@remnic/core 9.3.719 → 9.3.721

package/src/trust-score.ts

@@ -0,0 +1,449 @@
+/**
+ * trust-score.ts — unified TrustScore pure module (issue #1577 PR 1).
+ *
+ * Combines the trust-relevant signals Remnic already computes — memory worth
+ * (Laplace-smoothed outcome probability + recency decay), provenance strength,
+ * faithfulness verdict, corroboration count, contradiction status, and optional
+ * domain calibration — into ONE deterministic score in `[0, 1]` plus a band
+ * (`high` / `medium` / `low` / `quarantine`) and a fully-explained component
+ * breakdown for X-ray.
+ *
+ * Contract rules (mirror the battle-tested `memory-worth.ts` "corrupt inputs
+ * fail safely" header — read it before changing anything here):
+ *
+ *   1. **No signals → neutral.** An empty `TrustSignals` yields score `0.5`,
+ *      band `medium`, and a recall multiplier of exactly `1.0`. Uninstrumented
+ *      memories are NEVER penalized (rule 39 — byte-identical ranking when the
+ *      feature is off; neutral prior when on but a memory has no data).
+ *   2. **Corrupt / out-of-range component → that component collapses to
+ *      neutral**, never to an extreme. A `NaN` weight or a `corroborationCount`
+ *      of `-3` is treated as "no signal", not as damning evidence. Precedent:
+ *      `memory-worth.ts` `classifyCounter`.
+ *   3. **Deterministic.** Same inputs → identical result. All weights come from
+ *      the caller (config); no wall clock, no RNG, no hidden constants.
+ *   4. **Explainable.** Every active component is echoed in the result with its
+ *      normalized weight and contribution, so X-ray can render the basis
+ *      without re-deriving the math.
+ *   5. **`quarantine` is reserved for hard negatives** — `faithfulness:
+ *      "contradicted"` or `contradiction: "pending_review"`. Quarantined items
+ *      are excluded from injection but MUST stay visible in X-ray with the
+ *      reason (rule 34 — exclusion must never look like "no result").
+ *
+ * This module is deliberately framework-free: it takes already-collected
+ * signals and config weights, returns a score. The signal ADAPTERS (reading
+ * frontmatter / counters / review queues) live in `trust-score-stage.ts` so
+ * this file stays pure and trivially property-testable.
+ */
+
+/**
+ * Per-component weights. Defined canonically in `types.ts` (the PluginConfig
+ * home) and re-exported here so callers of the pure scorer don't need a second
+ * import path. Every field is optional and defaults to
+ * `DEFAULT_TRUST_WEIGHTS`; weights are sum-normalized at score time, so only
+ * their relative magnitudes matter (rule 51: invalid weight rejected at config
+ * parse, here we only defend against runtime corruption).
+ */
+export type { TrustWeights } from "./types.js";
+import type { TrustWeights } from "./types.js";
+
+/**
+ * Default per-component weights. Chosen so that, with all signals at neutral,
+ * the score is exactly `0.5`. Sum-normalized at compute time. These are the
+ * documented defaults; operators override via `trustScore.weights.*` config.
+ */
+export const DEFAULT_TRUST_WEIGHTS: Required<TrustWeights> = {
+  memoryWorth: 0.28,
+  provenance: 0.16,
+  faithfulness: 0.20,
+  corroboration: 0.12,
+  contradiction: 0.10,
+  domainCalibration: 0.04,
+  feedback: 0.05,
+  recency: 0.05,
+};
+
+/**
+ * All trust-relevant signals for ONE memory. Every field is optional — the
+ * scorer degrades to neutral for any absent or corrupt signal (rule 34).
+ */
+export interface TrustSignals {
+  /** Memory-worth result (Laplace success prob + confidence). */
+  memoryWorth?: { score: number; confidence: number };
+  /** Thumbs feedback tallies. */
+  feedback?: { up: number; down: number };
+  /** Contradiction review queue status. */
+  contradiction?: "none" | "pending_review" | "resolved_kept" | "resolved_superseded";
+  /** Claim-level provenance strength (#1575). */
+  provenance?: "verified" | "unverified" | "none";
+  /** Faithfulness gate verdict (#1576). */
+  faithfulness?: "entailed" | "contradicted" | "unsupported" | "unchecked";
+  /** Count of distinct source turns/sessions corroborating the fact. */
+  corroborationCount?: number;
+  /** Belief-ledger accuracy for the memory's domain, `0..1`. */
+  domainCalibration?: number;
+  /** Age in days vs a per-category half-life (caller computes). */
+  ageDays?: number;
+  /** Half-life (days) for recency decay; the caller supplies the per-category value. */
+  recencyHalfLifeDays?: number;
+}
+
+/** Trust band, coarse-grained for injection hedging and X-ray grouping. */
+export type TrustBand = "high" | "medium" | "low" | "quarantine";
+
+/**
+ * One component's contribution to the final score, for full explainability.
+ * `value` is the normalized `[0,1]` signal contribution; `weight` is the
+ * sum-normalized weight that was applied.
+ */
+export interface TrustScoreComponent {
+  value: number;
+  weight: number;
+}
+
+/**
+ * Full TrustScore result. `score` is the weighted blend in `[0,1]`; `band` is
+ * the coarse category; `components` echoes every active component so X-ray /
+ * epistemic rendering can explain the basis without re-deriving it.
+ */
+export interface TrustScoreResult {
+  score: number;
+  band: TrustBand;
+  components: Record<string, TrustScoreComponent>;
+  /**
+   * `true` when the result is the neutral prior (no usable signals). Lets the
+   * multiplier short-circuit to exactly `1.0` and the epistemic renderer skip
+   * the hedge for the common uninstrumented case.
+   */
+  neutral: boolean;
+}
+
+/** Band thresholds on the blended score. */
+export const TRUST_BAND_THRESHOLDS = {
+  high: 0.7,
+  medium: 0.45,
+  low: 0.2,
+} as const;
+
+/** Neutral prior: the score an empty-signal memory receives. */
+export const NEUTRAL_TRUST_SCORE = 0.5;
+
+/**
+ * Validate a single weight: a finite number in `[0, 1]`. Returns the value or
+ * `undefined` when corrupt (the caller falls back to the default).
+ */
+function sanitizeWeight(value: number | undefined): number | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== "number") return undefined;
+  if (!Number.isFinite(value)) return undefined;
+  if (value < 0 || value > 1) return undefined;
+  return value;
+}
+
+/**
+ * Merge caller weights over the defaults, dropping corrupt entries. Exposed for
+ * config parse so an invalid weight is rejected once at the boundary (rule 51
+ * spirit) — but the scorer defends again here so a hand-built bench fixture
+ * cannot poison the math.
+ */
+export function resolveTrustWeights(
+  override: Readonly<TrustWeights> | undefined,
+): Required<TrustWeights> {
+  const out: Required<TrustWeights> = { ...DEFAULT_TRUST_WEIGHTS };
+  if (!override) return out;
+  (Object.keys(DEFAULT_TRUST_WEIGHTS) as Array<keyof TrustWeights>).forEach((key) => {
+    const v = sanitizeWeight(override[key]);
+    if (v !== undefined) out[key] = v;
+  });
+  return out;
+}
+
+/** Clamp a value to `[0,1]`; NaN/Infinity collapse to the neutral `0.5`. */
+function clampUnit(value: number): number {
+  if (typeof value !== "number" || !Number.isFinite(value)) return NEUTRAL_TRUST_SCORE;
+  if (value < 0) return 0;
+  if (value > 1) return 1;
+  return value;
+}
+
+/**
+ * Coerce an already-`[0,1]` signal (domain calibration, etc.) for the scorer.
+ * Returns `undefined` when absent or corrupt so the component is DROPPED — a
+ * single corrupt signal must not be read as damning evidence nor as a neutral
+ * contribution that masquerades as "we measured this". Mirrors the
+ * `classifyCounter` precedent from `memory-worth.ts`.
+ */
+function unitValue(value: number | undefined): number | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
+  if (value < 0 || value > 1) return undefined;
+  return value;
+}
+
+/** Map a provenance tag to a `[0,1]` contribution. Absent → neutral. */
+function provenanceValue(tag: TrustSignals["provenance"]): number | undefined {
+  if (tag === undefined) return undefined;
+  if (tag === "verified") return 1;
+  if (tag === "unverified") return 0.5;
+  // "none" is meaningful negative evidence (no surviving source span), not
+  // neutral. It pulls toward 0 but gently so a single unprovenanced fact is
+  // not damned on its own.
+  if (tag === "none") return 0.25;
+  return undefined;
+}
+
+/** Map a faithfulness verdict to a `[0,1]` contribution. Absent → dropped. */
+function faithfulnessValue(verdict: TrustSignals["faithfulness"]): number | undefined {
+  if (verdict === undefined) return undefined;
+  if (verdict === "entailed") return 1;
+  // "unchecked" means the gate ran but could not verify — it carries NO signal.
+  // Return undefined (absent) so a memory whose ONLY signal is unchecked
+  // faithfulness scores truly neutral, not "active 0.5". This stops the
+  // epistemic hedge from spuriously firing on unverifiable memories (review
+  // Oqg_0: unchecked-as-absent for hedging) and stops the component from
+  // masquerading as measured evidence.
+  if (verdict === "unchecked") return undefined;
+  if (verdict === "unsupported") return 0.35;
+  // "contradicted" is a hard negative — it also forces quarantine (see below),
+  // but as a component it contributes 0 so the blended score sinks.
