@inerrata-corporation/errata 2.0.13-dev.2998 → 2.0.13-dev.3054

package/errata.mjs

@@ -15488,6 +15488,370 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/shared/src/history-text.ts
+function looksLikeSecretValue(raw2, quoted) {
+  if (raw2.includes("${") || raw2.includes("{{") || raw2.includes("%(")) return false;
+  if (raw2.startsWith("[redacted:")) return false;
+  if (quoted) return raw2.length > 0;
+  const lower = raw2.toLowerCase();
+  if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
+  if (!/^[A-Za-z0-9+/=_-]{8,}$/.test(raw2)) return false;
+  if (/\d/.test(raw2)) return true;
+  if (raw2.length >= 12) return true;
+  return /[a-z]/.test(raw2) && /[A-Z]/.test(raw2);
+}
+function applyRule(text, rule, removed) {
+  let count = 0;
+  const out2 = text.replace(rule.re, (...args2) => {
+    const m = args2.slice(0, -2);
+    const r = rule.replace(m);
+    if (r === null) return m[0];
+    const marker = r.indexOf(REDACTED_CREDENTIAL);
+    if (removed && marker >= 0) {
+      const prefix = r.slice(0, marker), suffix = r.slice(marker + REDACTED_CREDENTIAL.length);
+      if (m[0].startsWith(prefix) && m[0].endsWith(suffix)) {
+        const literal2 = m[0].slice(prefix.length, m[0].length - suffix.length);
+        if (literal2 && !literal2.includes("[redacted:")) removed.add(literal2);
+      }
+    }
+    count += 1;
+    return r;
+  });
+  return { text: out2, count };
+}
+function scrubHistoryText(text) {
+  return scrubText(text);
+}
+function scrubText(text, removed) {
+  let out2 = text;
+  let credentials = 0;
+  for (const rule of CREDENTIAL_RULES) {
+    const r = applyRule(out2, rule, removed);
+    out2 = r.text;
+    credentials += r.count;
+  }
+  let emails = 0;
+  out2 = out2.replace(EMAIL_RE, () => {
+    emails += 1;
+    return REDACTED_EMAIL;
+  });
+  return { text: out2, credentials, emails };
+}
+function scrubHistoryValue(value) {
+  const removed = /* @__PURE__ */ new Set();
+  const visit = (input) => {
+    if (typeof input === "string") return scrubText(input, removed).text;
+    if (Array.isArray(input)) return input.map(visit);
+    if (input && typeof input === "object") return Object.fromEntries(Object.entries(input).map(([key, item]) => {
+      const field = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+      const credentialField = /^(?:token|credential|credentials|pwd|passwd|passphrase)$/.test(field) || /(?:password|secret|secretkey|apikey|accesskey|privatekey|authkey|accesstoken|refreshtoken)$/.test(field);
+      if (typeof item === "string" && credentialField) {
+        const assignment = `${key}: ${JSON.stringify(item)}`;
+        if (scrubText(assignment, removed).credentials > 0) return [key, REDACTED_CREDENTIAL];
+      }
+      return [key, visit(item)];
+    }));
+    return input;
+  };
+  const safe = visit(value);
+  if (!removed.size) return safe;
+  const escaped = [...removed].sort((a, b) => b.length - a.length).map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  const literals = new RegExp(`(?<![\\p{L}\\p{N}_])(?:${escaped.join("|")})(?![\\p{L}\\p{N}_])`, "gu");
+  const clear = (input) => typeof input === "string" ? input.replace(literals, REDACTED_CREDENTIAL) : Array.isArray(input) ? input.map(clear) : input && typeof input === "object" ? Object.fromEntries(Object.entries(input).map(([k, v]) => [k, clear(v)])) : input;
+  return clear(safe);
+}
+var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, ASSIGNMENT_STOPWORDS, CREDENTIAL_RULES, EMAIL_RE;
+var init_history_text = __esm({
+  "../../packages/shared/src/history-text.ts"() {
+    "use strict";
+    HISTORY_SCRUBBER_VERSION = "history-scrub-3";
+    REDACTED_CREDENTIAL = "[redacted:credential]";
+    REDACTED_EMAIL = "[redacted:email]";
+    cred = () => REDACTED_CREDENTIAL;
+    ASSIGNMENT_STOPWORDS = /* @__PURE__ */ new Set([
+      "string",
+      "boolean",
+      "number",
+      "required",
+      "optional",
+      "undefined",
+      "unknown",
+      "function",
+      "process",
+      "request",
+      "response",
+      "password",
+      "secret",
+      "token",
+      "tokens",
+      "credential",
+      "credentials",
+      "bearer",
+      "basic",
+      "example",
+      "redacted",
+      "nullable",
+      "readonly",
+      "override",
+      "abstract",
+      "interface",
+      "constant",
+      "variable",
+      "property",
+      "parameter",
+      "argument",
+      "callback",
+      "promise",
+      "settings",
+      "options",
+      "default",
+      "disabled",
+      "enabled",
+      "internal",
+      "external",
+      "protected",
+      "provided",
+      "resolved",
+      "rejected",
+      "expected",
+      "received",
+      "salt",
+      "hash",
+      "hashed",
+      "hashing",
+      "authentication",
+      "field",
+      "format"
+    ]);
+    CREDENTIAL_RULES = [
+      // Human-written seed/reset notes omit assignment punctuation: password `…`
+      // or password (…). Preserve names of fields and hash components.
+      {
+        re: /\b((?:password|passwd|passphrase|pwd)\s+)(["'`(])([^\s"'`,;)}\]]+)(["'`)])/gi,
+        replace: (m) => !ASSIGNMENT_STOPWORDS.has((m[3] ?? "").toLowerCase()) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
+      },
+      // "with SeedValue42! credentials" and "with SeedValue42!/seeded account".
+      // Require mixed-case letters plus a digit, or a password-like special char;
+      // ordinary phrases such as "with test credentials" remain useful prose.
+      {
+        re: /\b(with\s+)(["'`]?)([A-Za-z0-9][A-Za-z0-9!@#$%^&*._+=?-]{7,})(["'`]?)(?=\s+credentials\b|\s*\/\s*seeded\b)/gi,
+        replace: (m) => /[a-z]/.test(m[3]) && /[A-Z]/.test(m[3]) && /[0-9!@#$%^&*]/.test(m[3]) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
+      },
+      // Userinfo in connection URLs must be removed before the email rule runs.
+      {
+        re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+):([^\s/@]+)@/gi,
+        replace: (m) => m[2] === "[redacted" && m[3] === "credential]" ? null : `${m[1]}${REDACTED_CREDENTIAL}@`
+      },
+      // Seeded login prose commonly writes email/password without an assignment.
+      {
+        re: /(\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+|\[redacted:email\])(\s*\/\s*)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
+        replace: (m) => m[4]?.startsWith("[redacted:") ? null : `${m[1]}${m[2]}${m[3]}${REDACTED_CREDENTIAL}`
+      },
+      // Explicit natural-language passwords, including weak seeded values.
+      {
+        re: /\b((?:password|passwd|passphrase|pwd)\s+(?:is|was|of)\s+)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
+        replace: (m) => {
+          const value = m[3] ?? "";
+          if (ASSIGNMENT_STOPWORDS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
+          return `${m[1]}${m[2]}${REDACTED_CREDENTIAL}`;
+        }
+      },
+      // Private-key blocks, including ones a diff prefixes with `+`/`-` per line
+      // and ones the diff context cut before the END line.
+      {
+        re: /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*\r?\n[+\- ]?[A-Za-z0-9+/=]{16,}[ \t]*)*(?:[ \t]*\r?\n[+\- ]?-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)?/g,
+        replace: cred
+      },
+      { re: /\b(?:AKIA|ASIA)[0-9A-Z]{16,}\b/g, replace: cred },
+      // AWS access key id
+      { re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, replace: cred },
+      { re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g, replace: cred },
+      { re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replace: cred },
+      { re: /\bxox[abeprs]-[A-Za-z0-9-]{10,}\b/g, replace: cred },
+      // Slack
+      { re: /\bsk-(?:ant-)?[A-Za-z0-9_-]{20,}\b/g, replace: cred },
+      // OpenAI / Anthropic
+      { re: /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g, replace: cred },
+      // Stripe
+      { re: /\brnd_[A-Za-z0-9]{20,}\b/g, replace: cred },
+      // Render
+      { re: /\bnpm_[A-Za-z0-9]{36}\b/g, replace: cred },
+      { re: /\bAIza[0-9A-Za-z_-]{35}\b/g, replace: cred },
+      // Google API key
+      { re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, replace: cred },
+      // JWT
+      { re: /(?<![A-Za-z0-9])[A-Za-z0-9]{84}(?![A-Za-z0-9])/g, replace: cred },
+      // Azure-shaped
+      {
+        re: /\b(Bearer|Basic|Token)(\s+)([A-Za-z0-9._~+/=-]{16,})/g,
+        replace: (m) => `${m[1]}${m[2]}${REDACTED_CREDENTIAL}`
+      },
+      // Assignments after key-ish names: `password=...`, `API_KEY: "..."`,
+      // `"client_secret": "..."`, `AWS_SECRET_ACCESS_KEY=...`, 32+ hex/base64 after
+      // any of them. The value heuristic keeps `token: string` and
+      // `password = process.env.X` intact.
+      {
+        re: /((?:[A-Za-z0-9_.-]*?)(?:password|passwd|passphrase|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|auth[_-]?key|credential)(?:[A-Za-z0-9_-]*))(["']?\s*(?:=>|=|:)\s*)(["'`]?)([^\s"'`,;)}\]]+)/gi,
+        replace: (m) => {
+          const value = m[4] ?? "";
+          const quote = m[3] ?? "";
+          if (m[1]?.toLowerCase() === "credentials" && /^(include|omit|same-origin)$/.test(value)) return null;
+          if (!looksLikeSecretValue(value, quote.length > 0)) return null;
+          return `${m[1]}${m[2]}${quote}${REDACTED_CREDENTIAL}`;
+        }
+      }
+    ];
+    EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+\b/g;
+  }
+});
+
+// ../../packages/shared/src/history-evidence.ts
+import { createHash as createHash2 } from "node:crypto";
+function historyTextDigest(text) {
+  return createHash2("sha256").update(text).digest("hex");
+}
+function historySourceBlocks(input) {
+  const blocks = [];
+  const add = (kind, text, commitSha, pathToken) => {
+    const safe = scrubHistoryText(text.replace(/\r\n?/g, "\n")).text.trim();
+    if (safe && safe !== "[truncated]") blocks.push({ id: `b${blocks.length}`, kind, commitSha, pathToken, text: safe, digest: historyTextDigest(safe) });
+  };
+  const narrative2 = scrubHistoryText(input.narrative.replace(/\r\n?/g, "\n")).text;
+  if (input.narrativeSources?.length) {
