@remnic/core 9.69.33 → 9.69.35

package/src/fallback-llm.test.ts

@@ -827,6 +827,59 @@ test("fallback llm invokes registered codex-cli fallback runner", { concurrency:
   }
 });
 
+test("fallback llm leaves codex-cli call timeout unset so provider retryOptions applies", { concurrency: false }, async () => {
+  clearModelsJsonCache();
+  clearSecretCache();
+
+  let capturedOptionTimeout: unknown;
+  let capturedProviderTimeout: unknown;
+  const restoreRunner = __codexCliFallbackTestHooks.setRunCodexCliForTest(
+    async (request) => {
+      capturedOptionTimeout = request.options.timeoutMs;
+      capturedProviderTimeout = request.config.retryOptions?.timeoutMs;
+      return { content: "provider timeout answer" };
+    },
+  );
+
+  const llm = new FallbackLlmClient({
+    agents: {
+      defaults: {
+        model: {
+          primary: "codex-cli/gpt-custom",
+        },
+      },
+    },
+    models: {
+      providers: {
+        "codex-cli": {
+          baseUrl: "",
+          api: "codex-cli",
+          executable: "codex-test-bin",
+          retryOptions: { timeoutMs: 1234 },
+          models: [],
+        },
+      },
+    },
+  });
+
+  try {
+    const response = await llm.chatCompletion(
+      [
+        { role: "user", content: "Say OK" },
+      ],
+      { temperature: 0, maxTokens: 16 },
+    );
+
+    assert.equal(response?.content, "provider timeout answer");
+    assert.equal(capturedOptionTimeout, undefined);
+    assert.equal(capturedProviderTimeout, 1234);
+  } finally {
+    restoreRunner();
+    clearModelsJsonCache();
+    clearSecretCache();
+  }
+});
+
 test("fallback llm aborts codex-cli fallback requests when timeout wins", { concurrency: false }, async () => {
   clearModelsJsonCache();
   clearSecretCache();

package/src/fallback-llm.ts

@@ -13,6 +13,11 @@ import {
   type GetRuntimeAuthForModelFn,
   type ResolveApiKeyFn,
 } from "./resolve-provider-secret.js";
+import {
+  CODEX_SUBSCRIPTION_PROVIDER_ID,
+  codexSubscriptionBuiltinProviderConfig,
+  ensureCodexSubscriptionRunnerRegistered,
+} from "./providers/codex-subscription.js";
 import { loadModelsJsonProviders } from "./models-json.js";
 import { callCodexCliFallback } from "./cli-fallback.js";
 import { resolveHomeDir } from "./runtime/env.js";
@@ -160,6 +165,10 @@ const BUILT_IN_PROVIDER_FALLBACKS: Record<string, ModelProviderConfig> = {
     models: [],
     [PROVIDER_API_KEY_FIELD]: MANAGED_SECRETREF_MARKER,
   },
+  // Subscription-OAuth extraction provider (issue #2784): no apiKey — the
+  // codex CLI login authenticates, via the runner the codex-subscription
+  // module registers on this same seam.
+  [CODEX_SUBSCRIPTION_PROVIDER_ID]: codexSubscriptionBuiltinProviderConfig(),
 };
 
 /**
@@ -667,6 +676,9 @@ export class FallbackLlmClient {
     }
 
     if (model.providerConfig.api === "codex-cli") {
+      // Registers the core subprocess transport only when no host/benchmark
+      // runner claimed the seam, so daemon/plugin runtimes work out of the box.
+      ensureCodexSubscriptionRunnerRegistered();
       return await callCodexCliFallback(
         effectiveConfig,
         model.modelId,

package/src/index.ts

@@ -48,6 +48,7 @@ export * from "./memory-projection-format.js";
 export { searchWithGenericExclusion } from "./access-memory-search-fanout.js";
 export * from "./model-registry.js";
 export * from "./contradiction/index.js";
+export * from "./recall-state-view.js";
 
 export {
   buildEvidencePack,
@@ -149,6 +150,7 @@ export {
   type CodexCliFallbackResult,
   type CodexCliFallbackRunner,
 } from "./cli-fallback.js";
+export { CODEX_SUBSCRIPTION_PROVIDER_ID, codexSubscriptionBuiltinProviderConfig, createCodexSubscriptionRunner, ensureCodexSubscriptionRunnerRegistered, CodexSubscriptionAuthError, CodexSubscriptionConfigError, CodexSubscriptionTimeoutError } from "./providers/codex-subscription.js";
 
