@remnic/core 9.3.719 → 9.3.721

package/src/access-service.ts

@@ -243,6 +243,7 @@ import {
   type ActionConfidenceResult,
 } from "./action-confidence.js";
 import { formatProfileTraceAscii } from "./profiling.js";
+import { resolveAccessSetupCapabilities, resolveGraphConstructionCapabilities } from "./capabilities.js";
 
 export class EngramAccessInputError extends Error {}
 
@@ -1299,14 +1300,15 @@ export class EngramAccessService {
 
   constructor(private readonly orchestrator: Orchestrator) {
     this.idempotency = new AccessIdempotencyStore(orchestrator.config.memoryDir);
+    const accessCaps = resolveAccessSetupCapabilities(orchestrator.config); // #1566 Cluster B
     this.budget = new CrossNamespaceBudget({
-      enabled: orchestrator.config.recallCrossNamespaceBudgetEnabled,
+      enabled: accessCaps.recallCrossNamespaceBudget,
       windowMs: orchestrator.config.recallCrossNamespaceBudgetWindowMs,
       softLimit: orchestrator.config.recallCrossNamespaceBudgetSoftLimit,
       hardLimit: orchestrator.config.recallCrossNamespaceBudgetHardLimit,
     });
 
-    const auditEnabled = orchestrator.config.recallAuditAnomalyDetectionEnabled === true;
+    const auditEnabled = accessCaps.recallAuditAnomalyDetection;
     const auditLogEnabled = false; // Audit JSONL logging — off until wired to a directory
     if (auditEnabled || auditLogEnabled) {
       const auditConfig: AccessAuditConfig = {
@@ -7512,6 +7514,7 @@ export class EngramAccessService {
     );
     const storage = await this.orchestrator.getStorage(namespace);
     const cfg = this.orchestrator.config;
+    const graphCaps = resolveGraphConstructionCapabilities(cfg);
     // Canonicalize the storage root once — through `realpath` so that any
     // symlink in the namespace root path itself is resolved before we
     // compare children against it.  This is required because
@@ -7608,9 +7611,9 @@ export class EngramAccessService {
     return buildGraphSnapshot({
       memoryDir: namespaceRootReal,
       graphConfig: {
-        entityGraphEnabled: cfg.entityGraphEnabled === true,
-        timeGraphEnabled: cfg.timeGraphEnabled === true,
-        causalGraphEnabled: cfg.causalGraphEnabled === true,
+        entityGraph: graphCaps.entityGraph,
+        timeGraph: graphCaps.timeGraph,
+        causalGraph: graphCaps.causalGraph,
       },
       request: {
         limit: request.limit,

package/src/capabilities-cluster-b.test.ts

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import {
+  resolveAccessSetupCapabilities,
+  type AccessSetupCapabilitySet,
+} from "./capabilities.js";
+
+/**
+ * Parity tests for the access-setup capability set (issue #1566 Cluster B).
+ *
+ * Every access-setup capability field must project from its `<field>Enabled`
+ * config flag, and the default-off semantics for both flags must be preserved.
+ */
+
+const ACCESS_FIELD_TO_FLAG: Record<keyof AccessSetupCapabilitySet, string> = {
+  recallCrossNamespaceBudget: "recallCrossNamespaceBudgetEnabled",
+  recallAuditAnomalyDetection: "recallAuditAnomalyDetectionEnabled",
+};
+
+const ACCESS_FIELDS = Object.keys(ACCESS_FIELD_TO_FLAG) as Array<
+  keyof AccessSetupCapabilitySet
+>;
+
+test("resolveAccessSetupCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(ACCESS_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const accessCaps = resolveAccessSetupCapabilities(config);
+
+  for (const field of ACCESS_FIELDS) {
+    const flag = ACCESS_FIELD_TO_FLAG[field];
+    assert.equal(
+      accessCaps[field],
+      (config as unknown as Record<string, boolean>)[flag],
+      `accessCaps.${field} must equal config.${flag} (true variant)`,
+    );
+  }
+});
+
+test("resolveAccessSetupCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(ACCESS_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const accessCaps = resolveAccessSetupCapabilities(config);
+
+  for (const field of ACCESS_FIELDS) {
+    assert.equal(
+      accessCaps[field],
+      false,
+      `accessCaps.${field} must be false when its flag is false`,
+    );
+  }
+});
+
+test("resolveAccessSetupCapabilities preserves default-off semantics when flags are undefined", () => {
+  // parseConfig with no overrides exercises the documented defaults. Both
+  // access-setup flags default to false.
+  const config = parseConfig({});
+  const accessCaps = resolveAccessSetupCapabilities(config);
+
+  assert.equal(
+    accessCaps.recallCrossNamespaceBudget,
+    false,
+    "recallCrossNamespaceBudget must default to false",
+  );
+  assert.equal(
+    accessCaps.recallAuditAnomalyDetection,
+    false,
+    "recallAuditAnomalyDetection must default to false",
+  );
+});
+
+test("resolveAccessSetupCapabilities returns a frozen object", () => {
+  const accessCaps = resolveAccessSetupCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(accessCaps), true, "AccessSetupCapabilitySet must be frozen");
+});

