@remnic/core 9.3.720 → 9.3.721

package/dist/{chunk-Y4I7SOJN.js → chunk-LA3HZKES.js}

@@ -4,16 +4,16 @@ import {
   loadSyncState,
   syncWearableSource,
   wearableSourceLabel
-} from "./chunk-DGTDRIUO.js";
+} from "./chunk-4T3BMHKD.js";
 import {
   MaintenanceScheduler
-} from "./chunk-DG3ORVCU.js";
+} from "./chunk-Z4RU5VPM.js";
 import {
   migrateFromEngram
 } from "./chunk-7HYPN2GC.js";
 import {
   LcmEngine
-} from "./chunk-NO4DWSQE.js";
+} from "./chunk-PKMQK2WY.js";
 import {
   chunkTranscriptEntries
 } from "./chunk-TECVW3JP.js";
@@ -23,7 +23,7 @@ import {
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "./chunk-HAPVZ4CO.js";
+} from "./chunk-WQYSDPMA.js";
 import {
   SharedContextManager
 } from "./chunk-UFS7OXGL.js";
@@ -32,6 +32,12 @@ import {
   applyUtilityRankingRuntimeDelta,
   loadUtilityRuntimeValues
 } from "./chunk-LXOM6IQU.js";
+import {
+  TierMigrationExecutor
+} from "./chunk-VOUOLGIP.js";
+import {
+  decideTierTransition
+} from "./chunk-S75M5ZRK.js";
 import {
   TmtBuilder
 } from "./chunk-ECZU5BJH.js";
@@ -46,39 +52,19 @@ import {
 import {
   renderEpistemicHedge
 } from "./chunk-YN2UN7N3.js";
+import {
+  buildTargetedFactRecallSection,
+  shouldRecallTargetedFactEvidence
+} from "./chunk-4SBW47WK.js";
 import {
   CODEX_THREAD_KEY_PREFIX
 } from "./chunk-4EX5WZ4M.js";
-import {
-  TierMigrationExecutor
-} from "./chunk-VOUOLGIP.js";
-import {
-  decideTierTransition
-} from "./chunk-S75M5ZRK.js";
 import {
   HourlySummarizer
-} from "./chunk-IO5NQEGZ.js";
-import {
-  buildTargetedFactRecallSection,
-  shouldRecallTargetedFactEvidence
-} from "./chunk-4SBW47WK.js";
+} from "./chunk-DKT3X5C3.js";
 import {
   SessionObserverState
 } from "./chunk-DKTSR7EK.js";
-import {
-  applyRuntimeRetrievalPolicy
-} from "./chunk-5IZL4DCV.js";
-import {
-  RelevanceStore
-} from "./chunk-GG6AJN7A.js";
-import {
-  RerankCache,
-  rerankLocalOrNoop
-} from "./chunk-E3VODCC3.js";
-import {
-  buildResponseGuidanceRecallSection,
-  shouldRecallResponseGuidance
-} from "./chunk-L6W77GWW.js";
 import {
   mergeWithAgentResults,
   runDirectAgent,
@@ -97,27 +83,44 @@ import {
   recencyWindowFromPrompt,
   resolvePromptTagPrefilterAsync
 } from "./chunk-MGN7VHWQ.js";
+import {
+  applyRuntimeRetrievalPolicy
+} from "./chunk-5IZL4DCV.js";
+import {
+  findUnresolvedEntityRefs
+} from "./chunk-X7XN6YU4.js";
+import {
+  RelevanceStore
+} from "./chunk-GG6AJN7A.js";
+import {
+  RerankCache,
+  rerankLocalOrNoop
+} from "./chunk-E3VODCC3.js";
+import {
+  buildResponseGuidanceRecallSection,
+  shouldRecallResponseGuidance
+} from "./chunk-L6W77GWW.js";
+import {
+  createRecallSectionMetricRecorder
+} from "./chunk-VQ34TERH.js";
 import {
   LastRecallStore,
   RecallHandleHistoryStore,
   TierMigrationStatusStore,
   clampGraphRecallExpandedEntries
 } from "./chunk-UC4YOAC2.js";
-import {
-  findUnresolvedEntityRefs
-} from "./chunk-X7XN6YU4.js";
 import {
   reorderRecallResultsWithMmr
 } from "./chunk-YDBIWGNI.js";
-import {
-  createRecallSectionMetricRecorder
-} from "./chunk-VQ34TERH.js";
 import {
   applyReasoningTraceBoost
 } from "./chunk-ZZTOURJI.js";
 import {
   NegativeExampleStore
 } from "./chunk-EXM3CQTZ.js";
+import {
+  evaluateMemoryActionPolicy
+} from "./chunk-H63EDPFJ.js";
 import {
   applyMemoryWorthFilter,
   buildMemoryWorthCounterMap
@@ -125,9 +128,6 @@ import {
 import {
   runLiveConnectorsOnce
 } from "./chunk-VU3SVYMA.js";
-import {
-  evaluateMemoryActionPolicy
-} from "./chunk-H63EDPFJ.js";
 import {
   hasBroadGraphIntent,
   inferIntentFromText,
@@ -144,10 +144,10 @@ import {
   getVerdictKind,
   judgeFactDurability,
   validateProcedureExtraction
-} from "./chunk-TH7WMHVK.js";
+} from "./chunk-3NN73CM7.js";
 import {
   ExtractionEngine
-} from "./chunk-2SXMCQEQ.js";
+} from "./chunk-GZQXOQQ2.js";
 import {
   parseMemoryActionEligibilityContext
 } from "./chunk-5GSUBCZM.js";
@@ -184,47 +184,47 @@ import {
   buildEntityRecallSection,
   entityRecentTranscriptLookbackHours,
   readRecentEntityTranscriptEntries
-} from "./chunk-RX7EBFFJ.js";
+} from "./chunk-5O42UKXI.js";
 import {
   formatDaySummaryMemories
 } from "./chunk-EO5QWINU.js";
-import {
-  RoutingRulesStore
-} from "./chunk-WIWPSQYU.js";
 import {
   normalizeReplaySessionKey
 } from "./chunk-2PRQG7PV.js";
+import {
+  RoutingRulesStore
+} from "./chunk-WIWPSQYU.js";
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-H2AGJ5SV.js";
+} from "./chunk-EBDA5TYA.js";
 import {
   ThreadingManager
 } from "./chunk-QRDOSYOR.js";
 import {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
-} from "./chunk-O6SEGJNV.js";
+} from "./chunk-YEE5KJQQ.js";
 import {
   searchWorkProductLedgerEntries
 } from "./chunk-ZRWB5D4H.js";
 import {
   TranscriptManager
 } from "./chunk-GY3SKOS4.js";
+import {
+  PolicyRuntimeManager
+} from "./chunk-33JBK2XP.js";
 import {
   runNamespaceMaintenanceFanout,
   summarizeNamespaceMaintenanceHealth
-} from "./chunk-NERBFQNY.js";
+} from "./chunk-PD42EYQN.js";
 import {
   NamespaceCatalog,
   planNamespaceMaintenance
-} from "./chunk-WBHQ5LP5.js";
+} from "./chunk-EXUCUPV2.js";
 import {
   NamespaceStorageRouter
-} from "./chunk-JV7Q226R.js";
-import {
-  PolicyRuntimeManager
-} from "./chunk-33JBK2XP.js";
+} from "./chunk-OHTOPFRF.js";
 import {
   isAboveImportanceThreshold,
   scoreImportance
@@ -262,7 +262,7 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-HTIL3EJK.js";
+} from "./chunk-NXRUUDUF.js";
 import {
   buildRecallQueryPolicy
 } from "./chunk-LBJBNWS2.js";
@@ -303,7 +303,7 @@ import {
   clusterByKey,
   createCorrectionService,
   detectPassiveCorrections
-} from "./chunk-PPVCZPYA.js";
+} from "./chunk-VCLGUIFM.js";
 import {
   listTrustZoneRecords,
   searchTrustZoneRecords
@@ -313,25 +313,25 @@ import {
 } from "./chunk-FF4KLI5W.js";
 import {
   buildXraySnapshot
-} from "./chunk-3XEGHEQ2.js";
-import {
-  combineNamespaces,
-  getConfiguredNamespaces,
-  resolveCodingNamespaceOverlay,
-  resolveNamespaceFromStorageDir,
-  resolveScopePlan,
-  resolveScopeProfilePlan
-} from "./chunk-J6BH2OBA.js";
+} from "./chunk-GJSL4WG2.js";
 import {
   NamespaceSearchRouter
-} from "./chunk-IPJD7WJH.js";
+} from "./chunk-QR67FU5G.js";
 import {
   createConversationIndexRuntime,
   createSearchBackend
-} from "./chunk-UUMYB3FR.js";
+} from "./chunk-HCVWF657.js";
 import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
+import {
+  combineNamespaces,
+  getConfiguredNamespaces,
+  resolveCodingNamespaceOverlay,
+  resolveNamespaceFromStorageDir,
+  resolveScopePlan,
+  resolveScopeProfilePlan
+} from "./chunk-J6BH2OBA.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken,
@@ -362,17 +362,17 @@ import {
 } from "./chunk-DVRHLN2O.js";
 import {
   searchCausalTrajectories
-} from "./chunk-ZE7GJ76H.js";
+} from "./chunk-SQNED75R.js";
 import {
   GraphIndex
-} from "./chunk-XROP4ZHB.js";
+} from "./chunk-EHQ5HO5T.js";
 import {
   decideLifecycleTransition,
   resolveLifecycleState
 } from "./chunk-TBBDFYXW.js";
 import {
   buildChainFollowupGenerator
-} from "./chunk-T3XSXAWK.js";
+} from "./chunk-UO5ZHIIH.js";
 import {
   ContentHashIndex,
   StorageManager,
@@ -380,7 +380,7 @@ import {
   fingerprintEntityStructuredFacts,
   normalizeAttributePairs,
   parseEntityFile
-} from "./chunk-422TIKIH.js";
+} from "./chunk-EVPNWN7Z.js";
 import {
   buildRetiredFactTombstoneInputs
 } from "./chunk-L2B3EE7B.js";
@@ -414,16 +414,16 @@ import {
 } from "./chunk-SVOZFLIQ.js";
 import {
   confidenceTier
-} from "./chunk-ZW5I3UNP.js";
-import {
-  inferMemoryStatus,
-  isActiveMemoryStatus
-} from "./chunk-RULE4VG5.js";
+} from "./chunk-ILFSEIRT.js";
 import {
   buildQmdRecallCacheKey,
   getCachedQmdRecall,
   setCachedQmdRecall
 } from "./chunk-42JKGUFJ.js";
+import {
+  inferMemoryStatus,
+  isActiveMemoryStatus
+} from "./chunk-RULE4VG5.js";
 import {
   lintWorkspaceFiles,
   rotateMarkdownFileToArchive
@@ -432,12 +432,12 @@ import {
   applyFaithfulnessVerdict,
   createFaithfulnessCounters,
   runFaithfulnessGateBatch
-} from "./chunk-FEB7W5JG.js";
+} from "./chunk-6OIDDKAA.js";
 import {
   FallbackLlmClient,
   fallbackLlmRuntimeContextFromConfig,
   gatewayTaskChainOptions
-} from "./chunk-5J4OL7TJ.js";
+} from "./chunk-VUA4S7P6.js";
 import {
   keyring_exports,
   secureStoreDir
@@ -3931,7 +3931,7 @@ var Orchestrator = class _Orchestrator {
     if (signal.aborted) return;
     if (!this.wearablesAutoSyncHandle && this.config.wearables.enabled && this.config.wearables.autoSyncEnabled && Object.values(this.config.wearables.sources).some((source) => source.enabled)) {
       try {
-        const { startWearablesAutoSync } = await import("./auto-sync-24NNS3GU.js");
+        const { startWearablesAutoSync } = await import("./auto-sync-F3KCSQFJ.js");
         if (signal.aborted) return;
         this.wearablesAutoSyncHandle = startWearablesAutoSync(
           {
@@ -15793,4 +15793,4 @@ export {
   resolvePersistedMemoryRelativePath,
   Orchestrator
 };
-//# sourceMappingURL=chunk-Y4I7SOJN.js.map
+//# sourceMappingURL=chunk-LA3HZKES.js.map

