akm-cli 0.9.16 → 0.9.17-alpha.1

package/dist/indexer/graph/graph-extraction.js

@@ -128,7 +128,7 @@ function normalizeConfidence(raw) {
         return undefined;
     return Math.max(0, Math.min(1, raw));
 }
-function getGraphExtractorId(config) {
+export function getGraphExtractorId(config) {
     const fingerprint = computeBodyHash(JSON.stringify({
         promptVersion: graphExtract.GRAPH_EXTRACT_PROMPT_VERSION,
         model: config.model,
@@ -152,6 +152,36 @@ function buildLowQualityWarnings(quality, telemetry) {
     }
     return warnings;
 }
+/**
+ * Failure-rate abort for the extraction run (R2), modelled on consolidate's
+ * chunk-level guard (`ABORT_MIN_CHUNKS`/`ABORT_FAILURE_RATE` in
+ * consolidate.ts, C-6/#392): rate-based over a minimum sample so a couple of
+ * transient per-file failures cannot abort a run that would otherwise
+ * recover, while a systemically dead provider stops burning through the
+ * rest of the eligible set. The existing "one failure must not abort the
+ * rest" behaviour for individual files is untouched — this only stops
+ * further model calls once the failure rate itself is the signal.
+ */
+const GRAPH_EXTRACTION_ABORT_MIN_ATTEMPTS = 4;
+const GRAPH_EXTRACTION_ABORT_FAILURE_RATE = 0.5;
+/** Records one attempted (non-cache-hit) model call and flips `aborted` once the failure-rate threshold is crossed. */
+function recordGraphExtractionAttempt(state, failed) {
+    if (state.aborted)
+        return;
+    state.attempts += 1;
+    if (failed)
+        state.failures += 1;
+    if (state.attempts < GRAPH_EXTRACTION_ABORT_MIN_ATTEMPTS)
+        return;
+    const failureRate = state.failures / state.attempts;
+    if (failureRate < GRAPH_EXTRACTION_ABORT_FAILURE_RATE)
+        return;
+    state.aborted = true;
+    state.message =
+        `graph extraction aborted — failure rate ${(failureRate * 100).toFixed(0)}% over ${state.attempts} ` +
+            `attempt(s) (>= ${GRAPH_EXTRACTION_ABORT_FAILURE_RATE * 100}% threshold). LLM may be unavailable.`;
+    warn(state.message);
+}
 export function getGraphExtractionIncludeTypes(config) {
     const configured = getIndexPassConfig(config.index, "graph")?.graphExtractionIncludeTypes;
     if (!configured || configured.length === 0)
@@ -200,6 +230,20 @@ function validateGraphCacheShape(raw) {
         ...(typeof obj.reason === "string" ? { reason: obj.reason } : {}),
     };
 }
+/**
+ * A `"failed"` extraction (provider error, invalid JSON, context overflow —
+ * see {@link GraphExtractionStatus}) must never be reused as a cache hit or
+ * re-persisted as one. R2: a dead provider upserted ~30,900 rows shaped
+ * `{"entities":[],"relations":[],"status":"failed","reason":"llm_error"}`,
+ * and both hit paths (the `llm_enrichment_cache` lookup and `reuseGraphNode`
+ * over the previous graph) validated the shape without checking `status`, so
+ * 92% of the persisted graph became a permanent hit that never retried. A
+ * failed result becomes a miss naturally and is overwritten on the next
+ * successful extraction; existing failed rows are left on disk untouched.
+ */
+function isFailedExtractionStatus(status) {
+    return status === "failed";
+}
 function loadGraphFile(stashRoot, db) {
     if (!db)
         return { files: [] };
@@ -252,6 +296,8 @@ function reuseGraphNode(previousNodes, candidate, bodyHash) {
         return undefined;
     if (node.bodyHash !== bodyHash)
         return undefined;
+    if (isFailedExtractionStatus(node.status))
+        return undefined;
     const validated = validateGraphCacheShape({ entities: node.entities, relations: node.relations });
     if (!validated)
         return undefined;
@@ -276,8 +322,9 @@ function planEligibleGraphExtractions(args) {
             if (entry?.bodyHash === bodyHash) {
                 try {
                     const cached = validateGraphCacheShape(JSON.parse(entry.resultJson));
-                    if (cached)
+                    if (cached && !isFailedExtractionStatus(cached.status)) {
                         return { kind: "cache-hit", candidate, bodyHash, cached, persistCache: false };
+                    }
                 }
                 catch {
                     // Corrupt cache rows are immutable model plans for this pass.
