instar 1.3.1300 → 1.3.1302

package/dist/core/JevSignalShadow.d.ts

@@ -1,3 +1,4 @@
+import { type GateSignal } from './GateSignalDetectors.js';
 import { type CascadeBand, type EscalationReason } from './JevCascade.js';
 import type { IntelligenceProvider } from './types.js';
 export declare const JEV_SHADOW_FEATURE = "jev-signal-shadow";
@@ -34,8 +35,57 @@ export interface JevSignalShadowConfig {
         maxPerDay?: number;
     };
 }
+/**
+ * The live advisory switch (docs/specs/jev-signal-live.md). When on, the tone
+ * gate awaits Jev (bounded) and uses its CONFIDENT answers for the B1–B7
+ * artefact signals; unsure or missing answers fall back to the detectors.
+ * `enabled` is resolved through the development-agent gate before it reaches
+ * the shadow (live on a dev agent, dark on the fleet unless flipped).
+ */
+export interface JevSignalLiveConfig {
+    enabled?: boolean;
+    /** Fetch abort for the live call (default LIVE_DEFAULT_TIMEOUT_MS, clamped to LIVE_TIMEOUT_MIN_MS–LIVE_TIMEOUT_MAX_MS). */
+    timeoutMs?: number;
+    /** Confident-vs-unsure band (default: the cascade's 0.30–0.70). */
+    band?: CascadeBand;
+    bands?: Record<string, CascadeBand>;
+}
+/** Covers the measured p99 (834 ms) of Jev calls on real candidates. */
+export declare const LIVE_DEFAULT_TIMEOUT_MS = 1000;
+/** Operator `timeoutMs` is clamped to this range, so no config value can make the gate wait long. */
+export declare const LIVE_TIMEOUT_MIN_MS = 100;
+export declare const LIVE_TIMEOUT_MAX_MS = 3000;
+/** Extra wait past the fetch abort before the caller stops waiting regardless. */
+export declare const LIVE_RACE_SLACK_MS = 250;
+/** An in-flight slot older than this is treated as abandoned and reclaimed. */
+export declare const STALE_SLOT_MS = 30000;
+/** Consecutive live failures (missed deadline, timeout, HTTP error, model mismatch) that open the breaker. */
+export declare const LIVE_BREAKER_FAILURES = 3;
+/** How long an open breaker keeps live mode on the detector path. */
+export declare const LIVE_BREAKER_OPEN_MS: number;
+/**
+ * What a rule's line on a live candidate rests on: `jev` = a confident Jev
+ * answer decided it; `disputed` = the detector matched and Jev confidently
+ * disagrees — the detection stands, annotated with Jev's view; `detector-fallback`
+ * = Jev was unsure or had no answer, the detector decided.
+ */
+export type LiveSource = 'jev' | 'disputed' | 'detector-fallback';
+/** What the tone gate receives from a live call. Never rejects. */
+export interface LiveSignalsResult {
+    signals: GateSignal[];
+    /** True when at least one signal line came from a confident Jev answer —
+     *  i.e. the list the judge sees differs from the detector list. An agreed
+     *  "nothing here" does not count, so the prompt stays today's. */
+    jevUsed: boolean;
+}
 /** The closed set of reasons a candidate was not compared. */
-export type NotComparedReason = 'timeout' | 'http-error' | 'oversize' | 'skipped-concurrent' | 'skipped-sample' | 'model-mismatch' | 'disabled-no-key' | 'soak-expired';
+export type NotComparedReason = 'timeout' | 'http-error' | 'oversize' | 'skipped-concurrent' | 'skipped-sample' | 'model-mismatch' | 'disabled-no-key' | 'soak-expired'
+/** Live only: the text scrub failed, so nothing was sent. */
+ | 'scrub-error'
+/** Live only: the vendor answered but gave no usable probability at all. */
+ | 'no-answers'
+/** Live only: the vendor breaker opened (one row per opening). */
+ | 'breaker-open';
 export type ShadowRow = {
     kind: 'compared';
     ts: string;
@@ -46,6 +96,13 @@ export type ShadowRow = {
     ms: number;
     modelServed: string;
     disagree: string[];
+    /** Present on live candidates (the answers fed the tone gate). */
+    live?: true;
+    /** Live only: which source decided each rule's signal. */
+    liveSources?: Record<string, LiveSource>;
+    /** Live only: the answer arrived after the caller stopped waiting, so
+     *  every rule for this message used the detector. */
+    liveLate?: true;
     /** Scrubbed, span-anchored excerpt — present ONLY on disagreeing rows,