package/dist/{chunk-LQ6JI4VH.js → chunk-LD53WPMU.js}

@@ -1,10 +1,10 @@
-import {
-  scanMemoryDir
-} from "./chunk-AER6MT24.js";
 import {
   isSearchAborted,
   throwIfSearchAborted
 } from "./chunk-CINZGPSJ.js";
+import {
+  scanMemoryDir
+} from "./chunk-AER6MT24.js";
 import {
   resolveEnsureCollectionArgs
 } from "./chunk-YNQ6DFSV.js";
@@ -605,4 +605,4 @@ export {
   resolveOramaCollectionDbFilePath,
   OramaBackend
 };
-//# sourceMappingURL=chunk-LQ6JI4VH.js.map
+//# sourceMappingURL=chunk-LD53WPMU.js.map

package/dist/{chunk-NE5WFIY6.js → chunk-LLUGAZ3B.js}

@@ -1,6 +1,6 @@
 import {
   EngramAccessInputError
-} from "./chunk-M3GBOKUX.js";
+} from "./chunk-GDUOCHCD.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -104,4 +104,4 @@ export {
   listRegisteredOperations,
   __resetRegistryForTest
 };
-//# sourceMappingURL=chunk-NE5WFIY6.js.map
+//# sourceMappingURL=chunk-LLUGAZ3B.js.map

package/dist/{chunk-RVLB4E6N.js → chunk-MDBZTH7N.js}

@@ -1,3 +1,7 @@
+import {
+  coerceBool,
+  coerceNumber
+} from "./chunk-PHK3HARR.js";
 import {
   isSafeMemoryContent
 } from "./chunk-5GKPFL3S.js";
@@ -10,34 +14,6 @@ import {
 
 // src/provenance.ts
 import { z } from "zod";
-
-// src/connectors/coerce.ts
-function coerceBool(value) {
-  if (typeof value === "boolean") return value;
-  if (typeof value === "string") {
-    const v = value.trim().toLowerCase();
-    if (["false", "0", "no", "off"].includes(v)) return false;
-    if (["true", "1", "yes", "on"].includes(v)) return true;
-  }
-  return void 0;
-}
-function coerceInstallExtension(value) {
-  return coerceBool(value);
-}
-function coerceNumber(value) {
-  if (typeof value === "number") {
-    return Number.isFinite(value) ? value : void 0;
-  }
-  if (typeof value === "string") {
-    const trimmed = value.trim();
-    if (trimmed.length === 0) return void 0;
-    const n = Number(trimmed);
-    return Number.isFinite(n) ? n : void 0;
-  }
-  return void 0;
-}
-
-// src/provenance.ts
 var PROVENANCE_SOURCE_KEY_ORDER = [
   "sessionKey",
   "turnId",
@@ -315,9 +291,6 @@ function buildFactProvenance(factQuote, turns, config) {
 }
 
 export {
-  coerceBool,
-  coerceInstallExtension,
-  coerceNumber,
   serializeProvenanceFields,
   parseProvenanceTag,
   reconcileProvenanceRead,
@@ -325,4 +298,4 @@ export {
   parseProvenanceConfig,
   buildFactProvenance
 };
-//# sourceMappingURL=chunk-RVLB4E6N.js.map
+//# sourceMappingURL=chunk-MDBZTH7N.js.map

