nexusmem 0.8.0 → 0.9.0

package/dist/cli/index.js

@@ -2,7 +2,7 @@
 
 // src/cli/index.ts
 import { Command } from "commander";
-import pc20 from "picocolors";
+import pc21 from "picocolors";
 
 // src/config/workspace.ts
 import { existsSync } from "fs";
@@ -290,6 +290,7 @@ function crashStatus(code, signal) {
   return null;
 }
 var TRANSIENT_SPAWN_CODES = /* @__PURE__ */ new Set(["EAGAIN", "EPERM", "EACCES", "EMFILE", "ENFILE", "ENOMEM", "EBUSY", "ETXTBSY"]);
+var GIT_LAUNCH_FAILURE = /error launching git/i;
 function toSpawnError(err, cwd, args) {
   const code = err?.code;
   if (code === "ENOENT") {
@@ -366,6 +367,15 @@ async function* runGitOnce(cwd, args, opts) {
   }
   if (code !== 0) {
     const trimmed = stderr.trim();
+    if (GIT_LAUNCH_FAILURE.test(trimmed)) {
+      throw new GitSpawnError(
+        `Could not start git (${trimmed.split("\n")[0]}) in ${cwd}. This is usually transient on Windows -- retrying the same command often succeeds.`,
+        fullArgs,
+        void 0,
+        true,
+        null
+      );
+    }
     const detail = trimmed.split("\n")[0];
     throw new GitError(
       `git ${args.join(" ")} exited with code ${code}${detail ? `: ${detail}` : ""}`,
@@ -491,6 +501,9 @@ function renderHookSnippet(logPath) {
     "$global:__ssd_last_history_id = -1",
     `$global:__ssd_log_path = ${toPowerShellLiteral(logPath)}`,
     "function global:prompt {",
+    // Must be first: Get-History (or anything else) below would overwrite $?.
+    "  $__ssd_ok = $?",
+    "  $__ssd_exit = $LASTEXITCODE",
     "  $__ssd_h = Get-History -Count 1 -ErrorAction SilentlyContinue",
     "  if ($__ssd_h -and $__ssd_h.Id -ne $global:__ssd_last_history_id) {",
     "    $global:__ssd_last_history_id = $__ssd_h.Id",
@@ -498,7 +511,8 @@ function renderHookSnippet(logPath) {
     "      $__ssd_entry = [ordered]@{",
     '        ts = (Get-Date).ToString("o")',
     "        cwd = (Get-Location).Path",
-    "        exitCode = $LASTEXITCODE",
+    // $LASTEXITCODE alone misses cmdlet failures and goes stale after them; $? catches both.
+    "        exitCode = if ($__ssd_ok) { 0 } elseif ($__ssd_exit) { $__ssd_exit } else { 1 }",
     "        durationMs = [int](($__ssd_h.EndExecutionTime - $__ssd_h.StartExecutionTime).TotalMilliseconds)",
     "        command = $__ssd_h.CommandLine",
     "      }",
@@ -974,6 +988,13 @@ CREATE TABLE contradiction_checks (
   PRIMARY KEY (candidate_id, against_id)
 );
 `;
+var V9 = `
+ALTER TABLE contradiction_checks ADD COLUMN dismissed INTEGER NOT NULL DEFAULT 0;
+`;
+var V10 = `
+ALTER TABLE nodes ADD COLUMN trust_state TEXT NOT NULL DEFAULT 'candidate';
+CREATE INDEX idx_nodes_trust_state ON nodes (project_id, trust_state) WHERE trust_state != 'candidate';
+`;
 var MIGRATIONS = [
   { version: 1, up: (db) => db.exec(V1) },
   { version: 2, up: (db) => db.exec(V2) },
@@ -982,7 +1003,9 @@ var MIGRATIONS = [
   { version: 5, up: (db) => db.exec(V5) },
   { version: 6, up: (db) => db.exec(V6) },
   { version: 7, up: (db) => db.exec(V7) },
-  { version: 8, up: (db) => db.exec(V8) }
+  { version: 8, up: (db) => db.exec(V8) },
+  { version: 9, up: (db) => db.exec(V9) },
+  { version: 10, up: (db) => db.exec(V10) }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
 function currentSchemaVersion(db) {
@@ -1000,6 +1023,36 @@ function migrate(db) {
   return { from, to: currentSchemaVersion(db) };
 }
 
+// src/store/audit.ts
+function recordMutationAudit(db, input) {
+  return Number(
+    db.prepare(
+      `INSERT INTO mutation_audit (action, project_id, detail, affected_count, succeeded, error, started_at, finished_at)
+         VALUES (@action, @projectId, @detail, @affectedCount, @succeeded, @error, @startedAt, @finishedAt)`
+    ).run({
+      action: input.action,
+      projectId: input.projectId,
+      detail: JSON.stringify(input.detail),
+      affectedCount: input.affectedCount,
+      succeeded: input.succeeded ? 1 : 0,
+      error: input.error ?? null,
+      startedAt: input.startedAt,
+      finishedAt: input.finishedAt
+    }).lastInsertRowid
+  );
+}
+function listMutationAudit(db, projectId, opts = {}) {
+  const rows = db.prepare(
+    `SELECT id, action, project_id AS projectId, detail, affected_count AS affectedCount,
+              succeeded, error, started_at AS startedAt, finished_at AS finishedAt
+       FROM mutation_audit
+       WHERE project_id = @projectId
+       ORDER BY started_at DESC
+       LIMIT @limit`
+  ).all({ projectId, limit: opts.limit ?? 50 });
+  return rows.map((r) => ({ ...r, succeeded: r.succeeded === 1 }));
+}
+
 // src/store/projects.ts
 function upsertProject(db, project) {
   db.prepare(
@@ -1152,7 +1205,7 @@ function clearProject(db, projectId) {
 function getNodesByIds(db, ids) {
   if (ids.length === 0) return [];
   return db.prepare(
-    `SELECT id, kind, project_id AS projectId, ts, title, body, signal, provenance
+    `SELECT id, kind, project_id AS projectId, ts, title, body, signal, provenance, trust_state AS trustState
        FROM nodes WHERE id IN (SELECT value FROM json_each(?))`
   ).all(JSON.stringify(ids));
 }
@@ -1198,6 +1251,9 @@ function getSupersededIds(db, projectId) {
 function setSupersedes(db, newNodeId, staleNodeId) {
   db.prepare("UPDATE nodes SET supersedes = ? WHERE id = ?").run(staleNodeId, newNodeId);
 }
+function setTrustState(db, nodeId, state) {
+  return db.prepare("UPDATE nodes SET trust_state = ? WHERE id = ?").run(state, nodeId).changes > 0;
+}
 function listStaleCandidates(db, projectId, opts = {}) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const minAgeDays = opts.minAgeDays ?? 45;
@@ -1417,16 +1473,18 @@ function upsertEmbedding(db, rowid, embedding) {
 function dropAllEmbeddings(db) {
   return db.prepare("DELETE FROM nodes_vec").run().changes;
 }
-function vectorSearch(db, projectId, embedding, limit = 20) {
+function vectorSearch(db, projectId, embedding, limit = 20, opts = {}) {
   const overfetch = Math.max(limit * 8, 50);
+  const asOfEpoch = opts.asOfEpoch ?? null;
   return db.prepare(
-    `SELECT n.id, n.kind, n.ts, n.title, n.body, n.signal, n.provenance, v.distance AS distance
+    `SELECT n.id, n.kind, n.ts, n.title, n.body, n.signal, n.provenance, n.trust_state AS trustState, v.distance AS distance
        FROM nodes_vec v
        JOIN nodes n ON n.rowid = v.rowid
        WHERE v.embedding MATCH ? AND k = ? AND n.project_id = ?
+         AND (? IS NULL OR n.created_at <= ?)
        ORDER BY v.distance
        LIMIT ?`
-  ).all(embedding, overfetch, projectId, limit);
+  ).all(embedding, overfetch, projectId, asOfEpoch, asOfEpoch, limit);
 }
 
