@vostride/agent-qa-knowledge-local 0.0.1 → 0.2.2

package/dist/index.d.ts

@@ -0,0 +1,3983 @@
+import { KnowledgePort } from '@vostride/agent-qa-agent';
+import { KnowledgeHintReader } from '@vostride/agent-qa-runner';
+import * as _vostride_agent_qa_schema from '@vostride/agent-qa-schema';
+import { CurationSnapshotChange, CurationSnapshot, EntityKind, EmbeddingProfile, EntityDescriptor, EntityResolution, VerdictClass, QuarantineOperationsPort, ArtifactRef, MaskFn, CurationAuthorship, BundleDraft, BundleDiscriminant, OriginClass, ScreenState, BundleOutcomeEvent, BundleRelation, DistilledObservation, RecordId, BundleIdentityCore, GateReceipt, MeasurementObservation, PromotionReceipt, MeasurementBaseline, RetrievalTraceLeg, RecordedRetrievalRung, Anchor, IndexEntry, TrustPriorTable, CompletedRunHandoff, PerTestOutcome, StepEvidence, QuarantineLedgerEvent, RunAnalysisArtifact, Verdict, ScopeKey, ExecutionContext, BundleKind, FactSubtype, Delta, CurationFallbackReason, CompareAndSet, BundleStatus, ResolvePromotionPosture, PromotionGateHoldReason, PromotionPath, KnowledgeAcceptInput, KnowledgeRejectInput, KnowledgeForgetInput, KnowledgeMarkInput, KnowledgeProjection, KnowledgeReviewVerb, CommitReceipt, ForgetReceiptV1, KnowledgeTargetRef, DraftReceipt, MarkReceipt, OriginStage, NoDraftableFixChecked, MarkQuarantineClass, ImprovementPlan, Mark } from '@vostride/agent-qa-schema';
+export { testFingerprintElements } from '@vostride/agent-qa-schema';
+import { z } from 'zod';
+import { I as IndexReaderConnection, E as EmbedderPort, a as IndexFace, K as KnowledgeReader, V as VecCapability, Q as QuarantineAppendOutcome, b as QuarantineDetectionSighting, R as RefusedQuarantineLine, r as readRebuildRequest, c as readIndexMaintenanceState, d as RebuildRequest, o as openKnowledgeReader, L as LoadedBundle, A as AppendMarkEvidenceOutcome } from './mark-evidence-plan-BCkYN07i.js';
+export { e as AUTHORING_BRIEF_DEFAULT_BUDGET, f as AUTHORING_DENSE_K, g as AUTHORING_EXCERPT_CHAR_BUDGET, h as AUTHORING_EXEMPLAR_CAP, i as AUTHORING_PROCEDURE_CAP, j as AUTO_QUARANTINE_CLASSES, k as AssembleAuthoringBriefInput, l as AssembledAuthoringBrief, m as AuthoringEntryCandidate, n as AuthoringExemplarRow, p as AuthoringReaderDependencies, q as AuthoringTestRef, C as CHECKPOINT_EVERY_N_BUNDLES, s as CanaryPostureFacts, t as CanonicalBundleAnchorLookup, D as DenseHit, u as DenseSearchOptions, v as DiffSinceOptions, w as EnumeratedBundleDir, x as EvaluateQuarantineDetectionInput, G as GATES_REL_PATH, y as INDEX_DB_FILE, z as INDEX_RENDERING_SCHEMA_VERSION, B as INDEX_SCHEMA_VERSION, F as IndexHealth, H as IndexWriterHandle, J as InspectRecordsOptions, M as IntegrityReport, N as KnowledgeHit, O as KnowledgeMaintenanceScanError, P as KnowledgeMaintenanceScanIssue, S as KnowledgeRecordNotFoundError, T as KnowledgeSearchOptions, U as LoadBundleOutcome, W as LowerTrustShare, X as MARK_EVIDENCE_TOKEN_PREFIX, Y as MarkEvidenceEffect, Z as MarkEvidencePlan, _ as MarkEvidenceTarget, $ as Measurements, a0 as OpenKnowledgeReaderOptions, a1 as OpenServingKnowledgeReaderConfig, a2 as PlanMarkEvidenceInput, a3 as QUARANTINE_AUTO_EXIT_PASSES, a4 as QUARANTINE_CLASS_DISPOSITIONS, a5 as QUARANTINE_DEFAULT_EXPIRY_DAYS, a6 as QUARANTINE_ESCALATE_THRESHOLD, a7 as QUARANTINE_FLAG_FLOOR, a8 as QUARANTINE_LEDGER_FILENAME, a9 as QuarantineDetectionFailure, aa as QuarantineDetectionResult, ab as QuarantineDetectionTestWindow, ac as QuarantineDisposition, ad as QuarantineLedgerRead, ae as QuarantineOrdinalOutcome, af as READER_BUSY_TIMEOUT_MS, ag as REBUILD_MARKER_FILE, ah as REQUIRED_INDEX_TABLES, ai as ReadRebuildRequestOutcome, aj as RebuildReason, ak as RequestRebuildOptions, al as ScanBundleByIdOptions, am as ScanBundlesOptions, an as ShowRecordOptions, ao as StandingReceiptDigest, ap as WRITER_BUSY_TIMEOUT_MS, aq as assembleAuthoringBrief, ar as canaryPostureFactsFor, as as classifyIndexFace, at as clearRebuildRequest, au as createAuthoringReader, av as deriveBundleTrust, aw as diffSince, ax as embeddingProfileKey, ay as enumerateBundleDirs, az as evaluateQuarantineDetection, aA as foldQuarantineLedgerState, aB as indexDbPath, aC as inspectRecords, aD as isServable, aE as loadBundle, aF as lowerTrustSharesFor, aG as markEvidenceEvent, aH as openIndexReaderConnection, aI as openIndexWriter, aJ as openKnowledgeReader, aK as planMarkEvidence, aL as probeIndexHealth, aM as projectMarkEvidenceOutcome, aN as quarantineLedgerPath, aO as readCanonicalBundleAnchors, aP as readGateReceipts, aQ as readMeasurements, aR as readQuarantineLedger, aS as requestRebuild, aT as resolveActiveProfile, aU as resolveVecCapability, aV as scanBundleById, aW as scanBundles, aX as showRecord, aY as standingReceiptDigestsFor, aZ as toInspectRecordView, a_ as vecTableName, a$ as verifyBundleIntegrity } from './mark-evidence-plan-BCkYN07i.js';
+import { DatabaseSync } from 'node:sqlite';
+import { Tokenizer } from '@huggingface/tokenizers';
+import { E as EmbedderWorkerRegistration, a as EmbedderWorkerIncarnationVerdict } from './worker-registration-C-9spEsf.js';
+export { b as EMBEDDER_WORKER_REGISTRATION_FILE, c as EMBEDDER_WORKER_REGISTRATION_SCHEMA_VERSION, d as EMBEDDER_WORKER_REQUEST_TIMEOUT_MS, e as EMBEDDER_WORKER_START_TIMEOUT_MS, f as EMBEDDER_WORKER_TERM_GRACE_MS, g as EMBEDDER_WORKER_UNVERIFIABLE_INCARNATION, h as EmbedderWorkerTimeoutError, i as EmbedderWorkerTimeoutPhase, R as ReadEmbedderWorkerRegistrationOutcome, j as embedderWorkerProcessIsAlive, k as embedderWorkerSocketPath, p as probeEmbedderWorkerSocket, r as readEmbedderWorkerRegistration, l as removeEmbedderWorkerRegistration, w as writeEmbedderWorkerRegistration } from './worker-registration-C-9spEsf.js';
+
+interface ReadCurationEffectsOptions {
+    knowledgeRoot: string;
+    sourceRunId: string;
+    observationIds?: readonly string[];
+}
+/** Read only successful, surviving effects; current status is never classification authority. */
+declare function readCurationEffects(options: ReadCurationEffectsOptions): CurationSnapshotChange[];
+/** One affected record, strongest classification, with all historical identities retained. */
+declare function foldCurationSnapshot(effects: readonly CurationSnapshotChange[]): CurationSnapshot;
+
+declare const PAYLOAD_BENEFITS: readonly ["exercised-benefited", "rode-along", "exercised-harmed"];
+declare const PAYLOAD_STATE_VALIDITIES: readonly ["valid", "stale", "unknown"];
+declare const canaryOutcomePayloadSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    benefit: z.ZodEnum<{
+        "exercised-benefited": "exercised-benefited";
+        "rode-along": "rode-along";
+        "exercised-harmed": "exercised-harmed";
+    }>;
+    stateValidity: z.ZodEnum<{
+        unknown: "unknown";
+        valid: "valid";
+        stale: "stale";
+    }>;
+    corpusDigest: z.ZodOptional<z.ZodString>;
+    observedStateDigest: z.ZodOptional<z.ZodString>;
+    ablation: z.ZodOptional<z.ZodObject<{
+        crossCheck: z.ZodEnum<{
+            inconclusive: "inconclusive";
+            flipped: "flipped";
+            held: "held";
+            "not-run": "not-run";
+        }>;
+        k: z.ZodNumber;
+        baseSeed: z.ZodNumber;
+        seeds: z.ZodArray<z.ZodNumber>;
+        seedHonored: z.ZodBoolean;
+        spend: z.ZodObject<{
+            modelCalls: z.ZodNumber;
+            screens: z.ZodNumber;
+            promptTokens: z.ZodNumber;
+            completionTokens: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    jobKind: z.ZodLiteral<"canary-outcome">;
+    candidateId: z.ZodString;
+    runId: z.ZodString;
+    testId: z.ZodString;
+    testIndex: z.ZodNumber;
+    buildOrdinal: z.ZodNumber;
+    stepIndex: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        positive: "positive";
+        negative: "negative";
+    }>;
+    exercisedAnchor: z.ZodType<_vostride_agent_qa_schema.Anchor, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.Anchor, unknown>>;
+    attribution: z.ZodString;
+    briefDigest: z.ZodString;
+}, z.core.$strict>;
+type CanaryOutcomePayload = z.infer<typeof canaryOutcomePayloadSchema>;
+type QueuedCanaryPayloadRead = {
+    kind: 'current';
+    payload: CanaryOutcomePayload;
+} | {
+    kind: 'refused';
+    issues: string[];
+};
+declare function readQueuedCanaryPayload(value: unknown): QueuedCanaryPayloadRead;
+
+/**
+ * Stamped into `PRAGMA user_version` at creation and checked on every open.
+ *
+ * Stamp and hard-fail, never migrate — the 385 D-04 convention. The milestone ships nothing
+ * between its releases, so a ledger written by another build is a development artifact, and
+ * migration machinery for it would be code with no user that everything afterwards has to
+ * keep working. Note what this does NOT license: the ROWS are permanent regardless. A version
+ * refusal tells an operator to move a stale development file aside; it never rewrites one.
+ */
+declare const ADDRESSING_LEDGER_USER_VERSION = 2;
+/**
+ * Busy timeout for every connection.
+ *
+ * D-02's story is "any process mints, sqlite arbitrates", which only works if a writer
+ * waiting on the write lock retries rather than failing immediately. Matched to the job
+ * store's window because the transactions are the same shape and size: retune from observed
+ * contention, not from a guess about how many hosts there are.
+ */
+declare const ADDRESSING_LEDGER_BUSY_TIMEOUT_MS = 2000;
+/** The ledger's own file name under the agent-qa root, beside `agent-jobs.db` (D-02). */
+declare const ADDRESSING_LEDGER_DB_FILE = "entity-addresses.db";
+/** A ledger file this build cannot read. Refused before a single schema statement runs. */
+declare class AddressingLedgerSchemaVersionError extends Error {
+    readonly path: string;
+    readonly expected: number;
+    readonly found: number;
+    constructor(path: string, expected: number, found: number);
+}
+/**
+ * An EXPLICITLY recorded target rename (D-03).
+ *
+ * There is no heuristic rename detection in this file and there must not be. Inferring that
+ * two target slugs are "the same target" from their spelling, their order of appearance or
+ * their contents is a guess, and ENTY-01's never-guess law is not weaker inside the ledger
+ * than it is inside the resolver — a wrong link here would silently re-point a published
+ * address, which is the exact failure D-02 exists to make impossible.
+ */
+interface TargetRename {
+    readonly fromSlug: string;
+    readonly toSlug: string;
+    readonly recordedAt: string;
+}
+/** A minted address: the durable mapping plus the short-ID it renders as. */
+interface EntityAddress {
+    readonly kind: EntityKind;
+    readonly machineId: string;
+    /** Present for ordinal-addressed kinds; absent for slug-addressed ones (D-03). */
+    readonly ordinal?: number;
+    readonly shortId: string;
+    readonly mintedAt: string;
+}
+interface AddressingLedger {
+    /**
+     * Assign this machine id its permanent address, or return the one it already has.
+     *
+     * Idempotent by construction rather than by a caller-side check: the unique index decides,
+     * so two processes calling this at the same instant agree, and a caller that forgot to look
+     * first cannot create a second address.
+     */
+    mint(kind: EntityKind, machineId: string): EntityAddress;
+    /** The address for a machine id, or `undefined` when it has never been sighted. */
+    lookup(kind: EntityKind, machineId: string): EntityAddress | undefined;
+    /** The address a published short-ID names, or `undefined`. Tier (a)'s whole job. */
+    lookupByShortId(shortId: string): EntityAddress | undefined;
+    /**
+     * Every address ever minted, in a fixed order (kind, then short-ID).
+     *
+     * READ-only, and the append-only law is what makes it worth having: this list only grows, so
+     * a caller enumerating it is reading a complete history rather than a snapshot that could
+     * have lost rows. The entity index is rebuilt FROM this (D-06) — a projection can only claim
+     * to heal if the thing it is rebuilt from can be enumerated in full.
+     */
+    listAddresses(): EntityAddress[];
+    /**
+     * Record that a config target was renamed (D-03). See {@link TargetRename} for why this is
+     * the only way a link between two slugs ever comes to exist.
+     *
+     * Both slugs are minted, so both keep their own permanent address: the predecessor keeps
+     * the one already sitting in somebody's CI log, and the successor gets its own rather than
+     * inheriting one. Recording is idempotent — a repeat is the same fact, not a second one.
+     */
+    recordTargetRename(fromSlug: string, toSlug: string): TargetRename;
+    /** The rename recorded FOR this slug, if any. Never the reverse direction. */
+    lookupTargetRename(fromSlug: string): TargetRename | undefined;
+    close(): void;
+}
+interface OpenAddressingLedgerOptions {
+    /** Absolute path to the ledger file, typically `<agentQaRoot>/entity-addresses.db`. */
+    readonly path: string;
+    /** ISO-8601 stamp source. Injected so mint times are deterministic under test. */
+    readonly now?: () => string;
+    readonly timeoutMs?: number;
+}
+declare function openAddressingLedger(options: OpenAddressingLedgerOptions): AddressingLedger;
+
+/**
+ * The projection's own file name, beside the knowledge index rather than inside it.
+ *
+ * Beside, because an entity is not a learned fact (D-06). Its own file, because the knowledge
+ * index's schema version, rebuild and per-profile vec bookkeeping belong to records, and
+ * sharing them would have coupled two projections whose only similarity is their shape.
+ */
+declare const ENTITY_INDEX_DB_FILE = "entity-index.db";
+/**
+ * Stamped into `PRAGMA user_version` at creation and checked on every open.
+ *
+ * Stamp and hard-fail, never migrate — the 385 D-04 house style. Migration would be effort
+ * spent on a file whose contents can be regenerated in full from the ledger; a refusal that
+ * says which version it found is more useful than a migration nobody would maintain.
+ */
+declare const ENTITY_INDEX_USER_VERSION = 2;
+/**
+ * How often a standing daemon re-renders the projection from its sources (D-06).
+ *
+ * PROVISIONAL 600_000 (ten minutes); retune from operational evidence without adding config,
+ * the `LEASE_HEARTBEAT_TTL_MS` house style. What it is bounding is STALENESS of a title or a
+ * status in a fuzzy-match target — never correctness of an address, which the ledger owns and
+ * no cadence can affect. Sightings already refresh an entity the moment anything touches it,
+ * so this sweep exists for the entities nothing has touched since their source data moved.
+ *
+ * Deliberately its own interval rather than the daemon's `MAINTENANCE_CADENCE_MS`. That
+ * cadence runs the lease-holding maintenance tail; this sweep must never require the writer
+ * lease (D-02/D-06) because it writes only this file, and sharing a timer with lease-gated
+ * work would have made a lease-free projection stop being maintained the moment a lease was
+ * lost — a coupling nothing in the projection's own contract asks for.
+ */
+declare const ENTITY_INDEX_SWEEP_INTERVAL_MS = 600000;
+declare class EntityIndexSchemaVersionError extends Error {
+    readonly path: string;
+    readonly supportedVersion: number;
+    readonly foundVersion: number;
+    constructor(path: string, supportedVersion: number, foundVersion: number);
+}
+interface EntityIndexHandle {
+    /** The connection shape the retrieval legs take. `vec` is pinned `brute` — see the header. */
+    readonly connection: IndexReaderConnection;
+    readonly path: string;
+    close(): void;
+}
+interface OpenEntityIndexOptions {
+    /** Absolute path to the projection file, typically `entityIndexDbPath(knowledgeRoot)`. */
+    readonly path: string;
+    /**
+     * The knowledge root the path lives under. When given, the path's directory chain must stay
+     * inside it (261003-mqc): a linked `memory/` or `memory/index/` is refused before the open.
+     */
+    readonly knowledgeRoot?: string;
+    readonly timeoutMs?: number;
+}
+/** The projection's path: beside the knowledge index, never inside it. */
+declare function entityIndexDbPath(knowledgeRoot: string): string;
+declare function openEntityIndex(options: OpenEntityIndexOptions): EntityIndexHandle;
+/**
+ * Project one entity into the index (D-06's incremental half).
+ *
+ * Called from the resolver's sighting/mint path, so every process posture — daemon, one-shot
+ * CLI, a test harness — maintains the projection by using it. Idempotent: re-projecting an
+ * unchanged entity leaves the same row.
+ */
+declare function refreshEntity(handle: EntityIndexHandle, descriptor: EntityDescriptor): void;
+/**
+ * Drop everything and re-project from the supplied descriptor set (D-06's healing half).
+ *
+ * The set comes from the ledger plus the owning stores, which is what makes this a rebuild
+ * rather than a repair: nothing in this file is consulted to produce the new contents, so a
+ * file damaged in any way at all converges to the same result as a file that never existed.
+ * Embeddings are re-derived rather than carried, because a rebuild that preserved derived
+ * bytes would preserve exactly the state a rebuild is run to be rid of.
+ */
+declare function rebuildEntityIndex(handle: EntityIndexHandle, descriptors: Iterable<EntityDescriptor>): number;
+interface EntityIndexSweepReport {
+    readonly examined: number;
+    readonly refreshed: number;
+}
+/**
+ * Re-project the entities whose source data moved (D-06's maintenance-cadence half).
+ *
+ * A sweep is maintenance of a disposable projection, so it writes only where a row disagrees
+ * with its source. It never touches the addressing ledger — the ledger is not a projection
+ * (D-02) — and it takes no writer lease, because everything it writes lives in this file.
+ */
+declare function sweepEntityIndex(handle: EntityIndexHandle, descriptors: Iterable<EntityDescriptor>): EntityIndexSweepReport;
+/**
+ * Embed every row whose rendering has no vector yet, returning how many were embedded.
+ *
+ * Separate from `refreshEntity` on purpose. Projecting an entity is synchronous and always
+ * possible; embedding one needs a model that a floor host may not have. Splitting them is what
+ * lets the degradation ladder work by omission — an index with no vectors simply serves its
+ * lexical leg, and the resolver rides that without a posture flag anywhere.
+ *
+ * A profile change invalidates every stored vector rather than mixing two geometries in one
+ * table, which is the same disposability law the records index applies to its own.
+ */
+declare function embedPendingEntities(handle: EntityIndexHandle, embedder: EmbedderPort, profile?: EmbeddingProfile): Promise<number>;
+
+/**
+ * One store's answer to "do you own an entity with exactly this machine id?".
+ *
+ * A port rather than a switch over kinds, because each kind's machine ids live behind a
+ * different store and the tracer wires only one of them. 387-03 adds sources for the
+ * remaining kinds and neither this function nor its callers change.
+ */
+interface EntitySightingSource {
+    readonly kind: EntityKind;
+    /** The entity with this exact machine id, or `undefined`. Never a fuzzy match. */
+    sight(machineId: string): EntitySighting | undefined;
+    /** The entity a minted address maps back to, for rendering a ledger hit. */
+    hydrate(machineId: string): EntitySighting | undefined;
+}
+/** What a store reports about one of its entities. Facts only — no card, no address. */
+interface EntitySighting {
+    readonly machineId: string;
+    readonly title: string;
+    /**
+     * The status as the OWNING store reports it. Validated against the kind's closed union at
+     * the card boundary (D-12), not here: this layer reports, the producer renders, and the
+     * schema refuses. Three responsibilities, three places.
+     */
+    readonly statusSource: string;
+}
+interface ResolveEntityRefDeps {
+    readonly ledger: AddressingLedger;
+    readonly sources: readonly EntitySightingSource[];
+    /**
+     * The D-06 projection, maintained by USE.
+     *
+     * Optional, and that is the degradation ladder rather than a convenience: a composition that
+     * supplies no index gets tier (a) and the honest `none` arm, which is exactly what 387-01
+     * shipped. Nothing here silently becomes a guess when the projection is absent.
+     */
+    readonly entityIndex?: EntityIndexHandle;
+    /** Test/integration seam for tier (b)'s dense leg; omission runs the acquisition ladder. */
+    readonly embedder?: EmbedderPort;
+}
+/**
+ * Every entity the ledger has ever addressed and a source can still describe.
+ *
+ * This is the set `rebuildEntityIndex` is rebuilt FROM and the set the daemon sweep re-renders
+ * (D-06). It reads the LEDGER, never the index: a projection rebuilt from itself would
+ * preserve exactly the state a rebuild is run to be rid of.
+ *
+ * An address whose source can no longer describe it is skipped rather than projected as a
+ * husk. The address keeps resolving through tier (a) either way — D-04's permanence lives in
+ * the ledger — but a row with no title is not something fuzzy text should ever match.
+ */
+declare function describeAllEntities(deps: ResolveEntityRefDeps): EntityDescriptor[];
+/**
+ * THE sighting leg (D-01): exact machine-id equality, mint, project, describe.
+ *
+ * Extracted so the resolver's own leg and the LIST VERBS' sighting site are one mechanism
+ * rather than two that mint the same way today. D-01 names four sighting sites — a resolver
+ * hit, a card render, verdict authoring, a list verb — and a second minting path written for
+ * the fourth would be a second place where "first sighting mints" could stop being true, with
+ * nothing comparing them.
+ *
+ * `undefined` means no registered source recognises the id at all.
+ *
+ * EXACT equality, always. A prefix or case-insensitive comparison here would be tier (b)
+ * smuggled in below the never-guess contract. Sources are consulted in registered order so
+ * the answer does not depend on iteration accidents.
+ */
+declare function sightEntity(machineId: string, deps: ResolveEntityRefDeps): EntityResolution | undefined;
+/**
+ * Resolve a reference through the three tiers, minting on first sighting (D-01).
+ *
+ * Order matters and is fixed: URI, then short-ID, then exact machine id, then — for free text
+ * only — the hybrid tiers. Addresses are tried before machine ids because an address is
+ * unambiguous by construction, and a machine id that happened to LOOK like a short-ID would
+ * otherwise be able to shadow a published address.
+ *
+ * ASYNC because tier (b)'s dense leg is: an embedding query cannot be made synchronous, and
+ * the alternative — a second, synchronous entry that quietly answers with tier (a) only —
+ * would be a resolver that under-answers depending on which function a caller happened to
+ * import. The PORT this reaches surfaces through was already asynchronous, so no composition
+ * edge changes shape.
+ */
+declare function resolveEntityRef(ref: string, deps: ResolveEntityRefDeps): Promise<EntityResolution>;
+/**
+ * `entities.get`'s read path: the descriptor for an EXACT address, or `undefined`.
+ *
+ * Deliberately narrower than `resolveEntityRef` — it neither mints nor consults the sighting
+ * leg. `get` means "I already have the address", and a `get` that could mint would make every
+ * card render a potential write.
+ */
+declare function getEntityDescriptor(ref: string, deps: ResolveEntityRefDeps): EntityDescriptor | undefined;
+
+/**
+ * The two leg weights, and they are EQUAL for a reason that is not aesthetic.
+ *
+ * The degradation invariant (D-08) says a floor host may only produce MORE disambiguation,
+ * never a different answer. Floor mode is full mode minus the dense leg, so each candidate's
+ * floor score is its full score minus its own dense contribution. With equal weights the most
+ * any candidate can gain from the dense leg is one rank-1 contribution, which is what bounds
+ * how far the dense leg can reorder the lexical ranking — and that bound is what
+ * `RESOLVER_STRONG_HIT_MARGIN` is set against. Weighting the dense leg above the lexical one
+ * (as the `semantic` query-class vector does for records) would let the dense leg invert an
+ * ordering by more than the margin, and floor mode could then resolve to a different entity.
+ *
+ * The resolver therefore owns its own weights rather than importing a query-class vector: this
+ * pair is load-bearing for a safety property, and a vector tuned for record retrieval has no
+ * obligation to stay equal.
+ */
+declare const RESOLVER_LEG_WEIGHT_LEXICAL = 1;
+declare const RESOLVER_LEG_WEIGHT_DENSE = 1;
+/**
+ * The fused score of a candidate ranked first in EVERY leg — the scale's maximum.
+ *
+ * Derived rather than typed out, so a `C_RRF` change or a weight change moves the scale and
+ * the thresholds below keep meaning what they say. Dividing by it turns the fused score into
+ * agreement on [0, 1]: 1 means every leg put this candidate first, and exactly 0.5 means one
+ * leg put it first and the other did not rank it at all.
+ *
+ * This is a rescale by a constant and nothing else — it preserves the ordering `fuseWeightedRrf`
+ * produced, and no ranking decision is taken here. It exists so a card can print a number next
+ * to tier (a)'s 1.0 without inventing a second vocabulary for confidence.
