@remnic/core 9.3.726 → 9.3.727

package/src/orchestrator.ts

@@ -2771,16 +2771,28 @@ export class Orchestrator {
     dedupContent: string,
     bounds: {
       invalidAt?: string;
+      // #1707 thread 2 — per-fact start bound (valid_at). Carried so a
+      // re-extracted duplicate whose event time yields only a start bound
+      // ("since 2024", "yesterday", an absolute date) gets the corrected
+      // per-fact anchoring onto the existing copy.
+      validFrom?: string;
       observedAt?: string;
       eventTimeSource?: "extracted" | "assumed";
     },
     entityRef?: string,
   ): Promise<void> {
-    // I/O gate: only scan when there is an end bound to backfill. Without
-    // invalidAt there is nothing that changes recall behavior — observedAt
-    // and eventTimeSource alone do not expire a fact. This avoids a full
-    // readAllMemories on every dedup short-circuit under biTemporal.
-    if (!bounds.invalidAt) return;
+    // I/O gate: scan when there is a recall-relevant bound to backfill —
+    // either an end bound (invalidAt, which expires the fact) or a corrected
+    // EXTRACTED start bound. A start bound only changes recall when it is
+    // extracted (the as-of filter excludes facts whose valid_at is after the
+    // as-of instant); an "assumed" validFrom is just the ingestion anchor
+    // (resolveFactEventTime sets one for every fact), so scanning on it would
+    // run a full readAllMemories on every bi-temporal dedup hit for no benefit
+    // (review cursor PRRT_OvHk / codex PRRT_OvHxVH). observedAt and
+    // eventTimeSource alone never change recall.
+    const hasExtractedStart =
+      bounds.validFrom !== undefined && bounds.eventTimeSource === "extracted";
+    if (!bounds.invalidAt && !hasExtractedStart) return;
     try {
       const incomingHash = ContentHashIndex.computeHash(dedupContent);
       const normalizedIncoming = ContentHashIndex.normalizeContent(dedupContent);
@@ -2839,6 +2851,37 @@ export class Orchestrator {
       ) {
         patch.eventTimeSource = bounds.eventTimeSource;
       }
+      // #1707 thread 2 — per-fact-anchored start bound. A re-extracted
+      // duplicate whose event time resolves a real start bound must carry
+      // that anchor onto the existing copy so as-of recall uses the corrected
+      // valid_at instead of a stale batch-anchored value. Only an EXTRACTED
+      // bound corrects; an "assumed" bound is just the ingestion anchor.
+      //
+      // No-clobber via equality, not provenance inference: exact-content dedup
+      // re-extracts the SAME event-time expression, which #1670 per-fact
+      // anchoring resolves deterministically to the same validFrom — so for
+      // stable content the incoming validFrom EQUALS the copy's valid_at and
+      // we skip the redundant write (the only no-clobber that holds without a
+      // fragile provenance heuristic — review codex PRRT_Ov7LKC). When they
+      // differ (a prior batch/assumed anchor, end-only assumed start, or a
+      // non-deterministic re-resolution), the extracted validFrom is the
+      // authoritative correction and overwrites. The eventTimeSource upgrade
+      // below records that the start is now extracted-anchored.
+      if (
+        bounds.validFrom &&
+        bounds.eventTimeSource === "extracted" &&
+        fm.valid_at !== bounds.validFrom
+      ) {
+        patch.valid_at = bounds.validFrom;
+        // Mark the copy extracted-anchored in the SAME patch so its provenance
+        // reflects the correction (review cursor PRRT_OvHM / codex PRRT_OvHxVD):
+        // without this, a copy upgraded from "assumed" would keep "assumed"
+        // provenance while carrying an extracted start. (The earlier
+        // eventTimeSource block only fills an EMPTY source.)
