@remnic/core 9.3.744 → 9.3.745

package/dist/{chunk-WPLRJ4XM.js → chunk-24YDB5QP.js}

@@ -9,9 +9,21 @@ import {
 import {
   importCapsule
 } from "./chunk-ARV3AUOM.js";
+import {
+  getTrustZoneStoreStatus,
+  isTrustZoneName,
+  listTrustZoneRecords,
+  promoteTrustZoneRecord,
+  scoreTrustZoneProvenance,
+  seedTrustZoneDemoDataset,
+  summarizeTrustZonePromotionReadiness
+} from "./chunk-JGSKJHF7.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-IQ7WCZRW.js";
+import {
+  isPathInsideStorageRoot
+} from "./chunk-FF4KLI5W.js";
 import {
   applyTagFilter,
   normalizeTags,
@@ -23,37 +35,12 @@ import {
 import {
   toRecallExplainJson
 } from "./chunk-GKRLPHPU.js";
-import {
-  recordObjectiveStateSnapshotsFromObservedMessages
-} from "./chunk-ICP53SKG.js";
-import {
-  buildProposedActions,
-  buildQualityScore,
-  groupActionsByStatus,
-  listMemoryGovernanceRuns,
-  readMemoryGovernanceRunArtifact,
-  runMemoryGovernance
-} from "./chunk-7N7S2RKF.js";
-import {
-  clusterByKey,
-  createCorrectionService,
-  isCorrectionFeatureEnabled
-} from "./chunk-A2KKLCOS.js";
-import {
-  getTrustZoneStoreStatus,
-  isTrustZoneName,
-  listTrustZoneRecords,
-  promoteTrustZoneRecord,
-  scoreTrustZoneProvenance,
-  seedTrustZoneDemoDataset,
-  summarizeTrustZonePromotionReadiness
-} from "./chunk-JGSKJHF7.js";
-import {
-  isPathInsideStorageRoot
-} from "./chunk-FF4KLI5W.js";
 import {
   estimateRecallTokens
 } from "./chunk-DRUDC2UX.js";
+import {
+  recordObjectiveStateSnapshotsFromObservedMessages
+} from "./chunk-ICP53SKG.js";
 import {
   objectiveStateStoreOverrideForNamespace
 } from "./chunk-6HMYUWXR.js";
@@ -76,6 +63,14 @@ import {
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
+import {
+  buildProposedActions,
+  buildQualityScore,
+  groupActionsByStatus,
+  listMemoryGovernanceRuns,
+  readMemoryGovernanceRunArtifact,
+  runMemoryGovernance
+} from "./chunk-R2OAN6IP.js";
 import {
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
@@ -110,15 +105,22 @@ import {
 import {
   FileCalendarSource,
   buildBriefing,
+  enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-6XG3NQRC.js";
+} from "./chunk-3IJGF6K2.js";
 import {
   parseEntityFile
-} from "./chunk-JFCS6PQU.js";
+} from "./chunk-JHQUIH3W.js";
 import {
   stripAttributesSuffix
 } from "./chunk-SVOZFLIQ.js";
+import {
+  serializeMutations
+} from "./chunk-LTJAMRGI.js";
+import {
+  supersessionKeysForFact
+} from "./chunk-TKZ3AL5V.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
@@ -140,6 +142,9 @@ import {
 import {
   createVersion
 } from "./chunk-VF4XKTX3.js";
+import {
+  computeContentHash
+} from "./chunk-W5H6ZRPT.js";
 import {
   exportCapsule
 } from "./chunk-KQAFEZQX.js";
@@ -181,6 +186,9 @@ import {
   resolveRecallEnhancementCapabilities,
   resolveSecurityCapabilities
 } from "./chunk-VSF7AAGE.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -203,7 +211,7 @@ import { stat as stat2 } from "fs/promises";
 import * as nodeFs from "fs/promises";
 import { constants as fsConstants } from "fs";
 import { readdirSync, unlinkSync } from "fs";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { ZodError } from "zod";
 
 // src/coding/decision-records.ts
@@ -1180,12 +1188,12 @@ async function findArchitectureCardMemory(storage) {
   });
   return cards[0] ?? null;
 }
-function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile4, writeVersion) {
+function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile5, writeVersion) {
   return {
     async snapshotIfExists(memory) {
       if (!enabled) return;
       try {
-        const fullContent = await readFile4(memory.path);
+        const fullContent = await readFile5(memory.path);
         await writeVersion(
           memory.path,
           fullContent,
@@ -1958,219 +1966,2074 @@ function computeSessionDelta(lastSeen, current) {
     nextState
   };
 }
-function capCommits(commits, max) {
-  if (!Number.isFinite(max) || max <= 0) return [];
-  if (commits.length <= max) return commits;
-  return commits.slice(-max);
+function capCommits(commits, max) {
+  if (!Number.isFinite(max) || max <= 0) return [];
+  if (commits.length <= max) return commits;
+  return commits.slice(-max);
+}
+function capFiles(files, max) {
+  if (!Number.isFinite(max) || max <= 0) return [];
+  if (files.length <= max) return files;
+  return files.slice(0, max);
+}
+function buildSummaryLine(commitCount, fileCount, sinceIso) {
+  const since = formatSinceDate(sinceIso);
+  const commitWord = commitCount === 1 ? "commit" : "commits";
+  const fileWord = fileCount === 1 ? "file" : "files";
+  return `Since ${since}: ${commitCount} ${commitWord}, ${fileCount} ${fileWord} touched.`;
+}
+function formatSinceDate(iso) {
+  const match = /^(\d{4}-\d{2}-\d{2})/.exec(iso);
+  return match ? match[1] : iso;
+}
+var CODING_KNOWLEDGE_STATE_DIR = path3.join("state", "coding-knowledge");
+function sessionDeltaStatePath(memoryDir, namespace) {
+  const safe = sanitizeFragment(namespace) || "default";
+  return path3.join(memoryDir, CODING_KNOWLEDGE_STATE_DIR, `${safe}.json`);
+}
+async function readLastSeenState(statePath) {
+  try {
+    const raw = await readFile2(statePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const obj = parsed;
+    const head = typeof obj.head === "string" ? obj.head : null;
+    const at = typeof obj.at === "string" ? obj.at : null;
+    if (!head || !at) return null;
+    return { head, at };
+  } catch {
+    return null;
+  }
+}
+async function writeLastSeenState(statePath, state) {
+  if (!state.head || !state.at) {
+    throw new Error(
+      `writeLastSeenState: invalid state (head=${JSON.stringify(state.head)}, at=${JSON.stringify(state.at)})`
+    );
+  }
+  const dir = path3.dirname(statePath);
+  await mkdir(dir, { recursive: true });
+  const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
+  await writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
+  await rename(tmp, statePath);
+}
+function resolveSlice(repoRoot, sinceHead, invoker) {
+  const headResult = invoker(repoRoot, ["rev-parse", "HEAD"]);
+  if (headResult.exitCode !== 0) {
+    return {
+      ok: false,
+      code: headResult.stdout.trim().length === 0 ? "no_head" : "git_failed",
+      detail: `rev-parse HEAD exited ${headResult.exitCode}`
+    };
+  }
+  const currentHead = headResult.stdout.trim();
+  if (!currentHead) {
+    return { ok: false, code: "no_head", detail: "rev-parse HEAD returned empty" };
+  }
+  if (!sinceHead) {
+    return { ok: true, slice: { commits: [], touchedFiles: [], currentHead } };
+  }
+  if (sinceHead === currentHead) {
+    return { ok: true, slice: { commits: [], touchedFiles: [], currentHead } };
+  }
+  const SEP = "";
+  const logResult = invoker(repoRoot, [
+    "log",
+    "--reverse",
+    `--pretty=format:%H${SEP}%s`,
+    "--name-only",
+    `${sinceHead}..${currentHead}`
+  ]);
+  if (logResult.exitCode !== 0) {
+    if (logResult.exitCode === 128) {
+      return { ok: true, slice: { commits: [], touchedFiles: [], currentHead } };
+    }
+    return {
+      ok: false,
+      code: "git_failed",
+      detail: "git log exited " + logResult.exitCode + " (transient \u2014 state marker preserved)"
+    };
+  }
+  const { commits, touchedFiles } = parseLogOutput(logResult.stdout, SEP);
+  return { ok: true, slice: { commits, touchedFiles, currentHead } };
+}
+function parseLogOutput(stdout, sep2) {
+  const commits = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  const blocks = stdout.split(/\n\s*\n/);
+  for (const block of blocks) {
+    const lines = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+    if (lines.length === 0) continue;
+    const header = lines[0];
+    const sepIdx = header.indexOf(sep2);
+    if (sepIdx >= 0) {
+      const sha = header.slice(0, sepIdx);
+      const subject = header.slice(sepIdx + sep2.length);
+      commits.push({ sha, subject });
+      for (let i = 1; i < lines.length; i += 1) {
+        if (lines[i]) fileSet.add(lines[i]);
+      }
+    } else {
+      for (const line of lines) fileSet.add(line);
+    }
+  }
+  const touchedFiles = [...fileSet].sort((a, b) => a.localeCompare(b));
+  return { commits, touchedFiles };
+}
+
+// src/coding/session-delta-surfaces.ts
+var DELTA_SUBCOMMANDS = ["get"];
+function isSessionDeltaSurfaceEnabled(config, codingContext) {
+  return config.enabled === true && config.sessionDelta === true && codingContext !== null && codingContext !== void 0;
+}
+async function handleCodingDelta(request, ctx) {
+  const codingContext = request.sessionKey ? ctx.getCodingContext(request.sessionKey) : null;
+  if (codingContext === null || !isSessionDeltaSurfaceEnabled(ctx.codingKnowledge, codingContext)) {
+    ctx.throwInputError(
+      "coding_delta requires codingKnowledge.enabled, codingKnowledge.sessionDelta, and an attached coding context"
+    );
+  }
+  switch (request.subcommand) {
+    case "get":
+      return deltaGet(request, ctx, codingContext);
+  }
+}
+async function deltaGet(request, ctx, codingContext) {
+  const storage = await ctx.resolveStorage(request);
+  const statePath = sessionDeltaStatePath(storage.memoryDir, storage.namespace);
+  const lastSeen = await readLastSeenState(statePath);
+  const repoRoot = codingContext.rootPath ?? codingContext.projectId;
+  const sliceResult = resolveSlice(
+    repoRoot,
+    lastSeen?.head ?? null,
+    ctx.gitInvoker
+  );
+  if (!sliceResult.ok) {
+    log.warn(
+      `coding_delta/get: slice resolution failed (code=${sliceResult.code}): ${sliceResult.detail}`
+    );
+    return {
+      subcommand: "get",
+      ok: false,
+      code: "git_failed",
+      detail: sliceResult.detail
+    };
+  }
+  const result = computeSessionDelta(lastSeen, sliceResult.slice);
+  const canAdvanceState = storage.canAdvanceState !== false;
+  let nextState = null;
+  if (result.ok) {
+    nextState = result.nextState;
+  } else if (result.code === "unreachable_head") {
+    nextState = result.nextState;
+  }
+  if (nextState && canAdvanceState) {
+    try {
+      await writeLastSeenState(statePath, nextState);
+    } catch (err) {
+      log.warn(
+        `coding_delta/get: state write failed for ${statePath}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  if (!result.ok) {
+    if (result.code === "unreachable_head") {
+      return {
+        subcommand: "get",
+        ok: false,
+        code: result.code,
+        detail: result.detail,
+        nextState: result.nextState
+      };
+    }
+    return {
+      subcommand: "get",
+      ok: false,
+      code: result.code,
+      detail: result.detail
+    };
+  }
+  switch (result.kind) {
+    case "first_run":
+      return { subcommand: "get", ok: true, kind: "first_run", nextState: result.nextState };
+    case "unchanged":
+      return { subcommand: "get", ok: true, kind: "unchanged", nextState: result.nextState };
+    case "changed":
+      return {
+        subcommand: "get",
+        ok: true,
+        kind: "changed",
+        delta: {
+          commits: result.delta.commits,
+          touchedFiles: result.delta.touchedFiles,
+          totalCommits: result.delta.totalCommits,
+          totalTouchedFiles: result.delta.totalTouchedFiles,
+          summaryLine: result.delta.summaryLine
+        },
+        nextState: result.nextState
+      };
+  }
+}
+
+// src/correction/correction-contract.ts
+var MEMORY_CATEGORIES = [
+  "fact",
+  "preference",
+  "correction",
+  "entity",
+  "decision",
+  "relationship",
+  "principle",
+  "commitment",
+  "moment",
+  "skill",
+  "rule",
+  "procedure",
+  "reasoning_trace"
+];
+var CORRECTION_ACTION_KINDS = [
+  "supersede",
+  "edit",
+  "retract",
+  "rescope",
+  "redaction_rule"
+];
+var CORRECTION_TEXT_MAX = 1e4;
+var REDACTION_PATTERN_MAX = 256;
+function validateCorrectionRequest(request) {
+  if (!request || typeof request !== "object") {
+    throw new CorrectionContractError("CorrectionRequest must be an object.");
+  }
+  const text = typeof request.text === "string" ? request.text.trim() : "";
+  if (text.length === 0) {
+    throw new CorrectionContractError("CorrectionRequest.text is required and must be non-empty.");
+  }
+  if (text.length > CORRECTION_TEXT_MAX) {
+    throw new CorrectionContractError(
+      `CorrectionRequest.text exceeds the ${CORRECTION_TEXT_MAX}-character limit (${text.length}).`
+    );
+  }
+  const targetIds = Array.isArray(request.targetIds) ? request.targetIds.filter((id) => typeof id === "string" && id.length > 0) : void 0;
+  if (targetIds !== void 0 && targetIds.length === 0) {
+    return {
+      text,
+      ...request.sessionKey ? { sessionKey: request.sessionKey } : {},
+      ...request.principal ? { principal: request.principal } : {},
+      ...request.namespace ? { namespace: request.namespace } : {}
+    };
+  }
+  return {
+    text,
+    ...targetIds ? { targetIds } : {},
+    ...request.sessionKey ? { sessionKey: request.sessionKey } : {},
+    ...request.principal ? { principal: request.principal } : {},
+    ...request.namespace ? { namespace: request.namespace } : {}
+  };
+}
+function validateRedactionPattern(pattern) {
+  if (typeof pattern !== "string") {
+    throw new CorrectionContractError("redaction_rule.pattern must be a string.");
+  }
+  const trimmed = pattern.trim();
+  if (trimmed.length === 0) {
+    throw new CorrectionContractError("redaction_rule.pattern is required.");
+  }
+  if (trimmed.length > REDACTION_PATTERN_MAX) {
+    throw new CorrectionContractError(
+      `redaction_rule.pattern exceeds the ${REDACTION_PATTERN_MAX}-character bound.`
+    );
+  }
+  if (isRegexLike(trimmed) && isUnsafeRedactionRegex(trimmed)) {
+    throw new CorrectionContractError(
+      "redaction_rule.pattern is unsafe \u2014 use a bounded literal or a regex without nested quantifiers / overlapping alternation."
