@panaversity/ksor 0.0.8 → 0.0.9

package/dist/cli.mjs

@@ -16,7 +16,7 @@ import { bodyLimit } from "hono/body-limit";
 import { execFileSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
 import { readFile, readdir, stat } from "node:fs/promises";
-//#region ../content-gateway/dist/main-fIdtI02D.mjs
+//#region ../content-gateway/dist/main-tBbDvU1w.mjs
 /**
 * A connection could not be ESTABLISHED in time — retryable.
 *
@@ -4082,7 +4082,7 @@ async function withPgRetry(op, options = {}) {
 	throw lastError;
 }
 //#endregion
-//#region ../content/dist/commands-BxgkBvyW.mjs
+//#region ../content/dist/commands-1ZBNjWKb.mjs
 /**
 * EVAL-LOCKED constants, quarried verbatim from the oracle
 * (sor-agentfactory @ b554f91, config.py) — changing any of these is a
@@ -5849,1609 +5849,1609 @@ async function assertGovernanceServable(pool, instance, targetGeneration) {
   why: an author restricted those documents and nothing would enforce it — this door would serve them in full to every caller, and the frontmatter key saying otherwise would be the only trace. The site refuses to BUILD in this exact state (ksor-visibility-without-audiences); the door must not serve in it
   fix: declare the model in instance.md (audiences: least-restricted first, plus default_visibility:), or remove the visibility: keys and re-ingest`);
 }
+/** §5 rule 2: snapshot-token TTL (30 min) + 10 min = 40 min from retirement. */
+const GC_GRACE_MS = 24e5;
 /**
-* The §7 row for a governance act, written INSIDE the same transaction as the
-* act. `logRead` deliberately covers only the four serving actions; a takedown
-* is a write-plane act, and separating the two writes would allow a denial with
-* no row proving it happened — the one outcome the ledger exists to prevent.
+* Poison-chunk tolerance (oracle review: poison-chunk-wedge): one
+* deterministically-failing chunk must not wedge every future flip forever. A
+* generation is servable if a SMALL fraction failed — the read path already
+* filters to `embedded`, so a quarantined chunk is simply absent, not
+* corrupt. Above the fraction, a real ingest break is signalled by
+* withholding readiness.
 */
-async function recordAct(client, instance, detail, actor, action = "takedown_applied") {
-	await client.query("INSERT INTO retrieval_log (tenant_id, corpus_id, actor, action, detail) VALUES ($1, $2, $3, $5, $4::jsonb)", [
-		instance.tenantId,
-		instance.corpusId,
-		actor,
-		JSON.stringify(detail),
-		action
+const MAX_FAILED_FRACTION = .02;
+const LOCK_SQL = "SELECT pg_advisory_xact_lock(hashtextextended('sor-ingest:' || $1, 0))";
+/**
+* Take the tenant lock, allocate generation max+1 (monotonic per corpus,
+* never reused), open the building run. The corpora row seeds at
+* active_generation=0 (nothing active) on first ingest.
+*
+* `manifestSha256` fills `instance_bundle_sha256` — ksor has no bundle
+* transport (the CLI reads the local repo), so the recorded digest is of the
+* manifest this build actually consumed: the closest honest provenance.
+*/
+async function allocateRun(client, opts) {
+	await client.query(LOCK_SQL, [opts.tenantId]);
+	await client.query("INSERT INTO corpora (tenant_id, corpus_id, active_generation) VALUES ($1, $2, 0) ON CONFLICT (tenant_id, corpus_id) DO NOTHING", [opts.tenantId, opts.corpusId]);
+	const next = await client.query("SELECT COALESCE(max(generation), 0) + 1 AS next FROM ingestion_runs WHERE tenant_id = $1 AND corpus_id = $2", [opts.tenantId, opts.corpusId]);
+	const generation = Number(next.rows[0].next);
+	const run = await client.query("INSERT INTO ingestion_runs (tenant_id, corpus_id, generation, state, source_commit, instance_bundle_sha256, schema_version) VALUES ($1, $2, $3, 'building', $4, $5, $6) RETURNING run_id", [
+		opts.tenantId,
+		opts.corpusId,
+		generation,
+		opts.sourceCommit,
+		opts.manifestSha256,
+		schemaVersion()
 	]);
+	return {
+		runId: Number(run.rows[0].run_id),
+		generation
+	};
 }
 /**
-* Deny a node (or its subtree) and record the act.
+* The generation to carry embeddings FROM: the newest COMPLETE one holding
+* embedded chunks.
 *
-* The audit row is written in the SAME transaction as the denial: a takedown
-* that happened without a row proving it happened is exactly the shape the
-* §7 ledger exists to prevent.
+* WHY NOT ONLY THE ACTIVE ONE: the eval-before-flip design means a candidate
+* is often built, measured, and deliberately NOT served; ACTIVE then points
+* at an OLD generation and the next candidate re-embeds the whole corpus —
+* measured 2026-08-02: generation 4 re-embedded 5,915 chunks while
+* generation 3 held near-identical content, because generation 1 was still
+* active.
+*
+* Two constraints a rewrite once dropped (oracle review of PR #420):
+* CORPUS-SCOPED via the run-table join (chunks carry no corpus_id), and
+* COMPLETE RUNS ONLY (ready/active/retired) — a crashed `building` queue's
+* half-drained vectors never qualify.
+*
+* Returns 0 when there is no complete embedded generation — the first ingest.
 */
-async function applyTakedown(pool, instance, opts) {
-	return runIngest(pool, instance.tenantId, async (client) => {
-		const resolves = ((await client.query(`SELECT 1 FROM content_nodes n
-         JOIN corpora c ON c.tenant_id = n.tenant_id AND c.corpus_id = $2
-        WHERE n.tenant_id = $1 AND n.stable_id = $3 AND n.generation = c.active_generation
-        LIMIT 1`, [
-			instance.tenantId,
-			instance.corpusId,
-			opts.stableId
-		])).rowCount ?? 0) > 0;
-		const changed = (await client.query("INSERT INTO takedown_denylist (tenant_id, corpus_id, stable_id, scope, reason) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (tenant_id, corpus_id, stable_id) DO UPDATE   SET scope = EXCLUDED.scope, reason = EXCLUDED.reason WHERE takedown_denylist.scope IS DISTINCT FROM EXCLUDED.scope    OR takedown_denylist.reason IS DISTINCT FROM EXCLUDED.reason RETURNING stable_id", [
-			instance.tenantId,
-			instance.corpusId,
-			opts.stableId,
-			opts.scope,
-			opts.reason
-		])).rowCount === 1;
-		await recordAct(client, instance, {
-			stable_id: opts.stableId,
-			scope: opts.scope,
-			reason: opts.reason,
-			change: changed ? "applied" : "unchanged"
-		}, opts.actor);
-		return {
-			stableId: opts.stableId,
-			scope: opts.scope,
-			changed,
-			resolves
-		};
-	});
-}
-/** Lift a denial. The ledger keeps the row that recorded imposing it. */
-async function revokeTakedown(pool, instance, opts) {
-	return runIngest(pool, instance.tenantId, async (client) => {
-		const changed = ((await client.query("DELETE FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2 AND stable_id = $3", [
-			instance.tenantId,
-			instance.corpusId,
-			opts.stableId
-		])).rowCount ?? 0) > 0;
-		await recordAct(client, instance, {
-			stable_id: opts.stableId,
-			change: changed ? "revoked" : "not-denied"
-		}, opts.actor, "takedown_revoked");
-		return {
-			stableId: opts.stableId,
-			scope: "node",
-			changed
-		};
-	});
-}
-async function readLedger(pool, instance, limit) {
-	return runAuditRead(pool, instance.tenantId, async (client) => {
-		return (await client.query("SELECT action, actor, generation, detail, created_at FROM retrieval_log WHERE tenant_id = $1 AND corpus_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3", [
-			instance.tenantId,
-			instance.corpusId,
-			limit
-		])).rows.map((row) => ({
-			action: String(row.action),
-			actor: String(row.actor),
-			generation: row.generation === null ? null : Number(row.generation),
-			detail: row.detail ?? {},
-			createdAt: row.created_at
-		}));
-	});
+async function bestCarrySource(client, opts) {
+	const gen = (await client.query(`
+    SELECT max(c.generation) AS gen FROM chunks c
+    JOIN ingestion_runs r ON r.tenant_id = c.tenant_id AND r.generation = c.generation
+    WHERE c.tenant_id = $1 AND r.corpus_id = $2
+      AND r.state IN ('ready', 'active', 'retired')
+      AND c.generation <> $3 AND c.embedding_status = 'embedded'
+    `, [
+		opts.tenantId,
+		opts.corpusId,
+		opts.excludeGeneration
+	])).rows[0]?.gen ?? null;
+	return gen === null ? 0 : Number(gen);
 }
 /**
-* Every stable_id a build must not publish, with `subtree` denials EXPANDED to
-* their actual descendants by the same `parent_id` walk the serving side uses.
+* Copy embeddings for chunks whose ENTIRE embed input is unchanged (hash +
+* heading path + node title). Cost ∝ change survives the generational
+* rebuild. Returns rows carried.
 *
-* The site cannot do this itself: it has no tree, so it matched a prefix — and
-* a section's stable_id ends in `/index` (or `#section`), so the prefix never
-* matched its children and every descendant of a subtree takedown kept
-* publishing. Decision 14 records exactly why a prefix is wrong here; the fix
-* is to resolve the walk where the tree lives and hand over a flat list
-* (round-2 review of #43).
+* `modelId` is REQUIRED, never defaulted here: the vendor transport is
+* irrelevant to the space (the same model through two providers is the same
+* space), and a silent module default is exactly how a model bump would
+* carry stale vectors unnoticed.
 */
-async function deniedStableIds(pool, instance) {
-	return runRead(pool, instance.tenantId, async (client) => {
-		return (await client.query(`WITH RECURSIVE gen AS (
-         SELECT active_generation AS g FROM corpora WHERE tenant_id = $1 AND corpus_id = $2
-       ),
-       seed AS (
-         SELECT n.node_id, n.stable_id, d.scope
-           FROM takedown_denylist d
-           JOIN content_nodes n ON n.tenant_id = d.tenant_id AND n.stable_id = d.stable_id
-           JOIN gen ON n.generation = gen.g
-          WHERE d.tenant_id = $1 AND d.corpus_id = $2
-       ),
-       walk AS (
-         SELECT node_id, stable_id, scope FROM seed
-         UNION ALL
-         SELECT c.node_id, c.stable_id, w.scope
-           FROM content_nodes c
-           JOIN walk w ON c.parent_id = w.node_id
-           JOIN gen ON c.generation = gen.g
-          WHERE c.tenant_id = $1 AND w.scope = 'subtree'
-       )
-       SELECT DISTINCT stable_id FROM walk
-       UNION
-       -- Denials naming a stable_id no CURRENT generation carries are still
-       -- denied: identity outlives any one generation (decision 14).
-       SELECT stable_id FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2`, [instance.tenantId, instance.corpusId])).rows.map((r) => String(r.stable_id)).sort();
-	});
+async function carryForward(client, opts) {
+	if (opts.fromGeneration < 1) return 0;
+	return (await client.query(`
+    UPDATE chunks new SET embedding = old.embedding, embedding_status = 'embedded',
+           embedded_at = old.embedded_at, embedding_model = old.embedding_model
+    FROM chunks old, sources os, content_nodes onode, sources ns, content_nodes nnode
+    WHERE new.tenant_id = $1 AND new.generation = $2
+      AND new.embedding_status = 'pending'
+      AND old.tenant_id = new.tenant_id AND old.generation = $3
+      AND old.embedding_status = 'embedded'
+      -- R-1 gate (oracle review: carry-model-gate-r1): carry ONLY vectors from the CURRENT
+      -- embedding model. Without this, a model bump silently carries every old-model vector
+      -- forward (pending→0, flip → corpus-wide nonsense cosine vs the new query model, zero
+      -- errors). A model change now correctly leaves the old vectors pending → they re-embed.
+      AND old.embedding_model = $4
+      AND old.source_id = new.source_id
+      AND old.chunk_hash = new.chunk_hash
+      AND old.heading_path_text IS NOT DISTINCT FROM new.heading_path_text
+      AND os.source_id = old.source_id AND os.tenant_id = old.tenant_id
+      AND os.generation = old.generation
+      AND onode.node_id = os.node_id AND onode.tenant_id = os.tenant_id
+      AND ns.source_id = new.source_id AND ns.tenant_id = new.tenant_id
+      AND ns.generation = new.generation
+      AND nnode.node_id = ns.node_id AND nnode.tenant_id = ns.tenant_id
+      AND onode.title = nnode.title
+    `, [
+		opts.tenantId,
+		opts.generation,
+		opts.fromGeneration,
+		opts.modelId
+	])).rowCount ?? 0;
 }
 /**
-* The knowledge-relative DIRECTORIES that `--subtree` denials govern.
-*
-* Derived from the DESCENDANTS' `sources.origin_path`, never from the denied
-* node's own id or path, because neither works:
-*
-*   a section has no source     `knowledge/policies#section` is synthetic — the
-*                               tree node for a directory. Joining `sources` on
-*                               the denied node itself yields nothing, and a
-*                               section is the ordinary target of `--subtree`.
-*   a leaf's directory is not   `--subtree` on one document would emit that
-*   its subtree                 document's directory and deny every sibling.
-*
-* So: walk the descendants, take the directory of each one's file, and keep the
-* SHALLOWEST — a directory that contains another in the set is the subtree
-* root, and `startsWith` then covers subdirectories added later too. A denial
-* with no descendants contributes nothing, which is correct: its subtree is
-* itself, and the flat id list already holds it.
-*
-* The seed's OWN file counts when the seed has children, and only then — see
-* the SQL comment: a container's index.md names its directory, a leaf's file
-* names its parent's.
+* avg(embedding) per node over servable prose — rows the routing arm reads
+* (never aggregate at query time again). nav/embed/assessment chunks never
+* pollute routing centroids.
 */
-async function deniedSubtreeDirs(pool, instance) {
-	const paths = await runRead(pool, instance.tenantId, async (client) => {
-		return (await client.query(`WITH RECURSIVE gen AS (
-         SELECT active_generation AS g FROM corpora WHERE tenant_id = $1 AND corpus_id = $2
-       ),
-       seed AS (
-         SELECT n.node_id
-           FROM takedown_denylist d
-           JOIN content_nodes n ON n.tenant_id = d.tenant_id AND n.stable_id = d.stable_id
-           JOIN gen ON n.generation = gen.g
-          WHERE d.tenant_id = $1 AND d.corpus_id = $2 AND d.scope = 'subtree'
-       ),
-       walk AS (
-         SELECT node_id FROM seed
-         UNION ALL
-         SELECT c.node_id
-           FROM content_nodes c
-           JOIN walk w ON c.parent_id = w.node_id
-           JOIN gen ON c.generation = gen.g
-          WHERE c.tenant_id = $1
-       )
-       SELECT DISTINCT s.origin_path
-         FROM walk w
-         JOIN content_nodes n ON n.node_id = w.node_id
-         JOIN sources s ON s.tenant_id = n.tenant_id AND s.generation = n.generation
-                       AND s.node_id = n.node_id
-         -- The seed's own file counts only when the seed HAS CHILDREN.
-         --
-         -- Excluding every seed stopped a LEAF denial emitting its parent
-         -- directory and denying every sibling — right for a leaf, wrong for a
-         -- container. A section's own index.md is the file that names the
-         -- section's DIRECTORY, so a section whose other descendants all live
-         -- one level down contributed only the subdirectory, and a document
-         -- written directly under the withdrawn section published to /docs and
-         -- llms.txt (round-10 review of PR 43).
-         --
-         -- "Has children" is the right test, not "kind = section": it is the
-         -- property that decides whether the node's directory is its subtree
-         -- or its parent's.
-        WHERE w.node_id NOT IN (
-                SELECT s2.node_id FROM seed s2
-                 WHERE NOT EXISTS (SELECT 1 FROM content_nodes kid
-                                    JOIN gen ON kid.generation = gen.g
-                                   WHERE kid.tenant_id = $1 AND kid.parent_id = s2.node_id)
-              )`, [instance.tenantId, instance.corpusId])).rows.map((r) => String(r.origin_path));
-	});
-	const dirs = /* @__PURE__ */ new Set();
-	for (const raw of paths) {
-		const normalized = raw.replace(/\\/g, "/");
-		const slash = normalized.lastIndexOf("/");
-		dirs.add(slash === -1 ? "/" : `${normalized.slice(0, slash)}/`);
-	}
-	const all = [...dirs];
-	return all.filter((dir) => !all.some((other) => other !== dir && dir.startsWith(other))).sort();
+async function materializeCentroids(client, opts) {
+	await client.query("DELETE FROM node_centroids WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation]);
+	return (await client.query(`
+    INSERT INTO node_centroids (tenant_id, generation, node_id, stable_id, chunk_count, embedding)
+    SELECT c.tenant_id, c.generation, n.node_id, n.stable_id, count(*), avg(c.embedding)
+    FROM chunks c
+    JOIN sources s ON s.source_id = c.source_id AND s.tenant_id = c.tenant_id
+                  AND s.generation = c.generation
+    JOIN content_nodes n ON n.node_id = s.node_id AND n.tenant_id = s.tenant_id
+    WHERE c.tenant_id = $1 AND c.generation = $2 AND c.embedding_status = 'embedded'
+      AND c.labels->>'source_type' = 'prose'
+    GROUP BY c.tenant_id, c.generation, n.node_id, n.stable_id
+    `, [opts.tenantId, opts.generation])).rowCount ?? 0;
 }
-async function listTakedowns(pool, instance) {
-	return runRead(pool, instance.tenantId, async (client) => {
-		return (await client.query("SELECT stable_id, scope, reason, created_at FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2 ORDER BY created_at, stable_id", [instance.tenantId, instance.corpusId])).rows.map((r) => ({
-			stableId: String(r.stable_id),
-			scope: String(r.scope),
-			reason: String(r.reason),
-			createdAt: r.created_at
-		}));
-	});
+/**
+* The ready gate, factored pure: zero PENDING (the queue drained) + some
+* embedded content + failures within tolerance. The read path serves only
+* `embedded`, so a failed chunk is quarantined, not corrupt.
