@remnic/core 9.65.1 → 9.65.3

package/dist/{chunk-3PXVYJMC.js → chunk-WN5FSGLE.js}

@@ -8,20 +8,20 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-PMVPCZJZ.js";
+} from "./chunk-6433HV72.js";
 import {
   buildCodingGraphInstallHint,
   tryLoadCodingGraphModule
 } from "./chunk-VQ7B2Q6M.js";
-import {
-  WriteQuarantineStore
-} from "./chunk-PJSK6OJM.js";
 import {
   WHO_KNOWS_DEFAULT_LIMIT,
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-R3AAOKR2.js";
+} from "./chunk-NZWEEALH.js";
+import {
+  WriteQuarantineStore
+} from "./chunk-PJSK6OJM.js";
 import {
   trustResultFor
 } from "./chunk-GNVZQ5JN.js";
@@ -45,25 +45,25 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-W6TSGWYS.js";
+} from "./chunk-AZAA5DNP.js";
 import {
   estimateRecallTokens
-} from "./chunk-VPGRXEAB.js";
+} from "./chunk-G57LQRP6.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-4W6INNXO.js";
+} from "./chunk-GUXS322H.js";
+import {
+  ReplicaDivergenceMonitor
+} from "./chunk-CVILPI77.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-2HIJHXB3.js";
 import {
   objectiveStateStoreOverrideForNamespace
 } from "./chunk-HTP6XRUI.js";
-import {
-  ReplicaDivergenceMonitor
-} from "./chunk-CVILPI77.js";
 import {
   recordMemoryOutcome
-} from "./chunk-EIR5VLIH.js";
+} from "./chunk-4K7IW3F7.js";
 import {
   coerceIncludedMemories
 } from "./chunk-2YA5N2BY.js";
@@ -90,13 +90,14 @@ import {
 } from "./chunk-IVKIODHO.js";
 import {
   buildProcedurePersistBody,
-  normalizeProcedureSteps
+  normalizeProcedureSteps,
+  parseProcedureStepsFromBody
 } from "./chunk-QDW3E4RD.js";
 import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-NS5ETDYD.js";
+} from "./chunk-7BEPVIH3.js";
 import {
   boundRecallContextComposition,
   composeRecallContext,
@@ -116,46 +117,42 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-SYJ6EKKE.js";
+} from "./chunk-EIVIB73I.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-53ENM6F6.js";
+} from "./chunk-P4DHENRE.js";
 import {
   ExtractionDeadlineError,
   isActivityDigestPath,
   isArtifactMemoryPath,
   isLocationDayPath,
   isMeetingRecordPath
-} from "./chunk-S2VBSTTA.js";
+} from "./chunk-THG4GYIE.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
-import {
-  filterTrajectoriesByLookbackDays,
-  readCausalTrajectoryRecords
-} from "./chunk-PP7R754B.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-3TMYV3LP.js";
+} from "./chunk-AYYGRVRP.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-DEFI2QBT.js";
+} from "./chunk-PAYGC3BD.js";
 import {
   namespaceCollectionName
-} from "./chunk-X5SDZMO7.js";
+} from "./chunk-YHCBJULX.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-JFJ3MHGV.js";
+} from "./chunk-NXKJHSDN.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -166,15 +163,26 @@ import {
   buildObserveRequestFingerprint,
   composeMemoryEnvelope,
   isMemoryCategory
-} from "./chunk-LCU5R6TQ.js";
+} from "./chunk-RAIUTAZZ.js";
 import {
   applyTagFilter,
   normalizeTags,
   parseTagMatch
 } from "./chunk-BT7NVCML.js";
 import {
-  createVersion
+  createVersion,
+  getVersion,
+  revertToVersion
 } from "./chunk-UFKPQBXH.js";
+import {
+  MEMORY_CORPUS_VERSION_SENTINEL,
+  bumpMemoryCorpusVersionForDir
+} from "./chunk-XCB6QDL6.js";
+import {
+  HistoricalEntityCanonicalIdCache,
+  canonicalizeEntityRefFrontmatter,
+  repairContentAfterJournalMoveSync
+} from "./chunk-ZVPVTPGI.js";
 import {
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
@@ -194,9 +202,16 @@ import {
 import {
   isExternalWikiCollectionName
 } from "./chunk-JV3C2MNQ.js";
+import {
+  filterTrajectoriesByLookbackDays,
+  readCausalTrajectoryRecords
+} from "./chunk-PP7R754B.js";
+import {
+  computePromotionCandidates
+} from "./chunk-RIAM7DND.js";
 import {
   exportCapsule
-} from "./chunk-KQAFEZQX.js";
+} from "./chunk-VDX2J7OX.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
@@ -225,7 +240,7 @@ import {
 } from "./chunk-LNEWDF2A.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-I2HTKOOP.js";
+} from "./chunk-ODZG724P.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-HZNYJN77.js";
@@ -243,6 +258,7 @@ import {
 } from "./chunk-KCT36JAW.js";
 import {
   inferMemoryStatus,
+  isActiveMemoryStatus,
   toMemoryPathRel
 } from "./chunk-7RJUVTVF.js";
 import {
@@ -251,13 +267,6 @@ import {
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
-import {
-  computeContentHash
-} from "./chunk-5FVVY2EB.js";
-import {
-  serializeMutations,
-  withHeldFileLock
-} from "./chunk-FFAZ2XFU.js";
 import {
   SUPPORT_PASSPORT_ATTRIBUTE_KEYS,
   SUPPORT_PASSPORT_CARD_TAG,
@@ -284,6 +293,13 @@ import {
 import {
   stripAttributesSuffix
 } from "./chunk-JDSVLVCG.js";
+import {
+  computeContentHash
+} from "./chunk-5FVVY2EB.js";
+import {
+  serializeMutations,
+  withHeldFileLock
+} from "./chunk-FFAZ2XFU.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
@@ -374,6 +390,10 @@ import {
   raceAbort,
   throwIfAborted
 } from "./chunk-BTTPKDIL.js";
+import {
+  readJsonFile,
+  writeJsonFileAtomic
+} from "./chunk-P77QX3ID.js";
 import {
   AccessAuditAdapter
 } from "./chunk-TVVEYCNW.js";
@@ -387,7 +407,8 @@ import {
   SecureStoreLockedError
 } from "./chunk-XQ3HXAQH.js";
 import {
-  ALL_CATEGORY_DIRS
+  ALL_CATEGORY_DIRS,
+  getCategoryDir
 } from "./chunk-VS2IYZRU.js";
 import {
   recordCitationUsage
@@ -397,7 +418,7 @@ import {
 } from "./chunk-3WCASNQZ.js";
 
 // src/access-service.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { constants as fsConstants2 } from "fs";
 import { readdirSync, unlinkSync } from "fs";
 import { stat as stat3 } from "fs/promises";
@@ -5367,6 +5388,7 @@ var OPERATION_NAMES = [
   "recall_tier_explain",
   "recall_xray",
   "who_knows",
+  "promotion_candidates",
   "namespace_writable",
   "wearables_status",
   "wearables_sync",
@@ -5387,6 +5409,7 @@ var OPERATION_NAMES = [
   "procedure_mining_run",
   "pattern_reinforcement_run",
   "procedural_stats",
+  "procedure_library_maintenance",
   "memory_timeline",
   "suggestion_submit",
   "entity_get",
@@ -5437,6 +5460,7 @@ var OPERATION_NAMES = [
   "review_list",
   "review_resolve",
   "contradiction_scan_run",
+  "preference_drift_scan",
   "memory_summarize_hourly",
   "conversation_index_update",
   "profiling_report",
@@ -5481,6 +5505,9 @@ var OPERATION_NAMES = [
   "trust_zones_status",
   "trust_zones_records",
   "review_disposition",
+  "review_deck_list",
+  "review_deck_action",
+  "review_deck_undo",
   "trust_zones_promote",
   "trust_zones_demo_seed",
   "citations_observed",
@@ -5558,10 +5585,10 @@ function formatZodIssues(error) {
   const parts = [];
   for (const issue of error.issues) {
     const hasNumeric = issue.path.some((p) => typeof p === "number");
-    const path16 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    const path20 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
     const options = enumOptionsFromIssue(issue);
     const suffix = options ? `. Valid: ${options.join(", ")}` : "";
-    parts.push(`${path16}: ${issue.message}${suffix}`);
+    parts.push(`${path20}: ${issue.message}${suffix}`);
   }
   return parts.length > 0 ? `request validation failed: ${parts.join("; ")}` : "request validation failed";
 }
@@ -6114,6 +6141,343 @@ async function promoteMemory(options) {
   };
 }
 
