total-recall-brain 3.23.2 → 3.24.0

package/src/core/dream.mjs

@@ -3,7 +3,8 @@ import path from 'path';
 import os from 'os';
 import crypto from 'crypto';
 import matter from 'gray-matter';
-import { writeNode, atomicWrite, walkMd } from './vault.mjs';
+import { writeNode, walkMd } from './vault.mjs';
+import { updateNodeInPlace } from './validated-write.mjs';
 import { getNodes } from './vault-cache.mjs';
 import { logger } from './logger.mjs';
 import { agentDir, brainDir } from './config.mjs';
@@ -13,68 +14,58 @@ import { loadQueue } from './research-queue.mjs';
  * Write a daily dream-cycle summary to memory-vault/daily/YYYY-MM-DD.md.
  * SSSS node natively; Obsidian Daily Notes plugin reads these files directly.
  */
-function writeDailyNote(vaultDir, summaryLines) {
+async function writeDailyNote(vaultDir, summaryLines) {
   const today = new Date().toISOString().slice(0, 10);
   const now = new Date().toISOString();
-  const dailyDir = path.join(vaultDir, 'daily');
-  if (!fs.existsSync(dailyDir)) fs.mkdirSync(dailyDir, { recursive: true });
-
-  const filePath = path.join(dailyDir, `${today}.md`);
+  const filePath = path.join(vaultDir, 'daily', `${today}.md`);
+  const runBlock = [
+    `## Dream Cycle \u2013 ${now}`,
+    '',
+    ...summaryLines.map((l) => `- ${l}`),
+  ].join('\n');
 
+  // Append to an existing note rather than replacing it: several dream cycles
+  // can run in one day and each one's summary is worth keeping.
   if (fs.existsSync(filePath)) {
-    // Append this run's summary to the existing note
-    const existing = fs.readFileSync(filePath, 'utf8');
-    const runBlock = `\n## Dream Cycle – ${now}\n\n${summaryLines.map(l => `- ${l}`).join('\n')}\n`;
-    atomicWrite(filePath, existing.trimEnd() + runBlock);
-    return;
+    return updateNodeInPlace(filePath, (data, body) => {
+      data.updated = now;
+      data.last_accessed = now;
+      return { data, body: `${body.trimEnd()}\n\n${runBlock}\n` };
+    }, { vaultDir, agentRole: 'system' });
   }
 
-  const frontmatter = [
-    '---',
-    'type: memory',
-    `slug: "daily-${today}"`,
-    'category: daily',
-    `title: "Daily Note: ${today}"`,
-    'status: active',
-    'confidence: 1.0',
-    'importance: 2',
-    `created: "${now}"`,
-    `updated: "${now}"`,
-    `last_accessed: "${now}"`,
-    'source:',
-    '  type: dream-cycle',
-    `  session_id: "dream-${today}"`,
-    '  evidence_count: 1',
-    'supersedes: []',
-    'superseded_by: null',
-    'contradicts: []',
-    'tags: [daily, dream-cycle]',
-    'related: []',
-    'routes_to_skills: []',
-    'sentiment_polarity: descriptive',
-    'sentiment_target: system',
-    'modality: should',
-    'subject: system',
-    'predicate: ran',
-    'object: dream-cycle',
-    'decay:',
-    '  half_life_days: 30',
-    '  access_count: 0',
-    'schema_version: 2',
-    '---',
-    ''
-  ].join('\n');
-
-  const body = [
-    `# Daily Note: ${today}`,
-    '',
-    `## Dream Cycle – ${now}`,
-    '',
-    ...summaryLines.map(l => `- ${l}`),
-    ''
-  ].join('\n');
-
-  atomicWrite(filePath, frontmatter + body);
+  // The frontmatter here used to be a hand-assembled YAML string, which is why
+  // every daily note predates SSSS 0.9 universal frontmatter: a literal block
+  // cannot pick up new required fields. prepareNodeForContract fills them.
+  return writeNode({
+    type: 'memory',
+    slug: `daily-${today}`,
+    category: 'daily',
+    title: `Daily Note: ${today}`,
+    description: `Dream-cycle summary for ${today}.`,
+    status: 'active',
+    confidence: 1.0,
+    importance: 2,
+    created: now,
+    updated: now,
+    last_accessed: now,
+    source: { type: 'dream-cycle', session_id: `dream-${today}`, evidence_count: 1 },
+    supersedes: [],
+    superseded_by: null,
+    contradicts: [],
+    tags: ['daily', 'dream-cycle'],
+    related: [],
+    routes_to_skills: [],
+    sentiment_polarity: 'descriptive',
+    sentiment_target: 'system',
+    modality: 'should',
+    subject: 'system',
+    predicate: 'ran',
+    object: 'dream-cycle',
+    decay: { half_life_days: 30, access_count: 0 },
+    schema_version: 2,
+    body: [`# Daily Note: ${today}`, '', runBlock, ''].join('\n'),
+  }, vaultDir, { path: `daily/${today}.md`, agentRole: 'system' });
 }
 import { detectConflicts, quarantineConflict } from './steering.mjs';
 import { compileSurface } from './surface.mjs';
@@ -587,7 +578,7 @@ export async function runDreamCycle({
   // Write daily note summary (native SSSS node; Obsidian Daily Notes reads it directly)
   try {
     const existingNodes = getNodes(vaultDir);
-    writeDailyNote(vaultDir, [
+    await writeDailyNote(vaultDir, [
       `Modified vault files scanned: ${modified.length}`,
       `REM candidates: ${candidates.length} (promoted ${promotedCount}, conflicted ${conflictedCount})`,
       `Active nodes: ${existingNodes.filter(n => n.status === 'active').length}`,

