@remnic/core 9.7.15 → 9.8.0

package/dist/chunk-FMLKOL2Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recall-state.ts"],"sourcesContent":["import { appendFile, mkdir, readFile, rename, rm, stat, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { log } from \"./logger.js\";\nimport { writeFileAtomically } from \"./maintenance/atomic-file.js\";\nimport { isErrnoCode } from \"./utils/errno.js\";\nimport { withHeldFileLock, type HeldFileLockOptions } from \"./utils/serialize-mutations.js\";\nimport { ensureContainedSpillDir, listContainedSpillFiles } from \"./utils/path-containment.js\";\nimport type { SearchDegradation } from \"./search/port.js\";\nimport type {\n  IdentityInjectionMode,\n  RecallPlanMode,\n  RecallTierExplain,\n} from \"./types.js\";\n\nexport interface LastRecallBudgetSummary {\n  requestedTopK?: number;\n  appliedTopK: number;\n  recallBudgetChars: number;\n  maxMemoryTokens: number;\n  qmdFetchLimit?: number;\n  qmdHybridFetchLimit?: number;\n  finalContextChars?: number;\n  truncated?: boolean;\n  includedSections?: string[];\n  omittedSections?: string[];\n  includedMemoryIds?: string[];\n  includedMemoryPaths?: string[];\n  includedMemoryNamespaces?: Array<string | undefined>;\n  omittedMemoryIds?: string[];\n}\n\nexport interface LastRecallSnapshot {\n  sessionKey: string;\n  recordedAt: string;\n  queryHash: string;\n  queryLen: number;\n  memoryIds: string[];\n  namespace?: string;\n  recallNamespaces?: string[];\n  traceId?: string;\n  plannerMode?: RecallPlanMode;\n  requestedMode?: RecallPlanMode;\n  source?: string;\n  fallbackUsed?: boolean;\n  sourcesUsed?: string[];\n  budgetsApplied?: LastRecallBudgetSummary;\n  latencyMs?: number;\n  resultPaths?: string[];\n  resultNamespaces?: Array<string | undefined>;\n  policyVersion?: string;\n  identityInjectionMode?: IdentityInjectionMode | \"none\";\n  identityInjectedChars?: number;\n  identityInjectionTruncated?: boolean;\n  /**\n   * Collision-safe write nonce.  Random UUID set on every `record()`\n   * call so the observation-mode direct-answer hook can detect stale\n   * snapshots and avoid annotating a snapshot that a subsequent recall\n   * already replaced (issue #518).\n   */\n  writeNonce?: string;\n  /**\n   * Optional tier-level explanation of how recall was served\n   * (issue #518).  Populated by orchestrator call sites that can\n   * identify a concrete tier; surfaces expose the block via\n   * `engram query --explain`, the `?explain=1` HTTP flag, and the\n   * `remnic_recall_explain` MCP tool.  Orthogonal to the existing\n   * graph-path `recallExplain` operation.\n   */\n  tierExplain?: RecallTierExplain;\n  /**\n   * Backend degradations observed while serving this recall (issue #1536).\n   * Present only when a search backend reported unavailable/loading/timeout\n   * during the recall — distinguishing \"no matches\" from \"backend could not\n   * answer\" (CLAUDE.md rule 34). Deliberately independent of `tierExplain`,\n   * which is gated behind `recallDirectAnswerEnabled`.\n   */\n  backendDegradations?: SearchDegradation[];\n}\n\nexport interface GraphRecallExpandedEntry {\n  path: string;\n  score: number;\n  namespace: string;\n  seed: string;\n  hopDepth: number;\n  decayedWeight: number;\n  graphType: \"entity\" | \"time\" | \"causal\";\n  /**\n   * Issue #681 PR 3/3 — confidence of the edge that produced this entry's\n   * recorded provenance (strongest edge along the chosen entry path).\n   * Range `[0, 1]`. Optional so persisted snapshots from older builds\n   * round-trip through `clampGraphRecallExpandedEntries` without dropping.\n   */\n  edgeConfidence?: number;\n}\n\nexport function clampGraphRecallExpandedEntries(\n  entries: unknown,\n  maxEntries: number = 64,\n): GraphRecallExpandedEntry[] {\n  const limit = Math.max(1, Math.floor(maxEntries));\n  if (!Array.isArray(entries)) return [];\n  return entries\n    .filter((item): item is Record<string, unknown> => !!item && typeof item === \"object\")\n    .map((item) => {\n      const graphType: \"entity\" | \"time\" | \"causal\" =\n        item.graphType === \"entity\" || item.graphType === \"time\" || item.graphType === \"causal\"\n          ? item.graphType\n          : \"entity\";\n      const out: GraphRecallExpandedEntry = {\n        path: typeof item.path === \"string\" ? item.path : \"\",\n        score: typeof item.score === \"number\" && Number.isFinite(item.score) ? item.score : 0,\n        namespace: typeof item.namespace === \"string\" ? item.namespace : \"\",\n        seed: typeof item.seed === \"string\" ? item.seed : \"\",\n        hopDepth:\n          typeof item.hopDepth === \"number\" && Number.isFinite(item.hopDepth)\n            ? Math.max(0, Math.floor(item.hopDepth))\n            : 0,\n        decayedWeight:\n          typeof item.decayedWeight === \"number\" && Number.isFinite(item.decayedWeight)\n            ? Math.max(0, item.decayedWeight)\n            : 0,\n        graphType,\n      };\n      // Issue #681 PR 3/3: clamp `edgeConfidence` into [0, 1] when present.\n      // Older snapshots without the field round-trip cleanly via the\n      // optional shape; legacy callers always rendered as 1.0.\n      if (\n        typeof item.edgeConfidence === \"number\" &&\n        Number.isFinite(item.edgeConfidence)\n      ) {\n        out.edgeConfidence = Math.min(1, Math.max(0, item.edgeConfidence));\n      }\n      return out;\n    })\n    .filter((item) => item.path.length > 0 && item.namespace.length > 0)\n    .slice(0, limit);\n}\n\ntype LastRecallState = Record<string, LastRecallSnapshot>;\ntype StateFileWriter = (filePath: string, content: string) => Promise<void>;\n\n/**\n * Deep-copy a RecallTierExplain block.  Used by both the write path\n * (so caller mutation after `record()` cannot tear the persisted\n * snapshot) and the read path (so caller mutation after `get()` /\n * `getMostRecent()` cannot tear the in-memory store).\n *\n * Uses structuredClone so future additions to RecallTierExplain do\n * not silently share references through hand-enumerated fields —\n * matching the pattern used elsewhere in the codebase (e.g.,\n * qmd-recall-cache.ts).  The payload is pure JSON-shaped data, so\n * structuredClone is both safe and complete here.\n */\n/**\n * Stale-snapshot identity guard shared by the annotate methods (issue #518):\n * a writeNonce match wins outright; otherwise traceId (when expected) and\n * recordedAt are compared. Extracted so every annotation surface applies\n * identical guards (CLAUDE.md rule 22).\n */\nfunction snapshotMatchesExpectedIdentity(\n  current: LastRecallSnapshot,\n  expected?: { writeNonce?: string; traceId?: string; recordedAt?: string },\n): boolean {\n  if (!expected) return true;\n  if (typeof expected.writeNonce === \"string\" && expected.writeNonce.length > 0) {\n    return current.writeNonce === expected.writeNonce;\n  }\n  const hasExpectedTraceId =\n    typeof expected.traceId === \"string\" && expected.traceId.length > 0;\n  if (hasExpectedTraceId) {\n    return current.traceId === expected.traceId;\n  }\n  if (expected.recordedAt !== undefined) {\n    return current.recordedAt === expected.recordedAt;\n  }\n  return true;\n}\n\nfunction cloneTierExplain(\n  tierExplain: RecallTierExplain | undefined,\n): RecallTierExplain | undefined {\n  if (!tierExplain) return undefined;\n  return structuredClone(tierExplain);\n}\n\n/**\n * Deep-copy a LastRecallSnapshot so callers that receive it cannot\n * mutate the store's internal state through mutable array/object\n * fields.  Same structuredClone rationale as cloneTierExplain above.\n */\nfunction cloneLastRecallSnapshot(\n  snapshot: LastRecallSnapshot | null,\n): LastRecallSnapshot | null {\n  if (!snapshot) return null;\n  return structuredClone(snapshot);\n}\n\nexport interface TierMigrationCycleSummary {\n  trigger: \"extraction\" | \"maintenance\" | \"manual\";\n  scanned: number;\n  migrated: number;\n  promoted: number;\n  demoted: number;\n  limit: number;\n  dryRun: boolean;\n  skipped?: string;\n  errorCount?: number;\n}\n\nexport interface TierMigrationStatusSnapshot {\n  updatedAt: string;\n  lastCycle: TierMigrationCycleSummary | null;\n  totals: {\n    cycles: number;\n    scanned: number;\n    migrated: number;\n    promoted: number;\n    demoted: number;\n    errors: number;\n  };\n}\n\nconst DEFAULT_TIER_MIGRATION_STATUS: TierMigrationStatusSnapshot = {\n  updatedAt: new Date(0).toISOString(),\n  lastCycle: null,\n  totals: {\n    cycles: 0,\n    scanned: 0,\n    migrated: 0,\n    promoted: 0,\n    demoted: 0,\n    errors: 0,\n  },\n};\n\n/**\n * Suffix marking an impression spill CLAIMED for commit but not yet deleted.\n * The crash-safe drain renames `<uuid>.jsonl` -> `<uuid>.jsonl.claimed` before\n * committing its rows, mirroring the lifecycle ledger's claim/commit protocol\n * (#2033).\n */\nconst CLAIMED_IMPRESSION_SPILL_SUFFIX = \".claimed\";\n\n/**\n * Outcome of {@link LastRecallStore.drainPendingImpressions}. Distinguishes a\n * completed drain (or nothing pending) from a DEFERRED drain that left durable\n * spills in the offline-sync-EXCLUDED queue, so the caller can tell the\n * data-safe cases apart from the one where an offline-sync snapshot would\n * silently omit recorded impressions (#2033).\n */\nexport interface DrainPendingImpressionsResult {\n  /** Pending spill rows were folded into the synced active file this call. */\n  folded: boolean;\n  /**\n   * Durable spill rows remain in the offline-sync-EXCLUDED pending queue after\n   * this drain: the rotation lock could not be acquired, a spill could not be\n   * claimed, or the drain-only fold left rows that would only fit by rotating\n   * into a sync-excluded archive. A snapshot taken now would silently omit them\n   * (#2033): the caller MUST treat the active file as INCOMPLETE and retry or\n   * abort the snapshot rather than report success. `false` means the active file\n   * is complete — every pending row was folded or nothing was pending.\n   */\n  pendingDeferred: boolean;\n}\n\nexport class LastRecallStore {\n  private readonly statePath: string;\n  private readonly impressionsPath: string;\n  private readonly writeStateFile: StateFileWriter;\n  private readonly impressionsRotateBytes: number;\n  private readonly impressionsRotateKeep: number;\n  // Lock-acquisition timing for the cross-process impression rotation lock.\n  // Only tests set this (small maxWaitMs) to force the acquisition-timeout\n  // (`acquired=false`) branch deterministically; production uses the defaults.\n  private readonly impressionsLockOptions?: Pick<HeldFileLockOptions, \"maxWaitMs\" | \"pollMs\">;\n  private state: LastRecallState = {};\n  private stateWriteChain: Promise<void> = Promise.resolve();\n  // Serializes the rotate-then-append critical section so concurrent record()\n  // calls never interleave rotation renames with each other's appends (#1910).\n  private impressionsWriteChain: Promise<void> = Promise.resolve();\n\n  constructor(\n    memoryDir: string,\n    options: {\n      writeStateFile?: StateFileWriter;\n      impressionsRotateBytes?: number;\n      impressionsRotateKeep?: number;\n      impressionsLockOptions?: Pick<HeldFileLockOptions, \"maxWaitMs\" | \"pollMs\">;\n    } = {},\n  ) {\n    this.statePath = path.join(memoryDir, \"state\", \"last_recall.json\");\n    this.impressionsPath = path.join(memoryDir, \"state\", \"recall_impressions.jsonl\");\n    // 0 disables rotation (never coerced to a default); keep floors at 1.\n    this.impressionsRotateBytes = Math.max(0, Math.floor(options.impressionsRotateBytes ?? 0));\n    this.impressionsRotateKeep = Math.max(1, Math.floor(options.impressionsRotateKeep ?? 5));\n    this.impressionsLockOptions = options.impressionsLockOptions;\n    this.writeStateFile =\n      options.writeStateFile ??\n      (async (filePath, content) => {\n        await writeFileAtomically(filePath, content);\n      });\n  }\n\n  async load(): Promise<void> {\n    try {\n      const raw = await readFile(this.statePath, \"utf-8\");\n      const parsed = JSON.parse(raw) as LastRecallState;\n      if (parsed && typeof parsed === \"object\") this.state = parsed;\n    } catch {\n      this.state = {};\n    }\n  }\n\n  get(sessionKey: string): LastRecallSnapshot | null {\n    // Defensive copy: callers must not be able to mutate internal state\n    // by reaching into array/object fields on the returned snapshot.\n    return cloneLastRecallSnapshot(this.state[sessionKey] ?? null);\n  }\n\n  getMostRecent(): LastRecallSnapshot | null {\n    const snapshots = Object.values(this.state);\n    if (snapshots.length === 0) return null;\n    // Secondary key on sessionKey keeps the sort stable when two\n    // snapshots share a recordedAt timestamp (CLAUDE.md rule 19).\n    snapshots.sort((a, b) => {\n      const byTime = b.recordedAt.localeCompare(a.recordedAt);\n      if (byTime !== 0) return byTime;\n      return a.sessionKey.localeCompare(b.sessionKey);\n    });\n    return cloneLastRecallSnapshot(snapshots[0] ?? null);\n  }\n\n  /**\n   * Persist last-recall snapshot and append an impression log entry.\n   * Does not store raw query text; uses a stable hash for correlation.\n   */\n  async record(opts: {\n    sessionKey: string;\n    query: string;\n    memoryIds: string[];\n    namespace?: string;\n    recallNamespaces?: string[];\n    traceId?: string;\n    plannerMode?: RecallPlanMode;\n    requestedMode?: RecallPlanMode;\n    source?: string;\n    fallbackUsed?: boolean;\n    sourcesUsed?: string[];\n    budgetsApplied?: LastRecallBudgetSummary;\n    latencyMs?: number;\n    resultPaths?: string[];\n    resultNamespaces?: Array<string | undefined>;\n    policyVersion?: string;\n    appendImpression?: boolean;\n    identityInjection?: {\n      mode: IdentityInjectionMode | \"none\";\n      injectedChars: number;\n      truncated: boolean;\n    };\n    /**\n     * Per-tier explain annotation (issue #518).  When supplied, the\n     * snapshot carries it so downstream surfaces (CLI / HTTP / MCP)\n     * can render which retrieval tier served the query.\n     */\n    tierExplain?: RecallTierExplain;\n    /**\n     * Backend degradations observed while serving this recall (issue #1536).