chainlesschain 0.166.129 → 0.166.131

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.131",
+      "cliVersions": ["0.166.131"],
+      "date": "2026-10-29",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.131: memory consistency and temporary worktree ownership (candidate, 2026-10-29)",
+          "body": "- Bind Memory recall to the same monotonic revision before and after query/ranking, and interrupt asynchronous semantic candidate waits on Stop. Late results cannot resume a cancelled request.\n- Verify all disk query bundle frames and file identities with exact BigInt metadata; narrowly bridge affected Windows libuv path-device projections through independently opened parent/volume handles. Preserve replacement, link, corruption and cleanup refusals.\n- Refresh project rules and Memory around canonical compaction; validate real killed-writer recovery and independent mutation/readback without duplicating compaction events. Incomplete semantic usage intents require reconciliation. Full IDE recovery, semantic quality and latency SLO remain separate acceptance work.\n- Preserve privately identified host system rules across unsaved canonical compaction, including headless, stream, hermetic and sub-agent hosts; copied messages cannot acquire host identity, and retained context still counts against the input budget.\n- Restrict temporary worktree callbacks from launching unowned background shell/subagents, persistent schedules or isolated skill children; retain awaited foreground execution and ordinary persistent-host background behavior. Arbitrary daemon containment is not claimed.\n- Include independent verify: Goal checks, live MCP catalog inheritance/cancellation, skill download cancellation and Terra capability/cache-billing changes accumulated on main. These are unreleased until the new exact-source gates and publication complete.\n- Require context-memory-kernel 0.1.11 publication and public verification before CLI 0.166.131, then pair IDE candidates 0.37.169 / 0.4.186 after the CLI is verified. Use OIDC only; never reuse the occupied .130 tag. Accepted deliveries remain 34/45; NOT_PAID_READY / NOT_ADMITTED / HOLD and the unresolved original dispatch remain."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.130",
+      "cliVersions": ["0.166.130"],
+      "date": "2026-10-29",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.130: Goal budget and workspace evidence (candidate, 2026-10-29)",
+          "body": "- Share model Goal review with the author run iteration/cost budgets, cancellation and output limits; retain known usage and stop on unknown usage or transport failure.\n- Bind Goal tool and artifact evidence to current workspace bytes and identities before and after review. External changes invalidate earlier successful observations; bounded reads fail closed when coverage is incomplete.\n- Refresh the reviewed security-map producer digest after adding Goal checkpoint evidence assertions. Preserve every mapped test, original threshold and required operating system.\n- Include the subsequent independent Goal acceptance, Memory cancellation/cache and Terra profile/cache-billing work now on main; validate their final combined source before release.\n- Pair with VS Code 0.37.168 / JetBrains 0.4.185. Before CLI publication, align changed child-package versions and verify their upstream releases. Release requires exact-source CLI CI and Strict Sandbox, OIDC publication and public artifact verification. Cumulative accepted deliverables remain 34/45, with 11 unfinished; NOT_PAID_READY / NOT_ADMITTED / HOLD remain."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.129",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Fixed - cc CLI 0.166.129: independent change review and Codex support evidence (candidate, 2026-10-28)",
-          "body": "- Give opted-in hermetic change review its own request context and tool journal, preserving original requirements, shared request limits, permissions and cancellation. Missing review usage blocks further calls; review is not independent task acceptance.\n- Centralize experimental Codex App Server support, versioned schema probes and CI targets. Keep default-off routing and the existing experimental allowlist; probe-only 0.160.0 and 0.164.0 do not imply production admission.\n- Verify concurrent thread recovery with explicit database recency pagination on Linux, Windows and macOS. Retain documented limitations for default rollout scanning and legacy creation-time pagination.\n- Retain published child dependencies. Candidate publication requires exact-commit CLI CI and Strict Sandbox across all configured systems, GitHub Actions OIDC publication and public artifact readback. Historical task and native acceptance remain separately reported."
+          "body": "- Give opted-in hermetic change review its own request context and tool journal, preserving original requirements, shared request limits, permissions and cancellation. Missing review usage blocks further calls; review is not independent task acceptance.\n- Centralize experimental Codex App Server support, versioned schema probes and CI targets. Keep default-off routing and the existing experimental allowlist; probe-only 0.160.0 and 0.164.0 do not imply production admission.\n- Verify concurrent thread recovery with explicit database recency pagination on Linux, Windows and macOS. Retain documented limitations for default rollout scanning and legacy creation-time pagination.\n- Skip automatic and managed workspace snapshots for read-only Git inspection commands in IDE and CLI agent sessions. Retain checkpoints for mutations, explicit output files, external diff drivers and custom Git executors; session persistence and permission checks remain active.\n- Retain published child dependencies. Candidate publication requires exact-commit CLI CI and Strict Sandbox across all configured systems, GitHub Actions OIDC publication and public artifact readback. Historical task and native acceptance remain separately reported."
         }
       ]
     },

