aiki-cli 0.3.2 → 0.3.5

package/dist/orchestration/context.js

@@ -39,7 +39,7 @@ export const DEFAULT_DEADLINE_MS = 20 * 60 * 1000; // wall-clock cap
 // (2026-07-13) after the spawn timeout became actually enforced and killed a LEGITIMATE deep call: codex's
 // S4 analysis of a hard build case ran ~10 min to a valid output (run 20260713-1341, 13:44→13:54). 900s
 // per attempt covers observed deep work; the wall-clock deadline above remains the outer bound.
-const DEFAULT_CALL_TIMEOUT_MS = 900_000;
+export const DEFAULT_CALL_TIMEOUT_MS = 900_000;
 export class BudgetExceeded extends Error {
     constructor(limit) {
         super(`call budget exhausted (limit ${limit})`);
@@ -74,6 +74,9 @@ export class RunCtx {
     cwd;
     events;
     evidencePack;
+    allowBlockedSources;
+    urlSources;
+    isAuto;
     budget;
     calls = [];
     /** Logical provider-call stages, including resume cache hits. Used by bounded protocol caps. */
@@ -87,6 +90,8 @@ export class RunCtx {
     deadlineAt;
     now;
     replay; // resume replay cache (V6.3)
+    autoDecision; // v7 Phase B/D: routing record + output escalation receipt
+    fastPathActive;
     seq = 0; // monotonic per-call counter for raw/ filenames (== budget.used on a fresh run)
     constructor(opts) {
         this.runId = opts.runId;
@@ -97,6 +102,12 @@ export class RunCtx {
         this.cwd = opts.cwd;
         this.events = opts.events;
         this.evidencePack = opts.evidencePack;
+        this.allowBlockedSources = opts.allowBlockedSources;
+        this.urlSources = opts.urlSources;
+        this.isAuto = opts.autoDecision !== undefined;
+        this.fastPathActive = this.mode === 'quick'
+            && opts.autoDecision?.resolved === 'quick'
+            && opts.autoDecision.fast_path === true;
         this.budget = { limit: opts.budget ?? defaultBudgetFor(opts.workflow, this.mode), used: 0 };
         this.handles = new Map(opts.handles.map((h) => [h.id, h]));
         this.signal = opts.signal;
@@ -104,6 +115,23 @@ export class RunCtx {
         this.now = opts.now ?? Date.now;
         this.deadlineAt = this.now() + this.deadlineMs;
         this.replay = opts.replay;
+        this.autoDecision = opts.autoDecision ? { ...opts.autoDecision } : undefined;
+    }
+    get fastPath() {
+        return this.fastPathActive;
+    }
+    get autoEscalationReasons() {
+        return this.autoDecision?.escalation_reasons ?? [];
+    }
+    /** Phase D: retain initial fast-path eligibility in meta, but stop rendering it as single-pass. */
+    markAutoEscalated(reasons) {
+        if (!this.autoDecision || reasons.length === 0)
+            return;
+        this.fastPathActive = false;
+        this.autoDecision = {
+            ...this.autoDecision,
+            escalation_reasons: [...new Set([...(this.autoDecision.escalation_reasons ?? []), ...reasons])],
+        };
     }
     /** Provider ids available this run (READY at setup). */
     available() {
@@ -135,6 +163,8 @@ export class RunCtx {
     optionalCallsRemaining() {
         if (this.workflow !== 'idea-refinement')
             return 0;
+        if (this.isAuto)
+            return 0; // Phase D adaptive topology owns its single optional challenge directly.
         const plan = IDEA_MODE_PLANS[this.mode];
         const logicalUsed = this.attemptedStages.filter(isOptionalStage).length;
         const protocolRoom = Math.max(0, plan.optionalCalls - logicalUsed);
@@ -160,13 +190,16 @@ export class RunCtx {
         // Resume (V6.3): if this exact (provider, prompt) already succeeded in the run we're resuming,
         // replay its output — no real call, no budget spend. Only never-completed calls hit the model.
         const cachedOut = this.replay?.get(replayKey(handle.id, req.prompt));