+ */
+declare const RESOLVER_FUSED_SCORE_NORMALIZER: number;
+/**
+ * The absolute half of the D-07 rule: a strong hit is at the head of at least one leg.
+ *
+ * 0.5 is exactly one leg's rank-1 contribution on the normalised scale, and picking it says
+ * something narrow and true: a candidate that no leg ranked first is never a strong hit, no
+ * matter how far ahead of the runner-up it ended up. That case is reachable in practice — the
+ * index is refreshed on sighting, so it can hold a row for an entity whose owning store has
+ * since forgotten it; when that row heads a leg it is dropped after fusion, and the survivor
+ * behind it must NOT be promoted into a confident answer just because the leader vanished.
+ *
+ * Honest about its limits: on an RRF scale an absolute threshold cannot do much more than
+ * this. The fused top is always at least one leg's rank-1 contribution whenever any leg head
+ * survives, so a threshold below 0.5 would never fire, and a threshold above 0.5 would forbid
+ * a floor host from ever resolving anything — including a reference that matched exactly one
+ * entity. The discrimination work is therefore done by the margin below, which is where the
+ * two-part rule's second half earns its place rather than restating the first.
+ *
+ * The corpus report confirms both halves of that claim rather than only the comfortable one:
+ * 31 of its 110 cases resolve at the floor, so the threshold is not quietly forbidding the
+ * floor rung; and the case where a leg head is dropped after fusion still refuses, so it is not
+ * quietly permitting a survivor to inherit a leader's confidence.
+ */
+declare const RESOLVER_STRONG_HIT_MIN_SCORE = 0.5;
+/**
+ * The margin half of the D-07 rule, and the number that makes a safety property structural.
+ *
+ * A candidate can gain at most 0.5 on the normalised scale by being ranked first in the dense
+ * leg. For floor mode (which has no dense leg) to resolve entity E while full mode resolves a
+ * DIFFERENT entity Z, the dense leg would have to move Z past E by more than twice the margin.
+ * Any margin above 0.25 therefore makes that impossible rather than unlikely: floor mode can
+ * only ever produce the same resolved entity or refuse to resolve at all. 0.26 is the pinned
+ * value with room above the bound so an adjacent-rank rounding difference cannot reach it.
+ *
+ * Its everyday meaning is simpler: a strong hit is one the legs AGREE on more than they agree
+ * on anything else. Two near-twins ranked 1 and 2 differ by 0.016 and always disambiguate —
+ * including the equal-strength typo case, which differs by exactly zero and therefore cannot
+ * be resolved by any positive margin at all (D-07).
+ *
+ * WHERE THE BOUNDARY ACTUALLY IS, measured by the 387-05 corpus rather than argued.
+ *
+ * The 0.25 above comes from a CONTINUOUS inequality, and this scale is not continuous. A floor
+ * host's score comes from the lexical leg alone, so its top is one leg's rank-1 contribution
+ * (0.5) and its runner-up, when it has one, is rank 2 (0.4919). The largest margin a floor host
+ * can therefore ever clear against a rival is the gap between two adjacent ranks — 1/124, about
+ * 0.00806 — and above that the floor can only resolve a reference that matched exactly ONE
+ * entity, which no dense leg can reorder. So the real bound is thirty times smaller than the
+ * one the paragraph above derives, and 0.26 clears both with room to spare.
+ *
+ * That is not a licence to lower it. The corpus runs its whole population through this same
+ * rule at several margins and reports what it finds: no divergence at 0.26, none at 1.5×1/124,
+ * and a real one BELOW 1/124, where a case whose two lexical candidates sit 0.008 apart resolves
+ * the first at the floor while the dense leg promotes the second in full. That measurement is
+ * what makes the invariant's test a gate rather than an arithmetic tautology — and it is only
+ * reachable because the decision is applied through one exported function (`applyStrongHitRule`)
+ * that the corpus can hand a different margin. Nothing in production passes it one.
+ *
+ * Retune only alongside `RESOLVER_STRONG_HIT_MIN_SCORE`, and only against the corpus report
+ * named at the top of this file: dropping below 1/124 trades the degradation guarantee for
+ * recall, and dropping to 0.25 or below gives up the argument that it cannot be traded at all.
+ */
+declare const RESOLVER_STRONG_HIT_MARGIN = 0.26;
+/**
+ * How many candidates each leg is asked for.
+ *
+ * Larger than the top-3 a disambiguation card shows, because fusion needs to SEE the runner-up
+ * to refuse: a leg truncated at 3 would hide the competitor that should have turned a resolve
+ * into a disambiguation. Bounded because the entity corpus is bounded by what a human can name.
+ */
+declare const RESOLVER_CANDIDATE_K = 32;
+/**
+ * The lexical admission floor for the ENTITY corpus, which is not the records corpus floor.
+ *
+ * `TAU_LEX` is 6.86, calibrated from a recorded serving replay over knowledge records. Measured
+ * against entity renderings on 2026-08-02, the entire observed positive BM25 range was 0.0 to
+ * 3.24 — an entity rendering is six words where a record rendering is a paragraph, so the two
+ * corpora are not on the same scale and `TAU_LEX` rejects EVERY entity lexical candidate. The
+ * dense leg keeps its own floor, `tau_dense`, which is profile-owned and therefore correct
+ * wherever it is applied; only the lexical floor is corpus-specific, and applying a record
+ * corpus's number here would have silently deleted the lexical leg.
+ *
+ * Zero means "the FTS query matched at all", and that is deliberately permissive. Under the
+ * never-guess rule a weak extra candidate can only ADD a runner-up, and a runner-up can only
+ * turn a resolve into a disambiguation — never into a different answer, because `lexicalLeg`
+ * orders by BM25, so a genuine match always outranks a noise match. Raising this floor would
+ * make small corpora answer `none` where several entities plainly do mention the word, which
+ * is a worse lie than an honest disambiguation card.
+ */
+declare const RESOLVER_LEXICAL_MIN_BM25 = 0;
+
+/** Build the MEM sighting source over a knowledge root. */
+declare function createMemorySightingSource(resolveKnowledgeRoot: () => string): EntitySightingSource;
+
+/**
+ * Read side of the fingerprint-keyed recurrence window (Phase 390, D-07).
+ *
+ * `run_fingerprint_windows` is written by `applyRunOutcomes`; this module is the one place that
+ * queries it. Strictly read-only: prepared SELECTs, no statement that mutates a row, ever — the
+ * writer half stays whole in `run-outcomes.ts`, exactly as `run-outcome-read.ts` does for the
+ * per-test counters it is the sibling of.
+ *
+ * KEY LAW — a window row is addressed by `(product, fingerprint)`. Stable test identity
+ * `(product, filePath, testName)` travels ON the row because a crossing has to name the test it
+ * quarantines, but it is never part of the recurrence key: one fingerprint may be exercised by
+ * several tests, and D-07's rule is about the FAILURE recurring, not the test.
+ *
+ * THE WINDOW SLIDES OVER ORDINALS, NOT RUNS (D-07). Recurrence is counted over the ordinal range
+ * `[current - QUARANTINE_WINDOW_ORDINALS + 1, current]`:
+ *
+ *  - two failing runs inside ONE build ordinal count once (the numerator counts DISTINCT ordinals),
+ *  - a failure at ordinals 5/7/9 still crosses at 9 even though no two runs were consecutive,
+ *  - and an occurrence that has slid out of the range is FORGIVEN. That is the whole point of a
+ *    window: the lifetime `flake_count` never forgives, which is exactly why D-07 demoted it to a
+ *    ranking input and made this the trigger substrate instead.
+ *
+ * `windowOrdinals` is the honest denominator: how many distinct ordinals in the range this product
+ * recorded a failure in at all. A caller renders "3rd occurrence in 5 builds" from the pair, and an
+ * empty window answers typed zeros rather than an absence a renderer has to guess about.
+ *
+ * PRECONDITION — the caller supplies a connection where `ensureRunOutcomeTables` has run (every
+ * `openIndexWriter` does). A read-only connection against a store predating these tables raises
+ * sqlite's `no such table`, which the composition layer folds to typed absence the same way it
+ * already does for `readTestOutcomeHistory`.
+ */
+
+/**
+ * §7.3's locked detection window, verbatim: the same fingerprint recurring within the last five
+ * build ordinals. A pinned constant with no config key (386 D-15) — retune it from operational
+ * evidence, in the source, where the change is reviewable. Plan 05's rule reads the threshold
+ * against this window; D-10's auto-exit is symmetric with it by design.
+ */
+declare const QUARANTINE_WINDOW_ORDINALS = 5;
+/** The recurrence key: the failure, inside one product partition. */
+interface FingerprintWindowIdentity {
+    product: string;
+    fingerprint: string;
+}
+/** One window row, as the writer stored it. */
+interface FingerprintWindowRow {
+    product: string;
+    filePath: string;
+    testName: string;
+    fingerprint: string;
+    verdictClass: VerdictClass;
+    buildOrdinal: number;
+    runId: string;
+}
+interface FingerprintRecurrence {
+    /** DISTINCT build ordinals inside the window carrying this fingerprint. */
+    occurrenceOrdinals: number;
+    /** DISTINCT build ordinals inside the window carrying ANY failure for this product. */
+    windowOrdinals: number;
+}
+/**
+ * Every stored row for one fingerprint inside the bounded read scope, ordinal-ascending.
+ *
+ * The read scope is the last {@link LAST_OUTCOMES_LIMIT} ordinals rather than the detection window,
+ * so a caller that wants to SHOW the recent history (D-10's M-consecutive-passes exit, the list
+ * verb) sees the same depth the per-test outcome window carries. An identity the projection never
+ * recorded answers `[]` — typed absence, never a stand-in row.
+ */
+declare function readFingerprintWindow(db: DatabaseSync, identity: FingerprintWindowIdentity, currentBuildOrdinal: number): FingerprintWindowRow[];
+/**
+ * One fingerprint's recurrence over the sliding ordinal window (D-07) — computed LIVE on every
+ * call, never stored. Both legs count DISTINCT ordinals, which is what makes two failing runs in
+ * one build one occurrence.
+ */
+declare function fingerprintRecurrence(db: DatabaseSync, identity: FingerprintWindowIdentity, currentBuildOrdinal: number): FingerprintRecurrence;
+
+declare const LEASE_FILE = ".lease";
+declare const EPOCH_FILE = ".epoch";
+/** Provisional writer-heartbeat TTL; retune from operational evidence without adding config. */
+declare const LEASE_HEARTBEAT_TTL_MS = 30000;
+/** Bounded mutation-lock takeover; retune from operational evidence without adding config. */
+declare const MUTATION_LOCK_TAKEOVER_MS = 45000;
+/** Authority-store filename is pinned; retune only through a data-migration plan. */
+declare const WRITER_AUTHORITY_DB_FILE = ".writer-authority.sqlite";
+/**
+ * Provisional SQLite contention window; retune from operational evidence without adding config.
+ *
+ * The takeover deadline remains separate: this short timeout makes each failed write attempt
+ * observable so the contender can apply the lease and verified-termination policy.
+ */
+declare const MUTATION_LOCK_BUSY_TIMEOUT_MS = 2000;
+/**
+ * Transient guard serializing the beat's read-check-write with release's read-check-delete.
+ *
+ * A directory holding exactly one `owner-<token>` file, published whole by renaming a staged
+ * directory into place. It lives under `memory/queue/`, which every scaffolded knowledge
+ * `.gitignore` already ignores, so neither a guard in use nor one a crash left behind is ever a
+ * commit-visible file in a user's knowledge repository (261002-lse follow-up; the user's
+ * `.gitignore` is never rewritten, D-22).
+ */
+declare const LEASE_GUARD_DIR = "memory/queue/lease-guard";
+declare const writerLeaseSchema: z.ZodObject<{
+    leaseId: z.ZodString;
+    pid: z.ZodNumber;
+    epoch: z.ZodNumber;
+    heartbeatAtMs: z.ZodNumber;
+}, z.core.$strict>;
+type WriterLease = z.infer<typeof writerLeaseSchema>;
+/** What the contender could observe about the owner it gave up on; never an authority claim. */
+interface UnreclaimableMutationLockOwner {
+    pid: number;
+    acquiredAtMs: number;
+    generationToken: string;
+    /** False when the row carries no incarnation, which is why escalation could never fire. */
+    incarnationAttributed: boolean;
+}
+type AcquireWriterLeaseOutcome = {
+    kind: 'held';
+    holder: WriterLease;
+} | {
+    kind: 'acquired';
+    leaseId: string;
+    epoch: number;
+    reclaimed?: WriterLease;
+} | {
+    kind: 'refused';
+    reason: 'corrupt-epoch-state';
+    error: CorruptEpochStateError;
+} | {
+    /**
+     * CR-01 (round 5): the lease file's own sibling of `corrupt-epoch-state`.
+     *
+     * `code` is the raw errno so an operator sees EACCES rather than a contender that silently
+     * spun to its deadline over an authority state nobody can evaluate; `error` keeps this arm
+     * inside the union's stated contract that every refusal is rethrowable.
+     */
+    kind: 'refused';
+    reason: 'unreadable-lease-state';
+    code: string;
+    error: UnreadableWriterLeaseStateError;
+} | {
+    kind: 'refused';
+    reason: 'mutation-lock-unreclaimable';
+    /**
+     * Both refusal arms carry a thrown-shaped `error` ON PURPOSE.
+     *
+     * Every caller of this union already renders `refused` as `[reason]: error.message` or
+     * rethrows it, so a new arm that also carries one is surfaced by name at every entry point —
+     * including any added later — without a list of call sites to keep in step. Naming the
+     * refusal is the requirement; enumerating the callers who must name it is the failure mode
+     * this phase keeps rediscovering.
+     */
+    error: WriterLeaseUnreclaimableError;
+    attempts: number;
+    waitedMs: number;
+    observedOwner?: UnreclaimableMutationLockOwner;
+    observedLease?: WriterLease;
+};
+interface LeaseOperationOptions {
+    knowledgeRoot: string;
+    leaseId: string;
+}
+/** Test/chaos seam on the lease-file guard taken by `heartbeatLease` and `releaseLease`. */
+interface LeaseGuardHooks {
+    /** Fires once, when the guard is first found held by a live section other than this caller's. */
+    onLeaseGuardContended?: () => void;
+    /** Fires each time a guard has been judged residue, before this caller reclaims it. */
+    beforeLeaseGuardReclaim?: () => void;
+    /** Fires inside a reclaim, after its first step and before its last. */
+    duringLeaseGuardReclaim?: () => void;
+}
+type HeartbeatLeaseOutcome = {
+    kind: 'heartbeated';
+    holder: WriterLease;
+} | {
+    kind: 'refused';
+    reason: 'lease-missing' | 'lease-malformed'
+    /** CR-01: the lease exists and could not be opened — never write over what you cannot read. */
+     | 'lease-unreadable' | 'lease-id-mismatch' | 'stale-epoch' | 'corrupt-epoch-state';
+    holder?: WriterLease;
+    observedEpoch?: number;
+    error?: CorruptEpochStateError;
+};
+type ReleaseLeaseOutcome = {
+    kind: 'released';
+} | {
+    kind: 'refused';
+    reason: 'lease-missing' | 'lease-malformed' | 'lease-unreadable' | 'lease-id-mismatch';
+    holder?: WriterLease;
+};
+/** Exact writer identity carried by governed maintenance mutators. */
+interface WriterLeaseAuthority extends LeaseOperationOptions {
+    epoch: number;
+}
+type WriterAuthorityLostReason = Extract<HeartbeatLeaseOutcome, {
+    kind: 'refused';
+}>['reason'] | 'epoch-mismatch-before-heartbeat' | 'epoch-mismatch-after-heartbeat' | 'mutation-lock-generation-lost';
+/** Fail-closed maintenance refusal with the holder and fresh disk epoch attached. */
+declare class WriterAuthorityLostError extends Error {
+    readonly name = "WriterAuthorityLostError";
+    readonly authority: WriterLeaseAuthority;
+    readonly reason: WriterAuthorityLostReason;
+    readonly observedEpoch: number;
+    constructor(authority: WriterLeaseAuthority, reason: WriterAuthorityLostReason, observedEpoch: number);
+}
+type CorruptEpochStateReason = 'unreadable' | 'malformed' | 'overflow';
+/** Fail-closed authority-state error; callers must never substitute epoch zero for this state. */
+declare class CorruptEpochStateError extends Error {
+    readonly name = "CorruptEpochStateError";
+    readonly path: string;
+    readonly reason: CorruptEpochStateReason;
+    readonly rawPreview: string;
+    constructor(path: string, reason: CorruptEpochStateReason, rawPreview: string);
+}
+/**
+ * Fail-closed acquisition refusal after the deadline; carries why the wait could not end well.
+ *
+ * A contender that gives up is reporting a fact about the SYSTEM, not about itself, so the
+ * diagnostics travel with the error: the owner it kept losing to, whether that owner was even
+ * attributable (an unattributed row can never be escalated against, which is usually the whole
+ * story), and the lease it kept reading. `agent-qa daemon` prints this and exits non-zero where it
+ * previously hung with no output at all.
+ */
+declare class WriterLeaseUnreclaimableError extends Error {
+    readonly name = "WriterLeaseUnreclaimableError";
+    readonly reason: "mutation-lock-unreclaimable";
+    readonly attempts: number;
+    readonly waitedMs: number;
+    readonly observedOwner?: UnreclaimableMutationLockOwner;
+    readonly observedLease?: WriterLease;
+    constructor(attempts: number, waitedMs: number, observedOwner?: UnreclaimableMutationLockOwner, observedLease?: WriterLease);
+}
+/**
+ * The lease file's sibling of `CorruptEpochStateError`, for a read that produced no throwable.
+ *
+ * `readFileSync` threw, but the value that reaches a consumer is a kinded outcome rather than an
+ * exception, and `AcquireWriterLeaseOutcome`'s own contract is that EVERY refusal arm carries a
+ * thrown-shaped `error` — three call sites rethrow or render it without knowing which arm they
+ * hold (`drain.ts:842` among them). A refusal that carried only an errno string would have made
+ * that contract a list of call sites to keep in step, which is the failure mode this module keeps
+ * rediscovering. Deliberately not re-exported from the package index (IN-04): the refusal is fully
+ * legible from `reason`, `code` and `error.message`.
+ */
+declare class UnreadableWriterLeaseStateError extends Error {
+    readonly name = "UnreadableWriterLeaseStateError";
+    readonly path: string;
+    readonly code: string;
+    constructor(path: string, code: string);
+}
+/**
+ * The authority-file read verdict, and it has four values rather than three.
+ *
+ * Round-5 CR-01: `unreadable` is the sibling of the epoch read's
+ * `CorruptEpochStateError(…, 'unreadable', …)`. A file that EXISTS and could not be opened is a
+ * different fact from a file that is not there and from a file whose bytes were read and failed to
+ * parse, and the previous three arms had nowhere to put it — so EACCES, EIO, EMFILE and ENFILE all
+ * landed on `malformed`, which every consumer reads as "nobody holds authority". `code` carries
+ * the errno so the refusal that follows can name the cause to an operator.
+ */
+type ReadWriterLeaseOutcome = {
+    kind: 'absent';
+} | {
+    kind: 'malformed';
+} | {
+    kind: 'unreadable';
+    code: string;
+} | {
+    kind: 'parsed';
+    lease: WriterLease;
+};
+/**
+ * Opaque process-incarnation token for one pid, anchored OUTSIDE any value this module writes.
+ *
+ * CR-04: a durable row's pid is not an identity. Once the recorded process dies, the kernel is
+ * free to hand that number to a stranger, and every later decision keyed on the number alone
+ * (above all `SIGKILL`) targets whoever holds it now. The one fact that distinguishes them is
+ * assigned by the OS and cannot be forged from inside the store: when the process at that pid
+ * started.
+ *
+ * Linux reads field 22 (`starttime`) of `/proc/<pid>/stat`, counted from the LAST `)` because the
+ * `comm` field is parenthesised and may itself contain spaces and parentheses. Other POSIX hosts
+ * read `/bin/ps -p <pid> -o lstart=` in the C locale and UTC, so every reader renders one start
+ * time as one token. Windows has no equivalent builtin, so it resolves to `undefined` and every
+ * incarnation check there fails closed.
+ *
+ * Returns `undefined` — never throws — whenever the pid cannot be attributed. `undefined` means
+ * "do not signal", never "safe to signal".
+ *
+ * WR-04: `timeoutMs` bounds the POSIX arm's `ps` fork, which is the last wait beneath the
+ * acquisition deadline that used to be able to outlive it — a wedged `ps` never returns, and this
+ * resolution sits directly on the pre-signal path. A cap that expires resolves
+ * through the SAME funnel every other failure uses (`undefined`), so a timed-out resolution is
+ * unverifiable and therefore signal-ineligible. Callers with no budget of their own omit it.
+ *
+ * 386-32 consumes this same helper for the embedder-worker signal path, so both kill paths speak
+ * one incarnation vocabulary.
+ */
+declare function resolveProcessIncarnation(pid: number, timeoutMs?: number, psExecutable?: string): string | undefined;
+interface MutationLockOptions {
+    /** Test/chaos seam after the claim is committed and before the held transaction begins. */
+    afterMutationLockClaimed?: (generationToken: string) => void;
+    afterMutationLockAcquired?: () => void;
+    /** Test/chaos seam inside acquisition, after the epoch rewrite and before lease publication. */
+    afterEpochRewrite?: () => void;
+    mutationLockTakeoverMs?: number;
+    /**
+     * Test-only observation of every process-incarnation resolution the escalation path performs.
+     *
+     * Purely an observer, never a replacement: the production resolver still runs, so what a test
+     * counts is what a daemon pays. It exists because the cost being bounded (a `ps` fork per
+     * resolution, on the caller's main thread) is invisible to any assertion about outcomes.
+     */
+    onProcessIncarnationResolved?: (pid: number) => void;
+    psExecutable?: string;
+}
+interface AcquireWriterLeaseOptions extends MutationLockOptions {
+    /**
+     * Test/chaos seam for the pinned acquisition deadline; production never sets it.
+     *
+     * The same shape as `mutationLockTakeoverMs` and the heartbeat supervisor's `stopTimeoutMs`: a
+     * real unreclaimable wait is 60 s, which no test can afford to sit through, and shortening the
+     * window is the only way to reach the refusal branch (D-15 — a seam, never a config key).
+     */
+    acquireDeadlineMs?: number;
+}
+interface CurrentWriterAuthority {
+    leaseId: string;
+    epoch: number;
+}
+interface CurrentWriterAuthorityHooks extends MutationLockOptions {
+    /** Test/chaos seam after the lock-held epoch comparison and before mutation. */
+    afterFinalAuthorityCompare?: () => void;
+}
+/**
+ * Read and strictly validate current writer authority without acquiring or refreshing it.
+ *
+ * CR-01 (round 5): ENOENT is the only read failure that is evidence of absence, and NO read
+ * failure is evidence of corruption. This is `readEpoch`'s rule applied to the file it was not
+ * applied to — the derivation's own W-01 note says the guard belongs at the READ, so that
+ * consumers inherit it rather than each re-deriving it, and this read has three consumers that
+ * select SIGKILL, epoch minting and registration deletion from its answer.
+ *
+ * The `existsSync` fallback that used to sit here is deleted rather than kept beside the errno
+ * test: under fd exhaustion it fails for the same reason the open did, so it degraded an EMFILE
+ * read from `malformed` to `absent` — the strongest possible statement that nobody holds the
+ * lease, produced by the weakest possible evidence.
+ */
+declare function readWriterLease(knowledgeRoot: string): ReadWriterLeaseOutcome;
+/** Purely classify a guarded or untrusted lease value against one explicit wall-clock instant. */
+declare function isLeaseStale(lease: unknown, nowMs: number): boolean;
+/**
+ * The one freshness answer, and it has three values rather than two.
+ *
+ * CR-01: the previous derivation returned a boolean, so every way of failing to READ the epoch
+ * collapsed into the same value a genuinely expired lease produces. `readEpoch` raises
+ * `CorruptEpochStateError(…, 'unreadable', …)` for EACCES, EIO, EMFILE and ENFILE, not only for
+ * corrupt bytes, and fd exhaustion produces both that failure and the daemon identity-handshake
+ * failure at once. A live, healthy holder therefore became de-registrable and SIGKILL-eligible on
+ * a transient read error.
+ *
+ * `unknown` is deliberately NOT resolved to either boolean here. Resolving it toward "fresh" makes
+ * a permanently unreadable epoch an immortal phantom holder no contender can ever reclaim;
+ * resolving it toward "reclaimable" is the kill this closes. It is returned to the consumers so
+ * each of them names what it does with it, and so a fourth consumer added later cannot inherit a
+ * default it never chose.
+ *
+ * W-01: the epoch conjunct lives HERE, in the derivation, not at the consumers. Three surfaces
+ * classify recoverability from this verdict — `leasePermitsEscalation`, the acquisition
+ * pre-check, and `classifyDaemonRegistration` in the CLI — and a fix applied consumer by consumer
+ * is a list that the next surface joins without joining the guard. A lease naming a superseded
+ * epoch is recovery input no matter how fresh its bytes are: nobody can still be inside a
+ * transaction for an epoch that has already been replaced.
+ *
+ * WR-04: a crash between the epoch rewrite and the lease rewrite leaves a lease naming the
+ * previous epoch. Reporting that lease as held manufactures a phantom holder no TTL sweep ever
+ * reclaims, so an epoch-invalid lease is recovery input rather than an answer.
+ *
+ * The inputs are the disk epoch and the lease value, and nothing else. There is no second
+ * freshness channel and no further conjunct: three conjuncts produced three defects.
+ */
+type WriterLeaseFreshness = {
+    kind: 'fresh';
+} | {
+    kind: 'reclaimable';
+} | {
+    kind: 'unknown';
+    error: CorruptEpochStateError;
+};
+declare function deriveWriterLeaseFreshness(knowledgeRoot: string, lease: WriterLease, nowMs: number): WriterLeaseFreshness;
+/** Return a live holder or atomically mint a new, monotonically fenced writer identity. */
+declare function acquireWriterLease(knowledgeRoot: string, hooks?: AcquireWriterLeaseOptions): AcquireWriterLeaseOutcome;
+/**
+ * Compare one exact writer authority and run its mutation under the same generation lock.