package/dist/chunk-MDBZTH7N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provenance.ts"],"sourcesContent":["/**\n * Claim-level provenance spans (issue #1575 PR 1).\n *\n * Centralizes the parse/serialize logic for the `sources` array and the\n * coarse `provenance` strength tag, plus the `provenance` config-block\n * parser.  Extracted from `storage.ts` and `config.ts` so those files keep\n * only thin delegation call-sites — the frontmatter round-trip and config\n * parsing growth lives here (issue #1520 ratchet discipline).\n *\n * Contract:\n *  - When no provenance fields are present, output is byte-identical to\n *    pre-feature behavior (rule 39).\n *  - Corrupt `sources` lines / unknown `provenance` tags drop to\n *    `undefined` on read so a malformed frontmatter never poisons\n *    downstream readers (rule 34 spirit — drop corrupt rather than poison).\n *  - Validation lives on the write path; this module only parses.\n *  - Invariant (review round 5, cursor thread KQN): a `verified` or\n *    `unverified` tag is NEVER persisted/read without surviving sources —\n *    without excerpts the tag is indistinguishable from a grounded fact to\n *    downstream faithfulness/correction/TrustScore surfaces. The invariant\n *    is enforced symmetrically: `serializeProvenanceFields` (write) and\n *    `reconcileProvenanceRead` (read) both downgrade the tag to `none`\n *    when no source survives.\n */\n\nimport { z } from \"zod\";\n\nimport { coerceBool, coerceNumber } from \"./connectors/coerce.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport { collapseWhitespace } from \"./whitespace.js\";\nimport type { MemoryFrontmatter, ProvenanceConfig, ProvenanceSource } from \"./types.js\";\nimport { isSafeMemoryContent } from \"./sanitize.js\";\n\n/**\n * Canonical key order for a serialized `ProvenanceSource` (issue #1575).\n * Deterministic emission (rule 38) — readers and the byte-identical-when-off\n * contract (rule 39) depend on this order never drifting.\n */\nconst PROVENANCE_SOURCE_KEY_ORDER = [\n  \"sessionKey\",\n  \"turnId\",\n  \"observedAt\",\n  \"quote\",\n  \"charStart\",\n  \"charEnd\",\n] as const;\n\n/**\n * Build a single `ProvenanceSource` object whose keys appear in the canonical\n * order, omitting absent optional fields. The result is what gets fed to\n * `JSON.stringify` so the on-disk line is deterministic.\n */\nfunction canonicalProvenanceSource(src: ProvenanceSource): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of PROVENANCE_SOURCE_KEY_ORDER) {\n    const value = src[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Serialize the `sources` array (issue #1575) as a single JSON line, matching\n * the `structuredAttributes` precedent. Each entry is rebuilt in canonical key\n * order (rule 38) so the output is byte-stable. The `provenance` enum is\n * emitted bare (same style as `status`) — only the three documented values\n * are ever written.\n *\n * Verified-requires-evidence invariant (review round 5, cursor thread KQN):\n * a `verified`/`unverified` tag is downgraded to `none` whenever no source\n * survives write validation — whether sources were absent, an empty array,\n * or all entries failed the schema. This covers all three failure shapes the\n * earlier 3-branch logic left open (`{provenance:\"verified\"}`,\n * `{sources:[],provenance:\"verified\"}`, `{sources:[invalid…],provenance:\"verified\"}`).\n */\nexport function serializeProvenanceFields(fm: MemoryFrontmatter, lines: string[]): void {\n  let hasValidSources = false;\n  if (fm.sources && fm.sources.length > 0) {\n    // Validate each entry against the same schema used on read so invalid\n    // in-memory sources are dropped at write time, not silently lost on the\n    // next read (review thread 4 — write-path validation parity).\n    const canonical: Record<string, unknown>[] = [];\n    for (const src of fm.sources) {\n      const result = ProvenanceSourceSchema.safeParse(src);\n      if (result.success) canonical.push(canonicalProvenanceSource(result.data));\n    }\n    if (canonical.length > 0) {\n      lines.push(`sources: ${JSON.stringify(canonical)}`);\n      hasValidSources = true;\n    }\n  }\n  // A verified/unverified tag requires surviving evidence; without it the\n  // tag is meaningless downstream (faithfulness/TrustScore cannot distinguish\n  // it from a grounded fact). Downgrade to \"none\" regardless of WHY no source\n  // survived (absent / empty / all-invalid) — single invariant, all cases.\n  const tag =\n    (fm.provenance === \"verified\" || fm.provenance === \"unverified\") && !hasValidSources\n      ? \"none\"\n      : fm.provenance;\n  if (tag) {\n    lines.push(`provenance: ${tag}`);\n  }\n}\n\n/**\n * Parse the coarse `provenance` strength tag (issue #1575). Returns\n * `undefined` for missing/blank/unknown values so a corrupt or hand-edited\n * field fails safely to the legacy-equivalent `\"none\"` semantics on read\n * (rule 34 spirit — drop corrupt rather than poison).\n */\nexport function parseProvenanceTag(\n  raw: string | undefined,\n): \"verified\" | \"unverified\" | \"none\" | undefined {\n  if (raw === undefined) return undefined;\n  const trimmed = raw.trim();\n  if (trimmed.length === 0) return undefined;\n  if (trimmed === \"verified\" || trimmed === \"unverified\" || trimmed === \"none\") {\n    return trimmed;\n  }\n  return undefined;\n}\n\n/**\n * Enforce the verified-requires-evidence invariant on the READ path.\n * `parseProvenanceTag` and `parseProvenanceSources` are independent (they\n * parse separate frontmatter lines), so a hand-edited or imported memory may\n * carry `provenance: verified` with no surviving `sources` — a corrupt line,\n * an empty array, or all-invalid entries. Downgrade such a tag to `none` so\n * the in-memory object never exposes an ungrounded \"verified\" fact\n * (review round 5, cursor thread KQN — read-path parity with the write-path\n * downgrade in `serializeProvenanceFields`). `none`/`undefined` tags pass\n * through unchanged.\n */\nexport function reconcileProvenanceRead(\n  tag: \"verified\" | \"unverified\" | \"none\" | undefined,\n  sources: ProvenanceSource[] | undefined,\n): \"verified\" | \"unverified\" | \"none\" | undefined {\n  if ((tag === \"verified\" || tag === \"unverified\") && (!sources || sources.length === 0)) {\n    return \"none\";\n  }\n  return tag;\n}\n\n/**\n * Strict ISO-8601 timestamp check (review round 6, codex thread OXPAp).\n * `Date.parse` accepts non-ISO strings (bare years like `\"123\"`) and\n * silently normalizes calendar overflow (`2026-02-30` -> March 2, hour 25\n * -> next day), so malformed provenance survives as if valid. Require the\n * full `YYYY-MM-DDTHH:MM:SS[.fff](Z|±HH:MM)` shape and reject overflow via a\n * `Date.UTC` round-trip component check — the offset does not affect whether\n * a wall-clock field overflows, so this is correct for any timezone suffix.\n */\nfunction isStrictIsoTimestamp(s: string): boolean {\n  const m = /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$/.exec(s);\n  if (!m) return false;\n  const y = Number(m[1]), mo = Number(m[2]), da = Number(m[3]);\n  const h = Number(m[4]), mi = Number(m[5]), se = Number(m[6]);\n  // Date.UTC normalizes overflow (Feb 30 -> Mar 2); a component round-trip\n  // catches what Date.parse silently accepts.\n  const d = new Date(Date.UTC(y, mo - 1, da, h, mi, se));\n  // The component round-trip validates wall-clock overflow (Feb 30 -> Mar 2);\n  // Date.parse additionally rejects impossible timezone offsets such as\n  // +99:99, which the regex accepts but the runtime treats as NaN\n  // (codex thread OXQ0e).\n  return (\n    !Number.isNaN(Date.parse(s)) &&\n    d.getUTCFullYear() === y &&\n    d.getUTCMonth() === mo - 1 &&\n    d.getUTCDate() === da &&\n    d.getUTCHours() === h &&\n    d.getUTCMinutes() === mi &&\n    d.getUTCSeconds() === se\n  );\n}\n\n/**\n * Coerce a turn timestamp to a strict ISO-8601 string (cursor thread Ocveu —\n * \"Non-ISO turn timestamps drop sources\"). The write-path `ProvenanceSourceSchema`\n * rejects anything `isStrictIsoTimestamp` fails, so a turn whose `timestamp`\n * parses via `new Date(...)` but isn't already strict ISO (e.g.\n * `\"2026/01/15 12:00:00\"` or `\"Jan 15 2026\"`) would be silently dropped at\n * serialization — clearing the whole `sources` array and downgrading the tag\n * to `\"none\"`. Normalizing at extraction time preserves the source.