@clien-ai/mcp 0.10.1 → 0.10.3

package/dist/tools/report-digest.js

@@ -59,6 +59,55 @@ const CLAIM_RENDER_CAP = 40;
 const CLAIM_TEXT_MAX = 140;
 /** Max personas / hypotheses / disagreements listed before capping. */
 const LIST_RENDER_CAP = 25;
+/**
+ * Max chars of a hypothesis STATEMENT on a robustness row's first continuation
+ * line (FUL-614).
+ *
+ * This is the one of the three that drives the budget: `statement` is required by
+ * `HypothesisResultSchema` and was present on 371/371 hypothesis rows across the 49
+ * production jobs that carry any, so it renders on every row the section shows, and it
+ * is the only one of the three whose length nothing upstream bounds.
+ *
+ * Worst case is `LIST_RENDER_CAP` rows x (160 + ~20 for the label, indent, quotes and
+ * newline) ~= 4.5KB of statement lines on a saturated digest. ⚠️ THAT IS NOT THE WHOLE
+ * SECTION'S BUDGET: `evidenceReading` renders on nearly every row too (see
+ * {@link renderRobustness} for why its measured 3.8% is a fact about the stored corpus
+ * rather than about the field), adding 25 x (~85 for the composed sentence + ~15 of
+ * label and indent) ~= 2.5KB, so ~7KB together. A typical run has 5-8 hypotheses, so
+ * ~1.5-2KB. `scopeCaveat` stays off the budget at a real 7%.
+ */
+const HYPOTHESIS_STATEMENT_MAX = 160;
+/**
+ * Max chars of a `scopeCaveat` / `evidenceReading` continuation line (FUL-614).
+ *
+ * Both are specified as ONE LINE by their producers — the synthesiser prompt asks
+ * for "a one-line note naming the mismatch", and `evidenceReading` is composed from
+ * a fixed template in `agent/src/hypothesis-reading.ts` — so this is a defensive
+ * ceiling on values that should already be well under it, in the same spirit as
+ * {@link VERDICT_SUMMARY_MAX}, not a routine trim.
+ *
+ * It can be looser than {@link HYPOTHESIS_STATEMENT_MAX} because both fields are BOUNDED
+ * BY THEIR PRODUCERS in a way `statement` is not — the longest sentence
+ * `deriveEvidenceReading`'s template can compose runs ~96 chars, and the caveat is
+ * prompted as one line — NOT because either is rare. `statement` is free model prose the
+ * synthesiser echoes from the plan under no length instruction at all, so 160 there is a
+ * real trim rather than a backstop.
+ */
+const HYPOTHESIS_NOTE_MAX = 200;
+/**
+ * Max persona NAMES listed inside one group of a disagreement row (FUL-616).
+ *
+ * A separate cap from `LIST_RENDER_CAP` because it multiplies against it rather
+ * than sitting beside it: the split rows are already capped at 25, and each row
+ * now carries three name groups. Ten is comfortably above the personas a real run
+ * interviews, so this is a runaway backstop on a drifted payload and not a routine
+ * trim — the same posture `CLAIM_RENDER_CAP` takes.
+ *
+ * The overflow is STATED inline (`, +3 more`) rather than silently cut, for the
+ * reason the module header gives: a silent truncation reads as "that was all of
+ * them", and in this section that would read as "nobody else pushed back".
+ */
+const SPLIT_NAME_CAP = 10;
 /**
  * The MODEL-ATTESTED tier's user-facing word, lower-cased for inline prose (FUL-363).
  *
@@ -109,6 +158,31 @@ const ATTESTED_WINDOW_LABEL = 'cited window (NOT a verified span)';
  * carries the meaning the shared word no longer can.
  */
 const UNSOURCED_LABEL = 'unsourced';
+/**
+ * The three labels on a robustness row's continuation lines (FUL-614).
+ *
+ * ⚠️ THE LABEL IS THE GUARD, for the same reason `ATTESTED_WINDOW_LABEL`'s doc gives:
+ * `\n    "…"` is EXACTLY the shape `renderReceiptPools` gives a verified persona
+ * receipt, so an unlabelled indented quote under a verdict row would read as evidence
+ * that something was checked. A hypothesis statement is the opposite — it is the
+ * assertion under test, not support for it.
