@remnic/core 9.7.14 → 9.8.0

package/src/retrieval-agents.test.ts

@@ -0,0 +1,79 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { PARALLEL_AGENT_WEIGHTS, mergeWithAgentResults } from "./retrieval-agents.js";
+import type { ParallelSearchResult } from "./retrieval-agents.js";
+import type { QmdSearchResult } from "./types.js";
+
+const P = "/abs/mem/a.md";
+
+function contextual(namespace: string | undefined, snippet: string, score: number): QmdSearchResult {
+  return { docid: "a", path: P, namespace, snippet, score, transport: "hybrid" };
+}
+
+function direct(namespace: string | undefined, score: number): ParallelSearchResult {
+  return { docid: "a", path: P, namespace, snippet: "", score, transport: "scoped_prefilter", agentSource: "direct" };
+}
+
+// (a) Same resolved namespace + same path → ONE merged entry, snippet + weighted score preserved.
+test("collapses direct + contextual for same (namespace, path) via resolver", async () => {
+  const merged = await mergeWithAgentResults(
+    [contextual("shared", "ctx", 1)],
+    [direct(undefined, 1)],
+    [],
+    PARALLEL_AGENT_WEIGHTS,
+    10,
+    undefined,
+    () => "shared",
+  );
+  assert.equal(merged.length, 1);
+  assert.equal(merged[0].namespace, "shared");
+  // Higher-weighted direct (1.0) wins the score but the contextual snippet is preserved.
+  assert.equal(merged[0].score, 1 * PARALLEL_AGENT_WEIGHTS.direct);
+  assert.equal(merged[0].snippet, "ctx");
+});
+
+// Regression guard for the bug: without namespace normalization the same memory
+// would occupy two keys ("shared\0P" and "\0P") and be injected twice.
+test("without resolver an unstamped direct hit double-counts (the bug the resolver fixes)", async () => {
+  const withoutResolver = await mergeWithAgentResults(
+    [contextual("shared", "ctx", 1)],
+    [direct(undefined, 1)],
+    [],
+    PARALLEL_AGENT_WEIGHTS,
+    10,
+    undefined,
+  );
+  assert.equal(withoutResolver.length, 2);
+});
+
+// (b) Same path but DIFFERENT resolved namespaces stay DISTINCT.
+test("keeps two same-path results under different namespaces distinct", async () => {
+  const merged = await mergeWithAgentResults(
+    [contextual("projA", "a", 1), contextual("projB", "b", 1)],
+    [direct("projA", 1)],
+    [],
+    PARALLEL_AGENT_WEIGHTS,
+    10,
+    undefined,
+    () => "projA",
+  );
+  assert.equal(merged.length, 2);
+  const namespaces = merged.map((r) => r.namespace).sort();
+  assert.deepEqual(namespaces, ["projA", "projB"]);
+});
+
+// (c) Results genuinely lacking any namespace behave as before (single "" bucket).
+test("namespace-less results merge on path alone, unchanged behavior", async () => {
+  const merged = await mergeWithAgentResults(
+    [contextual(undefined, "ctx", 1)],
+    [direct(undefined, 1)],
+    [],
+    PARALLEL_AGENT_WEIGHTS,
+    10,
+    undefined,
+    () => "",
+  );
+  assert.equal(merged.length, 1);
+  assert.equal(merged[0].namespace ?? "", "");
+});

package/src/retrieval-agents.ts

@@ -123,10 +123,25 @@ async function resolveContainedRegularFile(
  * Cost: readdir on entities/ + filename scoring. Typically <5ms.
  *
  */
+// Agents scan one namespace storage dir and return absolute paths. Contextual
+// fanout hits are also absolute (globally-unique identity), so we keep the
+// agent path absolute and only stamp the owning namespace here — that carries
+// the namespace through merge/tracking without re-deriving it (#2020). No-op
+// without a resolver.
+function namespaceRelativeResult(
+  result: ParallelSearchResult,
+  _memoryDir: string,
+  namespaceFromPath?: (p: string) => string,
+): ParallelSearchResult {
+  if (!namespaceFromPath || !result.path || result.namespace) return result;
+  return { ...result, namespace: namespaceFromPath(result.path) };
+}
+
 export async function runDirectAgent(
   query: string,
   memoryDir: string,
   maxResults = 10,
+  namespaceFromPath?: (p: string) => string,
 ): Promise<ParallelSearchResult[]> {
   try {
     const canonicalRoot = await realpath(memoryDir);
@@ -156,14 +171,20 @@ export async function runDirectAgent(
       const safePath = await resolveContainedRegularFile(memoryDir, fullPath, canonicalRoot);
       if (!safePath) continue;
 
