@remnic/core 9.7.14 → 9.8.0

package/dist/{chunk-TRWPCR6P.js → chunk-JECBQBEX.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-OD4FM2U7.js";
 import {
   resolveCompressionCapabilities
-} from "./chunk-BFPETA3S.js";
+} from "./chunk-SCCO46KZ.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/orchestration/compression-guideline-coordinator.ts
 import { createHash } from "crypto";
@@ -283,4 +283,4 @@ export {
   CompressionGuidelineCoordinator,
   formatCompressionGuidelinesForRecall
 };
-//# sourceMappingURL=chunk-TRWPCR6P.js.map
+//# sourceMappingURL=chunk-JECBQBEX.js.map

package/dist/{chunk-HG32URJJ.js → chunk-JYIFGGEM.js}

@@ -1,6 +1,6 @@
 import {
   readAllEdges
-} from "./chunk-OBMR4VIX.js";
+} from "./chunk-L2DPF4DF.js";
 import {
   readEdgeConfidence
 } from "./chunk-2LSZVONP.js";
@@ -162,4 +162,4 @@ export {
   parseGraphSnapshotSince,
   buildGraphSnapshot
 };
-//# sourceMappingURL=chunk-HG32URJJ.js.map
+//# sourceMappingURL=chunk-JYIFGGEM.js.map

package/dist/{chunk-VA4WSW54.js → chunk-JYIJNNN3.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-AAD2ZS6P.js";
 import {
   gatewayTaskChainOptions
-} from "./chunk-UXKMMNJD.js";
+} from "./chunk-C23BYTJV.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/extraction-faithfulness.ts
 import { createHash } from "crypto";
@@ -685,4 +685,4 @@ export {
   serializeFaithfulnessFields,
   parseFaithfulnessField
 };
-//# sourceMappingURL=chunk-VA4WSW54.js.map
+//# sourceMappingURL=chunk-JYIJNNN3.js.map

package/dist/{chunk-L5HJQC36.js → chunk-K2TDK7GG.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-QDW3E4RD.js";
 import {
   gatewayTaskChainOptions
-} from "./chunk-UXKMMNJD.js";
+} from "./chunk-C23BYTJV.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/extraction-judge.ts
 import { createHash } from "crypto";
@@ -486,4 +486,4 @@ export {
   createVerdictCache,
   createDeferCountMap
 };
-//# sourceMappingURL=chunk-L5HJQC36.js.map
+//# sourceMappingURL=chunk-K2TDK7GG.js.map

package/dist/{chunk-MKDRQAA3.js → chunk-KAVBJSBQ.js}

@@ -1,10 +1,10 @@
 import {
   StorageManager,
   normalizeEntityName
-} from "./chunk-7ICYQUOL.js";
+} from "./chunk-4BJQODZF.js";
 import {
   serializeMutations
-} from "./chunk-LTJAMRGI.js";
+} from "./chunk-WL5EBRDH.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
@@ -14,7 +14,7 @@ import {
 } from "./chunk-JUC24CTX.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/briefing.ts
 import { readFile as readFile2 } from "fs/promises";
@@ -956,4 +956,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-MKDRQAA3.js.map
+//# sourceMappingURL=chunk-KAVBJSBQ.js.map

package/dist/{chunk-EEARRVZ2.js → chunk-KF5EUVKQ.js}

@@ -1,14 +1,16 @@
 import {
   assertFleetWideOperationAllowed,
   assertOperationAllowed,
+  capabilityAllowsOp,
   tokenCapabilityStore
-} from "./chunk-D7FOKIY5.js";
-import {
-  EngramAccessInputError
-} from "./chunk-GMSDQUCR.js";
+} from "./chunk-7AMFUATK.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
+import {
+  EngramAccessForbiddenError,
+  EngramAccessInputError
+} from "./chunk-2Z24E5W2.js";
 
 // src/access-boundary.ts
 import { z } from "zod";
@@ -44,6 +46,7 @@ var OPERATION_NAMES = [
   "set_coding_context",
   "recall_tier_explain",
   "recall_xray",
+  "namespace_writable",
   "wearables_status",
   "wearables_sync",
   "transcript_day",
@@ -245,7 +248,14 @@ function defineOperation(spec) {
       if (!parseResult.success) {
         throw new EngramAccessInputError(formatZodIssues(parseResult.error));
       }
-      assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);
+      if (spec.allowedByOps && spec.allowedByOps.length > 0) {
+        const store = tokenCapabilityStore.getStore();
+        if (!spec.allowedByOps.some((op) => capabilityAllowsOp(store, op))) {
+          throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${spec.name}`);
+        }
+      } else {
+        assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);
+      }
       if (spec.fleetWide) {
         assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());
       }
@@ -276,4 +286,4 @@ export {
   listRegisteredOperations,
   __resetRegistryForTest
 };
-//# sourceMappingURL=chunk-EEARRVZ2.js.map
+//# sourceMappingURL=chunk-KF5EUVKQ.js.map