+        const category = callCategory(stage);
+        const replayed = cachedOut !== undefined;
+        if (!replayed && this.budget.used + 1 > this.budget.limit)
+            throw new BudgetExceeded(this.budget.limit);
+        this.events?.onCallStart?.(handle.id, stage, category, replayed);
         let res;
         if (cachedOut !== undefined) {
             res = { ok: true, text: cachedOut, json: req.expectJson ? extractJson(cachedOut) : undefined, durationMs: 0 };
         }
         else {
-            if (this.budget.used + 1 > this.budget.limit)
-                throw new BudgetExceeded(this.budget.limit);
             this.budget.used++;
             res = await handle.adapter.run({
                 prompt: req.prompt,
@@ -184,10 +217,12 @@ export class RunCtx {
                 stage,
                 category: callCategory(stage),
                 durationMs: res.durationMs,
+                usage: (res.ok && res.usage) || estimateUsage(req.prompt, res.ok ? res.text : ''),
                 ...(res.ok ? {} : { error: res.error }),
             });
         }
         await this.writer.writeRaw(`${stage}-${handle.id}-${seq}.out`, res.ok ? res.text : `[${res.error}]\n${res.stderrTail}`);
+        this.events?.onCallEnd?.(handle.id, stage, res.durationMs, res.ok, replayed);
         return res;
     }
     /** Assemble the run's `meta.json` payload (§15) from the handles + call ledger accumulated so
@@ -211,6 +246,7 @@ export class RunCtx {
         this.roles.s4.forEach((id, i) => (roles[`s4_${i + 1}`] = id));
         // Fold stage-raised flags in with any explicitly passed by the caller; dedupe.
         const allFlags = [...new Set([...(flags ?? []), ...this.flags])];
+        const usage_totals = this.sumUsage();
         return {
             run_id: this.runId,
             workflow: this.workflow,
@@ -223,11 +259,38 @@ export class RunCtx {
             call_count: this.calls.length,
             budget: { limit: this.budget.limit, used: this.budget.used },
             receipt: this.receipt(),
+            ...(usage_totals ? { usage_totals } : {}),
+            ...(this.autoDecision ? { auto_decision: this.autoDecision } : {}),
             exit_status: exitStatus,
             aborted,
             ...(allFlags.length ? { flags: allFlags } : {}),
         };
     }
+    /** Sum per-call usage into run totals. Undefined when no call carries usage (empty run). */
+    sumUsage() {
+        let inputTokens = 0, outputTokens = 0, reportedCalls = 0, estimatedCalls = 0, reportedCostUsd = 0, anyCost = false;
+        for (const c of this.calls) {
+            if (!c.usage)
+                continue;
+            inputTokens += c.usage.inputTokens ?? 0;
+            outputTokens += c.usage.outputTokens ?? 0;
+            if (c.usage.estimated)
+                estimatedCalls++;
+            else
+                reportedCalls++;
+            if (c.usage.reportedCostUsd !== undefined) {
+                reportedCostUsd += c.usage.reportedCostUsd;
+                anyCost = true;
+            }
+        }
+        if (reportedCalls === 0 && estimatedCalls === 0)
+            return undefined;
+        return { inputTokens, outputTokens, reportedCalls, estimatedCalls, ...(anyCost ? { reportedCostUsd } : {}) };
+    }
+}
+/** ponytail: chars/4 heuristic, labeled estimated — good enough until a provider reports. */
+function estimateUsage(prompt, out) {
+    return { inputTokens: Math.ceil(prompt.length / 4), outputTokens: Math.ceil(out.length / 4), estimated: true };
 }
 /** Run-fatal errors abort the whole run; everything else (e.g. a single provider failure in a
  *  fan-out) is handled locally by the stage (drop provider, check quorum). */