\n     * Passed at record time so the published snapshot is born annotated —\n     * a post-record annotation would leave a window where readers see the\n     * snapshot without them (codex review on #1544).\n     */\n    backendDegradations?: SearchDegradation[];\n  }): Promise<void> {\n    const now = new Date().toISOString();\n    const queryHash = createHash(\"sha256\").update(opts.query).digest(\"hex\");\n\n    // Build the snapshot from opts, then deep-copy it via\n    // cloneLastRecallSnapshot so caller arrays/objects passed in\n    // `opts` cannot retain a live reference to the persisted state and\n    // tear it after `record()` returns.\n    const liveSnapshot: LastRecallSnapshot = {\n      sessionKey: opts.sessionKey,\n      recordedAt: now,\n      queryHash,\n      writeNonce: randomUUID(),\n      queryLen: opts.query.length,\n      memoryIds: opts.memoryIds,\n      namespace: opts.namespace,\n      recallNamespaces: opts.recallNamespaces,\n      traceId: opts.traceId,\n      plannerMode: opts.plannerMode,\n      requestedMode: opts.requestedMode,\n      source: opts.source,\n      fallbackUsed: opts.fallbackUsed,\n      sourcesUsed: opts.sourcesUsed,\n      budgetsApplied: opts.budgetsApplied,\n      latencyMs: opts.latencyMs,\n      resultPaths: opts.resultPaths,\n      resultNamespaces: opts.resultNamespaces,\n      policyVersion: opts.policyVersion,\n      identityInjectionMode: opts.identityInjection?.mode,\n      identityInjectedChars: opts.identityInjection?.injectedChars,\n      identityInjectionTruncated: opts.identityInjection?.truncated,\n      tierExplain: opts.tierExplain,\n      backendDegradations:\n        opts.backendDegradations && opts.backendDegradations.length > 0\n          ? opts.backendDegradations\n          : undefined,\n    };\n    // `cloneLastRecallSnapshot` handles `null` but that never applies\n    // at this call site — the non-null assertion keeps the type\n    // checker honest.\n    const snapshot = cloneLastRecallSnapshot(liveSnapshot)!;\n\n    this.state[opts.sessionKey] = snapshot;\n\n    // Keep the state bounded; the impression log is append-only.\n    const keys = Object.keys(this.state);\n    if (keys.length > 50) {\n      const ordered = keys\n        .map((k) => ({ k, at: this.state[k]?.recordedAt ?? \"\" }))\n        .sort((a, b) => b.at.localeCompare(a.at));\n      for (const doomed of ordered.slice(50)) {\n        delete this.state[doomed.k];\n      }\n    }\n\n    try {\n      await this.flushState();\n    } catch (err) {\n      log.debug(`last recall store write failed: ${err}`);\n    }\n\n    if (opts.appendImpression !== false) {\n      const line = JSON.stringify(snapshot) + \"\\n\";\n      // Chain onto the previous impression write so rotation + append run as one\n      // serialized critical section — concurrent record() calls can never\n      // interleave a rename with another call's append (#1910). `.catch` before\n      // the link keeps a prior failure from poisoning the chain.\n      const chained = this.impressionsWriteChain\n        .catch(() => {})\n        .then(() => this.appendImpressionSerialized(line));\n      this.impressionsWriteChain = chained;\n      try {\n        await chained;\n      } catch (err) {\n        log.debug(`recall impressions append failed: ${err}`);\n      }\n    }\n  }\n\n  /**\n   * Drain pending spills, rotate (best-effort, sized to the projected payload),\n   * then append one impression line under ONE shared cross-process lock (#1910,\n   * #2033). Both the archive-shift renames AND the append run inside the same\n   * held lock so a peer process holding the lock can never rename the active\n   * inode to `.1` between our open and write — which would land the impression in\n   * a rotated archive that offline-sync excludes, silently dropping it from\n   * active-state/sync consumers.\n   *\n   * On lock-acquisition timeout the impression is NEVER written to the active\n   * file unlocked (#2033): a peer holding the lock is likely mid-rotation, so an\n   * unlocked append can land in the inode it is about to rename to `.1` — the\n   * exact silent-drop this lock prevents. Instead the row is spilled to a\n   * durable node-local per-event file under `<impressions>.pending.d/` and\n   * folded back into the active file by the next append that DOES hold the lock,\n   * preserving durability without racing rotation. Rotation failure under the\n   * held lock is logged and the append still runs. Callers invoke this only\n   * through `impressionsWriteChain` so the sequence is serialized in-process.\n   */\n  private get impressionsPendingDir(): string {\n    return `${this.impressionsPath}.pending.d`;\n  }\n\n  private async spillImpression(line: string): Promise<void> {\n    await ensureContainedSpillDir(this.impressionsPendingDir);\n    // Write to a temp name the drain's `.jsonl` lister ignores, then atomically\n    // rename to the final `<uuid>.jsonl` (#2033). writeFile creates the path\n    // before its bytes are durable, so writing straight to the final name lets a\n    // concurrent lock holder's drain read/rename/delete a partial spill and\n    // append malformed JSON — permanently losing that impression. The temp lives\n    // in the SAME contained dir, so the rename is atomic and stays symlink-safe.\n    const id = randomUUID();\n    const tempPath = path.join(this.impressionsPendingDir, `${id}.jsonl.tmp`);\n    const finalPath = path.join(this.impressionsPendingDir, `${id}.jsonl`);\n    await writeFile(tempPath, line, \"utf-8\");\n    await rename(tempPath, finalPath);\n  }\n\n  /**\n   * Recover a claim a crashed drain left mid-flight (#2033): the crash-safe\n   * drain renames `<uuid>.jsonl` -> `<uuid>.jsonl.claimed` BEFORE committing, so\n   * a `.claimed` file with no matching commit is the ONLY durable copy of those\n   * rows. Rename each orphan back to `<uuid>.jsonl` so it re-enters the normal\n   * collect+claim+commit flow. MUST run under the held rotation lock, before\n   * collecting. listContainedSpillFiles skips symlinked/escaping entries.\n   */\n  private async recoverOrphanedImpressionClaims(): Promise<void> {\n    const orphans = await listContainedSpillFiles(\n      this.impressionsPendingDir,\n      `.jsonl${CLAIMED_IMPRESSION_SPILL_SUFFIX}`,\n    );\n    for (const claimedPath of orphans) {\n      const original = claimedPath.slice(0, -CLAIMED_IMPRESSION_SPILL_SUFFIX.length);\n      await rename(claimedPath, original).catch(() => undefined);\n    }\n  }\n\n  /**\n   * Recover a crash-orphaned spill temp after its write completed but before\n   * the atomic `.tmp` → `.jsonl` rename. Valid JSONL temps are promoted back\n   * into the normal queue; incomplete temps remain pending and keep offline sync\n   * deferred rather than being discarded.\n   */\n  private async recoverOrphanedImpressionTemps(): Promise<void> {\n    const temps = await listContainedSpillFiles(this.impressionsPendingDir, \".jsonl.tmp\");\n    for (const tempPath of temps) {\n      let content: string;\n      try {\n        content = await readFile(tempPath, \"utf-8\");\n        for (const line of content.split(\"\\n\")) {\n          if (line.trim().length > 0) JSON.parse(line);\n        }\n      } catch {\n        continue;\n      }\n      const finalPath = tempPath.slice(0, -\".tmp\".length);\n      await rename(tempPath, finalPath).catch(() => undefined);\n    }\n  }\n\n  private async appendImpressionSerialized(line: string): Promise<void> {\n    await mkdir(path.dirname(this.impressionsPath), { recursive: true });\n    // Every active-file write goes under the shared cross-process rotation lock,\n    // even when THIS writer's local rotation is disabled (`impressionsRotateBytes\n    // <= 0`). A peer process with rotation enabled shares this lock and may\n    // rename the active inode to `.1` at any moment, so an unlocked append could\n    // land in an offline-sync-excluded archive and be silently dropped (#2033).\n    // Only the local rotate DECISION is disabled — the bounded fold skips\n    // rotation when this writer's limit is 0 — the lock itself is not.\n    const lockPath = `${this.impressionsPath}.lock`;\n    await withHeldFileLock(\n      lockPath,\n      { staleMs: 30_000, ...this.impressionsLockOptions },\n      async (acquired) => {\n        // withHeldFileLock falls back to task(false) when it cannot acquire the\n        // lock within the budget. Do NOT append to the active file unlocked: a\n        // peer holding the lock may be mid-rotation, so an unlocked append could\n        // land in the inode it renames to `.1` (an offline-sync-excluded\n        // archive), silently dropping the impression. Spill it to the durable\n        // pending queue instead — the next lock holder folds it back in (#2033).\n        if (!acquired) {\n          log.debug(\"recall impressions rotation lock not acquired; spilling impression to the durable pending queue\");\n          await this.spillImpression(line);\n          return;\n        }\n        await this.foldPendingImpressionsAndAppend(line);\n      },\n    );\n  }\n\n  /**\n   * Fold any durable pending recall-impression spills into the synced active\n   * `recall_impressions.jsonl` WITHOUT recording a new impression (#2033).\n   *\n   * The pending spill dir is offline-sync-excluded, so an impression that a\n   * lock-timed-out `record()` spilled there is absent from an offline-sync\n   * snapshot and lost if this node is discarded before the next `record()`\n   * folds it back. Offline sync calls this before building a snapshot so a\n   * recorded impression always reaches the remote. Fast no-op — no lock and no\n   * dir/lock-file creation — when nothing is pending.\n   *\n   * Returns a {@link DrainPendingImpressionsResult}: `folded` is true when rows\n   * were folded into the active file; `pendingDeferred` is true when durable\n   * spills still remain in the offline-sync-EXCLUDED queue after this call —\n   * because the rotation lock could not be acquired, a spill could not be\n   * claimed, or the drain-only fold deferred rows that would only fit by\n   * rotating into a sync-excluded archive (#2033). A snapshot taken while\n   * `pendingDeferred` is true would silently drop those rows, so the caller MUST\n   * NOT report a clean snapshot — it either retries or aborts.\n   */\n  async drainPendingImpressions(): Promise<DrainPendingImpressionsResult> {\n    if (!(await this.pendingSpillsRemain())) {\n      return { folded: false, pendingDeferred: false };\n    }\n    const lockPath = `${this.impressionsPath}.lock`;\n    let folded = false;\n    let acquiredLock = false;\n    let spillsRemain = false;\n    await withHeldFileLock(\n      lockPath,\n      { staleMs: 30_000, ...this.impressionsLockOptions },\n      async (acquired) => {\n        // A peer holds the lock (mid-rotation or mid-append). We MUST NOT touch\n        // the active file unlocked (#2033), so the spills stay in the\n        // offline-sync-EXCLUDED pending queue. Report the drain as DEFERRED\n        // (pendingDeferred=true) so the caller does not build a snapshot that\n        // silently omits them; the next lock holder — or a caller retry — folds\n        // them in.\n        if (!acquired) return;\n        acquiredLock = true;\n        folded = await this.foldPendingImpressionsAndAppend(null);\n        // Even WITH the lock, a spill the fold could not claim or a `.claimed`\n        // orphan a failed commit left behind keeps durable rows in the excluded\n        // queue. Treat that as an incomplete drain so the caller retries/aborts\n        // rather than snapshotting an active file that omits them (#2033).\n        spillsRemain = await this.pendingSpillsRemain();\n      },\n    );\n    return { folded, pendingDeferred: !acquiredLock || spillsRemain };\n  }\n\n  /**\n   * Claim/commit fold of durable pending impression spills into the active file\n   * under the held rotation lock (#2033). `line` is a new impression to append\n   * after the drained rows, or null for a drain-only pre-sync fold.\n   *\n   * Each spill is folded as an INDEPENDENT claim -> append -> finalize unit\n   * rather than materializing the whole queue as one joined payload and\n   * splitting it in a single synchronous pass (#2033). A multi-hundred-MB drain\n   * done as one join/split blocks the event loop long enough for\n   * `withHeldFileLock`'s ownership-refresh timer to miss its window, so a peer\n   * stale-breaks the 30s lock and rotates/appends concurrently — defeating the\n   * rotation lock this drain relies on. The per-file `await`s keep the payload\n   * bounded to one spill at a time and let the refresh timer fire between files.\n   *\n   * The DRAIN-ONLY path (`line === null`, run before an offline-sync snapshot)\n   * NEVER rotates a drained row into an archive. `recall_impressions.jsonl.*`\n   * is offline-sync-EXCLUDED, so rotating a just-drained row into `.1`/`.2` and\n   * then deleting its spill would leave that row only in a path sync omits —\n   * silently lost when the node is discarded after a \"successful\" sync (#2033).\n   * It folds only the rows that fit the synced active file under the cap and\n   * leaves the rest durable in the pending queue; {@link drainPendingImpressions}\n   * then reports the drain DEFERRED so the caller retries or aborts. The\n   * record() path (`line !== null`) keeps rotating normally — its archives stay\n   * on a live node that is not being discarded.\n   *\n   * Recovers any crash-orphaned claim first. Each impression carries a unique\n   * writeNonce, so a crash-recovered re-commit is a collapsible duplicate, never\n   * a lost row. listContainedSpillFiles rejects symlinked/escaping entries; a\n   * spill that cannot be claimed is skipped this pass. An append failure rolls\n   * that spill's claim back so the row retries on the next lock holder's drain.\n   * Returns true when the active file was written. MUST run under the held\n   * rotation lock.