@inerrata-corporation/errata 2.0.1-dev.60 → 2.0.2-dev.125

package/consolidate-worker.mjs

@@ -15194,7 +15194,10 @@ var init_edge_rules = __esm({
       // NOT ruled here — the type pre-exists with broader extractor senses, and a
       // new rule on an old type would reject legitimate live flows (reject-never-flip
       // cuts both ways: only rule types you introduce or senses that are documented).
-      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool"] },
+      // `Component` joined the target set with OM-agent-anchors: an agent-named
+      // component ("React Router") is the same knowledge→named-unit anchor shape as
+      // a Tool — the knowledge is ABOUT it, not dependent on it.
+      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
       OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
       INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
       // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
@@ -15307,7 +15310,12 @@ var init_wire = __esm({
        *  knows which packages are private. The door does NOT trust a `public` claim
        *  blindly (it re-confirms on the spine); absent ⇒ unknown ⇒ fail-closed to
        *  org-private. Accepted-but-ignored until ORG_MEMBRANE_ENABLED flips. */
-      anchorVisibility: external_exports.enum(["public", "private"]).optional()
+      anchorVisibility: external_exports.enum(["public", "private"]).optional(),
+      /** The spine-resolvable anchor id backing a `public` tag (OM-anchor-tag): a
+       *  Package purl or `languageCanonicalId`. The door validates THIS on the
+       *  public spine (falling back to `canonicalId` when absent — context stubs
+       *  are self-anchored). Never trusted without spine confirmation. */
+      anchor: external_exports.string().min(1).max(300).optional()
     });
     RouteContextCountWireSchema = external_exports.object({
       confirmed: external_exports.number().int().min(0),
@@ -16023,6 +16031,13 @@ var SqliteGraphStore = class {
       findByLabel: this.db.prepare(
         "SELECT * FROM nodes WHERE label = ? AND valid_to IS NULL"
       ),
+      // Scalar count twin of findByLabel — same live-row semantics, no row
+      // hydration. Exists because status surfaces (daemon `/` + `/health`) used
+      // findNodesByLabel(...).length, materializing every row's attrs JSON and
+      // embedding blob per request — seconds of synchronous loop-hold per poll.
+      countByLabel: this.db.prepare(
+        "SELECT COUNT(*) AS n FROM nodes WHERE label = ? AND valid_to IS NULL"
+      ),
       // ALL versions of a label — incl frozen/closed (valid_to set). Used by the
       // clean-reindex purge so a true wipe removes history too, not just live rows.
       findByLabelAll: this.db.prepare("SELECT * FROM nodes WHERE label = ?"),
@@ -16276,6 +16291,13 @@ var SqliteGraphStore = class {
     const rows = this.stmts.findByLabel.all(label);
     return rows.map(rowToNode);
   }
+  /** Live-row count for a label — `findNodesByLabel(label).length` without the
+   *  per-row hydration (attrs JSON + embedding blob). Status surfaces poll this
+   *  per project per request; the materializing form held the daemon's event
+   *  loop for seconds at scale. */
+  countNodesByLabel(label) {
+    return Number(this.stmts.countByLabel.get(label).n);
+  }
   findAllVersionsByLabel(label) {
     const rows = this.stmts.findByLabelAll.all(label);
     return rows.map(rowToNode);

package/errata.mjs

@@ -938,6 +938,12 @@ function packageCanonicalId(p) {
   const name2 = eco === "npm" ? p.name.toLowerCase() : p.name;
   return `pkg:${eco}/${name2}${p.version ? `@${p.version}` : ""}`;
 }
+function versionlessPurl(purl) {
+  if (!purl.startsWith("pkg:")) return null;
+  const lastSlash = purl.lastIndexOf("/");
+  const lastAt = purl.lastIndexOf("@");
+  return lastAt > lastSlash ? purl.slice(0, lastAt) : purl;
+}
 function parsePackageRef(ref) {
   let rest2 = ref.trim();
   if (rest2.startsWith("pkg:")) {
@@ -15363,7 +15369,10 @@ var init_edge_rules = __esm({
       // NOT ruled here — the type pre-exists with broader extractor senses, and a
       // new rule on an old type would reject legitimate live flows (reject-never-flip
       // cuts both ways: only rule types you introduce or senses that are documented).
-      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool"] },
+      // `Component` joined the target set with OM-agent-anchors: an agent-named
+      // component ("React Router") is the same knowledge→named-unit anchor shape as
+      // a Tool — the knowledge is ABOUT it, not dependent on it.