-      results.push({
-        docid: nameWithoutExt,
-        path: safePath,
-        snippet: "", // populated by augmentWithDirectAndTemporal after merge
-        score,
-        transport: "scoped_prefilter",
-        agentSource: "direct",
-      });
+      results.push(
+        namespaceRelativeResult(
+          {
+            docid: nameWithoutExt,
+            path: safePath,
+            snippet: "", // populated by augmentWithDirectAndTemporal after merge
+            score,
+            transport: "scoped_prefilter",
+            agentSource: "direct",
+          },
+          memoryDir,
+          namespaceFromPath,
+        ),
+      );
     }
 
     return results
@@ -194,6 +215,7 @@ export async function runTemporalAgent(
   /** Optional candidate set from query-aware prefilter. Applied BEFORE the top-K cap so
    * in-scope entries are not displaced by newer out-of-scope entries. */
   candidatePaths?: Set<string> | null,
+  namespaceFromPath?: (p: string) => string,
 ): Promise<ParallelSearchResult[]> {
   try {
     const canonicalRoot = await realpath(memoryDir);
@@ -306,14 +328,20 @@ export async function runTemporalAgent(
 
       const baseName = path.basename(safePath, ".md");
 
-      results.push({
-        docid: baseName,
-        path: safePath,
-        snippet: "", // populated by augmentWithDirectAndTemporal after merge
-        score,
-        transport: "scoped_prefilter",
-        agentSource: "temporal",
-      });
+      results.push(
+        namespaceRelativeResult(
+          {
+            docid: baseName,
+            path: safePath,
+            snippet: "", // populated by augmentWithDirectAndTemporal after merge
+            score,
+            transport: "scoped_prefilter",
+            agentSource: "temporal",
+          },
+          memoryDir,
+          namespaceFromPath,
+        ),
+      );
     }
 
     return results
@@ -359,23 +387,34 @@ export async function runContextualAgent(
 
 /**
  * Merge results from multiple agents into a single deduplicated, weighted list.
- * Preserves snippets: if a higher-scoring result lacks a snippet, the existing
- * snippet from a lower-scoring source is retained.
+ * Deduplicates by (namespace, path). Contextual results carry a `namespace`
+ * (from the namespace-fanout search); direct/temporal results do not. When a
+ * `resolveNamespace` resolver is supplied, the missing namespace is derived from
+ * the result path the same canonical way the contextual side derives it
+ * (`result.namespace ?? resolveNamespace(result.path)`), so a direct/temporal hit
+ * and a contextual hit for the same (namespace, path) collapse to ONE merge key
+ * instead of being injected and access-counted twice. Preserves snippets: if a
+ * higher-scoring result lacks a snippet, the existing snippet from a lower-scoring
+ * source is retained.
  */
 function mergeAgentResults(
   allResults: ParallelSearchResult[],
   weights: Record<SearchAgentSource, number>,
   maxResults: number,
+  resolveNamespace?: (path: string) => string,
 ): QmdSearchResult[] {
   const merged = new Map<string, QmdSearchResult>();
   for (const result of allResults) {
-    const key = result.path || result.docid;
+    const namespace =
+      result.namespace ?? (resolveNamespace && result.path ? resolveNamespace(result.path) : undefined);
+    const key = `${namespace ?? ""}\0${result.path || result.docid}`;
     const weightedScore = result.score * weights[result.agentSource];
     const existing = merged.get(key);
     if (!existing || weightedScore > existing.score) {
       merged.set(key, {
         docid: result.docid,
         path: result.path,
+        namespace,
         // Preserve any snippet from the existing entry when the new one has none
         snippet: result.snippet || existing?.snippet || "",
         score: weightedScore,
@@ -455,6 +494,10 @@ export async function mergeWithAgentResults(
   weights: Record<SearchAgentSource, number>,
   maxResults: number,
   memoryDir?: string,
+  /** Optional namespace resolver. Direct/temporal results lack a namespace under
+   * namespace fanout; deriving it from the path lets them collapse onto the same
+   * merge key as the contextual result for the same (namespace, path). */
+  resolveNamespace?: (path: string) => string,
 ): Promise<QmdSearchResult[]> {
   if (directResults.length === 0 && temporalResults.length === 0) {
     return contextualResults.slice(0, maxResults);
@@ -469,6 +512,7 @@ export async function mergeWithAgentResults(
     [...contextualTagged, ...directResults, ...temporalResults],
     weights,
     maxResults,
+    resolveNamespace,
   );
   return populateEmptySnippets(merged, memoryDir);
 }
@@ -511,6 +555,9 @@ export async function augmentWithDirectAndTemporal(
   /** Optional candidate set from query-aware prefilter (time/tag scoped). Agents' results are
    * filtered to this set when provided so recall stays within the operator-specified scope. */
   candidatePaths?: Set<string> | null,
+  /** Optional namespace resolver so direct/temporal results collapse onto the same
+   * (namespace, path) merge key as their contextual counterpart. */
+  resolveNamespace?: (path: string) => string,
 ): Promise<QmdSearchResult[]> {
   // maxPerAgent=0 is a hard disable: skip agents entirely and return contextual unchanged
   if (maxPerAgent === 0) return contextualResults;
@@ -575,6 +622,7 @@ export async function augmentWithDirectAndTemporal(
     [...contextualTagged, ...scopedDirect, ...temporalResults],
     weights,
     maxResults,
+    resolveNamespace,
   );
 
