@remnic/core 9.69.55 → 9.69.57

package/dist/storage-CMm-3aD3.d.ts

@@ -1,2421 +0,0 @@
-import { M as MemoryFile, bd as FusedWearableConversation, bl as FusedDayMeta, bm as FusedDayFile, b1 as MeetingRecord, bn as MeetingDetectionSource, b0 as FusedMeeting, m as MemoryFrontmatter, bo as EntityTimelineEntry, as as EntityStructuredSection, E as EntityFile, P as PluginConfig, x as MemoryStatus, u as MemoryCategory, aB as ImportanceScore, bp as MemoryLink, F as FaithfulnessFrontmatter, U as ProvenanceSource, N as MemorySubject, bq as BufferState, aK as MetaState, an as MemoryActionEvent, K as MemoryLifecycleEvent, ae as BufferSurpriseEvent, ad as BehaviorSignalEvent, ao as CompressionGuidelineOptimizerState, br as FileHygieneConfig, bs as EntityRelationship, bt as EntityActivityEntry, bu as AccessTrackingEntry, J as MemoryProjectionCurrentState, bv as MemorySummary, aO as TopicScore } from './types-Du6VdoAg.js';
-import { CorpusReadOptions } from './corpus-read-cancellation.js';
-import { ArtifactSearchOptions } from './artifact-search.js';
-import { ContextTransformTelemetryRecord } from './active-context-transform.js';
-import './entity-id-normalization.js';
-import { VersioningConfig } from './page-versioning.js';
-import { ConsolidationOperator } from './consolidation-operator.js';
-import { withHeldFileLock } from './utils/serialize-mutations.js';
-import { ProjectedMemoryBrowseOptions, ProjectedMemoryBrowsePage, readProjectedGovernanceRecord } from './memory-projection-store.js';
-import { SealedMemoryEnvelope } from './write-envelope.js';
-import './structured-attributes.js';
-import { ContinuityIncidentOpenInput, ContinuityIncidentRecord, ContinuityIncidentCloseInput, ContinuityImprovementLoop, ContinuityLoopUpsertInput, ContinuityLoopReviewInput } from './types-continuity.js';
-
-/** #2813 (P1 A): truthful outcome of a standing-receipt read.
- * - `present` — the target's standing receipt token.
- * - `absent` — no receipt was ever minted (a pre-sidecar legacy record, or
- *   a fresh target); `undefined` semantics stay correct for those.
- * - `unavailable` — the sidecar could not be read (unreadable, unsafe, or
- *   PENDING finalization), so receipt identity is UNKNOWN. The fail-open
- *   `readRevision` collapses this into `undefined`; callers that transact
- *   on receipt identity MUST refuse instead. */
-type CasRevisionReadStatus = {
-    status: "present";
-    revision: string;
-    committedDigest?: string;
-    committedSemanticFingerprint?: string;
-} | {
-    status: "absent";
-} | {
-    status: "unavailable";
-    reason: string;
-};
-/** #2813 (P1 C): a write-ahead receipt transaction. `pendingRevision` is a
- * RESERVATION, never ownership: no reader may attribute the record from it
- * while the marker is pending. `commit` publishes the COMMITTED receipt
- * after the durable memory write lands; `abort` discards the reservation
- * (restoring the previous standing token) when the write failed. If
- * `commit` itself fails after the write, the pending marker REMAINS so
- * readers report recovery-needed and promotion/rollback refuse until
- * {@link CasRevisionStore.reconcilePendingRevision} runs with the known
- * write outcome or {@link CasRevisionStore.recoverPendingRevision} decides
- * from the recorded evidence (#2807). */
-interface CasRevisionTransaction {
-    readonly pendingRevision: string;
-    /** #2807: record the durable file's post-write fingerprint in the
-     * PENDING marker — the crash evidence recovery compares. Call immediately
-     * after the durable write lands, before `commit`. */
-    writeLanded(): Promise<void>;
-    commit(): Promise<void>;
-    abort(): Promise<void>;
-}
-
-interface WindowedMemoryReadOptions {
-    maxMemories?: number;
-    batchSize?: number;
-    updatedAfter?: Date;
-    /** Require candidate paths so malformed files can be reported by governance. */
-    includeMalformedPaths?: boolean;
-}
-interface WindowedMemoryReadResult {
-    memories: MemoryFile[];
-    filePaths: string[];
-}
-
-/** Result of a pre-snapshot lifecycle drain (#2033): `folded` is true when spill
- *  rows were committed to the active ledger; `pendingDeferred` is true when
- *  durable spill rows STILL remain in the offline-sync-EXCLUDED pending queue
- *  after the attempt (the ledger lock was held by a peer, or a spill could not
- *  be claimed). A caller MUST NOT report a clean snapshot while `pendingDeferred`
- *  is true — those append-only rows would be silently omitted. */
-interface DrainPendingLifecycleForSyncResult {
-    folded: boolean;
-    pendingDeferred: boolean;
-}
-
-/**
- * Wearable cross-source fusion — derived-day file serialization.
- *
- * One derived file per fused day, stored ALONGSIDE raw source transcripts
- * (under the wearables tree) but never overwriting them. Format mirrors
- * the day-transcript convention: YAML frontmatter (`kind:
- * wearable-fusion`) + a JSON body carrying the structured
- * `FusedWearableConversation[]`. The frontmatter `contentHash` is the
- * idempotency key derived from inputs plus the effective fusion config,
- * so an unchanged re-run (same inputs AND config) produces a
- * byte-identical file.
- */
-
-declare const FUSION_KIND: "wearable-fusion";
-/** Hash the canonical JSON body for idempotent skip-unchanged checks. */
-declare function hashFusionBody(conversations: readonly FusedWearableConversation[]): string;
-declare function composeFusionDayMeta(date: string, conversations: readonly FusedWearableConversation[], sources: readonly string[], contentHash: string, fusedAt: string): FusedDayMeta;
-/** Serialize meta + conversations into the persisted file format. */
-declare function serializeFusionDay(meta: FusedDayMeta, conversations: readonly FusedWearableConversation[]): string;
-/**
- * Parse a persisted fused-day file. Returns null when the content does
- * not look like a fusion artifact (wrong kind / missing frontmatter) so
- * callers can distinguish "not fused" from a malformed file. A non-null
- * result carries `parseOk`: false when the JSON body failed to parse, was
- * not an array, or held a malformed element (conversations is empty in
- * that case), true for a well-formed (incl. legitimately-empty `[]`)
- * body — so the skip-unchanged path can force a self-repair rewrite
- * regardless of the recomputed conversation count or body hash.
- */
-declare function parseFusionDay(raw: string): FusedDayFile | null;
-/**
- * Encrypted-at-rest + atomic file IO the fusion artifact store needs.
- * Satisfied by StorageManager (which owns the secure-store key + atomic
- * write path) and injected so this module performs NO direct fs — the
- * derived files inherit the same encrypted-at-rest + atomic-write
- * semantics as raw day transcripts without this module knowing the key.
- */
-interface FusionFileIo {
-    writeFile(filePath: string, content: string): Promise<void>;
-    /** Read a file; rejects with ENOENT when it is absent. */
-    readFile(filePath: string): Promise<string>;
-    /** Directory entries; rejects with ENOENT when the directory is absent. */
-    readDir(dirPath: string): Promise<string[]>;
-    /** Remove a file; rejects with ENOENT when it is absent. */
-    deleteFile(filePath: string): Promise<void>;
-    /**
-     * Resolve a path through symlinks (node:fs/promises realpath); rejects
-     * with ENOENT when the path is absent. Used by the symlink-containment
-     * guard so a symlinked `_fusion` dir (or a symlinked wearables root)
-     * that resolves outside the memory dir is rejected before any
-     * read/write/delete (AGENTS.md #3).
-     */
-    realpath(filePath: string): Promise<string>;
-    /**
-     * Stat a path WITHOUT following a trailing symlink
-     * (node:fs/promises lstat); rejects with ENOENT when the path is
-     * absent. Used to detect a pre-existing symlink at the fusion
-     * artifact directory itself, which is rejected even when its
-     * target resolves inside the memory dir (issue #1849).
-     */
-    lstat(filePath: string): Promise<{
-        isSymbolicLink: boolean;
-    }>;
-}
-/**
- * Owns the derived fused-day artifact files under
- * `<wearablesDir>/_fusion/<YYYY-MM-DD>.md`. Path construction, date
- * validation, and newest-first listing live here (relocated out of the
- * root storage module — issue #1810 ratchet); the bytes flow through the
- * injected secure IO.
- */
-declare class FusionArtifactStore {
-    private readonly wearablesDir;
-    private readonly memoryDir;
-    private readonly io;
-    constructor(wearablesDir: string, memoryDir: string, io: FusionFileIo);
-    fusedDayPath(date: string): string;
-    writeFusedDay(date: string, serialized: string): Promise<void>;
-    /** Read a stored fused-day artifact; null when absent. */
-    readFusedDay(date: string): Promise<string | null>;
-    /**
-     * Remove a stored fused-day artifact. Idempotent: a no-op when the
-     * artifact is already absent. Used to clear a now-stale derived file
-     * before a fusion run that deliberately refuses to fuse (e.g. a day
-     * whose sources later conflict on timezone) so fusedConversations()
-     * does not keep serving a stale view (issue #1849).
-     */
-    deleteFusedDay(date: string): Promise<void>;
-    /** List dates with stored fused artifacts, newest first. */
-    listFusedDays(): Promise<string[]>;
-    /**
-     * Reject a symlinked/traversing fusion artifact path before any IO. The
-     * fusion dir (`<wearablesDir>/_fusion`) and its parents are followed
-     * directly by the secure IO; a symlink placed there (attacker-writable
-     * or a malformed memory dir) would otherwise be followed and
-     * read/write/delete outside the allowed root (AGENTS.md pattern #3).
-     *
-     * Containment is anchored to the real MEMORY-DIR root, not the
-     * wearables dir, AND the wearables root is checked explicitly: if
-     * `wearablesDir` itself is a symlink that resolves outside memoryDir, a
-     * leaf candidate like `<wearablesDir>/_fusion/<date>.md` may not yet
-     * exist (so its realpath ENOENT-skips) and the write would silently
-     * create the file inside the symlinked escape target. Checking
-     * `wearablesDir` itself — which resolves through the symlink when it
-     * exists — closes that gap, while the per-leaf checks catch a nested
-     * `_fusion` or per-file symlink. Absent paths are allowed (a fresh
-     * write creates them lexically under the root; only a path that
-     * resolves to an existing target can redirect IO). Mirrors
-     * `assertPathInsideRoot` in the storage walkers.
-     */
-    private assertPathContained;
-    /**
-     * Refuse a pre-existing symbolic link at the `<wearablesDir>/_fusion`
-     * directory. Unlike `assertNoEscape` (which follows the link and only
-     * rejects when the target lands outside the memory dir), this catches a
-     * fusion root that aliases an in-bounds path — e.g. a `_fusion` link
-     * pointed at a raw source transcript — so fusion IO never writes
-     * through it and overwrites the aliased file. Absent dirs are allowed
-     * (a fresh write creates a real directory lexically under the root).
-     */
-    private assertFusionDirNotSymlinked;
-    /**
-     * Refuse a candidate whose realpath escapes the memory root. Absent
-     * candidates are allowed: a missing path cannot yet redirect IO, and
-     * the secure write creates it lexically under the root.
-     */
-    private assertNoEscape;
-}
-
-/**
- * Meeting record composition, serialization, and the on-disk store (#1900).
- *
- * One markdown file per meeting under `<memoryDir>/meetings/<YYYY-MM-DD>/<id>.md`
- * with YAML frontmatter. Placement mirrors the wearables day-store rationale:
- *
- *   - OUTSIDE the memory scan roots (facts/, procedures/, …) so meeting
- *     transcripts never surface as memories in recall or governance passes;
- *   - INSIDE the QMD collection root (the memory dir) so records are full-text
- *     searchable after the next index update — but never auto-recalled raw.
- *
- * Records rebuild idempotently on `contentHash`: an unchanged meeting re-writes
- * nothing. The transcript body reuses the wearables day-store line grammar
- * (`**Name** [HH:MM]: text`, escape-aware) so existing parsers apply. File IO is
- * injected (like the fusion artifact store) so encrypted-at-rest + atomic-write
- * semantics are inherited without this module touching the secure-store key.
- */
-
-declare const MEETINGS_DIR_NAME = "meetings";
-declare const MEETING_KIND: "meeting";
-declare const MEETING_FORMAT_VERSION = 1;
-/** The detection-source label from a meeting id would be ambiguous, so validate
- *  an id AND confirm its embedded date matches the directory it lives under. */
-declare function meetingIdDate(id: string): string | null;
-/** Base fields (identity + detection) a fused meeting is composed with. */
-interface MeetingRecordBase {
-    id: string;
-    date: string;
-    startUtc: string;
-    endUtc: string;
-    app?: string;
-    detectionSource: MeetingDetectionSource;
-    title?: string;
-}
-/** Compose a full meeting record (with contentHash) from its base + fused view. */
-declare function composeMeetingRecord(base: MeetingRecordBase, fused: FusedMeeting): MeetingRecord;
-/** Serialize a meeting record into its persisted markdown form. */
-declare function serializeMeetingRecord(record: MeetingRecord): string;
-/** A meeting record's frontmatter, parsed for listing + idempotency checks. */
-interface MeetingRecordSummary {
-    id: string;
-    date: string;
-    startUtc: string;
-    endUtc: string;
-    app?: string;
-    detectionSource: string;
-    title?: string;
-    attendees: string[];
-    sources: string[];
-    corroboratedBy: string[];
-    snapshotCount: number;
-    contentHash: string;
-}
-/** Parse a meeting record's frontmatter. Returns null when the content is not a
- *  meeting record (wrong kind, missing frontmatter) so callers distinguish a
- *  non-record from a corrupt one. */
-declare function parseMeetingRecordSummary(raw: string): MeetingRecordSummary | null;
-/**
- * Encrypted-at-rest + atomic file IO the meeting record store needs. Satisfied
- * by StorageManager (which owns the secure-store key + atomic write path) and
- * injected so this module performs NO direct fs — records inherit the same
- * encrypted-at-rest + atomic-write semantics as memories. Same shape as the
- * fusion artifact store's IO port (kept per-module, not shared, so each store's
- * boundary stays explicit).
- */
-interface MeetingRecordFileIo {
-    writeFile(filePath: string, content: string): Promise<void>;
-    readFile(filePath: string): Promise<string>;
-    readDir(dirPath: string): Promise<string[]>;
-    deleteFile(filePath: string): Promise<void>;
-    realpath(filePath: string): Promise<string>;
-    lstat(filePath: string): Promise<{
-        isSymbolicLink: boolean;
-    }>;
-}
-/** Result of an idempotent record save. */
-interface MeetingSaveResult {
-    path: string;
-    /** False when the on-disk contentHash already matched (nothing rewritten). */
-    written: boolean;
-    contentHash: string;
-}
-/**
- * Owns the meeting record files under `<memoryDir>/meetings/<date>/<id>.md`.
- * Path construction, date/id validation, and symlink containment live here; the
- * bytes flow through the injected secure IO. Containment is anchored to the real
- * memory-dir root and mirrors the fusion artifact store (AGENTS.md pattern #3).
- */
-declare class MeetingRecordStore {
-    private readonly memoryDir;
-    private readonly io;
-    private readonly meetingsDir;
-    constructor(memoryDir: string, io: MeetingRecordFileIo);
-    recordPath(date: string, id: string): string;
-    /** Idempotently persist a record: skip the write when contentHash is unchanged. */
-    saveMeetingRecord(record: MeetingRecord): Promise<MeetingSaveResult>;
-    /** Read a stored record's raw markdown; null when absent. */
-    readMeetingRecord(date: string, id: string): Promise<string | null>;
-    /**
-     * Read + parse every stored record for a day exactly ONCE, sorted by start
-     * time (ascending, id tiebreak). The single day-read path both `listMeetingIds`
-     * and `listMeetingSummaries` derive from — no record is read twice.
