@staix/agent-hub 0.12.25 → 0.12.26

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.26
+
+- Import claude-mem observations under a checkout-independent identity, so the same observation is one entry on every machine after sync however the checkouts differ; scan the source database project-aware with a persisted machine-local cursor (`--restart` re-scans), so unrelated projects cannot starve the requested one; reconcile legacy duplicate imports with `ahub memory dedupe` through append-only supersede operations (#380).
+- Protect the targets of direct-child symlinks of a protected directory under every data-policy form (exact entry, `data/*`, `data/**`), with case-compatible on-disk root discovery and a streaming scan inside the shared 4096-entry bound: a dangling link covers its lexical target, an unresolvable link loop aliases nothing, a root whose discovery budget is exhausted contributes no aliases, and an unreadable protected root still fails closed (#385).
+- State the document converter's project-scoped read guarantee and the bounded, cleared-when-full failure record precisely in code comments and docs (#386).
+
 ## 0.12.25
 
 - Preserve person-owned reservations through planner grooming, including same-value changes (#378).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker, with optional Qwen Code and Jcode support, collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.25, control protocol 16. Durable delivery records distinguish queued
+Status: 0.12.26, control protocol 16. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -33,7 +33,7 @@ cd <your project> && ahub init && ahub up
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.25 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.26 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/data-policy.md

@@ -28,7 +28,8 @@
 
 - `*` matches any characters within one path segment, `?` matches one character, and a whole-segment `**` matches zero or more segments. Matching includes dot names and folds case consistently with the existing exact policy. A matched directory protects its subtree. Directory task scopes are private if they can contain a future matching descendant, even before a file exists.
 - Examples: `pii.paths = ["data/**/*.csv"]` and `data.readonly = ["data/raw-*/**"]`. Up to 16 wildcard characters per pattern. Absolute paths, parent traversal, bracket classes, braces, negation and mixed `**suffix` forms are refused. Backslashes remain literal in exact entries but are refused in glob entries; no escape syntax is interpreted.
-- Match both declared spelling and real target. Wildcard directory/file aliases are discovered from compatible prefixes, including symlink aliases to future targets. Discovery is refreshed per decision, with no stale cached expansion. It reads at most 4096 directory entries and traverses at most 32 levels. An unreadable/dangling/cyclic/out-of-project alias or an exhausted discovery bound conservatively protects rather than declaring a path public/writable. No discovered name or policy body is logged.
+- An exact directory entry (`data`), a single-segment glob (`data/*`) and a subtree glob (`data/**`) all protect targets of symlinks directly inside `data`, including file targets. Only this one level is aliased: `data/sub/link` does not protect its outside target under any of these forms, while paths through the protected tree remain protected lexically. Exact entries and trailing `**` matches scan immediate children once, without descending; `*` retains its existing matched-link resolution. Retargeted links are evaluated afresh on the next decision. A self-link such as `data/loop -> .` adds only the directory itself and does not trigger a recursive walk.
+- Match both declared spelling and real target. Wildcard directory/file aliases are discovered from compatible prefixes, including symlink aliases to future targets. Discovery is refreshed per decision, with no stale cached expansion. Wildcard discovery and immediate alias scans share one per-call budget of 4096 directory entries; wildcard traversal is limited to depth 32. Existing wildcard discovery runs before the new direct-child scans, so these scans cannot consume its budget first. Immediate scans stream directory entry types and resolve only symlink children, with no descent. For exact entries and trailing-`**` roots, a dangling direct child protects its lexical target (including a future target), an ELOOP child is skipped, and a root whose scan cannot complete within the remaining shared budget contributes no child aliases, even if an earlier child matched. Unreadable matched roots still fail closed, including when earlier roots used up the budget. Lexical protection of the tree stays in force; tree depth and cycles below that one level are never traversed. `data/*` retains its existing matched-link failure behavior, and descending glob discovery (`data/**/*.csv`, `**/ß`) retains its existing fail-closed handling of unreadable/dangling/cyclic/out-of-project aliases and exhausted bounds. No discovered name or policy body is logged.
 - Managed local/Pi write/edit and private Tasks/facts use this same matcher. Existing hardlink refusal, post-approval recheck and filesystem-read-only command profile remain unchanged.
 - Claude's managed `ask-when-needed` hook receives `ask` for a write matching data.readonly. Reads and ordinary project writes retain their existing scoped decisions. The daemon evaluates policy locally only for the current managed PreToolUse ask-when-needed write grant and sends no pattern list to the hook. PostToolUse, unavailable/ask/never-ask modes and non-write tools perform no grant-policy discovery. Explicit native approval and `never-ask` remain the person's native authority; this is scoped auto-grant filtering, not a new Claude sandbox or containment claim.
 - The previous malformed-config fixture that refused every wildcard now refuses an unsupported bracket class; its rejection assertion is retained. New tests establish the deliberately added glob grammar, future paths, wildcard aliases/retargeting, private scopes, discovery failures and actual daemon hook replies. Native account/model consumption is unverified.

