@tpsdev-ai/flair 0.44.9 → 0.44.10

package/dist/cli.js

@@ -7455,6 +7455,133 @@ export function decideCandidateAction(candidate, action) {
     }
     return { ok: true };
 }
+// ─── ADK tag-lineage on promote (#1205 slice 1205a — Sherlock security req) ───
+// ADK session records are written by adk-flair (memory_service.py) under a
+// SHARED-namespace agentId, with per-user separation carried ENTIRELY by a
+// compound scope tag `adk:<app>:<user>`. That tag is the access-control
+// boundary. A candidate distilled from those records therefore MUST carry the
+// scope tag when promoted, or the promoted claim lands in the shared agentId
+// memory retrievable by every other user of the app — a cross-user leak.
+//
+// `rem promote` historically hard-coded `["nightly-rem-promoted", from:<id>]`
+// and DROPPED the source tag. We now propagate the source scope tag for
+// ADK-sourced candidates, and FAIL CLOSED (refuse) when a candidate is
+// ADK-sourced but its scope tag can't be uniquely+completely determined.
+//
+// SCOPING (deliberate, per spec): fail-closed applies ONLY to ADK-sourced
+// candidates. Non-ADK candidates carry no `adk:` tag and promote byte-for-byte
+// as before — a transient/deleted source on a non-ADK candidate must NOT block
+// its promotion.
+//
+// SEAM (foundation only; the distillation engine is slice #1205b): ADK-sourcing
+// is detected here by re-reading the candidate's source memories and inspecting
+// their tags. That leaves ONE residual fail-open: an ADK-sourced candidate all
+// of whose source memories are unreadable (deleted/transient) yields no `adk:`
+// evidence and is treated as non-ADK. Closing that corner without regressing
+// non-ADK promotion requires the ENGINE to stamp the authoritative scope tag
+// onto the MemoryCandidate row at distillation time (it distills per single
+// scope:tagged tag, so it knows it authoritatively). `derivePromotedTags` is
+// written so that override can be threaded in later without touching callers.
+export const ADK_SCOPE_TAG_PREFIX = "adk:";
+/**
+ * Decide the tag set for a promoted Memory given the candidate id and the
+ * result of fetching each of its source memories. Pure — no I/O; the action
+ * callback does the fetching and threads the results here so this is unit-
+ * testable and the fail-closed logic is exercised directly.
+ *
+ * `stampedScopeTag` (#1205b-1 — the engine slice the #1205a SEAM note below
+ * anticipated): the authoritative scope:"tagged" tag the distillation engine
+ * stamped onto the MemoryCandidate row (resources/MemoryReflect.ts →
+ * buildStagedCandidateRow). When present it is AUTHORITATIVE and short-circuits
+ * the source re-read entirely — the engine distilled under exactly this one
+ * tag, so it knows the per-user scope tag independent of whether the source
+ * memories are still readable. This closes the residual fail-open the SEAM
+ * note describes: a candidate all of whose sources are unreadable yields no
+ * `adk:` evidence and would otherwise be mis-classified NON-ADK and promoted
+ * tagless into the shared agentId namespace (a cross-user leak). Threading it
+ * in as an optional trailing arg keeps every pre-#1205b caller (and every
+ * candidate that never carried a stamp) on the unchanged source-re-read path.
+ *
+ * With NO stamp (undefined/empty) the source-re-read classification runs
+ * exactly as in #1205a:
+ *  - No `adk:` scope tag across readable sources → NON-ADK candidate; return
+ *    the provenance tags only (unchanged behavior).
+ *  - Exactly one `adk:` scope tag AND every source readable → ADK-sourced;
+ *    return [scopeTag, ...provenance].
+ *  - `adk:` evidence present but the scope tag is ambiguous (>1 distinct tag)
+ *    OR incomplete (some source unreadable) → REFUSE (fail-closed): a
+ *    tagless/mis-tagged claim in a shared ADK namespace is a cross-user leak,
+ *    not a benign miss.
+ */
+export function derivePromotedTags(candidateId, sources, stampedScopeTag) {
+    const provenance = ["nightly-rem-promoted", `from:${candidateId}`];
+    // #1205b-1: a stamped scope tag is AUTHORITATIVE — consume it directly, never
+    // re-read sources. This is the seam closure: correctness no longer depends on
+    // source readability. `adkSourced` (which gates the Soul-promotion refusal in
+    // the promote action) tracks whether the stamped tag is an ADK scope tag.