\n *\n * Returns the strict ISO string when the timestamp already passes or\n * `Date.parse` can round-trip it; `undefined` for empty / unparseable input\n * so callers can decide whether to skip the source or fall back.\n */\nfunction toStrictIsoTimestamp(ts: string | undefined | null): string | undefined {\n  if (typeof ts !== \"string\" || ts.length === 0) return undefined;\n  if (isStrictIsoTimestamp(ts)) return ts;\n  const parsed = Date.parse(ts);\n  if (Number.isNaN(parsed)) return undefined;\n  // Reject bare-year / numeric-only strings that Date.parse accepts (e.g.\n  // \"123\") — isStrictIsoTimestamp already rejected them, and the round-trip\n  // below would otherwise resurrect them. Require at least one date/time\n  // separator so a plain number never round-trips into a fake epoch.\n  if (!/[-:T]/.test(ts)) return undefined;\n  // Reject calendar-overflow dates (chatgpt-codex-connector thread dANc):\n  // Date.parse silently rolls over invalid components — \"2026-02-30\" becomes\n  // 2026-03-02 — fabricating the observation date. For strings that carry an\n  // explicit numeric Y/M/D prefix (the common import/provider shape), validate\n  // the calendar components are in range before accepting the shifted result.\n  // isStrictIsoTimestamp already does this for full ISO strings; this closes\n  // the gap for the non-ISO normalization path.\n  const ymd = /^(\\d{4})\\D(\\d{1,2})\\D(\\d{1,2})/.exec(ts);\n  if (ymd) {\n    const [_, ys, ms, ds] = ymd;\n    const y = Number(ys), mo = Number(ms), da = Number(ds);\n    if (!isValidCalendarDate(y, mo, da)) return undefined;\n  }\n  // Also validate M/D/Y or D/M/Y formats (provider/import common shapes:\n  // 02/30/2026, 30-02-2026, etc.). Date.parse silently shifts overflow in\n  // these too. Try both month-first and day-first interpretations; if\n  // neither is a valid calendar date, reject (chatgpt-codex-connector thread\n  // dH47 — non-YMD overflow timestamps).\n  const mdy = /^(\\d{1,2})\\D(\\d{1,2})\\D(\\d{4})/.exec(ts);\n  if (mdy) {\n    const a = Number(mdy[1]), b = Number(mdy[2]), yr = Number(mdy[3]);\n    if (!isValidCalendarDate(yr, a, b) && !isValidCalendarDate(yr, b, a)) {\n      return undefined;\n    }\n  }\n  const iso = new Date(parsed).toISOString();\n  return isStrictIsoTimestamp(iso) ? iso : undefined;\n}\n\n/**\n * Validate numeric calendar components without Date overflow (review thread\n * dANc). Date.UTC silently normalizes Feb 30 -> Mar 2; a component round-trip\n * catches what Date.parse accepts. Mirrors the same technique isStrictIsoTimestamp\n * uses for full ISO strings, applied here to the non-ISO normalization path.\n */\nfunction isValidCalendarDate(y: number, mo: number, da: number): boolean {\n  if (mo < 1 || mo > 12 || da < 1) return false;\n  const leap = (y % 4 === 0 && (y % 100 !== 0 || y % 400 === 0)) ? 29 : 28;\n  const daysInMonth = [31, leap, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n  return da <= daysInMonth[mo - 1]!;\n}\n\n/**\n * Zod schema for a single `ProvenanceSource` entry (issue #1575).  Parsed\n * JSON from frontmatter is external data, so each entry is validated here\n * rather than trusted via a cast (rule: no inline-cast-access on parsed\n * blobs).  `safeParse` lets us drop corrupt entries individually instead of\n * failing the whole field.\n */\nconst ProvenanceSourceSchema = z\n  .object({\n    sessionKey: z.string().min(1),\n    observedAt: z\n      .string()\n      .min(1)\n      .refine(isStrictIsoTimestamp, \"must be a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SS[Z|±HH:MM], no calendar overflow)\"),\n    quote: z.string().min(1),\n    turnId: z.string().min(1).optional(),\n    charStart: z.number().finite().nonnegative().int().optional(),\n    charEnd: z.number().finite().nonnegative().int().optional(),\n  })\n  .refine(\n    (src) => src.charStart === undefined || src.charEnd === undefined || src.charEnd >= src.charStart,\n    { message: \"charEnd must be >= charStart (half-open interval, rule 35)\" },\n  );\n\n/**\n * Parse the `sources` array (issue #1575) from its single-line JSON form.\n * Mirrors `parseStructuredAttributes` (JSON.parse) but validates each entry\n * against `ProvenanceSourceSchema` and DROPS corrupt ones rather than\n * poisoning downstream readers — the same \"drop corrupt rather than poison\"\n * contract as `parseMemoryWorthCounterField`.  If no entry survives, the\n * whole field is `undefined` (legacy-equivalent).\n */\nexport function parseProvenanceSources(raw: string | undefined): ProvenanceSource[] | undefined {\n  if (raw === undefined) return undefined;\n  const trimmed = raw.trim();\n  if (trimmed.length === 0) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return undefined;\n  }\n  if (!Array.isArray(parsed)) return undefined;\n  const sources: ProvenanceSource[] = [];\n  for (const entry of parsed) {\n    const result = ProvenanceSourceSchema.safeParse(entry);\n    if (result.success) sources.push(result.data);\n  }\n  return sources.length > 0 ? sources : undefined;\n}\n\n/**\n * Parse the `provenance` config block (issue #1575 PR 1).  Validates the\n * shape before applying defaults — a shorthand like `provenance: false` must\n * reject loudly rather than normalize to `{}` and silently enable the feature\n * (rule 51).  Booleans coerce via `coerceBool` (rule 36); numeric cap clamps\n * at 1 (rule 28).  `REMNIC_PROVENANCE_ENABLED` / `ENGRAM_PROVENANCE_ENABLED`\n * are honored only when the `enabled` key is omitted (explicit config wins).\n *\n * Schema-default note (review rounds 1–3, settled): `provenance.enabled` has\n * NO `\"default\"` in any plugin.json schema. OpenClaw's loader runs\n * `applyDefaults: true` before exposing `api.pluginConfig` (src/index.ts:1345,\n * PR #1593 round 8), so a schema default would be materialized into the\n * merged config and mask the `REMNIC_`/`ENGRAM_` env override. The code-level\n * default-on here (`return true` when `enabled` is omitted) supplies the\n * default-on behavior without that materialization. This matches the\n * emitLegacyTools/namespaceCatalogEnabled precedent, which omits the env\n * override only after a raw-vs-effective split — overkill for a single\n * boolean, so this field uses the simpler omit-the-default approach.\n */\nexport function parseProvenanceConfig(raw: unknown): ProvenanceConfig {\n  if (\n    raw !== undefined &&\n    (raw === null || typeof raw !== \"object\" || Array.isArray(raw))\n  ) {\n    throw new Error(\n      `provenance must be an object (got ${JSON.stringify(raw)}). Use provenance: { enabled: false } to opt out; omit the key to use the default-on behavior (issue #1575).`,\n    );\n  }\n  const rawProvenance =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  return {\n    enabled: (() => {\n      if (rawProvenance.enabled === undefined) {\n        const envEnabled =\n          readEnvVar(\"REMNIC_PROVENANCE_ENABLED\") ?? readEnvVar(\"ENGRAM_PROVENANCE_ENABLED\");\n        if (envEnabled !== undefined) {\n          const coerced = coerceBool(envEnabled);\n          if (coerced === undefined) {\n            throw new Error(\n              `REMNIC_PROVENANCE_ENABLED must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(envEnabled)}`,\n            );\n          }\n          return coerced;\n        }\n        return true;\n      }\n      const coerced = coerceBool(rawProvenance.enabled);\n      if (coerced === undefined) {\n        throw new Error(\n          `provenance.enabled must be a boolean or one of \"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\"on\"/\"off\" (got ${JSON.stringify(rawProvenance.enabled)}). Omit the key to use the default-on behavior (issue #1575).`,\n        );\n      }\n      return coerced;\n    })(),\n    maxQuoteChars: (() => {\n      if (rawProvenance.maxQuoteChars === undefined) return 300;\n      const rawCap = coerceNumber(rawProvenance.maxQuoteChars);\n      // Reject present-but-invalid rather than silently widening the cap\n      // (AGENTS.md input-validation rule — a typo should not persist more\n      // text than the operator configured).\n      if (rawCap === undefined || !Number.isFinite(rawCap) || rawCap < 1 || !Number.isInteger(rawCap)) {\n        throw new Error(\n          `provenance.maxQuoteChars must be a positive integer >= 1 (got ${JSON.stringify(rawProvenance.maxQuoteChars)}).