+      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
       OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
       INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
       // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
@@ -15602,7 +15611,12 @@ var init_wire = __esm({
        *  knows which packages are private. The door does NOT trust a `public` claim
        *  blindly (it re-confirms on the spine); absent ⇒ unknown ⇒ fail-closed to
        *  org-private. Accepted-but-ignored until ORG_MEMBRANE_ENABLED flips. */
-      anchorVisibility: external_exports.enum(["public", "private"]).optional()
+      anchorVisibility: external_exports.enum(["public", "private"]).optional(),
+      /** The spine-resolvable anchor id backing a `public` tag (OM-anchor-tag): a
+       *  Package purl or `languageCanonicalId`. The door validates THIS on the
+       *  public spine (falling back to `canonicalId` when absent — context stubs
+       *  are self-anchored). Never trusted without spine confirmation. */
+      anchor: external_exports.string().min(1).max(300).optional()
     });
     RouteContextCountWireSchema = external_exports.object({
       confirmed: external_exports.number().int().min(0),
@@ -15993,6 +16007,7 @@ __export(src_exports, {
   toCloudAttrs: () => toCloudAttrs,
   toolCanonicalId: () => toolCanonicalId,
   validateCastaliaPayload: () => validateCastaliaPayload,
+  versionlessPurl: () => versionlessPurl,
   vetSidecarSummaries: () => vetSidecarSummaries
 });
 var init_src = __esm({
@@ -16662,6 +16677,13 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
           findByLabel: this.db.prepare(
             "SELECT * FROM nodes WHERE label = ? AND valid_to IS NULL"
           ),
+          // Scalar count twin of findByLabel — same live-row semantics, no row
+          // hydration. Exists because status surfaces (daemon `/` + `/health`) used
+          // findNodesByLabel(...).length, materializing every row's attrs JSON and
+          // embedding blob per request — seconds of synchronous loop-hold per poll.
+          countByLabel: this.db.prepare(
+            "SELECT COUNT(*) AS n FROM nodes WHERE label = ? AND valid_to IS NULL"
+          ),
           // ALL versions of a label — incl frozen/closed (valid_to set). Used by the
           // clean-reindex purge so a true wipe removes history too, not just live rows.
           findByLabelAll: this.db.prepare("SELECT * FROM nodes WHERE label = ?"),
@@ -16915,6 +16937,13 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
         const rows = this.stmts.findByLabel.all(label);
         return rows.map(rowToNode);
       }
+      /** Live-row count for a label — `findNodesByLabel(label).length` without the
+       *  per-row hydration (attrs JSON + embedding blob). Status surfaces poll this
+       *  per project per request; the materializing form held the daemon's event
+       *  loop for seconds at scale. */
+      countNodesByLabel(label) {
+        return Number(this.stmts.countByLabel.get(label).n);
+      }
       findAllVersionsByLabel(label) {
         const rows = this.stmts.findByLabelAll.all(label);
         return rows.map(rowToNode);
@@ -18316,6 +18345,55 @@ function mintDomainNode(store, name2, ts) {
   }
   return id;
 }
+function mintCitedPackageNode(store, ref, ts) {
+  const cleaned = ref.replace(/\s+/g, " ").trim();
+  const slash = /^([a-z0-9-]+)\/(.+)$/i.exec(cleaned);
+  const hasEco = slash != null && !cleaned.startsWith("@");
+  const name2 = (hasEco ? slash[2] : cleaned).trim();
+  const nameLc = name2.toLowerCase();
+  const existing = store.findNodesByLabel("Package").find((n) => String(n.attrs["name"] ?? "").toLowerCase() === nameLc);
+  if (existing) return existing.id;
+  let eco = hasEco ? slash[1].toLowerCase() : "";
+  if (!eco && cleaned.startsWith("@")) eco = "npm";
+  if (!eco) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const p of store.findNodesByLabel("Package")) {
+      const e = String(p.attrs["ecosystem"] ?? "").toLowerCase();
+      if (e) counts.set(e, (counts.get(e) ?? 0) + 1);
+    }
+    eco = [...counts.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] ?? "npm";
+  }
+  const purlName = eco === "npm" ? nameLc : name2;
+  const purl = `pkg:${eco}/${purlName}`;
+  if (!store.getNode(purl)) {
+    store.mergeNode(
+      buildNode(purl, "Package", name2, ts, {
+        purl,
+        name: name2,
+        ecosystem: eco,
+        resolved: false,
+        // agent-cited, no lockfile resolution
+        source: "convo",
+        provisional: true
+      })
+    );
+  }
+  return purl;
+}
+function mintComponentNode(store, name2, ts) {
+  const display = name2.replace(/\s+/g, " ").trim();
+  const slug2 = display.toLowerCase();
+  if (!store.getNode(slug2)) {
+    store.mergeNode(
+      buildNode(slug2, "Component", display, ts, {
+        name: display,
+        source: "convo",
+        provisional: true
+      })
+    );
+  }
+  return slug2;
+}
 function resolveFileNode(store, path2, workspaceId2) {
   const want = path2.trim().replace(/^\.?\//, "");
   for (const n of store.findNodesByLabel("File")) {
@@ -20766,6 +20844,8 @@ __export(src_exports2, {
   matchSymbolsInText: () => matchSymbolsInText,
   mergeCloudCounts: () => mergeCloudCounts,
   mergeDuplicateProblems: () => mergeDuplicateProblems,
+  mintCitedPackageNode: () => mintCitedPackageNode,
+  mintComponentNode: () => mintComponentNode,
   mintDomainNode: () => mintDomainNode,
   mintPatternNode: () => mintPatternNode,
   openGraphStore: () => openGraphStore,
@@ -21530,7 +21610,12 @@ function toWirePayload(batch, runId) {
     // attrs travel; node-level bookkeeping (embedding, momentum counters,
     // bi-temporal fields) is local-stratum and never crosses.
     attrs: n.attrs ?? {},
-    extractionSource: n.extractionSource
+    extractionSource: n.extractionSource,
+    // Org-membrane anchor tag (OM-anchor-tag): the batch builders set these
+    // on wire-bound projections only; the door re-validates the claim on the
+    // public spine, so lifting them is routing input, not a grant.