package/dist/chunk-KF5EUVKQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-boundary.ts"],"sourcesContent":["/**\n * Single input-validation and error boundary for the CLI/MCP/HTTP access\n * surfaces (issue #1525, epic #1520 Phase 1).\n *\n * Every operation that crosses the access-service facade passes through ONE\n * registry entry: a zod-validated request envelope, a shared error mapper,\n * and the \"reject invalid input and list valid options\" behavior that\n * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented\n * per handler. The three surfaces become thin adapters — one operation\n * definition, three transports — so a validation fix lands everywhere at\n * once.\n *\n * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`\n * prefix. Session/namespace tenancy stays in the handler layer (resolved via\n * ScopePlan #1521); the boundary validates SHAPE, not tenancy.\n */\n\nimport { z } from \"zod\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\nimport { EngramAccessInputError, type EngramAccessService } from \"./access-service.js\";\nimport {\n  assertFleetWideOperationAllowed,\n  assertOperationAllowed,\n  capabilityAllowsOp,\n  tokenCapabilityStore,\n} from \"./access-token-capabilities.js\";\nimport { expandTildePath } from \"./utils/path.js\";\n\n// ---------------------------------------------------------------------------\n// Canonical operation names — host-agnostic (rule 31)\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Add to this union as\n * each domain-group migration PR (memory ops → connectors → namespaces …)\n * lands; the fitness test in `access-surface-catalog.test.ts` treats the\n * registered set as the migration state.\n */\nexport const OPERATION_NAMES = [\n  \"memory_get\",\n  \"memory_search\",\n  \"memory_store\",\n  \"coding_decision\",\n  \"coding_architecture\",\n  // codegraph parity tools (issue #1554) -- each maps to one codegraph_*\n  // boundary operation that delegates to the surface handler in\n  // coding/codegraph-surfaces.ts. Names match the external tool suffixes.\n  \"codegraph_index\",\n  \"codegraph_list_projects\",\n  \"codegraph_delete_project\",\n  \"codegraph_index_status\",\n  \"codegraph_search_graph\",\n  \"codegraph_trace_path\",\n  \"codegraph_detect_changes\",\n  \"codegraph_query_graph\",\n  \"codegraph_get_schema\",\n  \"codegraph_get_snippet\",\n  \"codegraph_get_architecture\",\n  \"codegraph_search_code\",\n  \"codegraph_manage_adr\",\n  \"codegraph_ingest_traces\",\n  \"memory_correct_plan\",\n  \"memory_correct_apply\",\n  \"coding_delta\",\n  // Remaining MCP/HTTP handlers migrated through the boundary (issue #1525).\n  \"recall\",\n  \"recall_explain\",\n  \"set_coding_context\",\n  \"recall_tier_explain\",\n  \"recall_xray\",\n  \"namespace_writable\",\n  \"wearables_status\",\n  \"wearables_sync\",\n  \"transcript_day\",\n  \"transcript_search\",\n  \"transcript_memories\",\n  \"action_confidence\",\n  \"chatgpt_memory_inspector\",\n  \"day_summary\",\n  \"capsule_export\",\n  \"capsule_import\",\n  \"capsule_list\",\n  \"memory_governance_run\",\n  \"procedure_mining_run\",\n  \"pattern_reinforcement_run\",\n  \"procedural_stats\",\n  \"memory_timeline\",\n  \"suggestion_submit\",\n  \"entity_get\",\n  \"review_queue_list\",\n  \"correction_pending\",\n  \"observe\",\n  \"lcm_search\",\n  \"lcm_compaction_flush\",\n  \"lcm_compaction_record\",\n  \"continuity_audit_generate\",\n  \"continuity_incident_open\",\n  \"continuity_incident_close\",\n  \"continuity_incident_list\",\n  \"continuity_loop_add_or_update\",\n  \"continuity_loop_review\",\n  \"identity_anchor_get\",\n  \"identity_anchor_update\",\n  \"memory_identity\",\n  \"work_task\",\n  \"work_project\",\n  \"work_board\",\n  \"shared_context_write_output\",\n  \"shared_feedback_record\",\n  \"shared_priorities_append\",\n  \"relay_mission_append\",\n  \"relay_mission_read\",\n  \"shared_context_cross_signals_run\",\n  \"shared_context_curate_daily\",\n  \"compounding_weekly_synthesize\",\n  \"compounding_promote_candidate\",\n  \"compression_guidelines_optimize\",\n  \"compression_guidelines_activate\",\n  \"memory_profile\",\n  \"memory_entities_list\",\n  \"memory_questions\",\n  \"memory_last_recall\",\n  \"memory_intent_debug\",\n  \"memory_qmd_debug\",\n  \"memory_graph_explain\",\n  \"graph_snapshot\",\n  \"memory_feedback\",\n  \"memory_promote\",\n  \"memory_outcome\",\n  \"memory_action_apply\",\n  \"context_checkpoint\",\n  \"briefing\",\n  \"review_list\",\n  \"review_resolve\",\n  \"contradiction_scan_run\",\n  \"memory_summarize_hourly\",\n  \"conversation_index_update\",\n  \"profiling_report\",\n  \"graph_edge_decay_run\",\n  \"live_connectors_run\",\n  \"peer_list\",\n  \"peer_get\",\n  \"peer_set\",\n  \"peer_delete\",\n  \"peer_profile_get\",\n  \"peer_forget\",\n  \"console_state\",\n  \"dreams_status\",\n  \"dreams_run\",\n  // HTTP-only routes (no direct MCP tool equivalent).\n  \"adapters_status\",\n  \"offline_sync_snapshot\",\n  \"offline_sync_snapshot_stream\",\n  \"offline_sync_files\",\n  \"offline_sync_file_content\",\n  \"offline_sync_apply_file_content\",\n  \"offline_sync_apply\",\n  \"lcm_status\",\n  \"memory_list\",\n  \"recall_timings\",\n  \"entity_list\",\n  \"maintenance_status\",\n  \"quality_status\",\n  \"trust_zones_status\",\n  \"trust_zones_records\",\n  \"review_disposition\",\n  \"trust_zones_promote\",\n  \"trust_zones_demo_seed\",\n  \"citations_observed\",\n  \"contradiction_detail\",\n  \"graph_events\",\n  // Chat surface — conversational memory inspection/correction (issue #1583).\n  \"chat_message\",\n  \"chat_events\",\n] as const;\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Derived from\n * {@link OPERATION_NAMES} (single source of truth) so the runtime catalog\n * used for token-capability validation cannot drift from the type. The\n * fitness test in `access-surface-catalog.test.ts` treats the registered set\n * as the migration state.\n */\nexport type OperationName = (typeof OPERATION_NAMES)[number];\n\n// ---------------------------------------------------------------------------\n// Operation context — what every handler receives\n// ---------------------------------------------------------------------------\n\n/**\n * Per-call context. `service` is the facade the handler delegates to; the\n * boundary never reaches past it. `authenticatedPrincipal` is resolved by\n * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary\n * runs, so handlers stay principal-source-agnostic. `hooks` carries\n * transport-level callbacks (e.g. HTTP write-quota enforcement) that must\n * fire atomically inside the service call; surfaces that have no such hook\n * leave it undefined.\n */\nexport interface OperationContext {\n  readonly service: EngramAccessService;\n  readonly authenticatedPrincipal?: string;\n  readonly operatorPrincipal?: string;\n  /** Per-request cancellation supplied by transports that own a request lifecycle. */\n  readonly abortSignal?: AbortSignal;\n  /** Server-resolved connector identity (Phase 1 provenance). Set by the HTTP auth boundary from the matched token's connector; flows to write handlers so frontmatter records which connector submitted the memory. Client-supplied values are always overridden. */\n  readonly sourceConnector?: string;\n  readonly hooks?: OperationHooks;\n}\n\n/**\n * Transport-level callbacks a handler forwards into the service call. Kept\n * narrow on purpose: the boundary owns validation + dispatch shape, not\n * transport policy. Add fields here only when a surface genuinely needs a\n * callback the service itself consumes.