package/src/harness/worktree-isolator.js

@@ -28,6 +28,7 @@ import {
   assertSafeGitPath,
 } from "../lib/git-integration.js";
 import { evaluateWorktreeCleanup } from "../lib/worktree-cleanup-safety.js";
+import { withEphemeralWorktreeScope } from "../lib/ephemeral-worktree-scope.js";
 import {
   normalizeSparsePaths,
   planSymlinkDirectories,
@@ -818,7 +819,9 @@ export async function isolateTask(repoDir, taskId, fn, options = {}) {
   const worktreePath = created.path;
 
   try {
-    const result = await fn(worktreePath);
+    const result = await withEphemeralWorktreeScope(worktreePath, () =>
+      fn(worktreePath),
+    );
     const hasChanges = _hasUncommittedChanges(worktreePath);
 
     return {

package/src/lib/compaction-host-provenance.js

@@ -0,0 +1,24 @@
+import { getDurableSystemMessageProvenance } from "./session-message-provenance.js";
+
+// A live host grants this capability only after validating and rendering its
+// own base. Neither serialized fields nor a cloned message carry authority.
+const LIVE_HOST_BASES = new WeakSet();
+
+export function markCompactionHostBase(message) {
+  if (
+    !message ||
+    message.role !== "system" ||
+    getDurableSystemMessageProvenance(message)
+  )
+    throw new TypeError("Compaction host base must be a live system message");
+  LIVE_HOST_BASES.add(message);
+  return message;
+}
+
+export function isCompactionHostBase(message) {
+  return (
+    LIVE_HOST_BASES.has(message) &&
+    message.role === "system" &&
+    !getDurableSystemMessageProvenance(message)
+  );
+}

package/src/lib/context-memory-kernel/durable-memory-port.js

@@ -19,7 +19,11 @@ import {
   cloneCanonical,
   normalizeMemoryRecord,
 } from "@chainlesschain/context-memory-kernel";
-import { withFileLock } from "../with-file-lock.js";
+import { withFileLockAsync } from "../with-file-lock.js";
+import {
+  checkMemoryQueryAborted,
+  memoryLockWait,
+} from "./memory-query-control.js";
 import { getHomeDir } from "../paths.js";
 import { resolve } from "node:path";
 import {
@@ -261,11 +265,13 @@ export class DurableJsonMemoryPort {
     }
   }
 
-  _locked(operation) {
+  _locked(operation, { signal } = {}) {
+    checkMemoryQueryAborted(signal);
     mkdirSync(dirname(this.filePath), { recursive: true, mode: 0o700 });
-    return withFileLock(
+    return withFileLockAsync(
       this.filePath,
       (context) => {
+        checkMemoryQueryAborted(signal);
         if (this.lockObserver) {
           try {
             this.lockObserver({
@@ -285,6 +291,7 @@ export class DurableJsonMemoryPort {
         retryMs: 2,
         maxRetryMs: 32,
         retryJitterMs: 8,
+        _sleep: memoryLockWait(signal),
       },
     );
   }
@@ -296,15 +303,17 @@ export class DurableJsonMemoryPort {
     });
   }
 
-  async query() {
-    return this._locked(() =>
-      Object.values(this._readUnlocked().records).map(cloneCanonical),
+  async query(_request, { signal } = {}) {
+    return this._locked(
+      () => Object.values(this._readUnlocked().records).map(cloneCanonical),
+      { signal },
     );
   }
 