+    );
+  }
+  if (isRegexLike(trimmed)) {
+    const regexBody = trimmed.slice(1, -1);
+    if (regexBody.length === 0) {
+      throw new CorrectionContractError("redaction_rule.pattern body is empty \u2014 use a non-empty regex.");
+    }
+    try {
+      if (new RegExp(regexBody).test("")) {
+        throw new CorrectionContractError(
+          "redaction_rule.pattern matches the empty string \u2014 it would withhold every fact."
+        );
+      }
+    } catch (e) {
+      if (e instanceof CorrectionContractError) throw e;
+    }
+  }
+  return trimmed;
+}
+function isRegexLike(pattern) {
+  return pattern.startsWith("/") && pattern.endsWith("/") && pattern.length >= 2;
+}
+function isUnsafeRedactionRegex(pattern) {
+  const body = pattern.startsWith("/") && pattern.endsWith("/") ? pattern.slice(1, -1) : pattern;
+  if (/(?:^|[^\\])\(\.\*\)|(?:^|[^\\])\.\*|(?:^|[^\\])\.\+|^\.([^*+]?)$/.test(body)) {
+    return true;
+  }
+  if (body.length > 512) return true;
+  for (let i = 0; i < body.length; i++) {
+    if (body[i] !== "(") continue;
+    let depth = 1;
+    let j = i + 1;
+    while (j < body.length && depth > 0) {
+      if (body[j] === "\\") {
+        j += 2;
+        continue;
+      }
+      if (body[j] === "(") depth++;
+      else if (body[j] === ")") depth--;
+      j++;
+    }
+    if (depth !== 0) continue;
+    const afterGroup = body[j];
+    if (afterGroup !== "+" && afterGroup !== "*" && afterGroup !== "{") continue;
+    const groupBody = body.slice(i + 1, j - 1);
+    if (/[+*?]$/.test(groupBody) || /\{\d+,?\d*\}[+*?]?$/.test(groupBody)) {
+      return true;
+    }
+    if (groupBody.includes("|")) {
+      const branches = groupBody.split("|");
+      if (branches.length >= 2) {
+        const firstChars = new Set(branches.map((b) => b[0]).filter(Boolean));
+        if (firstChars.size < branches.filter((b) => b.length > 0).length) {
+          return true;
+        }
+      }
+    }
+    i = j;
+  }
+  return false;
+}
+function validateCorrectionAction(action) {
+  if (!action || typeof action !== "object") {
+    throw new CorrectionContractError("CorrectionAction must be an object.");
+  }
+  const a = action;
+  if (typeof a.kind !== "string" || !CORRECTION_ACTION_KINDS.includes(a.kind)) {
+    throw new CorrectionContractError(
+      `CorrectionAction.kind must be one of: ${CORRECTION_ACTION_KINDS.join(", ")}.`
+    );
+  }
+  switch (a.kind) {
+    case "supersede":
+      if (typeof a.loserId !== "string" || a.loserId.length === 0) {
+        throw new CorrectionContractError("supersede.loserId is required.");
+      }
+      if (a.replacement !== void 0 && a.replacement !== null) {
+        validateMemoryDraft(a.replacement);
+      }
+      break;
+    case "edit":
+      if (typeof a.memoryId !== "string" || a.memoryId.length === 0) {
+        throw new CorrectionContractError("edit.memoryId is required.");
+      }
+      if (typeof a.patch !== "string" || a.patch.length === 0) {
+        throw new CorrectionContractError("edit.patch is required and must be non-empty.");
+      }
+      break;
+    case "retract":
+      if (typeof a.memoryId !== "string" || a.memoryId.length === 0) {
+        throw new CorrectionContractError("retract.memoryId is required.");
+      }
+      break;
+    case "rescope":
+      if (typeof a.memoryId !== "string" || a.memoryId.length === 0) {
+        throw new CorrectionContractError("rescope.memoryId is required.");
+      }
+      if (typeof a.toNamespace !== "string" || a.toNamespace.trim().length === 0) {
+        throw new CorrectionContractError("rescope.toNamespace is required.");
+      }
+      break;
+    case "redaction_rule":
+      if (typeof a.pattern !== "string") {
+        throw new CorrectionContractError("redaction_rule.pattern is required.");
+      }
+      validateRedactionPattern(a.pattern);
+      break;
+  }
+}
+function validateMemoryDraft(draft) {
+  if (!draft || typeof draft !== "object") {
+    throw new CorrectionContractError("MemoryDraft must be an object.");
+  }
+  const d = draft;
+  if (typeof d.content !== "string" || d.content.trim().length === 0) {
+    throw new CorrectionContractError("MemoryDraft.content is required and must be non-empty.");
+  }
+  if (d.category !== void 0) {
+    if (typeof d.category !== "string" || !MEMORY_CATEGORIES.includes(d.category)) {
+      throw new CorrectionContractError(
+        `MemoryDraft.category must be one of: ${MEMORY_CATEGORIES.join(", ")}.`
+      );
+    }
+  }
+  if (d.confidence !== void 0 && (typeof d.confidence !== "number" || d.confidence < 0 || d.confidence > 1)) {
+    throw new CorrectionContractError("MemoryDraft.confidence must be a number in [0, 1].");
+  }
+  if (d.tags !== void 0 && !Array.isArray(d.tags)) {
+    throw new CorrectionContractError("MemoryDraft.tags must be an array.");
+  }
+  if (d.structuredAttributes !== void 0 && (typeof d.structuredAttributes !== "object" || d.structuredAttributes === null)) {
+    throw new CorrectionContractError("MemoryDraft.structuredAttributes must be an object.");
+  }
+}
+function deterministicFallbackPlan(args) {
+  return {
+    planId: newPlanId(),
+    request: args.request,
+    namespace: args.namespace,
+    affected: args.affected,
+    classification: "outdated",
+    actions: [],
+    diff: "",
+    confidence: 0,
+    warnings: [...args.warnings, "planner LLM unavailable \u2014 manual action selection required"],
+    createdAt: args.createdAt,
+    expiresAt: args.expiresAt,
+    status: "pending"
+  };
+}
+function newPlanId() {
+  return `corr-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+var CorrectionContractError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CorrectionContractError";
+  }
+};
+
+// src/correction/correction-planner.ts
+import { mkdir as mkdir2, readFile as readFile3, rename as rename2, unlink, readdir as readdir2, writeFile as writeFile2 } from "fs/promises";
+import path4 from "path";
+var REDACTED_REQUEST_TEXT = "[redacted \u2014 never-store/redaction correction text withheld from the pending-plan file]";
+var CorrectionPlanner = class _CorrectionPlanner {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * Plan a correction. `readableNamespaces` is the AUTHORIZED read scope the
+   * service resolved for this caller; the planner never trusts a caller string.
+   */
+  async plan(request, readableNamespaces) {
+    const cleaned = validateCorrectionRequest(request);
+    if (cleaned.text.length > CORRECTION_TEXT_MAX) {
+      throw new CorrectionContractError("CorrectionRequest.text too long.");
+    }
+    if (cleaned.targetIds && cleaned.targetIds.length > this.deps.maxAffected) {
+      throw new CorrectionContractError(
+        `Correction target list (${cleaned.targetIds.length}) exceeds maxAffected (${this.deps.maxAffected}) \u2014 narrow the target set.`
+      );
+    }
+    const namespaces = readableNamespaces;
+    if (namespaces.length === 0) {
+      throw new CorrectionContractError(
+        "Correction requires at least one readable namespace \u2014 principal has no read scope."
