@konneal/engine 0.2.134 → 0.2.135

package/dist/{ask-PFU74MIP.js → ask-JX55WMFR.js}

@@ -1,11 +1,11 @@
 import {
   handleAsk
-} from "./chunk-JYJJ4SYF.js";
+} from "./chunk-27NZR4HF.js";
 import "./chunk-J6LBR6GI.js";
 import "./chunk-7AXXR7GD.js";
 import "./chunk-TH5XGPD5.js";
 import "./chunk-W7J5SFXJ.js";
-import "./chunk-WPOKSNPE.js";
+import "./chunk-XBZIJMS7.js";
 import "./chunk-4NXH5ZI6.js";
 import "./chunk-VT7DR6NQ.js";
 import "./chunk-GBGRHXRU.js";

package/dist/{chunk-JYJJ4SYF.js → chunk-27NZR4HF.js}

@@ -80,10 +80,11 @@ import {
   validateQuery
 } from "./chunk-W7J5SFXJ.js";
 import {
+  cacheableAnswer,
   canonicalRefusal,
   exciseMisplacedPin,
   refusalAnswer
-} from "./chunk-WPOKSNPE.js";
+} from "./chunk-XBZIJMS7.js";
 import {
   entitlementScope,
   requestSalt,
@@ -2659,7 +2660,7 @@ ${q.query}`.replace("\n\n\n\n", "\n\n") }];
           if (streamed.violations.length > 0) {
             console.log("anchors:", streamed.violations.length, "of", streamed.total, "unverified \u2014 not caching");
           }
-          if (streamed.violations.length === 0 && canonical.length > 0 && !contextual && !declaredCtx && !canonical.includes(refusalAnswer()) && !ablate) {
+          if (streamed.violations.length === 0 && canonical.length > 0 && !contextual && !declaredCtx && cacheableAnswer(canonical, refusalScope(usedHits.length > 0)) && !ablate) {
             ctx.waitUntil(
               env.CACHE.put(exactCacheKey(env.INDEX_VERSION, gen, ns, await sha256Hex(cacheKeyMaterial(q.query, q.lang, salt))), JSON.stringify({ answer: canonical, citations: cites, model, query_hash: queryHash, ...sourceQuality ? { source_quality: sourceQuality, confidence_note: streamedNote || qualityNote(sourceQuality) } : {}, ...streamedEntailment ? { entailment: streamedEntailment } : {} }), { expirationTtl: LIMITS.cacheTtlSec })
             );
@@ -2807,7 +2808,7 @@ ${q.query}`.replace("\n\n\n\n", "\n\n") }];
     }
   }
   const out = { answer, citations: finalCites, ...jsonQuality ? { source_quality: jsonQuality, confidence_note: entailmentNote || qualityNote(jsonQuality), ...entailment ? { entailment } : {}, ...jsonQuality === "ocr" ? { experimental_sources: experimentalSourceLabels(finalCites) } : {} } : {}, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : [], ...aggregationBlock ? [aggregationBlock] : [], ...registerBlock ? [registerBlock] : [], ...completionBlocks], context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {}, ...ablate ? { ablate } : {}, route: { route: routed.route, features: routed.features } };
-  const cacheable = !contextual && !declaredCtx && !ablate && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
+  const cacheable = !contextual && !declaredCtx && !ablate && cacheableAnswer(answer, refusalScope(usedHits.length > 0)) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const ck = exactCacheKey(env.INDEX_VERSION, gen, ns, await sha256Hex(cacheKeyMaterial(q.query, q.lang, salt)));
     ctx.waitUntil(env.CACHE.put(ck, JSON.stringify(out), { expirationTtl: LIMITS.cacheTtlSec }));

