@ijfw/memory-server 1.5.5 → 1.6.0

package/src/handlers/brain-handler.js

@@ -25,6 +25,9 @@ import { compileWikiPage, slugify } from '../brain/wiki-compiler.js';
 import { resolveCitations } from '../brain/citation-resolver.js';
 import { exportPageBundle, writeShareReadme } from '../brain/export.js';
 import { validateSafeRepoPath } from '../brain/path-guard.js';
+import { profileGet, profileBrief } from '../profile/serve.js';
+import { forgetAndWrite, listInferences } from '../profile/audit.js';
+import { readProfile } from '../profile/store.js';
 
 const WIKI_TYPES = ['concepts', 'entities', 'decisions', 'milestones'];
 
@@ -336,7 +339,99 @@ function verbConflictResolve(db, repoRoot, args) {
   return { ok: true, resolved: true, winnerId: args.winnerId, supersededIds, validTo: chosenValidTo };
 }
 
-export async function handleIjfwBrain({ verb, args = {}, db, repoRoot, env: _env, opts = {} } = {}) {
+// ---------------------------------------------------------------------------
+// PHASE P4 — cross-system profile bus serving verbs (folded into ijfw_brain so
+// the MCP tool cap stays at 13/13 — NO new top-level tool). Both verbs are
+// ZERO-LLM by construction: they route into src/profile/serve.js, which imports
+// only the store/render/egress/sensitivity modules (the P4.5 import-graph guard
+// proves the serve path never reaches the LLM tier). `env` threads the host's
+// env so per-host opt-in (IJFW_PROFILE_SHARE_SENSITIVE), redaction
+// (IJFW_PROFILE_REDACT) and the kill-switch (IJFW_PROFILE_KILL) are honored.
+//
+// args (both verbs, all optional):
+//   tokenBudget     number — cap brief output (brief only)
+//   context         { overlay?, host?, session? } — overlay key + egress meta
+//   shareSensitive  boolean — programmatic per-host opt-in (else env flag)
+// ---------------------------------------------------------------------------
+
+function profileServeOpts(args, env) {
+  return {
+    tokenBudget: args && Number.isFinite(args.tokenBudget) ? args.tokenBudget : undefined,
+    context: (args && args.context && typeof args.context === 'object') ? args.context : {},
+    shareSensitive: (args && typeof args.shareSensitive === 'boolean') ? args.shareSensitive : undefined,
+    env: env || process.env,
+  };
+}
+
+function verbProfileGet(args, env) {
+  return profileGet(profileServeOpts(args, env));
+}
+
+function verbProfileBrief(args, env) {
+  return profileBrief(profileServeOpts(args, env));
+}
+
+// ---------------------------------------------------------------------------
+// PHASE P4 — right-to-be-forgotten + audit INVOCATION SURFACE (audit M2). The
+// audit module's forgetAndWrite / listInferences were previously reachable only
+// from tests; these verbs give the user a real way to SEE what was inferred and
+// to DELETE it (the egress purge rides along inside forgetAndWrite). Folded into
+// ijfw_brain — NO new top-level tool, cap stays 13/13.
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a forget pattern from wire args. Across JSON we accept ONLY a string
+ * (exact-id or `kind::`/`::subject` segment match — see audit.matcherFor) or an
+ * explicit { regex, flags? } object that we compile under audit's ReDoS guard.