package/dist/orchestration/decision-dossier.js

@@ -1,4 +1,6 @@
 import { DISPLAY_NAME } from '../providers/types.js';
+import { evidenceOrigin } from './evidence-origin.js';
+import { sanitizeLocalPaths } from './sanitize-paths.js';
 function cell(value) {
     return value.replaceAll('\n', ' ').replaceAll('|', '\\|');
 }
@@ -21,6 +23,13 @@ export function claimShortLabel(text, max = 60) {
     const boundary = clipped.lastIndexOf(' ');
     return `${clipped.slice(0, boundary > max * 0.6 ? boundary : max).trimEnd()}…`;
 }
+/** Human token summary: "~18.4k in / ~3.2k out (2 calls estimated)". `~` iff any call estimated. */
+export function formatTokenLine(t) {
+    const k = (n) => (n >= 1000 ? `${(n / 1000).toFixed(1)}k` : String(n));
+    const tilde = t.estimatedCalls > 0 ? '~' : '';
+    const suffix = t.estimatedCalls > 0 ? ` (${t.estimatedCalls} calls estimated)` : '';
+    return `${tilde}${k(t.inputTokens)} in / ${tilde}${k(t.outputTokens)} out${suffix}`;
+}
 /** id → claim text lookup for stripReaderClaimIds substitution; shared by readerClaimLabel's fallback and the Markdown/HTML renderers. */
 export function claimLookup(report) {
     return (id) => report.claims.find((claim) => claim.id === id)?.text ?? null;
@@ -64,6 +73,7 @@ const FLAG_EXPLAIN = {
     weak_seat: 'one scout seat contributed far less evidenced material than the other; treat convergence cautiously',
     source_fallback_search: 'a supplied page blocked direct reading; the source-investigation seat searched for accessible sources instead',
     deliverable_gap: 'one or more surviving scouts omitted a requested feature or implementation proposal',
+    plan_partial: 'the answer planner omitted part of the requested deliverables; the report shows what was produced',
 };
 function degradation(report, flags) {
     const active = flags.filter((flag) => report.flags.includes(flag));
@@ -76,6 +86,12 @@ function coverageLabel(value) {
     return value >= 0.75 ? 'High' : value >= 0.5 ? 'Medium' : 'Low';
 }
 function councilRead(report) {
+    if (report.fastPath)
+        return 'Single-pass analysis; council escalation was not required.';
+    if (report.adaptiveAuto)
+        return report.autoEscalationReasons?.length
+            ? `The primary analysis tripped structural gates; two task readings checked the interpretation${report.autoChallengeUsed ? ', and one targeted challenger checked eligible claims' : '; no challenger could add information'}. No full council was convened.`
+            : 'Two task readings informed one primary decision analyst. No full council was convened.';
     if (report.mode === 'quick')
         return 'One structured analyst produced this result; no council, consensus, or independent-verification claim is being made.';
     const scouts = report.models.filter((model) => model.roles.includes('scout')).length;
@@ -88,10 +104,13 @@ function councilRead(report) {
 export function sanitizeReaderText(text, labelFor) {
     return stripReaderClaimIds(text, labelFor)
         .replace(/\b(?:G|C|D)\d+\b/g, '')
-        .replace(/\bUNVERIFIABLE\b/gi, 'not independently confirmed')
-        .replace(/\bUNVERIFIED\b/gi, 'not yet confirmed')
-        .replace(/\bPARTIAL\b/gi, 'partly supported')
-        .replace(/\bCONFLICTED\b/gi, 'supported by conflicting evidence')
+        // v6: UPPERCASE-only — a leaked internal enum is rewritten; ordinary English ("the rules are
+        // unverified") is the model's own prose and must survive (f740's "confirmed-unverified" became
+        // "confirmed-not yet confirmed" under the old /gi).
+        .replace(/\bUNVERIFIABLE\b/g, 'not independently confirmed')
+        .replace(/\bUNVERIFIED\b/g, 'not yet confirmed')
+        .replace(/\bPARTIAL\b/g, 'partly supported')
+        .replace(/\bCONFLICTED\b/g, 'supported by conflicting evidence')
         .replace(/\bstructural score\b/gi, 'confidence estimate')
         .replace(/\bevidence coverage\b/gi, 'source strength')
         .replace(/\bverification coverage\b/gi, 'source strength')
@@ -108,7 +127,7 @@ export function cleanReaderText(report, text) {
 }
 const MATERIAL_WARNING_ORDER = [
     'synthesis_suspect', 'low_diversity', 'weak_seat', 'deliverable_gap', 'plan_skipped',
-    'plan_fallback', 'headless_intent', 'verification_skipped', 'research_ungrounded',
+    'plan_fallback', 'plan_partial', 'headless_intent', 'verification_skipped', 'research_ungrounded',
 ];
 const READER_WARNING = {
     synthesis_suspect: 'The final synthesis needed repair; treat its wording cautiously.',
@@ -117,6 +136,7 @@ const READER_WARNING = {
     deliverable_gap: 'At least one scout omitted a requested feature or implementation proposal.',
     plan_skipped: 'The answer-planning step was skipped because its call budget was unavailable.',
     plan_fallback: 'The answer planner failed validation; this report uses a deterministic fallback.',
+    plan_partial: 'The answer planner omitted part of the requested deliverables; the report shows what was produced.',
     headless_intent: 'No person confirmed the interpreted request; documented defaults were used.',
     verification_skipped: 'Independent verification was skipped; important factual claims may remain unchecked.',
     research_ungrounded: 'Source investigation did not produce a cited public source; treat current claims as ungrounded.',