+      );
+    }
+    const located = await this.locateCandidates(cleaned, namespaces);
+    if (located.candidates.length === 0) {
+      return this.persist(
+        this.emptyPlan(cleaned, namespaces[0], "no matching memories found for the correction text")
+      );
+    }
+    const llm = await this.deps.classifyAndDraft({
+      text: cleaned.text,
+      candidates: located.candidates
+    });
+    for (const action of llm.actions) {
+      validateCorrectionAction(action);
+      if (action.kind === "redaction_rule") {
+        validateRedactionPattern(action.pattern);
+      }
+    }
+    const affected = this.deriveAffected(located.candidates, llm);
+    const touchedCount = new Set(
+      llm.actions.map(
+        (a) => a.kind === "supersede" ? a.loserId : a.kind === "edit" || a.kind === "retract" || a.kind === "rescope" ? a.memoryId : null
+      ).filter((id) => id !== null)
+    ).size;
+    if (touchedCount > this.deps.maxAffected) {
+      throw new CorrectionContractError(
+        `Correction touches ${touchedCount} memories, exceeding the maxAffected limit of ${this.deps.maxAffected}. Narrow the correction text or supply explicit targetIds.`
+      );
+    }
+    const candidateIds = new Set(located.candidates.map((c) => c.memoryId));
+    if (llm.actions.length > 0 && candidateIds.size > 0) {
+      const filtered = llm.actions.filter((action) => {
+        const id = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : null;
+        return id === null || candidateIds.has(id);
+      });
+      if (filtered.length < llm.actions.length) {
+        const dropped = llm.actions.length - filtered.length;
+        llm.warnings = [...llm.warnings, `${dropped} action(s) targeted memories outside the located candidate set and were dropped (prompt-injection guard).`];
+        llm.actions = filtered;
+      }
+    }
+    const diff = llm.fallback ? "" : await this.deps.renderDiff({ candidates: located.candidates, actions: llm.actions });
+    const createdAt = this.deps.now().toISOString();
+    const expiresAt = new Date(
+      this.deps.now().getTime() + this.deps.planTtlHours * 60 * 60 * 1e3
+    ).toISOString();
+    const plan = llm.fallback ? deterministicFallbackPlan({
+      request: cleaned,
+      namespace: namespaces[0],
+      affected,
+      warnings: llm.warnings,
+      createdAt,
+      expiresAt
+    }) : {
+      planId: newPlanId(),
+      request: cleaned,
+      namespace: namespaces[0],
+      affected,
+      classification: llm.classification,
+      actions: llm.actions,
+      diff,
+      confidence: clampConfidence(llm.confidence),
+      warnings: llm.warnings,
+      createdAt,
+      expiresAt,
+      status: "pending"
+    };
+    return this.persist(plan);
+  }
+  async locateCandidates(request, namespaces) {
+    if (request.targetIds && request.targetIds.length > 0) {
+      const targets = await this.deps.resolveTargets({
+        targetIds: request.targetIds,
+        namespaces
+      });
+      const seedIds2 = targets.map((c) => c.memoryId);
+      const neighbors2 = await this.deps.expandNeighbors({
+        seedIds: seedIds2,
+        namespaces,
+        limit: this.deps.maxAffected
+      });
+      return { candidates: mergeCandidates(targets, neighbors2).slice(0, this.deps.maxAffected) };
+    }
+    const searched = await this.deps.searchCorpus({
+      text: request.text,
+      namespaces,
+      limit: this.deps.maxAffected
+    });
+    if (searched.length === 0) return { candidates: [] };
+    const seedIds = searched.slice(0, Math.min(5, searched.length)).map((c) => c.memoryId);
+    const neighbors = await this.deps.expandNeighbors({
+      seedIds,
+      namespaces,
+      limit: this.deps.maxAffected
+    });
+    return { candidates: mergeCandidates(searched, neighbors).slice(0, this.deps.maxAffected) };
+  }
+  deriveAffected(candidates, llm) {
+    const byId = new Map(candidates.map((c) => [c.memoryId, c]));
+    const out = [];
+    for (const rel of llm.relevance) {
+      const c = byId.get(rel.memoryId);
+      if (!c) continue;
+      out.push({
+        memoryId: c.memoryId,
+        path: c.path,
+        excerpt: c.excerpt,
+        why: rel.why,
+        ...c.sourceQuote ? { sourceQuote: c.sourceQuote } : {}
+      });
+    }
+    const annotated = new Set(out.map((e) => e.memoryId));
+    for (const action of llm.actions) {
+      const id = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : null;
+      if (id && !annotated.has(id)) {
+        const c = byId.get(id);
+        if (c) {
+          out.push({
+            memoryId: c.memoryId,
+            path: c.path,
+            excerpt: c.excerpt,
+            why: "touched by a drafted action",
+            ...c.sourceQuote ? { sourceQuote: c.sourceQuote } : {}
+          });
+          annotated.add(id);
+        }
+      }
+    }
+    return out;
+  }
+  emptyPlan(request, namespace, warning) {
+    const createdAt = this.deps.now().toISOString();
+    const expiresAt = new Date(
+      this.deps.now().getTime() + this.deps.planTtlHours * 60 * 60 * 1e3
+    ).toISOString();
+    return {
+      planId: newPlanId(),
+      request,
+      namespace,
+      affected: [],
+      classification: "outdated",
+      actions: [],
+      diff: "",
+      confidence: 0,
+      warnings: [warning],
+      createdAt,
+      expiresAt,
+      status: "pending"
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Plan persistence — atomic write (rule 54), serialized per plan id (rule 40).
+  // -------------------------------------------------------------------------
+  /** Directory holding pending plans for one namespace. */
+  async pendingDir(namespace) {
+    return path4.join(await this.deps.storageDir(namespace), "state", "corrections", "pending");
+  }
+  async persist(plan) {
+    const dir = await this.pendingDir(plan.namespace);
+    const target = path4.join(dir, `${plan.planId}.json`);
+    const sensitive = plan.classification === "never_store" || plan.actions.some((a) => a.kind === "redaction_rule");
+    const persistedPlan = sensitive ? { ...plan, request: { ...plan.request, text: REDACTED_REQUEST_TEXT } } : plan;
+    await serializeMutations(`correction-plan:${target}`, async () => {
+      await mkdir2(dir, { recursive: true });
+      const tmp = `${target}.${process.pid}.${Date.now().toString(36)}.tmp`;
+      await writeFile2(tmp, `${JSON.stringify(persistedPlan)}
+`, "utf-8");
+      await rename2(tmp, target);
+    });
+    return plan;
+  }
+  /** Load a pending plan by id (used by the service / executor). */
+  async loadPlan(namespace, planId) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    return serializeMutations(`correction-plan:${file}`, async () => {
+      let raw;
+      try {
+        raw = await readFile3(file, "utf-8");
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return null;
+        throw err;
+      }
+      return parsePlan(raw);
+    });
+  }
+  /** List pending plans (newest first), excluding consumed (applied/discarded). */
+  async listPending(namespace) {
+    const dir = await this.pendingDir(namespace);
+    let files;
+    try {
+      files = await readdir2(dir);
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      throw err;
+    }
+    const plans = [];
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      let plan = null;
+      try {
+        plan = await this.loadPlan(namespace, f.replace(/\.json$/, ""));
+      } catch {
+        continue;
+      }
+      if (plan && plan.status === "pending") plans.push(plan);
+    }
+    plans.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
+    return plans;
+  }
+  async markConsumed(namespace, planId, status) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    await serializeMutations(`correction-plan:${file}`, async () => {
+      let raw;
+      try {
+        raw = await readFile3(file, "utf-8");
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return;
+        throw err;
+      }
+      const plan = parsePlan(raw);
+      if (!plan) return;
+      plan.status = status;
+      if (status === "applying") {
+        plan.applyingAt = this.deps.now().toISOString();
+      } else {
+        delete plan.applyingAt;
+      }
+      if (status !== "applying") {
+        plan.actions = plan.actions.map(
+          (a) => a.kind === "redaction_rule" ? { ...a, pattern: "[redacted \u2014 pattern applied]" } : a
+        );
+      }
+      const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.tmp`;
+      await writeFile2(tmp, `${JSON.stringify(plan)}
+`, "utf-8");
+      await rename2(tmp, file);
+    });
+  }
+  async deletePlan(namespace, planId) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    await serializeMutations(`correction-plan:${file}`, async () => {
+      try {
+        await unlink(file);
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return;
+        throw err;
+      }
+    });
+  }
+  /**
+   * Stale-applying TTL: a plan in `applying` state longer than this is
+   * assumed to be from a crashed process and is recovered on startup
+   * (#1713 Item 2). 10 minutes is generous for an apply that normally
+   * completes in seconds, yet short enough to avoid leaving stale state.
+   */
+  static STALE_APPLYING_TTL_MS = 10 * 60 * 1e3;
+  /**
+   * Recover stale `applying` plans past the stale-applying TTL (#1713 Item 2).
+   *
+   * A plan stuck in `applying` means the process died mid-apply. Re-applying
+   * wholesale would duplicate succeeded actions (replacements, tombstones,
+   * audits), so recovery discards + scrubs the plan instead. The operator
+   * inspects the outcome and files a NEW plan for any actions that did not
+   * complete. Plans without `applyingAt` (predating this fix) are recovered
+   * when they are past their `expiresAt` timestamp.
+   *
+   * @returns the ids of recovered (discarded) plans.
+   */
+  async recoverStaleApplyingPlans(namespace, opts) {
+    const ttl = opts?.ttlMs ?? _CorrectionPlanner.STALE_APPLYING_TTL_MS;
+    const now = (opts?.now ?? this.deps.now()).getTime();
+    const dir = await this.pendingDir(namespace);
+    let files;
+    try {
+      files = await readdir2(dir);
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      throw err;
+    }
+    const recovered = [];
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      const planId = f.replace(/\.json$/, "");
+      let plan;
+      try {
+        plan = await this.loadPlan(namespace, planId);
+      } catch {
+        continue;
+      }
+      if (!plan || plan.status !== "applying") continue;
+      const stale = plan.applyingAt ? now - new Date(plan.applyingAt).getTime() >= ttl : now >= new Date(plan.expiresAt).getTime();
+      if (!stale) continue;
+      try {
+        await this.markConsumed(namespace, planId, "discarded");
+        recovered.push(planId);
+      } catch {
+      }
+    }
+    return recovered;
+  }
+};
+function assertSafePlanId(planId) {
+  if (typeof planId !== "string" || planId.length === 0 || planId.includes("/") || planId.includes("\\") || planId.includes("\0") || planId === "." || planId === ".." || planId.startsWith(".") || planId.includes("..")) {
+    throw new CorrectionContractError(
+      `Invalid plan id: ${JSON.stringify(planId)} \u2014 must be a bare file basename with no path separators or parent segments.`
+    );
+  }
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.min(1, Math.max(0, n));
+}
+function mergeCandidates(a, b) {
+  const map = /* @__PURE__ */ new Map();
+  for (const c of a) {
+    const existing = map.get(c.memoryId);
+    if (!existing || c.score > existing.score) map.set(c.memoryId, c);
+  }
+  for (const c of b) {
+    const existing = map.get(c.memoryId);
+    if (!existing || c.score > existing.score) map.set(c.memoryId, c);
+  }
+  return [...map.values()].sort((x, y) => y.score - x.score);
+}
+function parsePlan(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const p = parsed;
+  if (typeof p.planId !== "string" || typeof p.namespace !== "string") return null;
+  if (typeof p.createdAt !== "string" || typeof p.expiresAt !== "string") return null;
+  if (!Array.isArray(p.actions) || !Array.isArray(p.affected)) return null;
+  for (const action of p.actions) {
+    try {
+      validateCorrectionAction(action);
+    } catch {
+      return null;
+    }
+  }
+  return parsed;
+}
+
+// src/correction/correction-executor.ts
+var CorrectionExecutor = class {
+  constructor(deps, planner) {
+    this.deps = deps;
+    this.planner = planner;
+  }
+  deps;
+  planner;
+  /**
+   * Apply a persisted plan by id. Idempotent-once: a second apply of the same
+   * plan is rejected. Returns the {@link CorrectionOutcome}.
+   */
+  async apply(namespace, planId, opts) {
+    if (!opts.confirm) {
+      throw new CorrectionContractError(
+        "Correction apply requires explicit confirmation (correction.applyRequiresConfirm)."