 // src/store/fts.ts
@@ -1445,18 +1503,20 @@ function toMatchQuery(input) {
 }
 
 // src/store/search.ts
-function search(db, projectId, query, limit = 20) {
+function search(db, projectId, query, limit = 20, opts = {}) {
   const match = toMatchQuery(query);
   if (!match) return [];
+  const asOfEpoch = opts.asOfEpoch ?? null;
   const rows = db.prepare(
-    `SELECT n.id, n.kind, n.ts, n.title, n.body, n.signal, n.provenance,
+    `SELECT n.id, n.kind, n.ts, n.title, n.body, n.signal, n.provenance, n.trust_state AS trustState,
               bm25(nodes_fts, 10.0, 1.0) AS rank
        FROM nodes_fts
        JOIN nodes n ON n.rowid = nodes_fts.rowid
        WHERE nodes_fts MATCH ? AND n.project_id = ?
+         AND (? IS NULL OR n.created_at <= ?)
        ORDER BY rank
        LIMIT ?`
-  ).all(match, projectId, limit);
+  ).all(match, projectId, asOfEpoch, asOfEpoch, limit);
   return rows;
 }
 function stats(db, projectId) {
@@ -1514,7 +1574,7 @@ function listContradictionSuggestions(db, projectId, opts = {}) {
        FROM contradiction_checks c
        JOIN nodes n ON n.id = c.candidate_id
        JOIN nodes a ON a.id = c.against_id
-       WHERE n.project_id = @projectId AND c.contradicts = 1
+       WHERE n.project_id = @projectId AND c.contradicts = 1 AND c.dismissed = 0
          AND c.candidate_id NOT IN (SELECT supersedes FROM nodes WHERE project_id = @projectId AND supersedes IS NOT NULL)
        ORDER BY c.checked_at DESC
        LIMIT @limit`
@@ -1525,11 +1585,19 @@ function countContradictionSuggestions(db, projectId) {
     `SELECT COUNT(*) AS count
        FROM contradiction_checks c
        JOIN nodes n ON n.id = c.candidate_id
-       WHERE n.project_id = @projectId AND c.contradicts = 1
+       WHERE n.project_id = @projectId AND c.contradicts = 1 AND c.dismissed = 0
          AND c.candidate_id NOT IN (SELECT supersedes FROM nodes WHERE project_id = @projectId AND supersedes IS NOT NULL)`
   ).get({ projectId });
   return row.count;
 }
+function dismissContradictionSuggestion(db, projectId, candidateId) {
+  return db.prepare(
+    `UPDATE contradiction_checks
+       SET dismissed = 1
+       WHERE candidate_id = @candidateId AND contradicts = 1 AND dismissed = 0
+         AND candidate_id IN (SELECT id FROM nodes WHERE project_id = @projectId)`
+  ).run({ projectId, candidateId }).changes;
+}
 
