@lh8ppl/claude-memory-kit 0.2.4 → 0.3.1

package/src/transcript-index.mjs

@@ -0,0 +1,165 @@
+// Task 104.2 (D-117) — transcript chunking + index sync: the SEARCH half of
+// the L3 raw tier (the capture half shipped in 104.1). Transcript files
+// (context/transcripts/{date}.md — dialogue + per-turn Tools blocks) are
+// chunked by `## ` turn headings and windowed to ≤1500 chars (the memsearch
+// chunking rule Task 65 adopted), then synced into the SEPARATE
+// transcript_chunks table (index-db.mjs) so `cmk search --scope transcripts`
+// reaches them WITHOUT polluting L1 fact results (the MemPalace last-resort
+// contract, D-70/D-72).
+//
+// Sync strategy mirrors the observation indexer: per-file mtime/sha1 rows in
+// the shared `files` table (keyed with a 'transcript:' prefix so they never
+// collide with observation sources) → unchanged files cost one stat.
+//
+// Public boundary:
+//   chunkTranscript(text) → [{heading, body, sourceLine, chunkIdx}]  (pure)
+//   syncTranscriptChunks({db, projectRoot, now?}) → {files, chunks}
+
+import { hashContent } from './content-hash.mjs';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const CHUNK_MAX_CHARS = 1500; // the Task-65 / memsearch chunking rule
+const FILES_KEY_PREFIX = 'transcript:';
+
+export function chunkTranscript(text) {
+  if (typeof text !== 'string' || text.trim() === '') return [];
+  const lines = text.split(/\r?\n/);
+  // Locate turn headings (`## <ts> — speaker`, the capture-prompt/-turn shape).
+  const headings = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (/^##\s/.test(lines[i])) headings.push(i);
+  }
+  if (headings.length === 0) return [];
+
+  const chunks = [];
+  let chunkIdx = 0;
+  for (let h = 0; h < headings.length; h++) {
+    const start = headings[h];
+    const end = h + 1 < headings.length ? headings[h + 1] : lines.length;
+    const heading = lines[start].trim();
+    const body = lines
+      .slice(start + 1, end)
+      .join('\n')
+      .trim();
+    if (body === '') continue;
+    // Window oversized turns; every window keeps its turn heading so a hit
+    // is always attributable to a specific turn.
+    for (let off = 0; off < body.length; off += CHUNK_MAX_CHARS) {
+      chunks.push({
+        heading,
+        body: body.slice(off, off + CHUNK_MAX_CHARS),
+        sourceLine: start + 1, // 1-based heading line — the drill-back anchor
+        chunkIdx: chunkIdx++,
+      });
+    }
+  }
+  return chunks;
+}
+
+// Transcript-chunk fingerprint for the `files`-table diff key (column name
+// `sha1` kept for checkpoint back-compat; algorithm is SHA-256 via hashContent,
+// D-149). Self-heals on the first post-upgrade boot like the observation index.
+function sha1(text) {
+  return hashContent(text);
+}
+
+// Task 126 (D-119) — the raw-tier scope covers BOTH halves of the session
+// record: verbatim transcripts AND the Haiku-compressed sessions summaries
+// (today-*.md / recent.md / archive.md — the middle tier that was otherwise
+// a recall blind spot: discussed-but-never-graduated content). Exclusions:
+// now.md (the volatile live buffer — already in context, and its constant
+// truncation would churn the index) and non-.md observability files.
+const RAW_TIER_DIRS = ['transcripts', 'sessions'];
+const SESSIONS_EXCLUDE = new Set(['now.md']);
+
