open-memex 0.3.0 → 0.4.0-alpha.1

package/src/store/markdown.ts

@@ -2,7 +2,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 import yaml from "js-yaml";
-import { memoriesDirFor, memoriesDirPath } from "../paths.ts";
+import {
+  memoriesDirFor,
+  memoriesDirPath,
+  inRepoMemoriesDirPath,
+} from "../paths.ts";
 
 /** v2 content-kind taxonomy (V2-DESIGN §3.1). `type` = what the memory IS. */
 export const MEMORY_TYPE_TAXONOMY = [
@@ -52,6 +56,62 @@ export interface Frontmatter {
   updated_at: string; // RFC 3339
   supersedes: string | null; // on the NEW memory → points BACK (§3.3)
   superseded_by: string | null; // on the OLD memory → points FORWARD
+  /** 2B/D25: where this memory sits in the propose → promote workflow. */
+  review_state: ReviewState;
+  /** Who proposed / approved it (git user.name, fallback OS user). */
+  proposed_by: string | null;
+  approved_by: string | null;
+  /** For propose-copies: the personal memory this was derived from. */
+  derived_from: string | null;
+  /** Curator note on the latest review transition (e.g. rejection reason). */
+  review_note: string | null;
+  /** 2B/D29: append-only audit trail of review transitions. Lives in the
+   *  file (source of truth), so it travels through branches and PRs. */
+  review_history: ReviewTransition[];
+}
+
+/** One step in a memory's review lifecycle — who moved it, when, why. */
+export interface ReviewTransition {
+  at: string; // RFC 3339
+  by: string; // author identity (git user.name, fallback OS user)
+  from: ReviewState;
+  to: ReviewState;
+  note: string | null;
+}
+
+/** Defensive parse: malformed entries are dropped, never fatal. */
+export function asReviewHistory(v: unknown): ReviewTransition[] {
+  if (!Array.isArray(v)) return [];
+  const out: ReviewTransition[] = [];
+  for (const e of v) {
+    if (!e || typeof e !== "object") continue;
+    const r = e as Record<string, unknown>;
+    const from = asReviewState(r.from);
+    const to = asReviewState(r.to);
+    const at = typeof r.at === "string" && r.at ? r.at : null;
+    const by = typeof r.by === "string" && r.by ? r.by : null;
+    if (!at || !by) continue;
+    out.push({
+      at,
+      by,
+      from,
+      to,
+      note: typeof r.note === "string" && r.note ? r.note : null,
+    });
+  }
+  return out;
+}
+
+/** Review lifecycle for shared memories (2B/D25): draft → proposed →
+ *  approved/rejected → published. Personal memories stay `draft`. */
+export type ReviewState = "draft" | "proposed" | "approved" | "rejected" | "published";
+
+const REVIEW_STATES: ReviewState[] = ["draft", "proposed", "approved", "rejected", "published"];
+
+export function asReviewState(v: unknown): ReviewState {
+  return typeof v === "string" && (REVIEW_STATES as string[]).includes(v)
+    ? (v as ReviewState)
+    : "draft";
 }
 
 export interface MemoryFile {
@@ -179,6 +239,16 @@ export function normalizeFrontmatter(
       typeof raw.superseded_by === "string" && raw.superseded_by
         ? raw.superseded_by
         : null,
+    review_state: asReviewState(raw.review_state),
+    proposed_by:
+      typeof raw.proposed_by === "string" && raw.proposed_by ? raw.proposed_by : null,
+    approved_by:
+      typeof raw.approved_by === "string" && raw.approved_by ? raw.approved_by : null,
+    derived_from:
+      typeof raw.derived_from === "string" && raw.derived_from ? raw.derived_from : null,
+    review_note:
+      typeof raw.review_note === "string" && raw.review_note ? raw.review_note : null,
+    review_history: asReviewHistory(raw.review_history),
   };
 }
 
