@kortexya/reasoninglayer 1.23.0 → 1.25.0

package/dist/index.d.cts

@@ -109,7 +109,7 @@ type JsonValue$1 = string | number | boolean | null | JsonValue$1[] | object;
  * This is the single source of truth for the version constant.
  * The `scripts/release.sh` script updates this value alongside `package.json`.
  */
-declare const SDK_VERSION = "1.23.0";
+declare const SDK_VERSION = "1.25.0";
 /**
  * Authentication mode for the SDK.
  *
@@ -764,11 +764,12 @@ interface AddRuleRequest$1 {
      */
     antecedents?: TermInputDto$1[];
     /**
-     * Certainty factor (default: 1.0)
+     * Certainty factor. `None` (absent) is a crisp rule — degree 1.0; an
+     * explicit `0.0` is the t-norm annihilator, a rule that can never
+     * contribute a proof. The two are distinct on the wire (#217).
      * @format double
-     * @default 1
      */
-    certainty?: number;
+    certainty?: number | null;
     /** The conclusion term (head of the rule) */
     term: TermInputDto$1;
 }
@@ -2645,7 +2646,7 @@ interface BindingSummaryDto$1 {
      * uniqueness constraint backs it or an operator ticked it, and those two
      * have opposite durability.
      */
-    key_provenance: KeyProvenanceDto;
+    key_provenance: KeyProvenanceDto$1;
     /** Sort ID (UUID string). */
     sort_id: string;
     /**
@@ -8052,7 +8053,7 @@ interface DiscoveredFeatureDto$1 {
      * rebuild of the source: a uniqueness constraint does, a graph's internal
      * record id does not.
      */
-    identifier_provenance?: null | KeyProvenanceDto;
+    identifier_provenance?: null | KeyProvenanceDto$1;
     /** Whether the field is a primary key/identifier */
     is_identifier: boolean;
     /** Whether the field is a relation */
@@ -11354,6 +11355,8 @@ type FeatureInputValueDto$1 = {
 } | {
     /** @format uuid */
     sort_ref: string;
+} | {
+    type: string;
 } | {
     name: string;
 } | {
@@ -11414,7 +11417,23 @@ type FeatureTypeDto$1 = "string" | "integer" | "real" | "boolean" | "reference"
  * - null
  * - array of FeatureValueDto
  */
-type FeatureValueDto$1 = string | number | boolean | null | FeatureValueDto$1[];
+type FeatureValueDto$1 = {
+    term_id: string;
+    var_name: string;
+} | {
+    /**
+     * Feature value in a Ψ-term (untagged union). Can be:
+     * - UUID string (term reference)
+     * - string value
+     * - integer (i64)
+     * - number (f64)
+     * - boolean
+     * - null
+     * - array of FeatureValueDto
+     */
+    literal: FeatureValueDto$1;
+    term_id: string;
+} | string | number | boolean | null | FeatureValueDto$1[];
 /** Request to finalize a live oversight session. */
 interface FinalizeSessionRequest {
     /** Optional execution log (for full provenance) */
@@ -11852,7 +11871,11 @@ interface ForwardChainRequest$1 {
      * Default: false (standard symbolic-only forward chaining)
      */
     enable_provenance_tags?: boolean;
-    /** Initial facts (optional - uses existing facts if not provided) */
+    /**
+     * Initial facts (optional). The run's fact universe is the union of the
+     * tenant's (gateway-visible) existing facts and these seeds, so a seed
+     * AUGMENTS the base — it never replaces it (#218).
+     */
     initial_facts?: TermInputDto$1[];
     /**
      * Maximum facts to derive
@@ -12092,6 +12115,37 @@ type FunctionBodyDto$1 = {
     program: string;
     type: "Neural";
 };
+/** One thing that calls a function. */
+interface FunctionCallerDto {
+    /** Where the reference lives. */
+    kind: FunctionCallerKind$1;
+    /**
+     * The calling function's name, or the rule conclusion's display, so a
+     * refusal names something the caller can find.
+     */
+    name: string;
+    /**
+     * Term id of the calling rule's conclusion, or of the `function_call`
+     * goal term when no rule holds it. Absent for a function caller, which is
+     * identified by name.
+     * @format uuid
+     */
+    term_id?: string | null;
+}
+/** What names a function — where the reference lives. */
+type FunctionCallerKind$1 = "function" | "rule";
+/**
+ * What `DELETE /api/v1/functions/{name}` does about the things that CALL the
+ * function.
+ *
+ * A function is reachable by name from two places: another registered
+ * function's clause body (`FunctionCall`), and a rule's `function_call` goal.
+ * Removing it underneath either leaves the caller naming something that no
+ * longer resolves, and the failure surfaces at evaluation time — which is
+ * exactly what "no route at all, recover with a tenant wipe" already produced
+ * and what this route exists to stop being the default.
+ */
+type FunctionCallersDisposition$1 = "refuse" | "orphan";
 /** A single clause in a function definition */
 interface FunctionClauseDto$1 {
     /** Function body - what to compute */
@@ -12182,6 +12236,36 @@ type FunctionValueDto$1 = {
 } | {
     type: "Uninstantiated";
 };
+/**
+ * What withdrawing a registered function removed.
+ *
+ * A function is carried twice — the durable `meta.function` carrier Ψ-term
+ * that is the source of truth, and the evaluator's own registry used for
+ * dispatch — so both are reported. Forgetting either leaves it half-alive.
+ */
+interface FunctionWithdrawalReport$1 {
+    /**
+     * Everything that still names the function, left calling something that
+     * no longer resolves. Empty on the ordinary withdrawal; non-empty only
+     * under `?callers=orphan`, which is the disposition that permits it.
+     */
+    callers_orphaned?: FunctionCallerDto[];
+    /**
+     * Whether the durable `meta.function` carrier Ψ-term was deleted. `false`
+     * means the function is gone from this process but its carrier survives,
+     * so a restart would bring it back — the operator's cue to retry.
+     */
+    carrier_deleted: boolean;
+    /** Whether it left the in-process registry and the evaluator. */
+    deregistered: boolean;
+    /**
+     * Its stable id, as the registration reported it.
+     * @format uuid
+     */
+    function_id: string;
+    /** The function that was withdrawn. */
+    name: string;
+}
 /**
  * Request: render the LIFE-function definitions in the tenant's
  * term store.
@@ -16224,7 +16308,7 @@ type KbChangeDto$1 = {
  * *do the term ids survive a rebuild of the source?* — are readable without
  * inferring anything from a column's name.
  */
-interface KeyProvenanceDto {
+interface KeyProvenanceDto$1 {
     /**
      * Which side settled the key: `discovery`, `client`, `nobody` (a keyless
      * binding), or `unrecorded`.
@@ -19792,34 +19876,21 @@ interface Objective$1 {
 }
 /** Direction of the objective function. */
 type ObjectiveSense$1 = "minimize" | "maximize";
-/** One observation on the wire. */
+/** One observed unit. */
 interface ObservationDto$1 {
+    /** Binary treatment indicator (`true` = treated). */
+    a: boolean;
     /**
-     * Sightings so far.
-     * @format int64
-     * @min 0
-     */
-    count: number;
-    /** Distinct source documents. */
-    documents: string[];
-    /**
-     * Unix seconds of the first sighting.
+     * Discrete covariate stratum (integer code — bin a categorical or
+     * coarsened-continuous confounder).
      * @format int64
      */
-    first_seen: number;
+    x: number;
     /**
-     * Unix seconds of the latest sighting.
-     * @format int64
+     * Observed outcome.
+     * @format double
      */
-    last_seen: number;
-    /** The normalised identity observations aggregate under. */
-    normalized: string;
-    /** Who saw it (`ingestion`, `extraction_certificate`, `sentinel_near_miss`). */
-    producers: string[];
-    /** The proposed sort's id, once a generate pass minted one. */
-    proposed_sort_id?: string | null;
-    /** Representative surface form. */
-    surface: string;
+    y: number;
 }
 /** Observational inputs for PN / PS */
 interface ObservationalProbabilitiesDto$1 {
@@ -19842,7 +19913,7 @@ interface ObservationalProbabilitiesDto$1 {
 /** Response of `GET /api/v1/sorts/proposals`. */
 interface ObservationsResponse {
     /** Observations, most recurrent first. */
-    observations: ObservationDto$1[];
+    observations: SightingDto[];
 }
 interface ObserveMultiRequest$1 {
     /** Map of variable name to value */
@@ -23199,6 +23270,121 @@ interface RepairHintDto {
     /** The feature or predicate the hint applies to. */
     target: string;
 }
+/**
+ * Request body of `PUT /api/v1/functions/{name}` — the definition that
+ * replaces the one registered under the path name.
+ *
+ * # Why it accepts the register payload verbatim
+ *
+ * `POST /functions/register` takes `{tenant_id, name, arity, clauses}`, and
+ * that is the payload a client already has in hand when it decides to replace
+ * something. Sending it to `PUT` is the obvious move, and under
+ * `deny_unknown_fields` it would answer `422 unknown field 'tenant_id'` —
+ * technically correct and unhelpful, since the caller's actual question is
+ * about the two `name`s (#234).