@@ -232,7 +252,8 @@ function renderReaderBriefMarkdown(report) {
         L.push('## Decision numbers', '', '### Decisive numbers', '', '| Metric | Value | What it means |', '|---|---:|---|');
         for (const item of projection.snapshot.decisiveNumbers)
             L.push(`| ${cell(item.label)} | ${cell(item.value)} | ${cell(item.meaning)} |`);
-        if (projection.snapshot.payback) {
+        // v6: a NOT_COMPUTABLE payback is noise on a non-financial question — omit, don't announce.
+        if (projection.snapshot.payback && projection.snapshot.payback.status !== 'NOT_COMPUTABLE') {
             L.push('', `**Payback — ${projection.snapshot.payback.status.replaceAll('_', ' ')}:** ${projection.snapshot.payback.result}`);
             L.push(`Basis: ${projection.snapshot.payback.basis}`, '');
         }
@@ -289,6 +310,8 @@ function renderReaderBriefMarkdown(report) {
     }
     if (projection.sources.length) {
         L.push('## Sources', '');
+        const externalCount = report.dossier.evidence.filter((item) => evidenceOrigin(item) === 'EXTERNAL').length;
+        L.push(`${externalCount} independent external source${externalCount === 1 ? '' : 's'}; everything else is your own material or model background.`, '');
         for (const source of projection.sources) {
             const citationScope = source.citedFor.length ? ` — Cited for: ${source.citedFor.join('; ')}` : '';
             L.push(`${source.url ? `- [${source.label.replace(/[\[\]]/g, '')}](${source.url})` : `- ${source.label}`}${citationScope}`);
@@ -325,7 +348,7 @@ function renderLegacyDecisionDossierMarkdown(report) {
         for (const item of report.decisionSnapshot.decisiveNumbers) {
             L.push(`| ${cell(item.label)} | ${cell(item.value)} | ${cell(item.meaning)} | ${cell(readerClaimRefs(report, item.claimIds))} |`);
         }
-        if (report.decisionSnapshot.payback) {
+        if (report.decisionSnapshot.payback && report.decisionSnapshot.payback.status !== 'NOT_COMPUTABLE') {
             const payback = report.decisionSnapshot.payback;
             L.push('', `**Payback — ${payback.status.replaceAll('_', ' ')}:** ${payback.result}`);
             L.push(`Basis: ${payback.basis}`, '');
@@ -558,9 +581,13 @@ function renderLegacyDecisionDossierMarkdown(report) {
     L.push(`- Models and roles: ${report.models.map((model) => `${model.name} (${model.roles.join(', ')})`).join(' · ') || 'none recorded'}`);
     L.push(`- Mode: ${report.mode}`);
     L.push(`- Provider calls: ${report.receipt.calls}/${report.receipt.budget}`);
+    if (report.autoEscalationReasons?.length)
+        L.push(`- Adaptive escalation: ${report.autoEscalationReasons.join('; ')}`);
     L.push(`- Categories: discovery ${report.receipt.categories.discovery} · verification ${report.receipt.categories.verification} · repair ${report.receipt.categories.repair} · planning ${report.receipt.categories.planning}`);
     L.push(`- By provider: ${Object.entries(report.receipt.byProvider).map(([provider, count]) => `${providerName(provider)} ${count}`).join(', ') || 'none'}`);
     L.push(`- Recorded model time: ${(report.receipt.modelTimeMs / 1000).toFixed(1)}s`);
+    if (report.receipt.tokens)
+        L.push(`- Tokens: ${formatTokenLine(report.receipt.tokens)}`);
     L.push(`- Degradation flags: ${report.flags.join(', ') || 'none'}`, '');
     // This pass runs over already-built (cell-escaped) table rows, so injected labels must be cell-escaped too.
     for (let index = 0; index < L.length; index++)
@@ -593,7 +620,11 @@ function renderLegacyDecisionDossierMarkdown(report) {
     if (dossier.evidence.length) {
         L.push('| Evidence ID | Source | Date | Freshness | Verification | Linked claims |', '|---|---|---|---|---|---|');
         for (const evidence of dossier.evidence) {
-            L.push(`| ${evidence.id} | ${cell(evidence.source)} (${evidence.sourceKind}) | ${evidence.date} | ${evidence.freshness} | ${evidence.verificationStatus} | ${cell(readerClaimRefs(report, evidence.claimIds))} |`);
+            // v6: the user's own material can corroborate what they told us — never "verify" it.
+            const verification = evidenceOrigin(evidence) === 'USER_MATERIAL'
+                ? 'consistent with your materials (not independently checked)'
+                : evidence.verificationStatus;
+            L.push(`| ${evidence.id} | ${cell(evidence.source)} (${evidence.sourceKind}) | ${evidence.date} | ${evidence.freshness} | ${verification} | ${cell(readerClaimRefs(report, evidence.claimIds))} |`);
         }
     }
     else
@@ -643,7 +674,8 @@ function renderLegacyDecisionDossierMarkdown(report) {
     L.push('', '</details>', '');
     return L.join('\n');
 }
-/** Canonical Markdown. HTML and Copy-Markdown consume the same persisted reader brief. */
+/** Canonical Markdown. HTML and Copy-Markdown consume the same persisted reader brief.
+ *  v6: every rendered artifact is path-sanitized; stored run JSON keeps raw locators for audit. */
 export function renderDecisionDossierMarkdown(report) {
-    return report.dossier.readerBrief ? renderReaderBriefMarkdown(report) : renderLegacyDecisionDossierMarkdown(report);
+    return sanitizeLocalPaths(report.dossier.readerBrief ? renderReaderBriefMarkdown(report) : renderLegacyDecisionDossierMarkdown(report));
 }