      *  and only when retention is enabled. */
     excerpt?: string;
@@ -59,6 +116,8 @@ export type ShadowRow = {
     sha256: string;
     bytes: number;
     reason: NotComparedReason;
+    /** Live candidate: every rule for this message fell back to the detector. */
+    live?: true;
 } | {
     kind: 'referee';
     ts: string;
@@ -98,6 +157,8 @@ export declare const KEY_REREAD_MS: number;
 export interface JevSignalShadowDeps {
     /** Live config read — called per candidate so the kill-switch needs no restart. */
     getConfig: () => JevSignalShadowConfig | undefined;
+    /** Live advisory config, `enabled` already dev-gate-resolved. Absent ⇒ never live. */
+    getLiveConfig?: () => JevSignalLiveConfig | undefined;
     /**
      * Resolves the vault key. May block (a keychain lookup), so it is called once
      * at construction — boot, never the message path — and afterwards at most once
@@ -120,6 +181,13 @@ export interface JevSignalShadowDeps {
 }
 export declare class JevSignalShadow {
     private inFlight;
+    /** When the current in-flight call started (stale-slot reclaim). */
+    private inFlightSince;
+    /** Slot generation: only the call that holds the CURRENT slot may release it. */
+    private slotGen;
+    /** Vendor-down breaker for live mode: consecutive failures, and when it closes again. */
+    private liveFailures;
+    private liveBreakerUntil;
     private cachedKey;
     /** When the key was last read; re-reads are rate-limited from here. */
     private keyReadAt;
@@ -127,6 +195,34 @@ export declare class JevSignalShadow {
     private readonly deps;
     constructor(deps: JevSignalShadowDeps);
     private refreshKey;
+    /**
+     * The single-flight slot. A slot held past STALE_SLOT_MS belongs to a call
+     * that never settled (a fetch that ignored its abort); it is reclaimed so one
+     * stuck request cannot turn every later candidate into a fallback forever.
+     * Outstanding requests stay bounded: at most one per STALE_SLOT_MS.
+     */
+    private slotBusy;
+    /**
+     * Take the slot and return its release. The release is generation-checked: a
+     * reclaimed (stale) call that settles later cannot free the slot a newer call
+     * now holds, so single-flight survives a reclaim.
+     */
+    private takeSlot;
+    /**
+     * Live entry point (docs/specs/jev-signal-live.md). Returns null — without
+     * doing anything — when live mode is off, so the caller falls back to
+     * `observe()` and today's detector-only path. Otherwise returns a promise that
+     * never rejects and settles within timeoutMs + LIVE_RACE_SLACK_MS with the
+     * merged signals; any failure resolves to the plain detector signals.
+     * The live call IS the shadow's measurement call: it writes the same rows
+     * (tagged `live: true`) and feeds the same referee cascade.
+     */
+    liveSignals(text: string): Promise<LiveSignalsResult> | null;
+    private liveInner;
+    /** Breaker bookkeeping per live candidate, as the caller saw it: an answer in
+     *  time resets the count; a missed deadline, HTTP error, timeout or model
+     *  mismatch counts as one failure. */
+    private noteLiveOutcome;
     /**
      * Fire-and-forget entry point. Synchronous, never throws, never awaited by
      * the caller. The only synchronous work is a config read, a hash, and (when
@@ -166,6 +262,27 @@ export declare class JevSignalShadow {
     private maybeRefer;
     private write;
 }
+/**
+ * Merge Jev's answers into the detector signals (docs/specs/jev-signal-live.md).
+ * Per kind:
+ *   - Jev confident YES (p > band.hi): detected. The detector's signal is kept
+ *     (its spans + sample still anchor the judge); if the detector missed it, a
+ *     sample-less model signal is added.
+ *   - Jev confident NO (p < band.lo) against a detector match: the detection
+ *     STANDS (detected:true, so every B1–B7 rule can still fire on it) and is
+ *     annotated with Jev's disagreement for the judge to weigh. Jev never hides
+ *     or overrides an observation; it can only add to or comment on the list.