+    for (const source of input.narrativeSources) {
+      const safe = scrubHistoryText(source.text.replace(/\r\n?/g, "\n")).text.trim();
+      if (safe && narrative2.includes(safe)) add("narrative", safe, source.commitSha, null);
+    }
+  } else {
+    add("narrative", narrative2, input.isMerge ? null : input.commitSha, null);
+  }
+  let token = null;
+  let hunk = [];
+  const flush = () => {
+    if (hunk.some((line) => /^[+-](?![+-]{2})/.test(line))) add("diff", hunk.join("\n"), input.commitSha, token);
+    hunk = [];
+  };
+  for (const line of input.diff.replace(/\r\n?/g, "\n").split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      flush();
+      token = /^diff --git a\/(p\d+) b\/(p\d+)$/.exec(line)?.[2] ?? null;
+    } else if (/^@@ /.test(line)) {
+      flush();
+      hunk.push(line);
+    } else if (!/^(--- |\+\+\+ |index |new file |deleted file |similarity |rename |\[truncated\])/.test(line) && token && /^[ +\-\\]/.test(line)) {
+      hunk.push(line);
+    }
+  }
+  flush();
+  return blocks;
+}
+function resolveHistoryEvidence(selection, blocks) {
+  const block = blocks.find((b) => b.id === selection.blockId);
+  if (!block) return null;
+  const quote = selection.quote.replace(/\r\n?/g, "\n");
+  if (scrubHistoryText(quote).text !== quote) return null;
+  let start2 = block.text.indexOf(quote);
+  if (selection.startByte !== void 0) {
+    const prefix = Buffer.from(block.text, "utf8").subarray(0, selection.startByte).toString("utf8");
+    if (Buffer.byteLength(prefix, "utf8") !== selection.startByte || !block.text.startsWith(prefix)) return null;
+    start2 = prefix.length;
+    if (!block.text.startsWith(quote, start2)) return null;
+  } else if (start2 < 0 || block.text.indexOf(quote, start2 + 1) !== -1) return null;
+  const firstLine = block.text.lastIndexOf("\n", start2 - 1) + 1;
+  const selectedLines = block.text.slice(firstLine, start2 + quote.length).split("\n");
+  if (block.kind === "diff" && selectedLines.every((l) => l.startsWith("@@"))) return null;
+  const signs = new Set(selectedLines.filter((l) => !l.startsWith("@@")).map((l) => l[0]));
+  const side = block.kind === "narrative" ? "narrative" : signs.has("+") && signs.has("-") ? "mixed" : signs.has("+") ? "after" : signs.has("-") ? "before" : "context";
+  return {
+    ...selection,
+    quote,
+    blockDigest: block.digest,
+    startByte: Buffer.byteLength(block.text.slice(0, start2), "utf8"),
+    endByte: Buffer.byteLength(block.text.slice(0, start2 + quote.length), "utf8"),
+    sourceKind: block.kind,
+    commitSha: block.commitSha,
+    pathToken: block.pathToken,
+    scrubberVersion: HISTORY_SCRUBBER_VERSION,
+    side
+  };
+}
+function checkHistoryCandidate(atom, blocks) {
+  const evidence = atom.evidence.map((e) => resolveHistoryEvidence(e, blocks));
+  if (evidence.some((e) => e === null)) return { reason: "missing-evidence", evidence: [] };
+  const refs = evidence;
+  if (!refs.some((e) => e.supports === "statement") || atom.rationale !== null && !refs.some((e) => e.supports === "rationale") || atom.conditions.some((_, i2) => !refs.some((e) => e.supports === "condition" && e.conditionIndex === i2)) || refs.some((e) => e.supports === "relation" || (e.supports === "condition" ? e.conditionIndex === null || e.conditionIndex >= atom.conditions.length : e.conditionIndex !== null))) {
+    return { reason: "missing-field-evidence", evidence: [] };
+  }
+  if (atom.label === "Claim" !== (atom.claimKind !== null)) return { reason: "invalid-kind", evidence: [] };
+  if (atom.anchorTokens.some((token) => !blocks.some((b) => b.kind === "diff" && b.pathToken === token)) || atom.label !== "Claim" && atom.anchorTokens.length === 0) return { reason: "invalid-anchor", evidence: [] };
+  return { reason: "accepted", evidence: refs };
+}
+var HISTORY_EVIDENCE_SCHEMA_VERSION, HistoryAnchorSourceSchema, HistorySymbolAnchorSchema, HistoryEvidenceSelectionSchema, HistoryCandidateSchema, HistoryRelationCandidateSchema, HistoryCandidateBatchSchema, HistoryEvidenceRefSchema;
+var init_history_evidence = __esm({
+  "../../packages/shared/src/history-evidence.ts"() {
+    "use strict";
+    init_zod();
+    init_history_text();
+    HISTORY_EVIDENCE_SCHEMA_VERSION = "history-evidence-1";
+    HistoryAnchorSourceSchema = external_exports.strictObject({
+      sourceCommitSha: external_exports.string().regex(/^[a-f0-9]{40,64}$/),
+      commitSha: external_exports.string().regex(/^[a-f0-9]{40,64}$/),
+      side: external_exports.enum(["before", "after"]),
+      blockDigest: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      startByte: external_exports.number().int().nonnegative(),
+      endByte: external_exports.number().int().positive(),
+      bodyHash: external_exports.string().regex(/^[a-f0-9]{8,64}$/).optional()
+    }).refine((v) => v.endByte > v.startByte);
+    HistorySymbolAnchorSchema = external_exports.object({
+      symbolId: external_exports.string().regex(/^sym_[a-f0-9]{8,64}$/),
+      kind: external_exports.string().max(40),
+      /** Legacy association, never a source-revision or live validation. */
+      contentHash: external_exports.string().regex(/^[a-f0-9]{8,64}$/).optional(),
+      historical: HistoryAnchorSourceSchema.optional()
+    });
+    HistoryEvidenceSelectionSchema = external_exports.strictObject({
+      blockId: external_exports.string().min(1).max(80),
+      quote: external_exports.string().min(3).max(1600),
+      supports: external_exports.enum(["statement", "condition", "rationale", "relation"]),
+      conditionIndex: external_exports.number().int().min(0).max(7).nullable(),
+      /** Optional exact location disambiguates repeated source lines. */
+      startByte: external_exports.number().int().nonnegative().optional()
+    });
+    HistoryCandidateSchema = external_exports.strictObject({
+      tempId: external_exports.string().regex(/^a[0-9]{1,3}$/),
+      label: external_exports.enum(["Problem", "Solution", "RootCause", "Claim"]),
+      statement: external_exports.string().min(10).max(2e3),
+      claimKind: external_exports.enum(["snapshot", "decision", "constraint"]).nullable(),
+      qualifier: external_exports.enum(["instance", "project"]),
+      conditions: external_exports.array(external_exports.string().min(1).max(300)).max(8),
+      rationale: external_exports.string().min(1).max(1e3).nullable(),
+      evidence: external_exports.array(HistoryEvidenceSelectionSchema).min(1).max(12),
+      anchorTokens: external_exports.array(external_exports.string().regex(/^p[0-9]+$/)).max(8)
+    });
+    HistoryRelationCandidateSchema = external_exports.strictObject({
+      tempId: external_exports.string().regex(/^r[0-9]{1,3}$/),
+      fromTempId: external_exports.string().regex(/^a[0-9]{1,3}$/),
+      toTempId: external_exports.string().regex(/^a[0-9]{1,3}$/),
+      meaning: external_exports.enum(["resolves", "mitigates", "caused-by"]),
+      evidence: external_exports.array(HistoryEvidenceSelectionSchema).min(1).max(8)
+    });
+    HistoryCandidateBatchSchema = external_exports.strictObject({
+      atoms: external_exports.array(HistoryCandidateSchema).max(32),
+      relations: external_exports.array(HistoryRelationCandidateSchema).max(32)
+    });
+    HistoryEvidenceRefSchema = HistoryEvidenceSelectionSchema.extend({
+      blockDigest: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      startByte: external_exports.number().int().nonnegative(),
+      endByte: external_exports.number().int().nonnegative(),
+      sourceKind: external_exports.enum(["narrative", "diff"]),
+      commitSha: external_exports.string().regex(/^[a-f0-9]{40,64}$/).nullable(),
+      pathToken: external_exports.string().regex(/^p[0-9]+$/).nullable(),
+      scrubberVersion: external_exports.string().max(80),
+      side: external_exports.enum(["before", "after", "context", "mixed", "narrative"])
+    });
+  }
+});
+
 // ../../packages/shared/src/edge-rules.ts
 function isValidEdge(from, type, to) {
   const rule = EDGE_RULES[type];
@@ -15526,7 +15890,9 @@ var init_edge_rules = __esm({
       // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
       TARGETS: { from: ["Exploit"], to: ["Vulnerability"] },
       ENABLES: { from: ["AntiPattern"], to: ["Vulnerability"] },
-      MITIGATES: { from: ["Solution"], to: ["Vulnerability"] },
+      // Partial remedies also apply to project Problems/RootCauses. Direction stays
+      // remedy -> ailment; a mitigation must never claim complete SOLVED_BY status.
+      MITIGATES: { from: ["Solution"], to: ["Vulnerability", "Problem", "RootCause"] },
       PRESENTS: { from: ["Solution"], to: ["Problem", "Vulnerability"] },
       // SOLVED_BY sources: Vulnerability (v1 comment) + Problem/RootCause
       // (upstream design-problem.ts + triage.ts mint both).
@@ -15804,6 +16170,7 @@ var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
     init_zod();
+    init_history_evidence();
     init_castalia();
     init_edge_rules();
     init_symbol_intent();
@@ -15930,6 +16297,12 @@ var init_wire = __esm({
       attrs: external_exports.object({
         confidence: external_exports.number().min(0).max(1).optional(),
         extractedBy: external_exports.enum(INGEST_EXTRACTION_SOURCES).optional(),
+        sourceSupport: external_exports.literal("supported").optional(),
+        historicalAnchors: external_exports.array(HistoryAnchorSourceSchema).max(160).optional(),
+        evidence: external_exports.array(HistoryEvidenceRefSchema).max(12).optional(),
+        verificationEvidence: external_exports.array(HistoryEvidenceRefSchema).max(12).optional(),
+        verifierBuild: external_exports.string().max(80).optional(),
+        unitDigest: external_exports.string().regex(/^[a-f0-9]{64}$/).optional(),
         /** Triage route per-context counts (T3 induction). Carried as structured data
          *  here; stored JSON-encoded on the Neo4j rel (`perContextJson`). */
         perContext: external_exports.record(external_exports.string(), RouteContextCountWireSchema).optional(),
@@ -16740,6 +17113,178 @@ var init_manifests = __esm({
   }
 });
 