 // ---------------------------------------------------------------------------
 // Smart buffer (issue #563)

package/src/local-llm-config.ts

@@ -0,0 +1,25 @@
+export interface LocalLlmConfig {
+  // Local LLM Provider (v2.1)
+  localLlmEnabled: boolean;
+  localLlmUrl: string;
+  localLlmModel: string;
+  /** Optional API key for authenticated OpenAI-compatible endpoints. */
+  localLlmApiKey?: string;
+  /** Optional environment-variable name that supplies localLlmApiKey at runtime. */
+  localLlmApiKeyEnv?: string;
+  /** Additional headers for local/compatible endpoint requests. */
+  localLlmHeaders?: Record<string, string>;
+  /** If false, do not send Authorization header even when localLlmApiKey is set. */
+  localLlmAuthHeader: boolean;
+  localLlmFallback: boolean;
+  /** Optional home directory override for local LLM helpers (LM Studio settings, CLI PATH). */
+  localLlmHomeDir?: string;
+  /** Optional absolute path to LMS CLI binary (preferred over auto-detection). */
+  localLmsCliPath?: string;
+  /** Optional bin directory prepended to PATH for LMS CLI execution. */
+  localLmsBinDir?: string;
+  /** Hard timeout for local LLM and gateway fallback requests (ms). */
+  localLlmTimeoutMs: number;
+  /** Max context window for local LLM (override auto-detection). Set lower if your LLM server defaults to smaller contexts. */
+  localLlmMaxContext?: number;
+}

package/src/local-llm.ts

@@ -237,6 +237,8 @@ interface LocalLlmChatCompletionOptions {
   priority?: LocalLlmRequestPriority;
   signal?: AbortSignal;
   redactProviderErrors?: boolean;
+  /** Per-request model; defaults to config.localLlmModel. */
+  model?: string;
 }
 interface LocalLlmQueuedRequest {
   messages: Array<{ role: string; content: string }>;
@@ -958,7 +960,7 @@ export class LocalLlmClient {
 
       const promptChars = messages.reduce((sum, m) => sum + (m.content?.length ?? 0), 0);
       const requestBody: Record<string, unknown> = {
-        model: this.config.localLlmModel,
+        model: options.model ?? this.config.localLlmModel,
         messages,
         temperature: options.temperature ?? 0.7,
         // Use max_tokens consistent with cloud models

package/src/orchestration/dependency-propagation-recovery-replay.ts

@@ -49,7 +49,7 @@ export type DependencyPropagationRecoveryStorage = DependencyPropagationStorage
       actor?: string;
       sourceConnector?: string;
     },
-  ) => Promise<boolean>;
+  ) => Promise<string | false>;
 };
 
 /**

package/src/orchestration/extraction-persist-deps.ts

@@ -96,5 +96,14 @@ export interface ExtractionPersistDeps {
     fallbackCausalPredecessor: string | undefined,
     graphCaps?: GraphConstructionCapabilitySet
   ) => Promise<GraphEdge[] | void>;
+  /**
+   * #2807 (finding 4): invalidate the in-process GraphIndex edge cache for
+   * a storage dir. Called after a merged-target graph rewrite rolls back —
+   * the rollback repairs the JSONL files, but the warm cache served by
+   * `loadEdgesCached()` would otherwise keep the rolled-back edges for the
+   * full TTL. Optional so existing partial deps keep compiling; production
+   * wiring always supplies it.
+   */
+  invalidateGraphEdgeCache?: (storage: StorageManager) => void;
   updateTemporalTagIndexes: (storage: StorageManager, persistedIds: string[]) => Promise<void>;
 }

package/src/orchestration/extraction-persist-promotion.test.ts

@@ -1,14 +1,15 @@
 import assert from "node:assert/strict";
 import test, { mock } from "node:test";
-import { mkdtemp } from "node:fs/promises";
-import type { MemoryFile } from "../types.js";
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
+import type { MemoryFile } from "../types.js";
 
 import { StorageManager } from "../index.js";
 import { parseConfig } from "../config.js";
 import { createBatchPromotedCopyProbe, mergeTargetHasPromotedCopies, promoteAndReconcileMergedTarget, retireStaleMergedTargetPromotionCopies } from "./extraction-persist-promotion.js";
-import { buildMergedTargetPromotionPayload } from "./semantic-merge-promotion-payload.js";
+import { buildMergedTargetPromotionPayload, type MergedTargetPromotionPayload } from "./semantic-merge-promotion-payload.js";
 import type { ResolvedScopeProfilePlan } from "../namespaces/scope-profiles.js";
 