+ *   - Unsure or no answer: the detector's output, unchanged.
+ * Pure. Output order follows GATE_SIGNAL_KINDS.
+ */
+export declare function mergeLiveSignals(detected: GateSignal[], jev: Record<string, number>, opts?: {
+    band?: CascadeBand;
+    bands?: Record<string, CascadeBand>;
+}): {
+    signals: GateSignal[];
+    sources: Record<string, LiveSource>;
+    jevUsed: boolean;
+};
 /**
  * The production wiring, shared by server.ts and the E2E test so the test
  * exercises the same config resolution, key lookup and log location the server
@@ -179,5 +296,15 @@ export declare function buildJevSignalShadow(opts: {
     metrics?: JevSignalShadowDeps['metrics'];
     fetchImpl?: typeof fetch;
     referee?: IntelligenceProvider | null;
+    /** Boot-time `intelligence.jevSignalLive`, the fallback when the live read has none. */
+    bootLiveBlock?: JevSignalLiveConfig;
+    /** The agent's `developmentAgent` flag — decides live mode when `enabled` is omitted. */
+    developmentAgent?: boolean;
+    /**
+     * Is decision-quality recording live? The outbound route hardens a migration
+     * advisory into a non-overridable hold when it is not, so live mode is off
+     * then. Default: the real recorder's answer.
+     */
+    recordingLive?: () => boolean;
 }): JevSignalShadow;
 //# sourceMappingURL=JevSignalShadow.d.ts.map

package/dist/core/JevSignalShadow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JevSignalShadow.d.ts","sourceRoot":"","sources":["../../src/core/JevSignalShadow.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAiC,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAGrC,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;sEAEkE;IAClE,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,WAAW,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,YAAY,GACZ,UAAU,GACV,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,CAAC;AAEnB,MAAM,MAAM,SAAS,GACjB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;8CAC0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,WAAW,GAAG,aAAa,CAAC;CACvE,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC9F;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,aAAa,CAAC;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEN;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQtG,CAAC;AACF,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,mGAAmG;AACnG,eAAO,MAAM,aAAa,QAAc,CAAC;AAEzC,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,SAAS,EAAE,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACnD;;;;OAIG;IACH,OAAO,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC7B,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,kFAAkF;IAClF,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,4BAA4B;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAuB;IACxC,uEAAuE;IACvE,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,SAAS,CAAgC;IACjD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;gBAE/B,IAAI,EAAE,mBAAmB;IAKrC,OAAO,CAAC,UAAU;IAUlB;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ3B,mEAAmE;IACnE,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAqB;IAEhD,OAAO,CAAC,YAAY;YAsCN,QAAQ;IAmEtB;;;0EAGsE;IACtE,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAK;IAEzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA0DpB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAK;IACzB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAqB;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IA6ClB,OAAO,CAAC,KAAK;CAQd;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACvC,GAAG,eAAe,CAgBlB"}
+{"version":3,"file":"JevSignalShadow.d.ts","sourceRoot":"","sources":["../../src/core/JevSignalShadow.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAwC,KAAK,UAAU,EAAuB,MAAM,0BAA0B,CAAC;AAEtH,OAAO,EAA0C,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGlH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAGrC,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;sEAEkE;IAClE,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,WAAW,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2HAA2H;IAC3H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACrC;AACD,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,+EAA+E;AAC/E,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,8GAA8G;AAC9G,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAElE,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB;;sEAEkE;IAClE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,YAAY,GACZ,UAAU,GACV,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc;AAChB,6DAA6D;GAC3D,aAAa;AACf,4EAA4E;GAC1E,YAAY;AACd,kEAAkE;GAChE,cAAc,CAAC;AAEnB,MAAM,MAAM,SAAS,GACjB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC;yDACqD;IACrD,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB;8CAC0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,WAAW,GAAG,aAAa,CAAC;CACvE,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3F,6EAA6E;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC;CACb,