+// ../../packages/shared/src/history-quality.ts
+var init_history_quality = __esm({
+  "../../packages/shared/src/history-quality.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/history-read.ts
+function historyReadFields(source, attrsJson) {
+  const attrs = unpackHistoryAttrs(typeof attrsJson === "string" ? { attrsJson } : {});
+  const policy = historyReadPolicy({ extractionSource: source, attrs });
+  if (!policy.history) return {};
+  const quality = attrs["historyQuality"];
+  return {
+    historyNotice: policy.notice,
+    ...quality && typeof quality === "object" && !Array.isArray(quality) ? { historyQuality: quality } : {}
+  };
+}
+function unpackHistoryAttrs(attrs = {}) {
+  let nested = {};
+  if (typeof attrs["attrsJson"] === "string") {
+    try {
+      const parsed = JSON.parse(attrs["attrsJson"]);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) nested = parsed;
+    } catch {
+    }
+  }
+  return { ...nested, ...attrs };
+}
+function historyReadPolicy(node2, options = {}) {
+  const attrs = unpackHistoryAttrs(node2.attrs);
+  if (attrs["source"] === "cloud" && typeof attrs["extractionSource"] !== "string" && attrs["historyQuality"] == null) {
+    return { allow: options.mode !== "passive", history: false, notice: "Cloud provenance is missing; refresh this cached result before using it as a standing prior." };
+  }
+  const isHistory = node2.extractionSource === "history-mined" || attrs["extractionSource"] === "history-mined" || attrs["historyQuality"] != null;
+  if (!isHistory) return { allow: true, history: false, notice: null };
+  const raw2 = attrs["historyQuality"];
+  const q = raw2 && typeof raw2 === "object" ? raw2 : {};
+  const source = q["sourceSupport"] ?? "unreviewed";
+  const applicability = q["applicability"] ?? "unknown";
+  const current = options.atCommit !== void 0 && q["evaluatedAtCommit"] === options.atCommit;
+  const invalid = source === "contradicted" || source === "quarantined";
+  const passive = options.mode === "passive";
+  const validation = node2.validationSource ?? attrs["validationSource"];
+  const independentlyValidated = validation === "human-explicit" || validation === "human-implicit" || validation === "agent-observed";
+  const allow = !invalid && (!passive || source === "supported" && current && applicability === "applicable" && independentlyValidated);
+  const at = typeof attrs["commitSha"] === "string" ? ` at ${attrs["commitSha"].slice(0, 12)}` : "";
+  return {
+    allow,
+    history: true,
+    notice: `History-derived${at}; source ${String(source)}; applicability ${current ? String(applicability) : "unknown at this checkout"}; ${independentlyValidated ? "separate validation recorded" : "not independently validated"}.`
+  };
+}
+var init_history_read = __esm({
+  "../../packages/shared/src/history-read.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/history-temporal.ts
+async function evaluateHistoryApplicability(intervals, atCommit, isAncestor) {
+  let superseded = false;
+  let historical = false;
+  let uncertain = false;
+  for (const interval of intervals) {
+    const [begun, covered, coherent] = await Promise.all([
+      isAncestor(interval.fromCommit, atCommit),
+      isAncestor(atCommit, interval.throughCommit),
+      isAncestor(interval.fromCommit, interval.throughCommit)
+    ]);
+    if (begun === null || covered === null || coherent === null) {
+      uncertain = true;
+      continue;
+    }
+    if (!begun || !covered || !coherent) continue;
+    if (interval.untilCommit) {
+      const [ended, validEnd] = await Promise.all([isAncestor(interval.untilCommit, atCommit), isAncestor(interval.fromCommit, interval.untilCommit)]);
+      if (ended === null || validEnd === null || !validEnd) {
+        uncertain = true;
+        continue;
+      }
+      if (ended) {
+        if (interval.supersededByOccurrence) superseded = true;
+        else historical = true;
+        continue;
+      }
+    }
+    return "applicable";
+  }
+  return uncertain ? "unknown" : superseded ? "superseded" : historical ? "historical" : "unknown";
+}
+var init_history_temporal = __esm({
+  "../../packages/shared/src/history-temporal.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/history-revision.ts
+function historyDag(records) {
+  const graph = new Map(records.map((r) => [r.commit, r.parents]));
+  if (graph.size !== records.length) throw new Error("duplicate Git commit in history proof");
+  const incoming = new Map([...graph].map(([id, parents]) => [id, parents.filter((p) => graph.has(p)).length]));
+  const children = /* @__PURE__ */ new Map();
+  for (const [id, parents] of graph) for (const p of parents) if (graph.has(p)) children.set(p, [...children.get(p) ?? [], id]);
+  const ready = [...incoming].filter(([, n]) => n === 0).map(([id]) => id);
+  let visited = 0;
+  while (ready.length) {
+    const id = ready.pop();
+    visited++;
+    for (const child of children.get(id) ?? []) {
+      const n = incoming.get(child) - 1;
+      incoming.set(child, n);
+      if (n === 0) ready.push(child);
+    }
+  }
+  if (visited !== graph.size) throw new Error("cyclic history proof");
+  return (a, b) => {
+    if (!graph.has(a) || !graph.has(b)) return null;
+    const pending = [b], seen = /* @__PURE__ */ new Set();
+    let missing = false;
+    while (pending.length) {
+      const id = pending.pop();
+      if (id === a) return true;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      const parents = graph.get(id);
+      if (!parents) missing = true;
+      else pending.push(...parents);
+    }
+    return missing ? null : false;
+  };
+}
+function occurrenceSourceCommit(o) {
+  const sha2 = o.quality["commitSha"];
+  return typeof sha2 === "string" && Sha.safeParse(sha2).success ? sha2 : null;
+}
+function historySemanticKey(projectId, o) {
+  const q = o.quality;
+  const anchors = q["historicalAnchors"];
+  if (q["sourceSupport"] !== "supported" || !anchors?.length || anchors.some((a) => !a.symbolId)) return null;
+  return digest([projectId, o.label, o.statement, q["claimKind"] ?? null, q["qualifier"], q["conditions"], q["rationale"], [...new Set(anchors.map((a) => a.symbolId))].sort()]);
+}
+function preservedHistoryOccurrence(o, observed, atCommit, ancestor) {
+  const q = o.quality, source = occurrenceSourceCommit(o);
+  if (!source || ancestor(source, atCommit) !== true || q["sourceSupport"] !== "supported" || !observed) return false;
+  const parsed = external_exports.array(HistoryEvidenceRefSchema).safeParse(q["evidence"]);
+  if (!parsed.success || !parsed.data.length || parsed.data.some((e) => e.sourceKind !== "diff" || !["after", "context"].includes(e.side))) return false;
+  const anchors = q["historicalAnchors"];
+  if (!anchors?.length || anchors.some((a) => a.side !== "after" || !a.bodyHash || !observed.symbols.some((s) => s.symbolId === a.symbolId && s.bodyHash === a.bodyHash))) return false;
+  return parsed.data.every((e) => anchors.some((a) => a.blockDigest === e.blockDigest && a.startByte <= e.startByte && a.endByte >= e.endByte));
+}
+var Sha, HistoryRevisionRequestSchema;
+var init_history_revision = __esm({
+  "../../packages/shared/src/history-revision.ts"() {
+    "use strict";
+    init_zod();
+    init_hash();
+    init_history_evidence();
+    Sha = external_exports.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/);
+    HistoryRevisionRequestSchema = external_exports.strictObject({
+      atCommit: Sha,
+      parents: external_exports.array(external_exports.strictObject({ commit: Sha, parents: external_exports.array(Sha).max(32) })).max(8192),
+      observations: external_exports.array(external_exports.strictObject({
+        occurrenceId: external_exports.string().min(1).max(100),
+        symbols: external_exports.array(external_exports.strictObject({ symbolId: external_exports.string().regex(/^sym_[a-f0-9]{8,64}$/), bodyHash: external_exports.string().regex(/^[a-f0-9]{8,64}$/) })).max(32),
+        /** Scrubbed, tokenized net change from this occurrence's source to atCommit. */
+        diff: external_exports.string().max(16e3).optional()
+      })).max(50)
+    });
+  }
+});
+
 // ../../packages/shared/src/nlp/canonicalize.ts
 function canonicalize(value) {
   return value.normalize("NFC").trim().toLowerCase().replace(/\s+/g, " ");
@@ -16809,6 +17354,16 @@ __export(src_exports, {
   FILE_ANCHOR_QNAME: () => FILE_ANCHOR_QNAME,
   GIT_EDGES: () => GIT_EDGES,
   GRAPH_EVENT_VOCABULARIES: () => GRAPH_EVENT_VOCABULARIES,
+  HISTORY_EVIDENCE_SCHEMA_VERSION: () => HISTORY_EVIDENCE_SCHEMA_VERSION,
+  HISTORY_SCRUBBER_VERSION: () => HISTORY_SCRUBBER_VERSION,
+  HistoryAnchorSourceSchema: () => HistoryAnchorSourceSchema,
+  HistoryCandidateBatchSchema: () => HistoryCandidateBatchSchema,
+  HistoryCandidateSchema: () => HistoryCandidateSchema,
+  HistoryEvidenceRefSchema: () => HistoryEvidenceRefSchema,
+  HistoryEvidenceSelectionSchema: () => HistoryEvidenceSelectionSchema,
+  HistoryRelationCandidateSchema: () => HistoryRelationCandidateSchema,
+  HistoryRevisionRequestSchema: () => HistoryRevisionRequestSchema,
+  HistorySymbolAnchorSchema: () => HistorySymbolAnchorSchema,
   IDENTITY_EDGES: () => IDENTITY_EDGES,
   INGEST_EXTRACTION_SOURCES: () => INGEST_EXTRACTION_SOURCES,
   INGEST_SOURCES: () => INGEST_SOURCES,
@@ -16824,6 +17379,8 @@ __export(src_exports, {
   PROJECT_ONLY_EDGE_TYPES: () => PROJECT_ONLY_EDGE_TYPES,
   PROJECT_ONLY_NODE_LABELS: () => PROJECT_ONLY_NODE_LABELS,
   QUARANTINE_EXTRACTION_SOURCE_PREFIX: () => QUARANTINE_EXTRACTION_SOURCE_PREFIX,
+  REDACTED_CREDENTIAL: () => REDACTED_CREDENTIAL,
+  REDACTED_EMAIL: () => REDACTED_EMAIL,
   RESOLUTION_EDGES: () => RESOLUTION_EDGES,
   RE_LEADING_ARTICLE: () => RE_LEADING_ARTICLE,
   ROUTING_REASONS: () => ROUTING_REASONS,
@@ -16854,6 +17411,7 @@ __export(src_exports, {
   canonicalizeContext: () => canonicalizeContext,
   canonicalizeError: () => canonicalizeError,
   canonicalizeToken: () => canonicalizeToken,
+  checkHistoryCandidate: () => checkHistoryCandidate,
   claimStructure: () => claimStructure,
   conceptBag: () => conceptBag,
   conceptTokens: () => conceptTokens,
@@ -16863,8 +17421,15 @@ __export(src_exports, {
   detectStance: () => detectStance,
   digest: () => digest,
   errorSignatureEqual: () => errorSignatureEqual,
+  evaluateHistoryApplicability: () => evaluateHistoryApplicability,
   extractIdentifierTokens: () => extractIdentifierTokens,
   genericCanonicalId: () => genericCanonicalId,
+  historyDag: () => historyDag,
+  historyReadFields: () => historyReadFields,
+  historyReadPolicy: () => historyReadPolicy,
+  historySemanticKey: () => historySemanticKey,
+  historySourceBlocks: () => historySourceBlocks,
+  historyTextDigest: () => historyTextDigest,
   identityId: () => identityId,
   isAnchorLabelKind: () => isAnchorLabelKind,
   isCausalProtected: () => isCausalProtected,
@@ -16891,6 +17456,7 @@ __export(src_exports, {
   normalizeSymbolPath: () => normalizeSymbolPath,
   normalizeToolName: () => normalizeToolName,
   npmPurl: () => npmPurl,
+  occurrenceSourceCommit: () => occurrenceSourceCommit,
   operatingSystemCanonicalId: () => operatingSystemCanonicalId,
   osNameForPlatform: () => osNameForPlatform,
   packageCanonicalId: () => packageCanonicalId,
@@ -16902,14 +17468,18 @@ __export(src_exports, {
   parsePackageRef: () => parsePackageRef,
   parsePnpmLock: () => parsePnpmLock,
   prefilterEntities: () => prefilterEntities,
+  preservedHistoryOccurrence: () => preservedHistoryOccurrence,
   problemIdFromError: () => problemIdFromError,
   projectSaltedNodeId: () => projectSaltedNodeId,
   projectSymbolId: () => projectSymbolId,
   provenanceBand: () => provenanceBand,
   resolveCanonical: () => resolveCanonical,
   resolveCanonicalId: () => resolveCanonicalId,
+  resolveHistoryEvidence: () => resolveHistoryEvidence,
   resolveUnambiguousCanonicalId: () => resolveUnambiguousCanonicalId,
   retrievalTokens: () => retrievalTokens,
+  scrubHistoryText: () => scrubHistoryText,
+  scrubHistoryValue: () => scrubHistoryValue,
   sha256: () => sha256,
   sha256Short: () => sha256Short,
   sidecarDropBucket: () => sidecarDropBucket,
@@ -16922,6 +17492,7 @@ __export(src_exports, {
   toCloudAttrs: () => toCloudAttrs,
   toolCanonicalId: () => toolCanonicalId,
   triageDiscriminatorAttrs: () => triageDiscriminatorAttrs,
+  unpackHistoryAttrs: () => unpackHistoryAttrs,
   unregisteredGraphEventKeys: () => unregisteredGraphEventKeys,
   validateCastaliaPayload: () => validateCastaliaPayload,
   versionlessPurl: () => versionlessPurl,
@@ -16940,6 +17511,11 @@ var init_src = __esm({
     init_project_symbol();
     init_lockfile();
     init_manifests();
+    init_history_quality();
+    init_history_read();
+    init_history_temporal();
+    init_history_revision();
+    init_history_evidence();
     init_hash();
     init_error_signature();
     init_canonicalize();
@@ -16949,6 +17525,7 @@ var init_src = __esm({
     init_predicate();
     init_taxonomy();
     init_triage_canon();
+    init_history_text();
   }
 });
 
