@inerrata-corporation/errata 2.0.2-dev.226 → 2.0.2-dev.227

package/consolidate-worker.mjs

@@ -15315,6 +15315,15 @@ var init_wire = __esm({
       /** Canonical human-readable description (no raw paths — daemon scrubs; server rechecks). */
       description: external_exports.string().min(1).max(4e3),
       attrs: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
+      /** One-way origin key of the SESSION that minted this node (`ws_…`, a
+       *  truncated digest — never the raw session id). Stamped onto the created
+       *  node as `authoringSession`, which is the independence unit for the
+       *  evidence channels: the session that authored a claim may not corroborate
+       *  or refute it, while a DIFFERENT session on the same checkout may (alyssa,
+       *  2026-07-31 — the workspace key made every witness on a single-checkout
+       *  deployment a self-corroboration). Optional + additive: absent leaves the
+       *  gate fail-open for that node, exactly today's behaviour. */
+      originSession: external_exports.string().min(3).max(64).optional(),
       extractionSource: external_exports.enum(INGEST_EXTRACTION_SOURCES),
       validationSource: external_exports.enum(VALIDATION_SOURCES).optional(),
       /** Org-membrane (M2): the daemon's anchor tag — it owns the lockfile, so it

package/errata.mjs

@@ -15616,6 +15616,15 @@ var init_wire = __esm({
       /** Canonical human-readable description (no raw paths — daemon scrubs; server rechecks). */
       description: external_exports.string().min(1).max(4e3),
       attrs: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
+      /** One-way origin key of the SESSION that minted this node (`ws_…`, a
+       *  truncated digest — never the raw session id). Stamped onto the created
+       *  node as `authoringSession`, which is the independence unit for the
+       *  evidence channels: the session that authored a claim may not corroborate
+       *  or refute it, while a DIFFERENT session on the same checkout may (alyssa,
+       *  2026-07-31 — the workspace key made every witness on a single-checkout
+       *  deployment a self-corroboration). Optional + additive: absent leaves the
+       *  gate fail-open for that node, exactly today's behaviour. */
+      originSession: external_exports.string().min(3).max(64).optional(),
       extractionSource: external_exports.enum(INGEST_EXTRACTION_SOURCES),
       validationSource: external_exports.enum(VALIDATION_SOURCES).optional(),
       /** Org-membrane (M2): the daemon's anchor tag — it owns the lockfile, so it
@@ -16279,6 +16288,9 @@ var init_profile = __esm({
 });
 
 // ../../packages/local-shared/src/daemon-wire.ts
+function formatDisposition(d) {
+  return `${d.recorded} recorded \xB7 ${d.unmatched} unmatched (queued) \xB7 ${d.duplicate} dup \xB7 ${d.selfGated} self`;
+}
 var init_daemon_wire = __esm({
   "../../packages/local-shared/src/daemon-wire.ts"() {
     "use strict";
@@ -47250,12 +47262,12 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src5();
-import { closeSync as closeSync2, existsSync as existsSync25, openSync as openSync2, readFileSync as readFileSync23, renameSync as renameSync3, statSync as statSync6 } from "node:fs";
-import { join as join27 } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync25, openSync as openSync2, readFileSync as readFileSync24, renameSync as renameSync4, statSync as statSync6 } from "node:fs";
+import { join as join28 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/daemon.ts
-import { existsSync as existsSync20, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync20, writeFileSync as writeFileSync17 } from "node:fs";
 
 // ../../node_modules/.pnpm/@hono+node-server@1.19.11_hono@4.12.8/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
@@ -47835,8 +47847,8 @@ init_config();
 
 // src/engine.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync19, statSync as statSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync9, renameSync as renameSync2, readFileSync as readFileSync18, writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join23, relative as relative6, sep as sep4 } from "node:path";
+import { existsSync as existsSync19, statSync as statSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync9, renameSync as renameSync3, readFileSync as readFileSync19, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join24, relative as relative6, sep as sep4 } from "node:path";
 
 // ../../node_modules/.pnpm/chokidar@4.0.3/node_modules/chokidar/esm/index.js
 import { stat as statcb } from "fs";
@@ -48567,9 +48579,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname10 = sysPath.dirname(file2);
+    const dirname11 = sysPath.dirname(file2);
     const basename5 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname10);
+    const parent = this.fsw._getWatchedDir(dirname11);
     let prevStats = stats;
     if (parent.has(basename5))
       return;
@@ -48596,7 +48608,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error48) {
-          this.fsw._remove(dirname10, basename5);
+          this.fsw._remove(dirname11, basename5);
         }
       } else if (parent.has(basename5)) {
         const at = newStats.atimeMs;
@@ -51997,109 +52009,6 @@ function createToolRunState() {
 // src/engine.ts
 init_paths();
 