\n */\nexport interface OperationHooks {\n  /** HTTP write-quota gate; throws to reject the write when exhausted. */\n  readonly enforceWriteQuota?: () => void | Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Operation spec + bound operation\n// ---------------------------------------------------------------------------\n\nexport interface OperationSpec<In, Out> {\n  /** Canonical operation id; matches an {@link OperationName}. */\n  readonly name: OperationName;\n  readonly description: string;\n  /** Zod schema validating the raw request envelope. */\n  readonly schema: z.ZodType<In>;\n  /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */\n  readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;\n  /**\n   * Marks an operation as inherently FLEET-WIDE / global — it runs across ALL\n   * namespaces (or against a single non-namespaced global layer) and carries no\n   * `namespace` argument, so the MCP `tools/call` effective-namespace chokepoint\n   * never applies. When set, {@link defineOperation}'s run wrapper rejects any\n   * namespace-SCOPED token (fail closed) via assertFleetWideOperationAllowed\n   * BEFORE the handler — no side effect on denial. Unrestricted/legacy tokens\n   * (cron, internal callers, no capability record) are unaffected (issue #1850).\n   */\n  readonly fleetWide?: boolean;\n  /**\n   * Alternate op allow-list: when set, the token may invoke this operation if\n   * its ops allow-list permits ANY of these ops (instead of the default rule\n   * that requires the op's own {@link name}). Lets a read-only diagnostic be\n   * granted by the write ops it diagnoses — e.g. `namespace_writable` is\n   * runnable by any token permitted to `observe`/`memory_store`, so a token\n   * minted before the diagnostic op existed can still call it. Unrestricted /\n   * legacy tokens (no ops axis) are unaffected. Keeps the boundary and any HTTP\n   * transport for the same op enforcing ONE policy.\n   */\n  readonly allowedByOps?: readonly OperationName[];\n}\n\nexport interface BoundOperation<In = unknown, Out = unknown> {\n  readonly spec: OperationSpec<In, Out>;\n  /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */\n  readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;\n}\n\n// ---------------------------------------------------------------------------\n// Shared normalizers the boundary owns (rules 17, 28, 36, 48, 51)\n// ---------------------------------------------------------------------------\n\n/**\n * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans\n * and the string spellings clients send (\"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\n * \"on\"/\"off\", case-insensitive). Rejects anything else loudly — `Boolean(\"false\")`\n * would silently be `true`, which is the bug rule 36 exists to prevent.\n *\n * `undefined`/`null`/`\"\"` → `undefined`, so callers can keep treating an\n * absent flag as \"use the default\" without a separate presence check.\n */\nexport function coerceBooleanLike(value: unknown): boolean | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\") {\n    const lower = value.trim().toLowerCase();\n    if (lower === \"true\" || lower === \"1\" || lower === \"yes\" || lower === \"on\") return true;\n    if (lower === \"false\" || lower === \"0\" || lower === \"no\" || lower === \"off\") return false;\n  }\n  throw new EngramAccessInputError(\n    `expected a boolean-like value (true|false|1|0|yes|no|on|off); got ${JSON.stringify(value)}`,\n  );\n}\n\n/**\n * Coerce + validate a positive integer from a numeric string or number\n * (rule 28). Loosely-typed MCP/CLI clients send `\"5\"`; `typeof saved === \"number\"`\n * on read-back would reject it later, so we coerce at the edge and reject\n * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).\n *\n * `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function coercePositiveInteger(value: unknown, label: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return value;\n  }\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (!/^[+-]?\\d+$/.test(trimmed)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    const parsed = Number(trimmed);\n    if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return parsed;\n  }\n  throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n}\n\n/**\n * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;\n * ad-hoc regex drifts. `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function normalizeOptionalPath(value: unknown): string | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\") {\n    throw new EngramAccessInputError(`expected a path string; got ${JSON.stringify(value)}`);\n  }\n  return expandTildePath(value);\n}\n\n// ---------------------------------------------------------------------------\n// Error formatting — rule 51: list valid options, never silently default\n// ---------------------------------------------------------------------------\n\n/**\n * Turn a zod failure into an {@link EngramAccessInputError} whose message\n * names the offending field and — for enum/union issues — lists the valid\n * options, so the caller can correct rather than guess (rule 51).\n */\nexport function formatZodIssues(error: z.ZodError): string {\n  const parts: string[] = [];\n  for (const issue of error.issues) {\n    // Collapse array-index paths (e.g. [\"currentContextScopes\", 1]) to\n    // the field name so the message reads \"field: must be ...\" not\n    // \"field.1: must be ...\".\n    const hasNumeric = issue.path.some((p) => typeof p === \"number\");\n    const path = hasNumeric\n      ? issue.path.filter((p) => typeof p === \"string\").join(\".\") || \"(root)\"\n      : issue.path.length > 0 ? issue.path.join(\".\") : \"(root)\";\n    const options = enumOptionsFromIssue(issue);\n    const suffix = options ? `. Valid: ${options.join(\", \")}` : \"\";\n    parts.push(`${path}: ${issue.message}${suffix}`);\n  }\n  return parts.length > 0\n    ? `request validation failed: ${parts.join(\"; \")}`\n    : \"request validation failed\";\n}\n\nfunction enumOptionsFromIssue(issue: z.ZodIssue): readonly string[] | undefined {\n  // zod exposes accepted enum values on the issue for ZodEnum / ZodNativeEnum\n  // and on the options of invalid_union discriminators. Reading them here\n  // keeps \"list valid options\" in ONE place rather than per handler.\n  if (issue.code === z.ZodIssueCode.invalid_enum_value) {\n    const rawOptions = (issue as { options?: unknown }).options;\n    if (Array.isArray(rawOptions)) {\n      return rawOptions.map((opt) => String(opt));\n    }\n  }\n  return undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\nconst registry = new Map<OperationName, BoundOperation>();\n\n/**\n * Register an operation. Throws if the name is already registered — duplicate\n * registration is a programming error, not a runtime input fault, so it throws\n * a plain Error (not the input-error class surfaces translate for clients).\n */\n/**\n * Error map that converts Zod's generic type-mismatch messages into\n * human-readable \"must be a <type>\" messages (rule 51).  Applied at the\n * boundary chokepoint so every operation gets consistent messaging\n * without per-handler boilerplate.