@@ -21307,6 +21884,15 @@ function percolate(l1, l2, opts) {
     for (const label of PERCOLATING_LABELS) {
       for (const n of l1.findNodesByLabel(label)) {
         if (n.label === "Problem" && n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) continue;
+        if (n.attrs["source"] === "cloud") {
+          const raw2 = l2.getMeta?.(`history-correction:${String(n.attrs["cloudNodeId"] ?? n.id)}`);
+          const correction = raw2 ? JSON.parse(raw2) : null;
+          const support2 = n.attrs["historyQuality"]?.["sourceSupport"];
+          if (correction?.action === "quarantine" || correction?.sourceSupport === "contradicted" || support2 === "quarantined" || support2 === "contradicted") {
+            result.nodesSkipped++;
+            continue;
+          }
+        }
         present.add(n.id);
         const existing = l2.getNode(n.id);
         if (!existing) {
@@ -24222,6 +24808,7 @@ var init_src5 = __esm({
 
 // ../../packages/context-writer/src/render.ts
 function isPassiveInjectable(node2) {
+  if (!historyReadPolicy(node2, { mode: "passive" }).allow) return false;
   if (node2.label === "Pattern" || node2.label === "Technique" || node2.label === "AntiPattern") {
     return true;
   }
@@ -24231,7 +24818,7 @@ function isPassiveInjectable(node2) {
   return false;
 }
 function buildSnapshot(opts) {
-  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0);
+  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive" }).allow);
   const stillOpen = problems.filter((p) => p.attrs["resolvedAt"] == null);
   const allProblems = stillOpen.filter((p) => !isConstraintProblem(p));
   allProblems.sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt);
@@ -24261,10 +24848,11 @@ function buildSnapshot(opts) {
     ...opts.store.findNodesByLabel("Pattern"),
     ...opts.store.findNodesByLabel("Technique"),
     ...opts.store.findNodesByLabel("AntiPattern")
-  ].sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
+  ].filter((n) => historyReadPolicy(n, { mode: "passive" }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
   const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile) : void 0;
   const byEpisode = /* @__PURE__ */ new Map();
   for (const sol of opts.store.findNodesByLabel("Solution")) {
+    if (!historyReadPolicy(sol, { mode: "passive" }).allow) continue;
     if (sol.attrs["enrichmentPending"] !== true) continue;
     const ep = sol.attrs["episodeId"] ?? sol.id;
     const list = byEpisode.get(ep) ?? [];
@@ -24374,6 +24962,14 @@ function sliceForFile(store, relPath) {
     if (externalRefs.length >= 20) break;
   }
   const fp = priorsForFile(store, relPath);
+  if (fp) {
+    const allowed = (n) => historyReadPolicy(n, { mode: "passive" }).allow;
+    fp.openProblems = fp.openProblems.filter(allowed);
+    fp.constraints = fp.constraints.filter(allowed);
+    fp.resolvedProblems = fp.resolvedProblems.filter(allowed);
+    fp.related = fp.related.filter(allowed);
+    for (const [id, solutions] of fp.solutionsByProblem) fp.solutionsByProblem.set(id, solutions.filter(allowed));
+  }
   const priors = fp ? {
     openProblems: fp.openProblems.slice(0, 3).map((p) => ({
       id: p.id,
@@ -24846,6 +25442,7 @@ var init_render = __esm({
     "use strict";
     init_src5();
     init_src2();
+    init_src();
     RECALL_FIRST_HEADER = "## errata \u2014 recall before you work";
     RECALL_FIRST_BODY = "Before investigating any bug or error, your FIRST tool call must be `mcp__errata__errata_search` with a few words describing the problem. This machine's knowledge graph records previously solved problems \u2014 the answer may already be recorded. Read what it returns before touching any files.";
     RECALL_FIRST_BLOCK = `${RECALL_FIRST_HEADER}
@@ -24993,7 +25590,7 @@ function selectDurableMemory(store, profile, opts = {}) {
   const minContributors = opts.minContributors ?? 1;
   const wsLangs = new Set(profile.languages.map((l) => l.toLowerCase()));
   return store.findNodesByLabel("Claim").filter(
-    (n) => Number(n.attrs["abstractionLevel"] ?? ABSTRACTION_LEVEL.CONCRETE) === ABSTRACTION_LEVEL.PRINCIPLE && n.attrs["provisional"] === false && contributorsOf(n) >= minContributors && // Lang-relevance: universal principles (no scope.lang) bleed everywhere; a
+    (n) => historyReadPolicy(n, { mode: "passive" }).allow && Number(n.attrs["abstractionLevel"] ?? ABSTRACTION_LEVEL.CONCRETE) === ABSTRACTION_LEVEL.PRINCIPLE && n.attrs["provisional"] === false && contributorsOf(n) >= minContributors && // Lang-relevance: universal principles (no scope.lang) bleed everywhere; a
     // language-scoped principle only bleeds into repos that USE that language —
     // so a Python principle never lands a dead `**/*.py` rule in a TS repo.
     (scopeLangOf(n) == null || wsLangs.has(scopeLangOf(n)))
@@ -25017,6 +25614,7 @@ var init_select_durable_memory = __esm({
   "../../packages/context-writer/src/select-durable-memory.ts"() {
     "use strict";
     init_src2();
+    init_src();
     num2 = (v, d = 0) => typeof v === "number" && Number.isFinite(v) ? v : d;
     LANG_GLOBS = {
       typescript: ["**/*.ts", "**/*.tsx"],
@@ -25854,7 +26452,7 @@ var init_client = __esm({
           label: n.label,
           description: n.description,
           extractionConfidence: typeof n.attrs["score"] === "number" ? clamp012(n.attrs["score"]) : 0.5,
-          extractionSource: "agent-observed",
+          extractionSource: INGEST_EXTRACTION_SOURCES.includes(n.attrs["extractionSource"]) ? n.attrs["extractionSource"] : "cold-start-seed",
           embedding: [],
           cumulativeSurprise: 0,
           peakSurprise: 0,
@@ -25866,7 +26464,7 @@ var init_client = __esm({
           isLandmark: false,
           community: null,
           stability: "stable",
-          attrs: { ...n.attrs, source: "cloud", cloudNodeId: n.nodeId }
+          attrs: { ...unpackHistoryAttrs(n.attrs), source: "cloud", cloudNodeId: n.nodeId }
         }));
         const edges = res.edges.map((e) => ({
           id: digest({ from: e.fromCanonicalId, type: e.type, to: e.toCanonicalId }),
@@ -25915,6 +26513,17 @@ var init_client = __esm({
        * daemon filters the page against its own checkout, and nothing about which
        * symbols it holds is sent. Same membership gate as priors.
        */
+      /** Content-free invalidations, independent of code-symbol/anchor availability. */
+      async getProjectHistoryCorrections(projectId, since, limit = 200) {
+        return this.json("GET", `/v2/projects/${encodeURIComponent(projectId)}/anchors?correctionsOnly=1&correctionSince=${String(since)}&limit=${String(limit)}`);
+      }
+      async getHistoryOccurrences(projectId, atCommit, after) {
+        const query = new URLSearchParams({ atCommit, limit: "50", ...after ? { after } : {} });
+        return this.json("GET", `/v2/projects/${encodeURIComponent(projectId)}/history/occurrences?${query}`);
+      }
+      async reconcileHistory(projectId, proof) {
+        return this.json("POST", `/v2/projects/${encodeURIComponent(projectId)}/history/reconcile`, proof);
+      }
       async getProjectAnchors(projectId, since, limit = 200) {
         const res = await this.json(
           "GET",
@@ -26066,13 +26675,13 @@ var init_client = __esm({
 });
 
 // ../../packages/cloud-client/src/pkce.ts
-import { createHash as createHash2, randomBytes } from "node:crypto";
+import { createHash as createHash3, randomBytes } from "node:crypto";
 function base64url3(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function generatePkce() {
   const verifier = base64url3(randomBytes(32));
-  const challenge = base64url3(createHash2("sha256").update(verifier).digest());
+  const challenge = base64url3(createHash3("sha256").update(verifier).digest());
   return { verifier, challenge, method: "S256" };
 }
 function randomState() {
@@ -29368,14 +29977,14 @@ var init_git_remote = __esm({
 
 // src/profile.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { join as join7 } from "node:path";
 function workspaceId(root) {
-  return "wp_" + createHash3("sha256").update(root).digest("hex").slice(0, 12);
+  return "wp_" + createHash4("sha256").update(root).digest("hex").slice(0, 12);
 }
 function sessionOriginKey(sessionId) {
   if (!sessionId) return void 0;
-  return "ws_" + createHash3("sha256").update(sessionId).digest("hex").slice(0, 12);
+  return "ws_" + createHash4("sha256").update(sessionId).digest("hex").slice(0, 12);
 }
 function refreshRepoLocator(root, profile) {
   const detected = detectRepoLocator(root, profile.repoRemote);
@@ -29813,7 +30422,7 @@ function scrub(input) {
       return `<api-key:${id}>`;
     });
   }
-  text = text.replace(EMAIL_RE, (m) => {
+  text = text.replace(EMAIL_RE2, (m) => {
     const id = sha256Short(m, 6);
     bump("email", `<email:${id}>`);
     return `<email:${id}>`;
@@ -29864,8 +30473,8 @@ function detectViolations(input) {
     if (p.re.test(input)) violations.add("api-key");
     p.re.lastIndex = 0;
   }
-  if (EMAIL_RE.test(input)) violations.add("email");
-  EMAIL_RE.lastIndex = 0;
+  if (EMAIL_RE2.test(input)) violations.add("email");
+  EMAIL_RE2.lastIndex = 0;
   if (WIN_PATH_RE.test(input)) violations.add("windows-path");
   WIN_PATH_RE.lastIndex = 0;
   if (WIN_UNC_RE.test(input)) violations.add("windows-path");
@@ -29876,7 +30485,7 @@ function detectViolations(input) {
   IPV4_RE.lastIndex = 0;
   return [...violations];
 }
-var API_KEY_PATTERNS, EMAIL_RE, IPV4_RE, IPV6_RE, WIN_PATH_RE, WIN_UNC_RE, POSIX_USER_PATH_RE, LONG_HASH_RE, UUID_RE;
+var API_KEY_PATTERNS, EMAIL_RE2, IPV4_RE, IPV6_RE, WIN_PATH_RE, WIN_UNC_RE, POSIX_USER_PATH_RE, LONG_HASH_RE, UUID_RE;
 var init_scrub = __esm({
   "../../packages/canonical/src/scrub.ts"() {
     "use strict";
@@ -29890,7 +30499,7 @@ var init_scrub = __esm({
       { name: "stripe-key", re: /\b(sk|pk)_(test|live)_[0-9a-zA-Z]{24,}\b/g },
       { name: "bearer", re: /\bBearer\s+[A-Za-z0-9_\-\.]{16,}\b/gi }
     ];
-    EMAIL_RE = /\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g;
+    EMAIL_RE2 = /\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g;
     IPV4_RE = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
     IPV6_RE = /\b(?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9:]{1,4}\b/g;
     WIN_PATH_RE = /\b[A-Za-z]:[\\/](?![\\/])(?:[^\\/\s"']+[\\/])*[^\\/\s"']*/g;
@@ -32622,6 +33231,7 @@ var init_nightly = __esm({
 });
 