+    ...n.anchorVisibility ? { anchorVisibility: n.anchorVisibility } : {},
+    ...n.anchor ? { anchor: n.anchor } : {}
   }));
   const edges = batch.edges.filter((e) => !droppedNodeIds.has(e.from) && !droppedNodeIds.has(e.to)).map((e) => {
     const perContext = wirePerContext(e.attrs?.["perContext"]);
@@ -25125,6 +25210,11 @@ function linkBullet(ref) {
     `    \xB7 ${TAG_EXAMPLE.domain()} \u2014 name the ABSTRACT AREA it's about (e.g. (domain: Observability),`,
     "      (domain: Community Detection)). An abstract problem with no code anchor NEEDS this or it's",
     "      an invisible island: the Domain is the topic other problems in the area cluster on. Title Case.",
+    `    \xB7 ${TAG_EXAMPLE.package()} \u2014 the PUBLIC PACKAGE the problem is about, even when this`,
+    "      workspace doesn't depend on it (e.g. (package: chokidar), (package: pypi/requests)) \u2014 a",
+    "      public-registry anchor lets the knowledge cross to the collective; internal names stay private.",
+    `    \xB7 ${TAG_EXAMPLE.component()} \u2014 the framework/product-level UNIT it concerns when it's not a`,
+    "      package or a language (e.g. (component: React Router), (component: V8 Isolate)).",
     `    \xB7 (aids:[${ref}],\u2026) \u2014 your FIX could also help these other, even unrelated, problems.`,
     "      A hypothesis, not a claim \u2014 it's recorded as may-resolve and checked by whoever tries it.",
     `    \xB7 when your fix relates to a PRIOR solution you were primed with (a problem's`,
@@ -25196,6 +25286,12 @@ var init_agent_signals = __esm({
       // DOMAIN — the abstract area a problem is about; the concept layer an
       // anchor-less problem clusters on. Mints/resolves a Domain by name.
       domain: () => `(domain: The Area)`,
+      // PACKAGE/COMPONENT — agent-named public anchors (OM-agent-anchors): the
+      // package a problem is ABOUT (even when not a dependency) and the
+      // framework/product-level unit it concerns. Public spine anchors → the
+      // knowledge can cross to the collective.
+      package: () => `(package: the-package-name)`,
+      component: () => `(component: The Component)`,
       aids: (ref) => `(aids:[${ref}])`
     };
     GLOSS = {
@@ -37339,7 +37435,7 @@ var init_mcp = __esm({
       },
       {
         name: "errata.why",
-        description: "Causal/resolution neighborhood along the causal edge families (CAUSED_BY, MANIFESTS_AS, FIXED_BY, SOLVED_BY, \u2026), walked in both directions. For a Problem this surfaces its root causes AND solutions; for a Solution, the problems it resolves. Ranked by accumulated conductance. Pass nodeId or qname. Returns {seedId, nodes:[{id,label,description,hops,edgeType,relevance}]}.",
+        description: "Causal/resolution neighborhood along the causal edge families (CAUSED_BY, MANIFESTS_AS, FIXED_BY, SOLVED_BY, \u2026), walked in both directions. For a Problem this surfaces its root causes AND solutions; for a Solution, the problems it resolves. Merges the machine-wide shared store's triage layer (cause chains from inline `<-` diagnoses land there, keyed by the same content-derived problem id). Ranked by accumulated conductance. Pass nodeId or qname. Returns {seedId, nodes:[{id,label,description,hops,edgeType,relevance}]}.",
         inputSchema: {
           type: "object",
           properties: {
@@ -37354,7 +37450,26 @@ var init_mcp = __esm({
           if (!id) return unresolved(args2);
           const maxHops = Math.max(1, Math.min(8, Number(args2["maxHops"] ?? 4)));
           const limit = Math.max(1, Math.min(100, Number(args2["limit"] ?? 30)));
-          return { found: true, ...causalChain(store, { seedId: id, direction: "both", maxHops, limit }) };
+          const local = causalChain(store, { seedId: id, direction: "both", maxHops, limit });
+          try {
+            const path2 = sharedStorePath();
+            if (!existsSync10(path2)) return { found: true, ...local };
+            const shared = openGraphStore({ path: path2 });
+            try {
+              if (!shared.getNode(id)) return { found: true, ...local };
+              const l2 = causalChain(shared, { seedId: id, direction: "both", maxHops, limit });
+              const seen = new Set(local.nodes.map((n) => n.id));
+              const merged = [
+                ...local.nodes,
+                ...l2.nodes.filter((n) => !seen.has(n.id)).map((n) => ({ ...n, store: "shared" }))
+              ].sort((a, b) => (b.relevance ?? 0) - (a.relevance ?? 0)).slice(0, limit);
+              return { found: true, seedId: local.seedId, nodes: merged };
+            } finally {
+              shared.close();
+            }
+          } catch {
+            return { found: true, ...local };
+          }
         }
       },
       {
@@ -49594,6 +49709,8 @@ var ALTERNATIVE_PREFIX = /^\s*alternative:(?:#([a-z][\w-]{0,63}))?\s*/i;
 var INSTANCE_PREFIX = /^\s*instance:\s*/i;
 var PATTERN_RE = /\(\s*pattern:\s*([^()\n]{3,}?)\s*\)/gi;