+      );
+    }
+    return serializeMutations(
+      `correction-apply:${namespace}:${planId}`,
+      () => this.applyInternal(namespace, planId, opts.canWriteDestination)
+    );
+  }
+  async applyInternal(namespace, planId, canWriteDestination) {
+    const plan = await this.planner.loadPlan(namespace, planId);
+    if (!plan) {
+      throw new CorrectionContractError(`Correction plan not found: ${planId}`);
+    }
+    if (plan.namespace !== namespace) {
+      throw new CorrectionContractError(
+        `Correction plan ${planId} belongs to namespace '${plan.namespace}', not '${namespace}'.`
+      );
+    }
+    if (plan.status === "applied" || plan.status === "partial" || plan.status === "applying") {
+      throw new CorrectionContractError(
+        `Correction plan ${planId} has already been applied or is in progress (status=${plan.status}).`
+      );
+    }
+    if (plan.status === "discarded") {
+      throw new CorrectionContractError(`Correction plan ${planId} has been discarded.`);
+    }
+    if (this.deps.now().getTime() > new Date(plan.expiresAt).getTime()) {
+      await this.planner.markConsumed(namespace, planId, "discarded");
+      throw new CorrectionContractError(
+        `Correction plan ${planId} expired at ${plan.expiresAt} and has been discarded.`
+      );
+    }
+    for (const action of plan.actions) {
+      validateCorrectionAction(action);
+      if (action.kind === "redaction_rule") {
+        validateRedactionPattern(action.pattern);
+      }
+    }
+    try {
+      await this.planner.markConsumed(namespace, planId, "applying");
+    } catch {
+      throw new CorrectionContractError(
+        `Correction plan ${planId}: cannot mark in-progress (filesystem unwritable?) \u2014 aborting before any mutation.`
+      );
+    }
+    const results = [];
+    const appliedTouched = [];
+    for (const action of plan.actions) {
+      if (action.kind === "supersede" && action.replacement) {
+        const loser = await this.deps.getMemory(namespace, action.loserId);
+        if (!loser) {
+          results.push({
+            action,
+            status: "failed",
+            error: `supersede loser not found: ${action.loserId}`
+          });
+          continue;
+        }
+        try {
+          const newId = await this.deps.writeReplacement(namespace, {
+            content: action.replacement.content,
+            ...action.replacement.category ? { category: action.replacement.category } : {},
+            ...action.replacement.confidence !== void 0 ? { confidence: action.replacement.confidence } : {},
+            ...action.replacement.tags ? { tags: action.replacement.tags } : {},
+            ...action.replacement.entityRef ? { entityRef: action.replacement.entityRef } : {},
+            ...action.replacement.validAt ? { validAt: action.replacement.validAt } : {},
+            ...action.replacement.observedAt ? { observedAt: action.replacement.observedAt } : {},
+            ...action.replacement.structuredAttributes ? { structuredAttributes: action.replacement.structuredAttributes } : {},
+            supersedes: action.loserId
+          });
+          results.push({ action, status: "applied", memoryId: newId });
+          appliedTouched.push(newId);
+        } catch (err) {
+          results.push({
+            action,
+            status: "failed",
+            error: errMsg(err)
+          });
+        }
+      } else if (action.kind === "edit") {
+        try {
+          const editedId = await this.deps.applyEdit(namespace, action.memoryId, action.patch);
+          results.push({ action, status: "applied", memoryId: editedId });
+          appliedTouched.push(editedId);
+        } catch (err) {
+          results.push({ action, status: "failed", error: errMsg(err) });
+        }
+      } else if (action.kind === "redaction_rule") {
+        try {
+          await this.deps.registerRedactionRule(namespace, action.pattern);
+          results.push({ action, status: "applied" });
+        } catch (err) {
+          results.push({ action, status: "failed", error: errMsg(err) });
+        }
+      }
+    }
+    for (const action of plan.actions) {
+      if (action.kind === "supersede") {
+        const replacementResult = results.find(
+          (r) => r.action === action && r.status === "applied"
+        );
+        if (action.replacement && !replacementResult) {
+          continue;
+        }
+        await this.retireAndTombstone(namespace, action, "supersession", results, appliedTouched, {
+          supersededBy: replacementResult?.memoryId
+        });
+      } else if (action.kind === "retract") {
+        await this.retireAndTombstone(namespace, action, "retraction", results, appliedTouched);
+      } else if (action.kind === "rescope") {
+        try {
+          const allowed = canWriteDestination ? await canWriteDestination(action.toNamespace) : true;
+          if (!allowed) {
+            results.push({
+              action,
+              status: "failed",
+              error: `rescope destination namespace not writable: ${action.toNamespace}`
+            });
+            continue;
+          }
+          const destId = await this.deps.rescopeMemory(namespace, action.memoryId, action.toNamespace);
+          results.push({ action, status: "applied", memoryId: destId });
+          appliedTouched.push(action.memoryId);
+          try {
+            await this.deps.propagate(action.toNamespace, [destId]);
+          } catch {
+          }
+        } catch (err) {
+          results.push({ action, status: "failed", error: errMsg(err) });
+        }
+      }
+    }
+    const propagationWarnings = [];
+    if (appliedTouched.length > 0) {
+      try {
+        await this.deps.propagate(namespace, appliedTouched);
+      } catch (err) {
+        propagationWarnings.push(`propagation failed (non-fatal): ${errMsg(err)}`);
+      }
+    }
+    const anyFailed = results.some((r) => r.status === "failed");
+    const status = anyFailed ? "partial" : "applied";
+    const appliedAt = this.deps.now().toISOString();
+    const outcome = {
+      planId,
+      status,
+      results,
+      auditMemoryId: "",
+      // filled after the audit write
+      appliedAt
+    };
+    if (propagationWarnings.length > 0) {
+      outcome.warnings = propagationWarnings;
+    }
+    try {
+      const auditId = await this.deps.appendAuditRecord(namespace, {
+        planId,
+        classification: plan.classification,
+        outcome,
+        requestText: plan.request.text
+      });
+      outcome.auditMemoryId = auditId;
+    } catch (err) {
+      outcome.warnings = [
+        ...propagationWarnings,
+        `audit record write failed (non-fatal): ${errMsg(err)}`
+      ];
+    }
+    try {
+      await this.planner.markConsumed(namespace, planId, status);
+    } catch (err) {
+      const w = outcome;
+      w.warnings = [...w.warnings ?? [], `plan mark-consumed failed (non-fatal): ${errMsg(err)}`];
+    }
+    return outcome;
+  }
+  async retireAndTombstone(namespace, action, reason, results, appliedTouched, opts = {}) {
+    const memoryId = action.kind === "supersede" ? action.loserId : action.kind === "retract" ? action.memoryId : null;
+    if (!memoryId) return;
+    try {
+      const memory = await this.deps.getMemory(namespace, memoryId);
+      if (!memory) {
+        results.push({
+          action,
+          status: "failed",
+          error: `memory not found: ${memoryId}`
+        });
+        return;
+      }
+      const validUntil = this.deps.biTemporalEnabled ? this.deps.now().toISOString() : void 0;
+      const tombstoneId = await this.deps.appendTombstone(namespace, {
+        reason,
+        sourceMemoryId: memoryId,
+        rawContent: memory.rawContent,
+        ...memory.entityRef ? { entityRef: memory.entityRef } : {},
+        ...memory.supersessionKey ? { supersessionKey: memory.supersessionKey } : {},
+        // #1672 item 4: carry the canonical contentHash (exact tier) and the
+        // full supersession-key set (keyed tier) so paraphrased re-observations
+        // of the same supersession identity are blocked, not just the literal
+        // body. Without these the tombstone projected from a structured fact
+        // dropped both fields and the fact could resurrect.
+        ...memory.contentHash ? { contentHash: memory.contentHash } : {},
+        ...memory.supersessionKeys && memory.supersessionKeys.length > 0 ? { supersessionKeys: memory.supersessionKeys } : {}
+      });
+      await this.deps.retireMemory(namespace, memoryId, {
+        status: reason === "supersession" ? "superseded" : "retracted",
+        ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
+        ...validUntil ? { validUntil } : {}
+      });
+      results.push({
+        action,
+        status: "applied",
+        memoryId,
+        ...tombstoneId ? { tombstoneId } : {}
+      });
+      appliedTouched.push(memoryId);
+    } catch (err) {
+      results.push({ action, status: "failed", error: errMsg(err) });
+    }
+  }
+};
+var CORRECTION_ERROR_MAX = 500;
+function sanitizeErrorMessage(raw) {
+  const stripped = raw.replace(/(^|[\s:'"(])\/(?:[^\s'">)\\]+\/)+[^\s'">)\\]*/g, "$1<path>").replace(/(^|[\s:'"(])[A-Za-z]:\\[^\s'">)\\]+(?:\\[^\s'">) ]*)*/g, "$1<path>");
+  const trimmed = stripped.trim();
+  return trimmed.length > CORRECTION_ERROR_MAX ? `${trimmed.slice(0, CORRECTION_ERROR_MAX)}\u2026` : trimmed;
+}
+function errMsg(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return sanitizeErrorMessage(raw);
+}
+
+// src/correction/correction-service.ts
+var CorrectionService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.planner = new CorrectionPlanner(deps.plannerDeps());
+    this.executor = new CorrectionExecutor(deps.executorDeps(), this.planner);
+  }
+  deps;
+  planner;
+  executor;
+  /**
+   * Plan a correction. Read-only — produces + persists a {@link CorrectionPlan}.
+   * Safe to run with the gate ON (default) since the plan writes no memory state.
+   *
+   * The plan is stored under the AUTHORIZED (writable) namespace — the same
+   * namespace apply/listPending/discard resolve — so the plan is always
+   * found by the caller that created it (review threads: plan-stored-wrong-
+   * namespace + cross-namespace candidate mismatch). Candidates are located
+   * within that single namespace too: a correction can only affect memories
+   * the principal can write, so reading from a non-writable namespace to
+   * draft a correction that can never be applied would be misleading.
+   */
+  async plan(request) {
+    this.requireEnabled();
+    const authorized = await this.deps.policy.resolveAuthorizedNamespace(request);
+    return this.planner.plan(request, [authorized]);
+  }
+  /**
+   * Apply a persisted plan by id. Requires `confirm: true` (or interactive
+   * yes at the CLI) when `applyRequiresConfirm` is on (default).
+   */
+  async apply(planId, opts) {
+    this.requireEnabled();
+    if (this.deps.applyRequiresConfirm() && opts.confirm !== true) {
+      throw new CorrectionContractError(
+        "Correction apply requires explicit confirmation (pass `confirm: true`)."
+      );
+    }
+    const namespace = await this.deps.policy.resolveAuthorizedNamespace({
+      ...opts.namespace ? { namespace: opts.namespace } : {},
+      ...opts.sessionKey ? { sessionKey: opts.sessionKey } : {},
+      ...opts.principal ? { principal: opts.principal } : {}
+    });
+    return this.executor.apply(namespace, planId, {
+      confirm: true,
+      // Authorize rescope destinations through the namespace policy bound to
+      // THIS caller's principal (review thread: authorize-rescope-destination).
+      canWriteDestination: (dest) => this.deps.policy.canWriteNamespace({
+        namespace: dest,
+        ...opts.sessionKey ? { sessionKey: opts.sessionKey } : {},
+        ...opts.principal ? { principal: opts.principal } : {}
+      })
+    });
+  }
+  /** List pending (not-yet-applied) plans for the caller's namespace. */
+  async listPending(opts) {
+    this.requireEnabled();
+    const namespace = await this.deps.policy.resolveAuthorizedNamespace(opts);
+    return this.planner.listPending(namespace);
+  }
+  /** Discard a pending plan. Idempotent. */
+  async discard(planId, opts) {
+    this.requireEnabled();
+    const namespace = await this.deps.policy.resolveAuthorizedNamespace(opts);
+    await this.planner.markConsumed(namespace, planId, "discarded");
+    await this.planner.deletePlan(namespace, planId);
+  }
+  /**
+   * Recover stale `applying` plans across the given namespaces (#1713 Item 2).
+   *
+   * Startup maintenance: scans each namespace for plans stuck in `applying`
+   * past the stale-applying TTL (process died mid-apply) and discards+scrubs
+   * them. Unlike plan/apply/listPending, this is NOT a per-caller request —
+   * it operates on all supplied namespaces directly because it is an
+   * internal maintenance operation invoked by the orchestrator at init.
+   *
+   * @returns the total count of recovered plans across all namespaces.
+   */
+  async recoverStaleApplyingPlans(namespaces) {
+    let recovered = 0;
+    for (const namespace of namespaces) {
+      try {
+        const ids = await this.planner.recoverStaleApplyingPlans(namespace);
+        recovered += ids.length;
+      } catch {
+      }
+    }
+    return recovered;
+  }
+  requireEnabled() {
+    if (!this.deps.isEnabled()) {
+      throw new CorrectionContractError(
+        "Correction Contract is disabled (set correction.enabled = true to enable)."