+ * A bad regex source compiles into a RegExp whose forgetAndWrite pre-validation
+ * (validatePattern) rejects it BEFORE the global lock — so a hostile pattern can
+ * neither hang the event loop nor over-delete.
+ */
+function buildForgetPattern(args) {
+  if (args && typeof args.id === 'string' && args.id) return { ok: true, pattern: args.id };
+  if (args && typeof args.pattern === 'string' && args.pattern) return { ok: true, pattern: args.pattern };
+  if (args && args.regex && typeof args.regex === 'string') {
+    const flags = typeof args.flags === 'string' ? args.flags.replace(/[^gimsuy]/g, '') : '';
+    try {
+      return { ok: true, pattern: new RegExp(args.regex, flags) };
+    } catch (e) {
+      return { ok: false, error: 'invalid-regex', message: e.message };
+    }
+  }
+  return { ok: false, error: 'missing-pattern' };
+}
+
+async function verbProfileForget(args) {
+  const built = buildForgetPattern(args);
+  if (!built.ok) return { ok: false, error: built.error, message: built.message };
+  // forgetAndWrite validates the pattern (ReDoS guard) BEFORE taking the global
+  // profile lock, runs read→forget→write under the lock, and purges egress.
+  const r = await forgetAndWrite(built.pattern);
+  if (!r.ok) return { ok: false, error: r.code || 'forget-failed', message: r.message };
+  return {
+    ok: true,
+    removed: (r.removed || []).map((inf) => ({ id: inf.id, kind: inf.kind, subject: inf.subject })),
+    removedCount: (r.removed || []).length,
+    egressRemoved: r.egressRemoved || 0,
+  };
+}
+
+function verbProfileAudit() {
+  // Read the current global profile and surface every inference with full
+  // provenance (scope, evidence, source sessions/hosts, sensitivity). Cold
+  // start (no profile on disk) -> empty list, never an error.
+  let profile = null;
+  try {
+    const r = readProfile();
+    profile = r && r.ok ? r.profile : null;
+  } catch {
+    profile = null;
+  }
+  if (!profile) return { ok: true, inferences: [] };
+  return { ok: true, inferences: listInferences(profile) };
+}
+
+export async function handleIjfwBrain({ verb, args = {}, db, repoRoot, env = process.env, opts = {} } = {}) {
   if (!verb || typeof verb !== 'string') return { ok: false, error: 'missing-verb' };
   switch (verb) {
     case 'think':              return verbThink(db, repoRoot, args, opts);
@@ -347,6 +442,10 @@ export async function handleIjfwBrain({ verb, args = {}, db, repoRoot, env: _env
     case 'wiki.export':        return verbWikiExport(db, repoRoot, args);
     case 'wiki.shareReadme':   return verbWikiShareReadme(db, repoRoot);
     case 'conflict.resolve':   return verbConflictResolve(db, repoRoot, args);
+    case 'profile.get':        return verbProfileGet(args, env);
+    case 'profile.brief':      return verbProfileBrief(args, env);
+    case 'profile.forget':     return verbProfileForget(args);
+    case 'profile.audit':      return verbProfileAudit();
     default:                   return { ok: false, error: 'unknown-verb', verb };
   }
 }
@@ -355,4 +454,5 @@ export const IJFW_BRAIN_VERBS = [
   'think', 'links',
   'wiki.get', 'wiki.compile', 'wiki.promote', 'wiki.export', 'wiki.shareReadme',
   'conflict.resolve',
+  'profile.get', 'profile.brief', 'profile.forget', 'profile.audit',
 ];