package/docs/memory.md

@@ -196,21 +196,58 @@ ahub memory demote 1a2b3c4d              # a long-term entry becomes short-term
 ahub memory forget 1a2b3c4d              # gone from the index here, and on other machines once synced
 ahub memory supersede <old> <new>        # the old one is dropped from briefs and recall
 ahub memory rebuild
+ahub memory dedupe                     # inspect legacy claude-mem duplicate groups
+ahub memory dedupe --apply             # append supersede relations, never rewrite log bytes
 ```
 
 A forgotten long-term entry stays in the log file and in the sync remote's git history; removing it from there is a
-person's rewrite of that history.
+person's rewrite of that history. Forgetting a claude-mem import forgets every known non-forgotten member of its tuple group (source, project, source timestamp and text), including hidden duplicates, so they cannot reappear when their replacement is forgotten.
 
 ## Importing from claude-mem
 
-`ahub memory import claude-mem [--db <path>] [--limit N]` (a person's) copies the hub's own notes from claude-mem
+`ahub memory import claude-mem [--db <path>] [--limit N] [--restart]` (a person's) copies the hub's own notes from claude-mem
 (observations whose metadata names a `peer`: `hub_remember` and the hub's task notes) into long-term hub memory as
-`source: claude-mem`, for this project only (claude-mem files them under the repository's own name; a superproject's
-notes stay out, and two unrelated repositories with one name share it). Model answers from `ahub ask --remember`, text
-matching a PII pattern, text about a path the project's `pii.paths` makes private and secret-looking text are skipped. An
-imported note is placed in the graph by the paths and symbols in its text (claude-mem keeps no task proposal time).
-claude-mem's database is opened read-only and never changed; an observation always maps to the same entry, on any
-machine, so importing again adds nothing.
+`source: claude-mem`, for this project only. The SQL filters by the repository's basename before applying the limit;
+a superproject's notes stay out, while two unrelated repositories with one basename still share claude-mem's namespace.
+Model answers from `ahub ask --remember`, PII-pattern text, text about a path made private by the project's `pii.paths`
+and secret-looking text are skipped. The source database is opened read-only and never changed.
+
+- Import graph nodes are derived from text only: no checkout existence check and no machine-local `local.deny`.
+  Built-in denylisted names, relative-path normalization, absolute/parent exclusion, sorting and the 64-node cap still apply.
+  The source's timestamp and the existing content hash stay unchanged. Matching observations on different checkouts now
+  produce the same id; old ids, references and content validation remain valid. The local tuple fallback keeps re-import
+  idempotent even for legacy ids (its known ceiling is that the tuple excludes title).
+- A machine-local `memory/import-state.json` records the last fully handled row, including all skips. The cursor key
+  combines the source DB's real path, claude-mem project name and hub project key. The file uses mode 0600 and atomic
+  replacement; it never syncs. Unreadable or malformed state replays from zero, write failure logs a warning and preserves
+  the import result, and a source whose maximum candidate id for this project is below the cursor resets it (unrelated projects cannot mask a recreated source). Completed progress is saved even if a later
+  row throws. `--restart` starts from zero; use it after changing a PII policy to revisit rows skipped under the old policy.
+- The default limit is 10000. JSON reports `read` (project-matched, peer-tagged SQL rows this run), `added`,
+  `skipped.model`, `skipped.pii`, `skipped.secret`, `cursor` (last handled id), and `more` (`read === limit`). Malformed
+  metadata, non-string peers and empty text count only in `read`; already imported rows add nothing. `more` asks for
+  another run, which can return zero rows when the last batch exactly filled the limit. There is no project-skip counter.
+- Repository identity still depends on the local real path without an origin remote, and non-GitHub remotes spelled
+  differently can yield different project keys. These affect all hub memory and remain outside this import fix.
+
+### Legacy duplicate imports
+
+`ahub memory dedupe [--apply] [--json]` is console-only, including the listing, because it shows unscreened note text.
+It groups this project's non-forgotten claude-mem entries by `(source, project, at, text)`. Listing reports only actionable
+groups, their members, heads and chosen target; `--apply` appends ordinary supersede operations in this machine's log.
+Historical log bytes are never rewritten. Forget operates on the whole known tuple group.
+
+- Heads have no current replacement. Existing replacement relations, including a person's distinct outside notes, stay
+  intact. If every head can reach a valid synced outside terminal (shared when any head is shared), the newest qualifying
+  terminal by `(at, id)` replaces all heads, even a single head. Otherwise multiple heads converge onto the smallest id
+  among the heads; zero heads or one head without a qualifying outside terminal require no writes. A refused supersede
+  is reported as an error. Re-running after convergence writes nothing.
+- When `A -> B` already exists inside a group, dedupe connects another head `C -> B`, without trying the cyclic `B -> A`.
+  When `B -> X` and `C -> Y` name outside user replacements, `X` and `Y` both remain visible; a remaining head moves to
+  the newer qualifying terminal. A later outside replacement can make a previously settled group actionable again.
+- Old or mixed extractor versions can still introduce duplicate ids. Run dedupe after syncing them. Two machines acting
+  on divergent prior relations can choose different targets; sync folds relations deterministically using the existing
+  latest-relation and cycle guards. If several group members remain visible, one more dedupe run converges them. New
+  same-version imports with stable project keys converge automatically in either sync order.
 
 ## Measuring it
 

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.25 and control protocol 16. Live verification
+This guide describes ahub 0.12.26 and control protocol 16. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Command output
@@ -1619,21 +1619,21 @@ section is what they run.
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.25), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.26), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.25 ahub upgrade --to 0.12.25 --dry-run
-bunx --package @staix/agent-hub@0.12.25 ahub upgrade --to 0.12.25 --yes
+bunx --package @staix/agent-hub@0.12.26 ahub upgrade --to 0.12.26 --dry-run
+bunx --package @staix/agent-hub@0.12.26 ahub upgrade --to 0.12.26 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.25 (protocol 16) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.26 (protocol 16) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -1665,14 +1665,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.25 --dry-run
+ahub upgrade --to 0.12.26 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.25 --yes
+ahub upgrade --to 0.12.26 --yes
 ahub recovery status [<operation-id>]
 ahub recovery resume [<operation-id>]
 ahub recovery abort [<operation-id>]
@@ -2622,7 +2622,7 @@ Native policy is unmanaged and has NO hub sandbox; no permission_modes.jcode or
 
 # Rich-document text projections (#259)
 
-- Configure text_projection only in an untracked machine-local file, with a separate {input} argv argument. Facts uses bounded read-only/no-network conversion from a scratch directory, where the converter reads only its input snapshot and its own program and script files (no other project file, even under `local.read_allow`), and a content/config cache; failure keeps the prior file view and logs a bounded notice, and a conversion that failed with its full deadline is not retried for the same bytes and command for the life of the hub process (a bounded in-memory record) (#382).
+- Configure text_projection only in an untracked machine-local file, with a separate {input} argv argument. Facts uses bounded read-only/no-network conversion from a scratch directory, where the converter reads only its input snapshot and its own program and script files (no other project file, even under `local.read_allow`), and a content/config cache; failure keeps the prior file view and logs a bounded notice, and a conversion that failed with its full deadline is not retried for the same bytes and command while its entry lives in the failure record, which is in memory, bounded at 1024 entries, and cleared when full or at restart (#382).
 - Raw change identity and projected presentation stay separate; private paths never enter conversion. Schema, limits and current surface scope: [text projections](text-projection.md).
 
 # Task catalog guidance (#295)

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.25
+bun add -g github:STAIxBWLB/agent-hub#v0.12.26
 ahub setup
 ```
 

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -2424,7 +2424,7 @@ the queue.
 