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,aAAa,CAAC;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEN;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQtG,CAAC;AACF,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,mGAAmG;AACnG,eAAO,MAAM,aAAa,QAAc,CAAC;AAEzC,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,SAAS,EAAE,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACnD,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACtD;;;;OAIG;IACH,OAAO,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC7B,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,kFAAkF;IAClF,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,4BAA4B;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAS;IACzB,oEAAoE;IACpE,OAAO,CAAC,aAAa,CAAK;IAC1B,iFAAiF;IACjF,OAAO,CAAC,OAAO,CAAK;IACpB,yFAAyF;IACzF,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,SAAS,CAAuB;IACxC,uEAAuE;IACvE,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,SAAS,CAAgC;IACjD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;gBAE/B,IAAI,EAAE,mBAAmB;IAKrC,OAAO,CAAC,UAAU;IAUlB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAOhB;;;;;;;;OAQG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI;IAiB5D,OAAO,CAAC,SAAS;IA0DjB;;0CAEsC;IACtC,OAAO,CAAC,eAAe;IASvB;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ3B,mEAAmE;IACnE,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAqB;IAEhD,OAAO,CAAC,YAAY;YAuCN,QAAQ;IA8FtB;;;0EAGsE;IACtE,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAK;IAEzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA0DpB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAK;IACzB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAqB;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IA6ClB,OAAO,CAAC,KAAK;CAQd;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,UAAU,EAAE,EACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CAAO,GACrE;IAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAgClF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,wFAAwF;IACxF,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B,GAAG,eAAe,CAwBlB"}

package/dist/core/JevSignalShadow.js

@@ -27,15 +27,30 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { detectGateSignals } from './GateSignalDetectors.js';
+import { detectGateSignals, GATE_SIGNAL_KINDS } from './GateSignalDetectors.js';
 import { scrubForStore } from './durableSecretScrub.js';
-import { selectEscalations, askReferee } from './JevCascade.js';
+import { selectEscalations, askReferee, bandFor } from './JevCascade.js';
+import { resolveDevAgentGate } from './devAgentGate.js';
+import { decisionQualityRecordingLive } from './DecisionQualityRecorderImpl.js';
 export const JEV_SHADOW_FEATURE = 'jev-signal-shadow';
 /** Attribution label for the referee's LLM calls (feature metrics + routing). */
 export const JEV_REFEREE_COMPONENT = 'JevLunaReferee';
 /** Default volume bound on referee calls per UTC day. */
 export const REFEREE_DAILY_CAP = 300;
 const ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
+/** Covers the measured p99 (834 ms) of Jev calls on real candidates. */
+export const LIVE_DEFAULT_TIMEOUT_MS = 1000;
+/** Operator `timeoutMs` is clamped to this range, so no config value can make the gate wait long. */
+export const LIVE_TIMEOUT_MIN_MS = 100;
+export const LIVE_TIMEOUT_MAX_MS = 3000;
+/** Extra wait past the fetch abort before the caller stops waiting regardless. */
+export const LIVE_RACE_SLACK_MS = 250;
+/** An in-flight slot older than this is treated as abandoned and reclaimed. */
+export const STALE_SLOT_MS = 30_000;
+/** Consecutive live failures (missed deadline, timeout, HTTP error, model mismatch) that open the breaker. */
+export const LIVE_BREAKER_FAILURES = 3;
+/** How long an open breaker keeps live mode on the detector path. */
+export const LIVE_BREAKER_OPEN_MS = 5 * 60_000;
 /**
  * The frozen comparison contract: one Noul question per rule, the detector
  * signal kind it is compared against, and the positive threshold. Changing a
@@ -62,6 +77,13 @@ export const EXCERPT_DAILY_CAP = 50;
 export const KEY_REREAD_MS = 10 * 60_000;
 export class JevSignalShadow {
     inFlight = false;
+    /** When the current in-flight call started (stale-slot reclaim). */
+    inFlightSince = 0;
+    /** Slot generation: only the call that holds the CURRENT slot may release it. */
+    slotGen = 0;
+    /** Vendor-down breaker for live mode: consecutive failures, and when it closes again. */
+    liveFailures = 0;
+    liveBreakerUntil = 0;
     cachedKey = null;
     /** When the key was last read; re-reads are rate-limited from here. */
     keyReadAt = 0;
@@ -81,6 +103,133 @@ export class JevSignalShadow {
             this.cachedKey = null;
         }
     }
+    /**
+     * The single-flight slot. A slot held past STALE_SLOT_MS belongs to a call
+     * that never settled (a fetch that ignored its abort); it is reclaimed so one
+     * stuck request cannot turn every later candidate into a fallback forever.