+ * The generation check after the failpoint prevents an expired owner from resuming after a
+ * bounded takeover. Mutation implementations must keep irreversible work inside `mutate`.
+ */
+declare function withCurrentWriterAuthority<T>(knowledgeRoot: string, authority: CurrentWriterAuthority, mutate: () => T, hooks?: CurrentWriterAuthorityHooks): T;
+/**
+ * Refresh the matching current-epoch holder without entering the mutation lock.
+ *
+ * CR-03 dissolves here rather than being worked around. The beat used to share
+ * `withMutationLock` with every governed write, and it runs in a worker THREAD, so the daemon's
+ * long synchronous mutation on the main thread held the lock while the worker blocked on it: the
+ * holder starved its own heartbeat, crossed the TTL and became a takeover target. Writing `.lease`
+ * directly means a governed mutation of any length cannot starve the beat at all, so heartbeat
+ * independence is structural instead of a fallback that has to be maintained beside the real path.
+ *
+ * What the lock used to buy was check-then-write atomicity of the identity/epoch ladder below
+ * against a concurrent reclaim, and dropping it opens exactly one race: a holder resuming from a
+ * >=TTL wedge can land its read-check-write astride a contender's reclaim and clobber the
+ * successor's lease. That is contained rather than prevented, and the containment is the epoch
+ * fence: a reclaim rewrites `.epoch` strictly BEFORE it publishes its lease, both inside the lock,
+ * so any lease clobbered afterwards names a superseded epoch. Every classifier reads it as
+ * recovery input, no store write is admitted under it (the epoch fence at the store verbs), and
+ * the successor's next authority check surfaces WriterAuthorityLostError, after which a fresh
+ * acquisition reclaims at the next epoch. The worst case is one successor bounce in a microsecond
+ * window after a 30 s wedge — a liveness hiccup, never minted authority. During the exact schedule
+ * this lock-free write exists for (the holder's own mutation in flight) no contender can be
+ * mid-reclaim at all, because a reclaim requires the very lock that mutation is holding.
+ *
+ * 2026-08-01 W-02 re-scope: `MUTATION_LOCK_TAKEOVER_MS` now governs reclaim from DEAD and
+ * whole-process-STOPPED owners, which write no beats and cross the TTL. Auto-takeover of a LIVE
+ * holder whose beat thread is still ticking is deliberately impossible; a wedged-forever live
+ * daemon surfaces at every contender as the typed `mutation-lock-unreclaimable` refusal naming its
+ * pid. That is an operator kill rather than an automated one, which is this module's own law: a
+ * wrong kill is unrecoverable, a wedged contender is not.
+ *
+ * Identity is still proven first, and every refusal below leaves `.lease` byte-identical.
+ *
+ * 2026-10-02 (quick 261002-lse, 432-19 #7): the ladder and the write run under the lease-file
+ * guard `releaseLease` also takes. Without it a beat that read before a release wrote after it,
+ * and since release deliberately keeps the epoch, the resurrected lease named the CURRENT epoch:
+ * the fence above contains a reclaim but not a release, and the next acquire answered `held`.
+ * The guard is not the mutation lock, so everything said above about CR-03 still holds.
+ */
+declare function heartbeatLease(opts: LeaseOperationOptions, hooks?: LeaseGuardHooks): HeartbeatLeaseOutcome;
+/**
+ * Refresh one exact maintenance writer at a non-mutating boundary.
+ *
+ * The epoch reads deliberately bracket the heartbeat: the first rejects an already-reclaimed
+ * holder, while the second detects a reclaim race after the lease rewrite. The authority-store
+ * transaction is released before this function returns, so this is NOT a mutation fence. Any
+ * irreversible mutation must instead run inside `withCurrentWriterAuthority`.
+ */
+declare function refreshWriterLeaseAuthority(authority: WriterLeaseAuthority): WriterLeaseAuthority;
+/**
+ * Remove only the matching lease file; the monotonic epoch is deliberately retained forever.
+ *
+ * The read and the deletion run under the lease-file guard, taken inside the mutation lock, so a
+ * heartbeat in flight finishes before the lease is read and any later beat finds it gone
+ * (261002-lse). The guard is always taken second, and the beat never takes the mutation lock, so
+ * the two cannot wait on each other.
+ */
+declare function releaseLease(opts: LeaseOperationOptions, hooks?: LeaseGuardHooks): ReleaseLeaseOutcome;
+
+/**
+ * What a manually added window records where an auto-entry records the fingerprint that crossed.
+ *
+ * A human quarantining a known-broken test is not reporting a recurrence, so there is no window key
+ * to carry — and the `entered` event REQUIRES one (an entry with no fingerprint would fail the
+ * ledger's own shape guard). A typed literal that cannot be mistaken for a real key is the honest
+ * answer: every computed fingerprint contains `::`, this one contains none.
+ */
+declare const QUARANTINE_MANUAL_ENTRY_FINGERPRINT = "manual-entry";
+/**
+ * The class a manual entry records: `unknown`, on the merits rather than for convenience.
+ *
+ * `unknown` is precisely "a failure carrying no verdict" — nothing classified this test, because a
+ * human decided to suppress it rather than a detector deciding it recurred. Recording a made-up
+ * `flake` would put an assertion nobody made into committed truth, and the detection ladder reads
+ * the class of AUTO entries only, so no rule changes behaviour on the strength of this value.
+ */
+declare const QUARANTINE_MANUAL_ENTRY_CLASS: VerdictClass;
+/**
+ * The `filePath` a caller sent cannot mint the durable identity the ledger is keyed on (390-12).
+ *
+ * Same shape and same reason as the lease refusal above: the port's result unions carry no refusal
+ * arm by design (390-04), so a refusal that is not one of the named outcomes surfaces as a typed
+ * throw. Raised BEFORE the knowledge root is resolved, before the lease is acquired and before a
+ * byte is read, so a refused call costs the ledger nothing and the next writer nothing.
+ *
+ * WHAT THIS OWNS, AND WHAT THE LEDGER'S OWN WRITE GUARD OWNS (390-11). They are not two spellings
+ * of one rule and neither subsumes the other:
+ *
+ *  - THIS decides what the identity IS. It is the only gate that knows the checkout root, so it is
+ *    the only one that can turn `/Users/me/repo/tests/a.yaml` — a real file inside the workspace,
+ *    the exact bytes an operator pastes out of a failure report — into `tests/a.yaml` and ACCEPT
+ *    it. The structural guard would refuse that input; refusing it is the wrong answer, because
+ *    the operator named a file the workspace genuinely contains.
+ *  - The STRUCTURAL guard in `appendQuarantineEvents` decides what the FILE may carry, for every
+ *    writer including one that never met a mint. It is a backstop with no host context, and it
+ *    throws rather than answering data because a line the reader refuses is corruption.
+ *
+ * What cannot be canonicalized at all — a path escaping the config directory — is refused here,
+ * with the mint's own message carried so the operator learns why rather than that.
+ */
+declare class QuarantineIdentityRefusedError extends Error {
+    readonly filePath: string;
+    readonly reason: unknown;
+    constructor(filePath: string, reason: unknown);
+}
+interface QuarantineOperationsOptions {
+    /** The committed knowledge root. A FACTORY, because the CLI host resolves it asynchronously. */
+    resolveKnowledgeRoot: () => Promise<string> | string;
+    /** The ONLY way wall clock enters these verbs. Required — see the module head. */
+    now: () => string;
+    /**
+     * Mints the durable workspace-relative identity a `filePath` is stored under (390-12 / D-01).
+     *
+     * Production supplies core's ONE recipe, `workspaceRelativeIdentityPath`, pre-bound to the host's
+     * own config directory. INJECTED rather than imported for two independent reasons, and either
+     * alone would be sufficient: this package may not depend on `@vostride/agent-qa-core` (only the
+     * surface packages may), and — the load-bearing one — the checkout root is a HOST fact these
+     * verbs cannot discover. A verb that guessed it would mint identities against the wrong root.
+     *
+     * REQUIRED, with no default. A default passthrough is exactly the unvalidated pass-through that
+     * produced the round-2 regression: the verbs answered `entered` over lines the reader is
+     * guaranteed to refuse. An absent mint must be a compile error at the composition that forgot it,
+     * not a runtime surprise inside a committed artifact.
+     *
+     * @throws whatever the mint throws for a path it cannot canonicalize; re-raised as
+     * {@link QuarantineIdentityRefusedError}.
+     */
+    mintIdentityPath: (filePath: string) => string;
+    /**
+     * The writer lease THIS process already holds, when it holds one (387-08 D-18 / D-5).
+     *
+     * Supplied by the daemon host, which acquires at startup and holds for its whole lifetime: a
+     * holder that calls `acquireWriterLease` is answered `held` by itself and, unlike the apply path,
+     * has nobody to delegate to. Absent on the CLI in-process host, which holds nothing and therefore
+     * takes the lease per call.
+     *
+     * THE VALUE IS CONSULTED FOR FENCING (390-15 / G-390-2R), and this sentence used to say the
+     * opposite. It is re-validated against disk on every write verb, so the question it answers is
+     * "is this process STILL the holder?" rather than "did this process already serialize itself?".
+     * The two are the same question only while nothing reclaims: a daemon whose heartbeat starved
+     * and whose lease was then taken answers yes to the second one forever, and the two-OS-process
+     * harness measured what that costs — two `entered` lines for one identity, and the verb
+     * returning an owner committed truth does not record. See {@link underWriterLease}.
+     *
+     * AND WHAT THE RE-VALIDATION DOES NOT BUY (390-22 / WR-07): it is a read, not a lock. It answers
+     * "still the holder?" as of the read, and the decide it licenses runs after it. A reclaim landing
+     * between the two is still unfenced. `lease/under-writer-lease.ts` states the residual in full.
+     */
+    resolveWriterAuthority?: () => {
+        leaseId: string;
+        epoch: number;
+    } | undefined;
+}
+/**
+ * The three verbs over one committed ledger.
+ *
+ * Each call is a full read-fold-decide-append cycle. Nothing is cached between calls, which is what
+ * makes `quarantine.list` and the sentence's ladder clause two readings of ONE live computation
+ * (SC4): an event appended between two calls is visible to both.
+ */
+declare function createQuarantineOperations(options: QuarantineOperationsOptions): QuarantineOperationsPort;
+
+declare const ARTIFACT_STEP_CAP_BYTES: number;
+declare const ARTIFACT_RUN_CAP_BYTES: number;
+interface ArtifactCopyInput {
+    ref: ArtifactRef;
+    sourcePath: string;
+    stepIndex: number;
+    role?: string;
+    originalName?: string;
+}
+interface CopiedArtifact {
+    ref: ArtifactRef;
+    relPath: string;
+    bytes: number;
+    stepIndex: number;
+    role?: string;
+    originalName?: string;
+}
+type ArtifactCopySkipReason = 'step-cap' | 'run-cap' | 'pruned-source' | 'sha-mismatch';
+interface SkippedArtifact<Reason extends string = ArtifactCopySkipReason> {
+    ref: ArtifactRef;
+    stepIndex: number;
+    reason: Reason;
+}
+interface ArtifactCopyResult {
+    copied: CopiedArtifact[];
+    skipped: SkippedArtifact[];
+    evidenceIncomplete: boolean;
+}
+interface ArtifactCopyOptions {
+    /** Pre-copy refusals retained in the same inventory as copy-time refusals. */
+    preSkipped?: readonly SkippedArtifact[];
+    mask?: MaskFn;
+}
+declare function copyArtifacts(inputs: readonly ArtifactCopyInput[], destArtifactsDir: string, options?: ArtifactCopyOptions): ArtifactCopyResult;
+
+interface RenderedBundlePart {
+    relPath: string;
+    label: string;
+    text: string;
+}
+type BundleProvenanceInput = {
+    mode: 'run-linked';
+    runId: string;
+    testId: string;
+    stepIndex: number;
+    curationJobId?: string;
+    sourceBuildOrdinal?: number;
+    authorship?: CurationAuthorship;
+    needsEnrichment?: boolean;
+    withheld?: boolean;
+} | {
+    mode: 'standalone';
+    sourceDescription: string;
+};
+interface RenderBundlePartsInput {
+    draft: BundleDraft;
+    discriminant: BundleDiscriminant;
+    originClass: OriginClass;
+    createdAtOrdinal: number;
+    screenStates: readonly ScreenState[];
+    initialEvents: readonly BundleOutcomeEvent[];
+    relations: readonly BundleRelation[];
+    provenance: BundleProvenanceInput;
+    copiedArtifacts: ArtifactCopyResult;
+    evidenceIncomplete: boolean;
+    evidenceMarkdown?: string;
+    distilledObservations?: readonly DistilledObservation[];
+}
+declare function renderBundleParts(input: RenderBundlePartsInput): {
+    parts: RenderedBundlePart[];
+    id: RecordId;
+    identityHash: string;
+    identityCore: BundleIdentityCore;
+};
+
+interface BundleStoreConfig {
+    /** Absolute committed-root path. Deliberately no working-directory default. */
+    knowledgeRoot: string;
+    productKey: string;
+    commitArtifacts: 'none' | 'thumbnails';
+    /** Active writer identity used to attribute crash-left staging trees. */
+    writerLeaseId?: string;
+    /** Fencing epoch embedded in reader-invisible staging names. */
+    writerEpoch?: number;
+    hooks?: {
+        /** Test/chaos seam after all staged bytes exist but before the visibility rename. */
+        beforePublishRename?: () => void;
+        /** Test/chaos seam after each durable mutable-file replacement. */
+        afterMutableReplacement?: (targetRelPath: string) => void;
+    };
+}
+interface PublishBundleInput extends Omit<RenderBundlePartsInput, 'copiedArtifacts' | 'evidenceIncomplete'> {
+    artifacts: readonly ArtifactCopyInput[];
+    /** Refusals already decided by the Curator's pre-copy pass. */
+    preSkippedArtifacts?: readonly SkippedArtifact<ArtifactCopySkipReason>[];
+}
+type PublishBundleOutcome = {
+    kind: 'published';
+    id: RecordId;
+    dir: string;
+    evidenceIncomplete: boolean;
+} | {
+    kind: 'already-exists';
+    id: RecordId;
+} | {
+    kind: 'identity-collision';
+    id: RecordId;
+    dir: string;
+    reason: 'identity-hash-mismatch' | 'identity-core-mismatch' | 'existing-manifest-corrupt';
+    expectedIdentityHash: string;
+    existingIdentityHash: string | null;
+};
+
+/** Unfenced compatibility composition for test data setup only. */
+declare function publishBundle(config: BundleStoreConfig, input: PublishBundleInput): PublishBundleOutcome;
+
+type AppendOutcome = {
+    kind: 'appended';
+} | {
+    kind: 'duplicate';
+} | {
+    kind: 'not-found';
+};
+/** 416 D-04: receipt identity is its verified content digest, before any committed write. */
+declare function appendGateReceipt(config: BundleStoreConfig, id: RecordId, receipt: GateReceipt): AppendOutcome;
+/** 416 D-05/D-07: one promotion line per candidate/path; lifecycle bytes remain unchanged. */
+declare function appendPromotionReceipt(config: BundleStoreConfig, id: RecordId, lineWithoutDigest: Omit<PromotionReceipt, 'receiptDigest' | 'citedReceiptDigests'> & {
+    citedReceiptDigests: readonly string[];
+}): AppendOutcome;
+declare const MEASUREMENTS_REL_PATH = "evidence/measurements.json";
+declare function appendOutcomeEvent(config: BundleStoreConfig, id: RecordId, event: BundleOutcomeEvent): AppendOutcome;
+/**
+ * Persist D-03's immutable validity-window snapshot. An existing measurements
+ * file is an idempotent refusal: baseline bytes are never rewritten.
+ */
+declare function writeMeasurementBaseline(config: BundleStoreConfig, id: RecordId, baseline: MeasurementBaseline): AppendOutcome;
+/**
+ * Append one observation through the full journaled replacement path. Existing
+ * lines remain byte-for-byte unchanged; only the new canonical line is added.
+ */
+declare function appendMeasurementObservation(config: BundleStoreConfig, id: RecordId, observation: MeasurementObservation): AppendOutcome;
+declare function appendRelation(config: BundleStoreConfig, id: RecordId, relation: BundleRelation): AppendOutcome;
+
+type CanonicalBundleStateDigests = {
+    kind: 'found';
+    digests: string[];
+} | {
+    kind: 'not-found';
+};
+declare function readCanonicalBundleStateDigests(input: {
+    knowledgeRoot: string;
+    candidateId: string;
+}): CanonicalBundleStateDigests;
+
+/**
+ * The leg Channel-1 run-brief assembly attributes to. See the module header: the assembly's whole
+ * ordering signal is the scope/anchor token overlap, so this is a statement about the code that
+ * ranks, not a default.
+ */
+declare const CHANNEL_1_SERVING_LEG: RetrievalTraceLeg;
+/**
+ * The leg Channel-3 caution selection attributes to. Unambiguous here: a caution with no matching
+ * anchor is dropped before it is ever ranked.
+ */
+declare const CHANNEL_3_CAUTION_LEG: RetrievalTraceLeg;
+/**
+ * The legs a serving channel in this package can actually emit. This is the `knowledge-local` half
+ * of the cross-package vocabulary check the trace DTO asks for: the schema declares
+ * `RETRIEVAL_TRACE_LEGS`, the retrieval legs module declares a module-private `CandidateLeg`, and
+ * this package is the only one that can see both. Exported so a test can assert the three sets
+ * agree instead of a comment claiming they do.
+ */
+declare const SERVING_TRACE_LEGS: readonly RetrievalTraceLeg[];
+
+type EmbedCacheLeg = 'doc' | 'query';
+type EmbedCacheMode = 'check-only' | 'check-and-store';
+interface EmbedCacheLookup {
+    db: DatabaseSync;
+    profile: EmbeddingProfile;
+    leg: EmbedCacheLeg;
+    rendering: string;
+}
+interface EmbedCachePut extends EmbedCacheLookup {
+    vector: Float32Array;
+}
+interface EmbedCacheWrapperOptions {
+    embedder: EmbedderPort;
+    profile: EmbeddingProfile;
+    db: DatabaseSync;
+    mode: EmbedCacheMode;
+}
+/** Create the derived cache table from a writer-role connection. */
+declare function ensureEmbedCacheTable(db: DatabaseSync): void;
+/** Return a copied vector so callers cannot mutate SQLite-owned row bytes. */
+declare function getCachedEmbedding({ db, profile, leg, rendering, }: EmbedCacheLookup): Float32Array | undefined;
+/** Store an exact Float32 byte copy under the raw-rendering content hash. */
+declare function putCachedEmbedding({ db, profile, leg, rendering, vector, }: EmbedCachePut): void;
+/** Evict every cached leg/revision/dtype row owned by one model id. */
+declare function dropEmbedCacheForModel(db: DatabaseSync, modelId: string): void;
+/**
+ * Decorate an embedder with the M2 connection-role posture.
+ *
+ * Reader connections use check-only: they benefit from materialized rows but never write on a
+ * miss. Writer-role backfill, migration, and bench paths use check-and-store, which is where the
+ * steady-state cache materializes. Callers must ensure the table once through a writer first.
+ */
+declare function wrapEmbedderWithCache({ embedder, profile, db, mode, }: EmbedCacheWrapperOptions): EmbedderPort;
+
+type WorkerDiscoveryResult = {
+    kind: 'no-worker';
+} | {
+    kind: 'worker';
+};
+type EmbedderRung = 'native' | 'floor';
+type EmbedderWorkerPolicy = 'preferred' | 'required';
+type DeferReason = 'cold-artifact' | 'load-failure' | 'worker-unavailable';
+type AcquireEmbedderOutcome = {
+    kind: 'ready';
+    rung: EmbedderRung;
+    profile: EmbeddingProfile;
+    embedder: EmbedderPort;
+} | {
+    kind: 'deferred';
+    reason: DeferReason;
+} | {
+    kind: 'lexical-only';
+};
+/**
+ * D-12/D-17 test-only capability injection seam.
+ *
+ * Production callers must omit this field so rung selection reflects host truth. No probe is a
+ * user-facing selector, configuration key, environment variable, or CLI switch.
+ */
+interface EmbedderProbes {
+    discoverWorker?: (agentQaRoot: string) => Promise<WorkerDiscoveryResult>;
+    createNativeEmbedder?: (options: {
+        profile: EmbeddingProfile;
+        allowDownload: boolean;
+    }) => Promise<EmbedderPort>;
+    createFloorEmbedder?: () => EmbedderPort | Promise<EmbedderPort>;
+}
+interface AcquireEmbedderOptions {
+    preferredProfile?: EmbeddingProfile;
+    allowDownload: boolean;
+    /** Daemon posture requires the child; ordinary one-shot callers retain the preferred ladder. */
+    workerPolicy?: EmbedderWorkerPolicy;
+    /** Explicit hosted runtime root. Required policy must never infer it from ambient cwd. */
+    agentQaRoot?: string;
+    cache?: {
+        db: DatabaseSync;
+        mode: EmbedCacheMode;
+    };
+    /** D-12/D-17 test seam. Production callers resolve actual host capabilities. */
+    probes?: EmbedderProbes;
+}
+interface ResolveEmbedderCapabilityOptions {
+    preferredProfile?: EmbeddingProfile;
+    allowDownload: boolean;
+    /** Daemon posture requires the child; ordinary one-shot callers retain the preferred ladder. */
+    workerPolicy?: EmbedderWorkerPolicy;
+    /** Explicit hosted runtime root. Required policy must never infer it from ambient cwd. */
+    agentQaRoot?: string;
+    /** D-12/D-17 test seam. Production callers resolve actual host capabilities. */
+    probes?: EmbedderProbes;
+}
+type CapabilityOutcome = AcquireEmbedderOutcome;
+/**
+ * Invalidate process-lifetime capability resolution without touching process-local pipelines.
+ *
+ * A named profile clears only its memo entry. Omitting the profile clears every production and
+ * probe-isolated entry so a long-lived host can re-probe after its worker or artifact state moves.
+ */
+declare function resetEmbedderCapability(profile?: EmbeddingProfile): void;
+interface DiscoverEmbedderWorkerOptions {
+    /** Test-only shortening seam; production omits this and uses the pinned request deadline. */
+    readonly requestTimeoutMs?: number;
+}
+/** D-09's worker arm, rooted in the hosted project rather than ambient process cwd. */
+declare function discoverEmbedderWorker(agentQaRoot: string, options?: DiscoverEmbedderWorkerOptions): Promise<WorkerDiscoveryResult>;
+/**
+ * Resolve the automatic ladder once per profile for this process (D-17).
+ *
+ * Every host/runtime failure collapses to a typed capability outcome; callers cannot select a
+ * rung. Injected test seams receive an isolated memo while production keys solely by the stable
+ * embedding profile identity.
+ */
+declare function resolveEmbedderCapability(options: ResolveEmbedderCapabilityOptions): Promise<CapabilityOutcome>;
+declare function acquireEmbedder(options: AcquireEmbedderOptions): Promise<AcquireEmbedderOutcome>;
+
+/**
+ * The ONE fold from the host's two retrieval axes to the recorded rung (407 TRST-01 · D-13/D-17).
+ *
+ * ONE resolver, three callers: the runner's evidence recorder (407-07) stamps the value into
+ * `StepEvidence.retrievalRung`, `doctor` (407-08) grades it live, and the run header banner
+ * (407-10) renders the recorded copy. Three callers deriving a rung independently from the same
+ * two axes is exactly how a banner and a doctor row come to disagree about one machine, so the
+ * fold table lives here once and its cells are pinned by `__tests__/retrieval-rung.test.ts`.
+ *
+ * WHAT THE VALUE MEANS. It is the HOST's ladder at serve time — never a claim about how any
+ * individual brief line was ranked. The run-brief serve path reads index rows directly and
+ * attributes channels 1 and 3 to the `anchor` leg by construction; the dense leg and the
+ * bundle-scan fallback belong to the general `retrieve()` path the curator, the entity resolver
+ * and the authoring reader use. A surface renders "retrieval was on rung X for this run".
+ *
+ * This module lives in knowledge-local because it is the only package that can see either axis:
+ * the index face is `index-reader`'s degrade ladder and the embedder outcome is
+ * `embedder-acquire`'s capability probe. What it hands back is the schema-owned value.
+ */
+
+/** The index half of the fold — `index-reader`'s degrade ladder, read without side effects. */
+type IndexAxis = IndexFace;
+/** The embedder half of the fold — `embedder-acquire`'s capability outcome, unchanged. */
+type EmbedderAxis = AcquireEmbedderOutcome;
+/**
+ * Fold the two axes into the value that gets recorded (D-17).
+ *
+ * ORDERING IS PART OF THE CONTRACT: the index axis is consulted FIRST. No dense leg can run
+ * against an index that will not open, whatever the embedder resolved to, so a `scan` face is
+ * `bundle-scan` even on a host with a live native embedder. Folding the embedder first would
+ * label a host with an unopenable index `memidex` and make the banner lie.
+ *
+ * `reason` is ABSENT for `memidex` — the top rung is not a degradation and has no cause to name.
+ * Every lower rung carries one, which is what lets the banner say rung AND cause in one line.
+ */
+declare function foldRetrievalRung(index: IndexAxis, embedder: EmbedderAxis, preferredProfile?: EmbeddingProfile): RecordedRetrievalRung;
+interface ResolveRetrievalRungOptions {
+    knowledgeRoot: string;
+    /** Explicit hosted runtime root for worker discovery; defaults to the acquirer's own rule. */
+    agentQaRoot?: string;
+    preferredProfile?: EmbeddingProfile;
+    /** D-12/D-17 test seam, passed through unchanged. Production callers omit it. */
+    probes?: EmbedderProbes;
+}
+/**
+ * Probe both axes and fold them (D-17). NEVER throws, NEVER downloads, NEVER writes.
+ *
+ * - `allowDownload: false` is hard-coded, not an option: this call answers "what is this host
+ *   doing today", and a probe that fetched a model would change the answer by asking it (T-407-09).
+ * - A `scan` face short-circuits before the embedder is touched at all. The fold does not need the
+ *   embedder axis in that arm, and the probe can cost a model load.
+ * - A rejected capability probe folds to `deferred/load-failure` rather than propagating. This
+ *   resolver's callers are a banner, a doctor row and an evidence recorder; none of them has a
+ *   sensible behaviour for "asking about the ladder threw".
