opencode-self-improvement 0.8.0 → 0.8.1

package/README.md

@@ -41,6 +41,12 @@ LLMs waste a lot of tokens reading and re-reading your code and asking you for c
   superseded memories are rejected. Blocked writes are logged with a reason
   (`memory_evidence`), and nothing is ever deleted — updates supersede the old row and
   `memory_undo` rolls back.
+- **Safe across concurrent sessions** — the daily store file is shared by every
+  opencode session on the machine plus the viewer, so the whole-file rewrites
+  (update, forget, undo, viewer delete) hold a per-file lock that is honored
+  across processes, and hand the new file over with an atomic rename. Another
+  session's write is never overwritten, and a reader never sees a half-written
+  store.
 - Automatically looks for insights when you complete the verification gates (tests, linting, etc)
 - Always defaults to memories first before sending a prompt to the LLM, which saves tokens! 
 
@@ -182,7 +188,7 @@ Add a `plugins` entry to your opencode config —
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugins": ["opencode-self-improvement@0.3.0"]
+  "plugins": ["opencode-self-improvement"]
 }
 ```
 
@@ -190,13 +196,15 @@ Opencode installs the package (and its dependencies) automatically with Bun at
 startup. Quit and restart opencode; the plugin loads and `/repo-init` installs
 itself. Nothing else to do.
 
-Pin the exact version (as above). An unpinned entry resolves `@latest` exactly
-once and is never re-resolved afterwards, so it silently sticks. To update,
-bump the version in the config and restart. On Opencode v2 you can also manage
-it with the CLI:
+An unpinned entry resolves `@latest` exactly once and is never re-resolved
+afterwards, so updates are deliberate: `opencode plugin update
+opencode-self-improvement`. To install a specific release, append
+`@<version>` — see [npm](https://www.npmjs.com/package/opencode-self-improvement)
+for what's current — and bump it when you want to move. On Opencode v2 you
+can also manage it with the CLI:
 
 ```sh
-opencode plugin add opencode-self-improvement@0.3.0
+opencode plugin add opencode-self-improvement
 opencode plugin update opencode-self-improvement
 ```
 
@@ -398,6 +406,7 @@ Run `bun memory-view` in your terminal and visit  http://127.0.0.1:8787 in your
 | `memory_remember` says blocked | A gate rejected the write (stale code reference, a cited `path/to/file.ts` that doesn't exist in the repo, overlap with a superseded memory, or an ambiguous claim). The reason is logged — check `memory_evidence`, then rephrase against current code and retry. |
 | `invalid arguments to memory_*` | The tool call didn't match the tool's input schema — nothing was done, and the message names the offending fields. Schema validation lives at the tool boundary; gate blocks look different (`blocked at GATE (…)`). |
 | STORE shows `N malformed` | Rows in a daily file have a `ts=` that is not a valid ISO instant (typically a hand-edit gone wrong). Every reader skips them; fix the `ts=` value or restore the file with `memory_undo`. |
+| `memory store is busy`, or a stray `*.logfmt.lock` | Another session or the viewer has held that store file for over 5s. Ordinary writes proceed anyway; only `memory_undo` and the viewer's restore refuse, because a forced rollback under a live writer would drop rows nobody agreed to drop. Retry. A lock left behind by a killed process is taken over after 10s; `*.lock` and `*.tmp` files in the store are write bookkeeping, safe to delete while nothing is writing. |
 | `/repo-init` missing from the command list | The self-install couldn't write to `~/.config/opencode/commands/` (e.g. read-only config dir). Create it, restart, or just ask the model to "init memory for this repo" — it calls the same tool. |
 | Init says `Graph: unavailable` | `codebase-memory-mcp` couldn't start (not installed, or its once-only download is blocked). Install pinned `0.11.0` via the one-liner above, or point `OPENCODE_CBM_BIN` at the binary. Scripts are still remembered without it. |
 | Stale plugin after an update | Bump the pinned version in the `plugin` entry (or `opencode plugin update opencode-self-improvement` on v2) and restart opencode. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/blocklist.ts

@@ -5,7 +5,8 @@
 // memory scan must never pick it up.
 import { join } from "node:path";
 import { memoryRoot } from "./config.ts";
-import { appendLog, formatLine, parseLine, readLines } from "./logfmt.ts";
+import { appendLog, formatLine, parseLine, readLines, writeAtomic } from "./logfmt.ts";
+import { withStoreLock, LOCK_WRITE } from "./lock.ts";
 
 const BLOCKLIST_FILENAME = "blocklist.logfmt";
 
@@ -40,17 +41,31 @@ export async function blockedTs(): Promise<Set<string>> {
 
 export async function addBlock(ts: string, reason: string): Promise<string> {
   if (!reason.trim()) throw new Error("reason is required to block a memory");
-  await appendLog(blocklistFile(), formatLine({ ts, reason, blocked_at: new Date().toISOString() }));
+  const file = blocklistFile();
+  await withStoreLock(
+    file,
+    () => appendLog(file, formatLine({ ts, reason, blocked_at: new Date().toISOString() })),
+    LOCK_WRITE,
+  );
   return ts;
 }
 
+// Unblocking filters the file down, so it republishes it whole: both paths hold
+// the blocklist lock or the slower one loses the other's entries.
