@inerrata-corporation/errata 2.0.17-dev.3504 → 2.0.17-dev.3527

package/errata.mjs

@@ -1153,9 +1153,9 @@ function parsePackageRef(ref) {
   }
   const at = rest2.lastIndexOf("@");
   const name2 = at > 0 ? rest2.slice(0, at) : rest2;
-  const version2 = at > 0 ? rest2.slice(at + 1) || null : null;
-  const slug2 = (version2 ? `${name2}@${version2}` : name2).toLowerCase();
-  return { name: name2, version: version2, slug: slug2 };
+  const version3 = at > 0 ? rest2.slice(at + 1) || null : null;
+  const slug2 = (version3 ? `${name2}@${version3}` : name2).toLowerCase();
+  return { name: name2, version: version3, slug: slug2 };
 }
 var DESIGN_PROBLEM_PREFIX, DESIGN_PROBLEM_ID_LENGTH, DIAGNOSTIC_PROBLEM_PREFIX, DIAGNOSTIC_HASH_LENGTH, TRIAGE_PREFIX, TRIAGE_ID_LENGTH, SAFE_TOOL_NAME, OS_NAME;
 var init_identity = __esm({
@@ -2285,10 +2285,10 @@ var init_regexes = __esm({
     duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
     extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
     guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-    uuid = (version2) => {
-      if (!version2)
+    uuid = (version3) => {
+      if (!version3)
         return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-      return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+      return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
     };
     uuid4 = /* @__PURE__ */ uuid(4);
     uuid6 = /* @__PURE__ */ uuid(6);
@@ -15097,10 +15097,10 @@ function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
     return schema ? z.any() : z.never();
   }
-  const version2 = detectVersion(schema, params?.defaultTarget);
+  const version3 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
   const ctx = {
-    version: version2,
+    version: version3,
     defs,
     refs: /* @__PURE__ */ new Map(),
     processing: /* @__PURE__ */ new Set(),
@@ -15829,6 +15829,169 @@ var init_history_evidence = __esm({
   }
 });
 
+// ../../packages/shared/src/history-dependencies.ts
+function mentions(text, name2) {
+  const escaped = name2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(^|[^a-z0-9_@/.-])${escaped}($|[^a-z0-9_/-])`, "i").test(text);
+}
+function namedHistoryDependency(text, name2) {
+  if (name2.length < 3) return mentions(text, `\`${name2}\``);
+  if (["node", "graph", "types", "test", "core", "privacy", "next"].includes(name2.toLowerCase())) {
+    return mentions(text, `\`${name2}\``) || name2 === "node" && /\bnode\.js\b/i.test(text) || name2 === "next" && /\bnext\.js\b/i.test(text);
+  }
+  return mentions(text, name2);
+}
+function selectHistoryDependencies(context, input) {
+  if (!context) return void 0;
+  const paths = new Set(input.evidence.flatMap((e) => e.pathToken ? [e.pathToken] : []));
+  const sides = new Set(input.evidence.map((e) => e.side));
+  const both = sides.has("mixed") || sides.has("narrative") || sides.has("context") || sides.size === 0;
+  const dependencies = context.dependencies.filter((d) => (both || sides.has(d.side)) && (paths.size === 0 || d.pathTokens.some((p) => paths.has(p)))).map((d) => ({ ...d, binding: namedHistoryDependency(input.text, d.name) ? "named" : d.importTokens.some((p) => paths.has(p)) ? "import" : "environment" }));
+  const statedVersions = [];
+  for (const d of dependencies) {
+    if (d.binding === "environment") continue;
+    const escaped = d.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const match2 = new RegExp(`(?:^|[^a-z0-9_@/.-])${escaped}\\s+(?:v(?:ersion)?\\s*)?(\\d+(?:\\.\\d+){0,2})(?!\\d)`, "i").exec(input.text);
+    if (match2 && !statedVersions.some((v) => v.packageId === d.packageId && v.version === match2[1])) statedVersions.push({ packageId: d.packageId, version: match2[1] });
+  }
+  const conflict = statedVersions.some((v) => !dependencies.some((d) => d.packageId === v.packageId && (d.resolvedVersion ?? d.declaredRange)?.replace(/^[~^=v\s]+/, "").split(".").slice(0, v.version.split(".").length).join(".") === v.version));
+  return { schemaVersion: "history-deps-1", complete: context.complete, dependencies, statedVersions, conflict };
+}
+function historyDependencyIdentity(raw2) {
+  const parsed = HistoryDependencyContextSchema.safeParse(raw2);
+  if (!parsed.success || !parsed.data.complete || parsed.data.conflict) return null;
+  if (parsed.data.dependencies.some((d) => !exactHistoryDependencyVersion(d))) return null;
+  return digest(parsed.data.dependencies.map((d) => [d.packageId, d.manifestId, d.side, d.declaredRange, d.resolvedVersion]).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b))));
+}
+function exactHistoryDependencyVersion(d) {
+  return d.resolvedVersion ?? (/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(d.declaredRange ?? "") ? d.declaredRange : null);
+}
+function preservedHistoryDependencies(old, current, atCommit) {
+  const a = HistoryDependencyContextSchema.safeParse(old), b = HistoryDependencyContextSchema.safeParse(current);
+  if (!a.success || !a.data.complete || a.data.conflict || !b.success || !b.data.complete || b.data.conflict) return false;
+  const exact = exactHistoryDependencyVersion;
+  return a.data.dependencies.every((d) => {
+    if (d.side !== "after" || !exact(d)) return false;
+    const matches = b.data.dependencies.filter((n) => n.side === "after" && n.packageId === d.packageId && n.manifestId === d.manifestId);
+    return matches.length === 1 && (!atCommit || matches[0].sourceCommit === atCommit) && exact(matches[0]) === exact(d);
+  });
+}
+function historyDependencyVersions(context) {
+  const versions = /* @__PURE__ */ new Map();
+  for (const d of context?.dependencies ?? []) {
+    if (d.binding === "environment") continue;
+    const set2 = versions.get(d.packageId) ?? /* @__PURE__ */ new Set();
+    versions.set(d.packageId, set2);
+    set2.add(d.resolvedVersion ?? d.declaredRange ?? "");
+  }
+  const result = Object.fromEntries([...versions].filter(([, v]) => v.size === 1 && !v.has("")).map(([k, v]) => [k, [...v][0]]));
+  return Object.keys(result).length ? result : null;
+}
+function pnpmEntry(locks, path2, importer, name2) {
+  let files = pnpmIndexes.get(locks);
+  if (!files) {
+    files = /* @__PURE__ */ new Map();
+    pnpmIndexes.set(locks, files);
+  }
+  let index = files.get(path2);
+  if (!index) {
+    index = /* @__PURE__ */ new Map();
+    files.set(path2, index);
+    let inImporters = false, workspace = "", dep = "", spec = null;