package/src/capabilities.test.ts

@@ -2,7 +2,12 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import { parseConfig } from "./config.js";
-import { resolveCapabilities, type CapabilitySet } from "./capabilities.js";
+import {
+  resolveCapabilities,
+  resolveAccessSetupCapabilities,
+  type CapabilitySet,
+  type AccessSetupCapabilitySet,
+} from "./capabilities.js";
 
 /**
  * Characterization tests for the recall-operation CapabilitySet (issue #1523).
@@ -22,6 +27,7 @@ const FIELD_TO_FLAG: Record<keyof CapabilitySet, string> = {
   rerankCache: "rerankCacheEnabled",
   recallDirectAnswer: "recallDirectAnswerEnabled",
   recallMemoryWorthFilter: "recallMemoryWorthFilterEnabled",
+  recallTrustScore: "trustScoreEnabled",
   recallMmr: "recallMmrEnabled",
   recallReasoningTraceBoost: "recallReasoningTraceBoostEnabled",
   recallPlannerLlm: "recallPlannerLlmEnabled",
@@ -30,6 +36,10 @@ const FIELD_TO_FLAG: Record<keyof CapabilitySet, string> = {
   graphRecall: "graphRecallEnabled",
   graphAssistInFullMode: "graphAssistInFullModeEnabled",
   graphExpandedIntent: "graphExpandedIntentEnabled",
+  // Issue #1566 Cluster C: mixed-operation flags.
+  rerank: "rerankEnabled",
+  harmonicRetrieval: "harmonicRetrievalEnabled",
+  parallelRetrieval: "parallelRetrievalEnabled",
 };
 
 const FIELDS = Object.keys(FIELD_TO_FLAG) as Array<keyof CapabilitySet>;

package/src/capabilities.ts

@@ -38,6 +38,8 @@ export interface CapabilitySet {
   readonly recallDirectAnswer: boolean;
   /** `recallMemoryWorthFilterEnabled` — Memory-Worth score reweighting. */
   readonly recallMemoryWorthFilter: boolean;
+  /** `trustScoreEnabled` — unified TrustScore recall stage (issue #1577). */
+  readonly recallTrustScore: boolean;
   /** `recallMmrEnabled` — maximal-marginal-relevance diversification. */
   readonly recallMmr: boolean;
   /** `recallReasoningTraceBoostEnabled` — boost reasoning-trace memories. */
@@ -54,6 +56,13 @@ export interface CapabilitySet {
   readonly graphAssistInFullMode: boolean;
   /** `graphExpandedIntentEnabled` — promote broad-intent asks to graph mode. */
   readonly graphExpandedIntent: boolean;
+  // --- Issue #1566 Cluster C: mixed-operation flags (recall + summarizer/CLI/writes) ---
+  /** `rerankEnabled` — optional LLM reranking of recall candidates. */
+  readonly rerank: boolean;
+  /** `harmonicRetrievalEnabled` — abstraction-node harmonic retrieval tier. */
+  readonly harmonicRetrieval: boolean;
+  /** `parallelRetrievalEnabled` — three-agent parallel retrieval (DirectFact + Contextual + Temporal). */
+  readonly parallelRetrieval: boolean;
 }
 