\n   */\n  private async foldPendingImpressionsAndAppend(line: string | null): Promise<boolean> {\n    await this.recoverOrphanedImpressionTemps();\n    await this.recoverOrphanedImpressionClaims();\n    const spillFiles = await listContainedSpillFiles(this.impressionsPendingDir);\n    const drainOnly = line === null;\n    const cap = this.impressionsRotateBytes;\n    let activeSize = 0;\n    if (cap > 0) {\n      try {\n        activeSize = (await stat(this.impressionsPath)).size;\n      } catch (err) {\n        if (!isErrnoCode(err, \"ENOENT\")) throw err;\n      }\n    }\n    let wrote = false;\n    for (const filePath of spillFiles) {\n      const content = await readFile(filePath, \"utf-8\");\n      const unit = content.length === 0 || content.endsWith(\"\\n\") ? content : `${content}\\n`;\n      const unitBytes = Buffer.byteLength(unit, \"utf-8\");\n      // Drain-only fold must never push a drained row into a sync-excluded\n      // archive (#2033). Once the active file cannot take this spill under the\n      // cap without rotating, stop: the remaining spills stay durable in the\n      // pending queue and the drain reports itself deferred. A lone spill larger\n      // than the cap on an empty active file is still folded whole (it cannot be\n      // split without corrupting JSONL) so it reaches sync rather than stranding.\n      if (drainOnly && cap > 0 && activeSize > 0 && activeSize + unitBytes >= cap) break;\n      const claimedPath = `${filePath}${CLAIMED_IMPRESSION_SPILL_SUFFIX}`;\n      try {\n        await rename(filePath, claimedPath);\n      } catch {\n        continue; // could not claim → do not commit; a later drain retries it.\n      }\n      try {\n        activeSize = await this.appendImpressionUnit(unit, activeSize, drainOnly);\n      } catch (err) {\n        // Commit failed: roll this spill's claim back so it retries on the next\n        // lock holder's drain instead of being lost.\n        await rename(claimedPath, filePath).catch(() => undefined);\n        throw err;\n      }\n      // Commit is durable: delete the claimed file. A delete that fails leaves a\n      // `.claimed` orphan the next drain recovers and re-commits — a\n      // writeNonce-collapsible duplicate, never a lost row (#2033).\n      await unlink(claimedPath).catch(() => undefined);\n      wrote = true;\n    }\n    if (line !== null) {\n      activeSize = await this.appendImpressionUnit(line, activeSize, false);\n      wrote = true;\n    }\n    return wrote;\n  }\n\n  /**\n   * Append one whole JSONL unit (a claimed spill's rows or a fresh impression\n   * line) to the active impressions file, returning the resulting active-file\n   * byte size. On the rotating (record) path, when the unit would push the\n   * current active generation to/over `impressionsRotateBytes`, the full active\n   * file is rotated aside FIRST so no generation exceeds the cap (#2033); a lone\n   * unit larger than the cap on an empty active file is written whole because\n   * splitting a JSONL row would corrupt it. `drainOnly` and disabled rotation\n   * (`impressionsRotateBytes <= 0`) both skip rotation — drain-only defers its\n   * overflow in {@link foldPendingImpressionsAndAppend} rather than rotating into\n   * a sync-excluded archive. A rotation error is logged and the append still\n   * runs so a row is never lost; an append failure propagates so the caller\n   * rolls its claim back. MUST run under the held rotation lock.\n   */\n  private async appendImpressionUnit(\n    unit: string,\n    activeSize: number,\n    drainOnly: boolean,\n  ): Promise<number> {\n    const cap = this.impressionsRotateBytes;\n    const unitBytes = Buffer.byteLength(unit, \"utf-8\");\n    if (cap > 0 && !drainOnly && activeSize > 0 && activeSize + unitBytes >= cap) {\n      try {\n        await this.shiftImpressionArchives();\n        activeSize = 0;\n      } catch (err) {\n        log.debug(`recall impressions rotation failed (append preserved): ${err}`);\n      }\n    }\n    await appendFile(this.impressionsPath, unit, \"utf-8\");\n    return activeSize + unitBytes;\n  }\n\n  /**\n   * True when any live `<uuid>.jsonl` spill, crash-orphaned `.claimed` file,\n   * or crash-orphaned `.jsonl.tmp` spill remains in the offline-sync-EXCLUDED\n   * pending queue (#2033). After a drain acquires the rotation lock, a spill\n   * the fold could not claim (rename race / read-only dir) or a `.claimed`\n   * orphan a failed commit left behind means durable rows are STILL excluded\n   * from a snapshot — the drain must report itself INCOMPLETE so the caller\n   * retries or aborts rather than snapshotting an active file that omits them.\n   */\n  private async pendingSpillsRemain(): Promise<boolean> {\n    if ((await listContainedSpillFiles(this.impressionsPendingDir, \".jsonl.tmp\")).length > 0) {\n      return true;\n    }\n    const liveSpills = await listContainedSpillFiles(this.impressionsPendingDir);\n    if (liveSpills.length > 0) return true;\n    const claimed = await listContainedSpillFiles(\n      this.impressionsPendingDir,\n      `.jsonl${CLAIMED_IMPRESSION_SPILL_SUFFIX}`,\n    );\n    return claimed.length > 0;\n  }\n\n  /**\n   * Shift `.1..N` archives down one slot and move the active file to `.1`,\n   * dropping anything beyond `keep`. Callers invoke this only while holding the\n   * cross-process rotation lock (issue #1910).\n   */\n  private async shiftImpressionArchives(): Promise<void> {\n    const keep = this.impressionsRotateKeep;\n    // Drop the archive that would fall off the end, then shift down: .(keep-1)\n    // -> .keep, ..., .1 -> .2, active -> .1.\n    try {\n      await rm(`${this.impressionsPath}.${keep}`, { force: true });\n    } catch {\n      // best-effort cleanup of the oldest archive\n    }\n    for (let i = keep - 1; i >= 1; i -= 1) {\n      try {\n        await rename(`${this.impressionsPath}.${i}`, `${this.impressionsPath}.${i + 1}`);\n      } catch (err) {\n        if (!isErrnoCode(err, \"ENOENT\")) throw err;\n      }\n    }\n    try {\n      await rename(this.impressionsPath, `${this.impressionsPath}.1`);\n    } catch (err) {\n      if (!isErrnoCode(err, \"ENOENT\")) throw err;\n    }\n  }\n\n  /**\n   * Attach a RecallTierExplain block to the existing snapshot for a\n   * session without rewriting the entire snapshot.  Used by the\n   * post-recall direct-answer annotation path (issue #518 slice 3c):\n   * recallInternal records the snapshot first, then the orchestrator\n   * fires the direct-answer tier in observation mode and annotates\n   * the stored snapshot with whichever tier served the query.\n   *\n   * No-op when no snapshot exists for the given session; callers do\n   * not need to guard on existence.\n   */\n  async annotateTierExplain(\n    sessionKey: string,\n    tierExplain: RecallTierExplain,\n    expected?: { writeNonce?: string; traceId?: string; recordedAt?: string },\n  ): Promise<void> {\n    const current = this.state[sessionKey];\n    if (!current) return;\n    if (!snapshotMatchesExpectedIdentity(current, expected)) return;\n    this.state[sessionKey] = {\n      ...current,\n      tierExplain: cloneTierExplain(tierExplain),\n    };\n    try {\n      await this.flushState();\n    } catch (err) {\n      log.debug(`last recall tier-explain annotate failed: ${err}`);\n    }\n  }\n\n\n  private flushState(): Promise<void> {\n    const run = this.stateWriteChain.catch(() => undefined).then(async () => {\n      await mkdir(path.dirname(this.statePath), { recursive: true });\n      await this.writeStateFile(this.statePath, JSON.stringify(this.state, null, 2));\n    });\n    this.stateWriteChain = run.then(\n      () => undefined,\n      () => undefined,\n    );\n    return run;\n  }\n}\n\nexport class TierMigrationStatusStore {\n  private readonly statePath: string;\n  private state: TierMigrationStatusSnapshot = structuredClone(DEFAULT_TIER_MIGRATION_STATUS);\n\n  constructor(memoryDir: string) {\n    this.statePath = path.join(memoryDir, \"state\", \"tier-migration-status.json\");\n  }\n\n  async load(): Promise<void> {\n    try {\n      const raw = await readFile(this.statePath, \"utf-8\");\n      const parsed = JSON.parse(raw) as Partial<TierMigrationStatusSnapshot> | null;\n      if (!parsed || typeof parsed !== \"object\") {\n        this.state = structuredClone(DEFAULT_TIER_MIGRATION_STATUS);\n        return;\n      }\n      const totals = parsed.totals && typeof parsed.totals === \"object\"\n        ? parsed.totals\n        : DEFAULT_TIER_MIGRATION_STATUS.totals;\n      this.state = {\n        updatedAt:\n          typeof parsed.updatedAt === \"string\" && parsed.updatedAt.length > 0\n            ? parsed.updatedAt\n            : DEFAULT_TIER_MIGRATION_STATUS.updatedAt,\n        lastCycle:\n          parsed.lastCycle && typeof parsed.lastCycle === \"object\"\n            ? (parsed.lastCycle as TierMigrationCycleSummary)\n            : null,\n        totals: {\n          cycles: typeof totals.cycles === \"number\" && Number.isFinite(totals.cycles) ? totals.cycles : 0,\n          scanned: typeof totals.scanned === \"number\" && Number.isFinite(totals.scanned) ? totals.scanned : 0,\n          migrated: typeof totals.migrated === \"number\" && Number.isFinite(totals.migrated) ? totals.migrated : 0,\n          promoted: typeof totals.promoted === \"number\" && Number.isFinite(totals.promoted) ? totals.promoted : 0,\n          demoted: typeof totals.demoted === \"number\" && Number.isFinite(totals.demoted) ? totals.demoted : 0,\n          errors: typeof totals.errors === \"number\" && Number.isFinite(totals.errors) ? totals.errors : 0,\n        },\n      };\n    } catch {\n      this.state = structuredClone(DEFAULT_TIER_MIGRATION_STATUS);\n    }\n  }\n\n  get(): TierMigrationStatusSnapshot {\n    return {\n      updatedAt: this.state.updatedAt,\n      lastCycle: this.state.lastCycle ? { ...this.state.lastCycle } : null,\n      totals: { ...this.state.totals },\n    };\n  }\n\n  async recordCycle(summary: TierMigrationCycleSummary): Promise<void> {\n    const now = new Date().toISOString();\n    const migratedDelta = summary.dryRun ? 0 : Math.max(0, summary.migrated);\n    const promotedDelta = summary.dryRun ? 0 : Math.max(0, summary.promoted);\n    const demotedDelta = summary.dryRun ? 0 : Math.max(0, summary.demoted);\n    const next: TierMigrationStatusSnapshot = {\n      updatedAt: now,\n      lastCycle: { ...summary },\n      totals: {\n        cycles: this.state.totals.cycles + 1,\n        scanned: this.state.totals.scanned + Math.max(0, summary.scanned),\n        migrated: this.state.totals.migrated + migratedDelta,\n        promoted: this.state.totals.promoted + promotedDelta,\n        demoted: this.state.totals.demoted + demotedDelta,\n        errors: this.state.totals.errors + Math.max(0, summary.errorCount ?? 0),\n      },\n    };\n    this.state = next;\n    try {\n      await mkdir(path.dirname(this.statePath), { recursive: true });\n      await writeFile(this.statePath, JSON.stringify(next, null, 2), \"utf-8\");\n    } catch (err) {\n      log.debug(`tier migration status write failed: ${err}`);\n    }\n  }\n}\n\n\n/**\n * Per-session bounded history of recent recall memory-id sets, used ONLY by\n * handle resolution (issue #1582). Distinct from {@link LastRecallStore} —\n * that keeps ONE last snapshot per session; this keeps a small ring (depth N)\n * of the memory-id arrays a session has recalled, newest first, so a handle\n * cited in a later turn still resolves even after a newer recall displaced the\n * \"last\" snapshot.\n *\n * Deliberately lightweight: stores only `string[]` per entry (no full\n * snapshot), capped at `depth` per session and 50 sessions total (rule 27\n * slice/cap guards). Misses are acceptable and tagged at resolution time.\n */\nexport class RecallHandleHistoryStore {\n  private readonly statePath: string;\n  private readonly writeStateFile: StateFileWriter;\n  private state: Record<string, Array<{ at: string; ids: string[] }>> = {};\n  private writeChain: Promise<void> = Promise.resolve();\n  private readonly maxDepth: number;\n\n  constructor(memoryDir: string, options: { writeStateFile?: StateFileWriter; maxDepth?: number } = {}) {\n    this.statePath = path.join(memoryDir, \"state\", \"handle_history.json\");\n    this.writeStateFile =\n      options.writeStateFile ??\n      (async (filePath, content) => {\n        await writeFileAtomically(filePath, content);\n      });\n    this.maxDepth =\n      typeof options.maxDepth === \"number\" && Number.isFinite(options.maxDepth)\n        ? Math.max(1, Math.min(50, Math.floor(options.maxDepth)))\n        : 5;\n  }\n\n  async load(): Promise<void> {\n    try {\n      const raw = await readFile(this.statePath, \"utf-8\");\n      const parsed = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\") this.state = parsed as typeof this.state;\n    } catch {\n      this.state = {};\n    }\n  }\n\n  /**\n   * Record one recall's admitted memory ids for a session, newest first.\n   * The ring is capped at {@link maxDepth}; older entries drop off the tail.\n   */\n  async record(sessionKey: string, memoryIds: readonly string[]): Promise<void> {\n    if (!sessionKey) return;\n    const ids = memoryIds.filter((id): id is string => typeof id === \"string\" && id.length > 0);\n    const entry = { at: new Date().toISOString(), ids };\n    const prior = this.state[sessionKey] ?? [];\n    const next = [entry, ...prior].slice(0, this.maxDepth);\n    this.state[sessionKey] = next;\n    this.capSessions();\n    try {\n      await this.flush();\n    } catch (err) {\n      log.debug(`recall handle history write failed: ${err}`);\n    }\n  }\n\n  /**\n   * Return the memory-id arrays for a session, newest first, capped at `depth`.\n   * Empty array when the session has no recorded history.\n   */\n  recent(sessionKey: string, depth: number = this.maxDepth): Array<readonly string[]> {\n    const entries = this.state[sessionKey];\n    if (!entries || entries.length === 0) return [];\n    const limit = Math.max(0, Math.min(depth, entries.length));\n    return entries.slice(0, limit).map((e) => e.ids);\n  }\n\n  /** Test seam: drop all history (used by the corpus-scan hygiene test). */\n  clearForTest(): void {\n    this.state = {};\n  }\n\n  private capSessions(): void {\n    const keys = Object.keys(this.state);\n    if (keys.length <= 50) return;\n    const ordered = keys\n      .map((k) => ({ k, at: this.state[k]?.