common_knowledge_schema-v0_10.sql

-- =============================================================
-- Common Knowledge KB — PostgreSQL Schema (v0.10)
-- =============================================================
--
-- INVARIANTS (load-bearing across all schema, trigger, and inference code)
-- ─────────────────────────────────────────────────────────────────────────
-- 1. OPEN-WORLD ASSUMPTION
--    Absence of a statement does not imply falsity. holds_at() in
--    'open_world' mode returns only positively supported statements
--    (effective_mean > p_threshold). Absence of evidence ≠ evidence of
--    absence. truth_status() returns 'unknown' for the genuine no-evidence
--    case, distinct from 'contradicted'.
--
-- 2. is_a / instance_of IS THE CANONICAL TYPE MECHANISM
--    type_membership is a derived materialized cache populated exclusively
--    by trg_sync_type_membership. Never write to type_membership directly.
--    Transitive closure over subtype_of is resolved at enforcement time
--    via recursive CTE in check_soft_domain_violations. is_a targets
--    must be ontological kinds, not role-hierarchy objects (Fix 3).
--
-- 3. fuzzy_time IS THE CANONICAL TIME REPRESENTATION
--    All temporal bounds live in statement t_start / t_end fuzzy_time
--    fields. For ternary predicates (located_in, causes…), the third arg
--    is reserved for named semantic periods. Use no_period when no named
--    period is the semantic argument. Bare year-objects are a category
--    error. point statements now use granularity-aware overlap (Fix 5).
--
-- 4. CONFLICTS REPRESENT EVIDENTIAL OPPOSITION, NOT LOGICAL NEGATION
--    direct_negation in conflicts identifies evidentially opposed
--    statements. It does NOT mean one is the logical complement of the
--    other. effective_mean is computed via a competition model
--    (credibility_adjusted / (self + Σ opponents)) rather than a
--    multiplicative penalty, and credibility_adjusted is now the actual
--    base of effective_mean (Fix 2).
--
-- 5. KERNEL STATEMENTS ARE CORRECTABLE BUT PROTECTED FROM PASSIVE DRIFT
--    system_kernel has is_protected = true. update_trust() requires
--    p_override = true to modify kernel credibility. update_belief()
--    requires p_override = true to modify ontological statements (Fix 1).
--
-- v0.8 CHANGES (Fixes 1–10):
--   Fix 1:  Belief pipeline stratified by statement_kind. Ontological
--           belief is fixed at assertion time; update_belief() rejects
--           without p_override. Statistical parents in
--           compute_derived_belief() raise a hard exception. Effective
--           belief computed per-kind in statement_effective_belief.
--   Fix 2:  effective_mean now uses credibility_adjusted as its base
--           (previously raw_mean was used, discarding the entire
--           attestation/credibility subsystem). Multiplicative severity
--           penalty replaced by competition normalisation:
--             effective_mean = cred / (cred + Σ opponent_cred)
--           No-opponent case returns cred unmodified (not 1.0).
--   Fix 3:  BEFORE trigger (trg_c_enforce_is_a_target) prevents is_a
--           from targeting role-hierarchy types. Use has_role instead.
--   Fix 4:  BEFORE trigger (trg_b_enforce_kind_consistency) enforces
--           predicate → statement_kind at insertion time:
--             correlated_with / typical_of → statistical
--             implies                       → rule
--             subtype_of / disjoint_with /
--             equivalent_to / opposite_of /
--             different_from                → ontological
--           disjointness_kind defaults to 'constraint' for disjoint_with.
--   Fix 5:  Temporal model hardened. interval requires both t_start and
--           t_end NOT NULL (CHECK). point requires t_start NOT NULL and
--           t_end IS NULL (CHECK). holds_at / tell_about use
--           point_statement_contains() for granularity-aware point overlap
--           rather than coalescing t_end to infinity.
--   Fix 6:  trg_enforce_provenance fires on INSERT OR UPDATE (was INSERT
--           only). trg_zz_auto_inverse_statement fires on INSERT OR UPDATE;
--           UPDATE path propagates belief only, INSERT path creates inverse.
--           sync_statement_args short-circuits on UPDATE when args unchanged.
--   Fix 7:  Acyclicity enforced at write time. trg_e_enforce_subtype_
--           acyclicity (BEFORE INSERT on statements for subtype_of) and
--           trg_enforce_dependency_acyclicity (BEFORE INSERT on
--           statement_dependencies) both use bounded recursive CTEs
--           (depth 50) and reject cycles with an exception.
--   Fix 8:  Sentinels (no_scope, no_period, unknown, true, false) are
--           first-class. objects gains is_sentinel boolean. Sentinels
--           cannot appear in is_a / subtype_of / same_as / different_from
--           / equivalent_to, cannot appear in type_membership, and domain-
--           check and inverse triggers short-circuit on sentinel args.
--           tell_about() gains include_sentinels boolean (default false).
--   Fix 9:  Disjointness enforcement implemented in-database. statements
--           gains disjointness_kind column ('constraint'|'incompatibility').
--           trg_za_enforce_disjointness raises an exception when a
--           constraint disjoint_with axiom is violated by a new is_a.
--           Incompatibility rows contribute to the competition model
--           denominator in statement_effective_belief via the
--           incompat_penalties CTE.
--   Fix 10: validate_kb_integrity() checks statement_args sync,
--           type_membership correctness, missing provenance, subtype_of
--           cycles, sentinel violations, and predicate–kind consistency.
--           truth_status() returns 'supported' | 'contradicted' | 'unknown'.
--
-- v0.9 CHANGES (Fixes 11–22) — see CHANGELOG.md for full rationale:
--   Fix 11: year_to_jd() rewritten with the full proleptic-Gregorian
--           Julian Day algorithm. The v0.8 formula omitted the month/day
--           and Gregorian-correction terms and was ~51 days early: a
--           "year 1815" point window actually covered
--           [1814-11-10, 1815-11-11). Now exact to the calendar year.
--   Fix 12: Evidence bridge. Attestations now contribute Beta pseudo-
--           counts to a per-statement POSTERIOR (statement Beta +
--           source-credibility-weighted attestation counts). v0.8 used
--           weighted source credibility as the base of effective_mean,
--           which silently masked every update_belief() call on any
--           attested statement. One posterior now feeds everything.
--   Fix 13: Competition model made continuous and monotone:
--             effective_mean = posterior / (1 + Σ opponents + Σ penalties)
--           The v0.8 form cred/(cred + Σopp) was discontinuous at zero
--           opposition: a feeble opponent (Σopp < 1 − cred) RAISED a
--           statement's effective belief above its unopposed value.
--           value_conflict rows now also feed the denominator.
--   Fix 14: Derived-belief semantics corrected. compute_derived_belief()
--           combines the PREMISES of one rule application ('min' or new
--           'noisy_and'); 'log_odds' is removed there (premise
--           conjunction can never exceed the weakest premise) and now
--           raises with a pointer to the new combine_evidence(), which
--           log-odds-accumulates across INDEPENDENT DERIVATIONS of the
--           same conclusion. Chain-length decay now operates in log-odds
--           space (decays toward the 0.5 prior, never below it) and
--           parent evidence strength is propagated instead of being
--           reset to 2.0.
--   Fix 15: Context-scoped type system. type_membership PK now includes
--           context_id; every recursive closure (domain check, is_a
--           target check, acyclicity, disjointness, incompatibility
--           penalties) filters statements to context_chain(context):
--           the context and its ancestors. A fiction-context is_a can
--           no longer overwrite or contaminate the reality cache.
--   Fix 16: Statement identity. content_hash (computed by the BEFORE
--           validation trigger over predicate, args, context, and
--           temporal scope) is UNIQUE: the same atom can no longer be
--           inserted twice, ON CONFLICT (content_hash) DO NOTHING makes
--           seeds genuinely idempotent, and competing evidence about
--           one atom merges into one Beta instead of forking rows.
--   Fix 17: Functional predicates. predicates.is_functional marks
--           predicates whose first n−1 args determine the last;
--           detect_conflicts() gains a value_conflict pass that catches
--           real-world contradictions (same subject, different value,
--           overlapping time) which the v0.8 same-atom scan missed.
--   Fix 18: Conflict dedup. Unique pair index for direct_negation /
--           value_conflict; type_mismatch inserts are guarded so
--           update_belief() no longer re-inserts a duplicate conflict
--           row on every belief update of a soft-violating statement.
--   Fix 19: Inverse belief sync is bidirectional. Updating either side
--           of an inverse pair propagates to the other (the v0.8 path
--           only matched forward_chained mirrors, so updating the auto-
--           created inverse silently diverged from the original).
--           Inverse rows are also matched per temporal scope.
--   Fix 20: truth_status() four-state: 'supported' | 'insufficient' |
--           'contradicted' | 'unknown'. A lone weak statement with no
--           opposition is 'insufficient', not 'contradicted'.
--   Fix 21: Incompatibility penalties walk the asserted type's ancestors
--           (parity with constraint enforcement, which already did).
--   Fix 22: type_membership lifecycle (stale rows removed on arg-change
--           UPDATE and on DELETE); canonical_name may not contain ':'
--           (closes the stable_uuid('a:b','c') = stable_uuid('a','b:c')
--           collision); unknown combination modes now raise instead of
--           silently falling back to 'min'.
--
-- v0.10 CHANGES (Fixes 23–24) — see CHANGELOG.md for full rationale:
--   Fix 23: Live derivation graph. (a) compute_derived_belief() now
--           consumes each parent's EFFECTIVE pipeline belief (the same
--           number queries see: posterior incl. attestations, suppressed
--           by open conflicts) instead of raw belief_alpha/beta, closing
--           the inconsistency where a contested or heavily-attested
--           premise fed its conclusions as if neither fact existed.
--           Rule-kind parents are licensing, not evidence: skipped from
--           the math. (b) statements.combination_mode records how a
--           derived row was computed. (c) recompute_derived_belief()
--           re-derives one forward_chained statement from its provenance
--           edges (grouped per rule_name; independent groups merged via
--           log-odds, correlated groups fall back to the strongest one).
--           (d) trg_zzz_propagate_derived + an attestations trigger push
--           parent belief/evidence changes down the DAG automatically,
--           with convergence guards. Derived rows are owned by the
--           machinery: direct evidence about a conclusion belongs in
--           attestations ON the derived row (they survive recompute).
--   Fix 24: combine_evidence() verifies independence by default: parents
--           sharing a provenance ancestor (or one being an ancestor of
--           another) raise instead of silently double-counting shared
--           evidence. statement_ancestors() exposes the ancestor walk.
-- =============================================================


-- ── Extensions ───────────────────────────────────────────────
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE EXTENSION IF NOT EXISTS "vector";
CREATE EXTENSION IF NOT EXISTS "btree_gist";


-- ── Stable UUID helper ────────────────────────────────────────
-- Derives a deterministic UUID v4-shaped value from a text key.
-- Both overloads are IMMUTABLE for index-friendliness.
-- Known deviation: variant octet is not set per RFC 4122. No practical
-- consequence until external systems validate UUID format strictly.
CREATE OR REPLACE FUNCTION stable_uuid(p_key text)
RETURNS uuid LANGUAGE sql IMMUTABLE STRICT AS $$
    SELECT (
        substring(md5(p_key), 1,  8) || '-' ||
        substring(md5(p_key), 9,  4) || '-4' ||
        substring(md5(p_key), 14, 3) || '-' ||
        substring(md5(p_key), 17, 4) || '-' ||
        substring(md5(p_key), 21, 12)
    )::uuid;
$$;

-- [Fix 22] ':' is the name/kind delimiter, so canonical names must not
-- contain ':' (enforced by a CHECK on objects.canonical_name). Without
-- that guard, stable_uuid('a:b','c') = stable_uuid('a','b:c').
CREATE OR REPLACE FUNCTION stable_uuid(p_name text, p_kind text)
RETURNS uuid LANGUAGE sql IMMUTABLE STRICT AS $$
    SELECT stable_uuid(p_name || ':' || p_kind);
$$;


-- ── Enums ─────────────────────────────────────────────────────

-- Coarse infrastructure kind only.
-- All domain-level typing lives in subtype_of / type_membership.
CREATE TYPE object_kind AS ENUM (
    'entity',     -- persons, institutions, concepts, events, quantities, etc.
    'predicate',  -- relation/property schema objects
    'context',    -- reasoning contexts (reality, domains, theories, fictions…)
    'source'      -- epistemic sources (users, databases, LLMs, …)
);

CREATE TYPE temporal_kind AS ENUM (
    'eternal',    -- true outside of time (mathematical facts, definitions)
    'always',     -- true for all of recorded/modeled time
    'interval',   -- true during [t_start, t_end); both bounds required
    'point',      -- true at a single fuzzy instant; only t_start set
    'default'     -- true until explicitly contradicted (open-world default)
);

CREATE TYPE time_granularity AS ENUM (
    'exact',
    'day',
    'month',
    'year',
    'decade',
    'century',
    'unknown'
);

CREATE TYPE predicate_status AS ENUM (
    'proposed',
    'confirmed',
    'deprecated'
);

-- How strictly predicate domain constraints are enforced.
CREATE TYPE domain_strictness AS ENUM (
    'hard',   -- reject INSERT if domain constraint violated
    'soft',   -- allow INSERT, record type_mismatch conflict
    'none'    -- no domain enforcement
);

CREATE TYPE context_kind AS ENUM (
    'reality',
    'domain',
    'theory',
    'fiction',
    'hypothetical',
    'game'
);

CREATE TYPE derivation_type AS ENUM (
    'axiomatic',
    'user_asserted',
    'source_ingested',
    'forward_chained',
    'abduced',
    'learned'
);

-- direct_negation = evidential opposition, NOT logical negation.
-- Two competing positive statements are stored as two positive statements;
-- their conflict is registered here. The reasoner weighs by effective_mean.
CREATE TYPE conflict_kind AS ENUM (
    'direct_negation',    -- evidential opposition between two competing statements
    'mutual_exclusion',   -- at most one of a set can hold
    'type_violation',     -- argument fails a hard domain constraint
    'type_mismatch',      -- argument fails a soft domain constraint
    'temporal_overlap',   -- two interval statements overlap impossibly
    'value_conflict'      -- literal values are mutually inconsistent
);

-- Epistemic interpretation tag on statements.
CREATE TYPE statement_interpretation AS ENUM (
    'ontological',    -- genuine ontological claim
    'modeling',       -- convenient modeling assumption (e.g. "AI is an agent")
    'legal_fiction',  -- legally or conventionally true, not ontologically
    'metaphorical'    -- figurative / analogical
);

-- Epistemic KIND — governs inference chain participation (Fix 1).
-- ontological : type-hierarchy and definitional claims. Belief fixed at
--               assertion time; update_belief() rejected without override.
--               No conflict penalty; no credibility weighting.
-- empirical   : factual claims about the world. Full belief pipeline:
--               credibility weighting + competition model.
-- statistical : probabilistic patterns (typical_of, correlated_with).
--               Must NOT feed logical inference chains. Hard exception
--               in compute_derived_belief if used as parent.
-- rule        : encoded inference rule. Opaque to all query functions.
CREATE TYPE statement_kind AS ENUM (
    'ontological',
    'empirical',
    'statistical',
    'rule'
);

-- Distinguishes structural from evidential disjointness (Fix 9).
-- constraint      : hard axiom; triggers exception if violated at is_a time.
-- incompatibility : graded evidence; scales competition-model denominator.
CREATE TYPE disjointness_kind AS ENUM (
    'constraint',
    'incompatibility'
);


-- ── Composite type: fuzzy timestamp ──────────────────────────
-- best: Julian Day Number of the central estimate
-- lo/hi: JD uncertainty bounds
-- granularity: precision of the best estimate
--
-- CANONICAL TIME POLICY: this is the ONLY mechanism for encoding
-- temporal bounds on statements. For ternary predicates
-- (located_in, causes…), use t_start/t_end fuzzy_time fields.
-- Use no_period as the third arg when no named period is the
-- semantic argument. Bare year-objects are a category error.
CREATE TYPE fuzzy_time AS (
    best        double precision,   -- JD central estimate
    lo          double precision,   -- JD lower bound
    hi          double precision,   -- JD upper bound
    granularity time_granularity
);

-- [Fix 11] Julian Day Number of 00:00 UTC on 1 January of year y,
-- proleptic Gregorian calendar (matching PostgreSQL's own calendar and
-- the Unix-epoch convention used by jd_to_tstz).
--
-- The v0.8 formula 365.25·(y+4716) − 1524.5 was a fragment of the Meeus
-- algorithm with the month/day term and Gregorian leap correction
-- omitted; it ran ~51 days EARLY, so a year-granularity window labelled
-- "1815" actually covered [1814-11-10, 1815-11-11): queries late in the
-- nominal year missed, and queries in late autumn of the PREVIOUS year
-- falsely matched.
--
-- Standard integer JDN algorithm specialised to (y, 1, 1):
--   a  = 1                       (January ⇒ a = (14−m)/12 = 1)
--   y' = y + 4800 − a = y + 4799
--   m' = m + 12a − 3 = 10
--   JDN(noon) = 1 + (153·m'+2)/5 + 365·y' + y'/4 − y'/100 + y'/400 − 32045
--             = 307 + 365·y' + ⌊y'/4⌋ − ⌊y'/100⌋ + ⌊y'/400⌋ − 32045
--   JD(midnight) = JDN(noon) − 0.5
-- Verified: year_to_jd(2000) = 2451544.5 (true JD of 2000-01-01T00Z).
CREATE OR REPLACE FUNCTION year_to_jd(y integer)
RETURNS double precision LANGUAGE sql IMMUTABLE AS $$
    SELECT (307
            + 365.0 * (y + 4799)
            + floor((y + 4799) / 4.0)
            - floor((y + 4799) / 100.0)
            + floor((y + 4799) / 400.0)
            - 32045) - 0.5;
$$;

CREATE OR REPLACE FUNCTION jd_to_tstz(jd double precision)
RETURNS timestamptz LANGUAGE sql IMMUTABLE AS $$
    SELECT CASE
        WHEN jd IS NULL      THEN NULL
        WHEN jd < 1721425.5  THEN '0001-01-01 00:00:00+00'::timestamptz
        WHEN jd > 5373484.5  THEN '9999-12-31 23:59:59+00'::timestamptz
        ELSE to_timestamp((jd - 2440587.5) * 86400.0)
    END;
$$;

-- [Fix 5] Granularity-aware range for point statements.
-- Uses the lo/hi bounds of the fuzzy_time directly, which encode the
-- granularity window (e.g. year: lo=JD(1815), hi=JD(1816)).
-- For 'exact' granularity where lo=hi, adds 1 second so the range is
-- non-empty and a timestamptz can fall inside it.
CREATE OR REPLACE FUNCTION point_statement_contains(ft fuzzy_time, p_time timestamptz)
RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
    SELECT tstzrange(
        jd_to_tstz(ft.lo),
        CASE
            WHEN ft.granularity = 'exact'
            THEN jd_to_tstz(ft.hi) + INTERVAL '1 second'
            ELSE jd_to_tstz(ft.hi)
        END,
        '[)'
    ) @> p_time;
$$;


-- ── [Fix 12] Attestation evidence scale ───────────────────────
-- One fully-confident attestation (confidence_weight = 1.0) contributes
-- kb_attestation_scale() pseudo-observations to the statement's Beta
-- posterior, split between alpha and beta in proportion to the source's
-- credibility mean:
--   alpha += w · scale · cred_mean
--   beta  += w · scale · (1 − cred_mean)
-- This is the bridge between the attestation/credibility subsystem and
-- statement belief: both update_belief() and attestations now move the
-- SAME posterior (v0.8 kept them in parallel, and the credibility side
-- silently masked the belief side whenever any attestation existed).
-- Tune the constant here if sources should weigh more or less against
-- direct belief updates.
CREATE OR REPLACE FUNCTION kb_attestation_scale()
RETURNS double precision LANGUAGE sql IMMUTABLE AS $$
    SELECT 5.0::double precision;
$$;


-- ── updated_at trigger ────────────────────────────────────────
CREATE OR REPLACE FUNCTION set_updated_at()
RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN
    NEW.updated_at := now();
    RETURN NEW;
END;
$$;