 export async function removeBlock(ts: string): Promise<boolean> {
-  const file = Bun.file(blocklistFile());
-  if (!(await file.exists())) return false;
-  const kept = (await file.text()).split("\n").filter((l) => {
-    const f = parseLine(l);
-    return !(f && f.ts === ts);
-  });
-  await Bun.write(blocklistFile(), kept.join("\n") + (kept.length ? "\n" : ""));
-  return true;
-}
+  const file = blocklistFile();
+  return withStoreLock(
+    file,
+    async () => {
+      const store = Bun.file(file);
+      if (!(await store.exists())) return false;
+      const kept = (await store.text()).split("\n").filter((l) => {
+        const row = parseLine(l);
+        return !(row && row.ts === ts);
+      });
+      await writeAtomic(file, kept.join("\n") + (kept.length ? "\n" : ""));
+      return true;
+    },
+    LOCK_WRITE,
+  );
+}

package/src/index.ts

@@ -415,7 +415,8 @@ const impl = {
             const kept = res.mode === "merge" && (res.concurrentAdded.length || res.concurrentChanged.length)
               ? ` Kept ${res.concurrentAdded.length} added / ${res.concurrentChanged.length} changed row(s) written after the snapshot.`
               : "";
-            return { content: `Restored ${basename(res.target)} from ${res.mode} snapshot -> ${res.target}.${kept}` };
+            const safety = res.safety ? ` Pre-restore file snapshotted -> ${res.safety}.` : "";
+            return { content: `Restored ${basename(res.target)} from ${res.mode} snapshot -> ${res.target}.${kept}${safety}` };
           }
           const snaps = await listSnapshots();
           if (!snaps.length) return { content: "No snapshots" };

package/src/lock.ts

@@ -0,0 +1,202 @@
+// Serialization for the store's write paths.
+//
+// Daily store files are shared by every opencode session on the machine plus
+// the viewer, which is a separate process. Appending is atomic on its own
+// (O_APPEND, see logfmt.ts), but supersede, prune, viewer delete and snapshot
+// restore each REWRITE a whole file: a writer that read before someone else
+// wrote publishes a stale copy and silently drops the other's rows. Measured
+// before this module existed: 40 concurrent appends against 40 supersedes left
+// 40 rows on disk; four processes writing one store kept 20 of 120.
+//
+// One lock per store file, held across the whole read-modify-write. Appends take
+// the same lock so they cannot land inside an RMW window. Two layers, sharing
+// one timeout budget:
+//   - a FIFO hand-off between async tasks in THIS process, so contending
+//     writers take their turn instead of spinning;
+//   - a lock FILE created with O_EXCL, which is atomic across processes (and
+//     exclusive against our own tasks too, since the check is in the kernel).
+// A killed holder is recovered by age. A writer that waits past the budget
+// gives up waiting — see onTimeout.
+//
+// Readers take NO lock: publishers hand over the new file with a rename
+// (writeAtomic in logfmt.ts), so a reader always sees a complete store, never
+// the middle of a rewrite.
+import { mkdir, open, stat, unlink } from "node:fs/promises";
+import { basename, dirname } from "node:path";
+import { record } from "./evidence.ts";
+
+const LOCK_SUFFIX = ".lock";
+// A lock older than this belongs to a process that died holding it.
+const STALE_MS = 10_000;
+const DEFAULT_TIMEOUT_MS = 5_000;
+const MIN_BACKOFF_MS = 1;
+const MAX_BACKOFF_MS = 25;
+
+export function lockFileFor(file: string): string {
+  return file + LOCK_SUFFIX;
+}
+
+/** Waiting past the timeout, or taking over a dead holder's lock. */
+export type LockEvent = "steal" | "timeout";
+
+export interface LockOptions {
+  timeoutMs?: number;
+  /**
+   * What waiting past `timeoutMs` means. "fail" refuses the mutation (for
+   * callers where proceeding unlocked could destroy more than it saves, e.g.
+   * snapshot restore). "proceed" runs it anyway: strictly no worse than the
+   * pre-lock behaviour, and it never costs a user their write.
+   */
+  onTimeout?: "proceed" | "fail";
+  onEvent?: (event: LockEvent, waitedMs: number) => void;
+}
+
+// How each store caller treats contention. An ordinary write PROCEEDS past the
+// timeout rather than lose the user's memory, and the wait is audited; restore
+// fails closed, because "force" drops rows and must not guess under a racing
+// writer.
