opencode-self-improvement 0.8.0 → 0.8.2

package/README.md

@@ -41,6 +41,12 @@ LLMs waste a lot of tokens reading and re-reading your code and asking you for c
   superseded memories are rejected. Blocked writes are logged with a reason
   (`memory_evidence`), and nothing is ever deleted — updates supersede the old row and
   `memory_undo` rolls back.
+- **Safe across concurrent sessions** — the daily store file is shared by every
+  opencode session on the machine plus the viewer, so the whole-file rewrites
+  (update, forget, undo, viewer delete) hold a per-file lock that is honored
+  across processes, and hand the new file over with an atomic rename. Another
+  session's write is never overwritten, and a reader never sees a half-written
+  store.
 - Automatically looks for insights when you complete the verification gates (tests, linting, etc)
 - Always defaults to memories first before sending a prompt to the LLM, which saves tokens! 
 
@@ -182,7 +188,7 @@ Add a `plugins` entry to your opencode config —
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugins": ["opencode-self-improvement@0.3.0"]
+  "plugins": ["opencode-self-improvement"]
 }
 ```
 
@@ -190,13 +196,15 @@ Opencode installs the package (and its dependencies) automatically with Bun at
 startup. Quit and restart opencode; the plugin loads and `/repo-init` installs
 itself. Nothing else to do.
 
-Pin the exact version (as above). An unpinned entry resolves `@latest` exactly
-once and is never re-resolved afterwards, so it silently sticks. To update,
-bump the version in the config and restart. On Opencode v2 you can also manage
-it with the CLI:
+An unpinned entry resolves `@latest` exactly once and is never re-resolved
+afterwards, so updates are deliberate: `opencode plugin update
+opencode-self-improvement`. To install a specific release, append
+`@<version>` — see [npm](https://www.npmjs.com/package/opencode-self-improvement)
+for what's current — and bump it when you want to move. On Opencode v2 you
+can also manage it with the CLI:
 
 ```sh
-opencode plugin add opencode-self-improvement@0.3.0
+opencode plugin add opencode-self-improvement
 opencode plugin update opencode-self-improvement
 ```
 
@@ -398,6 +406,7 @@ Run `bun memory-view` in your terminal and visit  http://127.0.0.1:8787 in your
 | `memory_remember` says blocked | A gate rejected the write (stale code reference, a cited `path/to/file.ts` that doesn't exist in the repo, overlap with a superseded memory, or an ambiguous claim). The reason is logged — check `memory_evidence`, then rephrase against current code and retry. |
 | `invalid arguments to memory_*` | The tool call didn't match the tool's input schema — nothing was done, and the message names the offending fields. Schema validation lives at the tool boundary; gate blocks look different (`blocked at GATE (…)`). |
 | STORE shows `N malformed` | Rows in a daily file have a `ts=` that is not a valid ISO instant (typically a hand-edit gone wrong). Every reader skips them; fix the `ts=` value or restore the file with `memory_undo`. |
+| `memory store is busy`, or a stray `*.logfmt.lock` | Another session or the viewer has held that store file for over 5s. Ordinary writes proceed anyway; only `memory_undo` and the viewer's restore refuse, because a forced rollback under a live writer would drop rows nobody agreed to drop. Retry. A lock left behind by a killed process is taken over after 10s; `*.lock` and `*.tmp` files in the store are write bookkeeping, safe to delete while nothing is writing. |
 | `/repo-init` missing from the command list | The self-install couldn't write to `~/.config/opencode/commands/` (e.g. read-only config dir). Create it, restart, or just ask the model to "init memory for this repo" — it calls the same tool. |
 | Init says `Graph: unavailable` | `codebase-memory-mcp` couldn't start (not installed, or its once-only download is blocked). Install pinned `0.11.0` via the one-liner above, or point `OPENCODE_CBM_BIN` at the binary. Scripts are still remembered without it. |
 | Stale plugin after an update | Bump the pinned version in the `plugin` entry (or `opencode plugin update opencode-self-improvement` on v2) and restart opencode. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/blocklist.ts

@@ -5,7 +5,8 @@
 // memory scan must never pick it up.
 import { join } from "node:path";
 import { memoryRoot } from "./config.ts";
-import { appendLog, formatLine, parseLine, readLines } from "./logfmt.ts";
+import { appendLog, formatLine, parseLine, readLines, writeAtomic } from "./logfmt.ts";
+import { withStoreLock, LOCK_WRITE } from "./lock.ts";
 
 const BLOCKLIST_FILENAME = "blocklist.logfmt";
 
@@ -40,17 +41,31 @@ export async function blockedTs(): Promise<Set<string>> {
 
 export async function addBlock(ts: string, reason: string): Promise<string> {
   if (!reason.trim()) throw new Error("reason is required to block a memory");
-  await appendLog(blocklistFile(), formatLine({ ts, reason, blocked_at: new Date().toISOString() }));
+  const file = blocklistFile();
+  await withStoreLock(
+    file,
+    () => appendLog(file, formatLine({ ts, reason, blocked_at: new Date().toISOString() })),
+    LOCK_WRITE,
+  );
   return ts;
 }
 
+// Unblocking filters the file down, so it republishes it whole: both paths hold
+// the blocklist lock or the slower one loses the other's entries.
 export async function removeBlock(ts: string): Promise<boolean> {
-  const file = Bun.file(blocklistFile());
-  if (!(await file.exists())) return false;
-  const kept = (await file.text()).split("\n").filter((l) => {
-    const f = parseLine(l);
-    return !(f && f.ts === ts);
-  });
-  await Bun.write(blocklistFile(), kept.join("\n") + (kept.length ? "\n" : ""));
-  return true;
-}
+  const file = blocklistFile();
+  return withStoreLock(
+    file,
+    async () => {
+      const store = Bun.file(file);
+      if (!(await store.exists())) return false;
+      const kept = (await store.text()).split("\n").filter((l) => {
+        const row = parseLine(l);
+        return !(row && row.ts === ts);
+      });
+      await writeAtomic(file, kept.join("\n") + (kept.length ? "\n" : ""));
+      return true;
+    },
+    LOCK_WRITE,
+  );
+}

package/src/capture.ts

@@ -7,6 +7,7 @@
 // All parsing functions are TOTAL: any malformed input yields [] / "" / null,
 // never a throw.
