@konneal/engine 0.2.170 → 0.2.175

package/dist/admin.d.ts

@@ -21,9 +21,11 @@ export declare function handleSectionUnit(env: Env, ctx: ExecutionContext, req:
  *  the deterministic registry line. Admin-gated; idempotent (force
  *  regenerates); the quality-first lane pays once. */
 export declare function handleFamilySummary(env: Env, req: Request): Promise<Response>;
-/** Ops access to the Vectorize binding (get/upsert by id) for offline
- *  passes like embedding smoothing (G-ETSI-4) — the binding is the
- *  credential, admin-token gated exactly like /admin/enrich. */
+/** The pairwise vision judge (TODO.sota/18.4's A/B): two anonymized
+ *  captions of the SAME figure, presented in randomized order beside the
+ *  image itself; a THIRD model (never a contestant) picks the better
+ *  caption with a reason. Admin-gated; one-time quality-first lane. */
+export declare function handleVisionJudge(env: Env, req: Request): Promise<Response>;
 /** One-time figure captioning (TODO.remaining/03): fetch the unit's asset
  *  from R2, describe it with the vision-capable answer model, store the
  *  description into unit_payloads. Admin-gated; idempotent. */

package/dist/ask-7TNQCRD6.js

@@ -0,0 +1,16 @@
+import {
+  handleAsk
+} from "./chunk-ZZLUGHZ2.js";
+import "./chunk-ECOYO7EX.js";
+import "./chunk-B2MU4ZWM.js";
+import "./chunk-CLDMP5YH.js";
+import "./chunk-ZHT4456M.js";
+import "./chunk-D7MO4RVQ.js";
+import "./chunk-ETLSWSZ7.js";
+import "./chunk-FNQ7UOEB.js";
+import "./chunk-HWWJAJWM.js";
+import "./chunk-3FYJM7LH.js";
+import "./chunk-KINFFYQH.js";
+export {
+  handleAsk
+};

package/dist/{chunk-QS6V53RO.js → chunk-B2MU4ZWM.js}

@@ -1,12 +1,12 @@
 import {
   embed
-} from "./chunk-XWSZWFYP.js";
+} from "./chunk-ZHT4456M.js";
 import {
   standardKeysFrom
-} from "./chunk-PQDAL4MX.js";
+} from "./chunk-FNQ7UOEB.js";
 import {
   THRESHOLDS
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 import {
   P
 } from "./chunk-3FYJM7LH.js";

package/dist/{chunk-RZLEHCIA.js → chunk-CLDMP5YH.js}

@@ -1,11 +1,11 @@
 import {
   embed,
   rerank
-} from "./chunk-XWSZWFYP.js";
+} from "./chunk-ZHT4456M.js";
 import {
   bubbleConfirmPage,
   isAllowedBubbleOrigin
-} from "./chunk-O2XMNKCK.js";
+} from "./chunk-D7MO4RVQ.js";
 import {
   DATASETS,
   LIMITS,
@@ -15,7 +15,7 @@ import {
   processExpansion,
   sha256Hex,
   today
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 import {
   P
 } from "./chunk-3FYJM7LH.js";

package/dist/{chunk-O2XMNKCK.js → chunk-D7MO4RVQ.js}

@@ -1,7 +1,7 @@
 import {
   LIMITS,
   sha256Hex
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 import {
   P
 } from "./chunk-3FYJM7LH.js";

package/dist/{chunk-PQDAL4MX.js → chunk-FNQ7UOEB.js}

@@ -1,7 +1,7 @@
 import {
   DATASETS,
   datasetAllowed
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 import {
   P
 } from "./chunk-3FYJM7LH.js";

package/dist/{chunk-5UIMQAJZ.js → chunk-HWWJAJWM.js}

@@ -11,6 +11,13 @@ var MODELS = {
   // Vision image-parts land with answer contract v2; text answers work now.
   anon: "@cf/zai-org/glm-5.3-flash",
   member: "@cf/zai-org/glm-5.3-flash",
+  // figure captions + the vision lane (one-time, quality-first; the A/B
+  // lever is CAPTION_MODEL, the per-request arm is the admin route's
+  // body.model)
+  caption: "@cf/zai-org/glm-5.3-flash",
+  // the pairwise vision judge (sees the image; a THIRD model never
+  // judges its own arm)
+  visionJudge: "@cf/deepseek-ai/deepseek-v4.1-flash-1017",
   // the VLM figure rerank (TODO.sota/18.3): the newly-landed
   // vision-capable MoE scores figure IMAGES against figure-seeking
   // questions — one bounded call per figure question, ablatable stage

package/dist/{chunk-6KEWBP7O.js → chunk-MUWO2EV6.js}

@@ -6,24 +6,24 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-RZLEHCIA.js";
+} from "./chunk-CLDMP5YH.js";
 import {
   corsHeaders,
   err,
   json,
   readJson,
   validateQuery
-} from "./chunk-O2XMNKCK.js";
+} from "./chunk-D7MO4RVQ.js";
 import {
   entitlementScope,
   standardKeysFrom
-} from "./chunk-PQDAL4MX.js";
+} from "./chunk-FNQ7UOEB.js";
 import {
   LIMITS,
   MODELS,
   num,
   sha256Hex
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 import {
   portModelRunner
 } from "./chunk-KINFFYQH.js";

package/dist/{chunk-XWSZWFYP.js → chunk-ZHT4456M.js}

@@ -1,7 +1,7 @@
 import {
   answerEffort,
   effortBudget
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 
 // workers/worker_public/src/ai.ts
 var delay = (ms) => new Promise((r) => setTimeout(r, ms));