   // Populate snippets for results discovered only by direct/temporal (no contextual preview)
@@ -593,6 +641,9 @@ export interface ParallelRetrievalOptions {
   maxResultsPerAgent?: number;
   /** Override default agent weights. Falls back to PARALLEL_AGENT_WEIGHTS when absent. */
   agentWeights?: Record<SearchAgentSource, number>;
+  /** Optional namespace resolver so direct/temporal results collapse onto the same
+   * (namespace, path) merge key as the contextual result for the same path. */
+  resolveNamespace?: (path: string) => string;
 }
 
 /**
@@ -655,6 +706,7 @@ export async function parallelRetrieval(
     [...contextualResults, ...directResults, ...temporalResults],
     options.agentWeights ?? PARALLEL_AGENT_WEIGHTS,
     maxResults,
+    options.resolveNamespace,
   );
   return populateEmptySnippets(merged, memoryDir);
 }

package/src/salvage-envelope.ts

@@ -0,0 +1,28 @@
+import {
+  composeMemoryEnvelope,
+  type MemoryWriteInput,
+  type SealedMemoryEnvelope,
+  type WriteContext,
+} from "./write-envelope.js";
+import { log } from "./logger.js";
+
+/**
+ * Shared salvage-compose helper for MACHINE-GENERATED or replayed-from-store
+ * write input (issue #1989 PR4): one malformed optional field must not abort
+ * the surrounding batch/action, and every drop is warn-logged with the
+ * caller's label — visible, never silent (rule 34).
+ *
+ * Operator/system-built input must NOT use this — compose strict so caller
+ * bugs surface (see AGENTS.md "Sealed memory-write envelope").
+ */
+export function composeSalvagedEnvelope(
+  label: string,
+  input: MemoryWriteInput,
+  ctx: WriteContext,
+): SealedMemoryEnvelope {
+  const envelope = composeMemoryEnvelope(input, ctx, { salvage: true });
+  if (envelope.salvageNotes.length > 0) {
+    log.warn(`${label} write salvaged invalid fields: ${envelope.salvageNotes.join("; ")}`);
+  }
+  return envelope;
+}