@@ -217,6 +287,9 @@ export function writeMemoryFile(
   fm: Frontmatter,
   body: string,
 ): { filePath: string; mtimeMs: number } {
+  // 2B/D26: project drafts live in appdata (the outbox) — the in-repo dir
+  // only ever holds submitted memories (proposed/approved/published).
+  // Personal stays in appdata and never leaves the machine.
   const dir = memoriesDirFor(fm.scope_key);
   const filePath = path.join(dir, `${fm.id}.md`);
   fs.writeFileSync(filePath, serialize(fm, body), "utf8");
@@ -224,14 +297,16 @@ export function writeMemoryFile(
   return { filePath, mtimeMs: st.mtimeMs };
 }
 
-export function deleteMemoryFile(scopeKey: string, id: string): boolean {
-  const dir = memoriesDirPath(scopeKey);
-  const filePath = path.join(dir, `${id}.md`);
-  if (fs.existsSync(filePath)) {
-    fs.unlinkSync(filePath);
-    return true;
+/** Yield `*.md` files in the in-repo dir (read path — never creates it). */
+export function* iterInRepoMemoryFiles(
+  root: string,
+  memoryDir: string,
+): Generator<string> {
+  const dir = inRepoMemoriesDirPath(root, memoryDir);
+  if (!fs.existsSync(dir)) return;
+  for (const name of fs.readdirSync(dir)) {
+    if (name.endsWith(".md")) yield path.join(dir, name);
   }
-  return false;
 }
 
 export function readMemoryFile(filePath: string): MemoryFile | null {

package/src/store/sync.ts

@@ -1,17 +1,21 @@
 import fs from "node:fs";
+import path from "node:path";
 import { db } from "./db.ts";
 import { cjkIndexText } from "../retrieve/cjk.ts";
 import { contentHash, repairChain } from "./lifecycle.ts";
 import {
   iterMemoryFiles,
+  iterInRepoMemoryFiles,
   readMemoryFile,
   timeToMs,
   type MemoryFile,
 } from "./markdown.ts";
+import { projectRoot, paths } from "../paths.ts";
+import { loadConfig } from "../config.ts";
 
 const UPSERT_SQL = `
-  INSERT INTO memories (id, scope_key, scope, visibility, project_name, type, role, importance, status, tags, content, cjk, content_hash, superseded_by, source, file_path, mtime_ms, created_at, updated_at)
-  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  INSERT INTO memories (id, scope_key, scope, visibility, project_name, type, role, importance, status, tags, content, cjk, content_hash, superseded_by, source, file_path, mtime_ms, created_at, updated_at, review_state)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   ON CONFLICT(id) DO UPDATE SET
     scope_key    = excluded.scope_key,
     scope        = excluded.scope,
@@ -27,6 +31,7 @@ const UPSERT_SQL = `
     content_hash = excluded.content_hash,
     superseded_by = excluded.superseded_by,
     source       = excluded.source,
+    review_state = excluded.review_state,
     file_path    = excluded.file_path,
     mtime_ms     = excluded.mtime_ms,
     updated_at   = excluded.updated_at
@@ -77,6 +82,7 @@ function writeRow(mf: MemoryFile, mtimeMs: number): void {
     mtimeMs,
     timeToMs(fm.created_at),
     timeToMs(fm.updated_at),
+    fm.review_state ?? "draft",
   );
 }
 
@@ -91,7 +97,7 @@ export interface SyncStats {
   scanned: number;
 }
 
-export function syncScope(scopeKey: string): SyncStats {
+export function syncScope(scopeKey: string, kind: SyncKind = "auto"): SyncStats {
   const d = db();
   const stats: SyncStats = { added: 0, updated: 0, removed: 0, scanned: 0 };
 
@@ -101,7 +107,22 @@ export function syncScope(scopeKey: string): SyncStats {
   const existingById = new Map(existing.map((r) => [r.id, r]));
   const seen = new Set<string>();
 