package/src/core/env-import.mjs

@@ -24,6 +24,23 @@ export const KNOWN_SECRET_KEYS = [];
 const SECRET_NAME_RE =
   /(?:^|_)(API[_-]?KEY|API[_-]?TOKEN|ACCESS[_-]?TOKEN|ACCESS[_-]?KEY|SECRET[_-]?KEY|PRIVATE[_-]?KEY|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|WEBHOOK[_-]?SECRET|PASSWORD|PASSWD|TOKEN|SECRET|KEY)$/i;
 
+/**
+ * The secrets store's own master password must never be imported into the
+ * store, and neither may anything else that controls access to it.
+ *
+ * TR_SECRETS_PASSWORD is exported into every shell by ~/.zshenv (from the
+ * macOS Keychain), so it shows up in the env scan like any other credential —
+ * and `secret import-env --all`, the command the help text recommends, would
+ * happily write it in. That is the key to the box stored inside the box: it
+ * cannot be read back without the value it holds, and it puts the one
+ * credential that protects everything else next to what it protects.
+ */
+const STORE_CONTROL_KEYS = new Set([
+  'TR_SECRETS_PASSWORD',
+  'TR_SECRETS_KEY_CACHE',
+  'TR_REMOTE_VAULT_TOKEN',
+]);
+
 /** Obvious non-secrets even if they match loosely */
 const SKIP_KEYS = new Set([
   'PATH',
@@ -174,6 +191,7 @@ export function parseEnvText(text) {
  */
 export function isCandidateKey(key) {
   if (!key || typeof key !== 'string') return false;
+  if (STORE_CONTROL_KEYS.has(key.toUpperCase())) return false;
   if (SKIP_KEYS.has(key) || SKIP_KEYS.has(key.toUpperCase())) return false;
   // skip pure PATH-like / numeric shell junk
   if (key.length < 4 || key.length > 128) return false;

package/src/core/inference-engine.mjs

@@ -3,7 +3,7 @@ import path from 'path';
 import matter from 'gray-matter';
 import crypto from 'crypto';
 import { callLocalRuntime, cleanAndParseJSON } from './runtime.mjs';
-import { atomicWrite, safeStringify } from './vault.mjs';
+import { atomicWrite, safeStringify, writeNode } from './vault.mjs';
 import { getNodes } from './vault-cache.mjs';
 import { logger } from './logger.mjs';
 import { brainDir } from './config.mjs';
@@ -130,9 +130,8 @@ export async function runInferenceTask(slugs, { vaultDir, inboxDir, runtimeConfi
 