+    if (typeof stampedScopeTag === "string" && stampedScopeTag.length > 0) {
+        return {
+            ok: true,
+            tags: [stampedScopeTag, ...provenance],
+            adkSourced: stampedScopeTag.startsWith(ADK_SCOPE_TAG_PREFIX),
+        };
+    }
+    const adkTags = new Set();
+    let anySourceUnreadable = false;
+    for (const s of sources) {
+        if (!s.ok) {
+            anySourceUnreadable = true;
+            continue;
+        }
+        for (const t of s.tags) {
+            if (typeof t === "string" && t.startsWith(ADK_SCOPE_TAG_PREFIX))
+                adkTags.add(t);
+        }
+    }
+    // No positive ADK evidence → non-ADK. An unreadable source with zero ADK
+    // evidence does NOT fail closed here (that would regress non-ADK promotion);
+    // see the SEAM note above.
+    if (adkTags.size === 0) {
+        return { ok: true, tags: provenance, adkSourced: false };
+    }
+    if (adkTags.size > 1) {
+        return {
+            ok: false,
+            reason: `ADK-sourced candidate spans multiple scope tags (${[...adkTags].sort().join(", ")}); refusing to promote — a merged cross-user claim would leak across users`,
+        };
+    }
+    if (anySourceUnreadable) {
+        return {
+            ok: false,
+            reason: `ADK-sourced candidate has unreadable source memories; the per-user scope tag cannot be confirmed — refusing to promote (fail-closed)`,
+        };
+    }
+    const scopeTag = [...adkTags][0];
+    return { ok: true, tags: [scopeTag, ...provenance], adkSourced: true };
+}
+// ─── Machine reviewer namespace (#1205 slice 1205a — Sherlock security req 4) ─
+// A promotion records a reviewerId that feeds audit/attribution
+// (schemas/memory.graphql:209). An automated (machine-driven) promotion path
+// must record a reviewerId that can NEVER be mistaken for a human/agent
+// reviewer, so attribution isn't laundered. Reserve the `machine:` namespace
+// for that, and forbid the human `--reviewer` path from claiming it.
+export const MACHINE_REVIEWER_PREFIX = "machine:";
+/** Canonical machine reviewerId for the ADK auto-promote consumer (#1205b). */
+export const MACHINE_REVIEWER_ADK_AUTO_PROMOTE = "machine:adk-auto-promote";
+/** True iff `id` is in the reserved machine-reviewer namespace — i.e. it
+ *  denotes an automated path, not a human or agent reviewer. */
+export function isMachineReviewerId(id) {
+    return typeof id === "string" && id.startsWith(MACHINE_REVIEWER_PREFIX);
+}
+/** The human `flair rem promote` path must not record a reviewerId in the
+ *  reserved machine namespace — that would launder automated attribution onto
+ *  a human-operated promotion. Returns an error string, or null if allowed. */
+export function validateHumanReviewerId(reviewerId) {
+    if (isMachineReviewerId(reviewerId)) {
+        return `--reviewer '${reviewerId}' uses the reserved '${MACHINE_REVIEWER_PREFIX}' namespace (reserved for automated promotion); use a human/agent reviewer id`;
+    }
+    return null;
+}
 // ─── flair rem promote ───────────────────────────────────────────────────────
 // Slice 2 of FLAIR-NIGHTLY-REM (ops-2qq). Promote a candidate to either Soul
 // or persistent Memory. Both --rationale and --to are required (spec § 5: no
@@ -7482,6 +7609,13 @@ rem
         process.exit(1);
     }
     const reviewerId = opts.reviewer || process.env.FLAIR_AGENT_ID || "admin";
+    // The human promote path must not record a reserved machine reviewerId
+    // (Sherlock #4): that would launder automated attribution.
+    const reviewerErr = validateHumanReviewerId(reviewerId);
+    if (reviewerErr) {
+        console.error(`Error: ${reviewerErr}`);
+        process.exit(1);
+    }
     try {
         // Fetch the candidate
         const candidate = await api("GET", `/MemoryCandidate/${encodeURIComponent(candidateId)}`);
@@ -7492,6 +7626,51 @@ rem
             console.error(`Error: candidate ${candidateId} ${msg}`);
             process.exit(1);
         }
+        // ADK tag-lineage: derive the promoted-claim tag set.