@@ -305,7 +352,7 @@ function graphRecordFromCachePlan(plan) {
     };
 }
 async function extractGraphBatches(args) {
-    const { plans, batchSize, signal, db, cacheVariant, telemetry, llmRunner, lease, featureConfig, onFallback, batchState, runtimeTelemetry, onNotices, reportProgress, } = args;
+    const { plans, batchSize, signal, db, cacheVariant, telemetry, llmRunner, lease, featureConfig, onFallback, abortState, batchState, runtimeTelemetry, onNotices, reportProgress, maxChunksPerAsset, } = args;
     const results = new Array(plans.length).fill(undefined);
     const chunkStarts = [];
     for (let start = 0; start < plans.length; start += batchSize)
@@ -328,12 +375,12 @@ async function extractGraphBatches(args) {
                 continue;
             telemetry.cacheHits += 1;
             results[start + index] = graphRecordFromCachePlan(plan);
-            if (db && plan.persistCache) {
+            if (db && plan.persistCache && !isFailedExtractionStatus(plan.cached.status)) {
                 upsertLlmCacheEntry(db, plan.candidate.absPath, plan.bodyHash, JSON.stringify(plan.cached), cacheVariant);
             }
         }
         const modelPlans = chunk.filter((plan) => plan.kind === "model");
-        if (modelPlans.length === 0) {
+        if (modelPlans.length === 0 || abortState.aborted) {
             reportChunkProgress();
             return;
         }
@@ -345,6 +392,7 @@ async function extractGraphBatches(args) {
                 telemetry: runtimeTelemetry,
                 onNotices,
                 ...(lease ? { lease } : {}),
+                ...(maxChunksPerAsset != null ? { maxChunksPerAsset } : {}),
             });
         }
         catch (error) {
@@ -355,6 +403,8 @@ async function extractGraphBatches(args) {
             throw error;
         }
         let llmIndex = 0;
+        let dispatchHadResult = false;
+        let dispatchAllFailed = true;
         for (let index = 0; index < chunk.length; index++) {
             const plan = chunk[index];
             if (!plan || plan.kind !== "model")
@@ -369,7 +419,10 @@ async function extractGraphBatches(args) {
                 ...(extraction.status ? { status: extraction.status } : {}),
                 ...(extraction.reason ? { reason: extraction.reason } : {}),
             };
-            if (db) {
+            dispatchHadResult = true;
+            if (!isFailedExtractionStatus(cacheShape.status))
+                dispatchAllFailed = false;
+            if (db && !isFailedExtractionStatus(cacheShape.status)) {
                 upsertLlmCacheEntry(db, plan.candidate.absPath, plan.bodyHash, JSON.stringify(cacheShape), cacheVariant);
             }
             results[start + index] = {
@@ -379,6 +432,14 @@ async function extractGraphBatches(args) {
                 ...cacheShape,
             };
         }
+        // One attempt per `extractGraphFromBodies` dispatch (this chunk's batch
+        // call), not one per file it covers — mirrors consolidate.ts's
+        // totalChunksProcessed++/totalChunksFailed, which count once per chunk
+        // regardless of how many memories are in it. Counting per file let a
+        // single batched provider_error satisfy GRAPH_EXTRACTION_ABORT_MIN_ATTEMPTS
+        // after one HTTP failure whenever graphExtractionBatchSize >= 4.