   // Write merge proposals
   if (mergeCandidates.length > 0) {
-    const proposalsDir = path.join(vaultDir, 'proposals');
     for (const candidate of mergeCandidates) {
-      writeMergeProposal(proposalsDir, candidate);
+      await writeMergeProposal(vaultDir, candidate);
     }
   }
 
@@ -259,30 +258,29 @@ function writeContradictionRecord(conflictsDir, contradiction) {
   );
 }
 
-function writeMergeProposal(proposalsDir, candidate) {
-  if (!fs.existsSync(proposalsDir)) {
-    fs.mkdirSync(proposalsDir, { recursive: true });
-  }
-
+async function writeMergeProposal(vaultDir, candidate) {
   const slug = `merge-proposal-${crypto.createHash('md5').update(candidate.node_a + candidate.node_b).digest('hex').slice(0, 8)}`;
   const now = new Date().toISOString();
+  const summary = `Merge ${candidate.node_a} and ${candidate.node_b}`;
 
-  const data = {
+  // proposals/ lives inside the vault, so this is a canonical write and has to
+  // clear the contract. The old atomicWrite emitted no title/description/
+  // timestamp, so every merge proposal ever written fails SSSS 0.9 §4.2.
+  return writeNode({
     type: 'proposal',
     slug,
-    category: 'memory-cleanup',
+    title: summary,
+    description: candidate.reason || 'Nodes appear to express the same concept differently.',
+    timestamp: now,
     status: 'draft',
     proposed_by: 'inference-engine',
     proposed_at: now,
     target_path: `${candidate.node_a},${candidate.node_b}`,
-    summary: `Merge ${candidate.node_a} and ${candidate.node_b}`,
+    summary,
     rationale: candidate.reason || 'Nodes appear to express the same concept differently.',
-  };
-
-  atomicWrite(
-    path.join(proposalsDir, `${slug}.md`),
-    safeStringify('', data),
-  );
+    proposal_topic: 'memory-cleanup',
+    body: '',
+  }, vaultDir, { agentRole: 'system' });
 }
 
 // ─── Memory Synthesizer ─────────────────────────────────────────────────────────

package/src/core/migrate.mjs

@@ -20,7 +20,11 @@ export async function runMigration(vaultDir, fromVersion, toVersion, migrationFn
 
   // 1. Safety Snapshot
   logger.info('migration', 'Creating pre-migration safety snapshot...');
-  const snapshotId = await createSnapshot(vaultDir);
+  const snapshot = createSnapshot(`pre-migration-v${fromVersion}-to-v${toVersion}`, vaultDir);
+  if (!snapshot.success) {
+    throw new Error(`Refusing to migrate without a safety snapshot: ${snapshot.error}`);
+  }
+  const snapshotId = snapshot.snapshot_id;
   logger.info('migration', `Safety snapshot created: ${snapshotId}`);
 
   const migrationId = `mig_${crypto.randomBytes(6).toString('hex')}`;

package/src/core/okf-adapter.mjs

@@ -498,6 +498,7 @@ export function generateLiveIndex(vaultDir) {
     }
     indexContent += '\n';
   }
+  // ssss-raw-write: OKF bundle manifest, not a memory node (excluded from node walks).
   fs.writeFileSync(path.join(vaultDir, 'index.md'), indexContent, 'utf8');
 }
 
