@remnic/core 9.3.699 → 9.3.701

package/dist/{chunk-RIC5U67B.js → chunk-SFMRLXIV.js}

@@ -1,3 +1,8 @@
+import {
+  TombstoneStore,
+  buildRetiredFactTombstoneInputs,
+  collectRetiredMemoriesForRebuild
+} from "./chunk-3JJWNZTT.js";
 import {
   WEARABLES_DIR_NAME,
   isValidTranscriptDate
@@ -8,6 +13,9 @@ import {
 import {
   assertPathInsideRoot
 } from "./chunk-5GPPACXK.js";
+import {
+  supersessionKeysForFact
+} from "./chunk-OMNTQPZO.js";
 import {
   stripAttributesSuffix
 } from "./chunk-SVOZFLIQ.js";
@@ -19,7 +27,7 @@ import {
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-ZXUOAFUG.js";
+} from "./chunk-IKNQAGBV.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -257,6 +265,8 @@ function serializeFrontmatter(fm) {
     lines.push(`lineage: [${fm.lineage.map((l) => `"${l}"`).join(", ")}]`);
   }
   if (fm.status && fm.status !== "active") lines.push(`status: ${fm.status}`);
+  if (fm.blockedBy) lines.push(`blockedBy: ${fm.blockedBy}`);
+  if (fm.tombstoneBlockTier) lines.push(`tombstoneBlockTier: ${fm.tombstoneBlockTier}`);
   if (fm.supersededBy) lines.push(`supersededBy: ${fm.supersededBy}`);
   if (fm.supersededAt) lines.push(`supersededAt: ${fm.supersededAt}`);
   if (fm.archivedAt) lines.push(`archivedAt: ${fm.archivedAt}`);
@@ -615,6 +625,9 @@ function parseFrontmatter(raw) {
       lineage: lineage && lineage.length > 0 ? lineage : void 0,
       // Status management
       status: fm.status || "active",
+      // Tombstone block visibility (issue #1579) — read-through.
+      blockedBy: fm.blockedBy || void 0,
+      tombstoneBlockTier: fm.tombstoneBlockTier === "exact" || fm.tombstoneBlockTier === "normalized" || fm.tombstoneBlockTier === "keyed" || fm.tombstoneBlockTier === "semantic" ? fm.tombstoneBlockTier : void 0,
       supersededBy: fm.supersededBy || void 0,
       supersededAt: fm.supersededAt || void 0,
       archivedAt: fm.archivedAt || void 0,
@@ -1751,6 +1764,13 @@ var StorageManager = class _StorageManager {
     } catch {
     }
   }
+  // ── Tombstone store (issue #1579) ───────────────────────────────────────
+  // Instance-scoped (rule 11) + namespace-scoped (rule 42) tombstone index.
+  // Lazily loaded from <stateDir>/tombstones.jsonl; invalidated together with
+  // every other cache layer via invalidateAllMemoriesCache (rule 25).
+  tombstoneStore = null;
+  tombstoneStoreLoadPromise = null;
+  tombstonesConfig = { enabled: false, semanticMatch: false, semanticThreshold: 0.9, namespace: "default" };
   /** Page-versioning configuration.  Set by the orchestrator after construction. */
   _versioningConfig = null;
   /** Set the page-versioning configuration.  When `enabled` is false (default), all versioning calls are no-ops. */
@@ -2048,13 +2068,17 @@ var StorageManager = class _StorageManager {
    * Promote a pending_review wearable memory to active in place,
    * merging updated trust evidence into structuredAttributes. Returns
    * false when the memory is missing or no longer pending_review (a
-   * concurrent review decision wins).
+   * concurrent review decision wins), or when the row is tombstone-blocked
+   * (`blockedBy` — issue #1579 threads OcuDx/Ocu1l): writeMemoryFrontmatter
+   * bypasses the writeMemory chokepoint, so a blocked row must first be
+   * cleared via revokeTombstone before promotion can proceed.