+        //
+        // #1205b-1: if the engine stamped an authoritative `scopeTag` on the
+        // candidate (scope:"tagged" distillation), consume it DIRECTLY and skip
+        // the source re-read — correctness no longer depends on the source
+        // memories still being readable (the #1205a seam closure). We only fall
+        // back to re-reading sources when there is NO stamp (a pre-#1205b
+        // candidate, or a non-tagged distillation).
+        const stampedScopeTag = typeof candidate.scopeTag === "string" && candidate.scopeTag.length > 0 ? candidate.scopeTag : undefined;
+        const sourceFetches = [];
+        if (!stampedScopeTag) {
+            // No authoritative stamp — re-read sources to classify. Fail-closed for
+            // ADK-sourced candidates whose per-user scope tag can't be confirmed;
+            // unchanged for non-ADK candidates. See derivePromotedTags for rules.
+            const sourceIds = Array.isArray(candidate.sourceMemoryIds) ? candidate.sourceMemoryIds : [];
+            for (const sid of sourceIds) {
+                try {
+                    const mem = await api("GET", `/Memory/${encodeURIComponent(String(sid))}`);
+                    if (mem && !mem.error) {
+                        sourceFetches.push({ ok: true, tags: Array.isArray(mem.tags) ? mem.tags : [] });
+                    }
+                    else {
+                        sourceFetches.push({ ok: false });
+                    }
+                }
+                catch {
+                    sourceFetches.push({ ok: false });
+                }
+            }
+        }
+        const tagDecision = derivePromotedTags(candidateId, sourceFetches, stampedScopeTag);
+        if (!tagDecision.ok) {
+            console.error(`Error: candidate ${candidateId} — ${tagDecision.reason}`);
+            process.exit(1);
+        }
+        // Soul entries are agentId-scoped and cannot carry a per-user scope tag,
+        // so an ADK-sourced candidate promoted to Soul is a cross-user leak by
+        // construction — fail closed. (Server-side trust-tier enforcement that
+        // hard-locks the target is the engine slice #1205b; this is the CLI-side
+        // foundation.)
+        if (opts.to === "soul" && tagDecision.adkSourced) {
+            console.error(`Error: candidate ${candidateId} is ADK-sourced (scope tag ${tagDecision.tags[0]}); Soul is agentId-scoped and cannot carry a per-user scope tag — refusing to promote to Soul (would leak across users). Promote ADK-sourced candidates to memory.`);
+            process.exit(1);
+        }
+        const promotedTags = tagDecision.tags;
         const decidedAt = new Date().toISOString();
         // Write the resulting Soul or Memory entry
         if (opts.to === "memory") {
@@ -7501,7 +7680,7 @@ rem
                 agentId: candidate.agentId,
                 content: candidate.claim,
                 durability: "persistent",
-                tags: ["nightly-rem-promoted", `from:${candidateId}`],
+                tags: promotedTags,
                 derivedFrom: candidate.sourceMemoryIds ?? [],
                 promotionStatus: "approved",
                 promotedAt: decidedAt,
@@ -12758,7 +12937,14 @@ program
 // a real user query, so a high score means "recall is functioning", not
 // "recall is optimal". Its job is to catch recall CRATERING (embeddings
 // down, index busted) — the score collapsing toward 0 is the signal, not
-// fine-grained precision grading. Requires an actual agent identity to
+// fine-grained precision grading. NOTE (#1216): this cue-from-the-memory
+// design is self-polluting as a recall-QUALITY metric — relevance is
+// query/corpus overlap by construction, so near-duplicate density reads as a
+// recall collapse (flair#967 / #857 / #996). It is deliberately NOT the
+// recall-quality number; that authority is the deterministic, fixed-label,
+// CI-gated eval at test/bench/recall-eval (recall@k / nDCG@10 / MRR). This
+// probe stays scoped to live-health cratering only. Requires an actual
+// agent identity to
 // query AS (semantic search is agent-scoped) — no identity, fewer than the
 // sample-size memories to sample, or a search error all degrade to `null` +
 // a `gaps` entry, same graceful-degradation contract as every metric here —

package/dist/rem/runner.js

@@ -7,7 +7,11 @@
  *   3. Maintenance — delegate to /MemoryMaintenance (same code path `flair rem light` uses).