+  if (verdict === "contradicted") return 0;
+  return undefined;
+}
+
+/** Map contradiction review status to a `[0,1]` contribution. */
+function contradictionValue(
+  status: TrustSignals["contradiction"],
+): number | undefined {
+  if (status === undefined) return undefined;
+  if (status === "none") return NEUTRAL_TRUST_SCORE;
+  if (status === "resolved_kept") return 0.7;
+  if (status === "resolved_superseded") return 0.1;
+  if (status === "pending_review") return 0.15;
+  return undefined;
+}
+
+/** Feedback balance → `[0,1]` via Laplace smoothing (mirrors memory-worth). */
+function feedbackValue(fb: TrustSignals["feedback"]): number | undefined {
+  if (fb === undefined) return undefined;
+  const up = typeof fb.up === "number" && Number.isFinite(fb.up) && fb.up >= 0 ? fb.up : 0;
+  const down =
+    typeof fb.down === "number" && Number.isFinite(fb.down) && fb.down >= 0 ? fb.down : 0;
+  if (up === 0 && down === 0) return undefined;
+  // Laplace: (up+1)/(up+down+2). Clamped defensively.
+  return clampUnit((up + 1) / (up + down + 2));
+}
+
+/** Corroboration count → `[0,1]` via log-saturation (3+ sources ≈ 1.0). */
+function corroborationValue(count: TrustSignals["corroborationCount"]): number | undefined {
+  if (count === undefined) return undefined;
+  if (typeof count !== "number" || !Number.isFinite(count) || count < 0) return undefined;
+  if (count === 0) return 0.3; // single mention is mild negative evidence vs neutral
+  // log2(1 + count) saturates: 1→0.5, 2→0.63, 3→0.66, 4→0.68 ... capped at 1.
+  return clampUnit(Math.log2(1 + count) / 2);
+}
+
+/** Recency decay vs a half-life, mapped so "fresh" → high, "stale" → low. */
+function recencyValue(signals: TrustSignals): number | undefined {
+  if (signals.ageDays === undefined) return undefined;
+  if (typeof signals.ageDays !== "number" || !Number.isFinite(signals.ageDays) || signals.ageDays < 0)
+    return undefined;
+  const halfLife = signals.recencyHalfLifeDays;
+  if (typeof halfLife !== "number" || !Number.isFinite(halfLife) || halfLife <= 0) return undefined;
+  // 2^(-age/halfLife): age 0 → 1, age=halfLife → 0.5, age≫halfLife → ~0.
+  return clampUnit(Math.pow(2, -signals.ageDays / halfLife));
+}
+
+/**
+ * Determine whether the signals warrant the `quarantine` band: a hard negative
+ * that excludes the item from injection (but never from X-ray — rule 34).
+ */
+function isHardNegative(signals: TrustSignals): boolean {
+  if (signals.faithfulness === "contradicted") return true;
+  if (signals.contradiction === "pending_review") return true;
+  return false;
+}
+
+/**
+ * Compute the unified TrustScore for one memory.
+ *
+ * Returns the neutral prior (`0.5`, band `medium`, `neutral: true`) when no
+ * usable signal is present, so uninstrumented memories are untouched.
+ */
+export function computeTrustScore(
+  signals: TrustSignals = {},
+  weights: Readonly<TrustWeights> = DEFAULT_TRUST_WEIGHTS,
+): TrustScoreResult {
+  const resolved = resolveTrustWeights(weights);
+
+  // Build the (component → value) map, skipping absent/corrupt signals.
+  // Each value is already clamped to [0,1] by its mapper.
+  const candidates: Array<{ key: keyof TrustWeights; value: number }> = [];
+  const push = (key: keyof TrustWeights, value: number | undefined) => {
+    if (value === undefined) return;
+    candidates.push({ key, value: clampUnit(value) });
+  };
+
+  push("memoryWorth", signals.memoryWorth ? clampUnit(signals.memoryWorth.score) : undefined);
+  push("provenance", provenanceValue(signals.provenance));
+  push("faithfulness", faithfulnessValue(signals.faithfulness));
+  push("corroboration", corroborationValue(signals.corroborationCount));
+  push("contradiction", contradictionValue(signals.contradiction));
+  push("domainCalibration", unitValue(signals.domainCalibration));
+  push("feedback", feedbackValue(signals.feedback));
+  push("recency", recencyValue(signals));
+
+  // No usable signal → neutral prior, multiplier exactly 1.0.
+  if (candidates.length === 0) {
+    return {
+      score: NEUTRAL_TRUST_SCORE,
+      band: "medium",
+      components: {},
+      neutral: true,
+    };
+  }
+
+  // Sum-normalize the active weights so absent components redistribute their
+  // weight to the present ones (a memory with only memory-worth data is scored
+  // purely on memory-worth, not half-scored because other signals are absent).
+  const activeWeightSum = candidates.reduce((acc, c) => acc + resolved[c.key], 0);
+  // When every present signal's weight is 0 (operator explicitly disabled
+  // the only components the memory has), fall back to the neutral prior
+  // rather than damning the memory to score 0. A disabled signal is not a
+  // negative signal — it carries no information (review P2: zero-weight).
+  if (activeWeightSum <= 0) {
+    return {
+      score: NEUTRAL_TRUST_SCORE,
+      band: "medium",
+      components: {},
+      neutral: true,
+    };
+  }
+  const safeWeightSum = activeWeightSum;
+
+  let blended = 0;
+  const components: Record<string, TrustScoreComponent> = {};
+  for (const c of candidates) {
+    const w = resolved[c.key] / safeWeightSum;
+    blended += c.value * w;
+    components[c.key] = { value: c.value, weight: w };
+  }
+
+  // Clamp the blend: floating-point noise can drift a hair outside [0,1].
+  const score = clampUnit(blended);
+
+  // Hard negatives are quarantined regardless of the blended score, so a
+  // corroborated-but-contradicted fact is still excluded from injection.
+  const band = bandForScore(score, isHardNegative(signals));
+
+  return { score, band, components, neutral: false };
+}
+
+/**
+ * Resolve the band from the blended score, accounting for hard-negative
+ * quarantine. Extracted so the thresholds live in ONE place (X-ray, injection,
+ * and tests all agree on the mapping).
+ */
+export function bandForScore(score: number, hardNegative: boolean): TrustBand {
+  if (hardNegative) return "quarantine";
+  const s = clampUnit(score);
+  if (s >= TRUST_BAND_THRESHOLDS.high) return "high";
+  if (s >= TRUST_BAND_THRESHOLDS.medium) return "medium";
+  if (s >= TRUST_BAND_THRESHOLDS.low) return "low";
+  return "low";
+}
+
+/**
+ * Map a `[0,1]` trust score to a recall multiplier in
+ * `[minMultiplier, maxMultiplier]`. The neutral prior (`0.5`) maps to exactly
+ * `1.0` so uninstrumented memories are untouched. Linear interpolation centered
+ * at neutral:
+ *
+ *   score < 0.5 → multiplier in [min, 1)
+ *   score = 0.5 → 1.0
+ *   score > 0.5 → multiplier in (1, max]
+ */
+export function trustMultiplier(
+  score: number,
+  minMultiplier: number = 0.5,
+  maxMultiplier: number = 1.25,
+): number {
+  const min = typeof minMultiplier === "number" && Number.isFinite(minMultiplier) ? minMultiplier : 0.5;
+  const max = typeof maxMultiplier === "number" && Number.isFinite(maxMultiplier) ? maxMultiplier : 1.25;
+  // Defend against an inverted contract (min > max): pick the tighter bound.
+  const lo = Math.min(min, max);
+  const hi = Math.max(min, max);
+  const s = clampUnit(score);
+  if (s === NEUTRAL_TRUST_SCORE) return 1;
+  if (s < NEUTRAL_TRUST_SCORE) {
+    // Map [0, 0.5) → [lo, 1). score 0 → lo, score →0.5 → 1.
+    const t = s / NEUTRAL_TRUST_SCORE; // [0,1)
+    return lo + (1 - lo) * t;
+  }
+  // Map (0.5, 1] → (1, hi]. score 0.5 → 1, score 1 → hi.
+  const t = (s - NEUTRAL_TRUST_SCORE) / (1 - NEUTRAL_TRUST_SCORE); // (0,1]
+  return 1 + (hi - 1) * t;
+}
+
+/**
+ * Deterministic epistemic hedge suffix for an injected memory line, generated
+ * from the trust components (template, not LLM). Returns the empty string for
+ * the `high` band and for neutral results so the common case wastes no tokens.
+ *
+ * Examples:
+ *   high    → ""
+ *   medium  → "(unconfirmed — single mention, 2025-11)"
+ *   low     → "(low confidence — contradicted once, uncorroborated)"
+ */
+export function renderEpistemicHedge(result: TrustScoreResult): string {
+  if (result.neutral) return "";
+  switch (result.band) {
+    case "high":
+      return "";
+    case "quarantine":
+    case "low":
+      return `(low confidence — ${describeWeakness(result.components)})`;
+    case "medium":
+      return `(unconfirmed — ${describeWeakness(result.components)})`;
+    default:
+      return "";
+  }
+}
+
+/**
+ * Build a short, deterministic weakness description from the components. Reads
+ * the lowest-contributing signals so the hedge names the actual reason the
+ * model should hedge. Pure and order-stable.