+    for (const line of locks[path2].split(/\r?\n/)) {
+      if (/^\S/.test(line)) {
+        inImporters = line === "importers:";
+        continue;
+      }
+      if (!inImporters) continue;
+      const item2 = /^  (\S.*):\s*$/.exec(line);
+      if (item2) {
+        workspace = item2[1].replace(/^['"]|['"]$/g, "");
+        dep = "";
+        continue;
+      }
+      const entry = /^      (\S.*):\s*$/.exec(line);
+      if (entry) {
+        dep = entry[1].replace(/^['"]|['"]$/g, "");
+        spec = null;
+        continue;
+      }
+      const declared = /^        specifier: (.+)$/.exec(line);
+      if (declared) spec = declared[1].replace(/^['"]|['"]$/g, "");
+      const resolved = /^        version: (.+)$/.exec(line);
+      if (resolved) index.set(JSON.stringify([workspace, dep]), { spec, version: resolved[1].replace(/^['"]|['"]$/g, "") });
+    }
+  }
+  return index.get(JSON.stringify([importer, name2]));
+}
+function resolveHistoricalNpmVersion(name2, manifest, declared, locks) {
+  const dir = manifest.includes("/") ? manifest.slice(0, manifest.lastIndexOf("/")) : ".";
+  const exact = (v) => typeof v === "string" ? /^(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\(|$)/.exec(v)?.[1] ?? null : null;
+  const lockPaths = Object.keys(locks).filter((p) => {
+    const root = p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : ".";
+    return root === "." || dir === root || dir.startsWith(root + "/");
+  }).sort((a, b) => b.split("/").length - a.split("/").length);
+  for (const path2 of lockPaths) {
+    const root = path2.includes("/") ? path2.slice(0, path2.lastIndexOf("/")) : ".";
+    const importer = root === "." ? dir : dir === root ? "." : dir.slice(root.length + 1);
+    if (path2.endsWith("pnpm-lock.yaml")) {
+      const entry = pnpmEntry(locks, path2, importer, name2);
+      if (entry?.spec === declared) return exact(entry.version);
+    } else if (path2.endsWith("package-lock.json")) {
+      try {
+        const json2 = JSON.parse(locks[path2]);
+        const key = importer === "." ? "" : importer, owner = json2.packages?.[key];
+        if (!owner || ![owner.dependencies?.[name2], owner.devDependencies?.[name2], owner.optionalDependencies?.[name2]].includes(declared ?? void 0)) continue;
+        let parent = key;
+        for (; ; ) {
+          const installed = json2.packages?.[`${parent ? parent + "/" : ""}node_modules/${name2}`];
+          if (installed) return exact(installed.version);
+          if (!parent) break;
+          parent = parent.includes("/") ? parent.slice(0, parent.lastIndexOf("/")) : "";
+        }
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+var version2, HistoryDependencySchema, HistoryDependencyContextSchema, HISTORY_RECONCILE_BUILD, historyManifestId, pnpmIndexes, historyDependencyPackageId;
+var init_history_dependencies = __esm({
+  "../../packages/shared/src/history-dependencies.ts"() {
+    "use strict";
+    init_zod();
+    init_hash();
+    init_identity();
+    version2 = external_exports.string().max(160).nullable();
+    HistoryDependencySchema = external_exports.object({
+      packageId: external_exports.string().startsWith("pkg:").max(300),
+      ecosystem: external_exports.string().min(1).max(20),
+      name: external_exports.string().min(1).max(200),
+      kind: external_exports.enum(["package", "sdk", "engine", "runtime", "image"]),
+      manifestId: external_exports.string().regex(/^hmanifest_[a-f0-9]{32}$/),
+      sourceCommit: external_exports.string().regex(/^[a-f0-9]{7,64}$/),
+      side: external_exports.enum(["before", "after"]),
+      /** Environment-only entries constrain applicability but never mint a package edge. */
+      binding: external_exports.enum(["named", "import", "environment"]).optional(),
+      declaredRange: version2,
+      resolvedVersion: version2,
+      pathTokens: external_exports.array(external_exports.string().regex(/^p\d+$/)).max(500),
+      importTokens: external_exports.array(external_exports.string().regex(/^p\d+$/)).max(500)
+    }).refine((d) => d.packageId === packageCanonicalId({ ecosystem: d.ecosystem, name: d.name }), "package identity must match its evidence");
+    HistoryDependencyContextSchema = external_exports.object({
+      schemaVersion: external_exports.literal("history-deps-1"),
+      complete: external_exports.boolean(),
+      dependencies: external_exports.array(HistoryDependencySchema).max(256),
+      statedVersions: external_exports.array(external_exports.object({ packageId: external_exports.string().max(300), version: external_exports.string().max(80) })).max(64).optional(),
+      conflict: external_exports.boolean().optional()
+    });
+    HISTORY_RECONCILE_BUILD = "history-reconcile-2";
+    historyManifestId = (path2) => `hmanifest_${digest(path2.replace(/\\/g, "/")).slice(0, 32)}`;
+    pnpmIndexes = /* @__PURE__ */ new WeakMap();
+    historyDependencyPackageId = (ecosystem, name2) => packageCanonicalId({ ecosystem, name: name2 });
+  }
+});
+
 // ../../packages/shared/src/edge-rules.ts
 function isValidEdge(from, type, to) {
   const rule = EDGE_RULES[type];
@@ -16148,6 +16311,7 @@ var init_wire = __esm({
     "use strict";
     init_zod();
     init_history_evidence();
+    init_history_dependencies();
     init_castalia();
     init_edge_rules();
     init_symbol_intent();
@@ -16276,6 +16440,7 @@ var init_wire = __esm({
         extractedBy: external_exports.enum(INGEST_EXTRACTION_SOURCES).optional(),
         sourceSupport: external_exports.literal("supported").optional(),
         historicalAnchors: external_exports.array(HistoryAnchorSourceSchema).max(160).optional(),
+        dependencyEvidence: external_exports.array(HistoryDependencySchema).max(256).optional(),
         evidence: external_exports.array(HistoryEvidenceRefSchema).max(12).optional(),
         verificationEvidence: external_exports.array(HistoryEvidenceRefSchema).max(12).optional(),
         verifierBuild: external_exports.string().max(80).optional(),
@@ -16410,16 +16575,16 @@ var init_project_symbol = __esm({
 // ../../packages/shared/src/lockfile.ts
 function rankDirect(raw2, ecosystem = "npm") {
   const byName = /* @__PURE__ */ new Map();
-  for (const { name: name2, version: version2 } of raw2) {
+  for (const { name: name2, version: version3 } of raw2) {
     const prev = byName.get(name2);
     if (prev) {
       prev.importers++;
       continue;
     }
     byName.set(name2, {
-      purl: `pkg:${ecosystem}/${name2}@${version2}`,