 // Synthetic fixtures only — no real paths, hosts, or memory content.
@@ -418,7 +419,7 @@ async function commitWriterMerge(
 ): Promise<void> {
   const snapshot = await storage.getMemoryByIdIncludingArchived(targetId);
   assert.ok(snapshot);
-  assert.equal(await storage.updateMemoryIfUnchanged(snapshot, body), true);
+  assert.ok(await storage.updateMemoryIfUnchanged(snapshot, body));
 }
 
 test("promoteAndReconcileMergedTarget: abandons the cached promotion when the target advanced past it (round N+15 A)", async () => {
@@ -433,7 +434,7 @@ test("promoteAndReconcileMergedTarget: abandons the cached promotion when the ta
     source: "test",
   });
   await commitWriterMerge(s.source, target.id, A_MERGED_BODY);
-  const payload = await buildMergedTargetPromotionPayload(s.source, {
+  const { payload } = await buildMergedTargetPromotionPayload(s.source, {
     targetId: target.id,
     mergedContent: A_MERGED_BODY,
     provenancePatched: true,
@@ -480,7 +481,7 @@ test("promoteAndReconcileMergedTarget: reconciliation canonical is the re-read r
     source: "test",
   });
   await commitWriterMerge(s.source, target.id, A_MERGED_BODY);
-  const payload = await buildMergedTargetPromotionPayload(s.source, {
+  const { payload } = await buildMergedTargetPromotionPayload(s.source, {
     targetId: target.id,
     mergedContent: A_MERGED_BODY,
     provenancePatched: true,
@@ -532,3 +533,261 @@ test("promoteAndReconcileMergedTarget: reconciliation canonical is the re-read r
     "the supersession lands on the source target — the live canonical record",
   );
 });
+
+test("promoteAndReconcileMergedTarget: an unreadable payload skips destructive reconciliation (#2807)", async () => {
+  // The payload builder's post-commit reread failed TRANSIENTLY (secure
+  // store locked, corpus read I/O error). A null from that path means
+  // "payload unknown", not "no promotion warranted" — but the caller
+  // conflated both, so reconciliation immediately reread successfully,
+  // interpreted the missing payload as an intentional no-promotion result,
+  // and superseded a concurrent writer's PRE-merge copy with no
+  // current-body replacement, removing an otherwise eligible memory from
+  // the shared layer. An unknown payload must skip the destructive pass;
+  // the next merge retries both.
+  const s = await makeStorages();
+  const target = await s.source.writeMemory("fact", PRE_MERGE_BODY, {
+    source: "test",
+  });
+  await commitWriterMerge(s.source, target.id, A_MERGED_BODY);
+  // A concurrent writer published the PRE-merge body after the initial
+  // guard — the exact race reconciliation exists to clean up, but ONLY
+  // once the no-promotion outcome is confirmed intentional.
+  const staleCopy = await s.shared.writeMemory("fact", PRE_MERGE_BODY, {
+    source: "writer-b",
+    sourceMemoryId: target.id,
+  });
+  let reads = 0;
+  const lockedThenRecovered = {
+    dir: s.source.dir,
+    getMemoryByIdIncludingArchived: async (id: string) => {
+      reads += 1;
+      if (reads === 1) throw new Error("secure store locked");
+      return s.source.getMemoryByIdIncludingArchived(id);
+    },
+  } as unknown as StorageManager;
+  const built = (await buildMergedTargetPromotionPayload(lockedThenRecovered, {
+    targetId: target.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  })) as { payload: MergedTargetPromotionPayload | null; readFailed?: boolean } | null;
+  // Pre-#2807 the builder returned a bare null; the result object now
+  // preserves WHY. This normalization keeps the test runnable against
+  // both shapes.
+  const payload = built === null ? null : built.payload;
+  const readFailed = built !== null && built.readFailed === true;
+  let promotions = 0;
+  await promoteAndReconcileMergedTarget({
+    promote: async () => {
+      promotions += 1;
+      return `copy-${promotions}`;
+    },
+    config: parseConfig({ memoryDir: s.source.dir, sharedNamespace: "shared" }),
+    getStorageRouter: () => s.router,
+    scopeProfileWritePlan: null,
+    sourceStorage: s.source,
+    sourceMemoryId: target.id,
+    mergedPromotion: payload,
+    mergedPromotionReadFailed: readFailed,
+    normalize: (content: string) => content,
+  });
+  assert.equal(promotions, 0, "an unreadable payload promotes nothing");
+  const row = await s.shared.getMemoryByIdIncludingArchived(staleCopy.id);
+  assert.equal(