-// src/causal.ts
-var SUPPRESSORS = [
-  { kind: "ts-nocheck", re: /@ts-nocheck\b/g },
-  { kind: "ts-ignore", re: /@ts-(?:ignore|expect-error)\b/g },
-  { kind: "eslint-disable", re: /eslint-disable(?:-next-line|-line)?\b/g },
-  { kind: "py-ignore", re: /#\s*(?:noqa|type:\s*ignore|pyright:\s*ignore|mypy:\s*ignore|nosec|pragma:\s*no\s*cover)\b/gi },
-  { kind: "test-skip", re: /\bx(?:it|describe|test)\s*\(|\.(?:skip|todo)\s*\(|@(?:pytest\.mark\.skip|unittest\.skip)|\bxfail\b|\bt\.Skip\s*\(/g },
-  { kind: "lint-allow", re: /\/\/\s*nolint\b|#\[allow\(|istanbul\s+ignore|c8\s+ignore/g },
-  { kind: "config-loosen", re: /"strict"\s*:\s*false|"skipLibCheck"\s*:\s*true|ignore_errors\s*=\s*True/gi }
-];
-function detectSuppression(oldStr, newStr) {
-  if (!newStr) return null;
-  const old = oldStr ?? "";
-  for (const { kind, re } of SUPPRESSORS) {
-    const inNew = (newStr.match(re) ?? []).length;
-    const inOld = (old.match(re) ?? []).length;
-    if (inNew > inOld) return kind;
-  }
-  return null;
-}
-var DECL_RE = /\b(?:function|class|const|let|var|def|interface|type|enum)\s+([A-Za-z_$][\w$]*)/g;
-function deriveIntentHints(tool, oldStr, newStr) {
-  const hints = /* @__PURE__ */ new Set();
-  if (tool === "Write" && (oldStr == null || oldStr === "")) hints.add("add");
-  if (detectSuppression(oldStr, newStr)) hints.add("suppress");
-  if (oldStr != null && newStr != null) {
-    const oldNames = new Set([...oldStr.matchAll(DECL_RE)].map((m) => m[1]));
-    const newNames = new Set([...newStr.matchAll(DECL_RE)].map((m) => m[1]));
-    const removed = [...oldNames].filter((n) => !newNames.has(n));
-    const added = [...newNames].filter((n) => !oldNames.has(n));
-    if (removed.length > 0 && added.length > 0) hints.add("rename");
-    else if (added.length > 0) hints.add("add");
-    else if (removed.length > 0) hints.add("delete");
-  }
-  return [...hints];
-}
-function deriveDeclaredRenames(oldStr, newStr) {
-  if (oldStr == null || newStr == null) return [];
-  const oldNames = [...oldStr.matchAll(DECL_RE)].map((m) => m[1]);
-  const newNames = [...newStr.matchAll(DECL_RE)].map((m) => m[1]);
-  const oldSet = new Set(oldNames);
-  const newSet = new Set(newNames);
-  const removed = [...new Set(oldNames.filter((n) => !newSet.has(n)))];
-  const added = [...new Set(newNames.filter((n) => !oldSet.has(n)))];
-  if (removed.length === 1 && added.length === 1) {
-    return [{ from: removed[0], to: added[0] }];
-  }
-  return [];
-}
-var CausalBuffer = class {
-  constructor(windowMs = 5e3, maxAgeMs = 3e4) {
-    this.windowMs = windowMs;
-    this.maxAgeMs = maxAgeMs;
-  }
-  events = [];
-  record(e) {
-    this.events.push(e);
-    this.prune(e.ts);
-  }
-  prune(now) {
-    const cutoff = now - this.maxAgeMs;
-    if (this.events.length > 0 && this.events[0].ts < cutoff) {
-      this.events = this.events.filter((e) => e.ts >= cutoff);
-    }
-  }
-  /**
-   * Correlate a reindex flush (the changed relPaths at instant `t`) to a causal
-   * context, if any buffered tool event touched one of those paths within the
-   * window. The most recent match wins for session/tool; hints are unioned.
-   */
-  correlate(relPaths, t) {
-    const set2 = new Set(relPaths);
-    const matches = this.events.filter(
-      (e) => set2.has(e.relPath) && Math.abs(e.ts - t) <= this.windowMs
-    );
-    if (matches.length === 0) return null;
-    matches.sort((a, b) => b.ts - a.ts);
-    const top = matches[0];
-    const hints = /* @__PURE__ */ new Set();
-    const renames = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const m of matches) {
-      for (const h of m.intentHints) hints.add(h);
-      for (const r of m.declaredRenames) {
-        const key = `${r.from}->${r.to}`;
-        if (!seen.has(key)) {
-          seen.add(key);
-          renames.push(r);
-        }
-      }
-    }
-    return {
-      sessionId: top.sessionId,
-      tool: top.tool,
-      intentHints: [...hints],
-      declaredRenames: renames
-    };
-  }
-  size() {
-    return this.events.length;
-  }
-};
-
 // src/profile.ts
 init_src2();
 init_paths();
@@ -52163,6 +52072,10 @@ function detectRepoLocator(root, remote) {
 function workspaceId(root) {
   return "wp_" + createHash12("sha256").update(root).digest("hex").slice(0, 12);
 }
+function sessionOriginKey(sessionId) {
+  if (!sessionId) return void 0;
+  return "ws_" + createHash12("sha256").update(sessionId).digest("hex").slice(0, 12);
+}
 function refreshRepoLocator(root, profile) {
   const detected = detectRepoLocator(root, profile.repoRemote);
   if (!detected || detected === profile.repoLocator) return false;
@@ -52242,6 +52155,160 @@ function autodetectProfile(root) {
   return p;
 }
 