+ *
+ * ⚠️ THE QUOTING IS ALSO LOAD-BEARING, and it is the prose/proof line this file's header
+ * states (FUL-510). `statement` and `scopeCaveat` are MODEL-WRITTEN, so they render as
+ * QUOTED, labelled values — attributed to the run, exactly as `renderPersonaClaim`
+ * already carries a claim's model-written `text` below the `---`. `evidenceReading` is
+ * CODE-COMPOSED (`deriveEvidenceReading` in `agent/src/hypothesis-reading.ts` is its sole
+ * writer and STRIPS any model-supplied value on the rows it does not cover), so the digest
+ * states it unquoted, in its own voice. What never crosses is a model-written JUDGEMENT
+ * about the run — that is `verdictSummary`, and it renders above the separator.
+ *
+ * `EVIDENCE_READING_LABEL` deliberately echoes the report markdown's own `- **Rests on**:`
+ * (`agent/src/report-generator.ts`). One field, one word for it, on both surfaces — the
+ * lesson `ATTESTED_LABEL` above records the hard way.
+ */
+const HYPOTHESIS_LABEL = 'hypothesis';
+const SCOPE_CAVEAT_LABEL = '⚠️ scope caveat — persona support from OUTSIDE its credibility domain; directional, NOT grounded';
+const EVIDENCE_READING_LABEL = 'rests on';
 // ---------------------------------------------------------------------------
 // Defensive accessors — every one of these answers "or nothing" rather than throwing
 // ---------------------------------------------------------------------------
@@ -667,6 +741,24 @@ function renderPersonas(reportData, channel) {
  * The anti-sycophancy readout — deterministically computed from the interviews,
  * not model-opined, which is exactly why it belongs in the text: it is the one
  * signal that says whether the personas actually pushed back or just agreed.
+ *
+ * FUL-616 gave the section its own evidence. It used to render six of the sixteen
+ * fields its four schemas declare, and the ten it withheld were the substance behind
+ * the six it printed: a headline claim about the rejection COUNT with no rejection
+ * behind it, and a split rendered as three integers when WHICH persona pushed back is
+ * usually the whole finding — "the buyer said no, the user said yes" is a different
+ * result from "1 of 3 disagreed". Names and rejections now render; the discrimination
+ * ratio and the tradeoff rows deliberately do not (see the allowlist reasons in
+ * `render-coverage.test.ts` — tradeoffs are the largest of the four shapes and the
+ * furthest from the question this section answers, so they stay the first thing to cut).
+ *
+ * ⚠️ THE COUNTS STAY BESIDE THE NAMES ON A SPLIT ROW, and that is a trust decision
+ * rather than a formatting one. A count is `array.length` — nothing a value can forge.
+ * A name is untrusted text: personas are user- or model-named, so a persona called
+ * `Ada, Marcus` renders as two supporters inside its group's parentheses. Keeping the
+ * integer in front means such a row disagrees with itself visibly (`1 supportive (Ada,
+ * Marcus)`) instead of quietly overstating who agreed with the idea — in the one
+ * section a reader consults precisely to find out whether the agreement was real.
  */
 function renderSycophancy(reportData, channel) {
     const signals = asRecord(reportData.sycophancySignals);
@@ -681,6 +773,12 @@ function renderSycophancy(reportData, channel) {
     const disagreements = asArray(signals.disagreements);
     const lines = [];
     // A healthy run has ≥1 explicit rejection; zero is itself the warning.
+    //
+    // ⚠️ THIS LINE IS THE SECTION'S HEADLINE AND IT IS UNCHANGED BY FUL-616. The
+    // zero case is the case the section exists for — a run where nobody said no is
+    // the classic sycophancy signature — and it renders with no evidence block below
+    // it because there is no evidence, which is the finding. A change to this readout
+    // that only looks right on a run WITH rejections has broken exactly that case.
     if (totalRejections !== null) {
         lines.push(totalRejections === 0
             ? '⚠️ 0 explicit rejections across all personas — nobody said no to anything. A run with no ' +
@@ -693,10 +791,13 @@ function renderSycophancy(reportData, channel) {
             // FUL-253: joined into one warning line, so a newline in a name would end
             // the warning early and leave the rest of the flagged personas rendering
             // as ordinary text below it.