 var DOMAIN_RE = /\(\s*domain:\s*([^()\n]{3,}?)\s*\)/gi;
+var PACKAGE_RE = /\(\s*package:\s*([^()\n]{2,}?)\s*\)/gi;
+var COMPONENT_RE = /\(\s*component:\s*([^()\n]{2,}?)\s*\)/gi;
 var CAUSE_TEXT_MIN = 8;
 var FLAG_RE = /\[([!?])(?:#([a-z][\w-]{0,63})\s+)?\s*([^\]\n]{8,}?)\s*(?:@\s*([^\s\]]+?)(?::(\d+))?\s*)?\]/g;
 var CONSTRAINT_MIN = 8;
@@ -49789,6 +49906,18 @@ function parseInlineTags(text) {
       const raw3 = dm[1].replace(/\s+/g, " ").trim();
       if (raw3.length >= 3) out2.push({ kind: "domain", domainText: raw3, sentence: sfield });
     }
+    PACKAGE_RE.lastIndex = 0;
+    let pk;
+    while ((pk = PACKAGE_RE.exec(sentence)) !== null) {
+      const raw3 = pk[1].replace(/\s+/g, " ").trim();
+      if (raw3.length >= 2) out2.push({ kind: "package", packageText: raw3, sentence: sfield });
+    }
+    COMPONENT_RE.lastIndex = 0;
+    let cm;
+    while ((cm = COMPONENT_RE.exec(sentence)) !== null) {
+      const raw3 = cm[1].replace(/\s+/g, " ").trim();
+      if (raw3.length >= 2) out2.push({ kind: "component", componentText: raw3, sentence: sfield });
+    }
     CONSTRAINT_RE.lastIndex = 0;
     let c;
     while ((c = CONSTRAINT_RE.exec(sentence)) !== null) {
@@ -49823,7 +49952,12 @@ var LABEL_PAIR = {
   // EDGE_RULES-clean by construction: CONCERNS allows exactly these sources.
   "Problem>Tool": "CONCERNS",
   "Solution>Tool": "CONCERNS",
-  "RootCause>Tool": "CONCERNS"
+  "RootCause>Tool": "CONCERNS",
+  // Agent-named component anchors (OM-agent-anchors): a Component is a
+  // framework/product-level unit the knowledge is ABOUT — CONCERNS, like Tool.
+  "Problem>Component": "CONCERNS",
+  "Solution>Component": "CONCERNS",
+  "RootCause>Component": "CONCERNS"
 };
 var STACK_GROUNDING_EDGES = ["WRITTEN_IN", "DEPENDS_ON", "OCCURS_IN"];
 var TIEBREAK = [
@@ -49922,7 +50056,7 @@ function harvestInlineTags(store, text, opts) {
   const source = opts.sourceId ? store.getNode(opts.sourceId) : null;
   const mintPriors = opts.mintPriors ?? true;
   const touched = opts.sessionTouchedIds ?? /* @__PURE__ */ new Set();
-  const plan = { priorEdges: 0, problems: [], fixes: [], triages: [], attempts: [], unresolvedFixes: [], transfers: [], solutionLinks: [], instances: [], patterns: [], domains: [], refutes: [], corroborations: [] };
+  const plan = { priorEdges: 0, problems: [], fixes: [], triages: [], attempts: [], unresolvedFixes: [], transfers: [], solutionLinks: [], instances: [], patterns: [], domains: [], packages: [], components: [], refutes: [], corroborations: [] };
   const tags = parseInlineTags(text);
   const symptomSeqs = tags.filter((t) => (t.kind === "problem" || t.kind === "todo" || t.kind === "constraint") && t.statement).map((t) => ({ seq: t.seq ?? -1, statement: t.statement, threadId: t.threadId })).sort((a, b) => a.seq - b.seq);
   const bindSymptom = (seq, threadId) => {
@@ -50062,6 +50196,16 @@ function harvestInlineTags(store, text, opts) {
         ...tag.threadId ? { threadId: tag.threadId } : {},
         evidence: b.evidence
       });
+    } else if (tag.kind === "package" || tag.kind === "component") {
+      const b = bindSymptom(tag.seq, tag.threadId);
+      const bound = {
+        ...b.statement ? { boundStatement: b.statement } : {},
+        ...b.problemId ? { problemId: b.problemId } : {},
+        ...tag.threadId ? { threadId: tag.threadId } : {},
+        evidence: b.evidence
+      };
+      if (tag.kind === "package") plan.packages.push({ packageText: tag.packageText, ...bound });
+      else plan.components.push({ componentText: tag.componentText, ...bound });
     } else if (tag.kind === "attempt" || tag.kind === "failure") {
       for (const h of tag.refuteHandles ?? []) {
         const nodeId = resolveHandle(store, h, opts.handleMap);
@@ -50086,6 +50230,17 @@ function harvestInlineTags(store, text, opts) {
           boundStatement: b.statement
         });
       }
+    } else if (tag.kind === "prior") {
+      const targetId = resolveHandle(store, tag.handle, opts.handleMap);
+      const target = targetId ? store.getNode(targetId) : null;
+      const citedLabel = target?.label ?? opts.handleMap[tag.handle]?.label;
+      if (targetId && citedLabel && CORROBORATABLE_LABELS.has(citedLabel)) {
+        const witnessKey = `corrob:${targetId}:lean:${digest({ h: tag.handle })}`.slice(0, 72);
+        if (!plan.corroborations.some((c) => c.witnessKey === witnessKey)) {
+          plan.corroborations.push({ nodeId: targetId, witnessKey });
+        }
+      }
+      if (mintPriors && source && target && mintPriorEdge(store, source, target, tag.sentence, touched, opts.ts)) plan.priorEdges++;
     } else if (mintPriors && source) {
       const targetId = resolveHandle(store, tag.handle, opts.handleMap);
       const target = targetId ? store.getNode(targetId) : null;
@@ -50094,6 +50249,12 @@ function harvestInlineTags(store, text, opts) {
   }
   return plan;
 }
+var CORROBORATABLE_LABELS = /* @__PURE__ */ new Set(["Problem", "Solution", "RootCause"]);