+        if (dispatchHadResult)
+            recordGraphExtractionAttempt(abortState, dispatchAllFailed);
         reportChunkProgress();
     }, llmRunner.connection.concurrency ?? 1);
     return { results, ...(configFailure ? { configFailure } : {}) };
@@ -670,6 +731,7 @@ export async function runGraphExtractionPass(ctx) {
             batchingDisabled: false,
             nonArrayBatchFailures: 0,
         };
+        const abortState = { attempts: 0, failures: 0, aborted: false };
         warnVerbose(`graph extraction: starting for ${considered} eligible file(s) under ${primary.path}; ` +
             `includeTypes=${includeTypes.join(",")}, batchSize=${batchSize}, concurrency=${llmRunner.connection.concurrency ?? 1}, ` +
             `reEnrich=${reEnrich === true}, candidateScoped=${options.candidatePaths ? "true" : "false"}.`);
@@ -690,11 +752,15 @@ export async function runGraphExtractionPass(ctx) {
                 if (plan.kind === "cache-hit") {
                     telemetry.cacheHits += 1;
                     cached = plan.cached;
-                    if (db && plan.persistCache) {
+                    if (db && plan.persistCache && !isFailedExtractionStatus(cached.status)) {
                         upsertLlmCacheEntry(db, candidate.absPath, bodyHash, JSON.stringify(cached), cacheVariant);
                     }
                 }
                 else {
+                    if (abortState.aborted) {
+                        reportProgress(candidate.absPath, undefined);
+                        return undefined;
+                    }
                     telemetry.cacheMisses += 1;
                     let extraction;
                     try {
@@ -703,6 +769,7 @@ export async function runGraphExtractionPass(ctx) {
                             telemetry: runtimeTelemetry,
                             onNotices,
                             ...(dispatchLease ? { lease: dispatchLease } : {}),
+                            ...(options.maxChunksPerAsset != null ? { maxChunksPerAsset: options.maxChunksPerAsset } : {}),
                         });
                     }
                     catch (err) {
@@ -719,7 +786,8 @@ export async function runGraphExtractionPass(ctx) {
                         ...(extraction.status ? { status: extraction.status } : {}),
                         ...(extraction.reason ? { reason: extraction.reason } : {}),
                     };
-                    if (db) {
+                    recordGraphExtractionAttempt(abortState, isFailedExtractionStatus(cached.status));
+                    if (db && !isFailedExtractionStatus(cached.status)) {
                         upsertLlmCacheEntry(db, candidate.absPath, bodyHash, JSON.stringify(cached), cacheVariant);
                     }
                 }
@@ -754,8 +822,10 @@ export async function runGraphExtractionPass(ctx) {
                 onFallback,
                 batchState,
                 runtimeTelemetry,
+                abortState,
                 onNotices,
                 reportProgress,
+                ...(options.maxChunksPerAsset != null ? { maxChunksPerAsset: options.maxChunksPerAsset } : {}),
             });
             extractionResults = batch.results;
             configFailure ??= batch.configFailure;
@@ -797,14 +867,18 @@ export async function runGraphExtractionPass(ctx) {
         const assetRefs = mergedNodes.map((node) => node.path);
         const deduped = deduplicateGraph(mergedNodes.map((node) => ({ entities: node.entities, relations: node.relations })), assetRefs);
         telemetry.truncationCount = runtimeTelemetry.truncationCount ?? 0;
+        telemetry.truncatedChunks = runtimeTelemetry.truncatedChunks ?? 0;
         telemetry.failureCount = runtimeTelemetry.failureCount ?? 0;
         telemetry.htmlErrorCount = runtimeTelemetry.htmlErrorCount ?? 0;
         telemetry.retryAttempts = runtimeTelemetry.retryAttempts ?? 0;
         telemetry.nonArrayBatchFailures = runtimeTelemetry.nonArrayBatchFailures ?? 0;
+        telemetry.aborted = abortState.aborted;
         const qualityConsidered = mergedNodes.length;
         const qualityExtracted = mergedNodes.filter((node) => node.status === "extracted" && node.entities.length > 0).length;
         const quality = computeGraphQualityTelemetry(qualityConsidered, qualityExtracted, deduped.entities.length, deduped.relations.length);
         const warnings = buildLowQualityWarnings(quality, telemetry);
+        if (abortState.message)
+            warnings.push(abortState.message);
         for (const warning of warnings)
             warnVerbose(`graph extraction quality: ${warning}`);
         const graph = {

package/dist/indexer/passes/memory-inference.js

@@ -46,7 +46,7 @@ import { todayIso } from "../../core/common.js";
 import { concurrentMap } from "../../core/concurrent.js";
 import { ConfigError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
-import { recordWrittenPath } from "../../core/write-provenance.js";
+import { beginWriteProvenance, recordWrittenPath } from "../../core/write-provenance.js";
 import { writeAssetToSource } from "../../core/write-source.js";
 import { disposeLoweredExecutionDispatchLease, } from "../../integrations/agent/execution-lowering.js";
 import { isProcessEnabled } from "../../llm/feature-gate.js";
@@ -188,6 +188,18 @@ async function inferPendingMemoryRecord(plan, ctx) {
  * short-circuits to a no-op result.
  */
 export async function runMemoryInferencePass(ctx) {
+    // R78 (tier1-0917): owns the write-provenance journal end-to-end so it closes on every
+    // exit path, including a throw out of the body below — an unclosed journal
+    // would keep reporting every later write in this process as this call's own.