+      );
+    }
+  }
+};
+
+// src/correction/correction-access-wiring.ts
+import path5 from "path";
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+function createCorrectionService(wiring) {
+  const cfg = wiring.orchestrator.config;
+  const correctionEnabled = isCorrectionFeatureEnabled(cfg);
+  const applyRequiresConfirm = typeof cfg.correctionApplyRequiresConfirm === "boolean" ? cfg.correctionApplyRequiresConfirm : readCorrectionFlag(cfg, "applyRequiresConfirm", true);
+  const maxAffected = typeof cfg.correctionMaxAffected === "number" && cfg.correctionMaxAffected >= 1 ? Math.floor(cfg.correctionMaxAffected) : readCorrectionNumber(cfg, "maxAffected", 10);
+  const planTtlHours = typeof cfg.correctionPlanTtlHours === "number" && cfg.correctionPlanTtlHours > 0 ? cfg.correctionPlanTtlHours : readCorrectionNumber(cfg, "planTtlHours", 24);
+  const biTemporalEnabled = cfg.temporalBiTemporal === true;
+  const serviceDeps = {
+    policy: {
+      resolveAuthorizedNamespace: (req) => wiring.resolveAuthorizedNamespace(req),
+      canWriteNamespace: (req) => wiring.canWriteNamespace(req),
+      readableNamespaces: (req) => Promise.resolve(wiring.resolveReadableNamespaces(req))
+    },
+    plannerDeps: () => makePlannerDeps(wiring, { maxAffected, planTtlHours }),
+    executorDeps: () => makeExecutorDeps(wiring, { biTemporalEnabled }),
+    isEnabled: () => correctionEnabled,
+    applyRequiresConfirm: () => applyRequiresConfirm
+  };
+  return new CorrectionService(serviceDeps);
+}
+function makePlannerDeps(wiring, opts) {
+  return {
+    searchCorpus: async ({ text, namespaces, limit }) => searchMemories(wiring, text, namespaces, limit),
+    resolveTargets: async ({ targetIds, namespaces }) => resolveTargetMemories(wiring, targetIds, namespaces),
+    expandNeighbors: async ({ seedIds, namespaces, limit }) => expandEntityNeighbors(wiring, seedIds, namespaces, limit),
+    classifyAndDraft: async ({ text, candidates }) => classifyAndDraft(wiring, text, candidates),
+    renderDiff: async ({ candidates, actions }) => renderCorrectionDiff(wiring, candidates, actions),
+    storageDir: async (namespace) => (await wiring.orchestrator.getStorage(namespace)).dir,
+    maxAffected: opts.maxAffected,
+    planTtlHours: opts.planTtlHours,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function searchMemories(wiring, text, namespaces, limit) {
+  const tokens = tokenize(text);
+  if (tokens.length === 0) return [];
+  const scored = [];
+  for (const ns of namespaces) {
+    const storage = await wiring.orchestrator.getStorage(ns);
+    const all = await storage.readAllMemories();
+    for (const m of all) {
+      if (!isEligibleCorrectionCandidate(m)) continue;
+      const hay = `${m.content} ${m.frontmatter.tags?.join(" ") ?? ""}`.toLowerCase();
+      let hits = 0;
+      for (const tok of tokens) {
+        if (hay.includes(tok)) hits++;
+      }
+      if (hits === 0) continue;
+      scored.push({ m, ns, score: hits / tokens.length });
+    }
+  }
+  scored.sort((a, b) => b.score - a.score);
+  return scored.slice(0, limit).map((s, i) => toCandidate(s.m, s.ns, s.score - i * 0.01));
+}
+function tokenize(text) {
+  const STOP = /* @__PURE__ */ new Set([
+    "the",
+    "a",
+    "an",
+    "is",
+    "are",
+    "was",
+    "were",
+    "be",
+    "been",
+    "being",
+    "to",
+    "of",
+    "in",
+    "on",
+    "at",
+    "by",
+    "for",
+    "with",
+    "from",
+    "into",
+    "and",
+    "or",
+    "but",
+    "not",
+    "no",
+    "yes",
+    "this",
+    "that",
+    "these",
+    "those",
+    "it",
+    "its",
+    "we",
+    "you",
+    "i",
+    "he",
+    "she",
+    "they",
+    "them",
+    "our",
+    "your",
+    "my",
+    "his",
+    "her",
+    "their",
+    "as",
+    "so",
+    "if",
+    "then",
+    "than",
+    "too",
+    "very",
+    "can",
+    "will",
+    "just",
+    "should",
+    "now",
+    "has",
+    "have",
+    "had",
+    "do",
+    "does",
+    "did",
+    "about",
+    "which",
+    "what",
+    "who",
+    "when",
+    "where",
+    "why",
+    "how",
+    "all",
+    "each",
+    "every",
+    "both",
+    "few",
+    "more",
+    "most",
+    "other",
+    "some",
+    "such",
+    "only",
+    "own",
+    "same",
+    "up"
+  ]);
+  const raw = text.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  const out = raw.filter((w) => w.length >= 3 && !STOP.has(w));
+  return [...new Set(out)];
+}
+async function resolveTargetMemories(wiring, targetIds, namespaces) {
+  const out = [];
+  const missing = [];
+  for (const id of targetIds) {
+    let found = null;
+    for (const ns of namespaces) {
+      const storage = await wiring.orchestrator.getStorage(ns);
+      const m = await storage.getMemoryById(id);
+      if (m) {
+        found = toCandidate(m, ns, 1);
+        break;
+      }
+    }
+    if (found) out.push(found);
+    else missing.push(id);
+  }
+  if (missing.length > 0) {
+    throw new CorrectionContractError(`target memory not found: ${missing[0]}`);
+  }
+  return out;
+}
+async function expandEntityNeighbors(wiring, seedIds, namespaces, limit) {
+  if (seedIds.length === 0 || limit <= 0 || namespaces.length === 0) return [];
+  const out = [];
+  const seen = new Set(seedIds);
+  const seedRefs = /* @__PURE__ */ new Set();
+  for (const ns of namespaces) {
+    const storage = await wiring.orchestrator.getStorage(ns);
+    const all = await storage.readAllMemories();
+    for (const m of all) {
+      if (seedIds.includes(m.frontmatter.id) && m.frontmatter.entityRef) {
+        seedRefs.add(m.frontmatter.entityRef);
+      }
+    }
+  }
+  if (seedRefs.size === 0) return [];
+  for (const ns of namespaces) {
+    if (out.length >= limit) break;
+    const storage = await wiring.orchestrator.getStorage(ns);
+    const all = await storage.readAllMemories();
+    for (const m of all) {
+      if (out.length >= limit) break;
+      if (seen.has(m.frontmatter.id)) continue;
+      if (!isEligibleCorrectionCandidate(m)) continue;
+      if (m.frontmatter.entityRef && seedRefs.has(m.frontmatter.entityRef)) {
+        out.push(toCandidate(m, ns, 0.5));
+        seen.add(m.frontmatter.id);
+      }
+    }
+  }
+  return out;
+}
+async function classifyAndDraft(wiring, text, candidates) {
+  try {
+    if (!wiring.llmComplete) {
+      return fallbackClassification(candidates, "no LLM client available");
+    }
+    const user = buildClassifyPrompt(text, candidates);
+    const raw = await wiring.llmComplete({ system: CLASSIFY_SYSTEM_PROMPT, user });
+    return parseClassifyResponse(raw, candidates);
+  } catch (err) {
+    return fallbackClassification(candidates, `LLM unavailable: ${errMsg2(err)}`);
+  }
+}
+async function renderCorrectionDiff(_wiring, candidates, actions) {
+  const lines = [];
+  for (const action of actions) {
+    const id = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : null;
+    const candidate = id ? candidates.find((c) => c.memoryId === id) : null;
+    const before = candidate?.content ?? "(new)";
+    const after = describeAfterState(action);
+    lines.push(`--- ${id ?? "redaction-rule"} (${action.kind})`);
+    lines.push(`- ${before.slice(0, 120)}`);
+    lines.push(`+ ${after.slice(0, 120)}`);
+  }
+  return lines.join("\n");
+}
+function describeAfterState(action) {
+  switch (action.kind) {
+    case "supersede":
+      return action.replacement?.content ?? "(superseded without replacement)";
+    case "edit":
+      return action.patch;
+    case "retract":
+      return "(retracted + tombstoned)";
+    case "rescope":
+      return `(moved to namespace '${action.toNamespace}')`;
+    case "redaction_rule":
+      return `(redaction rule persisted for pattern '${action.pattern}')`;
+  }
+}
+function makeExecutorDeps(wiring, opts) {
+  return {
+    getMemory: async (namespace, memoryId) => getExecutorMemory(wiring, namespace, memoryId),
+    writeReplacement: async (namespace, draft) => writeReplacementMemory(wiring, namespace, draft),
+    applyEdit: async (namespace, memoryId, patch) => applyEditMemory(wiring, namespace, memoryId, patch),
+    retireMemory: async (namespace, memoryId, retireOpts) => retireMemoryFn(wiring, namespace, memoryId, retireOpts),
+    rescopeMemory: async (namespace, memoryId, toNamespace) => rescopeMemoryFn(wiring, namespace, memoryId, toNamespace),
+    appendTombstone: async (namespace, input) => appendTombstoneFn(wiring, namespace, input),
+    registerRedactionRule: async (namespace, pattern) => registerRedactionRuleFn(wiring, namespace, pattern),
+    appendAuditRecord: async (namespace, record) => appendAuditRecordFn(wiring, namespace, record),
+    propagate: async (namespace, touchedMemoryIds) => propagateFn(wiring, namespace, touchedMemoryIds),
+    biTemporalEnabled: opts.biTemporalEnabled,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function getExecutorMemory(wiring, namespace, memoryId) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const m = await storage.getMemoryById(memoryId);
+  if (!m) return null;
+  return toExecutorMemory(m);
+}
+async function writeReplacementMemory(wiring, namespace, draft) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const { id, tombstoneBlocked } = await storage.writeMemory(
+    draft.category ?? "fact",
+    draft.content,
+    {
+      source: "correction",
+      confidence: draft.confidence ?? 0.9,
+      tags: draft.tags ?? [],
+      ...draft.entityRef ? { entityRef: draft.entityRef } : {},
+      ...draft.validAt ? { validAt: draft.validAt } : {},
+      ...draft.observedAt ? { observedAt: draft.observedAt } : {},
+      ...draft.structuredAttributes ? { structuredAttributes: draft.structuredAttributes } : {},
+      ...draft.supersedes ? { supersedes: draft.supersedes } : {}
+    }
+  );
+  if (tombstoneBlocked) {
+    throw new CorrectionContractError(
+      `correction replacement was tombstone-blocked (pending_review ${id}) \u2014 cannot supersede with a non-active replacement`
+    );
+  }
+  return id;
+}
+async function applyEditMemory(wiring, namespace, memoryId, patch) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const existing = await storage.getMemoryById(memoryId);
+  if (!existing) throw new CorrectionContractError(`memory not found for edit: ${memoryId}`);
+  const contentHashForPatch = existing.frontmatter.category === "fact" ? computeContentHash(sanitizeMemoryContent(patch).text) : void 0;
+  await storage.writeMemoryFrontmatter(
+    { ...existing, content: patch },
+    {
+      updated: (/* @__PURE__ */ new Date()).toISOString(),
+      ...contentHashForPatch ? { contentHash: contentHashForPatch } : {}
+    }
+  );
+  return memoryId;
+}
+async function retireMemoryFn(wiring, namespace, memoryId, opts) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const memory = await storage.getMemoryById(memoryId);
+  if (!memory) throw new CorrectionContractError(`memory not found for retire: ${memoryId}`);
+  const storageStatus = opts.status === "retracted" ? "forgotten" : "superseded";
+  await storage.writeMemoryFrontmatter(memory, {
+    status: storageStatus,
+    ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
+    ...opts.status === "superseded" ? { supersededAt: (/* @__PURE__ */ new Date()).toISOString() } : {},
+    // validUntil is the bi-temporal end; absent when the gate is off.
