@remnic/core 9.3.708 → 9.3.709

package/src/access-http.ts

@@ -8,6 +8,7 @@ import { fileURLToPath, URL } from "node:url";
 import { gunzipSync } from "node:zlib";
 import { log } from "./logger.js";
 import { EngramAccessInputError, type EngramAccessService, type EngramAccessMemoryResponse, type EngramAccessWriteResponse } from "./access-service.js";
+import { CorrectionContractError } from "./correction/correction-contract.js";
 import { WearablesInputError } from "./wearables/errors.js";
 import { EngramMcpServer } from "./access-mcp.js";
 import { validateRequest, type SchemaName, type SchemaTypeFor } from "./access-schema.js";
@@ -319,6 +320,7 @@ export class EngramAccessHttpServer {
       architectureCardVisible: this.service.architectureCardSurfaceVisible,
       codegraphVisible: this.service.codegraphSurfaceVisible,
       sessionDeltaVisible: this.service.sessionDeltaSurfaceVisible,
+      correctionVisible: this.service.correctionSurfaceVisible,
     });
   }
 
@@ -343,6 +345,10 @@ export class EngramAccessHttpServer {
             this.respondJson(res, 400, { error: err.message, code: "input_error" });
             return;
           }
+          if (err instanceof CorrectionContractError) {
+            this.respondJson(res, 400, { error: err.message, code: "correction_contract_error" });
+            return;
+          }
           if (res.headersSent) {
             res.destroy(err as Error);
             return;
@@ -1432,6 +1438,58 @@ export class EngramAccessHttpServer {
       return;
     }
 
+    // ── Correction Contract (issue #1580) — plan / apply / pending ─────────
+    // All three routes dispatch through the boundary operations so schema
+    // validation + namespace policy reach every correction path (rule 22/39).
+    if (req.method === "POST" && pathname === "/engram/v1/correction/plan") {
+      // Planning persists a pending plan JSON file on every successful call
+      // (review thread UhA), so it is a state write for rate-limit purposes —
+      // mirror the apply route's precheck + accounting to bound files under
+      // state/corrections/pending instead of letting an HTTP client create
+      // unbounded plan files without consuming write quota.
+      this.ensureWriteRateLimitAvailable();
+      const body = await this.readJsonBody(req);
+      const op = getOperation("memory_correct_plan");
+      if (!op) {
+        throw new EngramAccessInputError("access-boundary: operation not registered: memory_correct_plan");
+      }
+      const output = (await op.run(body, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+      })) as { result: unknown };
+      this.recordWriteRateLimitHit();
+      this.respondJson(res, 200, output.result);
+      return;
+    }
+
+    if (req.method === "POST" && pathname === "/engram/v1/correction/apply") {
+      this.ensureWriteRateLimitAvailable();
+      const body = await this.readJsonBody(req);
+      const op = getOperation("memory_correct_apply");
+      if (!op) {
+        throw new EngramAccessInputError("access-boundary: operation not registered: memory_correct_apply");
+      }
+      const output = (await op.run(body, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+      })) as { result: unknown };
+      this.recordWriteRateLimitHit();
+      this.respondJson(res, 200, output.result);
+      return;
+    }
+
+    if (req.method === "GET" && pathname === "/engram/v1/correction/pending") {
+      const namespace = parsed.searchParams.get("namespace") ?? undefined;
+      const sessionKey = parsed.searchParams.get("sessionKey") ?? undefined;
+      const plans = await this.service.correctionListPending({
+        ...(namespace ? { namespace } : {}),
+        ...(sessionKey ? { sessionKey } : {}),
+        principal: this.resolveRequestPrincipal(req),
+      });
+      this.respondJson(res, 200, plans);
+      return;
+    }
+
     if (req.method === "POST" && pathname === "/engram/v1/suggestions") {
       void getOperation("suggestion_submit"); // boundary dispatch (issue #1525)
       const body = await this.readValidatedBody(req, "suggestionSubmit");
@@ -2527,6 +2585,12 @@ export class EngramAccessHttpServer {
             toolName === "remnic.memory_action_apply"
           )
         ) ||
+        (
+          toolName === "engram.memory_correct_apply" ||
+          toolName === "remnic.memory_correct_apply" ||
+          toolName === "engram.memory_correct_plan" ||
+          toolName === "remnic.memory_correct_plan"
+        ) ||
         codingDecisionWrite ||
         codingArchitectureWrite ||
         codegraphWrite
@@ -2561,7 +2625,12 @@ export class EngramAccessHttpServer {
       // would consume the write quota despite no mutation occurring
       // (issue #1554 review thread: don't bill rejected calls as writes).
       const isRejectedCodegraph = structured?.ok === false;
-      if (!isError && !isRejectedCodegraph && structured && this.shouldCountWriteRateLimit(structured)) {
+      // A write tool that succeeded without structuredContent (e.g.
+      // memory_correct_apply, which returns a CorrectionOutcome) still
+      // consumed a write — count it. Tools WITH structuredContent use the
+      // dryRun/idempotencyReplay guards.
+      const counts = structured ? this.shouldCountWriteRateLimit(structured) : true;
+      if (!isError && !isRejectedCodegraph && counts) {
         this.recordWriteRateLimitHit();
       }
     }

