@remnic/core 9.65.2 → 9.65.4

package/dist/{chunk-SB7D4BT7.js → chunk-AZLLH6YA.js}

@@ -18,7 +18,7 @@ import {
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-SPUJNJJC.js";
+} from "./chunk-KFIOPZ25.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
@@ -45,13 +45,13 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-7YQ4IYS2.js";
+} from "./chunk-YOXVZJFM.js";
 import {
   estimateRecallTokens
-} from "./chunk-3I7ASZN3.js";
+} from "./chunk-MFOSZUIT.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-PE255F4T.js";
+} from "./chunk-2MVTAIL3.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
@@ -88,11 +88,6 @@ import {
 import {
   LocalLlmClient
 } from "./chunk-IVKIODHO.js";
-import {
-  buildProcedurePersistBody,
-  normalizeProcedureSteps,
-  parseProcedureStepsFromBody
-} from "./chunk-QDW3E4RD.js";
 import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
@@ -117,11 +112,11 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-JYYBA7TF.js";
+} from "./chunk-KOO37E4Y.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-XRYZRW54.js";
+} from "./chunk-WDXD6ITO.js";
 import {
   ExtractionDeadlineError,
   isActivityDigestPath,
@@ -132,31 +127,27 @@ import {
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
-import {
-  filterTrajectoriesByLookbackDays,
-  readCausalTrajectoryRecords
-} from "./chunk-PP7R754B.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-NTWN6HB2.js";
+} from "./chunk-IURMJBGP.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-J275IYMG.js";
+} from "./chunk-THVI4Y7X.js";
 import {
   namespaceCollectionName
 } from "./chunk-YHCBJULX.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-SBDCZ2AX.js";
+} from "./chunk-LBFFNDFM.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -174,11 +165,19 @@ import {
   parseTagMatch
 } from "./chunk-BT7NVCML.js";
 import {
-  createVersion
+  createVersion,
+  getVersion,
+  revertToVersion
 } from "./chunk-UFKPQBXH.js";
 import {
+  MEMORY_CORPUS_VERSION_SENTINEL,
   bumpMemoryCorpusVersionForDir
 } from "./chunk-XCB6QDL6.js";
+import {
+  HistoricalEntityCanonicalIdCache,
+  canonicalizeEntityRefFrontmatter,
+  repairContentAfterJournalMoveSync
+} from "./chunk-ZVPVTPGI.js";
 import {
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
@@ -198,6 +197,15 @@ import {
 import {
   isExternalWikiCollectionName
 } from "./chunk-JV3C2MNQ.js";
+import {
+  buildProcedurePersistBody,
+  normalizeProcedureSteps,
+  parseProcedureStepsFromBody
+} from "./chunk-QDW3E4RD.js";
+import {
+  filterTrajectoriesByLookbackDays,
+  readCausalTrajectoryRecords
+} from "./chunk-PP7R754B.js";
 import {
   computePromotionCandidates
 } from "./chunk-RIAM7DND.js";
@@ -232,7 +240,7 @@ import {
 } from "./chunk-LNEWDF2A.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-ODZG724P.js";
+} from "./chunk-I2HTKOOP.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-HZNYJN77.js";
@@ -282,9 +290,6 @@ import {
   isSupportPassportPrivateMemory,
   projectSupportPassportCard
 } from "./chunk-XDL5CYZN.js";
-import {
-  stripAttributesSuffix
-} from "./chunk-JDSVLVCG.js";
 import {
   computeContentHash
 } from "./chunk-5FVVY2EB.js";
@@ -292,6 +297,9 @@ import {
   serializeMutations,
   withHeldFileLock
 } from "./chunk-FFAZ2XFU.js";
+import {
+  stripAttributesSuffix
+} from "./chunk-JDSVLVCG.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
@@ -399,7 +407,8 @@ import {
   SecureStoreLockedError
 } from "./chunk-XQ3HXAQH.js";
 import {
-  ALL_CATEGORY_DIRS
+  ALL_CATEGORY_DIRS,
+  getCategoryDir
 } from "./chunk-VS2IYZRU.js";
 import {
   recordCitationUsage
@@ -409,7 +418,7 @@ import {
 } from "./chunk-3WCASNQZ.js";
 
 // src/access-service.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { constants as fsConstants2 } from "fs";
 import { readdirSync, unlinkSync } from "fs";
 import { stat as stat3 } from "fs/promises";
@@ -5451,6 +5460,7 @@ var OPERATION_NAMES = [
   "review_list",
   "review_resolve",
   "contradiction_scan_run",
+  "preference_drift_scan",
   "memory_summarize_hourly",
   "conversation_index_update",
   "profiling_report",
@@ -5495,6 +5505,9 @@ var OPERATION_NAMES = [
   "trust_zones_status",
   "trust_zones_records",
   "review_disposition",
+  "review_deck_list",
+  "review_deck_action",
+  "review_deck_undo",
   "trust_zones_promote",
   "trust_zones_demo_seed",
   "citations_observed",
@@ -5572,10 +5585,10 @@ function formatZodIssues(error) {
   const parts = [];
   for (const issue of error.issues) {
     const hasNumeric = issue.path.some((p) => typeof p === "number");
-    const path17 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    const path20 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
     const options = enumOptionsFromIssue(issue);
     const suffix = options ? `. Valid: ${options.join(", ")}` : "";
-    parts.push(`${path17}: ${issue.message}${suffix}`);
+    parts.push(`${path20}: ${issue.message}${suffix}`);
   }
   return parts.length > 0 ? `request validation failed: ${parts.join("; ")}` : "request validation failed";
 }
@@ -9151,14 +9164,15 @@ ${snippet}`;
       const withHandle = handle ? `${head.trimEnd()} ${handle}` : head.trimEnd();
       const connectorLabel = renderConnectorLabel(r.sourceConnector);
       const withConnector = connectorLabel ? `${withHandle} [agent: ${connectorLabel}]` : withHandle;
+      const withDrift = r.driftNote ? `${withConnector} ${r.driftNote}` : withConnector;
       if (hedgeMap) {
         const item = trustResultFor(hedgeMap, r);
         if (item) {
           const hedge = renderEpistemicHedge(item.trust);
-          if (hedge.length > 0) return `${withConnector} ${hedge}`;
+          if (hedge.length > 0) return `${withDrift} ${hedge}`;
         }
       }
-      return withConnector;
+      return withDrift;
     });
     return { heading: `## ${title}`, entries };
   }
@@ -10351,8 +10365,1403 @@ var AccessRecallSurface = class {
   }
 };
 
+// src/review/review-deck-surface.ts
+import { createHash as createHash8 } from "crypto";
+
+// src/review/review-deck.ts
+import { createHash as createHash6 } from "crypto";
+var ReviewDeckCursorError = class extends Error {
+  constructor(message = "Invalid review deck cursor") {
+    super(message);
+    this.name = "ReviewDeckCursorError";
+  }
+};
+var ALLOWED_CHOICES = ["keep", "prepare_fix", "not_true"];
+var REVERSIBLE_RISK = {
+  keep: "reversible",
+  prepare_fix: "reversible",
+  not_true: "reversible"
+};
+var REVIEW_REASON_LABELS = {
+  low_confidence: "Low confidence",
+  suggestion: "Suggested memory",
+  tombstone_blocked: "Blocked by a deletion",
+  contradiction: "Conflicts with another memory",
+  duplicate: "Possible duplicate"
+};
+var EXCERPT_LIMIT = 240;
+function computeReviewItemRevision(fileContent) {
+  return `rv1:${createHash6("sha256").update(fileContent).digest("hex")}`;
+}
+function projectReviewDeckItem(row, namespace) {
+  const provenance = provenanceFromRow(row);
+  return {
+    schemaVersion: 1,
+    itemId: row.itemId,
+    source: "review",
+    sourceId: row.itemId,
+    memoryId: row.itemId,
+    content: row.content,
+    ...row.category !== void 0 ? { category: row.category } : {},
+    ...row.lifecycleState !== void 0 ? { lifecycleState: row.lifecycleState } : {},
+    ...row.confidence !== void 0 ? { confidence: row.confidence } : {},
+    ...row.confidenceTier !== void 0 ? { confidenceTier: row.confidenceTier } : {},
+    reviewReason: row.reviewReason,
+    reviewReasonLabel: reviewReasonLabel(row.reviewReason),
+    supportCount: provenance.filter((entry) => entry.relation === "supports").length,
+    provenance,
+    allowedChoices: ALLOWED_CHOICES,
+    choiceRisk: REVERSIBLE_RISK,
+    namespace,
+    revision: row.revision
+  };
+}
+function compareReviewDeckRows(a, b) {
+  const aBlocked = a.blockedBy && a.blockedBy.length > 0 ? 0 : 1;
+  const bBlocked = b.blockedBy && b.blockedBy.length > 0 ? 0 : 1;
+  if (aBlocked !== bBlocked) return aBlocked - bBlocked;
+  const aConfidence = a.confidence ?? 0.5;
+  const bConfidence = b.confidence ?? 0.5;
+  if (aConfidence !== bConfidence) return aConfidence < bConfidence ? -1 : 1;
+  if (a.created !== b.created) return a.created < b.created ? -1 : 1;
+  if (a.itemId !== b.itemId) return a.itemId < b.itemId ? -1 : 1;
+  return 0;
+}
+function encodeReviewDeckCursor(scope, lastSortKey) {
+  return Buffer.from(
+    JSON.stringify({
+      v: 1,
+      p: scope.principalDigest,
+      n: scope.namespace,
+      f: scope.filterDigest,
+      c: scope.corpusVersion,
+      k: lastSortKey
+    }),
+    "utf8"
+  ).toString("base64url");
+}
+function decodeReviewDeckCursor(cursor, scope) {
+  const payload = parseCursorPayload(cursor);
+  if (payload.p !== scope.principalDigest || payload.n !== scope.namespace || payload.f !== scope.filterDigest || payload.c !== scope.corpusVersion) {
+    throw new ReviewDeckCursorError("Review deck cursor scope mismatch");
+  }
+  return payload.k;
+}
+function buildReviewDeckPage(rows, opts) {
+  const sorted = [...rows].sort(compareReviewDeckRows);
+  const limit = Math.max(0, opts.limit);
+  let start = 0;
+  if (opts.cursor !== void 0) {
+    const lastSortKey = decodeReviewDeckCursor(opts.cursor, opts.scope);
+    start = sorted.findIndex((row) => reviewDeckSortKey(row) > lastSortKey);
+    if (start < 0) start = sorted.length;
+  }
+  const pageRows = limit === 0 ? [] : sorted.slice(start, start + limit);
+  const items = pageRows.map((row) => projectReviewDeckItem(row, opts.scope.namespace));
+  const consumed = start + pageRows.length;
+  const nextCursor = pageRows.length > 0 && consumed < sorted.length ? encodeReviewDeckCursor(opts.scope, reviewDeckSortKey(pageRows[pageRows.length - 1])) : void 0;
+  return {
+    schemaVersion: 1,
+    items,
+    total: sorted.length,
+    ...nextCursor !== void 0 ? { nextCursor } : {}
+  };
+}
+function reviewDeckSortKey(row) {
+  const blocked = row.blockedBy && row.blockedBy.length > 0 ? "0" : "1";
+  return `${blocked}	${(row.confidence ?? 0.5).toFixed(6)}	${row.created}	${row.itemId}`;
+}
+function reviewReasonLabel(reason) {
+  const known = REVIEW_REASON_LABELS[reason];
+  if (known) return known;
+  const words = reason.split("_").filter((part) => part.length > 0);
+  if (words.length === 0) return "Review";
+  return words.map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase()).join(" ");
+}