+*/
+function generationReady(health) {
+	if (health.pending !== 0 || health.embedded === 0) return false;
+	const total = health.embedded + health.failed;
+	return health.failed / total <= MAX_FAILED_FRACTION;
 }
-function denylistManifest(corpusId, stableIds, now, source = "database", deniedSubtrees = []) {
+async function generationHealth(client, opts) {
+	const row = (await client.query("SELECT count(*) FILTER (WHERE embedding_status = 'embedded') AS embedded, count(*) FILTER (WHERE embedding_status = 'pending') AS pending, count(*) FILTER (WHERE embedding_status = 'failed') AS failed FROM chunks WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation])).rows[0];
 	return {
-		format: 1,
-		corpus_id: corpusId,
-		source,
-		denied_subtrees: [...deniedSubtrees].sort(),
-		exported_at: now.toISOString(),
-		denied: stableIds.map((stable_id) => ({
-			stable_id,
-			scope: "node"
-		}))
+		generation: opts.generation,
+		embedded: Number(row.embedded),
+		pending: Number(row.pending),
+		failed: Number(row.failed)
 	};
 }
+function addedSlugs(delta) {
+	return [...delta.newSlugs].filter((s) => !delta.priorSlugs.has(s)).sort();
+}
+function removedSlugs(delta) {
+	return [...delta.priorSlugs].filter((s) => !delta.newSlugs.has(s)).sort();
+}
 /**
-* The plain-tree corpus adapter — ANY folder of Markdown becomes a corpus.
-* Converted from the oracle (sor-agentfactory @ b554f91,
-* ingest/adapters/plain_tree.py); the kernel cannot tell this manifest from
-* any other adapter's.
-*
-* Conventions (deliberately minimal — an operator can satisfy them with a bare
-* folder):
-*   - directories become `section` nodes; `.md`/`.mdx` files become `document`
-*     nodes;
-*   - `index.md` (or `README.md`) inside a directory is that SECTION's own
-*     content, not a child;
-*   - ordering: frontmatter `position` (or `sidebar_position`) wins, else name
-*     sort;
-*   - titles: frontmatter `title`, else the filename humanized;
-*   - stable ids: frontmatter `sor_id`, else the tree-relative path;
-*   - hidden entries (leading `.` or `_`) and ALL symlinks are skipped LOUDLY
-*     (reported through `onSkip`, console by default — never silent); symlinks
-*     are never followed, so a link cannot walk out of the tree or cycle it;
-*   - a directory carrying MORE than one index-named file (index.md +
-*     README.md …) fails loud: which one is the section's own content is
-*     ambiguous, and silently dropping the loser is exactly the corpus
-*     corruption this adapter must never commit.
-*
-* The oracle's `publish_bundle` (deterministic tgz staging) is a separate
-* slice and is not converted here.
+* Net fractional drop in node count vs the prior generation. Zero when the
+* prior generation is empty (a FIRST ingest has nothing to shrink from) so
+* the guard never trips on it.
 */
-const INDEX_NAMES = [
-	"index.md",
-	"index.mdx",
-	"README.md"
-];
-/** Frontmatter-position fallback for entries that declare none (oracle plain_tree.py:107,114). */
-const POSITION_FALLBACK = 1e4;
-/** Walk a directory on disk → manifest + sources. Fail-loud on emptiness and ambiguity. */
-async function buildManifest(treeRoot, options) {
-	const rootPath = treeRoot.length > 1 ? treeRoot.replace(/\/+$/, "") : treeRoot;
-	let isDir = false;
-	try {
-		isDir = (await stat(rootPath)).isDirectory();
-	} catch {
-		isDir = false;
-	}
-	if (!isDir) throw new ManifestError(`plain-tree root ${rootPath} is not a directory`);
-	return buildManifestFromTree(await readTree(rootPath), {
-		...options,
-		rootPath
-	});
+function shrinkFraction(priorCount, newCount) {
+	if (priorCount === 0) return 0;
+	return Math.max(0, priorCount - newCount) / priorCount;
 }
 /**
-* Load a directory into an in-memory tree. lstat semantics throughout: a
-* symlink is represented as a symlink — even one named `index.md` — never
-* followed, never read (the oracle's docstring contract; its `_index_of`
-* incidentally followed a symlinked index via `is_file()`, which this port
-* deliberately does not reproduce). Non-markdown files are invisible to the
-* walk, exactly as the oracle's suffix filter makes them.
+* True when the corpus shrank by MORE than the tolerated fraction — the flip
+* should be refused unless the drop is explicitly acknowledged. A first
+* ingest is always safe.
 */
-async function readTree(dirPath) {
-	const dirents = await readdir(dirPath, { withFileTypes: true });
-	const entries = [];
-	for (const d of dirents) if (d.isSymbolicLink()) entries.push({
-		kind: "symlink",
-		name: d.name
-	});
-	else if (d.isDirectory()) entries.push(await readTree(join(dirPath, d.name)));
-	else if (d.isFile() && isDoc(d.name)) entries.push({
-		kind: "file",
-		name: d.name,
-		text: await readFile(join(dirPath, d.name), "utf8")
-	});
+function shrinkUnsafe(priorCount, newCount, maxShrink) {
+	return priorCount > 0 && shrinkFraction(priorCount, newCount) > maxShrink;
+}
+/** Read the node-slug sets of the active generation and the candidate; the caller decides. */
+async function flipDelta(client, opts) {
+	const raw = (await client.query("SELECT active_generation FROM corpora WHERE tenant_id = $1 AND corpus_id = $2", [opts.tenantId, opts.corpusId])).rows[0]?.active_generation ?? null;
+	const prior = raw === null ? 0 : Number(raw);
+	const nodesOf = async (generation) => {
+		if (generation < 1) return /* @__PURE__ */ new Set();
+		const res = await client.query("SELECT stable_id FROM content_nodes WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, generation]);
+		return new Set(res.rows.map((r) => String(r.stable_id)));
+	};
 	return {
-		kind: "dir",
-		name: basename(dirPath),
-		entries
+		priorGeneration: prior,
+		priorSlugs: await nodesOf(prior),
+		newSlugs: await nodesOf(opts.newGeneration)
 	};
 }
-/** The pure walk: tree → manifest + {manifest path → source path}. */
-function buildManifestFromTree(root, options) {
-	const rootName = root.name;
-	const rootPath = options.rootPath ?? rootName;
-	const onSkip = options.onSkip ?? ((line) => console.log(line));
-	const nodes = [];
-	const files = [];
-	const sources = /* @__PURE__ */ new Map();
-	const skipped = [];
-	const fullPath = (relSegs, name) => `${rootPath}/${[...relSegs, name].join("/")}`;
-	const addFile = (nodeSid, fileSegs) => {
-		const rel = fileSegs.join("/");
-		const manifestPath = `${rootName}/${rel}`;
-		files.push(manifestFile({
-			path: manifestPath,
-			node: nodeSid
-		}));
-		sources.set(manifestPath, `${rootPath}/${rel}`);
-	};
-	const walk = (dir, relSegs, parentSid) => {
-		const entries = [...dir.entries].sort((a, b) => codePointCompare(a.name.toLowerCase(), b.name.toLowerCase()));
-		const docs = [];
-		const dirs = [];
-		for (const e of entries) if (e.kind === "symlink") skipped.push(`${fullPath(relSegs, e.name)} (symlink)`);
-		else if (e.kind === "file" && isDoc(e.name)) docs.push(e);
-		else if (e.kind === "dir") dirs.push(e);
-		const ordered = [];
-		for (const f of docs) {
-			if (f.name.startsWith(".") || f.name.startsWith("_")) {
-				skipped.push(fullPath(relSegs, f.name));
-				continue;
-			}
-			if (INDEX_NAMES.includes(f.name)) continue;
-			ordered.push({
-				position: positionOf(frontmatterMeta(f.text), POSITION_FALLBACK),
-				nameLower: f.name.toLowerCase(),
-				entry: f
-			});
-		}
-		for (const d of dirs) {
-			if (d.name.startsWith(".") || d.name.startsWith("_")) {
-				skipped.push(fullPath(relSegs, d.name));
-				continue;
-			}
-			const index = indexOf(d, fullPath(relSegs, d.name));
-			const dirMeta = index === null ? {} : frontmatterMeta(index.text);
-			ordered.push({
-				position: positionOf(dirMeta, POSITION_FALLBACK),
-				nameLower: d.name.toLowerCase(),
-				entry: d
-			});
-		}
-		ordered.sort((x, y) => x.position - y.position || codePointCompare(x.nameLower, y.nameLower));
-		let position = 0;
-		for (const { entry } of ordered) {
-			position += 1;
-			if (entry.kind === "dir") {
-				const dirSegs = [...relSegs, entry.name];
-				const index = indexOf(entry, fullPath(relSegs, entry.name));
-				const meta = index === null ? {} : frontmatterMeta(index.text);
-				const sid = index === null ? `${rootName}/${dirSegs.join("/")}#section` : stableIdOf(rootName, [...dirSegs, index.name], meta);
-				nodes.push(manifestNode({
-					stable_id: sid,
-					slug: slugify(entry.name),
-					title: titleOf(meta, entry.name),
-					kind: "section",
-					parent: parentSid,
-					position,
-					governance: index === null ? NO_GOVERNANCE : governanceFromFrontmatter(meta, index.text)
-				}));
-				if (index !== null) addFile(sid, [...dirSegs, index.name]);
-				walk(entry, dirSegs, sid);
-			} else {
-				const meta = frontmatterMeta(entry.text);
-				const stem = stemOf(entry.name);
-				const sid = stableIdOf(rootName, [...relSegs, entry.name], meta);
-				nodes.push(manifestNode({
-					stable_id: sid,
-					slug: slugify(stem),
-					title: titleOf(meta, stem),
-					kind: "document",
-					parent: parentSid,
-					position,
-					governance: governanceFromFrontmatter(meta, entry.text)
-				}));
-				addFile(sid, [...relSegs, entry.name]);
-			}
-		}
-	};
-	const rootIndex = indexOf(root, rootPath);
-	if (rootIndex !== null) {
-		const meta = frontmatterMeta(rootIndex.text);
-		const sid = stableIdOf(rootName, [rootIndex.name], meta);
-		nodes.push(manifestNode({
-			stable_id: sid,
-			slug: slugify(rootName),
-			title: titleOf(meta, rootName),
-			kind: "document",
-			position: 0,
-			governance: governanceFromFrontmatter(meta, rootIndex.text)
-		}));
-		addFile(sid, [rootIndex.name]);
-	}
-	walk(root, [], null);
-	for (const s of skipped) onSkip(`plain-tree: skipped ${s}`);
-	if (files.length === 0) throw new ManifestError(`plain-tree root ${rootPath} contains no Markdown`);
-	const manifest = {
-		format: 1,
-		corpus_id: options.corpusId,
-		source_commit: options.sourceCommit,
-		nodes,
-		files
-	};
-	parseManifest(JSON.stringify(manifestToJson(manifest)));
-	return {
-		manifest,
-		sources
-	};
-}
-/** Python `p.suffix in (".md", ".mdx")` parity: a dotfile named exactly ".md" has NO suffix. */
-function isDoc(name) {
-	const dot = name.lastIndexOf(".");
-	if (dot <= 0) return false;
-	const suffix = name.slice(dot);
-	return suffix === ".md" || suffix === ".mdx";
-}
-function indexOf(dir, dirPath) {
-	const present = [];
-	for (const name of INDEX_NAMES) {
-		const hit = dir.entries.find((e) => e.kind === "file" && e.name === name);
-		if (hit !== void 0) present.push(hit);
-	}
-	if (present.length > 1) throw new ManifestError(`ambiguous section index in ${dirPath}: [${present.map((p) => `'${p.name}'`).join(", ")}] — keep exactly one`);
-	return present[0] ?? null;
-}
-function stableIdOf(rootName, fileSegs, meta) {
-	const sid = meta["sor_id"];
-	if (typeof sid === "string" && sid.trim() !== "") return sid.trim();
-	return `${rootName}/${withoutSuffix(fileSegs.join("/"))}`;
-}
-/** Python Path.with_suffix("") parity: strip the LAST suffix only; a dotfile has none. */
-function withoutSuffix(rel) {
-	const slash = rel.lastIndexOf("/");
-	const name = rel.slice(slash + 1);
-	const dot = name.lastIndexOf(".");
-	if (dot <= 0) return rel;
-	return rel.slice(0, slash + 1) + name.slice(0, dot);
-}
-function stemOf(name) {
-	return withoutSuffix(name);
-}
-function slugify(text) {
-	const slug = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-	if (slug !== "") return slug;
-	return "x-" + createHash("sha256").update(text, "utf8").digest("hex").slice(0, 8);
+/**
+* Activation + run-state bookkeeping + the ledger row. The health gate is the
+* CALLER's duty — never partially activate. Serialized under the tenant
+* advisory lock (re-taken here: the allocate lock died with its own txn) and
+* MONOTONIC: only ever advances.
+*/
+async function flip(client, opts) {
+	await client.query(LOCK_SQL, [opts.tenantId]);
+	if (!(await client.query("UPDATE corpora SET rollback_generation = active_generation, active_generation = $1, updated_at = now() WHERE tenant_id = $2 AND corpus_id = $3 AND active_generation < $1", [
+		opts.toGeneration,
+		opts.tenantId,
+		opts.corpusId
+	])).rowCount) throw new Error(`flip to generation ${opts.toGeneration} refused: active_generation is already >= it (an out-of-order or duplicate flip — refusing to regress the served corpus)`);
+	await client.query("UPDATE ingestion_runs SET state = 'retired', finished_at = now() WHERE tenant_id = $1 AND corpus_id = $2 AND state = 'active'", [opts.tenantId, opts.corpusId]);
+	await client.query("UPDATE ingestion_runs SET state = 'active', finished_at = COALESCE(finished_at, now()) WHERE tenant_id = $1 AND corpus_id = $2 AND generation = $3", [
+		opts.tenantId,
+		opts.corpusId,
+		opts.toGeneration
+	]);
+	await client.query("INSERT INTO retrieval_log (tenant_id, corpus_id, generation, actor, action, detail) VALUES ($1, $2, $3, 'sor-ingest', 'generation_activated', '{}')", [
+		opts.tenantId,
+		opts.corpusId,
+		opts.toGeneration
+	]);
 }
-const CASED = /\p{Cased}/u;
 /**
-* Python str.title() parity (the oracle's `_humanize`): a cased character
-* following an uncased one uppercases, following a cased one lowercases —
-* apostrophe quirk included ("rock'n'roll" → "Rock'N'Roll"). Node titles are
-* carry-forward join keys, so the quirk is load-bearing, not cosmetic.
+* The §5 algebra: not active, not rollback, past token grace since
+* retirement, ≥2 complete generations REMAIN after collection; abandoned
+* builds reap on heartbeat staleness alone (they were never served, no token
+* can reference them).
 */
-function humanize(stem) {
-	const spaced = stem.replace(/[-_]+/g, " ").trim();
-	let out = "";
-	let prevCased = false;
-	for (const ch of spaced) {
-		const cased = CASED.test(ch);
-		out += cased ? prevCased ? ch.toLowerCase() : ch.toUpperCase() : ch;
-		prevCased = cased;
+async function collectableGenerations(client, opts) {
+	const ts = opts.now ?? /* @__PURE__ */ new Date();
+	const pointer = await client.query("SELECT active_generation, rollback_generation FROM corpora WHERE tenant_id = $1 AND corpus_id = $2", [opts.tenantId, opts.corpusId]);
+	if (pointer.rows.length === 0) return [];
+	const active = Number(pointer.rows[0].active_generation);
+	const rollbackRaw = pointer.rows[0].rollback_generation;
+	const rollbackGen = rollbackRaw === null ? null : Number(rollbackRaw);
+	const runs = await client.query("SELECT generation, state, finished_at, heartbeat_at FROM ingestion_runs WHERE tenant_id = $1 AND corpus_id = $2 AND state <> 'reaped' ORDER BY generation", [opts.tenantId, opts.corpusId]);
+	const complete = runs.rows.filter((r) => [
+		"ready",
+		"active",
+		"retired"
+	].includes(String(r.state)));
+	const out = [];
+	let remaining = complete.length;
+	for (const row of runs.rows) {
+		const gen = Number(row.generation);
+		const state = String(row.state);
+		const finishedAt = row.finished_at;
+		const heartbeatAt = row.heartbeat_at;
+		if (state === "building") {
+			if (heartbeatAt !== null && ts.getTime() - heartbeatAt.getTime() > 864e5) out.push(gen);
+			continue;
+		}
+		if (gen === active || rollbackGen !== null && gen === rollbackGen) continue;
+		if (finishedAt === null || ts.getTime() - finishedAt.getTime() < GC_GRACE_MS) continue;
+		if (remaining - 1 < 2) continue;
+		remaining -= 1;
+		out.push(gen);
 	}
 	return out;
 }
-/** Python `str(meta.get("title") or _humanize(...))` — falsy titles fall back. */
-function titleOf(meta, fallbackStem) {
-	const t = meta["title"];
-	if (t === void 0 || t === null || t === "" || t === 0 || t === false) return humanize(fallbackStem);
-	return String(t);
-}
-function positionOf(meta, fallback) {
-	for (const key of ["position", "sidebar_position"]) {
-		const val = meta[key];
-		if (typeof val === "number" && Number.isFinite(val)) return Math.trunc(val);
-	}
-	return fallback;
-}
-/** Python compares strings by code point; JS `<` compares UTF-16 units — they differ on astral names. */
-function codePointCompare(a, b) {
-	const as = [...a];
-	const bs = [...b];
-	const n = Math.min(as.length, bs.length);
-	for (let i = 0; i < n; i++) {
-		const d = (as[i]?.codePointAt(0) ?? 0) - (bs[i]?.codePointAt(0) ?? 0);
-		if (d !== 0) return d;
-	}
-	return as.length - bs.length;
+/**
+* Delete one generation's rows (chunks cascade from sources) and mark the run
+* reaped. NEVER touches takedown_denylist or retrieval_log — the ledger and
+* denylist outlive the content they governed (§5).
+*/
+async function reap(client, opts) {
+	for (const sql of [
+		"DELETE FROM node_centroids WHERE tenant_id = $1 AND generation = $2",
+		"DELETE FROM slug_aliases WHERE tenant_id = $1 AND generation = $2",
+		"DELETE FROM sources WHERE tenant_id = $1 AND generation = $2"
+	]) await client.query(sql, [opts.tenantId, opts.generation]);
+	for (;;) if (!(await client.query("DELETE FROM content_nodes n WHERE n.tenant_id = $1 AND n.generation = $2 AND NOT EXISTS (SELECT 1 FROM content_nodes ch WHERE ch.parent_id = n.node_id                  AND ch.tenant_id = n.tenant_id AND ch.generation = n.generation)", [opts.tenantId, opts.generation])).rowCount) break;
+	await client.query("UPDATE ingestion_runs SET state = 'reaped' WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation]);
 }
-/** Re-exported so every reader of a document agrees where its frontmatter ENDS. */
-const FRONTMATTER$1 = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/;
-const YAML_BOOLS = {
-	yes: true,
-	Yes: true,
-	YES: true,
-	no: false,
-	No: false,
-	NO: false,
-	true: true,
-	True: true,
-	TRUE: true,
-	false: false,
-	False: false,
-	FALSE: false,
-	on: true,
-	On: true,
-	ON: true,
-	off: false,
-	Off: false,
-	OFF: false
-};
 /**
-* Minimal PyYAML-compatible frontmatter reader for the FOUR scalar keys this
-* adapter consumes (`title`, `position`, `sidebar_position`, `sor_id`) — the
-* kernel discards every other frontmatter key at build time (taxonomy comes
-* from the manifest), so a YAML dependency would buy nothing (guard rule 5).
