@remnic/core 9.7.15 → 9.9.0

package/src/orchestration/extraction-persist.ts

@@ -19,6 +19,12 @@
  * tests continue to work.
  */
 
+import { isMemoryCategory } from "../write-envelope.js";
+import {
+  composeSalvagedExtractionEnvelope,
+  probeSalvageSurvivingFields,
+  withReservedMarkerTag,
+} from "./extraction-envelope.js";
 import path from "node:path";
 import {
   StorageManager,
@@ -38,6 +44,7 @@ import {
   resolveNamespaceCapabilities,
   resolveRecallEnhancementCapabilities,
   resolveConversationContextCapabilities,
+  resolveRecallAuxiliaryCapabilities,
   type GraphConstructionCapabilitySet,
   type MemoryLifecycleCapabilitySet,
 } from "../capabilities.js";
@@ -101,8 +108,14 @@ import type {
   MemoryLink,
   PluginConfig,
   ProvenanceSource,
+  MemoryCategory,
 } from "../types.js";
-import { confidenceTier } from "../types.js";
+import {
+  flushDeferredFactHashOnFailure,
+  profileAutoPromotionAllows,
+  readActiveMemoriesBothTiers,
+  shouldPromoteToShared,
+} from "./extraction-persist-promotion.js";
 import type { ResolvedScopeProfilePlan } from "../namespaces/scope-profiles.js";
 import {
   buildMemoryPathById,
@@ -208,7 +221,6 @@ export class ExtractionPersistCoordinator {
   constructor(
     private readonly deps: ExtractionPersistDeps,
   ) {}
-
   private get config(): PluginConfig {
     return this.deps.config;
   }
@@ -224,7 +236,7 @@ export class ExtractionPersistCoordinator {
     sourceText?: string,
     graphCaps: GraphConstructionCapabilitySet = resolveGraphConstructionCapabilities(this.deps.config),
     lifecycleCaps: MemoryLifecycleCapabilitySet = resolveMemoryLifecycleCapabilities(this.deps.config),
-  ): Promise<string[]> {
+  ): Promise<{ persistedIds: string[]; memoryPathById: Map<string, string> }> {
     // Inline source attribution (issue #369). When enabled, every extracted
     // fact is rewritten to carry a compact provenance tag inside its body so
     // the citation survives hostile memory text, copy/paste, and LLM quoting.
@@ -232,6 +244,15 @@ export class ExtractionPersistCoordinator {
     // see zero behavioral change.
     const citationEnabled = resolvePipelineProcessingCapabilities(this.deps.config).inlineSourceAttribution === true;
     const citationTemplate = this.deps.config.inlineSourceAttributionFormat;
+    // #1909: the main-path fact writes defer their per-fact fact-hash-index flush
+    // to the orchestrator's end-of-persist reconciling batch save ONLY when fact
+    // deduplication is enabled (with it off, contentHashIndexForStorage() returns
+    // null and the batch save is a no-op, so the write must save immediately).
+    // Round 11: there is NO fact-hashes.ready marker anymore — the fact-hash
+    // index is ALWAYS rebuilt from the corpus on restart (see
+    // ensureFactHashIndexAuthoritative), so a deferred write, crash, or
+    // multi-process interleave is safe by construction with no marker to guard.
+    const factDedupEnabled = resolveRecallAuxiliaryCapabilities(this.deps.config).factDeduplication;
 
   // Canonicalize stored content for dedup comparison: strip citations
   // (using the same template), sanitize, then normalize whitespace.
@@ -268,14 +289,12 @@ export class ExtractionPersistCoordinator {
       return attachCitation(content, citationContext, citationTemplate);
     };
     const persistedIds: string[] = [];
+    const memoryPathById = new Map<string, string>();
     const supersessionOrderingAt = (validAt?: string): string =>
       validAt && validAt.length > 0 ? validAt : new Date().toISOString();
     // #1635: pending_review persisted ids, excluded from the thread episode set below.
     const pendingReviewPersistedIds: string[] = [];
-    const persistedIdsByStorage = new Map<
-      string,
-      { storage: StorageManager; ids: string[] }
-    >();
+    const persistedIdsByStorage = new Map<string, { storage: StorageManager; ids: string[] }>();
     const trackPersistedId = (
       targetStorage: StorageManager,
       id: string,
@@ -283,6 +302,7 @@ export class ExtractionPersistCoordinator {
         includeReturnedIds?: boolean;
         /** #1635: keep this id out of the persisted thread episode set. */
         pendingReview?: boolean;
+        category?: MemoryCategory;
       } = {},
     ): void => {
       if (options.includeReturnedIds !== false) {
@@ -295,14 +315,16 @@ export class ExtractionPersistCoordinator {
       const existing = persistedIdsByStorage.get(key);
       if (existing) {
         existing.ids.push(id);
-        return;
+      } else {
+        persistedIdsByStorage.set(key, { storage: targetStorage, ids: [id] });
+      }
+      if (options.category && !memoryPathById.has(id)) {
+        const relPath = resolvePersistedMemoryRelativePath({ memoryId: id, pathById: memoryPathById, category: options.category });
+        memoryPathById.set(id, relPath);
       }
-      persistedIdsByStorage.set(key, { storage: targetStorage, ids: [id] });
     };
     let dedupedCount = 0;
     // Counter for facts skipped by the importance write-gate (issue #372).
