@remnic/core 9.54.8 → 9.56.0

package/src/orchestration/extraction-injection-gate.ts

@@ -0,0 +1,154 @@
+/**
+ * Pure issue #1955 injection-screen gate for extracted facts.
+ */
+
+import { normalizeAttributePairs } from "../structured-attributes.js";
+import { buildProcedurePersistBody } from "../procedural/procedure-types.js";
+import { screenCandidateFact } from "../security/injection-screen.js";
+import type { EntityStructuredSection } from "../types.js";
+
+export interface InjectionScreenCandidate {
+  content: string;
+  category?: string;
+  structuredAttributes?: Record<string, unknown>;
+  procedureSteps?: unknown;
+}
+
+export interface InjectionScreenGateResult {
+  status?: "pending_review";
+  tags: string[];
+}
+
+/** Serialize the body fields that the persistence path will store. */
+export function serializeInjectionScreenCandidate(candidate: InjectionScreenCandidate): string {
+  const body =
+    candidate.category === "procedure"
+      ? buildProcedurePersistBody(candidate.content, candidate.procedureSteps)
+      : candidate.content;
+  // Salvage malformed extractor output: non-string attribute values (e.g.
+  // `{ priority: 1 }`) must not throw and abort the whole extraction batch
+  // (#1955 review). Coerce primitives; drop anything else.
+  const attrs = Object.fromEntries(
+    Object.entries(candidate.structuredAttributes ?? {}).flatMap(([key, value]): Array<[string, string]> => {
+      if (typeof value === "string") return [[key, value]];
+      if (typeof value === "number" || typeof value === "boolean") return [[key, String(value)]];
+      return [];
+    }),
+  );
+  return Object.keys(attrs).length > 0
+    ? `${body}\n[Attributes: ${normalizeAttributePairs(attrs)}]`
+    : body;
+}
+
+/** Screen one candidate and assemble the persistence effects. */
+export function evaluateInjectionScreen(
+  candidate: InjectionScreenCandidate | string,
+  enabled: boolean,
+): InjectionScreenGateResult {
+  if (!enabled) return { tags: [] };
+  const content =
+    typeof candidate === "string" ? candidate : serializeInjectionScreenCandidate(candidate);
+  const result = screenCandidateFact(content);
+  return {
+    status: result.quarantine === true ? "pending_review" : undefined,
+    tags: result.quarantine === true
+      ? result.findings.map((finding) => `injection-screen:${finding.rule}`)
+      : [],
+  };
+}
+
+/**
+ * Withhold injection-flagged strings from an entity-index write (#1955
+ * review): entity facts/sections have no review status, so a flagged field is
+ * excluded from the recallable index and surfaced via the returned rules for
+ * the caller to log. Screen off → strings pass through unfiltered.
+ */
+export function withholdScreenedStrings(
+  values: readonly unknown[],
+  enabled: boolean,
+): { kept: string[]; withheldRules: string[] } {
+  const kept: string[] = [];
+  const withheldRules: string[] = [];
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    if (!enabled) {
+      kept.push(value);
+      continue;
+    }
+    const screened = screenCandidateFact(value);
+    if (screened.quarantine) {
+      withheldRules.push(...screened.findings.map((finding) => `injection-screen:${finding.rule}`));
+    } else {
+      kept.push(value);
+    }
+  }
+  return { kept, withheldRules };
+}
+
+export interface ScreenedEntityWrite {
+  name: string;
+  type: string;
+  source: string;
+  facts: string[];
+  structuredSections?: EntityStructuredSection[];
+  withheldRules: string[];
+  /** True when the entity NAME itself was flagged — callers must not index it. */
+  withheld: boolean;
+}
+
+/**
+ * Validate and screen one extracted entity before it enters the entity index
+ * (#1955 review): flagged facts/section facts are withheld and reported via
+ * `withheldRules` (entities carry no review status; routing is #2397).
+ * Returns null for entities without a usable name/type.