+function stampWitnessOrigin(items, origin) {
+  if (!origin) return [...items];
+  const o = digest({ p: origin }).slice(0, 12);
+  return items.map((i2) => ({ ...i2, witnessKey: `${i2.witnessKey}:o:${o}` }));
+}
 
 // src/rollup.ts
 function readConversation(transcriptPath, includeThinking = true, maxChars = 6e4) {
@@ -50596,7 +50757,9 @@ function generalizeRouteForSync(edge2, level) {
     navFailures: 0
   };
 }
-function buildTriageIngest(shared, daemonVersion, ignorePatterns = [], level = 2) {
+function buildTriageIngest(shared, daemonVersion, ignorePatterns = [], level = 2, opts = {}) {
+  const lang = opts.primaryLanguage?.trim().toLowerCase();
+  const claim = lang ? { anchorVisibility: "public", anchor: `lang:${lang}` } : {};
   const nodes = [];
   const edges = [];
   const seenIds = /* @__PURE__ */ new Set();
@@ -50609,7 +50772,8 @@ function buildTriageIngest(shared, daemonVersion, ignorePatterns = [], level = 2
       ...n,
       description: generalize(n.description, { level }).text,
       embedding: [],
-      attrs: { scope: {} }
+      attrs: { scope: {} },
+      ...claim
     });
   };
   for (const tri of shared.findNodesByLabel("Triage")) {
@@ -50625,7 +50789,8 @@ function buildTriageIngest(shared, daemonVersion, ignorePatterns = [], level = 2
         attrs: {
           ...statement ? { statement: generalize(statement, { level }).text } : {},
           ...tri.attrs["perContextSeen"] ? { perContextSeen: tri.attrs["perContextSeen"] } : {}
-        }
+        },
+        ...claim
       });
     }
     for (const tb of shared.inEdges(tri.id, ["TRIAGED_BY"])) {
@@ -51664,7 +51829,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.1-dev.60" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.2-dev.125" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -52498,6 +52663,20 @@ function createWorkspaceEngine(opts) {
           if (domainId === pid) continue;
           mintCiteEdge(pid, domainId, "PERTAIN_TO", d.evidence === "witnessed" ? 0.4 : 0.3, { domainCite: true, evidence: d.evidence });
         }
+        for (const p of plan.packages) {
+          const pid = bindPid(p);
+          if (!pid) continue;
+          const pkgId = mintCitedPackageNode(store, p.packageText, t);
+          if (pkgId === pid) continue;
+          mintCiteEdge(pid, pkgId, "DEPENDS_ON", p.evidence === "witnessed" ? 0.4 : 0.3, { packageCite: true, evidence: p.evidence });
+        }
+        for (const cpt of plan.components) {
+          const pid = bindPid(cpt);
+          if (!pid) continue;
+          const componentId = mintComponentNode(store, cpt.componentText, t);
+          if (componentId === pid) continue;
+          mintCiteEdge(pid, componentId, "CONCERNS", cpt.evidence === "witnessed" ? 0.4 : 0.3, { componentCite: true, evidence: cpt.evidence });
+        }
         for (const inst of plan.instances) {
           const pid = bindPid(inst);
           if (!pid) continue;
@@ -52539,14 +52718,14 @@ function createWorkspaceEngine(opts) {
           }
         }
         if (plan.refutes.length > 0 && typeof cloud.reportContradictions === "function") {
-          void cloud.reportContradictions({ daemonVersion: DAEMON_VERSION, projectId: profile.id, items: plan.refutes }).then((r) => {
+          void cloud.reportContradictions({ daemonVersion: DAEMON_VERSION, projectId: profile.id, items: stampWitnessOrigin(plan.refutes, profile.id) }).then((r) => {
             if (r?.recorded) console.log(`[errata] refute: ${r.recorded} contradiction(s) recorded`);
           }).catch(
             (err2) => console.warn("[errata] refute transport failed (continuing):", err2 instanceof Error ? err2.message : err2)
           );
         }
         if (plan.corroborations.length > 0 && typeof cloud.reportCorroborations === "function") {
-          void cloud.reportCorroborations({ daemonVersion: DAEMON_VERSION, projectId: profile.id, items: plan.corroborations }).then((r) => {
+          void cloud.reportCorroborations({ daemonVersion: DAEMON_VERSION, projectId: profile.id, items: stampWitnessOrigin(plan.corroborations, profile.id) }).then((r) => {
             if (r?.recorded) console.log(`[errata] corroborate: ${r.recorded} corroboration(s) recorded`);
           }).catch(
             (err2) => console.warn("[errata] corroboration transport failed (continuing):", err2 instanceof Error ? err2.message : err2)
@@ -53262,7 +53441,12 @@ function buildContextIngest(store, profile, daemonVersion, ignorePatterns = [],
           name: n.attrs["name"],
           ecosystem: n.attrs["ecosystem"],
           resolved: n.attrs["resolved"]
-        } : { name: n.attrs["name"] }
+        } : { name: n.attrs["name"] },
+        // OM-anchor-tag: context stubs are self-anchored — the wire id IS the
+        // spine key (purl / languageCanonicalId). The door re-confirms on the
+        // public spine; a private-registry or workspace package never confirms
+        // and fails closed to org, exactly as an untagged one would.