+ */
+function describeWeakness(components: Record<string, TrustScoreComponent>): string {
+  const parts: string[] = [];
+  const f = components.faithfulness;
+  if (f && f.value <= 0.35) parts.push(f.value === 0 ? "contradicted" : "unsupported");
+  const c = components.contradiction;
+  if (c && c.value <= 0.2) parts.push("under review");
+  const cor = components.corroboration;
+  if (cor && cor.value <= 0.4) parts.push("single mention");
+  const prov = components.provenance;
+  if (prov && prov.value <= 0.3) parts.push("unprovenanced");
+  const rec = components.recency;
+  if (rec && rec.value <= 0.3) parts.push("stale");
+  if (parts.length === 0) {
+    // No single component is weak but the blend is below high — name the
+    // weakest one explicitly so the hedge is never vacuous.
+    let weakest: { key: string; value: number } | null = null;
+    for (const [key, comp] of Object.entries(components)) {
+      if (!weakest || comp.value < weakest.value) weakest = { key, value: comp.value };
+    }
+    if (weakest) parts.push(`weak ${humanizeComponentName(weakest.key)}`);
+  }
+  return parts.slice(0, 2).join(", ");
+}
+
+function humanizeComponentName(key: string): string {
+  switch (key) {
+    case "memoryWorth":
+      return "outcome history";
+    case "domainCalibration":
+      return "domain calibration";
+    default:
+      return key;
+  }
+}

package/src/types.ts

@@ -993,6 +993,31 @@ export interface PluginConfig {
    * once the benchmark shows precision tie-or-win.
    */
   recallMemoryWorthFilterEnabled: boolean;
+  // Unified TrustScore recall stage (issue #1577). Combines memory-worth,
+  // provenance, faithfulness, corroboration, contradiction, feedback, recency,
+  // and optional domain calibration into one [0,1] trust score applied as a
+  // bounded recall multiplier. Subsumes the Memory Worth multiplier when on
+  // (the orchestrator runs exactly one of the two — rule 39).
+  /**
+   * Master gate for the unified TrustScore recall stage. Default `false`: off
+   * = the stage is absent and ranking is byte-identical to the pre-feature
+   * pipeline (rule 39). Flip via #1574 ablation evidence only.
+   */
+  trustScoreEnabled: boolean;
+  /** Append epistemic hedge suffixes to injected memory lines. Separate gate. */
+  trustScoreEpistemicRendering: boolean;
+  /**
+   * Exclude hard-negative (quarantine-band) items from injection. Default
+   * `true`; only effective under the master gate. Quarantined items stay
+   * visible in X-ray with a reason (rule 34).
+   */
+  trustScoreQuarantine: boolean;
+  /** Lower bound of the trust multiplier (default 0.5). */
+  trustScoreMinMultiplier: number;
+  /** Upper bound of the trust multiplier (default 1.25). */
+  trustScoreMaxMultiplier: number;
+  /** Per-component weights for the TrustScore blend; invalid weights rejected at parse. */
+  trustScoreWeights: TrustWeights;
   /**
    * Recall-audit anomaly detector (issue #565 PR 5/5). When true,
    * access surfaces run the anomaly detector over a tail of the audit
@@ -1182,12 +1207,30 @@ export interface PluginConfig {
   // extracted facts against their verified source spans from #1575.
   /** Gate mode: "off" (default, byte-identical pre-feature), "shadow" (record only), "enforce" (route to pending_review). */
   extractionFaithfulnessGate: "off" | "shadow" | "enforce";
-  /** Override model/endpoint; empty string = default routing chain. */
+  /** Override model name; empty string = default routing chain. */
   extractionFaithfulnessModel: string;
+  /**
+   * Base URL of a local openai-compatible endpoint serving a fine-tuned
+   * faithfulness gate (issue #1585 model-lab), e.g.
+   * `http://localhost:11434/v1` (Ollama) or `http://localhost:8000/v1` (vLLM).
+   * Empty string (default) preserves the existing routing chain exactly;
+   * set together with `extractionFaithfulnessModel` to route the gate to the
+   * local model first, falling back to the chain on failure.
+   */
+  extractionFaithfulnessBaseUrl: string;
   /** Context window (chars) around the quote sent to the verifier. Default 400. */
   extractionFaithfulnessContextChars: number;
   /** Per-batch timeout in ms; timeout → tagged error, never blocks writes. Default 8000. */
   extractionFaithfulnessTimeoutMs: number;
+  /**
+   * Correction-intent model-lab pointer (issue #1581 / #1585). When both this
+   * and `correctionIntentBaseUrl` are set, the detection path can route to a
+   * local fine-tuned correction-intent classifier. Empty default keeps the
+   * rule-based passive-correction detector as the sole path (byte-identical).
+   */
+  correctionIntentModel: string;
+  /** Base URL of a local openai-compatible endpoint serving the correction-intent classifier (issue #1585). Empty default = rule-based detection. */
+  correctionIntentBaseUrl: string;
   // Hourly summaries
   hourlySummariesEnabled: boolean;
   daySummaryEnabled: boolean;
@@ -2785,6 +2828,23 @@ export interface FaithfulnessFrontmatter {
   at?: string;
 }
 
+/**
+ * Per-component weights for the unified TrustScore blend (issue #1577). Every
+ * field is optional and defaults to the documented value in `trust-score.ts`;
+ * weights are sum-normalized at score time so only relative magnitudes matter.
+ * Invalid weights (non-finite, outside `[0,1]`) are rejected at config parse.
+ */
+export interface TrustWeights {
+  memoryWorth?: number;
+  provenance?: number;
+  faithfulness?: number;
+  corroboration?: number;
+  contradiction?: number;
+  domainCalibration?: number;
+  feedback?: number;
+  recency?: number;
+}
+
 /** Memory link relationship types */
 export type MemoryLinkType = "follows" | "references" | "contradicts" | "supports" | "related";
 

package/dist/chunk-3JJWNZTT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lifecycle/tombstones.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// lifecycle/tombstones.ts — Tombstone store + non-resurrection invariant\n// (issue #1579)\n//\n// A \"tombstone\" records that a fact has been retired (corrected, superseded,\n// or retracted) so that the SAME fact cannot silently come back to life through\n// any of the five resurrection paths:\n//\n//   1. Re-extraction (session replay, re-observation)\n//   2. Importers (capsule / import-* payloads)\n//   3. Consolidation merges\n//   4. Dreams (REM re-derivation)\n//   5. Pattern reinforcement (duplicate promotion)\n//\n// The invariant is enforced at the SINGLE storage persist path\n// (`StorageManager.writeMemory` — the same chokepoint that records catalog\n// writes, issue #1522). Every write path funnels through it, so paths (a)–(e)\n// are blocked WITHOUT per-path code.\n//\n// File-first / rebuildable (the repo's storage philosophy): the JSONL at\n// `<stateDir>/tombstones.jsonl` is a cache of truth. The authoritative sources\n// are the memory files themselves (status: superseded/retracted) and the\n// `corrections/` records. `rebuildTombstonesFromStorage` reconstructs the\n// JSONL from those sources.\n//\n// Design rules honored (issue #1579 design section):\n//   - Hash `rawContent` exactly as the dedup index does — one helper\n//     (`ContentHashIndex.computeHash` / `normalizeContent`), never a second\n//     (checklist §13; rule 23).\n//   - Append-only log — never rewrite history; a later `kind: \"revocation\"`\n//     entry re-allows (rule 25).\n//   - Instance-scoped, never module-level (rule 11).\n//   - Namespace-scoped — a tombstone in namespace A never blocks namespace B\n//     (rule 42).\n//   - Serialized appends with rejection recovery (rule 40).\n//   - Never silent drop — a blocked write lands as pending_review + blockedBy\n//     (rule 34).\n//   - Do NOT register a blocked fact as an active dedup/index entry (rule 44).\n//   - Off = pre-feature behavior for rollback safety (rule 30).\n//   - Semantic tier (4) ships dark, off by default (rule 48).