@remnic/core 9.7.15 → 9.9.0

package/src/storage/secure-line-reader.test.ts

@@ -0,0 +1,197 @@
+import assert from "node:assert/strict";
+import { mkdtemp, open, rm, symlink, truncate, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  readMaybeEncryptedLines,
+  readMemoryLifecycleEventsFromLines,
+  STATE_FILE_MAX_DECRYPT_BYTES,
+} from "./secure-line-reader.js";
+import { MAGIC_BYTES, MAGIC_HEADER_SIZE } from "../secure-store/secure-fs.js";
+import type { MemoryLifecycleEvent } from "../types.js";
+
+function event(eventId: string, memoryId: string, timestamp: string): MemoryLifecycleEvent {
+  return { eventId, memoryId, eventType: "created", timestamp, actor: "test", ruleVersion: "1" };
+}
+
+async function* fromArray(rows: string[]): AsyncGenerator<string> {
+  for (const row of rows) yield row;
+}
+
+test("readMemoryLifecycleEventsFromLines keeps only the last `limit` appended rows", async () => {
+  const rows = [
+    JSON.stringify(event("a", "m1", "2026-01-01T00:00:00.000Z")),
+    JSON.stringify(event("b", "m2", "2026-01-02T00:00:00.000Z")),
+    JSON.stringify(event("c", "m3", "2026-01-03T00:00:00.000Z")),
+  ];
+  const tail = await readMemoryLifecycleEventsFromLines(fromArray(rows), 2);
+  assert.deepEqual(
+    tail.map((e) => e.eventId),
+    ["b", "c"],
+  );
+});
+
+test("readMemoryLifecycleEventsFromLines skips malformed/blank rows fail-open and honors limit 0", async () => {
+  const rows = [
+    "   ",
+    "{not json",
+    JSON.stringify({ eventId: "x", memoryId: "m", eventType: "created", timestamp: "t", actor: 42, ruleVersion: "1" }),
+    JSON.stringify(event("keep", "m", "2026-01-01T00:00:00.000Z")),
+  ];
+  assert.deepEqual(await readMemoryLifecycleEventsFromLines(fromArray(rows), 5), [
+    event("keep", "m", "2026-01-01T00:00:00.000Z"),
+  ]);
+  assert.deepEqual(await readMemoryLifecycleEventsFromLines(fromArray(rows), 0), []);
+});
+
+test("readMemoryLifecycleEventsFromLines admits any structurally valid eventType (readAll parity, issue #1910)", async () => {
+  const unknown = { eventId: "bad", memoryId: "m", eventType: "exploded", timestamp: "2026-01-01T00:00:00.000Z", actor: "test", ruleVersion: "1" };
+  const empty = { eventId: "empty", memoryId: "m", eventType: "", timestamp: "2026-01-02T00:00:00.000Z", actor: "test", ruleVersion: "1" };
+  const rows = [
+    // Unknown/typoed and empty-string eventTypes are structurally valid, so the
+    // bounded governance read MUST keep them — it has to match readAll, which
+    // admits any string eventType. Only genuinely malformed rows are dropped.
