = await this.recoverPendingRevision(filePath, {
+        onlyWithWriteEvidence: true
+      });
+      if (outcome === "reserved") return status;
+    } catch (error) {
+      return {
+        status: "unavailable",
+        reason: error instanceof Error ? error.message : String(error)
+      };
+    }
+    return await this.readRevisionStatus(filePath);
+  }
+  async readDurableFileDigest(filePath) {
+    try {
+      return await this.digestDurableFile(filePath);
+    } catch (err) {
+      log.warn(`storage.readDurableFileDigest failed for ${filePath}: ${err}`);
+      return null;
+    }
+  }
+  /** #2807 (P1): reconcile any crash-orphaned PENDING marker for this
+   * target BEFORE the next semantic mutation reserves a new token —
+   * otherwise a crashed reservation would make the memory permanently
+   * unwritable. Decisive evidence heals; ambiguity throws so the
+   * mutation fails closed with the actionable recovery error. */
+  async beginRevision(pathname, expectedContent) {
+    await this.recoverPendingRevision(pathname);
+    return await this.beginRevisionTransaction(pathname, expectedContent);
+  }
+};
+
 // src/storage/identity-continuity-store.ts
 import { readdir as readdir3 } from "fs/promises";
 import path7 from "path";
@@ -2549,16 +2993,16 @@ var IdentityContinuityStore = class {
 };
 
 // src/storage/entity-canonical-id-migration.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import {
   access,
   lstat as lstat2,
-  readFile,
+  readFile as readFile2,
   readdir as readdir4,
   realpath as realpath2,
-  rename,
+  rename as rename2,
   stat as statFile,
-  unlink as unlink2,
+  unlink as unlink3,
   writeFile
 } from "fs/promises";
 import path8 from "path";
@@ -2600,7 +3044,7 @@ async function fingerprintEntityEntries(entitiesDir) {
     if (isErrnoCode(error, "ENOENT")) return "missing";
     throw error;
   }
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   for (const name of names) {
     hash.update(`${name.length}:${name}:`);
     try {
@@ -2720,7 +3164,7 @@ async function readState(deps) {
   await assertSafeMigrationStateFile(deps);
   let raw;
   try {
-    raw = await readFile(statePath(deps), "utf-8");
+    raw = await readFile2(statePath(deps), "utf-8");
   } catch (error) {
     if (isErrnoCode(error, "ENOENT")) return null;
     throw error;
@@ -2743,13 +3187,13 @@ async function readState(deps) {
 }
 async function writeState(deps, state) {
   const destination = statePath(deps);
-  const temporary = `${destination}.${process.pid}.${randomUUID()}.tmp`;
+  const temporary = `${destination}.${process.pid}.${randomUUID2()}.tmp`;
   try {
     await writeFile(temporary, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
-    await rename(temporary, destination);
+    await rename2(temporary, destination);
   } finally {
-    await unlink2(temporary).catch(() => void 0);
+    await unlink3(temporary).catch(() => void 0);
   }
 }
 async function publishState(deps, state) {
@@ -3142,7 +3586,7 @@ async function migrateEntityFilePair(deps, legacyId, canonicalId, refreshMigrati
       await deps.snapshotBeforeWrite(legacyPath, "write");
       await assertNotSymlink(legacyPath, legacyId);
       await assertEntityContentUnchanged(deps, legacyPath, legacyContent, legacyId);
-      await unlink2(legacyPath);
+      await unlink3(legacyPath);
       return { deferred: false, progressed: true };
     }
     if (!legacyExists) return { deferred: false, progressed: false };
@@ -3166,13 +3610,13 @@ async function migrateEntityFilePair(deps, legacyId, canonicalId, refreshMigrati
       await deps.snapshotBeforeWrite(legacyPath, "write");
       await assertNotSymlink(legacyPath, legacyId);
       await assertEntityContentUnchanged(deps, legacyPath, entityContent, legacyId);
-      await unlink2(legacyPath);
+      await unlink3(legacyPath);
     } catch (error) {
       if (!canonicalExists && canonicalFingerprintAfterWrite !== null) {
         try {
           if (await fingerprintPath(canonicalPath) === canonicalFingerprintAfterWrite) {
             await assertNotSymlink(canonicalPath, canonicalId);
-            await unlink2(canonicalPath);