\n */\nconst humanReadableErrorMap: z.ZodErrorMap = (issue, ctx) => {\n  if (issue.code === z.ZodIssueCode.invalid_type) {\n    if (issue.received === \"undefined\") return { message: ctx.defaultError };\n    // Array-element type errors — collapse to field-level message.\n    if (issue.path.some((p) => typeof p === \"number\")) {\n      const arrField = issue.path.filter((p) => typeof p === \"string\").join(\".\");\n      return { message: `${arrField} must be an array of ${issue.expected}s` };\n    }\n    const fieldName = issue.path.length > 0 ? String(issue.path[issue.path.length - 1]) : \"value\";\n    switch (issue.expected) {\n      case \"string\": return { message: `${fieldName} must be a string` };\n      case \"boolean\": return { message: `${fieldName} must be a boolean` };\n      case \"number\": return { message: `${fieldName} must be a number` };\n      case \"array\": return { message: `${fieldName} must be an array` };\n      case \"object\": return { message: `${fieldName} must be an object` };\n      default: return { message: ctx.defaultError };\n    }\n  }\n  return { message: ctx.defaultError };\n};\n\nexport function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out> {\n  if (registry.has(spec.name)) {\n    throw new Error(`access-boundary: operation already registered: ${spec.name}`);\n  }\n  const bound: BoundOperation<In, Out> = {\n    spec,\n    run: async (rawInput, ctx) => {\n      const parseResult = spec.schema.safeParse(rawInput, { errorMap: humanReadableErrorMap });\n      if (!parseResult.success) {\n        throw new EngramAccessInputError(formatZodIssues(parseResult.error));\n      }\n      // Per-token capability enforcement (issue #1837): when the presenting\n      // token carries an ops allow-list, reject operations not in it. The\n      // capability record is carried via AsyncLocalStorage, set once per\n      // authorized HTTP/MCP request; absent (CLI/tests/direct callers) ⇒\n      // unrestricted. Default-deny ONLY when an ops axis is present — legacy\n      // tokens (absent record) and explicit-unrestricted new tokens are\n      // unaffected.\n      // When the op declares alternate grant ops, permit any of them (so the\n      // batch/MCP path matches an HTTP transport that relaxes the same op);\n      // otherwise the token must carry the op's own name. Unrestricted/legacy\n      // tokens pass either way (capabilityAllowsOp is true when no ops axis).\n      if (spec.allowedByOps && spec.allowedByOps.length > 0) {\n        const store = tokenCapabilityStore.getStore();\n        if (!spec.allowedByOps.some((op) => capabilityAllowsOp(store, op))) {\n          throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${spec.name}`);\n        }\n      } else {\n        assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);\n      }\n      // Fleet-wide / global maintenance ops (issue #1850 round 10): these run\n      // across all namespaces with no `namespace` arg, so the tools/call\n      // effective-namespace gate never fires. A namespace-SCOPED token must not\n      // trigger cross-namespace maintenance — fail closed BEFORE the handler so\n      // a denial never leaks a partial mutation. No-op for unrestricted/legacy.\n      if (spec.fleetWide) {\n        assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());\n      }\n      return spec.handler(parseResult.data, ctx);\n    },\n  };\n  // Store under the canonical name; the cast is safe because In/Out are\n  // erased at the registry boundary and recovered by callers via getOperation.\n  registry.set(spec.name, bound as unknown as BoundOperation);\n  return bound;\n}\n\n/** Look up a registered operation by canonical name. */\nexport function getOperation(name: OperationName): BoundOperation | undefined {\n  return registry.get(name);\n}\n\n/** All registered operation names. */\nexport function listRegisteredOperations(): readonly OperationName[] {\n  return [...registry.keys()];\n}\n\n/** Test-only: clear the registry so pilot definitions can be re-registered. */\nexport function __resetRegistryForTest(): void {\n  registry.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiBA,SAAS,SAAS;AAsBX,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AAqGO,SAAS,kBAAkB,OAAqC;AACrE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,QAAQ,MAAM,KAAK,EAAE,YAAY;AACvC,QAAI,UAAU,UAAU,UAAU,OAAO,UAAU,SAAS,UAAU,KAAM,QAAO;AACnF,QAAI,UAAU,WAAW,UAAU,OAAO,UAAU,QAAQ,UAAU,MAAO,QAAO;AAAA,EACtF;AACA,QAAM,IAAI;AAAA,IACR,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,EAC5F;AACF;AAUO,SAAS,sBAAsB,OAAgB,OAAmC;AACvF,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,KAAK,GAAG;AACrE,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,GAAG;AAChD,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AACtG;AAMO,SAAS,sBAAsB,OAAoC;AACxE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,uBAAuB,+BAA+B,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EACzF;AACA,SAAO,gBAAgB,KAAK;AAC9B;AAWO,SAAS,gBAAgB,OAA2B;AACzD,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,MAAM,QAAQ;AAIhC,UAAM,aAAa,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ;AAC/D,UAAM,OAAO,aACT,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,WAC7D,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AACnD,UAAM,UAAU,qBAAqB,KAAK;AAC1C,UAAM,SAAS,UAAU,YAAY,QAAQ,KAAK,IAAI,CAAC,KAAK;AAC5D,UAAM,KAAK,GAAG,IAAI,KAAK,MAAM,OAAO,GAAG,MAAM,EAAE;AAAA,EACjD;AACA,SAAO,MAAM,SAAS,IAClB,8BAA8B,MAAM,KAAK,IAAI,CAAC,KAC9C;AACN;AAEA,SAAS,qBAAqB,OAAkD;AAI9E,MAAI,MAAM,SAAS,EAAE,aAAa,oBAAoB;AACpD,UAAM,aAAc,MAAgC;AACpD,QAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,aAAO,WAAW,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;AAMA,IAAM,WAAW,oBAAI,IAAmC;AAaxD,IAAM,wBAAuC,CAAC,OAAO,QAAQ;AAC3D,MAAI,MAAM,SAAS,EAAE,aAAa,cAAc;AAC9C,QAAI,MAAM,aAAa,YAAa,QAAO,EAAE,SAAS,IAAI,aAAa;AAEvE,QAAI,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAG;AACjD,YAAM,WAAW,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AACzE,aAAO,EAAE,SAAS,GAAG,QAAQ,wBAAwB,MAAM,QAAQ,IAAI;AAAA,IACzE;AACA,UAAM,YAAY,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI;AACtF,YAAQ,MAAM,UAAU;AAAA,MACtB,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAW,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MACnE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAS,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MAChE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MAClE;AAAS,eAAO,EAAE,SAAS,IAAI,aAAa;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,EAAE,SAAS,IAAI,aAAa;AACrC;AAEO,SAAS,gBAAyB,MAAuD;AAC9F,MAAI,SAAS,IAAI,KAAK,IAAI,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD,KAAK,IAAI,EAAE;AAAA,EAC/E;AACA,QAAM,QAAiC;AAAA,IACrC;AAAA,IACA,KAAK,OAAO,UAAU,QAAQ;AAC5B,YAAM,cAAc,KAAK,OAAO,UAAU,UAAU,EAAE,UAAU,sBAAsB,CAAC;AACvF,UAAI,CAAC,YAAY,SAAS;AACxB,cAAM,IAAI,uBAAuB,gBAAgB,YAAY,KAAK,CAAC;AAAA,MACrE;AAYA,UAAI,KAAK,gBAAgB,KAAK,aAAa,SAAS,GAAG;AACrD,cAAM,QAAQ,qBAAqB,SAAS;AAC5C,YAAI,CAAC,KAAK,aAAa,KAAK,CAAC,OAAO,mBAAmB,OAAO,EAAE,CAAC,GAAG;AAClE,gBAAM,IAAI,2BAA2B,6CAA6C,KAAK,IAAI,EAAE;AAAA,QAC/F;AAAA,MACF,OAAO;AACL,+BAAuB,qBAAqB,SAAS,GAAG,KAAK,IAAI;AAAA,MACnE;AAMA,UAAI,KAAK,WAAW;AAClB,wCAAgC,qBAAqB,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,KAAK,QAAQ,YAAY,MAAM,GAAG;AAAA,IAC3C;AAAA,EACF;AAGA,WAAS,IAAI,KAAK,MAAM,KAAkC;AAC1D,SAAO;AACT;AAGO,SAAS,aAAa,MAAiD;AAC5E,SAAO,SAAS,IAAI,IAAI;AAC1B;AAGO,SAAS,2BAAqD;AACnE,SAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAC5B;AAGO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;","names":[]}