`,\n        );\n      }\n      return rawCap;\n    })(),\n    requireSpans: (() => {\n      if (rawProvenance.requireSpans === undefined) return false;\n      const coerced = coerceBool(rawProvenance.requireSpans);\n      if (coerced === undefined) {\n        throw new Error(\n          `provenance.requireSpans must be a boolean or one of \"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\"on\"/\"off\" (got ${JSON.stringify(rawProvenance.requireSpans)}).`,\n        );\n      }\n      return coerced;\n    })(),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Issue #1575 PR 2 — extraction-side post-parse validator.\n// ---------------------------------------------------------------------------\n//\n// This runs once at write time (inside `ExtractionEngine.extract`, after the\n// LLM output is parsed and sanitized, before the result is returned for\n// persistence). Its job: locate each fact's LLM-provided `quote` in the\n// buffered turn texts and build a `ProvenanceSource[]` with verified\n// offsets. Never throws, never drops a fact (rule 34 spirit — an\n// unverifiable span is a tagged state, not a silent failure).\n//\n// Reuses `collapseWhitespace` from `whitespace.ts` for normalization so there\n// is exactly one normalizer in the codebase (issue #1575 pitfall: \"do not\n// write a second normalizer\").\n// ---------------------------------------------------------------------------\n\n/**\n * A turn in the buffered conversation, reduced to the fields the provenance\n * validator needs. `ExtractionEngine.extract` maps its `BufferTurn[]` to this\n * shape so the validator is pure and testable without the full BufferTurn type.\n */\nexport interface ProvenanceTurnInput {\n  content: string;\n  sessionKey?: string;\n  logicalSessionKey?: string;\n  timestamp: string;\n  turnId?: string;\n}\n\n/**\n * Result of building provenance for a single extracted fact.\n */\nexport interface ProvenanceBuildResult {\n  /** Verified sources (one per matching turn). Absent when no quote survives. */\n  sources?: ProvenanceSource[];\n  /** Coarse strength tag persisted to frontmatter. */\n  provenance: \"verified\" | \"unverified\" | \"none\";\n  /**\n   * Transient signal (never persisted): `true` when `config.requireSpans`\n   * is enabled and the LLM-provided quote could not be located in ANY source\n   * turn (the strict case `ProvenanceConfig.requireSpans` documents: \"facts\n   * whose quote cannot be located are routed to `pending_review`\"). The\n   * extraction consumer carries this onto the in-memory `ExtractedFact` so\n   * the persist path can route the fact to the review queue. A quote that\n   * WAS located but whose source was dropped (e.g. un-coercible timestamp)\n   * does NOT set this flag — the span was found, so requireSpans is\n   * satisfied (chatgpt-codex-connector thread 4xB).\n   */\n  requireSpansPending?: boolean;\n}\n\n/**\n * Cap a quote string at `maxChars`, truncating at the last word boundary that\n * fits and appending an ellipsis marker. Quotes at or under the cap pass\n * through unchanged. Operates on Unicode code points (not UTF-16 units) so\n * emoji and astral-plane characters are not split mid-glyph.\n */\nfunction capQuote(quote: string, maxChars: number): string {\n  const glyphs = Array.from(quote);\n  if (glyphs.length <= maxChars) return quote;\n  // Walk backward from the cap to find a word boundary (space). If the entire\n  // span is one long token (no spaces), cut at the cap — a hard cut is better\n  // than no quote at all.\n  let cut = maxChars;\n  while (cut > 0 && !/\\s/.test(glyphs[cut - 1]!)) cut--;\n  if (cut === 0) cut = maxChars; // no word boundary found\n  return glyphs.slice(0, cut).join(\"\").trimEnd() + \"\\u2026\";\n}\n\n/**\n * Casefold a string for normalized matching. Uses `toLowerCase` (not\n * `toLocaleLowerCase`) for determinism across runtime locales — the existing\n * `normalizeFactKey` helper in extraction.ts follows the same convention.\n */\nfunction casefold(s: string): string {\n  return s.toLowerCase();\n}\n\n/**\n * Locate `quote` within `text`, returning whether a match was found and, when\n * recoverable, the half-open `[start, end)` offsets. Tries exact substring\n * first, then whitespace/case-normalized match.\n *\n * For the normalized path, the mapping from the normalized string back to\n * original offsets is recovered by walking both strings in lockstep: we know\n * `collapseWhitespace(text)` is a subsequence of `text` with whitespace runs\n * collapsed, so we can track the original offset as we scan.\n *\n * Returns `{ matched: false }` when neither match succeeds. Returns\n * `{ matched: true, offsets }` when offsets are recoverable. Returns\n * `{ matched: true }` (offsets omitted) when the normalized substring was\n * found but original offsets could not be recovered — callers still treat\n * this as a verified match and record a source without offsets (cursor\n * thread Ocver — \"Normalized match drops verified provenance\").\n */\ntype LocateQuoteResult =\n  | { matched: false }\n  | { matched: true; offsets?: { charStart: number; charEnd: number } };\n\nfunction locateQuoteOffsets(quote: string, text: string): LocateQuoteResult {\n  // 1. Exact substring match (handles unicode, curly quotes, emoji verbatim).\n  const exactIdx = text.indexOf(quote);\n  if (exactIdx >= 0) {\n    return { matched: true, offsets: { charStart: exactIdx, charEnd: exactIdx + quote.length } };\n  }\n\n  // 2. Whitespace/case-normalized match. Collapse runs of whitespace and\n  //    casefold both sides, then find the normalized quote in the normalized\n  //    text. Recover original offsets by scanning forward from the normalized\n  //    match start through the original text, accumulating non-whitespace\n  //    glyphs until we've consumed the normalized quote length.\n  const normQuote = collapseWhitespace(casefold(quote));\n  if (normQuote.length === 0) return { matched: false };\n  const normText = collapseWhitespace(casefold(text));\n  const normIdx = normText.indexOf(normQuote);\n  if (normIdx < 0) return { matched: false };\n\n  // Recover original offsets: walk the original text, skipping leading\n  // whitespace to align with the collapsed form, then track how many\n  // normalized chars we've consumed.\n  const normQuoteLen = normQuote.length;\n  let origIdx = 0;\n  // Skip leading whitespace in original text (collapseWhitespace trims both ends).\n  while (origIdx < text.length && /\\s/.test(text[origIdx]!)) origIdx++;\n  // Walk through original text, counting normalized chars consumed.\n  // Each non-whitespace char in original = 1 normalized char.\n  // Whitespace runs in original = 1 space in normalized (but only between non-ws).\n  let normPos = 0;\n  let origStart = -1;\n  let origEnd = -1;\n  let prevWasWs = true; // suppress the leading space in collapsed form\n  while (origIdx < text.length && origEnd < 0) {\n    const ch = text[origIdx]!;\n    if (/\\s/.test(ch)) {\n      if (!prevWasWs) {\n        // This whitespace run collapses to a single space in normalized text.\n        if (normPos === normIdx) origStart = origIdx; // normalized space aligns\n        normPos++;\n        prevWasWs = true;\n      }\n      origIdx++;\n      continue;\n    }\n    // Non-whitespace char.\n    if (normPos === normIdx && origStart < 0) {\n      origStart = origIdx;\n    }\n    normPos++;\n    prevWasWs = false;\n    origIdx++;\n    if (normPos >= normIdx + normQuoteLen) {\n      origEnd = origIdx;\n    }\n  }\n  if (origStart >= 0 && origEnd >= 0) {\n    return { matched: true, offsets: { charStart: origStart, charEnd: origEnd } };\n  }\n  // Normalized substring was found, but original offsets are not recoverable\n  // (edge case in the normalized mapping). The match still counts as verified\n  // — record a source without offsets rather than dropping the turn entirely\n  // (cursor thread Ocver). charStart/charEnd are best-effort debugging aids,\n  // not a precondition for a verified source.\n  return { matched: true };\n}\n\n/**\n * Build provenance sources for a single extracted fact by locating its\n * LLM-provided `quote` in the buffered turns (issue #1575 PR 2).\n *\n * Matching strategy (per issue design):\n *   1. Exact substring match in a turn → `provenance: \"verified\"` with\n *      `charStart`/`charEnd` offsets.\n *   2. Whitespace/case-normalized match → `\"verified\"`, offsets recovered\n *      when possible, else omitted.