+ */
+export function screenEntityForIndex(entity: unknown, enabled: boolean): ScreenedEntityWrite | null {
+  const record = entity as { name?: unknown; type?: unknown; source?: unknown; facts?: unknown; structuredSections?: unknown } | null;
+  const name = record?.name;
+  const type = record?.type;
+  if (typeof name !== "string" || !name.trim() || typeof type !== "string" || !type.trim()) return null;
+  // #1955 review: the raw name is emitted as the entity target outside the
+  // snippet fence — a flagged name withholds the whole entity from the index.
+  const nameScreen = withholdScreenedStrings([name], enabled);
+  const factScreen = withholdScreenedStrings(Array.isArray(record?.facts) ? record.facts : [], enabled);
+  const rawSections: EntityStructuredSection[] | undefined = Array.isArray(record?.structuredSections)
+    ? (record.structuredSections as EntityStructuredSection[])
+    : undefined;
+  const sectionScreens = enabled && rawSections
+    ? rawSections.map((section) => ({ section, screen: withholdScreenedStrings(section?.facts ?? [], true) }))
+    : undefined;
+  return {
+    name,
+    type,
+    source: typeof record?.source === "string" ? record.source : "extraction",
+    facts: factScreen.kept,
+    ...(sectionScreens
+      ? { structuredSections: sectionScreens.map(({ section, screen }) => ({ ...section, facts: screen.kept })) }
+      : rawSections
+        ? { structuredSections: rawSections }
+        : {}),
+    withheldRules: [
+      ...nameScreen.withheldRules,
+      ...factScreen.withheldRules,
+      ...(sectionScreens ?? []).flatMap(({ screen }) => screen.withheldRules),
+    ],
+    withheld: nameScreen.withheldRules.length > 0,
+  };
+}
+
+/**
+ * Screen a batch of persist-bound strings and preformat the withheld warning
+ * (#1955): keeps persist call sites within their file-size ratchet.
+ */
+export function screenPersistStrings(
+  values: readonly string[],
+  enabled: boolean,
+): { kept: string[]; warning?: string } {
+  const screen = withholdScreenedStrings(values, enabled);
+  return {
+    kept: screen.kept,
+    ...(screen.withheldRules.length > 0
+      ? { warning: `injection screen withheld ${values.length - screen.kept.length} candidate(s) [${screen.withheldRules.join(", ")}]` }
+      : {}),
+  };
+}

package/src/orchestration/extraction-origin-context.ts

@@ -0,0 +1,90 @@
+/**
+ * Derive issue #1955 origin metadata at the extraction boundary.
+ */
+
+import { classifyOrigin, type OriginClass } from "../security/origin-authority.js";
+import type { BufferTurn } from "../types.js";
+
+export interface ExtractionSourceContext {
+  sessionKey?: string;
+  principal?: string;
+  validAt?: string;
+  sourceConnector?: string;
+  turnRole?: "user" | "assistant" | "tool" | string;
+  importAdapter?: string;
+  originConflict?: boolean;
+}
+
+/** Derive one origin context from the turns that supplied an extraction. */
+export function deriveExtractionOriginContext(
+  targetTurns: readonly BufferTurn[],
+  fallbackConnector?: string,
+): Pick<ExtractionSourceContext, "turnRole" | "importAdapter" | "sourceConnector" | "originConflict"> {
+  const originRoles = new Set(targetTurns.map((turn) => turn.role));
+  const turnRole = originRoles.size === 1 ? [...originRoles][0] : undefined;
+  const originConnectors = new Set(
+    targetTurns
+      .map((turn) => turn.sourceConnector)
+      .filter((connector): connector is string => typeof connector === "string" && connector.length > 0),
+  );
+  // Mirror the pre-#1955 provenance rule: a batch only carries a connector
+  // when EVERY turn is tagged with the same one — a mixed tagged+untagged
+  // batch must stay connector-less (connector-provenance-lifecycle tests).
