@polycode-projects/the-mechanical-code-talker 6.0.19 → 6.0.20

package/src/adapters/memory/core.mjs

@@ -39,6 +39,8 @@ import {
 // consumers keep one import site.
 export { CREATED_AT_PROP, UPDATED_AT_PROP, provenanceTagToSource } from "../../domain/memory/trust.mjs";
 import { NEG_PREDICATE_PREFIX, negatedPredicate } from "../../domain/memory/capability.mjs";
+import { factOrderKey } from "../../domain/memory/fact-order.mjs";
+import { partitionAttributions } from "../../domain/news-feed.mjs";
 import {
   planHeadRollup, planChainRollup, mergeRollups,
   isHeadRollupId, isChainRollupId, isRollupId, headRollupTypeOf,
@@ -68,7 +70,10 @@ export {
 // fine as long as neither side READS an imported binding while the other's
 // body is still running — rows.mjs builds its class map on first use, and
 // every use here is inside a function.
-import { payloadToRows, rowsToPayload, diffRows, renormalizeAssembledPayload, renormalizeProseIndex } from "./rows.mjs";
+import {
+  payloadToRows, rowsToPayload, diffRows, renormalizeAssembledPayload, renormalizeProseIndex,
+  canDropAssembledIndividuals, dropAssembledIndividuals, appendAssembledRowOrder, dropAssembledRowOrder,
+} from "./rows.mjs";
 
 // The rollup vocabulary and its tuning constants live with the compaction
 // layer; re-exported here so store consumers keep one import site.
@@ -139,13 +144,13 @@ const MEMORY_VOCABULARY = [
   { prop: "mgx:factProvenance", note: "LEGACY COMPAT SHIM: the ' | '-joined provenance tag string a fact came from; the source-of-truth is now the mgx:statedBy edges derived from it" },
   { prop: "mgx:sourceId", note: "the assertion key a Fact record is filed under — the Source id of the ONE party asserting it, which is also the @-suffix of the record's own id. `src:none` when no tag names a Source, so every record has a key rather than a hole" },
   { prop: "mgx:observedAt", note: "OPTIONAL valid time: when the asserting party WITNESSED the claim, as against mgx:createdAt's transaction time (when this store recorded it). A stale article read today loses to an eyewitness report from yesterday. Stored only when a caller supplies one — never fabricated, never backfilled" },
-  { prop: "mgx:extractionFinding", note: "OPTIONAL: the space-joined structural findings the extractor recorded about how THIS assertion's sentence was read, from the closed vocabulary identifier-token | clause-fallback | pronoun-carry | definitional-frame. Per assertion, never per triple: a later clean re-assertion of the same triple carries none. Absence means no findings were recorded, never that the sentence was checked and read cleanly" },
+  { prop: "mgx:extractionFinding", note: "OPTIONAL: the space-joined structural findings the extractor recorded about how THIS assertion's sentence was read, from the closed vocabulary identifier-token | clause-fallback | pronoun-carry | definitional-frame | reported-speech. Per assertion, never per triple: a later clean re-assertion of the same triple carries none. Absence means no findings were recorded, never that the sentence was checked and read cleanly" },
   { prop: "mgx:supersedes", note: "the record id(s) this one replaced when its own source re-asserted the triple with a newer embedded timestamp. A space-joined LIST; absent, never empty, until the first supersession" },
   { prop: "mgx:supersededBy", note: "the record id(s) that replaced this one. Its presence is what makes a record a demoted leaf rather than a live head, and the group fold skips it: a source's past belief is not a second vote for the present one. A LIST, because one source with two live replicas can fork before they sync" },
   { prop: "mgx:factQuantifier", note: "OPTIONAL: the quantifier word a plural class-membership teach used ('every'/'some'/'a few'), for literal recall by 'how many Xs are Ys' — never real cardinality counting" },
   { prop: "mgx:factJustification", note: "an entailed Fact's supporting premise fact ids: ' | '-separated environments, one space-separated premise-id list per independent derivation, capped by syllogise's maxEnvironments knob; a value with no ' | ' is a single environment" },
   { prop: "mgx:ruleName", note: "a taught Rule's own name (e.g. 'grandparent') — the query-dispatcher's lookup key, PLAN_TAUGHT_RELATIONS.md §2/§3" },
-  { prop: "mgx:ruleKind", note: "a taught Rule's SHAPE tag — the closed vocabulary compose2 | filter | recursive (structural, like 'Fact'/'Rule' themselves, never a domain word)" },
+  { prop: "mgx:ruleKind", note: "a taught Rule's SHAPE tag — the closed vocabulary compose2 | filter | recursive | action-signature | action-precond | action-effect | action-constraint (structural, like 'Fact'/'Rule' themselves, never a domain word)" },
   { prop: "mgx:ruleBase1", note: "compose2: the first hop's base relation name; filter: the base rule/relation being filtered (same 'base relation' role in both kinds, so the name is shared)" },
   { prop: "mgx:ruleBase2", note: "compose2 only: the second hop's base relation name" },
   { prop: "mgx:ruleFilterProperty", note: "filter only: the property literal candidates are filtered by (an mgx:hasProperty-shaped Fact lookup)" },
@@ -260,6 +265,9 @@ export function createInMemoryStore() {
 export function applySeedPayload(memoryDir, seedPayload) {
   if (!seedPayload) return;
   memoryDir.payload = { ...memoryDir.payload, ...seedPayload };
+  // A seed arrives from anywhere, so whatever an earlier load settled about the
+  // ids this store holds no longer describes it.
+  memoryDir.storeMigrationsSettled = false;
   stampStoreWrite(memoryDir);
 }
 