+      purl: `pkg:${ecosystem}/${name2}@${version3}`,
       name: name2,
-      version: version2,
+      version: version3,
       ecosystem,
       importers: 1
     });
@@ -16428,11 +16593,11 @@ function rankDirect(raw2, ecosystem = "npm") {
     (a, b) => b.importers - a.importers || a.name.localeCompare(b.name)
   );
 }
-function npmPurl(name2, version2) {
-  return `pkg:npm/${name2}@${version2}`;
+function npmPurl(name2, version3) {
+  return `pkg:npm/${name2}@${version3}`;
 }
-function component(name2, version2) {
-  return { purl: npmPurl(name2, version2), name: name2, version: version2, ecosystem: "npm" };
+function component(name2, version3) {
+  return { purl: npmPurl(name2, version3), name: name2, version: version3, ecosystem: "npm" };
 }
 function isNpmImporterPath(path2) {
   return path2 === "" || !path2.includes("node_modules/");
@@ -16453,13 +16618,13 @@ function parsePackageLockJson(jsonText) {
     const ix = path2.lastIndexOf("node_modules/");
     if (ix === -1) continue;
     const name2 = path2.slice(ix + "node_modules/".length);
-    const version2 = typeof meta3.version === "string" ? meta3.version : "";
-    if (!name2 || !version2) continue;
-    components.push(component(name2, version2));
-    byPath.set(path2, { name: name2, version: version2 });
+    const version3 = typeof meta3.version === "string" ? meta3.version : "";
+    if (!name2 || !version3) continue;
+    components.push(component(name2, version3));
+    byPath.set(path2, { name: name2, version: version3 });
     const depth = path2.split("node_modules/").length;
     const prev = hoisted.get(name2);
-    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version2, depth });
+    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version3, depth });
   }
   const dependencies = [];
   for (const [path2, meta3] of Object.entries(packages)) {
@@ -16502,9 +16667,9 @@ function splitPnpmKey(raw2) {
   const at = k.lastIndexOf("@");
   if (at <= 0) return null;
   const name2 = k.slice(0, at);
-  const version2 = k.slice(at + 1);
-  if (!name2 || !version2) return null;
-  return { name: name2, version: version2 };
+  const version3 = k.slice(at + 1);
+  if (!name2 || !version3) return null;
+  return { name: name2, version: version3 };
 }
 function parsePnpmImporters(lines) {
   const DEP_SECTIONS = /* @__PURE__ */ new Set(["dependencies:", "devDependencies:", "optionalDependencies:"]);
@@ -16540,14 +16705,14 @@ function parsePnpmImporters(lines) {
     if (indent === 8 && depName) {
       const t = line.trim();
       if (!t.startsWith("version:")) continue;
-      let version2 = t.slice("version:".length).trim().replace(/^['"]|['"]$/g, "");
-      const paren = version2.indexOf("(");
-      if (paren !== -1) version2 = version2.slice(0, paren);
-      if (!version2 || version2.startsWith("link:") || version2.startsWith("file:") || version2.includes("://")) {
+      let version3 = t.slice("version:".length).trim().replace(/^['"]|['"]$/g, "");
+      const paren = version3.indexOf("(");
+      if (paren !== -1) version3 = version3.slice(0, paren);
+      if (!version3 || version3.startsWith("link:") || version3.startsWith("file:") || version3.includes("://")) {
         depName = null;
         continue;
       }
-      raw2.push({ name: depName, version: version2 });
+      raw2.push({ name: depName, version: version3 });
       depName = null;
     }
   }
@@ -16663,19 +16828,19 @@ function parseGemfileLock(text) {
     const spec = specLine.exec(line);
     if (spec) {
       const name2 = spec[1];
-      const version2 = (spec[2] ?? "").trim();
+      const version3 = (spec[2] ?? "").trim();
       if (section === "path-or-git") {
         nonRegistry.add(name2);
         currentGem = null;
         continue;
       }
-      if (!version2) continue;
-      currentGem = { name: name2, version: version2 };
-      registryVersions.set(name2, version2);
-      const purl = `pkg:gem/${name2}@${version2}`;
+      if (!version3) continue;
+      currentGem = { name: name2, version: version3 };
+      registryVersions.set(name2, version3);
+      const purl = `pkg:gem/${name2}@${version3}`;
       if (!seen.has(purl)) {
         seen.add(purl);
-        components.push({ purl, name: name2, version: version2, ecosystem: "gem" });
+        components.push({ purl, name: name2, version: version3, ecosystem: "gem" });
       }
       continue;
     }
@@ -16755,8 +16920,8 @@ function parseGodot(path2, text) {
   const m = /config\/features=PackedStringArray\(([^)]*)\)/.exec(text);
   if (!m) return [];
   const feats = (m[1] ?? "").split(",").map((f) => f.trim().replace(/^"|"$/g, "")).filter((f) => f.length > 0);
-  const version2 = feats.find((f) => /^\d+\.\d+/.test(f)) ?? null;
-  return [{ ecosystem: "godot", name: "godot", version: version2, kind: "engine", manifest: path2 }];
+  const version3 = feats.find((f) => /^\d+\.\d+/.test(f)) ?? null;
+  return [{ ecosystem: "godot", name: "godot", version: version3, kind: "engine", manifest: path2 }];
 }
 function parsePackageJson(path2, text) {
   let obj;
@@ -16771,8 +16936,8 @@ function parsePackageJson(path2, text) {
     const section = obj[key];
     if (!section || typeof section !== "object") continue;
     for (const [name2, ver] of Object.entries(section)) {
-      const version2 = ver ? String(ver) : null;
-      deps.push({ ecosystem: "npm", name: name2, version: version2, kind: "package", manifest: path2 });
+      const version3 = ver ? String(ver) : null;
+      deps.push({ ecosystem: "npm", name: name2, version: version3, kind: "package", manifest: path2 });
     }
   }
   return deps;
@@ -16877,12 +17042,12 @@ function parseGradle(path2, text) {
   const re = new RegExp(`\\b(?:${GRADLE_CONFIGS})\\s*(?:\\(\\s*)?["']([^"']+)["']`, "g");
   for (const m of text.matchAll(re)) {
     const parts2 = (m[1] ?? "").split(":");
-    const [group, artifact, version2] = parts2;
+    const [group, artifact, version3] = parts2;
     if (!group || !artifact || parts2.length < 2) continue;
     deps.push({
       ecosystem: "maven",
       name: mavenName(group, artifact),
-      version: version2?.trim() || null,
+      version: version3?.trim() || null,
       kind: "package",
       manifest: path2
     });
@@ -16896,18 +17061,18 @@ function parseVersionCatalog(path2, text) {
   for (const line of (section[1] ?? "").split(/\r?\n/)) {
     if (!line.trim() || line.trimStart().startsWith("#")) continue;