+ * - `classifyIndexFace` writes no rebuild marker, so asking is not a mutation of the knowledge root.
+ *
+ * The memo inside `resolveEmbedderCapability` is what makes a second call in the same process free,
+ * which is why `doctor` and the runner can both ask without paying twice.
+ */
+declare function resolveRetrievalRung(options: ResolveRetrievalRungOptions): Promise<RecordedRetrievalRung>;
+
+/**
+ * Fixed weighted-RRF vector for each deterministic query class (D-06).
+ *
+ * PROVISIONAL vectors pending M3's learned per-product replacements. Plain RRF with all three
+ * weights equal to 1 is the declared cold-start floor; learning may replace vectors, never the
+ * classifier itself.
+ */
+declare const QUERY_CLASS_WEIGHTS: {
+    readonly literal: {
+        readonly wLex: 1.5;
+        readonly wDense: 0.5;
+        readonly wAnchor: 2;
+    };
+    readonly mixed: {
+        readonly wLex: 1;
+        readonly wDense: 1;
+        readonly wAnchor: 1.5;
+    };
+    readonly semantic: {
+        readonly wLex: 0.5;
+        readonly wDense: 1.5;
+        readonly wAnchor: 1;
+    };
+};
+
+/**
+ * D-06's closed query-class contract. The classifier is deterministic and total; future learned
+ * weights may replace class vectors, but they must not replace or widen these classes implicitly.
+ */
+type QueryClass = 'literal' | 'mixed' | 'semantic';
+
+/**
+ * The deterministic memory.md §5.5.8 query door (377 D-13). Every identity anchor is normalized
+ * through the schema authority before keys or matching helpers are derived. Raw selector atoms
+ * remain lexical-only; dense text and fallback regions are assembled from structured fields.
+ */
+
+interface RetrievalQueryInput {
+    screenState?: ScreenState;
+    intent: string;
+    anchors: readonly Anchor[];
+}
+interface FallbackRendering {
+    anchorIndex: number;
+    lookupKey: string;
+    text: string;
+    reconfirmToken: string;
+    fallback: true;
+    anchorExact: false;
+}
+interface RetrievalQuery {
+    lexicalQuery: string;
+    semanticText: string;
+    normalizedAnchors: Anchor[];
+    anchorLookupKeys: string[];
+    queryClass: QueryClass;
+    weights: (typeof QUERY_CLASS_WEIGHTS)[QueryClass];
+    fallbackRenderings: FallbackRendering[];
+}
+/**
+ * Build both recall inputs from structured runner state. Fallback renderings are candidates only:
+ * callers use them after exact/normalized anchor lookup misses and may set the admission
+ * anchorExact carve-out only after a lexical hit re-confirms reconfirmToken (T-377-23).
+ */
+declare function buildRetrievalQuery(input: RetrievalQueryInput): RetrievalQuery;
+
+interface AsOfRange {
+    lo: number;
+    hi: number;
+}
+
+/**
+ * Public memory.md §5.5 retrieval composition.
+ *
+ * Usage telemetry (§5.5.9) is deferred by architecture: reader connections are query_only, so
+ * counters land with Phases 378/380's writer-owned paths and are never an input to trust.
+ */
+
+interface RetrieveOptions {
+    n: number;
+    product: string;
+    testKey?: string;
+    suiteKey?: string;
+    asOfBuild?: number;
+    resolveLatestOrdinal?: (product: string) => number | undefined;
+    runtimeRoot?: string;
+    includeSuperseded?: boolean;
+    asOfRange?: AsOfRange;
+    /** Host-resolved posture; a deferred daemon capability forbids in-process fallback. */
+    embeddingCapability?: AcquireEmbedderOutcome;
+}
+type RetrieveResult = IndexEntry[];
+/** Retrieve a deterministic ranked headline list through the reader's current capability. */
+declare function retrieve(reader: KnowledgeReader, query: RetrievalQueryInput, options: RetrieveOptions): Promise<RetrieveResult>;
+
+interface RebuildReport {
+    projected: number;
+    skippedIncomplete: number;
+    scanIssues: string[];
+    removed: number;
+    backfilled: number;
+    vec: VecCapability;
+    pendingEmbeddings: number;
+    maintenanceRemaining: boolean;
+}
+type RebuildMutationFamily = 'project-bundle' | 'checkpoint-passive' | 'remove-missing-bundles' | 'complete-rendering-epoch' | 'complete-trust-epoch' | 'clear-rebuild-request';
+interface RebuildIndexHooks {
+    /** Test/chaos seam after synchronous DML and immediately before the final commit fence. */
+    beforeTransactionCommit?: () => void;
+    /** Test/chaos seam immediately before one named authority unit acquires its hold. */
+    beforeMutationAuthority?: (family: RebuildMutationFamily) => void;
+    /** Test/chaos seam after authority is held and before the named mutation begins. */
+    insideMutationAuthority?: (family: RebuildMutationFamily) => void;
+}
+interface RebuildIndexOptions {
+    knowledgeRoot: string;
+    priors?: TrustPriorTable;
+    embedder?: EmbedderPort;
+    vecLoadablePath?: string;
+    writerAuthority?: WriterLeaseAuthority;
+    hooks?: RebuildIndexHooks;
+}
+/**
+ * WR-01 record-scoped healing: delete the total projection set for exactly the supplied bundle
+ * ids inside one transaction and return the number of records removed. An absent index db,
+ * empty ids, and ids without records rows are no-ops; embed_cache is untouched (purge-only A4).
+ */
+declare function removeBundleProjectionRows(knowledgeRoot: string, bundleIds: readonly string[], writerAuthority: WriterLeaseAuthority): number;
+/** Hash-selected projection plus the independent D-02 backfill and D-10 reconciliation passes. */
+declare function rebuildIndex(opts: RebuildIndexOptions): Promise<RebuildReport>;
+
+declare function readLatestBuildOrdinal(runtimeRoot: string, product: string): number | undefined;
+
+/** The one table name, so the read port and every writer cannot spell it apart. */
+declare const SUITE_FINGERPRINTS_TABLE = "suite_fingerprints";
+
+/** One test's ordered fingerprint elements, keyed by the stable identity. */
+interface SuiteFingerprintTestDelta {
+    filePath: string;
+    testName: string;
+    /** `actionAnchorElement` bytes, in exercised order. Never empty — see `testFingerprint`. */
+    elements: string[];
+}
+/** The row set one run contributes, plus the provenance the replacement rule compares on. */
+interface SuiteFingerprintsProjection {
+    product: string;
+    runId: string;
+    buildOrdinal: number;
+    tests: SuiteFingerprintTestDelta[];
+}
+interface FoldSuiteFingerprintsOptions {
+    /**
+     * The projection partition — `projectionPartition(handoff.scope).product`. Supplied by the
+     * caller so this module never re-spells the partition law that `run-outcomes.ts` owns (and so
+     * the two modules do not have to import each other).
+     */
+    product: string;
+    /**
+     * The `excludedFromOutcomes` decision, CARRIED rather than re-read. See the exclusion note in
+     * this module's header: a gate-run contributes no rows.
+     */
+    excluded: boolean;
+}
+/**
+ * The per-identity deltas for a member list (pure).
+ *
+ * Takes MEMBERS rather than a handoff because the production caller has already applied the one
+ * exclusion gate to them — see the exclusion note in the header. A test contributing zero
+ * elements yields no delta at all, which is what stops an evidence-less run from ERASING an
+ * identity's accumulated coverage: the union only ever moves through evidence.
+ */
+declare function suiteFingerprintDeltas(members: readonly PerTestOutcome[]): SuiteFingerprintTestDelta[];
+/**
+ * Writer against the one index connection.
+ *
+ * Deliberately opens NO transaction of its own. On the production path it runs inside
+ * `applyRunOutcomes`'s `BEGIN IMMEDIATE`, so the fingerprint rows and the outcome counters commit
+ * or roll back together and the two tables can never describe different runs; SQLite has no
+ * nested transactions, so a second `BEGIN IMMEDIATE` here would fail exactly on that path. Called
+ * standalone it rides autocommit, which is sound because the replacement rule is convergent.
+ */
+declare function applySuiteFingerprints(db: DatabaseSync, projection: SuiteFingerprintsProjection): number;
+/**
+ * The standalone fold door: project one handoff's fingerprints and write them.
+ *
+ * The production path does NOT come through here — it folds both projections in one pass through
+ * `projectRunOutcomes`/`applyRunOutcomes` so a single transaction and a single applied-runs marker
+ * cover both tables. This entry exists for callers that hold a handoff and want only the
+ * fingerprint half (the gate evaluator's own harness, and this module's corpus).
+ */
+declare function foldSuiteFingerprints(db: DatabaseSync, handoff: CompletedRunHandoff, opts: FoldSuiteFingerprintsOptions): SuiteFingerprintsProjection;
+/**
+ * The read port gate 3 consumes through composition (D-15).
+ *
+ * MINIMAL BY DESIGN. Conservatism lives in the normalizer (D-14), not here: this port answers
+ * what the table holds and nothing more, so a later retune of "near-same elements normalize
+ * equal" moves in exactly one place. There is no similarity verb here because there is no
+ * similarity threshold to defend — gate 3's value test is set membership, spec §6.3 verbatim.
+ */
+interface SuiteFingerprintIndex {
+    /** The union D-14's novel-element test compares against. Empty table, empty union. */
+    elementUnion(): Set<string>;
+    /**
+     * The identities that HAVE fingerprint rows, sorted. The consumer subtracts these from the
+     * authored-test universe to derive the evidence-less set that rides D-16's text lane — which is
+     * why this port reports coverage rather than trying to enumerate the suite, a fact it does not
+     * own and could only guess at.
+     */
+    coveredTests(): Array<{
+        filePath: string;
+        testName: string;
+    }>;
+    /** One identity's elements in exercised order; `[]` for an identity with no rows. */
+    elementsForTest(filePath: string, testName: string): string[];
+}
+interface SuiteFingerprintIndexOptions {
+    /**
+     * The partition to read. REQUIRED rather than optional: an unscoped union would compare a draft
+     * against another product's suite, and "everything in the table" is never the question gate 3 is
+     * asking.
+     */
+    product: string;
+}
+declare function createSuiteFingerprintIndex(db: DatabaseSync, opts: SuiteFingerprintIndexOptions): SuiteFingerprintIndex;
+
+/**
+ * PROVISIONAL last-N window for per-test outcome history (~10 pending ABRF-02 ranking
+ * measurements). Entries are {buildOrdinal, passed} — ordinals only, wall-clock never.
+ * Shared by readers and writers without pulling writer authority into the read closure.
+ */
+declare const LAST_OUTCOMES_LIMIT = 10;
+
+/**
+ * Stamped into the curation-tail receipt's projection component. Bump when the fold
+ * semantics or table shapes change so already-receipted runs refold on the next tail.
+ *
+ * HOW THAT REFOLD ACTUALLY HAPPENS (393 CR-02), because the receipt alone cannot do it. The tail
+ * stores this number in each run's receipt, so a bump invalidates every receipt and the sweep
+ * re-runs each historical run — but the per-run fold then answers 'already-applied' off the
+ * durable marker and writes nothing. The stamp is therefore ALSO stored in the index itself, in
+ * `run_outcome_projection_version`, and `reconcileRunOutcomesProjection` compares the two ONCE per
+ * curation-tail sweep, before the per-run loop: a differing or absent stamp rebuilds the whole
+ * projection family from the runs root through `rebuildRunOutcomes`, which clears the family
+ * (marker included) and re-reads every `handoff.json` + `analysis.json` from disk. THAT is how an
+ * already-receipted run contributes its elements. The per-run receipts then rewrite at the new
+ * version through the same sweep. The family is derived, so the rebuild is the whole upgrade, and
+ * it is a mechanism that runs, not an argument that it is unnecessary.
+ *
+ * NOT the case argued at `cli/src/commands/run.ts:1949` (390-08 D-01), where a bump was
+ * deliberately declined: there the rebuild would have replayed stored handoffs carrying the OLD
+ * identities, landing in the same mixed state the bump was meant to clear. Here the new table has
+ * no historical rows at all, and every row it will hold is derivable from evidence the stored
+ * handoffs already carry — so the refold produces the complete answer rather than a mixed one.
+ */
+declare const RUN_OUTCOMES_PROJECTION_VERSION = 2;
+
+/** Anchor extraction seam: the CLI tail passes its exercisedAnchors(step) walk. */
+type ExtractStepAnchors = (step: StepEvidence) => Anchor[];
+/**
+ * Projection inputs contain no exclusion override. The durable handoff marker is the sole
+ * authority for current-run folds, sibling backfill, and full rebuild alike (D-14 §6).
+ */
+interface ProjectRunOutcomesOptions {
+    extractAnchors: ExtractStepAnchors;
+    /**
+     * The run's persisted analysis artifact when one exists (390 D-09, the `ProjectCanaryOutcomes
+     * Input.artifact` precedent). DATA, not a port: `foldRunOutcomes` and `rebuildRunOutcomes` each
+     * load it from the run's own dir through the one shared loader and hand it here, so ONE
+     * projection function with ONE signature serves both paths — a second signature only one path
+     * calls is exactly how L12 rebuild parity breaks in silence.
+     */
+    artifact?: RunAnalysisArtifact;
+}
+/**
+ * What a FAILED member contributes to the fingerprint-keyed recurrence window (390 D-07).
+ *
+ * The fingerprint is composed through the ONE exported vocabulary — `failingStepOf`/`errorTextOf`
+ * over `exercisedAnchors`, keyed by `failureFingerprint` — so this window and the render-time
+ * cluster presentation cannot disagree about what "the same failure" is. The verdict class is part
+ * of the key by recipe, which is why it travels beside it rather than being re-derived downstream.
+ */
+interface RunOutcomeFailureKey {
+    fingerprint: string;
+    verdictClass: VerdictClass;
+    /**
+     * WHICH pipeline authored the class (390-16). Not part of the fingerprint and not stored on
+     * `run_fingerprint_windows` — it travels on the in-memory delta only, because the quarantine
+     * ladder's floor-eligibility gate needs to know whether the class is a statement about THIS
+     * TEST (an authored `analyze-run` verdict) or about the RUN (the deterministic floor, whose
+     * `environment` arms are one health-probe result applied to every failing member).
+     */
+    producer: Verdict['producer'];
+}
+interface RunOutcomeTestDelta {
+    filePath: string;
+    testName: string;
+    passed: boolean;
+    heals: number;
+    flake: boolean;
+    /** canonicalJson(normalizeAnchor(...)) keys — byte-deterministic (ABRF-02 encoding edge). */
+    anchorKeys: string[];
+    /** Present for exactly the failed members — a pass contributes no window row (D-07). */
+    failure?: RunOutcomeFailureKey;
+}
+interface RunOutcomesProjection {
+    product: string;
+    scope: ScopeKey;
+    runId: string;
+    buildOrdinal: number;
+    excluded: boolean;
+    tests: RunOutcomeTestDelta[];
+    /**
+     * The suite-fingerprint deltas for the SAME members (393 D-15). They travel on this projection
+     * rather than being folded by a second pass so that one traversal of the handoff produces both
+     * tables, one transaction commits them, and one applied-runs marker covers them — which is what
+     * makes rebuild parity structural instead of asserted.
+     */
+    fingerprints: SuiteFingerprintTestDelta[];
+}
+type ApplyRunOutcomesResult = {
+    kind: 'applied';
+    tests: number;
+} | {
+    kind: 'already-applied';
+    tests: 0;
+};
+interface RebuildRunOutcomesOptions {
+    extractAnchors: ExtractStepAnchors;
+}
+/**
+ * What one rebuild did, with its two skip causes kept APART (393 round 7, CR-01-WIDENED).
+ *
+ * A single conflating counter answered "how many runs did not fold" and nothing an operator could
+ * act on: a malformed `handoff.json` and an unloadable `analysis.json` are different files, written
+ * by different producers, and fixed differently. There is deliberately no third counter for a
+ * projection or write failure — that class is no longer a skip at all. It propagates out of
+ * `rebuildRunOutcomes` and the rebuild produces no report.
+ */
+interface RebuildRunOutcomesReport {
+    folded: number;
+    /** Runs whose `handoff.json` would not load or carries a pre-381 / structurally unsafe shape. */
+    skippedHandoffs: number;
+    /** Runs whose `handoff.json` loaded but whose `analysis.json` threw (the D-09 second document). */
+    skippedArtifacts: number;
+}
+/**
+ * What the fold needs before it may evaluate the quarantine detection ladder (390 D-08).
+ *
+ * Grouped and OPTIONAL on purpose: a caller that cannot supply a clock does
+ * not get a silently empty evaluation, it gets `{kind: 'not-evaluated', reason: 'not-requested'}`
+ * on the report. "Detection ran and found nothing" and "detection never ran" are different facts.
+ */
+interface QuarantineDetectionOptions {
+    /**
+     * The ISO-8601 instant the evaluation is anchored to — the drain's own wall clock, read ONCE by
+     * the caller. The fold and the rule below it stay clock-free (390-01's purity-by-argument), which
+     * is what lets both expiry and the ladder be pinned one step either side.
+     */
+    now: string;
+}
+interface FoldRunOutcomesOptions {
+    /** Absolute agent-qa-knowledge root hosting the derived index SQLite. */
+    knowledgeRoot: string;
+    handoff: CompletedRunHandoff;
+    extractAnchors: ExtractStepAnchors;
+    /**
+     * The run's own directory (`.agent-qa/runs/<slug(runId)>/`). When supplied, the fold loads
+     * `analysis.json` from it so the counters read RESOLVED verdicts (D-09). Absent — a caller that
+     * has no run dir — folds the deterministic floor, byte-identically to pre-390.
+     */
+    runDir?: string;
+    /** Present when the caller wants the D-08 detection step; absent skips it explicitly. */
+    quarantine?: QuarantineDetectionOptions;
+}
+/**
+ * What the fold's detection step did, as DATA (390 Pitfall 4).
+ *
+ * Every arm is a fact the caller can print. A ledger that could not be read is a value, not an
+ * exception: a failure that vanished inside a catch is exactly how an `entered` event goes missing
+ * in silence, and a missing `entered` event is a test that keeps failing builds with nobody told
+ * why it was supposed to stop.
+ */
+type QuarantineFoldOutcome = {
+    kind: 'not-evaluated';
+    reason: 'already-applied' | 'not-requested';
+}
+/** The committed ledger could not be read at all — detection refuses rather than guessing. */
+ | {
+    kind: 'ledger-unreadable';
+    reason: string;
+} | {
+    kind: 'evaluated';
+    append: QuarantineAppendOutcome;
+    events: readonly QuarantineLedgerEvent[];
+    flagged: readonly QuarantineDetectionSighting[];
+    escalatedNotQuarantined: readonly QuarantineDetectionSighting[];
+    refusedLines: readonly RefusedQuarantineLine[];
+};
+type FoldRunOutcomesReport = ApplyRunOutcomesResult & {
+    quarantine: QuarantineFoldOutcome;
+};
+/** Pure fold: identical (handoff, artifact) bytes yield identical row deltas. */
+declare function projectRunOutcomes(handoff: CompletedRunHandoff, opts: ProjectRunOutcomesOptions): RunOutcomesProjection;
+/**
+ * Writer against the one index connection. Idempotent per product/runId: the applied-runs
+ * marker commits in the same transaction as the counter rows, so a crash-rerun tail that
+ * refolds an already-applied partition (receipt withheld mid-tail) changes nothing.
+ */
+declare function applyRunOutcomes(db: DatabaseSync, projection: RunOutcomesProjection): ApplyRunOutcomesResult;
+/**
+ * Full rebuild: scan and read every run dir under `runsRoot`, then clear the projection tables
+ * and refold each loadable handoff. Reproduces tables byte-identical to the incremental fold
+ * (L12); a rebuild over zero handoff dirs yields empty tables without error (ABRF-02
+ * empty edge). BAD-BYTES load failures and pre-381 shapes are counted skips — including a run whose
+ * `analysis.json` will not decode, which costs that run's contribution and nothing else (393 round
+ * 6, CR-01). One undecodable artifact must never truncate a family this function has already
+ * read; an errno-coded HOST fault on either document, on the runs root, or on any run dir
+ * propagates BEFORE the family is deleted, so no sweep can stamp — or empty — a family the
+ * filesystem prevented it from reading (418-12, CR-01-EXISTS).
+ *
+ * Phase A: no document is destroyed before every document was read — a host fault during reads
+ * leaves the previous family and its stamp untouched (418-12, CR-02-DESTRUCTIVE, load-before-delete).
+ * The list holds parsed handoffs for one sweep; the runs root is bounded by host run retention.
+ *
+ * Phase B is DELETE-FIRST, STAMP-LAST, and that order is the crash story rather than a style choice (393
+ * CR-02). The version row is cleared with the family it describes and re-written only after the
+ * refold loop has run to completion, so a crash anywhere in between leaves NO stamp — which
+ * `reconcileRunOutcomesProjection` reads as a mismatch and rebuilds again. The projection
+ * therefore self-heals from a partial rebuild instead of stamping a half-built family as current.
+ */
+declare function rebuildRunOutcomes(db: DatabaseSync, runsRoot: string, opts: RebuildRunOutcomesOptions): RebuildRunOutcomesReport;
+/** What one reconcile did — a fact the caller can print, never a silent side effect. */
+type ReconcileRunOutcomesProjectionResult = {
+    kind: 'current';
+} | {
+    kind: 'rebuilt';
+    report: RebuildRunOutcomesReport;
+} | {
+    kind: 'skipped';
+    reason: 'no-writer-authority';
+};
+interface ReconcileRunOutcomesProjectionOptions {
+    /** The exact live writer lease owned by the caller; never inferred from an epoch alone. */
+    authority?: {
+        leaseId: string;
+        epoch: number;
+    };
+    /** Absolute agent-qa-knowledge root hosting the derived index SQLite. */
+    knowledgeRoot: string;
+    /** `<agentQaRoot>/runs` — the scan root the rebuild refolds from. */
+    runsRoot: string;
+    extractAnchors: ExtractStepAnchors;
+}
+/**
+ * THE version trigger: reconcile the stored fold semantics with the shipped ones (393 CR-02).
+ *
+ * `RUN_OUTCOMES_PROJECTION_VERSION`'s doc block has always promised that a bump makes
+ * already-receipted runs refold. Nothing performed that refold: `applyRunOutcomes` short-circuits
+ * on the `run_outcome_applied_runs` marker before it can reach the fingerprint write, and nothing
+ * cleared the marker on a version change — so on any project that folded runs before a bump, the
+ * new table stayed empty forever and gate 3's fingerprint lane never had data to decide on. This
+ * function is what makes that promise true, and it composes machinery that already existed rather
+ * than adding a parallel path: `rebuildRunOutcomes` already clears the family, already re-reads
+ * every `handoff.json` + `analysis.json` through the one shared loader, and already reaches
+ * `applySuiteFingerprints` for every fold.
+ *
+ * ABSENT MEANS MISMATCH, deliberately. Every pre-stamp index reads as absent, which is exactly the
+ * population that needs to converge; so does an index whose file was deleted, which is exactly the
+ * population that needs to re-heal. Treating absence as "probably fine" would have made the
+ * upgrade path the one path this function does not serve.
+ *
+ * WHY A REBUILD RATHER THAN A PER-RUN VERSION COLUMN. Refolding runs in place through the
+ * incremental path would add each run's counters a SECOND time — the fold accumulates, it does not
+ * replace. The rebuild is the mechanism precisely because it clears before it refolds, which is
+ * also why the derived family is safe to move this way at all (L12: every row here is reproducible
+ * from run artifacts on disk).
+ *
+ * 418-12 WR-03: a destructive rebuild of a shared derived family is a leased act. A caller
+ * without authority gets a typed skip before opening a writer; it stays stale until a leased
+ * sweep. The version check and entire rebuild share the current-authority generation lock.
+ */
+declare function reconcileRunOutcomesProjection(opts: ReconcileRunOutcomesProjectionOptions): ReconcileRunOutcomesProjectionResult;
+/**
+ * Incremental fold wrapper for the post-verdict tail: opens the one index writer, applies
+ * the projection, and closes. The tail invokes it inside the SAME crash boundary and the
+ * SAME (extended) receipt as candidate/canary emit — never a second marker file.
+ *
+ * Detection hangs off the `'applied'` arm ONLY (D-08). `applyRunOutcomes` answers
+ * `'already-applied'` from an early return that fires before its transaction even opens, so
+ * "a refold never double-quarantines" is true by POSITION — there is no second idempotency
+ * condition here to keep in sync with the marker.
+ */
+declare function foldRunOutcomes(opts: FoldRunOutcomesOptions): FoldRunOutcomesReport;
+
+/**
+ * Read side of the run-outcome projection (389 ANLZ-03, RESEARCH Pitfall 2).
+ *
+ * `run_test_outcomes` is written by `foldRunOutcomes`/`applyRunOutcomes`; this module is
+ * the one place that queries it. Strictly read-only: one prepared SELECT, no statement
+ * that mutates a row, ever — the writer half stays whole in `run-outcomes.ts`.
+ *
+ * KEY LAW — stable test identity is `(product, filePath, testName)`, exactly the
+ * projection's primary key and per-test-outcome.ts's identity rule. Callers joining from
+ * a handoff use `PerTestOutcome.filePath` + `testName`, NEVER `testId` (a per-run
+ * explicit id, not a durable identity).
+ */
+
+/** One window entry: ordinals only, wall-clock never (mirrors the writer's OutcomeEntry). */
+interface TestOutcomeEntry {
+    buildOrdinal: number;
+    passed: boolean;
+}
+interface TestOutcomeHistory {
+    passes: number;
+    failures: number;
+    heals: number;
+    flakeCount: number;
+    /** Ordinal-ascending, at most LAST_OUTCOMES_LIMIT entries; [] when the stored JSON is malformed. */
+    lastOutcomes: TestOutcomeEntry[];
+    lastBuildOrdinal: number | undefined;
+}
+/** The projection's key, spelled the way the table is keyed. */
+interface TestOutcomeIdentity {
+    product: string;
+    filePath: string;
+    testName: string;
+}
+/**
+ * Answer one test's failure history from `run_test_outcomes`, or `undefined` when the
+ * projection has never counted the test — typed absence, never an empty stand-in row.