+    ...opts.validUntil ? { invalid_at: opts.validUntil } : {}
+  });
+}
+async function rescopeMemoryFn(wiring, namespace, memoryId, toNamespace) {
+  const sourceStorage = await wiring.orchestrator.getStorage(namespace);
+  const memory = await sourceStorage.getMemoryById(memoryId);
+  if (!memory) throw new CorrectionContractError(`memory not found for rescope: ${memoryId}`);
+  if (memory.frontmatter.status && memory.frontmatter.status !== "active") {
+    throw new CorrectionContractError(
+      `cannot rescope memory ${memoryId}: source is ${memory.frontmatter.status}, not active`
+    );
+  }
+  const destStorage = await wiring.orchestrator.getStorage(toNamespace);
+  const fm = memory.frontmatter;
+  const destContent = fm.structuredAttributes ? stripAttributesSuffix(memory.content) : memory.content;
+  const { id: destId, tombstoneBlocked: destBlocked } = await destStorage.writeMemory(fm.category, destContent, {
+    source: `correction:rescope:${namespace}`,
+    ...typeof fm.confidence === "number" ? { confidence: fm.confidence } : {},
+    ...Array.isArray(fm.tags) ? { tags: fm.tags } : {},
+    ...fm.entityRef ? { entityRef: fm.entityRef } : {},
+    ...fm.structuredAttributes ? { structuredAttributes: fm.structuredAttributes } : {},
+    ...fm.valid_at ? { validAt: fm.valid_at } : {},
+    ...fm.observedAt ? { observedAt: fm.observedAt } : {},
+    ...fm.memoryKind ? { memoryKind: fm.memoryKind } : {},
+    ...Array.isArray(fm.links) ? { links: fm.links } : {},
+    ...fm.intentGoal ? { intentGoal: fm.intentGoal } : {}
+  });
+  if (destBlocked) {
+    throw new CorrectionContractError(
+      `rescope of ${memoryId} into "${toNamespace}" was tombstone-blocked (pending_review ${destId}) \u2014 keeping source active`
+    );
+  }
+  try {
+    await sourceStorage.writeMemoryFrontmatter(memory, {
+      status: "archived",
+      archivedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  } catch (err) {
+    try {
+      const destMem = await destStorage.getMemoryById(destId);
+      if (destMem) {
+        await destStorage.writeMemoryFrontmatter(destMem, {
+          status: "archived",
+          archivedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    } catch {
+    }
+    throw err;
+  }
+  return destId;
+}
+async function appendTombstoneFn(wiring, namespace, input) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const enabled = typeof storage.isTombstonesEnabled === "function" ? storage.isTombstonesEnabled() : true;
+  const keys = input.supersessionKeys && input.supersessionKeys.length > 0 ? input.supersessionKeys : input.supersessionKey ? [input.supersessionKey] : [void 0];
+  const writtenIds = [];
+  let firstId = null;
+  for (const key of keys) {
+    const result = await storage.appendTombstone({
+      reason: input.reason,
+      createdBy: "user_correction",
+      sourceMemoryId: input.sourceMemoryId,
+      rawContent: input.rawContent,
+      ...input.entityRef ? { entityRef: input.entityRef } : {},
+      ...key ? { supersessionKey: key } : {},
+      ...input.contentHash ? { contentHash: input.contentHash } : {}
+    });
+    if (result === null && enabled) {
+      for (const id of writtenIds) {
+        try {
+          await storage.revokeTombstone(id, "user_correction");
+        } catch {
+        }
+      }
+      throw new CorrectionContractError(
+        `tombstone persistence failed for memory ${input.sourceMemoryId} (tombstones enabled but store returned null \u2014 I/O error swallowed)`
+      );
+    }
+    if (firstId === null) firstId = result;
+    if (result) writtenIds.push(result);
+  }
+  return firstId;
+}
+async function registerRedactionRuleFn(wiring, namespace, pattern) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const dir = path5.join(storage.dir, "state", "corrections", "redaction-rules");
+  await mkdir3(dir, { recursive: true });
+  const slugBase = pattern.replace(/[^a-zA-Z0-9]+/g, "-").slice(0, 48) || "rule";
+  const patternHash = createHash2("sha256").update(pattern).digest("hex").slice(0, 16);
+  const slug = `${slugBase}-${patternHash}`;
+  await writeFile3(
+    path5.join(dir, `${slug}.json`),
+    `${JSON.stringify({ pattern, namespace, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`,
+    "utf-8"
+  );
+}
+async function appendAuditRecordFn(wiring, namespace, record) {
+  const storage = await wiring.orchestrator.getStorage(namespace);
+  const { id } = await storage.writeMemory("correction", buildAuditBody(record), {
+    source: "correction-contract",
+    confidence: 1,
+    tags: ["correction-audit", `plan:${record.planId}`, `classification:${record.classification}`]
+  });
+  return id;
+}
+function buildAuditBody(record) {
+  const sensitive = record.classification === "never_store" || record.outcome.results.some((r) => r.action.kind === "redaction_rule");
+  const safeRequest = sensitive ? "[redacted \u2014 never-store/redaction correction text withheld from the audit trail]" : record.requestText.slice(0, 200);
+  const lines = [
+    `Correction plan ${record.planId} applied (${record.outcome.status}).`,
+    "",
+    `Request: ${safeRequest}`,
+    `Classification: ${record.classification}`,
+    `Applied at: ${record.outcome.appliedAt}`,
+    "",
+    "Actions:"
+  ];
+  for (const r of record.outcome.results) {
+    const withhold = r.action.kind === "redaction_rule" || record.classification === "never_store";
+    const errPart = r.error ? withhold ? " (error withheld)" : ` (${r.error})` : "";
+    lines.push(`  - ${r.action.kind}: ${r.status}${errPart}`);
+  }
+  return lines.join("\n");
+}
+async function propagateFn(wiring, namespace, touchedMemoryIds) {
+  for (const id of touchedMemoryIds) {
+    try {
+      const storage = await wiring.orchestrator.getStorage(namespace);
+      const orchestrator = wiring.orchestrator;
+      if (typeof orchestrator.indexPersistedMemory === "function") {
+        await orchestrator.indexPersistedMemory(storage, id);
+      }
+    } catch {
+    }
+  }
 }
-function capFiles(files, max) {
-  if (!Number.isFinite(max) || max <= 0) return [];
-  if (files.length <= max) return files;
-  return files.slice(0, max);
+function toCandidate(m, namespace, score) {
+  return {
+    memoryId: m.frontmatter.id,
+    path: m.path,
+    content: m.content,
+    excerpt: m.content.slice(0, 160),
+    ...m.frontmatter.entityRef ? { entityRef: m.frontmatter.entityRef } : {},
+    score
+    // namespace is implicit (the planner scopes by namespace); keep it on the
+    // candidate for diff rendering if needed.
+  };
 }
-function buildSummaryLine(commitCount, fileCount, sinceIso) {
-  const since = formatSinceDate(sinceIso);
-  const commitWord = commitCount === 1 ? "commit" : "commits";
-  const fileWord = fileCount === 1 ? "file" : "files";
-  return `Since ${since}: ${commitCount} ${commitWord}, ${fileCount} ${fileWord} touched.`;
+function isEligibleCorrectionCandidate(m) {
+  if (m.frontmatter.status && m.frontmatter.status !== "active") return false;
+  if (typeof m.frontmatter.archivedAt === "string" && m.frontmatter.archivedAt.length > 0) return false;
+  return true;
+}
+function toExecutorMemory(m) {
+  const fm = m.frontmatter;
+  const rawBody = fm.structuredAttributes ? stripAttributesSuffix(m.content) : m.content;
+  const supersessionKeys = supersessionKeysForFact({
+    entityRef: fm.entityRef,
+    structuredAttributes: fm.structuredAttributes
+  });
+  return {
+    memoryId: fm.id,
+    content: m.content,
+    category: fm.category,
+    rawContent: rawBody,
+    ...fm.entityRef ? { entityRef: fm.entityRef } : {},
+    ...supersessionKeys.length > 0 ? { supersessionKeys } : {},
+    ...supersessionKeys.length > 0 ? { supersessionKey: supersessionKeys[0] } : {},
+    ...typeof fm.contentHash === "string" && fm.contentHash.length > 0 ? { contentHash: fm.contentHash } : {}
+  };
 }
-function formatSinceDate(iso) {
-  const match = /^(\d{4}-\d{2}-\d{2})/.exec(iso);
-  return match ? match[1] : iso;
+function isCorrectionFeatureEnabled(config) {
+  if (typeof resolveRecallAuxiliaryCapabilities(config).correction === "boolean") return resolveRecallAuxiliaryCapabilities(config).correction;
+  const nested = config.correction;
+  if (nested && typeof nested.enabled === "boolean") return nested.enabled;
+  if (nested && typeof nested.enabled === "string") return nested.enabled === "true" || nested.enabled === "1";
+  return readCorrectionFlag(config, "enabled", true);
+}
+function readCorrectionFlag(config, key, fallback) {
+  const nested = config.correction;
+  if (nested && typeof nested[key] === "boolean") return nested[key];
+  if (nested && typeof nested[key] === "string") return nested[key] === "true" || nested[key] === "1";
+  const raw = config[`correction${capitalize(key)}`];
+  if (typeof raw === "boolean") return raw;
+  if (typeof raw === "string") return raw === "true" || raw === "1";
+  return fallback;
+}
+function readCorrectionNumber(config, key, fallback) {
+  const nested = config.correction;
+  if (nested) {
+    const nv = nested[key];
+    if (typeof nv === "number" && Number.isFinite(nv)) return nv;
+    if (typeof nv === "string") {
+      const nn = Number(nv);
+      if (Number.isFinite(nn)) return nn;
+    }
+  }
+  const raw = config[`correction${capitalize(key)}`];
+  if (typeof raw === "number" && Number.isFinite(raw)) return raw;
+  if (typeof raw === "string") {
+    const n = Number(raw);
+    if (Number.isFinite(n)) return n;
+  }
+  return fallback;
+}
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+function errMsg2(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+var CLASSIFY_SYSTEM_PROMPT = `You classify memory corrections and draft per-memory actions.
+
+Given a correction statement and candidate memories, respond with a JSON object:
+{
+  "classification": "wrong" | "outdated" | "incomplete" | "wrong_scope" | "never_store",
+  "confidence": <number 0..1>,
+  "actions": [<one or more correction actions>],
+  "relevance": [{"memoryId": "<id>", "why": "<one short sentence>"}]
 }
-var CODING_KNOWLEDGE_STATE_DIR = path3.join("state", "coding-knowledge");
-function sessionDeltaStatePath(memoryDir, namespace) {
-  const safe = sanitizeFragment(namespace) || "default";
-  return path3.join(memoryDir, CODING_KNOWLEDGE_STATE_DIR, `${safe}.json`);
+
+Action shapes:
+- {"kind":"supersede","loserId":"<id>","replacement":{"content":"<new fact>"}}
+- {"kind":"edit","memoryId":"<id>","patch":"<new full content>"}
+- {"kind":"retract","memoryId":"<id>"}
+- {"kind":"rescope","memoryId":"<id>","toNamespace":"<ns>"}
+- {"kind":"redaction_rule","pattern":"<bounded literal or regex>"}
+
+Only emit actions you are confident in. If uncertain, return confidence < 0.5 and few actions.`;
+function buildClassifyPrompt(text, candidates) {
+  const lines = [
+    `Correction: ${text}`,
+    "",
+    "Candidate memories:"
+  ];
+  for (const c of candidates.slice(0, 20)) {
+    lines.push(`[${c.memoryId}] ${c.excerpt}`);
+  }
+  lines.push("", "Respond with the JSON object only.");
+  return lines.join("\n");
 }
-async function readLastSeenState(statePath) {
+function parseClassifyResponse(raw, candidates) {
+  let parsed;
   try {
-    const raw = await readFile2(statePath, "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const obj = parsed;
-    const head = typeof obj.head === "string" ? obj.head : null;
-    const at = typeof obj.at === "string" ? obj.at : null;
-    if (!head || !at) return null;
-    return { head, at };
+    parsed = JSON.parse(raw);
   } catch {
-    return null;
-  }
-}
-async function writeLastSeenState(statePath, state) {
-  if (!state.head || !state.at) {
-    throw new Error(
-      `writeLastSeenState: invalid state (head=${JSON.stringify(state.head)}, at=${JSON.stringify(state.at)})`
-    );
-  }
-  const dir = path3.dirname(statePath);
-  await mkdir(dir, { recursive: true });
-  const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
-  await writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
-  await rename(tmp, statePath);
-}
-function resolveSlice(repoRoot, sinceHead, invoker) {
-  const headResult = invoker(repoRoot, ["rev-parse", "HEAD"]);
-  if (headResult.exitCode !== 0) {
-    return {
-      ok: false,
-      code: headResult.stdout.trim().length === 0 ? "no_head" : "git_failed",