  *   4. Trust-tier filter on input memories — permanently deferred (see below).
  *   5. Distillation — call /ReflectMemories with execute:true, persist staged
- *      candidate ids to the audit row.
+ *      candidate ids to the audit row. TAG-AWARE (#1205b-1): enumerate the
+ *      active adk:<app>:<user> tags for the agentId and distill ONCE PER TAG
+ *      under scope:"tagged" (per-user isolation, no cross-user bleed); fall
+ *      back to the agentId-only scope:"recent" distill when there are no adk:
+ *      tags (ordinary single-tenant agents, unchanged).
  *   6. Instance-wide dedup-cluster stat — call /MemoryDedupStats (flair-
  *      quality Slice 1c). NOT part of FLAIR-NIGHTLY-REM's original per-agent
  *      § 4 list — added because a near-duplicate cluster count is inherently
@@ -54,6 +58,34 @@ import { homedir } from "node:os";
 import { createSnapshot } from "./snapshot.js";
 export const REM_PAUSE_FLAG = resolve(homedir(), ".flair", "rem.paused");
 export const REM_NIGHTLY_LOG = resolve(homedir(), ".flair", "logs", "rem-nightly.jsonl");
+// ─── ADK per-tag distillation (#1205b-1) ─────────────────────────────────────
+// adk-flair collapses (app_name, user_id) → ONE Flair agentId, distinguishing
+// users ONLY by a per-user tag `adk:<app>:<user>` (see the adk-flair
+// memory_service compound-tag). An agentId-wide distill (scope:"recent")
+// therefore mixes every user's sessions into shared claims — the cross-user
+// bleed #1205 fixes. The tag-aware cycle instead distills once per active
+// adk: tag under scope:"tagged", so each user's claims come only from that
+// user's sessions.
+export const ADK_TAG_PREFIX = "adk:";
+/**
+ * Recency window (ms) used to decide which adk: tags are ACTIVE — a tag is
+ * enumerated (and distilled) only if it has memory records created within this
+ * window. This is BOTH the bound that keeps enumeration off a full-table scan
+ * (the query filters on the indexed `createdAt`) AND the threshold-gate that
+ * skips idle users for free (Kern 1a). 48h (not 24h) so a single missed
+ * nightly cycle doesn't skip a user who was active only in the gap; distilling
+ * a tag pulls ALL its memories regardless, so a skipped cycle only delays, it
+ * never loses content.
+ */
+export const DEFAULT_DISTILL_LOOKBACK_MS = 48 * 3600_000;
+/**
+ * Per-cycle ceiling on tag-driven /ReflectMemories calls (one LLM call each),
+ * so a burst of active ADK users can't starve the nightly window for other
+ * agents (Kern 1b). Sequential, not concurrent — matches the runner's existing
+ * single-threaded shape. If more tags are active than this, the overflow is
+ * recorded in `errors` and picked up on subsequent cycles (they stay active).
+ */
+export const DEFAULT_MAX_TAGS_PER_CYCLE = 200;
 function readPauseSentinel(path) {
     try {
         const contents = readFileSync(path, "utf-8");
@@ -134,6 +166,59 @@ async function fetchPendingCandidateCount(api, agentId) {
         return 0;
     }
 }
+/**
+ * Derive the DISTINCT active `adk:<app>:<user>` tags from an agent's memory
+ * set (#1205b-1). "Active" = the memory was created at/after `sinceDate`.
+ * Returns the distinct set, sorted for determinism.
+ *
+ * Operates over the memories the runner ALREADY fetched for the snapshot
+ * (step 2's `GET /Memory?agentId=<id>`), so enumeration adds NO extra query
+ * and NO additional table scan on top of what the cycle already does — a
+ * separate bounded distinct-tag DB query is NOT available here: the Memory
+ * resource exposes no REST `search_by_conditions` handler (that verb 405s —
+ * only MemoryCandidate overrides it), and Harper's ops-API `search_by_
+ * conditions` needs admin creds the agent-authed nightly runner doesn't carry.
+ * Reusing the already-loaded set is cheaper than either (no second round-trip)
+ * and sidesteps that seam entirely. See the module header + issue #1205.