+     * Outstanding requests stay bounded: at most one per STALE_SLOT_MS.
+     */
+    slotBusy(nowMs) {
+        return this.inFlight && nowMs - this.inFlightSince < STALE_SLOT_MS;
+    }
+    /**
+     * Take the slot and return its release. The release is generation-checked: a
+     * reclaimed (stale) call that settles later cannot free the slot a newer call
+     * now holds, so single-flight survives a reclaim.
+     */
+    takeSlot(nowMs) {
+        const gen = ++this.slotGen;
+        this.inFlight = true;
+        this.inFlightSince = nowMs;
+        return () => { if (this.slotGen === gen)
+            this.inFlight = false; };
+    }
+    /**
+     * Live entry point (docs/specs/jev-signal-live.md). Returns null — without
+     * doing anything — when live mode is off, so the caller falls back to
+     * `observe()` and today's detector-only path. Otherwise returns a promise that
+     * never rejects and settles within timeoutMs + LIVE_RACE_SLACK_MS with the
+     * merged signals; any failure resolves to the plain detector signals.
+     * The live call IS the shadow's measurement call: it writes the same rows
+     * (tagged `live: true`) and feeds the same referee cascade.
+     */
+    liveSignals(text) {
+        let live;
+        try {
+            live = this.deps.getLiveConfig?.();
+        }
+        catch {
+            // @silent-fallback-ok — an unreadable live config means live is off; the gate keeps today's detector-only path.
+            return null;
+        }
+        if (!live || live.enabled !== true)
+            return null;
+        try {
+            return this.liveInner(text, live);
+        }
+        catch {
+            // @silent-fallback-ok — any live-path fault resolves to the detector signals (today's behaviour).
+            return Promise.resolve(detectorOnly(text));
+        }
+    }
+    liveInner(text, live) {
+        const cfg = this.deps.getConfig() ?? {};
+        const nowMs = (this.deps.now ?? Date.now)();
+        const ts = new Date(nowMs).toISOString();
+        const bytes = Buffer.byteLength(text, 'utf8');
+        const maxBytes = this.deps.maxScanBytes ?? 1_000_000;
+        const sha256 = crypto.createHash('sha256').update(bytes > maxBytes ? text.slice(0, maxBytes) : text, 'utf8').digest('hex');
+        const fallback = (reason) => {
+            this.write({ kind: 'not-compared', ts, sha256, bytes, reason, live: true });
+            return Promise.resolve(detectorOnly(text));
+        };
+        if (!this.cachedKey && nowMs - this.keyReadAt >= KEY_REREAD_MS)
+            this.refreshKey();
+        if (!this.cachedKey) {
+            // A standing condition: one row per process, not one per message.
+            if (this.bootNoted.has('disabled-no-key'))
+                return Promise.resolve(detectorOnly(text));
+            this.bootNoted.add('disabled-no-key');
+            return fallback('disabled-no-key');
+        }
+        // During a vendor outage every message would otherwise wait the full
+        // timeout; an open breaker keeps them on the detector path (one row when it
+        // opens, not one per message).
+        if (nowMs < this.liveBreakerUntil)
+            return Promise.resolve(detectorOnly(text));
+        if (bytes > maxBytes)
+            return fallback('oversize');
+        if (this.slotBusy(nowMs))
+            return fallback('skipped-concurrent');
+        // Live mode is not soak-bounded, so the text is secret-scrubbed before it
+        // leaves the machine (the detectors and the row hash still see the original).
+        const scrubbed = scrubForStore(text);
+        if (scrubbed.error || scrubbed.truncated)
+            return fallback('scrub-error');
+        const signals = detectGateSignals(text);
+        const timeoutMs = typeof live.timeoutMs === 'number' && Number.isFinite(live.timeoutMs)
+            ? Math.max(LIVE_TIMEOUT_MIN_MS, Math.min(LIVE_TIMEOUT_MAX_MS, live.timeoutMs))
+            : LIVE_DEFAULT_TIMEOUT_MS;
+        const race = { late: false };
+        const release = this.takeSlot(nowMs);
+        const call = this.dispatch(text, cfg, { ts, sha256, bytes, detectorSignals: signals.map((x) => x.kind), signals }, { live, timeoutMs, race, sendText: scrubbed.text });
+        this.lastDispatch = call.then(() => undefined, () => undefined).finally(release);
+        let timer;
+        const deadline = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                race.late = true;
+                // The caller stops waiting now: record that outcome now, so a call that
+                // never settles still leaves a row (a late answer adds a liveLate row).