package/src/scopes/scope-plan.test.ts

@@ -24,9 +24,11 @@ import test from "node:test";
 import {
   getConfiguredNamespaces,
   resolveNamespaceFromStorageDir,
+  resolveNamespacePreflight,
   resolveScopePlan,
   resolveWritableNamespaceValue,
 } from "./scope-plan.js";
+import type { TokenCapabilities } from "../access-token-capabilities.js";
 import {
   combineNamespaces,
   lcmSessionKeyForNamespace,
@@ -525,3 +527,43 @@ test("resolveWritableNamespaceValue: namespaces disabled, default namespace →
   assert.equal(result.ok, true);
   if (result.ok) assert.equal(result.namespace, "default");
 });
+
+test("resolveNamespacePreflight gates on the allow-list, policy, and the requested write op", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  // Unrestricted token, observe path: default writable, foreign policy-rejected.
+  assert.deepEqual(
+    resolveNamespacePreflight(undefined, "default", undefined, undefined, config, "observe"),
+    { ok: true, namespace: "default" },
+  );
+  assert.equal(
+    resolveNamespacePreflight(undefined, "team-b", undefined, undefined, config, "observe").ok,
+    false,
+  );
+  // Namespace-scoped token: in-list writable; out-of-list definitive not_writable.
+  const scoped = { namespaces: ["default"] } as unknown as TokenCapabilities;
+  assert.deepEqual(
+    resolveNamespacePreflight(scoped, "default", undefined, undefined, config, "observe"),
+    { ok: true, namespace: "default" },
+  );
+  assert.deepEqual(
+    resolveNamespacePreflight(scoped, "team-b", undefined, undefined, config, "observe"),
+    { ok: false, reason: "not_writable", namespace: "team-b" },
+  );
+  // Write-op awareness: a memory_store-only token is not_writable for the
+  // observe path but writable for the memory_store path; a token lacking BOTH
+  // (diagnostic-only) is never writable.
+  const storeOnly = { ops: ["memory_store"] } as unknown as TokenCapabilities;
+  assert.equal(
+    resolveNamespacePreflight(storeOnly, "default", undefined, undefined, config, "observe").ok,
+    false,
+  );
+  assert.deepEqual(
+    resolveNamespacePreflight(storeOnly, "default", undefined, undefined, config, "memory_store"),
+    { ok: true, namespace: "default" },
+  );
+  const diagnosticOnly = { ops: ["namespace_writable"] } as unknown as TokenCapabilities;
+  assert.equal(
+    resolveNamespacePreflight(diagnosticOnly, "default", undefined, undefined, config, "observe").ok,
+    false,
+  );
+});

package/src/scopes/scope-plan.ts

@@ -44,6 +44,12 @@ import {
   namespaceIdentityToken,
 } from "../namespaces/identity.js";
 import path from "node:path";
+import {
+  capabilityAllowsOp,
+  isNamespaceAllowed,
+  resolveEffectiveNamespace,
+  type TokenCapabilities,
+} from "../access-token-capabilities.js";
 import type { ResolvedScopeProfilePlan } from "../namespaces/scope-profiles.js";
 import {
   expandScopeProfileReadNamespaces,
@@ -482,3 +488,42 @@ export function resolveWritableNamespaceValue(
   }
   return { ok: true, namespace: resolved };
 }
+
+/**
+ * Namespace preflight (issue #1888 part 3): would a write to `namespace` by a
+ * caller carrying `caps` succeed? Combines the token's write-op scope, its
+ * namespace allow-list, and policy writability so one call answers the real
+ * question. A token that cannot actually write (no `observe`/`memory_store` in
+ * its ops allow-list) or is asking about a namespace outside its allow-list
+ * gets a definitive `not_writable` — revealing nothing about the namespace's
+ * policy beyond what the token's own scope already implies, and never throwing
+ * a hard authorization error the caller cannot distinguish from a transport
+ * fault. (Unrestricted tokens pass both scope checks unchanged.)
+ */
+export function resolveNamespacePreflight(
+  caps: TokenCapabilities | undefined | null,
+  namespace: string | undefined,
+  sessionKey: string | undefined,
+  authenticatedPrincipal: string | undefined,
+  config: PluginConfig,
+  writeOp: string,
+): WritableNamespaceResult {
+  const notWritable = (): WritableNamespaceResult => ({
+    ok: false,
+    reason: "not_writable",
+    namespace: resolveEffectiveNamespace(namespace, config.defaultNamespace) ?? namespace ?? "",
+  });
+  // The token must be able to perform the write op the caller's ENABLED write
+  // path actually uses (`observe` for automatic turn capture — the silent
+  // #1888 data-loss path — or `memory_store` for an explicit-only install).
+  // A token that cannot perform that op would drop the write, so an otherwise
+  // policy-writable namespace is still reported not_writable rather than a
+  // false ok:true that promises a write the token cannot make.
+  if (!capabilityAllowsOp(caps, writeOp)) {
+    return notWritable();
+  }
+  if (!isNamespaceAllowed(caps, namespace, config.defaultNamespace)) {
+    return notWritable();
+  }
+  return resolveWritableNamespaceValue(namespace, sessionKey, authenticatedPrincipal, config);
+}

package/src/search/port.ts

@@ -64,6 +64,17 @@ export function resolveEnsureCollectionArgs(
   return { collection: undefined, execution: collectionOrExecution ?? execution };
 }
 