-- =============================================================
-- CORE TABLES
-- =============================================================

-- ── Objects ───────────────────────────────────────────────────
-- Unified namespace for every named entity in the KB.
-- Fine-grained typing is expressed via type_membership (derived from
-- is_a / instance_of statements) and subtype_of statements, NOT via kind.
--
-- [Fix 8] is_sentinel: marks structural placeholder objects (no_scope,
-- no_period, unknown, true, false). Sentinels cannot acquire types,
-- participate in equivalence chains, or appear in structural predicates
-- (is_a, subtype_of, same_as, different_from, equivalent_to).
-- Domain-check and inverse triggers short-circuit on sentinel args.
CREATE TABLE objects (
    id              uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
    kind            object_kind NOT NULL,
    canonical_name  text        NOT NULL,
    display_name    text,
    aliases         text[]      NOT NULL DEFAULT '{}',
    description     text,
    -- [Fix 8] Marks structural placeholder entities.
    is_sentinel     boolean     NOT NULL DEFAULT false,
    embedding       vector(768),
    external_ids    jsonb,
    created_at      timestamptz NOT NULL DEFAULT now(),
    updated_at      timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT canonical_name_kind_unique UNIQUE (canonical_name, kind),
    -- [Fix 22] ':' is reserved as the stable_uuid name/kind delimiter.
    -- Allowing it in names would let two different (name, kind) pairs
    -- collide onto one deterministic UUID.
    CONSTRAINT canonical_name_no_colon CHECK (position(':' in canonical_name) = 0)
);

CREATE INDEX idx_objects_kind      ON objects (kind);
CREATE INDEX idx_objects_sentinel  ON objects (is_sentinel) WHERE is_sentinel;
CREATE INDEX idx_objects_aliases   ON objects USING GIN (aliases);
CREATE INDEX idx_objects_external  ON objects USING GIN (external_ids);
CREATE INDEX idx_objects_embedding ON objects USING hnsw (embedding vector_cosine_ops);

CREATE TRIGGER trg_objects_updated_at
    BEFORE UPDATE ON objects
    FOR EACH ROW EXECUTE FUNCTION set_updated_at();


-- ── Predicate metadata ────────────────────────────────────────
CREATE TABLE predicates (
    id                   uuid               PRIMARY KEY
                             REFERENCES objects (id) ON DELETE CASCADE,
    arity                int                NOT NULL CHECK (arity BETWEEN 1 AND 8),
    arg_labels           text[],
    -- arg_type_ids: expected object type IDs per position.
    -- Enforcement follows domain_strictness: hard → reject; soft → conflict.
    arg_type_ids         uuid[],
    -- inverse_predicate_id: when set, trg_zz_auto_inverse_statement inserts
    -- the inverse statement automatically on binary statement INSERT/UPDATE.
    inverse_predicate_id uuid               REFERENCES objects (id),
    fol_definition       text,
    nl_description       text,
    source_predicate     text,
    is_basis             boolean            NOT NULL DEFAULT false,
    -- [Fix 17] Functional predicate: within one context and overlapping
    -- temporal scope, the first (arity − 1) object args determine the
    -- final arg. Two believed statements that agree on the leading args
    -- but disagree on the last are a genuine contradiction;
    -- detect_conflicts() records them as conflict_kind='value_conflict'.
    -- Example: has_value(entity, attribute, value).
    is_functional        boolean            NOT NULL DEFAULT false,
    domain_strictness    domain_strictness  NOT NULL DEFAULT 'soft',
    status               predicate_status   NOT NULL DEFAULT 'proposed',
    introduced_by        uuid               REFERENCES objects (id),
    introduced_at        timestamptz        NOT NULL DEFAULT now()
);

CREATE INDEX idx_predicates_basis   ON predicates (is_basis) WHERE is_basis;
CREATE INDEX idx_predicates_status  ON predicates (status);
CREATE INDEX idx_predicates_inverse ON predicates (inverse_predicate_id)
    WHERE inverse_predicate_id IS NOT NULL;


-- ── Context metadata ──────────────────────────────────────────
-- Tree structure (parent_id). DAG generalisation planned for v0.9.
CREATE TABLE contexts (
    id          uuid         PRIMARY KEY
                    REFERENCES objects (id) ON DELETE CASCADE,
    kind        context_kind NOT NULL DEFAULT 'reality',
    parent_id   uuid         REFERENCES contexts (id),
    description text
);


-- ── [Fix 15] Context ancestry chain ───────────────────────────
-- Returns the given context plus all of its ancestors (via
-- contexts.parent_id), as a uuid[]. Used by every trigger/view that
-- resolves type membership or ontological axioms, so that:
--   • a statement in context C is checked against axioms visible
--     from C (C itself and the contexts it inherits from), and
--   • sibling contexts (e.g. two fictions, or fiction vs reality)
--     can no longer contaminate each other's type system.
-- The base member does not depend on a contexts row existing, so the
-- function is safe during seeding before contexts rows are inserted
-- (it simply returns {p_context_id}).
-- Depth-capped at 20; the context tree is expected to be shallow.
CREATE OR REPLACE FUNCTION context_chain(p_context_id uuid)
RETURNS uuid[] LANGUAGE sql STABLE AS $$
    WITH RECURSIVE chain AS (
        SELECT p_context_id AS id, 0 AS depth

        UNION ALL

        SELECT c.parent_id, chain.depth + 1
        FROM chain
        JOIN contexts c ON c.id = chain.id
        WHERE c.parent_id IS NOT NULL
          AND chain.depth < 20
    )
    SELECT array_agg(DISTINCT id) FROM chain;
$$;



-- ── Orphan-guard triggers ─────────────────────────────────────
CREATE OR REPLACE FUNCTION guard_predicate_object()
RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN
    IF NEW.kind = 'predicate' THEN
        IF NOT EXISTS (SELECT 1 FROM predicates WHERE id = NEW.id) THEN
            RAISE EXCEPTION
                'objects row with kind=''predicate'' requires a matching predicates row (id=%)',
                NEW.id;
        END IF;
    END IF;
    RETURN NEW;
END;
$$;

CREATE OR REPLACE FUNCTION guard_context_object()
RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN
    IF NEW.kind = 'context' THEN
        IF NOT EXISTS (SELECT 1 FROM contexts WHERE id = NEW.id) THEN
            RAISE EXCEPTION
                'objects row with kind=''context'' requires a matching contexts row (id=%)',
                NEW.id;
        END IF;
    END IF;
    RETURN NEW;
END;
$$;

CREATE CONSTRAINT TRIGGER trg_guard_predicate_object
    AFTER INSERT ON objects
    DEFERRABLE INITIALLY DEFERRED
    FOR EACH ROW EXECUTE FUNCTION guard_predicate_object();

CREATE CONSTRAINT TRIGGER trg_guard_context_object
    AFTER INSERT ON objects
    DEFERRABLE INITIALLY DEFERRED
    FOR EACH ROW EXECUTE FUNCTION guard_context_object();


-- ── Statements ───────────────────────────────────────────────
-- Ground atoms with belief, time, context, and derivation metadata.
--
-- Negation policy:
--   No negated boolean. Logical negation and evidential opposition are
--   expressed via the conflicts table with conflict_kind = 'direct_negation'.
--   Two competing statements coexist; the reasoner weighs by effective_mean.
--
-- Argument caching policy:
--   object_args and literal_args are denormalized caches. The authoritative
--   normalized form is statement_args. trg_sync_statement_args keeps them
--   consistent (with early return on UPDATE when args unchanged, Fix 6).
--
-- Provenance policy:
--   derived_from uuid[] is a fast cache of parent statement IDs.
--   The authoritative provenance record is statement_dependencies.
--   For forward_chained and abduced statements, at least one
--   statement_dependencies row must exist by commit time (enforced by the
--   DEFERRABLE trigger trg_enforce_provenance, now fires on UPDATE too, Fix 6).
--
-- Statement kind policy (Fix 1):
--   statement_kind governs the entire belief pipeline, not just query
--   filtering. Structural predicates must use 'ontological'. Belief on
--   ontological statements is fixed; update_belief() requires p_override.
--
-- Temporal constraints (Fix 5):
--   interval: both t_start and t_end must be non-null.
--   point:    t_start must be non-null; t_end must be null.
--   holds_at() and tell_about() use point_statement_contains() for point
--   overlap, not the old coalesce-to-infinity approach.
--
-- Disjointness kind policy (Fix 9):
--   disjointness_kind is only meaningful for disjoint_with predicate rows.
--   trg_b_enforce_kind_consistency defaults it to 'constraint' on insert
--   and rejects it on any other predicate.
--
-- Statement identity policy (Fix 16):
--   content_hash is computed by trg_a_validate_statement_args over
--   (predicate, object_args, literal_args, context, t_kind, t_start,
--   t_end) and is UNIQUE. One atom = one row. Competing evidence about
--   the same atom merges into that row's Beta (update_belief /
--   attestations) rather than forking a duplicate row; genuinely
--   different claims (different args or different temporal scope) remain
--   distinct rows and are weighed against each other by the conflict
--   machinery. ON CONFLICT (content_hash) DO NOTHING makes seed files
--   idempotent. Belief values are deliberately EXCLUDED from the hash.
CREATE TABLE statements (
    id               uuid                     PRIMARY KEY DEFAULT gen_random_uuid(),
    predicate_id     uuid                     NOT NULL REFERENCES objects (id),

    -- [Fix 16] Identity hash of the atom; set by the BEFORE validation
    -- trigger, never supplied by callers. UNIQUE (uq_stmt_content).
    content_hash     text                     NOT NULL,

    -- [Fix 23] How a derived (forward_chained) statement's belief was
    -- combined from its premises; recompute_derived_belief() replays it
    -- when a parent changes. NULL means 'min'. Meaningless (and left
    -- NULL) on non-derived rows.
    combination_mode text
        CHECK (combination_mode IN ('min', 'noisy_and')),

    -- Denormalized argument cache (authoritative: statement_args)
    object_args      uuid[]                   NOT NULL DEFAULT '{}',
    literal_args     jsonb                    NOT NULL DEFAULT '[]'
                         CHECK (jsonb_typeof(literal_args) = 'array'),

    -- Belief: Beta(alpha, beta) distribution over truth.
    -- For ontological statements, alpha and beta are recorded at assertion
    -- time and must not drift via passive evidence accumulation.
    belief_alpha     double precision         NOT NULL DEFAULT 1.0
                         CHECK (belief_alpha > 0),
    belief_beta      double precision         NOT NULL DEFAULT 1.0
                         CHECK (belief_beta  > 0),
    belief_mean      double precision         GENERATED ALWAYS AS (
                         belief_alpha / (belief_alpha + belief_beta)
                     ) STORED,

    interpretation   statement_interpretation NOT NULL DEFAULT 'ontological',
    statement_kind   statement_kind           NOT NULL DEFAULT 'empirical',

    -- [Fix 9] Only populated for disjoint_with predicate statements.
    -- trg_b_enforce_kind_consistency defaults this to 'constraint' for
    -- disjoint_with and rejects it on all other predicates.
    disjointness_kind disjointness_kind,

    -- Temporal scope (Fix 5: interval/point CHECK constraints enforced here)
    t_kind           temporal_kind            NOT NULL DEFAULT 'default',
    t_start          fuzzy_time,
    t_end            fuzzy_time,
    t_start_ts       timestamptz              GENERATED ALWAYS AS (
                         jd_to_tstz((t_start).best)
                     ) STORED,
    t_end_ts         timestamptz              GENERATED ALWAYS AS (
                         jd_to_tstz((t_end).best)
                     ) STORED,

    -- [Fix 5] Structural temporal constraints.
    CONSTRAINT temporal_interval_bounds CHECK (
        t_kind != 'interval'
        OR (t_start IS NOT NULL AND t_end IS NOT NULL)
    ),
    CONSTRAINT temporal_point_bounds CHECK (
        t_kind != 'point'
        OR (t_start IS NOT NULL AND t_end IS NULL)
    ),

    context_id       uuid                     NOT NULL REFERENCES objects (id),

    derivation_type  derivation_type          NOT NULL DEFAULT 'user_asserted',
    derivation_depth int                      NOT NULL DEFAULT 0
                         CHECK (derivation_depth >= 0),
    -- Denormalized cache; authoritative: statement_dependencies.
    derived_from     uuid[]                   NOT NULL DEFAULT '{}',

    created_at       timestamptz              NOT NULL DEFAULT now(),
    updated_at       timestamptz              NOT NULL DEFAULT now(),

    CONSTRAINT args_nonempty CHECK (
        cardinality(object_args) >= 1
        OR jsonb_array_length(literal_args) >= 1
    )
);

CREATE INDEX idx_stmt_predicate      ON statements (predicate_id);
CREATE INDEX idx_stmt_context        ON statements (context_id);
CREATE INDEX idx_stmt_t_kind         ON statements (t_kind);
CREATE INDEX idx_stmt_deriv_type     ON statements (derivation_type);
CREATE INDEX idx_stmt_belief_mean    ON statements (belief_mean DESC);
CREATE INDEX idx_stmt_object_args    ON statements USING GIN (object_args);
CREATE INDEX idx_stmt_derived_from   ON statements USING GIN (derived_from);
CREATE INDEX idx_stmt_interp         ON statements (interpretation);
CREATE INDEX idx_stmt_kind           ON statements (statement_kind);
CREATE INDEX idx_stmt_disj_kind      ON statements (disjointness_kind)
    WHERE disjointness_kind IS NOT NULL;

CREATE INDEX idx_stmt_temporal_range ON statements USING GIST (
    tstzrange(
        coalesce(t_start_ts, '-infinity'::timestamptz),
        coalesce(t_end_ts,   'infinity'::timestamptz),
        '[)'
    )
) WHERE t_kind IN ('interval', 'point');

CREATE INDEX idx_stmt_eternal ON statements (predicate_id)
    WHERE t_kind = 'eternal';

-- [Fix 16] One atom = one row. The arbiter for idempotent seed inserts.
CREATE UNIQUE INDEX uq_stmt_content ON statements (content_hash);

-- Composite index for detect_conflicts self-join (viable at scale).
CREATE INDEX idx_stmt_conflict_lookup
    ON statements (context_id, predicate_id, object_args)
    WHERE t_kind != 'eternal';

CREATE TRIGGER trg_statements_updated_at
    BEFORE UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION set_updated_at();


-- ── Normalized argument table ─────────────────────────────────
-- Authoritative per-position argument store.
-- object_id XOR literal_value must be non-null (enforced by CHECK).
-- position is 0-based, must be < predicate arity (enforced by trigger).
CREATE TABLE statement_args (
    statement_id  uuid  NOT NULL REFERENCES statements (id) ON DELETE CASCADE,
    position      int   NOT NULL CHECK (position >= 0),
    object_id     uuid  REFERENCES objects (id),
    literal_value jsonb,
    PRIMARY KEY (statement_id, position),
    CONSTRAINT arg_xor CHECK (
        (object_id IS NOT NULL)::int +
        (literal_value IS NOT NULL)::int = 1
    )
);

CREATE INDEX idx_sargs_object ON statement_args (object_id) WHERE object_id IS NOT NULL;
CREATE INDEX idx_sargs_stmt   ON statement_args (statement_id);


-- =============================================================
-- SUPPORTING TABLES
-- =============================================================

-- ── Attestations ─────────────────────────────────────────────
-- Links statements to sources with confidence weight.
-- evidence_group_id groups correlated sources to prevent double-counting.
-- statement_credibility view enforces: each evidence_group_id contributes
-- at most its single highest-weight attestation to the credibility sum.
CREATE TABLE attestations (
    id                uuid             PRIMARY KEY DEFAULT gen_random_uuid(),
    statement_id      uuid             NOT NULL REFERENCES statements (id) ON DELETE CASCADE,
    source_id         uuid             NOT NULL REFERENCES objects (id),
    evidence_group_id uuid,
    confidence_weight double precision NOT NULL DEFAULT 1.0
                          CHECK (confidence_weight BETWEEN 0.0 AND 1.0),
    raw_claim         text,
    url               text,
    accessed_at       timestamptz,
    created_at        timestamptz      NOT NULL DEFAULT now()
);

CREATE INDEX idx_attest_statement      ON attestations (statement_id);
CREATE INDEX idx_attest_source         ON attestations (source_id);
CREATE INDEX idx_attest_evidence_group ON attestations (evidence_group_id)
    WHERE evidence_group_id IS NOT NULL;


-- ── Source credibility ────────────────────────────────────────
-- Beta(alpha, beta) credibility distribution per (source, context).
-- is_protected: if true, update_trust() requires p_override = true.
CREATE TABLE source_credibility (
    source_id    uuid             NOT NULL REFERENCES objects (id),
    context_id   uuid             NOT NULL REFERENCES objects (id),
    alpha        double precision NOT NULL DEFAULT 1.0 CHECK (alpha > 0),
    beta         double precision NOT NULL DEFAULT 1.0 CHECK (beta  > 0),
    is_protected boolean          NOT NULL DEFAULT false,
    updated_at   timestamptz      NOT NULL DEFAULT now(),
    PRIMARY KEY (source_id, context_id)
);


-- ── Statement dependencies ────────────────────────────────────
-- Authoritative provenance graph: (parent → child) derivation edges.
-- Used by compute_derived_belief, why(), and audit trails.
-- derived_from on statements is maintained as a fast cache of parent IDs.
-- [Fix 7] trg_enforce_dependency_acyclicity prevents cycle introduction.
CREATE TABLE statement_dependencies (
    parent_id    uuid             NOT NULL REFERENCES statements (id) ON DELETE CASCADE,
    child_id     uuid             NOT NULL REFERENCES statements (id) ON DELETE CASCADE,
    rule_name    text,
    weight       double precision NOT NULL DEFAULT 1.0 CHECK (weight > 0),
    created_at   timestamptz      NOT NULL DEFAULT now(),
    PRIMARY KEY (parent_id, child_id)
);

CREATE INDEX idx_sdep_child  ON statement_dependencies (child_id);
CREATE INDEX idx_sdep_parent ON statement_dependencies (parent_id);


-- ── Predicate subsumption ─────────────────────────────────────
CREATE TABLE predicate_subsumption (
    child_id    uuid             NOT NULL REFERENCES objects (id),
    parent_id   uuid             NOT NULL REFERENCES objects (id),
    alpha       double precision NOT NULL DEFAULT 1.0 CHECK (alpha > 0),
    beta        double precision NOT NULL DEFAULT 1.0 CHECK (beta  > 0),
    context_id  uuid             REFERENCES objects (id),
    PRIMARY KEY (child_id, parent_id)
);


-- ── Type membership ───────────────────────────────────────────
-- Derived cache of is_a / instance_of statements.
-- INVARIANT: never assert rows here directly. Populated exclusively by
-- trg_sync_type_membership. Querying this reflects all committed is_a
-- assertions but NOT transitive closure via subtype_of (resolved on
-- demand by check_soft_domain_violations recursive CTE).
-- [Fix 8] Sentinel objects cannot appear as object_id here; the sync
-- trigger short-circuits if either arg is a sentinel.
-- [Fix 15] context_id is part of the primary key. In v0.8 the PK was
-- (object_id, type_id) with last-write-wins upserts, so an is_a asserted
-- in a fiction context silently OVERWROTE the reality-context cache row
-- for the same pair. Memberships are now cached per context; readers
-- resolve visibility through context_chain().
CREATE TABLE type_membership (
    object_id   uuid             NOT NULL REFERENCES objects (id),
    type_id     uuid             NOT NULL REFERENCES objects (id),
    alpha       double precision NOT NULL DEFAULT 1.0 CHECK (alpha > 0),
    beta        double precision NOT NULL DEFAULT 1.0 CHECK (beta  > 0),
    context_id  uuid             NOT NULL REFERENCES objects (id),
    PRIMARY KEY (object_id, type_id, context_id)
);

CREATE INDEX idx_typemem_type   ON type_membership (type_id);
CREATE INDEX idx_typemem_object ON type_membership (object_id);


