@@ -311,3 +311,123 @@ describe("background embed pass honors the configured embed timeout (CL-8615)",
     }
   });
 });
+
+describe("findPendingChunks skips tombstoned and non-live versions", () => {
+  it("joins memory.version and binds live generation so a forget-then-add cannot sweep [redacted] text", async () => {
+    const { findPendingChunks } = await loadRealCapture();
+    const queries: Array<{ sql: string; params: readonly unknown[] }> = [];
+    const client = {
+      query: (sql: string, params: readonly unknown[]) => {
+        queries.push({ sql, params });
+        return Promise.resolve([{ id: "chunk_live", text: "keep me" }]);
+      },
+    };
+    const table = {
+      tableName: `"memory"."embedding_0123456789abcdef"`,
+      dims: 128,
+      modelId: "test-model",
+    };
+
+    const pending = await findPendingChunks(client, "tenant-1", table, 100);
+
+    expect(pending).toEqual([{ id: "chunk_live", text: "keep me" }]);
+    expect(queries).toHaveLength(1);
+    const { sql, params } = queries[0]!;
+    expect(sql).toContain('INNER JOIN "memory"."version" v ON v.id = c.version_id');
+    expect(sql).toContain("v.status <> 'tombstoned'");
+    expect(sql).toContain("v.generation = $3");
+    expect(params).toEqual(["tenant-1", 100, "live"]);
+  });
+});
+
+describe("background embed scheduler serializes overlapping adds", () => {
+  it("overlapping enqueues for one tenant share one in-flight pass and never overlap run()", async () => {
+    const { createBackgroundEmbedScheduler } = await loadRealCapture();
+    const scheduler = createBackgroundEmbedScheduler();
+    let current = 0;
+    const batches: string[][] = [];
+    let release!: () => void;
+    const held = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    let holding = true;
+
+    const run = async (chunks: EmbeddableChunk[]) => {
+      current++;
+      batches.push(chunks.map((chunk) => chunk.id));
+      if (holding) {
+        holding = false;
+        await held;
+      }
+      current--;
+    };
+
+    const p1 = scheduler.enqueue({
+      tenantId: "tenant-1",
+      chunks: [{ id: "a", text: "a" }],
+      run,
+    });
+    const p2 = scheduler.enqueue({
+      tenantId: "tenant-1",
+      chunks: [{ id: "b", text: "b" }],
+      run,
+    });
+    const p3 = scheduler.enqueue({
+      tenantId: "tenant-1",
+      chunks: [{ id: "c", text: "c" }],
+      run,
+    });
+
+    await Promise.resolve();
+    expect(scheduler.passStarts()).toBe(1);
+    expect(scheduler.maxConcurrent()).toBe(1);
+    expect(current).toBe(1);
+    release();
+    await Promise.all([p1, p2, p3]);
+
+    expect(scheduler.maxConcurrent()).toBe(1);
+    expect(scheduler.passStarts()).toBeLessThanOrEqual(2);
+    expect(batches.flat().sort()).toEqual(["a", "b", "c"]);
+  });
+
+  it("passes for two tenants still never run concurrently", async () => {
+    const { createBackgroundEmbedScheduler } = await loadRealCapture();
+    const scheduler = createBackgroundEmbedScheduler();
+    let releaseFirst!: () => void;
+    const held = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    let holding = true;
+    const seenTenants: string[] = [];
+
+    const runFor = (tenantId: string) => async (_chunks: EmbeddableChunk[]) => {
+      seenTenants.push(tenantId);
+      if (holding) {
+        holding = false;
+        await held;
+      }
+    };
+
+    const pA = scheduler.enqueue({
+      tenantId: "tenant-a",
+      chunks: [{ id: "a", text: "a" }],
+      run: runFor("tenant-a"),
+    });
+    const pB = scheduler.enqueue({
+      tenantId: "tenant-b",
+      chunks: [{ id: "b", text: "b" }],
+      run: runFor("tenant-b"),
+    });
+
+    await Promise.resolve();
+    expect(scheduler.passStarts()).toBe(1);
+    expect(scheduler.maxConcurrent()).toBe(1);
+    expect(seenTenants).toEqual(["tenant-a"]);
+    releaseFirst();
+    await Promise.all([pA, pB]);
+
+    expect(scheduler.maxConcurrent()).toBe(1);
+    expect(scheduler.passStarts()).toBe(2);
+    expect(seenTenants).toEqual(["tenant-a", "tenant-b"]);
+  });
+});
@@ -642,6 +642,109 @@ const BACKGROUND_EMBED_PENDING_LIMIT = 100;
 // after a longer pause, rather than hammering it.