package/src/access-mcp.ts

@@ -127,6 +127,9 @@ const MCP_MIGRATED_OPERATIONS: Readonly<Record<string, OperationName>> = {
   "engram.codegraph_manage_adr": "codegraph_manage_adr",
   "engram.codegraph_ingest_traces": "codegraph_ingest_traces",
   "engram.coding_delta": "coding_delta",
+  // Correction Contract (issue #1580) — one plan/apply pipeline.
+  "engram.memory_correct_plan": "memory_correct_plan",
+  "engram.memory_correct_apply": "memory_correct_apply",
 };
 
 function resolveChatGptInspectorRecallSessionKey(
@@ -354,6 +357,13 @@ export class EngramMcpServer {
    */
   private readonly codegraphVisible: boolean;
   private readonly sessionDeltaVisible: boolean;
+  /**
+   * Whether the two correction tools (memory_correct_plan / memory_correct_apply)
+   * should appear in `tools/list` (issue #1580). Gated on `correction.enabled`
+   * (default true — plan is read-only; safe on). When false the tools array is
+   * byte-identical to pre-feature.
+   */
+  private readonly correctionVisible: boolean;
 
   constructor(
     private readonly service: EngramAccessService,
@@ -366,6 +376,7 @@ export class EngramMcpServer {
       architectureCardVisible?: boolean;
       codegraphVisible?: boolean;
       sessionDeltaVisible?: boolean;
+      correctionVisible?: boolean;
     } = {},
   ) {
     this.citationsEnabled = options.citationsEnabled === true;
@@ -375,6 +386,8 @@ export class EngramMcpServer {
     this.architectureCardVisible = options.architectureCardVisible === true;
     this.codegraphVisible = options.codegraphVisible === true;
     this.sessionDeltaVisible = options.sessionDeltaVisible === true;
+    // correction defaults to visible (enabled by default — plan is read-only).
+    this.correctionVisible = options.correctionVisible !== false;
     this.authenticatedPrincipal =
       options.principal?.trim() ||
       readEnvVar("OPENCLAW_ENGRAM_ACCESS_PRINCIPAL")?.trim() ||
@@ -2149,6 +2162,58 @@ export class EngramMcpServer {
       );
       this.tools = [...this.tools, ...deltaTools];
     }
+    if (this.correctionVisible) {
+      // Correction Contract (issue #1580) — one plan/apply pipeline for every
+      // memory correction. Both tools dispatch through the boundary operations
+      // (memory_correct_plan / memory_correct_apply) which delegate to the
+      // CorrectionService.
+      const planTool = withToolAliases(
+        {
+          name: "engram.memory_correct_plan",
+          description:
+            "Plan a memory correction from a plain-language statement (issue #1580). Returns a CorrectionPlan with a diff preview; apply via memory_correct_apply.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              text: {
+                type: "string",
+                description: "The natural-language correction (e.g. \"we migrated to MySQL in March\").",
+              },
+              targetIds: {
+                type: "array",
+                items: { type: "string" },
+                description: "Optional explicit target memory ids. When omitted, the planner searches.",
+              },
+              sessionKey: { type: "string", description: "Session identifier for namespace resolution." },
+              namespace: { type: "string", description: "Optional explicit namespace (validated by policy)." },
+            },
+            required: ["text"],
+            additionalProperties: false,
+          },
+        },
+        this.emitLegacyTools,
+      );
+      const applyTool = withToolAliases(
+        {
+          name: "engram.memory_correct_apply",
+          description:
+            "Apply a planned memory correction by planId (issue #1580). Requires confirm: true when correction.applyRequiresConfirm is on (default).",
+          inputSchema: {
+            type: "object",
+            properties: {
+              planId: { type: "string", description: "The plan id returned by memory_correct_plan." },
+              confirm: { type: "boolean", description: "Must be true to apply (safety guard, rule 48)." },
+              sessionKey: { type: "string", description: "Session identifier for namespace resolution." },
+              namespace: { type: "string", description: "Optional explicit namespace (validated by policy)." },
+            },
+            required: ["planId"],
+            additionalProperties: false,
+          },
+        },
+        this.emitLegacyTools,
+      );
+      this.tools = [...this.tools, ...planTool, ...applyTool];
+    }
   }
 