@@ -538,6 +539,7 @@ export function generateLiveLog(vaultDir) {
   } else {
     logContent += 'No update history available.\n';
   }
+  // ssss-raw-write: OKF bundle changelog, not a memory node (excluded from node walks).
   fs.writeFileSync(path.join(vaultDir, 'log.md'), logContent, 'utf8');
 }
 

package/src/core/post-mortem.mjs

@@ -4,6 +4,7 @@ import matter from 'gray-matter';
 import crypto from 'crypto';
 import { callLocalRuntime, loadRuntimeConfig } from './runtime.mjs';
 import { atomicWrite, safeStringify } from './vault.mjs';
+import { updateNodeInPlace } from './validated-write.mjs';
 import { getNodes } from './vault-cache.mjs';
 import { logger } from './logger.mjs';
 import { brainDir } from './config.mjs';
@@ -379,34 +380,37 @@ async function escalateViolatedRules(violations, nodes, vaultDir) {
     if (!node || !node._filepath) continue;
 
     try {
-      const raw = fs.readFileSync(node._filepath, 'utf8');
-      const { data, content } = matter(raw);
-
-      // Track violation count
-      const violationCount = (data.x_violation_count || 0) + 1;
-      data.x_violation_count = violationCount;
-
-      // Bump importance (max 5)
-      if (data.importance < 5) {
-        data.importance = Math.min(5, data.importance + 1);
-      }
-
-      // Bump confidence (max 1.0)
-      if (data.confidence < 1.0) {
-        data.confidence = Math.min(1.0, data.confidence + 0.05);
-      }
-
-      // Auto-escalate to priority: absolute after 3+ violations
-      if (violationCount >= 3 && data.priority !== 'absolute') {
-        data.priority = 'absolute';
-        logger.info({
-          subsystem: 'compliance-auditor',
-          message: `ESCALATED rule "${data.slug}" to priority: absolute after ${violationCount} violations.`,
+      const result = await updateNodeInPlace(node._filepath, (data) => {
+        // Track violation count
+        const violationCount = (data.x_violation_count || 0) + 1;
+        data.x_violation_count = violationCount;
+
+        // Bump importance (max 5)
+        if (data.importance < 5) {
+          data.importance = Math.min(5, data.importance + 1);
+        }
+
+        // Bump confidence (max 1.0)
+        if (data.confidence < 1.0) {
+          data.confidence = Math.min(1.0, data.confidence + 0.05);
+        }
+
+        // Auto-escalate to priority: absolute after 3+ violations
+        if (violationCount >= 3 && data.priority !== 'absolute') {
+          data.priority = 'absolute';
+          logger.info({
+            subsystem: 'compliance-auditor',
+            message: `ESCALATED rule "${data.slug}" to priority: absolute after ${violationCount} violations.`,
+          });
+        }
+
+        data.updated = new Date().toISOString();
+      }, { vaultDir });
+      if (!result.success) {
+        logger.debug('post-mortem', `escalate skipped for ${v.rule_slug}`, {
+          errors: result.validation?.errors || [result.error],
         });
       }
-
-      data.updated = new Date().toISOString();
-      atomicWrite(node._filepath, safeStringify(content, data));
     } catch {
       // Skip if we can't update
     }

package/src/core/proposal-applier.mjs

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import matter from 'gray-matter';
 import { loadNodes, writeNode, atomicWrite } from './vault.mjs';
+import { updateNodeInPlace } from './validated-write.mjs';
 import { proposalKey } from './optimizer.mjs';
 import { logger } from './logger.mjs';
 
@@ -192,12 +193,14 @@ export function getProposal(vaultDir, id) {
 /**
  * Move a proposal to a new status, preserving every other frontmatter field.
  *
- * Writes the file directly rather than via writeNode(): the proposal already
- * passed the contract on creation, and a status transition must not be able to
- * fail on an unrelated schema change months later — that would strand the
- * proposal in a state no command can clear.
+ * Goes through the contract first so a transition also repairs frontmatter that
+ * predates the current schema. It falls back to a direct write when validation
+ * fails, because a status change must never be blocked by an unrelated schema
+ * change months later — that would strand the proposal in a state no command
+ * can clear, which is the failure this function was originally written to
+ * avoid. The fallback is logged so the invalid node still gets surfaced.
  */
-export function setProposalStatus(vaultDir, id, status, extra = {}) {
+export async function setProposalStatus(vaultDir, id, status, extra = {}) {
   if (!PROPOSAL_STATUSES.includes(status)) {
     throw new Error(`Invalid proposal status: ${status}`);
   }
@@ -207,7 +210,20 @@ export function setProposalStatus(vaultDir, id, status, extra = {}) {
   const raw = fs.readFileSync(proposal._filePath, 'utf8');
   const { data, content } = matter(raw);
   const next = { ...data, ...extra, status, status_changed_at: new Date().toISOString() };
-  atomicWrite(proposal._filePath, matter.stringify(content, next));
+
+  const result = await updateNodeInPlace(proposal._filePath, (nodeData) => {
+    Object.assign(nodeData, next);
+  }, { vaultDir });
+
+  if (!result.success) {
+    logger.warn('proposal-applier',
+      `Proposal ${id} failed contract validation; writing status transition directly`, {
+        errors: result.validation?.errors || [result.error],
+      });
+    // ssss-raw-write: deliberate fallback — see setProposalStatus doc comment.
+    atomicWrite(proposal._filePath, matter.stringify(content, next));
+  }
+
   return { ...next, _filePath: proposal._filePath };
 }
 