+                this.write({ kind: 'not-compared', ts, sha256, bytes, reason: 'timeout', live: true });
+                resolve(null);
+            }, timeoutMs + LIVE_RACE_SLACK_MS);
+            timer.unref?.();
+        });
+        // The breaker counts what the CALLER saw, once: a missed deadline is a
+        // failure even if the answer lands later, and a late success resets nothing.
+        return Promise.race([call.catch(() => null), deadline])
+            .then((merged) => {
+            this.noteLiveOutcome(merged !== null, ts, sha256, bytes);
+            return merged ?? { signals, jevUsed: false };
+        })
+            .finally(() => { if (timer)
+            clearTimeout(timer); });
+    }
+    /** Breaker bookkeeping per live candidate, as the caller saw it: an answer in
+     *  time resets the count; a missed deadline, HTTP error, timeout or model
+     *  mismatch counts as one failure. */
+    noteLiveOutcome(ok, ts, sha256, bytes) {
+        if (ok) {
+            this.liveFailures = 0;
+            return;
+        }
+        this.liveFailures++;
+        if (this.liveFailures < LIVE_BREAKER_FAILURES)
+            return;
+        this.liveFailures = 0;
+        this.liveBreakerUntil = (this.deps.now ?? Date.now)() + LIVE_BREAKER_OPEN_MS;
+        this.write({ kind: 'not-compared', ts, sha256, bytes, reason: 'breaker-open', live: true });
+    }
     /**
      * Fire-and-forget entry point. Synchronous, never throws, never awaited by
      * the caller. The only synchronous work is a config read, a hash, and (when
@@ -134,7 +283,7 @@ export class JevSignalShadow {
             notCompared('oversize');
             return;
         }
-        if (this.inFlight) {
+        if (this.slotBusy(nowMs)) {
             notCompared('skipped-concurrent');
             return;
         }
@@ -143,19 +292,31 @@ export class JevSignalShadow {
         // beyond what the detector actually pointed at.
         const signals = detectGateSignals(text);
         const detectorSignals = signals.map((s) => s.kind);
-        this.inFlight = true;
+        const release = this.takeSlot(nowMs);
         this.lastDispatch = this.dispatch(text, cfg, { ts, sha256, bytes, detectorSignals, signals })
+            .then(() => undefined)
             .catch(() => { })
-            .finally(() => { this.inFlight = false; });
+            .finally(release);
     }
-    async dispatch(text, cfg, base) {
+    async dispatch(text, cfg, base, 
+    /** Live mode: `sendText` is the scrubbed text that leaves the machine; `text`
+     *  stays the original for excerpt anchoring (spans index the original). */
+    live) {
         const model = cfg.model || 'jev-1.13.0';
-        const timeoutMs = typeof cfg.timeoutMs === 'number' && cfg.timeoutMs > 0 ? cfg.timeoutMs : 1500;
+        const timeoutMs = live ? live.timeoutMs : typeof cfg.timeoutMs === 'number' && cfg.timeoutMs > 0 ? cfg.timeoutMs : 1500;
+        const liveTag = live ? { live: true } : {};
         const questions = Object.fromEntries(SHADOW_QUESTIONS.map((q) => [q.rule, { type: 'noul', instructions: q.instructions }]));
         const ctrl = new AbortController();
         const timer = setTimeout(() => ctrl.abort(), timeoutMs);
         const t0 = (this.deps.now ?? Date.now)();
-        const nc = (reason) => this.write({ kind: 'not-compared', ts: base.ts, sha256: base.sha256, bytes: base.bytes, reason });
+        const nc = (reason) => {
+            // A live candidate whose caller deadline already passed has its timeout
+            // row; a failure landing after that is the same candidate, not a new row.