 import { STATUSES, TYPES } from "./types.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 
 export interface CaptureOptions {
   model: string; // "provider/id"
@@ -97,10 +98,16 @@ export function parseCandidates(raw: string, max: number): CaptureCandidate[] {
       if (out.length >= max) break;
       if (!item || typeof item !== "object" || Array.isArray(item)) continue;
       const o = item as Record<string, unknown>;
-      const type = typeof o.type === "string" ? o.type.trim() : "";
-      const scope = typeof o.scope === "string" ? o.scope.trim() : "";
+      const rawType = typeof o.type === "string" ? o.type : "";
+      const rawScope = typeof o.scope === "string" ? o.scope : "";
+      const type = rawType.trim();
+      const scope = rawScope.trim();
       const content = typeof o.content === "string" ? o.content.trim() : "";
       if (!type || !scope || !content) continue;
+      if (
+        flattenMemoryText(rawType) !== rawType ||
+        flattenMemoryText(rawScope) !== rawScope
+      ) continue;
       if (!VALID_TYPES.has(type)) continue;
       if (content.length < 20 || content.length > 600) continue;
       const status = o.status === "open" || o.status === "settled" ? o.status : undefined;

package/src/gates.ts

@@ -14,6 +14,7 @@ import {
   type Memory,
 } from "./memory.ts";
 import { chainId, contentHash, record, recordWriteBlocked } from "./evidence.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 import {
   displayCall,
   extractCallForms,
@@ -222,6 +223,34 @@ export async function runWriteGate(
     };
   }
 
+  const badMetadata: string[] = ([
+    ["type", candidate.type],
+    ["scope", candidate.scope],
+    ["issue", candidate.issue],
+  ] as const)
+    .filter(
+      ([, value]) =>
+        value !== undefined &&
+        (typeof value !== "string" || flattenMemoryText(value) !== value),
+    )
+    .map(([field]) => field);
+  if (
+    candidate.tags !== undefined &&
+    (!Array.isArray(candidate.tags) ||
+      candidate.tags.some((tag) => typeof tag !== "string" || flattenMemoryText(tag) !== tag))
+  ) {
+    badMetadata.push("tags");
+  }
+  if (badMetadata.length) {
+    await recordWriteBlocked(4, "invalid_metadata", [`fields=${badMetadata.join(",")}`], chain);
+    return {
+      action: "blocked",
+      reason: "invalid_metadata",
+      chain,
+      hint: `${badMetadata.join(", ")} must not contain control characters.`,
+    };
+  }
+
   const ch = contentHash(candidate.content);
   await record("gate_start", {
     chain,

package/src/index.ts

@@ -65,6 +65,7 @@ import { getCurrent, setCurrent } from "./state.ts";
 import { resolveRepo, setRepoScope, rememberSessionDir, sessionDir } from "./repokey.ts";
 import { readLines } from "./logfmt.ts";
 import { buildCapturePrompt, flattenTranscript, parseCandidates, parseModelRef } from "./capture.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 
 // Tool/input boundaries are zod schemas (src/schema.ts): the JSON Schema the
 // host sees is GENERATED from them, and raw args are re-parsed at execution.
@@ -387,7 +388,10 @@ const impl = {
             types.set(m.type, (types.get(m.type) ?? 0) + 1);
           }
           const fmt = (map: Map<string, number>) =>
-            [...map.entries()].sort((a, b) => b[1] - a[1]).map(([k, c]) => `  ${k}: ${c}`).join("\n");
+            [...map.entries()]
+              .sort((a, b) => b[1] - a[1])
+              .map(([k, c]) => `  ${flattenMemoryText(k)}: ${c}`)
+              .join("\n");
           return { content: `Total: ${mems.length}\n\nScopes:\n${fmt(scopes)}\n\nTypes:\n${fmt(types)}` };
         },
       }));
@@ -415,7 +419,8 @@ const impl = {
             const kept = res.mode === "merge" && (res.concurrentAdded.length || res.concurrentChanged.length)
               ? ` Kept ${res.concurrentAdded.length} added / ${res.concurrentChanged.length} changed row(s) written after the snapshot.`
               : "";
-            return { content: `Restored ${basename(res.target)} from ${res.mode} snapshot -> ${res.target}.${kept}` };
+            const safety = res.safety ? ` Pre-restore file snapshotted -> ${res.safety}.` : "";
+            return { content: `Restored ${basename(res.target)} from ${res.mode} snapshot -> ${res.target}.${kept}${safety}` };
           }
           const snaps = await listSnapshots();
           if (!snaps.length) return { content: "No snapshots" };
@@ -522,7 +527,10 @@ const impl = {
             return { content: `No active open threads older than ${days} days.` };
           }
           const listing = stale
-            .map((m) => `  ${m.ts} ${m.type}/${m.scope}: ${m.content.slice(0, 100)}`)
+            .map(
+              (m) =>
+                `  ${flattenMemoryText(m.ts)} ${flattenMemoryText(m.type)}/${flattenMemoryText(m.scope)}: ${flattenMemoryText(m.content).slice(0, 100)}`,
+            )
             .join("\n");
           if (dryRun) {
             await record(

package/src/inject.ts

@@ -10,6 +10,7 @@ import { record } from "./evidence.ts";
 import { dateStr } from "./config.ts";
 import { bracketList } from "./logfmt.ts";
 import { recentConvergenceSummary } from "./triggers.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 
 export interface TransformOutput {
   system: string[];
@@ -53,9 +54,12 @@ export function formatMemory(m: Memory): string {
   // One memory is ONE line in every injected block: the store round-trips real
   // newlines, so a planted "\n## Fake header" would forge its own section and
   // escape the framing (and throw capToBudget's line accounting off). Line
-  // breaks collapse to spaces; ordinary spacing survives.
-  const content = m.content.replace(/[\r\n\t]+/g, " ");
-  return `- [${dateOf(m.ts)}]${tag}${src} ${m.type}/${m.scope}: ${content}`;
+  // breaks and other controls collapse to spaces; ordinary spacing survives.