+  const connector =
+    targetTurns.length > 0 &&
+    targetTurns.every(
+      (turn) => typeof turn.sourceConnector === "string" && turn.sourceConnector.length > 0,
+    ) &&
+    originConnectors.size === 1
+      ? [...originConnectors][0]
+      : undefined;
+  const originAdapters = new Set(
+    targetTurns
+      .map((turn) => turn.importProvenance?.sourceLabel)
+      .filter((adapter): adapter is string => typeof adapter === "string" && adapter.length > 0),
+  );
+  // Conflict when identities disagree OR are only partially present: a batch
+  // where some turns carry an import label (or connector) and others do not
+  // must classify as unknown, never fall back to the uniform turn role
+  // (#1955 review: mixed import labels previously became `user`).
+  const everyTurnHasConnector =
+    targetTurns.length > 0 &&
+    targetTurns.every((turn) => typeof turn.sourceConnector === "string" && turn.sourceConnector.length > 0);
+  const everyTurnHasAdapter =
+    targetTurns.length > 0 &&
+    targetTurns.every(
+      (turn) => typeof turn.importProvenance?.sourceLabel === "string" && turn.importProvenance.sourceLabel.length > 0,
+    );
+  const originConflict =
+    originConnectors.size > 1 ||
+    originAdapters.size > 1 ||
+    (originConnectors.size > 0 && originAdapters.size > 0) ||
+    (originConnectors.size > 0 && !everyTurnHasConnector) ||
+    (originAdapters.size > 0 && !everyTurnHasAdapter);
+  const importAdapter =
+    targetTurns.length > 0 &&
+    targetTurns.every(
+      (turn) =>
+        typeof turn.importProvenance?.sourceLabel === "string" &&
+        turn.importProvenance.sourceLabel.length > 0,
+    ) &&
+    originAdapters.size === 1
+      ? [...originAdapters][0]
+      : undefined;
+  return {
+    ...(turnRole ? { turnRole } : {}),
+    ...(importAdapter ? { importAdapter } : {}),
+    ...(originConflict ? { originConflict: true } : {}),
+    sourceConnector: fallbackConnector ?? connector,
+  };
+}
+
+/** Classify the persisted origin without reading config flags. */
+export function classifyExtractionOrigin(sourceContext?: ExtractionSourceContext): OriginClass {
+  if (sourceContext?.originConflict === true) return "unknown";
+  return classifyOrigin({
+    turnRole: sourceContext?.turnRole,
+    connectorId: sourceContext?.sourceConnector,
+    importAdapter: sourceContext?.importAdapter,
+  });
+}

package/src/orchestration/extraction-persist.ts

@@ -1,3 +1,5 @@
+import { classifyExtractionOrigin, type ExtractionSourceContext } from "./extraction-origin-context.js";
+import { evaluateInjectionScreen, screenEntityForIndex, screenPersistStrings } from "./extraction-injection-gate.js";
 /**
  * Extraction persistence coordinator (issue #1526, seam 16).
  *
@@ -26,9 +28,8 @@ import {
   resolvePresentationCapabilities,
   resolveNamespaceCapabilities,
   resolveRecallEnhancementCapabilities,
-  resolveConversationContextCapabilities,
   resolveRecallAuxiliaryCapabilities,
-  type GraphConstructionCapabilitySet,
+  resolveConversationContextCapabilities, resolveSecurityCapabilities, type GraphConstructionCapabilitySet,
   type MemoryLifecycleCapabilitySet,
 } from "../capabilities.js";
 import { coerceBool } from "../connectors/coerce.js";
@@ -132,7 +133,7 @@ export class ExtractionPersistCoordinator {
     result: ExtractionResult,
     storage: StorageManager,
     threadIdForExtraction?: string | null,
-    sourceContext?: { sessionKey?: string; principal?: string; validAt?: string; sourceConnector?: string },
+    sourceContext?: ExtractionSourceContext,
     baseNamespace?: string,
     scopeProfileWritePlan?: ResolvedScopeProfilePlan | null,
     /** Verbatim source turn text the facts were extracted from (faithfulness gate #1576). */
@@ -337,7 +338,7 @@ export class ExtractionPersistCoordinator {
     // (pre-judge + write-loop) so no new scattered config.*Enabled read is
     // introduced (ratchet scatteredConfigFlagReads; see #1523).