-- ── Conflicts ─────────────────────────────────────────────────
-- Records detected conflicts between statements.
-- direct_negation = evidential opposition, not logical negation.
-- severity: normalised CI gap in [0, 1]. Retained as a diagnostic column
-- but no longer used directly in effective_mean computation; the
-- competition model (Fix 2) uses credibility_adjusted sums instead.
-- type_mismatch conflicts may be self-referential (statement_a = statement_b).
CREATE TABLE conflicts (
    id              uuid             PRIMARY KEY DEFAULT gen_random_uuid(),
    statement_a     uuid             NOT NULL REFERENCES statements (id),
    statement_b     uuid             NOT NULL REFERENCES statements (id),
    conflict_kind   conflict_kind,
    severity        double precision CHECK (severity IS NULL OR severity BETWEEN 0.0 AND 1.0),
    resolved        boolean          NOT NULL DEFAULT false,
    resolution_note text,
    created_at      timestamptz      NOT NULL DEFAULT now()
);

CREATE INDEX idx_conflicts_a        ON conflicts (statement_a);
CREATE INDEX idx_conflicts_b        ON conflicts (statement_b);
CREATE INDEX idx_conflicts_resolved ON conflicts (resolved) WHERE NOT resolved;
CREATE INDEX idx_conflicts_severity ON conflicts (severity DESC)
    WHERE resolved = false AND severity IS NOT NULL;
CREATE INDEX idx_conflicts_kind     ON conflicts (conflict_kind) WHERE NOT resolved;

-- [Fix 18] At most one open-or-resolved conflict row per unordered
-- statement pair and kind, for the pair-shaped kinds. Prevents (a)
-- duplicate rows from concurrent / repeated detect_conflicts() runs and
-- (b) double-counting the same opponent in the competition denominator
-- of statement_effective_belief (which sums per conflict row).
CREATE UNIQUE INDEX uq_conflicts_pair ON conflicts (
    LEAST(statement_a, statement_b),
    GREATEST(statement_a, statement_b),
    conflict_kind
) WHERE conflict_kind IN ('direct_negation', 'value_conflict');


-- ── Object equivalence ────────────────────────────────────────
-- Probabilistic same-as links for entity resolution.
CREATE TABLE object_equivalence (
    object_a   uuid             NOT NULL REFERENCES objects (id),
    object_b   uuid             NOT NULL REFERENCES objects (id),
    alpha      double precision NOT NULL DEFAULT 1.0 CHECK (alpha > 0),
    beta       double precision NOT NULL DEFAULT 1.0 CHECK (beta  > 0),
    context_id uuid             REFERENCES objects (id),
    PRIMARY KEY (object_a, object_b),
    CONSTRAINT equiv_no_self   CHECK (object_a <> object_b),
    CONSTRAINT equiv_canonical CHECK (object_a < object_b)
);

CREATE INDEX idx_equiv_b ON object_equivalence (object_b);


-- =============================================================
-- TRIGGER FUNCTIONS
-- Naming convention for BEFORE triggers on statements:
--   trg_a_ … trg_e_: fire in alphabetical order before row insertion.
-- Naming convention for AFTER triggers on statements:
--   trg_sync_*: normalize data first.
--   trg_z_*:    domain/constraint checks (after type_membership is populated).
--   trg_za_*:   disjointness enforcement (after domain check).
--   trg_zz_*:   inverse automation (last).
-- =============================================================

-- ── [Fix 4] Predicate → statement_kind consistency (BEFORE) ──
-- Enforces that certain predicates can only appear with specific
-- statement_kinds. Prevents statistical leakage into logical chains
-- at insertion time rather than at query time.
-- Also defaults disjointness_kind to 'constraint' for disjoint_with,
-- and rejects disjointness_kind on any other predicate.
CREATE OR REPLACE FUNCTION enforce_kind_consistency()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_required_kind statement_kind;
BEGIN
    -- Determine required kind for this predicate
    CASE NEW.predicate_id
        WHEN stable_uuid('correlated_with', 'predicate'),
             stable_uuid('typical_of',      'predicate')
        THEN v_required_kind := 'statistical';

        WHEN stable_uuid('implies', 'predicate')
        THEN v_required_kind := 'rule';

        WHEN stable_uuid('subtype_of',    'predicate'),
             stable_uuid('disjoint_with', 'predicate'),
             stable_uuid('equivalent_to', 'predicate'),
             stable_uuid('opposite_of',   'predicate'),
             stable_uuid('different_from','predicate')
        THEN v_required_kind := 'ontological';

        ELSE v_required_kind := NULL;  -- no constraint; any kind accepted
    END CASE;

    IF v_required_kind IS NOT NULL AND NEW.statement_kind != v_required_kind THEN
        RAISE EXCEPTION
            'Predicate % requires statement_kind=''%'' but got ''%''. '
            'Insert the statement with the correct kind.',
            NEW.predicate_id, v_required_kind, NEW.statement_kind;
    END IF;

    -- [Fix 9] disjointness_kind handling
    IF NEW.predicate_id = stable_uuid('disjoint_with', 'predicate') THEN
        -- Default disjointness_kind to 'constraint' when not supplied
        IF NEW.disjointness_kind IS NULL THEN
            NEW.disjointness_kind := 'constraint';
        END IF;
    ELSE
        -- disjointness_kind must not be set on any other predicate
        IF NEW.disjointness_kind IS NOT NULL THEN
            RAISE EXCEPTION
                'disjointness_kind can only be set on disjoint_with predicate statements, '
                'but predicate_id is %', NEW.predicate_id;
        END IF;
    END IF;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_b_enforce_kind_consistency
    BEFORE INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION enforce_kind_consistency();


-- ── [Fix 3] is_a target enforcement (BEFORE) ─────────────────
-- Prevents is_a from targeting objects in the role hierarchy.
-- Role assertions must use has_role(entity, role, scope).
-- is_a is reserved for ontological kind membership.
-- Safe to apply before role hierarchy is seeded: if 'role' entity
-- does not exist in subtype_of, the CTE returns empty and no check fires.
CREATE OR REPLACE FUNCTION enforce_is_a_target()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_target_is_role boolean;
BEGIN
    IF NEW.predicate_id != stable_uuid('is_a', 'predicate') THEN
        RETURN NEW;
    END IF;

    IF cardinality(NEW.object_args) < 2 THEN
        RETURN NEW;
    END IF;

    -- Walk upward from 'role' entity via subtype_of to find all role-kind types.
    -- If the proposed is_a target is one of them, reject.
    WITH RECURSIVE role_hierarchy AS (
        SELECT stable_uuid('role', 'entity') AS type_id

        UNION

        SELECT s.object_args[1]
        FROM role_hierarchy rh
        JOIN statements s
          ON s.object_args[2] = rh.type_id
         AND s.predicate_id   = stable_uuid('subtype_of', 'predicate')
         -- [Fix 15] Only role axioms visible from this statement's
         -- context (the context itself plus its ancestors) apply.
         AND s.context_id     = ANY (context_chain(NEW.context_id))
    )
    SELECT EXISTS (
        SELECT 1 FROM role_hierarchy WHERE type_id = NEW.object_args[2]
    ) INTO v_target_is_role;

    IF v_target_is_role THEN
        RAISE EXCEPTION
            'is_a target % is in the role hierarchy. '
            'Use has_role(entity, role, scope) for role assertions. '
            'is_a is reserved for ontological kind membership.',
            NEW.object_args[2];
    END IF;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_c_enforce_is_a_target
    BEFORE INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION enforce_is_a_target();


-- ── [Fix 8] Sentinel usage enforcement (BEFORE) ──────────────
-- Sentinel objects (no_scope, no_period, unknown, true, false) cannot
-- appear as arguments of structural predicates:
--   is_a, subtype_of, same_as, different_from, equivalent_to.
-- These predicates build the ontological scaffold; sentinels must
-- not acquire types or participate in equivalence chains.
-- Domain-check and inverse triggers also short-circuit on sentinels.
CREATE OR REPLACE FUNCTION enforce_sentinel_usage()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_is_structural_pred boolean;
    v_has_sentinel_arg   boolean;
BEGIN
    -- Only enforce on structural predicates
    v_is_structural_pred :=
        NEW.predicate_id = stable_uuid('is_a',          'predicate') OR
        NEW.predicate_id = stable_uuid('subtype_of',    'predicate') OR
        NEW.predicate_id = stable_uuid('same_as',       'predicate') OR
        NEW.predicate_id = stable_uuid('different_from','predicate') OR
        NEW.predicate_id = stable_uuid('equivalent_to', 'predicate');

    IF NOT v_is_structural_pred THEN
        RETURN NEW;
    END IF;

    SELECT EXISTS (
        SELECT 1
        FROM unnest(NEW.object_args) AS oid
        JOIN objects o ON o.id = oid
        WHERE o.is_sentinel
    ) INTO v_has_sentinel_arg;

    IF v_has_sentinel_arg THEN
        RAISE EXCEPTION
            'Sentinel objects cannot appear as arguments of structural predicates '
            '(is_a, subtype_of, same_as, different_from, equivalent_to). '
            'Statement predicate_id: %', NEW.predicate_id;
    END IF;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_d_enforce_sentinel_usage
    BEFORE INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION enforce_sentinel_usage();


-- ── [Fix 7] Subtype acyclicity enforcement (BEFORE) ──────────
-- Prevents cycles in the subtype_of hierarchy by checking, before
-- insertion, whether the proposed supertype is already reachable
-- from the proposed subtype via existing subtype_of edges.
-- Depth capped at 50; exceeding the cap also raises an exception
-- (a very deep hierarchy is itself a likely data error).
CREATE OR REPLACE FUNCTION enforce_subtype_acyclicity()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_creates_cycle boolean;
BEGIN
    IF NEW.predicate_id != stable_uuid('subtype_of', 'predicate') THEN
        RETURN NEW;
    END IF;

    IF cardinality(NEW.object_args) < 2 THEN
        RETURN NEW;
    END IF;

    -- Check: is the proposed subtype (object_args[1]) reachable from
    -- the proposed supertype (object_args[2]) via existing subtype_of edges?
    -- If yes, inserting this edge creates subtype_of(A, B) where B already
    -- reaches A, making a cycle.
    WITH RECURSIVE reachable AS (
        SELECT NEW.object_args[2] AS type_id, 0 AS depth

        UNION ALL

        SELECT s.object_args[2], r.depth + 1
        FROM reachable r
        JOIN statements s
          ON s.object_args[1]  = r.type_id
         AND s.predicate_id    = stable_uuid('subtype_of', 'predicate')
         -- [Fix 15] A cycle is only a cycle through edges visible from
         -- this statement's context chain; sibling contexts may reuse
         -- type names without interfering.
         AND s.context_id      = ANY (context_chain(NEW.context_id))
        WHERE r.depth < 50
    )
    SELECT EXISTS (
        SELECT 1 FROM reachable WHERE type_id = NEW.object_args[1]
    ) INTO v_creates_cycle;

    IF v_creates_cycle THEN
        RAISE EXCEPTION
            'Subtype acyclicity violation: subtype_of(%, %) would introduce a cycle '
            'or exceeds depth-50 search limit.',
            NEW.object_args[1], NEW.object_args[2];
    END IF;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_e_enforce_subtype_acyclicity
    BEFORE INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION enforce_subtype_acyclicity();


-- ── Arity validation (BEFORE) ─────────────────────────────────
-- Validates arity and duplicate literal positions on INSERT/UPDATE.
CREATE OR REPLACE FUNCTION validate_statement_args()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_arity   int;
    v_total   int;
    v_dup_pos int;
BEGIN
    SELECT arity INTO v_arity FROM predicates WHERE id = NEW.predicate_id;

    IF v_arity IS NULL THEN
        RAISE EXCEPTION 'predicate % not found in predicates table', NEW.predicate_id;
    END IF;

    v_total := cardinality(NEW.object_args) + jsonb_array_length(NEW.literal_args);

    IF v_total != v_arity THEN
        RAISE EXCEPTION
            'argument count mismatch: predicate arity=%, got object_args=% + literal_args=%',
            v_arity, cardinality(NEW.object_args), jsonb_array_length(NEW.literal_args);
    END IF;

    SELECT count(*) INTO v_dup_pos
    FROM (
        SELECT elem->>'pos'
        FROM jsonb_array_elements(NEW.literal_args) AS elem
        GROUP BY elem->>'pos'
        HAVING count(*) > 1
    ) dups;

    IF v_dup_pos > 0 THEN
        RAISE EXCEPTION 'literal_args contains duplicate pos values';
    END IF;

    -- [Fix 16] Identity hash of the atom. Covers everything that makes a
    -- statement a distinct proposition: predicate, arguments, context,
    -- and temporal scope. Belief (alpha/beta), interpretation, and
    -- derivation metadata are deliberately EXCLUDED: those describe our
    -- attitude towards the atom, not the atom itself. Computed on both
    -- INSERT and UPDATE so an arg/scope edit re-keys the row (and is
    -- rejected by uq_stmt_content if it would collide with an existing
    -- atom). '|' separators prevent field-boundary ambiguity.
    NEW.content_hash := md5(
        NEW.predicate_id::text
        || '|' || array_to_string(NEW.object_args, ',')
        || '|' || NEW.literal_args::text
        || '|' || NEW.context_id::text
        || '|' || NEW.t_kind::text
        || '|' || coalesce(NEW.t_start::text, '')
        || '|' || coalesce(NEW.t_end::text,   '')
    );

    RETURN NEW;
END;
$$;

-- Named trg_a_ so it fires first among BEFORE triggers on statements.
CREATE TRIGGER trg_a_validate_statement_args
    BEFORE INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION validate_statement_args();


-- ── [Fix 6] Sync trigger: statements → statement_args ─────────
-- [Fix 6] Early return on UPDATE when args are unchanged, eliminating
-- index churn on the most frequent write path (update_belief calls).
CREATE OR REPLACE FUNCTION sync_statement_args()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_pos     int;
    v_elem    jsonb;
    v_lit_pos int;
BEGIN
    -- [Fix 6] Short-circuit: skip DELETE/reinsert if args have not changed.
    IF TG_OP = 'UPDATE'
       AND NEW.object_args  = OLD.object_args
       AND NEW.literal_args = OLD.literal_args
    THEN
        RETURN NEW;
    END IF;

    DELETE FROM statement_args WHERE statement_id = NEW.id;

    FOR v_pos IN 1 .. cardinality(NEW.object_args) LOOP
        INSERT INTO statement_args (statement_id, position, object_id)
        VALUES (NEW.id, v_pos - 1, NEW.object_args[v_pos]);
    END LOOP;

    FOR v_pos IN 0 .. jsonb_array_length(NEW.literal_args) - 1 LOOP
        v_elem    := NEW.literal_args -> v_pos;
        v_lit_pos := COALESCE((v_elem->>'pos')::int,
                              cardinality(NEW.object_args) + v_pos);
        INSERT INTO statement_args (statement_id, position, literal_value)
        VALUES (NEW.id, v_lit_pos, v_elem);
    END LOOP;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_sync_statement_args
    AFTER INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION sync_statement_args();


-- ── Type membership sync: is_a / instance_of → type_membership ──
-- Sole write path for type_membership. Fires on INSERT/UPDATE for
-- is_a and instance_of predicates.
-- [Fix 8] Short-circuits if either arg is a sentinel object.
-- Entity-type: object_args[1]. Type: object_args[2].
-- [Fix 15] Upserts are keyed per (object, type, CONTEXT): an is_a in a
-- fiction context maintains its own cache row and can no longer clobber
-- the reality row for the same pair.
-- [Fix 22] Lifecycle handling: the trigger now also fires on DELETE, and
-- on UPDATE it cleans up the OLD (object, type, context) cache row when
-- the args or context changed. Stale rows are either re-derived from the
-- strongest remaining supporting statement or removed when no supporting
-- statement is left — type_membership can no longer drift out of sync
-- with the statements that justify it.
CREATE OR REPLACE FUNCTION sync_type_membership_from_is_a()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_entity_is_sentinel boolean;
    v_type_is_sentinel   boolean;
    v_typing_pred        boolean;
    v_old_typing_pred    boolean;
BEGIN
    -- TG_OP is tested in separate IF branches (not AND-chained) because
    -- PL/pgSQL does not guarantee short-circuit evaluation, and NEW/OLD
    -- are unassigned in DELETE/INSERT triggers respectively.
    IF TG_OP = 'DELETE' THEN
        v_typing_pred := false;
    ELSE
        v_typing_pred := NEW.predicate_id IN (
            stable_uuid('instance_of', 'predicate'),
            stable_uuid('is_a',        'predicate')
        );
    END IF;

    IF TG_OP = 'INSERT' THEN
        v_old_typing_pred := false;
    ELSE
        v_old_typing_pred := OLD.predicate_id IN (
            stable_uuid('instance_of', 'predicate'),
            stable_uuid('is_a',        'predicate')
        );
    END IF;

    -- ── Stale-row cleanup (UPDATE that changed the pair, or DELETE) ──
    IF v_old_typing_pred
       AND cardinality(OLD.object_args) >= 2
       AND (
           TG_OP = 'DELETE'
           OR NOT v_typing_pred
           OR OLD.object_args[1] IS DISTINCT FROM NEW.object_args[1]
           OR OLD.object_args[2] IS DISTINCT FROM NEW.object_args[2]
           OR OLD.context_id     IS DISTINCT FROM NEW.context_id
       )
    THEN
        -- Re-derive the OLD cache row from the strongest remaining
        -- supporting statement (same pair + context may be asserted with
        -- several temporal scopes), or remove it if none remain.
        UPDATE type_membership tm
           SET alpha = sup.belief_alpha,
               beta  = sup.belief_beta
          FROM (
              SELECT s.belief_alpha, s.belief_beta
              FROM statements s
              WHERE s.predicate_id IN (stable_uuid('is_a',        'predicate'),
                                       stable_uuid('instance_of', 'predicate'))
                AND s.object_args[1] = OLD.object_args[1]
                AND s.object_args[2] = OLD.object_args[2]
                AND s.context_id     = OLD.context_id
                AND s.id            != OLD.id
              ORDER BY s.belief_mean DESC
              LIMIT 1
          ) sup
         WHERE tm.object_id  = OLD.object_args[1]
           AND tm.type_id    = OLD.object_args[2]
           AND tm.context_id = OLD.context_id;

        IF NOT FOUND THEN
            DELETE FROM type_membership tm
            WHERE tm.object_id  = OLD.object_args[1]
              AND tm.type_id    = OLD.object_args[2]
              AND tm.context_id = OLD.context_id
              AND NOT EXISTS (
                  SELECT 1 FROM statements s
                  WHERE s.predicate_id IN (stable_uuid('is_a',        'predicate'),
                                           stable_uuid('instance_of', 'predicate'))
                    AND s.object_args[1] = OLD.object_args[1]
                    AND s.object_args[2] = OLD.object_args[2]
                    AND s.context_id     = OLD.context_id
                    AND s.id            != OLD.id
              );
        END IF;
    END IF;

    IF NOT v_typing_pred THEN
        RETURN COALESCE(NEW, OLD);
    END IF;

    IF cardinality(NEW.object_args) < 2 THEN
        RETURN NEW;
    END IF;

    -- [Fix 8] Skip if either arg is a sentinel; sentinels must not acquire types.
    SELECT is_sentinel INTO v_entity_is_sentinel FROM objects WHERE id = NEW.object_args[1];
    SELECT is_sentinel INTO v_type_is_sentinel   FROM objects WHERE id = NEW.object_args[2];

    IF COALESCE(v_entity_is_sentinel, false) OR COALESCE(v_type_is_sentinel, false) THEN
        RETURN NEW;
    END IF;

    INSERT INTO type_membership (object_id, type_id, alpha, beta, context_id)
    VALUES (
        NEW.object_args[1],
        NEW.object_args[2],
        NEW.belief_alpha,
        NEW.belief_beta,
        NEW.context_id
    )
    ON CONFLICT (object_id, type_id, context_id) DO UPDATE
        SET alpha = EXCLUDED.alpha,
            beta  = EXCLUDED.beta;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_sync_type_membership
    AFTER INSERT OR UPDATE OR DELETE ON statements
    FOR EACH ROW EXECUTE FUNCTION sync_type_membership_from_is_a();


