@staix/vault-mem 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.2.2] - 2026-10-31
+
+- Report operations under `reports/` and `ops/` accept and reread files up to 16 MiB, so graph artifacts above 2 MiB can be rebuilt. Notes keep their 256 KiB write / 2 MiB read limits; CLI body input limits are unchanged.
+- `vmem doctor` checks configured remotes and project registries locally, without network access. Remote validation shares sync's origin URL rules, registry validation uses the log-write parser, and failed checks exit 1.
+- A registry update whose directory flush fails after the config was replaced now reports `registry updated but directory fsync failed`, so the caller knows the update committed and need not retry. The lock is still released; a retried `vaults add` remains refused as already registered.
+- `vmem recover` reads at most 4 KiB of the lock owner record; a larger lock file is treated as unreadable (state `unknown`) and is never removed.
+
+## [0.2.1] - 2026-10-30
+
+- The `tidy` LINT event and the org-promotion SYNC events are bound to the vaults resolved at the start of the run; if a vault id is re-registered before the append, the event is refused with LOG_DRIFT instead of landing in the other vault. The committed notes are not rolled back.
+- Tidy and org promotion bind every note write to the same vaults: a re-registration before a write is refused with VAULT_DRIFT and nothing is written. A bound log append reports any re-registration as LOG_DRIFT, before policy or path checks.
+- Org promotion and `tidy --log` report `applied: true` when a write committed and a later step (lock removal, directory flush) failed; tidy then lists the log in `written`.
+
 ## [0.2.0] - 2026-10-30
 
 - Fine-grained PII policy: `vault.pii` can set `allow`, `warn` or `deny` per category (email, phone, the global `piiPatterns`, named per-vault patterns) and per surface (notes, log, promotion), with an allow list of exact addresses, domains and phone numbers. The `allow`/`deny` shorthand keeps its previous meaning.

package/README.md

@@ -31,7 +31,7 @@ Durability: the temporary file is fsynced before the rename and the home directo
 
 Crash recovery: the lock file records the writer's pid, host and start time. Nothing is cleaned up automatically. `vmem recover` previews the state; `vmem recover --confirm` removes the lock only when it names this host and a pid that no longer runs, and then removes leftover `.config-<uuid>.tmp` files. A live lock, a lock from another host, or an unreadable (older-format) lock is never removed and the command exits 1; confirm no writer runs, then delete `config.lock` by hand. No other file in the home or any vault is touched. If cleanup fails after an operation (for example the lock cannot be removed), the original error is kept and the cleanup failure, including a retained lock, is appended to it.
 
-Vault fields: `id`, absolute `path` (must contain a real `notes/` directory), `kind` (`personal|org`), `write` (`mcp|cli|none`), optional `pii` (the `allow|deny` shorthand or a policy object, see PII policy below; default `allow` for personal and `deny` for org, and `status`/`vaults list` always report the effective shorthand and `piiPolicy` matrix, including for unhealthy entries), optional `remote` (any nonempty string such as an `https://` or `git@host:path` URL; stored only) and optional `registry` (absolute path; stored only). No sync exists yet, so `remote` and `registry` are not validated against a server and doctor does not check them; reachability checks apply once sync is implemented. Policy fields are stored for later note-writing stages, not enforced by the read commands. Writer commands enforce write/channel policy and configured deny/PII screening.
+Vault fields: `id`, absolute `path` (must contain a real `notes/` directory), `kind` (`personal|org`), `write` (`mcp|cli|none`), optional `pii` (the `allow|deny` shorthand or a policy object, see PII policy below; default `allow` for personal and `deny` for org, and `status`/`vaults list` always report the effective shorthand and `piiPolicy` matrix, including for unhealthy entries), optional `remote` (any nonempty string such as an `https://` or `git@host:path` URL) and optional `registry` (absolute path). For healthy vaults, `doctor` checks locally that the vault is a git repository root with an origin whose fetch and push URLs all match `remote` (URL rewrites are refused), and that `registry` passes the same deny-path, size and project-id validation as log appends. Results appear under each vault's `checks.remote` and `checks.registry`; a failed check exits 1. These checks use no network and do not test reachability. `status` is unchanged. Policy fields are stored for later note-writing stages, not enforced by the read commands. Writer commands enforce write/channel policy and configured deny/PII screening.
 
 The only runtime dependency is the exact first-party pin `@staix/agent-mem@0.11.0`; it is not loaded by registry commands. Public library exports cover configuration, home resolution, registry operations, frontmatter, link resolution and the derived index. No console bin or UI contract is advertised before its implementation.
 
@@ -121,9 +121,9 @@ Syntax follows indexed reads: the vault id comes first. `new` supports `--title`
 
 `--dry-run` plans and validates any writer without creating locks, temporary files, directories or caches. `check` always takes this path, even without `--dry-run`. Move, delete and tidy first return a preview with planned path/hash changes and a fingerprint; confirmation requires that fingerprint. It covers canonical operation input, the canonical vault path/identity and policy, expected SHAs, every scanned note and all touched files, so even a new inbound reference after preview forces another preview. Move rewrites visible wiki/heading/block/embed targets and wiki references in frontmatter across the vault, preserving explicit `|label` text, anchors and code. Alias-only links resolve to no note and are left as written. The move source may be an existing note with a legacy file name (lint L13, for example a dot in the stem); the destination must be a valid stem. Tidy folds Connections sections into Relevant Notes. Delete refuses when it would newly break inbound links or MOC topics; fix those references first.
 
-Validation returns named issues with severity and no matched secret text: V01 schema/enums/description; V02 existing MOC topics; V03 newly unresolved links; V04 flat ASCII note paths (maximum 200 bytes) and safe report paths; V05 final Topics placement/content (warning), with explicit append-to-Topics refusal; V06 pinned agent-mem secret regex parity and denied sources/input/snapshot paths; V07 email/phone/configured PII patterns when denied; V08 create duplicates (stem/NFKC H1); V09 256 KiB prospective size, exact patch and expected-SHA/drift; V10 supersession target integrity. Unchanged pre-existing broken links warn, including after a move. `possibleDuplicates` lists candidate paths for warnings from a disposable in-memory FTS5 query of title terms, with BM25 <= -0.000001, up to three paths; no disk cache is written for that check. `LOCKED`, `IO`, `ROLLBACK`, `INDEX` and `CLEANUP` identify operational failures. CLI returns exit 1 when `ok` is false.
+Validation returns named issues with severity and no matched secret text: V01 schema/enums/description; V02 existing MOC topics; V03 newly unresolved links; V04 flat ASCII note paths (maximum 200 bytes) and safe report paths; V05 final Topics placement/content (warning), with explicit append-to-Topics refusal; V06 pinned agent-mem secret regex parity and denied sources/input/snapshot paths; V07 email/phone/configured PII patterns when denied; V08 create duplicates (stem/NFKC H1); V09 256 KiB prospective note size / 16 MiB report size, exact patch and expected-SHA/drift; V10 supersession target integrity. Unchanged pre-existing broken links warn, including after a move. `possibleDuplicates` lists candidate paths for warnings from a disposable in-memory FTS5 query of title terms, with BM25 <= -0.000001, up to three paths; no disk cache is written for that check. `LOCKED`, `IO`, `ROLLBACK`, `INDEX` and `CLEANUP` identify operational failures. CLI returns exit 1 when `ok` is false.
 