package/dist/orchestration/decision-graph.js

@@ -32,7 +32,7 @@ export function interpretClaimOutcome(graph, claim, adjudication) {
 export function positionId(provider, localId, sourceId = provider) {
     return `${sourceId}/${localId}`;
 }
-function classify(positions) {
+export function classifyClaimState(positions) {
     const providers = new Set(positions.map((position) => position.provider));
     const stances = new Set(positions.map((position) => position.stance));
     const supporters = positions.filter((position) => position.stance === 'SUPPORT').map((position) => position.provider);
@@ -139,7 +139,7 @@ export function compileDecisionGraph(submissions, rubric, semanticGroups = []) {
                     : 'load-bearing claim has no settling evidence';
             evidenceHoles.push({ claim_id: id, reason });
         }
-        const baseState = classify(members);
+        const baseState = classifyClaimState(members);
         return {
             id,
             proposition: members[0].proposition,

package/dist/orchestration/engine.js

@@ -31,7 +31,7 @@ export async function executeRun(ctx, input, fn) {
     try {
         await fn(ctx, input);
         await ctx.writer.writeMeta(ctx.buildMeta('ok', false));
-        return { ok: true, ...base, callCount: ctx.calls.length };
+        return { ok: true, aborted: false, ...base, callCount: ctx.calls.length };
     }
     catch (e) {
         const classified = classifyError(e);
@@ -40,7 +40,7 @@ export async function executeRun(ctx, input, fn) {
         const aborted = ctx.aborted || classified.aborted;
         // Best-effort finalize: never let a meta-write failure mask the original error.
         await ctx.writer.writeMeta(ctx.buildMeta(aborted ? 'aborted' : 'failed', aborted)).catch(() => { });
-        return { ok: false, ...base, callCount: ctx.calls.length, error: { code: classified.code, message: e instanceof Error ? e.message : String(e) } };
+        return { ok: false, aborted, ...base, callCount: ctx.calls.length, error: { code: classified.code, message: e instanceof Error ? e.message : String(e) } };
     }
 }
 /**
@@ -54,13 +54,14 @@ export async function run(workflow, input, opts = {}) {
     if (handles.length < requiredProviders) {
         return {
             ok: false,
+            aborted: false,
             runId: '(none)',
             dir: '',
             callCount: 0,
             error: { code: 'QUORUM', message: `need ≥${requiredProviders} provider${requiredProviders === 1 ? '' : 's'}, found ${handles.length} — run \`aiki doctor\`` },
         };
     }
-    const runId = makeRunId(workflow);
+    const runId = opts.runId ?? makeRunId(workflow);
     const roles = resolveRoles(workflow, handles.map((h) => h.id), opts.roleOverrides);
     const writer = new RunWriter(runId, opts.runsRoot);
     const ctx = new RunCtx({
@@ -77,6 +78,9 @@ export async function run(workflow, input, opts = {}) {
         events: opts.events,
         replay: opts.replay,
         evidencePack: opts.evidencePack,
+        allowBlockedSources: opts.allowBlockedSources,
+        urlSources: opts.urlSources,
+        autoDecision: opts.autoDecision,
     });
     // Register the session (V6.3) so `aiki sessions`/`resume` can find it from anywhere. run() is a
     // real-CLI entry (setupProviders); tests use executeRun directly and never touch the global registry.
@@ -90,6 +94,6 @@ export async function run(workflow, input, opts = {}) {
         ...(opts.resumedFrom ? { resumedFrom: opts.resumedFrom } : {}),
     });
     const outcome = await executeRun(ctx, input, WORKFLOWS[workflow]);
-    await updateSessionStatus(runId, outcome.ok ? 'ok' : 'failed');
+    await updateSessionStatus(runId, outcome.ok ? 'ok' : outcome.aborted ? 'aborted' : 'failed');
     return outcome;
 }

