@remnic/core 9.69.46 → 9.69.47

package/dist/{chunk-TNQR7N52.js → chunk-S3YM4SZQ.js}

@@ -149,6 +149,7 @@ async function buildReconcileManifest(options) {
     }
   }
   for (let i = 0; i < uncached.length; i += MANIFEST_BUILD_BATCH_SIZE) {
+    options.signal?.throwIfAborted();
     const batch = uncached.slice(i, i + MANIFEST_BUILD_BATCH_SIZE);
     const results = await Promise.all(
       batch.map(
@@ -347,4 +348,4 @@ export {
   buildReconcileManifest,
   collapseActiveFactDuplicates
 };
-//# sourceMappingURL=chunk-TNQR7N52.js.map
+//# sourceMappingURL=chunk-S3YM4SZQ.js.map

package/dist/chunk-S3YM4SZQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reconcile/manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { computeLegacyContentHash, normalizeLegacyContent } from \"../content-hash.js\";\nimport { inferMemoryStatus } from \"../memory-lifecycle-ledger-utils.js\";\nimport { DEFAULT_CITATION_FORMAT, stripCitationForTemplate } from \"../source-attribution.js\";\nimport { ContentHashIndex, type ContentHashPathEntry } from \"../storage/content-hash-index.js\";\nimport { storedContentIdentityCandidates } from \"../structured-attributes.js\";\nimport type { MemoryFrontmatter, MemoryStatus } from \"../types.js\";\nimport { RECALL_FALLBACK_DIRS } from \"../utils/category-dir.js\";\nimport {\n  type ReconcileFileState,\n  type ReconcilePlan,\n  type ReconcilePlanEntry,\n  type ReconcileSemanticAgreement,\n  type ReconcileSemanticChange,\n  compareReconcilePlanEntries,\n  semanticAgreementKey,\n  summarizeReconcilePlan,\n} from \"./plan.js\";\n\nexport const RECONCILE_MANIFEST_FORMAT = \"remnic-reconcile-manifest\";\nexport const RECONCILE_MANIFEST_SCHEMA_VERSION = 1;\nexport const CONTENT_HASH_NORMALIZER_VERSION = 4;\n/**\n * Version of the identity-resolution LOGIC (alias recovery, candidate\n * ordering), independent of the content normalizer: a cached manifest entry\n * written before an identity-resolution change carries an older value and is\n * reparsed even when its normalizerVersion still matches (issue #2367\n * review round 2). Bump when parsedMemoryIdentity's output shape or\n * semantics change.\n */\nexport const IDENTITY_RESOLUTION_VERSION = 2;\n\n/**\n * Identity of the manifest-affecting implementation this peer builds\n * STREAMED manifests with. Advertised via offline-sync capabilities so the\n * client can key peer-side plan caches on it: a peer that upgrades its\n * normalization logic or citation template without rewriting stored files\n * keeps the same file hashes, and only this revision invalidates the stale\n * cached identities (#2803 / #2956 review).\n */\nexport function peerManifestRevision(citationTemplate?: string): string {\n  return `schema=${RECONCILE_MANIFEST_SCHEMA_VERSION};normalizer=${CONTENT_HASH_NORMALIZER_VERSION};identity=${IDENTITY_RESOLUTION_VERSION};citation=${citationTemplateFingerprint(citationTemplate)}`;\n}\n\nexport interface ReconcileMemoryIdentity {\n  id: string;\n  category: string;\n  contentHash: string;\n  /**\n   * Recovered current-normalizer identities for a record whose persisted hash\n   * is ambiguous under the legacy normalizer (issue #2367). The persisted\n   * hash stays primary; these participate in duplicate bucketing so a\n   * replica carrying the current form of the same fact still collapses.\n   */\n  contentHashAliases?: readonly string[];\n  /** See IDENTITY_RESOLUTION_VERSION; absent on pre-versioning cache entries. */\n  normalizerVersion?: number;\n  identityResolutionVersion?: number;\n  status: MemoryStatus;\n}\n\nexport interface ReconcileManifestFile extends ReconcileFileState {\n  memory?: ReconcileMemoryIdentity;\n  /** Present on sha-only (negative) entries so an upgrade re-parses them. */\n  normalizerVersion?: number;\n  identityResolutionVersion?: number;\n}\n\ntype ActiveFactManifestFile = ReconcileManifestFile & { memory: ReconcileMemoryIdentity };\n\nexport interface ReconcileManifest {\n  format: typeof RECONCILE_MANIFEST_FORMAT;\n  schemaVersion: typeof RECONCILE_MANIFEST_SCHEMA_VERSION;\n  files: ReconcileManifestFile[];\n}\n\nexport type ReconcileMemoryParser = (raw: string) => { frontmatter: MemoryFrontmatter; content: string } | null;\n\nexport interface BuildReconcileManifestOptions {\n  files: Iterable<ReconcileFileState>;\n  readFile: (file: ReconcileFileState) => Promise<Buffer | string | null>;\n  parseMemory: ReconcileMemoryParser;\n  cachedFiles?: Iterable<ReconcileManifestFile>;\n  citationTemplate?: string;\n  /** Cancellation (#2954): checked between read batches so an aborted run\n   * stops scheduling new file reads instead of walking the whole corpus. */\n  signal?: AbortSignal;\n}\n\nconst SHA256_PATTERN = /^[a-f0-9]{64}$/i;\nconst MEMORY_DIRS = new Set(RECALL_FALLBACK_DIRS);\n\nfunction isMemoryPath(filePath: string): boolean {\n  if (!filePath.endsWith(\".md\")) return false;\n  const segments = filePath.split(\"/\");\n  let index = 0;\n  if (segments[index] === \"cold\" || segments[index] === \"archive\") index += 1;\n  return MEMORY_DIRS.has(segments[index] ?? \"\");\n}\n\nfunction parsedMemoryIdentity(\n  filePath: string,\n  raw: Buffer | string,\n  parseMemory: ReconcileMemoryParser,\n  citationTemplate: string\n): ReconcileMemoryIdentity | undefined {\n  if (!isMemoryPath(filePath)) return undefined;\n  const parsed = parseMemory(Buffer.isBuffer(raw) ? raw.toString(\"utf8\") : raw);\n  if (!parsed?.frontmatter.id) return undefined;\n\n  const storedHash =\n    parsed.frontmatter.contentHash && SHA256_PATTERN.test(parsed.frontmatter.contentHash)\n      ? parsed.frontmatter.contentHash.toLowerCase()\n      : undefined;\n  const candidates = storedContentIdentityCandidates(parsed.content, (content) =>\n    stripCitationForTemplate(content, citationTemplate)\n  );\n  const bodyHash = ContentHashIndex.computeHash(candidates[0] ?? \"\");\n  const currentMatch = candidates.find((content) => ContentHashIndex.computeHash(content) === storedHash);\n  const legacyMatch = [...candidates].reverse().find((content) => computeLegacyContentHash(content) === storedHash);\n  let contentHash: string;\n  let contentHashAliases: string[] | undefined;\n  if (currentMatch) {\n    contentHash = ContentHashIndex.computeHash(currentMatch);\n  } else if (legacyMatch && normalizeLegacyContent(legacyMatch).length > 0) {\n    // A non-empty legacy equality is ambiguous (issue #2367): the persisted\n    // hash may be an explicit contentHashSource identity that merely collides\n    // with the body's ASCII skeleton under the lossy legacy normalizer, and\n    // nothing in the record proves which it is. Keep the persisted hash as\n    // the primary identity and expose the recovered current identity as an\n    // alias so replicas carrying either form still collapse.\n    contentHash = storedHash ?? bodyHash;\n    const recovered = ContentHashIndex.computeHash(legacyMatch);\n    if (recovered !== contentHash) contentHashAliases = [recovered];\n  } else {\n    // An EMPTY legacy skeleton identifies nothing (every non-ASCII body maps\n    // to it), so preserving it would collapse unrelated records. Recovering\n    // the current identity here is repair, not replacement.\n    contentHash = legacyMatch ? ContentHashIndex.computeHash(legacyMatch) : (storedHash ?? bodyHash);\n  }\n\n  return {\n    id: parsed.frontmatter.id,\n    category: parsed.frontmatter.category,\n    contentHash,\n    ...(contentHashAliases ? { contentHashAliases } : {}),\n    normalizerVersion: CONTENT_HASH_NORMALIZER_VERSION,\n    identityResolutionVersion: IDENTITY_RESOLUTION_VERSION,\n    status: inferMemoryStatus(parsed.frontmatter, filePath),\n  };\n}\n\n/**\n * Stable fingerprint of the citation template that `parsedMemoryIdentity` uses\n * to strip inline attribution before hashing. A persisted identity cache is\n * only reusable while this matches: identical file content under a different\n * template yields a different `contentHash`, which would silently change\n * duplicate and conflict decisions on a warm plan.\n */\nexport function citationTemplateFingerprint(citationTemplate?: string): string {\n  return createHash(\"sha256\")\n    .update(citationTemplate ?? DEFAULT_CITATION_FORMAT)\n    .digest(\"hex\")\n    .slice(0, 16);\n}\n\n/**\n * Structural guard for identities read back from an on-disk cache. A cache file\n * is untrusted JSON: without this an entry carrying `memory: null` survives the\n * loader's cast and then throws when the hit path dereferences\n * `memory.normalizerVersion`, aborting a manifest build that should instead\n * fall back to a cold parse.\n */\nexport function isReconcileMemoryIdentity(value: unknown): value is ReconcileMemoryIdentity {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const memory = value as Record<string, unknown>;\n  if (typeof memory.id !== \"string\") return false;\n  if (typeof memory.category !== \"string\") return false;\n  if (typeof memory.contentHash !== \"string\" || !SHA256_PATTERN.test(memory.contentHash)) return false;\n  if (typeof memory.status !== \"string\") return false;\n  if (memory.normalizerVersion !== undefined && typeof memory.normalizerVersion !== \"number\") return false;\n  if (memory.identityResolutionVersion !== undefined && typeof memory.identityResolutionVersion !== \"number\") {\n    return false;\n  }\n  if (\n    memory.contentHashAliases !== undefined &&\n    (!Array.isArray(memory.contentHashAliases) ||\n      memory.contentHashAliases.some((alias) => typeof alias !== \"string\" || !SHA256_PATTERN.test(alias)))\n  ) {\n    return false;\n  }\n  return true;\n}\n\n/** A cache hit is valid only when the entry was built by the current parser.\n * Positive hits carry versions on `memory`; sha-only negatives stamp the same\n * versions on the entry itself. Unversioned negatives are pre-upgrade leftovers\n * and must miss so a newer parser can recognize an identity it previously skipped. */\nexport function isCachedIdentityReusable(cached: ReconcileManifestFile): boolean {\n  if (cached.memory !== undefined) {\n    return (\n      cached.memory.normalizerVersion === CONTENT_HASH_NORMALIZER_VERSION &&\n      cached.memory.identityResolutionVersion === IDENTITY_RESOLUTION_VERSION\n    );\n  }\n  return (\n    cached.normalizerVersion === CONTENT_HASH_NORMALIZER_VERSION &&\n    cached.identityResolutionVersion === IDENTITY_RESOLUTION_VERSION\n  );\n}\n\nexport async function buildReconcileManifestFile(\n  file: ReconcileFileState,\n  readFile: (file: ReconcileFileState) => Promise<Buffer | string | null>,\n  parseMemory: ReconcileMemoryParser,\n  citationTemplate = DEFAULT_CITATION_FORMAT\n): Promise<ReconcileManifestFile> {\n  let raw: Buffer | string | null = null;\n  let readFailed = false;\n  if (isMemoryPath(file.path)) {\n    try {\n      raw = await readFile(file);\n    } catch {\n      readFailed = true;\n      raw = null;\n    }\n  }\n  if (raw !== null && createHash(\"sha256\").update(raw).digest(\"hex\") !== file.sha256.toLowerCase()) {\n    raw = null;\n  }\n  const memory = raw === null ? undefined : parsedMemoryIdentity(file.path, raw, parseMemory, citationTemplate);\n  // A thrown read is not a negative identity. Stamping versions here would\n  // make the next warm cycle treat the failure as \"this file has no id\".\n  if (readFailed) return { ...file };\n  return {\n    ...file,\n    ...(memory\n      ? { memory }\n      : {\n          normalizerVersion: CONTENT_HASH_NORMALIZER_VERSION,\n          identityResolutionVersion: IDENTITY_RESOLUTION_VERSION,\n        }),\n  };\n}\n\n/** Read-batch size for manifest builds. Uncached files are independent (a\n * per-file read + sha256 + frontmatter parse); processing them in bounded\n * batches amortizes the per-file promise/async-hook overhead that dominates\n * boot-scale corpus builds (measured: ~66% of CPU in async_hooks._propagate +\n * GC at ~100k files) and overlaps IO waits, while the bound keeps memory flat.\n * Order is preserved: results land in input order regardless of completion\n * order, so the manifest output is byte-identical to the sequential form. */\nconst MANIFEST_BUILD_BATCH_SIZE = 50;\n\nexport async function buildReconcileManifest(options: BuildReconcileManifestOptions): Promise<ReconcileManifest> {\n  const cachedByPath = new Map<string, ReconcileManifestFile>();\n  for (const cached of options.cachedFiles ?? []) {\n    cachedByPath.set(cached.path, cached);\n  }\n\n  const allFiles = [...options.files];\n  // Every result — cache hit or rebuild — is stored at its own input index.\n  // Pushing hits onto a dense array while rebuilds are assigned by index\n  // silently drops entries whenever a miss precedes a hit: the rebuild lands\n  // on the slot the hit already occupied.\n  const files: ReconcileManifestFile[] = new Array(allFiles.length);\n  // Cache hits stay on a synchronous fast path (no promise allocation, no\n  // Promise.all — a fully-cached rebuild must not regress); only the uncached\n  // entries ride the bounded batches.\n  const uncached: Array<{ index: number; file: ReconcileFileState }> = [];\n  for (let i = 0; i < allFiles.length; i += 1) {\n    const file = allFiles[i]!;\n    const cached = cachedByPath.get(file.path);\n    if (\n      cached !== undefined &&\n      cached.sha256.toLowerCase() === file.sha256.toLowerCase() &&\n      isCachedIdentityReusable(cached)\n    ) {\n      files[i] = {\n        ...file,\n        ...(cached.memory\n          ? { memory: cached.memory }\n          : {\n              normalizerVersion: cached.normalizerVersion,\n              identityResolutionVersion: cached.identityResolutionVersion,\n            }),\n      };\n    } else {\n      uncached.push({ index: i, file });\n    }\n  }\n  for (let i = 0; i < uncached.length; i += MANIFEST_BUILD_BATCH_SIZE) {\n    // Between batches, not within one: an abort mid-batch lets the in-flight\n    // reads settle (their own fetch signal does the aborting) and stops the\n    // NEXT batch from ever being scheduled.\n    options.signal?.throwIfAborted();\n    const batch = uncached.slice(i, i + MANIFEST_BUILD_BATCH_SIZE);\n    const results = await Promise.all(\n      batch.map(({ file }) =>\n        buildReconcileManifestFile(file, options.readFile, options.parseMemory, options.citationTemplate)\n      )\n    );\n    for (let j = 0; j < batch.length; j += 1) {\n      files[batch[j]!.index] = results[j]!;\n    }\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0));\n  return {\n    format: RECONCILE_MANIFEST_FORMAT,\n    schemaVersion: RECONCILE_MANIFEST_SCHEMA_VERSION,\n    files,\n  };\n}\n\nfunction activeFactByPath(manifest: ReconcileManifest | undefined): Map<string, ActiveFactManifestFile> {\n  const result = new Map<string, ActiveFactManifestFile>();\n  for (const file of manifest?.files ?? []) {\n    if (file.memory?.category === \"fact\" && file.memory.status === \"active\") {\n      result.set(file.path, file as ActiveFactManifestFile);\n    }\n  }\n  return result;\n}\n\nfunction memoryIdentityHashes(memory: ReconcileMemoryIdentity): string[] {\n  return [memory.contentHash, ...(memory.contentHashAliases ?? [])];\n}\n\nfunction contentHashRows(files: Iterable<ActiveFactManifestFile>, contentHash: string): ContentHashPathEntry[] {\n  const rows: ContentHashPathEntry[] = [];\n  for (const file of files) {\n    rows.push({ path: file.path, contentHash });\n  }\n  return rows;\n}\n\nfunction classifySemanticChange(\n  current: ReconcileSemanticAgreement,\n  prior: ReconcileSemanticAgreement | undefined\n): ReconcileSemanticChange {\n  if (!prior) return \"unchanged\";\n  const localChanged = current.local.sha256 !== prior.local.sha256;\n  const peerChanged = current.peer.sha256 !