 ## Amendment: bounded data policy globs (#259)
 
-pii.paths and data.readonly accept exact paths/subtrees and *, ? and whole-segment ** patterns. Validation keeps 64 entries, 200 characters each and at most 16 wildcard characters. Unsupported bracket/brace/negation/escape syntax, absolute paths and parent traversal refuse. Matching folds case, protects matched subtrees and treats parent task scopes as private when a future matching descendant is possible. Resolve both declared and real paths; wildcard alias discovery is uncached and bounded to 4096 directory entries and 32 levels. Resolution/discovery failure conservatively matches an active policy. Managed local/Pi tools retain hardlink and read-only command protections. Only an authenticated pre-tool ask-when-needed write grant evaluates the daemon-side read-only matcher; other phases/modes perform no grant-policy discovery. Protected grants are withheld without exposing policy paths; explicit approval/never-ask remain native authority, with no new sandbox claim. No account/research pilot is implied.
+pii.paths and data.readonly accept exact paths/subtrees and *, ? and whole-segment ** patterns. Validation keeps 64 entries, 200 characters each and at most 16 wildcard characters. Unsupported bracket/brace/negation/escape syntax, absolute paths and parent traversal refuse. Matching folds case, protects matched subtrees and treats parent task scopes as private when a future matching descendant is possible. Resolve both declared and real paths; wildcard alias discovery is uncached and bounded to 4096 directory entries per decision and 32 levels. Wildcard resolution/discovery failure conservatively matches an active policy. Exact entries and trailing-** roots also protect the targets of symlinks directly inside the matched directory, one level only (#385): a dangling child protects its lexical target, an ELOOP child is skipped, a root whose scan does not complete within the shared budget contributes no child aliases, and an unreadable root matches; * keeps its matched-link resolution. Managed local/Pi tools retain hardlink and read-only command protections. Only an authenticated pre-tool ask-when-needed write grant evaluates the daemon-side read-only matcher; other phases/modes perform no grant-policy discovery. Protected grants are withheld without exposing policy paths; explicit approval/never-ask remain native authority, with no new sandbox claim. No account/research pilot is implied.
 
 ## Amendment: custom lifecycle data (#257)
 

package/docs/text-projection.md

@@ -3,7 +3,7 @@
 - Optional machine-local text_projection maps lowercase extensions to argv arrays. Each uses one separate {input} argument. No shell string, automatic converter install or default command.
 - Example: { "text_projection": { ".docx": ["/usr/bin/textutil", "-convert", "txt", "-stdout", "{input}"] } }. Configure the converter explicitly for the machine. Shared/tracked config cannot choose these programs.
 - Facts excludes private paths before conversion. The converter reads an immutable snapshot in an owned temporary directory, from its own scratch directory, with literal read grants for that file and for the program and script files its argv names (relative ones are passed as absolute paths, and the directories above an in-project script can be listed) (nothing else in the project is readable, even under a `local.read_allow` entry that encloses it, so a converter that follows an include or loads a sibling helper module fails), uses the existing macOS no-network/read-only sandbox and has a 5-second deadline, 16 MiB input cap and 256 KiB stdout/stderr cap. A trusted helper owns and stops its process group; converter stderr is never published.
-- Output caches in state by raw content hash, extension and argv/program/script metadata fingerprint. Invalid/oversized cache or failing/unavailable conversion falls back to the existing raw/binary facts behavior, with one bounded notice per extension. A conversion that fails with its full deadline is not tried again for the same bytes and command for the life of the hub process, within a bounded in-memory record (#382).
+- Output caches in state by raw content hash, extension and argv/program/script metadata fingerprint. Invalid/oversized cache or failing/unavailable conversion falls back to the existing raw/binary facts behavior, with one bounded notice per extension. A conversion that fails with its full deadline is not tried again for the same bytes and command while its entry lives in the failure record, which is in memory, bounded at 1024 entries, and cleared when full or at restart (#382).
 - Raw hashes and git blob identities remain the change identities. Projected text only supplies presentation diffs. A projected read or patch cannot establish raw-file write attribution. Existing text privacy checks and header sanitization still apply.
 - Converter programs may require temporary writes/caches; those fail under this read-only policy. Use a converter that emits stdout. The owner and other native same-user processes remain outside this boundary.
 - Linux retains no-sandbox/no-converter behavior. No native model/account study runs. Shadow repositories and profile override/glob follow-ups remain open in #259.