+export function syncTranscriptChunks({ db, projectRoot, now = Date.now() } = {}) {
+  let files = 0;
+  let chunks = 0;
+
+  const entries = []; // {abs, sourceFile}
+  for (const sub of RAW_TIER_DIRS) {
+    const dir = join(projectRoot, 'context', sub);
+    if (!existsSync(dir)) continue;
+    let names;
+    try {
+      names = readdirSync(dir).filter(
+        (n) => n.endsWith('.md') && !(sub === 'sessions' && SESSIONS_EXCLUDE.has(n)),
+      );
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      entries.push({ abs: join(dir, name), sourceFile: `context/${sub}/${name}` });
+    }
+  }
+
+  const getFileRow = db.prepare('SELECT mtime, sha1 FROM files WHERE path = ?');
+  const upsertFileRow = db.prepare(
+    'INSERT INTO files (path, mtime, sha1, indexed_at) VALUES (?, ?, ?, ?) ' +
+      'ON CONFLICT(path) DO UPDATE SET mtime = excluded.mtime, sha1 = excluded.sha1, indexed_at = excluded.indexed_at',
+  );
+  const deleteChunks = db.prepare('DELETE FROM transcript_chunks WHERE source_file = ?');
+  const insertChunk = db.prepare(
+    'INSERT INTO transcript_chunks (source_file, chunk_idx, source_line, heading, body) VALUES (?, ?, ?, ?, ?)',
+  );
+
+  for (const { abs, sourceFile } of entries) {
+    const filesKey = FILES_KEY_PREFIX + sourceFile;
+    let st;
+    try {
+      st = statSync(abs);
+    } catch {
+      continue;
+    }
+    const prev = getFileRow.get(filesKey);
+    // NO mtime fast-path: two appends inside the filesystem's mtime
+    // resolution would make the second invisible (caught as a flaky test —
+    // rapid Stop hooks are the same shape in production). sha1 is the
+    // authority; day-files are small and reindex reads its other sources
+    // anyway, so the read cost is negligible.
+    let text;
+    try {
+      text = readFileSync(abs, 'utf8');
+    } catch {
+      continue;
+    }
+    const digest = sha1(text);
+    if (prev && prev.sha1 === digest) {
+      continue; // content unchanged
+    }
+
+    const parsed = chunkTranscript(text);
+    const replaceFile = db.transaction(() => {
+      deleteChunks.run(sourceFile);
+      for (const c of parsed) {
+        insertChunk.run(sourceFile, c.chunkIdx, c.sourceLine, c.heading, c.body);
+      }
+      upsertFileRow.run(filesKey, Math.trunc(st.mtimeMs), digest, now);
+    });
+    replaceFile();
+    files += 1;
+    chunks += parsed.length;
+  }
+
+  // Orphan-prune for THIS scope: a deleted/rotated file (transcripts OR
+  // sessions — weekly-curate rotates today-*.md into archive.md) leaves its
+  // chunks + checkpoint behind otherwise. The observation indexer's prune
+  // deliberately skips 'transcript:' rows (they are not observation sources)
+  // — pruning them is this function's job, scoped by the key prefix.
+  const live = new Set(entries.map((e) => FILES_KEY_PREFIX + e.sourceFile));
+  const known = db
+    .prepare("SELECT path FROM files WHERE path LIKE ?")
+    .all(FILES_KEY_PREFIX + '%');
+  const pruneTxn = db.transaction((filesKey) => {
+    db.prepare('DELETE FROM transcript_chunks WHERE source_file = ?').run(
+      filesKey.slice(FILES_KEY_PREFIX.length),
+    );
+    db.prepare('DELETE FROM files WHERE path = ?').run(filesKey);
+  });
+  for (const { path } of known) {
+    if (!live.has(path)) pruneTxn(path);
+  }
+
+  return { files, chunks };
+}