+        anchorVisibility: "public"
       });
       seen.add(n.id);
     }
@@ -53276,6 +53460,10 @@ function buildContextIngest(store, profile, daemonVersion, ignorePatterns = [],
   }
   const base = {
     daemonVersion,
+    // Origin key (= project, the salted `wp_…`) — the door stamps it onto created
+    // nodes as `authoringProject`, arming the evidence channels' cross-origin gate
+    // (EE-corrob-live: without it every node is fail-open to self-corroboration).
+    ...profile.id ? { originProject: profile.id } : {},
     profile: { stack: profile.stack, languages: profile.languages, domains: profile.domains },
     nodes,
     edges
@@ -53355,8 +53543,8 @@ function noveltyAgainst(node2, neighbors, opts = {}) {
 // src/instance-ingest.ts
 var INSTANCE_LABELS = ["Problem", "Solution", "RootCause"];
 var INSTANCE_EDGES = ["CAUSED_BY", "SOLVED_BY"];
-var ANCHOR_EDGES = ["OCCURS_IN", "DEPENDS_ON", "PERTAIN_TO"];
-var ANCHOR_TARGET_LABELS = ["Language", "Package", "Domain"];
+var ANCHOR_EDGES = ["OCCURS_IN", "DEPENDS_ON", "PERTAIN_TO", "CONCERNS"];
+var ANCHOR_TARGET_LABELS = ["Language", "Package", "Domain", "Component"];
 function stripCodebaseScope(scope) {
   const s = { ...scope ?? {} };
   delete s["codebase"];
@@ -53372,6 +53560,10 @@ function wireContextId(n) {
   }
   return n.id;
 }
+function langAnchor(t) {
+  const name2 = String(t.attrs["name"] ?? "").trim() || t.description.trim() || t.id.replace(/^lang:/, "").trim();
+  return name2 ? `lang:${name2.toLowerCase()}` : void 0;
+}
 function shareableContext(n, wireId) {
   const attrs = n.label === "Package" ? {
     // No `version` attr: the purl encodes it, and the door's temporal
@@ -53381,7 +53573,18 @@ function shareableContext(n, wireId) {
     ecosystem: n.attrs["ecosystem"],
     resolved: n.attrs["resolved"]
   } : n.label === "Domain" ? { name: n.description, canonicalId: n.attrs["canonicalId"] } : { name: n.attrs["name"] };
-  return { ...n, id: wireId, embedding: [], attrs };
+  return {
+    ...n,
+    id: wireId,
+    embedding: [],
+    attrs,
+    ...n.label === "Package" ? { anchorVisibility: "public" } : {},
+    ...n.label === "Language" && langAnchor(n) ? { anchorVisibility: "public", anchor: langAnchor(n) } : {},
+    // A Component stub claims itself by slug (OM-agent-anchors) — the door
+    // confirms only against an EXISTING public Component of that slug, so an
+    // org-internal component name never crosses (fails closed to org).