+// src/witness-queue.ts
+import { readFileSync as readFileSync18, renameSync as renameSync2, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname9, join as join23 } from "node:path";
+var WITNESS_QUEUE_CAP = 500;
+var WITNESS_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
+var WITNESS_MAX_ATTEMPTS = 5;
+function witnessQueuePath(workspaceConfigDir) {
+  return join23(workspaceConfigDir, "witness-queue.json");
+}
+function loadWitnessQueue(path2) {
+  try {
+    const raw2 = JSON.parse(readFileSync18(path2, "utf8"));
+    if (!Array.isArray(raw2)) return [];
+    return raw2.filter(
+      (w) => !!w && typeof w === "object" && typeof w.nodeId === "string" && typeof w.witnessKey === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+function saveWitnessQueue(path2, queue) {
+  try {
+    const tmp = join23(dirname9(path2), `.${Date.now()}.witness-queue.tmp`);
+    writeFileSync15(tmp, JSON.stringify(queue), "utf8");
+    renameSync2(tmp, path2);
+  } catch {
+  }
+}
+function pruneWitnessQueue(queue, now) {
+  const live = queue.filter(
+    (w) => now - w.ts < WITNESS_TTL_MS && w.attempts < WITNESS_MAX_ATTEMPTS
+  );
+  return live.length > WITNESS_QUEUE_CAP ? live.slice(live.length - WITNESS_QUEUE_CAP) : live;
+}
+function enqueueWitnesses(queue, fresh, now) {
+  const byKey = new Map(queue.map((w) => [`${w.channel}:${w.witnessKey}`, w]));
+  for (const f of fresh) {
+    const k = `${f.channel}:${f.witnessKey}`;
+    const existing = byKey.get(k);
+    if (existing) existing.attempts += 1;
+    else byKey.set(k, { ...f, ts: now, attempts: 1 });
+  }
+  return pruneWitnessQueue([...byKey.values()], now);
+}
+function pendingFor(queue, channel) {
+  return queue.filter((w) => w.channel === channel);
+}
+function retireWitnesses(queue, channel, settledKeys) {
+  return queue.filter((w) => !(w.channel === channel && settledKeys.has(w.witnessKey)));
+}
+
+// src/causal.ts
+var SUPPRESSORS = [
+  { kind: "ts-nocheck", re: /@ts-nocheck\b/g },
+  { kind: "ts-ignore", re: /@ts-(?:ignore|expect-error)\b/g },
+  { kind: "eslint-disable", re: /eslint-disable(?:-next-line|-line)?\b/g },
+  { kind: "py-ignore", re: /#\s*(?:noqa|type:\s*ignore|pyright:\s*ignore|mypy:\s*ignore|nosec|pragma:\s*no\s*cover)\b/gi },
+  { kind: "test-skip", re: /\bx(?:it|describe|test)\s*\(|\.(?:skip|todo)\s*\(|@(?:pytest\.mark\.skip|unittest\.skip)|\bxfail\b|\bt\.Skip\s*\(/g },
+  { kind: "lint-allow", re: /\/\/\s*nolint\b|#\[allow\(|istanbul\s+ignore|c8\s+ignore/g },
+  { kind: "config-loosen", re: /"strict"\s*:\s*false|"skipLibCheck"\s*:\s*true|ignore_errors\s*=\s*True/gi }
+];
+function detectSuppression(oldStr, newStr) {
+  if (!newStr) return null;
+  const old = oldStr ?? "";
+  for (const { kind, re } of SUPPRESSORS) {
+    const inNew = (newStr.match(re) ?? []).length;
+    const inOld = (old.match(re) ?? []).length;
+    if (inNew > inOld) return kind;
+  }
+  return null;
+}
+var DECL_RE = /\b(?:function|class|const|let|var|def|interface|type|enum)\s+([A-Za-z_$][\w$]*)/g;
+function deriveIntentHints(tool, oldStr, newStr) {
+  const hints = /* @__PURE__ */ new Set();
+  if (tool === "Write" && (oldStr == null || oldStr === "")) hints.add("add");
+  if (detectSuppression(oldStr, newStr)) hints.add("suppress");
+  if (oldStr != null && newStr != null) {
+    const oldNames = new Set([...oldStr.matchAll(DECL_RE)].map((m) => m[1]));
+    const newNames = new Set([...newStr.matchAll(DECL_RE)].map((m) => m[1]));
+    const removed = [...oldNames].filter((n) => !newNames.has(n));
+    const added = [...newNames].filter((n) => !oldNames.has(n));
+    if (removed.length > 0 && added.length > 0) hints.add("rename");
+    else if (added.length > 0) hints.add("add");
+    else if (removed.length > 0) hints.add("delete");
+  }
+  return [...hints];
+}
+function deriveDeclaredRenames(oldStr, newStr) {
+  if (oldStr == null || newStr == null) return [];
+  const oldNames = [...oldStr.matchAll(DECL_RE)].map((m) => m[1]);
+  const newNames = [...newStr.matchAll(DECL_RE)].map((m) => m[1]);
+  const oldSet = new Set(oldNames);
+  const newSet = new Set(newNames);
+  const removed = [...new Set(oldNames.filter((n) => !newSet.has(n)))];
+  const added = [...new Set(newNames.filter((n) => !oldSet.has(n)))];
+  if (removed.length === 1 && added.length === 1) {
+    return [{ from: removed[0], to: added[0] }];
+  }
+  return [];
+}
+var CausalBuffer = class {
+  constructor(windowMs = 5e3, maxAgeMs = 3e4) {
+    this.windowMs = windowMs;
+    this.maxAgeMs = maxAgeMs;
+  }
+  events = [];
+  record(e) {
+    this.events.push(e);
+    this.prune(e.ts);
+  }
+  prune(now) {
+    const cutoff = now - this.maxAgeMs;
+    if (this.events.length > 0 && this.events[0].ts < cutoff) {
+      this.events = this.events.filter((e) => e.ts >= cutoff);
+    }
+  }
+  /**
+   * Correlate a reindex flush (the changed relPaths at instant `t`) to a causal
+   * context, if any buffered tool event touched one of those paths within the
+   * window. The most recent match wins for session/tool; hints are unioned.
+   */
+  correlate(relPaths, t) {
+    const set2 = new Set(relPaths);
+    const matches = this.events.filter(
+      (e) => set2.has(e.relPath) && Math.abs(e.ts - t) <= this.windowMs
+    );
+    if (matches.length === 0) return null;
+    matches.sort((a, b) => b.ts - a.ts);
+    const top = matches[0];
+    const hints = /* @__PURE__ */ new Set();
+    const renames = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const m of matches) {
+      for (const h of m.intentHints) hints.add(h);
+      for (const r of m.declaredRenames) {
+        const key = `${r.from}->${r.to}`;
+        if (!seen.has(key)) {
+          seen.add(key);
+          renames.push(r);
+        }
+      }
+    }
+    return {
+      sessionId: top.sessionId,
+      tool: top.tool,
+      intentHints: [...hints],
+      declaredRenames: renames
+    };
+  }
+  size() {
+    return this.events.length;
+  }
+};
+
 // src/engine.ts
 init_config();
 init_cloud_auth();
@@ -52391,7 +52458,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.2-dev.226" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.2-dev.227" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -52402,7 +52469,7 @@ function appendIdentityAudit(path2, record2, line) {
   if (!record2.accepted && record2.score <= 0) return;
   try {
     if (existsSync19(path2) && statSync5(path2).size >= IDENTITY_AUDIT_MAX_BYTES) {
-      renameSync2(path2, `${path2}.1`);
+      renameSync3(path2, `${path2}.1`);
     }
     appendFileSync2(path2, line);
   } catch {
@@ -52411,7 +52478,7 @@ function appendIdentityAudit(path2, record2, line) {
 var yieldToLoop = () => new Promise((r) => setImmediate(r));
 function loadTurnCursors(path2) {
   try {
-    const raw2 = JSON.parse(readFileSync18(path2, "utf8"));
+    const raw2 = JSON.parse(readFileSync19(path2, "utf8"));
     return new Map(
       Object.entries(raw2).map(([k, v]) => [k, typeof v === "string" ? v : String(v?.uuid ?? "")])
     );
@@ -52421,7 +52488,7 @@ function loadTurnCursors(path2) {
 }
 function loadTurnOffsets(path2) {
   try {
-    const raw2 = JSON.parse(readFileSync18(path2, "utf8"));
+    const raw2 = JSON.parse(readFileSync19(path2, "utf8"));
     const out2 = /* @__PURE__ */ new Map();
     for (const [k, v] of Object.entries(raw2)) {
       const off = typeof v === "object" && v !== null ? v.offset : void 0;
@@ -52437,7 +52504,7 @@ function saveTurnCursors(path2, cursors, offsets) {
     const merged = {};
     for (const [k, uuid3] of cursors) merged[k] = { uuid: uuid3, offset: offsets.get(k) ?? 0 };
     for (const [k, offset] of offsets) if (!merged[k]) merged[k] = { uuid: "", offset };
-    writeFileSync15(path2, JSON.stringify(merged), "utf8");
+    writeFileSync16(path2, JSON.stringify(merged), "utf8");
   } catch {
   }
 }
@@ -52459,7 +52526,7 @@ function gitSourceWatchTargets(root) {
         ["-C", root, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"],
         { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }
       );
-      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join23(root, d) + sep4));
+      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join24(root, d) + sep4));
     } catch {
     }
     const hasIgnoredChild = (dir) => ignoredDirs.some((ig) => ig.startsWith(dir + "/"));
@@ -52471,19 +52538,19 @@ function gitSourceWatchTargets(root) {
         if (!f.startsWith(prefix)) continue;
         const rest2 = f.slice(prefix.length);
         if (rest2.includes("/")) children.add(dir === "" ? rest2.slice(0, rest2.indexOf("/")) : dir + "/" + rest2.slice(0, rest2.indexOf("/")));
-        else targets.add(join23(root, f));
+        else targets.add(join24(root, f));
       }
       for (const c of children) {
-        if (IGNORED_PATH.test(join23(root, c) + sep4)) continue;
+        if (IGNORED_PATH.test(join24(root, c) + sep4)) continue;
         if (hasIgnoredChild(c)) addUnder(c);
-        else targets.add(join23(root, c));
+        else targets.add(join24(root, c));
       }
     };
     addUnder("");
     if (targets.size > 0) return [...targets];
   } catch {
   }
-  return readdirSync9(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join23(root, String(e.name)) + sep4)).map((e) => join23(root, String(e.name)));
+  return readdirSync9(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join24(root, String(e.name)) + sep4)).map((e) => join24(root, String(e.name)));