package/dist/{chunk-WPOKSNPE.js → chunk-XBZIJMS7.js}

@@ -97,9 +97,14 @@ function exciseMisplacedPin(answer, cites) {
   }
   return out.replace(/^[ \t\n]+/, "").replace(/\n{3,}/g, "\n\n").trim();
 }
+function cacheableAnswer(answer, scope) {
+  if (answer.includes(refusalAnswer())) return false;
+  return canonicalRefusal(answer, scope) === answer;
+}
 
 export {
   refusalAnswer,
   canonicalRefusal,
-  exciseMisplacedPin
+  exciseMisplacedPin,
+  cacheableAnswer
 };

package/dist/refusal.d.ts

@@ -32,3 +32,11 @@ export declare function canonicalRefusal(answer: string, scope?: RefusalScope):
  *  the pin sentence (and its refusal-shaped paraphrases) are excised —
  *  the surrounding content stands on its own. */
 export declare function exciseMisplacedPin(answer: string, cites: boolean): string;
+/** Cacheable under the refusal law (2026-10-11, the poisoned-entry
+ *  lesson): "refusals are never cached" was enforced as "answers
+ *  containing the pin are never cached" — backwards for DRIFT, which
+ *  lacks the pin and cached itself across deploy windows (an edge
+ *  instance running pre-wall code wrote a drifted refusal that served
+ *  every later ask). An answer is cacheable only when it carries no
+ *  pin AND the wall would not rewrite it. */
+export declare function cacheableAnswer(answer: string, scope?: RefusalScope): boolean;

package/dist/{search-NIRCPRMW.js → search-LFS5HHMZ.js}

@@ -4,7 +4,7 @@ import {
 import "./chunk-7AXXR7GD.js";
 import "./chunk-TH5XGPD5.js";
 import "./chunk-W7J5SFXJ.js";
-import "./chunk-WPOKSNPE.js";
+import "./chunk-XBZIJMS7.js";
 import "./chunk-4NXH5ZI6.js";
 import "./chunk-VT7DR6NQ.js";
 import "./chunk-3FYJM7LH.js";

package/dist/worker_public/src/index.js

@@ -4,7 +4,7 @@ import {
   handleMemories,
   scoreFaithfulness,
   scoreJudge
-} from "../../chunk-JYJJ4SYF.js";
+} from "../../chunk-27NZR4HF.js";
 import {
   TOOLS_REGISTRY,
   bindModelNode,
@@ -54,7 +54,7 @@ import {
 } from "../../chunk-W7J5SFXJ.js";
 import {
   canonicalRefusal
-} from "../../chunk-WPOKSNPE.js";
+} from "../../chunk-XBZIJMS7.js";
 import {
   entitlementScope,
   standardKeysFrom
@@ -1052,7 +1052,7 @@ async function callToolOnce(env, ctx, _req, tier, key, name, args, t0) {
       const r = await runTool({ ...env, DB: env.DB }, { name, args }, "mcp");
       payload = r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
     } else {
-      const res = name === "ask" ? await (await import("../../ask-PFU74MIP.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-NIRCPRMW.js")).handleSearch(env, ctx, inner, tier, key);
+      const res = name === "ask" ? await (await import("../../ask-JX55WMFR.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-LFS5HHMZ.js")).handleSearch(env, ctx, inner, tier, key);
       payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     }
     telemetry(env, ctx, tier, `mcp:${name}`, null, !payload?.error, JSON.stringify(payload).length, await sha256Hex(`${name}:${JSON.stringify(args ?? {})}`), void 0, void 0, { durationMs: Date.now() - t0 });

package/dist/worker_public/src/refusal.js

@@ -1,10 +1,12 @@
 import {
+  cacheableAnswer,
   canonicalRefusal,
   exciseMisplacedPin,
   refusalAnswer
-} from "../../chunk-WPOKSNPE.js";
+} from "../../chunk-XBZIJMS7.js";
 import "../../chunk-3FYJM7LH.js";
 export {
+  cacheableAnswer,
   canonicalRefusal,
   exciseMisplacedPin,
   refusalAnswer