-            .map((raw) => safeInline(asRecord(raw)?.personaName, 100) ?? '(unnamed)');
+            .map((raw) => personaLabel(raw));
         lines.push(`⚠️ ${lowDiscriminationCount} persona(s) flagged \`lowDiscrimination\` (uniformly supportive AND ` +
             `rejected nothing — their answers carry little signal): ${names.join(', ')}`);
     }
+    const rejections = renderRejections(personaSignals, channel);
+    if (rejections)
+        lines.push(rejections);
     if (disagreements.length > 0) {
         const shown = disagreements.slice(0, LIST_RENDER_CAP);
         lines.push(`Hypotheses the personas SPLIT on (disagreement is signal, not noise):\n` +
@@ -704,10 +805,9 @@ function renderSycophancy(reportData, channel) {
                 .map((raw) => {
                 const d = asRecord(raw);
                 const id = renderId(d?.hypothesisId);
-                const supportive = asArray(d?.supportive).length;
-                const negative = asArray(d?.negative).length;
-                const neutral = asArray(d?.neutral).length;
-                return `  - ${id}: ${supportive} supportive / ${neutral} neutral / ${negative} pushed back`;
+                return (`  - ${id}: ${splitGroup(d?.supportive, 'supportive')}` +
+                    ` / ${splitGroup(d?.neutral, 'neutral')}` +
+                    ` / ${splitGroup(d?.negative, 'pushed back')}`);
             })
                 .join('\n') +
             capNote(shown.length, disagreements.length, channel, 'report_data.sycophancySignals.disagreements'));
@@ -717,6 +817,149 @@ function renderSycophancy(reportData, channel) {
     }
     return `### Anti-sycophancy\n${lines.join('\n')}`;
 }
+/**
+ * The continuation lines under one robustness row (FUL-614).
+ *
+ * Returns '' when the row has nothing to add. A field that is absent, empty or
+ * whitespace-only emits NO LINE — never a label with nothing after it, which would
+ * read as "the run recorded a scope caveat and we cannot show it" on the 93% of rows
+ * that simply have none. That is `safeInline`'s own `null` contract, and here it is
+ * the whole difference between a qualification and a false alarm.
+ *
+ * ⚠️ EVERY VALUE GOES THROUGH `safeInline`, and the reason is the one `renderRobustness`
+ * already states for `status` / `downgradedStatus`: these rows are `- ` entries whose
+ * point is the ⚠️ FLIPPED warning, and `statement` / `scopeCaveat` are MODEL-WRITTEN —
+ * the first untrusted prose to reach this section. A newline in either ends the line
+ * early and lets the remainder pose as a sibling row for the same hypothesis WITHOUT the
+ * warning, which is precisely the reading a forgery would want to drop (FUL-253).
+ * `render-forgery.test.ts` has planted poisoned values on these three fields since
+ * FUL-263 — before anything rendered them, which is that file's whole premise — so its
+ * assertions bit on this change with no fixture edit.
+ */
+function hypothesisDetail(result) {
+    const statement = safeInline(result?.statement, HYPOTHESIS_STATEMENT_MAX);
+    const scopeCaveat = safeInline(result?.scopeCaveat, HYPOTHESIS_NOTE_MAX);
+    const evidenceReading = safeInline(result?.evidenceReading, HYPOTHESIS_NOTE_MAX);
+    return ((statement ? `\n    ${HYPOTHESIS_LABEL}: "${statement}"` : '') +
+        (scopeCaveat ? `\n    ${SCOPE_CAVEAT_LABEL}: "${scopeCaveat}"` : '') +
+        (evidenceReading ? `\n    ${EVIDENCE_READING_LABEL}: ${evidenceReading}` : ''));
+}
+/**
+ * What a persona name that arrived unreadable renders as (FUL-616).
+ *
+ * One bare word carrying no punctuation of its own, so each caller decides the
+ * shape around it: `personaLabel` parenthesises it because it stands in for a
+ * whole label, and `splitGroup` prints it bare because the group already supplies
+ * the parentheses. Parenthesising it in both places produced
+ * `1 pushed back ((unnamed))` — doubled brackets that read as a formatting bug on
+ * exactly the drift path where a reader has least evidence to tell a bug from the
+ * data it is describing.
+ */
+const UNNAMED_PERSONA = 'unnamed';
+/**
+ * How a persona is named wherever the anti-sycophancy section names one (FUL-616).