+function provenanceFromRow(row) {
+  const fm = parseFrontmatterFields(row.fileContent);
+  const source = nonempty(row.source) ?? nonempty(fm.source);
+  const context = nonempty(row.context) ?? nonempty(fm.context);
+  const created = nonempty(row.created) ?? nonempty(fm.created);
+  const supportIds = idList(fm.supports);
+  const conflictIds = [...idList(fm.conflicts), ...idList(fm.contradicts)];
+  const relatedIds = idList(fm.relatedMemoryIds);
+  const relatedRelation = row.reviewReason === "contradiction" ? "conflicts" : "supports";
+  const provenance = [];
+  if (source !== void 0 || context !== void 0) {
+    provenance.push({
+      relation: "origin",
+      ...created !== void 0 ? { sourceDate: created } : {},
+      excerpt: truncateExcerpt(context ?? source ?? "")
+    });
+  }
+  for (const sourceMemoryId of supportIds) {
+    provenance.push({ relation: "supports", sourceMemoryId });
+  }
+  for (const sourceMemoryId of conflictIds) {
+    provenance.push({ relation: "conflicts", sourceMemoryId });
+  }
+  for (const sourceMemoryId of relatedIds) {
+    if (supportIds.includes(sourceMemoryId) || conflictIds.includes(sourceMemoryId)) continue;
+    provenance.push({ relation: relatedRelation, sourceMemoryId });
+  }
+  return provenance;
+}
+function parseFrontmatterFields(content) {
+  if (!content.startsWith("---\n")) return {};
+  const end = content.indexOf("\n---", 4);
+  if (end === -1) return {};
+  const fields = {};
+  for (const line of content.slice(4, end).split("\n")) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    fields[line.slice(0, colonIdx).trim()] = line.slice(colonIdx + 1).trim();
+  }
+  return fields;
+}
+function idList(value) {
+  if (value === void 0 || value.length === 0) return [];
+  return value.replace(/^\[|\]$/g, "").split(",").map((part) => part.trim().replace(/^["']|["']$/g, "")).filter((part) => part.length > 0);
+}
+function nonempty(value) {
+  if (value === void 0) return void 0;
+  return value.trim().length > 0 ? value : void 0;
+}
+function truncateExcerpt(value) {
+  return value.length <= EXCERPT_LIMIT ? value : value.slice(0, EXCERPT_LIMIT);
+}
+function parseCursorPayload(cursor) {
+  if (cursor.length === 0) throw new ReviewDeckCursorError("Malformed review deck cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+  } catch {
+    throw new ReviewDeckCursorError("Malformed review deck cursor");
+  }
+  if (!parsed || typeof parsed !== "object") throw new ReviewDeckCursorError("Malformed review deck cursor");
+  const record = parsed;
+  if (record.v !== 1) throw new ReviewDeckCursorError("Unsupported review deck cursor schema");
+  if (typeof record.p !== "string" || typeof record.n !== "string" || typeof record.f !== "string" || typeof record.c !== "string" || typeof record.k !== "string" || record.k.length === 0) {
+    throw new ReviewDeckCursorError("Malformed review deck cursor");
+  }
+  return { v: 1, p: record.p, n: record.n, f: record.f, c: record.c, k: record.k };
+}
+
+// src/review/review-deck-mutation.ts
+import { createHash as createHash7, randomUUID } from "crypto";
+import fs3 from "fs";
+import path14 from "path";
+
+// src/review/index.ts
+import fs from "fs";
+import path12 from "path";
+var historicalIdCache = new HistoricalEntityCanonicalIdCache();
+function writeReviewFileCanonicalized(memoryDir, filePath, content) {
+  const stateDir = path12.join(memoryDir, "state");
+  const idsAtWrite = historicalIdCache.get(stateDir);
+  let originalBytes = null;
+  try {
+    originalBytes = fs.readFileSync(filePath, "utf8");
+  } catch {
+    originalBytes = null;
+  }
+  const written = canonicalizeEntityRefFrontmatter(content, idsAtWrite);
+  fs.writeFileSync(filePath, written, "utf8");
+  try {
+    repairContentAfterJournalMoveSync({
+      stateDir,
+      cache: historicalIdCache,
+      idsAtWrite,
+      rawContent: content,
+      lastWritten: written,
+      rewrite: (next) => fs.writeFileSync(filePath, next, "utf8")
+    });
+  } catch (err) {
+    try {
+      if (originalBytes === null) {
+        fs.unlinkSync(filePath);
+      } else {
+        fs.writeFileSync(filePath, originalBytes, "utf8");
+      }
+    } catch {
+    }
+    throw err;
+  }
+}
+var DEFAULT_CONFIDENCE_THRESHOLD = 0.7;
+function realMemoryRoot(memoryDir) {
+  try {
+    const stat4 = fs.lstatSync(memoryDir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return null;
+    return fs.realpathSync(memoryDir);
+  } catch {
+    return null;
+  }
+}
+function isPathInside(rootReal, candidateReal) {
+  const relative2 = path12.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path12.isAbsolute(relative2);
+}
+function isSafeDirectory(rootReal, dir) {
+  try {
+    const stat4 = fs.lstatSync(dir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return false;
+    return isPathInside(rootReal, fs.realpathSync(dir));
+  } catch {
+    return false;
+  }
+}
+function ensureSafeDirectory(rootReal, dir) {
+  if (fs.existsSync(dir)) {
+    if (!isSafeDirectory(rootReal, dir)) {
+      throw new Error(`Refusing to write through unsafe review path: ${dir}`);
+    }
+    return;
+  }
+  fs.mkdirSync(dir, { recursive: true });
+  if (!isSafeDirectory(rootReal, dir)) {
+    throw new Error(`Refusing to write through unsafe review path: ${dir}`);
+  }
+}
+function listReviewItems(options) {
+  const startTime = Date.now();
+  const {
+    memoryDir,
+    reason: filterReason,
+    limit = 50,
+    confidenceThreshold = DEFAULT_CONFIDENCE_THRESHOLD
+  } = options;
+  const maxItems = Math.max(0, limit);
+  const rootReal = realMemoryRoot(memoryDir);
+  if (!rootReal || maxItems === 0) {
+    return { items: [], total: 0, durationMs: Date.now() - startTime };
+  }
+  const items = [];
+  const isLimitReached = () => items.length >= maxItems;
+  const addItem = (item) => {
+    if (isLimitReached()) return;
+    if (filterReason && item.reviewReason !== filterReason) return;
+    items.push(item);
+  };
+  const suggestionsDir = path12.join(memoryDir, "suggestions");
+  if (!isLimitReached() && fs.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
+    walkMd(rootReal, suggestionsDir, (filePath, content) => {
+      if (isLimitReached()) return true;
+      const fm = parseFrontmatter2(content);
+      const body = extractBody(content);
+      if (!fm?.id) return false;
+      addItem({
+        id: fm.id,
+        content: body,
+        category: fm.category ?? "suggestion",
+        confidence: parseConfidence(fm.confidence, 0.5),
+        confidenceTier: fm.confidenceTier ?? "low",
+        source: fm.source ?? "unknown",
+        filePath,
+        created: fm.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+        reviewReason: "suggestion"
+      });
+      return isLimitReached();
+    });
+  }
+  const reviewDir = path12.join(memoryDir, "review");
+  if (!isLimitReached() && fs.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
+    walkMd(rootReal, reviewDir, (filePath, content) => {
+      if (isLimitReached()) return true;
+      const fm = parseFrontmatter2(content);
+      const body = extractBody(content);
+      if (!fm?.id) return false;
+      addItem({
+        id: fm.id,
+        content: body,
+        category: fm.category ?? "review",
+        confidence: parseConfidence(fm.confidence, 0.5),
+        confidenceTier: fm.confidenceTier ?? "low",
+        source: fm.source ?? "unknown",
+        filePath,
+        created: fm.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+        reviewReason: fm.reviewReason ?? "low_confidence",
+        context: fm.context
+      });
+      return isLimitReached();
+    });
+  }
+  const categories = ALL_CATEGORY_DIRS;
+  for (const category of categories) {
+    if (isLimitReached()) break;
+    const dir = path12.join(memoryDir, category);
+    if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    walkMd(rootReal, dir, (filePath, content) => {
+      if (isLimitReached()) return true;
+      const fm = parseFrontmatter2(content);
+      const body = extractBody(content);
+      if (!fm?.id) return false;
+      const confidence = parseConfidence(fm.confidence, 1);
+      if (confidence >= confidenceThreshold && !(typeof fm.blockedBy === "string" && fm.blockedBy.length > 0)) return false;
+      if (parseBoolean(fm.reviewDismissed)) return false;
+      if (items.some((i) => i.id === fm.id)) return false;
+      addItem({
+        id: fm.id,
+        content: body,
+        category: fm.category ?? category.slice(0, -1),
+        confidence,
+        confidenceTier: fm.confidenceTier ?? "low",
+        source: fm.source ?? "unknown",
+        filePath,
+        created: fm.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+        reviewReason: typeof fm.blockedBy === "string" && fm.blockedBy.length > 0 ? "tombstone_blocked" : "low_confidence"
+      });
+      return isLimitReached();
+    });
+  }
+  return {
+    items,
+    total: items.length,
+    durationMs: Date.now() - startTime
+  };
+}
+function performReview(memoryDir, itemId, action, options = {}) {
+  const result = action === "approve" ? approveItem(memoryDir, itemId, options) : action === "dismiss" ? dismissItem(memoryDir, itemId, options) : flagItem(memoryDir, itemId, options);
+  if (result.updatedPath !== void 0) bumpMemoryCorpusVersionForDir(memoryDir);
+  return result;
+}
+function approveItem(memoryDir, itemId, options) {
+  const rootReal = realMemoryRoot(memoryDir);
+  if (!rootReal) return { itemId, action: "approve", message: "Item not found" };
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "approve", message: "Item not found" };
+  }
+  const content = fs.readFileSync(found.filePath, "utf8");
+  const fm = parseFrontmatter2(content);
+  if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
+  const blockedBy = typeof fm.blockedBy === "string" ? fm.blockedBy : null;
+  const fireBlockedRevocation = () => {
+    if (!blockedBy || !options.onApproveBlockedMemory) return;
+    try {
+      const maybe = options.onApproveBlockedMemory(blockedBy, itemId);
+      if (maybe && typeof maybe.then === "function") {
+        void maybe.catch(() => void 0);
+      }
+    } catch {
+    }
+  };
+  const updatedContent = updateFrontmatterFields(content, {
+    confidence: "0.9",
+    confidenceTier: "high",
+    reviewDismissed: null,
+    // Clear the tombstone-block markers so the promoted memory is active.
