@inerrata-corporation/errata 2.0.20 → 2.0.21-dev.3716

package/errata.mjs

@@ -137,6 +137,9 @@ var init_castalia = __esm({
       "probe-failed"
     ];
     ROUTING_REASONS = [
+      "trusted-system-public",
+      "public-target-staged",
+      "source-membrane",
       /** Harness org (CTF lane, e2e battery, canary) — forced org-private. */
       "harness-clamp",
       "witnessed-vulnerability-private",
@@ -18594,6 +18597,11 @@ CREATE INDEX IF NOT EXISTS nodes_live_description ON nodes(description, label) W
 -- Problems by the file their anchor hint names: the harvest upgrades hints for
 -- every edited file of every turn, and a scan parses every Problem's attrs.
 CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_json, '$.anchorHint.path')) WHERE valid_to IS NULL;
+-- Nodes still waiting on a root-cause ask. The MCP server checks this on EVERY
+-- tool response (the enrichment piggyback), so it must not parse every
+-- Solution's and Problem's attrs per call. Not partial: the Problem pull reads
+-- closed versions too.
+CREATE INDEX IF NOT EXISTS nodes_enrichment_pending ON nodes(json_extract(attrs_json, '$.enrichmentPending'));
 `;
     FINGERPRINT_INDEXED_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
     NODE_LABELS_CHUNK = 256;
@@ -19194,7 +19202,10 @@ CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_js
         }));
       }
       findAllVersionsByLabel(label, attribute) {
-        const rows = attribute ? this.db.prepare("SELECT * FROM nodes WHERE label = ? AND json_extract(attrs_json, ?) = ?").all(label, `$.${attribute.path}`, attribute.value) : this.stmts.findByLabelAll.all(label);
+        if (attribute && !/^[A-Za-z0-9_]+(\.[A-Za-z0-9_]+)*$/.test(attribute.path)) {
+          throw new Error(`invalid attr path: ${attribute.path}`);
+        }
+        const rows = attribute ? this.db.prepare(`SELECT * FROM nodes WHERE json_extract(attrs_json, '$.${attribute.path}') = ? AND label = ?`).all(attribute.value, label) : this.stmts.findByLabelAll.all(label);
         return rows.map(rowToNode);
       }
       searchNodes(opts) {
@@ -19219,6 +19230,21 @@ CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_js
         const rows = this.db.prepare(sql).all(params);
         return rows.map(rowToNode);
       }
+      searchDescriptionTerms(terms, limit) {
+        if (terms.length === 0) return [];
+        const score2 = terms.map(() => "(description LIKE ?)").join(" + ");
+        const rows = this.db.prepare(
+          `SELECT n.*, h.m AS matched
+           FROM (SELECT rowid AS rid, ${score2} AS m
+                   FROM nodes INDEXED BY nodes_live_description
+                  WHERE valid_to IS NULL) h
+           JOIN nodes n ON n.rowid = h.rid
+          WHERE h.m > 0
+          ORDER BY h.m DESC, n.page_rank DESC, n.last_updated_at DESC
+          LIMIT ?`
+        ).all(...terms.map((t) => `%${t}%`), Math.max(1, limit));
+        return rows.map((r) => ({ node: rowToNode(r), matched: Number(r.matched) }));
+      }
       typedEdgeStmt(sql) {
         let stmt = this.typedEdgeStmts.get(sql);
         if (!stmt) {
@@ -21681,7 +21707,11 @@ function priorsForFile(store, relPath) {
   const resolvedProblems = [];
   const seenProblem = /* @__PURE__ */ new Set();
   const related = /* @__PURE__ */ new Map();
-  for (const e of store.inEdges(file2.id, ["ANCHORED_AT"])) {
+  const anchorEdges = [
+    ...store.inEdges(file2.id, ["ANCHORED_AT"]),
+    ...store.outEdges(file2.id, ["DEFINES"]).flatMap((d) => store.inEdges(d.to, ["ANCHORED_AT"]))
+  ];
+  for (const e of anchorEdges) {
     const n = store.getNode(e.from);
     if (!n) continue;
     if (n.label === "Problem" || n.label === "Vulnerability") {
@@ -21929,12 +21959,21 @@ function resolveDesignProblemByStatement(store, statement, fixNote, t) {
   const problemId = identityId({ kind: "DesignProblem", statement });