-- ── Soft domain violation check ───────────────────────────────
-- Fires AFTER INSERT OR UPDATE on statements. Checks each object argument
-- against the predicate's arg_type_ids.
--
-- Type membership is resolved via recursive CTE over subtype_of (transitive
-- closure at enforcement time). Predicates constraining args to abstract
-- types (e.g. animate) correctly accept subtypes (e.g. person → animate).
--
-- [Fix 8] Short-circuits if any object argument is a sentinel, so sentinels
-- can appear in functional predicates (has_role, located_in) without
-- triggering domain warnings against expected ontological types.
CREATE OR REPLACE FUNCTION check_soft_domain_violations()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_arg_type_ids  uuid[];
    v_strictness    domain_strictness;
    v_pos           int;
    v_expected_type uuid;
    v_actual_obj    uuid;
    v_type_ok       boolean;
    v_is_sentinel   boolean;
    -- [Fix 15] Axiom visibility for this statement's context.
    v_ctx_chain     uuid[];
    v_note          text;
BEGIN
    v_ctx_chain := context_chain(NEW.context_id);
    SELECT p.arg_type_ids, p.domain_strictness
    INTO v_arg_type_ids, v_strictness
    FROM predicates p
    WHERE p.id = NEW.predicate_id;

    IF v_arg_type_ids IS NULL OR v_strictness = 'none' THEN
        RETURN NEW;
    END IF;

    FOR v_pos IN 1 .. cardinality(NEW.object_args) LOOP
        v_expected_type := v_arg_type_ids[v_pos];
        v_actual_obj    := NEW.object_args[v_pos];

        CONTINUE WHEN v_expected_type IS NULL;

        -- [Fix 8] Short-circuit for sentinel objects in any position.
        SELECT is_sentinel INTO v_is_sentinel FROM objects WHERE id = v_actual_obj;
        CONTINUE WHEN COALESCE(v_is_sentinel, false);

        -- Resolve type membership transitively via subtype_of.
        -- [Fix 15] Both the membership rows and the subtype edges are
        -- restricted to this statement's context chain.
        WITH RECURSIVE type_closure AS (
            SELECT tm.object_id, tm.type_id
            FROM type_membership tm
            WHERE tm.object_id = v_actual_obj
              AND tm.context_id = ANY (v_ctx_chain)
              AND (tm.alpha / (tm.alpha + tm.beta)) > 0.5

            UNION

            SELECT tc.object_id, s.object_args[2]
            FROM type_closure tc
            JOIN statements s
              ON s.object_args[1] = tc.type_id
             AND s.predicate_id   = stable_uuid('subtype_of', 'predicate')
             AND s.context_id     = ANY (v_ctx_chain)
             AND s.belief_mean    > 0.9
        )
        SELECT EXISTS (
            SELECT 1 FROM type_closure WHERE type_id = v_expected_type
        ) INTO v_type_ok;

        IF NOT v_type_ok THEN
            IF v_strictness = 'hard' THEN
                RAISE EXCEPTION
                    'Hard domain violation on statement %: arg at position % (object %) '
                    'is not a confirmed member of expected type % '
                    '(checked transitively via subtype_of)',
                    NEW.id, v_pos - 1, v_actual_obj, v_expected_type;
            ELSIF v_strictness = 'soft' THEN
                v_note := format(
                    'Soft domain violation: arg at position %s (object %s) '
                    'is not a confirmed member of expected type %s '
                    '(checked transitively via subtype_of)',
                    v_pos - 1, v_actual_obj, v_expected_type
                );
                -- [Fix 18] This trigger fires on every UPDATE of the row,
                -- including the hot update_belief() path. Without this
                -- guard, each belief update of a soft-violating statement
                -- re-inserted a duplicate type_mismatch conflict, growing
                -- the conflicts table without bound.
                INSERT INTO conflicts (
                    statement_a, statement_b, conflict_kind, resolution_note
                )
                SELECT NEW.id, NEW.id, 'type_mismatch', v_note
                WHERE NOT EXISTS (
                    SELECT 1 FROM conflicts c
                    WHERE c.statement_a     = NEW.id
                      AND c.statement_b     = NEW.id
                      AND c.conflict_kind   = 'type_mismatch'
                      AND c.resolution_note = v_note
                );
            END IF;
        END IF;
    END LOOP;

    RETURN NEW;
END;
$$;

-- Named trg_z_ to sort AFTER trg_sync_type_membership so the cache is
-- populated before domain checks read from it.
CREATE TRIGGER trg_z_soft_domain_check
    AFTER INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION check_soft_domain_violations();


-- ── [Fix 9] Disjointness constraint enforcement ───────────────
-- Fires AFTER INSERT OR UPDATE for is_a / instance_of statements.
--
-- Two recursive CTEs are used:
--
--   asserted_type_ancestors: walks upward from the newly asserted type via
--     subtype_of to find all constraint disjoint_with axioms that apply to it
--     or any of its supertypes.
--
--   entity_type_closure: walks upward from every type the entity already holds
--     (via type_membership) through subtype_of, giving the full transitive set
--     of types the entity is known to belong to.
--
-- The check fails (and the insert is rejected) when any candidate disjoint_type
-- from the first CTE is reachable in the entity's transitive type closure.
--
-- Rationale for the second CTE: type_membership stores only direct is_a
-- assertions. An entity typed as 'artifact' implicitly belongs to 'concrete'
-- (via artifact ⊂ phys_obj ⊂ concrete) but that row does not appear in
-- type_membership. Without transitive closure the guard silently passes for
-- indirect memberships, which was the original bug.
--
-- Named trg_za_ to fire after domain check (trg_z_) but before inverse
-- automation (trg_zz_).
CREATE OR REPLACE FUNCTION enforce_disjointness_constraints()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_entity_id     uuid;
    v_asserted_type uuid;
    v_disjoint_rec  RECORD;
BEGIN
    IF NEW.predicate_id NOT IN (
        stable_uuid('is_a',         'predicate'),
        stable_uuid('instance_of',  'predicate')
    ) THEN
        RETURN NEW;
    END IF;

    IF cardinality(NEW.object_args) < 2 THEN
        RETURN NEW;
    END IF;

    v_entity_id     := NEW.object_args[1];
    v_asserted_type := NEW.object_args[2];

    -- Step 1: find every constraint disjoint_with axiom that applies to the
    -- asserted type or any of its supertypes.
    FOR v_disjoint_rec IN
        WITH RECURSIVE asserted_type_ancestors AS (
            SELECT v_asserted_type AS type_id

            UNION

            SELECT s.object_args[2]
            FROM asserted_type_ancestors ta
            JOIN statements s
              ON s.object_args[1] = ta.type_id
             AND s.predicate_id   = stable_uuid('subtype_of', 'predicate')
             -- [Fix 15] Only edges visible from this statement's context.
             AND s.context_id     = ANY (context_chain(NEW.context_id))
             AND s.belief_mean    > 0.9
        )
        SELECT
            dw.id                                           AS dw_id,
            CASE
                WHEN dw.object_args[1] = ta.type_id
                THEN dw.object_args[2]
                ELSE dw.object_args[1]
            END                                             AS disjoint_type
        FROM statements dw
        JOIN asserted_type_ancestors ta
          ON (dw.object_args[1] = ta.type_id OR dw.object_args[2] = ta.type_id)
        WHERE dw.predicate_id      = stable_uuid('disjoint_with', 'predicate')
          AND dw.disjointness_kind = 'constraint'
          -- [Fix 15] A disjointness axiom asserted inside a game or
          -- fiction context must not block reality inserts (and vice
          -- versa for sibling contexts).
          AND dw.context_id        = ANY (context_chain(NEW.context_id))
    LOOP
        -- Step 2: check whether the entity already belongs to the disjoint type,
        -- resolving transitively through subtype_of so that indirect memberships
        -- (e.g. artifact → phys_obj → concrete) are also caught.
        IF EXISTS (
            WITH RECURSIVE entity_type_closure AS (
                SELECT tm.type_id
                FROM type_membership tm
                WHERE tm.object_id  = v_entity_id
                  -- [Fix 15] Memberships visible from this context only.
                  AND tm.context_id = ANY (context_chain(NEW.context_id))

                UNION

                SELECT s.object_args[2]
                FROM entity_type_closure tc
                JOIN statements s
                  ON s.object_args[1] = tc.type_id
                 AND s.predicate_id   = stable_uuid('subtype_of', 'predicate')
                 AND s.context_id     = ANY (context_chain(NEW.context_id))
                 AND s.belief_mean    > 0.9
            )
            SELECT 1 FROM entity_type_closure
            WHERE type_id = v_disjoint_rec.disjoint_type
        ) THEN
            RAISE EXCEPTION
                'Disjointness constraint violated: entity % cannot be simultaneously '
                'typed as % and % (constraint disjoint_with axiom %).',
                v_entity_id, v_asserted_type,
                v_disjoint_rec.disjoint_type, v_disjoint_rec.dw_id;
        END IF;
    END LOOP;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_za_enforce_disjointness
    AFTER INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION enforce_disjointness_constraints();


-- ── [Fix 6] Provenance enforcement ───────────────────────────
-- DEFERRABLE INITIALLY DEFERRED constraint trigger.
-- [Fix 6] Now fires on INSERT OR UPDATE (was INSERT only).
-- At commit time, verifies that any forward_chained or abduced statement
-- has at least one statement_dependencies row. This enforces
-- statement_dependencies as the authoritative provenance record.
CREATE OR REPLACE FUNCTION enforce_provenance_dependencies()
RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN
    IF NEW.derivation_type IN ('forward_chained', 'abduced') THEN
        IF NOT EXISTS (
            SELECT 1 FROM statement_dependencies WHERE child_id = NEW.id
        ) THEN
            RAISE EXCEPTION
                'Provenance violation: statement % has derivation_type=% but no '
                'statement_dependencies rows exist. Insert at least one dependency '
                'row in the same transaction before commit.',
                NEW.id, NEW.derivation_type;
        END IF;
    END IF;
    RETURN NEW;
END;
$$;

CREATE CONSTRAINT TRIGGER trg_enforce_provenance
    AFTER INSERT OR UPDATE ON statements
    DEFERRABLE INITIALLY DEFERRED
    FOR EACH ROW EXECUTE FUNCTION enforce_provenance_dependencies();


-- ── [Fix 6] Inverse predicate automation ─────────────────────
-- [Fix 6] Now fires on INSERT OR UPDATE.
-- INSERT path: creates the inverse statement as forward_chained.
-- UPDATE path: propagates belief changes to the existing inverse statement.
-- Both paths guard against sentinel args (Fix 8).
-- Named trg_zz_ to fire last among AFTER triggers on statements.
CREATE OR REPLACE FUNCTION auto_insert_inverse_statement()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_inverse_pred_id uuid;
    v_inverse_stmt_id uuid;
    v_has_sentinel    boolean;
BEGIN
    IF cardinality(NEW.object_args) != 2 THEN
        RETURN NEW;
    END IF;

    SELECT p.inverse_predicate_id INTO v_inverse_pred_id
    FROM predicates p
    WHERE p.id = NEW.predicate_id;

    IF v_inverse_pred_id IS NULL THEN
        RETURN NEW;
    END IF;

    -- [Fix 8] Short-circuit if any arg is a sentinel.
    SELECT EXISTS (
        SELECT 1 FROM unnest(NEW.object_args) oid
        JOIN objects o ON o.id = oid
        WHERE o.is_sentinel
    ) INTO v_has_sentinel;

    IF v_has_sentinel THEN
        RETURN NEW;
    END IF;

    IF TG_OP = 'UPDATE' THEN
        -- [Fix 19] UPDATE path: propagate belief change to the mirror
        -- statement REGARDLESS of how the mirror was derived. The v0.8
        -- path matched only derivation_type='forward_chained' mirrors,
        -- so calling update_belief() on the auto-created inverse (a
        -- perfectly ordinary, query-visible statement) silently failed
        -- to propagate back to the user-asserted original — exactly the
        -- divergence the inverse machinery exists to prevent.
        --
        -- Recursion safety: the IS DISTINCT FROM predicate on the target
        -- makes the second hop a no-op. A→B sets B's belief equal to
        -- A's; B's own trigger then finds A already equal and matches
        -- zero rows.
        --
        -- The mirror is matched per temporal scope (t_kind / t_start /
        -- t_end) so that multiple scoped assertions of the same pair
        -- each sync with their own inverse.
        IF NEW.belief_alpha != OLD.belief_alpha OR NEW.belief_beta != OLD.belief_beta THEN
            UPDATE statements
               SET belief_alpha = NEW.belief_alpha,
                   belief_beta  = NEW.belief_beta,
                   updated_at   = now()
             WHERE predicate_id = v_inverse_pred_id
               AND object_args  = ARRAY[NEW.object_args[2], NEW.object_args[1]]
               AND context_id   = NEW.context_id
               AND t_kind       = NEW.t_kind
               AND t_start IS NOT DISTINCT FROM NEW.t_start
               AND t_end   IS NOT DISTINCT FROM NEW.t_end
               AND (belief_alpha IS DISTINCT FROM NEW.belief_alpha
                    OR belief_beta IS DISTINCT FROM NEW.belief_beta);
        END IF;
        RETURN NEW;
    END IF;

    -- INSERT path: create the inverse statement if this exact atom's
    -- mirror does not already exist. [Fix 19] The existence check matches
    -- the temporal scope too, so two differently-scoped assertions of
    -- the same pair each get their own inverse (v0.8 stopped at the
    -- first, leaving later scopes without mirrors).
    IF EXISTS (
        SELECT 1 FROM statements s
        WHERE s.predicate_id = v_inverse_pred_id
          AND s.object_args  = ARRAY[NEW.object_args[2], NEW.object_args[1]]
          AND s.context_id   = NEW.context_id
          AND s.t_kind       = NEW.t_kind
          AND s.t_start IS NOT DISTINCT FROM NEW.t_start
          AND s.t_end   IS NOT DISTINCT FROM NEW.t_end
    ) THEN
        RETURN NEW;  -- recursion guard: terminates after original → inverse
    END IF;

    -- [Fix 16] ON CONFLICT (content_hash) DO NOTHING guards the race
    -- where the mirror atom appears between the check above and this
    -- insert; if it fires, there is no new row to wire provenance for.
    INSERT INTO statements (
        predicate_id,  object_args,
        belief_alpha,  belief_beta,
        interpretation, statement_kind,
        t_kind, t_start, t_end,
        context_id,
        derivation_type, derivation_depth, derived_from
    )
    VALUES (
        v_inverse_pred_id,
        ARRAY[NEW.object_args[2], NEW.object_args[1]],
        NEW.belief_alpha,  NEW.belief_beta,
        NEW.interpretation, NEW.statement_kind,
        NEW.t_kind, NEW.t_start, NEW.t_end,
        NEW.context_id,
        'forward_chained', NEW.derivation_depth + 1, ARRAY[NEW.id]
    )
    ON CONFLICT (content_hash) DO NOTHING
    RETURNING id INTO v_inverse_stmt_id;

    IF v_inverse_stmt_id IS NOT NULL THEN
        INSERT INTO statement_dependencies (parent_id, child_id, rule_name, weight)
        VALUES (NEW.id, v_inverse_stmt_id, 'inverse_predicate', 1.0);
    END IF;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_zz_auto_inverse_statement
    AFTER INSERT OR UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION auto_insert_inverse_statement();


-- ── [Fix 7] Dependency acyclicity enforcement ─────────────────
-- Fires BEFORE INSERT on statement_dependencies.
-- Prevents cycles in derivation chains, which would cause belief
-- amplification loops in the competition model.
-- Checks: is parent_id reachable from child_id following existing
-- dependency edges? If yes, inserting (parent → child) creates a cycle.
-- Depth capped at 50.
CREATE OR REPLACE FUNCTION enforce_dependency_acyclicity()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_creates_cycle boolean;
BEGIN
    WITH RECURSIVE reachable AS (
        SELECT NEW.child_id AS node, 0 AS depth

        UNION ALL

        SELECT sd.child_id, r.depth + 1
        FROM reachable r
        JOIN statement_dependencies sd ON sd.parent_id = r.node
        WHERE r.depth < 50
    )
    SELECT EXISTS (
        SELECT 1 FROM reachable WHERE node = NEW.parent_id
    ) INTO v_creates_cycle;

    IF v_creates_cycle THEN
        RAISE EXCEPTION
            'Dependency acyclicity violation: adding edge (parent=%, child=%) would create '
            'a cycle in statement_dependencies. Derivation chains must be acyclic.',
            NEW.parent_id, NEW.child_id;
    END IF;

    RETURN NEW;
END;
$$;

CREATE TRIGGER trg_enforce_dependency_acyclicity
    BEFORE INSERT ON statement_dependencies
    FOR EACH ROW EXECUTE FUNCTION enforce_dependency_acyclicity();


-- =============================================================
-- VIEWS
-- =============================================================

-- ── Raw Beta belief statistics ────────────────────────────────
CREATE VIEW statement_belief AS
SELECT
    id,
    belief_alpha,
    belief_beta,
    belief_mean,
    belief_alpha + belief_beta                                AS evidence_strength,
    (belief_alpha * belief_beta)
        / (pow(belief_alpha + belief_beta, 2)
           * (belief_alpha + belief_beta + 1))                AS variance,
    GREATEST(0,
        belief_mean - 1.96 * sqrt(
            (belief_alpha * belief_beta)
            / (pow(belief_alpha + belief_beta, 2)
               * (belief_alpha + belief_beta + 1))
        )
    )                                                         AS ci_low,
    LEAST(1,
        belief_mean + 1.96 * sqrt(
            (belief_alpha * belief_beta)
            / (pow(belief_alpha + belief_beta, 2)
               * (belief_alpha + belief_beta + 1))
        )
    )                                                         AS ci_high,
    interpretation,
    statement_kind,
    t_kind,
    context_id,
    derivation_type,
    derivation_depth
FROM statements;


-- ── Human-readable statement join ────────────────────────────
CREATE VIEW statement_view AS
SELECT
    s.id,
    p.canonical_name                  AS predicate,
    s.object_args,
    arg_names.names                   AS arg_names,
    s.literal_args,
    s.belief_mean,
    s.belief_alpha + s.belief_beta    AS evidence_strength,
    s.interpretation,
    s.statement_kind,
    s.disjointness_kind,
    s.t_kind,
    s.t_start,
    s.t_end,
    c.canonical_name                  AS context,
    s.derivation_type,
    s.derivation_depth,
    s.derived_from,
    s.created_at
FROM statements s
JOIN objects p ON p.id = s.predicate_id
JOIN objects c ON c.id = s.context_id
LEFT JOIN LATERAL (
    SELECT array_agg(o.canonical_name ORDER BY ord) AS names
    FROM unnest(s.object_args) WITH ORDINALITY AS u(oid, ord)
    JOIN objects o ON o.id = u.oid
) arg_names ON true;


-- ── Source credibility statistics ─────────────────────────────
CREATE VIEW source_credibility_score AS
SELECT
    source_id,
    context_id,
    alpha / (alpha + beta)                          AS mean,
    alpha + beta                                     AS evidence_strength,
    is_protected,
    GREATEST(0,
        alpha / (alpha + beta)
        - 1.96 * sqrt(alpha * beta
                      / (pow(alpha + beta, 2) * (alpha + beta + 1)))
    )                                                AS ci_low,
    LEAST(1,
        alpha / (alpha + beta)
        + 1.96 * sqrt(alpha * beta
                      / (pow(alpha + beta, 2) * (alpha + beta + 1)))
    )                                                AS ci_high
FROM source_credibility;