-     */
-    private readDaySummaries;
-    /** List meeting ids stored for a day, sorted by start time (ascending). */
-    listMeetingIds(date: string): Promise<string[]>;
-    /** Read parsed summaries for a day, sorted by start time. */
-    listMeetingSummaries(date: string): Promise<MeetingRecordSummary[]>;
-    /** List dates that have at least one stored meeting record, newest first. */
-    listMeetingDates(): Promise<string[]>;
-    /** Remove a stored record. Idempotent: a no-op when already absent. */
-    deleteMeetingRecord(date: string, id: string): Promise<void>;
-    private readRaw;
-    private assertPathContained;
-    /** The `<meetings>/<date>` directory on the path to `targetPath`, or null when
-     *  `targetPath` is the meetings root itself. */
-    private dayDirWithin;
-    private assertNotSymlink;
-    private assertNoEscape;
-}
-
-/** Why a tombstone was emitted. */
-type TombstoneReason = "correction" | "supersession" | "retraction" | "contradiction_resolution";
-/** Who emitted the tombstone. */
-type TombstoneCreatedBy = "user_correction" | "contradiction_resolution" | "supersession" | "chat";
-/** Tier that matched on lookup. */
-type TombstoneMatchTier = "exact" | "normalized" | "keyed" | "semantic";
-/**
- * A single append-only tombstone log entry.
- *
- * `kind: "tombstone"` blocks; `kind: "revocation"` re-allows. The log is
- * never rewritten — the NEWEST matching entry wins at lookup (rule 25).
- */
-interface TombstoneEntry {
-    /** Stable tombstone id (`tomb-<ts>-<rand>`). */
-    id: string;
-    kind: "tombstone" | "revocation";
-    reason: TombstoneReason;
-    /** The memory that was retired. */
-    sourceMemoryId: string;
-    /** sha256 of the retired identity; explicit contentHashSource may define it. */
-    contentHash: string;
-    /** Current body hash retained alongside an ambiguous or explicit primary hash. */
-    currentContentHashAlias?: string;
-    /** Current normalized body used by the normalized lookup tier. */
-    normalizedText: string;
-    /** Version of the current body identity fields. */
-    normalizerVersion?: number;
-    entityRef?: string;
-    /** Structured-attribute supersession key when one existed. */
-    supersessionKey?: string;
-    /** Stable operation identity for crash-recovery replay. */
-    operationKey?: string;
-    /** Namespace scope (rule 42). */
-    namespace: string;
-    createdAt: string;
-    createdBy: TombstoneCreatedBy;
-    /** For `kind: "revocation"`: the tombstone id being revoked. */
-    revokes?: string;
-}
-/** A positive block decision returned by `TombstoneStore.lookup`. */
-interface TombstoneMatch {
-    tombstoneId: string;
-    matchedTier: TombstoneMatchTier;
-    reason: TombstoneReason;
-}
-/** Inputs to a lookup. At least one discriminator must be present.
- *
- * Issue #1579 thread Ociag/Oci-W: `supersessionKeys` (plural) lets the write
- * chokepoint check EVERY derived key, not just the first. Emitters register
- * one tombstone per matched key (temporal-supersession, rebuild), so a block
- * can live on any later key; querying only `supersessionKeys[0]` missed it
- * and the retired fact resurrected as active. `supersessionKey` (singular)
- * remains for direct/unit callers; `lookup` checks the union of both. */
-interface TombstoneLookupQuery {
-    contentHash?: string;
-    normalizedText?: string;
-    entityRef?: string;
-    /** Single supersession key (direct/unit callers). */
-    supersessionKey?: string;
-    /** All derived supersession keys (write chokepoint). The keyed tier is
-     * checked for each; the first active match wins. */
-    supersessionKeys?: string[];
-    namespace: string;
-}
-/** Configuration for a tombstone store instance. */
-interface TombstoneStoreOptions {
-    enabled: boolean;
-    semanticMatch: boolean;
-    semanticThreshold: number;
-    /** sha256 of raw content — wired to `ContentHashIndex.computeHash`. */
-    hashContent: (raw: string) => string;
-    /** Normalize raw content — wired to `ContentHashIndex.normalizeContent`. */
-    normalizeText: (raw: string) => string;
-    /**
-     * Optional cosine similarity in [0, 1] for the semantic tier. When
-     * undefined or when `semanticMatch` is false, the semantic tier is
-     * skipped entirely.
-     */
-    semanticSimilarity?: (a: string, b: string) => number;
-    /**
-     * Resolve source identity candidates for bounded legacy sourceMemoryIds.
-     * StorageManager reads the corpus before the tombstone write lock.
-     */
-    readonly sourceContentsForMemoryIds?: (sourceMemoryIds: readonly string[]) => Promise<ReadonlyMap<string, string | readonly string[]>>;
-    /** Maximum number of legacy entries considered during one load. */
-    readonly legacyMigrationLimit?: number;
-    /**
-     * Cross-process write-lock timings for the tombstone JSONL mutation lock
-     * (issue #1639). The secure-store append is a read-merge-write (read
-     * encrypted → decrypt → concat → re-encrypt → atomic rename), so two
-     * Remnic processes appending concurrently can each read the same contents
-     * and the last writer drops the other's entry — breaking the
-     * non-resurrection invariant. The lock serializes the mutation across
-     * processes. When omitted, defaults that fit the short tombstone critical
-     * section (mirroring the summary-snapshot lock): staleMs 30s, maxWaitMs 5s,
-     * heartbeatMs floor(staleMs/3).
-     */
-    readonly lockStaleMs?: number;
-    readonly lockMaxWaitMs?: number;
-    readonly lockHeartbeatMs?: number;
-}
-/** Injected file I/O — the StorageManager wires its secure-store-aware
- * implementations so tombstones are encrypted at rest alongside other state.
- * `stat` is optional; when provided the store tracks the file mtime itself and
- * runs a cross-process staleness probe on each access (#1579). */
-interface TombstoneFileIo {
-    read: (filePath: string) => Promise<string>;
-    append: (filePath: string, content: string) => Promise<void>;
-    write: (filePath: string, content: string) => Promise<void>;
-    stat?: (filePath: string) => {
-        mtimeMs: number;
-    };
-}
-/** Aggregate stats for `remnic doctor`. */
-interface TombstoneStats {
-    count: number;
-    revoked: number;
-    lastAppendAt: string | null;
-    corruptedLines: number;
-    /** Whether the in-memory index matches the on-disk file (rebuild check). */
-    loaded: boolean;
-}
-/**
- * The instance-scoped tombstone store. One per StorageManager (rule 11),
- * namespace-scoped via `namespace` + the on-disk path (rule 42).
- *
- * The in-memory index is built lazily on first access and invalidated on
- * append + by the StorageManager's cache-invalidation chokepoint (rule 25).
- */
-declare class TombstoneStore {
-    private readonly filePath;
-    private readonly namespace;
-    private readonly options;
-    private readonly io;
-    private entries;
-    /** contentHash → tombstone id (newest) — exact tier. */
-    private readonly byHash;
-    /** normalizedText → tombstone id (newest) — normalized tier. */
-    private readonly byNormalized;
-    /** entityRef\0supersessionKey → tombstone id (newest) — keyed tier. */
-    private readonly byKey;
-    /** Tombstone ids that have a later revocation entry. */
-    private readonly revokedIds;
-    /** id → entry index (newest only, for revocation lookups). */
-    private readonly byId;
-    private loaded;
-    private loadPromise;
-    private corruptedLines;
-    private lastAppendAt;
-    /**
-     * Last-seen mtime of the JSONL file (cross-process staleness probe, #1579).
-     * Tracked inside the store so the StorageManager wiring stays thin. When the
-     * file's mtime advances past this value between accesses, the in-memory index
-     * is stale (a peer process appended) and is reloaded before the next lookup.
-     */
-    private fileMtimeMs;
-    constructor(filePath: string, namespace: string, options: TombstoneStoreOptions, io: TombstoneFileIo);
-    /**
-     * Resolved cross-process write-lock timings (issue #1639). Defaults mirror
-     * the summary-snapshot lock: a tombstone append critical section is
-     * sub-second, so a stale lock older than 30s is a crashed holder; bounded
-     * acquisition gives up after 5s and strict-fails rather than clobbering a
-     * concurrent writer (which would reintroduce the lost-write race this lock
-     * closes).
-     */
-    private readonly lockStaleMs;
-    private readonly lockMaxWaitMs;
-    private readonly lockHeartbeatMs;
-    /**
-     * Sibling advisory lockfile: `<tombstones>.jsonl` → `<tombstones>.lock`.
-     * Shared by append, revoke, and rebuild so every JSONL mutation serializes
-     * against the others across processes (issue #1639: "shared with rebuilds").
-     */
-    private get lockPath();
-    /** Lazy load + build the in-memory index. Idempotent. */
-    load(): Promise<void>;
-    private loadInternal;
-    private parseEntries;
-    /**
-     * Re-index pre-Unicode records from retired source content.
-     * Source reads stay bounded, but every batch finishes before the store
-     * publishes its in-memory index. Missing sources remain eligible on restart.
-     */
-    private migrateLegacyEntries;
-    private resetIndex;
-    /**
-     * Index an entry. Later entries (higher array index = newer createdAt)
-     * OVERRIDE earlier ones at each tier key — the newest matching entry wins
-     * (rule 25). Revocation entries mark their target as revoked.
-     */
-    private indexEntry;
-    /** Invalidate the in-memory cache (rule 25). The next access reloads. */
-    invalidate(): void;
-    /**
-     * Cross-process staleness probe (#1579). If the file's mtime advanced since
-     * the last load/own-write, a peer process appended and our in-memory index
-     * is stale — invalidate and reload before the next access. Mutation callers
-     * pass `migrate: false` to avoid nested serializer/lock acquisition.
-     */
-    ensureFreshAgainstDisk(options?: {
-        migrate?: boolean;
-    }): Promise<void>;
-    /**
-     * Record the file mtime after THIS process writes (append / revoke / rebuild)
-     * so `ensureFreshAgainstDisk` does not treat our own write as a peer append
-     * and throw away the just-updated in-memory index (#1579 — avoids a needless
-     * invalidate+reload in the hot write path).
-     */
-    private markWritten;
-    private recordFileMtime;
-    /**
-     * Append a tombstone entry. Serialized via `serializeMutations` keyed by
-     * file path so concurrent appends do not interleave, with rejection recovery
-     * (rule 40 — a single failed append never poisons the chain). The in-memory
-     * index is updated AFTER the durable append succeeds.
-     *
-     * Returns the new tombstone id.
-     */
-    appendTombstone(input: {
-        reason: TombstoneReason;
-        createdBy: TombstoneCreatedBy;
-        sourceMemoryId: string;
-        rawContent: string;
-        entityRef?: string;
-        supersessionKey?: string;
-        operationKey?: string;
-        createdAt?: string;
-        /**
-         * Pre-computed canonical contentHash from the retired memory's frontmatter.
-         * When provided, used directly so the tombstone's exact tier matches the
-         * hash writeMemory computes on re-extraction (issue #1579 review: cited
-         * facts must not slip past the chokepoint because the emitter hashed the
-         * citation-annotated body instead of the canonical source).
-         */
-        contentHash?: string;
-    }): Promise<string>;
-    /**
-     * Append a revocation entry referencing `tombstoneId`. The log is
-     * append-only; lookup treats a revoked tombstone as re-allowed (rule 25).
-     */
-    revoke(tombstoneId: string, createdBy: TombstoneCreatedBy): Promise<string>;
-    private serializeAppend;
-    private migrateLoadedLegacyEntries;
-    /**
-     * Acquire the cross-process tombstone write lock and run `task` under it
-     * (issue #1639). Strict-fail on acquisition timeout: the secure-store append
-     * is a read-merge-write, so a best-effort unlocked run would clobber a
-     * concurrent writer — reintroducing the lost-write race this lock closes.
-     * The thrown error surfaces to the caller (rule 34: never silently drop);
-     * rebuild recovers the tombstone on the next maintenance cycle.
-     *
-     * In-process callers are already serialized by serializeMutations (one key
-     * for append/revoke/rebuild), so this lock only contends across processes —
-     * the single-process daemon (default deployment) acquires it immediately.
-     */
-    private withWriteLock;
-    /**
-     * Look up whether `query` is blocked by an active (non-revoked) tombstone.
-     * Tiers are checked in order: exact (contentHash) → normalized → keyed →
-     * semantic (off by default). Returns the first active match, or `null`.
-     *
-     * Namespace isolation (rule 42): only entries with `namespace === query.namespace`
-     * match. The store is per-namespace, so this is belt-and-suspenders.
-     */
-    lookup(query: TombstoneLookupQuery): TombstoneMatch | null;
-    hasExactEntry(input: {
-        sourceMemoryId: string;
-        contentHash?: string;
-        entityRef?: string;
-        supersessionKey?: string;
-        createdAt?: string;
-        operationKey?: string;
-    }): Promise<boolean>;
-    /** Aggregate stats for the doctor / x-ray surfaces. */
-    stats(): TombstoneStats;
-    /** Read-only snapshot of all entries (for rebuild + tests). */
-    snapshot(): readonly TombstoneEntry[];
-    /**
-     * Rebuild the in-memory index + JSONL from the supplied retired-memory
-     * records + existing entries (preserving revocations). Byte-stable: entries
-     * are sorted by (createdAt, id) before write (rule 38).
-     *
-     * Returns the count of tombstone entries written.
-     */
-    rebuild(retiredMemories: ReadonlyArray<RetiredMemoryRecord>): Promise<number>;
-}
-/** A retired memory projected into the shape `TombstoneStore.rebuild` consumes. */
-interface RetiredMemoryRecord {
-    memoryId: string;
-    rawContent: string;
-    entityRef?: string;
-    supersessionKey?: string;
-    reason: TombstoneReason;
-    createdBy: TombstoneCreatedBy;
-    createdAt: string;
-    /** Canonical contentHash from the retired memory's frontmatter (#1579). */
-    contentHash?: string;
-}
-
-interface SupersessionAuditOptions {
-    content: string;
-    tags?: string[];
-    structuredAttributes?: Record<string, string>;
-    source?: string;
-}
-
-/**
- * Tuning for {@link ContentHashIndex} cross-process lock waits and the
- * deferred reconcile-save durable retry (issue #1909 / PR #2016). All optional;
- * production uses the module defaults. Tests inject small values so the
- * lock-timeout + retry path is exercised deterministically without real
- * multi-second waits.
- */
-interface ContentHashIndexLockOptions {
-    /** Bounded wait to acquire the per-file advisory lock; passed to `withHeldFileLock` (default 5000ms). */
-    readonly maxWaitMs?: number;
-    /** Poll interval while waiting for a busy lock (default 50ms). */
-    readonly pollMs?: number;
-    /** Base backoff before the first deferred-save retry (default 500ms). */
-    readonly retryBaseMs?: number;
-    /** Max deferred-save retries before falling back to the corpus-rebuild safety net (default 5). */
-    readonly retryMaxAttempts?: number;
-}
-/**
- * Thrown when the fact-hash index cannot be made authoritative — the
- * cross-process rebuild lock could not be acquired within the bounded retry
- * budget (PR #2016). Callers that require an authoritative dedup answer surface
- * this instead of silently trusting a stale loaded snapshot.
- */
-declare class FactHashIndexNotAuthoritativeError extends Error {
-    constructor(stateDir: string);
-}
-interface ContentHashPathEntry {
-    readonly path: string;
-    readonly contentHash: string;
-}
-/**
- * Content-hash dedup index for facts.
- * Normalizes content (lowercase, strip punctuation, collapse whitespace),
- * computes SHA-256, and stores hashes in a line-delimited file.
- * Prevents writing semantically identical facts.
