@remnic/core 9.69.33 → 9.69.35

package/src/orchestration/semantic-merge-persist.ts

@@ -81,6 +81,7 @@ import type {
 } from "../types.js";
 import { normalizeConnectorScope } from "../dedup/connector-scope.js";
 import type { StorageManager } from "../index.js";
+import { casCommittedRevisionOf } from "../storage/deletion-revision-store.js";
 import type { ExtractionPersistDeps } from "./extraction-persist-deps.js";
 
 export type SemanticMergeCreateReason =
@@ -714,9 +715,7 @@ export async function applySemanticMergeAtPersist(
   // win rather than be overwritten from a stale body. The active-target check
   // above makes a tombstone block structurally impossible here.
   const nowIso = (options.now ? options.now() : new Date()).toISOString();
-  let contentCommitted = false;
-  // Captured so the success return can describe the COMMITTED frontmatter
-  // (the patch's appended sources) without widening the try's scope.
+  let casRevision: string | undefined; // #2813 (P1): OUR content CAS's receipt — feeds the patch stamp below and the catch's rollback comparison
   let mergePatch: MergeFrontmatterUpdate | undefined;
   try {
     mergePatch = buildMergeFrontmatterUpdate({
@@ -742,7 +741,7 @@ export async function applySemanticMergeAtPersist(
       );
       return { action: "created", reason: "target_changed" };
     }
-    contentCommitted = true;
+    casRevision = updated; // fix A: a successful CAS returns the revision it landed; a later rollback compares against it
     // The provenance patch must land on OUR merged body. An id-keyed patch
     // re-reads and stamps whatever the latest row holds, so a writer landing
     // after the content commit would receive this merge's provenance while
@@ -790,6 +789,8 @@ export async function applySemanticMergeAtPersist(
     const patched = await options.storage.writeMemoryFrontmatterIfUnchanged(
       merged,
       {
+        // #2807: business/event time, exactly what an ordinary write would
+        // stamp — receipt identity is the sidecar token storage mints.
         updated: mergePatch.updated,
         derived_via: mergePatch.derived_via,
         reinforcement_count: mergePatch.reinforcement_count,
@@ -831,10 +832,100 @@ export async function applySemanticMergeAtPersist(
     // leave those claims without the incoming provenance, so `created` is
     // reachable only once storage has been re-read and confirms the target no
     // longer holds this merge's unprovenanced body.
-    if (
-      contentCommitted &&
-      !(await revertMergedContent(options.storage, target, committedContent))
-    ) {
+    //
+    // #2807 (finding 2): the flag alone cannot distinguish a CAS that threw
+    // BEFORE changing the target (lock acquisition, transient I/O) from one
+    // that threw AFTER the write committed — and both left the staged
+    // snapshot `pending` forever, which pruneExcessVersions deliberately
+    // excludes, so repeated contention grew history past
+    // maxVersionsPerPage with snapshots of bodies storage never (or no
+    // longer) holds. Reread the target instead of trusting the flag.
+    // #2813 (P1): ownership comes from the CAS's own commit identity —
+    // storage stamps the thrown error with the revision its write landed
+    // (markCasCommittedRevision) — NEVER from body equality: a concurrent
+    // writer's identical deterministic merge is byte-for-byte this writer's
+    // merged body, so content comparison would misattribute their commit,
+    // and the revert below would CAS-replace their valid merge with the
+    // pre-merge body while their patched provenance stood.
+    //   - receipt present → OUR write landed (throw after commit) → revert,
+    //     else degraded success — and the rollback verifies the standing
+    //     record still carries the receipt's revision (#2813 P1, round 2);
+    //     clean up OUR staged duplicate, leave theirs untouched, report the
+    //     degraded merged outcome (never `created`: storage already holds
+    //     these claims);
+    //   - no receipt, pre-merge body → the write never landed → the snapshot
+    //     is a duplicate and goes, `created` is honest;
+    //   - no receipt, replaced by another writer or unreadable →
+    //     unverifiable → keep-side, the snapshot stays.