\n *   3. No match in any turn → `\"unverified\"` — the quote survives as a\n *      source (the LLM vouched for it) but without located offsets.\n *   4. No quote provided by the LLM → `\"none\"` — no evidence to record.\n *\n * A quote appearing in multiple turns produces multiple sources (one per\n * matching turn) so a repeated utterance backs the fact from each occurrence.\n *\n * The quote is capped at `config.maxQuoteChars` (truncated at a word boundary\n * with an ellipsis marker) BEFORE storage. Locating uses the original\n * (untruncated) quote for maximum match fidelity; the capped excerpt is what\n * gets persisted.\n *\n * When `config.enabled === false`, returns `{ provenance: \"none\" }`\n * immediately — byte-identical to pre-feature extraction (rule 39).\n *\n * Never throws. An unexpected error degrades to `{ provenance: \"none\" }` so\n * extraction never crashes on a provenance hiccup (rule 13/18).\n */\n/**\n * Strip a leading extraction-prompt role label from a quote (cursor thread Oc3Z2\n * — \"Quote prompt mismatches validator\"). The extraction prompt renders each\n * buffered turn as `[role] content` (or `[context role] content`), so a\n * faithful LLM may include that prefix in its verbatim quote. buildFactProvenance\n * searches the raw `turn.content` (no prefix), so a quote carrying the label\n * would never match. Stripping the leading label lets the actual utterance\n * verify against the turn text. Only a SINGLE leading label is stripped — a\n * multi-turn quote (with embedded labels) is left untouched and will simply\n * fail to match a single turn, as before.\n *\n * The regex is constrained to the labels the prompt actually emits — `user`,\n * `assistant`, optionally prefixed with `context ` (extraction.ts renders\n * `[user]`, `[assistant]`, `[context user]`, `[context assistant]`). A\n * real utterance that happens to start with other bracketed text (e.g.\n * `[do not] deploy before approval`, `[P1] fix the cache`) is preserved\n * verbatim so the quote can match the turn and the persisted span retains its\n * original meaning (chatgpt-codex-connector thread 4xA — limiting role-prefix\n * stripping to actual prompt labels).\n */\nfunction stripLeadingRolePrefix(quote: string): string {\n  return quote.replace(/^\\s*\\[(?:context\\s+)?(?:user|assistant)\\]\\s+/i, \"\");\n}\n\nexport function buildFactProvenance(\n  factQuote: string | null | undefined,\n  turns: ReadonlyArray<ProvenanceTurnInput>,\n  config: ProvenanceConfig,\n): ProvenanceBuildResult {\n  if (!config.enabled) return { provenance: \"none\" };\n  const rawQuote = typeof factQuote === \"string\" ? factQuote.trim() : \"\";\n  // requireSpans (chatgpt-codex-connector thread dEsu + cursor thread dGKJ):\n  // every early exit that drops a fact's span (no quote, empty after label\n  // strip, or unsafe quote) must flag requireSpansPending when the operator\n  // opted into requireSpans, so the persist path routes the fact to\n  // pending_review instead of active. Only the disabled-feature exit (above)\n  // and the unexpected-error catch (below) omit the flag — those are\n  // policy-neutral degradations, not a missing-span decision.\n  const noneResult = (): ProvenanceBuildResult =>\n    config.requireSpans === true\n      ? { provenance: \"none\", requireSpansPending: true }\n      : { provenance: \"none\" };\n  if (rawQuote.length === 0) return noneResult();\n  // Strip a leading prompt role label so a faithful quote verifies against\n  // the raw turn content (cursor thread Oc3Z2). Prefer the RAW quote when it\n  // matches at least one turn — an utterance that literally begins with\n  // [user]/[assistant] must verify as-is, not be truncated to the post-label\n  // text (cursor/codex thread dEsw). The strip handles the common case where\n  // the LLM includes the prompt label; this preserves the rare case where the\n  // utterance itself starts with that text.\n  const strippedQuote = stripLeadingRolePrefix(rawQuote);\n  const useRawQuote =\n    rawQuote === strippedQuote ||\n    turns.some(\n      (t) =>\n        typeof t?.content === \"string\" &&\n        t.content.length > 0 &&\n        locateQuoteOffsets(rawQuote, t.content).matched,\n    );\n  const quote = useRawQuote ? rawQuote : strippedQuote;\n  if (quote.length === 0) return noneResult();\n  // Sanitize the quote before persisting it as a provenance span\n  // (chatgpt-codex-connector thread dANZ): the fact body is sanitized via\n  // sanitizeMemoryContent, but sources[].quote was persisted verbatim,\n  // reintroducing unsafe memory text (e.g. \"ignore previous instructions\")\n  // through the provenance field exposed to memory_get/x-ray/faithfulness.\n  // An unsafe quote cannot serve as evidence — drop the source entirely\n  // (consistent with how the body is sanitized: unsafe text is redacted,\n  // and a redacted quote is useless as a verbatim span).\n  if (!isSafeMemoryContent(quote)) return noneResult();\n\n  try {\n    // Search every turn for the quote. Collect verified sources.\n    const sources: ProvenanceSource[] = [];\n    // Track the first turn where the quote was located even when its\n    // timestamp can't be coerced (cursor thread 4Pj — \"Bad timestamp drops\n    // matched source\"). Without this, a located-but-unverifiable quote falls\n    // through to the unverified branch and is attributed to the *last* turn's\n    // session, mislabeling the source's origin session. Also drives the\n    // requireSpans signal: only a quote that was NOT located in any turn\n    // qualifies for pending_review routing under requireSpans (thread 4xB).\n    let locatedTurn: ProvenanceTurnInput | undefined;\n    for (const turn of turns) {\n      if (!turn || typeof turn.content !== \"string\" || turn.content.length === 0) continue;\n      const located = locateQuoteOffsets(quote, turn.content);\n      // cursor thread Ocver: a normalized match counts as verified even when\n      // original offsets are unrecoverable — record the source without\n      // charStart/charEnd instead of skipping the turn.\n      if (!located.matched) continue;\n      if (!locatedTurn) locatedTurn = turn;\n      // cursor thread Ocveu: normalize the turn timestamp to strict ISO so\n      // the write-path ProvenanceSourceSchema keeps the source. Skip the turn\n      // when the timestamp can't be coerced — pushing it would guarantee a\n      // serialization drop (and the tag downgrade) for this source.\n      const observedAt = toStrictIsoTimestamp(turn.timestamp);\n      if (!observedAt) continue;\n      sources.push({\n        sessionKey: turn.sessionKey ?? turn.logicalSessionKey ?? \"unknown\",\n        ...(turn.turnId ? { turnId: turn.turnId } : {}),\n        observedAt,\n        quote: capQuote(quote, config.maxQuoteChars),\n        ...(located.offsets\n          ? { charStart: located.offsets.charStart, charEnd: located.offsets.charEnd }\n          : {}),\n      });\n    }\n\n    if (sources.length > 0) {\n      return { sources, provenance: \"verified\" };\n    }\n\n    // Quote provided but could not be turned into a verified source.\n    // Determine the session to attribute: prefer the turn where the quote was\n    // LOCATED even if its timestamp couldn't be coerced (cursor thread 4Pj — a\n    // located quote must not be tied to the *last* turn's session). If the\n    // quote was not located in any turn at all, fall back to the last turn's\n    // session (the documented unverified behavior: the LLM vouched for the\n    // excerpt but we couldn't pin it to a character offset). Normalize the\n    // timestamp (thread Ocveu); fall back to epoch when no turn supplies a\n    // coercible timestamp so the unverified source still survives the\n    // write-path schema.\n    const fallbackTurn = locatedTurn ?? turns[turns.length - 1];\n    const fallbackSessionKey = fallbackTurn\n      ? (fallbackTurn.sessionKey ?? fallbackTurn.logicalSessionKey ?? \"unknown\")\n      : \"unknown\";\n    const fallbackObservedAt = fallbackTurn\n      ? (toStrictIsoTimestamp(fallbackTurn.timestamp) ?? new Date(0).toISOString())\n      : new Date(0).toISOString();\n    // requireSpans signal (chatgpt-codex-connector thread 4xB): when an\n    // operator opts into provenance.requireSpans, a fact whose quote could\n    // not be located in ANY turn (locatedTurn undefined) is flagged so the\n    // persist path routes it to pending_review instead of active. A quote\n    // that WAS located (locatedTurn set) satisfies requireSpans even when\n    // its source was dropped for an un-coercible timestamp — the span was\n    // found, so the fact has the grounding requireSpans demands.