- */
-declare class ContentHashIndex {
-    private hashes;
-    /**
-     * Fact-ONLY hash partition (issue #2474). `hashes` above is category-blind
-     * (every write category registers there); this subset carries only
-     * `category === "fact"` hashes so fact-only membership checks
-     * (`hasFact*`) can never be satisfied by an unrelated decision/preference
-     * sharing the same normalized body. In-memory only — never serialized to
-     * fact-hashes.txt; `clear()` drops it and every authoritative rebuild
-     * repopulates it via `addFactByHash`. Subset invariant: `factHashes ⊆
-     * hashes` — `addFact*` registers in both, and the removal sites that drop
-     * a shared hash also drop the partition entry (removal stays caller-paired
-     * because shared-index removal is category-blind: archiving a non-fact
-     * must not evict an active fact's fact-only membership).
-     */
-    private factHashes;
-    private dirty;
-    /** True when load() found the pre-Unicode, markerless on-disk format. */
-    private formatMigrationRequired;
-    /**
-     * Hashes explicitly removed since the last successful save (issue #1909 review
-     * round 8 thread 3). Tracked separately so `saveMergingWithDisk` can be
-     * removal-AWARE: under the file lock it reads the latest on-disk set, DROPS
-     * these, then unions our additions — so a removal batch cannot resurrect a
-     * hash (union alone would) and cannot clobber a concurrent extraction's
-     * appended hash (blind overwrite would). Consumed + cleared by every save.
-     */
-    private removed;
-    /**
-     * Hashes added by THIS instance since the last successful save (issue #1909
-     * review round 9 finding 3). Tracked separately from the loaded snapshot so a
-     * reconciling save publishes `(on-disk \ removed) ∪ added` — it re-applies only
-     * OUR additions, never the stale loaded entries. Without this, seeding the
-     * merge from `this.hashes` (loaded ∪ added) would resurrect a hash a peer
-     * removed on disk while this instance held a stale snapshot.
-     */
-    private added;
-    private readonly filePath;
-    private readonly secureStoreKeyProvider;
-    private readonly secureStoreWriteKeyProvider;
-    private readonly memoryDir;
-    private readonly lockOptions;
-    /**
-     * Deferred reconcile-save durable-retry state (issue #1909 / PR #2016). At
-     * most ONE retry is ever armed (`reconcileRetryTimer` is the reentrancy guard)
-     * so successive timed-out saves cannot stack duplicate/parallel retries.
-     * `reconcileRetryBarrier` resolves when the chain settles (published or gave
-     * up) — awaited by tests and any caller wanting the eventual result.
-     */
-    private reconcileRetryTimer;
-    private reconcileRetryAttempts;
-    private reconcileRetryBarrier;
-    private reconcileRetryResolve;
-    /**
-     * On-disk fingerprint captured at the last point THIS instance's in-memory
-     * set matched disk — after `load()`, `save()`, or a reconcile publish. A peer
-     * process that advances the durable index changes its file generation even
-     * when byte size and mtime collide, so the freshness check remains safe
-     * without an O(file-size) read on the hot path.
-     */
-    private lastSyncedFingerprint;
-    constructor(stateDir: string, secureStoreKeyProvider?: () => Buffer | null, secureStoreWriteKeyProvider?: () => Buffer | null, memoryDir?: string, lockOptions?: ContentHashIndexLockOptions);
-    /** Whether a caller with an authoritative corpus must rebuild this legacy index. */
-    get requiresFormatMigration(): boolean;
-    /** Load existing hashes from disk. Safe to call multiple times. */
-    load(): Promise<void>;
-    /** Cheap `stat` of the durable index file; null when it does not exist yet. */
-    private statIndexFile;
-    /** Record the current on-disk fingerprint as this instance's synced baseline. */
-    private captureSyncedFingerprint;
-    /**
-     * True when the durable index file is unchanged since this instance last
-     * synced it (load / save / reconcile). False when a peer advanced it, when
-     * the file appeared or vanished, or when freshness cannot be established
-     * (stat error) — the caller then treats the in-memory snapshot as
-     * non-authoritative and confirms a dedup miss against the durable corpus.
-     * The stat includes file identity and generation metadata so same-size,
-     * same-mtime atomic replacements are detected without reading the file body.
-     */
-    isDiskFingerprintCurrent(): Promise<boolean>;
-    /** Check if content already exists in the index. */
-    has(content: string): boolean;
-    /** Add content hash to the index. */
-    add(content: string): void;
-    get size(): number;
-    /** Clear all loaded hashes so the next save rewrites the index from scratch. */
-    clear(): void;
-    /** Persist index to disk if changed (plain whole-file overwrite). */
-    save(): Promise<void>;
-    /**
-     * Persist the index by RECONCILING with the latest on-disk state under a
-     * cross-process lock (issue #1909). Used by the extraction-persist batch save
-     * for BOTH append and removal batches, so appends and removals to the same
-     * index serialize against each other:
-     *   final = (on-disk \ this.removed) ∪ this.added
-     * Note it re-applies only OUR local additions (`added`), NOT the loaded
-     * snapshot (review round 9 finding 3): seeding from `this.hashes` would
-     * resurrect a hash a peer removed on disk while we held a stale snapshot. This
-     * preserves a concurrent writer's appended hashes (a blind overwrite would
-     * drop them), never resurrects a removed hash, and never loses our additions.
-     *
-     * Hardening:
-     *  - Dirty short-circuit (round 7 finding 3): when this instance neither added
-     *    nor removed anything this run, skip the O(file) read+rewrite entirely.
-     *  - Cross-process lock (round 7 finding 2): serialize the read→reconcile→write
-     *    window on a per-file advisory lock. If the lock is NOT acquired (timeout),
-     *    do NOT publish (round 9 finding 2): keep `dirty` set AND schedule a bounded
-     *    durable background retry (PR #2016) that keeps re-attempting the locked
-     *    publish until the deferred additions land — never an unlocked write that
-     *    could clobber a peer, and never a silent "batch save complete" that leaves
-     *    the addition in this process's memory only.
-     */
-    saveMergingWithDisk(): Promise<void>;
-    /**
-     * Rebuild-and-publish the index from an authoritative source (the durable
-     * corpus) under the SAME per-file cross-process lock the reconciling
-     * append/removal saves (`saveMergingWithDisk`) use (issue #1909 / PR #2016).
-     * The `populate` callback runs WHILE the lock is held and MUST repopulate this
-     * index from the corpus (`clear()` then `addByHash(...)` for every corpus
-     * hash); the rebuilt set is then published with a plain overwrite that is now
-     * serialized against every locked writer.
-     *
-     * This closes the finding where the previous unlocked clear→scan→save() could
-     * overwrite a peer's newer lock-merged or deferred additions: a locked writer
-     * that committed BEFORE the rebuild acquired the lock has its memory `.md` on
-     * disk and is re-scanned; one that commits AFTER the rebuild releases
-     * reconciles its additions on top of the freshly-published set. No union with
-     * the raw on-disk file is performed, so the rebuild keeps its
-     * garbage-collection property (orphaned hashes for deleted memories drop).
-     *
-     * Lock-acquisition failure is explicit and non-destructive: `populate` is NOT
-     * run and nothing is written (never an unlocked overwrite). Returns true when
-     * the rebuild was published under the lock, false when the lock timed out —
-     * the caller keeps the index non-authoritative and retries on next use. Uses
-     * the same non-reentrant file lock as the reconcile path, so it can never
-     * deadlock with the deferred reconcile-retry: a concurrent locked writer (or a
-     * fired retry) simply yields `acquired=false` after the bounded wait.
-     */
-    rebuildUnderLock(populate: () => Promise<void>): Promise<boolean>;
-    /**
-     * True while a background durable reconcile-save retry is armed (PR #2016).
-     * Test/introspection hook.
-     */
-    get hasPendingReconcileRetry(): boolean;
-    /** True while this index has in-memory changes not yet published to disk. */
-    get hasPendingChanges(): boolean;
-    /**
-     * Resolve once any armed background reconcile-save retry chain has settled —
-     * either it published the deferred additions, or it exhausted its bounded
-     * attempts and fell back to the corpus-rebuild safety net. Resolves
-     * immediately when nothing is armed. Lets a caller (or a test) await the
-     * eventual durability outcome of a lock-timed-out save.
-     */
-    whenReconcileRetrySettled(): Promise<void>;
-    /**
-     * Drive any deferred lock-timeout reconcile save to completion INLINE at a
-     * lifecycle boundary (PR #2016 finding 3). The background retry timer is
-     * `unref`'d so it never keeps a long-lived daemon alive — but a short-lived
-     * writer (a one-shot CLI) can exit before it fires, leaving a durable fact
-     * `.md` whose hash never reached `fact-hashes.txt` for peers that already
-     * built their in-memory index. `orchestrator.destroy()` calls this so the
-     * addition publishes before the process exits; long-lived hosts only reach it
-     * at their own shutdown, so their in-flight retries keep running in the
-     * background until then. Bounded by the same attempt ceiling as the background
-     * retry; a permanently contended lock falls back to the corpus-rebuild-on-
-     * restart safety net (the fact `.md` is already durable). No deadlock: each
-     * attempt is the same non-reentrant, bounded-wait file lock.
-     */
-    flushReconcileRetry(): Promise<void>;
-    /**
-     * Schedule ONE bounded, exponentially-backed-off background retry of the
-     * deferred reconcile save (PR #2016). Reentrant-safe: an already-armed timer
-     * short-circuits, so successive timed-out saves never stack duplicate retries.
-     * When attempts are exhausted the chain settles without publishing — the
-     * durable fact `.md` is on disk and a process restart rebuilds the index from
-     * the corpus, so this degrades to that safety net, never a fatal failure.
-     */
-    private scheduleReconcileRetry;
-    /** Cancel any armed reconcile-save retry and settle the barrier (a publish landed). */
-    private cancelReconcileRetry;
-    /** Resolve and clear the retry barrier if one is outstanding. */
-    private settleReconcileRetry;
-    /** Remove a hash from the index (used when archiving/deleting). */
-    remove(content: string): void;
-    /**
-     * Remove a pre-computed SHA-256 hash directly from the index without
-     * re-hashing.  Use this when the caller already holds the stored hash
-     * (e.g. `memory.frontmatter.contentHash`) to avoid the double-hash bug
-     * where `remove(hash)` would compute `hash(hash)` and never match the
-     * entry.
-     */
-    removeByHash(hash: string): void;
-    /**
-     * Add a pre-computed SHA-256 hash directly to the index without re-hashing.
-     * Use this when the caller already holds the stored hash
-     * (e.g. `memory.frontmatter.contentHash`) so that the index records the raw
-     * content hash rather than re-hashing the citation-annotated body.
-     *
-     * @internal Only called from `StorageManager.ensureFactHashIndexAuthoritative`.
-     * Not part of the public API — prefer `add(content)` for external callers.
-     */
-    addByHash(hash: string): void;
-    /** Register fact content in BOTH the shared index and the fact-only partition. */
-    addFact(content: string): void;
-    /** Register a pre-computed fact hash in both the shared index and the fact-only partition. */
-    addFactByHash(hash: string): void;
-    /** Fact-ONLY membership: has this content been registered as a fact? */
-    hasFact(content: string): boolean;
-    /** Fact-ONLY membership for a pre-computed SHA-256 hash. */
-    hasFactByHash(hash: string): boolean;
-    /**
-     * Drop fact-only partition membership WITHOUT touching the shared index.
-     * The shared removal stays caller-owned: a shared hash is dropped only when
-     * no other active memory holds it, while fact-only membership follows the
-     * fact's own lifecycle (supersede/archive/promotion).
-     */
-    removeFactByHash(hash: string): void;
-    /**
-     * Resolve a pre-computed semantic hash to one deterministic corpus path.
-     *
-     * This lookup is separate from durable hash membership: `this.hashes` stays
-     * one hash per line and `has(content)` keeps its existing raw-content contract.
-     * Reconciliation supplies short-lived manifest rows where hash and path coexist.
-     */
-    static resolvePathByHash(hash: string, entries: Iterable<ContentHashPathEntry>): string | undefined;
-    /** Normalize content (delegates to content-hash.ts for a single source of truth). */
-    static normalizeContent(content: string): string;
-    /** Compute SHA-256 hash (delegates to content-hash.ts for a single source of truth). */
-    static computeHash(content: string): string;
-}
-
-type StreamedOfflineSyncIdentity = {
-    identityHash: string;
-};
-type OfflineSyncMemoryParser = (filePath: string, content: Buffer) => MemoryFile | null;
-declare abstract class TombstoneBlockedCaptureIndexHost {
-    private tombstoneBlockedCaptureIndex;
-    protected abstract tombstoneBlockedCaptureIndexOptions(): TombstoneBlockedCaptureIndexOptions;
-    protected abstract writeStorageSecureFile(filePath: string, content: string | Buffer, forceEncrypt?: boolean): Promise<void>;
-    protected abstract assertManagedStoragePath(filePath: string, method: string): string;
-    protected abstract notifyCatalogWriteForPath(filePath: string): void;
-    protected abstract readMemoryByPath(filePath: string): Promise<MemoryFile | null>;
-    protected abstract invalidateAllMemoriesCache(): void;
-    protected abstract invalidateKnowledgeIndexCache(): void;
-    protected abstract invalidateColdMemoriesCache(): void;
-    protected abstract bumpArtifactWriteVersion(): number;
-    protected abstract bumpMemoryStatusVersion(): void;
-    protected abstract bumpMemoryCorpusVersion(): void;
-    protected abstract markFactHashIndexNotAuthoritative(): void;
-    /** #2837: durable unlink plus deletion-revision record, WITHOUT the CAS
-     * shard sweep — the concrete {@link deleteManagedStorageFile} composes the
-     * two so every deletion funnel (invalidation, maintenance purge, archive
-     * move, offline sync) sweeps. */
-    protected abstract deleteManagedStorageFileDurable(filePath: string, deletionMtimeMs?: number | null): Promise<boolean>;
-    protected abstract writeManagedStorageFile(filePath: string, write: () => Promise<void>): Promise<void>;
-    /** #2813 (P1 C, #2807): reserve the target's next durable CAS revision
-     * token as a two-phase receipt transaction — a PENDING write-ahead
-     * marker under the mutation's path lock, published COMMITTED only after
-     * the durable file write lands. Receipt identity lives in the per-target
-     * sidecar, never in public `frontmatter.updated`. The default host keeps
-     * no receipt identity; StorageManager records it. */
-    protected beginDurableMemoryRevision(_pathname: string, _expectedContent?: string | Buffer | null): Promise<CasRevisionTransaction | undefined>;
-    /** #2837 (shard cleanup): after a managed memory file is durably deleted,
-     * sweep its per-target CAS receipt shard so orphan shards cannot grow
-     * forever. The sweep runs under the shard's own lock and is best-effort —
-     * the memory file is already gone, so a sweep failure logs and never
-     * fails the delete. The sweeper is a second CasRevisionHost over the same
-     * memory dir; the host is stateless and every mutation serializes through
-     * the sidecar's file locks, so it shares the same shard files
-     * StorageManager's own host operates on. */
-    private deletedMemoryShardSweeper;
-    protected deleteManagedStorageFile(filePath: string, deletionMtimeMs?: number | null): Promise<boolean>;
-    private writeStorageSecureFileChunks;
-    protected getTombstoneBlockedCaptureIndex(): TombstoneBlockedCaptureIndex;
-    withTombstoneBlockedCaptureWriteLock<T>(task: () => Promise<T>, identity?: string | readonly string[]): Promise<T>;
-    /** Read selected memories while their mutation locks remain held. */
-    readMemorySnapshotsIfUnchanged(expected: readonly MemoryFile[]): Promise<MemoryFile[] | null>;
-    withMemorySnapshotsIfUnchanged<T>(expected: readonly MemoryFile[], task: (memories: MemoryFile[]) => Promise<T>): Promise<T | null>;
-    protected withTombstoneBlockedCaptureWriteLockAndHashes<T>(task: () => Promise<T>, identity: string | readonly string[] | undefined, identityHashes: readonly string[]): Promise<T>;
-    private writeTombstoneBlockedMutation;
-    protected writeTombstoneBlockedMemory(pathname: string, fileContent: string, frontmatter: MemoryFrontmatter, content: string, beforeIndexUpdate?: () => Promise<void>): Promise<void>;
-    protected withTombstoneBlockedMemoryPathLock<T>(pathname: string, task: (current: MemoryFile | null) => Promise<T>, additionalPathnames?: readonly string[]): Promise<T>;
-    protected writeTombstoneBlockedChunk(pathname: string, fileContent: string, frontmatter: MemoryFrontmatter, content: string, findDuplicate: () => Promise<MemoryFile | null>, afterWrite: (current: MemoryFile | null) => Promise<void>): Promise<string>;
-    protected writeTombstoneBlockedUpdate(before: MemoryFile, fileContent: string, frontmatter: MemoryFrontmatter, content: string, beforeIndexUpdate?: () => Promise<void>): Promise<string | undefined>;
-    protected writeTombstoneBlockedFrontmatter(before: MemoryFile, fileContent: string, frontmatter: MemoryFrontmatter, beforeIndexUpdate?: () => Promise<void>): Promise<string | undefined>;
-    private isTombstoneBlockedMemory;
-    private offlineSyncMemoryIdentity;
-    private isDuplicateTombstoneBlockedOfflineSync;
-    private invalidateAfterOfflineSyncMutation;
-    protected runTombstoneBlockedArchive(memory: MemoryFile, task: (current: MemoryFile, markDurable: () => void) => Promise<string | null>): Promise<string | null>;
-    protected runTombstoneBlockedInvalidation(memory: MemoryFile, task: (current: MemoryFile, rebuildMarker: string | undefined, markDurable: () => void) => Promise<boolean>, propagateErrors?: boolean, coordinate?: boolean): Promise<boolean>;
-    deleteMemoryForMaintenance(memory: MemoryFile, shouldDelete?: (current: MemoryFile) => boolean): Promise<MemoryFile | null>;
-    protected runTombstoneBlockedOfflineSyncMutation(target: string, after: MemoryFile | null, write: () => Promise<boolean | void>, coordinate?: boolean, streamedIdentity?: StreamedOfflineSyncIdentity): Promise<void>;
-    protected writeTombstoneBlockedOfflineSyncFile(target: string, content: Buffer): Promise<void>;
-    private prepareTombstoneBlockedOfflineSyncChunks;
-    private describeStagedOfflineSyncChunks;
-    private computeStagedOfflineSyncIdentity;
-    private readStagedOfflineSyncChunks;
-    protected writeTombstoneBlockedOfflineSyncFileChunks(target: string, chunks: AsyncIterable<Buffer>): Promise<void>;
-    writeOfflineSyncFile(filePath: string, content: Buffer): Promise<void>;
-    writeOfflineSyncFileChunks(filePath: string, chunks: AsyncIterable<Buffer>): Promise<void>;
-    /**
-     * Opaque replicated bytes can restore legacy memory references or entity
-     * relationship targets. Other sync traffic must not request reconciliation.