     const module2 = /module\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
-    const version2 = /version(?:\.ref)?\s*=\s*["']([^"']+)["']/.exec(line)?.[1] ?? null;
+    const version3 = /version(?:\.ref)?\s*=\s*["']([^"']+)["']/.exec(line)?.[1] ?? null;
     if (module2) {
       const [group2, artifact2] = module2.split(":");
       if (group2 && artifact2) {
-        deps.push({ ecosystem: "maven", name: mavenName(group2, artifact2), version: version2, kind: "package", manifest: path2 });
+        deps.push({ ecosystem: "maven", name: mavenName(group2, artifact2), version: version3, kind: "package", manifest: path2 });
       }
       continue;
     }
     const group = /\bgroup\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
     const artifact = /\bname\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
     if (group && artifact) {
-      deps.push({ ecosystem: "maven", name: mavenName(group, artifact), version: version2, kind: "package", manifest: path2 });
+      deps.push({ ecosystem: "maven", name: mavenName(group, artifact), version: version3, kind: "package", manifest: path2 });
     }
   }
   return deps;
@@ -17134,7 +17299,9 @@ function historyReadPolicy(node2, options = {}) {
   const q = raw2 && typeof raw2 === "object" ? raw2 : {};
   const source = q["sourceSupport"] ?? "unreviewed";
   const applicability = q["applicability"] ?? "unknown";
-  const current = options.atCommit !== void 0 && q["evaluatedAtCommit"] === options.atCommit;
+  const proof = q["reconciliationEvidence"];
+  const environmentKnown = historyDependencyIdentity(q["dependencyContext"]) !== null && proof?.["build"] === HISTORY_RECONCILE_BUILD;
+  const current = options.atCommit !== void 0 && q["evaluatedAtCommit"] === options.atCommit && environmentKnown;
   const invalid = source === "contradicted" || source === "quarantined";
   const passive = options.mode === "passive";
   const validation = node2.validationSource ?? attrs["validationSource"];
@@ -17144,12 +17311,13 @@ function historyReadPolicy(node2, options = {}) {
   return {
     allow,
     history: true,
-    notice: `History-derived${at}; source ${String(source)}; applicability ${current ? String(applicability) : "unknown at this checkout"}; ${independentlyValidated ? "separate validation recorded" : "not independently validated"}.`
+    notice: `History-derived${at}; source ${String(source)}; applicability ${current ? String(applicability) : "unknown at this checkout"}; ${environmentKnown ? "dependency context checked" : "dependency applicability unverified"}; ${independentlyValidated ? "separate validation recorded" : "not independently validated"}.`
   };
 }
 var init_history_read = __esm({
   "../../packages/shared/src/history-read.ts"() {
     "use strict";
+    init_history_dependencies();
   }
 });
 
@@ -17234,11 +17402,14 @@ function historySemanticKey(projectId, o) {
   const q = o.quality;
   const anchors = q["historicalAnchors"];
   if (q["sourceSupport"] !== "supported" || !anchors?.length || anchors.some((a) => !a.symbolId)) return null;
-  return digest([projectId, o.label, o.statement, q["claimKind"] ?? null, q["qualifier"], q["conditions"], q["rationale"], [...new Set(anchors.map((a) => a.symbolId))].sort()]);
+  const dependencies = historyDependencyIdentity(q["dependencyContext"]);
+  if (!dependencies) return null;
+  return digest([projectId, o.label, o.statement, q["claimKind"] ?? null, q["qualifier"], q["conditions"], q["rationale"], dependencies, [...new Set(anchors.map((a) => a.symbolId))].sort()]);
 }
 function preservedHistoryOccurrence(o, observed, atCommit, ancestor) {
   const q = o.quality, source = occurrenceSourceCommit(o);
   if (!source || ancestor(source, atCommit) !== true || q["sourceSupport"] !== "supported" || !observed) return false;
+  if (!preservedHistoryDependencies(q["dependencyContext"], observed.dependencyContext, atCommit)) return false;
   const parsed = external_exports.array(HistoryEvidenceRefSchema).safeParse(q["evidence"]);
   if (!parsed.success || !parsed.data.length || parsed.data.some((e) => e.sourceKind !== "diff" || !["after", "context"].includes(e.side))) return false;
   const anchors = q["historicalAnchors"];
@@ -17252,6 +17423,7 @@ var init_history_revision = __esm({
     init_zod();
     init_hash();
     init_history_evidence();
+    init_history_dependencies();
     Sha = external_exports.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/);
     HistoryRevisionRequestSchema = external_exports.strictObject({
       atCommit: Sha,
@@ -17260,7 +17432,8 @@ var init_history_revision = __esm({
         occurrenceId: external_exports.string().min(1).max(100),
         symbols: external_exports.array(external_exports.strictObject({ symbolId: external_exports.string().regex(/^sym_[a-f0-9]{8,64}$/), bodyHash: external_exports.string().regex(/^[a-f0-9]{8,64}$/) })).max(32),
         /** Scrubbed, tokenized net change from this occurrence's source to atCommit. */
-        diff: external_exports.string().max(16e3).optional()
+        diff: external_exports.string().max(16e3).optional(),
+        dependencyContext: HistoryDependencyContextSchema.optional()
       })).max(50)
     });
   }
@@ -17350,10 +17523,13 @@ __export(src_exports, {
   HISTORY_EVIDENCE_SCHEMA_VERSION: () => HISTORY_EVIDENCE_SCHEMA_VERSION,
   HISTORY_MAX_SPINE_DEPS: () => HISTORY_MAX_SPINE_DEPS,
   HISTORY_MAX_TEXT_CHARS: () => HISTORY_MAX_TEXT_CHARS,
+  HISTORY_RECONCILE_BUILD: () => HISTORY_RECONCILE_BUILD,
   HISTORY_SCRUBBER_VERSION: () => HISTORY_SCRUBBER_VERSION,
   HistoryAnchorSourceSchema: () => HistoryAnchorSourceSchema,
   HistoryCandidateBatchSchema: () => HistoryCandidateBatchSchema,
   HistoryCandidateSchema: () => HistoryCandidateSchema,
+  HistoryDependencyContextSchema: () => HistoryDependencyContextSchema,
+  HistoryDependencySchema: () => HistoryDependencySchema,
   HistoryEvidenceRefSchema: () => HistoryEvidenceRefSchema,
   HistoryEvidenceSelectionSchema: () => HistoryEvidenceSelectionSchema,
   HistoryRelationCandidateSchema: () => HistoryRelationCandidateSchema,
@@ -17417,9 +17593,14 @@ __export(src_exports, {
   digest: () => digest,
   errorSignatureEqual: () => errorSignatureEqual,
   evaluateHistoryApplicability: () => evaluateHistoryApplicability,
+  exactHistoryDependencyVersion: () => exactHistoryDependencyVersion,
   extractIdentifierTokens: () => extractIdentifierTokens,