@@ -512,6 +520,18 @@ function backfillFactsProjection(db) {
 
 const individualAttr = (ind, prop) => (ind?.attributes || []).find((a) => a?.prop === prop)?.value || "";
 const individualKey = (ind, key) => (ind?.attributes || []).find((a) => a?.key === key)?.value || "";
+
+/** Order two strings by codepoint, never by locale. Every listing this store
+ *  hands out is read on whatever machine holds it, and two locales sorting one
+ *  set differently is the same broken promise arrival order would be: a read
+ *  over the fact store answers to the set, and to nothing about where it ran.
+ *  memory/fact-order.mjs states the rule; inspect.mjs keeps its own copy of
+ *  this comparator for the text it renders. */
+const byCodepoint = (a, b) => {
+  const ka = String(a ?? "");
+  const kb = String(b ?? "");
+  return ka < kb ? -1 : ka > kb ? 1 : 0;
+};
 const subjectPredicateKey = (subject, predicate) => `${subject}\u0000${predicate}`;
 
 // ---- Derived-local tables: `fact_heads` and `fact_object_supersessions` -----
@@ -808,11 +828,13 @@ export function wrapRowBackend(impl, {
     backend: BACKEND_ROW,
     impl,
     cachedPayload: null,
+    cachedIndex: null,
     basePayload: cloneMemoryPayload(basePayload),
     sqliteSeedStore,
     sqliteSeedOverlayRows: sqliteSeedOverlayRows ? [...sqliteSeedOverlayRows] : null,
     sqliteSeedKeyOrds: null,
     baseRows: null,
+    baseKeyOrds: null,
     storedRows: null,
     onOversizedRow,
     copyOnRead,
@@ -853,11 +875,8 @@ function overlayRows(baseRows, sessionRows) {
  *  session store does not already hold a row for. */
 function seedOnlyKeys(handle) {
   const sessionKeys = new Set(handle.storedRows.map((r) => r.rowKey));
-  const baseKeys = handle.sqliteSeedStore
-    ? sqliteSeedKeyOrds(handle).keys()
-    : handle.baseRows.map((r) => r.rowKey);
   const seedOnly = new Set();
-  for (const key of baseKeys) if (!sessionKeys.has(key)) seedOnly.add(key);
+  for (const key of readOnlyLayerKeyOrds(handle).keys()) if (!sessionKeys.has(key)) seedOnly.add(key);
   return seedOnly;
 }
 
@@ -935,8 +954,29 @@ function dropAssembledRowPayload(handle) {
   if (!isRowHandle(handle)) return;
   stampStoreWrite(handle);
   handle.cachedPayload = null;
+  handle.cachedIndex = null;
   handle.storedRows = null;
   handle.baseRows = null;
+  handle.baseKeyOrds = null;
+}
+
+/** Every key a READ-ONLY layer under this handle holds, with the ord each one
+ *  carries — the sqlite seed and its overlay, or the base payload's own
+ *  projection. A session row keyed the same as one of these SHADOWS it, so
+ *  deleting that session row brings the read-only row back rather than dropping
+ *  the individual: a rebuild is the only honest answer to that delete, and this
+ *  is what tells the write path so.
+ *
+ *  The ords are what let a write project the SESSION's rows alone and still put
+ *  a newly-keyed row past everything the read-only layer already holds. A key
+ *  and an integer per row is small where the rows themselves are not, so this is
+ *  held for the handle's life once a write has asked for it. */
+function readOnlyLayerKeyOrds(handle) {
+  if (handle.sqliteSeedStore) return sqliteSeedKeyOrds(handle);
+  if (!handle.baseKeyOrds) {
+    handle.baseKeyOrds = new Map((handle.baseRows || []).map((row) => [row.rowKey, ordOfRow(row)]));
+  }
+  return handle.baseKeyOrds;
 }
 
 /** A record with its audit stamp removed. `mgx:updatedAt` moves on every
@@ -969,13 +1009,17 @@ function movedBeyondAuditStamp(beforeRow, row) {
 async function persistRowPayload(handle, payload) {
   await ensureRowPayload(handle);
   const seedKeys = seedOnlyKeys(handle);
-  // On the sqlite path the seed is out of BOTH sides of the diff: the rows it
-  // holds are exactly the keys no write may touch, so projecting them would
+  // The seed is out of BOTH sides of the diff, whichever layer holds it: those
+  // keys are exactly the ones no write may touch, so projecting them would
   // materialize the whole seed only to filter every row of it back out.
-  const before = handle.sqliteSeedStore ? handle.storedRows : overlayRows(handle.baseRows, handle.storedRows);
+  const before = handle.storedRows;
   const beforeByKey = new Map(before.map((row) => [row.rowKey, row]));
-  const after = payloadToRows(handle.sqliteSeedStore ? payloadWithoutRowKeys(payload, seedKeys) : payload, {
-    priorRows: handle.sqliteSeedStore ? sqliteSeedPriorRows(handle) : before,
+  const after = payloadToRows(payloadWithoutRowKeys(payload, seedKeys), {
+    priorRows: before,
+    // The seed's ords are handed over as the map the handle already holds. The
+    // session's own rows come first, so a key both layers hold keeps the ord
+    // assembly gives it.
+    priorOrds: readOnlyLayerKeyOrds(handle),
     onOversizedRow: handle.onOversizedRow,
     ...(handle.log ? { log: handle.log } : {}),
   });
@@ -998,18 +1042,19 @@ async function persistRowPayload(handle, payload) {
   for (const row of writes) next.set(row.rowKey, row);
   handle.storedRows = [...next.values()];
   const meta = { memory: payload.memory, prefixes: payload.prefixes };
-  if (handle.sqliteSeedStore && !removals.length) {
-    patchAssembledPayload(handle.cachedPayload, meta, writes);
-  } else if (handle.sqliteSeedStore) {
-    handle.cachedPayload = null;
-    handle.cachedPayload = migrateStoredMemory(assembleSqliteSeededPayload(handle, meta));
-  } else {
-    // Dropped before the rebuild, not after it: the payload this replaces is the
-    // largest object the handle holds, and keeping it reachable while the next
-    // one assembles doubles the peak for no reason.
-    handle.cachedPayload = null;
-    handle.cachedPayload = migrateStoredMemory(rowsToPayload(overlayRows(handle.baseRows, handle.storedRows), { meta }));
+  if (patchAssembledPayload(handle.cachedPayload, meta, writes, removals, readOnlyLayerKeyOrds(handle))) {
+    patchStoreWideIndex(handle, writes, removals);
+    return;
   }
+  // Dropped before the rebuild, not after it: the payload this replaces is the
+  // largest object the handle holds, and keeping it reachable while the next
+  // one assembles doubles the peak for no reason. The index goes with it for
+  // the same reason — it names the arrays that payload owned.
+  handle.cachedPayload = null;
+  handle.cachedIndex = null;
+  handle.cachedPayload = migrateStoredMemory(handle.sqliteSeedStore
+    ? assembleSqliteSeededPayload(handle, meta)
+    : rowsToPayload(overlayRows(handle.baseRows, handle.storedRows), { meta }));
 }
 