-    // Emitted via the `importance_gated` metric below and rolled into the
-    // final `persisted:` log line so operators can tune the threshold.
     let importanceGatedCount = 0;
     // UUI2: short-circuit semantic dedup after first backend-unavailable signal
     // within this batch. Once any fact in the batch gets reason="backend_unavailable"
@@ -349,12 +371,6 @@ export class ExtractionPersistCoordinator {
         events: [...events],
       });
     };
-    const confidenceTierOrder = [
-      "explicit",
-      "implied",
-      "inferred",
-      "speculative",
-    ] as const;
     const sharedProfileLayer = scopeProfileWritePlan?.layers.find(
       (layer) =>
         layer.id === "serverShared" &&
@@ -378,59 +394,6 @@ export class ExtractionPersistCoordinator {
     // (pre-judge + write-loop) so no new scattered config.*Enabled read is
     // introduced (ratchet scatteredConfigFlagReads; see #1523).
     const namespacesEnabled = resolveNamespaceCapabilities(this.deps.config).namespaces;
-    const profileAutoPromotionAllows = (
-      category: string,
-      confidence: number,
-    ): boolean => {
-      if (!scopeProfileWritePlan) return false;
-      const actualTier = confidenceTier(confidence);
-      const actualRank = confidenceTierOrder.indexOf(actualTier);
-      if (actualRank === -1) return false;
-      const autoPromote = scopeProfileWritePlan.profile.autoPromote;
-      if (!autoPromote.enabled) return false;
-      if (!autoPromote.categories.includes(category as any)) return false;
-      const minimumRank = confidenceTierOrder.indexOf(autoPromote.minConfidenceTier);
-      return minimumRank !== -1 && actualRank <= minimumRank;
-    };
-    const sharedAutoPromotionAllows = (
-      category: string,
-      confidence: number,
-    ): boolean => {
-      if (!scopeProfileWritePlan) {
-        const actualTier = confidenceTier(confidence);
-        const actualRank = confidenceTierOrder.indexOf(actualTier);
-        if (actualRank === -1) return false;
-        if (!resolveRecallEnhancementCapabilities(this.deps.config).autoPromoteToShared) return false;
-        if (!this.deps.config.autoPromoteToSharedCategories.includes(category as any))
-          return false;
-        const minimumRank = confidenceTierOrder.indexOf(
-          this.deps.config.autoPromoteMinConfidenceTier,
-        );
-        return minimumRank !== -1 && actualRank <= minimumRank;
-      }
-      return (
-        scopeProfileWritePlan.profile.autoPromote.targets.includes("serverShared") &&
-        profileAutoPromotionAllows(category, confidence)
-      );
-    };
-    const shouldPromoteToShared = (
-      targetStorage: StorageManager,
-      category: string,
-      confidence: number,
-    ): boolean => {
-      if (
-        !resolveNamespaceCapabilities(this.deps.config).namespaces ||
-        !profileAllowsSharedWrites ||
-        !sharedAutoPromotionAllows(category, confidence)
-      )
-        return false;
-      if (
-        this.deps.storageDirNamespace(targetStorage.dir) ===
-        this.deps.config.sharedNamespace
-      )
-        return false;
-      return true;
-    };
     const promoteMemoryToProfileTargets = async (options: {
       sourceStorage: StorageManager;
       category: string;
@@ -457,7 +420,7 @@ export class ExtractionPersistCoordinator {
     }): Promise<void> => {
       if (
         !scopeProfileWritePlan ||
-        !profileAutoPromotionAllows(options.category, options.confidence)
+        !profileAutoPromotionAllows(scopeProfileWritePlan, options.category, options.confidence)
       )
         return;
       const autoTargets = new Set(scopeProfileWritePlan.profile.autoPromote.targets);
@@ -475,17 +438,35 @@ export class ExtractionPersistCoordinator {
           : options.content;
       const citedContent = applyInlineCitation(rawContent);
       const sanitizedBase = sanitizeMemoryContent(rawContent);
-      const dedupContent =
-        options.category === "fact" &&
-        options.structuredAttributes &&
-        Object.keys(options.structuredAttributes).length > 0
-          ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs(options.structuredAttributes)}]`
-          : sanitizedBase.text;
       for (const target of targets) {
         if (!target.namespace) continue;
         try {
           const targetStorage = await this.deps.getStorageRouter().storageFor(target.namespace);
           if (targetStorage.dir === options.sourceStorage.dir) continue;
+          // Compose BEFORE the dedup gate (#2014 round 2): salvage mode may
+          // drop or clamp attributes, and the dedup hash, contentHashSource,
+          // and supersession keys below must all describe the SURVIVING
+          // fields that writeSealedMemory actually persists.
+          const targetPromotionEnvelope = composeSalvagedExtractionEnvelope(
+            {
+              content: citedContent,
+              category: options.category as MemoryCategory,
+              confidence: options.confidence,
+              tags: withReservedMarkerTag(options.tags, `${target.target}-promotion`),
+              entityRef: options.entityRef,
+              structuredAttributes: options.structuredAttributes,
+              validAt: options.validAt,
+              ...(sourceContext?.sourceConnector ? { sourceConnector: sourceContext.sourceConnector } : {}),
+            },
+            { source: `${options.source}-${target.target}-promotion` },
+          );
+          const targetSurvivingAttrs = targetPromotionEnvelope.rawStructuredAttributes;
+          const dedupContent =
+            options.category === "fact" &&
+            targetSurvivingAttrs &&
+            Object.keys(targetSurvivingAttrs).length > 0
+              ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs({ ...targetSurvivingAttrs })}]`
+              : sanitizedBase.text;
           if (
             options.category === "fact" &&
             (await targetStorage.hasFactContentHash(dedupContent))
@@ -495,7 +476,7 @@ export class ExtractionPersistCoordinator {
             // Different connectors with same content should NOT be deduped.
             let skipPromotion = true;
             try {
-              const allMems = await targetStorage.readAllMemories();
+              const allMems = await readActiveMemoriesBothTiers(targetStorage);
               const nc = sourceContext?.sourceConnector?.trim() || undefined;
               skipPromotion = allMems.some((m) => {
                 if (m.frontmatter.category !== options.category) return false;
@@ -526,40 +507,34 @@ export class ExtractionPersistCoordinator {
                   ...(options.observedAt ? { observedAt: options.observedAt } : {}),
                   ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
                 },
-                options.entityRef,
+                // #2014 round 3: the envelope's SURVIVING entityRef — the raw
+                // option can differ (untrimmed/dropped) from what sealed
+                // writes persisted, mistargeting the backfill row.
+                targetPromotionEnvelope.entityRef,
                 sourceContext?.sourceConnector,
               );
             }
             continue;
             }
           }
-          const targetPromotion = await targetStorage.writeMemory(
-            options.category as any,
-            citedContent,
-            {
-              confidence: options.confidence,
-              tags: [...options.tags, `${target.target}-promotion`],
-              entityRef: options.entityRef,
-              structuredAttributes: options.structuredAttributes,
-              source: `${options.source}-${target.target}-promotion`,
-              importance: options.importance,
-              lineage: [options.sourceMemoryId],
-              sourceMemoryId: options.sourceMemoryId,
-              intentGoal: options.intentGoal,
-              intentActionType: options.intentActionType,
-              intentEntityTypes: options.intentEntityTypes,
-              memoryKind: options.memoryKind,
-              validAt: options.validAt,
-              // #1578 — forward bi-temporal bounds + ingestion provenance.