 // src/store/store.ts
 var MemoryStore = class _MemoryStore {
@@ -1703,14 +1771,14 @@ var MemoryStore = class _MemoryStore {
   setMeta(key, value) {
     setMeta(this.db, key, value);
   }
-  vectorSearch(projectId, embedding, limit = 20) {
-    return vectorSearch(this.db, projectId, embedding, limit);
+  vectorSearch(projectId, embedding, limit = 20, opts = {}) {
+    return vectorSearch(this.db, projectId, embedding, limit, opts);
   }
   stats(projectId) {
     return stats(this.db, projectId);
   }
-  search(projectId, query, limit = 20) {
-    return search(this.db, projectId, query, limit);
+  search(projectId, query, limit = 20, opts = {}) {
+    return search(this.db, projectId, query, limit, opts);
   }
   /** The project a node belongs to, or null if no node has this id. Used by `mark-stale` to validate both ids. */
   getNodeProjectId(id) {
@@ -1724,6 +1792,10 @@ var MemoryStore = class _MemoryStore {
   setSupersedes(newNodeId, staleNodeId) {
     setSupersedes(this.db, newNodeId, staleNodeId);
   }
+  /** Record a human's verdict on one node -- the write behind `nexusmem review`. Caller validates project ownership first. */
+  setTrustState(nodeId, state) {
+    return setTrustState(this.db, nodeId, state);
+  }
   /** Aging non-`observed` nodes nothing supersedes yet -- candidates for `nexusmem mark-stale`, not auto-applied. */
   listStaleCandidates(projectId, opts = {}) {
     return listStaleCandidates(this.db, projectId, opts);
@@ -1746,6 +1818,18 @@ var MemoryStore = class _MemoryStore {
   countContradictionSuggestions(projectId) {
     return countContradictionSuggestions(this.db, projectId);
   }
+  /** Reject every open suggestion for this candidate; returns how many were actually dismissed. */
+  dismissContradictionSuggestion(projectId, candidateId) {
+    return dismissContradictionSuggestion(this.db, projectId, candidateId);
+  }
+  /** Record one `mutation_audit` row for a coarse/destructive operation outside `forget` (currently: `--prune-source`/`--prune-stale-shell`). */
+  recordMutationAudit(input) {
+    return recordMutationAudit(this.db, input);
+  }
+  /** Newest-first `mutation_audit` rows for this project -- every `forget` and `--prune-source` run, whether or not anything matched. */
+  listMutationAudit(projectId, opts = {}) {
+    return listMutationAudit(this.db, projectId, opts);
+  }
   /** Escape hatch for tests and future modules. */
   get raw() {
     return this.db;
@@ -2395,6 +2479,7 @@ function packContext(ranked, tokensBudget, opts = {}) {
       summary,
       tokens,
       provenance: hit.provenance,
+      trustState: hit.trustState,
       ...hit.project ? { project: hit.project } : {}
     });
     tokensUsed += tokens;
@@ -2408,7 +2493,8 @@ function renderContextBlock(query, result) {
   for (const node of result.nodes) {
     const project = node.project ? `[${node.project}] ` : "";
     const provenance = `[${node.provenance}] `;
-    lines.push(`- ${node.ts.slice(0, 10)} ${provenance}${project}${node.title}`);
+    const trust = node.trustState !== "candidate" ? `[${node.trustState}] ` : "";
+    lines.push(`- ${node.ts.slice(0, 10)} ${provenance}${trust}${project}${node.title}`);
     if (node.summary && node.summary !== node.title) {
       if (node.kind === "code_diff") {
         for (const line of node.summary.split("\n")) lines.push(`  ${line}`);
@@ -2546,6 +2632,7 @@ function mergeSearchAndVectorHits(bm25Hits, vectorHits) {
       body: hit.body,
       signal: hit.signal,
       provenance: hit.provenance,
+      trustState: hit.trustState,
       rank: 0
     });
   }
@@ -2565,6 +2652,7 @@ var HALF_LIFE_RATIO = {
   derived: 0.35
 };
 var SUPERSEDED_PENALTY = 0.5;
+var REJECTED_TRUST_PENALTY = 0.3;
 var MAX_PRIOR_OVERTURN = 2;
 var PRIOR_COUNT = 2;
 var PER_PRIOR_OVERTURN = MAX_PRIOR_OVERTURN ** (1 / PRIOR_COUNT);
@@ -2608,7 +2696,8 @@ function rankHits(hits, opts = {}) {
     const effectiveHalfLife = halfLife * (ratios[hit.provenance] ?? 1);
     const recencyFactor = RECENCY_FLOOR + (1 - RECENCY_FLOOR) * 2 ** (-ageDays / effectiveHalfLife);
     const rawScore = relevance * signalWeight ** SIGNAL_EXPONENT * recencyFactor ** RECENCY_EXPONENT;
-    const score = opts.supersededIds?.has(hit.id) ? rawScore * SUPERSEDED_PENALTY : rawScore;
+    const supersededScore = opts.supersededIds?.has(hit.id) ? rawScore * SUPERSEDED_PENALTY : rawScore;
+    const score = hit.trustState === "rejected" ? supersededScore * REJECTED_TRUST_PENALTY : supersededScore;
     return { ...hit, relevance, signalWeight, ageDays, recencyFactor, score };
   });
   return ranked.sort((a, b) => b.score - a.score);
@@ -2638,6 +2727,7 @@ function pullLinkedResolutions(resolveStore, ranked) {
           body: resolution.body,
           signal: resolution.signal,
           provenance: resolution.provenance,
+          trustState: resolution.trustState,
           rank: 0,
           // no bm25/vector rank of its own -- never read again past this point
           relevance: hit.relevance,
@@ -2662,8 +2752,8 @@ async function runCrossProjectQuery(sources, query, opts) {
   const supersededIds = /* @__PURE__ */ new Set();
   for (const source of sources) {
     const label = (hit) => ({ ...hit, project: source.label });
-    const bm25Hits = source.store.search(source.projectId, query, opts.candidates).map(label);
-    const vectorHits = queryVector ? source.store.vectorSearch(source.projectId, queryVector, opts.candidates) : [];
+    const bm25Hits = source.store.search(source.projectId, query, opts.candidates, { asOfEpoch: opts.asOfEpoch }).map(label);
+    const vectorHits = queryVector ? source.store.vectorSearch(source.projectId, queryVector, opts.candidates, { asOfEpoch: opts.asOfEpoch }) : [];
     bm25Count += bm25Hits.length;
     vectorCount += vectorHits.length;
     perProject.push({ label: source.label, bm25: bm25Hits.length, vector: vectorHits.length });
@@ -2684,11 +2774,11 @@ async function runCrossProjectQuery(sources, query, opts) {
   return { bm25Count, vectorCount, hits, packed, perProject };
 }
 async function runHybridQuery(store, projectId, query, opts) {
-  const bm25Hits = store.search(projectId, query, opts.candidates);
+  const bm25Hits = store.search(projectId, query, opts.candidates, { asOfEpoch: opts.asOfEpoch });
   let vectorHits = [];
   if (opts.embeddingProvider) {
     const queryVector = await opts.embeddingProvider.embed(query);
-    if (queryVector) vectorHits = store.vectorSearch(projectId, queryVector, opts.candidates);
+    if (queryVector) vectorHits = store.vectorSearch(projectId, queryVector, opts.candidates, { asOfEpoch: opts.asOfEpoch });
   }
   const hits = vectorHits.length > 0 ? mergeSearchAndVectorHits(bm25Hits, vectorHits) : bm25Hits;
   const relevanceScores = vectorHits.length > 0 ? reciprocalRankFusion([bm25Hits, vectorHits]) : void 0;
@@ -5118,8 +5208,18 @@ function runPruneSources(store, projectId, otherProjectIds, sources, yes, out) {
     );
     return 0;
   }
+  const startedAt = Date.now();
   let removed = 0;
   for (const { source, id } of counts) removed += store.pruneSourceNodes(id, source, []);
+  store.recordMutationAudit({
+    action: "prune_source",
+    projectId,
+    detail: { sources, scopeProjectIds: scopeIds },
+    affectedCount: removed,
+    succeeded: true,
+    startedAt,
+    finishedAt: Date.now()
+  });
   const identityPart = otherProjectIds.length > 0 ? `, ${scopeIds.length} project identit${scopeIds.length === 1 ? "y" : "ies"}` : "";
   out(`${pc7.green("pruned")} ${removed} node(s) across ${sources.length} source(s)${identityPart}
 `);
@@ -5262,10 +5362,17 @@ async function searchMemory(input) {
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const budget = input.budget ?? 2e3;
   const candidates = input.candidates ?? 30;
+  let asOfEpoch;
+  if (input.asOf) {
+    const parsed = Date.parse(input.asOf);
+    if (Number.isNaN(parsed)) throw new Error(`asOf "${input.asOf}" is not a parseable date`);
+    asOfEpoch = parsed;
+  }
   const queryOpts = {
     budget,
     candidates,
-    embeddingProvider: input.noVector ? null : new OllamaEmbeddingProvider()
+    embeddingProvider: input.noVector ? null : new OllamaEmbeddingProvider(),
+    asOfEpoch
   };
   if (input.allProjects) {
     const opened = await openAllProjectSources({ projectId, root: repo.root, dbPath: ws.dbPath });
@@ -5361,11 +5468,14 @@ function createServer() {
         budget: z4.number().int().positive().optional().describe("Max tokens in the returned context block. Default 2000."),
         allProjects: z4.boolean().optional().describe(
           "Search every repository NexusMem has been run in on this machine, not just projectRoot. Use when the answer may live in a different project (a pattern solved elsewhere, a tool that failed the same way before). Each result is tagged with its repository."
+        ),
+        asOf: z4.string().optional().describe(
+          'ISO-8601 date/time. Restricts results to nodes recorded at or before this instant -- "what did memory hold as of then", not "what happened then". Omit for the normal, unrestricted read.'
         )
       }
     },
-    async ({ projectRoot, query, budget, allProjects }) => {
-      const result = await searchMemory({ projectRoot, query, budget, allProjects });
+    async ({ projectRoot, query, budget, allProjects, asOf }) => {
+      const result = await searchMemory({ projectRoot, query, budget, allProjects, asOf });
       return {
         content: [{ type: "text", text: result.text }],
         structuredContent: {
@@ -5550,8 +5660,20 @@ ${pc8.dim("-".repeat(40))}
 
