@vostride/agent-qa-knowledge-local 0.2.3 → 0.2.4

package/dist/index.d.ts

@@ -1,15 +1,15 @@
 import { KnowledgePort } from '@vostride/agent-qa-agent';
 import { KnowledgeHintReader } from '@vostride/agent-qa-runner';
 import * as _vostride_agent_qa_schema from '@vostride/agent-qa-schema';
-import { CurationSnapshotChange, CurationSnapshot, EntityKind, EmbeddingProfile, EntityDescriptor, EntityResolution, VerdictClass, QuarantineOperationsPort, ArtifactRef, MaskFn, CurationAuthorship, BundleDraft, BundleDiscriminant, OriginClass, ScreenState, BundleOutcomeEvent, BundleRelation, DistilledObservation, RecordId, BundleIdentityCore, GateReceipt, MeasurementObservation, PromotionReceipt, MeasurementBaseline, RetrievalTraceLeg, RecordedRetrievalRung, Anchor, IndexEntry, TrustPriorTable, CompletedRunHandoff, PerTestOutcome, StepEvidence, QuarantineLedgerEvent, RunAnalysisArtifact, Verdict, ScopeKey, ExecutionContext, BundleKind, FactSubtype, Delta, CurationFallbackReason, CompareAndSet, BundleStatus, ResolvePromotionPosture, PromotionGateHoldReason, PromotionPath, KnowledgeAcceptInput, KnowledgeRejectInput, KnowledgeForgetInput, KnowledgeMarkInput, KnowledgeProjection, KnowledgeReviewVerb, CommitReceipt, ForgetReceiptV1, KnowledgeTargetRef, DraftReceipt, MarkReceipt, OriginStage, NoDraftableFixChecked, MarkQuarantineClass, ImprovementPlan, Mark } from '@vostride/agent-qa-schema';
+import { CurationSnapshotChange, CurationSnapshot, EntityKind, EmbeddingProfile, EntityDescriptor, EntityResolution, VerdictClass, QuarantineOperationsPort, ArtifactRef, MaskFn, CurationAuthorship, BundleDraft, BundleDiscriminant, OriginClass, ScreenState, BundleOutcomeEvent, BundleRelation, DistilledObservation, RecordId, BundleIdentityCore, GateReceipt, MeasurementObservation, PromotionReceipt, MeasurementBaseline, RetrievalTraceLeg, RecordedRetrievalRung, Anchor, IndexEntry, CompletedRunHandoff, PerTestOutcome, StepEvidence, QuarantineLedgerEvent, RunAnalysisArtifact, Verdict, ScopeKey, ExecutionContext, BundleKind, FactSubtype, Delta, CurationFallbackReason, CompareAndSet, BundleStatus, PromotionGateHoldReason, PromotionPath, KnowledgeAcceptInput, KnowledgeRejectInput, KnowledgeForgetInput, KnowledgeMarkInput, KnowledgeProjection, KnowledgeReviewVerb, CommitReceipt, ForgetReceiptV1, KnowledgeTargetRef, DraftReceipt, MarkReceipt, OriginStage, NoDraftableFixChecked, MarkQuarantineClass, ImprovementPlan, Mark } from '@vostride/agent-qa-schema';
 export { testFingerprintElements } from '@vostride/agent-qa-schema';
 import { z } from 'zod';
-import { I as IndexReaderConnection, E as EmbedderPort, a as IndexFace, K as KnowledgeReader, V as VecCapability, Q as QuarantineAppendOutcome, b as QuarantineDetectionSighting, R as RefusedQuarantineLine, r as readRebuildRequest, c as readIndexMaintenanceState, d as RebuildRequest, o as openKnowledgeReader, L as LoadedBundle, A as AppendMarkEvidenceOutcome } from './mark-evidence-plan-BCkYN07i.js';
-export { e as AUTHORING_BRIEF_DEFAULT_BUDGET, f as AUTHORING_DENSE_K, g as AUTHORING_EXCERPT_CHAR_BUDGET, h as AUTHORING_EXEMPLAR_CAP, i as AUTHORING_PROCEDURE_CAP, j as AUTO_QUARANTINE_CLASSES, k as AssembleAuthoringBriefInput, l as AssembledAuthoringBrief, m as AuthoringEntryCandidate, n as AuthoringExemplarRow, p as AuthoringReaderDependencies, q as AuthoringTestRef, C as CHECKPOINT_EVERY_N_BUNDLES, s as CanaryPostureFacts, t as CanonicalBundleAnchorLookup, D as DenseHit, u as DenseSearchOptions, v as DiffSinceOptions, w as EnumeratedBundleDir, x as EvaluateQuarantineDetectionInput, G as GATES_REL_PATH, y as INDEX_DB_FILE, z as INDEX_RENDERING_SCHEMA_VERSION, B as INDEX_SCHEMA_VERSION, F as IndexHealth, H as IndexWriterHandle, J as InspectRecordsOptions, M as IntegrityReport, N as KnowledgeHit, O as KnowledgeMaintenanceScanError, P as KnowledgeMaintenanceScanIssue, S as KnowledgeRecordNotFoundError, T as KnowledgeSearchOptions, U as LoadBundleOutcome, W as LowerTrustShare, X as MARK_EVIDENCE_TOKEN_PREFIX, Y as MarkEvidenceEffect, Z as MarkEvidencePlan, _ as MarkEvidenceTarget, $ as Measurements, a0 as OpenKnowledgeReaderOptions, a1 as OpenServingKnowledgeReaderConfig, a2 as PlanMarkEvidenceInput, a3 as QUARANTINE_AUTO_EXIT_PASSES, a4 as QUARANTINE_CLASS_DISPOSITIONS, a5 as QUARANTINE_DEFAULT_EXPIRY_DAYS, a6 as QUARANTINE_ESCALATE_THRESHOLD, a7 as QUARANTINE_FLAG_FLOOR, a8 as QUARANTINE_LEDGER_FILENAME, a9 as QuarantineDetectionFailure, aa as QuarantineDetectionResult, ab as QuarantineDetectionTestWindow, ac as QuarantineDisposition, ad as QuarantineLedgerRead, ae as QuarantineOrdinalOutcome, af as READER_BUSY_TIMEOUT_MS, ag as REBUILD_MARKER_FILE, ah as REQUIRED_INDEX_TABLES, ai as ReadRebuildRequestOutcome, aj as RebuildReason, ak as RequestRebuildOptions, al as ScanBundleByIdOptions, am as ScanBundlesOptions, an as ShowRecordOptions, ao as StandingReceiptDigest, ap as WRITER_BUSY_TIMEOUT_MS, aq as assembleAuthoringBrief, ar as canaryPostureFactsFor, as as classifyIndexFace, at as clearRebuildRequest, au as createAuthoringReader, av as deriveBundleTrust, aw as diffSince, ax as embeddingProfileKey, ay as enumerateBundleDirs, az as evaluateQuarantineDetection, aA as foldQuarantineLedgerState, aB as indexDbPath, aC as inspectRecords, aD as isServable, aE as loadBundle, aF as lowerTrustSharesFor, aG as markEvidenceEvent, aH as openIndexReaderConnection, aI as openIndexWriter, aJ as openKnowledgeReader, aK as planMarkEvidence, aL as probeIndexHealth, aM as projectMarkEvidenceOutcome, aN as quarantineLedgerPath, aO as readCanonicalBundleAnchors, aP as readGateReceipts, aQ as readMeasurements, aR as readQuarantineLedger, aS as requestRebuild, aT as resolveActiveProfile, aU as resolveVecCapability, aV as scanBundleById, aW as scanBundles, aX as showRecord, aY as standingReceiptDigestsFor, aZ as toInspectRecordView, a_ as vecTableName, a$ as verifyBundleIntegrity } from './mark-evidence-plan-BCkYN07i.js';
+import { I as IndexReaderConnection, E as EmbedderPort, a as IndexFace, K as KnowledgeReader, V as VecCapability, Q as QuarantineAppendOutcome, b as QuarantineDetectionSighting, R as RefusedQuarantineLine, r as readRebuildRequest, c as readIndexMaintenanceState, d as RebuildRequest, o as openKnowledgeReader, L as LoadedBundle, A as AppendMarkEvidenceOutcome } from './mark-evidence-plan-CmOkzw6u.js';
+export { e as AUTHORING_BRIEF_DEFAULT_BUDGET, f as AUTHORING_DENSE_K, g as AUTHORING_EXCERPT_CHAR_BUDGET, h as AUTHORING_EXEMPLAR_CAP, i as AUTHORING_PROCEDURE_CAP, j as AUTO_QUARANTINE_CLASSES, k as AssembleAuthoringBriefInput, l as AssembledAuthoringBrief, m as AuthoringEntryCandidate, n as AuthoringExemplarRow, p as AuthoringReaderDependencies, q as AuthoringTestRef, C as CHECKPOINT_EVERY_N_BUNDLES, s as CanonicalBundleAnchorLookup, D as DenseHit, t as DenseSearchOptions, u as DiffSinceOptions, v as EnumeratedBundleDir, w as EvaluateQuarantineDetectionInput, G as GATES_REL_PATH, x as INDEX_DB_FILE, y as INDEX_RENDERING_SCHEMA_VERSION, z as INDEX_SCHEMA_VERSION, B as IndexHealth, F as IndexWriterHandle, H as InspectRecordsOptions, J as IntegrityReport, M as KnowledgeHit, N as KnowledgeMaintenanceScanError, O as KnowledgeMaintenanceScanIssue, P as KnowledgeRecordNotFoundError, S as KnowledgeSearchOptions, T as LoadBundleOutcome, U as MARK_EVIDENCE_TOKEN_PREFIX, W as MarkEvidenceEffect, X as MarkEvidencePlan, Y as MarkEvidenceTarget, Z as Measurements, _ as OpenKnowledgeReaderOptions, $ as OpenServingKnowledgeReaderConfig, a0 as PlanMarkEvidenceInput, a1 as QUARANTINE_AUTO_EXIT_PASSES, a2 as QUARANTINE_CLASS_DISPOSITIONS, a3 as QUARANTINE_DEFAULT_EXPIRY_DAYS, a4 as QUARANTINE_ESCALATE_THRESHOLD, a5 as QUARANTINE_FLAG_FLOOR, a6 as QUARANTINE_LEDGER_FILENAME, a7 as QuarantineDetectionFailure, a8 as QuarantineDetectionResult, a9 as QuarantineDetectionTestWindow, aa as QuarantineDisposition, ab as QuarantineLedgerRead, ac as QuarantineOrdinalOutcome, ad as READER_BUSY_TIMEOUT_MS, ae as REBUILD_MARKER_FILE, af as REQUIRED_INDEX_TABLES, ag as ReadRebuildRequestOutcome, ah as RebuildReason, ai as RequestRebuildOptions, aj as ScanBundleByIdOptions, ak as ScanBundlesOptions, al as ShowRecordOptions, am as WRITER_BUSY_TIMEOUT_MS, an as assembleAuthoringBrief, ao as classifyIndexFace, ap as clearRebuildRequest, aq as createAuthoringReader, ar as deriveBundleTrust, as as diffSince, at as embeddingProfileKey, au as enumerateBundleDirs, av as evaluateQuarantineDetection, aw as foldQuarantineLedgerState, ax as indexDbPath, ay as inspectRecords, az as isServable, aA as loadBundle, aB as markEvidenceEvent, aC as openIndexReaderConnection, aD as openIndexWriter, aE as openKnowledgeReader, aF as planMarkEvidence, aG as probeIndexHealth, aH as projectMarkEvidenceOutcome, aI as quarantineLedgerPath, aJ as readCanonicalBundleAnchors, aK as readGateReceipts, aL as readMeasurements, aM as readQuarantineLedger, aN as requestRebuild, aO as resolveActiveProfile, aP as resolveVecCapability, aQ as scanBundleById, aR as scanBundles, aS as showRecord, aT as toInspectRecordView, aU as vecTableName, aV as verifyBundleIntegrity } from './mark-evidence-plan-CmOkzw6u.js';
 import { DatabaseSync } from 'node:sqlite';
 import { Tokenizer } from '@huggingface/tokenizers';
-import { E as EmbedderWorkerRegistration, a as EmbedderWorkerIncarnationVerdict } from './worker-registration-C-9spEsf.js';
-export { b as EMBEDDER_WORKER_REGISTRATION_FILE, c as EMBEDDER_WORKER_REGISTRATION_SCHEMA_VERSION, d as EMBEDDER_WORKER_REQUEST_TIMEOUT_MS, e as EMBEDDER_WORKER_START_TIMEOUT_MS, f as EMBEDDER_WORKER_TERM_GRACE_MS, g as EMBEDDER_WORKER_UNVERIFIABLE_INCARNATION, h as EmbedderWorkerTimeoutError, i as EmbedderWorkerTimeoutPhase, R as ReadEmbedderWorkerRegistrationOutcome, j as embedderWorkerProcessIsAlive, k as embedderWorkerSocketPath, p as probeEmbedderWorkerSocket, r as readEmbedderWorkerRegistration, l as removeEmbedderWorkerRegistration, w as writeEmbedderWorkerRegistration } from './worker-registration-C-9spEsf.js';
+import { E as EmbedderWorkerRegistration, a as EmbedderWorkerIncarnationVerdict } from './worker-registration-DAYLDaFV.js';
+export { b as EMBEDDER_WORKER_REGISTRATION_FILE, c as EMBEDDER_WORKER_REGISTRATION_SCHEMA_VERSION, d as EMBEDDER_WORKER_REQUEST_TIMEOUT_MS, e as EMBEDDER_WORKER_START_TIMEOUT_MS, f as EMBEDDER_WORKER_TERM_GRACE_MS, g as EMBEDDER_WORKER_UNVERIFIABLE_INCARNATION, h as EmbedderWorkerTimeoutError, i as EmbedderWorkerTimeoutPhase, R as ReadEmbedderWorkerRegistrationOutcome, j as embedderWorkerProcessIsAlive, k as embedderWorkerSocketPath, p as probeEmbedderWorkerSocket, r as readEmbedderWorkerRegistration, l as removeEmbedderWorkerRegistration, w as writeEmbedderWorkerRegistration } from './worker-registration-DAYLDaFV.js';
 
 interface ReadCurationEffectsOptions {
     knowledgeRoot: string;
@@ -22,7 +22,6 @@ declare function readCurationEffects(options: ReadCurationEffectsOptions): Curat
 declare function foldCurationSnapshot(effects: readonly CurationSnapshotChange[]): CurationSnapshot;
 
 declare const PAYLOAD_BENEFITS: readonly ["exercised-benefited", "rode-along", "exercised-harmed"];
-declare const PAYLOAD_STATE_VALIDITIES: readonly ["valid", "stale", "unknown"];
 declare const canaryOutcomePayloadSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<2>;
     benefit: z.ZodEnum<{
@@ -30,31 +29,6 @@ declare const canaryOutcomePayloadSchema: z.ZodObject<{
         "rode-along": "rode-along";
         "exercised-harmed": "exercised-harmed";
     }>;
-    stateValidity: z.ZodEnum<{
-        unknown: "unknown";
-        valid: "valid";
-        stale: "stale";
-    }>;
-    corpusDigest: z.ZodOptional<z.ZodString>;
-    observedStateDigest: z.ZodOptional<z.ZodString>;
-    ablation: z.ZodOptional<z.ZodObject<{
-        crossCheck: z.ZodEnum<{
-            inconclusive: "inconclusive";
-            flipped: "flipped";
-            held: "held";
-            "not-run": "not-run";
-        }>;
-        k: z.ZodNumber;
-        baseSeed: z.ZodNumber;
-        seeds: z.ZodArray<z.ZodNumber>;
-        seedHonored: z.ZodBoolean;
-        spend: z.ZodObject<{
-            modelCalls: z.ZodNumber;
-            screens: z.ZodNumber;
-            promptTokens: z.ZodNumber;
-            completionTokens: z.ZodNumber;
-        }, z.core.$strict>;
-    }, z.core.$strict>>;
     jobKind: z.ZodLiteral<"canary-outcome">;
     candidateId: z.ZodString;
     runId: z.ZodString;
@@ -80,26 +54,9 @@ type QueuedCanaryPayloadRead = {
 };
 declare function readQueuedCanaryPayload(value: unknown): QueuedCanaryPayloadRead;
 
-/**
- * Stamped into `PRAGMA user_version` at creation and checked on every open.
- *
- * Stamp and hard-fail, never migrate — the 385 D-04 convention. The milestone ships nothing
- * between its releases, so a ledger written by another build is a development artifact, and
- * migration machinery for it would be code with no user that everything afterwards has to
- * keep working. Note what this does NOT license: the ROWS are permanent regardless. A version
- * refusal tells an operator to move a stale development file aside; it never rewrites one.
- */
 declare const ADDRESSING_LEDGER_USER_VERSION = 2;
-/**
- * Busy timeout for every connection.
- *
- * D-02's story is "any process mints, sqlite arbitrates", which only works if a writer
- * waiting on the write lock retries rather than failing immediately. Matched to the job
- * store's window because the transactions are the same shape and size: retune from observed
- * contention, not from a guess about how many hosts there are.
- */
 declare const ADDRESSING_LEDGER_BUSY_TIMEOUT_MS = 2000;
-/** The ledger's own file name under the agent-qa root, beside `agent-jobs.db` (D-02). */
+/** The ledger's own file name under the agent-qa root, beside `agent-jobs.db`. */
 declare const ADDRESSING_LEDGER_DB_FILE = "entity-addresses.db";
 /** A ledger file this build cannot read. Refused before a single schema statement runs. */
 declare class AddressingLedgerSchemaVersionError extends Error {
@@ -108,15 +65,6 @@ declare class AddressingLedgerSchemaVersionError extends Error {
     readonly found: number;
     constructor(path: string, expected: number, found: number);
 }
-/**
- * An EXPLICITLY recorded target rename (D-03).
- *
- * There is no heuristic rename detection in this file and there must not be. Inferring that
- * two target slugs are "the same target" from their spelling, their order of appearance or
- * their contents is a guess, and ENTY-01's never-guess law is not weaker inside the ledger
- * than it is inside the resolver — a wrong link here would silently re-point a published
- * address, which is the exact failure D-02 exists to make impossible.
- */
 interface TargetRename {
     readonly fromSlug: string;
     readonly toSlug: string;
@@ -126,7 +74,7 @@ interface TargetRename {
 interface EntityAddress {
     readonly kind: EntityKind;
     readonly machineId: string;
-    /** Present for ordinal-addressed kinds; absent for slug-addressed ones (D-03). */
+    /** Present for ordinal-addressed kinds; absent for slug-addressed ones. */
     readonly ordinal?: number;
     readonly shortId: string;
     readonly mintedAt: string;
@@ -144,23 +92,7 @@ interface AddressingLedger {
     lookup(kind: EntityKind, machineId: string): EntityAddress | undefined;
     /** The address a published short-ID names, or `undefined`. Tier (a)'s whole job. */
     lookupByShortId(shortId: string): EntityAddress | undefined;
-    /**
-     * Every address ever minted, in a fixed order (kind, then short-ID).
-     *
-     * READ-only, and the append-only law is what makes it worth having: this list only grows, so
-     * a caller enumerating it is reading a complete history rather than a snapshot that could
-     * have lost rows. The entity index is rebuilt FROM this (D-06) — a projection can only claim
-     * to heal if the thing it is rebuilt from can be enumerated in full.
-     */
     listAddresses(): EntityAddress[];
-    /**
-     * Record that a config target was renamed (D-03). See {@link TargetRename} for why this is
-     * the only way a link between two slugs ever comes to exist.
-     *
-     * Both slugs are minted, so both keep their own permanent address: the predecessor keeps
-     * the one already sitting in somebody's CI log, and the successor gets its own rather than
-     * inheriting one. Recording is idempotent — a repeat is the same fact, not a second one.
-     */
     recordTargetRename(fromSlug: string, toSlug: string): TargetRename;
     /** The rename recorded FOR this slug, if any. Never the reverse direction. */
     lookupTargetRename(fromSlug: string): TargetRename | undefined;
@@ -175,37 +107,8 @@ interface OpenAddressingLedgerOptions {
 }
 declare function openAddressingLedger(options: OpenAddressingLedgerOptions): AddressingLedger;
 
