@vaur94/agz-memory 0.5.0 → 0.5.2

package/dist/server.js

@@ -2,8 +2,8 @@
 // @bun
 
 // src/index.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4 } from "fs";
-import { dirname as dirname3 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "fs";
+import { dirname as dirname4 } from "path";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 
 // src/config.ts
@@ -11,7 +11,8 @@ import { homedir } from "os";
 import { join } from "path";
 function resolveConfig(environment = process.env) {
   const databasePath = environment.OPENCODE_MEMORY_DATABASE_PATH?.trim() || join(environment.HOME ?? homedir(), ".local", "share", "opencode-memory", "memory.sqlite");
-  return { databasePath };
+  const quarantineKeyringPath = environment.OPENCODE_MEMORY_QUARANTINE_KEYRING_PATH?.trim() || `${databasePath}.quarantine-keys`;
+  return { databasePath, quarantineKeyringPath };
 }
 
 // src/db.ts
@@ -749,7 +750,7 @@ function inspectDatabase(db) {
   }
   return { integrity, foreignKeyViolations, schemaVersion, counts };
 }
-function assertHealthyDatabase(db) {
+function assertHealthyDatabase(db, options = {}) {
   const health = inspectDatabase(db);
   if (health.integrity !== "ok") {
     throw new Error(`database integrity check failed: ${health.integrity}`);
@@ -757,7 +758,7 @@ function assertHealthyDatabase(db) {
   if (health.foreignKeyViolations.length > 0) {
     throw new Error(`database foreign key check failed: ${health.foreignKeyViolations.length} violation(s)`);
   }
-  if (health.schemaVersion === 11)
+  if (options.verifySchema !== false && health.schemaVersion === 11)
     assertSchemaV11(db);
   return health;
 }
@@ -2184,7 +2185,7 @@ var V9_V10_COLUMNS = {
     "completed_at"
   ]
 };
-function assertLegacySchemaIdentity(db, version) {
+function assertLegacySchemaIdentity(db, version, options = {}) {
   if (version < 2 || version > 10)
     throw new Error("unrecognized_database");
   const applicationID = db.query("PRAGMA application_id").get().application_id;
@@ -2192,12 +2193,14 @@ function assertLegacySchemaIdentity(db, version) {
     throw new Error("unrecognized_database");
   if (version === 2 && tableExists(db, "memory_items")) {
     assertV2Identity(db);
-    assertHealthyDatabase(db);
+    if (options.verifyHealth)
+      assertHealthyDatabase(db);
     return;
   }
   if (version < 8) {
     assertPreV8Identity(db, version);
-    assertHealthyDatabase(db);
+    if (options.verifyHealth)
+      assertHealthyDatabase(db);
     return;
   }
   const states = db.query("SELECT version FROM schema_state").all();
@@ -2222,7 +2225,8 @@ function assertLegacySchemaIdentity(db, version) {
       throw new Error("unrecognized_database");
     }
   }
-  assertHealthyDatabase(db);
+  if (options.verifyHealth)
+    assertHealthyDatabase(db);
   if (version === 10)
     assertV10SourceDatabase(db);
 }
@@ -3390,7 +3394,7 @@ function migrateV9ToV10(db) {
 }
 
 // src/version.ts
-var PRODUCT_VERSION = "0.5.0";
+var PRODUCT_VERSION = "0.5.2";
 
 // src/db.ts
 var DDL = `
@@ -3433,15 +3437,25 @@ CREATE INDEX IF NOT EXISTS note_edges_target_idx ON note_edges(project_id, targe
 CREATE TABLE IF NOT EXISTS schema_state (version INTEGER PRIMARY KEY);
 `;
 var PRE_OPEN_PROBE_TIMEOUT_MS = 5000;
-function openMemoryDatabase(path) {
+function timeMigrationStage(timing, stage, work) {
+  if (!timing)
+    return work();
+  const started = performance.now();
+  try {
+    return work();
+  } finally {
+    timing.phases.push({ stage, elapsedMs: Math.round((performance.now() - started) * 1000) / 1000 });
+  }
+}
+function openMemoryDatabase(path, options = {}) {
   ensureDatabaseParent(path);
-  assertSupportedDatabaseBeforeOpen(path);
+  assertSupportedDatabaseBeforeOpen(path, false);
   recoverStaleMaintenanceGate(path, () => assertSupportedDatabaseBeforeOpen(path));
   let lock = acquireMigrationLock(path, SCHEMA_VERSION);
   let lease = acquireDatabaseLease(path);
   let db;
   try {
-    assertSupportedDatabaseBeforeOpen(path);
+    assertSupportedDatabaseBeforeOpen(path, false);
     db = openDatabase(path);
   } catch (error) {
     lease.release();
@@ -3463,7 +3477,7 @@ function openMemoryDatabase(path) {
       lease.release();
       lease = undefined;
       lease = acquireDatabaseLease(path);
-      assertSupportedDatabaseBeforeOpen(path);
+      assertSupportedDatabaseBeforeOpen(path, false);
       db = openDatabase(path);
       dbOpen = true;
       if (hasApplicationObjects(db)) {
@@ -3513,7 +3527,7 @@ function openMemoryDatabase(path) {
       lease.release();
       lease = undefined;
       lease = acquireDatabaseLease(path);
-      assertSupportedDatabaseBeforeOpen(path);
+      assertSupportedDatabaseBeforeOpen(path, false);
       db = openDatabase(path);
       dbOpen = true;
       let migrationVersion = getSchemaVersion(db);
@@ -3541,7 +3555,7 @@ function openMemoryDatabase(path) {
       lease.release();
       lease = undefined;
       maintenance = acquireMaintenanceGate(path);
-      assertSupportedDatabaseBeforeOpen(path);
+      timeMigrationStage(options.timing, "source-validation", () => assertSupportedDatabaseBeforeOpen(path, false));
       db = openDatabase(path);
       dbOpen = true;
       migrationVersion = getSchemaVersion(db);
@@ -3571,12 +3585,12 @@ function openMemoryDatabase(path) {
         lease = undefined;
         return opened3;
       }
-      backup = createVerifiedBackup(db, path, migrationVersion?.version ?? 2, SCHEMA_VERSION, PRODUCT_VERSION);
+      backup = timeMigrationStage(options.timing, "backup-checkpoint", () => createVerifiedBackup(db, path, migrationVersion?.version ?? 2, SCHEMA_VERSION, PRODUCT_VERSION));
       db.exec("PRAGMA foreign_keys=OFF");
       if (!migrationVersion && hasLegacyV2(db)) {
         db.exec(DDL);
         db.exec("CREATE VIRTUAL TABLE IF NOT EXISTS notes_fts USING fts5(id UNINDEXED, title, summary, content, tokenize='unicode61')");
-        migrateFromV2(db, path);
+        timeMigrationStage(options.timing, "v2-import", () => migrateFromV2(db, path));
       } else if (!migrationVersion) {
         db.exec(DDL);
         db.exec("CREATE VIRTUAL TABLE IF NOT EXISTS notes_fts USING fts5(id UNINDEXED, title, summary, content, tokenize='unicode61')");
@@ -3592,24 +3606,25 @@ function openMemoryDatabase(path) {
       }
       let version = getSchemaVersion(db)?.version ?? 8;
       if (version < 9) {
-        db.transaction(() => migrateV8ToV9(db))();
+        timeMigrationStage(options.timing, "v8-to-v9", () => db.transaction(() => migrateV8ToV9(db))());
         version = 9;
       }
       if (version < 10) {
-        db.transaction(() => migrateV9ToV10(db))();
+        timeMigrationStage(options.timing, "v9-to-v10", () => db.transaction(() => migrateV9ToV10(db))());
         version = 10;
       }
       if (version < SCHEMA_VERSION) {
-        db.transaction(() => {
+        timeMigrationStage(options.timing, "v10-to-v11", () => db.transaction(() => {
           db.exec(`PRAGMA application_id = ${APPLICATION_ID}`);
           migrateV10ToV11(db);
-        })();
+        })());
       }
       db.exec("PRAGMA foreign_keys=ON");
       if (db.query("PRAGMA foreign_keys").get().foreign_keys !== 1) {
         throw new Error("failed to enable database foreign keys");
       }
-      assertHealthyDatabase(db);
+      timeMigrationStage(options.timing, "fingerprint", () => assertSchemaV11(db));
+      timeMigrationStage(options.timing, "deep-health", () => assertHealthyDatabase(db, { verifySchema: false }));
       console.warn(`[agz-memory] migrated to v${SCHEMA_VERSION} (backup: ${backup.manifestPath})`);
       backup = undefined;
       db.close();
@@ -3695,11 +3710,11 @@ function openDatabase(path) {
     throw error;
   }
 }
-function assertSupportedDatabaseBeforeOpen(path) {
+function assertSupportedDatabaseBeforeOpen(path, verifyHealth = true) {
   const deadline = Date.now() + PRE_OPEN_PROBE_TIMEOUT_MS;
   while (true) {
     try {
-      assertSupportedDatabaseBeforeOpenOnce(path);
+      assertSupportedDatabaseBeforeOpenOnce(path, verifyHealth);
       return;
     } catch (error) {
       if (!isSQLiteBusyError(error) || Date.now() >= deadline)
@@ -3708,19 +3723,19 @@ function assertSupportedDatabaseBeforeOpen(path) {
     }
   }
 }
-function assertSupportedDatabaseBeforeOpenOnce(path) {
+function assertSupportedDatabaseBeforeOpenOnce(path, verifyHealth) {
   assertDatabasePath(path);
   if (!existsSync4(path))
     return;
   const db = new Database3(path, { readonly: true });
   try {
     assertDatabasePath(path);
-    assertSupportedDatabase(db);
+    assertSupportedDatabase(db, verifyHealth);
   } finally {
     db.close();
   }
 }
-function assertSupportedDatabase(db) {
+function assertSupportedDatabase(db, verifyHealth = true) {
   const existingVersion = getSchemaVersion(db);
   if (existingVersion && existingVersion.version > SCHEMA_VERSION) {
     throw new Error(`database schema v${existingVersion.version} is newer than supported v${SCHEMA_VERSION}`);
@@ -3731,7 +3746,7 @@ function assertSupportedDatabase(db) {
   if (!existingVersion) {
     if (!hasLegacyV2(db))
       throw new Error("unrecognized_database");
-    assertLegacySchemaIdentity(db, 2);
+    assertLegacySchemaIdentity(db, 2, { verifyHealth });
     return;
   }
   if (existingVersion.version === SCHEMA_VERSION || hasV11Marker) {
@@ -3741,7 +3756,7 @@ function assertSupportedDatabase(db) {
   if (existingVersion.version < 2 || existingVersion.version > 10) {
     throw new Error("unrecognized_database");
   }
-  assertLegacySchemaIdentity(db, existingVersion.version);
+  assertLegacySchemaIdentity(db, existingVersion.version, { verifyHealth });
 }
 function assertDatabasePath(path) {
   try {
@@ -4054,7 +4069,7 @@ import { McpServer } from "@modelcontextprotocol/server";
 
 // src/context.ts
 var MEMORY_GUIDANCE = `Use project-scoped memory for durable facts across sessions.