\n// ---------------------------------------------------------------------------\n\nimport { serializeMutations } from \"../utils/serialize-mutations.js\";\n\n/** Why a tombstone was emitted. */\nexport type TombstoneReason =\n  | \"correction\"\n  | \"supersession\"\n  | \"retraction\"\n  | \"contradiction_resolution\";\n\n/** Who emitted the tombstone. */\nexport type TombstoneCreatedBy =\n  | \"user_correction\"\n  | \"contradiction_resolution\"\n  | \"supersession\"\n  | \"chat\";\n\n/** Tier that matched on lookup. */\nexport type TombstoneMatchTier = \"exact\" | \"normalized\" | \"keyed\" | \"semantic\";\n\n/**\n * A single append-only tombstone log entry.\n *\n * `kind: \"tombstone\"` blocks; `kind: \"revocation\"` re-allows. The log is\n * never rewritten — the NEWEST matching entry wins at lookup (rule 25).\n */\nexport interface TombstoneEntry {\n  /** Stable tombstone id (`tomb-<ts>-<rand>`). */\n  id: string;\n  kind: \"tombstone\" | \"revocation\";\n  reason: TombstoneReason;\n  /** The memory that was retired. */\n  sourceMemoryId: string;\n  /** sha256 of the retired memory's rawContent (rule 23). */\n  contentHash: string;\n  /** `ContentHashIndex.normalizeContent(rawContent)` — the pre-hash form. */\n  normalizedText: string;\n  entityRef?: string;\n  /** Structured-attribute supersession key when one existed. */\n  supersessionKey?: string;\n  /** Namespace scope (rule 42). */\n  namespace: string;\n  createdAt: string;\n  createdBy: TombstoneCreatedBy;\n  /** For `kind: \"revocation\"`: the tombstone id being revoked. */\n  revokes?: string;\n}\n\n/** A positive block decision returned by `TombstoneStore.lookup`. */\nexport interface TombstoneMatch {\n  tombstoneId: string;\n  matchedTier: TombstoneMatchTier;\n  reason: TombstoneReason;\n}\n\n/** Inputs to a lookup. At least one discriminator must be present.\n *\n * Issue #1579 thread Ociag/Oci-W: `supersessionKeys` (plural) lets the write\n * chokepoint check EVERY derived key, not just the first. Emitters register\n * one tombstone per matched key (temporal-supersession, rebuild), so a block\n * can live on any later key; querying only `supersessionKeys[0]` missed it\n * and the retired fact resurrected as active. `supersessionKey` (singular)\n * remains for direct/unit callers; `lookup` checks the union of both. */\nexport interface TombstoneLookupQuery {\n  contentHash?: string;\n  normalizedText?: string;\n  entityRef?: string;\n  /** Single supersession key (direct/unit callers). */\n  supersessionKey?: string;\n  /** All derived supersession keys (write chokepoint). The keyed tier is\n   *  checked for each; the first active match wins. */\n  supersessionKeys?: string[];\n  namespace: string;\n}\n\n/** Configuration for a tombstone store instance. */\nexport interface TombstoneStoreOptions {\n  enabled: boolean;\n  semanticMatch: boolean;\n  semanticThreshold: number;\n  /** sha256 of raw content — wired to `ContentHashIndex.computeHash`. */\n  hashContent: (raw: string) => string;\n  /** Normalize raw content — wired to `ContentHashIndex.normalizeContent`. */\n  normalizeText: (raw: string) => string;\n  /**\n   * Optional cosine similarity in [0, 1] for the semantic tier. When\n   * undefined or when `semanticMatch` is false, the semantic tier is\n   * skipped entirely.\n   */\n  semanticSimilarity?: (a: string, b: string) => number;\n}\n\n/** Injected file I/O — the StorageManager wires its secure-store-aware\n * implementations so tombstones are encrypted at rest alongside other state.\n * `stat` is optional; when provided the store tracks the file mtime itself and\n * runs a cross-process staleness probe on each access (#1579). */\nexport interface TombstoneFileIo {\n  read: (filePath: string) => Promise<string>;\n  append: (filePath: string, content: string) => Promise<void>;\n  write: (filePath: string, content: string) => Promise<void>;\n  stat?: (filePath: string) => { mtimeMs: number };\n}\n\n/** Aggregate stats for `remnic doctor`. */\nexport interface TombstoneStats {\n  count: number;\n  revoked: number;\n  lastAppendAt: string | null;\n  corruptedLines: number;\n  /** Whether the in-memory index matches the on-disk file (rebuild check). */\n  loaded: boolean;\n}\n\nconst TOMBSTONE_PREFIX = \"tomb\";\n\nfunction newTombstoneId(): string {\n  return `${TOMBSTONE_PREFIX}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;\n}\n\n/** Deterministic key for the keyed tier (namespace + entityRef + supersessionKey).\n *\n * The namespace is part of the discriminator so two namespace-scoped stores\n * that share the same backing `tombstones.jsonl` (namespaces disabled, or the\n * same directory used with different namespace configs) cannot overwrite each\n * other's index entries — a later tombstone for namespace B with the same\n * entity/key no longer evicts namespace A's entry (issue #1579 thread Ocs-O). */\nfunction keyedTierKey(namespace: string, entityRef: string, supersessionKey: string): string {\n  return `${namespace}\\0${entityRef}\\0${supersessionKey}`;\n}\n\n/**\n * Parse one JSONL line into a TombstoneEntry, validating the discriminated\n * union. Returns `null` for malformed lines (rule 34 — skip with a counter,\n * never crash).\n */\nexport function parseTombstoneLine(line: string): TombstoneEntry | null {\n  const trimmed = line.trim();\n  if (trimmed.length === 0) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\") return null;\n  const e = parsed as Record<string, unknown>;\n  if (typeof e.id !== \"string\" || e.id.length === 0) return null;\n  if (e.kind !== \"tombstone\" && e.kind !== \"revocation\") return null;\n  if (\n    e.reason !== \"correction\" &&\n    e.reason !== \"supersession\" &&\n    e.reason !== \"retraction\" &&\n    e.reason !== \"contradiction_resolution\"\n  ) {\n    return null;\n  }\n  if (typeof e.sourceMemoryId !== \"string\") return null;\n  if (typeof e.contentHash !== \"string\") return null;\n  if (typeof e.normalizedText !== \"string\") return null;\n  if (typeof e.namespace !== \"string\") return null;\n  if (typeof e.createdAt !== \"string\") return null;\n  if (\n    e.createdBy !== \"user_correction\" &&\n    e.createdBy !== \"contradiction_resolution\" &&\n    e.createdBy !== \"supersession\" &&\n    e.createdBy !== \"chat\"\n  ) {\n    return null;\n  }\n  const out: TombstoneEntry = {\n    id: e.id,\n    kind: e.kind,\n    reason: e.reason,\n    sourceMemoryId: e.sourceMemoryId,\n    contentHash: e.contentHash,\n    normalizedText: e.normalizedText,\n    namespace: e.namespace,\n    createdAt: e.createdAt,\n    createdBy: e.createdBy,\n  };\n  if (typeof e.entityRef === \"string\") out.entityRef = e.entityRef;\n  if (typeof e.supersessionKey === \"string\") out.supersessionKey = e.supersessionKey;\n  if (typeof e.revokes === \"string\") out.revokes = e.revokes;\n  return out;\n}\n\n/**\n * The instance-scoped tombstone store. One per StorageManager (rule 11),\n * namespace-scoped via `namespace` + the on-disk path (rule 42).\n *\n * The in-memory index is built lazily on first access and invalidated on\n * append + by the StorageManager's cache-invalidation chokepoint (rule 25).\n */\nexport class TombstoneStore {\n  private entries: TombstoneEntry[] = [];\n  /** contentHash → tombstone id (newest) — exact tier. */\n  private readonly byHash = new Map<string, string>();\n  /** normalizedText → tombstone id (newest) — normalized tier. */\n  private readonly byNormalized = new Map<string, string>();\n  /** entityRef\\0supersessionKey → tombstone id (newest) — keyed tier. */\n  private readonly byKey = new Map<string, string>();\n  /** Tombstone ids that have a later revocation entry. */\n  private readonly revokedIds = new Set<string>();\n  /** id → entry index (newest only, for revocation lookups). */\n  private readonly byId = new Map<string, TombstoneEntry>();\n  private loaded = false;\n  private loadPromise: Promise<void> | null = null;\n  private corruptedLines = 0;\n  private lastAppendAt: string | null = null;\n  /**\n   * Last-seen mtime of the JSONL file (cross-process staleness probe, #1579).\n   * Tracked inside the store so the StorageManager wiring stays thin. When the\n   * file's mtime advances past this value between accesses, the in-memory index\n   * is stale (a peer process appended) and is reloaded before the next lookup.