package/src/importers/discover.js

@@ -23,7 +23,7 @@ import { homedir } from 'node:os';
 const DEV_PARENTS = ['dev', 'Code', 'code', 'projects', 'repos', 'work', 'src'];
 
 // Decode Claude Code's path-encoded project directory name back to an absolute
-// path. Example: "-Users-seandonahoe-dev-pip" -> "/Users/seandonahoe/dev/pip".
+// path. Example: "-Users-alice-dev-pip" -> "/Users/alice/dev/pip".
 // Encoding replaces `/` with `-`. Leading `-` becomes leading `/`.
 // Caveat: directories with literal `-` in their name become ambiguous on
 // decode; we verify by checking whether the decoded path exists.

package/src/memory/bench-metrics.js

@@ -0,0 +1,289 @@
+// IJFW v1.6.0 -- benchmark metrics. Pure functions, no I/O, no LLM.
+import { mulberry32 } from './benchmark.js';
+//
+// Retrieval metrics (free -- no model calls):
+//   recallAtK, precisionAtK, mrr, episodesPerQuery, latencyPercentile
+// Answer metrics:
+//   normalizeAnswer + answerExactMatch (free string match). LLM-judged
+//   answer correctness is a separate paid path wired in P5, not here.
+//
+// All retrieval metrics operate on:
+//   retrievedIds : string[]  -- ranked result ids (best first)
+//   relevantIds  : string[]  -- gold evidence ids (the relevant set)
+// expressed in the SAME id space (the loader's job to align granularity).
+
+/** Recall@k = |relevant ∩ retrieved[0:k]| / |relevant|. */
+export function recallAtK(retrievedIds, relevantIds, k) {
+  if (!relevantIds || relevantIds.length === 0) return null; // undefined for no-evidence queries
+  const top = new Set(retrievedIds.slice(0, k));
+  let hit = 0;
+  for (const r of relevantIds) if (top.has(r)) hit++;
+  return hit / relevantIds.length;
+}
+
+/** Precision@k = |relevant ∩ retrieved[0:k]| / k. */
+export function precisionAtK(retrievedIds, relevantIds, k) {
+  if (k <= 0) return null;
+  const rel = new Set(relevantIds || []);
+  const top = retrievedIds.slice(0, k);
+  if (top.length === 0) return 0;
+  let hit = 0;
+  for (const id of top) if (rel.has(id)) hit++;
+  return hit / Math.min(k, top.length);
+}
+
+/** Mean Reciprocal Rank: 1/(rank of first relevant), else 0. */
+export function reciprocalRank(retrievedIds, relevantIds) {
+  const rel = new Set(relevantIds || []);
+  for (let i = 0; i < retrievedIds.length; i++) {
+    if (rel.has(retrievedIds[i])) return 1 / (i + 1);
+  }
+  return 0;
+}
+
+/** Mean over a list of per-query numbers, skipping null (undefined) entries. */
+export function mean(values) {
+  const xs = values.filter((v) => v !== null && v !== undefined && !Number.isNaN(v));
+  if (xs.length === 0) return null;
+  return xs.reduce((a, b) => a + b, 0) / xs.length;
+}
+
+/** Percentile (linear interpolation). p in [0,100]. */
+export function percentile(values, p) {
+  const xs = values.filter((v) => typeof v === 'number' && !Number.isNaN(v)).slice().sort((a, b) => a - b);
+  if (xs.length === 0) return null;
+  if (xs.length === 1) return xs[0];
+  const rank = (p / 100) * (xs.length - 1);
+  const lo = Math.floor(rank);
+  const hi = Math.ceil(rank);
+  if (lo === hi) return xs[lo];
+  return xs[lo] + (xs[hi] - xs[lo]) * (rank - lo);
+}
+
+/** Normalize an answer string for exact-match comparison (SQuAD-style). */
+export function normalizeAnswer(s) {
+  return String(s ?? '')
+    .toLowerCase()
+    .replace(/\b(a|an|the)\b/g, ' ')
+    .replace(/[^a-z0-9 ]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+/**
+ * G1b L4-HIGH-1: is this ground-truth entry an ABSTENTION (no-answer / trap) gold?
+ *
+ * Both confirmatory loaders (longmemeval.js `_abs`, convomem.js abstention_evidence)
+ * stamp `ground_truth[qid].is_abstention = true` and KEEP the dataset's own
+ * natural-language no-answer gold. This canonical flag — NOT the gold's surface
+ * form — is what routes scoring to the single abstention rubric, so a correct
+ * abstention scores the same on BOTH datasets and a confident hallucination is
+ * wrong on BOTH. Pure; exported for unit tests.
+ *
+ * @param {object|null|undefined} gt  a ground_truth entry
+ * @returns {boolean}
+ */
+export function isAbstentionGold(gt) {
+  return !!(gt && gt.is_abstention === true);
+}
+
+// Lexical cues that a prediction CORRECTLY abstained / declined (no confident
