arkaos 4.13.2 → 4.14.1

package/core/shared/decay.py

@@ -0,0 +1,94 @@
+"""Knowledge decay — "the graph that forgets" (F1-C1, ruflo teardown).
+
+Read-time exponential decay for knowledge stores (pattern cards as of
+F1-C1; recipes and agent experiences wire in F1-C2): records are NEVER
+deleted by decay — they fade out of context injection unless
+reinforcement re-touches them.
+Verified semantics from the claude-flow v3 teardown: rows carry a
+last-reinforced timestamp; weight halves every ``half_life_days``;
+consumers drop records below a floor from injection only.
+
+Config (``~/.arkaos/config.json``):
+    knowledge.decay.enabled       default True
+    knowledge.decay.halfLifeDays  default 60
+Env kill-switch: ``ARKA_KNOWLEDGE_DECAY=0``.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import os
+from datetime import UTC, datetime
+from pathlib import Path
+
+DEFAULT_HALF_LIFE_DAYS = 60.0
+INJECTION_FLOOR = 0.15  # below this weight a record fades from injection
+_CONFIG_PATH = Path.home() / ".arkaos" / "config.json"
+
+
+def _decay_config() -> dict:
+    try:
+        data = json.loads(_CONFIG_PATH.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    knowledge = data.get("knowledge")
+    if not isinstance(knowledge, dict):
+        return {}
+    section = knowledge.get("decay")
+    return section if isinstance(section, dict) else {}
+
+
+def decay_enabled() -> bool:
+    if os.environ.get("ARKA_KNOWLEDGE_DECAY", "").strip() == "0":
+        return False
+    return bool(_decay_config().get("enabled", True))
+
+
+def half_life_days() -> float:
+    value = _decay_config().get("halfLifeDays", DEFAULT_HALF_LIFE_DAYS)
+    try:
+        parsed = float(value)
+    except (TypeError, ValueError):
+        return DEFAULT_HALF_LIFE_DAYS
+    return parsed if parsed > 0 else DEFAULT_HALF_LIFE_DAYS
+
+
+def _parse_ts(ts: str) -> datetime | None:
+    try:
+        parsed = datetime.fromisoformat(ts)
+    except (ValueError, TypeError):
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=UTC)
+    return parsed
+
+
+def decayed_weight(
+    last_reinforced_iso: str,
+    half_life: float | None = None,
+    now: datetime | None = None,
+    enabled: bool | None = None,
+) -> float:
+    """Weight in (0, 1]: 1.0 fresh, 0.5 after one half-life, and so on.
+
+    An unparseable/empty timestamp returns the floor (not 0.0): a record
+    with unknown age is dimmed, never silently erased from ranking.
+    When decay is disabled every record weighs 1.0.
+
+    Hot-path callers MUST hoist the config reads: resolve
+    ``decay_enabled()`` and ``half_life_days()`` ONCE per query and pass
+    them via ``enabled``/``half_life`` — per-record config parsing on an
+    injection path is the exact laziness this param surface exists to
+    prevent.
+    """
+    if not (decay_enabled() if enabled is None else enabled):
+        return 1.0
+    parsed = _parse_ts(last_reinforced_iso or "")
+    if parsed is None:
+        return INJECTION_FLOOR
+    current = now or datetime.now(UTC)
+    age_days = max(0.0, (current - parsed).total_seconds() / 86400.0)
+    return math.pow(0.5, age_days / (half_life or half_life_days()))