+    JSON.stringify(unknown),
+    JSON.stringify(empty),
+    JSON.stringify(event("keep", "m", "2026-01-03T00:00:00.000Z")),
+  ];
+  const kept = await readMemoryLifecycleEventsFromLines(fromArray(rows), 5);
+  assert.deepEqual(
+    kept.map((e) => e.eventId).sort(),
+    ["bad", "empty", "keep"],
+  );
+});
+
+test("readMemoryLifecycleEventsFromLines filters by memoryId when provided", async () => {
+  const rows = [
+    JSON.stringify(event("a", "target", "2026-01-01T00:00:00.000Z")),
+    JSON.stringify(event("b", "other", "2026-01-02T00:00:00.000Z")),
+    JSON.stringify(event("c", "target", "2026-01-03T00:00:00.000Z")),
+  ];
+  const tail = await readMemoryLifecycleEventsFromLines(fromArray(rows), 10, "target");
+  assert.deepEqual(
+    tail.map((e) => e.eventId),
+    ["a", "c"],
+  );
+});
+
+test("readMaybeEncryptedLines streams plaintext lines without the encrypted fallback", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-slr-plain-"));
+  const filePath = path.join(dir, "state.jsonl");
+  await writeFile(filePath, "one\ntwo\nthree\n", "utf8");
+  try {
+    const out: string[] = [];
+    for await (const line of readMaybeEncryptedLines(filePath, async () => {
+      throw new Error("plaintext must not use the encrypted whole-file reader");
+    })) {
+      if (line.trim()) out.push(line);
+    }
+    assert.deepEqual(out, ["one", "two", "three"]);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("readMaybeEncryptedLines refuses an oversized encrypted file before decrypting", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-slr-oversize-"));
+  const filePath = path.join(dir, "state.jsonl");
+  // Write a valid encrypted magic header, then sparsely grow the file past the
+  // decrypt ceiling. `truncate` produces a sparse file, so this costs ~no disk.
+  const header = Buffer.alloc(MAGIC_HEADER_SIZE);
+  MAGIC_BYTES.copy(header, 0);
+  const handle = await open(filePath, "w");
+  await handle.write(header, 0, header.length, 0);
+  await handle.close();
+  await truncate(filePath, STATE_FILE_MAX_DECRYPT_BYTES + 1);
+  try {
+    let decryptCalled = false;
+    await assert.rejects(
+      async () => {
+        for await (const _line of readMaybeEncryptedLines(
+          filePath,
+          async () => {
+            decryptCalled = true;
+            return "";
+          },
+          STATE_FILE_MAX_DECRYPT_BYTES,
+        )) {
+          // no-op
+        }
+      },
+      (err: unknown) => {
+        const message = err instanceof Error ? err.message : String(err);
+        assert.match(message, /whole-file decrypt limit/);
+        assert.match(message, /rebuild-memory-lifecycle-ledger|doctor/);
+        // The remedy is namespace-aware (#2033): an oversized encrypted ledger
+        // under namespaces/<ns>/state must not be pointed at a root-only command.
+        assert.match(message, /--namespace/);
+        assert.ok(message.includes(filePath));
+        return true;
+      },
+    );
+    assert.equal(decryptCalled, false);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("readMaybeEncryptedLines does not refuse an oversized encrypted file without a decrypt ceiling (memory-actions parity, issue #1910)", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-slr-nolimit-"));
+  const filePath = path.join(dir, "state.jsonl");
+  const header = Buffer.alloc(MAGIC_HEADER_SIZE);
+  MAGIC_BYTES.copy(header, 0);
+  const handle = await open(filePath, "w");
+  await handle.write(header, 0, header.length, 0);
+  await handle.close();
+  await truncate(filePath, STATE_FILE_MAX_DECRYPT_BYTES + 1);
+  try {
+    // No maxDecryptBytes argument: the caller (e.g. the memory-actions ledger)
+    // has no compaction remedy, so the size guard must NOT fire — decryption is
+    // attempted exactly as before the lifecycle-only ceiling was added.
+    let decryptCalled = false;
+    const lines: string[] = [];
+    for await (const line of readMaybeEncryptedLines(filePath, async () => {
+      decryptCalled = true;
+      return "row-1\nrow-2";
+    })) {
+      lines.push(line);
+    }
+    assert.equal(decryptCalled, true, "decrypt runs when no ceiling is supplied");
+    assert.deepEqual(lines, ["row-1", "row-2"]);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("readMaybeEncryptedLines refuses a symlinked state file before opening it (#2033)", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-slr-symlink-"));
+  try {
+    const realTarget = path.join(dir, "real.jsonl");
+    await writeFile(realTarget, "one\ntwo\n", "utf8");
+    const linkPath = path.join(dir, "link.jsonl");
+    await symlink(realTarget, linkPath);
+    let decryptCalled = false;
+    await assert.rejects(
+      async () => {
+        for await (const _line of readMaybeEncryptedLines(linkPath, async () => {
+          decryptCalled = true;
+          return "";
+        })) {
+          // no-op — the symlink must be refused before any line is yielded.