+// src/procedural/library-maintenance.ts
+import path10 from "path";
+var MAINTENANCE_ACTOR = "procedure-library-maintenance";
+var MAINTENANCE_RULE_VERSION = "procedure-library-maintenance:1";
+function maintenanceMarkerPath(memoryDir) {
+  return path10.join(memoryDir, "state", "procedure-maintenance.json");
+}
+async function readProcedureMaintenanceMarker(memoryDir) {
+  try {
+    const raw = await readJsonFile(maintenanceMarkerPath(memoryDir));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const m = raw;
+    if (typeof m.lastRunAt !== "string") return null;
+    return {
+      schemaVersion: 1,
+      lastRunAt: m.lastRunAt,
+      lastApplyAt: typeof m.lastApplyAt === "string" ? m.lastApplyAt : null,
+      appliedCount: typeof m.appliedCount === "number" ? m.appliedCount : 0
+    };
+  } catch {
+    return null;
+  }
+}
+function evidenceFor(m) {
+  return {
+    memoryId: m.frontmatter.id,
+    mwSuccess: m.frontmatter.mw_success ?? 0,
+    mwFail: m.frontmatter.mw_fail ?? 0,
+    lastAccessed: m.frontmatter.lastAccessed ?? null,
+    updated: m.frontmatter.updated ?? null
+  };
+}
+function tsMs(value) {
+  if (typeof value !== "string") return null;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) ? ms : null;
+}
+function procedureTitle(content) {
+  const text = content.replace(/\r\n/g, "\n").trim();
+  const idx = text.search(/^##\s+Step\s+\d+\s*$/im);
+  return (idx === -1 ? text : text.slice(0, idx)).trim();
+}
+function normalizePhrase(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+function stepSignature(steps) {
+  if (steps === null) return "<unparsed>";
+  return steps.map(
+    (s) => `${s.order}|${normalizePhrase(s.intent)}|${s.toolCall?.kind ?? ""}|${s.toolCall?.signature ?? ""}`
+  ).join(";;");
+}
+function isUserEditedProcedure(content) {
+  const steps = parseProcedureStepsFromBody(content);
+  if (steps === null) return true;
+  const rebuilt = buildProcedurePersistBody(procedureTitle(content), steps);
+  return rebuilt.trim() !== content.replace(/\r\n/g, "\n").trim();
+}
+function compareCanonical(a, b) {
+  const aMs = tsMs(a.frontmatter.updated) ?? tsMs(a.frontmatter.created) ?? 0;
+  const bMs = tsMs(b.frontmatter.updated) ?? tsMs(b.frontmatter.created) ?? 0;
+  if (aMs !== bMs) return aMs > bMs ? -1 : 1;
+  const aId = a.frontmatter.id ?? "";
+  const bId = b.frontmatter.id ?? "";
+  if (aId !== bId) return aId < bId ? -1 : 1;
+  return 0;
+}
+function recentTrajectoryToolText(trajectories) {
+  return trajectories.map((r) => r.actionSummary).join("\n").toLowerCase();
+}
+async function runProcedureLibraryMaintenance(options) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const nowIso = now.toISOString();
+  const mode = options.apply === true ? "apply" : "shadow";
+  const cfg = options.config.procedural;
+  if (cfg?.enabled !== true || cfg.maintenance?.enabled !== true) {
+    return {
+      schemaVersion: 1,
+      generatedAt: nowIso,
+      mode,
+      scannedProcedures: 0,
+      proposed: [],
+      applied: [],
+      appliedCount: 0,
+      skippedReason: cfg?.enabled !== true ? "procedural_disabled" : "maintenance_disabled"
+    };
+  }
+  const maintenance = cfg.maintenance;
+  const all = await options.storage.readAllMemories();
+  const byId = /* @__PURE__ */ new Map();
+  for (const m of all) {
+    if (m.frontmatter.category !== "procedure") continue;
+    if (!isActiveMemoryStatus(m.frontmatter.status)) continue;
+    if (typeof m.frontmatter.id === "string" && m.frontmatter.id.length > 0) {
+      byId.set(m.frontmatter.id, m);
+    }
+  }
+  const activeProcedures = [...byId.values()];
+  const report = {
+    schemaVersion: 1,
+    generatedAt: nowIso,
+    mode,
+    scannedProcedures: activeProcedures.length,
+    proposed: [],
+    applied: [],
+    appliedCount: 0
+  };
+  if (activeProcedures.length === 0 && mode === "shadow") return report;
+  const mergeConsumed = /* @__PURE__ */ new Set();
+  if (maintenance.mergeEnabled) {
+    const clusters = /* @__PURE__ */ new Map();
+    for (const m of activeProcedures) {
+      const steps = parseProcedureStepsFromBody(m.content);
+      const key = `${normalizePhrase(procedureTitle(m.content))}
+@@
+${stepSignature(steps)}`;
+      const bucket = clusters.get(key);
+      if (bucket) bucket.push(m);
+      else clusters.set(key, [m]);
+    }
+    for (const cluster of clusters.values()) {
+      if (cluster.length < 2) continue;
+      const sortedCluster = [...cluster].sort(compareCanonical);
+      const userEdited = sortedCluster.filter((m) => isUserEditedProcedure(m.content));
+      if (userEdited.length > 0) {
+        report.proposed.push({
+          action: "flag_user_edited",
+          reasonCode: "user_edited_protected",
+          memoryIds: sortedCluster.map((m) => m.frontmatter.id),
+          reason: "duplicate-signature cluster contains user-edited bodies; merge skipped for manual review",
+          evidence: sortedCluster.map(evidenceFor)
+        });
+        continue;
+      }
+      const canonical = sortedCluster[0];
+      const duplicates = sortedCluster.slice(1);
+      for (const m of sortedCluster) mergeConsumed.add(m.frontmatter.id);
+      report.proposed.push({
+        action: "merge",
+        reasonCode: "merge_duplicate_signature",
+        memoryIds: [canonical.frontmatter.id, ...duplicates.map((m) => m.frontmatter.id)],
+        canonicalId: canonical.frontmatter.id,
+        reason: `near-identical trigger phrase + step signature across ${sortedCluster.length} active procedures`,
+        evidence: sortedCluster.map(evidenceFor)
+      });
+    }
+  }
+  const trajectoryDir = typeof options.config.causalTrajectoryStoreDir === "string" && options.config.causalTrajectoryStoreDir.trim().length > 0 ? options.config.causalTrajectoryStoreDir.trim() : void 0;
+  const { trajectories } = await readCausalTrajectoryRecords({
+    memoryDir: options.memoryDir,
+    causalTrajectoryStoreDir: trajectoryDir
+  });
+  const recentTrajectories = filterTrajectoriesByLookbackDays(
+    trajectories,
+    cfg.lookbackDays,
+    now.getTime()
+  );
+  const repairFlags = [];
+  const staleToolsByProcedure = /* @__PURE__ */ new Map();
+  if (recentTrajectories.length > 0) {
+    const toolText = recentTrajectoryToolText(recentTrajectories);
+    for (const m of activeProcedures) {
+      if (mergeConsumed.has(m.frontmatter.id)) continue;
+      const steps = parseProcedureStepsFromBody(m.content);
+      if (steps === null) continue;
+      const tools = [
+        ...new Set(
+          steps.map((s) => s.toolCall?.kind).filter((t) => typeof t === "string" && t.length > 0)
+        )
+      ];
+      if (tools.length === 0) continue;
+      const stale = tools.filter((t) => !toolText.includes(t.toLowerCase()));
+      if (stale.length === 0) continue;
+      staleToolsByProcedure.set(m.frontmatter.id, stale);
+      repairFlags.push({
+        action: "flag_repair",
+        reasonCode: "needs_repair_stale_tools",
+        memoryIds: [m.frontmatter.id],
+        reason: `tools absent from last ${cfg.lookbackDays}d of trajectories: ${stale.join(", ")}`,
+        evidence: [evidenceFor(m)]
+      });
+    }
+  }
+  const retireActions = [];
+  const retireIds = /* @__PURE__ */ new Set();
+  const idleMs = maintenance.retireIdleDays * 24 * 60 * 60 * 1e3;
+  for (const m of activeProcedures) {
+    if (mergeConsumed.has(m.frontmatter.id)) continue;
+    const mwSuccess = m.frontmatter.mw_success ?? 0;
+    const mwFail = m.frontmatter.mw_fail ?? 0;
+    const failureDominant = mwFail >= maintenance.retireMinOutcomes && mwFail > mwSuccess * maintenance.retireFailRatio;
+    const lastSignalMs = tsMs(m.frontmatter.lastAccessed) ?? tsMs(m.frontmatter.updated);
+    const idle = maintenance.retireIdleDays > 0 && mwSuccess + mwFail === 0 && lastSignalMs !== null && lastSignalMs < now.getTime() - idleMs;
+    const reasonCode = failureDominant ? "retire_failure_dominant" : idle ? "retire_idle" : null;
+    if (reasonCode === null) continue;
+    if (isUserEditedProcedure(m.content)) {
+      report.proposed.push({
+        action: "flag_user_edited",
+        reasonCode: "user_edited_protected",
+        memoryIds: [m.frontmatter.id],
+        reason: `user-edited body exempt from automatic retirement (${reasonCode} waived)`,
+        evidence: [evidenceFor(m)]
+      });
+      continue;
+    }
+    retireIds.add(m.frontmatter.id);
+    retireActions.push({
+      action: "retire",
+      reasonCode,
+      memoryIds: [m.frontmatter.id],
+      reason: reasonCode === "retire_failure_dominant" ? `mw_fail ${mwFail} >= ${maintenance.retireMinOutcomes} and > mw_success ${mwSuccess} * ${maintenance.retireFailRatio}` : `no access signal for ${maintenance.retireIdleDays}d and zero recorded outcomes`,
+      evidence: [evidenceFor(m)]
+    });
+  }
+  for (const flag of repairFlags) {
+    if (retireIds.has(flag.memoryIds[0])) continue;
+    report.proposed.push(flag);
+  }
+  report.proposed.push(...retireActions);
+  if (mode === "shadow") return report;
+  const applied = report.proposed;
+  let writes = 0;
+  for (const action of applied) {
+    try {
+      if (action.action === "merge") {
+        const canonicalId = action.canonicalId;
+        const canonical = canonicalId !== void 0 ? byId.get(canonicalId) : void 0;
+        if (!canonical || canonicalId === void 0) continue;
+        const memberIds = [...action.memoryIds].sort();
+        const previousCount = canonical.frontmatter.reinforcement_count ?? 0;
+        const newCount = Math.max(previousCount, memberIds.length);
+        if (newCount !== canonical.frontmatter.reinforcement_count || canonical.frontmatter.derived_via !== "pattern-reinforcement") {
+          await options.storage.writeMemoryFrontmatter(
+            canonical,
+            {
+              reinforcement_count: newCount,
+              last_reinforced_at: nowIso,
+              derived_via: "pattern-reinforcement",
+              derived_from: memberIds,
+              updated: nowIso
+            },
+            {
+              actor: MAINTENANCE_ACTOR,
+              reasonCode: action.reasonCode,
+              ruleVersion: MAINTENANCE_RULE_VERSION,
+              relatedMemoryIds: memberIds
+            }
+          );
+          writes += 1;
+        }
+        for (const memberId of action.memoryIds) {
+          if (memberId === canonicalId) continue;
+          const member = byId.get(memberId);
+          if (!member) continue;
+          await options.storage.writeMemoryFrontmatter(
+            member,
+            {
+              status: "superseded",
+              supersededBy: canonicalId,
+              supersededAt: nowIso,
+              updated: nowIso
+            },
+            {
+              actor: MAINTENANCE_ACTOR,
+              reasonCode: action.reasonCode,
+              ruleVersion: MAINTENANCE_RULE_VERSION,
+              relatedMemoryIds: [canonicalId]
+            }
+          );
+          writes += 1;
+        }
+      } else if (action.action === "retire") {
+        const memory = byId.get(action.memoryIds[0]);
+        if (!memory) continue;
+        const archivedPath = await options.storage.archiveMemory(memory, {
+          at: now,
+          actor: `${MAINTENANCE_ACTOR}.apply`,
+          reasonCode: action.reasonCode,
+          ruleVersion: MAINTENANCE_RULE_VERSION,
+          relatedMemoryIds: []
+        });
+        if (archivedPath !== null) writes += 1;
+      } else if (action.action === "flag_repair") {
+        const memory = byId.get(action.memoryIds[0]);
+        if (!memory) continue;
+        const existing = memory.frontmatter.structuredAttributes ?? {};
+        const prior = existing.needsRepair;
+        let priorReason = null;
+        if (typeof prior === "string") {
+          try {
+            const parsed = JSON.parse(prior);
+            if (typeof parsed.reason === "string") priorReason = parsed.reason;
+          } catch {
+            priorReason = prior;
+          }
+        }
+        if (priorReason === action.reason) continue;
+        const stamp = JSON.stringify({ reason: action.reason, detectedAt: nowIso });
+        await options.storage.writeMemoryFrontmatter(
+          memory,
+          {
+            structuredAttributes: { ...existing, needsRepair: stamp },
+            updated: nowIso
+          },
+          {
+            actor: MAINTENANCE_ACTOR,
+            reasonCode: action.reasonCode,
+            ruleVersion: MAINTENANCE_RULE_VERSION
+          }
+        );
+        writes += 1;
+      }
+      report.applied.push(action);
+    } catch (err) {
+      log.warn(
+        `procedure-library-maintenance: action ${action.reasonCode} on ${action.memoryIds.join(",")} failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  report.appliedCount = report.applied.length;
+  if (writes > 0) {
+    bumpMemoryCorpusVersionForDir(options.memoryDir);
+  }
+  try {
+    await writeJsonFileAtomic(maintenanceMarkerPath(options.memoryDir), {
+      schemaVersion: 1,
+      lastRunAt: nowIso,
+      lastApplyAt: nowIso,
+      appliedCount: report.appliedCount
+    });
+  } catch (err) {
+    log.warn(
+      `procedure-library-maintenance: failed to persist run marker: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return report;
+}
+
 // src/procedural/procedure-stats.ts
 function snapshotConfig(config) {
   const p = config.procedural;
@@ -6127,7 +6491,7 @@ function snapshotConfig(config) {
     recallMaxProcedures: typeof p?.recallMaxProcedures === "number" ? p.recallMaxProcedures : 0
   };
 }
-function tsMs(value) {
+function tsMs2(value) {
   if (typeof value !== "string") return null;
   const ms = Date.parse(value);
   return Number.isFinite(ms) ? ms : null;
@@ -6149,6 +6513,7 @@ async function computeProcedureStats(options) {
   let lastWriteMs = null;
   let writesLast7Days = 0;
   let minerSourced = 0;
+  let needsRepairFlags = 0;
   const known = [
     "active",
     "pending_review",
@@ -6172,8 +6537,8 @@ async function computeProcedureStats(options) {
     } else {
       counts.other += 1;
     }
-    const createdMs = tsMs(m.frontmatter.created);
-    const updatedMs = tsMs(m.frontmatter.updated);
+    const createdMs = tsMs2(m.frontmatter.created);
+    const updatedMs = tsMs2(m.frontmatter.updated);
     const latestMs = createdMs !== null && updatedMs !== null ? Math.max(createdMs, updatedMs) : updatedMs ?? createdMs;
     if (latestMs !== null) {
       if (lastWriteMs === null || latestMs > lastWriteMs) {
@@ -6186,7 +6551,11 @@ async function computeProcedureStats(options) {
     if (m.frontmatter.source === "procedure-miner") {
       minerSourced += 1;
     }
+    if (m.frontmatter.structuredAttributes?.needsRepair !== void 0 && isActiveMemoryStatus(m.frontmatter.status)) {
+      needsRepairFlags += 1;
+    }
   }
+  const maintenanceMarker = await readProcedureMaintenanceMarker(storage.dir);
   return {
     schemaVersion: 1,
     generatedAt: new Date(nowMs).toISOString(),
@@ -6196,7 +6565,9 @@ async function computeProcedureStats(options) {
       writesLast7Days,
       minerSourced
     },
-    config: snapshotConfig(config)
+    config: snapshotConfig(config),
+    lastMaintenanceAt: maintenanceMarker?.lastRunAt ?? null,
+    needsRepairFlags
   };
 }
 function formatProcedureStatsText(report) {
@@ -6231,6 +6602,10 @@ function formatProcedureStatsText(report) {
   lines.push(`    lastWriteAt:      ${recent.lastWriteAt ?? "(none)"}`);
   lines.push(`    writesLast7Days:  ${recent.writesLast7Days}`);
   lines.push(`    minerSourced:     ${recent.minerSourced}`);
+  lines.push("");
+  lines.push(`  maintenance:`);
+  lines.push(`    lastMaintenanceAt: ${report.lastMaintenanceAt ?? "(never)"}`);
+  lines.push(`    needsRepairFlags:  ${report.needsRepairFlags}`);
   return lines.join("\n") + "\n";
 }
 
@@ -8691,7 +9066,7 @@ import { createHash as createHash5 } from "crypto";
 import * as nodePath2 from "path";
 
 // src/orchestration/recall-result-formatter.ts
-import path10 from "path";
+import path11 from "path";
 function renderConnectorLabel(connector) {
   if (!isValidConnectorId(connector)) return null;
   return connector.length <= CONNECTOR_LABEL_MAX_LENGTH ? connector : `${connector.slice(0, CONNECTOR_LABEL_MAX_LENGTH - 1)}\u2026`;
@@ -8713,15 +9088,15 @@ function resolveEffectiveIdentityInjectionMode(options) {
   return { mode: options.configuredMode, shouldInject: true };
 }
 function displayResultPath(resultPath, memoryDir, namespace) {
-  if (!path10.isAbsolute(resultPath)) return resultPath;
-  const root = path10.resolve(memoryDir);
-  const nsRoot = path10.join(root, "namespaces");
-  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path10.sep))) {
-    const afterNs = path10.relative(nsRoot, resultPath).split(path10.sep).slice(1).join("/");
+  if (!path11.isAbsolute(resultPath)) return resultPath;
+  const root = path11.resolve(memoryDir);
+  const nsRoot = path11.join(root, "namespaces");
+  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path11.sep))) {
+    const afterNs = path11.relative(nsRoot, resultPath).split(path11.sep).slice(1).join("/");
     if (afterNs) return `${namespace}/${afterNs}`;
   }
-  const rel = path10.relative(root, resultPath);
-  return rel && !rel.startsWith("..") && !path10.isAbsolute(rel) ? rel.split(path10.sep).join("/") : resultPath;
+  const rel = path11.relative(root, resultPath);
+  return rel && !rel.startsWith("..") && !path11.isAbsolute(rel) ? rel.split(path11.sep).join("/") : resultPath;
 }
 function displaySafeRecallSnapshot(snapshot, memoryDir) {
   const includedMemories = coerceIncludedMemories(snapshot).map((memory) => ({
@@ -8789,14 +9164,15 @@ ${snippet}`;
       const withHandle = handle ? `${head.trimEnd()} ${handle}` : head.trimEnd();
       const connectorLabel = renderConnectorLabel(r.sourceConnector);
       const withConnector = connectorLabel ? `${withHandle} [agent: ${connectorLabel}]` : withHandle;
+      const withDrift = r.driftNote ? `${withConnector} ${r.driftNote}` : withConnector;
       if (hedgeMap) {
         const item = trustResultFor(hedgeMap, r);
         if (item) {
           const hedge = renderEpistemicHedge(item.trust);
-          if (hedge.length > 0) return `${withConnector} ${hedge}`;
+          if (hedge.length > 0) return `${withDrift} ${hedge}`;
         }
       }
-      return withConnector;
+      return withDrift;
     });
     return { heading: `## ${title}`, entries };
   }
@@ -9989,102 +10365,1497 @@ var AccessRecallSurface = class {
   }
 };
 
-// src/support-passport/card-service.ts
-import { randomUUID as randomUUID2 } from "crypto";
+// src/review/review-deck-surface.ts
+import { createHash as createHash8 } from "crypto";
 