package/dist/chunk-KFZY2OFH.js

@@ -0,0 +1,42 @@
+// src/bounded-jsonl-state.ts
+var RECALL_IMPRESSIONS_ROTATE_KEEP_MAX = 1e3;
+function parseBoundedJsonlStateConfig(cfg, parseIntegerAtLeast) {
+  const recallImpressionsRotateKeep = parseIntegerAtLeast(
+    cfg.recallImpressionsRotateKeep,
+    5,
+    1,
+    "recallImpressionsRotateKeep"
+  );
+  if (recallImpressionsRotateKeep > RECALL_IMPRESSIONS_ROTATE_KEEP_MAX) {
+    throw new Error(
+      `recallImpressionsRotateKeep must be an integer between 1 and ${RECALL_IMPRESSIONS_ROTATE_KEEP_MAX}; got ${JSON.stringify(cfg.recallImpressionsRotateKeep)}`
+    );
+  }
+  return {
+    memoryLifecycleLedgerCompactBytes: parseIntegerAtLeast(
+      cfg.memoryLifecycleLedgerCompactBytes,
+      64 * 1024 * 1024,
+      0,
+      "memoryLifecycleLedgerCompactBytes"
+    ),
+    memoryLifecycleLedgerCompactMinIntervalMs: parseIntegerAtLeast(
+      cfg.memoryLifecycleLedgerCompactMinIntervalMs,
+      6 * 60 * 60 * 1e3,
+      6e4,
+      "memoryLifecycleLedgerCompactMinIntervalMs"
+    ),
+    recallImpressionsRotateBytes: parseIntegerAtLeast(
+      cfg.recallImpressionsRotateBytes,
+      32 * 1024 * 1024,
+      0,
+      "recallImpressionsRotateBytes"
+    ),
+    recallImpressionsRotateKeep
+  };
+}
+
+export {
+  RECALL_IMPRESSIONS_ROTATE_KEEP_MAX,
+  parseBoundedJsonlStateConfig
+};
+//# sourceMappingURL=chunk-KFZY2OFH.js.map