+    // Clear the tombstone-block markers AND restore active status so the
+    // promoted memory is fully active in recall + provenance (issue #1579
+    // review: leaving status: pending_review kept it invisible to recall).
+    ...blockedBy ? { blockedBy: null, tombstoneBlockTier: null, status: "active" } : {}
+  });
+  if (found.location === "category") {
+    writeReviewFileCanonicalized(memoryDir, found.filePath, updatedContent);
+    fireBlockedRevocation();
+    return {
+      itemId,
+      action: "approve",
+      updatedPath: found.filePath,
+      message: "Approved low-confidence memory in place with confidence 0.9",
+      ...blockedBy ? { clearedTombstoneId: blockedBy } : {}
+    };
+  }
+  const category = fm.category ?? "fact";
+  const targetDir = getCategoryDir(memoryDir, category);
+  const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  ensureSafeDirectory(rootReal, targetDir);
+  const outputPath = path12.join(targetDir, dateDir, path12.basename(found.filePath));
+  ensureSafeDirectory(rootReal, path12.dirname(outputPath));
+  const reviewStateDir = path12.join(memoryDir, "state");
+  const idsAtWrite = historicalIdCache.get(reviewStateDir);
+  const promotedWritten = canonicalizeEntityRefFrontmatter(updatedContent, idsAtWrite);
+  const promotedPath = writeFileWithoutClobber(outputPath, promotedWritten, itemId);
+  try {
+    repairContentAfterJournalMoveSync({
+      stateDir: reviewStateDir,
+      cache: historicalIdCache,
+      idsAtWrite,
+      rawContent: updatedContent,
+      lastWritten: promotedWritten,
+      rewrite: (next) => fs.writeFileSync(promotedPath, next, "utf8")
+    });
+  } catch (err) {
+    try {
+      fs.unlinkSync(promotedPath);
+    } catch {
+    }
+    throw err;
+  }
+  fs.unlinkSync(found.filePath);
+  fireBlockedRevocation();
+  return {
+    itemId,
+    action: "approve",
+    updatedPath: promotedPath,
+    message: `Promoted to ${category} with confidence 0.9`,
+    ...blockedBy ? { clearedTombstoneId: blockedBy } : {}
+  };
+}
+function dismissItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "dismiss", message: "Item not found" };
+  }
+  if (found.location === "queue") {
+    fs.unlinkSync(found.filePath);
+    return { itemId, action: "dismiss", message: "Dismissed and removed" };
+  }
+  const content = fs.readFileSync(found.filePath, "utf8");
+  writeReviewFileCanonicalized(
+    memoryDir,
+    found.filePath,
+    updateFrontmatterFields(content, {
+      reviewDismissed: "true",
+      reviewDismissedAt: (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+  return {
+    itemId,
+    action: "dismiss",
+    updatedPath: found.filePath,
+    message: "Dismissed low-confidence memory in place"
+  };
+}
+function flagItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "flag", message: "Item not found" };
+  }
+  const content = fs.readFileSync(found.filePath, "utf8");
+  const fixed = updateFrontmatterFields(content, {
+    flagged: "true",
+    flaggedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  writeReviewFileCanonicalized(memoryDir, found.filePath, fixed);
+  return {
+    itemId,
+    action: "flag",
+    updatedPath: found.filePath,
+    message: "Flagged for further review"
+  };
+}
+function findReviewFileById(memoryDir, id, options = {}) {
+  const rootReal = realMemoryRoot(memoryDir);
+  if (!rootReal) return null;
+  for (const loc of ["suggestions", "review"]) {
+    const dir = path12.join(memoryDir, loc);
+    if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    const found = findFileById(rootReal, dir, id);
+    if (found) return { filePath: found, location: "queue" };
+  }
+  for (const category of ALL_CATEGORY_DIRS) {
+    const dir = path12.join(memoryDir, category);
+    if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    const found = findFileById(rootReal, dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
+    if (found) return { filePath: found, location: "category" };
+  }
+  return null;
+}
+function findFileById(rootReal, dir, id, include) {
+  const files = walkMdPaths(rootReal, dir);
+  for (const filePath of files) {
+    const content = readFileSafe(filePath);
+    if (!content) continue;
+    const fm = parseFrontmatter2(content);
+    if (fm?.id === id && (!include || include(fm))) return filePath;
+  }
+  return null;
+}
+function isLowConfidenceReviewCandidate(fm, options) {
+  const threshold = options.confidenceThreshold ?? DEFAULT_CONFIDENCE_THRESHOLD;
+  if (typeof fm.blockedBy === "string" && fm.blockedBy.length > 0) {
+    return !parseBoolean(fm.reviewDismissed);
+  }
+  return parseConfidence(fm.confidence, 1) < threshold && !parseBoolean(fm.reviewDismissed);
+}
+function parseBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "true" || normalized === "1" || normalized === "yes";
+}
+function parseConfidence(value, fallback) {
+  if (typeof value === "number") return Number.isFinite(value) ? value : fallback;
+  if (typeof value === "string") {
+    const n = parseFloat(value);
+    return Number.isFinite(n) ? n : fallback;
+  }
+  return fallback;
+}
+function updateFrontmatterFields(content, fields) {
+  const match = content.match(/^(---\n)([\s\S]*?)(\n---(?:\n|$))/);
+  if (!match) return content;
+  const seen = /* @__PURE__ */ new Set();
+  const lines = match[2].split("\n");
+  const nextLines = [];
+  for (const line of lines) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) {
+      nextLines.push(line);
+      continue;
+    }
+    const key = line.slice(0, colonIdx).trim();
+    if (!Object.prototype.hasOwnProperty.call(fields, key)) {
+      nextLines.push(line);
+      continue;
+    }
+    seen.add(key);
+    const value = fields[key];
+    if (value !== null) {
+      nextLines.push(`${key}: ${value}`);
+    }
+  }
+  for (const [key, value] of Object.entries(fields)) {
+    if (value !== null && !seen.has(key)) {
+      nextLines.push(`${key}: ${value}`);
+    }
+  }
+  return `${match[1]}${nextLines.join("\n")}${match[3]}${content.slice(match[0].length)}`;
+}
+function readFileSafe(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function writeFileWithoutClobber(basePath, content, discriminator) {
+  const parsed = path12.parse(basePath);
+  const safeDiscriminator = sanitizeFilePart(discriminator);
+  for (let attempt = 0; attempt < 1e3; attempt++) {
+    const candidate = attempt === 0 ? basePath : path12.join(
+      parsed.dir,
+      `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
+    );
+    try {
+      fs.writeFileSync(candidate, content, { encoding: "utf8", flag: "wx" });
+      return candidate;
+    } catch (error) {
+      if (error.code === "EEXIST") continue;
+      throw error;
+    }
+  }
+  throw new Error(`Could not find a free review promotion path for ${basePath}`);
+}
+function sanitizeFilePart(value) {
+  const chars = [];
+  let previousWasDash = false;
+  for (const char of value) {
+    const next = isSafeFilePartChar(char) ? char : "-";
+    if (next === "-" && previousWasDash) continue;
+    chars.push(next);
+    previousWasDash = next === "-";
+    if (chars.length >= 64) break;
+  }
+  let start = 0;
+  let end = chars.length;
+  while (start < end && chars[start] === "-") start++;
+  while (end > start && chars[end - 1] === "-") end--;
+  const sanitized = chars.slice(start, end).join("");
+  return sanitized || "review-item";
+}
+function isSafeFilePartChar(value) {
+  if (value.length !== 1) return false;
+  const code = value.charCodeAt(0);
+  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || value === "." || value === "_" || value === "-";
+}
+function parseFrontmatter2(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return null;
+  const fm = {};
+  for (const line of match[1].split("\n")) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    const key = line.slice(0, colonIdx).trim();
+    const value = line.slice(colonIdx + 1).trim();
+    fm[key] = value;
+  }
+  return fm;
+}
+function extractBody(content) {
+  const match = content.match(/^---\n[\s\S]*?\n---\n([\s\S]*)/);
+  return match ? match[1].trim() : content.trim();
+}
+function walkMd(rootReal, dir, callback) {
+  if (!isSafeDirectory(rootReal, dir)) return false;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path12.join(dir, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (walkMd(rootReal, fullPath, callback)) return true;
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      const content = readFileSafe(fullPath);
+      if (content && callback(fullPath, content) === true) return true;
+    }
+  }
+  return false;
+}
+function walkMdPaths(rootReal, dir) {
+  const results = [];
+  if (!isSafeDirectory(rootReal, dir)) return results;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path12.join(dir, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      results.push(...walkMdPaths(rootReal, fullPath));
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+// src/review/review-deck-snapshot.ts
+import fs2 from "fs";
+import path13 from "path";
+var QUEUE_DIRS = ["suggestions", "review"];
+function readReviewDeckSnapshot(opts) {
+  const corpusVersion = readCorpusVersion(opts.memoryDir);
+  const rootReal = realMemoryRoot2(opts.memoryDir);
+  if (!rootReal) return { corpusVersion, total: 0, rows: [] };
+  const rows = [];
+  for (const location of QUEUE_DIRS) {
+    const dir = path13.join(opts.memoryDir, location);
+    if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
+    walkMd2(rootReal, dir, (filePath, content) => {
+      const row = rowFromQueueFile(filePath, content, location);
+      if (row) rows.push(row);
+    });
+  }
+  return { corpusVersion, total: rows.length, rows };
+}
+function readReviewDeckRow(opts) {
+  const rootReal = realMemoryRoot2(opts.memoryDir);
+  if (!rootReal) return null;
+  for (const location of QUEUE_DIRS) {
+    const dir = path13.join(opts.memoryDir, location);
+    if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
+    let found = null;
+    walkMd2(rootReal, dir, (filePath, content) => {
+      const row = rowFromQueueFile(filePath, content, location);
+      if (row?.itemId === opts.itemId) {
+        found = row;
+        return true;
+      }
+    });
+    if (found) return found;
+  }
+  return null;
+}
+function readCorpusVersion(memoryDir) {
+  try {