-// src/support-passport/errors.ts
-var SupportPassportError = class extends Error {
-  code;
-  status;
-  constructor(code, message, status) {
+// src/review/review-deck.ts
+import { createHash as createHash6 } from "crypto";
+var ReviewDeckCursorError = class extends Error {
+  constructor(message = "Invalid review deck cursor") {
     super(message);
-    this.name = "SupportPassportError";
-    this.code = code;
-    this.status = status;
+    this.name = "ReviewDeckCursorError";
   }
 };
-
-// src/support-passport/card-state.ts
-function invalidInput() {
-  return new SupportPassportError("invalid_input", "The support card request is invalid.", 400);
+var ALLOWED_CHOICES = ["keep", "prepare_fix", "not_true"];
+var REVERSIBLE_RISK = {
+  keep: "reversible",
+  prepare_fix: "reversible",
+  not_true: "reversible"
+};
+var REVIEW_REASON_LABELS = {
+  low_confidence: "Low confidence",
+  suggestion: "Suggested memory",
+  tombstone_blocked: "Blocked by a deletion",
+  contradiction: "Conflicts with another memory",
+  duplicate: "Possible duplicate"
+};
+var EXCERPT_LIMIT = 240;
+function computeReviewItemRevision(fileContent) {
+  return `rv1:${createHash6("sha256").update(fileContent).digest("hex")}`;
 }
-function isStorageConflict(error) {
-  return error instanceof SupportPassportError && error.code === "storage_conflict";
+function projectReviewDeckItem(row, namespace) {
+  const provenance = provenanceFromRow(row);
+  return {
+    schemaVersion: 1,
+    itemId: row.itemId,
+    source: "review",
+    sourceId: row.itemId,
+    memoryId: row.itemId,
+    content: row.content,
+    ...row.category !== void 0 ? { category: row.category } : {},
+    ...row.lifecycleState !== void 0 ? { lifecycleState: row.lifecycleState } : {},
+    ...row.confidence !== void 0 ? { confidence: row.confidence } : {},
+    ...row.confidenceTier !== void 0 ? { confidenceTier: row.confidenceTier } : {},
+    reviewReason: row.reviewReason,
+    reviewReasonLabel: reviewReasonLabel(row.reviewReason),
+    supportCount: provenance.filter((entry) => entry.relation === "supports").length,
+    provenance,
+    allowedChoices: ALLOWED_CHOICES,
+    choiceRisk: REVERSIBLE_RISK,
+    namespace,
+    revision: row.revision
+  };
 }
-function once(callback) {
-  let called = false;
-  return () => {
-    if (called) return;
-    called = true;
-    callback?.();
+function compareReviewDeckRows(a, b) {
+  const aBlocked = a.blockedBy && a.blockedBy.length > 0 ? 0 : 1;
+  const bBlocked = b.blockedBy && b.blockedBy.length > 0 ? 0 : 1;
+  if (aBlocked !== bBlocked) return aBlocked - bBlocked;
+  const aConfidence = a.confidence ?? 0.5;
+  const bConfidence = b.confidence ?? 0.5;
+  if (aConfidence !== bConfidence) return aConfidence < bConfidence ? -1 : 1;
+  if (a.created !== b.created) return a.created < b.created ? -1 : 1;
+  if (a.itemId !== b.itemId) return a.itemId < b.itemId ? -1 : 1;
+  return 0;
+}
+function encodeReviewDeckCursor(scope, lastSortKey) {
+  return Buffer.from(
+    JSON.stringify({
+      v: 1,
+      p: scope.principalDigest,
+      n: scope.namespace,
+      f: scope.filterDigest,
+      c: scope.corpusVersion,
+      k: lastSortKey
+    }),
+    "utf8"
+  ).toString("base64url");
+}
+function decodeReviewDeckCursor(cursor, scope) {
+  const payload = parseCursorPayload(cursor);
+  if (payload.p !== scope.principalDigest || payload.n !== scope.namespace || payload.f !== scope.filterDigest || payload.c !== scope.corpusVersion) {
+    throw new ReviewDeckCursorError("Review deck cursor scope mismatch");
+  }
+  return payload.k;
+}
+function buildReviewDeckPage(rows, opts) {
+  const sorted = [...rows].sort(compareReviewDeckRows);
+  const limit = Math.max(0, opts.limit);
+  let start = 0;
+  if (opts.cursor !== void 0) {
+    const lastSortKey = decodeReviewDeckCursor(opts.cursor, opts.scope);
+    start = sorted.findIndex((row) => reviewDeckSortKey(row) > lastSortKey);
+    if (start < 0) start = sorted.length;
+  }
+  const pageRows = limit === 0 ? [] : sorted.slice(start, start + limit);
+  const items = pageRows.map((row) => projectReviewDeckItem(row, opts.scope.namespace));
+  const consumed = start + pageRows.length;
+  const nextCursor = pageRows.length > 0 && consumed < sorted.length ? encodeReviewDeckCursor(opts.scope, reviewDeckSortKey(pageRows[pageRows.length - 1])) : void 0;
+  return {
+    schemaVersion: 1,
+    items,
+    total: sorted.length,
+    ...nextCursor !== void 0 ? { nextCursor } : {}
   };
 }
-function validateOwnerScope(owner, principal) {
-  const requestedPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal });
-  const namespace = SupportPassportNamespaceSchema.safeParse(owner.namespace);
-  const ownerPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal: owner.principal });
-  if (!requestedPrincipal.success || !namespace.success || !ownerPrincipal.success || ownerPrincipal.data.principal !== requestedPrincipal.data.principal) {
-    throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
+function reviewDeckSortKey(row) {
+  const blocked = row.blockedBy && row.blockedBy.length > 0 ? "0" : "1";
+  return `${blocked}	${(row.confidence ?? 0.5).toFixed(6)}	${row.created}	${row.itemId}`;
+}
+function reviewReasonLabel(reason) {
+  const known = REVIEW_REASON_LABELS[reason];
+  if (known) return known;
+  const words = reason.split("_").filter((part) => part.length > 0);
+  if (words.length === 0) return "Review";
+  return words.map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase()).join(" ");
+}
+function provenanceFromRow(row) {
+  const fm = parseFrontmatterFields(row.fileContent);
+  const source = nonempty(row.source) ?? nonempty(fm.source);
+  const context = nonempty(row.context) ?? nonempty(fm.context);
+  const created = nonempty(row.created) ?? nonempty(fm.created);
+  const supportIds = idList(fm.supports);
+  const conflictIds = [...idList(fm.conflicts), ...idList(fm.contradicts)];
+  const relatedIds = idList(fm.relatedMemoryIds);
+  const relatedRelation = row.reviewReason === "contradiction" ? "conflicts" : "supports";
+  const provenance = [];
+  if (source !== void 0 || context !== void 0) {
+    provenance.push({
+      relation: "origin",
+      ...created !== void 0 ? { sourceDate: created } : {},
+      excerpt: truncateExcerpt(context ?? source ?? "")
+    });
   }
-  return { ...owner, principal: ownerPrincipal.data.principal, namespace: namespace.data };
-}
-var MAX_OWNER_VISIBLE_CARDS = 100;
-var OWNER_VISIBLE_STATUSES = /* @__PURE__ */ new Set(["pending_review", "active"]);
-function revisionFor(card, status, updatedAt) {
-  return computeSupportPassportCardRevision({
-    cardId: card.cardId,
-    title: card.title,
-    statement: card.statement,
-    category: card.category,
-    status,
-    updatedAt,
-    reviewBy: card.reviewBy
-  });
+  for (const sourceMemoryId of supportIds) {
+    provenance.push({ relation: "supports", sourceMemoryId });
+  }
+  for (const sourceMemoryId of conflictIds) {
+    provenance.push({ relation: "conflicts", sourceMemoryId });
+  }
+  for (const sourceMemoryId of relatedIds) {
+    if (supportIds.includes(sourceMemoryId) || conflictIds.includes(sourceMemoryId)) continue;
+    provenance.push({ relation: relatedRelation, sourceMemoryId });
+  }
+  return provenance;
 }
-function projectRequiredCard(memory, namespace, principal) {
-  const card = projectSupportPassportCard(memory);
-  if (!card) throw new SupportPassportError("card_data_invalid", "The support card data is invalid.", 500);
-  if (card.namespace !== namespace || card.owner !== computeSupportPassportOwnerKey(principal)) {
-    throw new SupportPassportError("card_not_found", "The support card was not found.", 404);
+function parseFrontmatterFields(content) {
+  if (!content.startsWith("---\n")) return {};
+  const end = content.indexOf("\n---", 4);
+  if (end === -1) return {};
+  const fields = {};
+  for (const line of content.slice(4, end).split("\n")) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    fields[line.slice(0, colonIdx).trim()] = line.slice(colonIdx + 1).trim();
   }
-  return card;
+  return fields;
 }
-function projectOwnedCard(memory, namespace, principal) {
-  const card = projectSupportPassportCard(memory);
-  return card?.namespace === namespace && card.owner === computeSupportPassportOwnerKey(principal) ? card : null;
+function idList(value) {
+  if (value === void 0 || value.length === 0) return [];
+  return value.replace(/^\[|\]$/g, "").split(",").map((part) => part.trim().replace(/^["']|["']$/g, "")).filter((part) => part.length > 0);
 }
-function ownsMemory(memory, namespace, principal) {
-  const attributes = memory.frontmatter.structuredAttributes;
-  return attributes !== void 0 && decodeSupportPassportNamespaceAttributes(attributes) === namespace && attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.owner] === computeSupportPassportOwnerKey(principal);
+function nonempty(value) {
+  if (value === void 0) return void 0;
+  return value.trim().length > 0 ? value : void 0;
 }
-function requireRevision(card, expectedRevision) {
-  if (card.card.revision !== expectedRevision) {
-    throw new SupportPassportError("revision_conflict", "The support card changed after it was loaded.", 409);
+function truncateExcerpt(value) {
+  return value.length <= EXCERPT_LIMIT ? value : value.slice(0, EXCERPT_LIMIT);
+}
+function parseCursorPayload(cursor) {
+  if (cursor.length === 0) throw new ReviewDeckCursorError("Malformed review deck cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+  } catch {
+    throw new ReviewDeckCursorError("Malformed review deck cursor");
+  }
+  if (!parsed || typeof parsed !== "object") throw new ReviewDeckCursorError("Malformed review deck cursor");
+  const record = parsed;
+  if (record.v !== 1) throw new ReviewDeckCursorError("Unsupported review deck cursor schema");
+  if (typeof record.p !== "string" || typeof record.n !== "string" || typeof record.f !== "string" || typeof record.c !== "string" || typeof record.k !== "string" || record.k.length === 0) {
+    throw new ReviewDeckCursorError("Malformed review deck cursor");
   }
+  return { v: 1, p: record.p, n: record.n, f: record.f, c: record.c, k: record.k };
 }
-function requireStatus(card, status) {
-  if (card.card.status !== status) {
-    throw new SupportPassportError("invalid_card_status", `The support card must have status ${status}.`, 409);
+
+// src/review/review-deck-mutation.ts
+import { createHash as createHash7, randomUUID } from "crypto";
+import fs3 from "fs";
+import path14 from "path";
+
+// src/review/index.ts
+import fs from "fs";
+import path12 from "path";
+var historicalIdCache = new HistoricalEntityCanonicalIdCache();
+function writeReviewFileCanonicalized(memoryDir, filePath, content) {
+  const stateDir = path12.join(memoryDir, "state");
+  const idsAtWrite = historicalIdCache.get(stateDir);
+  let originalBytes = null;
+  try {
+    originalBytes = fs.readFileSync(filePath, "utf8");
+  } catch {
+    originalBytes = null;
+  }
+  const written = canonicalizeEntityRefFrontmatter(content, idsAtWrite);
+  fs.writeFileSync(filePath, written, "utf8");
+  try {
+    repairContentAfterJournalMoveSync({
+      stateDir,
+      cache: historicalIdCache,
+      idsAtWrite,
+      rawContent: content,
+      lastWritten: written,
+      rewrite: (next) => fs.writeFileSync(filePath, next, "utf8")
+    });
+  } catch (err) {
+    try {
+      if (originalBytes === null) {
+        fs.unlinkSync(filePath);
+      } else {
+        fs.writeFileSync(filePath, originalBytes, "utf8");
+      }
+    } catch {
+    }
+    throw err;
   }
 }
-function ownerVisibleCards(storedCards) {
-  const visibleCards = storedCards.filter(
-    (item) => OWNER_VISIBLE_STATUSES.has(item.card.status) && !item.draftReplacementPrepared
-  );
-  if (visibleCards.length <= MAX_OWNER_VISIBLE_CARDS) return visibleCards;
-  const cardsWithPendingReplacements = new Set(
-    visibleCards.filter((item) => item.card.status === "pending_review").map((item) => item.memory.frontmatter.supersedes).filter((cardId) => typeof cardId === "string")
-  );
-  return visibleCards.filter(
-    (item) => item.card.status !== "active" || !cardsWithPendingReplacements.has(item.card.cardId)
-  );
+var DEFAULT_CONFIDENCE_THRESHOLD = 0.7;
+function realMemoryRoot(memoryDir) {
+  try {
+    const stat4 = fs.lstatSync(memoryDir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return null;
+    return fs.realpathSync(memoryDir);
+  } catch {
+    return null;
+  }
 }
-function ownerListCards(storedCards) {
-  const visibleCards = ownerVisibleCards(storedCards);
-  const byId = new Map(storedCards.map((item) => [item.card.cardId, item]));
-  const activeReplacementPredecessors = activeSupportPassportReplacementPredecessorIds(visibleCards);
-  const replacedDraftIds = new Set(
-    visibleCards.filter(
+function isPathInside(rootReal, candidateReal) {
+  const relative2 = path12.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path12.isAbsolute(relative2);
+}
+function isSafeDirectory(rootReal, dir) {
+  try {
+    const stat4 = fs.lstatSync(dir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return false;
+    return isPathInside(rootReal, fs.realpathSync(dir));
+  } catch {
+    return false;
+  }
+}
+function ensureSafeDirectory(rootReal, dir) {
+  if (fs.existsSync(dir)) {
+    if (!isSafeDirectory(rootReal, dir)) {
+      throw new Error(`Refusing to write through unsafe review path: ${dir}`);
+    }
+    return;
+  }
+  fs.mkdirSync(dir, { recursive: true });
+  if (!isSafeDirectory(rootReal, dir)) {
+    throw new Error(`Refusing to write through unsafe review path: ${dir}`);
+  }
+}
+function listReviewItems(options) {
+  const startTime = Date.now();
+  const {
+    memoryDir,
+    reason: filterReason,
+    limit = 50,
+    confidenceThreshold = DEFAULT_CONFIDENCE_THRESHOLD
+  } = options;
+  const maxItems = Math.max(0, limit);
+  const rootReal = realMemoryRoot(memoryDir);
+  if (!rootReal || maxItems === 0) {
+    return { items: [], total: 0, durationMs: Date.now() - startTime };
+  }
+  const items = [];
+  const isLimitReached = () => items.length >= maxItems;
+  const addItem = (item) => {
+    if (isLimitReached()) return;
+    if (filterReason && item.reviewReason !== filterReason) return;
+    items.push(item);
+  };
+  const suggestionsDir = path12.join(memoryDir, "suggestions");
+  if (!isLimitReached() && fs.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
+    walkMd(rootReal, suggestionsDir, (filePath, content) => {
+      if (isLimitReached()) return true;
+      const fm = parseFrontmatter2(content);
+      const body = extractBody(content);
+      if (!fm?.id) return false;
+      addItem({
+        id: fm.id,
+        content: body,
+        category: fm.category ?? "suggestion",
+        confidence: parseConfidence(fm.confidence, 0.5),
+        confidenceTier: fm.confidenceTier ?? "low",
+        source: fm.source ?? "unknown",
+        filePath,
+        created: fm.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+        reviewReason: "suggestion"
+      });
+      return isLimitReached();
+    });
+  }
+  const reviewDir = path12.join(memoryDir, "review");
+  if (!isLimitReached() && fs.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
+    walkMd(rootReal, reviewDir, (filePath, content) => {
+      if (isLimitReached()) return true;
+      const fm = parseFrontmatter2(content);
+      const body = extractBody(content);
+      if (!fm?.id) return false;
+      addItem({
+        id: fm.id,
+        content: body,
+        category: fm.category ?? "review",
+        confidence: parseConfidence(fm.confidence, 0.5),
+        confidenceTier: fm.confidenceTier ?? "low",
+        source: fm.source ?? "unknown",
+        filePath,
+        created: fm.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+        reviewReason: fm.reviewReason ?? "low_confidence",
+        context: fm.context
+      });
+      return isLimitReached();
+    });
+  }
+  const categories = ALL_CATEGORY_DIRS;
+  for (const category of categories) {
+    if (isLimitReached()) break;
+    const dir = path12.join(memoryDir, category);
+    if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    walkMd(rootReal, dir, (filePath, content) => {
+      if (isLimitReached()) return true;
+      const fm = parseFrontmatter2(content);
+      const body = extractBody(content);
+      if (!fm?.id) return false;
+      const confidence = parseConfidence(fm.confidence, 1);
+      if (confidence >= confidenceThreshold && !(typeof fm.blockedBy === "string" && fm.blockedBy.length > 0)) return false;
+      if (parseBoolean(fm.reviewDismissed)) return false;
+      if (items.some((i) => i.id === fm.id)) return false;
+      addItem({
+        id: fm.id,
+        content: body,
+        category: fm.category ?? category.slice(0, -1),
+        confidence,
+        confidenceTier: fm.confidenceTier ?? "low",
+        source: fm.source ?? "unknown",
+        filePath,
+        created: fm.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+        reviewReason: typeof fm.blockedBy === "string" && fm.blockedBy.length > 0 ? "tombstone_blocked" : "low_confidence"
+      });
+      return isLimitReached();
+    });
+  }
+  return {
+    items,
+    total: items.length,
+    durationMs: Date.now() - startTime
+  };
+}
+function performReview(memoryDir, itemId, action, options = {}) {
+  const result = action === "approve" ? approveItem(memoryDir, itemId, options) : action === "dismiss" ? dismissItem(memoryDir, itemId, options) : flagItem(memoryDir, itemId, options);
+  if (result.updatedPath !== void 0) bumpMemoryCorpusVersionForDir(memoryDir);
+  return result;
+}
+function approveItem(memoryDir, itemId, options) {
+  const rootReal = realMemoryRoot(memoryDir);
+  if (!rootReal) return { itemId, action: "approve", message: "Item not found" };
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "approve", message: "Item not found" };
+  }
+  const content = fs.readFileSync(found.filePath, "utf8");
+  const fm = parseFrontmatter2(content);
+  if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
+  const blockedBy = typeof fm.blockedBy === "string" ? fm.blockedBy : null;
+  const fireBlockedRevocation = () => {
+    if (!blockedBy || !options.onApproveBlockedMemory) return;
+    try {
+      const maybe = options.onApproveBlockedMemory(blockedBy, itemId);
+      if (maybe && typeof maybe.then === "function") {
+        void maybe.catch(() => void 0);
+      }
+    } catch {
+    }
+  };
+  const updatedContent = updateFrontmatterFields(content, {
+    confidence: "0.9",
+    confidenceTier: "high",
+    reviewDismissed: null,
+    // Clear the tombstone-block markers so the promoted memory is active.
+    // Clear the tombstone-block markers AND restore active status so the
+    // promoted memory is fully active in recall + provenance (issue #1579
+    // review: leaving status: pending_review kept it invisible to recall).
+    ...blockedBy ? { blockedBy: null, tombstoneBlockTier: null, status: "active" } : {}
+  });
+  if (found.location === "category") {
+    writeReviewFileCanonicalized(memoryDir, found.filePath, updatedContent);
+    fireBlockedRevocation();
+    return {
+      itemId,
+      action: "approve",
+      updatedPath: found.filePath,
+      message: "Approved low-confidence memory in place with confidence 0.9",
+      ...blockedBy ? { clearedTombstoneId: blockedBy } : {}
+    };
+  }
+  const category = fm.category ?? "fact";
+  const targetDir = getCategoryDir(memoryDir, category);
+  const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  ensureSafeDirectory(rootReal, targetDir);
+  const outputPath = path12.join(targetDir, dateDir, path12.basename(found.filePath));
+  ensureSafeDirectory(rootReal, path12.dirname(outputPath));
+  const reviewStateDir = path12.join(memoryDir, "state");
+  const idsAtWrite = historicalIdCache.get(reviewStateDir);
+  const promotedWritten = canonicalizeEntityRefFrontmatter(updatedContent, idsAtWrite);
+  const promotedPath = writeFileWithoutClobber(outputPath, promotedWritten, itemId);
+  try {
+    repairContentAfterJournalMoveSync({
+      stateDir: reviewStateDir,
+      cache: historicalIdCache,
+      idsAtWrite,
+      rawContent: updatedContent,
+      lastWritten: promotedWritten,
+      rewrite: (next) => fs.writeFileSync(promotedPath, next, "utf8")
+    });
+  } catch (err) {
+    try {
+      fs.unlinkSync(promotedPath);
+    } catch {
+    }
+    throw err;
+  }
+  fs.unlinkSync(found.filePath);
+  fireBlockedRevocation();
+  return {
+    itemId,
+    action: "approve",
+    updatedPath: promotedPath,
+    message: `Promoted to ${category} with confidence 0.9`,
+    ...blockedBy ? { clearedTombstoneId: blockedBy } : {}
+  };
+}
+function dismissItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "dismiss", message: "Item not found" };
+  }
+  if (found.location === "queue") {
+    fs.unlinkSync(found.filePath);
+    return { itemId, action: "dismiss", message: "Dismissed and removed" };
+  }
+  const content = fs.readFileSync(found.filePath, "utf8");
+  writeReviewFileCanonicalized(
+    memoryDir,
+    found.filePath,
+    updateFrontmatterFields(content, {
+      reviewDismissed: "true",
+      reviewDismissedAt: (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+  return {
+    itemId,
+    action: "dismiss",
+    updatedPath: found.filePath,
+    message: "Dismissed low-confidence memory in place"
+  };
+}
+function flagItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "flag", message: "Item not found" };
+  }
+  const content = fs.readFileSync(found.filePath, "utf8");
+  const fixed = updateFrontmatterFields(content, {
+    flagged: "true",
+    flaggedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  writeReviewFileCanonicalized(memoryDir, found.filePath, fixed);
+  return {
+    itemId,
+    action: "flag",
+    updatedPath: found.filePath,
+    message: "Flagged for further review"
+  };
+}
+function findReviewFileById(memoryDir, id, options = {}) {
+  const rootReal = realMemoryRoot(memoryDir);
+  if (!rootReal) return null;
+  for (const loc of ["suggestions", "review"]) {
+    const dir = path12.join(memoryDir, loc);
+    if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    const found = findFileById(rootReal, dir, id);
+    if (found) return { filePath: found, location: "queue" };
+  }
+  for (const category of ALL_CATEGORY_DIRS) {
+    const dir = path12.join(memoryDir, category);
+    if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    const found = findFileById(rootReal, dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
+    if (found) return { filePath: found, location: "category" };
+  }
+  return null;
+}
+function findFileById(rootReal, dir, id, include) {
+  const files = walkMdPaths(rootReal, dir);
+  for (const filePath of files) {
+    const content = readFileSafe(filePath);
+    if (!content) continue;
+    const fm = parseFrontmatter2(content);
+    if (fm?.id === id && (!include || include(fm))) return filePath;
+  }
+  return null;
+}
+function isLowConfidenceReviewCandidate(fm, options) {
+  const threshold = options.confidenceThreshold ?? DEFAULT_CONFIDENCE_THRESHOLD;
+  if (typeof fm.blockedBy === "string" && fm.blockedBy.length > 0) {
+    return !parseBoolean(fm.reviewDismissed);
+  }
+  return parseConfidence(fm.confidence, 1) < threshold && !parseBoolean(fm.reviewDismissed);
+}
+function parseBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "true" || normalized === "1" || normalized === "yes";
+}
+function parseConfidence(value, fallback) {
+  if (typeof value === "number") return Number.isFinite(value) ? value : fallback;
+  if (typeof value === "string") {
+    const n = parseFloat(value);
+    return Number.isFinite(n) ? n : fallback;
+  }
+  return fallback;
+}
+function updateFrontmatterFields(content, fields) {
+  const match = content.match(/^(---\n)([\s\S]*?)(\n---(?:\n|$))/);
+  if (!match) return content;
+  const seen = /* @__PURE__ */ new Set();
+  const lines = match[2].split("\n");
+  const nextLines = [];
+  for (const line of lines) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) {
+      nextLines.push(line);
+      continue;
+    }
+    const key = line.slice(0, colonIdx).trim();
+    if (!Object.prototype.hasOwnProperty.call(fields, key)) {
+      nextLines.push(line);
+      continue;
+    }
+    seen.add(key);
+    const value = fields[key];
+    if (value !== null) {
+      nextLines.push(`${key}: ${value}`);
+    }
+  }
+  for (const [key, value] of Object.entries(fields)) {
+    if (value !== null && !seen.has(key)) {
+      nextLines.push(`${key}: ${value}`);
+    }
+  }
+  return `${match[1]}${nextLines.join("\n")}${match[3]}${content.slice(match[0].length)}`;
+}
+function readFileSafe(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function writeFileWithoutClobber(basePath, content, discriminator) {
+  const parsed = path12.parse(basePath);
+  const safeDiscriminator = sanitizeFilePart(discriminator);
+  for (let attempt = 0; attempt < 1e3; attempt++) {
+    const candidate = attempt === 0 ? basePath : path12.join(
+      parsed.dir,
+      `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
+    );
+    try {
+      fs.writeFileSync(candidate, content, { encoding: "utf8", flag: "wx" });
+      return candidate;
+    } catch (error) {
+      if (error.code === "EEXIST") continue;
+      throw error;
+    }
+  }
+  throw new Error(`Could not find a free review promotion path for ${basePath}`);
+}
+function sanitizeFilePart(value) {
+  const chars = [];
+  let previousWasDash = false;
+  for (const char of value) {
+    const next = isSafeFilePartChar(char) ? char : "-";
+    if (next === "-" && previousWasDash) continue;
+    chars.push(next);
+    previousWasDash = next === "-";
+    if (chars.length >= 64) break;
+  }
+  let start = 0;
+  let end = chars.length;
+  while (start < end && chars[start] === "-") start++;
+  while (end > start && chars[end - 1] === "-") end--;
+  const sanitized = chars.slice(start, end).join("");
+  return sanitized || "review-item";
+}
+function isSafeFilePartChar(value) {
+  if (value.length !== 1) return false;
+  const code = value.charCodeAt(0);
+  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || value === "." || value === "_" || value === "-";
+}
+function parseFrontmatter2(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return null;
+  const fm = {};
+  for (const line of match[1].split("\n")) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    const key = line.slice(0, colonIdx).trim();
+    const value = line.slice(colonIdx + 1).trim();
+    fm[key] = value;
+  }
+  return fm;
+}
+function extractBody(content) {
+  const match = content.match(/^---\n[\s\S]*?\n---\n([\s\S]*)/);
+  return match ? match[1].trim() : content.trim();
+}
+function walkMd(rootReal, dir, callback) {
+  if (!isSafeDirectory(rootReal, dir)) return false;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path12.join(dir, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (walkMd(rootReal, fullPath, callback)) return true;
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      const content = readFileSafe(fullPath);
+      if (content && callback(fullPath, content) === true) return true;
+    }
+  }
+  return false;
+}
+function walkMdPaths(rootReal, dir) {
+  const results = [];
+  if (!isSafeDirectory(rootReal, dir)) return results;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path12.join(dir, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      results.push(...walkMdPaths(rootReal, fullPath));
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+// src/review/review-deck-snapshot.ts
+import fs2 from "fs";
+import path13 from "path";
+var QUEUE_DIRS = ["suggestions", "review"];
+function readReviewDeckSnapshot(opts) {
+  const corpusVersion = readCorpusVersion(opts.memoryDir);
+  const rootReal = realMemoryRoot2(opts.memoryDir);
+  if (!rootReal) return { corpusVersion, total: 0, rows: [] };
+  const rows = [];
+  for (const location of QUEUE_DIRS) {
+    const dir = path13.join(opts.memoryDir, location);
+    if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
+    walkMd2(rootReal, dir, (filePath, content) => {
+      const row = rowFromQueueFile(filePath, content, location);
+      if (row) rows.push(row);
+    });
+  }
+  return { corpusVersion, total: rows.length, rows };
+}
+function readReviewDeckRow(opts) {
+  const rootReal = realMemoryRoot2(opts.memoryDir);