package/dist/{chunk-PO3UBDNZ.js → chunk-ZZLUGHZ2.js}

@@ -32,7 +32,7 @@ import {
   tableRetyped,
   toolNote,
   verdictNote
-} from "./chunk-QS6V53RO.js";
+} from "./chunk-B2MU4ZWM.js";
 import {
   NO_CONTEXT,
   STAGE_NAMES,
@@ -75,18 +75,18 @@ import {
   tokenBudget,
   understandQuery,
   usageTotal
-} from "./chunk-RZLEHCIA.js";
+} from "./chunk-CLDMP5YH.js";
 import {
   embed,
   generateOnce
-} from "./chunk-XWSZWFYP.js";
+} from "./chunk-ZHT4456M.js";
 import {
   corsHeaders,
   err,
   json,
   readJson,
   validateQuery
-} from "./chunk-O2XMNKCK.js";
+} from "./chunk-D7MO4RVQ.js";
 import {
   cacheableAnswer,
   canonicalRefusal,
@@ -99,7 +99,7 @@ import {
   requestSalt,
   resolveRequestScope,
   standardKeysFrom
-} from "./chunk-PQDAL4MX.js";
+} from "./chunk-FNQ7UOEB.js";
 import {
   LIMITS,
   MODELS,
@@ -110,7 +110,7 @@ import {
   requestEffort,
   roleModel,
   sha256Hex
-} from "./chunk-5UIMQAJZ.js";
+} from "./chunk-HWWJAJWM.js";
 import {
   P
 } from "./chunk-3FYJM7LH.js";
@@ -1590,7 +1590,11 @@ ${passages.map((p, i) => `[${i + 1}] ${p}`).join("\n")}
 List the DISTINCT requirements relevant to the question as JSON: {"mode":"check"|"list","requirements":[{"text":"...","clause":"..."}]} \u2014 "check" when the user's question or values ask whether requirements are MET; "list" when the user asks what the requirements ARE. Max ${THRESHOLDS.decisionsRequirementsMax}. Each requirement's clause = the clause anchor it comes from. If nothing qualifies, return {"mode":"list","requirements":[]}.`
         }
       ],
-      maxTokens: 1536,
+      maxTokens: 3072,
+      // the GLM law: the effort defaults to MAX when absent — an omitted
+      // effort starved the derivation to empty (observed live: the pass
+      // stood down silently on every fired question)
+      effort: "low",
       temperature: 0
     });
     const { mode, requirements } = parseDerivation(derived.text, THRESHOLDS.decisionsRequirementsMax);
@@ -1617,6 +1621,15 @@ ${passages.join("\n")}`.slice(0, 12e3),
     return null;
   }
 }
+function telemetryDecisions(env, ctx, tier, queryHash, result, durationMs) {
+  try {
+    telemetry(env, ctx, tier, "ask-decisions", result ? result.gate.toFixed(2) : "0", !!result, result?.items.length ?? 0, queryHash, result?.mode ?? void 0, void 0, { durationMs });
+    for (const it of result?.items ?? []) {
+      telemetry(env, ctx, tier, "ask-decision", it.probability.toFixed(2), it.band === "met", 1, queryHash, it.band, void 0, {});
+    }
+  } catch {
+  }
+}
 
 // workers/worker_public/src/route.ts
 var ROUTE_FAST_WORD_CAP = 10;
@@ -2972,14 +2985,17 @@ Answer account questions from these records ONLY: name the record when you use i
         let canonical0 = exciseMisplacedPin(canonicalRefusal(full.replace(/^TOOL [a-z_.]+.*$\n?/gm, "").replace(/^\n+/, ""), refusalScope(answerCites(full))), answerCites(full));
         const c2 = canonical0.includes(refusalAnswer()) ? { text: canonical0, blocks: [], dropped: [] } : await contractV2(env.DB, canonical0, usedHits);
         let streamedCompletionBlocks = [];
-        if (decisionPromise && !canonical0.includes(refusalAnswer())) {
+        let streamedDecisions;
+        if (decisionPromise && !canonical0.includes(refusalAnswer()) && !verdictBlock && !conditionBlock && !aggregationBlock) {
           const dp = await decisionPromise;
           if (dp) {
             canonical0 += dp.section;
             send({ type: "token", v: dp.section });
             full += dp.section;
+            streamedDecisions = { mode: dp.mode, gate: dp.gate, items: dp.items };
             console.log("decisions: streamed the checklist section (" + dp.items.length + " items, mode " + dp.mode + ")");
           }
+          telemetryDecisions(env, ctx, tier, queryHash, streamedDecisions ?? null, Date.now() - tStart);
         }
         if (!canonical0.includes(refusalAnswer())) {
           try {
@@ -2994,6 +3010,7 @@ Answer account questions from these records ONLY: name the record when you use i
           model,
           query_hash: queryHash,
           follow_ups: refusalShaped(canonical0, refusalScope(answerCites(full))) ? [] : understanding?.follow_ups ?? [],
+          ...streamedDecisions ? { decisions: streamedDecisions } : {},
           blocks: [...c2.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : [], ...aggregationBlock ? [aggregationBlock] : [], ...streamedCompletionBlocks],
           context_applied: ctxApplied,
           read: readAs(),
@@ -3215,10 +3232,11 @@ Answer account questions from these records ONLY: name the record when you use i
     let decisionsOut;
     if (decisionPromise) {
       const dp = await decisionPromise;
-      if (dp && answer && !answer.includes(refusalAnswer())) {
+      if (dp && answer && !answer.includes(refusalAnswer()) && !verdictBlock && !conditionBlock && !aggregationBlock) {
         answer = answer + dp.section;
         decisionsOut = { mode: dp.mode, gate: dp.gate, items: dp.items };
       }
+      telemetryDecisions(env, ctx, tier, queryHash, decisionsOut ?? null, Date.now() - tStart);
     }
     const out = { answer, citations: finalCites, ...jsonQuality ? { source_quality: jsonQuality, confidence_note: entailmentNote || qualityNote(jsonQuality), ...entailment ? { entailment } : {}, ...jsonQuality === "ocr" ? { experimental_sources: experimentalSourceLabels(finalCites) } : {} } : {}, model: MODELS.member, query_hash: queryHash, follow_ups: refusalShaped(answer, refusalScope(answerCites(answer))) ? [] : understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : [], ...aggregationBlock ? [aggregationBlock] : [], ...registerBlock ? [registerBlock] : [], ...completionBlocks], context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {}, ...decisionsOut ? { decisions: decisionsOut } : {}, ...ablate ? { ablate } : {}, route: { route: routed.route, features: routed.features } };
     const cacheable = !contextual && !declaredCtx && !ablate && cacheableAnswer(answer, refusalScope(answerCites(answer))) && finalAnchors.violations.length === 0;

package/dist/config.d.ts

@@ -3,6 +3,8 @@ export declare const MODELS: {
     readonly rerank: "@cf/baai/bge-reranker-base";
     readonly anon: "@cf/zai-org/glm-5.3-flash";
     readonly member: "@cf/zai-org/glm-5.3-flash";
+    readonly caption: "@cf/zai-org/glm-5.3-flash";
+    readonly visionJudge: "@cf/deepseek-ai/deepseek-v4.1-flash-1017";
     readonly vlmFigure: "@cf/deepseek-ai/deepseek-v4.1-flash-1017";
     readonly decisionsGate: "@cf/cloudflare/clef-flash";
     readonly decisionsModel: "@cf/cloudflare/clef";