package/dist/chunk-KFZY2OFH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bounded-jsonl-state.ts"],"sourcesContent":["/**\n * Bounded JSONL state configuration (issue #1910).\n *\n * Extracted from `config.ts`/`types.ts` so the god-file line-count ratchets\n * (issue #1995) do not grow: `PluginConfig` extends the interface below and\n * `parseConfig` spreads `parseBoundedJsonlStateConfig`. No behavior change —\n * the knobs, defaults, and coercion rules are identical to the inline forms.\n */\n\n/** Knobs that bound the unbounded JSONL state files (issue #1910). */\nexport interface BoundedJsonlStateConfig {\n  /**\n   * Auto-compact `state/memory-lifecycle-ledger.jsonl` when it exceeds this many\n   * bytes, triggered off the debounced maintenance path. `0` disables. Default\n   * 64MB.\n   */\n  memoryLifecycleLedgerCompactBytes: number;\n  /**\n   * Minimum interval between auto-compactions of the lifecycle ledger, so a\n   * heavy rebuild cannot run back-to-back. Floored at 60s. Default 6h.\n   */\n  memoryLifecycleLedgerCompactMinIntervalMs: number;\n  /**\n   * Rotate `state/recall_impressions.jsonl` to `.1..N` when it exceeds this many\n   * bytes. `0` disables. Default 32MB.\n   */\n  recallImpressionsRotateBytes: number;\n  /**\n   * Number of rotated recall-impression archives to keep (`.1 .. .N`). Floored\n   * at 1 when rotation is enabled. Default 5.\n   */\n  recallImpressionsRotateKeep: number;\n}\n\n/** Integer coercion contract shared with `config.ts` (`parseIntegerAtLeast`). */\ntype IntegerParser = (value: unknown, fallback: number, min: number, keyName: string) => number;\n\n/**\n * Upper bound for `recallImpressionsRotateKeep`. Each retained slot costs one\n * rename under the held cross-process impressions lock on every rotation, so an\n * accidentally huge value (a `1000000` typo) would stall recall recording and\n * block other writers. 1000 archives is already far past any real retention\n * need; a larger request is REJECTED before it reaches the rotation loop (#2033).\n */\nexport const RECALL_IMPRESSIONS_ROTATE_KEEP_MAX = 1000;\n\n/**\n * Parse the bounded-state knobs. Numeric knobs accept CLI/overlay string forms\n * (Gotcha #28) via `coerceNumber`, then require an integer >= min. A\n * present-but-malformed or fractional value is REJECTED (throws) rather than\n * silently taking the default; only an absent value falls back. `0` survives\n * when `min` is 0, so the documented disable stays effective on every surface\n * (byte thresholds floor at 0, the min-interval at 60s, and the keep count at 1\n * so rotation always retains at least one archive).\n */\nexport function parseBoundedJsonlStateConfig(\n  cfg: Record<string, unknown>,\n  parseIntegerAtLeast: IntegerParser,\n): BoundedJsonlStateConfig {\n  const recallImpressionsRotateKeep = parseIntegerAtLeast(\n    cfg.recallImpressionsRotateKeep,\n    5,\n    1,\n    \"recallImpressionsRotateKeep\",\n  );\n  if (recallImpressionsRotateKeep > RECALL_IMPRESSIONS_ROTATE_KEEP_MAX) {\n    throw new Error(\n      `recallImpressionsRotateKeep must be an integer between 1 and `\n      + `${RECALL_IMPRESSIONS_ROTATE_KEEP_MAX}; got ${JSON.stringify(cfg.recallImpressionsRotateKeep)}`,\n    );\n  }\n  return {\n    memoryLifecycleLedgerCompactBytes: parseIntegerAtLeast(\n      cfg.memoryLifecycleLedgerCompactBytes,\n      64 * 1024 * 1024,\n      0,\n      \"memoryLifecycleLedgerCompactBytes\",\n    ),\n    memoryLifecycleLedgerCompactMinIntervalMs: parseIntegerAtLeast(\n      cfg.memoryLifecycleLedgerCompactMinIntervalMs,\n      6 * 60 * 60 * 1000,\n      60_000,\n      \"memoryLifecycleLedgerCompactMinIntervalMs\",\n    ),\n    recallImpressionsRotateBytes: parseIntegerAtLeast(\n      cfg.recallImpressionsRotateBytes,\n      32 * 1024 * 1024,\n      0,\n      \"recallImpressionsRotateBytes\",\n    ),\n    recallImpressionsRotateKeep,\n  };\n}\n"],"mappings":";AA4CO,IAAM,qCAAqC;AAW3C,SAAS,6BACd,KACA,qBACyB;AACzB,QAAM,8BAA8B;AAAA,IAClC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,8BAA8B,oCAAoC;AACpE,UAAM,IAAI;AAAA,MACR,gEACK,kCAAkC,SAAS,KAAK,UAAU,IAAI,2BAA2B,CAAC;AAAA,IACjG;AAAA,EACF;AACA,SAAO;AAAA,IACL,mCAAmC;AAAA,MACjC,IAAI;AAAA,MACJ,KAAK,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF;AAAA,IACA,2CAA2C;AAAA,MACzC,IAAI;AAAA,MACJ,IAAI,KAAK,KAAK;AAAA,MACd;AAAA,MACA;AAAA,IACF;AAAA,IACA,8BAA8B;AAAA,MAC5B,IAAI;AAAA,MACJ,KAAK,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-4OKLXWDZ.js → chunk-KNB7IBBU.js}