-              ...(options.invalidAt ? { invalidAt: options.invalidAt } : {}),
-              ...(options.observedAt ? { observedAt: options.observedAt } : {}),
-              ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
-              contentHashSource: options.category === "fact" ? dedupContent : rawContent,
-              ...(options.sources && options.sources.length > 0 ? { sources: options.sources } : {}),
-              ...(options.provenance ? { provenance: options.provenance } : {}),
-              ...(sourceContext?.sourceConnector ? { sourceConnector: sourceContext.sourceConnector } : {}),
-            },
-          );
+          // Sealed-envelope write (issue #1989 PR2): cross-cutting fields ride
+          // the composed envelope (built above, before the dedup gate).
+          const targetPromotion = await targetStorage.writeSealedMemory(targetPromotionEnvelope, {
+            importance: options.importance,
+            lineage: [options.sourceMemoryId],
+            sourceMemoryId: options.sourceMemoryId,
+            intentGoal: options.intentGoal,
+            intentActionType: options.intentActionType,
+            intentEntityTypes: options.intentEntityTypes,
+            memoryKind: options.memoryKind,
+            // #1578 — forward bi-temporal bounds + ingestion provenance.
+            ...(options.invalidAt ? { invalidAt: options.invalidAt } : {}),
+            ...(options.observedAt ? { observedAt: options.observedAt } : {}),
+            ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
+            contentHashSource: options.category === "fact" ? dedupContent : rawContent,
+            ...(options.sources && options.sources.length > 0 ? { sources: options.sources } : {}),
+            ...(options.provenance ? { provenance: options.provenance } : {}),
+          });
           const promotedId = targetPromotion.id;
           // #1645: if the TARGET namespace's own tombstone blocked this promotion,
           // the row lands pending_review — do NOT supersede active target memories.
@@ -567,16 +542,16 @@ export class ExtractionPersistCoordinator {
             !targetPromotion.tombstoneBlocked &&
             lifecycleCaps.temporalSupersession &&
             options.category === "fact" &&
-            options.entityRef &&
-            options.structuredAttributes &&
-            Object.keys(options.structuredAttributes).length > 0
+            targetPromotionEnvelope.entityRef &&
+            targetSurvivingAttrs &&
+            Object.keys(targetSurvivingAttrs).length > 0
           ) {
             try {
               await applyTemporalSupersession({
                 storage: targetStorage,
                 newMemoryId: promotedId,
-                entityRef: options.entityRef,
-                structuredAttributes: options.structuredAttributes,
+                entityRef: targetPromotionEnvelope.entityRef,
+                structuredAttributes: { ...targetSurvivingAttrs },
                 createdAt: supersessionOrderingAt(options.validAt),
                 enabled: !(options.eventTimeSource === "extracted" && !options.validAt),
               });
@@ -589,7 +564,7 @@ export class ExtractionPersistCoordinator {
           // #1645 TV6: a tombstone-blocked promotion is pending_review (no
           // active copy) — skip catalog/index/behavior like postWriteGuard.
           if (!targetPromotion.tombstoneBlocked) {
-            trackPersistedId(targetStorage, promotedId, { includeReturnedIds: false });
+            trackPersistedId(targetStorage, promotedId, { includeReturnedIds: false, category: options.category as MemoryCategory });
             await this.deps.indexPersistedMemory(targetStorage, promotedId);
             trackBehaviorSignals(
               targetStorage,
@@ -639,6 +614,10 @@ export class ExtractionPersistCoordinator {
       await promoteMemoryToProfileTargets(options);
       if (
         !shouldPromoteToShared(
+          this.deps.config,
+          scopeProfileWritePlan,
+          profileAllowsSharedWrites,
+          (dir) => this.deps.storageDirNamespace(dir),
           options.sourceStorage,
           options.category,
           options.confidence,
@@ -693,11 +672,29 @@ export class ExtractionPersistCoordinator {
             : options.content;
         const citedContent = applyInlineCitation(rawContent);
         const sanitizedBase = sanitizeMemoryContent(rawContent);
+        // Compose BEFORE the dedup gate (#2014 round 2): salvage mode may drop
+        // or clamp attributes, and the dedup hash, contentHashSource, and
+        // supersession keys below must all describe the SURVIVING fields that
+        // writeSealedMemory actually persists — never the raw extractor map.
+        const sharedPromotionEnvelope = composeSalvagedExtractionEnvelope(
+          {
+            content: citedContent,
+            category: options.category as MemoryCategory,
+            confidence: options.confidence,
+            tags: withReservedMarkerTag(options.tags, "shared-promotion"),
+            entityRef: options.entityRef,
+            structuredAttributes: options.structuredAttributes,
+            validAt: options.validAt,
+            ...(sourceContext?.sourceConnector ? { sourceConnector: sourceContext.sourceConnector } : {}),
+          },
+          { source: `${options.source}-shared-promotion` },
+        );
+        const sharedSurvivingAttrs = sharedPromotionEnvelope.rawStructuredAttributes;
         const dedupContent =
           options.category === "fact" &&
-          options.structuredAttributes &&
-          Object.keys(options.structuredAttributes).length > 0
-            ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs(options.structuredAttributes)}]`
+          sharedSurvivingAttrs &&
+          Object.keys(sharedSurvivingAttrs).length > 0
+            ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs({ ...sharedSurvivingAttrs })}]`
             : sanitizedBase.text;
         if (
           options.category === "fact" &&
@@ -712,7 +709,7 @@ export class ExtractionPersistCoordinator {
           let sharedSameConnector = true;
           if (options.invalidAt || options.validAt) {
             try {
-              const sharedMems = await sharedStorage.readAllMemories();
+              const sharedMems = await readActiveMemoriesBothTiers(sharedStorage);
               const snc = sourceContext?.sourceConnector?.trim() || undefined;
               sharedSameConnector = sharedMems.some((m) => {
                 if (m.frontmatter.category !== "fact") return false;
@@ -750,7 +747,8 @@ export class ExtractionPersistCoordinator {
                 ...(options.observedAt ? { observedAt: options.observedAt } : {}),
                 ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
               },
-              options.entityRef,
+              // #2014 round 3: envelope-surviving entityRef (see profile-target).