 }
 function createWorkspaceEngine(opts) {
   const paths = workspacePaths(opts.workspaceRoot);
@@ -52498,6 +52565,10 @@ function createWorkspaceEngine(opts) {
     refreshRepoLocator(opts.workspaceRoot, profile);
   }
   const store = openGraphStore({ path: paths.castalia });
+  let witnessQueue = pruneWitnessQueue(
+    loadWitnessQueue(witnessQueuePath(paths.configDir)),
+    Date.now()
+  );
   const log = openEventLog({ path: paths.eventLog });
   const bundled = import.meta.url.endsWith(".mjs");
   const passWorker = bundled && paths.castalia !== ":memory:" ? new PassWorker({
@@ -52637,7 +52708,7 @@ function createWorkspaceEngine(opts) {
       const srcPaths = diff.changedPaths.filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(p));
       let episodeId2;
       if (srcPaths.length > 0) {
-        const abs = srcPaths.map((p) => join23(opts.workspaceRoot, p));
+        const abs = srcPaths.map((p) => join24(opts.workspaceRoot, p));
         try {
           const r = await runReindexPass(
             `git-reindex:${profile.name} (${abs.length} files)`,
@@ -52673,7 +52744,7 @@ function createWorkspaceEngine(opts) {
         `[errata] git: ${ev.kind} ${ev.newSha.slice(0, 7)} by ${meta3.authorName} \u2014 ${diff.changedPaths.length} file(s), ${diff.renames.length} rename(s)`
       );
     };
-    const gitDir = join23(opts.workspaceRoot, ".git");
+    const gitDir = join24(opts.workspaceRoot, ".git");
     if (existsSync19(gitDir)) {
       stopGit = startGitSensor(gitDir, (ev) => {
         void handleGitEvent(ev).catch((err2) => {
@@ -52744,10 +52815,10 @@ function createWorkspaceEngine(opts) {
     });
     doneRender?.();
     writeContextFile(opts.workspaceRoot, body2);
-    const target = join23(opts.workspaceRoot, "AGENTS.md");
+    const target = join24(opts.workspaceRoot, "AGENTS.md");
     writeManagedBlock(target, { body: AGENTS_POINTER_BODY, stable: true, force: true });
     if (elicit) {
-      writePrimingHandles(join23(paths.configDir, "priming-handles.json"), [
+      writePrimingHandles(join24(paths.configDir, "priming-handles.json"), [
         ...snapshot.recentProblems.map((r) => r.node),
         // Resolved-band handles: the ✓ problem AND its Solution are citable
         // (a fix tag on an already-resolved problem no-ops idempotently; the
@@ -52952,7 +53023,7 @@ function createWorkspaceEngine(opts) {
       resultSummary: { exitCode: e.exitCode ?? 1, errorTokens: e.errorTokens }
     });
   };
-  const turnCursorPath = join23(paths.configDir, "turn-cursors.json");
+  const turnCursorPath = join24(paths.configDir, "turn-cursors.json");
   const lastTurnUuid = loadTurnCursors(turnCursorPath);
   const turnOffset = loadTurnOffsets(turnCursorPath);
   const sessionLastProblem = /* @__PURE__ */ new Map();
@@ -52976,7 +53047,7 @@ function createWorkspaceEngine(opts) {
     const t = Date.now();
     let processedTurns = 0;
     const elicit = isEdgeElicitationEnabled();
-    const handleMap = elicit ? readPrimingHandles(join23(paths.configDir, "priming-handles.json")) : {};
+    const handleMap = elicit ? readPrimingHandles(join24(paths.configDir, "priming-handles.json")) : {};
     const wsRoot = (opts.workspaceRoot ?? "").replace(/\\/g, "/");
     const toRel = (abs) => {
       const p = abs.replace(/\\/g, "/");
@@ -53318,18 +53389,83 @@ function createWorkspaceEngine(opts) {
             mintCiteEdge(solId, targetId, sl.relation, 0.4, { solutionStructure: true, hypothesis: true });
           }
         }
-        if (plan.refutes.length > 0 && typeof cloud.reportContradictions === "function") {
-          void cloud.reportContradictions({ daemonVersion: DAEMON_VERSION, projectId: profile.id, items: stampWitnessOrigin(plan.refutes, profile.id) }).then((r) => {
-            if (r?.recorded) console.log(`[errata] refute: ${r.recorded} contradiction(s) recorded`);
-          }).catch(
-            (err2) => console.warn("[errata] refute transport failed (continuing):", err2 instanceof Error ? err2.message : err2)
+        const citingSession = sessionOriginKey(sessionId);
+        const mintedHere = (nodeId) => store.getNode(nodeId)?.attrs["sources"]?.[0] === sessionId;
+        const sendWitnesses = async (channel, fresh, send) => {
+          const queued = pendingFor(witnessQueue, channel);
+          if (fresh.length === 0 && queued.length === 0) return;
+          const groups = /* @__PURE__ */ new Map();
+          for (const q of queued) {
+            const g = groups.get(q.sessionKey) ?? [];
+            g.push({ nodeId: q.nodeId, witnessKey: q.witnessKey });
+            groups.set(q.sessionKey, g);
+          }
+          const freshGroup = groups.get(citingSession) ?? [];
+          for (const f of fresh) {
+            if (freshGroup.some((x) => x.witnessKey === f.witnessKey)) continue;
+            freshGroup.push(f);
+          }
+          groups.set(citingSession, freshGroup);
+          const settled = /* @__PURE__ */ new Set();
+          const stillUnmatched = [];
+          let recorded = 0, unmatched = 0, duplicate = 0, selfGated = 0;
+          for (const [session, items2] of groups) {
+            if (items2.length === 0) continue;
+            try {
+              const raw2 = await send(items2, session);
+              const d = {
+                recorded: raw2?.recorded ?? 0,
+                unmatched: raw2?.unmatched ?? 0,
+                duplicate: raw2?.duplicate ?? 0,
+                selfGated: raw2?.selfGated ?? 0,
+                unmatchedIds: raw2?.unmatchedIds ?? []
+              };
+              recorded += d.recorded;
+              unmatched += d.unmatched;
+              duplicate += d.duplicate;
+              selfGated += d.selfGated;
+              const missing = new Set(d.unmatchedIds);
+              for (const it of items2) {
+                if (missing.has(it.nodeId)) stillUnmatched.push({ channel, ...it, sessionKey: session });
+                else settled.add(it.witnessKey);
+              }
+            } catch (err2) {
+              console.warn(`[errata] ${channel} transport failed (witnesses kept for retry):`, err2 instanceof Error ? err2.message : err2);
+              for (const it of items2) stillUnmatched.push({ channel, ...it, sessionKey: session });
+            }
+          }
+          witnessQueue = retireWitnesses(witnessQueue, channel, settled);
+          witnessQueue = enqueueWitnesses(witnessQueue, stillUnmatched, Date.now());
+          saveWitnessQueue(witnessQueuePath(paths.configDir), witnessQueue);
+          console.log(
+            `[errata] ${channel}: ${formatDisposition({ recorded, unmatched, duplicate, selfGated })}` + (queued.length > 0 ? ` (incl. ${queued.length} replayed)` : "")
+          );
+        };
+        if (typeof cloud.reportContradictions === "function") {
+          await sendWitnesses(
+            "contradict",
+            plan.refutes,
+            (items2, session) => cloud.reportContradictions({
+              daemonVersion: DAEMON_VERSION,
+              projectId: profile.id,
+              ...session ? { sessionId: session } : {},
+              items: stampWitnessOrigin(items2, profile.id)
+            })
           );
         }
-        if (plan.corroborations.length > 0 && typeof cloud.reportCorroborations === "function") {
-          void cloud.reportCorroborations({ daemonVersion: DAEMON_VERSION, projectId: profile.id, items: stampWitnessOrigin(plan.corroborations, profile.id) }).then((r) => {
-            if (r?.recorded) console.log(`[errata] corroborate: ${r.recorded} corroboration(s) recorded`);
-          }).catch(
-            (err2) => console.warn("[errata] corroboration transport failed (continuing):", err2 instanceof Error ? err2.message : err2)
+        if (typeof cloud.reportCorroborations === "function") {
+          const emit = plan.corroborations.filter((c) => !mintedHere(c.nodeId));
+          const skipped = plan.corroborations.length - emit.length;
+          if (skipped > 0) console.log(`[errata] corroborate: ${skipped} skipped (this session authored the node)`);
+          await sendWitnesses(
+            "corroborate",
+            emit,
+            (items2, session) => cloud.reportCorroborations({
+              daemonVersion: DAEMON_VERSION,
+              projectId: profile.id,
+              ...session ? { sessionId: session } : {},
+              items: stampWitnessOrigin(items2, profile.id)
+            })
           );
         }
       } catch (err2) {
@@ -53522,7 +53658,7 @@ function createWorkspaceEngine(opts) {
     try {
       const inputs = emitInputsFromManifest(paths.configDir, paths.skillsManifest);
       emitAndProjectSkills(opts.workspaceRoot, inputs);
-      writePrimingHandles(join23(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
+      writePrimingHandles(join24(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
     } catch (err2) {
       console.warn("[skills] agent-skills projection failed (non-fatal):", err2 instanceof Error ? err2.message : err2);
     }
@@ -53796,7 +53932,7 @@ async function startDaemon(opts) {
     reviewUrl: () => webUiUrl + "/review"
   });
   const writeLockFile = (url2) => {
-    writeFileSync16(
+    writeFileSync17(
       engine.paths.daemonLock,
       JSON.stringify({ pid: process.pid, webUiUrl: url2, startedAt: Date.now() }),
       "utf8"
@@ -53856,16 +53992,16 @@ async function listenServer(fetchFn, port) {
 
