@remnic/core 9.3.719 → 9.3.721

package/dist/{chunk-DGTDRIUO.js → chunk-4T3BMHKD.js}

@@ -1,6 +1,6 @@
 import {
   getVerdictKind
-} from "./chunk-TH7WMHVK.js";
+} from "./chunk-3NN73CM7.js";
 import {
   scoreImportance
 } from "./chunk-JXS5PDQ7.js";
@@ -1161,4 +1161,4 @@ export {
   syncWearableSource,
   defaultTimezone
 };
-//# sourceMappingURL=chunk-DGTDRIUO.js.map
+//# sourceMappingURL=chunk-4T3BMHKD.js.map

package/dist/{chunk-EH27LHML.js → chunk-5O42UKXI.js}

@@ -4,7 +4,7 @@ import {
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-YYOK4GVF.js";
+} from "./chunk-EVPNWN7Z.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
@@ -679,4 +679,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-EH27LHML.js.map
+//# sourceMappingURL=chunk-5O42UKXI.js.map

package/dist/{chunk-KRGC4EDX.js → chunk-6FAMMBQ3.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-SFQ6QNL7.js";
 import {
   StorageManager
-} from "./chunk-YYOK4GVF.js";
+} from "./chunk-EVPNWN7Z.js";
 import {
   buildLifecycleEventsForMemory,
   sortMemoryLifecycleEvents
@@ -74,4 +74,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-KRGC4EDX.js.map
+//# sourceMappingURL=chunk-6FAMMBQ3.js.map

package/dist/{chunk-FEB7W5JG.js → chunk-6OIDDKAA.js}

@@ -1,6 +1,10 @@
+import {
+  callOpenAiCompatibleChat,
+  resolveFaithfulnessGateEndpoint
+} from "./chunk-XGTBNVIU.js";
 import {
   gatewayTaskChainOptions
-} from "./chunk-5J4OL7TJ.js";
+} from "./chunk-VUA4S7P6.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
@@ -101,12 +105,28 @@ function parseEntries(data, expectedCount) {
   }
   return map.size > 0 ? map : null;
 }
-async function callFaithfulnessLlm(systemPrompt, userPrompt, config, localLlm, fallbackLlm, timeoutMs, signal) {
+async function callFaithfulnessLlm(systemPrompt, userPrompt, config, localLlm, fallbackLlm, timeoutMs, signal, fetchImpl = fetch) {
   const messages = [
     { role: "system", content: systemPrompt },
     { role: "user", content: userPrompt }
   ];
-  const modelOverride = config.extractionFaithfulnessModel || void 0;
+  const localEndpoint = resolveFaithfulnessGateEndpoint(config);
+  if (localEndpoint) {
+    const probeBudgetMs = Math.max(500, Math.floor(timeoutMs / 2));
+    const result = await callOpenAiCompatibleChat(
+      localEndpoint,
+      messages,
+      { temperature: 0.1, maxTokens: 2048, responseFormatJson: true, timeoutMs: probeBudgetMs },
+      fetchImpl
+    );
+    if (result?.content) {
+      return { content: result.content, modelUsed: result.modelUsed };
+    }
+    log.debug(
+      "extraction-faithfulness: local model-lab endpoint unavailable, trying configured chain"
+    );
+  }
+  const modelOverride = localEndpoint ? void 0 : config.extractionFaithfulnessModel || void 0;
   const skipLocal = config.modelSource === "gateway" || Boolean(modelOverride);
   const gatewayChain = gatewayTaskChainOptions(config);
   let modelUsed = null;
@@ -158,7 +178,7 @@ async function callLocalLlm(client, messages, options) {
     content: result?.content ?? null
   };
 }
-async function checkFaithfulnessBatch(inputs, config, localLlm, fallbackLlm) {
+async function checkFaithfulnessBatch(inputs, config, localLlm, fallbackLlm, fetchImpl) {
   const timeoutMs = typeof config.extractionFaithfulnessTimeoutMs === "number" && Number.isFinite(config.extractionFaithfulnessTimeoutMs) && config.extractionFaithfulnessTimeoutMs > 0 ? config.extractionFaithfulnessTimeoutMs : 8e3;
   const contextChars = typeof config.extractionFaithfulnessContextChars === "number" && Number.isFinite(config.extractionFaithfulnessContextChars) && config.extractionFaithfulnessContextChars > 0 ? config.extractionFaithfulnessContextChars : 400;
   const results = new Array(inputs.length);
@@ -199,7 +219,8 @@ async function checkFaithfulnessBatch(inputs, config, localLlm, fallbackLlm) {
       localLlm,
       fallbackLlm,
       timeoutMs,
-      controller.signal
+      controller.signal,
+      fetchImpl
     );
     const settled = await Promise.race([
       callPromise.then(
@@ -638,4 +659,4 @@ export {
   serializeFaithfulnessFields,
   parseFaithfulnessField
 };
-//# sourceMappingURL=chunk-FEB7W5JG.js.map
+//# sourceMappingURL=chunk-6OIDDKAA.js.map

package/dist/chunk-6OIDDKAA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/extraction-faithfulness.ts"],"sourcesContent":["/**\n * Extraction faithfulness gate — entailment verification of extracted\n * facts against their verified source spans (issue #1576).\n *\n * Part of #1572 (glass-box memory). Depends on #1575 (provenance spans).\n * Improved later by #1585 (fine-tuned local gate model).\n *\n * Unlike the extraction-judge (#376), which gates on fact-worthiness\n * (\"is this worth remembering?\"), this module gates on faithfulness\n * (\"is this fact actually supported by what was said?\"). Hallucinated\n * or mis-paraphrased extractions become durable memories, get recalled\n * with confidence, and poison downstream answers — the highest-severity\n * accuracy failure a memory system can have.\n *\n * Design constraints:\n *   - Tagged results only — a backend failure is distinguishable from a\n *     genuine verdict (rule 34 / checklist §22: never conflate \"empty\"\n *     with \"failed\").\n *   - The gate consumes the QUOTE, not the whole conversation — passing\n *     full turns re-introduces the hallucination surface you're guarding\n *     and blows the latency budget.\n *   - No module-level state — batch queues hang off the orchestrator\n *     instance (rule 11).\n *   - Byte-identical pre-feature pipeline when mode is \"off\" (rule 39).\n *   - Graceful degradation — a backend failure never blocks writes\n *     (checklist §4); the fact proceeds with verdict \"unchecked\".\n *   - Never mutate mw_*\\/trust fields — faithfulness is its own\n *     frontmatter island consumed by #1577.\n */\n\nimport { createHash } from \"node:crypto\";\n\nimport { log } from \"./logger.js\";\nimport type { PluginConfig, MemoryFrontmatter, FaithfulnessFrontmatter } from \"./types.js\";\nimport type { LocalLlmClient } from \"./local-llm.js\";\nimport { type FallbackLlmClient, gatewayTaskChainOptions } from \"./fallback-llm.js\";\nimport {\n  callOpenAiCompatibleChat,\n  resolveFaithfulnessGateEndpoint,\n} from \"./local-model-endpoint.js\";\nimport { extractJsonCandidates } from \"./json-extract.js\";\n\n// Re-export for callers importing from this module.\nexport type { FaithfulnessFrontmatter } from \"./types.js\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * The three entailment verdicts. \"unchecked\" is NOT a member of this union —\n * it lives only in the frontmatter to mark facts that bypassed the gate\n * (backend failure, no span, mode=off). A real verdict is always one of\n * these three.\n */\nexport type FaithfulnessVerdict = \"entailed\" | \"contradicted\" | \"unsupported\";\n\n/**\n * Failure codes for tagged-error results. Each is distinguishable so callers\n * and telemetry can tell \"no span available\" from \"the backend was down\".\n */\nexport type FaithfulnessFailureCode =\n  | \"no_span\"\n  | \"backend_unavailable\"\n  | \"malformed_output\"\n  | \"timeout\";\n\n/**\n * Tagged result — success carries the verdict + model + optional rationale;\n * failure carries only the error code. Never conflate the two (rule 34).\n */\nexport type FaithfulnessResult =\n  | { ok: true; verdict: FaithfulnessVerdict; model: string; rationale?: string }\n  | { ok: false; error: { code: FaithfulnessFailureCode } };\n\n/**\n * Input for a single faithfulness check. The quote is the verified span from\n * #1575; context is optional surrounding turn text (bounded by\n * faithfulnessContextChars).\n */\nexport interface FaithfulnessCheckInput {\n  factText: string;\n  quote: string;\n  context?: string;\n}\n\n/**\n * Shape persisted to frontmatter (issue #1576). Serialized as a single JSON\n * line so it round-trips through the existing YAML parser without special\n * handling.\n *\n * `verdict: \"unchecked\"` marks a fact that entered the gate but could not be\n * evaluated (backend failure, timeout). It is distinct from the field being\n * absent (which means the gate was off entirely or the fact predates #1576).\n */\n\n// ---------------------------------------------------------------------------\n// Sealed prompt (hash lets #1573-style caching key on it)\n// ---------------------------------------------------------------------------\n\nconst FAITHFULNESS_SYSTEM_PROMPT = `You are a faithfulness verifier for a memory system. Given a QUOTE from the source conversation and an extracted FACT, determine whether the FACT is supported by the QUOTE.\n\nRules:\n- \"entailed\" — the FACT directly follows from the QUOTE (paraphrase is OK).\n- \"contradicted\" — the FACT asserts something the QUOTE directly negates.\n- \"unsupported\" — the FACT introduces information not present in the QUOTE.\n\nAnswer with a JSON array. Each element: {\"index\": <int>, \"verdict\": \"entailed\"|\"contradicted\"|\"unsupported\", \"rationale\": \"<one sentence>\"}.\n\nExamples:\nQUOTE: \"I've been using Vim for about ten years now.\"\nFACT: \"The user has used Vim for approximately a decade.\"\n{\"index\": 0, \"verdict\": \"entailed\", \"rationale\": \"Paraphrase of the same duration.\"}\n\nQUOTE: \"I've been using Vim for about ten years now.\"\nFACT: \"The user prefers Emacs.