 /**
@@ -72,6 +81,9 @@ export function resolveCapabilities(config: PluginConfig): CapabilitySet {
     rerankCache: config.rerankCacheEnabled,
     recallDirectAnswer: config.recallDirectAnswerEnabled,
     recallMemoryWorthFilter: config.recallMemoryWorthFilterEnabled,
+    // Issue #1577: TrustScore subsumes the Memory Worth multiplier when on;
+    // the orchestrator runs exactly one of the two (mutual exclusion, rule 39).
+    recallTrustScore: config.trustScoreEnabled === true,
     recallMmr: config.recallMmrEnabled,
     recallReasoningTraceBoost: config.recallReasoningTraceBoostEnabled,
     recallPlannerLlm: config.recallPlannerLlmEnabled,
@@ -82,6 +94,10 @@ export function resolveCapabilities(config: PluginConfig): CapabilitySet {
     // migrated call sites used (`!== false` = default-on, `=== true` = default-off).
     graphAssistInFullMode: config.graphAssistInFullModeEnabled !== false,
     graphExpandedIntent: config.graphExpandedIntentEnabled === true,
+    // Issue #1566 Cluster C: mixed-operation flags resolved once per recall op.
+    rerank: config.rerankEnabled,
+    harmonicRetrieval: config.harmonicRetrievalEnabled,
+    parallelRetrieval: config.parallelRetrievalEnabled,
   });
 }
 
@@ -145,3 +161,45 @@ export function resolveGraphConstructionCapabilities(
     graphWriteSessionAdjacency: config.graphWriteSessionAdjacencyEnabled !== false,
   });
 }
+
+// ---------------------------------------------------------------------------
+// Access-setup capability set (issue #1566 Cluster B).
+//
+// These two flags gate cross-namespace recall budgeting and anomaly-detection
+// auditing. Resolved once at access-service handler entry (and the operator
+// doctor check) rather than re-derived from raw config at each site.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of access-setup feature gates (issue #1566 Cluster B).
+ *
+ * Every field is `readonly boolean`. Composition (including the default-off
+ * semantics for the optional `recallAuditAnomalyDetectionEnabled`) lives ONLY
+ * in {@link resolveAccessSetupCapabilities}.
+ */
+export interface AccessSetupCapabilitySet {
+  /** `recallCrossNamespaceBudgetEnabled` — rolling cross-namespace recall budget. */
+  readonly recallCrossNamespaceBudget: boolean;
+  /** `recallAuditAnomalyDetectionEnabled` — access-audit anomaly detection (default-off). */
+  readonly recallAuditAnomalyDetection: boolean;
+}
+
+/**
+ * Resolve the {@link AccessSetupCapabilitySet} from parsed config.
+ *
+ * Call this ONCE at access-service handler entry and thread the result down.
+ */
+export type AccessSetupConfigProjection = Pick<
+  PluginConfig,
+  "recallCrossNamespaceBudgetEnabled" | "recallAuditAnomalyDetectionEnabled"
+>;
+
+export function resolveAccessSetupCapabilities(
+  config: AccessSetupConfigProjection,
+): AccessSetupCapabilitySet {
+  return Object.freeze({
+    recallCrossNamespaceBudget: config.recallCrossNamespaceBudgetEnabled,
+    // Optional/default-off flag: preserve `=== true` semantics.
+    recallAuditAnomalyDetection: config.recallAuditAnomalyDetectionEnabled === true,
+  });
+}