-  for (const fp of iterMemoryFiles(scopeKey)) {
+  // 2B/D26: project scopes have two homes — the appdata outbox (drafts,
+  // branch-independent) and the in-repo dir (submitted memories, following
+  // the current branch). No migration: appdata files stay put until an
+  // explicit `submit` moves them. On the near-impossible id collision the
+  // in-repo (submitted) copy wins, so scan appdata first.
+  const filePaths: string[] = [];
+  if (scopeKey.startsWith("project__")) {
+    const root = projectRoot();
+    const memoryDir = loadConfig().memoryDir;
+    for (const fp of iterMemoryFiles(scopeKey)) filePaths.push(fp);
+    for (const fp of iterInRepoMemoryFiles(root, memoryDir)) filePaths.push(fp);
+  } else {
+    for (const fp of iterMemoryFiles(scopeKey)) filePaths.push(fp);
+  }
+
+  for (const fp of filePaths) {
     const mf = readMemoryFile(fp);
     if (!mf) continue;
     stats.scanned++;
@@ -123,5 +144,65 @@ export function syncScope(scopeKey: string): SyncStats {
     }
   }
 
+  recordSync(scopeKey, kind, stats);
   return stats;
 }
+
+// ---------------------------------------------------------------------------
+// D31: last-sync visibility
+// ---------------------------------------------------------------------------
+
+/** What triggered the sync — shown in sync-status so the user can see it. */
+export type SyncKind = "session" | "request" | "cli" | "submit" | "auto";
+
+export interface SyncStateEntry {
+  lastSyncAt: string; // RFC 3339
+  lastSyncKind: SyncKind;
+  added: number;
+  updated: number;
+  removed: number;
+  scanned: number;
+}
+
+function syncStatePath(): string {
+  return path.join(paths().root, "sync-state.json");
+}
+
+/** Best-effort: a failed write never breaks the sync itself. */
+export function recordSync(scopeKey: string, kind: SyncKind, stats: SyncStats): void {
+  try {
+    const p = syncStatePath();
+    let all: Record<string, SyncStateEntry> = {};
+    if (fs.existsSync(p)) {
+      try {
+        all = JSON.parse(fs.readFileSync(p, "utf8")) as Record<string, SyncStateEntry>;
+      } catch {
+        /* corrupt — start fresh */
+      }
+    }
+    all[scopeKey] = {
+      lastSyncAt: new Date().toISOString(),
+      lastSyncKind: kind,
+      added: stats.added,
+      updated: stats.updated,
+      removed: stats.removed,
+      scanned: stats.scanned,
+    };
+    fs.writeFileSync(p, JSON.stringify(all, null, 2), "utf8");
+  } catch {
+    /* visibility is advisory — never fail a sync over it */
+  }
+}
+
+export function readSyncState(scopeKey: string): SyncStateEntry | null {
+  try {
+    const p = syncStatePath();
+    if (!fs.existsSync(p)) return null;
+    const all = JSON.parse(fs.readFileSync(p, "utf8")) as Record<string, unknown>;
+    const e = all?.[scopeKey] as SyncStateEntry | undefined;
+    if (!e || typeof e.lastSyncAt !== "string") return null;
+    return e;
+  } catch {
+    return null;
+  }
+}