+ *
+ * The recency cutoff is applied in-memory here as the threshold-gate (Kern 1a):
+ * a tag with no records at/after `sinceDate` is idle and is skipped for free.
+ * Distilling a tag later still pulls ALL its memories (scope:"tagged" ignores
+ * recency), so a skipped cycle only delays, never loses.
+ *
+ * OWNER-ONLY (Sherlock's user-enumeration-oracle flag): tags are collected
+ * ONLY from records whose `agentId` equals `agentId` (the runner's own id).
+ * This is load-bearing, NOT belt-and-suspenders: the snapshot fetch
+ * (`GET /Memory?agentId=<id>`) resolves through Memory's "open-within-org"
+ * read scope and returns org-wide rows — the `?agentId=` query param is NOT an
+ * owner filter (verified empirically against Harper, #1205b-1). Without this
+ * per-record agentId check the runner would enumerate (and try to distill)
+ * OTHER agents' adk tags — a cross-agent user-enumeration oracle. Filtering
+ * here confines enumeration to the runner's own users, and the reduction is
+ * pure in-process (no endpoint an attacker could point at another id).
+ */
+export function deriveActiveAdkTags(memories, sinceDate, agentId) {
+    const tags = new Set();
+    for (const m of memories) {
+        if (!m || typeof m !== "object")
+            continue;
+        // Owner scope: only this agent's own records (the fetch is org-wide).
+        if (m.agentId !== agentId)
+            continue;
+        const createdAt = m.createdAt;
+        // Recency / threshold gate: skip idle tags (no record since the cutoff).
+        if (!createdAt || new Date(createdAt) < sinceDate)
+            continue;
+        const mt = m.tags;
+        if (!Array.isArray(mt))
+            continue;
+        for (const t of mt) {
+            if (typeof t === "string" && t.startsWith(ADK_TAG_PREFIX))
+                tags.add(t);
+        }
+    }
+    return [...tags].sort();
+}
 /**
  * Runs one nightly cycle for the given agent. See module header for steps.
  * Pure orchestration; all I/O goes through injected dependencies.
@@ -167,10 +252,14 @@ export async function runNightlyCycle(opts) {
     let memoryCount = 0;
     let soulCount = 0;
     let pendingCandidates = 0;
+    // #1205b-1: the memories fetched here (for the snapshot) are reused by the
+    // step-5 tag enumeration — no second fetch. Hoisted so step 5 can read them.
+    let fetchedMemories = [];
     try {
         // Fetch agent data
         const memoriesRaw = await opts.apiCall("GET", `/Memory?agentId=${encodeURIComponent(opts.agentId)}`);
         const memories = asArray(memoriesRaw);
+        fetchedMemories = memories;
         memoryCount = memories.length;
         const soulRaw = await opts.apiCall("GET", `/Soul?agentId=${encodeURIComponent(opts.agentId)}`);
         const souls = asArray(soulRaw);
@@ -251,34 +340,89 @@ export async function runNightlyCycle(opts) {
     // the same way dryRun skips the snapshot write.
     // When the call IS attempted (success or failure), the audit row's `slice`
     // flips to "2" — "2-maintenance" is reserved for the dry-run skip case.
+    //
+    // #1205b-1 — TAG-AWARE distillation. First enumerate the active
+    // adk:<app>:<user> tags for this agentId. If any exist, this is (or includes)
+    // an ADK agentId whose users share one agentId and are separated ONLY by
+    // tag: distill ONCE PER TAG under scope:"tagged" so each user's candidates
+    // are distilled from that user's sessions alone (no cross-user bleed). If
+    // NONE exist, this is an ordinary single-tenant agent — fall back to the
+    // unchanged agentId-only scope:"recent" distill so non-ADK agents behave
+    // exactly as before. The single-node-runs-the-timer property is unchanged:
+    // this all runs inside the one cycle on the one node.
     let candidates;
+    const collectStagedIds = (obj) => asArray(obj.candidates)
+        .map((c) => (c && typeof c === "object" ? c.id : c))
+        .filter((id) => typeof id === "string");
     if (!opts.dryRun) {
         sliceLabel = "2";
-        try {
-            const reflectRaw = await opts.apiCall("POST", "/ReflectMemories", {
-                agentId: opts.agentId,
-                execute: true,
-            });
-            const obj = (reflectRaw && typeof reflectRaw === "object") ? reflectRaw : {};
-            if (obj.error) {
-                // Defensive: a 200 response shouldn't carry { error }, since
-                // MemoryReflect signals failure via HTTP status (503/502) — apiCall
-                // implementations throw for those. Handled the same way regardless.