-A successful receipt reports `applied`, planned path/hash/byte changes, issues and `indexUpdated`. Unrelated malformed legacy YAML is skipped by duplicate hints and by writer index refresh, with a V01 warning naming the unchanged note; normal read/rebuild commands retain strict parsing. Move/tidy still require parseable inputs and name the offending path on refusal. Reads allocate each note's stat size plus one growth-probe byte, capped at the 2 MiB read limit plus one. A failed index refresh rolls back the file changes. Rollback first verifies each file still equals this operation's committed result; external edits are preserved. Failed/refused rollback retains the original backup and reports its relative recovery path. All files are staged before replacement and backups permit rollback of caught multi-file failures. Each individual rename is atomic; a machine/process crash between multiple renames can leave a partially completed batch. The retained lock and `.vmem-<uuid>.tmp` files require inspection and manual recovery after confirming the writer stopped. They are never automatically removed by registry recovery. Uncoordinated editors do not honor the lock; the pipeline rechecks SHAs before replacement, but this does not provide a filesystem transaction against concurrent external edits. Existing notes may be read up to the index's 2 MiB limit; prospective files are limited to 256 KiB, with at most 10000 flat notes per mutation snapshot. File/directory fsync has the platform guarantees described above. Successful changed mutations now append an event as described below; log failure is reported separately from note success.
+A successful receipt reports `applied`, planned path/hash/byte changes, issues and `indexUpdated`. Unrelated malformed legacy YAML is skipped by duplicate hints and by writer index refresh, with a V01 warning naming the unchanged note; normal read/rebuild commands retain strict parsing. Move/tidy still require parseable inputs and name the offending path on refusal. Reads allocate each note's stat size plus one growth-probe byte, capped at the 2 MiB read limit plus one. A failed index refresh rolls back the file changes. Rollback first verifies each file still equals this operation's committed result; external edits are preserved. Failed/refused rollback retains the original backup and reports its relative recovery path. All files are staged before replacement and backups permit rollback of caught multi-file failures. Each individual rename is atomic; a machine/process crash between multiple renames can leave a partially completed batch. The retained lock and `.vmem-<uuid>.tmp` files require inspection and manual recovery after confirming the writer stopped. They are never automatically removed by registry recovery. Uncoordinated editors do not honor the lock; the pipeline rechecks SHAs before replacement, but this does not provide a filesystem transaction against concurrent external edits. Existing notes may be read up to the index's 2 MiB limit; prospective notes are limited to 256 KiB; report operations under `reports/` and `ops/` allow up to 16 MiB for both prospective content and existing-file reads (including staging and rollback rechecks), with at most 10000 flat notes per mutation snapshot. File/directory fsync has the platform guarantees described above. Successful changed mutations now append an event as described below; log failure is reported separately from note success.
 
 
 # Append-only events
@@ -140,7 +140,7 @@ Every MCP log append and CLI call with a nonempty `AGENTHUB_PEER_ID`, `CLAUDECOD
 
 `appendLog` validates the registered canonical vault and write/channel policy, acquires a separate `log.lock` (bounded two-second contention wait), then makes one O_APPEND write and fsyncs the log. New log files are mode 0600 and their parent directory is flushed. Linked/nonregular files and an incomplete existing final line are refused. Cooperating appenders share the lock; a short write is truncated back only when the same file still has the expected size, and its tail still equals our exact prefix, then flushed. Error-after-write cases inspect at most one event's bytes. Failed/ambiguous writes or cleanup are explicit; the receipt reports `appended` (possibly null when unknown), `synced`, `bytesWritten` (possibly null) and `rolledBack` when a partial append was removed. Before reporting sync, the current log and vault identities are rechecked; rotation produces LOG_DRIFT and an unknown current-path append state. A synced event can coexist with a cleanup error. No existing event is rewritten. A crash can retain `log.lock`, and failed short-write recovery can retain an incomplete line; inspect the file and stopped writer before manual recovery. There is no automatic cleanup or new TTY requirement.
 
-Successful changed mutations default to EXTRACT, link to CONNECT, move to ROUTE, and supersede/tidy to RETHINK. Default events use project `-`, affected paths and the operation name rather than note text. Library callers can supply `WriteRequest.log` to override the event or `false` to disable it; CLI writers accept `--log JSON` for overrides. Preview/check/no-op/refused mutations never append. The append is bound to the mutation's resolved vault identity/policy, so re-registration cannot route its event to another vault. After a committed mutation, log append is independent: `ok`/`applied` describe the note operation, `log` holds its append receipt, and `logged` is true only when the event was appended and synced. A log error does not roll back a successfully saved note. CLI exits 1 for a log failure even when the note receipt says `ok: true`; inspect the receipt before retrying to avoid duplicate mutations/events. An override is validated at append time, not during a note-only dry run.
+Successful changed mutations default to EXTRACT, link to CONNECT, move to ROUTE, and supersede/tidy to RETHINK. Default events use project `-`, affected paths and the operation name rather than note text. Library callers can supply `WriteRequest.log` to override the event or `false` to disable it; CLI writers accept `--log JSON` for overrides. Preview/check/no-op/refused mutations never append. The append is bound to the mutation's resolved vault identity/policy, so re-registration cannot route its event to another vault; the same binding covers the tidy LINT event and both SYNC events of org promotion, which are refused with LOG_DRIFT instead. A bound append compares the registry before any policy or path check, so a re-registration always reads as LOG_DRIFT. Tidy and org promotion also bind every note write to the vaults resolved at the start of the run: if a vault id is re-registered before a write, that write is refused with VAULT_DRIFT and nothing is written to either vault. After a committed mutation, log append is independent: `ok`/`applied` describe the note operation, `log` holds its append receipt, and `logged` is true only when the event was appended and synced. A log error does not roll back a successfully saved note. CLI exits 1 for a log failure even when the note receipt says `ok: true`; inspect the receipt before retrying to avoid duplicate mutations/events. An override is validated at append time, not during a note-only dry run.
 
 Readers never create a home, log or lock, and work with `write: none`. They skip blank/comment lines, return the last matching 1..200 records (default 50), accept an optional canonical TYPE and non-backtracking regex subset up to 256 characters (`|`, `^`, `$`, `.`, character classes, `\d`/`\s`/`\w` and their inverses, escaped literals, and atom `*`/`+`/`?`; groups, backreferences and brace quantifiers are refused), and scan a fixed descriptor-size snapshot. Streaming is capped at 32 MiB; individual historical lines over 4096 bytes and incomplete final lines are omitted with warnings, and the serialized line array stays within 128 KiB. Above 20000 data lines, the manual-archival warning is preserved. Read failure returns `dataLines: null` rather than claiming a count. Golden synthetic fixtures and concurrent/fault persistence tests cover the format and actual append state; no live vault log was read or modified for this increment.
 