+    ...n.label === "Component" ? { anchorVisibility: "public", anchor: `component:${wireId}` } : {}
+  };
 }
 function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [], opts = {}) {
   const level = opts.level ?? 1;
@@ -53399,6 +53602,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
   });
   const nodes = [];
   const seen = /* @__PURE__ */ new Set();
+  const shippedById = /* @__PURE__ */ new Map();
   const anchorSources = /* @__PURE__ */ new Set();
   const includedByLabel = /* @__PURE__ */ new Map();
   for (const label of INSTANCE_LABELS) {
@@ -53416,7 +53620,9 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       }
       if (!noveltyAgainst(n, ref, noveltyOpts).ready) continue;
       ref.push(n);
-      nodes.push(shareable(n));
+      const wireNode = shareable(n);
+      nodes.push(wireNode);
+      shippedById.set(n.id, wireNode);
       seen.add(n.id);
       anchorSources.add(n.id);
     }
@@ -53438,11 +53644,23 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       if (e.type === "OCCURS_IN" && t.label !== "Language") continue;
       if (e.type === "DEPENDS_ON" && t.label !== "Package") continue;
       if (e.type === "PERTAIN_TO" && t.label !== "Domain") continue;
-      if (t.label === "Package" && opts.includePackages !== true) continue;
+      if (e.type === "CONCERNS" && t.label !== "Component") continue;
+      if ((t.label === "Package" || t.label === "Component") && opts.includePackages !== true) continue;
       if (ignored(t.description) || ignored(String(t.attrs["name"] ?? ""))) continue;
       targets.push({ e, t, wireId: wireContextId(t) });
     }
     if (targets.length === 0) continue;
+    const shipped = shippedById.get(sourceId);
+    if (shipped) {
+      const anchors = (label) => targets.filter((x) => x.t.label === label).map(
+        (x) => label === "Language" ? langAnchor(x.t) : label === "Component" ? `component:${x.wireId}` : x.wireId
+      ).filter((a) => a != null).sort();
+      const anchor = anchors("Package")[0] ?? anchors("Component")[0] ?? anchors("Language")[0];
+      if (anchor) {
+        shipped.anchorVisibility = "public";
+        shipped.anchor = anchor;
+      }
+    }
     const dg = digest(targets.map(({ e, wireId }) => `${e.type}>${wireId}`).sort());
     const sourceNode = store.getNode(sourceId);
     if (sourceNode?.attrs["anchorsContributedDigest"] === dg) continue;
@@ -53456,6 +53674,15 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       contextNodes.push(shareableContext(t, wireId));
     }
   }
+  const primaryLang = (profile.languages ?? []).map((l) => String(l).trim().toLowerCase()).filter(Boolean)[0];
+  if (primaryLang) {
+    for (const shipped of shippedById.values()) {
+      if (!shipped.anchorVisibility) {
+        shipped.anchorVisibility = "public";
+        shipped.anchor = `lang:${primaryLang}`;
+      }
+    }
+  }
   const project = opts.project;
   if (project) {
     const now = Date.now();
@@ -53533,6 +53760,11 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
   edges.push(...anchorEdges);
   const base = {
     daemonVersion,
+    // Origin key (= project, the salted `wp_…`) — the door stamps it onto created
+    // nodes as `authoringProject`, arming the evidence channels' cross-origin gate
+    // (EE-corrob-live: this is the MAIN semantic drain; without the stamp every
+    // Problem/Solution lands fail-open to self-corroboration).
+    ...profile.id ? { originProject: profile.id } : {},
     profile: { stack: profile.stack, languages: profile.languages, domains: profile.domains },
     // Context nodes FIRST: a chunked drain (cloud-client, 25-node chunks) then
     // co-locates the few Language/Package stubs with the first instance chunk,
@@ -54159,8 +54391,10 @@ async function startMultiDaemon(opts = {}) {
         path: r.root,
         stack: r.entry.stack,
         nodes: r.engine.store.nodeCount(),
-        problems: r.engine.store.findNodesByLabel("Problem").length,
-        solutions: r.engine.store.findNodesByLabel("Solution").length,
+        // COUNT(*) — the materializing findNodesByLabel(...).length form held
+        // the event loop for seconds per poll once stores grew (HZ-index-hydrate).
+        problems: r.engine.store.countNodesByLabel("Problem"),
+        solutions: r.engine.store.countNodesByLabel("Solution"),
         endpoints: `/ws/${r.id}/`
       })),
       humanView: "run `errata report` \u2014 the dashboard was retired (GRAFT 4e)"
@@ -54216,8 +54450,9 @@ async function startMultiDaemon(opts = {}) {
         name: r.entry.name,
         path: r.root,
         nodes: r.engine.store.nodeCount(),
-        problems: r.engine.store.findNodesByLabel("Problem").length,
-        solutions: r.engine.store.findNodesByLabel("Solution").length,
+        // COUNT(*) — same hydration hazard as `/` (HZ-index-hydrate).