package/src/submit.ts

@@ -0,0 +1,411 @@
+/**
+ * 2B/D26: submit — move outbox drafts into a git branch for review.
+ *
+ * The AI-driven sync loop:
+ *   1. `open-memex sync-status` — what is waiting (outbox drafts, in-review, published)
+ *   2. user picks memories to sync
+ *   3. `open-memex submit <ids>` — new branch (default `mem/sync-*`), copy
+ *      drafts into the repo dir as `proposed`, commit locally, move the
+ *      outbox originals out (copy + verify + delete)
+ *   4. push + open PR — done by the agent holding the user's approval, or by
+ *      the human; the tool only prints the exact commands (D27)
+ *
+ * Git automation line (D27): the tool automates LOCAL git
+ * only (branch, copy, commit). Nothing leaves the machine without the user's
+ * explicit approval — push/PR are the agent's or the human's job.
+ *
+ * `submit` is idempotent: re-submitting an id whose file is already on the
+ * branch with identical content just completes the outbox move. A same-id
+ * file with DIFFERENT content is a conflict — abort, the human judges.
+ */
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { loadConfig } from "./config.ts";
+import { inRepoMemoriesDir, memoriesDirPath, projectRoot } from "./paths.ts";
+import { resolveProjectScope } from "./scope.ts";
+import { contentHash } from "./store/lifecycle.ts";
+import {
+  msToRfc3339,
+  parse as parseMemory,
+  readMemoryFile,
+  serialize,
+  type ReviewState,
+} from "./store/markdown.ts";
+import { upsertFromFile, recordSync, readSyncState } from "./store/sync.ts";
+import { db } from "./store/db.ts";
+import { currentAuthor } from "./review.ts";
+
+function fail(msg: string): never {
+  throw new Error(`[open-memex] ${msg}`);
+}
+
+function git(root: string, args: string[]): string {
+  try {
+    return execFileSync("git", args, {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    }).trim();
+  } catch (e) {
+    const err = e as { stderr?: string; message?: string };
+    const detail = (err.stderr ?? err.message ?? "").trim().split("\n")[0];
+    fail(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+}
+
+function snippetOf(body: string): string {
+  const line = body.split("\n").map((l) => l.trim()).find((l) => l.length > 0) ?? "";
+  return line.length > 60 ? line.slice(0, 60) + "…" : line;
+}
+
+// ---------------------------------------------------------------------------
+// status
+// ---------------------------------------------------------------------------
+
+export type OutboxLocation = "outbox" | "repo";
+export type GitState = "uncommitted" | "committed" | "n/a";
+
+export interface StatusEntry {
+  id: string;
+  title: string;
+  reviewState: ReviewState;
+  location: OutboxLocation;
+  gitState: GitState;
+}
+
+export interface SyncStatus {
+  scopeKey: string;
+  projectName: string;
+  outbox: StatusEntry[]; // appdata drafts waiting for submit
+  inRepo: StatusEntry[]; // files in the repo dir (any review_state)
+  uncommitted: StatusEntry[]; // repo files not yet committed (the untracked window)
+}
+
+/** Files under .ai/open-memex that git sees as new/modified/untracked. */
+function uncommittedRepoFiles(root: string, repoDir: string): Set<string> {
+  const out = new Set<string>();
+  try {
+    const porcelain = git(root, ["status", "--porcelain", "--", repoDir]);
+    for (const line of porcelain.split("\n")) {
+      const m = line.match(/^.{2}\s+(.*)$/);
+      if (!m) continue;
+      let p = m[1].trim();
+      // handle renames: "R  old -> new"
+      if (p.includes(" -> ")) p = p.split(" -> ")[1];
+      // strip quotes git adds around unusual names
+      if (p.startsWith('"') && p.endsWith('"')) p = p.slice(1, -1);
+      out.add(path.resolve(root, p));
+    }
+  } catch {
+    /* not a git repo or git unavailable — no git state */
+  }
+  return out;
+}
+
+export function getSyncStatus(): SyncStatus {
+  const root = projectRoot();
+  const scope = resolveProjectScope(root);