+  if (!rootReal) return null;
+  for (const location of QUEUE_DIRS) {
+    const dir = path13.join(opts.memoryDir, location);
+    if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
+    let found = null;
+    walkMd2(rootReal, dir, (filePath, content) => {
+      const row = rowFromQueueFile(filePath, content, location);
+      if (row?.itemId === opts.itemId) {
+        found = row;
+        return true;
+      }
+    });
+    if (found) return found;
+  }
+  return null;
+}
+function readCorpusVersion(memoryDir) {
+  try {
+    return String(fs2.statSync(path13.join(memoryDir, "state", MEMORY_CORPUS_VERSION_SENTINEL)).size);
+  } catch {
+    return "0";
+  }
+}
+function rowFromQueueFile(filePath, content, location) {
+  const fm = parseFrontmatter3(content);
+  const itemId = optionalString(fm?.id);
+  if (!fm || !itemId || !isPendingQueueRow(fm)) return null;
+  const blockedBy = optionalString(fm.blockedBy);
+  const confidence = parseOptionalConfidence(fm.confidence);
+  const category = optionalString(fm.category);
+  const confidenceTier = optionalString(fm.confidenceTier);
+  const source = optionalString(fm.source);
+  const context = optionalString(fm.context);
+  const lifecycleState = optionalString(fm.lifecycleState) ?? optionalString(fm.status);
+  const created = optionalString(fm.created) ?? "";
+  const explicitReason = optionalString(fm.reviewReason);
+  return {
+    itemId,
+    filePath,
+    fileContent: content,
+    revision: computeReviewItemRevision(content),
+    content: extractBody2(content),
+    reviewReason: explicitReason ?? (blockedBy ? "tombstone_blocked" : location === "suggestions" ? "suggestion" : "low_confidence"),
+    created,
+    ...category ? { category } : {},
+    ...confidence !== void 0 ? { confidence } : {},
+    ...confidenceTier ? { confidenceTier } : {},
+    ...source ? { source } : {},
+    ...blockedBy ? { blockedBy } : {},
+    ...lifecycleState ? { lifecycleState } : {},
+    ...context ? { context } : {}
+  };
+}
+function isPendingQueueRow(fm) {
+  if (parseBoolean2(fm.reviewDismissed)) return false;
+  const status = optionalString(fm.status);
+  return status === void 0 || status === "pending_review";
+}
+function realMemoryRoot2(memoryDir) {
+  try {
+    const stat4 = fs2.lstatSync(memoryDir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return null;
+    return fs2.realpathSync(memoryDir);
+  } catch {
+    return null;
+  }
+}
+function isPathInside2(rootReal, candidateReal) {
+  const relative2 = path13.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path13.isAbsolute(relative2);
+}
+function isSafeDirectory2(rootReal, dir) {
+  try {
+    const stat4 = fs2.lstatSync(dir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return false;
+    return isPathInside2(rootReal, fs2.realpathSync(dir));
+  } catch {
+    return false;
+  }
+}
+function walkMd2(rootReal, dir, callback) {
+  if (!isSafeDirectory2(rootReal, dir)) return false;
+  for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path13.join(dir, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (walkMd2(rootReal, fullPath, callback)) return true;
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      const content = readFileSafe2(fullPath);
+      if (content && callback(fullPath, content) === true) return true;
+    }
+  }
+  return false;
+}
+function readFileSafe2(filePath) {
+  try {
+    return fs2.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function splitFrontmatter(content) {
+  if (!content.startsWith("---\n")) return null;
+  const end = content.indexOf("\n---", 4);
+  if (end === -1) return null;
+  const after = end + "\n---".length;
+  const body = content.startsWith("\n", after) ? content.slice(after + 1) : content.slice(after);
+  return { fields: content.slice(4, end), body };
+}
+function parseFrontmatter3(content) {
+  const split = splitFrontmatter(content);
+  if (!split) return null;
+  const fm = {};
+  for (const line of split.fields.split("\n")) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    fm[line.slice(0, colonIdx).trim()] = line.slice(colonIdx + 1).trim();
+  }
+  return fm;
+}
+function extractBody2(content) {
+  const split = splitFrontmatter(content);
+  return split ? split.body.trim() : content.trim();
+}
+function parseBoolean2(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "true" || normalized === "1" || normalized === "yes";
+}
+function optionalString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function parseOptionalConfidence(value) {
+  if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+  if (typeof value === "string" && value.trim().length > 0) {
+    const parsed = Number.parseFloat(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}
+
+// src/review/review-deck-mutation.ts
+var ACTOR = "admin-console.review-deck";
+var RULE_VERSION = "admin-console.review-deck.v1";
+var DECK_VERSIONING = {
+  enabled: true,
+  maxVersionsPerPage: 20,
+  sidecarDir: ".versions"
+};
+var KEEP_EFFECT = "Kept: this memory can now be recalled.";
+var NOT_TRUE_EFFECT = "Marked untrue: removed from the review queue.";
+var PLANNED_EFFECT = "Prepared a correction plan.";
+var PLAN_FAILED_EFFECT = "Could not prepare a correction plan.";
+var MISSING_EFFECT = "This review item is no longer available.";
+var CONFLICT_EFFECT = "This memory changed. Review it again.";
+var UNDO_EFFECT = "Undid the last review decision.";
+var UNDO_CONFLICT_EFFECT = "Another change happened first. Nothing was undone.";
+var UNDO_FAILED_EFFECT = "This action cannot be undone.";
+var ReviewDeckIdempotencyError = class extends Error {
+  name = "ReviewDeckIdempotencyError";
+  constructor(message = "Idempotency key was reused with a different review request.") {
+    super(message);
+  }
+};
+var ReviewDeckInputError = class extends Error {
+  name = "ReviewDeckInputError";
+  constructor(message) {
+    super(message);
+  }
+};
+var LEDGER_ACTION = {
+  keep: "approve",
+  not_true: "dismiss",
+  undo: "undo"
+};
+var EVENT_TYPE = {
+  keep: "promoted",
+  not_true: "rejected",
+  undo: "restored"
+};
+function sha256Hex(value) {
+  return createHash7("sha256").update(value, "utf8").digest("hex");
+}
+function computeReceiptId(namespace, principalDigest, idempotencyKey) {
+  return `rcp1:${sha256Hex(`${namespace}\0${principalDigest}\0${idempotencyKey}`)}`;
+}
+function computeRequestFingerprint(parts) {
+  return `rfp1:${sha256Hex(parts.join("\0"))}`;
+}
+function actionFingerprint(ctx, itemId, action, expectedRevision, correctionText) {
+  const parts = [ctx.principalDigest, ctx.namespace, itemId, action, expectedRevision];
+  if (correctionText !== void 0) parts.push(correctionText);
+  return computeRequestFingerprint(parts);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isReceiptAction(value) {
+  return value === "approve" || value === "dismiss" || value === "undo";
+}
+function parseReviewLifecycleReceipt(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  const rec = value;
+  if (rec.schemaVersion !== 1) return null;
+  if (!isNonEmptyString(rec.receiptId)) return null;
+  if (!isNonEmptyString(rec.requestFingerprint)) return null;
+  if (!isNonEmptyString(rec.principalDigest)) return null;
+  if (!isNonEmptyString(rec.itemId)) return null;
+  if (!isReceiptAction(rec.action)) return null;
+  if (typeof rec.beforeRevision !== "string") return null;
+  if (typeof rec.afterRevision !== "string") return null;
+  if (!isNonEmptyString(rec.sourcePath) || path14.isAbsolute(rec.sourcePath)) return null;
+  if (rec.revisionArtifact !== void 0 && typeof rec.revisionArtifact !== "string") return null;
+  if (rec.undoOfReceiptId !== void 0 && typeof rec.undoOfReceiptId !== "string") return null;
+  const parsed = {
+    schemaVersion: 1,
+    receiptId: rec.receiptId,
+    requestFingerprint: rec.requestFingerprint,
+    principalDigest: rec.principalDigest,
+    itemId: rec.itemId,
+    action: rec.action,
+    beforeRevision: rec.beforeRevision,
+    afterRevision: rec.afterRevision,
+    sourcePath: rec.sourcePath
+  };
+  if (typeof rec.revisionArtifact === "string") parsed.revisionArtifact = rec.revisionArtifact;
+  if (typeof rec.undoOfReceiptId === "string") parsed.undoOfReceiptId = rec.undoOfReceiptId;
+  return parsed;
+}
+function asStoredEvent(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function findStoredReceipt(events, receiptId) {
+  for (const raw of events) {
+    const event = asStoredEvent(raw);
+    if (!event) continue;
+    const receipt = parseReviewLifecycleReceipt(event.reviewReceipt);
+    if (receipt && receipt.receiptId === receiptId) return { event, receipt };
+  }
+  return null;
+}
+function resolveInside(memoryDir, rel) {
+  if (!rel || path14.isAbsolute(rel)) return null;
+  const root = path14.resolve(memoryDir);
+  const abs = path14.resolve(root, rel.split("/").join(path14.sep));
+  const next = path14.relative(root, abs);
+  if (next.startsWith("..") || path14.isAbsolute(next)) return null;
+  return abs;
+}
+function currentRevision(absPath) {
+  try {
+    return computeReviewItemRevision(fs3.readFileSync(absPath, "utf8"));
+  } catch {
+    return "";
+  }
+}
+function publicReceipt(input) {
+  return {
+    schemaVersion: 1,
+    receiptId: input.receiptId,
+    itemId: input.itemId,
+    action: input.action,
+    outcome: input.outcome,
+    effect: input.effect,
+    undoAvailable: input.undoAvailable,
+    ...input.appliedRevision !== void 0 ? { appliedRevision: input.appliedRevision } : {},
+    ...input.correctionPlanId !== void 0 ? { correctionPlanId: input.correctionPlanId } : {},
+    ...input.correctionPreview !== void 0 ? { correctionPreview: input.correctionPreview } : {}
+  };
+}
+async function snapshotForUndo(filePath, memoryDir) {
+  try {
+    const content = fs3.readFileSync(filePath, "utf8");
+    const version = await createVersion(
+      filePath,
+      content,
+      "manual",
+      DECK_VERSIONING,
+      void 0,
+      void 0,
+      memoryDir
+    );
+    return version.versionId;
+  } catch {
+    return void 0;
+  }
+}
+async function artifactReadable(filePath, versionId, memoryDir) {
+  try {
+    await getVersion(filePath, versionId, DECK_VERSIONING, memoryDir);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function undoTargetRevision(receipt, createdRel) {
+  const created = createdRel && createdRel !== receipt.sourcePath ? createdRel : void 0;
+  if (receipt.action === "approve" && created) return created;
+  return receipt.sourcePath;
+}
+async function honestUndoAvailable(ctx, receipt, createdRel) {
+  if (!receipt.revisionArtifact || receipt.action === "undo") return false;
+  const sourceAbs = resolveInside(ctx.memoryDir, receipt.sourcePath);
+  if (!sourceAbs) return false;
+  if (!await artifactReadable(sourceAbs, receipt.revisionArtifact, ctx.memoryDir)) return false;
+  const targetRel = undoTargetRevision(receipt, createdRel);
+  const targetAbs = resolveInside(ctx.memoryDir, targetRel);
+  if (!targetAbs) return false;
+  return currentRevision(targetAbs) === receipt.afterRevision;
+}
+async function replayReceipt(ctx, hit, action) {
+  const stored = hit.event.reviewDeckReceipt;
+  const undoAvailable = await honestUndoAvailable(ctx, hit.receipt, hit.event.reviewCreatedPath);
+  if (stored && stored.schemaVersion === 1 && stored.receiptId === hit.receipt.receiptId) {
+    return {
+      ...stored,
+      undoAvailable,
+      appliedRevision: stored.appliedRevision ?? hit.receipt.afterRevision
+    };
+  }
+  return publicReceipt({
+    receiptId: hit.receipt.receiptId,
+    itemId: hit.receipt.itemId,
+    action,
+    outcome: "applied",
+    effect: action === "keep" ? KEEP_EFFECT : action === "not_true" ? NOT_TRUE_EFFECT : UNDO_EFFECT,
+    undoAvailable,
+    appliedRevision: hit.receipt.afterRevision
+  });
+}
+function applyKeepOrNotTrueSync(input) {
+  let current;
+  try {
+    current = fs3.readFileSync(input.filePath, "utf8");
+  } catch {
+    return { kind: "failed" };
+  }
+  const currentRev = computeReviewItemRevision(current);
+  if (currentRev !== input.expectedRevision) {
+    return { kind: "conflict", current: currentRev };
+  }
+  const result = performReview(
+    input.memoryDir,
+    input.itemId,
+    input.action === "keep" ? "approve" : "dismiss",
+    { onApproveBlockedMemory: input.onApproveBlockedMemory }
+  );
+  if (result.message === "Item not found" || result.message === "Could not parse frontmatter") {
+    return { kind: "failed" };
+  }
+  if (result.updatedPath && fs3.existsSync(result.updatedPath)) {
+    return {
+      kind: "applied",
+      afterRevision: computeReviewItemRevision(fs3.readFileSync(result.updatedPath, "utf8")),
+      createdAbs: result.updatedPath
+    };
+  }
+  return { kind: "applied", afterRevision: "" };
+}
+async function appendAppliedEvent(ctx, input) {
+  const event = {
+    eventId: `mle-${randomUUID()}`,
+    memoryId: input.itemId,
+    eventType: EVENT_TYPE[input.action],
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    actor: ACTOR,
+    ruleVersion: RULE_VERSION,
+    reviewReceipt: input.receipt,
+    reviewNamespace: ctx.namespace,
+    reviewDeckReceipt: input.publicReceipt,
+    before: { path: input.receipt.sourcePath },
+    ...input.createdRel ? { after: { path: input.createdRel }, reviewCreatedPath: input.createdRel } : {},
+    ...input.undoOfReceiptId ? { relatedMemoryIds: [input.itemId] } : {}
+  };
+  await ctx.appendLifecycleEvents([event]);
+}
+async function executeReviewDeckAction(ctx, req) {
+  throwIfAborted(ctx.signal);
+  if (req.schemaVersion !== 1) throw new ReviewDeckInputError("schemaVersion must be 1");
+  if (!isNonEmptyString(req.itemId)) throw new ReviewDeckInputError("itemId is required");
+  if (!isNonEmptyString(req.revision)) throw new ReviewDeckInputError("revision is required");
+  if (!isNonEmptyString(req.idempotencyKey)) throw new ReviewDeckInputError("idempotencyKey is required");
+  const receiptId = computeReceiptId(ctx.namespace, ctx.principalDigest, req.idempotencyKey);
+  if (req.action === "prepare_fix") {
+    const correctionText = req.correctionText;
+    if (typeof correctionText !== "string" || correctionText.trim() === "") {
+      throw new ReviewDeckInputError("correctionText is required");
+    }
+    if (!ctx.planCorrection) {
+      return publicReceipt({
+        receiptId,
+        itemId: req.itemId,
+        action: "prepare_fix",
+        outcome: "failed",
+        effect: PLAN_FAILED_EFFECT,
+        undoAvailable: false
+      });
+    }
+    const planned = await ctx.planCorrection({ itemId: req.itemId, correctionText });
+    if (!planned.planId) {
+      return publicReceipt({
+        receiptId,
+        itemId: req.itemId,
+        action: "prepare_fix",
+        outcome: "failed",
+        effect: planned.message?.trim() || PLAN_FAILED_EFFECT,
+        undoAvailable: false
+      });
+    }
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: "prepare_fix",
+      outcome: "planned",
+      effect: PLANNED_EFFECT,
+      undoAvailable: false,
+      correctionPlanId: planned.planId,
+      correctionPreview: planned.preview
+    });
+  }
+  if (req.action !== "keep" && req.action !== "not_true") {
+    throw new ReviewDeckInputError("unsupported review deck action");
+  }
+  const fingerprint = actionFingerprint(ctx, req.itemId, req.action, req.revision);
+  const existing = findStoredReceipt(await ctx.readLifecycleEvents(), receiptId);
+  if (existing) {
+    if (existing.receipt.requestFingerprint !== fingerprint) throw new ReviewDeckIdempotencyError();
+    return replayReceipt(ctx, existing, req.action);
+  }
+  const row = readReviewDeckRow({ memoryDir: ctx.memoryDir, itemId: req.itemId });
+  if (!row) {
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: req.action,
+      outcome: "failed",
+      effect: MISSING_EFFECT,
+      undoAvailable: false
+    });
+  }
+  throwIfAborted(ctx.signal);
+  const revisionArtifact = await snapshotForUndo(row.filePath, ctx.memoryDir);
+  throwIfAborted(ctx.signal);
+  const applied = applyKeepOrNotTrueSync({
+    memoryDir: ctx.memoryDir,
+    itemId: req.itemId,
+    filePath: row.filePath,
+    expectedRevision: req.revision,
+    action: req.action,
+    onApproveBlockedMemory: ctx.onApproveBlockedMemory
+  });
+  if (applied.kind === "conflict") {
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: req.action,
+      outcome: "conflict",
+      effect: CONFLICT_EFFECT,
+      undoAvailable: false,
+      appliedRevision: applied.current
+    });
+  }
+  if (applied.kind === "failed") {
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: req.action,
+      outcome: "failed",
+      effect: MISSING_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const sourcePath = toMemoryPathRel(ctx.memoryDir, row.filePath);
+  const createdRel = applied.createdAbs ? toMemoryPathRel(ctx.memoryDir, applied.createdAbs) : void 0;
+  const ledgerReceipt = {
+    schemaVersion: 1,
+    receiptId,
+    requestFingerprint: fingerprint,
+    principalDigest: ctx.principalDigest,
+    itemId: req.itemId,
+    action: LEDGER_ACTION[req.action],
+    beforeRevision: req.revision,
+    afterRevision: applied.afterRevision,
+    sourcePath,
+    ...revisionArtifact ? { revisionArtifact } : {}
+  };
+  const undoAvailable = Boolean(revisionArtifact);
+  const published = publicReceipt({
+    receiptId,
+    itemId: req.itemId,
+    action: req.action,
+    outcome: "applied",
+    effect: req.action === "keep" ? KEEP_EFFECT : NOT_TRUE_EFFECT,
+    undoAvailable,
+    appliedRevision: applied.afterRevision
+  });
+  await appendAppliedEvent(ctx, {
+    itemId: req.itemId,
+    action: req.action,
+    receipt: ledgerReceipt,
+    createdRel,
+    publicReceipt: published
+  });
+  return published;
+}
+async function executeReviewDeckUndo(ctx, req) {
+  throwIfAborted(ctx.signal);
+  if (req.schemaVersion !== 1) throw new ReviewDeckInputError("schemaVersion must be 1");
+  if (!isNonEmptyString(req.receiptId)) throw new ReviewDeckInputError("receiptId is required");
+  if (typeof req.expectedRevision !== "string") throw new ReviewDeckInputError("expectedRevision is required");
+  if (!isNonEmptyString(req.idempotencyKey)) throw new ReviewDeckInputError("idempotencyKey is required");
+  const undoReceiptId = computeReceiptId(ctx.namespace, ctx.principalDigest, req.idempotencyKey);
+  const events = await ctx.readLifecycleEvents();
+  const original = findStoredReceipt(events, req.receiptId);
+  if (!original) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: "",
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const scopeOk = original.receipt.principalDigest === ctx.principalDigest && original.event.reviewNamespace === ctx.namespace;
+  if (!scopeOk) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: "",
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const fingerprint = actionFingerprint(
+    ctx,
+    original.receipt.itemId,
+    "undo",
+    req.expectedRevision
+  );
+  const priorUndo = findStoredReceipt(events, undoReceiptId);
+  if (priorUndo) {
+    if (priorUndo.receipt.requestFingerprint !== fingerprint) throw new ReviewDeckIdempotencyError();
+    return replayReceipt(ctx, priorUndo, "undo");
+  }
+  if (req.expectedRevision !== original.receipt.afterRevision) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "conflict",
+      effect: UNDO_CONFLICT_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const createdRel = original.event.reviewCreatedPath;
+  const targetRel = undoTargetRevision(original.receipt, createdRel);
+  const targetAbs = resolveInside(ctx.memoryDir, targetRel);
+  const sourceAbs = resolveInside(ctx.memoryDir, original.receipt.sourcePath);
+  if (!targetAbs || !sourceAbs) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  if (currentRevision(targetAbs) !== original.receipt.afterRevision) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "conflict",
+      effect: UNDO_CONFLICT_EFFECT,
+      undoAvailable: false,
+      appliedRevision: currentRevision(targetAbs)
+    });
+  }
+  if (!original.receipt.revisionArtifact) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  throwIfAborted(ctx.signal);
+  try {
+    await revertToVersion(
+      sourceAbs,
+      original.receipt.revisionArtifact,
+      DECK_VERSIONING,
+      void 0,
+      ctx.memoryDir
+    );
+  } catch {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  if (createdRel && createdRel !== original.receipt.sourcePath) {
+    const createdAbs = resolveInside(ctx.memoryDir, createdRel);
+    if (createdAbs && createdAbs !== sourceAbs && fs3.existsSync(createdAbs)) {
+      fs3.unlinkSync(createdAbs);
+    }
+  }
+  bumpMemoryCorpusVersionForDir(ctx.memoryDir);
+  const afterRevision = currentRevision(sourceAbs);
+  const ledgerReceipt = {
+    schemaVersion: 1,
+    receiptId: undoReceiptId,
+    requestFingerprint: fingerprint,
+    principalDigest: ctx.principalDigest,
+    itemId: original.receipt.itemId,
+    action: "undo",
+    beforeRevision: original.receipt.afterRevision,
+    afterRevision,
+    sourcePath: original.receipt.sourcePath,
+    undoOfReceiptId: original.receipt.receiptId
+  };
+  const published = publicReceipt({
+    receiptId: undoReceiptId,
+    itemId: original.receipt.itemId,
+    action: "undo",
+    outcome: "applied",
+    effect: UNDO_EFFECT,
+    undoAvailable: false,
+    appliedRevision: afterRevision
+  });
+  await appendAppliedEvent(ctx, {
+    itemId: original.receipt.itemId,
+    action: "undo",
+    receipt: ledgerReceipt,
+    publicReceipt: published,
+    undoOfReceiptId: original.receipt.receiptId
+  });
+  return published;
+}
+
+// src/review/review-deck-surface.ts
+function digest(value) {
+  return createHash8("sha256").update(value).digest("hex");
+}
+var ReviewDeckSurface = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async list(opts) {
+    const namespace = this.deps.resolveReadableNamespace(opts.namespace, opts.principal);
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    const snapshot = readReviewDeckSnapshot({ memoryDir: storage.dir, namespace });
+    try {
+      return buildReviewDeckPage(snapshot.rows, {
+        scope: {
+          principalDigest: digest(opts.principal ?? ""),
+          namespace,
+          filterDigest: digest(""),
+          corpusVersion: snapshot.corpusVersion
+        },
+        cursor: opts.cursor,
+        limit: opts.limit
+      });
+    } catch (error) {
+      if (error instanceof ReviewDeckCursorError) {
+        throw new EngramAccessInputError(error.message);
+      }
+      throw error;
+    }
+  }
+  async action(req, opts) {
+    return executeReviewDeckAction(await this.mutationContext(opts), req);
+  }
+  async undo(req, opts) {
+    return executeReviewDeckUndo(await this.mutationContext(opts), req);
+  }
+  async mutationContext(opts) {
+    const namespace = this.deps.writableNamespaceFor(opts.namespace, void 0, opts.principal);
+    this.deps.resolveReadableNamespace(namespace, opts.principal);
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    return {
+      memoryDir: storage.dir,
+      namespace,
+      principalDigest: digest(opts.principal ?? ""),
+      appendLifecycleEvents: async (events) => {
+        await storage.appendMemoryLifecycleEvents(events);
+      },
+      readLifecycleEvents: (memoryId) => memoryId ? storage.getMemoryTimeline(memoryId) : storage.readMemoryLifecycleEvents(),
+      onApproveBlockedMemory: (tombstoneId) => {
+        void storage.revokeTombstone(tombstoneId, "user_correction").catch(() => void 0);
+      },
+      planCorrection: async ({ itemId, correctionText }) => {
+        const plan = await this.deps.correctionPlan(
+          {
+            text: correctionText,
+            targetIds: [itemId],
+            principal: opts.principal,
+            namespace
+          },
+          opts.signal ? { abortSignal: opts.signal } : void 0
+        );
+        return { planId: plan.planId, preview: plan };
+      },
+      signal: opts.signal
+    };
+  }
+};
+
+// src/support-passport/card-service.ts
+import { randomUUID as randomUUID3 } from "crypto";
+
+// src/support-passport/errors.ts
+var SupportPassportError = class extends Error {
+  code;
+  status;
+  constructor(code, message, status) {
+    super(message);
+    this.name = "SupportPassportError";
+    this.code = code;
+    this.status = status;
+  }
+};
+
+// src/support-passport/card-state.ts
+function invalidInput() {
+  return new SupportPassportError("invalid_input", "The support card request is invalid.", 400);
+}
+function isStorageConflict(error) {
+  return error instanceof SupportPassportError && error.code === "storage_conflict";
+}
+function once(callback) {
+  let called = false;
+  return () => {
+    if (called) return;
+    called = true;
+    callback?.();
+  };
+}
+function validateOwnerScope(owner, principal) {
+  const requestedPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal });
+  const namespace = SupportPassportNamespaceSchema.safeParse(owner.namespace);
+  const ownerPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal: owner.principal });
+  if (!requestedPrincipal.success || !namespace.success || !ownerPrincipal.success || ownerPrincipal.data.principal !== requestedPrincipal.data.principal) {
+    throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
+  }
+  return { ...owner, principal: ownerPrincipal.data.principal, namespace: namespace.data };
+}
+var MAX_OWNER_VISIBLE_CARDS = 100;
+var OWNER_VISIBLE_STATUSES = /* @__PURE__ */ new Set(["pending_review", "active"]);
+function revisionFor(card, status, updatedAt) {
+  return computeSupportPassportCardRevision({
+    cardId: card.cardId,
+    title: card.title,
+    statement: card.statement,
+    category: card.category,
+    status,
+    updatedAt,
+    reviewBy: card.reviewBy
+  });
+}
+function projectRequiredCard(memory, namespace, principal) {
+  const card = projectSupportPassportCard(memory);
+  if (!card) throw new SupportPassportError("card_data_invalid", "The support card data is invalid.", 500);
+  if (card.namespace !== namespace || card.owner !== computeSupportPassportOwnerKey(principal)) {
+    throw new SupportPassportError("card_not_found", "The support card was not found.", 404);
+  }
+  return card;
+}
+function projectOwnedCard(memory, namespace, principal) {
+  const card = projectSupportPassportCard(memory);
+  return card?.namespace === namespace && card.owner === computeSupportPassportOwnerKey(principal) ? card : null;
+}
+function ownsMemory(memory, namespace, principal) {
+  const attributes = memory.frontmatter.structuredAttributes;
+  return attributes !== void 0 && decodeSupportPassportNamespaceAttributes(attributes) === namespace && attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.owner] === computeSupportPassportOwnerKey(principal);
+}
+function requireRevision(card, expectedRevision) {
+  if (card.card.revision !== expectedRevision) {
+    throw new SupportPassportError("revision_conflict", "The support card changed after it was loaded.", 409);
+  }
+}
+function requireStatus(card, status) {
+  if (card.card.status !== status) {
+    throw new SupportPassportError("invalid_card_status", `The support card must have status ${status}.`, 409);
+  }
+}
+function ownerVisibleCards(storedCards) {
+  const visibleCards = storedCards.filter(
+    (item) => OWNER_VISIBLE_STATUSES.has(item.card.status) && !item.draftReplacementPrepared
+  );
+  if (visibleCards.length <= MAX_OWNER_VISIBLE_CARDS) return visibleCards;
+  const cardsWithPendingReplacements = new Set(
+    visibleCards.filter((item) => item.card.status === "pending_review").map((item) => item.memory.frontmatter.supersedes).filter((cardId) => typeof cardId === "string")
+  );
+  return visibleCards.filter(
+    (item) => item.card.status !== "active" || !cardsWithPendingReplacements.has(item.card.cardId)
+  );
+}
+function ownerListCards(storedCards) {
+  const visibleCards = ownerVisibleCards(storedCards);
+  const byId = new Map(storedCards.map((item) => [item.card.cardId, item]));
+  const activeReplacementPredecessors = activeSupportPassportReplacementPredecessorIds(visibleCards);
+  const replacedDraftIds = new Set(
+    visibleCards.filter(
       (item) => item.card.status === "pending_review" && item.replacesDraftId !== void 0 && byId.get(item.replacesDraftId)?.card.status === "pending_review"
     ).map((item) => item.replacesDraftId)
   );
@@ -10180,14 +11951,14 @@ async function completeSupportPassportReplacementPrior(input) {
 }
 