== prior.peer.sha256;\n  if (localChanged && peerChanged) return \"both_modified\";\n  if (localChanged) return \"local_changed\";\n  if (peerChanged) return \"peer_changed\";\n  return \"unchanged\";\n}\n\nexport function collapseActiveFactDuplicates(\n  plan: ReconcilePlan,\n  localManifests: ReadonlyMap<string, ReconcileManifest>,\n  peerManifests: ReadonlyMap<string, ReconcileManifest>,\n  priorSemanticAgreements?: ReadonlyMap<string, readonly ReconcileSemanticAgreement[]>\n): ReconcilePlan {\n  const entriesByNamespace = new Map<string, ReconcilePlanEntry[]>();\n  for (const entry of plan.entries) {\n    const entries = entriesByNamespace.get(entry.namespace) ?? [];\n    entries.push({ ...entry });\n    entriesByNamespace.set(entry.namespace, entries);\n  }\n\n  let changed = false;\n  for (const namespace of new Set([...localManifests.keys(), ...peerManifests.keys()])) {\n    const entries = entriesByNamespace.get(namespace) ?? [];\n    const localManifest = localManifests.get(namespace);\n    const peerManifest = peerManifests.get(namespace);\n    const localByPath = activeFactByPath(localManifest);\n    const peerByPath = activeFactByPath(peerManifest);\n    const localFilesByPath = new Map((localManifest?.files ?? []).map((file) => [file.path, file]));\n    const peerFilesByPath = new Map((peerManifest?.files ?? []).map((file) => [file.path, file]));\n    const priorSemanticByPathPair = new Map(\n      (priorSemanticAgreements?.get(namespace) ?? []).map((agreement) => [semanticAgreementKey(agreement), agreement])\n    );\n    const localByHash = new Map<string, ActiveFactManifestFile[]>();\n    const peerByHash = new Map<string, ActiveFactManifestFile[]>();\n\n    for (const file of localByPath.values()) {\n      for (const hash of memoryIdentityHashes(file.memory)) {\n        const bucket = localByHash.get(hash) ?? [];\n        bucket.push(file);\n        localByHash.set(hash, bucket);\n      }\n    }\n    for (const file of peerByPath.values()) {\n      for (const hash of memoryIdentityHashes(file.memory)) {\n        const bucket = peerByHash.get(hash) ?? [];\n        bucket.push(file);\n        peerByHash.set(hash, bucket);\n      }\n    }\n\n    const removed = new Set<ReconcilePlanEntry>();\n    const replacements: ReconcilePlanEntry[] = [];\n    const processedPathPairs = new Set<string>();\n    for (const hash of new Set([...localByHash.keys(), ...peerByHash.keys()])) {\n      const localCandidates = (localByHash.get(hash) ?? []).filter((file) => {\n        const opposite = peerFilesByPath.get(file.path);\n        const activeOpposite = peerByPath.get(file.path);\n        return (\n          opposite === undefined ||\n          (activeOpposite !== undefined && memoryIdentityHashes(activeOpposite.memory).includes(hash))\n        );\n      });\n      const peerCandidates = (peerByHash.get(hash) ?? []).filter((file) => {\n        const opposite = localFilesByPath.get(file.path);\n        const activeOpposite = localByPath.get(file.path);\n        return (\n          opposite === undefined ||\n          (activeOpposite !== undefined && memoryIdentityHashes(activeOpposite.memory).includes(hash))\n        );\n      });\n      const localPath = ContentHashIndex.resolvePathByHash(hash, contentHashRows(localCandidates, hash));\n      const peerPath = ContentHashIndex.resolvePathByHash(hash, contentHashRows(peerCandidates, hash));\n\n      if (localPath && peerPath && localPath !== peerPath) {\n        const pathPair = `${localPath}\\0${peerPath}`;\n        if (processedPathPairs.has(pathPair)) continue;\n        processedPathPairs.add(pathPair);\n        const localFile = localByPath.get(localPath);\n        const peerFile = peerByPath.get(peerPath);\n        if (!localFile || !peerFile) continue;\n        const duplicatePaths = new Set([\n          ...localCandidates.map((file) => file.path),\n          ...peerCandidates.map((file) => file.path),\n        ]);\n        const authoritativeSamePathEntries = new Set(\n          entries.filter(\n            (entry) =>\n              duplicatePaths.has(entry.path) &&\n              localFilesByPath.has(entry.path) &&\n              peerFilesByPath.has(entry.path) &&\n              entry.action !== \"identical\"\n          )\n        );\n        if (authoritativeSamePathEntries.size > 0) {\n          for (const entry of entries) {\n            if (\n              duplicatePaths.has(entry.path) &&\n              !authoritativeSamePathEntries.has(entry) &&\n              (entry.action === \"pull\" || entry.action === \"push\" || entry.action === \"identical\")\n            ) {\n              removed.add(entry);\n              changed = true;\n            }\n          }\n          continue;\n        }\n        const unsafeEntry = entries.some(\n          (entry) => duplicatePaths.has(entry.path) && (entry.action === \"suppress\" || entry.action === \"conflict\")\n        );\n        if (unsafeEntry) continue;\n        for (const entry of entries) {\n          if (\n            duplicatePaths.has(entry.path) &&\n            (entry.action === \"pull\" || entry.action === \"push\" || entry.action === \"identical\")\n          ) {\n            removed.add(entry);\n          }\n        }\n        const semanticAgreement: ReconcileSemanticAgreement = {\n          local: { path: localPath, sha256: localFile.sha256 },\n          peer: { path: peerPath, sha256: peerFile.sha256 },\n        };\n        replacements.push({\n          path: localPath < peerPath ? localPath : peerPath,\n          namespace,\n          action: \"identical\",\n          reason: \"semantic_duplicate\",\n          semanticAgreement,\n          semanticChange: classifySemanticChange(\n            semanticAgreement,\n            priorSemanticByPathPair.get(semanticAgreementKey(semanticAgreement))\n          ),\n        });\n        changed = true;\n        continue;\n      }\n\n      const sameSideEntries = entries.filter((entry) => {\n        if (localPath && entry.reason === \"local_only\") {\n          return localCandidates.some((file) => file.path === entry.path);\n        }\n        if (peerPath && entry.reason === \"peer_only\") {\n          return peerCandidates.some((file) => file.path === entry.path);\n        }\n        return false;\n      });\n      const canonicalPath = localPath ?? peerPath;\n      const hasSharedCanonical = localPath !== undefined && localPath === peerPath;\n      if (!canonicalPath || sameSideEntries.length === 0 || (!hasSharedCanonical && sameSideEntries.length < 2)) {\n        continue;\n      }\n      for (const entry of sameSideEntries) {\n        if (entry.path !== canonicalPath) {\n          removed.add(entry);\n          changed = true;\n        }\n      }\n    }\n\n    if (removed.size > 0 || replacements.length > 0) {\n      entriesByNamespace.set(\n        namespace,\n        [...entries.filter((entry) => !removed.has(entry)), ...replacements].sort(compareReconcilePlanEntries)\n      );\n    }\n  }\n\n  if (!changed) return plan;\n  const entries = [...entriesByNamespace.values()].flat().sort(compareReconcilePlanEntries);\n  return {\n    entries,\n    byNamespace: summarizeReconcilePlan(entries),\n    converged: entries.every((entry) => entry.action === \"identical\"),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAmBpB,IAAM,4BAA4B;AAClC,IAAM,oCAAoC;AAC1C,IAAM,kCAAkC;AASxC,IAAM,8BAA8B;AAUpC,SAAS,qBAAqB,kBAAmC;AACtE,SAAO,UAAU,iCAAiC,eAAe,+BAA+B,aAAa,2BAA2B,aAAa,4BAA4B,gBAAgB,CAAC;AACpM;AA+CA,IAAM,iBAAiB;AACvB,IAAM,cAAc,IAAI,IAAI,oBAAoB;AAEhD,SAAS,aAAa,UAA2B;AAC/C,MAAI,CAAC,SAAS,SAAS,KAAK,EAAG,QAAO;AACtC,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,QAAQ;AACZ,MAAI,SAAS,KAAK,MAAM,UAAU,SAAS,KAAK,MAAM,UAAW,UAAS;AAC1E,SAAO,YAAY,IAAI,SAAS,KAAK,KAAK,EAAE;AAC9C;AAEA,SAAS,qBACP,UACA,KACA,aACA,kBACqC;AACrC,MAAI,CAAC,aAAa,QAAQ,EAAG,QAAO;AACpC,QAAM,SAAS,YAAY,OAAO,SAAS,GAAG,IAAI,IAAI,SAAS,MAAM,IAAI,GAAG;AAC5E,MAAI,CAAC,QAAQ,YAAY,GAAI,QAAO;AAEpC,QAAM,aACJ,OAAO,YAAY,eAAe,eAAe,KAAK,OAAO,YAAY,WAAW,IAChF,OAAO,YAAY,YAAY,YAAY,IAC3C;AACN,QAAM,aAAa;AAAA,IAAgC,OAAO;AAAA,IAAS,CAAC,YAClE,yBAAyB,SAAS,gBAAgB;AAAA,EACpD;AACA,QAAM,WAAW,iBAAiB,YAAY,WAAW,CAAC,KAAK,EAAE;AACjE,QAAM,eAAe,WAAW,KAAK,CAAC,YAAY,iBAAiB,YAAY,OAAO,MAAM,UAAU;AACtG,QAAM,cAAc,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,yBAAyB,OAAO,MAAM,UAAU;AAChH,MAAI;AACJ,MAAI;AACJ,MAAI,cAAc;AAChB,kBAAc,iBAAiB,YAAY,YAAY;AAAA,EACzD,WAAW,eAAe,uBAAuB,WAAW,EAAE,SAAS,GAAG;AAOxE,kBAAc,cAAc;AAC5B,UAAM,YAAY,iBAAiB,YAAY,WAAW;AAC1D,QAAI,cAAc,YAAa,sBAAqB,CAAC,SAAS;AAAA,EAChE,OAAO;AAIL,kBAAc,cAAc,iBAAiB,YAAY,WAAW,IAAK,cAAc;AAAA,EACzF;AAEA,SAAO;AAAA,IACL,IAAI,OAAO,YAAY;AAAA,IACvB,UAAU,OAAO,YAAY;AAAA,IAC7B;AAAA,IACA,GAAI,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AAAA,IACnD,mBAAmB;AAAA,IACnB,2BAA2B;AAAA,IAC3B,QAAQ,kBAAkB,OAAO,aAAa,QAAQ;AAAA,EACxD;AACF;AASO,SAAS,4BAA4B,kBAAmC;AAC7E,SAAO,WAAW,QAAQ,EACvB,OAAO,oBAAoB,uBAAuB,EAClD,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AAChB;AASO,SAAS,0BAA0B,OAAkD;AAC1F,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,OAAO,SAAU,QAAO;AAC1C,MAAI,OAAO,OAAO,aAAa,SAAU,QAAO;AAChD,MAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,eAAe,KAAK,OAAO,WAAW,EAAG,QAAO;AAC/F,MAAI,OAAO,OAAO,WAAW,SAAU,QAAO;AAC9C,MAAI,OAAO,sBAAsB,UAAa,OAAO,OAAO,sBAAsB,SAAU,QAAO;AACnG,MAAI,OAAO,8BAA8B,UAAa,OAAO,OAAO,8BAA8B,UAAU;AAC1G,WAAO;AAAA,EACT;AACA,MACE,OAAO,uBAAuB,WAC7B,CAAC,MAAM,QAAQ,OAAO,kBAAkB,KACvC,OAAO,mBAAmB,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,IACpG;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMO,SAAS,yBAAyB,QAAwC;AAC/E,MAAI,OAAO,WAAW,QAAW;AAC/B,WACE,OAAO,OAAO,sBAAsB,mCACpC,OAAO,OAAO,8BAA8B;AAAA,EAEhD;AACA,SACE,OAAO,sBAAsB,mCAC7B,OAAO,8BAA8B;AAEzC;AAEA,eAAsB,2BACpB,MACA,UACA,aACA,mBAAmB,yBACa;AAChC,MAAI,MAA8B;AAClC,MAAI,aAAa;AACjB,MAAI,aAAa,KAAK,IAAI,GAAG;AAC3B,QAAI;AACF,YAAM,MAAM,SAAS,IAAI;AAAA,IAC3B,QAAQ;AACN,mBAAa;AACb,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,MAAM,KAAK,OAAO,YAAY,GAAG;AAChG,UAAM;AAAA,EACR;AACA,QAAM,SAAS,QAAQ,OAAO,SAAY,qBAAqB,KAAK,MAAM,KAAK,aAAa,gBAAgB;AAG5G,MAAI,WAAY,QAAO,EAAE,GAAG,KAAK;AACjC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,SACA,EAAE,OAAO,IACT;AAAA,MACE,mBAAmB;AAAA,MACnB,2BAA2B;AAAA,IAC7B;AAAA,EACN;AACF;AASA,IAAM,4BAA4B;AAElC,eAAsB,uBAAuB,SAAoE;AAC/G,QAAM,eAAe,oBAAI,IAAmC;AAC5D,aAAW,UAAU,QAAQ,eAAe,CAAC,GAAG;AAC9C,iBAAa,IAAI,OAAO,MAAM,MAAM;AAAA,EACtC;AAEA,QAAM,WAAW,CAAC,GAAG,QAAQ,KAAK;AAKlC,QAAM,QAAiC,IAAI,MAAM,SAAS,MAAM;AAIhE,QAAM,WAA+D,CAAC;AACtE,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK,GAAG;AAC3C,UAAM,OAAO,SAAS,CAAC;AACvB,UAAM,SAAS,aAAa,IAAI,KAAK,IAAI;AACzC,QACE,WAAW,UACX,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,YAAY,KACxD,yBAAyB,MAAM,GAC/B;AACA,YAAM,CAAC,IAAI;AAAA,QACT,GAAG;AAAA,QACH,GAAI,OAAO,SACP,EAAE,QAAQ,OAAO,OAAO,IACxB;AAAA,UACE,mBAAmB,OAAO;AAAA,UAC1B,2BAA2B,OAAO;AAAA,QACpC;AAAA,MACN;AAAA,IACF,OAAO;AACL,eAAS,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;AAAA,IAClC;AAAA,EACF;AACA,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK,2BAA2B;AAInE,YAAQ,QAAQ,eAAe;AAC/B,UAAM,QAAQ,SAAS,MAAM,GAAG,IAAI,yBAAyB;AAC7D,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,MAAM;AAAA,QAAI,CAAC,EAAE,KAAK,MAChB,2BAA2B,MAAM,QAAQ,UAAU,QAAQ,aAAa,QAAQ,gBAAgB;AAAA,MAClG;AAAA,IACF;AACA,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,YAAM,MAAM,CAAC,EAAG,KAAK,IAAI,QAAQ,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,KAAK,CAAC,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AAC1F,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,UAA8E;AACtG,QAAM,SAAS,oBAAI,IAAoC;AACvD,aAAW,QAAQ,UAAU,SAAS,CAAC,GAAG;AACxC,QAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,OAAO,WAAW,UAAU;AACvE,aAAO,IAAI,KAAK,MAAM,IAA8B;AAAA,IACtD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,QAA2C;AACvE,SAAO,CAAC,OAAO,aAAa,GAAI,OAAO,sBAAsB,CAAC,CAAE;AAClE;AAEA,SAAS,gBAAgB,OAAyC,aAA6C;AAC7G,QAAM,OAA+B,CAAC;AACtC,aAAW,QAAQ,OAAO;AACxB,SAAK,KAAK,EAAE,MAAM,KAAK,MAAM,YAAY,CAAC;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,uBACP,SACA,OACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,eAAe,QAAQ,MAAM,WAAW,MAAM,MAAM;AAC1D,QAAM,cAAc,QAAQ,KAAK,WAAW,MAAM,KAAK;AACvD,MAAI,gBAAgB,YAAa,QAAO;AACxC,MAAI,aAAc,QAAO;AACzB,MAAI,YAAa,QAAO;AACxB,SAAO;AACT;AAEO,SAAS,6BACd,MACA,gBACA,eACA,yBACe;AACf,QAAM,qBAAqB,oBAAI,IAAkC;AACjE,aAAW,SAAS,KAAK,SAAS;AAChC,UAAMA,WAAU,mBAAmB,IAAI,MAAM,SAAS,KAAK,CAAC;AAC5D,IAAAA,SAAQ,KAAK,EAAE,GAAG,MAAM,CAAC;AACzB,uBAAmB,IAAI,MAAM,WAAWA,QAAO;AAAA,EACjD;AAEA,MAAI,UAAU;AACd,aAAW,aAAa,oBAAI,IAAI,CAAC,GAAG,eAAe,KAAK,GAAG,GAAG,cAAc,KAAK,CAAC,CAAC,GAAG;AACpF,UAAMA,WAAU,mBAAmB,IAAI,SAAS,KAAK,CAAC;AACtD,UAAM,gBAAgB,eAAe,IAAI,SAAS;AAClD,UAAM,eAAe,cAAc,IAAI,SAAS;AAChD,UAAM,cAAc,iBAAiB,aAAa;AAClD,UAAM,aAAa,iBAAiB,YAAY;AAChD,UAAM,mBAAmB,IAAI,KAAK,eAAe,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;AAC9F,UAAM,kBAAkB,IAAI,KAAK,cAAc,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;AAC5F,UAAM,0BAA0B,IAAI;AAAA,OACjC,yBAAyB,IAAI,SAAS,KAAK,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,qBAAqB,SAAS,GAAG,SAAS,CAAC;AAAA,IACjH;AACA,UAAM,cAAc,oBAAI,IAAsC;AAC9D,UAAM,aAAa,oBAAI,IAAsC;AAE7D,eAAW,QAAQ,YAAY,OAAO,GAAG;AACvC,iBAAW,QAAQ,qBAAqB,KAAK,MAAM,GAAG;AACpD,cAAM,SAAS,YAAY,IAAI,IAAI,KAAK,CAAC;AACzC,eAAO,KAAK,IAAI;AAChB,oBAAY,IAAI,MAAM,MAAM;AAAA,MAC9B;AAAA,IACF;AACA,eAAW,QAAQ,WAAW,OAAO,GAAG;AACtC,iBAAW,QAAQ,qBAAqB,KAAK,MAAM,GAAG;AACpD,cAAM,SAAS,WAAW,IAAI,IAAI,KAAK,CAAC;AACxC,eAAO,KAAK,IAAI;AAChB,mBAAW,IAAI,MAAM,MAAM;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,UAAU,oBAAI,IAAwB;AAC5C,UAAM,eAAqC,CAAC;AAC5C,UAAM,qBAAqB,oBAAI,IAAY;AAC3C,eAAW,QAAQ,oBAAI,IAAI,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,WAAW,KAAK,CAAC,CAAC,GAAG;AACzE,YAAM,mBAAmB,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,SAAS;AACrE,cAAM,WAAW,gBAAgB,IAAI,KAAK,IAAI;AAC9C,cAAM,iBAAiB,WAAW,IAAI,KAAK,IAAI;AAC/C,eACE,aAAa,UACZ,mBAAmB,UAAa,qBAAqB,eAAe,MAAM,EAAE,SAAS,IAAI;AAAA,MAE9F,CAAC;AACD,YAAM,kBAAkB,WAAW,IAAI,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,SAAS;AACnE,cAAM,WAAW,iBAAiB,IAAI,KAAK,IAAI;AAC/C,cAAM,iBAAiB,YAAY,IAAI,KAAK,IAAI;AAChD,eACE,aAAa,UACZ,mBAAmB,UAAa,qBAAqB,eAAe,MAAM,EAAE,SAAS,IAAI;AAAA,MAE9F,CAAC;AACD,YAAM,YAAY,iBAAiB,kBAAkB,MAAM,gBAAgB,iBAAiB,IAAI,CAAC;AACjG,YAAM,WAAW,iBAAiB,kBAAkB,MAAM,gBAAgB,gBAAgB,IAAI,CAAC;AAE/F,UAAI,aAAa,YAAY,cAAc,UAAU;AACnD,cAAM,WAAW,GAAG,SAAS,KAAK,QAAQ;AAC1C,YAAI,mBAAmB,IAAI,QAAQ,EAAG;AACtC,2BAAmB,IAAI,QAAQ;AAC/B,cAAM,YAAY,YAAY,IAAI,SAAS;AAC3C,cAAM,WAAW,WAAW,IAAI,QAAQ;AACxC,YAAI,CAAC,aAAa,CAAC,SAAU;AAC7B,cAAM,iBAAiB,oBAAI,IAAI;AAAA,UAC7B,GAAG,gBAAgB,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,UAC1C,GAAG,eAAe,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,QAC3C,CAAC;AACD,cAAM,+BAA+B,IAAI;AAAA,UACvCA,SAAQ;AAAA,YACN,CAAC,UACC,eAAe,IAAI,MAAM,IAAI,KAC7B,iBAAiB,IAAI,MAAM,IAAI,KAC/B,gBAAgB,IAAI,MAAM,IAAI,KAC9B,MAAM,WAAW;AAAA,UACrB;AAAA,QACF;AACA,YAAI,6BAA6B,OAAO,GAAG;AACzC,qBAAW,SAASA,UAAS;AAC3B,gBACE,eAAe,IAAI,MAAM,IAAI,KAC7B,CAAC,6BAA6B,IAAI,KAAK,MACtC,MAAM,WAAW,UAAU,MAAM,WAAW,UAAU,MAAM,WAAW,cACxE;AACA,sBAAQ,IAAI,KAAK;AACjB,wBAAU;AAAA,YACZ;AAAA,UACF;AACA;AAAA,QACF;AACA,cAAM,cAAcA,SAAQ;AAAA,UAC1B,CAAC,UAAU,eAAe,IAAI,MAAM,IAAI,MAAM,MAAM,WAAW,cAAc,MAAM,WAAW;AAAA,QAChG;AACA,YAAI,YAAa;AACjB,mBAAW,SAASA,UAAS;AAC3B,cACE,eAAe,IAAI,MAAM,IAAI,MAC5B,MAAM,WAAW,UAAU,MAAM,WAAW,UAAU,MAAM,WAAW,cACxE;AACA,oBAAQ,IAAI,KAAK;AAAA,UACnB;AAAA,QACF;AACA,cAAM,oBAAgD;AAAA,UACpD,OAAO,EAAE,MAAM,WAAW,QAAQ,UAAU,OAAO;AAAA,UACnD,MAAM,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAO;AAAA,QAClD;AACA,qBAAa,KAAK;AAAA,UAChB,MAAM,YAAY,WAAW,YAAY;AAAA,UACzC;AAAA,UACA,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR;AAAA,UACA,gBAAgB;AAAA,YACd;AAAA,YACA,wBAAwB,IAAI,qBAAqB,iBAAiB,CAAC;AAAA,UACrE;AAAA,QACF,CAAC;AACD,kBAAU;AACV;AAAA,MACF;AAEA,YAAM,kBAAkBA,SAAQ,OAAO,CAAC,UAAU;AAChD,YAAI,aAAa,MAAM,WAAW,cAAc;AAC9C,iBAAO,gBAAgB,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM,IAAI;AAAA,QAChE;AACA,YAAI,YAAY,MAAM,WAAW,aAAa;AAC5C,iBAAO,eAAe,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM,IAAI;AAAA,QAC/D;AACA,eAAO;AAAA,MACT,CAAC;AACD,YAAM,gBAAgB,aAAa;AACnC,YAAM,qBAAqB,cAAc,UAAa,cAAc;AACpE,UAAI,CAAC,iBAAiB,gBAAgB,WAAW,KAAM,CAAC,sBAAsB,gBAAgB,SAAS,GAAI;AACzG;AAAA,MACF;AACA,iBAAW,SAAS,iBAAiB;AACnC,YAAI,MAAM,SAAS,eAAe;AAChC,kBAAQ,IAAI,KAAK;AACjB,oBAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAEA,QAAI,QAAQ,OAAO,KAAK,aAAa,SAAS,GAAG;AAC/C,yBAAmB;AAAA,QACjB;AAAA,QACA,CAAC,GAAGA,SAAQ,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,YAAY,EAAE,KAAK,2BAA2B;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,CAAC,GAAG,mBAAmB,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,2BAA2B;AACxF,SAAO;AAAA,IACL;AAAA,IACA,aAAa,uBAAuB,OAAO;AAAA,IAC3C,WAAW,QAAQ,MAAM,CAAC,UAAU,MAAM,WAAW,WAAW;AAAA,EAClE;AACF;","names":["entries"]}