+              sharedPromotionEnvelope.entityRef,
               sourceContext?.sourceConnector,
             );
           }
@@ -767,9 +765,9 @@ export class ExtractionPersistCoordinator {
           // step — if the lookup fails we skip silently (same as the normal path).
           if (
             lifecycleCaps.temporalSupersession &&
-            options.entityRef &&
-            options.structuredAttributes &&
-            Object.keys(options.structuredAttributes).length > 0
+            sharedPromotionEnvelope.entityRef &&
+            sharedSurvivingAttrs &&
+            Object.keys(sharedSurvivingAttrs).length > 0
           ) {
             // PR #402 round-7 (Fix #2 / Codex P1 PRRT_kwDORJXyws56VALC):
             // Track whether matchingFact lookup completed before the try block
@@ -787,7 +785,7 @@ export class ExtractionPersistCoordinator {
               // sanitization redacted the content, causing the candidate lookup to
               // return undefined and leaving stale facts active.
               const normalizedIncoming = ContentHashIndex.normalizeContent(dedupContent);
-              const allShared = await sharedStorage.readAllMemories();
+              const allShared = await readActiveMemoriesBothTiers(sharedStorage);
               // PR #402 round-12 (Finding Uybg): restrict hash-dedup matching to
               // the SAME entity.  Content-hash equality alone can collide across
               // entities when two entities share identical fact text.  Using an
@@ -795,7 +793,7 @@ export class ExtractionPersistCoordinator {
               // supersession to that entity's record and corrupt its
               // `supersededBy` links.  Only consider facts whose normalized
               // `entityRef` matches the incoming entity.
-              const incomingEntityNorm = normalizeSupersessionKey(options.entityRef);
+              const incomingEntityNorm = normalizeSupersessionKey(sharedPromotionEnvelope.entityRef);
               hashDedupMatchingFact = allShared.find((m) => {
                 if (m.frontmatter.category !== "fact") return false;
                 if ((m.frontmatter.status ?? "active") !== "active") return false;
@@ -839,8 +837,8 @@ export class ExtractionPersistCoordinator {
                 const hashDedupSupersession = await applyTemporalSupersession({
                   storage: sharedStorage,
                   newMemoryId: hashDedupMatchingFact.frontmatter.id,
-                  entityRef: options.entityRef,
-                  structuredAttributes: options.structuredAttributes,
+                  entityRef: sharedPromotionEnvelope.entityRef,
+                  structuredAttributes: { ...sharedSurvivingAttrs },
                   createdAt: supersessionOrderingAt(options.validAt),
                   enabled: !(options.eventTimeSource === "extracted" && !options.validAt),
                   useCallerTimestamp: true,
@@ -903,7 +901,7 @@ export class ExtractionPersistCoordinator {
             // fact gets its own promoted copy.
             let skipSharedPromotion = true;
             try {
-              const allSharedMems = await sharedStorage.readAllMemories();
+              const allSharedMems = await readActiveMemoriesBothTiers(sharedStorage);
               const snc = sourceContext?.sourceConnector?.trim() || undefined;
               const sharedNormalized = ContentHashIndex.normalizeContent(dedupContent);
               skipSharedPromotion = allSharedMems.some((m) => {
@@ -924,34 +922,23 @@ export class ExtractionPersistCoordinator {
             // No same-connector active shared fact — fall through to write.
           }
         }
-        const sharedPromotion = await sharedStorage.writeMemory(
-          options.category as any,
-          citedContent,
-          {
-            confidence: options.confidence,
-            tags: [...options.tags, "shared-promotion"],
-            entityRef: options.entityRef,
-            structuredAttributes: options.structuredAttributes,
-            source: `${options.source}-shared-promotion`,
-            importance: options.importance,
-            lineage: [options.sourceMemoryId],
-            sourceMemoryId: options.sourceMemoryId,
-            intentGoal: options.intentGoal,
-            intentActionType: options.intentActionType,
-            intentEntityTypes: options.intentEntityTypes,
-            memoryKind: options.memoryKind,
-            validAt: options.validAt,
-            // #1578 — forward bi-temporal bounds + ingestion provenance.
-            ...(options.invalidAt ? { invalidAt: options.invalidAt } : {}),
-            ...(options.observedAt ? { observedAt: options.observedAt } : {}),
-            ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
-            contentHashSource: options.category === "fact" ? dedupContent : rawContent,
-            // Claim-level provenance spans (issue #1575 PR 2).
-            ...(options.sources && options.sources.length > 0 ? { sources: options.sources } : {}),
-            ...(options.provenance ? { provenance: options.provenance } : {}),
-            ...(sourceContext?.sourceConnector ? { sourceConnector: sourceContext.sourceConnector } : {}),
-          },
-        );
+        const sharedPromotion = await sharedStorage.writeSealedMemory(sharedPromotionEnvelope, {
+          importance: options.importance,
+          lineage: [options.sourceMemoryId],
+          sourceMemoryId: options.sourceMemoryId,
+          intentGoal: options.intentGoal,
+          intentActionType: options.intentActionType,
+          intentEntityTypes: options.intentEntityTypes,
+          memoryKind: options.memoryKind,
+          // #1578 — forward bi-temporal bounds + ingestion provenance.
+          ...(options.invalidAt ? { invalidAt: options.invalidAt } : {}),
+          ...(options.observedAt ? { observedAt: options.observedAt } : {}),
+          ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
+          contentHashSource: options.category === "fact" ? dedupContent : rawContent,
+          // Claim-level provenance spans (issue #1575 PR 2).
+          ...(options.sources && options.sources.length > 0 ? { sources: options.sources } : {}),
+          ...(options.provenance ? { provenance: options.provenance } : {}),
+        });
         const promotedId = sharedPromotion.id;
         // #1645: if the shared namespace's own tombstone blocked this promotion,
         // leave the row pending_review but do NOT supersede active shared memories.