package/docs/verification/2026-10-14-0.12.26.md

@@ -0,0 +1,31 @@
+# 0.12.26 release verification
+
+This record covers release preparation and source verification. It does not certify tagging, package publication, global installation or a live upgrade; those receipts are recorded separately.
+
+## Candidate
+
+0.12.26 carries the hub-collaboration round for issues #380, #385 and #386: PRs #389, #387 and #388. Control protocol remains 16.
+
+- #389 (#380): claude-mem imports derive their graph nodes from the observation text without consulting the checkout, so one observation is one content-hashed entry on every machine and sync converges regardless of import order; the import scan filters the project in SQL and resumes from a persisted machine-local cursor (`--restart` re-scans), so unrelated projects cannot exhaust the window; `ahub memory dedupe [--apply]` reconciles pre-fix duplicate groups with append-only supersede operations onto the lexicographically smallest id.
+- #387 (#385): an exact or trailing-`**` data-policy entry that matches a directory resolves that directory's direct-child symlinks and protects their targets, matching what `data/*` already did for a matched link; discovery of the on-disk root is case-compatible, the scan streams inside the shared 4096-entry budget without descending, a dangling link covers its lexical target, an unresolvable link loop aliases nothing, a root whose budget is exhausted contributes no aliases, and an unreadable protected root fails closed. The failure semantics for the new scan are the user's direct ruling of 2026-10-14. The spec paragraph in docs/specs/2026-09-19-agent-hub-design.md was amended in the same PR.
+- #388 (#386): the text-projection converter comment and both docs state the project-scoped read guarantee and the 1024-entry, cleared-when-full in-memory failure record.
+
+Every fix carries regression tests that failed before it. Review was adversarial and multi-round on the board (tasks #45-#52): the review of #387 found the case-sensitive exact-root miss (P1) and the unbounded readdir (P2), CI found the Linux EACCES-at-read edge (#51) and two seed guards that needed retargeting after the refactor (#52), each fixed and re-gated before merge.
+
+## Document review
+
+Every stale document was rechecked against the ten source commits of the three PRs. README, Quickstart and Operations carry the 0.12.26 version and install/upgrade strings; Operations' converter failure-record wording landed with #388. The data-policy contract document (docs/data-policy.md) and docs/memory.md were updated inside their fix PRs. The adapters and daemon area notes were confirmed accurate against the `cliCommandLabel` addition, the tests note against the seed-selector repairs, and Security against the policy-matching change (it makes no per-form matching claim; the contract lives in data-policy.md). Budget, Bus, Benchmarks, Models, Tasks and the local-worker notes were not stale.
+
+## Recorded checks
+
+- PR #388 head 483ca546: CI Linux, macOS and seeded guards passed; board review approved.
+- PR #389 head d5738472: worktree `scripts/check.sh` 2702 pass, 0 fail, 189163 assertions, `check: OK`, no daemon leaks; CI green; board review approved.
+- PR #387 head 5fbe5d3a: worktree full gate 2714 pass, `check: OK`; CI Linux, macOS and seeded guards passed; board review approved.
+- Release candidate fbf96c08: local `scripts/check.sh` in an isolated worktree — 2728 pass, 0 fail, 189269 assertions, `check: OK`, no daemon leaks. Later commits on this branch change documentation only.
+- Release head: CI, document freshness at the merge commit, and the release workflow are required before tagging is reported complete.
+
+Note: `scripts/check.sh` in the main checkout fails 35/68 daemon tests on unmodified main because the live hub daemon serving the project interferes; the isolated worktree gate is the valid signal (recorded in shared memory #194264).
+
+## Not verified
+
+Native, account and research legs remain open in #273 and #1. The installed runtime and live hubs are not upgraded by this release.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -98,7 +98,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -172,7 +172,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.25",
+  "version": "0.12.26",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.25",
+  "version": "0.12.26",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -16157,7 +16157,7 @@ import { join as join4 } from "path";
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.25",
+  version: "0.12.26",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/cli/help.ts

@@ -110,7 +110,7 @@ const SECTIONS: [string, [usage: string, description: string][]][] = [
     ["ahub memory search <words> | show <id> | graph <id|node> [--hops 1|2] [--json]", "find entries, read one with its provenance, or list its graph neighbourhood"],
     ["ahub memory promote|demote|forget <id> | supersede <old> <new> | rebuild", "a person's changes to memory: move an entry between tiers, forget it, mark it superseded, or rebuild the index from the logs"],
     ["ahub memory sync [--remote <private git url>] | machine [--label <name>]", "sync hub memory with your other machines through a private git remote (a person's), or show or name this machine"],
-    ["ahub memory import claude-mem [--db <path>] [--limit N] | suggestions | confirm|reject <id>", "copy the hub's notes from claude-mem into hub memory (a person's); review the model's suggested edges"],
+    ["ahub memory import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <id>", "copy the hub's notes from claude-mem into hub memory (a person's); review the model's suggested edges"],
     ["ahub goal [list] [--all] | show <id> [--json]", "long-term tasks: state, which machine holds each and until when, linked board tasks"],
     ["ahub goal new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task> | state <id> <state> | done <id> | take <id> [--force]", "a person's changes to long-term tasks; take --force voids other machines' claims"],
   ]],

package/src/cli/identity.ts

@@ -61,7 +61,7 @@ export function cliCommandLabel(command: string, args: readonly string[]): strin
   if (!["upgrade", "restart", "recovery", "recovery-run", "help", "--help", "--version", "version", "projects", "ui", "manager", "setup", "init", "daemon", "up", "console", "claude", "codex", "kimi", "qwen", "jcode", "pi", "local", "stop", "models", "say", "queue", "tail", "watch", "budget", "board", "task", "review", "remember", "ask", "route", "pause", "resume", "permit", "permission", "settings", "roster", "status", "pet", "logs", "export", "report", "research", "memory", "goal", "bench", "sdlc", "role", "facts", "check-path", "turns", "undo", "kill", "reset", "doctor"].includes(command)) return "unknown";
   if (["task", "queue", "budget", "route", "recovery", "models", "projects", "research", "memory", "goal", "bench"].includes(command)) {
     const sub = command === "bench" || command === "memory" || command === "goal" ? args.find((arg) => arg !== "--json") : args[0];
-    if (sub && ["propose", "show", "assign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;
+    if (sub && ["propose", "show", "assign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "dedupe", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;
   }
   return (/^[a-z][a-z0-9-]*$/.test(command) && !/\s/.test(command)) || ["--help", "--version"].includes(command) ? command : "unknown";
 }

package/src/cli/memory.ts

@@ -12,7 +12,7 @@ const loadConfigSafe = (cwd: string) => { try { return loadConfig(cwd); } catch
  * #258: `ahub memory`, straight on the machine's store (no hub needed). Reading is anyone's; promote, demote, forget,
  * supersede and rebuild are a person's (the identity gate refuses agent shells).
  */
-export const MEMORY_USAGE = "usage: ahub memory [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> | show <id> | graph <id|node> [--hops 1|2] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] | suggestions | confirm|reject <suggestion id>  [--json]";
+export const MEMORY_USAGE = "usage: ahub memory [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> | show <id> | graph <id|node> [--hops 1|2] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]";
 export const GOAL_USAGE = "usage: ahub goal [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]";
 