+    return String(fs2.statSync(path13.join(memoryDir, "state", MEMORY_CORPUS_VERSION_SENTINEL)).size);
+  } catch {
+    return "0";
+  }
+}
+function rowFromQueueFile(filePath, content, location) {
+  const fm = parseFrontmatter3(content);
+  const itemId = optionalString(fm?.id);
+  if (!fm || !itemId || !isPendingQueueRow(fm)) return null;
+  const blockedBy = optionalString(fm.blockedBy);
+  const confidence = parseOptionalConfidence(fm.confidence);
+  const category = optionalString(fm.category);
+  const confidenceTier = optionalString(fm.confidenceTier);
+  const source = optionalString(fm.source);
+  const context = optionalString(fm.context);
+  const lifecycleState = optionalString(fm.lifecycleState) ?? optionalString(fm.status);
+  const created = optionalString(fm.created) ?? "";
+  const explicitReason = optionalString(fm.reviewReason);
+  return {
+    itemId,
+    filePath,
+    fileContent: content,
+    revision: computeReviewItemRevision(content),
+    content: extractBody2(content),
+    reviewReason: explicitReason ?? (blockedBy ? "tombstone_blocked" : location === "suggestions" ? "suggestion" : "low_confidence"),
+    created,
+    ...category ? { category } : {},
+    ...confidence !== void 0 ? { confidence } : {},
+    ...confidenceTier ? { confidenceTier } : {},
+    ...source ? { source } : {},
+    ...blockedBy ? { blockedBy } : {},
+    ...lifecycleState ? { lifecycleState } : {},
+    ...context ? { context } : {}
+  };
+}
+function isPendingQueueRow(fm) {
+  if (parseBoolean2(fm.reviewDismissed)) return false;
+  const status = optionalString(fm.status);
+  return status === void 0 || status === "pending_review";
+}
+function realMemoryRoot2(memoryDir) {
+  try {
+    const stat4 = fs2.lstatSync(memoryDir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return null;
+    return fs2.realpathSync(memoryDir);
+  } catch {
+    return null;
+  }
+}
+function isPathInside2(rootReal, candidateReal) {
+  const relative2 = path13.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path13.isAbsolute(relative2);
+}
+function isSafeDirectory2(rootReal, dir) {
+  try {
+    const stat4 = fs2.lstatSync(dir);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) return false;
+    return isPathInside2(rootReal, fs2.realpathSync(dir));
+  } catch {
+    return false;
+  }
+}
+function walkMd2(rootReal, dir, callback) {
+  if (!isSafeDirectory2(rootReal, dir)) return false;
+  for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path13.join(dir, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (walkMd2(rootReal, fullPath, callback)) return true;
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      const content = readFileSafe2(fullPath);
+      if (content && callback(fullPath, content) === true) return true;
+    }
+  }
+  return false;
+}
+function readFileSafe2(filePath) {
+  try {
+    return fs2.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function splitFrontmatter(content) {
+  if (!content.startsWith("---\n")) return null;
+  const end = content.indexOf("\n---", 4);
+  if (end === -1) return null;
+  const after = end + "\n---".length;
+  const body = content.startsWith("\n", after) ? content.slice(after + 1) : content.slice(after);
+  return { fields: content.slice(4, end), body };
+}
+function parseFrontmatter3(content) {
+  const split = splitFrontmatter(content);
+  if (!split) return null;
+  const fm = {};
+  for (const line of split.fields.split("\n")) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    fm[line.slice(0, colonIdx).trim()] = line.slice(colonIdx + 1).trim();
+  }
+  return fm;
+}
+function extractBody2(content) {
+  const split = splitFrontmatter(content);
+  return split ? split.body.trim() : content.trim();
+}
+function parseBoolean2(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "true" || normalized === "1" || normalized === "yes";
+}
+function optionalString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function parseOptionalConfidence(value) {
+  if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+  if (typeof value === "string" && value.trim().length > 0) {
+    const parsed = Number.parseFloat(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}
+
+// src/review/review-deck-mutation.ts
+var ACTOR = "admin-console.review-deck";
+var RULE_VERSION = "admin-console.review-deck.v1";
+var DECK_VERSIONING = {
+  enabled: true,
+  maxVersionsPerPage: 20,
+  sidecarDir: ".versions"
+};
+var KEEP_EFFECT = "Kept: this memory can now be recalled.";
+var NOT_TRUE_EFFECT = "Marked untrue: removed from the review queue.";
+var PLANNED_EFFECT = "Prepared a correction plan.";
+var PLAN_FAILED_EFFECT = "Could not prepare a correction plan.";
+var MISSING_EFFECT = "This review item is no longer available.";
+var CONFLICT_EFFECT = "This memory changed. Review it again.";
+var UNDO_EFFECT = "Undid the last review decision.";
+var UNDO_CONFLICT_EFFECT = "Another change happened first. Nothing was undone.";
+var UNDO_FAILED_EFFECT = "This action cannot be undone.";
+var ReviewDeckIdempotencyError = class extends Error {
+  name = "ReviewDeckIdempotencyError";
+  constructor(message = "Idempotency key was reused with a different review request.") {
+    super(message);
+  }
+};
+var ReviewDeckInputError = class extends Error {
+  name = "ReviewDeckInputError";
+  constructor(message) {
+    super(message);
+  }
+};
+var LEDGER_ACTION = {
+  keep: "approve",
+  not_true: "dismiss",
+  undo: "undo"
+};
+var EVENT_TYPE = {
+  keep: "promoted",
+  not_true: "rejected",
+  undo: "restored"
+};
+function sha256Hex(value) {
+  return createHash7("sha256").update(value, "utf8").digest("hex");
+}
+function computeReceiptId(namespace, principalDigest, idempotencyKey) {
+  return `rcp1:${sha256Hex(`${namespace}\0${principalDigest}\0${idempotencyKey}`)}`;
+}
+function computeRequestFingerprint(parts) {
+  return `rfp1:${sha256Hex(parts.join("\0"))}`;
+}
+function actionFingerprint(ctx, itemId, action, expectedRevision, correctionText) {
+  const parts = [ctx.principalDigest, ctx.namespace, itemId, action, expectedRevision];
+  if (correctionText !== void 0) parts.push(correctionText);
+  return computeRequestFingerprint(parts);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isReceiptAction(value) {
+  return value === "approve" || value === "dismiss" || value === "undo";
+}
+function parseReviewLifecycleReceipt(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  const rec = value;
+  if (rec.schemaVersion !== 1) return null;
+  if (!isNonEmptyString(rec.receiptId)) return null;
+  if (!isNonEmptyString(rec.requestFingerprint)) return null;
+  if (!isNonEmptyString(rec.principalDigest)) return null;
+  if (!isNonEmptyString(rec.itemId)) return null;
+  if (!isReceiptAction(rec.action)) return null;
+  if (typeof rec.beforeRevision !== "string") return null;
+  if (typeof rec.afterRevision !== "string") return null;
+  if (!isNonEmptyString(rec.sourcePath) || path14.isAbsolute(rec.sourcePath)) return null;
+  if (rec.revisionArtifact !== void 0 && typeof rec.revisionArtifact !== "string") return null;
+  if (rec.undoOfReceiptId !== void 0 && typeof rec.undoOfReceiptId !== "string") return null;
+  const parsed = {
+    schemaVersion: 1,
+    receiptId: rec.receiptId,
+    requestFingerprint: rec.requestFingerprint,
+    principalDigest: rec.principalDigest,
+    itemId: rec.itemId,
+    action: rec.action,
+    beforeRevision: rec.beforeRevision,
+    afterRevision: rec.afterRevision,
+    sourcePath: rec.sourcePath
+  };
+  if (typeof rec.revisionArtifact === "string") parsed.revisionArtifact = rec.revisionArtifact;
+  if (typeof rec.undoOfReceiptId === "string") parsed.undoOfReceiptId = rec.undoOfReceiptId;
+  return parsed;
+}
+function asStoredEvent(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function findStoredReceipt(events, receiptId) {
+  for (const raw of events) {
+    const event = asStoredEvent(raw);
+    if (!event) continue;
+    const receipt = parseReviewLifecycleReceipt(event.reviewReceipt);
+    if (receipt && receipt.receiptId === receiptId) return { event, receipt };
+  }
+  return null;
+}
+function resolveInside(memoryDir, rel) {
+  if (!rel || path14.isAbsolute(rel)) return null;
+  const root = path14.resolve(memoryDir);
+  const abs = path14.resolve(root, rel.split("/").join(path14.sep));
+  const next = path14.relative(root, abs);
+  if (next.startsWith("..") || path14.isAbsolute(next)) return null;
+  return abs;
+}
+function currentRevision(absPath) {
+  try {
+    return computeReviewItemRevision(fs3.readFileSync(absPath, "utf8"));
+  } catch {
+    return "";
+  }
+}
+function publicReceipt(input) {
+  return {
+    schemaVersion: 1,
+    receiptId: input.receiptId,
+    itemId: input.itemId,
+    action: input.action,
+    outcome: input.outcome,
+    effect: input.effect,
+    undoAvailable: input.undoAvailable,
+    ...input.appliedRevision !== void 0 ? { appliedRevision: input.appliedRevision } : {},
+    ...input.correctionPlanId !== void 0 ? { correctionPlanId: input.correctionPlanId } : {},
+    ...input.correctionPreview !== void 0 ? { correctionPreview: input.correctionPreview } : {}
+  };
+}
+async function snapshotForUndo(filePath, memoryDir) {
+  try {
+    const content = fs3.readFileSync(filePath, "utf8");
+    const version = await createVersion(
+      filePath,
+      content,
+      "manual",
+      DECK_VERSIONING,
+      void 0,
+      void 0,
+      memoryDir
+    );
+    return version.versionId;
+  } catch {
+    return void 0;
+  }
+}
+async function artifactReadable(filePath, versionId, memoryDir) {
+  try {
+    await getVersion(filePath, versionId, DECK_VERSIONING, memoryDir);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function undoTargetRevision(receipt, createdRel) {
+  const created = createdRel && createdRel !== receipt.sourcePath ? createdRel : void 0;
+  if (receipt.action === "approve" && created) return created;
+  return receipt.sourcePath;
+}
+async function honestUndoAvailable(ctx, receipt, createdRel) {
+  if (!receipt.revisionArtifact || receipt.action === "undo") return false;
+  const sourceAbs = resolveInside(ctx.memoryDir, receipt.sourcePath);
+  if (!sourceAbs) return false;
+  if (!await artifactReadable(sourceAbs, receipt.revisionArtifact, ctx.memoryDir)) return false;