package/dist/orchestration/evidence-origin.js

@@ -0,0 +1,17 @@
+// v6 evidence origin honesty (plan/AIKI-v6-council-integrity-plan.md T7). Run f740's coverage
+// numbers counted the user's own idea-brief as evidence (8 of 12 cards, some marked VERIFIED) —
+// circular. Origin is derived, never trusted from labels alone: EXTERNAL requires BOTH an
+// external source_kind AND a public http(s) locator, so a mislabeled local file stays humble.
+/** Accepts graph-card shape (`source_kind`/`locator`/`url`) and dossier-row shape
+ *  (`sourceKind`/`source`/`url`). Defaults toward USER_MATERIAL — the humbler label. */
+export function evidenceOrigin(card) {
+    const kind = card.source_kind ?? card.sourceKind;
+    if (kind === 'MODEL_KNOWLEDGE')
+        return 'MODEL_KNOWLEDGE';
+    if (kind === 'PRIMARY' || kind === 'SECONDARY') {
+        const locator = card.url ?? card.locator ?? card.source ?? '';
+        if (/^https?:\/\//i.test(locator.trim()))
+            return 'EXTERNAL';
+    }
+    return 'USER_MATERIAL';
+}

package/dist/orchestration/jsonStage.js

@@ -10,10 +10,14 @@ import { StageError } from './context.js';
  *  Two live failures shaped it (run 20260715-1516): the S9 chair's only defect was `dissent` as a
  *  string, and the paid repair it triggered flipped the verdict PIVOT→PWC and died on 7 conditions
  *  vs max 6. Policy:
- *  - LOSSLESS (always): a lone value where an array is expected becomes a one-element array. Runs
- *    BEFORE the paid repair — a wrappable-only defect costs zero extra calls.
- *  - LOSSY (`lossy: true`, last resort after the repair failed): arrays beyond their schema max are
- *    truncated in order — one extra condition costs one condition, never the run.
+ *  - LOSSLESS (always): a lone value where an array is expected becomes a one-element array, and an
+ *    EMPTY optional min-1 string is dropped (empty carries no information — absent beats invalid;
+ *    run f740's codex seat burned a 267s repair on 12 empty rationales). Runs BEFORE the paid
+ *    repair — such defects cost zero extra calls.
+ *  - LOSSY (`lossy: true`, last resort once the repair path is spent or disallowed): arrays beyond
+ *    their schema max are truncated in order; strings beyond their max are clipped at a word
+ *    boundary with a trailing ellipsis (run f740's planner died on a 173-char headline vs max 160
+ *    with no repair budget).
  *  Never invents a value. The full schema still validates the result; anything else stays invalid. */
 export function coerceToSchema(schema, value, lossy) {
     const def = schema?._def;
@@ -21,7 +25,12 @@ export function coerceToSchema(schema, value, lossy) {
         return value;
     const kind = def.typeName;
     if (kind === 'ZodOptional' || kind === 'ZodNullable' || kind === 'ZodDefault' || kind === 'ZodReadonly' || kind === 'ZodCatch') {
-        return value === undefined || value === null ? value : coerceToSchema(def.innerType, value, lossy);
+        if (value === undefined || value === null)
+            return value;
+        const coerced = coerceToSchema(def.innerType, value, lossy);
+        if (kind === 'ZodOptional' && coerced === '' && minStringLength(def.innerType) >= 1)
+            return undefined;
+        return coerced;
     }
     if (kind === 'ZodEffects')
         return coerceToSchema(def.schema, value, lossy); // refine/preprocess wrappers
@@ -46,8 +55,36 @@ export function coerceToSchema(schema, value, lossy) {
         }
         return out;
     }
+    if (kind === 'ZodString') {
+        if (!lossy || typeof value !== 'string')
+            return value;
+        const max = stringCheck(def, 'max');
+        if (typeof max !== 'number' || value.length <= max)
+            return value;
+        const cut = value.slice(0, max - 1);
+        const atWord = cut.includes(' ') ? cut.slice(0, cut.lastIndexOf(' ')) : cut;
+        return `${atWord}…`;
+    }
     return value;
 }
+function stringCheck(def, kind) {
+    const checks = def.checks;
+    const found = checks?.find((check) => check.kind === kind)?.value;
+    return typeof found === 'number' ? found : undefined;
+}
+function minStringLength(schema) {
+    const def = schema?._def;
+    if (!def)
+        return 0;
+    const kind = def.typeName;
+    if (kind === 'ZodEffects')
+        return minStringLength(def.schema);
+    if (kind === 'ZodPipeline')
+        return minStringLength(def.in);
+    if (kind !== 'ZodString')
+        return 0;
+    return stringCheck(def, 'min') ?? 0;
+}
 export async function jsonCall(ctx, handle, stage, prompt, schema, opts = {}) {
     // Deterministic last resort once the repair path is spent: stage-specific salvage first, then the
     // generic lossy floor (truncate over-cap arrays), then both composed. No extra provider call.
@@ -79,6 +116,11 @@ export async function jsonCall(ctx, handle, stage, prompt, schema, opts = {}) {
     if (wrapped.success)
         return wrapped.data;
     if (opts.repair === false) {
+        // Repair is unavailable (budget/policy) — the deterministic floor is all we have. A clipped
+        // string beats a discarded artifact (run f740: complete plan lost to a 13-char overflow).
+        const saved = trySalvage(first.json);
+        if (saved !== undefined)
+            return saved;
         throw new StageError(stage, 'BAD_OUTPUT', `output failed validation: ${zodMessage(parsed.error)}`);
     }
     // §14 repair retry — one attempt, same provider.