+    const provenance = beginWriteProvenance();
+    try {
+        return await runMemoryInferencePassBody(ctx, provenance);
+    }
+    finally {
+        provenance.end();
+    }
+}
+async function runMemoryInferencePassBody(ctx, provenance) {
     const { config, sources, signal, db, reEnrich, onProgress, options = {} } = ctx;
     const invocationOwnsRunner = Object.hasOwn(ctx, "llmRunner");
     const compressMemoryToDerivedMemory = options.compressMemoryToDerivedMemory ?? memoryInfer.compressMemoryToDerivedMemory;
@@ -202,6 +214,7 @@ export async function runMemoryInferencePass(ctx) {
         skippedAborted: 0,
         unaccounted: 0,
         htmlErrorCount: 0,
+        writtenPaths: [],
     };
     // Mutable sink threaded into compressMemoryToDerivedMemory so the per-call
     // HTML-error categorization (which is otherwise swallowed inside the feature
@@ -215,6 +228,8 @@ export async function runMemoryInferencePass(ctx) {
     const completeResult = () => {
         if (noticesByKey.size > 0)
             result.notices = Object.freeze([...noticesByKey.values()]);
+        // Non-destructive read — the wrapper's `finally` owns closing the journal.
+        result.writtenPaths = provenance.writtenPaths();
         return result;
     };
     // Gate 1 — feature gate via isProcessEnabled, which reads the 0.8.0 path

package/dist/llm/client.js

@@ -117,12 +117,24 @@ export function isContextSizeError(message) {
         /exceeded|over.*limit|too.*long/.test(lower);
     return evidence;
 }
+/**
+ * Codes describing a failure to reach or get a usable response from the
+ * provider transport itself, as opposed to a malformed-but-received response
+ * (`parse_error`) or a request-shape rejection (`rate_limited`). Shared by
+ * {@link isRetryable} (which additionally requires evidence the failure is
+ * transient) and the batch graph-extraction storm guard in `graph-extract.ts`
+ * (which treats any of these as "the provider is down, stop retrying
+ * per-asset") so the two classifications cannot drift apart.
+ */
+export function isTransportFailure(err) {
+    return err.code === "provider_error" || err.code === "network_error" || err.code === "provider_html_error";
+}
 /**
  * Decide whether a first-attempt {@link LlmCallError} is eligible for a single
  * retry. Retryable: HTTP 5xx (`provider_error` with statusCode >= 500) and
  * `network_error` whose message looks like a transient connection drop.
- * NOT retryable: 4xx, `rate_limited` (429), `timeout`, `parse_error`, and
- * context-overflow-classified errors.
+ * NOT retryable: 4xx, `rate_limited` (429), `timeout`, `parse_error`,
+ * `provider_html_error`, and context-overflow-classified errors.
  *
  * The connection-drop heuristic covers the substrings emitted across runtimes
  * for a mid-flight socket close:
@@ -141,6 +153,8 @@ export function isContextSizeError(message) {
 function isRetryable(err) {
     if (isContextSizeError(err.message))
         return false;
+    if (!isTransportFailure(err))
+        return false;
     if (err.code === "provider_error") {
         return typeof err.statusCode === "number" && err.statusCode >= 500;
     }

package/dist/llm/graph-extract.js

@@ -25,7 +25,7 @@ import { toErrorMessage } from "../core/common.js";
 import { ConfigError } from "../core/errors.js";
 import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { warn, warnVerbose } from "../core/warn.js";
-import { isContextSizeError } from "./client.js";
+import { isContextSizeError, isTransportFailure, LlmCallError } from "./client.js";
 import { tryLlmFeature } from "./feature-gate.js";
 import { callStructured } from "./structured-call.js";
 /**
@@ -33,7 +33,7 @@ import { callStructured } from "./structured-call.js";
  * Chosen to be visually clear and unlikely to appear verbatim in asset bodies.
  */
 const BATCH_ASSET_SEPARATOR = "=== ASSET";
-export const GRAPH_EXTRACT_PROMPT_VERSION = "v2";
+export const GRAPH_EXTRACT_PROMPT_VERSION = "v3";
 /** Asset bodies longer than this are chunked instead of truncated. */
 const MAX_CHUNK_BODY_CHARS = 1600;
 /** Bodies longer than this are excluded from multi-asset batch prompts. */
@@ -44,10 +44,72 @@ const NON_ARRAY_BATCH_DISABLE_THRESHOLD = 2;
 const MAX_ENTITIES_PER_ASSET = 32;
 /** Hard cap on relations returned per asset. */
 const MAX_RELATIONS_PER_ASSET = 32;
+/**
+ * Default cap on chunks processed per asset (R12b + R20) — overridable via
+ * `processes.graphExtraction.maxChunksPerAsset`. Without a cap, one long file
+ * chunked at MAX_CHUNK_BODY_CHARS could spend dozens of calls on a single
+ * asset (one file spent 21 of 27 run calls this way) before its output was
+ * sliced to MAX_ENTITIES_PER_ASSET/MAX_RELATIONS_PER_ASSET anyway.