    */
   async promoteWearableMemory(id, attributeUpdates, confidence) {
     const memories = await this.readAllMemories();
     const memory = memories.find((entry) => entry.frontmatter.id === id);
     if (!memory) return false;
     if (memory.frontmatter.status !== "pending_review") return false;
+    if (memory.frontmatter.blockedBy) return false;
     return this.writeMemoryFrontmatter(memory, {
       status: "active",
       // Keep frontmatter confidence in step with the re-scored trust —
@@ -2361,6 +2385,139 @@ var StorageManager = class _StorageManager {
   get factHashIndexReadyPath() {
     return path.join(this.stateDir, "fact-hashes.ready");
   }
+  // ── Tombstone store access (issue #1579) ─────────────────────────────────
+  /**
+   * The on-disk tombstone log path. Lives under `<stateDir>/tombstones.jsonl`
+   * so it is co-located with the fact-hash index and encrypted at rest when
+   * the secure-store is enabled (the StorageManager's secure read/write
+   * helpers are injected into the store).
+   */
+  get tombstonesPath() {
+    return path.join(this.stateDir, "tombstones.jsonl");
+  }
+  /**
+   * Configure the tombstone invariant for this storage instance. Installed
+   * by the orchestrator after construction (same pattern as
+   * `setVersioningConfig` / `citationTemplate`). When `enabled` is false
+   * (default until the orchestrator wires config), the chokepoint check is a
+   * no-op — pre-feature behavior for rollback safety (rule 30).
+   */
+  setTombstonesConfig(config) {
+    this.tombstonesConfig = { ...config };
+    if (this.tombstoneStore) {
+      this.tombstoneStore.invalidate();
+      this.tombstoneStore = null;
+      this.tombstoneStoreLoadPromise = null;
+    }
+  }
+  buildTombstoneStore() {
+    const options = {
+      enabled: this.tombstonesConfig.enabled,
+      semanticMatch: this.tombstonesConfig.semanticMatch,
+      semanticThreshold: this.tombstonesConfig.semanticThreshold,
+      // Wire the SAME helpers the dedup index uses (rule 23 / checklist §13):
+      // hashContent = ContentHashIndex.computeHash, normalizeText =
+      // ContentHashIndex.normalizeContent. Importing them here (not copying)
+      // guarantees the tombstone tiers can never drift from dedup.
+      hashContent: ContentHashIndex.computeHash,
+      normalizeText: ContentHashIndex.normalizeContent
+    };
+    const io = {
+      read: (filePath) => this.readStorageSecureFile(filePath),
+      append: (filePath, content) => this.appendStorageSecureFile(filePath, content),
+      write: (filePath, content) => this.writeStorageSecureFile(filePath, content),
+      // stat lets the store own its cross-process staleness probe (#1579).
+      stat: (filePath) => statSync(filePath)
+    };
+    return new TombstoneStore(
+      this.tombstonesPath,
+      this.tombstonesConfig.namespace,
+      options,
+      io
+    );
+  }
+  /**
+   * Lazily load the tombstone store. Mirrors the fact-hash-index lazy-load
+   * pattern: a single in-flight load promise dedups concurrent first-access.
+   * The cross-process staleness probe lives inside the store now (#1579): on
+   * each cached access it stats its own file and invalidates if a peer process
+   * appended, so the next lookup reloads from disk. If the probe just
+   * invalidated the store, fall through to the reload branch — returning null
+   * here was the original regression (the chokepoint threw and failed OPEN).
+   */
+  getTombstoneStore() {
+    if (this.tombstoneStore) {
+      const cached = this.tombstoneStore;
+      return cached.ensureFreshAgainstDisk().then(() => cached);
+    }
+    if (!this.tombstoneStoreLoadPromise) {
+      const store = this.buildTombstoneStore();
+      this.tombstoneStoreLoadPromise = store.load().then(() => {
+        this.tombstoneStore = store;
+        return store;
+      }).catch((err) => {
+        this.tombstoneStoreLoadPromise = null;
+        throw err;
+      });
+    }
+    return this.tombstoneStoreLoadPromise;
+  }
+  /**
+   * Append a tombstone for a retired memory (issue #1579 emitters).