+  const date = flattenMemoryText(dateOf(m.ts));
+  const type = flattenMemoryText(m.type);
+  const scope = flattenMemoryText(m.scope);
+  const content = flattenMemoryText(m.content);
+  return `- [${date}]${tag}${src} ${type}/${scope}: ${content}`;
 }
 
 function argText(args: unknown): string {
@@ -141,7 +145,7 @@ export async function systemDigest(
   // Repo-scoped: model-facing reads see this repo + global rows.
   const mems = visibleHere((await loadAll()).filter(isActive));
   if (!mems.length) return;
-  const latest = mems.map((m) => m.ts).sort().pop() ?? "?";
+  const latest = flattenMemoryText(mems.map((m) => m.ts).sort().pop() ?? "?");
   output.system.push(
     "\n## Persistent memory (opencode-self-improvement)\n" +
       `${mems.length} durable memories; latest: ${latest}. ` +
@@ -177,7 +181,7 @@ export async function systemDigest(
     "frontier_injected",
     {
       session: sid,
-      scopes: bracketList([...new Set(open.map((m) => m.scope))]),
+      scopes: bracketList([...new Set(open.map((m) => flattenMemoryText(m.scope)))]),
       shown: open.length,
       open_total: openMems.length,
       ts_since: dateStr(),

package/src/lock.ts

@@ -0,0 +1,202 @@
+// Serialization for the store's write paths.
+//
+// Daily store files are shared by every opencode session on the machine plus
+// the viewer, which is a separate process. Appending is atomic on its own
+// (O_APPEND, see logfmt.ts), but supersede, prune, viewer delete and snapshot
+// restore each REWRITE a whole file: a writer that read before someone else
+// wrote publishes a stale copy and silently drops the other's rows. Measured
+// before this module existed: 40 concurrent appends against 40 supersedes left
+// 40 rows on disk; four processes writing one store kept 20 of 120.
+//
+// One lock per store file, held across the whole read-modify-write. Appends take
+// the same lock so they cannot land inside an RMW window. Two layers, sharing
+// one timeout budget:
+//   - a FIFO hand-off between async tasks in THIS process, so contending
+//     writers take their turn instead of spinning;
+//   - a lock FILE created with O_EXCL, which is atomic across processes (and
+//     exclusive against our own tasks too, since the check is in the kernel).
+// A killed holder is recovered by age. A writer that waits past the budget
+// gives up waiting — see onTimeout.
+//
+// Readers take NO lock: publishers hand over the new file with a rename
+// (writeAtomic in logfmt.ts), so a reader always sees a complete store, never
+// the middle of a rewrite.
+import { mkdir, open, stat, unlink } from "node:fs/promises";
+import { basename, dirname } from "node:path";
+import { record } from "./evidence.ts";
+
+const LOCK_SUFFIX = ".lock";
+// A lock older than this belongs to a process that died holding it.
+const STALE_MS = 10_000;
+const DEFAULT_TIMEOUT_MS = 5_000;
+const MIN_BACKOFF_MS = 1;
+const MAX_BACKOFF_MS = 25;
+
+export function lockFileFor(file: string): string {
+  return file + LOCK_SUFFIX;
+}
+
+/** Waiting past the timeout, or taking over a dead holder's lock. */
+export type LockEvent = "steal" | "timeout";
+
+export interface LockOptions {
+  timeoutMs?: number;
+  /**
+   * What waiting past `timeoutMs` means. "fail" refuses the mutation (for
+   * callers where proceeding unlocked could destroy more than it saves, e.g.
+   * snapshot restore). "proceed" runs it anyway: strictly no worse than the
+   * pre-lock behaviour, and it never costs a user their write.
+   */
+  onTimeout?: "proceed" | "fail";
+  onEvent?: (event: LockEvent, waitedMs: number) => void;
+}
+
+// How each store caller treats contention. An ordinary write PROCEEDS past the
+// timeout rather than lose the user's memory, and the wait is audited; restore
+// fails closed, because "force" drops rows and must not guess under a racing
+// writer.
+export const LOCK_WRITE: LockOptions = {
+  onEvent: (event, waitedMs) => {
+    void record("store_lock", { event, waited_ms: waitedMs, op: "write" });
+  },
+};
+
+export const LOCK_RESTORE: LockOptions = {
+  onTimeout: "fail",
+  onEvent: (event, waitedMs) => {
+    void record("store_lock", { event, waited_ms: waitedMs, op: "restore" });
+  },
+};
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+// Resolves when the task stored as this key has finished, handing the turn to
+// whoever queued after it.
+const turns = new Map<string, Promise<void>>();
+
+async function timed(prev: Promise<void>, ms: number): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const gained = await Promise.race([
+    prev.then(() => true),
+    new Promise<boolean>((res) => (timer = setTimeout(() => res(false), ms))),
+  ]);
+  clearTimeout(timer);
+  return gained;
+}
+
+async function stealIfStale(lockPath: string, now: number): Promise<boolean> {
+  let age = -1;
+  try {
+    age = now - (await stat(lockPath)).mtimeMs;
+  } catch {
+    return true; // vanished between EEXIST and stat: retry the create
+  }
+  if (age < STALE_MS) return false;
+  try {
+    await unlink(lockPath);
+  } catch {
+    return false; // another stealer won; its create decides
+  }
+  return true;
+}
+
+/** Cross-process half: hold the lock file while `fn` runs. */
+async function holdFileLock<T>(
+  lockPath: string,
+  file: string,
+  fn: () => Promise<T>,
+  opts: LockOptions,
+  budgetMs: number,
+): Promise<T> {
+  await mkdir(dirname(lockPath), { recursive: true });
+  const token = `${process.pid}-${Math.random().toString(36).slice(2)}`;
+  const started = Date.now();
+  let backoff = MIN_BACKOFF_MS;
+  for (;;) {
+    try {
+      const handle = await open(lockPath, "wx");
+      try {
+        await handle.write(token);
+      } finally {
+        await handle.close();
+      }
+      break;
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") throw err;
+      if (await stealIfStale(lockPath, Date.now())) {
+        opts.onEvent?.("steal", Date.now() - started);
+        continue;
+      }
+      if (Date.now() - started >= budgetMs) {
+        opts.onEvent?.("timeout", Date.now() - started);
+        if (opts.onTimeout === "fail") {
+          throw new Error(
+            `memory store is busy: ${basename(file)} has been locked for ${Date.now() - started}ms — retry`,
+          );
+        }
+        return fn();
+      }
+      await sleep(backoff);
+      backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    // Never release a lock that is no longer ours: if we ran long and someone
+    // stole it, unlinking would clobber the new holder.
+    try {
+      if ((await Bun.file(lockPath).text()) === token) await unlink(lockPath);
+    } catch {
+      // already gone
+    }
+  }
+}
+
+/**
+ * Run `fn` as the only writer of `file`, in this process and every other one.
+ * Sections run flat: calling this again for the same file from inside `fn`
+ * waits for its own lock.