-* Scope, deliberately narrow pending a shared markdown module: top-level
-* `key: scalar` pairs only; nested/indented structure is ignored. Mirroring
-* the oracle's error path (`parse_frontmatter` catches YAMLError → `{}`), a
-* document PyYAML would refuse — an UNQUOTED value containing ": ", a block
-* scalar, an anchor/alias/tag, a non-mapping line — yields an EMPTY meta, so
-* titles fall back to the humanized filename instead of a half-read mapping.
+* The §7 row for a governance act, written INSIDE the same transaction as the
+* act. `logRead` deliberately covers only the four serving actions; a takedown
+* is a write-plane act, and separating the two writes would allow a denial with
+* no row proving it happened — the one outcome the ledger exists to prevent.
 */
-function frontmatterMeta(text) {
-	const block = FRONTMATTER$1.exec(text)?.[1];
-	if (block === void 0) return {};
-	const meta = {};
-	for (const line of block.split(/\r?\n/)) {
-		if (line.trim() === "" || line.trimStart().startsWith("#")) continue;
-		if (/^[ \t]/.test(line)) continue;
-		const kv = /^([^\s:]+):(?:[ \t]+(.*))?$/.exec(line);
-		const key = kv?.[1];
-		if (key === void 0) return {};
-		const parsed = scalarValue((kv?.[2] ?? "").trim());
-		if (!parsed.ok) return {};
-		meta[key] = parsed.value;
-	}
-	return meta;
-}
-function scalarValue(raw) {
-	if (raw === "") return {
-		ok: true,
-		value: null
-	};
-	const dq = /^"(.*)"$/.exec(raw);
-	if (dq !== null) return {
-		ok: true,
-		value: (dq[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")
-	};
-	const sq = /^'(.*)'$/.exec(raw);
-	if (sq !== null) return {
-		ok: true,
-		value: (sq[1] ?? "").replace(/''/g, "'")
-	};
-	const plain = raw.replace(/[ \t]+#.*$/, "").trim();
-	if (Object.hasOwn(YAML_BOOLS, plain)) return {
-		ok: true,
-		value: YAML_BOOLS[plain]
-	};
-	if (plain === "~" || /^(?:null|Null|NULL)$/.test(plain)) return {
-		ok: true,
-		value: null
-	};
-	if (/^[-+]?[0-9][0-9_]*$/.test(plain)) return {
-		ok: true,
-		value: Number.parseInt(plain.replaceAll("_", ""), 10)
-	};
-	if (/^[-+]?(?:\.[0-9]+|[0-9][0-9_]*\.[0-9_]*)(?:[eE][-+]?[0-9]+)?$/.test(plain)) return {
-		ok: true,
-		value: Number.parseFloat(plain.replaceAll("_", ""))
-	};
-	if (/:[ \t]/.test(plain) || plain.endsWith(":")) return {
-		ok: false,
-		value: null
-	};
-	if (/^[|>&*!{[]/.test(plain)) return {
-		ok: false,
-		value: null
-	};
-	return {
-		ok: true,
-		value: plain
-	};
+async function recordAct(client, instance, detail, actor, action = "takedown_applied") {
+	await client.query("INSERT INTO retrieval_log (tenant_id, corpus_id, actor, action, detail) VALUES ($1, $2, $3, $5, $4::jsonb)", [
+		instance.tenantId,
+		instance.corpusId,
+		actor,
+		JSON.stringify(detail),
+		action
+	]);
 }
 /**
-* The governance a document declares about itself, read once and carried onto
-* the record.
-*
-* Before this module the ingest adapter kept four frontmatter keys and dropped
-* the rest, so `visibility`, `status`, `owner` and `provenance` existed only in
-* markdown — and every surface re-derived them independently. The site enforced
-* `visibility:`; the MCP door could not, because the record did not carry it.
-* One reader, one shape, persisted on `content_nodes` (schema 2.2).
+* Deny a node (or its subtree) and record the act.
 *
-* The vocabulary is deliberately NOT closed here. A record that declares an
-* audience the instance does not know is a corpus error the checker names; the
-* ingest path's job is to carry what was written, faithfully, so the serving
-* door can make the decision with the instance in hand. Refusing unknown values
-* here would put the audience model in two places again.
+* The audit row is written in the SAME transaction as the denial: a takedown
+* that happened without a row proving it happened is exactly the shape the
+* §7 ledger exists to prevent.
 */
-const NO_GOVERNANCE = {
-	visibility: null,
-	docStatus: null,
-	owner: null,
-	provenance: null,
-	supersededBy: null
-};
-function scalar(meta, key) {
-	const raw = meta[key];
-	if (typeof raw === "string") {
-		const trimmed = raw.trim();
-		return trimmed === "" ? null : trimmed;
-	}
-	if (typeof raw === "boolean") return raw ? "true" : "false";
-	if (typeof raw === "number") return String(raw);
-	return null;
+async function applyTakedown(pool, instance, opts) {
+	return runIngest(pool, instance.tenantId, async (client) => {
+		const resolves = ((await client.query(`SELECT 1 FROM content_nodes n
+         JOIN corpora c ON c.tenant_id = n.tenant_id AND c.corpus_id = $2
+        WHERE n.tenant_id = $1 AND n.stable_id = $3 AND n.generation = c.active_generation
+        LIMIT 1`, [
+			instance.tenantId,
+			instance.corpusId,
+			opts.stableId
+		])).rowCount ?? 0) > 0;
+		const changed = (await client.query("INSERT INTO takedown_denylist (tenant_id, corpus_id, stable_id, scope, reason) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (tenant_id, corpus_id, stable_id) DO UPDATE   SET scope = EXCLUDED.scope, reason = EXCLUDED.reason WHERE takedown_denylist.scope IS DISTINCT FROM EXCLUDED.scope    OR takedown_denylist.reason IS DISTINCT FROM EXCLUDED.reason RETURNING stable_id", [
+			instance.tenantId,
+			instance.corpusId,
+			opts.stableId,
+			opts.scope,
+			opts.reason
+		])).rowCount === 1;
+		await recordAct(client, instance, {
+			stable_id: opts.stableId,
+			scope: opts.scope,
+			reason: opts.reason,
+			change: changed ? "applied" : "unchanged"
+		}, opts.actor);
+		return {
+			stableId: opts.stableId,
+			scope: opts.scope,
+			changed,
+			resolves
+		};
+	});
+}
+/** Lift a denial. The ledger keeps the row that recorded imposing it. */
+async function revokeTakedown(pool, instance, opts) {
+	return runIngest(pool, instance.tenantId, async (client) => {
+		const changed = ((await client.query("DELETE FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2 AND stable_id = $3", [
+			instance.tenantId,
+			instance.corpusId,
+			opts.stableId
+		])).rowCount ?? 0) > 0;
+		await recordAct(client, instance, {
+			stable_id: opts.stableId,
+			change: changed ? "revoked" : "not-denied"
+		}, opts.actor, "takedown_revoked");
+		return {
+			stableId: opts.stableId,
+			scope: "node",
+			changed
+		};
+	});
+}
+async function readLedger(pool, instance, limit) {
+	return runAuditRead(pool, instance.tenantId, async (client) => {
+		return (await client.query("SELECT action, actor, generation, detail, created_at FROM retrieval_log WHERE tenant_id = $1 AND corpus_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3", [
+			instance.tenantId,
+			instance.corpusId,
+			limit
+		])).rows.map((row) => ({
+			action: String(row.action),
+			actor: String(row.actor),
+			generation: row.generation === null ? null : Number(row.generation),
+			detail: row.detail ?? {},
+			createdAt: row.created_at
+		}));
+	});
 }
-const BLOCK_LIST = (key) => new RegExp(`^${key}:[ \\t]*\\r?\\n((?:[ \\t]*-[ \\t]+.*\\r?\\n?)+)`, "m");
 /**
-* Values of a simple `key:` block list, the one nested shape the record's
-* grammar uses (`provenance:` here, `audiences:` in instance.md). The scalar
-* reader deliberately ignores indented lines, so without this a provenance list
-* would vanish silently — the failure mode this whole module exists to end.
+* Every stable_id a build must not publish, with `subtree` denials EXPANDED to
+* their actual descendants by the same `parent_id` walk the serving side uses.
+*
+* The site cannot do this itself: it has no tree, so it matched a prefix — and
+* a section's stable_id ends in `/index` (or `#section`), so the prefix never
+* matched its children and every descendant of a subtree takedown kept
+* publishing. Decision 14 records exactly why a prefix is wrong here; the fix
+* is to resolve the walk where the tree lives and hand over a flat list
+* (round-2 review of #43).
 */
-function frontmatterListValues(text, key) {
-	const block = FRONTMATTER$1.exec(text)?.[1];
-	if (block === void 0) return null;
-	const m = BLOCK_LIST(key).exec(block + "\n");
-	if (m === null) return null;
-	const items = (m[1] ?? "").split(/\r?\n/).map((line) => /^[ \t]*-[ \t]+(.*)$/.exec(line)?.[1] ?? "").map((v) => v.trim().replace(/^["']|["']$/g, "").trim()).filter((v) => v !== "");
-	return items.length > 0 ? items : null;
+async function deniedStableIds(pool, instance) {
+	return runRead(pool, instance.tenantId, async (client) => {
+		return (await client.query(`WITH RECURSIVE gen AS (
+         SELECT active_generation AS g FROM corpora WHERE tenant_id = $1 AND corpus_id = $2
+       ),
+       seed AS (
+         SELECT n.node_id, n.stable_id, d.scope
+           FROM takedown_denylist d
+           JOIN content_nodes n ON n.tenant_id = d.tenant_id AND n.stable_id = d.stable_id
+           JOIN gen ON n.generation = gen.g
+          WHERE d.tenant_id = $1 AND d.corpus_id = $2
+       ),
+       walk AS (
+         SELECT node_id, stable_id, scope FROM seed
+         UNION ALL
+         SELECT c.node_id, c.stable_id, w.scope
+           FROM content_nodes c
+           JOIN walk w ON c.parent_id = w.node_id
+           JOIN gen ON c.generation = gen.g
+          WHERE c.tenant_id = $1 AND w.scope = 'subtree'
+       )
+       SELECT DISTINCT stable_id FROM walk
+       UNION
+       -- Denials naming a stable_id no CURRENT generation carries are still
+       -- denied: identity outlives any one generation (decision 14).
+       SELECT stable_id FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2`, [instance.tenantId, instance.corpusId])).rows.map((r) => String(r.stable_id)).sort();
+	});
 }
 /**
-* Read the governance keys from an already-parsed scalar map plus the raw
-* document text (which the list reader needs). Unknown keys are ignored, as
-* they always were — this module widens what the record carries, it does not
-* narrow what a document may say.
+* The knowledge-relative DIRECTORIES that `--subtree` denials govern.
+*
+* Derived from the DESCENDANTS' `sources.origin_path`, never from the denied
+* node's own id or path, because neither works:
+*
+*   a section has no source     `knowledge/policies#section` is synthetic — the
+*                               tree node for a directory. Joining `sources` on
+*                               the denied node itself yields nothing, and a
+*                               section is the ordinary target of `--subtree`.
+*   a leaf's directory is not   `--subtree` on one document would emit that
+*   its subtree                 document's directory and deny every sibling.
+*
+* So: walk the descendants, take the directory of each one's file, and keep the
+* SHALLOWEST — a directory that contains another in the set is the subtree
+* root, and `startsWith` then covers subdirectories added later too. A denial
+* with no descendants contributes nothing, which is correct: its subtree is
+* itself, and the flat id list already holds it.
+*
+* The seed's OWN file counts when the seed has children, and only then — see
+* the SQL comment: a container's index.md names its directory, a leaf's file
+* names its parent's.
 */
-var GovernanceParseError = class extends Error {
-	name = "GovernanceParseError";
-};
-function governanceFromFrontmatter(meta, text) {
-	if (frontmatterListValues(text, "visibility") !== null) throw new GovernanceParseError("a document declares `visibility:` as a LIST — a document belongs to exactly one tier. Write a single value, e.g. `visibility: internal`.");
-	const declaredInText = /^visibility:[ \t]*(.*)$/m.exec(FRONTMATTER$1.exec(text)?.[1] ?? "");
-	if (declaredInText !== null && scalar(meta, "visibility") === null) {
-		const written = declaredInText[1]?.trim() ?? "";
-		throw new GovernanceParseError(written === "" ? "a document declares `visibility:` with no readable value — an unreadable tier reads as no tier, and no tier is the default tier, which is how a restricted document gets served. Write a single value, e.g. `visibility: internal`." : `a document declares \`visibility: ${written}\` but this reader could not resolve it — usually because ANOTHER key in the same frontmatter is a shape it cannot read (a flow list like \`tags: [a, b]\`, or an unquoted value containing ": "). An unresolved tier would be served at the default. Quote the other value, or write it as a block list.`);
-	}
-	const provenanceScalar = scalar(meta, "provenance");
-	const provenanceList = frontmatterListValues(text, "provenance");
-	return {
-		visibility: scalar(meta, "visibility"),
-		docStatus: scalar(meta, "status"),
-		owner: scalar(meta, "owner"),
-		provenance: provenanceList ?? (provenanceScalar === null ? null : [provenanceScalar]),
-		supersededBy: scalar(meta, "superseded_by")
-	};
-}
-const SUPPORTED_FORMATS = [1];
-/** The manifest is malformed — named precisely; a bad manifest never half-ingests. */
-var ManifestError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ManifestError";
-	}
-};
-/** Mirrors the oracle dataclass defaults (parent/summary/permalink None, position 0, keywords ()). */
-function manifestNode(init) {
-	return {
-		stable_id: init.stable_id,
-		slug: init.slug,
-		title: init.title,
-		kind: init.kind,
-		parent: init.parent ?? null,
-		position: init.position ?? 0,
-		summary: init.summary ?? null,
-		keywords: init.keywords ?? [],
-		permalink: init.permalink ?? null,
-		governance: init.governance ?? NO_GOVERNANCE
-	};
-}
-function manifestFile(init) {
-	return {
-		path: init.path,
-		node: init.node,
-		title: init.title ?? null
-	};
-}
-function parseManifest(text) {
-	let raw;
-	try {
-		raw = JSON.parse(text);
-	} catch (exc) {
-		throw new ManifestError(`manifest.json is not valid JSON: ${exc instanceof Error ? exc.message : String(exc)}`);
+async function deniedSubtreeDirs(pool, instance) {
+	const paths = await runRead(pool, instance.tenantId, async (client) => {
+		return (await client.query(`WITH RECURSIVE gen AS (
+         SELECT active_generation AS g FROM corpora WHERE tenant_id = $1 AND corpus_id = $2
+       ),
+       seed AS (
+         SELECT n.node_id
+           FROM takedown_denylist d
+           JOIN content_nodes n ON n.tenant_id = d.tenant_id AND n.stable_id = d.stable_id
+           JOIN gen ON n.generation = gen.g
+          WHERE d.tenant_id = $1 AND d.corpus_id = $2 AND d.scope = 'subtree'
+       ),
+       walk AS (
+         SELECT node_id FROM seed
+         UNION ALL
+         SELECT c.node_id
+           FROM content_nodes c
+           JOIN walk w ON c.parent_id = w.node_id
+           JOIN gen ON c.generation = gen.g
+          WHERE c.tenant_id = $1
+       )
+       SELECT DISTINCT s.origin_path
+         FROM walk w
+         JOIN content_nodes n ON n.node_id = w.node_id
+         JOIN sources s ON s.tenant_id = n.tenant_id AND s.generation = n.generation
+                       AND s.node_id = n.node_id
+         -- The seed's own file counts only when the seed HAS CHILDREN.
+         --
+         -- Excluding every seed stopped a LEAF denial emitting its parent
+         -- directory and denying every sibling — right for a leaf, wrong for a
+         -- container. A section's own index.md is the file that names the
+         -- section's DIRECTORY, so a section whose other descendants all live
+         -- one level down contributed only the subdirectory, and a document
+         -- written directly under the withdrawn section published to /docs and
+         -- llms.txt (round-10 review of PR 43).
+         --
+         -- "Has children" is the right test, not "kind = section": it is the
+         -- property that decides whether the node's directory is its subtree
+         -- or its parent's.
+        WHERE w.node_id NOT IN (
+                SELECT s2.node_id FROM seed s2
+                 WHERE NOT EXISTS (SELECT 1 FROM content_nodes kid
+                                    JOIN gen ON kid.generation = gen.g
+                                   WHERE kid.tenant_id = $1 AND kid.parent_id = s2.node_id)
+              )`, [instance.tenantId, instance.corpusId])).rows.map((r) => String(r.origin_path));
+	});
+	const dirs = /* @__PURE__ */ new Set();
+	for (const raw of paths) {
+		const normalized = raw.replace(/\\/g, "/");
+		const slash = normalized.lastIndexOf("/");
+		dirs.add(slash === -1 ? "/" : `${normalized.slice(0, slash)}/`);
 	}
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new ManifestError("manifest.json must be an object");
-	const obj = raw;
-	const fmt = obj["format"];
-	if (typeof fmt !== "number" || !SUPPORTED_FORMATS.includes(fmt)) throw new ManifestError(`manifest format ${JSON.stringify(fmt)} unsupported (supported: ${SUPPORTED_FORMATS.join(", ")})`);
-	const corpusId = topString(obj, "corpus_id");
-	const sourceCommit = topString(obj, "source_commit");
-	const nodes = entriesOf(obj, "nodes").map((n, i) => manifestNode({
-		stable_id: req(n, "stable_id", i),
-		slug: req(n, "slug", i),
-		title: req(n, "title", i),
-		kind: req(n, "kind", i),
-		parent: optString(n["parent"]),
-		position: toPosition(n["position"], i),
-		summary: optString(n["summary"]),
-		keywords: toKeywords(n["keywords"], i),
-		permalink: optString(n["permalink"]),
-		governance: toGovernance(n["governance"], i)
-	}));
-	const files = entriesOf(obj, "files").map((f, i) => manifestFile({
-		path: req(f, "path", i),
-		node: req(f, "node", i),
-		title: optString(f["title"])
-	}));
-	validate(nodes, files);
+	const all = [...dirs];
+	return all.filter((dir) => !all.some((other) => other !== dir && dir.startsWith(other))).sort();
+}
+async function listTakedowns(pool, instance) {
+	return runRead(pool, instance.tenantId, async (client) => {
+		return (await client.query("SELECT stable_id, scope, reason, created_at FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2 ORDER BY created_at, stable_id", [instance.tenantId, instance.corpusId])).rows.map((r) => ({
+			stableId: String(r.stable_id),
+			scope: String(r.scope),
+			reason: String(r.reason),
+			createdAt: r.created_at
+		}));
+	});
+}
+function denylistManifest(corpusId, stableIds, now, source = "database", deniedSubtrees = []) {
 	return {
-		format: fmt,
+		format: 1,
 		corpus_id: corpusId,
-		source_commit: sourceCommit,
-		nodes,
-		files
+		source,
+		denied_subtrees: [...deniedSubtrees].sort(),
+		exported_at: now.toISOString(),
+		denied: stableIds.map((stable_id) => ({
+			stable_id,
+			scope: "node"
+		}))
 	};
 }
 /**
-* The inverse of `governanceToJson`. Absent → NO_GOVERNANCE, which is what a
-* corpus that declares nothing has always meant. A present-but-wrong shape is
-* REFUSED rather than silently dropped: dropping it would serve a document at
-* the instance default, and for a `visibility:` that means serving a restricted
-* document to everyone.