-- ── Attestation credibility (evidence-group-deduped) ─────────
-- RULE: Each evidence_group_id contributes at most its single
-- highest-weight attestation. Ungrouped attestations are included
-- individually. Prevents confidence inflation from correlated sources.
CREATE VIEW statement_credibility AS
WITH ranked_attestations AS (
    SELECT
        a.statement_id,
        a.source_id,
        a.confidence_weight,
        a.evidence_group_id,
        COALESCE(sc_domain.mean,              sc_reality.mean,             0.5)  AS src_mean,
        COALESCE(sc_domain.evidence_strength, sc_reality.evidence_strength, 2.0) AS src_es,
        CASE
            WHEN a.evidence_group_id IS NULL THEN 1
            ELSE ROW_NUMBER() OVER (
                PARTITION BY a.statement_id, a.evidence_group_id
                ORDER BY a.confidence_weight DESC
            )
        END AS group_rank
    FROM attestations a
    JOIN statements s ON s.id = a.statement_id
    LEFT JOIN source_credibility_score sc_domain
           ON sc_domain.source_id  = a.source_id
          AND sc_domain.context_id = s.context_id
    LEFT JOIN source_credibility_score sc_reality
           ON sc_reality.source_id  = a.source_id
          AND sc_reality.context_id = stable_uuid('reality', 'context')
)
SELECT
    statement_id,
    sum(src_mean * src_es * confidence_weight)
        / NULLIF(sum(src_es * confidence_weight), 0) AS weighted_credibility,
    sum(src_es * confidence_weight)                   AS total_source_weight,
    count(*)                                          AS source_count,
    -- [Fix 12] Beta pseudo-counts contributed by (deduped) attestations.
    -- Each surviving attestation adds confidence_weight ·
    -- kb_attestation_scale() pseudo-observations, split between success
    -- (alpha) and failure (beta) in proportion to the source's
    -- credibility mean. These are folded into the statement's Beta in
    -- statement_effective_belief, forming ONE posterior that both
    -- update_belief() and attestations move.
    sum(confidence_weight * kb_attestation_scale() * src_mean)         AS att_alpha,
    sum(confidence_weight * kb_attestation_scale() * (1.0 - src_mean)) AS att_beta
FROM ranked_attestations
WHERE group_rank = 1
GROUP BY statement_id;


-- ── [Fix 12, Fix 13, Fix 21] statement_effective_belief ──────
--
-- This is the CANONICAL INPUT for holds_at (open_world mode) and
-- tell_about. All threshold comparisons use effective_mean.
--
-- THE POSTERIOR (Fix 12). For every statement:
--
--     posterior_alpha = belief_alpha + att_alpha
--     posterior_beta  = belief_beta  + att_beta
--     posterior_mean  = posterior_alpha / (posterior_alpha + posterior_beta)
--
-- where att_alpha / att_beta are the source-credibility-weighted
-- pseudo-counts from statement_credibility (deduped per evidence group,
-- scaled by kb_attestation_scale()). This replaces the v0.8 design in
-- which weighted source credibility was the BASE of effective_mean:
-- there, the moment a statement had any attestation, its own Beta belief
-- became invisible and update_belief() had no observable effect; worse,
-- "how trustworthy are the sources" was conflated with "how much net
-- evidence supports this claim". Now there is one posterior and every
-- evidence channel moves it.
--
-- PER-KIND PIPELINE (Fix 1, retained):
--   ontological : effective_mean = raw_mean. Belief fixed at assertion;
--                 no attestation folding, no conflict interaction.
--   statistical : effective_mean = raw_mean. Population-level patterns.
--   rule        : effective_mean = NULL. Not in the belief pipeline.
--   empirical   : competition model below.
--
-- COMPETITION MODEL (Fix 13). For empirical statements:
--
--     effective_mean = posterior_mean
--                    / (1 + Σ opponent_posterior_mean
--                         + Σ incompatibility_penalty)
--
-- This is continuous and strictly monotone decreasing in opposition,
-- and reduces exactly to posterior_mean when unopposed. The v0.8 form
--     cred / (cred + Σ opp)        (cred alone when Σ opp = 0)
-- was discontinuous at zero opposition: for any opponent mass below
-- (1 − cred), the ratio EXCEEDED the unopposed value — registering a
-- feeble objection to a claim RAISED its effective belief, an
-- exploitable inversion. Intuition for the new form: the implicit
-- residual doubt (1 − p) always sits in the denominator alongside the
-- explicit opponents, i.e. p / (p + (1 − p) + Σopp) = p / (1 + Σopp).
--
-- Opponents are the other side of every OPEN direct_negation or
-- value_conflict row (Fix 17: value conflicts now feed the model too),
-- weighed by their own posterior_mean.
--
-- conflict_severity is retained as a diagnostic column but is not part
-- of the effective_mean computation.
CREATE VIEW statement_effective_belief AS
WITH

-- Base posterior for every statement (Fix 12).
stmt_base AS (
    SELECT
        s.id,
        s.statement_kind,
        s.predicate_id,
        s.object_args,
        s.context_id,
        s.belief_mean                                        AS raw_mean,
        -- Evidence strength of the full posterior (direct + attested).
        s.belief_alpha + s.belief_beta
            + COALESCE(sc.att_alpha, 0.0)
            + COALESCE(sc.att_beta,  0.0)                    AS evidence_strength,
        (s.belief_alpha + COALESCE(sc.att_alpha, 0.0))
            / (s.belief_alpha + s.belief_beta
               + COALESCE(sc.att_alpha, 0.0)
               + COALESCE(sc.att_beta,  0.0))                AS posterior_mean,
        -- Diagnostic only: mean source credibility of the attestations
        -- (NULL when unattested). No longer the base of effective_mean.
        sc.weighted_credibility                              AS credibility_adjusted,
        sc.total_source_weight,
        sc.source_count
    FROM statements s
    LEFT JOIN statement_credibility sc ON sc.statement_id = s.id
),

-- Open conflict metadata. [Fix 17] value_conflict rows count alongside
-- direct_negation: both represent live evidential opposition.
conflict_info AS (
    SELECT
        sid,
        COUNT(*)::bigint             AS open_conflict_count,
        MAX(COALESCE(severity, 0.0)) AS max_severity
    FROM (
        SELECT statement_a AS sid, severity
        FROM conflicts
        WHERE resolved = false
          AND conflict_kind IN ('direct_negation', 'value_conflict')
        UNION
        SELECT statement_b AS sid, severity
        FROM conflicts
        WHERE resolved = false
          AND conflict_kind IN ('direct_negation', 'value_conflict')
    ) both_sides
    GROUP BY sid
),

-- Opponent mass for the competition model: the other side of each open
-- direct_negation / value_conflict row, weighed by ITS posterior mean.
-- uq_conflicts_pair guarantees each opponent pair contributes one row,
-- so opponents cannot be double-counted (Fix 18).
opponent_cred AS (
    SELECT c.statement_a AS sid, SUM(sb.posterior_mean) AS opp_cred
    FROM conflicts c
    JOIN stmt_base sb ON sb.id = c.statement_b
    WHERE c.resolved = false
      AND c.conflict_kind IN ('direct_negation', 'value_conflict')
    GROUP BY c.statement_a

    UNION ALL

    SELECT c.statement_b AS sid, SUM(sb.posterior_mean) AS opp_cred
    FROM conflicts c
    JOIN stmt_base sb ON sb.id = c.statement_a
    WHERE c.resolved = false
      AND c.conflict_kind IN ('direct_negation', 'value_conflict')
    GROUP BY c.statement_b
),
opp_totals AS (
    SELECT sid, SUM(opp_cred) AS total_opp_cred
    FROM opponent_cred
    GROUP BY sid
),

-- Incompatibility penalties from graded disjointness axioms.
-- For each empirical is_a/instance_of(entity, T1): if an incompatibility
-- disjoint_with axiom applies to T1 OR ANY OF ITS SUPERTYPES (Fix 21 —
-- v0.8 only matched axioms naming T1 directly, so is_a(X, lawyer) with
-- lawyer ⊂ person escaped a person ⊥ institution penalty that
-- is_a(X, person) received) and the entity is also typed — directly or
-- transitively — as the disjoint partner, the axiom's belief_mean is
-- added to the competition denominator.
-- [Fix 15] All walks are restricted to the statement's context chain,
-- matching enforce_disjointness_constraints().
incompat_penalties AS (
    SELECT
        s1.id               AS stmt_id,
        SUM(dw.belief_mean) AS penalty
    FROM statements s1
    CROSS JOIN LATERAL context_chain(s1.context_id) AS ctx(chain)
    -- Asserted type and its supertypes (Fix 21).
    JOIN LATERAL (
        WITH RECURSIVE asserted_type_ancestors AS (
            SELECT s1.object_args[2] AS type_id

            UNION

            SELECT s.object_args[2]
            FROM asserted_type_ancestors ta
            JOIN statements s
              ON s.object_args[1] = ta.type_id
             AND s.predicate_id   = stable_uuid('subtype_of', 'predicate')
             AND s.context_id     = ANY (ctx.chain)
             AND s.belief_mean    > 0.9
        )
        SELECT type_id FROM asserted_type_ancestors
    ) ta ON true
    JOIN statements dw
      ON dw.predicate_id      = stable_uuid('disjoint_with', 'predicate')
     AND dw.disjointness_kind = 'incompatibility'
     AND dw.context_id        = ANY (ctx.chain)
     AND (dw.object_args[1] = ta.type_id OR dw.object_args[2] = ta.type_id)
    WHERE s1.predicate_id IN (
              stable_uuid('is_a',        'predicate'),
              stable_uuid('instance_of', 'predicate')
          )
      AND s1.statement_kind = 'empirical'
      AND cardinality(s1.object_args) >= 2
      -- The entity must actually hold the disjoint partner type,
      -- resolved transitively within the same context chain.
      AND EXISTS (
          WITH RECURSIVE entity_type_closure AS (
              SELECT tm.type_id
              FROM type_membership tm
              WHERE tm.object_id  = s1.object_args[1]
                AND tm.context_id = ANY (ctx.chain)

              UNION

              SELECT s.object_args[2]
              FROM entity_type_closure tc
              JOIN statements s
                ON s.object_args[1] = tc.type_id
               AND s.predicate_id   = stable_uuid('subtype_of', 'predicate')
               AND s.context_id     = ANY (ctx.chain)
               AND s.belief_mean    > 0.9
          )
          SELECT 1 FROM entity_type_closure
          WHERE type_id = CASE
                              WHEN dw.object_args[1] = ta.type_id
                              THEN dw.object_args[2]
                              ELSE dw.object_args[1]
                          END
      )
    GROUP BY s1.id
)

SELECT
    sb.id,
    sb.raw_mean,
    sb.posterior_mean,
    sb.credibility_adjusted,
    sb.evidence_strength,
    sb.total_source_weight,
    sb.source_count,
    CASE sb.statement_kind
        -- Ontological: fixed at assertion; no attestation folding,
        -- no conflict interaction (Fix 1).
        WHEN 'ontological' THEN sb.raw_mean
        -- Statistical: typicality/correlation strength only.
        WHEN 'statistical' THEN sb.raw_mean
        -- Rule: not in the belief pipeline.
        WHEN 'rule'        THEN NULL::double precision
        -- Empirical: continuous competition model (Fix 13).
        ELSE sb.posterior_mean
             / (1.0
                + COALESCE(ot.total_opp_cred, 0.0)
                + COALESCE(ip.penalty,        0.0))
    END                                             AS effective_mean,
    COALESCE(ci.open_conflict_count, 0)             AS open_conflict_count,
    ci.max_severity                                 AS conflict_severity
FROM stmt_base sb
LEFT JOIN conflict_info      ci ON ci.sid     = sb.id
LEFT JOIN opp_totals         ot ON ot.sid     = sb.id
LEFT JOIN incompat_penalties ip ON ip.stmt_id = sb.id;


-- =============================================================
-- FUNCTIONS
-- =============================================================

-- ── update_trust ──────────────────────────────────────────────
-- Bayesian conjugate update of source credibility.
-- p_override required for protected sources (e.g. system_kernel).
CREATE OR REPLACE FUNCTION update_trust(
    p_source_id  uuid,
    p_context_id uuid,
    p_correct    boolean,
    p_weight     double precision DEFAULT 1.0,
    p_override   boolean          DEFAULT false
) RETURNS void LANGUAGE plpgsql AS $$
DECLARE
    v_protected boolean;
BEGIN
    INSERT INTO source_credibility (source_id, context_id, alpha, beta, is_protected)
    VALUES (p_source_id, p_context_id, 1.0, 1.0, false)
    ON CONFLICT (source_id, context_id) DO NOTHING;

    SELECT is_protected INTO v_protected
    FROM source_credibility
    WHERE source_id = p_source_id AND context_id = p_context_id;

    IF v_protected AND NOT p_override THEN
        RAISE EXCEPTION
            'source % is protected; pass p_override=true to modify', p_source_id;
    END IF;

    IF p_correct THEN
        UPDATE source_credibility
           SET alpha = alpha + p_weight, updated_at = now()
         WHERE source_id = p_source_id AND context_id = p_context_id;
    ELSE
        UPDATE source_credibility
           SET beta  = beta  + p_weight, updated_at = now()
         WHERE source_id = p_source_id AND context_id = p_context_id;
    END IF;
END;
$$;


-- ── [Fix 1] update_belief ─────────────────────────────────────
-- Bayesian conjugate update of a statement's Beta belief.
-- [Fix 1] Rejects updates to ontological statements unless p_override=true.
-- Ontological belief is fixed at assertion time and must not drift from
-- passive evidence accumulation.
CREATE OR REPLACE FUNCTION update_belief(
    p_statement_id uuid,
    p_weight       double precision,
    p_supports     boolean,
    p_override     boolean DEFAULT false
) RETURNS void LANGUAGE plpgsql AS $$
DECLARE
    v_kind statement_kind;
BEGIN
    SELECT statement_kind INTO v_kind
    FROM statements WHERE id = p_statement_id;

    IF v_kind = 'ontological' AND NOT p_override THEN
        RAISE EXCEPTION
            'update_belief: statement % has statement_kind=''ontological''. '
            'Ontological belief is fixed at assertion time and protected from '
            'passive drift. Pass p_override=true to modify deliberately.',
            p_statement_id;
    END IF;

    IF p_supports THEN
        UPDATE statements
           SET belief_alpha = belief_alpha + p_weight, updated_at = now()
         WHERE id = p_statement_id;
    ELSE
        UPDATE statements
           SET belief_beta  = belief_beta  + p_weight, updated_at = now()
         WHERE id = p_statement_id;
    END IF;
END;
$$;


-- ── [Fix 1, Fix 14] compute_derived_belief ────────────────────
-- Computes (alpha, beta) for a forward-chained statement from the
-- PREMISES of ONE rule application.
--
-- SEMANTICS (Fix 14). The parents passed here are the joint premises of
-- a single inference step: the conclusion can be no more believable than
-- their conjunction. P(A ∧ B) ≤ min(P(A), P(B)), so NO premise-
-- combination mode may exceed the weakest premise. The v0.8 'log_odds'
-- mode summed parent log-odds — the rule for combining INDEPENDENT
-- EVIDENCE FOR THE SAME PROPOSITION — and so claimed conclusions MORE
-- certain than every premise. That mode is removed here and lives on,
-- with its correct semantics, as combine_evidence(): use it to merge
-- multiple independent DERIVATIONS of the same conclusion.
--
-- p_combination options:
--   'min'       (default) — conclusion mean = min(parent means).
--               Correct upper bound; exact when premises are perfectly
--               correlated. Use when premise independence is unknown.
--   'noisy_and' — conclusion mean = Π parent means. Exact when premises
--               are independent; strictly more conservative than 'min'.
--   anything else raises (v0.8 silently fell back to 'min', hiding typos).
--
-- CHAIN-LENGTH DECAY (Fix 14). Applied in LOG-ODDS space:
--     logit(p') = logit(p) · 0.9^p_chain_length
-- which shrinks belief toward the uninformative 0.5 prior. The v0.8
-- decay multiplied the PROBABILITY by 0.9^len, which (a) pushed a
-- perfectly uninformative 0.5 premise to 0.45 — manufacturing negative
-- information from nothing — and (b) capped every chain at 0.9 per step
-- regardless of premise strength.
--
-- EVIDENCE STRENGTH (Fix 14). The output concentration is
--     clamp(min(parent strengths) · 0.9^len, 2 .. 1000)
-- so a conclusion drawn from near-certain axioms no longer collapses to
-- the confidence interval of a twice-flipped coin (v0.8 reset every
-- derived statement to strength 2, letting a couple of update_belief()
-- calls swamp conclusions of strong chains).
--
-- PIPELINE INPUT (Fix 23). Each parent contributes its EFFECTIVE
-- pipeline belief — the same number every query function sees:
--   • empirical parents: the attestation-informed posterior, suppressed
--     by open conflicts (effective_mean);
--   • ontological parents: raw_mean (kind-stratified pipeline);
--   • rule-kind parents: SKIPPED from the math — a rule licenses the
--     inference, it is not evidence for the conclusion. Wire it as a
--     provenance edge; its belief does not enter the conjunction.
-- v0.9 read raw belief_alpha/beta directly, so a premise that was
-- heavily attested, or actively contested, fed its conclusions as if
-- neither fact existed.
-- Parent evidence strength is the posterior strength (direct + attested
-- pseudo-observations) from the same view.
-- Note: reads statement_effective_belief; on very large KBs prefer
-- batching derivations over calling this in a tight per-row loop.
--
-- [Fix 1] Statistical parents raise a hard exception: population-level
-- patterns cannot feed logical inference chains.
-- Returns (alpha=1, beta=1) uniform prior when p_parent_ids is empty,
-- and raises if every supplied parent is rule-kind (no evidential
-- parents).
CREATE OR REPLACE FUNCTION compute_derived_belief(
    p_parent_ids   uuid[],
    p_chain_length int  DEFAULT 1,
    p_combination  text DEFAULT 'min'
) RETURNS TABLE (out_alpha double precision, out_beta double precision)
LANGUAGE plpgsql STABLE AS $$
DECLARE
    v_min_mean     double precision := 1.0;
    v_prod_mean    double precision := 1.0;
    v_min_strength double precision := 'infinity';
    v_n            int              := 0;
    v_mean         double precision;
    v_alpha        double precision;
    v_beta         double precision;
    v_decay        double precision;
    v_result_mean  double precision;
    v_strength     double precision;
    v_has_stat     boolean;
BEGIN
    IF p_parent_ids IS NULL OR cardinality(p_parent_ids) = 0 THEN
        RETURN QUERY SELECT 1.0::double precision, 1.0::double precision;
        RETURN;
    END IF;

    -- [Fix 14] Unknown modes are an error, not a silent 'min'.
    IF p_combination = 'log_odds' THEN
        RAISE EXCEPTION
            'compute_derived_belief: ''log_odds'' was removed in v0.9. '
            'Summed log-odds is the rule for combining independent evidence '
            'FOR THE SAME proposition; the parents of a rule application are '
            'its joint PREMISES, and a conclusion can never be more believable '
            'than its weakest premise. Use ''min'' or ''noisy_and'' here, and '
            'combine_evidence() to merge multiple independent derivations of '
            'the same conclusion.';
    ELSIF p_combination NOT IN ('min', 'noisy_and') THEN
        RAISE EXCEPTION
            'compute_derived_belief: unknown combination mode ''%''. '
            'Valid modes: ''min'' (default), ''noisy_and''.', p_combination;
    END IF;

    -- [Fix 1] Hard exception for statistical parents.
    SELECT EXISTS (
        SELECT 1 FROM statements
        WHERE id = ANY(p_parent_ids)
          AND statement_kind = 'statistical'
    ) INTO v_has_stat;

    IF v_has_stat THEN
        RAISE EXCEPTION
            'compute_derived_belief: one or more parent statements have '
            'statement_kind = ''statistical''. Statistical statements encode '
            'population-level patterns and cannot participate in logical inference '
            'chains. Use probabilistic reasoning functions for statistical parents.';
    END IF;

    -- [Fix 23] Pipeline belief per parent: effective_mean (posterior +
    -- competition) for empirical, raw for ontological — exactly what
    -- queries consume. Rule parents are licensing edges: skipped.
    FOR v_mean, v_alpha, v_beta IN
        SELECT
            COALESCE(seb.effective_mean, seb.raw_mean),
            seb.evidence_strength,           -- reused as strength carrier
            0.0
        FROM statements s
        JOIN statement_effective_belief seb ON seb.id = s.id
        WHERE s.id = ANY(p_parent_ids)
          AND s.statement_kind != 'rule'
    LOOP
        IF v_mean < v_min_mean THEN
            v_min_mean := v_mean;
        END IF;
        v_prod_mean    := v_prod_mean * v_mean;
        v_min_strength := LEAST(v_min_strength, v_alpha);
        v_n            := v_n + 1;
    END LOOP;