   return closeDesignProblem(store, problemId, fixNote, t);
 }
+function closableByCaller(node2) {
+  if (node2.attrs["source"] !== "cloud") return true;
+  const visibility = node2.attrs["visibility"];
+  return typeof visibility === "string" && MEMBER_VISIBILITIES.has(visibility);
+}
+function isVerdictable(node2) {
+  return node2.label === "Problem" && node2.attrs["resolvedAt"] == null && (node2.validTo ?? null) === null && !isConstraintProblem(node2) && node2.attrs["kind"] !== "todo";
+}
 function resolveDesignProblemById(store, id, fixNote, t) {
   return closeDesignProblem(store, id.trim(), fixNote, t);
 }
 function closeDesignProblem(store, problemId, fixNote, t) {
   const p = store.getNode(problemId);
   if (!p || p.label !== "Problem" && p.label !== "Vulnerability") return false;
+  if (!closableByCaller(p)) return false;
   if (p.attrs["resolvedAs"]) return false;
   if (fixNote?.trim() && !isFragmentFixNote(fixNote)) {
     const sols = store.outEdges(problemId, ["SOLVED_BY"]).map((e) => store.getNode(e.to)).filter((n) => n !== null);
@@ -22007,6 +22046,7 @@ function retractDesignProblemByStatement(store, statement, resolvedAs, reason, t
 function retractDesignProblem(store, problemId, resolvedAs, reason, t) {
   const p = store.getNode(problemId);
   if (!p || p.label !== "Problem" || p.attrs["resolvedAt"]) return false;
+  if (!closableByCaller(p)) return false;
   store.updateNode(problemId, {
     attrs: {
       ...p.attrs,
@@ -22142,7 +22182,7 @@ function priorExposure(store, nodeId, atSeq) {
   if ((n.attrs["evictedCount"] ?? 0) > 0) return "evicted";
   return "unshown";
 }
-var DESIGN_PROMOTE_AT, STATEMENT_ALIAS_CAP, RECURRENCE_DEBOUNCE_MS, PATTERN_DEDUP_COSINE, PATTERN_ALIAS_CAP, DEDUP_STOPWORDS, SAME_ANCHOR_DEDUP_JACCARD, EMPTY_FOLD_REPORT, SAME_ANCHOR_SCOUT_AUTO_COSINE, SAME_ANCHOR_SCOUT_MIN_COSINE, SAME_ANCHOR_NOMINATE_JACCARD, REOPEN_MIN_SOURCES, RECURRENCE_SOURCES_CAP, CITABLE_PRIOR_LABELS, MAX_ANCHOR_FILES, ENCLOSING_SYMBOL_KINDS, ENCLOSING_WALK_DEPTH, FIX_CANDIDATE_ASK_LIMIT;
+var DESIGN_PROMOTE_AT, STATEMENT_ALIAS_CAP, RECURRENCE_DEBOUNCE_MS, PATTERN_DEDUP_COSINE, PATTERN_ALIAS_CAP, DEDUP_STOPWORDS, SAME_ANCHOR_DEDUP_JACCARD, EMPTY_FOLD_REPORT, SAME_ANCHOR_SCOUT_AUTO_COSINE, SAME_ANCHOR_SCOUT_MIN_COSINE, SAME_ANCHOR_NOMINATE_JACCARD, REOPEN_MIN_SOURCES, RECURRENCE_SOURCES_CAP, CITABLE_PRIOR_LABELS, MAX_ANCHOR_FILES, ENCLOSING_SYMBOL_KINDS, ENCLOSING_WALK_DEPTH, MEMBER_VISIBILITIES, FIX_CANDIDATE_ASK_LIMIT;
 var init_design_problem = __esm({
   "../../packages/local-graph/src/design-problem.ts"() {
     "use strict";
@@ -22219,6 +22259,7 @@ var init_design_problem = __esm({
       "Property"
     ]);
     ENCLOSING_WALK_DEPTH = 8;
+    MEMBER_VISIBILITIES = /* @__PURE__ */ new Set(["project", "team", "org"]);
     FIX_CANDIDATE_ASK_LIMIT = 5;
   }
 });
@@ -25358,6 +25399,7 @@ __export(src_exports2, {
   clearAnsweredRevisits: () => clearAnsweredRevisits,
   clearRevisit: () => clearRevisit,
   clearSettledFixCandidates: () => clearSettledFixCandidates,
+  closableByCaller: () => closableByCaller,
   communityInductionRequests: () => communityInductionRequests,
   communitySeeds: () => communitySeeds,
   compareSemver: () => compareSemver,
@@ -25396,6 +25438,7 @@ __export(src_exports2, {
   isFragmentFixNote: () => isFragmentFixNote,
   isPlaceholderStatement: () => isPlaceholderStatement,
   isUnfilledPlaceholder: () => isUnfilledPlaceholder,
+  isVerdictable: () => isVerdictable,
   learnedConductance: () => learnedConductance,
   linkProblemToLanguages: () => linkProblemToLanguages,
   linkProblemToPackages: () => linkProblemToPackages,
@@ -25923,6 +25966,13 @@ function renderSnapshot(s) {
       lines.push("_Priors that speak to it \u2014 cite one with its `[handle]` if you lean on it:_");
       for (const h of si.hits) {