   genericCanonicalId: () => genericCanonicalId,
   historyDag: () => historyDag,
+  historyDependencyIdentity: () => historyDependencyIdentity,
+  historyDependencyPackageId: () => historyDependencyPackageId,
+  historyDependencyVersions: () => historyDependencyVersions,
+  historyManifestId: () => historyManifestId,
   historyReadFields: () => historyReadFields,
   historyReadPolicy: () => historyReadPolicy,
   historySemanticKey: () => historySemanticKey,
@@ -17444,6 +17625,7 @@ __export(src_exports, {
   isValidEdge: () => isValidEdge,
   isValidEdgeType: () => isValidEdgeType,
   languageCanonicalId: () => languageCanonicalId,
+  namedHistoryDependency: () => namedHistoryDependency,
   nearestDeps: () => nearestDeps,
   normalizeExtractionSource: () => normalizeExtractionSource,
   normalizePredicate: () => normalizePredicate,
@@ -17463,6 +17645,7 @@ __export(src_exports, {
   parsePackageRef: () => parsePackageRef,
   parsePnpmLock: () => parsePnpmLock,
   prefilterEntities: () => prefilterEntities,
+  preservedHistoryDependencies: () => preservedHistoryDependencies,
   preservedHistoryOccurrence: () => preservedHistoryOccurrence,
   problemIdFromError: () => problemIdFromError,
   projectSaltedNodeId: () => projectSaltedNodeId,
@@ -17471,11 +17654,13 @@ __export(src_exports, {
   provenanceBand: () => provenanceBand,
   resolveCanonical: () => resolveCanonical,
   resolveCanonicalId: () => resolveCanonicalId,
+  resolveHistoricalNpmVersion: () => resolveHistoricalNpmVersion,
   resolveHistoryEvidence: () => resolveHistoryEvidence,
   resolveUnambiguousCanonicalId: () => resolveUnambiguousCanonicalId,
   retrievalTokens: () => retrievalTokens,
   scrubHistoryText: () => scrubHistoryText,
   scrubHistoryValue: () => scrubHistoryValue,
+  selectHistoryDependencies: () => selectHistoryDependencies,
   sha256: () => sha256,
   sha256Short: () => sha256Short,
   sidecarDropBucket: () => sidecarDropBucket,
@@ -17512,6 +17697,7 @@ var init_src = __esm({
     init_history_temporal();
     init_history_revision();
     init_history_evidence();
+    init_history_dependencies();
     init_hash();
     init_error_signature();
     init_canonicalize();
@@ -19256,8 +19442,8 @@ CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_js
       freezeNode(liveId, t) {
         const live3 = this.getNode(liveId);
         if (!live3) return null;
-        const version2 = live3.version ?? 1;
-        const frozenId = `${liveId}@v${version2}`;
+        const version3 = live3.version ?? 1;
+        const frozenId = `${liveId}@v${version3}`;
         if (this.getNode(frozenId)) {
           this.stmts.advanceLive.run({ live_id: liveId, t });
           return frozenId;
@@ -19605,7 +19791,7 @@ function evaluateDependency(attrs, newVersion) {
   }
   return { revisit: false, reason: "" };
 }
-function findOrCreatePackage(store, name2, version2, ts) {
+function findOrCreatePackage(store, name2, version3, ts) {
   const existing = store.findNodesByLabel("Package").find((n) => n.attrs["name"] === name2 || n.description === name2);
   if (existing) return existing;
   const node2 = {
@@ -19625,7 +19811,7 @@ function findOrCreatePackage(store, name2, version2, ts) {
     isLandmark: false,
     community: null,
     stability: "unstable",
-    attrs: { version: version2 }
+    attrs: { version: version3 }
   };
   store.mergeNode(node2);
   return node2;
@@ -20144,13 +20330,13 @@ function linkProblemToPackages(store, problemId, text, ts, index) {
   if (idx.size === 0) return { linked: [] };
   const already = new Set(store.outEdges(problemId, ["DEPENDS_ON"]).map((e) => e.to));
   const linked = [];
-  for (const { node: node2, version: version2 } of matchPackagesInText(text, idx)) {
+  for (const { node: node2, version: version3 } of matchPackagesInText(text, idx)) {
     if (already.has(node2.id)) continue;
     addDependency(store, {
       fromId: problemId,
       toId: node2.id,
       relation: "depends-on",
-      evidence: version2 ? `named in problem (@${version2})` : "named in problem statement",
+      evidence: version3 ? `named in problem (@${version3})` : "named in problem statement",
       ts,
       extractionSource: "daemon-extracted"
     });
@@ -20448,8 +20634,8 @@ import { mkdirSync as mkdirSync3, existsSync as existsSync4 } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname4, join as join3 } from "node:path";
 import { createRequire } from "node:module";
-function semanticFloorFor(version2) {
-  if (version2 === EMBEDDING_VERSION || version2 === MODEL_EMBEDDING_VERSION) return 0.25;
+function semanticFloorFor(version3) {
+  if (version3 === EMBEDDING_VERSION || version3 === MODEL_EMBEDDING_VERSION) return 0.25;
   return 0.5;
 }
 function noteHashFallback() {
@@ -39644,10 +39830,10 @@ ${JSON.stringify(symbolNames, null, 2)}`);
           this.language = null;
         } else if (language.constructor === Language) {
           address = language[0];
-          const version2 = C._ts_language_abi_version(address);
-          if (version2 < MIN_COMPATIBLE_VERSION || LANGUAGE_VERSION < version2) {
+          const version3 = C._ts_language_abi_version(address);
+          if (version3 < MIN_COMPATIBLE_VERSION || LANGUAGE_VERSION < version3) {
             throw new Error(
-              `Incompatible language version ${version2}. Compatibility range ${MIN_COMPATIBLE_VERSION} through ${LANGUAGE_VERSION}.`
+              `Incompatible language version ${version3}. Compatibility range ${MIN_COMPATIBLE_VERSION} through ${LANGUAGE_VERSION}.`
             );
           }
           this.language = language;
@@ -55596,36 +55782,36 @@ var require_diagnostics = __commonJS({
       const debuglog = fetchDebuglog.enabled ? fetchDebuglog : undiciDebugLog;
       diagnosticsChannel.channel("undici:client:beforeConnect").subscribe((evt) => {
         const {
-          connectParams: { version: version2, protocol, port, host }
+          connectParams: { version: version3, protocol, port, host }
         } = evt;
         debuglog(
           "connecting to %s using %s%s",
           `${host}${port ? `:${port}` : ""}`,
           protocol,
-          version2
+          version3
         );
       });
       diagnosticsChannel.channel("undici:client:connected").subscribe((evt) => {
         const {
-          connectParams: { version: version2, protocol, port, host }
+          connectParams: { version: version3, protocol, port, host }
         } = evt;