 // src/cli/commands/query.ts
 import pc9 from "picocolors";
+var QueryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "QueryError";
+  }
+};
 async function runQuery(opts) {
   const { repo, ws, projectId } = await loadContext(opts.cwd);
+  let asOfEpoch;
+  if (opts.asOf) {
+    const parsed = Date.parse(opts.asOf);
+    if (Number.isNaN(parsed)) throw new QueryError(`--as-of "${opts.asOf}" is not a parseable date`);
+    asOfEpoch = parsed;
+  }
   const opened = opts.allProjects ? await openAllProjectSources({ projectId, root: repo.root, dbPath: ws.dbPath }) : null;
   let store = null;
   try {
@@ -5559,7 +5681,8 @@ async function runQuery(opts) {
       budget: opts.budget,
       candidates: opts.candidates,
       halfLifeDays: opts.halfLifeDays,
-      embeddingProvider: opts.noVector ? null : new OllamaEmbeddingProvider()
+      embeddingProvider: opts.noVector ? null : new OllamaEmbeddingProvider(),
+      asOfEpoch
     };
     let result;
     if (opened) {
@@ -5569,6 +5692,10 @@ async function runQuery(opts) {
       result = await runHybridQuery(store, projectId, opts.query, queryOpts);
     }
     const { bm25Count, vectorCount, hits, packed } = result;
+    if (asOfEpoch !== void 0 && !opts.json) {
+      process.stderr.write(`${pc9.dim("as of  ")} ${new Date(asOfEpoch).toISOString()} -- excludes anything recorded after
+`);
+    }
     if (opened && !opts.json) {
       const searched = opened.sources.map((s) => s.label).join(", ");
       process.stderr.write(`${pc9.dim("scope  ")} ${opened.sources.length} project(s): ${searched}
@@ -5630,11 +5757,45 @@ async function runQuery(opts) {
   }
 }
 
+// src/cli/commands/review.ts
+import pc10 from "picocolors";
+var ReviewError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReviewError";
+  }
+};
+async function runReview(opts) {
+  const { projectId, ws } = await loadContext(opts.cwd);
+  const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
+  const store = MemoryStore.open(ws.dbPath);
+  try {
+    const owner = store.getNodeProjectId(opts.nodeId);
+    if (owner === null) {
+      throw new ReviewError(`no node found with id ${opts.nodeId}`);
+    }
+    if (owner !== projectId) {
+      throw new ReviewError("node must belong to the current project");
+    }
+    store.setTrustState(opts.nodeId, opts.verdict);
+    const verb = opts.verdict === "verified" ? "verified" : "rejected";
+    out(
+      `${pc10.green(verb)} ${opts.nodeId}
+` + (opts.verdict === "rejected" ? `${pc10.dim("down-weighted in ranking")} -- the node stays queryable, just ranked lower
+` : `${pc10.dim("labeled only")} -- verifying does not change ranking
+`)
+    );
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+
 // src/cli/commands/scan-conversation.ts
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 
 // src/cli/format.ts
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 var GIT_SIGNAL_BANDS = { high: 0.7, medium: 0.45 };
 var SHELL_SIGNAL_BANDS = { high: 0.6, medium: 0.4 };
 var CONVERSATION_SIGNAL_BANDS = { high: 0.55, medium: 0.35 };
@@ -5646,9 +5807,9 @@ function signalBand(signal, bands) {
   return "low";
 }
 var BAND_COLOR = {
-  high: pc10.green,
-  medium: pc10.yellow,
-  low: pc10.dim
+  high: pc11.green,
+  medium: pc11.yellow,
+  low: pc11.dim
 };
 function formatSignal(signal, bands) {
   return BAND_COLOR[signalBand(signal, bands)](signal.toFixed(2));
@@ -5657,7 +5818,7 @@ function approxTotalTokens(nodes) {
   return nodes.reduce((n, x) => n + approxTokens(x.body), 0);
 }
 function summarize2(nodes) {
-  if (nodes.length === 0) return pc10.yellow("no commits matched");
+  if (nodes.length === 0) return pc11.yellow("no commits matched");
   const timestamps = nodes.map((n) => n.ts).sort();
   const avgSignal = nodes.reduce((n, x) => n + x.signal, 0) / nodes.length;
   const totalTokens = approxTotalTokens(nodes);
@@ -5667,7 +5828,7 @@ function summarize2(nodes) {
   }
   const hottest = [...fileHits.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([path, count]) => `    ${String(count).padStart(3)}x ${path}`);
   return [
-    `${pc10.bold(String(nodes.length))} nodes  ${pc10.dim(`${timestamps[0]?.slice(0, 10)} .. ${timestamps.at(-1)?.slice(0, 10)}`)}`,
+    `${pc11.bold(String(nodes.length))} nodes  ${pc11.dim(`${timestamps[0]?.slice(0, 10)} .. ${timestamps.at(-1)?.slice(0, 10)}`)}`,
     `  avg signal ${avgSignal.toFixed(3)}   ~${totalTokens.toLocaleString()} tokens if sent raw`,
     hottest.length ? `  hottest files:
 ${hottest.join("\n")}` : ""
@@ -5681,9 +5842,9 @@ async function runScanConversation(opts) {
   const files = await listTranscriptFiles(repo.root);
   if (!opts.json) {
     process.stderr.write(
-      files.length ? `${pc11.dim("transcripts")} ${files.length} file(s) in ${claudeProjectTranscriptDir(repo.root)}
+      files.length ? `${pc12.dim("transcripts")} ${files.length} file(s) in ${claudeProjectTranscriptDir(repo.root)}
 