+* The plain-tree corpus adapter — ANY folder of Markdown becomes a corpus.
+* Converted from the oracle (sor-agentfactory @ b554f91,
+* ingest/adapters/plain_tree.py); the kernel cannot tell this manifest from
+* any other adapter's.
+*
+* Conventions (deliberately minimal — an operator can satisfy them with a bare
+* folder):
+*   - directories become `section` nodes; `.md`/`.mdx` files become `document`
+*     nodes;
+*   - `index.md` (or `README.md`) inside a directory is that SECTION's own
+*     content, not a child;
+*   - ordering: frontmatter `position` (or `sidebar_position`) wins, else name
+*     sort;
+*   - titles: frontmatter `title`, else the filename humanized;
+*   - stable ids: frontmatter `sor_id`, else the tree-relative path;
+*   - hidden entries (leading `.` or `_`) and ALL symlinks are skipped LOUDLY
+*     (reported through `onSkip`, console by default — never silent); symlinks
+*     are never followed, so a link cannot walk out of the tree or cycle it;
+*   - a directory carrying MORE than one index-named file (index.md +
+*     README.md …) fails loud: which one is the section's own content is
+*     ambiguous, and silently dropping the loser is exactly the corpus
+*     corruption this adapter must never commit.
+*
+* The oracle's `publish_bundle` (deterministic tgz staging) is a separate
+* slice and is not converted here.
 */
-function toGovernance(raw, index) {
-	if (raw === void 0 || raw === null) return NO_GOVERNANCE;
-	if (typeof raw !== "object" || Array.isArray(raw)) throw new ManifestError(`entry ${index}: 'governance' must be an object`);
-	const g = raw;
-	const str = (key) => {
-		const val = g[key];
-		if (val === void 0 || val === null) return null;
-		if (typeof val !== "string" || val === "") throw new ManifestError(`entry ${index}: 'governance.${key}' must be a non-empty string`);
-		return val;
-	};
-	const provenanceRaw = g["provenance"];
-	let provenance = null;
-	if (provenanceRaw !== void 0 && provenanceRaw !== null) {
-		if (!Array.isArray(provenanceRaw) || provenanceRaw.some((v) => typeof v !== "string")) throw new ManifestError(`entry ${index}: 'governance.provenance' must be a list of strings`);
-		provenance = provenanceRaw;
+const INDEX_NAMES = [
+	"index.md",
+	"index.mdx",
+	"README.md"
+];
+/** Frontmatter-position fallback for entries that declare none (oracle plain_tree.py:107,114). */
+const POSITION_FALLBACK = 1e4;
+/** Walk a directory on disk → manifest + sources. Fail-loud on emptiness and ambiguity. */
+async function buildManifest(treeRoot, options) {
+	const rootPath = treeRoot.length > 1 ? treeRoot.replace(/\/+$/, "") : treeRoot;
+	let isDir = false;
+	try {
+		isDir = (await stat(rootPath)).isDirectory();
+	} catch {
+		isDir = false;
 	}
-	return {
-		visibility: str("visibility"),
-		docStatus: str("doc_status"),
-		owner: str("owner"),
-		provenance,
-		supersededBy: str("superseded_by")
-	};
-}
-function topString(obj, key) {
-	const val = obj[key];
-	if (typeof val !== "string" || !val) throw new ManifestError(`manifest.${key} must be a non-empty string`);
-	return val;
-}
-function entriesOf(obj, key) {
-	const raw = obj[key] ?? [];
-	if (!Array.isArray(raw)) throw new ManifestError(`manifest.${key} must be an array`);
-	return raw.map((entry, i) => {
-		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new ManifestError(`entry ${i}: must be an object`);
-		return entry;
+	if (!isDir) throw new ManifestError(`plain-tree root ${rootPath} is not a directory`);
+	return buildManifestFromTree(await readTree(rootPath), {
+		...options,
+		rootPath
 	});
 }
-function req(obj, key, index) {
-	const val = obj[key];
-	if (typeof val !== "string" || !val) throw new ManifestError(`entry ${index}: '${key}' must be a non-empty string`);
-	return val;
-}
-function optString(val) {
-	return typeof val === "string" ? val : null;
-}
-/** Python `int(...)` parity: truncate finite numbers, parse integer strings, refuse the rest loudly. */
-function toPosition(val, index) {
-	if (val === void 0) return 0;
-	if (typeof val === "number" && Number.isFinite(val)) return Math.trunc(val);
-	if (typeof val === "boolean") return val ? 1 : 0;
-	if (typeof val === "string" && /^[+-]?\d+$/.test(val.trim())) return Number.parseInt(val.trim(), 10);
-	throw new ManifestError(`entry ${index}: position must be an integer, got ${JSON.stringify(val)}`);
-}
-function toKeywords(val, index) {
-	if (val === void 0 || val === null) return [];
-	if (!Array.isArray(val)) throw new ManifestError(`entry ${index}: keywords must be an array of strings`);
-	return val.map((k, j) => {
-		if (typeof k !== "string") throw new ManifestError(`entry ${index}: keywords[${j}] must be a string`);
-		return k;
+/**
+* Load a directory into an in-memory tree. lstat semantics throughout: a
+* symlink is represented as a symlink — even one named `index.md` — never
+* followed, never read (the oracle's docstring contract; its `_index_of`
+* incidentally followed a symlinked index via `is_file()`, which this port
+* deliberately does not reproduce). Non-markdown files are invisible to the
+* walk, exactly as the oracle's suffix filter makes them.
+*/
+async function readTree(dirPath) {
+	const dirents = await readdir(dirPath, { withFileTypes: true });
+	const entries = [];
+	for (const d of dirents) if (d.isSymbolicLink()) entries.push({
+		kind: "symlink",
+		name: d.name
+	});
+	else if (d.isDirectory()) entries.push(await readTree(join(dirPath, d.name)));
+	else if (d.isFile() && isDoc(d.name)) entries.push({
+		kind: "file",
+		name: d.name,
+		text: await readFile(join(dirPath, d.name), "utf8")
 	});
+	return {
+		kind: "dir",
+		name: basename(dirPath),
+		entries
+	};
 }
-function validate(nodes, files) {
-	const seen = /* @__PURE__ */ new Set();
-	const dupes = /* @__PURE__ */ new Set();
-	for (const n of nodes) {
-		if (seen.has(n.stable_id)) dupes.add(n.stable_id);
-		seen.add(n.stable_id);
-	}
-	if (dupes.size > 0) throw new ManifestError(`duplicate node stable_id(s): [${[...dupes].sort().map((d) => `'${d}'`).join(", ")}]`);
-	for (const n of nodes) if (n.parent !== null && !seen.has(n.parent)) throw new ManifestError(`node '${n.stable_id}': unknown parent '${n.parent}'`);
-	for (const f of files) if (!seen.has(f.node)) throw new ManifestError(`file '${f.path}': unknown node '${f.node}'`);
-	const paths = /* @__PURE__ */ new Set();
-	for (const f of files) {
-		if (paths.has(f.path)) throw new ManifestError("duplicate file paths in manifest");
-		paths.add(f.path);
-	}
-	const siblingSlugs = /* @__PURE__ */ new Map();
-	for (const n of nodes) {
-		const parent = n.parent ?? "";
-		const bySlug = siblingSlugs.get(parent) ?? /* @__PURE__ */ new Map();
-		const owners = bySlug.get(n.slug) ?? [];
-		owners.push(n.stable_id);
-		bySlug.set(n.slug, owners);
-		siblingSlugs.set(parent, bySlug);
-	}
-	for (const bySlug of siblingSlugs.values()) for (const [slug, owners] of bySlug) if (owners.length > 1) throw new ManifestError(`sibling slug collision: ${owners.map((o) => `'${o}'`).join(", ")} all slug to '${slug}' under the same parent — rename one (a slug is a node's URL segment and must be unique among siblings)`);
-}
-/** Parents before children (insert order for the FK); a cycle fails loudly. */
-function topological(nodes) {
-	const byId = new Map(nodes.map((n) => [n.stable_id, n]));
-	const out = [];
-	const state = /* @__PURE__ */ new Map();
-	const visit = (n) => {
-		const mark = state.get(n.stable_id) ?? 0;
-		if (mark === 2) return;
-		if (mark === 1) throw new ManifestError(`parent cycle at '${n.stable_id}'`);
-		state.set(n.stable_id, 1);
-		if (n.parent !== null) {
-			const parent = byId.get(n.parent);
-			if (parent === void 0) throw new ManifestError(`node '${n.stable_id}': unknown parent '${n.parent}'`);
-			visit(parent);
+/** The pure walk: tree → manifest + {manifest path → source path}. */
+function buildManifestFromTree(root, options) {
+	const rootName = root.name;
+	const rootPath = options.rootPath ?? rootName;
+	const onSkip = options.onSkip ?? ((line) => console.log(line));
+	const nodes = [];
+	const files = [];
+	const sources = /* @__PURE__ */ new Map();
+	const skipped = [];
+	const fullPath = (relSegs, name) => `${rootPath}/${[...relSegs, name].join("/")}`;
+	const addFile = (nodeSid, fileSegs) => {
+		const rel = fileSegs.join("/");
+		const manifestPath = `${rootName}/${rel}`;
+		files.push(manifestFile({
+			path: manifestPath,
+			node: nodeSid
+		}));
+		sources.set(manifestPath, `${rootPath}/${rel}`);
+	};
+	const walk = (dir, relSegs, parentSid) => {
+		const entries = [...dir.entries].sort((a, b) => codePointCompare(a.name.toLowerCase(), b.name.toLowerCase()));
+		const docs = [];
+		const dirs = [];
+		for (const e of entries) if (e.kind === "symlink") skipped.push(`${fullPath(relSegs, e.name)} (symlink)`);
+		else if (e.kind === "file" && isDoc(e.name)) docs.push(e);
+		else if (e.kind === "dir") dirs.push(e);
+		const ordered = [];
+		for (const f of docs) {
+			if (f.name.startsWith(".") || f.name.startsWith("_")) {
+				skipped.push(fullPath(relSegs, f.name));
+				continue;
+			}
+			if (INDEX_NAMES.includes(f.name)) continue;
+			ordered.push({
+				position: positionOf(frontmatterMeta(f.text), POSITION_FALLBACK),
+				nameLower: f.name.toLowerCase(),
+				entry: f
+			});
+		}
+		for (const d of dirs) {
+			if (d.name.startsWith(".") || d.name.startsWith("_")) {
+				skipped.push(fullPath(relSegs, d.name));
+				continue;
+			}
+			const index = indexOf(d, fullPath(relSegs, d.name));
+			const dirMeta = index === null ? {} : frontmatterMeta(index.text);
+			ordered.push({
+				position: positionOf(dirMeta, POSITION_FALLBACK),
+				nameLower: d.name.toLowerCase(),
+				entry: d
+			});
+		}
+		ordered.sort((x, y) => x.position - y.position || codePointCompare(x.nameLower, y.nameLower));
+		let position = 0;
+		for (const { entry } of ordered) {
+			position += 1;
+			if (entry.kind === "dir") {
+				const dirSegs = [...relSegs, entry.name];
+				const index = indexOf(entry, fullPath(relSegs, entry.name));
+				const meta = index === null ? {} : frontmatterMeta(index.text);
+				const sid = index === null ? `${rootName}/${dirSegs.join("/")}#section` : stableIdOf(rootName, [...dirSegs, index.name], meta);
+				nodes.push(manifestNode({
+					stable_id: sid,
+					slug: slugify(entry.name),
+					title: titleOf(meta, entry.name),
+					kind: "section",
+					parent: parentSid,
+					position,
+					governance: index === null ? NO_GOVERNANCE : governanceFromFrontmatter(meta, index.text)
+				}));
+				if (index !== null) addFile(sid, [...dirSegs, index.name]);
+				walk(entry, dirSegs, sid);
+			} else {
+				const meta = frontmatterMeta(entry.text);
+				const stem = stemOf(entry.name);
+				const sid = stableIdOf(rootName, [...relSegs, entry.name], meta);
+				nodes.push(manifestNode({
+					stable_id: sid,
+					slug: slugify(stem),
+					title: titleOf(meta, stem),
+					kind: "document",
+					parent: parentSid,
+					position,
+					governance: governanceFromFrontmatter(meta, entry.text)
+				}));
+				addFile(sid, [...relSegs, entry.name]);
+			}
 		}
-		state.set(n.stable_id, 2);
-		out.push(n);
 	};
-	for (const n of nodes) visit(n);
-	return out;
-}
-/**
-* The one canonical JSON emitter for every adapter (re-homed from the oracle's
-* `_to_json`, adapters/docusaurus_sidebar.py:410): node keys whose value is
-* null/empty/zero are omitted EXCEPT `position`, which is always emitted; file
-* dicts carry `title` only when set. Adapters round-trip the result through
-* `parseManifest` before writing, so an adapter can never emit what ingest
-* would refuse.
-*/
-function manifestToJson(m) {
+	const rootIndex = indexOf(root, rootPath);
+	if (rootIndex !== null) {
+		const meta = frontmatterMeta(rootIndex.text);
+		const sid = stableIdOf(rootName, [rootIndex.name], meta);
+		nodes.push(manifestNode({
+			stable_id: sid,
+			slug: slugify(rootName),
+			title: titleOf(meta, rootName),
+			kind: "document",
+			position: 0,
+			governance: governanceFromFrontmatter(meta, rootIndex.text)
+		}));
+		addFile(sid, [rootIndex.name]);
+	}
+	walk(root, [], null);
+	for (const s of skipped) onSkip(`plain-tree: skipped ${s}`);
+	if (files.length === 0) throw new ManifestError(`plain-tree root ${rootPath} contains no Markdown`);
+	const manifest = {
+		format: 1,
+		corpus_id: options.corpusId,
+		source_commit: options.sourceCommit,
+		nodes,
+		files
+	};
+	parseManifest(JSON.stringify(manifestToJson(manifest)));
 	return {
-		format: m.format,
-		corpus_id: m.corpus_id,
-		source_commit: m.source_commit,
-		nodes: m.nodes.map(nodeToJson),
-		files: m.files.map((f) => ({
-			path: f.path,
-			node: f.node,
-			...f.title ? { title: f.title } : {}
-		}))
+		manifest,
+		sources
 	};
 }
-function nodeToJson(n) {
-	const fields = [
-		["stable_id", n.stable_id],
-		["slug", n.slug],
-		["title", n.title],
-		["kind", n.kind],
-		["parent", n.parent],
-		["position", n.position],
-		["summary", n.summary],
-		["keywords", n.keywords],
-		["permalink", n.permalink]
-	];
-	const out = {};
-	for (const [key, val] of fields) {
-		const omit = val === null || val === 0 || Array.isArray(val) && val.length === 0;
-		if (key === "position" || !omit) out[key] = val;
+/** Python `p.suffix in (".md", ".mdx")` parity: a dotfile named exactly ".md" has NO suffix. */
+function isDoc(name) {
+	const dot = name.lastIndexOf(".");
+	if (dot <= 0) return false;
+	const suffix = name.slice(dot);
+	return suffix === ".md" || suffix === ".mdx";
+}
+function indexOf(dir, dirPath) {
+	const present = [];
+	for (const name of INDEX_NAMES) {
+		const hit = dir.entries.find((e) => e.kind === "file" && e.name === name);
+		if (hit !== void 0) present.push(hit);
 	}
-	const gov = governanceToJson(n.governance);
-	if (Object.keys(gov).length > 0) out["governance"] = gov;
-	return out;
+	if (present.length > 1) throw new ManifestError(`ambiguous section index in ${dirPath}: [${present.map((p) => `'${p.name}'`).join(", ")}] — keep exactly one`);
+	return present[0] ?? null;
 }
-function governanceToJson(g) {
-	const out = {};
-	if (g.visibility !== null) out["visibility"] = g.visibility;
-	if (g.docStatus !== null) out["doc_status"] = g.docStatus;
-	if (g.owner !== null) out["owner"] = g.owner;
-	if (g.provenance !== null && g.provenance.length > 0) out["provenance"] = g.provenance;
-	if (g.supersededBy !== null) out["superseded_by"] = g.supersededBy;
-	return out;
+function stableIdOf(rootName, fileSegs, meta) {
+	const sid = meta["sor_id"];
+	if (typeof sid === "string" && sid.trim() !== "") return sid.trim();
+	return `${rootName}/${withoutSuffix(fileSegs.join("/"))}`;
+}
+/** Python Path.with_suffix("") parity: strip the LAST suffix only; a dotfile has none. */
+function withoutSuffix(rel) {
+	const slash = rel.lastIndexOf("/");
+	const name = rel.slice(slash + 1);
+	const dot = name.lastIndexOf(".");
+	if (dot <= 0) return rel;
+	return rel.slice(0, slash + 1) + name.slice(0, dot);
+}
+function stemOf(name) {
+	return withoutSuffix(name);
+}
+function slugify(text) {
+	const slug = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	if (slug !== "") return slug;
+	return "x-" + createHash("sha256").update(text, "utf8").digest("hex").slice(0, 8);
 }
+const CASED = /\p{Cased}/u;
 /**
-* Carried verbatim from the oracle's build step (ingest/build.py:109):
-* `source_id = f.path.removesuffix(".md") + ":prose"`. The ".md"-only strip is
-* a deliberate quirk — `a/b.md` → `a/b:prose` while `a/b.mdx` KEEPS its suffix
-* → `a/b.mdx:prose`. Persisted source rows and carry-forward joins already pin
-* this shape; changing it is a policy decision, never a tidy-up.
+* Python str.title() parity (the oracle's `_humanize`): a cased character
+* following an uncased one uppercases, following a cased one lowercases —
+* apostrophe quirk included ("rock'n'roll" → "Rock'N'Roll"). Node titles are
+* carry-forward join keys, so the quirk is load-bearing, not cosmetic.
