@equationalapplications/core-llm-wiki 5.3.1 → 5.5.0

package/dist/{testing-zf3Jp_RL.d.mts → testing-D0RnZjyW.d.mts}

@@ -1,3 +1,4 @@
+import { OkfSource, OkfVerifiedEntry, OkfSourceUsageWindow } from '@equationalapplications/core-okf';
 import { SearchResult } from 'minisearch';
 
 /**
@@ -250,6 +251,38 @@ interface WikiFact {
      * OKF import. Distinct from `source_type`, which governs immutability rules.
      */
     okf_type?: string | null;
+    /** OKF v0.2 lifecycle state. Defaults to 'stable' on the SQL side. */
+    lifecycle_status?: 'draft' | 'stable' | 'deprecated';
+    /** Absolute YYYY-MM-DD cutoff for staleness. NULL = never stale. */
+    stale_after?: number | null;
+    /** Actor string per OKF v0.2 §7 (`<producer>/<version>`, `human:<id>`, `process:<id>`). */
+    generated_by?: string | null;
+    /** Full list of OKF v0.2 sources (provenance). */
+    okf_sources?: OkfSource[];
+    /** Chronological list of verification events. */
+    okf_verified?: OkfVerifiedEntry[];
+    /** Sibling-of-sources usage window object. */
+    okf_usage_window?: OkfSourceUsageWindow | null;
+    /** Convenience: epoch ms of the latest verifier. Derived; mirrored for query speed. */
+    last_verified_at?: number | null;
+    /** Convenience: actor string of the latest verifier. Derived; mirrored for query speed. */
+    last_verified_by?: string | null;
+    /**
+     * Hydrated at read time: `isStaleAfter(stale_after, now)`. `true` once the
+     * absolute stale_after cutoff has passed; `false` otherwise (including when
+     * stale_after is null). Surfaced per spec §2.7 + §5.3 so hosts can render
+     * staleness without recomputing. Always present on read paths that go
+     * through `mapRowToFact` / `mapRowToTask`.
+     */
+    isStale?: boolean;
+    /**
+     * Hydrated at read time: `deriveTrustTier(okf_verified)`. `'human-reviewed'`
+     * when any entry has `by: 'human:...'`, `'machine-confirmed'` when entries
+     * exist without a human verifier, `'unverified'` when okf_verified is empty.
+     * Surfaced per spec §2.7 + §5.3. Always present on read paths that go through
+     * `mapRowToFact` / `mapRowToTask`.
+     */
+    trustTier?: 'unverified' | 'machine-confirmed' | 'human-reviewed';
 }
 interface WikiTask {
     id: string;
@@ -263,6 +296,27 @@ interface WikiTask {
     deleted_at: number | null;
     /** Verbatim OKF `type:` frontmatter value when this task originated from an OKF bundle. */
     okf_type?: string | null;
+    lifecycle_status?: 'draft' | 'stable' | 'deprecated';
+    stale_after?: number | null;
+    generated_by?: string | null;
+    okf_sources?: OkfSource[];
+    okf_verified?: OkfVerifiedEntry[];
+    okf_usage_window?: OkfSourceUsageWindow | null;
+    last_verified_at?: number | null;
+    last_verified_by?: string | null;
+    /**
+     * Hydrated at read time: `isStaleAfter(stale_after, now)`. Mirrors
+     * {@link WikiFact.isStale} (spec §2.5 + §5.3 treat stale_after symmetrically
+     * for tasks and facts). Always present on read paths that go through
+     * `mapRowToTask`.
+     */
+    isStale?: boolean;
+    /**
+     * Hydrated at read time: `deriveTrustTier(okf_verified)`. Mirrors
+     * {@link WikiFact.trustTier}. Always present on read paths that go through
+     * `mapRowToTask`.
+     */
+    trustTier?: 'unverified' | 'machine-confirmed' | 'human-reviewed';
 }
 interface WikiEvent {
     id: string;
@@ -619,6 +673,79 @@ declare class PrunePartialFailureError extends Error {
     constructor(deleted: number, failedAt: string, remaining: number, cause: Error, deletedTasks?: number, deletedEvents?: number);
 }
 declare const HOOK_TIMEOUT_MARKER: unique symbol;
+/**
+ * Failure record for a single chunk that could not be ingested. Produced by
+ * `IngestionService.ingestDocument` and surfaced on the result's `parseFailures`
+ * array. `source === 'parse'` for `WikiParseError`-shaped failures (then `tier`
+ * is set); `source === 'llm'` for `generateText` rejections (no `tier`).
+ *
+ * Note: `'ontologyContext'` is reserved but NEVER produced. `buildPromptContext`
+ * failures are DB-systemic and propagate as raw throws, not as `parseFailures`.
+ */
+interface ChunkFailure {
+    chunkIndex: number;
+    sourceRef: string;
+    source: 'parse' | 'llm';
+    tier?: 'strict' | 'repair' | 'all';
+    position: number | null;
+    message: string;
+}
+/**
+ * Result of `IngestionService.ingestDocument`. The shape WIDENS relative to
+ * earlier versions: `ingestedChunks` and `failedChunks` are always present;
+ * `parseFailures` is present iff at least one chunk failed.
+ *
+ * Hosts that destructure `{ truncated, chunks }` see no behavior change.
+ * Hosts pattern-matching the entire shape must update to the new fields.
+ */
+interface IngestDocumentResult {
+    truncated: boolean;
+    chunks: number;
+    ingestedChunks: number;
+    failedChunks: number;
+    duplicateOf?: string;
+    parseFailures?: ChunkFailure[];
+}
+/**
+ * Thrown by `parseJsonResponse` when both the strict scanner pass and the
+ * container-aware repair pass fail to produce a parsable candidate.
+ *
+ * - `tier: 'strict'` — the existing scanner produced no usable slice (no
+ *   `{`/`[` at all, or no balanced close). `slice` is the full input text;
+ *   `position` is the offset of the first `{`/`[`, or `null` when none found.
+ * - `tier: 'repair'` — tier 1 found a slice but `JSON.parse` failed; tier 2
+ *   produced no parsable candidate within `MAX_REPAIR_CANDIDATES`. `slice` is
+ *   the largest balanced span the walker found; `position` is the offset of
+ *   the first parse failure within that candidate when known.
+ * - `tier: 'all'` — generic catch-all.
+ */
+declare class WikiParseError extends Error {
+    readonly tier: 'strict' | 'repair' | 'all';
+    readonly position: number | null;
+    readonly slice: string;
+    constructor(message: string, opts: {
+        tier: WikiParseError['tier'];
+        position?: number | null;
+        slice?: string;
+    });
+}
+/**
+ * Thrown by `IngestionService.ingestDocument` when every chunk of a document
+ * failed (either `parseJsonResponse` or `generateText`). A silent zero-fact
+ * ingest is a worse regression than a typed throw — matches existing host
+ * semantics (`aws-cloud-agent` Writer Lambda today sees `ingestDocument`
+ * throw on any failure).
+ */
+declare class WikiIngestEmptyError extends Error {
+    readonly parseFailures: ChunkFailure[];
+    readonly sourceRef: string;
+    readonly chunks: number;
+    constructor(params: {
+        parseFailures: ChunkFailure[];
+        sourceRef: string;
+        chunks: number;
+    });
+}
 