+    row?.frontmatter.status ?? "active",
+    "active",
+    "an unconfirmed no-promotion outcome must never retire copies — the next merge retries promotion and reconciliation",
+  );
+});
+
+function casShardPath(storageDir: string, memoryPath: string): string {
+  const relative = path.relative(storageDir, memoryPath).split(path.sep).join("/");
+  const hash = createHash("sha256").update(relative).digest("hex");
+  return path.join(storageDir, ".offline-sync", "cas-revisions", `${hash}.json`);
+}
+
+test("buildMergedTargetPromotionPayload: an unreadable CAS receipt shard refuses the promotion (#2813 P1 A)", async () => {
+  const s = await makeStorages();
+  const target = await s.source.writeMemory("fact", PRE_MERGE_BODY, { source: "test" });
+  await commitWriterMerge(s.source, target.id, A_MERGED_BODY);
+  const committedRow = await s.source.getMemoryByIdIncludingArchived(target.id);
+  assert.ok(committedRow);
+  const shardPath = casShardPath(s.source.dir, committedRow.path);
+  // Prove a real standing receipt existed before tearing the shard.
+  const shard = JSON.parse(await readFile(shardPath, "utf8")) as { revision?: string };
+  assert.ok(shard.revision, "the merge commit minted a standing receipt");
+  await writeFile(shardPath, "{corrupt", "utf8");
+
+  // A concurrent writer published the PRE-merge body after the initial
+  // guard — reconciliation may retire it ONLY off a confirmed outcome.
+  const staleCopy = await s.shared.writeMemory("fact", PRE_MERGE_BODY, {
+    source: "writer-b",
+    sourceMemoryId: target.id,
+  });
+  const built = await buildMergedTargetPromotionPayload(s.source, {
+    targetId: target.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  });
+  assert.equal(built.payload, null, "an unreadable receipt must refuse the promotion");
+  assert.equal(built.readFailed, true, "the refusal is an unknown outcome, not a no-promotion verdict");
+
+  let promotions = 0;
+  await promoteAndReconcileMergedTarget({
+    promote: async () => {
+      promotions += 1;
+      return `copy-${promotions}`;
+    },
+    config: parseConfig({ memoryDir: s.source.dir, sharedNamespace: "shared" }),
+    getStorageRouter: () => s.router,
+    scopeProfileWritePlan: null,
+    sourceStorage: s.source,
+    sourceMemoryId: target.id,
+    mergedPromotion: built.payload,
+    mergedPromotionReadFailed: built.readFailed,
+    normalize: (content) => content,
+  });
+  assert.equal(promotions, 0, "nothing is promoted off an unconfirmable receipt");
+  const row = await s.shared.getMemoryByIdIncludingArchived(staleCopy.id);
+  assert.equal(
+    row?.frontmatter.status ?? "active",
+    "active",
+    "no destructive reconciliation runs off an unknown payload",
+  );
+});
+
+test("promoteAndReconcileMergedTarget: a receipt that becomes unreadable before the promotion abandons it (#2813 P1 A)", async () => {
+  const s = await makeStorages();
+  // Fresh target, never minted: the payload legitimately carries no token.
+  const target = await s.source.writeMemory("fact", A_MERGED_BODY, { source: "test" });
+  const { payload } = await buildMergedTargetPromotionPayload(s.source, {
+    targetId: target.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  });
+  assert.ok(payload);
+  assert.equal(payload.committedRevision, undefined, "a genuinely absent receipt builds a tokenless payload");
+  // A torn shard write lands between build and promotion: absence became
+  // UNREADABLE, and the old undefined-vs-undefined comparison would have
+  // confirmed the cached body anyway.
+  const committedRow = await s.source.getMemoryByIdIncludingArchived(target.id);
+  assert.ok(committedRow);
+  const tornShardPath = casShardPath(s.source.dir, committedRow.path);
+  await mkdir(path.dirname(tornShardPath), { recursive: true });
+  await writeFile(tornShardPath, "{corrupt", "utf8");
+
+  let promotions = 0;
+  await promoteAndReconcileMergedTarget({
+    promote: async () => {
+      promotions += 1;
+      return `copy-${promotions}`;
+    },
+    config: parseConfig({ memoryDir: s.source.dir, sharedNamespace: "shared" }),
+    getStorageRouter: () => s.router,
+    scopeProfileWritePlan: null,
+    sourceStorage: s.source,
+    sourceMemoryId: target.id,
+    mergedPromotion: payload,
+    normalize: (content) => content,
+  });
+  assert.equal(promotions, 0, "an unreadable standing receipt must not confirm the cached payload");