+export const LOCK_WRITE: LockOptions = {
+  onEvent: (event, waitedMs) => {
+    void record("store_lock", { event, waited_ms: waitedMs, op: "write" });
+  },
+};
+
+export const LOCK_RESTORE: LockOptions = {
+  onTimeout: "fail",
+  onEvent: (event, waitedMs) => {
+    void record("store_lock", { event, waited_ms: waitedMs, op: "restore" });
+  },
+};
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+// Resolves when the task stored as this key has finished, handing the turn to
+// whoever queued after it.
+const turns = new Map<string, Promise<void>>();
+
+async function timed(prev: Promise<void>, ms: number): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const gained = await Promise.race([
+    prev.then(() => true),
+    new Promise<boolean>((res) => (timer = setTimeout(() => res(false), ms))),
+  ]);
+  clearTimeout(timer);
+  return gained;
+}
+
+async function stealIfStale(lockPath: string, now: number): Promise<boolean> {
+  let age = -1;
+  try {
+    age = now - (await stat(lockPath)).mtimeMs;
+  } catch {
+    return true; // vanished between EEXIST and stat: retry the create
+  }
+  if (age < STALE_MS) return false;
+  try {
+    await unlink(lockPath);
+  } catch {
+    return false; // another stealer won; its create decides
+  }
+  return true;
+}
+
+/** Cross-process half: hold the lock file while `fn` runs. */
+async function holdFileLock<T>(
+  lockPath: string,
+  file: string,
+  fn: () => Promise<T>,
+  opts: LockOptions,
+  budgetMs: number,
+): Promise<T> {
+  await mkdir(dirname(lockPath), { recursive: true });
+  const token = `${process.pid}-${Math.random().toString(36).slice(2)}`;
+  const started = Date.now();
+  let backoff = MIN_BACKOFF_MS;
+  for (;;) {
+    try {
+      const handle = await open(lockPath, "wx");
+      try {
+        await handle.write(token);
+      } finally {
+        await handle.close();
+      }
+      break;
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") throw err;
+      if (await stealIfStale(lockPath, Date.now())) {
+        opts.onEvent?.("steal", Date.now() - started);
+        continue;
+      }
+      if (Date.now() - started >= budgetMs) {
+        opts.onEvent?.("timeout", Date.now() - started);
+        if (opts.onTimeout === "fail") {
+          throw new Error(
+            `memory store is busy: ${basename(file)} has been locked for ${Date.now() - started}ms — retry`,
+          );
+        }
+        return fn();
+      }
+      await sleep(backoff);
+      backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    // Never release a lock that is no longer ours: if we ran long and someone
+    // stole it, unlinking would clobber the new holder.
+    try {
+      if ((await Bun.file(lockPath).text()) === token) await unlink(lockPath);
+    } catch {
+      // already gone
+    }
+  }
+}
+
+/**
+ * Run `fn` as the only writer of `file`, in this process and every other one.
+ * Sections run flat: calling this again for the same file from inside `fn`
+ * waits for its own lock.
+ */
+export async function withStoreLock<T>(
+  file: string,
+  fn: () => Promise<T>,
+  opts: LockOptions = {},
+): Promise<T> {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const started = Date.now();
+  const lockPath = lockFileFor(file);
+
+  let releaseTurn!: () => void;
+  const myTurnEnded = new Promise<void>((res) => (releaseTurn = res));
+  const queuedBehind = turns.get(file);
+  turns.set(file, myTurnEnded);
+
+  const finish = () => {
+    releaseTurn();
+    if (turns.get(file) === myTurnEnded) turns.delete(file);
+  };
+
+  if (queuedBehind) {
+    const gained = await timed(queuedBehind, timeoutMs);
+    if (!gained) {
+      // Give up our place in line rather than park everyone behind us on a
+      // writer that is not going to finish.
+      finish();
+      opts.onEvent?.("timeout", Date.now() - started);
+      if (opts.onTimeout === "fail") {
+        throw new Error(
+          `memory store is busy: ${basename(file)} has been locked for ${Date.now() - started}ms — retry`,
+        );
+      }
+      return fn();
+    }
+  }
+
+  try {
+    return await holdFileLock(lockPath, file, fn, opts, timeoutMs - (Date.now() - started));
+  } finally {
+    finish();
+  }
+}

package/src/logfmt.ts

@@ -1,7 +1,7 @@
 // Minimal logfmt reader/writer shared by the durable store and the evidence
 // log. Field order is preserved on write so chains are diffable.
 import { dirname } from "node:path";
-import { appendFile, mkdir } from "node:fs/promises";
+import { appendFile, mkdir, rename, unlink } from "node:fs/promises";
 
 export type Fields = Record<string, unknown>;
 
@@ -88,9 +88,31 @@ export async function appendLog(file: string, line: string): Promise<void> {
   // covering interleaved async tasks in the service AND a second process
   // (the viewer) appending the same day file. Do NOT "simplify" back to
   // Bun.write with an options object: on Bun 1.4.3 that silently TRUNCATES.