 // src/registry.ts
 init_paths();
-import { existsSync as existsSync21, readFileSync as readFileSync19, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync20, writeFileSync as writeFileSync18 } from "node:fs";
+import { join as join25 } from "node:path";
 function registryPath() {
-  return process.env["ERRATA_REGISTRY_PATH"] ?? join24(globalDir(), "workspaces.json");
+  return process.env["ERRATA_REGISTRY_PATH"] ?? join25(globalDir(), "workspaces.json");
 }
 function read() {
   const p = registryPath();
   if (!existsSync21(p)) return { version: 1, workspaces: {} };
   try {
-    const parsed = JSON.parse(readFileSync19(p, "utf8"));
+    const parsed = JSON.parse(readFileSync20(p, "utf8"));
     return { version: 1, workspaces: parsed.workspaces ?? {} };
   } catch {
     return { version: 1, workspaces: {} };
@@ -53873,7 +54009,7 @@ function read() {
 }
 function write(reg) {
   ensureDir(globalDir());
-  writeFileSync17(registryPath(), JSON.stringify(reg, null, 2), "utf8");
+  writeFileSync18(registryPath(), JSON.stringify(reg, null, 2), "utf8");
 }
 function registerWorkspace(profile, root, now = Date.now()) {
   const reg = read();
@@ -53905,7 +54041,7 @@ function workspaceStatus(entry) {
   let webUiUrl = null;
   if (existsSync21(lockPath)) {
     try {
-      const lock = JSON.parse(readFileSync19(lockPath, "utf8"));
+      const lock = JSON.parse(readFileSync20(lockPath, "utf8"));
       if (lock.pid && lock.webUiUrl && pidAlive(lock.pid)) {
         running = true;
         webUiUrl = lock.webUiUrl;
@@ -53933,7 +54069,7 @@ function pidAlive(pid) {
 // src/multi.ts
 init_dist();
 init_src4();
-import { readFileSync as readFileSync22, unlinkSync as unlinkSync3, writeFileSync as writeFileSync18 } from "node:fs";
+import { readFileSync as readFileSync23, unlinkSync as unlinkSync3, writeFileSync as writeFileSync19 } from "node:fs";
 