 interface WikiOutboxEvent<T = unknown> {
     id: string;
@@ -697,6 +824,21 @@ declare class EntryRepository extends BaseRepository {
      * Upsert a WikiFact. Nullable fields set to null when fact value is null.
      * Returns { changes, lastInsertRowId }.
      * `tx` is REQUIRED to ensure atomic outbox staging.
+     *
+     * OKF metadata discipline (spec §2.5 + DAO checklist §8): content writes
+     * MUST NOT silently overwrite OKF metadata that a caller didn't supply. The
+     * previous CASE WHEN IS NULL guards around `lifecycle_status`, etc. were
+     * dead because the bind always supplied a non-null value (notably
+     * `fact.lifecycle_status ?? 'stable'`), so excluded.X was never NULL and
+     * an UPDATE rewrote an existing `deprecated` row to `stable`. We now omit
+     * these columns from the SET clause entirely — SQLite's ON CONFLICT UPDATE
+     * leaves untouched columns at their existing row value, which is exactly
+     * the preservation semantics we want for content writes. Callers that
+     * intentionally want to overwrite OKF metadata should use
+     * {@link upsertForImport} (always-replace semantics for that path).
+     * New-row INSERTs still bind a value so the column is populated; if the
+     * caller supplied nothing, the schema DEFAULT 'stable' applies when the
+     * bind is bound as 'stable' explicitly here.
      */
     upsert(fact: WikiFact, tx: SQLiteAdapter): Promise<{
         changes: number;
@@ -1422,11 +1564,7 @@ declare class IngestionService {
         promptOverride?: string;
     }, opts?: {
         onDuplicateHash?: 'ingest' | 'skip' | 'throw';
-    }): Promise<{
-        truncated: boolean;
-        chunks: number;
-        duplicateOf?: string;
-    }>;
+    }): Promise<IngestDocumentResult>;
     /**
      * Implements spec §2 data flow steps a–j with the host-facing
      * `{sourceRef, sourceHash, nodes, edges}` parameter shape. Shared between
@@ -1470,6 +1608,38 @@ declare class IngestionService {
         edgesWritten: number;
         superseded: number;
     }>;
+    /**
+     * Full supersession + ownership path: identical to the pre-issue-#92 behavior
+     * for the happy path. Called from the `failedChunks === 0` branch of
+     * `ingestDocument`. Runs INSIDE the caller's tx.
+     *
+     * Returns `{ deletedSourceFactIds, insertedFacts }` so the caller can fire
+     * post-commit hooks (embedding lifecycle) AFTER the transaction commits.
+     * On the partial path the caller never invokes this method; the empty
+     * arrays stay empty.
+     */
+    private runFullUpsertGraph;
+    /**
+     * Partial-commit path for `ingestDocument`. Inserts ONLY facts whose
+     * normalized title is not already in the live set for this (entityId,
+     * sourceRef). Does NOT call `entryRepo.softDeleteBySource` (no
+     * supersession) and does NOT call `sourceRefIndexRepo.upsert` (no
+     * ownership). Edges are NOT resolved on this path (no ontology-context
+     * build, no `resolveEdges`, no `mergeEmergentUpdates`). Stale edges from
+     * prior attempts are recovered on the next full run's supersession.
+     *
+     * Source-hash is stored as NULL on partial rows. `findLatestSourceHash`
+     * reads from the most recently updated live row for the sourceRef, so
+     * storing the incoming hash here would cause `hasChanged` to return
+     * `false` on a same-hash retry — the failed chunks would never get a
+     * second chance. With NULL, a retry sees `storedHash === null`, `hasChanged`
+     * returns `true`, and the partial commit's sibling rows remain live
+     * (deduped, not superseded) for the next attempt to extend.
+     *
+     * Runs INSIDE the caller's `tx`. Does not open a nested transaction.
+     * Returns `{ inserted, skippedDuplicate }` for observability.
+     */
+    private appendPartialFacts;
 }
 