+  const cfg = loadConfig();
+  const outboxDir = memoriesDirPath(scope.key);
+  const repoDir = path.join(root, cfg.memoryDir);
+
+  const rows = db()
+    .prepare(
+      `SELECT id, review_state, file_path, content FROM memories WHERE scope_key = ? ORDER BY updated_at DESC`,
+    )
+    .all(scope.key) as Array<{
+    id: string;
+    review_state: string;
+    file_path: string;
+    content: string;
+  }>;
+
+  const uncommitted = fs.existsSync(repoDir) ? uncommittedRepoFiles(root, repoDir) : new Set<string>();
+  const outbox: StatusEntry[] = [];
+  const inRepo: StatusEntry[] = [];
+  const uncommittedList: StatusEntry[] = [];
+
+  for (const r of rows) {
+    const inOutbox = r.file_path.startsWith(outboxDir + path.sep);
+    const entry: StatusEntry = {
+      id: r.id,
+      title: snippetOf(r.content ?? ""),
+      reviewState: (r.review_state ?? "draft") as ReviewState,
+      location: inOutbox ? "outbox" : "repo",
+      gitState: "n/a",
+    };
+    if (inOutbox) {
+      outbox.push(entry);
+    } else {
+      entry.gitState = uncommitted.has(path.resolve(r.file_path)) ? "uncommitted" : "committed";
+      inRepo.push(entry);
+      if (entry.gitState === "uncommitted") uncommittedList.push(entry);
+    }
+  }
+  return {
+    scopeKey: scope.key,
+    projectName: scope.projectName,
+    outbox,
+    inRepo,
+    uncommitted: uncommittedList,
+  };
+}
+
+export function formatSyncStatus(st: SyncStatus): string {
+  const lines: string[] = [];
+  lines.push(`project: ${st.projectName} (${st.scopeKey})`);
+  // D31: when the index was last synced and what triggered it.
+  const last = readSyncState(st.scopeKey);
+  if (last) {
+    lines.push(
+      `last sync: ${last.lastSyncAt} (${last.lastSyncKind}) — +${last.added} ~${last.updated} -${last.removed} (scanned ${last.scanned})`,
+    );
+  } else {
+    lines.push(`last sync: never`);
+  }
+  lines.push(`outbox (appdata, pending sync): ${st.outbox.length}`);
+  for (const e of st.outbox) {
+    lines.push(`  ${e.id}  [${e.reviewState}] ${e.title}`);
+  }
+  const byState = new Map<string, number>();
+  for (const e of st.inRepo) byState.set(e.reviewState, (byState.get(e.reviewState) ?? 0) + 1);
+  const breakdown = [...byState.entries()].map(([s, n]) => `${n} ${s}`).join(", ") || "none";
+  lines.push(`repo .ai/open-memex: ${st.inRepo.length} (${breakdown})`);
+  for (const e of st.inRepo) {
+    const u = e.gitState === "uncommitted" ? " (uncommitted)" : "";
+    lines.push(`  ${e.id}  [${e.reviewState}]${u} ${e.title}`);
+  }
+  if (st.uncommitted.length > 0) {
+    lines.push(`note: ${st.uncommitted.length} repo file(s) not yet committed — they ride with the working tree until you commit.`);
+  }
+  if (st.outbox.length > 0) {
+    lines.push(`next: open-memex submit ${st.outbox.map((e) => e.id).join(" ")}`);
+  }
+  return lines.join("\n");
+}
+
+// ---------------------------------------------------------------------------
+// submit
+// ---------------------------------------------------------------------------
+
+export interface SubmitOptions {
+  /** Submit onto this branch instead of creating mem/sync-*. Must be the current branch. */
+  onto?: string;
+  /** PR base override (default: the branch we branched from). */
+  base?: string;
+}
+
+export interface SubmitResult {
+  branch: string;
+  base: string;
+  submitted: Array<{ id: string; filePath: string; reviewState: ReviewState }>;
+  /** already on the branch with identical content — outbox move completed */
+  skippedIdentical: string[];
+  /** false when everything was already on the branch (nothing new to commit) */
+  committed: boolean;
+  pushCommand: string;
+  prCommand: string;
+}
+
+interface Validated {
+  id: string;
+  srcPath: string;
+  body: string;
+  reviewState: ReviewState;
+}
+
+export function submitMemories(ids: string[], opts: SubmitOptions = {}): SubmitResult {
+  if (ids.length === 0) fail("submit needs at least one memory id");