package/dist/{chunk-RW4QNB4J.js → chunk-S45INSV3.js}

@@ -382,6 +382,8 @@ export {
   reconcileProvenanceRead,
   parseProvenanceSources,
   parseProvenanceConfig,
+  locateQuoteOffsets,
+  stripLeadingRolePrefix,
   buildFactProvenance
 };
-//# sourceMappingURL=chunk-RW4QNB4J.js.map
+//# sourceMappingURL=chunk-S45INSV3.js.map

package/dist/{chunk-RW4QNB4J.js.map → chunk-S45INSV3.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/provenance.ts"],"sourcesContent":["/**\n * Claim-level provenance spans (issue #1575 PR 1).\n *\n * Centralizes the parse/serialize logic for the `sources` array and the\n * coarse `provenance` strength tag, plus the `provenance` config-block\n * parser.  Extracted from `storage.ts` and `config.ts` so those files keep\n * only thin delegation call-sites — the frontmatter round-trip and config\n * parsing growth lives here (issue #1520 ratchet discipline).\n *\n * Contract:\n *  - When no provenance fields are present, output is byte-identical to\n *    pre-feature behavior (rule 39).\n *  - Corrupt `sources` lines / unknown `provenance` tags drop to\n *    `undefined` on read so a malformed frontmatter never poisons\n *    downstream readers (rule 34 spirit — drop corrupt rather than poison).\n *  - Validation lives on the write path; this module only parses.\n *  - Invariant (review round 5, cursor thread KQN): a `verified` or\n *    `unverified` tag is NEVER persisted/read without surviving sources —\n *    without excerpts the tag is indistinguishable from a grounded fact to\n *    downstream faithfulness/correction/TrustScore surfaces. The invariant\n *    is enforced symmetrically: `serializeProvenanceFields` (write) and\n *    `reconcileProvenanceRead` (read) both downgrade the tag to `none`\n *    when no source survives.\n */\n\nimport { z } from \"zod\";\n\nimport { coerceBool, coerceNumber } from \"./connectors/coerce.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport { collapseWhitespace } from \"./whitespace.js\";\nimport type { MemoryFrontmatter, ProvenanceConfig, ProvenanceSource } from \"./types.js\";\nimport { isSafeMemoryContent } from \"./sanitize.js\";\n\n/**\n * Canonical key order for a serialized `ProvenanceSource` (issue #1575).\n * Deterministic emission (rule 38) — readers and the byte-identical-when-off\n * contract (rule 39) depend on this order never drifting.\n */\nconst PROVENANCE_SOURCE_KEY_ORDER = [\n  \"sessionKey\",\n  \"turnId\",\n  \"observedAt\",\n  \"quote\",\n  \"charStart\",\n  \"charEnd\",\n] as const;\n\n/**\n * Build a single `ProvenanceSource` object whose keys appear in the canonical\n * order, omitting absent optional fields. The result is what gets fed to\n * `JSON.stringify` so the on-disk line is deterministic.\n */\nfunction canonicalProvenanceSource(src: ProvenanceSource): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of PROVENANCE_SOURCE_KEY_ORDER) {\n    const value = src[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Serialize the `sources` array (issue #1575) as a single JSON line, matching\n * the `structuredAttributes` precedent. Each entry is rebuilt in canonical key\n * order (rule 38) so the output is byte-stable. The `provenance` enum is\n * emitted bare (same style as `status`) — only the three documented values\n * are ever written.\n *\n * Verified-requires-evidence invariant (review round 5, cursor thread KQN):\n * a `verified`/`unverified` tag is downgraded to `none` whenever no source\n * survives write validation — whether sources were absent, an empty array,\n * or all entries failed the schema. This covers all three failure shapes the\n * earlier 3-branch logic left open (`{provenance:\"verified\"}`,\n * `{sources:[],provenance:\"verified\"}`, `{sources:[invalid…],provenance:\"verified\"}`).\n */\nexport function serializeProvenanceFields(fm: MemoryFrontmatter, lines: string[]): void {\n  let hasValidSources = false;\n  if (fm.sources && fm.sources.length > 0) {\n    // Validate each entry against the same schema used on read so invalid\n    // in-memory sources are dropped at write time, not silently lost on the\n    // next read (review thread 4 — write-path validation parity).\n    const canonical: Record<string, unknown>[] = [];\n    for (const src of fm.sources) {\n      const result = ProvenanceSourceSchema.safeParse(src);\n      if (result.success) canonical.push(canonicalProvenanceSource(result.data));\n    }\n    if (canonical.length > 0) {\n      lines.push(`sources: ${JSON.stringify(canonical)}`);\n      hasValidSources = true;\n    }\n  }\n  // A verified/unverified tag requires surviving evidence; without it the\n  // tag is meaningless downstream (faithfulness/TrustScore cannot distinguish\n  // it from a grounded fact). Downgrade to \"none\" regardless of WHY no source\n  // survived (absent / empty / all-invalid) — single invariant, all cases.\n  const tag =\n    (fm.provenance === \"verified\" || fm.provenance === \"unverified\") && !hasValidSources\n      ? \"none\"\n      : fm.provenance;\n  if (tag) {\n    lines.push(`provenance: ${tag}`);\n  }\n}\n\n/**\n * Parse the coarse `provenance` strength tag (issue #1575). Returns\n * `undefined` for missing/blank/unknown values so a corrupt or hand-edited\n * field fails safely to the legacy-equivalent `\"none\"` semantics on read\n * (rule 34 spirit — drop corrupt rather than poison).\n */\nexport function parseProvenanceTag(\n  raw: string | undefined,\n): \"verified\" | \"unverified\" | \"none\" | undefined {\n  if (raw === undefined) return undefined;\n  const trimmed = raw.trim();\n  if (trimmed.length === 0) return undefined;\n  if (trimmed === \"verified\" || trimmed === \"unverified\" || trimmed === \"none\") {\n    return trimmed;\n  }\n  return undefined;\n}\n\n/**\n * Enforce the verified-requires-evidence invariant on the READ path.\n * `parseProvenanceTag` and `parseProvenanceSources` are independent (they\n * parse separate frontmatter lines), so a hand-edited or imported memory may\n * carry `provenance: verified` with no surviving `sources` — a corrupt line,\n * an empty array, or all-invalid entries. Downgrade such a tag to `none` so\n * the in-memory object never exposes an ungrounded \"verified\" fact\n * (review round 5, cursor thread KQN — read-path parity with the write-path\n * downgrade in `serializeProvenanceFields`). `none`/`undefined` tags pass\n * through unchanged.\n */\nexport function reconcileProvenanceRead(\n  tag: \"verified\" | \"unverified\" | \"none\" | undefined,\n  sources: ProvenanceSource[] | undefined,\n): \"verified\" | \"unverified\" | \"none\" | undefined {\n  if ((tag === \"verified\" || tag === \"unverified\") && (!sources || sources.length === 0)) {\n    return \"none\";\n  }\n  return tag;\n}\n\n/**\n * Strict ISO-8601 timestamp check (review round 6, codex thread OXPAp).\n * `Date.parse` accepts non-ISO strings (bare years like `\"123\"`) and\n * silently normalizes calendar overflow (`2026-02-30` -> March 2, hour 25\n * -> next day), so malformed provenance survives as if valid. Require the\n * full `YYYY-MM-DDTHH:MM:SS[.fff](Z|±HH:MM)` shape and reject overflow via a\n * `Date.UTC` round-trip component check — the offset does not affect whether\n * a wall-clock field overflows, so this is correct for any timezone suffix.\n */\nfunction isStrictIsoTimestamp(s: string): boolean {\n  const m = /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$/.exec(s);\n  if (!m) return false;\n  const y = Number(m[1]), mo = Number(m[2]), da = Number(m[3]);\n  const h = Number(m[4]), mi = Number(m[5]), se = Number(m[6]);\n  // Date.UTC normalizes overflow (Feb 30 -> Mar 2); a component round-trip\n  // catches what Date.parse silently accepts.\n  const d = new Date(Date.UTC(y, mo - 1, da, h, mi, se));\n  // The component round-trip validates wall-clock overflow (Feb 30 -> Mar 2);\n  // Date.parse additionally rejects impossible timezone offsets such as\n  // +99:99, which the regex accepts but the runtime treats as NaN\n  // (codex thread OXQ0e).\n  return (\n    !Number.isNaN(Date.parse(s)) &&\n    d.getUTCFullYear() === y &&\n    d.getUTCMonth() === mo - 1 &&\n    d.getUTCDate() === da &&\n    d.getUTCHours() === h &&\n    d.getUTCMinutes() === mi &&\n    d.getUTCSeconds() === se\n  );\n}\n\n/**\n * Coerce a turn timestamp to a strict ISO-8601 string (cursor thread Ocveu —\n * \"Non-ISO turn timestamps drop sources\"). The write-path `ProvenanceSourceSchema`\n * rejects anything `isStrictIsoTimestamp` fails, so a turn whose `timestamp`\n * parses via `new Date(...)` but isn't already strict ISO (e.g.\n * `\"2026/01/15 12:00:00\"` or `\"Jan 15 2026\"`) would be silently dropped at\n * serialization — clearing the whole `sources` array and downgrading the tag\n * to `\"none\"`. Normalizing at extraction time preserves the source.\n *\n * Returns the strict ISO string when the timestamp already passes or\n * `Date.parse` can round-trip it; `undefined` for empty / unparseable input\n * so callers can decide whether to skip the source or fall back.\n */\nfunction toStrictIsoTimestamp(ts: string | undefined | null): string | undefined {\n  if (typeof ts !== \"string\" || ts.length === 0) return undefined;\n  // Trim surrounding whitespace: Date.parse accepts leading/trailing\n  // whitespace, so an imported \" 2026-05\" would otherwise bypass the\n  // year-led partial-date guard below and fabricate May 1\n  // (chatgpt-codex-connector review on #1714, issue #1657).\n  const value = ts.trim();\n  if (value.length === 0) return undefined;\n  if (isStrictIsoTimestamp(value)) return value;\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) return undefined;\n  // Year-led date guard (issues #1657 + #1723). `parseYearLedDatePrefix`\n  // recognizes a COMPLETE, calendar-valid year-led prefix — numeric OR textual\n  // month — with real date-separator RUNS of non-alphanumeric, non-colon chars\n  // (so complete-but-unusual-punctuation dates like \"2026 May, 10\",\n  // \"2026, May 10\", \"2026 Jan. 15\" are accepted), the day-not-the-hour\n  // invariant via the `(?![\\d:])` lookahead, and a calendar-valid day. This\n  // single rule subsumes the prior partial-numeric (\"2026-05\"), textual-partial\n  // (\"2026-Jan\"), and calendar-overflow (\"2026-02-30\", \"2026-Feb-30\") checks\n  // and extends them to textual months — Date.parse silently fills missing\n  // components and rolls overflow, fabricating observedAt, so a non-complete\n  // or invalid year-led prefix is rejected. Non-year-led shapes\n  // (\"Jan 15 2026\", \"02/30/2026\") fall through to Date.parse / the mdy check.\n  const yearLedPrefix = parseYearLedDatePrefix(value);\n  // Agreement check (issue #1723 codex r2/r3/r4): exotic punctuation can make\n  // the prefix structure disagree with Date.parse's own interpretation — e.g.\n  // \"2026 (May) 10\" parses as a valid May 10 PREFIX but Date.parse reads\n  // October 1; \"2026 May (10)\" agrees on month but Date.parse reads day 1 — so\n  // the round-trip would persist a fabricated observedAt while the guard\n  // \"validated\" a different date. Require Date.parse's interpretation to match\n  // the prefix's FULL (y, m, d) tuple. Offset-bearing inputs compare in the\n  // source's explicit offset frame (the prefix date is offset-local, so a UTC\n  // instant legitimately falls on an adjacent UTC/local day); offset-free\n  // inputs compare both the local and UTC frames (Date.parse uses UTC for ISO\n  // date-only strings and local for non-ISO — a single frame would wrongly\n  // reject legitimate month/day-boundary dates that shift across timezones).\n  const yearLedAgrees = yearLedAgreesWithDateParse(parsed, value, yearLedPrefix);\n  const validYearLed = yearLedPrefix !== null && yearLedAgrees;\n  // Reject bare-year / numeric-only strings that Date.parse accepts (e.g.\n  // \"123\") — isStrictIsoTimestamp already rejected them, and the round-trip\n  // below would otherwise resurrect them. Require at least one date/time\n  // separator so a plain number never round-trips into a fake epoch — UNLESS\n  // the value is itself a complete, calendar-valid year-led date that\n  // Date.parse agrees with (issue #1723: a date-only punctuated textual form\n  // like \"2026 May, 10\" has no -/:/T yet parses to the correct calendar day).\n  if (!/[-:T]/.test(value) && !validYearLed) {\n    return undefined;\n  }\n  // Reject year-led timestamps that are not a COMPLETE, calendar-valid date\n  // Date.parse agrees with (covers partial, overflow, AND the punctuation\n  // misinterpretation above).\n  if (/^\\d{4}\\D/.test(value) && !validYearLed) {\n    return undefined;\n  }\n  // Also validate M/D/Y or D/M/Y formats (provider/import common shapes:\n  // 02/30/2026, 30-02-2026, etc.). Date.parse silently shifts overflow in\n  // these too. Try both month-first and day-first interpretations; if\n  // neither is a valid calendar date, reject (chatgpt-codex-connector thread\n  // dH47 — non-YMD overflow timestamps).\n  const mdy = /^(\\d{1,2})\\D(\\d{1,2})\\D(\\d{4})/.exec(value);\n  if (mdy) {\n    const a = Number(mdy[1]), b = Number(mdy[2]), yr = Number(mdy[3]);\n    if (!isValidCalendarDate(yr, a, b) && !isValidCalendarDate(yr, b, a)) {\n      return undefined;\n    }\n  }\n  const iso = new Date(parsed).toISOString();\n  return isStrictIsoTimestamp(iso) ? iso : undefined;\n}\n\n/**\n * Validate numeric calendar components without Date overflow (review thread\n * dANc). Date.UTC silently normalizes Feb 30 -> Mar 2; a component round-trip\n * catches what Date.parse accepts. Mirrors the same technique isStrictIsoTimestamp\n * uses for full ISO strings, applied here to the non-ISO normalization path.\n */\nfunction isValidCalendarDate(y: number, mo: number, da: number): boolean {\n  if (mo < 1 || mo > 12 || da < 1) return false;\n  const leap = (y % 4 === 0 && (y % 100 !== 0 || y % 400 === 0)) ? 29 : 28;\n  const daysInMonth = [31, leap, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n  return da <= daysInMonth[mo - 1]!;\n}\n\n/**\n * Recognized month-name → number map for year-led textual-month dates\n * (issue #1657). Both the 3-letter abbreviations and the full names that\n * Date.parse accepts for year-first shapes (e.g. \"2026-Jan-15\",\n * \"2026-January-15\", \"2026 February 2\").\n */\nconst MONTH_NAMES: Record<string, number> = {\n  jan: 1, january: 1,\n  feb: 2, february: 2,\n  mar: 3, march: 3,\n  apr: 4, april: 4,\n  may: 5,\n  jun: 6, june: 6,\n  jul: 7, july: 7,\n  aug: 8, august: 8,\n  sep: 9, september: 9,\n  sept: 9,\n  oct: 10, october: 10,\n  nov: 11, november: 11,\n  dec: 12, december: 12,\n};\n\n/**\n * Parse a complete, calendar-valid year-led date prefix from `s`\n * (issue #1657, relaxed in #1723): `YYYY <sep> (MM | MonthName) <sep> DD`\n * where each separator is a RUN of non-alphanumeric, non-colon chars (so a\n * complete date with any punctuation — \"2026 May, 10\", \"2026, May 10\",\n * \"2026 Jan. 15\" — is accepted; the run excludes letters so a textual month\n * is never consumed by the separator, and excludes the colon so the date/time\n * boundary stays clean) and the day is a true calendar day — not the hour\n * before a `:` time separator (the `(?![\\d:])` lookahead rejects\n * \"2026-05 10:00\" capturing \"10\" as the day). Returns the numeric components\n * for a complete, valid date; `null` for an incomplete (\"2026-05\",\n * \"2026-Jan\"), overflowed (\"2026-02-30\", \"2026-Feb-30\"), or non-year-led\n * prefix. Centralizes the fabricated-date rejection for the\n * toStrictIsoTimestamp normalization path across numeric and textual months\n * in one rule.\n */\nfunction parseYearLedDatePrefix(s: string): { y: number; mo: number; da: number } | null {\n  const m = /^(\\d{4})[^0-9A-Za-z]+(\\d{1,2}|[A-Za-z]{3,})[^0-9A-Za-z:]+(\\d{1,2})(?![\\d:])/.exec(s);\n  if (!m) return null;\n  const y = Number(m[1]);\n  const da = Number(m[3]);\n  const mo = /^\\d+$/.test(m[2]) ? Number(m[2]) : (MONTH_NAMES[m[2]!.toLowerCase()] ?? -1);\n  if (!isValidCalendarDate(y, mo, da)) return null;\n  return { y, mo, da };\n}\n\n/**\n * Extract an explicit timezone offset (ms east of UTC) from a non-strict-ISO\n * timestamp, or `null` if none is present (issue #1723 codex r4). Recognizes\n * the offset forms `Date.parse` accepts for non-ISO year-led dates: a trailing\n * `±HH:MM` / `±HHMM`, and a `GMT`/`UTC` token optionally followed by\n * `±HHMM` (bare `GMT`/`UTC` ⇒ offset 0). Strict ISO `Z` forms are handled\n * by `isStrictIsoTimestamp` before this point, so they never reach here.\n */\n/**\n * Named timezone abbreviations Node's `Date.parse` accepts for non-ISO dates\n * (issue #1723 codex r8). V8 recognizes a fixed set of US zones; each maps to a\n * fixed offset (the abbreviation itself encodes standard vs daylight, so PST is\n * always -8 and PDT always -7 regardless of the calendar date). Other named\n * zones (CET/CEST/JST/…) return NaN from `Date.parse` and never reach here.\n */\nconst NAMED_ZONE_OFFSETS_MS: Record<string, number> = {\n  PST: -8 * 60, PDT: -7 * 60,\n  MST: -7 * 60, MDT: -6 * 60,\n  CST: -6 * 60, CDT: -5 * 60,\n  EST: -5 * 60, EDT: -4 * 60,\n};\n\nfunction explicitOffsetMs(value: string): number | null {\n  // Recognize the offset forms Date.parse accepts for non-ISO year-led dates,\n  // returning ms east of UTC or null. Tries each shape in order; a stray run\n  // of date digits can never pose as an offset because (a) trailing numeric\n  // offsets must be preceded by whitespace or glued to a \":SS\" seconds field\n  // (lookbehind), and (b) every candidate is range-validated (|hh| ≤ 14,\n  // mm < 59).\n  // Named US zone abbreviation (PST/EST/EDT/…), trailing token (codex r8).\n  const nz = /\\b([A-Z]{3,4})\\s*$/.exec(value);\n  if (nz && NAMED_ZONE_OFFSETS_MS[nz[1]] !== undefined) {\n    return NAMED_ZONE_OFFSETS_MS[nz[1]] * 60_000;\n  }\n  const tryOff = (sign: string | undefined, hh: number, mm: number): number | null => {\n    if (hh > 14 || mm > 59) return null;\n    return (sign === \"-\" ? -1 : 1) * (hh * 60 + mm) * 60_000;\n  };\n  let m: RegExpExecArray | null;\n  // GMT/UTC token: colon form, then ±HHMM (4-digit, before bare hour so\n  // \"GMT+0530\" is not read as \"+05\"), then bare hour, then the bare token\n  // itself (offset 0).\n  if (\n    (m = /\\b(?:GMT|UTC)\\b\\s*([+-])?(\\d{1,2}):(\\d{2})/i.exec(value)) ||\n    (m = /\\b(?:GMT|UTC)\\b\\s*([+-])?(\\d{2})(\\d{2})/i.exec(value))\n  ) {\n    const r = tryOff(m[1], Number(m[2]), Number(m[3]));\n    if (r !== null) return r;\n  }\n  if ((m = /\\b(?:GMT|UTC)\\b\\s*([+-])?(\\d{1,2})\\b/i.exec(value))) {\n    const r = tryOff(m[1], Number(m[2]), 0);\n    if (r !== null) return r;\n  }\n  if (/\\b(?:GMT|UTC)\\b/i.test(value)) return 0;\n  // Trailing numeric offset: whitespace-delimited OR glued to a \":SS\"\n  // seconds field (lookbehind), so date digits (\"-0510\" in \"2026-0510\") are\n  // never misread as an offset. Colon form, then ±HHMM, then bare hour — each\n  // for BOTH the whitespace and glued contexts.\n  if (\n    (m = /(?:\\s|(?<=:\\d{2}))([+-])(\\d{1,2}):(\\d{2})\\s*$/.exec(value)) ||\n    (m = /(?:\\s|(?<=:\\d{2}))([+-])(\\d{2})(\\d{2})\\s*$/.exec(value)) ||\n    (m = /(?:\\s|(?<=:\\d{2}))([+-])(\\d{1,2})\\s*$/.exec(value))\n  ) {\n    const r = tryOff(m[1], Number(m[2]), m[3] ? Number(m[3]) : 0);\n    if (r !== null) return r;\n  }\n  return null;\n}\n\n/**\n * Verify `Date.parse`'s interpretation of `value` agrees with the year-led\n * `prefix` components `(y, m, d)` (issue #1723 codex r2/r3/r4). Returns\n * `false` when `prefix` is `null` (no complete year-led date). Otherwise\n * compares the FULL tuple so punctuation that shifts the month OR the day is\n * caught. Offset-bearing inputs are compared in the source's explicit offset\n * frame (the prefix date is offset-local, so the same instant legitimately\n * lands on an adjacent UTC/local day); offset-free inputs accept either the\n * local or UTC frame, because `Date.parse` uses UTC for ISO date-only strings\n * and local for non-ISO forms.\n */\nfunction yearLedAgreesWithDateParse(\n  parsed: number,\n  value: string,\n  prefix: { y: number; mo: number; da: number } | null,\n): boolean {\n  if (prefix === null) return false;\n  const off = explicitOffsetMs(value);\n  if (off !== null) {\n    const shifted = new Date(parsed + off);\n    return (\n      shifted.getUTCFullYear() === prefix.y &&\n      shifted.getUTCMonth() + 1 === prefix.mo &&\n      shifted.getUTCDate() === prefix.da\n    );\n  }\n  const pd = new Date(parsed);\n  const localMatch =\n    pd.getFullYear() === prefix.y &&\n    pd.getMonth() + 1 === prefix.mo &&\n    pd.getDate() === prefix.da;\n  const utcMatch =\n    pd.getUTCFullYear() === prefix.y &&\n    pd.getUTCMonth() + 1 === prefix.mo &&\n    pd.getUTCDate() === prefix.da;\n  return localMatch || utcMatch;\n}\n\n/**\n * Zod schema for a single `ProvenanceSource` entry (issue #1575).  Parsed\n * JSON from frontmatter is external data, so each entry is validated here\n * rather than trusted via a cast (rule: no inline-cast-access on parsed\n * blobs).  `safeParse` lets us drop corrupt entries individually instead of\n * failing the whole field.