@@ -236,7 +252,7 @@ function writeUndoSnapshot(vaultDir, proposalId, filePaths) {
  * Restore a proposal's snapshot and return the proposal to `accepted`.
  * @returns {{ reverted: number, deleted: number }}
  */
-export function revertProposal(vaultDir, id) {
+export async function revertProposal(vaultDir, id) {
   const snapshotPath = path.join(undoDir(vaultDir), `${id}.json`);
   if (!fs.existsSync(snapshotPath)) {
     throw new Error(`No undo snapshot for proposal ${id} — cannot revert.`);
@@ -260,7 +276,7 @@ export function revertProposal(vaultDir, id) {
   // reverting into it means the next dream cycle re-applies the very thing that
   // was just undone — an undo/redo loop with no human in it. A revert is a
   // human saying "not this"; it must land somewhere only a human can move it out of.
-  setProposalStatus(vaultDir, id, 'draft', {
+  await setProposalStatus(vaultDir, id, 'draft', {
     reverted_at: new Date().toISOString(),
     review_reason: 'Previously applied and reverted; re-apply only after confirming the merge is correct.',
   });
@@ -420,11 +436,11 @@ export async function applyProposal(vaultDir, id, opts = {}) {
   if (dryRun) return { ...result, dryRun: true };
 
   if (result.ok) {
-    setProposalStatus(vaultDir, id, 'applied', { applied_at: new Date().toISOString(), applied_by: actor });
+    await setProposalStatus(vaultDir, id, 'applied', { applied_at: new Date().toISOString(), applied_by: actor });
   } else if (result.supersede) {
     // The world moved on — the proposal was never wrong, it is just no longer
     // actionable. Marking it `rejected` would misreport the gate's accuracy.
-    setProposalStatus(vaultDir, id, 'superseded', { superseded_reason: result.reason });
+    await setProposalStatus(vaultDir, id, 'superseded', { superseded_reason: result.reason });
   }
 
   appendProposalAudit(vaultDir, {

package/src/core/repo-sync.mjs

@@ -18,6 +18,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { writeNodeValidatedAsync } from './validated-write.mjs';
 import crypto from 'node:crypto';
 import { logger } from './logger.mjs';
 
@@ -130,19 +131,37 @@ function extractTitle(content, filename) {
 
 /**
  * Write a single repo-synced node to the vault.
- * Uses SSSS-compatible frontmatter format.
+ *
+ * Goes through the SSSS Core Contract rather than serializing frontmatter by
+ * hand. The hand-rolled version emitted neither `timestamp` (SSSS 0.9 §4.2
+ * universal) nor `schema_version`, so every node this ingested failed package
+ * validation — visible in a freshly initialized brain, where `init` runs this
+ * and the resulting facts/ node was the only invalid one it produced.
+ * prepareNodeForContract() fills both, and the kernel rejects anything still
+ * malformed instead of writing it.
  */
-function writeRepoNode(slug, title, content, repoName, relPath, vaultDir) {
+async function writeRepoNode(slug, title, content, repoName, relPath, vaultDir) {
   const category = 'facts';
-  const categoryDir = path.join(vaultDir, category);
-  if (!fs.existsSync(categoryDir)) {
-    fs.mkdirSync(categoryDir, { recursive: true });
+  const now = new Date().toISOString();
+
+  // Preserve the original creation time across re-ingests so decay and
+  // chronology survive a content change.
+  let created = now;
+  const nodePath = path.join(vaultDir, category, `${slug}.md`);
+  if (fs.existsSync(nodePath)) {
+    try {
+      const createdMatch = fs
+        .readFileSync(nodePath, 'utf8')
+        .match(/^created:\s*"?([^"\n]+)"?$/m);
+      if (createdMatch) created = createdMatch[1];
+    } catch { /* fall back to now */ }
   }
 