package/core/shared/sqlite_recovery.py

@@ -0,0 +1,266 @@
+"""SQLite self-heal (F1-D1 — memory/learning reform).
+
+Python port of a verified claude-flow v3 pattern (recoverMemoryDatabase):
+    1. confirm corruption first (``PRAGMA quick_check``) — never rewrite
+       a healthy DB
+    2. exclusive-writer guard (``BEGIN IMMEDIATE``) — never race a live
+       writer
+    3. salvage rows in rowid-range chunks into a sibling file — rows on
+       unreadable pages are lost, rows on healthy pages survive; a table
+       whose schema can't be recreated is skipped whole
+    4. verify the rebuild BEFORE touching the original:
+       ``integrity_check`` plus a non-circular row floor — a rebuild
+       that lost every row of a store that demonstrably had rows, or
+       less than half of any fully-countable table, is refused
+    5. atomic ``os.replace`` swap, corrupt original kept as ``.bak``
+
+Never destructive: every failure path leaves the original untouched,
+and a "successful" heal that would silently empty the live store is
+treated as a failure (``verify-failed``), not a success.
+
+CLI: ``python3 -m core.shared.sqlite_recovery <db_path>``
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sqlite3
+import sys
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Optional
+
+from pydantic import BaseModel
+
+_SALVAGE_CHUNK = 200  # rows fetched per rowid-range step
+_MAX_SKIPS = 4096  # single-row steps past unreadable rows — bounded walk
+_FLOOR_FRACTION = 0.5  # countable tables must keep at least this share
+
+
+class RecoveryResult(BaseModel):
+    """Outcome of a recovery attempt — reasons are honest, never blank."""
+
+    recovered: bool = False
+    reason: str = ""
+    backup_path: str = ""
+    rows_recovered: int = 0
+
+
+@dataclass
+class SalvageOutcome:
+    copied: int = 0  # rows written to the rebuild
+    countable_est: int = 0  # source rows across fully-countable tables
+    countable_copied: int = 0  # rows copied from those same tables
+    hit_errors: bool = False  # at least one unreadable range/table
+
+
+def _quote(name: str) -> str:
+    """Quote an SQL identifier from a possibly-hostile sqlite_master."""
+    return '"' + name.replace('"', '""') + '"'
+
+
+def _quick_check_ok(conn: sqlite3.Connection) -> bool:
+    try:
+        row = conn.execute("PRAGMA quick_check(1)").fetchone()
+        return bool(row) and str(row[0]).lower() == "ok"
+    except sqlite3.DatabaseError:
+        return False  # so corrupt the check itself fails — proceed to salvage
+
+
+def _count_rows(src: sqlite3.Connection, name: str) -> Optional[int]:
+    """Best-effort source count; None when the table can't be scanned."""
+    count_sql = f"SELECT COUNT(*) FROM {_quote(name)}"  # identifier quoted above
+    try:
+        return int(src.execute(count_sql).fetchone()[0])
+    except sqlite3.Error:
+        return None
+
+
+def _copy_whole(src: sqlite3.Connection, dst: sqlite3.Connection, name: str) -> tuple[int, bool]:
+    """WITHOUT ROWID fallback: all-or-nothing copy of one table."""
+    select_sql = f"SELECT * FROM {_quote(name)}"  # identifier quoted above
+    try:
+        rows = src.execute(select_sql).fetchall()
+    except sqlite3.Error:
+        return 0, True
+    if rows:
+        marks = ",".join("?" * len(rows[0]))
+        dst.executemany(f"INSERT OR IGNORE INTO {_quote(name)} VALUES ({marks})", rows)
+    return len(rows), False
+
+
+def _narrow_or_step(chunk: int, last: int, skips: int) -> tuple[int, int, int]:
+    """Halve a failing range; once isolated, step past ONLY the bad row."""
+    if chunk > 1:
+        return chunk // 2, last, skips
+    return 1, last + 1, skips + 1
+
+
+def _walk_table(src: sqlite3.Connection, dst: sqlite3.Connection, name: str) -> tuple[int, bool]:
+    """Adaptive rowid walk — one bad page loses only its own rows,
+    never healthy neighbours."""
+    q = _quote(name)
+    table_info_sql = f"PRAGMA table_info({q})"  # identifier quoted above
+    cols = [r[1] for r in dst.execute(table_info_sql).fetchall()]
+    if not cols:
+        return 0, True
+    col_list = ",".join(["rowid"] + [_quote(c) for c in cols])
+    marks = ",".join("?" * (len(cols) + 1))
+    insert = f"INSERT OR IGNORE INTO {q} ({col_list}) VALUES ({marks})"
+    select_sql = f"SELECT rowid,* FROM {q} WHERE rowid > ? ORDER BY rowid LIMIT ?"
+    copied, errors, skips, last, chunk = 0, False, 0, 0, _SALVAGE_CHUNK
+    while skips < _MAX_SKIPS:
+        try:
+            rows = src.execute(select_sql, (last, chunk)).fetchall()
+        except sqlite3.Error as exc:
+            if isinstance(exc, sqlite3.OperationalError) and "rowid" in str(exc).lower():
+                return _copy_whole(src, dst, name)  # WITHOUT ROWID table
+            errors = True
+            chunk, last, skips = _narrow_or_step(chunk, last, skips)
+            continue
+        if not rows:
+            break
+        dst.executemany(insert, rows)
+        copied, last, chunk = copied + len(rows), rows[-1][0], _SALVAGE_CHUNK