 declare class TaskRepository extends BaseRepository {
@@ -1494,6 +1664,12 @@ declare class TaskRepository extends BaseRepository {
      * Uses ON CONFLICT(id) DO UPDATE (not INSERT OR REPLACE).
      * Stages an outbox entry in the same transaction.
      * `tx` is REQUIRED.
+     *
+     * OKF metadata (lifecycle_status, sources, etc.) is intentionally excluded
+     * from the SET clause so content writes preserve any existing row values.
+     * See {@link EntryRepository.upsert} for the rationale — the same applies
+     * symmetrically to tasks (spec §2.5). Callers that need to overwrite OKF
+     * metadata should use {@link upsertForImport}.
      */
     upsert(task: WikiTask, tx: SQLiteAdapter, updatedAt?: number): Promise<void>;
     upsertForImport(task: WikiTask, tx: SQLiteAdapter, updatedAt?: number): Promise<void>;
@@ -1835,6 +2011,7 @@ declare class WikiMemory {
     private promptService;
     private ontologyService;
     private graphTraversalService;
+    private readonly okfTrustWrites;
     constructor(db: SQLiteAdapter, options: WikiOptions);
     /**
      * Explicit escape hatch for test suites: typed access to composed services for mocks/spies.
@@ -2022,11 +2199,7 @@ declare class WikiMemory {
         promptOverride?: string;
     }, opts?: {
         onDuplicateHash?: 'ingest' | 'skip' | 'throw';
-    }): Promise<{
-        truncated: boolean;
-        chunks: number;
-        duplicateOf?: string;
-    }>;
+    }): Promise<IngestDocumentResult>;
     /**
      * Deterministic write path into the graph. Accepts caller-supplied
      * `(nodes, edges)` and writes them under `(sourceRef, sourceHash)`
@@ -2101,6 +2274,34 @@ declare class WikiMemory {
     setOntologyManifest(entityId: string, manifest: OntologyManifest, options?: {
         mode?: OntologyMode;
     }): Promise<void>;
+    /** Append a verification event to a fact. Does NOT touch `updated_at`. */
+    writeOkfTrust(entryId: string, entityId: string, verified: {
+        by: string;
+        at: string;
+    }[]): Promise<void>;
+    /** Replace a fact's source list. Does NOT touch `updated_at`. */
+    writeOkfSources(entryId: string, entityId: string, sources: Array<{
+        resource: string;
+        [k: string]: unknown;
+    }>): Promise<void>;
+    /** Set a fact's OKF v0.2 lifecycle status. Does NOT touch `updated_at`. */
+    setLifecycleStatus(entryId: string, entityId: string, status: 'draft' | 'stable' | 'deprecated'): Promise<void>;
+    /** Set a fact's stale_after (epoch ms) or clear it. Does NOT touch `updated_at`. */
+    setStaleAfter(entryId: string, entityId: string, date: number | null): Promise<void>;
+    /** Set a fact's generated_by actor string. Does NOT touch `updated_at`. */
+    setGeneratedBy(entryId: string, entityId: string, actor: string): Promise<void>;
+    /** Task variants of the same five DAO methods. Symmetric per spec §2.5. */
+    writeOkfTrustTask(taskId: string, entityId: string, verified: {
+        by: string;
+        at: string;
+    }[]): Promise<void>;
+    writeOkfSourcesTask(taskId: string, entityId: string, sources: Array<{
+        resource: string;
+        [k: string]: unknown;
+    }>): Promise<void>;
+    setLifecycleStatusTask(taskId: string, entityId: string, status: 'draft' | 'stable' | 'deprecated'): Promise<void>;
+    setStaleAfterTask(taskId: string, entityId: string, date: number | null): Promise<void>;
+    setGeneratedByTask(taskId: string, entityId: string, actor: string): Promise<void>;
 }
 