-     */
-    private requestSyncReconcileIfMigrationPath;
-    deleteOfflineSyncFile(filePath: string, deletionMtimeMs?: number | null): Promise<void>;
-    protected deleteTombstoneBlockedOfflineSyncFile(target: string, deletionMtimeMs?: number | null): Promise<void>;
-    checkTombstoneBlockedExplicitCapture(...args: [string, string, string?]): Promise<{
-        has: boolean;
-        authoritative: boolean;
-    }>;
-    hasTombstoneBlockedExplicitCapture(...args: [string, string, string?]): Promise<boolean>;
-    isTombstoneBlockedExplicitCaptureIndexAuthoritative(): Promise<boolean>;
-    protected rebuildTombstoneBlockedCaptureAfterInvalidationForPath(filePath: string, ownedMarker?: string): Promise<void>;
-    protected rebuildTombstoneBlockedCaptureAfterInvalidation(ownedMarker?: string): Promise<void>;
-}
-
-type TombstoneBlockedCaptureIndexOptions = {
-    readonly stateDir: string;
-    readonly memoryDir: string;
-    readonly secureStoreKeyProvider: () => Buffer | null;
-    readonly secureStoreWriteKeyProvider: () => Buffer | null;
-    readonly lockOptions: () => ContentHashIndexLockOptions;
-    readonly readAllMemories: () => Promise<MemoryFile[]>;
-    readonly readAllColdMemories: () => Promise<MemoryFile[]>;
-    readonly parseMemory?: OfflineSyncMemoryParser;
-    readonly withHeldFileLock?: typeof withHeldFileLock;
-};
-/**
- * Durable targeted deduplication for tombstone-blocked explicit captures.
- *
- * The active fact-hash index intentionally excludes blocked rows. This small
- * companion index keeps the blocked identity visible without making every
- * authoritative active-index miss scan the full corpus.
- */
-declare class TombstoneBlockedCaptureIndex {
-    private readonly options;
-    private index;
-    private loadPromise;
-    private refreshPromise;
-    private authoritative;
-    private readonly captureWriteLock;
-    constructor(options: TombstoneBlockedCaptureIndexOptions);
-    private createIndex;
-    private indexPath;
-    private rebuildMarkerPath;
-    private readRebuildMarkers;
-    private isAbandonedMarker;
-    private isProcessAlive;
-    private readProcessStartedAtMs;
-    private getClearableRebuildMarkerPaths;
-    private getRebuildMarkers;
-    private writeMarkerAtomically;
-    private markRebuildRequired;
-    private markRebuildCommitted;
-    private clearRebuildRequired;
-    private hasRebuildRequired;
-    private setAuthoritative;
-    private isBlocked;
-    private rebuild;
-    private hasPersistedIndexOrMarkers;
-    private getIndex;
-    withCaptureWriteLock<T>(task: () => Promise<T>, identity?: string | readonly string[]): Promise<T>;
-    withCaptureWriteLockHashes<T>(task: () => Promise<T>, identityHashes: readonly string[]): Promise<T>;
-    withCaptureWriteLockAndHashes<T>(task: () => Promise<T>, identity: string | readonly string[] | undefined, identityHashes: readonly string[]): Promise<T>;
-    private reload;
-    /** Return blocked-row membership and authority from one index snapshot. */
-    check(content: string, category: string, sourceConnector?: string): Promise<{
-        has: boolean;
-        authoritative: boolean;
-    }>;
-    /** Return whether a blocked row matches this explicit-capture identity. */
-    has(content: string, category: string, sourceConnector?: string): Promise<boolean>;
-    /** Return whether the in-memory index is safe to answer an authoritative miss. */
-    isAuthoritative(): Promise<boolean>;
-    /** Reserve durable rebuild intent before a blocked memory file is committed. */
-    prepareWrite(): Promise<string>;
-    /** Mark a prepared write committed once its memory file is durable. */
-    commitWrite(rebuildMarker: string): Promise<void>;
-    /** Drop a pending marker when the protected memory write never commits. */
-    discardWrite(rebuildMarker: string): Promise<void>;
-    /** Add a newly persisted blocked row to the durable targeted index. */
-    add(memory: MemoryFile, rebuildMarker?: string): Promise<void>;
-    /** Rebuild the index after a blocked row changes or is removed. */
-    rebuildIfLoaded(ownedMarker?: string): Promise<void>;
-    /** Rebuild when either side of a write is blocked and its identity changed. */
-    sync(before: MemoryFile, after: MemoryFile, rebuildMarker?: string): Promise<void>;
-    markUntrusted(): void;
-    private failOpen;
-    addWrittenMemory(pathname: string, frontmatter: MemoryFrontmatter, content: string, rebuildMarker?: string): Promise<void>;
-    rebuildAfterInvalidation(ownedMarker?: string): Promise<void>;
-    /**
-     * Drop an already-committed write marker without re-reading the corpus. The
-     * offline-sync mutation path commits its marker around the file write, then
-     * must clear it even when the write cannot have changed the blocked key set
-     * (neither side tombstone-blocked) — otherwise the marker lingers until some
-     * later rebuild clears it. Mirrors the tail of `add`/`sync`.
-     */
-    clearCommittedWriteMarker(rebuildMarker: string): Promise<void>;
-    syncUpdatedMemory(before: MemoryFile, frontmatter: MemoryFrontmatter, content: string, rebuildMarker?: string): Promise<void>;
-    syncUpdatedFrontmatter(before: MemoryFile, frontmatter: MemoryFrontmatter, rebuildMarker?: string): Promise<void>;
-    shouldRebuildAfterInvalidationForPath(filePath: string): boolean;
-}
-
-declare function normalizeStructuredSectionFactsWithOrigins(facts: string[], factOrigins?: Array<string | undefined>, defaultOrigin?: string): Pick<EntityStructuredSection, "facts" | "factOrigins">;
-declare function normalizeStructuredSectionFacts(facts: string[]): string[];
-declare function compileEntityFacts(timeline: EntityTimelineEntry[], structuredSections: EntityStructuredSection[]): string[];
-declare function compareEntityTimestamps(left?: string, right?: string): number;
-declare function countEntityStructuredFacts(entity: EntityFile): number;
-declare function fingerprintEntityStructuredFacts(entity: Pick<EntityFile, "structuredSections">): string | undefined;
-declare function isEntitySynthesisStale(entity: EntityFile): boolean;
-
-interface ReextractJobRequest {
-    memoryId: string;
-    model: string;
-    requestedAt: string;
-    source: "cli-migrate";
-}
-interface MemoryLifecycleEventWriteOptions {
-    at?: Date;
-    actor?: string;
-    reasonCode?: string;
-    ruleVersion?: string;
-    relatedMemoryIds?: string[];
-    correlationId?: string;
-}
-declare function parseFrontmatterStringValue(rawValue: string | undefined): string | undefined;
-declare function parseFrontmatter(raw: string): {
-    frontmatter: MemoryFrontmatter;
-    content: string;
-} | null;
-declare function normalizeFrontmatterForPath(frontmatter: MemoryFrontmatter, pathRel: string, content?: string): MemoryFrontmatter;
-
-/**
- * Parse an entity markdown file into a structured EntityFile.
- * Backward compatible: old files without new sections get empty arrays.
- */
-declare function parseEntityFile(content: string, entitySchemas?: PluginConfig["entitySchemas"]): EntityFile;
-/**
- * Serialize an EntityFile back to markdown.
- * Writes the compiled-truth + timeline format while remaining parse-compatible
- * with the legacy in-memory `summary` and `facts` fields.
- */
-declare function serializeEntityFile(entity: EntityFile, entitySchemas?: PluginConfig["entitySchemas"], okfType?: boolean): string;
-declare function buildEntitySchemaCacheKey(entitySchemas?: PluginConfig["entitySchemas"]): string;
-/**
- * Full-schema type guard for a `BUFFER_SURPRISE` telemetry row
- * (issue #563 PR 3).
- *
- * The reader applies `limit` over the count of VALID rows, so
- * applying only a partial check (e.g. "has a finite surpriseScore")
- * and then deferring the rest of validation to
- * `reportBufferSurpriseDistribution` would silently count
- * schema-incomplete rows toward the limit, pushing genuinely-valid
- * earlier rows out of the report window. Validate everything the
- * downstream report requires at read time so the limit semantics and
- * the distribution semantics stay consistent.
- */
-declare function isValidBufferSurpriseEvent(value: unknown): value is BufferSurpriseEvent;
-/** Result of {@link StorageManager.writeMemory} (issue #1645). Carries the
- * persisted id PLUS the non-resurrection tombstone-block outcome (#1579) so
- * post-write callers can observe it — NEVER a silent no-op (rule 34). */
-interface MemoryWriteResult {
-    /** The persisted memory id. */
-    id: string;
-    /** True when the #1579 tombstone chokepoint downgraded this write to
-     * `pending_review` + `blockedBy`. Callers gate active post-write work on this. */
-    tombstoneBlocked: boolean;
-    /** The tombstone id that blocked the write, when `tombstoneBlocked`. */
-    blockedBy?: string;
-    /** Existing pending-review memory id when a blocked write coalesced with it. */
-    duplicateOf?: string;
-}
-/**
- * Options accepted by `StorageManager.writeMemory` (extracted verbatim in
- * issue #1989 PR2 so `SealedWriteExtras` can be derived from it — the
- * sealed-envelope path takes envelope-owned fields from the envelope and
- * everything else from these extras).
- */
-interface WriteMemoryOptions {
-    actor?: string;
-    confidence?: number;
-    tags?: string[];
-    entityRef?: string;
-    source?: string;
-    supersedes?: string;
-    lineage?: string[];
-    importance?: ImportanceScore;
-    links?: MemoryLink[];
-    intentGoal?: string;
-    intentActionType?: string;
-    intentEntityTypes?: string[];
-    artifactType?: MemoryFrontmatter["artifactType"];
-    sourceMemoryId?: string;
-    sourceTurnId?: string;
-    memoryKind?: MemoryFrontmatter["memoryKind"];
-    expiresAt?: string;
-    validAt?: string;
-    observedAt?: string;
-    eventTimeSource?: "extracted" | "assumed";
-    invalidAt?: string;
-    structuredAttributes?: Record<string, string>;
-    /**
-     * When provided, this string is used as the source for the fact-content
-     * dedup hash index instead of the persisted body (`content`).
-     *
-     * Use this when the persisted body differs from the canonical fact text
-     * — for example when `content` is a citation-annotated variant of a raw
-     * fact. Passing the raw fact as `contentHashSource` ensures that
-     * `hasFactContentHash(rawFact)` returns `true` after the write, so
-     * subsequent extractions of the same logical fact are correctly deduped
-     * even when their citation timestamp differs.
-     */
-    contentHashSource?: string;
-    /**
-     * When true, writeMemory marks the fact-hash index dirty via `.add(...)`
-     * but does NOT flush it to disk — the caller is responsible for a
-     * subsequent batch save (issue #1909). The extraction persist path sets
-     * this and relies on the orchestrator's authoritative
-     * `saveContentHashIndexes()` batch save plus a per-storage union flush,
-     * avoiding a whole-index (which grows with corpus size) rewrite per fact.
-     * Default false: every
-     * other (single-write) caller keeps the immediate, crash-safe save.
-     */
-    deferHashIndexSave?: boolean;
-    status?: MemoryStatus;
-    /**
-     * Consolidation provenance (issue #561 PR 2).  When the caller is a
-     * consolidation / supersession / dedup-merge path, these fields wire
-     * the page-version snapshots the new memory was derived from and the
-     * operator that produced it.  Persisted onto frontmatter as
-     * `derived_from` + `derived_via`; validated at serialize time.
-     */
-    derivedFrom?: string[];
-    derivedVia?: ConsolidationOperator;
-    /**
-     * Faithfulness gate verdict (issue #1576). When provided, persisted to
-     * frontmatter so downstream readers (TrustScore #1577, review queue)
-     * can consume it. Absent = gate was off or fact predates #1576.
-     */
-    faithfulness?: FaithfulnessFrontmatter;
-    /**
-     * Claim-level provenance spans (issue #1575 PR 2). When provided,
-     * persisted to frontmatter so downstream readers (memory_get, x-ray,
-     * faithfulness gate #1576) can consume them. Absent = fact predates
-     * #1575 or provenance was disabled.
-     */
-    sources?: ProvenanceSource[];
-    provenance?: "verified" | "unverified" | "none";
-    origin?: string;
-    sourceConnector?: string;
-    toolScoped?: true;
-    subject?: MemorySubject;
-}
-/**
- * `WriteMemoryOptions` minus the fields a `SealedMemoryEnvelope` owns.
- * Passing an envelope-owned field twice is a compile error by construction.
- */
-type SealedWriteExtras = Omit<WriteMemoryOptions, "confidence" | "tags" | "entityRef" | "source" | "expiresAt" | "validAt" | "structuredAttributes" | "sourceConnector" | "origin" | "subject">;
-declare class StorageManager extends TombstoneBlockedCaptureIndexHost {
-    private readonly baseDir;
-    private readonly entitySchemas?;
-    private knowledgeIndexCache;
-    private readonly deletionRevisionStore;
-    private readonly casRevisions;
-    private artifactIndexCache;
-    private projectionLedgerLagManager;
-    private static readonly loadedMemorySnapshots;
-    static readonly KNOWLEDGE_INDEX_CACHE_TTL_MS = 600000;
-    /** Read by storage/memory-read-store.ts (decomposition). */
-    static readonly ARTIFACT_INDEX_CACHE_TTL_MS = 60000;
-    private static readonly artifactWriteVersionByDir;
-    private static readonly memoryStatusVersionByDir;
-    private static readonly memoryCorpusVersionByDir;
-    private static readonly entityMutationVersionByDir;
-    private static readonly secureStoreEntityCacheKeyIds;
-    private static nextSecureStoreEntityCacheKeyId;
-    private static readonly coldWriteVersionByDir;
-    /**
-     * Process-wide default for the hot-memories result cache gate (issue #1902).