+        }
+      },
+      (err: unknown) => {
+        const message = err instanceof Error ? err.message : String(err);
+        assert.match(message, /non-regular state file/);
+        assert.match(message, /symlink\/FIFO\/device/);
+        assert.ok(message.includes(linkPath));
+        return true;
+      },
+    );
+    assert.equal(decryptCalled, false, "never opened or decrypted the symlink target");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});

package/src/storage/secure-line-reader.ts

@@ -1,23 +1,61 @@
 import { createReadStream } from "node:fs";
-import { open } from "node:fs/promises";
+import { lstat, open } from "node:fs/promises";
 import { createInterface } from "node:readline";
 
 import { isEncryptedFile, MAGIC_HEADER_SIZE } from "../secure-store/secure-fs.js";
-import type { MemoryActionEvent } from "../types.js";
+import type { MemoryActionEvent, MemoryLifecycleEvent } from "../types.js";
+
+/**
+ * Whole-file decrypt ceiling for encrypted state files. V8's max string length
+ * is ~512MB; a decrypted body that approaches it throws an opaque
+ * `Invalid string length` on every read (the 691MB lifecycle-ledger incident).
+ * We refuse at a size comfortably under the cap and point the operator at the
+ * compaction remedy instead of letting the runtime crash. Plaintext streaming
+ * is unaffected at any size.
+ */
+export const STATE_FILE_MAX_DECRYPT_BYTES = 400 * 1024 * 1024;
 
 /**
  * Stream plaintext files by line while preserving authenticated whole-file
- * reads for encrypted files.
+ * reads for encrypted files. `maxDecryptBytes` bounds the whole-file decrypt:
+ * when set, an encrypted file at/over it is refused before decryption with an
+ * actionable error. The ceiling is OPT-IN so it applies ONLY to callers with a
+ * compaction-backed remedy (the lifecycle ledger). Callers with no bounded
+ * maintenance path — e.g. the memory-actions ledger — omit it and keep the
+ * prior unbounded read (issue #1910).
  */
 export async function* readMaybeEncryptedLines(
   filePath: string,
   readEncryptedFile: () => Promise<string>,
+  maxDecryptBytes?: number,
 ): AsyncGenerator<string> {
+  // Reject a symlink/FIFO/device BEFORE opening, matching the maintenance ledger
+  // probe (probeEncryptedRegularFileHeader, #2033): opening a FIFO blocks until a
+  // writer appears and a symlink would redirect the read outside our tree. An
+  // ENOENT from the missing regular file propagates so callers keep their
+  // absent-file → [] behavior (they catch ENOENT), exactly as a missing open did.
+  const entryStat = await lstat(filePath);
+  if (!entryStat.isFile()) {
+    throw new Error(
+      `refusing to read non-regular state file ${filePath} `
+      + `(symlink/FIFO/device); opening it could block or escape containment (#2033)`,
+    );
+  }
   const file = await open(filePath, "r");
   const header = Buffer.alloc(MAGIC_HEADER_SIZE);
   try {
     const { bytesRead } = await file.read(header, 0, header.length, 0);
     if (isEncryptedFile(header.subarray(0, bytesRead))) {
+      if (maxDecryptBytes !== undefined) {
+        const { size } = await file.stat();
+        if (size >= maxDecryptBytes) {
+          throw new Error(
+            `encrypted state file ${filePath} is ${size} bytes, at or over the ${maxDecryptBytes}-byte `
+            + `whole-file decrypt limit. Run 'remnic rebuild-memory-lifecycle-ledger --write' (add `
+            + `'--namespace <ns>' when the path is under namespaces/<ns>/state) or 'remnic doctor' to compact it.`,
+          );
+        }
+      }
       yield* (await readEncryptedFile()).split("\n");
       return;
     }
@@ -77,3 +115,143 @@ export async function readMemoryActionEventRowsFromLines(
   }
   return writeIndex === 0 ? out : [...out.slice(writeIndex), ...out.slice(0, writeIndex)];
 }
+
+/**
+ * Validate that a parsed row carries every required lifecycle-event field.