\n    const requireSpansPending =\n      config.requireSpans === true && locatedTurn === undefined;\n    return {\n      sources: [\n        {\n          sessionKey: fallbackSessionKey,\n          observedAt: fallbackObservedAt,\n          quote: capQuote(quote, config.maxQuoteChars),\n        },\n      ],\n      provenance: \"unverified\",\n      ...(requireSpansPending ? { requireSpansPending: true } : {}),\n    };\n  } catch {\n    // Never crash extraction on a provenance error (rule 13/18).\n    return { provenance: \"none\" };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,SAAS,SAAS;AAalB,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,SAAS,0BAA0B,KAAgD;AACjF,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,6BAA6B;AAC7C,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,UAAU,OAAW,KAAI,GAAG,IAAI;AAAA,EACtC;AACA,SAAO;AACT;AAgBO,SAAS,0BAA0B,IAAuB,OAAuB;AACtF,MAAI,kBAAkB;AACtB,MAAI,GAAG,WAAW,GAAG,QAAQ,SAAS,GAAG;AAIvC,UAAM,YAAuC,CAAC;AAC9C,eAAW,OAAO,GAAG,SAAS;AAC5B,YAAM,SAAS,uBAAuB,UAAU,GAAG;AACnD,UAAI,OAAO,QAAS,WAAU,KAAK,0BAA0B,OAAO,IAAI,CAAC;AAAA,IAC3E;AACA,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,KAAK,YAAY,KAAK,UAAU,SAAS,CAAC,EAAE;AAClD,wBAAkB;AAAA,IACpB;AAAA,EACF;AAKA,QAAM,OACH,GAAG,eAAe,cAAc,GAAG,eAAe,iBAAiB,CAAC,kBACjE,SACA,GAAG;AACT,MAAI,KAAK;AACP,UAAM,KAAK,eAAe,GAAG,EAAE;AAAA,EACjC;AACF;AAQO,SAAS,mBACd,KACgD;AAChD,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI,YAAY,cAAc,YAAY,gBAAgB,YAAY,QAAQ;AAC5E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAaO,SAAS,wBACd,KACA,SACgD;AAChD,OAAK,QAAQ,cAAc,QAAQ,kBAAkB,CAAC,WAAW,QAAQ,WAAW,IAAI;AACtF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,qBAAqB,GAAoB;AAChD,QAAM,IAAI,mFAAmF,KAAK,CAAC;AACnG,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;AAC3D,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;AAG3D,QAAM,IAAI,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAKrD,SACE,CAAC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,KAC3B,EAAE,eAAe,MAAM,KACvB,EAAE,YAAY,MAAM,KAAK,KACzB,EAAE,WAAW,MAAM,MACnB,EAAE,YAAY,MAAM,KACpB,EAAE,cAAc,MAAM,MACtB,EAAE,cAAc,MAAM;AAE1B;AAeA,SAAS,qBAAqB,IAAmD;AAC/E,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,EAAG,QAAO;AACtD,MAAI,qBAAqB,EAAE,EAAG,QAAO;AACrC,QAAM,SAAS,KAAK,MAAM,EAAE;AAC5B,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AAKjC,MAAI,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO;AAQ9B,QAAM,MAAM,iCAAiC,KAAK,EAAE;AACpD,MAAI,KAAK;AACP,UAAM,CAAC,GAAG,IAAI,IAAI,EAAE,IAAI;AACxB,UAAM,IAAI,OAAO,EAAE,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,OAAO,EAAE;AACrD,QAAI,CAAC,oBAAoB,GAAG,IAAI,EAAE,EAAG,QAAO;AAAA,EAC9C;AAMA,QAAM,MAAM,iCAAiC,KAAK,EAAE;AACpD,MAAI,KAAK;AACP,UAAM,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;AAChE,QAAI,CAAC,oBAAoB,IAAI,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,GAAG;AACpE,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,KAAK,MAAM,EAAE,YAAY;AACzC,SAAO,qBAAqB,GAAG,IAAI,MAAM;AAC3C;AAQA,SAAS,oBAAoB,GAAW,IAAY,IAAqB;AACvE,MAAI,KAAK,KAAK,KAAK,MAAM,KAAK,EAAG,QAAO;AACxC,QAAM,OAAQ,IAAI,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,QAAQ,KAAM,KAAK;AACtE,QAAM,cAAc,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACrE,SAAO,MAAM,YAAY,KAAK,CAAC;AACjC;AASA,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,YAAY,EACT,OAAO,EACP,IAAI,CAAC,EACL,OAAO,sBAAsB,6FAA0F;AAAA,EAC1H,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5D,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS;AAC5D,CAAC,EACA;AAAA,EACC,CAAC,QAAQ,IAAI,cAAc,UAAa,IAAI,YAAY,UAAa,IAAI,WAAW,IAAI;AAAA,EACxF,EAAE,SAAS,6DAA6D;AAC1E;AAUK,SAAS,uBAAuB,KAAyD;AAC9F,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,OAAO,QAAS,SAAQ,KAAK,OAAO,IAAI;AAAA,EAC9C;AACA,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAqBO,SAAS,sBAAsB,KAAgC;AACpE,MACE,QAAQ,WACP,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,IAC7D;AACA,UAAM,IAAI;AAAA,MACR,qCAAqC,KAAK,UAAU,GAAG,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,gBACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAC/C,MACD,CAAC;AACP,SAAO;AAAA,IACL,UAAU,MAAM;AACd,UAAI,cAAc,YAAY,QAAW;AACvC,cAAM,aACJ,WAAW,2BAA2B,KAAK,WAAW,2BAA2B;AACnF,YAAI,eAAe,QAAW;AAC5B,gBAAMA,WAAU,WAAW,UAAU;AACrC,cAAIA,aAAY,QAAW;AACzB,kBAAM,IAAI;AAAA,cACR,8FAA8F,KAAK,UAAU,UAAU,CAAC;AAAA,YAC1H;AAAA,UACF;AACA,iBAAOA;AAAA,QACT;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAU,WAAW,cAAc,OAAO;AAChD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR,oGAAoG,KAAK,UAAU,cAAc,OAAO,CAAC;AAAA,QAC3I;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,IACH,gBAAgB,MAAM;AACpB,UAAI,cAAc,kBAAkB,OAAW,QAAO;AACtD,YAAM,SAAS,aAAa,cAAc,aAAa;AAIvD,UAAI,WAAW,UAAa,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,MAAM,GAAG;AAC/F,cAAM,IAAI;AAAA,UACR,iEAAiE,KAAK,UAAU,cAAc,aAAa,CAAC;AAAA,QAC9G;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,IACH,eAAe,MAAM;AACnB,UAAI,cAAc,iBAAiB,OAAW,QAAO;AACrD,YAAM,UAAU,WAAW,cAAc,YAAY;AACrD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR,yGAAyG,KAAK,UAAU,cAAc,YAAY,CAAC;AAAA,QACrJ;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,EACL;AACF;AA2DA,SAAS,SAAS,OAAe,UAA0B;AACzD,QAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,MAAI,OAAO,UAAU,SAAU,QAAO;AAItC,MAAI,MAAM;AACV,SAAO,MAAM,KAAK,CAAC,KAAK,KAAK,OAAO,MAAM,CAAC,CAAE,EAAG;AAChD,MAAI,QAAQ,EAAG,OAAM;AACrB,SAAO,OAAO,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,IAAI;AACnD;AAOA,SAAS,SAAS,GAAmB;AACnC,SAAO,EAAE,YAAY;AACvB;AAuBA,SAAS,mBAAmB,OAAe,MAAiC;AAE1E,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,YAAY,GAAG;AACjB,WAAO,EAAE,SAAS,MAAM,SAAS,EAAE,WAAW,UAAU,SAAS,WAAW,MAAM,OAAO,EAAE;AAAA,EAC7F;AAOA,QAAM,YAAY,mBAAmB,SAAS,KAAK,CAAC;AACpD,MAAI,UAAU,WAAW,EAAG,QAAO,EAAE,SAAS,MAAM;AACpD,QAAM,WAAW,mBAAmB,SAAS,IAAI,CAAC;AAClD,QAAM,UAAU,SAAS,QAAQ,SAAS;AAC1C,MAAI,UAAU,EAAG,QAAO,EAAE,SAAS,MAAM;AAKzC,QAAM,eAAe,UAAU;AAC/B,MAAI,UAAU;AAEd,SAAO,UAAU,KAAK,UAAU,KAAK,KAAK,KAAK,OAAO,CAAE,EAAG;AAI3D,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,SAAO,UAAU,KAAK,UAAU,UAAU,GAAG;AAC3C,UAAM,KAAK,KAAK,OAAO;AACvB,QAAI,KAAK,KAAK,EAAE,GAAG;AACjB,UAAI,CAAC,WAAW;AAEd,YAAI,YAAY,QAAS,aAAY;AACrC;AACA,oBAAY;AAAA,MACd;AACA;AACA;AAAA,IACF;AAEA,QAAI,YAAY,WAAW,YAAY,GAAG;AACxC,kBAAY;AAAA,IACd;AACA;AACA,gBAAY;AACZ;AACA,QAAI,WAAW,UAAU,cAAc;AACrC,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,aAAa,KAAK,WAAW,GAAG;AAClC,WAAO,EAAE,SAAS,MAAM,SAAS,EAAE,WAAW,WAAW,SAAS,QAAQ,EAAE;AAAA,EAC9E;AAMA,SAAO,EAAE,SAAS,KAAK;AACzB;AAiDA,SAAS,uBAAuB,OAAuB;AACrD,SAAO,MAAM,QAAQ,iDAAiD,EAAE;AAC1E;AAEO,SAAS,oBACd,WACA,OACA,QACuB;AACvB,MAAI,CAAC,OAAO,QAAS,QAAO,EAAE,YAAY,OAAO;AACjD,QAAM,WAAW,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AAQpE,QAAM,aAAa,MACjB,OAAO,iBAAiB,OACpB,EAAE,YAAY,QAAQ,qBAAqB,KAAK,IAChD,EAAE,YAAY,OAAO;AAC3B,MAAI,SAAS,WAAW,EAAG,QAAO,WAAW;AAQ7C,QAAM,gBAAgB,uBAAuB,QAAQ;AACrD,QAAM,cACJ,aAAa,iBACb,MAAM;AAAA,IACJ,CAAC,MACC,OAAO,GAAG,YAAY,YACtB,EAAE,QAAQ,SAAS,KACnB,mBAAmB,UAAU,EAAE,OAAO,EAAE;AAAA,EAC5C;AACF,QAAM,QAAQ,cAAc,WAAW;AACvC,MAAI,MAAM,WAAW,EAAG,QAAO,WAAW;AAS1C,MAAI,CAAC,oBAAoB,KAAK,EAAG,QAAO,WAAW;AAEnD,MAAI;AAEF,UAAM,UAA8B,CAAC;AAQrC,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,WAAW,EAAG;AAC5E,YAAM,UAAU,mBAAmB,OAAO,KAAK,OAAO;AAItD,UAAI,CAAC,QAAQ,QAAS;AACtB,UAAI,CAAC,YAAa,eAAc;AAKhC,YAAM,aAAa,qBAAqB,KAAK,SAAS;AACtD,UAAI,CAAC,WAAY;AACjB,cAAQ,KAAK;AAAA,QACX,YAAY,KAAK,cAAc,KAAK,qBAAqB;AAAA,QACzD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7C;AAAA,QACA,OAAO,SAAS,OAAO,OAAO,aAAa;AAAA,QAC3C,GAAI,QAAQ,UACR,EAAE,WAAW,QAAQ,QAAQ,WAAW,SAAS,QAAQ,QAAQ,QAAQ,IACzE,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,EAAE,SAAS,YAAY,WAAW;AAAA,IAC3C;AAYA,UAAM,eAAe,eAAe,MAAM,MAAM,SAAS,CAAC;AAC1D,UAAM,qBAAqB,eACtB,aAAa,cAAc,aAAa,qBAAqB,YAC9D;AACJ,UAAM,qBAAqB,eACtB,qBAAqB,aAAa,SAAS,MAAK,oBAAI,KAAK,CAAC,GAAE,YAAY,KACzE,oBAAI,KAAK,CAAC,GAAE,YAAY;AAQ5B,UAAM,sBACJ,OAAO,iBAAiB,QAAQ,gBAAgB;AAClD,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,UACE,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,OAAO,SAAS,OAAO,OAAO,aAAa;AAAA,QAC7C;AAAA,MACF;AAAA,MACA,YAAY;AAAA,MACZ,GAAI,sBAAsB,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF,QAAQ;AAEN,WAAO,EAAE,YAAY,OAAO;AAAA,EAC9B;AACF;","names":["coerced"]}