 /** The payload minus a set of row keys, for a projection that must not spend
@@ -1093,15 +1138,6 @@ function sqliteSeedKeyOrds(handle) {
   return ords;
 }
 
-/** What `payloadToRows` reads off prior rows: the ord each key already carries,
- *  in the smallest row shape that carries one. The session's own rows come
- *  last, so a key both layers hold keeps the session's ord — the precedence
- *  assembly gives it. */
-function* sqliteSeedPriorRows(handle) {
-  for (const [rowKey, ord] of sqliteSeedKeyOrds(handle)) yield { rowKey, json: `{"ord":${ord}}` };
-  yield* handle.storedRows;
-}
-
 function* chainedRows(...sources) {
   for (const source of sources) yield* source;
 }
@@ -1118,28 +1154,50 @@ function assembleSqliteSeededPayload(handle, meta) {
   );
 }
 
-/** The assembled payload after a write that only added or rewrote rows, brought
- *  up to date without reading the seed again.
+/** The assembled payload after a write, brought up to date without reading the
+ *  seed again. Returns true when it did, false when this write is not patchable
+ *  and the caller has to rebuild — decided before anything is touched, so a
+ *  `false` leaves the payload exactly as it found it.
+ *
+ *  Why the positions work out for an ADDED or REWRITTEN row: a write only ever
+ *  carries session rows, and `payloadToRows` gives a newly-keyed row an ord past
+ *  every ord already assembled, so a new individual belongs at the tail and a
+ *  rewritten one belongs exactly where it already sits.
+ *
+ *  Why they work out for a REMOVED one: dropping an individual from the
+ *  assembled array would drop it from wherever the fact ordering moved it to,
+ *  which is a different slot from the one it held in row order — so the drop
+ *  goes through the row order the assembly carries (`dropAssembledIndividuals`)
+ *  and the array is refilled in that order first. The slots that survive are
+ *  then the ones the surviving ROWS own, which is what a rebuild would leave.
  *
- *  Why the positions work out: a write only ever carries session rows, and
- *  `payloadToRows` gives a newly-keyed row an ord past every ord already
- *  assembled, so a new individual belongs at the tail and a rewritten one
- *  belongs exactly where it already sits. Both are where a rebuild from the
- *  same rows would put them, and the fact set is unchanged or grown, so the
- *  fact ordering `renormalizeAssembledPayload` reapplies lands the same way.
- *  Everything the payload derives goes through that one function, the same one
- *  `rowsToPayload` itself ends on, so a patched payload and a rebuilt one
- *  cannot drift apart.
+ *  Either way everything the payload derives goes through
+ *  `renormalizeAssembledPayload`, the same function `rowsToPayload` itself ends
+ *  on, so a patched payload and a rebuilt one cannot drift apart.
  *
- *  A REMOVAL is not patchable this way and does not come here: dropping an
- *  individual from the assembled array drops it from wherever the fact ordering
- *  moved it to, which is a different position from the one it occupied in row
- *  order, and every fact after it shifts. `persistRowPayload` rebuilds for those.
- *  Mutates and returns `payload`. */
-function patchAssembledPayload(payload, meta, writes) {
+ *  `readOnlyKeys` are the keys a layer under the session holds: deleting a
+ *  session row that SHADOWS one of them uncovers the read-only row rather than
+ *  dropping the individual, which only a rebuild can work out.
+ *
+ *  On `false` the caller replaces this payload with a fresh assembly, so
+ *  whatever this got part-way through applying is discarded with it. */
+function patchAssembledPayload(payload, meta, writes, removals, readOnlyKeys) {
+  const droppedGroups = new Set();
+  const droppedIndividuals = new Set();
+  for (const key of removals) {
+    const rowKey = String(key);
+    if (readOnlyKeys.has(rowKey)) return false;
+    if (rowKey.startsWith(EDGE_GROUP_KEY_PREFIX)) droppedGroups.add(rowKey.slice(EDGE_GROUP_KEY_PREFIX.length));
+    else droppedIndividuals.add(rowKey);
+  }
+  if (droppedIndividuals.size && !canDropAssembledIndividuals(payload, droppedIndividuals)) return false;
+
   payload.memory = meta.memory;
   payload.prefixes = meta.prefixes;
-  if (!writes.length) return renormalizeAssembledPayload(payload);
+  if (!writes.length && !removals.length) {
+    renormalizeAssembledPayload(payload);
+    return true;
+  }
 
   const individualPositions = new Map();
   for (let i = 0; i < payload.individuals.length; i += 1) individualPositions.set(payload.individuals[i]?.id, i);
@@ -1165,9 +1223,16 @@ function patchAssembledPayload(payload, meta, writes) {
     if (at === undefined) {
       individualPositions.set(individual.id, payload.individuals.length);
       payload.individuals.push(individual);
+      appendAssembledRowOrder(payload, individual.id);
     } else payload.individuals[at] = individual;
   }
-  return renormalizeAssembledPayload(payload);
+
+  if (droppedGroups.size) {
+    payload.objectProperties = payload.objectProperties.filter((group) => !droppedGroups.has(group?.prop));
+  }
+  if (droppedIndividuals.size && !dropAssembledIndividuals(payload, droppedIndividuals)) return false;
+  renormalizeAssembledPayload(payload);
+  return true;
 }
 