    IF v_n = 0 THEN
        RAISE EXCEPTION
            'compute_derived_belief: no evidential parents (all supplied '
            'parents are rule-kind, or the id array matched no statements). '
            'Rules license inferences; they are not evidence.';
    END IF;

    v_result_mean := CASE p_combination
                         WHEN 'noisy_and' THEN v_prod_mean
                         ELSE                  v_min_mean
                     END;
    v_result_mean := GREATEST(1e-6, LEAST(1.0 - 1e-6, v_result_mean));

    -- [Fix 14] Decay toward the 0.5 prior in log-odds space.
    v_decay       := pow(0.9, GREATEST(p_chain_length, 0));
    v_result_mean := 1.0 / (1.0 + exp(-(ln(v_result_mean / (1.0 - v_result_mean))
                                        * v_decay)));
    v_result_mean := GREATEST(1e-6, LEAST(1.0 - 1e-6, v_result_mean));

    -- [Fix 14] Propagate the weakest parent's evidence strength, decayed
    -- per chain step and clamped to a sane band.
    v_strength := LEAST(1000.0, GREATEST(2.0, v_min_strength * v_decay));

    RETURN QUERY SELECT
        (v_result_mean * v_strength)::double precision,
        ((1.0 - v_result_mean) * v_strength)::double precision;
END;
$$;


-- ── [Fix 24] statement_ancestors ──────────────────────────────
-- All provenance ancestors of a statement (the statement itself
-- included), walked through statement_dependencies. Depth-capped at 100;
-- dependency cycles are independently forbidden by
-- validate_kb_integrity(), and the cap bounds the walk regardless.
-- Used by combine_evidence() and recompute_derived_belief() to detect
-- correlated derivations, and useful on its own for impact analysis
-- ("what feeds this conclusion?").
CREATE OR REPLACE FUNCTION statement_ancestors(p_stmt_id uuid)
RETURNS TABLE (ancestor_id uuid) LANGUAGE sql STABLE AS $$
    WITH RECURSIVE anc AS (
        SELECT p_stmt_id AS id, 0 AS depth

        UNION

        SELECT sd.parent_id, anc.depth + 1
        FROM anc
        JOIN statement_dependencies sd ON sd.child_id = anc.id
        WHERE anc.depth < 100
    )
    SELECT DISTINCT id FROM anc;
$$;


-- ── [Fix 14] combine_evidence ─────────────────────────────────
-- Merges multiple INDEPENDENT DERIVATIONS (or evidence lines) for the
-- SAME conclusion into one (alpha, beta).
--
-- This is the correct home for log-odds accumulation: if each parent is
-- an independent posterior for the same proposition obtained from a
-- shared uniform prior, then by Bayes
--     posterior_odds = Π parent_odds   ⇔   log-odds sum.
-- Two independent 90% derivations of the same conclusion combine to
-- ≈ 0.988 — ABOVE either, which is correct HERE (and only here; see
-- compute_derived_belief for why it is wrong for premises).
--
-- Typical use: a conclusion statement already exists with provenance
-- edges from rule application R1; rule application R2 independently
-- derives the same atom. Compute each derivation's belief with
-- compute_derived_belief(), then merge them with combine_evidence() and
-- write the result onto the single conclusion row (one atom = one row,
-- Fix 16).
--
-- INDEPENDENCE GUARD (Fix 24). Summed log-odds is only valid for
-- independent derivations: lines that share a provenance ancestor (or
-- where one parent is an ancestor of another) are correlated, and
-- combining them double-counts the shared evidence. By default the
-- function walks statement_ancestors() for every parent and RAISES on
-- the first shared ancestor, naming the offending pair. Pass
-- p_check_independence => false only when you have established
-- independence by other means (e.g. the shared node is a near-certain
-- axiom whose double-counting you accept).
--
-- Evidence strength: parents' strengths are summed (independent
-- observations add), clamped to 1000.
-- Statistical parents raise, as everywhere in the logical pipeline.
-- Returns the uniform prior (1, 1) when p_parent_ids is empty.
CREATE OR REPLACE FUNCTION combine_evidence(
    p_parent_ids         uuid[],
    p_check_independence boolean DEFAULT true
) RETURNS TABLE (out_alpha double precision, out_beta double precision)
LANGUAGE plpgsql STABLE AS $$
DECLARE
    v_log_odds double precision := 0.0;
    v_strength double precision := 0.0;
    v_n        int              := 0;
    v_alpha    double precision;
    v_beta     double precision;
    v_mean     double precision;
    v_has_stat boolean;
    v_pair     record;
BEGIN
    IF p_parent_ids IS NULL OR cardinality(p_parent_ids) = 0 THEN
        RETURN QUERY SELECT 1.0::double precision, 1.0::double precision;
        RETURN;
    END IF;

    -- [Fix 24] Refuse correlated parents unless explicitly overridden.
    IF p_check_independence THEN
        SELECT a.pid AS pid_a, b.pid AS pid_b, shared.ancestor_id
          INTO v_pair
        FROM unnest(p_parent_ids) WITH ORDINALITY AS a(pid, ord_a)
        JOIN unnest(p_parent_ids) WITH ORDINALITY AS b(pid, ord_b)
          ON b.ord_b > a.ord_a
        CROSS JOIN LATERAL (
            SELECT sa.ancestor_id
            FROM statement_ancestors(a.pid) sa
            JOIN statement_ancestors(b.pid) sb USING (ancestor_id)
            LIMIT 1
        ) shared
        LIMIT 1;

        IF v_pair IS NOT NULL THEN
            RAISE EXCEPTION
                'combine_evidence: parents % and % are correlated — they share '
                'provenance ancestor %. Summing their log-odds would double-count '
                'that evidence. Combine only independent derivations, or pass '
                'p_check_independence => false to override deliberately.',
                v_pair.pid_a, v_pair.pid_b, v_pair.ancestor_id;
        END IF;
    END IF;

    SELECT EXISTS (
        SELECT 1 FROM statements
        WHERE id = ANY(p_parent_ids)
          AND statement_kind = 'statistical'
    ) INTO v_has_stat;

    IF v_has_stat THEN
        RAISE EXCEPTION
            'combine_evidence: one or more parent statements have '
            'statement_kind = ''statistical''. Statistical statements encode '
            'population-level patterns and cannot participate in logical '
            'inference chains.';
    END IF;

    FOR v_alpha, v_beta IN
        SELECT s.belief_alpha, s.belief_beta
        FROM statements s
        WHERE s.id = ANY(p_parent_ids)
    LOOP
        v_mean     := v_alpha / (v_alpha + v_beta);
        v_mean     := GREATEST(1e-6, LEAST(1.0 - 1e-6, v_mean));
        -- Each independent posterior from a uniform prior contributes its
        -- own log-odds increment.
        v_log_odds := v_log_odds + ln(v_mean / (1.0 - v_mean));
        v_strength := v_strength + (v_alpha + v_beta);
        v_n        := v_n + 1;
    END LOOP;

    IF v_n = 0 THEN
        RETURN QUERY SELECT 1.0::double precision, 1.0::double precision;
        RETURN;
    END IF;

    v_mean     := 1.0 / (1.0 + exp(-v_log_odds));
    v_mean     := GREATEST(1e-6, LEAST(1.0 - 1e-6, v_mean));
    v_strength := LEAST(1000.0, GREATEST(2.0, v_strength));

    RETURN QUERY SELECT
        (v_mean * v_strength)::double precision,
        ((1.0 - v_mean) * v_strength)::double precision;
END;
$$;


-- ── [Fix 5] holds_at ─────────────────────────────────────────
-- Returns statements for a predicate+args combination that hold at
-- a given time, in a given context, under a given reasoning mode.
--
-- [Fix 5] point statements now use point_statement_contains()
-- (granularity-aware fuzzy window) rather than coalescing t_end to
-- infinity. A year-granularity point at 1815 correctly overlaps only
-- queries in [1815-01-01, 1816-01-01), not all future times.
--
-- p_mode options:
--   'open_world'        — (default) statements with effective_mean > p_threshold
--                         AND evidence_strength >= p_min_evidence.
--   'default_true'      — 'default' t_kind statements treated as true until
--                         a direct_negation conflict exists (raw belief_mean).
--   'evidence_weighted' — all matching statements, ordered by effective_mean.
--
-- Rule statements (statement_kind = 'rule') excluded from all modes.
CREATE OR REPLACE FUNCTION holds_at(
    p_predicate_id  uuid,
    p_object_args   uuid[],
    p_time          timestamptz,
    p_context_id    uuid    DEFAULT NULL,
    p_mode          text    DEFAULT 'open_world',
    p_threshold     float   DEFAULT 0.5,
    p_min_evidence  float   DEFAULT 0.0
) RETURNS TABLE (
    statement_id    uuid,
    belief_mean_val double precision,
    evidence_str    double precision,
    interp          statement_interpretation
) LANGUAGE plpgsql STABLE AS $$
DECLARE
    v_context_id uuid;
BEGIN
    v_context_id := COALESCE(p_context_id, stable_uuid('reality', 'context'));

    IF p_mode = 'evidence_weighted' THEN
        RETURN QUERY
        SELECT sub.sid, sub.eff_mean, sub.estr, sub.interp
        FROM (
            -- Eternal / always
            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind IN ('eternal', 'always')

            UNION ALL

            -- [Fix 5] Interval: both bounds required by CHECK constraint.
            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind          = 'interval'
              AND tstzrange(s.t_start_ts, s.t_end_ts, '[)') @> p_time

            UNION ALL

            -- [Fix 5] Point: use granularity-aware overlap.
            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind          = 'point'
              AND point_statement_contains(s.t_start, p_time)

            UNION ALL

            -- Default
            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind          = 'default'
        ) sub(sid, eff_mean, estr, interp)
        ORDER BY eff_mean DESC;

    ELSIF p_mode = 'default_true' THEN
        RETURN QUERY
        SELECT sub.sid, sub.bmean, sub.estr, sub.interp
        FROM (
            SELECT s.id, s.belief_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind IN ('eternal', 'always')

            UNION ALL

            SELECT s.id, s.belief_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind          = 'interval'
              AND tstzrange(s.t_start_ts, s.t_end_ts, '[)') @> p_time

            UNION ALL

            SELECT s.id, s.belief_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind          = 'point'
              AND point_statement_contains(s.t_start, p_time)

            UNION ALL

            SELECT s.id, s.belief_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            WHERE s.predicate_id    = p_predicate_id
              AND s.object_args     = p_object_args
              AND s.context_id      = v_context_id
              AND s.statement_kind != 'rule'
              AND s.t_kind          = 'default'
              AND s.t_end_ts        IS NULL
              AND NOT EXISTS (
                  SELECT 1 FROM conflicts c
                  WHERE c.conflict_kind = 'direct_negation'
                    AND (c.statement_a = s.id OR c.statement_b = s.id)
                    AND c.resolved = false
              )
        ) sub(sid, bmean, estr, interp)
        ORDER BY bmean DESC;

    ELSE
        -- Default: 'open_world'. Filters on effective_mean so that open
        -- conflicts and credibility weighting reduce apparent confidence.
        RETURN QUERY
        SELECT sub.sid, sub.eff_mean, sub.estr, sub.interp
        FROM (
            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id                  = p_predicate_id
              AND s.object_args                   = p_object_args
              AND s.context_id                    = v_context_id
              AND seb.effective_mean              > p_threshold
              AND s.belief_alpha + s.belief_beta >= p_min_evidence
              AND s.statement_kind               != 'rule'
              AND s.t_kind IN ('eternal', 'always')

            UNION ALL

            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id                  = p_predicate_id
              AND s.object_args                   = p_object_args
              AND s.context_id                    = v_context_id
              AND seb.effective_mean              > p_threshold
              AND s.belief_alpha + s.belief_beta >= p_min_evidence
              AND s.statement_kind               != 'rule'
              AND s.t_kind                        = 'interval'
              AND tstzrange(s.t_start_ts, s.t_end_ts, '[)') @> p_time

            UNION ALL

            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id                  = p_predicate_id
              AND s.object_args                   = p_object_args
              AND s.context_id                    = v_context_id
              AND seb.effective_mean              > p_threshold
              AND s.belief_alpha + s.belief_beta >= p_min_evidence
              AND s.statement_kind               != 'rule'
              AND s.t_kind                        = 'point'
              AND point_statement_contains(s.t_start, p_time)

            UNION ALL

            SELECT s.id, seb.effective_mean, s.belief_alpha + s.belief_beta, s.interpretation
            FROM statements s
            JOIN statement_effective_belief seb ON seb.id = s.id
            WHERE s.predicate_id                  = p_predicate_id
              AND s.object_args                   = p_object_args
              AND s.context_id                    = v_context_id
              AND seb.effective_mean              > p_threshold
              AND s.belief_alpha + s.belief_beta >= p_min_evidence
              AND s.statement_kind               != 'rule'
              AND s.t_kind                        = 'default'
        ) sub(sid, eff_mean, estr, interp)
        ORDER BY eff_mean DESC;

    END IF;
END;
$$;


-- ── [Fix 23] recompute_derived_belief ─────────────────────────
-- Re-derives ONE forward_chained statement's belief from its provenance
-- edges, replaying the combination that produced it:
--
--   1. Dependency edges are grouped per rule_name — each group is one
--      rule application whose parents are the joint premises of that
--      derivation. 'inverse_predicate' edges are ignored: mirror rows
--      are belief-synced by trg_zz (equality), not re-derived (decaying
--      a mirror would make the pair spiral toward 0.5).
--   2. Each group is recomputed with compute_derived_belief(parents, 1,
--      mode) where mode = the statement's combination_mode (NULL→'min').
--      Groups with no evidential (non-rule) parents are skipped.
--   3. Multiple groups are independent derivations of the same
--      conclusion: if their parent sets share no provenance ancestor,
--      they are merged by log-odds accumulation (the combine_evidence
--      rule); if any two groups are correlated, the strongest single
--      group wins instead (conservative — no double-counting).
--
-- The new belief is written only when it differs (IS DISTINCT), which is
-- what guarantees cascade termination. Returns true when the row was
-- updated; p_write => false performs a dry run (used by the staleness
-- integrity check).
--
-- OWNERSHIP NOTE: forward_chained rows are owned by this machinery — a
-- direct update_belief() on one will be overwritten by the next
-- recompute. Direct evidence about a conclusion belongs in attestations
-- ON the derived row: those fold into its posterior in the view layer
-- and survive recompute.
CREATE OR REPLACE FUNCTION recompute_derived_belief(
    p_stmt_id uuid,
    p_write   boolean DEFAULT true
) RETURNS TABLE (changed boolean, out_alpha double precision, out_beta double precision)
LANGUAGE plpgsql AS $$
DECLARE
    v_stmt        statements%ROWTYPE;
    v_mode        text;
    v_group       record;
    v_g_alpha     double precision;
    v_g_beta      double precision;
    v_means       double precision[] := '{}';
    v_strengths   double precision[] := '{}';
    v_n_groups    int := 0;
    v_correlated  boolean := false;
    v_mean        double precision;
    v_strength    double precision;
    v_log_odds    double precision;
    v_best        double precision;
    v_best_idx    int;
    v_i           int;
    v_new_alpha   double precision;
    v_new_beta    double precision;
BEGIN
    SELECT * INTO v_stmt FROM statements WHERE id = p_stmt_id;

    IF NOT FOUND OR v_stmt.derivation_type != 'forward_chained' THEN
        RETURN QUERY SELECT false, NULL::double precision, NULL::double precision;
        RETURN;
    END IF;

    v_mode := COALESCE(v_stmt.combination_mode, 'min');

    -- One group per rule application; inverse edges excluded.
    FOR v_group IN
        SELECT COALESCE(sd.rule_name, '') AS rname,
               array_agg(sd.parent_id)    AS parents
        FROM statement_dependencies sd
        WHERE sd.child_id = p_stmt_id
          AND COALESCE(sd.rule_name, '') != 'inverse_predicate'
        GROUP BY COALESCE(sd.rule_name, '')
    LOOP
        -- Skip groups with no evidential parents (rule-only licensing).
        IF NOT EXISTS (
            SELECT 1 FROM statements p
            WHERE p.id = ANY(v_group.parents)
              AND p.statement_kind != 'rule'
        ) THEN
            CONTINUE;
        END IF;

        SELECT cd.out_alpha, cd.out_beta INTO v_g_alpha, v_g_beta
        FROM compute_derived_belief(v_group.parents, 1, v_mode) cd;

        v_n_groups  := v_n_groups + 1;
        v_means     := v_means     || (v_g_alpha / (v_g_alpha + v_g_beta));
        v_strengths := v_strengths || (v_g_alpha + v_g_beta);
    END LOOP;

    IF v_n_groups = 0 THEN
        RETURN QUERY SELECT false, NULL::double precision, NULL::double precision;
        RETURN;
    END IF;

    IF v_n_groups = 1 THEN
        v_mean     := v_means[1];
        v_strength := v_strengths[1];
    ELSE
        -- Pairwise group correlation: any parent of one group sharing a
        -- provenance ancestor with any parent of a DIFFERENT group means
        -- combining would double-count; fall back to the strongest
        -- single group. Checked directly over statement_dependencies
        -- (groups are ragged, so no array materialisation).
        SELECT EXISTS (
            SELECT 1
            FROM statement_dependencies d1
            JOIN statement_dependencies d2
              ON d2.child_id = d1.child_id
             AND COALESCE(d2.rule_name, '') > COALESCE(d1.rule_name, '')
            JOIN LATERAL statement_ancestors(d1.parent_id) sa ON true
            JOIN LATERAL statement_ancestors(d2.parent_id) sb
              ON sb.ancestor_id = sa.ancestor_id
            WHERE d1.child_id = p_stmt_id
              AND COALESCE(d1.rule_name, '') != 'inverse_predicate'
              AND COALESCE(d2.rule_name, '') != 'inverse_predicate'
        ) INTO v_correlated;

        IF v_correlated THEN
            -- Strongest single group (highest mean; conservative).
            v_best     := -1;
            v_best_idx := 1;
            FOR v_i IN 1 .. v_n_groups LOOP
                IF v_means[v_i] > v_best THEN
                    v_best     := v_means[v_i];
                    v_best_idx := v_i;
                END IF;
            END LOOP;
            v_mean     := v_means[v_best_idx];
            v_strength := v_strengths[v_best_idx];
        ELSE
            -- Independent derivations: log-odds accumulation.
            v_log_odds := 0.0;
            v_strength := 0.0;
            FOR v_i IN 1 .. v_n_groups LOOP
                v_mean     := GREATEST(1e-6, LEAST(1.0 - 1e-6, v_means[v_i]));
                v_log_odds := v_log_odds + ln(v_mean / (1.0 - v_mean));
                v_strength := v_strength + v_strengths[v_i];
            END LOOP;
            v_mean     := 1.0 / (1.0 + exp(-v_log_odds));
            v_strength := LEAST(1000.0, v_strength);
        END IF;
    END IF;

    v_mean      := GREATEST(1e-6, LEAST(1.0 - 1e-6, v_mean));
    v_strength  := LEAST(1000.0, GREATEST(2.0, v_strength));
    v_new_alpha := v_mean * v_strength;
    v_new_beta  := (1.0 - v_mean) * v_strength;

    IF p_write THEN
        UPDATE statements
           SET belief_alpha = v_new_alpha,
               belief_beta  = v_new_beta,
               updated_at   = now()
         WHERE id = p_stmt_id
           AND (belief_alpha IS DISTINCT FROM v_new_alpha
                OR belief_beta IS DISTINCT FROM v_new_beta);
        RETURN QUERY SELECT FOUND, v_new_alpha, v_new_beta;
    ELSE
        RETURN QUERY SELECT
            (v_stmt.belief_alpha IS DISTINCT FROM v_new_alpha
             OR v_stmt.belief_beta IS DISTINCT FROM v_new_beta),
            v_new_alpha, v_new_beta;
    END IF;
END;
$$;