-                errors.push(`distillation: ${describeApiError(obj.error)}`);
+        const distillSince = opts.distillSince ?? new Date(startedMs - DEFAULT_DISTILL_LOOKBACK_MS);
+        const maxTags = opts.maxTagsPerCycle ?? DEFAULT_MAX_TAGS_PER_CYCLE;
+        // Derive active adk: tags from the memories already fetched in step 2 — no
+        // extra query/scan. See deriveActiveAdkTags for why a separate bounded DB
+        // query isn't available (Memory has no REST search handler; ops-API needs
+        // admin the runner lacks).
+        const activeAdkTags = deriveActiveAdkTags(fetchedMemories, distillSince, opts.agentId);
+        if (activeAdkTags.length > 0) {
+            // Per-tag distillation path (ADK). One scope:"tagged" call per active
+            // tag; aggregate every batch's staged ids into the single `candidates`
+            // list. A per-tag failure is recorded and does NOT abort the remaining
+            // tags (or the cycle) — the same non-fatal discipline the agentId-only
+            // path uses below.
+            const staged = [];
+            const tagsToRun = activeAdkTags.slice(0, maxTags);
+            if (activeAdkTags.length > maxTags) {
+                errors.push(`distillation: ${activeAdkTags.length} active adk tags exceed the per-cycle cap (${maxTags}); ${activeAdkTags.length - maxTags} deferred to a later cycle`);
             }
-            else {
-                const staged = asArray(obj.candidates);
-                candidates = staged
-                    .map((c) => (c && typeof c === "object" ? c.id : c))
-                    .filter((id) => typeof id === "string");
+            for (const tag of tagsToRun) {
+                try {
+                    const reflectRaw = await opts.apiCall("POST", "/ReflectMemories", {
+                        agentId: opts.agentId,
+                        execute: true,
+                        scope: "tagged",
+                        tag,
+                    });
+                    const obj = (reflectRaw && typeof reflectRaw === "object") ? reflectRaw : {};
+                    if (obj.error) {
+                        errors.push(`distillation[${tag}]: ${describeApiError(obj.error)}`);
+                    }
+                    else {
+                        staged.push(...collectStagedIds(obj));
+                    }
+                }
+                catch (err) {
+                    errors.push(`distillation[${tag}]: ${describeApiError(err?.message ?? err)}`);
+                }
             }
+            // `candidates` is defined (even if empty) whenever distillation was
+            // ATTEMPTED this cycle — same contract as the agentId-only path.
+            candidates = staged;
         }
-        catch (err) {
-            // Distillation failure is recorded, not fatal — maintenance already
-            // succeeded and the cycle's guaranteed steps are done (spec § 3B item
-            // 3). Zero partial candidates is guaranteed server-side (all-or-
-            // nothing staging in /ReflectMemories).
-            errors.push(`distillation: ${describeApiError(err?.message ?? err)}`);
+        else {
+            // AgentId-only path (non-ADK, unchanged pre-#1205b behavior).
+            try {
+                const reflectRaw = await opts.apiCall("POST", "/ReflectMemories", {
+                    agentId: opts.agentId,
+                    execute: true,
+                });
+                const obj = (reflectRaw && typeof reflectRaw === "object") ? reflectRaw : {};
+                if (obj.error) {
+                    // Defensive: a 200 response shouldn't carry { error }, since
+                    // MemoryReflect signals failure via HTTP status (503/502) — apiCall
+                    // implementations throw for those. Handled the same way regardless.
+                    errors.push(`distillation: ${describeApiError(obj.error)}`);
+                }
+                else {
+                    candidates = collectStagedIds(obj);
+                }
+            }
+            catch (err) {
+                // Distillation failure is recorded, not fatal — maintenance already
+                // succeeded and the cycle's guaranteed steps are done (spec § 3B item
+                // 3). Zero partial candidates is guaranteed server-side (all-or-
+                // nothing staging in /ReflectMemories).
+                errors.push(`distillation: ${describeApiError(err?.message ?? err)}`);
+            }
         }
     }
     // Step 6 (flair-quality Slice 1c): instance-wide dedup-cluster stat.