@@ -214,7 +214,7 @@ vmem promote-from-amem personal mem:<id> --link-to existing-note  # link an exis
 
 `vmem graph build <vault> [--dry-run]` writes `reports/vault-graph.json`, a dated graph report, graph trend history and GRAPH events through `applyWrite`. Old dated reports are preserved. Trend history appends one row per build, including repeated builds on the same date. Output receipts expose partial report/log failure; these separate writes are not a single transaction. `vmem graph neighbors <vault> <stem> [--hops 1..2] [--limit 1..500]` reads a bounded neighborhood. Matching MCP tools are `vmem_lint`, `vmem_graph_build`, and `vmem_graph_neighbors`; MCP report writes require `write=mcp`.
 
-Analysis consumes note sources from the derived SQLite index, including invalid-frontmatter rows retained separately from searchable notes. Normal scans also retain note sources in `analysis_notes`, roughly doubling cached source storage outside the vault; the cache remains derived and can be rebuilt. Read-only analysis and dry runs clone any existing derived cache through a readonly connection, then refresh changed notes in memory. A missing cache is built in memory. They create no cache, locks, reports or events. Auxiliary log, registry and report inputs use bounded plain-file reads. Snapshot limits are 10,000 notes / 64 MiB source, 1,000 reports / 16 MiB combined, and 32 MiB log; oversized inputs fail explicitly. Graph limits are 100,000 edges and 32 deterministic label-propagation rounds. MOCs are excluded from clustering; ties sort by node id. Graph extraction intentionally retains the reference's body-only legacy wiki-link semantics, distinct from the richer navigation resolver.
+Analysis consumes note sources from the derived SQLite index, including invalid-frontmatter rows retained separately from searchable notes. Normal scans also retain note sources in `analysis_notes`, roughly doubling cached source storage outside the vault; the cache remains derived and can be rebuilt. Read-only analysis and dry runs clone any existing derived cache through a readonly connection, then refresh changed notes in memory. A missing cache is built in memory. They create no cache, locks, reports or events. Auxiliary log, registry and report inputs use bounded plain-file reads. Snapshot limits are 10,000 notes / 64 MiB source, 1,000 reports / 16 MiB per file and combined, and 32 MiB log; oversized inputs fail explicitly. Graph limits are 100,000 edges and 32 deterministic label-propagation rounds. MOCs are excluded from clustering; ties sort by node id. Graph extraction intentionally retains the reference's body-only legacy wiki-link semantics, distinct from the richer navigation resolver.
 
 `bun scripts/lint-parity.ts` and `bun scripts/graph-parity.ts` compare the synthetic corpus against frozen Python reference oracles. Use `--reference /absolute/path/to/lint.py` or `--reference /absolute/path/to/build-graph.py` to run the unchanged Python tools directly (`PYTHON` selects an interpreter with PyYAML/networkx). Keep those references until a separate retirement decision after two consecutive zero-diff runs. Fixture parity does not establish private-corpus parity or authorize a live vault cutover. Private corpus evidence stays private; no note bodies belong in public fixtures.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/vault-mem",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Validated Obsidian-compatible knowledge vaults for agents and people",
   "license": "MIT",
   "type": "module",

package/src/analysis-input.ts

@@ -1,3 +1,4 @@
+import { MAX_REPORT_BYTES } from "./write-validation.ts";
 import { parseFrontmatter } from "./frontmatter.ts";
 import { sourceWorkspaceRoot, missingSourceWarnings, sourceReferences } from "./source.ts";
 import { parseAnalysisYaml } from "./analysis-yaml.ts";
@@ -50,7 +51,7 @@ export function analysisInput(home: string, id: string, options: { today?: strin
   let bytes = 0;
   for (const name of entries) {
     const file = join(reportsDir,name); permitted(file,config);
-    const source = analysisRead(file); if (source !== null) { bytes += Buffer.byteLength(source); if (bytes > 16 * 1024 * 1024) throw new Error("analysis: reports exceed aggregate bound"); reports[name] = source; }
+    const source = analysisRead(file, MAX_REPORT_BYTES); if (source !== null) { bytes += Buffer.byteLength(source); if (bytes > MAX_REPORT_BYTES) throw new Error("analysis: reports exceed aggregate bound"); reports[name] = source; }
   }
   let registryIds: string[] | null = null;
   if (vault.registry) {

package/src/analysis-reports.ts

@@ -1,3 +1,4 @@
+import { MAX_REPORT_BYTES } from "./write-validation.ts";
 import type { VaultSpec } from "./config.ts";
 import { lstatSync } from "node:fs";
 import { join } from "node:path";
@@ -46,10 +47,10 @@ export function writeAnalysisReports(home: string, request: AnalysisRequest, env
   }
   const originals = new Map(outputs.map(out => {
     const name = out.path.slice("reports/".length);
-    return [out.path, request.kind === "graph" ? snapshot.reports[name] ?? null : analysisRead(join(vault.path,out.path))] as const;
+    return [out.path, request.kind === "graph" ? snapshot.reports[name] ?? null : analysisRead(join(vault.path,out.path), MAX_REPORT_BYTES)] as const;
   }));
   unchanged();
-  for (const out of outputs) if (analysisRead(join(vault.path,out.path)) !== originals.get(out.path)) throw new Error("analysis: report changed during build");
+  for (const out of outputs) if (analysisRead(join(vault.path,out.path), MAX_REPORT_BYTES) !== originals.get(out.path)) throw new Error("analysis: report changed during build");
   const expectedShas = Object.fromEntries(snapshot.notes.map(n => ["notes/"+n.path.replace(/^notes\//,""),sha256(n.source)]));
   // Preflight every output through the same validation pipeline, before any output is written.
   const previews = outputs.map(out => applyWrite(home,{vault:request.vault,operation:{op:"report",...out},dryRun:true,channel:request.channel,expectedShas,log:false},{env}));
@@ -57,7 +58,7 @@ export function writeAnalysisReports(home: string, request: AnalysisRequest, env
   const receipts: WriteReceipt[] = [];
   for (const out of outputs) {
     unchanged();
-    if (analysisRead(join(vault.path,out.path)) !== originals.get(out.path)) throw new Error("analysis: report changed during build");
+    if (analysisRead(join(vault.path,out.path), MAX_REPORT_BYTES) !== originals.get(out.path)) throw new Error("analysis: report changed during build");
     const receipt = applyWrite(home,{vault:request.vault,operation:{op:"report",...out},channel:request.channel,expectedShas,log:false},{env});
     receipts.push(receipt);
     if (!receipt.ok) break;