+  // Appending is safe against other appenders only. Callers writing a file that
+  // is ALSO rewritten whole (a daily memory file, the blocklist) hold the store
+  // lock around this — see lock.ts.
   await appendFile(file, next);
 }
 
+// Publish whole-file content so no reader can observe a partial store. Recall,
+// injection and the viewer read these files without taking the lock, so the
+// handover is a same-directory rename (atomic on POSIX): a reader sees either
+// the previous file or the new one, never a truncated middle. Callers hold the
+// store lock for the whole read-modify-write.
+export async function writeAtomic(file: string, content: string): Promise<void> {
+  await ensureDir(dirname(file));
+  // One writer per file (the store lock), so the temp name is stable per
+  // process and a crash leaves one leftover instead of one per attempt.
+  const tmp = `${file}.${process.pid}.tmp`;
+  try {
+    await Bun.write(tmp, content);
+    await rename(tmp, file);
+  } catch (err) {
+    await unlink(tmp).catch(() => undefined);
+    throw err;
+  }
+}
+
 export async function readLines(file: string): Promise<string[]> {
   const f = Bun.file(file);
   if (!(await f.exists())) return [];

package/src/memory.ts

@@ -3,11 +3,13 @@
 // vendor/opencode-memory/LICENSE) and extends it with the fields the write-gate
 // needs: supersession markers, snapshots and audited deletion.
 import { existsSync } from "node:fs";
+import { open } from "node:fs/promises";
 import { join, basename } from "node:path";
-import { memoryRoot, deletionsFile, snapshotDir } from "./config.ts";
+import { dateStr, memoryRoot, deletionsFile, snapshotDir } from "./config.ts";
 import { repoScopeFor } from "./repokey.ts";
 import { getCurrent } from "./state.ts";
-import { appendLog, ensureDir, formatLine, parseLine, readLines } from "./logfmt.ts";
+import { appendLog, ensureDir, formatLine, parseLine, readLines, writeAtomic, type Fields } from "./logfmt.ts";
+import { withStoreLock, LOCK_WRITE } from "./lock.ts";
 import { blockedTs } from "./blocklist.ts";
 
 export type MemoryStatus = "open" | "settled";
@@ -143,16 +145,15 @@ export interface AppendMemoryInput {
   repoPath?: string;
 }
 
-// Existing ts values across all memory files, used to guarantee uniqueness of
-// newly appended entries (a fast seed->append within one millisecond would
-// otherwise collide on the ISO timestamp).
-async function existingTs(): Promise<Set<string>> {
+// ts values already in `file`. An appended row's ts is "now", so the only rows
+// it can collide with are ones this same file received in the same millisecond;
+// scanning just it keeps the locked section to one read of one file. (A row
+// hand-placed with today's ts in another day's file is outside this promise.)
+async function existingTs(file: string): Promise<Set<string>> {
   const set = new Set<string>();
-  for (const file of await memoryFiles()) {
-    for (const line of await readLines(file)) {
-      const f = parseLine(line);
-      if (f && typeof f.ts === "string") set.add(f.ts);
-    }
+  for (const line of await readLines(file)) {
+    const f = parseLine(line);
+    if (f && typeof f.ts === "string") set.add(f.ts);
   }
   return set;
 }
@@ -166,17 +167,11 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   if (input.content.length > MAX_CONTENT_CHARS) {
     throw new Error(`memory content exceeds ${MAX_CONTENT_CHARS} chars (${input.content.length})`);
   }
-  const taken = await existingTs();
-  let ts = new Date().toISOString();
-  let guard = 0;
-  while (taken.has(ts) && guard++ < 1000) {
-    ts = new Date(new Date(ts).getTime() + 1).toISOString();
-  }
-  // Repo stamp at the single write choke point: gated writes,
-  // viewer restores and edits all pass through here. Explicit "global"
-  // survives; an unscoped process (viewer) stamps nothing = global. Session
-  // identity wins over the module scope so a server hosting several workspaces
-  // stamps the writing session's repo.
+  // Repo stamp at the single write choke point: gated writes, viewer restores
+  // and edits all pass through here. Explicit "global" survives; an unscoped
+  // process (viewer) stamps nothing = global. Session identity wins over the
+  // module scope so a server hosting several workspaces stamps the writing
+  // session's repo.
   let repo = input.repo;
   let repoPath = input.repoPath;
   if (repo === undefined) {
@@ -186,22 +181,36 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
       repoPath = cur.path;
     }
   }
-  const file = join(memoryRoot(), `${ts.split("T")[0]}.logfmt`);
-  await appendLog(
-    file,
-    formatLine({
-      ts,
-      type: input.type,
-      scope: input.scope,
-      content: input.content,
-      issue: input.issue,
-      tags: input.tags?.length ? input.tags.join(",") : undefined,
-      status: input.status,
-      repo,
-      repoPath,
-    }),
-  );
-  return ts;
+  // Day file chosen before the lock (it IS the lock key). A ts bumped across
+  // midnight therefore lands under the previous day's name; readers glob every
+  // file and decay compares ts values, so the grouping is cosmetic.