+/**
+ * Optional status report for search backends that track embedding backlog.
+ * Backends without embedding pipelines return null from status().
+ */
+export interface SearchBackendStatus {
+  pendingEmbeddings: number | null;
+  oldestPendingAgeMs: number | null;
+  totalFiles: number | null;
+  embeddedFiles: number | null;
+}
+
 /**
  * Abstract search backend interface.
  *
@@ -88,6 +99,8 @@ export interface SearchBackend {
   checkAvailability?(execution?: SearchExecutionOptions): Promise<boolean>;
   isAvailable(): boolean;
   debugStatus(): string;
+  /** Optional embedding backlog status for health surfaces. */
+  status?(): Promise<SearchBackendStatus>;
 
   // ── Search ──
   search(
@@ -119,6 +132,17 @@ export interface SearchBackend {
 
   // ── Maintenance ──
   update(execution?: SearchExecutionOptions): Promise<void>;
+  /**
+   * Wall-clock ms of the most recent SUCCESSFUL index refresh, or null when the
+   * backend has never run one. Ordinary update() is fail-open: it returns
+   * silently (without throwing or advancing this timestamp) when the backend is
+   * unavailable or the call is suppressed by a min-interval / failure backoff.
+   * Callers that must know whether update() actually indexed — so they can
+   * invalidate dependent caches only on a real refresh — snapshot this before
+   * the call and treat the backend as refreshed iff the value advanced. Optional
+   * because not every backend tracks it; absent means "assume refreshed".
+   */
+  readonly lastUpdateRanAtMs?: number | null;
   /**
    * Optional strict refresh used by callers that must know whether the backend
    * was actually refreshed before writing success markers. Ordinary update

package/src/secure-store/index.ts

@@ -121,6 +121,7 @@ export {
   FILE_FORMAT_VERSION,
   MAGIC_BYTES,
   MAGIC_HEADER_SIZE,
+  SECURE_STORE_ENVELOPE_OVERHEAD_BYTES,
   SecureStoreDecryptError,
   SecureStoreLockedError,
   decryptMemoryDirToPlaintext,

package/src/secure-store/secure-fs.ts

@@ -60,6 +60,7 @@ import {
   seal,
 } from "./cipher.js";
 import { RECALL_FALLBACK_DIRS } from "../utils/category-dir.js";
+import { isErrnoCode } from "../utils/errno.js";
 
 // ---------------------------------------------------------------------------
 // Error classes
@@ -105,6 +106,18 @@ export const FILE_FORMAT_FLAGS = 0x00;
 /** Total size of the magic header prefix (magic + version + flags). */
 export const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes
 
+/**
+ * Exact, deterministic bytes `writeMaybeEncryptedFile` adds to an encrypted
+ * file beyond its plaintext body: the magic header prefix plus the fixed
+ * envelope header (version + salt + IV + auth tag). AES-256-GCM ciphertext
+ * matches the plaintext length and the state-file write path applies no
+ * compression, so an encrypted state file is exactly `plaintext +
+ * SECURE_STORE_ENVELOPE_OVERHEAD_BYTES` on disk. Compaction reserves this so an
+ * encrypted ledger lands strictly below the reader's whole-file decrypt cap
+ * (issue #2033).
+ */
+export const SECURE_STORE_ENVELOPE_OVERHEAD_BYTES = MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE;
+
 // ---------------------------------------------------------------------------
 // Detection
 // ---------------------------------------------------------------------------
@@ -119,6 +132,41 @@ export function isEncryptedFile(buf: Uint8Array): boolean {
   return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);
 }
 
+/**
+ * True when the REGULAR file at `probePath` is encrypted at rest (its first
+ * bytes are the REMNIC-ENC magic header). ENOENT resolves to false — an absent
+ * file has nothing to probe. A symlink, FIFO, device, or any other non-regular
+ * path is REFUSED with a throw rather than opened: opening a FIFO blocks until a
+ * writer appears and a symlink would redirect the probe outside our tree. The
+ * ledgers and per-event spills we manage are always regular files, so a
+ * non-regular path is an anomaly the caller must treat as unsafe, never follow
+ * (#2033). Shared by the CLI ledger recovery probe and the auto-compaction probe
+ * so both enforce identical open safety.
+ */
+export async function probeEncryptedRegularFileHeader(probePath: string): Promise<boolean> {
+  let entryStat;
+  try {
+    entryStat = await lstat(probePath);
+  } catch (err) {
+    if (isErrnoCode(err, "ENOENT")) return false;
+    throw err;
+  }
+  if (!entryStat.isFile()) {
+    throw new Error(
+      `refusing to probe non-regular state path ${probePath} `
+      + `(symlink/FIFO/device); opening it could block or escape containment (#2033)`,
+    );
+  }
+  const handle = await openFile(probePath, "r");
+  try {
+    const header = Buffer.alloc(MAGIC_HEADER_SIZE);
+    const { bytesRead } = await handle.read(header, 0, header.length, 0);
+    return isEncryptedFile(header.subarray(0, bytesRead));
+  } finally {
+    await handle.close();
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Encrypt / decrypt file body
 // ---------------------------------------------------------------------------