-/**
- * The projection's own file name, beside the knowledge index rather than inside it.
- *
- * Beside, because an entity is not a learned fact (D-06). Its own file, because the knowledge
- * index's schema version, rebuild and per-profile vec bookkeeping belong to records, and
- * sharing them would have coupled two projections whose only similarity is their shape.
- */
 declare const ENTITY_INDEX_DB_FILE = "entity-index.db";
-/**
- * Stamped into `PRAGMA user_version` at creation and checked on every open.
- *
- * Stamp and hard-fail, never migrate — the 385 D-04 house style. Migration would be effort
- * spent on a file whose contents can be regenerated in full from the ledger; a refusal that
- * says which version it found is more useful than a migration nobody would maintain.
- */
 declare const ENTITY_INDEX_USER_VERSION = 2;
-/**
- * How often a standing daemon re-renders the projection from its sources (D-06).
- *
- * PROVISIONAL 600_000 (ten minutes); retune from operational evidence without adding config,
- * the `LEASE_HEARTBEAT_TTL_MS` house style. What it is bounding is STALENESS of a title or a
- * status in a fuzzy-match target — never correctness of an address, which the ledger owns and
- * no cadence can affect. Sightings already refresh an entity the moment anything touches it,
- * so this sweep exists for the entities nothing has touched since their source data moved.
- *
- * Deliberately its own interval rather than the daemon's `MAINTENANCE_CADENCE_MS`. That
- * cadence runs the lease-holding maintenance tail; this sweep must never require the writer
- * lease (D-02/D-06) because it writes only this file, and sharing a timer with lease-gated
- * work would have made a lease-free projection stop being maintained the moment a lease was
- * lost — a coupling nothing in the projection's own contract asks for.
- */
 declare const ENTITY_INDEX_SWEEP_INTERVAL_MS = 600000;
 declare class EntityIndexSchemaVersionError extends Error {
     readonly path: string;
@@ -214,7 +117,7 @@ declare class EntityIndexSchemaVersionError extends Error {
     constructor(path: string, supportedVersion: number, foundVersion: number);
 }
 interface EntityIndexHandle {
-    /** The connection shape the retrieval legs take. `vec` is pinned `brute` — see the header. */
+    /** `vec` is `brute`: `denseVec0` needs the records index's private vec-cleanup epoch marker. */
     readonly connection: IndexReaderConnection;
     readonly path: string;
     close(): void;
@@ -222,45 +125,18 @@ interface EntityIndexHandle {
 interface OpenEntityIndexOptions {
     /** Absolute path to the projection file, typically `entityIndexDbPath(knowledgeRoot)`. */
     readonly path: string;
-    /**
-     * The knowledge root the path lives under. When given, the path's directory chain must stay
-     * inside it (261003-mqc): a linked `memory/` or `memory/index/` is refused before the open.
-     */
     readonly knowledgeRoot?: string;
     readonly timeoutMs?: number;
 }
 /** The projection's path: beside the knowledge index, never inside it. */
 declare function entityIndexDbPath(knowledgeRoot: string): string;
 declare function openEntityIndex(options: OpenEntityIndexOptions): EntityIndexHandle;
-/**
- * Project one entity into the index (D-06's incremental half).
- *
- * Called from the resolver's sighting/mint path, so every process posture — daemon, one-shot
- * CLI, a test harness — maintains the projection by using it. Idempotent: re-projecting an
- * unchanged entity leaves the same row.
- */
 declare function refreshEntity(handle: EntityIndexHandle, descriptor: EntityDescriptor): void;
-/**
- * Drop everything and re-project from the supplied descriptor set (D-06's healing half).
- *
- * The set comes from the ledger plus the owning stores, which is what makes this a rebuild
- * rather than a repair: nothing in this file is consulted to produce the new contents, so a
- * file damaged in any way at all converges to the same result as a file that never existed.
- * Embeddings are re-derived rather than carried, because a rebuild that preserved derived
- * bytes would preserve exactly the state a rebuild is run to be rid of.
- */
 declare function rebuildEntityIndex(handle: EntityIndexHandle, descriptors: Iterable<EntityDescriptor>): number;
 interface EntityIndexSweepReport {
     readonly examined: number;
     readonly refreshed: number;
 }
-/**
- * Re-project the entities whose source data moved (D-06's maintenance-cadence half).
- *
- * A sweep is maintenance of a disposable projection, so it writes only where a row disagrees
- * with its source. It never touches the addressing ledger — the ledger is not a projection
- * (D-02) — and it takes no writer lease, because everything it writes lives in this file.
- */
 declare function sweepEntityIndex(handle: EntityIndexHandle, descriptors: Iterable<EntityDescriptor>): EntityIndexSweepReport;
 /**
  * Embed every row whose rendering has no vector yet, returning how many were embedded.
@@ -275,13 +151,6 @@ declare function sweepEntityIndex(handle: EntityIndexHandle, descriptors: Iterab
  */
 declare function embedPendingEntities(handle: EntityIndexHandle, embedder: EmbedderPort, profile?: EmbeddingProfile): Promise<number>;
 
-/**
- * One store's answer to "do you own an entity with exactly this machine id?".
- *
- * A port rather than a switch over kinds, because each kind's machine ids live behind a
- * different store and the tracer wires only one of them. 387-03 adds sources for the
- * remaining kinds and neither this function nor its callers change.
- */
 interface EntitySightingSource {
     readonly kind: EntityKind;
     /** The entity with this exact machine id, or `undefined`. Never a fuzzy match. */
@@ -293,69 +162,17 @@ interface EntitySightingSource {
 interface EntitySighting {
     readonly machineId: string;
     readonly title: string;
-    /**
-     * The status as the OWNING store reports it. Validated against the kind's closed union at
-     * the card boundary (D-12), not here: this layer reports, the producer renders, and the
-     * schema refuses. Three responsibilities, three places.
-     */
     readonly statusSource: string;
 }
 interface ResolveEntityRefDeps {
     readonly ledger: AddressingLedger;
     readonly sources: readonly EntitySightingSource[];
-    /**
-     * The D-06 projection, maintained by USE.
-     *
-     * Optional, and that is the degradation ladder rather than a convenience: a composition that
-     * supplies no index gets tier (a) and the honest `none` arm, which is exactly what 387-01
-     * shipped. Nothing here silently becomes a guess when the projection is absent.
-     */
     readonly entityIndex?: EntityIndexHandle;
     /** Test/integration seam for tier (b)'s dense leg; omission runs the acquisition ladder. */
     readonly embedder?: EmbedderPort;
 }
-/**
- * Every entity the ledger has ever addressed and a source can still describe.
- *
- * This is the set `rebuildEntityIndex` is rebuilt FROM and the set the daemon sweep re-renders
- * (D-06). It reads the LEDGER, never the index: a projection rebuilt from itself would
- * preserve exactly the state a rebuild is run to be rid of.
- *
- * An address whose source can no longer describe it is skipped rather than projected as a
- * husk. The address keeps resolving through tier (a) either way — D-04's permanence lives in
- * the ledger — but a row with no title is not something fuzzy text should ever match.
- */
 declare function describeAllEntities(deps: ResolveEntityRefDeps): EntityDescriptor[];
-/**
- * THE sighting leg (D-01): exact machine-id equality, mint, project, describe.
- *
- * Extracted so the resolver's own leg and the LIST VERBS' sighting site are one mechanism
- * rather than two that mint the same way today. D-01 names four sighting sites — a resolver
- * hit, a card render, verdict authoring, a list verb — and a second minting path written for
- * the fourth would be a second place where "first sighting mints" could stop being true, with
- * nothing comparing them.
- *
- * `undefined` means no registered source recognises the id at all.
- *
- * EXACT equality, always. A prefix or case-insensitive comparison here would be tier (b)
- * smuggled in below the never-guess contract. Sources are consulted in registered order so
- * the answer does not depend on iteration accidents.
- */
 declare function sightEntity(machineId: string, deps: ResolveEntityRefDeps): EntityResolution | undefined;
-/**
- * Resolve a reference through the three tiers, minting on first sighting (D-01).
- *
- * Order matters and is fixed: URI, then short-ID, then exact machine id, then — for free text
- * only — the hybrid tiers. Addresses are tried before machine ids because an address is
- * unambiguous by construction, and a machine id that happened to LOOK like a short-ID would
- * otherwise be able to shadow a published address.
- *
- * ASYNC because tier (b)'s dense leg is: an embedding query cannot be made synchronous, and
- * the alternative — a second, synchronous entry that quietly answers with tier (a) only —
- * would be a resolver that under-answers depending on which function a caller happened to
- * import. The PORT this reaches surfaces through was already asynchronous, so no composition
- * edge changes shape.
- */
 declare function resolveEntityRef(ref: string, deps: ResolveEntityRefDeps): Promise<EntityResolution>;
 /**
  * `entities.get`'s read path: the descriptor for an EXACT address, or `undefined`.
@@ -366,22 +183,6 @@ declare function resolveEntityRef(ref: string, deps: ResolveEntityRefDeps): Prom
  */
 declare function getEntityDescriptor(ref: string, deps: ResolveEntityRefDeps): EntityDescriptor | undefined;
 
-/**
- * The two leg weights, and they are EQUAL for a reason that is not aesthetic.
- *
- * The degradation invariant (D-08) says a floor host may only produce MORE disambiguation,
- * never a different answer. Floor mode is full mode minus the dense leg, so each candidate's
- * floor score is its full score minus its own dense contribution. With equal weights the most
- * any candidate can gain from the dense leg is one rank-1 contribution, which is what bounds
- * how far the dense leg can reorder the lexical ranking — and that bound is what
- * `RESOLVER_STRONG_HIT_MARGIN` is set against. Weighting the dense leg above the lexical one
- * (as the `semantic` query-class vector does for records) would let the dense leg invert an
- * ordering by more than the margin, and floor mode could then resolve to a different entity.
- *
- * The resolver therefore owns its own weights rather than importing a query-class vector: this
- * pair is load-bearing for a safety property, and a vector tuned for record retrieval has no
- * obligation to stay equal.
- */
 declare const RESOLVER_LEG_WEIGHT_LEXICAL = 1;
 declare const RESOLVER_LEG_WEIGHT_DENSE = 1;
 /**
@@ -397,66 +198,7 @@ declare const RESOLVER_LEG_WEIGHT_DENSE = 1;
  * to tier (a)'s 1.0 without inventing a second vocabulary for confidence.
  */
 declare const RESOLVER_FUSED_SCORE_NORMALIZER: number;
-/**
- * The absolute half of the D-07 rule: a strong hit is at the head of at least one leg.
- *
- * 0.5 is exactly one leg's rank-1 contribution on the normalised scale, and picking it says
- * something narrow and true: a candidate that no leg ranked first is never a strong hit, no
- * matter how far ahead of the runner-up it ended up. That case is reachable in practice — the
- * index is refreshed on sighting, so it can hold a row for an entity whose owning store has
- * since forgotten it; when that row heads a leg it is dropped after fusion, and the survivor
- * behind it must NOT be promoted into a confident answer just because the leader vanished.
- *
- * Honest about its limits: on an RRF scale an absolute threshold cannot do much more than
- * this. The fused top is always at least one leg's rank-1 contribution whenever any leg head
- * survives, so a threshold below 0.5 would never fire, and a threshold above 0.5 would forbid
- * a floor host from ever resolving anything — including a reference that matched exactly one
- * entity. The discrimination work is therefore done by the margin below, which is where the
- * two-part rule's second half earns its place rather than restating the first.
- *
- * The corpus report confirms both halves of that claim rather than only the comfortable one:
- * 31 of its 110 cases resolve at the floor, so the threshold is not quietly forbidding the
- * floor rung; and the case where a leg head is dropped after fusion still refuses, so it is not
- * quietly permitting a survivor to inherit a leader's confidence.
- */
 declare const RESOLVER_STRONG_HIT_MIN_SCORE = 0.5;
-/**
- * The margin half of the D-07 rule, and the number that makes a safety property structural.
- *
- * A candidate can gain at most 0.5 on the normalised scale by being ranked first in the dense
- * leg. For floor mode (which has no dense leg) to resolve entity E while full mode resolves a
- * DIFFERENT entity Z, the dense leg would have to move Z past E by more than twice the margin.
- * Any margin above 0.25 therefore makes that impossible rather than unlikely: floor mode can
- * only ever produce the same resolved entity or refuse to resolve at all. 0.26 is the pinned
- * value with room above the bound so an adjacent-rank rounding difference cannot reach it.
- *
- * Its everyday meaning is simpler: a strong hit is one the legs AGREE on more than they agree
- * on anything else. Two near-twins ranked 1 and 2 differ by 0.016 and always disambiguate —
- * including the equal-strength typo case, which differs by exactly zero and therefore cannot
- * be resolved by any positive margin at all (D-07).
- *
- * WHERE THE BOUNDARY ACTUALLY IS, measured by the 387-05 corpus rather than argued.
- *
- * The 0.25 above comes from a CONTINUOUS inequality, and this scale is not continuous. A floor
- * host's score comes from the lexical leg alone, so its top is one leg's rank-1 contribution
- * (0.5) and its runner-up, when it has one, is rank 2 (0.4919). The largest margin a floor host
- * can therefore ever clear against a rival is the gap between two adjacent ranks — 1/124, about
- * 0.00806 — and above that the floor can only resolve a reference that matched exactly ONE
- * entity, which no dense leg can reorder. So the real bound is thirty times smaller than the
- * one the paragraph above derives, and 0.26 clears both with room to spare.
- *
- * That is not a licence to lower it. The corpus runs its whole population through this same
- * rule at several margins and reports what it finds: no divergence at 0.26, none at 1.5×1/124,
- * and a real one BELOW 1/124, where a case whose two lexical candidates sit 0.008 apart resolves
- * the first at the floor while the dense leg promotes the second in full. That measurement is
- * what makes the invariant's test a gate rather than an arithmetic tautology — and it is only
- * reachable because the decision is applied through one exported function (`applyStrongHitRule`)
- * that the corpus can hand a different margin. Nothing in production passes it one.
- *
- * Retune only alongside `RESOLVER_STRONG_HIT_MIN_SCORE`, and only against the corpus report
- * named at the top of this file: dropping below 1/124 trades the degradation guarantee for
- * recall, and dropping to 0.25 or below gives up the argument that it cannot be traded at all.
- */
 declare const RESOLVER_STRONG_HIT_MARGIN = 0.26;
 /**
  * How many candidates each leg is asked for.
@@ -466,67 +208,11 @@ declare const RESOLVER_STRONG_HIT_MARGIN = 0.26;
  * into a disambiguation. Bounded because the entity corpus is bounded by what a human can name.
  */
 declare const RESOLVER_CANDIDATE_K = 32;
-/**
- * The lexical admission floor for the ENTITY corpus, which is not the records corpus floor.
- *
- * `TAU_LEX` is 6.86, calibrated from a recorded serving replay over knowledge records. Measured
- * against entity renderings on 2026-08-02, the entire observed positive BM25 range was 0.0 to
- * 3.24 — an entity rendering is six words where a record rendering is a paragraph, so the two
- * corpora are not on the same scale and `TAU_LEX` rejects EVERY entity lexical candidate. The
- * dense leg keeps its own floor, `tau_dense`, which is profile-owned and therefore correct
- * wherever it is applied; only the lexical floor is corpus-specific, and applying a record
- * corpus's number here would have silently deleted the lexical leg.
- *
- * Zero means "the FTS query matched at all", and that is deliberately permissive. Under the
- * never-guess rule a weak extra candidate can only ADD a runner-up, and a runner-up can only
- * turn a resolve into a disambiguation — never into a different answer, because `lexicalLeg`
- * orders by BM25, so a genuine match always outranks a noise match. Raising this floor would
- * make small corpora answer `none` where several entities plainly do mention the word, which
- * is a worse lie than an honest disambiguation card.
- */
 declare const RESOLVER_LEXICAL_MIN_BM25 = 0;
 
 /** Build the MEM sighting source over a knowledge root. */
 declare function createMemorySightingSource(resolveKnowledgeRoot: () => string): EntitySightingSource;
 