+});
+
+test("promoteAndReconcileMergedTarget: a genuinely absent receipt still confirms and promotes (#2813 P1 A)", async () => {
+  const s = await makeStorages();
+  const target = await s.source.writeMemory("fact", A_MERGED_BODY, { source: "test" });
+  const { payload } = await buildMergedTargetPromotionPayload(s.source, {
+    targetId: target.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  });
+  assert.ok(payload);
+  assert.equal(payload.committedRevision, undefined, "a pre-sidecar target promotes without a token");
+
+  let promotions = 0;
+  await promoteAndReconcileMergedTarget({
+    promote: async (promotionPayload) => {
+      promotions += 1;
+      assert.equal(promotionPayload.content, A_MERGED_BODY);
+      return `copy-${promotions}`;
+    },
+    config: parseConfig({ memoryDir: s.source.dir, sharedNamespace: "shared" }),
+    getStorageRouter: () => s.router,
+    scopeProfileWritePlan: null,
+    sourceStorage: s.source,
+    sourceMemoryId: target.id,
+    mergedPromotion: payload,
+    normalize: (content) => content,
+  });
+  assert.equal(promotions, 1, "absent-versus-absent confirms — pre-sidecar records keep their promotion semantics");
+});
+test("buildMergedTargetPromotionPayload and promotion refuse when interleaving writer updates metadata with same body (#2813 P1 B)", async () => {
+  const s = await makeStorages();
+  const target = await s.source.writeMemory("fact", PRE_MERGE_BODY, { source: "test", confidence: 0.5 });
+  await commitWriterMerge(s.source, target.id, A_MERGED_BODY);
+  const { payload } = await buildMergedTargetPromotionPayload(s.source, {
+    targetId: target.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  });
+  assert.ok(payload);
+  assert.ok(payload.committedRevision);
+  assert.ok(payload.committedDigest);
+
+  // Interleaving writer updates metadata with the SAME body/content:
+  assert.ok(await s.source.updateMemoryFrontmatter(target.id, { confidence: 0.95 }));
+
+  let promotions = 0;
+  await promoteAndReconcileMergedTarget({
+    promote: async () => {
+      promotions += 1;
+      return `copy-${promotions}`;
+    },
+    config: parseConfig({ memoryDir: s.source.dir, sharedNamespace: "shared" }),
+    getStorageRouter: () => s.router,
+    scopeProfileWritePlan: null,
+    sourceStorage: s.source,
+    sourceMemoryId: target.id,
+    mergedPromotion: payload,
+    normalize: (content) => content,
+  });
+  assert.equal(
+    promotions,
+    0,
+    "promotion must be abandoned when standing receipt digest/revision changes due to same-body metadata update",
+  );
+});
+
+test("buildMergedTargetPromotionPayload: unavailable snapshot digest refuses when a committed digest exists (#2813 P1)", async () => {
+  const s = await makeStorages();
+  const target = await s.source.writeMemory("fact", PRE_MERGE_BODY, { source: "test" });
+  await commitWriterMerge(s.source, target.id, A_MERGED_BODY);
+  const committedRow = await s.source.getMemoryByIdIncludingArchived(target.id);
+  assert.ok(committedRow);
+  const status = await s.source.readCasRevisionStatus(committedRow.path);
+  assert.equal(status.status, "present", "the merge minted a standing receipt");
+  assert.ok(
+    status.status === "present" && status.committedDigest,
+    "the standing receipt carries a committed digest",
+  );
+
+  s.source.readDurableFileDigest = async () => null;
+  const built = await buildMergedTargetPromotionPayload(s.source, {
+    targetId: target.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  });
+  assert.equal(built.payload, null, "an unreadable snapshot digest must refuse the promotion");
+  assert.equal(built.readFailed, true, "unavailable snapshot is unknown, not an absent revision");
+
+  const legacyStore = await makeStorages();
+  const fresh = await legacyStore.source.writeMemory("fact", A_MERGED_BODY, { source: "test" });
+  legacyStore.source.readDurableFileDigest = async () => null;
+  const legacy = await buildMergedTargetPromotionPayload(legacyStore.source, {
+    targetId: fresh.id,
+    mergedContent: A_MERGED_BODY,
+    provenancePatched: true,
+  });
+  assert.ok(legacy.payload, "a genuinely absent receipt still builds a payload");
+  assert.equal(legacy.readFailed, false, "missing snapshot must not be conflated with an absent revision");
+  assert.equal(legacy.payload.committedRevision, undefined);
+});