package/src/turn-tools.mjs

@@ -0,0 +1,179 @@
+// Task 104.1 — extract the CURRENT turn's tool activity from Anthropic's
+// session JSONL (the Stop payload's `transcript_path`) so capture-turn can
+// enrich the kit's own committed transcript (the L3 raw tier of the recall
+// waterfall, design §19 / D-117).
+//
+// Why read the live JSONL: it is the only record of tool calls + results
+// (the Stop payload itself carries only the assistant TEXT), and it expires
+// (~30 days, machine-local) — we extract the current turn into OUR format at
+// capture time; we never copy/snapshot the file (the user's 2026-06-06
+// directive: enriching our own transcript, not a JSONL crutch).
+//
+// The JSONL internal format is NOT a documented Anthropic contract (only
+// `transcript_path` is). Shapes below were verified EMPIRICALLY across 6
+// sessions / 4 projects (2026-06-10):
+//   - entries: {type: 'user'|'assistant'|<harness types to skip>, message?}
+//   - message.content: a block LIST or a plain STRING (both real)
+//   - blocks: text / thinking / tool_use {id,name,input} / tool_result
+//     {tool_use_id, content: STRING or LIST of {type:'text',text}}
+//   - tool_result blocks ride USER-role entries (API convention) — a user
+//     entry is a real prompt boundary ONLY if it has text and no tool_result.
+// Everything here is defensive: unrecognized shapes are skipped; any failure
+// returns null. A format shift degrades the enrichment, never the capture.
+//
+// Public boundary:
+//   extractTurnToolActivity(jsonlText) → string|null   (pure)
+//   readTranscriptTail(path, maxBytes?) → string        (bounded file read)
+
+import { openSync, readSync, closeSync, fstatSync } from 'node:fs';
+
+// Caps (git-bloat control, the D-117 sub-decision (a)): one turn's Tools
+// block stays a small fraction of a transcript day.
+const RESULT_SNIPPET_CHARS = 300;
+const INPUT_SUMMARY_CHARS = 160;
+const BLOCK_CAP_CHARS = 4000;
+// Tail bound: one turn comfortably fits; a mega-session file is never read whole.
+const DEFAULT_TAIL_BYTES = 768 * 1024;
+
+// The most informative input field per common tool; unknown tools fall back
+// to a compact JSON summary. Order matters — first present key wins.
+const REPRESENTATIVE_INPUT_KEYS = [
+  'command',
+  'file_path',
+  'pattern',
+  'query',
+  'url',
+  'path',
+  'prompt',
+];
+
+function oneLine(s, max) {
+  const flat = String(s).replace(/\s+/g, ' ').trim();
+  return flat.length > max ? flat.slice(0, max) + '…' : flat;
+}
+
+function summarizeInput(input) {
+  if (!input || typeof input !== 'object') return '';
+  for (const key of REPRESENTATIVE_INPUT_KEYS) {
+    if (typeof input[key] === 'string' && input[key].trim() !== '') {
+      return oneLine(input[key], INPUT_SUMMARY_CHARS);
+    }
+  }
+  try {
+    return oneLine(JSON.stringify(input), INPUT_SUMMARY_CHARS);
+  } catch {
+    return '';
+  }
+}
+
+function flattenResultContent(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((b) => (b && typeof b === 'object' && typeof b.text === 'string' ? b.text : ''))
+      .filter(Boolean)
+      .join(' ');
+  }
+  return '';
+}
+
+function contentBlocks(message) {
+  const c = message?.content;
+  return Array.isArray(c) ? c.filter((b) => b && typeof b === 'object') : [];
+}
+
+// A user entry is a REAL prompt boundary when it carries prompt text (string
+// content or a text block) and no tool_result blocks (results ride user role).
+function isRealUserPrompt(entry) {
+  if (entry?.type !== 'user') return false;
+  const c = entry.message?.content;
+  if (typeof c === 'string') return c.trim() !== '';
+  const blocks = contentBlocks(entry.message);
+  if (blocks.some((b) => b.type === 'tool_result')) return false;
+  return blocks.some((b) => b.type === 'text' && typeof b.text === 'string' && b.text.trim() !== '');
+}
+
+export function extractTurnToolActivity(jsonlText) {
+  if (typeof jsonlText !== 'string' || jsonlText.trim() === '') return null;
+
+  const entries = [];
+  for (const raw of jsonlText.split('\n')) {
+    if (raw.trim() === '') continue;
+    try {
+      const e = JSON.parse(raw);
+      if (e && (e.type === 'user' || e.type === 'assistant')) entries.push(e);
+    } catch {
+      // partial first line of a tail read, or harness noise — skip
+    }
+  }
+  if (entries.length === 0) return null;
+
+  let lastPromptIdx = -1;
+  for (let i = entries.length - 1; i >= 0; i--) {
+    if (isRealUserPrompt(entries[i])) {
+      lastPromptIdx = i;
+      break;
+    }
+  }
+  // No prompt boundary in the (tail) window → attribute everything we see to
+  // the current turn rather than dropping it (the tail bound already scopes us).
+  const turn = entries.slice(lastPromptIdx + 1);
+
+  const calls = []; // {id, name, summary, result}
+  const byId = new Map();
+  for (const e of turn) {
+    for (const b of contentBlocks(e.message)) {
+      if (b.type === 'tool_use' && typeof b.name === 'string') {
+        const call = { id: b.id, name: b.name, summary: summarizeInput(b.input), result: '' };
+        calls.push(call);
+        if (typeof b.id === 'string') byId.set(b.id, call);
+      } else if (b.type === 'tool_result') {
+        const call = typeof b.tool_use_id === 'string' ? byId.get(b.tool_use_id) : undefined;
+        if (call && !call.result) {
+          call.result = oneLine(flattenResultContent(b.content), RESULT_SNIPPET_CHARS);
+        }
+      }
+    }
+  }
+  if (calls.length === 0) return null;
+
+  const lines = [];
+  let used = 0;
+  let shown = 0;
+  for (const call of calls) {
+    const line = `- ${call.name}(${call.summary})${call.result ? ` → ${call.result}` : ''}`;
+    if (used + line.length + 1 > BLOCK_CAP_CHARS) break;
+    lines.push(line);
+    used += line.length + 1;
+    shown += 1;
+  }
+  if (shown < calls.length) {
+    lines.push(`- …${calls.length - shown} more tool call(s) truncated`);
+  }
+  return lines.join('\n');
+}
+
+// Bounded tail read — a turn comfortably fits in the window; a multi-MB
+// session file is never loaded whole inside the Stop hook's budget.
+export function readTranscriptTail(path, maxBytes = DEFAULT_TAIL_BYTES) {
+  let fd;
+  try {
+    fd = openSync(path, 'r');
+    const size = fstatSync(fd).size;
+    const start = Math.max(0, size - maxBytes);
+    const len = size - start;
+    const buf = Buffer.alloc(len);
+    readSync(fd, buf, 0, len, start);
+    return buf.toString('utf8');
+  } catch {
+    return '';
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // best-effort close
+      }
+    }
+  }
+}