+  const targetRel = undoTargetRevision(receipt, createdRel);
+  const targetAbs = resolveInside(ctx.memoryDir, targetRel);
+  if (!targetAbs) return false;
+  return currentRevision(targetAbs) === receipt.afterRevision;
+}
+async function replayReceipt(ctx, hit, action) {
+  const stored = hit.event.reviewDeckReceipt;
+  const undoAvailable = await honestUndoAvailable(ctx, hit.receipt, hit.event.reviewCreatedPath);
+  if (stored && stored.schemaVersion === 1 && stored.receiptId === hit.receipt.receiptId) {
+    return {
+      ...stored,
+      undoAvailable,
+      appliedRevision: stored.appliedRevision ?? hit.receipt.afterRevision
+    };
+  }
+  return publicReceipt({
+    receiptId: hit.receipt.receiptId,
+    itemId: hit.receipt.itemId,
+    action,
+    outcome: "applied",
+    effect: action === "keep" ? KEEP_EFFECT : action === "not_true" ? NOT_TRUE_EFFECT : UNDO_EFFECT,
+    undoAvailable,
+    appliedRevision: hit.receipt.afterRevision
+  });
+}
+function applyKeepOrNotTrueSync(input) {
+  let current;
+  try {
+    current = fs3.readFileSync(input.filePath, "utf8");
+  } catch {
+    return { kind: "failed" };
+  }
+  const currentRev = computeReviewItemRevision(current);
+  if (currentRev !== input.expectedRevision) {
+    return { kind: "conflict", current: currentRev };
+  }
+  const result = performReview(
+    input.memoryDir,
+    input.itemId,
+    input.action === "keep" ? "approve" : "dismiss",
+    { onApproveBlockedMemory: input.onApproveBlockedMemory }
+  );
+  if (result.message === "Item not found" || result.message === "Could not parse frontmatter") {
+    return { kind: "failed" };
+  }
+  if (result.updatedPath && fs3.existsSync(result.updatedPath)) {
+    return {
+      kind: "applied",
+      afterRevision: computeReviewItemRevision(fs3.readFileSync(result.updatedPath, "utf8")),
+      createdAbs: result.updatedPath
+    };
+  }
+  return { kind: "applied", afterRevision: "" };
+}
+async function appendAppliedEvent(ctx, input) {
+  const event = {
+    eventId: `mle-${randomUUID()}`,
+    memoryId: input.itemId,
+    eventType: EVENT_TYPE[input.action],
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    actor: ACTOR,
+    ruleVersion: RULE_VERSION,
+    reviewReceipt: input.receipt,
+    reviewNamespace: ctx.namespace,
+    reviewDeckReceipt: input.publicReceipt,
+    before: { path: input.receipt.sourcePath },
+    ...input.createdRel ? { after: { path: input.createdRel }, reviewCreatedPath: input.createdRel } : {},
+    ...input.undoOfReceiptId ? { relatedMemoryIds: [input.itemId] } : {}
+  };
+  await ctx.appendLifecycleEvents([event]);
+}
+async function executeReviewDeckAction(ctx, req) {
+  throwIfAborted(ctx.signal);
+  if (req.schemaVersion !== 1) throw new ReviewDeckInputError("schemaVersion must be 1");
+  if (!isNonEmptyString(req.itemId)) throw new ReviewDeckInputError("itemId is required");
+  if (!isNonEmptyString(req.revision)) throw new ReviewDeckInputError("revision is required");
+  if (!isNonEmptyString(req.idempotencyKey)) throw new ReviewDeckInputError("idempotencyKey is required");
+  const receiptId = computeReceiptId(ctx.namespace, ctx.principalDigest, req.idempotencyKey);
+  if (req.action === "prepare_fix") {
+    const correctionText = req.correctionText;
+    if (typeof correctionText !== "string" || correctionText.trim() === "") {
+      throw new ReviewDeckInputError("correctionText is required");
+    }
+    if (!ctx.planCorrection) {
+      return publicReceipt({
+        receiptId,
+        itemId: req.itemId,
+        action: "prepare_fix",
+        outcome: "failed",
+        effect: PLAN_FAILED_EFFECT,
+        undoAvailable: false
+      });
+    }
+    const planned = await ctx.planCorrection({ itemId: req.itemId, correctionText });
+    if (!planned.planId) {
+      return publicReceipt({
+        receiptId,
+        itemId: req.itemId,
+        action: "prepare_fix",
+        outcome: "failed",
+        effect: planned.message?.trim() || PLAN_FAILED_EFFECT,
+        undoAvailable: false
+      });
+    }
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: "prepare_fix",
+      outcome: "planned",
+      effect: PLANNED_EFFECT,
+      undoAvailable: false,
+      correctionPlanId: planned.planId,
+      correctionPreview: planned.preview
+    });
+  }
+  if (req.action !== "keep" && req.action !== "not_true") {
+    throw new ReviewDeckInputError("unsupported review deck action");
+  }
+  const fingerprint = actionFingerprint(ctx, req.itemId, req.action, req.revision);
+  const existing = findStoredReceipt(await ctx.readLifecycleEvents(), receiptId);
+  if (existing) {
+    if (existing.receipt.requestFingerprint !== fingerprint) throw new ReviewDeckIdempotencyError();
+    return replayReceipt(ctx, existing, req.action);
+  }
+  const row = readReviewDeckRow({ memoryDir: ctx.memoryDir, itemId: req.itemId });
+  if (!row) {
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: req.action,
+      outcome: "failed",
+      effect: MISSING_EFFECT,
+      undoAvailable: false
+    });
+  }
+  throwIfAborted(ctx.signal);
+  const revisionArtifact = await snapshotForUndo(row.filePath, ctx.memoryDir);
+  throwIfAborted(ctx.signal);
+  const applied = applyKeepOrNotTrueSync({
+    memoryDir: ctx.memoryDir,
+    itemId: req.itemId,
+    filePath: row.filePath,
+    expectedRevision: req.revision,
+    action: req.action,
+    onApproveBlockedMemory: ctx.onApproveBlockedMemory
+  });
+  if (applied.kind === "conflict") {
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: req.action,
+      outcome: "conflict",
+      effect: CONFLICT_EFFECT,
+      undoAvailable: false,
+      appliedRevision: applied.current
+    });
+  }
+  if (applied.kind === "failed") {
+    return publicReceipt({
+      receiptId,
+      itemId: req.itemId,
+      action: req.action,
+      outcome: "failed",
+      effect: MISSING_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const sourcePath = toMemoryPathRel(ctx.memoryDir, row.filePath);
+  const createdRel = applied.createdAbs ? toMemoryPathRel(ctx.memoryDir, applied.createdAbs) : void 0;
+  const ledgerReceipt = {
+    schemaVersion: 1,
+    receiptId,
+    requestFingerprint: fingerprint,
+    principalDigest: ctx.principalDigest,
+    itemId: req.itemId,
+    action: LEDGER_ACTION[req.action],
+    beforeRevision: req.revision,
+    afterRevision: applied.afterRevision,
+    sourcePath,
+    ...revisionArtifact ? { revisionArtifact } : {}
+  };
+  const undoAvailable = Boolean(revisionArtifact);
+  const published = publicReceipt({
+    receiptId,
+    itemId: req.itemId,
+    action: req.action,
+    outcome: "applied",
+    effect: req.action === "keep" ? KEEP_EFFECT : NOT_TRUE_EFFECT,
+    undoAvailable,
+    appliedRevision: applied.afterRevision
+  });
+  await appendAppliedEvent(ctx, {
+    itemId: req.itemId,
+    action: req.action,
+    receipt: ledgerReceipt,
+    createdRel,
+    publicReceipt: published
+  });
+  return published;
+}
+async function executeReviewDeckUndo(ctx, req) {
+  throwIfAborted(ctx.signal);
+  if (req.schemaVersion !== 1) throw new ReviewDeckInputError("schemaVersion must be 1");
+  if (!isNonEmptyString(req.receiptId)) throw new ReviewDeckInputError("receiptId is required");
+  if (typeof req.expectedRevision !== "string") throw new ReviewDeckInputError("expectedRevision is required");
+  if (!isNonEmptyString(req.idempotencyKey)) throw new ReviewDeckInputError("idempotencyKey is required");
+  const undoReceiptId = computeReceiptId(ctx.namespace, ctx.principalDigest, req.idempotencyKey);
+  const events = await ctx.readLifecycleEvents();
+  const original = findStoredReceipt(events, req.receiptId);
+  if (!original) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: "",
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const scopeOk = original.receipt.principalDigest === ctx.principalDigest && original.event.reviewNamespace === ctx.namespace;
+  if (!scopeOk) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: "",
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const fingerprint = actionFingerprint(
+    ctx,
+    original.receipt.itemId,
+    "undo",
+    req.expectedRevision
+  );
+  const priorUndo = findStoredReceipt(events, undoReceiptId);
+  if (priorUndo) {
+    if (priorUndo.receipt.requestFingerprint !== fingerprint) throw new ReviewDeckIdempotencyError();
+    return replayReceipt(ctx, priorUndo, "undo");
+  }
+  if (req.expectedRevision !== original.receipt.afterRevision) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "conflict",
+      effect: UNDO_CONFLICT_EFFECT,
+      undoAvailable: false
+    });
+  }
+  const createdRel = original.event.reviewCreatedPath;
+  const targetRel = undoTargetRevision(original.receipt, createdRel);
+  const targetAbs = resolveInside(ctx.memoryDir, targetRel);
+  const sourceAbs = resolveInside(ctx.memoryDir, original.receipt.sourcePath);
+  if (!targetAbs || !sourceAbs) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  if (currentRevision(targetAbs) !== original.receipt.afterRevision) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "conflict",
+      effect: UNDO_CONFLICT_EFFECT,
+      undoAvailable: false,
+      appliedRevision: currentRevision(targetAbs)
+    });
+  }
+  if (!original.receipt.revisionArtifact) {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  throwIfAborted(ctx.signal);
+  try {
+    await revertToVersion(
+      sourceAbs,
+      original.receipt.revisionArtifact,
+      DECK_VERSIONING,
+      void 0,
+      ctx.memoryDir
+    );
+  } catch {
+    return publicReceipt({
+      receiptId: undoReceiptId,
+      itemId: original.receipt.itemId,
+      action: "undo",
+      outcome: "failed",
+      effect: UNDO_FAILED_EFFECT,
+      undoAvailable: false
+    });
+  }
+  if (createdRel && createdRel !== original.receipt.sourcePath) {
+    const createdAbs = resolveInside(ctx.memoryDir, createdRel);
+    if (createdAbs && createdAbs !== sourceAbs && fs3.existsSync(createdAbs)) {
+      fs3.unlinkSync(createdAbs);
+    }
+  }
+  bumpMemoryCorpusVersionForDir(ctx.memoryDir);
+  const afterRevision = currentRevision(sourceAbs);
+  const ledgerReceipt = {
+    schemaVersion: 1,
+    receiptId: undoReceiptId,
+    requestFingerprint: fingerprint,
+    principalDigest: ctx.principalDigest,