\n   */\n  private fileMtimeMs = 0;\n\n  constructor(\n    private readonly filePath: string,\n    private readonly namespace: string,\n    private readonly options: TombstoneStoreOptions,\n    private readonly io: TombstoneFileIo,\n  ) {}\n\n  /** Lazy load + build the in-memory index. Idempotent. */\n  async load(): Promise<void> {\n    if (this.loaded) return;\n    if (this.loadPromise) return this.loadPromise;\n    this.loadPromise = this.loadInternal();\n    try {\n      await this.loadPromise;\n    } finally {\n      this.loadPromise = null;\n    }\n  }\n\n  private async loadInternal(): Promise<void> {\n    // Record the file's mtime so the staleness probe does not immediately\n    // invalidate on the next access (fileMtimeMs starts at 0; without this,\n    // any non-zero mtime would trigger a spurious reload). Done before the\n    // read so an ENOENT still records 0.\n    this.recordFileMtime();\n    let raw: string;\n    try {\n      raw = await this.io.read(this.filePath);\n    } catch (err) {\n      // ENOENT is fine — fresh store. Other errors leave the store empty\n      // rather than crashing the write path (rule 34 spirit: degrade to\n      // \"no tombstones known\" rather than blocking all writes).\n      const code = (err as NodeJS.ErrnoException)?.code;\n      if (code !== \"ENOENT\") {\n        // Swallow — the write path must not crash on a corrupt tombstone file.\n        // Rebuild will repair on the next doctor/maintenance run.\n      }\n      this.loaded = true;\n      return;\n    }\n    this.resetIndex();\n    let corrupted = 0;\n    for (const line of raw.split(\"\\n\")) {\n      const entry = parseTombstoneLine(line);\n      if (!entry) {\n        if (line.trim().length > 0) corrupted += 1;\n        continue;\n      }\n      this.indexEntry(entry);\n    }\n    this.corruptedLines = corrupted;\n    this.loaded = true;\n  }\n\n  private resetIndex(): void {\n    this.entries = [];\n    this.byHash.clear();\n    this.byNormalized.clear();\n    this.byKey.clear();\n    this.revokedIds.clear();\n    this.byId.clear();\n  }\n\n  /**\n   * Index an entry. Later entries (higher array index = newer createdAt)\n   * OVERRIDE earlier ones at each tier key — the newest matching entry wins\n   * (rule 25). Revocation entries mark their target as revoked.\n   */\n  private indexEntry(entry: TombstoneEntry): void {\n    this.entries.push(entry);\n    this.byId.set(entry.id, entry);\n    if (entry.createdAt > (this.lastAppendAt ?? \"\")) {\n      this.lastAppendAt = entry.createdAt;\n    }\n    if (entry.kind === \"revocation\") {\n      if (entry.revokes) this.revokedIds.add(entry.revokes);\n      return;\n    }\n    // Tombstone entries populate the lookup maps. The namespace is part of\n    // every discriminator key (issue #1579 thread Ocs-O): when two\n    // namespace-scoped stores share the same backing file, a later tombstone\n    // for namespace B with identical content must NOT evict namespace A's map\n    // entry — otherwise A's lookup finds B's id, rejects it on namespace\n    // mismatch, and misses its own still-active tombstone (resurrection).\n    const ns = entry.namespace;\n    if (entry.contentHash) this.byHash.set(`${ns}\\0${entry.contentHash}`, entry.id);\n    if (entry.normalizedText) this.byNormalized.set(`${ns}\\0${entry.normalizedText}`, entry.id);\n    if (entry.entityRef && entry.supersessionKey) {\n      this.byKey.set(keyedTierKey(ns, entry.entityRef, entry.supersessionKey), entry.id);\n    }\n  }\n\n  /** Invalidate the in-memory cache (rule 25). The next access reloads. */\n  invalidate(): void {\n    this.loaded = false;\n    this.loadPromise = null;\n    this.resetIndex();\n  }\n\n  /**\n   * Cross-process staleness probe (#1579). If the file's mtime advanced since\n   * the last load/own-write, a peer process appended and our in-memory index is\n   * stale — invalidate AND reload in place so the next lookup sees the new\n   * entries. Best-effort: a stat error is swallowed (the loaded index is\n   * retained rather than crashing the write path). No-op when no `stat` was\n   * injected or when the mtime is unchanged. After our own append/revoke/rebuild\n   * `markWritten` records the new mtime, so this probe does not fire for our\n   * own writes (only for peer-process appends).\n   */\n  async ensureFreshAgainstDisk(): Promise<void> {\n    if (!this.io.stat) return;\n    let mtimeMs: number;\n    try {\n      mtimeMs = Math.floor(this.io.stat(this.filePath).mtimeMs);\n    } catch {\n      return; // ENOENT / permission — keep the loaded index (fail-open).\n    }\n    if (mtimeMs === this.fileMtimeMs && this.loaded) return;\n    this.fileMtimeMs = mtimeMs;\n    this.invalidate();\n    await this.load();\n  }\n\n  /**\n   * Record the file mtime after THIS process writes (append / revoke / rebuild)\n   * so `ensureFreshAgainstDisk` does not treat our own write as a peer append\n   * and throw away the just-updated in-memory index (#1579 — avoids a needless\n   * invalidate+reload in the hot write path).\n   */\n  private markWritten(): void {\n    this.recordFileMtime();\n  }\n\n  private recordFileMtime(): void {\n    if (!this.io.stat) return;\n    try {\n      this.fileMtimeMs = Math.floor(this.io.stat(this.filePath).mtimeMs);\n    } catch {\n      // ENOENT — fresh store with no file yet; mtime stays at its current value.\n    }\n  }\n\n  /**\n   * Append a tombstone entry. Serialized via `serializeMutations` keyed by\n   * file path so concurrent appends do not interleave, with rejection recovery\n   * (rule 40 — a single failed append never poisons the chain). The in-memory\n   * index is updated AFTER the durable append succeeds.\n   *\n   * Returns the new tombstone id.\n   */\n  async appendTombstone(input: {\n    reason: TombstoneReason;\n    createdBy: TombstoneCreatedBy;\n    sourceMemoryId: string;\n    rawContent: string;\n    entityRef?: string;\n    supersessionKey?: string;\n    createdAt?: string;\n    /**\n     * Pre-computed canonical contentHash from the retired memory's frontmatter.\n     * When provided, used directly so the tombstone's exact tier matches the\n     * hash writeMemory computes on re-extraction (issue #1579 review: cited\n     * facts must not slip past the chokepoint because the emitter hashed the\n     * citation-annotated body instead of the canonical source).\n     */\n    contentHash?: string;\n  }): Promise<string> {\n    await this.load();\n    const createdAt = input.createdAt ?? new Date().toISOString();\n    const id = newTombstoneId();\n    const entry: TombstoneEntry = {\n      id,\n      kind: \"tombstone\",\n      reason: input.reason,\n      sourceMemoryId: input.sourceMemoryId,\n      contentHash: input.contentHash ?? this.options.hashContent(input.rawContent),\n      normalizedText: this.options.normalizeText(input.rawContent),\n      ...(input.entityRef ? { entityRef: input.entityRef } : {}),\n      ...(input.supersessionKey ? { supersessionKey: input.supersessionKey } : {}),\n      namespace: this.namespace,\n      createdAt,\n      createdBy: input.createdBy,\n    };\n    await this.serializeAppend(entry);\n    this.indexEntry(entry);\n    this.markWritten();\n    return id;\n  }\n\n  /**\n   * Append a revocation entry referencing `tombstoneId`. The log is\n   * append-only; lookup treats a revoked tombstone as re-allowed (rule 25).\n   */\n  async revoke(tombstoneId: string, createdBy: TombstoneCreatedBy): Promise<string> {\n    await this.load();\n    const createdAt = new Date().toISOString();\n    const id = newTombstoneId();\n    const entry: TombstoneEntry = {\n      id,\n      kind: \"revocation\",\n      reason: \"correction\",\n      sourceMemoryId: \"\",\n      contentHash: \"\",\n      normalizedText: \"\",\n      namespace: this.namespace,\n      createdAt,\n      createdBy,\n      revokes: tombstoneId,\n    };\n    await this.serializeAppend(entry);\n    this.indexEntry(entry);\n    this.markWritten();\n    return id;\n  }\n\n  private serializeAppend(entry: TombstoneEntry): Promise<void> {\n    const line = JSON.stringify(entry) + \"\\n\";\n    // serializeMutations recovers after rejection (rule 40): a failed append\n    // surfaces to THIS caller but the next append is not poisoned.