 // src/principle-sync.ts
 init_src4();
@@ -53961,8 +54097,8 @@ init_reconcile();
 
 // src/lockfile-auto.ts
 init_src();
-import { existsSync as existsSync22, readFileSync as readFileSync20 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync21 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // src/package-index.ts
 init_src();
@@ -54111,11 +54247,11 @@ function runLockfilePass(opts) {
     { file: "package-lock.json", parse: parsePackageLockJson }
   ];
   for (const c of candidates) {
-    const p = join25(opts.root, c.file);
+    const p = join26(opts.root, c.file);
     if (!existsSync22(p)) continue;
     let sbom;
     try {
-      sbom = c.parse(readFileSync20(p, "utf8"));
+      sbom = c.parse(readFileSync21(p, "utf8"));
     } catch {
       continue;
     }
@@ -54225,10 +54361,15 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
   const level = opts.level ?? 1;
   const noveltyOpts = opts.dedupCosine != null ? { dedupCosine: opts.dedupCosine } : {};
   const ignored = (text) => ignorePatterns.length > 0 && ignorePatterns.some((p) => text.toLowerCase().includes(p));
+  const originSessionOf = (n) => {
+    const key = sessionOriginKey(n.attrs["sources"]?.[0]);
+    return key ? { originSession: key } : {};
+  };
   const shareable = (n) => ({
     ...n,
     description: generalize(n.description, { level }).text,
     embedding: [],
+    ...originSessionOf(n),
     attrs: {
       scope: stripCodebaseScope(n.attrs["scope"]),
       ...n.attrs["kind"] ? { kind: n.attrs["kind"] } : {},
@@ -54558,7 +54699,7 @@ var ConsolidateWorker = class {
 init_paths();
 