+ *
+ * So both are declared, and each is handled explicitly rather than dropped:
+ *
+ * * `tenant_id` is **accepted and ignored**, exactly as `register_function`
+ *   ignores it — the tenant comes from the authenticated principal, and
+ *   trusting a body field would let a caller write into another tenant.
+ * * `name`, when present, **must equal the path's**. A mismatch is refused
+ *   with both names rather than silently applying the clauses to whichever
+ *   one the route happened to read.
+ *
+ * A *declared* field that is deliberately ignored is a different thing from
+ * an *undeclared* key that is silently dropped. The first is a documented
+ * contract; the second is the defect this issue is about.
+ */
+interface ReplaceFunctionRequest {
+    /**
+     * The number of named arguments the replacement accepts.
+     * @min 0
+     */
+    arity: number;
+    /** The replacement's pattern-matched clauses, tried in order. */
+    clauses: FunctionClauseDto$1[];
+    /**
+     * The function's name. Optional, and when present it must equal the
+     * path's — this route replaces a definition, it does not rename one.
+     *
+     * A rename would keep every caller's reference pointing at the OLD name,
+     * which no longer resolves; that is a withdrawal plus a registration, and
+     * the caller should say so.
+     */
+    name?: string | null;
+    /**
+     * Accepted so the `register` payload works verbatim, and **ignored**: the
+     * tenant is the authenticated principal's, never a body field.
+     * @format uuid
+     */
+    tenant_id?: string | null;
+}
+/**
+ * Response of `PUT /api/v1/functions/{name}`.
+ *
+ * # Why the previous signature is reported
+ *
+ * A function's identity is its NAME, so a replacement keeps every caller's
+ * reference valid — which is what makes an arity change dangerous rather than
+ * merely breaking: a caller passing the old number of arguments keeps
+ * resolving and starts failing at evaluation time with an arity error. The
+ * response names the change so a client can say so.
+ */
+interface ReplaceFunctionResponse$1 {
+    /**
+     * `true` when the arity changed. Every caller's reference stays valid and
+     * every call passing the old count now fails at evaluation time.
+     */
+    arity_changed: boolean;
+    /**
+     * Everything that calls this function. Reported rather than refused: the
+     * replacement keeps the name resolvable, so a caller is not orphaned —
+     * but one written against the old signature may no longer be correct.
+     */
+    callers?: FunctionCallerDto[];
+    /** What the replacement looks like. */
+    current: FunctionSummaryDto$1;
+    /**
+     * The replacement's id. A fresh registration mints a new one, so this
+     * differs from the previous definition's.
+     * @format uuid
+     */
+    function_id: string;
+    /** The function's name — unchanged by the replacement, by construction. */
+    name: string;
+    /** What the replaced definition looked like. */
+    previous: FunctionSummaryDto$1;
+}
+/**
+ * Response of `PUT /api/v1/inference/rules/{id}`.
+ *
+ * ## Why two ids
+ *
+ * A rule's id **is** its head term id. Under `OSFKB_RULE_STABLE_IDS=1` that id
+ * is content-addressed, so an edit that changes the head changes the id by
+ * construction; under the default it is random, so a replacement changes it
+ * anyway. There is no identity under which an edited rule is the same rule, so
+ * the response names both: the id that was withdrawn, and the id that now
+ * holds the edited clause. A client holding the old id must adopt the new one.
+ */
+interface ReplaceRuleResponse$1 {
+    /** How the edit moved the rule base's guarantees. */
+    certification: RuleCertificationDeltaDto;
+    /**
+     * The id the rule had before the edit. Every durable reference to it —
+     * `derived_facts.rule_id`, each `proofs[].rule_id`, queued dataflow
+     * events — was retracted rather than migrated: a conclusion proved by the
+     * pre-edit clause is not proved by the post-edit one, which is the point
+     * of the edit.
+     * @format uuid
+     */
+    previous_rule_id: string;
+    /** The replacement rule, as created. */
+    term: PsiTermDto$1;
+    /** What withdrawing the previous rule removed. */
+    withdrawal: RuleWithdrawalReport$1;
+}
 /** Oversight verification result for the report. */
 interface ReportVerification {
     /**
@@ -24780,6 +24966,34 @@ interface RuleBaseCertificateDto {
     /** The termination guarantee (or why it could not be established). */
     termination: TerminationDto;
 }
+/**
+ * How an edit changed the rule base's termination and order-independence
+ * guarantees.
+ *
+ * An edit can turn a certified-terminating rule base into a non-terminating
+ * one, or introduce a functional conflict. `GET /api/v1/analysis/rule-base/certify`
+ * computes the certificate live, so there is no stale cache to invalidate —
+ * but a caller who never asks would discover the change when the next chain
+ * run diverges. The write path therefore certifies before and after and
+ * reports the delta.
+ */
+interface RuleCertificationDeltaDto {
+    /** Whether it is order-independent after. */
+    order_independent_after: boolean;
+    /** Whether it was order-independent before the edit. */
+    order_independent_before: boolean;
+    /**
+     * `true` when the edit weakened either guarantee. The edit is still
+     * applied — refusing it would make a rule base unfixable once a previous
+     * edit had broken it — but a client that ignores this field is flying
+     * blind into a diverging chain run.
+     */
+    regressed: boolean;
+    /** Whether the rule base terminated before the edit. */
+    terminated_before: boolean;
+    /** Whether it terminates after. */
+    terminates_after: boolean;
+}
 /** A rule clause (OSF clause) */
 interface RuleClauseDto$1 {
     /** Constraints on variables in this clause */
@@ -24800,6 +25014,32 @@ type RuleConstraintDto$1 = {
     var2: string;
     type: "equal";
 };
+/**
+ * What `DELETE /api/v1/inference/rules/{id}` and
+ * `PUT /api/v1/inference/rules/{id}` do about the conclusions the withdrawn
+ * rule derived.
+ *
+ * A rule is not a row. Deleting one that silently keeps its derivations
+ * leaves the knowledge base asserting conclusions whose only justification is
+ * gone; deleting one that silently drops them destroys conclusions the caller
+ * may not have known were at stake. Neither is a default anybody can audit,
+ * so the disposition is named in the query — the same cut
+ * `DELETE /api/v1/sorts/{id}?terms=…` applies to a sort's terms (#213).
+ *
+ * ## What it governs, and what it does not
+ *
+ * This decides the **materialized** tier only (`derived_facts`), because that
+ * tier cannot re-derive itself synchronously — a row the withdrawal leaves
+ * standing stays until the supervisor or a rebuild says otherwise.
+ *
+ * The **in-memory** tier is exact either way and needs no disposition: the
+ * withdrawal walks the truth-maintenance cone from each deleted term and then
+ * re-derives through the same cached `CHAIN;` plan the OSFQL service runs, so
+ * every conclusion the surviving rules still prove comes back and every one
+ * they do not is gone. The report's `consequences_invalidated` says how many
+ * fell before the re-derivation.
+ */
+type RuleDerivationsDisposition$1 = "refuse" | "retract";
 /** A draft inference rule. */
 interface RuleDraftDto$1 {
     /** Antecedent conditions (body). */
@@ -24832,12 +25072,63 @@ interface RuleEntryDto$1 {
     certainty?: number | null;
     /** The head (consequent) of the rule. */
     head: PsiTermDto$1;
+    /**
+     * When [`Self::withdrawable`] is false, the refusal a withdrawal attempt
+     * would produce — the same prose, and the same `code`, the mutation route
+     * answers with.
+     *
+     * Absent for a withdrawable rule.
+     */
+    not_withdrawable?: null | RuleNotWithdrawableDto;
+    /**
+     * Where this rule came from, from the reading tenant's point of view.
+     *
+     * The listing deliberately returns the PLUGIN-MERGED rule set and admits
+     * the reserved system tenant's rules, because they fire in every tenant's
+     * proof — so three of the withdrawal route's five refusal classes describe
+     * rules that appear here (#232 §1).
+     */
+    origin: RuleOriginDto;
     /**
      * Rule term ID.
      * @format uuid
      */
     rule_id: string;
+    /**
+     * Whether `DELETE`/`PUT` on this rule will act rather than refuse.
+     *
+     * Derived from the same walk the mutation routes run, so the listing and
+     * the refusal cannot disagree. The engine stays the authority: a caller
+     * may still be refused by a state change between this read and the write.
+     */
+    withdrawable: boolean;
+}
+/**
+ * Why a listed rule cannot be withdrawn, in the same terms the mutation route
+ * would answer with.
+ */
+interface RuleNotWithdrawableDto {
+    /**
+     * The stable machine-readable discriminator the `DELETE` would carry —
+     * `rule_system_owned`, `rule_plugin_owned` or `rule_bootstrap`.
+     */
+    code: string;
+    /**
+     * The refusal in words, naming the lifecycle operation that DOES withdraw
+     * this rule.
+     */
+    reason: string;
 }
+/**
+ * Where a listed rule came from.