+    return copied, errors
+
+
+def _salvage_into(src: sqlite3.Connection, tmp_path: Path) -> SalvageOutcome:
+    """Copy schema + readable rows into ``tmp_path`` (table-level stats)."""
+    objects = src.execute(
+        "SELECT type, name, sql FROM sqlite_master "
+        "WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite_%'"
+    ).fetchall()
+    out = SalvageOutcome()
+    dst = sqlite3.connect(tmp_path)
+    try:
+        for kind, name, sql in objects:
+            if kind != "table":
+                continue
+            try:
+                dst.execute(sql)
+            except sqlite3.Error:
+                out.hit_errors = True
+                continue  # untranslatable table def — skip whole table
+            copied, errors = _walk_table(src, dst, name)
+            out.copied += copied
+            out.hit_errors = out.hit_errors or errors
+            est = _count_rows(src, name)
+            if est is not None:
+                out.countable_est += est
+                out.countable_copied += copied
+        for kind, _name, sql in objects:
+            if kind == "table":
+                continue
+            try:
+                dst.execute(sql)
+            except sqlite3.Error:
+                pass  # an index over corrupt data — non-fatal
+        dst.commit()
+        return out
+    finally:
+        dst.close()
+
+
+def _floor_ok(out: SalvageOutcome) -> bool:
+    """Refuse a rebuild that silently emptied or gutted the store."""
+    had_rows = out.countable_est > 0 or out.hit_errors
+    if out.copied == 0 and had_rows:
+        return False
+    if out.countable_est > 0:
+        return out.countable_copied >= int(out.countable_est * _FLOOR_FRACTION)
+    return True
+
+
+def _rebuilt_is_healthy(tmp_path: Path, out: SalvageOutcome) -> bool:
+    """Verify BEFORE touching the original: integrity ok + row floor."""
+    if not _floor_ok(out):
+        return False
+    try:
+        check = sqlite3.connect(f"file:{tmp_path}?mode=ro", uri=True)
+        try:
+            row = check.execute("PRAGMA integrity_check").fetchone()
+            return bool(row) and str(row[0]).lower() == "ok"
+        finally:
+            check.close()
+    except sqlite3.Error:
+        return False
+
+
+def _swap_in(db: Path, tmp: Path, bak: Path, copied: int) -> RecoveryResult:
+    """Back up the corrupt original, then atomically install the rebuild."""
+    shutil.copyfile(db, bak)
+    os.replace(tmp, db)
+    for suffix in ("-wal", "-shm"):
+        Path(f"{db}{suffix}").unlink(missing_ok=True)
+    return RecoveryResult(recovered=True, backup_path=str(bak), rows_recovered=copied)
+
+
+def recover(db_path: str | Path) -> RecoveryResult:
+    """Attempt in-place recovery of a corrupt SQLite file (see module doc)."""
+    db = Path(db_path)
+    if not db.is_file():
+        return RecoveryResult(reason="no-db")
+    ts = int(time.time() * 1000)
+    tmp = db.with_name(f"{db.name}.recovering-{ts}")
+    bak = db.with_name(f"{db.name}.corrupt-{ts}.bak")
+    src = sqlite3.connect(db, timeout=1.5, isolation_level=None)
+    try:
+        if _quick_check_ok(src):
+            return RecoveryResult(reason="not-corrupt")
+        try:
+            src.execute("BEGIN IMMEDIATE")
+        except sqlite3.OperationalError:
+            return RecoveryResult(reason="writer-active")
+        except sqlite3.DatabaseError:
+            # Not even lockable (e.g. "file is not a database") — nothing
+            # sqlite3 can salvage; leave the original byte-for-byte intact.
+            return RecoveryResult(reason="unreadable")
+        try:
+            outcome = _salvage_into(src, tmp)
+        except sqlite3.Error:
+            tmp.unlink(missing_ok=True)
+            return RecoveryResult(reason="unreadable")
+        finally:
+            try:
+                src.execute("ROLLBACK")
+            except sqlite3.Error:
+                pass
+    finally:
+        src.close()
+    if not _rebuilt_is_healthy(tmp, outcome):
+        tmp.unlink(missing_ok=True)
+        return RecoveryResult(reason="verify-failed")
+    return _swap_in(db, tmp, bak, outcome.copied)
+
+
+def open_with_recovery(db_path: str | Path, opener):
+    """Run ``opener()``; on DatabaseError recover ONCE and retry.
+
+    ``opener`` is a zero-arg callable that opens/initialises the store.
+    A second failure propagates — callers keep their own degraded paths.
+    """
+    try:
+        return opener()
+    except sqlite3.DatabaseError:
+        result = recover(db_path)
+        if not result.recovered:
+            raise
+        return opener()
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = argv if argv is not None else sys.argv[1:]
+    if len(args) != 1:
+        print("usage: python3 -m core.shared.sqlite_recovery <db_path>")
+        return 2
+    result = recover(args[0])
+    print(json.dumps(result.model_dump()))
+    return 0 if result.recovered or result.reason == "not-corrupt" else 1
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())