         lines.push(`- **${h.description}** \u2014 \`${h.id}\``);
+        if (h.verdict === "own") {
+          lines.push(
+            `  - still open \u2014 did this work settle it? fixed \u2192 (fix:[${h.id}]) \xB7 not a real problem \u2192 an \`errata-resolved\` block with \`id: ` + h.id + "`, `disposition: false_positive`, `reason: \u2026` \xB7 still open \u2192 say nothing"
+          );
+        } else if (h.verdict === "foreign") {
+          lines.push(`  - open in another membrane \u2014 not yours to close: (confirm:[${h.id}]) it held \xB7 (refute:[${h.id}] one line why)`);
+        }
       }
     }
     if (si.remoteHits?.length) {
@@ -27795,8 +27845,8 @@ var init_config = __esm({
     "use strict";
     init_paths();
     LEGACY_CLOUD_URL = "https://inerrata-gateway.onrender.com";
-    DEFAULT_CLOUD_URL = true ? "https://inerrata.dev" : DEV_CLOUD_URL;
-    DEFAULT_UPDATE_CHANNEL = true ? "latest" : "dev";
+    DEFAULT_CLOUD_URL = true ? "https://dev.inerrata.dev" : DEV_CLOUD_URL;
+    DEFAULT_UPDATE_CHANNEL = false ? "latest" : "dev";
   }
 });
 
@@ -32524,7 +32574,10 @@ var init_agent_signals = __esm({
       // lean-on corroboration lived, because only corroboration had an inline path. Grammar
       // single-sourced with parseInlineTags' CONFIRM_PREFIX/REFUTE_PREFIX.
       confirm: (ref) => `(confirm:[${ref}])`,
-      refute: (ref) => `(refute:[${ref}] one line why)`
+      refute: (ref) => `(refute:[${ref}] one line why)`,
+      // RETRACT — "not a real problem": the errata-resolved block with a disposition
+      // (parseDesignResolutions, turn.ts). No inline form exists; the block is the grammar.
+      retract: (id) => ["```errata-resolved", `id: ${id}`, "disposition: false_positive", "reason: why it was never a real problem", "```"].join("\n")
     };
     TAG_OPENERS = [
       ...new Set(
@@ -34414,6 +34467,19 @@ function buildSymbolLexicon(store) {
   }
   return lex;
 }
+function codeGraphKey(store) {
+  const files = store.labelFingerprint?.(["File"]);
+  if (files === void 0) return null;
+  return [files, ...LEXICON_SYMBOL_LABELS.map((l) => store.countNodesByLabel(l))].join("|");
+}
+function lexiconsFor(store) {
+  const key = codeGraphKey(store);
+  const hit = key !== null ? lexiconCache.get(store) : void 0;
+  if (hit && hit.key === key) return hit;
+  const built = { symbols: buildSymbolLexicon(store), files: buildFileLexicon(store) };
+  if (key !== null) lexiconCache.set(store, { key, ...built });
+  return built;
+}
 function replaceWithPhrase(text, before, escapedKey, after, phrase2) {
   if (!RE_LEADING_ARTICLE2.test(phrase2)) {
     return text.replace(new RegExp(`${before}${escapedKey}${after}`, "g"), phrase2);
@@ -34579,7 +34645,7 @@ function registerRenderedContributorLabels(labels) {
     if (trimmed.length >= 3) renderedContributorLabels.add(trimmed);
   }
 }
-var SYMBOL_LABELS2, KIND_PHRASE, BUILTIN_TYPE_NAMES, DOC_COMMENT_KINDS, MAX_DOC_CHARS, RE_RESERVED2, escapeRe4, RE_LEADING_ARTICLE2, CONVENTION_FILENAMES, CONVENTION_BASENAME_MIN_FILES, CONVENTION_STEMS, FILE_TOKEN_RE, STEM_TOKEN_RE, SOURCE_EXTENSIONS, TOKEN_RE3, renderedContributorLabels;
+var SYMBOL_LABELS2, KIND_PHRASE, BUILTIN_TYPE_NAMES, DOC_COMMENT_KINDS, MAX_DOC_CHARS, LEXICON_SYMBOL_LABELS, lexiconCache, RE_RESERVED2, escapeRe4, RE_LEADING_ARTICLE2, CONVENTION_FILENAMES, CONVENTION_BASENAME_MIN_FILES, CONVENTION_STEMS, FILE_TOKEN_RE, STEM_TOKEN_RE, SOURCE_EXTENSIONS, TOKEN_RE3, renderedContributorLabels;
 var init_generalize_graph = __esm({
   "src/generalize-graph.ts"() {
     "use strict";
@@ -34629,6 +34695,8 @@ var init_generalize_graph = __esm({
     ]);
     DOC_COMMENT_KINDS = /* @__PURE__ */ new Set(["docstring", "explanation"]);
     MAX_DOC_CHARS = 600;
+    LEXICON_SYMBOL_LABELS = ["Function", "Method", "Class", "Interface", "Const", "Comment"];