+ *
+ * The client-facing projection of the engine's provenance walk. A UI keys the
+ * row's actions on this rather than on `_plugin_id` — the underscore-prefixed
+ * provenance meta-feature the marketplace stamps on a plugin's clauses, which
+ * is documented as invisible to domain queries and cannot tell a system-wide
+ * plugin from a tenant-scoped one, nor see a bootstrap rule at all.
+ */
+type RuleOriginDto = "tenant" | "system_plugin" | "tenant_plugin" | "bootstrap";
 /** Response with rule store info */
 interface RuleStoreResponse$1 {
     /** @min 0 */
@@ -24885,6 +25176,63 @@ interface RuleUtilityDto$1 {
      */
     utility: number;
 }
+/**
+ * What withdrawing a rule removed, in every tier that held part of it.
+ *
+ * A rule is one head row, N body rows, a rule-index entry, a set of in-memory
+ * justifications, a set of `derived_facts` rows and their proof objects, and
+ * the derived terms themselves. A response reporting only "deleted" would
+ * name none of that, so each tier is counted separately.
+ */
+interface RuleWithdrawalReport$1 {
+    /**
+     * In-memory consequences invalidated by the truth-maintenance cone, before
+     * the surviving ones were re-derived.
+     * @min 0
+     */
+    consequences_invalidated: number;
+    /**
+     * Materialized derivations (`derived_facts` rows) whose last proof this
+     * rule was, so the row itself is gone.
+     * @min 0
+     */
+    derivations_removed: number;
+    /**
+     * Whether the derivation walk hit its visit cap and stopped early. A
+     * truncated retraction is not a complete one; re-issue the request.
+     */
+    derivations_truncated: boolean;
+    /**
+     * Materialized derivations that lost this rule's proofs but remain proved
+     * by another rule. These are correctly left standing.
+     * @min 0
+     */
+    derivations_weakened: number;
+    /**
+     * Incomplete dataflow queue entries cancelled because they named this rule.
+     * @min 0
+     */
+    queued_events_cancelled: number;
+    /**
+     * The rule that was withdrawn.
+     * @format uuid
+     */
+    rule_id: string;
+    /**
+     * Terms deleted with it: the head plus the body, guard, variable and
+     * operand terms the rule exclusively owned.
+     * @min 0
+     */
+    terms_deleted: number;
+    /**
+     * Terms of the rule's graph that were **kept** because something outside
+     * the rule still holds them — another rule's antecedent, or a fact the
+     * rule's body referenced. Deleting these would destroy data the rest of
+     * the knowledge base owns.
+     * @min 0
+     */
+    terms_retained_shared: number;
+}
 /** The payload an AG-UI client POSTs to start (or continue) a run. */
 interface RunAgentInput {
     /** Contextual key-value items. */
@@ -25972,6 +26320,46 @@ interface ShiftEffectResponse$1 {
      */
     std_error: number;
 }
+/**
+ * One sighting on the wire — one unknown surface form the lattice does not
+ * declare, with its recurrence evidence.
+ *
+ * Named `SightingDto`, not `ObservationDto`: the OpenAPI components namespace
+ * is FLAT, and `crates/api/src/dto/semiparametric.rs` already registers an
+ * `ObservationDto` — the `(x, a, y)` causal unit. Two live structs under one
+ * schema name meant the spec silently kept only one, and the survivor
+ * documented the wrong request body for `POST /api/v1/causal/ate` (#216). The
+ * name is the schema; a rename costs nothing on the wire because the JSON
+ * field names are the struct's, unchanged.
+ */
+interface SightingDto {
+    /**
+     * Sightings so far.
+     * @format int64
+     * @min 0
+     */
+    count: number;
+    /** Distinct source documents. */
+    documents: string[];
+    /**
+     * Unix seconds of the first sighting.
+     * @format int64
+     */
+    first_seen: number;
+    /**
+     * Unix seconds of the latest sighting.
+     * @format int64
+     */
+    last_seen: number;
+    /** The normalised identity observations aggregate under. */
+    normalized: string;
+    /** Who saw it (`ingestion`, `extraction_certificate`, `sentinel_near_miss`). */
+    producers: string[];
+    /** The proposed sort's id, once a generate pass minted one. */
+    proposed_sort_id?: string | null;
+    /** Representative surface form. */
+    surface: string;
+}
 /** A single similarity entry for bulk operations */
 interface SimilarityEntry {
     /**
@@ -32050,20 +32438,71 @@ type FeatureTargetDto = TaggedFeatureValueDto | string;
  * Do NOT use with term CRUD or query endpoints — use {@link ValueDto} instead.
  *
  * The backend Rust type is `FeatureValueDto` in `dto/homoiconic.rs` with
- * `#[serde(untagged)]`. Variant ordering:
- * 1. TermRef (UUID string)
- * 2. TermRefs/List (array of FeatureValueDto)
- * 3. String
- * 4. Integer (i64)
- * 5. Real (f64)
- * 6. Boolean
- * 7. Null (uninstantiated)
+ * `#[serde(untagged)]`. Variant ordering — **load-bearing**, because an
+ * untagged union tries its variants in declaration order and an object with
+ * extra keys still matches an earlier variant that ignores them:
+ * 1. Variable (`{term_id, var_name}`)
+ * 2. Literal (`{term_id, literal}`)
+ * 3. TermRef (`{term_id}`)
+ * 4. TermRefs/List (array of FeatureValueDto)
+ * 5. String
+ * 6. Integer (i64)
+ * 7. Real (f64)
+ * 8. Boolean
+ * 9. Null (uninstantiated)
  *
  * **Ambiguity note**: UUID strings and regular strings are both `string` in TypeScript.
  * The backend distinguishes them by UUID format. The SDK provides
  * `discriminateFeatureValue()` in `utils/discrimination.ts` for response parsing.
  */
-type FeatureValueDto = string | number | boolean | null | FeatureValueDto[];
+type FeatureValueDto = VariableFeatureValue | LiteralFeatureValue | TermRefFeatureValue | string | number | boolean | null | FeatureValueDto[];
+/**
+ * A feature bound to a LOGIC VARIABLE, carrying the name the rule author wrote.
+ *
+ * @remarks
+ * A variable and a reference to a stored term are both `Value::Reference` in
+ * the engine, so both used to arrive as a bare {@link TermRefFeatureValue} —
+ * nothing in a rule's features said that `name` was bound to `?N` rather than
+ * to a term, and the name existed only inside the `display` prose (#232 §2).
+ *
+ * `termId` is the variable term's, so **two features bound to the same variable
+ * carry the same id**. That is how a client reads the coreference which makes
+ * `senior(name: ?N) WHEN person(name: ?N)` a join rather than two independent
+ * patterns.
+ */
+interface VariableFeatureValue {
+    /** The variable term's UUID. Shared by every feature bound to it. */
+    term_id: string;
+    /** The variable's name as authored, e.g. `?N`. */
+    var_name: string;
+}
+/**
+ * A feature bound to an INTERNED LITERAL WRAPPER, carrying the scalar it holds.
+ *
+ * @remarks
+ * The engine interns a guard's bound as a term — `65` becomes an
+ * `integer_type` Ψ-term — so reading it used to cost one `GET /terms/{id}` per
+ * guard, and the summary that exists to save that round trip named the
+ * wrapper's SORT rather than its value (#232 §4).
+ */
+interface LiteralFeatureValue {
+    /** The wrapper term's UUID. */
+    term_id: string;
+    /** The scalar the wrapper holds. */
+    literal: FeatureValueDto;
+}
+/**
+ * A reference to another term, with nothing said about what it is.
+ *
+ * @remarks
+ * What a reference falls back to when it is neither a named variable nor an
+ * interned literal — an ordinary stored term, or an anonymous variable, which
+ * carries no name to report.