     const namespacesEnabled = resolveNamespaceCapabilities(this.deps.config).namespaces;
-    const sourceConnector = sourceContext?.sourceConnector; // #2183 tool-scope guard input
+    const sourceConnector = sourceContext?.sourceConnector; const origin = classifyExtractionOrigin(sourceContext);
     const promoteMemoryToProfileTargets = async (options: {
       sourceStorage: StorageManager;
       category: string;
@@ -400,7 +401,7 @@ export class ExtractionPersistCoordinator {
             {
               content: citedContent,
               category: options.category as MemoryCategory,
-              confidence: options.confidence,
+              origin, confidence: options.confidence,
               tags: withReservedMarkerTag(options.tags, `${target.target}-promotion`),
               entityRef: options.entityRef,
               structuredAttributes: options.structuredAttributes,
@@ -643,7 +644,7 @@ export class ExtractionPersistCoordinator {
           {
             content: citedContent,
             category: options.category as MemoryCategory,
-            confidence: options.confidence,
+            origin, confidence: options.confidence,
             tags: withReservedMarkerTag(options.tags, "shared-promotion"),
             entityRef: options.entityRef,
             structuredAttributes: options.structuredAttributes,
@@ -1622,6 +1623,7 @@ export class ExtractionPersistCoordinator {
         entityRef: fact.entityRef,
         validAt: biTemporal?.validFrom ?? sourceContext?.validAt,
       };
+      const { status: injectionScreenStatus, tags: injectionScreenTags } = evaluateInjectionScreen({ content: fact.content, category: writeCategory, structuredAttributes: fact.structuredAttributes, procedureSteps: fact.procedureSteps }, resolveSecurityCapabilities(this.deps.config).injectionScreen);
       // #1669 redaction-rule gate: consult BOTH source and target namespace
       // rules before any write. A never-store pattern registered under the
       // source namespace must survive scope-routing to a different target
@@ -1724,7 +1726,7 @@ export class ExtractionPersistCoordinator {
           exactDuplicate = false;
         }
       }
-      if (exactDuplicate) {
+      if (exactDuplicate && injectionScreenStatus !== "pending_review") {
         // #1671 — before short-circuiting, backfill bi-temporal bounds
         // onto the existing source-namespace copy if it lacks bounds the
         // incoming fact now carries (re-extraction with a resolved invalidAt).
@@ -1809,8 +1811,7 @@ export class ExtractionPersistCoordinator {
         dedupedCount++;
         continue;
       }
-
-      if (writeCategory === "procedure" && this.deps.config.procedural?.enabled !== true) {
+      if (writeCategory === "procedure" && this.deps.config.procedural?.enabled !== true && injectionScreenStatus !== "pending_review") {
         log.debug("persistExtraction: skip procedure memory (procedural.enabled is false)");
         continue;
       }
@@ -1824,6 +1825,7 @@ export class ExtractionPersistCoordinator {
       // gate, trivial turn-level chatter ("hi", "k", heartbeat pings) gets
       // persisted as a fact memory and dilutes the store.
       if (
+        injectionScreenStatus !== "pending_review" &&
         !isAboveImportanceThreshold(
           importance.level,
           this.deps.config.extractionMinImportanceLevel,
@@ -1851,7 +1853,7 @@ export class ExtractionPersistCoordinator {
       // extraction pass. The judge module tracks how many times the same
       // content has been deferred and converts to reject at the configured
       // cap, so the orchestrator only needs to skip the write here.
-      if (judgeVerdictsByFactIndex) {
+      if (judgeVerdictsByFactIndex && injectionScreenStatus !== "pending_review") {
         const verdict = judgeVerdictsByFactIndex.get(factLoopIndex);
         if (verdict && !verdict.durable) {
           const verdictKind = getVerdictKind(verdict);
@@ -1878,7 +1880,7 @@ export class ExtractionPersistCoordinator {
       // Procedure extraction gate (issue #519): ≥2 steps + trigger phrasing.