@@ -964,16 +951,16 @@ export class ExtractionPersistCoordinator {
         if (
           !sharedPromotion.tombstoneBlocked &&
           lifecycleCaps.temporalSupersession &&
-          options.entityRef &&
-          options.structuredAttributes &&
-          Object.keys(options.structuredAttributes).length > 0
+          sharedPromotionEnvelope.entityRef &&
+          sharedSurvivingAttrs &&
+          Object.keys(sharedSurvivingAttrs).length > 0
         ) {
           try {
             await applyTemporalSupersession({
               storage: sharedStorage,
               newMemoryId: promotedId,
-              entityRef: options.entityRef,
-              structuredAttributes: options.structuredAttributes,
+              entityRef: sharedPromotionEnvelope.entityRef,
+              structuredAttributes: { ...sharedSurvivingAttrs },
               createdAt: supersessionOrderingAt(options.validAt),
               enabled: !(options.eventTimeSource === "extracted" && !options.validAt),
             });
@@ -996,6 +983,7 @@ export class ExtractionPersistCoordinator {
         if (!sharedPromotion.tombstoneBlocked) {
           trackPersistedId(sharedStorage, promotedId, {
             includeReturnedIds: false,
+            category: options.category as MemoryCategory,
           });
           await this.deps.indexPersistedMemory(sharedStorage, promotedId);
           trackBehaviorSignals(
@@ -1055,11 +1043,28 @@ export class ExtractionPersistCoordinator {
           ? stripCitationForTemplate(args.content, citationTemplate)
           : args.content;
       const sanitizedBase = sanitizeMemoryContent(rawContent);
+      // #2014 round 3: promoted copies were written from SALVAGE envelopes,
+      // so hash on the same surviving fields those writes persisted — a
+      // raw-attrs hash silently misses after salvage drops/dedupes keys.
+      // Fail open to raw fields when the probe rejects.
+      const probed =
+        args.category === "fact" && isMemoryCategory(args.category)
+          ? probeSalvageSurvivingFields({
+              content: rawContent,
+              category: args.category,
+              structuredAttributes: args.structuredAttributes,
+              entityRef: args.entityRef,
+            })
+          : null;
+      const backfillEntityRef = probed ? probed.entityRef : args.entityRef;
+      const survivingBackfillAttrs = probed
+        ? probed.structuredAttributes
+        : args.structuredAttributes;
       const dedupContent =
         args.category === "fact" &&
-        args.structuredAttributes &&
-        Object.keys(args.structuredAttributes).length > 0
-          ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs(args.structuredAttributes)}]`
+        survivingBackfillAttrs &&
+        Object.keys(survivingBackfillAttrs).length > 0
+          ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs(survivingBackfillAttrs)}]`
           : sanitizedBase.text;
       // Profile targets. NOTE: we do NOT gate on profileAutoPromotionAllows —
       // a promoted profile copy may exist from an EARLIER extraction with
@@ -1090,7 +1095,7 @@ export class ExtractionPersistCoordinator {
               targetStorage,
               dedupContent,
               args.bounds,
-              args.entityRef,
+              backfillEntityRef,
               args.sourceConnector,
             );
           } catch (err) {
@@ -1118,7 +1123,7 @@ export class ExtractionPersistCoordinator {
               sharedStorage,
               dedupContent,
               args.bounds,
-              args.entityRef,
+              backfillEntityRef,
               args.sourceConnector,
             );
           }
@@ -1136,7 +1141,7 @@ export class ExtractionPersistCoordinator {
         "persistExtraction: result or result.facts is invalid, skipping",
         { resultType: typeof result, factsType: typeof result?.facts },
       );
-      return persistedIds;
+      return { persistedIds, memoryPathById };
     }
 
     // Chunking config from plugin settings
@@ -1521,6 +1526,18 @@ export class ExtractionPersistCoordinator {
       ) {
         continue;
       }
+      // Trim first (round 5): legacy writeMemory accepted " fact ".
+      (fact as any).category = (fact as any).category.trim();
+      // #2014/#2017 review round: an unrecognized non-empty category from
+      // the extractor is a per-CANDIDATE defect. The composer keeps category
+      // fatal even in salvage mode (identity field), so filter here — one
+      // malformed model field must not abort the whole extraction batch.
+      if (!isMemoryCategory((fact as any).category)) {
+        log.warn(
+          `persistExtraction: skipping fact with unrecognized category ${JSON.stringify((fact as any).category)}`,
+        );
+        continue;
+      }
       (fact as any).tags = Array.isArray((fact as any).tags)
         ? (fact as any).tags.filter((t: any) => typeof t === "string")
         : [];
@@ -1668,26 +1685,47 @@ export class ExtractionPersistCoordinator {
         fact.tags,
       );
       let exactDuplicate = false;
+      let needsCorpusConfirm = false;
       try {
-        exactDuplicate = await this.deps.hasContentHashDedup(
-          targetStorage,
-          contentHashDedupKey,
-        );
+        exactDuplicate = await this.deps.hasContentHashDedup(targetStorage, contentHashDedupKey);
+        if (factDedupEnabled && !exactDuplicate) {
+          // Fact dedup disabled → skip the authority check AND (via the guarded
+          // corpus block below) corpus confirmation, so a disabled deployment
+          // never suppresses a write via dedup (PR #2016 thread SD-nH). Enabled:
+          // a MISS is trustworthy only against an AUTHORITATIVE index — re-check.
+          if (await targetStorage.isFactContentHashAuthoritative()) {
+            exactDuplicate = await this.deps.hasContentHashDedup(targetStorage, contentHashDedupKey);
+          } else {
+            needsCorpusConfirm = true;
+          }
+        }
       } catch (err) {
+        // Dedup lookup failed (e.g. the authoritative rebuild could not run). Do
+        // NOT fail-open into a possible duplicate — confirm against the corpus.
+        needsCorpusConfirm = true;
         log.warn(
-          `content-hash dedup lookup failed for storage ${targetStorage.dir}; writing fact fail-open: ${err}`,
+          `content-hash dedup lookup unavailable for storage ${targetStorage.dir}; confirming against corpus: ${err}`,
         );
       }
-      // Connector-aware dedup (QOjlB): if the hash says duplicate, verify
-      // a same-content, same-connector active fact exists. Different
-      // connectors with same content should NOT be deduped. Fail open
-      // (write) on scan failure so an unverifiable hash hit cannot
-      // silently drop content.