-/**
- * Read side of the fingerprint-keyed recurrence window (Phase 390, D-07).
- *
- * `run_fingerprint_windows` is written by `applyRunOutcomes`; this module is the one place that
- * queries it. Strictly read-only: prepared SELECTs, no statement that mutates a row, ever — the
- * writer half stays whole in `run-outcomes.ts`, exactly as `run-outcome-read.ts` does for the
- * per-test counters it is the sibling of.
- *
- * KEY LAW — a window row is addressed by `(product, fingerprint)`. Stable test identity
- * `(product, filePath, testName)` travels ON the row because a crossing has to name the test it
- * quarantines, but it is never part of the recurrence key: one fingerprint may be exercised by
- * several tests, and D-07's rule is about the FAILURE recurring, not the test.
- *
- * THE WINDOW SLIDES OVER ORDINALS, NOT RUNS (D-07). Recurrence is counted over the ordinal range
- * `[current - QUARANTINE_WINDOW_ORDINALS + 1, current]`:
- *
- *  - two failing runs inside ONE build ordinal count once (the numerator counts DISTINCT ordinals),
- *  - a failure at ordinals 5/7/9 still crosses at 9 even though no two runs were consecutive,
- *  - and an occurrence that has slid out of the range is FORGIVEN. That is the whole point of a
- *    window: the lifetime `flake_count` never forgives, which is exactly why D-07 demoted it to a
- *    ranking input and made this the trigger substrate instead.
- *
- * `windowOrdinals` is the honest denominator: how many distinct ordinals in the range this product
- * recorded a failure in at all. A caller renders "3rd occurrence in 5 builds" from the pair, and an
- * empty window answers typed zeros rather than an absence a renderer has to guess about.
- *
- * PRECONDITION — the caller supplies a connection where `ensureRunOutcomeTables` has run (every
- * `openIndexWriter` does). A read-only connection against a store predating these tables raises
- * sqlite's `no such table`, which the composition layer folds to typed absence the same way it
- * already does for `readTestOutcomeHistory`.
- */
-
-/**
- * §7.3's locked detection window, verbatim: the same fingerprint recurring within the last five
- * build ordinals. A pinned constant with no config key (386 D-15) — retune it from operational
- * evidence, in the source, where the change is reviewable. Plan 05's rule reads the threshold
- * against this window; D-10's auto-exit is symmetric with it by design.
- */
 declare const QUARANTINE_WINDOW_ORDINALS = 5;
 /** The recurrence key: the failure, inside one product partition. */
 interface FingerprintWindowIdentity {
@@ -549,20 +235,7 @@ interface FingerprintRecurrence {
     /** DISTINCT build ordinals inside the window carrying ANY failure for this product. */
     windowOrdinals: number;
 }
-/**
- * Every stored row for one fingerprint inside the bounded read scope, ordinal-ascending.
- *
- * The read scope is the last {@link LAST_OUTCOMES_LIMIT} ordinals rather than the detection window,
- * so a caller that wants to SHOW the recent history (D-10's M-consecutive-passes exit, the list
- * verb) sees the same depth the per-test outcome window carries. An identity the projection never
- * recorded answers `[]` — typed absence, never a stand-in row.
- */
 declare function readFingerprintWindow(db: DatabaseSync, identity: FingerprintWindowIdentity, currentBuildOrdinal: number): FingerprintWindowRow[];
-/**
- * One fingerprint's recurrence over the sliding ordinal window (D-07) — computed LIVE on every
- * call, never stored. Both legs count DISTINCT ordinals, which is what makes two failing runs in
- * one build one occurrence.
- */
 declare function fingerprintRecurrence(db: DatabaseSync, identity: FingerprintWindowIdentity, currentBuildOrdinal: number): FingerprintRecurrence;
 
 declare const LEASE_FILE = ".lease";
@@ -580,15 +253,6 @@ declare const WRITER_AUTHORITY_DB_FILE = ".writer-authority.sqlite";
  * observable so the contender can apply the lease and verified-termination policy.
  */
 declare const MUTATION_LOCK_BUSY_TIMEOUT_MS = 2000;
-/**
- * Transient guard serializing the beat's read-check-write with release's read-check-delete.
- *
- * A directory holding exactly one `owner-<token>` file, published whole by renaming a staged
- * directory into place. It lives under `memory/queue/`, which every scaffolded knowledge
- * `.gitignore` already ignores, so neither a guard in use nor one a crash left behind is ever a
- * commit-visible file in a user's knowledge repository (261002-lse follow-up; the user's
- * `.gitignore` is never rewritten, D-22).
- */
 declare const LEASE_GUARD_DIR = "memory/queue/lease-guard";
 declare const writerLeaseSchema: z.ZodObject<{
     leaseId: z.ZodString;
@@ -618,13 +282,6 @@ type AcquireWriterLeaseOutcome = {
     reason: 'corrupt-epoch-state';
     error: CorruptEpochStateError;
 } | {
-    /**
-     * CR-01 (round 5): the lease file's own sibling of `corrupt-epoch-state`.
-     *
-     * `code` is the raw errno so an operator sees EACCES rather than a contender that silently
-     * spun to its deadline over an authority state nobody can evaluate; `error` keeps this arm
-     * inside the union's stated contract that every refusal is rethrowable.
-     */
     kind: 'refused';
     reason: 'unreadable-lease-state';
     code: string;
@@ -632,15 +289,6 @@ type AcquireWriterLeaseOutcome = {
 } | {
     kind: 'refused';
     reason: 'mutation-lock-unreclaimable';
-    /**
-     * Both refusal arms carry a thrown-shaped `error` ON PURPOSE.
-     *
-     * Every caller of this union already renders `refused` as `[reason]: error.message` or
-     * rethrows it, so a new arm that also carries one is surfaced by name at every entry point —
-     * including any added later — without a list of call sites to keep in step. Naming the
-     * refusal is the requirement; enumerating the callers who must name it is the failure mode
-     * this phase keeps rediscovering.
-     */
     error: WriterLeaseUnreclaimableError;
     attempts: number;
     waitedMs: number;
@@ -665,9 +313,7 @@ type HeartbeatLeaseOutcome = {
     holder: WriterLease;
 } | {
     kind: 'refused';
-    reason: 'lease-missing' | 'lease-malformed'
-    /** CR-01: the lease exists and could not be opened — never write over what you cannot read. */
-     | 'lease-unreadable' | 'lease-id-mismatch' | 'stale-epoch' | 'corrupt-epoch-state';
+    reason: 'lease-missing' | 'lease-malformed' | 'lease-unreadable' | 'lease-id-mismatch' | 'stale-epoch' | 'corrupt-epoch-state';
     holder?: WriterLease;
     observedEpoch?: number;
     error?: CorruptEpochStateError;
@@ -703,15 +349,6 @@ declare class CorruptEpochStateError extends Error {
     readonly rawPreview: string;
     constructor(path: string, reason: CorruptEpochStateReason, rawPreview: string);
 }
-/**
- * Fail-closed acquisition refusal after the deadline; carries why the wait could not end well.
- *
- * A contender that gives up is reporting a fact about the SYSTEM, not about itself, so the
- * diagnostics travel with the error: the owner it kept losing to, whether that owner was even
- * attributable (an unattributed row can never be escalated against, which is usually the whole
- * story), and the lease it kept reading. `agent-qa daemon` prints this and exits non-zero where it
- * previously hung with no output at all.
- */
 declare class WriterLeaseUnreclaimableError extends Error {
     readonly name = "WriterLeaseUnreclaimableError";
     readonly reason: "mutation-lock-unreclaimable";
@@ -721,33 +358,12 @@ declare class WriterLeaseUnreclaimableError extends Error {
     readonly observedLease?: WriterLease;
     constructor(attempts: number, waitedMs: number, observedOwner?: UnreclaimableMutationLockOwner, observedLease?: WriterLease);
 }
-/**
- * The lease file's sibling of `CorruptEpochStateError`, for a read that produced no throwable.
- *
- * `readFileSync` threw, but the value that reaches a consumer is a kinded outcome rather than an
- * exception, and `AcquireWriterLeaseOutcome`'s own contract is that EVERY refusal arm carries a
- * thrown-shaped `error` — three call sites rethrow or render it without knowing which arm they
- * hold (`drain.ts:842` among them). A refusal that carried only an errno string would have made
- * that contract a list of call sites to keep in step, which is the failure mode this module keeps
- * rediscovering. Deliberately not re-exported from the package index (IN-04): the refusal is fully
- * legible from `reason`, `code` and `error.message`.
- */
 declare class UnreadableWriterLeaseStateError extends Error {
     readonly name = "UnreadableWriterLeaseStateError";
     readonly path: string;
     readonly code: string;
     constructor(path: string, code: string);
 }
-/**
- * The authority-file read verdict, and it has four values rather than three.
- *
- * Round-5 CR-01: `unreadable` is the sibling of the epoch read's
- * `CorruptEpochStateError(…, 'unreadable', …)`. A file that EXISTS and could not be opened is a
- * different fact from a file that is not there and from a file whose bytes were read and failed to
- * parse, and the previous three arms had nowhere to put it — so EACCES, EIO, EMFILE and ENFILE all
- * landed on `malformed`, which every consumer reads as "nobody holds authority". `code` carries
- * the errno so the refusal that follows can name the cause to an operator.
- */
 type ReadWriterLeaseOutcome = {
     kind: 'absent';
 } | {
@@ -759,33 +375,6 @@ type ReadWriterLeaseOutcome = {
     kind: 'parsed';
     lease: WriterLease;
 };
-/**
- * Opaque process-incarnation token for one pid, anchored OUTSIDE any value this module writes.
- *
- * CR-04: a durable row's pid is not an identity. Once the recorded process dies, the kernel is
- * free to hand that number to a stranger, and every later decision keyed on the number alone
- * (above all `SIGKILL`) targets whoever holds it now. The one fact that distinguishes them is
- * assigned by the OS and cannot be forged from inside the store: when the process at that pid
- * started.
- *
- * Linux reads field 22 (`starttime`) of `/proc/<pid>/stat`, counted from the LAST `)` because the
- * `comm` field is parenthesised and may itself contain spaces and parentheses. Other POSIX hosts
- * read `/bin/ps -p <pid> -o lstart=` in the C locale and UTC, so every reader renders one start
- * time as one token. Windows has no equivalent builtin, so it resolves to `undefined` and every
- * incarnation check there fails closed.
- *
- * Returns `undefined` — never throws — whenever the pid cannot be attributed. `undefined` means
- * "do not signal", never "safe to signal".
- *
- * WR-04: `timeoutMs` bounds the POSIX arm's `ps` fork, which is the last wait beneath the
- * acquisition deadline that used to be able to outlive it — a wedged `ps` never returns, and this
- * resolution sits directly on the pre-signal path. A cap that expires resolves
- * through the SAME funnel every other failure uses (`undefined`), so a timed-out resolution is
- * unverifiable and therefore signal-ineligible. Callers with no budget of their own omit it.
- *
- * 386-32 consumes this same helper for the embedder-worker signal path, so both kill paths speak
- * one incarnation vocabulary.
- */
 declare function resolveProcessIncarnation(pid: number, timeoutMs?: number, psExecutable?: string): string | undefined;
 interface MutationLockOptions {
     /** Test/chaos seam after the claim is committed and before the held transaction begins. */
@@ -805,13 +394,6 @@ interface MutationLockOptions {
     psExecutable?: string;
 }
 interface AcquireWriterLeaseOptions extends MutationLockOptions {
-    /**
-     * Test/chaos seam for the pinned acquisition deadline; production never sets it.
-     *
-     * The same shape as `mutationLockTakeoverMs` and the heartbeat supervisor's `stopTimeoutMs`: a
-     * real unreclaimable wait is 60 s, which no test can afford to sit through, and shortening the
-     * window is the only way to reach the refusal branch (D-15 — a seam, never a config key).
-     */
     acquireDeadlineMs?: number;
 }
 interface CurrentWriterAuthority {
@@ -822,53 +404,9 @@ interface CurrentWriterAuthorityHooks extends MutationLockOptions {
     /** Test/chaos seam after the lock-held epoch comparison and before mutation. */
     afterFinalAuthorityCompare?: () => void;
 }
-/**
- * Read and strictly validate current writer authority without acquiring or refreshing it.
- *
- * CR-01 (round 5): ENOENT is the only read failure that is evidence of absence, and NO read
- * failure is evidence of corruption. This is `readEpoch`'s rule applied to the file it was not
- * applied to — the derivation's own W-01 note says the guard belongs at the READ, so that
- * consumers inherit it rather than each re-deriving it, and this read has three consumers that
- * select SIGKILL, epoch minting and registration deletion from its answer.
- *
- * The `existsSync` fallback that used to sit here is deleted rather than kept beside the errno
- * test: under fd exhaustion it fails for the same reason the open did, so it degraded an EMFILE
- * read from `malformed` to `absent` — the strongest possible statement that nobody holds the
- * lease, produced by the weakest possible evidence.
- */
 declare function readWriterLease(knowledgeRoot: string): ReadWriterLeaseOutcome;
 /** Purely classify a guarded or untrusted lease value against one explicit wall-clock instant. */
 declare function isLeaseStale(lease: unknown, nowMs: number): boolean;
-/**
- * The one freshness answer, and it has three values rather than two.
- *
- * CR-01: the previous derivation returned a boolean, so every way of failing to READ the epoch
- * collapsed into the same value a genuinely expired lease produces. `readEpoch` raises
- * `CorruptEpochStateError(…, 'unreadable', …)` for EACCES, EIO, EMFILE and ENFILE, not only for
- * corrupt bytes, and fd exhaustion produces both that failure and the daemon identity-handshake
- * failure at once. A live, healthy holder therefore became de-registrable and SIGKILL-eligible on
- * a transient read error.
- *
- * `unknown` is deliberately NOT resolved to either boolean here. Resolving it toward "fresh" makes
- * a permanently unreadable epoch an immortal phantom holder no contender can ever reclaim;
- * resolving it toward "reclaimable" is the kill this closes. It is returned to the consumers so
- * each of them names what it does with it, and so a fourth consumer added later cannot inherit a
- * default it never chose.
- *
- * W-01: the epoch conjunct lives HERE, in the derivation, not at the consumers. Three surfaces
- * classify recoverability from this verdict — `leasePermitsEscalation`, the acquisition
- * pre-check, and `classifyDaemonRegistration` in the CLI — and a fix applied consumer by consumer
- * is a list that the next surface joins without joining the guard. A lease naming a superseded
- * epoch is recovery input no matter how fresh its bytes are: nobody can still be inside a
- * transaction for an epoch that has already been replaced.
- *
- * WR-04: a crash between the epoch rewrite and the lease rewrite leaves a lease naming the
- * previous epoch. Reporting that lease as held manufactures a phantom holder no TTL sweep ever
- * reclaims, so an epoch-invalid lease is recovery input rather than an answer.
- *
- * The inputs are the disk epoch and the lease value, and nothing else. There is no second
- * freshness channel and no further conjunct: three conjuncts produced three defects.
- */
 type WriterLeaseFreshness = {
     kind: 'fresh';
 } | {
@@ -886,44 +424,6 @@ declare function acquireWriterLease(knowledgeRoot: string, hooks?: AcquireWriter
  * bounded takeover. Mutation implementations must keep irreversible work inside `mutate`.
  */
 declare function withCurrentWriterAuthority<T>(knowledgeRoot: string, authority: CurrentWriterAuthority, mutate: () => T, hooks?: CurrentWriterAuthorityHooks): T;
-/**
- * Refresh the matching current-epoch holder without entering the mutation lock.
- *
- * CR-03 dissolves here rather than being worked around. The beat used to share
- * `withMutationLock` with every governed write, and it runs in a worker THREAD, so the daemon's
- * long synchronous mutation on the main thread held the lock while the worker blocked on it: the
- * holder starved its own heartbeat, crossed the TTL and became a takeover target. Writing `.lease`
- * directly means a governed mutation of any length cannot starve the beat at all, so heartbeat
- * independence is structural instead of a fallback that has to be maintained beside the real path.
- *
- * What the lock used to buy was check-then-write atomicity of the identity/epoch ladder below
- * against a concurrent reclaim, and dropping it opens exactly one race: a holder resuming from a
- * >=TTL wedge can land its read-check-write astride a contender's reclaim and clobber the
- * successor's lease. That is contained rather than prevented, and the containment is the epoch
- * fence: a reclaim rewrites `.epoch` strictly BEFORE it publishes its lease, both inside the lock,
- * so any lease clobbered afterwards names a superseded epoch. Every classifier reads it as
- * recovery input, no store write is admitted under it (the epoch fence at the store verbs), and
- * the successor's next authority check surfaces WriterAuthorityLostError, after which a fresh
- * acquisition reclaims at the next epoch. The worst case is one successor bounce in a microsecond
- * window after a 30 s wedge — a liveness hiccup, never minted authority. During the exact schedule
- * this lock-free write exists for (the holder's own mutation in flight) no contender can be
- * mid-reclaim at all, because a reclaim requires the very lock that mutation is holding.
- *
- * 2026-08-01 W-02 re-scope: `MUTATION_LOCK_TAKEOVER_MS` now governs reclaim from DEAD and
- * whole-process-STOPPED owners, which write no beats and cross the TTL. Auto-takeover of a LIVE
- * holder whose beat thread is still ticking is deliberately impossible; a wedged-forever live
- * daemon surfaces at every contender as the typed `mutation-lock-unreclaimable` refusal naming its
- * pid. That is an operator kill rather than an automated one, which is this module's own law: a
- * wrong kill is unrecoverable, a wedged contender is not.
- *
- * Identity is still proven first, and every refusal below leaves `.lease` byte-identical.
- *
- * 2026-10-02 (quick 261002-lse, 432-19 #7): the ladder and the write run under the lease-file
- * guard `releaseLease` also takes. Without it a beat that read before a release wrote after it,
- * and since release deliberately keeps the epoch, the resurrected lease named the CURRENT epoch:
- * the fence above contains a reclaim but not a release, and the next acquire answered `held`.
- * The guard is not the mutation lock, so everything said above about CR-03 still holds.
- */
 declare function heartbeatLease(opts: LeaseOperationOptions, hooks?: LeaseGuardHooks): HeartbeatLeaseOutcome;
 /**
  * Refresh one exact maintenance writer at a non-mutating boundary.
@@ -934,14 +434,6 @@ declare function heartbeatLease(opts: LeaseOperationOptions, hooks?: LeaseGuardH
  * irreversible mutation must instead run inside `withCurrentWriterAuthority`.
  */
 declare function refreshWriterLeaseAuthority(authority: WriterLeaseAuthority): WriterLeaseAuthority;
-/**
- * Remove only the matching lease file; the monotonic epoch is deliberately retained forever.
- *
- * The read and the deletion run under the lease-file guard, taken inside the mutation lock, so a
- * heartbeat in flight finishes before the lease is read and any later beat finds it gone
- * (261002-lse). The guard is always taken second, and the beat never takes the mutation lock, so
- * the two cannot wait on each other.
- */
 declare function releaseLease(opts: LeaseOperationOptions, hooks?: LeaseGuardHooks): ReleaseLeaseOutcome;
 