\n */\nconst ProvenanceSourceSchema = z\n  .object({\n    sessionKey: z.string().min(1),\n    observedAt: z\n      .string()\n      .min(1)\n      .refine(isStrictIsoTimestamp, \"must be a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SS[Z|±HH:MM], no calendar overflow)\"),\n    quote: z.string().min(1),\n    turnId: z.string().min(1).optional(),\n    charStart: z.number().finite().nonnegative().int().optional(),\n    charEnd: z.number().finite().nonnegative().int().optional(),\n  })\n  .refine(\n    (src) => src.charStart === undefined || src.charEnd === undefined || src.charEnd >= src.charStart,\n    { message: \"charEnd must be >= charStart (half-open interval, rule 35)\" },\n  );\n\n/**\n * Parse the `sources` array (issue #1575) from its single-line JSON form.\n * Mirrors `parseStructuredAttributes` (JSON.parse) but validates each entry\n * against `ProvenanceSourceSchema` and DROPS corrupt ones rather than\n * poisoning downstream readers — the same \"drop corrupt rather than poison\"\n * contract as `parseMemoryWorthCounterField`.  If no entry survives, the\n * whole field is `undefined` (legacy-equivalent).\n */\nexport function parseProvenanceSources(raw: string | undefined): ProvenanceSource[] | undefined {\n  if (raw === undefined) return undefined;\n  const trimmed = raw.trim();\n  if (trimmed.length === 0) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return undefined;\n  }\n  if (!Array.isArray(parsed)) return undefined;\n  const sources: ProvenanceSource[] = [];\n  for (const entry of parsed) {\n    const result = ProvenanceSourceSchema.safeParse(entry);\n    if (result.success) sources.push(result.data);\n  }\n  return sources.length > 0 ? sources : undefined;\n}\n\n/**\n * Parse the `provenance` config block (issue #1575 PR 1).  Validates the\n * shape before applying defaults — a shorthand like `provenance: false` must\n * reject loudly rather than normalize to `{}` and silently enable the feature\n * (rule 51).  Booleans coerce via `coerceBool` (rule 36); numeric cap clamps\n * at 1 (rule 28).  `REMNIC_PROVENANCE_ENABLED` / `ENGRAM_PROVENANCE_ENABLED`\n * are honored only when the `enabled` key is omitted (explicit config wins).\n *\n * Schema-default note (review rounds 1–3, settled): `provenance.enabled` has\n * NO `\"default\"` in any plugin.json schema. OpenClaw's loader runs\n * `applyDefaults: true` before exposing `api.pluginConfig` (src/index.ts:1345,\n * PR #1593 round 8), so a schema default would be materialized into the\n * merged config and mask the `REMNIC_`/`ENGRAM_` env override. The code-level\n * default-on here (`return true` when `enabled` is omitted) supplies the\n * default-on behavior without that materialization. This matches the\n * emitLegacyTools/namespaceCatalogEnabled precedent, which omits the env\n * override only after a raw-vs-effective split — overkill for a single\n * boolean, so this field uses the simpler omit-the-default approach.\n */\nexport function parseProvenanceConfig(raw: unknown): ProvenanceConfig {\n  if (\n    raw !== undefined &&\n    (raw === null || typeof raw !== \"object\" || Array.isArray(raw))\n  ) {\n    throw new Error(\n      `provenance must be an object (got ${JSON.stringify(raw)}). Use provenance: { enabled: false } to opt out; omit the key to use the default-on behavior (issue #1575).`,\n    );\n  }\n  const rawProvenance =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  return {\n    enabled: (() => {\n      if (rawProvenance.enabled === undefined) {\n        const envEnabled =\n          readEnvVar(\"REMNIC_PROVENANCE_ENABLED\") ?? readEnvVar(\"ENGRAM_PROVENANCE_ENABLED\");\n        if (envEnabled !== undefined) {\n          const coerced = coerceBool(envEnabled);\n          if (coerced === undefined) {\n            throw new Error(\n              `REMNIC_PROVENANCE_ENABLED must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(envEnabled)}`,\n            );\n          }\n          return coerced;\n        }\n        return true;\n      }\n      const coerced = coerceBool(rawProvenance.enabled);\n      if (coerced === undefined) {\n        throw new Error(\n          `provenance.enabled must be a boolean or one of \"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\"on\"/\"off\" (got ${JSON.stringify(rawProvenance.enabled)}). Omit the key to use the default-on behavior (issue #1575).`,\n        );\n      }\n      return coerced;\n    })(),\n    maxQuoteChars: (() => {\n      if (rawProvenance.maxQuoteChars === undefined) return 300;\n      const rawCap = coerceNumber(rawProvenance.maxQuoteChars);\n      // Reject present-but-invalid rather than silently widening the cap\n      // (AGENTS.md input-validation rule — a typo should not persist more\n      // text than the operator configured).\n      if (rawCap === undefined || !Number.isFinite(rawCap) || rawCap < 1 || !Number.isInteger(rawCap)) {\n        throw new Error(\n          `provenance.maxQuoteChars must be a positive integer >= 1 (got ${JSON.stringify(rawProvenance.maxQuoteChars)}).`,\n        );\n      }\n      return rawCap;\n    })(),\n    requireSpans: (() => {\n      if (rawProvenance.requireSpans === undefined) return false;\n      const coerced = coerceBool(rawProvenance.requireSpans);\n      if (coerced === undefined) {\n        throw new Error(\n          `provenance.requireSpans must be a boolean or one of \"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\"on\"/\"off\" (got ${JSON.stringify(rawProvenance.requireSpans)}).`,\n        );\n      }\n      return coerced;\n    })(),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Issue #1575 PR 2 — extraction-side post-parse validator.\n// ---------------------------------------------------------------------------\n//\n// This runs once at write time (inside `ExtractionEngine.extract`, after the\n// LLM output is parsed and sanitized, before the result is returned for\n// persistence). Its job: locate each fact's LLM-provided `quote` in the\n// buffered turn texts and build a `ProvenanceSource[]` with verified\n// offsets. Never throws, never drops a fact (rule 34 spirit — an\n// unverifiable span is a tagged state, not a silent failure).\n//\n// Reuses `collapseWhitespace` from `whitespace.ts` for normalization so there\n// is exactly one normalizer in the codebase (issue #1575 pitfall: \"do not\n// write a second normalizer\").\n// ---------------------------------------------------------------------------\n\n/**\n * A turn in the buffered conversation, reduced to the fields the provenance\n * validator needs. `ExtractionEngine.extract` maps its `BufferTurn[]` to this\n * shape so the validator is pure and testable without the full BufferTurn type.\n */\nexport interface ProvenanceTurnInput {\n  content: string;\n  sessionKey?: string;\n  logicalSessionKey?: string;\n  timestamp: string;\n  turnId?: string;\n}\n\n/**\n * Result of building provenance for a single extracted fact.\n */\nexport interface ProvenanceBuildResult {\n  /** Verified sources (one per matching turn). Absent when no quote survives. */\n  sources?: ProvenanceSource[];\n  /** Coarse strength tag persisted to frontmatter. */\n  provenance: \"verified\" | \"unverified\" | \"none\";\n  /**\n   * Transient signal (never persisted): `true` when `config.requireSpans`\n   * is enabled and the LLM-provided quote could not be located in ANY source\n   * turn (the strict case `ProvenanceConfig.requireSpans` documents: \"facts\n   * whose quote cannot be located are routed to `pending_review`\"). The\n   * extraction consumer carries this onto the in-memory `ExtractedFact` so\n   * the persist path can route the fact to the review queue. A quote that\n   * WAS located but whose source was dropped (e.g. un-coercible timestamp)\n   * does NOT set this flag — the span was found, so requireSpans is\n   * satisfied (chatgpt-codex-connector thread 4xB).\n   */\n  requireSpansPending?: boolean;\n}\n\n/**\n * Cap a quote string at `maxChars`, truncating at the last word boundary that\n * fits and appending an ellipsis marker. Quotes at or under the cap pass\n * through unchanged. Operates on Unicode code points (not UTF-16 units) so\n * emoji and astral-plane characters are not split mid-glyph.\n */\nfunction capQuote(quote: string, maxChars: number): string {\n  const glyphs = Array.from(quote);\n  if (glyphs.length <= maxChars) return quote;\n  // Walk backward from the cap to find a word boundary (space). If the entire\n  // span is one long token (no spaces), cut at the cap — a hard cut is better\n  // than no quote at all.\n  let cut = maxChars;\n  while (cut > 0 && !/\\s/.test(glyphs[cut - 1]!)) cut--;\n  if (cut === 0) cut = maxChars; // no word boundary found\n  return glyphs.slice(0, cut).join(\"\").trimEnd() + \"\\u2026\";\n}\n\n/**\n * Casefold a string for normalized matching. Uses `toLowerCase` (not\n * `toLocaleLowerCase`) for determinism across runtime locales — the existing\n * `normalizeFactKey` helper in extraction.ts follows the same convention.\n */\nfunction casefold(s: string): string {\n  return s.toLowerCase();\n}\n\n/**\n * Locate `quote` within `text`, returning whether a match was found and, when\n * recoverable, the half-open `[start, end)` offsets. Tries exact substring\n * first, then whitespace/case-normalized match.\n *\n * For the normalized path, the mapping from the normalized string back to\n * original offsets is recovered by walking both strings in lockstep: we know\n * `collapseWhitespace(text)` is a subsequence of `text` with whitespace runs\n * collapsed, so we can track the original offset as we scan.\n *\n * Returns `{ matched: false }` when neither match succeeds. Returns\n * `{ matched: true, offsets }` when offsets are recoverable. Returns\n * `{ matched: true }` (offsets omitted) when the normalized substring was\n * found but original offsets could not be recovered — callers still treat\n * this as a verified match and record a source without offsets (cursor\n * thread Ocver — \"Normalized match drops verified provenance\").\n */\ntype LocateQuoteResult =\n  | { matched: false }\n  | { matched: true; offsets?: { charStart: number; charEnd: number } };\n\nfunction locateQuoteOffsets(quote: string, text: string): LocateQuoteResult {\n  // 1. Exact substring match (handles unicode, curly quotes, emoji verbatim).\n  const exactIdx = text.indexOf(quote);\n  if (exactIdx >= 0) {\n    return { matched: true, offsets: { charStart: exactIdx, charEnd: exactIdx + quote.length } };\n  }\n\n  // 2. Whitespace/case-normalized match. Collapse runs of whitespace and\n  //    casefold both sides, then find the normalized quote in the normalized\n  //    text. Recover original offsets by scanning forward from the normalized\n  //    match start through the original text, accumulating non-whitespace\n  //    glyphs until we've consumed the normalized quote length.\n  const normQuote = collapseWhitespace(casefold(quote));\n  if (normQuote.length === 0) return { matched: false };\n  const normText = collapseWhitespace(casefold(text));\n  const normIdx = normText.indexOf(normQuote);\n  if (normIdx < 0) return { matched: false };\n\n  // Recover original offsets: walk the original text, skipping leading\n  // whitespace to align with the collapsed form, then track how many\n  // normalized chars we've consumed.\n  const normQuoteLen = normQuote.length;\n  let origIdx = 0;\n  // Skip leading whitespace in original text (collapseWhitespace trims both ends).\n  while (origIdx < text.length && /\\s/.test(text[origIdx]!)) origIdx++;\n  // Walk through original text, counting normalized chars consumed.\n  // Each non-whitespace char in original = 1 normalized char.\n  // Whitespace runs in original = 1 space in normalized (but only between non-ws).\n  let normPos = 0;\n  let origStart = -1;\n  let origEnd = -1;\n  let prevWasWs = true; // suppress the leading space in collapsed form\n  while (origIdx < text.length && origEnd < 0) {\n    const ch = text[origIdx]!;\n    if (/\\s/.test(ch)) {\n      if (!prevWasWs) {\n        // This whitespace run collapses to a single space in normalized text.\n        if (normPos === normIdx) origStart = origIdx; // normalized space aligns\n        normPos++;\n        prevWasWs = true;\n      }\n      origIdx++;\n      continue;\n    }\n    // Non-whitespace char.\n    if (normPos === normIdx && origStart < 0) {\n      origStart = origIdx;\n    }\n    normPos++;\n    prevWasWs = false;\n    origIdx++;\n    if (normPos >= normIdx + normQuoteLen) {\n      origEnd = origIdx;\n    }\n  }\n  if (origStart >= 0 && origEnd >= 0) {\n    return { matched: true, offsets: { charStart: origStart, charEnd: origEnd } };\n  }\n  // Normalized substring was found, but original offsets are not recoverable\n  // (edge case in the normalized mapping). The match still counts as verified\n  // — record a source without offsets rather than dropping the turn entirely\n  // (cursor thread Ocver). charStart/charEnd are best-effort debugging aids,\n  // not a precondition for a verified source.\n  return { matched: true };\n}\n\n/**\n * Build provenance sources for a single extracted fact by locating its\n * LLM-provided `quote` in the buffered turns (issue #1575 PR 2).\n *\n * Matching strategy (per issue design):\n *   1. Exact substring match in a turn → `provenance: \"verified\"` with\n *      `charStart`/`charEnd` offsets.\n *   2. Whitespace/case-normalized match → `\"verified\"`, offsets recovered\n *      when possible, else omitted.\n *   3. No match in any turn → `\"unverified\"` — the quote survives as a\n *      source (the LLM vouched for it) but without located offsets.\n *   4. No quote provided by the LLM → `\"none\"` — no evidence to record.\n *\n * A quote appearing in multiple turns produces multiple sources (one per\n * matching turn) so a repeated utterance backs the fact from each occurrence.\n *\n * The quote is capped at `config.maxQuoteChars` (truncated at a word boundary\n * with an ellipsis marker) BEFORE storage. Locating uses the original\n * (untruncated) quote for maximum match fidelity; the capped excerpt is what\n * gets persisted.\n *\n * When `config.enabled === false`, returns `{ provenance: \"none\" }`\n * immediately — byte-identical to pre-feature extraction (rule 39).\n *\n * Never throws. An unexpected error degrades to `{ provenance: \"none\" }` so\n * extraction never crashes on a provenance hiccup (rule 13/18).\n */\n/**\n * Strip a leading extraction-prompt role label from a quote (cursor thread Oc3Z2\n * — \"Quote prompt mismatches validator\"). The extraction prompt renders each\n * buffered turn as `[role] content` (or `[context role] content`), so a\n * faithful LLM may include that prefix in its verbatim quote. buildFactProvenance\n * searches the raw `turn.content` (no prefix), so a quote carrying the label\n * would never match. Stripping the leading label lets the actual utterance\n * verify against the turn text. Only a SINGLE leading label is stripped — a\n * multi-turn quote (with embedded labels) is left untouched and will simply\n * fail to match a single turn, as before.\n *\n * The regex is constrained to the labels the prompt actually emits — `user`,\n * `assistant`, optionally prefixed with `context ` (extraction.ts renders\n * `[user]`, `[assistant]`, `[context user]`, `[context assistant]`). A\n * real utterance that happens to start with other bracketed text (e.g.\n * `[do not] deploy before approval`, `[P1] fix the cache`) is preserved\n * verbatim so the quote can match the turn and the persisted span retains its\n * original meaning (chatgpt-codex-connector thread 4xA — limiting role-prefix\n * stripping to actual prompt labels).\n */\nfunction stripLeadingRolePrefix(quote: string): string {\n  return quote.replace(/^\\s*\\[(?:context\\s+)?(?:user|assistant)\\]\\s+/i, \"\");\n}\n\nexport function buildFactProvenance(\n  factQuote: string | null | undefined,\n  turns: ReadonlyArray<ProvenanceTurnInput>,\n  config: ProvenanceConfig,\n): ProvenanceBuildResult {\n  if (!config.enabled) return { provenance: \"none\" };\n  const rawQuote = typeof factQuote === \"string\" ? factQuote.trim() : \"\";\n  // requireSpans (chatgpt-codex-connector thread dEsu + cursor thread dGKJ):\n  // every early exit that drops a fact's span (no quote, empty after label\n  // strip, or unsafe quote) must flag requireSpansPending when the operator\n  // opted into requireSpans, so the persist path routes the fact to\n  // pending_review instead of active. Only the disabled-feature exit (above)\n  // and the unexpected-error catch (below) omit the flag — those are\n  // policy-neutral degradations, not a missing-span decision.\n  const noneResult = (): ProvenanceBuildResult =>\n    config.requireSpans === true\n      ? { provenance: \"none\", requireSpansPending: true }\n      : { provenance: \"none\" };\n  if (rawQuote.length === 0) return noneResult();\n  // Strip a leading prompt role label so a faithful quote verifies against\n  // the raw turn content (cursor thread Oc3Z2). Prefer the RAW quote when it\n  // matches at least one turn — an utterance that literally begins with\n  // [user]/[assistant] must verify as-is, not be truncated to the post-label\n  // text (cursor/codex thread dEsw). The strip handles the common case where\n  // the LLM includes the prompt label; this preserves the rare case where the\n  // utterance itself starts with that text.\n  const strippedQuote = stripLeadingRolePrefix(rawQuote);\n  const useRawQuote =\n    rawQuote === strippedQuote ||\n    turns.some(\n      (t) =>\n        typeof t?.content === \"string\" &&\n        t.content.length > 0 &&\n        locateQuoteOffsets(rawQuote, t.content).matched,\n    );\n  const quote = useRawQuote ? rawQuote : strippedQuote;\n  if (quote.length === 0) return noneResult();\n  // Sanitize the quote before persisting it as a provenance span\n  // (chatgpt-codex-connector thread dANZ): the fact body is sanitized via\n  // sanitizeMemoryContent, but sources[].quote was persisted verbatim,\n  // reintroducing unsafe memory text (e.g. \"ignore previous instructions\")\n  // through the provenance field exposed to memory_get/x-ray/faithfulness.\n  // An unsafe quote cannot serve as evidence — drop the source entirely\n  // (consistent with how the body is sanitized: unsafe text is redacted,\n  // and a redacted quote is useless as a verbatim span).\n  if (!isSafeMemoryContent(quote)) return noneResult();\n\n  try {\n    // Search every turn for the quote. Collect verified sources.\n    const sources: ProvenanceSource[] = [];\n    // Track the first turn where the quote was located even when its\n    // timestamp can't be coerced (cursor thread 4Pj — \"Bad timestamp drops\n    // matched source\"). Without this, a located-but-unverifiable quote falls\n    // through to the unverified branch and is attributed to the *last* turn's\n    // session, mislabeling the source's origin session. Also drives the\n    // requireSpans signal: only a quote that was NOT located in any turn\n    // qualifies for pending_review routing under requireSpans (thread 4xB).\n    let locatedTurn: ProvenanceTurnInput | undefined;\n    for (const turn of turns) {\n      if (!turn || typeof turn.content !== \"string\" || turn.content.length === 0) continue;\n      const located = locateQuoteOffsets(quote, turn.content);\n      // cursor thread Ocver: a normalized match counts as verified even when\n      // original offsets are unrecoverable — record the source without\n      // charStart/charEnd instead of skipping the turn.\n      if (!located.matched) continue;\n      if (!locatedTurn) locatedTurn = turn;\n      // cursor thread Ocveu: normalize the turn timestamp to strict ISO so\n      // the write-path ProvenanceSourceSchema keeps the source. Skip the turn\n      // when the timestamp can't be coerced — pushing it would guarantee a\n      // serialization drop (and the tag downgrade) for this source.\n      const observedAt = toStrictIsoTimestamp(turn.timestamp);\n      if (!observedAt) continue;\n      sources.push({\n        sessionKey: turn.sessionKey ?? turn.logicalSessionKey ?? \"unknown\",\n        ...(turn.turnId ? { turnId: turn.turnId } : {}),\n        observedAt,\n        quote: capQuote(quote, config.maxQuoteChars),\n        ...(located.offsets\n          ? { charStart: located.offsets.charStart, charEnd: located.offsets.charEnd }\n          : {}),\n      });\n    }\n\n    if (sources.length > 0) {\n      return { sources, provenance: \"verified\" };\n    }\n\n    // Quote provided but could not be turned into a verified source.\n    // Determine the session to attribute: prefer the turn where the quote was\n    // LOCATED even if its timestamp couldn't be coerced (cursor thread 4Pj — a\n    // located quote must not be tied to the *last* turn's session). If the\n    // quote was not located in any turn at all, fall back to the last turn's\n    // session (the documented unverified behavior: the LLM vouched for the\n    // excerpt but we couldn't pin it to a character offset). Normalize the\n    // timestamp (thread Ocveu); fall back to epoch when no turn supplies a\n    // coercible timestamp so the unverified source still survives the\n    // write-path schema.\n    const fallbackTurn = locatedTurn ?? turns[turns.length - 1];\n    const fallbackSessionKey = fallbackTurn\n      ? (fallbackTurn.sessionKey ?? fallbackTurn.logicalSessionKey ?? \"unknown\")\n      : \"unknown\";\n    const fallbackObservedAt = fallbackTurn\n      ? (toStrictIsoTimestamp(fallbackTurn.timestamp) ?? new Date(0).toISOString())\n      : new Date(0).toISOString();\n    // requireSpans signal (chatgpt-codex-connector thread 4xB): when an\n    // operator opts into provenance.requireSpans, a fact whose quote could\n    // not be located in ANY turn (locatedTurn undefined) is flagged so the\n    // persist path routes it to pending_review instead of active. A quote\n    // that WAS located (locatedTurn set) satisfies requireSpans even when\n    // its source was dropped for an un-coercible timestamp — the span was\n    // found, so the fact has the grounding requireSpans demands.