package/src/cli/research-status-commands.ts

@@ -18,6 +18,7 @@
  */
 
 import type { Orchestrator } from "../orchestrator.js";
+import { resolveCapabilities } from "../capabilities.js";
 import type { CliCommand } from "../cli.js";
 import type { UtilityTelemetryEvent } from "../utility-telemetry.js";
 import {
@@ -42,6 +43,9 @@ export function registerResearchStatusCommands(
   cmd: CliCommand,
   orchestrator: Orchestrator,
 ): void {
+  // Resolve recall-operation gates once (#1566 Cluster C — harmonicRetrieval is a
+  // mixed-op flag read here on the CLI-search path as well as in recall).
+  const caps = resolveCapabilities(orchestrator.config);
 cmd
   .command("objective-state-status")
   .description("Show objective-state store status, snapshot counts, and latest stored snapshot")
@@ -111,7 +115,7 @@ cmd
     const status = await runAbstractionNodeStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       abstractionNodeStoreDir: orchestrator.config.abstractionNodeStoreDir,
-      harmonicRetrievalEnabled: orchestrator.config.harmonicRetrievalEnabled,
+      harmonicRetrievalEnabled: caps.harmonicRetrieval,
       abstractionAnchorsEnabled: orchestrator.config.abstractionAnchorsEnabled,
     });
     console.log(JSON.stringify(status, null, 2));
@@ -125,7 +129,7 @@ cmd
     const status = await runCueAnchorStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       abstractionNodeStoreDir: orchestrator.config.abstractionNodeStoreDir,
-      harmonicRetrievalEnabled: orchestrator.config.harmonicRetrievalEnabled,
+      harmonicRetrievalEnabled: caps.harmonicRetrieval,
       abstractionAnchorsEnabled: orchestrator.config.abstractionAnchorsEnabled,
     });
     console.log(JSON.stringify(status, null, 2));
@@ -147,7 +151,7 @@ cmd
     const results = await runHarmonicSearchCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       abstractionNodeStoreDir: orchestrator.config.abstractionNodeStoreDir,
-      harmonicRetrievalEnabled: orchestrator.config.harmonicRetrievalEnabled,
+      harmonicRetrievalEnabled: caps.harmonicRetrieval,
       abstractionAnchorsEnabled: orchestrator.config.abstractionAnchorsEnabled,
       query,
       maxResults: Number.isFinite(maxResults) ? maxResults : 3,

package/src/cli.ts

@@ -125,6 +125,7 @@ import {
   validateEvalBenchmarkPack,
 } from "./evals.js";
 import { analyzeGraphHealth, type GraphHealthReport } from "./graph.js";
+import { resolveGraphConstructionCapabilities } from "./capabilities.js";
 import {
   getCausalTrajectoryStoreStatus,
   type CausalTrajectoryStoreStatus,
@@ -6360,11 +6361,12 @@ export function registerCli(
         .option("--repair-guidance", "Include non-destructive repair guidance")
         .action(async (...args: unknown[]) => {
           const options = (args[0] ?? {}) as Record<string, unknown>;
+          const graphCaps = resolveGraphConstructionCapabilities(orchestrator.config);
           const report = await runGraphHealthCliCommand({
             memoryDir: orchestrator.config.memoryDir,
-            entityGraphEnabled: orchestrator.config.entityGraphEnabled,
-            timeGraphEnabled: orchestrator.config.timeGraphEnabled,
-            causalGraphEnabled: orchestrator.config.causalGraphEnabled,
+            entityGraphEnabled: graphCaps.entityGraph,
+            timeGraphEnabled: graphCaps.timeGraph,
+            causalGraphEnabled: graphCaps.causalGraph,
             includeRepairGuidance: options.repairGuidance === true,
           });
           console.log(JSON.stringify(report, null, 2));
@@ -6415,12 +6417,15 @@ export function registerCli(
         .option("--json", "Emit machine-readable JSON only")
         .action(async (...args: unknown[]) => {
           const options = (args[0] ?? {}) as Record<string, unknown>;
+          const repairGraphCaps = resolveGraphConstructionCapabilities(orchestrator.config);
           const report = await runOperatorRepair({
             config: {
               memoryDir: orchestrator.config.memoryDir,
-              entityGraphEnabled: orchestrator.config.entityGraphEnabled,
-              timeGraphEnabled: orchestrator.config.timeGraphEnabled,
-              causalGraphEnabled: orchestrator.config.causalGraphEnabled,
+              entityGraphEnabled: repairGraphCaps.entityGraph,
+              timeGraphEnabled: repairGraphCaps.timeGraph,
+              causalGraphEnabled: repairGraphCaps.causalGraph,
+              multiGraphMemoryEnabled: repairGraphCaps.multiGraphMemory,
+              graphWriteSessionAdjacencyEnabled: repairGraphCaps.graphWriteSessionAdjacency,
             },
             apply: options.apply === true,
             dryRun: options.dryRun === true,