+ */
+interface TermRefFeatureValue {
+    /** The referenced term's UUID. */
+    term_id: string;
+}
 
 type values_BellShape = BellShape;
 type values_BooleanValue = BooleanValue;
@@ -32079,6 +32518,7 @@ type values_GaussianProductShape = GaussianProductShape;
 type values_GaussianShape = GaussianShape;
 type values_IntegerValue = IntegerValue;
 type values_ListValue = ListValue;
+type values_LiteralFeatureValue = LiteralFeatureValue;
 type values_PiShapeShape = PiShapeShape;
 type values_PiecewiseLinearShape = PiecewiseLinearShape;
 type values_RealValue = RealValue;
@@ -32092,13 +32532,15 @@ type values_SortIdValue = SortIdValue;
 type values_SpikeShape = SpikeShape;
 type values_StringValue = StringValue;
 type values_TaggedFeatureValueDto = TaggedFeatureValueDto;
+type values_TermRefFeatureValue = TermRefFeatureValue;
 type values_TrapezoidalShape = TrapezoidalShape;
 type values_TriangularShape = TriangularShape;
 type values_UninstantiatedValue = UninstantiatedValue;
 type values_ValueDto = ValueDto;
+type values_VariableFeatureValue = VariableFeatureValue;
 type values_ZShapeShape = ZShapeShape;
 declare namespace values {
-  export type { values_BellShape as BellShape, values_BooleanValue as BooleanValue, values_CauchyShape as CauchyShape, values_CosineShape as CosineShape, values_CyclicGaussianShape as CyclicGaussianShape, values_FeatureTargetDto as FeatureTargetDto, values_FeatureValueDto as FeatureValueDto, values_FuzzyNumberValue as FuzzyNumberValue, values_FuzzyScalarValue as FuzzyScalarValue, values_FuzzyShapeDto as FuzzyShapeDto, values_GaussianProductShape as GaussianProductShape, values_GaussianShape as GaussianShape, values_IntegerValue as IntegerValue, values_ListValue as ListValue, values_PiShapeShape as PiShapeShape, values_PiecewiseLinearShape as PiecewiseLinearShape, values_RealValue as RealValue, values_ReferenceValue as ReferenceValue, values_SShapeShape as SShapeShape, values_SetValue as SetValue, values_SigmoidDifferenceShape as SigmoidDifferenceShape, values_SigmoidProductShape as SigmoidProductShape, values_SigmoidShape as SigmoidShape, values_SortIdValue as SortIdValue, values_SpikeShape as SpikeShape, values_StringValue as StringValue, values_TaggedFeatureValueDto as TaggedFeatureValueDto, values_TrapezoidalShape as TrapezoidalShape, values_TriangularShape as TriangularShape, values_UninstantiatedValue as UninstantiatedValue, values_ValueDto as ValueDto, values_ZShapeShape as ZShapeShape };
+  export type { values_BellShape as BellShape, values_BooleanValue as BooleanValue, values_CauchyShape as CauchyShape, values_CosineShape as CosineShape, values_CyclicGaussianShape as CyclicGaussianShape, values_FeatureTargetDto as FeatureTargetDto, values_FeatureValueDto as FeatureValueDto, values_FuzzyNumberValue as FuzzyNumberValue, values_FuzzyScalarValue as FuzzyScalarValue, values_FuzzyShapeDto as FuzzyShapeDto, values_GaussianProductShape as GaussianProductShape, values_GaussianShape as GaussianShape, values_IntegerValue as IntegerValue, values_ListValue as ListValue, values_LiteralFeatureValue as LiteralFeatureValue, values_PiShapeShape as PiShapeShape, values_PiecewiseLinearShape as PiecewiseLinearShape, values_RealValue as RealValue, values_ReferenceValue as ReferenceValue, values_SShapeShape as SShapeShape, values_SetValue as SetValue, values_SigmoidDifferenceShape as SigmoidDifferenceShape, values_SigmoidProductShape as SigmoidProductShape, values_SigmoidShape as SigmoidShape, values_SortIdValue as SortIdValue, values_SpikeShape as SpikeShape, values_StringValue as StringValue, values_TaggedFeatureValueDto as TaggedFeatureValueDto, values_TermRefFeatureValue as TermRefFeatureValue, values_TrapezoidalShape as TrapezoidalShape, values_TriangularShape as TriangularShape, values_UninstantiatedValue as UninstantiatedValue, values_ValueDto as ValueDto, values_VariableFeatureValue as VariableFeatureValue, values_ZShapeShape as ZShapeShape };
 }
 
 /**
@@ -33697,6 +34139,11 @@ interface FindBySortRequest {
     sortName?: string | null;
     /** Optional filter for feature-based filtering. */
     filter?: Record<string, string> | null;
+    /**
+     * Cap on the number of terms returned, applied after the filter. Omit (or
+     * pass 0) for no cap.
+     */
+    limit?: number | null;
 }
 /**
  * Request to validate a term against its sort's type witnesses.
@@ -34361,6 +34808,19 @@ declare class Inference<SecurityDataType = unknown> {
         /** Also delete referenced terms */
         delete_references?: boolean;
     }, params?: RequestParams) => Promise<HttpResponse<DeleteGoalResponse$1, void>>;
+    /**
+     * @description # The disposition is the caller's `?derivations=refuse` (the default) refuses while the rule still supports materialized conclusions and says how many; `?derivations=retract` withdraws them with it and reports the counts. A delete that silently drops derivations is as wrong as one that silently keeps them, so neither is the unnamed default. # Authorization Requires `X-Tenant-Id`. Runs the same delete guard as `DELETE /api/v1/terms/{id}` — a rule is a policy-relevant object, and withdrawing one changes what the engine will conclude. Honours `If-Match` against the conclusion's content ETag, and requires it under `OSFKB_REQUIRE_IF_MATCH=1`. Every request is captured by the audit middleware.
+     *
+     * @tags inference
+     * @name DeleteRule
+     * @summary Delete a rule.
+     * @request DELETE:/api/v1/inference/rules/{id}
+     * @secure
+     */
+    deleteRule: (id: string, query?: {
+        /** What to do about the conclusions this rule derived. */
+        derivations?: RuleDerivationsDisposition$1;
+    }, params?: RequestParams) => Promise<HttpResponse<RuleWithdrawalReport$1, void>>;
     /**
      * @description Never writes to the KB — returns validated drafts for human review.
      *
@@ -34443,15 +34903,15 @@ declare class Inference<SecurityDataType = unknown> {
      */
     getMetaSorts: (params?: RequestParams) => Promise<HttpResponse<MetaSortsResponse$1, any>>;
     /**
-     * @description # Authorization Requires X-Tenant-Id header.
+     * @description # Authorization Requires X-Tenant-Id header, and the path tenant must equal it. # The path segment Named `{id}` because `DELETE` and `PUT` on the same path address ONE RULE by term id (#231), and one segment cannot carry two names. Here it is the tenant — and a redundant one, since any value but the authenticated principal is refused.
      *
      * @tags inference
      * @name GetRules
      * @summary Get all rules (clauses with antecedents) for a tenant
-     * @request GET:/api/v1/inference/rules/{tenant_id}
+     * @request GET:/api/v1/inference/rules/{id}
      * @secure
      */
-    getRules: (tenantId: string, params?: RequestParams) => Promise<HttpResponse<GetRulesResponse$1, any>>;
+    getRules: (id: string, params?: RequestParams) => Promise<HttpResponse<GetRulesResponse$1, any>>;
     /**
      * @description # TRUE HOMOICONICITY Goals are Ψ-terms persisted to PostgreSQL. This endpoint returns all goals for the authenticated tenant with summary information. # Authorization Requires X-Tenant-Id header.
      *
@@ -34482,6 +34942,16 @@ declare class Inference<SecurityDataType = unknown> {
      * @secure
      */
     predictWithOrchestrator: (data: OrchestratorPredictRequest, params?: RequestParams) => Promise<HttpResponse<OrchestratorPredictResponse, void>>;
+    /**
+     * @description # An edit addresses ONE clause "Edit the rule for X" is ambiguous, because the authoring UI's "add clause" writes a *second* rule with the same conclusion, OR-unioned with the first. The path names a single rule term — one disjunct — so a client cannot silently edit the wrong one. # The old rule is withdrawn, not amended Everything `DELETE` does happens, always with the retract disposition: an edit that leaves the pre-edit clause's conclusions standing is exactly the defect this route exists to fix. The replacement is created through the same code `POST /api/v1/inference/rules` runs, so creation's guards — #227's guard canonicalisation, #219's range restriction, #217's certainty distinction — hold for an edit too, and a rejected replacement leaves the rule base untouched because the build runs BEFORE the clause is de-indexed. The response carries `previous_rule_id` alongside the new rule: a rule's id is its conclusion term id, so an edit changes it by construction. When the replacement is content-addressed to the same id (identical conclusion under `OSFKB_RULE_STABLE_IDS=1`), the two are equal and the edit was applied in place — the outgoing clause's now-unused antecedents are still collected and deleted. # Authorization Identical to `DELETE`: the delete guard on the outgoing rule, `If-Match` against its conclusion, and audit capture.
+     *
+     * @tags inference
+     * @name ReplaceRule
+     * @summary Replace a rule.
+     * @request PUT:/api/v1/inference/rules/{id}
+     * @secure
+     */
+    replaceRule: (id: string, data: AddRuleRequest$1, params?: RequestParams) => Promise<HttpResponse<ReplaceRuleResponse$1, void>>;
     /**
      * @description In OSF/LIFE terms, the orchestrator pushes the conclusion gate and each antecedent gate toward the dual-weighted satisfaction objective `1 − ( w_D · K_D + w_K · K_K )` (paper eq. 4). Each call performs exactly one epoch over the supplied batch — the response carries the per-epoch metrics for that single epoch (multi-epoch aggregation is the caller's responsibility). # Authorization Requires `X-Tenant-Id` header.
      *
@@ -35170,6 +35640,58 @@ interface RuleEntryDto {
     body: PsiTermDto[];
     /** Optional certainty/confidence for the rule. */
     certainty?: number | null;
+    /**
+     * Where this rule came from, from the reading tenant's point of view.
+     *
+     * @remarks
+     * The listing deliberately returns the PLUGIN-MERGED rule set and admits the
+     * reserved system tenant's rules, because they fire in every tenant's proof
+     * — so three of the withdrawal route's five refusal classes describe rules
+     * that appear here.
+     */
+    origin: RuleOrigin;
+    /**
+     * Whether `deleteRule` / `replaceRule` will act on this rule rather than
+     * refuse.