\n    const requireSpansPending =\n      config.requireSpans === true && locatedTurn === undefined;\n    return {\n      sources: [\n        {\n          sessionKey: fallbackSessionKey,\n          observedAt: fallbackObservedAt,\n          quote: capQuote(quote, config.maxQuoteChars),\n        },\n      ],\n      provenance: \"unverified\",\n      ...(requireSpansPending ? { requireSpansPending: true } : {}),\n    };\n  } catch {\n    // Never crash extraction on a provenance error (rule 13/18).\n    return { provenance: \"none\" };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,SAAS,SAAS;AAalB,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,SAAS,0BAA0B,KAAgD;AACjF,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,6BAA6B;AAC7C,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,UAAU,OAAW,KAAI,GAAG,IAAI;AAAA,EACtC;AACA,SAAO;AACT;AAgBO,SAAS,0BAA0B,IAAuB,OAAuB;AACtF,MAAI,kBAAkB;AACtB,MAAI,GAAG,WAAW,GAAG,QAAQ,SAAS,GAAG;AAIvC,UAAM,YAAuC,CAAC;AAC9C,eAAW,OAAO,GAAG,SAAS;AAC5B,YAAM,SAAS,uBAAuB,UAAU,GAAG;AACnD,UAAI,OAAO,QAAS,WAAU,KAAK,0BAA0B,OAAO,IAAI,CAAC;AAAA,IAC3E;AACA,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,KAAK,YAAY,KAAK,UAAU,SAAS,CAAC,EAAE;AAClD,wBAAkB;AAAA,IACpB;AAAA,EACF;AAKA,QAAM,OACH,GAAG,eAAe,cAAc,GAAG,eAAe,iBAAiB,CAAC,kBACjE,SACA,GAAG;AACT,MAAI,KAAK;AACP,UAAM,KAAK,eAAe,GAAG,EAAE;AAAA,EACjC;AACF;AAQO,SAAS,mBACd,KACgD;AAChD,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI,YAAY,cAAc,YAAY,gBAAgB,YAAY,QAAQ;AAC5E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAaO,SAAS,wBACd,KACA,SACgD;AAChD,OAAK,QAAQ,cAAc,QAAQ,kBAAkB,CAAC,WAAW,QAAQ,WAAW,IAAI;AACtF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,qBAAqB,GAAoB;AAChD,QAAM,IAAI,mFAAmF,KAAK,CAAC;AACnG,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;AAC3D,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;AAG3D,QAAM,IAAI,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAKrD,SACE,CAAC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,KAC3B,EAAE,eAAe,MAAM,KACvB,EAAE,YAAY,MAAM,KAAK,KACzB,EAAE,WAAW,MAAM,MACnB,EAAE,YAAY,MAAM,KACpB,EAAE,cAAc,MAAM,MACtB,EAAE,cAAc,MAAM;AAE1B;AAeA,SAAS,qBAAqB,IAAmD;AAC/E,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,EAAG,QAAO;AAKtD,QAAM,QAAQ,GAAG,KAAK;AACtB,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AAajC,QAAM,gBAAgB,uBAAuB,KAAK;AAalD,QAAM,gBAAgB,2BAA2B,QAAQ,OAAO,aAAa;AAC7E,QAAM,eAAe,kBAAkB,QAAQ;AAQ/C,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,CAAC,cAAc;AACzC,WAAO;AAAA,EACT;AAIA,MAAI,WAAW,KAAK,KAAK,KAAK,CAAC,cAAc;AAC3C,WAAO;AAAA,EACT;AAMA,QAAM,MAAM,iCAAiC,KAAK,KAAK;AACvD,MAAI,KAAK;AACP,UAAM,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;AAChE,QAAI,CAAC,oBAAoB,IAAI,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,GAAG;AACpE,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,KAAK,MAAM,EAAE,YAAY;AACzC,SAAO,qBAAqB,GAAG,IAAI,MAAM;AAC3C;AAQA,SAAS,oBAAoB,GAAW,IAAY,IAAqB;AACvE,MAAI,KAAK,KAAK,KAAK,MAAM,KAAK,EAAG,QAAO;AACxC,QAAM,OAAQ,IAAI,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,QAAQ,KAAM,KAAK;AACtE,QAAM,cAAc,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACrE,SAAO,MAAM,YAAY,KAAK,CAAC;AACjC;AAQA,IAAM,cAAsC;AAAA,EAC1C,KAAK;AAAA,EAAG,SAAS;AAAA,EACjB,KAAK;AAAA,EAAG,UAAU;AAAA,EAClB,KAAK;AAAA,EAAG,OAAO;AAAA,EACf,KAAK;AAAA,EAAG,OAAO;AAAA,EACf,KAAK;AAAA,EACL,KAAK;AAAA,EAAG,MAAM;AAAA,EACd,KAAK;AAAA,EAAG,MAAM;AAAA,EACd,KAAK;AAAA,EAAG,QAAQ;AAAA,EAChB,KAAK;AAAA,EAAG,WAAW;AAAA,EACnB,MAAM;AAAA,EACN,KAAK;AAAA,EAAI,SAAS;AAAA,EAClB,KAAK;AAAA,EAAI,UAAU;AAAA,EACnB,KAAK;AAAA,EAAI,UAAU;AACrB;AAkBA,SAAS,uBAAuB,GAAyD;AACvF,QAAM,IAAI,8EAA8E,KAAK,CAAC;AAC9F,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AACrB,QAAM,KAAK,OAAO,EAAE,CAAC,CAAC;AACtB,QAAM,KAAK,QAAQ,KAAK,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,IAAK,YAAY,EAAE,CAAC,EAAG,YAAY,CAAC,KAAK;AACpF,MAAI,CAAC,oBAAoB,GAAG,IAAI,EAAE,EAAG,QAAO;AAC5C,SAAO,EAAE,GAAG,IAAI,GAAG;AACrB;AAiBA,IAAM,wBAAgD;AAAA,EACpD,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAAA,EACxB,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAAA,EACxB,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAAA,EACxB,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAC1B;AAEA,SAAS,iBAAiB,OAA8B;AAQtD,QAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,MAAI,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,QAAW;AACpD,WAAO,sBAAsB,GAAG,CAAC,CAAC,IAAI;AAAA,EACxC;AACA,QAAM,SAAS,CAAC,MAA0B,IAAY,OAA8B;AAClF,QAAI,KAAK,MAAM,KAAK,GAAI,QAAO;AAC/B,YAAQ,SAAS,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM;AAAA,EACpD;AACA,MAAI;AAIJ,OACG,IAAI,8CAA8C,KAAK,KAAK,OAC5D,IAAI,2CAA2C,KAAK,KAAK,IAC1D;AACA,UAAM,IAAI,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;AACjD,QAAI,MAAM,KAAM,QAAO;AAAA,EACzB;AACA,MAAK,IAAI,wCAAwC,KAAK,KAAK,GAAI;AAC7D,UAAM,IAAI,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;AACtC,QAAI,MAAM,KAAM,QAAO;AAAA,EACzB;AACA,MAAI,mBAAmB,KAAK,KAAK,EAAG,QAAO;AAK3C,OACG,IAAI,gDAAgD,KAAK,KAAK,OAC9D,IAAI,6CAA6C,KAAK,KAAK,OAC3D,IAAI,wCAAwC,KAAK,KAAK,IACvD;AACA,UAAM,IAAI,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AAC5D,QAAI,MAAM,KAAM,QAAO;AAAA,EACzB;AACA,SAAO;AACT;AAaA,SAAS,2BACP,QACA,OACA,QACS;AACT,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,MAAM,iBAAiB,KAAK;AAClC,MAAI,QAAQ,MAAM;AAChB,UAAM,UAAU,IAAI,KAAK,SAAS,GAAG;AACrC,WACE,QAAQ,eAAe,MAAM,OAAO,KACpC,QAAQ,YAAY,IAAI,MAAM,OAAO,MACrC,QAAQ,WAAW,MAAM,OAAO;AAAA,EAEpC;AACA,QAAM,KAAK,IAAI,KAAK,MAAM;AAC1B,QAAM,aACJ,GAAG,YAAY,MAAM,OAAO,KAC5B,GAAG,SAAS,IAAI,MAAM,OAAO,MAC7B,GAAG,QAAQ,MAAM,OAAO;AAC1B,QAAM,WACJ,GAAG,eAAe,MAAM,OAAO,KAC/B,GAAG,YAAY,IAAI,MAAM,OAAO,MAChC,GAAG,WAAW,MAAM,OAAO;AAC7B,SAAO,cAAc;AACvB;AASA,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,YAAY,EACT,OAAO,EACP,IAAI,CAAC,EACL,OAAO,sBAAsB,6FAA0F;AAAA,EAC1H,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5D,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS;AAC5D,CAAC,EACA;AAAA,EACC,CAAC,QAAQ,IAAI,cAAc,UAAa,IAAI,YAAY,UAAa,IAAI,WAAW,IAAI;AAAA,EACxF,EAAE,SAAS,6DAA6D;AAC1E;AAUK,SAAS,uBAAuB,KAAyD;AAC9F,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,OAAO,QAAS,SAAQ,KAAK,OAAO,IAAI;AAAA,EAC9C;AACA,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAqBO,SAAS,sBAAsB,KAAgC;AACpE,MACE,QAAQ,WACP,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,IAC7D;AACA,UAAM,IAAI;AAAA,MACR,qCAAqC,KAAK,UAAU,GAAG,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,gBACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAC/C,MACD,CAAC;AACP,SAAO;AAAA,IACL,UAAU,MAAM;AACd,UAAI,cAAc,YAAY,QAAW;AACvC,cAAM,aACJ,WAAW,2BAA2B,KAAK,WAAW,2BAA2B;AACnF,YAAI,eAAe,QAAW;AAC5B,gBAAMA,WAAU,WAAW,UAAU;AACrC,cAAIA,aAAY,QAAW;AACzB,kBAAM,IAAI;AAAA,cACR,8FAA8F,KAAK,UAAU,UAAU,CAAC;AAAA,YAC1H;AAAA,UACF;AACA,iBAAOA;AAAA,QACT;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAU,WAAW,cAAc,OAAO;AAChD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR,oGAAoG,KAAK,UAAU,cAAc,OAAO,CAAC;AAAA,QAC3I;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,IACH,gBAAgB,MAAM;AACpB,UAAI,cAAc,kBAAkB,OAAW,QAAO;AACtD,YAAM,SAAS,aAAa,cAAc,aAAa;AAIvD,UAAI,WAAW,UAAa,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,MAAM,GAAG;AAC/F,cAAM,IAAI;AAAA,UACR,iEAAiE,KAAK,UAAU,cAAc,aAAa,CAAC;AAAA,QAC9G;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,IACH,eAAe,MAAM;AACnB,UAAI,cAAc,iBAAiB,OAAW,QAAO;AACrD,YAAM,UAAU,WAAW,cAAc,YAAY;AACrD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR,yGAAyG,KAAK,UAAU,cAAc,YAAY,CAAC;AAAA,QACrJ;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,EACL;AACF;AA2DA,SAAS,SAAS,OAAe,UAA0B;AACzD,QAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,MAAI,OAAO,UAAU,SAAU,QAAO;AAItC,MAAI,MAAM;AACV,SAAO,MAAM,KAAK,CAAC,KAAK,KAAK,OAAO,MAAM,CAAC,CAAE,EAAG;AAChD,MAAI,QAAQ,EAAG,OAAM;AACrB,SAAO,OAAO,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,IAAI;AACnD;AAOA,SAAS,SAAS,GAAmB;AACnC,SAAO,EAAE,YAAY;AACvB;AAuBA,SAAS,mBAAmB,OAAe,MAAiC;AAE1E,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,YAAY,GAAG;AACjB,WAAO,EAAE,SAAS,MAAM,SAAS,EAAE,WAAW,UAAU,SAAS,WAAW,MAAM,OAAO,EAAE;AAAA,EAC7F;AAOA,QAAM,YAAY,mBAAmB,SAAS,KAAK,CAAC;AACpD,MAAI,UAAU,WAAW,EAAG,QAAO,EAAE,SAAS,MAAM;AACpD,QAAM,WAAW,mBAAmB,SAAS,IAAI,CAAC;AAClD,QAAM,UAAU,SAAS,QAAQ,SAAS;AAC1C,MAAI,UAAU,EAAG,QAAO,EAAE,SAAS,MAAM;AAKzC,QAAM,eAAe,UAAU;AAC/B,MAAI,UAAU;AAEd,SAAO,UAAU,KAAK,UAAU,KAAK,KAAK,KAAK,OAAO,CAAE,EAAG;AAI3D,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,SAAO,UAAU,KAAK,UAAU,UAAU,GAAG;AAC3C,UAAM,KAAK,KAAK,OAAO;AACvB,QAAI,KAAK,KAAK,EAAE,GAAG;AACjB,UAAI,CAAC,WAAW;AAEd,YAAI,YAAY,QAAS,aAAY;AACrC;AACA,oBAAY;AAAA,MACd;AACA;AACA;AAAA,IACF;AAEA,QAAI,YAAY,WAAW,YAAY,GAAG;AACxC,kBAAY;AAAA,IACd;AACA;AACA,gBAAY;AACZ;AACA,QAAI,WAAW,UAAU,cAAc;AACrC,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,aAAa,KAAK,WAAW,GAAG;AAClC,WAAO,EAAE,SAAS,MAAM,SAAS,EAAE,WAAW,WAAW,SAAS,QAAQ,EAAE;AAAA,EAC9E;AAMA,SAAO,EAAE,SAAS,KAAK;AACzB;AAiDA,SAAS,uBAAuB,OAAuB;AACrD,SAAO,MAAM,QAAQ,iDAAiD,EAAE;AAC1E;AAEO,SAAS,oBACd,WACA,OACA,QACuB;AACvB,MAAI,CAAC,OAAO,QAAS,QAAO,EAAE,YAAY,OAAO;AACjD,QAAM,WAAW,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AAQpE,QAAM,aAAa,MACjB,OAAO,iBAAiB,OACpB,EAAE,YAAY,QAAQ,qBAAqB,KAAK,IAChD,EAAE,YAAY,OAAO;AAC3B,MAAI,SAAS,WAAW,EAAG,QAAO,WAAW;AAQ7C,QAAM,gBAAgB,uBAAuB,QAAQ;AACrD,QAAM,cACJ,aAAa,iBACb,MAAM;AAAA,IACJ,CAAC,MACC,OAAO,GAAG,YAAY,YACtB,EAAE,QAAQ,SAAS,KACnB,mBAAmB,UAAU,EAAE,OAAO,EAAE;AAAA,EAC5C;AACF,QAAM,QAAQ,cAAc,WAAW;AACvC,MAAI,MAAM,WAAW,EAAG,QAAO,WAAW;AAS1C,MAAI,CAAC,oBAAoB,KAAK,EAAG,QAAO,WAAW;AAEnD,MAAI;AAEF,UAAM,UAA8B,CAAC;AAQrC,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,WAAW,EAAG;AAC5E,YAAM,UAAU,mBAAmB,OAAO,KAAK,OAAO;AAItD,UAAI,CAAC,QAAQ,QAAS;AACtB,UAAI,CAAC,YAAa,eAAc;AAKhC,YAAM,aAAa,qBAAqB,KAAK,SAAS;AACtD,UAAI,CAAC,WAAY;AACjB,cAAQ,KAAK;AAAA,QACX,YAAY,KAAK,cAAc,KAAK,qBAAqB;AAAA,QACzD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7C;AAAA,QACA,OAAO,SAAS,OAAO,OAAO,aAAa;AAAA,QAC3C,GAAI,QAAQ,UACR,EAAE,WAAW,QAAQ,QAAQ,WAAW,SAAS,QAAQ,QAAQ,QAAQ,IACzE,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,EAAE,SAAS,YAAY,WAAW;AAAA,IAC3C;AAYA,UAAM,eAAe,eAAe,MAAM,MAAM,SAAS,CAAC;AAC1D,UAAM,qBAAqB,eACtB,aAAa,cAAc,aAAa,qBAAqB,YAC9D;AACJ,UAAM,qBAAqB,eACtB,qBAAqB,aAAa,SAAS,MAAK,oBAAI,KAAK,CAAC,GAAE,YAAY,KACzE,oBAAI,KAAK,CAAC,GAAE,YAAY;AAQ5B,UAAM,sBACJ,OAAO,iBAAiB,QAAQ,gBAAgB;AAClD,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,UACE,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,OAAO,SAAS,OAAO,OAAO,aAAa;AAAA,QAC7C;AAAA,MACF;AAAA,MACA,YAAY;AAAA,MACZ,GAAI,sBAAsB,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF,QAAQ;AAEN,WAAO,EAAE,YAAY,OAAO;AAAA,EAC9B;AACF;","names":["coerced"]}
+{"version":3,"sources":["../src/provenance.ts"],"sourcesContent":["/**\n * Claim-level provenance spans (issue #1575 PR 1).\n *\n * Centralizes the parse/serialize logic for the `sources` array and the\n * coarse `provenance` strength tag, plus the `provenance` config-block\n * parser.  Extracted from `storage.ts` and `config.ts` so those files keep\n * only thin delegation call-sites — the frontmatter round-trip and config\n * parsing growth lives here (issue #1520 ratchet discipline).\n *\n * Contract:\n *  - When no provenance fields are present, output is byte-identical to\n *    pre-feature behavior (rule 39).\n *  - Corrupt `sources` lines / unknown `provenance` tags drop to\n *    `undefined` on read so a malformed frontmatter never poisons\n *    downstream readers (rule 34 spirit — drop corrupt rather than poison).\n *  - Validation lives on the write path; this module only parses.\n *  - Invariant (review round 5, cursor thread KQN): a `verified` or\n *    `unverified` tag is NEVER persisted/read without surviving sources —\n *    without excerpts the tag is indistinguishable from a grounded fact to\n *    downstream faithfulness/correction/TrustScore surfaces. The invariant\n *    is enforced symmetrically: `serializeProvenanceFields` (write) and\n *    `reconcileProvenanceRead` (read) both downgrade the tag to `none`\n *    when no source survives.\n */\n\nimport { z } from \"zod\";\n\nimport { coerceBool, coerceNumber } from \"./connectors/coerce.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport { collapseWhitespace } from \"./whitespace.js\";\nimport type { MemoryFrontmatter, ProvenanceConfig, ProvenanceSource } from \"./types.js\";\nimport { isSafeMemoryContent } from \"./sanitize.js\";\n\n/**\n * Canonical key order for a serialized `ProvenanceSource` (issue #1575).\n * Deterministic emission (rule 38) — readers and the byte-identical-when-off\n * contract (rule 39) depend on this order never drifting.\n */\nconst PROVENANCE_SOURCE_KEY_ORDER = [\n  \"sessionKey\",\n  \"turnId\",\n  \"observedAt\",\n  \"quote\",\n  \"charStart\",\n  \"charEnd\",\n] as const;\n\n/**\n * Build a single `ProvenanceSource` object whose keys appear in the canonical\n * order, omitting absent optional fields. The result is what gets fed to\n * `JSON.stringify` so the on-disk line is deterministic.\n */\nfunction canonicalProvenanceSource(src: ProvenanceSource): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of PROVENANCE_SOURCE_KEY_ORDER) {\n    const value = src[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Serialize the `sources` array (issue #1575) as a single JSON line, matching\n * the `structuredAttributes` precedent. Each entry is rebuilt in canonical key\n * order (rule 38) so the output is byte-stable. The `provenance` enum is\n * emitted bare (same style as `status`) — only the three documented values\n * are ever written.\n *\n * Verified-requires-evidence invariant (review round 5, cursor thread KQN):\n * a `verified`/`unverified` tag is downgraded to `none` whenever no source\n * survives write validation — whether sources were absent, an empty array,\n * or all entries failed the schema. This covers all three failure shapes the\n * earlier 3-branch logic left open (`{provenance:\"verified\"}`,\n * `{sources:[],provenance:\"verified\"}`, `{sources:[invalid…],provenance:\"verified\"}`).\n */\nexport function serializeProvenanceFields(fm: MemoryFrontmatter, lines: string[]): void {\n  let hasValidSources = false;\n  if (fm.sources && fm.sources.length > 0) {\n    // Validate each entry against the same schema used on read so invalid\n    // in-memory sources are dropped at write time, not silently lost on the\n    // next read (review thread 4 — write-path validation parity).\n    const canonical: Record<string, unknown>[] = [];\n    for (const src of fm.sources) {\n      const result = ProvenanceSourceSchema.safeParse(src);\n      if (result.success) canonical.push(canonicalProvenanceSource(result.data));\n    }\n    if (canonical.length > 0) {\n      lines.push(`sources: ${JSON.stringify(canonical)}`);\n      hasValidSources = true;\n    }\n  }\n  // A verified/unverified tag requires surviving evidence; without it the\n  // tag is meaningless downstream (faithfulness/TrustScore cannot distinguish\n  // it from a grounded fact). Downgrade to \"none\" regardless of WHY no source\n  // survived (absent / empty / all-invalid) — single invariant, all cases.\n  const tag =\n    (fm.provenance === \"verified\" || fm.provenance === \"unverified\") && !hasValidSources\n      ? \"none\"\n      : fm.provenance;\n  if (tag) {\n    lines.push(`provenance: ${tag}`);\n  }\n}\n\n/**\n * Parse the coarse `provenance` strength tag (issue #1575). Returns\n * `undefined` for missing/blank/unknown values so a corrupt or hand-edited\n * field fails safely to the legacy-equivalent `\"none\"` semantics on read\n * (rule 34 spirit — drop corrupt rather than poison).\n */\nexport function parseProvenanceTag(\n  raw: string | undefined,\n): \"verified\" | \"unverified\" | \"none\" | undefined {\n  if (raw === undefined) return undefined;\n  const trimmed = raw.trim();\n  if (trimmed.length === 0) return undefined;\n  if (trimmed === \"verified\" || trimmed === \"unverified\" || trimmed === \"none\") {\n    return trimmed;\n  }\n  return undefined;\n}\n\n/**\n * Enforce the verified-requires-evidence invariant on the READ path.\n * `parseProvenanceTag` and `parseProvenanceSources` are independent (they\n * parse separate frontmatter lines), so a hand-edited or imported memory may\n * carry `provenance: verified` with no surviving `sources` — a corrupt line,\n * an empty array, or all-invalid entries. Downgrade such a tag to `none` so\n * the in-memory object never exposes an ungrounded \"verified\" fact\n * (review round 5, cursor thread KQN — read-path parity with the write-path\n * downgrade in `serializeProvenanceFields`). `none`/`undefined` tags pass\n * through unchanged.\n */\nexport function reconcileProvenanceRead(\n  tag: \"verified\" | \"unverified\" | \"none\" | undefined,\n  sources: ProvenanceSource[] | undefined,\n): \"verified\" | \"unverified\" | \"none\" | undefined {\n  if ((tag === \"verified\" || tag === \"unverified\") && (!sources || sources.length === 0)) {\n    return \"none\";\n  }\n  return tag;\n}\n\n/**\n * Strict ISO-8601 timestamp check (review round 6, codex thread OXPAp).\n * `Date.parse` accepts non-ISO strings (bare years like `\"123\"`) and\n * silently normalizes calendar overflow (`2026-02-30` -> March 2, hour 25\n * -> next day), so malformed provenance survives as if valid. Require the\n * full `YYYY-MM-DDTHH:MM:SS[.fff](Z|±HH:MM)` shape and reject overflow via a\n * `Date.UTC` round-trip component check — the offset does not affect whether\n * a wall-clock field overflows, so this is correct for any timezone suffix.\n */\nfunction isStrictIsoTimestamp(s: string): boolean {\n  const m = /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$/.exec(s);\n  if (!m) return false;\n  const y = Number(m[1]), mo = Number(m[2]), da = Number(m[3]);\n  const h = Number(m[4]), mi = Number(m[5]), se = Number(m[6]);\n  // Date.UTC normalizes overflow (Feb 30 -> Mar 2); a component round-trip\n  // catches what Date.parse silently accepts.\n  const d = new Date(Date.UTC(y, mo - 1, da, h, mi, se));\n  // The component round-trip validates wall-clock overflow (Feb 30 -> Mar 2);\n  // Date.parse additionally rejects impossible timezone offsets such as\n  // +99:99, which the regex accepts but the runtime treats as NaN\n  // (codex thread OXQ0e).\n  return (\n    !Number.isNaN(Date.parse(s)) &&\n    d.getUTCFullYear() === y &&\n    d.getUTCMonth() === mo - 1 &&\n    d.getUTCDate() === da &&\n    d.getUTCHours() === h &&\n    d.getUTCMinutes() === mi &&\n    d.getUTCSeconds() === se\n  );\n}\n\n/**\n * Coerce a turn timestamp to a strict ISO-8601 string (cursor thread Ocveu —\n * \"Non-ISO turn timestamps drop sources\"). The write-path `ProvenanceSourceSchema`\n * rejects anything `isStrictIsoTimestamp` fails, so a turn whose `timestamp`\n * parses via `new Date(...)` but isn't already strict ISO (e.g.\n * `\"2026/01/15 12:00:00\"` or `\"Jan 15 2026\"`) would be silently dropped at\n * serialization — clearing the whole `sources` array and downgrading the tag\n * to `\"none\"`. Normalizing at extraction time preserves the source.\n *\n * Returns the strict ISO string when the timestamp already passes or\n * `Date.parse` can round-trip it; `undefined` for empty / unparseable input\n * so callers can decide whether to skip the source or fall back.\n */\nfunction toStrictIsoTimestamp(ts: string | undefined | null): string | undefined {\n  if (typeof ts !== \"string\" || ts.length === 0) return undefined;\n  // Trim surrounding whitespace: Date.parse accepts leading/trailing\n  // whitespace, so an imported \" 2026-05\" would otherwise bypass the\n  // year-led partial-date guard below and fabricate May 1\n  // (chatgpt-codex-connector review on #1714, issue #1657).\n  const value = ts.trim();\n  if (value.length === 0) return undefined;\n  if (isStrictIsoTimestamp(value)) return value;\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) return undefined;\n  // Year-led date guard (issues #1657 + #1723). `parseYearLedDatePrefix`\n  // recognizes a COMPLETE, calendar-valid year-led prefix — numeric OR textual\n  // month — with real date-separator RUNS of non-alphanumeric, non-colon chars\n  // (so complete-but-unusual-punctuation dates like \"2026 May, 10\",\n  // \"2026, May 10\", \"2026 Jan. 15\" are accepted), the day-not-the-hour\n  // invariant via the `(?![\\d:])` lookahead, and a calendar-valid day. This\n  // single rule subsumes the prior partial-numeric (\"2026-05\"), textual-partial\n  // (\"2026-Jan\"), and calendar-overflow (\"2026-02-30\", \"2026-Feb-30\") checks\n  // and extends them to textual months — Date.parse silently fills missing\n  // components and rolls overflow, fabricating observedAt, so a non-complete\n  // or invalid year-led prefix is rejected. Non-year-led shapes\n  // (\"Jan 15 2026\", \"02/30/2026\") fall through to Date.parse / the mdy check.\n  const yearLedPrefix = parseYearLedDatePrefix(value);\n  // Agreement check (issue #1723 codex r2/r3/r4): exotic punctuation can make\n  // the prefix structure disagree with Date.parse's own interpretation — e.g.