package/src/config.ts

@@ -28,6 +28,7 @@ import type {
   SlotBehaviorConfig,
   SlotMismatchMode,
   TriggerMode,
+  TrustWeights,
 } from "./types.js";
 import { log } from "./logger.js";
 import { cloneDefaultSessionObserverBands } from "./session-observer-bands.js";
@@ -48,6 +49,7 @@ import { parseWearablesConfig } from "./wearables/config.js";
 import { parseProvenanceConfig } from "./provenance.js";
 import { parseCodingKnowledgeConfig } from "./coding/coding-knowledge-config.js";
 import { parseChatConfig } from "./chat/chat-config.js";
+import { parseCorrectionIntentConfig, parseFaithfulnessGateConfig } from "./faithfulness-config.js";
 const DEFAULT_MEMORY_DIR = path.join(
   resolveHomeDir(),
   ".openclaw",
@@ -2336,6 +2338,27 @@ export function parseConfig(
       const n = coerceNumber(cfg.recallMemoryWorthHalfLifeMs);
       return n !== undefined && n >= 0 ? n : 0;
     })(),
+    // Unified TrustScore recall stage (issue #1577). Default off: the stage
+    // is absent and ranking is byte-identical to the pre-feature pipeline
+    // (rule 39). Flip the master gate via #1574 ablation evidence only.
+    trustScoreEnabled: coerceBool(cfg.trustScoreEnabled) ?? false,
+    // Epistemic rendering ships behind its own gate so scoring can land first.
+    trustScoreEpistemicRendering: coerceBool(cfg.trustScoreEpistemicRendering) ?? false,
+    // Quarantine defaults on (only effective under the master gate); keeps
+    // hard negatives out of injection but visible in X-ray (rule 34).
+    trustScoreQuarantine: coerceBool(cfg.trustScoreQuarantine) ?? true,
+    trustScoreMinMultiplier: (() => {
+      const n = coerceNumber(cfg.trustScoreMinMultiplier);
+      return n !== undefined && n >= 0 && n <= 1 ? n : 0.5;
+    })(),
+    trustScoreMaxMultiplier: (() => {
+      const n = coerceNumber(cfg.trustScoreMaxMultiplier);
+      return n !== undefined && n >= 1 && n <= 4 ? n : 1.25;
+    })(),
+    // Per-component weights. Accept a nested object from config; invalid
+    // entries (non-finite, outside [0,1]) are dropped by resolveTrustWeights,
+    // which falls back to the documented defaults (rule 51).
+    trustScoreWeights: parseTrustScoreWeights(cfg.trustScoreWeights),
     // Memory Linking (Phase 3A)
     memoryLinkingEnabled: cfg.memoryLinkingEnabled === true, // Off by default initially
     // Conversation Threading (Phase 3B)
@@ -2996,36 +3019,14 @@ export function parseConfig(
     collectJudgeTrainingPairs: coerceBool(cfg.collectJudgeTrainingPairs) === true,
     judgeTrainingDir:
       typeof cfg.judgeTrainingDir === "string" ? cfg.judgeTrainingDir : "",
-    // Extraction faithfulness gate (issue #1576). Entailment-verification of
-    // extracted facts against verified source spans (#1575). Default "off"
-    // (rule 39: byte-identical pre-feature pipeline). Invalid values are
-    // rejected listing valid options (rule 51).
-    extractionFaithfulnessGate: (() => {
-      const v = cfg.extractionFaithfulnessGate;
-      if (v === undefined || v === null) return "off";
-      // Present-but-invalid (true/1/{}) must reject, not silently disable the gate (Ob4RQ).
-      const raw = typeof v === "string" ? v.trim().toLowerCase() : v;
-      if (raw === "off" || raw === "shadow" || raw === "enforce") return raw;
-      throw new Error(
-        `extractionFaithfulnessGate must be one of "off" | "shadow" | "enforce" (got ${JSON.stringify(v)})`,
-      );
-    })(),
-    extractionFaithfulnessModel:
-      typeof cfg.extractionFaithfulnessModel === "string"
-        ? cfg.extractionFaithfulnessModel
-        : "",
-    // Issue #1634 (#1576 follow-up): strict-integer validation via
-    // parseIntegerAtLeast — reject non-numeric, <=0, non-integer, NaN,
-    // Infinity, booleans, objects (gotcha #51). Mirrors qmdDaemonTimeoutMs.
-    // Valid CLI-string integers still coerce and clamp to the budget cap.
-    extractionFaithfulnessContextChars: Math.min(
-      parseIntegerAtLeast(cfg.extractionFaithfulnessContextChars, 400, 1, "extractionFaithfulnessContextChars"),
-      4000,
-    ),
-    extractionFaithfulnessTimeoutMs: Math.min(
-      parseIntegerAtLeast(cfg.extractionFaithfulnessTimeoutMs, 8000, 1, "extractionFaithfulnessTimeoutMs"),
-      60_000,
-    ),
+    // Extraction faithfulness gate (issue #1576) + model-lab pointer
+    // `extractionFaithfulnessBaseUrl` (issue #1585), and the correction-intent
+    // model-lab pointer (issue #1581 / #1585). Parsed in faithfulness-config.ts
+    // (extracted from this god file so the block can grow without tripping the
+    // ratchet). Defaults preserve the byte-identical pre-feature pipeline
+    // (rule 39); invalid values reject (rule 51 / #1634).
+    ...parseFaithfulnessGateConfig(cfg),
+    ...parseCorrectionIntentConfig(cfg),
     // Inline source attribution (issue #369). Opt-in to preserve
     // backwards compatibility with existing downstream consumers.
     inlineSourceAttributionEnabled: cfg.inlineSourceAttributionEnabled === true,
@@ -4639,3 +4640,32 @@ function buildRecallPipelineConfig(cfg: Record<string, unknown>): RecallPipeline
 