package/src/cli.ts

@@ -1,3 +1,5 @@
+import { originCheck } from "./sync.ts";
+import { registryIds } from "./vault-log.ts";
 import { runAnalysisCommand } from "./analysis-commands.ts";
 import { runLogCommand } from "./log-commands.ts";
 import { runOrgCommand } from "./org-commands.ts";
@@ -51,7 +53,23 @@ export function run(args: string[], env: NodeJS.ProcessEnv = process.env): { tex
   switch (command) {
     case "status": case "doctor": {
       if (positional.length) throw new Error(`${command}: unexpected arguments`);
-      const vaults = registryStatus(home.home), healthy = vaults.every(v => v.healthy);
+      const config = command === "doctor" ? loadRegistry(home.home) : undefined;
+      const vaults = registryStatus(home.home).map(vault => {
+        if (command !== "doctor" || !vault.healthy || (!vault.remote && !vault.registry)) return vault;
+        const checks: Record<string, { ok: boolean; issue?: string }> = {};
+        if (vault.remote) {
+          try {
+            const checked = originCheck(vault.path, vault.remote, env);
+            checks.remote = { ok: checked.ok, ...(checked.issue ? { issue: checked.issue } : {}) };
+          } catch (error) { checks.remote = { ok: false, issue: error instanceof Error ? error.message : "git failed" }; }
+        }
+        if (vault.registry) {
+          try { registryIds(vault.registry, config!.denyPaths); checks.registry = { ok: true }; }
+          catch (error) { checks.registry = { ok: false, issue: error instanceof Error ? error.message : "cannot read project registry" }; }
+        }
+        return { ...vault, checks };
+      });
+      const healthy = vaults.every(v => v.healthy && (!("checks" in v) || Object.values(v.checks).every(check => check.ok)));
       result = { ...home, version, stage: "foundation", healthy, vaults };
       if (command === "doctor" && !healthy) code = 1;
       break;

package/src/org-promote.ts

@@ -9,9 +9,9 @@ import { VaultIndex } from "./vault-index.ts";
 import { applyWrite } from "./writer.ts";
 import { notePath } from "./write-operations.ts";
 import { screenContent } from "./write-validation.ts";
-import { appendLog } from "./vault-log.ts";
+import { appendLog, logBinding } from "./vault-log.ts";
 import type { WriteIssue, WriteReceipt } from "./write-types.ts";
-import type { LogReceipt } from "./log-types.ts";
+import type { LogBinding, LogReceipt } from "./log-types.ts";
 import { analysisInput } from "./analysis-input.ts";
 import { lintVault } from "./vault-lint.ts";
 import type { AnalysisSnapshot } from "./analysis-types.ts";
@@ -182,6 +182,10 @@ export function promoteToOrg(home: string, request: OrgPromoteRequest, options:
   if (target.kind !== "org" || target.write === "none") return fail(issue("POLICY", "promotion target must be a writable org vault"));
   if (request.channel === "mcp" && target.write !== "mcp") return fail(issue("POLICY", "target vault write policy refuses MCP"));
   if (request.channel === "mcp" && source.write !== "mcp") return fail(issue("POLICY", "source provenance write needs write=mcp on the personal vault"));
+  // SYNC events must land in the vaults resolved here, even if the registry is changed before the appends.
+  let bindings: Record<"source" | "target", LogBinding>;
+  try { bindings = { source: logBinding(source, config), target: logBinding(target, config) }; }
+  catch { return fail(issue("V04", "source or target vault path unavailable")); }
   let path: string;
   const index = new VaultIndex(home, source, all.map(v => v.path));
   try { index.scan(); path = `notes/${index.show(request.note, 1).path}`; }
@@ -207,13 +211,13 @@ export function promoteToOrg(home: string, request: OrgPromoteRequest, options:
     try { existing = parseFrontmatter(readSource(target, targetPath)).data; } catch { /* unreadable: treated as foreign */ }
     if (existing.promoted_from !== result.source || prior.includes(promotedTo)) return fail(issue("V08", `${target.id} already has ${targetPath}; move or delete it in the org vault first`, targetPath));
     const set = { promoted_to: prior.length ? [...prior, promotedTo] : promotedTo };
-    const plan = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env });
+    const plan = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env, binding: bindings.source });
     const fingerprint = sha({ recover: plan.fingerprint, promotedTo });
     const recovery: OrgPromoteResult = { ...result, target: `${target.id}:${targetPath}`, screen: { passed: true, issues: [] }, fingerprint, recovery: "provenance-only" };
     if (!plan.ok) return { ...recovery, issues: plan.issues };
     if (request.confirm !== true) return { ...recovery, ok: true, preview: true };
     if (request.fingerprint !== fingerprint) return { ...recovery, issues: [issue("V09", "stale or missing preview fingerprint")] };
-    const provenance = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set }, channel: request.channel ?? "cli", log: false }, { env: options.env });
+    const provenance = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set }, channel: request.channel ?? "cli", log: false }, { env: options.env, binding: bindings.source });
     return { ...recovery, ok: provenance.ok, applied: provenance.applied, provenance, issues: provenance.ok ? [] : provenance.issues };
   }
   const missingTopics = topics.filter(topic => !targetNotes.mocs.has(linkKey(topic)));
@@ -234,10 +238,10 @@ export function promoteToOrg(home: string, request: OrgPromoteRequest, options:
   const refusing = screen.filter(found => found.severity === "error");
   result.screen = { passed: refusing.length === 0, issues: screen };
   if (refusing.length) return { ...result, issues: screen };
-  const planned = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env, piiSurface: "promotion" });
+  const planned = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env, piiSurface: "promotion", binding: bindings.target });
   const provenanceSet = { promoted_to: prior.length ? [...prior.filter(p => p !== promotedTo), promotedTo] : promotedTo };
   const provenanceText = emitFrontmatter(parsed, provenanceSet);
-  const provenancePlan = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set: provenanceSet }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env });
+  const provenancePlan = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set: provenanceSet }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env, binding: bindings.source });
   result.fingerprint = sha({ target: planned.fingerprint, source: provenancePlan.fingerprint, text, provenanceText });
   // Org lint runs on the preview too (the note overlaid on the org snapshot), so a note that would fail lint is never written.
   const previewLint = lintPromoted(home, target, targetPath, text);
@@ -247,12 +251,13 @@ export function promoteToOrg(home: string, request: OrgPromoteRequest, options:
   if (request.confirm !== true) return { ...result, ok: true, preview: true, issues: [...planned.issues, ...provenancePlan.issues] };
   if (request.fingerprint !== result.fingerprint) return { ...result, issues: [issue("V09", "stale or missing preview fingerprint")] };
   const event = { type: "SYNC", project: request.logProject ?? "-", source: `${source.id}:${path}`, dest: `${target.id}:${targetPath}`, note: `promoted: ${typeof parsed.data.type === "string" ? parsed.data.type : "note"}` };
-  const note = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", log: false }, { env: options.env, piiSurface: "promotion" });
-  if (!note.ok || !note.applied) return { ...result, note, issues: note.issues };
-  const provenance = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set: provenanceSet }, channel: request.channel ?? "cli", log: false }, { env: options.env });
+  const note = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", log: false }, { env: options.env, piiSurface: "promotion", binding: bindings.target });
+  // A create that committed and then failed a later step (cleanup) is still a written org note.
+  if (!note.ok || !note.applied) return { ...result, applied: note.applied === true, note, issues: note.issues };
+  const provenance = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set: provenanceSet }, channel: request.channel ?? "cli", log: false }, { env: options.env, binding: bindings.source });
   const logs = { source: null as LogReceipt | null, target: null as LogReceipt | null };
   for (const [key, vault] of [["target", target], ["source", source]] as const) {
-    try { logs[key] = appendLog(home, { vault: vault.id, event, channel: request.channel ?? "cli" }, { env: options.env }); }
+    try { logs[key] = appendLog(home, { vault: vault.id, event, channel: request.channel ?? "cli" }, { env: options.env, binding: bindings[key] }); }
     catch { logs[key] = { ok: false, appended: null, synced: false, bytesWritten: null, issues: [issue("LOG_IO", "log append failed")] }; }
   }
   const lint = lintPromoted(home, target, targetPath, text);