+ */
+const DEFAULT_MAX_CHUNKS_PER_ASSET = 8;
 const SYSTEM_PROMPT = systemPromptTemplate;
 const USER_PROMPT_PREFIX = userPromptTemplate
     .replace("{{MAX_ENTITIES}}", String(MAX_ENTITIES_PER_ASSET))
     .replace("{{MAX_RELATIONS}}", String(MAX_RELATIONS_PER_ASSET));
+/**
+ * Strict JSON Schema for one asset's extraction payload (R12b, compacted for
+ * R12). Sent via `responseSchema` to providers that opt into structured
+ * output (`runner.connection.supportsJsonSchema` — same lift as
+ * memory-infer.ts's `DERIVED_MEMORY_JSON_SCHEMA`); the client silently drops
+ * it otherwise. `maxItems` mirrors MAX_ENTITIES_PER_ASSET/MAX_RELATIONS_PER_ASSET
+ * so a compliant provider cannot pay for output beyond what
+ * parseGraphExtraction keeps. Relations are compact `[from, type, to]`
+ * triples (`type` may be `""`) rather than `{"from","to","type"}` objects —
+ * the object-keyed form cost 10+ tokens per relation for no signal, and
+ * output tokens cost far more than prompt tokens. There is deliberately no
+ * relation-level `confidence` in the schema (the prompt never asks for one);
+ * `parseGraphExtraction` still reads it from a legacy object-shaped relation
+ * for backward compatibility. `confidence` stays at the extraction level —
+ * parseGraphExtraction reads it into the merged confidence.
+ * `additionalProperties: false` forbids anything else. Reused as the `items`
+ * schema of a batch call's array response (see
+ * {@link buildBatchResponseSchema}) so a single-asset and a batched call
+ * bound entities/relations identically.
+ */
+const GRAPH_EXTRACTION_ITEM_SCHEMA = {
+    type: "object",
+    properties: {
+        entities: { type: "array", items: { type: "string" }, maxItems: MAX_ENTITIES_PER_ASSET },
+        relations: {
+            type: "array",
+            maxItems: MAX_RELATIONS_PER_ASSET,
+            items: {
+                type: "array",
+                items: { type: "string" },
+                minItems: 3,
+                maxItems: 3,
+            },
+        },
+        confidence: { type: "number" },
+    },
+    required: ["entities", "relations"],
+    additionalProperties: false,
+};
+/** Schema for {@link extractGraphFromBody}'s single-asset `responseSchema`. */
+const GRAPH_EXTRACTION_JSON_SCHEMA = GRAPH_EXTRACTION_ITEM_SCHEMA;
+/**
+ * Schema for {@link extractGraphFromBodies}' batch `responseSchema` — an
+ * array of exactly `count` {@link GRAPH_EXTRACTION_ITEM_SCHEMA} elements, one
+ * per asset in the batch, matching the batch prompt's contract.
+ */
+function buildBatchResponseSchema(count) {
+    return {
+        type: "array",
+        minItems: count,
+        maxItems: count,
+        items: GRAPH_EXTRACTION_ITEM_SCHEMA,
+    };
+}
 const GENERIC_ENTITIES = new Set([
     "agent",
     "application",
@@ -152,12 +214,14 @@ function mergeGraphExtractions(extractions) {
     const relationChunkCounts = new Map();
     let confidence;
     let truncationCount = 0;
+    let truncatedChunks = 0;
     let filteredGenericEntities = 0;
     let filteredInvalidRelations = 0;
     let filteredLowConfidenceRelations = 0;
     let firstFailureReason;
     for (const extraction of extractions) {
         truncationCount += extraction.truncationCount ?? 0;
+        truncatedChunks += extraction.truncatedChunks ?? 0;
         filteredGenericEntities += extraction.filteredGenericEntities ?? 0;
         filteredInvalidRelations += extraction.filteredInvalidRelations ?? 0;
         filteredLowConfidenceRelations += extraction.filteredLowConfidenceRelations ?? 0;
@@ -234,6 +298,7 @@ function mergeGraphExtractions(extractions) {
         reason,
         chunkCount: extractions.length,
         truncationCount,
+        truncatedChunks,
         filteredGenericEntities,
         filteredInvalidRelations,
         filteredLowConfidenceRelations,
@@ -283,13 +348,36 @@ function parseGraphExtraction(raw) {
     let filteredLowConfidenceRelations = 0;
     if (Array.isArray(item.relations)) {
         for (const relation of item.relations) {
-            if (typeof relation !== "object" || relation === null || Array.isArray(relation)) {
+            // Compact triple form `[from, type, to]` (R12) — `type` may be "".