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.134",
+  "version": "0.2.135",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/src/ask.ts

@@ -17,7 +17,7 @@ import { reflect } from "./reflect";
 import { scoreFaithfulness } from "./faithfulness";
 import { entailmentVerdict } from "./entailment";
 import { checkQuoteAnchors, ANCHOR_CORRECTION_NOTE } from "./anchors";
-import { canonicalRefusal, exciseMisplacedPin } from "./refusal";
+import { cacheableAnswer, canonicalRefusal, exciseMisplacedPin } from "./refusal";
 import { contractV2, tableRetyped } from "./refs";
 import { completeTables, completeFigures } from "./completion";
 import { NO_CONTEXT, appliedContext, contextNote, namedDocumentIn, parseContext, resolveDocScope, syntheticUnderstanding } from "./context";
@@ -1582,7 +1582,7 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
           if (streamed.violations.length > 0) {
             console.log("anchors:", streamed.violations.length, "of", streamed.total, "unverified — not caching");
           }
-          if (streamed.violations.length === 0 && canonical.length > 0 && !contextual && !declaredCtx && !canonical.includes(refusalAnswer()) && !ablate) {
+          if (streamed.violations.length === 0 && canonical.length > 0 && !contextual && !declaredCtx && cacheableAnswer(canonical, refusalScope(usedHits.length > 0)) && !ablate) {
             ctx.waitUntil(
               env.CACHE.put(exactCacheKey(env.INDEX_VERSION, gen, ns, await sha256Hex(cacheKeyMaterial(q.query, q.lang, salt))), JSON.stringify({ answer: canonical, citations: cites, model, query_hash: queryHash, ...(sourceQuality ? { source_quality: sourceQuality, confidence_note: streamedNote || qualityNote(sourceQuality) } : {}), ...(streamedEntailment ? { entailment: streamedEntailment } : {}) }), { expirationTtl: LIMITS.cacheTtlSec }),
             );
@@ -1811,7 +1811,7 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
     }
   }
   const out = { answer, citations: finalCites, ...(jsonQuality ? { source_quality: jsonQuality, confidence_note: entailmentNote || qualityNote(jsonQuality), ...(entailment ? { entailment } : {}), ...(jsonQuality === "ocr" ? { experimental_sources: experimentalSourceLabels(finalCites) } : {}) } : {}), model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...(registerBlock ? [registerBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}), ...(ablate ? { ablate } : {}), route: { route: routed.route, features: routed.features } };
-  const cacheable = !contextual && !declaredCtx && !ablate && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
+  const cacheable = !contextual && !declaredCtx && !ablate && cacheableAnswer(answer, refusalScope(usedHits.length > 0)) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const ck = exactCacheKey(env.INDEX_VERSION, gen, ns, await sha256Hex(cacheKeyMaterial(q.query, q.lang, salt)));
     ctx.waitUntil(env.CACHE.put(ck, JSON.stringify(out), { expirationTtl: LIMITS.cacheTtlSec }));

package/workers/worker_public/src/refusal.ts

@@ -146,3 +146,15 @@ export function exciseMisplacedPin(answer: string, cites: boolean): string {
   }
   return out.replace(/^[ \t\n]+/, "").replace(/\n{3,}/g, "\n\n").trim();
 }
+
+/** Cacheable under the refusal law (2026-10-11, the poisoned-entry
+ *  lesson): "refusals are never cached" was enforced as "answers
+ *  containing the pin are never cached" — backwards for DRIFT, which
+ *  lacks the pin and cached itself across deploy windows (an edge
+ *  instance running pre-wall code wrote a drifted refusal that served
+ *  every later ask). An answer is cacheable only when it carries no
+ *  pin AND the wall would not rewrite it. */
+export function cacheableAnswer(answer: string, scope?: RefusalScope): boolean {
+  if (answer.includes(refusalAnswer())) return false;
+  return canonicalRefusal(answer, scope) === answer;
+}