-- ── [Fix 23] Belief propagation through the derivation DAG ─────
-- When a statement's belief changes, every forward_chained child whose
-- provenance cites it (excluding inverse-mirror edges, which trg_zz
-- syncs by equality) is recomputed. The recompute writes only when the
-- value actually changes, so the cascade terminates at the first
-- fixed point; the trigger-depth guard is a belt-and-braces bound for
-- pathological graphs.
--
-- Propagation triggers on (a) statements belief updates and (b)
-- attestation changes — both move the parent's pipeline belief that
-- compute_derived_belief() consumes. Changes that alter effective_mean
-- WITHOUT touching either (new conflicts from detect_conflicts(),
-- source_credibility updates via update_trust()) do not auto-propagate;
-- call recompute_derived_belief() on affected conclusions, or rely on
-- the next belief/attestation touch. The stale_derived_belief integrity
-- check reports any drift.
CREATE OR REPLACE FUNCTION propagate_derived_belief()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_child uuid;
BEGIN
    IF NEW.belief_alpha IS NOT DISTINCT FROM OLD.belief_alpha
       AND NEW.belief_beta IS NOT DISTINCT FROM OLD.belief_beta THEN
        RETURN NEW;
    END IF;

    IF pg_trigger_depth() > 40 THEN
        RAISE WARNING
            'propagate_derived_belief: trigger depth cap reached at statement %; '
            'derivation chain deeper than 40 or non-converging — propagation '
            'truncated. Run recompute_derived_belief() on downstream conclusions.',
            NEW.id;
        RETURN NEW;
    END IF;

    FOR v_child IN
        SELECT DISTINCT sd.child_id
        FROM statement_dependencies sd
        JOIN statements c ON c.id = sd.child_id
        WHERE sd.parent_id = NEW.id
          AND c.derivation_type = 'forward_chained'
          AND COALESCE(sd.rule_name, '') != 'inverse_predicate'
    LOOP
        PERFORM recompute_derived_belief(v_child);
    END LOOP;

    RETURN NEW;
END;
$$;

-- Named trg_zzz_ so it fires after the inverse-mirror sync (trg_zz_).
CREATE TRIGGER trg_zzz_propagate_derived
    AFTER UPDATE ON statements
    FOR EACH ROW EXECUTE FUNCTION propagate_derived_belief();


-- ── [Fix 23] Attestation changes propagate too ─────────────────
-- Attaching/removing/reweighting an attestation changes the statement's
-- POSTERIOR without touching its statements row, so the statements
-- trigger above never fires; this one closes that path.
CREATE OR REPLACE FUNCTION propagate_attestation_change()
RETURNS trigger LANGUAGE plpgsql AS $$
DECLARE
    v_stmt  uuid;
    v_child uuid;
BEGIN
    v_stmt := COALESCE(NEW.statement_id, OLD.statement_id);

    IF pg_trigger_depth() > 40 THEN
        RETURN COALESCE(NEW, OLD);
    END IF;

    FOR v_child IN
        SELECT DISTINCT sd.child_id
        FROM statement_dependencies sd
        JOIN statements c ON c.id = sd.child_id
        WHERE sd.parent_id = v_stmt
          AND c.derivation_type = 'forward_chained'
          AND COALESCE(sd.rule_name, '') != 'inverse_predicate'
    LOOP
        PERFORM recompute_derived_belief(v_child);
    END LOOP;

    RETURN COALESCE(NEW, OLD);
END;
$$;

CREATE TRIGGER trg_propagate_attestation
    AFTER INSERT OR UPDATE OR DELETE ON attestations
    FOR EACH ROW EXECUTE FUNCTION propagate_attestation_change();


-- ── detect_conflicts ──────────────────────────────────────────
-- Two passes:
--
-- PASS 1 (direct_negation): pairs with the same predicate + object_args
-- whose 95% Beta CIs do not overlap. With Fix 16 (one atom = one row),
-- identical atoms can no longer be duplicated, so this pass now catches
-- DIFFERENTLY-SCOPED assertions of the same proposition (same args,
-- overlapping but distinct temporal windows) with incompatible beliefs.
--
-- PASS 2 (value_conflict, Fix 17): for predicates marked is_functional,
-- pairs in the same context that agree on the leading args but disagree
-- on the final arg, with overlapping temporal scope and both positively
-- believed (mean > 0.5). This is the detector for real-world
-- contradictions — has_value(X, mass, 5kg) vs has_value(X, mass, 7kg) —
-- which the v0.8 same-atom scan could never see. severity = the weaker
-- side's mean (how strongly we believe both of two incompatible things).
--
-- Temporal overlap guard: two statements in non-overlapping time windows
-- are not flagged as conflicting. Eternal/always bypass the guard.
-- [Fix 5] Point statements in the temporal guard use the fuzzy (lo, hi)
-- range.
-- [Fix 18] All inserts are ON CONFLICT DO NOTHING against the unique
-- pair index, so repeated or concurrent runs cannot duplicate rows.
--
-- Returns the number of new conflicts inserted (both passes).
CREATE OR REPLACE FUNCTION detect_conflicts(
    p_context_id uuid DEFAULT NULL
) RETURNS int LANGUAGE plpgsql AS $$
DECLARE
    v_context_id uuid;
    v_inserted   int;
    v_inserted2  int;
BEGIN
    v_context_id := COALESCE(p_context_id, stable_uuid('reality', 'context'));

    WITH belief_ci AS (
        SELECT
            s.id,
            s.predicate_id,
            s.object_args,
            s.belief_mean,
            s.t_kind,
            s.t_start_ts,
            s.t_end_ts,
            s.t_start,
            GREATEST(0,
                s.belief_mean - 1.96 * sqrt(
                    (s.belief_alpha * s.belief_beta)
                    / (pow(s.belief_alpha + s.belief_beta, 2)
                       * (s.belief_alpha + s.belief_beta + 1))
                )
            ) AS ci_low,
            LEAST(1,
                s.belief_mean + 1.96 * sqrt(
                    (s.belief_alpha * s.belief_beta)
                    / (pow(s.belief_alpha + s.belief_beta, 2)
                       * (s.belief_alpha + s.belief_beta + 1))
                )
            ) AS ci_high
        FROM statements s
        WHERE s.context_id      = v_context_id
          AND s.statement_kind != 'rule'
    ),
    conflict_pairs AS (
        SELECT
            a.id                                                        AS stmt_a,
            b.id                                                        AS stmt_b,
            GREATEST(b.ci_low - a.ci_high, a.ci_low - b.ci_high, 0.0) AS severity
        FROM belief_ci a
        JOIN belief_ci b
          ON b.predicate_id = a.predicate_id
         AND b.object_args  = a.object_args
         AND b.id > a.id
        WHERE
            -- CIs are disjoint
            (a.ci_high < b.ci_low OR b.ci_high < a.ci_low)

            -- Temporal overlap guard (Fix 5: point uses lo/hi range)
            AND (
                a.t_kind IN ('eternal', 'always')
                OR b.t_kind IN ('eternal', 'always')
                OR tstzrange(
                       CASE a.t_kind
                           WHEN 'point' THEN jd_to_tstz((a.t_start).lo)
                           ELSE COALESCE(a.t_start_ts, '-infinity'::timestamptz)
                       END,
                       CASE a.t_kind
                           WHEN 'point' THEN jd_to_tstz((a.t_start).hi)
                           ELSE COALESCE(a.t_end_ts, 'infinity'::timestamptz)
                       END,
                       '[)'
                   ) &&
                   tstzrange(
                       CASE b.t_kind
                           WHEN 'point' THEN jd_to_tstz((b.t_start).lo)
                           ELSE COALESCE(b.t_start_ts, '-infinity'::timestamptz)
                       END,
                       CASE b.t_kind
                           WHEN 'point' THEN jd_to_tstz((b.t_start).hi)
                           ELSE COALESCE(b.t_end_ts, 'infinity'::timestamptz)
                       END,
                       '[)'
                   )
            )

            -- Not already recorded
            AND NOT EXISTS (
                SELECT 1 FROM conflicts c
                WHERE (c.statement_a = a.id AND c.statement_b = b.id)
                   OR (c.statement_a = b.id AND c.statement_b = a.id)
            )
    )
    INSERT INTO conflicts (statement_a, statement_b, conflict_kind, severity)
    SELECT stmt_a, stmt_b, 'direct_negation', severity
    FROM conflict_pairs
    ON CONFLICT DO NOTHING;          -- [Fix 18] arbiter: uq_conflicts_pair

    GET DIAGNOSTICS v_inserted = ROW_COUNT;

    -- ── PASS 2 [Fix 17]: functional-predicate value conflicts ─────
    -- Same context, same functional predicate, same leading args,
    -- different final arg, overlapping time, both positively believed.
    --
    -- Two atom shapes are supported:
    --   (a) all-object atoms: leading args = object_args[1..n−1],
    --       value = object_args[n];
    --   (b) object leading args + ONE literal value in the final
    --       position (the canonical has_value(entity, attribute, value)
    --       shape): leading args = object_args, value = the literal.
    -- Values are compared via a tagged text representation ('o:' uuid /
    -- 'l:' jsonb) so an object value never spuriously equals a literal.
    -- jsonb's canonical key ordering makes the literal form stable.
    -- Other mixed shapes are skipped: positional identity of the
    -- determining args would be ambiguous.
    WITH functional_stmts AS (
        SELECT
            s.id,
            s.predicate_id,
            CASE WHEN jsonb_array_length(s.literal_args) = 0
                 THEN s.object_args[1 : cardinality(s.object_args) - 1]
                 ELSE s.object_args
            END                                               AS lead_args,
            CASE WHEN jsonb_array_length(s.literal_args) = 0
                 THEN 'o:' || s.object_args[cardinality(s.object_args)]::text
                 ELSE 'l:' || s.literal_args::text
            END                                               AS value_repr,
            s.belief_mean,
            s.t_kind,
            s.t_start_ts,
            s.t_end_ts,
            s.t_start
        FROM statements s
        JOIN predicates p ON p.id = s.predicate_id
        WHERE s.context_id      = v_context_id
          AND p.is_functional
          AND s.statement_kind != 'rule'
          AND (
               -- shape (a): all-object atom
               (jsonb_array_length(s.literal_args) = 0
                AND cardinality(s.object_args) >= 2)
               -- shape (b): single literal value in the final position
               OR (jsonb_array_length(s.literal_args) = 1
                   AND cardinality(s.object_args) = p.arity - 1)
          )
    ),
    value_pairs AS (
        SELECT
            a.id                            AS stmt_a,
            b.id                            AS stmt_b,
            LEAST(a.belief_mean, b.belief_mean) AS severity
        FROM functional_stmts a
        JOIN functional_stmts b
          ON b.predicate_id = a.predicate_id
         AND b.lead_args    = a.lead_args
         AND b.value_repr  != a.value_repr
         AND b.id > a.id
        WHERE a.belief_mean > 0.5
          AND b.belief_mean > 0.5

          -- Same temporal overlap guard as pass 1.
          AND (
              a.t_kind IN ('eternal', 'always')
              OR b.t_kind IN ('eternal', 'always')
              OR tstzrange(
                     CASE a.t_kind
                         WHEN 'point' THEN jd_to_tstz((a.t_start).lo)
                         ELSE COALESCE(a.t_start_ts, '-infinity'::timestamptz)
                     END,
                     CASE a.t_kind
                         WHEN 'point' THEN jd_to_tstz((a.t_start).hi)
                         ELSE COALESCE(a.t_end_ts, 'infinity'::timestamptz)
                     END,
                     '[)'
                 ) &&
                 tstzrange(
                     CASE b.t_kind
                         WHEN 'point' THEN jd_to_tstz((b.t_start).lo)
                         ELSE COALESCE(b.t_start_ts, '-infinity'::timestamptz)
                     END,
                     CASE b.t_kind
                         WHEN 'point' THEN jd_to_tstz((b.t_start).hi)
                         ELSE COALESCE(b.t_end_ts, 'infinity'::timestamptz)
                     END,
                     '[)'
                 )
          )
    )
    INSERT INTO conflicts (statement_a, statement_b, conflict_kind, severity)
    SELECT stmt_a, stmt_b, 'value_conflict', severity
    FROM value_pairs
    ON CONFLICT DO NOTHING;          -- [Fix 18] arbiter: uq_conflicts_pair

    GET DIAGNOSTICS v_inserted2 = ROW_COUNT;
    RETURN v_inserted + v_inserted2;
END;
$$;


-- ── [Fix 8] tell_about ────────────────────────────────────────
-- Returns all statements in which p_entity_id appears in any object
-- arg position, ordered by effective_mean DESC.
--
-- [Fix 8] include_sentinels (default false): when false, excludes
-- statements in which any object argument is a sentinel. Set true for
-- diagnostic queries where sentinel args are meaningful.
--
-- p_time (default null): when supplied, restricts results to statements
-- whose temporal scope includes p_time. Eternal, always, and default
-- statements always pass. Interval uses [t_start, t_end); point uses
-- point_statement_contains() (Fix 5).
--
-- Rule statements excluded. Threshold applied to effective_mean.
CREATE OR REPLACE FUNCTION tell_about(
    p_entity_id       uuid,
    p_context_id      uuid        DEFAULT NULL,
    p_threshold       float       DEFAULT 0.0,
    p_time            timestamptz DEFAULT NULL,
    p_include_sentinels boolean   DEFAULT false
) RETURNS TABLE (
    statement_id        uuid,
    predicate           text,
    arg_names           text[],
    literal_args        jsonb,
    effective_mean      double precision,
    raw_mean            double precision,
    evidence_strength   double precision,
    open_conflict_count bigint,
    interpretation      statement_interpretation,
    statement_kind      statement_kind,
    t_kind              temporal_kind,
    t_start             fuzzy_time,
    t_end               fuzzy_time,
    context             text,
    derivation_type     derivation_type
) LANGUAGE sql STABLE AS $$
    SELECT
        s.id,
        p.canonical_name,
        arg_names.names,
        s.literal_args,
        seb.effective_mean,
        seb.raw_mean,
        s.belief_alpha + s.belief_beta,
        seb.open_conflict_count,
        s.interpretation,
        s.statement_kind,
        s.t_kind,
        s.t_start,
        s.t_end,
        c.canonical_name,
        s.derivation_type
    FROM statements s
    JOIN statement_effective_belief seb ON seb.id = s.id
    JOIN objects p ON p.id = s.predicate_id
    JOIN objects c ON c.id = s.context_id
    LEFT JOIN LATERAL (
        SELECT array_agg(o.canonical_name ORDER BY ord) AS names
        FROM unnest(s.object_args) WITH ORDINALITY AS u(oid, ord)
        JOIN objects o ON o.id = u.oid
    ) arg_names ON true
    WHERE p_entity_id = ANY(s.object_args)
      AND (p_context_id IS NULL OR s.context_id = p_context_id)
      AND seb.effective_mean  >= p_threshold
      AND s.statement_kind   != 'rule'
      -- [Fix 8] Sentinel filter: exclude statements containing sentinel args by default.
      AND (
          p_include_sentinels
          OR NOT EXISTS (
              SELECT 1
              FROM unnest(s.object_args) oid
              JOIN objects o ON o.id = oid
              WHERE o.is_sentinel
          )
      )
      -- Temporal filter: when p_time is supplied, honour scope.
      AND (
          p_time IS NULL
          OR s.t_kind IN ('eternal', 'always', 'default')
          OR (s.t_kind  = 'interval'
              AND tstzrange(s.t_start_ts, s.t_end_ts, '[)') @> p_time)
          OR (s.t_kind  = 'point'
              AND point_statement_contains(s.t_start, p_time))
      )
    ORDER BY seb.effective_mean DESC;
$$;


-- ── why ───────────────────────────────────────────────────────
-- Returns the full provenance DAG for a derived statement as a
-- recursive traversal of statement_dependencies.
-- Cycle guard via visited array prevents infinite loops.
CREATE OR REPLACE FUNCTION why(
    p_statement_id uuid
) RETURNS TABLE (
    depth           int,
    statement_id    uuid,
    predicate       text,
    arg_names       text[],
    belief_mean     double precision,
    effective_mean  double precision,
    rule_name       text,
    edge_weight     double precision,
    derivation_type derivation_type,
    statement_kind  statement_kind
) LANGUAGE sql STABLE AS $$
    WITH RECURSIVE provenance AS (
        SELECT
            0                           AS depth,
            s.id                        AS statement_id,
            s.predicate_id,
            s.object_args,
            s.belief_mean,
            s.statement_kind,
            s.derivation_type,
            NULL::text                  AS rule_name,
            NULL::double precision      AS edge_weight,
            ARRAY[s.id]                 AS visited
        FROM statements s
        WHERE s.id = p_statement_id

        UNION ALL

        SELECT
            pr.depth + 1,
            s.id,
            s.predicate_id,
            s.object_args,
            s.belief_mean,
            s.statement_kind,
            s.derivation_type,
            sd.rule_name,
            sd.weight,
            pr.visited || s.id
        FROM provenance pr
        JOIN statement_dependencies sd ON sd.child_id = pr.statement_id
        JOIN statements s              ON s.id        = sd.parent_id
        WHERE s.id <> ALL(pr.visited)
    )
    SELECT
        pr.depth,
        pr.statement_id,
        p.canonical_name                AS predicate,
        arg_names.names                 AS arg_names,
        pr.belief_mean,
        seb.effective_mean,
        pr.rule_name,
        pr.edge_weight,
        pr.derivation_type,
        pr.statement_kind
    FROM provenance pr
    JOIN objects p ON p.id = pr.predicate_id
    JOIN statement_effective_belief seb ON seb.id = pr.statement_id
    LEFT JOIN LATERAL (
        SELECT array_agg(o.canonical_name ORDER BY ord) AS names
        FROM unnest(pr.object_args) WITH ORDINALITY AS u(oid, ord)
        JOIN objects o ON o.id = u.oid
    ) arg_names ON true
    ORDER BY pr.depth, pr.statement_id;
$$;


-- ── [Fix 10] validate_kb_integrity ───────────────────────────
-- Runs a suite of consistency checks and returns one row per check
-- with violation count and diagnostic detail.
-- Intended to be called after bulk ingestion alongside detect_conflicts().
-- Returns rows only for checks that find violations when called normally;
-- pass p_all boolean true to see all checks including passing ones.
CREATE OR REPLACE FUNCTION validate_kb_integrity(
    p_context_id uuid    DEFAULT NULL,
    p_all        boolean DEFAULT false
) RETURNS TABLE (
    check_name       text,
    violation_count  int,
    detail           text
) LANGUAGE plpgsql STABLE AS $$
DECLARE
    v_context_id uuid;
    v_count      int;
BEGIN
    v_context_id := COALESCE(p_context_id, stable_uuid('reality', 'context'));

    -- 1. statement_args ↔ object_args sync
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    WHERE EXISTS (
        SELECT 1
        FROM unnest(s.object_args) WITH ORDINALITY u(oid, pos)
        WHERE NOT EXISTS (
            SELECT 1 FROM statement_args sa
            WHERE sa.statement_id = s.id
              AND sa.position     = (pos - 1)::int
              AND sa.object_id    = oid
        )
    );
    IF v_count > 0 OR p_all THEN
        check_name      := 'statement_args_sync';
        violation_count := v_count;
        detail          := 'Statements with object_args not fully mirrored in statement_args table';
        RETURN NEXT;
    END IF;

    -- 2. type_membership orphans (rows without a backing is_a statement)
    -- [Fix 15] The backing statement must be in the SAME context as the
    -- cache row, since memberships are now cached per context.
    SELECT COUNT(*)::int INTO v_count
    FROM type_membership tm
    WHERE NOT EXISTS (
        SELECT 1 FROM statements s
        WHERE s.predicate_id IN (
                  stable_uuid('is_a',        'predicate'),
                  stable_uuid('instance_of', 'predicate')
              )
          AND s.object_args[1] = tm.object_id
          AND s.object_args[2] = tm.type_id
          AND s.context_id     = tm.context_id
    );
    IF v_count > 0 OR p_all THEN
        check_name      := 'type_membership_orphans';
        violation_count := v_count;
        detail          := 'type_membership rows with no corresponding is_a/instance_of statement';
        RETURN NEXT;
    END IF;