+ * Shared by the tail reader and the per-memory reader so both apply the EXACT
+ * same fail-open guard as `readAllLifecycleEventsFromLedger` (`eventType` is any
+ * string). Governance reads via `readMemoryLifecycleEvents(MAX_SAFE_INTEGER)`
+ * must be byte-for-byte identical to `readAllMemoryLifecycleEvents`, so this
+ * MUST NOT restrict `eventType` to a handled allow-list — an unknown type is
+ * still admitted here and sorted deterministically by `lifecycleEventSortRank`
+ * (issue #1910).
+ */
+function isValidLifecycleEventRow(
+  parsed: Partial<MemoryLifecycleEvent>,
+): parsed is MemoryLifecycleEvent {
+  return (
+    typeof parsed.eventId === "string" &&
+    typeof parsed.memoryId === "string" &&
+    typeof parsed.eventType === "string" &&
+    typeof parsed.timestamp === "string" &&
+    typeof parsed.actor === "string" &&
+    typeof parsed.ruleVersion === "string"
+  );
+}
+
+/**
+ * Bounded min-heap that retains the `limit` rows that rank highest under
+ * `compare`, breaking ties by append order (later rows win). Heap use is
+ * O(limit); each row costs O(log limit). Used for the per-memory timeline
+ * fallback, which must keep the last `limit` events in canonical
+ * timestamp/event order — not merely the last `limit` appended rows.
+ */
+class BoundedLifecycleTopN {
+  private readonly heap: Array<{ event: MemoryLifecycleEvent; seq: number }> = [];
+
+  constructor(
+    private readonly limit: number,
+    private readonly compare: (a: MemoryLifecycleEvent, b: MemoryLifecycleEvent) => number,
+  ) {}
+
+  private less(
+    a: { event: MemoryLifecycleEvent; seq: number },
+    b: { event: MemoryLifecycleEvent; seq: number },
+  ): boolean {
+    const c = this.compare(a.event, b.event);
+    return c !== 0 ? c < 0 : a.seq < b.seq;
+  }
+
+  add(event: MemoryLifecycleEvent, seq: number): void {
+    const item = { event, seq };
+    if (this.heap.length < this.limit) {
+      this.heap.push(item);
+      this.siftUp(this.heap.length - 1);
+    } else if (this.heap.length > 0 && this.less(this.heap[0], item)) {
+      this.heap[0] = item;
+      this.siftDown(0);
+    }
+  }
+
+  /** Kept rows in ascending canonical order (append order breaks ties). */
+  drainSorted(): MemoryLifecycleEvent[] {
+    return this.heap
+      .slice()
+      .sort((a, b) => (this.less(a, b) ? -1 : this.less(b, a) ? 1 : 0))
+      .map((item) => item.event);
+  }
+
+  private siftUp(index: number): void {
+    let i = index;
+    while (i > 0) {
+      const parent = (i - 1) >> 1;
+      if (!this.less(this.heap[i], this.heap[parent])) break;
+      [this.heap[i], this.heap[parent]] = [this.heap[parent], this.heap[i]];
+      i = parent;
+    }
+  }
+
+  private siftDown(index: number): void {
+    let i = index;
+    const n = this.heap.length;
+    for (;;) {
+      const left = 2 * i + 1;
+      const right = 2 * i + 2;
+      let smallest = i;
+      if (left < n && this.less(this.heap[left], this.heap[smallest])) smallest = left;
+      if (right < n && this.less(this.heap[right], this.heap[smallest])) smallest = right;
+      if (smallest === i) break;
+      [this.heap[i], this.heap[smallest]] = [this.heap[smallest], this.heap[i]];
+      i = smallest;
+    }
+  }
+}
+
+/**
+ * Bounded tail read for lifecycle-event rows, mirroring
+ * `readMemoryActionEventRowsFromLines`: heap use is O(limit) rather than
+ * O(rows), no matter how large the ledger is. When `memoryId` is supplied,
+ * only rows for that memory are considered, so the per-memory timeline
+ * fallback never materializes the whole ledger either.