\"\n{\"index\": 0, \"verdict\": \"unsupported\", \"rationale\": \"QUOTE mentions Vim, not Emacs.\"}\n\nQUOTE: \"I stopped drinking coffee last month.\"\nFACT: \"The user drinks coffee regularly.\"\n{\"index\": 0, \"verdict\": \"contradicted\", \"rationale\": \"QUOTE says they stopped; FACT claims the opposite.\"}`;\n\n/**\n * SHA-256 hash of the sealed system prompt. Cache keys and prompt-version\n * telemetry include this so a prompt change is detectable (#1573-style\n * caching can invalidate stale entries).\n */\nexport const FAITHFULNESS_PROMPT_HASH = createHash(\"sha256\")\n  .update(FAITHFULNESS_SYSTEM_PROMPT)\n  .digest(\"hex\");\n\n// ---------------------------------------------------------------------------\n// Prompt construction\n// ---------------------------------------------------------------------------\n\n/**\n * Build the user-prompt payload for a batch of (fact, quote) pairs.\n * Each pair is numbered so the LLM's response can be correlated back.\n *\n * Context (when provided) is included after the quote, clearly delimited,\n * so the model knows it is supplementary — not the primary evidence.\n */\nfunction buildBatchPrompt(inputs: FaithfulnessCheckInput[], contextChars: number): string {\n  const parts: string[] = [];\n  for (let i = 0; i < inputs.length; i++) {\n    const inp = inputs[i];\n    if (!inp) continue;\n    // The QUOTE is the primary entailment evidence and is already bounded\n    // upstream (provenance.maxQuoteChars / locateFactQuote). Send it whole\n    // so the verifier never judges entailment on a truncated span. Only the\n    // supplementary CONTEXT is bounded by contextChars (the config's \"window\n    // around the quote\" semantics — cursor review).\n    parts.push(`--- Item ${i} ---\nQUOTE: \"${inp.quote}\"`);\n    if (inp.context && inp.context.trim().length > 0) {\n      parts.push(`CONTEXT: \"${inp.context.slice(0, contextChars)}\"`);\n    }\n    parts.push(`FACT: \"${inp.factText}\"\n\nRespond with the JSON array entry for index ${i}.`);\n  }\n  parts.push(`\\nRespond now with a single JSON array covering indexes 0–${inputs.length - 1}.`);\n  return parts.join(\"\\n\");\n}\n\n// ---------------------------------------------------------------------------\n// Response parsing\n// ---------------------------------------------------------------------------\n\nconst VALID_VERDICTS = new Set<string>([\"entailed\", \"contradicted\", \"unsupported\"]);\n\n/**\n * Parsed LLM response entry — validated shape.\n */\ninterface ParsedFaithfulnessEntry {\n  index: number;\n  verdict: FaithfulnessVerdict;\n  rationale?: string;\n}\n\n/**\n * Parse the LLM response into a map of index → entry. Returns null when the\n * response is unparseable (rules 13/18: malformed output → tagged error,\n * never a crash).\n *\n * Accepts both a bare JSON array and a JSON array embedded in surrounding\n * text (the `extractJsonCandidates` helper handles fenced blocks and\n * code-block-wrapped JSON).\n */\nexport function parseFaithfulnessResponse(\n  raw: string,\n  expectedCount: number,\n): Map<number, ParsedFaithfulnessEntry> | null {\n  if (!raw || typeof raw !== \"string\" || raw.trim().length === 0) {\n    return null;\n  }\n\n  const candidates = extractJsonCandidates(raw);\n  for (const candidate of candidates) {\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(candidate);\n    } catch {\n      continue;\n    }\n    const map = parseEntries(parsed, expectedCount);\n    if (map) return map;\n  }\n\n  // Last resort: the model may have returned bare objects without array\n  // wrapping — try parsing the whole thing as a single entry.\n  try {\n    const single = JSON.parse(raw.trim());\n    const map = parseEntries([single], expectedCount);\n    if (map) return map;\n  } catch {\n    // fall through\n  }\n\n  return null;\n}\n\nfunction parseEntries(\n  data: unknown,\n  expectedCount: number,\n): Map<number, ParsedFaithfulnessEntry> | null {\n  if (!Array.isArray(data)) {\n    // Accept object-wrapped arrays — {\"results\":[...]}, {\"verdicts\":[...]},\n    // {\"entries\":[...]}, {\"facts\":[...]} — a common JSON-object prompt shape the\n    // extraction-judge parser already accepts. Rejecting them marked the whole\n    // batch malformed_output; in enforce mode those facts then wrote as ACTIVE\n    // (gate bypass — codex Ob4RO).\n    if (data && typeof data === \"object\") {\n      for (const key of [\"results\", \"verdicts\", \"entries\", \"facts\"]) {\n        const inner = (data as Record<string, unknown>)[key];\n        if (Array.isArray(inner)) return parseEntries(inner, expectedCount);\n      }\n    }\n    return null;\n  }\n  const map = new Map<number, ParsedFaithfulnessEntry>();\n  for (const entry of data) {\n    if (!entry || typeof entry !== \"object\") continue;\n    const obj = entry as Record<string, unknown>;\n    const idx = typeof obj.index === \"number\" ? obj.index : undefined;\n    if (idx === undefined || idx < 0 || idx >= expectedCount) continue;\n    const verdictRaw = typeof obj.verdict === \"string\" ? obj.verdict : undefined;\n    if (!verdictRaw || !VALID_VERDICTS.has(verdictRaw)) continue;\n    const rationale =\n      typeof obj.rationale === \"string\" && obj.rationale.trim().length > 0\n        ? obj.rationale.trim().slice(0, 500)\n        : undefined;\n    map.set(idx, {\n      index: idx,\n      verdict: verdictRaw as FaithfulnessVerdict,\n      rationale,\n    });\n  }\n  return map.size > 0 ? map : null;\n}\n\n// ---------------------------------------------------------------------------\n// LLM call helper\n// ---------------------------------------------------------------------------\n\ninterface LlmCallResult {\n  content: string | null;\n  modelUsed: string | null;\n}\n\n/**\n * Call the model routing chain (local → fallback) with the faithfulness\n * classification prompt. Mirrors `callJudgeLlm` in extraction-judge.ts so\n * the same routing, model-override, and gateway-chain logic applies.\n *\n * Returns the raw content string and the model that produced it, or\n * `{ content: null, modelUsed: null }` when every backend is unavailable.\n */\nasync function callFaithfulnessLlm(\n  systemPrompt: string,\n  userPrompt: string,\n  config: PluginConfig,\n  localLlm: LocalLlmClient | null,\n  fallbackLlm: FallbackLlmClient | null,\n  timeoutMs: number,\n  signal?: AbortSignal,\n  fetchImpl: typeof fetch = fetch,\n): Promise<LlmCallResult> {\n  const messages: Array<{ role: \"system\" | \"user\"; content: string }> = [\n    { role: \"system\", content: systemPrompt },\n    { role: \"user\", content: userPrompt },\n  ];\n\n  // Issue #1585 model-lab pointer: when an explicit local fine-tuned endpoint\n  // is configured (base URL + model name), try it FIRST — it is the cheapest,\n  // deterministic path the operator opted into by setting\n  // extractionFaithfulnessBaseUrl. Unset (the default) skips this entirely,\n  // preserving byte-identical pre-feature routing (rule 39). Any failure\n  // (network, non-2xx, malformed body, timeout) returns null and falls through\n  // to the configured chain (checklist §4 graceful degradation).\n  const localEndpoint = resolveFaithfulnessGateEndpoint(config);\n  if (localEndpoint) {\n    // Give the local probe a SMALLER budget than the outer batch timeout so a\n    // wedged local model returns null (and falls through to the configured\n    // chain) before the batch timer fires. The local endpoint is meant to be\n    // the fast path; if it cannot answer within half the budget (min 500ms),\n    // abandon it and let the fallback chain use the remainder (codex P2 — the\n    // advertised graceful fallback must actually reach the chain, not be starved\n    // by a hanging probe sharing the full batch budget).\n    const probeBudgetMs = Math.max(500, Math.floor(timeoutMs / 2));\n    const result = await callOpenAiCompatibleChat(\n      localEndpoint,\n      messages,\n      { temperature: 0.1, maxTokens: 2048, responseFormatJson: true, timeoutMs: probeBudgetMs },\n      fetchImpl,\n    );\n    if (result?.content) {\n      return { content: result.content, modelUsed: result.modelUsed };\n    }\n    log.debug(\n      \"extraction-faithfulness: local model-lab endpoint unavailable, trying configured chain\",\n    );\n  }\n\n  // extractionFaithfulnessModel is the LOCAL served model's name (e.g.\n  // remnic-faithfulness-gate-v1). When a local endpoint is configured it\n  // belongs to that endpoint ONLY — it must NOT leak into the fallback chain\n  // as a gateway/local-LLM override, or a local outage forces the configured\n  // chain onto an unavailable local-only model and turns graceful fallback\n  // into backend_unavailable (codex P2 PRRT_kwDORJXyws6Otp-L). Decouple: the\n  // override reaches the fallback chain only when NO local endpoint is\n  // configured (the pre-feature model-override contract, preserved\n  // byte-identical — rule 39).\n  const modelOverride = localEndpoint ? undefined : (config.extractionFaithfulnessModel || undefined);\n\n  // Skip the local backend when (a) modelSource is \"gateway\", or (b) a\n  // faithfulness model override is set. The local client always sends\n  // config.localLlmModel and silently ignores options.model, so a local\n  // success would run the wrong model and prevent the override from ever\n  // reaching the gateway. Routing straight to the gateway honors the\n  // override (codex review PRRT_kwDORJXyws6ObYQ8).