package/src/orchestration/extraction-persist-promotion.ts

@@ -22,7 +22,7 @@ import {
 } from "../capabilities.js";
 import type { MemoryFile, PluginConfig } from "../types.js";
 import type { ResolvedScopeProfilePlan } from "../namespaces/scope-profiles.js";
-import type { MergedTargetPromotionPayload } from "./semantic-merge-promotion-payload.js";
+import { readPromotionReceiptStatus, type MergedTargetPromotionPayload } from "./semantic-merge-promotion-payload.js";
 
 export const confidenceTierOrder = [
   "explicit",
@@ -361,9 +361,24 @@ export async function promoteAndReconcileMergedTarget(args: {
   sourceMemoryId: string;
   /** Null = payload builder refused (degraded merge / target replaced mid-flight). */
   mergedPromotion: MergedTargetPromotionPayload | null;
+  /** #2807 (finding 1): the builder's post-commit reread FAILED — the payload is unknown, not refused. Skips the destructive reconciliation. */
+  mergedPromotionReadFailed?: boolean;
   normalize: (content: string) => string;
   onReconciled?: () => void;
 }): Promise<void> {
+  // #2807 (finding 1): an unreadable payload is not a no-promotion
+  // verdict. Reconciling anyway rereads the record successfully a moment
+  // later and interprets the missing payload as "no promotion warranted" —
+  // retiring a concurrently published PRE-merge copy with no current-body
+  // replacement and removing an otherwise eligible memory from the
+  // shared/profile layer. Skip the destructive pass; the next merge
+  // retries promotion and reconciliation against a readable record.
+  if (args.mergedPromotion === null && args.mergedPromotionReadFailed === true) {
+    log.warn(
+      `persistExtraction: merged-target promotion reconciliation skipped for ${args.sourceMemoryId} — the committed record was unreadable at payload-build time, so no promotion outcome is confirmed`,
+    );
+    return;
+  }
   let promotedCopyId: string | undefined;
   if (args.mergedPromotion) {
     const payload = args.mergedPromotion;
@@ -373,14 +388,38 @@ export async function promoteAndReconcileMergedTarget(args: {
     if (
       !current ||
       inferMemoryStatus(current.frontmatter, current.path) !== "active" ||
-      current.content !== payload.content ||
-      (current.frontmatter.updated ?? undefined) !== (payload.committedRevision ?? undefined)
+      current.content !== payload.content
     ) {
       log.warn(
         `persistExtraction: merged-target promotion abandoned for ${args.sourceMemoryId} — the committed record advanced past the cached payload, so the newer writer's copy stands`,
       );
       return;
     }
+    // #2813 (P1 A, P1 B): confirm the cached payload against a TRUTHFUL receipt
+    // read and digest check. An unavailable sidecar or digest mismatch abandons the
+    // promotion — the previous undefined-vs-undefined comparison confirmed any
+    // payload whose receipt identity had become unreadable. A genuinely absent receipt
+    // still compares equal and promotes.
+    const standingReceipt = await readPromotionReceiptStatus(args.sourceStorage, current.path);
+    const standingDigest =
+      typeof args.sourceStorage.readDurableFileDigest === "function"
+        ? await args.sourceStorage.readDurableFileDigest(current.path).catch(() => null)
+        : null;
+    if (
+      !standingReceipt.available ||
+      (standingReceipt.revision ?? undefined) !== (payload.committedRevision ?? undefined) ||
+      (payload.committedDigest !== undefined &&
+        standingReceipt.committedDigest !== undefined &&
+        standingReceipt.committedDigest !== payload.committedDigest) ||
+      (payload.committedDigest !== undefined &&
+        standingDigest !== null &&
+        standingDigest !== payload.committedDigest)
+    ) {
+      log.warn(
+        `persistExtraction: merged-target promotion abandoned for ${args.sourceMemoryId} — the committed record's CAS receipt or digest ${standingReceipt.available ? "does not match the cached payload's" : "is unreadable"}, so the cached body is not confirmed`,
+      );
+      return;
+    }
     try {
       promotedCopyId = await args.promote(payload);
     } catch (err) {