package/dist/orchestration/modes.js

@@ -3,7 +3,9 @@ const FULL_COUNCIL_PLAN = {
     baseCalls: 6,
     optionalCalls: 4,
     maxCalls: 10,
-    reservedCalls: 2,
+    // v6: chair + planner + ONE tail repair. Run f740 proved 2 was not enough — upstream repairs
+    // drained the cushion and the planner's complete deliverables died unrepairables at 12/12.
+    reservedCalls: 3,
     defaultBudget: 12,
     deadlineMs: 45 * MINUTE,
 };
@@ -35,7 +37,7 @@ export function callCategory(stage) {
         return 'repair';
     if (stage.startsWith('S9b'))
         return 'planning';
-    if (stage.startsWith('S8') || stage === 'S9' || stage.startsWith('S9-'))
+    if (stage === 'S4b' || stage.startsWith('S8') || stage === 'S9' || stage.startsWith('S9-'))
         return 'verification';
     return 'discovery';
 }

package/dist/orchestration/preflight.js

@@ -37,6 +37,25 @@ USER TEXT:
 {{RAW_INPUT}}
 URL SOURCE SNAPSHOTS:
 {{URL_SOURCES_JSON}}`;
+/** Phase C fast path: the CLI already proved this is an unambiguous, decision-only request. */
+export function deterministicContract(rawInput, coreRubric) {
+    const successBar = 'a decision-ready recommendation';
+    return DecisionContract.parse({
+        task: rawInput.trim(),
+        task_type: 'idea-refinement',
+        constraints: [],
+        unknowns: [],
+        success_criteria: [successBar],
+        alternatives: [],
+        success_bar: successBar,
+        evidence_supplied: [],
+        missing_evidence: [],
+        core_rubric: coreRubric,
+        user_confirmed: false,
+        confirmation: 'headless-defaulted',
+        requested_outputs: requestedOutputsFor(rawInput),
+    });
+}
 function unique(values, max = Number.POSITIVE_INFINITY) {
     const seen = new Set();
     const result = [];

package/dist/orchestration/quick-analysis.js

@@ -1,4 +1,4 @@
-import { ActionPlan, JudgeReport, QuickDecisionModel, readerBriefIssues, } from '../schemas/index.js';
+import { ActionPlan, JudgeReport, QuickDecisionModel, readerBriefIssues, salvageIdeaRoleOutputModel, } from '../schemas/index.js';
 import { jsonCall } from './jsonStage.js';
 const QUICK_PROMPT = `ROLE: Single decision analyst. This is explicit QUICK mode, not a multi-model
 council. Give one strong structured analysis and do not claim independent consensus or verification.{{SKILL}}
@@ -9,8 +9,23 @@ EVIDENCE PACK MANIFEST: {{EVIDENCE_PACK_JSON}}
 