+            await unlink3(canonicalPath);
           }
         } catch {
         }
@@ -3198,7 +3642,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
       let reconcileRequested = await fileExists(consumingMarkerPath);
       if (await fileExists(reconcileMarkerPath)) {
         try {
-          await rename(reconcileMarkerPath, consumingMarkerPath);
+          await rename2(reconcileMarkerPath, consumingMarkerPath);
           reconcileRequested = true;
         } catch (error) {
           if (!isErrnoCode(error, "ENOENT")) throw error;
@@ -3221,7 +3665,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
           );
         }
         if (reconcileRequested) {
-          await unlink2(consumingMarkerPath).catch((error) => {
+          await unlink3(consumingMarkerPath).catch((error) => {
             if (!isErrnoCode(error, "ENOENT")) throw error;
           });
         }
@@ -3367,7 +3811,7 @@ async function migrateLegacyEntityCanonicalIds(deps) {
 }
 
 // src/storage/entity-ref-repair.ts
-import { unlink as unlink3 } from "fs/promises";
+import { unlink as unlink4 } from "fs/promises";
 var EntityRefRepair = class {
   constructor(deps) {
     this.deps = deps;
@@ -3429,7 +3873,7 @@ ${body}
       if (opts.onFailRestore) {
         await this.restore(opts.onFailRestore);
       } else if (opts.onFailRemove) {
-        await unlink3(opts.onFailRemove).catch(() => void 0);
+        await unlink4(opts.onFailRemove).catch(() => void 0);
         this.deps.invalidateAllMemoriesCache();
       }
       throw err;
@@ -4522,7 +4966,7 @@ function collectSpeakers(tagged) {
 }
 
 // src/wearables/fusion/fuse.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var FUSION_ID_PREFIX = "fusion";
 var FUSION_ALGO_VERSION = "2026-07-12-1";
 function canonicalInputsKey(date, inputs) {
@@ -4551,7 +4995,7 @@ function canonicalInputsKey(date, inputs) {
       ])
     ])
   ];
-  return createHash2("sha256").update(JSON.stringify(record), "utf-8").digest("hex");
+  return createHash3("sha256").update(JSON.stringify(record), "utf-8").digest("hex");
 }
 function configFingerprint(options, sources) {
   const proximityGapMs = options.proximityGapMs ?? DEFAULT_PROXIMITY_GAP_MS;
@@ -4566,7 +5010,7 @@ function canonicalDayKey(date, inputs, options, algoVersion = FUSION_ALGO_VERSIO
     options,
     inputs.map((conv) => conv.source)
   );
-  return createHash2("sha256").update(inputsKey).update("\n").update(fingerprint).update("\n").update(algoVersion).digest("hex");
+  return createHash3("sha256").update(inputsKey).update("\n").update(fingerprint).update("\n").update(algoVersion).digest("hex");
 }
 function buildProvenance(cluster, proximityGapMs, windowToleranceMs) {
   return {
@@ -4626,11 +5070,11 @@ function fuseDay(date, inputs, options = {}) {
 }
 
 // src/wearables/fusion/store.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import * as path11 from "path";
 var FUSION_KIND = "wearable-fusion";
 function hashFusionBody(conversations) {
-  return createHash3("sha256").update(JSON.stringify(conversations), "utf-8").digest("hex");
+  return createHash4("sha256").update(JSON.stringify(conversations), "utf-8").digest("hex");
 }
 function composeFusionDayMeta(date, conversations, sources, contentHash, fusedAt) {
   return {
@@ -5047,7 +5491,7 @@ function reconstructFusionInputs(date, dayTranscripts) {
 }
 
 // src/meetings/store.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import * as path12 from "path";
 var MEETINGS_DIR_NAME = "meetings";
 var MEETING_KIND = "meeting";
@@ -5078,7 +5522,7 @@ function canonicalContent(base, fused) {
   });
 }
 function composeMeetingRecord(base, fused) {
-  const contentHash = createHash4("sha256").update(canonicalContent(base, fused), "utf-8").digest("hex");
+  const contentHash = createHash5("sha256").update(canonicalContent(base, fused), "utf-8").digest("hex");
   return {
     ...base,
     ...fused,
@@ -5485,7 +5929,7 @@ Reason: ${reason}`;
 }
 
 // src/storage/entity-timeline.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var ENTITY_TIMELINE_METADATA_MARKER = "remnic-meta-v1";
 function parseEntityTimelineBullet(bullet, fallbackTimestamp) {