 /** Every distinct subject and object a seed store's facts carry, off the
@@ -1285,8 +1350,11 @@ function readSqlitePayload(handle) {
   if (handle.cachedPayload && handle.cachedDataVersion !== dataVersion) {
     // Another connection committed, so the fold this handle holds describes a
     // store that no longer exists — it goes with the payload it was taken of.
+    // So does what an earlier load settled about the ids the store carries: the
+    // other writer is the one path that can put a shape there this one wouldn't.
     stampStoreWrite(handle);
     handle.cachedPayload = null;
+    handle.storeMigrationsSettled = false;
   }
   if (!handle.cachedPayload) {
     handle.cachedPayload = buildSqlitePayloadFromRows(handle);
@@ -1402,8 +1470,10 @@ function cacheDropGroups(cache, droppedProps) {
 const EDGE_GROUP_ROW_CLASS = "edge-group";
 const EDGE_GROUP_KEY_PREFIX = "edge-group:";
 
+const FACT_ROW_CLASS = "fact";
+
 const ROW_CLASS_BY_INDIVIDUAL_CLASS = new Map([
-  [FACT_CLASS, "fact"],
+  [FACT_CLASS, FACT_ROW_CLASS],
   [SOURCE_CLASS, "source"],
   [UTTERANCE_CLASS, "utterance"],
   [MEMORY_SESSION_CLASS, "session"],
@@ -2007,8 +2077,8 @@ export async function snapshotMemory(dir, { retentionVersions } = {}) {
  *  append creates the file). The result is a raw entities payload;
  *  parseEntities() loads it. */
 export async function loadMemory(dir) {
-  if (isMemoryHandle(dir)) return migrateStoredMemory(dir.payload);
-  if (isSqliteHandle(dir)) return migrateStoredMemory(readSqlitePayload(dir));
+  if (isMemoryHandle(dir)) return migrateStoredMemoryOnce(dir, dir.payload);
+  if (isSqliteHandle(dir)) return migrateStoredMemoryOnce(dir, readSqlitePayload(dir));
   // Not migrated here: a row handle migrates the payload once, as it assembles
   // it, so every read after the first is spared two walks of the whole graph.
   if (isRowHandle(dir)) return readRowPayload(dir);
@@ -2027,6 +2097,30 @@ export async function loadMemory(dir) {
  *  Both are pure payload transforms and both converge to no-ops. */
 const migrateStoredMemory = (payload) => migrateFactAssertionKeys(migrateLegacyFactIds(payload));
 
+/** True when some Fact still carries an id from before one of the two
+ *  migrations above — a pre-widening 32-bit id, or a pre-assertion-model id
+ *  keyed on the triple alone. Both lack the `@` a record id carries, so one
+ *  pass over the individuals answers it, allocating nothing. */
+function carriesPreMigrationFactIds(payload) {
+  for (const ind of payload?.individuals || []) {
+    if (ind?.class === FACT_CLASS && !String(ind.id || "").includes("@")) return true;
+  }
+  return false;
+}
+
+/** `migrateStoredMemory` for a handle that hands back the same store on every
+ *  read. A store whose Facts are all on current ids cannot acquire an old one —
+ *  every write mints through `factIdFor` — so the first load that finds nothing
+ *  to migrate settles the question for this handle and later loads skip even
+ *  the scan. A store that IS on old ids keeps migrating on every read until a
+ *  write persists the healed form, exactly as before. */
+function migrateStoredMemoryOnce(handle, payload) {
+  if (handle.storeMigrationsSettled) return payload;
+  if (carriesPreMigrationFactIds(payload)) return migrateStoredMemory(payload);
+  handle.storeMigrationsSettled = true;
+  return payload;
+}
+
 // A Fact id written before factIdFor widened to 64 bits — `fact:` + exactly 8
 // hex. A current id is 16 hex, so this anchored test never matches one, and a
 // migrated store pays only string checks with no rehash on load.
@@ -2054,6 +2148,9 @@ function migrateLegacyFactIds(payload) {
     ind.id = currentId;
   }
   if (!remap.size) return payload;
+  // The row order an assembly carries names the ids the rows arrived under, and
+  // this just moved every legacy Fact off one of them.
+  dropAssembledRowOrder(payload);
   const remapId = (id) => remap.get(id) || id;
   for (const group of payload.objectProperties || []) {
     for (const e of group.examples || []) {
@@ -2309,49 +2406,200 @@ export async function saveNodeId(dir, nodeId) {
  *  append goes through here, including the lazy legacy-provenance migration
  *  and actor-level Source reliability recompute. `fn` may be async (the
  *  SHACL ingest gate awaits validation before ever mutating `payload`). */
-// Per-call lookup index (individualsById/sourcesById/statedByBySubject),
-// attached to payload under a Symbol key (skipped by JSON.stringify) so
-// upsertIndividual/upsertSource/upsertEdge/appendFacts get O(1) lookups
-// instead of re-scanning; discarded when mutateMemory returns.
+// Per-call lookup index, attached to payload under a Symbol key (skipped by
+// JSON.stringify) so upsertIndividual/upsertSource/upsertEdge/appendFacts get
+// O(1) lookups instead of re-scanning; discarded when mutateMemory returns. On
+// a row handle the two id -> id-list halves read through a base the handle
+// keeps across writes (storeWideIndexOf), so only the three that hold
+// individuals are built per call.
 const MEMORY_INDEX = Symbol("mutateMemory lookup index");
 