       // Runs even when extractionJudgeEnabled is false (durability judge is unrelated).
       // Never tied to extractionJudgeShadow — that flag is only for the LLM durability judge.
-      if (writeCategory === "procedure") {
+      if (writeCategory === "procedure" && injectionScreenStatus !== "pending_review") {
         const procGate = validateProcedureExtraction({
           content: fact.content,
           procedureSteps: fact.procedureSteps,
@@ -1918,7 +1920,7 @@ export class ExtractionPersistCoordinator {
         fact.requireSpansPending === true
           ? ("pending_review" as const)
           : undefined;
-      const faithfulnessEnforceStatus = faithfulnessGateStatus ?? requireSpansPendingStatus;
+      const faithfulnessEnforceStatus = faithfulnessGateStatus ?? requireSpansPendingStatus ?? injectionScreenStatus;
 
       // Issue #373 — write-time semantic similarity guard. Hook runs after
       // the exact content-hash miss and the importance gate so that:
@@ -1939,7 +1941,7 @@ export class ExtractionPersistCoordinator {
       // a high-similarity update/correction is linked as a superseding
       // contradiction rather than silently dropped.
       let pendingSemanticSkip: (SemanticDedupDecision & { action: "skip" }) | null = null;
-      if (resolvePipelineProcessingCapabilities(this.deps.config).semanticDedup) {
+      if (resolvePipelineProcessingCapabilities(this.deps.config).semanticDedup && injectionScreenStatus !== "pending_review") {
         let semanticDecision: SemanticDedupDecision;
         // UUI2: skip embedding lookup for the rest of this batch once we know
         // the backend is unavailable. The flag is reset per-batch (set to false
@@ -2189,8 +2191,8 @@ export class ExtractionPersistCoordinator {
             {
               content: citedChunkedContent,
               category: writeCategory,
-              confidence: fact.confidence,
-              tags: withReservedMarkerTag(fact.tags, "chunked"),
+              origin, confidence: fact.confidence,
+              tags: withReservedMarkerTag([...fact.tags, ...injectionScreenTags], "chunked"),
               entityRef: fact.entityRef,
               structuredAttributes: fact.structuredAttributes,
               validAt: biTemporal ? biTemporal.validFrom : sourceContext?.validAt,
@@ -2302,7 +2304,7 @@ export class ExtractionPersistCoordinator {
                   // the verified span (chatgpt-codex-connector thread Ocvmo).
                   ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
                   ...(fact.provenance ? { provenance: fact.provenance } : {}),
-                  ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
+                  ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}), ...(origin ? { origin } : {}),
                   ...(factToolScoped ? { toolScoped: true as const } : {}),
                 },
               );
@@ -2459,6 +2461,7 @@ export class ExtractionPersistCoordinator {
                 intentActionType: inferredIntent?.actionType,
                 intentEntityTypes: inferredIntent?.entityTypes,
                 ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
+                ...(origin ? { origin } : {}),
                 ...(factToolScoped ? { toolScoped: true as const } : {}),
               });
             }
@@ -2568,8 +2571,8 @@ export class ExtractionPersistCoordinator {
         {
           content: citedFactContent,
           category: writeCategory,
-          confidence: fact.confidence,
-          tags: fact.tags,
+          origin, confidence: fact.confidence,
+          tags: [...fact.tags, ...injectionScreenTags],
           entityRef:
             typeof (fact as any).entityRef === "string"
               ? (fact as any).entityRef
@@ -2778,6 +2781,7 @@ export class ExtractionPersistCoordinator {
             intentActionType: inferredIntent?.actionType,
             intentEntityTypes: inferredIntent?.entityTypes,
             ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
+            ...(origin ? { origin } : {}),
             ...(factToolScoped ? { toolScoped: true as const } : {}),
           });
         }
@@ -2838,29 +2842,21 @@ export class ExtractionPersistCoordinator {
       durableNonFactTouchRecorded = true;
       touchBaseNonFactNamespace();
     };
+    // #1955 review: entity fields recall via entity hints — screened before
+    // entering the index (screenEntityForIndex); withheld fields are logged.