\n  // \"2026 (May) 10\" parses as a valid May 10 PREFIX but Date.parse reads\n  // October 1; \"2026 May (10)\" agrees on month but Date.parse reads day 1 — so\n  // the round-trip would persist a fabricated observedAt while the guard\n  // \"validated\" a different date. Require Date.parse's interpretation to match\n  // the prefix's FULL (y, m, d) tuple. Offset-bearing inputs compare in the\n  // source's explicit offset frame (the prefix date is offset-local, so a UTC\n  // instant legitimately falls on an adjacent UTC/local day); offset-free\n  // inputs compare both the local and UTC frames (Date.parse uses UTC for ISO\n  // date-only strings and local for non-ISO — a single frame would wrongly\n  // reject legitimate month/day-boundary dates that shift across timezones).\n  const yearLedAgrees = yearLedAgreesWithDateParse(parsed, value, yearLedPrefix);\n  const validYearLed = yearLedPrefix !== null && yearLedAgrees;\n  // Reject bare-year / numeric-only strings that Date.parse accepts (e.g.\n  // \"123\") — isStrictIsoTimestamp already rejected them, and the round-trip\n  // below would otherwise resurrect them. Require at least one date/time\n  // separator so a plain number never round-trips into a fake epoch — UNLESS\n  // the value is itself a complete, calendar-valid year-led date that\n  // Date.parse agrees with (issue #1723: a date-only punctuated textual form\n  // like \"2026 May, 10\" has no -/:/T yet parses to the correct calendar day).\n  if (!/[-:T]/.test(value) && !validYearLed) {\n    return undefined;\n  }\n  // Reject year-led timestamps that are not a COMPLETE, calendar-valid date\n  // Date.parse agrees with (covers partial, overflow, AND the punctuation\n  // misinterpretation above).\n  if (/^\\d{4}\\D/.test(value) && !validYearLed) {\n    return undefined;\n  }\n  // Also validate M/D/Y or D/M/Y formats (provider/import common shapes:\n  // 02/30/2026, 30-02-2026, etc.). Date.parse silently shifts overflow in\n  // these too. Try both month-first and day-first interpretations; if\n  // neither is a valid calendar date, reject (chatgpt-codex-connector thread\n  // dH47 — non-YMD overflow timestamps).\n  const mdy = /^(\\d{1,2})\\D(\\d{1,2})\\D(\\d{4})/.exec(value);\n  if (mdy) {\n    const a = Number(mdy[1]), b = Number(mdy[2]), yr = Number(mdy[3]);\n    if (!isValidCalendarDate(yr, a, b) && !isValidCalendarDate(yr, b, a)) {\n      return undefined;\n    }\n  }\n  const iso = new Date(parsed).toISOString();\n  return isStrictIsoTimestamp(iso) ? iso : undefined;\n}\n\n/**\n * Validate numeric calendar components without Date overflow (review thread\n * dANc). Date.UTC silently normalizes Feb 30 -> Mar 2; a component round-trip\n * catches what Date.parse accepts. Mirrors the same technique isStrictIsoTimestamp\n * uses for full ISO strings, applied here to the non-ISO normalization path.\n */\nfunction isValidCalendarDate(y: number, mo: number, da: number): boolean {\n  if (mo < 1 || mo > 12 || da < 1) return false;\n  const leap = (y % 4 === 0 && (y % 100 !== 0 || y % 400 === 0)) ? 29 : 28;\n  const daysInMonth = [31, leap, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n  return da <= daysInMonth[mo - 1]!;\n}\n\n/**\n * Recognized month-name → number map for year-led textual-month dates\n * (issue #1657). Both the 3-letter abbreviations and the full names that\n * Date.parse accepts for year-first shapes (e.g. \"2026-Jan-15\",\n * \"2026-January-15\", \"2026 February 2\").\n */\nconst MONTH_NAMES: Record<string, number> = {\n  jan: 1, january: 1,\n  feb: 2, february: 2,\n  mar: 3, march: 3,\n  apr: 4, april: 4,\n  may: 5,\n  jun: 6, june: 6,\n  jul: 7, july: 7,\n  aug: 8, august: 8,\n  sep: 9, september: 9,\n  sept: 9,\n  oct: 10, october: 10,\n  nov: 11, november: 11,\n  dec: 12, december: 12,\n};\n\n/**\n * Parse a complete, calendar-valid year-led date prefix from `s`\n * (issue #1657, relaxed in #1723): `YYYY <sep> (MM | MonthName) <sep> DD`\n * where each separator is a RUN of non-alphanumeric, non-colon chars (so a\n * complete date with any punctuation — \"2026 May, 10\", \"2026, May 10\",\n * \"2026 Jan. 15\" — is accepted; the run excludes letters so a textual month\n * is never consumed by the separator, and excludes the colon so the date/time\n * boundary stays clean) and the day is a true calendar day — not the hour\n * before a `:` time separator (the `(?![\\d:])` lookahead rejects\n * \"2026-05 10:00\" capturing \"10\" as the day). Returns the numeric components\n * for a complete, valid date; `null` for an incomplete (\"2026-05\",\n * \"2026-Jan\"), overflowed (\"2026-02-30\", \"2026-Feb-30\"), or non-year-led\n * prefix. Centralizes the fabricated-date rejection for the\n * toStrictIsoTimestamp normalization path across numeric and textual months\n * in one rule.\n */\nfunction parseYearLedDatePrefix(s: string): { y: number; mo: number; da: number } | null {\n  const m = /^(\\d{4})[^0-9A-Za-z]+(\\d{1,2}|[A-Za-z]{3,})[^0-9A-Za-z:]+(\\d{1,2})(?![\\d:])/.exec(s);\n  if (!m) return null;\n  const y = Number(m[1]);\n  const da = Number(m[3]);\n  const mo = /^\\d+$/.test(m[2]) ? Number(m[2]) : (MONTH_NAMES[m[2]!.toLowerCase()] ?? -1);\n  if (!isValidCalendarDate(y, mo, da)) return null;\n  return { y, mo, da };\n}\n\n/**\n * Extract an explicit timezone offset (ms east of UTC) from a non-strict-ISO\n * timestamp, or `null` if none is present (issue #1723 codex r4). Recognizes\n * the offset forms `Date.parse` accepts for non-ISO year-led dates: a trailing\n * `±HH:MM` / `±HHMM`, and a `GMT`/`UTC` token optionally followed by\n * `±HHMM` (bare `GMT`/`UTC` ⇒ offset 0). Strict ISO `Z` forms are handled\n * by `isStrictIsoTimestamp` before this point, so they never reach here.\n */\n/**\n * Named timezone abbreviations Node's `Date.parse` accepts for non-ISO dates\n * (issue #1723 codex r8). V8 recognizes a fixed set of US zones; each maps to a\n * fixed offset (the abbreviation itself encodes standard vs daylight, so PST is\n * always -8 and PDT always -7 regardless of the calendar date). Other named\n * zones (CET/CEST/JST/…) return NaN from `Date.parse` and never reach here.\n */\nconst NAMED_ZONE_OFFSETS_MS: Record<string, number> = {\n  PST: -8 * 60, PDT: -7 * 60,\n  MST: -7 * 60, MDT: -6 * 60,\n  CST: -6 * 60, CDT: -5 * 60,\n  EST: -5 * 60, EDT: -4 * 60,\n};\n\nfunction explicitOffsetMs(value: string): number | null {\n  // Recognize the offset forms Date.parse accepts for non-ISO year-led dates,\n  // returning ms east of UTC or null. Tries each shape in order; a stray run\n  // of date digits can never pose as an offset because (a) trailing numeric\n  // offsets must be preceded by whitespace or glued to a \":SS\" seconds field\n  // (lookbehind), and (b) every candidate is range-validated (|hh| ≤ 14,\n  // mm < 59).\n  // Named US zone abbreviation (PST/EST/EDT/…), trailing token (codex r8).\n  const nz = /\\b([A-Z]{3,4})\\s*$/.exec(value);\n  if (nz && NAMED_ZONE_OFFSETS_MS[nz[1]] !== undefined) {\n    return NAMED_ZONE_OFFSETS_MS[nz[1]] * 60_000;\n  }\n  const tryOff = (sign: string | undefined, hh: number, mm: number): number | null => {\n    if (hh > 14 || mm > 59) return null;\n    return (sign === \"-\" ? -1 : 1) * (hh * 60 + mm) * 60_000;\n  };\n  let m: RegExpExecArray | null;\n  // GMT/UTC token: colon form, then ±HHMM (4-digit, before bare hour so\n  // \"GMT+0530\" is not read as \"+05\"), then bare hour, then the bare token\n  // itself (offset 0).\n  if (\n    (m = /\\b(?:GMT|UTC)\\b\\s*([+-])?(\\d{1,2}):(\\d{2})/i.exec(value)) ||\n    (m = /\\b(?:GMT|UTC)\\b\\s*([+-])?(\\d{2})(\\d{2})/i.exec(value))\n  ) {\n    const r = tryOff(m[1], Number(m[2]), Number(m[3]));\n    if (r !== null) return r;\n  }\n  if ((m = /\\b(?:GMT|UTC)\\b\\s*([+-])?(\\d{1,2})\\b/i.exec(value))) {\n    const r = tryOff(m[1], Number(m[2]), 0);\n    if (r !== null) return r;\n  }\n  if (/\\b(?:GMT|UTC)\\b/i.test(value)) return 0;\n  // Trailing numeric offset: whitespace-delimited OR glued to a \":SS\"\n  // seconds field (lookbehind), so date digits (\"-0510\" in \"2026-0510\") are\n  // never misread as an offset. Colon form, then ±HHMM, then bare hour — each\n  // for BOTH the whitespace and glued contexts.\n  if (\n    (m = /(?:\\s|(?<=:\\d{2}))([+-])(\\d{1,2}):(\\d{2})\\s*$/.exec(value)) ||\n    (m = /(?:\\s|(?<=:\\d{2}))([+-])(\\d{2})(\\d{2})\\s*$/.exec(value)) ||\n    (m = /(?:\\s|(?<=:\\d{2}))([+-])(\\d{1,2})\\s*$/.exec(value))\n  ) {\n    const r = tryOff(m[1], Number(m[2]), m[3] ? Number(m[3]) : 0);\n    if (r !== null) return r;\n  }\n  return null;\n}\n\n/**\n * Verify `Date.parse`'s interpretation of `value` agrees with the year-led\n * `prefix` components `(y, m, d)` (issue #1723 codex r2/r3/r4). Returns\n * `false` when `prefix` is `null` (no complete year-led date). Otherwise\n * compares the FULL tuple so punctuation that shifts the month OR the day is\n * caught. Offset-bearing inputs are compared in the source's explicit offset\n * frame (the prefix date is offset-local, so the same instant legitimately\n * lands on an adjacent UTC/local day); offset-free inputs accept either the\n * local or UTC frame, because `Date.parse` uses UTC for ISO date-only strings\n * and local for non-ISO forms.\n */\nfunction yearLedAgreesWithDateParse(\n  parsed: number,\n  value: string,\n  prefix: { y: number; mo: number; da: number } | null,\n): boolean {\n  if (prefix === null) return false;\n  const off = explicitOffsetMs(value);\n  if (off !== null) {\n    const shifted = new Date(parsed + off);\n    return (\n      shifted.getUTCFullYear() === prefix.y &&\n      shifted.getUTCMonth() + 1 === prefix.mo &&\n      shifted.getUTCDate() === prefix.da\n    );\n  }\n  const pd = new Date(parsed);\n  const localMatch =\n    pd.getFullYear() === prefix.y &&\n    pd.getMonth() + 1 === prefix.mo &&\n    pd.getDate() === prefix.da;\n  const utcMatch =\n    pd.getUTCFullYear() === prefix.y &&\n    pd.getUTCMonth() + 1 === prefix.mo &&\n    pd.getUTCDate() === prefix.da;\n  return localMatch || utcMatch;\n}\n\n/**\n * Zod schema for a single `ProvenanceSource` entry (issue #1575).  Parsed\n * JSON from frontmatter is external data, so each entry is validated here\n * rather than trusted via a cast (rule: no inline-cast-access on parsed\n * blobs).  `safeParse` lets us drop corrupt entries individually instead of\n * failing the whole field.\n */\nconst ProvenanceSourceSchema = z\n  .object({\n    sessionKey: z.string().min(1),\n    observedAt: z\n      .string()\n      .min(1)\n      .refine(isStrictIsoTimestamp, \"must be a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SS[Z|±HH:MM], no calendar overflow)\"),\n    quote: z.string().min(1),\n    turnId: z.string().min(1).optional(),\n    charStart: z.number().finite().nonnegative().int().optional(),\n    charEnd: z.number().finite().nonnegative().int().optional(),\n  })\n  .refine(\n    (src) => src.charStart === undefined || src.charEnd === undefined || src.charEnd >= src.charStart,\n    { message: \"charEnd must be >= charStart (half-open interval, rule 35)\" },\n  );\n\n/**\n * Parse the `sources` array (issue #1575) from its single-line JSON form.\n * Mirrors `parseStructuredAttributes` (JSON.parse) but validates each entry\n * against `ProvenanceSourceSchema` and DROPS corrupt ones rather than\n * poisoning downstream readers — the same \"drop corrupt rather than poison\"\n * contract as `parseMemoryWorthCounterField`.  If no entry survives, the\n * whole field is `undefined` (legacy-equivalent).\n */\nexport function parseProvenanceSources(raw: string | undefined): ProvenanceSource[] | undefined {\n  if (raw === undefined) return undefined;\n  const trimmed = raw.trim();\n  if (trimmed.length === 0) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return undefined;\n  }\n  if (!Array.isArray(parsed)) return undefined;\n  const sources: ProvenanceSource[] = [];\n  for (const entry of parsed) {\n    const result = ProvenanceSourceSchema.safeParse(entry);\n    if (result.success) sources.push(result.data);\n  }\n  return sources.length > 0 ? sources : undefined;\n}\n\n/**\n * Parse the `provenance` config block (issue #1575 PR 1).  Validates the\n * shape before applying defaults — a shorthand like `provenance: false` must\n * reject loudly rather than normalize to `{}` and silently enable the feature\n * (rule 51).  Booleans coerce via `coerceBool` (rule 36); numeric cap clamps\n * at 1 (rule 28).  `REMNIC_PROVENANCE_ENABLED` / `ENGRAM_PROVENANCE_ENABLED`\n * are honored only when the `enabled` key is omitted (explicit config wins).\n *\n * Schema-default note (review rounds 1–3, settled): `provenance.enabled` has\n * NO `\"default\"` in any plugin.json schema. OpenClaw's loader runs\n * `applyDefaults: true` before exposing `api.pluginConfig` (src/index.ts:1345,\n * PR #1593 round 8), so a schema default would be materialized into the\n * merged config and mask the `REMNIC_`/`ENGRAM_` env override. The code-level\n * default-on here (`return true` when `enabled` is omitted) supplies the\n * default-on behavior without that materialization. This matches the\n * emitLegacyTools/namespaceCatalogEnabled precedent, which omits the env\n * override only after a raw-vs-effective split — overkill for a single\n * boolean, so this field uses the simpler omit-the-default approach.\n */\nexport function parseProvenanceConfig(raw: unknown): ProvenanceConfig {\n  if (\n    raw !== undefined &&\n    (raw === null || typeof raw !== \"object\" || Array.isArray(raw))\n  ) {\n    throw new Error(\n      `provenance must be an object (got ${JSON.stringify(raw)}). Use provenance: { enabled: false } to opt out; omit the key to use the default-on behavior (issue #1575).`,\n    );\n  }\n  const rawProvenance =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  return {\n    enabled: (() => {\n      if (rawProvenance.enabled === undefined) {\n        const envEnabled =\n          readEnvVar(\"REMNIC_PROVENANCE_ENABLED\") ?? readEnvVar(\"ENGRAM_PROVENANCE_ENABLED\");\n        if (envEnabled !== undefined) {\n          const coerced = coerceBool(envEnabled);\n          if (coerced === undefined) {\n            throw new Error(\n              `REMNIC_PROVENANCE_ENABLED must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(envEnabled)}`,\n            );\n          }\n          return coerced;\n        }\n        return true;\n      }\n      const coerced = coerceBool(rawProvenance.enabled);\n      if (coerced === undefined) {\n        throw new Error(\n          `provenance.enabled must be a boolean or one of \"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\"on\"/\"off\" (got ${JSON.stringify(rawProvenance.enabled)}). Omit the key to use the default-on behavior (issue #1575).`,\n        );\n      }\n      return coerced;\n    })(),\n    maxQuoteChars: (() => {\n      if (rawProvenance.maxQuoteChars === undefined) return 300;\n      const rawCap = coerceNumber(rawProvenance.maxQuoteChars);\n      // Reject present-but-invalid rather than silently widening the cap\n      // (AGENTS.md input-validation rule — a typo should not persist more\n      // text than the operator configured).\n      if (rawCap === undefined || !Number.isFinite(rawCap) || rawCap < 1 || !Number.isInteger(rawCap)) {\n        throw new Error(\n          `provenance.maxQuoteChars must be a positive integer >= 1 (got ${JSON.stringify(rawProvenance.maxQuoteChars)}).`,\n        );\n      }\n      return rawCap;\n    })(),\n    requireSpans: (() => {\n      if (rawProvenance.requireSpans === undefined) return false;\n      const coerced = coerceBool(rawProvenance.requireSpans);\n      if (coerced === undefined) {\n        throw new Error(\n          `provenance.requireSpans must be a boolean or one of \"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\"on\"/\"off\" (got ${JSON.stringify(rawProvenance.requireSpans)}).`,\n        );\n      }\n      return coerced;\n    })(),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Issue #1575 PR 2 — extraction-side post-parse validator.\n// ---------------------------------------------------------------------------\n//\n// This runs once at write time (inside `ExtractionEngine.extract`, after the\n// LLM output is parsed and sanitized, before the result is returned for\n// persistence). Its job: locate each fact's LLM-provided `quote` in the\n// buffered turn texts and build a `ProvenanceSource[]` with verified\n// offsets. Never throws, never drops a fact (rule 34 spirit — an\n// unverifiable span is a tagged state, not a silent failure).\n//\n// Reuses `collapseWhitespace` from `whitespace.ts` for normalization so there\n// is exactly one normalizer in the codebase (issue #1575 pitfall: \"do not\n// write a second normalizer\").\n// ---------------------------------------------------------------------------\n\n/**\n * A turn in the buffered conversation, reduced to the fields the provenance\n * validator needs. `ExtractionEngine.extract` maps its `BufferTurn[]` to this\n * shape so the validator is pure and testable without the full BufferTurn type.\n */\nexport interface ProvenanceTurnInput {\n  content: string;\n  sessionKey?: string;\n  logicalSessionKey?: string;\n  timestamp: string;\n  turnId?: string;\n}\n\n/**\n * Result of building provenance for a single extracted fact.\n */\nexport interface ProvenanceBuildResult {\n  /** Verified sources (one per matching turn). Absent when no quote survives. */\n  sources?: ProvenanceSource[];\n  /** Coarse strength tag persisted to frontmatter. */\n  provenance: \"verified\" | \"unverified\" | \"none\";\n  /**\n   * Transient signal (never persisted): `true` when `config.requireSpans`\n   * is enabled and the LLM-provided quote could not be located in ANY source\n   * turn (the strict case `ProvenanceConfig.requireSpans` documents: \"facts\n   * whose quote cannot be located are routed to `pending_review`\"). The\n   * extraction consumer carries this onto the in-memory `ExtractedFact` so\n   * the persist path can route the fact to the review queue. A quote that\n   * WAS located but whose source was dropped (e.g. un-coercible timestamp)\n   * does NOT set this flag — the span was found, so requireSpans is\n   * satisfied (chatgpt-codex-connector thread 4xB).\n   */\n  requireSpansPending?: boolean;\n}\n\n/**\n * Cap a quote string at `maxChars`, truncating at the last word boundary that\n * fits and appending an ellipsis marker. Quotes at or under the cap pass\n * through unchanged. Operates on Unicode code points (not UTF-16 units) so\n * emoji and astral-plane characters are not split mid-glyph.\n */\nfunction capQuote(quote: string, maxChars: number): string {\n  const glyphs = Array.from(quote);\n  if (glyphs.length <= maxChars) return quote;\n  // Walk backward from the cap to find a word boundary (space). If the entire\n  // span is one long token (no spaces), cut at the cap — a hard cut is better\n  // than no quote at all.\n  let cut = maxChars;\n  while (cut > 0 && !/\\s/.test(glyphs[cut - 1]!)) cut--;\n  if (cut === 0) cut = maxChars; // no word boundary found\n  return glyphs.slice(0, cut).join(\"\").trimEnd() + \"\\u2026\";\n}\n\n/**\n * Casefold a string for normalized matching. Uses `toLowerCase` (not\n * `toLocaleLowerCase`) for determinism across runtime locales — the existing\n * `normalizeFactKey` helper in extraction.ts follows the same convention.\n */\nfunction casefold(s: string): string {\n  return s.toLowerCase();\n}\n\n/**\n * Locate `quote` within `text`, returning whether a match was found and, when\n * recoverable, the half-open `[start, end)` offsets. Tries exact substring\n * first, then whitespace/case-normalized match.\n *\n * For the normalized path, the mapping from the normalized string back to\n * original offsets is recovered by walking both strings in lockstep: we know\n * `collapseWhitespace(text)` is a subsequence of `text` with whitespace runs\n * collapsed, so we can track the original offset as we scan.\n *\n * Returns `{ matched: false }` when neither match succeeds. Returns\n * `{ matched: true, offsets }` when offsets are recoverable. Returns\n * `{ matched: true }` (offsets omitted) when the normalized substring was\n * found but original offsets could not be recovered — callers still treat\n * this as a verified match and record a source without offsets (cursor\n * thread Ocver — \"Normalized match drops verified provenance\").\n */\nexport type LocateQuoteResult =\n  | { matched: false }\n  | { matched: true; offsets?: { charStart: number; charEnd: number } };\n\nexport function locateQuoteOffsets(quote: string, text: string): LocateQuoteResult {\n  // 1. Exact substring match (handles unicode, curly quotes, emoji verbatim).\n  const exactIdx = text.indexOf(quote);\n  if (exactIdx >= 0) {\n    return { matched: true, offsets: { charStart: exactIdx, charEnd: exactIdx + quote.length } };\n  }\n\n  // 2. Whitespace/case-normalized match. Collapse runs of whitespace and\n  //    casefold both sides, then find the normalized quote in the normalized\n  //    text. Recover original offsets by scanning forward from the normalized\n  //    match start through the original text, accumulating non-whitespace\n  //    glyphs until we've consumed the normalized quote length.\n  const normQuote = collapseWhitespace(casefold(quote));\n  if (normQuote.length === 0) return { matched: false };\n  const normText = collapseWhitespace(casefold(text));\n  const normIdx = normText.indexOf(normQuote);\n  if (normIdx < 0) return { matched: false };\n\n  // Recover original offsets: walk the original text, skipping leading\n  // whitespace to align with the collapsed form, then track how many\n  // normalized chars we've consumed.