 const fail = (message: string): never => { throw new Error(message); };
@@ -85,17 +85,27 @@ export async function memoryCommand(args: string[], cwd: string, opts: { store?:
         if (!r.ok) fail(`hub memory sync: ${r.error}`);
         return `synced${r.pushed ? " and pushed" : ""}: ${r.entries} long-term entries visible here${r.warning ? `\nnote: ${r.warning}` : ""}`;
       }
+      case "dedupe": {
+        const apply = rest.includes("--apply");
+        if (rest.some(arg => arg !== "--apply")) fail("usage: ahub memory dedupe [--apply] [--json]");
+        const result = store.dedupe(project, apply);
+        if (json) return JSON.stringify(result, null, 2);
+        return [result.groups.length ? `${result.groups.length} duplicate import group(s)${apply ? `; appended ${result.applied} supersede operation(s)` : "; use --apply to reconcile"}` : "no duplicate import groups to reconcile",
+          ...result.groups.map(g => `${g.members.map(v => v.id.slice(0, 8)).join(", ")} -> ${g.target.slice(0, 8)}: ${g.members[0]!.text}`)].join("\n");
+      }
       case "import": {
         const db = flag("--db"), limit = flag("--limit");
-        if (rest[0] !== "claude-mem" || rest.length !== 1) fail("usage: ahub memory import claude-mem [--db <path>] [--limit N]");
+        const restart = rest.includes("--restart");
+        if (restart) rest.splice(rest.indexOf("--restart"), 1);
+        if (rest[0] !== "claude-mem" || rest.length !== 1) fail("usage: ahub memory import claude-mem [--db <path>] [--limit N] [--restart]");
         if (limit && !(Number(limit) > 0)) fail("--limit takes a positive number");
         const routing = currentRouting(cwd);
         const policy = privatePaths(); // a note about a private path never reaches the synced log
-        const key = memoryProjectKey(cwd), deny = loadConfigSafe(cwd)?.local.deny ?? [];
-        const nodes = (text: string) => extractNodes(text, { cwd, project: key, repo: key.startsWith("github.com/") ? key.slice("github.com/".length) : key, deny });
-        const r = importClaudeMem(store, { project: key, chain: projectChain(cwd), nodes, isPii: (text) => detectSignals({ title: text, detail: "", refs: {} }, routing, cwd).includes("pii") || mentionsPrivatePath(text, [], policy, cwd), ...(db ? { db } : {}), ...(limit ? { limit: Number(limit) } : {}) });
+        const key = memoryProjectKey(cwd);
+        const nodes = (text: string) => extractNodes(text, { cwd, project: key, repo: key.startsWith("github.com/") ? key.slice("github.com/".length) : key, checkExists: false });
+        const r = importClaudeMem(store, { project: key, chain: projectChain(cwd), nodes, restart, isPii: (text) => detectSignals({ title: text, detail: "", refs: {} }, routing, cwd).includes("pii") || mentionsPrivatePath(text, [], policy, cwd), ...(db ? { db } : {}), ...(limit ? { limit: Number(limit) } : {}) });
         if (json) return JSON.stringify(r, null, 2);
-        return `imported ${r.added} of ${r.read} hub notes from claude-mem as long-term entries (skipped: ${r.skipped.project} other projects, ${r.skipped.model} model answers, ${r.skipped.pii} PII, ${r.skipped.secret} secret-looking; the rest were already here)`;
+        return `imported ${r.added} of ${r.read} hub notes from claude-mem as long-term entries (skipped: ${r.skipped.model} model answers, ${r.skipped.pii} PII, ${r.skipped.secret} secret-looking; other candidates were empty, malformed or already imported)${r.more ? "\nmore remain: run it again" : ""}`;
       }
       case "suggestions": {
         const pending = store.suggestions(project).filter((x) => x.status === "suggested");