   const trimmed = bullet.trim();
@@ -5927,7 +6371,7 @@ function fingerprintEntityStructuredFacts(entity) {
     (left, right) => left.key.localeCompare(right.key) || left.title.localeCompare(right.title) || left.facts.join("\n").localeCompare(right.facts.join("\n"))
   );
   if (normalizedSections.length === 0) return void 0;
-  return createHash5("sha256").update(JSON.stringify(normalizedSections)).digest("hex");
+  return createHash6("sha256").update(JSON.stringify(normalizedSections)).digest("hex");
 }
 function isEntitySynthesisStale(entity) {
   const structuredFactCount = countEntityStructuredFacts(entity);
@@ -6972,6 +7416,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       deletionRevisionLockPath: path14.join(baseDir, ".offline-sync", "deletion-revisions.v1.json.lock"),
       assertManagedStoragePath: (filePath, method) => this.assertManagedStoragePath(filePath, method)
     });
+    this.casRevisions = new CasRevisionHost(baseDir);
     this.hotMemoriesCacheEnabled = hotMemoriesCacheEnabledOverride ?? _StorageManager.hotMemoriesCacheDefaultByDir.get(baseDir) ?? _StorageManager.hotMemoriesCacheDefault;
     this.loadAliasesSync();
   }
@@ -6979,6 +7424,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   entitySchemas;
   knowledgeIndexCache = null;
   deletionRevisionStore;
+  casRevisions;
   artifactIndexCache = null;
   projectionLedgerLagManager = new ProjectionLedgerLagManager();
   static loadedMemorySnapshots = /* @__PURE__ */ new WeakMap();
@@ -7604,7 +8050,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       writeFile: (p, c) => this.writeStorageSecureFile(p, c),
       readFile: (p) => readMaybeEncryptedFile(p, this._secureStoreKey, this.baseDir),
       readDir: (d) => readdir6(d),
-      deleteFile: (p) => unlink4(p),
+      deleteFile: (p) => unlink5(p),
       realpath: (p) => realpath3(p),
       lstat: (p) => lstat3(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() }))
     });
@@ -7622,7 +8068,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       writeFile: (p, c) => this.writeStorageSecureFile(p, c),
       readFile: (p) => readMaybeEncryptedFile(p, this._secureStoreKey, this.baseDir),
       readDir: (d) => readdir6(d),
-      deleteFile: (p) => unlink4(p),
+      deleteFile: (p) => unlink5(p),
       realpath: (p) => realpath3(p),
       lstat: (p) => lstat3(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() }))
     });
@@ -7761,6 +8207,10 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   async hasCommittedInvalidation(memory) {
     return this.deletionRevisionStore.hasCommittedInvalidation(memory);
   }
+  readCasRevision = (filePath) => this.casRevisions.readCasRevision(filePath);
+  readCasRevisionStatus = (filePath) => this.casRevisions.readCasRevisionStatus(filePath);
+  readDurableFileDigest = (filePath) => this.casRevisions.readDurableFileDigest(filePath);
+  beginDurableMemoryRevision = (pathname, expectedContent) => this.casRevisions.beginRevision(pathname, expectedContent);
   async recordCommittedInvalidation(memory) {
     return this.deletionRevisionStore.recordCommittedInvalidation(memory);
   }
@@ -7797,11 +8247,11 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     if (encrypted) {
       const content = await readMaybeEncryptedFileBuffer(target, this._secureStoreKey, this.baseDir);
       digest = {
-        sha256: createHash6("sha256").update(content).digest("hex"),
+        sha256: createHash7("sha256").update(content).digest("hex"),
         bytes: content.byteLength
       };
     } else {
-      const hash = createHash6("sha256");
+      const hash = createHash7("sha256");
       let bytes = 0;
       for await (const rawChunk of createReadStream(target)) {
         const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
@@ -7829,7 +8279,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   async readOfflineSyncDigestCache() {
     const cache = /* @__PURE__ */ new Map();
     try {
-      const raw = await readFile2(this.offlineSyncDigestCachePath, "utf-8");
+      const raw = await readFile3(this.offlineSyncDigestCachePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return cache;