+            // Legacy `{"from","to","type","confidence"}` object form still parses
+            // for backward compatibility (older cached prompts, other callers).
+            let fromRaw;
+            let toRaw;
+            let typeRaw;
+            let confidenceRaw;
+            if (Array.isArray(relation)) {
+                if (relation.length !== 3 ||
+                    typeof relation[0] !== "string" ||
+                    typeof relation[1] !== "string" ||
+                    typeof relation[2] !== "string") {
+                    filteredInvalidRelations += 1;
+                    continue;
+                }
+                fromRaw = normalizeEntityName(relation[0]);
+                typeRaw = relation[1];
+                toRaw = normalizeEntityName(relation[2]);
+            }
+            else if (typeof relation === "object" && relation !== null) {
+                const rel = relation;
+                fromRaw = typeof rel.from === "string" ? normalizeEntityName(rel.from) : "";
+                toRaw = typeof rel.to === "string" ? normalizeEntityName(rel.to) : "";
+                typeRaw = typeof rel.type === "string" ? rel.type : undefined;
+                confidenceRaw = rel.confidence;
+            }
+            else {
                 filteredInvalidRelations += 1;
                 continue;
             }
-            const rel = relation;
-            const fromRaw = typeof rel.from === "string" ? normalizeEntityName(rel.from) : "";
-            const toRaw = typeof rel.to === "string" ? normalizeEntityName(rel.to) : "";
             if (!fromRaw || !toRaw) {
                 filteredInvalidRelations += 1;
                 continue;
@@ -300,12 +388,12 @@ function parseGraphExtraction(raw) {
                 filteredInvalidRelations += 1;
                 continue;
             }
-            const type = typeof rel.type === "string" ? normalizeRelationType(rel.type) : undefined;
+            const type = typeRaw !== undefined ? normalizeRelationType(typeRaw) : undefined;
             if (type !== undefined && GENERIC_RELATION_TYPES.has(type)) {
                 filteredInvalidRelations += 1;
                 continue;
             }
-            const confidence = parseConfidence(rel.confidence);
+            const confidence = parseConfidence(confidenceRaw);
             if (confidence !== undefined && confidence < MIN_RELATION_CONFIDENCE) {
                 filteredLowConfidenceRelations += 1;
                 continue;
@@ -356,8 +444,8 @@ function parseGraphExtraction(raw) {
  *
  *   Expected model output (valid JSON array, no prose):
  *     [
- *       {"entities":["ServiceA","ServiceB"],"relations":[{"from":"ServiceA","to":"ServiceB","type":"integrates with"}]},
- *       {"entities":["Terraform","Prod cluster"],"relations":[{"from":"Terraform","to":"Prod cluster","type":"provisions"}]},
+ *       {"entities":["ServiceA","ServiceB"],"relations":[["ServiceA","integrates with","ServiceB"]]},
+ *       {"entities":["Terraform","Prod cluster"],"relations":[["Terraform","provisions","Prod cluster"]]},
  *       {"entities":[],"relations":[]}
  *     ]
  *
@@ -389,10 +477,10 @@ function buildBatchUserPrompt(bodies) {
     return (`Extract entities and relations from the N=${count} assets below.\n\n` +
         `Rules:\n` +
         `- Output ONLY a JSON array of exactly ${count} objects, one per asset, preserving input order.\n` +
-        `- Each object: {"entities": ["Entity One", ...], "relations": [{"from": "A", "to": "B", "type": "uses"}, ...]}\n` +
+        `- Each object: {"entities": ["Entity One", ...], "relations": [["A", "uses", "B"], ...]}\n` +
         `- Entities are short, canonical noun phrases (project names, services, tools, people, file/dir names, technical concepts).\n` +
-        `- Relations connect two entities that both appear in that asset's entities array.\n` +
-        `- "type" is a short verb phrase (e.g. "uses", "depends on", "owns"). Optional; omit when unsure.\n` +
+        `- Each relation is a 3-element array: [from, type, to]. Relations connect two entities that both appear in that asset's entities array.\n` +
+        `- "type" is a short verb phrase (e.g. "uses", "depends on", "owns"). Use "" when unsure.\n` +
         `- Drop pleasantries, meta-commentary, and timestamps.\n` +
         `- Limit to at most ${MAX_ENTITIES_PER_ASSET} entities and ${MAX_RELATIONS_PER_ASSET} relations per asset.\n` +
         `- Use {"entities":[],"relations":[]} for assets with no extractable graph content.\n` +
@@ -504,12 +592,26 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
     }
     const systemPrompt = buildBatchSystemPrompt();
     const userPrompt = buildBatchUserPrompt(nonEmptyBodies);
+    // Same responseSchema lift as extractGraphFromBody (R12b), scoped to this
+    // batch's asset count so a compliant provider bounds every element's
+    // entities/relations by the same maxItems as the single-asset path.