-      if (exactDuplicate) {
+      // Connector-aware dedup (QOjlB): if the hash says duplicate — or the index
+      // could not authoritatively confirm a miss — verify a same-content,
+      // same-connector active fact exists across the hot+cold tiers. Different
+      // connectors with the same content are NOT duplicates. Fail open (write) on
+      // scan failure so an unverifiable state cannot silently drop content.
+      if (factDedupEnabled && (exactDuplicate || needsCorpusConfirm)) {
         try {
-          const allMems = await targetStorage.readAllMemories();
+          // #2016 cold-tier finding: the authoritative content-hash rebuild
+          // unions the HOT and COLD tiers, so a hash hit can name an active copy
+          // that was demoted to cold/. A hot-only confirmation scan misses it,
+          // flips exactDuplicate back to false, and writes a second active hot
+          // copy of the same content. Scan both tiers so a cold-only active copy
+          // still confirms the duplicate and suppresses the redundant hot write.
+          const [hotMems, coldMems] = await Promise.all([
+            targetStorage.readAllMemories(),
+            targetStorage.readAllColdMemories(),
+          ]);
           const nc = sourceContext?.sourceConnector?.trim() || undefined;
-          exactDuplicate = allMems.some((m) => {
+          const matchesActiveDuplicate = (m: MemoryFile): boolean => {
             if (m.frontmatter.category !== writeCategory) return false;
             if ((m.frontmatter.status ?? "active") !== "active") return false;
             // Thread 5 (QPDE5): for procedures the hash is keyed on the full
@@ -1700,7 +1738,9 @@ export class ExtractionPersistCoordinator {
             if (normalizeStoredHashSource(stripAttributesSuffix(m.content ?? "")) !==
               ContentHashIndex.normalizeContent(contentHashDedupKey)) return false;
             return (m.frontmatter.sourceConnector?.trim() || undefined) === nc;
-          });
+          };
+          exactDuplicate =
+            hotMems.some(matchesActiveDuplicate) || coldMems.some(matchesActiveDuplicate);
         } catch (err) {
           log.warn(
             `connector-aware dedup scan failed for storage ${targetStorage.dir}; writing fail-open: ${err instanceof Error ? err.message : String(err)}`,
@@ -2158,34 +2198,39 @@ export class ExtractionPersistCoordinator {
               ? stripCitationForTemplate(fact.content, citationTemplate)
               : fact.content;
           const citedChunkedContent = applyInlineCitation(rawChunkedContent);
-          const parentWrite = await targetStorage.writeMemory(
-            writeCategory,
-            citedChunkedContent,
+          const parentWriteEnvelope = composeSalvagedExtractionEnvelope(
             {
+              content: citedChunkedContent,
+              category: writeCategory,
               confidence: fact.confidence,
-              tags: [...fact.tags, "chunked"],
+              tags: withReservedMarkerTag(fact.tags, "chunked"),
               entityRef: fact.entityRef,
-              source: extractionWriteSource,
-              ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
-              importance,
-              supersedes,
-              links: links.length > 0 ? links : undefined,
-              intentGoal: inferredIntent?.goal,
-              intentActionType: inferredIntent?.actionType,
-              intentEntityTypes: inferredIntent?.entityTypes,
-              memoryKind,
               structuredAttributes: fact.structuredAttributes,
               validAt: biTemporal ? biTemporal.validFrom : sourceContext?.validAt,
-              ...(biTemporal ? { observedAt: biTemporal.observedAt, eventTimeSource: biTemporal.eventTimeSource, ...(biTemporal.validUntil ? { invalidAt: biTemporal.validUntil } : {}) } : {}),
-              contentHashSource: rawChunkedContent,
-              // Faithfulness gate (issue #1576).
-              ...(faithfulnessFm ? { faithfulness: faithfulnessFm } : {}),
-              ...(faithfulnessEnforceStatus ? { status: faithfulnessEnforceStatus } : {}),
-              // Claim-level provenance spans (issue #1575 PR 2).
-              ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
-              ...(fact.provenance ? { provenance: fact.provenance } : {}),
+              ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
             },
-          );
+            { source: extractionWriteSource },
+);
+          const parentWrite = await targetStorage.writeSealedMemory(parentWriteEnvelope, {
+            importance,
+            supersedes,
+            links: links.length > 0 ? links : undefined,
+            intentGoal: inferredIntent?.goal,
+            intentActionType: inferredIntent?.actionType,
+            intentEntityTypes: inferredIntent?.entityTypes,
+            memoryKind,
+            ...(biTemporal ? { observedAt: biTemporal.observedAt, eventTimeSource: biTemporal.eventTimeSource, ...(biTemporal.validUntil ? { invalidAt: biTemporal.validUntil } : {}) } : {}),
+            contentHashSource: rawChunkedContent,
+            // Faithfulness gate (issue #1576).
+            ...(faithfulnessFm ? { faithfulness: faithfulnessFm } : {}),
+            ...(faithfulnessEnforceStatus ? { status: faithfulnessEnforceStatus } : {}),
+            // Claim-level provenance spans (issue #1575 PR 2).
+            ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
+            ...(fact.provenance ? { provenance: fact.provenance } : {}),
+            // PR #2016: never defer here — fallible chunk/artifact writes follow this
+            // durable parent .md; flush the hash now so a throw can't strand it (dup).
+            deferHashIndexSave: false,
+          });
           const parentId = parentWrite.id;
           // #1645: surface the tombstone block and gate active post-write paths
           // (chunks, supersession, shared promotion, graph/artifact) like #1576.
@@ -2201,13 +2246,18 @@ export class ExtractionPersistCoordinator {
             postWriteGuard,
           );
           try {
+            // #2014 round 3: chunks inherit the PARENT ENVELOPE's surviving
+            // tags (minus the parent-only "chunked" marker) and entityRef —
+            // passing raw fact.tags let chunk frontmatter disagree with the
+            // sealed parent and retain tags past the per-memory limits.