 /**
@@ -962,29 +454,6 @@ declare const QUARANTINE_MANUAL_ENTRY_FINGERPRINT = "manual-entry";
  * the class of AUTO entries only, so no rule changes behaviour on the strength of this value.
  */
 declare const QUARANTINE_MANUAL_ENTRY_CLASS: VerdictClass;
-/**
- * The `filePath` a caller sent cannot mint the durable identity the ledger is keyed on (390-12).
- *
- * Same shape and same reason as the lease refusal above: the port's result unions carry no refusal
- * arm by design (390-04), so a refusal that is not one of the named outcomes surfaces as a typed
- * throw. Raised BEFORE the knowledge root is resolved, before the lease is acquired and before a
- * byte is read, so a refused call costs the ledger nothing and the next writer nothing.
- *
- * WHAT THIS OWNS, AND WHAT THE LEDGER'S OWN WRITE GUARD OWNS (390-11). They are not two spellings
- * of one rule and neither subsumes the other:
- *
- *  - THIS decides what the identity IS. It is the only gate that knows the checkout root, so it is
- *    the only one that can turn `/Users/me/repo/tests/a.yaml` — a real file inside the workspace,
- *    the exact bytes an operator pastes out of a failure report — into `tests/a.yaml` and ACCEPT
- *    it. The structural guard would refuse that input; refusing it is the wrong answer, because
- *    the operator named a file the workspace genuinely contains.
- *  - The STRUCTURAL guard in `appendQuarantineEvents` decides what the FILE may carry, for every
- *    writer including one that never met a mint. It is a backstop with no host context, and it
- *    throws rather than answering data because a line the reader refuses is corruption.
- *
- * What cannot be canonicalized at all — a path escaping the config directory — is refused here,
- * with the mint's own message carried so the operator learns why rather than that.
- */
 declare class QuarantineIdentityRefusedError extends Error {
     readonly filePath: string;
     readonly reason: unknown;
@@ -995,56 +464,12 @@ interface QuarantineOperationsOptions {
     resolveKnowledgeRoot: () => Promise<string> | string;
     /** The ONLY way wall clock enters these verbs. Required — see the module head. */
     now: () => string;
-    /**
-     * Mints the durable workspace-relative identity a `filePath` is stored under (390-12 / D-01).
-     *
-     * Production supplies core's ONE recipe, `workspaceRelativeIdentityPath`, pre-bound to the host's
-     * own config directory. INJECTED rather than imported for two independent reasons, and either
-     * alone would be sufficient: this package may not depend on `@vostride/agent-qa-core` (only the
-     * surface packages may), and — the load-bearing one — the checkout root is a HOST fact these
-     * verbs cannot discover. A verb that guessed it would mint identities against the wrong root.
-     *
-     * REQUIRED, with no default. A default passthrough is exactly the unvalidated pass-through that
-     * produced the round-2 regression: the verbs answered `entered` over lines the reader is
-     * guaranteed to refuse. An absent mint must be a compile error at the composition that forgot it,
-     * not a runtime surprise inside a committed artifact.
-     *
-     * @throws whatever the mint throws for a path it cannot canonicalize; re-raised as
-     * {@link QuarantineIdentityRefusedError}.
-     */
     mintIdentityPath: (filePath: string) => string;
-    /**
-     * The writer lease THIS process already holds, when it holds one (387-08 D-18 / D-5).
-     *
-     * Supplied by the daemon host, which acquires at startup and holds for its whole lifetime: a
-     * holder that calls `acquireWriterLease` is answered `held` by itself and, unlike the apply path,
-     * has nobody to delegate to. Absent on the CLI in-process host, which holds nothing and therefore
-     * takes the lease per call.
-     *
-     * THE VALUE IS CONSULTED FOR FENCING (390-15 / G-390-2R), and this sentence used to say the
-     * opposite. It is re-validated against disk on every write verb, so the question it answers is
-     * "is this process STILL the holder?" rather than "did this process already serialize itself?".
-     * The two are the same question only while nothing reclaims: a daemon whose heartbeat starved
-     * and whose lease was then taken answers yes to the second one forever, and the two-OS-process
-     * harness measured what that costs — two `entered` lines for one identity, and the verb
-     * returning an owner committed truth does not record. See {@link underWriterLease}.
-     *
-     * AND WHAT THE RE-VALIDATION DOES NOT BUY (390-22 / WR-07): it is a read, not a lock. It answers
-     * "still the holder?" as of the read, and the decide it licenses runs after it. A reclaim landing
-     * between the two is still unfenced. `lease/under-writer-lease.ts` states the residual in full.
-     */
     resolveWriterAuthority?: () => {
         leaseId: string;
         epoch: number;
     } | undefined;
 }
-/**
- * The three verbs over one committed ledger.
- *
- * Each call is a full read-fold-decide-append cycle. Nothing is cached between calls, which is what
- * makes `quarantine.list` and the sentence's ladder clause two readings of ONE live computation
- * (SC4): an event appended between two calls is visible to both.
- */
 declare function createQuarantineOperations(options: QuarantineOperationsOptions): QuarantineOperationsPort;
 
 declare const ARTIFACT_STEP_CAP_BYTES: number;
@@ -1126,7 +551,6 @@ interface BundleStoreConfig {
     /** Absolute committed-root path. Deliberately no working-directory default. */
     knowledgeRoot: string;
     productKey: string;
-    commitArtifacts: 'none' | 'thumbnails';
     /** Active writer identity used to attribute crash-left staging trees. */
     writerLeaseId?: string;
     /** Fencing epoch embedded in reader-invisible staging names. */
@@ -1170,18 +594,12 @@ type AppendOutcome = {
 } | {
     kind: 'not-found';
 };
-/** 416 D-04: receipt identity is its verified content digest, before any committed write. */
 declare function appendGateReceipt(config: BundleStoreConfig, id: RecordId, receipt: GateReceipt): AppendOutcome;
-/** 416 D-05/D-07: one promotion line per candidate/path; lifecycle bytes remain unchanged. */
 declare function appendPromotionReceipt(config: BundleStoreConfig, id: RecordId, lineWithoutDigest: Omit<PromotionReceipt, 'receiptDigest' | 'citedReceiptDigests'> & {
     citedReceiptDigests: readonly string[];
 }): AppendOutcome;
 declare const MEASUREMENTS_REL_PATH = "evidence/measurements.json";
 declare function appendOutcomeEvent(config: BundleStoreConfig, id: RecordId, event: BundleOutcomeEvent): AppendOutcome;
-/**
- * Persist D-03's immutable validity-window snapshot. An existing measurements
- * file is an idempotent refusal: baseline bytes are never rewritten.
- */
 declare function writeMeasurementBaseline(config: BundleStoreConfig, id: RecordId, baseline: MeasurementBaseline): AppendOutcome;
 /**
  * Append one observation through the full journaled replacement path. Existing
@@ -1190,17 +608,6 @@ declare function writeMeasurementBaseline(config: BundleStoreConfig, id: RecordI
 declare function appendMeasurementObservation(config: BundleStoreConfig, id: RecordId, observation: MeasurementObservation): AppendOutcome;
 declare function appendRelation(config: BundleStoreConfig, id: RecordId, relation: BundleRelation): AppendOutcome;
 
-type CanonicalBundleStateDigests = {
-    kind: 'found';
-    digests: string[];
-} | {
-    kind: 'not-found';
-};
-declare function readCanonicalBundleStateDigests(input: {
-    knowledgeRoot: string;
-    candidateId: string;
-}): CanonicalBundleStateDigests;
-
 /**
  * The leg Channel-1 run-brief assembly attributes to. See the module header: the assembly's whole
  * ordering signal is the scope/anchor token overlap, so this is a statement about the code that
@@ -1246,13 +653,6 @@ declare function getCachedEmbedding({ db, profile, leg, rendering, }: EmbedCache
 declare function putCachedEmbedding({ db, profile, leg, rendering, vector, }: EmbedCachePut): void;
 /** Evict every cached leg/revision/dtype row owned by one model id. */
 declare function dropEmbedCacheForModel(db: DatabaseSync, modelId: string): void;
-/**
- * Decorate an embedder with the M2 connection-role posture.
- *
- * Reader connections use check-only: they benefit from materialized rows but never write on a
- * miss. Writer-role backfill, migration, and bench paths use check-and-store, which is where the
- * steady-state cache materializes. Callers must ensure the table once through a writer first.
- */
 declare function wrapEmbedderWithCache({ embedder, profile, db, mode, }: EmbedCacheWrapperOptions): EmbedderPort;
 
 type WorkerDiscoveryResult = {
@@ -1274,12 +674,6 @@ type AcquireEmbedderOutcome = {
 } | {
     kind: 'lexical-only';
 };
-/**
- * D-12/D-17 test-only capability injection seam.
- *
- * Production callers must omit this field so rung selection reflects host truth. No probe is a
- * user-facing selector, configuration key, environment variable, or CLI switch.
- */
 interface EmbedderProbes {
     discoverWorker?: (agentQaRoot: string) => Promise<WorkerDiscoveryResult>;
     createNativeEmbedder?: (options: {
@@ -1299,7 +693,6 @@ interface AcquireEmbedderOptions {
         db: DatabaseSync;
         mode: EmbedCacheMode;
     };
-    /** D-12/D-17 test seam. Production callers resolve actual host capabilities. */
     probes?: EmbedderProbes;
 }
 interface ResolveEmbedderCapabilityOptions {
@@ -1309,7 +702,6 @@ interface ResolveEmbedderCapabilityOptions {
     workerPolicy?: EmbedderWorkerPolicy;
     /** Explicit hosted runtime root. Required policy must never infer it from ambient cwd. */
     agentQaRoot?: string;
-    /** D-12/D-17 test seam. Production callers resolve actual host capabilities. */
     probes?: EmbedderProbes;
 }
 type CapabilityOutcome = AcquireEmbedderOutcome;
@@ -1324,86 +716,24 @@ interface DiscoverEmbedderWorkerOptions {
     /** Test-only shortening seam; production omits this and uses the pinned request deadline. */
     readonly requestTimeoutMs?: number;
 }
-/** D-09's worker arm, rooted in the hosted project rather than ambient process cwd. */
 declare function discoverEmbedderWorker(agentQaRoot: string, options?: DiscoverEmbedderWorkerOptions): Promise<WorkerDiscoveryResult>;
-/**
- * Resolve the automatic ladder once per profile for this process (D-17).
- *
- * Every host/runtime failure collapses to a typed capability outcome; callers cannot select a
- * rung. Injected test seams receive an isolated memo while production keys solely by the stable
- * embedding profile identity.
- */
 declare function resolveEmbedderCapability(options: ResolveEmbedderCapabilityOptions): Promise<CapabilityOutcome>;
 declare function acquireEmbedder(options: AcquireEmbedderOptions): Promise<AcquireEmbedderOutcome>;
 
-/**
- * The ONE fold from the host's two retrieval axes to the recorded rung (407 TRST-01 · D-13/D-17).
- *
- * ONE resolver, three callers: the runner's evidence recorder (407-07) stamps the value into
- * `StepEvidence.retrievalRung`, `doctor` (407-08) grades it live, and the run header banner
- * (407-10) renders the recorded copy. Three callers deriving a rung independently from the same
- * two axes is exactly how a banner and a doctor row come to disagree about one machine, so the
- * fold table lives here once and its cells are pinned by `__tests__/retrieval-rung.test.ts`.
- *
- * WHAT THE VALUE MEANS. It is the HOST's ladder at serve time — never a claim about how any
- * individual brief line was ranked. The run-brief serve path reads index rows directly and
- * attributes channels 1 and 3 to the `anchor` leg by construction; the dense leg and the
- * bundle-scan fallback belong to the general `retrieve()` path the curator, the entity resolver
- * and the authoring reader use. A surface renders "retrieval was on rung X for this run".
- *
- * This module lives in knowledge-local because it is the only package that can see either axis:
- * the index face is `index-reader`'s degrade ladder and the embedder outcome is
- * `embedder-acquire`'s capability probe. What it hands back is the schema-owned value.
- */
-
 /** The index half of the fold — `index-reader`'s degrade ladder, read without side effects. */
 type IndexAxis = IndexFace;
 /** The embedder half of the fold — `embedder-acquire`'s capability outcome, unchanged. */
 type EmbedderAxis = AcquireEmbedderOutcome;
-/**
- * Fold the two axes into the value that gets recorded (D-17).
- *
- * ORDERING IS PART OF THE CONTRACT: the index axis is consulted FIRST. No dense leg can run
- * against an index that will not open, whatever the embedder resolved to, so a `scan` face is
- * `bundle-scan` even on a host with a live native embedder. Folding the embedder first would
- * label a host with an unopenable index `memidex` and make the banner lie.
- *
- * `reason` is ABSENT for `memidex` — the top rung is not a degradation and has no cause to name.
- * Every lower rung carries one, which is what lets the banner say rung AND cause in one line.
- */
 declare function foldRetrievalRung(index: IndexAxis, embedder: EmbedderAxis, preferredProfile?: EmbeddingProfile): RecordedRetrievalRung;
 interface ResolveRetrievalRungOptions {
     knowledgeRoot: string;
     /** Explicit hosted runtime root for worker discovery; defaults to the acquirer's own rule. */
     agentQaRoot?: string;
     preferredProfile?: EmbeddingProfile;
-    /** D-12/D-17 test seam, passed through unchanged. Production callers omit it. */
     probes?: EmbedderProbes;
 }
-/**
- * Probe both axes and fold them (D-17). NEVER throws, NEVER downloads, NEVER writes.
- *
- * - `allowDownload: false` is hard-coded, not an option: this call answers "what is this host
- *   doing today", and a probe that fetched a model would change the answer by asking it (T-407-09).
- * - A `scan` face short-circuits before the embedder is touched at all. The fold does not need the
- *   embedder axis in that arm, and the probe can cost a model load.
- * - A rejected capability probe folds to `deferred/load-failure` rather than propagating. This
- *   resolver's callers are a banner, a doctor row and an evidence recorder; none of them has a
- *   sensible behaviour for "asking about the ladder threw".
- * - `classifyIndexFace` writes no rebuild marker, so asking is not a mutation of the knowledge root.
- *
- * The memo inside `resolveEmbedderCapability` is what makes a second call in the same process free,
- * which is why `doctor` and the runner can both ask without paying twice.
- */
 declare function resolveRetrievalRung(options: ResolveRetrievalRungOptions): Promise<RecordedRetrievalRung>;
 
-/**
- * Fixed weighted-RRF vector for each deterministic query class (D-06).
- *
- * PROVISIONAL vectors pending M3's learned per-product replacements. Plain RRF with all three
- * weights equal to 1 is the declared cold-start floor; learning may replace vectors, never the
- * classifier itself.
- */
 declare const QUERY_CLASS_WEIGHTS: {
     readonly literal: {
         readonly wLex: 1.5;
@@ -1422,18 +752,8 @@ declare const QUERY_CLASS_WEIGHTS: {
     };
 };
 
-/**
- * D-06's closed query-class contract. The classifier is deterministic and total; future learned
- * weights may replace class vectors, but they must not replace or widen these classes implicitly.
- */
 type QueryClass = 'literal' | 'mixed' | 'semantic';
 
-/**
- * The deterministic memory.md §5.5.8 query door (377 D-13). Every identity anchor is normalized
- * through the schema authority before keys or matching helpers are derived. Raw selector atoms
- * remain lexical-only; dense text and fallback regions are assembled from structured fields.
- */
-
 interface RetrievalQueryInput {
     screenState?: ScreenState;
     intent: string;
@@ -1456,11 +776,6 @@ interface RetrievalQuery {
     weights: (typeof QUERY_CLASS_WEIGHTS)[QueryClass];
     fallbackRenderings: FallbackRendering[];
 }
-/**
- * Build both recall inputs from structured runner state. Fallback renderings are candidates only:
- * callers use them after exact/normalized anchor lookup misses and may set the admission
- * anchorExact carve-out only after a lexical hit re-confirms reconfirmToken (T-377-23).
- */
 declare function buildRetrievalQuery(input: RetrievalQueryInput): RetrievalQuery;
 
 interface AsOfRange {
@@ -1468,13 +783,6 @@ interface AsOfRange {
     hi: number;
 }
 
-/**
- * Public memory.md §5.5 retrieval composition.
- *
- * Usage telemetry (§5.5.9) is deferred by architecture: reader connections are query_only, so
- * counters land with Phases 378/380's writer-owned paths and are never an input to trust.
- */
-
 interface RetrieveOptions {
     n: number;
     product: string;
@@ -1513,19 +821,12 @@ interface RebuildIndexHooks {
 }
 interface RebuildIndexOptions {
     knowledgeRoot: string;
-    priors?: TrustPriorTable;
     embedder?: EmbedderPort;
     vecLoadablePath?: string;
     writerAuthority?: WriterLeaseAuthority;
     hooks?: RebuildIndexHooks;
 }
-/**
- * WR-01 record-scoped healing: delete the total projection set for exactly the supplied bundle
- * ids inside one transaction and return the number of records removed. An absent index db,
- * empty ids, and ids without records rows are no-ops; embed_cache is untouched (purge-only A4).
- */
 declare function removeBundleProjectionRows(knowledgeRoot: string, bundleIds: readonly string[], writerAuthority: WriterLeaseAuthority): number;
-/** Hash-selected projection plus the independent D-02 backfill and D-10 reconciliation passes. */
 declare function rebuildIndex(opts: RebuildIndexOptions): Promise<RebuildReport>;
 
 declare function readLatestBuildOrdinal(runtimeRoot: string, product: string): number | undefined;
@@ -1588,23 +889,8 @@ declare function applySuiteFingerprints(db: DatabaseSync, projection: SuiteFinge
  * fingerprint half (the gate evaluator's own harness, and this module's corpus).
  */
 declare function foldSuiteFingerprints(db: DatabaseSync, handoff: CompletedRunHandoff, opts: FoldSuiteFingerprintsOptions): SuiteFingerprintsProjection;
-/**
- * The read port gate 3 consumes through composition (D-15).
- *
- * MINIMAL BY DESIGN. Conservatism lives in the normalizer (D-14), not here: this port answers
- * what the table holds and nothing more, so a later retune of "near-same elements normalize
- * equal" moves in exactly one place. There is no similarity verb here because there is no
- * similarity threshold to defend — gate 3's value test is set membership, spec §6.3 verbatim.
- */
 interface SuiteFingerprintIndex {
-    /** The union D-14's novel-element test compares against. Empty table, empty union. */
     elementUnion(): Set<string>;
-    /**
-     * The identities that HAVE fingerprint rows, sorted. The consumer subtracts these from the
-     * authored-test universe to derive the evidence-less set that rides D-16's text lane — which is
-     * why this port reports coverage rather than trying to enumerate the suite, a fact it does not
-     * own and could only guess at.
-     */
     coveredTests(): Array<{
         filePath: string;
         testName: string;
@@ -1622,72 +908,19 @@ interface SuiteFingerprintIndexOptions {
 }
 declare function createSuiteFingerprintIndex(db: DatabaseSync, opts: SuiteFingerprintIndexOptions): SuiteFingerprintIndex;
 