+ *
+ * The role is here because the name alone was ambiguous in the only place this
+ * section ever printed one — the flagged list — and FUL-616 adds a second place
+ * (the rejection rows), which would have reproduced the same ambiguity in new
+ * text. Two personas can easily share a first name in one run; "Dana (VP
+ * Engineering)" and "Dana (Founder)" are two different findings about who
+ * rubber-stamped the idea, and telling them apart is the point of naming anyone.
+ *
+ * Both halves go through `safeInline` at the budget `renderPersonaSpine` already
+ * spends on the same two fields, so the same persona is clipped identically
+ * wherever the digest names it.
+ */
+function personaLabel(raw) {
+    const persona = asRecord(raw);
+    const name = safeInline(persona?.personaName, 100) ?? `(${UNNAMED_PERSONA})`;
+    const role = safeInline(persona?.personaRole, 100);
+    return role ? `${name} (${role})` : name;
+}
+/**
+ * One stance group of a disagreement row: the count, then who (FUL-616).
+ *
+ * COUNT FIRST, deliberately — see the forgery note on `renderSycophancy`. The
+ * integer is derived from the array and cannot be influenced by what is in it, so
+ * it stays the authoritative half of the group and the names are the detail it
+ * carries. An empty group renders as the bare count (`0 neutral`) rather than as
+ * an empty pair of parentheses, matching `safeInline`'s rule that "nothing to say"
+ * gets a caller-chosen wording instead of empty punctuation.
+ *
+ * COST — this is the one cap here that MULTIPLIES, so its ceiling is stated rather
+ * than left to be derived. Worst case is `LIST_RENDER_CAP` split rows × 3 groups ×
+ * `SPLIT_NAME_CAP` names × the 100-char `safeInline` budget ≈ 76 KB, an order above
+ * anything else the digest renders. That number is a DRIFTED-PAYLOAD CEILING, not a
+ * run cost, and the two bounds it multiplies are not independent in a real run: a
+ * disagreement row exists per hypothesis and its groups partition the persona pool,
+ * so five hypotheses across five personas is 5 × 3 groups × ≤5 short names. MEASURED
+ * on the 5-persona, 3-split, 4-rejection run {@link renderRejections} also cites: all
+ * three split rows together are ~330 bytes of the section's ~1,100 — every persona in
+ * every row, the densest a run of that size gets. Even all 25 rows at that density is
+ * under 3 KB; reaching a tenth of the ceiling takes a `report_data` no
+ * synthesis run can produce — which is what a backstop is for, the posture
+ * `CLAIM_RENDER_CAP` already takes.
+ */
+function splitGroup(raw, label) {
+    const names = asArray(raw).map((n) => safeInline(n, 100) ?? UNNAMED_PERSONA);
+    const shown = names.slice(0, SPLIT_NAME_CAP);
+    const dropped = names.length - shown.length;
+    const who = shown.length > 0 ? ` (${shown.join(', ')}${dropped > 0 ? `, +${dropped} more` : ''})` : '';
+    return `${names.length} ${label}${who}`;
+}
+/**
+ * The rejection rows — the evidence behind the section's own headline (FUL-616).
+ *
+ * ⚠️ THE INTRO LINE SAYS WHAT THIS TEXT IS NOT, and that is a guard rather than a
+ * caveat. These reasons are indented quoted prose, which is the exact shape
+ * `renderReceiptPools` gives a verified persona receipt and the shape FUL-615 had to
+ * put a label in front of for the same reason. A synthetic persona's reason for
+ * saying no is not a source quote and must never be cited as one; the section's own
+ * value depends on that line staying honest, because a reader who mistook these for
+ * retrieved quotes would be trusting the sycophancy readout MORE than the report it
+ * is a check on.
+ *
+ * ⚠️ ROWS ARE NOT FILTERED FOR SUBSTANCE, on purpose. `computeSycophancySignals`
+ * already drops hollow `{ option: '', reason: '' }` rejections before storing — that
+ * filter is what makes `totalRejections` a real count rather than a presence tally —
+ * so a row reaching here with nothing in it is DRIFT, and the honest render is a row
+ * saying so. Dropping it silently would make this block disagree with the headline
+ * count above it and give a reader no way to see which number was wrong.