+  const file = join(memoryRoot(), `${dateStr()}.logfmt`);
+  // Locked end to end: seeding ts from a scan another process can race yields
+  // two rows with the same identity, and an append that lands inside someone
+  // else's whole-file rewrite is simply not there afterwards.
+  return withStoreLock(file, async () => {
+    const taken = await existingTs(file);
+    let ts = new Date().toISOString();
+    let guard = 0;
+    while (taken.has(ts) && guard++ < 1000) {
+      ts = new Date(new Date(ts).getTime() + 1).toISOString();
+    }
+    await appendLog(
+      file,
+      formatLine({
+        ts,
+        type: input.type,
+        scope: input.scope,
+        content: input.content,
+        issue: input.issue,
+        tags: input.tags?.length ? input.tags.join(",") : undefined,
+        status: input.status,
+        repo,
+        repoPath,
+      }),
+    );
+    return ts;
+  }, LOCK_WRITE);
 }
 
 export interface SupersedeFields {
@@ -213,44 +222,52 @@ export interface SupersedeFields {
   entity?: string;
 }
 
-// Copy `file` into snapshots/ before a mutation. Names follow
-// `<stamp>-<original>` because /undo strips the stamp to find its target, so a
-// same-millisecond collision would clobber an earlier, still-undoable snapshot
-// (supersede + clear in one merge_review can land in the same millisecond).
+// Copy `file` into snapshots/ before a mutation.
 async function snapshotBefore(file: string): Promise<void> {
-  await ensureDir(snapshotDir());
-  let stamp = Date.now();
-  let snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
-  while (await Bun.file(snap).exists()) snap = join(snapshotDir(), `${++stamp}-${basename(file)}`);
-  await Bun.write(snap, (await Bun.file(file).text()) || "");
+  await snapshotFiles([file]);
+}
+
+// Read-modify-write ONE row of a store file: read, rewrite the line, publish
+// atomically, all under the store lock, so an append or another rewrite by a
+// concurrent session cannot be overwritten by our stale copy. Resolves to null
+// when the row is not in this file, otherwise the mutation's outcome.
+async function stampRow(
+  file: string,
+  ts: string,
+  mutate: (fields: Fields) => string | null,
+): Promise<boolean | null> {
+  return withStoreLock(
+    file,
+    async () => {
+      const lines = await readLines(file);
+      const idx = lines.findIndex((l) => {
+        const f = parseLine(l);
+        return f && f.ts === ts;
+      });
+      if (idx === -1) return null;
+      const parsed = parseLine(lines[idx]);
+      if (!parsed) return false;
+      const next = mutate(parsed);
+      if (next === null) return false;
+      lines[idx] = next;
+      await snapshotBefore(file);
+      await writeAtomic(file, lines.join("\n") + "\n");
+      return true;
+    },
+    LOCK_WRITE,
+  );
 }
 
 // Mark an existing memory as superseded IN PLACE (entry retained, recoverable).
 // Idempotent: a second call is a no-op, so no double `superseded_by`.
 export async function markSuperseded(ts: string, fields: SupersedeFields): Promise<boolean> {
   for (const file of await memoryFiles()) {
-    const lines = await readLines(file);
-    const idx = lines.findIndex((l) => {
-      const f = parseLine(l);
-      return f && f.ts === ts;
-    });
-    if (idx === -1) continue;
-    const parsed = parseLine(lines[idx]);
-    if (parsed && typeof parsed.superseded_by === "string") return false;
-    // Rewrite the whole line rather than appending to it, so an old-format line
+    // The whole line is rewritten rather than extended, so an old-format line
     // comes out in the current format with its values unchanged.
-    lines[idx] = formatLine({
-      ...parsed,
-      superseded_by: fields.superseded_by,
-      reason: fields.reason,
-      symbol: fields.symbol,
-      from: fields.from,
-      to: fields.to,
-      entity: fields.entity,
-    });
-    await snapshotBefore(file);
-    await Bun.write(file, lines.join("\n") + "\n");
-    return true;
+    const outcome = await stampRow(file, ts, (parsed) =>
+      typeof parsed.superseded_by === "string" ? null : formatLine({ ...parsed, ...fields }),
+    );
+    if (outcome !== null) return outcome;
   }
   return false;
 }
@@ -260,25 +277,18 @@ export async function markSuperseded(ts: string, fields: SupersedeFields): Promi
 // even when an earlier row — now the loser — had superseded it first.
 export async function clearSuperseded(ts: string): Promise<boolean> {
   for (const file of await memoryFiles()) {
-    const lines = await readLines(file);
-    const idx = lines.findIndex((l) => {
-      const f = parseLine(l);
-      return f && f.ts === ts;
+    const outcome = await stampRow(file, ts, (parsed) => {
+      if (typeof parsed.superseded_by !== "string") return null;
+      // These five keys are written only by markSuperseded (drift, canonical,
+      // update and merge_review), never by appendMemory, so they are all part of
+      // the marker and go with it. Field order round-trips because parseLine
+      // inserts keys in source order.