+ */
+export async function withStoreLock<T>(
+  file: string,
+  fn: () => Promise<T>,
+  opts: LockOptions = {},
+): Promise<T> {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const started = Date.now();
+  const lockPath = lockFileFor(file);
+
+  let releaseTurn!: () => void;
+  const myTurnEnded = new Promise<void>((res) => (releaseTurn = res));
+  const queuedBehind = turns.get(file);
+  turns.set(file, myTurnEnded);
+
+  const finish = () => {
+    releaseTurn();
+    if (turns.get(file) === myTurnEnded) turns.delete(file);
+  };
+
+  if (queuedBehind) {
+    const gained = await timed(queuedBehind, timeoutMs);
+    if (!gained) {
+      // Give up our place in line rather than park everyone behind us on a
+      // writer that is not going to finish.
+      finish();
+      opts.onEvent?.("timeout", Date.now() - started);
+      if (opts.onTimeout === "fail") {
+        throw new Error(
+          `memory store is busy: ${basename(file)} has been locked for ${Date.now() - started}ms — retry`,
+        );
+      }
+      return fn();
+    }
+  }
+
+  try {
+    return await holdFileLock(lockPath, file, fn, opts, timeoutMs - (Date.now() - started));
+  } finally {
+    finish();
+  }
+}

package/src/logfmt.ts

@@ -1,7 +1,7 @@
 // Minimal logfmt reader/writer shared by the durable store and the evidence
 // log. Field order is preserved on write so chains are diffable.
 import { dirname } from "node:path";
-import { appendFile, mkdir } from "node:fs/promises";
+import { appendFile, mkdir, rename, unlink } from "node:fs/promises";
 
 export type Fields = Record<string, unknown>;
 
@@ -88,9 +88,31 @@ export async function appendLog(file: string, line: string): Promise<void> {
   // covering interleaved async tasks in the service AND a second process
   // (the viewer) appending the same day file. Do NOT "simplify" back to
   // Bun.write with an options object: on Bun 1.4.3 that silently TRUNCATES.
+  // Appending is safe against other appenders only. Callers writing a file that
+  // is ALSO rewritten whole (a daily memory file, the blocklist) hold the store
+  // lock around this — see lock.ts.
   await appendFile(file, next);
 }
 
+// Publish whole-file content so no reader can observe a partial store. Recall,
+// injection and the viewer read these files without taking the lock, so the
+// handover is a same-directory rename (atomic on POSIX): a reader sees either
+// the previous file or the new one, never a truncated middle. Callers hold the
+// store lock for the whole read-modify-write.
+export async function writeAtomic(file: string, content: string): Promise<void> {
+  await ensureDir(dirname(file));
+  // One writer per file (the store lock), so the temp name is stable per
+  // process and a crash leaves one leftover instead of one per attempt.
+  const tmp = `${file}.${process.pid}.tmp`;
+  try {
+    await Bun.write(tmp, content);
+    await rename(tmp, file);
+  } catch (err) {
+    await unlink(tmp).catch(() => undefined);
+    throw err;
+  }
+}
+
 export async function readLines(file: string): Promise<string[]> {
   const f = Bun.file(file);
   if (!(await f.exists())) return [];

package/src/memory.ts

@@ -3,12 +3,15 @@
 // vendor/opencode-memory/LICENSE) and extends it with the fields the write-gate
 // needs: supersession markers, snapshots and audited deletion.
 import { existsSync } from "node:fs";
+import { open } from "node:fs/promises";
 import { join, basename } from "node:path";
-import { memoryRoot, deletionsFile, snapshotDir } from "./config.ts";
+import { dateStr, memoryRoot, deletionsFile, snapshotDir } from "./config.ts";
 import { repoScopeFor } from "./repokey.ts";
 import { getCurrent } from "./state.ts";
-import { appendLog, ensureDir, formatLine, parseLine, readLines } from "./logfmt.ts";
+import { appendLog, ensureDir, formatLine, parseLine, readLines, writeAtomic, type Fields } from "./logfmt.ts";
+import { withStoreLock, LOCK_WRITE } from "./lock.ts";
 import { blockedTs } from "./blocklist.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 
 export type MemoryStatus = "open" | "settled";
 
@@ -143,16 +146,15 @@ export interface AppendMemoryInput {
   repoPath?: string;
 }
 
-// Existing ts values across all memory files, used to guarantee uniqueness of
-// newly appended entries (a fast seed->append within one millisecond would
-// otherwise collide on the ISO timestamp).
-async function existingTs(): Promise<Set<string>> {
+// ts values already in `file`. An appended row's ts is "now", so the only rows
+// it can collide with are ones this same file received in the same millisecond;
+// scanning just it keeps the locked section to one read of one file. (A row
+// hand-placed with today's ts in another day's file is outside this promise.)
+async function existingTs(file: string): Promise<Set<string>> {
   const set = new Set<string>();
-  for (const file of await memoryFiles()) {
-    for (const line of await readLines(file)) {
-      const f = parseLine(line);
-      if (f && typeof f.ts === "string") set.add(f.ts);
-    }
+  for (const line of await readLines(file)) {
+    const f = parseLine(line);
+    if (f && typeof f.ts === "string") set.add(f.ts);
   }
   return set;
 }
@@ -166,17 +168,23 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   if (input.content.length > MAX_CONTENT_CHARS) {
     throw new Error(`memory content exceeds ${MAX_CONTENT_CHARS} chars (${input.content.length})`);
   }
-  const taken = await existingTs();
-  let ts = new Date().toISOString();
-  let guard = 0;
-  while (taken.has(ts) && guard++ < 1000) {
-    ts = new Date(new Date(ts).getTime() + 1).toISOString();
+  for (const [field, value] of [
+    ["type", input.type],
+    ["scope", input.scope],
+    ["issue", input.issue],
+  ] as const) {
+    if (value !== undefined && flattenMemoryText(value) !== value) {
+      throw new Error(`memory ${field} must not contain control characters`);
+    }
   }
-  // Repo stamp at the single write choke point: gated writes,
-  // viewer restores and edits all pass through here. Explicit "global"
-  // survives; an unscoped process (viewer) stamps nothing = global. Session
-  // identity wins over the module scope so a server hosting several workspaces
-  // stamps the writing session's repo.