   /** Get clientInfo for a specific MCP session. Returns undefined for non-MCP requests. */

package/src/access-operations.ts

@@ -16,6 +16,8 @@ import { z } from "zod";
 
 import { defineOperation } from "./access-boundary.js";
 import { memoryStoreRequestSchema, type MemoryStoreRequest } from "./access-schema.js";
+import { EngramAccessInputError } from "./access-service.js";
+import { CorrectionContractError } from "./correction/correction-contract.js";
 import type {
   EngramAccessMemoryResponse,
   EngramAccessWriteResponse,
@@ -344,6 +346,124 @@ export const codingDeltaOperation = defineOperation<
   },
 });
 
+// ---------------------------------------------------------------------------
+// memory_correct_plan / memory_correct_apply — Correction Contract (#1580)
+// ---------------------------------------------------------------------------
+//
+// One plan/apply pipeline for every memory correction (supersession,
+// invalidation, tombstone, edit, rescope, redaction). The MCP/HTTP/CLI
+// surfaces all dispatch through these two ops so the boundary's validation +
+// error mapping reach every correction path (rule 22 / 39).
+
+const memoryCorrectPlanSchema = z.preprocess(
+  (data) => {
+    if (data && typeof data === "object" && !Array.isArray(data)) {
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
+        if (v !== null) out[k] = v;
+      }
+      return out;
+    }
+    return data;
+  },
+  z.object({
+    text: z.string().trim().min(1).max(10_000),
+    targetIds: z.array(z.string().trim().min(1).max(512)).optional(),
+    sessionKey: z.string().trim().max(512).optional(),
+    namespace: z.string().trim().max(256).optional(),
+  }),
+);
+
+export interface MemoryCorrectPlanInput {
+  text: string;
+  targetIds?: string[];
+  sessionKey?: string;
+  namespace?: string;
+}
+
+export interface MemoryCorrectPlanOutput {
+  readonly result: unknown; // CorrectionPlan — opaque to the boundary
+}
+
+export const memoryCorrectPlanOperation = defineOperation<
+  MemoryCorrectPlanInput,
+  MemoryCorrectPlanOutput
+>({
+  name: "memory_correct_plan",
+  description:
+    "Plan a memory correction from a plain-language statement (issue #1580). Returns a CorrectionPlan with a diff preview; apply via memory_correct_apply.",
+  schema: memoryCorrectPlanSchema as z.ZodType<MemoryCorrectPlanInput>,
+  handler: async (input, ctx) => {
+    try {
+      const result = await ctx.service.correctionPlan({
+        text: input.text,
+        ...(input.targetIds ? { targetIds: input.targetIds } : {}),
+        ...(input.sessionKey ? { sessionKey: input.sessionKey } : {}),
+        ...(input.namespace ? { namespace: input.namespace } : {}),
+        ...(ctx.authenticatedPrincipal ? { principal: ctx.authenticatedPrincipal } : {}),
+      });
+      return { result };
+    } catch (err) {
+      if (err instanceof CorrectionContractError) throw new EngramAccessInputError(err.message);
+      throw err;
+    }
+  },
+});
+
+const memoryCorrectApplySchema = z.preprocess(
+  (data) => {
+    if (data && typeof data === "object" && !Array.isArray(data)) {
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
+        if (v !== null) out[k] = v;
+      }
+      return out;
+    }
+    return data;
+  },
+  z.object({
+    planId: z.string().trim().min(1).max(512),
+    confirm: z.boolean().optional(),
+    sessionKey: z.string().trim().max(512).optional(),
+    namespace: z.string().trim().max(256).optional(),
+  }),
+);
+
+export interface MemoryCorrectApplyInput {
+  planId: string;
+  confirm?: boolean;
+  sessionKey?: string;
+  namespace?: string;
+}
+
+export interface MemoryCorrectApplyOutput {
+  readonly result: unknown; // CorrectionOutcome — opaque to the boundary
+}
+
+export const memoryCorrectApplyOperation = defineOperation<
+  MemoryCorrectApplyInput,
+  MemoryCorrectApplyOutput
+>({
+  name: "memory_correct_apply",
+  description:
+    "Apply a planned memory correction by planId (issue #1580). Requires confirm: true when correction.applyRequiresConfirm is on (default).",
+  schema: memoryCorrectApplySchema as z.ZodType<MemoryCorrectApplyInput>,
+  handler: async (input, ctx) => {
+    try {
+      const result = await ctx.service.correctionApply(input.planId, {
+        confirm: input.confirm === true,
+        ...(input.sessionKey ? { sessionKey: input.sessionKey } : {}),
+        ...(input.namespace ? { namespace: input.namespace } : {}),
+        ...(ctx.authenticatedPrincipal ? { principal: ctx.authenticatedPrincipal } : {}),
+      });
+      return { result };
+    } catch (err) {
+      if (err instanceof CorrectionContractError) throw new EngramAccessInputError(err.message);
+      throw err;
+    }
+  },
+});
+
 // ---------------------------------------------------------------------------
 // Surface registration map — what each transport calls the pilot ops
 // ---------------------------------------------------------------------------
@@ -574,4 +694,6 @@ export const REGISTERED_OPERATIONS = [
   codegraphManageAdrOperation.spec.name,
   codegraphIngestTracesOperation.spec.name,
   codingDeltaOperation.spec.name,
+  memoryCorrectPlanOperation.spec.name,
+  memoryCorrectApplyOperation.spec.name,
 ] as const;