\n    return serializeMutations(`tombstone:${this.filePath}`, () =>\n      this.io.append(this.filePath, line),\n    );\n  }\n\n  /**\n   * Look up whether `query` is blocked by an active (non-revoked) tombstone.\n   * Tiers are checked in order: exact (contentHash) → normalized → keyed →\n   * semantic (off by default). Returns the first active match, or `null`.\n   *\n   * Namespace isolation (rule 42): only entries with `namespace === query.namespace`\n   * match. The store is per-namespace, so this is belt-and-suspenders.\n   */\n  lookup(query: TombstoneLookupQuery): TombstoneMatch | null {\n    // We intentionally do NOT await load() here — lookup is called from the\n    // hot write path. Callers MUST ensure the store is loaded before lookup\n    // (StorageManager does this in ensureTombstoneStoreLoaded). If not loaded,\n    // lookup returns null (fail-open: a missing tombstone check is preferable\n    // to crashing every write — see rule 34 / the \"degrade gracefully\" note).\n    if (!this.options.enabled) return null;\n    if (!this.loaded) return null;\n\n    // Tier 1: exact contentHash. Namespace is part of the map key (thread\n    // Ocs-O), so the lookup finds only this namespace's tombstone even when\n    // the backing file is shared. The namespace equality check below is kept\n    // as defense-in-depth.\n    const ns = query.namespace;\n    if (query.contentHash) {\n      const id = this.byHash.get(`${ns}\\0${query.contentHash}`);\n      if (id && !this.revokedIds.has(id)) {\n        const entry = this.byId.get(id);\n        if (entry && entry.namespace === ns) {\n          return { tombstoneId: id, matchedTier: \"exact\", reason: entry.reason };\n        }\n      }\n    }\n    // Tier 2: normalized text.\n    if (query.normalizedText) {\n      const id = this.byNormalized.get(`${ns}\\0${query.normalizedText}`);\n      if (id && !this.revokedIds.has(id)) {\n        const entry = this.byId.get(id);\n        if (entry && entry.namespace === ns) {\n          return { tombstoneId: id, matchedTier: \"normalized\", reason: entry.reason };\n        }\n      }\n    }\n    // Tier 3: keyed (entityRef + supersessionKey). Issue #1579 thread\n    // Ociag/Oci-W: check EVERY supplied key, not just the first — emitters\n    // append one tombstone per matched supersession key, so the active block\n    // can live on any later key. The union of `supersessionKey` (singular,\n    // direct callers) and `supersessionKeys` (array, write chokepoint) is\n    // checked; the first active match wins (tiers are equality-based, so\n    // ordering across keys does not affect correctness).\n    if (query.entityRef) {\n      const keysToCheck: string[] = [];\n      if (query.supersessionKey) keysToCheck.push(query.supersessionKey);\n      if (query.supersessionKeys) {\n        for (const k of query.supersessionKeys) {\n          if (!keysToCheck.includes(k)) keysToCheck.push(k);\n        }\n      }\n      for (const key of keysToCheck) {\n        const id = this.byKey.get(keyedTierKey(ns, query.entityRef, key));\n        if (id && !this.revokedIds.has(id)) {\n          const entry = this.byId.get(id);\n          if (entry && entry.namespace === ns) {\n            return { tombstoneId: id, matchedTier: \"keyed\", reason: entry.reason };\n          }\n        }\n      }\n    }\n    // Tier 4: semantic (off by default, rule 48).\n    if (this.options.semanticMatch && this.options.semanticSimilarity && query.normalizedText) {\n      const threshold = this.options.semanticThreshold;\n      let best: { id: string; reason: TombstoneReason; score: number } | null = null;\n      for (const entry of this.entries) {\n        if (entry.kind !== \"tombstone\") continue;\n        if (entry.namespace !== query.namespace) continue;\n        if (this.revokedIds.has(entry.id)) continue;\n        if (!entry.normalizedText) continue;\n        const score = this.options.semanticSimilarity(query.normalizedText, entry.normalizedText);\n        if (score >= threshold && (!best || score > best.score)) {\n          best = { id: entry.id, reason: entry.reason, score };\n        }\n      }\n      if (best) {\n        return { tombstoneId: best.id, matchedTier: \"semantic\", reason: best.reason };\n      }\n    }\n    return null;\n  }\n\n  /** Aggregate stats for the doctor / x-ray surfaces. */\n  stats(): TombstoneStats {\n    let active = 0;\n    for (const entry of this.entries) {\n      if (entry.kind === \"tombstone\" && !this.revokedIds.has(entry.id)) active += 1;\n    }\n    return {\n      count: active,\n      revoked: this.revokedIds.size,\n      lastAppendAt: this.lastAppendAt,\n      corruptedLines: this.corruptedLines,\n      loaded: this.loaded,\n    };\n  }\n\n  /** Read-only snapshot of all entries (for rebuild + tests). */\n  snapshot(): readonly TombstoneEntry[] {\n    return this.entries;\n  }\n\n  /**\n   * Rebuild the in-memory index + JSONL from the supplied retired-memory\n   * records + existing entries (preserving revocations). Byte-stable: entries\n   * are sorted by (createdAt, id) before write (rule 38).\n   *\n   * Returns the count of tombstone entries written.\n   */\n  async rebuild(retiredMemories: ReadonlyArray<RetiredMemoryRecord>): Promise<number> {\n    // Preserve existing revocations (all namespaces — ids are globally\n    // unique) so a rebuild does not silently un-revoke.\n    const existingRevocations = this.entries.filter((e) => e.kind === \"revocation\");\n    // Preserve tombstone entries from OTHER namespaces when the backing file\n    // is shared (issue #1579 thread Oc2MJ). rebuild rewrites the entire file;\n    // without preserving foreign entries, rebuilding namespace A would\n    // silently delete namespace B's tombstones, allowing resurrection in B.\n    const foreignTombstones = this.entries.filter(\n      (e) => e.kind === \"tombstone\" && e.namespace !== this.namespace,\n    );\n    // Reuse existing tombstone ids for source-equivalent entries so a prior\n    // revocation (which references the tombstone id) survives rebuild — minting\n    // fresh ids would orphan the revocation and silently un-revoke the content.\n    // Issue #1579 thread Oci-T: key the reuse map by (sourceMemoryId,\n    // supersessionKey), not just sourceMemoryId. A retired fact with multiple\n    // structured-attribute keys emits one record per key (see\n    // collectRetiredMemoriesForRebuild); keying only by sourceMemoryId made\n    // every rebuilt record share one id, so a revocation of key A silently\n    // revoked key B (over-revoke) — or, if a prior single-key tombstone was\n    // revoked, the new multi-key records all inherited a revoked id and\n    // silently un-blocked (orphan). Including the supersession-key\n    // discriminator keeps each keyed tombstone's id (and thus its revocation)\n    // independent. Records without a supersession key fall back to a stable\n    // empty-string discriminator so they still reuse by sourceMemoryId alone.\n    const existingBySource = new Map<string, string>();\n    for (const e of this.entries) {\n      if (e.kind === \"tombstone\") {\n        existingBySource.set(`${e.sourceMemoryId}\\u{0000}${e.supersessionKey ?? \"\"}`, e.id);\n      }\n    }\n    const rebuilt: TombstoneEntry[] = retiredMemories.map((m) => ({\n      id:\n        existingBySource.get(`${m.memoryId}\\u{0000}${m.supersessionKey ?? \"\"}`) ??\n        newTombstoneId(),\n      kind: \"tombstone\" as const,\n      reason: m.reason,\n      sourceMemoryId: m.memoryId,\n      contentHash: m.contentHash ?? this.options.hashContent(m.rawContent),\n      normalizedText: this.options.normalizeText(m.rawContent),\n      ...(m.entityRef ? { entityRef: m.entityRef } : {}),\n      ...(m.supersessionKey ? { supersessionKey: m.supersessionKey } : {}),\n      namespace: this.namespace,\n      createdAt: m.createdAt,\n      createdBy: m.createdBy,\n    }));\n    // Sort deterministically (rule 38): createdAt, then id for stability.