package/dist/decisionWire.d.ts

@@ -23,3 +23,18 @@ export declare function runDecisionPass(env: Env, opts: {
     statedValues?: string;
     userDocs?: boolean;
 }): Promise<DecisionPassResult | null>;
+/** The decisions telemetry (TODO.decisions/03): the nightly's
+ *  calibration signal, riding the queries table's route key with a
+ *  defined encoding — no schema migration.
+ *  - one PASS row, route "ask-decisions": ok = fired, lang = mode,
+ *    model = the gate probability (2dp), duration_ms = the pass's.
+ *  - one ITEM row per requirement, route "ask-decision": ok = band is
+ *    "met", lang = band, model = the probability (2dp); query_hash
+ *    joins the rows to their pass. */
+export declare function telemetryDecisions(env: Env, ctx: {
+    waitUntil(p: Promise<unknown>): void;
+}, tier: string, queryHash: string, result: {
+    mode: string;
+    gate: number;
+    items: DecisionItem[];
+} | null, durationMs: number): void;

package/dist/openapi-surface.gen.d.ts

@@ -3,7 +3,7 @@ export interface OpenApiRoute {
     pattern: string;
     operationId: string;
 }
-export type OpenApiOperationId = "credits" | "creditsAlias" | "askAnonymous" | "askKeyed" | "search" | "searchKeyed" | "verify" | "verifyKeyed" | "research" | "researchKeyed" | "mcp" | "datasets" | "keyUsage" | "health" | "listConversations" | "createConversation" | "getConversation" | "renameConversation" | "deleteConversation" | "appendMessage" | "shareConversation" | "getShared" | "uploadAttachment" | "listAttachments" | "getAttachment" | "deleteAttachment" | "listMemories" | "createMemory" | "deleteMemory" | "listProjects" | "createProject" | "deleteProject" | "listProjectFiles" | "attachProjectFile" | "detachProjectFile" | "laneQuery" | "laneKeyed" | "feedback" | "adminEnrich" | "adminEnrichAlias" | "adminSection" | "adminFamilySummary" | "adminSectionAlias" | "adminFamilySummaryAlias" | "adminVectors" | "adminCaption" | "adminJudge" | "adminJudgeAlias" | "adminRevokeKey" | "authMe" | "authLogin" | "authCallback" | "authLogout" | "authLogoutLink" | "adminStats" | "adminListKeys" | "adminCreateKey";
+export type OpenApiOperationId = "credits" | "creditsAlias" | "askAnonymous" | "askKeyed" | "search" | "searchKeyed" | "verify" | "verifyKeyed" | "research" | "researchKeyed" | "mcp" | "datasets" | "keyUsage" | "health" | "listConversations" | "createConversation" | "getConversation" | "renameConversation" | "deleteConversation" | "appendMessage" | "shareConversation" | "getShared" | "uploadAttachment" | "listAttachments" | "getAttachment" | "deleteAttachment" | "listMemories" | "createMemory" | "deleteMemory" | "listProjects" | "createProject" | "deleteProject" | "listProjectFiles" | "attachProjectFile" | "detachProjectFile" | "laneQuery" | "laneKeyed" | "feedback" | "adminEnrich" | "adminEnrichAlias" | "adminSection" | "adminFamilySummary" | "adminSectionAlias" | "adminFamilySummaryAlias" | "adminVectors" | "adminCaption" | "adminVisionJudge" | "adminJudge" | "adminJudgeAlias" | "adminRevokeKey" | "authMe" | "authLogin" | "authCallback" | "authLogout" | "authLogoutLink" | "adminStats" | "adminListKeys" | "adminCreateKey";
 export declare const OPENAPI_SURFACE: readonly (Omit<OpenApiRoute, "operationId"> & {
     operationId: OpenApiOperationId;
 })[];

package/dist/openapi-types.d.ts

@@ -753,6 +753,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/vision_judge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Judge two captions of one figure against the image
+         * @description The caption A/B's pairwise judge — two anonymized descriptions of the same figure, presented in randomized order beside the image itself, decided by a third model that took no part in writing either. The vision A/B harness calls this lane.
+         */
+        post: operations["adminVisionJudge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/admin/judge": {
         parameters: {
             query?: never;
@@ -2164,11 +2184,44 @@ export interface operations {
                     unit_id: string;
                     /** @description Surrounding clause text, at most 400 characters, to steer the description. */
                     context?: string;
+                    /** @description Per-request vision model override (an @cf/ id) — the caption A/B's measurement arm. Absent, the CAPTION_MODEL role (default glm-5.3-flash) serves. */
+                    model?: string;
+                    /** @description Return the description without storing it into the unit's payload. */
+                    dry_run?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The description (stored, or returned only under dry_run). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminVisionJudge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The figure unit whose asset the captions describe. */
+                    unit_id: string;
+                    captions: {
+                        a: string;
+                        b: string;
+                    };
                 };
             };
         };
         responses: {
-            /** @description The stored description. */
+            /** @description The winning arm (a or b) with the judge's reason. */
             200: {
                 headers: {
                     [name: string]: unknown;

package/dist/search-KNPPTHMG.js

@@ -0,0 +1,14 @@
+import {
+  handleSearch
+} from "./chunk-MUWO2EV6.js";
+import "./chunk-CLDMP5YH.js";
+import "./chunk-ZHT4456M.js";
+import "./chunk-D7MO4RVQ.js";
+import "./chunk-ETLSWSZ7.js";
+import "./chunk-FNQ7UOEB.js";
+import "./chunk-HWWJAJWM.js";
+import "./chunk-3FYJM7LH.js";
+import "./chunk-KINFFYQH.js";
+export {
+  handleSearch
+};

package/dist/{tools-HK5RXHBQ.js → tools-VHN54DWH.js}

@@ -4,10 +4,10 @@ import {
   parseToolCall,
   runTool,
   toolNote
-} from "./chunk-QS6V53RO.js";
-import "./chunk-XWSZWFYP.js";
-import "./chunk-PQDAL4MX.js";
-import "./chunk-5UIMQAJZ.js";
+} from "./chunk-B2MU4ZWM.js";
+import "./chunk-ZHT4456M.js";
+import "./chunk-FNQ7UOEB.js";
+import "./chunk-HWWJAJWM.js";
 import "./chunk-3FYJM7LH.js";
 import "./chunk-KINFFYQH.js";
 export {

package/dist/worker_mcp/src/index.js

@@ -1,7 +1,7 @@
 import {
   authenticate
-} from "../../chunk-O2XMNKCK.js";
-import "../../chunk-5UIMQAJZ.js";
+} from "../../chunk-D7MO4RVQ.js";
+import "../../chunk-HWWJAJWM.js";
 import {
   P,
   setProfile

package/dist/worker_public/src/config.js

@@ -16,7 +16,7 @@ import {
   roleModel,
   sha256Hex,
   today
-} from "../../chunk-5UIMQAJZ.js";
+} from "../../chunk-HWWJAJWM.js";
 import "../../chunk-3FYJM7LH.js";
 export {
   DATASETS,