+    const batchResponseSchema = buildBatchResponseSchema(nonEmptyBodies.length);
     const truncatedBodies = nonEmptyBodies.filter((body) => body.length > MAX_BATCH_BODY_CHARS).length;
     if (truncatedBodies > 0) {
         warnVerbose(`graph extraction (batch): ${truncatedBodies}/${nonEmptyBodies.length} asset body/bodies exceed the batch body threshold of ${MAX_BATCH_BODY_CHARS} chars.`);
     }
     let batchContextError = false;
     let nonArrayResponse = false;
+    // R2: a dead/erroring provider must not be hammered with a per-asset
+    // fallback retry for every body in the batch — that is what turned one
+    // outage into 15,453 additional retry attempts. `isTransportFailure`
+    // (shared with client.ts's `isRetryable` — see its definition) covers
+    // `provider_error`, `network_error`, and `provider_html_error`: the
+    // provider itself is failing (a dead endpoint more often raises
+    // `network_error` or `provider_html_error` than a plain 5xx), not that this
+    // particular response was malformed; skip the fallback and record every
+    // asset as failed instead.
+    let batchProviderError = false;
     const batchOutcome = await tryLlmFeature("graph_extraction", akmConfig, async () => {
         try {
             const raw = await callGraphLlm(llmRunner, [
@@ -519,6 +621,7 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
                 temperature: 0.1,
                 timeoutMs: llmRunner.timeoutMs,
                 signal,
+                responseSchema: batchResponseSchema,
                 onRetryAttempt: () => bumpTelemetry(options.telemetry, "retryAttempts"),
             }, options.lease, options.onNotices);
             if (!raw)
@@ -535,7 +638,12 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
                 const retryRaw = await callGraphLlm(llmRunner, [
                     { role: "system", content: buildBatchRetrySystemPrompt() },
                     { role: "user", content: userPrompt },
-                ], { temperature: 0, timeoutMs: llmRunner.timeoutMs, signal }, options.lease, options.onNotices);
+                ], {
+                    temperature: 0,
+                    timeoutMs: llmRunner.timeoutMs,
+                    signal,
+                    responseSchema: batchResponseSchema,
+                }, options.lease, options.onNotices);
                 parsed = retryRaw ? parseEmbeddedJsonResponse(retryRaw, { expect: "array" }) : undefined;
             }
             if (!Array.isArray(parsed)) {
@@ -564,6 +672,12 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
                 warn(`graph extraction (batch): context size exceeded for ${nonEmptyBodies.length} asset(s); ` +
                     `skipping batch. promptChars=${userPrompt.length}${formatContextHint(llmRunner)}`);
             }
+            else if (err instanceof LlmCallError && isTransportFailure(err)) {
+                batchProviderError = true;
+                bumpTelemetry(options.telemetry, "failureCount", nonEmptyBodies.length);
+                warn(`graph extraction (batch): provider error (${err.code}) for ${nonEmptyBodies.length} asset(s); ` +
+                    `skipping per-asset fallback retries. promptChars=${userPrompt.length}${formatContextHint(llmRunner)}: ${errMsg}`);
+            }
             else {
                 warn(`graph extraction (batch) failed for ${nonEmptyBodies.length} asset(s); ` +
                     `promptChars=${userPrompt.length}${formatContextHint(llmRunner)}: ${errMsg}`);
@@ -581,6 +695,13 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
     if (batchResult !== null) {
         applySuccessfulBatchResults(results, batchResult, nonEmptyBodies, nonEmptyIndices, batchState);
     }
+    else if (batchProviderError) {
+        // No per-asset fallback against a failing provider — record every asset
+        // in this batch as a genuine failure so it is neither silently empty nor
+        // retried again below.