-` : `${pc11.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
+` : `${pc12.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
 `
     );
   }
@@ -5700,7 +5861,7 @@ async function runScanConversation(opts) {
   const approxTotal = approxTotalTokens(nodes);
   process.stderr.write(
     `
-${pc11.bold(String(nodes.length))} of ${turns.length} exchange(s) above threshold  ${pc11.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}` + (redactedTotal > 0 ? `  ${pc11.yellow(`${redactedTotal} secret-like value(s) redacted`)}` : "") + "\n"
+${pc12.bold(String(nodes.length))} of ${turns.length} exchange(s) above threshold  ${pc12.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}` + (redactedTotal > 0 ? `  ${pc12.yellow(`${redactedTotal} secret-like value(s) redacted`)}` : "") + "\n"
   );
   return 0;
 }
@@ -5709,7 +5870,7 @@ function formatNode(node) {
 }
 
 // src/cli/commands/scan-diff.ts
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 var DEFAULT_SCAN_COMMITS = 50;
 async function runScanDiff(opts) {
   const repo = await readRepoInfo(opts.cwd);
@@ -5717,9 +5878,9 @@ async function runScanDiff(opts) {
   if (!opts.json) {
     process.stderr.write(
       [
-        `${pc12.dim("repo   ")} ${repo.root}`,
-        `${pc12.dim("branch ")} ${repo.branch ?? pc12.yellow("(detached)")}`,
-        `${pc12.dim("project")} ${pc12.cyan(projectId)}`,
+        `${pc13.dim("repo   ")} ${repo.root}`,
+        `${pc13.dim("branch ")} ${repo.branch ?? pc13.yellow("(detached)")}`,
+        `${pc13.dim("project")} ${pc13.cyan(projectId)}`,
         ""
       ].join("\n")
     );
@@ -5749,28 +5910,28 @@ function formatNode2(node) {
   const churn = `+${node.meta.insertions ?? 0}/-${node.meta.deletions ?? 0}`;
   return [
     formatSignal(node.signal, DIFF_SIGNAL_BANDS),
-    pc12.dim(node.ts.slice(0, 10)),
-    pc12.magenta(sha),
+    pc13.dim(node.ts.slice(0, 10)),
+    pc13.magenta(sha),
     String(node.meta.path ?? ""),
-    pc12.dim(`(${churn}, ${node.meta.hunkCount ?? 0} hunk(s))`)
+    pc13.dim(`(${churn}, ${node.meta.hunkCount ?? 0} hunk(s))`)
   ].join(" ");
 }
 
 // src/cli/commands/scan-docs.ts
-import pc13 from "picocolors";
+import pc14 from "picocolors";
 async function runScanDocs(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const { files, unreadable } = await readDocFiles(repo.root);
   if (!opts.json) {
     process.stderr.write(
-      files.length ? `${pc13.dim("tracked .md files")} ${files.map((f) => f.path).join(", ")}
+      files.length ? `${pc14.dim("tracked .md files")} ${files.map((f) => f.path).join(", ")}
 
-` : `${pc13.yellow("no tracked .md files found")}
+` : `${pc14.yellow("no tracked .md files found")}
 `
     );
     if (unreadable.length > 0) {
-      process.stderr.write(`${pc13.yellow("unreadable")} ${unreadable.join(", ")}
+      process.stderr.write(`${pc14.yellow("unreadable")} ${unreadable.join(", ")}
 
 `);
     }
@@ -5786,7 +5947,7 @@ async function runScanDocs(opts) {
   const approxTotal = approxTotalTokens(nodes);
   process.stderr.write(
     `
-${pc13.bold(String(nodes.length))} section(s) from ${files.length} file(s) above threshold  ${pc13.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
+${pc14.bold(String(nodes.length))} section(s) from ${files.length} file(s) above threshold  ${pc14.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
 `
   );
   return 0;
@@ -5796,17 +5957,17 @@ function formatNode3(node) {
 }
 
 // src/cli/commands/scan-git.ts
-import pc14 from "picocolors";
+import pc15 from "picocolors";
 async function runScanGit(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   if (!opts.json) {
     process.stderr.write(
       [
-        `${pc14.dim("repo   ")} ${repo.root}`,
-        `${pc14.dim("branch ")} ${repo.branch ?? pc14.yellow("(detached)")}`,
-        `${pc14.dim("origin ")} ${repo.originUrl ?? pc14.dim("(none)")}`,
-        `${pc14.dim("project")} ${pc14.cyan(projectId)}`,
+        `${pc15.dim("repo   ")} ${repo.root}`,
+        `${pc15.dim("branch ")} ${repo.branch ?? pc15.yellow("(detached)")}`,
+        `${pc15.dim("origin ")} ${repo.originUrl ?? pc15.dim("(none)")}`,
+        `${pc15.dim("project")} ${pc15.cyan(projectId)}`,
         ""
       ].join("\n")
     );
@@ -5840,21 +6001,21 @@ function formatNode4(node) {
   const churn = `+${node.meta.insertions ?? 0}/-${node.meta.deletions ?? 0}`;
   return [
     formatSignal(node.signal, GIT_SIGNAL_BANDS),
-    pc14.dim(date),
-    pc14.magenta(sha),
+    pc15.dim(date),
+    pc15.magenta(sha),
     node.title,
-    pc14.dim(`(${files} file${files === 1 ? "" : "s"}, ${churn})`)
+    pc15.dim(`(${files} file${files === 1 ? "" : "s"}, ${churn})`)
   ].join(" ");
 }
 
 // src/cli/commands/scan-session.ts
-import pc15 from "picocolors";
+import pc16 from "picocolors";
 async function runScanSession(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const turns = await collectClaudeCodeTranscripts(repo.root);
   if (turns.length === 0) {
-    process.stderr.write(`${pc15.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
+    process.stderr.write(`${pc16.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
 `);
     return 0;
   }
@@ -5862,7 +6023,7 @@ async function runScanSession(opts) {
   const settled = selectSettledSessions(sessions, opts.settleMinutes);
   if (!opts.json) {
     process.stderr.write(
-      `${pc15.dim("sessions")} ${sessions.length} found, ${settled.length} settled (quiet ${opts.settleMinutes}m+)
+      `${pc16.dim("sessions")} ${sessions.length} found, ${settled.length} settled (quiet ${opts.settleMinutes}m+)
 
 `
     );
@@ -5888,7 +6049,7 @@ async function runScanSession(opts) {
     }
     for (const preview of previews) {
       process.stdout.write(
-        `${pc15.bold(preview.sessionKey)}  ${preview.startedAt.slice(0, 16).replace("T", " ")}  ${preview.includedTurns}/${preview.turns} turn(s), ${preview.promptChars} chars
+        `${pc16.bold(preview.sessionKey)}  ${preview.startedAt.slice(0, 16).replace("T", " ")}  ${preview.includedTurns}/${preview.turns} turn(s), ${preview.promptChars} chars
 ${preview.prompt}
 