+        if (fm.eventTimeSource !== "extracted") {
+          patch.eventTimeSource = "extracted";
+        }
+      }
       if (Object.keys(patch).length === 0) return;
       const ok = await targetStorage.writeMemoryFrontmatter(existing, patch);
       if (ok) {
@@ -14302,12 +14345,14 @@ export class Orchestrator {
             // lacks (re-extraction with a now-resolved invalidAt). Best-effort,
             // fail-open; the helper gates on invalidAt to avoid I/O when no
             // end bound is present.
-            if (options.invalidAt) {
+            if (options.invalidAt || options.validAt) {
               await this.backfillTemporalBoundsOnDedupHit(
                 targetStorage,
                 dedupContent,
                 {
                   invalidAt: options.invalidAt,
+                  // #1707 thread 2 — carry the corrected start bound.
+                  validFrom: options.validAt,
                   ...(options.observedAt ? { observedAt: options.observedAt } : {}),
                   ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
                 },
@@ -14481,12 +14526,14 @@ export class Orchestrator {
           // before the supersession short-circuit. Covers all return paths below
           // (supersession-hit, catch-skip, and the no-supersession short-circuit)
           // in one shot. Best-effort / fail-open; the helper gates on invalidAt.
-          if (options.invalidAt) {
+          if (options.invalidAt || options.validAt) {
             await this.backfillTemporalBoundsOnDedupHit(
               sharedStorage,
               dedupContent,
               {
                 invalidAt: options.invalidAt,
+                // #1707 thread 2 — carry the corrected start bound.
+                validFrom: options.validAt,
                 ...(options.observedAt ? { observedAt: options.observedAt } : {}),
                 ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
               },
@@ -14717,6 +14764,116 @@ export class Orchestrator {
         );
       }
     };
+    // #1707 thread 1 — backfill temporal bounds onto promotion copies when the
+    // SOURCE-namespace dedup short-circuit fires. That branch patches the
+    // source copy then `continue`s before the promotion dedup paths run, so
+    // promoted shared/profile copies written before the source fact carried
+    // resolved bounds stay stale (cross-namespace recall surfaces an expired
+    // fact). This mirrors the promotion-target resolution used by the two
+    // promote closures above and calls the same fail-open helper against each
+    // target storage. Backfill-only: never writes a new promoted copy.
+    const backfillTemporalBoundsOnPromotionCopies = async (args: {
+      sourceStorage: StorageManager;
+      content: string;
+      category: string;
+      confidence: number;
+      entityRef?: string;
+      structuredAttributes?: Record<string, string>;
+      bounds: {
+        invalidAt?: string;
+        validFrom?: string;
+        observedAt?: string;
+        eventTimeSource?: "extracted" | "assumed";
+      };
+    }): Promise<void> => {
+      // Mirror the helper's I/O gate: only resolve promotion targets when
+      // there is an end bound OR an EXTRACTED start bound. An "assumed"
+      // validFrom is just the ingestion anchor (no recall effect), so
+      // skipping it avoids resolving target storages on every bi-temporal
+      // duplicate (review cursor PRRT_OvHk).
+      const hasExtractedStart =
+        args.bounds.validFrom !== undefined &&
+        args.bounds.eventTimeSource === "extracted";
+      if (!args.bounds.invalidAt && !hasExtractedStart) return;
+      // Build the same dedupContent the promotion functions hash on so the
+      // content-hash lookup in the helper matches what was stored.
+      const rawContent =
+        citationEnabled && hasCitationForTemplate(args.content, citationTemplate)
+          ? stripCitationForTemplate(args.content, citationTemplate)
+          : args.content;
+      const sanitizedBase = sanitizeMemoryContent(rawContent);
+      const dedupContent =
+        args.category === "fact" &&
+        args.structuredAttributes &&
+        Object.keys(args.structuredAttributes).length > 0
+          ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs(args.structuredAttributes)}]`
+          : sanitizedBase.text;
+      // Profile targets. NOTE: we do NOT gate on profileAutoPromotionAllows —
+      // a promoted profile copy may exist from an EARLIER extraction with
+      // higher confidence or older auto-promote settings, so the current
+      // duplicate's confidence must not skip backfilling an already-existing
+      // promoted copy (review codex PRRT_Ov7LKF). The helper no-ops when no
+      // matching copy is found, so resolving all configured auto-promote
+      // targets is safe.