+    itemId: original.receipt.itemId,
+    action: "undo",
+    beforeRevision: original.receipt.afterRevision,
+    afterRevision,
+    sourcePath: original.receipt.sourcePath,
+    undoOfReceiptId: original.receipt.receiptId
+  };
+  const published = publicReceipt({
+    receiptId: undoReceiptId,
+    itemId: original.receipt.itemId,
+    action: "undo",
+    outcome: "applied",
+    effect: UNDO_EFFECT,
+    undoAvailable: false,
+    appliedRevision: afterRevision
+  });
+  await appendAppliedEvent(ctx, {
+    itemId: original.receipt.itemId,
+    action: "undo",
+    receipt: ledgerReceipt,
+    publicReceipt: published,
+    undoOfReceiptId: original.receipt.receiptId
+  });
+  return published;
+}
+
+// src/review/review-deck-surface.ts
+function digest(value) {
+  return createHash8("sha256").update(value).digest("hex");
+}
+var ReviewDeckSurface = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async list(opts) {
+    const namespace = this.deps.resolveReadableNamespace(opts.namespace, opts.principal);
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    const snapshot = readReviewDeckSnapshot({ memoryDir: storage.dir, namespace });
+    try {
+      return buildReviewDeckPage(snapshot.rows, {
+        scope: {
+          principalDigest: digest(opts.principal ?? ""),
+          namespace,
+          filterDigest: digest(""),
+          corpusVersion: snapshot.corpusVersion
+        },
+        cursor: opts.cursor,
+        limit: opts.limit
+      });
+    } catch (error) {
+      if (error instanceof ReviewDeckCursorError) {
+        throw new EngramAccessInputError(error.message);
+      }
+      throw error;
+    }
+  }
+  async action(req, opts) {
+    return executeReviewDeckAction(await this.mutationContext(opts), req);
+  }
+  async undo(req, opts) {
+    return executeReviewDeckUndo(await this.mutationContext(opts), req);
+  }
+  async mutationContext(opts) {
+    const namespace = this.deps.writableNamespaceFor(opts.namespace, void 0, opts.principal);
+    this.deps.resolveReadableNamespace(namespace, opts.principal);
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    return {
+      memoryDir: storage.dir,
+      namespace,
+      principalDigest: digest(opts.principal ?? ""),
+      appendLifecycleEvents: async (events) => {
+        await storage.appendMemoryLifecycleEvents(events);
+      },
+      readLifecycleEvents: (memoryId) => memoryId ? storage.getMemoryTimeline(memoryId) : storage.readMemoryLifecycleEvents(),
+      onApproveBlockedMemory: (tombstoneId) => {
+        void storage.revokeTombstone(tombstoneId, "user_correction").catch(() => void 0);
+      },
+      planCorrection: async ({ itemId, correctionText }) => {
+        const plan = await this.deps.correctionPlan(
+          {
+            text: correctionText,
+            targetIds: [itemId],
+            principal: opts.principal,
+            namespace
+          },
+          opts.signal ? { abortSignal: opts.signal } : void 0
+        );
+        return { planId: plan.planId, preview: plan };
+      },
+      signal: opts.signal
+    };
+  }
+};
+
 // src/support-passport/card-service.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/support-passport/errors.ts
 var SupportPassportError = class extends Error {
@@ -10542,14 +11951,14 @@ async function completeSupportPassportReplacementPrior(input) {
 }
 
 // src/support-passport/generated-batch.ts
-import path13 from "path";
+import path16 from "path";
 import { z as z2 } from "zod";
 
 // src/support-passport/private-file.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { constants as fsConstants } from "fs";
 import { lstat as lstat3, mkdir as mkdir3, open, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
-import path12 from "path";
+import path15 from "path";
 var UNSUPPORTED_DIRECTORY_SYNC_ERRORS = /* @__PURE__ */ new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
 var NON_WRITABLE_ANCESTOR_SYNC_ERRORS = /* @__PURE__ */ new Set(["EROFS", "EPERM", "EACCES"]);
 function assertStableDirectory(before, opened, after, errorMessage) {
@@ -10575,8 +11984,8 @@ function openFlags(...flags) {
   return combined;
 }
 function assertContainedPath(trustedRoot, directory, errorMessage) {
-  const relative2 = path12.relative(path12.resolve(trustedRoot), path12.resolve(directory));
-  if (relative2 === ".." || relative2.startsWith(`..${path12.sep}`) || path12.isAbsolute(relative2)) {
+  const relative2 = path15.relative(path15.resolve(trustedRoot), path15.resolve(directory));
+  if (relative2 === ".." || relative2.startsWith(`..${path15.sep}`) || path15.isAbsolute(relative2)) {
     throw new Error(errorMessage);
   }
 }
@@ -10609,7 +12018,7 @@ async function syncDirectoryHandle(handle) {
 }
 async function resolvePrivateDirectoryPath(directory, handle, opened, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const pinnedPath = path12.join(descriptorRoot, String(handle.fd));
+  const pinnedPath = path15.join(descriptorRoot, String(handle.fd));
   const metadata = await stat2(pinnedPath);
   if (!metadata.isDirectory() || metadata.dev !== opened.dev || metadata.ino !== opened.ino) {
     throw new Error(errorMessage);
@@ -10625,12 +12034,12 @@ function requirePrivateFileDescriptorRoot(platform, errorMessage) {
   throw new Error(errorMessage);
 }
 async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform = process.platform) {
-  const root = path12.resolve(trustedRoot);
-  const target = path12.resolve(directory);
+  const root = path15.resolve(trustedRoot);
+  const target = path15.resolve(directory);
   assertContainedPath(root, target, errorMessage);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const relative2 = path12.relative(root, target);
-  const components = relative2 === "" ? [] : relative2.split(path12.sep);
+  const relative2 = path15.relative(root, target);
+  const components = relative2 === "" ? [] : relative2.split(path15.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -10638,10 +12047,10 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const child = await openDirectoryNoFollow(path12.join(pinnedParent, component), errorMessage);
+      const child = await openDirectoryNoFollow(path15.join(pinnedParent, component), errorMessage);
       handles.push(child.handle);
       assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
-      currentPath = path12.join(currentPath, component);
+      currentPath = path15.join(currentPath, component);
       current = child;
     }
     assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
@@ -10662,12 +12071,12 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
   }
 }
 async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, hardenExistingChildren = true, platform = process.platform) {
-  const root = path12.resolve(trustedRoot);
-  const target = path12.resolve(directory);
+  const root = path15.resolve(trustedRoot);
+  const target = path15.resolve(directory);
   assertContainedPath(root, target, errorMessage);
-  const relative2 = path12.relative(root, target);
+  const relative2 = path15.relative(root, target);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const components = relative2 === "" ? [] : relative2.split(path12.sep);
+  const components = relative2 === "" ? [] : relative2.split(path15.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -10675,7 +12084,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const childPath = path12.join(pinnedParent, component);
+      const childPath = path15.join(pinnedParent, component);
       let created = false;
       try {
         await mkdir3(childPath, { mode: 448 });
@@ -10690,7 +12099,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
         await child.handle.chmod(448);
       }
       assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
-      currentPath = path12.join(currentPath, component);
+      currentPath = path15.join(currentPath, component);
       current = child;
     }
     assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
@@ -10699,8 +12108,8 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
   }
 }
 async function ensurePrivateDirectoryTreeNoFollow(directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, platform = process.platform) {
-  const target = path12.resolve(directory);
-  const filesystemRoot = path12.parse(target).root;
+  const target = path15.resolve(directory);
+  const filesystemRoot = path15.parse(target).root;
   const rootMetadata = await stat2(filesystemRoot);
   await ensurePrivateDirectoryNoFollow(
     filesystemRoot,
@@ -10735,15 +12144,15 @@ async function withPrivateDirectoryNoFollow(trustedRoot, directory, errorMessage
   }
 }
 async function readPrivateFileNoFollow(directory, filePath, errorMessage, trustedRoot = directory, platform = process.platform) {
-  if (path12.dirname(filePath) !== path12.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path12.basename(filePath);
+  if (path15.dirname(filePath) !== path15.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path15.basename(filePath);
   let directoryHandles = [];
   let fileHandle;
   try {
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    const targetPath = path12.join(pinnedDirectory, targetName);
+    const targetPath = path15.join(pinnedDirectory, targetName);
     const before = await lstat3(targetPath);
     if (before.isSymbolicLink() || !before.isFile()) throw new Error(errorMessage);
     try {
@@ -10762,10 +12171,10 @@ async function readPrivateFileNoFollow(directory, filePath, errorMessage, truste
   }
 }
 async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, content, errorMessage, directoryHandle, openFile) {
-  if (targetName.length === 0 || targetName === "." || targetName === ".." || path12.basename(targetName) !== targetName) {
+  if (targetName.length === 0 || targetName === "." || targetName === ".." || path15.basename(targetName) !== targetName) {
     throw new Error(errorMessage);
   }
-  const targetPath = path12.join(pinnedDirectory, targetName);
+  const targetPath = path15.join(pinnedDirectory, targetName);
   let fileHandle;
   try {
     try {
@@ -10801,8 +12210,8 @@ async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, c
 }
 async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, content, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const resolvedDirectory = path12.resolve(pinnedDirectory);