 `
@@ -5900,7 +6061,7 @@ ${preview.prompt}
     settleMinutes: opts.settleMinutes,
     maxSessions: opts.maxSessions,
     onProgress: (done, total) => {
-      if (!opts.json) process.stderr.write(`  ${pc15.dim(`summarizing ${done}/${total}`)}
+      if (!opts.json) process.stderr.write(`  ${pc16.dim(`summarizing ${done}/${total}`)}
 `);
     }
   });
@@ -5910,21 +6071,21 @@ ${preview.prompt}
     return 0;
   }
   for (const node of result.nodes) {
-    process.stdout.write(`${pc15.bold(node.title)}
-${pc15.dim(node.ts.slice(0, 16).replace("T", " "))}
+    process.stdout.write(`${pc16.bold(node.title)}
+${pc16.dim(node.ts.slice(0, 16).replace("T", " "))}
 ${node.body}
 
 `);
   }
   if (result.providerUnavailable) {
     process.stderr.write(
-      `${pc15.yellow("model unavailable")} -- is Ollama running with \`${opts.model}\` pulled? (\`ollama pull ${opts.model}\`)
+      `${pc16.yellow("model unavailable")} -- is Ollama running with \`${opts.model}\` pulled? (\`ollama pull ${opts.model}\`)
 `
     );
     return 0;
   }
   process.stderr.write(
-    `${pc15.bold(String(result.nodes.length))} summarized` + (result.failed > 0 ? `, ${pc15.yellow(`${result.failed} failed`)}` : "") + ` ${pc15.dim(`(model ${opts.model})`)}
+    `${pc16.bold(String(result.nodes.length))} summarized` + (result.failed > 0 ? `, ${pc16.yellow(`${result.failed} failed`)}` : "") + ` ${pc16.dim(`(model ${opts.model})`)}
 `
   );
   return 0;
@@ -5932,16 +6093,16 @@ ${node.body}
 var SCAN_SESSION_DEFAULT_MODEL = DEFAULT_SLM_MODEL;
 
 // src/cli/commands/scan-shell.ts
-import pc16 from "picocolors";
+import pc17 from "picocolors";
 async function runScanShell(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const results = await collectAvailableShellHistory({ tailLines: opts.tailLines, repoRoot: repo.root });
   if (!opts.json) {
     process.stderr.write(
-      results.length ? `${pc16.dim("sources found")} ${results.map((r) => r.name).join(", ")}
+      results.length ? `${pc17.dim("sources found")} ${results.map((r) => r.name).join(", ")}
 
-` : `${pc16.yellow("no shell history source found on this machine")}
+` : `${pc17.yellow("no shell history source found on this machine")}
 `
     );
   }
@@ -5950,7 +6111,7 @@ async function runScanShell(opts) {
     const nodes = collectShellHistory(result.entries, projectId).filter((n) => n.signal >= opts.minSignal);
     allNodes.push(...nodes);
     if (!opts.json) {
-      process.stdout.write(`${pc16.bold(`shell:${result.name}`)} ${pc16.dim(`(${nodes.length} of ${result.entries.length} above threshold)`)}
+      process.stdout.write(`${pc17.bold(`shell:${result.name}`)} ${pc17.dim(`(${nodes.length} of ${result.entries.length} above threshold)`)}
 `);
       for (const node of nodes) process.stdout.write(`${formatNode5(node)}
 `);
@@ -5963,19 +6124,19 @@ async function runScanShell(opts) {
     return 0;
   }
   const approxTotal = approxTotalTokens(allNodes);
-  process.stderr.write(`${pc16.bold(String(allNodes.length))} node(s) total  ${pc16.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
+  process.stderr.write(`${pc17.bold(String(allNodes.length))} node(s) total  ${pc17.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
 `);
   return 0;
 }
 function formatNode5(node) {
-  const approx = node.meta.tsApprox ? pc16.dim("~") : " ";
+  const approx = node.meta.tsApprox ? pc17.dim("~") : " ";
   const exit = node.meta.exitCode;
-  const exitLabel = typeof exit === "number" && exit !== 0 ? pc16.red(`exit ${exit}`) : "";
+  const exitLabel = typeof exit === "number" && exit !== 0 ? pc17.red(`exit ${exit}`) : "";
   return [formatSignal(node.signal, SHELL_SIGNAL_BANDS), approx + node.ts.slice(0, 16).replace("T", " "), node.title, exitLabel].filter(Boolean).join(" ");
 }
 
 // src/cli/commands/scan-structure.ts
-import pc17 from "picocolors";
+import pc18 from "picocolors";
 var TRACKED_EXTENSIONS = TRACKED_PATHSPECS.map((p) => p.replace("*", "")).join("/");
 async function runScanStructure(opts) {
   const repo = await readRepoInfo(opts.cwd);
@@ -5986,33 +6147,42 @@ async function runScanStructure(opts) {
     return 0;
   }
   if (unreadable.length > 0) {
-    process.stderr.write(`${pc17.yellow("unreadable")} ${unreadable.join(", ")}
+    process.stderr.write(`${pc18.yellow("unreadable")} ${unreadable.join(", ")}
 
 `);
   }
   for (const edge of edges) {
-    process.stdout.write(`${edge.fromPath} ${pc17.dim("->")} ${edge.toPath}
+    process.stdout.write(`${edge.fromPath} ${pc18.dim("->")} ${edge.toPath}
 `);
   }
   process.stderr.write(
     `
-${pc17.bold(String(edges.length))} edge(s) from ${filesScanned} tracked ${TRACKED_EXTENSIONS} file(s)
+${pc18.bold(String(edges.length))} edge(s) from ${filesScanned} tracked ${TRACKED_EXTENSIONS} file(s)
 `
   );
   return 0;
 }
 