         debuglog(
           "connected to %s using %s%s",
           `${host}${port ? `:${port}` : ""}`,
           protocol,
-          version2
+          version3
         );
       });
       diagnosticsChannel.channel("undici:client:connectError").subscribe((evt) => {
         const {
-          connectParams: { version: version2, protocol, port, host },
+          connectParams: { version: version3, protocol, port, host },
           error: error48
         } = evt;
         debuglog(
           "connection to %s using %s%s errored - %s",
           `${host}${port ? `:${port}` : ""}`,
           protocol,
-          version2,
+          version3,
           error48.message
         );
       });
@@ -55674,31 +55860,31 @@ var require_diagnostics = __commonJS({
         const debuglog = undiciDebugLog.enabled ? undiciDebugLog : websocketDebuglog;
         diagnosticsChannel.channel("undici:client:beforeConnect").subscribe((evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host }
+            connectParams: { version: version3, protocol, port, host }
           } = evt;
           debuglog(
             "connecting to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
             protocol,
-            version2
+            version3
           );
         });
         diagnosticsChannel.channel("undici:client:connected").subscribe((evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host }
+            connectParams: { version: version3, protocol, port, host }
           } = evt;
           debuglog(
             "connected to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
             protocol,
-            version2
+            version3
           );
         });
         diagnosticsChannel.channel("undici:client:connectError").subscribe((evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host },
+            connectParams: { version: version3, protocol, port, host },
             error: error48
           } = evt;
           debuglog(
@@ -55706,7 +55892,7 @@ var require_diagnostics = __commonJS({
             host,
             port ? `:${port}` : "",
             protocol,
-            version2,
+            version3,
             error48.message
           );
         });
@@ -64934,7 +65120,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/mock/mock-client.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify5 } = __require("node:util");
+    var { promisify: promisify6 } = __require("node:util");
     var Client = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -64974,7 +65160,7 @@ var require_mock_client = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify5(this[kOriginalClose])();
+        await promisify6(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -64987,7 +65173,7 @@ var require_mock_client = __commonJS({
 var require_mock_pool = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/mock/mock-pool.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify5 } = __require("node:util");
+    var { promisify: promisify6 } = __require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -65027,7 +65213,7 @@ var require_mock_pool = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify5(this[kOriginalClose])();
+        await promisify6(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -75757,14 +75943,14 @@ async function chat(req) {
   try {
     if (provider === "azure") {
       const endpoint = (process.env["AZURE_OPENAI_ENDPOINT"] ?? "").replace(/\/+$/, "");
-      const version2 = process.env["AZURE_OPENAI_API_VERSION"] ?? "2024-10-21";
+      const version3 = process.env["AZURE_OPENAI_API_VERSION"] ?? "2024-10-21";
       const deployment = deploymentFor(req.model);
       if (!endpoint || !deployment) {
         console.warn("[errata] llm: azure selected but endpoint/deployment missing \u2014 skipping");
         return null;
       }
       const resp2 = await fetch(
-        `${endpoint}/openai/deployments/${deployment}/chat/completions?api-version=${version2}`,
+        `${endpoint}/openai/deployments/${deployment}/chat/completions?api-version=${version3}`,
         {
           method: "POST",
           headers: {
@@ -79450,9 +79636,9 @@ function rankCandidates(cs) {
 var VCS_HOST_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/;
 var SCP_STYLE_REMOTE = /^[\w.-]+@[\w.-]+:/;
 var BARE_REPO_SHORTHAND = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?:#.*)?$/;
-function isLocalSpec(version2) {
-  if (!version2) return false;
-  const v = version2.trim().toLowerCase();
+function isLocalSpec(version3) {
+  if (!version3) return false;
+  const v = version3.trim().toLowerCase();
   return v.startsWith("workspace:") || v.startsWith("link:") || v.startsWith("file:") || v.startsWith("portal:") || v.startsWith("path:") || v.startsWith("git:") || v.startsWith("git+") || v.includes("://") || VCS_HOST_SHORTHAND.test(v) || SCP_STYLE_REMOTE.test(v) || BARE_REPO_SHORTHAND.test(v);
 }
 function retrievalStackTokens(input) {
@@ -82246,7 +82432,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.17-dev.3504" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.17-dev.3527" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -86502,8 +86688,8 @@ async function lookupPublished(channel, timeoutMs = 4e3) {
     });
     if (!res.ok) return { error: `http ${res.status}` };
     const body2 = await res.json();
-    const version2 = body2["dist-tags"]?.[channel];
-    return version2 ? { version: version2 } : { error: "no-tag" };
+    const version3 = body2["dist-tags"]?.[channel];
+    return version3 ? { version: version3 } : { error: "no-tag" };
   } catch {
     return { error: ctrl.signal.aborted ? "timeout" : "unreachable" };
   } finally {
@@ -87064,11 +87250,115 @@ async function hydrateProject(opts) {
 // src/history-reconcile.ts
 init_src11();
 init_src();
+import { execFile as execFile5 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
+import { extname as extname3 } from "node:path";
+
+// src/history-dependency-snapshot.ts
+init_src();
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { extname as extname3 } from "node:path";
-init_profile2();
 var exec = promisify3(execFile4);
+async function readHistoryDependencySnapshot(opts) {
+  const git3 = opts.git ?? (async (args2) => (await exec("git", ["-C", opts.root, ...args2], { windowsHide: true, maxBuffer: 16 * 1024 * 1024 })).stdout);
+  const read2 = opts.readBlob ?? (async (oid) => git3(["show", oid]));