[0]?.at ?? \"\" }))\n      .sort((a, b) => b.at.localeCompare(a.at));\n    for (const doomed of ordered.slice(50)) {\n      delete this.state[doomed.k];\n    }\n  }\n\n  private flush(): Promise<void> {\n    const run = this.writeChain.catch(() => undefined).then(async () => {\n      await mkdir(path.dirname(this.statePath), { recursive: true });\n      await this.writeStateFile(this.statePath, JSON.stringify(this.state, null, 2));\n    });\n    this.writeChain = run.then(() => undefined, () => undefined);\n    return run;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,OAAO,UAAU,QAAQ,IAAI,MAAM,QAAQ,iBAAiB;AACjF,OAAO,UAAU;AACjB,SAAS,YAAY,kBAAkB;AA+FhC,SAAS,gCACd,SACA,aAAqB,IACO;AAC5B,QAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC;AAChD,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO,CAAC;AACrC,SAAO,QACJ,OAAO,CAAC,SAA0C,CAAC,CAAC,QAAQ,OAAO,SAAS,QAAQ,EACpF,IAAI,CAAC,SAAS;AACb,UAAM,YACJ,KAAK,cAAc,YAAY,KAAK,cAAc,UAAU,KAAK,cAAc,WAC3E,KAAK,YACL;AACN,UAAM,MAAgC;AAAA,MACpC,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,MAClD,OAAO,OAAO,KAAK,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AAAA,MACpF,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AAAA,MACjE,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,MAClD,UACE,OAAO,KAAK,aAAa,YAAY,OAAO,SAAS,KAAK,QAAQ,IAC9D,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,QAAQ,CAAC,IACrC;AAAA,MACN,eACE,OAAO,KAAK,kBAAkB,YAAY,OAAO,SAAS,KAAK,aAAa,IACxE,KAAK,IAAI,GAAG,KAAK,aAAa,IAC9B;AAAA,MACN;AAAA,IACF;AAIA,QACE,OAAO,KAAK,mBAAmB,YAC/B,OAAO,SAAS,KAAK,cAAc,GACnC;AACA,UAAI,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,KAAK,cAAc,CAAC;AAAA,IACnE;AACA,WAAO;AAAA,EACT,CAAC,EACA,OAAO,CAAC,SAAS,KAAK,KAAK,SAAS,KAAK,KAAK,UAAU,SAAS,CAAC,EAClE,MAAM,GAAG,KAAK;AACnB;AAuBA,SAAS,gCACP,SACA,UACS;AACT,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,OAAO,SAAS,eAAe,YAAY,SAAS,WAAW,SAAS,GAAG;AAC7E,WAAO,QAAQ,eAAe,SAAS;AAAA,EACzC;AACA,QAAM,qBACJ,OAAO,SAAS,YAAY,YAAY,SAAS,QAAQ,SAAS;AACpE,MAAI,oBAAoB;AACtB,WAAO,QAAQ,YAAY,SAAS;AAAA,EACtC;AACA,MAAI,SAAS,eAAe,QAAW;AACrC,WAAO,QAAQ,eAAe,SAAS;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,iBACP,aAC+B;AAC/B,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,gBAAgB,WAAW;AACpC;AAOA,SAAS,wBACP,UAC2B;AAC3B,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,gBAAgB,QAAQ;AACjC;AA2BA,IAAM,gCAA6D;AAAA,EACjE,YAAW,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,EACnC,WAAW;AAAA,EACX,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,SAAS;AAAA,IACT,QAAQ;AAAA,EACV;AACF;AAQA,IAAM,kCAAkC;AAwBjC,IAAM,kBAAN,MAAsB;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACT,QAAyB,CAAC;AAAA,EAC1B,kBAAiC,QAAQ,QAAQ;AAAA;AAAA;AAAA,EAGjD,wBAAuC,QAAQ,QAAQ;AAAA,EAE/D,YACE,WACA,UAKI,CAAC,GACL;AACA,SAAK,YAAY,KAAK,KAAK,WAAW,SAAS,kBAAkB;AACjE,SAAK,kBAAkB,KAAK,KAAK,WAAW,SAAS,0BAA0B;AAE/E,SAAK,yBAAyB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,0BAA0B,CAAC,CAAC;AACzF,SAAK,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,yBAAyB,CAAC,CAAC;AACvF,SAAK,yBAAyB,QAAQ;AACtC,SAAK,iBACH,QAAQ,mBACP,OAAO,UAAU,YAAY;AAC5B,YAAM,oBAAoB,UAAU,OAAO;AAAA,IAC7C;AAAA,EACJ;AAAA,EAEA,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,WAAW,OAAO;AAClD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,UAAU,OAAO,WAAW,SAAU,MAAK,QAAQ;AAAA,IACzD,QAAQ;AACN,WAAK,QAAQ,CAAC;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,IAAI,YAA+C;AAGjD,WAAO,wBAAwB,KAAK,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/D;AAAA,EAEA,gBAA2C;AACzC,UAAM,YAAY,OAAO,OAAO,KAAK,KAAK;AAC1C,QAAI,UAAU,WAAW,EAAG,QAAO;AAGnC,cAAU,KAAK,CAAC,GAAG,MAAM;AACvB,YAAM,SAAS,EAAE,WAAW,cAAc,EAAE,UAAU;AACtD,UAAI,WAAW,EAAG,QAAO;AACzB,aAAO,EAAE,WAAW,cAAc,EAAE,UAAU;AAAA,IAChD,CAAC;AACD,WAAO,wBAAwB,UAAU,CAAC,KAAK,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,MAoCK;AAChB,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,YAAY,WAAW,QAAQ,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,KAAK;AAMtE,UAAM,eAAmC;AAAA,MACvC,YAAY,KAAK;AAAA,MACjB,YAAY;AAAA,MACZ;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,UAAU,KAAK,MAAM;AAAA,MACrB,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,kBAAkB,KAAK;AAAA,MACvB,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,eAAe,KAAK;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,gBAAgB,KAAK;AAAA,MACrB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,eAAe,KAAK;AAAA,MACpB,uBAAuB,KAAK,mBAAmB;AAAA,MAC/C,uBAAuB,KAAK,mBAAmB;AAAA,MAC/C,4BAA4B,KAAK,mBAAmB;AAAA,MACpD,aAAa,KAAK;AAAA,MAClB,qBACE,KAAK,uBAAuB,KAAK,oBAAoB,SAAS,IAC1D,KAAK,sBACL;AAAA,IACR;AAIA,UAAM,WAAW,wBAAwB,YAAY;AAErD,SAAK,MAAM,KAAK,UAAU,IAAI;AAG9B,UAAM,OAAO,OAAO,KAAK,KAAK,KAAK;AACnC,QAAI,KAAK,SAAS,IAAI;AACpB,YAAM,UAAU,KACb,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,GAAG,cAAc,GAAG,EAAE,EACvD,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAC1C,iBAAW,UAAU,QAAQ,MAAM,EAAE,GAAG;AACtC,eAAO,KAAK,MAAM,OAAO,CAAC;AAAA,MAC5B;AAAA,IACF;AAEA,QAAI;AACF,YAAM,KAAK,WAAW;AAAA,IACxB,SAAS,KAAK;AACZ,UAAI,MAAM,mCAAmC,GAAG,EAAE;AAAA,IACpD;AAEA,QAAI,KAAK,qBAAqB,OAAO;AACnC,YAAM,OAAO,KAAK,UAAU,QAAQ,IAAI;AAKxC,YAAM,UAAU,KAAK,sBAClB,MAAM,MAAM;AAAA,MAAC,CAAC,EACd,KAAK,MAAM,KAAK,2BAA2B,IAAI,CAAC;AACnD,WAAK,wBAAwB;AAC7B,UAAI;AACF,cAAM;AAAA,MACR,SAAS,KAAK;AACZ,YAAI,MAAM,qCAAqC,GAAG,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAY,wBAAgC;AAC1C,WAAO,GAAG,KAAK,eAAe;AAAA,EAChC;AAAA,EAEA,MAAc,gBAAgB,MAA6B;AACzD,UAAM,wBAAwB,KAAK,qBAAqB;AAOxD,UAAM,KAAK,WAAW;AACtB,UAAM,WAAW,KAAK,KAAK,KAAK,uBAAuB,GAAG,EAAE,YAAY;AACxE,UAAM,YAAY,KAAK,KAAK,KAAK,uBAAuB,GAAG,EAAE,QAAQ;AACrE,UAAM,UAAU,UAAU,MAAM,OAAO;AACvC,UAAM,OAAO,UAAU,SAAS;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,kCAAiD;AAC7D,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,SAAS,+BAA+B;AAAA,IAC1C;AACA,eAAW,eAAe,SAAS;AACjC,YAAM,WAAW,YAAY,MAAM,GAAG,CAAC,gCAAgC,MAAM;AAC7E,YAAM,OAAO,aAAa,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,IAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,iCAAgD;AAC5D,UAAM,QAAQ,MAAM,wBAAwB,KAAK,uBAAuB,YAAY;AACpF,eAAW,YAAY,OAAO;AAC5B,UAAI;AACJ,UAAI;AACF,kBAAU,MAAM,SAAS,UAAU,OAAO;AAC1C,mBAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,cAAI,KAAK,KAAK,EAAE,SAAS,EAAG,MAAK,MAAM,IAAI;AAAA,QAC7C;AAAA,MACF,QAAQ;AACN;AAAA,MACF;AACA,YAAM,YAAY,SAAS,MAAM,GAAG,CAAC,OAAO,MAAM;AAClD,YAAM,OAAO,UAAU,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,MAAc,2BAA2B,MAA6B;AACpE,UAAM,MAAM,KAAK,QAAQ,KAAK,eAAe,GAAG,EAAE,WAAW,KAAK,CAAC;AAQnE,UAAM,WAAW,GAAG,KAAK,eAAe;AACxC,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,SAAS,KAAQ,GAAG,KAAK,uBAAuB;AAAA,MAClD,OAAO,aAAa;AAOlB,YAAI,CAAC,UAAU;AACb,cAAI,MAAM,iGAAiG;AAC3G,gBAAM,KAAK,gBAAgB,IAAI;AAC/B;AAAA,QACF;AACA,cAAM,KAAK,gCAAgC,IAAI;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,0BAAkE;AACtE,QAAI,CAAE,MAAM,KAAK,oBAAoB,GAAI;AACvC,aAAO,EAAE,QAAQ,OAAO,iBAAiB,MAAM;AAAA,IACjD;AACA,UAAM,WAAW,GAAG,KAAK,eAAe;AACxC,QAAI,SAAS;AACb,QAAI,eAAe;AACnB,QAAI,eAAe;AACnB,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,SAAS,KAAQ,GAAG,KAAK,uBAAuB;AAAA,MAClD,OAAO,aAAa;AAOlB,YAAI,CAAC,SAAU;AACf,uBAAe;AACf,iBAAS,MAAM,KAAK,gCAAgC,IAAI;AAKxD,uBAAe,MAAM,KAAK,oBAAoB;AAAA,MAChD;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,iBAAiB,CAAC,gBAAgB,aAAa;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAc,gCAAgC,MAAuC;AACnF,UAAM,KAAK,+BAA+B;AAC1C,UAAM,KAAK,gCAAgC;AAC3C,UAAM,aAAa,MAAM,wBAAwB,KAAK,qBAAqB;AAC3E,UAAM,YAAY,SAAS;AAC3B,UAAM,MAAM,KAAK;AACjB,QAAI,aAAa;AACjB,QAAI,MAAM,GAAG;AACX,UAAI;AACF,sBAAc,MAAM,KAAK,KAAK,eAAe,GAAG;AAAA,MAClD,SAAS,KAAK;AACZ,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AAAA,MACzC;AAAA,IACF;AACA,QAAI,QAAQ;AACZ,eAAW,YAAY,YAAY;AACjC,YAAM,UAAU,MAAM,SAAS,UAAU,OAAO;AAChD,YAAM,OAAO,QAAQ,WAAW,KAAK,QAAQ,SAAS,IAAI,IAAI,UAAU,GAAG,OAAO;AAAA;AAClF,YAAM,YAAY,OAAO,WAAW,MAAM,OAAO;AAOjD,UAAI,aAAa,MAAM,KAAK,aAAa,KAAK,aAAa,aAAa,IAAK;AAC7E,YAAM,cAAc,GAAG,QAAQ,GAAG,+BAA+B;AACjE,UAAI;AACF,cAAM,OAAO,UAAU,WAAW;AAAA,MACpC,QAAQ;AACN;AAAA,MACF;AACA,UAAI;AACF,qBAAa,MAAM,KAAK,qBAAqB,MAAM,YAAY,SAAS;AAAA,MAC1E,SAAS,KAAK;AAGZ,cAAM,OAAO,aAAa,QAAQ,EAAE,MAAM,MAAM,MAAS;AACzD,cAAM;AAAA,MACR;AAIA,YAAM,OAAO,WAAW,EAAE,MAAM,MAAM,MAAS;AAC/C,cAAQ;AAAA,IACV;AACA,QAAI,SAAS,MAAM;AACjB,mBAAa,MAAM,KAAK,qBAAqB,MAAM,YAAY,KAAK;AACpE,cAAQ;AAAA,IACV;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAc,qBACZ,MACA,YACA,WACiB;AACjB,UAAM,MAAM,KAAK;AACjB,UAAM,YAAY,OAAO,WAAW,MAAM,OAAO;AACjD,QAAI,MAAM,KAAK,CAAC,aAAa,aAAa,KAAK,aAAa,aAAa,KAAK;AAC5E,UAAI;AACF,cAAM,KAAK,wBAAwB;AACnC,qBAAa;AAAA,MACf,SAAS,KAAK;AACZ,YAAI,MAAM,0DAA0D,GAAG,EAAE;AAAA,MAC3E;AAAA,IACF;AACA,UAAM,WAAW,KAAK,iBAAiB,MAAM,OAAO;AACpD,WAAO,aAAa;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,sBAAwC;AACpD,SAAK,MAAM,wBAAwB,KAAK,uBAAuB,YAAY,GAAG,SAAS,GAAG;AACxF,aAAO;AAAA,IACT;AACA,UAAM,aAAa,MAAM,wBAAwB,KAAK,qBAAqB;AAC3E,QAAI,WAAW,SAAS,EAAG,QAAO;AAClC,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,SAAS,+BAA+B;AAAA,IAC1C;AACA,WAAO,QAAQ,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,0BAAyC;AACrD,UAAM,OAAO,KAAK;AAGlB,QAAI;AACF,YAAM,GAAG,GAAG,KAAK,eAAe,IAAI,IAAI,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,IAC7D,QAAQ;AAAA,IAER;AACA,aAAS,IAAI,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG;AACrC,UAAI;AACF,cAAM,OAAO,GAAG,KAAK,eAAe,IAAI,CAAC,IAAI,GAAG,KAAK,eAAe,IAAI,IAAI,CAAC,EAAE;AAAA,MACjF,SAAS,KAAK;AACZ,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AAAA,MACzC;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,KAAK,iBAAiB,GAAG,KAAK,eAAe,IAAI;AAAA,IAChE,SAAS,KAAK;AACZ,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,oBACJ,YACA,aACA,UACe;AACf,UAAM,UAAU,KAAK,MAAM,UAAU;AACrC,QAAI,CAAC,QAAS;AACd,QAAI,CAAC,gCAAgC,SAAS,QAAQ,EAAG;AACzD,SAAK,MAAM,UAAU,IAAI;AAAA,MACvB,GAAG;AAAA,MACH,aAAa,iBAAiB,WAAW;AAAA,IAC3C;AACA,QAAI;AACF,YAAM,KAAK,WAAW;AAAA,IACxB,SAAS,KAAK;AACZ,UAAI,MAAM,6CAA6C,GAAG,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA,EAGQ,aAA4B;AAClC,UAAM,MAAM,KAAK,gBAAgB,MAAM,MAAM,MAAS,EAAE,KAAK,YAAY;AACvE,YAAM,MAAM,KAAK,QAAQ,KAAK,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,YAAM,KAAK,eAAe,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,MAAM,CAAC,CAAC;AAAA,IAC/E,CAAC;AACD,SAAK,kBAAkB,IAAI;AAAA,MACzB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AACF;AAEO,IAAM,2BAAN,MAA+B;AAAA,EACnB;AAAA,EACT,QAAqC,gBAAgB,6BAA6B;AAAA,EAE1F,YAAY,WAAmB;AAC7B,SAAK,YAAY,KAAK,KAAK,WAAW,SAAS,4BAA4B;AAAA,EAC7E;AAAA,EAEA,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,WAAW,OAAO;AAClD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,aAAK,QAAQ,gBAAgB,6BAA6B;AAC1D;AAAA,MACF;AACA,YAAM,SAAS,OAAO,UAAU,OAAO,OAAO,WAAW,WACrD,OAAO,SACP,8BAA8B;AAClC,WAAK,QAAQ;AAAA,QACX,WACE,OAAO,OAAO,cAAc,YAAY,OAAO,UAAU,SAAS,IAC9D,OAAO,YACP,8BAA8B;AAAA,QACpC,WACE,OAAO,aAAa,OAAO,OAAO,cAAc,WAC3C,OAAO,YACR;AAAA,QACN,QAAQ;AAAA,UACN,QAAQ,OAAO,OAAO,WAAW,YAAY,OAAO,SAAS,OAAO,MAAM,IAAI,OAAO,SAAS;AAAA,UAC9F,SAAS,OAAO,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,OAAO,IAAI,OAAO,UAAU;AAAA,UAClG,UAAU,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,OAAO,QAAQ,IAAI,OAAO,WAAW;AAAA,UACtG,UAAU,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,OAAO,QAAQ,IAAI,OAAO,WAAW;AAAA,UACtG,SAAS,OAAO,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,OAAO,IAAI,OAAO,UAAU;AAAA,UAClG,QAAQ,OAAO,OAAO,WAAW,YAAY,OAAO,SAAS,OAAO,MAAM,IAAI,OAAO,SAAS;AAAA,QAChG;AAAA,MACF;AAAA,IACF,QAAQ;AACN,WAAK,QAAQ,gBAAgB,6BAA6B;AAAA,IAC5D;AAAA,EACF;AAAA,EAEA,MAAmC;AACjC,WAAO;AAAA,MACL,WAAW,KAAK,MAAM;AAAA,MACtB,WAAW,KAAK,MAAM,YAAY,EAAE,GAAG,KAAK,MAAM,UAAU,IAAI;AAAA,MAChE,QAAQ,EAAE,GAAG,KAAK,MAAM,OAAO;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,SAAmD;AACnE,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,gBAAgB,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,QAAQ;AACvE,UAAM,gBAAgB,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,QAAQ;AACvE,UAAM,eAAe,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,OAAO;AACrE,UAAM,OAAoC;AAAA,MACxC,WAAW;AAAA,MACX,WAAW,EAAE,GAAG,QAAQ;AAAA,MACxB,QAAQ;AAAA,QACN,QAAQ,KAAK,MAAM,OAAO,SAAS;AAAA,QACnC,SAAS,KAAK,MAAM,OAAO,UAAU,KAAK,IAAI,GAAG,QAAQ,OAAO;AAAA,QAChE,UAAU,KAAK,MAAM,OAAO,WAAW;AAAA,QACvC,UAAU,KAAK,MAAM,OAAO,WAAW;AAAA,QACvC,SAAS,KAAK,MAAM,OAAO,UAAU;AAAA,QACrC,QAAQ,KAAK,MAAM,OAAO,SAAS,KAAK,IAAI,GAAG,QAAQ,cAAc,CAAC;AAAA,MACxE;AAAA,IACF;AACA,SAAK,QAAQ;AACb,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,KAAK,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,YAAM,UAAU,KAAK,WAAW,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,OAAO;AAAA,IACxE,SAAS,KAAK;AACZ,UAAI,MAAM,uCAAuC,GAAG,EAAE;AAAA,IACxD;AAAA,EACF;AACF;AAeO,IAAM,2BAAN,MAA+B;AAAA,EACnB;AAAA,EACA;AAAA,EACT,QAA8D,CAAC;AAAA,EAC/D,aAA4B,QAAQ,QAAQ;AAAA,EACnC;AAAA,EAEjB,YAAY,WAAmB,UAAmE,CAAC,GAAG;AACpG,SAAK,YAAY,KAAK,KAAK,WAAW,SAAS,qBAAqB;AACpE,SAAK,iBACH,QAAQ,mBACP,OAAO,UAAU,YAAY;AAC5B,YAAM,oBAAoB,UAAU,OAAO;AAAA,IAC7C;AACF,SAAK,WACH,OAAO,QAAQ,aAAa,YAAY,OAAO,SAAS,QAAQ,QAAQ,IACpE,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC,IACtD;AAAA,EACR;AAAA,EAEA,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,WAAW,OAAO;AAClD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,UAAU,OAAO,WAAW,SAAU,MAAK,QAAQ;AAAA,IACzD,QAAQ;AACN,WAAK,QAAQ,CAAC;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,YAAoB,WAA6C;AAC5E,QAAI,CAAC,WAAY;AACjB,UAAM,MAAM,UAAU,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAC1F,UAAM,QAAQ,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,IAAI;AAClD,UAAM,QAAQ,KAAK,MAAM,UAAU,KAAK,CAAC;AACzC,UAAM,OAAO,CAAC,OAAO,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,QAAQ;AACrD,SAAK,MAAM,UAAU,IAAI;AACzB,SAAK,YAAY;AACjB,QAAI;AACF,YAAM,KAAK,MAAM;AAAA,IACnB,SAAS,KAAK;AACZ,UAAI,MAAM,uCAAuC,GAAG,EAAE;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,YAAoB,QAAgB,KAAK,UAAoC;AAClF,UAAM,UAAU,KAAK,MAAM,UAAU;AACrC,QAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO,CAAC;AAC9C,UAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,OAAO,QAAQ,MAAM,CAAC;AACzD,WAAO,QAAQ,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,EACjD;AAAA;AAAA,EAGA,eAAqB;AACnB,SAAK,QAAQ,CAAC;AAAA,EAChB;AAAA,EAEQ,cAAoB;AAC1B,UAAM,OAAO,OAAO,KAAK,KAAK,KAAK;AACnC,QAAI,KAAK,UAAU,GAAI;AACvB,UAAM,UAAU,KACb,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,EAAE,EACpD,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAC1C,eAAW,UAAU,QAAQ,MAAM,EAAE,GAAG;AACtC,aAAO,KAAK,MAAM,OAAO,CAAC;AAAA,IAC5B;AAAA,EACF;AAAA,EAEQ,QAAuB;AAC7B,UAAM,MAAM,KAAK,WAAW,MAAM,MAAM,MAAS,EAAE,KAAK,YAAY;AAClE,YAAM,MAAM,KAAK,QAAQ,KAAK,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,YAAM,KAAK,eAAe,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,MAAM,CAAC,CAAC;AAAA,IAC/E,CAAC;AACD,SAAK,aAAa,IAAI,KAAK,MAAM,QAAW,MAAM,MAAS;AAC3D,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-FQC3DHH2.js