+ *
+ * Clipping reuses this file's existing budgets rather than minting one: `CLAIM_TEXT_MAX`
+ * for the reason (the cap the digest already spends on model-written claim prose, which
+ * is what this is) and the 100 `renderPersonaSpine` spends on a short persona field for
+ * the option label.
+ *
+ * DIGEST COST, in the idiom `RECEIPT_QUOTE_MAX`'s doc sets, because a digest an agent
+ * truncates is a digest it does not read. Bounded by construction at `LIST_RENDER_CAP`
+ * (25) rows × (140 + 100 + ~40 for the label, indent and separators) ≈ 7 KB worst case.
+ * MEASURED on a 5-persona, 4-rejection, 3-split run: the whole section is ~1,100 bytes,
+ * of which this block is ~320 — against the +8,360 FUL-247 spent on the receipt quotes.
+ * A run with ZERO rejections — the case this section exists for — adds nothing at all.
+ */
+function renderRejections(personaSignals, channel) {
+    const rows = [];
+    let total = 0;
+    for (const raw of personaSignals) {
+        const label = personaLabel(raw);
+        for (const rejectionRaw of asArray(asRecord(raw)?.rejections)) {
+            total += 1;
+            if (rows.length >= LIST_RENDER_CAP)
+                continue;
+            const rejection = asRecord(rejectionRaw);
+            const option = safeInline(rejection?.option, 100) ?? '(option not recorded)';
+            const reason = safeInline(rejection?.reason, CLAIM_TEXT_MAX);
+            rows.push(`  - ${label} ✕ ${option}${reason ? ` — "${reason}"` : ''}`);
+        }
+    }
+    if (rows.length === 0)
+        return '';
+    return ('What the personas explicitly rejected (the evidence behind the count above — the wording is a ' +
+        'SYNTHETIC persona\'s own, never a retrieved source quote, and must not be cited as one):\n' +
+        rows.join('\n') +
+        capNote(rows.length, total, channel, 'report_data.sycophancySignals.personaSignals'));
+}
 /**
  * Hypothesis verdict robustness.
  *
@@ -724,6 +967,37 @@ function renderSycophancy(reportData, channel) {
  * report's top-level `status` is NOT the verdict to act on — `downgradedStatus`
  * is. That inversion is precisely the kind of thing an agent gets wrong when it
  * reads only the prose, so it is stated per-hypothesis rather than as a footnote.
+ *
+ * FUL-614: a row used to identify its hypothesis BY ID ALONE, so the sharpest line in
+ * this digest named something a reader could only resolve by grepping the prose above
+ * for `H3`. It now carries the statement, and — where the run set them — the FUL-102
+ * scope caveat and the FUL-396 evidence reading, on labelled continuation lines. See
+ * {@link hypothesisDetail}.
+ *
+ * ⚠️ WHAT MAKES A FIELD THE ACTUAL GAP IS HOW OFTEN IT IS THERE — and a coverage rate
+ * says that only once it is DATED AGAINST THE PRODUCER THAT WRITES IT. Measured
+ * 2026-08-24 over the 49 stored production jobs carrying `hypothesisResults` (371 rows):
+ * `statement` 371/371, `scopeCaveat` 7%, `evidenceReading` 14/371 (3.8%). The first two
+ * are properties of the fields. The third is NOT. `withEvidenceReadings` — its sole
+ * writer, and the reason the line is code-composed rather than opined — landed
+ * 2026-08-17 (FUL-396), one week before that measurement, and
+ * `agent/src/hypothesis-reading.ts` documents 357/357 production hypotheses carrying at
+ * least one evidence item. So 3.8% is the age of the stored corpus, not the rarity of
+ * the field: it fires on essentially every row written since, and the 14 rows that carry
+ * it are consistent with being exactly that post-landing slice. `scopeCaveat`'s 7%
+ * survives the same check — its prompt has shipped since 2026-07-12 (FUL-102).
+ *
+ * So `statement` is what makes every row self-describing, `evidenceReading` joins it on
+ * nearly every row from here on, and `scopeCaveat` is the one field of the three that
+ * reaches NO other agent-visible text at all:
+ * `generateReportMarkdown` prints the statement as a heading, the evidence reading as
+ * `- **Rests on**:` and every robustness variant as its own bullet, but it has never
+ * printed the scope caveat. A verdict whose persona support came from outside that
+ * persona's credibility domain reached an agent with nothing marking it.