package/dist/worker_public/src/index.js

@@ -4,16 +4,16 @@ import {
   handleMemories,
   scoreFaithfulness,
   scoreJudge
-} from "../../chunk-PO3UBDNZ.js";
+} from "../../chunk-ZZLUGHZ2.js";
 import "../../chunk-ECOYO7EX.js";
 import {
   TOOLS_REGISTRY,
   bindModelNode,
   modelGroundingBlock
-} from "../../chunk-QS6V53RO.js";
+} from "../../chunk-B2MU4ZWM.js";
 import {
   handleSearch
-} from "../../chunk-6KEWBP7O.js";
+} from "../../chunk-MUWO2EV6.js";
 import {
   buildMessages,
   citations,
@@ -38,11 +38,11 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-RZLEHCIA.js";
+} from "../../chunk-CLDMP5YH.js";
 import {
   embed,
   generateOnce
-} from "../../chunk-XWSZWFYP.js";
+} from "../../chunk-ZHT4456M.js";
 import {
   authenticate,
   corsHeaders,
@@ -51,14 +51,14 @@ import {
   readJson,
   validateQuery,
   withCors
-} from "../../chunk-O2XMNKCK.js";
+} from "../../chunk-D7MO4RVQ.js";
 import {
   canonicalRefusal
 } from "../../chunk-ETLSWSZ7.js";
 import {
   entitlementScope,
   standardKeysFrom
-} from "../../chunk-PQDAL4MX.js";
+} from "../../chunk-FNQ7UOEB.js";
 import {
   LIMITS,
   MODELS,
@@ -69,7 +69,7 @@ import {
   roleModel,
   sha256Hex,
   today
-} from "../../chunk-5UIMQAJZ.js";
+} from "../../chunk-HWWJAJWM.js";
 import {
   P,
   setProfile
@@ -581,6 +581,70 @@ ${chain || "(no successor edges recorded)"}` }
     return err(502, "family_summary_failed", String(e?.message ?? e).slice(0, 200));
   }
 }
+async function loadUnitAsset(env, unitId) {
+  const row = await env.DB.prepare("SELECT payload, docidentifier FROM unit_payloads WHERE unit_id = ?1").bind(unitId).first();
+  if (!row) return { error: err(404, "not_found", "no unit_payload row for that id") };
+  const payload = JSON.parse(String(row.payload));
+  const uri = payload.uri ?? "";
+  const m = uri.match(/^\/assets\/(.+)/);
+  if (!m) return { error: err(400, "invalid_input", "payload has no /assets/ uri (upload the asset first)") };
+  const obj = await env.UNIT_ASSETS.get(m[1]);
+  if (!obj) return { error: err(404, "not_found", `asset ${m[1]} not in R2`) };
+  const buf = await obj.arrayBuffer();
+  const ext = m[1].split(".").pop()?.toLowerCase() ?? "png";
+  const mime = ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`;
+  const bytes = new Uint8Array(buf);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 8192) binary += String.fromCharCode(...bytes.subarray(i, i + 8192));
+  return { row, b64: btoa(binary), mime };
+}
+async function handleVisionJudge(env, req) {
+  if (!env.ADMIN_TOKEN) return err(501, "admin_disabled", "ADMIN_TOKEN secret is not configured");
+  const auth = req.headers.get("authorization") ?? "";
+  if (auth !== `Bearer ${env.ADMIN_TOKEN}`) return err(401, "unauthorized", "Invalid admin token");
+  const body = await readJson(req);
+  const unitId = typeof body?.unit_id === "string" ? body.unit_id : "";
+  const capA = typeof body?.captions?.a === "string" ? body.captions.a.slice(0, 2e3) : "";
+  const capB = typeof body?.captions?.b === "string" ? body.captions.b.slice(0, 2e3) : "";
+  if (!unitId || !capA || !capB) return err(400, "invalid_input", "unit_id and captions.a/.b required");
+  try {
+    const loaded = await loadUnitAsset(env, unitId);
+    if (loaded.error) return loaded.error;
+    const swap = Math.random() < 0.5;
+    const first = swap ? capB : capA;
+    const second = swap ? capA : capB;
+    const res = await env.AI.run(roleModel(env, "visionJudge"), {
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "text", text: `You are judging two descriptions of the same figure (from ${loaded.row.docidentifier}) written for a reader who cannot see it. The figure is attached.
+
+Description 1: ${first}
+
+Description 2: ${second}
+
+Which description better tells the reader what the figure shows and its normative point? Reply with ONLY JSON: {"better": 1 or 2, "reason": "one sentence"}.` },
+            { type: "image_url", image_url: { url: `data:${loaded.mime};base64,${loaded.b64}` } }
+          ]
+        }
+      ],
+      // the DeepSeek law: reasoning is always on — a 2048 budget starved
+      // the verdict to empty content (the E.2.2.x judges failed on
+      // "Unexpected end of JSON input"); 4096 leaves the JSON intact
+      max_tokens: 4096
+    });
+    const anyRes = res;
+    const text = typeof anyRes?.response === "string" ? anyRes.response : anyRes?.choices?.[0]?.message?.content ?? "";
+    const parsed = JSON.parse(text.replace(/^[^\{]*/, "").replace(/[^\}]*$/, ""));
+    const said = parsed?.better === 1 ? "first" : parsed?.better === 2 ? "second" : null;
+    if (!said) return err(502, "judge_failed", "no decision in the judge's reply: " + text.slice(0, 120));
+    const winner = said === "first" === swap ? "b" : "a";
+    return json({ ok: true, unit_id: unitId, better: winner, judge: roleModel(env, "visionJudge"), reason: String(parsed.reason ?? "").slice(0, 500) });
+  } catch (e) {
+    return err(502, "vision_judge_failed", String(e).slice(0, 200));
+  }
+}
 async function handleCaption(env, req) {
   if (!env.ADMIN_TOKEN) return err(501, "admin_disabled", "ADMIN_TOKEN secret is not configured");
   const auth = req.headers.get("authorization") ?? "";
@@ -588,27 +652,19 @@ async function handleCaption(env, req) {
   const body = await readJson(req);
   const unitId = typeof body?.unit_id === "string" ? body.unit_id : "";
   const context = typeof body?.context === "string" ? body.context.slice(0, 400) : "";
+  const override = typeof body?.model === "string" && body.model.startsWith("@cf/") ? body.model : null;
+  const dryRun = body?.dry_run === true;
   if (!unitId) return err(400, "invalid_input", "unit_id required");
   try {
-    const row = await env.DB.prepare("SELECT payload, docidentifier FROM unit_payloads WHERE unit_id = ?1").bind(unitId).first();
-    if (!row) return err(404, "not_found", "no unit_payload row for that id");
-    const payload = JSON.parse(String(row.payload));
-    const uri = payload.uri ?? "";
-    const m = uri.match(/^\/assets\/(.+)/);
-    if (!m) return err(400, "invalid_input", "payload has no /assets/ uri (upload the asset first)");
-    const obj = await env.UNIT_ASSETS.get(m[1]);
-    if (!obj) return err(404, "not_found", `asset ${m[1]} not in R2`);
-    const buf = await obj.arrayBuffer();
-    const ext = m[1].split(".").pop()?.toLowerCase() ?? "png";
-    const mime = ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`;
-    const bytes = new Uint8Array(buf);
-    let binary = "";
-    for (let i = 0; i < bytes.length; i += 8192) binary += String.fromCharCode(...bytes.subarray(i, i + 8192));
-    const b64 = btoa(binary);
+    const loaded = await loadUnitAsset(env, unitId);
+    if (loaded.error) return loaded.error;
+    const row = loaded.row;
+    const b64 = loaded.b64;
+    const mime = loaded.mime;
     let res = null;
     for (let attempt = 0; attempt < 2 && !res; attempt++) {
       try {
-        res = await env.AI.run(MODELS.member, {
+        res = await env.AI.run(override ?? roleModel(env, "caption"), {
           messages: [
             {
               role: "user",
@@ -636,8 +692,8 @@ async function handleCaption(env, req) {
       const end = Math.max(cut.lastIndexOf(". "), cut.lastIndexOf("! "), cut.lastIndexOf("? "));
       return end === -1 ? cut.slice(0, cut.lastIndexOf(" ")) : cut.slice(0, end + 1);
     })();
-    await env.DB.prepare("UPDATE unit_payloads SET payload = json_set(payload, '$.description', ?1) WHERE unit_id = ?2").bind(desc, unitId).run();
-    return json({ ok: true, unit_id: unitId, description: desc });
+    if (!dryRun) await env.DB.prepare("UPDATE unit_payloads SET payload = json_set(payload, '$.description', ?1) WHERE unit_id = ?2").bind(desc, unitId).run();
+    return json({ ok: true, unit_id: unitId, model: override ?? roleModel(env, "caption"), dry_run: dryRun || void 0, description: desc });
   } catch (e) {
     return err(502, "caption_failed", String(e).slice(0, 200));
   }
@@ -1119,13 +1175,13 @@ async function callToolOnce(env, ctx, _req, tier, key, name, args, t0) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const { runTool, TOOLS_REGISTRY: TOOLS_REGISTRY2 } = await import("../../tools-HK5RXHBQ.js");
+    const { runTool, TOOLS_REGISTRY: TOOLS_REGISTRY2 } = await import("../../tools-VHN54DWH.js");
     let payload;
     if (TOOLS_REGISTRY2.some((t) => t.name === name && t.audiences.includes("mcp"))) {
       const r = await runTool({ ...env, DB: env.DB }, { name, args }, "mcp");
       payload = r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
     } else {
-      const res = name === "ask" ? await (await import("../../ask-BKWQEMSY.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-RNCRT5BR.js")).handleSearch(env, ctx, inner, tier, key);
+      const res = name === "ask" ? await (await import("../../ask-7TNQCRD6.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-KNPPTHMG.js")).handleSearch(env, ctx, inner, tier, key);
       payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     }
     telemetry(env, ctx, tier, `mcp:${name}`, null, !payload?.error, JSON.stringify(payload).length, await sha256Hex(`${name}:${JSON.stringify(args ?? {})}`), void 0, void 0, { durationMs: Date.now() - t0 });
@@ -1392,6 +1448,11 @@ var OPENAPI_SURFACE = [
     "pattern": "/admin/caption",
     "operationId": "adminCaption"
   },
+  {
+    "method": "POST",
+    "pattern": "/admin/vision_judge",
+    "operationId": "adminVisionJudge"
+  },
   {
     "method": "POST",
     "pattern": "/v1/admin/judge",
@@ -1933,6 +1994,7 @@ var OPENAPI_HANDLERS = {
   adminSectionAlias: (c) => handleSectionUnit(c.env, c.ctx, c.req),
   adminVectors: (c) => handleVectors(c.env, c.req),
   adminCaption: (c) => handleCaption(c.env, c.req),
+  adminVisionJudge: (c) => handleVisionJudge(c.env, c.req),
   adminJudge: (c) => handleJudge(c.env, c.req),
   adminJudgeAlias: (c) => handleJudge(c.env, c.req)
 };