-     * Set once from config by the orchestrator/access layer via
-     * setHotMemoriesCacheDefault() so that EVERY StorageManager — including the
-     * ephemeral instances recall sub-stages (verified-recall, semantic-rule
-     * verification, ...) construct over the same dir — honors the operator's
-     * hotMemoriesCacheEnabled setting. The constructor option overrides this
-     * per-instance (tests). Defaults true (cache on).
-     */
-    private static hotMemoriesCacheDefault;
-    /**
-     * Per-memory-directory override of the hot-cache gate (issue #1902, Codex
-     * P2). setHotMemoriesCacheDefault(memoryDir, enabled) registers the
-     * operator's setting keyed by dir, so a StorageManager constructed over that
-     * dir honors ITS owning orchestrator's config — not merely the last
-     * orchestrator constructed in the process. Unregistered dirs fall back to
-     * the process-wide default above.
-     */
-    private static readonly hotMemoriesCacheDefaultByDir;
-    /**
-     * Process-wide TTL (ms) safety net for the hot cache (issue #1902). Bounds
-     * how long a version-keyed entry is served before a fresh disk scan, so
-     * external filesystem edits (manual/git/editor) that don't bump the sentinel
-     * self-heal. Set from config by the orchestrator via setHotMemoriesCacheDefault.
-     * 0 disables the TTL (version invalidation only). Default 60s.
-     */
-    private static hotMemoriesCacheTtlMs;
-    /**
-     * Per-memory-directory override of the hot-cache TTL (issue #1902, Codex P2),
-     * mirroring hotMemoriesCacheDefaultByDir. Registered by
-     * setHotMemoriesCacheDefault so two orchestrators in one process with
-     * different TTLs don't clobber each other's setting. Unregistered dirs fall
-     * back to the process-wide default above.
-     */
-    private static readonly hotMemoriesCacheTtlByDir;
-    /**
-     * Whether the process-wide hot-cache fallbacks (hotMemoriesCacheDefault /
-     * hotMemoriesCacheTtlMs) have been seeded by the first
-     * setHotMemoriesCacheDefault call (issue #1902, Cursor Low). Only the first
-     * registration seeds them; later registrations touch ONLY their per-dir map
-     * entry. This makes the process-wide fallback deterministic (first-writer,
-     * by init order) instead of last-writer-wins, so a second orchestrator with
-     * a divergent config cannot silently flip the fallback that unregistered
-     * dirs resolve to. All REGISTERED dirs are isolated by the per-dir maps.
-     */
-    private static hotMemoriesCacheProcessDefaultSeeded;
-    /**
-     * Per-memory-directory gate for scope-aware cache invalidation (issue #1904).
-     * Registered from config by the orchestrator via
-     * setScopedCacheInvalidationDefault() so every StorageManager built over a
-     * memory dir — including ephemeral recall sub-stage instances — honors the
-     * operator's setting. Unregistered dirs default to `true` (scoped on). Set
-     * `false` to restore the pre-#1904 full-clear-per-write behavior (rollback
-     * lever). Read once per write via isScopedCacheInvalidationEnabled().
-     */
-    private static readonly scopedCacheInvalidationByDir;
-    /** Read by storage/memory-read-store.ts (decomposition). */
-    static readonly COLD_SCAN_CACHE_TTL_MS = 30000;
-    /** Read by storage/memory-read-store.ts (decomposition). */
-    static readonly coldMemoriesCache: Map<string, {
-        memories: MemoryFile[];
-        loadedAt: number;
-        coldVersion: number;
-        keyId: string;
-    }>;
-    /** Read by storage/memory-read-store.ts (decomposition). */
-    static readonly QUESTIONS_CACHE_TTL_MS = 60000;
-    /** Read by storage/memory-read-store.ts (decomposition). */
-    static readonly questionsCache: Map<string, {
-        questions: Array<{
-            id: string;
-            question: string;
-            context: string;
-            priority: number;
-            resolved: boolean;
-            created: string;
-            filePath: string;
-        }>;
-        loadedAt: number;
-    }>;
-    private factHashIndex;
-    private factHashIndexLoadPromise;
-    private factHashIndexAuthoritative;
-    private factHashIndexAuthoritativePromise;
-    /**
-     * Fact-ONLY hash membership (PR #2016 / issue #2474) lives on the shared
-     * `ContentHashIndex` fact-only partition (`addFact*` / `hasFact*` /
-     * `removeFactByHash`), not a parallel set here. The partition carries only
-     * `category === "fact"` hashes and is the sole source for
-     * `hasFactContentHash`, so an over-included non-fact body can never
-     * suppress a real fact candidate. In-memory only; never persisted — every
-     * authoritative corpus rebuild repopulates it via
-     * `ContentHashIndex.clear()` + `addFactByHash`.
-     */
-    /** Optional lock/retry tuning for the fact-hash index cross-process lock (PR #2016; tests inject tight budgets). */
-    factHashIndexLockOptions: ContentHashIndexLockOptions;
-    private readonly secureAppendChains;
-    /**
-     * Cache of "is this file encrypted?" keyed by absolute path, VALIDATED by file
-     * identity (size + mtimeMs) — issue #1909 review round 10 finding 1. A prior
-     * design cached only a boolean and relied on this instance's own writes to
-     * invalidate it; a PEER process encrypting the file would not invalidate,
-     * leaving a stale `false` that made the append path write RAW bytes into an
-     * encrypted file (corruption). Now each entry records the (size, mtime) the
-     * classification was read at; `isEncryptedFileHeader` re-sniffs (header-only)
-     * whenever the on-disk identity no longer matches, so a foreign rewrite is
-     * detected. The whole-file read is still never performed.
-     */
-    private readonly secureFileEncryptionSniffCache;
-    private offlineSyncDigestCache;
-    private offlineSyncDigestCacheLoadPromise;
-    private offlineSyncDigestCacheWriteChain;
-    private offlineSyncDigestCacheWriteTimer;
-    /** Optional: set by the orchestrator after construction to enable template-aware citation stripping during legacy hash rebuild. */
-    citationTemplate: string;
-    /** Post-write catalog hook (#1522). Installed by the namespace router; fire-and-forget. */
-    onCatalogWrite?: () => void;
-    /** Post-write embedding hook (#2019). Installed by the orchestrator; fire-and-forget. */
-    onMemoryWrite?: (filePath: string) => void;
-    private notifyMemoryWrite;
-    private notifyCatalogWrite;
-    /**
-     * Whether pure state-file writes touch the namespace catalog (issue #1903).
-     * Set by `NamespaceStorageRouter.bindCatalogWriteHook` from
-     * `namespacesCatalogTouchStateWrites` (default false). State files
-     * (`state/buffer.json`, ledgers, indexes) are not namespace memory data, so by
-     * default their writes do NOT record a catalog touch.
-     */
-    touchStateWrites: boolean;
-    /**
-     * Post-write catalog hook, gated by file path (issue #1903). Namespace data
-     * (`facts/`, `cold/`, `entities/`, `artifacts/`, `profile.md`, ...) lives
-     * OUTSIDE `stateDir`, so a data write always touches; a write under `stateDir`
-     * is a pure state write and is skipped unless `touchStateWrites` is enabled.
-     */
-    protected notifyCatalogWriteForPath(filePath: string): void;
-    /** Whether `filePath` resolves to `stateDir` itself or a path contained in it. */
-    private isStateFilePath;
-    private tombstoneStore;
-    private tombstoneStoreLoadPromise;
-    private tombstonesConfig;
-    /** Page-versioning configuration.  Set by the orchestrator after construction. */
-    private _versioningConfig;
-    /** Set the page-versioning configuration.  When `enabled` is false (default), all versioning calls are no-ops. */
-    setVersioningConfig(config: VersioningConfig): void;
-    /**
-     * At-rest encryption key (issue #690 PR 3/4).
-     *
-     * When non-null, every memory file read is decrypted and every write
-     * is encrypted using the secure-fs layer.  When null, the storage
-     * layer operates in plain-text mode (legacy/unencrypted store).
-     *
-     * Set by the orchestrator after init/unlock; cleared on lock.
-     * The key buffer is NEVER logged or serialized.
-     */
-    private _secureStoreKey;
-    /**
-     * When true (and `_secureStoreKey` is non-null), new writes are
-     * encrypted.  Set to false to pause encryption of new writes while
-     * still decrypting existing files.
-     */
-    private _secureStoreEncryptOnWrite;
-    /**
-     * When true, the secure-store is configured as required — writes
-     * MUST be encrypted and a locked store MUST reject writes rather
-     * than silently falling back to plaintext.  Set by the orchestrator
-     * from `resolveRecallAuxiliaryCapabilities(config).secureStore`.
-     */
-    private _secureStoreRequired;
-    /**
-     * Set or clear the at-rest encryption key.
-     *
-     * Pass a 32-byte Buffer to enable encryption; pass null to clear
-     * (lock) the store. The caller is responsible for key lifecycle —
-     * this method does not zero the buffer on replacement; the keyring
-     * module (`keyring.ts`) owns zeroization. The setter remains synchronous
-     * for existing consumers; call `setSecureStoreKeyAndWait` when unlock must
-     * await migration.
-     */
-    setSecureStoreKey(key: Buffer | null, encryptOnWrite?: boolean): void;
-    setSecureStoreKeyAndWait(key: Buffer | null, encryptOnWrite?: boolean): Promise<void>;
-    private applySecureStoreKey;
-    private getEntityCacheSecureStoreKey;
-    /**
-     * Secure-store key identity for the version-keyed hot/archive memory caches
-     * (issue #1902, Codex P1). Scopes cached DECRYPTED corpora by the key that
-     * decrypted them, so a locked/unkeyed StorageManager for the same baseDir
-     * never reads content another instance decrypted under a key (which would
-     * bypass the locked-store error). Plaintext and locked stores share the ""
-     * namespace; an unlocked encrypted store uses its per-key id.
-     */
-    hotCacheKeyId(): string;
-    /**
-     * Resolved hot-cache gate for THIS store (issue #1902, Cursor Medium): the
-     * per-instance override if one was passed, else the per-dir/process default.
-     * Recall sub-stages (verified-recall, semantic-rule) read this to honor the
-     * operator's opt-out for their derived caches even when the caller omits the
-     * flag in options.
-     */
-    isHotCacheEnabled(): boolean;
-    /**
-     * Effective hot-cache TTL (ms) for this store's dir (issue #1902): the per-dir
-     * registration if present, else the process-wide default. 0 disables the TTL.
-     */
-    hotCacheTtlMs(): number;
-    /**
-     * True if `p` lives in this store's cold/ or archive/ tier (issue #1902,
-     * Codex P2). Determined RELATIVE to baseDir — a substring scan of the
-     * absolute path would misclassify every active path when memoryDir itself is
-     * nested under a dir literally named "cold" or "archive" (e.g.
-     * /srv/cold/remnic), skipping the patch and stranding a stale hot entry.
-     */
-    private isColdOrArchiveTierPath;
-    /**
-     * Mark the secure-store as required for this storage instance.
-     * When required and locked, writes throw SecureStoreLockedError
-     * rather than silently writing plaintext.
-     */
-    setSecureStoreRequired(required: boolean): void;
-    /** Return true iff the secure-store key is currently set (store is unlocked). */
-    isSecureStoreUnlocked(): boolean;
-    /** Whether a state-file write encrypts at rest (encrypt-on-write on AND key
-     *  set) — the write mode lifecycle compaction reserves the envelope for (#2033). */
-    willEncryptStateWrites(): boolean;
-    /**
-     * Resolve the effective write key: null when encrypt-on-write is off or the
-     * store is unlocked-optional; the key when set; else throws
-     * SecureStoreLockedError under a required-but-locked store (PR #767) instead
-     * of silently writing plaintext.
-     *
-     * `forceEncrypt` overrides the encrypt-on-write policy flag ONLY (issue
-     * #2033): a lifecycle-ledger compaction of an already-encrypted ledger/backup
-     * must preserve encryption at rest even when `secureStoreEncryptOnWrite` is
-     * paused, or it would silently downgrade encrypted state to plaintext. It
-     * never bypasses the LOCK: when the store has no key it still returns null
-     * (optional) or throws (required), so a keyless caller can never fabricate an
-     * encrypted write.
-     */
-    private resolveWriteKey;
-    /**
-     * Snapshot the current content of a page before overwriting.
-     * No-op when versioning is disabled or the file does not yet exist.
-     */
-    private snapshotBeforeWrite;
-    /**
-     * Consolidation provenance helper (issue #561 PR 2).
-     *
-     * Captures the current on-disk content of a source memory as a
-     * page-version snapshot so the downstream consolidated write can record a
-     * `derived_from` pointer that actually resolves.  Returns the
-     * `"<relative-path>:<versionId>"` entry expected by the `derived_from`
-     * frontmatter field.
-     *
-     * Returns `null` when versioning is disabled (snapshots would not be
-     * created), when the file does not exist (nothing to snapshot), or when
-     * the snapshot write itself fails (best-effort — callers skip the entry
-     * rather than block the consolidation).
-     */
-    snapshotForProvenance(filePath: string): Promise<string | null>;
-    private readonly hotMemoriesCacheEnabled;
-    constructor(baseDir: string, entitySchemas?: PluginConfig["entitySchemas"], 
-    /**
-     * Hot-memories result cache gate (issue #1902). When omitted, resolves to
-     * the per-directory default registered by setHotMemoriesCacheDefault()
-     * (falling back to the process-wide default); pass an explicit boolean to
-     * override per-instance (tests, memory-constrained readers).
-     */
-    hotMemoriesCacheEnabledOverride?: boolean);
-    /** Set the process-wide hot-memories cache default (issue #1902). The
-     *  orchestrator/access layer calls this with the operator's
-     *  hotMemoriesCacheEnabled config so the escape hatch reaches every
-     *  StorageManager, including ephemeral recall-sub-stage instances. Only an
-     *  explicit `false` disables; `undefined` (e.g. a cast test config missing
-     *  the field) leaves the cache on. */
-    static setHotMemoriesCacheDefault(memoryDir: string, enabled: boolean | undefined, ttlMs?: number): void;
-    /** Register the operator's scope-aware cache invalidation gate for a memory
-     *  dir (issue #1904). The orchestrator/access layer calls this with
-     *  the operator's scopedCacheInvalidationEnabled flag so the setting reaches every
-     *  StorageManager built over the dir, including ephemeral recall-sub-stage
-     *  instances. Only an explicit `false` disables; `undefined` leaves it on. */
-    static setScopedCacheInvalidationDefault(memoryDir: string, enabled: boolean | undefined): void;
-    /** OKF `type` emission gate registrations per memory dir (issue #1946). */
-    private static readonly okfConformanceByDir;
-    /** Register the OKF conformance gate for a memory dir. Unregistered dirs default to
-     *  conformance-on; namespace child dirs (<memoryDir>/namespaces/<tok>) inherit the
-     *  nearest registered ancestor. Only an explicit `false` disables. */
-    static setOkfConformanceDefault(memoryDir: string, enabled: boolean | undefined): void;
-    okfConformanceEnabled(): boolean;
-    /**
-     * The LIVE class object of this instance (issue #1809 review of the
-     * storage decomposition): extracted store modules must read/write the
-     * shared static caches (questionsCache, coldMemoriesCache, ...) through
-     * the SAME class binding the host methods use. Referencing the imported
-     * `StorageManager` symbol from a split bundle chunk can yield a second
-     * class copy with its own statics, split-braining the caches
-     * (resolveQuestion clears copy A while readQuestions reads copy B).