@@ -0,0 +1,20 @@
+import {
+  composeMemoryEnvelope
+} from "./chunk-CGASUJVP.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
+
+// src/salvage-envelope.ts
+function composeSalvagedEnvelope(label, input, ctx) {
+  const envelope = composeMemoryEnvelope(input, ctx, { salvage: true });
+  if (envelope.salvageNotes.length > 0) {
+    log.warn(`${label} write salvaged invalid fields: ${envelope.salvageNotes.join("; ")}`);
+  }
+  return envelope;
+}
+
+export {
+  composeSalvagedEnvelope
+};
+//# sourceMappingURL=chunk-FQC3DHH2.js.map

package/dist/chunk-FQC3DHH2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/salvage-envelope.ts"],"sourcesContent":["import {\n  composeMemoryEnvelope,\n  type MemoryWriteInput,\n  type SealedMemoryEnvelope,\n  type WriteContext,\n} from \"./write-envelope.js\";\nimport { log } from \"./logger.js\";\n\n/**\n * Shared salvage-compose helper for MACHINE-GENERATED or replayed-from-store\n * write input (issue #1989 PR4): one malformed optional field must not abort\n * the surrounding batch/action, and every drop is warn-logged with the\n * caller's label — visible, never silent (rule 34).\n *\n * Operator/system-built input must NOT use this — compose strict so caller\n * bugs surface (see AGENTS.md \"Sealed memory-write envelope\").\n */\nexport function composeSalvagedEnvelope(\n  label: string,\n  input: MemoryWriteInput,\n  ctx: WriteContext,\n): SealedMemoryEnvelope {\n  const envelope = composeMemoryEnvelope(input, ctx, { salvage: true });\n  if (envelope.salvageNotes.length > 0) {\n    log.warn(`${label} write salvaged invalid fields: ${envelope.salvageNotes.join(\"; \")}`);\n  }\n  return envelope;\n}\n"],"mappings":";;;;;;;;AAiBO,SAAS,wBACd,OACA,OACA,KACsB;AACtB,QAAM,WAAW,sBAAsB,OAAO,KAAK,EAAE,SAAS,KAAK,CAAC;AACpE,MAAI,SAAS,aAAa,SAAS,GAAG;AACpC,QAAI,KAAK,GAAG,KAAK,mCAAmC,SAAS,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,EACxF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-G4CN3ZXL.js → chunk-FUTF72MJ.js}

@@ -1,38 +1,38 @@
+import {
+  RemoteSearchBackend
+} from "./chunk-3Y224NYC.js";
+import {
+  EmbedHelper
+} from "./chunk-ANEUPF6O.js";
 import {
   LanceDbBackend
-} from "./chunk-74F5STS4.js";
+} from "./chunk-BLAKS3CP.js";
 import {
   MeilisearchBackend
-} from "./chunk-FNZQGN76.js";
+} from "./chunk-S2BBISHU.js";
 import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
 import {
   OramaBackend
-} from "./chunk-DZKHSDOM.js";
-import {
-  RemoteSearchBackend
-} from "./chunk-LRNMRXJO.js";
-import {
-  EmbedHelper
-} from "./chunk-FNMFJWBY.js";
+} from "./chunk-ES36HTSC.js";
 import {
   createConversationIndexBackend
-} from "./chunk-JI5AVXYO.js";
+} from "./chunk-LEPOP46W.js";
 import {
   FaissConversationIndexAdapter
-} from "./chunk-TN7THW5U.js";
+} from "./chunk-ET356KSB.js";
 import {
   QmdClient
-} from "./chunk-DYP3YYJJ.js";
+} from "./chunk-QJAQNXWI.js";
 import {
   resolveIndexingCapabilities,
   resolvePipelineProcessingCapabilities,
   resolveQmdCapabilities
-} from "./chunk-BFPETA3S.js";
+} from "./chunk-SCCO46KZ.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/search/factory.ts
 import path from "path";
@@ -175,4 +175,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-G4CN3ZXL.js.map
+//# sourceMappingURL=chunk-FUTF72MJ.js.map

package/dist/chunk-GCASGYIO.js

@@ -0,0 +1,71 @@
+import {
+  isErrnoCode
+} from "./chunk-5UZXUTVO.js";
+
+// src/utils/path-containment.ts
+import path from "path";
+import { lstat, mkdir, readdir, realpath } from "fs/promises";
+function pathIsInside(parent, child) {
+  const relative = path.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function assertPathInsideRoot(rootReal, candidateReal, originalPath) {
+  if (!pathIsInside(rootReal, candidateReal)) {
+    throw new Error(`Refusing to scan memory path outside memoryDir: ${originalPath}`);
+  }
+}
+async function listContainedSpillFiles(dir, suffix = ".jsonl") {
+  let dirReal;
+  try {
+    const dirStat = await lstat(dir);
+    if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) return [];
+    dirReal = await realpath(dir);
+  } catch (err) {
+    if (isErrnoCode(err, "ENOENT")) return [];
+    throw err;
+  }
+  let names;
+  try {
+    names = (await readdir(dir)).filter((name) => name.endsWith(suffix)).sort();
+  } catch (err) {
+    if (isErrnoCode(err, "ENOENT")) return [];
+    throw err;
+  }
+  const files = [];
+  for (const name of names) {
+    const filePath = path.join(dir, name);
+    let entryStat;
+    try {
+      entryStat = await lstat(filePath);
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) continue;
+      throw err;
+    }
+    if (entryStat.isSymbolicLink() || !entryStat.isFile()) continue;
+    let entryReal;
+    try {
+      entryReal = await realpath(filePath);
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) continue;
+      throw err;
+    }
+    if (!pathIsInside(dirReal, entryReal)) continue;
+    files.push(filePath);
+  }
+  return files;
+}
+async function ensureContainedSpillDir(dir) {
+  await mkdir(dir, { recursive: true });
+  const dirStat = await lstat(dir);
+  if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) {
+    throw new Error(`Refusing to write spill file into symlinked or non-directory path: ${dir}`);
+  }
+}
+
+export {
+  pathIsInside,
+  assertPathInsideRoot,
+  listContainedSpillFiles,
+  ensureContainedSpillDir
+};
+//# sourceMappingURL=chunk-GCASGYIO.js.map

package/dist/chunk-GCASGYIO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/path-containment.ts"],"sourcesContent":["/**\n * @remnic/core — Path Containment Guards\n *\n * Shared symlink/traversal containment helpers for filesystem walkers that\n * scan the memory store. Extracted from search/document-scanner.ts so every\n * walker (the search index scanner, the CLI dedupe walker, ...) enforces the\n * SAME containment semantics instead of forking the check (CLAUDE.md rule 22).\n *\n * Both helpers operate on realpath()-resolved absolute paths: callers resolve\n * symlinks first, then assert the resolved target is still inside the (also\n * realpath-resolved) memory root. This blocks a symlinked category directory\n * (e.g. decisions/ → /etc) from redirecting a scan — or a destructive dedupe\n * unlink — outside the memory store.\n */\n\nimport path from \"node:path\";\nimport { lstat, mkdir, readdir, realpath } from \"node:fs/promises\";\nimport { isErrnoCode } from \"./errno.js\";\n\n/**\n * True when `child` is `parent` itself or nested underneath it. Both arguments\n * must already be resolved (realpath) absolute paths.\n */\nexport function pathIsInside(parent: string, child: string): boolean {\n  const relative = path.relative(parent, child);\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n\n/**\n * Throw if the realpath-resolved `candidateReal` escapes `rootReal`. The\n * message references the original (pre-realpath) path so operators can locate\n * the offending symlink/entry.\n */\nexport function assertPathInsideRoot(\n  rootReal: string,\n  candidateReal: string,\n  originalPath: string,\n): void {\n  if (!pathIsInside(rootReal, candidateReal)) {\n    throw new Error(`Refusing to scan memory path outside memoryDir: ${originalPath}`);\n  }\n}\n\n/**\n * List the regular-file children of `dir` whose name ends in `suffix` (default\n * `.jsonl`) in sorted name order as absolute paths, rejecting a symlinked/\n * non-directory `dir` and skipping any entry that is a symlink or whose realpath\n * escapes `dir`. Returns `[]` when the directory is absent or cannot be safely\n * enumerated. Used by the durable pending-spill drains (lifecycle ledger +\n * recall impressions, #2033) so a poisoned link planted in a spill directory\n * cannot redirect a secure read — or a later unlink — outside that directory.\n * The `suffix` override lets the lifecycle drain enumerate crash-orphaned\n * `*.jsonl.claimed` files with the SAME containment guard as live spills.\n */\nexport async function listContainedSpillFiles(dir: string, suffix = \".jsonl\"): Promise<string[]> {\n  let dirReal: string;\n  try {\n    const dirStat = await lstat(dir);\n    if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) return [];\n    dirReal = await realpath(dir);\n  } catch (err) {\n    if (isErrnoCode(err, \"ENOENT\")) return [];\n    throw err;\n  }\n  let names: string[];\n  try {\n    names = (await readdir(dir)).filter((name) => name.endsWith(suffix)).sort();\n  } catch (err) {\n    if (isErrnoCode(err, \"ENOENT\")) return [];\n    throw err;\n  }\n  const files: string[] = [];\n  for (const name of names) {\n    const filePath = path.join(dir, name);\n    let entryStat;\n    try {\n      entryStat = await lstat(filePath);\n    } catch (err) {\n      if (isErrnoCode(err, \"ENOENT\")) continue; // vanished between readdir and lstat\n      throw err;\n    }\n    // Reject a symlinked entry or one whose real target escapes the spill dir\n    // BEFORE any secure read/delete: a poisoned link must never redirect a\n    // decrypt or a later unlink outside the directory (#2033).\n    if (entryStat.isSymbolicLink() || !entryStat.isFile()) continue;\n    let entryReal: string;\n    try {\n      entryReal = await realpath(filePath);\n    } catch (err) {\n      if (isErrnoCode(err, \"ENOENT\")) continue;\n      throw err;\n    }\n    if (!pathIsInside(dirReal, entryReal)) continue;\n    files.push(filePath);\n  }\n  return files;\n}\n\n/**\n * Create `dir` (recursively, if absent) and assert it is a REAL directory —\n * never a symlink — BEFORE any spill file is written into it (#2033). This\n * mirrors the lstat guard {@link listContainedSpillFiles} applies on the read\n * side so the durable-spill WRITE and its later drain enforce the SAME\n * symlink-safe containment: a symlink planted at the spill-directory path (e.g.\n * `<ledger>.pending.d` -> /etc) cannot redirect a write/rename/unlink outside\n * the intended location. `mkdir` recursive is a no-op when the path already\n * resolves through a symlink, so the post-mkdir lstat is what actually refuses\n * the poisoned link. Throws on a symlinked or non-directory target.\n */\nexport async function ensureContainedSpillDir(dir: string): Promise<void> {\n  await mkdir(dir, { recursive: true });\n  const dirStat = await lstat(dir);\n  if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) {\n    throw new Error(`Refusing to write spill file into symlinked or non-directory path: ${dir}`);\n  }\n}\n"],"mappings":";;;;;AAeA,OAAO,UAAU;AACjB,SAAS,OAAO,OAAO,SAAS,gBAAgB;AAOzC,SAAS,aAAa,QAAgB,OAAwB;AACnE,QAAM,WAAW,KAAK,SAAS,QAAQ,KAAK;AAC5C,SAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AACpF;AAOO,SAAS,qBACd,UACA,eACA,cACM;AACN,MAAI,CAAC,aAAa,UAAU,aAAa,GAAG;AAC1C,UAAM,IAAI,MAAM,mDAAmD,YAAY,EAAE;AAAA,EACnF;AACF;AAaA,eAAsB,wBAAwB,KAAa,SAAS,UAA6B;AAC/F,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG;AAC/B,QAAI,QAAQ,eAAe,KAAK,CAAC,QAAQ,YAAY,EAAG,QAAO,CAAC;AAChE,cAAU,MAAM,SAAS,GAAG;AAAA,EAC9B,SAAS,KAAK;AACZ,QAAI,YAAY,KAAK,QAAQ,EAAG,QAAO,CAAC;AACxC,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAAA,EAC5E,SAAS,KAAK;AACZ,QAAI,YAAY,KAAK,QAAQ,EAAG,QAAO,CAAC;AACxC,UAAM;AAAA,EACR;AACA,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,KAAK,KAAK,KAAK,IAAI;AACpC,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,MAAM,QAAQ;AAAA,IAClC,SAAS,KAAK;AACZ,UAAI,YAAY,KAAK,QAAQ,EAAG;AAChC,YAAM;AAAA,IACR;AAIA,QAAI,UAAU,eAAe,KAAK,CAAC,UAAU,OAAO,EAAG;AACvD,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,QAAQ;AAAA,IACrC,SAAS,KAAK;AACZ,UAAI,YAAY,KAAK,QAAQ,EAAG;AAChC,YAAM;AAAA,IACR;AACA,QAAI,CAAC,aAAa,SAAS,SAAS,EAAG;AACvC,UAAM,KAAK,QAAQ;AAAA,EACrB;AACA,SAAO;AACT;AAaA,eAAsB,wBAAwB,KAA4B;AACxE,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAM,UAAU,MAAM,MAAM,GAAG;AAC/B,MAAI,QAAQ,eAAe,KAAK,CAAC,QAAQ,YAAY,GAAG;AACtD,UAAM,IAAI,MAAM,sEAAsE,GAAG,EAAE;AAAA,EAC7F;AACF;","names":[]}

package/dist/{chunk-HF77M34J.js → chunk-GFPZS3F5.js}

@@ -1,10 +1,10 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-3IY64MV6.js";
+} from "./chunk-44XZ75OQ.js";
 import {
   getConfiguredNamespaces
-} from "./chunk-7PND4PUC.js";
+} from "./chunk-MMGGVZ4Q.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken,
@@ -13,20 +13,20 @@ import {
 import {
   MutationSerializer,
   withHeldFileLock
-} from "./chunk-LTJAMRGI.js";
+} from "./chunk-WL5EBRDH.js";
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
+import {
+  ALL_CATEGORY_DIRS
+} from "./chunk-VS2IYZRU.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
 import {
   resolveConversationContextCapabilities,
   resolveNamespaceCapabilities
-} from "./chunk-BFPETA3S.js";
-import {
-  ALL_CATEGORY_DIRS
-} from "./chunk-VS2IYZRU.js";
+} from "./chunk-SCCO46KZ.js";
 