package/core/synapse/agent_experiences_layer.py

@@ -68,11 +68,19 @@ class AgentExperiencesLayer(Layer):
         if not experiences:
             return self._empty_result(start, tag=f"[agent-experiences:{target} none]")
 
-        content = format_experiences(target, experiences)
+        # F1-C2 decay: stale lessons collapse to a count line instead of
+        # full injection — history is never lost (JSONL untouched), it
+        # just stops paying context rent.
+        fresh, faded_count = _split_by_decay(experiences)
+        if not fresh:
+            return self._empty_result(
+                start, tag=f"[agent-experiences:{target} faded:{faded_count}]"
+            )
+        content = format_experiences(target, fresh, faded_count=faded_count)
         ms = int((time.time() - start) * 1000)
         return LayerResult(
             layer_id=self.id,
-            tag=f"[agent-experiences:{target} count:{len(experiences)}]",
+            tag=f"[agent-experiences:{target} count:{len(fresh)}]",
             content=content,
             tokens_est=max(1, len(content) // 4),
             compute_ms=ms,
@@ -100,7 +108,33 @@ def _extract_dispatch_target(user_input: str) -> str | None:
     return matches[-1].group(1).lower()
 
 
-def format_experiences(target: str, experiences: list[Experience]) -> str:
+def _split_by_decay(experiences: list[Experience]) -> tuple[list[Experience], int]:
+    """Partition lessons into fresh (rendered) and faded (counted only).
+
+    Read-time only: decay for an append-only experience JSONL needs no
+    reinforcement field — a lesson's age IS its ``ts``. Config resolved
+    ONCE per call (hot-path hoisting mandated by core/shared/decay.py).
+    """
+    from core.shared.decay import (
+        INJECTION_FLOOR,
+        decay_enabled,
+        decayed_weight,
+        half_life_days,
+    )
+
+    if not decay_enabled():
+        return experiences, 0
+    hl = half_life_days()
+    fresh = [
+        exp for exp in experiences
+        if decayed_weight(exp.ts, half_life=hl, enabled=True) >= INJECTION_FLOOR
+    ]
+    return fresh, len(experiences) - len(fresh)
+
+
+def format_experiences(
+    target: str, experiences: list[Experience], faded_count: int = 0
+) -> str:
     """Render a compact, model-readable summary of past lessons."""
     lines = [f"Past lessons for {target} (most recent first):"]
     for i, exp in enumerate(experiences, start=1):
@@ -117,5 +151,10 @@ def format_experiences(target: str, experiences: list[Experience]) -> str:
         if exp.references:
             refs = ", ".join(exp.references[:2])
             lines.append(f"     refs: {refs}")
+    if faded_count > 0:
+        lines.append(
+            f"  +{faded_count} older lesson(s) faded from injection "
+            f"(history kept on disk)"
+        )
     lines.append("Apply these lessons proactively. Do not repeat the rejected patterns.")
     return "\n".join(lines)

package/core/synapse/engine.py

@@ -205,6 +205,8 @@ def create_default_engine(
     from core.synapse.graph_context_layer import GraphContextLayer
     from core.synapse.pattern_library_layer import PatternLibraryLayer
     from core.synapse.recipe_layer import RecipeLayer
+    from core.synapse.routing_feedback_layer import RoutingFeedbackLayer
+    from core.synapse.session_memory_layer import SessionMemoryLayer
 
     engine = SynapseEngine()
 