 // ../../packages/generalizer/src/embed-code.ts
+import { createHash as createHash5 } from "node:crypto";
 function embedCodeNodes(store, opts = {}) {
   return embedNodesByLabels(store, CODE_LABELS, opts);
 }
@@ -32630,9 +33240,15 @@ function embedSemanticNodes(store, opts = {}) {
 }
 async function ensureNodeEmbedded(store, nodeId, opts = {}) {
   const node2 = store.getNode(nodeId);
-  if (!node2 || node2.embedding.length > 0) return false;
+  if (!node2) return false;
+  if (!eligibleForEmbedding(store, node2)) {
+    clearWithdrawnVector(store, node2.id);
+    return false;
+  }
+  if (node2.embedding.length > 0) return false;
   const text = buildText(store, node2);
   if (!text) return false;
+  const before = embeddingSnapshot(node2, text);
   let result;
   try {
     if (opts.mode === "hash") {
@@ -32646,12 +33262,41 @@ async function ensureNodeEmbedded(store, nodeId, opts = {}) {
   } catch {
     return false;
   }
-  store.updateNode(nodeId, {
+  return store.transaction(() => writeIfUnchanged(store, before, result));
+}
+function embeddingState(node2) {
+  return createHash5("sha256").update(JSON.stringify([node2.attrs["embeddingVersion"] ?? null, node2.embedding])).digest("hex");
+}
+function embeddingSnapshot(node2, text) {
+  return { id: node2.id, text, validTo: node2.validTo, vectorState: embeddingState(node2) };
+}
+function writeIfUnchanged(store, before, result) {
+  const current = store.getNode(before.id);
+  if (!current || !eligibleForEmbedding(store, current) || buildText(store, current) !== before.text || current.validTo !== before.validTo || embeddingState(current) !== before.vectorState)
+    return false;
+  store.updateNode(current.id, {
     embedding: result.vector,
-    attrs: { ...node2.attrs, embeddingVersion: result.version }
+    attrs: { ...current.attrs, embeddingVersion: result.version }
   });
   return true;
 }
+function eligibleForEmbedding(store, node2) {
+  const cloudId = node2.attrs["cloudNodeId"];
+  const raw2 = node2.attrs["source"] === "cloud" ? store.getMeta?.(`history-correction:${typeof cloudId === "string" ? cloudId : node2.id}`) : null;
+  const correction = raw2 ? JSON.parse(raw2) : null;
+  const withdrawn = correction && Number(correction.seq) >= Number(node2.attrs["historyCorrectionSeq"] ?? 0) && (correction.action === "quarantine" || correction.sourceSupport === "contradicted");
+  return !withdrawn && historyReadPolicy(node2).allow && !node2.attrs["mergedInto"] && !node2.attrs["fusedInto"];
+}
+function clearWithdrawnVector(store, nodeId) {
+  store.transaction(() => {
+    const node2 = store.getNode(nodeId);
+    if (!node2 || eligibleForEmbedding(store, node2)) return;
+    if (node2.embedding.length || node2.attrs["embeddingVersion"] !== void 0) {
+      const { embeddingVersion: _version, ...attrs } = node2.attrs;
+      store.mergeNode({ ...node2, embedding: [], attrs });
+    }
+  });
+}
 async function embedNodesByLabels(store, labels, opts = {}) {
   const started2 = Date.now();
   const report = {
@@ -32666,8 +33311,14 @@ async function embedNodesByLabels(store, labels, opts = {}) {
   const currentVersion = hashOnly ? EMBEDDING_VERSION : (await embedBatchWithModelOrHash(["probe"]))[0]?.version ?? "unknown";
   const todo = [];
   for (const label of labels) {
-    for (const node2 of store.findNodesByLabel(label)) {
+    for (const node2 of store.findNodesByLabel(
+      label
+    )) {
       report.scanned++;
+      if (!eligibleForEmbedding(store, node2)) {
+        clearWithdrawnVector(store, node2.id);
+        continue;
+      }
       const existingVersion = node2.attrs["embeddingVersion"] ?? null;
       if (existingVersion) {
         report.versionsSeen[existingVersion] = (report.versionsSeen[existingVersion] ?? 0) + 1;
@@ -32682,7 +33333,7 @@ async function embedNodesByLabels(store, labels, opts = {}) {
       }
       const text = buildText(store, node2);
       if (!text) continue;
-      todo.push({ id: node2.id, text });
+      todo.push(embeddingSnapshot(node2, text));
     }
   }
   for (let i2 = 0; i2 < todo.length; i2 += BATCH_SIZE) {
@@ -32699,17 +33350,12 @@ async function embedNodesByLabels(store, labels, opts = {}) {
     }
     store.transaction(() => {
       for (let j = 0; j < batch.length; j++) {
-        const node2 = store.getNode(batch[j].id);
-        if (!node2) continue;
-        const newAttrs = {
-          ...node2.attrs,
-          embeddingVersion: results[j].version
-        };
-        store.updateNode(batch[j].id, {
-          embedding: results[j].vector,
-          attrs: newAttrs
-        });
-        report.embedded++;
+        const result = results[j];
+        if (!result) {
+          report.failed++;
+          continue;
+        }
+        if (writeIfUnchanged(store, batch[j], result)) report.embedded++;
       }
     });
     if (opts.progress) opts.progress(report.embedded, todo.length);
@@ -32738,6 +33384,7 @@ var CODE_LABELS, SEMANTIC_LABELS, BATCH_SIZE;
 var init_embed_code = __esm({
   "../../packages/generalizer/src/embed-code.ts"() {
     "use strict";
+    init_src();
     init_src3();
     CODE_LABELS = ["Function", "Method", "Class", "Const"];
     SEMANTIC_LABELS = ["Problem", "RootCause", "Solution", "Pattern", "Claim"];
@@ -32901,7 +33548,7 @@ var init_src10 = __esm({
 });
 
 // ../../packages/indexer/src/parse-cache.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join11 } from "node:path";
@@ -32909,7 +33556,7 @@ function parseCacheDir() {
   return process.env["ERRATA_PARSE_CACHE"] ?? join11(homedir3(), ".errata", "parse-cache");
 }
 function parseCacheKey(source, providerId) {
-  return createHash4("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
+  return createHash6("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
 }
 function entryPath(dir, key) {
   return join11(dir, key.slice(0, 2), `${key.slice(2)}.json`);
@@ -33207,7 +33854,7 @@ var init_identity3 = __esm({
 import { appendFileSync, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
 import { readdir } from "node:fs/promises";
 import { extname, join as join12, relative as relative2, sep } from "node:path";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 function nowTs() {
   return indexNow ?? Date.now();
@@ -33216,7 +33863,7 @@ function fingerprintOf(signature, bodyHash) {
   return `${signature ?? ""}|${bodyHash ?? ""}`;
 }
 function sha(s) {
-  return createHash5("sha256").update(s).digest("hex").slice(0, 16);
+  return createHash7("sha256").update(s).digest("hex").slice(0, 16);
 }
 function fileNodeId(workspaceId2, relPath) {
   return `file_${sha(workspaceId2 + ":" + relPath.replace(/\\/g, "/"))}`;
@@ -33344,7 +33991,7 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   for (const rel of [...changedRelPaths]) {
     let h;
     try {
-      h = createHash5("sha256").update(readFileSync11(join12(rootPath, rel))).digest("hex");
+      h = createHash7("sha256").update(readFileSync11(join12(rootPath, rel))).digest("hex");
     } catch {
       continue;
     }
@@ -34267,7 +34914,7 @@ function upsertFile(store, id, f, workspaceId2, skip) {
   if (existing && fileUnchanged(existing.attrs, f, skip)) return;
   let contentHash;
   try {
-    contentHash = createHash5("sha256").update(readFileSync11(f.absPath)).digest("hex");
+    contentHash = createHash7("sha256").update(readFileSync11(f.absPath)).digest("hex");
   } catch {
   }
   const carried = { ...existing?.attrs ?? {} };
@@ -38796,7 +39443,7 @@ var init_tree_sitter_loader = __esm({
 });
 
 // ../../packages/indexer/src/languages/typescript-treesitter.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function extractNode(node2, source, containerQname, containerKind) {
   switch (node2.type) {
     case "function_declaration":
@@ -39009,7 +39656,7 @@ function scopeRecord(kind, name2, qname, node2, body2, source) {
       const sig = header.replace(/\s+/g, " ").trim();
       if (sig) rec.signature = sig;
       const bodyText = source.slice(body2.startIndex, body2.endIndex);
-      rec.bodyHash = createHash6("sha256").update(bodyText).digest("hex").slice(0, 16);
+      rec.bodyHash = createHash8("sha256").update(bodyText).digest("hex").slice(0, 16);
       rec.bodySimhash = toHex(simhash(bodyText));
     }
   }
@@ -39451,14 +40098,14 @@ var init_typescript_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/python-treesitter.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 function sigAndHash(node2, body2, source) {
   if (!body2) return {};
   const out2 = {};
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash7("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash9("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -39871,7 +40518,7 @@ var init_python_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/cpp-treesitter.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function extractNode3(node2, containerQname, containerIsClass, source) {
   switch (node2.type) {
     case "function_definition":
@@ -40055,7 +40702,7 @@ function sigAndHash2(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash8("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash10("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40216,7 +40863,7 @@ var init_cpp_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/go-treesitter.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function extractNode4(node2, containerQname, source) {
   switch (node2.type) {
     case "function_declaration": {
@@ -40378,7 +41025,7 @@ function sigAndHash3(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash9("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash11("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40522,7 +41169,7 @@ var init_go_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/rust-treesitter.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function extractNode5(node2, containerQname, containerIsClass, source) {
   switch (node2.type) {
     case "function_item":
@@ -40737,7 +41384,7 @@ function sigAndHash4(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash10("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash12("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40888,7 +41535,7 @@ var init_rust_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/ruby-treesitter.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 function sigAndHash5(node2, body2, source) {
   if (!body2) {
     const sig2 = source.slice(node2.startIndex, node2.endIndex).replace(/\s+/g, " ").trim();
@@ -40898,7 +41545,7 @@ function sigAndHash5(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash11("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash13("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -41244,7 +41891,7 @@ var init_ruby_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/csharp-treesitter.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function extractNode7(node2, containerQname, containerIsType, source, eof) {
   switch (node2.type) {
     case "method_declaration":
@@ -41446,7 +42093,7 @@ function sigAndHash6(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash12("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash14("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -51362,10 +52009,10 @@ import {
   writeFileSync as writeFileSync11
 } from "node:fs";
 import { join as join16 } from "node:path";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 function enqueueOutbox(paths, payload) {
   ensureDir(paths.outbox);
-  const id = createHash13("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+  const id = createHash15("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
   const file2 = join16(paths.outbox, `${Date.now()}-${id}.json`);
   writeFileSync11(file2, JSON.stringify(payload, null, 2), "utf8");
   return file2;
@@ -63247,7 +63894,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/mock/mock-client.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify3 } = __require("node:util");
+    var { promisify: promisify4 } = __require("node:util");
     var Client = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -63287,7 +63934,7 @@ var require_mock_client = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify3(this[kOriginalClose])();
+        await promisify4(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -63300,7 +63947,7 @@ var require_mock_client = __commonJS({
 var require_mock_pool = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/mock/mock-pool.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify3 } = __require("node:util");
+    var { promisify: promisify4 } = __require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -63340,7 +63987,7 @@ var require_mock_pool = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify3(this[kOriginalClose])();
+        await promisify4(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -74104,7 +74751,7 @@ init_checkout_root();
 import { closeSync, existsSync as existsSync16, fstatSync, openSync, readdirSync as readdirSync6, readSync, realpathSync, statSync as statSync6 } from "node:fs";
 import { basename as basename5, delimiter, dirname as dirname10, join as join20, normalize as normalize3 } from "node:path";
 import { homedir as homedir4 } from "node:os";
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 function readFrom(path2, fromByte, maxBytes) {
   let fd;
   try {
@@ -74413,7 +75060,7 @@ function parseCodexAssistantTurns(raw2, skipFirstLineParseFailure = false, start
     turns.push({
       // Slice-local line numbers repeat on every Stop. Position distinguishes
       // identical messages; the digest distinguishes a replaced row at that position.
-      uuid: typeof payload["id"] === "string" && payload["id"].length > 0 ? payload["id"] : `codex-${lineByte}-${createHash14("sha256").update(line.trimEnd()).digest("hex")}`,
+      uuid: typeof payload["id"] === "string" && payload["id"].length > 0 ? payload["id"] : `codex-${lineByte}-${createHash16("sha256").update(line.trimEnd()).digest("hex")}`,
       text: parts2.join("\n\n"),
       hostHarness: "codex"
     });
@@ -74662,7 +75309,7 @@ function geminiSessionRoots(env2 = process.env, home = homedir4()) {
   return [...roots];
 }
 function geminiProjectHash(cwd) {
-  return createHash14("sha256").update(cwd).digest("hex");
+  return createHash16("sha256").update(cwd).digest("hex");
 }
 function geminiHashesFor(cwd) {
   const variants = /* @__PURE__ */ new Set([cwd, cwd.replace(/\/+$/, "")]);
@@ -77983,7 +78630,7 @@ var TelemetryRecorder = class {
 // src/file-activity.ts
 import { readFileSync as readFileSync22 } from "node:fs";
 import { join as join28 } from "node:path";
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 
 // ../../packages/privacy/src/patterns/credentials.ts
 var CREDENTIAL_PATTERNS = [
@@ -78732,6 +79379,7 @@ var openaiAgent = new import_undici.Agent({
 init_git_remote();
 