+// claim). Deliberately rubric-only (no LLM) so the abstention verdict is the
+// SAME function regardless of dataset, judge mode, or gold surface form.
+const ABSTENTION_CUES = [
+  /\bi (?:do not|don't|dont) (?:know|have)\b/,
+  /\b(?:no|not any|don't have|do not have|lack) (?:information|info|record|data|details?)\b/,
+  /\bno (?:information|mention|record|reference)\b/,
+  /\bnot (?:mentioned|stated|specified|provided|available|found|present|discussed)\b/,
+  /\b(?:cannot|can't|cant|could not|couldn't|unable to) (?:find|determine|tell|answer|say|locate)\b/,
+  /\bisn't (?:any )?(?:information|mention|record)\b/,
+  /\bthere (?:is|isn't|is no|isn't any|was no) (?:no )?(?:information|mention|record|reference|data)\b/,
+  /\bnot enough (?:information|context|detail)\b/,
+];
+
+// G1b cross-C LOW-1: bare cue TOKENS ("unknown", "unclear", "n/a") are genuine
+// abstentions ONLY when they are essentially the WHOLE answer — a short decline.
+// As a SUBSTRING of a longer confident response ("...the status is unknown to
+// the team but the project shipped", "Unknown Pleasures") they are a
+// hallucination on the trap, NOT a decline, and must score 0. These are matched
+// against the whole normalized answer (anchored), separate from the phrase cues
+// above which may legitimately appear inside a sentence. Symmetric across
+// subjects (the metric is subject-agnostic).
+const BARE_TOKEN_ABSTENTIONS = [
+  /^unknown$/,
+  /^unclear$/,
+  /^n\/a$/,
+  /^na$/,
+];
+
+/**
+ * G1b L4-HIGH-1: score one ABSTENTION question under ONE rubric.
+ *
+ * Returns 1 when the prediction correctly abstains / declines (it does not assert
+ * a specific fact), 0 when it makes a confident factual claim (a hallucination on
+ * an unanswerable trap). Independent of the gold's surface form — the gold is a
+ * natural-language no-answer sentence on LongMemEval and ConvoMem alike; the
+ * ABILITY graded is "did the system refuse to invent an answer". Pure.
+ *
+ * @param {string} predicted
+ * @returns {1|0}
+ */
+export function scoreAbstentionMatch(predicted) {
+  const t = String(predicted ?? '').toLowerCase().trim();
+  if (t === '') return 0; // an empty answer is not a stated abstention (caller may skip earlier)
+  // Phrase-level cues may appear inside a sentence (a genuine NL decline).
+  for (const re of ABSTENTION_CUES) {
+    if (re.test(t)) return 1;
+  }
+  // Bare cue tokens count ONLY when they are essentially the whole answer (a
+  // short decline) — strip surrounding punctuation/whitespace first so
+  // "Unknown.", "n/a!", " unclear " still match, but a confident sentence that
+  // merely CONTAINS the token does not.
+  const bare = t.replace(/^[\s"'.,!?-]+|[\s"'.,!?-]+$/g, '');
+  for (const re of BARE_TOKEN_ABSTENTIONS) {
+    if (re.test(bare)) return 1;
+  }
+  return 0;
+}
+
+/** Free answer-correctness signal: normalized exact / containment match. */
+export function answerExactMatch(predicted, gold) {
+  const p = normalizeAnswer(predicted);
+  const g = normalizeAnswer(gold);
+  if (!g) return null;
+  if (p === g) return 1;
+  // containment either direction handles "yes" vs "yes, both American" cases
+  if (p && (p.includes(g) || g.includes(p))) return 1;
+  return 0;
+}
+
+/**
+ * Aggregate per-query retrieval records into the metrics block for one
+ * (adapter, dataset) cell.
+ * @param {Array<{retrievedIds, relevantIds, latency_ms, tokens_in, tokens_out, cost_usd, n_retrieved, answerMatch}>} per
+ */
+export function aggregate(per) {
+  const r1 = per.map((q) => recallAtK(q.retrievedIds, q.relevantIds, 1));
+  const r5 = per.map((q) => recallAtK(q.retrievedIds, q.relevantIds, 5));
+  const r10 = per.map((q) => recallAtK(q.retrievedIds, q.relevantIds, 10));
+  const p5 = per.map((q) => precisionAtK(q.retrievedIds, q.relevantIds, 5));
+  const rr = per.map((q) => reciprocalRank(q.retrievedIds, q.relevantIds));
+  const lat = per.map((q) => q.latency_ms).filter((x) => typeof x === 'number');
+  const ans = per.map((q) => q.answerMatch).filter((x) => x !== null && x !== undefined);
+
+  return {
+    n_queries: per.length,
+    recall_at_1: round(mean(r1)),
+    recall_at_5: round(mean(r5)),
+    recall_at_10: round(mean(r10)),
+    precision_at_5: round(mean(p5)),