-- Start with project_list. Reuse a project only when it intentionally represents the same durable workspace or product; create one only when no matching project exists. If the listed projects are ambiguous, ask rather than guessing from a directory or session name.
+- Start with project_list. Reuse a project only when it intentionally represents the same durable workspace or product; Git linked worktrees are separate checkouts of that same workspace, not new memory projects. Create one only when no matching project exists. If the listed projects are ambiguous, ask rather than guessing from a directory, worktree, branch, or session name.
 - Prefer the immutable projectID for stable references. projectName is a convenient unique lookup, but names can change.
 - Every memory_recall, memory_read, memory_update, memory_link, and memory_pin call must select exactly one project by projectID or projectName.
 - The MCP server does not inject notes automatically. Recall relevant history before relying on prior decisions, and use memory_read for full indexed content and graph neighbors.
@@ -4065,42 +4080,233 @@ var MEMORY_GUIDANCE = `Use project-scoped memory for durable facts across sessio
 - memory_update with delete:true permanently deletes one note. project_delete permanently deletes a project and all owned memory. Verify current IDs first and use destructive operations only when explicitly intended.`;
 
 // src/tools.ts
+import * as z3 from "zod/v4";
+
+// src/contracts/limits.ts
 import * as z2 from "zod/v4";
-var MAX_BATCH = 10;
+var LIMITS = {
+  title: 240,
+  summary: 4096,
+  content: 65536,
+  query: 4096,
+  noteID: 256,
+  batch: 10,
+  requestBytes: 1048576,
+  responseBytes: 1048576,
+  pageSize: 100
+};
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function assertTextLimit(field, value) {
+  const maximum = LIMITS[field];
+  if (utf8Bytes(value) > maximum)
+    throw new RangeError(`${field} exceeds ${maximum} UTF-8 bytes`);
+}
+function boundedText(field, description) {
+  return z2.string().superRefine((value, context) => {
+    if (utf8Bytes(value) > LIMITS[field]) {
+      context.addIssue({ code: "custom", message: `${field} exceeds ${LIMITS[field]} UTF-8 bytes` });
+    }
+  }).describe(description);
+}
+function assertRequestLimit(value) {
+  if (utf8Bytes(JSON.stringify(value)) > LIMITS.requestBytes) {
+    throw new RangeError(`request exceeds ${LIMITS.requestBytes} UTF-8 bytes`);
+  }
+}
+
+// src/contracts/error.ts
+class MemoryBusinessError extends Error {
+  code;
+  correlationID;
+  cause;
+  constructor(code, message, correlationID = newCorrelationID(), cause) {
+    super(message);
+    this.code = code;
+    this.correlationID = correlationID;
+    this.cause = cause;
+  }
+}
+function correlationID() {
+  return newCorrelationID();
+}
+function newCorrelationID() {
+  return crypto.randomUUID();
+}
+function businessError(code, message, id = correlationID(), cause) {
+  return new MemoryBusinessError(code, message, id, cause);
+}
+function toPublicError(error) {
+  return { code: error.code, correlationID: error.correlationID, retryable: error.code === "internal_error", message: error.message };
+}
+function asBusinessError(error, id = correlationID()) {
+  if (error instanceof MemoryBusinessError)
+    return error;
+  if (error instanceof RangeError)
+    return businessError("limit_exceeded", error.message, id, error);
+  if (error instanceof TypeError) {
+    if (error.message === "invalid_cursor")
+      return businessError("invalid_cursor", "cursor is invalid", id, error);
+    if (error.message === "cursor_scope_mismatch")
+      return businessError("cursor_scope_mismatch", "cursor does not match this request", id, error);
+    if (error.message === "stale_snapshot")
+      return businessError("stale_cursor", "cursor snapshot is stale", id, error);
+    return businessError("invalid_request", "request is invalid", id, error);
+  }
+  return businessError("internal_error", "memory operation failed", id, error);
+}
+
+// src/contracts/mutation.ts
+function normalizeLegacyMutation(input) {
+  const { id, delete: deleteFlag, confirmation, kind, title, summary, content } = input;
+  const hasEdits = kind !== undefined || title !== undefined || summary !== undefined || content !== undefined;
+  if (deleteFlag) {
+    if (!id)
+      throw new TypeError("id is required for delete");
+    if (hasEdits)
+      throw new TypeError("cannot combine delete with edits");
+    return { operation: "delete", id, confirmation };
+  }
+  if (id) {
+    if (!hasEdits)
+      throw new TypeError("patch requires changes");
+    return { operation: "patch", id, changes: { kind, title, summary, content } };
+  }
+  if (!kind || title === undefined || summary === undefined) {
+    throw new TypeError("create requires kind, title, and summary");
+  }
+  return { operation: "create", kind, title, summary, content };
+}
+function assertStrictMutationOperation(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError("invalid mutation");
+  const input = value;
+  if (input.operation !== "create" && input.operation !== "patch" && input.operation !== "delete") {
+    throw new TypeError("invalid mutation operation");
+  }
+  const operation = input.operation;
+  const allowed = {
+    create: ["operation", "kind", "title", "summary", "content"],
+    patch: ["operation", "id", "changes"],
+    delete: ["operation", "id", "confirmation"]
+  };
+  const invalid = Object.keys(input).some((key) => !allowed[operation].includes(key));
+  if (invalid)
+    throw new TypeError("invalid mutation keys");
+  if (input.operation === "create") {
+    if (!KINDS.includes(input.kind) || typeof input.title !== "string" || typeof input.summary !== "string") {
+      throw new TypeError("invalid create mutation");
+    }
+    if (input.content !== undefined && typeof input.content !== "string")
+      throw new TypeError("invalid create mutation");
+  }
+  if (input.operation === "patch") {
+    if (typeof input.id !== "string" || !input.id || !input.changes || typeof input.changes !== "object" || Array.isArray(input.changes)) {
+      throw new TypeError("patch requires changes");
+    }
+    const changes = input.changes;
+    if (Object.values(changes).every((value2) => value2 === undefined))
+      throw new TypeError("patch requires changes");
+    if (Object.keys(changes).some((key) => !["kind", "title", "summary", "content"].includes(key)))
+      throw new TypeError("invalid patch changes");
+    if (changes.kind !== undefined && !KINDS.includes(changes.kind))
+      throw new TypeError("invalid patch changes");
+    for (const key of ["title", "summary", "content"]) {
+      if (changes[key] !== undefined && typeof changes[key] !== "string")
+        throw new TypeError("invalid patch changes");
+    }
+  }
+  if (input.operation === "delete") {
+    if (typeof input.id !== "string" || !input.id)
+      throw new TypeError("id is required for delete");
+    if (input.confirmation !== undefined && typeof input.confirmation !== "string")
+      throw new TypeError("invalid delete confirmation");
+  }
+}
+
+// src/tools.ts
+var MAX_BATCH = LIMITS.batch;
+var pageLimit = z3.number().int().min(1).max(LIMITS.pageSize).optional();
+var cursor = z3.string().max(2048).optional();
+var snapshot = z3.string().max(1024).optional();
 var CLOSED_WORLD = { openWorldHint: false };
-var projectID = z2.uuid().describe("The immutable project UUID returned by project_create or project_list.");
-var projectNameValue = z2.string().min(1).max(MAX_PROJECT_NAME_LENGTH);
+var projectID = z3.uuid().describe("The immutable project UUID returned by project_create or project_list.");
+var projectNameValue = z3.string().min(1).max(MAX_PROJECT_NAME_LENGTH);
 var projectName = projectNameValue.describe("The project's unique current name used to select it. Prefer projectID for long-lived references.");
 var newProjectName = projectNameValue.describe("Unique name for the new durable workspace or product memory project.");
 var replacementProjectName = projectNameValue.describe("New unique name for the selected project. The projectID remains unchanged.");
-var noteID = z2.string().describe("A note ID returned by memory_update, memory_recall, or memory_read.");
-var kind = z2.enum(KINDS).describe("The durable information category for this note.");
-var title = z2.string().describe("Short, specific title for identifying the durable record.");
-var summary = z2.string().describe("Concise retrieval summary of the durable record.");
-var content = z2.string().describe("Full durable content. For a new note, the summary is used when content is omitted.");
-var query = z2.string().describe("Search terms for durable records in the selected project.");
-var createUpdateSchema = z2.object({
+var noteID = boundedText("noteID", "A note ID returned by memory_update, memory_recall, or memory_read.");
+var kind = z3.enum(KINDS).describe("The durable information category for this note.");
+var title = boundedText("title", "Short, specific title for identifying the durable record.");
+var summary = boundedText("summary", "Concise retrieval summary of the durable record.");
+var content = boundedText("content", "Full durable content. For a new note, the summary is used when content is omitted.");
+var query = boundedText("query", "Search terms for durable records in the selected project.");
+var createUpdateSchema = z3.object({
   kind,
   title,
   summary,
   content: content.optional()
 }).strict();
-var patchUpdateSchema = z2.object({
+var patchUpdateSchema = z3.object({
   id: noteID,
   kind: kind.optional(),
   title: title.optional(),
   summary: summary.optional(),
   content: content.optional(),
-  delete: z2.boolean().describe("Set true to permanently delete this note; false or omitted performs a patch.").optional()
-}).strict();
-var updateSchema = z2.union([createUpdateSchema, patchUpdateSchema]);
-var linkSchema = z2.object({
+  delete: z3.boolean().describe("Set true to permanently delete this note; false or omitted performs a patch.").optional()
+}).strict().superRefine((value, context) => {
+  const hasEdits = value.kind !== undefined || value.title !== undefined || value.summary !== undefined || value.content !== undefined;
+  if (value.delete && hasEdits)
+    context.addIssue({ code: "custom", message: "cannot combine delete with edits" });
+  if (!value.delete && !hasEdits)
+    context.addIssue({ code: "custom", message: "patch requires changes" });
+});
+var updateSchema = z3.union([createUpdateSchema, patchUpdateSchema]);
+var linkSchema = z3.object({
   sourceID: noteID.describe("Subject/source note of the directed relationship."),
   targetID: noteID.describe("Object/target note of the directed relationship."),
-  predicate: z2.enum(PREDICATES).describe("Read as sourceID PREDICATE targetID: A SUPPORTS B; A DERIVED_FROM B; A PART_OF B; A ABOUT B; A PRECEDES B; A SUPERSEDES B.")