-  const descriptor = path12.relative(descriptorRoot, resolvedDirectory);
+  const resolvedDirectory = path15.resolve(pinnedDirectory);
+  const descriptor = path15.relative(descriptorRoot, resolvedDirectory);
   if (!/^\d+$/.test(descriptor)) throw new Error(errorMessage);
   const before = await stat2(resolvedDirectory);
   if (!before.isDirectory()) throw new Error(errorMessage);
@@ -10818,9 +12227,9 @@ async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, con
   }
 }
 async function writePrivateFileAtomicallyNoFollow(directory, filePath, content, errorMessage, trustedRoot = directory, platform = process.platform, syncVerifiedDirectory = syncDirectoryHandle) {
-  if (path12.dirname(filePath) !== path12.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path12.basename(filePath);
-  const tempName = `.${targetName}.${randomUUID()}.tmp`;
+  if (path15.dirname(filePath) !== path15.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path15.basename(filePath);
+  const tempName = `.${targetName}.${randomUUID2()}.tmp`;
   let tempPath;
   let directoryHandles = [];
   let fileHandle;
@@ -10828,8 +12237,8 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    tempPath = path12.join(pinnedDirectory, tempName);
-    const targetPath = path12.join(pinnedDirectory, targetName);
+    tempPath = path15.join(pinnedDirectory, tempName);
+    const targetPath = path15.join(pinnedDirectory, targetName);
     try {
       fileHandle = await open(
         tempPath,
@@ -10866,7 +12275,7 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
 }
 async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, trustedRoot = directory, platform = process.platform) {
   if (fileNames.some(
-    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path12.basename(fileName) !== fileName
+    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path15.basename(fileName) !== fileName
   )) {
     throw new Error(errorMessage);
   }
@@ -10876,7 +12285,7 @@ async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, tr
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
     for (const fileName of fileNames) {
-      await rm2(path12.join(pinnedDirectory, fileName), { force: true });
+      await rm2(path15.join(pinnedDirectory, fileName), { force: true });
     }
     assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
     if (stableDirectory.handle) await syncDirectoryHandle(stableDirectory.handle);
@@ -10897,13 +12306,13 @@ var GeneratedBatchMarkerSchema = z2.object({
 }).strict();
 var BATCH_ERROR = "The generated draft batch state is not safe.";
 function batchDirectory(storage) {
-  return path13.join(storage.dir, "state", "support-passport", "generated-batches");
+  return path16.join(storage.dir, "state", "support-passport", "generated-batches");
 }
 function batchFileName(batchId) {
   return `${BatchIdSchema.parse(batchId)}.json`;
 }
 function batchPath(storage, batchId) {
-  return path13.join(batchDirectory(storage), batchFileName(batchId));
+  return path16.join(batchDirectory(storage), batchFileName(batchId));
 }
 function markerFor(context, batchId, size, complete) {
   return GeneratedBatchMarkerSchema.parse({
@@ -11327,19 +12736,19 @@ var SupportPassportAnswerModelInputSchema = z4.object({
 }).strict();
 
 // src/support-passport/owner-lock.ts
-import { createHash as createHash6 } from "crypto";
-import path14 from "path";
+import { createHash as createHash9 } from "crypto";
+import path17 from "path";
 var CARD_MUTATION_LOCK_STALE_MS = 6e4;
 var CARD_MUTATION_LOCK_MAX_WAIT_MS = 3e4;
 function computeSupportPassportOwnerLockKey(namespace, principal) {
-  return createHash6("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
+  return createHash9("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
 }
 function supportPassportOwnerLockPath(storage, scope) {
   const ownerLockKey = scope.ownerKey ?? computeSupportPassportOwnerLockKey(scope.namespace, scope.principal);
   if (!/^[a-f0-9]{64}$/.test(ownerLockKey)) {
     throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
   }
-  return path14.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
+  return path17.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
 }
 async function withSupportPassportOwnerLock(storage, scope, task) {
   const lockPath = supportPassportOwnerLockPath(storage, scope);
@@ -11447,7 +12856,7 @@ var SupportPassportCardService = class {
     const onCommitted = once(input.onCommitted);
     return await withSupportPassportOwnerLock(storage, { namespace, principal }, async (lock) => {
       const batchContext = this.generatedBatchContext(storage, lock, principal, namespace, onCommitted);
-      const batchId = randomUUID2();
+      const batchId = randomUUID3();
       const created = [];
       const createdIds = [];
       const createdRecords = [];
@@ -12235,9 +13644,9 @@ var SupportPassportCardService = class {
 };
 
 // src/support-passport/grant-store.ts
-import { createHash as createHash7, randomBytes, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+import { createHash as createHash10, randomBytes, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
 import { lstat as lstat4, open as open2, readdir as readdir4 } from "fs/promises";
-import path15 from "path";
+import path18 from "path";
 var GRANT_LOCK_STALE_MS = 3e4;
 var GRANT_LOCK_WAIT_MS = 5e3;
 var GRANT_LOCK_HEARTBEAT_MS = 1e4;
@@ -12260,7 +13669,7 @@ var MalformedGrantStateError = class extends Error {
   }
 };
 function sha256(domain, value) {
-  return createHash7("sha256").update(domain).update("\0").update(value).digest("hex");
+  return createHash10("sha256").update(domain).update("\0").update(value).digest("hex");
 }
 function hashesMatch(left, right) {
   const leftBytes = Buffer.from(left, "hex");
@@ -12329,12 +13738,12 @@ var SupportPassportGrantStore = class {
   runWithHeldFileLock;
   syncDirectory;
   constructor(options) {
-    this.memoryDir = path15.resolve(expandTildePath(options.memoryDir));
-    this.grantsDir = path15.join(this.memoryDir, "state", "support-passport", "grants");
-    this.ownerIndexesDir = path15.join(this.grantsDir, "owners");
+    this.memoryDir = path18.resolve(expandTildePath(options.memoryDir));
+    this.grantsDir = path18.join(this.memoryDir, "state", "support-passport", "grants");
+    this.ownerIndexesDir = path18.join(this.grantsDir, "owners");
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.makeSecret = options.makeSecret ?? (() => randomBytes(32));
-    this.makeGrantId = options.makeGrantId ?? randomUUID3;
+    this.makeGrantId = options.makeGrantId ?? randomUUID4;
     this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
     this.syncDirectory = options.syncDirectory ?? syncDirectoryForDurability;
   }
@@ -12544,11 +13953,11 @@ var SupportPassportGrantStore = class {
   }
   filePath(grantId) {
     const normalizedGrantId = normalizeGrantId(grantId);
-    return path15.join(this.grantsDir, `${normalizedGrantId}.json`);
+    return path18.join(this.grantsDir, `${normalizedGrantId}.json`);
   }
   ownerIndexPath(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path15.join(this.ownerIndexesDir, `${ownerHash}.json`);
+    return path18.join(this.ownerIndexesDir, `${ownerHash}.json`);
   }
   ownerHash(namespace, principalHash) {
     return sha256("support-passport-owner-index:v1", `${namespace}\0${principalHash}`);
@@ -12604,12 +14013,12 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       grantIds.map((grantId) => `${grantId}.json`),
       "support passport grant files must be regular files in a stable directory",
-      path15.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   ownerMembershipDirectory(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path15.join(this.ownerIndexesDir, ownerHash);
+    return path18.join(this.ownerIndexesDir, ownerHash);
   }
   async ensureOwnerMembershipDirectory(ownerHash) {
     const directory = this.ownerMembershipDirectory(ownerHash);
@@ -12624,11 +14033,11 @@ var SupportPassportGrantStore = class {
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     await writePrivateFileAtomicallyNoFollow(
       directory,
-      path15.join(directory, `${state.grantId}.json`),
+      path18.join(directory, `${state.grantId}.json`),
       `${JSON.stringify({ schemaVersion: 1, grantId: state.grantId })}
 `,
       "support passport owner membership must be regular files in a stable directory",
-      path15.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async removeOwnerMembership(state) {
@@ -12638,7 +14047,7 @@ var SupportPassportGrantStore = class {
       directory,
       [`${state.grantId}.json`],
       "support passport owner membership must be regular files in a stable directory",
-      path15.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async removeStoredGrant(state) {
@@ -12739,7 +14148,7 @@ var SupportPassportGrantStore = class {
     const ownerHash = this.ownerHash(namespace, principalHash);
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     const grantIds = await withPrivateDirectoryNoFollow(
-      path15.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       directory,
       "support passport owner membership must be regular files in a stable directory",
       async (pinnedDirectory) => {
@@ -12770,7 +14179,7 @@ var SupportPassportGrantStore = class {
         this.ownerIndexesDir,
         filePath,
         "support passport owner indexes must be regular files in a stable directory",
-        path15.parse(this.memoryDir).root
+        path18.parse(this.memoryDir).root
       );
     } catch (error) {
       if (error.code === "ENOENT") return [];
@@ -12810,7 +14219,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify({ schemaVersion: 1, ownerHash, grantIds }, null, 2)}
 `,
       "support passport owner indexes must be regular files in a stable directory",
-      path15.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async readState(grantId) {
@@ -12820,7 +14229,7 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       filePath,
       "support passport grant files must be regular files in a stable directory",
-      path15.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
     try {
       const state = SupportPassportGrantStateSchema.parse(JSON.parse(content));