+ *
+ * The variants block and the evidence arrays stay out, decided with Alex on the same
+ * measurement: the markdown above the separator already prints every re-ask and every
+ * evidence summary, and they are the largest per-row cost this section could take.
  */
 function renderRobustness(reportData, channel) {
     const results = asArray(reportData.hypothesisResults);
@@ -750,16 +1024,21 @@ function renderRobustness(reportData, channel) {
         const flipped = tribool(robustness?.flipped);
         const downgraded = safeInline(robustness?.downgradedStatus, 40);
         const count = survived !== null && total !== null ? `held ${survived}/${total} framings` : 'survival count unavailable';
+        // Appended to EVERY branch, not just the flipped one. A held verdict is the row a
+        // reader is most likely to act on unexamined, so it is the last one that should be
+        // identified by an id alone.
+        const detail = hypothesisDetail(result);
         if (flipped === true) {
             return (`- ${id}: reported \`${status}\` — ⚠️ FLIPPED under rephrasing (${count}). ` +
-                `The verdict to act on is \`${downgraded ?? 'weaker than reported — downgrade unavailable'}\`, NOT \`${status}\`.`);
+                `The verdict to act on is \`${downgraded ?? 'weaker than reported — downgrade unavailable'}\`, NOT \`${status}\`.` +
+                detail);
         }
         // An unreadable `flipped` is NOT "held" — say so rather than printing the
         // verdict as if it had survived re-asking.
         if (flipped === null) {
-            return `- ${id}: reported \`${status}\` — ⚠️ flip status UNREADABLE (${count}); treat this verdict as un-retested.`;
+            return `- ${id}: reported \`${status}\` — ⚠️ flip status UNREADABLE (${count}); treat this verdict as un-retested.${detail}`;
         }
-        return `- ${id}: \`${status}\` — ${count}`;
+        return `- ${id}: \`${status}\` — ${count}${detail}`;
     });
     const flippedCount = withRobustness.filter((raw) => bool(asRecord(asRecord(raw)?.robustness)?.flipped)).length;
     const unreadableFlips = withRobustness.filter((raw) => tribool(asRecord(asRecord(raw)?.robustness)?.flipped) === null).length;
@@ -778,6 +1057,87 @@ function renderRobustness(reportData, channel) {
     return (`${header}\n${lines.join('\n')}` +
         capNote(shown.length, withRobustness.length, channel, 'report_data.hypothesisResults'));
 }
+// ---------------------------------------------------------------------------
+// Model-authored framing — prose side of the proof separator (FUL-570)
+// ---------------------------------------------------------------------------
+/** Defensive ceiling for one model-authored framing value read from raw report_data. */
+const MODEL_FRAMING_TEXT_MAX = 400;
+/** Runaway backstop for assumptions / risks; normal briefs carry only a handful. */
+const MODEL_FRAMING_LIST_CAP = 10;
+export const MODEL_FRAMING_HEADING = '## Model-authored report framing — not evidence or findings';
+function framingList(raw) {
+    return asArray(raw)
+        .map((value) => safeInline(value, MODEL_FRAMING_TEXT_MAX))
+        .filter((value) => Boolean(value));
+}
+function renderPersonasSynthesis(reportData) {
+    const synthesis = asRecord(reportData.personasSynthesis);
+    if (!synthesis)
+        return '';
+    const headline = safeInline(synthesis.headline, MODEL_FRAMING_TEXT_MAX);
+    const body = safeInline(synthesis.body, MODEL_FRAMING_TEXT_MAX);
+    // The producer treats the pair atomically: a headline without its justification is not a
+    // degraded synthesis, it is an assertion with the reasoning removed. Preserve that rule on
+    // the raw-passthrough path too.