-export { ImportExportService as $, WikiBusyError as A, type WikiBusyOperation as B, type WikiCheckpoint as C, type WikiConfig as D, type EntityStatus as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, WikiDuplicateHashError as I, type WikiEdge as J, type WikiEvent as K, type LLMProvider as L, type MemoryBundle as M, type WikiFact as N, type OntologyManifest as O, type PromptOverrides as P, type WikiMemoryTestAccess as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiOutboxEvent as T, WikiSourceRefHashCollision as U, type VectorRanker as V, type WikiOptions as W, WikiStrictOntologyViolation as X, type WikiTask as Y, WikiTransactionError as Z, EmbeddingService as _, type MemoryDump as a, IngestionService as a0, JobManager as a1, MaintenanceService as a2, RetrievalService as a3, SearchService as a4, WriteService as a5, type FormattedMemoryDump as b, WikiMemory as c, type ExtractedFact as d, type ExtractedFactEdge as e, type ExtractedFactWithOntology as f, type ExtractedTask as g, type GraphTraversalOptions as h, HEAL_RECHECK_MS as i, HOOK_TIMEOUT_MARKER as j, type HealResult as k, ONTOLOGY_BACKFILL_BATCH_SIZE as l, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as m, ONTOLOGY_BACKFILL_RECHECK_MS as n, type OntologyBackfillResult as o, type OntologyConfig as p, type OntologyEdgeType as q, type OntologyMode as r, type OntologyNodeType as s, type OntologyPromptContext as t, type OntologyUpdates as u, PromptService as v, PrunePartialFailureError as w, type VectorRankerFallback as x, type VectorRankerRankArgs as y, type VectorRankerSemanticResult as z };
+export { WikiStrictOntologyViolation as $, WikiBusyError as A, type WikiBusyOperation as B, type ChunkFailure as C, type WikiCheckpoint as D, type EntityStatus as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, type IngestDocumentResult as I, type WikiConfig as J, WikiDuplicateHashError as K, type LLMProvider as L, type MemoryBundle as M, type WikiEdge as N, type OntologyManifest as O, type PromptOverrides as P, type WikiEvent as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiFact as T, WikiIngestEmptyError as U, type VectorRanker as V, type WikiOptions as W, type WikiMemoryTestAccess as X, type WikiOutboxEvent as Y, WikiParseError as Z, WikiSourceRefHashCollision as _, type MemoryDump as a, type WikiTask as a0, WikiTransactionError as a1, EmbeddingService as a2, ImportExportService as a3, IngestionService as a4, JobManager as a5, MaintenanceService as a6, RetrievalService as a7, SearchService as a8, WriteService as a9, type FormattedMemoryDump as b, WikiMemory as c, type ExtractedFact as d, type ExtractedFactEdge as e, type ExtractedFactWithOntology as f, type ExtractedTask as g, type GraphTraversalOptions as h, HEAL_RECHECK_MS as i, HOOK_TIMEOUT_MARKER as j, type HealResult as k, ONTOLOGY_BACKFILL_BATCH_SIZE as l, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as m, ONTOLOGY_BACKFILL_RECHECK_MS as n, type OntologyBackfillResult as o, type OntologyConfig as p, type OntologyEdgeType as q, type OntologyMode as r, type OntologyNodeType as s, type OntologyPromptContext as t, type OntologyUpdates as u, PromptService as v, PrunePartialFailureError as w, type VectorRankerFallback as x, type VectorRankerRankArgs as y, type VectorRankerSemanticResult as z };

package/dist/{testing-zf3Jp_RL.d.ts → testing-D0RnZjyW.d.ts}

@@ -1,3 +1,4 @@
+import { OkfSource, OkfVerifiedEntry, OkfSourceUsageWindow } from '@equationalapplications/core-okf';
 import { SearchResult } from 'minisearch';
 