+      for (const key of ["superseded_by", "reason", "symbol", "from", "to", "entity"]) {
+        delete parsed[key];
+      }
+      return formatLine(parsed);
     });
-    if (idx === -1) continue;
-    const parsed = parseLine(lines[idx]);
-    if (!parsed || typeof parsed.superseded_by !== "string") return false;
-    // These five keys are written only by markSuperseded (drift, canonical,
-    // update and merge_review), never by appendMemory, so they are all part of
-    // the marker and go with it. Field order round-trips because parseLine
-    // inserts keys in source order.
-    for (const key of ["superseded_by", "reason", "symbol", "from", "to", "entity"]) {
-      delete parsed[key];
-    }
-    lines[idx] = formatLine(parsed);
-    await snapshotBefore(file);
-    await Bun.write(file, lines.join("\n") + "\n");
-    return true;
+    if (outcome !== null) return outcome;
   }
   return false;
 }
@@ -334,24 +344,35 @@ export interface DeletedMemory {
   reason: string;
 }
 
+// Claim a snapshot name with O_EXCL so "never overwrite a snapshot" holds
+// across processes, not just inside one: two sessions mutating the same file in
+// one millisecond both bump instead of one clobbering the other's still-undoable
+// copy. Names are `<epoch-ms>-<original>` because /undo strips the leading stamp
+// to find its target, so nothing may go in front of it.
+async function claimSnapshot(file: string): Promise<string> {
+  await ensureDir(snapshotDir());
+  let stamp = Date.now();
+  for (;;) {
+    const snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
+    try {
+      const handle = await open(snap, "wx");
+      await handle.close();
+      return snap;
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+      stamp++;
+    }
+  }
+}
+
 // Snapshot-before-mutate: copy each affected file into snapshots/ so /undo can
 // restore it. Returns the snapshot paths keyed by original file.
 export async function snapshotFiles(files: string[]): Promise<string[]> {
-  await ensureDir(snapshotDir());
-  let stamp = Date.now();
   const snaps: string[] = [];
   for (const file of files) {
     const f = Bun.file(file);
     if (!(await f.exists())) continue;
-    // Names must be unique: a `${Date.now()}-` stamp collides whenever two
-    // mutations happen in the same millisecond, and a clobbered snapshot once
-    // let a restore read post-edit content. Bump until free; never overwrite
-    // a snapshot.
-    let snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
-    while (await Bun.file(snap).exists()) {
-      stamp++;
-      snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
-    }
+    const snap = await claimSnapshot(file);
     await Bun.write(snap, await f.text());
     snaps.push(snap);
   }
@@ -379,30 +400,39 @@ export interface PruneResult {
 }
 
 // Remove matching memories (used by memory_forget), snapshotting first and
-// logging every deletion with its reason.
+// logging every deletion with its reason. Each file is filtered and republished
+// under the store lock, so a row another session appended while we were reading
+// is not quietly filtered out along with the targets.
 export async function prune(scope: string, type: string, reason: string): Promise<PruneResult> {
-  const files = await memoryFiles();
-  const snapshot = await snapshotFiles(files);
   const deleted: DeletedMemory[] = [];
-  for (const file of files) {
-    const lines = await readLines(file);
-    const kept: string[] = [];
-    let changed = false;
-    for (const line of lines) {
-      const parsed = parseLine(line);
-      const m = parsed ? toMemory(parsed, file, 0) : null;
-      // Repo floor: forgetting scope X here must never delete
-      // another repo's row for scope X — same basename collisions are real
-      // (a fork next to its upstream).
-      if (m && m.scope === scope && m.type === type && isVisibleHere(m)) {
-        deleted.push({ memory: m, reason });
-        await logDeletion(m, reason);
-        changed = true;
-        continue;
-      }
-      kept.push(line);
-    }
-    if (changed) await Bun.write(file, kept.join("\n") + (kept.length ? "\n" : ""));
+  const snapshot: string[] = [];
+  for (const file of await memoryFiles()) {
+    await withStoreLock(
+      file,
+      async () => {
+        const lines = await readLines(file);
+        const kept: string[] = [];
+        let changed = false;
+        for (const line of lines) {
+          const parsed = parseLine(line);
+          const m = parsed ? toMemory(parsed, file, 0) : null;
+          // Repo floor: forgetting scope X here must never delete
+          // another repo's row for scope X — same basename collisions are real
+          // (a fork next to its upstream).