 // src/history-bundle.ts
+init_src();
 import { execFile as execFile2 } from "node:child_process";
 import { readFileSync as readFileSync21 } from "node:fs";
 import { join as join27 } from "node:path";
@@ -78740,8 +79388,6 @@ var FILE_LIST_CAP = 60;
 var DIFF_FILE_CAP = 40;
 var GENERATED_JSON_MAX_CHURN = 800;
 var TRUNCATION_MARKER = "\n[truncated]";
-var REDACTED_CREDENTIAL = "[redacted:credential]";
-var REDACTED_EMAIL = "[redacted:email]";
 var CHARS_PER_TOKEN = 3.5;
 function estimateTokens(text) {
   return Math.ceil(text.length / CHARS_PER_TOKEN);
@@ -78882,138 +79528,6 @@ function isSourceFile(f) {
   if (ext === "json" && f.adds + f.dels > GENERATED_JSON_MAX_CHURN) return false;
   return true;
 }
-var cred = () => REDACTED_CREDENTIAL;
-var ASSIGNMENT_STOPWORDS = /* @__PURE__ */ new Set([
-  "string",
-  "boolean",
-  "number",
-  "required",
-  "optional",
-  "undefined",
-  "unknown",
-  "function",
-  "process",
-  "request",
-  "response",
-  "password",
-  "secret",
-  "token",
-  "tokens",
-  "credential",
-  "credentials",
-  "bearer",
-  "basic",
-  "example",
-  "redacted",
-  "nullable",
-  "readonly",
-  "override",
-  "abstract",
-  "interface",
-  "constant",
-  "variable",
-  "property",
-  "parameter",
-  "argument",
-  "callback",
-  "promise",
-  "settings",
-  "options",
-  "default",
-  "disabled",
-  "enabled",
-  "internal",
-  "external",
-  "protected",
-  "provided",
-  "resolved",
-  "rejected",
-  "expected",
-  "received"
-]);
-function looksLikeSecretValue(raw2, quoted) {
-  if (raw2.includes("${") || raw2.includes("{{") || raw2.includes("%(")) return false;
-  if (raw2.startsWith(REDACTED_CREDENTIAL) || raw2.startsWith(REDACTED_EMAIL)) return false;
-  const lower = raw2.toLowerCase();
-  if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
-  if (quoted) return raw2.length >= 6;
-  if (!/^[A-Za-z0-9+/=_-]{8,}$/.test(raw2)) return false;
-  if (/\d/.test(raw2)) return true;
-  if (raw2.length >= 12) return true;
-  return /[a-z]/.test(raw2) && /[A-Z]/.test(raw2);
-}
-var CREDENTIAL_RULES = [
-  // Private-key blocks, including ones a diff prefixes with `+`/`-` per line
-  // and ones the diff context cut before the END line.
-  {
-    re: /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*\r?\n[+\- ]?[A-Za-z0-9+/=]{16,}[ \t]*)*(?:[ \t]*\r?\n[+\- ]?-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)?/g,
-    replace: cred
-  },
-  { re: /\b(?:AKIA|ASIA)[0-9A-Z]{16,}\b/g, replace: cred },
-  // AWS access key id
-  { re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, replace: cred },
-  { re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g, replace: cred },
-  { re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replace: cred },
-  { re: /\bxox[abeprs]-[A-Za-z0-9-]{10,}\b/g, replace: cred },
-  // Slack
-  { re: /\bsk-(?:ant-)?[A-Za-z0-9_-]{20,}\b/g, replace: cred },
-  // OpenAI / Anthropic
-  { re: /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g, replace: cred },
-  // Stripe
-  { re: /\brnd_[A-Za-z0-9]{20,}\b/g, replace: cred },
-  // Render
-  { re: /\bnpm_[A-Za-z0-9]{36}\b/g, replace: cred },
-  { re: /\bAIza[0-9A-Za-z_-]{35}\b/g, replace: cred },
-  // Google API key
-  { re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, replace: cred },
-  // JWT
-  { re: /(?<![A-Za-z0-9])[A-Za-z0-9]{84}(?![A-Za-z0-9])/g, replace: cred },
-  // Azure-shaped
-  {
-    re: /\b(Bearer|Basic|Token)(\s+)([A-Za-z0-9._~+/=-]{16,})/g,
-    replace: (m) => `${m[1]}${m[2]}${REDACTED_CREDENTIAL}`
-  },
-  // Assignments after key-ish names: `password=...`, `API_KEY: "..."`,
-  // `"client_secret": "..."`, `AWS_SECRET_ACCESS_KEY=...`, 32+ hex/base64 after
-  // any of them. The value heuristic keeps `token: string` and
-  // `password = process.env.X` intact.
-  {
-    re: /((?:[A-Za-z0-9_.-]*?)(?:password|passwd|passphrase|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|auth[_-]?key|credential)(?:[A-Za-z0-9_-]*))(["']?\s*(?:=>|=|:)\s*)(["'`]?)([^\s"'`,;)}\]]+)/gi,
-    replace: (m) => {
-      const value = m[4] ?? "";
-      const quote = m[3] ?? "";
-      if (!looksLikeSecretValue(value, quote.length > 0)) return null;
-      return `${m[1]}${m[2]}${quote}${REDACTED_CREDENTIAL}`;
-    }
-  }
-];
-var EMAIL_RE2 = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+\b/g;
-function applyRule(text, rule) {
-  let count = 0;
-  const out2 = text.replace(rule.re, (...args2) => {
-    const m = args2.slice(0, -2);
-    const r = rule.replace(m);
-    if (r === null) return m[0];
-    count += 1;
-    return r;
-  });
-  return { text: out2, count };
-}
-function scrubText(text) {
-  let out2 = text;
-  let credentials = 0;
-  for (const rule of CREDENTIAL_RULES) {
-    const r = applyRule(out2, rule);
-    out2 = r.text;
-    credentials += r.count;
-  }
-  let emails = 0;
-  out2 = out2.replace(EMAIL_RE2, () => {
-    emails += 1;
-    return REDACTED_EMAIL;
-  });
-  return { text: out2, credentials, emails };
-}
 var TRAILER_KEYS = [
   "signed-off-by",
   "co-authored-by",
@@ -79135,12 +79649,18 @@ async function buildUnitBundle(root, unit, opts = {}) {
   const rawDiff = await unitDiff(root, unit, diffPaths);
   for (const p of headerPaths(rawDiff)) tokens.token(p);
   const narrativeRaw = opts.narrative ?? [unit.subject.trim(), stripTrailers(unit.body)].filter((s) => s.length > 0).join("\n\n");
-  const n = scrubText(tokens.apply(stripTrailers(narrativeRaw)));
-  const fl = scrubText(tokens.apply(fileListRaw));
-  const d = scrubText(tokens.apply(rawDiff));
-  let narrative2 = n.text;
-  let fileList = fl.text;
-  let diff = d.text;
+  const n = scrubHistoryText(tokens.apply(stripTrailers(narrativeRaw)));
+  const fl = scrubHistoryText(tokens.apply(fileListRaw));
+  const d = scrubHistoryText(tokens.apply(rawDiff));
+  const safe = scrubHistoryValue({
+    narrative: tokens.apply(stripTrailers(narrativeRaw)),
+    fileList: tokens.apply(fileListRaw),
+    diff: tokens.apply(rawDiff),
+    narrativeSources: opts.narrativeSources?.map((source) => ({ commitSha: source.commitSha, text: tokens.apply(stripTrailers(source.text)).trim() }))
+  });
+  let narrative2 = safe.narrative;
+  let fileList = safe.fileList;
+  let diff = safe.diff;
   const separators = 2;
   let prose = estimateTokens(narrative2) + estimateTokens(fileList) + separators;
   if (prose > maxTokens) {
@@ -79159,6 +79679,7 @@ async function buildUnitBundle(root, unit, opts = {}) {
   return {
     sha: unit.sha,
     narrative: narrative2,
+    ...safe.narrativeSources ? { narrativeSources: safe.narrativeSources.filter((source) => source.text.length > 0 && narrative2.includes(source.text)).slice(0, 64) } : {},
     fileList,
     diff,
     tokenEstimate: estimateTokens(narrative2) + estimateTokens(fileList) + estimateTokens(diff) + separators,
@@ -79281,7 +79802,7 @@ var FileActivityReporter = class {
       const current = this.options.binding();
       if (!identity || this.stopped || !current.enabled || current.projectId !== binding.projectId)
         return false;
-      const hash2 = createHash15("sha256").update(JSON.stringify([identity, source, at, clean, operation, branch, previousBranch])).digest("hex");
+      const hash2 = createHash17("sha256").update(JSON.stringify([identity, source, at, clean, operation, branch, previousBranch])).digest("hex");
       const id = `${hash2.slice(0, 8)}-${hash2.slice(8, 12)}-5${hash2.slice(13, 16)}-8${hash2.slice(17, 20)}-${hash2.slice(20, 32)}`;
       if (!this.pending.some((item) => item.event.id === id))
         this.pending.push({
@@ -80338,7 +80859,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.13-dev.2998" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.13-dev.3054" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -82797,10 +83318,10 @@ init_registry();
 init_identity2();
 
 // src/instance-receipts.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 var FIELDS = ["contributedAtSeq", "cloudNodeId", "anchorsContributedDigest", "projectAnchorsContributedDigest", "semanticEdgesContributedDigest", "shipRefusedSinceSeq", "shipRefusedCount", "shipRefusedReason", "shipRefusedFingerprint"];
 function instanceDestinationKey(input) {
-  return createHash16("sha256").update(JSON.stringify([
+  return createHash18("sha256").update(JSON.stringify([
     input.workspace,
     input.cloudUrl.replace(/\/+$/, ""),
     input.installationId ?? input.profileName ?? "default",
@@ -84282,6 +84803,69 @@ init_profile2();
 init_src();
 init_src11();
 init_profile2();
+
+// src/history-corrections.ts
+init_profile2();
+function applyHistoryCorrections(store, page) {
+  let changed = 0;
+  for (const correction of page.changes) {
+    const key = `history-correction:${correction.nodeId}`;
+    const previous = store.getMeta?.(key);
+    if (!previous || Number(JSON.parse(previous).seq) < correction.seq) store.setMeta?.(key, JSON.stringify(correction));
+    const current = store.getNode(correction.canonicalId) ?? store.getNode(correction.nodeId);
+    if (!current) continue;
+    const privacy = correction.action === "quarantine";
+    const copies = privacy ? store.nodeHistory(current.logicalId ?? current.id) : [current];
+    for (const node2 of copies) {
+      if (node2.attrs["source"] !== "cloud" || node2.attrs["cloudNodeId"] && node2.attrs["cloudNodeId"] !== correction.nodeId || Number(node2.attrs["historyCorrectionSeq"] ?? 0) >= correction.seq) continue;
+      const quality = { sourceSupport: correction.sourceSupport ?? (privacy ? "quarantined" : "unreviewed"), applicability: "unknown" };
+      store.mergeNode({
+        ...node2,
+        lastUpdatedAt: Date.now(),
+        ...privacy ? { description: "History source withdrawn.", embedding: [], isLandmark: false } : {},
+        attrs: {
+          ...privacy ? {} : node2.attrs,
+          source: "cloud",
+          cloudNodeId: correction.nodeId,
+          extractionSource: "history-mined",
+          historyQuality: quality,
+          historyCorrectionSeq: correction.seq
+        }
+      });
+      if (privacy) for (const edge2 of [...store.inEdges(node2.id), ...store.outEdges(node2.id)]) {
+        if (edge2.attrs["source"] === "cloud") store.mergeEdge({ ...edge2, attrs: { source: "cloud", historySourceWithdrawn: true } });
+      }
+      changed++;
+    }
+  }
+  return changed;
+}
+async function syncHistoryCorrections(opts) {
+  const { root, profile, store, cloud } = opts;
+  if (!profile.projectId || !cloud.getProjectHistoryCorrections) return;
+  let cursor = profile.projectHistoryCorrectionCursor ?? 0;
+  for (let i2 = 0; i2 < 25; i2++) {
+    const page = await cloud.getProjectHistoryCorrections(profile.projectId, cursor, 200);
+    if (!Number.isSafeInteger(page.cursor) || page.cursor < cursor || !Array.isArray(page.changes) || page.changes.length > 200 || page.changes.some((c, j) => !Number.isSafeInteger(c.seq) || c.seq <= (page.changes[j - 1]?.seq ?? cursor) || c.seq > page.cursor || !["quarantine", "unreviewed"].includes(c.action) || c.sourceSupport !== void 0 && !["supported", "contradicted", "unreviewed", "quarantined"].includes(c.sourceSupport) || typeof c.nodeId !== "string" || typeof c.canonicalId !== "string")) {
+      throw new Error("Invalid history correction page");
+    }
+    if (page.cursor !== (page.changes.at(-1)?.seq ?? cursor)) throw new Error("History correction cursor skipped a page");
+    applyHistoryCorrections(store, page);
+    for (const mirror of opts.mirrors ?? []) applyHistoryCorrections(mirror, page);
+    if (page.changes.some((c) => c.sourceSupport === "supported")) {
+      profile.projectAnchorCursor = 0;
+      delete profile.historyRevisionCursor;
+    }
+    if (page.cursor > cursor) {
+      cursor = page.cursor;
+      profile.projectHistoryCorrectionCursor = cursor;
+      saveProfile(root, profile);
+    }
+    if (page.changes.length < 200) break;
+  }
+}
+
+// src/project-reanchor.ts
 var DEFAULT_LIMIT = 50;
 var ANCHOR_SYMBOL_KINDS2 = [
   "Function",
@@ -84497,6 +85081,7 @@ async function syncProjectAnchors(opts) {
   let landed = 0;
   let cursor = profile.projectAnchorCursor ?? 0;
   try {
+    await syncHistoryCorrections({ root, profile, store, cloud, ...opts.correctionMirrors ? { mirrors: opts.correctionMirrors } : {} });
     for (let page = 0; page < maxPages; page++) {
       const res = await cloud.getProjectAnchors(projectId, cursor, limit);
       if (res.anchors.length === 0) break;
@@ -84611,13 +85196,109 @@ async function hydrateProject(opts) {
   }
 }
 