package/src/access-service.ts

@@ -49,6 +49,14 @@ import {
   type DeltaSurfaceStorage,
 } from "./coding/session-delta-surfaces.js";
 import { defaultGitInvoker } from "./coding/git-context.js";
+import {
+  createCorrectionService,
+  isCorrectionFeatureEnabled,
+  CorrectionService,
+  type CorrectionOutcome,
+  type CorrectionPlan,
+  type CorrectionRequest,
+} from "./correction/index.js";
 import { createVersion } from "./page-versioning.js";
 import { WorkStorage } from "./work/storage.js";
 import {
@@ -4715,6 +4723,90 @@ export class EngramAccessService {
     });
   }
 
+  // -------------------------------------------------------------------------
+  // Correction Contract (issue #1580) — one plan/apply pipeline for every
+  // memory correction. The CorrectionService owns the planner + executor; the
+  // access-service constructs it lazily via the wiring helper and delegates.
+  // Each method below is thin wiring (≤4 lines) per the god-file ratchet.
+  // -------------------------------------------------------------------------
+  /** Whether the memory_correct_plan / memory_correct_apply tools should appear in tools/list (rule 39). Same reader as the runtime gate so visibility + enforcement stay in sync. */
+  get correctionSurfaceVisible(): boolean {
+    return isCorrectionFeatureEnabled(this.orchestrator.config);
+  }
+
+
+  private _correctionService: CorrectionService | null = null;
+
+  /** Lazily construct + cache the CorrectionService with deps wired from the orchestrator. */
+  private correctionService(): CorrectionService {
+    if (this._correctionService) return this._correctionService;
+    const service = createCorrectionService({
+      orchestrator: this.orchestrator,
+      resolveAuthorizedNamespace: async (req) =>
+        this.resolveWritableNamespace(req.namespace, req.sessionKey, req.principal),
+      resolveReadableNamespaces: (req) => {
+        const principal = this.resolveRequestPrincipal(req.sessionKey, req.principal);
+        return recallNamespacesForPrincipal(principal, this.orchestrator.config);
+      },
+      canWriteNamespace: (req) => {
+        // resolveWritableNamespace resolves + checks writability in one step;
+        // reusing it avoids a second ad-hoc namespace-resolution call site.
+        try {
+          this.resolveWritableNamespace(req.namespace, req.sessionKey, req.principal);
+          return Promise.resolve(true);
+        } catch {
+          return Promise.resolve(false);
+        }
+      },
+      // Wire the orchestrator's extraction LLM so classify+draft actually
+      // drafts actions instead of always hitting the deterministic fallback
+      // (review thread PG5). The planner's classifyAndDraft already falls back
+      // on any LLM outage, so returning null (LLM disabled/cooldown) or a
+      // thrown error both degrade safely to the deterministic path (rule 13).
+      llmComplete: async ({ system, user }) => {
+        const result = await this.orchestrator.localLlm.chatCompletion(
+          [
+            { role: "system", content: system },
+            { role: "user", content: user },
+          ],
+          { operation: "correction-classify", priority: "background" },
+        );
+        if (!result) {
+          throw new Error("correction classify+draft: local LLM unavailable (disabled or in cooldown)");
+        }
+        return result.content;
+      },
+    });
+    this._correctionService = service;
+    return service;
+  }
+
+  async correctionPlan(request: CorrectionRequest): Promise<CorrectionPlan> {
+    return this.correctionService().plan(request);
+  }
+
+  async correctionApply(
+    planId: string,
+    opts: { confirm?: boolean; namespace?: string; sessionKey?: string; principal?: string },
+  ): Promise<CorrectionOutcome> {
+    return this.correctionService().apply(planId, opts);
+  }
+
+  async correctionListPending(opts: {
+    namespace?: string;
+    sessionKey?: string;
+    principal?: string;
+  }): Promise<CorrectionPlan[]> {
+    return this.correctionService().listPending(opts);
+  }
+
+  async correctionDiscard(
+    planId: string,
+    opts: { namespace?: string; sessionKey?: string; principal?: string },
+  ): Promise<void> {
+    return this.correctionService().discard(planId, opts);
+  }
+
   async memoryBrowse(
     request: EngramAccessMemoryBrowseRequest = {},
   ): Promise<EngramAccessMemoryBrowseResponse> {

package/src/access-surface-catalog.test.ts

@@ -44,7 +44,12 @@ import {
 // catalog-completeness correction: adding routes that were always live but
 // omitted from the catalog (review-caught). Such a bump MUST be accompanied
 // by the newly-cataloged entries; the higher count is the honest baseline.
-const UNMIGRATED_HANDLER_BASELINE = 80;
+// #1580 Correction Contract adds GET /engram/v1/correction/pending — a read-only
+// list route (namespace/sessionKey query params, no body), so it stays unmigrated
+// alongside the other GET list routes (baseline 80 from #1525 + 1 = 81). Also a
+// catalog-completeness correction: POST /engram/v1/memories (operation memory_store)
+// was always live but omitted from HTTP_ROUTES — it is migrated, so no count change.
+const UNMIGRATED_HANDLER_BASELINE = 81;
 
 // Keep the import live — `getOperation` is the call surfaces use at dispatch
 // time; referencing it here pins the registry's lookup contract.

package/src/access-surface-catalog.ts

@@ -72,6 +72,9 @@ export const MCP_TOOLS: readonly McpToolEntry[] = [
   { tool: "memory_get", operation: "memory_get" },
   { tool: "memory_timeline", operation: null },
   { tool: "memory_store", operation: "memory_store" },
+  // Correction Contract (issue #1580) — one plan/apply pipeline.
+  { tool: "memory_correct_plan", operation: "memory_correct_plan" },
+  { tool: "memory_correct_apply", operation: "memory_correct_apply" },
   { tool: "coding_decision", operation: "coding_decision" },
   { tool: "coding_architecture", operation: "coding_architecture" },
   // codegraph parity tools (issue #1554)
@@ -184,6 +187,10 @@ export const HTTP_ROUTES: readonly HttpRouteEntry[] = [
   { method: "POST", pathname: "/engram/v1/lcm/compaction/flush", operation: "lcm_compaction_flush" },
   { method: "POST", pathname: "/engram/v1/lcm/compaction/record", operation: "lcm_compaction_record" },
   { method: "GET", pathname: "/engram/v1/lcm/status", operation: "lcm_status" },
+  // Correction Contract (issue #1580) — plan/apply/pending.
+  { method: "POST", pathname: "/engram/v1/correction/plan", operation: "memory_correct_plan" },
+  { method: "POST", pathname: "/engram/v1/correction/apply", operation: "memory_correct_apply" },
+  { method: "GET", pathname: "/engram/v1/correction/pending", operation: null },
   { method: "POST", pathname: "/engram/v1/memories", operation: "memory_store" },
   { method: "POST", pathname: "/engram/v1/coding/decisions", operation: "coding_decision" },
   { method: "POST", pathname: "/engram/v1/coding/architecture", operation: "coding_architecture" },

package/src/cli.ts

@@ -2807,6 +2807,7 @@ export async function runAccessMcpServeCliCommand(
       architectureCardVisible: service.architectureCardSurfaceVisible,
       codegraphVisible: service.codegraphSurfaceVisible,
       sessionDeltaVisible: service.sessionDeltaSurfaceVisible,
+      correctionVisible: service.correctionSurfaceVisible,
     });
   await server.runStdio(options.stdin ?? process.stdin, options.stdout ?? process.stdout);
   return { ok: true };

package/src/config.test.ts

@@ -2082,3 +2082,13 @@ test("parseConfig extractionFaithfulnessTimeoutMs rejects non-numeric and non-in
     );
   }
 });
+
+test("parseConfig rejects invalid correction.enabled instead of silently enabling (#1580)", () => {
+  assert.throws(() => parseConfig({ correction: { enabled: "flase" } }), /Invalid correction\.enabled/);
+  assert.throws(() => parseConfig({ correctionEnabled: "nope" }), /Invalid correction\.enabled/);
+  assert.throws(() => parseConfig({ correction: { applyRequiresConfirm: "sure" } }), /Invalid correction\.applyRequiresConfirm/);
+  // Valid + absent still resolve correctly (no regression).
+  assert.equal(parseConfig({ correction: { enabled: false } }).correctionEnabled, false);
+  assert.equal(parseConfig({ correctionEnabled: "0" }).correctionEnabled, false);
+  assert.equal(parseConfig({}).correctionEnabled, true);
+});

package/src/config.ts

@@ -2097,6 +2097,49 @@ export function parseConfig(
     // (docs kept honest — review: wire resolver before exposing the gate).
     temporalBiTemporal: coerceBool(cfg.temporalBiTemporal) ?? false,
     temporalExpiredInInjection: coerceBool(cfg.temporalExpiredInInjection) ?? false,
+    // Correction Contract (issue #1580). Parsed here so operators can actually
+    // set the documented toggles/limits (review thread Txp): parseConfig builds
+    // an explicit output, so without these lines the raw `correction` block /
+    // flat legacy keys are dropped and the runtime always sees defaults. Nested
+    // `correction.<key>` wins; flat `correction<Key>` is the legacy fallback.
+    correctionEnabled: (() => {
+      const nested = (cfg.correction as Record<string, unknown> | undefined)?.enabled;
+      const raw = nested !== undefined ? nested : cfg.correctionEnabled;
+      if (raw === undefined || raw === null) return true;
+      const v = coerceBool(raw);
+      if (v === undefined) {
+        throw new Error(`Invalid correction.enabled: expected a boolean, got ${JSON.stringify(raw)}`);
+      }
+      return v;
+    })(),
+    correctionApplyRequiresConfirm: (() => {
+      const nested = (cfg.correction as Record<string, unknown> | undefined)?.applyRequiresConfirm;
+      const raw = nested !== undefined ? nested : cfg.correctionApplyRequiresConfirm;
+      if (raw === undefined || raw === null) return true;
+      const v = coerceBool(raw);
+      if (v === undefined) {
+        throw new Error(`Invalid correction.applyRequiresConfirm: expected a boolean, got ${JSON.stringify(raw)}`);
+      }
+      return v;
+    })(),
+    correctionMaxAffected: (() => {
+      const rawNested = (cfg.correction as Record<string, unknown> | undefined)?.maxAffected;
+      const raw = rawNested !== undefined ? rawNested : cfg.correctionMaxAffected;
+      if (raw === undefined || raw === null) return 10;
+      const n = coerceNumber(raw);
+      if (n === undefined || !Number.isFinite(n) || n < 1) {
+        throw new Error(`Invalid correction.maxAffected: expected an integer >= 1, got ${JSON.stringify(raw)}`);
+      }
+      return Math.floor(n);
+    })(),
+    correctionPlanTtlHours: (() => {
+      const nested = (cfg.correction as Record<string, unknown> | undefined)?.planTtlHours;
+      const fromNested = nested !== undefined ? coerceNumber(nested) : undefined;
+      if (fromNested !== undefined && fromNested > 0) return fromNested;
+      const fromFlat = coerceNumber(cfg.correctionPlanTtlHours);
+      if (fromFlat !== undefined && fromFlat > 0) return fromFlat;
+      return 24;
+    })(),
     // Tombstones — non-resurrection invariant (issue #1579). The invariant is
     // the point, so it ships ON by default; `false` restores pre-feature
     // behavior for rollback safety (rule 30). Uses coerceBool so CLI string