+  predicate: z3.enum(PREDICATES).describe("Read as sourceID PREDICATE targetID: A SUPPORTS B; A DERIVED_FROM B; A PART_OF B; A ABOUT B; A PRECEDES B; A SUPERSEDES B.")
 }).strict();
 function textResult(value) {
-  return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] };
+  const text = JSON.stringify(value, null, 2);
+  if (Buffer.byteLength(text, "utf8") > LIMITS.responseBytes)
+    return errorResult(businessError("limit_exceeded", "response exceeds configured limit"));
+  return { content: [{ type: "text", text }] };
+}
+function errorResult(error, operation = "tool") {
+  const publicError = toPublicError(asBusinessError(error));
+  logPublicError(operation, publicError);
+  return { content: [{ type: "text", text: JSON.stringify({ error: publicError }, null, 2) }], isError: true };
+}
+function logPublicError(operation, publicError) {
+  console.error(JSON.stringify({ component: "mcp", operation, outcome: "error", error_code: publicError.code, correlation_id: publicError.correlationID }));
+}
+function batchFailure(error, operation) {
+  const publicError = toPublicError(asBusinessError(error));
+  logPublicError(operation, publicError);
+  return { ok: false, error: publicError };
+}
+async function guardTool(operation, work) {
+  try {
+    return await work();
+  } catch (error) {
+    return errorResult(error, operation);
+  }
+}
+function updateFailure(result) {
+  const reason = result.reason ?? "memory update failed";
+  if (reason.includes("not found"))
+    return businessError("not_found", "memory record not found");
+  if (reason.includes("conflict") || reason.includes("already exists"))
+    return businessError("conflict", "memory operation conflicted");
+  return businessError("invalid_request", "memory operation was rejected");
+}
+function singleResult(result, operation) {
+  if (result.ok !== false)
+    return textResult({ results: [result] });
+  const error = updateFailure(result);
+  return errorResult(error, operation);
 }
 function resolveProject(store, selector) {
   const resolved = store.resolveProject(selector);
@@ -4110,168 +4316,207 @@ function registerTools(server, store) {
   server.registerTool("project_list", {
     title: "List memory projects",
     description: "List all memory projects with their immutable IDs, current names, note counts, and pinned-note counts. Use this before selecting or creating a project; reuse one only when it represents the same durable workspace.",
-    inputSchema: z2.object({}).strict(),
+    inputSchema: z3.object({ limit: pageLimit, cursor, snapshot }).strict(),
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, ...CLOSED_WORLD }
-  }, async () => textResult({ projects: store.listProjects() }));
+  }, async (raw) => guardTool("project_list", async () => {
+    const page = store.listProjectsPage(raw.limit ?? LIMITS.pageSize, raw.cursor, raw.snapshot);
+    return textResult({ projects: page.items, snapshot: page.snapshot, etag: page.etag, nextCursor: page.nextCursor });
+  }));
   server.registerTool("project_create", {
     title: "Create a memory project",
-    description: "Create an empty memory project only after project_list confirms that no existing project represents the same durable workspace. The returned projectID is immutable; the unique project name may be changed later.",
-    inputSchema: z2.object({ projectName: newProjectName }).strict(),
+    description: "Create an empty memory project only after project_list confirms that no existing project represents the same durable workspace. Git linked worktrees share the existing workspace memory project. The returned projectID is immutable; the unique project name may be changed later.",
+    inputSchema: z3.object({ projectName: newProjectName }).strict(),
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, ...CLOSED_WORLD }
-  }, async ({ projectName: projectName2 }) => textResult({ results: [store.createProject(projectName2)] }));
+  }, async ({ projectName: projectName2 }) => guardTool("project_create", () => singleResult(store.createProject(projectName2), "project_create")));
   server.registerTool("project_update", {
     title: "Rename a memory project",
     description: "Rename one project by its immutable projectID. Renaming does not change the ID or detach any notes.",
-    inputSchema: z2.object({ projectID, projectName: replacementProjectName }).strict(),
+    inputSchema: z3.object({ projectID, projectName: replacementProjectName }).strict(),
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, ...CLOSED_WORLD }
-  }, async ({ projectID: projectID2, projectName: projectName2 }) => textResult({ results: [store.updateProject(projectID2, projectName2)] }));
+  }, async ({ projectID: projectID2, projectName: projectName2 }) => guardTool("project_update", () => singleResult(store.updateProject(projectID2, projectName2), "project_update")));
   server.registerTool("project_delete", {
     title: "Permanently delete a memory project",
     description: "DANGER: Permanently deletes the selected project and every note, pinned note, graph edge, and search record owned by it. This cannot be undone. First call project_list, verify the immutable projectID and current name, then provide both confirmation fields exactly.",
-    inputSchema: z2.object({
+    inputSchema: z3.object({
       projectID,
       confirmProjectName: projectNameValue.describe("Must exactly match the project's current case-sensitive name. This prevents deletion after an unnoticed rename or wrong-ID selection."),
-      confirmation: z2.literal("DELETE_PROJECT_AND_ALL_MEMORY").describe("Required destructive-action confirmation phrase.")
+      confirmation: z3.literal("DELETE_PROJECT_AND_ALL_MEMORY").describe("Required destructive-action confirmation phrase.")
     }).strict(),
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, ...CLOSED_WORLD }
-  }, async ({ projectID: projectID2, confirmProjectName }) => textResult({ results: [store.deleteProject(projectID2, confirmProjectName)] }));
+  }, async ({ projectID: projectID2, confirmProjectName }) => guardTool("project_delete", () => singleResult(store.deleteProject(projectID2, confirmProjectName), "project_delete")));
   server.registerTool("memory_recall", {
     title: "Search project memory",
     description: "Search memory only inside one project selected by immutable projectID or unique projectName. Pass one query or up to 10 queries. Indexed cards require memory_read for full content.",
-    inputSchema: z2.union([
-      z2.object({ projectID, query }).strict(),
-      z2.object({
+    inputSchema: z3.union([
+      z3.object({ projectID, query, limit: pageLimit, cursor, snapshot }).strict(),
+      z3.object({
         projectID,
-        queries: z2.array(query).min(1).max(MAX_BATCH).describe("One to 10 independent searches.")
+        queries: z3.array(query).min(1).max(MAX_BATCH).describe("One to 10 independent searches.")
       }).strict(),
-      z2.object({ projectName, query }).strict(),
-      z2.object({
+      z3.object({ projectName, query, limit: pageLimit, cursor, snapshot }).strict(),
+      z3.object({
         projectName,
-        queries: z2.array(query).min(1).max(MAX_BATCH).describe("One to 10 independent searches.")
+        queries: z3.array(query).min(1).max(MAX_BATCH).describe("One to 10 independent searches.")