 /**
@@ -250,6 +251,38 @@ interface WikiFact {
      * OKF import. Distinct from `source_type`, which governs immutability rules.
      */
     okf_type?: string | null;
+    /** OKF v0.2 lifecycle state. Defaults to 'stable' on the SQL side. */
+    lifecycle_status?: 'draft' | 'stable' | 'deprecated';
+    /** Absolute YYYY-MM-DD cutoff for staleness. NULL = never stale. */
+    stale_after?: number | null;
+    /** Actor string per OKF v0.2 §7 (`<producer>/<version>`, `human:<id>`, `process:<id>`). */
+    generated_by?: string | null;
+    /** Full list of OKF v0.2 sources (provenance). */
+    okf_sources?: OkfSource[];
+    /** Chronological list of verification events. */
+    okf_verified?: OkfVerifiedEntry[];
+    /** Sibling-of-sources usage window object. */
+    okf_usage_window?: OkfSourceUsageWindow | null;
+    /** Convenience: epoch ms of the latest verifier. Derived; mirrored for query speed. */
+    last_verified_at?: number | null;
+    /** Convenience: actor string of the latest verifier. Derived; mirrored for query speed. */
+    last_verified_by?: string | null;
+    /**
+     * Hydrated at read time: `isStaleAfter(stale_after, now)`. `true` once the
+     * absolute stale_after cutoff has passed; `false` otherwise (including when
+     * stale_after is null). Surfaced per spec §2.7 + §5.3 so hosts can render
+     * staleness without recomputing. Always present on read paths that go
+     * through `mapRowToFact` / `mapRowToTask`.
+     */
+    isStale?: boolean;
+    /**
+     * Hydrated at read time: `deriveTrustTier(okf_verified)`. `'human-reviewed'`
+     * when any entry has `by: 'human:...'`, `'machine-confirmed'` when entries
+     * exist without a human verifier, `'unverified'` when okf_verified is empty.
+     * Surfaced per spec §2.7 + §5.3. Always present on read paths that go through
+     * `mapRowToFact` / `mapRowToTask`.
+     */
+    trustTier?: 'unverified' | 'machine-confirmed' | 'human-reviewed';
 }
 interface WikiTask {
     id: string;
@@ -263,6 +296,27 @@ interface WikiTask {
     deleted_at: number | null;
     /** Verbatim OKF `type:` frontmatter value when this task originated from an OKF bundle. */
     okf_type?: string | null;
+    lifecycle_status?: 'draft' | 'stable' | 'deprecated';
+    stale_after?: number | null;
+    generated_by?: string | null;
+    okf_sources?: OkfSource[];
+    okf_verified?: OkfVerifiedEntry[];
+    okf_usage_window?: OkfSourceUsageWindow | null;
+    last_verified_at?: number | null;
+    last_verified_by?: string | null;
+    /**
+     * Hydrated at read time: `isStaleAfter(stale_after, now)`. Mirrors
+     * {@link WikiFact.isStale} (spec §2.5 + §5.3 treat stale_after symmetrically
+     * for tasks and facts). Always present on read paths that go through
+     * `mapRowToTask`.
+     */
+    isStale?: boolean;
+    /**
+     * Hydrated at read time: `deriveTrustTier(okf_verified)`. Mirrors
+     * {@link WikiFact.trustTier}. Always present on read paths that go through
+     * `mapRowToTask`.
+     */
+    trustTier?: 'unverified' | 'machine-confirmed' | 'human-reviewed';
 }
 interface WikiEvent {
     id: string;
@@ -619,6 +673,79 @@ declare class PrunePartialFailureError extends Error {
     constructor(deleted: number, failedAt: string, remaining: number, cause: Error, deletedTasks?: number, deletedEvents?: number);
 }
 declare const HOOK_TIMEOUT_MARKER: unique symbol;
+/**
+ * Failure record for a single chunk that could not be ingested. Produced by
+ * `IngestionService.ingestDocument` and surfaced on the result's `parseFailures`
+ * array. `source === 'parse'` for `WikiParseError`-shaped failures (then `tier`
+ * is set); `source === 'llm'` for `generateText` rejections (no `tier`).
+ *
+ * Note: `'ontologyContext'` is reserved but NEVER produced. `buildPromptContext`
+ * failures are DB-systemic and propagate as raw throws, not as `parseFailures`.
+ */
+interface ChunkFailure {
+    chunkIndex: number;
+    sourceRef: string;
+    source: 'parse' | 'llm';
+    tier?: 'strict' | 'repair' | 'all';
+    position: number | null;
+    message: string;
+}
+/**
+ * Result of `IngestionService.ingestDocument`. The shape WIDENS relative to
+ * earlier versions: `ingestedChunks` and `failedChunks` are always present;
+ * `parseFailures` is present iff at least one chunk failed.
+ *
+ * Hosts that destructure `{ truncated, chunks }` see no behavior change.
+ * Hosts pattern-matching the entire shape must update to the new fields.
+ */
+interface IngestDocumentResult {
+    truncated: boolean;
+    chunks: number;
+    ingestedChunks: number;
+    failedChunks: number;
+    duplicateOf?: string;
+    parseFailures?: ChunkFailure[];
+}
+/**
+ * Thrown by `parseJsonResponse` when both the strict scanner pass and the
+ * container-aware repair pass fail to produce a parsable candidate.
+ *
+ * - `tier: 'strict'` — the existing scanner produced no usable slice (no
+ *   `{`/`[` at all, or no balanced close). `slice` is the full input text;
+ *   `position` is the offset of the first `{`/`[`, or `null` when none found.
+ * - `tier: 'repair'` — tier 1 found a slice but `JSON.parse` failed; tier 2
+ *   produced no parsable candidate within `MAX_REPAIR_CANDIDATES`. `slice` is
+ *   the largest balanced span the walker found; `position` is the offset of
+ *   the first parse failure within that candidate when known.
+ * - `tier: 'all'` — generic catch-all.
+ */
+declare class WikiParseError extends Error {
+    readonly tier: 'strict' | 'repair' | 'all';
+    readonly position: number | null;
+    readonly slice: string;
+    constructor(message: string, opts: {
+        tier: WikiParseError['tier'];
+        position?: number | null;
+        slice?: string;
+    });
+}
+/**
+ * Thrown by `IngestionService.ingestDocument` when every chunk of a document
+ * failed (either `parseJsonResponse` or `generateText`). A silent zero-fact
+ * ingest is a worse regression than a typed throw — matches existing host
+ * semantics (`aws-cloud-agent` Writer Lambda today sees `ingestDocument`
+ * throw on any failure).
+ */
+declare class WikiIngestEmptyError extends Error {
+    readonly parseFailures: ChunkFailure[];
+    readonly sourceRef: string;
+    readonly chunks: number;
+    constructor(params: {
+        parseFailures: ChunkFailure[];
+        sourceRef: string;
+        chunks: number;
+    });
+}
 