-/**
- * PROVISIONAL last-N window for per-test outcome history (~10 pending ABRF-02 ranking
- * measurements). Entries are {buildOrdinal, passed} — ordinals only, wall-clock never.
- * Shared by readers and writers without pulling writer authority into the read closure.
- */
 declare const LAST_OUTCOMES_LIMIT = 10;
 
-/**
- * Stamped into the curation-tail receipt's projection component. Bump when the fold
- * semantics or table shapes change so already-receipted runs refold on the next tail.
- *
- * HOW THAT REFOLD ACTUALLY HAPPENS (393 CR-02), because the receipt alone cannot do it. The tail
- * stores this number in each run's receipt, so a bump invalidates every receipt and the sweep
- * re-runs each historical run — but the per-run fold then answers 'already-applied' off the
- * durable marker and writes nothing. The stamp is therefore ALSO stored in the index itself, in
- * `run_outcome_projection_version`, and `reconcileRunOutcomesProjection` compares the two ONCE per
- * curation-tail sweep, before the per-run loop: a differing or absent stamp rebuilds the whole
- * projection family from the runs root through `rebuildRunOutcomes`, which clears the family
- * (marker included) and re-reads every `handoff.json` + `analysis.json` from disk. THAT is how an
- * already-receipted run contributes its elements. The per-run receipts then rewrite at the new
- * version through the same sweep. The family is derived, so the rebuild is the whole upgrade, and
- * it is a mechanism that runs, not an argument that it is unnecessary.
- *
- * NOT the case argued at `cli/src/commands/run.ts:1949` (390-08 D-01), where a bump was
- * deliberately declined: there the rebuild would have replayed stored handoffs carrying the OLD
- * identities, landing in the same mixed state the bump was meant to clear. Here the new table has
- * no historical rows at all, and every row it will hold is derivable from evidence the stored
- * handoffs already carry — so the refold produces the complete answer rather than a mixed one.
- */
 declare const RUN_OUTCOMES_PROJECTION_VERSION = 2;
 
 /** Anchor extraction seam: the CLI tail passes its exercisedAnchors(step) walk. */
 type ExtractStepAnchors = (step: StepEvidence) => Anchor[];
-/**
- * Projection inputs contain no exclusion override. The durable handoff marker is the sole
- * authority for current-run folds, sibling backfill, and full rebuild alike (D-14 §6).
- */
 interface ProjectRunOutcomesOptions {
     extractAnchors: ExtractStepAnchors;
-    /**
-     * The run's persisted analysis artifact when one exists (390 D-09, the `ProjectCanaryOutcomes
-     * Input.artifact` precedent). DATA, not a port: `foldRunOutcomes` and `rebuildRunOutcomes` each
-     * load it from the run's own dir through the one shared loader and hand it here, so ONE
-     * projection function with ONE signature serves both paths — a second signature only one path
-     * calls is exactly how L12 rebuild parity breaks in silence.
-     */
     artifact?: RunAnalysisArtifact;
 }
-/**
- * What a FAILED member contributes to the fingerprint-keyed recurrence window (390 D-07).
- *
- * The fingerprint is composed through the ONE exported vocabulary — `failingStepOf`/`errorTextOf`
- * over `exercisedAnchors`, keyed by `failureFingerprint` — so this window and the render-time
- * cluster presentation cannot disagree about what "the same failure" is. The verdict class is part
- * of the key by recipe, which is why it travels beside it rather than being re-derived downstream.
- */
 interface RunOutcomeFailureKey {
     fingerprint: string;
     verdictClass: VerdictClass;
-    /**
-     * WHICH pipeline authored the class (390-16). Not part of the fingerprint and not stored on
-     * `run_fingerprint_windows` — it travels on the in-memory delta only, because the quarantine
-     * ladder's floor-eligibility gate needs to know whether the class is a statement about THIS
-     * TEST (an authored `analyze-run` verdict) or about the RUN (the deterministic floor, whose
-     * `environment` arms are one health-probe result applied to every failing member).
-     */
     producer: Verdict['producer'];
 }
 interface RunOutcomeTestDelta {
@@ -1696,9 +929,8 @@ interface RunOutcomeTestDelta {
     passed: boolean;
     heals: number;
     flake: boolean;
-    /** canonicalJson(normalizeAnchor(...)) keys — byte-deterministic (ABRF-02 encoding edge). */
     anchorKeys: string[];
-    /** Present for exactly the failed members — a pass contributes no window row (D-07). */
+    /** Present for exactly the failed members — a pass contributes no window row. */
     failure?: RunOutcomeFailureKey;
 }
 interface RunOutcomesProjection {
@@ -1708,12 +940,6 @@ interface RunOutcomesProjection {
     buildOrdinal: number;
     excluded: boolean;
     tests: RunOutcomeTestDelta[];
-    /**
-     * The suite-fingerprint deltas for the SAME members (393 D-15). They travel on this projection
-     * rather than being folded by a second pass so that one traversal of the handoff produces both
-     * tables, one transaction commits them, and one applied-runs marker covers them — which is what
-     * makes rebuild parity structural instead of asserted.
-     */
     fingerprints: SuiteFingerprintTestDelta[];
 }
 type ApplyRunOutcomesResult = {
@@ -1726,35 +952,13 @@ type ApplyRunOutcomesResult = {
 interface RebuildRunOutcomesOptions {
     extractAnchors: ExtractStepAnchors;
 }
-/**
- * What one rebuild did, with its two skip causes kept APART (393 round 7, CR-01-WIDENED).
- *
- * A single conflating counter answered "how many runs did not fold" and nothing an operator could
- * act on: a malformed `handoff.json` and an unloadable `analysis.json` are different files, written
- * by different producers, and fixed differently. There is deliberately no third counter for a
- * projection or write failure — that class is no longer a skip at all. It propagates out of
- * `rebuildRunOutcomes` and the rebuild produces no report.
- */
 interface RebuildRunOutcomesReport {
     folded: number;
-    /** Runs whose `handoff.json` would not load or carries a pre-381 / structurally unsafe shape. */
+    /** Runs whose `handoff.json` would not load or has an old or structurally unsafe shape. */
     skippedHandoffs: number;
-    /** Runs whose `handoff.json` loaded but whose `analysis.json` threw (the D-09 second document). */
     skippedArtifacts: number;
 }
-/**
- * What the fold needs before it may evaluate the quarantine detection ladder (390 D-08).
- *
- * Grouped and OPTIONAL on purpose: a caller that cannot supply a clock does
- * not get a silently empty evaluation, it gets `{kind: 'not-evaluated', reason: 'not-requested'}`
- * on the report. "Detection ran and found nothing" and "detection never ran" are different facts.
- */
 interface QuarantineDetectionOptions {
-    /**
-     * The ISO-8601 instant the evaluation is anchored to — the drain's own wall clock, read ONCE by
-     * the caller. The fold and the rule below it stay clock-free (390-01's purity-by-argument), which
-     * is what lets both expiry and the ladder be pinned one step either side.
-     */
     now: string;
 }
 interface FoldRunOutcomesOptions {
@@ -1762,23 +966,9 @@ interface FoldRunOutcomesOptions {
     knowledgeRoot: string;
     handoff: CompletedRunHandoff;
     extractAnchors: ExtractStepAnchors;
-    /**
-     * The run's own directory (`.agent-qa/runs/<slug(runId)>/`). When supplied, the fold loads
-     * `analysis.json` from it so the counters read RESOLVED verdicts (D-09). Absent — a caller that
-     * has no run dir — folds the deterministic floor, byte-identically to pre-390.
-     */
     runDir?: string;
-    /** Present when the caller wants the D-08 detection step; absent skips it explicitly. */
     quarantine?: QuarantineDetectionOptions;
 }
-/**
- * What the fold's detection step did, as DATA (390 Pitfall 4).
- *
- * Every arm is a fact the caller can print. A ledger that could not be read is a value, not an
- * exception: a failure that vanished inside a catch is exactly how an `entered` event goes missing
- * in silence, and a missing `entered` event is a test that keeps failing builds with nobody told
- * why it was supposed to stop.
- */
 type QuarantineFoldOutcome = {
     kind: 'not-evaluated';
     reason: 'already-applied' | 'not-requested';
@@ -1806,27 +996,6 @@ declare function projectRunOutcomes(handoff: CompletedRunHandoff, opts: ProjectR
  * refolds an already-applied partition (receipt withheld mid-tail) changes nothing.
  */
 declare function applyRunOutcomes(db: DatabaseSync, projection: RunOutcomesProjection): ApplyRunOutcomesResult;
-/**
- * Full rebuild: scan and read every run dir under `runsRoot`, then clear the projection tables
- * and refold each loadable handoff. Reproduces tables byte-identical to the incremental fold
- * (L12); a rebuild over zero handoff dirs yields empty tables without error (ABRF-02
- * empty edge). BAD-BYTES load failures and pre-381 shapes are counted skips — including a run whose
- * `analysis.json` will not decode, which costs that run's contribution and nothing else (393 round
- * 6, CR-01). One undecodable artifact must never truncate a family this function has already
- * read; an errno-coded HOST fault on either document, on the runs root, or on any run dir
- * propagates BEFORE the family is deleted, so no sweep can stamp — or empty — a family the
- * filesystem prevented it from reading (418-12, CR-01-EXISTS).
- *
- * Phase A: no document is destroyed before every document was read — a host fault during reads
- * leaves the previous family and its stamp untouched (418-12, CR-02-DESTRUCTIVE, load-before-delete).
- * The list holds parsed handoffs for one sweep; the runs root is bounded by host run retention.
- *
- * Phase B is DELETE-FIRST, STAMP-LAST, and that order is the crash story rather than a style choice (393
- * CR-02). The version row is cleared with the family it describes and re-written only after the
- * refold loop has run to completion, so a crash anywhere in between leaves NO stamp — which
- * `reconcileRunOutcomesProjection` reads as a mismatch and rebuilds again. The projection
- * therefore self-heals from a partial rebuild instead of stamping a half-built family as current.
- */
 declare function rebuildRunOutcomes(db: DatabaseSync, runsRoot: string, opts: RebuildRunOutcomesOptions): RebuildRunOutcomesReport;
 /** What one reconcile did — a fact the caller can print, never a silent side effect. */
 type ReconcileRunOutcomesProjectionResult = {
@@ -1850,60 +1019,9 @@ interface ReconcileRunOutcomesProjectionOptions {
     runsRoot: string;
     extractAnchors: ExtractStepAnchors;
 }
-/**
- * THE version trigger: reconcile the stored fold semantics with the shipped ones (393 CR-02).
- *
- * `RUN_OUTCOMES_PROJECTION_VERSION`'s doc block has always promised that a bump makes
- * already-receipted runs refold. Nothing performed that refold: `applyRunOutcomes` short-circuits
- * on the `run_outcome_applied_runs` marker before it can reach the fingerprint write, and nothing
- * cleared the marker on a version change — so on any project that folded runs before a bump, the
- * new table stayed empty forever and gate 3's fingerprint lane never had data to decide on. This
- * function is what makes that promise true, and it composes machinery that already existed rather
- * than adding a parallel path: `rebuildRunOutcomes` already clears the family, already re-reads
- * every `handoff.json` + `analysis.json` through the one shared loader, and already reaches
- * `applySuiteFingerprints` for every fold.
- *
- * ABSENT MEANS MISMATCH, deliberately. Every pre-stamp index reads as absent, which is exactly the
- * population that needs to converge; so does an index whose file was deleted, which is exactly the
- * population that needs to re-heal. Treating absence as "probably fine" would have made the
- * upgrade path the one path this function does not serve.
- *
- * WHY A REBUILD RATHER THAN A PER-RUN VERSION COLUMN. Refolding runs in place through the
- * incremental path would add each run's counters a SECOND time — the fold accumulates, it does not
- * replace. The rebuild is the mechanism precisely because it clears before it refolds, which is
- * also why the derived family is safe to move this way at all (L12: every row here is reproducible
- * from run artifacts on disk).
- *
- * 418-12 WR-03: a destructive rebuild of a shared derived family is a leased act. A caller
- * without authority gets a typed skip before opening a writer; it stays stale until a leased
- * sweep. The version check and entire rebuild share the current-authority generation lock.
- */
 declare function reconcileRunOutcomesProjection(opts: ReconcileRunOutcomesProjectionOptions): ReconcileRunOutcomesProjectionResult;
-/**
- * Incremental fold wrapper for the post-verdict tail: opens the one index writer, applies
- * the projection, and closes. The tail invokes it inside the SAME crash boundary and the
- * SAME (extended) receipt as candidate/canary emit — never a second marker file.
- *
- * Detection hangs off the `'applied'` arm ONLY (D-08). `applyRunOutcomes` answers
- * `'already-applied'` from an early return that fires before its transaction even opens, so
- * "a refold never double-quarantines" is true by POSITION — there is no second idempotency
- * condition here to keep in sync with the marker.
- */
 declare function foldRunOutcomes(opts: FoldRunOutcomesOptions): FoldRunOutcomesReport;
 
-/**
- * Read side of the run-outcome projection (389 ANLZ-03, RESEARCH Pitfall 2).
- *
- * `run_test_outcomes` is written by `foldRunOutcomes`/`applyRunOutcomes`; this module is
- * the one place that queries it. Strictly read-only: one prepared SELECT, no statement
- * that mutates a row, ever — the writer half stays whole in `run-outcomes.ts`.
- *
- * KEY LAW — stable test identity is `(product, filePath, testName)`, exactly the
- * projection's primary key and per-test-outcome.ts's identity rule. Callers joining from
- * a handoff use `PerTestOutcome.filePath` + `testName`, NEVER `testId` (a per-run
- * explicit id, not a durable identity).
- */
-
 /** One window entry: ordinals only, wall-clock never (mirrors the writer's OutcomeEntry). */
 interface TestOutcomeEntry {
     buildOrdinal: number;
@@ -1929,29 +1047,10 @@ interface TestOutcomeIdentity {
  * projection has never counted the test — typed absence, never an empty stand-in row.
  */
 declare function readTestOutcomeHistory(db: DatabaseSync, identity: TestOutcomeIdentity): TestOutcomeHistory | undefined;
-/**
- * Every identity the projection has counted inside ONE file, in one product (394-17 · WTST-05).
- *
- * The neighbours side of D-14's stability read: "which tests does this suite file already have run
- * evidence for". Keyed on the projection's own primary key, so `product` is REQUIRED for the same
- * reason `readTestOutcomeHistory` requires it — a query that dropped it would serve every
- * product's rows under one file path and report another application's tests as this target's.
- *
- * `test_name` ORDER, so a caller's message names its neighbours in a stable order across runs. An
- * empty array is the honest answer for a file the projection has never counted; the caller turns
- * that into a `no-history` posture rather than into a clean bill of health.
- */
 declare function listTestsInFile(db: DatabaseSync, scope: {
     product: string;
     filePath: string;
 }): string[];
-/**
- * D-02's forced discriminator channel: did the same step pass on the previous build?
- * Answers the entry with the greatest buildOrdinal STRICTLY below `currentBuildOrdinal`,
- * or `undefined` when no prior build is in the window (empty history, a single
- * current-build entry, or every entry at/above current) — prior-build honestly absent,
- * never faked from the current entry.
- */
 declare function priorBuildOutcome(history: TestOutcomeHistory, currentBuildOrdinal: number): TestOutcomeEntry | undefined;
 interface FailureRecurrence {
     /** Failed entries with buildOrdinal AT OR BELOW current — includes the current failure when recorded. */
@@ -1959,25 +1058,9 @@ interface FailureRecurrence {
     /** Distinct buildOrdinals observed in lastOutcomes — honest about the ≤LAST_OUTCOMES_LIMIT window. */
     windowBuilds: number;
 }
-/**
- * Feeds "Kth failure in the last N builds", computed LIVE at render time (D-08) — counts
- * derived from the window on every call, never stored prose. 390 rebinds the same seam to
- * its fingerprint-window computation; this derivation is 389's binding, not the seam's
- * final owner. An empty history answers {kth: 0, windowBuilds: 0}: the renderer (plan 05)
- * turns zero-history into an explicit no-history clause, so absence stays typed.
- */
 declare function failureRecurrence(history: TestOutcomeHistory, currentBuildOrdinal: number): FailureRecurrence;
 
-/**
- * PROVISIONAL D-13 superseded-generation retention depth. M3 may calibrate the
- * value against gate receipts, but it remains an internal constitution value
- * and never a runtime config key.
- */
 declare const GC_SUPERSEDED_RETAIN_K = 3;
-/**
- * D-13 gate seam. M2 always passes `{ kind: 'none' }`; M3 plugs real gate
- * receipt ordinals into the second variant with zero shape change.
- */
 type GateHorizon = {
     kind: 'none';
 } | {
@@ -2002,26 +1085,8 @@ interface RunKnowledgeGcHooks {
     /** Test/chaos seam immediately before the authority check for one planned removal. */
     beforeGcRemoval?(recordId: RecordId): void;
 }
-/**
- * Trim only whole superseded bundle directories after constructing every D-13
- * exclusion set. No projection SQL exists here by design: the drain tail feeds
- * trimmedRecordIds straight into removeBundleProjectionRows, so the disposable
- * index heals in the same drain (WR-01).
- *
- * RATIFICATION: this typed in-memory summary, surfaced through drain diagnostics,
- * is the low-cost §9.2-style operational note. GC writes no persisted note artifact.
- */
 declare function runKnowledgeGc(input: RunKnowledgeGcInput, writerAuthority: WriterLeaseAuthority, hooks?: RunKnowledgeGcHooks): GcSummary;
 
-/**
- * D-19 active-profile migration over the derived index.
- *
- * M2 keeps this library-only: Phase 378's drainer binds it to runtime
- * coordination, while Phase 382 owns any eventual CLI cutover surface. Rows
- * projected after the frozen snapshot take the benign lag direction: the flip
- * marks them pending so 375's unchanged backfill selector heals them.
- */
-
 type MigrationOutcome = {
     flipped: true;
     profileKey: string;
@@ -2091,40 +1156,8 @@ declare function createNativeEmbedder(options: {
 }): Promise<EmbedderPort>;
 
 declare const MODEL_CACHE_DIR_ENV_VAR = "AGENT_QA_MODEL_CACHE_DIR";
-/**
- * Resolve the shared model cache used by every native embedder acquisition.
- *
- * D-11: one download per machine across all projects, with artifacts identified
- * by (model_id, revision). An explicit agent-qa override wins, then the XDG
- * cache root, with the conventional home cache as the final fallback.
- */
 declare function resolveModelCacheDir(): string;
 