@@ -1,7 +1,7 @@
 import {
   TOKEN_CAPABILITIES_VERSION,
   normalizeCapabilities
-} from "./chunk-D7FOKIY5.js";
+} from "./chunk-7AMFUATK.js";
 import {
   resolveHomeDir
 } from "./chunk-JUC24CTX.js";
@@ -253,4 +253,4 @@ export {
   getAllValidTokensCached,
   resolveConnectorFromToken
 };
-//# sourceMappingURL=chunk-4OKLXWDZ.js.map
+//# sourceMappingURL=chunk-KNB7IBBU.js.map

package/dist/{chunk-QLULYKWZ.js → chunk-KSXJOC4F.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-JUC24CTX.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/connectors/codex-materialize.ts
 import {
@@ -694,4 +694,4 @@ export {
   truncateToTokenBudget,
   describeMemoriesDir
 };
-//# sourceMappingURL=chunk-QLULYKWZ.js.map
+//# sourceMappingURL=chunk-KSXJOC4F.js.map

package/dist/{chunk-OBMR4VIX.js → chunk-L2DPF4DF.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-DEUNUKTD.js";
 
 // src/graph.ts
-import { appendFile, mkdir, readFile } from "fs/promises";
+import { appendFile, mkdir, readFile, stat } from "fs/promises";
 import * as path from "path";
 var DEFAULT_GRAPH_TRAVERSAL_CONFIDENCE_FLOOR = 0.2;
 var DEFAULT_GRAPH_TRAVERSAL_PAGERANK_ITERATIONS = 8;
@@ -217,14 +217,96 @@ var GraphIndex = class _GraphIndex {
     if (this.edgeCache && Date.now() - this.edgeCache.loadedAt < _GraphIndex.EDGE_CACHE_TTL_MS) {
       return this.edgeCache.allEdges;
     }
-    const allEdges = await readAllEdges(this.memoryDir, {
-      entityGraph: this.cfg.entityGraphEnabled,
-      timeGraph: this.cfg.timeGraphEnabled,
-      causalGraph: this.cfg.causalGraphEnabled
-    });
-    this.edgeCache = { allEdges, loadedAt: Date.now() };
+    let allEdges = [];
+    let meta = await this.readEnabledGraphFileMeta();
+    let stable = false;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const before = meta;
+      allEdges = await readAllEdges(this.memoryDir, {
+        entityGraph: this.cfg.entityGraphEnabled,
+        timeGraph: this.cfg.timeGraphEnabled,
+        causalGraph: this.cfg.causalGraphEnabled
+      });
+      meta = await this.readEnabledGraphFileMeta();
+      if (this.graphFileMetaEqual(before, meta)) {
+        stable = true;
+        break;
+      }
+    }
+    if (stable) {
+      this.edgeCache = { allEdges, loadedAt: Date.now(), meta };
+    } else {
+      this.edgeCache = null;
+    }
     return allEdges;
   }
+  /**
+   * Identity ({ size, mtimeMs, ino }) of each ENABLED graph file (issue #1904).
+   * Missing files (ENOENT) and any stat error map to the all-zero sentinel so
+   * the baseline is fail-open: a later revalidation sees a mismatch (or a peer
+   * creation flipping ino from 0 to non-zero) and forces a full reload rather
+   * than trusting a stale incremental push.
+   */
+  async readEnabledGraphFileMeta() {
+    const enabled = [];
+    if (this.cfg.entityGraphEnabled) enabled.push("entity");
+    if (this.cfg.timeGraphEnabled) enabled.push("time");
+    if (this.cfg.causalGraphEnabled) enabled.push("causal");
+    const meta = {};
+    for (const type of enabled) {
+      try {
+        const st = await stat(graphFilePath(this.memoryDir, type));
+        meta[type] = { size: st.size, mtimeMs: st.mtimeMs, ino: Number(st.ino) };
+      } catch {
+        meta[type] = { size: 0, mtimeMs: 0, ino: 0 };
+      }
+    }
+    return meta;
+  }
+  /** True iff both metadata maps carry identical identity for every key. */
+  graphFileMetaEqual(a, b) {
+    const types = ["entity", "time", "causal"];
+    for (const type of types) {
+      const x = a[type];
+      const y = b[type];
+      if (!x && !y) continue;
+      if (!x || !y) return false;
+      if (x.size !== y.size || x.mtimeMs !== y.mtimeMs || x.ino !== y.ino) return false;
+    }
+    return true;
+  }
+  /**
+   * Re-stat every graph file whose identity the cache just committed and return
+   * false if any has moved since (issue #1904, Codex). Closes the validation→
+   * in-place-push TOCTOU window: a peer process (concurrent CLI / daemon /
+   * decay job) can append between edgeFilesUnchangedExceptOurAppends()'s final
+   * stat and the allEdges.push(...). Without this re-check the cache would be
+   * accepted with identity predating the peer write and miss the peer edge for
+   * the TTL. A residual infinitesimal window (peer writes during this re-stat)
+   * remains and is TTL-bounded.
+   */
+  async edgeCacheIdentityUnchangedSinceCommit() {
+    if (!this.edgeCache) return false;
+    for (const type of Object.keys(this.edgeCache.meta)) {
+      const committed = this.edgeCache.meta[type];
+      if (!committed) continue;
+      let cur;
+      try {
+        const st = await stat(graphFilePath(this.memoryDir, type));
+        cur = { size: st.size, mtimeMs: st.mtimeMs, ino: Number(st.ino) };
+      } catch (err) {
+        if (err?.code === "ENOENT") {
+          cur = { size: 0, mtimeMs: 0, ino: 0 };
+        } else {
+          return false;
+        }
+      }
+      if (cur.size !== committed.size || cur.mtimeMs !== committed.mtimeMs || cur.ino !== committed.ino) {
+        return false;
+      }
+    }
+    return true;
+  }
   /**
    * Called after a memory is written to disk.
    *
@@ -244,52 +326,141 @@ var GraphIndex = class _GraphIndex {
     const timeOn = g ? g.timeGraph : this.cfg.timeGraphEnabled;
     const causalOn = g ? g.causalGraph : this.cfg.causalGraphEnabled;
     const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const appended = [];
     try {
       if (entityOn && opts.entityRef && opts.entitySiblings?.length) {