\n    rebuilt.sort((a, b) =>\n      a.createdAt === b.createdAt\n        ? a.id < b.id ? -1 : a.id > b.id ? 1 : 0\n        : a.createdAt < b.createdAt ? -1 : 1,\n    );\n    const all = [...rebuilt, ...existingRevocations, ...foreignTombstones].sort((a, b) =>\n      a.createdAt === b.createdAt\n        ? a.id < b.id ? -1 : a.id > b.id ? 1 : 0\n        : a.createdAt < b.createdAt ? -1 : 1,\n    );\n    const serialized = all.map((e) => JSON.stringify(e)).join(\"\\n\") + (all.length > 0 ? \"\\n\" : \"\");\n    await serializeMutations(`tombstone-rebuild:${this.filePath}`, () =>\n      this.io.write(this.filePath, serialized),\n    );\n    this.resetIndex();\n    for (const entry of all) this.indexEntry(entry);\n    this.corruptedLines = 0;\n    this.loaded = true;\n    this.markWritten();\n    return rebuilt.length;\n  }\n}\n\n/** A retired memory projected into the shape `TombstoneStore.rebuild` consumes. */\nexport interface RetiredMemoryRecord {\n  memoryId: string;\n  rawContent: string;\n  entityRef?: string;\n  supersessionKey?: string;\n  reason: TombstoneReason;\n  createdBy: TombstoneCreatedBy;\n  createdAt: string;\n  /** Canonical contentHash from the retired memory's frontmatter (#1579). */\n  contentHash?: string;\n}\n\n/**\n * Project a corpus of memories into the retired-memory records `rebuild`\n * consumes. Pure (no I/O) so the StorageManager wiring stays thin (#1579,\n * #1520 god-file ratchet). Only superseded / forgotten / rejected FACTS\n * participate — entities, questions, and artifacts have their own lifecycle\n * (issue pitfall). The supersession key is derived from structured attributes\n * via the injected helper so there is one keyed-tier definition (rule 23).\n */\nexport function collectRetiredMemoriesForRebuild(\n  memories: ReadonlyArray<{\n    frontmatter: {\n      id: string;\n      status?: string;\n      category?: string;\n      contentHash?: string;\n      entityRef?: string;\n      structuredAttributes?: Record<string, string>;\n      updated?: string;\n      created?: string;\n    };\n    content: string;\n  }>,\n  deps: {\n    /** Strip citation annotations from the body before hashing/normalizing. */\n    stripCitation: (text: string) => string;\n    /** Derive the keyed-tier supersession key (one helper, rule 23). */\n    supersessionKeysForFact: (spec: {\n      entityRef?: string;\n      structuredAttributes?: Record<string, string>;\n    }) => string[];\n  },\n): RetiredMemoryRecord[] {\n  const retired: RetiredMemoryRecord[] = [];\n  for (const m of memories) {\n    const status = m.frontmatter.status;\n    if (status !== \"superseded\" && status !== \"rejected\" && status !== \"forgotten\") continue;\n    if (m.frontmatter.category !== \"fact\") continue;\n    const reason: TombstoneReason =\n      status === \"superseded\" ? \"supersession\" : status === \"forgotten\" ? \"retraction\" : \"correction\";\n    const createdBy: TombstoneCreatedBy =\n      reason === \"supersession\" ? \"supersession\" : \"user_correction\";\n    const entityRef = m.frontmatter.entityRef;\n    const keys =\n      entityRef && m.frontmatter.structuredAttributes\n        ? deps.supersessionKeysForFact({\n            entityRef,\n            structuredAttributes: m.frontmatter.structuredAttributes,\n          })\n        : [];\n    // Issue #1579 thread Ocgjz: emit one record per matched supersession key\n    // (not just keys[0]) so rebuild reproduces the same keyed tombstones as\n    // live temporal-supersession (which now appends one per key — thread ObteS).\n    // Without this, a rebuild would under-rebuild the JSONL and keyed-tier\n    // blocks would disappear until rediscovered.\n    const keysToEmit = keys.length > 0 ? keys : [undefined];\n    for (const key of keysToEmit) {\n      retired.push({\n        memoryId: m.frontmatter.id,\n        rawContent: deps.stripCitation(m.content),\n        contentHash: m.frontmatter.contentHash,\n        ...(entityRef ? { entityRef } : {}),\n        ...(key ? { supersessionKey: key } : {}),\n        reason,\n        createdBy,\n        createdAt: m.frontmatter.updated || m.frontmatter.created || new Date().toISOString(),\n      });\n    }\n  }\n  return retired;\n}\n\n/**\n * Build the live-emission tombstone inputs for a single retired FACT — one\n * input per derived supersession key (or a single keyless record when no\n * structured attributes are present). Pure (no I/O) so the emitters in\n * `StorageManager.supersedeMemory` (contradiction) and `forgetMemory`\n * (retraction) stay thin (#1579, #1520 god-file ratchet). Mirrors the\n * temporal-supersession emitter and `collectRetiredMemoriesForRebuild` so\n * every retire path emits the same keyed-tombstone shape (issue #1579\n * threads Oci-Y / OchiF: without per-key tombstones, a paraphrased\n * re-observation missed the keyed tier and the fact resurrected active).\n */\nexport function buildRetiredFactTombstoneInputs(\n  memory: {\n    id: string;\n    content: string;\n    contentHash?: string;\n    entityRef?: string;\n    structuredAttributes?: Record<string, string>;\n  },\n  opts: {\n    reason: TombstoneReason;\n    createdBy: TombstoneCreatedBy;\n    createdAt: string;\n    supersessionKeysForFact: (spec: {\n      entityRef?: string;\n      structuredAttributes?: Record<string, string>;\n    }) => string[];\n  },\n): Array<{\n  reason: TombstoneReason;\n  createdBy: TombstoneCreatedBy;\n  sourceMemoryId: string;\n  rawContent: string;\n  contentHash?: string;\n  entityRef?: string;\n  supersessionKey?: string;\n  createdAt: string;\n}> {\n  const keys =\n    memory.entityRef && memory.structuredAttributes\n      ? opts.supersessionKeysForFact({\n          entityRef: memory.entityRef,\n          structuredAttributes: memory.structuredAttributes,\n        })\n      : [];\n  const keysToEmit = keys.length > 0 ? keys : [undefined];\n  return keysToEmit.map((key) => ({\n    reason: opts.reason,\n    createdBy: opts.createdBy,\n    sourceMemoryId: memory.id,\n    rawContent: memory.content,\n    ...(memory.contentHash ? { contentHash: memory.contentHash } : {}),\n    ...(memory.entityRef ? { entityRef: memory.entityRef } : {}),\n    ...(key ? { supersessionKey: key } : {}),\n    createdAt: opts.createdAt,\n  }));\n}\n"],"mappings":";;;;;AA0JA,IAAM,mBAAmB;AAEzB,SAAS,iBAAyB;AAChC,SAAO,GAAG,gBAAgB,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACjG;AASA,SAAS,aAAa,WAAmB,WAAmB,iBAAiC;AAC3F,SAAO,GAAG,SAAS,KAAK,SAAS,KAAK,eAAe;AACvD;AAOO,SAAS,mBAAmB,MAAqC;AACtE,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,EAAG,QAAO;AAC1D,MAAI,EAAE,SAAS,eAAe,EAAE,SAAS,aAAc,QAAO;AAC9D,MACE,EAAE,WAAW,gBACb,EAAE,WAAW,kBACb,EAAE,WAAW,gBACb,EAAE,WAAW,4BACb;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,EAAE,mBAAmB,SAAU,QAAO;AACjD,MAAI,OAAO,EAAE,gBAAgB,SAAU,QAAO;AAC9C,MAAI,OAAO,EAAE,mBAAmB,SAAU,QAAO;AACjD,MAAI,OAAO,EAAE,cAAc,SAAU,QAAO;AAC5C,MAAI,OAAO,EAAE,cAAc,SAAU,QAAO;AAC5C,MACE,EAAE,cAAc,qBAChB,EAAE,cAAc,8BAChB,EAAE,cAAc,kBAChB,EAAE,cAAc,QAChB;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAsB;AAAA,IAC1B,IAAI,EAAE;AAAA,IACN,MAAM,EAAE;AAAA,IACR,QAAQ,EAAE;AAAA,IACV,gBAAgB,EAAE;AAAA,IAClB,aAAa,EAAE;AAAA,IACf,gBAAgB,EAAE;AAAA,IAClB,WAAW,EAAE;AAAA,IACb,WAAW,EAAE;AAAA,IACb,WAAW,EAAE;AAAA,EACf;AACA,MAAI,OAAO,EAAE,cAAc,SAAU,KAAI,YAAY,EAAE;AACvD,MAAI,OAAO,EAAE,oBAAoB,SAAU,KAAI,kBAAkB,EAAE;AACnE,MAAI,OAAO,EAAE,YAAY,SAAU,KAAI,UAAU,EAAE;AACnD,SAAO;AACT;AASO,IAAM,iBAAN,MAAqB;AAAA,EAwB1B,YACmB,UACA,WACA,SACA,IACjB;AAJiB;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAJgB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EA3BX,UAA4B,CAAC;AAAA;AAAA,EAEpB,SAAS,oBAAI,IAAoB;AAAA;AAAA,EAEjC,eAAe,oBAAI,IAAoB;AAAA;AAAA,EAEvC,QAAQ,oBAAI,IAAoB;AAAA;AAAA,EAEhC,aAAa,oBAAI,IAAY;AAAA;AAAA,EAE7B,OAAO,oBAAI,IAA4B;AAAA,EAChD,SAAS;AAAA,EACT,cAAoC;AAAA,EACpC,iBAAiB;AAAA,EACjB,eAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO9B,cAAc;AAAA;AAAA,EAUtB,MAAM,OAAsB;AAC1B,QAAI,KAAK,OAAQ;AACjB,QAAI,KAAK,YAAa,QAAO,KAAK;AAClC,SAAK,cAAc,KAAK,aAAa;AACrC,QAAI;AACF,YAAM,KAAK;AAAA,IACb,UAAE;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,eAA