-/**
- * The embedder worker's half of the one process-identity vocabulary in this package.
- *
- * This is a separate module from `worker-registration.ts` on purpose. Registration reading and
- * socket probing are reachable from the read-only serving entry, and `reader-import-closure`
- * forbids that closure from crossing into `lease/`. The *signal decision* is a writer-side concern
- * that the reader never makes, so it lives here — which lets both kill paths in this package share
- * CR-04's single `resolveProcessIncarnation` definition instead of growing a second, subtly
- * different identity scheme.
- */
-
-/**
- * Compare the registration's recorded incarnation against the pid's CURRENT occupant.
- *
- * CR-05: a schema-valid registration naming a live pid whose socket has stopped answering is not
- * proof that the worker is still there. Once the worker died, the kernel is free to hand its pid to
- * a stranger, and every decision keyed on that number alone targets whoever holds it now. The one
- * fact that separates them is assigned by the OS and cannot be forged from inside the file: when
- * the process at that pid started.
- *
- * `mismatch` means the registered worker is provably gone; `unverifiable` means we cannot say, and
- * that is a refusal rather than a default-allow. Neither may be signalled — and neither needs to
- * be, because generation-specific sockets (Plan 24) let a fresh worker take a clean address without
- * the old pid ever being touched.
- */
 declare function verifyEmbedderWorkerIncarnation(registration: EmbedderWorkerRegistration): EmbedderWorkerIncarnationVerdict;
 
 declare const CURATION_QUEUE_SCHEMA_VERSION = 2;
@@ -2400,7 +1433,7 @@ declare function buildCurationCandidateAddressFields(input: BuildCurationCandida
  */
 declare function candidateContentAddress(fields: CurationCandidateAddressFields): string;
 
-/** Gitignored durable curation transport root; provisional until M2 field evidence retunes it. */
+/** Gitignored durable curation transport root. */
 declare const QUEUE_DIR = "memory/queue";
 /** Pending candidates visible to a drainer. */
 declare const QUEUED_SUBDIR = "queued";
@@ -2678,11 +1711,6 @@ type NeighborRecord = NeighborRecordBase & ({
     kind: 'fact';
     subtype: FactSubtype;
 } | NonFactNeighborRecord);
-/**
- * One authored outcome may carry multiple deltas (D-02): a procedure-extraction job can yield
- * whole-flow AND sub-flow candidates from one trajectory. Fact/caution authoring produces a
- * one-element array. The array is never empty.
- */
 type AuthorOutcome = {
     kind: 'authored';
     deltas: Delta[];
@@ -2693,33 +1721,13 @@ type AuthorOutcome = {
 };
 /** Provider-neutral author seam injected by the CLI composition root. */
 type CuratorAuthor = (job: CurationJobView, neighbors: NeighborRecord[]) => Promise<AuthorOutcome>;
-/**
- * Caller-owned disposition authority. Phase 379 may extend this profile with its deterministic
- * born-active drift-supersede carve-out without changing the author or checkpoint contracts.
- */
 interface DispositionProfile {
     mode: 'drain-to-active' | 'propose-only';
 }
-/**
- * Resolve automatic curation authority from the run's already-captured execution context.
- * Local work applies directly (432 D-08); CI and cloud stay proposed for the rolling-PR flow.
- */
 declare function resolveDispositionProfile(executionContext: ExecutionContext): DispositionProfile;
 type CheckpointBundleDraft = BundleDraft & {
     needsEnrichment?: true;
 };
-/**
- * The SHARED structural boundary for a checkpoint. Neighbor membership and CAS freshness are
- * deliberately disposition checks, so this schema validates structure without applying them.
- * D-02: the checkpoint carries the authored outcome's FULL delta array — one durable authoring
- * checkpoint per job, disposed delta-by-delta through the commit boundary.
- *
- * Deliberately origin-WIDE, and that is not an oversight — see
- * `AUTHORED_CHECKPOINT_ORIGIN_ADMISSION` below. `AuthoredCheckpoint`'s inferred delta type is
- * the type every in-process checkpoint carries, including the user-origin deltas the review
- * verbs commit and the system-origin deltas rollback and the canary commit. Origin admission is
- * a property of the DRAIN's parse boundary, not of the checkpoint shape.
- */
 declare const authoredCheckpointSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<2>;
     deltas: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -2826,11 +1834,6 @@ type AuthoredCheckpoint = z.infer<typeof authoredCheckpointSchema>;
  * the autonomy floor would then let tombstone standing knowledge.
  */
 declare function parseAuthoredCheckpoint(value: unknown): AuthoredCheckpoint;
-/**
- * The per-delta commit unit sliced from a widened checkpoint. `commitCurationDelta` remains
- * the ONE serialized mutation boundary and disposes exactly one delta per call; the drain
- * slices the checkpoint and disposes each delta independently (D-02).
- */
 interface AuthoredDeltaCheckpoint {
     schemaVersion: typeof AUTHORED_CHECKPOINT_SCHEMA_VERSION;
     delta: AuthoredCheckpoint['deltas'][number];
@@ -2854,13 +1857,8 @@ interface CanonicalBundleSnapshot {
     curationJobId?: string;
 }
 
-/** Provisional §7.3.1 cap. Phase 379 may retune it only through an explicit constant edit. */
 declare const BLAST_RADIUS_MAX_SUPERSEDES_PER_ANCHOR_PER_DRAIN = 1;
 
-/**
- * 381-03 (PROC-01 D-02/D-03): the verified queue evidence the procedure-extraction wall
- * validates against. It is code-derived queue truth — distilled observations — never LLM text.
- */
 interface ProcedureDispositionEvidence {
     distilledObservations: readonly DistilledObservation[];
 }
@@ -2881,7 +1879,7 @@ interface RelationIntent {
 }
 interface DispositionDrainState {
     supersedesSeenByAnchorKey: Map<string, number>;
-    /** 379 Open Question 3: one canonical O(store) scan, lazily cached per drain. */
+    /** One canonical O(store) scan, lazily cached per drain. */
     canonicalBundles?: CanonicalBundleSnapshot[];
     /** Test-only observability seam for proving the canonical scan runs once. */
     onCanonicalBundleScan?: () => void;
@@ -2918,7 +1916,6 @@ interface DisposeDeltaInput {
     checkpoint: AuthoredDeltaCheckpoint;
     profile: DispositionProfile;
     knowledgeRoot: string;
-    priors?: TrustPriorTable;
     /**
      * Verified queue evidence needed for anchor and new-ordinal checks. Optional only for the
      * non-mutating delta shapes; Add and Supersede fail closed when it is absent.
@@ -2958,47 +1955,8 @@ type DispositionOutcome = {
     kind: 'noop';
     reason: string;
 };
-/**
- * Every way `checkCitedIdIntegrity` can decide this store cannot stand behind a cited id.
- *
- * The registry exists so the count stops being something a comment or a corpus has to keep in
- * step. Round 2 measured what happens when it is not one: the check's second return is a
- * three-way disjunction, the corpus and the doc comment both said "three conditions", and
- * carving `scope-mismatch` out of the refusal for every origin left 3 files / 70 tests green.
- * A fifth member added here is a compile error at `citedIdIntegrityFailure`'s derivation and at
- * the corpus's `satisfies Record<CitedIdIntegrityCondition, …>` fixture table.
- */
 declare const CITED_ID_INTEGRITY_CONDITIONS: readonly ["not-a-persisted-neighbor", "missing-from-disk", "deprecated", "scope-mismatch"];
 type CitedIdIntegrityCondition = (typeof CITED_ID_INTEGRITY_CONDITIONS)[number];
-/**
- * The typed refusal a USER-authored delta receives when its cited-id integrity check fails.
- *
- * Thrown rather than returned, and out of the check funnel rather than out of the commit, so it
- * fires before any canonical byte moves for this delta: `disposeDelta` runs `checkCitedIdIntegrity`
- * first of the six §7.3.1 checks, ahead of every append, projection and promotion.
- * `applyReview`'s `commitAndPublish` catches it, restores the proposal to pending and rethrows,
- * which is how the caller gets a typed answer instead of a receipt for work nobody did.
- *
- * WHAT MAKES "NOTHING MOVED" TRUE, and it is not this sentence. The previous version of this
- * comment asserted whole-store neutrality as free-standing prose, naming no mechanism, and the
- * round-2 verifier measured that claim FALSE: the delta had already reached disposition through
- * `knowledge-store.ts`'s bridge, which materialized a claimed curation candidate on disk before
- * `commitWithProfile` ever called into the commit, and the throw left it there for the next
- * drain's reconcile to requeue (CR-02″). Two mechanisms now establish the claim, and each of them
- * reds if it is removed:
- *
- *   1. `bridgeDelta` is WRITE-FREE (`curator/knowledge-store.ts`). It computes the candidate's
- *      address and materializes nothing, so a check that throws at any position has nothing to
- *      leave behind. Reintroducing its two write statements reds the case in (2).
- *   2. `review/__tests__/apply-review.test.ts` asserts `hashTree(knowledgeRoot)` and the tree's
- *      full entry listing — QUEUE TREE INCLUDED — are identical across a refused `accept`, with
- *      a potency control proving the digest is falsifiable over that exact root.
- *
- * The scope of the guarantee is the knowledge root. The writer lease's own fencing state
- * (`.epoch`, `.writer-authority.sqlite`) advances on acquisition regardless of what the caller
- * then does, which is why the case above holds the lease across its measurement rather than
- * excusing those two names.
- */
 declare class UserDeltaCitationIntegrityError extends Error {
     readonly recordId: RecordId;
     readonly deltaKind: Delta['kind'];
@@ -3021,14 +1979,6 @@ interface CommitCurationDependencies {
     epoch: number;
     profile: DispositionProfile;
     drainState: DispositionDrainState;
-    /** Host-resolved posture as data; absent means the v51 floor. */
-    resolvePromotionPosture?: ResolvePromotionPosture;
-    priors?: TrustPriorTable;
-    /**
-     * Multi-delta disposal (D-02): when set, terminal paths skip queue completion so the
-     * claimed candidate directory stays available for the checkpoint's remaining deltas.
-     * The drain leaves it unset on the final delta, which completes the job as before.
-     */
     deferCompletion?: true;
     hooks?: {
         /**
@@ -3064,16 +2014,9 @@ interface CommittedBundleResult {
     bundleId: RecordId;
     bundleDir: string;
     deltaKind: Delta['kind'];
-    /** D-16 exception-bucket observability; absent when the gate promotes or never runs. */
     promotionHoldReason?: PromotionGateHoldReason;
     promotionPath?: PromotionPath;
 }
-/**
- * 381-47 (F-381-45-1): WHY a delta-noop disposition had nothing to apply. `authored-noop`
- * = a capable-model author deliberately emitted a Noop delta; the `fallback-*` members
- * name WHICH author fallback defeated extraction (the §7.9 one-element procedure Noop).
- * Benign noop reasons (evidence-token dedup, disposition rejects) never carry a cause.
- */
 type EmptyDeltaCause = 'authored-noop' | 'fallback-malformed' | 'fallback-no-model' | 'fallback-token-budget' | 'fallback-model-error';
 type CommitCurationOutcome = ({
     kind: 'applied';
@@ -3102,11 +2045,9 @@ type CommitCurationOutcome = ({
 };
 interface ApplyIndexDeltaForBundleInput {
     knowledgeRoot: string;
-    priors?: TrustPriorTable;
     bundleId: string;
     product?: string;
 }
-/** Shared Plan 378-10 projection authority used by commit and journal reconciliation. */
 declare function applyIndexDeltaForBundle(input: ApplyIndexDeltaForBundleInput): void;
 /** Recovery alias deliberately delegates to the same projection unit as the live tail. */
 declare function deriveIndexRowFromBundle(input: ApplyIndexDeltaForBundleInput): void;
@@ -3146,14 +2087,6 @@ interface ReconcileReport {
 }
 declare function reconcileOnDrainStart(deps: ReconcileOnDrainStartDependencies): ReconcileReport;
 
-/**
- * CR-02 takeover barriers. Test-only seams naming the three points at which a canary flow is
- * about to make canonical state durable; production callers omit them.
- *
- * The two entry barriers fire OUTSIDE the held section, which is what lets a schedule complete a
- * real takeover there and then observe the resumed writer's refusal. `beforeIndexProjection` fires
- * INSIDE it, so its schedule observes a contender blocked behind the tail instead.
- */
 interface CanaryAuthorityHooks {
     /** Immediately before the negative arm enters its held section. */
     beforeNegativeAppend?: () => void;
@@ -3167,24 +2100,12 @@ interface CreateLocalKnowledgeStoreConfig {
     executionContext: ExecutionContext;
     /** The holder's fresh lease epoch. Defaults to a fresh disk read for composition roots. */
     epoch?: number;
-    /**
-     * The caller's real writer-lease id, paired with `epoch`.
-     *
-     * CR-02: every canonical append, promotion, and index projection this store performs carries
-     * this identity into `withCurrentWriterAuthority`, so a store constructed by someone who is not
-     * the published holder is refused at its first canonical mutation instead of laundering a
-     * fabricated id. It is required precisely so no code path can omit it and fall back to one.
-     */
     writerLeaseId: string;
     /** Port calls lack a run ordinal; callers with run context should supply it. */
     sourceBuildOrdinal?: number;
     sourceRunId?: string;
-    /** 2026-09-07, 418 D-07: queue entry identity stamped as producedBy.jobId. */
     sourceJobId?: string;
     screenStates?: readonly ScreenState[];
-    resolvePromotionPosture?: ResolvePromotionPosture;
-    /** Resolved once at construction; only neutral immutable data reaches folds and projections. */
-    resolveTrustPriors?: () => TrustPriorTable | undefined;
     onPromotionOutcome?: (report: PromotionOutcomeReport) => void;
     /** Fault-injection seam; production callers must omit it. */
     canaryAuthorityHooks?: CanaryAuthorityHooks;
@@ -3204,13 +2125,10 @@ interface PromotionOutcomeReport {
     promotionPath?: PromotionPath;
     promotionHoldReason?: PromotionGateHoldReason;
 }
-/**
- * @deprecated `recordCanaryOutcome` is implemented. The exported class remains only so code
- * compiled against the pre-380 package surface does not lose its named import.
- */
+/** @deprecated `recordCanaryOutcome` is implemented; kept so older named imports resolve. */
 declare class KnowledgeStoreNotImplementedError extends Error {
     readonly operation: 'recordCanaryOutcome';
-    constructor(operation: 'recordCanaryOutcome', _retiredOwnerPhase?: 380);
+    constructor(operation: 'recordCanaryOutcome');
 }
 type KnowledgePromotionErrorReason = PromotionGateHoldReason | 'propose-only' | 'not-found';
 /** Typed refusal for the evidence-gated promote port; callers never receive a force path. */
@@ -3223,18 +2141,11 @@ declare class KnowledgeCommitError extends Error {
     readonly outcome: CommitCurationOutcome;
     constructor(outcome: CommitCurationOutcome);
 }
-/** Typed WR-02 refusal for procedure drafts that require evidence this port cannot carry. */
 declare class KnowledgeUnsupportedDeltaError extends Error {
     readonly deltaKind: Delta['kind'];
     readonly reason: 'procedure-evidence-unsupported';
     constructor(deltaKind: Delta['kind']);
 }
-/**
- * Realizes the agent write port over the canonical mutation path. D-08 propose-only is a
- * disposition profile inside commitCurationDelta, never a second mutation path. Because the port
- * carries bare deltas, this bridge materializes the smallest queue/checkpoint envelope and resolves
- * cited neighbor truth from canonical bundles before entering disposition.
- */
 declare function createLocalKnowledgeStore(config: CreateLocalKnowledgeStoreConfig): KnowledgePort;
 
 type MaintenanceSkipReason = 'lease-held' | 'budget-exhausted' | 'aborted' | 'daemon-cadence';
@@ -3259,7 +2170,6 @@ type GcPassReport = {
 } | {
     kind: 'completed';
     summary: GcSummary;
-    /** WR-01: projection rows removed by the same-tail scoped cleanup; absent on zero-trim. */
     projectionRowsRemoved?: number;
 } | {
     kind: 'failed';
@@ -3281,8 +2191,6 @@ interface MaintenanceBudget {
 }
 interface RunMaintenanceTailOptions {
     knowledgeRoot: string;
-    /** Same host-resolved data supplied to drains and review stores. */
-    priors?: TrustPriorTable;
     lease: {
         leaseId: string;
         epoch: number;
@@ -3313,11 +2221,10 @@ interface MaintenanceTailResult {
  */
 declare function runMaintenanceTail(options: RunMaintenanceTailOptions): Promise<MaintenanceTailResult>;
 