+        for (const origIdx of nonEmptyIndices)
+            results[origIdx] = { entities: [], relations: [], status: "failed", reason: "llm_error" };
+    }
     if (batchContextError && nonEmptyBodies.length > 1) {
         const splitAt = Math.ceil(nonEmptyBodies.length / 2);
         const left = await extractGraphFromBodies(llmRunner, nonEmptyBodies.slice(0, splitAt), signal, akmConfig, onFallback, options);
@@ -601,6 +722,8 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
     const fallbackIndices = nonEmptyIndices.filter((_origIdx, j) => {
         if (batchContextError)
             return false; // skip individual retries on context error
+        if (batchProviderError)
+            return false; // skip individual retries against a failing provider
         // Result is still empty → needs a fallback call.
         if (batchResult === null)
             return true;
@@ -653,17 +776,34 @@ export async function extractGraphFromBody(llmRunner, body, signal, akmConfig, o
         bumpTelemetry(options.telemetry, "truncationCount", chunked.truncationCount);
         warnVerbose(`graph extraction: split a long asset into ${chunked.chunks.length} chunk(s) with ${chunked.truncationCount} hard split(s).`);
     }
-    if (chunked.chunks.length > 1) {
+    // R12b + R20: bound per-asset cost by capping how many chunks of a long
+    // asset are ever sent to the LLM. Excess chunks are dropped, never
+    // processed — the coverage loss is recorded as truncatedChunks rather than
+    // silently absorbed.
+    const maxChunksPerAsset = options.maxChunksPerAsset ?? DEFAULT_MAX_CHUNKS_PER_ASSET;
+    const cappedChunks = chunked.chunks.length > maxChunksPerAsset ? chunked.chunks.slice(0, maxChunksPerAsset) : chunked.chunks;
+    const truncatedChunkCount = chunked.chunks.length - cappedChunks.length;
+    if (truncatedChunkCount > 0) {
+        bumpTelemetry(options.telemetry, "truncatedChunks", truncatedChunkCount);
+        warnVerbose(`graph extraction: capped a long asset to ${cappedChunks.length} of ${chunked.chunks.length} chunk(s) ` +
+            `(maxChunksPerAsset=${maxChunksPerAsset}); ${truncatedChunkCount} chunk(s) not processed.`);
+    }
+    if (cappedChunks.length > 1) {
         const chunkResults = [];
-        for (const chunk of chunked.chunks) {
+        for (const chunk of cappedChunks) {
             chunkResults.push(await extractGraphFromBody(llmRunner, chunk, signal, akmConfig, onFallback, options));
         }
         const merged = mergeGraphExtractions(chunkResults);
         merged.truncationCount = (merged.truncationCount ?? 0) + chunked.truncationCount;
+        merged.truncatedChunks = (merged.truncatedChunks ?? 0) + truncatedChunkCount;
         return merged;
     }
-    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody}`;
-    return callStructured({
+    // When capped down to exactly one chunk from a body that originally split
+    // into more, that single surviving chunk (not the full trimmedBody) is what
+    // must be sent — otherwise the cap would have no effect on prompt size.
+    const bodyForCall = truncatedChunkCount > 0 ? (cappedChunks[0] ?? trimmedBody) : trimmedBody;
+    const userPrompt = `${USER_PROMPT_PREFIX}${bodyForCall}`;
+    const result = await callStructured({
         feature: "graph_extraction",
         akmConfig,
         runner: llmRunner,
@@ -676,6 +816,7 @@ export async function extractGraphFromBody(llmRunner, body, signal, akmConfig, o
             temperature: 0.1,
             timeoutMs: llmRunner.timeoutMs,
             signal,
+            responseSchema: GRAPH_EXTRACTION_JSON_SCHEMA,
             onRetryAttempt: () => bumpTelemetry(options.telemetry, "retryAttempts"),
         },
         onNotices: options.onNotices,
@@ -718,6 +859,9 @@ export async function extractGraphFromBody(llmRunner, body, signal, akmConfig, o
         fallback: empty(),
         onFallback,
     });
+    if (truncatedChunkCount > 0)
+        result.truncatedChunks = (result.truncatedChunks ?? 0) + truncatedChunkCount;
+    return result;
 }
 // deduplicateGraph lives in src/indexer/graph/graph-dedup.ts (pure utility, no
 // LLM calls) — import it from there directly. The re-export that used to live