 // src/namespaces/catalog.ts
 import path from "path";
@@ -2204,4 +2204,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-HF77M34J.js.map
+//# sourceMappingURL=chunk-GFPZS3F5.js.map

package/dist/{chunk-BCDKBDSY.js → chunk-GNVZQ5JN.js}

@@ -7,6 +7,12 @@ import {
 } from "./chunk-IISBCCWR.js";
 
 // src/trust-score-stage.ts
+function trustResultKey(result) {
+  return JSON.stringify([result.namespace ?? "", result.path]);
+}
+function trustResultFor(trustByPath, result) {
+  return trustByPath.get(trustResultKey(result)) ?? trustByPath.get(result.path);
+}
 function buildTrustSignalMap(memories, now, options = {}) {
   const map = /* @__PURE__ */ new Map();
   const nowMs = now.getTime();
@@ -62,7 +68,7 @@ function applyTrustScoreStage(candidates, options) {
   const quarantined = [];
   for (let i = 0; i < candidates.length; i += 1) {
     const c = candidates[i];
-    const signals = options.signals.get(c.path);
+    const signals = options.signals.get(c.key ?? c.path) ?? options.signals.get(c.path);
     const trust = computeTrustScore(signals, options.weights);
     const isQuarantined = quarantine && trust.band === "quarantine";
     const multiplier = isQuarantined ? 1 : trustMultiplier(trust.score, minMul, maxMul);
@@ -70,6 +76,7 @@ function applyTrustScoreStage(candidates, options) {
     const scored = safeBase * multiplier;
     const item = {
       path: c.path,
+      ...c.key === void 0 ? {} : { key: c.key },
       score: scored,
       originalScore: c.score,
       multiplier,
@@ -107,67 +114,118 @@ function explainQuarantine(trust) {
   if (c.contradiction && c.contradiction.value <= 0.2) return "contradiction: pending review";
   return "hard-negative trust signal";
 }
-async function buildTrustSignalsForRerank(candidatePaths, namespaces, deps, signalCache, now, options = {}) {
-  const nowMs = now.getTime();
+var TRUST_SIGNAL_CACHE_MAX_AGE_MS = 3e5;
+var TRUST_SIGNAL_CACHE_MAX_NAMESPACES = 64;
+function capTrustSignalCache(cache, max) {
+  while (cache.size > max) {
+    const oldest = cache.keys().next().value;
+    if (oldest === void 0) break;
+    cache.delete(oldest);
+  }
+}
+async function buildTrustSignalsForRerank(candidates, namespaces, deps, signalCache, now, options = {}) {
   const logDebug = options.logDebug ?? (() => {
   });
   const signals = /* @__PURE__ */ new Map();
-  for (const [key, entry] of signalCache.cache) {
-    if (nowMs - entry.at >= signalCache.ttlMs) signalCache.cache.delete(key);
-  }
-  const seenNamespaces = /* @__PURE__ */ new Set();
-  for (const ns of namespaces) {
-    if (seenNamespaces.has(ns)) continue;
-    seenNamespaces.add(ns);
-    try {
-      const cached = signalCache.cache.get(ns);
-      let nsMap;
-      if (cached && nowMs - cached.at < signalCache.ttlMs) {
-        nsMap = cached.signals;
-      } else {
-        const memories = await deps.readNamespaceMemories(ns);
-        nsMap = buildTrustSignalMap(memories, now, {
-          recencyHalfLifeDays: options.recencyHalfLifeDays
-        });
-        signalCache.cache.set(ns, { at: nowMs, signals: nsMap });
-      }
-      for (const [path, s] of nsMap) signals.set(path, s);
-    } catch (err) {
-      logDebug("trust-score: failed to read namespace, skipping", {
-        namespace: ns,
-        error: err.message
-      });
+  const corpusFallbackEnabled = options.corpusFallbackEnabled ?? true;
+  const halfLife = { recencyHalfLifeDays: options.recencyHalfLifeDays };
+  const preloadedKeys = /* @__PURE__ */ new Set();
+  const normalized = candidates.map(
+    (c) => typeof c === "string" ? { path: c, signalKey: c, lookupKey: c, namespace: void 0 } : {
+      path: c.path,
+      signalKey: c.signalKey ?? c.path,
+      lookupKey: c.lookupKey ?? c.path,
+      namespace: c.namespace
+    }
+  );
+  if (options.preloadedFrontmatter) {
+    const preloaded = [];
+    for (const c of normalized) {
+      const mem = options.preloadedFrontmatter.get(c.lookupKey) ?? options.preloadedFrontmatter.get(c.path);
+      if (!mem) continue;
+      preloadedKeys.add(c.signalKey);
+      preloaded.push({ path: c.signalKey, frontmatter: mem.frontmatter });
+    }
+    if (preloaded.length > 0) {
+      const seeded = buildTrustSignalMap(preloaded, now, halfLife);
+      for (const [key, s] of seeded) signals.set(key, s);
     }
   }
-  const missing = candidatePaths.filter((p) => !signals.has(p));
-  if (missing.length > 0) {
-    const fallbackMemories = [];
-    for (const path of missing) {
+  if (corpusFallbackEnabled) {
+    const seenNamespaces = /* @__PURE__ */ new Set();
+    for (const ns of namespaces) {
+      if (options.abortSignal?.aborted) break;
+      if (seenNamespaces.has(ns)) continue;
+      seenNamespaces.add(ns);
+      if (normalized.every((c) => signals.has(c.signalKey) || preloadedKeys.has(c.signalKey))) break;
       try {
-        const frontmatter = await deps.readMemoryFrontmatter(path);
-        if (frontmatter) fallbackMemories.push({ path, frontmatter });
+        const version = await deps.getNamespaceVersion(ns);
+        const cached = signalCache.cache.get(ns);
+        const nowMs = now.getTime();
+        let nsMap;
+        if (cached && cached.version === version && nowMs - cached.cachedAt < TRUST_SIGNAL_CACHE_MAX_AGE_MS) {
+          nsMap = cached.signals;
+        } else {
+          const memories = await deps.readNamespaceMemories(ns);
+          nsMap = buildTrustSignalMap(memories, now, halfLife);
+          signalCache.cache.set(ns, { version, cachedAt: nowMs, signals: nsMap });
+          capTrustSignalCache(signalCache.cache, TRUST_SIGNAL_CACHE_MAX_NAMESPACES);
+        }
+        for (const c of normalized) {
+          if (signals.has(c.signalKey) || preloadedKeys.has(c.signalKey)) continue;
+          if (c.namespace !== void 0 && c.namespace !== ns) continue;
+          const s = nsMap.get(c.path);
+          if (s) signals.set(c.signalKey, s);
+        }
       } catch (err) {
-        logDebug("trust-score: direct path lookup failed", {
-          path,
+        logDebug("trust-score: failed to read namespace, skipping", {
+          namespace: ns,
           error: err.message
         });
       }
     }
+  }
+  const missing = normalized.filter(
+    (c) => !signals.has(c.signalKey) && !preloadedKeys.has(c.signalKey)
+  );
+  if (missing.length > 0) {
+    const fallbackMemories = [];
+    const BATCH = 16;
+    for (let off = 0; off < missing.length; off += BATCH) {
+      if (options.abortSignal?.aborted) break;
+      const batch = await Promise.all(
+        missing.slice(off, off + BATCH).map(async (c) => {
+          try {
+            const frontmatter = await deps.readMemoryFrontmatter(c.path, c.namespace);
+            return frontmatter ? { path: c.signalKey, frontmatter } : null;
+          } catch (err) {
+            logDebug("trust-score: direct path lookup failed", {
+              path: c.path,
+              error: err.message
+            });
+            return null;
+          }
+        })
+      );
+      for (const item of batch) if (item) fallbackMemories.push(item);
+    }
     if (fallbackMemories.length > 0) {
-      const fallbackSignals = buildTrustSignalMap(fallbackMemories, now, {
-        recencyHalfLifeDays: options.recencyHalfLifeDays
-      });
-      for (const [path, s] of fallbackSignals) signals.set(path, s);
+      const fallbackSignals = buildTrustSignalMap(fallbackMemories, now, halfLife);
+      for (const [key, s] of fallbackSignals) signals.set(key, s);
     }
   }
   return signals;
 }
 
 export {
+  trustResultKey,
+  trustResultFor,
   buildTrustSignalMap,
   applyTrustScoreStage,
   projectTrustForXray,
   explainQuarantine,
+  TRUST_SIGNAL_CACHE_MAX_AGE_MS,
+  TRUST_SIGNAL_CACHE_MAX_NAMESPACES,
   buildTrustSignalsForRerank
 };
-//# sourceMappingURL=chunk-BCDKBDSY.js.map
+//# sourceMappingURL=chunk-GNVZQ5JN.js.map