@@ -236,6 +238,12 @@ def create_default_engine(
     engine.register_layer(BranchLayer())
     engine.register_layer(CommandHintsLayer(commands=commands))
     engine.register_layer(QualityGateLayer())
+    # L5.5 (F1-B2) — routing feedback. When the detected department has a
+    # poor recent QG record (routing-scores.json, F1-B1), injects
+    # [arka:redo-risk] with citable counts. Silent below 5 samples or at
+    # healthy approval — warnings only, never noise. Closes the second
+    # learning loop of the memory reform.
+    engine.register_layer(RoutingFeedbackLayer())
     # L7 TimeLayer removed (prompt-surface P0 2026-07-08): the time-of-day tag
     # had no consumer rule and invalidated the prompt cache at every
     # 5h/12h/18h boundary — same rationale as the session-start hook's
@@ -252,5 +260,10 @@ def create_default_engine(
     # work. Inert when no recipes are captured.
     engine.register_layer(RecipeLayer())
     engine.register_layer(SessionContextLayer())
+    # L9.5 (F1-A3) — cross-session semantic turn memory. Reads the cache
+    # the detached turn-capture worker precomputed (labeled ranked@HH:MMZ
+    # / pre-ranked) plus a live keyword LIKE; NEVER embeds on the prompt
+    # path. Registered unconditionally: inert when the store is empty.
+    engine.register_layer(SessionMemoryLayer())
 
     return engine

package/core/synapse/recipe_layer.py

@@ -79,17 +79,40 @@ class RecipeLayer(Layer):
 
 
 def _match_recipes(keywords: list[str], limit: int) -> list[Recipe]:
-    """Rank recipes by keyword overlap with feature_keywords + stack."""
+    """Rank recipes by keyword overlap, faded by age (F1-C2 decay).
+
+    Overlap is multiplied by the decayed weight of the recipe's
+    ``provenance.captured_at`` — a stale recipe fades from injection
+    (never from disk) unless re-captured. Config resolved ONCE per call
+    (hot-path hoisting mandated by core/shared/decay.py).
+    """
+    from core.shared.decay import (
+        INJECTION_FLOOR,
+        decay_enabled,
+        decayed_weight,
+        half_life_days,
+    )
+
     kw = set(keywords)
-    scored: list[tuple[int, Recipe]] = []
+    decay_on = decay_enabled()
+    hl = half_life_days() if decay_on else 0.0
+    scored: list[tuple[float, Recipe]] = []
     for recipe in list_recipes():
         haystack = {
             w.lower()
             for w in (recipe.feature_keywords + recipe.stack)
         }
         overlap = len(kw & haystack)
-        if overlap:
-            scored.append((overlap, recipe))
+        if not overlap:
+            continue
+        weight = 1.0
+        if decay_on:
+            weight = decayed_weight(
+                recipe.provenance.captured_at, half_life=hl, enabled=True
+            )
+            if weight < INJECTION_FLOOR:
+                continue  # fades from injection only — recipe.json untouched
+        scored.append((overlap * weight, recipe))
     scored.sort(key=lambda pair: (-pair[0], pair[1].slug))
     return [recipe for _, recipe in scored[:limit]]
 