\n  const skipLocal = config.modelSource === \"gateway\" || Boolean(modelOverride);\n  const gatewayChain = gatewayTaskChainOptions(config);\n\n  let modelUsed: string | null = null;\n\n  // Try local LLM first (only when no override routes the call to gateway).\n  // The local client uses its OWN per-attempt AbortController keyed on\n  // `timeoutMs` (it does not read options.signal — see LocalLlmChatCompletionOptions),\n  // so the batch `signal` is not forwarded here; `timeoutMs` bounds each local\n  // attempt instead. The batch AbortController still governs the fallback path,\n  // which DOES honor the signal. (Matches extraction-judge.ts, which also passes\n  // no signal to the local client.)\n  if (localLlm && !skipLocal) {\n    try {\n      const result = await callLocalLlm(localLlm, messages, {\n        temperature: 0.1,\n        maxTokens: 2048,\n        responseFormat: { type: \"json_object\" },\n        timeoutMs,\n        operation: \"extraction-faithfulness\",\n      });\n      if (result.content) {\n        return { content: result.content, modelUsed: result.modelUsed ?? \"local\" };\n      }\n    } catch (err) {\n      log.debug(\n        `extraction-faithfulness: local LLM failed, trying fallback: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  // Try fallback LLM\n  if (fallbackLlm) {\n    try {\n      const result = await fallbackLlm.chatCompletion(\n        messages as Array<{ role: \"system\" | \"user\" | \"assistant\"; content: string }>,\n        {\n          temperature: 0.1,\n          maxTokens: 2048,\n          timeoutMs,\n          ...(modelOverride ? { model: modelOverride } : {}),\n          ...gatewayChain,\n          ...(signal ? { signal } : {}),\n        },\n      );\n      if (result?.content) {\n        return { content: result.content, modelUsed: result.modelUsed ?? \"fallback\" };\n      }\n    } catch (err) {\n      log.debug(\n        `extraction-faithfulness: fallback LLM failed: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  return { content: null, modelUsed: null };\n}\n\n/**\n * Call the local LLM's chatCompletion through a narrow, typed interface.\n * LocalLlmClient.chatCompletion accepts an options bag that includes an\n * `operation` discriminator; we forward it so the client can route\n * appropriately.\n */\ninterface LocalLlmCallOptions {\n  temperature: number;\n  maxTokens: number;\n  responseFormat?: { type: string };\n  timeoutMs: number;\n  operation: string;\n}\n\ninterface LocalLlmCallResponse {\n  content: string | null;\n  modelUsed?: string;\n}\n\nasync function callLocalLlm(\n  client: LocalLlmClient,\n  messages: Array<{ role: \"system\" | \"user\"; content: string }>,\n  options: LocalLlmCallOptions,\n): Promise<LocalLlmCallResponse> {\n  // LocalLlmClient.chatCompletion returns { content: string } — we use a\n  // typed call signature so no `any` leaks. The local client does not\n  // expose modelUsed, so we return \"local\" as the model identifier.\n  const result = await client.chatCompletion(messages, options);\n  return {\n    content: result?.content ?? null,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Core batch check\n// ---------------------------------------------------------------------------\n\n/**\n * Result of a batch faithfulness check — per-input results plus timing.\n */\nexport interface FaithfulnessBatchResult {\n  results: FaithfulnessResult[];\n  /** Wall-clock duration of the LLM call (0 when backend was not called). */\n  elapsedMs: number;\n}\n\n/**\n * Evaluate a batch of (fact, quote) pairs for faithfulness.\n *\n * - Calls the LLM once with all pairs (bounded by `inputs.length`).\n * - On timeout → every input gets `{ ok: false, code: \"timeout\" }`.\n * - On backend unavailable → `{ ok: false, code: \"backend_unavailable\" }`.\n * - On malformed output → `{ ok: false, code: \"malformed_output\" }`.\n * - Inputs with empty quotes get `{ ok: false, code: \"no_span\" }` and are\n *   NOT sent to the LLM.\n *\n * No module-level state: the caller (orchestrator) owns any caches.\n */\nexport async function checkFaithfulnessBatch(\n  inputs: FaithfulnessCheckInput[],\n  config: PluginConfig,\n  localLlm: LocalLlmClient | null,\n  fallbackLlm: FallbackLlmClient | null,\n  /**\n   * Optional fetch injection (issue #1585). The orchestrator does not pass it\n   * (uses global fetch); tests pass a stub to exercise the local model-lab\n   * endpoint path without a live server. See callFaithfulnessLlm.\n   */\n  fetchImpl?: typeof fetch,\n): Promise<FaithfulnessBatchResult> {\n  const timeoutMs =\n    typeof config.extractionFaithfulnessTimeoutMs === \"number\" &&\n    Number.isFinite(config.extractionFaithfulnessTimeoutMs) &&\n    config.extractionFaithfulnessTimeoutMs > 0\n      ? config.extractionFaithfulnessTimeoutMs\n      : 8000;\n\n  const contextChars =\n    typeof config.extractionFaithfulnessContextChars === \"number\" &&\n    Number.isFinite(config.extractionFaithfulnessContextChars) &&\n    config.extractionFaithfulnessContextChars > 0\n      ? config.extractionFaithfulnessContextChars\n      : 400;\n\n  // Partition: inputs with a real quote vs. inputs without one.\n  const results: FaithfulnessResult[] = new Array(inputs.length);\n  const checkableIndices: number[] = [];\n  const checkableInputs: FaithfulnessCheckInput[] = [];\n\n  for (let i = 0; i < inputs.length; i++) {\n    const inp = inputs[i];\n    if (!inp || !inp.quote || inp.quote.trim().length === 0) {\n      results[i] = { ok: false, error: { code: \"no_span\" } };\n    } else if (!inp.factText || inp.factText.trim().length === 0) {\n      results[i] = { ok: false, error: { code: \"no_span\" } };\n    } else {\n      checkableIndices.push(i);\n      checkableInputs.push(inp);\n    }\n  }\n\n  if (checkableInputs.length === 0) {\n    return { results, elapsedMs: 0 };\n  }\n\n  const userPrompt = buildBatchPrompt(checkableInputs, contextChars);\n  const startedAt = Date.now();\n\n  let timedOut = false;\n  const controller = new AbortController();\n  // Race the LLM call against the budget so the batch fails open at\n  // `timeoutMs` regardless of which backend is in flight. The local backend\n  // ignores the batch AbortSignal (it aborts each attempt via its own\n  // controller keyed on `timeoutMs`), so awaiting callFaithfulnessLlm directly\n  // could block past the budget on a slow/retrying local verifier. The timer\n  // both aborts the fallback (which honors the signal) and resolves the race\n  // so the batch returns promptly; the in-flight local call aborts on its own\n  // per-attempt timeoutMs. (codex review PRRT_kwDORJXyws6ObgMJ.)\n  // Manual deferred instead of Promise.withResolvers (ES2024) — plugin-openclaw's\n  // standalone tsconfig targets ES2022 lib and this module is reachable from its\n  // type graph, so withResolvers would TS2550 there.\n  let resolveTimeout!: (value: true) => void;\n  const racedTimeout = new Promise<true>((resolve) => {\n    resolveTimeout = resolve;\n  });\n  const timer = setTimeout(() => {\n    timedOut = true;\n    controller.abort();\n    resolveTimeout(true);\n  }, timeoutMs);\n\n  try {\n    const callPromise = callFaithfulnessLlm(\n      FAITHFULNESS_SYSTEM_PROMPT,\n      userPrompt,\n      config,\n      localLlm,\n      fallbackLlm,\n      timeoutMs,\n      controller.signal,\n      fetchImpl,\n    );\n    const settled = await Promise.race([\n      callPromise.then(\n        (r) => ({ done: true as const, result: r }),\n        // An unexpected throw is treated as \"no content\" (backend_unavailable)\n        // so the race never rejects and the outer catch is the final safety net.\n        () => ({ done: true as const, result: { content: null, modelUsed: null } }),\n      ),\n      racedTimeout.then(() => ({ done: false as const })),\n    ]);\n    const elapsedMs = Date.now() - startedAt;\n\n    if (!settled.done) {\n      // The budget elapsed before any backend returned content. Fail open as\n      // timeout; the orphaned callPromise resolves/rejects harmlessly (the\n      // fallback was aborted; the local client aborts on its own timeoutMs).\n      for (const idx of checkableIndices) {\n        results[idx] = { ok: false, error: { code: \"timeout\" } };\n      }\n      return { results, elapsedMs };\n    }\n\n    const llmResult = settled.result;\n\n    // Cursor review: if the LLM returned usable content, use it even when\n    // the abort timer raced — a response that lands just as the timer fires\n    // has real verdicts. Only fall back to timeout errors when there is no\n    // content to parse (the call genuinely did not complete in time).\n    if (timedOut && !llmResult.content) {\n      for (const idx of checkableIndices) {\n        results[idx] = { ok: false, error: { code: \"timeout\" } };\n      }\n      return { results, elapsedMs };\n    }\n\n    if (!llmResult.content) {\n      for (const idx of checkableIndices) {\n        results[idx] = { ok: false, error: { code: \"backend_unavailable\" } };\n      }\n      return { results, elapsedMs };\n    }\n\n    const parsed = parseFaithfulnessResponse(llmResult.content, checkableInputs.length);\n    if (!parsed) {\n      for (const idx of checkableIndices) {\n        results[idx] = { ok: false, error: { code: \"malformed_output\" } };\n      }\n      return { results, elapsedMs };\n    }\n\n    for (let j = 0; j < checkableIndices.length; j++) {\n      const inputIdx = checkableIndices[j];\n      if (inputIdx === undefined) continue;\n      const entry = parsed.get(j);\n      if (entry) {\n        results[inputIdx] = {\n          ok: true,\n          verdict: entry.verdict,\n          model: llmResult.modelUsed ?? \"unknown\",\n          ...