package/src/registry.ts

@@ -1,4 +1,4 @@
-import { closeSync, constants, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -50,7 +50,8 @@ function mutate<T>(home: string, update: (config: VmemConfig) => T): T {
     try { writeFileSync(fd, text); fsyncSync(fd); } finally { closeSync(fd); }
     renameSync(temporary, join(home, CONFIG_FILE));
     temporary = undefined;
-    syncDirectory(home);
+    try { syncDirectory(home); }
+    catch (error) { throw new Error(`${join(home, CONFIG_FILE)}: registry updated but directory fsync failed: ${message(error)}`, { cause: error }); }
     return result;
   } catch (error) {
     failed = true; primary = error;
@@ -73,9 +74,20 @@ function mutate<T>(home: string, update: (config: VmemConfig) => T): T {
     }
   }
 }
+/** Upper bound for a lock owner record; larger files are treated as unreadable. */
+const MAX_LOCK_BYTES = 4096;
 function lockOwner(lock: string): LockOwner | undefined {
   try {
-    const value = JSON.parse(readFileSync(lock, "utf8")) as Partial<LockOwner>;
+    const fd = openSync(lock, constants.O_RDONLY);
+    let text: string;
+    try {
+      const buffer = Buffer.alloc(MAX_LOCK_BYTES + 1);
+      let length = 0, read: number;
+      while (length < buffer.length && (read = readSync(fd, buffer, length, buffer.length - length, null)) > 0) length += read;
+      if (length > MAX_LOCK_BYTES) return undefined; // oversized: never trusted
+      text = buffer.subarray(0, length).toString("utf8");
+    } finally { closeSync(fd); }
+    const value = JSON.parse(text) as Partial<LockOwner>;
     if (typeof value.pid === "number" && Number.isInteger(value.pid) && value.pid > 0 && typeof value.host === "string" && typeof value.created === "string") return value as LockOwner;
   } catch { /* unreadable or legacy lock */ }
   return undefined;

package/src/sync.ts

@@ -52,6 +52,20 @@ function gitIn(cwd: string, env: NodeJS.ProcessEnv): Git {
     return out;
   };
 }
+/** Local-only origin validation shared by doctor and sync; never fetches or pushes. */
+export function originCheck(root: string, remote: string, env: NodeJS.ProcessEnv = process.env): { ok: boolean; origin: string | null; fetchUrls: string[]; pushUrls: string[]; issue?: string } {
+  const git = gitIn(root, env);
+  if (realpathSync(git(["rev-parse", "--show-toplevel"]).stdout.trim()) !== root) throw new Error("vault path is not the root of its git repository");
+  const origin = git(["remote", "get-url", "origin"], { allowFail: true });
+  const originUrl = origin.status === 0 ? origin.stdout.trim() : null;
+  // Every effective fetch and push URL must be the configured remote; URL rewrites are refused outright
+  // because git does not report pushInsteadOf rewrites of an explicit pushurl.
+  const lines = (args: string[]) => { const out = git(args, { allowFail: true }); return out.status === 0 ? out.stdout.split("\n").map(line => line.trim()).filter(Boolean) : []; };
+  const fetchUrls = lines(["remote", "get-url", "--all", "origin"]), pushUrls = lines(["remote", "get-url", "--push", "--all", "origin"]);
+  const rewrites = lines(["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"]);
+  const ok = originUrl !== null && rewrites.length === 0 && fetchUrls.length > 0 && pushUrls.length > 0 && [...fetchUrls, ...pushUrls].every(url => sameRemote(url, remote));
+  return { ok, origin: originUrl, fetchUrls, pushUrls, ...(!ok ? { issue: originUrl === null ? "repository has no origin remote" : rewrites.length ? "git url insteadOf/pushInsteadOf rewrites are configured; refusing because the push destination cannot be verified" : "an origin fetch or push URL does not match the configured remote; nothing was fetched or pushed" } : {}) };
+}
 function planned(path: string): boolean { return STAGE_FILES.includes(path) || STAGE_PREFIXES.some(prefix => path.startsWith(prefix)); }
 /** Parse `status --porcelain=v1 -z` into changed paths (renames contribute both sides). */
 function changed(git: Git): string[] {
@@ -83,17 +97,13 @@ export function syncVault(home: string, request: { vault: string; confirm?: bool
   if (isDenied(root, config.denyPaths)) return { ...result, issues: [issue("V06", "vault path is denied; nothing was synced")] };
   const git = gitIn(root, options.env ?? process.env);
   try {
-    if (realpathSync(git(["rev-parse", "--show-toplevel"]).stdout.trim()) !== root) return { ...result, issues: [issue("SYNC", "vault path is not the root of its git repository")] };
-    const origin = git(["remote", "get-url", "origin"], { allowFail: true });
-    result.remote.origin = origin.status === 0 ? origin.stdout.trim() : null;
-    // Every effective fetch and push URL must be the configured remote; URL rewrites are refused outright
-    // because git does not report pushInsteadOf rewrites of an explicit pushurl.
-    const lines = (args: string[]) => { const out = git(args, { allowFail: true }); return out.status === 0 ? out.stdout.split("\n").map(line => line.trim()).filter(Boolean) : []; };
-    const fetchUrls = lines(["remote", "get-url", "--all", "origin"]), pushUrls = lines(["remote", "get-url", "--push", "--all", "origin"]);
-    const rewrites = lines(["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"]);
+    const checked = originCheck(root, spec.remote, options.env ?? process.env);
+    const { fetchUrls, pushUrls } = checked;
+    result.remote.origin = checked.origin;
     result.remote.push = pushUrls;
-    result.remote.matches = result.remote.origin !== null && rewrites.length === 0 && fetchUrls.length > 0 && pushUrls.length > 0 && [...fetchUrls, ...pushUrls].every(url => sameRemote(url, spec.remote!));
-    if (!result.remote.matches) return { ...result, issues: [issue("REMOTE", result.remote.origin === null ? "repository has no origin remote" : rewrites.length ? "git url insteadOf/pushInsteadOf rewrites are configured; refusing because the push destination cannot be verified" : "an origin fetch or push URL does not match the configured remote; nothing was fetched or pushed")] };
+    result.remote.matches = checked.ok;
+    if (!checked.ok) return { ...result, issues: [issue("REMOTE", checked.issue!)] };
+    const lines = (args: string[]) => { const out = git(args, { allowFail: true }); return out.status === 0 ? out.stdout.split("\n").map(line => line.trim()).filter(Boolean) : []; };
     const branch = git(["symbolic-ref", "--quiet", "--short", "HEAD"], { allowFail: true });
     if (branch.status !== 0) return { ...result, issues: [issue("SYNC", "detached HEAD; check out a branch first")] };
     result.branch = branch.stdout.trim();