+    const entityScreenOn = resolveSecurityCapabilities(this.deps.config).injectionScreen;
     for (const entity of entities) {
       try {
-        const name = (entity as any)?.name;
-        const type = (entity as any)?.type;
-        if (
-          typeof name !== "string" ||
-          !name.trim() ||
-          typeof type !== "string" ||
-          !type.trim()
-        ) {
-          continue;
-        }
-        const safeFacts = Array.isArray((entity as any)?.facts)
-          ? (entity as any).facts.filter((f: any) => typeof f === "string")
-          : [];
-          const id = await storage.writeEntity(name, type, safeFacts, {
-            source: typeof (entity as any)?.source === "string" ? (entity as any).source : "extraction",
-            timestamp: sourceContext?.validAt,
-            sessionKey: sourceContext?.sessionKey,
-            principal: sourceContext?.principal,
-            structuredSections: Array.isArray((entity as any)?.structuredSections)
-            ? (entity as any).structuredSections
-            : undefined,
+        const screened = screenEntityForIndex(entity, entityScreenOn);
+        if (!screened) continue;
+        if (screened.withheldRules.length > 0) log.warn(`persistExtraction: injection screen withheld ${screened.withheldRules.length} entity field(s) for "${screened.name}" [${screened.withheldRules.join(", ")}]`);
+        if (screened.withheld) continue;
+        const id = await storage.writeEntity(screened.name, screened.type, screened.facts, {
+          source: screened.source,
+          timestamp: sourceContext?.validAt,
+          sessionKey: sourceContext?.sessionKey,
+          principal: sourceContext?.principal,
+          structuredSections: screened.structuredSections,
         });
         if (id) {
           trackPersistedId(storage, id);
@@ -2870,25 +2866,23 @@ export class ExtractionPersistCoordinator {
         log.warn(`persistExtraction: entity write failed: ${err}`);
       }
     }
-
-    // Persist entity relationships (v7.0)
+    // Persist entity relationships (v7.0). #1955 review: source/label/target are screened.
     if (
       resolveRecallEnhancementCapabilities(this.deps.config).entityRelationships &&
       Array.isArray(result.relationships)
     ) {
       for (const rel of result.relationships.slice(0, 5)) {
         if (!rel.source || !rel.target || !rel.label) continue;
+        const relScreen = screenPersistStrings([`${rel.source}\n${rel.label}\n${rel.target}`,
+          `${rel.target}\n${rel.label} (reverse)\n${rel.source}`], entityScreenOn);
+        if (relScreen.warning) {
+          log.warn(`persistExtraction(relationship): ${relScreen.warning}`);
+          continue;
+        }
         try {
-          // Add bidirectional relationship
-          await storage.addEntityRelationship(rel.source, {
-            target: rel.target,
-            label: rel.label,
-          });
+          await storage.addEntityRelationship(rel.source, { target: rel.target, label: rel.label });
           recordDurableNonFactWrite();
-          await storage.addEntityRelationship(rel.target, {
-            target: rel.source,
-            label: `${rel.label} (reverse)`,
-          });
+          await storage.addEntityRelationship(rel.target, { target: rel.source, label: `${rel.label} (reverse)` });
           recordDurableNonFactWrite();
         } catch (err) {
           log.debug(`relationship persist failed: ${err}`);
@@ -2915,14 +2909,21 @@ export class ExtractionPersistCoordinator {
         }
       }
     }
-
-    if (profileUpdates.length > 0) {
-      await storage.appendToProfile(profileUpdates);
+    // #1955 review: profile + questions render verbatim into model context —
+    // screened; questions screen question+context JOINED (routing: #2397).