package/src/hub/path-policy.ts

@@ -1,4 +1,4 @@
-import { lstatSync, opendirSync, statSync } from "node:fs";
+import { accessSync, constants, lstatSync, opendirSync, readlinkSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { realPath } from "./project.ts";
 import { foldSegment } from "./permission-mode.ts";
@@ -25,6 +25,47 @@ export function policyTargets(cwd: string, paths: string[]): string[] {
   const root = realPath(cwd);
   return [...new Set(paths.flatMap(path => { const lexical = resolve(root, path); return [lexical, policyRealPath(lexical)]; }))];
 }
+type DiscoveryBudget = { entries: number };
+/** A dangling direct child names a future lexical target; an ELOOP child opens no file. */
+function directAliasTarget(path: string): string | undefined {
+  let target = path;
+  // Include the final target resolution after the last bounded redirect.
+  for (let hops = 0; hops <= 40; hops++) {
+    try { return policyRealPath(target); }
+    catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code === "ELOOP") return undefined;
+      if (code !== "ENOENT") throw error;
+    }
+    let ancestor = target;
+    while (!existing(ancestor)) {
+      const parent = dirname(ancestor);
+      if (parent === ancestor) return undefined;
+      ancestor = parent;
+    }
+    if (!lstatSync(ancestor).isSymbolicLink()) return undefined;
+    target = resolve(dirname(ancestor), readlinkSync(ancestor), relative(ancestor, target));
+  }
+  return undefined;
+}
+/** Only a completed bounded scan contributes aliases; a truncated root contributes none. */
+function aliasScope(dir: string, lexical: string, actual: string, includeParents: boolean, budget: DiscoveryBudget): boolean {
+  // Readability must not depend on reaching readSync after an exhausted-budget return.
+  accessSync(dir, constants.R_OK);
+  const handle = opendirSync(dir);
+  let matched = false;
+  try {
+    if (budget.entries >= 4096) return false;
+    for (let entry = handle.readSync(); entry; entry = handle.readSync()) {
+      if (budget.entries >= 4096) return false;
+      budget.entries++;
+      if (!entry.isSymbolicLink()) continue;
+      const target = directAliasTarget(join(dir, entry.name));
+      if (target !== undefined && (beneath(lexical, target) || beneath(actual, target) || includeParents && (beneath(target, lexical) || beneath(target, actual)))) matched = true;
+    }
+  } finally { handle.closeSync(); }
+  return matched;
+}
 /**
  * Either spelling protects: the lowercase comparison keeps `?` matching one code point whose fold expands (ß, fi), and
  * the folded one catches NFD/NFC, compatibility and long-s aliases. Adding a match only ever adds protection.
@@ -69,7 +110,7 @@ function patternScope(pattern: string[], states: Set<number>, path: string, incl
   return includeParents && states.size > 0; // this scope can contain a future protected descendant
 }
 /** Resolve wildcard directory aliases without trusting a cached expansion. Bound all filesystem discovery. */
-function globScope(root: string, lexical: string, actual: string, path: string, includeParents: boolean, budget: { entries: number }): boolean {
+function globScope(root: string, lexical: string, actual: string, path: string, includeParents: boolean, budget: DiscoveryBudget, roots: Set<string>, aliasDiscovery = false): boolean {
   const pattern = path.split("/").filter(p => p && p !== ".");
   const start = closure(pattern, new Set([0]));
   if (patternScope(pattern, start, relative(root, lexical), includeParents) || patternScope(pattern, start, relative(root, actual), includeParents)) return true;
@@ -77,6 +118,8 @@ function globScope(root: string, lexical: string, actual: string, path: string,
     const real = policyRealPath(dir);
     if (states.has(pattern.length)) {
       if (beneath(lexical, real) || beneath(actual, real) || includeParents && (beneath(real, lexical) || beneath(real, actual))) return true;
+      // Defer new child aliases until every pre-existing policy match has had its discovery budget.
+      if (pattern.at(-1) === "**" && existing(real) && statSync(real).isDirectory()) roots.add(real);
       // An earlier `**` can still match deeper: an alias below this match (`ss/ß -> other` for `**/ß`) is searched too.
       // A trailing `**` only re-matches everything below, so it never walks the subtree (as before, for paths outside it).
       states = new Set([...states].filter(i => i !== pattern.length && !(i === pattern.length - 1 && pattern[i] === "**")));
@@ -88,11 +131,13 @@ function globScope(root: string, lexical: string, actual: string, path: string,
     if (!lowerBeneath(real, root)) throw new Error("policy glob discovery outside project");
     const info = statSync(dir);
     if (!info.isDirectory()) return false;
+    if (aliasDiscovery && budget.entries >= 4096) return false;
     if (depth > 32 || ancestors.has(real) || budget.entries > 4096) throw new Error("policy glob discovery unavailable");
     const chain = new Set(ancestors); chain.add(real);
     const handle = opendirSync(dir);
     try {
       for (let entry = handle.readSync(); entry; entry = handle.readSync()) {
+        if (aliasDiscovery && budget.entries >= 4096) return false;
         if (++budget.entries > 4096) throw new Error("policy glob discovery unavailable");
         const next = advance(pattern, states, entry.name);
         if (next.size && visit(join(dir, entry.name), next, depth + 1, chain)) return true;
@@ -102,14 +147,28 @@ function globScope(root: string, lexical: string, actual: string, path: string,
   };
   return visit(root, start, 0, new Set());
 }
-/** Compare declared spelling, real targets and wildcard aliases. Unknown discovery conservatively protects. */
+/** Compare declared spelling, real targets and bounded aliases; legacy discovery errors fail closed. */
 export function matchesPolicy(cwd: string, path: string, paths: string[], includeParents = false): boolean {
   if (!paths.length) return false;
   try {
     if (path.length > 4096) return true;
     const root = realPath(cwd), lexical = resolve(root, path), actual = policyRealPath(lexical);
     includeParents &&= !existing(lexical) || statSync(lexical).isDirectory();
-    const budget = { entries: 0 };
-    return paths.some(entry => /[?*]/.test(entry) ? globScope(root, lexical, actual, entry, includeParents, budget) : policyTargets(root, [entry]).some(target => beneath(lexical, target) || beneath(actual, target) || (includeParents && (beneath(target, lexical) || beneath(target, actual)))));
+    const budget = { entries: 0 }, roots = new Set<string>(), exact: string[] = [];
+    if (paths.some(entry => {
+      if (/[?*]/.test(entry)) return globScope(root, lexical, actual, entry, includeParents, budget, roots);
+      const targets = policyTargets(root, [entry]);
+      if (targets.some(target => beneath(lexical, target) || beneath(actual, target) || includeParents && (beneath(target, lexical) || beneath(target, actual)))) return true;
+      const real = targets.at(-1)!;
+      if (existing(real) && statSync(real).isDirectory()) roots.add(real);
+      exact.push(entry);
+      return false;
+    })) return true;
+    // New exact-root discovery cannot consume the budget before legacy wildcard matches are checked.
+    for (const entry of exact) {
+      if (globScope(root, lexical, actual, `${entry}/**`, includeParents, budget, roots, true)) return true;
+    }
+    for (const dir of roots) if (aliasScope(dir, lexical, actual, includeParents, budget)) return true;
+    return false;
   } catch { return true; }
 }

package/src/hub/text-projection.ts

@@ -55,7 +55,9 @@ export class TextProjections {
   /** Inputs whose full-budget conversion failed: the same bytes under the same command are not converted again. */
   private readonly failed = new Set<string>();
   constructor(private readonly options: { cwd: string; stateDir: string; config: ProjectionConfig; deny?: string[]; readAllow?: string[]; log?: (line: string) => void }) {
-    // Rooted at an empty system directory, not the project: the converter reads its snapshot and program files only.
+    // Rooted at an empty system directory, not the project. The project guarantee: project file data is denied, then the
+    // snapshot, the argv-named program/script files and the directory listings above an in-project script are granted, so
+    // no other project file is readable (system, toolchain, home and local.read_allow paths outside the project remain granted).
     // Only where conversion can run: /var/empty is a macOS directory, and a host without the sandbox never converts.
     this.sandbox = Object.keys(options.config).length && sandboxAvailable() ? profile(EMPTY_ROOT, false, options.readAllow, options.deny, ["."]) : "";
   }

package/src/memory/import.ts

@@ -1,5 +1,7 @@
 import { Database } from "bun:sqlite";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+import { realPath } from "../hub/project.ts";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { KINDS, looksSecret, type Kind, type MemoryStore } from "./store.ts";
@@ -9,7 +11,24 @@ export const CLAUDE_MEM_BUSY_TIMEOUT_MS = 3000;
 /** Titles `ahub ask --remember` gives a model's answer (ask.ts ASK_NOTE_TITLE): never imported as a finding. */
 const MODEL_ANSWER = "ahub ask (model answer)";
 
-export interface ImportResult { read: number; added: number; skipped: { model: number; pii: number; secret: number; project: number } }
+export interface ImportResult { read: number; added: number; skipped: { model: number; pii: number; secret: number }; more: boolean; cursor: number }
+
+/** Machine-local progress is disposable; malformed/unreadable state simply replays the idempotent import. */
+function readCursors(file: string): Record<string, number> {
+  try {
+    const value: unknown = JSON.parse(readFileSync(file, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+    return Object.fromEntries(Object.entries(value).filter(([, id]) => Number.isSafeInteger(id) && id >= 0));
+  } catch { return {}; }
+}
+function writeCursor(file: string, key: string, cursor: number, log: (line: string) => void): void {
+  const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify({ ...readCursors(file), [key]: cursor }) + "\n", { mode: 0o600, flag: "wx" });
+    renameSync(temp, file);
+  } catch { log("claude-mem import progress could not be saved; the next run may replay handled rows"); }
+  finally { try { rmSync(temp, { force: true }); } catch { /* disposable progress */ } }
+}
 