         const siblings = opts.entitySiblings.slice(0, this.cfg.maxEntityGraphEdgesPerMemory);
         for (const sibling of siblings) {
-          await appendEdge(this.memoryDir, {
+          const edge = {
             from: opts.memoryPath,
             to: sibling,
             type: "entity",
             weight: 1,
             label: opts.entityRef,
             ts
-          });
+          };
+          appended.push(edge);
+          await appendEdge(this.memoryDir, edge);
         }
       }
       if (timeOn && opts.threadId && opts.recentInThread?.length) {
         const predecessor = opts.recentInThread[opts.recentInThread.length - 1];
         if (predecessor && predecessor !== opts.memoryPath) {
-          await appendEdge(this.memoryDir, {
+          const edge = {
             from: predecessor,
             to: opts.memoryPath,
             type: "time",
             weight: 1,
             label: opts.threadId,
             ts
-          });
+          };
+          appended.push(edge);
+          await appendEdge(this.memoryDir, edge);
         }
       }
       if (causalOn && opts.causalPredecessor) {
         const phrase = detectCausalPhrase(opts.content);
         if (phrase) {
-          await appendEdge(this.memoryDir, {
+          const edge = {
             from: opts.causalPredecessor,
             to: opts.memoryPath,
             type: "causal",
             weight: 1,
             label: phrase,
             ts
-          });
+          };
+          appended.push(edge);
+          await appendEdge(this.memoryDir, edge);
         }
       }
     } catch (err) {
       const { log } = await import("./logger.js");
       log.warn(`[graph] onMemoryWritten error: ${err}`);
     } finally {
-      this.edgeCache = null;
+      if (!this.edgeCache || Date.now() - this.edgeCache.loadedAt >= _GraphIndex.EDGE_CACHE_TTL_MS) {
+        this.edgeCache = null;
+      } else if (this.cfg.graphEdgeCacheIncrementalEnabled === false) {
+        this.edgeCache = null;
+      } else {
+        try {
+          if (await this.edgeFilesUnchangedExceptOurAppends(appended)) {
+            if (appended.length > 0) {
+              this.edgeCache.allEdges.push(...appended);
+              if (this.edgeCache && !await this.edgeCacheIdentityUnchangedSinceCommit()) {
+                this.edgeCache = null;
+              }
+            }
+          } else {
+            this.edgeCache = null;
+          }
+        } catch {
+          this.edgeCache = null;
+        }
+      }
+    }
+  }
+  /**
+   * Cross-process coherence check for the incremental edge cache (issue #1904).
+   *
+   * Returns true iff every ENABLED graph file's current identity is explained
+   * ENTIRELY by THIS call's own append — no other process wrote to any graph
+   * file since load. Per file:
+   *   - inode must be unchanged. A local append (`appendFile`) keeps the inode;
+   *     an external atomic temp+rename rewrite (e.g. the edge-decay job) changes
+   *     it, so an inode change — even one that preserves byte length, such as
+   *     decaying confidence 0.9->0.8 — forces a reload (Codex).
+   *   - a file WE appended to (delta > 0): size must equal baseline + our exact
+   *     appended bytes. If it was absent at load (sentinel ino 0), our append
+   *     created it, so we accept size === delta and adopt the new identity.
+   *   - a file we did NOT touch (delta 0): size AND mtime must be unchanged, so
+   *     an in-place equal-length rewrite (mtime bump) or a peer append (size
+   *     bump) both force a reload.
+   * On success it commits the new identity baseline so the next append
+   * revalidates against post-this-write truth. Fail-open: an unreadable file
+   * (non-ENOENT) returns false, forcing a full reload.
+   */
+  async edgeFilesUnchangedExceptOurAppends(appended) {
+    if (!this.edgeCache) return false;
+    const expectedDelta = {};
+    for (const edge of appended) {
+      const bytes = Buffer.byteLength(`${JSON.stringify(edge)}
+`, "utf8");
+      expectedDelta[edge.type] = (expectedDelta[edge.type] ?? 0) + bytes;
+    }
+    const enabled = [];
+    if (this.cfg.entityGraphEnabled) enabled.push("entity");
+    if (this.cfg.timeGraphEnabled) enabled.push("time");
+    if (this.cfg.causalGraphEnabled) enabled.push("causal");
+    const observed = {};
+    for (const type of enabled) {
+      let cur;
+      try {
+        const st = await stat(graphFilePath(this.memoryDir, type));
+        cur = { size: st.size, mtimeMs: st.mtimeMs, ino: Number(st.ino) };
+      } catch (err) {
+        if (err?.code === "ENOENT") {
+          cur = { size: 0, mtimeMs: 0, ino: 0 };
+        } else {
+          return false;
+        }
+      }
+      const base = this.edgeCache.meta[type] ?? { size: 0, mtimeMs: 0, ino: 0 };
+      const delta = expectedDelta[type] ?? 0;
+      if (delta > 0) {
+        if (base.ino === 0) {
+          if (cur.ino === 0 || cur.size !== delta) return false;
+        } else {
+          if (cur.ino !== base.ino || cur.size !== base.size + delta) return false;
+        }
+      } else {
+        if (cur.ino !== base.ino || cur.size !== base.size || cur.mtimeMs !== base.mtimeMs) {
+          return false;
+        }
+      }
+      observed[type] = cur;
     }
+    this.edgeCache.meta = observed;
+    return true;
   }
   /**
    * Spreading activation BFS (SYNAPSE-inspired).
@@ -532,4 +703,4 @@ export {
   applyPageRankRefinement,
   applyLateralInhibition
 };
-//# sourceMappingURL=chunk-OBMR4VIX.js.map
+//# sourceMappingURL=chunk-L2DPF4DF.js.map