-     */
-    get storageManagerClass(): typeof StorageManager;
-    /** The root directory of this storage instance. */
-    /** MemoryReadStore (storage.ts decomposition). Lazy; selfDeps live wiring. */
-    private _memoryReadStore;
-    private get memoryReadStore();
-    /** EntityStore (storage.ts decomposition). Lazy; selfDeps live wiring. */
-    private _entityStore;
-    private get entityStore();
-    /** IdentityContinuityStore (storage.ts decomposition). Lazy; selfDeps live wiring. */
-    private _identityContinuityStore;
-    private get identityContinuityStore();
-    get dir(): string;
-    private identityFilePath;
-    private versionFilePath;
-    private bumpSharedVersion;
-    private readSharedVersion;
-    protected bumpMemoryStatusVersion(): void;
-    getMemoryStatusVersion(): number;
-    /**
-     * Entity content revision used by migration discovery and entity-page cache coherence.
-     */
-    getEntityMutationVersion(): number;
-    protected bumpEntityMutationVersion(): void;
-    /**
-     * Corpus version sentinel for the hot-memories result cache (#1902).
-     * Distinct from memory-status: bumps on EVERY memory-file mutation so the
-     * version-keyed hot cache stays coherent across processes, WITHOUT
-     * invalidating the version-keyed entity cache on every plain fact create.
-     */
-    getMemoryCorpusVersion(): number;
-    /**
-     * Bump only — NOT invalidateAllForDir (that would drop the very hot
-     * entry the write path just patched).
-     */
-    protected bumpMemoryCorpusVersion(): void;
-    getArchiveMutationVersion(): number;
-    /**
-     * Corpus bump reporting whether THIS process's append was the only one
-     * since the pre-bump size (#1902, Codex P1): the `exclusive` flag lets
-     * patchHotMemoriesCache refuse to re-key its locally patched corpus at a
-     * version already reflecting a peer's still-unread concurrent append.
-     */
-    private bumpMemoryCorpusVersionExclusive;
-    protected bumpArtifactWriteVersion(): number;
-    private getArtifactWriteVersion;
-    private get wearablesDir();
-    /**
-     * Resolve the on-disk path for a source/day transcript. Throws on
-     * malformed inputs — source ids and dates reach this from CLI/MCP/HTTP
-     * surfaces and must never become path traversal.
-     */
-    wearableTranscriptPath(sourceId: string, date: string): string;
-    writeWearableDayTranscript(sourceId: string, date: string, serialized: string): Promise<void>;
-    /** Read a stored day transcript; null when the day has no file. */
-    readWearableDayTranscript(sourceId: string, date: string): Promise<string | null>;
-    listWearableTranscriptDays(sourceId?: string): Promise<Array<{
-        source: string;
-        date: string;
-    }>>;
-    private _fusionStore?;
-    /** Derived fusion-day IO; file IO lives in wearables/fusion (#1810). */
-    fusionArtifactStore(): FusionArtifactStore;
-    private _meetingRecordStore?;
-    /**
-     * Meeting record IO (issue #1900). Records live under `<baseDir>/meetings/`
-     * — inside the QMD collection root (full-text searchable) but outside the
-     * memory scan roots — and inherit the same encrypted-at-rest + atomic-write +
-     * symlink-containment semantics as memories via the shared secure IO port.
-     */
-    meetingRecordStore(): MeetingRecordStore;
-    /**
-     * Locate a wearable-sourced memory by exact (trimmed) content,
-     * ignoring the "[Attributes: ...]" suffix writeMemory appends for
-     * structuredAttributes — callers pass the raw fact text. Used by the
-     * smart trust pipeline to find an earlier borderline write when the
-     * same fact re-extracts with stronger evidence.
-     */
-    findWearableMemoryByContent(content: string): Promise<{
-        id: string;
-        status: MemoryStatus | undefined;
-    } | null>;
-    /**
-     * Promote a pending_review wearable memory to active in place,
-     * merging updated trust evidence into structuredAttributes. Returns
-     * false when the memory is missing or no longer pending_review (a
-     * concurrent review decision wins), or when the row is tombstone-blocked
-     * (`blockedBy` — issue #1579 threads OcuDx/Ocu1l): writeMemoryFrontmatter
-     * bypasses the writeMemory chokepoint, so a blocked row must first be
-     * cleared via revokeTombstone before promotion can proceed.
-     */
-    promoteWearableMemory(id: string, attributeUpdates: Record<string, string>, confidence?: number): Promise<boolean>;
-    /**
-     * Demote a pending_review wearable memory to rejected when a re-pass
-     * produced an explicit judge-reject verdict, merging the evidence.
-     * Returns false when the memory is missing or no longer
-     * pending_review — active rows are NEVER auto-demoted (operator
-     * approvals and accrued recall signals win; contradiction scans and
-     * supersession own active-row retirement).
-     */
-    demoteWearableMemory(id: string, attributeUpdates: Record<string, string>): Promise<boolean>;
-    private get factsDir();
-    private get correctionsDir();
-    private get proceduresDir();
-    private get reasoningTracesDir();
-    private get entitiesDir();
-    private resolveEntityFilePath;
-    private readStorageSecureFile;
-    readDependencyPropagationQueueFile(filePath: string): Promise<string>;
-    writeDependencyPropagationQueueFile(filePath: string, content: string): Promise<void>;
-    protected writeStorageSecureFile(filePath: string, content: string | Buffer, forceEncrypt?: boolean): Promise<void>;
-    protected assertManagedStoragePath(filePath: string, method: string): string;
-    readDeletionRevisions(): Promise<ReadonlyMap<string, number>>;
-    hasCommittedInvalidation(memory: Pick<MemoryFile, "content" | "frontmatter">): Promise<boolean>;
-    readCasRevision: (filePath: string) => Promise<string | undefined>;
-    readCasRevisionStatus: (filePath: string) => Promise<CasRevisionReadStatus>;
-    readDurableFileDigest: (filePath: string) => Promise<string | null>;
-    protected beginDurableMemoryRevision: (pathname: string, expectedContent?: string | Buffer | null) => Promise<CasRevisionTransaction>;
-    private recordCommittedInvalidation;
-    private clearCommittedInvalidation;
-    recordReplicatedDeletionRevision(filePath: string, mtimeMs: number): Promise<void>;
-    protected writeManagedStorageFile(filePath: string, write: () => Promise<void>): Promise<void>;
-    protected deleteManagedStorageFileDurable(filePath: string, deletionMtimeMs?: number | null): Promise<boolean>;
-    readOfflineSyncFile(filePath: string): Promise<Buffer>;
-    digestOfflineSyncFile(filePath: string): Promise<{
-        sha256: string;
-        bytes: number;
-    }>;
-    private loadOfflineSyncDigestCache;
-    private readOfflineSyncDigestCache;
-    private rememberOfflineSyncDigest;
-    private scheduleOfflineSyncDigestCacheWrite;
-    private queueOfflineSyncDigestCacheWrite;
-    private offlineSyncFileIsEncrypted;
-    writeOfflineSyncStagingFile(filePath: string, content: Buffer): Promise<void>;
-    createContentHashIndex(): ContentHashIndex;
-    private appendStorageSecureFile;
-    /**
-     * Classify a file as encrypted by reading ONLY the fixed-size magic header
-     * (issue #1909), never the whole file. The result is cached per-path but
-     * VALIDATED against the file's (size, mtime) identity (review round 10 finding
-     * 1): a `stat` on each call is O(1), and the 12-byte header read happens only
-     * on a cache miss or when the on-disk identity changed — so a PEER process
-     * rewriting/encrypting the file is detected and we never append raw bytes into
-     * an encrypted body. ENOENT and short/empty files classify as not-encrypted
-     * (fall through to a plain `appendFile`).
-     */
-    private isEncryptedFileHeader;
-    private appendStorageSecureFileUnlocked;
-    private get stateDir();
-    private get offlineSyncDigestCachePath();
-    private get entitySynthesisQueuePath();
-    /**
-     * The on-disk tombstone log path. Lives under `<stateDir>/tombstones.jsonl`
-     * so it is co-located with the fact-hash index and encrypted at rest when
-     * the secure-store is enabled (the StorageManager's secure read/write
-     * helpers are injected into the store).
-     */
-    private get tombstonesPath();
-    /**
-     * Configure the tombstone invariant for this storage instance. Installed
-     * by the orchestrator after construction (same pattern as
-     * `setVersioningConfig` / `citationTemplate`). When `enabled` is false
-     * (default until the orchestrator wires config), the chokepoint check is a
-     * no-op — pre-feature behavior for rollback safety (rule 30).
-     */
-    setTombstonesConfig(config: {
-        enabled: boolean;
-        semanticMatch: boolean;
-        semanticThreshold: number;
-        namespace: string;
-    }): void;
-    private buildTombstoneStore;
-    /**
-     * Lazily load the tombstone store. Mirrors the fact-hash-index lazy-load
-     * pattern: a single in-flight load promise dedups concurrent first-access.
-     * The cross-process staleness probe lives inside the store now (#1579): on
-     * each cached access it stats its own file and invalidates if a peer process
-     * appended, so the next lookup reloads from disk. If the probe just
-     * invalidated the store, fall through to the reload branch — returning null
-     * here was the original regression (the chokepoint threw and failed OPEN).
-     */
-    getTombstoneStore(): Promise<TombstoneStore>;
-    /**
-     * Whether tombstones are enabled on this storage. Callers that need to
-     * distinguish "tombstones disabled" (null return is expected) from
-     * "persistence failed" (appendTombstone swallows store errors and also
-     * returns null) use this to fail closed when enabled (#1580 review OgIqp).
-     */
-    isTombstonesEnabled(): boolean;
-    /**
-     * Append a tombstone for a retired memory (issue #1579 emitters).
-     * Best-effort: a tombstone append failure MUST NOT fail the supersession /
-     * correction that triggered it (gotcha #13 / rule 34). The memory is
-     * already retired on disk; the tombstone is the non-resurrection guard.
-     */
-    appendTombstone(input: {
-        reason: TombstoneReason;
-        createdBy: TombstoneCreatedBy;
-        sourceMemoryId: string;
-        rawContent: string;
-        entityRef?: string;
-        supersessionKey?: string;
-        operationKey?: string;
-        createdAt?: string;
-        contentHash?: string;
-    }): Promise<string | null>;
-    hasExactTombstone(input: {
-        sourceMemoryId: string;
-        contentHash?: string;
-        entityRef?: string;
-        supersessionKey?: string;
-        createdAt?: string;
-        operationKey?: string;
-    }): Promise<boolean>;
-    /**
-     * Revoke a tombstone (re-allow the content). Used by the review-queue
-     * approval path when an operator approves a blocked memory.
-     */
-    revokeTombstone(tombstoneId: string, createdBy: TombstoneCreatedBy): Promise<string | null>;
-    /** Aggregate tombstone stats for `remnic doctor`. */
-    getTombstoneStats(): Promise<TombstoneStats | null>;
-    /**
-     * Rebuild the tombstone log from retired memories on disk. Exposed for
-     * `remnic doctor --rebuild-tombstones` and tests.
-     */
-    rebuildTombstonesFromFiles(): Promise<number>;
-    protected markFactHashIndexNotAuthoritative(): void;
-    protected tombstoneBlockedCaptureIndexOptions(): TombstoneBlockedCaptureIndexOptions;
-    private getFactHashIndex;
-    /**
-     * Return the fact-hash index after ensuring it is authoritative — i.e. rebuilt
-     * from the durable fact corpus (issue #1909 review round 12). This is the ONE
-     * coherent dedup source: the orchestrator's dedup layer
-     * (contentHashIndexForStorage) shares THIS instance instead of loading a raw,
-     * possibly-stale fact-hashes.txt, so after a crash+restart the orchestrator's
-     * hasContentHashDedup sees the same corpus-rebuilt hashes StorageManager does
-     * and never re-creates a fact whose per-write flush was deferred and lost.
-     */
-    getAuthoritativeFactHashIndex(): Promise<ContentHashIndex>;
-    /**
-     * Return the shared fact-hash index instance, corpus-rebuilt under the lock
-     * when the lock is free. Unlike {@link getAuthoritativeFactHashIndex} this
-     * NEVER throws on lock contention — it returns the shared instance (the loaded
-     * snapshot when a locked rebuild could not run) so registration writes still
-     * land in the one shared index and reconcile to disk. Callers that trust a
-     * dedup MISS MUST also consult {@link isFactContentHashAuthoritative} and
-     * confirm against the corpus when it is false (PR #2016).
-     */
-    getSharedFactHashIndex(): Promise<ContentHashIndex>;
-    private ensureFactHashIndexAuthoritative;
-    /**
-     * Repopulate `factHashIndex` in memory from the durable HOT+COLD corpus. Runs
-     * WHILE the per-index cross-process lock is held (see
-     * ContentHashIndex.rebuildUnderLock, which publishes the rebuilt set); this
-     * method itself never writes to disk.
-     */
-    private rebuildFactHashIndexFromCorpus;
-    private storedContentIdentityCandidates;
-    /** Returns the current body identity while preserving explicit external identities. */
-    private corpusRegisteredHashes;
-    private get questionsDir();
-    private get artifactsDir();
-    private get identityDir();
-    private get identityAnchorPath();
-    private get identityIncidentsDir();
-    private get identityAuditsWeeklyDir();
-    private get identityAuditsMonthlyDir();
-    private get identityImprovementLoopsPath();
-    private get identityReflectionsPath();
-    private get profilePath();
-    private get memoryActionsPath();
-    private get memoryLifecycleLedgerPath();
-    private get compressionGuidelinesPath();
-    private get compressionGuidelineDraftPath();
-    private get compressionGuidelineStatePath();
-    private get compressionGuidelineDraftStatePath();
-    private get behaviorSignalsPath();
-    /**
-     * In-memory dedup key set for behavior-signals appends (issue #1909),
-     * validated by (size, mtime) file identity like the catalog `compactedCache`.
-     * Avoids re-reading + JSON.parsing the whole `behavior-signals.jsonl` on
-     * every append. A foreign write changes size/mtime, forcing a reload; this
-     * process's own appends refresh the identity in place. null => reload.
-     */
-    private behaviorSignalsKeyCache;
-    /**
-     * Per-instance serializer for `appendBehaviorSignals` (issue #1909 review
-     * round 3). The read→dedup→append→cache-commit transaction must run to
-     * completion before the next append starts; otherwise two concurrent callers
-     * each snapshot their own `existingKeys`, and the later one commits an
-     * INCOMPLETE set under the final file identity, so a subsequent call
-     * cache-hits a set missing the earlier batch and writes duplicate signals.
-     * The `.catch` links keep the chain alive after a rejected append
-     * (AGENTS.md #28).
-     */
-    private behaviorSignalsAppendChain;
-    /**
-     * Buffer surprise telemetry ledger (issue #563 PR 3).
-     *
-     * Append-only JSONL of per-turn `BUFFER_SURPRISE` events emitted by
-     * `SmartBuffer` when `bufferSurpriseTriggerEnabled` is on. Each row
-     * captures the score, the threshold in force at the time, whether the
-     * turn caused an extract_now upgrade, and the buffer size. Kept in
-     * `state/` alongside the other append-only ledgers so cleanup and
-     * governance sweeps can treat it uniformly.
-     */
-    private get bufferSurpriseLedgerPath();
-    /**
-     * Entity alias table loaded from THIS store's config/aliases.json.
-     * Instance-scoped on purpose (issue #1534): multiple StorageManager
-     * instances in one process (namespaces, hosted profiles, tenants) must
-     * never share alias state — the previous module-level table let whichever
-     * store loaded last rewrite every other store's canonical entity ids.
-     */
-    private userAliases;
-    private readonly historicalEntityCanonicalIds;
-    private currentHistoricalIds;
-    /** Post-persist repair subsystem (issue #2213) — storage/entity-ref-repair.ts. */
-    private _entityRefRepair;
-    private get entityRefRepair();
-    private readonly entityCanonicalIdMigration;
-    normalizeEntityName(raw: string, type: string): string;
-    /**
-     * Read-only view of this store's user alias table, for call sites that
-     * normalize outside the manager (pass it to the free `normalizeEntityName`).