+          if (m && m.scope === scope && m.type === type && isVisibleHere(m)) {
+            deleted.push({ memory: m, reason });
+            await logDeletion(m, reason);
+            changed = true;
+            continue;
+          }
+          kept.push(line);
+        }
+        if (!changed) return;
+        snapshot.push(...(await snapshotFiles([file])));
+        await writeAtomic(file, kept.join("\n") + (kept.length ? "\n" : ""));
+      },
+      LOCK_WRITE,
+    );
   }
   return { deleted, snapshot };
 }

package/src/undo.ts

@@ -3,15 +3,18 @@
 //
 // Daily logfmt files are SHARED across concurrent sessions, so a naive
 // whole-file write can silently clobber rows another session appended after
-// the snapshot. Restore is therefore
-// conflict-aware. The snapshot cannot tell "rows I added since the snapshot,
-// which undo should remove" apart from "rows another session added, which
-// must survive" — that call belongs to the caller, so the default mode CHECK
-// refuses and lists the divergent rows; MERGE replays them on top of the
-// snapshot; FORCE is the old exact rollback.
+// the snapshot. Restore is therefore conflict-aware: the snapshot cannot tell
+// "rows I added since the snapshot, which undo should remove" apart from
+// "rows another session added, which must survive", so that call belongs to
+// the caller. The default mode CHECK refuses and lists the divergent rows;
+// MERGE replays them on top of the snapshot; FORCE is the old exact rollback,
+// and additionally snapshots the file it replaces, so the state it drops stays
+// undoable (result.safety).
 import { basename, join, resolve, sep } from "node:path";
 import { snapshotDir } from "./config.ts";
-import { ensureDir } from "./logfmt.ts";
+import { ensureDir, writeAtomic } from "./logfmt.ts";
+import { withStoreLock, LOCK_RESTORE } from "./lock.ts";
+import { snapshotFiles } from "./memory.ts";
 
 export interface SnapshotInfo {
   file: string;
@@ -45,6 +48,9 @@ export interface RestoreResult {
   target: string;
   restored: boolean;
   mode: RestoreMode;
+  // Snapshot of the file as it stood the moment the restore held the lock —
+  // present on a force restore, which is the mode that drops rows.
+  safety?: string;
   // ts of rows present in the CURRENT file but absent from the snapshot
   // (added after it — or in-place edits, listed under their original ts).
   concurrentAdded: string[];
@@ -87,37 +93,55 @@ export async function restoreSnapshot(
     throw new Error(`snapshot target escapes the memory root: ${original}`);
   }
   const snapLines = rows(await f.text());
-  const cur = Bun.file(target);
-  const curLines = (await cur.exists()) ? rows(await cur.text()) : [];
 
-  const snapByKey = new Map(snapLines.map((l) => [rowKey(l), l]));
-  const concurrentAdded: string[] = [];
-  const concurrentChanged: string[] = [];
-  const curByKey = new Map<string, string>();
-  for (const l of curLines) {
-    const k = rowKey(l);
-    curByKey.set(k, l);
-    const s = snapByKey.get(k);
-    if (s === undefined) concurrentAdded.push(k);
-    else if (s !== l) concurrentChanged.push(k);
-  }
+  // Comparing and publishing happen under the same lock: a divergence check on
+  // a stale read would wave through a row that landed after it. A restore waits
+  // for the store rather than proceeding unlocked, because "force" deliberately
+  // drops rows — doing that on top of a racing writer would drop rows nobody
+  // agreed to drop.
+  return withStoreLock(
+    target,
+    async () => {
+      const cur = Bun.file(target);
+      const curLines = (await cur.exists()) ? rows(await cur.text()) : [];
 
-  if (mode === "check" && (concurrentAdded.length || concurrentChanged.length)) {
-    return { target, restored: false, mode, concurrentAdded, concurrentChanged };
-  }
+      const snapByKey = new Map(snapLines.map((l) => [rowKey(l), l]));
+      const concurrentAdded: string[] = [];
+      const concurrentChanged: string[] = [];
+      const curByKey = new Map<string, string>();
+      for (const l of curLines) {
+        const k = rowKey(l);
+        curByKey.set(k, l);
+        const s = snapByKey.get(k);
+        if (s === undefined) concurrentAdded.push(k);
+        else if (s !== l) concurrentChanged.push(k);
+      }
 
-  let out = snapLines;
-  if (mode === "merge") {
-    // Keep the CURRENT version of rows the snapshot also has (in-place edits —
-    // e.g. a supersede stamp — made after the snapshot win), then append the
-    // rows the snapshot never saw. Merge is a deliberate superset: rows the
-    // snapshotter wrote after the snapshot are NOT dropped here; choose FORCE
-    // for that.
-    out = snapLines.map((l) => curByKey.get(rowKey(l)) ?? l).concat(
-      curLines.filter((l) => !snapByKey.has(rowKey(l))),
-    );
-  }
-  await ensureDir(memoryRootDir);
-  await Bun.write(target, out.length ? out.join("\n") + "\n" : "");
-  return { target, restored: true, mode, concurrentAdded, concurrentChanged };
+      if (mode === "check" && (concurrentAdded.length || concurrentChanged.length)) {
+        return { target, restored: false, mode, concurrentAdded, concurrentChanged };
+      }
+
+      // FORCE is the mode that drops rows, so the file it replaces is
+      // snapshotted HERE — inside the lock, which is what makes rows a
+      // concurrent session appended moments earlier part of the copy. A caller
+      // that snapshots before this call races the very write it means to save.