+  let complete = true;
+  const tree = await git3(["ls-tree", "-r", opts.commit]).catch(() => null);
+  if (tree === null) return { schemaVersion: "history-deps-1", complete: false, dependencies: [] };
+  const entries = tree.split("\n").flatMap((line) => {
+    const match2 = /^\d+ blob ([a-f0-9]+)\t(.+)$/.exec(line);
+    if (!match2) return [];
+    const path2 = match2[2].replace(/^"|"$/g, "");
+    if (path2.includes("\\") || /[\r\n]/.test(path2)) {
+      complete = false;
+      return [];
+    }
+    return [{ path: path2, oid: match2[1] }];
+  });
+  const manifests = {}, locks = {};
+  for (const { path: path2, oid } of entries) {
+    const lock = /(?:^|\/)(?:pnpm-lock.yaml|package-lock.json)$/.test(path2);
+    if (!lock && (!isManifestPath(path2) || opts.manifestIds && !opts.manifestIds.has(historyManifestId(path2)))) continue;
+    if (opts.paths && !Object.values(opts.paths).some((p) => !path2.includes("/") || p.startsWith(path2.slice(0, path2.lastIndexOf("/") + 1)))) continue;
+    if (opts.allowPath && !opts.allowPath(path2)) {
+      complete = false;
+      continue;
+    }
+    try {
+      const text = await read2(oid);
+      if (text === null || text.length > 8e6) {
+        complete = false;
+        continue;
+      }
+      if (!lock && path2.endsWith("package.json")) {
+        const json2 = JSON.parse(text);
+        if (!json2 || typeof json2 !== "object" || Array.isArray(json2)) {
+          complete = false;
+          continue;
+        }
+      }
+      if (lock) locks[path2] = text;
+      else manifests[path2] = text;
+    } catch {
+      complete = false;
+    }
+  }
+  const spine = buildSpine(opts.commit, Object.keys(manifests), (p) => manifests[p]);
+  const sources = /* @__PURE__ */ new Map();
+  for (const [token, path2] of Object.entries(opts.paths ?? {})) {
+    if (opts.allowPath && !opts.allowPath(path2)) continue;
+    const file2 = entries.find((e) => e.path === path2);
+    if (!file2) continue;
+    try {
+      const text = await read2(file2.oid);
+      if (text !== null && text.length <= 1e6) sources.set(token, text);
+      else complete = false;
+    } catch {
+      complete = false;
+    }
+  }
+  const dependencies = /* @__PURE__ */ new Map();
+  const paths = opts.paths ? Object.entries(opts.paths) : [["", ""]];
+  for (const [token, path2] of paths) {
+    if (path2 && opts.allowPath && !opts.allowPath(path2)) continue;
+    const governing = Object.entries(spine.manifests).filter(([m]) => !opts.paths || !m.includes("/") || path2.startsWith(m.slice(0, m.lastIndexOf("/") + 1))).sort(([a], [b]) => b.split("/").length - a.split("/").length || a.localeCompare(b));
+    const chosen = /* @__PURE__ */ new Set();
+    for (const [manifest, deps] of governing) for (const d of deps) {
+      const packageId = historyDependencyPackageId(d.ecosystem, d.name);
+      if (opts.paths && chosen.has(packageId)) continue;
+      chosen.add(packageId);
+      const manifestId = historyManifestId(manifest), key = `${packageId}:${manifestId}`;
+      let dependency = dependencies.get(key);
+      if (!dependency) {
+        const declaredRange = !d.directRef && d.version && !/[:/\\@]/.test(d.version) ? d.version : null;
+        dependency = {
+          packageId,
+          ecosystem: d.ecosystem,
+          name: d.name,
+          kind: d.kind,
+          manifestId,
+          sourceCommit: opts.commit,
+          side: opts.side,
+          declaredRange,
+          resolvedVersion: d.ecosystem === "npm" && declaredRange ? resolveHistoricalNpmVersion(d.name, manifest, declaredRange, locks) : null,
+          pathTokens: [],
+          importTokens: []
+        };
+        dependencies.set(key, dependency);
+      }
+      if (token && !dependency.pathTokens.includes(token)) dependency.pathTokens.push(token);
+      const source = sources.get(token) ?? "";
+      const modules = [...source.matchAll(/(?:\bfrom\s*|\bimport\s*(?:\(\s*)?|\brequire\s*\(\s*)['"]([^'"\r\n]+)['"]/g)].map((m) => m[1]);
+      if (token && d.ecosystem === "npm" && modules.some((m) => m === d.name || m.startsWith(d.name + "/")) && !dependency.importTokens.includes(token)) dependency.importTokens.push(token);
+    }
+  }
+  const values = [...dependencies.values()].sort((a, b) => a.packageId.localeCompare(b.packageId) || a.manifestId.localeCompare(b.manifestId));
+  return { schemaVersion: "history-deps-1", complete: complete && values.length <= 128, dependencies: values.slice(0, 128) };
+}
+
+// src/history-reconcile.ts
+init_profile2();
+var exec2 = promisify4(execFile5);
 var KINDS = { function: "Function", class: "Class", method: "Method", interface: "Interface", const: "Const", enum: "Enum", typealias: "TypeAlias", namespace: "Namespace", property: "Property" };
 var inFlight = /* @__PURE__ */ new Map();
 async function syncHistoryRevision(opts) {
@@ -87098,7 +87388,7 @@ async function syncHistoryRevisionPage(opts) {
   const { root, profile, store, cloud, salt } = opts;
   if (!profile.projectId) return { changed: 0, remaining: false };
   const projectId = profile.projectId;
-  const git3 = opts.git ?? (async (args2) => (await exec("git", ["-C", root, ...args2], { windowsHide: true, maxBuffer: 8 * 1024 * 1024 })).stdout);
+  const git3 = opts.git ?? (async (args2) => (await exec2("git", ["-C", root, ...args2], { windowsHide: true, maxBuffer: 8 * 1024 * 1024 })).stdout);
   const atCommit = (await git3(["rev-parse", "--verify", "HEAD"])).trim();
   if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(atCommit)) throw new Error("history revision is not a full Git object id");
   const oldCursor = profile.historyRevisionCursor;
@@ -87117,6 +87407,16 @@ async function syncHistoryRevisionPage(opts) {
   const providers = defaultProviders();
   const parsedFiles = /* @__PURE__ */ new Map();
   const observations = [];
+  const contexts = page.occurrences.map((o) => HistoryDependencyContextSchema.safeParse(o.quality["dependencyContext"]));
+  const manifestIds = new Set(contexts.flatMap((c) => c.success ? c.data.dependencies.map((d) => d.manifestId) : []));
+  const currentDependencies = manifestIds.size ? await readHistoryDependencySnapshot({
+    root,
+    commit: atCommit,
+    side: "after",
+    manifestIds,
+    git: git3,
+    allowPath: (p) => pathAllowedByFloor(p) && !isPathBlocked(ignore2, p)
+  }) : void 0;
   for (const occurrence of page.occurrences) {
     const anchors = occurrence.quality["historicalAnchors"];