package/src/write-fact.mjs

@@ -21,6 +21,7 @@ import { reindex } from './reindex.mjs';
 import { appendAuditEntry, nowIso, REASON_CODES } from './audit-log.mjs';
 import { ERROR_CATEGORIES, errorResult } from './result-shapes.mjs';
 import { sanitizeHomePaths } from './sanitize.mjs';
+import { sanitizePrivacyTags } from './privacy.mjs';
 import { checkPoisonGuard, logPoisonGuardRejection } from './poison-guard.mjs';
 
 const VALID_TYPES = new Set(['user', 'feedback', 'project', 'reference']);
@@ -157,6 +158,14 @@ export function writeFact(opts = {}) {
   // — that's its purpose. The id hashes the SANITIZED body, so dedup keys on
   // what actually lands on disk.
   let { body, title } = opts;
+  // Privacy: strip <private>…</private> FIRST, on EVERY tier (cut-gate
+  // v0.3.1 finding — the tag was honored only by the UserPromptSubmit hook,
+  // so a fact written via cmk remember/mk_remember/import kept the secret).
+  // Runs before home-path sanitization, Poison_Guard, and id-generation, so
+  // the redacted body is what gets screened, hashed (dedup keys on what
+  // lands), and written.
+  body = sanitizePrivacyTags(body);
+  title = sanitizePrivacyTags(title);
   if (opts.tier === 'P' || opts.tier === 'U') {
     body = sanitizeHomePaths(body);
     title = sanitizeHomePaths(title);
@@ -252,10 +261,32 @@ export function writeFact(opts = {}) {
   // 2026-06-03 — "users should get it working from the start"). Best-effort: the
   // fact is already durably on disk, so an index-rebuild hiccup must not turn a
   // successful capture into an error — the next reindex/search self-heals.
+  //
+  // D-152: the failure is OBSERVABLE, not silently swallowed. A detached
+  // auto-extract child whose reindex was killed mid-rebuild (hook ceiling) used
+  // to leave INDEX.md lagging with ZERO trace — so a stale committed INDEX was
+  // undiagnosable (the user caught a 5-fact lag in the cut-gate). On throw we
+  // now record an INDEX_REBUILD_FAILED audit entry; HC-4 still detects the drift
+  // and `cmk reindex` corrects it. The `_reindexFn` seam is test-only.
+  const doReindex = opts._reindexFn ?? reindex;
   try {
-    reindex({ tier: opts.tier, projectRoot: opts.projectRoot, userDir: opts.userDir, warn: () => {} });
-  } catch {
-    // index rebuild is best-effort; capture already succeeded
+    doReindex({ tier: opts.tier, projectRoot: opts.projectRoot, userDir: opts.userDir, warn: () => {} });
+  } catch (reindexErr) {
+    // index rebuild is best-effort; capture already succeeded — but leave a
+    // trace so a lagging committed INDEX is diagnosable, never silent.
+    try {
+      appendAuditEntry(tierRoot, {
+        ts: createdAt,
+        action: 'index-rebuild-failed',
+        tier: opts.tier,
+        id,
+        reasonCode: REASON_CODES.INDEX_REBUILD_FAILED,
+        paths: { after: path },
+        extra: { error: String(reindexErr?.message ?? reindexErr) },
+      });
+    } catch {
+      // even the audit append is best-effort; the fact is already on disk
+    }
   }
 