       }).strict()
     ]),
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, ...CLOSED_WORLD }
-  }, async (raw) => {
+  }, async (raw) => guardTool("memory_recall", async () => {
+    assertRequestLimit(raw);
     const resolved = resolveProject(store, raw);
     if ("error" in resolved)
-      return textResult({ results: [resolved.error] });
+      return errorResult(businessError("not_found", "project not found"), "memory_recall");
     const queries = "query" in raw ? [raw.query] : raw.queries;
     return textResult({
       project: resolved.project,
       results: queries.map((query2) => ({
         query: query2,
-        cards: store.recall(resolved.project.projectID, query2)
+        ...(() => {
+          return store.recallPage(resolved.project.projectID, query2, raw.limit ?? LIMITS.pageSize, raw.cursor, raw.snapshot);
+        })()
       }))
     });
-  });
+  }));
   server.registerTool("memory_update", {
     title: "Create, patch, or delete project memory",
     description: "Create or patch notes only inside one selected project. Setting delete:true permanently deletes only the specified note from that project; verify the note ID before using delete. A batch contains up to 10 ordered, non-atomic updates: inspect every result because earlier items remain applied if a later item fails. Do not batch destructive deletes unless partial completion is acceptable. Pin state is changed only through memory_pin.",
-    inputSchema: z2.union([
+    inputSchema: z3.union([
       createUpdateSchema.extend({ projectID }),
       patchUpdateSchema.extend({ projectID }),
-      z2.object({
+      z3.object({
         projectID,
-        updates: z2.array(updateSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic create, patch, or delete operations.")
+        updates: z3.array(updateSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic create, patch, or delete operations.")
       }).strict(),
       createUpdateSchema.extend({ projectName }),
       patchUpdateSchema.extend({ projectName }),
-      z2.object({
+      z3.object({
         projectName,
-        updates: z2.array(updateSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic create, patch, or delete operations.")
+        updates: z3.array(updateSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic create, patch, or delete operations.")
       }).strict()
     ]),
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, ...CLOSED_WORLD }
-  }, async (raw) => {
+  }, async (raw) => guardTool("memory_update", async () => {
+    assertRequestLimit(raw);
     const resolved = resolveProject(store, raw);
     if ("error" in resolved)
-      return textResult({ results: [resolved.error] });
+      return errorResult(businessError("not_found", "project not found"), "memory_update");
     const updates = "updates" in raw ? raw.updates : [raw];
+    if (updates.length === 1 && !("updates" in raw)) {
+      try {
+        const result = store.update(resolved.project.projectID, normalizeLegacyMutation(updates[0]));
+        return result.ok ? textResult({ project: resolved.project, results: [result] }) : errorResult(updateFailure(result), "memory_update");
+      } catch (error) {
+        return errorResult(error, "memory_update");
+      }
+    }
+    const results = updates.map((update) => {
+      try {
+        const result = store.update(resolved.project.projectID, normalizeLegacyMutation(update));
+        return result.ok ? result : batchFailure(updateFailure(result), "memory_update");
+      } catch (error) {
+        return batchFailure(error, "memory_update");
+      }
+    });
     return textResult({
       project: resolved.project,
-      results: updates.map((update) => store.update(resolved.project.projectID, update))
+      ...results.some((result) => !result.ok) ? { status: "partial_failure" } : {},
+      results
     });
-  });
+  }));
   server.registerTool("memory_pin", {
     title: "Pin or unpin project memory",
     description: "Set the pinned state of one active note inside one selected project. pinned:true prioritizes matching recall results; pinned:false removes that priority. This tool never deletes note content.",
-    inputSchema: z2.union([
-      z2.object({
+    inputSchema: z3.union([
+      z3.object({
         projectID,
         id: noteID,
-        pinned: z2.boolean().describe("True to pin the note; false to unpin it.")
+        pinned: z3.boolean().describe("True to pin the note; false to unpin it.")
       }).strict(),
-      z2.object({
+      z3.object({
         projectName,
         id: noteID,
-        pinned: z2.boolean().describe("True to pin the note; false to unpin it.")
+        pinned: z3.boolean().describe("True to pin the note; false to unpin it.")
       }).strict()
     ]),
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, ...CLOSED_WORLD }
-  }, async (raw) => {
+  }, async (raw) => guardTool("memory_pin", async () => {
     const resolved = resolveProject(store, raw);
     if ("error" in resolved)
-      return textResult({ results: [resolved.error] });
-    return textResult({
-      project: resolved.project,
-      results: [store.pin(resolved.project.projectID, raw.id, raw.pinned)]
-    });
-  });
+      return errorResult(businessError("not_found", "project not found"), "memory_pin");
+    const result = store.pin(resolved.project.projectID, raw.id, raw.pinned);
+    return result.ok === false ? errorResult(updateFailure(result), "memory_pin") : textResult({ project: resolved.project, results: [result] });
+  }));
   server.registerTool("memory_link", {
     title: "Link project memories",
     description: `Create one directed graph edge or up to 10 ordered, non-atomic edge operations between active notes in the same selected project; inspect every result because earlier links remain applied if a later item fails. Read each edge as sourceID PREDICATE targetID. Cross-project links are rejected. Predicates: ${PREDICATES.join(", ")}.`,
-    inputSchema: z2.union([
+    inputSchema: z3.union([
       linkSchema.extend({ projectID }),
-      z2.object({
+      z3.object({
         projectID,
-        links: z2.array(linkSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic directed edges.")
+        links: z3.array(linkSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic directed edges.")
       }).strict(),
       linkSchema.extend({ projectName }),
-      z2.object({
+      z3.object({
         projectName,
-        links: z2.array(linkSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic directed edges.")
+        links: z3.array(linkSchema).min(1).max(MAX_BATCH).describe("One to 10 ordered, non-atomic directed edges.")
       }).strict()
     ]),
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, ...CLOSED_WORLD }
-  }, async (raw) => {
+  }, async (raw) => guardTool("memory_link", async () => {
     const resolved = resolveProject(store, raw);
     if ("error" in resolved)
-      return textResult({ results: [resolved.error] });
-    const links = "links" in raw ? raw.links : [raw];
-    return textResult({
-      project: resolved.project,
-      results: links.map((link) => store.link(resolved.project.projectID, link.sourceID, link.targetID, link.predicate))
+      return errorResult(businessError("not_found", "project not found"), "memory_link");
+    if (!("links" in raw)) {
+      try {
+        const result = store.link(resolved.project.projectID, raw.sourceID, raw.targetID, raw.predicate);
+        return result.ok ? textResult({ project: resolved.project, results: [result] }) : errorResult(updateFailure(result), "memory_link");
+      } catch (error) {
+        return errorResult(error, "memory_link");
+      }
+    }
+    const results = raw.links.map((link) => {
+      try {
+        const result = store.link(resolved.project.projectID, link.sourceID, link.targetID, link.predicate);
+        return result.ok ? result : batchFailure(updateFailure(result), "memory_link");
+      } catch (error) {
+        return batchFailure(error, "memory_link");
+      }
     });
-  });
+    return textResult({ project: resolved.project, ...results.some((result) => !result.ok) ? { status: "partial_failure" } : {}, results });
+  }));
   server.registerTool("memory_read", {
     title: "Read project memory",
     description: "Read one note or up to 10 notes from one selected project, including full content, pin state, project identity, and same-project graph edges.",
-    inputSchema: z2.union([
-      z2.object({ projectID, id: noteID }).strict(),
-      z2.object({
+    inputSchema: z3.union([
+      z3.object({ projectID, id: noteID, limit: pageLimit, cursor, snapshot }).strict(),
+      z3.object({
         projectID,
-        ids: z2.array(noteID).min(1).max(MAX_BATCH).describe("One to 10 note IDs to read.")
+        ids: z3.array(noteID).min(1).max(MAX_BATCH).describe("One to 10 note IDs to read.")
       }).strict(),
-      z2.object({ projectName, id: noteID }).strict(),
-      z2.object({
+      z3.object({ projectName, id: noteID, limit: pageLimit, cursor, snapshot }).strict(),
+      z3.object({
         projectName,
-        ids: z2.array(noteID).min(1).max(MAX_BATCH).describe("One to 10 note IDs to read.")
+        ids: z3.array(noteID).min(1).max(MAX_BATCH).describe("One to 10 note IDs to read.")