+      if (scopeProfileWritePlan) {
+        const autoTargets = new Set(
+          scopeProfileWritePlan.profile.autoPromote.targets,
+        );
+        const profileTargets = scopeProfileWritePlan.promotionTargets.filter(
+          (target) =>
+            target.target !== "serverShared" &&
+            autoTargets.has(target.target) &&
+            target.authorized &&
+            target.namespace,
+        );
+        for (const target of profileTargets) {
+          if (!target.namespace) continue;
+          try {
+            const targetStorage = await this.storageRouter.storageFor(
+              target.namespace,
+            );
+            if (targetStorage.dir === args.sourceStorage.dir) continue;
+            await this.backfillTemporalBoundsOnDedupHit(
+              targetStorage,
+              dedupContent,
+              args.bounds,
+              args.entityRef,
+            );
+          } catch (err) {
+            log.warn(
+              `bitemporal-backfill: profile-target backfill failed open for ${target.target}: ${err}`,
+            );
+          }
+        }
+      }
+      // Shared target. A shared copy may exist from an earlier extraction
+      // regardless of the current confidence, so do not gate on
+      // shouldPromoteToShared (review codex PRRT_Ov7LKF) — BUT still respect
+      // shared-write AUTHORIZATION: a scoped profile that does not authorize
+      // serverShared writes must not have its shared namespace backfilled
+      // (review codex PRRT_Ov7dHR). profileAllowsSharedWrites is true for the
+      // legacy no-scope case and encodes the readable/writable/authorized
+      // checks under a scope profile.
+      if (profileAllowsSharedWrites) {
+        try {
+          const sharedStorage = await this.storageRouter.storageFor(
+            this.config.sharedNamespace,
+          );
+          if (sharedStorage.dir !== args.sourceStorage.dir) {
+            await this.backfillTemporalBoundsOnDedupHit(
+              sharedStorage,
+              dedupContent,
+              args.bounds,
+              args.entityRef,
+            );
+          }
+        } catch (err) {
+          log.warn(
+            `bitemporal-backfill: shared-target backfill failed open: ${err}`,
+          );
+        }
+      }
+    };
 
     // Defensive: validate result and facts array
     if (!result || !Array.isArray(result.facts)) {
@@ -15226,7 +15383,20 @@ export class Orchestrator {
         // Skip when the fact would be rejected/deferred/pending by downstream
         // gates — a non-durable candidate must not expire an active fact
         // (chatgpt-codex P1: faithfulness, requireSpans, extraction judge).
-        if (biTemporal && biTemporal.validUntil) {
+        // #1671 + #1707: backfill bi-temporal bounds onto the existing
+        // source-namespace copy if it lacks bounds the incoming fact now
+        // carries (re-extraction with a resolved bound). #1707 thread 3:
+        // gate on writeCategory === "fact" — the helper only matches facts,
+        // so a non-fact duplicate must not reach the fact-only scan.
+        // #1707 thread 2: also fire when only a corrected start bound
+        // (validFrom) is present, not just an end bound (validUntil). The
+        // downstream-gate skip still applies — a non-durable candidate must
+        // not expire an active fact (chatgpt-codex P1).
+        if (
+          biTemporal &&
+          writeCategory === "fact" &&
+          (biTemporal.validUntil || biTemporal.validFrom)
+        ) {
           const fr = faithfulnessResultsByFactIndex?.get(factLoopIndex);
           const faithfulnessWouldPending =
             faithfulnessMode === "enforce" &&
@@ -15254,11 +15424,33 @@ export class Orchestrator {
               contentHashDedupKey,
               {
                 invalidAt: biTemporal.validUntil,
+                // #1707 thread 2 — carry the corrected start bound too.