 */
-function sourceId(path) {
-	return (path.endsWith(".md") ? path.slice(0, -3) : path) + ":prose";
+function humanize(stem) {
+	const spaced = stem.replace(/[-_]+/g, " ").trim();
+	let out = "";
+	let prevCased = false;
+	for (const ch of spaced) {
+		const cased = CASED.test(ch);
+		out += cased ? prevCased ? ch.toLowerCase() : ch.toUpperCase() : ch;
+		prevCased = cased;
+	}
+	return out;
 }
-/** Python len(): Unicode code points, not UTF-16 units. Every limit comparison
-* and the HARD_MAX_CHARS slice go through code points or the policy silently
-* changes on astral-plane text (emoji, musical symbols, CJK extensions). */
-function cpLen(s) {
-	let n = 0;
-	for (const _ch of s) n += 1;
-	return n;
+/** Python `str(meta.get("title") or _humanize(...))` — falsy titles fall back. */
+function titleOf(meta, fallbackStem) {
+	const t = meta["title"];
+	if (t === void 0 || t === null || t === "" || t === 0 || t === false) return humanize(fallbackStem);
+	return String(t);
 }
-/** Python str.splitlines() boundary set (full code-point scan, 2026-08-19):
-* \n \v \f \r \x1c \x1d \x1e \x85 \u2028 \u2029, with \r\n as one boundary.
-* A naive split(/\r?\n/) changes segmentation on \x85, \u2028 etc. All
-* boundaries are BMP, so a UTF-16 walk cannot land inside a surrogate pair. */
-const LINE_BOUNDARY = /* @__PURE__ */ new Set([
-	"\n",
-	"\v",
-	"\f",
-	"\r",
-	"",
-	"",
-	"",
-	"…",
-	"\u2028",
-	"\u2029"
-]);
-function pySplitLines(text, keepends) {
-	const out = [];
-	let start = 0;
-	let i = 0;
-	while (i < text.length) {
-		const ch = text[i];
-		if (LINE_BOUNDARY.has(ch)) {
-			let end = i + 1;
-			if (ch === "\r" && text[end] === "\n") end += 1;
-			out.push(keepends ? text.slice(start, end) : text.slice(start, i));
-			start = end;
-			i = end;
-		} else i += 1;
+function positionOf(meta, fallback) {
+	for (const key of ["position", "sidebar_position"]) {
+		const val = meta[key];
+		if (typeof val === "number" && Number.isFinite(val)) return Math.trunc(val);
 	}
-	if (start < text.length) out.push(text.slice(start));
-	return out;
+	return fallback;
 }
-/** Python's whitespace set — str.isspace() == str.strip() == re \s for str
-* patterns (verified identical by full code-point scan, 2026-08-19). Note the
-* two-way mismatch with JS: \x1c-\x1f and \x85 are whitespace only here;
-* \ufeff is whitespace to JS trim()/\s but NOT to Python. */
-const PY_SPACE = /* @__PURE__ */ new Set("	\n\v\f\r …\xA0            \u2028\u2029  　");
-function pyStrip(s) {
-	let a = 0;
-	let b = s.length;
-	while (a < b && PY_SPACE.has(s[a])) a += 1;
-	while (b > a && PY_SPACE.has(s[b - 1])) b -= 1;
-	return s.slice(a, b);
+/** Python compares strings by code point; JS `<` compares UTF-16 units — they differ on astral names. */
+function codePointCompare(a, b) {
+	const as = [...a];
+	const bs = [...b];
+	const n = Math.min(as.length, bs.length);
+	for (let i = 0; i < n; i++) {
+		const d = (as[i]?.codePointAt(0) ?? 0) - (bs[i]?.codePointAt(0) ?? 0);
+		if (d !== 0) return d;
+	}
+	return as.length - bs.length;
 }
-/** Character-class text for Python \s (same set as PY_SPACE, for regexes). */
-const WS = "\\t\\n\\v\\f\\r\\x1c-\\x1f \\x85\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000";
-/** Character-class text for Python \w: L* ∪ Nd ∪ Nl ∪ No ∪ {_} — i.e.
-* str.isalnum() plus underscore (spot-verified: é 中 Ⅰ ½ yes; 😀 and combining
-* marks no). Used where the oracle wrote \w or \b (JS \w/\b are ASCII-only). */
-const WORD = "\\p{L}\\p{N}_";
-const HEADING = new RegExp(`^(#{1,4})[${WS}]+([^\\n]*?)[${WS}]*$`);
-const FENCE = new RegExp(`^ {0,3}(\`{3,}|~{3,})([^\\n]*?)[${WS}]*$`);
-const EXPLICIT_ID = new RegExp(`[${WS}]*\\{#([${WORD}-]+)\\}[${WS}]*$`, "u");
-const SLUG_RUN = /[^a-z0-9]+/g;
-const JSX_ASSESS = new RegExp(`(?:^|(?<=\\n))[${WS}]*<(?:Quiz|Flashcards)(?![${WORD}])`, "u");
-const JSX_EMBED = new RegExp(`(?:^|(?<=\\n))[${WS}]*<(?:iframe|AICheck|AICheckField|ProjectCard|CapstoneWorkbook)(?![${WORD}])`, "u");
-const STYLE_OPEN = new RegExp(`^[${WS}]*<style(?![${WORD}])`, "iu");
-const CLASS_ATTR_G = new RegExp(`[${WS}]*className=(?:"[^"]*"|'[^']*'|\\{[^{}]*\\})`, "gu");
-const LAYOUT_NAMES = "div|span|section|figure|article|header|footer|main|aside";
-const LAYOUT_TAG_G = new RegExp(`<[${WS}]*(\\/?)[${WS}]*(${LAYOUT_NAMES})(?![${WORD}])([^<>]*?)(\\/?)[${WS}]*>`, "gu");
-const LAYOUT_TAG_PROBE = new RegExp(`<[${WS}]*(\\/?)[${WS}]*(${LAYOUT_NAMES})(?![${WORD}])([^<>]*?)(\\/?)[${WS}]*>`, "u");
-const INLINE_CODE_G = /* @__PURE__ */ new RegExp("`[^`\\n]+`", "g");
-const BLANK_RUN_G = /* @__PURE__ */ new RegExp("\\n{3,}", "g");
-const NUL = "\0";
-const BLANK_SEP = new RegExp(`(\\n[${WS}]*\\n)`);
-const sha256 = (s) => createHash("sha256").update(s, "utf8").digest("hex");
-function slug(title, cap = 60) {
-	const s = title.toLowerCase().replace(SLUG_RUN, "-").replace(/^-+|-+$/g, "");
-	if (s.length <= cap) return s;
-	const cut = s.lastIndexOf("-", cap - 1);
-	return s.slice(0, cut > 0 ? cut : cap).replace(/^-+|-+$/g, "");
+/** Re-exported so every reader of a document agrees where its frontmatter ENDS. */
+const FRONTMATTER$1 = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/;
+const YAML_BOOLS = {
+	yes: true,
+	Yes: true,
+	YES: true,
+	no: false,
+	No: false,
+	NO: false,
+	true: true,
+	True: true,
+	TRUE: true,
+	false: false,
+	False: false,
+	FALSE: false,
+	on: true,
+	On: true,
+	ON: true,
+	off: false,
+	Off: false,
+	OFF: false
+};
+/**
+* Minimal PyYAML-compatible frontmatter reader for the FOUR scalar keys this
+* adapter consumes (`title`, `position`, `sidebar_position`, `sor_id`) — the
+* kernel discards every other frontmatter key at build time (taxonomy comes
+* from the manifest), so a YAML dependency would buy nothing (guard rule 5).
+* Scope, deliberately narrow pending a shared markdown module: top-level
+* `key: scalar` pairs only; nested/indented structure is ignored. Mirroring
+* the oracle's error path (`parse_frontmatter` catches YAMLError → `{}`), a
+* document PyYAML would refuse — an UNQUOTED value containing ": ", a block
+* scalar, an anchor/alias/tag, a non-mapping line — yields an EMPTY meta, so
+* titles fall back to the humanized filename instead of a half-read mapping.
+*/
+function frontmatterMeta(text) {
+	const block = FRONTMATTER$1.exec(text)?.[1];
+	if (block === void 0) return {};
+	const meta = {};
+	for (const line of block.split(/\r?\n/)) {
+		if (line.trim() === "" || line.trimStart().startsWith("#")) continue;
+		if (/^[ \t]/.test(line)) continue;
+		const kv = /^([^\s:]+):(?:[ \t]+(.*))?$/.exec(line);
+		const key = kv?.[1];
+		if (key === void 0) return {};
+		const parsed = scalarValue((kv?.[2] ?? "").trim());
+		if (!parsed.ok) return {};
+		meta[key] = parsed.value;
+	}
+	return meta;
 }
-function headingPathText(path) {
-	return path.map((p) => slug(p)).filter((s) => s !== "").join("/");
+function scalarValue(raw) {
+	if (raw === "") return {
+		ok: true,
+		value: null
+	};
+	const dq = /^"(.*)"$/.exec(raw);
+	if (dq !== null) return {
+		ok: true,
+		value: (dq[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")
+	};
+	const sq = /^'(.*)'$/.exec(raw);
+	if (sq !== null) return {
+		ok: true,
+		value: (sq[1] ?? "").replace(/''/g, "'")
+	};
+	const plain = raw.replace(/[ \t]+#.*$/, "").trim();
+	if (Object.hasOwn(YAML_BOOLS, plain)) return {
+		ok: true,
+		value: YAML_BOOLS[plain]
+	};
+	if (plain === "~" || /^(?:null|Null|NULL)$/.test(plain)) return {
+		ok: true,
+		value: null
+	};
+	if (/^[-+]?[0-9][0-9_]*$/.test(plain)) return {
+		ok: true,
+		value: Number.parseInt(plain.replaceAll("_", ""), 10)
+	};
+	if (/^[-+]?(?:\.[0-9]+|[0-9][0-9_]*\.[0-9_]*)(?:[eE][-+]?[0-9]+)?$/.test(plain)) return {
+		ok: true,
+		value: Number.parseFloat(plain.replaceAll("_", ""))
+	};
+	if (/:[ \t]/.test(plain) || plain.endsWith(":")) return {
+		ok: false,
+		value: null
+	};
+	if (/^[|>&*!{[]/.test(plain)) return {
+		ok: false,
+		value: null
+	};
+	return {
+		ok: true,
+		value: plain
+	};
 }
-/** CommonMark fence tracking (v5 — the correctness core). A backtick fence
-* whose info string contains a backtick is NOT a fence; closing needs the same
-* char, a run at least as long, and nothing but whitespace after. */
-function fenceStep(line, fence) {
-	const m = FENCE.exec(line);
-	if (fence === null) {
-		if (m !== null) {
-			const marker = m[1];
-			const info = m[2];
-			if (marker[0] === "`" && info.includes("`")) return null;
-			return [marker[0], marker.length];
-		}
-		return null;
+/**
+* The governance a document declares about itself, read once and carried onto
+* the record.
+*
+* Before this module the ingest adapter kept four frontmatter keys and dropped
+* the rest, so `visibility`, `status`, `owner` and `provenance` existed only in
+* markdown — and every surface re-derived them independently. The site enforced
+* `visibility:`; the MCP door could not, because the record did not carry it.
+* One reader, one shape, persisted on `content_nodes` (schema 2.2).
+*
+* The vocabulary is deliberately NOT closed here. A record that declares an
+* audience the instance does not know is a corpus error the checker names; the
+* ingest path's job is to carry what was written, faithfully, so the serving
+* door can make the decision with the instance in hand. Refusing unknown values
+* here would put the audience model in two places again.
+*/
+const NO_GOVERNANCE = {
+	visibility: null,
+	docStatus: null,
+	owner: null,
+	provenance: null,
+	supersededBy: null
+};
+function scalar(meta, key) {
+	const raw = meta[key];
+	if (typeof raw === "string") {
+		const trimmed = raw.trim();
+		return trimmed === "" ? null : trimmed;
+	}
+	if (typeof raw === "boolean") return raw ? "true" : "false";
+	if (typeof raw === "number") return String(raw);
+	return null;
+}
+const BLOCK_LIST = (key) => new RegExp(`^${key}:[ \\t]*\\r?\\n((?:[ \\t]*-[ \\t]+.*\\r?\\n?)+)`, "m");
+/**
+* Values of a simple `key:` block list, the one nested shape the record's
+* grammar uses (`provenance:` here, `audiences:` in instance.md). The scalar
+* reader deliberately ignores indented lines, so without this a provenance list
+* would vanish silently — the failure mode this whole module exists to end.
+*/
+function frontmatterListValues(text, key) {
+	const block = FRONTMATTER$1.exec(text)?.[1];
+	if (block === void 0) return null;
+	const m = BLOCK_LIST(key).exec(block + "\n");
+	if (m === null) return null;
+	const items = (m[1] ?? "").split(/\r?\n/).map((line) => /^[ \t]*-[ \t]+(.*)$/.exec(line)?.[1] ?? "").map((v) => v.trim().replace(/^["']|["']$/g, "").trim()).filter((v) => v !== "");
+	return items.length > 0 ? items : null;
+}
+/**
+* Read the governance keys from an already-parsed scalar map plus the raw
+* document text (which the list reader needs). Unknown keys are ignored, as
+* they always were — this module widens what the record carries, it does not
+* narrow what a document may say.
+*/
+var GovernanceParseError = class extends Error {
+	name = "GovernanceParseError";
+};
+function governanceFromFrontmatter(meta, text) {
+	if (frontmatterListValues(text, "visibility") !== null) throw new GovernanceParseError("a document declares `visibility:` as a LIST — a document belongs to exactly one tier. Write a single value, e.g. `visibility: internal`.");
+	const declaredInText = /^visibility:[ \t]*(.*)$/m.exec(FRONTMATTER$1.exec(text)?.[1] ?? "");
+	if (declaredInText !== null && scalar(meta, "visibility") === null) {
+		const written = declaredInText[1]?.trim() ?? "";
+		throw new GovernanceParseError(written === "" ? "a document declares `visibility:` with no readable value — an unreadable tier reads as no tier, and no tier is the default tier, which is how a restricted document gets served. Write a single value, e.g. `visibility: internal`." : `a document declares \`visibility: ${written}\` but this reader could not resolve it — usually because ANOTHER key in the same frontmatter is a shape it cannot read (a flow list like \`tags: [a, b]\`, or an unquoted value containing ": "). An unresolved tier would be served at the default. Quote the other value, or write it as a block list.`);
+	}
+	const provenanceScalar = scalar(meta, "provenance");
+	const provenanceList = frontmatterListValues(text, "provenance");
+	return {
+		visibility: scalar(meta, "visibility"),
+		docStatus: scalar(meta, "status"),
+		owner: scalar(meta, "owner"),
+		provenance: provenanceList ?? (provenanceScalar === null ? null : [provenanceScalar]),
+		supersededBy: scalar(meta, "superseded_by")
+	};
+}
+const SUPPORTED_FORMATS = [1];
+/** The manifest is malformed — named precisely; a bad manifest never half-ingests. */
+var ManifestError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ManifestError";
+	}
+};
+/** Mirrors the oracle dataclass defaults (parent/summary/permalink None, position 0, keywords ()). */
+function manifestNode(init) {
+	return {
+		stable_id: init.stable_id,
+		slug: init.slug,
+		title: init.title,
+		kind: init.kind,
+		parent: init.parent ?? null,
+		position: init.position ?? 0,
+		summary: init.summary ?? null,
+		keywords: init.keywords ?? [],
+		permalink: init.permalink ?? null,
+		governance: init.governance ?? NO_GOVERNANCE
+	};
+}
+function manifestFile(init) {
+	return {
+		path: init.path,
+		node: init.node,
+		title: init.title ?? null
+	};
+}
+function parseManifest(text) {
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch (exc) {
+		throw new ManifestError(`manifest.json is not valid JSON: ${exc instanceof Error ? exc.message : String(exc)}`);
+	}
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new ManifestError("manifest.json must be an object");
+	const obj = raw;
+	const fmt = obj["format"];
+	if (typeof fmt !== "number" || !SUPPORTED_FORMATS.includes(fmt)) throw new ManifestError(`manifest format ${JSON.stringify(fmt)} unsupported (supported: ${SUPPORTED_FORMATS.join(", ")})`);
+	const corpusId = topString(obj, "corpus_id");
+	const sourceCommit = topString(obj, "source_commit");
+	const nodes = entriesOf(obj, "nodes").map((n, i) => manifestNode({
+		stable_id: req(n, "stable_id", i),
+		slug: req(n, "slug", i),
+		title: req(n, "title", i),
+		kind: req(n, "kind", i),
+		parent: optString(n["parent"]),
+		position: toPosition(n["position"], i),
+		summary: optString(n["summary"]),
+		keywords: toKeywords(n["keywords"], i),
+		permalink: optString(n["permalink"]),
+		governance: toGovernance(n["governance"], i)
+	}));
+	const files = entriesOf(obj, "files").map((f, i) => manifestFile({
+		path: req(f, "path", i),
+		node: req(f, "node", i),
+		title: optString(f["title"])
+	}));
+	validate(nodes, files);
+	return {
+		format: fmt,
+		corpus_id: corpusId,
+		source_commit: sourceCommit,
+		nodes,
+		files
+	};
+}
+/**
+* The inverse of `governanceToJson`. Absent → NO_GOVERNANCE, which is what a
+* corpus that declares nothing has always meant. A present-but-wrong shape is
+* REFUSED rather than silently dropped: dropping it would serve a document at
+* the instance default, and for a `visibility:` that means serving a restricted
+* document to everyone.