 // src/support-passport/generated-batch.ts
-import path12 from "path";
+import path16 from "path";
 import { z as z2 } from "zod";
 
 // src/support-passport/private-file.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { constants as fsConstants } from "fs";
 import { lstat as lstat3, mkdir as mkdir3, open, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
-import path11 from "path";
+import path15 from "path";
 var UNSUPPORTED_DIRECTORY_SYNC_ERRORS = /* @__PURE__ */ new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
 var NON_WRITABLE_ANCESTOR_SYNC_ERRORS = /* @__PURE__ */ new Set(["EROFS", "EPERM", "EACCES"]);
 function assertStableDirectory(before, opened, after, errorMessage) {
@@ -10213,8 +11984,8 @@ function openFlags(...flags) {
   return combined;
 }
 function assertContainedPath(trustedRoot, directory, errorMessage) {
-  const relative2 = path11.relative(path11.resolve(trustedRoot), path11.resolve(directory));
-  if (relative2 === ".." || relative2.startsWith(`..${path11.sep}`) || path11.isAbsolute(relative2)) {
+  const relative2 = path15.relative(path15.resolve(trustedRoot), path15.resolve(directory));
+  if (relative2 === ".." || relative2.startsWith(`..${path15.sep}`) || path15.isAbsolute(relative2)) {
     throw new Error(errorMessage);
   }
 }
@@ -10247,7 +12018,7 @@ async function syncDirectoryHandle(handle) {
 }
 async function resolvePrivateDirectoryPath(directory, handle, opened, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const pinnedPath = path11.join(descriptorRoot, String(handle.fd));
+  const pinnedPath = path15.join(descriptorRoot, String(handle.fd));
   const metadata = await stat2(pinnedPath);
   if (!metadata.isDirectory() || metadata.dev !== opened.dev || metadata.ino !== opened.ino) {
     throw new Error(errorMessage);
@@ -10263,12 +12034,12 @@ function requirePrivateFileDescriptorRoot(platform, errorMessage) {
   throw new Error(errorMessage);
 }
 async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform = process.platform) {
-  const root = path11.resolve(trustedRoot);
-  const target = path11.resolve(directory);
+  const root = path15.resolve(trustedRoot);
+  const target = path15.resolve(directory);
   assertContainedPath(root, target, errorMessage);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const relative2 = path11.relative(root, target);
-  const components = relative2 === "" ? [] : relative2.split(path11.sep);
+  const relative2 = path15.relative(root, target);
+  const components = relative2 === "" ? [] : relative2.split(path15.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -10276,10 +12047,10 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const child = await openDirectoryNoFollow(path11.join(pinnedParent, component), errorMessage);
+      const child = await openDirectoryNoFollow(path15.join(pinnedParent, component), errorMessage);
       handles.push(child.handle);
       assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
-      currentPath = path11.join(currentPath, component);
+      currentPath = path15.join(currentPath, component);
       current = child;
     }
     assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
@@ -10300,12 +12071,12 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
   }
 }
 async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, hardenExistingChildren = true, platform = process.platform) {
-  const root = path11.resolve(trustedRoot);
-  const target = path11.resolve(directory);
+  const root = path15.resolve(trustedRoot);
+  const target = path15.resolve(directory);
   assertContainedPath(root, target, errorMessage);
-  const relative2 = path11.relative(root, target);
+  const relative2 = path15.relative(root, target);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const components = relative2 === "" ? [] : relative2.split(path11.sep);
+  const components = relative2 === "" ? [] : relative2.split(path15.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -10313,7 +12084,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const childPath = path11.join(pinnedParent, component);
+      const childPath = path15.join(pinnedParent, component);
       let created = false;
       try {
         await mkdir3(childPath, { mode: 448 });
@@ -10328,7 +12099,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
         await child.handle.chmod(448);
       }
       assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
-      currentPath = path11.join(currentPath, component);
+      currentPath = path15.join(currentPath, component);
       current = child;
     }
     assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
@@ -10337,8 +12108,8 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
   }
 }
 async function ensurePrivateDirectoryTreeNoFollow(directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, platform = process.platform) {
-  const target = path11.resolve(directory);
-  const filesystemRoot = path11.parse(target).root;
+  const target = path15.resolve(directory);
+  const filesystemRoot = path15.parse(target).root;
   const rootMetadata = await stat2(filesystemRoot);
   await ensurePrivateDirectoryNoFollow(
     filesystemRoot,
@@ -10373,15 +12144,15 @@ async function withPrivateDirectoryNoFollow(trustedRoot, directory, errorMessage
   }
 }
 async function readPrivateFileNoFollow(directory, filePath, errorMessage, trustedRoot = directory, platform = process.platform) {
-  if (path11.dirname(filePath) !== path11.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path11.basename(filePath);
+  if (path15.dirname(filePath) !== path15.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path15.basename(filePath);
   let directoryHandles = [];
   let fileHandle;
   try {
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    const targetPath = path11.join(pinnedDirectory, targetName);
+    const targetPath = path15.join(pinnedDirectory, targetName);
     const before = await lstat3(targetPath);
     if (before.isSymbolicLink() || !before.isFile()) throw new Error(errorMessage);
     try {
@@ -10400,10 +12171,10 @@ async function readPrivateFileNoFollow(directory, filePath, errorMessage, truste
   }
 }
 async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, content, errorMessage, directoryHandle, openFile) {
-  if (targetName.length === 0 || targetName === "." || targetName === ".." || path11.basename(targetName) !== targetName) {
+  if (targetName.length === 0 || targetName === "." || targetName === ".." || path15.basename(targetName) !== targetName) {
     throw new Error(errorMessage);
   }
-  const targetPath = path11.join(pinnedDirectory, targetName);
+  const targetPath = path15.join(pinnedDirectory, targetName);
   let fileHandle;
   try {
     try {
@@ -10439,8 +12210,8 @@ async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, c
 }
 async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, content, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const resolvedDirectory = path11.resolve(pinnedDirectory);
-  const descriptor = path11.relative(descriptorRoot, resolvedDirectory);
+  const resolvedDirectory = path15.resolve(pinnedDirectory);
+  const descriptor = path15.relative(descriptorRoot, resolvedDirectory);
   if (!/^\d+$/.test(descriptor)) throw new Error(errorMessage);
   const before = await stat2(resolvedDirectory);
   if (!before.isDirectory()) throw new Error(errorMessage);
@@ -10456,9 +12227,9 @@ async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, con
   }
 }
 async function writePrivateFileAtomicallyNoFollow(directory, filePath, content, errorMessage, trustedRoot = directory, platform = process.platform, syncVerifiedDirectory = syncDirectoryHandle) {
-  if (path11.dirname(filePath) !== path11.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path11.basename(filePath);
-  const tempName = `.${targetName}.${randomUUID()}.tmp`;
+  if (path15.dirname(filePath) !== path15.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path15.basename(filePath);
+  const tempName = `.${targetName}.${randomUUID2()}.tmp`;
   let tempPath;
   let directoryHandles = [];
   let fileHandle;
@@ -10466,8 +12237,8 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    tempPath = path11.join(pinnedDirectory, tempName);
-    const targetPath = path11.join(pinnedDirectory, targetName);
+    tempPath = path15.join(pinnedDirectory, tempName);
+    const targetPath = path15.join(pinnedDirectory, targetName);
     try {
       fileHandle = await open(
         tempPath,
@@ -10504,7 +12275,7 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
 }
 async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, trustedRoot = directory, platform = process.platform) {
   if (fileNames.some(
-    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path11.basename(fileName) !== fileName
+    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path15.basename(fileName) !== fileName
   )) {
     throw new Error(errorMessage);
   }
@@ -10514,7 +12285,7 @@ async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, tr
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
     for (const fileName of fileNames) {
-      await rm2(path11.join(pinnedDirectory, fileName), { force: true });
+      await rm2(path15.join(pinnedDirectory, fileName), { force: true });
     }
     assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
     if (stableDirectory.handle) await syncDirectoryHandle(stableDirectory.handle);
@@ -10535,13 +12306,13 @@ var GeneratedBatchMarkerSchema = z2.object({
 }).strict();
 var BATCH_ERROR = "The generated draft batch state is not safe.";
 function batchDirectory(storage) {
-  return path12.join(storage.dir, "state", "support-passport", "generated-batches");
+  return path16.join(storage.dir, "state", "support-passport", "generated-batches");
 }
 function batchFileName(batchId) {
   return `${BatchIdSchema.parse(batchId)}.json`;
 }
 function batchPath(storage, batchId) {
-  return path12.join(batchDirectory(storage), batchFileName(batchId));
+  return path16.join(batchDirectory(storage), batchFileName(batchId));
 }
 function markerFor(context, batchId, size, complete) {
   return GeneratedBatchMarkerSchema.parse({
@@ -10965,19 +12736,19 @@ var SupportPassportAnswerModelInputSchema = z4.object({
 }).strict();
 