+  const root = projectRoot();
+  // submit needs a git repo — the whole point is branch + commit.
+  git(root, ["rev-parse", "--git-dir"]);
+
+  const scope = resolveProjectScope(root);
+  const cfg = loadConfig();
+  const outboxDir = memoriesDirPath(scope.key);
+  const repoDir = inRepoMemoriesDir(root, cfg.memoryDir);
+
+  // 1. Validate everything first (all-or-nothing — nothing is written yet).
+  //    Read the outbox files directly from disk: the index resolves same-id
+  //    collisions in favor of the repo copy, which would hide a genuine
+  //    outbox-vs-branch conflict from us.
+  const problems: string[] = [];
+  const validated: Validated[] = [];
+  for (const id of ids) {
+    if (!/^[A-Za-z0-9_-]+$/.test(id)) {
+      problems.push(`${id}: not a valid memory id`);
+      continue;
+    }
+    const srcPath = path.join(outboxDir, `${id}.md`);
+    if (!fs.existsSync(srcPath)) {
+      problems.push(`${id}: not in the outbox (never staged, or already submitted? see sync-status)`);
+      continue;
+    }
+    const mf = readMemoryFile(srcPath);
+    if (!mf) {
+      problems.push(`${id}: unreadable outbox file`);
+      continue;
+    }
+    if (mf.fm.id !== id) {
+      problems.push(`${id}: outbox file's frontmatter id is ${mf.fm.id} — not submitting a mislabeled file`);
+      continue;
+    }
+    if (mf.fm.scope !== "project") {
+      problems.push(`${id}: scope is ${mf.fm.scope}, only project memories can be submitted`);
+      continue;
+    }
+    const rs = (mf.fm.review_state ?? "draft") as ReviewState;
+    // draft/rejected move to proposed; a local-approved copy keeps its approval.
+    if (rs !== "draft" && rs !== "rejected" && rs !== "approved") {
+      problems.push(`${id}: review_state is ${rs}, only draft/rejected/approved can be submitted`);
+      continue;
+    }
+    validated.push({ id, srcPath, body: mf.body, reviewState: rs });
+  }
+  if (problems.length > 0) {
+    fail(`submit aborted — nothing was written:\n  ${problems.join("\n  ")}`);
+  }
+
+  // 2. Resolve the target branch.
+  const startBranch = git(root, ["branch", "--show-current"]) || git(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  let branch: string;
+  if (opts.onto) {
+    if (opts.onto !== startBranch) {
+      fail(`--onto ${opts.onto} is not the current branch (${startBranch || "(detached)"}). submit only targets the branch you're on.`);
+    }
+    branch = opts.onto;
+  } else {
+    const stamp = new Date().toISOString().replace(/[-:]/g, "").slice(0, 15);
+    branch = `mem/sync-${stamp}`;
+    let n = 0;
+    while (true) {
+      const exists = git(root, ["branch", "--list", branch]);
+      if (!exists) break;
+      n++;
+      branch = `mem/sync-${stamp}-${n}`;
+    }
+    git(root, ["checkout", "-b", branch]);
+  }
+  const base = opts.base ?? startBranch;
+  const author = currentAuthor();
+
+  // 3. Copy drafts into the repo dir as proposed (same id — one memory, one id).
+  //    Same id + different content on the branch = conflict → abort, human judges.
+  const submitted: Array<{ id: string; filePath: string; reviewState: ReviewState }> = [];
+  const skippedIdentical: string[] = [];
+  const now = msToRfc3339(Date.now());
+  const written: Array<{ id: string; srcPath: string; destPath: string; hash: string }> = [];
+  const conflicts: string[] = [];
+  for (const v of validated) {
+    const destPath = path.join(repoDir, `${v.id}.md`);
+    const raw = fs.existsSync(destPath) ? fs.readFileSync(destPath, "utf8") : null;
+    if (raw !== null) {
+      const existing = parseMemory(raw);
+      const sameContent = existing !== null && contentHash(existing.body) === contentHash(v.body);
+      if (sameContent) {
+        skippedIdentical.push(v.id);
+        written.push({ id: v.id, srcPath: v.srcPath, destPath, hash: contentHash(v.body) });
+        continue;
+      }
+      conflicts.push(`${v.id}: already on branch ${branch} with different content — resolve it manually, then re-submit`);