\n  const normQuoteLen = normQuote.length;\n  let origIdx = 0;\n  // Skip leading whitespace in original text (collapseWhitespace trims both ends).\n  while (origIdx < text.length && /\\s/.test(text[origIdx]!)) origIdx++;\n  // Walk through original text, counting normalized chars consumed.\n  // Each non-whitespace char in original = 1 normalized char.\n  // Whitespace runs in original = 1 space in normalized (but only between non-ws).\n  let normPos = 0;\n  let origStart = -1;\n  let origEnd = -1;\n  let prevWasWs = true; // suppress the leading space in collapsed form\n  while (origIdx < text.length && origEnd < 0) {\n    const ch = text[origIdx]!;\n    if (/\\s/.test(ch)) {\n      if (!prevWasWs) {\n        // This whitespace run collapses to a single space in normalized text.\n        if (normPos === normIdx) origStart = origIdx; // normalized space aligns\n        normPos++;\n        prevWasWs = true;\n      }\n      origIdx++;\n      continue;\n    }\n    // Non-whitespace char.\n    if (normPos === normIdx && origStart < 0) {\n      origStart = origIdx;\n    }\n    normPos++;\n    prevWasWs = false;\n    origIdx++;\n    if (normPos >= normIdx + normQuoteLen) {\n      origEnd = origIdx;\n    }\n  }\n  if (origStart >= 0 && origEnd >= 0) {\n    return { matched: true, offsets: { charStart: origStart, charEnd: origEnd } };\n  }\n  // Normalized substring was found, but original offsets are not recoverable\n  // (edge case in the normalized mapping). The match still counts as verified\n  // — record a source without offsets rather than dropping the turn entirely\n  // (cursor thread Ocver). charStart/charEnd are best-effort debugging aids,\n  // not a precondition for a verified source.\n  return { matched: true };\n}\n\n/**\n * Build provenance sources for a single extracted fact by locating its\n * LLM-provided `quote` in the buffered turns (issue #1575 PR 2).\n *\n * Matching strategy (per issue design):\n *   1. Exact substring match in a turn → `provenance: \"verified\"` with\n *      `charStart`/`charEnd` offsets.\n *   2. Whitespace/case-normalized match → `\"verified\"`, offsets recovered\n *      when possible, else omitted.\n *   3. No match in any turn → `\"unverified\"` — the quote survives as a\n *      source (the LLM vouched for it) but without located offsets.\n *   4. No quote provided by the LLM → `\"none\"` — no evidence to record.\n *\n * A quote appearing in multiple turns produces multiple sources (one per\n * matching turn) so a repeated utterance backs the fact from each occurrence.\n *\n * The quote is capped at `config.maxQuoteChars` (truncated at a word boundary\n * with an ellipsis marker) BEFORE storage. Locating uses the original\n * (untruncated) quote for maximum match fidelity; the capped excerpt is what\n * gets persisted.\n *\n * When `config.enabled === false`, returns `{ provenance: \"none\" }`\n * immediately — byte-identical to pre-feature extraction (rule 39).\n *\n * Never throws. An unexpected error degrades to `{ provenance: \"none\" }` so\n * extraction never crashes on a provenance hiccup (rule 13/18).\n */\n/**\n * Strip a leading extraction-prompt role label from a quote (cursor thread Oc3Z2\n * — \"Quote prompt mismatches validator\"). The extraction prompt renders each\n * buffered turn as `[role] content` (or `[context role] content`), so a\n * faithful LLM may include that prefix in its verbatim quote. buildFactProvenance\n * searches the raw `turn.content` (no prefix), so a quote carrying the label\n * would never match. Stripping the leading label lets the actual utterance\n * verify against the turn text. Only a SINGLE leading label is stripped — a\n * multi-turn quote (with embedded labels) is left untouched and will simply\n * fail to match a single turn, as before.\n *\n * The regex is constrained to the labels the prompt actually emits — `user`,\n * `assistant`, optionally prefixed with `context ` (extraction.ts renders\n * `[user]`, `[assistant]`, `[context user]`, `[context assistant]`). A\n * real utterance that happens to start with other bracketed text (e.g.\n * `[do not] deploy before approval`, `[P1] fix the cache`) is preserved\n * verbatim so the quote can match the turn and the persisted span retains its\n * original meaning (chatgpt-codex-connector thread 4xA — limiting role-prefix\n * stripping to actual prompt labels).\n */\nexport function stripLeadingRolePrefix(quote: string): string {\n  return quote.replace(/^\\s*\\[(?:context\\s+)?(?:user|assistant)\\]\\s+/i, \"\");\n}\n\nexport function buildFactProvenance(\n  factQuote: string | null | undefined,\n  turns: ReadonlyArray<ProvenanceTurnInput>,\n  config: ProvenanceConfig,\n): ProvenanceBuildResult {\n  if (!config.enabled) return { provenance: \"none\" };\n  const rawQuote = typeof factQuote === \"string\" ? factQuote.trim() : \"\";\n  // requireSpans (chatgpt-codex-connector thread dEsu + cursor thread dGKJ):\n  // every early exit that drops a fact's span (no quote, empty after label\n  // strip, or unsafe quote) must flag requireSpansPending when the operator\n  // opted into requireSpans, so the persist path routes the fact to\n  // pending_review instead of active. Only the disabled-feature exit (above)\n  // and the unexpected-error catch (below) omit the flag — those are\n  // policy-neutral degradations, not a missing-span decision.\n  const noneResult = (): ProvenanceBuildResult =>\n    config.requireSpans === true\n      ? { provenance: \"none\", requireSpansPending: true }\n      : { provenance: \"none\" };\n  if (rawQuote.length === 0) return noneResult();\n  // Strip a leading prompt role label so a faithful quote verifies against\n  // the raw turn content (cursor thread Oc3Z2). Prefer the RAW quote when it\n  // matches at least one turn — an utterance that literally begins with\n  // [user]/[assistant] must verify as-is, not be truncated to the post-label\n  // text (cursor/codex thread dEsw). The strip handles the common case where\n  // the LLM includes the prompt label; this preserves the rare case where the\n  // utterance itself starts with that text.\n  const strippedQuote = stripLeadingRolePrefix(rawQuote);\n  const useRawQuote =\n    rawQuote === strippedQuote ||\n    turns.some(\n      (t) =>\n        typeof t?.content === \"string\" &&\n        t.content.length > 0 &&\n        locateQuoteOffsets(rawQuote, t.content).matched,\n    );\n  const quote = useRawQuote ? rawQuote : strippedQuote;\n  if (quote.length === 0) return noneResult();\n  // Sanitize the quote before persisting it as a provenance span\n  // (chatgpt-codex-connector thread dANZ): the fact body is sanitized via\n  // sanitizeMemoryContent, but sources[].quote was persisted verbatim,\n  // reintroducing unsafe memory text (e.g. \"ignore previous instructions\")\n  // through the provenance field exposed to memory_get/x-ray/faithfulness.\n  // An unsafe quote cannot serve as evidence — drop the source entirely\n  // (consistent with how the body is sanitized: unsafe text is redacted,\n  // and a redacted quote is useless as a verbatim span).\n  if (!isSafeMemoryContent(quote)) return noneResult();\n\n  try {\n    // Search every turn for the quote. Collect verified sources.\n    const sources: ProvenanceSource[] = [];\n    // Track the first turn where the quote was located even when its\n    // timestamp can't be coerced (cursor thread 4Pj — \"Bad timestamp drops\n    // matched source\"). Without this, a located-but-unverifiable quote falls\n    // through to the unverified branch and is attributed to the *last* turn's\n    // session, mislabeling the source's origin session. Also drives the\n    // requireSpans signal: only a quote that was NOT located in any turn\n    // qualifies for pending_review routing under requireSpans (thread 4xB).\n    let locatedTurn: ProvenanceTurnInput | undefined;\n    for (const turn of turns) {\n      if (!turn || typeof turn.content !== \"string\" || turn.content.length === 0) continue;\n      const located = locateQuoteOffsets(quote, turn.content);\n      // cursor thread Ocver: a normalized match counts as verified even when\n      // original offsets are unrecoverable — record the source without\n      // charStart/charEnd instead of skipping the turn.\n      if (!located.matched) continue;\n      if (!locatedTurn) locatedTurn = turn;\n      // cursor thread Ocveu: normalize the turn timestamp to strict ISO so\n      // the write-path ProvenanceSourceSchema keeps the source. Skip the turn\n      // when the timestamp can't be coerced — pushing it would guarantee a\n      // serialization drop (and the tag downgrade) for this source.\n      const observedAt = toStrictIsoTimestamp(turn.timestamp);\n      if (!observedAt) continue;\n      sources.push({\n        sessionKey: turn.sessionKey ?? turn.logicalSessionKey ?? \"unknown\",\n        ...(turn.turnId ? { turnId: turn.turnId } : {}),\n        observedAt,\n        quote: capQuote(quote, config.maxQuoteChars),\n        ...(located.offsets\n          ? { charStart: located.offsets.charStart, charEnd: located.offsets.charEnd }\n          : {}),\n      });\n    }\n\n    if (sources.length > 0) {\n      return { sources, provenance: \"verified\" };\n    }\n\n    // Quote provided but could not be turned into a verified source.\n    // Determine the session to attribute: prefer the turn where the quote was\n    // LOCATED even if its timestamp couldn't be coerced (cursor thread 4Pj — a\n    // located quote must not be tied to the *last* turn's session). If the\n    // quote was not located in any turn at all, fall back to the last turn's\n    // session (the documented unverified behavior: the LLM vouched for the\n    // excerpt but we couldn't pin it to a character offset). Normalize the\n    // timestamp (thread Ocveu); fall back to epoch when no turn supplies a\n    // coercible timestamp so the unverified source still survives the\n    // write-path schema.\n    const fallbackTurn = locatedTurn ?? turns[turns.length - 1];\n    const fallbackSessionKey = fallbackTurn\n      ? (fallbackTurn.sessionKey ?? fallbackTurn.logicalSessionKey ?? \"unknown\")\n      : \"unknown\";\n    const fallbackObservedAt = fallbackTurn\n      ? (toStrictIsoTimestamp(fallbackTurn.timestamp) ?? new Date(0).toISOString())\n      : new Date(0).toISOString();\n    // requireSpans signal (chatgpt-codex-connector thread 4xB): when an\n    // operator opts into provenance.requireSpans, a fact whose quote could\n    // not be located in ANY turn (locatedTurn undefined) is flagged so the\n    // persist path routes it to pending_review instead of active. A quote\n    // that WAS located (locatedTurn set) satisfies requireSpans even when\n    // its source was dropped for an un-coercible timestamp — the span was\n    // found, so the fact has the grounding requireSpans demands.\n    const requireSpansPending =\n      config.requireSpans === true && locatedTurn === undefined;\n    return {\n      sources: [\n        {\n          sessionKey: fallbackSessionKey,\n          observedAt: fallbackObservedAt,\n          quote: capQuote(quote, config.maxQuoteChars),\n        },\n      ],\n      provenance: \"unverified\",\n      ...(requireSpansPending ? { requireSpansPending: true } : {}),\n    };\n  } catch {\n    // Never crash extraction on a provenance error (rule 13/18).\n    return { provenance: \"none\" };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,SAAS,SAAS;AAalB,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,SAAS,0BAA0B,KAAgD;AACjF,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,6BAA6B;AAC7C,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,UAAU,OAAW,KAAI,GAAG,IAAI;AAAA,EACtC;AACA,SAAO;AACT;AAgBO,SAAS,0BAA0B,IAAuB,OAAuB;AACtF,MAAI,kBAAkB;AACtB,MAAI,GAAG,WAAW,GAAG,QAAQ,SAAS,GAAG;AAIvC,UAAM,YAAuC,CAAC;AAC9C,eAAW,OAAO,GAAG,SAAS;AAC5B,YAAM,SAAS,uBAAuB,UAAU,GAAG;AACnD,UAAI,OAAO,QAAS,WAAU,KAAK,0BAA0B,OAAO,IAAI,CAAC;AAAA,IAC3E;AACA,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,KAAK,YAAY,KAAK,UAAU,SAAS,CAAC,EAAE;AAClD,wBAAkB;AAAA,IACpB;AAAA,EACF;AAKA,QAAM,OACH,GAAG,eAAe,cAAc,GAAG,eAAe,iBAAiB,CAAC,kBACjE,SACA,GAAG;AACT,MAAI,KAAK;AACP,UAAM,KAAK,eAAe,GAAG,EAAE;AAAA,EACjC;AACF;AAQO,SAAS,mBACd,KACgD;AAChD,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI,YAAY,cAAc,YAAY,gBAAgB,YAAY,QAAQ;AAC5E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAaO,SAAS,wBACd,KACA,SACgD;AAChD,OAAK,QAAQ,cAAc,QAAQ,kBAAkB,CAAC,WAAW,QAAQ,WAAW,IAAI;AACtF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,qBAAqB,GAAoB;AAChD,QAAM,IAAI,mFAAmF,KAAK,CAAC;AACnG,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;AAC3D,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;AAG3D,QAAM,IAAI,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAKrD,SACE,CAAC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,KAC3B,EAAE,eAAe,MAAM,KACvB,EAAE,YAAY,MAAM,KAAK,KACzB,EAAE,WAAW,MAAM,MACnB,EAAE,YAAY,MAAM,KACpB,EAAE,cAAc,MAAM,MACtB,EAAE,cAAc,MAAM;AAE1B;AAeA,SAAS,qBAAqB,IAAmD;AAC/E,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,EAAG,QAAO;AAKtD,QAAM,QAAQ,GAAG,KAAK;AACtB,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AAajC,QAAM,gBAAgB,uBAAuB,KAAK;AAalD,QAAM,gBAAgB,2BAA2B,QAAQ,OAAO,aAAa;AAC7E,QAAM,eAAe,kBAAkB,QAAQ;AAQ/C,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,CAAC,cAAc;AACzC,WAAO;AAAA,EACT;AAIA,MAAI,WAAW,KAAK,KAAK,KAAK,CAAC,cAAc;AAC3C,WAAO;AAAA,EACT;AAMA,QAAM,MAAM,iCAAiC,KAAK,KAAK;AACvD,MAAI,KAAK;AACP,UAAM,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;AAChE,QAAI,CAAC,oBAAoB,IAAI,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,GAAG;AACpE,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,KAAK,MAAM,EAAE,YAAY;AACzC,SAAO,qBAAqB,GAAG,IAAI,MAAM;AAC3C;AAQA,SAAS,oBAAoB,GAAW,IAAY,IAAqB;AACvE,MAAI,KAAK,KAAK,KAAK,MAAM,KAAK,EAAG,QAAO;AACxC,QAAM,OAAQ,IAAI,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,QAAQ,KAAM,KAAK;AACtE,QAAM,cAAc,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACrE,SAAO,MAAM,YAAY,KAAK,CAAC;AACjC;AAQA,IAAM,cAAsC;AAAA,EAC1C,KAAK;AAAA,EAAG,SAAS;AAAA,EACjB,KAAK;AAAA,EAAG,UAAU;AAAA,EAClB,KAAK;AAAA,EAAG,OAAO;AAAA,EACf,KAAK;AAAA,EAAG,OAAO;AAAA,EACf,KAAK;AAAA,EACL,KAAK;AAAA,EAAG,MAAM;AAAA,EACd,KAAK;AAAA,EAAG,MAAM;AAAA,EACd,KAAK;AAAA,EAAG,QAAQ;AAAA,EAChB,KAAK;AAAA,EAAG,WAAW;AAAA,EACnB,MAAM;AAAA,EACN,KAAK;AAAA,EAAI,SAAS;AAAA,EAClB,KAAK;AAAA,EAAI,UAAU;AAAA,EACnB,KAAK;AAAA,EAAI,UAAU;AACrB;AAkBA,SAAS,uBAAuB,GAAyD;AACvF,QAAM,IAAI,8EAA8E,KAAK,CAAC;AAC9F,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AACrB,QAAM,KAAK,OAAO,EAAE,CAAC,CAAC;AACtB,QAAM,KAAK,QAAQ,KAAK,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,IAAK,YAAY,EAAE,CAAC,EAAG,YAAY,CAAC,KAAK;AACpF,MAAI,CAAC,oBAAoB,GAAG,IAAI,EAAE,EAAG,QAAO;AAC5C,SAAO,EAAE,GAAG,IAAI,GAAG;AACrB;AAiBA,IAAM,wBAAgD;AAAA,EACpD,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAAA,EACxB,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAAA,EACxB,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAAA,EACxB,KAAK,KAAK;AAAA,EAAI,KAAK,KAAK;AAC1B;AAEA,SAAS,iBAAiB,OAA8B;AAQtD,QAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,MAAI,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,QAAW;AACpD,WAAO,sBAAsB,GAAG,CAAC,CAAC,IAAI;AAAA,EACxC;AACA,QAAM,SAAS,CAAC,MAA0B,IAAY,OAA8B;AAClF,QAAI,KAAK,MAAM,KAAK,GAAI,QAAO;AAC/B,YAAQ,SAAS,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM;AAAA,EACpD;AACA,MAAI;AAIJ,OACG,IAAI,8CAA8C,KAAK,KAAK,OAC5D,IAAI,2CAA2C,KAAK,KAAK,IAC1D;AACA,UAAM,IAAI,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;AACjD,QAAI,MAAM,KAAM,QAAO;AAAA,EACzB;AACA,MAAK,IAAI,wCAAwC,KAAK,KAAK,GAAI;AAC7D,UAAM,IAAI,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;AACtC,QAAI,MAAM,KAAM,QAAO;AAAA,EACzB;AACA,MAAI,mBAAmB,KAAK,KAAK,EAAG,QAAO;AAK3C,OACG,IAAI,gDAAgD,KAAK,KAAK,OAC9D,IAAI,6CAA6C,KAAK,KAAK,OAC3D,IAAI,wCAAwC,KAAK,KAAK,IACvD;AACA,UAAM,IAAI,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AAC5D,QAAI,MAAM,KAAM,QAAO;AAAA,EACzB;AACA,SAAO;AACT;AAaA,SAAS,2BACP,QACA,OACA,QACS;AACT,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,MAAM,iBAAiB,KAAK;AAClC,MAAI,QAAQ,MAAM;AAChB,UAAM,UAAU,IAAI,KAAK,SAAS,GAAG;AACrC,WACE,QAAQ,eAAe,MAAM,OAAO,KACpC,QAAQ,YAAY,IAAI,MAAM,OAAO,MACrC,QAAQ,WAAW,MAAM,OAAO;AAAA,EAEpC;AACA,QAAM,KAAK,IAAI,KAAK,MAAM;AAC1B,QAAM,aACJ,GAAG,YAAY,MAAM,OAAO,KAC5B,GAAG,SAAS,IAAI,MAAM,OAAO,MAC7B,GAAG,QAAQ,MAAM,OAAO;AAC1B,QAAM,WACJ,GAAG,eAAe,MAAM,OAAO,KAC/B,GAAG,YAAY,IAAI,MAAM,OAAO,MAChC,GAAG,WAAW,MAAM,OAAO;AAC7B,SAAO,cAAc;AACvB;AASA,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,YAAY,EACT,OAAO,EACP,IAAI,CAAC,EACL,OAAO,sBAAsB,6FAA0F;AAAA,EAC1H,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5D,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS;AAC5D,CAAC,EACA;AAAA,EACC,CAAC,QAAQ,IAAI,cAAc,UAAa,IAAI,YAAY,UAAa,IAAI,WAAW,IAAI;AAAA,EACxF,EAAE,SAAS,6DAA6D;AAC1E;AAUK,SAAS,uBAAuB,KAAyD;AAC9F,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,OAAO,QAAS,SAAQ,KAAK,OAAO,IAAI;AAAA,EAC9C;AACA,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAqBO,SAAS,sBAAsB,KAAgC;AACpE,MACE,QAAQ,WACP,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,IAC7D;AACA,UAAM,IAAI;AAAA,MACR,qCAAqC,KAAK,UAAU,GAAG,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,gBACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAC/C,MACD,CAAC;AACP,SAAO;AAAA,IACL,UAAU,MAAM;AACd,UAAI,cAAc,YAAY,QAAW;AACvC,cAAM,aACJ,WAAW,2BAA2B,KAAK,WAAW,2BAA2B;AACnF,YAAI,eAAe,QAAW;AAC5B,gBAAMA,WAAU,WAAW,UAAU;AACrC,cAAIA,aAAY,QAAW;AACzB,kBAAM,IAAI;AAAA,cACR,8FAA8F,KAAK,UAAU,UAAU,CAAC;AAAA,YAC1H;AAAA,UACF;AACA,iBAAOA;AAAA,QACT;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAU,WAAW,cAAc,OAAO;AAChD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR,oGAAoG,KAAK,UAAU,cAAc,OAAO,CAAC;AAAA,QAC3I;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,IACH,gBAAgB,MAAM;AACpB,UAAI,cAAc,kBAAkB,OAAW,QAAO;AACtD,YAAM,SAAS,aAAa,cAAc,aAAa;AAIvD,UAAI,WAAW,UAAa,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,MAAM,GAAG;AAC/F,cAAM,IAAI;AAAA,UACR,iEAAiE,KAAK,UAAU,cAAc,aAAa,CAAC;AAAA,QAC9G;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,IACH,eAAe,MAAM;AACnB,UAAI,cAAc,iBAAiB,OAAW,QAAO;AACrD,YAAM,UAAU,WAAW,cAAc,YAAY;AACrD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR,yGAAyG,KAAK,UAAU,cAAc,YAAY,CAAC;AAAA,QACrJ;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AAAA,EACL;AACF;AA2DA,SAAS,SAAS,OAAe,UAA0B;AACzD,QAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,MAAI,OAAO,UAAU,SAAU,QAAO;AAItC,MAAI,MAAM;AACV,SAAO,MAAM,KAAK,CAAC,KAAK,KAAK,OAAO,MAAM,CAAC,CAAE,EAAG;AAChD,MAAI,QAAQ,EAAG,OAAM;AACrB,SAAO,OAAO,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,IAAI;AACnD;AAOA,SAAS,SAAS,GAAmB;AACnC,SAAO,EAAE,YAAY;AACvB;AAuBO,SAAS,mBAAmB,OAAe,MAAiC;AAEjF,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,YAAY,GAAG;AACjB,WAAO,EAAE,SAAS,MAAM,SAAS,EAAE,WAAW,UAAU,SAAS,WAAW,MAAM,OAAO,EAAE;AAAA,EAC7F;AAOA,QAAM,YAAY,mBAAmB,SAAS,KAAK,CAAC;AACpD,MAAI,UAAU,WAAW,EAAG,QAAO,EAAE,SAAS,MAAM;AACpD,QAAM,WAAW,mBAAmB,SAAS,IAAI,CAAC;AAClD,QAAM,UAAU,SAAS,QAAQ,SAAS;AAC1C,MAAI,UAAU,EAAG,QAAO,EAAE,SAAS,MAAM;AAKzC,QAAM,eAAe,UAAU;AAC/B,MAAI,UAAU;AAEd,SAAO,UAAU,KAAK,UAAU,KAAK,KAAK,KAAK,OAAO,CAAE,EAAG;AAI3D,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,MAAI,UAAU;AACd,MAAI,YAAY;AAChB,SAAO,UAAU,KAAK,UAAU,UAAU,GAAG;AAC3C,UAAM,KAAK,KAAK,OAAO;AACvB,QAAI,KAAK,KAAK,EAAE,GAAG;AACjB,UAAI,CAAC,WAAW;AAEd,YAAI,YAAY,QAAS,aAAY;AACrC;AACA,oBAAY;AAAA,MACd;AACA;AACA;AAAA,IACF;AAEA,QAAI,YAAY,WAAW,YAAY,GAAG;AACxC,kBAAY;AAAA,IACd;AACA;AACA,gBAAY;AACZ;AACA,QAAI,WAAW,UAAU,cAAc;AACrC,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,aAAa,KAAK,WAAW,GAAG;AAClC,WAAO,EAAE,SAAS,MAAM,SAAS,EAAE,WAAW,WAAW,SAAS,QAAQ,EAAE;AAAA,EAC9E;AAMA,SAAO,EAAE,SAAS,KAAK;AACzB;AAiDO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,MAAM,QAAQ,iDAAiD,EAAE;AAC1E;AAEO,SAAS,oBACd,WACA,OACA,QACuB;AACvB,MAAI,CAAC,OAAO,QAAS,QAAO,EAAE,YAAY,OAAO;AACjD,QAAM,WAAW,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AAQpE,QAAM,aAAa,MACjB,OAAO,iBAAiB,OACpB,EAAE,YAAY,QAAQ,qBAAqB,KAAK,IAChD,EAAE,YAAY,OAAO;AAC3B,MAAI,SAAS,WAAW,EAAG,QAAO,WAAW;AAQ7C,QAAM,gBAAgB,uBAAuB,QAAQ;AACrD,QAAM,cACJ,aAAa,iBACb,MAAM;AAAA,IACJ,CAAC,MACC,OAAO,GAAG,YAAY,YACtB,EAAE,QAAQ,SAAS,KACnB,mBAAmB,UAAU,EAAE,OAAO,EAAE;AAAA,EAC5C;AACF,QAAM,QAAQ,cAAc,WAAW;AACvC,MAAI,MAAM,WAAW,EAAG,QAAO,WAAW;AAS1C,MAAI,CAAC,oBAAoB,KAAK,EAAG,QAAO,WAAW;AAEnD,MAAI;AAEF,UAAM,UAA8B,CAAC;AAQrC,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,WAAW,EAAG;AAC5E,YAAM,UAAU,mBAAmB,OAAO,KAAK,OAAO;AAItD,UAAI,CAAC,QAAQ,QAAS;AACtB,UAAI,CAAC,YAAa,eAAc;AAKhC,YAAM,aAAa,qBAAqB,KAAK,SAAS;AACtD,UAAI,CAAC,WAAY;AACjB,cAAQ,KAAK;AAAA,QACX,YAAY,KAAK,cAAc,KAAK,qBAAqB;AAAA,QACzD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7C;AAAA,QACA,OAAO,SAAS,OAAO,OAAO,aAAa;AAAA,QAC3C,GAAI,QAAQ,UACR,EAAE,WAAW,QAAQ,QAAQ,WAAW,SAAS,QAAQ,QAAQ,QAAQ,IACzE,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,EAAE,SAAS,YAAY,WAAW;AAAA,IAC3C;AAYA,UAAM,eAAe,eAAe,MAAM,MAAM,SAAS,CAAC;AAC1D,UAAM,qBAAqB,eACtB,aAAa,cAAc,aAAa,qBAAqB,YAC9D;AACJ,UAAM,qBAAqB,eACtB,qBAAqB,aAAa,SAAS,MAAK,oBAAI,KAAK,CAAC,GAAE,YAAY,KACzE,oBAAI,KAAK,CAAC,GAAE,YAAY;AAQ5B,UAAM,sBACJ,OAAO,iBAAiB,QAAQ,gBAAgB;AAClD,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,UACE,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,OAAO,SAAS,OAAO,OAAO,aAAa;AAAA,QAC7C;AAAA,MACF;AAAA,MACA,YAAY;AAAA,MACZ,GAAI,sBAAsB,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF,QAAQ;AAEN,WAAO,EAAE,YAAY,OAAO;AAAA,EAC9B;AACF;","names":["coerced"]}