+ */
+declare function readTestOutcomeHistory(db: DatabaseSync, identity: TestOutcomeIdentity): TestOutcomeHistory | undefined;
+/**
+ * Every identity the projection has counted inside ONE file, in one product (394-17 · WTST-05).
+ *
+ * The neighbours side of D-14's stability read: "which tests does this suite file already have run
+ * evidence for". Keyed on the projection's own primary key, so `product` is REQUIRED for the same
+ * reason `readTestOutcomeHistory` requires it — a query that dropped it would serve every
+ * product's rows under one file path and report another application's tests as this target's.
+ *
+ * `test_name` ORDER, so a caller's message names its neighbours in a stable order across runs. An
+ * empty array is the honest answer for a file the projection has never counted; the caller turns
+ * that into a `no-history` posture rather than into a clean bill of health.
+ */
+declare function listTestsInFile(db: DatabaseSync, scope: {
+    product: string;
+    filePath: string;
+}): string[];
+/**
+ * D-02's forced discriminator channel: did the same step pass on the previous build?
+ * Answers the entry with the greatest buildOrdinal STRICTLY below `currentBuildOrdinal`,
+ * or `undefined` when no prior build is in the window (empty history, a single
+ * current-build entry, or every entry at/above current) — prior-build honestly absent,
+ * never faked from the current entry.
+ */
+declare function priorBuildOutcome(history: TestOutcomeHistory, currentBuildOrdinal: number): TestOutcomeEntry | undefined;
+interface FailureRecurrence {
+    /** Failed entries with buildOrdinal AT OR BELOW current — includes the current failure when recorded. */
+    kth: number;
+    /** Distinct buildOrdinals observed in lastOutcomes — honest about the ≤LAST_OUTCOMES_LIMIT window. */
+    windowBuilds: number;
+}
+/**
+ * Feeds "Kth failure in the last N builds", computed LIVE at render time (D-08) — counts
+ * derived from the window on every call, never stored prose. 390 rebinds the same seam to
+ * its fingerprint-window computation; this derivation is 389's binding, not the seam's
+ * final owner. An empty history answers {kth: 0, windowBuilds: 0}: the renderer (plan 05)
+ * turns zero-history into an explicit no-history clause, so absence stays typed.
+ */
+declare function failureRecurrence(history: TestOutcomeHistory, currentBuildOrdinal: number): FailureRecurrence;
+
+/**
+ * PROVISIONAL D-13 superseded-generation retention depth. M3 may calibrate the
+ * value against gate receipts, but it remains an internal constitution value
+ * and never a runtime config key.
+ */
+declare const GC_SUPERSEDED_RETAIN_K = 3;
+/**
+ * D-13 gate seam. M2 always passes `{ kind: 'none' }`; M3 plugs real gate
+ * receipt ordinals into the second variant with zero shape change.
+ */
+type GateHorizon = {
+    kind: 'none';
+} | {
+    kind: 'ordinal';
+    deepestGateOrdinal: number;
+};
+interface GcSummary {
+    trimmedRecordIds: RecordId[];
+    skipped: {
+        unknownRef: number;
+        withinK: number;
+        userOrigin: number;
+        horizon: number;
+    };
+}
+interface RunKnowledgeGcInput {
+    knowledgeRoot: string;
+    horizon: GateHorizon;
+    retainK?: number;
+}
+interface RunKnowledgeGcHooks {
+    /** Test/chaos seam immediately before the authority check for one planned removal. */
+    beforeGcRemoval?(recordId: RecordId): void;
+}
+/**
+ * Trim only whole superseded bundle directories after constructing every D-13
+ * exclusion set. No projection SQL exists here by design: the drain tail feeds
+ * trimmedRecordIds straight into removeBundleProjectionRows, so the disposable
+ * index heals in the same drain (WR-01).
+ *
+ * RATIFICATION: this typed in-memory summary, surfaced through drain diagnostics,
+ * is the low-cost §9.2-style operational note. GC writes no persisted note artifact.
+ */
+declare function runKnowledgeGc(input: RunKnowledgeGcInput, writerAuthority: WriterLeaseAuthority, hooks?: RunKnowledgeGcHooks): GcSummary;
+
+/**
+ * D-19 active-profile migration over the derived index.
+ *
+ * M2 keeps this library-only: Phase 378's drainer binds it to runtime
+ * coordination, while Phase 382 owns any eventual CLI cutover surface. Rows
+ * projected after the frozen snapshot take the benign lag direction: the flip
+ * marks them pending so 375's unchanged backfill selector heals them.
+ */
+
+type MigrationOutcome = {
+    flipped: true;
+    profileKey: string;
+} | {
+    flipped: false;
+    missing: string[];
+};
+interface SetActiveEmbeddingProfileOptions {
+    db: DatabaseSync;
+    vec: VecCapability;
+    target: {
+        profile: EmbeddingProfile;
+        embedder: EmbedderPort;
+    };
+}
+/**
+ * Stage every frozen record for a schema-owned target profile, then atomically
+ * flip only when the exact frozen member set is complete.
+ */
+declare function setActiveEmbeddingProfile(options: SetActiveEmbeddingProfileOptions): Promise<MigrationOutcome>;
+
+type FloorAssetLoadErrorCode = 'package-root-not-found' | 'manifest-invalid' | 'asset-read-failed' | 'asset-size-mismatch' | 'digest-mismatch' | 'binary-invalid' | 'tokenizer-invalid' | 'tokenizer-runtime-unavailable';
+declare class FloorAssetLoadError extends Error {
+    readonly code: FloorAssetLoadErrorCode;
+    constructor(code: FloorAssetLoadErrorCode, message: string, options?: ErrorOptions);
+}
+type FloorEmbeddingErrorCode = 'empty-token-set' | 'token-id-out-of-range' | 'zero-vector';
+declare class FloorEmbeddingError extends Error {
+    readonly code: FloorEmbeddingErrorCode;
+    constructor(code: FloorEmbeddingErrorCode, message: string, options?: ErrorOptions);
+}
+interface FloorAssets {
+    tokenizer: Tokenizer;
+    vocabularySize: number;
+    dimension: number;
+    scales: Float32Array;
+    weights: Int8Array;
+}
+interface FloorAssetLoadOptions {
+    /** Test-only injection seam. Production callers resolve the committed package asset. */
+    assetsDir?: string;
+    /** Optional caller-owned token cap for bounded benchmark/runtime work. */
+    maxTokens?: number;
+}
+declare function loadFloorAssets(options?: FloorAssetLoadOptions): Promise<FloorAssets>;
+/**
+ * Construct the pure-TypeScript degradation-floor embedder without loading assets eagerly.
+ *
+ * The static floor profile has empty document and query prefixes, so both legs intentionally
+ * share exactly the same token lookup, mean pooling, and L2-normalization implementation.
+ */
+declare function createFloorEmbedder(options?: FloorAssetLoadOptions): EmbedderPort;
+
+declare class NativeEmbeddingModuleLoadError extends Error {
+    constructor(cause: unknown);
+}
+declare class NativeEmbeddingDimensionError extends RangeError {
+    readonly actualDim: number;
+    readonly expectedDim: number;
+    constructor(actualDim: number, expectedDim: number);
+}
+declare function createNativeEmbedder(options: {
+    profile: EmbeddingProfile;
+    allowDownload: boolean;
+    /** Optional process-wide token budget fixed by the first acquisition for this model identity. */
+    maxTokens?: number;
+}): Promise<EmbedderPort>;
+
+declare const MODEL_CACHE_DIR_ENV_VAR = "AGENT_QA_MODEL_CACHE_DIR";
+/**
+ * Resolve the shared model cache used by every native embedder acquisition.
+ *
+ * D-11: one download per machine across all projects, with artifacts identified
+ * by (model_id, revision). An explicit agent-qa override wins, then the XDG
+ * cache root, with the conventional home cache as the final fallback.
+ */
+declare function resolveModelCacheDir(): string;
+
+/**
+ * The embedder worker's half of the one process-identity vocabulary in this package.
+ *
+ * This is a separate module from `worker-registration.ts` on purpose. Registration reading and
+ * socket probing are reachable from the read-only serving entry, and `reader-import-closure`
+ * forbids that closure from crossing into `lease/`. The *signal decision* is a writer-side concern
+ * that the reader never makes, so it lives here — which lets both kill paths in this package share
+ * CR-04's single `resolveProcessIncarnation` definition instead of growing a second, subtly
+ * different identity scheme.
+ */
+
+/**
+ * Compare the registration's recorded incarnation against the pid's CURRENT occupant.
+ *
+ * CR-05: a schema-valid registration naming a live pid whose socket has stopped answering is not
+ * proof that the worker is still there. Once the worker died, the kernel is free to hand its pid to
+ * a stranger, and every decision keyed on that number alone targets whoever holds it now. The one
+ * fact that separates them is assigned by the OS and cannot be forged from inside the file: when
+ * the process at that pid started.
+ *
+ * `mismatch` means the registered worker is provably gone; `unverifiable` means we cannot say, and
+ * that is a refusal rather than a default-allow. Neither may be signalled — and neither needs to
+ * be, because generation-specific sockets (Plan 24) let a fresh worker take a clean address without
+ * the old pid ever being touched.
+ */
+declare function verifyEmbedderWorkerIncarnation(registration: EmbedderWorkerRegistration): EmbedderWorkerIncarnationVerdict;
+
+declare const CURATION_QUEUE_SCHEMA_VERSION = 2;
+declare const curationArtifactRoleSchema: z.ZodEnum<{
+    "dom-snapshot": "dom-snapshot";
+    "ax-snapshot": "ax-snapshot";
+    screenshot: "screenshot";
+    "opaque-evidence": "opaque-evidence";
+}>;
+declare const curationArtifactDescriptorSchema: z.ZodObject<{
+    ref: z.ZodType<ArtifactRef, unknown, z.core.$ZodTypeInternals<ArtifactRef, unknown>>;
+    stepIndex: z.ZodNumber;
+    role: z.ZodEnum<{
+        "dom-snapshot": "dom-snapshot";
+        "ax-snapshot": "ax-snapshot";
+        screenshot: "screenshot";
+        "opaque-evidence": "opaque-evidence";
+    }>;
+    originalName: z.ZodString;
+}, z.core.$strict>;
+declare const artifactInventoryEntrySchema: z.ZodObject<{
+    role: z.ZodEnum<{
+        "dom-snapshot": "dom-snapshot";
+        "ax-snapshot": "ax-snapshot";
+        screenshot: "screenshot";
+        "opaque-evidence": "opaque-evidence";
+    }>;
+    originalName: z.ZodString;
+    relativePath: z.ZodString;
+    sha256: z.ZodString;
+    bytes: z.ZodNumber;
+    stepIndex: z.ZodNumber;
+}, z.core.$strict>;
+declare const curationCandidateProjectionSchema: z.ZodObject<{
+    artifactDescriptors: z.ZodArray<z.ZodObject<{
+        ref: z.ZodType<ArtifactRef, unknown, z.core.$ZodTypeInternals<ArtifactRef, unknown>>;
+        stepIndex: z.ZodNumber;
+        role: z.ZodEnum<{
+            "dom-snapshot": "dom-snapshot";
+            "ax-snapshot": "ax-snapshot";
+            screenshot: "screenshot";
+            "opaque-evidence": "opaque-evidence";
+        }>;
+        originalName: z.ZodString;
+    }, z.core.$strict>>;
+    emittedAt: z.ZodString;
+    sourceRunId: z.ZodString;
+    scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+    buildOrdinal: z.ZodNumber;
+    executionContext: z.ZodType<ExecutionContext, unknown, z.core.$ZodTypeInternals<ExecutionContext, unknown>>;
+    kind: z.ZodType<BundleKind, unknown, z.core.$ZodTypeInternals<BundleKind, unknown>>;
+    subtype: z.ZodOptional<z.ZodType<FactSubtype, unknown, z.core.$ZodTypeInternals<FactSubtype, unknown>>>;
+    rootCauseClass: z.ZodOptional<z.ZodEnum<{
+        environment: "environment";
+        timeout: "timeout";
+        flake: "flake";
+    }>>;
+    anchors: z.ZodArray<z.ZodType<_vostride_agent_qa_schema.Anchor, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.Anchor, unknown>>>;
+    summarySeed: z.ZodString;
+    bodySeed: z.ZodString;
+    distilledObservations: z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodNumber;
+        step: z.ZodObject<{
+            naturalKey: z.ZodString;
+            ordinal: z.ZodNumber;
+        }, z.core.$strict>;
+        platform: z.ZodOptional<z.ZodEnum<{
+            web: "web";
+            mobile: "mobile";
+        }>>;
+        test: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        procedure: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        flow: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            precedes: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        surface: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                page: "page";
+                screen: "screen";
+            }>;
+            naturalKey: z.ZodString;
+        }, z.core.$strict>>;
+        element: z.ZodOptional<z.ZodObject<{
+            naturalKey: z.ZodString;
+        }, z.core.$strict>>;
+        locator: z.ZodOptional<z.ZodObject<{
+            selector: z.ZodString;
+        }, z.core.$strict>>;
+        error: z.ZodOptional<z.ZodObject<{
+            naturalKey: z.ZodString;
+            rootCauseClass: z.ZodOptional<z.ZodEnum<{
+                environment: "environment";
+                timeout: "timeout";
+                flake: "flake";
+            }>>;
+        }, z.core.$strict>>;
+        observedAtOrdinal: z.ZodNumber;
+    }, z.core.$strict>>;
+    evidenceToken: z.ZodString;
+    attributingObservationId: z.ZodString;
+}, z.core.$strict>;
+declare const curationCandidateAddressFieldsSchema: z.ZodObject<{
+    artifactInventory: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            "dom-snapshot": "dom-snapshot";
+            "ax-snapshot": "ax-snapshot";
+            screenshot: "screenshot";
+            "opaque-evidence": "opaque-evidence";
+        }>;
+        originalName: z.ZodString;
+        relativePath: z.ZodString;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+        stepIndex: z.ZodNumber;
+    }, z.core.$strict>>;
+    emittedAt: z.ZodString;
+    sourceRunId: z.ZodString;
+    scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+    buildOrdinal: z.ZodNumber;
+    executionContext: z.ZodType<ExecutionContext, unknown, z.core.$ZodTypeInternals<ExecutionContext, unknown>>;
+    kind: z.ZodType<BundleKind, unknown, z.core.$ZodTypeInternals<BundleKind, unknown>>;
+    subtype: z.ZodOptional<z.ZodType<FactSubtype, unknown, z.core.$ZodTypeInternals<FactSubtype, unknown>>>;
+    rootCauseClass: z.ZodOptional<z.ZodEnum<{
+        environment: "environment";
+        timeout: "timeout";
+        flake: "flake";
+    }>>;
+    anchors: z.ZodArray<z.ZodType<_vostride_agent_qa_schema.Anchor, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.Anchor, unknown>>>;
+    summarySeed: z.ZodString;
+    bodySeed: z.ZodString;
+    distilledObservations: z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodNumber;
+        step: z.ZodObject<{
+            naturalKey: z.ZodString;
+            ordinal: z.ZodNumber;
+        }, z.core.$strict>;
+        platform: z.ZodOptional<z.ZodEnum<{
+            web: "web";
+            mobile: "mobile";
+        }>>;
+        test: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        procedure: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        flow: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            precedes: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        surface: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                page: "page";
+                screen: "screen";
+            }>;
+            naturalKey: z.ZodString;
+        }, z.core.$strict>>;
+        element: z.ZodOptional<z.ZodObject<{
+            naturalKey: z.ZodString;
+        }, z.core.$strict>>;
+        locator: z.ZodOptional<z.ZodObject<{
+            selector: z.ZodString;
+        }, z.core.$strict>>;
+        error: z.ZodOptional<z.ZodObject<{
+            naturalKey: z.ZodString;
+            rootCauseClass: z.ZodOptional<z.ZodEnum<{
+                environment: "environment";
+                timeout: "timeout";
+                flake: "flake";
+            }>>;
+        }, z.core.$strict>>;
+        observedAtOrdinal: z.ZodNumber;
+    }, z.core.$strict>>;
+    evidenceToken: z.ZodString;
+    attributingObservationId: z.ZodString;
+    schemaVersion: z.ZodLiteral<2>;
+}, z.core.$strict>;
+declare const curationCandidatePayloadSchema: z.ZodObject<{
+    artifactInventory: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            "dom-snapshot": "dom-snapshot";
+            "ax-snapshot": "ax-snapshot";
+            screenshot: "screenshot";
+            "opaque-evidence": "opaque-evidence";
+        }>;
+        originalName: z.ZodString;
+        relativePath: z.ZodString;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+        stepIndex: z.ZodNumber;
+    }, z.core.$strict>>;
+    emittedAt: z.ZodString;
+    sourceRunId: z.ZodString;
+    scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+    buildOrdinal: z.ZodNumber;
+    executionContext: z.ZodType<ExecutionContext, unknown, z.core.$ZodTypeInternals<ExecutionContext, unknown>>;
+    kind: z.ZodType<BundleKind, unknown, z.core.$ZodTypeInternals<BundleKind, unknown>>;
+    subtype: z.ZodOptional<z.ZodType<FactSubtype, unknown, z.core.$ZodTypeInternals<FactSubtype, unknown>>>;
+    rootCauseClass: z.ZodOptional<z.ZodEnum<{
+        environment: "environment";
+        timeout: "timeout";
+        flake: "flake";
+    }>>;
+    anchors: z.ZodArray<z.ZodType<_vostride_agent_qa_schema.Anchor, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.Anchor, unknown>>>;
+    summarySeed: z.ZodString;
+    bodySeed: z.ZodString;
+    distilledObservations: z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodNumber;
+        step: z.ZodObject<{
+            naturalKey: z.ZodString;
+            ordinal: z.ZodNumber;
+        }, z.core.$strict>;
+        platform: z.ZodOptional<z.ZodEnum<{
+            web: "web";
+            mobile: "mobile";
+        }>>;
+        test: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        procedure: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        flow: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            precedes: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        surface: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                page: "page";
+                screen: "screen";
+            }>;
+            naturalKey: z.ZodString;
+        }, z.core.$strict>>;
+        element: z.ZodOptional<z.ZodObject<{
+            naturalKey: z.ZodString;
+        }, z.core.$strict>>;
+        locator: z.ZodOptional<z.ZodObject<{
+            selector: z.ZodString;
+        }, z.core.$strict>>;
+        error: z.ZodOptional<z.ZodObject<{
+            naturalKey: z.ZodString;
+            rootCauseClass: z.ZodOptional<z.ZodEnum<{
+                environment: "environment";
+                timeout: "timeout";
+                flake: "flake";
+            }>>;
+        }, z.core.$strict>>;
+        observedAtOrdinal: z.ZodNumber;
+    }, z.core.$strict>>;
+    evidenceToken: z.ZodString;
+    attributingObservationId: z.ZodString;
+    schemaVersion: z.ZodLiteral<2>;
+    candidateId: z.ZodString;
+}, z.core.$strict>;
+type CurationCandidateAddressFields = z.infer<typeof curationCandidateAddressFieldsSchema>;
+type CurationCandidatePayload = z.infer<typeof curationCandidatePayloadSchema>;
+type CurationCandidateArtifact = z.infer<typeof artifactInventoryEntrySchema>;
+type CurationArtifactRole = z.infer<typeof curationArtifactRoleSchema>;
+type CurationArtifactDescriptor = z.infer<typeof curationArtifactDescriptorSchema>;
+type CurationCandidateProjection = z.infer<typeof curationCandidateProjectionSchema>;
+type BuildCurationCandidateAddressFieldsInput = CurationCandidateAddressFields;
+/** Constructs strict version-2 fields with descriptor metadata for every copied artifact. */
+declare function buildCurationCandidateAddressFields(input: BuildCurationCandidateAddressFieldsInput): CurationCandidateAddressFields;
+/**
+ * Hashes every payload field except derived candidateId and diagnostic emittedAt. Identity covers
+ * schema/run/scope/ordinal/execution context, candidate kind/subtype, anchors and seeds, distilled
+ * observations, evidence attribution, and the complete artifact inventory.
+ */
+declare function candidateContentAddress(fields: CurationCandidateAddressFields): string;
+
+/** Gitignored durable curation transport root; provisional until M2 field evidence retunes it. */
+declare const QUEUE_DIR = "memory/queue";
+/** Pending candidates visible to a drainer. */
+declare const QUEUED_SUBDIR = "queued";
+/** Lease-partitioned candidates atomically removed from the pending set. */
+declare const CLAIMED_SUBDIR = "claimed";
+/** Durable lifecycle checkpoints keyed by candidate content address. */
+declare const JOBS_SUBDIR = "jobs";
+/** Provisional fail-closed disk-growth limit for one knowledge scope. */
+declare const QUEUE_MAX_JOBS_PER_SCOPE = 200;
+/** Provisional fail-closed candidate emission limit for one source run. */
+declare const QUEUE_MAX_EMITS_PER_RUN = 50;
+declare function queueRoot(knowledgeRoot: string): string;
+declare function queuedRoot(knowledgeRoot: string): string;
+declare function claimedRoot(knowledgeRoot: string): string;
+declare function jobsRoot(knowledgeRoot: string): string;
+declare function queueStagingRoot(knowledgeRoot: string): string;
+declare function queuedCandidateDir(knowledgeRoot: string, candidateId: string): string;
+declare function claimedLeaseDir(knowledgeRoot: string, leaseId: string): string;
+declare function claimedCandidateDir(knowledgeRoot: string, leaseId: string, candidateId: string): string;
+declare function jobStatePath(knowledgeRoot: string, candidateId: string): string;
+
+interface CurationProjectionArtifactSource {
+    /** Binds one raw projection descriptor by its ArtifactRef id. */
+    artifactId: string;
+    /** Absolute source outside the queue's durable projection. */
+    sourcePath: string;
+}
+interface EnqueueCurationCandidateProjectionOptions {
+    knowledgeRoot: string;
+    projection: CurationCandidateProjection;
+    artifactSources: readonly CurationProjectionArtifactSource[];
+    mask?: MaskFn;
+}
+type CurationEnqueueRefusalReason = 'invalid-payload' | 'artifact-inventory-mismatch' | 'artifact-missing' | 'artifact-sha-mismatch' | 'artifact-byte-length-mismatch' | 'artifact-step-cap' | 'artifact-run-cap';
+type EnqueueCurationCandidateProjectionOutcome = {
+    kind: 'enqueued';
+    candidateId: string;
+} | {
+    kind: 'coalesced';
+    candidateId: string;
+} | {
+    kind: 'cap-exceeded';
+    candidateId: string;
+} | {
+    kind: 'refused';
+    reason: CurationEnqueueRefusalReason;
+};
+type ReadCurationCandidatePayloadOutcome = {
+    kind: 'absent';
+    present: false;
+} | {
+    kind: 'parsed';
+    present: true;
+    payload: CurationCandidatePayload;
+} | {
+    kind: 'malformed';
+    present: true;
+};
+interface ClaimNextJobOptions {
+    knowledgeRoot: string;
+    leaseId: string;
+    authority: CurrentWriterAuthority;
+}
+interface ClaimedCurationJob {
+    kind: 'claimed';
+    candidateId: string;
+    leaseId: string;
+    payload: CurationCandidatePayload;
+    candidateDir: string;
+    payloadPath: string;
+    artifactsDir: string;
+}
+interface MalformedClaimedCurationJob {
+    kind: 'malformed';
+    candidateId: string;
+    leaseId: string;
+    candidateDir: string;
+    payloadPath: string;
+    artifactsDir: string;
+    payloadPresent: true;
+}
+type ClaimNextJobOutcome = ClaimedCurationJob | MalformedClaimedCurationJob;
+interface RequeueClaimedOptions {
+    knowledgeRoot: string;
+    leaseId: string;
+    authority: CurrentWriterAuthority;
+}
+interface InspectDrainableCurationWorkOptions {
+    readonly knowledgeRoot: string;
+    readonly currentLeaseId: string;
+}
+interface DrainableCurationWork {
+    readonly queuedCandidateIds: readonly string[];
+    readonly recoverableClaimedCandidateIds: readonly string[];
+}
+interface CountRemainingCurationWorkOptions {
+    /** Diagnostic identity only. The current claim remains included in the count. */
+    readonly currentLeaseId?: string;
+}
+interface CurationRemainingWork {
+    readonly queued: number;
+    readonly claimedNonterminal: number;
+    readonly quarantined: number;
+}
+type CurationQuarantineReason = 'malformed-payload' | 'malformed-job-state' | 'malformed-authored-checkpoint';
+interface QuarantineClaimedOptions {
+    readonly knowledgeRoot: string;
+    readonly leaseId: string;
+    readonly candidateId: string;
+    readonly authority: CurrentWriterAuthority;
+    readonly reason: CurationQuarantineReason;
+}
+/** Return deterministic candidate-id order and ignore non-contract directory names. */
+declare function listQueuedCandidates(knowledgeRoot: string): string[];
+/** Visibility-only count over the same durable pending layout consumed by claimNextJob. */
+declare function countPendingCurationJobs(knowledgeRoot: string): number;
+/**
+ * Count every durable unit that prevents the queue from being complete.
+ *
+ * Unlike recovery visibility this includes the current writer's claim: a process can crash
+ * after its last pending rename, so excluding that claim would produce a false zero.
+ */
+declare function countRemainingCurationWork(knowledgeRoot: string, _options?: CountRemainingCurationWorkOptions): CurationRemainingWork;
+/** Return deterministic active/recoverable lease directory order. */
+declare function listClaimedLeases(knowledgeRoot: string): string[];
+/**
+ * Observe work the current writer can reach through the canonical reconciliation path.
+ *
+ * This deliberately performs no recovery itself. The current lease is excluded by the same
+ * identity rule as reconcileOnDrainStart; drainQueue remains the only owner of requeue mutation.
+ */
+declare function inspectDrainableCurationWork(options: InspectDrainableCurationWorkOptions): DrainableCurationWork;
+declare function readCurationCandidatePayload(candidateDir: string): ReadCurationCandidatePayloadOutcome;
+/** Atomically claim the lexicographically first queued content address. */
+declare function claimNextJob(opts: ClaimNextJobOptions): ClaimNextJobOutcome | undefined;
+/** Reclaim one dead lease without discarding an already-authored deterministic checkpoint. */
+declare function requeueClaimed(opts: RequeueClaimedOptions): string[];
+/**
+ * Fenced terminal disposition for a claimed job whose durable inputs cannot be interpreted.