+*/
+function toGovernance(raw, index) {
+	if (raw === void 0 || raw === null) return NO_GOVERNANCE;
+	if (typeof raw !== "object" || Array.isArray(raw)) throw new ManifestError(`entry ${index}: 'governance' must be an object`);
+	const g = raw;
+	const str = (key) => {
+		const val = g[key];
+		if (val === void 0 || val === null) return null;
+		if (typeof val !== "string" || val === "") throw new ManifestError(`entry ${index}: 'governance.${key}' must be a non-empty string`);
+		return val;
+	};
+	const provenanceRaw = g["provenance"];
+	let provenance = null;
+	if (provenanceRaw !== void 0 && provenanceRaw !== null) {
+		if (!Array.isArray(provenanceRaw) || provenanceRaw.some((v) => typeof v !== "string")) throw new ManifestError(`entry ${index}: 'governance.provenance' must be a list of strings`);
+		provenance = provenanceRaw;
+	}
+	return {
+		visibility: str("visibility"),
+		docStatus: str("doc_status"),
+		owner: str("owner"),
+		provenance,
+		supersededBy: str("superseded_by")
+	};
+}
+function topString(obj, key) {
+	const val = obj[key];
+	if (typeof val !== "string" || !val) throw new ManifestError(`manifest.${key} must be a non-empty string`);
+	return val;
+}
+function entriesOf(obj, key) {
+	const raw = obj[key] ?? [];
+	if (!Array.isArray(raw)) throw new ManifestError(`manifest.${key} must be an array`);
+	return raw.map((entry, i) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new ManifestError(`entry ${i}: must be an object`);
+		return entry;
+	});
+}
+function req(obj, key, index) {
+	const val = obj[key];
+	if (typeof val !== "string" || !val) throw new ManifestError(`entry ${index}: '${key}' must be a non-empty string`);
+	return val;
+}
+function optString(val) {
+	return typeof val === "string" ? val : null;
+}
+/** Python `int(...)` parity: truncate finite numbers, parse integer strings, refuse the rest loudly. */
+function toPosition(val, index) {
+	if (val === void 0) return 0;
+	if (typeof val === "number" && Number.isFinite(val)) return Math.trunc(val);
+	if (typeof val === "boolean") return val ? 1 : 0;
+	if (typeof val === "string" && /^[+-]?\d+$/.test(val.trim())) return Number.parseInt(val.trim(), 10);
+	throw new ManifestError(`entry ${index}: position must be an integer, got ${JSON.stringify(val)}`);
+}
+function toKeywords(val, index) {
+	if (val === void 0 || val === null) return [];
+	if (!Array.isArray(val)) throw new ManifestError(`entry ${index}: keywords must be an array of strings`);
+	return val.map((k, j) => {
+		if (typeof k !== "string") throw new ManifestError(`entry ${index}: keywords[${j}] must be a string`);
+		return k;
+	});
+}
+function validate(nodes, files) {
+	const seen = /* @__PURE__ */ new Set();
+	const dupes = /* @__PURE__ */ new Set();
+	for (const n of nodes) {
+		if (seen.has(n.stable_id)) dupes.add(n.stable_id);
+		seen.add(n.stable_id);
+	}
+	if (dupes.size > 0) throw new ManifestError(`duplicate node stable_id(s): [${[...dupes].sort().map((d) => `'${d}'`).join(", ")}]`);
+	for (const n of nodes) if (n.parent !== null && !seen.has(n.parent)) throw new ManifestError(`node '${n.stable_id}': unknown parent '${n.parent}'`);
+	for (const f of files) if (!seen.has(f.node)) throw new ManifestError(`file '${f.path}': unknown node '${f.node}'`);
+	const paths = /* @__PURE__ */ new Set();
+	for (const f of files) {
+		if (paths.has(f.path)) throw new ManifestError("duplicate file paths in manifest");
+		paths.add(f.path);
 	}
-	if (m !== null && m[1][0] === fence[0] && m[1].length >= fence[1] && m[2] === "") return null;
-	return fence;
-}
-/** Drop prose-level `<style>…</style>` CSS — pure presentation; classify would
-* size a multi-KB CSS wall as prose and serve it (the oracle's field-test #3
-* "about" doc opened with ~2KB of it). Runs BEFORE contentHash + chunkText, so
-* chunks reassemble the CLEANED body byte-exact and only files that actually
-* held a block re-embed. FENCE-SAFE: a `<style>` shown as example code inside
-* a fence is content and survives. See STYLE_OPEN for the locked fast-path
-* quirk (^-anchored, no multiline). */
-function stripStyleBlocks(text) {
-	if (!STYLE_OPEN.test(text)) return text;
-	const out = [];
-	let fence = null;
-	let dropping = false;
-	for (const line of pySplitLines(text, true)) {
-		if (dropping) {
-			if (line.toLowerCase().includes("</style>")) dropping = false;
-			continue;
-		}
-		if (fence === null && STYLE_OPEN.test(line)) {
-			if (!line.toLowerCase().includes("</style>")) dropping = true;
-			continue;
-		}
-		out.push(line);
-		fence = fenceStep(line, fence);
+	const siblingSlugs = /* @__PURE__ */ new Map();
+	for (const n of nodes) {
+		const parent = n.parent ?? "";
+		const bySlug = siblingSlugs.get(parent) ?? /* @__PURE__ */ new Map();
+		const owners = bySlug.get(n.slug) ?? [];
+		owners.push(n.stable_id);
+		bySlug.set(n.slug, owners);
+		siblingSlugs.set(parent, bySlug);
 	}
-	return out.join("");
+	for (const bySlug of siblingSlugs.values()) for (const [slug, owners] of bySlug) if (owners.length > 1) throw new ManifestError(`sibling slug collision: ${owners.map((o) => `'${o}'`).join(", ")} all slug to '${slug}' under the same parent — rename one (a slug is a node's URL segment and must be unique among siblings)`);
 }
-const rstripSpacesTabs = (s) => {
-	let b = s.length;
-	while (b > 0 && (s[b - 1] === " " || s[b - 1] === "	")) b -= 1;
-	return s.slice(0, b);
-};
-/** Remove `style={{ ... }}` attributes by BRACE MATCHING, not regex: the value
-* is a JS object literal and the oracle measured 168 of them spanning lines.
-* An unbalanced opener leaves the rest of the text verbatim — a stripper must
-* never eat the rest of a document to satisfy itself. (The pre-attr rstrip of
-* spaces/tabs also glues `<div ` + a KEPT unbalanced `style={{` opener into
-* `<divstyle={{` — an oracle quirk locked by fixture strip-malformed-kept.) */
-function stripStyleAttr(text) {
+/** Parents before children (insert order for the FK); a cycle fails loudly. */
+function topological(nodes) {
+	const byId = new Map(nodes.map((n) => [n.stable_id, n]));
 	const out = [];
-	let i = 0;
-	for (;;) {
-		const j = text.indexOf("style={{", i);
-		if (j < 0) break;
-		out.push(rstripSpacesTabs(text.slice(i, j)));
-		let k = j + 6;
-		let depth = 0;
-		let closed = false;
-		while (k < text.length) {
-			const ch = text[k];
-			if (ch === "{") depth += 1;
-			else if (ch === "}") {
-				depth -= 1;
-				if (depth === 0) {
-					k += 1;
-					closed = true;
-					break;
-				}
-			}
-			k += 1;
-		}
-		if (!closed) {
-			out.push(text.slice(j));
-			return out.join("");
+	const state = /* @__PURE__ */ new Map();
+	const visit = (n) => {
+		const mark = state.get(n.stable_id) ?? 0;
+		if (mark === 2) return;
+		if (mark === 1) throw new ManifestError(`parent cycle at '${n.stable_id}'`);
+		state.set(n.stable_id, 1);
+		if (n.parent !== null) {
+			const parent = byId.get(n.parent);
+			if (parent === void 0) throw new ManifestError(`node '${n.stable_id}': unknown parent '${n.parent}'`);
+			visit(parent);
 		}
-		i = k;
-	}
-	out.push(text.slice(i));
-	return out.join("");
+		state.set(n.stable_id, 2);
+		out.push(n);
+	};
+	for (const n of nodes) visit(n);
+	return out;
 }
-/** Drop layout tags left BARE by the attribute strip, KEEPING each closer
-* paired with its opener: a closer carries no attributes, so `</div>` cannot
-* say whether it belongs to a removed wrapper or to a kept `<div id="x">`.
-* Track depth; a closer is removed iff its opener was. On any mismatch the tag
-* is KEPT — a stray tag beats eaten content. `stack` is owned by the CALLER
-* and persists across every prose segment of one document: a styled wrapper
-* around a code fence splits at the fence, and its opener/closer land in
-* different segments (228 of them in the oracle's corpus). */
-function dropBareLayoutTags(segment, stack) {
-	return segment.replace(LAYOUT_TAG_G, (m0, closing, name, rawAttrs, selfClosing) => {
-		const attrs = pyStrip(rawAttrs);
-		if (closing !== "") {
-			const top = stack[stack.length - 1];
-			if (top !== void 0 && top[0] === name) return stack.pop()[1] ? "" : m0;
-			return m0;
-		}
-		if (selfClosing !== "") return attrs === "" ? "" : m0;
-		stack.push([name, attrs === ""]);
-		return attrs === "" ? "" : m0;
-	});
+/**
+* The one canonical JSON emitter for every adapter (re-homed from the oracle's
+* `_to_json`, adapters/docusaurus_sidebar.py:410): node keys whose value is
+* null/empty/zero are omitted EXCEPT `position`, which is always emitted; file
+* dicts carry `title` only when set. Adapters round-trip the result through
+* `parseManifest` before writing, so an adapter can never emit what ingest
+* would refuse.
+*/
+function manifestToJson(m) {
+	return {
+		format: m.format,
+		corpus_id: m.corpus_id,
+		source_commit: m.source_commit,
+		nodes: m.nodes.map(nodeToJson),
+		files: m.files.map((f) => ({
+			path: f.path,
+			node: f.node,
+			...f.title ? { title: f.title } : {}
+		}))
+	};
 }
-/** Restore NUL<n>NUL placeholders — equivalent to the oracle's
-* re.sub(r"\x00(\d+)\x00", ...): a leftmost scan where a match is a NUL, a
-* maximal non-empty ASCII digit run, and a closing NUL; anything else stays
-* verbatim (backtracking cannot produce any other match for this pattern). */
-function restoreHeld(seg, held) {
-	let out = "";
-	let i = 0;
-	for (;;) {
-		const a = seg.indexOf(NUL, i);
-		if (a < 0) break;
-		let b = a + 1;
-		while (b < seg.length && seg[b] >= "0" && seg[b] <= "9") b += 1;
-		if (b > a + 1 && seg[b] === NUL) {
-			const d = seg.slice(a + 1, b);
-			const h = held[Number(d)];
-			if (h === void 0) throw new Error(`inline-code placeholder NUL${d}NUL has no held span (held ${held.length}): the source document contains a literal NUL-digit-NUL sequence, which collides with the stripper's placeholder scheme. Remove NUL control characters from the file.`);
-			out += seg.slice(i, a) + h;
-			i = b + 1;
-		} else {
-			out += seg.slice(i, a + 1);
-			i = a + 1;
-		}
+function nodeToJson(n) {
+	const fields = [
+		["stable_id", n.stable_id],
+		["slug", n.slug],
+		["title", n.title],
+		["kind", n.kind],
+		["parent", n.parent],
+		["position", n.position],
+		["summary", n.summary],
+		["keywords", n.keywords],
+		["permalink", n.permalink]
+	];
+	const out = {};
+	for (const [key, val] of fields) {
+		const omit = val === null || val === 0 || Array.isArray(val) && val.length === 0;
+		if (key === "position" || !omit) out[key] = val;
 	}
-	return out + seg.slice(i);
+	const gov = governanceToJson(n.governance);
+	if (Object.keys(gov).length > 0) out["governance"] = gov;
+	return out;
 }
-/** Strip presentation markup from ONE non-fenced segment. Inline code is
-* protected first (`<div>` written in prose backticks is a lesson). `stack` is
-* the document-wide layout-tag stack (see dropBareLayoutTags). */
-function stripProsePresentation(segment, stack) {
-	const held = [];
-	let seg = segment.replace(INLINE_CODE_G, (m0) => {
-		held.push(m0);
-		return `${NUL}${held.length - 1}${NUL}`;
-	});
-	seg = stripStyleAttr(seg).replace(CLASS_ATTR_G, "");
-	seg = dropBareLayoutTags(seg, stack);
-	seg = seg.replace(BLANK_RUN_G, "\n\n");
-	return restoreHeld(seg, held);
+function governanceToJson(g) {
+	const out = {};
+	if (g.visibility !== null) out["visibility"] = g.visibility;
+	if (g.docStatus !== null) out["doc_status"] = g.docStatus;
+	if (g.owner !== null) out["owner"] = g.owner;
+	if (g.provenance !== null && g.provenance.length > 0) out["provenance"] = g.provenance;
+	if (g.supersededBy !== null) out["superseded_by"] = g.supersededBy;
+	return out;
 }
-/** Drop layout markup — `style={{…}}`, `className="…"`, and the `<div>`/
-* `<span>` wrappers they leave bare — while KEEPING every character of the
-* text inside them ("The Third Era of AI Tools" is content, `af-hero-eyebrow`
-* is a CSS hook; the oracle measured a student being served the wrapper).
-* A layout tag is only stripped once it is BARE: attributes go first, and a
-* wrapper with nothing left was pure layout by construction, while
-* `<div id="x">` keeps its tag — no tag allowlist to drift. Deliberately never
-* touches capitalised components (<Quiz> is curriculum), inline SVG, or
-* `<details>`/`<summary>` (semantic HTML). FENCE- and inline-code-safe. ONE
-* layout-tag stack is threaded through every prose segment of the document so
-* pairing survives a fence split. */
-function stripPresentationJsx(text) {
-	if (!text.includes("className=") && !text.includes("style={{") && !LAYOUT_TAG_PROBE.test(text)) return text;
-	const out = [];
-	let buf = [];
-	let fence = null;
-	const stack = [];
-	for (const line of pySplitLines(text, true)) {
-		const nxt = fenceStep(line, fence);
-		if (fence === null && nxt === null) buf.push(line);
-		else {
-			if (buf.length > 0) {
-				out.push(stripProsePresentation(buf.join(""), stack));
-				buf = [];
-			}
-			out.push(line);
-		}
-		fence = nxt;
+/**
+* Carried verbatim from the oracle's build step (ingest/build.py:109):
+* `source_id = f.path.removesuffix(".md") + ":prose"`. The ".md"-only strip is
+* a deliberate quirk — `a/b.md` → `a/b:prose` while `a/b.mdx` KEEPS its suffix
+* → `a/b.mdx:prose`. Persisted source rows and carry-forward joins already pin
+* this shape; changing it is a policy decision, never a tidy-up.
+*/
+function sourceId(path) {
+	return (path.endsWith(".md") ? path.slice(0, -3) : path) + ":prose";
+}
+/** Python len(): Unicode code points, not UTF-16 units. Every limit comparison
+* and the HARD_MAX_CHARS slice go through code points or the policy silently
+* changes on astral-plane text (emoji, musical symbols, CJK extensions). */
+function cpLen(s) {
+	let n = 0;
+	for (const _ch of s) n += 1;
+	return n;
+}
+/** Python str.splitlines() boundary set (full code-point scan, 2026-08-19):
+* \n \v \f \r \x1c \x1d \x1e \x85 \u2028 \u2029, with \r\n as one boundary.
+* A naive split(/\r?\n/) changes segmentation on \x85, \u2028 etc. All
+* boundaries are BMP, so a UTF-16 walk cannot land inside a surrogate pair. */
+const LINE_BOUNDARY = /* @__PURE__ */ new Set([
+	"\n",
+	"\v",
+	"\f",
+	"\r",
+	"",
+	"",
+	"",
+	"…",
+	"\u2028",
+	"\u2029"
+]);
+function pySplitLines(text, keepends) {
+	const out = [];
+	let start = 0;
+	let i = 0;
+	while (i < text.length) {
+		const ch = text[i];
+		if (LINE_BOUNDARY.has(ch)) {
+			let end = i + 1;
+			if (ch === "\r" && text[end] === "\n") end += 1;
+			out.push(keepends ? text.slice(start, end) : text.slice(start, i));
+			start = end;
+			i = end;
+		} else i += 1;
 	}
-	if (buf.length > 0) out.push(stripProsePresentation(buf.join(""), stack));
-	return out.join("");
-}
-/**
-* The body-cleaning pipeline every ingest runs BEFORE the skip-gate hash and
-* chunking, as ONE ordered unit so the order cannot regress. CRLF→LF is
-* normalized FIRST — the strippers are \n-anchored (BLANK_RUN_G = /\n{3,}/),
-* so normalizing AFTER them left a CRLF checkout's blank runs un-collapsed and
-* every chunk_hash + content_hash diverged from an LF checkout, re-embedding
-* the whole file while content_hash claimed nothing changed (review,
-* 2026-08-19). Then style blocks and presentation JSX are stripped so served
-* chunks reassemble the CLEANED body byte-exact. A bare \r (no following \n)
-* stays content.
-*/
-function cleanBody(rawBody) {
-	return stripPresentationJsx(stripStyleBlocks(rawBody.replaceAll("\r\n", "\n")));
+	if (start < text.length) out.push(text.slice(start));
+	return out;
 }
-/** Heading text never counts toward the nav/prose size test — the
-* "content-only" in the policy name. Note: joins on \n, so exotic line
-* boundaries are normalized before the length is taken (as in the oracle). */
-function teachingBody(content) {
-	return pyStrip(pySplitLines(content, false).filter((ln) => !HEADING.test(ln)).join("\n"));
+/** Python's whitespace set — str.isspace() == str.strip() == re \s for str
+* patterns (verified identical by full code-point scan, 2026-08-19). Note the
+* two-way mismatch with JS: \x1c-\x1f and \x85 are whitespace only here;
+* \ufeff is whitespace to JS trim()/\s but NOT to Python. */
+const PY_SPACE = /* @__PURE__ */ new Set("	\n\v\f\r …\xA0            \u2028\u2029  　");
+function pyStrip(s) {
+	let a = 0;
+	let b = s.length;
+	while (a < b && PY_SPACE.has(s[a])) a += 1;
+	while (b > a && PY_SPACE.has(s[b - 1])) b -= 1;
+	return s.slice(a, b);
 }
-function classify(content, headingPath) {
-	if (JSX_ASSESS.test(content)) return "assessment";
-	const leaf = headingPath.length > 0 ? headingPath[headingPath.length - 1] : "";
-	if (JSX_EMBED.test(content) || content.includes("docs.google.com/presentation") || leaf.includes("Teaching Aid")) return "embed";
-	if (cpLen(teachingBody(content)) < 250) return "nav";
-	return "prose";
+/** Character-class text for Python \s (same set as PY_SPACE, for regexes). */
+const WS = "\\t\\n\\v\\f\\r\\x1c-\\x1f \\x85\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000";
+/** Character-class text for Python \w: L* ∪ Nd ∪ Nl ∪ No ∪ {_} — i.e.