 Output ONLY JSON:
 {
-  "analysis": <the idea analyst object: task_echo, strongest_version, positions, evidence,
-    calculations, coverage, decision_questions, deliverable_proposals>,
+  "analysis": <the idea analyst object with EXACTLY these fields:
+    task_echo: restate the task in ≤2 sentences.
+    strongest_version: the best honest version of this idea in ≤150 words.
+    positions: [{local_id, proposition, dimension_id, stance SUPPORT|OPPOSE|MIXED|UNKNOWN,
+      basis EVIDENCE|INFERENCE|ASSUMPTION, nature FACTUAL|JUDGMENT, load_bearing,
+      if_false STOP|PIVOT|CONDITION|MINOR, reasoning, evidence_ids, depends_on}]
+    evidence: [{id, claim_supported, source_kind USER|PRIMARY|SECONDARY|MODEL_KNOWLEDGE (exact token),
+      support SUPPORTS|CONTRADICTS|CONTEXT_ONLY, freshness CURRENT|DATED|UNKNOWN (exact token),
+      locator/url, accessed_at for current external sources}]. MODEL_KNOWLEDGE freshness is UNKNOWN.
+    calculations: [] or per derived numeric claim {id, claim_id, inputs: [{id,name,value,unit,evidence_ids}],
+      steps: [{id,operation ADD|SUBTRACT|MULTIPLY|DIVIDE,left,right,result,unit}], result_step}
+    coverage: one entry per rubric dimension {dimension_id, status COVERED|NOT_APPLICABLE,
+      position_ids ([] when none), rationale (required for NOT_APPLICABLE)} — no other keys.
+    decision_questions: [{question, claim_ids}]
+    deliverable_proposals: [] unless requested_outputs asks for FEATURE_BACKLOG or IMPLEMENTATION_PLAN,
+      then [{output FEATURE_BACKLOG|IMPLEMENTATION_PLAN, title, detail, user_value, why_distinctive, evidence_ids}].
+    Use ONLY these field names — no extra or renamed keys anywhere in analysis.>,
   "verdict": "<2-5 sentence decision and core reason>",
   "recommendation": "PROCEED|PROCEED_WITH_CONDITIONS|PIVOT|STOP",
   "conditions": ["<only for PROCEED_WITH_CONDITIONS>"],
@@ -38,11 +53,21 @@ export function buildQuickPrompt(contract, inputPath, evidencePack, skill) {
         .replace('{{INPUT_PATH}}', inputPath)
         .replace('{{EVIDENCE_PACK_JSON}}', JSON.stringify(evidencePack ?? { files: [] }));
 }
-export async function s4QuickAnalyze(ctx, prompt) {
+/** Auto standard path keeps the same typed one-call output without claiming explicit quick mode. */
+export function buildAdaptivePrompt(contract, inputPath, evidencePack, skill) {
+    return buildQuickPrompt(contract, inputPath, evidencePack, skill).replace('ROLE: Single decision analyst. This is explicit QUICK mode, not a multi-model\ncouncil. Give one strong structured analysis and do not claim independent consensus or verification.', 'ROLE: Primary decision analyst in an adaptive auto run. Give one strong structured analysis.\nDo not claim council consensus or independent verification. Use provider-native read-only source\ninvestigation when available; otherwise leave current facts visibly unverified.');
+}
+export async function s4QuickAnalyze(ctx, prompt, opts = {}) {
     const provider = ctx.roles.judge;
-    const decision = await jsonCall(ctx, ctx.handle(provider), 'Q1', prompt, QuickDecisionModel);
+    const decision = await jsonCall(ctx, ctx.handle(provider), opts.stage ?? 'Q1', prompt, QuickDecisionModel, {
+        // Same deterministic last resort as council S4, applied to the nested analysis object.
+        salvage: (json) => (json && typeof json === 'object' && !Array.isArray(json)
+            ? { ...json, analysis: salvageIdeaRoleOutputModel(json.analysis) }
+            : json),
+    });
     const output = { workflow: 'idea-refinement', ...decision.analysis };
-    await ctx.writer.writeRoleOutput(provider, output);
+    if (opts.persist !== false)
+        await ctx.writer.writeRoleOutput(provider, output);
     return { seat: { provider, sample: provider, output }, decision };
 }
 function claimAnchors(graph) {

package/dist/orchestration/sanitize-paths.js

@@ -0,0 +1,10 @@
+// v6 render-time path sanitization (plan/AIKI-v6-council-integrity-plan.md T8). Run f740's report
+// leaked `/Users/<name>/...` locators into its own evidence table while one of its accepted claims
+// said replays must sanitize local paths — the artifact violated the product's own rule. Every
+// rendered artifact (canonical Markdown, HTML) passes through here; stored run JSON keeps raw
+// locators for audit fidelity, and the terminal keeps the functional local report path.
+/** Replace the user-identifying prefix of absolute home paths with `~`. Idempotent; the
+ *  lookbehind keeps URL path segments like `example.com/Users/page` untouched. */
+export function sanitizeLocalPaths(text) {
+    return text.replace(/(?<![\w.:-])(?:file:\/\/)?\/(?:Users|home)\/[^/\s)\]|"'`]+/g, '~');
+}