(entry.rationale ? { rationale: entry.rationale } : {}),\n        };\n      } else {\n        // LLM response was missing this index\n        results[inputIdx] = { ok: false, error: { code: \"malformed_output\" } };\n      }\n    }\n\n    return { results, elapsedMs };\n  } catch (err) {\n    const elapsedMs = Date.now() - startedAt;\n    if (timedOut || isAbortError(err)) {\n      for (const idx of checkableIndices) {\n        results[idx] = { ok: false, error: { code: \"timeout\" } };\n      }\n      return { results, elapsedMs };\n    }\n    log.warn(\n      `extraction-faithfulness: batch check threw unexpectedly: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    for (const idx of checkableIndices) {\n      results[idx] = { ok: false, error: { code: \"backend_unavailable\" } };\n    }\n    return { results, elapsedMs };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nfunction isAbortError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const maybe = err as { name?: string; message?: string };\n  return (\n    maybe.name === \"AbortError\" ||\n    maybe.message === \"This operation was aborted\" ||\n    maybe.message === \"The operation was aborted\"\n  );\n}\n\n\n// ---------------------------------------------------------------------------\n// Extraction-path orchestration helpers (issue #1576)\n//\n// These wrap checkFaithfulnessBatch + verdict application so the orchestrator\n// holds only thin delegation (ground rule 4: god files gain thin wiring only).\n// The core algorithm lives above; these are call-site glue.\n// ---------------------------------------------------------------------------\n\n/**\n * Telemetry counters for the faithfulness gate. Hang off the orchestrator\n * instance (rule 11: no module-level state) and surface via console_state so\n * `remnic doctor` renders the verdict distribution.\n */\nexport interface FaithfulnessGateCounters {\n  entailed: number;\n  contradicted: number;\n  unsupported: number;\n  unchecked: number;\n  skippedNoSpan: number;\n}\n\n/**\n * Create a fresh zeroed counters object. Callers store it on the orchestrator\n * instance and pass it by reference to the gate helpers, which mutate it.\n */\nexport function createFaithfulnessCounters(): FaithfulnessGateCounters {\n  return { entailed: 0, contradicted: 0, unsupported: 0, unchecked: 0, skippedNoSpan: 0 };\n}\n\n/**\n * Structural slice of an extracted fact that the gate reads. Kept loose so\n * this pure module does not depend on the full `ExtractedFact` type.\n */\nexport interface FaithfulnessGateFact {\n  content: string;\n  sources?: { quote?: string }[];\n}\n\n/**\n * Run the faithfulness batch over a list of extracted facts and return a map\n * keyed by the ORIGINAL fact index → result. Facts without a usable verified\n * source span are omitted from the batch (they are tagged `skipped_no_span`\n * at apply time, never gated — don't punish legacy data). Updates `counters`\n * for console_state telemetry.\n *\n * Fail-open: any pipeline error is caught, logged, and an empty map returned\n * so the caller records `unchecked`/`skipped_no_span` and proceeds — a gate\n * outage must never block memory writes (checklist §4).\n */\n// Common English stopwords — filtered before overlap scoring so function\n// words (the, a, is, ...) don't dilute the signal between a fact and its\n// source sentence.\nconst STOPWORDS = new Set([\n  \"the\",\"a\",\"an\",\"and\",\"or\",\"but\",\"is\",\"are\",\"was\",\"were\",\"be\",\"been\",\"being\",\n  \"to\",\"of\",\"in\",\"on\",\"at\",\"for\",\"with\",\"from\",\"by\",\"as\",\"it\",\"its\",\"this\",\"that\",\n  \"these\",\"those\",\"i\",\"you\",\"he\",\"she\",\"we\",\"they\",\"my\",\"your\",\"his\",\"her\",\"our\",\"their\",\n  \"has\",\"have\",\"had\",\"do\",\"does\",\"did\",\"will\",\"would\",\"can\",\"could\",\"should\",\"not\",\"no\",\n  \"s\",\"very\",\"really\",\"just\",\"so\",\"than\",\"then\",\"there\",\"here\",\"about\",\"into\",\"over\",\"under\",\n]);\n\n/**\n * Crude stemmer: strip common suffixes so \"prefers\"/\"prefer\",\n * \"using\"/\"use\", \"started\"/\"start\" collapse to one token. Not a real\n * stemmer — just enough to raise recall for the interim locator (#1575 will\n * replace this with NLI-verified spans).\n */\nfunction crudeStem(word: string): string {\n  if (word.length > 5 && word.endsWith(\"ing\")) return word.slice(0, -3);\n  if (word.length > 4 && word.endsWith(\"ed\")) return word.slice(0, -2);\n  if (word.length > 3 && (word.endsWith(\"s\")) && !word.endsWith(\"ss\")) return word.slice(0, -1);\n  return word;\n}\n\n/**\n * Tokenize text into a lowercase, stopword-filtered, crudely-stemmed token\n * set for overlap scoring.\n */\nfunction tokenize(text: string): Set<string> {\n  const tokens = new Set<string>();\n  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {\n    if (raw.length <= 1) continue;\n    if (STOPWORDS.has(raw)) continue;\n    tokens.add(crudeStem(raw));\n  }\n  return tokens;\n}\n\n/**\n * Overlap coefficient: |A ∩ B| / min(|A|, |B|). Robust for paraphrase\n * matching where a short fact paraphrases a longer source sentence — a short\n * fact fully supported by a long sentence scores high, unrelated text scores 0.\n */\nfunction overlapCoefficient(a: Set<string>, b: Set<string>): number {\n  if (a.size === 0 || b.size === 0) return 0;\n  let intersection = 0;\n  const [small, large] = a.size <= b.size ? [a, b] : [b, a];\n  for (const t of small) if (large.has(t)) intersection++;\n  return intersection / small.size;\n}\n\n/**\n * Minimum overlap for a located quote to be trusted as the fact's source span.\n * Below this the fact is treated as having no located span (skipped_no_span)\n * rather than judged against an unrelated sentence.\n */\nconst LOCATE_QUOTE_MIN_OVERLAP = 0.3;\n\n/**\n * Locate the best-matching verbatim span (sentence) from the source turn text\n * for an extracted fact, by token overlap. Returns the quote when a confident\n * match is found, `undefined` otherwise (the gate then records\n * skipped_no_span — never judged against an unrelated span).\n *\n * This is the interim source-text locator that makes the gate functional on\n * real extraction output (where #1575 has not yet attached per-fact\n * `sources`). It produces a genuine located quote per fact so the gate\n * consumes a span, not the whole conversation (issue #1576 design constraint).\n * #1575's NLI-verified per-fact locator will replace this when it lands.\n */\n/**\n * Extract a bounded window of `sourceText` centered on the located `quote`,\n * bounded by `contextChars` (the config's \"window around the quote\" semantics).\n *\n * Used by the fallback-locator path in `runFaithfulnessGateBatch` so the\n * verifier sees surrounding turn text — without it,\n * `extractionFaithfulnessContextChars` is effectively ignored in the\n * production path (codex review PRRT_kwDORJXyws6OblI1). Returns undefined when\n * the quote is absent from sourceText (e.g. it was truncated by maxQuoteChars).\n */\nexport function extractContextWindow(\n  sourceText: string,\n  quote: string,\n  contextChars: number,\n  /**\n   * Character offset of `quote` within `sourceText` (from `locateFactQuote`).\n   * When the quote string appears more than once — e.g. repeated anaphoric\n   * lines after different entities — pass the matched occurrence's offset so\n   * the context window centers on the actual match, not the first occurrence\n   * (issue #1633, codex PRRT_kwDORJXyws6ObzwI). Defaults to the first\n   * occurrence via indexOf for backward compatibility.\n   */\n  matchedOffset?: number,\n): string | undefined {\n  if (!sourceText || !quote || !(contextChars > 0)) return undefined;\n  let idx: number;\n  if (matchedOffset !== undefined && matchedOffset >= 0) {\n    const at = sourceText.indexOf(quote, matchedOffset);\n    // Fall back to the first occurrence if the matched offset is stale (e.g.\n    // the quote was bounded and is not a literal substring at that offset).\n    idx = at >= 0 ? at : sourceText.indexOf(quote);\n  } else {\n    idx = sourceText.indexOf(quote);\n  }\n  if (idx < 0) return undefined;\n  const quoteEnd = idx + quote.length;\n  const center = Math.floor((idx + quoteEnd) / 2);\n  const half = Math.floor(contextChars / 2);\n  let start = Math.max(0, center - half);\n  const end = Math.min(sourceText.length, start + contextChars);\n  // Re-anchor start so the window uses the full budget when end clamped.\n  start = Math.max(0, end - contextChars);\n  const window = sourceText.slice(start, end).trim();\n  return window.length > 0 ? window : undefined;\n}\n\n/**\n * A located fallback quote plus the offset it begins at in the source text.\n * `offset` lets `extractContextWindow` disambiguate repeated occurrences of\n * the same quote string (issue #1633).\n */\nexport interface LocatedQuote {\n  /** Verbatim source span, centered on the matched terms when truncated. */\n  quote: string;\n  /** Character offset of `quote` within sourceText. */\n  offset: number;\n}\n\ninterface SourceCandidate {\n  /** Trimmed candidate text. */\n  text: string;\n  /** Character offset of `text` within the source string. */\n  start: number;\n}\n\n/**\n * Split source text into candidate spans (sentences, then line segments as a\n * fallback for transcripts without sentence punctuation), tracking each\n * candidate's start offset so repeated occurrences can be disambiguated\n * (issue #1633).