+                validFrom: biTemporal.validFrom,
                 observedAt: biTemporal.observedAt,
                 eventTimeSource: biTemporal.eventTimeSource,
               },
               fact.entityRef,
             );
+            // #1707 thread 1 — the source branch short-circuits (`continue`
+            // below) before the promotion dedup paths run, so promoted
+            // shared/profile copies written before the source fact carried
+            // resolved bounds stay stale and cross-namespace recall surfaces
+            // an expired fact. Backfill the promotion targets too (fail-open,
+            // backfill-only — never writes a new promoted copy).
+            await backfillTemporalBoundsOnPromotionCopies({
+              sourceStorage: targetStorage,
+              content: fact.content,
+              category: writeCategory,
+              confidence: fact.confidence,
+              entityRef: fact.entityRef,
+              structuredAttributes: fact.structuredAttributes,
+              bounds: {
+                invalidAt: biTemporal.validUntil,
+                validFrom: biTemporal.validFrom,
+                observedAt: biTemporal.observedAt,
+                eventTimeSource: biTemporal.eventTimeSource,
+              },
+            });
           }
         }
         log.debug(

package/src/provenance-extraction.test.ts

@@ -836,3 +836,269 @@ test("toStrictIsoTimestamp path: valid MM/DD/YYYY still normalizes (thread dH47
     /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
   );
 });
+
+
+// ---------------------------------------------------------------------------
+// Regression: issue #1657 — partial year-led timestamps must not be admitted
+// as fabricated complete dates. Date.parse fills in missing calendar
+// components ("2026-05" -> May 1) and the ymd guard misparses the date/time
+// boundary ("2026-05T10:00" reads the hour as the day). The normalization
+// path must reject any year-led shape with fewer than three complete calendar
+// components rather than persisting a fabricated observedAt.
+// ---------------------------------------------------------------------------
+
+test("toStrictIsoTimestamp path: partial YYYY-MM timestamp is rejected, not fabricated (issue #1657)", () => {
+  // "2026-05" is Date.parse-able (-> 2026-05-01) and passes the separator
+  // guard, so pre-fix the write path persisted a fabricated observedAt of
+  // 2026-05-01T00:00:00.000Z. Reject it so the source is dropped.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  // No verified source: the only matching turn has a partial timestamp.
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.notEqual(
+    result.sources![0]!.observedAt,
+    "2026-05-01T00:00:00.000Z",
+    "partial YYYY-MM timestamp must not fabricate May 1",
+  );
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "rejected partial timestamp falls back to epoch",
+  );
+});
+
+test("toStrictIsoTimestamp path: partial YYYY-MM T HH:MM is rejected, not misparsed (issue #1657)", () => {
+  // "2026-05T10:00" is Date.parse-able; the ymd regex grabs the hour "10" as
+  // the day across the date/time boundary, so pre-fix the write path persisted
+  // a fabricated observedAt (on May 10, shifted by timezone). Reject it.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05T10:00" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "partial YYYY-MM T HH:MM timestamp must fall back to epoch, not a fabricated date",
+  );
+});
+
+test("toStrictIsoTimestamp path: complete YYYY-MM-DD (no time) still normalizes (issue #1657 non-regression)", () => {
+  // A complete calendar date with no time component must still round-trip
+  // through Date.parse to strict ISO. This is the boundary the partial-date
+  // guard must NOT over-reject.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05-03" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "verified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    "2026-05-03T00:00:00.000Z",
+    "complete date-only timestamp normalizes to UTC midnight",
+  );
+});
+
+test("toStrictIsoTimestamp path: space-separated partial YYYY-MM HH:MM is rejected (issue #1657, codex r2)", () => {
+  // "2026-05 10:00" is Date.parse-able; the date separator must be a real
+  // date separator (- or /), not the space that precedes the time component.