+// src/history-reconcile.ts
+init_src11();
+init_src();
+import { execFile as execFile4 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+import { extname as extname3 } from "node:path";
+init_profile2();
+var exec = promisify2(execFile4);
+var KINDS = { function: "Function", class: "Class", method: "Method", interface: "Interface", const: "Const", enum: "Enum", typealias: "TypeAlias", namespace: "Namespace", property: "Property" };
+async function syncHistoryRevision(opts) {
+  const { root, profile, store, cloud, salt } = opts;
+  if (!profile.projectId) return { changed: 0, remaining: false };
+  const projectId = profile.projectId;
+  const git3 = opts.git ?? (async (args2) => (await exec("git", ["-C", root, ...args2], { windowsHide: true, maxBuffer: 8 * 1024 * 1024 })).stdout);
+  const atCommit = (await git3(["rev-parse", "--verify", "HEAD"])).trim();
+  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(atCommit)) throw new Error("history revision is not a full Git object id");
+  const oldCursor = profile.historyRevisionCursor;
+  const same = oldCursor?.atCommit === atCommit;
+  if (same && oldCursor.complete && Date.now() - oldCursor.updatedAt < 60 * 6e4) return { changed: 0, remaining: false };
+  const after = same && !oldCursor.complete ? oldCursor.after : void 0;
+  const page = await cloud.getHistoryOccurrences(projectId, atCommit, after);
+  if (!Array.isArray(page.occurrences) || page.occurrences.length > 50 || page.occurrences.some((o, i2) => o.occurrenceId <= (page.occurrences[i2 - 1]?.occurrenceId ?? after ?? "")) || page.cursor !== null && page.cursor !== page.occurrences.at(-1)?.occurrenceId) throw new Error("invalid history occurrence page");
+  const parents = (await git3(["rev-list", "--parents", "--max-count=8192", atCommit])).trim().split("\n").filter(Boolean).map((row) => {
+    const [commit, ...parents2] = row.trim().split(/\s+/);
+    return { commit, parents: parents2 };
+  });
+  const reverse = buildReverseSymbolMap({ store, projectId, salt });
+  const ignore2 = loadRepoIgnore(root, profile.ignoreExtra ?? []);
+  const providers = defaultProviders();
+  const parsedFiles = /* @__PURE__ */ new Map();
+  const observations = [];
+  for (const occurrence of page.occurrences) {
+    const anchors = occurrence.quality["historicalAnchors"];
+    const paths = /* @__PURE__ */ new Set(), symbols = [];
+    for (const anchor of anchors ?? []) {
+      const localId = reverse.get(anchor.symbolId), local = localId ? store.getNode(localId) : null;
+      const path2 = local?.attrs["relPath"];
+      if (typeof path2 !== "string" || !pathAllowedByFloor(path2) || isPathBlocked(ignore2, path2) || /[\r\n]/.test(path2)) continue;
+      paths.add(path2);
+      if (!parsedFiles.has(path2)) {
+        const hashes = /* @__PURE__ */ new Map();
+        parsedFiles.set(path2, hashes);
+        const provider = providers.find((p) => p.fileExtensions.includes(extname3(path2).toLowerCase()));
+        if (!provider) continue;
+        const source2 = await git3(["show", `${atCommit}:${path2}`]).catch(() => null);
+        if (source2 === null || Buffer.byteLength(source2) > 1e6 || source2.includes("\0")) continue;
+        await provider.preload?.();
+        for (const symbol2 of provider.extractSymbols(source2, path2)) {
+          const kind = KINDS[symbol2.kind];
+          if (kind && symbol2.bodyHash) hashes.set(projectSymbolId(salt, projectId, path2, symbol2.qname ?? symbol2.name, kind), symbol2.bodyHash);
+        }
+      }
+      const bodyHash = parsedFiles.get(path2).get(anchor.symbolId);
+      if (bodyHash) symbols.push({ symbolId: anchor.symbolId, bodyHash });
+    }
+    const source = occurrenceSourceCommit(occurrence);
+    let diff;
+    if (source && source !== atCommit && paths.size) {
+      const bundle = await buildUnitBundle(root, {
+        sha: atCommit,
+        parents: [source],
+        isMerge: true,
+        index: 0,
+        subIndex: 0,
+        subject: "",
+        body: "",
+        authorDate: "",
+        files: [...paths].map((path2) => ({ path: path2, adds: 1, dels: 1, binary: false }))
+      }, { maxTokens: 4e3, ignorePatterns: profile.ignoreExtra ?? [] }).catch(() => null);
+      if (bundle && !bundle.truncated) diff = bundle.diff;
+    }
+    observations.push({ occurrenceId: occurrence.occurrenceId, symbols, ...diff ? { diff } : {} });
+  }
+  const response = page.occurrences.length ? await cloud.reconcileHistory(projectId, { atCommit, parents, observations }) : { atCommit, receipts: [] };
+  if (response.atCommit !== atCommit || response.receipts.length !== page.occurrences.length || new Set(response.receipts.map((r) => r.occurrenceId)).size !== response.receipts.length || response.receipts.some((r) => r.atCommit !== atCommit || !observations.some((o) => o.occurrenceId === r.occurrenceId))) throw new Error("incomplete history reconciliation response");
+  if ((await git3(["rev-parse", "--verify", "HEAD"])).trim() !== atCommit) return { changed: 0, remaining: true };
+  let changed = 0;
+  for (const occurrence of page.occurrences) {
+    const node2 = store.getNode(occurrence.canonicalId) ?? (occurrence.nodeId ? store.getNode(occurrence.nodeId) : null);
+    if (!node2 || node2.attrs["source"] !== "cloud" || node2.attrs["historyQuality"]?.["sourceSupport"] === "quarantined") continue;
+    const receipt = response.receipts.find((r) => r.occurrenceId === occurrence.occurrenceId);
+    const previous = node2.attrs["historyQuality"];
+    if (previous?.["evaluatedAtCommit"] === atCommit && previous["applicability"] === "applicable" && receipt.verdict !== "applicable") continue;
+    store.mergeNode({ ...node2, attrs: { ...node2.attrs, historyQuality: {
+      ...occurrence.quality,
+      evaluatedAtCommit: atCommit,
+      applicability: receipt.verdict,
+      reconciliationEvidence: receipt.evidence
+    } } });
+    changed++;
+  }
+  profile.historyRevisionCursor = { atCommit, ...page.cursor ? { after: page.cursor } : {}, complete: page.cursor === null, updatedAt: Date.now() };
+  (opts.save ?? ((p) => saveProfile(root, p)))(profile);
+  return { changed, remaining: page.cursor !== null };
+}
+
 // src/project-history.ts
 init_src7();
 init_src();
-import { execFile as execFile4 } from "node:child_process";
+import { execFile as execFile5 } from "node:child_process";
 import { readFileSync as readFileSync32 } from "node:fs";
 import { join as join37 } from "node:path";
-import { promisify as promisify2 } from "node:util";
+import { promisify as promisify3 } from "node:util";
 
 // src/history-walk.ts
 var LOCKFILE_NAMES = /* @__PURE__ */ new Set([
@@ -84935,10 +85616,13 @@ function message(u) {
 ${u.body}` : u.subject;
 }
 function narrative(unit, group) {
-  if (!group || group.length === 0) return message(unit).trim();
+  return narrativeSources(unit, group).map((source) => source.text).join("\n\n");
+}
+function narrativeSources(unit, group) {
+  if (!group || group.length === 0) return [{ commitSha: unit.sha, text: message(unit).trim() }].filter((s) => s.text.length > 0);
   const members = group.filter((g) => g.groupSha === (unit.groupSha ?? unit.sha)).sort((a, b) => a.subIndex - b.subIndex);
   const source = members.length > 0 ? members : [...group].sort((a, b) => a.subIndex - b.subIndex);
-  return source.map(message).map((m) => m.trim()).filter((m) => m.length > 0).join("\n\n");
+  return source.map((member) => ({ commitSha: member.sha, text: message(member).trim() })).filter((s) => s.text.length > 0);
 }
 
 // src/git-batch.ts
@@ -85042,13 +85726,116 @@ var GitBlobReader = class {
   }
 };
 