package/dist/worker_public/src/requestScope.js

@@ -4,8 +4,8 @@ import {
   requestSalt,
   resolveRequestScope,
   standardKeysFrom
-} from "../../chunk-PQDAL4MX.js";
-import "../../chunk-5UIMQAJZ.js";
+} from "../../chunk-FNQ7UOEB.js";
+import "../../chunk-HWWJAJWM.js";
 import "../../chunk-3FYJM7LH.js";
 export {
   entitlementScope,

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.170",
+  "version": "0.2.175",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/openapi.yaml

@@ -1007,9 +1007,47 @@ paths:
                 context:
                   type: string
                   description: Surrounding clause text, at most 400 characters, to steer the description.
+                model:
+                  type: string
+                  description: >-
+                    Per-request vision model override (an @cf/ id) — the
+                    caption A/B's measurement arm. Absent, the CAPTION_MODEL
+                    role (default glm-5.3-flash) serves.
+                dry_run:
+                  type: boolean
+                  description: Return the description without storing it into the unit's payload.
+      responses:
+        '200':
+          description: The description (stored, or returned only under dry_run).
+  /admin/vision_judge:
+    post:
+      tags: [Administration]
+      summary: Judge two captions of one figure against the image
+      description: >-
+        The caption A/B's pairwise judge — two anonymized descriptions of
+        the same figure, presented in randomized order beside the image
+        itself, decided by a third model that took no part in writing
+        either. The vision A/B harness calls this lane.
+      operationId: adminVisionJudge
+      security: [{ adminAuth: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [unit_id, captions]
+              properties:
+                unit_id: { type: string, description: The figure unit whose asset the captions describe. }
+                captions:
+                  type: object
+                  required: [a, b]
+                  properties:
+                    a: { type: string }
+                    b: { type: string }
       responses:
         '200':
-          description: The stored description.
+          description: The winning arm (a or b) with the judge's reason.
   /v1/admin/judge:
     post:
       tags: [Administration]