-  const now = new Date().toISOString();
   const node = {
+    type: 'memory',
     slug,
     title: title.substring(0, 200),
+    description: `Auto-ingested from ${repoName}/${relPath}`,
     category,
     status: 'active',
     importance: 2,
@@ -157,46 +176,39 @@ function writeRepoNode(slug, title, content, repoName, relPath, vaultDir) {
     subject: 'repo',
     predicate: 'documents',
     object: repoName,
-    source: `repo-sync:${repoName}:${relPath}`,
-    decay: 0,
-    created: now,
+    // MemoryNodeSchema declares both of these as OBJECTS. The hand-rolled
+    // writer emitted `source` as a string and `decay` as a number, and because
+    // it wrote with raw writeFileSync nothing ever checked — the malformed
+    // shape only surfaced once this went through the contract.
+    source: {
+      type: 'repo-sync',
+      session_id: `${repoName}:${relPath}`,
+      agent: 'repo-sync',
+      evidence_count: 1,
+    },
+    decay: {
+      half_life_days: 365,
+      access_count: 0,
+    },
+    created,
     updated: now,
     last_accessed: now,
-    type: 'memory',
-    description: `Auto-ingested from ${repoName}/${relPath}`,
+    body: content,
   };
 
-  // Build frontmatter
-  const lines = ['---'];
-  for (const [key, value] of Object.entries(node)) {
-    lines.push(`${key}: ${JSON.stringify(value)}`);
+  const result = await writeNodeValidatedAsync(node, vaultDir);
+  if (!result.success) {
+    const reason = (result.validation?.errors || []).join('; ') || result.message || 'unknown';
+    throw new Error(`Rejected by SSSS contract: ${reason}`);
   }
-  lines.push('---');
-  lines.push(content);
-
-  const filePath = path.join(categoryDir, `${slug}.md`);
-
-  // If an existing file exists, preserve the created timestamp
-  if (fs.existsSync(filePath)) {
-    try {
-      const existing = fs.readFileSync(filePath, 'utf8');
-      const createdMatch = existing.match(/^created:\s*"?([^"\n]+)"?$/m);
-      if (createdMatch) {
-        const idx = lines.findIndex(l => l.startsWith('created:'));
-        if (idx >= 0) lines[idx] = `created: ${JSON.stringify(createdMatch[1])}`;
-      }
-    } catch { /* use new timestamp */ }
-  }
-
-  fs.writeFileSync(filePath, lines.join('\n'));
-  return filePath;
+  return nodePath;
 }
 
 /**
  * Sync a single repo: scan, hash-diff, ingest new/changed files.
  * Returns { repo, ingested, skipped, errors, deleted }.
  */
-function syncRepo(project) {
+async function syncRepo(project) {
   const repoPath = project.path;
   const repoName = project.name || path.basename(repoPath);
   const vaultDir = path.join(project.brainDir, 'memory-vault');
@@ -236,7 +248,7 @@ function syncRepo(project) {
       const content = fs.readFileSync(filePath, 'utf8');
       const slug = slugFromRelPath(repoName, relPath);
       const title = extractTitle(content, path.basename(filePath));
-      writeRepoNode(slug, title, content, repoName, relPath, vaultDir);
+      await writeRepoNode(slug, title, content, repoName, relPath, vaultDir);
       ingested++;
     } catch (err) {
       logger.warn('repo-sync', `Error ingesting ${repoName}/${relPath}: ${err.message}`);
@@ -274,7 +286,7 @@ function syncRepo(project) {
  *
  * @returns {{ repos: Array, totalIngested: number, totalSkipped: number }}
  */
-export function syncAllRepos() {
+export async function syncAllRepos() {
   const registry = loadProjectRegistry();
   const results = [];
   let totalIngested = 0;
@@ -285,7 +297,7 @@ export function syncAllRepos() {
     if (!fs.existsSync(project.path)) continue;
 