-/** Ratified M2 one-shot budget. A run's tail aborts an author request in flight at its end. */
+/** One-shot budget; a run's tail aborts an author request in flight at its end. */
 declare const DRAIN_BUDGET_MS = 60000;
 /** Provisional §7.4 cap over distinct search-before-create query targets. */
 declare const SEARCH_BEFORE_CREATE_MAX_QUERIES = 5;
-/** Provisional 376 D-14 per-job breaker before a vector-deferred commit is forced. */
 declare const EMBED_CRASH_VECTORLESS_THRESHOLD = 2;
 type DrainFailureStage = 'lease' | 'reconcile' | 'claim' | 'heartbeat' | 'job-state' | 'search' | 'author' | 'checkpoint' | 'commit' | 'quarantine' | 'requeue' | 'release' | 'writer-pass' | 'gc';
 interface DrainFailure {
@@ -3325,18 +2232,9 @@ interface DrainFailure {
     message: string;
     candidateId?: string;
 }
-/**
- * A commit that decided there was nothing to apply. Legitimate reasons exist (evidence-token
- * dedup), so a noop is never a failure — but dropping it on the floor made live procedure
- * extraction die silently for 13 UAT runs (G-381-1). Visibility, never a gate.
- */
 interface DrainNoop {
     candidateId: string;
     reason: string;
-    /**
-     * 381-47: present only on delta-noop entries — distinguishes a defeated extraction
-     * (`fallback-*`) from a deliberate authored Noop; benign dedup carries no cause.
-     */
     emptyDeltaCause?: EmptyDeltaCause;
 }
 interface DrainPromotionOutcome {
@@ -3357,16 +2255,6 @@ interface DrainReportBase {
     jobsProcessed: number;
     committed: number;
     evidenceCommitted?: number;
-    /**
-     * Committed deltas whose kind was `Deprecate` (388-02).
-     *
-     * OPTIONAL because the drain report is constructed by fault-injection fakes across four
-     * packages and a required field would make every one of them a compile error over a number
-     * they have no opinion about. The real drain always sets it, so a production report saying
-     * `deprecated: 0` is a measurement rather than an absence — which is what the post-run
-     * chain's notification (D-11) needs in order to tell a drain that deprecated nothing apart
-     * from a drain that never ran at all.
-     */
     deprecated?: number;
     /** Optional for fault-injection fakes; the real drain always sets this measurement. */
     promotions?: readonly DrainPromotionOutcome[];
@@ -3424,7 +2312,6 @@ interface DrainOperations extends MaintenanceOperations {
     hasIndexRow(knowledgeRoot: string, bundleId: string): boolean;
     applyIndexDeltaForBundle: typeof applyIndexDeltaForBundle;
     deriveIndexRowFromBundle: typeof deriveIndexRowFromBundle;
-    /** CR-02 takeover barriers for the canary branch; production omits them. */
     canaryAuthorityHooks?: CanaryAuthorityHooks;
 }
 interface DrainOptions {
@@ -3443,16 +2330,11 @@ interface DrainOptions {
     executionContext: ExecutionContext;
     /** Host-resolved posture; daemon sessions pass worker-required capability here. */
     embeddingCapability?: AcquireEmbedderOutcome;
-    /** Built once per drain on the host; synchronous per candidate inside the gate. */
-    resolvePromotionPosture?: ResolvePromotionPosture;
-    /** Already-resolved host snapshot; the host retains this data across queue retries. */
-    priors?: TrustPriorTable;
     /** Default inline preserves one-shot behavior; daemon sessions skip for their own cadence. */
     maintenance?: 'inline' | 'skip';
     signal?: AbortSignal;
     /** Synchronous durable-boundary observer; daemon hosts append these facts before proceeding. */
     onJobLifecycle?: (event: CurationDrainLifecycleEvent) => void;
-    /** D-06 test seam. Production uses the one wall clock only at drain boundaries. */
     now?: () => number;
     /** Fault-injection seam; production callers must omit it. */
     operations?: Partial<DrainOperations>;
@@ -3519,7 +2401,6 @@ interface PurgeAffectedSet {
 interface PurgeRecordInput {
     knowledgeRoot: string;
     recordId: RecordId;
-    /** Caller-owned sovereign identity; Phase 382 supplies the confirmed user identity. */
     initiator: string;
     /** Runtime-counter reservation used for a fresh destruction receipt; resumes reuse intent. */
     purgedAtOrdinal?: number;
@@ -3582,19 +2463,6 @@ declare function resolvePurgeAffectedSet(input: {
     recordId: RecordId;
 }): PurgeAffectedSet;
 declare function purgeAffectedSetFingerprint(affectedSet: PurgeAffectedSet): string;
-/**
- * Hard-remove one confirmed-sensitive record from every recoverable local-store surface.
- *
- * Recovery invariant (CR-04): nothing irreversible ever precedes a durable intent, so a retry
- * either re-resolves intact state (crash before the intent) or replays the intent's persisted
- * identities to the identical completion receipt (crash at any later boundary).
- *
- * Revival ratification (SC-4/DCAY-05, option a): bundle ids are deterministic content addresses,
- * so purged-then-re-learned content re-mints the SAME record id. Receipt-exists-but-live-surfaces
- * therefore runs a FRESH destruction cycle publishing the next append-only versioned receipt in
- * the series; original audit receipts are never rewritten, and already-purged is attested only
- * over verified-dead surfaces (live resolution always precedes any receipt-based attestation).
- */
 declare function purgeRecord(input: PurgeRecordInput): PurgeRecordOutcome;
 
 /**
@@ -3614,7 +2482,7 @@ declare function purgeRecord(input: PurgeRecordInput): PurgeRecordOutcome;
  * fact is recorded, and the receipt widens with it.
  */
 declare const FORGET_SCRUBBED_PROJECTIONS: readonly KnowledgeProjection[];
-/** Resolves a `MEM-` short-ID to the machine id it addresses, or `undefined` (D-01/D-04). */
+/** Resolves a `MEM-` short-ID to the machine id it addresses, or `undefined`. */
 type ResolveBundleShortId = (shortId: string) => string | undefined;
 /** A validated mark, accept, reject or forget, in the shape the review verbs take. */
 interface ReviewChangeRequest {
@@ -3626,15 +2494,6 @@ declare class MarkPlanIntegrityError extends Error {
     constructor(recordId: string);
 }
 
-/**
- * How long a delegating process waits for the leaseholder to finish an apply (D-18).
- *
- * PINNED, not configured, on the `LEASE_HEARTBEAT_TTL_MS` idiom. 30s is chosen as "longer than any
- * commit this store performs, shorter than a person's patience": a commit is a handful of file
- * appends plus one bundle re-projection, all local. RETUNE from an observed apply that legitimately
- * exceeded it — never from a flaky test, which is a symptom of a wedged holder rather than a slow
- * one, and the wedged holder is exactly what this bound exists to refuse rather than wait out.
- */
 declare const APPLY_DELEGATE_TIMEOUT_MS = 30000;
 /** The typed refusal a bounded wait produces. Never a generic timeout, never a takeover. */
 declare class ApplyDelegateTimeoutError extends Error {
@@ -3664,12 +2523,6 @@ interface ExplicitReviewDelegation {
     readonly request: ExplicitReviewRequest;
     readonly operationId: string;
 }
-/**
- * Hand the direct request to the leaseholder and wait bounded for its answer (D-18). Injected as
- * an optional operation rather than built here: `knowledge-local` neither knows nor may know that a
- * unix socket exists. A host supplies its transport; the leaseholder's own composition supplies
- * nothing, which makes delegation recursion impossible by construction.
- */
 type ExplicitReviewDelegate = (delegation: ExplicitReviewDelegation) => Promise<ExplicitReviewResult>;
 interface ApplyExplicitReviewInput {
     readonly agentQaRoot: string;
@@ -3687,8 +2540,6 @@ interface ApplyExplicitReviewInput {
     readonly resolveBundleShortId?: ResolveBundleShortId;
     readonly delegate?: ExplicitReviewDelegate;
     readonly writerAuthority?: WriterAuthority;
-    readonly resolvePromotionPosture?: ResolvePromotionPosture;
-    readonly resolveTrustPriors?: () => TrustPriorTable | undefined;
     readonly now?: () => number;
     readonly delegateTimeoutMs?: number;
 }
@@ -3710,13 +2561,6 @@ type ExplicitReviewResult = {
     readonly verb: KnowledgeReviewVerb;
     readonly changeId: string;
 };
-/**
- * Apply an explicit knowledge change in the call (432-06, D-04/D-05/D-09/D-11).
- *
- * No envelope is written, claimed or reloaded. A holder commits with its own authority, a free lease is acquired and released, and a live holder is
- * handed the same validated request and identity, bounded, and is never stolen from. Retrying
- * the same `operationId` lands nothing twice and answers the same record ids.
- */
 declare function applyExplicitReview(input: ApplyExplicitReviewInput): Promise<ExplicitReviewResult>;
 
 /** The one directory name receipts live under, beneath the agent-qa runtime root. */
@@ -3827,12 +2671,6 @@ interface RollbackCampaignInput extends RollbackBaseInput {
     originClass?: OriginClass;
 }
 type ResolveRollbackAffectedSetInput = RollbackCurationJobInput | RollbackCampaignInput;
-/**
- * CR-02: a rollback must never attest success at a resolution ordinal that is powerless to
- * change lifecycle status. At equal buildOrdinal the trust fold's fixed STATUS_PRECEDENCE keeps
- * active above deprecated, and an older event can never replace a newer status, so a
- * non-strictly-later resolvedAtOrdinal cannot causally invert a minted bundle.
- */
 declare class RollbackCausalityError extends Error {
     readonly offendingRecordIds: RecordId[];
     readonly minimumRequiredOrdinal: number;
@@ -3854,10 +2692,6 @@ declare function rollbackCurationJob(input: RollbackCurationJobInput): RollbackR
 /** Resolve and append the inverse map for an AND-composed provenance campaign. */
 declare function rollbackCampaign(input: RollbackCampaignInput): RollbackReport;
 
-/**
- * 378-17 canonical mutable-target order, additively extended by 379 D-03:
- * record, provenance, outcomes, measurements, relations, then manifest.
- */
 declare const MUTABLE_BUNDLE_TARGETS: readonly ["record.md", "provenance.json", "evidence/outcomes.jsonl", "evidence/measurements.json", "evidence/gates.jsonl", "relations.json", "manifest.json"];
 
 type MarkTriage = {
@@ -3969,15 +2803,9 @@ type MaterializeOutcome = {
     relPath: string;
     sectionBytes: number;
 };
-/**
- * The authored shelf is append-only under the caller's writer lease. An existing section ID
- * always wins, including when its human-edited body differs. Never rewrite that body.
- * commitArtifacts governs binary bundle artifacts, not policy text or git commits.
- * The authored text is written as given; no detector scans it (Phase 441, D-15).
- */
 declare function materializePolicy(input: MaterializePolicyInput): MaterializeOutcome;
 
 type LocalKnowledgeStore = KnowledgePort;
 type LocalKnowledgeReader = KnowledgeHintReader;
 