package/dist/chunk-GNVZQ5JN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/trust-score-stage.ts"],"sourcesContent":["import type { QmdSearchResult } from \"./types.js\";\n\n/** Stable key for a recall result whose path may repeat across namespaces. */\nexport function trustResultKey(result: Pick<QmdSearchResult, \"path\" | \"namespace\">): string {\n  return JSON.stringify([result.namespace ?? \"\", result.path]);\n}\n\n/** Read trust metadata while accepting pre-namespace path-only maps. */\nexport function trustResultFor(\n  trustByPath: ReadonlyMap<string, TrustStageResultItem>,\n  result: Pick<QmdSearchResult, \"path\" | \"namespace\">,\n): TrustStageResultItem | undefined {\n  return trustByPath.get(trustResultKey(result)) ?? trustByPath.get(result.path);\n}\n\n/**\n * trust-score-stage.ts — signal adapters + recall pipeline stage (issue #1577 PR 2).\n *\n * This module sits between the pure {@link computeTrustScore} scorer and the\n * recall pipeline. It owns TWO jobs:\n *\n *   1. **Signal adapters** — read each trust signal via existing readers only\n *      (`buildMemoryWorthCounterMap`-style frontmatter scan, faithfulness /\n *      provenance / sources frontmatter from #1575/#1576). No new disk format,\n *      no new write path. Expensive / optional signals (belief-ledger domain\n *      calibration, contradiction review queue) are extension points that\n *      return `undefined` when unwired — the scorer degrades to neutral for\n *      any absent signal (rule 34).\n *\n *   2. **The recall stage** — apply `trustMultiplier(trust.score)` to each\n *      candidate, exclude `quarantine`-band items from injection, and surface\n *      the per-result `{ score, band, components }` so X-ray and the epistemic\n *      renderer can explain the basis.\n *\n * Mutual exclusion with the Memory Worth filter (rule 39 — one multiplier, one\n * application point): when this stage runs, the standalone memory-worth filter\n * MUST NOT also run. The orchestrator enforces that at the wiring site\n * (`if (caps.recallTrustScore) … else if (caps.recallMemoryWorthFilter) …`);\n * the `double-multiplier` test below pins it structurally.\n */\n\nimport { computeMemoryWorth } from \"./memory-worth.js\";\nimport {\n  computeTrustScore,\n  trustMultiplier,\n  type TrustBand,\n  type TrustScoreComponent,\n  type TrustScoreResult,\n  type TrustSignals,\n  type TrustWeights,\n} from \"./trust-score.js\";\nimport type { FaithfulnessFrontmatter, ProvenanceSource } from \"./types.js\";\n\n/**\n * Frontmatter projection the adapter reads. Kept narrow + structural so it can\n * be fed from a `MemoryFrontmatter`, a bench fixture, or a test stub without\n * pulling the full frontmatter type graph into the stage module.\n */\nexport interface TrustFrontmatterProjection {\n  mw_success?: number;\n  mw_fail?: number;\n  lastAccessed?: string | null;\n  provenance?: \"verified\" | \"unverified\" | \"none\";\n  faithfulness?: FaithfulnessFrontmatter;\n  sources?: ProvenanceSource[];\n  /** Optional ISO creation/observation timestamp used for recency. */\n  observedAt?: string;\n}\n\n/**\n * Build a `path → TrustSignals` map from an in-memory frontmatter scan. The\n * caller passes the memories already read for the memory-worth counter map so\n * we do not re-read the namespace. Pure: no I/O, takes `now` explicitly.\n */\nexport function buildTrustSignalMap(\n  memories: ReadonlyArray<{ path: string; frontmatter: TrustFrontmatterProjection }>,\n  now: Date,\n  options: { recencyHalfLifeDays?: number } = {},\n): Map<string, TrustSignals> {\n  const map = new Map<string, TrustSignals>();\n  const nowMs = now.getTime();\n  const nowUsable = Number.isFinite(nowMs);\n  for (const m of memories) {\n    const fm = m.frontmatter;\n    const signals: TrustSignals = {};\n\n    // Memory worth — reuse the exact Laplace computation the standalone filter\n    // uses so the two never disagree on the same counters.\n    if (fm.mw_success !== undefined || fm.mw_fail !== undefined) {\n      // Pass the half-life through so outcome counters decay at the same\n      // rate as the standalone memory-worth filter (review P2: TrustScore\n      // subsumes the filter, so decay must not be lost). Convert days → ms.\n      const halfLifeMs =\n        options.recencyHalfLifeDays !== undefined\n          ? options.recencyHalfLifeDays * 86_400_000\n          : undefined;\n      const worth = computeMemoryWorth({\n        mw_success: fm.mw_success,\n        mw_fail: fm.mw_fail,\n        lastAccessed: fm.lastAccessed,\n        now,\n        halfLifeMs,\n      });\n      signals.memoryWorth = { score: worth.score, confidence: worth.confidence };\n    }\n\n    if (fm.provenance !== undefined) signals.provenance = fm.provenance;\n    if (fm.faithfulness !== undefined) {\n      // `skipped_no_span` (legacy fact lacking a verified source span) carries\n      // no entailment signal — collapse it to `unchecked` so the scorer treats\n      // it as the neutral \"no verdict\" case rather than a hard negative.\n      signals.faithfulness =\n        fm.faithfulness.verdict === \"skipped_no_span\" ? \"unchecked\" : fm.faithfulness.verdict;\n    }\n\n    // Corroboration = distinct source sessions/turns backing the fact.\n    if (Array.isArray(fm.sources) && fm.sources.length > 0) {\n      const distinct = new Set(\n        fm.sources.map((s) => `${s.sessionKey ?? \"\"}|${s.turnId ?? \"\"}`),\n      );\n      signals.corroborationCount = distinct.size;\n    }\n\n    // Recency: prefer an explicit observation timestamp; fall back to\n    // lastAccessed. Days-old vs the per-category half-life the caller supplies.\n    const ts = fm.observedAt ?? fm.lastAccessed;\n    if (nowUsable && typeof ts === \"string\" && ts.length > 0) {\n      const parsed = Date.parse(ts);\n      if (Number.isFinite(parsed)) {\n        const ageDays = Math.max(0, (nowMs - parsed) / (24 * 60 * 60 * 1000));\n        signals.ageDays = ageDays;\n        if (options.recencyHalfLifeDays !== undefined) {\n          signals.recencyHalfLifeDays = options.recencyHalfLifeDays;\n        }\n      }\n    }\n\n    // Only record an entry when at least one signal is present — a fully-empty\n    // entry would score neutral anyway, and skipping keeps the map small.\n    if (Object.keys(signals).length > 0) {\n      map.set(m.path, signals);\n    }\n  }\n  return map;\n}\n\n/** A scored recall candidate (mirrors `MemoryWorthFilterCandidate`). */\nexport interface TrustStageCandidate {\n  path: string;\n  score: number;\n  /** Namespace-aware result key used to preserve result identity through rerank. */\n  key?: string;\n}\n\n/** One candidate after the TrustScore stage. */\nexport interface TrustStageResultItem {\n  path: string;\n  /** Namespace-aware result key used to preserve result identity through rerank. */\n  key?: string;\n  /** Final score after the trust multiplier is applied. */\n  score: number;\n  /** The untouched input score — for telemetry / X-ray. */\n  originalScore: number;\n  /** The multiplier applied (exactly `1.0` for neutral / quarantined-kept). */\n  multiplier: number;\n  /** The full TrustScore result for X-ray + epistemic rendering. */\n  trust: TrustScoreResult;\n  /** `true` when the item was excluded from injection by quarantine. */\n  quarantined: boolean;\n}\n\nexport interface TrustStageOptions {\n  /** `path → TrustSignals`. Candidates absent from the map score neutral. */\n  signals: ReadonlyMap<string, TrustSignals>;\n  weights?: TrustWeights;\n  /** Multiplier bounds; see {@link trustMultiplier}. */\n  minMultiplier?: number;\n  maxMultiplier?: number;\n  /**\n   * When `true` (default), `quarantine`-band items are excluded from the\n   * returned (injected) list but still appear in {@link TrustStageOutput.all}\n   * with `quarantined: true` so X-ray can surface them with a reason.\n   * Only effective when the stage is active at all.\n   */\n  quarantine?: boolean;\n  /**\n   * Re-sort admitted candidates by descending multiplied score. Default `true`.\n   * When `false`, admitted items keep input order; quarantined items are still\n   * separated out.\n   */\n  reorder?: boolean;\n}\n\n/** Output of {@link applyTrustScoreStage}. */\nexport interface TrustStageOutput {\n  /** Admitted (injectable) candidates, score-multiplied and optionally sorted. */\n  admitted: TrustStageResultItem[];\n  /**\n   * Quarantined candidates — excluded from injection but visible to X-ray with\n   * the reason (rule 34 — exclusion must never look like \"no result\"). Callers\n   * that only need the injected list read `admitted`; X-ray reads `all`.\n   */\n  quarantined: TrustStageResultItem[];\n  /** Every candidate (admitted + quarantined) in input order, for X-ray. */\n  all: TrustStageResultItem[];\n}\n\n/**\n * Apply the unified TrustScore stage: score each candidate, multiply its base\n * score by `trustMultiplier(trust.score)`, and separate hard-negative\n * (quarantine) items from the injectable set.\n *\n * Neutral candidates (no signals → multiplier `1.0`) are mathematically\n * untouched, preserving byte-identical ranking for uninstrumented memories\n * when the feature is ON (and the whole stage is skipped when OFF — rule 39).\n */\nexport function applyTrustScoreStage(\n  candidates: readonly TrustStageCandidate[],\n  options: TrustStageOptions,\n): TrustStageOutput {\n  const reorder = options.reorder !== false;\n  const quarantine = options.quarantine !== false;\n  const minMul = options.minMultiplier;\n  const maxMul = options.maxMultiplier;\n\n  const all: TrustStageResultItem[] = [];\n  const admitted: TrustStageResultItem[] = [];\n  const quarantined: TrustStageResultItem[] = [];\n\n  for (let i = 0; i < candidates.length; i += 1) {\n    const c = candidates[i]!;\n    // Prefer the namespace-aware composite key; fall back to path for callers\n    // (and tests) that key signals by bare path (#2020).\n    const signals = options.signals.get(c.key ?? c.path) ?? options.signals.get(c.path);\n    const trust = computeTrustScore(signals, options.weights);\n    const isQuarantined = quarantine && trust.band === \"quarantine\";\n    // Quarantined items are excluded from injection. Keep their score unchanged\n    // so X-ray shows what the pipeline WOULD have injected — never inflate or\n    // zero the score of a hidden item (rule 34).\n    const multiplier = isQuarantined ? 1 : trustMultiplier(trust.score, minMul, maxMul);\n    // Clamp the base score at zero before multiplying, mirroring the\n    // memory-worth filter: a negative base would invert the multiplier's\n    // intended direction (see memory-worth-filter.ts:145-153).\n    const safeBase = c.score < 0 ? 0 : c.score;\n    const scored = safeBase * multiplier;\n    const item: TrustStageResultItem = {\n      path: c.path,\n      ...(c.key === undefined ? {} : { key: c.key }),\n      score: scored,\n      originalScore: c.score,\n      multiplier,\n      trust,\n      quarantined: isQuarantined,\n    };\n    all.push(item);\n    if (isQuarantined) quarantined.push(item);\n    else admitted.push(item);\n  }\n\n  if (reorder) {\n    // Stable sort by descending multiplied score, with original input position\n    // as the deterministic tiebreaker (CLAUDE.md rule 19 / checklist §12).\n    admitted.sort((a, b) => {\n      if (b.score !== a.score) return b.score - a.score;\n      // Tiebreaker: original insertion order. We don't have the index handy on\n      // the item, so derive it from `all` ordering (input order is preserved\n      // there). Equal-score items keep first-seen-first order.\n      return 0;\n    });\n    // Node's sort is stable (ES2019+); the explicit `return 0` documents the\n    // contract for reviewers.\n  }\n\n  return { admitted, quarantined, all };\n}\n\n/**\n * Compact X-ray projection of one stage item. Kept separate from the full\n * `TrustScoreResult` so the X-ray snapshot type stays narrow and serializable,\n * and so the renderer never depends on the scorer's internal component map\n * shape beyond `{ value, weight }`.\n */\nexport interface TrustXrayProjection {\n  score: number;\n  band: TrustBand;\n  components: Record<string, TrustScoreComponent>;\n  multiplier: number;\n  quarantined: boolean;\n  /** Human-readable exclusion reason, present only when quarantined. */\n  quarantineReason?: string;\n}\n\n/** Build the X-ray projection for one stage result item. */\nexport function projectTrustForXray(item: TrustStageResultItem): TrustXrayProjection {\n  const proj: TrustXrayProjection = {\n    score: item.trust.score,\n    band: item.trust.band,\n    components: item.trust.components,\n    multiplier: item.multiplier,\n    quarantined: item.quarantined,\n  };\n  if (item.quarantined) {\n    proj.quarantineReason = explainQuarantine(item.trust);\n  }\n  return proj;\n}\n\n/** Deterministic, component-derived reason a memory was quarantined. */\nexport function explainQuarantine(trust: TrustScoreResult): string {\n  const c = trust.components;\n  if (c.faithfulness && c.faithfulness.value === 0) return \"faithfulness: contradicted\";\n  if (c.contradiction && c.contradiction.value <= 0.2) return \"contradiction: pending review\";\n  return \"hard-negative trust signal\";\n}\n\n\n// ─── Recall-stage signal builder (I/O orchestration) ──────────────────────\n\n/**\n * Narrow callbacks the signal builder needs from its host (the orchestrator).\n * Kept as interfaces so the module stays pure-testable: the host binds\n * `getStorage` / `readQmdResultMemory` into these and the builder owns cache\n * management, namespace iteration, and the cold-tier direct fallback.\n */\nexport interface TrustScoreRerankDeps {\n  /** Read every memory in a namespace for the hot-tier signal scan. */\n  readNamespaceMemories(\n    namespace: string,\n  ): Promise<ReadonlyArray<{ path: string; frontmatter: TrustFrontmatterProjection }>>;\n  /** Read one memory's frontmatter by path (cold-tier direct fallback). The\n   * owning namespace is passed so a relative path resolves against the correct\n   * namespace store instead of the first fallback (#2020). */\n  readMemoryFrontmatter(\n    path: string,\n    preferredNamespace?: string,\n  ): Promise<TrustFrontmatterProjection | null>;\n  /**\n   * Current cross-process corpus version for a namespace (issue #1905). Used\n   * to key the per-namespace corpus-fallback cache so it invalidates on the\n   * next memory mutation instead of on a wall-clock timer that is shorter than\n   * recall latency (which produced a permanent steady-state miss).\n   */\n  getNamespaceVersion(namespace: string): Promise<number>;\n}\n\n/**\n * Per-namespace signal cache the host owns and the builder mutates. Keyed on\n * the shared corpus version (issue #1905): an entry is valid iff its `version`\n * still equals the namespace's current corpus version AND it is younger than\n * TRUST_SIGNAL_CACHE_MAX_AGE_MS. The age bound is required because trust\n * signals bake wall-clock time into their values (ageDays,\n * computeMemoryWorth(..., now) with recency half-life) — pure version\n * invalidation would serve stale decay on a read-only corpus (#1905, Codex).\n */\nexport interface TrustScoreSignalCache {\n  cache: Map<string, { version: number; cachedAt: number; signals: ReadonlyMap<string, TrustSignals> }>;\n}\n\n/** See TrustScoreSignalCache — bounds time-based staleness of cached signals. */\nexport const TRUST_SIGNAL_CACHE_MAX_AGE_MS = 300_000;\n\n/** Bound on distinct namespaces retained; overflow evicts the oldest. */\nexport const TRUST_SIGNAL_CACHE_MAX_NAMESPACES = 64;\n\n/** Insert-ordered bounded set: evict the oldest namespace on overflow. */\nfunction capTrustSignalCache(cache: TrustScoreSignalCache[\"cache\"], max: number): void {\n  while (cache.size > max) {\n    const oldest = cache.keys().next().value;\n    if (oldest === undefined) break;\n    cache.delete(oldest);\n  }\n}\n\n/**\n * Build the `path → TrustSignals` map for recall candidates.