       }).strict()
     ]),
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, ...CLOSED_WORLD }
-  }, async (raw) => {
+  }, async (raw) => guardTool("memory_read", async () => {
     const resolved = resolveProject(store, raw);
     if ("error" in resolved)
-      return textResult({ results: [resolved.error] });
+      return errorResult(businessError("not_found", "project not found"), "memory_read");
     const ids = "id" in raw ? [raw.id] : raw.ids;
+    const results = ids.map((id) => ({
+      id,
+      result: "id" in raw && (raw.limit !== undefined || raw.cursor !== undefined || raw.snapshot !== undefined) ? store.readPage(resolved.project.projectID, id, raw.limit ?? LIMITS.pageSize, raw.cursor, raw.snapshot) : store.read(resolved.project.projectID, id)
+    }));
+    const firstResult = results[0]?.result;
+    if (!("ids" in raw) && (!firstResult || !("note" in firstResult) || !firstResult.note)) {
+      return errorResult(businessError("not_found", "memory record not found"), "memory_read");
+    }
     return textResult({
       project: resolved.project,
-      results: ids.map((id) => ({
-        id,
-        result: store.read(resolved.project.projectID, id)
-      }))
+      results
     });
-  });
+  }));
 }
 
 // src/server.ts
@@ -4285,6 +4530,62 @@ function createMemoryServer(store) {
 
 // src/store.ts
 import { randomUUID as randomUUID7 } from "crypto";
+
+// src/contracts/pagination.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+var CURSOR_VERSION = 1;
+var CURSOR_KEY = randomBytes(32);
+var MAX_CURSOR_BYTES = 2048;
+function encodeCursor(payload) {
+  const body = Buffer.from(JSON.stringify({ v: CURSOR_VERSION, ...payload }));
+  const signature = createHmac("sha256", CURSOR_KEY).update(body).digest();
+  return Buffer.concat([body, signature]).toString("base64url");
+}
+function decodeCursor(cursor2, scope) {
+  let payload;
+  try {
+    if (Buffer.byteLength(cursor2, "utf8") > MAX_CURSOR_BYTES)
+      throw new Error;
+    const encoded = Buffer.from(cursor2, "base64url");
+    if (encoded.length <= 32)
+      throw new Error;
+    const body = encoded.subarray(0, -32);
+    const signature = encoded.subarray(-32);
+    const expected = createHmac("sha256", CURSOR_KEY).update(body).digest();
+    if (!timingSafeEqual(signature, expected))
+      throw new Error;
+    payload = JSON.parse(body.toString("utf8"));
+  } catch {
+    throw new TypeError("invalid_cursor");
+  }
+  if (payload.v !== CURSOR_VERSION || !Number.isSafeInteger(payload.offset) || payload.offset < 0)
+    throw new TypeError("invalid_cursor");
+  if (payload.projectID !== scope.projectID || payload.query !== scope.query) {
+    throw new TypeError("cursor_scope_mismatch");
+  }
+  if (payload.snapshot !== scope.snapshot)
+    throw new TypeError("stale_snapshot");
+  return { offset: payload.offset };
+}
+function paginate(items, options) {
+  if (!Number.isSafeInteger(options.limit) || options.limit < 1)
+    throw new RangeError("page limit must be positive");
+  if (options.requestedSnapshot !== undefined && options.requestedSnapshot !== options.snapshot) {
+    throw new TypeError("stale_snapshot");
+  }
+  const offset = options.cursor !== undefined ? decodeCursor(options.cursor, options).offset : 0;
+  const limit = Math.min(options.limit, LIMITS.pageSize);
+  const page = items.slice(offset, offset + limit);
+  const nextOffset = offset + page.length;
+  return {
+    items: page,
+    snapshot: options.snapshot,
+    etag: options.snapshot,
+    ...nextOffset < items.length ? { nextCursor: encodeCursor({ projectID: options.projectID, query: options.query, snapshot: options.snapshot, offset: nextOffset }) } : {}
+  };
+}
+
+// src/store.ts
 class MemoryStore {
   db;
   indexBackends;
@@ -4314,6 +4615,18 @@ class MemoryStore {
       pinnedCount: row.pinned_count
     }));
   }
+  listProjectsPage(limit, cursor2, snapshot2) {
+    const projects = this.listProjects();
+    const current = hashTuple("project-list-snapshot", 1, projects.flatMap((project) => [
+      project.projectID,
+      project.projectName,
+      project.createdAt,
+      project.updatedAt,
+      project.noteCount,
+      project.pinnedCount
+    ]));
+    return paginate(projects, { projectID: "__projects__", query: "", limit, cursor: cursor2, snapshot: current, requestedSnapshot: snapshot2 });
+  }
   createProject(nameValue) {
     const reason = validateProjectName(nameValue);
     if (reason)
@@ -4358,7 +4671,12 @@ class MemoryStore {
     }
     const now = Date.now();
     try {
-      const updated = this.immediateTransaction(() => this.db.query("UPDATE projects SET name = ?, normalized_name = ?, updated_at = ? WHERE id = ? RETURNING *").get(name, normalizedName, now, projectID2));
+      const updated = this.immediateTransaction(() => this.db.query(`UPDATE projects
+                  SET name = ?,
+                      normalized_name = ?,
+                      updated_at = CASE WHEN updated_at >= ? THEN updated_at + 1 ELSE ? END
+                WHERE id = ?
+                RETURNING *`).get(name, normalizedName, now, now, projectID2));
       if (!updated)
         return { ok: false, reason: `project ${projectID2} not found` };
       return { ok: true, project: rowToProject(updated) };
@@ -4416,14 +4734,14 @@ class MemoryStore {
       };
     });
   }
-  update(projectID2, input) {
+  update(projectID2, operation) {
     const project = this.getProjectRow(projectID2);
     if (!project)
       return { ok: false, reason: `project ${projectID2} not found` };
-    if (input.delete) {
-      if (!input.id)
-        return { ok: false, reason: "id is required for delete" };
-      const id2 = input.id;
+    assertStrictMutationOperation(operation);
+    if (operation.operation === "delete") {
+      const id2 = operation.id;
+      assertTextLimit("noteID", id2);
       const existing2 = this.getNoteRow(projectID2, id2);
       if (!existing2)
         return {
@@ -4440,6 +4758,7 @@ class MemoryStore {
           };
         }
         const now2 = Date.now();
+        this.bumpProjectVersion(projectID2, now2);
         for (const backend of this.indexBackends) {
           this.enqueueOutbox(backend, "delete-note", deleted.project_id, deleted.id, deleted.current_revision, null, now2);
         }
@@ -4452,31 +4771,35 @@ class MemoryStore {
         };
       });
     }
-    const existing = input.id ? this.getNoteRow(projectID2, input.id) : undefined;
-    if (input.id && !existing) {
+    if (operation.operation === "patch")
+      assertTextLimit("noteID", operation.id);
+    const existing = operation.operation === "patch" ? this.getNoteRow(projectID2, operation.id) : undefined;
+    if (operation.operation === "patch" && !existing) {
       return {
         ok: false,
-        reason: `note ${input.id} not found in project ${project.name}`
+        reason: `note ${operation.id} not found in project ${project.name}`
       };
     }
     if (existing && existing.status !== "active") {
       return { ok: false, reason: `note is ${existing.status}` };
     }
-    const kindValue = input.kind ?? existing?.kind;
+    const changes = operation.operation === "patch" ? operation.changes : undefined;
+    const kindValue = operation.operation === "create" ? operation.kind : changes?.kind ?? existing?.kind;
     const kind2 = KINDS.includes(kindValue ?? "") ? kindValue : null;
     if (!kind2)
       return { ok: false, reason: `kind must be one of: ${KINDS.join(", ")}` };
-    const title2 = input.title === undefined ? existing?.title ?? "" : input.title.trim();
-    const summary2 = input.summary === undefined ? existing?.summary ?? "" : input.summary.trim();
-    const content2 = input.content === undefined ? existing?.content ?? summary2 : input.content.trim();
+    const title2 = operation.operation === "create" ? operation.title.trim() : changes?.title === undefined ? existing?.title ?? "" : changes.title.trim();
+    const summary2 = operation.operation === "create" ? operation.summary.trim() : changes?.summary === undefined ? existing?.summary ?? "" : changes.summary.trim();
+    const content2 = operation.operation === "create" ? (operation.content ?? summary2).trim() : changes?.content === undefined ? existing?.content ?? summary2 : changes.content.trim();
     if (!title2)
       return { ok: false, reason: "title is required" };
-    if (title2.length > 240)
-      return { ok: false, reason: "title exceeds 240 characters" };
     if (!summary2)
       return { ok: false, reason: "summary is required" };
     if (!content2)
       return { ok: false, reason: "content is empty" };
+    assertTextLimit("title", title2);
+    assertTextLimit("summary", summary2);
+    assertTextLimit("content", content2);
     const now = Date.now();
     const sizeClass = content2.length <= INLINE_LIMIT ? "inline" : "indexed";
     const contentHash = noteContentHash(kind2, title2, summary2, content2);
@@ -4511,6 +4834,7 @@ class MemoryStore {
               RETURNING *`).get(kind2, title2, summary2, content2, sizeClass, subjectKey, contentHash, now, projectID2, existing.id, existing.current_revision);
         if (!updated)
           return;
+        this.bumpProjectVersion(projectID2, now);
         this.recordCurrentRevision(updated, "mcp-manual", now);
         const derived = deriveDocument({
           projectID: updated.project_id,
@@ -4556,6 +4880,7 @@ class MemoryStore {
     };
   }
   pin(projectID2, id, pinned) {
+    assertTextLimit("noteID", id);
     const project = this.getProjectRow(projectID2);
     if (!project)
       return { ok: false, reason: `project ${projectID2} not found` };
@@ -4590,6 +4915,7 @@ class MemoryStore {
             RETURNING *`).get(pinned ? 1 : 0, now, projectID2, id, note.current_revision);
       if (!updated)
         return;
+      this.bumpProjectVersion(projectID2, now);
       this.recordCurrentRevision(updated, "mcp-manual", now);
       const derived = deriveDocument({
         projectID: updated.project_id,
@@ -4634,6 +4960,7 @@ class MemoryStore {
            RETURNING *`).get(id, projectID2, kind2, title2, summary2, content2, sizeClass, supersedesID, subjectKey, contentHash, now, now);
       if (!note)
         throw new Error(`note ${id} insert returned no row`);
+      this.bumpProjectVersion(projectID2, now);
       this.recordCurrentRevision(note, "mcp-manual", now);
       const derived = deriveDocument({
         projectID: note.project_id,
@@ -4653,19 +4980,43 @@ class MemoryStore {
     });
   }
   read(projectID2, id) {
+    const page = this.readPage(projectID2, id, LIMITS.pageSize);
+    if (!("note" in page))
+      return page;
+    return {
+      note: page.note,
+      edges: page.items,
+      snapshot: page.snapshot,
+      etag: page.etag,
+      nextCursor: page.nextCursor
+    };
+  }
+  readPage(projectID2, id, limit, cursor2, snapshot2) {
+    assertTextLimit("noteID", id);
     const row = this.getNoteRow(projectID2, id);
     if (!row)
       return { reason: `note ${id} not found in project ${projectID2}` };
     const edges = this.db.query(`SELECT e.id, e.project_id, p.name AS project_name, e.source_id, e.target_id, e.predicate, e.created_at
-           FROM note_edges e
-           JOIN projects p ON p.id = e.project_id
-          WHERE e.project_id = ? AND (e.source_id = ? OR e.target_id = ?)`).all(projectID2, id, id);
+            FROM note_edges e
+            JOIN projects p ON p.id = e.project_id
+           WHERE e.project_id = ? AND (e.source_id = ? OR e.target_id = ?)