-      detail: `rev-parse HEAD exited ${headResult.exitCode}`
-    };
-  }
-  const currentHead = headResult.stdout.trim();
-  if (!currentHead) {
-    return { ok: false, code: "no_head", detail: "rev-parse HEAD returned empty" };
-  }
-  if (!sinceHead) {
-    return { ok: true, slice: { commits: [], touchedFiles: [], currentHead } };
+    return fallbackClassification(candidates, "LLM returned non-JSON response");
   }
-  if (sinceHead === currentHead) {
-    return { ok: true, slice: { commits: [], touchedFiles: [], currentHead } };
+  if (!parsed || typeof parsed !== "object") {
+    return fallbackClassification(candidates, "LLM returned non-object response");
   }
-  const SEP = "";
-  const logResult = invoker(repoRoot, [
-    "log",
-    "--reverse",
-    `--pretty=format:%H${SEP}%s`,
-    "--name-only",
-    `${sinceHead}..${currentHead}`
-  ]);
-  if (logResult.exitCode !== 0) {
-    if (logResult.exitCode === 128) {
-      return { ok: true, slice: { commits: [], touchedFiles: [], currentHead } };
+  const obj = parsed;
+  const classification = isClassification(obj.classification) ? obj.classification : "outdated";
+  const confidence = typeof obj.confidence === "number" ? Math.min(1, Math.max(0, obj.confidence)) : 0.5;
+  const rawActions = Array.isArray(obj.actions) ? obj.actions : [];
+  const actions = [];
+  const warnings = [];
+  for (const rawAction of rawActions) {
+    try {
+      validateCorrectionAction(rawAction);
+      actions.push(rawAction);
+    } catch (err) {
+      warnings.push(`dropped malformed action: ${errMsg2(err)}`);
     }
-    return {
-      ok: false,
-      code: "git_failed",
-      detail: "git log exited " + logResult.exitCode + " (transient \u2014 state marker preserved)"
-    };
   }
-  const { commits, touchedFiles } = parseLogOutput(logResult.stdout, SEP);
-  return { ok: true, slice: { commits, touchedFiles, currentHead } };
+  const relevance = Array.isArray(obj.relevance) ? obj.relevance.filter((r) => !!r && typeof r === "object").map((r) => ({
+    memoryId: typeof r.memoryId === "string" ? r.memoryId : "",
+    why: typeof r.why === "string" ? r.why : ""
+  })).filter((r) => r.memoryId.length > 0) : [];
+  return {
+    classification,
+    confidence,
+    actions,
+    relevance,
+    warnings
+  };
 }
-function parseLogOutput(stdout, sep2) {
-  const commits = [];
-  const fileSet = /* @__PURE__ */ new Set();
-  const blocks = stdout.split(/\n\s*\n/);
-  for (const block of blocks) {
-    const lines = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-    if (lines.length === 0) continue;
-    const header = lines[0];
-    const sepIdx = header.indexOf(sep2);
-    if (sepIdx >= 0) {
-      const sha = header.slice(0, sepIdx);
-      const subject = header.slice(sepIdx + sep2.length);
-      commits.push({ sha, subject });
-      for (let i = 1; i < lines.length; i += 1) {
-        if (lines[i]) fileSet.add(lines[i]);
+function isClassification(value) {
+  return value === "wrong" || value === "outdated" || value === "incomplete" || value === "wrong_scope" || value === "never_store";
+}
+function fallbackClassification(candidates, reason) {
+  return {
+    classification: "outdated",
+    confidence: 0,
+    actions: [],
+    relevance: candidates.map((c) => ({ memoryId: c.memoryId, why: "located for review" })),
+    warnings: [reason],
+    fallback: true
+  };
+}
+
+// src/correction/passive-correction-detector.ts
+var PATTERNS = [
+  // ── update: new fact replaces / corrects an old one ──────────────────────
+  {
+    polarity: "update",
+    // "actually, it's X not Y" / "actually we use X now"
+    regex: /\bactually[,\s]+(?:it'?s|we|the|i|our|my|\[m:)/i,
+    confidence: 0.85
+  },
+  {
+    polarity: "update",
+    // "we switched/switching/switched to X"
+    regex: /\bwe\b\s*(?:(?:'re|'ve|are|have)\s+)?(?:switch(?:ed|ing)?|migrat(?:ed|ing)?|mov(?:ed|ing)?|chang(?:ed|ing)?)\s+(?:to|over to|from)\b/i,
+    confidence: 0.9
+  },
+  {
+    polarity: "update",
+    // "we renamed X to Y" / "i renamed"
+    regex: /\b(?:we|i)\s+renam(?:ed|ing)\b/i,
+    confidence: 0.9
+  },
+  {
+    polarity: "update",
+    // "it's now X" / "the deadline moved to X" / "the date changed to X"
+    regex: /\b(?:it'?s now|the\s+(?:deadline|date|meeting|standup|review)\s+(?:moved|chang(?:ed|ing))?\s*to)\b/i,
+    confidence: 0.85
+  },
+  {
+    polarity: "update",
+    // "no, " at the start of a turn or clause — strong correction signal
+    regex: /(?:^|\.\s+|\n)\s*no[,\s]+(?:we|i|it|the|our|my|that)\b/i,
+    confidence: 0.8
+  },
+  {
+    polarity: "update",
+    // "no longer" / "not anymore" + an activity
+    regex: /\b(?:no longer|not anymore)\b/i,
+    confidence: 0.8
+  },
+  {
+    polarity: "update",
+    // Standalone "outdated" — catches "are both outdated", "is outdated", etc.
+    regex: /\boutdated\b/i,
+    confidence: 0.75
+  },
+  {
+    polarity: "update",
+    // "that's outdated" / "that's old"
+    regex: /\bthat'?s\s+(?:outdated|old|no longer (?:true|correct|accurate))\b/i,
+    confidence: 0.85
+  },
+  // ── retract: user says a fact is simply wrong ────────────────────────────
+  {
+    polarity: "retract",
+    regex: /\bthat'?s\s+(?:wrong|not right|incorrect|not true|false)\b/i,
+    confidence: 0.85
+  },
+  {
+    polarity: "retract",
+    // "we don't use X anymore" / "I don't use X anymore"
+    regex: /\b(?:we|i)\s+don'?t\s+use\s+\S+\s+anymore\b/i,
+    confidence: 0.9
+  },
+  {
+    polarity: "retract",
+    regex: /\bforget about\b/i,
+    confidence: 0.8
+  },
+  // ── stop_storing: user wants the agent to stop a behavior ────────────────
+  {
+    polarity: "stop_storing",
+    regex: /\bstop\s+(?:suggesting|bringing\s+up|recommending|reminding\s+me\s+(?:about)?)\b/i,
+    confidence: 0.9
+  },
+  {
+    polarity: "stop_storing",
+    regex: /\b(?:don'?t|never)\s+(?:mention|suggest|recommend|store|bring\s+up)\b/i,
+    confidence: 0.85
+  }
+];
+var HYPOTHETICAL_REGEX = /\b(?:if\s+(?:we|you|i|they)\s+(?:ever|were|could|might|should|decide)|what\s+if|suppose|hypothetically|in\s+(?:theory|principle)|let'?s\s+say|imagine\s+if)\b/i;
+var THIRD_PARTY_REGEX = /\b(?:tell\s+\w+\s+(?:he|she|they|you)'?re?\s+wrong|he'?s\s+wrong\s+about|she'?s\s+wrong\s+about|they'?re\s+wrong\s+about|correct\s+\w+\s+on)\b/i;
+var TOOL_OUTPUT_REGEX = /\b(?:the\s+(?:output|result|response|error|log)|your\s+(?:output|result|response|code|answer))\s+(?:is\s+)?(?:wrong|incorrect|bad|off)\b/i;
+var SELF_RESOLVE_REGEX = /(?:actually|wait|no)[,\s]+(?:never\s*mind|forget\s*(?:that|it)|the\s+(?:original|first)\s+(?:was|is)\s+(?:right|correct)|scratch\s+that|disregard)/i;
+function extractHandles(text) {
+  const matches = text.match(/\[m:[0-9a-fA-F]{4,}\]/g);
+  return matches ?? [];
+}
+function extractTargetHint(text, match) {
+  const matchStart = match.index ?? 0;
+  const start = Math.max(0, matchStart - 20);
+  const end = Math.min(text.length, matchStart + match[0].length + 60);
+  const window = text.slice(start, end).replace(/\s+/g, " ").trim();
+  return window.length > 80 ? window.slice(0, 77) + "..." : window;
+}
+function extractCorrectedAssertion(text, polarity) {
+  if (polarity === "retract") return "";
+  const trimmed = text.replace(/\s+/g, " ").trim();
+  return trimmed.length > 200 ? trimmed.slice(0, 197) + "..." : trimmed;
+}
+function isWithinQuotes(text, matchIndex) {
+  let inQuote = false;
+  for (let i = 0; i < matchIndex && i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "\u201C" || c === "\u201D") {
+      inQuote = !inQuote;
+    }
+  }
+  return inQuote;
+}
+function detectAntiFixture(text) {
+  if (SELF_RESOLVE_REGEX.test(text)) return "self_resolving";
+  if (HYPOTHETICAL_REGEX.test(text)) return "hypothetical";
+  if (THIRD_PARTY_REGEX.test(text)) return "third_party";
+  if (TOOL_OUTPUT_REGEX.test(text)) return "tool_output";
+  return null;
+}
+function detectPassiveCorrections(turns) {
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < turns.length; i++) {
+    const turn = turns[i];
+    if (turn.role !== "user") continue;
+    const content = turn.content?.trim();
+    if (!content) continue;
+    const guard = detectAntiFixture(content);
+    if (guard) continue;
+    const handles = extractHandles(content);
+    for (const pattern of PATTERNS) {
+      const match = pattern.regex.exec(content);
+      if (!match) continue;
+      if (match.index !== void 0 && isWithinQuotes(content, match.index)) {
+        continue;
       }
-    } else {
-      for (const line of lines) fileSet.add(line);
+      const targetHint = extractTargetHint(content, match);
+      const correctedAssertion = extractCorrectedAssertion(content, pattern.polarity);
+      const dedupKey = `${i}:${targetHint}`;
+      if (seen.has(dedupKey)) continue;
+      seen.add(dedupKey);
+      results.push({
+        targetHint,
+        correctedAssertion,
+        polarity: pattern.polarity,
+        handles,
+        confidence: pattern.confidence,
+        sourceExcerpt: content.slice(0, 200),
+        turnIndex: i
+      });
     }
   }
-  const touchedFiles = [...fileSet].sort((a, b) => a.localeCompare(b));
-  return { commits, touchedFiles };
+  return results;
 }
 
-// src/coding/session-delta-surfaces.ts
-var DELTA_SUBCOMMANDS = ["get"];
-function isSessionDeltaSurfaceEnabled(config, codingContext) {
-  return config.enabled === true && config.sessionDelta === true && codingContext !== null && codingContext !== void 0;
+// src/correction/passive-capture.ts
+function emptyTelemetry() {
+  return { detected: 0, queued: 0, autoApplied: 0, suppressedReasons: {} };
 }
-async function handleCodingDelta(request, ctx) {
-  const codingContext = request.sessionKey ? ctx.getCodingContext(request.sessionKey) : null;
-  if (codingContext === null || !isSessionDeltaSurfaceEnabled(ctx.codingKnowledge, codingContext)) {
-    ctx.throwInputError(
-      "coding_delta requires codingKnowledge.enabled, codingKnowledge.sessionDelta, and an attached coding context"
-    );
+function normalizeForFingerprint(text) {
+  return text.toLowerCase().replace(/[^\w\s]/g, "").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function correctionFingerprint(bufferKey, correction) {
+  return `${bufferKey}::${correction.polarity}::${normalizeForFingerprint(correction.targetHint)}`;
+}
+var AUTO_APPLICABLE_ACTION_KINDS = /* @__PURE__ */ new Set(["supersede", "edit", "retract"]);
+var AUTO_APPLICABLE_CLASSIFICATIONS = /* @__PURE__ */ new Set(["outdated", "wrong"]);
+function evaluateAutoApplyGuards(plan, config, isLiveSession) {
+  if (!isLiveSession) return "non_live_session";
+  if (plan.confidence < config.confidenceFloor) return "confidence_below_floor";
+  if (!AUTO_APPLICABLE_CLASSIFICATIONS.has(plan.classification)) {
+    return "classification_not_allowed";
   }
-  switch (request.subcommand) {
-    case "get":
-      return deltaGet(request, ctx, codingContext);
+  if (plan.affected.length > config.autoApplyMaxAffected) {
+    return "affected_too_large";
   }
-}
-async function deltaGet(request, ctx, codingContext) {
-  const storage = await ctx.resolveStorage(request);
-  const statePath = sessionDeltaStatePath(storage.memoryDir, storage.namespace);
-  const lastSeen = await readLastSeenState(statePath);
-  const repoRoot = codingContext.rootPath ?? codingContext.projectId;
-  const sliceResult = resolveSlice(
-    repoRoot,
-    lastSeen?.head ?? null,
-    ctx.gitInvoker
-  );
-  if (!sliceResult.ok) {
-    log.warn(
-      `coding_delta/get: slice resolution failed (code=${sliceResult.code}): ${sliceResult.detail}`
-    );
-    return {
-      subcommand: "get",
-      ok: false,
-      code: "git_failed",
-      detail: sliceResult.detail
-    };
+  if (plan.actions.length === 0) {
+    return "empty_plan";
   }
-  const result = computeSessionDelta(lastSeen, sliceResult.slice);
-  const canAdvanceState = storage.canAdvanceState !== false;
-  let nextState = null;
-  if (result.ok) {
-    nextState = result.nextState;
-  } else if (result.code === "unreachable_head") {
-    nextState = result.nextState;
+  for (const action of plan.actions) {
+    if (!AUTO_APPLICABLE_ACTION_KINDS.has(action.kind)) {
+      return "disallowed_action_kind";
+    }
   }