+  if (input.tags?.some((tag) => flattenMemoryText(tag) !== tag)) {
+    throw new Error("memory tags must not contain control characters");
+  }
+  // Repo stamp at the single write choke point: gated writes, viewer restores
+  // and edits all pass through here. Explicit "global" survives; an unscoped
+  // process (viewer) stamps nothing = global. Session identity wins over the
+  // module scope so a server hosting several workspaces stamps the writing
+  // session's repo.
   let repo = input.repo;
   let repoPath = input.repoPath;
   if (repo === undefined) {
@@ -186,22 +194,36 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
       repoPath = cur.path;
     }
   }
-  const file = join(memoryRoot(), `${ts.split("T")[0]}.logfmt`);
-  await appendLog(
-    file,
-    formatLine({
-      ts,
-      type: input.type,
-      scope: input.scope,
-      content: input.content,
-      issue: input.issue,
-      tags: input.tags?.length ? input.tags.join(",") : undefined,
-      status: input.status,
-      repo,
-      repoPath,
-    }),
-  );
-  return ts;
+  // Day file chosen before the lock (it IS the lock key). A ts bumped across
+  // midnight therefore lands under the previous day's name; readers glob every
+  // file and decay compares ts values, so the grouping is cosmetic.
+  const file = join(memoryRoot(), `${dateStr()}.logfmt`);
+  // Locked end to end: seeding ts from a scan another process can race yields
+  // two rows with the same identity, and an append that lands inside someone
+  // else's whole-file rewrite is simply not there afterwards.
+  return withStoreLock(file, async () => {
+    const taken = await existingTs(file);
+    let ts = new Date().toISOString();
+    let guard = 0;
+    while (taken.has(ts) && guard++ < 1000) {
+      ts = new Date(new Date(ts).getTime() + 1).toISOString();
+    }
+    await appendLog(
+      file,
+      formatLine({
+        ts,
+        type: input.type,
+        scope: input.scope,
+        content: input.content,
+        issue: input.issue,
+        tags: input.tags?.length ? input.tags.join(",") : undefined,
+        status: input.status,
+        repo,
+        repoPath,
+      }),
+    );
+    return ts;
+  }, LOCK_WRITE);
 }
 
 export interface SupersedeFields {
@@ -213,44 +235,52 @@ export interface SupersedeFields {
   entity?: string;
 }
 
-// Copy `file` into snapshots/ before a mutation. Names follow
-// `<stamp>-<original>` because /undo strips the stamp to find its target, so a
-// same-millisecond collision would clobber an earlier, still-undoable snapshot
-// (supersede + clear in one merge_review can land in the same millisecond).
+// Copy `file` into snapshots/ before a mutation.
 async function snapshotBefore(file: string): Promise<void> {
-  await ensureDir(snapshotDir());
-  let stamp = Date.now();
-  let snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
-  while (await Bun.file(snap).exists()) snap = join(snapshotDir(), `${++stamp}-${basename(file)}`);
-  await Bun.write(snap, (await Bun.file(file).text()) || "");
+  await snapshotFiles([file]);
+}
+
+// Read-modify-write ONE row of a store file: read, rewrite the line, publish
+// atomically, all under the store lock, so an append or another rewrite by a
+// concurrent session cannot be overwritten by our stale copy. Resolves to null
+// when the row is not in this file, otherwise the mutation's outcome.
+async function stampRow(
+  file: string,
+  ts: string,
+  mutate: (fields: Fields) => string | null,
+): Promise<boolean | null> {
+  return withStoreLock(
+    file,
+    async () => {
+      const lines = await readLines(file);
+      const idx = lines.findIndex((l) => {
+        const f = parseLine(l);
+        return f && f.ts === ts;
+      });
+      if (idx === -1) return null;
+      const parsed = parseLine(lines[idx]);
+      if (!parsed) return false;
+      const next = mutate(parsed);
+      if (next === null) return false;
+      lines[idx] = next;
+      await snapshotBefore(file);
+      await writeAtomic(file, lines.join("\n") + "\n");
+      return true;
+    },
+    LOCK_WRITE,
+  );
 }
 
 // Mark an existing memory as superseded IN PLACE (entry retained, recoverable).
 // Idempotent: a second call is a no-op, so no double `superseded_by`.
 export async function markSuperseded(ts: string, fields: SupersedeFields): Promise<boolean> {
   for (const file of await memoryFiles()) {
-    const lines = await readLines(file);
-    const idx = lines.findIndex((l) => {
-      const f = parseLine(l);
-      return f && f.ts === ts;
-    });
-    if (idx === -1) continue;
-    const parsed = parseLine(lines[idx]);
-    if (parsed && typeof parsed.superseded_by === "string") return false;
-    // Rewrite the whole line rather than appending to it, so an old-format line
+    // The whole line is rewritten rather than extended, so an old-format line
     // comes out in the current format with its values unchanged.
-    lines[idx] = formatLine({
-      ...parsed,
-      superseded_by: fields.superseded_by,
-      reason: fields.reason,
-      symbol: fields.symbol,
-      from: fields.from,
-      to: fields.to,
-      entity: fields.entity,
-    });
-    await snapshotBefore(file);
-    await Bun.write(file, lines.join("\n") + "\n");
-    return true;
+    const outcome = await stampRow(file, ts, (parsed) =>
+      typeof parsed.superseded_by === "string" ? null : formatLine({ ...parsed, ...fields }),
+    );
+    if (outcome !== null) return outcome;
   }
   return false;
 }
@@ -260,25 +290,18 @@ export async function markSuperseded(ts: string, fields: SupersedeFields): Promi
 // even when an earlier row — now the loser — had superseded it first.
 export async function clearSuperseded(ts: string): Promise<boolean> {
   for (const file of await memoryFiles()) {
-    const lines = await readLines(file);
-    const idx = lines.findIndex((l) => {
-      const f = parseLine(l);
-      return f && f.ts === ts;
+    const outcome = await stampRow(file, ts, (parsed) => {
+      if (typeof parsed.superseded_by !== "string") return null;
+      // These five keys are written only by markSuperseded (drift, canonical,
+      // update and merge_review), never by appendMemory, so they are all part of
+      // the marker and go with it. Field order round-trips because parseLine
+      // inserts keys in source order.
+      for (const key of ["superseded_by", "reason", "symbol", "from", "to", "entity"]) {
+        delete parsed[key];
+      }
+      return formatLine(parsed);
     });
-    if (idx === -1) continue;
-    const parsed = parseLine(lines[idx]);
-    if (!parsed || typeof parsed.superseded_by !== "string") return false;
-    // These five keys are written only by markSuperseded (drift, canonical,
-    // update and merge_review), never by appendMemory, so they are all part of
-    // the marker and go with it. Field order round-trips because parseLine
-    // inserts keys in source order.