+      const safety = mode === "force" ? (await snapshotFiles([target]))[0] : undefined;
+
+      let out = snapLines;
+      if (mode === "merge") {
+        // Keep the CURRENT version of rows the snapshot also has (in-place edits —
+        // e.g. a supersede stamp — made after the snapshot win), then append the
+        // rows the snapshot never saw. Merge is a deliberate superset: rows the
+        // snapshotter wrote after the snapshot are NOT dropped here; choose FORCE
+        // for that.
+        out = snapLines.map((l) => curByKey.get(rowKey(l)) ?? l).concat(
+          curLines.filter((l) => !snapByKey.has(rowKey(l))),
+        );
+      }
+      await ensureDir(memoryRootDir);
+      await writeAtomic(target, out.length ? out.join("\n") + "\n" : "");
+      return { target, restored: true, mode, safety, concurrentAdded, concurrentChanged };
+    },
+    LOCK_RESTORE,
+  );
 }

package/src/viewer/mutate.ts

@@ -9,7 +9,8 @@
 import { deletionsFile } from "../config.ts";
 import { addBlock, removeBlock } from "../blocklist.ts";
 import { record, chainId } from "../evidence.ts";
-import { appendLog, formatLine, parseLine, readLines } from "../logfmt.ts";
+import { appendLog, formatLine, parseLine, readLines, writeAtomic } from "../logfmt.ts";
+import { withStoreLock, LOCK_WRITE } from "../lock.ts";
 import {
   appendMemory,
   loadAll,
@@ -99,14 +100,23 @@ export async function deleteMemory(input: DeleteInput): Promise<MutationResult>
   const chain = chainId();
   const target = await findMemory(input.ts);
 
-  const snapshot = await snapshotFiles([target.file]);
-  const lines = await readLines(target.file);
-  const kept = lines.filter((l) => {
-    const f = parseLine(l);
-    return !(f && f.ts === input.ts);
-  });
-  if (kept.length === lines.length) throw new Error(`memory line not found: ${input.ts}`);
-  await Bun.write(target.file, kept.join("\n") + (kept.length ? "\n" : ""));
+  // Snapshot, filter and republish happen as one locked step, so a row another
+  // session appended while we read cannot be filtered out with the target.
+  let snapshot: string[] = [];
+  await withStoreLock(
+    target.file,
+    async () => {
+      const lines = await readLines(target.file);
+      const kept = lines.filter((l) => {
+        const f = parseLine(l);
+        return !(f && f.ts === input.ts);
+      });
+      if (kept.length === lines.length) throw new Error(`memory line not found: ${input.ts}`);
+      snapshot = await snapshotFiles([target.file]);
+      await writeAtomic(target.file, kept.join("\n") + (kept.length ? "\n" : ""));
+    },
+    LOCK_WRITE,
+  );
 
   await audit("deleted", target, input.ts, undefined, input.reason);
   await record("prune", {

package/src/viewer/server.ts

@@ -11,7 +11,7 @@ import { BlockBody, DeleteBody, EditBody, RestoreEntryBody, UnblockBody } from "
 import { deletionsFile, memoryRoot, snapshotDir } from "../config.ts";
 import { blockedEntries } from "../blocklist.ts";
 import { listSnapshots, restoreSnapshot } from "../undo.ts";
-import { appendMemory, loadAll, memoryFiles, snapshotFiles } from "../memory.ts";
+import { appendMemory, loadAll, memoryFiles } from "../memory.ts";
 import { parseLine, readLines } from "../logfmt.ts";
 import { deleteMemory, editMemory, addBlock, removeBlock, type MutationResult } from "./mutate.ts";
 
@@ -269,14 +269,14 @@ async function restoreRoute(body: Record<string, unknown>): Promise<Response> {
   if (!/^\d+-\d{4}-\d{2}-\d{2}\.logfmt$/.test(name)) {
     return error("invalid snapshot name", 400);
   }
-  const original = name.replace(/^\d+-/, "");
-  // Explicit human admin action: exact rollback — but the rollback is itself
-  // rollback-able. Snapshot the current file first so concurrent-session rows
-  // lost here stay recoverable, and report how many rows were rolled back.
-  await snapshotFiles([join(memoryRoot(), original)]);
+  // Explicit human admin action: exact rollback. The pre-restore snapshot the
+  // dropped rows can be recovered from is taken by restoreSnapshot itself,
+  // under the store lock — snapshotting here instead would miss anything
+  // another session appended between this call and the rollback.
   const res = await restoreSnapshot(join(snapshotDir(), name), memoryRoot(), "force");
   return json({
     restored: res.target,
+    safety: res.safety ?? null,
     rolledBack: res.concurrentAdded.length + res.concurrentChanged.length,
   });
 }