+  // Pre-fix the guard treated the space as a date separator and captured the
+  // hour "10" as the day, persisting a fabricated 2026-05-(10) source.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05 10:00" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "space-separated partial timestamp must fall back to epoch, not a fabricated date",
+  );
+});
+
+test("toStrictIsoTimestamp path: leading-whitespace partial timestamp is rejected (issue #1657, codex r3)", () => {
+  // Date.parse trims leading whitespace, so " 2026-05" parses as May 1 —
+  // but the ^\d{4} guard anchored at the start would not recognize the
+  // string as year-led, bypassing the partial-date rejection. Trim first.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: " 2026-05" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "leading-whitespace partial timestamp must fall back to epoch, not a fabricated date",
+  );
+});
+
+test("toStrictIsoTimestamp path: complete year-first textual-month date is preserved (issue #1657, codex r4)", () => {
+  // A complete year-first TEXTUAL-month date ("2026-Jan-15") is normalized by
+  // Date.parse and must stay verified — the unified guard must not reject a
+  // complete textual month. Date.parse parses this non-ISO form in the LOCAL
+  // timezone, so assert the source is preserved (verified, not the epoch
+  // fallback) and normalized to strict ISO — without assuming the UTC day,
+  // which shifts across timezones (codex r7).
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Jan-15" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "verified", "complete textual-month date must stay verified");
+  assert.ok(result.sources);
+  const observedAt = result.sources![0]!.observedAt;
+  assert.match(
+    observedAt,
+    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
+    "textual-month observedAt must normalize to strict ISO",
+  );
+  assert.notEqual(
+    observedAt,
+    new Date(0).toISOString(),
+    "complete textual-month date must not fall back to the epoch (it was accepted, not rejected)",
+  );
+});
+
+test("toStrictIsoTimestamp path: partial textual year-month is rejected (issue #1657, codex r5)", () => {
+  // "2026-Jan" is Date.parse-able (-> Jan 1) — a partial year-led TEXTUAL
+  // month that must be rejected just like the numeric "2026-05", not
+  // fabricated. The unified year-led guard covers textual months too.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Jan" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "partial textual year-month must fall back to epoch, not a fabricated Jan 1",
+  );
+});
+
+test("toStrictIsoTimestamp path: partial textual year-month with time is rejected (issue #1657, codex r5)", () => {
+  // "2026-Jan 10:00" — the hour must not be captured as the day across the
+  // date/time boundary (textual analogue of "2026-05 10:00").
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Jan 10:00" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "partial textual year-month with time must fall back to epoch",
+  );
+});
+
+test("toStrictIsoTimestamp path: textual-month calendar overflow is rejected (issue #1657, codex r5)", () => {
+  // "2026-Feb-30" is a COMPLETE textual date but Feb 30 overflows — Date.parse
+  // shifts it to March 2. The unified guard validates the textual month's
+  // calendar day too, so this is rejected rather than fabricated (textual
+  // analogue of the numeric dANc overflow).
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Feb-30" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.notEqual(
+    result.sources![0]!.observedAt,
+    "2026-03-02T00:00:00.000Z",
+    "textual-month overflow must not be silently shifted to March 2",
+  );
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "textual-month overflow falls back to epoch",
+  );
+});
+
+test("toStrictIsoTimestamp path: full month name is preserved (issue #1657, codex r6)", () => {
+  // Date.parse accepts full month names ("2026-January-15"), so the textual
+  // month map must include both abbreviations and full names — otherwise a
+  // complete, valid full-name date is dropped to an unverified epoch source.