 const BACKGROUND_EMBED_RETRY_DELAYS_MS = [1_000, 5_000];
 
+export type BackgroundEmbedPassFn = (
+  chunks: EmbeddableChunk[],
+) => Promise<void>;
+
+export type BackgroundEmbedEnqueue = {
+  tenantId: string;
+  chunks: readonly EmbeddableChunk[];
+  run: BackgroundEmbedPassFn;
+};
+
+export type BackgroundEmbedScheduler = {
+  /**
+   * Queue a pass. Overlapping calls for the same tenant coalesce into the
+   * in-flight drain (at most one trailing rerun); different tenants share one
+   * process-wide chain so N concurrent adds never fan out N retry storms.
+   */
+  enqueue: (work: BackgroundEmbedEnqueue) => Promise<void>;
+  /** Count of `run` invocations started (test seam). */
+  passStarts: () => number;
+  /** Peak overlapping `run` invocations (test seam). */
+  maxConcurrent: () => number;
+};
+
+/**
+ * Serial, coalescing gate for detached embed passes. One `run` at a time
+ * process-wide; same-tenant chunks that arrive while a drain is queued or
+ * running join that drain instead of starting another 3-retry + sweep storm.
+ */
+export function createBackgroundEmbedScheduler(): BackgroundEmbedScheduler {
+  type TenantState = {
+    chunks: EmbeddableChunk[];
+    run: BackgroundEmbedPassFn;
+    waiters: Array<{
+      resolve: () => void;
+      reject: (err: unknown) => void;
+    }>;
+    queued: boolean;
+  };
+
+  const tenants = new Map<string, TenantState>();
+  let chain: Promise<void> = Promise.resolve();
+  let passStarts = 0;
+  let inRun = 0;
+  let maxConcurrent = 0;
+
+  async function drainTenant(tenantId: string): Promise<void> {
+    const state = tenants.get(tenantId);
+    if (!state) return;
+    let error: unknown;
+    try {
+      for (;;) {
+        const batch = state.chunks.splice(0, state.chunks.length);
+        if (batch.length === 0) break;
+        passStarts++;
+        inRun++;
+        if (inRun > maxConcurrent) maxConcurrent = inRun;
+        try {
+          await state.run(batch);
+        } finally {
+          inRun--;
+        }
+      }
+    } catch (err) {
+      error = err;
+    }
+    const waiters = state.waiters.splice(0, state.waiters.length);
+    tenants.delete(tenantId);
+    if (error !== undefined) {
+      for (const waiter of waiters) waiter.reject(error);
+      return;
+    }
+    for (const waiter of waiters) waiter.resolve();
+  }
+
+  return {
+    enqueue(work) {
+      let state = tenants.get(work.tenantId);
+      if (!state) {
+        state = { chunks: [], run: work.run, waiters: [], queued: false };
+        tenants.set(work.tenantId, state);
+      }
+      state.chunks.push(...work.chunks);
+      state.run = work.run;
+      const done = new Promise<void>((resolve, reject) => {
+        state.waiters.push({ resolve, reject });
+      });
+      if (!state.queued) {
+        state.queued = true;
+        const tenantId = work.tenantId;
+        chain = chain.then(
+          () => drainTenant(tenantId),
+          () => drainTenant(tenantId),
+        );
+      }
+      return done;
+    },
+    passStarts: () => passStarts,
+    maxConcurrent: () => maxConcurrent,
+  };
+}
+
+const backgroundEmbedScheduler = createBackgroundEmbedScheduler();
+
 function resolveBackgroundOpts(opts: CaptureBackgroundOpts = {}): {
   fetchImpl: typeof fetch;
   schedule: (task: () => Promise<void>) => void;
@@ -668,6 +771,11 @@ function resolveBackgroundOpts(opts: CaptureBackgroundOpts = {}): {
  * `limit` (oldest first) so a long outage sweeps incrementally, one
  * background pass at a time, instead of embedding an unbounded backlog in a
  * single call.