package/src/orchestration/extraction-persist.ts

@@ -2554,14 +2554,14 @@ export class ExtractionPersistCoordinator {
         await anchorSnapshots.replace(targetStorage, semanticMerge.targetId, writeCategory, memoryPathById);
         // D + final round (A/B) + N+7 (A/B) + N+18 (B): with no promoted copies the create path's promotion must still run — fail-open, the merge stands — and its payload derives SOLELY from the re-read committed record (no field reads the incoming extraction; the null cases — replaced mid-flight, retired, degraded merge, or the isolated fail-open reread failure — are documented on buildMergedTargetPromotionPayload). After the current copy lands, any concurrently promoted PRE-merge copy is superseded. Promotion eligibility gates on the committed record's tier — the downgraded min(incoming, target) confidence where a lower incoming fact merged in.
         const mergedPromotion = await buildMergedTargetPromotionPayload(targetStorage, semanticMerge);
-        // Round N+10 (A): promotion AND reconciliation — including the no-promotion path, where a below-threshold downgrade or a degraded merge writes no replacement copy but a concurrently published PRE-merge copy must still retire. See promoteAndReconcileMergedTarget.
-        await promoteAndReconcileMergedTarget({ promote: (payload) => promoteMemoryToShared({ sourceStorage: targetStorage, ...payload }), config: this.deps.config, getStorageRouter: this.deps.getStorageRouter, scopeProfileWritePlan, sourceStorage: targetStorage, sourceMemoryId: semanticMerge.targetId, mergedPromotion, normalize: normalizeStoredHashSource, onReconciled: () => promotedCopyProbe.invalidate() });
+        // Round N+10 (A) + #2807 (finding 1): promotion AND reconciliation — including the no-promotion path, where a below-threshold downgrade or a degraded merge writes no replacement copy but a concurrently published PRE-merge copy must still retire. An UNREADABLE payload (readFailed) skips the destructive pass. See promoteAndReconcileMergedTarget.
+        await promoteAndReconcileMergedTarget({ promote: (payload) => promoteMemoryToShared({ sourceStorage: targetStorage, ...payload }), config: this.deps.config, getStorageRouter: this.deps.getStorageRouter, scopeProfileWritePlan, sourceStorage: targetStorage, sourceMemoryId: semanticMerge.targetId, mergedPromotion: mergedPromotion.payload, mergedPromotionReadFailed: mergedPromotion.readFailed, normalize: normalizeStoredHashSource, onReconciled: () => promotedCopyProbe.invalidate() });
         // Round N+7 (D): the merged body joins the INTERNAL temporal/tag index refresh (id-keyed, incremental); the PUBLIC persistedIds return stays new-fragment only. Round N+11 (B): the target is also persisted into the thread's DURABLE episode set via the same appendEpisodeIds path the create path uses — the batch-local adjacency list is not durable, so without this the target leaves the thread at the next extraction.
         trackPersistedId(targetStorage, semanticMerge.targetId, { includeReturnedIds: false });
         await persistMergedTargetThreadEpisode(this.deps.getThreading(), threadIdForExtraction, semanticMerge.targetId);
         // Finding B (round N+3): enqueue the surviving target so the end-of-batch harmonic pass covers the committed merged claims.
         if (harmonicConstructionEnabled) {
-          enqueueMergedTargetForHarmonicConstruction(harmonicFactsByStorage, targetStorage, harmonicFact, semanticMerge.targetId, semanticMerge.mergedContent, new Date(harmonicSourceInsertedAtBase + harmonicSourceOrder++).toISOString());
+          await enqueueMergedTargetForHarmonicConstruction(harmonicFactsByStorage, targetStorage, harmonicFact, semanticMerge.targetId, semanticMerge.mergedContent, new Date(harmonicSourceInsertedAtBase + harmonicSourceOrder++).toISOString());
         }
         // Round N+5 (A+B): create-path parity — the create path's graph-edge build and
         // behavior-signal ledger entry must also observe a committed merge.