+     *
+     * @remarks
+     * Derived from the same walk the mutation routes run, so the listing and the
+     * refusal cannot disagree. The engine stays the authority: a caller may
+     * still be refused by a state change between this read and the write.
+     */
+    withdrawable: boolean;
+    /**
+     * When {@link RuleEntryDto.withdrawable} is false, the refusal a withdrawal
+     * would produce — the same `code` and prose the mutation route answers with.
+     * Absent for a withdrawable rule.
+     */
+    notWithdrawable?: RuleNotWithdrawable;
+}
+/**
+ * Where a listed rule came from.
+ *
+ * @remarks
+ * A UI keys a row's actions on this rather than on `_plugin_id` — the
+ * underscore-prefixed provenance meta-feature the marketplace stamps on a
+ * plugin's clauses, which is documented as invisible to domain queries, cannot
+ * tell a system-wide plugin from a tenant-scoped one, and sees nothing at all
+ * for a bootstrap rule.
+ *
+ * - `tenant` — authored in this tenant. The only withdrawable origin.
+ * - `system_plugin` — a system-wide plugin's rule, firing in every tenant's proof.
+ * - `tenant_plugin` — contributed by a plugin installed in this tenant.
+ * - `bootstrap` — engine machinery (an Allen relation, a handler mapping).
+ */
+type RuleOrigin = 'tenant' | 'system_plugin' | 'tenant_plugin' | 'bootstrap';
+/** Why a listed rule cannot be withdrawn, in the mutation route's own terms. */
+interface RuleNotWithdrawable {
+    /**
+     * The stable discriminator the `DELETE` would carry — `rule_system_owned`,
+     * `rule_plugin_owned` or `rule_bootstrap`.
+     */
+    code: string;
+    /** The refusal in words, naming the lifecycle operation that DOES withdraw it. */
+    reason: string;
 }
 /** Response listing all rules for a tenant. */
 interface GetRulesResponse {
@@ -35178,6 +35700,91 @@ interface GetRulesResponse {
     /** The rules (clauses with antecedents). */
     rules: RuleEntryDto[];
 }
+/** What a rule withdrawal does about the conclusions the rule derived. */
+type RuleDerivationsDisposition = 'refuse' | 'retract';
+/**
+ * What withdrawing a rule removed, in every tier that held part of it.
+ *
+ * @remarks
+ * A rule is not a row. It is one conclusion term, N antecedent pattern terms,
+ * a rule-index entry, a set of in-memory justifications, a set of materialized
+ * derivations with their proof objects, and the derived terms themselves. Each
+ * tier is counted separately, because a response reporting only "deleted" would
+ * name none of it.
+ */
+interface RuleWithdrawalReport {
+    /** The rule that was withdrawn (UUID). */
+    ruleId: string;
+    /**
+     * Terms deleted with it: the conclusion plus the antecedent, guard, variable
+     * and operand terms the rule exclusively owned.
+     */
+    termsDeleted: number;
+    /**
+     * Terms of the rule's graph that were KEPT because something outside the rule
+     * still holds them — another rule's antecedent, or a fact the body
+     * referenced. Deleting these would destroy data the rest of the knowledge
+     * base owns.
+     */
+    termsRetainedShared: number;
+    /** Materialized derivations whose last proof this rule was, so the row is gone. */
+    derivationsRemoved: number;
+    /**
+     * Materialized derivations that lost this rule's proofs but remain proved by
+     * another rule. These are correctly left standing.
+     */
+    derivationsWeakened: number;
+    /**
+     * Whether the derivation walk hit its visit cap and stopped early. A
+     * truncated retraction is not a complete one; re-issue the request.
+     */
+    derivationsTruncated: boolean;
+    /**
+     * In-memory consequences invalidated by the truth-maintenance cone, before
+     * the surviving ones were re-derived.
+     */
+    consequencesInvalidated: number;
+    /** Incomplete dataflow queue entries cancelled because they named this rule. */
+    queuedEventsCancelled: number;
+}
+/** How an edit changed the rule base's termination and order-independence guarantees. */
+interface RuleCertificationDelta {
+    /** Whether the rule base terminated before the edit. */
+    terminatedBefore: boolean;
+    /** Whether it terminates after. */
+    terminatesAfter: boolean;
+    /** Whether it was order-independent before the edit. */
+    orderIndependentBefore: boolean;
+    /** Whether it is order-independent after. */
+    orderIndependentAfter: boolean;
+    /**
+     * `true` when the edit weakened either guarantee. The edit is still applied —
+     * refusing it would make a rule base unfixable once a previous edit had
+     * broken it — but a client that ignores this is flying blind into a diverging
+     * chain run.
+     */
+    regressed: boolean;
+}
+/** Result of replacing a rule. */
+interface ReplaceRuleResponse {
+    /**
+     * The id the rule had before the edit.
+     *
+     * @remarks
+     * A rule's id IS its conclusion term id, so an edit changes it by
+     * construction. Durable references to the old id are retracted rather than
+     * migrated: a conclusion proved by the pre-edit clause is not proved by the
+     * post-edit one, which is the point of the edit. A client holding the old id
+     * must adopt the new one.
+     */
+    previousRuleId: string;
+    /** The replacement rule, as created. */
+    term: PsiTermDto;
+    /** What withdrawing the previous rule removed. */
+    withdrawal: RuleWithdrawalReport;
+    /** How the edit moved the rule base's guarantees. */
+    certification: RuleCertificationDelta;
+}
 /**
  * Response listing the meta-sorts (built-in system sorts) for inference.
  *
@@ -35507,17 +36114,23 @@ type inference_NafProveRequest = NafProveRequest;
 type inference_NafProveResponse = NafProveResponse;
 type inference_ProofDto = ProofDto;
 type inference_ProvenanceTagDto = ProvenanceTagDto;
+type inference_ReplaceRuleResponse = ReplaceRuleResponse;
 type inference_RuleAggregatorDto = RuleAggregatorDto;
+type inference_RuleCertificationDelta = RuleCertificationDelta;
+type inference_RuleDerivationsDisposition = RuleDerivationsDisposition;
 type inference_RuleDraftClarificationQuestionDto = RuleDraftClarificationQuestionDto;
 type inference_RuleDraftDto = RuleDraftDto;
 type inference_RuleEntryDto = RuleEntryDto;
+type inference_RuleNotWithdrawable = RuleNotWithdrawable;
+type inference_RuleOrigin = RuleOrigin;
 type inference_RuleTermDraftDto = RuleTermDraftDto;
+type inference_RuleWithdrawalReport = RuleWithdrawalReport;
 type inference_SolutionDto = SolutionDto;
 type inference_TaggedDerivedFact = TaggedDerivedFact;
 type inference_TaggedForwardChainRequest = TaggedForwardChainRequest;
 type inference_TaggedForwardChainResponse = TaggedForwardChainResponse;
 declare namespace inference {
-  export type { inference_AddFactRequest as AddFactRequest, inference_AddFactResponse as AddFactResponse, inference_AddRuleRequest as AddRuleRequest, inference_AddRuleResponse as AddRuleResponse, inference_AllenRelation as AllenRelation, inference_BackwardChainRequest as BackwardChainRequest, inference_BackwardChainResponse as BackwardChainResponse, inference_BayesianEffectDto as BayesianEffectDto, inference_BayesianPredictRequest as BayesianPredictRequest, inference_BayesianPredictResponse as BayesianPredictResponse, inference_BindingDto as BindingDto, inference_BulkAddFactsRequest as BulkAddFactsRequest, inference_BulkAddFactsResponse as BulkAddFactsResponse, inference_BulkAddRulesRequest as BulkAddRulesRequest, inference_BulkAddRulesResponse as BulkAddRulesResponse, inference_BulkFuzzyProveRequest as BulkFuzzyProveRequest, inference_BulkFuzzyProveResponse as BulkFuzzyProveResponse, inference_ClearFactsResponse as ClearFactsResponse, inference_ConstraintInputDto as ConstraintInputDto, inference_CreateGoalRequest as CreateGoalRequest, inference_CreateGoalResponse as CreateGoalResponse, inference_DeleteGoalResponse as DeleteGoalResponse, inference_DraftRulesRequest as DraftRulesRequest, inference_DraftRulesResponse as DraftRulesResponse, inference_FactConfidenceEntry as FactConfidenceEntry, inference_ForwardChainRequest as ForwardChainRequest, inference_ForwardChainResponse as ForwardChainResponse, inference_FuzzyProveRequest as FuzzyProveRequest, inference_FuzzyProveResponse as FuzzyProveResponse, inference_GetFactsResponse as GetFactsResponse, inference_GetRulesResponse as GetRulesResponse, inference_GoalDto as GoalDto, inference_GoalSummaryDto as GoalSummaryDto, inference_GuardOp as GuardOp, inference_HomoiconicSubstitutionDto as HomoiconicSubstitutionDto, inference_ListGoalsResponse as ListGoalsResponse, inference_LiteralInputDto as LiteralInputDto, inference_MetaSortsResponse as MetaSortsResponse, inference_NafProveRequest as NafProveRequest, inference_NafProveResponse as NafProveResponse, inference_ProofDto as ProofDto, inference_ProvenanceTagDto as ProvenanceTagDto, inference_RuleAggregatorDto as RuleAggregatorDto, inference_RuleDraftClarificationQuestionDto as RuleDraftClarificationQuestionDto, inference_RuleDraftDto as RuleDraftDto, inference_RuleEntryDto as RuleEntryDto, inference_RuleTermDraftDto as RuleTermDraftDto, inference_SolutionDto as SolutionDto, inference_TaggedDerivedFact as TaggedDerivedFact, inference_TaggedForwardChainRequest as TaggedForwardChainRequest, inference_TaggedForwardChainResponse as TaggedForwardChainResponse };