   return { recallBudgetChars, pipeline };
 }
+
+/**
+ * Parse the `trustScoreWeights` config value into a {@link TrustWeights}
+ * object. Accepts a plain object of per-component numbers; non-finite or
+ * out-of-`[0,1]` entries are dropped (the scorer falls back to defaults via
+ * `resolveTrustWeights`). A non-object value yields `{}` → all defaults.
+ * Rule 51: invalid weight rejected, never silently clamped to an extreme.
+ */
+function parseTrustScoreWeights(value: unknown): TrustWeights {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const src = value as Record<string, unknown>;
+  const out: TrustWeights = {};
+  const keys: Array<keyof TrustWeights> = [
+    "memoryWorth",
+    "provenance",
+    "faithfulness",
+    "corroboration",
+    "contradiction",
+    "domainCalibration",
+    "feedback",
+    "recency",
+  ];
+  for (const key of keys) {
+    const raw = src[key as string];
+    if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 0 || raw > 1) continue;
+    (out as Record<string, number>)[key as string] = raw;
+  }
+  return out;
+}

package/src/extraction-faithfulness.test.ts

@@ -1254,3 +1254,178 @@ test("parseFaithfulnessResponse: object-wrapped arrays unwrap (results/verdicts/
   // A wrapper object with no recognized array key still returns null (no over-match).
   assert.equal(parseFaithfulnessResponse('{"data": {"nested": []}}', 1), null);
 });
+
+// ---------------------------------------------------------------------------
+// Issue #1585 model-lab pointer: local fine-tuned endpoint path
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a fake fetch that responds for a specific base URL with a canned
+ * openai-compatible chat-completions body. Records the request body so tests
+ * can assert the gate routed to the local model.
+ */
+function fakeFetchFor(
+  baseUrl: string,
+  responder: (body: Record<string, unknown>) => unknown,
+): { fetch: typeof fetch; requests: Array<{ url: string; body: Record<string, unknown> }> } {
+  const requests: Array<{ url: string; body: Record<string, unknown> }> = [];
+  const fake = ((url: string, init: RequestInit) => {
+    requests.push({ url, body: JSON.parse(String(init.body)) });
+    const body = JSON.parse(String(init.body));
+    const payload = responder(body);
+    return Promise.resolve(
+      new Response(JSON.stringify(payload), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+    );
+  }) as typeof fetch;
+  return { fetch: fake, requests };
+}
+
+test("checkFaithfulnessBatch: local model-lab endpoint is tried first when configured (#1585)", async () => {
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  const { fetch: fakeFetch, requests } = fakeFetchFor("http://localhost:11434/v1", (body) => ({
+    model: body.model,
+    choices: [{ message: { content: JSON.stringify([{ index: 0, verdict: "contradicted" }]) } }],
+  }));
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm("[]", fallbackCalls),
+    fakeFetch,
+  );
+  assert.equal(requests.length, 1, "local model-lab endpoint must be called");
+  assert.equal(requests[0]?.url, "http://localhost:11434/v1/chat/completions");
+  assert.equal(requests[0]?.body.model, "remnic-faithfulness-gate-v1");
+  assert.equal(fallbackCalls.length, 0, "gateway fallback must NOT run when the local endpoint succeeds");
+  assert.equal(result.results[0]?.ok, true);
+  if (result.results[0]?.ok) {
+    assert.equal(result.results[0].verdict, "contradicted", "local model verdict is used");
+    assert.equal(result.results[0].model, "remnic-faithfulness-gate-v1");
+  }
+});
+
+test("checkFaithfulnessBatch: local endpoint failure falls back to the configured chain (#1585 graceful)", async () => {
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  // Local endpoint returns 500 → caller returns null → gate falls through to fallback.
+  const failingFetch = (() =>