 interface WikiOutboxEvent<T = unknown> {
     id: string;
@@ -697,6 +824,21 @@ declare class EntryRepository extends BaseRepository {
      * Upsert a WikiFact. Nullable fields set to null when fact value is null.
      * Returns { changes, lastInsertRowId }.
      * `tx` is REQUIRED to ensure atomic outbox staging.
+     *
+     * OKF metadata discipline (spec §2.5 + DAO checklist §8): content writes
+     * MUST NOT silently overwrite OKF metadata that a caller didn't supply. The
+     * previous CASE WHEN IS NULL guards around `lifecycle_status`, etc. were
+     * dead because the bind always supplied a non-null value (notably
+     * `fact.lifecycle_status ?? 'stable'`), so excluded.X was never NULL and
+     * an UPDATE rewrote an existing `deprecated` row to `stable`. We now omit
+     * these columns from the SET clause entirely — SQLite's ON CONFLICT UPDATE
+     * leaves untouched columns at their existing row value, which is exactly
+     * the preservation semantics we want for content writes. Callers that
+     * intentionally want to overwrite OKF metadata should use
+     * {@link upsertForImport} (always-replace semantics for that path).
+     * New-row INSERTs still bind a value so the column is populated; if the
+     * caller supplied nothing, the schema DEFAULT 'stable' applies when the
+     * bind is bound as 'stable' explicitly here.
      */
     upsert(fact: WikiFact, tx: SQLiteAdapter): Promise<{
         changes: number;
@@ -1422,11 +1564,7 @@ declare class IngestionService {
         promptOverride?: string;
     }, opts?: {
         onDuplicateHash?: 'ingest' | 'skip' | 'throw';
-    }): Promise<{
-        truncated: boolean;
-        chunks: number;
-        duplicateOf?: string;
-    }>;
+    }): Promise<IngestDocumentResult>;
     /**
      * Implements spec §2 data flow steps a–j with the host-facing
      * `{sourceRef, sourceHash, nodes, edges}` parameter shape. Shared between
@@ -1470,6 +1608,38 @@ declare class IngestionService {
         edgesWritten: number;
         superseded: number;
     }>;
+    /**
+     * Full supersession + ownership path: identical to the pre-issue-#92 behavior
+     * for the happy path. Called from the `failedChunks === 0` branch of
+     * `ingestDocument`. Runs INSIDE the caller's tx.
+     *
+     * Returns `{ deletedSourceFactIds, insertedFacts }` so the caller can fire
+     * post-commit hooks (embedding lifecycle) AFTER the transaction commits.
+     * On the partial path the caller never invokes this method; the empty
+     * arrays stay empty.
+     */
+    private runFullUpsertGraph;
+    /**
+     * Partial-commit path for `ingestDocument`. Inserts ONLY facts whose
+     * normalized title is not already in the live set for this (entityId,
+     * sourceRef). Does NOT call `entryRepo.softDeleteBySource` (no
+     * supersession) and does NOT call `sourceRefIndexRepo.upsert` (no
+     * ownership). Edges are NOT resolved on this path (no ontology-context
+     * build, no `resolveEdges`, no `mergeEmergentUpdates`). Stale edges from
+     * prior attempts are recovered on the next full run's supersession.
+     *
+     * Source-hash is stored as NULL on partial rows. `findLatestSourceHash`
+     * reads from the most recently updated live row for the sourceRef, so
+     * storing the incoming hash here would cause `hasChanged` to return
+     * `false` on a same-hash retry — the failed chunks would never get a
+     * second chance. With NULL, a retry sees `storedHash === null`, `hasChanged`
+     * returns `true`, and the partial commit's sibling rows remain live
+     * (deduped, not superseded) for the next attempt to extend.
+     *
+     * Runs INSIDE the caller's `tx`. Does not open a nested transaction.
+     * Returns `{ inserted, skippedDuplicate }` for observability.
+     */
+    private appendPartialFacts;
 }
 