-    for (const key of ["superseded_by", "reason", "symbol", "from", "to", "entity"]) {
-      delete parsed[key];
-    }
-    lines[idx] = formatLine(parsed);
-    await snapshotBefore(file);
-    await Bun.write(file, lines.join("\n") + "\n");
-    return true;
+    if (outcome !== null) return outcome;
   }
   return false;
 }
@@ -334,24 +357,35 @@ export interface DeletedMemory {
   reason: string;
 }
 
+// Claim a snapshot name with O_EXCL so "never overwrite a snapshot" holds
+// across processes, not just inside one: two sessions mutating the same file in
+// one millisecond both bump instead of one clobbering the other's still-undoable
+// copy. Names are `<epoch-ms>-<original>` because /undo strips the leading stamp
+// to find its target, so nothing may go in front of it.
+async function claimSnapshot(file: string): Promise<string> {
+  await ensureDir(snapshotDir());
+  let stamp = Date.now();
+  for (;;) {
+    const snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
+    try {
+      const handle = await open(snap, "wx");
+      await handle.close();
+      return snap;
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+      stamp++;
+    }
+  }
+}
+
 // Snapshot-before-mutate: copy each affected file into snapshots/ so /undo can
 // restore it. Returns the snapshot paths keyed by original file.
 export async function snapshotFiles(files: string[]): Promise<string[]> {
-  await ensureDir(snapshotDir());
-  let stamp = Date.now();
   const snaps: string[] = [];
   for (const file of files) {
     const f = Bun.file(file);
     if (!(await f.exists())) continue;
-    // Names must be unique: a `${Date.now()}-` stamp collides whenever two
-    // mutations happen in the same millisecond, and a clobbered snapshot once
-    // let a restore read post-edit content. Bump until free; never overwrite
-    // a snapshot.
-    let snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
-    while (await Bun.file(snap).exists()) {
-      stamp++;
-      snap = join(snapshotDir(), `${stamp}-${basename(file)}`);
-    }
+    const snap = await claimSnapshot(file);
     await Bun.write(snap, await f.text());
     snaps.push(snap);
   }
@@ -379,30 +413,39 @@ export interface PruneResult {
 }
 
 // Remove matching memories (used by memory_forget), snapshotting first and
-// logging every deletion with its reason.
+// logging every deletion with its reason. Each file is filtered and republished
+// under the store lock, so a row another session appended while we were reading
+// is not quietly filtered out along with the targets.
 export async function prune(scope: string, type: string, reason: string): Promise<PruneResult> {
-  const files = await memoryFiles();
-  const snapshot = await snapshotFiles(files);
   const deleted: DeletedMemory[] = [];
-  for (const file of files) {
-    const lines = await readLines(file);
-    const kept: string[] = [];
-    let changed = false;
-    for (const line of lines) {
-      const parsed = parseLine(line);
-      const m = parsed ? toMemory(parsed, file, 0) : null;
-      // Repo floor: forgetting scope X here must never delete
-      // another repo's row for scope X — same basename collisions are real
-      // (a fork next to its upstream).
-      if (m && m.scope === scope && m.type === type && isVisibleHere(m)) {
-        deleted.push({ memory: m, reason });
-        await logDeletion(m, reason);
-        changed = true;
-        continue;
-      }
-      kept.push(line);
-    }
-    if (changed) await Bun.write(file, kept.join("\n") + (kept.length ? "\n" : ""));
+  const snapshot: string[] = [];
+  for (const file of await memoryFiles()) {
+    await withStoreLock(
+      file,
+      async () => {
+        const lines = await readLines(file);
+        const kept: string[] = [];
+        let changed = false;
+        for (const line of lines) {
+          const parsed = parseLine(line);
+          const m = parsed ? toMemory(parsed, file, 0) : null;
+          // Repo floor: forgetting scope X here must never delete
+          // another repo's row for scope X — same basename collisions are real
+          // (a fork next to its upstream).
+          if (m && m.scope === scope && m.type === type && isVisibleHere(m)) {
+            deleted.push({ memory: m, reason });
+            await logDeletion(m, reason);
+            changed = true;
+            continue;
+          }
+          kept.push(line);
+        }
+        if (!changed) return;
+        snapshot.push(...(await snapshotFiles([file])));
+        await writeAtomic(file, kept.join("\n") + (kept.length ? "\n" : ""));
+      },
+      LOCK_WRITE,
+    );
   }
   return { deleted, snapshot };
 }

package/src/portable.ts

@@ -8,6 +8,7 @@ import { memoryRoot } from "./config.ts";
 import { isActive, isVisibleHere, loadAll, type Memory } from "./memory.ts";
 import { TYPES } from "./types.ts";
 import type { WriteCandidate } from "./gates.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 
 // --- export -------------------------------------------------------------------
 
@@ -101,7 +102,8 @@ function exportHeader(line: string): { version: number } | null {
 
 // A line is malformed (skipped, never gated) unless it is a JSON object with a
 // known type, a non-empty scope, and non-empty content. Optional fields are
-// sanitized rather than fatal: an unusable status/tags/issue is dropped.
+// sanitized rather than fatal where noted. Control characters in structured
+// metadata make the row malformed; content alone may remain multiline.
 function parseRow(line: string): WriteCandidate | null {
   let row: unknown;
   try {
@@ -113,7 +115,13 @@ function parseRow(line: string): WriteCandidate | null {
   const r = row as Record<string, unknown>;
   if (typeof r.type !== "string" || !(TYPES as readonly string[]).includes(r.type)) return null;
   if (typeof r.scope !== "string" || !r.scope.trim()) return null;
+  if (flattenMemoryText(r.scope) !== r.scope) return null;
   if (typeof r.content !== "string" || !r.content.trim()) return null;
+  if (
+    Array.isArray(r.tags) &&
+    r.tags.some((t) => typeof t === "string" && flattenMemoryText(t) !== t)
+  ) return null;
+  if (typeof r.issue === "string" && flattenMemoryText(r.issue) !== r.issue) return null;
   const c: WriteCandidate = { type: r.type, scope: r.scope, content: r.content };
   if (r.status === "open" || r.status === "settled") c.status = r.status;
   if (Array.isArray(r.tags) && r.tags.every((t) => typeof t === "string")) c.tags = r.tags;

package/src/sanitize.ts

@@ -0,0 +1,9 @@
+// Memory content may legitimately be multiline in the store, but every field
+// rendered into a model-facing line must stay on that line. C0/C1 controls and
+// Unicode line/paragraph separators all collapse through this one helper so
+// renderers and write-boundary validators cannot drift.