-export { ADDRESSING_LEDGER_BUSY_TIMEOUT_MS, ADDRESSING_LEDGER_DB_FILE, ADDRESSING_LEDGER_USER_VERSION, APPLY_DELEGATE_TIMEOUT_MS, ARTIFACT_RUN_CAP_BYTES, ARTIFACT_STEP_CAP_BYTES, AUTHORED_CHECKPOINT_SCHEMA_VERSION, type AcquireEmbedderOptions, type AcquireEmbedderOutcome, type AcquireWriterLeaseOptions, type AcquireWriterLeaseOutcome, type AddressingLedger, AddressingLedgerSchemaVersionError, type AppendMarkEvidenceInput, AppendMarkEvidenceOutcome, type AppendOutcome, ApplyDelegateTimeoutError, ApplyDelegateUnavailableError, type ApplyExplicitReviewInput, type ApplyFeedbackInput, type ApplyIndexDeltaForBundleInput, type ApplyRunOutcomesResult, type ArtifactCopyInput, type ArtifactCopyResult, type AuthorOutcome, type AuthoredCheckpoint, type AuthoredDeltaCheckpoint, BLAST_RADIUS_MAX_SUPERSEDES_PER_ANCHOR_PER_DRAIN, type BuildCurationCandidateAddressFieldsInput, type BundleProvenanceInput, type BundleStoreConfig, CHANNEL_1_SERVING_LEG, CHANNEL_3_CAUTION_LEG, CITED_ID_INTEGRITY_CONDITIONS, CLAIMED_SUBDIR, COMMIT_INTENT_SCHEMA_VERSION, CURATION_JOB_STATE_SCHEMA_VERSION, CURATION_QUEUE_SCHEMA_VERSION, type CanonicalBundleStateDigests, type CitedIdIntegrityCondition, type ClaimNextJobOptions, type ClaimNextJobOutcome, type ClaimedCurationJob, type CommitCurationDependencies, type CommitCurationJob, type CommitCurationOutcome, type CopiedArtifact, CorruptEpochStateError, type CorruptEpochStateReason, type CountRemainingCurationWorkOptions, type CreateLocalKnowledgeStoreConfig, type CurationArtifactDescriptor, type CurationArtifactRole, type CurationCandidateAddressFields, type CurationCandidateArtifact, type CurationCandidatePayload, type CurationCandidateProjection, type CurationDrainLifecycleEvent, type CurationEnqueueRefusalReason, type CurationJobLifecycle, type CurationJobState, type CurationJobView, type CurationProjectionArtifactSource, type CurationQuarantineReason, type CurationRemainingWork, type CuratorAuthor, type CurrentWriterAuthority, type CurrentWriterAuthorityHooks, DRAFT_RECEIPTS_DIR_NAME, DRAIN_BUDGET_MS, type DeferReason, type DiscoverEmbedderWorkerOptions, type DisposeDeltaInput, type DispositionCandidateContext, type DispositionDrainState, type DispositionOutcome, type DispositionProfile, DraftReceiptDigestError, DraftReceiptSchemaVersionError, type DraftReceiptsStore, type DraftReceiptsStoreOptions, type DrainFailure, type DrainFailureStage, type DrainNoop, type DrainOptions, type DrainPromotionOutcome, type DrainReport, type DrainableCurationWork, EMBED_CRASH_VECTORLESS_THRESHOLD, ENTITY_INDEX_DB_FILE, ENTITY_INDEX_SWEEP_INTERVAL_MS, ENTITY_INDEX_USER_VERSION, EPOCH_FILE, type EmbedCacheLeg, type EmbedCacheLookup, type EmbedCacheMode, type EmbedCachePut, type EmbedCacheWrapperOptions, type EmbedderAxis, EmbedderPort, type EmbedderProbes, type EmbedderRung, EmbedderWorkerIncarnationVerdict, type EmbedderWorkerPolicy, EmbedderWorkerRegistration, type EmptyDeltaCause, type EnqueueCurationCandidateProjectionOptions, type EnqueueCurationCandidateProjectionOutcome, type EntityAddress, type EntityIndexHandle, EntityIndexSchemaVersionError, type EntityIndexSweepReport, type EntitySighting, type EntitySightingSource, type ExplicitReviewDelegate, type ExplicitReviewDelegation, type ExplicitReviewRequest, type ExplicitReviewResult, type ExtractStepAnchors, FORGET_SCRUBBED_PROJECTIONS, type FailureRecurrence, type FingerprintRecurrence, type FingerprintWindowIdentity, type FingerprintWindowRow, type FixSelection, FloorAssetLoadError, type FloorAssetLoadErrorCode, type FloorAssetLoadOptions, type FloorAssets, FloorEmbeddingError, type FloorEmbeddingErrorCode, type FloorProseInput, type FoldRunOutcomesOptions, type FoldRunOutcomesReport, type FoldSuiteFingerprintsOptions, GC_SUPERSEDED_RETAIN_K, type GateHorizon, type GcPassReport, type GcSummary, type HeartbeatLeaseOutcome, type IndexAxis, IndexFace, IndexReaderConnection, type InspectDrainableCurationWorkOptions, JOBS_SUBDIR, KnowledgeCommitError, KnowledgePromotionError, type KnowledgePromotionErrorReason, KnowledgeReader, KnowledgeStoreNotImplementedError, KnowledgeUnsupportedDeltaError, LAST_OUTCOMES_LIMIT, LEASE_FILE, LEASE_GUARD_DIR, LEASE_HEARTBEAT_TTL_MS, type LeaseOperationOptions, LoadedBundle, type LocalKnowledgeReader, type LocalKnowledgeStore, MEASUREMENTS_REL_PATH, MODEL_CACHE_DIR_ENV_VAR, MUTABLE_BUNDLE_TARGETS, MUTATION_LOCK_BUSY_TIMEOUT_MS, MUTATION_LOCK_TAKEOVER_MS, type MaintenanceBudget, type MaintenanceOperations, type MaintenanceSkipReason, type MaintenanceTailFailure, type MaintenanceTailResult, type MalformedClaimedCurationJob, MarkPlanIntegrityError, type MarkTriage, type MaterializeOutcome, type MaterializePolicyInput, type MigrationOutcome, NativeEmbeddingDimensionError, NativeEmbeddingModuleLoadError, type NeighborRecord, type OpenAddressingLedgerOptions, type OpenEntityIndexOptions, PAYLOAD_BENEFITS, PAYLOAD_STATE_VALIDITIES, PURGE_RECEIPT_SCHEMA_VERSION, type PersistAuthoredCheckpointOptions, type PersistAuthoredCheckpointOutcome, PolicyTextRefusedError, type ProcedureDispositionEvidence, type ProjectRunOutcomesOptions, type PromotionOutcomeReport, type PublishBundleInput, type PublishBundleOutcome, type PurgeAffectedSet, PurgeChronologyRequiredError, PurgeCompletionVerificationError, PurgeQueueIdentityError, type PurgeReceipt, PurgeReceiptSchema, type PurgeRecordInput, type PurgeRecordOutcome, PurgeTargetChangedError, PurgeTargetIntegrityError, QUARANTINE_MANUAL_ENTRY_CLASS, QUARANTINE_MANUAL_ENTRY_FINGERPRINT, QUARANTINE_WINDOW_ORDINALS, QUEUED_SUBDIR, QUEUE_DIR, QUEUE_MAX_EMITS_PER_RUN, QUEUE_MAX_JOBS_PER_SCOPE, QuarantineAppendOutcome, type QuarantineClaimedOptions, type QuarantineDetectionOptions, QuarantineDetectionSighting, type QuarantineFoldOutcome, QuarantineIdentityRefusedError, type QuarantineOperationsOptions, type QueuedCanaryPayloadRead, RESOLVER_CANDIDATE_K, RESOLVER_FUSED_SCORE_NORMALIZER, RESOLVER_LEG_WEIGHT_DENSE, RESOLVER_LEG_WEIGHT_LEXICAL, RESOLVER_LEXICAL_MIN_BM25, RESOLVER_STRONG_HIT_MARGIN, RESOLVER_STRONG_HIT_MIN_SCORE, RUN_OUTCOMES_PROJECTION_VERSION, type ReadCurationCandidatePayloadOutcome, type ReadCurationEffectsOptions, type ReadJobStateOutcome, type ReadWriterLeaseOutcome, type RebuildIndexHooks, type RebuildIndexOptions, type RebuildMutationFamily, type RebuildReport, RebuildRequest, type RebuildRunOutcomesOptions, type RebuildRunOutcomesReport, type ReconcileRunOutcomesProjectionOptions, type ReconcileRunOutcomesProjectionResult, RefusedQuarantineLine, type RelationIntent, type ReleaseLeaseOutcome, type RenderBundlePartsInput, type RenderedBundlePart, type RequeueClaimedOptions, type ResolveBundleShortId, type ResolveEmbedderCapabilityOptions, type ResolveEntityRefDeps, type ResolveRetrievalRungOptions, type ResolveRollbackAffectedSetInput, type RetrievalQuery, type RetrievalQueryInput, type RetrieveOptions, type RetrieveResult, type ReviewChangeRequest, ReviewTargetVanishedError, type RollbackAffectedSet, type RollbackCampaignInput, RollbackCausalityError, type RollbackCounterEvent, type RollbackCurationJobInput, type RollbackKind, RollbackPlanChangedError, type RollbackPlannedEffect, type RollbackReport, type RunKnowledgeGcHooks, type RunKnowledgeGcInput, type RunMaintenanceTailOptions, type RunOutcomeFailureKey, type RunOutcomeTestDelta, type RunOutcomesProjection, SEARCH_BEFORE_CREATE_MAX_QUERIES, SERVING_TRACE_LEGS, SUITE_FINGERPRINTS_TABLE, type ServedRecordFacts, type SetActiveEmbeddingProfileOptions, type SkippedArtifact, type SuiteFingerprintIndex, type SuiteFingerprintIndexOptions, type SuiteFingerprintTestDelta, type SuiteFingerprintsProjection, type TargetRename, type TestOutcomeEntry, type TestOutcomeHistory, type TestOutcomeIdentity, type UnreclaimableMutationLockOwner, UserDeltaCitationIntegrityError, VecCapability, WRITER_AUTHORITY_DB_FILE, type WorkerDiscoveryResult, type WriteJobStateOptions, WriterAuthorityLostError, type WriterAuthorityLostReason, type WriterLease, type WriterLeaseAuthority, type WriterLeaseFreshness, type WriterPassReport, acquireEmbedder, acquireWriterLease, appendGateReceipt, appendMarkEvidence, appendMeasurementObservation, appendOutcomeEvent, appendPromotionReceipt, appendRelation, applyExplicitReview, applyFeedback, applyIndexDeltaForBundle, applyRunOutcomes, applySuiteFingerprints, assertionDrift, authoredCheckpointSchema, buildCurationCandidateAddressFields, buildRetrievalQuery, candidateContentAddress, claimNextJob, claimedCandidateDir, claimedLeaseDir, claimedRoot, commitCurationDelta, copyArtifacts, countPendingCurationJobs, countRemainingCurationWork, createDraftReceiptsStore, createFloorEmbedder, createLocalKnowledgeStore, createMemorySightingSource, createNativeEmbedder, createQuarantineOperations, createSuiteFingerprintIndex, curationArtifactDescriptorSchema, curationArtifactRoleSchema, curationCandidatePayloadSchema, curationCandidateProjectionSchema, curationJobStateSchema, deriveIndexRowFromBundle, deriveWriterLeaseFreshness, describeAllEntities, discoverEmbedderWorker, disposeDelta, draftReceiptsDir, drainQueue, dropEmbedCacheForModel, embedPendingEntities, enqueueCurationCandidate, enqueueCurationCandidateProjection, ensureEmbedCacheTable, entityIndexDbPath, failureRecurrence, fingerprintRecurrence, floorProse, foldCurationSnapshot, foldRetrievalRung, foldRunOutcomes, foldSuiteFingerprints, getCachedEmbedding, getEntityDescriptor, guardPurgeReceipt, heartbeatLease, inspectDrainableCurationWork, isLeaseStale, jobStatePath, jobsRoot, listClaimedLeases, listQueuedCandidates, listTestsInFile, loadFloorAssets, materializePolicy, openAddressingLedger, openEntityIndex, parseAuthoredCheckpoint, persistAuthoredCheckpoint, policySectionMarkers, policyShelfPath, priorBuildOutcome, procedureReadOn, projectRunOutcomes, publishBundle as publishBundleForTest, purgeAffectedSetFingerprint, purgeReceiptSchema, purgeRecord, putCachedEmbedding, quarantineClaimed, queueRoot, queueStagingRoot, queuedCandidateDir, queuedRoot, readCanonicalBundleStateDigests, readCurationCandidatePayload, readCurationEffects, readFingerprintWindow, readJobState, readLatestBuildOrdinal, readQueuedCanaryPayload, readRebuildRequest, readTestOutcomeHistory, readWriterLease, rebuildEntityIndex, rebuildIndex, rebuildRunOutcomes, reconcileRunOutcomesProjection, refreshEntity, refreshWriterLeaseAuthority, releaseLease, renderBundleParts, requeueClaimed, resetEmbedderCapability, resolveDispositionProfile, resolveEmbedderCapability, resolveEntityRef, resolveModelCacheDir, resolveProcessIncarnation, resolvePurgeAffectedSet, resolveRetrievalRung, resolveRollbackAffectedSet, retrieve, rollbackAffectedSetFingerprint, rollbackCampaign, rollbackCurationJob, rollbackReceiptId, runKnowledgeGc, runMaintenanceTail, selectFixKind, servedIdsOn, setActiveEmbeddingProfile, sightEntity, sliceAuthoredCheckpoint, suiteFingerprintDeltas, sweepEntityIndex, triageMark, verifyEmbedderWorkerIncarnation, widenAuthoredDeltaCheckpoint, withCurrentWriterAuthority, wrapEmbedderWithCache, writeJobState, writeMeasurementBaseline };
+export { ADDRESSING_LEDGER_BUSY_TIMEOUT_MS, ADDRESSING_LEDGER_DB_FILE, ADDRESSING_LEDGER_USER_VERSION, APPLY_DELEGATE_TIMEOUT_MS, ARTIFACT_RUN_CAP_BYTES, ARTIFACT_STEP_CAP_BYTES, AUTHORED_CHECKPOINT_SCHEMA_VERSION, type AcquireEmbedderOptions, type AcquireEmbedderOutcome, type AcquireWriterLeaseOptions, type AcquireWriterLeaseOutcome, type AddressingLedger, AddressingLedgerSchemaVersionError, type AppendMarkEvidenceInput, AppendMarkEvidenceOutcome, type AppendOutcome, ApplyDelegateTimeoutError, ApplyDelegateUnavailableError, type ApplyExplicitReviewInput, type ApplyFeedbackInput, type ApplyIndexDeltaForBundleInput, type ApplyRunOutcomesResult, type ArtifactCopyInput, type ArtifactCopyResult, type AuthorOutcome, type AuthoredCheckpoint, type AuthoredDeltaCheckpoint, BLAST_RADIUS_MAX_SUPERSEDES_PER_ANCHOR_PER_DRAIN, type BuildCurationCandidateAddressFieldsInput, type BundleProvenanceInput, type BundleStoreConfig, CHANNEL_1_SERVING_LEG, CHANNEL_3_CAUTION_LEG, CITED_ID_INTEGRITY_CONDITIONS, CLAIMED_SUBDIR, COMMIT_INTENT_SCHEMA_VERSION, CURATION_JOB_STATE_SCHEMA_VERSION, CURATION_QUEUE_SCHEMA_VERSION, type CitedIdIntegrityCondition, type ClaimNextJobOptions, type ClaimNextJobOutcome, type ClaimedCurationJob, type CommitCurationDependencies, type CommitCurationJob, type CommitCurationOutcome, type CopiedArtifact, CorruptEpochStateError, type CorruptEpochStateReason, type CountRemainingCurationWorkOptions, type CreateLocalKnowledgeStoreConfig, type CurationArtifactDescriptor, type CurationArtifactRole, type CurationCandidateAddressFields, type CurationCandidateArtifact, type CurationCandidatePayload, type CurationCandidateProjection, type CurationDrainLifecycleEvent, type CurationEnqueueRefusalReason, type CurationJobLifecycle, type CurationJobState, type CurationJobView, type CurationProjectionArtifactSource, type CurationQuarantineReason, type CurationRemainingWork, type CuratorAuthor, type CurrentWriterAuthority, type CurrentWriterAuthorityHooks, DRAFT_RECEIPTS_DIR_NAME, DRAIN_BUDGET_MS, type DeferReason, type DiscoverEmbedderWorkerOptions, type DisposeDeltaInput, type DispositionCandidateContext, type DispositionDrainState, type DispositionOutcome, type DispositionProfile, DraftReceiptDigestError, DraftReceiptSchemaVersionError, type DraftReceiptsStore, type DraftReceiptsStoreOptions, type DrainFailure, type DrainFailureStage, type DrainNoop, type DrainOptions, type DrainPromotionOutcome, type DrainReport, type DrainableCurationWork, EMBED_CRASH_VECTORLESS_THRESHOLD, ENTITY_INDEX_DB_FILE, ENTITY_INDEX_SWEEP_INTERVAL_MS, ENTITY_INDEX_USER_VERSION, EPOCH_FILE, type EmbedCacheLeg, type EmbedCacheLookup, type EmbedCacheMode, type EmbedCachePut, type EmbedCacheWrapperOptions, type EmbedderAxis, EmbedderPort, type EmbedderProbes, type EmbedderRung, EmbedderWorkerIncarnationVerdict, type EmbedderWorkerPolicy, EmbedderWorkerRegistration, type EmptyDeltaCause, type EnqueueCurationCandidateProjectionOptions, type EnqueueCurationCandidateProjectionOutcome, type EntityAddress, type EntityIndexHandle, EntityIndexSchemaVersionError, type EntityIndexSweepReport, type EntitySighting, type EntitySightingSource, type ExplicitReviewDelegate, type ExplicitReviewDelegation, type ExplicitReviewRequest, type ExplicitReviewResult, type ExtractStepAnchors, FORGET_SCRUBBED_PROJECTIONS, type FailureRecurrence, type FingerprintRecurrence, type FingerprintWindowIdentity, type FingerprintWindowRow, type FixSelection, FloorAssetLoadError, type FloorAssetLoadErrorCode, type FloorAssetLoadOptions, type FloorAssets, FloorEmbeddingError, type FloorEmbeddingErrorCode, type FloorProseInput, type FoldRunOutcomesOptions, type FoldRunOutcomesReport, type FoldSuiteFingerprintsOptions, GC_SUPERSEDED_RETAIN_K, type GateHorizon, type GcPassReport, type GcSummary, type HeartbeatLeaseOutcome, type IndexAxis, IndexFace, IndexReaderConnection, type InspectDrainableCurationWorkOptions, JOBS_SUBDIR, KnowledgeCommitError, KnowledgePromotionError, type KnowledgePromotionErrorReason, KnowledgeReader, KnowledgeStoreNotImplementedError, KnowledgeUnsupportedDeltaError, LAST_OUTCOMES_LIMIT, LEASE_FILE, LEASE_GUARD_DIR, LEASE_HEARTBEAT_TTL_MS, type LeaseOperationOptions, LoadedBundle, type LocalKnowledgeReader, type LocalKnowledgeStore, MEASUREMENTS_REL_PATH, MODEL_CACHE_DIR_ENV_VAR, MUTABLE_BUNDLE_TARGETS, MUTATION_LOCK_BUSY_TIMEOUT_MS, MUTATION_LOCK_TAKEOVER_MS, type MaintenanceBudget, type MaintenanceOperations, type MaintenanceSkipReason, type MaintenanceTailFailure, type MaintenanceTailResult, type MalformedClaimedCurationJob, MarkPlanIntegrityError, type MarkTriage, type MaterializeOutcome, type MaterializePolicyInput, type MigrationOutcome, NativeEmbeddingDimensionError, NativeEmbeddingModuleLoadError, type NeighborRecord, type OpenAddressingLedgerOptions, type OpenEntityIndexOptions, PAYLOAD_BENEFITS, PURGE_RECEIPT_SCHEMA_VERSION, type PersistAuthoredCheckpointOptions, type PersistAuthoredCheckpointOutcome, PolicyTextRefusedError, type ProcedureDispositionEvidence, type ProjectRunOutcomesOptions, type PromotionOutcomeReport, type PublishBundleInput, type PublishBundleOutcome, type PurgeAffectedSet, PurgeChronologyRequiredError, PurgeCompletionVerificationError, PurgeQueueIdentityError, type PurgeReceipt, PurgeReceiptSchema, type PurgeRecordInput, type PurgeRecordOutcome, PurgeTargetChangedError, PurgeTargetIntegrityError, QUARANTINE_MANUAL_ENTRY_CLASS, QUARANTINE_MANUAL_ENTRY_FINGERPRINT, QUARANTINE_WINDOW_ORDINALS, QUEUED_SUBDIR, QUEUE_DIR, QUEUE_MAX_EMITS_PER_RUN, QUEUE_MAX_JOBS_PER_SCOPE, QuarantineAppendOutcome, type QuarantineClaimedOptions, type QuarantineDetectionOptions, QuarantineDetectionSighting, type QuarantineFoldOutcome, QuarantineIdentityRefusedError, type QuarantineOperationsOptions, type QueuedCanaryPayloadRead, RESOLVER_CANDIDATE_K, RESOLVER_FUSED_SCORE_NORMALIZER, RESOLVER_LEG_WEIGHT_DENSE, RESOLVER_LEG_WEIGHT_LEXICAL, RESOLVER_LEXICAL_MIN_BM25, RESOLVER_STRONG_HIT_MARGIN, RESOLVER_STRONG_HIT_MIN_SCORE, RUN_OUTCOMES_PROJECTION_VERSION, type ReadCurationCandidatePayloadOutcome, type ReadCurationEffectsOptions, type ReadJobStateOutcome, type ReadWriterLeaseOutcome, type RebuildIndexHooks, type RebuildIndexOptions, type RebuildMutationFamily, type RebuildReport, RebuildRequest, type RebuildRunOutcomesOptions, type RebuildRunOutcomesReport, type ReconcileRunOutcomesProjectionOptions, type ReconcileRunOutcomesProjectionResult, RefusedQuarantineLine, type RelationIntent, type ReleaseLeaseOutcome, type RenderBundlePartsInput, type RenderedBundlePart, type RequeueClaimedOptions, type ResolveBundleShortId, type ResolveEmbedderCapabilityOptions, type ResolveEntityRefDeps, type ResolveRetrievalRungOptions, type ResolveRollbackAffectedSetInput, type RetrievalQuery, type RetrievalQueryInput, type RetrieveOptions, type RetrieveResult, type ReviewChangeRequest, ReviewTargetVanishedError, type RollbackAffectedSet, type RollbackCampaignInput, RollbackCausalityError, type RollbackCounterEvent, type RollbackCurationJobInput, type RollbackKind, RollbackPlanChangedError, type RollbackPlannedEffect, type RollbackReport, type RunKnowledgeGcHooks, type RunKnowledgeGcInput, type RunMaintenanceTailOptions, type RunOutcomeFailureKey, type RunOutcomeTestDelta, type RunOutcomesProjection, SEARCH_BEFORE_CREATE_MAX_QUERIES, SERVING_TRACE_LEGS, SUITE_FINGERPRINTS_TABLE, type ServedRecordFacts, type SetActiveEmbeddingProfileOptions, type SkippedArtifact, type SuiteFingerprintIndex, type SuiteFingerprintIndexOptions, type SuiteFingerprintTestDelta, type SuiteFingerprintsProjection, type TargetRename, type TestOutcomeEntry, type TestOutcomeHistory, type TestOutcomeIdentity, type UnreclaimableMutationLockOwner, UserDeltaCitationIntegrityError, VecCapability, WRITER_AUTHORITY_DB_FILE, type WorkerDiscoveryResult, type WriteJobStateOptions, WriterAuthorityLostError, type WriterAuthorityLostReason, type WriterLease, type WriterLeaseAuthority, type WriterLeaseFreshness, type WriterPassReport, acquireEmbedder, acquireWriterLease, appendGateReceipt, appendMarkEvidence, appendMeasurementObservation, appendOutcomeEvent, appendPromotionReceipt, appendRelation, applyExplicitReview, applyFeedback, applyIndexDeltaForBundle, applyRunOutcomes, applySuiteFingerprints, assertionDrift, authoredCheckpointSchema, buildCurationCandidateAddressFields, buildRetrievalQuery, candidateContentAddress, claimNextJob, claimedCandidateDir, claimedLeaseDir, claimedRoot, commitCurationDelta, copyArtifacts, countPendingCurationJobs, countRemainingCurationWork, createDraftReceiptsStore, createFloorEmbedder, createLocalKnowledgeStore, createMemorySightingSource, createNativeEmbedder, createQuarantineOperations, createSuiteFingerprintIndex, curationArtifactDescriptorSchema, curationArtifactRoleSchema, curationCandidatePayloadSchema, curationCandidateProjectionSchema, curationJobStateSchema, deriveIndexRowFromBundle, deriveWriterLeaseFreshness, describeAllEntities, discoverEmbedderWorker, disposeDelta, draftReceiptsDir, drainQueue, dropEmbedCacheForModel, embedPendingEntities, enqueueCurationCandidate, enqueueCurationCandidateProjection, ensureEmbedCacheTable, entityIndexDbPath, failureRecurrence, fingerprintRecurrence, floorProse, foldCurationSnapshot, foldRetrievalRung, foldRunOutcomes, foldSuiteFingerprints, getCachedEmbedding, getEntityDescriptor, guardPurgeReceipt, heartbeatLease, inspectDrainableCurationWork, isLeaseStale, jobStatePath, jobsRoot, listClaimedLeases, listQueuedCandidates, listTestsInFile, loadFloorAssets, materializePolicy, openAddressingLedger, openEntityIndex, parseAuthoredCheckpoint, persistAuthoredCheckpoint, policySectionMarkers, policyShelfPath, priorBuildOutcome, procedureReadOn, projectRunOutcomes, publishBundle as publishBundleForTest, purgeAffectedSetFingerprint, purgeReceiptSchema, purgeRecord, putCachedEmbedding, quarantineClaimed, queueRoot, queueStagingRoot, queuedCandidateDir, queuedRoot, readCurationCandidatePayload, readCurationEffects, readFingerprintWindow, readJobState, readLatestBuildOrdinal, readQueuedCanaryPayload, readRebuildRequest, readTestOutcomeHistory, readWriterLease, rebuildEntityIndex, rebuildIndex, rebuildRunOutcomes, reconcileRunOutcomesProjection, refreshEntity, refreshWriterLeaseAuthority, releaseLease, renderBundleParts, requeueClaimed, resetEmbedderCapability, resolveDispositionProfile, resolveEmbedderCapability, resolveEntityRef, resolveModelCacheDir, resolveProcessIncarnation, resolvePurgeAffectedSet, resolveRetrievalRung, resolveRollbackAffectedSet, retrieve, rollbackAffectedSetFingerprint, rollbackCampaign, rollbackCurationJob, rollbackReceiptId, runKnowledgeGc, runMaintenanceTail, selectFixKind, servedIdsOn, setActiveEmbeddingProfile, sightEntity, sliceAuthoredCheckpoint, suiteFingerprintDeltas, sweepEntityIndex, triageMark, verifyEmbedderWorkerIncarnation, widenAuthoredDeltaCheckpoint, withCurrentWriterAuthority, wrapEmbedderWithCache, writeJobState, writeMeasurementBaseline };