package/src/tidy.ts

@@ -9,7 +9,7 @@ import { extractLinks, normalizeTarget } from "./links.ts";
 import { isDenied } from "./platform.ts";
 import { loadRegistry, syncDirectory } from "./registry.ts";
 import { normalizeSource, sourceReferences, sourceWorkspaceRoot, missingSourceWarnings } from "./source.ts";
-import { appendLog, LOG_LOCK } from "./vault-log.ts";
+import { appendLog, logBinding, LOG_LOCK } from "./vault-log.ts";
 import { appendSection, foldConnections, h2Sections } from "./write-operations.ts";
 import { SCHEMA_KEYS, SECRET_PATTERNS, TYPED_KEYS, screenContent } from "./write-validation.ts";
 import { redactPii } from "./pii.ts";
@@ -300,8 +300,11 @@ function sanitizeLog(text: string, vault: VaultSpec, config: VmemConfig): { text
   }).join("\n");
   return { text: out, lines, redactions, formats, changes };
 }
-/** Replace the log under its own lock, atomically (the one sanctioned in-place rewrite of the append-only log). */
-function rewriteLog(root: string, expected: string, next: string): void {
+/**
+ * Replace the log under its own lock, atomically (the one sanctioned in-place rewrite of the append-only log).
+ * `state.committed` turns true once the rename lands, so a caller can tell a later failure (fsync, lock removal) apart.
+ */
+function rewriteLog(root: string, expected: string, next: string, state: { committed: boolean }): void {
   const lock = join(root, LOG_LOCK);
   const fd = openSync(lock, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
   let temp: string | undefined;
@@ -311,7 +314,7 @@ function rewriteLog(root: string, expected: string, next: string): void {
     temp = join(root, `.vmem-log-${randomUUID()}.tmp`);
     const tfd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
     try { writeFileSync(tfd, next); fsyncSync(tfd); } finally { closeSync(tfd); }
-    renameSync(temp, join(root, "log")); temp = undefined;
+    renameSync(temp, join(root, "log")); temp = undefined; state.committed = true;
     syncDirectory(root);
   } finally {
     if (temp) try { unlinkSync(temp); } catch { /* best effort */ }
@@ -334,6 +337,8 @@ export function tidyVault(home: string, request: TidyRequest, options: { env?: N
   if (vault.write === "none" || (request.channel === "mcp" && vault.write !== "mcp")) return { ...result, issues: [issue("POLICY", "vault write policy refuses this channel")] };
   const root = realpathSync(vault.path);
   if (root !== vault.path || isDenied(root, config.denyPaths)) return { ...result, issues: [issue("V06", "vault path denied or changed")] };
+  // The LINT event must land in the vault this run read and wrote, even if the registry is changed meanwhile.
+  const binding = logBinding(vault, config);
   const map = request.map ?? { enums: {}, keys: {} };
   // Only flat notes/*.md are read: .obsidian/, templates/ and self/ are never touched.
   let notes: Map<string, string>;
@@ -369,8 +374,9 @@ export function tidyVault(home: string, request: TidyRequest, options: { env?: N
   // Validate every planned note with the writer (dry-run). A note the writer would refuse is reported and skipped
   // (left fully unchanged for manual repair) instead of blocking the rest of the migration.
   for (const change of [...planned]) {
-    const dry = applyWrite(home, { vault: vault.id, operation: { op: "sanitize", path: change.path, text: change.after }, channel: request.channel ?? "cli", dryRun: true, log: false }, { env: options.env });
+    const dry = applyWrite(home, { vault: vault.id, operation: { op: "sanitize", path: change.path, text: change.after }, channel: request.channel ?? "cli", dryRun: true, log: false }, { env: options.env, binding });
     const errors = dry.issues.filter(found => found.severity === "error");
+    if (errors.some(found => found.code === "VAULT_DRIFT")) return { ...result, issues: errors.filter(found => found.code === "VAULT_DRIFT") };
     if (!errors.length) continue;
     planned.splice(planned.indexOf(change), 1);
     result.reported.push({ path: change.path, message: `skipped: the writer refuses the sanitized note (${[...new Set(errors.map(found => found.code))].join(", ")}); repair by hand` });
@@ -385,18 +391,26 @@ export function tidyVault(home: string, request: TidyRequest, options: { env?: N
   if (request.confirm !== true) return { ...result, ok: true, preview: true };
   if (request.fingerprint !== result.fingerprint) return { ...result, issues: [issue("V09", "stale or missing preview fingerprint")] };
   for (const change of planned) {
-    const receipt = applyWrite(home, { vault: vault.id, operation: { op: "sanitize", path: change.path, text: change.after }, channel: request.channel ?? "cli", expectedShas: { [change.path]: sha256(change.before) }, log: false }, { env: options.env });
-    if (!receipt.ok || !receipt.applied) return { ...result, issues: receipt.issues.length ? receipt.issues : [issue("IO", "note write failed", change.path)] };
+    const receipt = applyWrite(home, { vault: vault.id, operation: { op: "sanitize", path: change.path, text: change.after }, channel: request.channel ?? "cli", expectedShas: { [change.path]: sha256(change.before) }, log: false }, { env: options.env, binding });
+    // Notes written before a failure stay committed, so the result reports them as applied.
+    if (!receipt.ok || !receipt.applied) {
+      if (receipt.applied) result.written.push(change.path); // committed, then a later step of the write failed
+      return { ...result, applied: result.written.length > 0, issues: receipt.issues.length ? receipt.issues : [issue("IO", "note write failed", change.path)] };
+    }
     result.written.push(change.path);
   }
   if (logPlan) {
-    if (isDenied(join(root, "log"), loadRegistry(home).denyPaths)) return { ...result, issues: [issue("V06", "the vault log is denied by the path policy; log not rewritten")] };
-    try { rewriteLog(root, logPlan.before, logPlan.text); result.written.push("log"); }
-    catch (error) { return { ...result, issues: [issue("LOG", error instanceof Error ? error.message.slice(0, 200) : "log rewrite failed")] }; }
+    if (isDenied(join(root, "log"), loadRegistry(home).denyPaths)) return { ...result, applied: result.written.length > 0, issues: [issue("V06", "the vault log is denied by the path policy; log not rewritten")] };
+    const state = { committed: false };
+    try { rewriteLog(root, logPlan.before, logPlan.text, state); result.written.push("log"); }
+    catch (error) {
+      if (state.committed) result.written.push("log"); // the new log is in place; a later step failed
+      return { ...result, applied: result.written.length > 0, issues: [issue("LOG", error instanceof Error ? error.message.slice(0, 200) : "log rewrite failed")] };
+    }
   }
   const counted = Object.values(result.counts).reduce((sum, n) => sum + n, 0);
   if (planned.length || logPlan) {
-    const receipt = appendLog(home, { vault: vault.id, event: { type: "LINT", project: "-", source: "vmem:tidy", note: result.event! }, channel: request.channel ?? "cli" }, { env: options.env });
+    const receipt = appendLog(home, { vault: vault.id, event: { type: "LINT", project: "-", source: "vmem:tidy", note: result.event! }, channel: request.channel ?? "cli" }, { env: options.env, binding });
     if (!receipt.ok) return { ...result, applied: true, issues: receipt.issues };
   }
   return { ...result, ok: true, applied: result.written.length > 0 || counted > 0 };