+const CONTROL_CHARS = /[\p{Cc}\p{Zl}\p{Zp}]+/gu;
+
+export function flattenMemoryText(value: string): string {
+  return value.replace(CONTROL_CHARS, " ");
+}

package/src/schema.ts

@@ -16,20 +16,30 @@
 //     check in memory.ts (row identity), where the row schema lives.
 import { z, type ZodTypeAny } from "zod";
 import { STATUSES, TYPES } from "./types.ts";
+import { flattenMemoryText } from "./sanitize.ts";
 
 type JSONSchema = Record<string, unknown>;
 
 /** Row identity anywhere it arrives off a boundary: an ISO instant. */
 export const isoTs = z.iso.datetime();
 
+// Structured row fields become labels in model-facing text. Content remains
+// multiline by design and is flattened only when rendered; metadata controls
+// are rejected at every write boundary instead. Lookup-only scopes (recall,
+// forget, export) stay plain strings so a row stored before this check can
+// still be found and forgotten.
+const memoryField = z.string().refine((value) => flattenMemoryText(value) === value, {
+  message: "must not contain control characters",
+});
+
 // ---- tool argument schemas (JSON Schema generated from these) ------------
 
 export const RememberArgs = z.object({
   type: z.enum(TYPES).describe("Type of memory"),
-  scope: z.string().describe("Scope/area (e.g., auth, api, ctl)"),
+  scope: memoryField.describe("Scope/area (e.g., auth, api, ctl)"),
   content: z.string().describe("The memory content"),
-  issue: z.string().describe("Related issue").optional(),
-  tags: z.array(z.string()).optional(),
+  issue: memoryField.describe("Related issue").optional(),
+  tags: z.array(memoryField).optional(),
   status: z
     .enum(STATUSES)
     .describe(
@@ -60,7 +70,7 @@ export const RecallArgs = z.object({
 });
 
 export const UpdateArgs = z.object({
-  scope: z.string(),
+  scope: memoryField,
   type: z.enum(TYPES),
   content: z.string(),
   query: z
@@ -140,10 +150,10 @@ export const DecayArgs = z.object({
 export const EditBody = z.object({
   ts: isoTs,
   type: z.enum(TYPES),
-  scope: z.string().min(1),
+  scope: memoryField.min(1),
   content: z.string().min(1),
-  issue: z.string().optional(),
-  tags: z.array(z.string()).optional(),
+  issue: memoryField.optional(),
+  tags: z.array(memoryField).optional(),
   // min NOT enforced here: the mutate layer owns the audit-reason contract
   // (and its tests pin its message). Shape is the boundary's job only.
   reason: z.string(),
@@ -156,7 +166,7 @@ export const UnblockBody = z.object({ ts: isoTs });
 // POSTs append rows with empty type/scope/content.
 export const RestoreEntryBody = z.object({
   type: z.enum(TYPES),
-  scope: z.string().min(1),
+  scope: memoryField.min(1),
   content: z.string().min(1),
 });
 

package/src/undo.ts

@@ -3,15 +3,18 @@
 //
 // Daily logfmt files are SHARED across concurrent sessions, so a naive
 // whole-file write can silently clobber rows another session appended after
-// the snapshot. Restore is therefore
-// conflict-aware. The snapshot cannot tell "rows I added since the snapshot,
-// which undo should remove" apart from "rows another session added, which
-// must survive" — that call belongs to the caller, so the default mode CHECK
-// refuses and lists the divergent rows; MERGE replays them on top of the
-// snapshot; FORCE is the old exact rollback.
+// the snapshot. Restore is therefore conflict-aware: the snapshot cannot tell
+// "rows I added since the snapshot, which undo should remove" apart from
+// "rows another session added, which must survive", so that call belongs to
+// the caller. The default mode CHECK refuses and lists the divergent rows;
+// MERGE replays them on top of the snapshot; FORCE is the old exact rollback,
+// and additionally snapshots the file it replaces, so the state it drops stays
+// undoable (result.safety).
 import { basename, join, resolve, sep } from "node:path";
 import { snapshotDir } from "./config.ts";
-import { ensureDir } from "./logfmt.ts";
+import { ensureDir, writeAtomic } from "./logfmt.ts";
+import { withStoreLock, LOCK_RESTORE } from "./lock.ts";
+import { snapshotFiles } from "./memory.ts";
 
 export interface SnapshotInfo {
   file: string;
@@ -45,6 +48,9 @@ export interface RestoreResult {
   target: string;
   restored: boolean;
   mode: RestoreMode;
+  // Snapshot of the file as it stood the moment the restore held the lock —
+  // present on a force restore, which is the mode that drops rows.
+  safety?: string;
   // ts of rows present in the CURRENT file but absent from the snapshot
   // (added after it — or in-place edits, listed under their original ts).
   concurrentAdded: string[];
@@ -87,37 +93,55 @@ export async function restoreSnapshot(
     throw new Error(`snapshot target escapes the memory root: ${original}`);
   }
   const snapLines = rows(await f.text());
-  const cur = Bun.file(target);
-  const curLines = (await cur.exists()) ? rows(await cur.text()) : [];
 
-  const snapByKey = new Map(snapLines.map((l) => [rowKey(l), l]));
-  const concurrentAdded: string[] = [];
-  const concurrentChanged: string[] = [];
-  const curByKey = new Map<string, string>();
-  for (const l of curLines) {
-    const k = rowKey(l);
-    curByKey.set(k, l);
-    const s = snapByKey.get(k);
-    if (s === undefined) concurrentAdded.push(k);
-    else if (s !== l) concurrentChanged.push(k);
-  }
+  // Comparing and publishing happen under the same lock: a divergence check on
+  // a stale read would wave through a row that landed after it. A restore waits
+  // for the store rather than proceeding unlocked, because "force" deliberately
+  // drops rows — doing that on top of a racing writer would drop rows nobody
+  // agreed to drop.