+    mrr: round(mean(rr)),
+    episodes_per_query_mean: round(mean(per.map((q) => q.n_retrieved))),
+    latency_p50_ms: round(percentile(lat, 50)),
+    latency_p95_ms: round(percentile(lat, 95)),
+    tokens_per_query_mean: round(mean(per.map((q) => (q.tokens_in || 0) + (q.tokens_out || 0)))),
+    cost_per_query_usd: round6(mean(per.map((q) => q.cost_usd || 0))),
+    answer_match_mean: ans.length ? round(mean(ans)) : null,
+    hops_mean: round(mean(per.map((q) => q.hops))),
+  };
+}
+
+/**
+ * Aggregate per-query records bucketed by a dimension key (e.g. question type).
+ * Returns { [dimensionValue]: aggregateBlock }. This is the diagnostic view —
+ * global aggregates hide WHERE a system fails; per-dimension exposes it.
+ * @param {Array} per   per-query records, each carrying a `dim` field
+ */
+export function aggregateByDimension(per) {
+  const buckets = new Map();
+  for (const q of per) {
+    const key = q.dim ?? 'unknown';
+    if (!buckets.has(key)) buckets.set(key, []);
+    buckets.get(key).push(q);
+  }
+  const out = {};
+  for (const [key, rows] of buckets) out[key] = aggregate(rows);
+  return out;
+}
+
+function round(x) { return x === null || x === undefined ? null : Math.round(x * 10000) / 10000; }
+function round6(x) { return x === null || x === undefined ? null : Math.round(x * 1e6) / 1e6; }
+
+/**
+ * Bootstrap confidence interval for the mean of per-query numeric scores.
+ *
+ * @param {number[]} perQuery - per-query numeric scores (e.g. 0/1 per query)
+ * @param {{ iters?: number, alpha?: number, seed?: number }} opts
+ * @returns {{ point: number, lo: number, hi: number }}
+ *   point = mean(perQuery), lo/hi are the alpha/2 and 1-alpha/2 percentiles
+ *   of the bootstrap distribution. Deterministic for a given seed.
+ */
+export function bootstrapCI(perQuery, { iters = 1000, alpha = 0.05, seed = 42 } = {}) {
+  const n = perQuery.length;
+  const point = n > 0 ? perQuery.reduce((a, b) => a + b, 0) / n : 0;
+  if (n === 0) return { point, lo: 0, hi: 0 };
+
+  const rng = mulberry32(seed);
+  const boots = Array.from({ length: iters });
+  for (let i = 0; i < iters; i++) {
+    let s = 0;
+    for (let j = 0; j < n; j++) {
+      s += perQuery[Math.floor(rng() * n)];
+    }
+    boots[i] = s / n;
+  }
+  boots.sort((a, b) => a - b);
+
+  const loIdx = Math.floor((alpha / 2) * iters);
+  const hiIdx = Math.floor((1 - alpha / 2) * iters);
+  return {
+    point,
+    lo: boots[loIdx],
+    hi: boots[Math.min(hiIdx, iters - 1)],
+  };
+}
+
+/**
+ * Paired McNemar test for two binary result arrays (same length, 0/1 per query).
+ *
+ * Uses continuity-corrected McNemar χ² statistic.
+ * pValue is derived from the χ²(1) survival function via an erfc approximation.
+ *
+ * @param {number[]} before - binary array (0/1 per query)
+ * @param {number[]} after  - binary array (0/1 per query)
+ * @returns {{ b: number, c: number, statistic: number, pValue: number, significant: boolean }}
+ *   b = count(before=0, after=1)  (after wins)
+ *   c = count(before=1, after=0)  (before wins)
+ */
+export function mcnemar(before, after) {
+  let b = 0; // before=0, after=1
+  let c = 0; // before=1, after=0
+  for (let i = 0; i < before.length; i++) {
+    if (before[i] === 0 && after[i] === 1) b++;
+    else if (before[i] === 1 && after[i] === 0) c++;
+  }
+
+  const bc = b + c;
+  if (bc === 0) return { b, c, statistic: 0, pValue: 1, significant: false };
+
+  // Continuity-corrected McNemar χ² = (|b-c| - 1)² / (b+c)
+  const diff = Math.abs(b - c) - 1;
+  const statistic = (diff * diff) / bc;
+
+  // χ²(1) survival function: P(χ² > x) = erfc(sqrt(x/2))
+  // Using erfc approximation (Abramowitz & Stegun 7.1.26)
+  const pValue = erfcApprox(Math.sqrt(statistic / 2));
+
+  return { b, c, statistic, pValue, significant: pValue < 0.05 };
+}
+
+/**
+ * Complementary error function approximation for χ²(1) p-value computation.
+ * Abramowitz & Stegun 7.1.26 rational approximation (max |err| < 1.5e-7).
+ */
+function erfcApprox(x) {
+  if (x < 0) return 2 - erfcApprox(-x);
+  const t = 1 / (1 + 0.3275911 * x);
+  const poly = t * (0.254829592 + t * (-0.284496736 + t * (1.421413741 + t * (-1.453152027 + t * 1.061405429))));
+  return poly * Math.exp(-x * x);
+}