+  export type { inference_AddFactRequest as AddFactRequest, inference_AddFactResponse as AddFactResponse, inference_AddRuleRequest as AddRuleRequest, inference_AddRuleResponse as AddRuleResponse, inference_AllenRelation as AllenRelation, inference_BackwardChainRequest as BackwardChainRequest, inference_BackwardChainResponse as BackwardChainResponse, inference_BayesianEffectDto as BayesianEffectDto, inference_BayesianPredictRequest as BayesianPredictRequest, inference_BayesianPredictResponse as BayesianPredictResponse, inference_BindingDto as BindingDto, inference_BulkAddFactsRequest as BulkAddFactsRequest, inference_BulkAddFactsResponse as BulkAddFactsResponse, inference_BulkAddRulesRequest as BulkAddRulesRequest, inference_BulkAddRulesResponse as BulkAddRulesResponse, inference_BulkFuzzyProveRequest as BulkFuzzyProveRequest, inference_BulkFuzzyProveResponse as BulkFuzzyProveResponse, inference_ClearFactsResponse as ClearFactsResponse, inference_ConstraintInputDto as ConstraintInputDto, inference_CreateGoalRequest as CreateGoalRequest, inference_CreateGoalResponse as CreateGoalResponse, inference_DeleteGoalResponse as DeleteGoalResponse, inference_DraftRulesRequest as DraftRulesRequest, inference_DraftRulesResponse as DraftRulesResponse, inference_FactConfidenceEntry as FactConfidenceEntry, inference_ForwardChainRequest as ForwardChainRequest, inference_ForwardChainResponse as ForwardChainResponse, inference_FuzzyProveRequest as FuzzyProveRequest, inference_FuzzyProveResponse as FuzzyProveResponse, inference_GetFactsResponse as GetFactsResponse, inference_GetRulesResponse as GetRulesResponse, inference_GoalDto as GoalDto, inference_GoalSummaryDto as GoalSummaryDto, inference_GuardOp as GuardOp, inference_HomoiconicSubstitutionDto as HomoiconicSubstitutionDto, inference_ListGoalsResponse as ListGoalsResponse, inference_LiteralInputDto as LiteralInputDto, inference_MetaSortsResponse as MetaSortsResponse, inference_NafProveRequest as NafProveRequest, inference_NafProveResponse as NafProveResponse, inference_ProofDto as ProofDto, inference_ProvenanceTagDto as ProvenanceTagDto, inference_ReplaceRuleResponse as ReplaceRuleResponse, inference_RuleAggregatorDto as RuleAggregatorDto, inference_RuleCertificationDelta as RuleCertificationDelta, inference_RuleDerivationsDisposition as RuleDerivationsDisposition, inference_RuleDraftClarificationQuestionDto as RuleDraftClarificationQuestionDto, inference_RuleDraftDto as RuleDraftDto, inference_RuleEntryDto as RuleEntryDto, inference_RuleNotWithdrawable as RuleNotWithdrawable, inference_RuleOrigin as RuleOrigin, inference_RuleTermDraftDto as RuleTermDraftDto, inference_RuleWithdrawalReport as RuleWithdrawalReport, inference_SolutionDto as SolutionDto, inference_TaggedDerivedFact as TaggedDerivedFact, inference_TaggedForwardChainRequest as TaggedForwardChainRequest, inference_TaggedForwardChainResponse as TaggedForwardChainResponse };
 }
 
 /**
@@ -35630,6 +36243,78 @@ declare class InferenceClient {
      * ```
      */
     getRules(): Promise<GetRulesResponse>;
+    /**
+     * Withdraw one rule from the knowledge base.
+     *
+     * @param ruleId - Term id of the rule (its conclusion), as returned by
+     *   {@link InferenceClient.addRule} or {@link InferenceClient.getRules}.
+     * @param options - `derivations` decides what happens to the conclusions the
+     *   rule derived. Defaults to `'refuse'`.
+     * @returns What the withdrawal removed, tier by tier.
+     * @throws {ApiError} 400 if the id names a fact rather than a rule, or if the
+     *   rule still supports derivations under the default `'refuse'`; 403 for a
+     *   system, plugin-owned or bootstrap rule; 404 if no such rule exists.
+     *
+     * @remarks
+     * A rule is not a row. Withdrawing one deletes its conclusion AND the
+     * antecedent pattern, guard and variable terms it exclusively owns — a
+     * conclusion-only delete would leave those patterns readable as ordinary
+     * facts — while keeping every term the rest of the knowledge base still
+     * holds.
+     *
+     * `'refuse'` (the default) refuses while the rule still proves materialized
+     * conclusions and says how many; `'retract'` withdraws them with it. A delete
+     * that silently drops derivations is as wrong as one that silently keeps
+     * them, so neither is the unnamed default.
+     *
+     * @example
+     * ```typescript
+     * const report = await client.inference.deleteRule(ruleId, { derivations: 'retract' });
+     * console.log(report.termsDeleted, report.derivationsRemoved);
+     * ```
+     */
+    deleteRule(ruleId: string, options?: {
+        derivations?: RuleDerivationsDisposition;
+    }): Promise<RuleWithdrawalReport>;
+    /**
+     * Replace one rule with a new one.
+     *
+     * @param ruleId - Term id of the rule (its conclusion) to replace.
+     * @param request - The replacement rule, in the same shape
+     *   {@link InferenceClient.addRule} takes.
+     * @returns The replacement, the id it replaced, what the withdrawal removed,
+     *   and how the rule base's guarantees moved.
+     * @throws {ApiError} 422 if the replacement is rejected by the authoring
+     *   guards — in which case the original rule is left live; 400/403/404 as for
+     *   {@link InferenceClient.deleteRule}.
+     *
+     * @remarks
+     * A rule's id IS its conclusion term id, so an edit changes it by
+     * construction. The response carries `previousRuleId` alongside the new
+     * rule; a client holding the old id must adopt the new one.
+     *
+     * The path names ONE rule term — one disjunct. Two rules with the same
+     * conclusion are OR-unioned, so "edit the rule for X" is ambiguous and this
+     * addresses a single clause.
+     *
+     * @example
+     * ```typescript
+     * const result = await client.inference.replaceRule(ruleId, {
+     *   term: psi('retiree', { name: Var('N') }),
+     *   antecedents: [psi('person', { name: Var('N') })],
+     * });
+     * console.log(result.previousRuleId, '->', result.term.termId);
+     * if (result.certification.regressed) {
+     *   console.warn('the edit weakened the rule base guarantees');
+     * }
+     * ```
+     */
+    replaceRule(ruleId: string, request: {
+        term: TermInputArg;
+        antecedents?: TermInputArg[];
+        certainty?: number;
+        aggregator?: RuleAggregatorDto | null;
+    }): Promise<ReplaceRuleResponse>;
     /**
      * Query for matching data by searching rules and facts backwards from a goal pattern.
      *
@@ -50774,12 +51459,25 @@ interface StructuredIngestionStatsDto {
     entitiesCreated: number;
     /** Number of entities extracted (from pipeline). */
     entitiesExtracted: number;
+    /**
+     * Number of records the source reported as available for the ingested
+     * tables, before any cap or collapse. Compared with `recordsProcessed` a cap
+     * hit is visible; compared with `termsCreated`, a partial ingest is.
+     */
+    recordsAvailable: number;
     /** Number of source records processed. */
     recordsProcessed: number;
     /** Number of relations created. */
     relationsCreated: number;
     /** Number of relations discovered. */
     relationsDiscovered: number;
+    /**
+     * Number of rows that collapsed onto a key value another row already
+     * produced in the same run — the bound-key upsert merged them into one term.
+     * Zero when the bound key identifies rows uniquely; named in `warnings` when
+     * it is not.
+     */
+    rowsCollapsed: number;
     /** Number of sorts created (from pipeline). */
     sortsCreated: number;
     /** Number of types/tables discovered. */
@@ -55657,6 +56355,19 @@ declare class PreferencesClient {
 declare class Functions<SecurityDataType = unknown> {
     http: HttpClient<SecurityDataType>;
     constructor(http: HttpClient<SecurityDataType>);
+    /**
+     * @description # The disposition is the caller's `?callers=refuse` (the default) refuses while anything calls the function and names every caller; `?callers=orphan` withdraws it anyway and reports the callers left naming something that no longer resolves. A withdrawal that silently orphans its callers is the state the missing route already produced. # Authorization Requires `X-Tenant-Id`. The function store is tenant-keyed, so another tenant's function is `404` rather than forbidden. Every request is captured by the audit middleware.