+    lexiconCache = /* @__PURE__ */ new WeakMap();
     RE_RESERVED2 = /[.*+?^${}()|[\]\\]/g;
     escapeRe4 = (s) => s.replace(RE_RESERVED2, "\\$&");
     RE_LEADING_ARTICLE2 = /^(?:an?|the)\s/i;
@@ -34831,19 +34899,18 @@ function isQuotaError(err2) {
   return status === 403 && /quota/i.test(msg);
 }
 async function dualAugment(opts) {
-  const { store, cloud, localHits, seedNode, queryText, limit } = opts;
+  const { store, cloud, localHits, seedNode, queryText, limit, generalizeSoft } = opts;
   const cloudHits = [];
   let seedUsageCount;
   let seedProvenance = "local";
   const calls = [];
   try {
-    const lexicon = buildSymbolLexicon(store);
     const hardIds = [.../* @__PURE__ */ new Set([...seedNode ? [seedNode.id] : [], ...localHits.map((h) => h.id)])].filter((nid) => {
       const n = seedNode && nid === seedNode.id ? seedNode : store.getNode(nid);
       return !!n && isHardBridge(n);
     });
     const softText = queryText ?? (seedNode && BRIDGE_LABELS.has(seedNode.label) ? seedNode.description : void 0);
-    const softQ = softText ? generalizeSymbols(softText, lexicon, 1) : void 0;
+    const softQ = softText ? await generalizeSoft?.(softText) ?? generalizeSymbols(softText, lexiconsFor(store).symbols, 1) : void 0;
     if (seedNode?.label === "Package") {
       calls.push(
         cloud.packages(seedNode.id).then((pn) => {
@@ -34955,6 +35022,50 @@ var init_dual_augment = __esm({
   }
 });
 
+// src/daemon-generalize-client.ts
+function daemonLoopbackUrl(lockPath = globalDaemonLock()) {
+  const url2 = readDaemonLock(lockPath)?.webUiUrl;
+  if (!url2) return null;
+  try {
+    const u = new URL(url2);
+    const isLoopback = u.hostname === "127.0.0.1" || u.hostname === "localhost" || u.hostname === "[::1]";
+    return u.protocol === "http:" && isLoopback ? u.origin : null;
+  } catch {
+    return null;
+  }
+}
+function daemonGeneralizer(workspaceRoot, opts = {}) {
+  const baseUrl = opts.baseUrl ?? (() => daemonLoopbackUrl());
+  const fetchFn = opts.fetchFn ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? DAEMON_GENERALIZE_TIMEOUT_MS;
+  return async (text) => {
+    try {
+      const base = baseUrl();
+      if (!base) return void 0;
+      const res = await fetchFn(`${base}/api/generalize`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ workspaceRoot, text }),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) return void 0;
+      const body2 = await res.json();
+      return typeof body2.generalized === "string" ? body2.generalized : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+}
+var DAEMON_GENERALIZE_TIMEOUT_MS;
+var init_daemon_generalize_client = __esm({
+  "src/daemon-generalize-client.ts"() {
+    "use strict";
+    init_lock();
+    init_paths();
+    DAEMON_GENERALIZE_TIMEOUT_MS = 3e3;
+  }
+});
+
 // ../../packages/indexer/src/parse-cache.ts
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync14, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync11 } from "node:fs";
@@ -43897,7 +44008,7 @@ __export(mcp_exports, {
 import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 function collectEnrichmentPulls(store, opts = {}) {
-  const pending = store.findNodesByLabel("Solution").filter((s) => s.attrs["enrichmentPending"] === true).filter((s) => !opts.onlyUnsurfaced || s.attrs["enrichmentSurfaced"] !== true);
+  const pending = store.findLiveNodesByAttr("Solution", "enrichmentPending", 1).filter((s) => s.attrs["enrichmentPending"] === true).filter((s) => !opts.onlyUnsurfaced || s.attrs["enrichmentSurfaced"] !== true);
   const byEpisode = /* @__PURE__ */ new Map();
   for (const s of pending) {
     const ep = s.attrs["episodeId"] ?? s.id;
@@ -44014,20 +44125,8 @@ function searchGraph(store, query, limit) {
   const terms = q.split(/\s+/).filter((t) => t.length >= 2);
   const pool = Math.max(limit * 3, 60);