+   * Best-effort: a tombstone append failure MUST NOT fail the supersession /
+   * correction that triggered it (gotcha #13 / rule 34). The memory is
+   * already retired on disk; the tombstone is the non-resurrection guard.
+   */
+  async appendTombstone(input) {
+    if (!this.tombstonesConfig.enabled) return null;
+    try {
+      const store = await this.getTombstoneStore();
+      const strippedRawContent = stripCitationForTemplate(input.rawContent, this.citationTemplate);
+      return await store.appendTombstone({ ...input, rawContent: strippedRawContent });
+    } catch (err) {
+      log.warn(`tombstone append failed (memory=${input.sourceMemoryId}): ${err}`);
+      return null;
+    }
+  }
+  /**
+   * Revoke a tombstone (re-allow the content). Used by the review-queue
+   * approval path when an operator approves a blocked memory.
+   */
+  async revokeTombstone(tombstoneId, createdBy) {
+    if (!this.tombstonesConfig.enabled) return null;
+    try {
+      const store = await this.getTombstoneStore();
+      return await store.revoke(tombstoneId, createdBy);
+    } catch (err) {
+      log.warn(`tombstone revoke failed (id=${tombstoneId}): ${err}`);
+      return null;
+    }
+  }
+  /** Aggregate tombstone stats for `remnic doctor`. */
+  async getTombstoneStats() {
+    if (!this.tombstonesConfig.enabled) return null;
+    try {
+      const store = await this.getTombstoneStore();
+      return store.stats();
+    } catch (err) {
+      log.warn(`tombstone stats failed: ${err}`);
+      return null;
+    }
+  }
+  /**
+   * Rebuild the tombstone log from retired memories on disk. Exposed for
+   * `remnic doctor --rebuild-tombstones` and tests.
+   */
+  async rebuildTombstonesFromFiles() {
+    if (!this.tombstonesConfig.enabled) return 0;
+    const store = await this.getTombstoneStore();
+    const all = [...await this.readAllMemories(), ...await this.readAllColdMemories()];
+    const retired = collectRetiredMemoriesForRebuild(all, {
+      stripCitation: (text) => stripCitationForTemplate(text, this.citationTemplate),
+      supersessionKeysForFact
+    });
+    return await store.rebuild(retired);
+  }
   async getFactHashIndex() {
     if (this.factHashIndex) {
       return this.factHashIndex;
@@ -2655,9 +2812,45 @@ var StorageManager = class _StorageManager {
     if (!sanitized.clean) {
       log.warn(`memory content sanitized for ${id}; violations=${sanitized.violations.join(", ")}`);
     }
+    let factHashSourceForTombstone = null;
     if (category === "fact") {
       const hashSource = options.contentHashSource !== void 0 && options.contentHashSource.length > 0 ? sanitizeMemoryContent(options.contentHashSource).text : sanitized.text;
       fm.contentHash = ContentHashIndex.computeHash(hashSource);
+      factHashSourceForTombstone = hashSource;
+    }
+    let tombstoneBlocked = false;
+    if (category === "fact" && this.tombstonesConfig.enabled && factHashSourceForTombstone !== null && // Block facts that would become ACTIVE or are already pending_review
+    // (issue #1579 thread ObteQ: wearable/native imports write fact
+    // candidates with status: pending_review; without checking them here,
+    // promoteWearableMemory could later flip a retired fact active without
+    // a tombstone check). A caller that explicitly requests a terminal
+    // non-active status (rejected/retracted/superseded) is respected.