   async listRecords(options = {}) {
     const query = normalizeListQuery(options);
-    const records = await this.query();
+    const records = await this.query(undefined, { signal: options.signal });
+    checkMemoryQueryAborted(options.signal);
     return records
       .filter((record) => matchesListQuery(record, query))
       .sort(compareMemoryRows)
@@ -319,31 +328,34 @@ export class DurableJsonMemoryPort {
   async listPage(options = {}) {
     const query = normalizeListQuery(options);
     const count = pageLimit(options.limit);
-    return this._locked(() => {
-      const state = this._readUnlocked();
-      const binding = listCursorBinding(
-        resolve(this.filePath),
-        state.digest,
-        query,
-      );
-      const after = decodeListCursor(options.cursor, binding);
-      const matches = Object.values(state.records)
-        .filter(
-          (record) =>
-            matchesListQuery(record, query) &&
-            (!after || compareMemoryRows(record, after) > 0),
-        )
-        .sort(compareMemoryRows);
-      const records = matches.slice(0, count);
-      return {
-        records,
-        storeRevision: state.storeRevision,
-        nextCursor:
-          matches.length > count
-            ? encodeListCursor(binding, records.at(-1))
-            : null,
-      };
-    });
+    return this._locked(
+      () => {
+        const state = this._readUnlocked();
+        const binding = listCursorBinding(
+          resolve(this.filePath),
+          state.digest,
+          query,
+        );
+        const after = decodeListCursor(options.cursor, binding);
+        const matches = Object.values(state.records)
+          .filter(
+            (record) =>
+              matchesListQuery(record, query) &&
+              (!after || compareMemoryRows(record, after) > 0),
+          )
+          .sort(compareMemoryRows);
+        const records = matches.slice(0, count);
+        return {
+          records,
+          storeRevision: state.storeRevision,
+          nextCursor:
+            matches.length > count
+              ? encodeListCursor(binding, records.at(-1))
+              : null,
+        };
+      },
+      { signal: options.signal },
+    );
   }
 
   async commit({ record, event, reconciliation }, expectedRevision = 0) {
@@ -381,8 +393,8 @@ export class DurableJsonMemoryPort {
     });
   }
 
-  async getRevision() {
-    return this._locked(() => this._readUnlocked().storeRevision);
+  async getRevision({ signal } = {}) {
+    return this._locked(() => this._readUnlocked().storeRevision, { signal });
   }
 
   async getReconciliation(requestId) {

package/src/lib/context-memory-kernel/live-compaction.js

@@ -14,6 +14,7 @@ import { JsonlSessionContextPort } from "./jsonl-session-context-port.js";
 import { createCliContextMemoryRuntime } from "./runtime.js";
 import { imageTransportEstimate } from "../image-token-estimate.js";
 import { projectRuntimeTokenUsage } from "../runtime-usage-ledger.js";
+import { isCompactionHostBase } from "../compaction-host-provenance.js";
 import {
   projectCanonicalResumeMessages,
   getDurableSystemMessageProvenance,
@@ -252,16 +253,24 @@ export async function compactLiveMessagesCanonical(
     sessionExists(sessionId);
   // Host policy is live-only. Durable summary/lineage systems retain their
   // private provenance and remain part of the exact authority comparison.
+  // Unsaved sessions have no durable host projection: only privately admitted
+  // live bases/nudges may bypass the planner, never arbitrary system messages.
   const messages = persistentSession
     ? projectCanonicalResumeMessages(liveMessages, { strict: true })
-    : liveMessages;
+    : liveMessages.filter(
+        (message) =>
+          !isCompactionHostBase(message) &&
+          !isRuntimeOnlySessionMessage(message),
+      );
   const ephemeralMessages = [];
-  if (persistentSession) {
+  {
     let sequence = 0;
     for (const message of liveMessages) {
       if (
         isRuntimeOnlySessionMessage(message) ||
-        (message.role === "system" &&
+        isCompactionHostBase(message) ||
+        (persistentSession &&
+          message.role === "system" &&
           !getDurableSystemMessageProvenance(message))
       )
         ephemeralMessages.push({ sequence, message });