+ *
+ * Without `compare`, the retained rows are the last `limit` *appended* rows
+ * (returned oldest→newest of that tail); callers apply
+ * `sortMemoryLifecycleEvents` for canonical ordering. With `compare`, the
+ * retained rows are the `limit` rows that rank highest under `compare` (ties
+ * broken by append order), returned in ascending `compare` order — preserving
+ * the prior "filter → canonical sort → last N" semantics without loading the
+ * whole file.
+ */
+export async function readMemoryLifecycleEventsFromLines(
+  lines: AsyncIterable<string>,
+  limit: number,
+  memoryId?: string,
+  compare?: (a: MemoryLifecycleEvent, b: MemoryLifecycleEvent) => number,
+): Promise<MemoryLifecycleEvent[]> {
+  if (limit <= 0) return [];
+  const top = compare ? new BoundedLifecycleTopN(limit, compare) : null;
+  const ring: MemoryLifecycleEvent[] = [];
+  let writeIndex = 0;
+  let seq = 0;
+  for await (const row of lines) {
+    const line = row.trim();
+    if (!line) continue;
+    try {
+      const parsed = JSON.parse(line) as Partial<MemoryLifecycleEvent>;
+      if (memoryId !== undefined && parsed.memoryId !== memoryId) continue;
+      if (!isValidLifecycleEventRow(parsed)) continue;
+      if (top) {
+        top.add(parsed, seq++);
+      } else if (ring.length < limit) {
+        ring.push(parsed);
+      } else {
+        ring[writeIndex] = parsed;
+        writeIndex = (writeIndex + 1) % limit;
+      }
+    } catch {
+      // Ignore malformed rows (fail-open).
+    }
+  }
+  if (top) return top.drainSorted();
+  return writeIndex === 0 ? ring : [...ring.slice(writeIndex), ...ring.slice(0, writeIndex)];
+}

package/src/storage-append-header-sniff.test.ts

@@ -0,0 +1,195 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { StorageManager } from "./storage.js";
+import type { MemoryLifecycleEvent } from "./types.js";
+
+// Issue #1909 (Part A): the plaintext secure-append path must classify a file
+// as encrypted by reading ONLY the fixed-size magic header, never the whole
+// file (a lifecycle ledger can grow to hundreds of MB on a large corpus), and
+// it must cache the classification so subsequent appends do NO reclassification
+// read at all.
+
+function lifecycleEvent(eventId: string): MemoryLifecycleEvent {
+  return {
+    eventId,
+    memoryId: `m-${eventId}`,
+    eventType: "created",
+    timestamp: "2026-01-01T00:00:00.000Z",
+    actor: "test",
+    ruleVersion: "1",
+  };
+}
+
+/**
+ * Spy the private whole-file read used by the encrypted-append branch so a test
+ * can assert the plaintext append path NEVER reads the whole file to classify —
+ * the #1909 Part A invariant. The classification uses a header-only sniff
+ * (open + read MAGIC_HEADER_SIZE bytes), now (size, mtime)-identity-validated so
+ * a peer rewrite is detected (round 10); it never falls back to a whole-file read.