 // src/support-passport/owner-lock.ts
-import { createHash as createHash6 } from "crypto";
-import path13 from "path";
+import { createHash as createHash9 } from "crypto";
+import path17 from "path";
 var CARD_MUTATION_LOCK_STALE_MS = 6e4;
 var CARD_MUTATION_LOCK_MAX_WAIT_MS = 3e4;
 function computeSupportPassportOwnerLockKey(namespace, principal) {
-  return createHash6("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
+  return createHash9("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
 }
 function supportPassportOwnerLockPath(storage, scope) {
   const ownerLockKey = scope.ownerKey ?? computeSupportPassportOwnerLockKey(scope.namespace, scope.principal);
   if (!/^[a-f0-9]{64}$/.test(ownerLockKey)) {
     throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
   }
-  return path13.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
+  return path17.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
 }
 async function withSupportPassportOwnerLock(storage, scope, task) {
   const lockPath = supportPassportOwnerLockPath(storage, scope);
@@ -11085,7 +12856,7 @@ var SupportPassportCardService = class {
     const onCommitted = once(input.onCommitted);
     return await withSupportPassportOwnerLock(storage, { namespace, principal }, async (lock) => {
       const batchContext = this.generatedBatchContext(storage, lock, principal, namespace, onCommitted);
-      const batchId = randomUUID2();
+      const batchId = randomUUID3();
       const created = [];
       const createdIds = [];
       const createdRecords = [];
@@ -11873,9 +13644,9 @@ var SupportPassportCardService = class {
 };
 