   // Default create-audit (Task 123.A / D-103). writeFact is the single boundary

package/template/.claude/skills/memory-search/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: memory-search
+description: Searches the project's recorded memory (claude-memory-kit) — decisions, conventions, architecture, the reasoning behind choices, and where things live — and returns a curated, cited summary. Fire whenever the answer might be something the project already established in past work, HOWEVER the question is phrased — any prior decision, convention, rationale, or "how/where/why is it this way" question, including oblique or roundabout asks ("why is everything so spread out?", "remind me what we settled on for X", "how come these files are tiny?"). Also fire when a "[claude-memory-kit] Memory available" hint appears on the prompt. The examples are illustrative, not a checklist — prefer recalling over re-deriving an answer from the code. The session-start snapshot is a bounded index; this skill reaches the rest. Skip only when the question is purely about uncommitted or just-edited live code that memory cannot know, concerns this conversation only, or the user asked to ignore memory.
+context: fork
+allowed-tools: mcp__cmk__mk_search mcp__cmk__mk_get mcp__cmk__mk_timeline mcp__cmk__mk_recent_activity Bash(cmk search *) Bash(cmk get *) Bash(cmk timeline *) Bash(cmk recent-activity *)
+---
+
+# Recalling from deep memory
+
+You are a memory-retrieval agent. Search the kit's memory archive for: $ARGUMENTS
+
+Query well: search the core noun phrases (e.g. "deploy target", "auth
+library decision"), not a full sentence. If the line above carries NO query
+(you run isolated and cannot see the conversation), start from the
+"When the query is vague" section below instead.
+
+Memory is the ground truth for documented knowledge and prior decisions
+(the injected-snapshot authority rule). Your job is to find what is already
+recorded and return ONLY a curated summary — never the raw dumps.
+
+## The 3-step ladder (filter before you fetch)
+
+Work index → context → bodies. Full bodies are ~10x the tokens of an index
+line; fetch them only for the ids that survived filtering.
+
+**Step 1 — Search the index.** Prefer the MCP tool when the `cmk` server is
+connected; otherwise the CLI:
+
+- MCP: `mk_search` with `query` (natural language is fine — when semantic
+  recall is enabled the project default searches by meaning; paraphrase hits).
+- CLI: `cmk search "<query>"`
+
+Each hit is one line: id, tier/trust, source location, snippet. Run 1-3
+query variants if the first misses (synonyms; the key noun alone). Drop
+hits that are clearly off-topic or too generic.
+
+**Step 2 — Context around an anchor (optional).** When a hit looks right
+but you need what happened around it (what led to a decision, what followed
+a fix):
+
+- MCP: `mk_timeline` with `anchor: "<id>"` (and `depth_before`/`depth_after`).
+- CLI: `cmk timeline <id>`
+
+**Step 3 — Fetch full bodies for the survivors only.**
+
+- MCP: `mk_get` with `ids: [...]` — batch all survivors in ONE call.
+- CLI: `cmk get <id> <id> ...`
+
+Rich facts carry **Why** / **How to apply** blocks — include those when the
+question is about rationale or how to act on a rule.
+
+**Step 4 — LAST RESORT: the session record.** Only when curated memory
+(steps 1-3) has no answer and the question is about what actually happened
+in a past session (an exact error message, the command that fixed
+something, how a discussion went). This scope covers the verbatim
+transcripts AND the compressed session summaries:
+
+- MCP: `mk_search` with `scope: "transcripts"`.
+- CLI: `cmk search "<query>" --scope transcripts`
+
+Hits are raw turn excerpts (dialogue + the tools the agent ran), keyed
+`T:<file>:<line>` — quote the relevant fragment in your summary; never dump
+whole turns. If something found here is durably useful, say so in the
+summary so the caller can capture it as a proper fact.
+
+## When the query is vague
+
+If you cannot form a concrete query, look at recent activity first, then
+search the topic that stands out:
+
+- MCP: `mk_recent_activity` (window `7d`) · CLI: `cmk recent-activity --window 7d`
+
+## Output
+
+Return a short, curated answer for the main conversation:
+
+- The relevant facts/decisions, each with its citation id (e.g. `P-XXXXXXXX`)
+  and the Why when it matters.
+- One line of source traceability per item (the source file the index line
+  showed).
+- If nothing relevant exists, say exactly that — "no recorded memory on
+  this" — so the caller knows to derive it fresh and capture it afterward.
+
+Never paste full fact files or long bodies into the summary; condense.
+This skill is read-only — capturing new facts is the `memory-write` skill's
+job.