     try {
-      const result = syncRepo(project);
+      const result = await syncRepo(project);
       results.push(result);
       totalIngested += result.ingested;
       totalSkipped += result.skipped;
@@ -307,7 +319,7 @@ export function syncAllRepos() {
 /**
  * Sync a single repo by path (used during init).
  */
-export function syncSingleRepo(projectPath, brainDir) {
+export async function syncSingleRepo(projectPath, brainDir) {
   const project = {
     name: path.basename(projectPath),
     path: projectPath,

package/src/core/scheduler.mjs

@@ -183,6 +183,7 @@ export function persistTaskToDisk(task, queueDir) {
   }
 
   const raw = safeStringify(body || '', frontmatter);
+  // ssss-raw-write: scheduler/queue task envelope, not a vault node.
   atomicWrite(filepath, raw);
   task._filepath = filepath;
   return filepath;

package/src/core/schema.mjs

@@ -23,9 +23,32 @@ export const MemoryNodeSchema = z.object({
   slug: z.string(),
   category: z.string(),
   title: z.string(),
+  // SSSS 0.9 universal frontmatter (§4.2) is `type`/`title`/`description`/
+  // `timestamp`. `timestamp` was not declared here at all, so nothing in this
+  // schema could notice its absence — which is how 743 of the 912 nodes in the
+  // global vault ended up without one, and how all four scaffold seeds shipped
+  // failing the package validator.
+  //
+  // Kept `.optional()` deliberately: writeNodeValidated() fills both fields
+  // before this schema ever runs, so new writes are conformant, while the
+  // historical nodes that predate that backfill still parse on READ. Tighten to
+  // required only once those are migrated — otherwise recall breaks on the vault
+  // it is meant to read.
   description: z.string().optional(),
+  // ssssDatetime(), not z.string(): YAML parses an unquoted ISO timestamp into a
+  // Date, so a plain string check rejects the very frontmatter the vault writes.
+  // The preprocessor normalizes Date -> ISO string, which is why every other
+  // datetime field in this file uses it.
+  timestamp: ssssDatetime().optional(),
   resource: z.string().optional(),
-  status: z.enum(['active', 'superseded', 'deprecated', 'draft']),
+  // `archived` is a first-class Total Recall status, not a legacy artifact:
+  // repo-sync rewrites ingested nodes to it, clarity-rewriter sets it when a
+  // correction deletes a fact, fact-seeker and remember use it, and dream and
+  // the API both read it. The enum simply never listed it, so 574 nodes — the
+  // most common status in the vault — failed validation against a rule the
+  // host's own writers contradict. SSSS 0.9 puts no enum on memory.status at
+  // all, so this is a host restriction, not a spec requirement.
+  status: z.enum(['active', 'superseded', 'deprecated', 'draft', 'archived']),
   confidence: z.number().min(0).max(1).optional(),
   importance: z.number().int().min(1).max(5).optional(),
   created: ssssDatetime().optional(),

package/src/core/search.mjs

@@ -138,7 +138,7 @@ export async function semanticSearch(query, {
   // "the embedding API failed" and "the index for this brain was never built"
   // are completely different problems with completely different fixes, and
   // this used to report both as the former. That mislabelling cost real time —
-  // festech.live's project brain had 2602 vault nodes and 0 embeddings, and
+  // one project brain had 2602 vault nodes and 0 embeddings, and
   // every recall against it printed "Embedding API unreachable or
   // unconfigured. Configure GOOGLE_API_KEY or OPENAI_API_KEY", which sent the
   // reader off to check credentials that were working perfectly.