 declare class TaskRepository extends BaseRepository {
@@ -1494,6 +1664,12 @@ declare class TaskRepository extends BaseRepository {
      * Uses ON CONFLICT(id) DO UPDATE (not INSERT OR REPLACE).
      * Stages an outbox entry in the same transaction.
      * `tx` is REQUIRED.
+     *
+     * OKF metadata (lifecycle_status, sources, etc.) is intentionally excluded
+     * from the SET clause so content writes preserve any existing row values.
+     * See {@link EntryRepository.upsert} for the rationale — the same applies
+     * symmetrically to tasks (spec §2.5). Callers that need to overwrite OKF
+     * metadata should use {@link upsertForImport}.
      */
     upsert(task: WikiTask, tx: SQLiteAdapter, updatedAt?: number): Promise<void>;
     upsertForImport(task: WikiTask, tx: SQLiteAdapter, updatedAt?: number): Promise<void>;
@@ -1835,6 +2011,7 @@ declare class WikiMemory {
     private promptService;
     private ontologyService;
     private graphTraversalService;
+    private readonly okfTrustWrites;
     constructor(db: SQLiteAdapter, options: WikiOptions);
     /**
      * Explicit escape hatch for test suites: typed access to composed services for mocks/spies.
@@ -2022,11 +2199,7 @@ declare class WikiMemory {
         promptOverride?: string;
     }, opts?: {
         onDuplicateHash?: 'ingest' | 'skip' | 'throw';
-    }): Promise<{
-        truncated: boolean;
-        chunks: number;
-        duplicateOf?: string;
-    }>;
+    }): Promise<IngestDocumentResult>;
     /**
      * Deterministic write path into the graph. Accepts caller-supplied
      * `(nodes, edges)` and writes them under `(sourceRef, sourceHash)`
@@ -2101,6 +2274,34 @@ declare class WikiMemory {
     setOntologyManifest(entityId: string, manifest: OntologyManifest, options?: {
         mode?: OntologyMode;
     }): Promise<void>;
+    /** Append a verification event to a fact. Does NOT touch `updated_at`. */
+    writeOkfTrust(entryId: string, entityId: string, verified: {
+        by: string;
+        at: string;
+    }[]): Promise<void>;
+    /** Replace a fact's source list. Does NOT touch `updated_at`. */
+    writeOkfSources(entryId: string, entityId: string, sources: Array<{
+        resource: string;
+        [k: string]: unknown;
+    }>): Promise<void>;
+    /** Set a fact's OKF v0.2 lifecycle status. Does NOT touch `updated_at`. */
+    setLifecycleStatus(entryId: string, entityId: string, status: 'draft' | 'stable' | 'deprecated'): Promise<void>;
+    /** Set a fact's stale_after (epoch ms) or clear it. Does NOT touch `updated_at`. */
+    setStaleAfter(entryId: string, entityId: string, date: number | null): Promise<void>;
+    /** Set a fact's generated_by actor string. Does NOT touch `updated_at`. */
+    setGeneratedBy(entryId: string, entityId: string, actor: string): Promise<void>;
+    /** Task variants of the same five DAO methods. Symmetric per spec §2.5. */
+    writeOkfTrustTask(taskId: string, entityId: string, verified: {
+        by: string;
+        at: string;
+    }[]): Promise<void>;
+    writeOkfSourcesTask(taskId: string, entityId: string, sources: Array<{
+        resource: string;
+        [k: string]: unknown;
+    }>): Promise<void>;
+    setLifecycleStatusTask(taskId: string, entityId: string, status: 'draft' | 'stable' | 'deprecated'): Promise<void>;
+    setStaleAfterTask(taskId: string, entityId: string, date: number | null): Promise<void>;
+    setGeneratedByTask(taskId: string, entityId: string, actor: string): Promise<void>;
 }
 