package/src/vault-log.ts

@@ -7,6 +7,7 @@ import { canonicalPath, isDenied } from "./platform.ts";
 import { formatLogEvent, LOG_TYPES } from "./log-format.ts";
 import type { LogBinding, LogContext, LogReadOptions, LogReadResult, LogReceipt, LogRequest } from "./log-types.ts";
 import type { WriteIssue } from "./write-types.ts";
+import type { VaultSpec, VmemConfig } from "./config.ts";
 export const LOG_LOCK = "log.lock";
 export const MAX_LOG_READ_BYTES = 32 * 1024 * 1024;
 export const LARGE_LOG_LINES = 20000;
@@ -30,7 +31,7 @@ function boundedPlain(file: string, maximum: number): string {
     return text;
   } finally { closeSync(fd); }
 }
-function registryIds(file: string, denyPaths: string[] = []): Set<string> {
+export function registryIds(file: string, denyPaths: string[] = []): Set<string> {
   if (isDenied(canonicalPath(file), denyPaths)) refuse("L09", "registry path is denied");
   let parsed: unknown;
   try { parsed = Bun.YAML.parse(boundedPlain(file, 1024 * 1024)); }
@@ -64,13 +65,32 @@ function context(home: string, id: string, channel: "cli" | "mcp" | undefined, w
   return { vault, config, channel, ...(write && vault.registry ? { projectIds: registryIds(vault.registry, config.denyPaths) } : {}) };
 }
 /** One O_APPEND write per event. A separate cooperative lock permits safe short-write rollback. */
+/** Bind a later append to the vault spec, path policy and root identity resolved now (refused with LOG_DRIFT if they change). */
+export function logBinding(vault: VaultSpec, config: VmemConfig): LogBinding {
+  const identity = lstatSync(vault.path);
+  return { vault, denyPaths: config.denyPaths ?? [], piiPatterns: config.piiPatterns ?? [], dev: Number(identity.dev), ino: Number(identity.ino) };
+}
+/** True when the registered vault still equals the binding: spec, path policy and root identity. Never throws. */
+export function matchesBinding(config: VmemConfig, id: string, binding: LogBinding): boolean {
+  const vault = config.vaults.find(v => v.id === id);
+  if (!vault || JSON.stringify(vault) !== JSON.stringify(binding.vault) || JSON.stringify(config.denyPaths ?? []) !== JSON.stringify(binding.denyPaths) || JSON.stringify(config.piiPatterns ?? []) !== JSON.stringify(binding.piiPatterns)) return false;
+  try { const identity = lstatSync(vault.path); return Number(identity.dev) === binding.dev && Number(identity.ino) === binding.ino; } catch { return false; }
+}
 export function appendLog(home: string, request: LogRequest, options: { env?: NodeJS.ProcessEnv; now?: Date; binding?: LogBinding } = {}): LogReceipt {
   const result: LogReceipt = { ok: false, appended: false, synced: false, bytesWritten: 0, issues: [] };
   let fd: number | undefined, lockFd: number | undefined, lockFile: string | undefined, identity: { ino: number; dev: number } | undefined;
   const error = (code: string, message: string) => result.issues.push({ code, severity: "error", message });
   try {
     if (!request || typeof request !== "object" || typeof request.vault !== "string" || Object.keys(request).some(key => !["vault", "event", "channel"].includes(key))) refuse("L09", "invalid log request");
-    const ctx = context(home, request.vault, request.channel, true);
+    // A bound append compares the registry first, so any re-registration reads as drift rather than a policy or path error.
+    if (options.binding && !matchesBinding(loadRegistry(home), request.vault, options.binding)) refuse("LOG_DRIFT", "vault identity or policy changed after mutation; log not appended");
+    let ctx: ReturnType<typeof context>;
+    try { ctx = context(home, request.vault, request.channel, true); }
+    catch (caught) {
+      // A re-registration between the binding check and this second registry read still reads as drift.
+      if (options.binding && !matchesBinding(loadRegistry(home), request.vault, options.binding)) refuse("LOG_DRIFT", "vault identity or policy changed after mutation; log not appended");
+      throw caught;
+    }
     const rootIdentity = lstatSync(ctx.vault.path);
     if (options.binding) {
       const bound = options.binding;

package/src/write-validation.ts

@@ -34,6 +34,7 @@ const SECRETS = [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, /\bAKIA[0-9A-Z]{16}\b/, /
 export const SECRET_PATTERNS: readonly RegExp[] = SECRETS;
 export { EMAIL_PATTERN } from "./pii.ts";
 const MAX_BYTES = 256 * 1024;
+export const MAX_REPORT_BYTES = 16 * 1024 * 1024;
 function issue(code: string, message: string, severity: WriteIssue["severity"] = "error", path?: string): WriteIssue {
   return { code, severity, message, ...(path ? { path } : {}) };
 }
@@ -209,7 +210,7 @@ export function validateWrite(changes: PlannedChange[], context: ValidationConte
     if (change.after === null) final.delete(change.path);
     else if (change.path.startsWith("notes/")) final.set(change.path, change.after);
     if (change.after === null) continue;
-    if (Buffer.byteLength(change.after) > MAX_BYTES) issues.push(issue("V09", "prospective file exceeds 256 KiB", "error", change.path));
+    if (Buffer.byteLength(change.after) > (report ? MAX_REPORT_BYTES : MAX_BYTES)) issues.push(issue("V09", report ? "prospective report exceeds 16 MiB" : "prospective file exceeds 256 KiB", "error", change.path));
     issues.push(...screenContent(change.after, context.vault, context.config, context.piiSurface).map(value => ({ ...value, path: change.path })));
     try{issues.push(...screenMetadata(parseFrontmatter(change.after).data,context,change.path));}catch{ /* Invalid note YAML is reported separately; reports remain schema-exempt. */ }
   }