+            const chunkTags = parentWriteEnvelope.tags.filter((tag) => tag !== "chunked");
             // Write individual chunks with parent reference
             for (const chunk of chunkResult.chunks) {
               // Score each chunk's importance separately
               const chunkImportance = scoreImportance(
                 chunk.content,
                 writeCategory,
-                fact.tags,
+                chunkTags,
               );
               const chunkWriteSource =
                 (fact as any).source === "proactive"
@@ -2223,9 +2273,11 @@ export class ExtractionPersistCoordinator {
                 // survives when a single chunk is quoted in isolation.
                 applyInlineCitation(chunk.content),
                 {
-                  confidence: fact.confidence,
-                  tags: fact.tags,
-                  entityRef: fact.entityRef,
+                  // #2014 round 4: sealed parent's confidence — raw
+                  // fact.confidence would let parent and chunk disagree.
+                  confidence: parentWriteEnvelope.confidence,
+                  tags: [...chunkTags],
+                  entityRef: parentWriteEnvelope.entityRef,
                   source: chunkWriteSource,
                   importance: chunkImportance,
                   intentGoal: inferredIntent?.goal,
@@ -2282,6 +2334,7 @@ export class ExtractionPersistCoordinator {
           );
           trackPersistedId(targetStorage, parentId, {
             pendingReview: postWriteGuard,
+            category: writeCategory,
           });
           // #1576 (cursor Medium): keep pending_review ids out of threadEpisodeIdsForGraph — else later active facts build thread-predecessor edges to an unfaithful memory.
           if (
@@ -2304,15 +2357,15 @@ export class ExtractionPersistCoordinator {
           // must NOT retire older active memories.
           if (!postWriteGuard) {
             try {
-              const supersessionEntityRef =
-                typeof (fact as any).entityRef === "string"
-                  ? ((fact as any).entityRef as string)
-                  : undefined;
+              // #2014 round 2: same envelope-surviving key rule as the
+              // non-chunked path.
               await applyTemporalSupersession({
                 storage: targetStorage,
                 newMemoryId: parentId,
-                entityRef: supersessionEntityRef,
-                structuredAttributes: fact.structuredAttributes,
+                entityRef: parentWriteEnvelope.entityRef,
+                structuredAttributes: parentWriteEnvelope.rawStructuredAttributes
+                  ? { ...parentWriteEnvelope.rawStructuredAttributes }
+                  : undefined,
                 createdAt: supersessionOrderingAt(biTemporal?.validFrom ?? sourceContext?.validAt),
                 // #1578 r3: an extracted end-only bound (validFrom absent) is
                 // historical, not a new authoritative state — never let it
@@ -2412,10 +2465,9 @@ export class ExtractionPersistCoordinator {
             if (graphCaps.multiGraphMemory && !postWriteGuard) {
               try {
                 const graphContext = await ensureGraphContext(targetStorage);
-                const entityRef =
-                  typeof (fact as any).entityRef === "string"
-                    ? (fact as any).entityRef
-                    : undefined;
+                // #2014 round 4: graph identity must match the PERSISTED
+                // memory — the envelope's surviving entityRef.
+                const entityRef = parentWriteEnvelope.entityRef;
                 const parentRelPath = resolvePersistedMemoryRelativePath({
                   memoryId: parentId,
                   pathById: graphContext.memoryPathById,
@@ -2511,39 +2563,44 @@ export class ExtractionPersistCoordinator {
           ? buildProcedurePersistBody(fact.content, fact.procedureSteps)
           : fact.content;
       const citedFactContent = applyInlineCitation(rawPersistBody);
-      const factWrite = await targetStorage.writeMemory(
-        writeCategory,
-        citedFactContent,
+      const factWriteEnvelope = composeSalvagedExtractionEnvelope(
         {
+          content: citedFactContent,
+          category: writeCategory,
           confidence: fact.confidence,
           tags: fact.tags,
           entityRef:
             typeof (fact as any).entityRef === "string"
               ? (fact as any).entityRef
               : undefined,
-          source: extractionWriteSource,
-          ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
-          importance,
-          supersedes,
-          links: links.length > 0 ? links : undefined,
-          intentGoal: inferredIntent?.goal,
-          intentActionType: inferredIntent?.actionType,
-          intentEntityTypes: inferredIntent?.entityTypes,
-          memoryKind,
           structuredAttributes: fact.structuredAttributes,
           validAt: biTemporal ? biTemporal.validFrom : sourceContext?.validAt,
-          ...(biTemporal ? { observedAt: biTemporal.observedAt, eventTimeSource: biTemporal.eventTimeSource, ...(biTemporal.validUntil ? { invalidAt: biTemporal.validUntil } : {}) } : {}),
-          contentHashSource: writeCategory === "fact" ? fact.content : undefined,
-          // Faithfulness gate (issue #1576).
-          ...(faithfulnessFm ? { faithfulness: faithfulnessFm } : {}),
-          ...(faithfulnessEnforceStatus ? { status: faithfulnessEnforceStatus } : {}),
-          // Claim-level provenance spans (issue #1575 PR 2). Carry verified
-          // sources + the coarse strength tag from the extraction validator
-          // through to frontmatter so they survive end-to-end.
-          ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
-          ...(fact.provenance ? { provenance: fact.provenance } : {}),
+          ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
         },
-      );
+        { source: extractionWriteSource },
+);
+      const factWrite = await targetStorage.writeSealedMemory(factWriteEnvelope, {
+        importance,
+        supersedes,
+        links: links.length > 0 ? links : undefined,
+        intentGoal: inferredIntent?.goal,
+        intentActionType: inferredIntent?.actionType,
+        intentEntityTypes: inferredIntent?.entityTypes,
+        memoryKind,
+        ...(biTemporal ? { observedAt: biTemporal.observedAt, eventTimeSource: biTemporal.eventTimeSource, ...(biTemporal.validUntil ? { invalidAt: biTemporal.validUntil } : {}) } : {}),
+        contentHashSource: writeCategory === "fact" ? fact.content : undefined,
+        // Faithfulness gate (issue #1576).
+        ...(faithfulnessFm ? { faithfulness: faithfulnessFm } : {}),
+        ...(faithfulnessEnforceStatus ? { status: faithfulnessEnforceStatus } : {}),
+        // Claim-level provenance spans (issue #1575 PR 2). Carry verified
+        // sources + the coarse strength tag from the extraction validator
+        // through to frontmatter so they survive end-to-end.