+        problems: r.engine.store.countNodesByLabel("Problem"),
+        solutions: r.engine.store.countNodesByLabel("Solution"),
         stranded: strandedCount(r)
       }))
     })
@@ -54586,7 +54821,19 @@ async function startMultiDaemon(opts = {}) {
     async syncTriagePublic() {
       if (!loadConfig().consent.sync) return { uploaded: 0, skipped: "consent-off" };
       const ignore = loadClaimIgnorePatterns(globalDir());
-      const payload = buildTriageIngest(sharedStore, DAEMON_VERSION, ignore);
+      const langCounts = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        for (const l of r.engine.profile.languages ?? []) {
+          const k = String(l).trim().toLowerCase();
+          if (k) langCounts.set(k, (langCounts.get(k) ?? 0) + 1);
+        }
+      }
+      const primaryLanguage = [...langCounts.entries()].sort(
+        (a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)
+      )[0]?.[0];
+      const payload = buildTriageIngest(sharedStore, DAEMON_VERSION, ignore, 2, {
+        ...primaryLanguage ? { primaryLanguage } : {}
+      });
       if (!payload) return { uploaded: 0 };
       const res = await cloudNow().ingest(payload);
       return { uploaded: res.accepted };
@@ -54773,6 +55020,8 @@ async function startMultiDaemon(opts = {}) {
     }
   };
   app.post("/api/sync", async (c) => {
+    if (boundaryFlushing) return c.json({ skipped: "in-flight" }, 409);
+    boundaryFlushing = true;
     try {
       const principles = await daemon.syncPrinciplesPublic();
       const triage = await daemon.syncTriagePublic();
@@ -54781,6 +55030,8 @@ async function startMultiDaemon(opts = {}) {
       return c.json({ principles, triage, instances, edgeBackfill });
     } catch (err2) {
       return c.json({ error: err2 instanceof Error ? err2.message : String(err2) }, 500);
+    } finally {
+      boundaryFlushing = false;
     }
   });
   app.post("/api/tick", async (c) => {
@@ -57604,8 +57855,12 @@ async function cmdSync(arg) {
     try {
       const res = await fetch(`${lock.webUiUrl}/api/sync`, {
         method: "POST",
-        signal: AbortSignal.timeout(3e4)
+        signal: AbortSignal.timeout(15 * 6e4)
       });
+      if (res.status === 409) {
+        console.log("sync already running: the daemon is mid-drain \u2014 it will finish on its own. Nothing new was started.");
+        return;
+      }
       if (!res.ok) {
         const detail = await res.text().catch(() => "");
         console.error(`sync failed: daemon at ${lock.webUiUrl} returned ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
@@ -57616,7 +57871,7 @@ async function cmdSync(arg) {
     } catch (err2) {
       const timedOut = err2 instanceof Error && err2.name === "TimeoutError";
       console.error(
-        timedOut ? `sync failed: the running daemon at ${lock.webUiUrl} didn't respond within 30s \u2014 it may be mid-reindex. Retry shortly.` : `sync failed: could not reach the running daemon at ${lock.webUiUrl} (${err2 instanceof Error ? err2.message : err2})`
+        timedOut ? `sync gave up waiting after 15 min \u2014 the daemon's pass may STILL be running (aborting this request does not cancel it). Check daemon.log before retrying; a retry while it runs answers 409.` : `sync failed: could not reach the running daemon at ${lock.webUiUrl} (${err2 instanceof Error ? err2.message : err2})`
       );
       process.exit(1);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.1-dev.60",
+  "version": "2.0.2-dev.125",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -15049,7 +15049,10 @@ var init_edge_rules = __esm({
       // NOT ruled here — the type pre-exists with broader extractor senses, and a
       // new rule on an old type would reject legitimate live flows (reject-never-flip
       // cuts both ways: only rule types you introduce or senses that are documented).
-      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool"] },
+      // `Component` joined the target set with OM-agent-anchors: an agent-named
+      // component ("React Router") is the same knowledge→named-unit anchor shape as
+      // a Tool — the knowledge is ABOUT it, not dependent on it.
+      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
       OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
       INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
       // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
@@ -15162,7 +15165,12 @@ var init_wire = __esm({
        *  knows which packages are private. The door does NOT trust a `public` claim
        *  blindly (it re-confirms on the spine); absent ⇒ unknown ⇒ fail-closed to
        *  org-private. Accepted-but-ignored until ORG_MEMBRANE_ENABLED flips. */
-      anchorVisibility: external_exports.enum(["public", "private"]).optional()
+      anchorVisibility: external_exports.enum(["public", "private"]).optional(),
+      /** The spine-resolvable anchor id backing a `public` tag (OM-anchor-tag): a
+       *  Package purl or `languageCanonicalId`. The door validates THIS on the
+       *  public spine (falling back to `canonicalId` when absent — context stubs
+       *  are self-anchored). Never trusted without spine confirmation. */
+      anchor: external_exports.string().min(1).max(300).optional()
     });
     RouteContextCountWireSchema = external_exports.object({
       confirmed: external_exports.number().int().min(0),
@@ -24330,6 +24338,13 @@ var SqliteGraphStore = class {
       findByLabel: this.db.prepare(
         "SELECT * FROM nodes WHERE label = ? AND valid_to IS NULL"
       ),
+      // Scalar count twin of findByLabel — same live-row semantics, no row
+      // hydration. Exists because status surfaces (daemon `/` + `/health`) used
+      // findNodesByLabel(...).length, materializing every row's attrs JSON and
+      // embedding blob per request — seconds of synchronous loop-hold per poll.
+      countByLabel: this.db.prepare(
+        "SELECT COUNT(*) AS n FROM nodes WHERE label = ? AND valid_to IS NULL"
+      ),
       // ALL versions of a label — incl frozen/closed (valid_to set). Used by the
       // clean-reindex purge so a true wipe removes history too, not just live rows.
       findByLabelAll: this.db.prepare("SELECT * FROM nodes WHERE label = ?"),
@@ -24583,6 +24598,13 @@ var SqliteGraphStore = class {
     const rows = this.stmts.findByLabel.all(label);
     return rows.map(rowToNode);
   }
+  /** Live-row count for a label — `findNodesByLabel(label).length` without the
+   *  per-row hydration (attrs JSON + embedding blob). Status surfaces poll this
+   *  per project per request; the materializing form held the daemon's event
+   *  loop for seconds at scale. */
+  countNodesByLabel(label) {
+    return Number(this.stmts.countByLabel.get(label).n);
+  }
   findAllVersionsByLabel(label) {
     const rows = this.stmts.findByLabelAll.all(label);
     return rows.map(rowToNode);