package/template/.gitattributes.fragment

@@ -0,0 +1,16 @@
+# claude-memory-kit — added by `cmk install`. Do not edit by hand;
+# `cmk install` refreshes these lines idempotently. Remove via
+# `cmk uninstall`.
+#
+# Force LF on the COMMITTED memory files. The kit's frontmatter parser uses
+# a strict-LF boundary and split('\n') readers; default Windows git
+# (autocrlf=true) rewrites line endings at clone, which made every fact
+# invisible to search on a Windows checkout (D-126). The read side now
+# self-heals (tolerant CRLF reads), but pinning LF here PREVENTS the
+# mangling so it never has to.
+#
+# Scoped to the text extensions the kit actually commits (.md + .json) under
+# context/ — NOT a blanket `context/** text`, so a future committed binary
+# under context/ is never force-normalized + corrupted.
+context/**/*.md text eol=lf
+context/**/*.json text eol=lf

package/template/CLAUDE.md.template

@@ -26,7 +26,7 @@ The `cmk doctor` health checks verify each layer is wired correctly: install int
 
 ### Recalling memory (for Claude)
 
-The snapshot injected at session start is a **bounded hot index, not everything** — there is a deeper, queryable archive. When a question is "what did we decide / what's our X / how does the user work / what's the setup," **query your memory instead of re-deriving the answer from scratch**:
+The snapshot injected at session start is a **bounded hot index, not everything** — there is a deeper, queryable archive. When a question is "what did we decide / what's our X / how does the user work / what's the setup / **how is this project structured or built / where does X live / what's the architecture**," **query your memory instead of re-deriving the answer from scratch** — the structure is a recorded decision, recall it before re-reading the files to reconstruct it:
 
 - **`cmk search "<topic>"`** — find any captured fact (decisions, preferences, config, lessons) across the project + user tiers.
 - **`context/memory/<type>_<slug>.md`** — the granular fact archive with full **Why / How** rationale (`context/memory/INDEX.md` lists them).
@@ -34,6 +34,8 @@ The snapshot injected at session start is a **bounded hot index, not everything*
 
 Reach for these *first* — re-deriving an answer the project already recorded (by re-reading files, re-searching, or working it out again) wastes the memory that exists precisely so you don't have to. Recall from memory first, then verify against the source if needed.
 
+**Authority rule:** when injected memory contradicts your assumptions, injected memory wins — it is the ground truth for documented knowledge and prior decisions (terminal/tool output stays the ground truth for live system state; official docs for version-specifics). Never treat a question as novel when the answer is already in your prompt.
+
 ### Memory write rules (for Claude)
 
 Most capture is automatic — the Stop hook extracts durable facts each turn, no action needed. To capture something **explicitly**, the **`memory-write` skill** carries the full procedure; it loads on demand when you save a fact. The invariants it enforces: