@remnic/core 9.3.708 → 9.3.709

package/dist/{chunk-STYMKPFT.js → chunk-EVX52NCY.js}

@@ -22,7 +22,7 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-XKMDDM7P.js";
+} from "./chunk-Y6PIFKXX.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -30,7 +30,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-ESMY4RJ4.js";
+} from "./chunk-XKU4YE6Z.js";
 import {
   clusterByKey,
   combineNamespaces,
@@ -58,7 +58,7 @@ import {
 } from "./chunk-FF4KLI5W.js";
 import {
   estimateRecallTokens
-} from "./chunk-SPETAWFE.js";
+} from "./chunk-AZVHBFI3.js";
 import {
   namespaceCollectionName
 } from "./chunk-K22IJO4R.js";
@@ -107,17 +107,20 @@ import {
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-W2WQ4LE7.js";
+} from "./chunk-35YJ6KCV.js";
 import {
   parseEntityFile
-} from "./chunk-2VQYHHWB.js";
+} from "./chunk-JSDZMOT7.js";
 import {
   stripAttributesSuffix
 } from "./chunk-SVOZFLIQ.js";
+import {
+  serializeMutations
+} from "./chunk-LTJAMRGI.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-MLLTU5FX.js";
+} from "./chunk-BOGENF7P.js";
 import {
   inferMemoryStatus,
   toMemoryPathRel
@@ -1144,12 +1147,12 @@ async function findArchitectureCardMemory(storage) {
   });
   return cards[0] ?? null;
 }
-function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile4, writeVersion) {
+function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile5, writeVersion) {
   return {
     async snapshotIfExists(memory) {
       if (!enabled) return;
       try {
-        const fullContent = await readFile4(memory.path);
+        const fullContent = await readFile5(memory.path);
         await writeVersion(
           memory.path,
           fullContent,
@@ -2131,10 +2134,1381 @@ async function deltaGet(request, ctx, codingContext) {
   }
 }
 
+// src/correction/correction-contract.ts
+var MEMORY_CATEGORIES = [
+  "fact",
+  "preference",
+  "correction",
+  "entity",
+  "decision",
+  "relationship",
+  "principle",
+  "commitment",
+  "moment",
+  "skill",
+  "rule",
+  "procedure",
+  "reasoning_trace"
+];
+var CORRECTION_ACTION_KINDS = [
+  "supersede",
+  "edit",
+  "retract",
+  "rescope",
+  "redaction_rule"
+];
+var CORRECTION_TEXT_MAX = 1e4;
+var REDACTION_PATTERN_MAX = 256;
+function validateCorrectionRequest(request) {
+  if (!request || typeof request !== "object") {
+    throw new CorrectionContractError("CorrectionRequest must be an object.");
+  }
+  const text = typeof request.text === "string" ? request.text.trim() : "";
+  if (text.length === 0) {
+    throw new CorrectionContractError("CorrectionRequest.text is required and must be non-empty.");
+  }
+  if (text.length > CORRECTION_TEXT_MAX) {
+    throw new CorrectionContractError(
+      `CorrectionRequest.text exceeds the ${CORRECTION_TEXT_MAX}-character limit (${text.length}).`
+    );
+  }
+  const targetIds = Array.isArray(request.targetIds) ? request.targetIds.filter((id) => typeof id === "string" && id.length > 0) : void 0;
+  if (targetIds !== void 0 && targetIds.length === 0) {
+    return {
+      text,
+      ...request.sessionKey ? { sessionKey: request.sessionKey } : {},
+      ...request.principal ? { principal: request.principal } : {},
+      ...request.namespace ? { namespace: request.namespace } : {}
+    };
+  }
+  return {
+    text,
+    ...targetIds ? { targetIds } : {},
+    ...request.sessionKey ? { sessionKey: request.sessionKey } : {},
+    ...request.principal ? { principal: request.principal } : {},
+    ...request.namespace ? { namespace: request.namespace } : {}
+  };
+}
+function validateRedactionPattern(pattern) {
+  if (typeof pattern !== "string") {
+    throw new CorrectionContractError("redaction_rule.pattern must be a string.");
+  }
+  const trimmed = pattern.trim();
+  if (trimmed.length === 0) {
+    throw new CorrectionContractError("redaction_rule.pattern is required.");
+  }
+  if (trimmed.length > REDACTION_PATTERN_MAX) {
+    throw new CorrectionContractError(
+      `redaction_rule.pattern exceeds the ${REDACTION_PATTERN_MAX}-character bound.`
+    );
+  }
+  if (isRegexLike(trimmed) && isOverlyBroadRegex(trimmed)) {
+    throw new CorrectionContractError(
+      "redaction_rule.pattern is too broad \u2014 use a bounded literal or a more specific pattern."
+    );
+  }
+  return trimmed;
+}
+function isRegexLike(pattern) {
+  if (pattern.startsWith("/") && pattern.endsWith("/") && pattern.length >= 2) return true;
+  return /[\\^$.|?*+()[\]{}]/.test(pattern);
+}
+function isOverlyBroadRegex(pattern) {
+  const body = pattern.startsWith("/") && pattern.endsWith("/") ? pattern.slice(1, -1) : pattern;
+  if (/(?:^|[^\\])\(\.\*\)|(?:^|[^\\])\.\*|(?:^|[^\\])\.\+|^\.([^*+]?)$/.test(body)) {
+    return true;
+  }
+  return false;
+}
+function validateCorrectionAction(action) {
+  if (!action || typeof action !== "object") {
+    throw new CorrectionContractError("CorrectionAction must be an object.");
+  }
+  const a = action;
+  if (typeof a.kind !== "string" || !CORRECTION_ACTION_KINDS.includes(a.kind)) {
+    throw new CorrectionContractError(
+      `CorrectionAction.kind must be one of: ${CORRECTION_ACTION_KINDS.join(", ")}.`
+    );
+  }
+  switch (a.kind) {
+    case "supersede":
+      if (typeof a.loserId !== "string" || a.loserId.length === 0) {
+        throw new CorrectionContractError("supersede.loserId is required.");
+      }
+      if (a.replacement !== void 0 && a.replacement !== null) {
+        validateMemoryDraft(a.replacement);
+      }
+      break;
+    case "edit":
+      if (typeof a.memoryId !== "string" || a.memoryId.length === 0) {
+        throw new CorrectionContractError("edit.memoryId is required.");
+      }
+      if (typeof a.patch !== "string" || a.patch.length === 0) {
+        throw new CorrectionContractError("edit.patch is required and must be non-empty.");
+      }
+      break;
+    case "retract":
+      if (typeof a.memoryId !== "string" || a.memoryId.length === 0) {
+        throw new CorrectionContractError("retract.memoryId is required.");
+      }
+      break;
+    case "rescope":
+      if (typeof a.memoryId !== "string" || a.memoryId.length === 0) {
+        throw new CorrectionContractError("rescope.memoryId is required.");
+      }
+      if (typeof a.toNamespace !== "string" || a.toNamespace.trim().length === 0) {
+        throw new CorrectionContractError("rescope.toNamespace is required.");
+      }
+      break;
+    case "redaction_rule":
+      if (typeof a.pattern !== "string") {
+        throw new CorrectionContractError("redaction_rule.pattern is required.");
+      }
+      validateRedactionPattern(a.pattern);
+      break;
+  }
+}
+function validateMemoryDraft(draft) {
+  if (!draft || typeof draft !== "object") {
+    throw new CorrectionContractError("MemoryDraft must be an object.");
+  }
+  const d = draft;
+  if (typeof d.content !== "string" || d.content.trim().length === 0) {
+    throw new CorrectionContractError("MemoryDraft.content is required and must be non-empty.");
+  }
+  if (d.category !== void 0) {
+    if (typeof d.category !== "string" || !MEMORY_CATEGORIES.includes(d.category)) {
+      throw new CorrectionContractError(
+        `MemoryDraft.category must be one of: ${MEMORY_CATEGORIES.join(", ")}.`
+      );
+    }
+  }
+  if (d.confidence !== void 0 && (typeof d.confidence !== "number" || d.confidence < 0 || d.confidence > 1)) {
+    throw new CorrectionContractError("MemoryDraft.confidence must be a number in [0, 1].");
+  }
+  if (d.tags !== void 0 && !Array.isArray(d.tags)) {
+    throw new CorrectionContractError("MemoryDraft.tags must be an array.");
+  }
+  if (d.structuredAttributes !== void 0 && (typeof d.structuredAttributes !== "object" || d.structuredAttributes === null)) {
+    throw new CorrectionContractError("MemoryDraft.structuredAttributes must be an object.");
+  }
+}
+function deterministicFallbackPlan(args) {
+  return {
+    planId: newPlanId(),
+    request: args.request,
+    namespace: args.namespace,
+    affected: args.affected,
+    classification: "outdated",
+    actions: [],
+    diff: "",
+    confidence: 0,
+    warnings: [...args.warnings, "planner LLM unavailable \u2014 manual action selection required"],
+    createdAt: args.createdAt,
+    expiresAt: args.expiresAt,
+    status: "pending"
+  };
+}
+function newPlanId() {
+  return `corr-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+var CorrectionContractError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CorrectionContractError";
+  }
+};
+
+// src/correction/correction-planner.ts
+import { mkdir as mkdir2, readFile as readFile3, rename as rename2, unlink, readdir as readdir2, writeFile as writeFile2 } from "fs/promises";
+import path4 from "path";
+var CorrectionPlanner = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * Plan a correction. `readableNamespaces` is the AUTHORIZED read scope the
+   * service resolved for this caller; the planner never trusts a caller string.
+   */
+  async plan(request, readableNamespaces) {
+    const cleaned = validateCorrectionRequest(request);
+    if (cleaned.text.length > CORRECTION_TEXT_MAX) {
+      throw new CorrectionContractError("CorrectionRequest.text too long.");
+    }
+    if (cleaned.targetIds && cleaned.targetIds.length > this.deps.maxAffected) {
+      throw new CorrectionContractError(
+        `Correction target list (${cleaned.targetIds.length}) exceeds maxAffected (${this.deps.maxAffected}) \u2014 narrow the target set.`
+      );
+    }
+    const namespaces = readableNamespaces;
+    if (namespaces.length === 0) {
+      throw new CorrectionContractError(
+        "Correction requires at least one readable namespace \u2014 principal has no read scope."
+      );
+    }
+    const located = await this.locateCandidates(cleaned, namespaces);
+    if (located.candidates.length === 0) {
+      return this.persist(
+        this.emptyPlan(cleaned, namespaces[0], "no matching memories found for the correction text")
+      );
+    }
+    const llm = await this.deps.classifyAndDraft({
+      text: cleaned.text,
+      candidates: located.candidates
+    });
+    for (const action of llm.actions) {
+      validateCorrectionAction(action);
+      if (action.kind === "redaction_rule") {
+        validateRedactionPattern(action.pattern);
+      }
+    }
+    const affected = this.deriveAffected(located.candidates, llm);
+    const touchedCount = new Set(
+      llm.actions.map(
+        (a) => a.kind === "supersede" ? a.loserId : a.kind === "edit" || a.kind === "retract" || a.kind === "rescope" ? a.memoryId : null
+      ).filter((id) => id !== null)
+    ).size;
+    if (touchedCount > this.deps.maxAffected) {
+      throw new CorrectionContractError(
+        `Correction touches ${touchedCount} memories, exceeding the maxAffected limit of ${this.deps.maxAffected}. Narrow the correction text or supply explicit targetIds.`
+      );
+    }
+    const candidateIds = new Set(located.candidates.map((c) => c.memoryId));
+    if (llm.actions.length > 0 && candidateIds.size > 0) {
+      const filtered = llm.actions.filter((action) => {
+        const id = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : null;
+        return id === null || candidateIds.has(id);
+      });
+      if (filtered.length < llm.actions.length) {
+        const dropped = llm.actions.length - filtered.length;
+        llm.warnings = [...llm.warnings, `${dropped} action(s) targeted memories outside the located candidate set and were dropped (prompt-injection guard).`];
+        llm.actions = filtered;
+      }
+    }
+    const diff = llm.fallback ? "" : await this.deps.renderDiff({ candidates: located.candidates, actions: llm.actions });
+    const createdAt = this.deps.now().toISOString();
+    const expiresAt = new Date(
+      this.deps.now().getTime() + this.deps.planTtlHours * 60 * 60 * 1e3
+    ).toISOString();
+    const plan = llm.fallback ? deterministicFallbackPlan({
+      request: cleaned,
+      namespace: namespaces[0],
+      affected,
+      warnings: llm.warnings,
+      createdAt,
+      expiresAt
+    }) : {
+      planId: newPlanId(),
+      request: cleaned,
+      namespace: namespaces[0],
+      affected,
+      classification: llm.classification,
+      actions: llm.actions,
+      diff,
+      confidence: clampConfidence(llm.confidence),
+      warnings: llm.warnings,
+      createdAt,
+      expiresAt,
+      status: "pending"
+    };
+    return this.persist(plan);
+  }
+  async locateCandidates(request, namespaces) {
+    if (request.targetIds && request.targetIds.length > 0) {
+      const targets = await this.deps.resolveTargets({
+        targetIds: request.targetIds,
+        namespaces
+      });
+      const seedIds2 = targets.map((c) => c.memoryId);
+      const neighbors2 = await this.deps.expandNeighbors({
+        seedIds: seedIds2,
+        namespaces,
+        limit: this.deps.maxAffected
+      });
+      return { candidates: mergeCandidates(targets, neighbors2).slice(0, this.deps.maxAffected) };
+    }
+    const searched = await this.deps.searchCorpus({
+      text: request.text,
+      namespaces,
+      limit: this.deps.maxAffected
+    });
+    if (searched.length === 0) return { candidates: [] };
+    const seedIds = searched.slice(0, Math.min(5, searched.length)).map((c) => c.memoryId);
+    const neighbors = await this.deps.expandNeighbors({
+      seedIds,
+      namespaces,
+      limit: this.deps.maxAffected
+    });
+    return { candidates: mergeCandidates(searched, neighbors).slice(0, this.deps.maxAffected) };
+  }
+  deriveAffected(candidates, llm) {
+    const byId = new Map(candidates.map((c) => [c.memoryId, c]));
+    const out = [];
+    for (const rel of llm.relevance) {
+      const c = byId.get(rel.memoryId);
+      if (!c) continue;
+      out.push({
+        memoryId: c.memoryId,
+        path: c.path,
+        excerpt: c.excerpt,
+        why: rel.why,
+        ...c.sourceQuote ? { sourceQuote: c.sourceQuote } : {}
+      });
+    }
+    const annotated = new Set(out.map((e) => e.memoryId));
+    for (const action of llm.actions) {
+      const id = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : null;
+      if (id && !annotated.has(id)) {
+        const c = byId.get(id);
+        if (c) {
+          out.push({
+            memoryId: c.memoryId,
+            path: c.path,
+            excerpt: c.excerpt,
+            why: "touched by a drafted action",
+            ...c.sourceQuote ? { sourceQuote: c.sourceQuote } : {}
+          });
+          annotated.add(id);
+        }
+      }
+    }
+    return out;
+  }
+  emptyPlan(request, namespace, warning) {
+    const createdAt = this.deps.now().toISOString();
+    const expiresAt = new Date(
+      this.deps.now().getTime() + this.deps.planTtlHours * 60 * 60 * 1e3
+    ).toISOString();
+    return {
+      planId: newPlanId(),
+      request,
+      namespace,
+      affected: [],
+      classification: "outdated",
+      actions: [],
+      diff: "",
+      confidence: 0,
+      warnings: [warning],
+      createdAt,
+      expiresAt,
+      status: "pending"
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Plan persistence — atomic write (rule 54), serialized per plan id (rule 40).
+  // -------------------------------------------------------------------------
+  /** Directory holding pending plans for one namespace. */
+  async pendingDir(namespace) {
+    return path4.join(await this.deps.storageDir(namespace), "state", "corrections", "pending");
+  }
+  async persist(plan) {
+    const dir = await this.pendingDir(plan.namespace);
+    const target = path4.join(dir, `${plan.planId}.json`);
+    await serializeMutations(`correction-plan:${target}`, async () => {
+      await mkdir2(dir, { recursive: true });
+      const tmp = `${target}.${process.pid}.${Date.now().toString(36)}.tmp`;
+      await writeFile2(tmp, `${JSON.stringify(plan)}
+`, "utf-8");
+      await rename2(tmp, target);
+    });
+    return plan;
+  }
+  /** Load a pending plan by id (used by the service / executor). */
+  async loadPlan(namespace, planId) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    return serializeMutations(`correction-plan:${file}`, async () => {
+      let raw;
+      try {
+        raw = await readFile3(file, "utf-8");
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return null;
+        throw err;
+      }
+      return parsePlan(raw);
+    });
+  }
+  /** List pending plans (newest first), excluding consumed (applied/discarded). */
+  async listPending(namespace) {
+    const dir = await this.pendingDir(namespace);
+    let files;
+    try {
+      files = await readdir2(dir);
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      throw err;
+    }
+    const plans = [];
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      let plan = null;
+      try {
+        plan = await this.loadPlan(namespace, f.replace(/\.json$/, ""));
+      } catch {
+        continue;
+      }
+      if (plan && plan.status === "pending") plans.push(plan);
+    }
+    plans.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
+    return plans;
+  }
+  async markConsumed(namespace, planId, status) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    await serializeMutations(`correction-plan:${file}`, async () => {
+      let raw;
+      try {
+        raw = await readFile3(file, "utf-8");
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return;
+        throw err;
+      }
+      const plan = parsePlan(raw);
+      if (!plan) return;
+      plan.status = status;
+      const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.tmp`;
+      await writeFile2(tmp, `${JSON.stringify(plan)}
+`, "utf-8");
+      await rename2(tmp, file);
+    });
+  }
+  async deletePlan(namespace, planId) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    await serializeMutations(`correction-plan:${file}`, async () => {
+      try {
+        await unlink(file);
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return;
+        throw err;
+      }
+    });
+  }
+};
+function assertSafePlanId(planId) {
+  if (typeof planId !== "string" || planId.length === 0 || planId.includes("/") || planId.includes("\\") || planId.includes("\0") || planId === "." || planId === ".." || planId.startsWith(".") || planId.includes("..")) {
+    throw new CorrectionContractError(
+      `Invalid plan id: ${JSON.stringify(planId)} \u2014 must be a bare file basename with no path separators or parent segments.`
+    );
+  }
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.min(1, Math.max(0, n));
+}
+function mergeCandidates(a, b) {
+  const map = /* @__PURE__ */ new Map();
+  for (const c of a) {
+    const existing = map.get(c.memoryId);
+    if (!existing || c.score > existing.score) map.set(c.memoryId, c);
+  }
+  for (const c of b) {
+    const existing = map.get(c.memoryId);
+    if (!existing || c.score > existing.score) map.set(c.memoryId, c);
+  }
+  return [...map.values()].sort((x, y) => y.score - x.score);
+}
+function parsePlan(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const p = parsed;
+  if (typeof p.planId !== "string" || typeof p.namespace !== "string") return null;
+  if (typeof p.createdAt !== "string" || typeof p.expiresAt !== "string") return null;
+  if (!Array.isArray(p.actions) || !Array.isArray(p.affected)) return null;
+  for (const action of p.actions) {
+    try {
+      validateCorrectionAction(action);
+    } catch {
+      return null;
+    }
+  }
+  return parsed;
+}
+
+// src/correction/correction-executor.ts
+var CorrectionExecutor = class {
+  constructor(deps, planner) {
+    this.deps = deps;
+    this.planner = planner;
+  }
+  deps;
+  planner;
+  /**
+   * Apply a persisted plan by id. Idempotent-once: a second apply of the same
+   * plan is rejected. Returns the {@link CorrectionOutcome}.
+   */
+  async apply(namespace, planId, opts) {
+    if (!opts.confirm) {
+      throw new CorrectionContractError(
+        "Correction apply requires explicit confirmation (correction.applyRequiresConfirm)."
+      );
+    }
+    return serializeMutations(
+      `correction-apply:${namespace}:${planId}`,
+      () => this.applyInternal(namespace, planId, opts.canWriteDestination)
+    );
+  }
+  async applyInternal(namespace, planId, canWriteDestination) {
+    const plan = await this.planner.loadPlan(namespace, planId);
+    if (!plan) {
+      throw new CorrectionContractError(`Correction plan not found: ${planId}`);
+    }
+    if (plan.namespace !== namespace) {
+      throw new CorrectionContractError(
+        `Correction plan ${planId} belongs to namespace '${plan.namespace}', not '${namespace}'.`
+      );
+    }
+    if (plan.status === "applied" || plan.status === "partial" || plan.status === "applying") {
+      throw new CorrectionContractError(
+        `Correction plan ${planId} has already been applied or is in progress (status=${plan.status}).`
+      );
+    }
+    if (plan.status === "discarded") {
+      throw new CorrectionContractError(`Correction plan ${planId} has been discarded.`);
+    }
+    if (this.deps.now().getTime() > new Date(plan.expiresAt).getTime()) {
+      await this.planner.markConsumed(namespace, planId, "discarded");
+      throw new CorrectionContractError(
+        `Correction plan ${planId} expired at ${plan.expiresAt} and has been discarded.`
+      );
+    }
+    for (const action of plan.actions) {
+      validateCorrectionAction(action);
+      if (action.kind === "redaction_rule") {
+        validateRedactionPattern(action.pattern);
+      }
+    }
+    try {
+      await this.planner.markConsumed(namespace, planId, "applying");
+    } catch {
+      throw new CorrectionContractError(
+        `Correction plan ${planId}: cannot mark in-progress (filesystem unwritable?) \u2014 aborting before any mutation.`
+      );
+    }
+    const results = [];
+    const appliedTouched = [];
+    for (const action of plan.actions) {
+      if (action.kind === "supersede" && action.replacement) {
+        const loser = await this.deps.getMemory(namespace, action.loserId);
+        if (!loser) {
+          results.push({
+            action,
+            status: "failed",
+            error: `supersede loser not found: ${action.loserId}`
+          });
+          continue;
+        }
+        try {
+          const newId = await this.deps.writeReplacement(namespace, {
+            content: action.replacement.content,
+            ...action.replacement.category ? { category: action.replacement.category } : {},
+            ...action.replacement.confidence !== void 0 ? { confidence: action.replacement.confidence } : {},
+            ...action.replacement.tags ? { tags: action.replacement.tags } : {},
+            ...action.replacement.entityRef ? { entityRef: action.replacement.entityRef } : {},
+            ...action.replacement.validAt ? { validAt: action.replacement.validAt } : {},
+            ...action.replacement.observedAt ? { observedAt: action.replacement.observedAt } : {},
+            ...action.replacement.structuredAttributes ? { structuredAttributes: action.replacement.structuredAttributes } : {},
+            supersedes: action.loserId
+          });
+          results.push({ action, status: "applied", memoryId: newId });
+          appliedTouched.push(newId);
+        } catch (err) {
+          results.push({
+            action,
+            status: "failed",
+            error: errMsg(err)
+          });
+        }
+      } else if (action.kind === "edit") {
+        try {
+          const editedId = await this.deps.applyEdit(namespace, action.memoryId, action.patch);
+          results.push({ action, status: "applied", memoryId: editedId });
+          appliedTouched.push(editedId);
+        } catch (err) {
+          results.push({ action, status: "failed", error: errMsg(err) });
+        }
+      } else if (action.kind === "redaction_rule") {
+        try {
+          await this.deps.registerRedactionRule(namespace, action.pattern);
+          results.push({ action, status: "applied" });
+        } catch (err) {
+          results.push({ action, status: "failed", error: errMsg(err) });
+        }
+      }
+    }
+    for (const action of plan.actions) {
+      if (action.kind === "supersede") {
+        const replacementResult = results.find(
+          (r) => r.action === action && r.status === "applied"
+        );
+        if (action.replacement && !replacementResult) {
+          continue;
+        }
+        await this.retireAndTombstone(namespace, action, "supersession", results, appliedTouched, {
+          supersededBy: replacementResult?.memoryId
+        });
+      } else if (action.kind === "retract") {
+        await this.retireAndTombstone(namespace, action, "retraction", results, appliedTouched);
+      } else if (action.kind === "rescope") {
+        try {
+          const allowed = canWriteDestination ? await canWriteDestination(action.toNamespace) : true;
+          if (!allowed) {
+            results.push({
+              action,
+              status: "failed",
+              error: `rescope destination namespace not writable: ${action.toNamespace}`
+            });
+            continue;
+          }
+          const destId = await this.deps.rescopeMemory(namespace, action.memoryId, action.toNamespace);
+          results.push({ action, status: "applied", memoryId: action.memoryId });
+          appliedTouched.push(action.memoryId);
+          try {
+            await this.deps.propagate(action.toNamespace, [destId]);
+          } catch {
+          }
+        } catch (err) {
+          results.push({ action, status: "failed", error: errMsg(err) });
+        }
+      }
+    }
+    const propagationWarnings = [];
+    if (appliedTouched.length > 0) {
+      try {
+        await this.deps.propagate(namespace, appliedTouched);
+      } catch (err) {
+        propagationWarnings.push(`propagation failed (non-fatal): ${errMsg(err)}`);
+      }
+    }
+    const anyFailed = results.some((r) => r.status === "failed");
+    const status = anyFailed ? "partial" : "applied";
+    const appliedAt = this.deps.now().toISOString();
+    const outcome = {
+      planId,
+      status,
+      results,
+      auditMemoryId: "",
+      // filled after the audit write
+      appliedAt
+    };
+    if (propagationWarnings.length > 0) {
+      outcome.warnings = propagationWarnings;
+    }
+    try {
+      const auditId = await this.deps.appendAuditRecord(namespace, {
+        planId,
+        classification: plan.classification,
+        outcome,
+        requestText: plan.request.text
+      });
+      outcome.auditMemoryId = auditId;
+    } catch (err) {
+      outcome.warnings = [
+        ...propagationWarnings,
+        `audit record write failed (non-fatal): ${errMsg(err)}`
+      ];
+    }
+    try {
+      await this.planner.markConsumed(namespace, planId, status);
+    } catch (err) {
+      const w = outcome;
+      w.warnings = [...w.warnings ?? [], `plan mark-consumed failed (non-fatal): ${errMsg(err)}`];
+    }
+    return outcome;
+  }
+  async retireAndTombstone(namespace, action, reason, results, appliedTouched, opts = {}) {
+    const memoryId = action.kind === "supersede" ? action.loserId : action.kind === "retract" ? action.memoryId : null;
+    if (!memoryId) return;
+    try {
+      const memory = await this.deps.getMemory(namespace, memoryId);
+      if (!memory) {
+        results.push({
+          action,
+          status: "failed",
+          error: `memory not found: ${memoryId}`
+        });
+        return;
+      }
+      const validUntil = this.deps.biTemporalEnabled ? this.deps.now().toISOString() : void 0;
+      const tombstoneId = await this.deps.appendTombstone(namespace, {
+        reason,
+        sourceMemoryId: memoryId,
+        rawContent: memory.rawContent,
+        ...memory.entityRef ? { entityRef: memory.entityRef } : {},
+        ...memory.supersessionKey ? { supersessionKey: memory.supersessionKey } : {}
+      });
+      await this.deps.retireMemory(namespace, memoryId, {
+        status: reason === "supersession" ? "superseded" : "retracted",
+        ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
+        ...validUntil ? { validUntil } : {}
+      });
+      results.push({
+        action,
+        status: "applied",
+        memoryId,
+        ...tombstoneId ? { tombstoneId } : {}
+      });
+      appliedTouched.push(memoryId);
+    } catch (err) {
+      results.push({ action, status: "failed", error: errMsg(err) });
+    }
+  }
+};
+function errMsg(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+
+// src/correction/correction-service.ts
+var CorrectionService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.planner = new CorrectionPlanner(deps.plannerDeps());
+    this.executor = new CorrectionExecutor(deps.executorDeps(), this.planner);
+  }
+  deps;
+  planner;
+  executor;
+  /**
+   * Plan a correction. Read-only — produces + persists a {@link CorrectionPlan}.
+   * Safe to run with the gate ON (default) since the plan writes no memory state.
+   *
+   * The plan is stored under the AUTHORIZED (writable) namespace — the same
+   * namespace apply/listPending/discard resolve — so the plan is always
+   * found by the caller that created it (review threads: plan-stored-wrong-
+   * namespace + cross-namespace candidate mismatch). Candidates are located
+   * within that single namespace too: a correction can only affect memories
+   * the principal can write, so reading from a non-writable namespace to
+   * draft a correction that can never be applied would be misleading.
+   */
+  async plan(request) {
+    this.requireEnabled();
+    const authorized = await this.deps.policy.resolveAuthorizedNamespace(request);
+    return this.planner.plan(request, [authorized]);
+  }
+  /**
+   * Apply a persisted plan by id. Requires `confirm: true` (or interactive
+   * yes at the CLI) when `applyRequiresConfirm` is on (default).
+   */
+  async apply(planId, opts) {
+    this.requireEnabled();
+    if (this.deps.applyRequiresConfirm() && opts.confirm !== true) {
+      throw new CorrectionContractError(
+        "Correction apply requires explicit confirmation (pass `confirm: true`)."
+      );
+    }
+    const namespace = await this.deps.policy.resolveAuthorizedNamespace({
+      ...opts.namespace ? { namespace: opts.namespace } : {},
+      ...opts.sessionKey ? { sessionKey: opts.sessionKey } : {},
+      ...opts.principal ? { principal: opts.principal } : {}
+    });
+    return this.executor.apply(namespace, planId, {
+      confirm: true,
+      // Authorize rescope destinations through the namespace policy bound to
+      // THIS caller's principal (review thread: authorize-rescope-destination).
+      canWriteDestination: (dest) => this.deps.policy.canWriteNamespace({
+        namespace: dest,
+        ...opts.sessionKey ? { sessionKey: opts.sessionKey } : {},
+        ...opts.principal ? { principal: opts.principal } : {}
+      })
+    });
+  }
+  /** List pending (not-yet-applied) plans for the caller's namespace. */
+  async listPending(opts) {
+    this.requireEnabled();
+    const namespace = await this.deps.policy.resolveAuthorizedNamespace(opts);
+    return this.planner.listPending(namespace);
+  }
+  /** Discard a pending plan. Idempotent. */
+  async discard(planId, opts) {
+    this.requireEnabled();
+    const namespace = await this.deps.policy.resolveAuthorizedNamespace(opts);
+    await this.planner.markConsumed(namespace, planId, "discarded");
+    await this.planner.deletePlan(namespace, planId);
+  }
+  requireEnabled() {
+    if (!this.deps.isEnabled()) {
+      throw new CorrectionContractError(
+        "Correction Contract is disabled (set correction.enabled = true to enable)."
+      );
+    }
+  }
+};
+
+// src/correction/correction-access-wiring.ts
+import path5 from "path";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+function createCorrectionService(wiring) {
+  const cfg = wiring.orchestrator.config;
+  const correctionEnabled = isCorrectionFeatureEnabled(cfg);
+  const applyRequiresConfirm = typeof cfg.correctionApplyRequiresConfirm === "boolean" ? cfg.correctionApplyRequiresConfirm : readCorrectionFlag(cfg, "applyRequiresConfirm", true);
+  const maxAffected = typeof cfg.correctionMaxAffected === "number" && cfg.correctionMaxAffected >= 1 ? Math.floor(cfg.correctionMaxAffected) : readCorrectionNumber(cfg, "maxAffected", 10);
+  const planTtlHours = typeof cfg.correctionPlanTtlHours === "number" && cfg.correctionPlanTtlHours > 0 ? cfg.correctionPlanTtlHours : readCorrectionNumber(cfg, "planTtlHours", 24);
+  const biTemporalEnabled = cfg.temporalBiTemporal === true;
+  const serviceDeps = {
+    policy: {
+      resolveAuthorizedNamespace: (req) => wiring.resolveAuthorizedNamespace(req),
+      canWriteNamespace: (req) => wiring.canWriteNamespace(req),
+      readableNamespaces: (req) => Promise.resolve(wiring.resolveReadableNamespaces(req))
+    },
+    plannerDeps: () => makePlannerDeps(wiring, { maxAffected, planTtlHours }),
+    executorDeps: () => makeExecutorDeps(wiring, { biTemporalEnabled }),
+    isEnabled: () => correctionEnabled,
+    applyRequiresConfirm: () => applyRequiresConfirm
+  };
+  return new CorrectionService(serviceDeps);
+}
+function makePlannerDeps(wiring, opts) {
+  return {
+    searchCorpus: async ({ text, namespaces, limit }) => searchMemories(wiring, text, namespaces, limit),
+    resolveTargets: async ({ targetIds, namespaces }) => resolveTargetMemories(wiring, targetIds, namespaces),
+    expandNeighbors: async ({ seedIds, namespaces, limit }) => expandEntityNeighbors(wiring, seedIds, namespaces, limit),
+    classifyAndDraft: async ({ text, candidates }) => classifyAndDraft(wiring, text, candidates),
+    renderDiff: async ({ candidates, actions }) => renderCorrectionDiff(wiring, candidates, actions),
+    storageDir: async (namespace) => (await wiring.orchestrator.getStorage(namespace)).dir,
+    maxAffected: opts.maxAffected,
+    planTtlHours: opts.planTtlHours,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function searchMemories(wiring, text, namespaces, limit) {
+  const tokens = tokenize(text);
+  if (tokens.length === 0) return [];
+  const scored = [];
+  for (const ns of namespaces) {
+    const storage = await wiring.orchestrator.getStorage(ns);
+    const all = await storage.readAllMemories();
+    for (const m of all) {
+      if (m.frontmatter.status && m.frontmatter.status !== "active") continue;
+      const hay = `${m.content} ${m.frontmatter.tags?.join(" ") ?? ""}`.toLowerCase();
+      let hits = 0;
+      for (const tok of tokens) {
+        if (hay.includes(tok)) hits++;
+      }
+      if (hits === 0) continue;
+      scored.push({ m, ns, score: hits / tokens.length });
+    }
+  }
+  scored.sort((a, b) => b.score - a.score);
+  return scored.slice(0, limit).map((s, i) => toCandidate(s.m, s.ns, s.score - i * 0.01));
+}
+function tokenize(text) {
+  const STOP = /* @__PURE__ */ new Set([
+    "the",
+    "a",
+    "an",
+    "is",
+    "are",
+    "was",
+    "were",
+    "be",
+    "been",
+    "being",
+    "to",
+    "of",
+    "in",
+    "on",
+    "at",
+    "by",
+    "for",
+    "with",
+    "from",
+    "into",
+    "and",
+    "or",
+    "but",
+    "not",
+    "no",
+    "yes",
+    "this",
+    "that",
+    "these",
+    "those",
+    "it",
+    "its",
+    "we",
+    "you",
+    "i",
+    "he",
+    "she",
+    "they",
+    "them",
+    "our",
+    "your",
+    "my",
+    "his",
+    "her",
+    "their",
+    "as",
+    "so",
+    "if",
+    "then",
+    "than",
+    "too",
+    "very",
+    "can",
+    "will",
+    "just",
+    "should",
+    "now",
+    "has",
+    "have",
+    "had",
+    "do",
+    "does",
+    "did",
+    "about",
+    "which",
+    "what",
+    "who",
+    "when",
+    "where",
+    "why",
+    "how",
+    "all",
+    "each",
+    "every",
+    "both",
+    "few",
+    "more",
+    "most",
+    "other",
+    "some",
+    "such",
+    "only",
+    "own",
+    "same",
+    "up"
+  ]);
+  const raw = text.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  const out = raw.filter((w) => w.length >= 3 && !STOP.has(w));
+  return [...new Set(out)];
+}
+async function resolveTargetMemories(wiring, targetIds, namespaces) {
+  const out = [];
+  const missing = [];
+  for (const id of targetIds) {
+    let found = null;
+    for (const ns of namespaces) {
+      const storage = await wiring.orchestrator.getStorage(ns);
+      const m = await storage.getMemoryById(id);
+      if (m) {
+        found = toCandidate(m, ns, 1);
+        break;
+      }
+    }
+    if (found) out.push(found);
+    else missing.push(id);
+  }
+  if (missing.length > 0) {
+    throw new CorrectionContractError(`target memory not found: ${missing[0]}`);
+  }
+  return out;
+}
+async function expandEntityNeighbors(wiring, seedIds, namespaces, limit) {
+  if (seedIds.length === 0 || limit <= 0 || namespaces.length === 0) return [];
+  const out = [];
+  const seen = new Set(seedIds);
+  const seedRefs = /* @__PURE__ */ new Set();
+  for (const ns of namespaces) {
+    const storage = await wiring.orchestrator.getStorage(ns);
+    const all = await storage.readAllMemories();
+    for (const m of all) {
+      if (seedIds.includes(m.frontmatter.id) && m.frontmatter.entityRef) {
+        seedRefs.add(m.frontmatter.entityRef);
+      }
+    }
+  }
+  if (seedRefs.size === 0) return [];
+  for (const ns of namespaces) {
+    if (out.length >= limit) break;
+    const storage = await wiring.orchestrator.getStorage(ns);
+    const all = await storage.readAllMemories();
+    for (const m of all) {
+      if (out.length >= limit) break;
+      if (seen.has(m.frontmatter.id)) continue;
+      if (m.frontmatter.status && m.frontmatter.status !== "active") continue;
+      if (m.frontmatter.entityRef && seedRefs.has(m.frontmatter.entityRef)) {
+        out.push(toCandidate(m, ns, 0.5));
+        seen.add(m.frontmatter.id);
+      }
+    }
+  }
+  return out;
+}
+async function classifyAndDraft(wiring, text, candidates) {
+  try {
+    if (!wiring.llmComplete) {
+      return fallbackClassification(candidates, "no LLM client available");
+    }
+    const user = buildClassifyPrompt(text, candidates);
+    const raw = await wiring.llmComplete({ system: CLASSIFY_SYSTEM_PROMPT, user });
+    return parseClassifyResponse(raw, candidates);
+  } catch (err) {
+    return fallbackClassification(candidates, `LLM unavailable: ${errMsg2(err)}`);
+  }
+}
+async function renderCorrectionDiff(_wiring, candidates, actions) {
+  const lines = [];
+  for (const action of actions) {
+    const id = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : null;
+    const candidate = id ? candidates.find((c) => c.memoryId === id) : null;
+    const before = candidate?.content ?? "(new)";
+    const after = describeAfterState(action);
+    lines.push(`--- ${id ?? "redaction-rule"} (${action.kind})`);
+    lines.push(`- ${before.slice(0, 120)}`);
+    lines.push(`+ ${after.slice(0, 120)}`);
+  }
+  return lines.join("\n");
+}
+function describeAfterState(action) {
+  switch (action.kind) {
+    case "supersede":
+      return action.replacement?.content ?? "(superseded without replacement)";
+    case "edit":
+      return action.patch;
+    case "retract":
+      return "(retracted + tombstoned)";
+    case "rescope":
+      return `(moved to namespace '${action.toNamespace}')`;
+    case "redaction_rule":
+      return `(redaction rule persisted for pattern '${action.pattern}')`;
+  }
+}
+function makeExecutorDeps(wiring, opts) {
+  return {
+    getMemory: async (namespace, memoryId) => getExecutorMemory(wiring, namespace, memoryId),
+    writeReplacement: async (namespace, draft) => writeReplacementMemory(wiring, namespace, draft),
+    applyEdit: async (namespace, memoryId, patch) => applyEditMemory(wiring, namespace, memoryId, patch),
+    retireMemory: async (namespace, memoryId, retireOpts) => retireMemoryFn(wiring, namespace, memoryId, retireOpts),
+    rescopeMemory: async (namespace, memoryId, toNamespace) => rescopeMemoryFn(wiring, namespace, memoryId, toNamespace),
+    appendTombstone: async (namespace, input) => appendTombstoneFn(wiring, namespace, input),
+    registerRedactionRule: async (namespace, pattern) => registerRedactionRuleFn(wiring, namespace, pattern),
+    appendAuditRecord: async (namespace, record) => appendAuditRecordFn(wiring, namespace, record),
+    propagate: async (namespace, touchedMemoryIds) => propagateFn(wiring, namespace, touchedMemoryIds),
+    biTemporalEnabled: opts.biTemporalEnabled,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function getExecutorMemory(wiring, namespace, memoryId) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const m = await storage.getMemoryById(memoryId);
+  if (!m) return null;
+  return toExecutorMemory(m);
+}
+async function writeReplacementMemory(wiring, namespace, draft) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const id = await storage.writeMemory(
+    draft.category ?? "fact",
+    draft.content,
+    {
+      source: "correction",
+      confidence: draft.confidence ?? 0.9,
+      tags: draft.tags ?? [],
+      ...draft.entityRef ? { entityRef: draft.entityRef } : {},
+      ...draft.validAt ? { validAt: draft.validAt } : {},
+      ...draft.observedAt ? { observedAt: draft.observedAt } : {},
+      ...draft.structuredAttributes ? { structuredAttributes: draft.structuredAttributes } : {},
+      ...draft.supersedes ? { supersedes: draft.supersedes } : {}
+    }
+  );
+  return id;
+}
+async function applyEditMemory(wiring, namespace, memoryId, patch) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const existing = await storage.getMemoryById(memoryId);
+  if (!existing) throw new CorrectionContractError(`memory not found for edit: ${memoryId}`);
+  await storage.writeMemoryFrontmatter(
+    { ...existing, content: patch },
+    { updated: (/* @__PURE__ */ new Date()).toISOString() }
+  );
+  return memoryId;
+}
+async function retireMemoryFn(wiring, namespace, memoryId, opts) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const memory = await storage.getMemoryById(memoryId);
+  if (!memory) throw new CorrectionContractError(`memory not found for retire: ${memoryId}`);
+  const storageStatus = opts.status === "retracted" ? "forgotten" : "superseded";
+  await storage.writeMemoryFrontmatter(memory, {
+    status: storageStatus,
+    ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
+    ...opts.status === "superseded" ? { supersededAt: (/* @__PURE__ */ new Date()).toISOString() } : {},
+    // validUntil is the bi-temporal end; absent when the gate is off.
+    ...opts.validUntil ? { invalid_at: opts.validUntil } : {}
+  });
+}
+async function rescopeMemoryFn(wiring, namespace, memoryId, toNamespace) {
+  const sourceStorage = await wiring.orchestrator.getStorage(namespace);
+  const memory = await sourceStorage.getMemoryById(memoryId);
+  if (!memory) throw new CorrectionContractError(`memory not found for rescope: ${memoryId}`);
+  if (memory.frontmatter.status && memory.frontmatter.status !== "active") {
+    throw new CorrectionContractError(
+      `cannot rescope memory ${memoryId}: source is ${memory.frontmatter.status}, not active`
+    );
+  }
+  const destStorage = await wiring.orchestrator.getStorage(toNamespace);
+  const fm = memory.frontmatter;
+  const destContent = fm.structuredAttributes ? stripAttributesSuffix(memory.content) : memory.content;
+  const destId = await destStorage.writeMemory(fm.category, destContent, {
+    source: `correction:rescope:${namespace}`,
+    ...typeof fm.confidence === "number" ? { confidence: fm.confidence } : {},
+    ...Array.isArray(fm.tags) ? { tags: fm.tags } : {},
+    ...fm.entityRef ? { entityRef: fm.entityRef } : {},
+    ...fm.structuredAttributes ? { structuredAttributes: fm.structuredAttributes } : {},
+    ...fm.valid_at ? { validAt: fm.valid_at } : {},
+    ...fm.observedAt ? { observedAt: fm.observedAt } : {},
+    ...fm.memoryKind ? { memoryKind: fm.memoryKind } : {},
+    ...Array.isArray(fm.links) ? { links: fm.links } : {},
+    ...fm.intentGoal ? { intentGoal: fm.intentGoal } : {}
+  });
+  try {
+    await sourceStorage.writeMemoryFrontmatter(memory, {
+      status: "archived",
+      archivedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  } catch (err) {
+    try {
+      const destMem = await destStorage.getMemoryById(destId);
+      if (destMem) {
+        await destStorage.writeMemoryFrontmatter(destMem, {
+          status: "archived",
+          archivedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    } catch {
+    }
+    throw err;
+  }
+  return destId;
+}
+async function appendTombstoneFn(wiring, namespace, input) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const enabled = typeof storage.isTombstonesEnabled === "function" ? storage.isTombstonesEnabled() : true;
+  const result = await storage.appendTombstone({
+    reason: input.reason,
+    createdBy: "user_correction",
+    sourceMemoryId: input.sourceMemoryId,
+    rawContent: input.rawContent,
+    ...input.entityRef ? { entityRef: input.entityRef } : {},
+    ...input.supersessionKey ? { supersessionKey: input.supersessionKey } : {}
+  });
+  if (result === null && enabled) {
+    throw new CorrectionContractError(
+      `tombstone persistence failed for memory ${input.sourceMemoryId} (tombstones enabled but store returned null \u2014 I/O error swallowed)`
+    );
+  }
+  return result;
+}
+async function registerRedactionRuleFn(wiring, namespace, pattern) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const dir = path5.join(storage.dir, "state", "corrections", "redaction-rules");
+  await mkdir3(dir, { recursive: true });
+  const slug = pattern.replace(/[^a-zA-Z0-9]+/g, "-").slice(0, 64) || "rule";
+  await writeFile3(
+    path5.join(dir, `${slug}.json`),
+    `${JSON.stringify({ pattern, namespace, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`,
+    "utf-8"
+  );
+}
+async function appendAuditRecordFn(wiring, namespace, record) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const id = await storage.writeMemory("correction", buildAuditBody(record), {
+    source: "correction-contract",
+    confidence: 1,
+    tags: ["correction-audit", `plan:${record.planId}`, `classification:${record.classification}`]
+  });
+  return id;
+}
+function buildAuditBody(record) {
+  const sensitive = record.classification === "never_store" || record.outcome.results.some((r) => r.action.kind === "redaction_rule");
+  const safeRequest = sensitive ? "[redacted \u2014 never-store/redaction correction text withheld from the audit trail]" : record.requestText.slice(0, 200);
+  const lines = [
+    `Correction plan ${record.planId} applied (${record.outcome.status}).`,
+    "",
+    `Request: ${safeRequest}`,
+    `Classification: ${record.classification}`,
+    `Applied at: ${record.outcome.appliedAt}`,
+    "",
+    "Actions:"
+  ];
+  for (const r of record.outcome.results) {
+    const withhold = r.action.kind === "redaction_rule" || record.classification === "never_store";
+    const errPart = r.error ? withhold ? " (error withheld)" : ` (${r.error})` : "";
+    lines.push(`  - ${r.action.kind}: ${r.status}${errPart}`);
+  }
+  return lines.join("\n");
+}
+async function propagateFn(wiring, namespace, touchedMemoryIds) {
+  for (const id of touchedMemoryIds) {
+    try {
+      const storage = await wiring.orchestrator.getStorage(namespace);
+      const orchestrator = wiring.orchestrator;
+      if (typeof orchestrator.indexPersistedMemory === "function") {
+        await orchestrator.indexPersistedMemory(storage, id);
+      }
+    } catch {
+    }
+  }
+}
+function toCandidate(m, namespace, score) {
+  return {
+    memoryId: m.frontmatter.id,
+    path: m.path,
+    content: m.content,
+    excerpt: m.content.slice(0, 160),
+    ...m.frontmatter.entityRef ? { entityRef: m.frontmatter.entityRef } : {},
+    score
+    // namespace is implicit (the planner scopes by namespace); keep it on the
+    // candidate for diff rendering if needed.
+  };
+}
+function toExecutorMemory(m) {
+  const fm = m.frontmatter;
+  const rawBody = fm.structuredAttributes ? stripAttributesSuffix(m.content) : m.content;
+  return {
+    memoryId: fm.id,
+    content: m.content,
+    category: fm.category,
+    rawContent: rawBody,
+    ...fm.entityRef ? { entityRef: fm.entityRef } : {}
+  };
+}
+function isCorrectionFeatureEnabled(config) {
+  if (typeof config.correctionEnabled === "boolean") return config.correctionEnabled;
+  const nested = config.correction;
+  if (nested && typeof nested.enabled === "boolean") return nested.enabled;
+  if (nested && typeof nested.enabled === "string") return nested.enabled === "true" || nested.enabled === "1";
+  return readCorrectionFlag(config, "enabled", true);
+}
+function readCorrectionFlag(config, key, fallback) {
+  const nested = config.correction;
+  if (nested && typeof nested[key] === "boolean") return nested[key];
+  if (nested && typeof nested[key] === "string") return nested[key] === "true" || nested[key] === "1";
+  const raw = config[`correction${capitalize(key)}`];
+  if (typeof raw === "boolean") return raw;
+  if (typeof raw === "string") return raw === "true" || raw === "1";
+  return fallback;
+}
+function readCorrectionNumber(config, key, fallback) {
+  const nested = config.correction;
+  if (nested) {
+    const nv = nested[key];
+    if (typeof nv === "number" && Number.isFinite(nv)) return nv;
+    if (typeof nv === "string") {
+      const nn = Number(nv);
+      if (Number.isFinite(nn)) return nn;
+    }
+  }
+  const raw = config[`correction${capitalize(key)}`];
+  if (typeof raw === "number" && Number.isFinite(raw)) return raw;
+  if (typeof raw === "string") {
+    const n = Number(raw);
+    if (Number.isFinite(n)) return n;
+  }
+  return fallback;
+}
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+function errMsg2(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+var CLASSIFY_SYSTEM_PROMPT = `You classify memory corrections and draft per-memory actions.
+
+Given a correction statement and candidate memories, respond with a JSON object:
+{
+  "classification": "wrong" | "outdated" | "incomplete" | "wrong_scope" | "never_store",
+  "confidence": <number 0..1>,
+  "actions": [<one or more correction actions>],
+  "relevance": [{"memoryId": "<id>", "why": "<one short sentence>"}]
+}
+
+Action shapes:
+- {"kind":"supersede","loserId":"<id>","replacement":{"content":"<new fact>"}}
+- {"kind":"edit","memoryId":"<id>","patch":"<new full content>"}
+- {"kind":"retract","memoryId":"<id>"}
+- {"kind":"rescope","memoryId":"<id>","toNamespace":"<ns>"}
+- {"kind":"redaction_rule","pattern":"<bounded literal or regex>"}
+
+Only emit actions you are confident in. If uncertain, return confidence < 0.5 and few actions.`;
+function buildClassifyPrompt(text, candidates) {
+  const lines = [
+    `Correction: ${text}`,
+    "",
+    "Candidate memories:"
+  ];
+  for (const c of candidates.slice(0, 20)) {
+    lines.push(`[${c.memoryId}] ${c.excerpt}`);
+  }
+  lines.push("", "Respond with the JSON object only.");
+  return lines.join("\n");
+}
+function parseClassifyResponse(raw, candidates) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return fallbackClassification(candidates, "LLM returned non-JSON response");
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return fallbackClassification(candidates, "LLM returned non-object response");
+  }
+  const obj = parsed;
+  const classification = isClassification(obj.classification) ? obj.classification : "outdated";
+  const confidence = typeof obj.confidence === "number" ? Math.min(1, Math.max(0, obj.confidence)) : 0.5;
+  const rawActions = Array.isArray(obj.actions) ? obj.actions : [];
+  const actions = [];
+  const warnings = [];
+  for (const rawAction of rawActions) {
+    try {
+      validateCorrectionAction(rawAction);
+      actions.push(rawAction);
+    } catch (err) {
+      warnings.push(`dropped malformed action: ${errMsg2(err)}`);
+    }
+  }
+  const relevance = Array.isArray(obj.relevance) ? obj.relevance.filter((r) => !!r && typeof r === "object").map((r) => ({
+    memoryId: typeof r.memoryId === "string" ? r.memoryId : "",
+    why: typeof r.why === "string" ? r.why : ""
+  })).filter((r) => r.memoryId.length > 0) : [];
+  return {
+    classification,
+    confidence,
+    actions,
+    relevance,
+    warnings
+  };
+}
+function isClassification(value) {
+  return value === "wrong" || value === "outdated" || value === "incomplete" || value === "wrong_scope" || value === "never_store";
+}
+function fallbackClassification(candidates, reason) {
+  return {
+    classification: "outdated",
+    confidence: 0,
+    actions: [],
+    relevance: candidates.map((c) => ({ memoryId: c.memoryId, why: "located for review" })),
+    warnings: [reason],
+    fallback: true
+  };
+}
+
 // src/procedural/procedure-miner.ts
 import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir2, rm, stat } from "fs/promises";
-import path4 from "path";
+import { mkdir as mkdir4, rm, stat } from "fs/promises";
+import path6 from "path";
 var PROCEDURE_CLUSTER_ATTR_MAX = 500;
 var PROCEDURE_CLUSTER_LOCK_STALE_MS = 12e4;
 var PROCEDURE_CLUSTER_LOCK_TIMEOUT_MS = 3e4;
@@ -2154,14 +3528,14 @@ function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function acquireClusterWriteLock(memoryDir, clusterHash) {
-  const lockRoot = path4.join(path4.resolve(memoryDir), "state", "procedure-miner-locks");
-  const lockDir = path4.join(lockRoot, `${clusterHash}.lock`);
-  await mkdir2(lockRoot, { recursive: true });
+  const lockRoot = path6.join(path6.resolve(memoryDir), "state", "procedure-miner-locks");
+  const lockDir = path6.join(lockRoot, `${clusterHash}.lock`);
+  await mkdir4(lockRoot, { recursive: true });
   const startedAt = Date.now();
   let attempts = 0;
   while (true) {
     try {
-      await mkdir2(lockDir);
+      await mkdir4(lockDir);
       return async () => {
         await rm(lockDir, { recursive: true, force: true });
       };
@@ -2186,7 +3560,7 @@ async function acquireClusterWriteLock(memoryDir, clusterHash) {
   }
 }
 async function withClusterWriteLock(memoryDir, clusterHash, fn) {
-  const inProcessKey = `${path4.resolve(memoryDir)}:${clusterHash}`;
+  const inProcessKey = `${path6.resolve(memoryDir)}:${clusterHash}`;
   const previous = inProcessClusterWriteLocks.get(inProcessKey) ?? Promise.resolve();
   let releaseInProcess;
   const current = previous.catch(() => void 0).then(
@@ -2425,7 +3799,7 @@ function formatProcedureStatsText(report) {
 }
 
 // src/admin/admin-surfaces.ts
-import path5 from "path";
+import path7 from "path";
 var REDACTED = "<redacted>";
 var SENSITIVE_KEY_RE = /(token|secret|password|api[_-]?key|bearer|authorization|credential|private[_-]?key)/i;
 var BEARER_VALUE_RE = /^(bearer|sk-|pk-|xox[bp]-|AKIA)/i;
@@ -2656,7 +4030,7 @@ async function auditTranscripts(memoryDir) {
     movedEntries: file.groups.reduce((sum, group) => sum + group.entryCount, 0),
     unmovableLines: file.unmovableLines
   }));
-  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path5.sep).includes("other"));
+  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path7.sep).includes("other"));
   const summary = plan.movedEntries === 0 ? "No mixed-session transcript data detected; nothing to migrate." : `Found ${plan.movedEntries} entries across ${plan.distinctSessions} distinct sessions stranded in shared/legacy directories. Run the CLI migration command to re-home them.`;
   return {
     generatedAt: plan.generatedAt,
@@ -5293,6 +6667,69 @@ var EngramAccessService = class {
       }
     });
   }
+  // -------------------------------------------------------------------------
+  // Correction Contract (issue #1580) — one plan/apply pipeline for every
+  // memory correction. The CorrectionService owns the planner + executor; the
+  // access-service constructs it lazily via the wiring helper and delegates.
+  // Each method below is thin wiring (≤4 lines) per the god-file ratchet.
+  // -------------------------------------------------------------------------
+  /** Whether the memory_correct_plan / memory_correct_apply tools should appear in tools/list (rule 39). Same reader as the runtime gate so visibility + enforcement stay in sync. */
+  get correctionSurfaceVisible() {
+    return isCorrectionFeatureEnabled(this.orchestrator.config);
+  }
+  _correctionService = null;
+  /** Lazily construct + cache the CorrectionService with deps wired from the orchestrator. */
+  correctionService() {
+    if (this._correctionService) return this._correctionService;
+    const service = createCorrectionService({
+      orchestrator: this.orchestrator,
+      resolveAuthorizedNamespace: async (req) => this.resolveWritableNamespace(req.namespace, req.sessionKey, req.principal),
+      resolveReadableNamespaces: (req) => {
+        const principal = this.resolveRequestPrincipal(req.sessionKey, req.principal);
+        return recallNamespacesForPrincipal(principal, this.orchestrator.config);
+      },
+      canWriteNamespace: (req) => {
+        try {
+          this.resolveWritableNamespace(req.namespace, req.sessionKey, req.principal);
+          return Promise.resolve(true);
+        } catch {
+          return Promise.resolve(false);
+        }
+      },
+      // Wire the orchestrator's extraction LLM so classify+draft actually
+      // drafts actions instead of always hitting the deterministic fallback
+      // (review thread PG5). The planner's classifyAndDraft already falls back
+      // on any LLM outage, so returning null (LLM disabled/cooldown) or a
+      // thrown error both degrade safely to the deterministic path (rule 13).
+      llmComplete: async ({ system, user }) => {
+        const result = await this.orchestrator.localLlm.chatCompletion(
+          [
+            { role: "system", content: system },
+            { role: "user", content: user }
+          ],
+          { operation: "correction-classify", priority: "background" }
+        );
+        if (!result) {
+          throw new Error("correction classify+draft: local LLM unavailable (disabled or in cooldown)");
+        }
+        return result.content;
+      }
+    });
+    this._correctionService = service;
+    return service;
+  }
+  async correctionPlan(request) {
+    return this.correctionService().plan(request);
+  }
+  async correctionApply(planId, opts) {
+    return this.correctionService().apply(planId, opts);
+  }
+  async correctionListPending(opts) {
+    return this.correctionService().listPending(opts);
+  }
+  async correctionDiscard(planId, opts) {
+    return this.correctionService().discard(planId, opts);
+  }
   async memoryBrowse(request = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(
       request.namespace,
@@ -7355,7 +8792,7 @@ ${next}`);
     const resolvedNs = this.resolveWritableNamespace(request.namespace, request.sessionKey, request.principal);
     const storage = await this.orchestrator.getStorage(resolvedNs);
     const storageDir = storage.dir;
-    const { writeFile: writeFile2, mkdir: mkdir3 } = await import("fs/promises");
+    const { writeFile: writeFile4, mkdir: mkdir5 } = await import("fs/promises");
     const { join: join2, resolve: resolve2 } = await import("path");
     const safeKey = request.sessionKey.replace(/[^a-zA-Z0-9_-]/g, "_");
     if (!safeKey) throw new EngramAccessInputError("sessionKey is required");
@@ -7364,10 +8801,10 @@ ${next}`);
     if (!resolved.startsWith(resolve2(storageDir))) {
       throw new EngramAccessInputError("Invalid sessionKey");
     }
-    await mkdir3(checkpointDir, { recursive: true });
+    await mkdir5(checkpointDir, { recursive: true });
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const filePath = join2(checkpointDir, `checkpoint-${ts}.md`);
-    await writeFile2(filePath, request.context, "utf-8");
+    await writeFile4(filePath, request.context, "utf-8");
     return { saved: true };
   }
   async lcmStatus() {
@@ -8256,6 +9693,7 @@ export {
   DECISION_SUBCOMMANDS,
   isCodegraphToolName,
   DELTA_SUBCOMMANDS,
+  CorrectionContractError,
   computeProcedureStats,
   formatProcedureStatsText,
   EngramAccessInputError,
@@ -8263,4 +9701,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-STYMKPFT.js.map
+//# sourceMappingURL=chunk-EVX52NCY.js.map