package/src/writer.ts

@@ -1,4 +1,4 @@
-import { appendLog } from "./vault-log.ts";
+import { appendLog, matchesBinding } from "./vault-log.ts";
 import type { LogEvent } from "./log-types.ts";
 import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
@@ -10,8 +10,9 @@ import { VaultIndex, MAX_NOTE_BYTES } from "./vault-index.ts";
 import { parseFrontmatter } from "./frontmatter.ts";
 import { canonicalPath, isDenied } from "./platform.ts";
 import { moveSourcePath, notePath, planOperation, refuse, WriteRefusal } from "./write-operations.ts";
-import { validateWrite } from "./write-validation.ts";
+import { MAX_REPORT_BYTES, validateWrite } from "./write-validation.ts";
 import type { PiiSurface } from "./config.ts";
+import type { LogBinding } from "./log-types.ts";
 import type { ChangeReceipt, PlannedChange, WriteIssue, WriteReceipt, WriteRequest } from "./write-types.ts";
 export const MUTATION_LOCK = "mutation.lock";
 export const MAX_WRITE_BYTES = 256 * 1024;
@@ -40,22 +41,22 @@ function safePath(root: string, path: string): string {
 function stamp(stat: { dev: bigint; ino: bigint; size: bigint; mtimeNs: bigint; ctimeNs: bigint }): string {
   return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
 }
-function readPlain(root: string, path: string): string | null {
+function readPlain(root: string, path: string, maximum = MAX_NOTE_BYTES): string | null {
   const file = safePath(root, path);
   let fd: number;
   try { fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
   catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw error; }
   try {
     const before = fstatSync(fd, { bigint: true });
-    if (!before.isFile() || before.size > BigInt(MAX_NOTE_BYTES)) refuse("V09", "file exceeds read bound or is not regular", path);
-    const bytes = Buffer.alloc(Math.min(Number(before.size) + 1, MAX_NOTE_BYTES + 1));
+    if (!before.isFile() || before.size > BigInt(maximum)) refuse("V09", "file exceeds read bound or is not regular", path);
+    const bytes = Buffer.alloc(Math.min(Number(before.size) + 1, maximum + 1));
     let size = 0;
     while (size < bytes.length) {
       const count = readSync(fd, bytes, size, bytes.length - size, null); size += count;
       if (!count) break;
     }
     const after = fstatSync(fd, { bigint: true });
-    if (size > MAX_NOTE_BYTES || stamp(before) !== stamp(after)) refuse("V09", "file changed during read", path);
+    if (size > maximum || stamp(before) !== stamp(after)) refuse("V09", "file changed during read", path);
     const buffer = bytes.subarray(0, size), text = buffer.toString("utf8");
     if (!Buffer.from(text).equals(buffer)) refuse("V01", "note must be valid UTF-8", path);
     return text;
@@ -112,7 +113,8 @@ function duplicateWarnings(request: WriteRequest, notes: Map<string, string>, ch
   } finally { db.close(); }
 }
 /** Single mutation entry point. Preview/dry-run perform no writes, including locks and caches. */
-export function applyWrite(home: string, request: WriteRequest, options: { env?: NodeJS.ProcessEnv; piiSurface?: PiiSurface } = {}): WriteReceipt {
+/** `options.binding` (internal callers composing several writes) refuses with VAULT_DRIFT unless the registry still matches it. */
+export function applyWrite(home: string, request: WriteRequest, options: { env?: NodeJS.ProcessEnv; piiSurface?: PiiSurface; binding?: LogBinding } = {}): WriteReceipt {
   let lockFd: number | undefined, lockFile: string | undefined, lockIdentity: { ino: number; dev: number } | undefined;
   let index: VaultIndex | undefined;
   const temps = new Set<string>(), createdDirs: string[] = [], committed: PlannedChange[] = [];
@@ -125,6 +127,7 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
     if (request.expectedShas !== undefined && (!request.expectedShas || typeof request.expectedShas !== "object" || Array.isArray(request.expectedShas))) refuse("V09", "expectedShas must be a mapping");
     if (request.channel !== undefined && !["cli", "mcp"].includes(request.channel)) refuse("POLICY", "unknown write channel");
     const config = loadRegistry(home), vault = config.vaults.find(value => value.id === request.vault);
+    if (options.binding && !matchesBinding(config, request.vault, options.binding)) refuse("VAULT_DRIFT", "vault identity or policy changed since the run started; nothing written");
     if (!vault) refuse("V04", "unknown vault id");
     if (request.operation.op !== "check" && (vault.write === "none" || (request.channel === "mcp" && vault.write !== "mcp"))) refuse("POLICY", "vault write policy refuses this channel");
     root = realpathSync(vault.path);
@@ -147,7 +150,7 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
       // Planning validates the report's exact relative path before it can be read.
       planOperation(request.operation, notes, null);
       if (isDenied(join(root, request.operation.path), config.denyPaths)) refuse("V06", "report output path is denied");
-      reportBefore = readPlain(root, request.operation.path);
+      reportBefore = readPlain(root, request.operation.path, MAX_REPORT_BYTES);
     }
     changes = planOperation(request.operation, notes, reportBefore);
     for (const change of changes) if (isDenied(join(root, change.path), config.denyPaths)) refuse("V06", "planned mutation path is denied", change.path);
@@ -155,6 +158,8 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
     if (!issues.some(issue => issue.severity === "error")) issues.push(...duplicateWarnings(request, notes, changes));
     const input = { vault: request.vault, channel: request.channel ?? "cli", operation: request.operation, expectedShas: request.expectedShas ?? {}, log: request.log ?? null };
     const identity = lstatSync(root);
+    // The identity every later commit check uses must still be the bound root, not a directory swapped in meanwhile.
+    if (options.binding && (Number(identity.dev) !== options.binding.dev || Number(identity.ino) !== options.binding.ino)) refuse("VAULT_DRIFT", "vault root changed since the run started; nothing written");
     fingerprint = sha256(canonical({ input, vault, policy: { denyPaths: config.denyPaths ?? [], piiPatterns: config.piiPatterns ?? [], piiSurface: options.piiSurface ?? "notes" }, root, identity: [identity.dev, identity.ino], files: [...notes].map(([path, text]) => [path, sha256(text)]), changes: receipts(changes) }));
     if (twoStep && request.confirm === true && (typeof request.fingerprint !== "string" || request.fingerprint !== fingerprint)) refuse("V09", "stale or missing preview fingerprint");
     if (issues.some(issue => issue.severity === "error")) return result = { ok: false, applied: false, issues, changes: receipts(changes), fingerprint, indexUpdated: false };
@@ -191,7 +196,7 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
       if (current.size !== notes.size || [...current].some(([path, text]) => notes.get(path) !== text)) refuse("V09", "vault changed while staging");
       for (const change of changes) {
         const file = safePath(root, change.path);
-        if (readPlain(root, change.path) !== change.before) refuse("V09", "file changed while staging", change.path);
+        if (readPlain(root, change.path, request.operation.op === "report" ? MAX_REPORT_BYTES : MAX_NOTE_BYTES) !== change.before) refuse("V09", "file changed while staging", change.path);
         if (change.after === null) unlinkSync(file);
         else { const temp = staged.get(change.path)!; renameSync(temp, file); temps.delete(temp); }
         committed.push(change);
@@ -204,7 +209,7 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
       for (const change of [...committed].reverse()) {
         try {
           const file = safePath(root, change.path);
-          if (readPlain(root, change.path) !== change.after) throw new Error("external write detected before rollback");
+          if (readPlain(root, change.path, request.operation.op === "report" ? MAX_REPORT_BYTES : MAX_NOTE_BYTES) !== change.after) throw new Error("external write detected before rollback");
           if (change.before === null) unlinkSync(file);
           else { const backup = backups.get(change.path)!; renameSync(backup, file); temps.delete(backup); }
         } catch {