package/dist/{chunk-KNN6DAZQ.js → chunk-N77ELJ2D.js}

@@ -3,16 +3,16 @@ import {
 } from "./chunk-FVZ2ISIX.js";
 import {
   defineOperation
-} from "./chunk-NE5WFIY6.js";
+} from "./chunk-LLUGAZ3B.js";
 import {
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   EngramAccessInputError,
   isCodegraphToolName
-} from "./chunk-M3GBOKUX.js";
+} from "./chunk-GDUOCHCD.js";
 import {
   CorrectionContractError
-} from "./chunk-PPVCZPYA.js";
+} from "./chunk-VCLGUIFM.js";
 
 // src/access-operations.ts
 import { z } from "zod";
@@ -465,4 +465,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-KNN6DAZQ.js.map
+//# sourceMappingURL=chunk-N77ELJ2D.js.map

package/dist/{chunk-HTIL3EJK.js → chunk-NXRUUDUF.js}

@@ -1,6 +1,6 @@
 import {
   runPostConsolidationMaterialize
-} from "./chunk-2RBMGTK4.js";
+} from "./chunk-A7TJZLPK.js";
 import {
   discoverMemoryExtensions,
   renderExtensionsBlock,
@@ -217,4 +217,4 @@ export {
   buildExtensionsBlockForConsolidation,
   materializeAfterSemanticConsolidation
 };
-//# sourceMappingURL=chunk-HTIL3EJK.js.map
+//# sourceMappingURL=chunk-NXRUUDUF.js.map

package/dist/{chunk-JV7Q226R.js → chunk-OHTOPFRF.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-ZFXCQPNO.js";
 import {
   StorageManager
-} from "./chunk-422TIKIH.js";
+} from "./chunk-EVPNWN7Z.js";
 import {
   MutationSerializer
 } from "./chunk-LTJAMRGI.js";
@@ -336,4 +336,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-JV7Q226R.js.map
+//# sourceMappingURL=chunk-OHTOPFRF.js.map

package/dist/{chunk-ZG2WP425.js → chunk-ORAK3LNZ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7FL4CNPV.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-ZE7GJ76H.js";
+} from "./chunk-SQNED75R.js";
 import {
   normalizeRecallTokens
 } from "./chunk-ZBJMUXZH.js";
@@ -339,4 +339,4 @@ export {
   scoreStitchCandidate,
   stitchCausalChain
 };
-//# sourceMappingURL=chunk-ZG2WP425.js.map
+//# sourceMappingURL=chunk-ORAK3LNZ.js.map

package/dist/{chunk-NERBFQNY.js → chunk-PD42EYQN.js}

@@ -3,7 +3,7 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-WBHQ5LP5.js";
+} from "./chunk-EXUCUPV2.js";
 
 // src/maintenance/namespace-maintenance-fanout.ts
 var NAMESPACE_MAINTENANCE_JOBS = [
@@ -146,4 +146,4 @@ export {
   summarizeNamespaceMaintenanceHealth,
   formatNamespaceMaintenanceHealthText
 };
-//# sourceMappingURL=chunk-NERBFQNY.js.map
+//# sourceMappingURL=chunk-PD42EYQN.js.map

package/dist/chunk-PHK3HARR.js

@@ -0,0 +1,32 @@
+// src/connectors/coerce.ts
+function coerceBool(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const v = value.trim().toLowerCase();
+    if (["false", "0", "no", "off"].includes(v)) return false;
+    if (["true", "1", "yes", "on"].includes(v)) return true;
+  }
+  return void 0;
+}
+function coerceInstallExtension(value) {
+  return coerceBool(value);
+}
+function coerceNumber(value) {
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? value : void 0;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed.length === 0) return void 0;
+    const n = Number(trimmed);
+    return Number.isFinite(n) ? n : void 0;
+  }
+  return void 0;
+}
+
+export {
+  coerceBool,
+  coerceInstallExtension,
+  coerceNumber
+};
+//# sourceMappingURL=chunk-PHK3HARR.js.map