+// src/history-anchors.ts
+init_src11();
+init_src();
+import { extname as extname4 } from "node:path";
+var LABELS = {
+  function: "Function",
+  class: "Class",
+  method: "Method",
+  interface: "Interface",
+  const: "Const",
+  enum: "Enum",
+  typealias: "TypeAlias",
+  namespace: "Namespace",
+  property: "Property"
+};
+var MAX_SOURCE_BYTES = 1e6;
+var MAX_ANCHORS = 20;
+async function historicalAnchors(input) {
+  if (!/^[a-f0-9]{40,64}$/.test(input.unit.sha)) return void 0;
+  const ignore2 = loadRepoIgnore(input.root, input.ignorePatterns);
+  const providers = input.providers ?? defaultProviders();
+  const beforeTokens = /* @__PURE__ */ new Map();
+  for (const line of input.bundle.diff.split("\n")) {
+    const m = /^diff --git a\/(p\d+) b\/(p\d+)$/.exec(line);
+    if (m) beforeTokens.set(m[2], m[1]);
+  }
+  const parsed = /* @__PURE__ */ new Map();
+  const parse4 = (commit, token) => {
+    const path2 = input.bundle.pathTokens[token];
+    if (!path2 || /[\r\n]/.test(path2) || !pathAllowedByFloor(path2) || isPathBlocked(ignore2, path2)) return Promise.resolve(null);
+    const provider = providers.find((p) => p.fileExtensions.includes(extname4(path2).toLowerCase()));
+    if (!provider) return Promise.resolve(null);
+    const spec = `${commit}:${path2}`;
+    if (!parsed.has(spec)) parsed.set(spec, (async () => {
+      try {
+        const source = await input.readBlob(spec);
+        if (source === null || source.includes("\0") || Buffer.byteLength(source) > MAX_SOURCE_BYTES) return null;
+        await provider.preload?.();
+        const symbols = provider.extractSymbols(source, path2).filter((s) => LABELS[s.kind] && s.startByte >= 0 && s.endByte > s.startByte);
+        const offsets = [0];
+        for (let i2 = 0; i2 < source.length; i2++) if (source[i2] === "\n") offsets.push(i2 + 1);
+        offsets.push(source.length + 1);
+        return { symbols, offsets };
+      } catch {
+        return null;
+      }
+    })());
+    return parsed.get(spec);
+  };
+  const out2 = {};
+  const blocks = historySourceBlocks({ narrative: "", diff: input.bundle.diff, commitSha: input.unit.sha });
+  for (const block of blocks) {
+    if (block.kind !== "diff" || !block.pathToken) continue;
+    const lines = block.text.split("\n");
+    const header = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(lines[0]);
+    if (!header) continue;
+    let before = Number(header[1]), after = Number(header[2]);
+    let offset = Buffer.byteLength(lines[0]) + 1;
+    const list = out2[block.pathToken] ?? [];
+    for (const line of lines.slice(1)) {
+      const end = offset + Buffer.byteLength(line);
+      const side = line[0] === "+" ? "after" : line[0] === "-" ? "before" : null;
+      if (side) {
+        const commit = side === "after" ? input.unit.sha : input.unit.parents[0];
+        const token = side === "after" ? block.pathToken : beforeTokens.get(block.pathToken);
+        if (commit && /^[a-f0-9]{40,64}$/.test(commit) && token) {
+          const file2 = await parse4(commit, token);
+          const row = (side === "after" ? after : before) - 1;
+          const start2 = file2?.offsets[row], stop2 = file2?.offsets[row + 1];
+          if (file2 && start2 !== void 0 && stop2 !== void 0) {
+            const symbols = file2.symbols.filter((s) => s.startByte < stop2 && s.endByte > start2).sort((a, b) => a.endByte - a.startByte - (b.endByte - b.startByte));
+            const symbol2 = symbols[0];
+            if (symbol2) {
+              const kind = LABELS[symbol2.kind];
+              const symbolId = projectSymbolId(input.salt, input.projectId, input.bundle.pathTokens[token], symbol2.qname ?? symbol2.name, kind);
+              const prev = list.at(-1);
+              if (prev?.symbolId === symbolId && prev.historical?.side === side && prev.historical.blockDigest === block.digest && prev.historical.endByte + 1 === offset) {
+                prev.historical.endByte = end;
+              } else if (list.length < MAX_ANCHORS) list.push({
+                symbolId,
+                kind,
+                historical: {
+                  sourceCommitSha: input.unit.sha,
+                  commitSha: commit,
+                  side,
+                  blockDigest: block.digest,
+                  startByte: offset,
+                  endByte: end,
+                  ...symbol2.bodyHash ? { bodyHash: symbol2.bodyHash } : {}
+                }
+              });
+            }
+          }
+        }
+      }
+      if (line[0] === " " || line[0] === "-") before++;
+      if (line[0] === " " || line[0] === "+") after++;
+      offset = end + 1;
+    }
+    if (list.length) out2[block.pathToken] = list;
+  }
+  return Object.keys(out2).length ? out2 : void 0;
+}
+
 // src/project-history.ts
 init_profile2();
-var execFileAsync2 = promisify2(execFile4);
+var execFileAsync2 = promisify3(execFile5);
 var HISTORY_EXTRACTOR_VERSION = "history-2";
 var LEASE_POLL_MS = 2e4;
 var RECOVERY_DEADLINE_MS = 15 * 6e4;
-var MAX_ANCHORS_PER_TOKEN = 20;
 var DEFAULT_LOOKAHEAD = 2;
 async function defaultGit(root, args2) {
   const { stdout } = await execFileAsync2("git", ["-C", root, ...args2], { maxBuffer: 64 * 1024 * 1024, windowsHide: true });
@@ -85099,27 +85886,6 @@ async function spineForUnit(git3, root, unit, readBlob) {
   const wire = (d) => ({ ecosystem: d.ecosystem, name: d.name, version: d.version, kind: d.kind, manifest: d.manifest });
   return { declared: rings.declared.map(wire), context: rings.context.map(wire) };
 }
-function anchorsFor(pathTokens, ignoreLines, projectId, anchors) {
-  if (!anchors) return void 0;
-  const out2 = {};
-  const ignored = (p) => ignoreLines.some((rule) => p === rule || p.startsWith(rule.replace(/\/+$/, "") + "/"));
-  for (const [token, relPath] of Object.entries(pathTokens)) {
-    if (ignored(relPath)) continue;
-    const nodes = anchors.index.nodesByRelPath([relPath]);
-    const list = [];
-    for (const n of nodes) {
-      const qname = n.attrs["qname"];
-      if (typeof qname !== "string") continue;
-      list.push({
-        symbolId: projectSymbolId(anchors.salt, projectId, relPath, qname, n.label),
-        kind: n.label
-      });
-      if (list.length >= MAX_ANCHORS_PER_TOKEN) break;
-    }
-    if (list.length > 0) out2[token] = list;
-  }
-  return Object.keys(out2).length > 0 ? out2 : void 0;
-}
 function stage(profile, patch, now) {
   const at = now().toISOString();
   const prev = profile.historyStage;
@@ -85137,6 +85903,7 @@ function stage(profile, patch, now) {
       // keep showing the error it recovered from); an absent key keeps it.
       ..."lastError" in patch ? patch.lastError ? { lastError: patch.lastError } : {} : prev?.lastError ? { lastError: prev.lastError } : {},
       ...patch.counts ? { counts: patch.counts } : prev?.counts ? { counts: prev.counts } : {},
+      ...patch.coverageGaps ? { coverageGaps: patch.coverageGaps } : prev?.coverageGaps ? { coverageGaps: prev.coverageGaps } : {},
       ...patch.backfillAnchor ? { backfillAnchor: patch.backfillAnchor } : prev?.backfillAnchor ? { backfillAnchor: prev.backfillAnchor } : {}
     }
   };
@@ -85156,7 +85923,7 @@ function unitTiming(postStarted, prepMs, receipt) {
 }
 function addCounts(a, b) {
   const sum = (k) => (a[k] ?? 0) + (b[k] ?? 0);
-  return { commitsWalked: sum("commitsWalked"), changesExtracted: sum("changesExtracted"), pairs: sum("pairs"), claims: sum("claims"), anchors: sum("anchors"), packages: sum("packages") };
+  return { commitsWalked: sum("commitsWalked"), changesExtracted: sum("changesExtracted"), pairs: sum("pairs"), claims: sum("claims"), anchors: sum("anchors"), packages: sum("packages"), deferredUnits: sum("deferredUnits") };
 }
 async function runHistoryWalk(root, input, client, opts = {}) {
   const reader = opts.git ? null : new GitBlobReader(root);
@@ -85198,7 +85965,12 @@ async function walk10(root, input, client, opts, readBlob) {
     return { profile, processed: 0, state: "refused" };
   }
   if (units.length === 0) {
-    profile = stage(profile, { state: "done", watermarkSha: headSha }, now);
+    const deferred = profile.historyStage?.counts?.deferredUnits ?? 0;
+    profile = stage(profile, {
+      state: "done",
+      watermarkSha: headSha,
+      ...deferred > 0 ? { lastError: `${deferred} history units deferred; coverage gaps require source review and re-extraction.` } : {}
+    }, now);
     persist(profile);
     await reportHistoryStage(client, profile, log);
     return { profile, processed: 0, state: "done" };
@@ -85227,7 +85999,8 @@ async function walk10(root, input, client, opts, readBlob) {
       const group = byIndex.get(u.index) ?? [u];
       const bundle = await buildUnitBundle(root, u, {
         ignorePatterns: ignoreLines,
-        narrative: narrative(u, u.isMerge ? group : void 0)
+        narrative: narrative(u, u.isMerge ? group : void 0),
+        narrativeSources: narrativeSources(u, u.isMerge ? group : void 0)
       });
       const prev = dryRun ? void 0 : predecessor(k);
       const body2 = {
@@ -85240,6 +86013,7 @@ async function walk10(root, input, client, opts, readBlob) {
           ...u.authorDate ? { authorDate: u.authorDate } : {}
         },
         narrative: bundle.narrative,
+        ...bundle.narrativeSources?.length ? { narrativeSources: bundle.narrativeSources } : {},
         fileList: bundle.fileList,
         diff: bundle.diff,
         pathTokens: Object.keys(bundle.pathTokens),
@@ -85251,7 +86025,15 @@ async function walk10(root, input, client, opts, readBlob) {
       };
       const spine = await spineForUnit(git3, root, u, readBlob);
       if (spine) body2.spine = spine;
-      const anchors = anchorsFor(bundle.pathTokens, ignoreLines, projectId, opts.anchors);
+      const anchors = opts.anchors ? await historicalAnchors({
+        root,
+        projectId,
+        salt: opts.anchors.salt,
+        unit: u,
+        bundle,
+        ignorePatterns: ignoreLines,
+        readBlob
+      }) : void 0;
       if (anchors) body2.anchors = anchors;
       return { body: body2, prepMs: Date.now() - prepStarted };
     })();
@@ -85384,6 +86166,15 @@ async function walk10(root, input, client, opts, readBlob) {
         return { profile, processed, state: "refused" };
       case "rejected":
       case "error":
+        if (outcome.status === "error" && outcome.parked && outcome.runId && ["deferred-context", "deferred-budget"].includes(outcome.errorCode ?? "")) {
+          const gaps = [...profile.historyStage?.coverageGaps ?? []];
+          const known = gaps.some((g) => g.runId === outcome.runId);
+          counts = addCounts(counts, { commitsWalked: 1, deferredUnits: known ? 0 : 1 });
+          if (!known) gaps.push({ sha: u.sha, subIndex: u.subIndex, runId: outcome.runId, reason: outcome.errorCode });
+          profile = stage(profile, { coverageGaps: gaps.slice(-1e3) }, now);
+          log(`[errata] history ${label}: deferred (${outcome.errorCode}); coverage gap retained as ${outcome.runId}`);
+          break;
+        }
         profile = stage(profile, { state: "paused", lastError: `unit ${label} ${outcome.status}: ${outcome.error.slice(0, 200)}` }, now);
         persist(profile);
         await reportHistoryStage(client, profile, log);
@@ -85394,7 +86185,11 @@ async function walk10(root, input, client, opts, readBlob) {
     processed += 1;
   }
   const reachedHead = (profile.historyStage?.unitsDone ?? 0) >= total;
-  profile = stage(profile, reachedHead ? { state: "done", watermarkSha: headSha } : { state: dryRun ? "extracting" : "contributing" }, now);
+  profile = stage(profile, reachedHead ? {
+    state: "done",
+    watermarkSha: headSha,
+    ...(counts.deferredUnits ?? 0) > 0 ? { lastError: `${counts.deferredUnits} history units deferred; coverage gaps require source review and re-extraction.` } : {}
+  } : { state: dryRun ? "extracting" : "contributing" }, now);
   persist(profile);
   await reportHistoryStage(client, profile, log);
   return { profile, processed, state: profile.historyStage?.state ?? "done" };
@@ -85477,7 +86272,7 @@ async function startHistoryStage(root, input, client, walk11 = {}) {
 
 // src/link-flow.ts
 init_cloud_auth();
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync30, writeFileSync as writeFileSync23 } from "node:fs";
 import { join as join38 } from "node:path";
@@ -85771,7 +86566,7 @@ async function loginOAuthLoopback(opts) {
 
 // src/link-flow.ts
 function remoteFingerprint(locator) {
-  return createHash17("sha256").update(locator).digest("hex");
+  return createHash19("sha256").update(locator).digest("hex");
 }
 function isDecision(value) {
   if (!value || typeof value !== "object") return false;
@@ -87057,13 +87852,24 @@ async function startMultiDaemon(opts = {}) {
   });
   const pullProjectAnchors = async (r, client, salt) => {
     const donePass = markPass(`anchor-pull:${r.engine.profile.name}`);
+    const beforeCorrections = r.engine.profile.projectHistoryCorrectionCursor ?? 0;
     const sync = await syncProjectAnchors({
       root: r.root,
       profile: r.engine.profile,
       store: r.engine.store,
+      correctionMirrors: [sharedStore],
       cloud: client,
       salt
     }).finally(donePass);
+    if ((r.engine.profile.projectHistoryCorrectionCursor ?? 0) > beforeCorrections) {
+      for (const record2 of records) record2.engine.markContextDirty();
+    }
+    try {
+      const revision = await syncHistoryRevision({ root: r.root, profile: r.engine.profile, store: r.engine.store, cloud: client, salt });
+      if (revision.changed) r.engine.markContextDirty();
+    } catch (err2) {
+      console.warn(`[errata] history revision reconciliation failed for ${r.engine.profile.name}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    }
     if (sync.synced) {
       if (sync.anchors + sync.updated > 0) {
         r.engine.markContextDirty();