+    (fm.status === void 0 || fm.status === "active" || fm.status === "pending_review")) {
+      try {
+        const tombstoneStore = await this.getTombstoneStore();
+        const keyedSupersession = options.entityRef && options.structuredAttributes ? supersessionKeysForFact({
+          entityRef: options.entityRef,
+          structuredAttributes: options.structuredAttributes
+        }) : [];
+        const match = tombstoneStore.lookup({
+          contentHash: fm.contentHash,
+          normalizedText: ContentHashIndex.normalizeContent(factHashSourceForTombstone),
+          ...options.entityRef ? { entityRef: options.entityRef } : {},
+          ...keyedSupersession.length > 0 ? { supersessionKeys: keyedSupersession } : {},
+          namespace: this.tombstonesConfig.namespace
+        });
+        if (match) {
+          tombstoneBlocked = true;
+          fm.status = "pending_review";
+          fm.blockedBy = match.tombstoneId;
+          fm.tombstoneBlockTier = match.matchedTier;
+          log.info(
+            `tombstone: blocked resurrection of fact ${id} (tier=${match.matchedTier}, tombstone=${match.tombstoneId}, reason=${match.reason})`
+          );
+        }
+      } catch (err) {
+        log.warn(`tombstone lookup failed for fact ${id} (fail-open): ${err}`);
+      }
     }
     const fileContent = `${serializeFrontmatter(fm)}
 
@@ -2678,7 +2871,7 @@ ${sanitized.text}
         ...(options.lineage ?? []).filter(Boolean)
       ]
     });
-    if (category === "fact") {
+    if (category === "fact" && !tombstoneBlocked) {
       try {
         const factHashIndex = await this.getFactHashIndex();
         if (options.contentHashSource !== void 0 && options.contentHashSource.length > 0) {
@@ -2720,6 +2913,22 @@ ${sanitized.text}
     factHashIndex.addByHash(hash);
     await factHashIndex.save();
   }
+  /**
+   * Re-register a fact's contentHash in the dedup index after a tombstone
+   * block is lifted on approval (issue #1579 thread ObnTy). `writeMemory`
+   * skips hash-index registration for tombstone-blocked facts (rule 44); when
+   * the review queue later promotes such a fact back to `status: active`, the
+   * hash must enter the index or the next extraction of the same content
+   * creates a second active fact. Reads the memory by id so the caller (the
+   * review CLI) does not need to re-parse the file. No-op for non-facts or
+   * facts that are not active.
+   */
+  async restoreFactHashAfterApproval(memoryId) {
+    const all = await this.readAllMemories();
+    const memory = all.find((m) => m.frontmatter.id === memoryId);
+    if (!memory) return;
+    await this.addActiveFactContentHash(memory);
+  }
   async syncFactHashIndexAfterRewrite(before, after) {
     if (before.frontmatter.category !== "fact" && after.frontmatter.category !== "fact") return;
     const beforeHash = this.factContentHashForRemoval(before);
@@ -3117,6 +3326,11 @@ ${sanitized.text}
   invalidateAllMemoriesCache() {
     _StorageManager.allMemoriesInFlight.delete(this.baseDir);
     invalidateAllForDir(this.baseDir);
+    if (this.tombstoneStore) {
+      this.tombstoneStore.invalidate();
+      this.tombstoneStore = null;
+      this.tombstoneStoreLoadPromise = null;
+    }
   }
   /**
    * Invalidate the cold-scan cache for this storage root and bump the
@@ -5416,6 +5630,20 @@ ${oldMemory.content}
       });
       this.bumpMemoryStatusVersion();
       log.debug(`superseded memory ${oldMemoryId} by ${newMemoryId}: ${reason}`);
+      if (oldMemory.frontmatter.category === "fact") {
+        for (const input of buildRetiredFactTombstoneInputs(
+          {
+            id: oldMemoryId,
+            content: stripCitationForTemplate(oldMemory.content, this.citationTemplate),
+            contentHash: oldMemory.frontmatter.contentHash,
+            entityRef: oldMemory.frontmatter.entityRef,
+            structuredAttributes: oldMemory.frontmatter.structuredAttributes
+          },
+          { reason: "contradiction_resolution", createdBy: "contradiction_resolution", createdAt: now, supersessionKeysForFact }
+        )) {
+          await this.appendTombstone(input);
+        }
+      }
       await this.writeMemory("correction", `Superseded: ${oldMemory.content}
 
 Reason: ${reason}`, {
@@ -5612,4 +5840,4 @@ export {
   serializeEntityFile,
   StorageManager
 };
-//# sourceMappingURL=chunk-RIC5U67B.js.map
+//# sourceMappingURL=chunk-SFMRLXIV.js.map