 /**
  * #258 phase 3: copy the hub's own notes from claude-mem (observations whose metadata names a `peer`: `hub_remember`
@@ -17,30 +36,38 @@ export interface ImportResult { read: number; added: number; skipped: { model: n
  * the projects in `chain` (claude-mem files them under the repository's basename). Model answers, PII-pattern text and secret-looking text are skipped.
  * Idempotent: an observation always maps to the same entry.
  */
-export function importClaudeMem(store: MemoryStore, opts: { project: string; chain: string[]; isPii: (text: string) => boolean; nodes?: (text: string) => string[]; db?: string; limit?: number }): ImportResult {
+export function importClaudeMem(store: MemoryStore, opts: { project: string; chain: string[]; isPii: (text: string) => boolean; nodes?: (text: string) => string[]; db?: string; limit?: number; restart?: boolean; log?: (line: string) => void }): ImportResult {
   const file = opts.db ?? join(homedir(), ".claude-mem", "claude-mem.db");
   if (!existsSync(file)) throw new Error(`no claude-mem store at ${file}`);
+  const limit = opts.limit ?? 10_000;
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error("--limit takes a positive integer");
+  const state = join(store.dir, "import-state.json");
+  const name = opts.chain.at(-1) ?? "";
+  const key = createHash("sha256").update(JSON.stringify([realPath(file), name, opts.project])).digest("hex");
+  let cursor = opts.restart ? 0 : readCursors(state)[key] ?? 0;
   const db = new Database(file, { readonly: true });
   db.run(`PRAGMA busy_timeout = ${CLAUDE_MEM_BUSY_TIMEOUT_MS}`);
-  const result: ImportResult = { read: 0, added: 0, skipped: { model: 0, pii: 0, secret: 0, project: 0 } };
+  const result: ImportResult = { read: 0, added: 0, skipped: { model: 0, pii: 0, secret: 0 }, more: false, cursor };
   try {
-    const rows = db.query("SELECT id, project, title, text, narrative, created_at_epoch, metadata FROM observations WHERE metadata LIKE '%\"peer\"%' ORDER BY id LIMIT ?")
-      .all(opts.limit ?? 10_000) as { id: number; project: string | null; title: string | null; text: string | null; narrative: string | null; created_at_epoch: number | null; metadata: string | null }[];
+    const max = db.query("SELECT MAX(id) AS id FROM observations WHERE project = ? AND metadata LIKE '%\"peer\"%'").get(name) as { id: number | null };
+    if ((max.id ?? 0) < cursor) cursor = 0;
+    const rows = db.query("SELECT id, project, title, text, narrative, created_at_epoch, metadata FROM observations WHERE project = ? AND id > ? AND metadata LIKE '%\"peer\"%' ORDER BY id LIMIT ?")
+      .all(name, cursor, limit) as { id: number; project: string | null; title: string | null; text: string | null; narrative: string | null; created_at_epoch: number | null; metadata: string | null }[];
     // The hub files its claude-mem notes under the repository's own name (the chain's last); the names above it are other
     // projects (a superproject) whose notes and privacy policy are not this one's. ponytail: claude-mem keys projects by
     // basename, so two unrelated repositories with one name still share it.
-    const project = opts.project, names = new Set(opts.chain.slice(-1));
-    for (const r of rows) {
-      result.read++;
+    const project = opts.project;
+    result.read = rows.length;
+    result.more = rows.length === limit;
+    const handle = (r: typeof rows[number]) => {
       let meta: Record<string, unknown>;
-      try { meta = JSON.parse(r.metadata ?? "{}"); } catch { continue; }
-      if (typeof meta.peer !== "string" || !meta.peer) continue;
-      if (!r.project || !names.has(r.project)) { result.skipped.project++; continue; }
+      try { meta = JSON.parse(r.metadata ?? "{}"); } catch { return; }
+      if (!meta || typeof meta !== "object" || typeof meta.peer !== "string" || !meta.peer) return;
       const title = r.title ?? "", text = (r.text ?? r.narrative ?? "").trim();
-      if (!text) continue;
-      if (meta.source === "ahub ask" || title.startsWith(MODEL_ANSWER)) { result.skipped.model++; continue; }
-      if (opts.isPii(`${title}\n${text}`)) { result.skipped.pii++; continue; }
-      if (looksSecret(`${title}\n${text}`)) { result.skipped.secret++; continue; }
+      if (!text) return;
+      if (meta.source === "ahub ask" || title.startsWith(MODEL_ANSWER)) { result.skipped.model++; return; }
+      if (opts.isPii(`${title}\n${text}`)) { result.skipped.pii++; return; }
+      if (looksSecret(`${title}\n${text}`)) { result.skipped.secret++; return; }
       const kind: Kind = KINDS.includes(meta.kind as Kind) ? meta.kind as Kind : "finding";
       const at = new Date(r.created_at_epoch ?? 0).toISOString();
       const { added } = store.importNote({ op: "note", project, scope: "project", tier: "long", kind, peer: meta.peer.slice(0, 32), ...(title ? { title } : {}), text,
@@ -48,8 +75,16 @@ export function importClaudeMem(store: MemoryStore, opts: { project: string; cha
         // own paths and symbols place the note in the graph.
         about: opts.nodes?.(`${title}\n${text}`) ?? [], source: "claude-mem" }, at);
       if (added) result.added++;
+    };
+    for (const row of rows) {
+      handle(row);
+      cursor = row.id; // only fully handled rows, including every skip
     }
-  } finally { db.close(); }
+  } finally {
+    db.close();
+    result.cursor = cursor;
+    writeCursor(state, key, cursor, opts.log ?? console.error);
+  }
   store.refresh();
   return result;
 }

package/src/memory/store.ts

@@ -78,10 +78,10 @@ const SECRETS = [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, /\bAKIA[0-9A-Z]{16}\b/, /
 export const looksSecret = (text: string): boolean => SECRETS.some((re) => re.test(text));
 