\n */\nfunction splitSourceCandidates(sourceText: string): SourceCandidate[] {\n  const candidates: SourceCandidate[] = [];\n  const re = /(?<=[.!?])\\s+|\\n+/g;\n  let lastEnd = 0;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(sourceText)) !== null) {\n    pushCandidate(candidates, sourceText, lastEnd, m.index);\n    lastEnd = re.lastIndex;\n  }\n  pushCandidate(candidates, sourceText, lastEnd, sourceText.length);\n  return candidates;\n}\n\nfunction pushCandidate(\n  out: SourceCandidate[],\n  source: string,\n  begin: number,\n  end: number,\n): void {\n  const seg = source.slice(begin, end);\n  const leadingWS = seg.length - seg.trimStart().length;\n  const trimmed = seg.trim();\n  if (trimmed.length > 0) {\n    out.push({ text: trimmed, start: begin + leadingWS });\n  }\n}\n\n/**\n * Locate the start offsets of fact-token matches inside a candidate. Used by\n * `locateFactQuote` to build a bounded window that is guaranteed to contain\n * real evidence (issue #1633, codex PRRT_kwDORJXyws6Obrwe / PRRT_kwDORJXyws6Oce-O).\n */\nfunction locateMatchedTokens(factTokens: Set<string>, candidate: string): number[] {\n  const lower = candidate.toLowerCase();\n  const wordRe = /[a-z0-9]+/g;\n  const positions: number[] = [];\n  let m: RegExpExecArray | null;\n  while ((m = wordRe.exec(lower)) !== null) {\n    const word = m[0];\n    if (word.length <= 1) continue;\n    if (STOPWORDS.has(word)) continue;\n    if (factTokens.has(crudeStem(word))) {\n      positions.push(m.index);\n    }\n  }\n  return positions;\n}\n\n/**\n * Build a bounded window of `maxChars` from `text` that contains the densest\n * cluster of matched-token positions. Slides a maxChars-wide window anchored\n * at each matched token and keeps the one that captures the most matches\n * (tiebreak: earliest anchor). This guarantees the window includes real\n * evidence even when the matched span is wider than `maxChars` (e.g. fact\n * tokens at both ends of a long sentence with filler between). Centering on\n * the densest cluster's midpoint then uses any leftover budget as leading and\n * trailing context. Returns the window text and its start offset within `text`\n * so callers can translate the in-candidate offset back to a source-text offset.\n */\nfunction boundedWindow(\n  text: string,\n  matchedPositions: number[],\n  maxChars: number,\n): { text: string; start: number } {\n  if (matchedPositions.length === 0) {\n    // Defensive: overlap scoring accepted the candidate but no individual\n    // token matched (e.g. all matches were stopwords). Fall back to prefix.\n    const end = Math.min(text.length, maxChars);\n    return { text: text.slice(0, end), start: 0 };\n  }\n  // matchedPositions is sorted ascending (the regex scans left-to-right), so a\n  // two-pointer sliding window finds the densest maxChars-wide cluster in O(n)\n  // instead of O(n^2). This matters when a long unpunctuated candidate carries\n  // many repeats of a fact token (pasted logs, minified text) — thousands of\n  // positions would otherwise stall extraction before the LLM call (codex\n  // PRRT_kwDORJXyws6Ocih3).\n  let bestAnchor = matchedPositions[0]!;\n  let bestCount = 0;\n  let bestLast = bestAnchor;\n  let j = 0;\n  for (let i = 0; i < matchedPositions.length; i++) {\n    const anchor = matchedPositions[i]!;\n    const winEnd = anchor + maxChars;\n    if (j < i) j = i;\n    while (j + 1 < matchedPositions.length && matchedPositions[j + 1]! < winEnd) {\n      j++;\n    }\n    const count = j - i + 1;\n    if (count > bestCount) {\n      bestCount = count;\n      bestAnchor = anchor;\n      bestLast = matchedPositions[j]!;\n    }\n  }\n  // The densest cluster [bestAnchor, bestLast] fits within maxChars by\n  // construction; center a maxChars window on its midpoint, clamped to text.\n  const center = Math.floor((bestAnchor + bestLast) / 2);\n  const half = Math.floor(maxChars / 2);\n  let start = Math.max(0, center - half);\n  const end = Math.min(text.length, start + maxChars);\n  // Re-anchor start so the window uses the full budget when end clamped.\n  start = Math.max(0, end - maxChars);\n  return { text: text.slice(start, end), start };\n}\n\nexport function locateFactQuote(\n  factText: string,\n  sourceText: string,\n  maxQuoteChars = 600,\n): LocatedQuote | undefined {\n  if (!factText || !sourceText) return undefined;\n  const factTokens = tokenize(factText);\n  if (factTokens.size === 0) return undefined;\n  const candidates = splitSourceCandidates(sourceText);\n  if (candidates.length === 0) return undefined;\n  // Pick the best-overlap candidate. Tiebreak equal own-overlap scores by a\n  // \"context\" score that includes the immediately PRECEDING candidate's text,\n  // so a repeated anaphoric line (\"It launched in March\") resolves to the\n  // occurrence whose neighbor names the fact's entity (issue #1633, codex\n  // PRRT_kwDORJXyws6Oce-S). Without this tiebreak the first occurrence wins\n  // even when the second is the one the fact refers to.\n  let best: { candidate: SourceCandidate; score: number; contextScore: number } | null = null;\n  for (let i = 0; i < candidates.length; i++) {\n    const candidate = candidates[i]!;\n    const score = overlapCoefficient(factTokens, tokenize(candidate.text));\n    const prevText = i > 0 ? candidates[i - 1]!.text : \"\";\n    const contextText = prevText ? `${prevText} ${candidate.text}` : candidate.text;\n    const contextScore = overlapCoefficient(factTokens, tokenize(contextText));\n    if (\n      !best ||\n      score > best.score ||\n      (score === best.score && contextScore > best.contextScore)\n    ) {\n      best = { candidate, score, contextScore };\n    }\n  }\n  if (!best || best.score < LOCATE_QUOTE_MIN_OVERLAP) return undefined;\n  const { text, start } = best.candidate;\n  if (text.length <= maxQuoteChars) {\n    return { quote: text, offset: start };\n  }\n  // Build a bounded window around the densest cluster of matched terms instead\n  // of returning the first maxQuoteChars prefix (issue #1633). Returning the\n  // prefix drops supporting words that fall after char ~600, routing\n  // actually-entailed facts to pending_review in enforce mode.\n  const matched = locateMatchedTokens(factTokens, text);\n  const win = boundedWindow(text, matched, maxQuoteChars);\n  return { quote: win.text, offset: start + win.start };\n}\nexport async function runFaithfulnessGateBatch(\n  facts: readonly FaithfulnessGateFact[],\n  mode: \"shadow\" | \"enforce\",\n  config: PluginConfig,\n  localLlm: LocalLlmClient | null,\n  fallbackLlm: FallbackLlmClient | null,\n  counters: FaithfulnessGateCounters,\n  /**\n   * The verbatim source turn text the facts were extracted from. When a fact\n   * has no #1575 `sources`, locateFactQuote finds a fallback span here so the\n   * gate runs on real extraction output. May be empty (replay/import paths\n   * with no source turns) — facts then get skipped_no_span.\n   */\n  sourceText = \"\",\n): Promise<Map<number, FaithfulnessResult> | null> {\n  // Phase 1 — build the checkable inputs. This is pure (no LLM, no throw):\n  // locateFactQuote and the source/span selection never reject. Keeping it\n  // outside the try lets the catch walk the same inputs to tag a pipeline\n  // failure as \"unchecked\" rather than dropping it on the floor.\n  const inputs: { factIndex: number; input: FaithfulnessCheckInput }[] = [];\n  for (let fi = 0; fi < facts.length; fi++) {\n    const f = facts[fi];\n    if (!f || typeof f.content !== \"string\" || !f.content.trim()) continue;\n    // Prefer #1575 verified spans; fall back to a located quote from the\n    // source turn text so the gate runs even before per-fact sources are\n    // attached. Without either, the fact is skipped_no_span (never gated).\n    // A composite fact may be supported by multiple adjacent spans — collect\n    // every valid source quote so the verifier sees the full evidence, not\n    // just sources[0] (codex review PRRT_kwDORJXyws6ObYQ_).\n    const sources = Array.isArray(f.sources) ? f.sources : [];\n    const sourceQuotes = sources\n      .map((s) => (s && typeof s.quote === \"string\" ? s.quote.trim() : \"\"))\n      .filter((q) => q.length > 0);\n    const usingFallbackLocator = sourceQuotes.length === 0;\n    let quote: string;\n    let matchedOffset: number | undefined;\n    if (sourceQuotes.length > 0) {\n      quote = sourceQuotes.join(\"\\n\");\n    } else {\n      // Fallback locator returns the matched span AND its offset so the\n      // context window centers on the occurrence that actually matched the\n      // fact, not the first indexOf hit (issue #1633).\n      const located = locateFactQuote(f.content, sourceText);\n      if (!located) continue; // no located span — applyFaithfulnessVerdict tags skipped_no_span\n      quote = located.quote;\n      matchedOffset = located.offset;\n    }\n    // Pass source context into the verifier so extractionFaithfulnessContextChars\n    // actually applies in the fallback-locator path (codex P2\n    // PRRT_kwDORJXyws6OblI1). #1575 verified spans already carry full evidence,\n    // so context is only synthesized for the fallback locator.