+  // Date.parse parses this non-ISO form in the LOCAL timezone, so assert the
+  // source is preserved (verified, not epoch) without a UTC-day assumption.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-January-15" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "verified", "full-name textual month must stay verified");
+  assert.ok(result.sources);
+  const observedAt = result.sources![0]!.observedAt;
+  assert.match(
+    observedAt,
+    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
+    "full-name textual month observedAt must normalize to strict ISO",
+  );
+  assert.notEqual(
+    observedAt,
+    new Date(0).toISOString(),
+    "full-name textual month must not fall back to the epoch (it was accepted, not rejected)",
+  );
+});

package/src/provenance.ts

@@ -188,33 +188,39 @@ function isStrictIsoTimestamp(s: string): boolean {
  */
 function toStrictIsoTimestamp(ts: string | undefined | null): string | undefined {
   if (typeof ts !== "string" || ts.length === 0) return undefined;
-  if (isStrictIsoTimestamp(ts)) return ts;
-  const parsed = Date.parse(ts);
+  // Trim surrounding whitespace: Date.parse accepts leading/trailing
+  // whitespace, so an imported " 2026-05" would otherwise bypass the
+  // year-led partial-date guard below and fabricate May 1
+  // (chatgpt-codex-connector review on #1714, issue #1657).
+  const value = ts.trim();
+  if (value.length === 0) return undefined;
+  if (isStrictIsoTimestamp(value)) return value;
+  const parsed = Date.parse(value);
   if (Number.isNaN(parsed)) return undefined;
   // Reject bare-year / numeric-only strings that Date.parse accepts (e.g.
   // "123") — isStrictIsoTimestamp already rejected them, and the round-trip
   // below would otherwise resurrect them. Require at least one date/time
   // separator so a plain number never round-trips into a fake epoch.
-  if (!/[-:T]/.test(ts)) return undefined;
-  // Reject calendar-overflow dates (chatgpt-codex-connector thread dANc):
-  // Date.parse silently rolls over invalid components — "2026-02-30" becomes
-  // 2026-03-02 — fabricating the observation date. For strings that carry an
-  // explicit numeric Y/M/D prefix (the common import/provider shape), validate
-  // the calendar components are in range before accepting the shifted result.
-  // isStrictIsoTimestamp already does this for full ISO strings; this closes
-  // the gap for the non-ISO normalization path.
-  const ymd = /^(\d{4})\D(\d{1,2})\D(\d{1,2})/.exec(ts);
-  if (ymd) {
-    const [_, ys, ms, ds] = ymd;
-    const y = Number(ys), mo = Number(ms), da = Number(ds);
-    if (!isValidCalendarDate(y, mo, da)) return undefined;
+  if (!/[-:T]/.test(value)) return undefined;
+  // Reject year-led timestamps that are not a COMPLETE, calendar-valid date
+  // (issue #1657). Date.parse silently fills missing components ("2026-05" ->
+  // May 1, "2026-Jan" -> Jan 1) and rolls overflow ("2026-02-30" and
+  // "2026-Feb-30" -> March 2), fabricating observedAt. `parseYearLedDatePrefix`
+  // requires a complete three-component date — numeric OR textual month — with
+  // real date separators (not T/:, and not the space that precedes a time
+  // component, so the hour is never captured as the day) and a calendar-valid
+  // day, in one rule (subsumes the prior partial-numeric and numeric-overflow
+  // checks, and extends them to textual months). Non-year-led shapes
+  // ("Jan 15 2026", "02/30/2026") fall through to Date.parse / the mdy check.
+  if (/^\d{4}\D/.test(value) && parseYearLedDatePrefix(value) === null) {
+    return undefined;
   }
   // Also validate M/D/Y or D/M/Y formats (provider/import common shapes:
   // 02/30/2026, 30-02-2026, etc.). Date.parse silently shifts overflow in
   // these too. Try both month-first and day-first interpretations; if
   // neither is a valid calendar date, reject (chatgpt-codex-connector thread
   // dH47 — non-YMD overflow timestamps).