-/** Build the three lookup Maps from the just-loaded payload and attach them
- *  under MEMORY_INDEX. */
-function buildMemoryIndex(payload) {
+/** Build the five lookup Maps from the just-loaded payload and attach them
+ *  under MEMORY_INDEX.
+ *
+ *  `base` is a store-wide index a row handle keeps across writes
+ *  (`storeWideIndexOf`). Its two maps are layered rather than rebuilt: this
+ *  mutation reads through them and writes only into its own layer, so the
+ *  handle's copy still describes the store when the mutation is over — or when
+ *  it throws. The other three hold INDIVIDUALS, and every individual this
+ *  mutation can reach is a fresh copy `mutablePayloadCopy` just made, so they
+ *  are always this payload's own. */
+function buildMemoryIndex(payload, base = null) {
   const individualsById = new Map();
   const sourcesById = new Map();
-  const statedByBySubject = new Map();
-  // groupId -> the record ids asserting that triple, so a write can ask "is
-  // anyone asserting this yet" and an edge can resolve a group id to the real
-  // nodes behind it, both without a scan.
-  const factRecordsByGroup = new Map();
   // groupId -> the retraction records standing over that triple, so the write
   // path can ask "was this source's assertion retracted" without a scan. Almost
   // always empty, which is why it is read before anything more expensive.
   const retractionsByGroup = new Map();
+  // groupId -> the record ids asserting that triple, so a write can ask "is
+  // anyone asserting this yet" and an edge can resolve a group id to the real
+  // nodes behind it, both without a scan.
+  const factRecordsByGroup = base ? new LayeredIdListMap(base.factRecordsByGroup) : new Map();
+  const statedByBySubject = base ? new LayeredIdListMap(base.statedByBySubject) : new Map();
   for (const ind of payload.individuals || []) {
     if (!ind?.id) continue;
     individualsById.set(ind.id, ind);
     if (ind.class === SOURCE_CLASS) sourcesById.set(ind.id, ind);
     if (ind.class === RETRACTION_CLASS) indexRetraction(retractionsByGroup, ind);
-    if (ind.class === FACT_CLASS) {
+    if (!base && ind.class === FACT_CLASS) {
       const groupId = factGroupId(ind.id);
       const held = factRecordsByGroup.get(groupId);
       if (held) held.push(ind.id);
       else factRecordsByGroup.set(groupId, [ind.id]);
     }
   }
-  const statedGroup = (payload.objectProperties || []).find((g) => g?.prop === STATED_BY_PROP);
-  for (const e of statedGroup?.examples || []) {
-    if (!e?.subject) continue;
-    const list = statedByBySubject.get(e.subject);
-    if (list) list.push(e.object);
-    else statedByBySubject.set(e.subject, [e.object]);
+  if (!base) {
+    const statedGroup = (payload.objectProperties || []).find((g) => g?.prop === STATED_BY_PROP);
+    for (const e of statedGroup?.examples || []) {
+      if (!e?.subject) continue;
+      const list = statedByBySubject.get(e.subject);
+      if (list) list.push(e.object);
+      else statedByBySubject.set(e.subject, [e.object]);
+    }
   }
   payload[MEMORY_INDEX] = { individualsById, sourcesById, statedByBySubject, factRecordsByGroup, retractionsByGroup };
   return payload[MEMORY_INDEX];
 }
 