       const entries = parsed.entries;
@@ -7886,7 +8336,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
       const cache = this.offlineSyncDigestCache;
       if (!cache) return;
       const entries = [...cache.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([entryPath, entry]) => ({ path: entryPath, ...entry }));
-      await mkdir(path14.dirname(this.offlineSyncDigestCachePath), { recursive: true });
+      await mkdir2(path14.dirname(this.offlineSyncDigestCachePath), { recursive: true });
       await writeFile2(this.offlineSyncDigestCachePath, `${JSON.stringify({ version: 1, entries })}
 `, "utf-8");
     }).catch((err) => {
@@ -7896,7 +8346,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     });
   }
   async offlineSyncFileIsEncrypted(filePath) {
-    const handle = await open(filePath, "r");
+    const handle = await open2(filePath, "r");
     try {
       const header = Buffer.alloc(MAGIC_HEADER_SIZE);
       const { bytesRead } = await handle.read(header, 0, header.length, 0);
@@ -7955,7 +8405,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     }
     let handle;
     try {
-      handle = await open(filePath, "r");
+      handle = await open2(filePath, "r");
     } catch (err) {
       if (isErrnoCode(err, "ENOENT")) return false;
       throw err;
@@ -7975,7 +8425,7 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
   }
   async appendStorageSecureFileUnlocked(filePath, content) {
     const writeKey = this.resolveWriteKey();
-    await mkdir(path14.dirname(filePath), { recursive: true });
+    await mkdir2(path14.dirname(filePath), { recursive: true });
     if (writeKey === null) {
       try {
         if (await this.isEncryptedFileHeader(filePath)) {
@@ -8495,22 +8945,22 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
     return completionFingerprint;
   }
   async ensureDirectories() {
-    await mkdir(this.baseDir, { recursive: true });
+    await mkdir2(this.baseDir, { recursive: true });
     await validateRoots(this.baseDir, this.entitiesDir, this.stateDir, this.archiveDir);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    await mkdir(path14.join(this.factsDir, today), { recursive: true });
-    await mkdir(path14.join(this.proceduresDir, today), { recursive: true });
-    await mkdir(path14.join(this.reasoningTracesDir, today), { recursive: true });
-    await mkdir(this.correctionsDir, { recursive: true });
-    await mkdir(this.entitiesDir, { recursive: true });
-    await mkdir(this.stateDir, { recursive: true });
-    await mkdir(this.questionsDir, { recursive: true });
-    await mkdir(this.artifactsDir, { recursive: true });
-    await mkdir(this.identityDir, { recursive: true });
-    await mkdir(this.identityIncidentsDir, { recursive: true });
-    await mkdir(this.identityAuditsWeeklyDir, { recursive: true });
-    await mkdir(this.identityAuditsMonthlyDir, { recursive: true });
-    await mkdir(path14.join(this.baseDir, "config"), { recursive: true });
+    await mkdir2(path14.join(this.factsDir, today), { recursive: true });
+    await mkdir2(path14.join(this.proceduresDir, today), { recursive: true });
+    await mkdir2(path14.join(this.reasoningTracesDir, today), { recursive: true });
+    await mkdir2(this.correctionsDir, { recursive: true });
+    await mkdir2(this.entitiesDir, { recursive: true });
+    await mkdir2(this.stateDir, { recursive: true });
+    await mkdir2(this.questionsDir, { recursive: true });
+    await mkdir2(this.artifactsDir, { recursive: true });
+    await mkdir2(this.identityDir, { recursive: true });
+    await mkdir2(this.identityIncidentsDir, { recursive: true });
+    await mkdir2(this.identityAuditsWeeklyDir, { recursive: true });
+    await mkdir2(this.identityAuditsMonthlyDir, { recursive: true });
+    await mkdir2(path14.join(this.baseDir, "config"), { recursive: true });
     await this.entityCanonicalIdMigration.ensure();
     if (this.hotMemoriesCacheEnabled && this.getMemoryCorpusVersion() === 0) {
       this.bumpMemoryCorpusVersion();
@@ -8531,11 +8981,11 @@ var StorageManager3 = class _StorageManager extends TombstoneBlockedCaptureIndex
    */