+           ORDER BY e.created_at, e.id`).all(projectID2, id, id);
+    const resultEdges = edges.map(rowToEdge);
+    const current = hashTuple("note-edge-snapshot", 1, [id, row.updated_at, ...resultEdges.flatMap((edge) => [edge.id, edge.projectID, edge.projectName, edge.sourceID, edge.targetID, edge.predicate, edge.createdAt])]);
     return {
       note: rowToNote(row),
-      edges: edges.map(rowToEdge)
+      ...paginate(resultEdges, { projectID: projectID2, query: `edges:${id}`, limit, cursor: cursor2, snapshot: current, requestedSnapshot: snapshot2 })
     };
   }
+  listRevisionsPage(projectID2, noteID2, limit, cursor2, snapshot2) {
+    assertTextLimit("noteID", noteID2);
+    const rows = this.db.query("SELECT revision, created_at FROM note_revisions WHERE project_id = ? AND note_id = ? ORDER BY revision").all(projectID2, noteID2);
+    const current = hashTuple("note-revision-snapshot", 1, [noteID2, ...rows.flatMap((row) => [row.revision, row.created_at])]);
+    return paginate(rows, { projectID: projectID2, query: `revisions:${noteID2}`, limit, cursor: cursor2, snapshot: current, requestedSnapshot: snapshot2 });
+  }
   link(projectID2, sourceID, targetID, predicate) {
+    assertTextLimit("noteID", sourceID);
+    assertTextLimit("noteID", targetID);
     const project = this.getProjectRow(projectID2);
     if (!project)
       return { ok: false, reason: `project ${projectID2} not found` };
@@ -4687,24 +5038,64 @@ class MemoryStore {
       if (row.status !== "active")
         return { ok: false, reason: `note ${id} is ${row.status}` };
     }
-    this.db.query("INSERT OR IGNORE INTO note_edges (id, project_id, source_id, target_id, predicate, created_at) VALUES (?, ?, ?, ?, ?, ?)").run(randomUUID7(), projectID2, sourceID, targetID, predicate, Date.now());
+    this.immediateTransaction(() => {
+      const now = Date.now();
+      const inserted = this.db.query("INSERT OR IGNORE INTO note_edges (id, project_id, source_id, target_id, predicate, created_at) VALUES (?, ?, ?, ?, ?, ?)").run(randomUUID7(), projectID2, sourceID, targetID, predicate, now);
+      if (inserted.changes > 0)
+        this.bumpProjectVersion(projectID2, now);
+    });
     return { ok: true, projectID: projectID2, projectName: project.name };
   }
   recall(projectID2, query2, limit = 10) {
+    return this.recallPage(projectID2, query2, limit).cards;
+  }
+  recallPage(projectID2, query2, limit = LIMITS.pageSize, cursor2, snapshot2) {
+    assertTextLimit("query", query2);
+    if (!Number.isSafeInteger(limit) || limit < 1) {
+      return { cards: [], snapshot: hashTuple("recall-snapshot", 1, [projectID2, query2]), etag: hashTuple("recall-snapshot", 1, [projectID2, query2]) };
+    }
+    const pageLimit2 = Math.min(limit, LIMITS.pageSize);
     const tokens = query2.split(/\s+/).map((token) => token.trim()).filter(Boolean).slice(0, 12).map((token) => `"${token.replace(/"/g, '""')}"`);
-    if (tokens.length === 0)
-      return [];
-    const matches = this.db.query(`SELECT n.*, p.name AS project_name, bm25(notes_fts) AS rank
+    if (tokens.length === 0) {
+      const current2 = hashTuple("recall-snapshot", 1, [projectID2, query2]);
+      return { cards: [], snapshot: current2, etag: current2 };
+    }
+    const project = this.getProjectRow(projectID2);
+    const current = hashTuple("recall-snapshot", 2, [
+      projectID2,
+      query2,
+      project?.name ?? "",
+      project?.updated_at ?? 0
+    ]);
+    if (snapshot2 !== undefined && snapshot2 !== current)
+      throw new TypeError("stale_snapshot");
+    const offset = cursor2 !== undefined ? decodeCursor(cursor2, { projectID: projectID2, query: query2, snapshot: current }).offset : 0;
+    const directCount = this.db.query(`SELECT COUNT(*) AS count
+         FROM notes_fts
+         JOIN notes n ON n.rowid = notes_fts.rowid
+        WHERE notes_fts MATCH ? AND n.project_id = ? AND n.status = 'active'`).get(tokens.join(" OR "), projectID2).count;
+    const matches = offset < directCount ? this.db.query(`SELECT n.*, p.name AS project_name, bm25(notes_fts) AS rank
            FROM notes_fts
            JOIN notes n ON n.rowid = notes_fts.rowid
            JOIN projects p ON p.id = n.project_id
           WHERE notes_fts MATCH ? AND n.project_id = ? AND n.status = 'active'
-          ORDER BY n.pinned DESC, rank
-          LIMIT ?`).all(tokens.join(" OR "), projectID2, limit);
+           ORDER BY n.pinned DESC, rank, n.id
+            LIMIT ? OFFSET ?`).all(tokens.join(" OR "), projectID2, pageLimit2, offset) : [];
     const cards = matches.map((row) => toCard(rowToNote(row), "match"));
-    const seen = new Set(cards.map((card) => card.id));
-    for (const match of matches.slice(0, 5)) {
-      const neighbors = this.db.query(`SELECT e.predicate, n.*, p.name AS project_name
+    const directRemaining = Math.max(0, directCount - offset);
+    const neighborOffset = Math.max(0, offset - directCount);
+    if (cards.length < pageLimit2 && directRemaining <= cards.length) {
+      const firstMatches = this.db.query(`SELECT n.*, p.name AS project_name, bm25(notes_fts) AS rank
+           FROM notes_fts
+           JOIN notes n ON n.rowid = notes_fts.rowid
+           JOIN projects p ON p.id = n.project_id
+          WHERE notes_fts MATCH ? AND n.project_id = ? AND n.status = 'active'
+          ORDER BY n.pinned DESC, rank, n.id
+          LIMIT 5`).all(tokens.join(" OR "), projectID2);
+      const neighborsToAppend = [];
+      const seen = new Set;
+      for (const match of firstMatches) {
+        const neighbors = this.db.query(`SELECT e.predicate, n.*, p.name AS project_name
              FROM note_edges e
              JOIN notes n ON n.id = CASE WHEN e.source_id = ? THEN e.target_id ELSE e.source_id END
              JOIN projects p ON p.id = n.project_id
@@ -4712,22 +5103,49 @@ class MemoryStore {
               AND (e.source_id = ? OR e.target_id = ?)
               AND n.project_id = ?