+/** File one id under a key in an id -> id-list map the WRITE path holds, plain
+ *  or layered. Idempotent, so a map answering from a layer below cannot start
+ *  disagreeing with one answering from its own entry. */
+function fileIdUnderKey(map, key, id) {
+  if (map.push) { map.push(key, id); return; }
+  const held = map.get(key);
+  if (!held) map.set(key, [id]);
+  else if (!held.includes(id)) held.push(id);
+}
+
+/** An id -> id-list map read through a base map this layer may never change.
+ *  A key this layer has touched answers from its own entry, everything else
+ *  from the base, and `push` copies the base's list before adding to it — so
+ *  the base keeps the lists it had however the mutation ends. Copy-on-write at
+ *  the one granularity the write path mutates.
+ *
+ *  Only `get` and the three writers exist. Nothing folds either of the two maps
+ *  this covers, and a layered map cannot answer `size` or an iteration without
+ *  merging both layers, which is the walk the layering exists to avoid. */
+class LayeredIdListMap {
+  #base;
+  #own = new Map();
+
+  constructor(base) { this.#base = base; }
+
+  get(key) {
+    const own = this.#own.get(key);
+    if (own !== undefined) return own === null ? undefined : own;
+    return this.#base.get(key);
+  }
+
+  set(key, ids) { this.#own.set(key, ids); }
+
+  /** A tombstone rather than a removal: the base still holds the key, and this
+   *  layer is what says the mutation dropped it. */
+  delete(key) { this.#own.set(key, null); }
+
+  push(key, id) {
+    const held = this.get(key);
+    if (!held) this.#own.set(key, [id]);
+    else if (!held.includes(id)) this.#own.set(key, [...held, id]);
+  }
+}
+
+/** The two halves of the lookup index a ROW handle keeps across writes, beside
+ *  the assembled payload they describe. Both map an id to a list of ids, so
+ *  neither can hand a mutation an individual the cache also holds — that is
+ *  what makes them reusable where `individualsById` is not, since
+ *  `mutablePayloadCopy` gives every individual a new identity per mutation.
+ *
+ *  Each half is guarded on the identity of the container it was read from. An
+ *  individuals array or a statedBy examples list that was REPLACED describes a
+ *  different graph, so the half built from it is built again. That covers every
+ *  rebuild path at once: a fresh assembly, a payload dropped after a failed
+ *  write, and a patch that had to fall back to reassembling from rows.
+ *
+ *  The fact half also survives a write that keeps the same array, because
+ *  `patchStoreWideIndex` applies that write's own row delta to it. The statedBy
+ *  half needs no such patch: a write that changes an edge group rewrites the
+ *  group row, and the assembled payload takes a fresh examples array from it,
+ *  which the guard sees. */
+function storeWideIndexOf(handle) {
+  const payload = handle.cachedPayload;
+  if (!payload) return null;
+  let held = handle.cachedIndex;
+  if (!held) {
+    held = { individuals: null, factRecordsByGroup: null, statedByExamples: null, statedByBySubject: null };
+    handle.cachedIndex = held;
+  }
+  if (!held.factRecordsByGroup || held.individuals !== payload.individuals) {
+    const factRecordsByGroup = new Map();
+    for (const ind of payload.individuals || []) {
+      if (!ind?.id || ind.class !== FACT_CLASS) continue;
+      const groupId = factGroupId(ind.id);
+      const group = factRecordsByGroup.get(groupId);
+      if (group) group.push(ind.id);
+      else factRecordsByGroup.set(groupId, [ind.id]);
+    }
+    held.factRecordsByGroup = factRecordsByGroup;
+    held.individuals = payload.individuals;
+  }
+  const examples = (payload.objectProperties || []).find((g) => g?.prop === STATED_BY_PROP)?.examples || null;
+  if (!held.statedByBySubject || held.statedByExamples !== examples) {
+    const statedByBySubject = new Map();
+    for (const e of examples || []) {
+      if (!e?.subject) continue;
+      const stated = statedByBySubject.get(e.subject);
+      if (stated) stated.push(e.object);
+      else statedByBySubject.set(e.subject, [e.object]);
+    }
+    held.statedByBySubject = statedByBySubject;
+    held.statedByExamples = examples;
+  }
+  return held;
+}
+
+/** Bring the store-wide fact half up to the write that just landed, from the
+ *  row delta the write itself carried. A row key IS the individual's id and the
+ *  row class says whether it is a Fact, so this reads the same delta
+ *  `patchAssembledPayload` applied to the payload and parses none of it.
+ *
+ *  Only called where that patch SUCCEEDED. A write that had to rebuild replaces
+ *  the individuals array, and the guard in `storeWideIndexOf` builds the half
+ *  again rather than trusting this. */
+function patchStoreWideIndex(handle, writes, removals) {
+  const cached = handle.cachedIndex;
+  if (!cached?.factRecordsByGroup) return;
+  const factRecordsByGroup = cached.factRecordsByGroup;
+  for (const key of removals) {
+    const id = String(key);
+    if (id.startsWith(EDGE_GROUP_KEY_PREFIX)) continue;
+    const groupId = factGroupId(id);
+    const kept = (factRecordsByGroup.get(groupId) || []).filter((recordId) => recordId !== id);
+    if (kept.length) factRecordsByGroup.set(groupId, kept);
+    else factRecordsByGroup.delete(groupId);
+  }
+  for (const row of writes) {
+    if (row.rowClass !== FACT_ROW_CLASS) continue;
+    const id = String(row.rowKey);
+    fileRecordIdInGroupOrder(factRecordsByGroup, factGroupId(id), id);
+  }
+  cached.individuals = handle.cachedPayload.individuals;
+}
+
+/** File a record id under its group where a REBUILD would put it. A group's
+ *  records sit in codepoint order on their ids in the assembled payload —
+ *  `sortFactIndividualsById` puts them there — so a build over that payload
+ *  reads them in that order. Appending in arrival order instead would leave the
+ *  carried map holding one order and a rebuild another, and every reader of the
+ *  list would then answer by which write came first. */
+function fileRecordIdInGroupOrder(factRecordsByGroup, groupId, id) {
+  const held = factRecordsByGroup.get(groupId);
+  if (!held) { factRecordsByGroup.set(groupId, [id]); return; }
+  if (held.includes(id)) return;
+  let at = 0;
+  while (at < held.length && held[at] < id) at += 1;
+  held.splice(at, 0, id);
+}
+
 /** File one retraction record under the triple it stands over, replacing any
  *  earlier reference to the same id — upsertIndividual merges in place, so the
  *  index must hold the record the payload holds, not a stale copy of it. */
@@ -2394,9 +2642,13 @@ async function mutateMemory(dir, fn) {
   // fold taken of it the moment `fn` starts changing it.
   stampStoreWrite(dir);
   try {
-    buildMemoryIndex(payload);
+    const layered = buildMemoryIndex(payload, overRowHandle ? storeWideIndexOf(dir) : null);
     const out = (await fn(payload)) ?? payload;
     migrateLegacyProvenance(out);
+    // The legacy-provenance migration re-keys records wholesale and indexes the
+    // result from scratch, so the ids the handle's own index names are no longer
+    // the store's. It goes rather than being reconciled against a re-key.
+    if (overRowHandle && memoryIndexOf(out) !== layered) dir.cachedIndex = null;
     recomputeSourceReliability(out);
     if (!overRowHandle) renormalizeProseIndex(out);
     await persistMemory(dir, out);
@@ -2762,12 +3014,7 @@ function upsertIndividual(payload, ind) {
     payload.individuals.push(ind);
     idx.individualsById.set(ind.id, ind);
     if (ind.class === RETRACTION_CLASS) indexRetraction(idx.retractionsByGroup, ind);
-    if (ind.class === FACT_CLASS) {
-      const groupId = factGroupId(ind.id);
-      const held = idx.factRecordsByGroup.get(groupId);
-      if (held) held.push(ind.id);
-      else idx.factRecordsByGroup.set(groupId, [ind.id]);
-    }
+    if (ind.class === FACT_CLASS) fileIdUnderKey(idx.factRecordsByGroup, factGroupId(ind.id), ind.id);
     return ind;
   }
   const i = payload.individuals.findIndex((x) => x?.id === ind.id);
@@ -2803,8 +3050,7 @@ function upsertEdge(payload, { predicate, prop }, edge) {
     if (!existing || !existing.includes(edge.object)) {
       group.examples.push({ ...edge, createdAt: edge.createdAt || nowIso() });
       group.count = group.examples.length;
-      if (existing) existing.push(edge.object);
-      else idx.statedByBySubject.set(edge.subject, [edge.object]);
+      fileIdUnderKey(idx.statedByBySubject, edge.subject, edge.object);
       return;
     }
     // Rare re-assert of the exact same (subject,object) pair — fall through
@@ -2821,11 +3067,7 @@ function upsertEdge(payload, { predicate, prop }, edge) {
   );
   group.examples.push({ ...edge, createdAt });
   group.count = group.examples.length;
-  if (idx) {
-    const list = idx.statedByBySubject.get(edge.subject) || [];
-    if (!list.includes(edge.object)) list.push(edge.object);
-    idx.statedByBySubject.set(edge.subject, list);
-  }
+  if (idx) fileIdUnderKey(idx.statedByBySubject, edge.subject, edge.object);
 }
 