-  if (nextState && canAdvanceState) {
+  return null;
+}
+async function capturePassiveCorrections(corrections, ctx, config, deps, dedupState) {
+  const telemetry = emptyTelemetry();
+  const plans = [];
+  telemetry.detected = corrections.length;
+  for (const correction of corrections) {
+    const fp = correctionFingerprint(ctx.bufferKey, correction);
+    if (dedupState.has(fp)) {
+      continue;
+    }
+    let targetIds;
+    if (correction.handles.length > 0 && deps.resolveHandle && ctx.sessionKey) {
+      const resolved = [];
+      for (const handle of correction.handles) {
+        const id = deps.resolveHandle(handle, ctx.sessionKey);
+        if (id) resolved.push(id);
+      }
+      if (resolved.length > 0) targetIds = resolved;
+    }
+    const request = {
+      text: correction.correctedAssertion || correction.sourceExcerpt,
+      ...targetIds ? { targetIds } : {},
+      ...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {},
+      ...ctx.principal ? { principal: ctx.principal } : {},
+      namespace: ctx.namespace
+    };
+    let plan;
     try {
-      await writeLastSeenState(statePath, nextState);
+      plan = await deps.planCorrection(request);
     } catch (err) {
       log.warn(
-        `coding_delta/get: state write failed for ${statePath}: ${err instanceof Error ? err.message : String(err)}`
+        `passive-correction: planning failed for "${correction.targetHint.slice(0, 60)}": ${err instanceof Error ? err.message : String(err)}`
       );
+      continue;
     }
-  }
-  if (!result.ok) {
-    if (result.code === "unreachable_head") {
-      return {
-        subcommand: "get",
-        ok: false,
-        code: result.code,
-        detail: result.detail,
-        nextState: result.nextState
-      };
+    plans.push(plan);
+    dedupState.add(fp);
+    if (config.mode === "queue") {
+      telemetry.queued += 1;
+      continue;
+    }
+    const suppression = evaluateAutoApplyGuards(plan, config, ctx.isLiveSession);
+    if (suppression) {
+      telemetry.suppressedReasons[suppression] = (telemetry.suppressedReasons[suppression] ?? 0) + 1;
+      telemetry.queued += 1;
+      continue;
+    }
+    try {
+      const outcome = await deps.applyCorrection(plan.planId, {
+        confirm: true,
+        namespace: ctx.namespace,
+        ...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {},
+        ...ctx.principal ? { principal: ctx.principal } : {}
+      });
+      if (outcome.status !== "applied") {
+        log.warn(
+          `passive-correction: plan ${plan.planId} applied partially \u2014 some actions failed (see audit record)`
+        );
+        continue;
+      }
+      telemetry.autoApplied += 1;
+      try {
+        const dir = await deps.storageDir(ctx.namespace);
+        await enqueuePassiveCorrectionNotification(dir, {
+          planId: plan.planId,
+          summary: buildNotificationSummary(plan),
+          undoCommand: `auto-applied (plan ${plan.planId})`,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      } catch (err) {
+        log.debug(`passive-correction: notification enqueue failed (non-fatal): ${err}`);
+      }
+    } catch (err) {
+      log.warn(
+        `passive-correction: auto-apply failed for plan ${plan.planId}: ${err instanceof Error ? err.message : String(err)} \u2014 plan left in queue`
+      );
+      telemetry.queued += 1;
     }
-    return {
-      subcommand: "get",
-      ok: false,
-      code: result.code,
-      detail: result.detail
-    };
   }
-  switch (result.kind) {
-    case "first_run":
-      return { subcommand: "get", ok: true, kind: "first_run", nextState: result.nextState };
-    case "unchanged":
-      return { subcommand: "get", ok: true, kind: "unchanged", nextState: result.nextState };
-    case "changed":
-      return {
-        subcommand: "get",
-        ok: true,
-        kind: "changed",
-        delta: {
-          commits: result.delta.commits,
-          touchedFiles: result.delta.touchedFiles,
-          totalCommits: result.delta.totalCommits,
-          totalTouchedFiles: result.delta.totalTouchedFiles,
-          summaryLine: result.delta.summaryLine
-        },
-        nextState: result.nextState
-      };
+  return { telemetry, plans };
+}
+function buildNotificationSummary(plan) {
+  const action = plan.actions[0];
+  if (!action) {
+    return plan.request.text.slice(0, 80);
   }
+  const target = action.kind === "supersede" ? action.loserId : action.kind === "edit" || action.kind === "retract" || action.kind === "rescope" ? action.memoryId : "pattern";
+  return `${plan.classification}: ${plan.request.text.slice(0, 60)}${plan.request.text.length > 60 ? "..." : ""} (${target})`;
+}
+
+// src/procedural/procedure-miner.ts
+import { createHash as createHash3 } from "crypto";
+import { mkdir as mkdir4, rm, stat } from "fs/promises";
+import path6 from "path";
+
+// src/procedural/reinforcement-core.ts
+function clusterByKey(items, keyFn) {
+  const clusters = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = keyFn(item);
+    if (typeof key !== "string") {
+      throw new TypeError(
+        `clusterByKey: keyFn must return a string, got ${key === null ? "null" : typeof key}`
+      );
+    }
+    const existing = clusters.get(key);
+    if (existing) {
+      existing.push(item);
+    } else {
+      clusters.set(key, [item]);
+    }
+  }
+  return clusters;
 }
 
 // src/procedural/procedure-miner.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir2, rm, stat } from "fs/promises";
-import path4 from "path";
 var PROCEDURE_CLUSTER_ATTR_MAX = 500;
 var PROCEDURE_CLUSTER_LOCK_STALE_MS = 12e4;
 var PROCEDURE_CLUSTER_LOCK_TIMEOUT_MS = 3e4;
@@ -2181,7 +4044,7 @@ function clusterKey(record) {
   return `${goal}|${refs.join(",")}`;
 }
 function clusterKeyHash(cluster) {
-  return createHash2("sha256").update(cluster).digest("hex");
+  return createHash3("sha256").update(cluster).digest("hex");
 }
 function isErrnoCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
@@ -2190,14 +4053,14 @@ function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function acquireClusterWriteLock(memoryDir, clusterHash) {
-  const lockRoot = path4.join(path4.resolve(memoryDir), "state", "procedure-miner-locks");
-  const lockDir = path4.join(lockRoot, `${clusterHash}.lock`);
-  await mkdir2(lockRoot, { recursive: true });
+  const lockRoot = path6.join(path6.resolve(memoryDir), "state", "procedure-miner-locks");
+  const lockDir = path6.join(lockRoot, `${clusterHash}.lock`);
+  await mkdir4(lockRoot, { recursive: true });
   const startedAt = Date.now();
   let attempts = 0;
   while (true) {
     try {
-      await mkdir2(lockDir);
+      await mkdir4(lockDir);
       return async () => {
         await rm(lockDir, { recursive: true, force: true });
       };
@@ -2222,7 +4085,7 @@ async function acquireClusterWriteLock(memoryDir, clusterHash) {
   }
 }
 async function withClusterWriteLock(memoryDir, clusterHash, fn) {
-  const inProcessKey = `${path4.resolve(memoryDir)}:${clusterHash}`;
+  const inProcessKey = `${path6.resolve(memoryDir)}:${clusterHash}`;
   const previous = inProcessClusterWriteLocks.get(inProcessKey) ?? Promise.resolve();
   let releaseInProcess;
   const current = previous.catch(() => void 0).then(
@@ -2462,7 +4325,7 @@ function formatProcedureStatsText(report) {
 }
 
 // src/admin/admin-surfaces.ts
-import path5 from "path";
+import path7 from "path";
 var REDACTED = "<redacted>";
 var SENSITIVE_KEY_RE = /(token|secret|password|api[_-]?key|bearer|authorization|credential|private[_-]?key)/i;
 var BEARER_VALUE_RE = /^(bearer|sk-|pk-|xox[bp]-|AKIA)/i;
@@ -2745,7 +4608,7 @@ async function auditTranscripts(memoryDir) {
     movedEntries: file.groups.reduce((sum, group) => sum + group.entryCount, 0),
     unmovableLines: file.unmovableLines
   }));
-  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path5.sep).includes("other"));
+  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path7.sep).includes("other"));
   const summary = plan.movedEntries === 0 ? "No mixed-session transcript data detected; nothing to migrate." : `Found ${plan.movedEntries} entries across ${plan.distinctSessions} distinct sessions stranded in shared/legacy directories. Run the CLI migration command to re-home them.`;
   return {
     generatedAt: plan.generatedAt,
@@ -3598,7 +5461,7 @@ var EngramAccessService = class {
     const snapshotForSerialization = {
       sessionKey: options.sessionKey ?? "",
       recordedAt: new Date(options.snapshot.capturedAt).toISOString(),
-      queryHash: createHash3("sha256").update(options.query).digest("hex"),
+      queryHash: createHash4("sha256").update(options.query).digest("hex"),
       queryLen: options.query.length,
       memoryIds,
       namespace,
@@ -7559,7 +9422,7 @@ ${next}`);
       sourceSessionKey: request.sessionKey,
       inputSummary: inputSummaryParts.length > 0 ? inputSummaryParts.join(" | ").slice(0, 500) : void 0,
       dryRun: request.dryRun === true,
-      promptHash: typeof request.sourcePrompt === "string" && request.sourcePrompt.length > 0 ? createHash3("sha256").update(request.sourcePrompt).digest("hex") : void 0
+      promptHash: typeof request.sourcePrompt === "string" && request.sourcePrompt.length > 0 ? createHash4("sha256").update(request.sourcePrompt).digest("hex") : void 0
     };
     const preview = this.orchestrator.previewMemoryActionEvent(event);
     if (request.dryRun === true) {
@@ -7572,7 +9435,7 @@ ${next}`);
     const resolvedNs = this.writableNamespaceFor(request.namespace, request.sessionKey, request.principal);
     const storage = await this.orchestrator.getStorage(resolvedNs);
     const storageDir = storage.dir;
-    const { writeFile: writeFile2, mkdir: mkdir3 } = await import("fs/promises");
+    const { writeFile: writeFile4, mkdir: mkdir5 } = await import("fs/promises");
     const { join: join2, resolve: resolve2 } = await import("path");
     const safeKey = request.sessionKey.replace(/[^a-zA-Z0-9_-]/g, "_");
     if (!safeKey) throw new EngramAccessInputError("sessionKey is required");
@@ -7581,10 +9444,10 @@ ${next}`);
     if (!resolved.startsWith(resolve2(storageDir))) {
       throw new EngramAccessInputError("Invalid sessionKey");
     }
-    await mkdir3(checkpointDir, { recursive: true });
+    await mkdir5(checkpointDir, { recursive: true });
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const filePath = join2(checkpointDir, `checkpoint-${ts}.md`);
-    await writeFile2(filePath, request.context, "utf-8");
+    await writeFile4(filePath, request.context, "utf-8");
     return { saved: true };
   }
   async lcmStatus() {
@@ -8036,7 +9899,7 @@ ${next}`);
   async offlineSyncSnapshot(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const storageHash = createHash3("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash4("sha256").update(storage.dir).digest("hex").slice(0, 16);
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0 ? buildOfflineSyncSnapshotFromBase : buildOfflineSyncSnapshot;
     const snapshot = await snapshotBuilder({
       root: storage.dir,
@@ -8056,7 +9919,7 @@ ${next}`);
   async offlineSyncSnapshotStream(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const storageHash = createHash3("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash4("sha256").update(storage.dir).digest("hex").slice(0, 16);
     return {
       namespace: resolvedNamespace,
       format: OFFLINE_SYNC_SNAPSHOT_FORMAT,
@@ -8077,7 +9940,7 @@ ${next}`);
   async offlineSyncFiles(options) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const storageHash = createHash3("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash4("sha256").update(storage.dir).digest("hex").slice(0, 16);
     try {
       const snapshot = await buildOfflineSyncSnapshotForPaths({
         root: storage.dir,
@@ -8483,6 +10346,11 @@ export {
   DECISION_SUBCOMMANDS,
   isCodegraphToolName,
   DELTA_SUBCOMMANDS,
+  CorrectionContractError,
+  createCorrectionService,
+  detectPassiveCorrections,
+  capturePassiveCorrections,
+  clusterByKey,
   computeProcedureStats,
   formatProcedureStatsText,
   EngramAccessInputError,
@@ -8490,4 +10358,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-WPLRJ4XM.js.map
+//# sourceMappingURL=chunk-24YDB5QP.js.map