-export { ImportExportService as $, WikiBusyError as A, type WikiBusyOperation as B, type WikiCheckpoint as C, type WikiConfig as D, type EntityStatus as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, WikiDuplicateHashError as I, type WikiEdge as J, type WikiEvent as K, type LLMProvider as L, type MemoryBundle as M, type WikiFact as N, type OntologyManifest as O, type PromptOverrides as P, type WikiMemoryTestAccess as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiOutboxEvent as T, WikiSourceRefHashCollision as U, type VectorRanker as V, type WikiOptions as W, WikiStrictOntologyViolation as X, type WikiTask as Y, WikiTransactionError as Z, EmbeddingService as _, type MemoryDump as a, IngestionService as a0, JobManager as a1, MaintenanceService as a2, RetrievalService as a3, SearchService as a4, WriteService as a5, type FormattedMemoryDump as b, WikiMemory as c, type ExtractedFact as d, type ExtractedFactEdge as e, type ExtractedFactWithOntology as f, type ExtractedTask as g, type GraphTraversalOptions as h, HEAL_RECHECK_MS as i, HOOK_TIMEOUT_MARKER as j, type HealResult as k, ONTOLOGY_BACKFILL_BATCH_SIZE as l, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as m, ONTOLOGY_BACKFILL_RECHECK_MS as n, type OntologyBackfillResult as o, type OntologyConfig as p, type OntologyEdgeType as q, type OntologyMode as r, type OntologyNodeType as s, type OntologyPromptContext as t, type OntologyUpdates as u, PromptService as v, PrunePartialFailureError as w, type VectorRankerFallback as x, type VectorRankerRankArgs as y, type VectorRankerSemanticResult as z };
+export { WikiStrictOntologyViolation as $, WikiBusyError as A, type WikiBusyOperation as B, type ChunkFailure as C, type WikiCheckpoint as D, type EntityStatus as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, type IngestDocumentResult as I, type WikiConfig as J, WikiDuplicateHashError as K, type LLMProvider as L, type MemoryBundle as M, type WikiEdge as N, type OntologyManifest as O, type PromptOverrides as P, type WikiEvent as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiFact as T, WikiIngestEmptyError as U, type VectorRanker as V, type WikiOptions as W, type WikiMemoryTestAccess as X, type WikiOutboxEvent as Y, WikiParseError as Z, WikiSourceRefHashCollision as _, type MemoryDump as a, type WikiTask as a0, WikiTransactionError as a1, EmbeddingService as a2, ImportExportService as a3, IngestionService as a4, JobManager as a5, MaintenanceService as a6, RetrievalService as a7, SearchService as a8, WriteService as a9, type FormattedMemoryDump as b, WikiMemory as c, type ExtractedFact as d, type ExtractedFactEdge as e, type ExtractedFactWithOntology as f, type ExtractedTask as g, type GraphTraversalOptions as h, HEAL_RECHECK_MS as i, HOOK_TIMEOUT_MARKER as j, type HealResult as k, ONTOLOGY_BACKFILL_BATCH_SIZE as l, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as m, ONTOLOGY_BACKFILL_RECHECK_MS as n, type OntologyBackfillResult as o, type OntologyConfig as p, type OntologyEdgeType as q, type OntologyMode as r, type OntologyNodeType as s, type OntologyPromptContext as t, type OntologyUpdates as u, PromptService as v, PrunePartialFailureError as w, type VectorRankerFallback as x, type VectorRankerRankArgs as y, type VectorRankerSemanticResult as z };

package/dist/testing.d.mts

@@ -1,2 +1,3 @@
-export { _ as EmbeddingService, $ as ImportExportService, a0 as IngestionService, a1 as JobManager, a1 as JobManagerType, a2 as MaintenanceService, a3 as RetrievalService, a4 as SearchService, a4 as SearchServiceType, Q as WikiMemoryTestAccess, a5 as WriteService } from './testing-zf3Jp_RL.mjs';
+export { a2 as EmbeddingService, a3 as ImportExportService, a4 as IngestionService, a5 as JobManager, a5 as JobManagerType, a6 as MaintenanceService, a7 as RetrievalService, a8 as SearchService, a8 as SearchServiceType, X as WikiMemoryTestAccess, a9 as WriteService } from './testing-D0RnZjyW.mjs';
+import '@equationalapplications/core-okf';
 import 'minisearch';

package/dist/testing.d.ts

@@ -1,2 +1,3 @@
-export { _ as EmbeddingService, $ as ImportExportService, a0 as IngestionService, a1 as JobManager, a1 as JobManagerType, a2 as MaintenanceService, a3 as RetrievalService, a4 as SearchService, a4 as SearchServiceType, Q as WikiMemoryTestAccess, a5 as WriteService } from './testing-zf3Jp_RL.js';
+export { a2 as EmbeddingService, a3 as ImportExportService, a4 as IngestionService, a5 as JobManager, a5 as JobManagerType, a6 as MaintenanceService, a7 as RetrievalService, a8 as SearchService, a8 as SearchServiceType, X as WikiMemoryTestAccess, a9 as WriteService } from './testing-D0RnZjyW.js';
+import '@equationalapplications/core-okf';
 import 'minisearch';