 /** Recount `classes[]` from the individuals — every memory class stays counted
@@ -3638,7 +3880,7 @@ export function findRulesByName(memory, name) {
   return (memory?.individuals || [])
     .filter((i) => i?.class === RULE_CLASS
       && (i.attributes || []).find((a) => a?.prop === RULE_NAME_PROP)?.value === n)
-    .sort((a, b) => kindOf(a).localeCompare(kindOf(b)) || String(a.id).localeCompare(String(b.id)));
+    .sort((a, b) => byCodepoint(kindOf(a), kindOf(b)) || byCodepoint(a.id, b.id));
 }
 
 /** Every taught Rule as a plain row {id, name, kind, slots, provenance} —
@@ -3663,8 +3905,7 @@ export function readRuleRows(memory) {
       provenance: attr("mgx:factProvenance") || "",
     });
   }
-  rows.sort((a, b) => a.name.localeCompare(b.name)
-    || a.kind.localeCompare(b.kind) || String(a.id).localeCompare(String(b.id)));
+  rows.sort((a, b) => byCodepoint(a.name, b.name) || byCodepoint(a.kind, b.kind) || byCodepoint(a.id, b.id));
   return rows;
 }
 
@@ -3918,7 +4159,15 @@ export async function foldedFactRows(dir) {
 /** The fold itself, over whatever slice of the graph a context was built for.
  *  `readFactRows` hands it the whole graph; a caller that only needs certain
  *  (subject, predicate) pairs hands it a scoped context and gets exactly the
- *  rows a whole-graph fold would have produced for those pairs. */
+ *  rows a whole-graph fold would have produced for those pairs.
+ *
+ *  The rows come out in content order, not in the order the payload happened to
+ *  hold them. A reader that takes the first of several equally-ranked rows, or
+ *  sorts by a key that ties, otherwise answers by arrival order — and two peers
+ *  holding one fact set arrive at it differently. Sorting here is what lets a
+ *  reader inherit the guarantee instead of re-earning it: the fold is the one
+ *  place every fact read passes through. p2p-room.mjs's sortFactIndividualsById
+ *  does the same job one level down, over the stored records. */
 function foldFactRows(memory, ctx, opts = {}) {
   // A materialised head, when the backend keeps one, replaces the group's own
   // fold with the audit trail that fold was last built from — the same records,
@@ -3936,6 +4185,54 @@ function foldFactRows(memory, ctx, opts = {}) {
     row.trust = computeAssertionGroupTrust(head ? head.inputs : row.assertions, opts).score;
     rows.push(row);
   }
+  // Each row's key is built once rather than on every comparison. Handing
+  // compareFactsByContent straight to sort rebuilds both keys per comparison,
+  // and a sort makes O(n log n) of them, which on a large store costs several
+  // times what building one key per row does — and this is the fold every fact
+  // read goes through. The order is the one that comparator defines, and a test
+  // holds the two to the same answer.
+  const keyed = rows.map((row) => ({ key: factOrderKey(row), row }));
+  keyed.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+  return attachSpeakers(keyed.map((entry) => entry.row));
+}
+
+// What every fact id starts with, and nothing a source ever writes as a term:
+// the prefix factIdFor mints and normFactTerm's carve-out keeps whole.
+const FACT_ID_PREFIX = "fact:";
+
+/** Hangs each attributed claim's speakers on the claim's own row, as
+ *  `attributedTo` — absent, never empty, the same way `extraction` is.
+ *
+ *  A report's claim and the speaker it was attributed to are two rows: the
+ *  claim, and `fact:<claimId> | mgx:attributedTo | <speaker>` beside it. A
+ *  surface that cannot render the attribution must not render the claim, so
+ *  resolving the pair belongs here rather than in each reader — the fold is the
+ *  one place every fact read passes through, and a reader that renders a row
+ *  inherits its speaker without asking for it.
+ *
+ *  news-feed.mjs's partitionAttributions owns which rows are attributions and
+ *  how one claim's speakers are ordered; only its map is wanted here, because a
+ *  fold hides no row from its readers — the news card suppresses attributions
+ *  from its own lanes, the store still holds and reads them.
+ *
+ *  Pure: the speakers come back sorted, so a claim two outlets attributed reads
+ *  the same whichever order the attributions arrived in, and an attribution
+ *  whose claim the fold never saw simply hangs on nothing — which is the case
+ *  every time rows arrive over p2p out of order. */
+function attachSpeakers(rows) {
+  // An attribution names its claim as its SUBJECT, and a claim's own subject is
+  // a term, so the prefix rules nearly every row out on one comparison. The
+  // fold is the hottest fact read there is, and the full test costs two
+  // lowercased copies and two regexes per row — on a store no report has ever
+  // written to, that is the whole price of a feature it does not use.
+  const referring = rows.filter((row) => row.subject.startsWith(FACT_ID_PREFIX));
+  if (!referring.length) return rows;
+  const { speakersByClaimId } = partitionAttributions(referring);
+  if (!speakersByClaimId.size) return rows;
+  for (const row of rows) {
+    const speakers = speakersByClaimId.get(row.id);
+    if (speakers?.length) row.attributedTo = speakers;
+  }
   return rows;
 }
 
@@ -4240,6 +4537,26 @@ function recordSourceIdOf(record) {
   return hash < 0 ? rest : rest.slice(0, hash);
 }
 