package/src/lib/context-memory-kernel/memory-query-bundle.js

@@ -0,0 +1,375 @@
+import { createHash, randomUUID } from "node:crypto";
+import fs, {
+  closeSync,
+  constants,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  openSync,
+  readSync,
+  renameSync,
+  unlinkSync,
+  writeSync,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { corruptStore, syncDirectory } from "./durable-memory-port.js";
+import {
+  isAffectedWindowsZeroDeviceStatRuntime,
+  samePathHandleStableFileIdentity,
+  withTrustedFileParentSync,
+} from "../secure-file-identity.js";
+
+const CHUNK_BYTES = 64 * 1024;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const MAGIC = "chainlesschain.memory-query-bundle/v1\n";
+const NAME_DOMAIN = "chainlesschain.memory-query-bundle/name/v1\0";
+const noop = () => {};
+
+function corruptBundle(file, reason) {
+  return Object.assign(
+    new Error(`Context/Memory query bundle is invalid: ${reason}`),
+    {
+      code: "CONTEXT_MEMORY_QUERY_BUNDLE_CORRUPT",
+      filePath: file,
+    },
+  );
+}
+
+function sameIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+function samePathHandle(file, pathStat, handleStat) {
+  if (
+    !isAffectedWindowsZeroDeviceStatRuntime() ||
+    (handleStat.dev !== 0n && sameIdentity(pathStat, handleStat))
+  )
+    return sameIdentity(pathStat, handleStat);
+  // libuv 1.49/1.50 can project a Windows path device differently from its
+  // handle. Bind the handle to a separately opened parent/volume device;
+  // never accept a zero device as a wildcard or relax the exact inode.
+  try {
+    return withTrustedFileParentSync(fs, file, ({ parentDevice }) =>
+      samePathHandleStableFileIdentity(pathStat, handleStat, parentDevice),
+    );
+  } catch (cause) {
+    throw corruptStore(
+      file,
+      "query bundle parent identity cannot be verified",
+      cause,
+    );
+  }
+}
+
+function regular(stat, file) {
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1n)
+    throw corruptStore(file, "query bundle must be an unlinked regular file");
+  return stat;
+}
+
+function targetStat(file) {
+  try {
+    return regular(lstatSync(file, { bigint: true }), file);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function sameFile(file, expected) {
+  const current = targetStat(file);
+  if (!current || !samePathHandle(file, current, expected))
+    throw corruptStore(file, "query bundle file identity changed");
+  return current;
+}
+
+function sameDirectory(directory, expected) {
+  const current = lstatSync(directory, { bigint: true });
+  if (
+    !current.isDirectory() ||
+    current.isSymbolicLink() ||
+    !sameIdentity(current, expected)
+  )
+    throw corruptStore(directory, "query bundle directory identity changed");
+}
+
+/** A derived representation; only the caller's verified manifest supplies lengths and hashes. */
+export function createQueryBundlePlan(
+  manifest,
+  { maxFrameBytes = 64 * 1024 * 1024, maxBundleBytes = 0 } = {},
+) {
+  if (
+    !DIGEST.test(manifest?.digest) ||
+    !manifest.shards ||
+    !Number.isSafeInteger(maxFrameBytes) ||
+    maxFrameBytes < 1 ||
+    !Number.isSafeInteger(maxBundleBytes) ||
+    maxBundleBytes < 1
+  )
+    return null;
+  const buckets = Object.keys(manifest.shards).sort();
+  if (!buckets.length || buckets.length > 256) return null;
+  const key = createHash("sha256")
+    .update(NAME_DOMAIN)
+    .update(manifest.digest)
+    .digest("hex");
+  const name = `query-00-${key}.json`;
+  const frames = [];
+  let payloadBytes = 0;
+  for (const bucket of buckets) {
+    const entry = manifest.shards[bucket];
+    if (
+      !/^[a-f0-9]{2}$/u.test(bucket) ||
+      !DIGEST.test(entry?.queryDigest) ||
+      !Number.isSafeInteger(entry.queryBytes) ||
+      entry.queryBytes < 1 ||
+      entry.queryBytes > maxFrameBytes
+    )
+      return null;
+    if (`query-${bucket}-${entry.queryDigest.slice(7)}.json` === name)
+      return null;
+    payloadBytes += entry.queryBytes;
+    if (!Number.isSafeInteger(payloadBytes) || payloadBytes > maxBundleBytes)
+      return null;
+    frames.push(
+      Object.freeze({
+        bucket,
+        byteLength: entry.queryBytes,
+        digest: entry.queryDigest,
+      }),
+    );
+  }
+  const header = Buffer.from(
+    `${MAGIC}${JSON.stringify({ manifestDigest: manifest.digest, frames })}\n`,
+  );
+  const byteLength = header.length + payloadBytes;
+  if (!Number.isSafeInteger(byteLength) || byteLength > maxBundleBytes)
+    return null;
+  return Object.freeze({
+    name,