package/workers/worker_public/src/admin.ts

@@ -264,6 +264,77 @@ export async function handleFamilySummary(env: Env, req: Request): Promise<Respo
 /** Ops access to the Vectorize binding (get/upsert by id) for offline
  *  passes like embedding smoothing (G-ETSI-4) — the binding is the
  *  credential, admin-token gated exactly like /admin/enrich. */
+/** The unit's vision asset, base64-encoded for the message part — the
+ *  one load path the caption and the pairwise judge share. */
+async function loadUnitAsset(env: Env, unitId: string) {
+  const row = await env.DB.prepare("SELECT payload, docidentifier FROM unit_payloads WHERE unit_id = ?1").bind(unitId).first<any>();
+  if (!row) return { error: err(404, "not_found", "no unit_payload row for that id") };
+  const payload = JSON.parse(String(row.payload));
+  const uri = payload.uri ?? "";
+  const m = uri.match(/^\/assets\/(.+)/);
+  if (!m) return { error: err(400, "invalid_input", "payload has no /assets/ uri (upload the asset first)") };
+  const obj = await env.UNIT_ASSETS.get(m[1]);
+  if (!obj) return { error: err(404, "not_found", `asset ${m[1]} not in R2`) };
+  const buf = await obj.arrayBuffer();
+  const ext = m[1].split(".").pop()?.toLowerCase() ?? "png";
+  const mime = ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`;
+  // chunked: spreading the whole byte array blows the V8 stack on large
+  // assets (the 389KB u:figure-1)
+  const bytes = new Uint8Array(buf);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 8192) binary += String.fromCharCode(...bytes.subarray(i, i + 8192));
+  return { row, b64: btoa(binary), mime };
+}
+
+/** The pairwise vision judge (TODO.sota/18.4's A/B): two anonymized
+ *  captions of the SAME figure, presented in randomized order beside the
+ *  image itself; a THIRD model (never a contestant) picks the better
+ *  caption with a reason. Admin-gated; one-time quality-first lane. */
+export async function handleVisionJudge(env: Env, req: Request): Promise<Response> {
+  if (!env.ADMIN_TOKEN) return err(501, "admin_disabled", "ADMIN_TOKEN secret is not configured");
+  const auth = req.headers.get("authorization") ?? "";
+  if (auth !== `Bearer ${env.ADMIN_TOKEN}`) return err(401, "unauthorized", "Invalid admin token");
+  const body = await readJson(req);
+  const unitId = typeof body?.unit_id === "string" ? body.unit_id : "";
+  const capA = typeof body?.captions?.a === "string" ? body.captions.a.slice(0, 2000) : "";
+  const capB = typeof body?.captions?.b === "string" ? body.captions.b.slice(0, 2000) : "";
+  if (!unitId || !capA || !capB) return err(400, "invalid_input", "unit_id and captions.a/.b required");
+  try {
+    const loaded = await loadUnitAsset(env, unitId);
+    if (loaded.error) return loaded.error;
+    // randomized presentation order: the judge's letter bias must not
+    // correlate with either arm
+    const swap = Math.random() < 0.5;
+    const first = swap ? capB : capA;
+    const second = swap ? capA : capB;
+    const res = await env.AI.run(roleModel(env, "visionJudge"), {
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "text", text: `You are judging two descriptions of the same figure (from ${loaded.row.docidentifier}) written for a reader who cannot see it. The figure is attached.\n\nDescription 1: ${first}\n\nDescription 2: ${second}\n\nWhich description better tells the reader what the figure shows and its normative point? Reply with ONLY JSON: {"better": 1 or 2, "reason": "one sentence"}.` },
+            { type: "image_url", image_url: { url: `data:${loaded.mime};base64,${loaded.b64}` } },
+          ],
+        },
+      ],
+      // the DeepSeek law: reasoning is always on — a 2048 budget starved
+      // the verdict to empty content (the E.2.2.x judges failed on
+      // "Unexpected end of JSON input"); 4096 leaves the JSON intact
+      max_tokens: 4096,
+    });
+    const anyRes = res as any;
+    const text = typeof anyRes?.response === "string" ? anyRes.response : anyRes?.choices?.[0]?.message?.content ?? "";
+    const parsed = JSON.parse(text.replace(/^[^\{]*/, "").replace(/[^\}]*$/, ""));
+    const said = parsed?.better === 1 ? "first" : parsed?.better === 2 ? "second" : null;
+    if (!said) return err(502, "judge_failed", "no decision in the judge's reply: " + text.slice(0, 120));
+    // map back through the presentation swap
+    const winner = (said === "first") === swap ? "b" : "a";
+    return json({ ok: true, unit_id: unitId, better: winner, judge: roleModel(env, "visionJudge"), reason: String(parsed.reason ?? "").slice(0, 500) });
+  } catch (e) {
+    return err(502, "vision_judge_failed", String(e).slice(0, 200));
+  }
+}
+
 /** One-time figure captioning (TODO.remaining/03): fetch the unit's asset
  *  from R2, describe it with the vision-capable answer model, store the
  *  description into unit_payloads. Admin-gated; idempotent. */
@@ -274,29 +345,22 @@ export async function handleCaption(env: Env, req: Request): Promise<Response> {
   const body = await readJson(req);
   const unitId = typeof body?.unit_id === "string" ? body.unit_id : "";
   const context = typeof body?.context === "string" ? body.context.slice(0, 400) : "";
+  // the A/B arm (TODO.sota/18.4): a per-request model override for the
+  // measurement, admin-gated like the route itself; dry_run skips the
+  // payload write so the arms never mix state in unit_payloads
+  const override = typeof body?.model === "string" && body.model.startsWith("@cf/") ? body.model : null;
+  const dryRun = body?.dry_run === true;
   if (!unitId) return err(400, "invalid_input", "unit_id required");
   try {
-    const row = await env.DB.prepare("SELECT payload, docidentifier FROM unit_payloads WHERE unit_id = ?1").bind(unitId).first<any>();
-    if (!row) return err(404, "not_found", "no unit_payload row for that id");
-    const payload = JSON.parse(String(row.payload));
-    const uri = payload.uri ?? "";
-    const m = uri.match(/^\/assets\/(.+)/);
-    if (!m) return err(400, "invalid_input", "payload has no /assets/ uri (upload the asset first)");
-    const obj = await env.UNIT_ASSETS.get(m[1]);
-    if (!obj) return err(404, "not_found", `asset ${m[1]} not in R2`);
-    const buf = await obj.arrayBuffer();
-    const ext = m[1].split(".").pop()?.toLowerCase() ?? "png";
-    const mime = ext === "svg" ? "image/svg+xml" : `image/${ext === "jpg" ? "jpeg" : ext}`;
-    // chunked: spreading the whole byte array blows the V8 stack on large
-    // assets (the 389KB u:figure-1)
-    const bytes = new Uint8Array(buf);
-    let binary = "";
-    for (let i = 0; i < bytes.length; i += 8192) binary += String.fromCharCode(...bytes.subarray(i, i + 8192));
-    const b64 = btoa(binary);
+    const loaded = await loadUnitAsset(env, unitId);
+    if (loaded.error) return loaded.error;
+    const row = loaded.row;
+    const b64 = loaded.b64;
+    const mime = loaded.mime;
     let res: any = null;
     for (let attempt = 0; attempt < 2 && !res; attempt++) {
       try {
-        res = await env.AI.run(MODELS.member, {
+        res = await env.AI.run(override ?? roleModel(env, "caption"), {
           messages: [
             {
               role: "user",
@@ -331,8 +395,8 @@ export async function handleCaption(env: Env, req: Request): Promise<Response> {
             const end = Math.max(cut.lastIndexOf(". "), cut.lastIndexOf("! "), cut.lastIndexOf("? "));
             return end === -1 ? cut.slice(0, cut.lastIndexOf(" ")) : cut.slice(0, end + 1);
           })();
-    await env.DB.prepare("UPDATE unit_payloads SET payload = json_set(payload, '$.description', ?1) WHERE unit_id = ?2").bind(desc, unitId).run();
-    return json({ ok: true, unit_id: unitId, description: desc });
+    if (!dryRun) await env.DB.prepare("UPDATE unit_payloads SET payload = json_set(payload, '$.description', ?1) WHERE unit_id = ?2").bind(desc, unitId).run();
+    return json({ ok: true, unit_id: unitId, model: override ?? roleModel(env, "caption"), dry_run: dryRun || undefined, description: desc });
   } catch (e) {
     return err(502, "caption_failed", String(e).slice(0, 200));
   }