+* str.isalnum() plus underscore (spot-verified: é 中 Ⅰ ½ yes; 😀 and combining
+* marks no). Used where the oracle wrote \w or \b (JS \w/\b are ASCII-only). */
+const WORD = "\\p{L}\\p{N}_";
+const HEADING = new RegExp(`^(#{1,4})[${WS}]+([^\\n]*?)[${WS}]*$`);
+const FENCE = new RegExp(`^ {0,3}(\`{3,}|~{3,})([^\\n]*?)[${WS}]*$`);
+const EXPLICIT_ID = new RegExp(`[${WS}]*\\{#([${WORD}-]+)\\}[${WS}]*$`, "u");
+const SLUG_RUN = /[^a-z0-9]+/g;
+const JSX_ASSESS = new RegExp(`(?:^|(?<=\\n))[${WS}]*<(?:Quiz|Flashcards)(?![${WORD}])`, "u");
+const JSX_EMBED = new RegExp(`(?:^|(?<=\\n))[${WS}]*<(?:iframe|AICheck|AICheckField|ProjectCard|CapstoneWorkbook)(?![${WORD}])`, "u");
+const STYLE_OPEN = new RegExp(`^[${WS}]*<style(?![${WORD}])`, "iu");
+const CLASS_ATTR_G = new RegExp(`[${WS}]*className=(?:"[^"]*"|'[^']*'|\\{[^{}]*\\})`, "gu");
+const LAYOUT_NAMES = "div|span|section|figure|article|header|footer|main|aside";
+const LAYOUT_TAG_G = new RegExp(`<[${WS}]*(\\/?)[${WS}]*(${LAYOUT_NAMES})(?![${WORD}])([^<>]*?)(\\/?)[${WS}]*>`, "gu");
+const LAYOUT_TAG_PROBE = new RegExp(`<[${WS}]*(\\/?)[${WS}]*(${LAYOUT_NAMES})(?![${WORD}])([^<>]*?)(\\/?)[${WS}]*>`, "u");
+const INLINE_CODE_G = /* @__PURE__ */ new RegExp("`[^`\\n]+`", "g");
+const BLANK_RUN_G = /* @__PURE__ */ new RegExp("\\n{3,}", "g");
+const NUL = "\0";
+const BLANK_SEP = new RegExp(`(\\n[${WS}]*\\n)`);
+const sha256 = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+function slug(title, cap = 60) {
+	const s = title.toLowerCase().replace(SLUG_RUN, "-").replace(/^-+|-+$/g, "");
+	if (s.length <= cap) return s;
+	const cut = s.lastIndexOf("-", cap - 1);
+	return s.slice(0, cut > 0 ? cut : cap).replace(/^-+|-+$/g, "");
 }
-/** A segment DOMINATED by a line-leading widget (with < NAV_MAX_CHARS of
-* teaching body before it) labels EVERY fragment — a char-sliced widget must
-* not leak as prose. */
-function segmentMarkerType(span) {
-	for (const [re, label] of [[JSX_ASSESS, "assessment"], [JSX_EMBED, "embed"]]) {
-		const m = re.exec(span);
-		if (m !== null && cpLen(teachingBody(span.slice(0, m.index))) < 250) return label;
-	}
-	return null;
+function headingPathText(path) {
+	return path.map((p) => slug(p)).filter((s) => s !== "").join("/");
 }
-/** Walk lines; headings count only OUTSIDE fences; every line lands in exactly
-* one segment (byte-exact). H1 records a title but never enters the path. */
-function segmentText(text) {
-	const segments = [];
-	const titles = /* @__PURE__ */ new Map();
-	const anchors = /* @__PURE__ */ new Map();
-	let buf = [];
-	let curPath = [];
-	let curAnchor = null;
-	let fence = null;
-	const flush = () => {
-		if (buf.length > 0) {
-			segments.push({
-				path: [...curPath],
-				anchor: curAnchor,
-				text: buf.join("")
-			});
-			buf = [];
-		}
-	};
-	for (const line of pySplitLines(text, true)) {
-		const m = fence === null ? HEADING.exec(line) : null;
+/** CommonMark fence tracking (v5 — the correctness core). A backtick fence
+* whose info string contains a backtick is NOT a fence; closing needs the same
+* char, a run at least as long, and nothing but whitespace after. */
+function fenceStep(line, fence) {
+	const m = FENCE.exec(line);
+	if (fence === null) {
 		if (m !== null) {
-			flush();
-			const level = m[1].length;
-			const rawTitle = m[2];
-			const idM = EXPLICIT_ID.exec(rawTitle);
-			const title = idM !== null ? pyStrip(rawTitle.replace(EXPLICIT_ID, "")) : rawTitle;
-			titles.set(level, title);
-			anchors.set(level, idM !== null ? idM[1] : null);
-			const deeper = [...titles.keys()].filter((lv) => lv > level);
-			for (const lv of deeper) {
-				titles.delete(lv);
-				anchors.delete(lv);
-			}
-			curPath = [...titles.keys()].sort((a, b) => a - b).filter((lv) => lv >= 2 && lv <= level).map((lv) => titles.get(lv));
-			curAnchor = curPath.length > 0 ? anchors.get(level) || slug(title) : null;
+			const marker = m[1];
+			const info = m[2];
+			if (marker[0] === "`" && info.includes("`")) return null;
+			return [marker[0], marker.length];
 		}
-		buf.push(line);
-		if (m === null) fence = fenceStep(line, fence);
+		return null;
 	}
-	flush();
-	return segments;
+	if (m !== null && m[1][0] === fence[0] && m[1].length >= fence[1] && m[2] === "") return null;
+	return fence;
 }
-/** Split on blank-line runs, greedy-pack, but flush ONLY outside a fence — a
-* flush never lands between an open fence and its close. The separator is
-* CAPTURED, so blank-line runs ride along as parts and concatenation is
-* lossless; nothing is trimmed. */
-function subsplit(span, maxChars) {
-	if (cpLen(span) <= maxChars) return [span];
-	const parts = span.split(BLANK_SEP);
-	const pieces = [];
-	let buf = "";
-	let bufLen = 0;
+/** Drop prose-level `<style>…</style>` CSS — pure presentation; classify would
+* size a multi-KB CSS wall as prose and serve it (the oracle's field-test #3
+* "about" doc opened with ~2KB of it). Runs BEFORE contentHash + chunkText, so
+* chunks reassemble the CLEANED body byte-exact and only files that actually
+* held a block re-embed. FENCE-SAFE: a `<style>` shown as example code inside
+* a fence is content and survives. See STYLE_OPEN for the locked fast-path
+* quirk (^-anchored, no multiline). */
+function stripStyleBlocks(text) {
+	if (!STYLE_OPEN.test(text)) return text;
+	const out = [];
 	let fence = null;
-	for (const part of parts) {
-		const partLen = cpLen(part);
-		if (buf !== "" && fence === null && bufLen + partLen > maxChars) {
-			pieces.push(buf);
-			buf = "";
-			bufLen = 0;
+	let dropping = false;
+	for (const line of pySplitLines(text, true)) {
+		if (dropping) {
+			if (line.toLowerCase().includes("</style>")) dropping = false;
+			continue;
 		}
-		buf += part;
-		bufLen += partLen;
-		for (const line of pySplitLines(part, true)) fence = fenceStep(line, fence);
+		if (fence === null && STYLE_OPEN.test(line)) {
+			if (!line.toLowerCase().includes("</style>")) dropping = true;
+			continue;
+		}
+		out.push(line);
+		fence = fenceStep(line, fence);
 	}
-	if (buf !== "") pieces.push(buf);
-	const out = [];
-	for (const piece of pieces) out.push(...enforceCeiling(piece));
-	return out;
+	return out.join("");
 }
-/** The ONLY place mid-line/mid-fence slicing can happen (a pathological single
-* paragraph or giant fence). Slices by CODE POINTS — 4000 UTF-16 units would
-* be a different policy and could split a surrogate pair. */
-function enforceCeiling(piece) {
-	if (cpLen(piece) <= 4e3) return [piece];
-	const cps = [...piece];
+const rstripSpacesTabs = (s) => {
+	let b = s.length;
+	while (b > 0 && (s[b - 1] === " " || s[b - 1] === "	")) b -= 1;
+	return s.slice(0, b);
+};
+/** Remove `style={{ ... }}` attributes by BRACE MATCHING, not regex: the value
+* is a JS object literal and the oracle measured 168 of them spanning lines.
+* An unbalanced opener leaves the rest of the text verbatim — a stripper must
+* never eat the rest of a document to satisfy itself. (The pre-attr rstrip of
+* spaces/tabs also glues `<div ` + a KEPT unbalanced `style={{` opener into
+* `<divstyle={{` — an oracle quirk locked by fixture strip-malformed-kept.) */
+function stripStyleAttr(text) {
 	const out = [];
-	for (let i = 0; i < cps.length; i += HARD_MAX_CHARS) out.push(cps.slice(i, i + HARD_MAX_CHARS).join(""));
-	return out;
-}
-function chunkText(text, maxChars = MAX_CHARS) {
-	const chunks = [];
-	let prefix = "";
-	const emit = (content, path, anchor, sourceType) => {
-		chunks.push({
-			ordinal: chunks.length,
-			content,
-			chunkHash: sha256(content),
-			headingPath: [...path],
-			anchor,
-			sourceType
-		});
-	};
-	for (const seg of segmentText(text)) {
-		if (pyStrip(seg.text) === "") {
-			if (chunks.length > 0) {
-				const last = chunks[chunks.length - 1];
-				const content = last.content + seg.text;
-				chunks[chunks.length - 1] = {
-					...last,
-					content,
-					chunkHash: sha256(content)
-				};
-			} else prefix += seg.text;
-			continue;
-		}
-		const segIsNav = cpLen(teachingBody(seg.text)) < 250;
-		const segMarker = segmentMarkerType(seg.text);
-		for (const piece of subsplit(seg.text, maxChars)) {
-			let sourceType;
-			if (segMarker !== null) sourceType = segMarker;
-			else {
-				sourceType = classify(piece, seg.path);
-				if (sourceType === "nav" && !segIsNav) sourceType = "prose";
+	let i = 0;
+	for (;;) {
+		const j = text.indexOf("style={{", i);
+		if (j < 0) break;
+		out.push(rstripSpacesTabs(text.slice(i, j)));
+		let k = j + 6;
+		let depth = 0;
+		let closed = false;
+		while (k < text.length) {
+			const ch = text[k];
+			if (ch === "{") depth += 1;
+			else if (ch === "}") {
+				depth -= 1;
+				if (depth === 0) {
+					k += 1;
+					closed = true;
+					break;
+				}
 			}
-			const content = prefix !== "" ? prefix + piece : piece;
-			prefix = "";
-			emit(content, seg.path, seg.anchor, sourceType);
+			k += 1;
+		}
+		if (!closed) {
+			out.push(text.slice(j));
+			return out.join("");
 		}
+		i = k;
 	}
-	if (prefix !== "") emit(prefix, [], null, "nav");
-	return chunks;
-}
-/** §5 rule 2: snapshot-token TTL (30 min) + 10 min = 40 min from retirement. */
-const GC_GRACE_MS = 24e5;
-/**
-* Poison-chunk tolerance (oracle review: poison-chunk-wedge): one
-* deterministically-failing chunk must not wedge every future flip forever. A
-* generation is servable if a SMALL fraction failed — the read path already
-* filters to `embedded`, so a quarantined chunk is simply absent, not
-* corrupt. Above the fraction, a real ingest break is signalled by
-* withholding readiness.
-*/
-const MAX_FAILED_FRACTION = .02;
-const LOCK_SQL = "SELECT pg_advisory_xact_lock(hashtextextended('sor-ingest:' || $1, 0))";
-/**
-* Take the tenant lock, allocate generation max+1 (monotonic per corpus,
-* never reused), open the building run. The corpora row seeds at
-* active_generation=0 (nothing active) on first ingest.
-*
-* `manifestSha256` fills `instance_bundle_sha256` — ksor has no bundle
-* transport (the CLI reads the local repo), so the recorded digest is of the
-* manifest this build actually consumed: the closest honest provenance.
-*/
-async function allocateRun(client, opts) {
-	await client.query(LOCK_SQL, [opts.tenantId]);
-	await client.query("INSERT INTO corpora (tenant_id, corpus_id, active_generation) VALUES ($1, $2, 0) ON CONFLICT (tenant_id, corpus_id) DO NOTHING", [opts.tenantId, opts.corpusId]);
-	const next = await client.query("SELECT COALESCE(max(generation), 0) + 1 AS next FROM ingestion_runs WHERE tenant_id = $1 AND corpus_id = $2", [opts.tenantId, opts.corpusId]);
-	const generation = Number(next.rows[0].next);
-	const run = await client.query("INSERT INTO ingestion_runs (tenant_id, corpus_id, generation, state, source_commit, instance_bundle_sha256, schema_version) VALUES ($1, $2, $3, 'building', $4, $5, $6) RETURNING run_id", [
-		opts.tenantId,
-		opts.corpusId,
-		generation,
-		opts.sourceCommit,
-		opts.manifestSha256,
-		schemaVersion()
-	]);
-	return {
-		runId: Number(run.rows[0].run_id),
-		generation
-	};
-}
-/**
-* The generation to carry embeddings FROM: the newest COMPLETE one holding
-* embedded chunks.
-*
-* WHY NOT ONLY THE ACTIVE ONE: the eval-before-flip design means a candidate
-* is often built, measured, and deliberately NOT served; ACTIVE then points
-* at an OLD generation and the next candidate re-embeds the whole corpus —
-* measured 2026-08-02: generation 4 re-embedded 5,915 chunks while
-* generation 3 held near-identical content, because generation 1 was still
-* active.
-*
-* Two constraints a rewrite once dropped (oracle review of PR #420):
-* CORPUS-SCOPED via the run-table join (chunks carry no corpus_id), and
-* COMPLETE RUNS ONLY (ready/active/retired) — a crashed `building` queue's
-* half-drained vectors never qualify.
-*
-* Returns 0 when there is no complete embedded generation — the first ingest.
-*/
-async function bestCarrySource(client, opts) {
-	const gen = (await client.query(`
-    SELECT max(c.generation) AS gen FROM chunks c
-    JOIN ingestion_runs r ON r.tenant_id = c.tenant_id AND r.generation = c.generation
-    WHERE c.tenant_id = $1 AND r.corpus_id = $2
-      AND r.state IN ('ready', 'active', 'retired')
-      AND c.generation <> $3 AND c.embedding_status = 'embedded'
-    `, [
-		opts.tenantId,
-		opts.corpusId,
-		opts.excludeGeneration
-	])).rows[0]?.gen ?? null;
-	return gen === null ? 0 : Number(gen);
-}
-/**
-* Copy embeddings for chunks whose ENTIRE embed input is unchanged (hash +
-* heading path + node title). Cost ∝ change survives the generational
-* rebuild. Returns rows carried.
-*
-* `modelId` is REQUIRED, never defaulted here: the vendor transport is
-* irrelevant to the space (the same model through two providers is the same
-* space), and a silent module default is exactly how a model bump would
-* carry stale vectors unnoticed.
-*/
-async function carryForward(client, opts) {
-	if (opts.fromGeneration < 1) return 0;
-	return (await client.query(`
-    UPDATE chunks new SET embedding = old.embedding, embedding_status = 'embedded',
-           embedded_at = old.embedded_at, embedding_model = old.embedding_model
-    FROM chunks old, sources os, content_nodes onode, sources ns, content_nodes nnode
-    WHERE new.tenant_id = $1 AND new.generation = $2
-      AND new.embedding_status = 'pending'
-      AND old.tenant_id = new.tenant_id AND old.generation = $3
-      AND old.embedding_status = 'embedded'
-      -- R-1 gate (oracle review: carry-model-gate-r1): carry ONLY vectors from the CURRENT
-      -- embedding model. Without this, a model bump silently carries every old-model vector
-      -- forward (pending→0, flip → corpus-wide nonsense cosine vs the new query model, zero
-      -- errors). A model change now correctly leaves the old vectors pending → they re-embed.
-      AND old.embedding_model = $4
-      AND old.source_id = new.source_id
-      AND old.chunk_hash = new.chunk_hash
-      AND old.heading_path_text IS NOT DISTINCT FROM new.heading_path_text
-      AND os.source_id = old.source_id AND os.tenant_id = old.tenant_id
-      AND os.generation = old.generation
-      AND onode.node_id = os.node_id AND onode.tenant_id = os.tenant_id
-      AND ns.source_id = new.source_id AND ns.tenant_id = new.tenant_id
-      AND ns.generation = new.generation
-      AND nnode.node_id = ns.node_id AND nnode.tenant_id = ns.tenant_id
-      AND onode.title = nnode.title
-    `, [
-		opts.tenantId,
-		opts.generation,
-		opts.fromGeneration,
-		opts.modelId
-	])).rowCount ?? 0;
-}
-/**
-* avg(embedding) per node over servable prose — rows the routing arm reads
-* (never aggregate at query time again). nav/embed/assessment chunks never
-* pollute routing centroids.
-*/
-async function materializeCentroids(client, opts) {
-	await client.query("DELETE FROM node_centroids WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation]);
-	return (await client.query(`
-    INSERT INTO node_centroids (tenant_id, generation, node_id, stable_id, chunk_count, embedding)
-    SELECT c.tenant_id, c.generation, n.node_id, n.stable_id, count(*), avg(c.embedding)
-    FROM chunks c
-    JOIN sources s ON s.source_id = c.source_id AND s.tenant_id = c.tenant_id
-                  AND s.generation = c.generation
-    JOIN content_nodes n ON n.node_id = s.node_id AND n.tenant_id = s.tenant_id
-    WHERE c.tenant_id = $1 AND c.generation = $2 AND c.embedding_status = 'embedded'
-      AND c.labels->>'source_type' = 'prose'
-    GROUP BY c.tenant_id, c.generation, n.node_id, n.stable_id
-    `, [opts.tenantId, opts.generation])).rowCount ?? 0;
+	out.push(text.slice(i));
+	return out.join("");
 }
-/**
-* The ready gate, factored pure: zero PENDING (the queue drained) + some
-* embedded content + failures within tolerance. The read path serves only
-* `embedded`, so a failed chunk is quarantined, not corrupt.
-*/
-function generationReady(health) {
-	if (health.pending !== 0 || health.embedded === 0) return false;
-	const total = health.embedded + health.failed;
-	return health.failed / total <= MAX_FAILED_FRACTION;
+/** Drop layout tags left BARE by the attribute strip, KEEPING each closer
+* paired with its opener: a closer carries no attributes, so `</div>` cannot
+* say whether it belongs to a removed wrapper or to a kept `<div id="x">`.