+    manifestDigest: manifest.digest,
+    frames: Object.freeze(frames),
+    header,
+    byteLength,
+  });
+}
+
+/**
+ * onFrame receives verified bytes; withhold results until the entire read succeeds.
+ * reuseFrameBuffer borrows storage only until onFrame settles. Opted-in callers
+ * must finish decoding before returning and must not retain the bytes or views.
+ * The default gives each callback its own independently retainable Buffer.
+ */
+export async function readQueryBundle(
+  file,
+  plan,
+  { checkpoint = noop, onFrame = noop, reuseFrameBuffer = false } = {},
+) {
+  await checkpoint();
+  const before = regular(lstatSync(file, { bigint: true }), file);
+  let fd, opened;
+  try {
+    try {
+      fd = openSync(
+        file,
+        constants.O_RDONLY |
+          (constants.O_NOFOLLOW || 0) |
+          (constants.O_NONBLOCK || 0),
+      );
+    } catch (error) {
+      if (["ELOOP", "ENOENT", "ENOTDIR"].includes(error.code))
+        throw corruptStore(
+          file,
+          "query bundle path changed while opening",
+          error,
+        );
+      throw error;
+    }
+    opened = regular(fstatSync(fd, { bigint: true }), file);
+    if (!samePathHandle(file, before, opened))
+      throw corruptStore(file, "query bundle changed while opening");
+    if (opened.size !== BigInt(plan.byteLength))
+      throw corruptBundle(file, "byte length does not match manifest plan");
+    async function readBytes(bytes, hash) {
+      let offset = 0;
+      while (offset < bytes.length) {
+        const count = readSync(
+          fd,
+          bytes,
+          offset,
+          Math.min(CHUNK_BYTES, bytes.length - offset),
+          null,
+        );
+        if (!count) throw corruptBundle(file, "unexpected end of file");
+        hash?.update(bytes.subarray(offset, offset + count));
+        offset += count;
+        await checkpoint();
+      }
+    }
+    const header = Buffer.allocUnsafe(plan.header.length);
+    await readBytes(header);
+    if (!header.equals(plan.header))
+      throw corruptBundle(file, "header does not match current manifest");
+    const reusable = reuseFrameBuffer
+      ? Buffer.allocUnsafe(
+          Math.max(...plan.frames.map((frame) => frame.byteLength)),
+        )
+      : null;
+    for (const frame of plan.frames) {
+      const bytes = reusable
+        ? reusable.subarray(0, frame.byteLength)
+        : Buffer.allocUnsafe(frame.byteLength);
+      const hash = createHash("sha256");
+      await readBytes(bytes, hash);
+      if (`sha256:${hash.digest("hex")}` !== frame.digest)
+        throw corruptBundle(
+          file,
+          `frame digest does not match bucket ${frame.bucket}`,
+        );
+      await onFrame(frame.bucket, bytes);
+    }
+    if (readSync(fd, Buffer.allocUnsafe(1), 0, 1, null) !== 0)
+      throw corruptBundle(file, "trailing data");
+    await checkpoint();
+    const after = regular(fstatSync(fd, { bigint: true }), file);
+    if (!sameIdentity(opened, after))
+      throw corruptStore(file, "query bundle descriptor identity changed");
+    sameFile(file, opened);
+    if (
+      after.size !== opened.size ||
+      after.mtimeNs !== opened.mtimeNs ||
+      after.ctimeNs !== opened.ctimeNs
+    )
+      throw corruptBundle(file, "file changed while reading");
+  } catch (error) {
+    if (fd !== undefined) {
+      // Content errors are repairable only while the pathname still names the
+      // inode we opened. Otherwise a failed read could authorize replacing an
+      // unrelated file that appeared during a cooperative checkpoint.
+      const current = regular(fstatSync(fd, { bigint: true }), file);
+      if (opened && !sameIdentity(current, opened))
+        throw corruptStore(file, "query bundle descriptor identity changed");
+      sameFile(file, current);
+    }
+    throw error;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+/** Caller holds the authority lock throughout construction, publication, and cleanup. */
+export async function writeQueryBundle(
+  file,
+  plan,
+  { checkpoint = noop, getFrame, checkDirectories } = {},
+) {
+  if (typeof getFrame !== "function" || typeof checkDirectories !== "function")
+    throw new TypeError(
+      "query bundle write requires getFrame and checkDirectories",
+    );
+  if (basename(file) !== plan.name)
+    throw corruptStore(file, "query bundle target does not match its plan");
+  await checkpoint();
+  await checkDirectories();
+  const directory = dirname(file);
+  const parent = lstatSync(directory, { bigint: true });