+ * The claimed payload, optional lifecycle bytes, and reason document move as one directory.
+ */
+declare function quarantineClaimed(opts: QuarantineClaimedOptions): string;
+/**
+ * Copies the projection's artifacts through the declared mask before the candidate content
+ * address or any queue-visible directory exists.
+ */
+declare function enqueueCurationCandidateProjection(opts: EnqueueCurationCandidateProjectionOptions): EnqueueCurationCandidateProjectionOutcome;
+declare const enqueueCurationCandidate: typeof enqueueCurationCandidateProjection;
+
+declare const CURATION_JOB_STATE_SCHEMA_VERSION = 2;
+type CurationJobLifecycle = 'queued' | 'authored' | 'bundling' | 'committing' | 'done';
+declare const curationJobStateSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    candidateId: z.ZodString;
+    lifecycle: z.ZodType<CurationJobLifecycle, unknown, z.core.$ZodTypeInternals<CurationJobLifecycle, unknown>>;
+    embedCrashCount: z.ZodDefault<z.ZodNumber>;
+    authored: z.ZodOptional<z.ZodUnknown>;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+type CurationJobState = z.infer<typeof curationJobStateSchema>;
+interface WriteJobStateOptions {
+    knowledgeRoot: string;
+    candidateId: string;
+    lifecycle: CurationJobLifecycle;
+    authority: CurrentWriterAuthority;
+    embedCrashCount?: number;
+    authored?: unknown;
+}
+type ReadJobStateOutcome = {
+    kind: 'absent';
+    present: false;
+} | {
+    kind: 'parsed';
+    present: true;
+    state: CurationJobState;
+} | {
+    kind: 'malformed';
+    present: true;
+};
+interface PersistAuthoredCheckpointOptions {
+    knowledgeRoot: string;
+    candidateId: string;
+    authority: CurrentWriterAuthority;
+    authored: unknown;
+}
+type PersistAuthoredCheckpointOutcome = {
+    kind: 'persisted';
+    state: CurationJobState;
+} | {
+    kind: 'malformed-state';
+    present: true;
+};
+/** Read a strict lifecycle checkpoint; corrupt bytes remain a typed present signal. */
+declare function readJobState(knowledgeRoot: string, candidateId: string): ReadJobStateOutcome;
+declare function writeJobState(opts: WriteJobStateOptions): CurationJobState;
+/** Persist the validated-later authored value before any deterministic bundle mutation begins. */
+declare function persistAuthoredCheckpoint(opts: PersistAuthoredCheckpointOptions): PersistAuthoredCheckpointOutcome;
+
+declare const COMMIT_INTENT_SCHEMA_VERSION = 2;
+declare const commitIntentSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    candidateId: z.ZodString;
+    bundleId: z.ZodString;
+    deltaKind: z.ZodEnum<{
+        Add: "Add";
+        Confirm: "Confirm";
+        Supersede: "Supersede";
+        Deprecate: "Deprecate";
+        MintUnknown: "MintUnknown";
+        Noop: "Noop";
+    }>;
+    targetRecordId: z.ZodOptional<z.ZodString>;
+    epoch: z.ZodNumber;
+    observation: z.ZodOptional<z.ZodObject<{
+        effects: z.ZodArray<z.ZodObject<{
+            recordId: z.ZodString;
+            product: z.ZodString;
+            change: z.ZodEnum<{
+                confirmed: "confirmed";
+                superseded: "superseded";
+                deprecated: "deprecated";
+                added: "added";
+            }>;
+            atOrdinal: z.ZodNumber;
+            evidenceToken: z.ZodString;
+            byRecordId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        sourceRunId: z.ZodString;
+        observationId: z.ZodString;
+        originalDeltaKind: z.ZodEnum<{
+            Add: "Add";
+            Confirm: "Confirm";
+            Supersede: "Supersede";
+            Deprecate: "Deprecate";
+            MintUnknown: "MintUnknown";
+            Noop: "Noop";
+        }>;
+        appliedDeltaKind: z.ZodEnum<{
+            Add: "Add";
+            Confirm: "Confirm";
+            Supersede: "Supersede";
+            Deprecate: "Deprecate";
+            MintUnknown: "MintUnknown";
+            Noop: "Noop";
+        }>;
+        disposition: z.ZodEnum<{
+            apply: "apply";
+            downgraded: "downgraded";
+        }>;
+        downgradeReason: z.ZodOptional<z.ZodString>;
+        schemaVersion: z.ZodLiteral<2>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type CommitIntent = z.infer<typeof commitIntentSchema>;
+
+declare const AUTHORED_CHECKPOINT_SCHEMA_VERSION = 2;
+/** The deterministic author-facing projection of one durable queue payload. */
+type CurationJobView = Pick<CurationCandidatePayload, 'candidateId' | 'kind' | 'subtype' | 'rootCauseClass' | 'anchors' | 'summarySeed' | 'bodySeed' | 'distilledObservations' | 'scope' | 'buildOrdinal' | 'attributingObservationId' | 'executionContext'>;
+/** One retrieval hit as shown to the author through a small integer alias. */
+interface NeighborRecordBase {
+    alias: number;
+    recordId: RecordId;
+    summary: string;
+    anchors: Anchor[];
+    observedStatus: string;
+    observedOrdinal: number;
+}
+type NonFactNeighborRecord = {
+    [Kind in Exclude<BundleKind, 'fact'>]: {
+        kind: Kind;
+        subtype?: never;
+    };
+}[Exclude<BundleKind, 'fact'>];
+type NeighborRecord = NeighborRecordBase & ({
+    kind: 'fact';
+    subtype: FactSubtype;
+} | NonFactNeighborRecord);
+/**
+ * One authored outcome may carry multiple deltas (D-02): a procedure-extraction job can yield
+ * whole-flow AND sub-flow candidates from one trajectory. Fact/caution authoring produces a
+ * one-element array. The array is never empty.
+ */
+type AuthorOutcome = {
+    kind: 'authored';
+    deltas: Delta[];
+    authorship: CurationAuthorship;
+} | {
+    kind: 'fallback-required';
+    reason: CurationFallbackReason;
+};
+/** Provider-neutral author seam injected by the CLI composition root. */
+type CuratorAuthor = (job: CurationJobView, neighbors: NeighborRecord[]) => Promise<AuthorOutcome>;
+/**
+ * Caller-owned disposition authority. Phase 379 may extend this profile with its deterministic
+ * born-active drift-supersede carve-out without changing the author or checkpoint contracts.
+ */
+interface DispositionProfile {
+    mode: 'drain-to-active' | 'propose-only';
+}
+/**
+ * Resolve automatic curation authority from the run's already-captured execution context.
+ * Local work applies directly (432 D-08); CI and cloud stay proposed for the rolling-PR flow.
+ */
+declare function resolveDispositionProfile(executionContext: ExecutionContext): DispositionProfile;
+type CheckpointBundleDraft = BundleDraft & {
+    needsEnrichment?: true;
+};
+/**
+ * The SHARED structural boundary for a checkpoint. Neighbor membership and CAS freshness are
+ * deliberately disposition checks, so this schema validates structure without applying them.
+ * D-02: the checkpoint carries the authored outcome's FULL delta array — one durable authoring
+ * checkpoint per job, disposed delta-by-delta through the commit boundary.
+ *
+ * Deliberately origin-WIDE, and that is not an oversight — see
+ * `AUTHORED_CHECKPOINT_ORIGIN_ADMISSION` below. `AuthoredCheckpoint`'s inferred delta type is
+ * the type every in-process checkpoint carries, including the user-origin deltas the review
+ * verbs commit and the system-origin deltas rollback and the canary commit. Origin admission is
+ * a property of the DRAIN's parse boundary, not of the checkpoint shape.
+ */
+declare const authoredCheckpointSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    deltas: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        bundle: z.ZodType<CheckpointBundleDraft, unknown, z.core.$ZodTypeInternals<CheckpointBundleDraft, unknown>>;
+        origin: z.ZodEnum<{
+            user: "user";
+            import: "import";
+            agent: "agent";
+            system: "system";
+        }>;
+        scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+        citedIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+        precondition: z.ZodOptional<z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>>;
+        authorship: z.ZodOptional<z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>>;
+        kind: z.ZodLiteral<"Add">;
+    }, z.core.$strict>, z.ZodObject<{
+        targetId: z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>;
+        evidenceToken: z.ZodPipe<z.ZodString, z.ZodTransform<_vostride_agent_qa_schema.EvidenceToken, string>>;
+        origin: z.ZodEnum<{
+            user: "user";
+            import: "import";
+            agent: "agent";
+            system: "system";
+        }>;
+        scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+        citedIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+        precondition: z.ZodOptional<z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>>;
+        authorship: z.ZodOptional<z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>>;
+        kind: z.ZodLiteral<"Confirm">;
+    }, z.core.$strict>, z.ZodObject<{
+        victimId: z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>;
+        newBundle: z.ZodType<CheckpointBundleDraft, unknown, z.core.$ZodTypeInternals<CheckpointBundleDraft, unknown>>;
+        evidenceToken: z.ZodPipe<z.ZodString, z.ZodTransform<_vostride_agent_qa_schema.EvidenceToken, string>>;
+        origin: z.ZodEnum<{
+            user: "user";
+            import: "import";
+            agent: "agent";
+            system: "system";
+        }>;
+        scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+        citedIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+        precondition: z.ZodOptional<z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>>;
+        authorship: z.ZodOptional<z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>>;
+        kind: z.ZodLiteral<"Supersede">;
+    }, z.core.$strict>, z.ZodObject<{
+        targetId: z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>;
+        reason: z.ZodString;
+        origin: z.ZodEnum<{
+            user: "user";
+            import: "import";
+            agent: "agent";
+            system: "system";
+        }>;
+        scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+        citedIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+        precondition: z.ZodOptional<z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>>;
+        authorship: z.ZodOptional<z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>>;
+        kind: z.ZodLiteral<"Deprecate">;
+    }, z.core.$strict>, z.ZodObject<{
+        conflict: z.ZodObject<{
+            recordIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+            kind: z.ZodEnum<{
+                contradiction: "contradiction";
+                drift: "drift";
+                clarification: "clarification";
+            }>;
+        }, z.core.$strict>;
+        origin: z.ZodEnum<{
+            user: "user";
+            import: "import";
+            agent: "agent";
+            system: "system";
+        }>;
+        scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+        citedIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+        precondition: z.ZodOptional<z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>>;
+        authorship: z.ZodOptional<z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>>;
+        kind: z.ZodLiteral<"MintUnknown">;
+    }, z.core.$strict>, z.ZodObject<{
+        origin: z.ZodEnum<{
+            user: "user";
+            import: "import";
+            agent: "agent";
+            system: "system";
+        }>;
+        scope: z.ZodType<ScopeKey, unknown, z.core.$ZodTypeInternals<ScopeKey, unknown>>;
+        citedIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+        precondition: z.ZodOptional<z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>>;
+        authorship: z.ZodOptional<z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>>;
+        kind: z.ZodLiteral<"Noop">;
+    }, z.core.$strict>], "kind">>;
+    neighborIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<RecordId, string>>>;
+    preconditions: z.ZodArray<z.ZodType<CompareAndSet, unknown, z.core.$ZodTypeInternals<CompareAndSet, unknown>>>;
+    authorship: z.ZodType<CurationAuthorship, unknown, z.core.$ZodTypeInternals<CurationAuthorship, unknown>>;
+}, z.core.$strict>;
+type AuthoredCheckpoint = z.infer<typeof authoredCheckpointSchema>;
+/**
+ * Parse authored bytes at the drain's boundary — both when wrapping fresh author output
+ * (drain.ts:537) and when replaying crash-recovered state (drain.ts:992).
+ *
+ * BOTH sites, deliberately. Guarding only the recovery read would leave the injected author seam
+ * able to put a non-agent origin into the durable slot in the first place, which is the same
+ * defect one step upstream: a delta the store attributes to a person, authored by a model, that
+ * the autonomy floor would then let tombstone standing knowledge.
+ */
+declare function parseAuthoredCheckpoint(value: unknown): AuthoredCheckpoint;
+/**
+ * The per-delta commit unit sliced from a widened checkpoint. `commitCurationDelta` remains
+ * the ONE serialized mutation boundary and disposes exactly one delta per call; the drain
+ * slices the checkpoint and disposes each delta independently (D-02).
+ */
+interface AuthoredDeltaCheckpoint {
+    schemaVersion: typeof AUTHORED_CHECKPOINT_SCHEMA_VERSION;
+    delta: AuthoredCheckpoint['deltas'][number];
+    neighborIds: AuthoredCheckpoint['neighborIds'];
+    preconditions: AuthoredCheckpoint['preconditions'];
+    authorship: AuthoredCheckpoint['authorship'];
+}
+/** Slice one widened checkpoint into its ordered per-delta commit units. */
+declare function sliceAuthoredCheckpoint(checkpoint: AuthoredCheckpoint): AuthoredDeltaCheckpoint[];
+/** Re-widen one commit unit into a parseable singleton checkpoint (job-state persistence). */
+declare function widenAuthoredDeltaCheckpoint(slice: AuthoredDeltaCheckpoint): AuthoredCheckpoint;
+
+interface CanonicalBundleSnapshot {
+    recordId: RecordId;
+    kind: 'fact' | 'procedure' | 'caution' | 'unknown' | 'policy';
+    anchors: readonly Anchor[];
+    scope: ScopeKey;
+    createdAtOrdinal: number;
+    events: readonly BundleOutcomeEvent[];
+    status: BundleStatus;
+    curationJobId?: string;
+}
+
+/** Provisional §7.3.1 cap. Phase 379 may retune it only through an explicit constant edit. */
+declare const BLAST_RADIUS_MAX_SUPERSEDES_PER_ANCHOR_PER_DRAIN = 1;
+
+/**
+ * 381-03 (PROC-01 D-02/D-03): the verified queue evidence the procedure-extraction wall
+ * validates against. It is code-derived queue truth — distilled observations — never LLM text.
+ */
+interface ProcedureDispositionEvidence {
+    distilledObservations: readonly DistilledObservation[];
+}
+interface DispositionCandidateContext {
+    anchors: readonly Anchor[];
+    scope: ScopeKey;
+    buildOrdinal: number;
+    /** Durable queue address used as the observation's idempotency identity. */
+    curationJobId?: string;
+    /** Original measurement seed value; prose authored by a model is never parsed for authority. */
+    measurementValue?: string;
+    /** Present only for procedure-extraction jobs; procedure deltas fail closed without it. */
+    procedureEvidence?: ProcedureDispositionEvidence;
+}
+interface RelationIntent {
+    type: 'proposed-supersession-of' | 'renamed-from';
+    targetId: RecordId;
+}
+interface DispositionDrainState {
+    supersedesSeenByAnchorKey: Map<string, number>;
+    /** 379 Open Question 3: one canonical O(store) scan, lazily cached per drain. */
+    canonicalBundles?: CanonicalBundleSnapshot[];
+    /** Test-only observability seam for proving the canonical scan runs once. */
+    onCanonicalBundleScan?: () => void;
+    /** Prevent two jobs in one drain from arming the same not-yet-published unknown. */
+    unknownMarkersSeen?: Set<string>;
+    /** New anchor groups observed by earlier jobs after the once-per-drain snapshot. */
+    firstSeenAnchorsByScope?: Map<string, Map<string, {
+        buildOrdinal: number;
+        recordId?: RecordId;
+    }>>;
+}
+interface FirstSeenRegistration {
+    scopeKey: string;
+    supersessionKey: string;
+    buildOrdinal: number;
+}
+interface UnknownMintIntent {
+    kind: 'thrash' | 'scope-burst';
+    marker: string;
+    triggerKey: string;
+    scope: ScopeKey;
+    windowOpenOrdinal: number;
+    windowCloseOrdinal: number;
+    evidenceRecordIds: RecordId[];
+    includeCommittedBundle: boolean;
+    firstSeenCount?: number;
+}
+interface UnknownResolutionIntent {
+    targetId: RecordId;
+    reason: 'thrash-stable-window';
+}
+interface DisposeDeltaInput {
+    delta: Delta;
+    checkpoint: AuthoredDeltaCheckpoint;
+    profile: DispositionProfile;
+    knowledgeRoot: string;
+    priors?: TrustPriorTable;
+    /**
+     * Verified queue evidence needed for anchor and new-ordinal checks. Optional only for the
+     * non-mutating delta shapes; Add and Supersede fail closed when it is absent.
+     */
+    candidate?: DispositionCandidateContext;
+    drainState: DispositionDrainState;
+}
+type DispositionOutcome = {
+    kind: 'apply';
+    delta: Delta;
+    relationIntents?: RelationIntent[];
+    bornActive?: true;
+    measurementAppend?: {
+        victimId: RecordId;
+        observation: MeasurementObservation;
+    };
+    unknownMintIntents?: UnknownMintIntent[];
+    unknownResolutionIntents?: UnknownResolutionIntent[];
+    firstSeenRegistration?: FirstSeenRegistration;
+} | {
+    kind: 'downgraded';
+    delta: Delta;
+    reason: string;
+    original: Delta;
+    relationIntents?: RelationIntent[];
+    measurementAppend?: {
+        victimId: RecordId;
+        observation: MeasurementObservation;
+    };
+    unknownMintIntents?: UnknownMintIntent[];
+    unknownResolutionIntents?: UnknownResolutionIntent[];
+    firstSeenRegistration?: FirstSeenRegistration;
+} | {
+    kind: 'requeue-resynthesis';
+    reason: string;
+} | {
+    kind: 'noop';
+    reason: string;
+};
+/**
+ * Every way `checkCitedIdIntegrity` can decide this store cannot stand behind a cited id.
+ *
+ * The registry exists so the count stops being something a comment or a corpus has to keep in
+ * step. Round 2 measured what happens when it is not one: the check's second return is a
+ * three-way disjunction, the corpus and the doc comment both said "three conditions", and
+ * carving `scope-mismatch` out of the refusal for every origin left 3 files / 70 tests green.
+ * A fifth member added here is a compile error at `citedIdIntegrityFailure`'s derivation and at
+ * the corpus's `satisfies Record<CitedIdIntegrityCondition, …>` fixture table.
+ */
+declare const CITED_ID_INTEGRITY_CONDITIONS: readonly ["not-a-persisted-neighbor", "missing-from-disk", "deprecated", "scope-mismatch"];
+type CitedIdIntegrityCondition = (typeof CITED_ID_INTEGRITY_CONDITIONS)[number];
+/**
+ * The typed refusal a USER-authored delta receives when its cited-id integrity check fails.
+ *
+ * Thrown rather than returned, and out of the check funnel rather than out of the commit, so it
+ * fires before any canonical byte moves for this delta: `disposeDelta` runs `checkCitedIdIntegrity`
+ * first of the six §7.3.1 checks, ahead of every append, projection and promotion.
+ * `applyReview`'s `commitAndPublish` catches it, restores the proposal to pending and rethrows,
+ * which is how the caller gets a typed answer instead of a receipt for work nobody did.
+ *
+ * WHAT MAKES "NOTHING MOVED" TRUE, and it is not this sentence. The previous version of this
+ * comment asserted whole-store neutrality as free-standing prose, naming no mechanism, and the
+ * round-2 verifier measured that claim FALSE: the delta had already reached disposition through
+ * `knowledge-store.ts`'s bridge, which materialized a claimed curation candidate on disk before
+ * `commitWithProfile` ever called into the commit, and the throw left it there for the next
+ * drain's reconcile to requeue (CR-02″). Two mechanisms now establish the claim, and each of them
+ * reds if it is removed:
+ *
+ *   1. `bridgeDelta` is WRITE-FREE (`curator/knowledge-store.ts`). It computes the candidate's
+ *      address and materializes nothing, so a check that throws at any position has nothing to
+ *      leave behind. Reintroducing its two write statements reds the case in (2).
+ *   2. `review/__tests__/apply-review.test.ts` asserts `hashTree(knowledgeRoot)` and the tree's
+ *      full entry listing — QUEUE TREE INCLUDED — are identical across a refused `accept`, with
+ *      a potency control proving the digest is falsifiable over that exact root.
+ *
+ * The scope of the guarantee is the knowledge root. The writer lease's own fencing state
+ * (`.epoch`, `.writer-authority.sqlite`) advances on acquisition regardless of what the caller
+ * then does, which is why the case above holds the lease across its measurement rather than
+ * excusing those two names.
+ */
+declare class UserDeltaCitationIntegrityError extends Error {
+    readonly recordId: RecordId;
+    readonly deltaKind: Delta['kind'];
+    readonly condition: CitedIdIntegrityCondition;
+    constructor(recordId: RecordId, deltaKind: Delta['kind'], condition: CitedIdIntegrityCondition);
+}
+/**
+ * Run memory.md §7.3.1's six checks in order. The function is deliberately synchronous: every
+ * decision is made from the persisted checkpoint and canonical bundle tree, never an index row.
+ */
+declare function disposeDelta(input: DisposeDeltaInput): DispositionOutcome;
+
+interface CommitCurationJob extends ClaimedCurationJob {
+    screenStates?: readonly ScreenState[];
+    /** Product authority resolved with the checkpoint; absent ids must be globally unique. */
+    targetProducts?: Readonly<Record<string, string>>;
+}
+interface CommitCurationDependencies {
+    knowledgeRoot: string;
+    epoch: number;
+    profile: DispositionProfile;
+    drainState: DispositionDrainState;
+    /** Host-resolved posture as data; absent means the v51 floor. */
+    resolvePromotionPosture?: ResolvePromotionPosture;
+    priors?: TrustPriorTable;
+    /**
+     * Multi-delta disposal (D-02): when set, terminal paths skip queue completion so the
+     * claimed candidate directory stays available for the checkpoint's remaining deltas.
+     * The drain leaves it unset on the final delta, which completes the job as before.
+     */
+    deferCompletion?: true;
+    hooks?: {
+        /**
+         * Test/chaos seam after every pre-staging write and immediately before the commit tail
+         * enters its current-writer-authority section. Nothing durable and reader-relevant to this
+         * candidate has been published yet when it fires.
+         */
+        beforeCommitAuthorityEntry?: () => void;
+        /** Test/chaos seam immediately after the durable intent rename. */
+        afterIntentWritten?: () => void;
+        /** Test/chaos seam while the complete bundle is staged but still reader-invisible. */
+        beforePublishRename?: () => void;
+        /** Test/chaos seam after lock-held authority comparison and before finalize. */
+        afterFinalAuthorityCompare?: () => void;
+        /** Test-only bounded-takeover override; production uses the pinned lock deadline. */
+        mutationLockTakeoverMs?: number;
+        /** Test/chaos seam after each durable mutable-file replacement. */
+        afterMutableReplacement?: (targetRelPath: string) => void;
+        /** Test/chaos seam after a fresh bundle publish and before its index projection. */
+        afterBundlePublished?: (bundleId: RecordId) => void;
+        /** Test/chaos seam after the index transaction and before intent removal. */
+        afterIndexApplied?: (bundleId: RecordId) => void;
+        /** Test/chaos seams around the durable observation/cleanup boundary. */
+        afterEffectReceiptsWritten?: () => void;
+        afterIntentCleared?: () => void;
+    };
+    operations?: {
+        /** Test/chaos seam; production always uses the canonical publisher. */
+        publishBundle?: (config: BundleStoreConfig, input: PublishBundleInput) => PublishBundleOutcome;
+    };
+}
+interface CommittedBundleResult {
+    bundleId: RecordId;
+    bundleDir: string;
+    deltaKind: Delta['kind'];
+    /** D-16 exception-bucket observability; absent when the gate promotes or never runs. */
+    promotionHoldReason?: PromotionGateHoldReason;
+    promotionPath?: PromotionPath;
+}
+/**
+ * 381-47 (F-381-45-1): WHY a delta-noop disposition had nothing to apply. `authored-noop`
+ * = a capable-model author deliberately emitted a Noop delta; the `fallback-*` members
+ * name WHICH author fallback defeated extraction (the §7.9 one-element procedure Noop).
+ * Benign noop reasons (evidence-token dedup, disposition rejects) never carry a cause.
+ */
+type EmptyDeltaCause = 'authored-noop' | 'fallback-malformed' | 'fallback-no-model' | 'fallback-token-budget' | 'fallback-model-error';
+type CommitCurationOutcome = ({
+    kind: 'applied';
+} & CommittedBundleResult) | ({
+    kind: 'downgraded';
+    reason: string;
+    original: Delta;
+} & CommittedBundleResult) | ({
+    kind: 'converted-confirm';
+} & CommittedBundleResult) | {
+    kind: 'abandoned-stale-epoch';
+    observedEpoch: number;
+} | {
+    kind: 'failed';
+    reason: 'identity-collision' | 'append-failed';
+    collisionReason?: Extract<PublishBundleOutcome, {
+        kind: 'identity-collision';
+    }>['reason'];
+} | {
+    kind: 'noop';
+    reason: string;
+    emptyDeltaCause?: EmptyDeltaCause;
+} | {
+    kind: 'requeue-resynthesis';
+    reason: string;
+};
+interface ApplyIndexDeltaForBundleInput {
+    knowledgeRoot: string;
+    priors?: TrustPriorTable;
+    bundleId: string;
+    product?: string;
+}
+/** Shared Plan 378-10 projection authority used by commit and journal reconciliation. */
+declare function applyIndexDeltaForBundle(input: ApplyIndexDeltaForBundleInput): void;
+/** Recovery alias deliberately delegates to the same projection unit as the live tail. */
+declare function deriveIndexRowFromBundle(input: ApplyIndexDeltaForBundleInput): void;
+/**
+ * The one serialized mutation boundary: fresh epoch, disposition, intent, fresh epoch, publish,
+ * append-only lifecycle, canonical index projection, intent clear, and queue completion.
+ */
+declare function commitCurationDelta(deps: CommitCurationDependencies, job: CommitCurationJob, checkpoint: AuthoredDeltaCheckpoint): CommitCurationOutcome;
+
+interface ReconcileOnDrainStartHooks {
+    /**
+     * Fires immediately before a stale intent is renamed aside. The only seam that can reproduce
+     * the race a second reconciler on another host creates: it removes the intent file between our
+     * listing and our rename.