+      continue;
+    }
+    const parsed = parseMemory(fs.readFileSync(v.srcPath, "utf8"));
+    if (!parsed) fail(`${v.id}: unreadable source file`);
+    // draft/rejected → proposed; a local-approved copy arrives already
+    // approved and keeps its approval (and its approved_by).
+    const destState: ReviewState = v.reviewState === "approved" ? "approved" : "proposed";
+    const fm = {
+      ...parsed.fm,
+      review_state: destState,
+      updated_at: now,
+      proposed_by: parsed.fm.proposed_by ?? author,
+      // D29: the outbox → repo move is part of the audit trail.
+      review_history: [
+        ...(parsed.fm.review_history ?? []),
+        {
+          at: now,
+          by: author,
+          from: parsed.fm.review_state ?? "draft",
+          to: destState,
+          note: `submitted to branch ${branch}`,
+        },
+      ],
+    };
+    const text = serialize(fm, parsed.body);
+    fs.writeFileSync(destPath, text, "utf8");
+    written.push({ id: v.id, srcPath: v.srcPath, destPath, hash: contentHash(parsed.body) });
+    submitted.push({ id: v.id, filePath: destPath, reviewState: destState });
+  }
+  if (conflicts.length > 0) {
+    // Roll back the copies we just made — nothing half-submitted.
+    for (const w of written) {
+      if (submitted.some((s) => s.id === w.id) && fs.existsSync(w.destPath)) {
+        fs.unlinkSync(w.destPath);
+      }
+    }
+    // If we created the branch and never committed, remove it too — an
+    // aborted submit leaves no trace.
+    if (!opts.onto) {
+      try {
+        git(root, ["checkout", "--quiet", startBranch]);
+        git(root, ["branch", "--quiet", "-D", branch]);
+      } catch {
+        /* best effort — the error below is what matters */
+      }
+    }
+    fail(`submit aborted — nothing was committed:\n  ${conflicts.join("\n  ")}`);
+  }
+
+  // 4. Commit locally (tool automates local git only — D27 line).
+  //    Only our own files are committed: anything else the user staged stays
+  //    staged and untouched.
+  const destPaths = written.map((w) => w.destPath);
+  const relPaths = destPaths.map((p: string) => path.relative(root, p));
+  git(root, ["add", "--", ...destPaths]);
+  const staged = git(root, ["diff", "--cached", "--name-only", "--", ...relPaths]);
+  let committed = false;
+  if (staged.trim()) {
+    const short = submitted.map((s) => s.id.slice(0, 8)).join(" ");
+    git(root, ["commit", "-m", `mem: submit ${submitted.length} ${submitted.length === 1 ? "memory" : "memories"} for review (${short})`, "--", ...relPaths]);
+    committed = true;
+  }
+
+  // 5. Verify the committed copies, then move the outbox originals out
+  //    (copy + verify + delete — never a bare rename across the move).
+  for (const w of written) {
+    const back = fs.readFileSync(w.destPath, "utf8");
+    const bParsed = parseMemory(back);
+    if (!bParsed || contentHash(bParsed.body) !== w.hash) {
+      fail(`${w.id}: verification failed after commit — outbox copy kept at ${w.srcPath}`);
+    }
+    // Same id, new home: ON CONFLICT(id) rewrites the row to the repo path.
+    upsertFromFile({
+      fm: bParsed.fm,
+      body: bParsed.body,
+      filePath: w.destPath,
+      mtimeMs: fs.statSync(w.destPath).mtimeMs,
+    });
+    fs.unlinkSync(w.srcPath);
+  }
+
+  const ids8 = validated.map((v) => v.id.slice(0, 8)).join(" ");
+  // D31: the submit itself is a sync event — visible in sync-status.
+  recordSync(scope.key, "submit", {
+    added: submitted.length,
+    updated: skippedIdentical.length,
+    removed: 0,
+    scanned: validated.length,
+  });
+  return {
+    branch,
+    base,
+    submitted,
+    skippedIdentical,
+    committed,
+    pushCommand: `git push -u origin ${branch}`,
+    prCommand: `gh pr create --base ${base} --title "mem: review ${validated.length} ${validated.length === 1 ? "memory" : "memories"}" --body "Submitted from the open-memex outbox: ${ids8}."`,
+  };
+}