package/dist/{chunk-FMEP2RB5.js → chunk-SJ7ZNUXB.js}

@@ -1,7 +1,7 @@
 import {
   SupportPassportCreateGrantRequestSchema,
   defineOperation
-} from "./chunk-HXDXR2FH.js";
+} from "./chunk-AS4YKT75.js";
 import {
   SupportPassportCardCategorySchema,
   SupportPassportMemoryIdSchema,
@@ -220,4 +220,4 @@ var supportPassportGrantAskOperation = defineOperation({
     result: await ctx.service.supportPassportAskGrant(grantId, secret, question, ctx.abortSignal)
   })
 });
-//# sourceMappingURL=chunk-FMEP2RB5.js.map
+//# sourceMappingURL=chunk-SJ7ZNUXB.js.map

package/dist/{chunk-EEHQY7ER.js → chunk-SK6HEQTW.js}

@@ -1,7 +1,7 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-J5OXWG66.js";
+} from "./chunk-XZUHXKM3.js";
 import {
   MutationSerializer,
   withHeldFileLock
@@ -1473,4 +1473,4 @@ export {
   isNamespaceKind,
   NamespaceCatalog
 };
-//# sourceMappingURL=chunk-EEHQY7ER.js.map
+//# sourceMappingURL=chunk-SK6HEQTW.js.map

package/dist/{chunk-PGAB2V53.js → chunk-SMBWBEE7.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VEWZZM3H.js";
 import {
   buildFactProvenance
-} from "./chunk-RW4QNB4J.js";
+} from "./chunk-S45INSV3.js";
 
 // src/extraction-source-grounding.ts
 function applyExtractionSourceGrounding2(result, sourceText, assertionSourceText = sourceText, roleAssertionSources, messageTimestamp, options) {
@@ -70,4 +70,4 @@ export {
   attachExtractionProvenance,
   filterExtractionResultBySource2 as filterExtractionResultBySource
 };
-//# sourceMappingURL=chunk-PGAB2V53.js.map
+//# sourceMappingURL=chunk-SMBWBEE7.js.map

package/dist/{chunk-62NYUFNH.js → chunk-SS33RR4F.js}

@@ -3,7 +3,7 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-WOBMSMUK.js";
+} from "./chunk-WYU66IVZ.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -14,7 +14,7 @@ import {
 } from "./chunk-CMTINOFS.js";
 import {
   summarizeCorpusAndReplica
-} from "./chunk-S3SND7SO.js";
+} from "./chunk-LIDJWAQV.js";
 import {
   readJudgeVerdictStats
 } from "./chunk-OZKOPQCM.js";
@@ -38,23 +38,23 @@ import {
 } from "./chunk-YBPYIAA5.js";
 import {
   parseConfig
-} from "./chunk-W6YDAIVB.js";
+} from "./chunk-OSTXIFZW.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-DDBLZJRV.js";
+} from "./chunk-QB4VXCFN.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-S7KDHFF2.js";
+} from "./chunk-YXWMZAAN.js";
 import {
   listNamespaces
-} from "./chunk-47C6DF43.js";
+} from "./chunk-OS4JVTHR.js";
 import {
   analyzeGraphHealth
 } from "./chunk-5FAGCOZD.js";
 import {
   StorageManager
-} from "./chunk-QUFJ3NJE.js";
+} from "./chunk-MNG536IS.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -1683,4 +1683,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-62NYUFNH.js.map
+//# sourceMappingURL=chunk-SS33RR4F.js.map

package/dist/{chunk-4ECS33D4.js → chunk-T3T5HTZZ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-QUFJ3NJE.js";
+} from "./chunk-MNG536IS.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-4ECS33D4.js.map
+//# sourceMappingURL=chunk-T3T5HTZZ.js.map

package/dist/{chunk-KG2OOAFF.js → chunk-TQSCR5DU.js}

@@ -1,6 +1,11 @@
 import {
   resolveEnsureCollectionArgs
 } from "./chunk-U2VDCFXW.js";
+import {
+  EMPTY_QMD_STATUS,
+  embedQmdFiles,
+  fetchQmdStatus
+} from "./chunk-IUM3VSHI.js";
 import {
   QMD_PROBE_RETRY_BACKOFF_MS,
   QMD_PROBE_TIMEOUT_MS,
@@ -13,11 +18,6 @@ import {
   qmdVersionToString,
   resolveQmdCapabilities
 } from "./chunk-ZLQ37WJX.js";
-import {
-  EMPTY_QMD_STATUS,
-  embedQmdFiles,
-  fetchQmdStatus
-} from "./chunk-IUM3VSHI.js";
 import {
   clearQmdResultCaches,
   getCachedQmdSearch,
@@ -2253,4 +2253,4 @@ export {
   sharedDaemonSessionCountForTest,
   QmdClient
 };
-//# sourceMappingURL=chunk-KG2OOAFF.js.map
+//# sourceMappingURL=chunk-TQSCR5DU.js.map

package/dist/{chunk-OV7GJ4KW.js → chunk-V2XNMIAM.js}

@@ -1,7 +1,7 @@
 import {
   SupportPassportError,
   getOperation
-} from "./chunk-HXDXR2FH.js";
+} from "./chunk-AS4YKT75.js";
 import {
   abortError,
   isAbortError
@@ -499,4 +499,4 @@ export {
   buildSupportPassportPublicRequestHandler,
   composeSupportPassportExternalRequestHandlers
 };
-//# sourceMappingURL=chunk-OV7GJ4KW.js.map
+//# sourceMappingURL=chunk-V2XNMIAM.js.map

package/dist/{chunk-AS2NOPDM.js → chunk-V7IONNTJ.js}

@@ -1,7 +1,7 @@
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-66YUOI53.js";
+} from "./chunk-WQW6KPVC.js";
 
 // src/recall-navigate-disclosure.ts
 function disclosureRank(level) {
@@ -27,4 +27,4 @@ export {
   disclosureRank,
   planDisclosureStep
 };
-//# sourceMappingURL=chunk-AS2NOPDM.js.map
+//# sourceMappingURL=chunk-V7IONNTJ.js.map

package/dist/{chunk-HYWPUYLO.js → chunk-VV5GCNKG.js}

@@ -2,7 +2,7 @@ import {
   WHO_KNOWS_DEFAULT_LIMIT,
   WHO_KNOWS_MAX_LIMIT,
   validateWhoKnowsInput
-} from "./chunk-FSH6KRKO.js";
+} from "./chunk-PPJLJD2D.js";
 
 // src/who-knows-cli.ts
 function extractWhoKnowsRawArgs(rest) {
@@ -74,4 +74,4 @@ export {
   renderWhoKnowsText,
   renderWhoKnows
 };
-//# sourceMappingURL=chunk-HYWPUYLO.js.map
+//# sourceMappingURL=chunk-VV5GCNKG.js.map

package/dist/{chunk-Y3XHIWVP.js → chunk-WL3PGPGU.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-PIWFNPQT.js";
 import {
   StorageManager
-} from "./chunk-QUFJ3NJE.js";
+} from "./chunk-MNG536IS.js";
 import {
   projectProceduresToSkills
 } from "./chunk-236PXYG7.js";
@@ -134,4 +134,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-Y3XHIWVP.js.map
+//# sourceMappingURL=chunk-WL3PGPGU.js.map

package/dist/{chunk-3UQIS2GC.js → chunk-WNMVUWI7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7RGX7BMF.js";
 import {
   deepRecallRequestSchema
-} from "./chunk-AYP2FZFA.js";
+} from "./chunk-JUOJGZPV.js";
 import {
   EngramAccessInputError
 } from "./chunk-2Z24E5W2.js";
@@ -40,4 +40,4 @@ async function respondDeepRecall(req, res, respondJson, readJsonBody, service, s
 export {
   respondDeepRecall
 };
-//# sourceMappingURL=chunk-3UQIS2GC.js.map
+//# sourceMappingURL=chunk-WNMVUWI7.js.map

package/dist/{chunk-66YUOI53.js → chunk-WQW6KPVC.js}

@@ -19,4 +19,4 @@ export {
   confidenceTier,
   SPECULATIVE_TTL_DAYS
 };
-//# sourceMappingURL=chunk-66YUOI53.js.map
+//# sourceMappingURL=chunk-WQW6KPVC.js.map