+     */
+    beforeStaleQuarantine?(candidateId: string, epoch: number): void;
+}
+interface ReconcileOnDrainStartDependencies {
+    knowledgeRoot: string;
+    writerAuthority: CurrentWriterAuthority;
+    hasIndexRow(bundleId: string): boolean;
+    applyIndexDelta(intent: CommitIntent): void;
+    deriveIndexRowFromBundle(bundleId: string): void;
+    hooks?: ReconcileOnDrainStartHooks;
+}
+interface ReconcileReport {
+    intentsCleared: number;
+    intentsReplayed: number;
+    intentsDiscarded: number;
+    /** Intents authored before the reconciled-epoch watermark: renamed aside, never replayed. */
+    intentsQuarantinedStale: number;
+    jobsRequeued: number;
+    orphansRemoved: number;
+    /** Present on production reconciliation; optional keeps injected legacy test reports compatible. */
+    mutationsRecovered?: number;
+    malformed: number;
+}
+declare function reconcileOnDrainStart(deps: ReconcileOnDrainStartDependencies): ReconcileReport;
+
+/**
+ * CR-02 takeover barriers. Test-only seams naming the three points at which a canary flow is
+ * about to make canonical state durable; production callers omit them.
+ *
+ * The two entry barriers fire OUTSIDE the held section, which is what lets a schedule complete a
+ * real takeover there and then observe the resumed writer's refusal. `beforeIndexProjection` fires
+ * INSIDE it, so its schedule observes a contender blocked behind the tail instead.
+ */
+interface CanaryAuthorityHooks {
+    /** Immediately before the negative arm enters its held section. */
+    beforeNegativeAppend?: () => void;
+    /** Immediately before the positive arm enters its held promotion section. */
+    beforePromotionAppend?: () => void;
+    /** Inside the negative arm's held section, between its append and its projection. */
+    beforeIndexProjection?: () => void;
+}
+interface CreateLocalKnowledgeStoreConfig {
+    knowledgeRoot: string;
+    executionContext: ExecutionContext;
+    /** The holder's fresh lease epoch. Defaults to a fresh disk read for composition roots. */
+    epoch?: number;
+    /**
+     * The caller's real writer-lease id, paired with `epoch`.
+     *
+     * CR-02: every canonical append, promotion, and index projection this store performs carries
+     * this identity into `withCurrentWriterAuthority`, so a store constructed by someone who is not
+     * the published holder is refused at its first canonical mutation instead of laundering a
+     * fabricated id. It is required precisely so no code path can omit it and fall back to one.
+     */
+    writerLeaseId: string;
+    /** Port calls lack a run ordinal; callers with run context should supply it. */
+    sourceBuildOrdinal?: number;
+    sourceRunId?: string;
+    /** 2026-09-07, 418 D-07: queue entry identity stamped as producedBy.jobId. */
+    sourceJobId?: string;
+    screenStates?: readonly ScreenState[];
+    resolvePromotionPosture?: ResolvePromotionPosture;
+    /** Resolved once at construction; only neutral immutable data reaches folds and projections. */
+    resolveTrustPriors?: () => TrustPriorTable | undefined;
+    onPromotionOutcome?: (report: PromotionOutcomeReport) => void;
+    /** Fault-injection seam; production callers must omit it. */
+    canaryAuthorityHooks?: CanaryAuthorityHooks;
+    /**
+     * Joins the caller's own terminal work to the canary tail's held section. The drain's `done`
+     * job-state write uses this so the append, the projection, and the lifecycle transition are one
+     * indivisible section; implementations must use within-held write forms only.
+     */
+    onCanaryTailWithinCurrentAuthority?: () => void;
+    operations?: {
+        /** Test/chaos seam; production always uses commitCurationDelta. */
+        commitCurationDelta?: typeof commitCurationDelta;
+    };
+}
+interface PromotionOutcomeReport {
+    candidateId: RecordId;
+    promotionPath?: PromotionPath;
+    promotionHoldReason?: PromotionGateHoldReason;
+}
+/**
+ * @deprecated `recordCanaryOutcome` is implemented. The exported class remains only so code
+ * compiled against the pre-380 package surface does not lose its named import.
+ */
+declare class KnowledgeStoreNotImplementedError extends Error {
+    readonly operation: 'recordCanaryOutcome';
+    constructor(operation: 'recordCanaryOutcome', _retiredOwnerPhase?: 380);
+}
+type KnowledgePromotionErrorReason = PromotionGateHoldReason | 'propose-only' | 'not-found';
+/** Typed refusal for the evidence-gated promote port; callers never receive a force path. */
+declare class KnowledgePromotionError extends Error {
+    readonly candidateId: RecordId;
+    readonly reason: KnowledgePromotionErrorReason;
+    constructor(candidateId: RecordId, reason: KnowledgePromotionErrorReason);
+}
+declare class KnowledgeCommitError extends Error {
+    readonly outcome: CommitCurationOutcome;
+    constructor(outcome: CommitCurationOutcome);
+}
+/** Typed WR-02 refusal for procedure drafts that require evidence this port cannot carry. */
+declare class KnowledgeUnsupportedDeltaError extends Error {
+    readonly deltaKind: Delta['kind'];
+    readonly reason: 'procedure-evidence-unsupported';
+    constructor(deltaKind: Delta['kind']);
+}
+/**
+ * Realizes the agent write port over the canonical mutation path. D-08 propose-only is a
+ * disposition profile inside commitCurationDelta, never a second mutation path. Because the port
+ * carries bare deltas, this bridge materializes the smallest queue/checkpoint envelope and resolves
+ * cited neighbor truth from canonical bundles before entering disposition.
+ */
+declare function createLocalKnowledgeStore(config: CreateLocalKnowledgeStoreConfig): KnowledgePort;
+
+type MaintenanceSkipReason = 'lease-held' | 'budget-exhausted' | 'aborted' | 'daemon-cadence';
+type WriterPassReport = {
+    kind: 'not-requested';
+} | {
+    kind: 'skipped';
+    reason: MaintenanceSkipReason;
+} | {
+    kind: 'rebuilt';
+    request?: RebuildRequest;
+    rebuild: RebuildReport;
+} | {
+    kind: 'failed';
+    message: string;
+};
+type GcPassReport = {
+    kind: 'not-run';
+} | {
+    kind: 'skipped';
+    reason: MaintenanceSkipReason;
+} | {
+    kind: 'completed';
+    summary: GcSummary;
+    /** WR-01: projection rows removed by the same-tail scoped cleanup; absent on zero-trim. */
+    projectionRowsRemoved?: number;
+} | {
+    kind: 'failed';
+    message: string;
+};
+interface MaintenanceOperations {
+    readRebuildRequest: typeof readRebuildRequest;
+    readIndexMaintenanceState: typeof readIndexMaintenanceState;
+    acquireEmbedder: typeof acquireEmbedder;
+    rebuildIndex: typeof rebuildIndex;
+    runKnowledgeGc: typeof runKnowledgeGc;
+    removeBundleProjectionRows: typeof removeBundleProjectionRows;
+    beforeGcRemoval?: RunKnowledgeGcHooks['beforeGcRemoval'];
+}
+interface MaintenanceBudget {
+    now: () => number;
+    startedAtMs: number;
+    limitMs: number;
+}
+interface RunMaintenanceTailOptions {
+    knowledgeRoot: string;
+    /** Same host-resolved data supplied to drains and review stores. */
+    priors?: TrustPriorTable;
+    lease: {
+        leaseId: string;
+        epoch: number;
+    };
+    /** Host-resolved posture; daemon callers pass worker-required, one-shot callers omit it. */
+    embeddingCapability?: AcquireEmbedderOutcome;
+    /** Omit for daemon cadence; one-shot drains provide their 60 s boundary explicitly. */
+    budget?: MaintenanceBudget;
+    /** Fault-injection seam; production callers must omit it. */
+    operations?: Partial<MaintenanceOperations>;
+    /** One-shot drains fold authority loss into their report; daemon callers surface it by default. */
+    surfaceAuthorityLoss?: boolean;
+}
+interface MaintenanceTailFailure {
+    stage: 'writer-pass' | 'gc';
+    error: unknown;
+}
+interface MaintenanceTailResult {
+    writerPass: WriterPassReport;
+    gc: GcPassReport;
+    failures: MaintenanceTailFailure[];
+}
+/**
+ * Run the writer-repair and canonical-GC tail as one host-independent callable.
+ *
+ * Daemon callers omit budget and receive stale authority errors unchanged. The one-shot drain
+ * supplies its existing wall-clock boundary and folds typed failures into DrainReport.
+ */
+declare function runMaintenanceTail(options: RunMaintenanceTailOptions): Promise<MaintenanceTailResult>;
+
+/** Ratified M2 one-shot budget. A run's tail aborts an author request in flight at its end. */
+declare const DRAIN_BUDGET_MS = 60000;
+/** Provisional §7.4 cap over distinct search-before-create query targets. */
+declare const SEARCH_BEFORE_CREATE_MAX_QUERIES = 5;
+/** Provisional 376 D-14 per-job breaker before a vector-deferred commit is forced. */
+declare const EMBED_CRASH_VECTORLESS_THRESHOLD = 2;
+type DrainFailureStage = 'lease' | 'reconcile' | 'claim' | 'heartbeat' | 'job-state' | 'search' | 'author' | 'checkpoint' | 'commit' | 'quarantine' | 'requeue' | 'release' | 'writer-pass' | 'gc';
+interface DrainFailure {
+    stage: DrainFailureStage;
+    message: string;
+    candidateId?: string;
+}
+/**
+ * A commit that decided there was nothing to apply. Legitimate reasons exist (evidence-token
+ * dedup), so a noop is never a failure — but dropping it on the floor made live procedure
+ * extraction die silently for 13 UAT runs (G-381-1). Visibility, never a gate.
+ */
+interface DrainNoop {
+    candidateId: string;
+    reason: string;
+    /**
+     * 381-47: present only on delta-noop entries — distinguishes a defeated extraction
+     * (`fallback-*`) from a deliberate authored Noop; benign dedup carries no cause.
+     */
+    emptyDeltaCause?: EmptyDeltaCause;
+}
+interface DrainPromotionOutcome {
+    candidateId: string;
+    promotionPath?: PromotionPath;
+    promotionHoldReason?: PromotionGateHoldReason;
+}
+interface DrainReportBase {
+    /** Actual surviving effects for the requested run, also present on incomplete drains. */
+    effects?: readonly CurationSnapshotChange[];
+    /** Certified only after a complete drain; absent for historical missing receipts. */
+    snapshot?: CurationSnapshot;
+    /**
+     * The effects committed; only the projection over them failed, so `snapshot` is absent. Never a
+     * failure: the drain stays complete and nothing is retried or refolded.
+     */
+    snapshotFoldFailed?: true;
+    jobsProcessed: number;
+    committed: number;
+    evidenceCommitted?: number;
+    /**
+     * Committed deltas whose kind was `Deprecate` (388-02).
+     *
+     * OPTIONAL because the drain report is constructed by fault-injection fakes across four
+     * packages and a required field would make every one of them a compile error over a number
+     * they have no opinion about. The real drain always sets it, so a production report saying
+     * `deprecated: 0` is a measurement rather than an absence — which is what the post-run
+     * chain's notification (D-11) needs in order to tell a drain that deprecated nothing apart
+     * from a drain that never ran at all.
+     */
+    deprecated?: number;
+    /** Optional for fault-injection fakes; the real drain always sets this measurement. */
+    promotions?: readonly DrainPromotionOutcome[];
+    downgraded: number;
+    withheld: number;
+    quarantined: number;
+    requeued: number;
+    failures: number;
+    failureDetails: DrainFailure[];
+    noops: number;
+    noopDetails: DrainNoop[];
+    reconcile: ReconcileReport | undefined;
+    writerPass: WriterPassReport;
+    gc: GcPassReport;
+    /** Visibility only: every durable disposition that still prevents queue completion. */
+    remaining: number;
+    /** Durable remainder partition. The current writer's nonterminal claim is included. */
+    remainingWork: CurationRemainingWork;
+}
+type DrainReport = DrainReportBase & ({
+    kind: 'drained' | 'aborted';
+} | {
+    kind: 'handed-off';
+    holder: WriterLease;
+});
+type CurationDrainLifecycleEvent = {
+    readonly kind: 'job-claimed';
+    readonly candidateId: string;
+} | {
+    readonly kind: 'job-completed';
+    readonly candidateId: string;
+};
+/**
+ * Internal capability table used by focused fault-injection tests. Production callers omit it;
+ * every default delegates directly to the shipped queue, lease, retrieval, commit, and rebuild
+ * authorities.
+ */
+interface DrainOperations extends MaintenanceOperations {
+    acquireWriterLease: typeof acquireWriterLease;
+    heartbeatLease: typeof heartbeatLease;
+    releaseLease: typeof releaseLease;
+    reconcileOnDrainStart: typeof reconcileOnDrainStart;
+    claimNextJob: typeof claimNextJob;
+    quarantineClaimed: typeof quarantineClaimed;
+    requeueClaimed: typeof requeueClaimed;
+    readJobState: typeof readJobState;
+    writeJobState: typeof writeJobState;
+    persistAuthoredCheckpoint: typeof persistAuthoredCheckpoint;
+    openKnowledgeReader: typeof openKnowledgeReader;
+    buildRetrievalQuery: typeof buildRetrievalQuery;
+    retrieve: typeof retrieve;
+    commitCurationDelta: typeof commitCurationDelta;
+    /** The canonical commit already projects dense work as pending; the breaker selects this seam. */
+    commitCurationDeltaVectorless: typeof commitCurationDelta;
+    hasIndexRow(knowledgeRoot: string, bundleId: string): boolean;
+    applyIndexDeltaForBundle: typeof applyIndexDeltaForBundle;
+    deriveIndexRowFromBundle: typeof deriveIndexRowFromBundle;
+    /** CR-02 takeover barriers for the canary branch; production omits them. */
+    canaryAuthorityHooks?: CanaryAuthorityHooks;
+}
+interface DrainOptions {
+    /** A per-run reader request, independent of which queued jobs this drain claims. */
+    sourceRunId?: string;
+    observationIds?: readonly string[];
+    knowledgeRoot: string;
+    /** `unbounded` is reserved for a standing host whose process lifetime is the boundary. */
+    budgetMs?: number | 'unbounded';
+    /** Standing writer authority owned by the caller; drainQueue never mutates its lifecycle. */
+    lease?: {
+        leaseId: string;
+        epoch: number;
+    };
+    author: CuratorAuthor;
+    executionContext: ExecutionContext;
+    /** Host-resolved posture; daemon sessions pass worker-required capability here. */
+    embeddingCapability?: AcquireEmbedderOutcome;
+    /** Built once per drain on the host; synchronous per candidate inside the gate. */
+    resolvePromotionPosture?: ResolvePromotionPosture;
+    /** Already-resolved host snapshot; the host retains this data across queue retries. */
+    priors?: TrustPriorTable;
+    /** Default inline preserves one-shot behavior; daemon sessions skip for their own cadence. */
+    maintenance?: 'inline' | 'skip';
+    signal?: AbortSignal;
+    /** Synchronous durable-boundary observer; daemon hosts append these facts before proceeding. */
+    onJobLifecycle?: (event: CurationDrainLifecycleEvent) => void;
+    /** D-06 test seam. Production uses the one wall clock only at drain boundaries. */
+    now?: () => number;
+    /** Fault-injection seam; production callers must omit it. */
+    operations?: Partial<DrainOperations>;
+}
+/**
+ * Lease-gated one-shot Curator drain. It owns no provider: authoring is injected, serialized, and
+ * durably checkpointed before the deterministic commit tail. Abort and budget are checked at job
+ * boundaries; an in-flight model request is cut off only by the host's own author signal.
+ */
+declare function drainQueue(options: DrainOptions): Promise<DrainReport>;
+
+declare const PURGE_RECEIPT_SCHEMA_VERSION = 2;
+/**
+ * Content-free committed audit receipt shared by the purge writer and read-only maintenance
+ * history. Keeping the contract outside purge.ts prevents the reader graph from importing the
+ * destructive implementation merely to validate committed receipt bytes.
+ */
+declare const PurgeReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    purgedRecordId: z.ZodString;
+    purgedAtOrdinal: z.ZodNumber;
+    initiator: z.ZodString;
+    affectedPaths: z.ZodArray<z.ZodString>;
+    firstCommittedOrdinal: z.ZodNumber;
+}, z.core.$strict>;
+declare const purgeReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    purgedRecordId: z.ZodString;
+    purgedAtOrdinal: z.ZodNumber;
+    initiator: z.ZodString;
+    affectedPaths: z.ZodArray<z.ZodString>;
+    firstCommittedOrdinal: z.ZodNumber;
+}, z.core.$strict>;
+type PurgeReceipt = z.infer<typeof PurgeReceiptSchema>;
+declare function guardPurgeReceipt(value: unknown): PurgeReceipt;
+
+interface PurgeAffectedBundleTarget {
+    product: string;
+    bundleDir: string;
+    kind: LoadedBundle['frontmatter']['kind'];
+    affectedPaths: string[];
+}
+interface PurgeAffectedQueueTarget {
+    candidateId: string;
+    candidateDir: string;
+    jobStatePath: string;
+}
+/**
+ * Content-free, deterministic statement of every local surface one purge operation will affect.
+ * This is the single planning shape shared by preview, the under-lease recheck, and destructive
+ * execution.
+ */
+interface PurgeAffectedSet {
+    recordId: string;
+    state: 'live' | 'resume' | 'already-purged' | 'not-found';
+    bundles: PurgeAffectedBundleTarget[];
+    receiptAffectedPaths: string[];
+    projectionTargets: string[];
+    embedCacheAction: 'clear-all';
+    queueTargets: PurgeAffectedQueueTarget[];
+    intentPath: string;
+    receiptPath: string;
+}
+interface PurgeRecordInput {
+    knowledgeRoot: string;
+    recordId: RecordId;
+    /** Caller-owned sovereign identity; Phase 382 supplies the confirmed user identity. */
+    initiator: string;
+    /** Runtime-counter reservation used for a fresh destruction receipt; resumes reuse intent. */
+    purgedAtOrdinal?: number;
+    /** Governed maintenance callers fence this exact lease at every mutation boundary. */
+    writerAuthority?: WriterLeaseAuthority;
+    /** Fingerprint of the caller's preview; drift must fail before any mutation. */
+    expectedAffectedSetFingerprint?: string;
+    /** Test/chaos seam between purge phases; production callers omit it (commit.ts precedent). */
+    hooks?: {
+        /** Immediately after the durable intent publication. */
+        afterIntentWritten?: () => void;
+        /** After the transactional projection purge. */
+        afterProjectionPurge?: () => void;
+        /** After every committed bundle tree removal. */
+        afterBundleRemoval?: () => void;
+        /** After the queue payload sweep. */
+        afterQueueSweep?: () => void;
+        /** Immediately before the completion receipt publication. */
+        beforeReceiptPublish?: () => void;
+    };
+}
+type PurgeRecordOutcome = {
+    kind: 'purged';
+    receipt: PurgeReceipt;
+} | {
+    kind: 'already-purged';
+    receipt: PurgeReceipt;
+} | {
+    kind: 'not-found';
+};
+declare class PurgeTargetChangedError extends Error {
+    readonly expectedFingerprint: string;
+    readonly actualFingerprint: string;
+    readonly code = "purge-target-changed";
+    constructor(expectedFingerprint: string, actualFingerprint: string);
+}
+declare class PurgeTargetIntegrityError extends Error {
+    readonly targetPath: string;
+    readonly reason: string;
+    readonly code = "purge-target-integrity";
+    constructor(targetPath: string, reason: string);
+}
+declare class PurgeQueueIdentityError extends Error {
+    readonly targetPath: string;
+    readonly reason: string;
+    readonly code = "purge-queue-identity";
+    constructor(targetPath: string, reason: string);
+}
+declare class PurgeCompletionVerificationError extends Error {
+    readonly survivingSurface: string;
+    readonly code = "purge-completion-verification";
+    constructor(survivingSurface: string);
+}
+declare class PurgeChronologyRequiredError extends Error {
+    readonly code = "purge-chronology-required";
+    constructor();
+}
+declare function resolvePurgeAffectedSet(input: {
+    knowledgeRoot: string;
+    recordId: RecordId;
+}): PurgeAffectedSet;
+declare function purgeAffectedSetFingerprint(affectedSet: PurgeAffectedSet): string;
+/**
+ * Hard-remove one confirmed-sensitive record from every recoverable local-store surface.
+ *
+ * Recovery invariant (CR-04): nothing irreversible ever precedes a durable intent, so a retry
+ * either re-resolves intact state (crash before the intent) or replays the intent's persisted
+ * identities to the identical completion receipt (crash at any later boundary).
+ *
+ * Revival ratification (SC-4/DCAY-05, option a): bundle ids are deterministic content addresses,
+ * so purged-then-re-learned content re-mints the SAME record id. Receipt-exists-but-live-surfaces
+ * therefore runs a FRESH destruction cycle publishing the next append-only versioned receipt in
+ * the series; original audit receipts are never rewritten, and already-purged is attested only
+ * over verified-dead surfaces (live resolution always precedes any receipt-based attestation).
+ */
+declare function purgeRecord(input: PurgeRecordInput): PurgeRecordOutcome;
+
+/**
+ * The §7.7 projections a forget in THIS store actually scrubs, enumerated honestly.
+ *
+ * `KNOWLEDGE_PROJECTIONS` declares four — `fts`, `vec`, `graph`, `exemplar` — and a receipt
+ * claiming all four would be a receipt nobody can trust. `scrubDeadRecallRows` (index-rebuild.ts)
+ * deletes the FTS row, deletes the record from every materialised vec table, and deletes the
+ * record's graph edges plus the nodes those edges orphaned. It does NOT touch the exemplar
+ * ranking, and it should not: an exemplar in this system is a TEST reference drawn from the
+ * run-outcome projection (`serving/get-authoring-brief.ts`), not a knowledge record, so a
+ * forgotten record has no exemplar row to scrub. Listing `exemplar` anyway would be the receipt
+ * asserting work nobody did — which is worse than a receipt that says less, because a shorter
+ * true list can be lengthened and a false one cannot be believed.
+ *
+ * When the exemplar ranking gains knowledge-record rows, this constant is the one place that
+ * fact is recorded, and the receipt widens with it.
+ */
+declare const FORGET_SCRUBBED_PROJECTIONS: readonly KnowledgeProjection[];
+/** Resolves a `MEM-` short-ID to the machine id it addresses, or `undefined` (D-01/D-04). */
+type ResolveBundleShortId = (shortId: string) => string | undefined;
+/** A validated mark, accept, reject or forget, in the shape the review verbs take. */
+interface ReviewChangeRequest {
+    readonly verb: 'accept' | 'reject' | 'forget' | 'mark';
+    readonly input: KnowledgeAcceptInput | KnowledgeRejectInput | KnowledgeForgetInput | KnowledgeMarkInput;
+}
+declare class MarkPlanIntegrityError extends Error {
+    readonly recordId: string;
+    constructor(recordId: string);
+}
+
+/**
+ * How long a delegating process waits for the leaseholder to finish an apply (D-18).
+ *
+ * PINNED, not configured, on the `LEASE_HEARTBEAT_TTL_MS` idiom. 30s is chosen as "longer than any
+ * commit this store performs, shorter than a person's patience": a commit is a handful of file
+ * appends plus one bundle re-projection, all local. RETUNE from an observed apply that legitimately
+ * exceeded it — never from a flaky test, which is a symptom of a wedged holder rather than a slow
+ * one, and the wedged holder is exactly what this bound exists to refuse rather than wait out.
+ */
+declare const APPLY_DELEGATE_TIMEOUT_MS = 30000;
+/** The typed refusal a bounded wait produces. Never a generic timeout, never a takeover. */
+declare class ApplyDelegateTimeoutError extends Error {
+    readonly changeId: string;
+    readonly timeoutMs: number;
+    constructor(changeId: string, timeoutMs: number);
+}
+/** The typed refusal when a live holder exists and this host was given no way to reach it. */
+declare class ApplyDelegateUnavailableError extends Error {
+    readonly changeId: string;
+    readonly holder: WriterLease;
+    constructor(changeId: string, holder: WriterLease);
+}
+/** The record a change addresses left the store between resolution and commit. */
+declare class ReviewTargetVanishedError extends Error {
+    readonly changeId: string;
+    constructor(changeId: string);
+}
+interface WriterAuthority {
+    readonly leaseId: string;
+    readonly epoch: number;
+}
+/** A validated mark, accept, reject or forget, in the shape the review verbs already take. */
+type ExplicitReviewRequest = ReviewChangeRequest;
+/** What the writer-lease holder is handed: the same request and the same stable identity. */
+interface ExplicitReviewDelegation {
+    readonly request: ExplicitReviewRequest;
+    readonly operationId: string;
+}
+/**
+ * Hand the direct request to the leaseholder and wait bounded for its answer (D-18). Injected as
+ * an optional operation rather than built here: `knowledge-local` neither knows nor may know that a
+ * unix socket exists. A host supplies its transport; the leaseholder's own composition supplies
+ * nothing, which makes delegation recursion impossible by construction.
+ */
+type ExplicitReviewDelegate = (delegation: ExplicitReviewDelegation) => Promise<ExplicitReviewResult>;
+interface ApplyExplicitReviewInput {
+    readonly agentQaRoot: string;
+    readonly knowledgeRoot: string;
+    readonly request: ExplicitReviewRequest;
+    /**
+     * The caller's stable identity for this change, such as a mark intent's UUID. A retry with the
+     * same identity is the same change: its evidence tokens, receipts and record ids repeat.