package/src/memory/benchmark.js

@@ -115,7 +115,7 @@ function mean(values) {
 
 // Deterministic PRNG (mulberry32) so the synthetic corpus is reproducible
 // across runs + machines. Same seed => same docs/queries/gold-mapping.
-function mulberry32(seed) {
+export function mulberry32(seed) {
   let a = seed >>> 0;
   return function() {
     a = (a + 0x6d2b79f5) >>> 0;

package/src/memory/search.js

@@ -45,6 +45,53 @@ const DB_FILENAME = 'memory.db';
 const INDEX_DIR_NAME = 'index';
 const IJFW_DIR_NAME = '.ijfw';
 
+// --- W1.3 (v1.6.0): natural-language OR-query construction ------------------
+//
+// FTS5 treats a space-separated MATCH as implicit AND -- every token must
+// co-occur in one indexed entry. A real natural-language recall ("what
+// database did we pick for the auth service") almost never has all its tokens
+// in a single entry, so the implicit-AND query starves and retrieves nothing.
+// expandQuery() only OR-groups *synonyms* ("(db OR database) AND user"); the
+// inter-token relation stays AND. The fix (proven by the v1.6.0 bench harness)
+// is to OR the salient terms: drop stopwords + sub-3-char tokens, dedup, fold
+// each surviving token's synonym group in, and OR-join. Single-token and
+// exact-phrase queries are unaffected (one quoted term / one OR-group).
+const FTS_STOPWORDS = new Set([
+  'the', 'and', 'for', 'are', 'was', 'were', 'with', 'that', 'this', 'from',
+  'who', 'what', 'when', 'where', 'which', 'whom', 'whose', 'why', 'how',
+  'did', 'does', 'has', 'had', 'have', 'been', 'being', 'into', 'than',
+  'same', 'both', 'also', 'about', 'between', 'their', 'they', 'them',
+  'his', 'her', 'its', 'our', 'your', 'you', 'she', 'him',
+]);
+
+// Strip FTS5 special / column-separator chars to spaces, collapse whitespace.
+// Keeps alphanumerics + underscore + spaces. (Mirrors the bench harness's
+// sanitiser; inlined so the hot search path stays uncoupled from bench code.)
+function sanitizeFtsQuery(q) {
+  if (typeof q !== 'string') return '';
+  return q.replace(/[^a-zA-Z0-9_\s]/g, ' ').replace(/\s+/g, ' ').trim();
+}
+
+// Build an OR-of-salient-terms FTS5 query from a natural-language string.
+// Each surviving token is folded through expandQuery so synonym groups still
+// fire (e.g. "auth" -> "(auth OR authentication)"); non-expanding tokens are
+// quoted as literals (safe against any residual FTS5 keyword). Returns '' when
+// nothing salient survives, so the caller can fall back to the raw query.
+function buildOrQuery(q) {
+  const sanitized = sanitizeFtsQuery(q);
+  if (!sanitized) return '';
+  const seen = new Set();
+  const groups = [];
+  for (const tok of sanitized.split(/\s+/)) {
+    const t = tok.toLowerCase();
+    if (t.length < 3 || FTS_STOPWORDS.has(t) || seen.has(t)) continue;
+    seen.add(t);
+    const { expanded, applied } = expandQuery(tok);
+    groups.push(applied ? expanded : `"${tok}"`);
+  }
+  return groups.join(' OR ');
+}
+
 // --- Driver bootstrap (top-level await; resolves once at module load) -----
 
 let DRIVER = null;
@@ -524,7 +571,12 @@ export function searchMemory(q, files, limit = MAX_RESULTS, options) {
         if (rowCount(db) === 0 && files.length > 0) {
           autoIndex(db, files);
         }
-        const ftsQuery = applied ? expanded : q;
+        // W1.3: OR the salient terms so NL queries don't starve under FTS5's
+        // implicit AND. Falls back to the synonym-expanded (or raw) query when
+        // no salient term survives. Final catch retries the raw query so a
+        // malformed rewrite can never regress to fewer results than today.
+        const orQuery = buildOrQuery(q);
+        const ftsQuery = orQuery || (applied ? expanded : q);
         let rows;
         try {
           rows = searchFts5(db, ftsQuery, limit, tier_semantic, include_stale);

package/src/orchestrator/plan-checker.js

@@ -7,7 +7,7 @@
  * surfaced in the `ijfw-plan-check` skill as the deterministic pre-dispatch
  * gate.
  *
- * Distilled from /Users/seandonahoe/.claude/agents/gsd-plan-checker.md — extracts
+ * Distilled from the gsd-plan-checker agent definition: extracts
  * the mechanically-checkable rules (the prose-reasoning ones stay in the skill).
  *
  * No I/O, no network — operates on plan text passed in by caller.