package/core/synapse/routing_feedback_layer.py

@@ -0,0 +1,132 @@
+"""Synapse L5.5 — routing feedback injection (F1-B2).
+
+CLOSES the second learning loop: the F1-B1 aggregator turned QG/judge
+verdicts into ``~/.arkaos/routing-scores.json``; this layer reads it at
+prompt time and warns when the detected department has a poor recent
+approval record, citing exact counts (evidence-flow: numbers the
+orchestrator can verify, never vibes):
+
+    [arka:redo-risk] frontend: 3/9 approved (90d, smoothed 0.36).
+    Top blockers: function-length, missing-tests. Dispatch the
+    specialist early; require evidence before the QG.
+
+Silence rules (honesty over noise):
+    - fewer than ``_MIN_SAMPLES`` QG verdicts → SILENT (no warnings
+      from statistical noise)
+    - smoothed approval >= ``_RISK_THRESHOLD`` → silent (no praise
+      spam; the layer only warns)
+    - no department detected in the prompt → silent
+
+Flag: ``synapse.l55RoutingFeedback`` (default ON) + env ``ARKA_BYPASS_L55``.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+
+from core.synapse.layers import Layer, LayerResult, PromptContext
+
+_MIN_SAMPLES = 5
+_RISK_THRESHOLD = 0.5
+_CONFIG_PATH = Path.home() / ".arkaos" / "config.json"
+
+
+def _l55_feature_flag_on() -> bool:
+    if os.environ.get("ARKA_BYPASS_L55", "").strip() == "1":
+        return False
+    try:
+        data = json.loads(_CONFIG_PATH.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return True
+    if not isinstance(data, dict):
+        return True  # malformed-but-valid JSON (list/str) => documented default ON
+    synapse_cfg = data.get("synapse") or {}
+    return bool(synapse_cfg.get("l55RoutingFeedback", True))
+
+
+def _detect_department(ctx: PromptContext) -> str:
+    """Reuse L1's keyword detection — one source of routing truth."""
+    try:
+        from core.synapse.layers import DepartmentLayer
+
+        result = DepartmentLayer().compute(ctx)
+        # L1 tags as [dept:<slug>] — extract the slug.
+        tag = result.tag or ""
+        if tag.startswith("[dept:") and tag.endswith("]"):
+            return tag[len("[dept:"):-1]
+    except Exception:  # detection is best-effort
+        pass
+    return ""
+
+
+class RoutingFeedbackLayer(Layer):
+    """L5.5: cite the department's recent QG record when it warns."""
+
+    @property
+    def id(self) -> str:
+        return "L5.5"
+
+    @property
+    def name(self) -> str:
+        return "RoutingFeedback"
+
+    @property
+    def cache_ttl(self) -> int:
+        return 300  # scores rebuild at most hourly — 5 min cache is safe
+
+    @property
+    def input_sensitive(self) -> bool:
+        return True  # department detection depends on the prompt
+
+    @property
+    def priority(self) -> int:
+        return 55  # after L5 CommandHints (50), before L6 QualityGate (60)
+
+    def compute(self, ctx: PromptContext) -> LayerResult:
+        start = time.time()
+        content = ""
+        try:
+            if ctx.user_input and _l55_feature_flag_on():
+                content = self._warn_if_risky(ctx)
+        except Exception:  # layer must never break the prompt
+            content = ""
+        elapsed = int((time.time() - start) * 1000)
+        if not content:
+            return LayerResult(layer_id=self.id, tag="", content="",
+                               tokens_est=0, compute_ms=elapsed, cached=False)
+        return LayerResult(
+            layer_id=self.id,
+            tag=content,
+            content=content,
+            tokens_est=len(content.split()),
+            compute_ms=elapsed,
+            cached=False,
+        )
+
+    def _warn_if_risky(self, ctx: PromptContext) -> str:
+        department = _detect_department(ctx)
+        if not department:
+            return ""
+        from core.governance.routing_feedback import load_scores
+
+        scores = load_scores()
+        if scores is None:
+            return ""
+        score = next(
+            (s for s in scores.scores if s.department == department), None
+        )
+        if score is None or score.samples < _MIN_SAMPLES:
+            return ""  # silence below the sample floor — noise is not signal
+        if score.smoothed_approval >= _RISK_THRESHOLD:
+            return ""
+        blockers = ", ".join(score.top_blocker_patterns) or "n/a"
+        return (
+            f"[arka:redo-risk] {department}: {score.approvals}/{score.samples}"
+            f" approved ({scores.window_days}d,"
+            f" smoothed {score.smoothed_approval:.2f})."
+            f" Top blockers: {blockers}."
+            f" Dispatch the specialist early; require evidence before the QG."
+        )