    -- 3. forward_chained / abduced without provenance
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    WHERE s.derivation_type IN ('forward_chained', 'abduced')
      AND NOT EXISTS (
          SELECT 1 FROM statement_dependencies sd WHERE sd.child_id = s.id
      );
    IF v_count > 0 OR p_all THEN
        check_name      := 'missing_provenance';
        violation_count := v_count;
        detail          := 'forward_chained or abduced statements with no statement_dependencies rows';
        RETURN NEXT;
    END IF;

    -- 4. subtype_of cycles (any type that is its own ancestor)
    SELECT COUNT(DISTINCT child_id)::int INTO v_count
    FROM (
        WITH RECURSIVE subtype_closure AS (
            SELECT s.object_args[1] AS child_id, s.object_args[2] AS anc_id, 1 AS depth,
                   ARRAY[s.object_args[1]] AS visited_path
            FROM statements s
            WHERE s.predicate_id    = stable_uuid('subtype_of', 'predicate')
              AND s.statement_kind  = 'ontological'

            UNION ALL

            SELECT sc.child_id, s.object_args[2], sc.depth + 1,
                   sc.visited_path || s.object_args[1]
            FROM subtype_closure sc
            JOIN statements s ON s.object_args[1] = sc.anc_id
              AND s.predicate_id = stable_uuid('subtype_of', 'predicate')
            WHERE sc.depth < 50
              AND NOT (s.object_args[1] = ANY(sc.visited_path))
        )
        SELECT child_id FROM subtype_closure WHERE child_id = anc_id
    ) cycles;
    IF v_count > 0 OR p_all THEN
        check_name      := 'subtype_of_cycles';
        violation_count := v_count;
        detail          := 'Types that appear as their own ancestor in subtype_of';
        RETURN NEXT;
    END IF;

    -- 5. Sentinel objects in structural predicate positions
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    WHERE s.predicate_id IN (
              stable_uuid('is_a',           'predicate'),
              stable_uuid('subtype_of',     'predicate'),
              stable_uuid('same_as',        'predicate'),
              stable_uuid('different_from', 'predicate'),
              stable_uuid('equivalent_to',  'predicate')
          )
      AND EXISTS (
          SELECT 1
          FROM unnest(s.object_args) oid
          JOIN objects o ON o.id = oid
          WHERE o.is_sentinel
      );
    IF v_count > 0 OR p_all THEN
        check_name      := 'sentinel_in_structural';
        violation_count := v_count;
        detail          := 'Sentinel objects appearing in is_a/subtype_of/same_as/different_from/equivalent_to';
        RETURN NEXT;
    END IF;

    -- 6. Predicate–kind consistency violations
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    WHERE (
        s.predicate_id IN (
            stable_uuid('correlated_with', 'predicate'),
            stable_uuid('typical_of',      'predicate')
        ) AND s.statement_kind != 'statistical'
    ) OR (
        s.predicate_id  = stable_uuid('implies', 'predicate')
        AND s.statement_kind != 'rule'
    ) OR (
        s.predicate_id IN (
            stable_uuid('subtype_of',    'predicate'),
            stable_uuid('disjoint_with', 'predicate'),
            stable_uuid('equivalent_to', 'predicate'),
            stable_uuid('opposite_of',   'predicate'),
            stable_uuid('different_from','predicate')
        ) AND s.statement_kind != 'ontological'
    );
    IF v_count > 0 OR p_all THEN
        check_name      := 'predicate_kind_mismatch';
        violation_count := v_count;
        detail          := 'Statements where predicate requires a specific statement_kind not set';
        RETURN NEXT;
    END IF;

    -- 7. Dependency graph cycles
    SELECT COUNT(DISTINCT child_id)::int INTO v_count
    FROM (
        WITH RECURSIVE dep_closure AS (
            SELECT sd.parent_id, sd.child_id, 1 AS depth,
                   ARRAY[sd.parent_id] AS visited_path
            FROM statement_dependencies sd

            UNION ALL

            SELECT dc.parent_id, sd.child_id, dc.depth + 1,
                   dc.visited_path || sd.parent_id
            FROM dep_closure dc
            JOIN statement_dependencies sd ON sd.parent_id = dc.child_id
            WHERE dc.depth < 50
              AND NOT (sd.parent_id = ANY(dc.visited_path))
        )
        SELECT child_id FROM dep_closure WHERE parent_id = child_id
    ) dep_cycles;
    IF v_count > 0 OR p_all THEN
        check_name      := 'dependency_cycles';
        violation_count := v_count;
        detail          := 'Statements that are their own ancestor in statement_dependencies';
        RETURN NEXT;
    END IF;

    -- 8. disjointness_kind set on non-disjoint_with statements
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    WHERE s.disjointness_kind IS NOT NULL
      AND s.predicate_id != stable_uuid('disjoint_with', 'predicate');
    IF v_count > 0 OR p_all THEN
        check_name      := 'disjointness_kind_misuse';
        violation_count := v_count;
        detail          := 'disjointness_kind set on statements whose predicate is not disjoint_with';
        RETURN NEXT;
    END IF;

    -- 9. [Fix 16] content_hash consistency: the stored hash must match a
    -- recomputation from the identity fields. A mismatch means a row was
    -- modified by a path that bypassed trg_a_validate_statement_args.
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    WHERE s.content_hash != md5(
        s.predicate_id::text
        || '|' || array_to_string(s.object_args, ',')
        || '|' || s.literal_args::text
        || '|' || s.context_id::text
        || '|' || s.t_kind::text
        || '|' || coalesce(s.t_start::text, '')
        || '|' || coalesce(s.t_end::text,   '')
    );
    IF v_count > 0 OR p_all THEN
        check_name      := 'content_hash_drift';
        violation_count := v_count;
        detail          := 'Statements whose content_hash does not match their identity fields';
        RETURN NEXT;
    END IF;

    -- 10. [Fix 23] Stale derived beliefs: forward_chained statements
    -- (with at least one non-inverse provenance group) whose stored
    -- belief differs from a dry-run recompute. Non-empty results mean a
    -- propagation path was bypassed (e.g. a conflict opened on a parent,
    -- or source credibility changed) — run recompute_derived_belief()
    -- on the listed statements or their roots.
    SELECT COUNT(*)::int INTO v_count
    FROM statements s
    CROSS JOIN LATERAL recompute_derived_belief(s.id, false) r
    WHERE s.derivation_type = 'forward_chained'
      AND EXISTS (
          SELECT 1 FROM statement_dependencies sd
          WHERE sd.child_id = s.id
            AND COALESCE(sd.rule_name, '') != 'inverse_predicate'
      )
      AND r.changed
      -- float jitter tolerance
      AND (abs(s.belief_alpha - r.out_alpha) > 1e-9
           OR abs(s.belief_beta - r.out_beta) > 1e-9);
    IF v_count > 0 OR p_all THEN
        check_name      := 'stale_derived_belief';
        violation_count := v_count;
        detail          := 'forward_chained statements whose belief differs from recomputation over their provenance';
        RETURN NEXT;
    END IF;

END;
$$;


-- ── [Fix 10, Fix 20] truth_status ─────────────────────────────
-- Returns the epistemic status of a proposition at a given time.
-- Four states (Fix 20):
--   'supported'    — at least one matching statement holds with
--                    effective_mean > threshold at the query time.
--   'contradicted' — matching statements exist, none holds above
--                    threshold, AND at least one of them is party to an
--                    OPEN direct_negation or value_conflict: the claim
--                    is actively opposed.
--   'insufficient' — matching statements exist, none holds above
--                    threshold, and there is NO open opposition. The
--                    claim is merely under-supported. (v0.8 mislabelled
--                    this 'contradicted', so a lone weak statement with
--                    no opposition whatsoever read as evidence of
--                    negation — undermining the open-world guarantee the
--                    function exists to provide.)
--   'unknown'      — no statements at all: the genuine open-world case.
--
-- The system makes no claim from silence, and no longer manufactures
-- contradiction from mere weakness.
CREATE OR REPLACE FUNCTION truth_status(
    p_predicate_id uuid,
    p_object_args  uuid[],
    p_context_id   uuid        DEFAULT NULL,
    p_time         timestamptz DEFAULT NULL,
    p_threshold    float       DEFAULT 0.5
) RETURNS text LANGUAGE plpgsql STABLE AS $$
DECLARE
    v_context_id      uuid;
    v_total_count     int;
    v_supported_count int;
    v_has_opposition  boolean;
    v_query_time      timestamptz;
BEGIN
    v_context_id := COALESCE(p_context_id, stable_uuid('reality', 'context'));
    v_query_time := COALESCE(p_time, now());

    -- Check if any relevant statements exist at all
    SELECT COUNT(*)::int INTO v_total_count
    FROM statements s
    WHERE s.predicate_id  = p_predicate_id
      AND s.object_args   = p_object_args
      AND s.context_id    = v_context_id
      AND s.statement_kind != 'rule';

    IF v_total_count = 0 THEN
        RETURN 'unknown';
    END IF;

    -- Check if any statement holds above threshold at query time
    SELECT COUNT(*)::int INTO v_supported_count
    FROM holds_at(
        p_predicate_id, p_object_args,
        v_query_time, v_context_id,
        'open_world', p_threshold, 0.0
    );

    IF v_supported_count > 0 THEN
        RETURN 'supported';
    END IF;

    -- [Fix 20] Below threshold: distinguish active opposition from mere
    -- weakness.
    SELECT EXISTS (
        SELECT 1
        FROM conflicts c
        JOIN statements s
          ON s.id IN (c.statement_a, c.statement_b)
        WHERE c.resolved      = false
          AND c.conflict_kind IN ('direct_negation', 'value_conflict')
          AND s.predicate_id  = p_predicate_id
          AND s.object_args   = p_object_args
          AND s.context_id    = v_context_id
    ) INTO v_has_opposition;

    IF v_has_opposition THEN
        RETURN 'contradicted';
    ELSE
        RETURN 'insufficient';
    END IF;
END;
$$;


-- =============================================================
-- SEED DATA
-- Wrapped in a single transaction so DEFERRABLE INITIALLY DEFERRED
-- orphan-guard and provenance triggers fire at COMMIT.
-- =============================================================

BEGIN;

-- ── Infrastructure objects ────────────────────────────────────
INSERT INTO objects (id, kind, canonical_name, display_name, description, is_sentinel) VALUES

    -- Contexts
    (stable_uuid('reality', 'context'),
     'context', 'reality', 'Reality',
     'The default real-world context', false),

    -- Sources
    (stable_uuid('user_parent', 'source'),
     'source', 'user_parent', 'User (parent)',
     'Primary user — highest trust, analogous to a parent', false),

    (stable_uuid('wikidata', 'source'),
     'source', 'wikidata', 'Wikidata',
     'Wikidata knowledge graph', false),

    (stable_uuid('llm_generated', 'source'),
     'source', 'llm_generated', 'LLM generated',
     'Fact proposed by language model; lower prior trust', false),

    (stable_uuid('system_kernel', 'source'),
     'source', 'system_kernel', 'System kernel',
     'Axiomatic facts at KB initialisation. Near-certain (alpha=999). '
     'is_protected=true: update_trust() requires explicit p_override=true.',
     false),

    -- [Fix 8] Boolean / epistemic sentinels (is_sentinel = true)
    (stable_uuid('true',    'entity'), 'entity', 'true',    'True',
     'The Boolean value true', true),

    (stable_uuid('false',   'entity'), 'entity', 'false',   'False',
     'The Boolean value false', true),

    -- unknown: epistemic state — identity or value is not known.
    -- NOT a scope or period placeholder.
    (stable_uuid('unknown', 'entity'), 'entity', 'unknown', 'Unknown',
     'Epistemic state: identity or value is unknown. '
     'NOT a scope placeholder (use no_scope). '
     'NOT a time-period placeholder (use no_period).', true),

    -- no_scope: role genuinely has no institutional scope.
    -- Use has_role(X, role, no_scope) when the role is unscoped by design.
    -- Restricted to role-scope arguments; do NOT use for time-period args.
    (stable_uuid('no_scope', 'entity'), 'entity', 'no_scope', 'No Scope',
     'Sentinel: this role or relation has no institutional scope. '
     'Use has_role(X, role, no_scope) when the role is genuinely unscoped. '
     'Restricted to role-scope arguments. Distinct from unknown scope '
     '(unknown = scope exists but is not known).', true),

    -- no_period: third arg of located_in and similar ternary predicates
    -- when no named historical period is the semantic argument.
    -- Temporal scope is encoded in t_start / t_end fuzzy_time fields.
    (stable_uuid('no_period', 'entity'), 'entity', 'no_period', 'No Period',
     'Sentinel: no named time period is the semantic argument of this relation. '
     'Use as the time_period arg of located_in(entity, place, no_period) when '
     'temporal scope is expressed in t_start/t_end. '
     'Distinct from no_scope (role-scope) and unknown (epistemic state).', true);


-- ── Ontological backbone objects ──────────────────────────────
INSERT INTO objects (id, kind, canonical_name, display_name, description, is_sentinel) VALUES

    -- Layer A: top-level ontological categories
    (stable_uuid('entity',    'entity'), 'entity', 'entity',    'Entity',
     'Top-level ontological category: everything that exists or is modeled', false),
    (stable_uuid('concrete',  'entity'), 'entity', 'concrete',  'Concrete',
     'Entities with spatiotemporal existence', false),
    (stable_uuid('abstract',  'entity'), 'entity', 'abstract',  'Abstract',
     'Entities without spatiotemporal existence: concepts, numbers, relations', false),
    (stable_uuid('living',    'entity'), 'entity', 'living',    'Living',
     'Concrete entities that are or were alive', false),
    (stable_uuid('animate',   'entity'), 'entity', 'animate',   'Animate',
     'Living entities capable of self-directed movement', false),
    (stable_uuid('sapient',   'entity'), 'entity', 'sapient',   'Sapient',
     'Animate entities with higher cognition', false),
    (stable_uuid('artifact',  'entity'), 'entity', 'artifact',  'Artifact',
     'Concrete entities created by agents', false),
    (stable_uuid('process',   'entity'), 'entity', 'process',   'Process',
     'Events or processes: creation, destruction, transformation. '
     'Full hierarchy (process ⊂ event_type ⊂ abstract ⊂ entity) seeded '
     'in common_objects_kernel.sql.', false),
    (stable_uuid('group',     'entity'), 'entity', 'group',     'Group',
     'Collections of entities. Not automatically an agent — see has_role.', false),
    (stable_uuid('person',    'entity'), 'entity', 'person',    'Person',
     'A human individual (subtype of sapient)', false),
    (stable_uuid('number',    'entity'), 'entity', 'number',    'Number',
     'Abstract numeric entity', false),
    (stable_uuid('relation',  'entity'), 'entity', 'relation',  'Relation',
     'Abstract relational entity', false),

    -- Layer B: functional roles (contextual, time-aware)
    (stable_uuid('agent',       'entity'), 'entity', 'agent',       'Agent',
     'Functional role: entity that acts with intention in some context. '
     'Use has_role(X, agent, context) rather than typing X as agent.', false),
    (stable_uuid('institution', 'entity'), 'entity', 'institution', 'Institution',
     'Functional role: organised group acting as a unit', false),
    (stable_uuid('government',  'entity'), 'entity', 'government',  'Government',
     'Functional role: governing body of a polity', false);


-- ── Predicate objects and metadata ────────────────────────────
INSERT INTO objects (id, kind, canonical_name, display_name, description, is_sentinel) VALUES

    (stable_uuid('subtype_of',   'predicate'), 'predicate', 'subtype_of',   'Subtype of',
     'T1 is a subtype of T2. Probabilistic subsumption.', false),
    (stable_uuid('instance_of',  'predicate'), 'predicate', 'instance_of',  'Instance of',
     'X is an instance of type T. '
     'CANONICAL TYPE MECHANISM: inserting an instance_of statement '
     'automatically populates the type_membership cache.', false),
    (stable_uuid('has_role',     'predicate'), 'predicate', 'has_role',     'Has role',
     'Entity holds a functional role within a scope/context. '
     'Use no_scope as the scope arg when the role is genuinely unscoped.', false),
    (stable_uuid('has_capacity', 'predicate'), 'predicate', 'has_capacity', 'Has capacity',
     'Entity possesses a capability. Distinct from roles: capacities are '
     'properties, roles are relational.', false),
    (stable_uuid('models_as',    'predicate'), 'predicate', 'models_as',    'Models as',
     'Subject is modeled as a type within a context (non-ontological).', false);

INSERT INTO predicates
    (id, arity, arg_labels, nl_description, is_basis, domain_strictness, status)
VALUES
    (stable_uuid('subtype_of',   'predicate'), 2,
     ARRAY['subtype','supertype'],
     'First argument is a subtype of the second.',
     true, 'soft', 'confirmed'),

    (stable_uuid('instance_of',  'predicate'), 2,
     ARRAY['instance','type'],
     'First argument is an instance of the second type. '
     'Populates type_membership automatically.',
     true, 'soft', 'confirmed'),

    (stable_uuid('has_role',     'predicate'), 3,
     ARRAY['entity','role','scope'],
     'Entity holds the given functional role within the given scope. '
     'Use no_scope as scope when the role has no institutional scope.',
     false, 'none', 'confirmed'),

    (stable_uuid('has_capacity', 'predicate'), 2,
     ARRAY['entity','capacity'],
     'Entity possesses the given capability.',
     false, 'none', 'confirmed'),

    (stable_uuid('models_as',    'predicate'), 3,
     ARRAY['subject','type','context'],
     'Subject is modeled as a type within a context (non-ontological).',
     false, 'none', 'confirmed');


-- ── Context row ───────────────────────────────────────────────
INSERT INTO contexts (id, kind, parent_id) VALUES
    (stable_uuid('reality', 'context'), 'reality', NULL);


-- ── Source credibility ────────────────────────────────────────
INSERT INTO source_credibility (source_id, context_id, alpha, beta, is_protected) VALUES
    (stable_uuid('user_parent',   'source'),
     stable_uuid('reality',       'context'),  19.0,  1.0,  false),

    (stable_uuid('wikidata',      'source'),
     stable_uuid('reality',       'context'),  13.0,  2.0,  false),

    (stable_uuid('llm_generated', 'source'),
     stable_uuid('reality',       'context'),   3.0,  2.0,  false),

    -- system_kernel: ~99.9% credibility prior; protected from passive drift.
    (stable_uuid('system_kernel', 'source'),
     stable_uuid('reality',       'context'), 999.0,  1.0,  true);


-- ── Ontological backbone statements ───────────────────────────
-- All sourced from system_kernel; axiomatic derivation; eternal.
-- statement_kind = 'ontological' for all subtype_of assertions.
-- The transitional process ⊂ entity stub from v0.6/v0.7 is removed;
-- the full chain process ⊂ event_type ⊂ abstract ⊂ entity is seeded
-- in common_objects_kernel.sql.
--
-- disjoint_with statements (abstract ⊥ concrete and descendants) are
-- seeded in common_objects_kernel.sql after disjoint_with predicate
-- is defined in common_predicates_kernel.sql, to avoid a forward
-- reference to a predicate not yet defined at schema init time.

INSERT INTO statements
    (id, predicate_id, object_args, belief_alpha, belief_beta,
     interpretation, statement_kind, t_kind, context_id, derivation_type, derivation_depth)
VALUES
    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('concrete','entity'),  stable_uuid('entity','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('abstract','entity'),  stable_uuid('entity','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('living','entity'),    stable_uuid('concrete','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('animate','entity'),   stable_uuid('living','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('sapient','entity'),   stable_uuid('animate','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('person','entity'),    stable_uuid('sapient','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('artifact','entity'),  stable_uuid('concrete','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('group','entity'),     stable_uuid('entity','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('number','entity'),    stable_uuid('abstract','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0),

    (gen_random_uuid(), stable_uuid('subtype_of','predicate'),
     ARRAY[stable_uuid('relation','entity'),  stable_uuid('abstract','entity')],
     999,1,'ontological','ontological','eternal',stable_uuid('reality','context'),'axiomatic',0)
-- [Fix 16] content_hash is the arbiter: re-applying the seed (or a
-- kernel re-asserting a backbone axiom) is a silent no-op instead of a
-- duplicate atom.
ON CONFLICT (content_hash) DO NOTHING;

COMMIT;