+    Promise.resolve(new Response("err", { status: 500 }))) as unknown as typeof fetch;
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }]), fallbackCalls),
+    failingFetch,
+  );
+  assert.equal(fallbackCalls.length, 1, "must fall back to the configured chain on local-endpoint failure");
+  assert.equal(result.results[0]?.ok, true);
+  if (result.results[0]?.ok) {
+    assert.equal(result.results[0].verdict, "entailed", "fallback chain verdict is used");
+  }
+});
+
+test("checkFaithfulnessBatch: a wedged local endpoint falls back to the chain BEFORE the batch timeout (codex P2 — probe budget)", async () => {
+  // The local probe must use a SMALLER budget than the outer batch timeout so a
+  // hanging endpoint returns null and the configured chain runs before the batch
+  // timer fires. extractionFaithfulnessTimeoutMs: 1000 → probe budget = 500ms.
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 1000,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  // A fetch that hangs forever on its own but HONORS the probe's AbortSignal —
+  // the probe's controller aborts it at 500ms (half the batch budget), the call
+  // returns null, and the gate falls through to the configured chain.
+  const wedgedFetch = ((_url: string, init: RequestInit) =>
+    new Promise<Response>((_resolve, reject) => {
+      const sig = init.signal;
+      if (!sig) return;
+      if (sig.aborted) reject(new Error("aborted"));
+      else sig.addEventListener("abort", () => reject(new Error("aborted")), { once: true });
+    })) as unknown as typeof fetch;
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }]), fallbackCalls),
+    wedgedFetch,
+  );
+  assert.equal(
+    fallbackCalls.length,
+    1,
+    "a wedged local probe must reach the configured chain before the batch budget elapses",
+  );
+  assert.equal(result.results[0]?.ok, true);
+  if (result.results[0]?.ok) {
+    assert.equal(result.results[0].verdict, "entailed", "fallback chain verdict is used");
+  }
+});
+
+test("checkFaithfulnessBatch: no local endpoint pointer → byte-identical routing (regression guard)", async () => {
+  // Default config (no baseUrl) must never attempt a local-endpoint fetch.
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = baseConfig();
+  let fetchCalled = false;
+  const spyFetch = (() => {
+    fetchCalled = true;
+    return Promise.resolve(new Response("{}", { status: 200 }));
+  }) as unknown as typeof fetch;
+  await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }])),
+    spyFetch,
+  );
+  assert.equal(fetchCalled, false, "no local-endpoint fetch when pointer is unset");
+});
+
+
+test("checkFaithfulnessBatch: local-endpoint failure does NOT leak the local model name into the fallback chain (codex P2 PRRT_kwDORJXyws6Otp-L)", async () => {
+  // extractionFaithfulnessModel is the LOCAL served model's name. When the
+  // local endpoint is configured but fails, that name must NOT be forwarded to
+  // the gateway/fallback as options.model — otherwise the configured chain is
+  // forced onto an unavailable local-only model and a local outage becomes
+  // backend_unavailable instead of graceful fallback to the configured chain.
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  // Local endpoint returns 500 -> caller returns null -> gate falls through.
+  const failingFetch = (() =>
+    Promise.resolve(new Response("err", { status: 500 }))) as unknown as typeof fetch;
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }]), fallbackCalls),
+    failingFetch,
+  );
+  assert.equal(fallbackCalls.length, 1, "fallback chain must run on local-endpoint failure");
+  const opts = fallbackCalls[0]?.options as Record<string, unknown>;
+  assert.equal(
+    opts?.model,
+    undefined,
+    "local-only model name must NOT leak into the fallback chain on endpoint failure",
+  );
+  assert.equal(result.results[0]?.ok, true);
+});