+        ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
+        ...(fact.provenance ? { provenance: fact.provenance } : {}),
+        // #1909: defer the per-fact index flush to the batch save only when
+        // fact dedup is on (the batch saver is a no-op otherwise).
+        deferHashIndexSave: factDedupEnabled,
+      });
       const memoryId = factWrite.id;
       // #1645: surface the tombstone block; gate active post-write paths like #1576
       // so a blocked fact creates no active shared copy / supersession / graph entry.
@@ -2552,12 +2609,12 @@ export class ExtractionPersistCoordinator {
         faithfulnessEnforceStatus === "pending_review" || tombstoneBlocked;
       // #1645: defer contradiction auto-resolve until tombstone status is
       // known (see applyDeferredContradictionResolve).
-      await this.deps.applyDeferredContradictionResolve(
-        contradiction,
-        targetStorage,
-        memoryId,
-        postWriteGuard,
-      );
+      try {
+        await this.deps.applyDeferredContradictionResolve(contradiction, targetStorage, memoryId, postWriteGuard);
+      } catch (err) {
+        await flushDeferredFactHashOnFailure(() => this.deps.saveContentHashIndexes(), factDedupEnabled);
+        throw err;
+      }
       if (routedRuleId) {
         log.debug(
           `routing applied for memory ${memoryId}: rule=${routedRuleId} category=${writeCategory} storage=${targetStorage.dir}`,
@@ -2570,15 +2627,16 @@ export class ExtractionPersistCoordinator {
       // the review queue must NOT retire older active memories.
       if (!postWriteGuard) {
         try {
-          const supersessionEntityRef =
-            typeof (fact as any).entityRef === "string"
-              ? ((fact as any).entityRef as string)
-              : undefined;
+          // #2014 round 2: key supersession on the envelope's SURVIVING
+          // fields — salvage may have dropped attributes that must not
+          // retire older facts the persisted copy does not actually contest.
           await applyTemporalSupersession({
             storage: targetStorage,
             newMemoryId: memoryId,
-            entityRef: supersessionEntityRef,
-            structuredAttributes: fact.structuredAttributes,
+            entityRef: factWriteEnvelope.entityRef,
+            structuredAttributes: factWriteEnvelope.rawStructuredAttributes
+              ? { ...factWriteEnvelope.rawStructuredAttributes }
+              : undefined,
             createdAt: supersessionOrderingAt(biTemporal?.validFrom ?? sourceContext?.validAt),
             enabled: lifecycleCaps.temporalSupersession &&
               !(biTemporal && !biTemporal.validFrom),
@@ -2601,6 +2659,7 @@ export class ExtractionPersistCoordinator {
         );
         trackPersistedId(targetStorage, memoryId, {
           pendingReview: postWriteGuard,
+          category: writeCategory,
         });
         if (
           !postWriteGuard &&
@@ -2652,10 +2711,8 @@ export class ExtractionPersistCoordinator {
         if (graphCaps.multiGraphMemory && !postWriteGuard) {
           try {
             const graphContext = await ensureGraphContext(targetStorage);
-            const entityRef =
-              typeof (fact as any).entityRef === "string"
-                ? (fact as any).entityRef
-                : undefined;
+            // #2014 round 4: envelope-surviving entityRef (see chunked path).
+            const entityRef = factWriteEnvelope.entityRef;
             const memoryRelPath = resolvePersistedMemoryRelativePath({
               memoryId,
               pathById: graphContext.memoryPathById,
@@ -2731,6 +2788,11 @@ export class ExtractionPersistCoordinator {
             `content-hash dedup registration failed for memory ${memoryId}: ${err}`,
           );
         }
+      } catch (err) {
+        // PR #2016: flush the deferred fact-hash before propagating so a durable
+        // .md never outlives a missing shared fact-hash index entry.
+        await flushDeferredFactHashOnFailure(() => this.deps.saveContentHashIndexes(), factDedupEnabled);
+        throw err;
       } finally {
         // Catalog touch (issue #1499): record AFTER every synchronous
         // source-namespace mutation in the non-chunked path: writeMemory,
@@ -2883,10 +2945,15 @@ export class ExtractionPersistCoordinator {
       touchBaseNonFactNamespace();
     }
 
-    // Save any content-hash indexes touched during the batch.
-    await this.deps.saveContentHashIndexes().catch((err) =>
-      log.warn(`content-hash index save failed: ${err}`),
-    );
+    // Save any content-hash indexes touched during the batch via the removal-
+    // aware, lock-held reconciling save (issue #1909). Round 11: the fact-hash
+    // index is rebuilt from the corpus on every restart (no ready marker), so
+    // this on-disk write is the in-process persisted view — never a cross-restart
+    // trust anchor. A deferred write whose addContentHashDedup threw is still
+    // safe: the fact .md is durable and the next restart's rebuild includes it.
+    await this.deps.saveContentHashIndexes().catch((err) => {
+      log.warn(`content-hash index save failed: ${err}`);
+    });
 
     for (const {
       storage: targetStorage,
@@ -2911,7 +2978,6 @@ export class ExtractionPersistCoordinator {
     log.info(
       `persisted: ${facts.length - dedupedCount - importanceGatedCount - judgeGatedCount - redactionGatedCount} facts${dedupSuffix}${gatedSuffix}${judgeSuffix}${redactionSuffix}, ${entities.length} entities, ${questions.length} questions, ${profileUpdates.length} profile updates`,
     );
-
     // Update temporal + tag indexes (v8.1) — fire-and-forget, fail-open
     void (async () => {
       if (persistedIdsByStorage.size === 0) {
@@ -2924,10 +2990,9 @@ export class ExtractionPersistCoordinator {
     })().catch((err) =>
       log.debug(`temporal-index update error (non-fatal): ${err}`),
     );
-
     // #1635: surface pending_review ids so the thread episode set excludes them.
     this.deps.setLastPersistExtractionPendingReviewIds(pendingReviewPersistedIds);
     // Return the persisted fact IDs for threading
-    return persistedIds;
+    return { persistedIds, memoryPathById };
   }
 }