   const raw2 = /* @__PURE__ */ new Map();
-  const collect2 = (nodes) => {
-    for (const n of nodes) {
-      const e = raw2.get(n.id);
-      if (e) e.matched++;
-      else raw2.set(n.id, { node: n, matched: 1 });
-    }
-  };
-  if (terms.length <= 1) {
-    collect2(store.searchNodes({ descriptionLike: q, limit: pool }));
-  } else {
-    for (const term of terms) {
-      collect2(store.searchNodes({ descriptionLike: term, limit: 200 }));
-    }
-  }
+  const scored = !q ? store.searchNodes({ limit: pool }).map((node2) => ({ node: node2, matched: 1 })) : terms.length <= 1 ? store.searchDescriptionTerms([q], pool) : store.searchDescriptionTerms(terms, Math.max(pool, 600));
+  for (const hit of scored) raw2.set(hit.node.id, hit);
   const merged = /* @__PURE__ */ new Map();
   const add = (node2, matched, via) => {
     const e = merged.get(node2.id);
@@ -44327,6 +44426,7 @@ async function runMcpServer(workspaceRoot, options = {}) {
   const store = openGraphStore({ path: paths.castalia });
   const handle2 = createMcpHandler(store, {
     ...buildToolContext(workspaceRoot),
+    generalizeSoft: daemonGeneralizer(workspaceRoot),
     sharedDbPath: sharedStorePath()
   }, options);
   process.stdin.setEncoding("utf8");
@@ -44372,6 +44472,7 @@ var init_mcp = __esm({
     init_src8();
     init_dual_burst();
     init_paths();
+    init_daemon_generalize_client();
     init_webui();
     init_reconcile();
     init_agent_signals();
@@ -44447,6 +44548,7 @@ var init_mcp = __esm({
             const dual = await dualAugment({
               store,
               cloud: ctx.cloud,
+              ...ctx.generalizeSoft ? { generalizeSoft: ctx.generalizeSoft } : {},
               localHits,
               queryText: query,
               limit
@@ -44626,6 +44728,7 @@ var init_mcp = __esm({
             const dual = await dualAugment({
               store,
               cloud: ctx.cloud,
+              ...ctx.generalizeSoft ? { generalizeSoft: ctx.generalizeSoft } : {},
               localHits,
               seedNode,
               limit: args2["limit"] != null ? Number(args2["limit"]) : 20
@@ -45197,6 +45300,7 @@ var init_mcp = __esm({
             const dual = await dualAugment({
               store,
               cloud: ctx.cloud,
+              ...ctx.generalizeSoft ? { generalizeSoft: ctx.generalizeSoft } : {},
               localHits,
               seedNode: node2,
               limit
@@ -53491,6 +53595,7 @@ __export(webui_exports, {
   asFailedPostToolUse: () => asFailedPostToolUse,
   buildWebUi: () => buildWebUi,
   decideContextInject: () => decideContextInject,
+  editVerdict: () => editVerdict,
   errorRecallTerms: () => errorRecallTerms,
   fileRecall: () => fileRecall,
   fileUriToFsPath: () => fileUriToFsPath,
@@ -53601,6 +53706,26 @@ ${lines.join("\n")}
     card
   };
 }
+function editVerdict(store, relPath) {
+  const priors = priorsForFile(store, relPath);
+  if (!priors || priors.openProblems.length === 0) return null;
+  const ranked = rankByRelevance(store, priors.file.id, priors.openProblems.map((n) => n.id));
+  const rank = new Map(ranked.map((r, i2) => [r.id, i2]));
+  const asked = [...priors.openProblems].sort((a, b) => (rank.get(a.id) ?? 0) - (rank.get(b.id) ?? 0)).slice(0, 3);
+  const lines = asked.map(
+    (p) => closableByCaller(p) ? recallLine(p, `fixed: ${TAG_EXAMPLE.fix(p.id)} \xB7 not a real problem: retract it (block below) \xB7 still open: say nothing`) : recallLine(p, `another membrane's \u2014 not yours to close: ${TAG_EXAMPLE.confirm(p.id)} it held \xB7 ${TAG_EXAMPLE.refute(p.id)}`)
+  );
+  const retractable = asked.find((p) => closableByCaller(p));
+  const shown = asked.map(deliveredPrior);
+  const headline = `verdict asked: ${plural(shown.length, "open problem")} on ${relPath.split("/").slice(-2).join("/")}`;
+  return {
+    context: `errata \u2014 you just edited ${relPath}; ${plural(priors.openProblems.length, "open problem")} recorded on it. Give each one below a verdict in your reply:
+${lines.join("\n")}
+` + (retractable ? `Retract (not a real problem):
+${TAG_EXAMPLE.retract(retractable.id)}` : ""),
+    card: deliveredCard(store, headline, shown) ?? { headline, items: [] }
+  };
+}
 function workspacePackageIds(store) {
   const hit = wsPackagesCache.get(store);
   const now = Date.now();
@@ -53671,6 +53796,7 @@ function buildWebUi(deps) {
   const B = deps.basePath ?? "";
   const lastInjectedHash = /* @__PURE__ */ new Map();
   const fileRecallSeen = /* @__PURE__ */ new Map();
+  const editVerdictAsked = /* @__PURE__ */ new Map();
   const lastSubagentInjectAt = /* @__PURE__ */ new Map();
   const noteSessionFrom = (headerOrigin, body2, ended = false) => {
     const { sessionId, agentId } = hookAudience(body2);
@@ -53935,6 +54061,27 @@ function buildWebUi(deps) {
         }
       }
     }
+    if (event === "PostToolUse" && !recall && rel && (tool === "Edit" || tool === "MultiEdit" || tool === "Write" || tool === "NotebookEdit")) {
+      const sid = hookAudience(body2).contextKey;
+      let asked = editVerdictAsked.get(sid);
+      if (!asked) {
+        asked = /* @__PURE__ */ new Set();
+        editVerdictAsked.set(sid, asked);
+      }
+      if (!asked.has(rel)) {
+        const verdict = editVerdict(deps.store, rel);
+        if (verdict) {
+          asked.add(rel);
+          let seen = fileRecallSeen.get(sid);
+          if (!seen) {
+            seen = /* @__PURE__ */ new Set();
+            fileRecallSeen.set(sid, seen);
+          }
+          seen.add(rel);
+          recall = verdict;
+        }
+      }
+    }
     if (event === "PostToolUse" && !recall && rel && (tool === "Read" || tool === "Edit" || tool === "Write" || tool === "NotebookEdit")) {
       const sid = hookAudience(body2).contextKey;
       let seen = fileRecallSeen.get(sid);
@@ -82706,7 +82853,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.20" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.21-dev.3716" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -83167,7 +83314,8 @@ function createWorkspaceEngine(opts) {
         id: h.node.id,
         label: h.node.label,
         description: h.node.description,
-        coverage: h.coverage
+        coverage: h.coverage,
+        ...isVerdictable(h.node) ? { verdict: closableByCaller(h.node) ? "own" : "foreign" } : {}
       })),
       ...collective && collective.hits.length > 0 ? {
         remoteHits: collective.hits.slice(0, 4).map((n) => ({ id: n.id, label: n.label, description: n.description }))
@@ -84176,7 +84324,11 @@ function createWorkspaceEngine(opts) {
           const closed = resolveDesignProblemById(store, pid, fx.fixNote, t);
           if (!closed) {
             const n = store.getNode(pid);
-            if (!n || n.label !== "Problem" && n.label !== "Vulnerability" || n.attrs["resolvedAs"] != null) {
+            if (n && n.attrs["resolvedAt"] == null && !closableByCaller(n)) {
+              console.warn(
+                `[errata] fix tag not applied: ${pid.slice(0, 32)} belongs to a membrane you are not in \u2014 a verdict closes only your own problems; cite it with (confirm:[id]) or (refute:[id] why) instead`
+              );
+            } else if (!n || n.label !== "Problem" && n.label !== "Vulnerability" || n.attrs["resolvedAs"] != null) {
               console.warn(
                 `[errata] fix tag went nowhere: ${!n ? `id ${pid.slice(0, 32)} unknown` : n.label !== "Problem" ? `${pid.slice(0, 32)} is a ${n.label}, not a Problem` : "the problem was retracted \u2014 a retraction is not fixable"} \u2014 the fix was NOT recorded`
               );
@@ -86732,21 +86884,7 @@ function liveBackoffMs(failures) {
 
 // src/drain-build.ts