+     *
+     * @tags functions
+     * @name DeleteFunction
+     * @summary Withdraw a registered function.
+     * @request DELETE:/api/v1/functions/{name}
+     * @secure
+     */
+    deleteFunction: (name: string, query?: {
+        /** What to do about the things that call this function. */
+        callers?: FunctionCallersDisposition$1;
+    }, params?: RequestParams) => Promise<HttpResponse<FunctionWithdrawalReport$1, void>>;
     /**
      * @description Never writes to the KB — returns a validated draft for human review.
      *
@@ -55697,6 +56408,16 @@ declare class Functions<SecurityDataType = unknown> {
      * @secure
      */
     registerFunction: (data: RegisterFunctionRequest$1, params?: RequestParams) => Promise<HttpResponse<RegisterFunctionResponse$1, void>>;
+    /**
+     * @description # Why this is not `POST /functions/register` Registration already replaces by name — silently, reporting nothing about what it displaced. `PUT` is the operation that says so: it refuses when nothing is registered under the name (that is registration's job), and answers with the previous signature, the new one, whether the arity moved, and everything that calls the function. # The arity is the hazard A function's identity is its NAME, so a replacement keeps every caller's reference valid — nothing dangles. That is exactly why an arity change is dangerous rather than merely breaking: every call still resolves, and one passing the old number of arguments starts failing at evaluation time. Reported, not refused: the caller may be replacing the function precisely because its signature was wrong. # Authorization Identical to `DELETE`: tenant-keyed, plugin-owned functions refused, audited.
+     *
+     * @tags functions
+     * @name ReplaceFunction
+     * @summary Replace a registered function's definition.
+     * @request PUT:/api/v1/functions/{name}
+     * @secure
+     */
+    replaceFunction: (name: string, data: ReplaceFunctionRequest, params?: RequestParams) => Promise<HttpResponse<ReplaceFunctionResponse$1, void>>;
 }
 
 /**
@@ -56038,6 +56759,94 @@ type DraftFunctionResponse = {
     /** Non-fatal issues the user should see (e.g., unknown function references). */
     warnings: string[];
 };
+/** What a withdrawal does about the things that CALL the function. */
+type FunctionCallersDisposition = 'refuse' | 'orphan';
+/** Where a reference to a function lives. */
+type FunctionCallerKind = 'function' | 'rule';
+/**
+ * One thing that calls a function.
+ *
+ * @remarks
+ * A function is reachable by name from exactly two places: another registered
+ * function's clause body, and a rule's `function_call` goal. Both are scanned
+ * before a withdrawal, because removing the function underneath either leaves
+ * the caller naming something that no longer resolves — and the failure
+ * surfaces at evaluation time.
+ */
+interface FunctionCaller {
+    /** Where the reference lives. */
+    kind: FunctionCallerKind;
+    /**
+     * The calling function's name, or a label for the calling rule — so a
+     * refusal names something the caller can find.
+     */
+    name: string;
+    /**
+     * Term id of the calling rule's conclusion, or of the `function_call` goal
+     * when no rule holds it. Absent for a function caller, which is identified
+     * by name.
+     */
+    termId?: string;
+}
+/**
+ * What withdrawing a registered function removed.
+ *
+ * @remarks
+ * A function is carried TWICE — the durable `meta.function` carrier Ψ-term
+ * that is the source of truth, and the evaluator's own registry used for
+ * dispatch — so both are reported. Forgetting either leaves it half-alive:
+ * still evaluable, or back after a restart.
+ */
+interface FunctionWithdrawalReport {
+    /** The function that was withdrawn. */
+    name: string;
+    /** Its stable id, as the registration reported it. */
+    functionId: string;
+    /**
+     * Whether the durable carrier was deleted. `false` means the function is
+     * gone from this process but its carrier survives, so a restart would bring
+     * it back — the cue to retry.
+     */
+    carrierDeleted: boolean;
+    /** Whether it left the in-process registry and the evaluator. */
+    deregistered: boolean;
+    /**
+     * Everything still naming the function, left calling what no longer
+     * resolves. Empty on the ordinary withdrawal; non-empty only under
+     * `callers: 'orphan'`.
+     */
+    callersOrphaned: FunctionCaller[];
+}
+/** Result of replacing a registered function's definition. */
+interface ReplaceFunctionResponse {
+    /** The function's name — unchanged by the replacement, by construction. */
+    name: string;
+    /**
+     * The replacement's id. A fresh registration mints a new one, so it differs
+     * from the previous definition's.
+     */
+    functionId: string;
+    /** What the replaced definition looked like. */
+    previous: FunctionSummaryDto;
+    /** What the replacement looks like. */
+    current: FunctionSummaryDto;
+    /**
+     * `true` when the arity changed.
+     *
+     * @remarks
+     * A function's identity is its NAME, so a replacement keeps every caller's
+     * reference valid — nothing dangles. That is exactly what makes an arity
+     * change dangerous rather than merely breaking: every call still resolves,
+     * and one passing the old argument count starts failing at evaluation time.
+     */
+    arityChanged: boolean;
+    /**
+     * Everything that calls this function. Reported rather than refused: the
+     * replacement keeps the name resolvable, so no caller is orphaned — but one
+     * written against the old signature may no longer be correct.
+     */
+    callers: FunctionCaller[];
+}
 
 type functions_AuthoringClarificationQuestionDto = AuthoringClarificationQuestionDto;
 type functions_BinaryOperatorDto = BinaryOperatorDto;
@@ -56047,18 +56856,23 @@ type functions_EvaluateFunctionRequest = EvaluateFunctionRequest;
 type functions_EvaluateFunctionResponse = EvaluateFunctionResponse;
 type functions_ExpressionDto = ExpressionDto;
 type functions_FunctionBodyDto = FunctionBodyDto;
+type functions_FunctionCaller = FunctionCaller;
+type functions_FunctionCallerKind = FunctionCallerKind;
+type functions_FunctionCallersDisposition = FunctionCallersDisposition;
 type functions_FunctionClauseDto = FunctionClauseDto;
 type functions_FunctionDraftDto = FunctionDraftDto;
 type functions_FunctionGuardDto = FunctionGuardDto;
 type functions_FunctionKindDto = FunctionKindDto;
 type functions_FunctionSummaryDto = FunctionSummaryDto;
 type functions_FunctionValueDto = FunctionValueDto;
+type functions_FunctionWithdrawalReport = FunctionWithdrawalReport;
 type functions_ListFunctionsResponse = ListFunctionsResponse;
 type functions_PatternDto = PatternDto;
 type functions_RegisterFunctionRequest = RegisterFunctionRequest;
 type functions_RegisterFunctionResponse = RegisterFunctionResponse;
+type functions_ReplaceFunctionResponse = ReplaceFunctionResponse;
 declare namespace functions {
-  export type { functions_AuthoringClarificationQuestionDto as AuthoringClarificationQuestionDto, functions_BinaryOperatorDto as BinaryOperatorDto, functions_DraftFunctionRequest as DraftFunctionRequest, functions_DraftFunctionResponse as DraftFunctionResponse, functions_EvaluateFunctionRequest as EvaluateFunctionRequest, functions_EvaluateFunctionResponse as EvaluateFunctionResponse, functions_ExpressionDto as ExpressionDto, functions_FunctionBodyDto as FunctionBodyDto, functions_FunctionClauseDto as FunctionClauseDto, functions_FunctionDraftDto as FunctionDraftDto, functions_FunctionGuardDto as FunctionGuardDto, functions_FunctionKindDto as FunctionKindDto, functions_FunctionSummaryDto as FunctionSummaryDto, functions_FunctionValueDto as FunctionValueDto, functions_ListFunctionsResponse as ListFunctionsResponse, functions_PatternDto as PatternDto, functions_RegisterFunctionRequest as RegisterFunctionRequest, functions_RegisterFunctionResponse as RegisterFunctionResponse };
+  export type { functions_AuthoringClarificationQuestionDto as AuthoringClarificationQuestionDto, functions_BinaryOperatorDto as BinaryOperatorDto, functions_DraftFunctionRequest as DraftFunctionRequest, functions_DraftFunctionResponse as DraftFunctionResponse, functions_EvaluateFunctionRequest as EvaluateFunctionRequest, functions_EvaluateFunctionResponse as EvaluateFunctionResponse, functions_ExpressionDto as ExpressionDto, functions_FunctionBodyDto as FunctionBodyDto, functions_FunctionCaller as FunctionCaller, functions_FunctionCallerKind as FunctionCallerKind, functions_FunctionCallersDisposition as FunctionCallersDisposition, functions_FunctionClauseDto as FunctionClauseDto, functions_FunctionDraftDto as FunctionDraftDto, functions_FunctionGuardDto as FunctionGuardDto, functions_FunctionKindDto as FunctionKindDto, functions_FunctionSummaryDto as FunctionSummaryDto, functions_FunctionValueDto as FunctionValueDto, functions_FunctionWithdrawalReport as FunctionWithdrawalReport, functions_ListFunctionsResponse as ListFunctionsResponse, functions_PatternDto as PatternDto, functions_RegisterFunctionRequest as RegisterFunctionRequest, functions_RegisterFunctionResponse as RegisterFunctionResponse, functions_ReplaceFunctionResponse as ReplaceFunctionResponse };
 }
 
 /**
@@ -56205,6 +57019,78 @@ declare class FunctionsClient {
      * ```
      */
     listFunctions(): Promise<ListFunctionsResponse>;
+    /**
+     * Withdraw a registered function.