+* Track depth; a closer is removed iff its opener was. On any mismatch the tag
+* is KEPT — a stray tag beats eaten content. `stack` is owned by the CALLER
+* and persists across every prose segment of one document: a styled wrapper
+* around a code fence splits at the fence, and its opener/closer land in
+* different segments (228 of them in the oracle's corpus). */
+function dropBareLayoutTags(segment, stack) {
+	return segment.replace(LAYOUT_TAG_G, (m0, closing, name, rawAttrs, selfClosing) => {
+		const attrs = pyStrip(rawAttrs);
+		if (closing !== "") {
+			const top = stack[stack.length - 1];
+			if (top !== void 0 && top[0] === name) return stack.pop()[1] ? "" : m0;
+			return m0;
+		}
+		if (selfClosing !== "") return attrs === "" ? "" : m0;
+		stack.push([name, attrs === ""]);
+		return attrs === "" ? "" : m0;
+	});
 }
-async function generationHealth(client, opts) {
-	const row = (await client.query("SELECT count(*) FILTER (WHERE embedding_status = 'embedded') AS embedded, count(*) FILTER (WHERE embedding_status = 'pending') AS pending, count(*) FILTER (WHERE embedding_status = 'failed') AS failed FROM chunks WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation])).rows[0];
-	return {
-		generation: opts.generation,
-		embedded: Number(row.embedded),
-		pending: Number(row.pending),
-		failed: Number(row.failed)
-	};
+/** Restore NUL<n>NUL placeholders — equivalent to the oracle's
+* re.sub(r"\x00(\d+)\x00", ...): a leftmost scan where a match is a NUL, a
+* maximal non-empty ASCII digit run, and a closing NUL; anything else stays
+* verbatim (backtracking cannot produce any other match for this pattern). */
+function restoreHeld(seg, held) {
+	let out = "";
+	let i = 0;
+	for (;;) {
+		const a = seg.indexOf(NUL, i);
+		if (a < 0) break;
+		let b = a + 1;
+		while (b < seg.length && seg[b] >= "0" && seg[b] <= "9") b += 1;
+		if (b > a + 1 && seg[b] === NUL) {
+			const d = seg.slice(a + 1, b);
+			const h = held[Number(d)];
+			if (h === void 0) throw new Error(`inline-code placeholder NUL${d}NUL has no held span (held ${held.length}): the source document contains a literal NUL-digit-NUL sequence, which collides with the stripper's placeholder scheme. Remove NUL control characters from the file.`);
+			out += seg.slice(i, a) + h;
+			i = b + 1;
+		} else {
+			out += seg.slice(i, a + 1);
+			i = a + 1;
+		}
+	}
+	return out + seg.slice(i);
 }
-function addedSlugs(delta) {
-	return [...delta.newSlugs].filter((s) => !delta.priorSlugs.has(s)).sort();
+/** Strip presentation markup from ONE non-fenced segment. Inline code is
+* protected first (`<div>` written in prose backticks is a lesson). `stack` is
+* the document-wide layout-tag stack (see dropBareLayoutTags). */
+function stripProsePresentation(segment, stack) {
+	const held = [];
+	let seg = segment.replace(INLINE_CODE_G, (m0) => {
+		held.push(m0);
+		return `${NUL}${held.length - 1}${NUL}`;
+	});
+	seg = stripStyleAttr(seg).replace(CLASS_ATTR_G, "");
+	seg = dropBareLayoutTags(seg, stack);
+	seg = seg.replace(BLANK_RUN_G, "\n\n");
+	return restoreHeld(seg, held);
 }
-function removedSlugs(delta) {
-	return [...delta.priorSlugs].filter((s) => !delta.newSlugs.has(s)).sort();
+/** Drop layout markup — `style={{…}}`, `className="…"`, and the `<div>`/
+* `<span>` wrappers they leave bare — while KEEPING every character of the
+* text inside them ("The Third Era of AI Tools" is content, `af-hero-eyebrow`
+* is a CSS hook; the oracle measured a student being served the wrapper).
+* A layout tag is only stripped once it is BARE: attributes go first, and a
+* wrapper with nothing left was pure layout by construction, while
+* `<div id="x">` keeps its tag — no tag allowlist to drift. Deliberately never
+* touches capitalised components (<Quiz> is curriculum), inline SVG, or
+* `<details>`/`<summary>` (semantic HTML). FENCE- and inline-code-safe. ONE
+* layout-tag stack is threaded through every prose segment of the document so
+* pairing survives a fence split. */
+function stripPresentationJsx(text) {
+	if (!text.includes("className=") && !text.includes("style={{") && !LAYOUT_TAG_PROBE.test(text)) return text;
+	const out = [];
+	let buf = [];
+	let fence = null;
+	const stack = [];
+	for (const line of pySplitLines(text, true)) {
+		const nxt = fenceStep(line, fence);
+		if (fence === null && nxt === null) buf.push(line);
+		else {
+			if (buf.length > 0) {
+				out.push(stripProsePresentation(buf.join(""), stack));
+				buf = [];
+			}
+			out.push(line);
+		}
+		fence = nxt;
+	}
+	if (buf.length > 0) out.push(stripProsePresentation(buf.join(""), stack));
+	return out.join("");
 }
 /**
-* Net fractional drop in node count vs the prior generation. Zero when the
-* prior generation is empty (a FIRST ingest has nothing to shrink from) so
-* the guard never trips on it.
+* The body-cleaning pipeline every ingest runs BEFORE the skip-gate hash and
+* chunking, as ONE ordered unit so the order cannot regress. CRLF→LF is
+* normalized FIRST — the strippers are \n-anchored (BLANK_RUN_G = /\n{3,}/),
+* so normalizing AFTER them left a CRLF checkout's blank runs un-collapsed and
+* every chunk_hash + content_hash diverged from an LF checkout, re-embedding
+* the whole file while content_hash claimed nothing changed (review,
+* 2026-08-19). Then style blocks and presentation JSX are stripped so served
+* chunks reassemble the CLEANED body byte-exact. A bare \r (no following \n)
+* stays content.
 */
-function shrinkFraction(priorCount, newCount) {
-	if (priorCount === 0) return 0;
-	return Math.max(0, priorCount - newCount) / priorCount;
+function cleanBody(rawBody) {
+	return stripPresentationJsx(stripStyleBlocks(rawBody.replaceAll("\r\n", "\n")));
 }
-/**
-* True when the corpus shrank by MORE than the tolerated fraction — the flip
-* should be refused unless the drop is explicitly acknowledged. A first
-* ingest is always safe.
-*/
-function shrinkUnsafe(priorCount, newCount, maxShrink) {
-	return priorCount > 0 && shrinkFraction(priorCount, newCount) > maxShrink;
+/** Heading text never counts toward the nav/prose size test — the
+* "content-only" in the policy name. Note: joins on \n, so exotic line
+* boundaries are normalized before the length is taken (as in the oracle). */
+function teachingBody(content) {
+	return pyStrip(pySplitLines(content, false).filter((ln) => !HEADING.test(ln)).join("\n"));
 }
-/** Read the node-slug sets of the active generation and the candidate; the caller decides. */
-async function flipDelta(client, opts) {
-	const raw = (await client.query("SELECT active_generation FROM corpora WHERE tenant_id = $1 AND corpus_id = $2", [opts.tenantId, opts.corpusId])).rows[0]?.active_generation ?? null;
-	const prior = raw === null ? 0 : Number(raw);
-	const nodesOf = async (generation) => {
-		if (generation < 1) return /* @__PURE__ */ new Set();
-		const res = await client.query("SELECT stable_id FROM content_nodes WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, generation]);
-		return new Set(res.rows.map((r) => String(r.stable_id)));
-	};
-	return {
-		priorGeneration: prior,
-		priorSlugs: await nodesOf(prior),
-		newSlugs: await nodesOf(opts.newGeneration)
+function classify(content, headingPath) {
+	if (JSX_ASSESS.test(content)) return "assessment";
+	const leaf = headingPath.length > 0 ? headingPath[headingPath.length - 1] : "";
+	if (JSX_EMBED.test(content) || content.includes("docs.google.com/presentation") || leaf.includes("Teaching Aid")) return "embed";
+	if (cpLen(teachingBody(content)) < 250) return "nav";
+	return "prose";
+}
+/** A segment DOMINATED by a line-leading widget (with < NAV_MAX_CHARS of
+* teaching body before it) labels EVERY fragment — a char-sliced widget must
+* not leak as prose. */
+function segmentMarkerType(span) {
+	for (const [re, label] of [[JSX_ASSESS, "assessment"], [JSX_EMBED, "embed"]]) {
+		const m = re.exec(span);
+		if (m !== null && cpLen(teachingBody(span.slice(0, m.index))) < 250) return label;
+	}
+	return null;
+}
+/** Walk lines; headings count only OUTSIDE fences; every line lands in exactly
+* one segment (byte-exact). H1 records a title but never enters the path. */
+function segmentText(text) {
+	const segments = [];
+	const titles = /* @__PURE__ */ new Map();
+	const anchors = /* @__PURE__ */ new Map();
+	let buf = [];
+	let curPath = [];
+	let curAnchor = null;
+	let fence = null;
+	const flush = () => {
+		if (buf.length > 0) {
+			segments.push({
+				path: [...curPath],
+				anchor: curAnchor,
+				text: buf.join("")
+			});
+			buf = [];
+		}
 	};
+	for (const line of pySplitLines(text, true)) {
+		const m = fence === null ? HEADING.exec(line) : null;
+		if (m !== null) {
+			flush();
+			const level = m[1].length;
+			const rawTitle = m[2];
+			const idM = EXPLICIT_ID.exec(rawTitle);
+			const title = idM !== null ? pyStrip(rawTitle.replace(EXPLICIT_ID, "")) : rawTitle;
+			titles.set(level, title);
+			anchors.set(level, idM !== null ? idM[1] : null);
+			const deeper = [...titles.keys()].filter((lv) => lv > level);
+			for (const lv of deeper) {
+				titles.delete(lv);
+				anchors.delete(lv);
+			}
+			curPath = [...titles.keys()].sort((a, b) => a - b).filter((lv) => lv >= 2 && lv <= level).map((lv) => titles.get(lv));
+			curAnchor = curPath.length > 0 ? anchors.get(level) || slug(title) : null;
+		}
+		buf.push(line);
+		if (m === null) fence = fenceStep(line, fence);
+	}
+	flush();
+	return segments;
 }
-/**
-* Activation + run-state bookkeeping + the ledger row. The health gate is the
-* CALLER's duty — never partially activate. Serialized under the tenant
-* advisory lock (re-taken here: the allocate lock died with its own txn) and
-* MONOTONIC: only ever advances.
-*/
-async function flip(client, opts) {
-	await client.query(LOCK_SQL, [opts.tenantId]);
-	if (!(await client.query("UPDATE corpora SET rollback_generation = active_generation, active_generation = $1, updated_at = now() WHERE tenant_id = $2 AND corpus_id = $3 AND active_generation < $1", [
-		opts.toGeneration,
-		opts.tenantId,
-		opts.corpusId
-	])).rowCount) throw new Error(`flip to generation ${opts.toGeneration} refused: active_generation is already >= it (an out-of-order or duplicate flip — refusing to regress the served corpus)`);
-	await client.query("UPDATE ingestion_runs SET state = 'retired', finished_at = now() WHERE tenant_id = $1 AND corpus_id = $2 AND state = 'active'", [opts.tenantId, opts.corpusId]);
-	await client.query("UPDATE ingestion_runs SET state = 'active', finished_at = COALESCE(finished_at, now()) WHERE tenant_id = $1 AND corpus_id = $2 AND generation = $3", [
-		opts.tenantId,
-		opts.corpusId,
-		opts.toGeneration
-	]);
-	await client.query("INSERT INTO retrieval_log (tenant_id, corpus_id, generation, actor, action, detail) VALUES ($1, $2, $3, 'sor-ingest', 'generation_activated', '{}')", [
-		opts.tenantId,
-		opts.corpusId,
-		opts.toGeneration
-	]);
+/** Split on blank-line runs, greedy-pack, but flush ONLY outside a fence — a
+* flush never lands between an open fence and its close. The separator is
+* CAPTURED, so blank-line runs ride along as parts and concatenation is
+* lossless; nothing is trimmed. */
+function subsplit(span, maxChars) {
+	if (cpLen(span) <= maxChars) return [span];
+	const parts = span.split(BLANK_SEP);
+	const pieces = [];
+	let buf = "";
+	let bufLen = 0;
+	let fence = null;
+	for (const part of parts) {
+		const partLen = cpLen(part);
+		if (buf !== "" && fence === null && bufLen + partLen > maxChars) {
+			pieces.push(buf);
+			buf = "";
+			bufLen = 0;
+		}
+		buf += part;
+		bufLen += partLen;
+		for (const line of pySplitLines(part, true)) fence = fenceStep(line, fence);
+	}
+	if (buf !== "") pieces.push(buf);
+	const out = [];
+	for (const piece of pieces) out.push(...enforceCeiling(piece));
+	return out;
 }
-/**
-* The §5 algebra: not active, not rollback, past token grace since
-* retirement, ≥2 complete generations REMAIN after collection; abandoned
-* builds reap on heartbeat staleness alone (they were never served, no token
-* can reference them).
-*/
-async function collectableGenerations(client, opts) {
-	const ts = opts.now ?? /* @__PURE__ */ new Date();
-	const pointer = await client.query("SELECT active_generation, rollback_generation FROM corpora WHERE tenant_id = $1 AND corpus_id = $2", [opts.tenantId, opts.corpusId]);
-	if (pointer.rows.length === 0) return [];
-	const active = Number(pointer.rows[0].active_generation);
-	const rollbackRaw = pointer.rows[0].rollback_generation;
-	const rollbackGen = rollbackRaw === null ? null : Number(rollbackRaw);
-	const runs = await client.query("SELECT generation, state, finished_at, heartbeat_at FROM ingestion_runs WHERE tenant_id = $1 AND corpus_id = $2 AND state <> 'reaped' ORDER BY generation", [opts.tenantId, opts.corpusId]);
-	const complete = runs.rows.filter((r) => [
-		"ready",
-		"active",
-		"retired"
-	].includes(String(r.state)));
+/** The ONLY place mid-line/mid-fence slicing can happen (a pathological single
+* paragraph or giant fence). Slices by CODE POINTS — 4000 UTF-16 units would
+* be a different policy and could split a surrogate pair. */
+function enforceCeiling(piece) {
+	if (cpLen(piece) <= 4e3) return [piece];
+	const cps = [...piece];
 	const out = [];
-	let remaining = complete.length;
-	for (const row of runs.rows) {
-		const gen = Number(row.generation);
-		const state = String(row.state);
-		const finishedAt = row.finished_at;
-		const heartbeatAt = row.heartbeat_at;
-		if (state === "building") {
-			if (heartbeatAt !== null && ts.getTime() - heartbeatAt.getTime() > 864e5) out.push(gen);
+	for (let i = 0; i < cps.length; i += HARD_MAX_CHARS) out.push(cps.slice(i, i + HARD_MAX_CHARS).join(""));
+	return out;
+}
+function chunkText(text, maxChars = MAX_CHARS) {
+	const chunks = [];
+	let prefix = "";
+	const emit = (content, path, anchor, sourceType) => {
+		chunks.push({
+			ordinal: chunks.length,
+			content,
+			chunkHash: sha256(content),
+			headingPath: [...path],
+			anchor,
+			sourceType
+		});
+	};
+	for (const seg of segmentText(text)) {
+		if (pyStrip(seg.text) === "") {
+			if (chunks.length > 0) {
+				const last = chunks[chunks.length - 1];
+				const content = last.content + seg.text;
+				chunks[chunks.length - 1] = {
+					...last,
+					content,
+					chunkHash: sha256(content)
+				};
+			} else prefix += seg.text;
 			continue;
 		}
-		if (gen === active || rollbackGen !== null && gen === rollbackGen) continue;
-		if (finishedAt === null || ts.getTime() - finishedAt.getTime() < GC_GRACE_MS) continue;
-		if (remaining - 1 < 2) continue;
-		remaining -= 1;
-		out.push(gen);
+		const segIsNav = cpLen(teachingBody(seg.text)) < 250;
+		const segMarker = segmentMarkerType(seg.text);
+		for (const piece of subsplit(seg.text, maxChars)) {
+			let sourceType;
+			if (segMarker !== null) sourceType = segMarker;
+			else {
+				sourceType = classify(piece, seg.path);
+				if (sourceType === "nav" && !segIsNav) sourceType = "prose";
+			}
+			const content = prefix !== "" ? prefix + piece : piece;
+			prefix = "";
+			emit(content, seg.path, seg.anchor, sourceType);
+		}
 	}
-	return out;
-}
-/**
-* Delete one generation's rows (chunks cascade from sources) and mark the run
-* reaped. NEVER touches takedown_denylist or retrieval_log — the ledger and
-* denylist outlive the content they governed (§5).
-*/
-async function reap(client, opts) {
-	for (const sql of [
-		"DELETE FROM node_centroids WHERE tenant_id = $1 AND generation = $2",
-		"DELETE FROM slug_aliases WHERE tenant_id = $1 AND generation = $2",
-		"DELETE FROM sources WHERE tenant_id = $1 AND generation = $2"
-	]) await client.query(sql, [opts.tenantId, opts.generation]);
-	for (;;) if (!(await client.query("DELETE FROM content_nodes n WHERE n.tenant_id = $1 AND n.generation = $2 AND NOT EXISTS (SELECT 1 FROM content_nodes ch WHERE ch.parent_id = n.node_id                  AND ch.tenant_id = n.tenant_id AND ch.generation = n.generation)", [opts.tenantId, opts.generation])).rowCount) break;
-	await client.query("UPDATE ingestion_runs SET state = 'reaped' WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation]);
+	if (prefix !== "") emit(prefix, [], null, "nav");
+	return chunks;
 }
 const FRONTMATTER = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/;
 function splitFrontmatter(text) {
@@ -8257,7 +8257,7 @@ async function ingestCommand(args) {
 			return await buildGeneration(pool, instance, {
 				knowledgeDir: values.knowledge,
 				sourceCommit,
-				flip: values.flip ?? false,
+				flip: false,
 				provider,
 				onLog: (line) => process.stdout.write(line + "\n")
 			});
@@ -8274,8 +8274,16 @@ async function ingestCommand(args) {
 	process.stdout.write(`ingest: generation ${report.generation} — ${report.nodes} nodes, ${report.chunks} chunks; embedded ${report.embedded}, carried ${report.carried}, failed ${report.failed}\n`);
 	if (report.refusal !== null) return fail$1(REFUSED, report.refusal);
 	const governance = await withPool(dsn, (pool) => assertGovernanceServable(pool, instance, report.generation).then(() => null, (error) => error instanceof Error ? error.message : String(error)));
-	if (governance !== null) return fail$1(REFUSED, `generation ${report.generation} was built, but no surface can serve it\n  ${governance.split("\n").join("\n  ")}`);
-	if (!report.flipped) process.stdout.write("ready; flip withheld (pass --flip to activate)\n");
+	if (governance !== null) return fail$1(REFUSED, `generation ${report.generation} was built and NOT activated — no surface could serve it\n  ${governance.split("\n").join("\n  ")}\n  note: generation ${report.generation} is left behind, un-activated; \`ksor gc\` reaps it once the grace window passes. The previously active generation still serves.`);
+	if (values.flip === true && !report.unchanged) {
+		await withPool(dsn, (pool) => runIngest(pool, instance.tenantId, (client) => flip(client, {
+			tenantId: instance.tenantId,
+			corpusId: instance.corpusId,
+			toGeneration: report.generation
+		})));
+		process.stdout.write(`FLIPPED active generation -> ${report.generation}\n`);
+	}
+	if (values.flip !== true) process.stdout.write("ready; flip withheld (pass --flip to activate)\n");
 	return 0;
 }
 /**