+    const committedRevision = casCommittedRevisionOf(err) ?? casRevision; // fix A: patch-path failures carry no error receipt — fall back to the success receipt
+    const landed = committedRevision !== undefined;
+    if (!landed) {
+      let observed: MemoryFile | null = null;
+      try {
+        observed = await readTargetSnapshot(options.storage, target);
+      } catch {
+        /* unreadable → keep-side below */
+      }
+      if (observed?.content === committedContent) {
+        await discardMergedTargetSnapshot(
+          target.path,
+          versioning,
+          options.storage.dir,
+          decision.targetId,
+          versionId,
+        );
+        await repairIndexes(committedMergedFactHash(deps, options.category, committedContent));
+        log.warn(
+          `semantic-merge: update failed for ${decision.targetId} (the compare-and-swap threw before this writer's mutation; the standing merged body is another writer's identical commit — snapshot ${versionId} discarded, the concurrent commit left untouched): ${detail}`,
+        );
+        return {
+          action: "merged",
+          targetId: decision.targetId,
+          mergedContent: committedContent,
+          provenancePatched: false,
+        };
+      } else if (observed?.content === target.content) {
+        await discardMergedTargetSnapshot(
+          target.path,
+          versioning,
+          options.storage.dir,
+          decision.targetId,
+          versionId,
+        );
+        log.warn(
+          `semantic-merge: update failed for ${decision.targetId} (the compare-and-swap threw before changing the target; snapshot ${versionId} discarded — the reread holds the pre-merge body): ${detail}`,
+        );
+        return { action: "created", reason: "update_failed" };
+      }
+    }
+    // #2813 (P1, round 2): the receipt was used only as a boolean — never
+    // compared with the standing record — so writer B's identical commit
+    // after our lock released was reverted as ours. Equal revision → ours,
+    // safe to roll back; advanced → B's — the same handling as the no-receipt
+    // other-writer branch above; never revert theirs.
+    const revert = landed
+      ? await revertMergedContent(options.storage, target, committedContent, committedRevision)
+      : undefined;
+    if (revert === "superseded") {
+      await discardMergedTargetSnapshot(
+        target.path,
+        versioning,
+        options.storage.dir,
+        decision.targetId,
+        versionId,
+      );
+      await repairIndexes(committedMergedFactHash(deps, options.category, committedContent));
+      log.warn(
+        `semantic-merge: update failed for ${decision.targetId} (the standing merged body advanced past this writer's commit receipt — another writer's identical commit stands; snapshot ${versionId} discarded, the concurrent commit left untouched): ${detail}`,
+      );
+      return {
+        action: "merged",
+        targetId: decision.targetId,
+        mergedContent: committedContent,
+        provenancePatched: false,
+      };
+    }
+    if (landed && revert !== "reverted") {
       log.error(
         `semantic-merge: ${decision.targetId} holds merged content without provenance metadata and the rollback failed (${detail}); snapshot ${versionId} holds the pre-merge state — recover with revertToVersion. Not creating a duplicate fact.`,
       );
@@ -861,10 +952,9 @@ export async function applySemanticMergeAtPersist(
     // Round N+13 (B): with the content committed and the revert above
     // confirmed, storage holds the pre-merge body, so the staged snapshot of
     // that same body is a duplicate and goes. (The degraded-success branch
-    // above keeps it as the recovery point. A throw BEFORE the content
-    // commit leaves storage state unverifiable — keep-side, the snapshot
-    // stays.)
-    if (contentCommitted) {
+    // above keeps it as the recovery point. An unverifiable throw — target
+    // replaced or unreadable — is keep-side, the snapshot stays.)
+    if (landed) {
       await discardMergedTargetSnapshot(
         target.path,
         versioning,
@@ -874,7 +964,7 @@ export async function applySemanticMergeAtPersist(
       );
     }
     log.warn(
-      `semantic-merge: update failed for ${decision.targetId}${contentCommitted ? ` (content rolled back; snapshot ${versionId} rolled back out of history)` : ` (snapshot ${versionId} staged)`}: ${detail}`,
+      `semantic-merge: update failed for ${decision.targetId}${landed ? ` (content rolled back; snapshot ${versionId} rolled back out of history)` : ` (snapshot ${versionId} staged)`}: ${detail}`,
     );
     return { action: "created", reason: "update_failed" };
   }
@@ -1024,6 +1114,10 @@ export async function runMergedTargetPostEffects(
     episodes.push(merge.targetId);
   }
   if (!input.graphCaps.multiGraphMemory) return signals;
+  // #2807 (finding 4): whether the remove-and-rebuild below finalized. A
+  // false or thrown exit means a ROLLBACK ran (or nothing mutated), and the
+  // owning index's edge cache must be invalidated after the catch.
+  let rewriteInstalled = false;
   try {
     const committed = await storage.getMemoryByIdIncludingArchived(merge.targetId);
     if (!committed || committed.content !== merge.mergedContent) return signals;
@@ -1066,11 +1160,12 @@ export async function runMergedTargetPostEffects(
     // Round N+12 (C): the remove-and-rebuild is revision-guarded end to end
     // (see rewriteMergedTargetGraphEdges) — a writer committing a newer body
     // mid-rebuild aborts this install instead of clobbering its edges.
-    const installed = await rewriteMergedTargetGraphEdges(storage, {
+    rewriteInstalled = await rewriteMergedTargetGraphEdges(storage, {
       targetId: merge.targetId,
       memoryRelPath,
       mergedContent: merge.mergedContent,
-      revisionChecked: committed.frontmatter.updated,
+      // #2807: the dedicated CAS revision token, not public `updated`.
+      revisionChecked: await storage.readCasRevision(committed.path),
       rewriteTypes,
       build: () =>
         deps.buildGraphEdge(
@@ -1087,9 +1182,19 @@ export async function runMergedTargetPostEffects(
           input.graphCaps,
         ),
     });
-    if (installed) input.graphContext.previousPersistedRelPath = memoryRelPath;
+    if (rewriteInstalled) input.graphContext.previousPersistedRelPath = memoryRelPath;
   } catch {
     /* fail-open: the committed merge stands; the create path's graph block fails open too */
   }
+  if (!rewriteInstalled) {
+    // #2807 (finding 4): the rewrite rolled back — superseded revision, a
+    // failed build, or a pre-rewrite read error — after the build's
+    // onMemoryWritten had already pushed this writer's appended rows into
+    // the owning GraphIndex's warm edge cache. The rollback repaired only
+    // the JSONL files; without invalidating the cache, spreadingActivation
+    // kept serving the rolled-back edges for the full five-minute TTL.
+    // Invalidation is idempotent and cheap when nothing was cached.
+    deps.invalidateGraphEdgeCache?.(storage);
+  }
   return signals;
 }

package/src/orchestration/semantic-merge-promotion-payload.ts

@@ -65,37 +65,60 @@ export interface MergedTargetPromotionPayload {
   toolScoped?: true;
   sourceConnector?: string;
   /**
-   * The committed record's `updated` revision at payload-build time (round
-   * N+15 A). The payload is a CACHE: before promoting it, the caller re-reads
-   * the record and confirms the revision AND body still match — a writer that
-   * merged the same target again in between makes this payload stale, and a
-   * stale body must never be promoted or become the reconciliation canon.
+   * The committed record's CAS revision token at payload-build time (round
+   * N+15 A, #2807) — the dedicated sidecar identity, never public
+   * `frontmatter.updated`. The payload is a CACHE: before promoting it, the
+   * caller re-reads the record and confirms the token AND body still match —
+   * a writer that merged the same target again in between makes this
+   * payload stale, and a stale body must never be promoted or become the
+   * reconciliation canon.
    */
   committedRevision?: string;
+  /** #2813 (P1 B): sha256 hex digest of the durable memory file when committed. */
+  committedDigest?: string;
+}
+
+/**
+ * #2807 (finding 1): the builder's null has two meanings the caller must
+ * not conflate. A REFUSED payload (degraded merge, target replaced
+ * mid-flight, retired record) means "no promotion is warranted" — the
+ * caller's destructive reconciliation may proceed on that conclusion. A
+ * payload that is UNKNOWN because the post-commit reread itself failed
+ * means no such conclusion was reached, so `readFailed` preserves the
+ * failure reason across the call boundary.
+ */
+export interface MergedTargetPromotionResult {
+  payload: MergedTargetPromotionPayload | null;
+  /** True when `payload` is null because the reread threw OR the CAS receipt
+   * sidecar was unreadable (#2813 P1 A) — the payload is unknown, not refused. */
+  readFailed: boolean;
 }
 
 /**
  * Re-read the committed merge target (cold-aware id lookup — the same
  * resolver the merge itself used) and derive the promotion payload solely
- * from that record. Returns null when the record can no longer ground the
- * promotion (deleted, its body was replaced after the merge committed, or a
- * concurrent lifecycle operation archived/superseded it between the merge
- * commit and this reread — promoting from a retired record would resurrect
- * content that operation retired, final round B), and null for a degraded
- * merge whose provenance patch never landed (round N+7 A) — the gate every
- * trust-elevating consumer routes through; callers then skip the promotion
- * fail-open — the merge itself stands. Round N+18 (B): the reread itself is
- * isolated fail-open — a locked secure store or a corpus read I/O error
- * resolves to null with a logged warn rather than a rejection, because the
- * merge has already committed and the hash-index repair makes any retry
- * dedupe against the committed body; an uncaught throw here would strand
- * every remaining durable effect (thread episode, temporal/tag refresh,
- * harmonic construction, graph rebuild, behavior signals, artifact write).
+ * from that record. Returns a null payload when the record can no longer
+ * ground the promotion (deleted, its body was replaced after the merge
+ * committed, or a concurrent lifecycle operation archived/superseded it
+ * between the merge commit and this reread — promoting from a retired
+ * record would resurrect content that operation retired, final round B),
+ * and null for a degraded merge whose provenance patch never landed (round
+ * N+7 A) — the gate every trust-elevating consumer routes through; callers
+ * then skip the promotion fail-open — the merge itself stands. Round N+18
+ * (B): the reread itself is isolated fail-open — a locked secure store or
+ * a corpus read I/O error resolves to a null payload with `readFailed:
+ * true` and a logged warn rather than a rejection, because the merge has
+ * already committed and the hash-index repair makes any retry dedupe
+ * against the committed body; an uncaught throw here would strand every
+ * remaining durable effect (thread episode, temporal/tag refresh, harmonic
+ * construction, graph rebuild, behavior signals, artifact write). #2807:
+ * the failure reason rides out on the result so reconciliation can tell an
+ * unknown payload from a refused one.
  */
 export async function buildMergedTargetPromotionPayload(
   storage: StorageManager,
   merge: { targetId: string; mergedContent: string; provenancePatched: boolean },
-): Promise<MergedTargetPromotionPayload | null> {
+): Promise<MergedTargetPromotionResult> {
   // Round N+7 (A): a degraded merge's record still holds its pre-merge
   // confidence, provenance, sources, and hash — a copy built off it would
   // publish incoming claims under that stronger metadata. No promotion may
@@ -104,7 +127,7 @@ export async function buildMergedTargetPromotionPayload(
     log.warn(
       `semantic-merge: skipping merged-target promotion for ${merge.targetId} — provenance patch did not land; the record still holds pre-merge trust metadata`,
     );
-    return null;
+    return { payload: null, readFailed: false };
   }
   let committed: MemoryFile | null;
   try {
@@ -114,48 +137,104 @@ export async function buildMergedTargetPromotionPayload(
     log.warn(
       `semantic-merge: merged-target promotion reread failed for ${merge.targetId} (non-fatal; promotion skipped, the committed merge stands): ${err instanceof Error ? err.message : String(err)}`,
     );
-    return null;
+    return { payload: null, readFailed: true };
+  }
+  if (!committed || committed.content !== merge.mergedContent) {
+    return { payload: null, readFailed: false };
   }
-  if (!committed || committed.content !== merge.mergedContent) return null;
   // Final round (B): the including-archived lookup still returns a retired
   // record, and body equality alone cannot tell a concurrent archive or
   // supersede apart from a live target. Recompute the status from the
   // committed record itself and refuse to promote unless it is still
   // active.
   if (inferMemoryStatus(committed.frontmatter, committed.path) !== "active") {
-    return null;
+    return { payload: null, readFailed: false };
   }
   const fm = committed.frontmatter;
+  // #2813 (P1 B): promotion reads record metadata and digest, then receipt.
+  // Compare record snapshot digest to receipt's committed digest to catch
+  // interleaving metadata writers with same body/new metadata.
+  const snapshotDigest =
+    typeof storage.readDurableFileDigest === "function"
+      ? await storage.readDurableFileDigest(committed.path).catch(() => null)
+      : null;
+  const receipt = await readPromotionReceiptStatus(storage, committed.path);
+  if (!receipt.available) {
+    log.warn(
+      `semantic-merge: merged-target promotion refused for ${merge.targetId} — the CAS revision receipt for ${committed.path} is unavailable (${receipt.reason}); promotion and reconciliation retry on the next merge`,
+    );
+    return { payload: null, readFailed: true };
+  }
+  if (receipt.committedDigest !== undefined && snapshotDigest !== receipt.committedDigest) {
+    log.warn(
+      snapshotDigest == null
+        ? `semantic-merge: merged-target promotion refused for ${merge.targetId} — the record snapshot digest is unavailable while the CAS receipt carries committed digest ${receipt.committedDigest}; promotion and reconciliation retry on the next merge`
+        : `semantic-merge: merged-target promotion refused for ${merge.targetId} — record snapshot digest (${snapshotDigest}) does not match committed receipt digest (${receipt.committedDigest}); record metadata was mutated concurrently`,
+    );
+    return { payload: null, readFailed: true };
+  }
   return {
-    category: fm.category,
-    content: committed.content,
-    confidence: fm.confidence,
-    tags: fm.tags ?? [],
-    sourceMemoryId: fm.id,
-    origin: parseOriginClass(fm.origin),
-    source: fm.source,
-    ...(fm.entityRef !== undefined ? { entityRef: fm.entityRef } : {}),
-    ...(fm.structuredAttributes !== undefined
-      ? { structuredAttributes: { ...fm.structuredAttributes } }
-      : {}),
-    ...(fm.importance !== undefined ? { importance: fm.importance } : {}),
-    ...(fm.intentGoal !== undefined ? { intentGoal: fm.intentGoal } : {}),
-    ...(fm.intentActionType !== undefined ? { intentActionType: fm.intentActionType } : {}),
-    ...(fm.intentEntityTypes !== undefined
-      ? { intentEntityTypes: [...fm.intentEntityTypes] }
-      : {}),
-    ...(fm.memoryKind !== undefined ? { memoryKind: fm.memoryKind } : {}),
-    ...(fm.valid_at !== undefined ? { validAt: fm.valid_at } : {}),
-    ...(fm.invalid_at !== undefined ? { invalidAt: fm.invalid_at } : {}),
-    ...(fm.observedAt !== undefined ? { observedAt: fm.observedAt } : {}),
-    ...(fm.eventTimeSource !== undefined ? { eventTimeSource: fm.eventTimeSource } : {}),
-    ...(fm.sources && fm.sources.length > 0
-      ? { sources: fm.sources.map((source) => ({ ...source })) }
-      : {}),
-    ...(fm.provenance !== undefined ? { provenance: fm.provenance } : {}),
-    ...(fm.subject !== undefined ? { subject: fm.subject } : {}),
-    ...(fm.toolScoped === true ? { toolScoped: true as const } : {}),
-    ...(fm.sourceConnector !== undefined ? { sourceConnector: fm.sourceConnector } : {}),
-    ...(fm.updated !== undefined ? { committedRevision: fm.updated } : {}),
+    payload: {
+      category: fm.category,
+      content: committed.content,
+      confidence: fm.confidence,
+      tags: fm.tags ?? [],
+      sourceMemoryId: fm.id,
+      origin: parseOriginClass(fm.origin),
+      source: fm.source,
+      ...(fm.entityRef !== undefined ? { entityRef: fm.entityRef } : {}),
+      ...(fm.structuredAttributes !== undefined
+        ? { structuredAttributes: { ...fm.structuredAttributes } }
+        : {}),
+      ...(fm.importance !== undefined ? { importance: fm.importance } : {}),
+      ...(fm.intentGoal !== undefined ? { intentGoal: fm.intentGoal } : {}),
+      ...(fm.intentActionType !== undefined ? { intentActionType: fm.intentActionType } : {}),
+      ...(fm.intentEntityTypes !== undefined
+        ? { intentEntityTypes: [...fm.intentEntityTypes] }
+        : {}),
+      ...(fm.memoryKind !== undefined ? { memoryKind: fm.memoryKind } : {}),
+      ...(fm.valid_at !== undefined ? { validAt: fm.valid_at } : {}),
+      ...(fm.invalid_at !== undefined ? { invalidAt: fm.invalid_at } : {}),
+      ...(fm.observedAt !== undefined ? { observedAt: fm.observedAt } : {}),
+      ...(fm.eventTimeSource !== undefined ? { eventTimeSource: fm.eventTimeSource } : {}),
+      ...(fm.sources && fm.sources.length > 0
+        ? { sources: fm.sources.map((source) => ({ ...source })) }
+        : {}),
+      ...(fm.provenance !== undefined ? { provenance: fm.provenance } : {}),
+      ...(fm.subject !== undefined ? { subject: fm.subject } : {}),
+      ...(fm.toolScoped === true ? { toolScoped: true as const } : {}),
+      ...(fm.sourceConnector !== undefined ? { sourceConnector: fm.sourceConnector } : {}),
+      ...(receipt.revision !== undefined ? { committedRevision: receipt.revision } : {}),
+      ...(receipt.committedDigest !== undefined
+        ? { committedDigest: receipt.committedDigest }
+        : snapshotDigest !== null
+          ? { committedDigest: snapshotDigest }
+          : {}),
+    },
+    readFailed: false,
   };
 }
+
+/** #2813 (P1 A): read the standing receipt as a three-way truth for the
+ * promotion path. Present and absent are usable identities (absent = the
+ * target predates the sidecar); unavailable is not. A storage whose status
+ * probe itself throws reads as unavailable — never as absence. */
+export async function readPromotionReceiptStatus(
+  storage: Pick<StorageManager, "readCasRevisionStatus">,
+  filePath: string,
+): Promise<
+  | { available: true; revision: string | undefined; committedDigest?: string }
+  | { available: false; reason: string }
+> {
+  try {
+    const status = await storage.readCasRevisionStatus(filePath);