+     *
+     * @param name - The registered function's name — its identity.
+     * @param options - `callers` decides what happens to the things that call
+     *   it. Defaults to `'refuse'`.
+     * @returns What the withdrawal removed, in each representation that held it.
+     * @throws {ApiError} 400 if something still calls the function under the
+     *   default `'refuse'` (the body carries `code: 'function_has_callers'` and
+     *   the caller list); 403 for a plugin-contributed function; 404 if nothing
+     *   is registered under that name.
+     *
+     * @remarks
+     * A function is carried twice — the durable `meta.function` carrier that is
+     * the source of truth, and the evaluator's own registry used for dispatch
+     * and recursive cross-calls — and the report names both, because forgetting
+     * either leaves it half-alive: still evaluable, or back after a restart.
+     *
+     * `'refuse'` names every caller; `'orphan'` withdraws anyway and reports the
+     * callers left naming something that no longer resolves.
+     *
+     * @example
+     * ```typescript
+     * const report = await client.functions.deleteFunction('scale', { callers: 'orphan' });
+     * for (const orphan of report.callersOrphaned) {
+     *   console.warn(`${orphan.kind} ${orphan.name} now calls a function that is gone`);
+     * }
+     * ```
+     */
+    deleteFunction(name: string, options?: {
+        callers?: FunctionCallersDisposition;
+    }): Promise<FunctionWithdrawalReport>;
+    /**
+     * Replace a registered function's definition.
+     *
+     * @param name - The registered function's name. Unchanged by the
+     *   replacement — the name IS the identity.
+     * @param request - The replacement's arity and clauses.
+     * @returns Both signatures, whether the arity moved, and everything that
+     *   calls the function.
+     * @throws {ApiError} 400 if the replacement's clauses are rejected — in
+     *   which case the registration is left exactly as it was; 403 for a
+     *   plugin-contributed function; 404 if nothing is registered under that
+     *   name (creating one is {@link FunctionsClient.registerFunction}'s job).
+     *
+     * @remarks
+     * `registerFunction` already replaces by name — silently, reporting nothing
+     * about what it displaced. This is the operation that says so.
+     *
+     * A function's identity is its NAME, so a replacement keeps every caller's
+     * reference valid: nothing dangles. That is exactly why an arity change is
+     * the dangerous edit — every call still resolves, and one passing the old
+     * argument count starts failing at evaluation time. `arityChanged` is
+     * reported rather than refused, because a caller may be replacing the
+     * function precisely because its signature was wrong.
+     *
+     * @example
+     * ```typescript
+     * const result = await client.functions.replaceFunction('scale', {
+     *   arity: 2,
+     *   clauses: [multiplyClause],
+     * });
+     * if (result.arityChanged) {
+     *   console.warn(`arity ${result.previous.arity} -> ${result.current.arity};`,
+     *     `${result.callers.length} caller(s) were written against the old one`);
+     * }
+     * ```
+     */
+    replaceFunction(name: string, request: {
+        arity: number;
+        clauses: FunctionClauseDto[];
+    }): Promise<ReplaceFunctionResponse>;
     /**
      * Draft a user-defined function from a natural-language description.
      *
@@ -58574,6 +59460,16 @@ interface ClearTenantResponse {
     inferenceStateCleared: boolean;
     /** Whether the cache was invalidated. */
     cacheInvalidated: boolean;
+    /**
+     * Number of vector-store points deleted for this tenant.
+     *
+     * @remarks
+     * Reported separately because it is the one count an erasure request cannot
+     * verify any other way: vector payloads carry the embedded text, so a wipe
+     * that left them behind would report every table emptied while the tenant's
+     * data stayed readable by similarity search.
+     */
+    vectorsDeleted: number;
     /**
      * Number of plugin-marketplace install records forgotten for this tenant.
      *
@@ -66857,11 +67753,49 @@ interface BulkBindSortsResponse {
 /**
  * Summary of a single active sort-table binding.
  */
+interface KeyProvenanceDto {
+    /**
+     * Which authority chose the key: `source_constraint`,
+     * `synthetic_record_id`, `sequence_default`, `schema_declared_identifier`,
+     * `naming_convention`, `sampled_uniqueness`, `client_supplied`, `keyless`
+     * or `unrecorded`.
+     */
+    source: string;
+    /**
+     * Which side settled it: `discovery`, `client`, `nobody` (a keyless
+     * binding), or `unrecorded`.
+     */
+    chosenBy: string;
+    /** One sentence stating what this key source means, in plain words. */
+    explanation: string;
+    /**
+     * Whether some authority guarantees the key identifies exactly one record.
+     * Absent where the question has no answer — a keyless binding, or a
+     * provenance that was never recorded.
+     */
+    guaranteedUnique?: boolean | null;
+    /**
+     * Whether term ids built from this key survive a rebuild of the source:
+     * `survives_source_rebuild` or `lifetime_scoped`. Absent for a
+     * client-supplied key, where nothing declares it.
+     */
+    durability?: string | null;
+}
+/**
+ * One active sort↔table binding.
+ */
 interface BindingSummaryDto {
     /** Number of bound features/columns. */
     featureCount: number;
     /** Primary key column names. */
     keyColumns: string[];
+    /**
+     * Where the key columns came from, and what that implies for the durability
+     * of ids derived from them. The column names cannot say it: `["title"]`
+     * looks identical whether a uniqueness constraint backs it or an operator
+     * nominated it.
+     */
+    keyProvenance: KeyProvenanceDto;
     /** Sort ID (UUID string). */
     sortId: string;
     /** External source identifier. */
@@ -66993,11 +67927,12 @@ type ontologyBridge_ImportFoundryRequest = ImportFoundryRequest;
 type ontologyBridge_ImportFoundryResponse = ImportFoundryResponse;
 type ontologyBridge_ImportOwlRequest = ImportOwlRequest;
 type ontologyBridge_ImportOwlResponse = ImportOwlResponse;
+type ontologyBridge_KeyProvenanceDto = KeyProvenanceDto;
 type ontologyBridge_ListBindingsResponse = ListBindingsResponse;
 type ontologyBridge_TranspileRequest = TranspileRequest;
 type ontologyBridge_TranspileResponse = TranspileResponse;
 declare namespace ontologyBridge {
-  export type { ontologyBridge_BindSortRequest as BindSortRequest, ontologyBridge_BindSortResponse as BindSortResponse, ontologyBridge_BindingSummaryDto as BindingSummaryDto, ontologyBridge_BulkBindError as BulkBindError, ontologyBridge_BulkBindSortsRequest as BulkBindSortsRequest, ontologyBridge_BulkBindSortsResponse as BulkBindSortsResponse, ontologyBridge_ColumnMappingDto as ColumnMappingDto, ontologyBridge_FoundryReviewItemDto as FoundryReviewItemDto, ontologyBridge_GroundedSchemaResponse as GroundedSchemaResponse, ontologyBridge_ImportFoundryRequest as ImportFoundryRequest, ontologyBridge_ImportFoundryResponse as ImportFoundryResponse, ontologyBridge_ImportOwlRequest as ImportOwlRequest, ontologyBridge_ImportOwlResponse as ImportOwlResponse, ontologyBridge_ListBindingsResponse as ListBindingsResponse, ontologyBridge_TranspileRequest as TranspileRequest, ontologyBridge_TranspileResponse as TranspileResponse };
+  export type { ontologyBridge_BindSortRequest as BindSortRequest, ontologyBridge_BindSortResponse as BindSortResponse, ontologyBridge_BindingSummaryDto as BindingSummaryDto, ontologyBridge_BulkBindError as BulkBindError, ontologyBridge_BulkBindSortsRequest as BulkBindSortsRequest, ontologyBridge_BulkBindSortsResponse as BulkBindSortsResponse, ontologyBridge_ColumnMappingDto as ColumnMappingDto, ontologyBridge_FoundryReviewItemDto as FoundryReviewItemDto, ontologyBridge_GroundedSchemaResponse as GroundedSchemaResponse, ontologyBridge_ImportFoundryRequest as ImportFoundryRequest, ontologyBridge_ImportFoundryResponse as ImportFoundryResponse, ontologyBridge_ImportOwlRequest as ImportOwlRequest, ontologyBridge_ImportOwlResponse as ImportOwlResponse, ontologyBridge_KeyProvenanceDto as KeyProvenanceDto, ontologyBridge_ListBindingsResponse as ListBindingsResponse, ontologyBridge_TranspileRequest as TranspileRequest, ontologyBridge_TranspileResponse as TranspileResponse };
 }
 
 /**