 // src/support-passport/grant-store.ts
-import { createHash as createHash7, randomBytes, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+import { createHash as createHash10, randomBytes, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
 import { lstat as lstat4, open as open2, readdir as readdir4 } from "fs/promises";
-import path14 from "path";
+import path18 from "path";
 var GRANT_LOCK_STALE_MS = 3e4;
 var GRANT_LOCK_WAIT_MS = 5e3;
 var GRANT_LOCK_HEARTBEAT_MS = 1e4;
@@ -11898,7 +13669,7 @@ var MalformedGrantStateError = class extends Error {
   }
 };
 function sha256(domain, value) {
-  return createHash7("sha256").update(domain).update("\0").update(value).digest("hex");
+  return createHash10("sha256").update(domain).update("\0").update(value).digest("hex");
 }
 function hashesMatch(left, right) {
   const leftBytes = Buffer.from(left, "hex");
@@ -11967,12 +13738,12 @@ var SupportPassportGrantStore = class {
   runWithHeldFileLock;
   syncDirectory;
   constructor(options) {
-    this.memoryDir = path14.resolve(expandTildePath(options.memoryDir));
-    this.grantsDir = path14.join(this.memoryDir, "state", "support-passport", "grants");
-    this.ownerIndexesDir = path14.join(this.grantsDir, "owners");
+    this.memoryDir = path18.resolve(expandTildePath(options.memoryDir));
+    this.grantsDir = path18.join(this.memoryDir, "state", "support-passport", "grants");
+    this.ownerIndexesDir = path18.join(this.grantsDir, "owners");
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.makeSecret = options.makeSecret ?? (() => randomBytes(32));
-    this.makeGrantId = options.makeGrantId ?? randomUUID3;
+    this.makeGrantId = options.makeGrantId ?? randomUUID4;
     this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
     this.syncDirectory = options.syncDirectory ?? syncDirectoryForDurability;
   }
@@ -12182,11 +13953,11 @@ var SupportPassportGrantStore = class {
   }
   filePath(grantId) {
     const normalizedGrantId = normalizeGrantId(grantId);
-    return path14.join(this.grantsDir, `${normalizedGrantId}.json`);
+    return path18.join(this.grantsDir, `${normalizedGrantId}.json`);
   }
   ownerIndexPath(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path14.join(this.ownerIndexesDir, `${ownerHash}.json`);
+    return path18.join(this.ownerIndexesDir, `${ownerHash}.json`);
   }
   ownerHash(namespace, principalHash) {
     return sha256("support-passport-owner-index:v1", `${namespace}\0${principalHash}`);
@@ -12242,12 +14013,12 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       grantIds.map((grantId) => `${grantId}.json`),
       "support passport grant files must be regular files in a stable directory",
-      path14.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   ownerMembershipDirectory(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path14.join(this.ownerIndexesDir, ownerHash);
+    return path18.join(this.ownerIndexesDir, ownerHash);
   }
   async ensureOwnerMembershipDirectory(ownerHash) {
     const directory = this.ownerMembershipDirectory(ownerHash);
@@ -12262,11 +14033,11 @@ var SupportPassportGrantStore = class {
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     await writePrivateFileAtomicallyNoFollow(
       directory,
-      path14.join(directory, `${state.grantId}.json`),
+      path18.join(directory, `${state.grantId}.json`),
       `${JSON.stringify({ schemaVersion: 1, grantId: state.grantId })}
 `,
       "support passport owner membership must be regular files in a stable directory",
-      path14.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async removeOwnerMembership(state) {
@@ -12276,7 +14047,7 @@ var SupportPassportGrantStore = class {
       directory,
       [`${state.grantId}.json`],
       "support passport owner membership must be regular files in a stable directory",
-      path14.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async removeStoredGrant(state) {
@@ -12377,7 +14148,7 @@ var SupportPassportGrantStore = class {
     const ownerHash = this.ownerHash(namespace, principalHash);
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     const grantIds = await withPrivateDirectoryNoFollow(
-      path14.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       directory,
       "support passport owner membership must be regular files in a stable directory",
       async (pinnedDirectory) => {
@@ -12408,7 +14179,7 @@ var SupportPassportGrantStore = class {
         this.ownerIndexesDir,
         filePath,
         "support passport owner indexes must be regular files in a stable directory",
-        path14.parse(this.memoryDir).root
+        path18.parse(this.memoryDir).root
       );
     } catch (error) {
       if (error.code === "ENOENT") return [];
@@ -12448,7 +14219,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify({ schemaVersion: 1, ownerHash, grantIds }, null, 2)}
 `,
       "support passport owner indexes must be regular files in a stable directory",
-      path14.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async readState(grantId) {
@@ -12458,7 +14229,7 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       filePath,
       "support passport grant files must be regular files in a stable directory",
-      path14.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
     try {
       const state = SupportPassportGrantStateSchema.parse(JSON.parse(content));
@@ -12492,7 +14263,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify(state, null, 2)}
 `,
       "support passport grant files must be regular files in a stable directory",
-      path14.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async ensureSafeDirectories() {
@@ -12526,8 +14297,8 @@ var SupportPassportGrantStore = class {
           void 0
         );
         this.memoryDir = configuredMemoryDir;
-        this.grantsDir = path14.join(configuredMemoryDir, "state", "support-passport", "grants");
-        this.ownerIndexesDir = path14.join(this.grantsDir, "owners");
+        this.grantsDir = path18.join(configuredMemoryDir, "state", "support-passport", "grants");
+        this.ownerIndexesDir = path18.join(this.grantsDir, "owners");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -12541,12 +14312,12 @@ var SupportPassportGrantStore = class {
   async withMutationLock(task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path14.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grants:${this.grantsDir}`,
-        path14.join(pinnedDirectory, ".grants.lock"),
+        path18.join(pinnedDirectory, ".grants.lock"),
         task
       )
     );
@@ -12555,12 +14326,12 @@ var SupportPassportGrantStore = class {
     const normalizedGrantId = normalizeGrantId(grantId);
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path14.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grant:${this.grantsDir}:${normalizedGrantId}`,
-        path14.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
+        path18.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
         task
       )
     );
@@ -12568,12 +14339,12 @@ var SupportPassportGrantStore = class {
   async withOwnerIndexLock(ownerHash, task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path14.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       this.ownerIndexesDir,
       "support passport owner lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-owner:${this.ownerIndexesDir}:${ownerHash}`,
-        path14.join(pinnedDirectory, `.${ownerHash}.lock`),
+        path18.join(pinnedDirectory, `.${ownerHash}.lock`),
         task
       )
     );
@@ -13410,8 +15181,8 @@ var SupportPassportModelAdapter = class {
 };
 