 init_generalize_graph();
-var LEXICON_SYMBOL_LABELS = ["Function", "Method", "Class", "Interface", "Const", "Comment"];
-function codeGraphKey(store) {
-  const files = store.labelFingerprint?.(["File"]);
-  if (files === void 0) return null;
-  return [files, ...LEXICON_SYMBOL_LABELS.map((l) => store.countNodesByLabel(l))].join("|");
-}
-var lexiconCache = /* @__PURE__ */ new WeakMap();
-function lexiconsFor(store) {
-  const key = codeGraphKey(store);
-  const hit = key !== null ? lexiconCache.get(store) : void 0;
-  if (hit && hit.key === key) return hit;
-  const built = { symbols: buildSymbolLexicon(store), files: buildFileLexicon(store) };
-  if (key !== null) lexiconCache.set(store, { key, ...built });
-  return built;
-}
+init_generalize_graph();
 function buildDrainContext(store, input) {
   return buildContextIngest(store, input.profile, input.daemonVersion, input.ignorePatterns, {
     ...input.includePackages !== void 0 ? { includePackages: input.includePackages } : {}
@@ -86881,6 +87019,98 @@ var ConsolidateWorker = class {
   }
 };
 
+// src/generalize-worker-client.ts
+import { Worker as Worker3 } from "node:worker_threads";
+var GENERALIZE_WORKER_IDLE_MS = 30 * 6e4;
+var GeneralizeWorker = class {
+  worker = null;
+  ready = null;
+  pending = /* @__PURE__ */ new Map();
+  nextId = 1;
+  stopped = false;
+  idleTimer = null;
+  async generalize(castaliaPath, text) {
+    if (this.stopped) throw new Error("generalize worker stopped");
+    this.ensureWorker();
+    this.touch();
+    await this.ready;
+    const id = this.nextId++;
+    return new Promise((resolve10, reject) => {
+      this.pending.set(id, { resolve: resolve10, reject });
+      const req = { id, castaliaPath, text };
+      this.worker.postMessage(req);
+    });
+  }
+  touch() {
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    this.idleTimer = setTimeout(() => {
+      if (this.pending.size > 0) return this.touch();
+      const w = this.worker;
+      this.worker = null;
+      this.ready = null;
+      void w?.terminate().catch(() => {
+      });
+    }, GENERALIZE_WORKER_IDLE_MS);
+    this.idleTimer.unref?.();
+  }
+  ensureWorker() {
+    if (this.worker) return;
+    const worker = new Worker3(new URL("./generalize-worker.mjs", import.meta.url), {
+      workerData: {},
+      execArgv: process.execArgv,
+      resourceLimits: workerResourceLimits()
+    });
+    noteIsolateSpawned();
+    this.worker = worker;
+    this.ready = new Promise((resolve10, reject) => {
+      const onReady = (m) => {
+        if (m?.ready) {
+          worker.off("message", onReady);
+          worker.off("error", onErr);
+          resolve10();
+        }
+      };
+      const onErr = (err2) => {
+        worker.off("message", onReady);
+        reject(err2);
+      };
+      worker.once("error", onErr);
+      worker.on("message", onReady);
+    });
+    worker.on("message", (m) => {
+      if (typeof m?.id !== "number") return;
+      const p = this.pending.get(m.id);
+      if (!p) return;
+      this.pending.delete(m.id);
+      if (m.ok && typeof m.result === "string") p.resolve(m.result);
+      else p.reject(new Error(m.error ?? "generalization failed"));
+    });
+    const onGone = (err2) => {
+      const e = err2 instanceof Error ? err2 : new Error("generalize worker exited");
+      for (const [, p] of this.pending) p.reject(e);
+      this.pending.clear();
+      if (this.worker === worker) {
+        this.worker = null;
+        this.ready = null;
+      }
+    };
+    worker.on("error", onGone);
+    worker.on("exit", () => {
+      noteIsolateExited();
+      onGone();
+    });
+  }
+  async stop() {
+    this.stopped = true;
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    if (this.worker) {
+      await this.worker.terminate().catch(() => {
+      });
+      this.worker = null;
+    }