\n    const fallbackContext =\n      usingFallbackLocator\n        ? extractContextWindow(\n            sourceText,\n            quote,\n            config.extractionFaithfulnessContextChars,\n            matchedOffset,\n          )\n        : undefined;\n    inputs.push({\n      factIndex: fi,\n      input: {\n        factText: f.content,\n        quote,\n        ...(fallbackContext ? { context: fallbackContext } : {}),\n      },\n    });\n  }\n  const resultsByFactIndex = new Map<number, FaithfulnessResult>();\n  if (inputs.length === 0) return resultsByFactIndex;\n  try {\n    const batch = await checkFaithfulnessBatch(\n      inputs.map((x) => x.input),\n      config,\n      localLlm,\n      fallbackLlm,\n    );\n    for (let j = 0; j < inputs.length; j++) {\n      const entry = inputs[j];\n      if (entry) resultsByFactIndex.set(entry.factIndex, batch.results[j]!);\n    }\n    // Verdict-distribution counters are bumped in applyFaithfulnessVerdict\n    // (at the per-fact apply point), NOT here, so console_state reflects\n    // facts that actually reached verdict application — not facts later\n    // dropped by dedup, importance, or judge gates (cursor review).\n    log.info(\n      `extraction-faithfulness[${mode}]: ${inputs.length} facts checked, ${batch.elapsedMs}ms`,\n    );\n  } catch (err) {\n    // Fail-open: a pipeline error never blocks writes (checklist §4). Tag each\n    // checkable fact as backend_unavailable so applyFaithfulnessVerdict records\n    // \"unchecked\" (issue spec: backend failure → unchecked). Returning null\n    // here would make a shadow/enforce batch failure indistinguishable from\n    // gate-off, losing the telemetry signal (cursor review). Facts with no\n    // located span stay absent → skipped_no_span at apply time.\n    log.warn(\n      `extraction-faithfulness: pipeline error, tagging ${inputs.length} checkable facts as unchecked (fail-open): ${err instanceof Error ? err.message : String(err)}`,\n    );\n    for (const { factIndex } of inputs) {\n      resultsByFactIndex.set(factIndex, { ok: false, error: { code: \"backend_unavailable\" } });\n    }\n  }\n  return resultsByFactIndex;\n}\n\n/**\n * Apply a pre-computed faithfulness verdict to a single fact, producing the\n * frontmatter record + an optional enforce-mode `pending_review` status.\n *\n * - `resultsByFactIndex` null (gate off) → nothing (rule 39: byte-identical).\n * - fact has no entry (no verified span) → `skipped_no_span`, never gated.\n * - backend failure (`ok: false`) → `unchecked`, fact proceeds (checklist §4).\n * - enforce + unsupported/contradicted → `pending_review` (memory persists,\n *   enters the review queue, never silently dropped).\n *\n * Mutates `counters.skippedNoSpan` for facts without a span.\n */\nexport function applyFaithfulnessVerdict(\n  resultsByFactIndex: Map<number, FaithfulnessResult> | null,\n  factLoopIndex: number,\n  mode: \"off\" | \"shadow\" | \"enforce\",\n  factContent: string,\n  counters: FaithfulnessGateCounters,\n): {\n  faithfulness: FaithfulnessFrontmatter | undefined;\n  enforceStatus: \"pending_review\" | undefined;\n} {\n  if (!resultsByFactIndex) {\n    return { faithfulness: undefined, enforceStatus: undefined };\n  }\n  const result = resultsByFactIndex.get(factLoopIndex);\n  if (!result) {\n    // No result for this fact index — it had no verified source span.\n    counters.skippedNoSpan++;\n    return {\n      faithfulness: { verdict: \"skipped_no_span\", at: new Date().toISOString() },\n      enforceStatus: undefined,\n    };\n  }\n  if (result.ok) {\n    if (result.verdict === \"entailed\") counters.entailed++;\n    else if (result.verdict === \"contradicted\") counters.contradicted++;\n    else if (result.verdict === \"unsupported\") counters.unsupported++;\n    const fm: FaithfulnessFrontmatter = {\n      verdict: result.verdict,\n      ...(result.model ? { model: result.model } : {}),\n      ...(result.rationale ? { rationale: result.rationale } : {}),\n      at: new Date().toISOString(),\n    };\n    let enforceStatus: \"pending_review\" | undefined;\n    if (\n      mode === \"enforce\" &&\n      (result.verdict === \"unsupported\" || result.verdict === \"contradicted\")\n    ) {\n      enforceStatus = \"pending_review\";\n      log.info(\n        `extraction-faithfulness[enforce]: routing \"${factContent.slice(0, 60)}…\" to pending_review (verdict=${result.verdict})`,\n      );\n    }\n    return { faithfulness: fm, enforceStatus };\n  }\n  // Backend failure — record as unchecked, fact proceeds (graceful degradation).\n  counters.unchecked++;\n  return {\n    faithfulness: { verdict: \"unchecked\", at: new Date().toISOString() },\n    enforceStatus: undefined,\n  };\n}\n// ---------------------------------------------------------------------------\n// Frontmatter serialization (single-line JSON, like provenance sources)\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical key order for the serialized `faithfulness` frontmatter field.\n * Deterministic emission (rule 38).\n */\nconst FAITHFULNESS_KEY_ORDER = [\"verdict\", \"model\", \"rationale\", \"at\"] as const;\n\n/**\n * Serialize the `faithfulness` frontmatter field as a single JSON line,\n * appended to `lines`. Called from `serializeFrontmatter` in storage.ts.\n *\n * Contract: when `fm.faithfulness` is absent, no line is emitted — the\n * memory round-trips byte-identical to pre-#1576 behavior (rule 39).\n */\nexport function serializeFaithfulnessFields(fm: MemoryFrontmatter, lines: string[]): void {\n  if (!fm.faithfulness) return;\n  const fm2 = fm.faithfulness;\n  const canonical: Record<string, unknown> = {};\n  for (const key of FAITHFULNESS_KEY_ORDER) {\n    const val = fm2[key];\n    if (val !== undefined && val !== null && val !== \"\") {\n      canonical[key] = val;\n    }\n  }\n  // verdict is always present on a valid FaithfulnessFrontmatter\n  if (!canonical.verdict) return;\n  lines.push(`faithfulness: ${JSON.stringify(canonical)}`);\n}\n\n/**\n * Parse the `faithfulness` frontmatter line from its single-line JSON form.\n * Returns `undefined` for missing, blank, or corrupt values so a malformed\n * frontmatter never poisons downstream readers (rule 34 spirit).\n */\nexport function parseFaithfulnessField(\n  raw: string | undefined,\n): FaithfulnessFrontmatter | undefined {\n  if (!raw || typeof raw !== \"string\" || raw.trim().length === 0) return undefined;\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return undefined;\n    const obj = parsed as Record<string, unknown>;\n    const verdictRaw = typeof obj.verdict === \"string\" ? obj.verdict : undefined;\n    if (!verdictRaw) return undefined;\n    const validVerdicts = new Set([\n      \"entailed\",\n      \"contradicted\",\n      \"unsupported\",\n      \"unchecked\",\n      \"skipped_no_span\",\n    ]);\n    if (!validVerdicts.has(verdictRaw)) return undefined;\n    const result: FaithfulnessFrontmatter = {\n      verdict: verdictRaw as FaithfulnessFrontmatter[\"verdict\"],\n    };\n    if (typeof obj.model === \"string\" && obj.model.length > 0) {\n      result.model = obj.model;\n    }\n    if (typeof obj.rationale === \"string\" && obj.rationale.length > 0) {\n      result.rationale = obj.rationale.slice(0, 500);\n    }\n    if (typeof obj.at === \"string\" && obj.at.length > 0) {\n      result.at = obj.at;\n    }\n    return result;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8BA,SAAS,kBAAkB;AAsE3B,IAAM,6BAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2B5B,IAAM,2BAA2B,WAAW,QAAQ,EACxD,OAAO,0BAA0B,EACjC,OAAO,KAAK;AAaf,SAAS,iBAAiB,QAAkC,cAA8B;AACxF,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,MAAM,OAAO,CAAC;AACpB,QAAI,CAAC,IAAK;AAMV,UAAM,KAAK,YAAY,CAAC;AAAA,UAClB,IAAI,KAAK,GAAG;AAClB,QAAI,IAAI,WAAW,IAAI,QAAQ,KAAK,EAAE,SAAS,GAAG;AAChD,YAAM,KAAK,aAAa,IAAI,QAAQ,MAAM,GAAG,YAAY,CAAC,GAAG;AAAA,IAC/D;AACA,UAAM,KAAK,UAAU,IAAI,QAAQ;AAAA;AAAA,8CAES,CAAC,GAAG;AAAA,EAChD;AACA,QAAM,KAAK;AAAA,+DAA6D,OAAO,SAAS,CAAC,GAAG;AAC5F,SAAO,MAAM,KAAK,IAAI;AACxB;AAMA,IAAM,iBAAiB,oBAAI,IAAY,CAAC,YAAY,gBAAgB,aAAa,CAAC;AAoB3E,SAAS,0BACd,KACA,eAC6C;AAC7C,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,GAAG;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,sBAAsB,GAAG;AAC5C,aAAW,aAAa,YAAY;AAClC,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,SAAS;AAAA,IAC/B,QAAQ;AACN;AAAA,IACF;AACA,UAAM,MAAM,aAAa,QAAQ,aAAa;AAC9C,QAAI,IAAK,QAAO;AAAA,EAClB;AAIA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC;AACpC,UAAM,MAAM,aAAa,CAAC,MAAM,GAAG,aAAa;AAChD,QAAI,IAAK,QAAO;AAAA,EAClB,QAAQ;AAAA,EAER;AAEA,SAAO;AACT;AAEA,SAAS,aACP,MACA,eAC6C;AAC7C,MAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AAMxB,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,iBAAW,OAAO,CAAC,WAAW,YAAY,WAAW,OAAO,GAAG;AAC7D,cAAM,QAAS,KAAiC,GAAG;AACnD,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,aAAa,OAAO,aAAa;AAAA,MACpE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,oBAAI,IAAqC;AACrD,aAAW,SAAS,MAAM;AACxB,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,UAAM,MAAM;AACZ,UAAM,MAAM,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AACxD,QAAI,QAAQ,UAAa,MAAM,KAAK,OAAO,cAAe;AAC1D,UAAM,aAAa,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AACnE,QAAI,CAAC,cAAc,CAAC,eAAe,IAAI,UAAU,EAAG;AACpD,UAAM,YACJ,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,KAAK,EAAE,SAAS,IAC/D,IAAI,UAAU,KAAK,EAAE,MAAM,GAAG,GAAG,IACjC;AACN,QAAI,IAAI,KAAK;AAAA,MACX,OAAO;AAAA,MACP,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,OAAO,IAAI,MAAM;AAC9B;AAmBA,eAAe,oBACb,cACA,YACA,QACA,UACA,aACA,WACA,QACA,YAA0B,OACF;AACxB,QAAM,WAAgE;AAAA,IACpE,EAAE,MAAM,UAAU,SAAS,aAAa;AAAA,IACxC,EAAE,MAAM,QAAQ,SAAS,WAAW;AAAA,EACtC;AASA,QAAM,gBAAgB,gCAAgC,MAAM;AAC5D,MAAI,eAAe;AAQjB,UAAM,gBAAgB,KAAK,IAAI,KAAK,KAAK,MAAM,YAAY,CAAC,CAAC;AAC7D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,aAAa,KAAK,WAAW,MAAM,oBAAoB,MAAM,WAAW,cAAc;AAAA,MACxF;AAAA,IACF;AACA,QAAI,QAAQ,SAAS;AACnB,aAAO,EAAE,SAAS,OAAO,SAAS,WAAW,OAAO,UAAU;AAAA,IAChE;AACA,QAAI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAWA,QAAM,gBAAgB,gBAAgB,SAAa,OAAO,+BAA+B;AAQzF,QAAM,YAAY,OAAO,gBAAgB,aAAa,QAAQ,aAAa;AAC3E,QAAM,eAAe,wBAAwB,MAAM;AAEnD,MAAI,YAA2B;AAS/B,MAAI,YAAY,CAAC,WAAW;AAC1B,QAAI;AACF,YAAM,SAAS,MAAM,aAAa,UAAU,UAAU;AAAA,QACpD,aAAa;AAAA,QACb,WAAW;AAAA,QACX,gBAAgB,EAAE,MAAM,cAAc;AAAA,QACtC;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AACD,UAAI,OAAO,SAAS;AAClB,eAAO,EAAE,SAAS,OAAO,SAAS,WAAW,OAAO,aAAa,QAAQ;AAAA,MAC3E;AAAA,IACF,SAAS,KAAK;AACZ,UAAI;AAAA,QACF,+DAA+D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,aAAa;AACf,QAAI;AACF,YAAM,SAAS,MAAM,YAAY;AAAA,QAC/B;AAAA,QACA;AAAA,UACE,aAAa;AAAA,UACb,WAAW;AAAA,UACX;AAAA,UACA,GAAI,gBAAgB,EAAE,OAAO,cAAc,IAAI,CAAC;AAAA,UAChD,GAAG;AAAA,UACH,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,eAAO,EAAE,SAAS,OAAO,SAAS,WAAW,OAAO,aAAa,WAAW;AAAA,MAC9E;AAAA,IACF,SAAS,KAAK;AACZ,UAAI;AAAA,QACF,iDAAiD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM,WAAW,KAAK;AAC1C;AAqBA,eAAe,aACb,QACA,UACA,SAC+B;AAI/B,QAAM,SAAS,MAAM,OAAO,eAAe,UAAU,OAAO;AAC5D,SAAO;AAAA,IACL,SAAS,QAAQ,WAAW;AAAA,EAC9B;AACF;AA2BA,eAAsB,uBACpB,QACA,QACA,UACA,aAMA,WACkC;AAClC,QAAM,YACJ,OAAO,OAAO,oCAAoC,YAClD,OAAO,SAAS,OAAO,+BAA+B,KACtD,OAAO,kCAAkC,IACrC,OAAO,kCACP;AAEN,QAAM,eACJ,OAAO,OAAO,uCAAuC,YACrD,OAAO,SAAS,OAAO,kCAAkC,KACzD,OAAO,qCAAqC,IACxC,OAAO,qCACP;AAGN,QAAM,UAAgC,IAAI,MAAM,OAAO,MAAM;AAC7D,QAAM,mBAA6B,CAAC;AACpC,QAAM,kBAA4C,CAAC;AAEnD,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,MAAM,OAAO,CAAC;AACpB,QAAI,CAAC,OAAO,CAAC,IAAI,SAAS,IAAI,MAAM,KAAK,EAAE,WAAW,GAAG;AACvD,cAAQ,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE;AAAA,IACvD,WAAW,CAAC,IAAI,YAAY,IAAI,SAAS,KAAK,EAAE,WAAW,GAAG;AAC5D,cAAQ,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE;AAAA,IACvD,OAAO;AACL,uBAAiB,KAAK,CAAC;AACvB,sBAAgB,KAAK,GAAG;AAAA,IAC1B;AAAA,EACF;AAEA,MAAI,gBAAgB,WAAW,GAAG;AAChC,WAAO,EAAE,SAAS,WAAW,EAAE;AAAA,EACjC;AAEA,QAAM,aAAa,iBAAiB,iBAAiB,YAAY;AACjE,QAAM,YAAY,KAAK,IAAI;AAE3B,MAAI,WAAW;AACf,QAAM,aAAa,IAAI,gBAAgB;AAYvC,MAAI;AACJ,QAAM,eAAe,IAAI,QAAc,CAAC,YAAY;AAClD,qBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW;AACX,eAAW,MAAM;AACjB,mBAAe,IAAI;AAAA,EACrB,GAAG,SAAS;AAEZ,MAAI;AACF,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF;AACA,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjC,YAAY;AAAA,QACV,CAAC,OAAO,EAAE,MAAM,MAAe,QAAQ,EAAE;AAAA;AAAA;AAAA,QAGzC,OAAO,EAAE,MAAM,MAAe,QAAQ,EAAE,SAAS,MAAM,WAAW,KAAK,EAAE;AAAA,MAC3E;AAAA,MACA,aAAa,KAAK,OAAO,EAAE,MAAM,MAAe,EAAE;AAAA,IACpD,CAAC;AACD,UAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,QAAI,CAAC,QAAQ,MAAM;AAIjB,iBAAW,OAAO,kBAAkB;AAClC,gBAAQ,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE;AAAA,MACzD;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AAEA,UAAM,YAAY,QAAQ;AAM1B,QAAI,YAAY,CAAC,UAAU,SAAS;AAClC,iBAAW,OAAO,kBAAkB;AAClC,gBAAQ,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE;AAAA,MACzD;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AAEA,QAAI,CAAC,UAAU,SAAS;AACtB,iBAAW,OAAO,kBAAkB;AAClC,gBAAQ,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,sBAAsB,EAAE;AAAA,MACrE;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AAEA,UAAM,SAAS,0BAA0B,UAAU,SAAS,gBAAgB,MAAM;AAClF,QAAI,CAAC,QAAQ;AACX,iBAAW,OAAO,kBAAkB;AAClC,gBAAQ,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,mBAAmB,EAAE;AAAA,MAClE;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AAEA,aAAS,IAAI,GAAG,IAAI,iBAAiB,QAAQ,KAAK;AAChD,YAAM,WAAW,iBAAiB,CAAC;AACnC,UAAI,aAAa,OAAW;AAC5B,YAAM,QAAQ,OAAO,IAAI,CAAC;AAC1B,UAAI,OAAO;AACT,gBAAQ,QAAQ,IAAI;AAAA,UAClB,IAAI;AAAA,UACJ,SAAS,MAAM;AAAA,UACf,OAAO,UAAU,aAAa;AAAA,UAC9B,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,QAC1D;AAAA,MACF,OAAO;AAEL,gBAAQ,QAAQ,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,mBAAmB,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,UAAU;AAAA,EAC9B,SAAS,KAAK;AACZ,UAAM,YAAY,KAAK,IAAI,IAAI;AAC/B,QAAI,YAAY,aAAa,GAAG,GAAG;AACjC,iBAAW,OAAO,kBAAkB;AAClC,gBAAQ,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE;AAAA,MACzD;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AACA,QAAI;AAAA,MACF,4DAA4D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC9G;AACA,eAAW,OAAO,kBAAkB;AAClC,cAAQ,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,sBAAsB,EAAE;AAAA,IACrE;AACA,WAAO,EAAE,SAAS,UAAU;AAAA,EAC9B,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAEA,SAAS,aAAa,KAAuB;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,QAAQ;AACd,SACE,MAAM,SAAS,gBACf,MAAM,YAAY,gCAClB,MAAM,YAAY;AAEtB;AA4BO,SAAS,6BAAuD;AACrE,SAAO,EAAE,UAAU,GAAG,cAAc,GAAG,aAAa,GAAG,WAAW,GAAG,eAAe,EAAE;AACxF;AAyBA,IAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EAAM;AAAA,EAAI;AAAA,EAAK;AAAA,EAAM;AAAA,EAAK;AAAA,EAAM;AAAA,EAAK;AAAA,EAAM;AAAA,EAAM;AAAA,EAAO;AAAA,EAAK;AAAA,EAAO;AAAA,EACpE;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAM;AAAA,EAAO;AAAA,EAAO;AAAA,EAAK;AAAA,EAAK;AAAA,EAAK;AAAA,EAAM;AAAA,EAAO;AAAA,EACzE;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAI;AAAA,EAAM;AAAA,EAAK;AAAA,EAAM;AAAA,EAAK;AAAA,EAAO;AAAA,EAAK;AAAA,EAAO;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAC/E;AAAA,EAAM;AAAA,EAAO;AAAA,EAAM;AAAA,EAAK;AAAA,EAAO;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAM;AAAA,EACjF;AAAA,EAAI;AAAA,EAAO;AAAA,EAAS;AAAA,EAAO;AAAA,EAAK;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AACrF,CAAC;AAQD,SAAS,UAAU,MAAsB;AACvC,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,KAAK,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACpE,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,IAAI,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACnE,MAAI,KAAK,SAAS,KAAM,KAAK,SAAS,GAAG,KAAM,CAAC,KAAK,SAAS,IAAI,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAC5F,SAAO;AACT;AAMA,SAAS,SAAS,MAA2B;AAC3C,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,OAAO,KAAK,YAAY,EAAE,MAAM,YAAY,GAAG;AACxD,QAAI,IAAI,UAAU,EAAG;AACrB,QAAI,UAAU,IAAI,GAAG,EAAG;AACxB,WAAO,IAAI,UAAU,GAAG,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAOA,SAAS,mBAAmB,GAAgB,GAAwB;AAClE,MAAI,EAAE,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO;AACzC,MAAI,eAAe;AACnB,QAAM,CAAC,OAAO,KAAK,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;AACxD,aAAW,KAAK,MAAO,KAAI,MAAM,IAAI,CAAC,EAAG;AACzC,SAAO,eAAe,MAAM;AAC9B;AAOA,IAAM,2BAA2B;AAwB1B,SAAS,qBACd,YACA,OACA,cASA,eACoB;AACpB,MAAI,CAAC,cAAc,CAAC,SAAS,EAAE,eAAe,GAAI,QAAO;AACzD,MAAI;AACJ,MAAI,kBAAkB,UAAa,iBAAiB,GAAG;AACrD,UAAM,KAAK,WAAW,QAAQ,OAAO,aAAa;AAGlD,UAAM,MAAM,IAAI,KAAK,WAAW,QAAQ,KAAK;AAAA,EAC/C,OAAO;AACL,UAAM,WAAW,QAAQ,KAAK;AAAA,EAChC;AACA,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,WAAW,MAAM,MAAM;AAC7B,QAAM,SAAS,KAAK,OAAO,MAAM,YAAY,CAAC;AAC9C,QAAM,OAAO,KAAK,MAAM,eAAe,CAAC;AACxC,MAAI,QAAQ,KAAK,IAAI,GAAG,SAAS,IAAI;AACrC,QAAM,MAAM,KAAK,IAAI,WAAW,QAAQ,QAAQ,YAAY;AAE5D,UAAQ,KAAK,IAAI,GAAG,MAAM,YAAY;AACtC,QAAM,SAAS,WAAW,MAAM,OAAO,GAAG,EAAE,KAAK;AACjD,SAAO,OAAO,SAAS,IAAI,SAAS;AACtC;AA2BA,SAAS,sBAAsB,YAAuC;AACpE,QAAM,aAAgC,CAAC;AACvC,QAAM,KAAK;AACX,MAAI,UAAU;AACd,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,UAAU,OAAO,MAAM;AACzC,kBAAc,YAAY,YAAY,SAAS,EAAE,KAAK;AACtD,cAAU,GAAG;AAAA,EACf;AACA,gBAAc,YAAY,YAAY,SAAS,WAAW,MAAM;AAChE,SAAO;AACT;AAEA,SAAS,cACP,KACA,QACA,OACA,KACM;AACN,QAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AACnC,QAAM,YAAY,IAAI,SAAS,IAAI,UAAU,EAAE;AAC/C,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,SAAS,GAAG;AACtB,QAAI,KAAK,EAAE,MAAM,SAAS,OAAO,QAAQ,UAAU,CAAC;AAAA,EACtD;AACF;AAOA,SAAS,oBAAoB,YAAyB,WAA6B;AACjF,QAAM,QAAQ,UAAU,YAAY;AACpC,QAAM,SAAS;AACf,QAAM,YAAsB,CAAC;AAC7B,MAAI;AACJ,UAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,MAAM;AACxC,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,KAAK,UAAU,EAAG;AACtB,QAAI,UAAU,IAAI,IAAI,EAAG;AACzB,QAAI,WAAW,IAAI,UAAU,IAAI,CAAC,GAAG;AACnC,gBAAU,KAAK,EAAE,KAAK;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AACT;AAaA,SAAS,cACP,MACA,kBACA,UACiC;AACjC,MAAI,iBAAiB,WAAW,GAAG;AAGjC,UAAMA,OAAM,KAAK,IAAI,KAAK,QAAQ,QAAQ;AAC1C,WAAO,EAAE,MAAM,KAAK,MAAM,GAAGA,IAAG,GAAG,OAAO,EAAE;AAAA,EAC9C;AAOA,MAAI,aAAa,iBAAiB,CAAC;AACnC,MAAI,YAAY;AAChB,MAAI,WAAW;AACf,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,iBAAiB,QAAQ,KAAK;AAChD,UAAM,SAAS,iBAAiB,CAAC;AACjC,UAAM,SAAS,SAAS;AACxB,QAAI,IAAI,EAAG,KAAI;AACf,WAAO,IAAI,IAAI,iBAAiB,UAAU,iBAAiB,IAAI,CAAC,IAAK,QAAQ;AAC3E;AAAA,IACF;AACA,UAAM,QAAQ,IAAI,IAAI;AACtB,QAAI,QAAQ,WAAW;AACrB,kBAAY;AACZ,mBAAa;AACb,iBAAW,iBAAiB,CAAC;AAAA,IAC/B;AAAA,EACF;AAGA,QAAM,SAAS,KAAK,OAAO,aAAa,YAAY,CAAC;AACrD,QAAM,OAAO,KAAK,MAAM,WAAW,CAAC;AACpC,MAAI,QAAQ,KAAK,IAAI,GAAG,SAAS,IAAI;AACrC,QAAM,MAAM,KAAK,IAAI,KAAK,QAAQ,QAAQ,QAAQ;AAElD,UAAQ,KAAK,IAAI,GAAG,MAAM,QAAQ;AAClC,SAAO,EAAE,MAAM,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM;AAC/C;AAEO,SAAS,gBACd,UACA,YACA,gBAAgB,KACU;AAC1B,MAAI,CAAC,YAAY,CAAC,WAAY,QAAO;AACrC,QAAM,aAAa,SAAS,QAAQ;AACpC,MAAI,WAAW,SAAS,EAAG,QAAO;AAClC,QAAM,aAAa,sBAAsB,UAAU;AACnD,MAAI,WAAW,WAAW,EAAG,QAAO;AAOpC,MAAI,OAAmF;AACvF,WAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AAC1C,UAAM,YAAY,WAAW,CAAC;AAC9B,UAAM,QAAQ,mBAAmB,YAAY,SAAS,UAAU,IAAI,CAAC;AACrE,UAAM,WAAW,IAAI,IAAI,WAAW,IAAI,CAAC,EAAG,OAAO;AACnD,UAAM,cAAc,WAAW,GAAG,QAAQ,IAAI,UAAU,IAAI,KAAK,UAAU;AAC3E,UAAM,eAAe,mBAAmB,YAAY,SAAS,WAAW,CAAC;AACzE,QACE,CAAC,QACD,QAAQ,KAAK,SACZ,UAAU,KAAK,SAAS,eAAe,KAAK,cAC7C;AACA,aAAO,EAAE,WAAW,OAAO,aAAa;AAAA,IAC1C;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,KAAK,QAAQ,yBAA0B,QAAO;AAC3D,QAAM,EAAE,MAAM,MAAM,IAAI,KAAK;AAC7B,MAAI,KAAK,UAAU,eAAe;AAChC,WAAO,EAAE,OAAO,MAAM,QAAQ,MAAM;AAAA,EACtC;AAKA,QAAM,UAAU,oBAAoB,YAAY,IAAI;AACpD,QAAM,MAAM,cAAc,MAAM,SAAS,aAAa;AACtD,SAAO,EAAE,OAAO,IAAI,MAAM,QAAQ,QAAQ,IAAI,MAAM;AACtD;AACA,eAAsB,yBACpB,OACA,MACA,QACA,UACA,aACA,UAOA,aAAa,IACoC;AAKjD,QAAM,SAAiE,CAAC;AACxE,WAAS,KAAK,GAAG,KAAK,MAAM,QAAQ,MAAM;AACxC,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,CAAC,KAAK,OAAO,EAAE,YAAY,YAAY,CAAC,EAAE,QAAQ,KAAK,EAAG;AAO9D,UAAM,UAAU,MAAM,QAAQ,EAAE,OAAO,IAAI,EAAE,UAAU,CAAC;AACxD,UAAM,eAAe,QAClB,IAAI,CAAC,MAAO,KAAK,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,KAAK,IAAI,EAAG,EACnE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC7B,UAAM,uBAAuB,aAAa,WAAW;AACrD,QAAI;AACJ,QAAI;AACJ,QAAI,aAAa,SAAS,GAAG;AAC3B,cAAQ,aAAa,KAAK,IAAI;AAAA,IAChC,OAAO;AAIL,YAAM,UAAU,gBAAgB,EAAE,SAAS,UAAU;AACrD,UAAI,CAAC,QAAS;AACd,cAAQ,QAAQ;AAChB,sBAAgB,QAAQ;AAAA,IAC1B;AAKA,UAAM,kBACJ,uBACI;AAAA,MACE;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,IACF,IACA;AACN,WAAO,KAAK;AAAA,MACV,WAAW;AAAA,MACX,OAAO;AAAA,QACL,UAAU,EAAE;AAAA,QACZ;AAAA,QACA,GAAI,kBAAkB,EAAE,SAAS,gBAAgB,IAAI,CAAC;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,qBAAqB,oBAAI,IAAgC;AAC/D,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,QAAQ,OAAO,CAAC;AACtB,UAAI,MAAO,oBAAmB,IAAI,MAAM,WAAW,MAAM,QAAQ,CAAC,CAAE;AAAA,IACtE;AAKA,QAAI;AAAA,MACF,2BAA2B,IAAI,MAAM,OAAO,MAAM,mBAAmB,MAAM,SAAS;AAAA,IACtF;AAAA,EACF,SAAS,KAAK;AAOZ,QAAI;AAAA,MACF,oDAAoD,OAAO,MAAM,8CAA8C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACjK;AACA,eAAW,EAAE,UAAU,KAAK,QAAQ;AAClC,yBAAmB,IAAI,WAAW,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,sBAAsB,EAAE,CAAC;AAAA,IACzF;AAAA,EACF;AACA,SAAO;AACT;AAcO,SAAS,yBACd,oBACA,eACA,MACA,aACA,UAIA;AACA,MAAI,CAAC,oBAAoB;AACvB,WAAO,EAAE,cAAc,QAAW,eAAe,OAAU;AAAA,EAC7D;AACA,QAAM,SAAS,mBAAmB,IAAI,aAAa;AACnD,MAAI,CAAC,QAAQ;AAEX,aAAS;AACT,WAAO;AAAA,MACL,cAAc,EAAE,SAAS,mBAAmB,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,MACzE,eAAe;AAAA,IACjB;AAAA,EACF;AACA,MAAI,OAAO,IAAI;AACb,QAAI,OAAO,YAAY,WAAY,UAAS;AAAA,aACnC,OAAO,YAAY,eAAgB,UAAS;AAAA,aAC5C,OAAO,YAAY,cAAe,UAAS;AACpD,UAAM,KAA8B;AAAA,MAClC,SAAS,OAAO;AAAA,MAChB,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MAC9C,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,MAC1D,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7B;AACA,QAAI;AACJ,QACE,SAAS,cACR,OAAO,YAAY,iBAAiB,OAAO,YAAY,iBACxD;AACA,sBAAgB;AAChB,UAAI;AAAA,QACF,8CAA8C,YAAY,MAAM,GAAG,EAAE,CAAC,sCAAiC,OAAO,OAAO;AAAA,MACvH;AAAA,IACF;AACA,WAAO,EAAE,cAAc,IAAI,cAAc;AAAA,EAC3C;AAEA,WAAS;AACT,SAAO;AAAA,IACL,cAAc,EAAE,SAAS,aAAa,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IACnE,eAAe;AAAA,EACjB;AACF;AASA,IAAM,yBAAyB,CAAC,WAAW,SAAS,aAAa,IAAI;AAS9D,SAAS,4BAA4B,IAAuB,OAAuB;AACxF,MAAI,CAAC,GAAG,aAAc;AACtB,QAAM,MAAM,GAAG;AACf,QAAM,YAAqC,CAAC;AAC5C,aAAW,OAAO,wBAAwB;AACxC,UAAM,MAAM,IAAI,GAAG;AACnB,QAAI,QAAQ,UAAa,QAAQ,QAAQ,QAAQ,IAAI;AACnD,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AAEA,MAAI,CAAC,UAAU,QAAS;AACxB,QAAM,KAAK,iBAAiB,KAAK,UAAU,SAAS,CAAC,EAAE;AACzD;AAOO,SAAS,uBACd,KACqC;AACrC,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AACvE,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,UAAM,MAAM;AACZ,UAAM,aAAa,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AACnE,QAAI,CAAC,WAAY,QAAO;AACxB,UAAM,gBAAgB,oBAAI,IAAI;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,CAAC,cAAc,IAAI,UAAU,EAAG,QAAO;AAC3C,UAAM,SAAkC;AAAA,MACtC,SAAS;AAAA,IACX;AACA,QAAI,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,SAAS,GAAG;AACzD,aAAO,QAAQ,IAAI;AAAA,IACrB;AACA,QAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,SAAS,GAAG;AACjE,aAAO,YAAY,IAAI,UAAU,MAAM,GAAG,GAAG;AAAA,IAC/C;AACA,QAAI,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,SAAS,GAAG;AACnD,aAAO,KAAK,IAAI;AAAA,IAClB;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["end"]}

package/dist/{chunk-67HG7KFE.js → chunk-6YKIYQU7.js}

@@ -15,7 +15,7 @@ import {
 } from "./chunk-O75CRYGF.js";
 import {
   coerceInstallExtension
-} from "./chunk-RVLB4E6N.js";
+} from "./chunk-PHK3HARR.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -2254,4 +2254,4 @@ export {
   resolveWeCloneProxyConfigPath,
   buildWeCloneProxyConfig
 };
-//# sourceMappingURL=chunk-67HG7KFE.js.map
+//# sourceMappingURL=chunk-6YKIYQU7.js.map

package/dist/{chunk-LXSG4L55.js → chunk-7CTNUVHZ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SOBJ6NEY.js";
 import {
   summarizeDisclosureTokens
-} from "./chunk-L5ASZA2F.js";
+} from "./chunk-GJSL4WG2.js";
 import {
   summarizeRetrievedMemoryProvenance
 } from "./chunk-I4WBNM3M.js";
@@ -587,4 +587,4 @@ export {
   renderRecallExplain,
   parseRecallExplainFormat
 };
-//# sourceMappingURL=chunk-LXSG4L55.js.map
+//# sourceMappingURL=chunk-7CTNUVHZ.js.map

package/dist/{chunk-UCJ5CDTK.js → chunk-A5XNBK2D.js}

@@ -1,6 +1,6 @@
 import {
   listNamespaces
-} from "./chunk-YTZLBBEB.js";
+} from "./chunk-EEJMD2L2.js";
 import {
   runConsolidationProvenanceCheck
 } from "./chunk-7XH7VJN4.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-YBPYIAA5.js";
 import {
   summarizeNamespaceMaintenanceHealth
-} from "./chunk-REWQAFSA.js";
+} from "./chunk-PD42EYQN.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -35,17 +35,22 @@ import {
 } from "./chunk-3PY7VHV7.js";
 import {
   parseConfig
-} from "./chunk-A5TUPZ3N.js";
+} from "./chunk-4SF232E6.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-2PTBLS2S.js";
+} from "./chunk-EDOQM4E4.js";
+import {
+  resolveAccessSetupCapabilities,
+  resolveCapabilities,
+  resolveGraphConstructionCapabilities
+} from "./chunk-DVRHLN2O.js";
 import {
   analyzeGraphHealth
-} from "./chunk-YGKUAX2B.js";
+} from "./chunk-EHQ5HO5T.js";
 import {
   StorageManager
-} from "./chunk-YYOK4GVF.js";
+} from "./chunk-EVPNWN7Z.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -453,6 +458,7 @@ async function runOperatorConfigReview(options) {
 }
 async function buildOperatorConfigReviewReport(input) {
   const { now, configStatus, config } = input;
+  const caps = resolveCapabilities(config);
   const findings = [];
   const searchBackend = config.searchBackend ?? "qmd";
   const workspaceBootstrapFiles = [
@@ -461,7 +467,7 @@ async function buildOperatorConfigReviewReport(input) {
     path.join(config.workspaceDir, "USER.md")
   ];
   const workspaceBootstrapExists = (await Promise.all(workspaceBootstrapFiles.map(pathExists))).some(Boolean);
-  if (config.memoryOsPreset !== "conservative" && config.memoryOsPreset !== "balanced" && config.memoryOsPreset !== "research-max" && config.memoryOsPreset !== "local-llm-heavy" && config.queryAwareIndexingEnabled === false && config.verbatimArtifactsEnabled === false && config.rerankEnabled === false) {
+  if (config.memoryOsPreset !== "conservative" && config.memoryOsPreset !== "balanced" && config.memoryOsPreset !== "research-max" && config.memoryOsPreset !== "local-llm-heavy" && config.queryAwareIndexingEnabled === false && config.verbatimArtifactsEnabled === false && !caps.rerank) {
     findings.push(buildConfigReviewFinding({
       key: "balanced_preset",
       status: "recommend",
@@ -833,7 +839,7 @@ async function summarizeBufferSurpriseDistribution(storage, config) {
   }
 }
 async function summarizeGraphEdgeDecayStatus(config) {
-  const { readGraphEdgeDecayStatus } = await import("./graph-edge-decay-JLOF3YW4.js");
+  const { readGraphEdgeDecayStatus } = await import("./graph-edge-decay-QPRJQ7DL.js");
   const enabled = config.graphEdgeDecayEnabled === true;
   if (!enabled) {
     return {
@@ -994,8 +1000,9 @@ async function summarizeDreamsPhases(config, storage = new StorageManager(config
   };
 }
 function summarizeSecurityMitigations(config) {
-  const budgetEnabled = config.recallCrossNamespaceBudgetEnabled === true;
-  const anomalyEnabled = config.recallAuditAnomalyDetectionEnabled === true;
+  const accessCaps = resolveAccessSetupCapabilities(config);
+  const budgetEnabled = accessCaps.recallCrossNamespaceBudget;
+  const anomalyEnabled = accessCaps.recallAuditAnomalyDetection;
   if (!budgetEnabled && !anomalyEnabled) {
     return {
       key: "security_mitigations",
@@ -1407,10 +1414,11 @@ async function runOperatorRepair(options) {
   const sessionRepairApply = await applySessionRepair({
     plan: sessionRepairPlan
   });
+  const graphCaps = resolveGraphConstructionCapabilities(options.config);
   const graphHealth = await analyzeGraphHealth(options.config.memoryDir, {
-    entityGraphEnabled: options.config.entityGraphEnabled,
-    timeGraphEnabled: options.config.timeGraphEnabled,
-    causalGraphEnabled: options.config.causalGraphEnabled,
+    entityGraphEnabled: graphCaps.entityGraph,
+    timeGraphEnabled: graphCaps.timeGraph,
+    causalGraphEnabled: graphCaps.causalGraph,
     includeRepairGuidance: true
   });
   return {
@@ -1440,4 +1448,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-UCJ5CDTK.js.map
+//# sourceMappingURL=chunk-A5XNBK2D.js.map