 /** `task`: the board task's id and proposal time; its node carries both, so a task id reused after `ahub reset --all` is another node. */
-export interface Extract { cwd: string; project: string; repo: string; deny?: string[]; paths?: string[]; symbols?: string[]; task?: { id: number; created: number } }
+export interface Extract { cwd: string; project: string; repo: string; deny?: string[]; paths?: string[]; symbols?: string[]; task?: { id: number; created: number }; checkExists?: boolean }
 /**
  * Deterministic edges, fixed at write time so a rebuild never depends on the file system: the task's refs and plan
- * paths, plan symbols (with the path when the plan names exactly one), paths in the text that exist in the project then,
+ * paths, plan symbols (with the path when the plan names exactly one), paths in the text that exist in the project then (or text-only paths when checkExists is false),
  * `#N` as an issue of `repo`, and `task #N` as a board task. Paths stay relative to the project root; denylisted ones
  * are left out.
  */
@@ -99,7 +99,7 @@ export function extractNodes(text: string, x: Extract): Node[] {
   for (const m of text.matchAll(/(?:^|[\s(`'"])((?:[\w.-]+\/)*[\w.-]+\.[A-Za-z0-9]{1,8})(?=$|[\s)`'",:;])/g)) {
     const p = m[1]!;
     if (!p.includes("/") && !/\.(ts|js|tsx|jsx|py|rs|go|md|json|toml|yaml|yml|sh|html|css)$/.test(p)) continue;
-    try { if (!isAbsolute(p) && !p.startsWith("..") && existsSync(join(x.cwd, p))) path(p); } catch { /* unreadable: not an edge */ }
+    try { if (!isAbsolute(p) && !p.startsWith("..") && (x.checkExists === false || existsSync(join(x.cwd, p)))) path(p); } catch { /* unreadable: not an edge */ }
   }
   for (const m of text.matchAll(/\btask #(\d{1,9})\b/gi)) out.add(`task:${x.project}#${m[1]}`);
   for (const m of text.matchAll(/(?<![\w/]|task )#(\d{1,9})\b/gi)) out.add(`issue:${x.repo}#${m[1]}`);
@@ -244,7 +244,7 @@ export class MemoryStore {
     // A fixed machine: the same observation imported on two machines is one entry once they sync.
     const body = { schema: MEMORY_SCHEMA, at, machine: "claude-mem", ...n, text: n.text.slice(0, MAX_TEXT), ...(n.title ? { title: n.title.slice(0, MAX_TITLE) } : {}) } as Omit<Entry, "id">;
     const id = entryId(body);
-    // The observation, not the nodes derived from it (they follow the repository's files), says whether it is here already.
+    // The source tuple also recognizes legacy ids whose nodes depended on the checkout or extractor version.
     const known = this.db.query("SELECT id FROM entries WHERE id = ? OR (source = 'claude-mem' AND project = ? AND at = ? AND text = ?)").get(id, n.project, at, n.text.slice(0, MAX_TEXT)) as { id: string } | null;
     if (known) return { id: known.id, added: false };
     appendFileSync(join(this.dir, n.tier === "short" ? "local" : "log", `${this.machine.id}.jsonl`), JSON.stringify({ ...body, id }) + "\n", { mode: 0o600 });
@@ -255,7 +255,55 @@ export class MemoryStore {
   private op(op: OpEntry["op"], target: View, actor: string, by?: string): string {
     return this.append({ op, target: target.id, actor, ...(by ? { by } : {}) }, target.local);
   }
-  forget(id: string, actor: string, project?: string): View | undefined { const v = this.get(id, project); if (v) this.op("forget", v, actor); return v; }
+  forget(id: string, actor: string, project?: string): View | undefined {
+    const v = this.get(id, project);
+    if (!v) return undefined;
+    // Legacy imports may have different node-derived ids. Forget every known copy, including hidden ones.
+    const group = v.source === "claude-mem" ? this.live().filter(x => x.source === v.source && x.project === v.project && x.at === v.at && x.text === v.text) : [v];
+    for (const member of group) this.op("forget", member, actor);
+    return v;
+  }
+
+  /** Plan or append reconciliation of legacy imports, preserving every existing replacement relation. */
+  dedupe(project: string, apply = false): { groups: { members: View[]; heads: string[]; target: string }[]; applied: number } {
+    const rows = this.live(), byId = new Map(rows.map(v => [v.id, v]));
+    const tuples = new Map<string, View[]>();
+    for (const v of rows) {
+      if (v.project !== project || v.source !== "claude-mem") continue;
+      const key = JSON.stringify([v.at, v.text]);
+      const group = tuples.get(key) ?? []; group.push(v); tuples.set(key, group);
+    }
+    const groups: { members: View[]; heads: string[]; target: string }[] = [];
+    for (const members of tuples.values()) {
+      if (members.length < 2) continue;
+      members.sort((a, b) => a.id.localeCompare(b.id));
+      const heads = members.filter(v => !v.supersededBy);
+      if (!heads.length) continue;
+      const ids = new Set(members.map(v => v.id));
+      const terminals = new Map<string, View>();
+      for (const v of members) {
+        let terminal = v;
+        const seen = new Set<string>();
+        while (terminal.supersededBy && !seen.has(terminal.id)) {
+          seen.add(terminal.id);
+          const next = byId.get(terminal.supersededBy);
+          if (!next) break;
+          terminal = next;
+        }
+        if (!terminal.supersededBy && !ids.has(terminal.id) && !terminal.local && (terminal.project === project || terminal.scope === "shared") && heads.every(h => h.scope !== "shared" || terminal.scope === "shared")) terminals.set(terminal.id, terminal);
+      }
+      const outside = [...terminals.values()].sort((a, b) => b.at.localeCompare(a.at) || b.id.localeCompare(a.id))[0];
+      if (!outside && heads.length === 1) continue;
+      groups.push({ members, heads: heads.map(v => v.id), target: outside?.id ?? heads[0]!.id });
+    }
+    let applied = 0;
+    if (apply) for (const group of groups) for (const head of group.heads) {
+      if (head === group.target) continue;
+      if (!this.supersede(head, group.target, "user", project)) throw new Error("memory dedupe replacement refused; rerun to inspect current relations");
+      applied++;
+    }
+    return { groups, applied };
+  }
   /** A short-term note kept short-term: it expires like any other and is never promoted (its demote entry stays local). */
   keepShort(id: string, actor: string): void { const v = this.get(id); if (v?.tier === "short" && v.local && v.expiresAt === null) this.op("demote", v, actor, this.until()); } // once: a deadline is never pushed out
   demote(id: string, actor: string, project?: string): View | undefined { const v = this.get(id, project); if (v?.tier === "long") this.op("demote", v, actor, this.until()); return v; }