@@ -12854,7 +14263,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify(state, null, 2)}
 `,
       "support passport grant files must be regular files in a stable directory",
-      path15.parse(this.memoryDir).root
+      path18.parse(this.memoryDir).root
     );
   }
   async ensureSafeDirectories() {
@@ -12888,8 +14297,8 @@ var SupportPassportGrantStore = class {
           void 0
         );
         this.memoryDir = configuredMemoryDir;
-        this.grantsDir = path15.join(configuredMemoryDir, "state", "support-passport", "grants");
-        this.ownerIndexesDir = path15.join(this.grantsDir, "owners");
+        this.grantsDir = path18.join(configuredMemoryDir, "state", "support-passport", "grants");
+        this.ownerIndexesDir = path18.join(this.grantsDir, "owners");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -12903,12 +14312,12 @@ var SupportPassportGrantStore = class {
   async withMutationLock(task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path15.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grants:${this.grantsDir}`,
-        path15.join(pinnedDirectory, ".grants.lock"),
+        path18.join(pinnedDirectory, ".grants.lock"),
         task
       )
     );
@@ -12917,12 +14326,12 @@ var SupportPassportGrantStore = class {
     const normalizedGrantId = normalizeGrantId(grantId);
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path15.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grant:${this.grantsDir}:${normalizedGrantId}`,
-        path15.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
+        path18.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
         task
       )
     );
@@ -12930,12 +14339,12 @@ var SupportPassportGrantStore = class {
   async withOwnerIndexLock(ownerHash, task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path15.parse(this.memoryDir).root,
+      path18.parse(this.memoryDir).root,
       this.ownerIndexesDir,
       "support passport owner lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-owner:${this.ownerIndexesDir}:${ownerHash}`,
-        path15.join(pinnedDirectory, `.${ownerHash}.lock`),
+        path18.join(pinnedDirectory, `.${ownerHash}.lock`),
         task
       )
     );
@@ -13772,8 +15181,8 @@ var SupportPassportModelAdapter = class {
 };
 
 // src/support-passport/model-audit.ts
-import { createHash as createHash8 } from "crypto";
-import path16 from "path";
+import { createHash as createHash11 } from "crypto";
+import path19 from "path";
 import { z as z5 } from "zod";
 var HashSchema = z5.string().regex(/^[a-f0-9]{64}$/);
 var SupportPassportModelAuditRecordSchema = z5.object({
@@ -13810,7 +15219,7 @@ var SupportPassportModelAuditRecordSchema = z5.object({
   }
 });
 function hashSupportPassportAuditValues(domain, values) {
-  return createHash8("sha256").update(`support-passport-audit:${domain}:v1`).update("\0").update([...values].sort().join("\0")).digest("hex");
+  return createHash11("sha256").update(`support-passport-audit:${domain}:v1`).update("\0").update([...values].sort().join("\0")).digest("hex");
 }
 var SupportPassportModelAuditStore = class {
   memoryDir;
@@ -13818,15 +15227,15 @@ var SupportPassportModelAuditStore = class {
   memoryRootReady;
   runWithHeldFileLock;
   constructor(options) {
-    this.memoryDir = path16.resolve(expandTildePath(options.memoryDir));
-    this.auditDir = path16.join(this.memoryDir, "state", "support-passport", "audit");
+    this.memoryDir = path19.resolve(expandTildePath(options.memoryDir));
+    this.auditDir = path19.join(this.memoryDir, "state", "support-passport", "audit");
     this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
   }
   async record(input) {
     const record = SupportPassportModelAuditRecordSchema.parse(input);
     await this.ensureSafeDirectories();
     const day = record.occurredAt.slice(0, 10);
-    const filePath = path16.join(this.auditDir, `${day}.jsonl`);
+    const filePath = path19.join(this.auditDir, `${day}.jsonl`);
     await serializeMutations(
       `support-passport-audit:${filePath}`,
       () => withPrivateDirectoryNoFollow(
@@ -13834,7 +15243,7 @@ var SupportPassportModelAuditStore = class {
         this.auditDir,
         "support passport audit directory must remain inside the memory directory",
         async (pinnedDirectory) => await this.runWithHeldFileLock(
-          path16.join(pinnedDirectory, `.${day}.lock`),
+          path19.join(pinnedDirectory, `.${day}.lock`),
           {
             staleMs: 3e4,
             maxWaitMs: 5e3,
@@ -13871,7 +15280,7 @@ var SupportPassportModelAuditStore = class {
           "support passport memory directory must be a stable directory"
         );
         this.memoryDir = configuredMemoryDir;
-        this.auditDir = path16.join(configuredMemoryDir, "state", "support-passport", "audit");
+        this.auditDir = path19.join(configuredMemoryDir, "state", "support-passport", "audit");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -13885,7 +15294,7 @@ var SupportPassportModelAuditStore = class {
 };
 
 // src/support-passport/model-service.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { z as z6 } from "zod";
 var DraftServiceInputSchema = z6.object({
   principal: z6.string().trim().min(1).max(512),
@@ -13921,7 +15330,7 @@ function supportPassportSourceContent(memory) {
   return hasStructuredAttributes(memory.frontmatter.structuredAttributes) ? stripAttributesSuffix(memory.content) : memory.content;
 }
 function computeSupportPassportSourceRevision(content, structuredAttributes) {
-  return createHash9("sha256").update("support-passport-source:v1\0").update(hasStructuredAttributes(structuredAttributes) ? stripAttributesSuffix(content) : content).digest("hex");
+  return createHash12("sha256").update("support-passport-source:v1\0").update(hasStructuredAttributes(structuredAttributes) ? stripAttributesSuffix(content) : content).digest("hex");
 }
 function isSupportPassportSourceEligible(memory) {
   const status = memory.frontmatter.status ?? "active";
@@ -14557,6 +15966,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     this.idempotency = new AccessIdempotencyStore(orchestrator.config.memoryDir);
     this.replicaDivergenceMonitor = new ReplicaDivergenceMonitor({ resolveSecretRef: options.resolveSecretRef });
     this.injectedSupportPassportGatewayRoute = options.supportPassportGatewayRoute ?? null;
+    this.reviewDeckEnabled = options.reviewDeckEnabled === true;
     const accessCaps = resolveAccessSetupCapabilities(orchestrator.config);
     this.budget = new CrossNamespaceBudget({
       enabled: accessCaps.recallCrossNamespaceBudget,
@@ -14596,6 +16006,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   corpusWatermarkCache = new CorpusWatermarkCache();
   replicaDivergenceMonitor;
   injectedSupportPassportGatewayRoute;
+  reviewDeckEnabled;
   /** AccessObserveWriteSurface (access-service decomposition). Lazy; selfDeps live wiring. */
   _accessObserveWriteSurface;
   get accessObserveWriteSurface() {
@@ -14624,6 +16035,15 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     }
     return this._accessAdminOpsSurface;
   }
+  _reviewDeckSurface;
+  get reviewDeckSurface() {
+    if (!this._reviewDeckSurface) {
+      this._reviewDeckSurface = new ReviewDeckSurface(
+        selfDeps(this)
+      );
+    }
+    return this._reviewDeckSurface;
+  }
   /** AccessRecallSurface (access-service decomposition). Lazy; selfDeps live wiring. */
   _accessRecallSurface;
   get accessRecallSurface() {
@@ -17407,8 +18827,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncSnapshot(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash10("sha256").update(storage.dir).digest("hex").slice(0, 16);
-    const deletions = [...await storage.readDeletionRevisions()].map(([path17, mtimeMs]) => ({ path: path17, mtimeMs }));
+    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const deletions = [...await storage.readDeletionRevisions()].map(([path20, mtimeMs]) => ({ path: path20, mtimeMs }));
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0 ? buildOfflineSyncSnapshotFromBase : buildOfflineSyncSnapshot;
     const snapshot = await snapshotBuilder({
       root: storage.dir,
@@ -17431,10 +18851,10 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncSnapshotStream(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash10("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
     const deletions = await filterOfflineSyncDeletionRevisions({
       root: storage.dir,
-      deletions: [...await storage.readDeletionRevisions()].map(([path17, mtimeMs]) => ({ path: path17, mtimeMs })),
+      deletions: [...await storage.readDeletionRevisions()].map(([path20, mtimeMs]) => ({ path: path20, mtimeMs })),
       includeTranscripts: options.includeTranscripts !== false,
       userExcludeRegexps: this.offlineSyncUserExcludes
     });
@@ -17471,7 +18891,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncFiles(options) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash10("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
     try {
       const snapshot = await buildOfflineSyncSnapshotForPaths({
         root: storage.dir,
@@ -17710,6 +19130,15 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async adminPromoteMemory(request) {
     return this.accessAdminOpsSurface.adminPromoteMemory(request);
   }
+  async reviewDeckList(opts) {
+    return this.reviewDeckSurface.list(opts);
+  }
+  async reviewDeckAction(...args) {
+    return this.reviewDeckSurface.action(...args);
+  }
+  async reviewDeckUndo(...args) {
+    return this.reviewDeckSurface.undo(...args);
+  }
 };
 
 // src/access-recall-concurrency.ts
@@ -18081,6 +19510,17 @@ export {
   RecallResultFormatter,
   assembleRecallResponse,
   AccessRecallSurface,
+  ReviewDeckCursorError,
+  computeReviewItemRevision,
+  projectReviewDeckItem,
+  compareReviewDeckRows,
+  encodeReviewDeckCursor,
+  decodeReviewDeckCursor,
+  buildReviewDeckPage,
+  listReviewItems,
+  performReview,
+  readReviewDeckSnapshot,
+  readReviewDeckRow,
   SupportPassportError,
   SupportPassportGrantCardRefSchema,
   SupportPassportGrantStateSchema,
@@ -18127,4 +19567,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-SB7D4BT7.js.map
+//# sourceMappingURL=chunk-AZLLH6YA.js.map