+    if (!headline || !body)
+        return '';
+    return ('### Persona-roster synthesis — model-authored, not evidence\n\n' +
+        `**${headline}**\n\n${body}`);
+}
+function renderResearchBrief(reportData) {
+    const brief = asRecord(reportData.researchBrief);
+    if (!brief)
+        return '';
+    const lines = [];
+    const targetMarket = safeInline(brief.targetMarket, MODEL_FRAMING_TEXT_MAX);
+    const valueProposition = safeInline(brief.valueProposition, MODEL_FRAMING_TEXT_MAX);
+    const competitiveLandscape = safeInline(brief.competitiveLandscape, MODEL_FRAMING_TEXT_MAX);
+    if (targetMarket)
+        lines.push(`- Target market: ${targetMarket}`);
+    if (valueProposition)
+        lines.push(`- Value proposition: ${valueProposition}`);
+    const assumptions = framingList(brief.assumptions);
+    if (assumptions.length > 0) {
+        lines.push('- Assumptions to test:');
+        lines.push(...assumptions
+            .slice(0, MODEL_FRAMING_LIST_CAP)
+            .map((assumption) => `  - ${assumption}`));
+        if (assumptions.length > MODEL_FRAMING_LIST_CAP) {
+            lines.push(`  - … ${assumptions.length - MODEL_FRAMING_LIST_CAP} more in report_data`);
+        }
+    }
+    if (competitiveLandscape) {
+        lines.push(`- Competitive landscape: ${competitiveLandscape}`);
+    }
+    const risks = framingList(brief.keyRisks);
+    if (risks.length > 0) {
+        lines.push('- Key risks:');
+        lines.push(...risks.slice(0, MODEL_FRAMING_LIST_CAP).map((risk) => `  - ${risk}`));
+        if (risks.length > MODEL_FRAMING_LIST_CAP) {
+            lines.push(`  - … ${risks.length - MODEL_FRAMING_LIST_CAP} more in report_data`);
+        }
+    }
+    if (lines.length === 0)
+        return '';
+    return '### Research brief — model-generated framing, not findings\n\n' + lines.join('\n');
+}
+/**
+ * The approved model-authored context block.
+ *
+ * `productName` and `problemStatement` remain typed but are deliberately not repeated: the
+ * former is already the report title and the latter restates the caller's idea. Only the five
+ * actionable framing fields approved in FUL-570 render here. This block is composed ABOVE the
+ * proof separator and labels itself twice; no line can be mistaken for a graded finding.
+ */
+function renderModelFraming(reportData) {
+    const data = asRecord(reportData);
+    if (!data)
+        return '';
+    const sections = [renderPersonasSynthesis(data), renderResearchBrief(data)].filter(Boolean);
+    if (sections.length === 0)
+        return '';
+    return `${MODEL_FRAMING_HEADING}\n\n${sections.join('\n\n')}`;
+}
 /**
  * The rendered budget for the run-level verdict rationale.
  *
@@ -861,6 +1221,64 @@ const NO_TRUST_DATA = `${DIGEST_HEADING}\n\n` +
     'verified against a source: there is no claim registry, no receipts, no QA flags, and no ' +
     'anti-sycophancy readout to check it against. Treat every figure, quote, and verdict above as ' +
     'UNVERIFIED — do not cite anything from it as source-checked.';
+export const COMPETITOR_SOURCE_QUALITY_HEADING = '### Competitor source quality — code-derived flags';
+const MARKDOWN_LINK_NAME = /^\[([^\]\n]+)\]\([^)\n]+\)$/;
+const PARTIAL_MARKDOWN_LINK_NAME = /\[[^\]\n]*\]\(/;
+const URL_LIKE_NAME = /(?:\bhttps?:\/\/|\bwww\.)/i;
+/**
+ * Render an identifier, never a link. A competitor name is model-authored and can
+ * itself contain Markdown link syntax or a raw URL even when the separate `url`
+ * field is withheld. An exact Markdown link keeps only its label; other URL-like
+ * names fail closed to a placeholder. Remaining Markdown punctuation, including
+ * reference-link brackets and dots that Markdown may autolink, is removed.
+ */
+function competitorIdentifier(raw) {
+    const flattened = safeInline(raw, CLAIM_TEXT_MAX);
+    if (!flattened)
+        return '(unnamed competitor)';
+    const markdownLink = MARKDOWN_LINK_NAME.exec(flattened);
+    const candidate = markdownLink?.[1] ?? flattened;
+    if ((!markdownLink && PARTIAL_MARKDOWN_LINK_NAME.test(flattened)) ||
+        URL_LIKE_NAME.test(candidate)) {
+        return '(competitor name withheld: URL-like)';
+    }
+    const plain = collapseWhitespace(candidate.replace(/[^\p{L}\p{N}&'’+\- ]/gu, ' '));
+    return plain || '(unnamed competitor)';
+}
+/**
+ * FUL-587's compact disclosure. The aggregate and the decision to mark a row are code-derived
+ * from the exact canonical `marketing_seo` token. Only the flagged rows are named; positioning,
+ * notes, url and threat level remain model-authored prose and never cross the proof separator.