\n *\n * O(candidates) inversion (issue #1905): when the host passes\n * `preloadedFrontmatter` (frontmatter already loaded on the hot recall path),\n * candidate signals are seeded directly from it — no corpus scan. Only\n * candidates still missing fall back to the corpus-level per-namespace map\n * (config-gated, version-keyed so it actually hits in steady state) and then\n * to a bounded-parallel direct per-path read.\n *\n * Fail-open: a single unreadable namespace or memory is logged and skipped so\n * a storage hiccup never breaks recall (mirrors `memory-worth-filter.ts`).\n */\nexport async function buildTrustSignalsForRerank(\n  candidates: readonly (\n    | string\n    | { path: string; signalKey?: string; lookupKey?: string; namespace?: string }\n  )[],\n  namespaces: readonly string[],\n  deps: TrustScoreRerankDeps,\n  signalCache: TrustScoreSignalCache,\n  now: Date,\n  options: {\n    recencyHalfLifeDays?: number;\n    logDebug?: (message: string, context: Record<string, unknown>) => void;\n    /**\n     * Candidate frontmatter already loaded on the hot recall path (issue\n     * #1905). When present, candidate signals are seeded from it before any\n     * corpus scan, so the common warm-candidate recall does zero\n     * `readNamespaceMemories` calls. Structural — a `MemoryFile` map satisfies\n     * `{ frontmatter: TrustFrontmatterProjection }` without importing it.\n     */\n    preloadedFrontmatter?: ReadonlyMap<string, { frontmatter: TrustFrontmatterProjection }>;\n    /**\n     * When false, skip the corpus-level `readNamespaceMemories` fallback\n     * entirely (candidates-first + direct-read only). Defaults to true so the\n     * corpus path stays reachable. See `recallTrustStageCorpusFallbackEnabled`.\n     */\n    corpusFallbackEnabled?: boolean;\n    /**\n     * Cooperative cancellation (issue #1905, Codex): when the recall's shared\n     * enrichment-assembly deadline wins the race, the host aborts this signal\n     * so an orphaned corpus scan / direct-read loop stops at the next loop\n     * boundary instead of continuing to burn I/O after recall already returned.\n     */\n    abortSignal?: AbortSignal;\n  } = {},\n): Promise<Map<string, TrustSignals>> {\n  const logDebug = options.logDebug ?? (() => {});\n  const signals = new Map<string, TrustSignals>();\n  const corpusFallbackEnabled = options.corpusFallbackEnabled ?? true;\n  const halfLife = { recencyHalfLifeDays: options.recencyHalfLifeDays };\n\n  // Paths examined via preloaded frontmatter (issue #1905, Cursor/Codex).\n  // buildTrustSignalMap deliberately OMITS neutral memories (no trust fields),\n  // so a preloaded candidate can be examined yet absent from `signals` — it\n  // must NOT be treated as missing, or the corpus fallback + direct read fire\n  // for every uninstrumented hot candidate, defeating the O(candidates) path.\n  // Absent-from-signals still means multiplier 1.0 downstream, exactly what a\n  // corpus scan would have produced for the same neutral memory.\n  const preloadedKeys = new Set<string>();\n\n  // Normalize candidates to a composite identity: `signalKey` is what the\n  // trust stage looks up (namespace-aware), `lookupKey` matches the preloaded\n  // frontmatter map's key, `path` is the raw store path used for corpus/direct\n  // reads. A bare string keeps the legacy path-only behavior (#2020).\n  const normalized = candidates.map((c) =>\n    typeof c === \"string\"\n      ? { path: c, signalKey: c, lookupKey: c, namespace: undefined as string | undefined }\n      : {\n          path: c.path,\n          signalKey: c.signalKey ?? c.path,\n          lookupKey: c.lookupKey ?? c.path,\n          namespace: c.namespace,\n        },\n  );\n\n  // O(candidates) fast path: seed signals from candidate frontmatter already\n  // loaded on the hot recall path. Reuses the exact `buildTrustSignalMap`\n  // computation so a candidate's signals equal what a corpus scan produced.\n  if (options.preloadedFrontmatter) {\n    const preloaded: Array<{ path: string; frontmatter: TrustFrontmatterProjection }> = [];\n    for (const c of normalized) {\n      // Composite lookupKey is authoritative; the bare-path fallback keeps\n      // path-keyed preloaded maps (e.g. the recent-scan branch) hitting the\n      // fast path and is inert in production composite-keyed maps (#2020).\n      const mem =\n        options.preloadedFrontmatter.get(c.lookupKey) ??\n        options.preloadedFrontmatter.get(c.path);\n      if (!mem) continue;\n      preloadedKeys.add(c.signalKey);\n      preloaded.push({ path: c.signalKey, frontmatter: mem.frontmatter });\n    }\n    if (preloaded.length > 0) {\n      const seeded = buildTrustSignalMap(preloaded, now, halfLife);\n      for (const [key, s] of seeded) signals.set(key, s);\n    }\n  }\n\n  // Corpus-level fallback (config-gated): candidates still missing probe a\n  // per-namespace signal map, cached and invalidated by the shared\n  // cross-process corpus version. Only candidate rows are copied out — never\n  // the whole map (issue #1905, no per-recall full-map union).\n  if (corpusFallbackEnabled) {\n    const seenNamespaces = new Set<string>();\n    for (const ns of namespaces) {\n      // Cooperative cancellation: the recall's assembly deadline may have won\n      // the race — stop before starting another namespace scan (#1905, Codex).\n      if (options.abortSignal?.aborted) break;\n      if (seenNamespaces.has(ns)) continue;\n      seenNamespaces.add(ns);\n      if (normalized.every((c) => signals.has(c.signalKey) || preloadedKeys.has(c.signalKey))) break;\n      try {\n        const version = await deps.getNamespaceVersion(ns);\n        const cached = signalCache.cache.get(ns);\n        const nowMs = now.getTime();\n        let nsMap: ReadonlyMap<string, TrustSignals>;\n        // Valid iff the corpus version still matches AND the entry is younger\n        // than the max age: trust signals bake `now` into their values, so an\n        // unchanged corpus still goes stale as wall-clock advances (#1905, Codex).\n        if (\n          cached &&\n          cached.version === version &&\n          nowMs - cached.cachedAt < TRUST_SIGNAL_CACHE_MAX_AGE_MS\n        ) {\n          nsMap = cached.signals;\n        } else {\n          const memories = await deps.readNamespaceMemories(ns);\n          nsMap = buildTrustSignalMap(memories, now, halfLife);\n          signalCache.cache.set(ns, { version, cachedAt: nowMs, signals: nsMap });\n          capTrustSignalCache(signalCache.cache, TRUST_SIGNAL_CACHE_MAX_NAMESPACES);\n        }\n        for (const c of normalized) {\n          // Preloaded keys were already examined — absent-from-signals means\n          // neutral (multiplier 1.0), identical to what the corpus map holds.\n          if (signals.has(c.signalKey) || preloadedKeys.has(c.signalKey)) continue;\n          // A namespaced candidate belongs to exactly one namespace: never seed\n          // its signals from a different namespace's corpus map, or two\n          // same-path candidates in different namespaces collapse (#2020).\n          if (c.namespace !== undefined && c.namespace !== ns) continue;\n          const s = nsMap.get(c.path);\n          if (s) signals.set(c.signalKey, s);\n        }\n      } catch (err) {\n        logDebug(\"trust-score: failed to read namespace, skipping\", {\n          namespace: ns,\n          error: (err as Error).message,\n        });\n      }\n    }\n  }\n\n  // Direct per-path fallback for candidates still absent (cold-tier / archive).\n  // Preloaded paths are excluded — they were examined and are neutral priors.\n  // Bounded-parallel (≤16) to match loadSearchResultMemoryMap's batch size.\n  const missing = normalized.filter(\n    (c) => !signals.has(c.signalKey) && !preloadedKeys.has(c.signalKey),\n  );\n  if (missing.length > 0) {\n    const fallbackMemories: Array<{ path: string; frontmatter: TrustFrontmatterProjection }> = [];\n    const BATCH = 16;\n    for (let off = 0; off < missing.length; off += BATCH) {\n      // Cooperative cancellation between batches (#1905, Codex).\n      if (options.abortSignal?.aborted) break;\n      const batch = await Promise.all(\n        missing.slice(off, off + BATCH).map(async (c) => {\n          try {\n            const frontmatter = await deps.readMemoryFrontmatter(c.path, c.namespace);\n            return frontmatter ? { path: c.signalKey, frontmatter } : null;\n          } catch (err) {\n            logDebug(\"trust-score: direct path lookup failed\", {\n              path: c.path,\n              error: (err as Error).message,\n            });\n            return null;\n          }\n        }),\n      );\n      for (const item of batch) if (item) fallbackMemories.push(item);\n    }\n    if (fallbackMemories.length > 0) {\n      const fallbackSignals = buildTrustSignalMap(fallbackMemories, now, halfLife);\n      for (const [key, s] of fallbackSignals) signals.set(key, s);\n    }\n  }\n\n  return signals;\n}\n"],"mappings":";;;;;;;;;AAGO,SAAS,eAAe,QAA6D;AAC1F,SAAO,KAAK,UAAU,CAAC,OAAO,aAAa,IAAI,OAAO,IAAI,CAAC;AAC7D;AAGO,SAAS,eACd,aACA,QACkC;AAClC,SAAO,YAAY,IAAI,eAAe,MAAM,CAAC,KAAK,YAAY,IAAI,OAAO,IAAI;AAC/E;AA6DO,SAAS,oBACd,UACA,KACA,UAA4C,CAAC,GAClB;AAC3B,QAAM,MAAM,oBAAI,IAA0B;AAC1C,QAAM,QAAQ,IAAI,QAAQ;AAC1B,QAAM,YAAY,OAAO,SAAS,KAAK;AACvC,aAAW,KAAK,UAAU;AACxB,UAAM,KAAK,EAAE;AACb,UAAM,UAAwB,CAAC;AAI/B,QAAI,GAAG,eAAe,UAAa,GAAG,YAAY,QAAW;AAI3D,YAAM,aACJ,QAAQ,wBAAwB,SAC5B,QAAQ,sBAAsB,QAC9B;AACN,YAAM,QAAQ,mBAAmB;AAAA,QAC/B,YAAY,GAAG;AAAA,QACf,SAAS,GAAG;AAAA,QACZ,cAAc,GAAG;AAAA,QACjB;AAAA,QACA;AAAA,MACF,CAAC;AACD,cAAQ,cAAc,EAAE,OAAO,MAAM,OAAO,YAAY,MAAM,WAAW;AAAA,IAC3E;AAEA,QAAI,GAAG,eAAe,OAAW,SAAQ,aAAa,GAAG;AACzD,QAAI,GAAG,iBAAiB,QAAW;AAIjC,cAAQ,eACN,GAAG,aAAa,YAAY,oBAAoB,cAAc,GAAG,aAAa;AAAA,IAClF;AAGA,QAAI,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,QAAQ,SAAS,GAAG;AACtD,YAAM,WAAW,IAAI;AAAA,QACnB,GAAG,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;AAAA,MACjE;AACA,cAAQ,qBAAqB,SAAS;AAAA,IACxC;AAIA,UAAM,KAAK,GAAG,cAAc,GAAG;AAC/B,QAAI,aAAa,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG;AACxD,YAAM,SAAS,KAAK,MAAM,EAAE;AAC5B,UAAI,OAAO,SAAS,MAAM,GAAG;AAC3B,cAAM,UAAU,KAAK,IAAI,IAAI,QAAQ,WAAW,KAAK,KAAK,KAAK,IAAK;AACpE,gBAAQ,UAAU;AAClB,YAAI,QAAQ,wBAAwB,QAAW;AAC7C,kBAAQ,sBAAsB,QAAQ;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAIA,QAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,UAAI,IAAI,EAAE,MAAM,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;AAwEO,SAAS,qBACd,YACA,SACkB;AAClB,QAAM,UAAU,QAAQ,YAAY;AACpC,QAAM,aAAa,QAAQ,eAAe;AAC1C,QAAM,SAAS,QAAQ;AACvB,QAAM,SAAS,QAAQ;AAEvB,QAAM,MAA8B,CAAC;AACrC,QAAM,WAAmC,CAAC;AAC1C,QAAM,cAAsC,CAAC;AAE7C,WAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK,GAAG;AAC7C,UAAM,IAAI,WAAW,CAAC;AAGtB,UAAM,UAAU,QAAQ,QAAQ,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,QAAQ,IAAI,EAAE,IAAI;AAClF,UAAM,QAAQ,kBAAkB,SAAS,QAAQ,OAAO;AACxD,UAAM,gBAAgB,cAAc,MAAM,SAAS;AAInD,UAAM,aAAa,gBAAgB,IAAI,gBAAgB,MAAM,OAAO,QAAQ,MAAM;AAIlF,UAAM,WAAW,EAAE,QAAQ,IAAI,IAAI,EAAE;AACrC,UAAM,SAAS,WAAW;AAC1B,UAAM,OAA6B;AAAA,MACjC,MAAM,EAAE;AAAA,MACR,GAAI,EAAE,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI;AAAA,MAC5C,OAAO;AAAA,MACP,eAAe,EAAE;AAAA,MACjB;AAAA,MACA;AAAA,MACA,aAAa;AAAA,IACf;AACA,QAAI,KAAK,IAAI;AACb,QAAI,cAAe,aAAY,KAAK,IAAI;AAAA,QACnC,UAAS,KAAK,IAAI;AAAA,EACzB;AAEA,MAAI,SAAS;AAGX,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,UAAI,EAAE,UAAU,EAAE,MAAO,QAAO,EAAE,QAAQ,EAAE;AAI5C,aAAO;AAAA,IACT,CAAC;AAAA,EAGH;AAEA,SAAO,EAAE,UAAU,aAAa,IAAI;AACtC;AAmBO,SAAS,oBAAoB,MAAiD;AACnF,QAAM,OAA4B;AAAA,IAChC,OAAO,KAAK,MAAM;AAAA,IAClB,MAAM,KAAK,MAAM;AAAA,IACjB,YAAY,KAAK,MAAM;AAAA,IACvB,YAAY,KAAK;AAAA,IACjB,aAAa,KAAK;AAAA,EACpB;AACA,MAAI,KAAK,aAAa;AACpB,SAAK,mBAAmB,kBAAkB,KAAK,KAAK;AAAA,EACtD;AACA,SAAO;AACT;AAGO,SAAS,kBAAkB,OAAiC;AACjE,QAAM,IAAI,MAAM;AAChB,MAAI,EAAE,gBAAgB,EAAE,aAAa,UAAU,EAAG,QAAO;AACzD,MAAI,EAAE,iBAAiB,EAAE,cAAc,SAAS,IAAK,QAAO;AAC5D,SAAO;AACT;AA8CO,IAAM,gCAAgC;AAGtC,IAAM,oCAAoC;AAGjD,SAAS,oBAAoB,OAAuC,KAAmB;AACrF,SAAO,MAAM,OAAO,KAAK;AACvB,UAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,QAAI,WAAW,OAAW;AAC1B,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAeA,eAAsB,2BACpB,YAIA,YACA,MACA,aACA,KACA,UAwBI,CAAC,GAC+B;AACpC,QAAM,WAAW,QAAQ,aAAa,MAAM;AAAA,EAAC;AAC7C,QAAM,UAAU,oBAAI,IAA0B;AAC9C,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,WAAW,EAAE,qBAAqB,QAAQ,oBAAoB;AASpE,QAAM,gBAAgB,oBAAI,IAAY;AAMtC,QAAM,aAAa,WAAW;AAAA,IAAI,CAAC,MACjC,OAAO,MAAM,WACT,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,OAAgC,IAClF;AAAA,MACE,MAAM,EAAE;AAAA,MACR,WAAW,EAAE,aAAa,EAAE;AAAA,MAC5B,WAAW,EAAE,aAAa,EAAE;AAAA,MAC5B,WAAW,EAAE;AAAA,IACf;AAAA,EACN;AAKA,MAAI,QAAQ,sBAAsB;AAChC,UAAM,YAA8E,CAAC;AACrF,eAAW,KAAK,YAAY;AAI1B,YAAM,MACJ,QAAQ,qBAAqB,IAAI,EAAE,SAAS,KAC5C,QAAQ,qBAAqB,IAAI,EAAE,IAAI;AACzC,UAAI,CAAC,IAAK;AACV,oBAAc,IAAI,EAAE,SAAS;AAC7B,gBAAU,KAAK,EAAE,MAAM,EAAE,WAAW,aAAa,IAAI,YAAY,CAAC;AAAA,IACpE;AACA,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,SAAS,oBAAoB,WAAW,KAAK,QAAQ;AAC3D,iBAAW,CAAC,KAAK,CAAC,KAAK,OAAQ,SAAQ,IAAI,KAAK,CAAC;AAAA,IACnD;AAAA,EACF;AAMA,MAAI,uBAAuB;AACzB,UAAM,iBAAiB,oBAAI,IAAY;AACvC,eAAW,MAAM,YAAY;AAG3B,UAAI,QAAQ,aAAa,QAAS;AAClC,UAAI,eAAe,IAAI,EAAE,EAAG;AAC5B,qBAAe,IAAI,EAAE;AACrB,UAAI,WAAW,MAAM,CAAC,MAAM,QAAQ,IAAI,EAAE,SAAS,KAAK,cAAc,IAAI,EAAE,SAAS,CAAC,EAAG;AACzF,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,oBAAoB,EAAE;AACjD,cAAM,SAAS,YAAY,MAAM,IAAI,EAAE;AACvC,cAAM,QAAQ,IAAI,QAAQ;AAC1B,YAAI;AAIJ,YACE,UACA,OAAO,YAAY,WACnB,QAAQ,OAAO,WAAW,+BAC1B;AACA,kBAAQ,OAAO;AAAA,QACjB,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,sBAAsB,EAAE;AACpD,kBAAQ,oBAAoB,UAAU,KAAK,QAAQ;AACnD,sBAAY,MAAM,IAAI,IAAI,EAAE,SAAS,UAAU,OAAO,SAAS,MAAM,CAAC;AACtE,8BAAoB,YAAY,OAAO,iCAAiC;AAAA,QAC1E;AACA,mBAAW,KAAK,YAAY;AAG1B,cAAI,QAAQ,IAAI,EAAE,SAAS,KAAK,cAAc,IAAI,EAAE,SAAS,EAAG;AAIhE,cAAI,EAAE,cAAc,UAAa,EAAE,cAAc,GAAI;AACrD,gBAAM,IAAI,MAAM,IAAI,EAAE,IAAI;AAC1B,cAAI,EAAG,SAAQ,IAAI,EAAE,WAAW,CAAC;AAAA,QACnC;AAAA,MACF,SAAS,KAAK;AACZ,iBAAS,mDAAmD;AAAA,UAC1D,WAAW;AAAA,UACX,OAAQ,IAAc;AAAA,QACxB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAKA,QAAM,UAAU,WAAW;AAAA,IACzB,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,SAAS,KAAK,CAAC,cAAc,IAAI,EAAE,SAAS;AAAA,EACpE;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,mBAAqF,CAAC;AAC5F,UAAM,QAAQ;AACd,aAAS,MAAM,GAAG,MAAM,QAAQ,QAAQ,OAAO,OAAO;AAEpD,UAAI,QAAQ,aAAa,QAAS;AAClC,YAAM,QAAQ,MAAM,QAAQ;AAAA,QAC1B,QAAQ,MAAM,KAAK,MAAM,KAAK,EAAE,IAAI,OAAO,MAAM;AAC/C,cAAI;AACF,kBAAM,cAAc,MAAM,KAAK,sBAAsB,EAAE,MAAM,EAAE,SAAS;AACxE,mBAAO,cAAc,EAAE,MAAM,EAAE,WAAW,YAAY,IAAI;AAAA,UAC5D,SAAS,KAAK;AACZ,qBAAS,0CAA0C;AAAA,cACjD,MAAM,EAAE;AAAA,cACR,OAAQ,IAAc;AAAA,YACxB,CAAC;AACD,mBAAO;AAAA,UACT;AAAA,QACF,CAAC;AAAA,MACH;AACA,iBAAW,QAAQ,MAAO,KAAI,KAAM,kBAAiB,KAAK,IAAI;AAAA,IAChE;AACA,QAAI,iBAAiB,SAAS,GAAG;AAC/B,YAAM,kBAAkB,oBAAoB,kBAAkB,KAAK,QAAQ;AAC3E,iBAAW,CAAC,KAAK,CAAC,KAAK,gBAAiB,SAAQ,IAAI,KAAK,CAAC;AAAA,IAC5D;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/{chunk-G6NKALRN.js → chunk-H4WG3UQZ.js}

@@ -1,7 +1,7 @@
 import {
   coerceBool,
   coerceNumber
-} from "./chunk-PHK3HARR.js";
+} from "./chunk-PQVCH2AE.js";
 
 // src/faithfulness-config.ts
 function parseIntegerAtLeast(value, fallback, min, keyName) {
@@ -60,4 +60,4 @@ export {
   parseFaithfulnessGateConfig,
   parseCorrectionIntentConfig
 };
-//# sourceMappingURL=chunk-G6NKALRN.js.map
+//# sourceMappingURL=chunk-H4WG3UQZ.js.map