+     */
+    readonly operationId: string;
+    /** The op making the change, stamped on Gate-3 receipts as `producedBy.opId`. */
+    readonly opId: string;
+    /** The caller's actual context. Recorded as-is; explicit authority never rewrites it. */
+    readonly executionContext: ExecutionContext;
+    readonly resolveBundleShortId?: ResolveBundleShortId;
+    readonly delegate?: ExplicitReviewDelegate;
+    readonly writerAuthority?: WriterAuthority;
+    readonly resolvePromotionPosture?: ResolvePromotionPosture;
+    readonly resolveTrustPriors?: () => TrustPriorTable | undefined;
+    readonly now?: () => number;
+    readonly delegateTimeoutMs?: number;
+}
+type ExplicitReviewResult = {
+    readonly outcome: 'applied';
+    readonly verb: KnowledgeReviewVerb;
+    readonly changeId: string;
+    /** The records the change added, confirmed or tombstoned, read back after the write. */
+    readonly recordIds: readonly string[];
+    readonly commitReceipt?: CommitReceipt;
+    readonly forgetReceipt?: ForgetReceiptV1;
+} | {
+    readonly outcome: 'target-not-found';
+    readonly verb: KnowledgeReviewVerb;
+    readonly changeId: string;
+    readonly target: KnowledgeTargetRef;
+} | {
+    readonly outcome: 'policy-materialize-refused';
+    readonly verb: KnowledgeReviewVerb;
+    readonly changeId: string;
+};
+/**
+ * Apply an explicit knowledge change in the call (432-06, D-04/D-05/D-09/D-11).
+ *
+ * No envelope is written, claimed or reloaded. A holder commits with its own authority, a free lease is acquired and released, and a live holder is
+ * handed the same validated request and identity, bounded, and is never stolen from. Retrying
+ * the same `operationId` lands nothing twice and answers the same record ids.
+ */
+declare function applyExplicitReview(input: ApplyExplicitReviewInput): Promise<ExplicitReviewResult>;
+
+/** The one directory name receipts live under, beneath the agent-qa runtime root. */
+declare const DRAFT_RECEIPTS_DIR_NAME = "draft-receipts";
+/** Thrown when a content digest could not be safely turned into a filename. */
+declare class DraftReceiptDigestError extends Error {
+    readonly contentDigest: string;
+    constructor(contentDigest: string);
+}
+/** Thrown when a persisted receipt was written under a different schema version. */
+declare class DraftReceiptSchemaVersionError extends Error {
+    readonly path: string;
+    readonly foundVersion: unknown;
+    constructor(path: string, foundVersion: unknown);
+}
+interface DraftReceiptsStoreOptions {
+    /**
+     * Where receipts are durable — `<configDir>/.agent-qa`. A FACTORY on the `createProposalsInbox`
+     * precedent: the CLI resolves its root asynchronously and per call, so closing over one resolved
+     * value would cache a fact this module does not own.
+     */
+    readonly resolveAgentQaRoot: () => Promise<string> | string;
+}
+interface DraftReceiptsStore {
+    /** Persist a receipt under its own `draftRef.contentDigest`. Create-on-first-write. */
+    put(receipt: DraftReceipt): Promise<void>;
+    /** The receipt for these draft bytes, or `undefined` if none was ever written. */
+    get(contentDigest: string): Promise<DraftReceipt | undefined>;
+    /** Every stored receipt, ordered by digest so two calls render the same table. */
+    list(): Promise<DraftReceipt[]>;
+}
+declare function draftReceiptsDir(agentQaRoot: string): string;
+/**
+ * Bind the three receipt verbs over one agent-qa runtime root.
+ *
+ * Nothing opens here and nothing is created until the first write, which is what lets a
+ * composition root bind this unconditionally without deciding whether a project has ever
+ * evaluated a draft — an absent directory and an empty store are the same answer.
+ */
+declare function createDraftReceiptsStore(options: DraftReceiptsStoreOptions): DraftReceiptsStore;
+
+type RollbackKind = 'job' | 'campaign';
+interface RollbackCounterEvent {
+    recordId: RecordId;
+    evidenceToken: string;
+    curationJobId: string;
+    type: 'confirmed' | 'deprecated' | 'superseded' | 'promoted';
+}
+type RollbackPlannedEffect = {
+    kind: 'deprecate-bundle';
+    product: string;
+    recordId: RecordId;
+} | {
+    kind: 'retract-counter' | 'retract-window-close' | 'retract-promotion';
+    product: string;
+    recordId: RecordId;
+    eventKey: string;
+    evidenceToken: string;
+    curationJobId: string;
+};
+interface RollbackBundleTarget {
+    product: string;
+    recordId: RecordId;
+}
+interface RollbackAffectedSet {
+    operationId: string;
+    /** Compatibility summary; plannedEffects is the product-qualified mutation authority. */
+    mintedBundleIds: RecordId[];
+    counterEvents: RollbackCounterEvent[];
+    plannedEffects: RollbackPlannedEffect[];
+    /** Projection healing targets; these never require a new rollback ordinal on their own. */
+    projectionTargets: RollbackBundleTarget[];
+    products: string[];
+}
+interface RollbackReport {
+    receiptId: string;
+    inverseCount: number;
+    restoredVictims: RecordId[];
+    deprecatedBundles: RecordId[];
+    /** Bundles whose surviving promoted events were cascade-retracted after support loss. */
+    retractedPromotions: RecordId[];
+    /** Auditable exact resolution that drove inverse construction. */
+    affected: RollbackAffectedSet;
+}
+type RollbackMutationKind = 'append' | 'projection';
+interface RollbackHooks {
+    /** Test/chaos seam after canonical resolution and causal preflight, before the first write. */
+    afterResolution?: () => void;
+    /** Test/chaos seam after one actual append or projection mutation completes. */
+    afterMutation?: (kind: RollbackMutationKind, recordId: RecordId) => void;
+}
+interface RollbackBaseInput {
+    knowledgeRoot: string;
+    resolvedAtOrdinal: number;
+    /** Governed maintenance callers fence this exact lease at every mutation boundary. */
+    writerAuthority?: WriterLeaseAuthority;
+    /** Preview fingerprint revalidated by the mutator immediately before its first write. */
+    expectedAffectedSetFingerprint?: string;
+    hooks?: RollbackHooks;
+}
+interface RollbackCurationJobInput extends RollbackBaseInput {
+    curationJobId: string;
+}
+interface RollbackCampaignInput extends RollbackBaseInput {
+    fromOrdinal?: number;
+    toOrdinal?: number;
+    anchorClusterKey?: string;
+    originClass?: OriginClass;
+}
+type ResolveRollbackAffectedSetInput = RollbackCurationJobInput | RollbackCampaignInput;
+/**
+ * CR-02: a rollback must never attest success at a resolution ordinal that is powerless to
+ * change lifecycle status. At equal buildOrdinal the trust fold's fixed STATUS_PRECEDENCE keeps
+ * active above deprecated, and an older event can never replace a newer status, so a
+ * non-strictly-later resolvedAtOrdinal cannot causally invert a minted bundle.
+ */
+declare class RollbackCausalityError extends Error {
+    readonly offendingRecordIds: RecordId[];
+    readonly minimumRequiredOrdinal: number;
+    constructor(offendingRecordIds: RecordId[], minimumRequiredOrdinal: number);
+}
+declare class RollbackPlanChangedError extends Error {
+    readonly name = "RollbackPlanChangedError";
+    readonly expectedFingerprint: string;
+    readonly actualFingerprint: string;
+    constructor(expectedFingerprint: string, actualFingerprint: string);
+}
+/** Stable identity for one selector and its product-qualified source-effect universe. */
+declare function rollbackReceiptId(kind: RollbackKind, keys: Readonly<Record<string, unknown>>, effectKeys?: readonly string[]): string;
+declare function rollbackAffectedSetFingerprint(affected: RollbackAffectedSet): string;
+/** Resolve the canonical rollback preview without appending inverse events or touching indexes. */
+declare function resolveRollbackAffectedSet(input: ResolveRollbackAffectedSetInput): RollbackAffectedSet;
+/** Resolve and append the ratified inverse map for one curation job. */
+declare function rollbackCurationJob(input: RollbackCurationJobInput): RollbackReport;
+/** Resolve and append the inverse map for an AND-composed provenance campaign. */
+declare function rollbackCampaign(input: RollbackCampaignInput): RollbackReport;
+
+/**
+ * 378-17 canonical mutable-target order, additively extended by 379 D-03:
+ * record, provenance, outcomes, measurements, relations, then manifest.
+ */
+declare const MUTABLE_BUNDLE_TARGETS: readonly ["record.md", "provenance.json", "evidence/outcomes.jsonl", "evidence/measurements.json", "evidence/gates.jsonl", "relations.json", "manifest.json"];
+
+type MarkTriage = {
+    kind: 'quarantined';
+    class: MarkQuarantineClass;
+    producer: string;
+} | {
+    kind: 'learnable';
+    rootCause?: {
+        class: VerdictClass;
+        producer: string;
+    };
+};
+declare function triageMark(member: PerTestOutcome): MarkTriage;
+declare function servedIdsOn(step: StepEvidence): string[];
+declare function procedureReadOn(member: PerTestOutcome, stepIndex: number): string | undefined;
+declare function assertionDrift(member: PerTestOutcome, step: StepEvidence): boolean;
+interface ServedRecordFacts {
+    recordId: string;
+    kind: BundleKind;
+    subtype?: FactSubtype;
+    anchors: Anchor[];
+    scope: ScopeKey;
+    summary: string;
+    distilledEvidenceRef: ArtifactRef;
+    originStage: OriginStage;
+}
+type FixSelection = {
+    fix: 'fact' | 'caution';
+    target: ServedRecordFacts;
+} | {
+    fix: 'procedure-hint';
+    target: ServedRecordFacts;
+} | {
+    fix: 'test-edit';
+} | {
+    fix: 'none';
+    checked: NoDraftableFixChecked;
+};
+declare function selectFixKind(input: {
+    kind: Mark;
+    member: PerTestOutcome;
+    step: StepEvidence;
+    stepIndex: number;
+    served: ServedRecordFacts[];
+    procedure?: ServedRecordFacts;
+}): FixSelection;
+interface ApplyFeedbackInput {
+    mark: Pick<MarkReceipt, 'markId' | 'runId' | 'runSlug' | 'testIndex' | 'testId' | 'stepIndex' | 'kind' | 'note'>;
+    handoff: CompletedRunHandoff;
+    resolvedStepIndex: number;
+    served: ServedRecordFacts[];
+    procedure?: ServedRecordFacts;
+    testRef?: string;
+}
+declare function applyFeedback(input: ApplyFeedbackInput): ImprovementPlan;
+
+interface FloorProseInput {
+    kind: Mark;
+    fix: 'fact' | 'caution' | 'procedure-hint';
+    stepText: string;
+    verifierReasoning: string;
+    servedSummary?: string;
+    note?: string;
+}
+declare function floorProse(input: FloorProseInput): {
+    summary: string;
+    body: string;
+};
+
+interface AppendMarkEvidenceInput {
+    knowledgeRoot: string;
+    executionContext: ExecutionContext;
+    lease: {
+        leaseId: string;
+        epoch: number;
+    };
+    mark: Pick<MarkReceipt, 'markId' | 'runId' | 'kind'>;
+    servedRecordIds: readonly string[];
+    /** Historical observation hashes require the original member/step coordinates. */
+    handoff?: CompletedRunHandoff;
+    /** Host-derived chainJobIdsForRun(runId, idSource).curateMemory; never guessed here. */
+    curationJobIds?: readonly string[];
+    /** Resuming one mark reports its complete logical effect, including already durable events. */
+    includeAlreadyAppended?: boolean;
+}
+declare function appendMarkEvidence(input: AppendMarkEvidenceInput): Promise<AppendMarkEvidenceOutcome>;
+
+declare class PolicyTextRefusedError extends Error {
+    constructor();
+}
+declare function policySectionMarkers(recordId: string): {
+    open: string;
+    close: string;
+};
+declare function policyShelfPath(knowledgeRoot: string, scope: string): string;
+interface MaterializePolicyInput {
+    writerAuthority: CurrentWriterAuthority;
+    knowledgeRoot: string;
+    recordId: string;
+    scope: string;
+    ruleText: string;
+    title?: string;
+    /** Recovery validates a previously authored section and must never recreate a missing one. */
+    existingOnly?: boolean;
+}
+type MaterializeOutcome = {
+    kind: 'written' | 'unchanged';
+    relPath: string;
+    sectionBytes: number;
+};
+/**
+ * The authored shelf is append-only under the caller's writer lease. An existing section ID
+ * always wins, including when its human-edited body differs. Never rewrite that body.
+ * commitArtifacts governs binary bundle artifacts, not policy text or git commits.
+ * The authored text is written as given; no detector scans it (Phase 441, D-15).
+ */
+declare function materializePolicy(input: MaterializePolicyInput): MaterializeOutcome;
+
+type LocalKnowledgeStore = KnowledgePort;
+type LocalKnowledgeReader = KnowledgeHintReader;
+
+export { ADDRESSING_LEDGER_BUSY_TIMEOUT_MS, ADDRESSING_LEDGER_DB_FILE, ADDRESSING_LEDGER_USER_VERSION, APPLY_DELEGATE_TIMEOUT_MS, ARTIFACT_RUN_CAP_BYTES, ARTIFACT_STEP_CAP_BYTES, AUTHORED_CHECKPOINT_SCHEMA_VERSION, type AcquireEmbedderOptions, type AcquireEmbedderOutcome, type AcquireWriterLeaseOptions, type AcquireWriterLeaseOutcome, type AddressingLedger, AddressingLedgerSchemaVersionError, type AppendMarkEvidenceInput, AppendMarkEvidenceOutcome, type AppendOutcome, ApplyDelegateTimeoutError, ApplyDelegateUnavailableError, type ApplyExplicitReviewInput, type ApplyFeedbackInput, type ApplyIndexDeltaForBundleInput, type ApplyRunOutcomesResult, type ArtifactCopyInput, type ArtifactCopyResult, type AuthorOutcome, type AuthoredCheckpoint, type AuthoredDeltaCheckpoint, BLAST_RADIUS_MAX_SUPERSEDES_PER_ANCHOR_PER_DRAIN, type BuildCurationCandidateAddressFieldsInput, type BundleProvenanceInput, type BundleStoreConfig, CHANNEL_1_SERVING_LEG, CHANNEL_3_CAUTION_LEG, CITED_ID_INTEGRITY_CONDITIONS, CLAIMED_SUBDIR, COMMIT_INTENT_SCHEMA_VERSION, CURATION_JOB_STATE_SCHEMA_VERSION, CURATION_QUEUE_SCHEMA_VERSION, type CanonicalBundleStateDigests, type CitedIdIntegrityCondition, type ClaimNextJobOptions, type ClaimNextJobOutcome, type ClaimedCurationJob, type CommitCurationDependencies, type CommitCurationJob, type CommitCurationOutcome, type CopiedArtifact, CorruptEpochStateError, type CorruptEpochStateReason, type CountRemainingCurationWorkOptions, type CreateLocalKnowledgeStoreConfig, type CurationArtifactDescriptor, type CurationArtifactRole, type CurationCandidateAddressFields, type CurationCandidateArtifact, type CurationCandidatePayload, type CurationCandidateProjection, type CurationDrainLifecycleEvent, type CurationEnqueueRefusalReason, type CurationJobLifecycle, type CurationJobState, type CurationJobView, type CurationProjectionArtifactSource, type CurationQuarantineReason, type CurationRemainingWork, type CuratorAuthor, type CurrentWriterAuthority, type CurrentWriterAuthorityHooks, DRAFT_RECEIPTS_DIR_NAME, DRAIN_BUDGET_MS, type DeferReason, type DiscoverEmbedderWorkerOptions, type DisposeDeltaInput, type DispositionCandidateContext, type DispositionDrainState, type DispositionOutcome, type DispositionProfile, DraftReceiptDigestError, DraftReceiptSchemaVersionError, type DraftReceiptsStore, type DraftReceiptsStoreOptions, type DrainFailure, type DrainFailureStage, type DrainNoop, type DrainOptions, type DrainPromotionOutcome, type DrainReport, type DrainableCurationWork, EMBED_CRASH_VECTORLESS_THRESHOLD, ENTITY_INDEX_DB_FILE, ENTITY_INDEX_SWEEP_INTERVAL_MS, ENTITY_INDEX_USER_VERSION, EPOCH_FILE, type EmbedCacheLeg, type EmbedCacheLookup, type EmbedCacheMode, type EmbedCachePut, type EmbedCacheWrapperOptions, type EmbedderAxis, EmbedderPort, type EmbedderProbes, type EmbedderRung, EmbedderWorkerIncarnationVerdict, type EmbedderWorkerPolicy, EmbedderWorkerRegistration, type EmptyDeltaCause, type EnqueueCurationCandidateProjectionOptions, type EnqueueCurationCandidateProjectionOutcome, type EntityAddress, type EntityIndexHandle, EntityIndexSchemaVersionError, type EntityIndexSweepReport, type EntitySighting, type EntitySightingSource, type ExplicitReviewDelegate, type ExplicitReviewDelegation, type ExplicitReviewRequest, type ExplicitReviewResult, type ExtractStepAnchors, FORGET_SCRUBBED_PROJECTIONS, type FailureRecurrence, type FingerprintRecurrence, type FingerprintWindowIdentity, type FingerprintWindowRow, type FixSelection, FloorAssetLoadError, type FloorAssetLoadErrorCode, type FloorAssetLoadOptions, type FloorAssets, FloorEmbeddingError, type FloorEmbeddingErrorCode, type FloorProseInput, type FoldRunOutcomesOptions, type FoldRunOutcomesReport, type FoldSuiteFingerprintsOptions, GC_SUPERSEDED_RETAIN_K, type GateHorizon, type GcPassReport, type GcSummary, type HeartbeatLeaseOutcome, type IndexAxis, IndexFace, IndexReaderConnection, type InspectDrainableCurationWorkOptions, JOBS_SUBDIR, KnowledgeCommitError, KnowledgePromotionError, type KnowledgePromotionErrorReason, KnowledgeReader, KnowledgeStoreNotImplementedError, KnowledgeUnsupportedDeltaError, LAST_OUTCOMES_LIMIT, LEASE_FILE, LEASE_GUARD_DIR, LEASE_HEARTBEAT_TTL_MS, type LeaseOperationOptions, LoadedBundle, type LocalKnowledgeReader, type LocalKnowledgeStore, MEASUREMENTS_REL_PATH, MODEL_CACHE_DIR_ENV_VAR, MUTABLE_BUNDLE_TARGETS, MUTATION_LOCK_BUSY_TIMEOUT_MS, MUTATION_LOCK_TAKEOVER_MS, type MaintenanceBudget, type MaintenanceOperations, type MaintenanceSkipReason, type MaintenanceTailFailure, type MaintenanceTailResult, type MalformedClaimedCurationJob, MarkPlanIntegrityError, type MarkTriage, type MaterializeOutcome, type MaterializePolicyInput, type MigrationOutcome, NativeEmbeddingDimensionError, NativeEmbeddingModuleLoadError, type NeighborRecord, type OpenAddressingLedgerOptions, type OpenEntityIndexOptions, PAYLOAD_BENEFITS, PAYLOAD_STATE_VALIDITIES, PURGE_RECEIPT_SCHEMA_VERSION, type PersistAuthoredCheckpointOptions, type PersistAuthoredCheckpointOutcome, PolicyTextRefusedError, type ProcedureDispositionEvidence, type ProjectRunOutcomesOptions, type PromotionOutcomeReport, type PublishBundleInput, type PublishBundleOutcome, type PurgeAffectedSet, PurgeChronologyRequiredError, PurgeCompletionVerificationError, PurgeQueueIdentityError, type PurgeReceipt, PurgeReceiptSchema, type PurgeRecordInput, type PurgeRecordOutcome, PurgeTargetChangedError, PurgeTargetIntegrityError, QUARANTINE_MANUAL_ENTRY_CLASS, QUARANTINE_MANUAL_ENTRY_FINGERPRINT, QUARANTINE_WINDOW_ORDINALS, QUEUED_SUBDIR, QUEUE_DIR, QUEUE_MAX_EMITS_PER_RUN, QUEUE_MAX_JOBS_PER_SCOPE, QuarantineAppendOutcome, type QuarantineClaimedOptions, type QuarantineDetectionOptions, QuarantineDetectionSighting, type QuarantineFoldOutcome, QuarantineIdentityRefusedError, type QuarantineOperationsOptions, type QueuedCanaryPayloadRead, RESOLVER_CANDIDATE_K, RESOLVER_FUSED_SCORE_NORMALIZER, RESOLVER_LEG_WEIGHT_DENSE, RESOLVER_LEG_WEIGHT_LEXICAL, RESOLVER_LEXICAL_MIN_BM25, RESOLVER_STRONG_HIT_MARGIN, RESOLVER_STRONG_HIT_MIN_SCORE, RUN_OUTCOMES_PROJECTION_VERSION, type ReadCurationCandidatePayloadOutcome, type ReadCurationEffectsOptions, type ReadJobStateOutcome, type ReadWriterLeaseOutcome, type RebuildIndexHooks, type RebuildIndexOptions, type RebuildMutationFamily, type RebuildReport, RebuildRequest, type RebuildRunOutcomesOptions, type RebuildRunOutcomesReport, type ReconcileRunOutcomesProjectionOptions, type ReconcileRunOutcomesProjectionResult, RefusedQuarantineLine, type RelationIntent, type ReleaseLeaseOutcome, type RenderBundlePartsInput, type RenderedBundlePart, type RequeueClaimedOptions, type ResolveBundleShortId, type ResolveEmbedderCapabilityOptions, type ResolveEntityRefDeps, type ResolveRetrievalRungOptions, type ResolveRollbackAffectedSetInput, type RetrievalQuery, type RetrievalQueryInput, type RetrieveOptions, type RetrieveResult, type ReviewChangeRequest, ReviewTargetVanishedError, type RollbackAffectedSet, type RollbackCampaignInput, RollbackCausalityError, type RollbackCounterEvent, type RollbackCurationJobInput, type RollbackKind, RollbackPlanChangedError, type RollbackPlannedEffect, type RollbackReport, type RunKnowledgeGcHooks, type RunKnowledgeGcInput, type RunMaintenanceTailOptions, type RunOutcomeFailureKey, type RunOutcomeTestDelta, type RunOutcomesProjection, SEARCH_BEFORE_CREATE_MAX_QUERIES, SERVING_TRACE_LEGS, SUITE_FINGERPRINTS_TABLE, type ServedRecordFacts, type SetActiveEmbeddingProfileOptions, type SkippedArtifact, type SuiteFingerprintIndex, type SuiteFingerprintIndexOptions, type SuiteFingerprintTestDelta, type SuiteFingerprintsProjection, type TargetRename, type TestOutcomeEntry, type TestOutcomeHistory, type TestOutcomeIdentity, type UnreclaimableMutationLockOwner, UserDeltaCitationIntegrityError, VecCapability, WRITER_AUTHORITY_DB_FILE, type WorkerDiscoveryResult, type WriteJobStateOptions, WriterAuthorityLostError, type WriterAuthorityLostReason, type WriterLease, type WriterLeaseAuthority, type WriterLeaseFreshness, type WriterPassReport, acquireEmbedder, acquireWriterLease, appendGateReceipt, appendMarkEvidence, appendMeasurementObservation, appendOutcomeEvent, appendPromotionReceipt, appendRelation, applyExplicitReview, applyFeedback, applyIndexDeltaForBundle, applyRunOutcomes, applySuiteFingerprints, assertionDrift, authoredCheckpointSchema, buildCurationCandidateAddressFields, buildRetrievalQuery, candidateContentAddress, claimNextJob, claimedCandidateDir, claimedLeaseDir, claimedRoot, commitCurationDelta, copyArtifacts, countPendingCurationJobs, countRemainingCurationWork, createDraftReceiptsStore, createFloorEmbedder, createLocalKnowledgeStore, createMemorySightingSource, createNativeEmbedder, createQuarantineOperations, createSuiteFingerprintIndex, curationArtifactDescriptorSchema, curationArtifactRoleSchema, curationCandidatePayloadSchema, curationCandidateProjectionSchema, curationJobStateSchema, deriveIndexRowFromBundle, deriveWriterLeaseFreshness, describeAllEntities, discoverEmbedderWorker, disposeDelta, draftReceiptsDir, drainQueue, dropEmbedCacheForModel, embedPendingEntities, enqueueCurationCandidate, enqueueCurationCandidateProjection, ensureEmbedCacheTable, entityIndexDbPath, failureRecurrence, fingerprintRecurrence, floorProse, foldCurationSnapshot, foldRetrievalRung, foldRunOutcomes, foldSuiteFingerprints, getCachedEmbedding, getEntityDescriptor, guardPurgeReceipt, heartbeatLease, inspectDrainableCurationWork, isLeaseStale, jobStatePath, jobsRoot, listClaimedLeases, listQueuedCandidates, listTestsInFile, loadFloorAssets, materializePolicy, openAddressingLedger, openEntityIndex, parseAuthoredCheckpoint, persistAuthoredCheckpoint, policySectionMarkers, policyShelfPath, priorBuildOutcome, procedureReadOn, projectRunOutcomes, publishBundle as publishBundleForTest, purgeAffectedSetFingerprint, purgeReceiptSchema, purgeRecord, putCachedEmbedding, quarantineClaimed, queueRoot, queueStagingRoot, queuedCandidateDir, queuedRoot, readCanonicalBundleStateDigests, readCurationCandidatePayload, readCurationEffects, readFingerprintWindow, readJobState, readLatestBuildOrdinal, readQueuedCanaryPayload, readRebuildRequest, readTestOutcomeHistory, readWriterLease, rebuildEntityIndex, rebuildIndex, rebuildRunOutcomes, reconcileRunOutcomesProjection, refreshEntity, refreshWriterLeaseAuthority, releaseLease, renderBundleParts, requeueClaimed, resetEmbedderCapability, resolveDispositionProfile, resolveEmbedderCapability, resolveEntityRef, resolveModelCacheDir, resolveProcessIncarnation, resolvePurgeAffectedSet, resolveRetrievalRung, resolveRollbackAffectedSet, retrieve, rollbackAffectedSetFingerprint, rollbackCampaign, rollbackCurationJob, rollbackReceiptId, runKnowledgeGc, runMaintenanceTail, selectFixKind, servedIdsOn, setActiveEmbeddingProfile, sightEntity, sliceAuthoredCheckpoint, suiteFingerprintDeltas, sweepEntityIndex, triageMark, verifyEmbedderWorkerIncarnation, widenAuthoredDeltaCheckpoint, withCurrentWriterAuthority, wrapEmbedderWithCache, writeJobState, writeMeasurementBaseline };