+  sameDirectory(directory, parent);
+  const originalTarget = targetStat(file);
+  const temporary = join(directory, `query-rebuild-${randomUUID()}.tmp`);
+  let fd, created;
+  let published = false;
+  try {
+    fd = openSync(
+      temporary,
+      constants.O_WRONLY |
+        constants.O_CREAT |
+        constants.O_EXCL |
+        (constants.O_NOFOLLOW || 0),
+      0o600,
+    );
+    created = regular(fstatSync(fd, { bigint: true }), temporary);
+    async function writeBytes(bytes, hash) {
+      let offset = 0;
+      while (offset < bytes.length) {
+        const count = writeSync(
+          fd,
+          bytes,
+          offset,
+          Math.min(CHUNK_BYTES, bytes.length - offset),
+        );
+        if (!count)
+          throw Object.assign(
+            new Error("query bundle write made no progress"),
+            { code: "EIO" },
+          );
+        hash?.update(bytes.subarray(offset, offset + count));
+        offset += count;
+        await checkpoint();
+      }
+    }
+    await writeBytes(plan.header);
+    for (const frame of plan.frames) {
+      const bytes = await getFrame(frame.bucket);
+      if (!Buffer.isBuffer(bytes) || bytes.length !== frame.byteLength)
+        throw corruptBundle(
+          file,
+          `source frame does not match bucket ${frame.bucket}`,
+        );
+      const sourceHash = createHash("sha256");
+      for (let offset = 0; offset < bytes.length; offset += CHUNK_BYTES) {
+        sourceHash.update(bytes.subarray(offset, offset + CHUNK_BYTES));
+        await checkpoint();
+      }
+      if (`sha256:${sourceHash.digest("hex")}` !== frame.digest)
+        throw corruptBundle(
+          file,
+          `source frame does not match bucket ${frame.bucket}`,
+        );
+      const writtenHash = createHash("sha256");
+      await writeBytes(bytes, writtenHash);
+      if (`sha256:${writtenHash.digest("hex")}` !== frame.digest)
+        throw corruptBundle(
+          file,
+          `source frame changed while writing bucket ${frame.bucket}`,
+        );
+    }
+    const written = regular(fstatSync(fd, { bigint: true }), temporary);
+    if (!sameIdentity(created, written))
+      throw corruptStore(temporary, "query bundle temporary identity changed");
+    if (written.size !== BigInt(plan.byteLength))
+      throw corruptBundle(file, "written byte length does not match plan");
+    fsyncSync(fd);
+    await checkpoint();
+    closeSync(fd);
+    fd = undefined;
+    await checkDirectories();
+    sameDirectory(directory, parent);
+    sameFile(temporary, created);
+    const currentTarget = targetStat(file);
+    if (
+      Boolean(originalTarget) !== Boolean(currentTarget) ||
+      (originalTarget && !sameIdentity(originalTarget, currentTarget))
+    )
+      throw corruptStore(
+        file,
+        "query bundle target identity changed before publication",
+      );
+    renameSync(temporary, file);
+    published = true;
+    syncDirectory(directory);
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+    if (!published && created) {
+      // An unsafe directory or a replaced temp path is not ours to delete.
+      // Preserve the original failure rather than hiding it with cleanup errors.
+      try {
+        await checkDirectories();
+        sameDirectory(directory, parent);
+        sameFile(temporary, created);
+        unlinkSync(temporary);
+      } catch {
+        /* Leave an untrusted/redirected temporary path untouched. */
+      }
+    }
+  }
+}

package/src/lib/context-memory-kernel/memory-query-control.js

@@ -0,0 +1,28 @@
+import { performance } from "node:perf_hooks";
+import { setImmediate, setTimeout } from "node:timers/promises";
+
+// These are host control signals, not serialized MemoryRecallRequest fields.
+export function checkMemoryQueryAborted(signal) {
+  signal?.throwIfAborted();
+}
+
+export function memoryLockWait(signal) {
+  return async (milliseconds) => {
+    checkMemoryQueryAborted(signal);
+    await setTimeout(milliseconds, undefined, { signal });
+    checkMemoryQueryAborted(signal);
+  };
+}
+
+/** Yield between bounded shards while retaining the authority lock/snapshot. */
+export function createMemoryQueryCheckpoint(signal) {
+  let yieldedAt = performance.now();
+  return async (force = false) => {
+    checkMemoryQueryAborted(signal);
+    if (force || performance.now() - yieldedAt >= 8) {
+      await setImmediate(undefined, { signal });
+      yieldedAt = performance.now();
+    }
+    checkMemoryQueryAborted(signal);
+  };
+}