+    const profileScreen = screenPersistStrings(profileUpdates, entityScreenOn);
+    if (profileScreen.warning) log.warn(`persistExtraction(profile): ${profileScreen.warning}`);
+    if (profileScreen.kept.length > 0) {
+      await storage.appendToProfile(profileScreen.kept);
       recordDurableNonFactWrite();
     }
 
-    // Persist questions
     for (const q of questions) {
+      const qScreen = screenPersistStrings([`${q.question}\n${q.context ?? ""}`], entityScreenOn);
+      if (qScreen.warning) {
+        log.warn(`persistExtraction(question): ${qScreen.warning}`);
+        continue;
+      }
       const id = await storage.writeQuestion(q.question, q.context, q.priority);
       if (id) {
         trackPersistedId(storage, id);
@@ -2930,17 +2931,18 @@ export class ExtractionPersistCoordinator {
       }
     }
 
-    // Persist identity reflection. This writes durable namespace-local state, so
-    // an identity-ONLY extraction (no facts/entities/profile/questions) still
-    // counts as a durable non-fact write for the catalog touch below (NIIly).
-    // Only count it when the write actually succeeds (best-effort write); the
-    // touch is recorded AFTER this so a rolled-back/failed write never touches.
+    // Persist identity reflection (screened — #1955): durable namespace-local
+    // state; identity-ONLY extraction still counts as durable non-fact (NIIly).
     if (resolveRecallEnhancementCapabilities(this.deps.config).identity && result.identityReflection) {
-      try {
-        await storage.appendIdentityReflection(result.identityReflection);
-        recordDurableNonFactWrite();
-      } catch (err) {
-        log.debug(`identity reflection write failed: ${err}`);
+      const idScreen = screenPersistStrings([result.identityReflection], entityScreenOn);
+      if (idScreen.warning) log.warn(`persistExtraction(identity): ${idScreen.warning}`);
+      else {
+        try {
+          await storage.appendIdentityReflection(result.identityReflection);
+          recordDurableNonFactWrite();
+        } catch (err) {
+          log.debug(`identity reflection write failed: ${err}`);
+        }
       }
     }
 

package/src/orchestration/extraction-run.ts

@@ -32,6 +32,7 @@ import { resolvePrincipal, defaultNamespaceForPrincipal } from "../namespaces/pr
 import { resolveScopeProfilePlan, type ResolvedScopeProfilePlan } from "../namespaces/scope-profiles.js";
 import { resolveCodingNamespaceOverlay } from "../coding/coding-namespace.js";
 import type { CodingContext } from "../types.js";
+import { deriveExtractionOriginContext, type ExtractionSourceContext } from "./extraction-origin-context.js";
 import {
   resolvePresentationCapabilities,
   resolveMemoryLifecycleCapabilities,
@@ -76,7 +77,7 @@ export interface ExtractionRunCoordinatorDeps {
     result: ExtractionResult,
     storage: StorageManager,
     threadIdForExtraction?: string | null,
-    sourceContext?: { sessionKey?: string; principal?: string; validAt?: string; sourceConnector?: string },
+    sourceContext?: ExtractionSourceContext,
     baseNamespace?: string,
     scopeProfileWritePlan?: ResolvedScopeProfilePlan | null,
     sourceText?: string,
@@ -1062,6 +1063,7 @@ export class ExtractionRunCoordinator {
         log.warn("[threading] processTurn failed before persistence (non-fatal)", err);
       }
     }
+    const originContext = deriveExtractionOriginContext(targetTurns, result.sourceConnector);
     throwIfDeadlineExceeded("before_persist");
     throwIfAborted("before_persist");
 
@@ -1069,7 +1071,7 @@ export class ExtractionRunCoordinator {
       result,
       storage,
       threadIdForExtraction,
-      { sessionKey, principal, validAt: sourceValidAt, sourceConnector: result.sourceConnector },
+      { sessionKey, principal, validAt: sourceValidAt, ...originContext },
       // Pass the KNOWN base namespace (NHIdx) so the catalog write touch records the
       // real namespace rather than a guess decoded from the storage dir.
       selfNamespace,