+ */
+function instrumentWholeFileReads(storage: StorageManager): { count: () => number } {
+  const priv = storage as unknown as {
+    readStorageSecureFile: (filePath: string) => Promise<string>;
+  };
+  const real = priv.readStorageSecureFile.bind(storage);
+  let reads = 0;
+  priv.readStorageSecureFile = async (filePath: string) => {
+    reads += 1;
+    return real(filePath);
+  };
+  return { count: () => reads };
+}
+
+async function withMemoryDir(run: (dir: string) => Promise<void>): Promise<void> {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-header-sniff-"));
+  try {
+    await run(dir);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+test("plaintext appends classify via a header sniff only — never a whole-file read", async () => {
+  await withMemoryDir(async (dir) => {
+    const ledgerPath = path.join(dir, "state", "memory-lifecycle-ledger.jsonl");
+    await mkdir(path.dirname(ledgerPath), { recursive: true });
+    // A large plaintext ledger — a whole-file sniff would scale with this.
+    await writeFile(ledgerPath, `${"x".repeat(2_000_000)}\n`, "utf8");
+
+    const storage = new StorageManager(dir);
+    const wholeReads = instrumentWholeFileReads(storage);
+
+    await storage.appendMemoryLifecycleEvents([lifecycleEvent("a")]);
+    await storage.appendMemoryLifecycleEvents([lifecycleEvent("b")]);
+    await storage.appendMemoryLifecycleEvents([lifecycleEvent("c")]);
+    assert.equal(
+      wholeReads.count(),
+      0,
+      "plaintext appends never read the whole file to classify (header sniff only)",
+    );
+
+    // The appends actually landed on top of the pre-existing large body.
+    const body = await readFile(ledgerPath, "utf8");
+    const rows = body.split("\n").filter((line) => line.startsWith("{"));
+    assert.equal(rows.length, 3, "all three appended events are present");
+    assert.ok(body.startsWith("x".repeat(100)), "the original plaintext body is preserved");
+
+    // White-box: the identity-validated cache entry records plaintext.
+    const cacheOwner = storage as unknown as {
+      secureFileEncryptionSniffCache: Map<
+        string,
+        { identity: { size: number; mtimeMs: number }; encrypted: boolean }
+      >;
+    };
+    assert.equal(
+      cacheOwner.secureFileEncryptionSniffCache.get(ledgerPath)?.encrypted,
+      false,
+      "the ledger is classified as plaintext",
+    );
+  });
+});
+test("isEncryptedFileHeader classifies large files correctly from the header alone", async () => {
+  await withMemoryDir(async (dir) => {
+    const storage = new StorageManager(dir);
+    const priv = storage as unknown as {
+      isEncryptedFileHeader: (filePath: string) => Promise<boolean>;
+    };
+
+    // Large plaintext file → not encrypted, regardless of its size.
+    const plainPath = path.join(dir, "big-plain.jsonl");
+    await writeFile(plainPath, `${"y".repeat(1_500_000)}\n`, "utf8");
+    assert.equal(await priv.isEncryptedFileHeader.call(storage, plainPath), false);
+
+    // Encrypted file produced by the secure write path → encrypted, detected by
+    // the 12-byte magic header without decrypting the whole body.
+    const encDir = await mkdtemp(path.join(os.tmpdir(), "remnic-header-enc-"));
+    try {
+      const encStorage = new StorageManager(encDir);
+      encStorage.setSecureStoreKey(Buffer.alloc(32, 7));
+      await encStorage.appendMemoryLifecycleEvents([lifecycleEvent("e")]);
+      const encLedger = path.join(encDir, "state", "memory-lifecycle-ledger.jsonl");
+      const encPriv = encStorage as unknown as {
+        isEncryptedFileHeader: (filePath: string) => Promise<boolean>;
+      };
+      assert.equal(await encPriv.isEncryptedFileHeader.call(encStorage, encLedger), true);
+    } finally {
+      await rm(encDir, { recursive: true, force: true });
+    }
+
+    // Missing file → not encrypted (falls through to appendFile).