-     */
-    get entityAliases(): Readonly<Record<string, string>>;
-    /**
-     * Reload user-defined entity aliases from config/aliases.json in the memory
-     * store. File format: { "variant": "canonical", ... }. The constructor
-     * already loads aliases, so this is only needed to pick up file changes
-     * (e.g. orchestrator.initialize() re-running on a live instance).
-     * Non-object payloads and non-string or empty alias values are ignored.
-     */
-    loadAliases(): Promise<void>;
-    private loadAliasesSync;
-    private runLegacyEntityCanonicalIdMigration;
-    ensureDirectories(): Promise<void>;
-    /**
-     * Resolve the on-disk write path for a memory of the given category, creating
-     * the target directory. Category routing goes through the shared
-     * `getCategoryDir()` chokepoint (utils/category-dir.ts → CATEGORY_DIR_MAP) so
-     * decision/preference/moment/etc. outputs land in their dedicated dirs
-     * (`decisions/`, `preferences/`, ...) instead of collapsing into `facts/`
-     * (issue #1546; CLAUDE.md rule 39). `correction` keeps its historical flat
-     * layout (no `<date>` subdir) as the corrections pipeline expects; every other
-     * category — including `fact`/`entity`, which fall back to `facts/` — is dated
-     * as `<dir>/<date>/`. Read/scan/reindex already iterate every category dir
-     * (RECALL_FALLBACK_DIRS; QMD scans baseDir recursively), so writes stay found.
-     */
-    private resolveCategoryWritePath;
-    private findExistingTombstoneBlockedMemory;
-    /** Derive the inert OKF `type` at the serialization choke point when conformance is on
-     *  and the parsed frontmatter carried none (issue #1946). Never touches `category`. */
-    private withOkfType;
-    writeMemory(category: MemoryCategory, content: string, options?: WriteMemoryOptions): Promise<{
-        id: string;
-        tombstoneBlocked: boolean;
-        blockedBy: string | undefined;
-        duplicateOf: string;
-        memory: MemoryFile;
-    } | {
-        memory: {
-            path: string;
-            frontmatter: MemoryFrontmatter;
-            content: string;
-        };
-        blockedBy?: string | undefined;
-        id: string;
-        tombstoneBlocked: boolean;
-        duplicateOf?: undefined;
-    }>;
-    /**
-     * Sealed-envelope write entry point (issue #1989 PR2).
-     *
-     * Byte-identity with `writeMemory` is BY DELEGATION: the envelope-owned
-     * fields are unpacked into the exact `writeMemory` arguments a legacy
-     * caller would have passed, so the persisted output is produced by the
-     * same code path. The composer's `persistedBody` was assembled with the
-     * same `assemblePersistedBody` helper `writeMemory` uses, so fingerprints
-     * derived from the envelope match the stored body (§13).
-     *
-     * Differences from a raw `writeMemory` call are REJECTIONS, not silent
-     * changes: the composer enforces tag/attribute caps, strict validAt, and
-     * plain-object attributes that the legacy path never validated.
-     *
-     * `envelope.ttl` maps to `expiresAt` verbatim; converting duration
-     * expressions (`"90d"`) to instants remains the access layer's job (PR3).
-     * `envelope.sourceReason` is access-layer metadata with no frontmatter
-     * field and is deliberately not persisted here.
-     */
-    writeSealedMemory(envelope: SealedMemoryEnvelope, extras?: SealedWriteExtras): Promise<{
-        id: string;
-        tombstoneBlocked: boolean;
-        blockedBy: string | undefined;
-        duplicateOf: string;
-        memory: MemoryFile;
-    } | {
-        memory: {
-            path: string;
-            frontmatter: MemoryFrontmatter;
-            content: string;
-        };
-        blockedBy?: string | undefined;
-        id: string;
-        tombstoneBlocked: boolean;
-        duplicateOf?: undefined;
-    }>;
-    hasFactContentHash(content: string): Promise<boolean>;
-    private factContentHashPresentInCorpus;
-    private factContentHashesForRemoval;
-    /** Publish `hashes` for an ACTIVE fact through the SAME locked reconcile the write path uses. */
-    private publishActiveFactHashes;
-    /**
-     * Register an EXPLICITLY computed content hash for an active fact (issue
-     * #2330 round N+16 C): the degraded merge repair indexes the COMMITTED
-     * body while the persisted `frontmatter.contentHash` is the stale
-     * PRE-merge identity. Round N+20 (B): body-coupled (`expectedContent`) —
-     * repair), so no obsolete hash lands on a newer record. No-op otherwise.
-     */
-    registerFactContentHash(memoryId: string, contentHash: string, expectedContent: string): Promise<void>;
-    private addActiveFactContentHash;
-    /**
-     * Re-register a fact's contentHash in the dedup index after a tombstone
-     * block is lifted on approval (issue #1579 thread ObnTy): `writeMemory`
-     * skips registration for tombstone-blocked facts (rule 44), so a promoted
-     * fact must re-enter the index or the next extraction of the same content
-     * creates a second active fact. No-op for non-facts or inactive facts.
-     */
-    restoreFactHashAfterApproval(memoryId: string): Promise<void>;
-    private syncFactHashIndexAfterRewrite;
-    removeFactContentHashesForMemories(memories: MemoryFile[]): Promise<void>;
-    /**
-     * Remove a memory's fact-ONLY partition membership in lockstep with the
-     * shared, category-agnostic index removal the orchestrator's
-     * `removeContentHashForMemory` performs on archival / semantic
-     * consolidation (PR #2016 threads SDzOP / SDzOR). Without this, the
-     * partition kept a removed/superseded fact's hash and `hasFactContentHash`
-     * returned a stale `true` until the next corpus rebuild, so wearable /
-     * explicit-capture / promotion callers skipped a valid write. No-op when
-     * the fact-hash index has not been loaded in this process yet (the
-     * partition is empty then and the corpus rebuild excludes the removed
-     * memory). No-op for non-facts.
-     */
-    removeFactOnlyHashForMemory(memory: MemoryFile): void;
-    isFactContentHashAuthoritative(): Promise<boolean>;
-    writeArtifact(quote: string, options?: {
-        actor?: string;
-        tags?: string[];
-        confidence?: number;
-        artifactType?: MemoryFrontmatter["artifactType"];
-        sourceMemoryId?: string;
-        sourceTurnId?: string;
-        intentGoal?: string;
-        intentActionType?: string;
-        intentEntityTypes?: string[];
-        sourceConnector?: string;
-        origin?: string;
-        toolScoped?: true;
-    }): Promise<string>;
-    private readAllArtifactsCached;
-    searchArtifacts(query: string, maxResults: number, options?: ArtifactSearchOptions): Promise<MemoryFile[]>;
-    writeEntity(name: string, type: string, facts: string[], options?: {
-        timestamp?: string;
-        source?: string;
-        sessionKey?: string;
-        principal?: string;
-        origin?: string;
-        structuredSections?: EntityStructuredSection[];
-    }): Promise<string>;
-    readProfile(): Promise<string>;
-    writeProfile(content: string): Promise<void>;
-    private static normalizeForDedup;
-    /**
-     * Check if a new bullet is a fuzzy duplicate of any existing bullet.
-     * Returns true if the new bullet should be skipped.
-     */
-    private static isFuzzyDuplicate;
-    appendToProfile(updates: string[]): Promise<void>;
-    /** Check if profile.md exceeds the max line cap and needs LLM consolidation */
-    profileNeedsConsolidation(triggerLines?: number): Promise<boolean>;
-    private rememberMemorySnapshot;
-    private rememberMemorySnapshots;
-    readAllMemories(options?: CorpusReadOptions): Promise<MemoryFile[]>;
-    /** Invalidate the readAllMemories() cache after writes that add/remove memories. */
-    /** Public cache invalidation for callers that need authoritative disk reads
-     *  (e.g. projection verify/rebuild). */
-    invalidateAllMemoriesCacheForDir(): void;
-    /** Invalidate only the cache layers affected by direct tier file deletes. */
-    invalidateMemoryCachesForTiers(tiers: Iterable<"hot" | "cold" | "archive">): void;
-    /** Clear ALL static caches. Use in tests that write files directly
-     *  (bypassing StorageManager.writeMemory) to avoid stale reads. */
-    static clearAllStaticCaches(): void;
-    /** Cancel any in-flight concurrent read so the next readAllMemories()
-     *  starts a fresh disk scan and sees the just-written data.
-     *
-     *  Finding UvBq (PR #402 round-11): this method intentionally does NOT
-     *  invalidate the cold-scan cache.  Ordinary hot-tier writes (writeMemory)
-     *  do not change cold-tier content, so evicting the cold cache on every hot
-     *  write was defeating the burst-dedup optimisation — the cold cache was
-     *  cleared before applyTemporalSupersession ran, causing a full cold-tree
-     *  disk scan on every write in a burst.  Cold cache invalidation is handled
-     *  exclusively by invalidateColdMemoriesCache(), which is called only when
-     *  cold content actually changes (hot→cold demotions, writeMemoryFileAtomic
-     *  inside cold/, archiveMemory, etc.). */
-    protected invalidateAllMemoriesCache(): void;
-    /**
-     * Single-file write/delete fast path for the hot-memories cache (issue
-     * #1902). Keeps THIS process's version-keyed corpus entry warm by patching
-     * the changed memory in place, bumps the dedicated `.memory-corpus-version.log`
-     * sentinel so PEER processes rescan (memory-status is deliberately NOT bumped
-     * here so plain creates/content edits don't invalidate the entity cache), and
-     * evicts only the derived/global layers (which
-     * are cheap to rebuild and are never patched). Mirrors the in-flight-dedup
-     * and tombstone-store invalidation that invalidateAllMemoriesCache() does.
-     *
-     * `added` is the written MemoryFile (writes/overwrites); `removedPath` is a
-     * deleted path. A path outside the active scan roots (under cold/ or
-     * archive/) is NOT applied to the hot map — that cache holds active memories
-     * only — but the version bump and derived/global eviction still run so
-     * coherence is preserved. Bulk/ambiguous mutations keep the wholesale
-     * invalidateAllMemoriesCache() drop instead (issue #1902 Step 5).
-     */
-    private patchHotMemoriesCache;
-    /**
-     * Invalidate the cold-scan cache for this storage root and bump the
-     * on-disk cold-version sentinel so that other processes (gateway, CLI) see
-     * the change immediately on their next readAllColdMemories() call.
-     *
-     * Must be called whenever a memory is written INTO the cold tier — hot→cold
-     * demotion, atomic writes inside cold/, archiving a cold memory, etc.
-     * NOT called on ordinary hot-tier writes (those don't change cold contents).
-     *
-     * Finding UvUy (PR #402 round-11): bumping the sentinel here makes the
-     * per-process in-memory cache safe across process boundaries.
-     */
-    protected invalidateColdMemoriesCache(): void;
-    /** Return the current cold-write version counter for this storage root.
-     *  Reads the on-disk sentinel (state/cold-write.log) so it reflects writes
-     *  made by other processes. */
-    private readColdWriteVersion;
-    /** Bump the on-disk cold-write version sentinel and update the in-process
-     *  fallback map.  Called by invalidateColdMemoriesCache(). */
-    private bumpColdWriteVersion;
-    private normalizeMemoryReadBatchSize;
-    /**
-     * Public cheap active-memory path scan (issue #2149 corpus watermark). Lists
-     * active memory file paths without parsing frontmatter — safe on a 100k+
-     * corpus, unlike readAllMemories().
-     */
-    collectActiveMemoryPaths(options?: {
-        propagateReadErrors?: boolean;
-    } & CorpusReadOptions): Promise<string[]>;
-    /**
-     * Public cheap cold-tier path scan (issue #2156 finding D corpus census).
-     * Lists demoted-but-reachable memory paths under `cold/` without parsing
-     * frontmatter, so the divergence watermark counts the cold tier too.
-     */
-    collectColdMemoryPaths(options?: {
-        propagateReadErrors?: boolean;
-    }): Promise<string[]>;
-    /**
-     * Combined hot+cold corpus-mutation sentinel (issue #2156). Changes whenever
-     * EITHER tier is written, so a divergence census can bracket its hot/cold scan
-     * and detect a tier migration (write-cold-then-unlink-hot) racing the walkers,
-     * then retry for a consistent snapshot instead of caching a transient
-     * double-count or miss.
-     */
-    getCorpusScanVersion(): string;
-    private readParsedMemoriesFromPaths;
-    private readWindowUpdatedMs;
-    private filterWindowPathsByUpdatedAfter;
-    private orderWindowPaths;
-    private readWindowBoundedBatch;
-    readMemoriesWindow(options?: WindowedMemoryReadOptions): Promise<WindowedMemoryReadResult>;
-    private _readAllMemoriesFromDisk;
-    readAllColdMemories(): Promise<MemoryFile[]>;
-    /**
-     * Read archived memory markdown files under archive/.
-     * Used by long-term recall fallback when hot recall has no hits.
-     */
-    readArchivedMemories(): Promise<MemoryFile[]>;
-    readMemoryByPath(filePath: string): Promise<MemoryFile | null>;
-    private resolveTierRootDir;
-    private resolveMemoryDateDir;
-    private isArtifactMemory;
-    buildTierMemoryPath(memory: MemoryFile, tier: "hot" | "cold"): string;
-    private writeMemoryFileAtomic;
-    moveMemoryToPath(memory: MemoryFile, targetPath: string): Promise<boolean>;
-    migrateMemoryToTier(memory: MemoryFile, targetTier: "hot" | "cold"): Promise<{
-        changed: boolean;
-        targetPath: string;
-    }>;
-    private get archiveDir();
-    /**
-     * Archive a memory by moving it from facts/ to archive/YYYY-MM-DD/.
-     * Updates frontmatter with archived status before moving.
-     * Returns the new file path on success, null on failure.
-     */
-    archiveMemory(memory: MemoryFile, lifecycle?: MemoryLifecycleEventWriteOptions): Promise<string | null>;
-    /** Alias of listEntityNames (kept for legacy callers; sorted). */
-    readEntities(): Promise<string[]>;
-    readEntity(name: string): Promise<string>;
-    listEntityNames(): Promise<string[]>;
-    /**
-     * Find an existing entity that fuzzy-matches the proposed name.
-     * Returns the existing entity filename (without .md) or null if no match.
-     *
-     * Matching priority:
-     * 1. Exact normalized match (handled by normalizeEntityName already)
-     * 2. Dehyphenated match: "jane-doe" vs "janedoe"
-     * 3. Substring containment: "handle-janedoe" contains "janedoe"
-     * 4. Levenshtein ≤ 2 on dehyphenated names
-     */
-    findMatchingEntity(proposedName: string, type: string): Promise<string | null>;
-    invalidateMemory(id: string, expectedSnapshot?: Pick<MemoryFile, "content" | "frontmatter"> & Partial<Pick<MemoryFile, "path">>, options?: {
-        recordCommitProof?: boolean;
-    }): Promise<boolean>;
-    /** Commit the new body and return the CAS commit receipt — the sidecar
-     * revision token, never `frontmatter.updated` (#2813 P1, #2807). */
-    private updateMemoryFromCurrent;
-    updateMemory(id: string, newContent: string, options?: {
-        supersedes?: string;
-        lineage?: string[];
-        actor?: string;
-        sourceConnector?: string;
-    }): Promise<boolean>;
-    /** CAS content update: false when the record moved past `expected`; on
-     * success the commit receipt — the only identity that can attribute a standing body later (#2813 P1, #2807). */
-    updateMemoryIfUnchanged(expected: MemoryFile, newContent: string, options?: {
-        supersedes?: string;
-        lineage?: string[];
-        actor?: string;
-        sourceConnector?: string;
-    }): Promise<string | false>;
-    /**
-     * Update frontmatter fields without changing memory content. Returns false when the memory is not found.