+    if (status.status === "unavailable") return { available: false, reason: status.reason };
+    return {
+      available: true,
+      revision: status.status === "present" ? status.revision : undefined,
+      committedDigest: status.status === "present" ? status.committedDigest : undefined,
+    };
+  } catch (err) {
+    return { available: false, reason: err instanceof Error ? err.message : String(err) };
+  }
+}

package/src/orchestrator.ts

@@ -857,6 +857,7 @@ export class Orchestrator {
         indexPersistedMemory: (storage, memoryId) => this.indexPersistedMemory(storage, memoryId),
         buildGraphEdge: (storage, memoryRelPath, entityRef, memoryId, factContent, allMemsForGraph, memoryPathById, threadIdForEdge, threadEpisodeIdsForGraph, fallbackCausalPredecessor, graphCaps) =>
           this.buildGraphEdge(storage, memoryRelPath, entityRef, memoryId, factContent, allMemsForGraph, memoryPathById, threadIdForEdge, threadEpisodeIdsForGraph, fallbackCausalPredecessor, graphCaps),
+        invalidateGraphEdgeCache: (storage) => this.graphIndexFor(storage).invalidateEdgeCache(),
         updateTemporalTagIndexes: (storage, persistedIds) =>
           this.updateTemporalTagIndexes(storage, persistedIds),
       });
@@ -3227,32 +3228,21 @@ export class Orchestrator {
     );
   }
 
+  /** Delegation wrapper so the persist wiring and root-test stubs route through `this` (#2813 CI-0). */
   private async buildGraphEdge(
     storage: StorageManager,
     memoryRelPath: string,
     entityRef: string | undefined,
     memoryId: string,
     factContent: string,
-    allMemsForGraph: import("./types.js").MemoryFile[] | null | undefined,
+    allMemsForGraph: MemoryFile[] | null | undefined,
     memoryPathById: Map<string, string>,
     threadIdForEdge: string | undefined,
     threadEpisodeIdsForGraph: string[] | undefined,
     fallbackCausalPredecessor: string | undefined,
     graphCaps: GraphConstructionCapabilitySet = resolveGraphConstructionCapabilities(this.config),
   ): Promise<GraphEdge[]> {
-    return this.persistenceIndexCoordinator.buildGraphEdge(
-      storage,
-      memoryRelPath,
-      entityRef,
-      memoryId,
-      factContent,
-      allMemsForGraph,
-      memoryPathById,
-      threadIdForEdge,
-      threadEpisodeIdsForGraph,
-      fallbackCausalPredecessor,
-      graphCaps,
-    );
+    return this.persistenceIndexCoordinator.buildGraphEdge(storage, memoryRelPath, entityRef, memoryId, factContent, allMemsForGraph, memoryPathById, threadIdForEdge, threadEpisodeIdsForGraph, fallbackCausalPredecessor, graphCaps);
   }
 
   private graphIndexFor(storage: StorageManager): GraphIndex {
@@ -3423,27 +3413,9 @@ export class Orchestrator {
     );
   }
 
-  private publishRecallResults(options: {
-    title: string;
-    results: QmdSearchResult[];
-    sectionBuckets: RecallSectionBuckets;
-    retrievalQuery: string;
-    sessionKey: string | undefined;
-    identityInjection?: {
-      mode: IdentityInjectionMode | "none";
-      injectedChars: number;
-      truncated: boolean;
-    };
-    /**
-     * Issue #1577 — per-recall trust map. When present, quarantined items
-     * are filtered from injection on EVERY recall path (hot QMD, embedding
-     * fallback, cold archive, recent) so a faithfulness-contradicted memory
-     * cannot sneak in via a branch that bypasses trust scoring (review:
-     * fallback paths bypass trust). The map is also threaded to
-     * formatQmdResults for the epistemic hedge.
-     */
-    trustByPath?: Map<string, TrustStageResultItem> | null;
-  }): void {
+  private publishRecallResults(
+    options: Parameters<RecallEntryCoordinator["publishRecallResults"]>[0],
+  ): void {
     return (this.recallEntryCoordinator ?? new RecallEntryCoordinator(
       selfDeps<ConstructorParameters<typeof RecallEntryCoordinator>[0]>(this),
     )).publishRecallResults(