8B;AAK1C,SAAK,gBAAgB;AACrB,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,GAAG,KAAK,KAAK,QAAQ;AAAA,IACxC,SAAS,KAAK;AAIZ,YAAM,OAAQ,KAA+B;AAC7C,UAAI,SAAS,UAAU;AAAA,MAGvB;AACA,WAAK,SAAS;AACd;AAAA,IACF;AACA,SAAK,WAAW;AAChB,QAAI,YAAY;AAChB,eAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,YAAM,QAAQ,mBAAmB,IAAI;AACrC,UAAI,CAAC,OAAO;AACV,YAAI,KAAK,KAAK,EAAE,SAAS,EAAG,cAAa;AACzC;AAAA,MACF;AACA,WAAK,WAAW,KAAK;AAAA,IACvB;AACA,SAAK,iBAAiB;AACtB,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,aAAmB;AACzB,SAAK,UAAU,CAAC;AAChB,SAAK,OAAO,MAAM;AAClB,SAAK,aAAa,MAAM;AACxB,SAAK,MAAM,MAAM;AACjB,SAAK,WAAW,MAAM;AACtB,SAAK,KAAK,MAAM;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,WAAW,OAA6B;AAC9C,SAAK,QAAQ,KAAK,KAAK;AACvB,SAAK,KAAK,IAAI,MAAM,IAAI,KAAK;AAC7B,QAAI,MAAM,aAAa,KAAK,gBAAgB,KAAK;AAC/C,WAAK,eAAe,MAAM;AAAA,IAC5B;AACA,QAAI,MAAM,SAAS,cAAc;AAC/B,UAAI,MAAM,QAAS,MAAK,WAAW,IAAI,MAAM,OAAO;AACpD;AAAA,IACF;AAOA,UAAM,KAAK,MAAM;AACjB,QAAI,MAAM,YAAa,MAAK,OAAO,IAAI,GAAG,EAAE,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE;AAC9E,QAAI,MAAM,eAAgB,MAAK,aAAa,IAAI,GAAG,EAAE,KAAK,MAAM,cAAc,IAAI,MAAM,EAAE;AAC1F,QAAI,MAAM,aAAa,MAAM,iBAAiB;AAC5C,WAAK,MAAM,IAAI,aAAa,IAAI,MAAM,WAAW,MAAM,eAAe,GAAG,MAAM,EAAE;AAAA,IACnF;AAAA,EACF;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,SAAS;AACd,SAAK,cAAc;AACnB,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,yBAAwC;AAC5C,QAAI,CAAC,KAAK,GAAG,KAAM;AACnB,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,KAAK,GAAG,KAAK,KAAK,QAAQ,EAAE,OAAO;AAAA,IAC1D,QAAQ;AACN;AAAA,IACF;AACA,QAAI,YAAY,KAAK,eAAe,KAAK,OAAQ;AACjD,SAAK,cAAc;AACnB,SAAK,WAAW;AAChB,UAAM,KAAK,KAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,cAAoB;AAC1B,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEQ,kBAAwB;AAC9B,QAAI,CAAC,KAAK,GAAG,KAAM;AACnB,QAAI;AACF,WAAK,cAAc,KAAK,MAAM,KAAK,GAAG,KAAK,KAAK,QAAQ,EAAE,OAAO;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBAAgB,OAgBF;AAClB,UAAM,KAAK,KAAK;AAChB,UAAM,YAAY,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC5D,UAAM,KAAK,eAAe;AAC1B,UAAM,QAAwB;AAAA,MAC5B;AAAA,MACA,MAAM;AAAA,MACN,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM;AAAA,MACtB,aAAa,MAAM,eAAe,KAAK,QAAQ,YAAY,MAAM,UAAU;AAAA,MAC3E,gBAAgB,KAAK,QAAQ,cAAc,MAAM,UAAU;AAAA,MAC3D,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,MAC1E,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,WAAW,MAAM;AAAA,IACnB;AACA,UAAM,KAAK,gBAAgB,KAAK;AAChC,SAAK,WAAW,KAAK;AACrB,SAAK,YAAY;AACjB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,aAAqB,WAAgD;AAChF,UAAM,KAAK,KAAK;AAChB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,KAAK,eAAe;AAC1B,UAAM,QAAwB;AAAA,MAC5B;AAAA,MACA,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AACA,UAAM,KAAK,gBAAgB,KAAK;AAChC,SAAK,WAAW,KAAK;AACrB,SAAK,YAAY;AACjB,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,OAAsC;AAC5D,UAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AAGrC,WAAO;AAAA,MAAmB,aAAa,KAAK,QAAQ;AAAA,MAAI,MACtD,KAAK,GAAG,OAAO,KAAK,UAAU,IAAI;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAO,OAAoD;AAMzD,QAAI,CAAC,KAAK,QAAQ,QAAS,QAAO;AAClC,QAAI,CAAC,KAAK,OAAQ,QAAO;AAMzB,UAAM,KAAK,MAAM;AACjB,QAAI,MAAM,aAAa;AACrB,YAAM,KAAK,KAAK,OAAO,IAAI,GAAG,EAAE,KAAK,MAAM,WAAW,EAAE;AACxD,UAAI,MAAM,CAAC,KAAK,WAAW,IAAI,EAAE,GAAG;AAClC,cAAM,QAAQ,KAAK,KAAK,IAAI,EAAE;AAC9B,YAAI,SAAS,MAAM,cAAc,IAAI;AACnC,iBAAO,EAAE,aAAa,IAAI,aAAa,SAAS,QAAQ,MAAM,OAAO;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,gBAAgB;AACxB,YAAM,KAAK,KAAK,aAAa,IAAI,GAAG,EAAE,KAAK,MAAM,cAAc,EAAE;AACjE,UAAI,MAAM,CAAC,KAAK,WAAW,IAAI,EAAE,GAAG;AAClC,cAAM,QAAQ,KAAK,KAAK,IAAI,EAAE;AAC9B,YAAI,SAAS,MAAM,cAAc,IAAI;AACnC,iBAAO,EAAE,aAAa,IAAI,aAAa,cAAc,QAAQ,MAAM,OAAO;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAQA,QAAI,MAAM,WAAW;AACnB,YAAM,cAAwB,CAAC;AAC/B,UAAI,MAAM,gBAAiB,aAAY,KAAK,MAAM,eAAe;AACjE,UAAI,MAAM,kBAAkB;AAC1B,mBAAW,KAAK,MAAM,kBAAkB;AACtC,cAAI,CAAC,YAAY,SAAS,CAAC,EAAG,aAAY,KAAK,CAAC;AAAA,QAClD;AAAA,MACF;AACA,iBAAW,OAAO,aAAa;AAC7B,cAAM,KAAK,KAAK,MAAM,IAAI,aAAa,IAAI,MAAM,WAAW,GAAG,CAAC;AAChE,YAAI,MAAM,CAAC,KAAK,WAAW,IAAI,EAAE,GAAG;AAClC,gBAAM,QAAQ,KAAK,KAAK,IAAI,EAAE;AAC9B,cAAI,SAAS,MAAM,cAAc,IAAI;AACnC,mBAAO,EAAE,aAAa,IAAI,aAAa,SAAS,QAAQ,MAAM,OAAO;AAAA,UACvE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ,iBAAiB,KAAK,QAAQ,sBAAsB,MAAM,gBAAgB;AACzF,YAAM,YAAY,KAAK,QAAQ;AAC/B,UAAI,OAAsE;AAC1E,iBAAW,SAAS,KAAK,SAAS;AAChC,YAAI,MAAM,SAAS,YAAa;AAChC,YAAI,MAAM,cAAc,MAAM,UAAW;AACzC,YAAI,KAAK,WAAW,IAAI,MAAM,EAAE,EAAG;AACnC,YAAI,CAAC,MAAM,eAAgB;AAC3B,cAAM,QAAQ,KAAK,QAAQ,mBAAmB,MAAM,gBAAgB,MAAM,cAAc;AACxF,YAAI,SAAS,cAAc,CAAC,QAAQ,QAAQ,KAAK,QAAQ;AACvD,iBAAO,EAAE,IAAI,MAAM,IAAI,QAAQ,MAAM,QAAQ,MAAM;AAAA,QACrD;AAAA,MACF;AACA,UAAI,MAAM;AACR,eAAO,EAAE,aAAa,KAAK,IAAI,aAAa,YAAY,QAAQ,KAAK,OAAO;AAAA,MAC9E;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,QAAwB;AACtB,QAAI,SAAS;AACb,eAAW,SAAS,KAAK,SAAS;AAChC,UAAI,MAAM,SAAS,eAAe,CAAC,KAAK,WAAW,IAAI,MAAM,EAAE,EAAG,WAAU;AAAA,IAC9E;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,SAAS,KAAK,WAAW;AAAA,MACzB,cAAc,KAAK;AAAA,MACnB,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAAA;AAAA,EAGA,WAAsC;AACpC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAAQ,iBAAsE;AAGlF,UAAM,sBAAsB,KAAK,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,YAAY;AAK9E,UAAM,oBAAoB,KAAK,QAAQ;AAAA,MACrC,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,cAAc,KAAK;AAAA,IACxD;AAeA,UAAM,mBAAmB,oBAAI,IAAoB;AACjD,eAAW,KAAK,KAAK,SAAS;AAC5B,UAAI,EAAE,SAAS,aAAa;AAC1B,yBAAiB,IAAI,GAAG,EAAE,cAAc,KAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE;AAAA,MACpF;AAAA,IACF;AACA,UAAM,UAA4B,gBAAgB,IAAI,CAAC,OAAO;AAAA,MAC5D,IACE,iBAAiB,IAAI,GAAG,EAAE,QAAQ,KAAW,EAAE,mBAAmB,EAAE,EAAE,KACtE,eAAe;AAAA,MACjB,MAAM;AAAA,MACN,QAAQ,EAAE;AAAA,MACV,gBAAgB,EAAE;AAAA,MAClB,aAAa,EAAE,eAAe,KAAK,QAAQ,YAAY,EAAE,UAAU;AAAA,MACnE,gBAAgB,KAAK,QAAQ,cAAc,EAAE,UAAU;AAAA,MACvD,GAAI,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,MAChD,GAAI,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAClE,WAAW,KAAK;AAAA,MAChB,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf,EAAE;AAEF,YAAQ;AAAA,MAAK,CAAC,GAAG,MACf,EAAE,cAAc,EAAE,YACd,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IACrC,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,IACvC;AACA,UAAM,MAAM,CAAC,GAAG,SAAS,GAAG,qBAAqB,GAAG,iBAAiB,EAAE;AAAA,MAAK,CAAC,GAAG,MAC9E,EAAE,cAAc,EAAE,YACd,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IACrC,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,IACvC;AACA,UAAM,aAAa,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,OAAO;AAC3F,UAAM;AAAA,MAAmB,qBAAqB,KAAK,QAAQ;AAAA,MAAI,MAC7D,KAAK,GAAG,MAAM,KAAK,UAAU,UAAU;AAAA,IACzC;AACA,SAAK,WAAW;AAChB,eAAW,SAAS,IAAK,MAAK,WAAW,KAAK;AAC9C,SAAK,iBAAiB;AACtB,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,WAAO,QAAQ;AAAA,EACjB;AACF;AAuBO,SAAS,iCACd,UAaA,MASuB;AACvB,QAAM,UAAiC,CAAC;AACxC,aAAW,KAAK,UAAU;AACxB,UAAM,SAAS,EAAE,YAAY;AAC7B,QAAI,WAAW,gBAAgB,WAAW,cAAc,WAAW,YAAa;AAChF,QAAI,EAAE,YAAY,aAAa,OAAQ;AACvC,UAAM,SACJ,WAAW,eAAe,iBAAiB,WAAW,cAAc,eAAe;AACrF,UAAM,YACJ,WAAW,iBAAiB,iBAAiB;AAC/C,UAAM,YAAY,EAAE,YAAY;AAChC,UAAM,OACJ,aAAa,EAAE,YAAY,uBACvB,KAAK,wBAAwB;AAAA,MAC3B;AAAA,MACA,sBAAsB,EAAE,YAAY;AAAA,IACtC,CAAC,IACD,CAAC;AAMP,UAAM,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,MAAS;AACtD,eAAW,OAAO,YAAY;AAC5B,cAAQ,KAAK;AAAA,QACX,UAAU,EAAE,YAAY;AAAA,QACxB,YAAY,KAAK,cAAc,EAAE,OAAO;AAAA,QACxC,aAAa,EAAE,YAAY;AAAA,QAC3B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,QACjC,GAAI,MAAM,EAAE,iBAAiB,IAAI,IAAI,CAAC;AAAA,QACtC;AAAA,QACA;AAAA,QACA,WAAW,EAAE,YAAY,WAAW,EAAE,YAAY,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAaO,SAAS,gCACd,QAOA,MAkBC;AACD,QAAM,OACJ,OAAO,aAAa,OAAO,uBACvB,KAAK,wBAAwB;AAAA,IAC3B,WAAW,OAAO;AAAA,IAClB,sBAAsB,OAAO;AAAA,EAC/B,CAAC,IACD,CAAC;AACP,QAAM,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,MAAS;AACtD,SAAO,WAAW,IAAI,CAAC,SAAS;AAAA,IAC9B,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK;AAAA,IAChB,gBAAgB,OAAO;AAAA,IACvB,YAAY,OAAO;AAAA,IACnB,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;AAAA,IAChE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1D,GAAI,MAAM,EAAE,iBAAiB,IAAI,IAAI,CAAC;AAAA,IACtC,WAAW,KAAK;AAAA,EAClB,EAAE;AACJ;","names":[]}