 // src/lock.ts
-import { existsSync as existsSync23, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync22 } from "node:fs";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
   try {
@@ -54571,7 +54712,7 @@ function isProcessAlive(pid) {
 function readDaemonLock(lockPath) {
   if (!existsSync23(lockPath)) return null;
   try {
-    const lock = JSON.parse(readFileSync21(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync22(lockPath, "utf8"));
     return typeof lock.pid === "number" ? lock : null;
   } catch {
     return null;
@@ -54814,12 +54955,12 @@ async function reanchorProject(opts) {
 
 // src/adopt.ts
 import { existsSync as existsSync24 } from "node:fs";
-import { dirname as dirname9, join as join26 } from "node:path";
+import { dirname as dirname10, join as join27 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync24(join26(dir, ".git"))) return dir;
-    const parent = dirname9(dir);
+    if (existsSync24(join27(dir, ".git"))) return dir;
+    const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -55067,7 +55208,7 @@ async function startMultiDaemon(opts = {}) {
     void ambientLinkAll();
     app.route(`/ws/${rec.id}`, rec.webApp);
     try {
-      writeFileSync18(
+      writeFileSync19(
         rec.engine.paths.daemonLock,
         JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${rec.id}`, startedAt: Date.now() }),
         "utf8"
@@ -55256,7 +55397,7 @@ async function startMultiDaemon(opts = {}) {
   baseUrl = `http://127.0.0.1:${port}`;
   try {
     ensureDir(globalDir());
-    writeFileSync18(
+    writeFileSync19(
       lockPath,
       JSON.stringify({ pid: process.pid, webUiUrl: baseUrl, startedAt: Date.now() }),
       "utf8"
@@ -55265,7 +55406,7 @@ async function startMultiDaemon(opts = {}) {
   }
   for (const r of records) {
     try {
-      writeFileSync18(
+      writeFileSync19(
         r.engine.paths.daemonLock,
         JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${r.id}`, startedAt: Date.now() }),
         "utf8"
@@ -55748,7 +55889,7 @@ async function startMultiDaemon(opts = {}) {
     },
     async stop() {
       try {
-        const cur = readFileSync22(lockPath, "utf8");
+        const cur = readFileSync23(lockPath, "utf8");
         if (JSON.parse(cur).pid === process.pid) unlinkSync3(lockPath);
       } catch {
       }
@@ -56766,20 +56907,20 @@ async function cmdInit() {
     console.log("");
     console.log("installing harness hooks...");
     const { existsSync: existsSync26 } = await import("node:fs");
-    const { join: join28 } = await import("node:path");
+    const { join: join29 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync26(join28(ROOT, ".cursor"))) {
+    if (existsSync26(join29(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
         console.warn(`  \u26A0\uFE0F  Cursor MCP config failed: ${err2 instanceof Error ? err2.message : err2}`);
       }
     }
-    if (existsSync26(join28(ROOT, ".codex"))) {
+    if (existsSync26(join29(ROOT, ".codex"))) {
       try {
         await installCodexHooks(port);
       } catch (err2) {
@@ -57593,7 +57734,7 @@ async function cmdReview() {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync23(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync24(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -58303,7 +58444,7 @@ async function gatherReportData(generatedAt) {
   };
 }
 async function cmdReport(args2) {
-  const { mkdirSync: mkdirSync8, writeFileSync: writeFileSync19 } = await import("node:fs");
+  const { mkdirSync: mkdirSync8, writeFileSync: writeFileSync20 } = await import("node:fs");
   const { renderReport: renderReport2 } = await Promise.resolve().then(() => (init_report_render(), report_render_exports));
   const includeFutureVerbs = args2.includes("--future-verbs");
   const now = /* @__PURE__ */ new Date();
@@ -58316,8 +58457,8 @@ async function cmdReport(args2) {
   const outDir = workspacePaths(ROOT).configDir;
   mkdirSync8(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync19(join27(outDir, f.name), f.html, "utf8");
-  const indexPath = join27(outDir, "report.html");
+  for (const f of files) writeFileSync20(join28(outDir, f.name), f.html, "utf8");
+  const indexPath = join28(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -58369,7 +58510,7 @@ function spawnDaemonDetached() {
   try {
     const logPath = daemonLogPath();
     try {
-      if (statSync6(logPath).size > 5 * 1024 * 1024) renameSync3(logPath, `${logPath}.1`);
+      if (statSync6(logPath).size > 5 * 1024 * 1024) renameSync4(logPath, `${logPath}.1`);
     } catch {
     }
     out2 = openSync2(logPath, "a");
@@ -58435,15 +58576,15 @@ function hookRelayCommand(port, path2) {
   return process.platform === "win32" ? `cmd //c "curl -s --connect-timeout 1 --max-time 2 -X POST -H \\"Content-Type: application/json\\" --data-binary @- ${url2} 2>NUL || echo {}"` : `curl -s --connect-timeout 1 --max-time 2 -X POST -H 'Content-Type: application/json' --data-binary @- ${url2} 2>/dev/null || echo '{}'`;
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync24, writeFileSync: writeFileSync19 } = await import("node:fs");
-  const { join: join28 } = await import("node:path");
-  const dir = join28(ROOT, ".claude");
+  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync25, writeFileSync: writeFileSync20 } = await import("node:fs");
+  const { join: join29 } = await import("node:path");
+  const dir = join29(ROOT, ".claude");
   if (!existsSync26(dir)) mkdirSync8(dir, { recursive: true });
-  const file2 = join28(dir, "settings.json");
+  const file2 = join29(dir, "settings.json");
   let settings = {};
   if (existsSync26(file2)) {
     try {
-      settings = JSON.parse(readFileSync24(file2, "utf8"));
+      settings = JSON.parse(readFileSync25(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -58489,10 +58630,10 @@ async function installClaudeHooks(port) {
     dropErrata(list);
     list.push({ hooks: [{ type: "command", command: injectCmd }] });
   }
-  writeFileSync19(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  writeFileSync20(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code hooks \u2192 ${file2}`);
   await installClaudeMcpConfig();
-  const claudeMd = join28(ROOT, "CLAUDE.md");
+  const claudeMd = join29(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -58504,15 +58645,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync24, writeFileSync: writeFileSync19 } = await import("node:fs");
-  const { join: join28, dirname: dirname10 } = await import("node:path");
-  const file2 = join28(ROOT, ".mcp.json");
-  const dir = dirname10(file2);
+  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync25, writeFileSync: writeFileSync20 } = await import("node:fs");
+  const { join: join29, dirname: dirname11 } = await import("node:path");
+  const file2 = join29(ROOT, ".mcp.json");
+  const dir = dirname11(file2);
   if (!existsSync26(dir)) mkdirSync8(dir, { recursive: true });
   let cfg = {};
   if (existsSync26(file2)) {
     try {
-      cfg = JSON.parse(readFileSync24(file2, "utf8"));
+      cfg = JSON.parse(readFileSync25(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -58520,21 +58661,21 @@ async function installClaudeMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync19(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync20(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code MCP server config \u2192 ${file2}`);
   console.log(`  Claude Code will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync24, writeFileSync: writeFileSync19 } = await import("node:fs");
-  const { join: join28 } = await import("node:path");
-  const dir = join28(ROOT, ".cursor");
+  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync25, writeFileSync: writeFileSync20 } = await import("node:fs");
+  const { join: join29 } = await import("node:path");
+  const dir = join29(ROOT, ".cursor");
   if (!existsSync26(dir)) mkdirSync8(dir, { recursive: true });
-  const file2 = join28(dir, "mcp.json");
+  const file2 = join29(dir, "mcp.json");
   let cfg = {};
   if (existsSync26(file2)) {
     try {
-      cfg = JSON.parse(readFileSync24(file2, "utf8"));
+      cfg = JSON.parse(readFileSync25(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -58542,7 +58683,7 @@ async function installCursorMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync19(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync20(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Cursor MCP server config \u2192 ${file2}`);
   console.log(`  Cursor will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses`);
@@ -58550,16 +58691,16 @@ async function installCursorMcpConfig() {
   console.log(`  \u26A0\uFE0F  reload Cursor (Cmd/Ctrl-Shift-P \u2192 "Reload Window") to pick it up.`);
 }
 async function installCodexHooks(port) {
-  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync24, writeFileSync: writeFileSync19 } = await import("node:fs");
-  const { join: join28 } = await import("node:path");
-  const dir = join28(ROOT, ".codex");
+  const { mkdirSync: mkdirSync8, existsSync: existsSync26, readFileSync: readFileSync25, writeFileSync: writeFileSync20 } = await import("node:fs");
+  const { join: join29 } = await import("node:path");
+  const dir = join29(ROOT, ".codex");
   if (!existsSync26(dir)) mkdirSync8(dir, { recursive: true });
-  const file2 = join28(dir, "config.toml");
+  const file2 = join29(dir, "config.toml");
   const BEGIN = `# >>> errata hooks (errata-managed)`;
   const END = `# <<< errata hooks`;
   let existing = "";
   if (existsSync26(file2)) {
-    existing = readFileSync24(file2, "utf8");
+    existing = readFileSync25(file2, "utf8");
     const beginIdx = existing.indexOf(BEGIN);
     const endIdx = existing.indexOf(END);
     if (beginIdx >= 0 && endIdx > beginIdx) {
@@ -58588,7 +58729,7 @@ ${END}
   const final = existing.length > 0 && !existing.endsWith("\n") ? `${existing}
 