 // src/cli/commands/stale.ts
-import pc18 from "picocolors";
+import pc19 from "picocolors";
 var STALE_DEFAULT_MODEL = DEFAULT_SLM_MODEL;
 async function runStale(opts) {
   const { projectId, ws } = await loadContext(opts.cwd);
   const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
   const store = MemoryStore.open(ws.dbPath);
   try {
+    if (opts.dismiss) {
+      const dismissed = store.dismissContradictionSuggestion(projectId, opts.dismiss);
+      out(
+        dismissed > 0 ? `${pc19.green("dismissed")} the contradiction suggestion for ${opts.dismiss} -- it will not resurface
+` : `${pc19.dim("no open contradiction suggestion")} for ${opts.dismiss} -- nothing to dismiss
+`
+      );
+      return 0;
+    }
     const candidates = store.listStaleCandidates(projectId, { minAgeDays: opts.minAgeDays, limit: opts.limit });
     if (candidates.length === 0) {
-      out(`${pc18.dim("no stale candidates")} -- no unconfirmed node older than the threshold lacks a successor
+      out(`${pc19.dim("no stale candidates")} -- no unconfirmed node older than the threshold lacks a successor
 `);
       return 0;
     }
@@ -6034,15 +6204,15 @@ async function runStale(opts) {
     for (const s of suggestions) byCandidateId.set(s.candidateId, s);
     out(
       [
-        `${pc18.bold(String(candidates.length))} stale candidate(s) -- oldest first, none of these were changed:`,
+        `${pc19.bold(String(candidates.length))} stale candidate(s) -- oldest first, none of these were changed:`,
         ...candidates.map((c) => {
-          const line = `  ${pc18.dim(c.id)} ${pc18.yellow(`${c.ageDays}d old`)} [${c.kind}] ${c.title}`;
+          const line = `  ${pc19.dim(c.id)} ${pc19.yellow(`${c.ageDays}d old`)} [${c.kind}] ${c.title}`;
           const hit = byCandidateId.get(c.id);
           return hit ? `${line}
-    ${pc18.red("likely superseded by")} ${pc18.dim(hit.againstId)} ${hit.againstTitle} -- ${hit.reason}` : line;
+    ${pc19.red("likely superseded by")} ${pc19.dim(hit.againstId)} ${hit.againstTitle} -- ${hit.reason}` : line;
         }),
         "",
-        `run ${pc18.bold("nexusmem mark-stale <id> --supersedes <newId>")} on any that are actually wrong`
+        `run ${pc19.bold("nexusmem mark-stale <id> --supersedes <newId>")} on any that are actually wrong`
       ].join("\n").concat("\n")
     );
     return 0;
@@ -6054,7 +6224,7 @@ async function runStale(opts) {
 // src/cli/commands/status.ts
 import { basename as basename4 } from "path";
 import { statSync } from "fs";
-import pc19 from "picocolors";
+import pc20 from "picocolors";
 function daySpan(oldest, newest) {
   const oldestDay = Date.parse(oldest.slice(0, 10));
   const newestDay = Date.parse(newest.slice(0, 10));
@@ -6114,34 +6284,34 @@ async function runStatus(opts) {
     const flaggedCount = store.countContradictionSuggestions(projectId);
     const dbBytes = fileSize(ws.dbPath) + fileSize(`${ws.dbPath}-wal`);
     const kinds = Object.entries(stats2.byKind).sort((a, b) => b[1] - a[1]).map(([kind, n]) => `    ${String(n).padStart(6)}  ${kind}`);
-    const staleProjectWarning = otherProjectIds.length ? `${pc19.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc19.bold(
+    const staleProjectWarning = otherProjectIds.length ? `${pc20.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc20.bold(
       "nexusmem sync --prune-source <name>"
     )} to remove stale source data` : "";
     out(
       [
-        `${pc19.dim("repo    ")} ${repo.root}`,
-        `${pc19.dim("branch  ")} ${repo.branch ?? pc19.yellow("(detached)")}`,
-        `${pc19.dim("project ")} ${pc19.cyan(projectId)}`,
-        `${pc19.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc19.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
-        `${pc19.dim("database")} ${ws.dbPath} ${pc19.dim(`(${humanBytes(dbBytes)})`)}`,
+        `${pc20.dim("repo    ")} ${repo.root}`,
+        `${pc20.dim("branch  ")} ${repo.branch ?? pc20.yellow("(detached)")}`,
+        `${pc20.dim("project ")} ${pc20.cyan(projectId)}`,
+        `${pc20.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc20.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
+        `${pc20.dim("database")} ${ws.dbPath} ${pc20.dim(`(${humanBytes(dbBytes)})`)}`,
         staleProjectWarning,
         "",
-        `${pc19.bold(String(stats2.total))} node(s)${stats2.total ? ` ${pc19.dim(`${stats2.oldest?.slice(0, 10)} .. ${stats2.newest?.slice(0, 10)}`)}` : ""}`,
+        `${pc20.bold(String(stats2.total))} node(s)${stats2.total ? ` ${pc20.dim(`${stats2.oldest?.slice(0, 10)} .. ${stats2.newest?.slice(0, 10)}`)}` : ""}`,
         ...kinds,
-        stats2.total ? `    ${pc19.dim(`${stats2.distinctFiles} distinct file path(s)`)}` : "",
+        stats2.total ? `    ${pc20.dim(`${stats2.distinctFiles} distinct file path(s)`)}` : "",
         "",
-        sources.length ? pc19.dim("sources") : pc19.yellow("no sources synced yet"),
+        sources.length ? pc20.dim("sources") : pc20.yellow("no sources synced yet"),
         ...sources.map((s) => {
           const when = s.lastRunAt ? new Date(s.lastRunAt).toISOString().slice(0, 16).replace("T", " ") : "never";
           const cursorLabel = s.source === "git" ? s.cursor?.slice(0, 7) ?? "-" : s.cursor ?? "-";
-          return `    ${s.source.padEnd(14)} ${pc19.dim(`last run ${when}`)}  ${pc19.dim(`cursor ${cursorLabel}`)}`;
+          return `    ${s.source.padEnd(14)} ${pc20.dim(`last run ${when}`)}  ${pc20.dim(`cursor ${cursorLabel}`)}`;
         }),
         "",
-        gitCursor && gitCursor !== repo.head ? `${pc19.yellow("git behind HEAD")} \u2014 run ${pc19.bold("nexusmem sync")}` : "",
-        chains.failuresTotal ? `${pc19.dim("chains  ")} ${pc19.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc19.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc19.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
-        structure.edges ? `${pc19.dim("structure")} ${pc19.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : "",
-        staleCount ? `${pc19.dim("aging   ")} ${pc19.bold(String(staleCount))} unconfirmed node(s) worth a look \u2014 run ${pc19.bold("nexusmem stale")}` : "",
-        flaggedCount ? `${pc19.dim("flagged ")} ${pc19.bold(String(flaggedCount))} likely-superseded node(s) awaiting review \u2014 run ${pc19.bold("nexusmem stale")} for detail` : ""
+        gitCursor && gitCursor !== repo.head ? `${pc20.yellow("git behind HEAD")} \u2014 run ${pc20.bold("nexusmem sync")}` : "",
+        chains.failuresTotal ? `${pc20.dim("chains  ")} ${pc20.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc20.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc20.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
+        structure.edges ? `${pc20.dim("structure")} ${pc20.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : "",
+        staleCount ? `${pc20.dim("aging   ")} ${pc20.bold(String(staleCount))} unconfirmed node(s) worth a look \u2014 run ${pc20.bold("nexusmem stale")}` : "",
+        flaggedCount ? `${pc20.dim("flagged ")} ${pc20.bold(String(flaggedCount))} likely-superseded node(s) awaiting review \u2014 run ${pc20.bold("nexusmem stale")} for detail` : ""