+/** The triples that name any of `goneGroupIds` in a TERM rather than through an
+ *  edge, as group ids — what a retraction has to take with it, because an
+ *  objectProperties scrub cannot see a fact id sitting in an attribute value.
+ *
+ *  The whole group comes back, not the matching record: an attribution two
+ *  outlets both wrote is one triple with two records, and retracting the claim
+ *  under it leaves neither of them anything to be about. A term is only ever a
+ *  reference when it is a fact id, so membership in the gone set IS the test —
+ *  no term a source writes can collide with one. */
+function factGroupsReferencing(payload, goneGroupIds) {
+  const groups = new Set();
+  for (const ind of payload?.individuals || []) {
+    if (ind?.class !== FACT_CLASS) continue;
+    const subject = individualAttr(ind, "rdf:subject");
+    const object = individualAttr(ind, "rdf:object");
+    if (goneGroupIds.has(subject) || goneGroupIds.has(object)) groups.add(factGroupId(ind.id));
+  }
+  return groups;
+}
+
 /** Retract facts by id — a real DELETE (syllogise.mjs's retractability
  *  mechanism). A GROUP id retracts the triple: every source's record for it,
  *  demoted leaves included, since retracting "dogs bark" cannot leave half its
@@ -4254,9 +4571,16 @@ function recordSourceIdOf(record) {
  *  keeps the retraction on record rather than erasing the fact that something
  *  was asserted at all. A retraction record is never itself removed here.
  *
+ *  A triple retracted WHOLE takes the triples that name it with it, through
+ *  factGroupsReferencing above — the reified attribution beside a report's
+ *  claim is the live case, and the edge scrub cannot reach it. While any
+ *  source's record for a triple still stands the claim does too, so nothing
+ *  cascades off a single retracted record.
+ *
  *  Returns { removed, records } — `removed` the ids asked for that matched, so
  *  it may be smaller than the input and is never longer than it; `records` the
- *  concrete record ids that went, which is what the retraction absorbed. */
+ *  concrete record ids that went, cascaded ones included, which is what the
+ *  retraction absorbed. */
 export async function removeFacts(dir, ids, { provenance = "", retractedAt = "" } = {}) {
   const idSet = new Set((ids || []).filter(Boolean));
   const removed = [];
@@ -4267,12 +4591,7 @@ export async function removeFacts(dir, ids, { provenance = "", retractedAt = ""
     const removedSet = new Set();
     const matched = new Set();
     const retiredByGroupAndSource = new Map(); // `${groupId}${sourceId}` -> { groupId, sourceId, ids, template }
-    payload.individuals = (payload.individuals || []).filter((ind) => {
-      if (ind?.class !== FACT_CLASS) return true;
-      const groupId = factGroupId(ind.id);
-      const asked = idSet.has(ind.id) ? ind.id : (idSet.has(groupId) ? groupId : "");
-      if (!asked) return true;
-      matched.add(asked);
+    const retire = (ind, groupId) => {
       removedSet.add(ind.id);
       const sourceId = recordSourceIdOf(ind);
       const key = `${groupId}${sourceId}`;
@@ -4299,8 +4618,36 @@ export async function removeFacts(dir, ids, { provenance = "", retractedAt = ""
           },
         });
       }
-      return false;
-    });
+    };
+
+    // Round one takes the ids asked for; every round after it takes whatever
+    // the last one left pointing at a triple that is now gone. A reference to a
+    // reference would need a third round, so the loop runs until a round finds
+    // nothing rather than assuming one hop.
+    let asking = idSet;
+    let cascading = false;
+    while (asking.size) {
+      const standingGroups = new Set();
+      const emptiedGroups = new Set();
+      payload.individuals = (payload.individuals || []).filter((ind) => {
+        if (ind?.class !== FACT_CLASS) return true;
+        const groupId = factGroupId(ind.id);
+        const asked = asking.has(ind.id) ? ind.id : (asking.has(groupId) ? groupId : "");
+        if (!asked) {
+          standingGroups.add(groupId);
+          return true;
+        }
+        // Only the caller's own ids answer for what it asked; a cascade is this
+        // call's consequence, not part of the request.
+        if (!cascading) matched.add(asked);
+        emptiedGroups.add(groupId);
+        retire(ind, groupId);
+        return false;
+      });
+      const gone = [...emptiedGroups].filter((groupId) => !standingGroups.has(groupId));
+      asking = gone.length ? factGroupsReferencing(payload, new Set(gone)) : new Set();
+      cascading = true;
+    }
     for (const id of matched) removed.push(id);
     if (!removed.length) return; // honest no-op — nothing matched, no write needed beyond this
     for (const id of removedSet) records.push(id);
@@ -4464,7 +4811,7 @@ export function findContradictions(memory, { floor = CONTRADICTION_TRUST_FLOOR,
   const byKey = new Map();
   for (const r of rows) {
     if (resolutionStrategyFor(r.predicate) === RESOLUTION_MERGE) continue;
-    const key = `${r.subject} ${r.predicate}`;
+    const key = subjectPredicateKey(r.subject, r.predicate);
     if (!byKey.has(key)) byKey.set(key, []);
     byKey.get(key).push(r);
   }
@@ -4473,7 +4820,10 @@ export function findContradictions(memory, { floor = CONTRADICTION_TRUST_FLOOR,
     if (new Set(group.map((r) => r.object)).size < 2) continue;
     const strategy = resolutionStrategyFor(group[0].predicate);
     if (strategy !== RESOLUTION_CONTRADICTION && !resolveSiblingGroups(group, strategy).contested) continue;
-    out.push(group.slice().sort((a, b) => b.trust - a.trust || a.object.localeCompare(b.object)));
+    out.push(group.slice().sort((a, b) => b.trust - a.trust || byCodepoint(a.object, b.object)));
   }
-  return out.sort((a, b) => `${a[0].subject} ${a[0].predicate}`.localeCompare(`${b[0].subject} ${b[0].predicate}`));
+  return out.sort((a, b) => byCodepoint(
+    subjectPredicateKey(a[0].subject, a[0].predicate),
+    subjectPredicateKey(b[0].subject, b[0].predicate),
+  ));
 }