               AND n.status = 'active'
-            ORDER BY n.pinned DESC
+             ORDER BY n.pinned DESC, n.updated_at DESC, n.id
             LIMIT 6`).all(match.id, projectID2, match.id, match.id, projectID2);
-      for (const neighbor of neighbors) {
-        if (seen.has(neighbor.id))
-          continue;
-        seen.add(neighbor.id);
-        const card = toCard(rowToNote(neighbor), "neighbor");
-        card.predicates = [neighbor.predicate];
-        cards.push(card);
+        for (const neighbor of neighbors) {
+          if (seen.has(neighbor.id))
+            continue;
+          const isDirectMatch = this.db.query(`SELECT 1
+             FROM notes_fts
+             JOIN notes n ON n.rowid = notes_fts.rowid
+            WHERE notes_fts MATCH ? AND n.project_id = ? AND n.id = ? AND n.status = 'active'`).get(tokens.join(" OR "), projectID2, neighbor.id);
+          if (isDirectMatch)
+            continue;
+          seen.add(neighbor.id);
+          const card = toCard(rowToNote(neighbor), "neighbor");
+          card.predicates = [neighbor.predicate];
+          neighborsToAppend.push(card);
+        }
       }
+      cards.push(...neighborsToAppend.slice(neighborOffset, neighborOffset + (pageLimit2 - cards.length)));
+      const consumedNeighbors = neighborOffset + Math.max(0, cards.length - matches.length);
+      const hasMore2 = offset + matches.length < directCount || consumedNeighbors < neighborsToAppend.length;
+      return {
+        cards,
+        snapshot: current,
+        etag: current,
+        ...hasMore2 ? { nextCursor: encodeCursor({ projectID: projectID2, query: query2, snapshot: current, offset: offset + cards.length }) } : {}
+      };
     }
-    return cards.slice(0, limit + 5);
+    const hasMore = offset + cards.length < directCount;
+    return {
+      cards,
+      snapshot: current,
+      etag: current,
+      ...hasMore ? { nextCursor: encodeCursor({ projectID: projectID2, query: query2, snapshot: current, offset: offset + cards.length }) } : {}
+    };
   }
   getProjectRow(id) {
     return this.db.query("SELECT * FROM projects WHERE id = ?").get(id);
   }
+  bumpProjectVersion(projectID2, now) {
+    this.db.query(`UPDATE projects
+          SET updated_at = CASE WHEN updated_at >= ? THEN updated_at + 1 ELSE ? END
+        WHERE id = ?`).run(now, now, projectID2);
+  }
   getProjectByNormalizedName(normalizedName) {
     return this.db.query("SELECT * FROM projects WHERE normalized_name = ?").get(normalizedName);
   }
@@ -4872,13 +5290,332 @@ function takeHead(value, maxCharacters) {
   return value.slice(0, offset);
 }
 
+// src/security/quarantine-key.ts
+import { createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  existsSync as existsSync5,
+  fchmodSync,
+  fstatSync as fstatSync2,
+  fsyncSync as fsyncSync3,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync4,
+  openSync as openSync3,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync3,
+  writeSync as writeSync2
+} from "fs";
+import { dirname as dirname3 } from "path";
+var KEYRING_FORMAT = "agz-memory.quarantine-keyring/1";
+var KEY_BYTES = 32;
+var KEY_ID_BYTES = 12;
+var MAX_KEYRING_BYTES = 64 * 1024;
+var KEY_MODE = 384;
+var LOCK_TIMEOUT_MS = 1000;
+var RETRIES = 20;
+
+class QuarantineKeyring {
+  path;
+  constructor(path) {
+    this.path = path;
+  }
+  readActiveKey() {
+    return this.keyReference(this.readDocument());
+  }
+  ensureActiveKey() {
+    let lastError;
+    for (let attempt = 0;attempt < RETRIES; attempt++) {
+      try {
+        return this.readActiveKey();
+      } catch (error) {
+        lastError = error;
+        if (!isKeyringError(error, "quarantine_keyring_missing")) {
+          if (attempt + 1 < RETRIES) {
+            pause();
+            continue;
+          }
+          throw error;
+        }
+      }
+      try {
+        this.createInitialKeyring();
+      } catch (error) {
+        lastError = error;
+        if (!isKeyringError(error, "quarantine_keyring_exists"))
+          throw error;
+      }
+      pause();
+    }
+    throw lastError instanceof Error ? lastError : new Error("quarantine_keyring_unavailable");
+  }
+  rotate() {
+    this.assertSupportedPlatform();
+    const lockPath = `${this.path}.lock`;
+    const lock = this.acquireLock(lockPath);
+    try {
+      const document = this.readDocument();
+      const keyID = randomBytes2(KEY_ID_BYTES).toString("hex");
+      document.keys[keyID] = randomBytes2(KEY_BYTES).toString("base64");
+      document.activeKeyID = keyID;
+      this.writeAtomically(document);
+      return { keyID };
+    } finally {
+      closeSync3(lock);
+      rmSync3(lockPath, { force: true });
+    }
+  }
+  digestSource(source, payloadFingerprint) {
+    const active = this.activeKey(true);
+    return digestSourceWithKey(source, payloadFingerprint, active);
+  }
+  digestExistingSource(source, payloadFingerprint) {
+    const active = this.activeKey(false);
+    return digestSourceWithKey(source, payloadFingerprint, active);
+  }
+  verifySourceDigest(source, payloadFingerprint, keyID, digest) {
+    if (!isPayloadFingerprint(payloadFingerprint) || !/^[0-9a-f]{24}$/.test(keyID) || !/^[0-9a-f]{64}$/.test(digest)) {
+      return false;
+    }
+    const document = this.readDocument();
+    const encoded = document.keys[keyID];
+    if (!encoded)
+      return false;
+    const expected = createHmac2("sha256", Buffer.from(encoded, "base64")).update(sourceDigestBytes(source, payloadFingerprint)).digest();
+    return timingSafeEqual2(expected, Buffer.from(digest, "hex"));
+  }
+  activeKey(createIfMissing) {
+    if (createIfMissing)
+      this.ensureActiveKey();
+    const document = this.readDocument();
+    const keyID = document.activeKeyID;
+    const encoded = document.keys[keyID];
+    if (!encoded)
+      throw new Error("quarantine_keyring_invalid");
+    return { keyID, key: Buffer.from(encoded, "base64") };
+  }
+  keyReference(document) {
+    if (!document.keys[document.activeKeyID])
+      throw new Error("quarantine_keyring_invalid");
+    return { keyID: document.activeKeyID };
+  }
+  createInitialKeyring() {
+    this.assertSupportedPlatform();
+    this.assertSafeParent();
+    const keyID = randomBytes2(KEY_ID_BYTES).toString("hex");
+    const document = {
+      format: KEYRING_FORMAT,
+      activeKeyID: keyID,
+      keys: { [keyID]: randomBytes2(KEY_BYTES).toString("base64") }
+    };
+    let fd;
+    try {
+      fd = openSync3(this.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, KEY_MODE);
+      fchmodSync(fd, KEY_MODE);
+      writeSync2(fd, JSON.stringify(document));
+      fsyncSync3(fd);
+    } catch (error) {
+      if (error.code === "EEXIST") {
+        throw new Error("quarantine_keyring_exists");
+      }
+      throw error;
+    } finally {
+      if (fd !== undefined)
+        closeSync3(fd);
+    }
+  }
+  readDocument() {
+    this.assertSupportedPlatform();
+    let before;
+    try {
+      before = lstatSync4(this.path);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw new Error("quarantine_keyring_missing");
+      }
+      throw new Error("quarantine_keyring_unavailable");
+    }
+    if (before.isSymbolicLink())
+      throw new Error("quarantine_keyring_symlink");
+    if (!before.isFile())
+      throw new Error("quarantine_keyring_not_regular");
+    this.assertPermissions(before.mode);
+    if (before.size <= 0 || before.size > MAX_KEYRING_BYTES) {
+      throw new Error("quarantine_keyring_invalid");
+    }
+    let fd;
+    try {
+      fd = openSync3(this.path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+      const opened = fstatSync2(fd);
+      if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size <= 0 || opened.size > MAX_KEYRING_BYTES) {
+        throw new Error("quarantine_keyring_toctou");
+      }
+      this.assertPermissions(opened.mode);
+      const bytes = readFileSync4(fd);
+      const after = fstatSync2(fd);
+      if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size) {
+        throw new Error("quarantine_keyring_toctou");
+      }
+      return parseKeyring(bytes);
+    } catch (error) {
+      if (error.code === "ELOOP") {
+        throw new Error("quarantine_keyring_symlink");
+      }
+      throw error;
+    } finally {
+      if (fd !== undefined)
+        closeSync3(fd);
+    }
+  }
+  writeAtomically(document) {
+    this.assertSafeParent();
+    const temporary = `${this.path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
+    let fd;
+    try {
+      fd = openSync3(temporary, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, KEY_MODE);
+      fchmodSync(fd, KEY_MODE);
+      writeSync2(fd, JSON.stringify(document));
+      fsyncSync3(fd);
+      closeSync3(fd);
+      fd = undefined;
+      renameSync4(temporary, this.path);
+      this.syncParent();
+    } finally {
+      if (fd !== undefined)
+        closeSync3(fd);
+      rmSync3(temporary, { force: true });
+    }
+  }
+  acquireLock(lockPath) {
+    this.assertSafeParent();
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      try {
+        const fd = openSync3(lockPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, KEY_MODE);
+        fchmodSync(fd, KEY_MODE);
+        return fd;
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+        pause();
+      }
+    }
+    throw new Error("quarantine_keyring_busy");
+  }
+  assertSafeParent() {
+    const parent = dirname3(this.path);
+    if (!existsSync5(parent))
+      mkdirSync4(parent, { recursive: true, mode: 448 });
+    const stat = lstatSync4(parent);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new Error("quarantine_keyring_parent_unsafe");
+    }
+  }
+  assertSupportedPlatform() {
+    if (process.platform === "win32") {
+      throw new Error("quarantine_keyring_platform_unsupported");
+    }
+  }
+  assertPermissions(mode) {
+    if ((mode & 511) !== KEY_MODE)
+      throw new Error("quarantine_keyring_permissions");
+  }
+  syncParent() {
+    let fd;
+    try {
+      fd = openSync3(dirname3(this.path), constants3.O_RDONLY);
+      fsyncSync3(fd);
+    } catch {} finally {
+      if (fd !== undefined)
+        closeSync3(fd);
+    }
+  }
+}
+function digestSourceWithKey(source, payloadFingerprint, active) {
+  if (!isPayloadFingerprint(payloadFingerprint)) {
+    throw new Error("quarantine_payload_fingerprint_invalid");
+  }
+  return {
+    keyID: active.keyID,
+    digest: createHmac2("sha256", active.key).update(sourceDigestBytes(source, payloadFingerprint)).digest("hex")
+  };
+}
+function parseKeyring(bytes) {
+  let value;
+  try {
+    value = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new Error("quarantine_keyring_invalid");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("quarantine_keyring_invalid");
+  }
+  const record = value;
+  if (record.format !== KEYRING_FORMAT || typeof record.activeKeyID !== "string" || !record.keys || typeof record.keys !== "object" || Array.isArray(record.keys) || Object.keys(record).length !== 3) {
+    throw new Error("quarantine_keyring_invalid");
+  }
+  const keys = record.keys;
+  if (!/^[0-9a-f]{24}$/.test(record.activeKeyID)) {
+    throw new Error("quarantine_keyring_invalid");
+  }
+  for (const [keyID, encoded] of Object.entries(keys)) {
+    if (!/^[0-9a-f]{24}$/.test(keyID) || typeof encoded !== "string" || !isCanonicalKey(encoded)) {
+      throw new Error("quarantine_keyring_invalid");
+    }
+  }
+  if (typeof keys[record.activeKeyID] !== "string") {
+    throw new Error("quarantine_keyring_invalid");
+  }
+  return {
+    format: KEYRING_FORMAT,
+    activeKeyID: record.activeKeyID,
+    keys
+  };
+}
+function isCanonicalKey(value) {
+  const key = Buffer.from(value, "base64");
+  return key.length === KEY_BYTES && key.toString("base64") === value;
+}
+function sourceDigestBytes(source, payloadFingerprint) {
+  return Buffer.from(JSON.stringify([
+    "quarantine-source-payload/2",
+    source.schema,
+    source.projectID,
+    source.bindingKey,
+    source.kind,
+    source.source.system,
+    source.source.opencodeVersion,
+    source.source.pluginVersion,
+    source.source.sessionID,
+    source.source.messageID ?? null,
+    source.source.ordinal ?? null,
+    source.source.toolCallID ?? null,
+    payloadFingerprint
+  ]), "utf8");
+}
+function isPayloadFingerprint(value) {
+  return /^[0-9a-f]{64}$/.test(value);
+}
+function isKeyringError(error, code) {
+  return error instanceof Error && error.message === code;
+}
+function pause() {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+}
+
 // src/store/capture.ts
 class CaptureStore {
   db;
   indexBackends;
-  constructor(db, indexBackends = []) {
+  quarantineKeyring;
+  constructor(db, indexBackends = [], options = {}) {
     this.db = db;
     this.indexBackends = indexBackends;
+    this.quarantineKeyring = options.quarantineKeyring ?? new QuarantineKeyring(resolveConfig().quarantineKeyringPath);
+    try {
+      this.quarantineKeyring.ensureActiveKey();
+    } catch {}
   }
   bindProject(input) {
     const workspaceID = input.workspaceID ?? "";
@@ -5059,7 +5796,7 @@ class CaptureStore {
     }
     if (!this.binding(parsed.bindingKey, parsed.projectID))
       throw new Error("binding_conflict");
-    const prepared = prepareForPersistence(parsed, options.denylist);
+    const prepared = prepareForPersistence(parsed, options.denylist, this.quarantineKeyring);
     const now = Date.now();
     let result = {
       outcome: prepared.quarantined ? "quarantined" : "shadowed",
@@ -5074,13 +5811,13 @@ class CaptureStore {
            generation, created_at, updated_at, processed_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0, ?, ?, ?)