       ].filter((line) => line !== "").join("\n").concat("\n")
     );
     return 0;
@@ -6156,7 +6326,7 @@ function isExpected(err) {
   // the user fixes, not stack traces they debug.
   err instanceof GitSpawnError || // Survived every retry, so git is genuinely unstable on this machine
   // (antivirus, a bad install). Actionable, and not our stack to print.
-  err instanceof GitCrashError || err instanceof ConfigError || err instanceof ProfileNotFoundError || err instanceof ForeignGitHookError || err instanceof DenyListError || err instanceof MarkStaleError;
+  err instanceof GitCrashError || err instanceof ConfigError || err instanceof ProfileNotFoundError || err instanceof ForeignGitHookError || err instanceof DenyListError || err instanceof MarkStaleError || err instanceof QueryError || err instanceof ReviewError;
 }
 function guard(run) {
   return async () => {
@@ -6164,7 +6334,7 @@ function guard(run) {
       process.exitCode = await run();
     } catch (err) {
       if (isExpected(err)) {
-        process.stderr.write(`${pc20.red("error")} ${err.message}
+        process.stderr.write(`${pc21.red("error")} ${err.message}
 `);
         process.exitCode = 1;
         return;
@@ -6227,7 +6397,7 @@ program.command("hook").description("Manage the opt-in PowerShell hook that logs
   )
 );
 program.command("status").description("Show what is currently remembered for this repository").option("-C, --cwd <path>", "repository path", process.cwd()).option("--share", "print a plain-text summary formatted for sharing, e.g. on X or Reddit").action((options) => guard(() => runStatus({ cwd: options.cwd, share: options.share }))());
-program.command("query").description("Search remembered history and print a token-budgeted context block").argument("<text>", "free-text query").option("-C, --cwd <path>", "repository path", process.cwd()).option("-b, --budget <tokens>", "max tokens in the packed context", (v) => Number.parseInt(v, 10), 2e3).option("-n, --candidates <count>", "how many search hits to rank before packing", (v) => Number.parseInt(v, 10), 30).option("--half-life <days>", "days for a node's recency weight to halve", (v) => Number.parseFloat(v)).option("--no-vector", "BM25 only -- skip embedding the query and vector search").option("-a, --all-projects", "search every registered repository, not just this one", false).option("--json", "emit the packed result as JSON on stdout", false).action(
+program.command("query").description("Search remembered history and print a token-budgeted context block").argument("<text>", "free-text query").option("-C, --cwd <path>", "repository path", process.cwd()).option("-b, --budget <tokens>", "max tokens in the packed context", (v) => Number.parseInt(v, 10), 2e3).option("-n, --candidates <count>", "how many search hits to rank before packing", (v) => Number.parseInt(v, 10), 30).option("--half-life <days>", "days for a node's recency weight to halve", (v) => Number.parseFloat(v)).option("--no-vector", "BM25 only -- skip embedding the query and vector search").option("-a, --all-projects", "search every registered repository, not just this one", false).option("--as-of <date>", 'bi-temporal read: only nodes recorded at or before this date -- "what did the store hold then", not "what happened then"').option("--json", "emit the packed result as JSON on stdout", false).action(
   (text, options) => guard(
     () => runQuery({
       cwd: options.cwd,
@@ -6237,6 +6407,7 @@ program.command("query").description("Search remembered history and print a toke
       halfLifeDays: options.halfLife,
       noVector: !options.vector,
       allProjects: options.allProjects,
+      asOf: options.asOf,
       json: options.json
     })
   )()
@@ -6266,17 +6437,26 @@ program.command("mark-stale").description(
 program.command("stale").description("List unconfirmed (non-observed) nodes old enough to be worth double-checking (writes nothing)").option("-C, --cwd <path>", "repository path", process.cwd()).option("--min-age-days <days>", "only nodes at least this old", (v) => Number.parseFloat(v)).option("-n, --limit <count>", "stop after N candidates", (v) => Number.parseInt(v, 10)).option(
   "--check-contradictions",
   "ask the local SLM whether a similar newer node actually contradicts each candidate (needs Ollama)"
-).option("--model <name>", "Ollama chat model for --check-contradictions", STALE_DEFAULT_MODEL).action(
+).option("--model <name>", "Ollama chat model for --check-contradictions", STALE_DEFAULT_MODEL).option("--dismiss <candidateId>", "reject the open contradiction suggestion for this node id so it stops resurfacing").action(
   (options) => guard(
     () => runStale({
       cwd: options.cwd,
       minAgeDays: options.minAgeDays,
       limit: options.limit,
       checkContradictions: options.checkContradictions,
-      model: options.model
+      model: options.model,
+      dismiss: options.dismiss
     })
   )()
 );
+program.command("review").description("Record a human verdict on one node: --verify or --reject (a rejected node is down-weighted in ranking, never deleted)").argument("<nodeId>", "id of the node being reviewed").option("-C, --cwd <path>", "repository path", process.cwd()).option("--verify", "mark the node verified (label only, no ranking change)", false).option("--reject", "mark the node rejected (down-weighted in ranking, still queryable)", false).action(
+  (nodeId, options) => guard(async () => {
+    if (options.verify === options.reject) {
+      throw new ReviewError("pass exactly one of --verify or --reject");
+    }
+    return runReview({ cwd: options.cwd, nodeId, verdict: options.verify ? "verified" : "rejected" });
+  })()
+);
 program.command("projects").description("List the repositories `query --all-projects` would search").option("--prune", "forget registered projects whose database is no longer on disk", false).option("--json", "emit the registry as JSON on stdout", false).action((options) => guard(() => runProjects({ prune: options.prune, json: options.json }))());
 program.command("scan-git").description("Preview the MemoryNodes git history would produce (writes nothing)").option("-C, --cwd <path>", "repository path", process.cwd()).option("--since <date>", "only commits newer than this git date expression, e.g. 90.days.ago").option("-n, --limit <count>", "stop after N commits", (v) => Number.parseInt(v, 10)).option("--no-merges", "skip merge commits").option("--min-signal <score>", "drop nodes below this signal", (v) => Number.parseFloat(v), 0).option("--json", "emit MemoryNodes as JSON on stdout", false).action(
   (options) => guard(
@@ -6337,7 +6517,7 @@ program.command("scan-structure").description("Preview the JS/TS/Python/Go/Rust/
 program.command("mcp").description("Start the MCP server (stdio transport) for Claude Desktop, Cursor, Windsurf, etc.").action(() => guard(() => runMcpServer().then(() => 0))());
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`${pc20.red("error")} ${message}
+  process.stderr.write(`${pc21.red("error")} ${message}
 `);
   process.exitCode = 1;
 });