+ *
+ * The competitor name is the approved row identifier, not a prose block. It is flattened and
+ * capped before rendering, so a stored name cannot mint a digest row or heading of its own.
+ */
+function renderCompetitorSourceQuality(reportData) {
+    const competitors = asArray(reportData.competitors);
+    if (competitors.length === 0)
+        return '';
+    const readable = competitors
+        .map(asRecord)
+        .filter((competitor) => competitor !== null);
+    const unreadableCount = competitors.length - readable.length;
+    const flagged = readable.filter((competitor) => canonicalContentType(competitor.contentType) === 'marketing_seo');
+    const shown = flagged.slice(0, LIST_RENDER_CAP);
+    const lines = shown.map((competitor) => `- ⚠️ ${competitorIdentifier(competitor.name)} — \`marketing_seo\``);
+    const aggregate = `${flagged.length} of ${readable.length} competitor rows are flagged \`marketing_seo\`. ` +
+        'The mark is a source-quality classification used by synthesis filters, not a claim-level ' +
+        'grounding verdict. Check reportClaims[] states and receipts: a competitor’s own page may ' +
+        'ground a claim about itself only after span verification. Unmarked rows are not certified ' +
+        'as grounding evidence by this summary.' +
+        (unreadableCount > 0
+            ? ` ${unreadableCount} additional competitor array ${unreadableCount === 1 ? 'entry was' : 'entries were'} unreadable and could not be classified; do not treat that gap as clean.`
+            : '');
+    const cap = flagged.length > shown.length
+        ? `\n\n_Only ${shown.length} of ${flagged.length} flagged rows are named here; read report_data.competitors[] for the full structured list._`
+        : '';
+    return (`${COMPETITOR_SOURCE_QUALITY_HEADING}\n\n${aggregate}` +
+        (lines.length > 0 ? `\n\n${lines.join('\n')}` : '') +
+        cap);
+}
 /**
  * Build the trust digest appended to `get_report`'s text.
  *
@@ -876,6 +1294,7 @@ export function buildTrustDigest(reportData, channel) {
     const sections = [
         renderPersonaSpine(data, channel),
         renderReportSpine(data, channel),
+        renderCompetitorSourceQuality(data),
         renderReceiptPools(data, channel),
         renderPersonas(data, channel),
         renderSycophancy(data, channel),
@@ -952,17 +1371,19 @@ function renderReportGaps(reportData) {
  * a field can reach a caller through one tool and not the others while every test stays
  * green. FUL-510's `verdictSummary` is the field that made the seam worth naming.
  *
- * The order is the contract. Report prose first (the run's markdown, then its own stored
- * verdict rationale), then `---`, then the machine-checked digest LAST — because the
- * digest's authority rule is that the last such section in the message is the real one,
- * and anything above the separator is prose that may resemble it.
+ * The order is the contract. Report prose first (the run's markdown, then the explicitly
+ * labelled model-authored framing and its own stored verdict rationale), then `---`, then
+ * the machine-checked digest LAST — because the digest's authority rule is that the last
+ * such section in the message is the real one, and anything above the separator is prose
+ * that may resemble it.
  */
 export function composeReportText(reportMarkdown, reportData, channel) {
     const rationale = renderVerdictRationale(reportData);
+    const framing = renderModelFraming(reportData);
     // FUL-586: the completeness banner goes FIRST — before the prose it is a caveat about.
     const gaps = renderReportGaps(reportData);
     return (`${gaps ? `${gaps}\n\n---\n\n` : ''}` +
-        `${reportMarkdown}${rationale ? `\n\n${rationale}` : ''}` +
+        `${reportMarkdown}${framing ? `\n\n${framing}` : ''}${rationale ? `\n\n${rationale}` : ''}` +
         `\n\n---\n\n${buildTrustDigest(reportData, channel)}`);
 }
 //# sourceMappingURL=report-digest.js.map