         ON CONFLICT DO NOTHING
-      `).run(prepared.event.idempotencyKey, prepared.event.schema, prepared.event.projectID, prepared.event.bindingKey, prepared.event.kind, prepared.event.source.sessionID, prepared.event.source.messageID ?? null, prepared.event.source.ordinal ?? null, prepared.event.source.toolCallID ?? null, prepared.payload, prepared.payloadHash, REDACTION_POLICY_VERSION, prepared.quarantined ? "quarantined" : "pending", now, now, prepared.quarantined ? now : null);
+      `).run(prepared.event.idempotencyKey, prepared.event.schema, prepared.event.projectID, prepared.event.bindingKey, prepared.event.kind, prepared.event.source.sessionID, prepared.event.source.messageID ?? null, prepared.event.source.ordinal ?? null, prepared.event.source.toolCallID ?? null, prepared.payload, prepared.payloadHash, prepared.redactionVersion, prepared.quarantined ? "quarantined" : "pending", now, now, prepared.quarantined ? now : null);
       if (inserted.changes === 0) {
         const existing = this.db.query(`SELECT contract, project_id, binding_key, event_kind, source_session_id,
                     source_message_id, source_ordinal, source_tool_call_id,
                     payload_json, payload_hash, redaction_version, note_id
                FROM capture_events WHERE idempotency_key = ?`).get(parsed.idempotencyKey);
-        if (!existing || !samePersistedCapture(existing, prepared.event, prepared.payload, prepared.payloadHash)) {
+        if (!existing || !samePersistedCapture(existing, prepared.event, prepared.payload, prepared.payloadHash, prepared.redactionVersion, prepared.payloadFingerprint, this.quarantineKeyring)) {
           throw new Error("idempotency_conflict");
         }
         result = {
@@ -5245,6 +5982,9 @@ class CaptureStore {
          supersedes_id, current_revision, subject_key, content_hash, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, 0, 'active', ?, 1, ?, ?, ?, ?)
     `).run(id, event.projectID, candidate.kind, candidate.title, candidate.summary, candidate.content, sizeClass, supersedesID, subjectKey, contentHash, now, now);
+    this.db.query(`UPDATE projects
+          SET updated_at = CASE WHEN updated_at >= ? THEN updated_at + 1 ELSE ? END
+        WHERE id = ?`).run(now, now, event.projectID);
     this.recordRevision(event, id, now);
     return id;
   }
@@ -5321,7 +6061,7 @@ class CaptureStore {
     return rows[0];
   }
 }
-function prepareForPersistence(event, denylist) {
+function prepareForPersistence(event, denylist, quarantineKeyring) {
   const copy = structuredClone(event);
   let replacements = 0;
   let truncated = copy.redaction.truncated;
@@ -5362,11 +6102,28 @@ function prepareForPersistence(event, denylist) {
     truncated
   };
   const validated = parseCaptureEvent(copy);
+  const payloadFingerprint = capturePayloadHash2(validated);
+  let payloadHash = payloadFingerprint;
+  let redactionVersion = REDACTION_POLICY_VERSION;
+  if (quarantined) {
+    let keyID = "unavailable";
+    payloadHash = null;
+    try {
+      const keyed = quarantineKeyring?.digestExistingSource(validated, payloadFingerprint);
+      if (keyed) {
+        keyID = keyed.keyID;
+        payloadHash = keyed.digest;
+      }
+    } catch {}
+    redactionVersion = quarantineRedactionVersion(keyID);
+  }
   const payload = quarantined ? null : JSON.stringify(validated);
   return {
     event: validated,
     payload,
-    payloadHash: capturePayloadHash2(validated),
+    payloadHash,
+    redactionVersion,
+    payloadFingerprint,
     quarantined,
     additionalReplacements: replacements
   };
@@ -5440,9 +6197,34 @@ function captureKeyForEvent(event) {
     terminalStatus: event.signal.status
   });
 }
-function samePersistedCapture(existing, event, payload, payloadHash) {
-  const retainedLegacyPayload = existing.payload_json === null && existing.payload_hash === null;
-  return existing.contract === event.schema && existing.project_id === event.projectID && existing.binding_key === event.bindingKey && existing.event_kind === event.kind && existing.source_session_id === event.source.sessionID && existing.source_message_id === (event.source.messageID ?? null) && existing.source_ordinal === (event.source.ordinal ?? null) && existing.source_tool_call_id === (event.source.toolCallID ?? null) && (retainedLegacyPayload || sameCapturePayload(existing.payload_json, existing.payload_hash, payload, payloadHash) && existing.redaction_version === REDACTION_POLICY_VERSION);
+function samePersistedCapture(existing, event, payload, payloadHash, redactionVersion, payloadFingerprint, quarantineKeyring) {
+  const retainedLegacyPayload = existing.payload_json === null && existing.payload_hash === null && !isQuarantineRedactionVersion(existing.redaction_version);
+  return existing.contract === event.schema && existing.project_id === event.projectID && existing.binding_key === event.bindingKey && existing.event_kind === event.kind && existing.source_session_id === event.source.sessionID && existing.source_message_id === (event.source.messageID ?? null) && existing.source_ordinal === (event.source.ordinal ?? null) && existing.source_tool_call_id === (event.source.toolCallID ?? null) && (retainedLegacyPayload || sameCapturePayload(existing.payload_json, existing.payload_hash, payload, payloadHash) && existing.redaction_version === redactionVersion || sameKeyedQuarantinedCapture(existing, event, payload, payloadHash, redactionVersion, payloadFingerprint, quarantineKeyring));
+}
+function sameKeyedQuarantinedCapture(existing, event, payload, payloadHash, redactionVersion, payloadFingerprint, quarantineKeyring) {
+  if (payload !== null || existing.payload_json !== null || payloadHash === null || existing.payload_hash === null || !isCurrentKeyedQuarantineVersion(existing.redaction_version) || !isCurrentKeyedQuarantineVersion(redactionVersion)) {
+    return false;
+  }
+  const keyID = quarantineKeyID(existing.redaction_version);
+  if (!keyID)
+    return false;
+  try {
+    return quarantineKeyring.verifySourceDigest(event, payloadFingerprint, keyID, existing.payload_hash);
+  } catch {
+    return false;
+  }
+}
+function quarantineRedactionVersion(keyID) {
+  return `${REDACTION_POLICY_VERSION};quarantine-key=${keyID};quarantine-digest=2`;
+}
+function isQuarantineRedactionVersion(value) {
+  return /^redaction\/1;quarantine-key=(?:[0-9a-f]{24}|unavailable)(?:;quarantine-digest=2)?$/.test(value);
+}
+function isCurrentKeyedQuarantineVersion(value) {
+  return /^redaction\/1;quarantine-key=[0-9a-f]{24};quarantine-digest=2$/.test(value);
+}
+function quarantineKeyID(value) {
+  return /^redaction\/1;quarantine-key=([0-9a-f]{24});quarantine-digest=2$/.exec(value)?.[1];
 }
 function sameCapturePayload(existingPayload, existingHash, payload, payloadHash) {
   if (existingHash !== null && existingHash === payloadHash)
@@ -5481,9 +6263,9 @@ function derivedHash(note) {
 // src/index.ts
 function main() {
   const { databasePath } = resolveConfig();
-  const directory = dirname3(databasePath);
-  if (!existsSync5(directory))
-    mkdirSync4(directory, { recursive: true });
+  const directory = dirname4(databasePath);
+  if (!existsSync6(directory))
+    mkdirSync5(directory, { recursive: true });
   const opened = openMemoryDatabase(databasePath);
   const store = new MemoryStore(opened.db);
   const capture = new CaptureStore(opened.db);