+  }
+};
+
 // src/prepare-store.ts
 init_src5();
 async function prepareStore(path2, root, workspaceId2) {
@@ -89836,6 +90066,7 @@ async function startMultiDaemon(opts = {}) {
   const sharedStore = openGraphStore({ path: sharedDbPath });
   const bundledRun = import.meta.url.endsWith(".mjs");
   const consolidateWorker = bundledRun && sharedDbPath !== ":memory:" ? new ConsolidateWorker() : null;
+  const generalizeWorker = bundledRun ? new GeneralizeWorker() : null;
   startLoopLagMonitor();
   let baseUrl = "";
   const records = [];
@@ -91523,6 +91754,7 @@ async function startMultiDaemon(opts = {}) {
         await Promise.allSettled(attaching.values());
         for (const r of records) await r.engine.stop();
         if (consolidateWorker) await consolidateWorker.stop();
+        if (generalizeWorker) await generalizeWorker.stop();
         try {
           sharedStore.close();
         } catch {
@@ -91551,6 +91783,33 @@ async function startMultiDaemon(opts = {}) {
     }
   });
   app.get("/api/sync", (c) => c.json(flushSnapshot()));
+  const GENERALIZE_MAX_CHARS = 8e3;
+  app.post("/api/generalize", async (c) => {
+    const host = (c.req.header("host") ?? "").toLowerCase();
+    if (!/^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/.test(host)) return c.json({ error: "forbidden" }, 403);
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) {
+      return c.json({ error: "json required" }, 415);
+    }
+    let body2;
+    try {
+      body2 = await c.req.json();
+    } catch {
+      return c.json({ error: "bad json" }, 400);
+    }
+    if (typeof body2.workspaceRoot !== "string" || typeof body2.text !== "string") {
+      return c.json({ error: "workspaceRoot and text required" }, 400);
+    }
+    if (body2.text.length > GENERALIZE_MAX_CHARS) return c.json({ error: "text too long" }, 413);
+    const entry = workspaceEntryForPath(pathResolve(body2.workspaceRoot));
+    if (!entry) return c.json({ error: "unregistered workspace" }, 404);
+    if (!generalizeWorker) return c.json({ error: "no worker" }, 503);
+    try {
+      const generalized = await generalizeWorker.generalize(workspacePaths(entry.path).castalia, body2.text);
+      return c.json({ generalized });
+    } catch (err2) {
+      return c.json({ error: err2 instanceof Error ? err2.message : String(err2) }, 503);
+    }
+  });
   app.post("/api/tick", async (c) => {
     try {
       return c.json({ reports: Object.fromEntries(await daemon.tickAll()) });
@@ -94099,7 +94358,7 @@ async function cmdInit() {
     }
     console.log("");
     console.log("connecting your cloud account...");
-    await cmdLoginOAuth(cfgNow);
+    await cmdLoginOAuth(cfgNow, false, false);
     cfgNow = loadConfig();
     if (!hasCloudCredential(cfgNow)) {
       console.error("init requires login \u2014 re-run `errata init`, or `errata init --no-login` to stay unlinked.");
@@ -94742,7 +95001,7 @@ async function warnIfApprovalUnreachable(url2) {
   } catch {
   }
 }
-async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
+async function cmdLoginOAuth(cfg, useBrowserLoopback = false, linkAfterLogin = true) {
   const inspection = await inspectCloudEndpoint(cfg.cloudUrl);
   try {
     assertCloudEndpointAllowed(cfg.cloudUrl, inspection);
@@ -94779,7 +95038,7 @@ async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
     nextCfg.email = me.handle;
     saveConfig(nextCfg);
     console.log(`logged in as ${me.handle} (${me.tier}) \u2014 tokens stored at ${globalConfigPath()}`);
-    await linkRegisteredWorkspaces(nextCfg);
+    if (linkAfterLogin) await linkRegisteredWorkspaces(nextCfg);
   } catch (err2) {
     console.error(`signed in, but identity check failed: ${err2 instanceof Error ? err2.message : err2}`);
     console.error(`  credentials were not stored; try again or paste a key:  errata login --token <key>`);