-  const mdy = /^(\d{1,2})\D(\d{1,2})\D(\d{4})/.exec(ts);
+  const mdy = /^(\d{1,2})\D(\d{1,2})\D(\d{4})/.exec(value);
   if (mdy) {
     const a = Number(mdy[1]), b = Number(mdy[2]), yr = Number(mdy[3]);
     if (!isValidCalendarDate(yr, a, b) && !isValidCalendarDate(yr, b, a)) {
@@ -238,6 +244,50 @@ function isValidCalendarDate(y: number, mo: number, da: number): boolean {
   return da <= daysInMonth[mo - 1]!;
 }
 
+/**
+ * Recognized month-name → number map for year-led textual-month dates
+ * (issue #1657). Both the 3-letter abbreviations and the full names that
+ * Date.parse accepts for year-first shapes (e.g. "2026-Jan-15",
+ * "2026-January-15", "2026 February 2").
+ */
+const MONTH_NAMES: Record<string, number> = {
+  jan: 1, january: 1,
+  feb: 2, february: 2,
+  mar: 3, march: 3,
+  apr: 4, april: 4,
+  may: 5,
+  jun: 6, june: 6,
+  jul: 7, july: 7,
+  aug: 8, august: 8,
+  sep: 9, september: 9,
+  sept: 9,
+  oct: 10, october: 10,
+  nov: 11, november: 11,
+  dec: 12, december: 12,
+};
+
+/**
+ * Parse a complete, calendar-valid year-led date prefix from `s`
+ * (issue #1657): `YYYY <sep> (MM | MonthName) <sep> DD` where the separators
+ * are real date separators (non-digit, non-T, non-colon) and the day is a
+ * true calendar day — not the hour before a `:` time separator (the
+ * `(?![\d:])` lookahead rejects "2026-05 10:00" capturing "10" as the day).
+ * Returns the numeric components for a complete, valid date; `null` for an
+ * incomplete ("2026-05", "2026-Jan"), overflowed ("2026-02-30",
+ * "2026-Feb-30"), or non-year-led prefix. Centralizes the fabricated-date
+ * rejection for the toStrictIsoTimestamp normalization path across numeric
+ * and textual months in one rule.
+ */
+function parseYearLedDatePrefix(s: string): { y: number; mo: number; da: number } | null {
+  const m = /^(\d{4})[^0-9T](\d{1,2}|[A-Za-z]{3,})[^0-9T:](\d{1,2})(?![\d:])/.exec(s);
+  if (!m) return null;
+  const y = Number(m[1]);
+  const da = Number(m[3]);
+  const mo = /^\d+$/.test(m[2]) ? Number(m[2]) : (MONTH_NAMES[m[2]!.toLowerCase()] ?? -1);
+  if (!isValidCalendarDate(y, mo, da)) return null;
+  return { y, mo, da };
+}
+
 /**
  * Zod schema for a single `ProvenanceSource` entry (issue #1575).  Parsed
  * JSON from frontmatter is external data, so each entry is validated here

package/src/types.ts

@@ -1222,6 +1222,14 @@ export interface PluginConfig {
   extractionFaithfulnessContextChars: number;
   /** Per-batch timeout in ms; timeout → tagged error, never blocks writes. Default 8000. */
   extractionFaithfulnessTimeoutMs: number;
+  /**
+   * Resilient-fallback toggle for the local model-lab endpoint (issue #1700
+   * nit #6). When the local endpoint returns 200 with non-verdict JSON, the
+   * default (false) surfaces `malformed_output` so a misconfigured endpoint is
+   * visible to the operator. Set true to instead fall back to the configured
+   * chain on local parse failure (pre-validated via parseFaithfulnessResponse).
+   */
+  extractionFaithfulnessLocalParseFallback: boolean;
   /**
    * Correction-intent model-lab pointer (issue #1581 / #1585). When both this
    * and `correctionIntentBaseUrl` are set, the detection path can route to a