package/workers/worker_public/src/ask.ts

@@ -35,7 +35,7 @@ import { entitlementScope, resolveRequestScope, requestSalt, standardKeysFrom }
 import { rawSessionToken, type SessionClaims } from "./session";
 import { cacheKeyMaterial, corpusGen, exactCacheKey, freshRequested } from "./answercache";
 import { parseAblate } from "./ablate";
-import { decisionsEnabled, gateQuestion, runDecisionPass } from "./decisionWire";
+import { decisionsEnabled, gateQuestion, runDecisionPass, telemetryDecisions } from "./decisionWire";
 import type { DecisionItem } from "./decisions";
 import { STAGE_NAMES } from "./stages/index.ts";
 import { routeFor, fastRouteStages } from "./route.ts";
@@ -1730,15 +1730,21 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
           let streamedCompletionBlocks: Awaited<ReturnType<typeof completeTables>> = [];
           // the decision pass's section streams as the answer's tail
           // (the pass ran concurrently with generation — its arrival is
-          // instant here), before the completions and the done event
-          if (decisionPromise && !canonical0.includes(refusalAnswer())) {
+          // instant here), before the completions and the done event.
+          // Stand-down law (TODO.decisions/00): where a deterministic
+          // engine (verdict, condition, aggregation) answered, its block
+          // is authoritative — the checklist never rides beside it.
+          let streamedDecisions: { mode: string; gate: number; items: DecisionItem[] } | undefined;
+          if (decisionPromise && !canonical0.includes(refusalAnswer()) && !verdictBlock && !conditionBlock && !aggregationBlock) {
             const dp = await decisionPromise;
             if (dp) {
               canonical0 += dp.section;
               send({ type: "token", v: dp.section });
               full += dp.section;
+              streamedDecisions = { mode: dp.mode, gate: dp.gate, items: dp.items };
               console.log("decisions: streamed the checklist section (" + dp.items.length + " items, mode " + dp.mode + ")");
             }
+            telemetryDecisions(env, ctx, tier, queryHash, streamedDecisions ?? null, Date.now() - tStart);
           }
           if (!canonical0.includes(refusalAnswer())) {
             try {
@@ -1747,7 +1753,7 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
               if (streamedCompletionBlocks.length) console.log("streamed completion:", streamedCompletionBlocks.length, "block(s) attached");
             } catch { /* additive — the answer stands without the blocks */ }
           }
-          send({ type: "done", model, query_hash: queryHash, follow_ups: refusalShaped(canonical0, refusalScope(answerCites(full))) ? [] : (understanding?.follow_ups ?? []), blocks: [...c2.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...streamedCompletionBlocks], context_applied: ctxApplied, read: readAs(),
+          send({ type: "done", model, query_hash: queryHash, follow_ups: refusalShaped(canonical0, refusalScope(answerCites(full))) ? [] : (understanding?.follow_ups ?? []), ...(streamedDecisions ? { decisions: streamedDecisions } : {}), blocks: [...c2.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...streamedCompletionBlocks], context_applied: ctxApplied, read: readAs(),
             // the evidence view's ground truth: the exact passages this
             // answer was built from, compact — cache hits carry none,
             // because the cache stores the answer and never the passages
@@ -2083,10 +2089,11 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
   let decisionsOut: { mode: string; gate: number; items: DecisionItem[] } | undefined;
   if (decisionPromise) {
     const dp = await decisionPromise;
-    if (dp && answer && !answer!.includes(refusalAnswer())) {
+    if (dp && answer && !answer!.includes(refusalAnswer()) && !verdictBlock && !conditionBlock && !aggregationBlock) {
       answer = answer! + dp.section;
       decisionsOut = { mode: dp.mode, gate: dp.gate, items: dp.items };
     }
+    telemetryDecisions(env, ctx, tier, queryHash, decisionsOut ?? null, Date.now() - tStart);
   }
   const out = { answer, citations: finalCites, ...(jsonQuality ? { source_quality: jsonQuality!, confidence_note: entailmentNote || qualityNote(jsonQuality!), ...(entailment ? { entailment } : {}), ...(jsonQuality === "ocr" ? { experimental_sources: experimentalSourceLabels(finalCites) } : {}) } : {}), model: MODELS.member, query_hash: queryHash, follow_ups: refusalShaped(answer!, refusalScope(answerCites(answer!))) ? [] : (understanding?.follow_ups ?? []), blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...(registerBlock ? [registerBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}), ...(decisionsOut ? { decisions: decisionsOut } : {}), ...(ablate ? { ablate } : {}), route: { route: routed.route, features: routed.features } };
   const cacheable = !contextual && !declaredCtx && !ablate && cacheableAnswer(answer!, refusalScope(answerCites(answer!))) && finalAnchors.violations.length === 0;