+ *
+ * Joins `memory.version` so a forget-then-add cannot sweep `[redacted]`
+ * placeholder text: tombstoned versions and non-live generations are skipped.
+ * Search already hides tombstones; this filter is wasted-work / placeholder-
+ * vector prevention, not a hit-leak fix.
  */
 export async function findPendingChunks(
   client: EmbedRegistrySqlClient,
@@ -682,11 +790,14 @@ export async function findPendingChunks(
   }
   const rows = await client.query(
     `SELECT c.id AS id, c.text AS text FROM "memory"."chunk" c
+     INNER JOIN "memory"."version" v ON v.id = c.version_id
      LEFT JOIN ${activeTable.tableName} e ON e.chunk_id = c.id
      WHERE c.tenant_id = $1 AND e.chunk_id IS NULL
+       AND v.status <> 'tombstoned'
+       AND v.generation = $3
      ORDER BY c.created_at ASC
      LIMIT $2`,
-    [tenantId, Math.max(1, Math.floor(limit))],
+    [tenantId, Math.max(1, Math.floor(limit)), LIVE_GENERATION],
   );
   return rows.map((row) => ({
     id: row["id"] as string,
@@ -885,9 +996,11 @@ export async function captureDocument(
   // inference) must never stall the `add` tool call, so the embed pass runs
   // detached with retry plus a bounded pending-chunk sweep (see
   // runBackgroundEmbedPass), and failures stay in the logs rather than the
-  // response. The synchronous paths below pay for no network: no chunks
-  // means nothing to embed, and no embed endpoint (lexical-only) is decided
-  // locally without touching the registry.
+  // response. The success path therefore omits `degraded: ["embed_unavailable"]`
+  // even while chunks are still pending: a captured result means the row store
+  // committed, not that the embedder has caught up. The synchronous paths
+  // below pay for no network: no chunks means nothing to embed, and no embed
+  // endpoint (lexical-only) is decided locally without touching the registry.
   const embedClientConfig = toEmbedClientConfig(deps.config.embed);
   if (txResult.insertedChunks.length === 0 || !embedClientConfig) {
     const { degraded } = await embedInsertedChunksWithConfig(
@@ -909,11 +1022,16 @@ export async function captureDocument(
   const resolved = resolveBackgroundOpts(background);
   const backgroundChunks = txResult.insertedChunks;
   resolved.schedule(() =>
-    runBackgroundEmbedPass(deps.sql, input.tenantId, backgroundChunks, embedClientConfig, {
-      fetchImpl: resolved.fetchImpl,
-      sleep: resolved.sleep,
-      maxAttempts: resolved.maxAttempts,
-      pendingLimit: resolved.pendingLimit,
+    backgroundEmbedScheduler.enqueue({
+      tenantId: input.tenantId,
+      chunks: backgroundChunks,
+      run: (chunks) =>
+        runBackgroundEmbedPass(deps.sql, input.tenantId, chunks, embedClientConfig, {
+          fetchImpl: resolved.fetchImpl,
+          sleep: resolved.sleep,
+          maxAttempts: resolved.maxAttempts,
+          pendingLimit: resolved.pendingLimit,
+        }),
     }),
   );