   async resolveCategoryWritePath(category, id, today) {
     if (category === "correction") {
-      await mkdir(this.correctionsDir, { recursive: true });
+      await mkdir2(this.correctionsDir, { recursive: true });
       return path14.join(this.correctionsDir, `${id}.md`);
     }
     const datedDir = path14.join(getCategoryDir(this.baseDir, category), today);
-    await mkdir(datedDir, { recursive: true });
+    await mkdir2(datedDir, { recursive: true });
     return path14.join(datedDir, `${id}.md`);
   }
   async findExistingTombstoneBlockedMemory(content, category, sourceConnector) {
@@ -8707,7 +9157,7 @@ ${sanitized.text}
             }
           });
         } catch (err) {
-          await unlink4(filePath).catch(() => void 0);
+          await unlink5(filePath).catch(() => void 0);
           this.invalidateAllMemoriesCache();
           await this.rebuildTombstoneBlockedCaptureAfterInvalidationForPath(filePath);
           throw err;
@@ -8924,7 +9374,7 @@ ${sanitized.text}
     const now = /* @__PURE__ */ new Date();
     const day = now.toISOString().slice(0, 10);
     const dir = path14.join(this.artifactsDir, day);
-    await mkdir(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     const id = `artifact-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const fm = {
       id,
@@ -9507,7 +9957,7 @@ ${memory.content}
       {},
       this.baseDir
     );
-    const priorDest = await readFile2(targetPath).catch(() => null);
+    const priorDest = await readFile3(targetPath).catch(() => null);
     await persist();
     if (typeof rawRef === "string") {
       const refBeforeRepair = frontmatter.entityRef;
@@ -9522,7 +9972,7 @@ ${memory.content}
         });
       } catch (err) {
         if (priorDest === null) {
-          await unlink4(targetPath).catch(() => void 0);
+          await unlink5(targetPath).catch(() => void 0);
         } else {
           await writeFile2(targetPath, priorDest).catch(() => void 0);
         }
@@ -9619,7 +10069,7 @@ ${memory.content}
         const now = lifecycle?.at ?? /* @__PURE__ */ new Date();
         const today = now.toISOString().slice(0, 10);
         const destDir = path14.join(this.archiveDir, today);
-        await mkdir(destDir, { recursive: true });
+        await mkdir2(destDir, { recursive: true });
         const refIdsAtWrite = this.currentHistoricalIds();
         const updatedFm = canonicalizeEntityRefOption(
           {
@@ -9651,7 +10101,7 @@ ${current.content}
               await recordArchiveDelete2(
                 this.baseDir,
                 destPath,
-                () => unlink4(destPath).then(
+                () => unlink5(destPath).then(
                   () => true,
                   () => false
                 )
@@ -9768,10 +10218,10 @@ ${current.content}
       });
     });
   }
+  /** Commit the new body and return the CAS commit receipt — the sidecar
+   * revision token, never `frontmatter.updated` (#2813 P1, #2807). */
   async updateMemoryFromCurrent(memory, newContent, options) {
-    const mergedLineage = [...memory.frontmatter.lineage ?? [], ...options?.lineage ?? []].filter(
-      (v, i, a) => a.indexOf(v) === i
-    );
+    const mergedLineage = [...memory.frontmatter.lineage ?? [], ...options?.lineage ?? []].filter((v, i, a) => a.indexOf(v) === i);
     const refIdsAtWrite = this.currentHistoricalIds();
     const updated = canonicalizeEntityRefOption(
       {
@@ -9791,41 +10241,40 @@ ${current.content}
 
 ${sanitized.text}
 `;
-    await this.writeTombstoneBlockedUpdate(memory, fileContent, updated, sanitized.text, async () => {
+    const receipt = await this.writeTombstoneBlockedUpdate(memory, fileContent, updated, sanitized.text, async () => {
       this.invalidateAllMemoriesCache();
       if (this.isColdOrArchiveTierPath(memory.path)) this.invalidateColdMemoriesCache();
     });
-    if (typeof memory.frontmatter.entityRef === "string") {
-      await this.entityRefRepair.repair(
-        memory.path,
-        updated,
-        memory.frontmatter.entityRef,
-        refIdsAtWrite,
-        sanitized.text,
-        { onFailRestore: memory }
-      );
-    }