     const paths = /* @__PURE__ */ new Set(), symbols = [];
@@ -87157,7 +87457,13 @@ async function syncHistoryRevisionPage(opts) {
       }, { maxTokens: 4e3, ignorePatterns: profile.ignoreExtra ?? [] }).catch(() => null);
       if (bundle && !bundle.truncated) diff = bundle.diff;
     }
-    observations.push({ occurrenceId: occurrence.occurrenceId, symbols, ...diff ? { diff } : {} });
+    const old = HistoryDependencyContextSchema.safeParse(occurrence.quality["dependencyContext"]);
+    const dependencyContext = old.success ? {
+      schemaVersion: "history-deps-1",
+      complete: old.data.dependencies.length === 0 || currentDependencies?.complete === true,
+      dependencies: currentDependencies?.dependencies.filter((d) => old.data.dependencies.some((o) => o.packageId === d.packageId && o.manifestId === d.manifestId)) ?? []
+    } : void 0;
+    observations.push({ occurrenceId: occurrence.occurrenceId, symbols, ...diff ? { diff } : {}, ...dependencyContext ? { dependencyContext } : {} });
   }
   const response = page.occurrences.length ? await cloud.reconcileHistory(projectId, { atCommit, parents, observations }) : { atCommit, receipts: [] };
   if (response.atCommit !== atCommit || response.receipts.length !== page.occurrences.length || new Set(response.receipts.map((r) => r.occurrenceId)).size !== response.receipts.length || response.receipts.some((r) => r.atCommit !== atCommit || !observations.some((o) => o.occurrenceId === r.occurrenceId))) throw new Error("incomplete history reconciliation response");
@@ -87168,7 +87474,7 @@ async function syncHistoryRevisionPage(opts) {
     if (!node2 || node2.attrs["source"] !== "cloud" || node2.attrs["historyQuality"]?.["sourceSupport"] === "quarantined") continue;
     const receipt = response.receipts.find((r) => r.occurrenceId === occurrence.occurrenceId);
     const previous = node2.attrs["historyQuality"];
-    if (previous?.["evaluatedAtCommit"] === atCommit && previous["applicability"] === "applicable" && receipt.verdict !== "applicable") continue;
+    if (previous?.["evaluatedAtCommit"] === atCommit && previous["applicability"] === "applicable" && receipt.verdict !== "applicable" && previous["reconciliationEvidence"]?.["build"] === HISTORY_RECONCILE_BUILD) continue;
     store.mergeNode({ ...node2, attrs: { ...node2.attrs, historyQuality: {
       ...occurrence.quality,
       evaluatedAtCommit: atCommit,
@@ -87185,10 +87491,10 @@ async function syncHistoryRevisionPage(opts) {
 // src/project-history.ts
 init_src7();
 init_src();
-import { execFile as execFile5 } from "node:child_process";
+import { execFile as execFile6 } from "node:child_process";
 import { readFileSync as readFileSync35 } from "node:fs";
 import { join as join39 } from "node:path";
-import { promisify as promisify4 } from "node:util";
+import { promisify as promisify5 } from "node:util";
 
 // src/history-walk.ts
 var LOCKFILE_NAMES = /* @__PURE__ */ new Set([
@@ -87722,7 +88028,7 @@ async function historicalAnchors(input) {
 
 // src/project-history.ts
 init_profile2();
-var execFileAsync2 = promisify4(execFile5);
+var execFileAsync2 = promisify5(execFile6);
 var HISTORY_EXTRACTOR_VERSION = "history-2";
 var LEASE_POLL_MS = 2e4;
 var RECOVERY_DEADLINE_MS = 15 * 6e4;
@@ -87909,6 +88215,8 @@ async function walk10(root, input, client, opts, readBlob) {
     return { profile, processed: 0, state: "done" };
   }
   const ignoreLines = readIgnoreLines(root, profile);
+  const dependencyIgnore = loadRepoIgnore(root, ignoreLines);
+  const allowDependencyPath = (path2) => pathAllowedByFloor(path2) && !isPathBlocked(dependencyIgnore, path2);
   let counts = profile.historyStage?.counts ?? {};
   let processed = 0;
   const byIndex = /* @__PURE__ */ new Map();
@@ -87963,6 +88271,29 @@ async function walk10(root, input, client, opts, readBlob) {
       };
       const spine = await spineForUnit(git3, root, u, readBlob, (line) => log(`[errata] history ${u.sha.slice(0, 12)}/${u.subIndex}: ${line}`));
       if (spine) body2.spine = spine;
+      const dependencyAfter = await readHistoryDependencySnapshot({
+        root,
+        commit: u.sha,
+        side: "after",
+        paths: bundle.pathTokens,
+        git: (args2) => git3(root, args2),
+        readBlob,
+        allowPath: allowDependencyPath
+      });
+      const dependencyBefore = u.parents[0] ? await readHistoryDependencySnapshot({
+        root,
+        commit: u.parents[0],
+        side: "before",
+        paths: bundle.pathTokens,
+        git: (args2) => git3(root, args2),
+        readBlob,
+        allowPath: allowDependencyPath
+      }) : { complete: true, dependencies: [] };
+      body2.dependencyContext = {
+        schemaVersion: "history-deps-1",
+        complete: dependencyAfter.complete && dependencyBefore.complete,
+        dependencies: [...dependencyBefore.dependencies, ...dependencyAfter.dependencies]
+      };
       const anchors = opts.anchors ? await historicalAnchors({
         root,
         projectId,
@@ -92010,9 +92341,9 @@ var OPENCODE_PLUGIN_MARKER = "// @inerrata opencode plugin \u2014 errata-managed
 var OPENCODE_D1_CONTRACT = "Behavioral contract: (1) On ANY error, call search() BEFORE debugging \u2014 costs ~400 tokens vs 5,000\u201350,000 cold. (2) After solving non-trivial problems, contribute back: if your harness emits typed nodes (canonicalId + label + attrs), use ingest \u2014 the typed door; otherwise call contribute(), the prose fallback. (3) Before web search, try search() first \u2014 graph is 2\u201315\xD7 cheaper. (4) At session end, review what you solved and contribute anything novel.";
 var OPENCODE_TOOL_FAILURE_NUDGE = "[inerrata] This tool call failed \u2014 call search() with the error message BEFORE debugging from scratch (~400 tokens vs 5,000\u201350,000 cold).";
 function buildOpencodePluginSource(port, opts = {}) {
-  const version2 = opts.version ?? "dev";
+  const version3 = opts.version ?? "dev";
   return `${OPENCODE_PLUGIN_MARKER}
-// Generated by errata ${version2}. Re-run \`errata install-hooks opencode\` to update; edits here are overwritten.
+// Generated by errata ${version3}. Re-run \`errata install-hooks opencode\` to update; edits here are overwritten.
 // What it does: mirrors each OpenCode session's OWN message record to a JSONL
 // file the errata daemon can parse, and tells the daemon on every turn boundary.
 // It has no dependencies and never throws into OpenCode.