 // src/support-passport/model-audit.ts
-import { createHash as createHash8 } from "crypto";
-import path15 from "path";
+import { createHash as createHash11 } from "crypto";
+import path19 from "path";
 import { z as z5 } from "zod";
 var HashSchema = z5.string().regex(/^[a-f0-9]{64}$/);
 var SupportPassportModelAuditRecordSchema = z5.object({
@@ -13448,7 +15219,7 @@ var SupportPassportModelAuditRecordSchema = z5.object({
   }
 });
 function hashSupportPassportAuditValues(domain, values) {
-  return createHash8("sha256").update(`support-passport-audit:${domain}:v1`).update("\0").update([...values].sort().join("\0")).digest("hex");
+  return createHash11("sha256").update(`support-passport-audit:${domain}:v1`).update("\0").update([...values].sort().join("\0")).digest("hex");
 }
 var SupportPassportModelAuditStore = class {
   memoryDir;
@@ -13456,15 +15227,15 @@ var SupportPassportModelAuditStore = class {
   memoryRootReady;
   runWithHeldFileLock;
   constructor(options) {
-    this.memoryDir = path15.resolve(expandTildePath(options.memoryDir));
-    this.auditDir = path15.join(this.memoryDir, "state", "support-passport", "audit");
+    this.memoryDir = path19.resolve(expandTildePath(options.memoryDir));
+    this.auditDir = path19.join(this.memoryDir, "state", "support-passport", "audit");
     this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
   }
   async record(input) {
     const record = SupportPassportModelAuditRecordSchema.parse(input);
     await this.ensureSafeDirectories();
     const day = record.occurredAt.slice(0, 10);
-    const filePath = path15.join(this.auditDir, `${day}.jsonl`);
+    const filePath = path19.join(this.auditDir, `${day}.jsonl`);
     await serializeMutations(
       `support-passport-audit:${filePath}`,
       () => withPrivateDirectoryNoFollow(
@@ -13472,7 +15243,7 @@ var SupportPassportModelAuditStore = class {
         this.auditDir,
         "support passport audit directory must remain inside the memory directory",
         async (pinnedDirectory) => await this.runWithHeldFileLock(
-          path15.join(pinnedDirectory, `.${day}.lock`),
+          path19.join(pinnedDirectory, `.${day}.lock`),
           {
             staleMs: 3e4,
             maxWaitMs: 5e3,
@@ -13509,7 +15280,7 @@ var SupportPassportModelAuditStore = class {
           "support passport memory directory must be a stable directory"
         );
         this.memoryDir = configuredMemoryDir;
-        this.auditDir = path15.join(configuredMemoryDir, "state", "support-passport", "audit");
+        this.auditDir = path19.join(configuredMemoryDir, "state", "support-passport", "audit");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -13523,7 +15294,7 @@ var SupportPassportModelAuditStore = class {
 };
 
 // src/support-passport/model-service.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { z as z6 } from "zod";
 var DraftServiceInputSchema = z6.object({
   principal: z6.string().trim().min(1).max(512),
@@ -13559,7 +15330,7 @@ function supportPassportSourceContent(memory) {
   return hasStructuredAttributes(memory.frontmatter.structuredAttributes) ? stripAttributesSuffix(memory.content) : memory.content;
 }
 function computeSupportPassportSourceRevision(content, structuredAttributes) {
-  return createHash9("sha256").update("support-passport-source:v1\0").update(hasStructuredAttributes(structuredAttributes) ? stripAttributesSuffix(content) : content).digest("hex");
+  return createHash12("sha256").update("support-passport-source:v1\0").update(hasStructuredAttributes(structuredAttributes) ? stripAttributesSuffix(content) : content).digest("hex");
 }
 function isSupportPassportSourceEligible(memory) {
   const status = memory.frontmatter.status ?? "active";
@@ -14195,6 +15966,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     this.idempotency = new AccessIdempotencyStore(orchestrator.config.memoryDir);
     this.replicaDivergenceMonitor = new ReplicaDivergenceMonitor({ resolveSecretRef: options.resolveSecretRef });
     this.injectedSupportPassportGatewayRoute = options.supportPassportGatewayRoute ?? null;
+    this.reviewDeckEnabled = options.reviewDeckEnabled === true;
     const accessCaps = resolveAccessSetupCapabilities(orchestrator.config);
     this.budget = new CrossNamespaceBudget({
       enabled: accessCaps.recallCrossNamespaceBudget,
@@ -14234,6 +16006,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   corpusWatermarkCache = new CorpusWatermarkCache();
   replicaDivergenceMonitor;
   injectedSupportPassportGatewayRoute;
+  reviewDeckEnabled;
   /** AccessObserveWriteSurface (access-service decomposition). Lazy; selfDeps live wiring. */
   _accessObserveWriteSurface;
   get accessObserveWriteSurface() {
@@ -14262,6 +16035,15 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     }
     return this._accessAdminOpsSurface;
   }
+  _reviewDeckSurface;
+  get reviewDeckSurface() {
+    if (!this._reviewDeckSurface) {
+      this._reviewDeckSurface = new ReviewDeckSurface(
+        selfDeps(this)
+      );
+    }
+    return this._reviewDeckSurface;
+  }
   /** AccessRecallSurface (access-service decomposition). Lazy; selfDeps live wiring. */
   _accessRecallSurface;
   get accessRecallSurface() {
@@ -15223,6 +17005,36 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     ]);
     return computeWhoKnows({ topic, limit, memories, entities });
   }
+  /**
+   * Read-only promotion-candidate surfacing (issue #2372): agent-subject,
+   * active, reuse-signaled memories in the caller's namespace with no
+   * equivalent in the target layer. No auto-promotion — callers use the
+   * existing promotion commands.
+   */
+  async promotionCandidates(request) {
+    const limit = request.limit ?? 20;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      throw new EngramAccessInputError(
+        `promotion_candidates: limit expects an integer in [1, 100] (got ${String(request.limit)})`
+      );
+    }
+    const resolvedNamespace = this.resolveReadableNamespace(request.namespace, request.authenticatedPrincipal);
+    const resolvedTarget = this.resolveReadableNamespace(
+      request.targetNamespace ?? this.orchestrator.config.sharedNamespace,
+      request.authenticatedPrincipal
+    );
+    const minAccessCount = this.orchestrator.config.promotionCandidates.minAccessCount;
+    const [memories, targetMemories] = await Promise.all([
+      (await this.orchestrator.getStorage(resolvedNamespace)).readAllMemories(),
+      (await this.orchestrator.getStorage(resolvedTarget)).readAllMemories()
+    ]);
+    return {
+      namespace: resolvedNamespace,
+      targetNamespace: resolvedTarget,
+      minAccessCount,
+      candidates: computePromotionCandidates({ memories, targetMemories, minAccessCount, limit })
+    };
+  }
   async memoryStore(request, hooks) {
     return this.accessObserveWriteSurface.memoryStore(request, hooks);
   }
@@ -15863,6 +17675,35 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     });
     return { namespace: resolvedNamespace, ...report };
   }
+  /**
+   * Procedure library health maintenance (issue #2370). Shadow-first: the
+   * gate is checked BEFORE any storage read, so `maintenance.enabled=false`
+   * returns `{ enabled: false }` having touched nothing but config. Apply
+   * mode additionally requires `apply: true`; `dryRun: true` forces shadow.
+   *
+   * The authenticated principal (never a client-supplied actor) drives the
+   * namespace via the same writable resolver `procedureMiningRun` uses, so
+   * cross-tenant writes are impossible.
+   */
+  async procedureLibraryMaintenance(request, principal) {
+    const procedural = this.orchestrator.config.procedural;
+    if (procedural?.enabled !== true || procedural.maintenance?.enabled !== true) {
+      return { enabled: false };
+    }
+    const resolvedNamespace = this.writableNamespaceFor(
+      request.namespace,
+      void 0,
+      request.authenticatedPrincipal ?? principal
+    );
+    const storage = await this.orchestrator.getStorage(resolvedNamespace);
+    const report = await runProcedureLibraryMaintenance({
+      memoryDir: storage.dir,
+      storage,
+      config: this.orchestrator.config,
+      apply: request.apply === true && request.dryRun !== true
+    });
+    return { enabled: true, namespace: resolvedNamespace, report };
+  }
   async memorySummarizeHourly() {
     await this.orchestrator.summarizer.runHourly();
     return {
@@ -16986,8 +18827,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncSnapshot(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash10("sha256").update(storage.dir).digest("hex").slice(0, 16);
-    const deletions = [...await storage.readDeletionRevisions()].map(([path16, mtimeMs]) => ({ path: path16, mtimeMs }));
+    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const deletions = [...await storage.readDeletionRevisions()].map(([path20, mtimeMs]) => ({ path: path20, mtimeMs }));
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0 ? buildOfflineSyncSnapshotFromBase : buildOfflineSyncSnapshot;
     const snapshot = await snapshotBuilder({
       root: storage.dir,
@@ -17010,10 +18851,10 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncSnapshotStream(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash10("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
     const deletions = await filterOfflineSyncDeletionRevisions({
       root: storage.dir,
-      deletions: [...await storage.readDeletionRevisions()].map(([path16, mtimeMs]) => ({ path: path16, mtimeMs })),
+      deletions: [...await storage.readDeletionRevisions()].map(([path20, mtimeMs]) => ({ path: path20, mtimeMs })),
       includeTranscripts: options.includeTranscripts !== false,
       userExcludeRegexps: this.offlineSyncUserExcludes
     });
@@ -17050,7 +18891,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncFiles(options) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash10("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
     try {
       const snapshot = await buildOfflineSyncSnapshotForPaths({
         root: storage.dir,
@@ -17289,6 +19130,15 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async adminPromoteMemory(request) {
     return this.accessAdminOpsSurface.adminPromoteMemory(request);
   }
+  async reviewDeckList(opts) {
+    return this.reviewDeckSurface.list(opts);
+  }
+  async reviewDeckAction(...args) {
+    return this.reviewDeckSurface.action(...args);
+  }
+  async reviewDeckUndo(...args) {
+    return this.reviewDeckSurface.undo(...args);
+  }
 };
 
 // src/access-recall-concurrency.ts
@@ -17647,6 +19497,7 @@ export {
   resolveNamespaceWritablePreflight,
   resolveAuthorizedNamespaceWritablePreflight,
   resolveQueryNamespaceWritablePreflight,
+  runProcedureLibraryMaintenance,
   computeProcedureStats,
   formatProcedureStatsText,
   AccessIdentityContinuitySurface,
@@ -17659,6 +19510,17 @@ export {
   RecallResultFormatter,
   assembleRecallResponse,
   AccessRecallSurface,
+  ReviewDeckCursorError,
+  computeReviewItemRevision,
+  projectReviewDeckItem,
+  compareReviewDeckRows,
+  encodeReviewDeckCursor,
+  decodeReviewDeckCursor,
+  buildReviewDeckPage,
+  listReviewItems,
+  performReview,
+  readReviewDeckSnapshot,
+  readReviewDeckRow,
   SupportPassportError,
   SupportPassportGrantCardRefSchema,
   SupportPassportGrantStateSchema,
@@ -17705,4 +19567,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-3PXVYJMC.js.map
+//# sourceMappingURL=chunk-WN5FSGLE.js.map