-     */
-    writeMemoryFrontmatter(memory: MemoryFile, patch: Partial<MemoryFrontmatter>, lifecycle?: MemoryLifecycleEventWriteOptions): Promise<boolean>;
-    /**
-     * Update frontmatter only when the persisted memory still matches the
-     * expected semantic snapshot.
-     */
-    writeMemoryFrontmatterIfUnchanged(expected: MemoryFile, patch: Partial<MemoryFrontmatter>, lifecycle?: MemoryLifecycleEventWriteOptions): Promise<boolean>;
-    /**
-     * Update frontmatter by memory ID.
-     * Prefer writeMemoryFrontmatter(memory, patch) in batch loops to avoid full-corpus rescans.
-     */
-    updateMemoryFrontmatter(id: string, patch: Partial<MemoryFrontmatter>): Promise<boolean>;
-    /** Remove memories past their TTL expiresAt date */
-    cleanExpiredTTL(): Promise<MemoryFile[]>;
-    loadBuffer(): Promise<BufferState>;
-    saveBuffer(state: BufferState): Promise<void>;
-    loadMeta(): Promise<MetaState>;
-    saveMeta(state: MetaState): Promise<void>;
-    appendMemoryActionEvents(events: MemoryActionEvent[]): Promise<number>;
-    appendContextTransformRecords(records: ContextTransformTelemetryRecord[]): Promise<number>;
-    readContextTransformRecords(limit?: number): Promise<ContextTransformTelemetryRecord[]>;
-    appendMemoryLifecycleEvents(events: MemoryLifecycleEvent[]): Promise<number>;
-    /** Drain the durable pending lifecycle-append spill into the ledger (#2033);
-     *  fast no-op when nothing is pending. Returns true when rows were drained. */
-    drainPendingMemoryLifecycleEvents(): Promise<boolean>;
-    /** Offline-sync pre-snapshot drain (#2033): fold pending lifecycle spills into
-     *  the active ledger and report whether durable rows STILL remain in the
-     *  offline-sync-EXCLUDED pending queue. The caller aborts the snapshot when
-     *  `pendingDeferred` is true so append-only rows are never silently omitted. */
-    drainPendingMemoryLifecycleEventsForSync(): Promise<DrainPendingLifecycleForSyncResult>;
-    /** Drain pending lifecycle spills for any ledger inside this storage root.
-     * The offline CLI uses this path-aware variant for per-namespace ledgers so
-     * secure-store encryption and path-bound authentication remain consistent. */
-    drainPendingMemoryLifecycleEventsForSyncAt(ledgerPath: string): Promise<DrainPendingLifecycleForSyncResult>;
-    /** Rewrite the ledger through the secure writer (#1910); re-encrypts when unlocked, throws when locked.
-     *  `targetPath` re-encrypts under a decryptable backup path's own AAD;
-     *  Buffer content passes through verbatim (#2033). `forceEncrypt` preserves
-     *  encryption at rest for an already-encrypted ledger/backup even when the
-     *  `secureStoreEncryptOnWrite` policy is paused, so a compaction never
-     *  downgrades encrypted state to plaintext (#2033); it never bypasses the lock. */
-    writeMemoryLifecycleLedgerContent(content: string | Buffer, targetPath?: string, forceEncrypt?: boolean): Promise<void>;
-    appendBufferSurpriseEvents(events: BufferSurpriseEvent[]): Promise<number>;
-    readBufferSurpriseEvents(options?: {
-        limit?: number;
-    }): Promise<BufferSurpriseEvent[]>;
-    appendBehaviorSignals(events: BehaviorSignalEvent[]): Promise<number>;
-    private appendBehaviorSignalsUnlocked;
-    appendReextractJobs(events: ReextractJobRequest[]): Promise<number>;
-    readReextractJobs(limit?: number): Promise<ReextractJobRequest[]>;
-    readBehaviorSignals(limit?: number): Promise<BehaviorSignalEvent[]>;
-    readMemoryActionEvents(limit?: number): Promise<MemoryActionEvent[]>;
-    readMemoryActionEventRows(limit?: number): Promise<Array<{
-        line: number;
-        event: MemoryActionEvent;
-    }>>;
-    readAllMemoryLifecycleEvents(): Promise<MemoryLifecycleEvent[]>;
-    /** Raw decrypted ledger bytes as a Buffer, never a string, so an oversized
-     *  ledger cannot throw on decode before recovery (#2033). */
-    readMemoryLifecycleLedgerRawBufferForCompaction(): Promise<Buffer>;
-    readAllMemoryLifecycleEventsForCompaction(): Promise<MemoryLifecycleEvent[]>;
-    readMemoryLifecycleEvents(limit?: number): Promise<MemoryLifecycleEvent[]>;
-    writeCompressionGuidelines(content: string): Promise<void>;
-    readCompressionGuidelines(): Promise<string | null>;
-    writeCompressionGuidelineDraft(content: string): Promise<void>;
-    readCompressionGuidelineDraft(): Promise<string | null>;
-    writeCompressionGuidelineOptimizerState(state: CompressionGuidelineOptimizerState): Promise<void>;
-    writeCompressionGuidelineDraftState(state: CompressionGuidelineOptimizerState): Promise<void>;
-    readCompressionGuidelineOptimizerState(): Promise<CompressionGuidelineOptimizerState | null>;
-    readCompressionGuidelineDraftState(): Promise<CompressionGuidelineOptimizerState | null>;
-    activateCompressionGuidelineDraft(options?: {
-        expectedContentHash?: string;
-        expectedGuidelineVersion?: number;
-    }): Promise<boolean>;
-    private readCompressionGuidelineStateFile;
-    writeIdentityAnchor(content: string): Promise<void>;
-    readIdentityAnchor(): Promise<string | null>;
-    appendContinuityIncident(input: ContinuityIncidentOpenInput): Promise<ContinuityIncidentRecord>;
-    readContinuityIncidents(limit?: number, state?: "open" | "closed" | "all"): Promise<ContinuityIncidentRecord[]>;
-    closeContinuityIncident(id: string, closure: ContinuityIncidentCloseInput): Promise<ContinuityIncidentRecord | null>;
-    writeIdentityAudit(period: "weekly" | "monthly", key: string, content: string): Promise<string>;
-    readIdentityAudit(period: "weekly" | "monthly", key: string): Promise<string | null>;
-    writeIdentityImprovementLoops(content: string): Promise<void>;
-    readIdentityImprovementLoops(): Promise<string | null>;
-    readIdentityImprovementLoopRegister(): Promise<ContinuityImprovementLoop[]>;
-    upsertIdentityImprovementLoop(input: ContinuityLoopUpsertInput): Promise<ContinuityImprovementLoop>;
-    reviewIdentityImprovementLoop(id: string, input: ContinuityLoopReviewInput): Promise<ContinuityImprovementLoop | null>;
-    private generateId;
-    writeQuestion(question: string, context: string, priority: number): Promise<string>;
-    readQuestions(opts?: {
-        unresolvedOnly?: boolean;
-    }): Promise<Array<{
-        id: string;
-        question: string;
-        context: string;
-        priority: number;
-        resolved: boolean;
-        created: string;
-        filePath: string;
-    }>>;
-    /** Invalidate the questions cache (call after writing a question). */
-    invalidateQuestionsCache(): void;
-    private parseQuestionFile;
-    resolveQuestion(id: string): Promise<boolean>;
-    readIdentity(workspaceDir: string, namespace?: string): Promise<string>;
-    writeIdentity(workspaceDir: string, content: string, namespace?: string): Promise<void>;
-    /** Max size for IDENTITY.md before we stop appending reflections (15KB leaves room under 20KB gateway limit) */
-    private static readonly IDENTITY_MAX_BYTES;
-    /** Minimum interval between reflections (1 hour) */
-    private static readonly REFLECTION_COOLDOWN_MS;
-    appendToIdentity(workspaceDir: string, reflection: string, opts?: {
-        hygiene?: FileHygieneConfig;
-        namespace?: string;
-    }): Promise<void>;
-    readIdentityReflections(): Promise<string | null>;
-    writeIdentityReflections(content: string): Promise<void>;
-    appendIdentityReflection(reflection: string): Promise<void>;
-    addEntityRelationship(name: string, rel: EntityRelationship): Promise<void>;
-    addEntityActivity(name: string, entry: EntityActivityEntry, maxEntries: number): Promise<void>;
-    addEntityAlias(name: string, alias: string): Promise<void>;
-    updateEntitySynthesis(name: string, synthesis: string, options?: {
-        entityUpdatedAt?: string;
-        synthesisStructuredFactCount?: number;
-        synthesisStructuredFactDigest?: string;
-        synthesisTimelineCount?: number;
-        updatedAt?: string;
-        incrementVersion?: boolean;
-    }): Promise<void>;
-    /** Backward-compatible alias for legacy callers/tests. */
-    updateEntitySummary(name: string, summary: string): Promise<void>;
-    readEntitySynthesisQueue(): Promise<string[]>;
-    refreshEntitySynthesisQueue(): Promise<string[]>;
-    removeEntitySynthesisQueueEntries(entityNames: string[]): Promise<void>;
-    migrateEntityFilesToCompiledTruthTimeline(): Promise<{
-        total: number;
-        migrated: number;
-    }>;
-    readAllEntityFiles(options?: CorpusReadOptions): Promise<EntityFile[]>;
-    /**
-     * Score an entity based on recency, frequency, activity, type priority,
-     * and relationship density.
-     *
-     * score = recency*0.40 + frequency*0.25 + activity*0.15 + typePriority*0.10 + relationshipDensity*0.10
-     */
-    static scoreEntity(entity: EntityFile, now: Date): number;
-    buildKnowledgeIndex(config: PluginConfig, overrides?: {
-        maxEntities?: number;
-        maxChars?: number;
-    }): Promise<{
-        result: string;
-        cached: boolean;
-    }>;
-    /** Invalidate the Knowledge Index cache (call after entity mutations). */
-    invalidateKnowledgeIndexCache(): void;
-    /** Max lines for profile.md before LLM consolidation triggers */
-    private static readonly PROFILE_MAX_LINES;
-    mergeFragmentedEntities(): Promise<number>;
-    cleanExpiredCommitments(decayDays: number): Promise<MemoryFile[]>;
-    /**
-     * Flush batched access tracking updates to disk.
-     * Called during consolidation or when buffer exceeds max size.
-     */
-    flushAccessTracking(entries: AccessTrackingEntry[]): Promise<number>;
-    getMemoryById(id: string): Promise<MemoryFile | null>;
-    getMemoryByIdIncludingArchived(id: string): Promise<MemoryFile | null>;
-    /** Resolve existing active memory IDs through a lightweight directory scan. */
-    findExistingMemoryPaths(ids: string[], preferredPaths?: Map<string, string[]>): Promise<Map<string, string[]>>;
-    /**
-     * Check which of the given memory IDs actually exist on disk.
-     */
-    filterExistingMemoryIds(ids: string[]): Promise<Set<string>>;
-    getProjectedMemoryState(id: string): Promise<MemoryProjectionCurrentState | null>;
-    browseProjectedMemories(options: ProjectedMemoryBrowseOptions): Promise<ProjectedMemoryBrowsePage | null>;
-    getProjectedGovernanceRecord(): Promise<ReturnType<typeof readProjectedGovernanceRecord>>;
-    private toProjectedCurrentState;
-    getMemoryTimeline(memoryId: string, limit?: number): Promise<MemoryLifecycleEvent[]>;
-    /**
-     * Write a memory chunk with parent reference.
-     * Chunk IDs follow format: {parentId}-chunk-{index}
-     */
-    writeChunk(parentId: string, chunkIndex: number, chunkTotal: number, category: MemoryCategory, content: string, options?: {
-        confidence?: number;
-        tags?: string[];
-        entityRef?: string;
-        source?: string;
-        importance?: ImportanceScore;
-        intentGoal?: string;
-        intentActionType?: string;
-        intentEntityTypes?: string[];
-        memoryKind?: MemoryFrontmatter["memoryKind"];
-        validAt?: string;
-        /** Lifecycle status (issue #1576): pending_review chunks stay out of active recall. */
-        status?: MemoryStatus;
-        /**
-         * Tombstone block provenance (issue #1645): when the parent fact was
-         * tombstone-blocked, propagate the tombstone id onto each chunk so an
-         * independently-surfaced chunk (memory_get/x-ray/doctor) reveals the block
-         * and the chunk stays pending_review, never an active resurrection.
-         */
-        blockedBy?: string;
-        /** Faithfulness gate verdict (issue #1576), propagated from the parent fact. */
-        faithfulness?: FaithfulnessFrontmatter;
-        /** Claim-level provenance spans (issue #1575 PR 2), propagated from the parent fact so a chunk surfaced independently (memory_get/x-ray) preserves them (chatgpt-codex-connector thread Ocvmo). */
-        sources?: ProvenanceSource[];
-        /** Coarse provenance tag (issue #1575 PR 2), propagated from the parent. */
-        provenance?: "verified" | "unverified" | "none";
-        invalidAt?: string;
-        observedAt?: string;
-        eventTimeSource?: "extracted" | "assumed";
-        sourceConnector?: string;
-        origin?: string;
-        toolScoped?: true;
-    }): Promise<string>;
-    /**
-     * Get all chunks for a given parent memory ID.
-     * Returns chunks sorted by chunkIndex.
-     */
-    getChunksForParent(parentId: string): Promise<MemoryFile[]>;
-    supersedeMemory(oldMemoryId: string, newMemoryId: string, reason: string, supersessionMetadata?: Pick<MemoryFrontmatter, "supersessionCause" | "invalidatedBy">, options?: {
-        actor?: string;
-        requireActive?: boolean;
-        acceptExactReplay?: boolean;
-        expectedSnapshot?: Pick<MemoryFile, "content" | "frontmatter"> & Partial<Pick<MemoryFile, "path">>;
-        audit?: SupersessionAuditOptions;
-    }): Promise<boolean>;
-    private get summariesDir();
-    writeSummary(summary: MemorySummary): Promise<void>;
-    readSummaries(): Promise<MemorySummary[]>;
-    archiveMemories(memoryIds: string[], summaryId: string): Promise<number>;
-    saveTopics(topics: TopicScore[]): Promise<void>;
-    loadTopics(): Promise<{
-        topics: TopicScore[];
-        updatedAt: string | null;
-    }>;
-    addLinksToMemory(memoryId: string, links: MemoryLink[], lifecycle?: MemoryLifecycleEventWriteOptions): Promise<boolean>;
-    private summarizeLifecycleState;
-    private frontmatterPatchEventType;
-    private appendGeneratedMemoryLifecycleEvent;
-    private appendGeneratedMemoryLifecycleEventFailOpen;
-}
-
-export { countEntityStructuredFacts as A, fingerprintEntityStructuredFacts as B, ContentHashIndex as C, isEntitySynthesisStale as D, isValidBufferSurpriseEvent as E, FusionArtifactStore as F, normalizeFrontmatterForPath as G, normalizeStructuredSectionFacts as H, normalizeStructuredSectionFactsWithOrigins as I, parseFrontmatter as J, parseFrontmatterStringValue as K, type MemoryWriteResult as M, type ReextractJobRequest as R, StorageManager as S, type WriteMemoryOptions as W, MeetingRecordStore as a, type MeetingRecordSummary as b, FUSION_KIND as c, MEETINGS_DIR_NAME as d, MEETING_FORMAT_VERSION as e, MEETING_KIND as f, type MeetingRecordBase as g, type MeetingRecordFileIo as h, type MeetingSaveResult as i, composeFusionDayMeta as j, composeMeetingRecord as k, hashFusionBody as l, meetingIdDate as m, parseFusionDay as n, parseMeetingRecordSummary as o, parseEntityFile as p, serializeFusionDay as q, serializeMeetingRecord as r, serializeEntityFile as s, type ContentHashIndexLockOptions as t, FactHashIndexNotAuthoritativeError as u, type MemoryLifecycleEventWriteOptions as v, type SealedWriteExtras as w, buildEntitySchemaCacheKey as x, compareEntityTimestamps as y, compileEntityFacts as z };