 ${block}` : existing + (existing.endsWith("\n\n") ? "" : "\n") + block;
-  writeFileSync19(file2, final, "utf8");
+  writeFileSync20(file2, final, "utf8");
   console.log(`installed Codex hooks \u2192 ${file2}`);
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
   console.log("");
@@ -58902,7 +59043,7 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile);
-        const res = bleedRules(join27(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join28(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.2-dev.226",
+  "version": "2.0.2-dev.227",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -15170,6 +15170,15 @@ var init_wire = __esm({
       /** Canonical human-readable description (no raw paths — daemon scrubs; server rechecks). */
       description: external_exports.string().min(1).max(4e3),
       attrs: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
+      /** One-way origin key of the SESSION that minted this node (`ws_…`, a
+       *  truncated digest — never the raw session id). Stamped onto the created
+       *  node as `authoringSession`, which is the independence unit for the
+       *  evidence channels: the session that authored a claim may not corroborate
+       *  or refute it, while a DIFFERENT session on the same checkout may (alyssa,
+       *  2026-07-31 — the workspace key made every witness on a single-checkout
+       *  deployment a self-corroboration). Optional + additive: absent leaves the
+       *  gate fail-open for that node, exactly today's behaviour. */
+      originSession: external_exports.string().min(3).max(64).optional(),
       extractionSource: external_exports.enum(INGEST_EXTRACTION_SOURCES),
       validationSource: external_exports.enum(VALIDATION_SOURCES).optional(),
       /** Org-membrane (M2): the daemon's anchor tag — it owns the lockfile, so it