package/workers/worker_public/src/config.ts

@@ -7,6 +7,13 @@ export const MODELS = {
   // Vision image-parts land with answer contract v2; text answers work now.
   anon: "@cf/zai-org/glm-5.3-flash",
   member: "@cf/zai-org/glm-5.3-flash",
+  // figure captions + the vision lane (one-time, quality-first; the A/B
+  // lever is CAPTION_MODEL, the per-request arm is the admin route's
+  // body.model)
+  caption: "@cf/zai-org/glm-5.3-flash",
+  // the pairwise vision judge (sees the image; a THIRD model never
+  // judges its own arm)
+  visionJudge: "@cf/deepseek-ai/deepseek-v4.1-flash-1017",
   // the VLM figure rerank (TODO.sota/18.3): the newly-landed
   // vision-capable MoE scores figure IMAGES against figure-seeking
   // questions — one bounded call per figure question, ablatable stage

package/workers/worker_public/src/decisionWire.ts

@@ -4,6 +4,7 @@
 // when DECISIONS_ENABLED, not ablated, not a refusal, no verdict block
 // bound, and the gate's noul clears decisionsGateMin.
 import { portModelRunner } from "./env.ts";
+import { telemetry } from "./quota";
 import { MODELS, THRESHOLDS } from "./config.ts";
 import {
   buildDecisionQuestions, matchAnswers, parseDerivation,
@@ -91,7 +92,11 @@ export async function runDecisionPass(
             `Each requirement's clause = the clause anchor it comes from. If nothing qualifies, return {"mode":"list","requirements":[]}.`,
         },
       ],
-      maxTokens: 1536,
+      maxTokens: 3072,
+      // the GLM law: the effort defaults to MAX when absent — an omitted
+      // effort starved the derivation to empty (observed live: the pass
+      // stood down silently on every fired question)
+      effort: "low",
       temperature: 0,
     });
     const { mode, requirements } = parseDerivation(derived.text, THRESHOLDS.decisionsRequirementsMax);
@@ -122,3 +127,27 @@ export async function runDecisionPass(
     return null; // additive — the essay answer ships
   }
 }
+
+/** The decisions telemetry (TODO.decisions/03): the nightly's
+ *  calibration signal, riding the queries table's route key with a
+ *  defined encoding — no schema migration.
+ *  - one PASS row, route "ask-decisions": ok = fired, lang = mode,
+ *    model = the gate probability (2dp), duration_ms = the pass's.
+ *  - one ITEM row per requirement, route "ask-decision": ok = band is
+ *    "met", lang = band, model = the probability (2dp); query_hash
+ *    joins the rows to their pass. */
+export function telemetryDecisions(
+  env: Env,
+  ctx: { waitUntil(p: Promise<unknown>): void },
+  tier: string,
+  queryHash: string,
+  result: { mode: string; gate: number; items: DecisionItem[] } | null,
+  durationMs: number,
+): void {
+  try {
+    telemetry(env, ctx, tier, "ask-decisions", result ? result.gate.toFixed(2) : "0", !!result, result?.items.length ?? 0, queryHash, result?.mode ?? undefined, undefined, { durationMs });
+    for (const it of result?.items ?? []) {
+      telemetry(env, ctx, tier, "ask-decision", it.probability.toFixed(2), it.band === "met", 1, queryHash, it.band, undefined, {});
+    }
+  } catch { /* telemetry never answers for the answer */ }
+}

package/workers/worker_public/src/index.ts

@@ -23,7 +23,7 @@ import { json, err, corsHeaders, withCors, readJson, authenticate, type ApiKey }
 import { creditBudget, clientIp } from "./quota";
 
 import { handleSearch } from "./search";
-import { handleEnrich, handleSectionUnit, handleCaption, handleVectors, handleJudge, handleCreateKey, handleListKeys, handleRevokeKey, handleKeyUsage, handleFamilySummary } from "./admin";
+import { handleEnrich, handleSectionUnit, handleCaption, handleVisionJudge, handleVectors, handleJudge, handleCreateKey, handleListKeys, handleRevokeKey, handleKeyUsage, handleFamilySummary } from "./admin";
 import { handleResearch } from "./research";
 import { uploadAttachment, readAttachment, deleteAttachment, type AttachmentDeps } from "./attachments";
 import { cfBlobs } from "./ports/cloudflare/adapters";
@@ -639,6 +639,7 @@ const OPENAPI_HANDLERS: Record<OpenApiOperationId, RouteHandler> = {
   adminSectionAlias: (c) => handleSectionUnit(c.env, c.ctx, c.req),
   adminVectors: (c) => handleVectors(c.env, c.req),
   adminCaption: (c) => handleCaption(c.env, c.req),
+  adminVisionJudge: (c) => handleVisionJudge(c.env, c.req),
   adminJudge: (c) => handleJudge(c.env, c.req),
   adminJudgeAlias: (c) => handleJudge(c.env, c.req),
 };

package/workers/worker_public/src/openapi-surface.gen.ts

@@ -53,6 +53,7 @@ export type OpenApiOperationId =
   | "adminFamilySummaryAlias"
   | "adminVectors"
   | "adminCaption"
+  | "adminVisionJudge"
   | "adminJudge"
   | "adminJudgeAlias"
   | "adminRevokeKey"
@@ -296,6 +297,11 @@ export const OPENAPI_SURFACE: readonly (Omit<OpenApiRoute, "operationId"> & { op
     "pattern": "/admin/caption",
     "operationId": "adminCaption"
   },
+  {
+    "method": "POST",
+    "pattern": "/admin/vision_judge",
+    "operationId": "adminVisionJudge"
+  },
   {
     "method": "POST",
     "pattern": "/v1/admin/judge",

package/dist/ask-BKWQEMSY.js

@@ -1,16 +0,0 @@
-import {
-  handleAsk
-} from "./chunk-PO3UBDNZ.js";
-import "./chunk-ECOYO7EX.js";
-import "./chunk-QS6V53RO.js";
-import "./chunk-RZLEHCIA.js";
-import "./chunk-XWSZWFYP.js";
-import "./chunk-O2XMNKCK.js";
-import "./chunk-ETLSWSZ7.js";
-import "./chunk-PQDAL4MX.js";
-import "./chunk-5UIMQAJZ.js";
-import "./chunk-3FYJM7LH.js";
-import "./chunk-KINFFYQH.js";
-export {
-  handleAsk
-};

package/dist/search-RNCRT5BR.js

@@ -1,14 +0,0 @@
-import {
-  handleSearch
-} from "./chunk-6KEWBP7O.js";
-import "./chunk-RZLEHCIA.js";
-import "./chunk-XWSZWFYP.js";
-import "./chunk-O2XMNKCK.js";
-import "./chunk-ETLSWSZ7.js";
-import "./chunk-PQDAL4MX.js";
-import "./chunk-5UIMQAJZ.js";
-import "./chunk-3FYJM7LH.js";
-import "./chunk-KINFFYQH.js";
-export {
-  handleSearch
-};