-    await this.patchHotMemoriesCache({ addedPath: memory.path });
-    await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.updateMemory", {
-      memoryId: memory.frontmatter.id,
-      eventType: "updated",
-      timestamp: updated.updated,
-      actor: options?.actor ?? "storage.updateMemory",
-      before: this.summarizeLifecycleState(memory.frontmatter, memory.path),
-      after: this.summarizeLifecycleState(updated, memory.path),
-      relatedMemoryIds: [
-        ...updated.supersedes ? [updated.supersedes] : [],
-        ...(updated.lineage ?? []).filter(Boolean)
-      ]
+    if (receipt === void 0) throw new Error(`CAS revision receipt unavailable for ${memory.frontmatter.id}`);
+    return await withCasCommitReceipt(receipt, async () => {
+      if (typeof memory.frontmatter.entityRef === "string") {
+        await this.entityRefRepair.repair(memory.path, updated, memory.frontmatter.entityRef, refIdsAtWrite, sanitized.text, { onFailRestore: memory });
+      }
+      await this.patchHotMemoriesCache({ addedPath: memory.path });
+      await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.updateMemory", {
+        memoryId: memory.frontmatter.id,
+        eventType: "updated",
+        timestamp: updated.updated,
+        actor: options?.actor ?? "storage.updateMemory",
+        before: this.summarizeLifecycleState(memory.frontmatter, memory.path),
+        after: this.summarizeLifecycleState(updated, memory.path),
+        relatedMemoryIds: [
+          ...updated.supersedes ? [updated.supersedes] : [],
+          ...(updated.lineage ?? []).filter(Boolean)
+        ]
+      });
+      log.debug(`updated memory ${memory.frontmatter.id}`);
+      return receipt;
     });
-    log.debug(`updated memory ${memory.frontmatter.id}`);
-    return true;
   }
   async updateMemory(id, newContent, options) {
     const memory = (await this.readAllMemories()).find((candidate) => candidate.frontmatter.id === id);
     if (!memory) return false;
-    return await this.updateMemoryFromCurrent(memory, newContent, options);
+    await this.updateMemoryFromCurrent(memory, newContent, options);
+    return true;
   }
+  /** CAS content update: false when the record moved past `expected`; on
+   * success the commit receipt — the only identity that can attribute a standing body later (#2813 P1, #2807). */
   async updateMemoryIfUnchanged(expected, newContent, options) {
     const sanitized = sanitizeMemoryContent(newContent);
     const oldIdentity = buildExplicitCaptureDedupKey(
@@ -9849,8 +10298,7 @@ ${sanitized.text}
     );
   }
   /**
-   * Update frontmatter fields without changing memory content.
-   * Returns false when the memory is not found.
+   * Update frontmatter fields without changing memory content. Returns false when the memory is not found.
    */
   async writeMemoryFrontmatter(memory, patch, lifecycle) {
     const beforeStatus = memory.frontmatter.status ?? "active";
@@ -10078,7 +10526,7 @@ ${memory.content}
       },
       (payload) => this.appendStorageSecureFile(target, payload),
       async () => {
-        await mkdir(path14.dirname(target), { recursive: true });
+        await mkdir2(path14.dirname(target), { recursive: true });
       }
     );
   }
@@ -10338,7 +10786,7 @@ ${memory.content}
       return false;
     }
     if (draftState.contentHash) {
-      const contentHash = createHash6("sha256").update(draftContent).digest("hex");
+      const contentHash = createHash7("sha256").update(draftContent).digest("hex");
       if (contentHash !== draftState.contentHash) return false;
     }
     await this.writeCompressionGuidelines(draftContent);
@@ -10347,8 +10795,8 @@ ${memory.content}
       activationState: "active"
     });
     await Promise.all([
-      unlink4(this.compressionGuidelineDraftPath).catch(() => void 0),
-      unlink4(this.compressionGuidelineDraftStatePath).catch(() => void 0)
+      unlink5(this.compressionGuidelineDraftPath).catch(() => void 0),
+      unlink5(this.compressionGuidelineDraftStatePath).catch(() => void 0)
     ]);
     return true;
   }
@@ -10400,7 +10848,7 @@ ${memory.content}
     return `${prefix}-${ts}-${rand}`;