+    assert.equal(
+      await priv.isEncryptedFileHeader.call(storage, path.join(dir, "does-not-exist.jsonl")),
+      false,
+    );
+    // Short file (< MAGIC_HEADER_SIZE) → not encrypted.
+    const shortPath = path.join(dir, "short.jsonl");
+    await writeFile(shortPath, "hi", "utf8");
+    assert.equal(await priv.isEncryptedFileHeader.call(storage, shortPath), false);
+  });
+});
+
+test("encrypted files still round-trip through the append path unchanged", async () => {
+  await withMemoryDir(async (dir) => {
+    const storage = new StorageManager(dir);
+    storage.setSecureStoreKey(Buffer.alloc(32, 9));
+
+    await storage.appendMemoryLifecycleEvents([lifecycleEvent("one")]);
+    await storage.appendMemoryLifecycleEvents([lifecycleEvent("two")]);
+
+    // The decrypt-append-rewrite branch keeps the ledger readable + intact.
+    const events = await storage.readAllMemoryLifecycleEvents();
+    const ids = events.map((e) => e.eventId).sort();
+    assert.deepEqual(ids, ["one", "two"]);
+
+    // On disk the file is genuinely encrypted (header magic present).
+    const ledgerPath = path.join(dir, "state", "memory-lifecycle-ledger.jsonl");
+    const raw = await readFile(ledgerPath);
+    assert.ok(raw.length > 0);
+    assert.notEqual(raw.toString("utf8").includes("\"eventId\":\"one\""), true, "body is not plaintext");
+  });
+});
+
+test("append to a missing path creates the file via the plaintext append path", async () => {
+  await withMemoryDir(async (dir) => {
+    const storage = new StorageManager(dir);
+    const wholeReads = instrumentWholeFileReads(storage);
+    // Fresh (ENOENT) ledger: the header sniff stats → ENOENT → not-encrypted, and
+    // the append creates the file — never a whole-file read.
+    const n = await storage.appendMemoryLifecycleEvents([lifecycleEvent("fresh")]);
+    assert.equal(n, 1);
+    assert.equal(wholeReads.count(), 0, "creating the ledger does no whole-file read");
+
+    const ledgerPath = path.join(dir, "state", "memory-lifecycle-ledger.jsonl");
+    const body = await readFile(ledgerPath, "utf8");
+    assert.ok(body.includes("\"eventId\":\"fresh\""));
+  });
+});
+
+test("#1909 round 10: a peer encrypting the file flips the sniff classification (no raw append into ciphertext)", async () => {
+  // A long-lived manager caches plaintext for an append target; a SECOND manager
+  // then encrypts that file (whole-file rewrite). The first manager's next append
+  // must detect the flip via (size, mtime) identity re-validation and NOT append
+  // raw bytes into the encrypted body (data corruption).
+  await withMemoryDir(async (dir) => {
+    const a = new StorageManager(dir); // no key → plaintext writer
+    await a.appendMemoryLifecycleEvents([lifecycleEvent("a1")]); // creates the ledger
+    await a.appendMemoryLifecycleEvents([lifecycleEvent("a2")]); // now A caches plaintext=false
+
+    // Peer B encrypts the whole file by appending under a key.
+    const b = new StorageManager(dir);
+    b.setSecureStoreKey(Buffer.alloc(32, 7));
+    await b.appendMemoryLifecycleEvents([lifecycleEvent("b1")]); // whole-file rewrite → encrypted
+
+    // A's next append must detect the flip and refuse (A has no key) rather than
+    // corrupt the ciphertext with a raw plaintext append.
+    await assert.rejects(() => a.appendMemoryLifecycleEvents([lifecycleEvent("a3")]));
+
+    // The encrypted ledger is intact and fully decryptable by B — a3 never landed.
+    const ids = (await b.readAllMemoryLifecycleEvents()).map((e) => e.eventId).sort();
+    assert.deepEqual(ids, ["a1", "a2", "b1"]);
+  });
+});