+  return withStoreLock(
+    target,
+    async () => {
+      const cur = Bun.file(target);
+      const curLines = (await cur.exists()) ? rows(await cur.text()) : [];
 
-  if (mode === "check" && (concurrentAdded.length || concurrentChanged.length)) {
-    return { target, restored: false, mode, concurrentAdded, concurrentChanged };
-  }
+      const snapByKey = new Map(snapLines.map((l) => [rowKey(l), l]));
+      const concurrentAdded: string[] = [];
+      const concurrentChanged: string[] = [];
+      const curByKey = new Map<string, string>();
+      for (const l of curLines) {
+        const k = rowKey(l);
+        curByKey.set(k, l);
+        const s = snapByKey.get(k);
+        if (s === undefined) concurrentAdded.push(k);
+        else if (s !== l) concurrentChanged.push(k);
+      }
 
-  let out = snapLines;
-  if (mode === "merge") {
-    // Keep the CURRENT version of rows the snapshot also has (in-place edits —
-    // e.g. a supersede stamp — made after the snapshot win), then append the
-    // rows the snapshot never saw. Merge is a deliberate superset: rows the
-    // snapshotter wrote after the snapshot are NOT dropped here; choose FORCE
-    // for that.
-    out = snapLines.map((l) => curByKey.get(rowKey(l)) ?? l).concat(
-      curLines.filter((l) => !snapByKey.has(rowKey(l))),
-    );
-  }
-  await ensureDir(memoryRootDir);
-  await Bun.write(target, out.length ? out.join("\n") + "\n" : "");
-  return { target, restored: true, mode, concurrentAdded, concurrentChanged };
+      if (mode === "check" && (concurrentAdded.length || concurrentChanged.length)) {
+        return { target, restored: false, mode, concurrentAdded, concurrentChanged };
+      }
+
+      // FORCE is the mode that drops rows, so the file it replaces is
+      // snapshotted HERE — inside the lock, which is what makes rows a
+      // concurrent session appended moments earlier part of the copy. A caller
+      // that snapshots before this call races the very write it means to save.
+      const safety = mode === "force" ? (await snapshotFiles([target]))[0] : undefined;
+
+      let out = snapLines;
+      if (mode === "merge") {
+        // Keep the CURRENT version of rows the snapshot also has (in-place edits —
+        // e.g. a supersede stamp — made after the snapshot win), then append the
+        // rows the snapshot never saw. Merge is a deliberate superset: rows the
+        // snapshotter wrote after the snapshot are NOT dropped here; choose FORCE
+        // for that.
+        out = snapLines.map((l) => curByKey.get(rowKey(l)) ?? l).concat(
+          curLines.filter((l) => !snapByKey.has(rowKey(l))),
+        );
+      }
+      await ensureDir(memoryRootDir);
+      await writeAtomic(target, out.length ? out.join("\n") + "\n" : "");
+      return { target, restored: true, mode, safety, concurrentAdded, concurrentChanged };
+    },
+    LOCK_RESTORE,
+  );
 }

package/src/viewer/mutate.ts

@@ -9,7 +9,8 @@
 import { deletionsFile } from "../config.ts";
 import { addBlock, removeBlock } from "../blocklist.ts";
 import { record, chainId } from "../evidence.ts";
-import { appendLog, formatLine, parseLine, readLines } from "../logfmt.ts";
+import { appendLog, formatLine, parseLine, readLines, writeAtomic } from "../logfmt.ts";
+import { withStoreLock, LOCK_WRITE } from "../lock.ts";
 import {
   appendMemory,
   loadAll,
@@ -99,14 +100,23 @@ export async function deleteMemory(input: DeleteInput): Promise<MutationResult>
   const chain = chainId();
   const target = await findMemory(input.ts);
 
-  const snapshot = await snapshotFiles([target.file]);
-  const lines = await readLines(target.file);
-  const kept = lines.filter((l) => {
-    const f = parseLine(l);
-    return !(f && f.ts === input.ts);
-  });
-  if (kept.length === lines.length) throw new Error(`memory line not found: ${input.ts}`);
-  await Bun.write(target.file, kept.join("\n") + (kept.length ? "\n" : ""));
+  // Snapshot, filter and republish happen as one locked step, so a row another
+  // session appended while we read cannot be filtered out with the target.
+  let snapshot: string[] = [];
+  await withStoreLock(
+    target.file,
+    async () => {
+      const lines = await readLines(target.file);
+      const kept = lines.filter((l) => {
+        const f = parseLine(l);
+        return !(f && f.ts === input.ts);
+      });
+      if (kept.length === lines.length) throw new Error(`memory line not found: ${input.ts}`);
+      snapshot = await snapshotFiles([target.file]);
+      await writeAtomic(target.file, kept.join("\n") + (kept.length ? "\n" : ""));
+    },
+    LOCK_WRITE,
+  );
 
   await audit("deleted", target, input.ts, undefined, input.reason);
   await record("prune", {

package/src/viewer/server.ts

@@ -11,7 +11,7 @@ import { BlockBody, DeleteBody, EditBody, RestoreEntryBody, UnblockBody } from "
 import { deletionsFile, memoryRoot, snapshotDir } from "../config.ts";
 import { blockedEntries } from "../blocklist.ts";
 import { listSnapshots, restoreSnapshot } from "../undo.ts";
-import { appendMemory, loadAll, memoryFiles, snapshotFiles } from "../memory.ts";
+import { appendMemory, loadAll, memoryFiles } from "../memory.ts";
 import { parseLine, readLines } from "../logfmt.ts";
 import { deleteMemory, editMemory, addBlock, removeBlock, type MutationResult } from "./mutate.ts";
 
@@ -269,14 +269,14 @@ async function restoreRoute(body: Record<string, unknown>): Promise<Response> {
   if (!/^\d+-\d{4}-\d{2}-\d{2}\.logfmt$/.test(name)) {
     return error("invalid snapshot name", 400);
   }
-  const original = name.replace(/^\d+-/, "");
-  // Explicit human admin action: exact rollback — but the rollback is itself
-  // rollback-able. Snapshot the current file first so concurrent-session rows
-  // lost here stay recoverable, and report how many rows were rolled back.
-  await snapshotFiles([join(memoryRoot(), original)]);
+  // Explicit human admin action: exact rollback. The pre-restore snapshot the
+  // dropped rows can be recovered from is taken by restoreSnapshot itself,
+  // under the store lock — snapshotting here instead would miss anything
+  // another session appended between this call and the rollback.
   const res = await restoreSnapshot(join(snapshotDir(), name), memoryRoot(), "force");
   return json({
     restored: res.target,
+    safety: res.safety ?? null,
     rolledBack: res.concurrentAdded.length + res.concurrentChanged.length,
   });
 }