   }
   async writeQuestion(question, context, priority) {
-    await mkdir(this.questionsDir, { recursive: true });
+    await mkdir2(this.questionsDir, { recursive: true });
     const id = this.generateId("q");
     const frontmatter = {
       id,
@@ -10454,7 +10902,7 @@ ${question}
   async readIdentity(workspaceDir, namespace) {
     const identityPath = this.identityFilePath(workspaceDir, namespace);
     try {
-      return await readFile2(identityPath, "utf-8");
+      return await readFile3(identityPath, "utf-8");
     } catch {
       return "";
     }
@@ -10472,7 +10920,7 @@ ${question}
     const identityPath = this.identityFilePath(workspaceDir, opts?.namespace);
     let existing = "";
     try {
-      existing = await readFile2(identityPath, "utf-8");
+      existing = await readFile3(identityPath, "utf-8");
     } catch {
     }
     const hygiene = opts?.hygiene;
@@ -10532,7 +10980,7 @@ ${reflection}
     }
   }
   async writeIdentityReflections(content) {
-    await mkdir(this.identityDir, { recursive: true });
+    await mkdir2(this.identityDir, { recursive: true });
     await this.writeStorageSecureFile(this.identityReflectionsPath, content);
   }
   async appendIdentityReflection(reflection) {
@@ -10564,7 +11012,7 @@ ${reflection}
 
 ${reflection}
 `;
-    await mkdir(this.identityDir, { recursive: true });
+    await mkdir2(this.identityDir, { recursive: true });
     await this.writeStorageSecureFile(this.identityReflectionsPath, `${existing.trimEnd()}${section}`);
     log.debug(`appended namespace-local reflection to ${this.identityReflectionsPath}`);
   }
@@ -10620,7 +11068,7 @@ ${reflection}
       const rightTs = latestEntityTimelineTimestamp(right.entity) ?? "";
       return compareEntityTimestamps(rightTs, leftTs);
     }).map(({ entityName }) => entityName);
-    await mkdir(this.stateDir, { recursive: true });
+    await mkdir2(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       this.entitySynthesisQueuePath,
       JSON.stringify(
@@ -10640,7 +11088,7 @@ ${reflection}
     if (queue.length === 0) return;
     const removals = new Set(entityNames);
     const nextQueue = queue.filter((name) => !removals.has(name));
-    await mkdir(this.stateDir, { recursive: true });
+    await mkdir2(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       this.entitySynthesisQueuePath,
       JSON.stringify(
@@ -11039,7 +11487,7 @@ ${sanitized.text}
     }
     if (!oldMemory) return false;
     const requireActiveAtWrite = options.requireActive === true || inferMemoryStatus(oldMemory.frontmatter, toMemoryPathRel(this.baseDir, oldMemory.path)) === "active";
-    const operationId = createHash6("sha256").update(
+    const operationId = createHash7("sha256").update(
       JSON.stringify({
         oldMemoryId,
         newMemoryId,
@@ -11171,7 +11619,7 @@ ${current.content}
     return path14.join(this.baseDir, "summaries");
   }
   async writeSummary(summary) {
-    await mkdir(this.summariesDir, { recursive: true });
+    await mkdir2(this.summariesDir, { recursive: true });
     const filePath = path14.join(this.summariesDir, `${summary.id}.json`);
     await this.writeStorageSecureFile(filePath, JSON.stringify(summary, null, 2));
     log.debug(`wrote summary ${summary.id}`);
@@ -11253,7 +11701,7 @@ ${current.content}
   }
   async saveTopics(topics) {
     const metaPath = path14.join(this.stateDir, "topics.json");
-    await mkdir(this.stateDir, { recursive: true });
+    await mkdir2(this.stateDir, { recursive: true });
     await this.writeStorageSecureFile(
       metaPath,
       JSON.stringify({ topics, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
@@ -11338,13 +11786,6 @@ ${current.content}
 export {
   serializeDriftProvenance,
   parseDriftProvenance,
-  okfTypeForCategory,
-  okfTypeForMemory,
-  OKF_PROFILE_TYPE,
-  OKF_DECISION_RECORD_TYPE,
-  OKF_ARCHITECTURE_CARD_TYPE,
-  OKF_CODE_MODULE_TYPE,
-  OKF_RESERVED_BASENAMES,
   selfDeps,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
@@ -11386,4 +11827,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-HV7OY4DM.js.map
+//# sourceMappingURL=chunk-5VAF4ID4.js.map