package/src/secure-store/secure-store.test.ts

@@ -75,6 +75,7 @@ import {
   filePathAad,
   isEncryptedFile,
   migrateMemoryDirToEncrypted,
+  probeEncryptedRegularFileHeader,
   readMaybeEncryptedFile,
 } from "./secure-fs.js";
 
@@ -963,3 +964,42 @@ test("secure-store migration encrypts memory category dirs but leaves the questi
     await rm(tempRoot, { recursive: true, force: true });
   }
 });
+
+test("probeEncryptedRegularFileHeader detects encryption, treats absent as false, and refuses non-regular paths (#2033)", async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), "remnic-probe-header-"));
+  try {
+    // Plaintext regular file → not encrypted.
+    const plainPath = path.join(dir, "plain.jsonl");
+    await writeFile(plainPath, "row-1\nrow-2\n", "utf8");
+    assert.equal(await probeEncryptedRegularFileHeader(plainPath), false, "plaintext file is not encrypted");
+
+    // Encrypted-at-rest regular file → encrypted.
+    const encPath = path.join(dir, "enc.jsonl");
+    const key = Buffer.alloc(32, 5);
+    await writeFile(encPath, encryptFileBody("secret\n", key, filePathAad(encPath, dir)));
+    assert.equal(await probeEncryptedRegularFileHeader(encPath), true, "encrypted file detected via magic header");
+
+    // Absent file → false (nothing to probe), not a throw.
+    assert.equal(await probeEncryptedRegularFileHeader(path.join(dir, "missing.jsonl")), false);
+
+    // A symlink (even to a regular file) is REFUSED before opening — a poisoned
+    // link must never redirect the probe outside our tree (#2033).
+    const linkPath = path.join(dir, "link.jsonl");
+    await symlink(plainPath, linkPath);
+    await assert.rejects(
+      () => probeEncryptedRegularFileHeader(linkPath),
+      (err: unknown) => {
+        const message = err instanceof Error ? err.message : String(err);
+        assert.match(message, /non-regular state path/);
+        assert.match(message, /symlink\/FIFO\/device/);
+        assert.ok(message.includes(linkPath));
+        return true;
+      },
+    );
+
+    // A directory is likewise non-regular and refused.
+    await assert.rejects(() => probeEncryptedRegularFileHeader(dir), /non-regular state path/);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});

package/src/semantic-rule-promotion.ts

@@ -1,4 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
+import { composeMemoryEnvelope } from "./write-envelope.js";
+import { log } from "./logger.js";
 import { link, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
@@ -638,10 +640,17 @@ export async function promoteSemanticRuleFromMemory(options: {
     }
 
     await lock.beforePromotedRuleWrite();
-    const { id: id } = await storage.writeMemory("rule", content, {
-      confidence,
-      tags: candidateBase.tags,
-      source: "semantic-rule-promotion",
+    // Sealed-envelope write (issue #1989 PR4): rule content and tags are
+    // derived from stored/LLM data — salvage; drops are warn-logged.
+    const ruleEnvelope = composeMemoryEnvelope(
+      { content, category: "rule", confidence, tags: candidateBase.tags },
+      { source: "semantic-rule-promotion" },
+      { salvage: true },
+    );
+    if (ruleEnvelope.salvageNotes.length > 0) {
+      log.warn(`rule-promotion write salvaged invalid fields: ${ruleEnvelope.salvageNotes.join("; ")}`);
+    }
+    const { id: id } = await storage.writeSealedMemory(ruleEnvelope, {
       lineage: candidateBase.lineage,
       sourceMemoryId: options.sourceMemoryId,
       memoryKind: "note",