+            if (live?.race.late)
+                return null;
+            this.write({ kind: 'not-compared', ts: base.ts, sha256: base.sha256, bytes: base.bytes, reason, ...liveTag });
+            return null;
+        };
         let tokensIn;
         let outcome = 'error';
         let modelServed;
@@ -163,7 +324,7 @@ export class JevSignalShadow {
             const res = await (this.deps.fetchImpl ?? fetch)(ENDPOINT, {
                 method: 'POST',
                 headers: { Authorization: `Bearer ${this.cachedKey}`, 'Content-Type': 'application/json' },
-                body: JSON.stringify({ state: text, model, questions }),
+                body: JSON.stringify({ state: live ? live.sendText : text, model, questions }),
                 signal: ctrl.signal,
             });
             if (!res.ok) {
@@ -171,21 +332,18 @@ export class JevSignalShadow {
                     this.cachedKey = null;
                     this.keyReadAt = (this.deps.now ?? Date.now)();
                 } // re-read after KEY_REREAD_MS, never per message
-                nc('http-error');
-                return;
+                return nc('http-error');
             }
             const json = (await res.json());
             modelServed = typeof json.model === 'string' ? json.model : undefined;
             tokensIn = json.usage?.input_tokens;
-            if (modelServed !== model) {
-                nc('model-mismatch');
-                return;
-            }
+            if (modelServed !== model)
+                return nc('model-mismatch');
             const jev = {};
             const disagree = [];
             for (const q of SHADOW_QUESTIONS) {
                 const p = json.answers?.[q.rule]?.noul;
-                if (typeof p !== 'number')
+                if (typeof p !== 'number' || !Number.isFinite(p))
                     continue;
                 jev[q.rule] = p;
                 const jevSays = p > POSITIVE_THRESHOLD;
@@ -193,16 +351,36 @@ export class JevSignalShadow {
                 if (jevSays !== detectorSays)
                     disagree.push(q.rule);
             }
+            // A response with no usable probability is a failure, not an answer: it
+            // must count toward the breaker instead of resetting it.
+            if (live && Object.keys(jev).length === 0)
+                return nc('no-answers');
             outcome = disagree.length ? 'fired' : 'noop';
             const { signals, ...rowBase } = base;
-            const retained = disagree.length > 0 && cfg.retainDisagreementExcerpts === true
+            // Measurement EXTRAS (retained excerpts, the referee) belong to the shadow:
+            // on a live call they run only while the shadow itself is measuring (on,
+            // inside its soak), so live mode — which is not soak-bound — never carries
+            // them past the window. One check, so every extra is bound the same way.
+            const measuring = !live || shadowMeasuring(cfg, (this.deps.now ?? Date.now)());
+            const retained = measuring && disagree.length > 0 && cfg.retainDisagreementExcerpts === true
                 ? this.buildExcerpt(text, signals, disagree, cfg, base.ts)
                 : {};
-            this.write({ kind: 'compared', ...rowBase, jev, ms: (this.deps.now ?? Date.now)() - t0, modelServed, disagree, ...retained });
-            this.maybeRefer(text, cfg, base.ts, base.sha256, jev, base.detectorSignals);
+            // Live: merge, and record which source decided each rule. A late answer
+            // (the caller already stopped waiting) is recorded as such, so a row never
+            // claims Jev supplied a signal the gate did not actually use.
+            const merged = live ? mergeLiveSignals(signals, jev, live.live) : null;
+            const liveFields = !live ? {}
+                : live.race.late ? { live: true, liveLate: true }
+                    : { live: true, liveSources: merged.sources };
+            this.write({ kind: 'compared', ...rowBase, jev, ms: (this.deps.now ?? Date.now)() - t0, modelServed, disagree, ...liveFields, ...retained });
+            if (measuring)
+                this.maybeRefer(text, cfg, base.ts, base.sha256, jev, base.detectorSignals);
+            return merged ? { signals: merged.signals, jevUsed: merged.jevUsed } : null;
         }
         catch (err) {
-            nc(err?.name === 'AbortError' ? 'timeout' : 'http-error');
+            // Everything after the fetch is guarded (merge is pure, excerpt and referee
+            // hand-off catch their own errors), so a throw here is the transport.
+            return nc(err?.name === 'AbortError' ? 'timeout' : 'http-error');
         }
         finally {
             clearTimeout(timer);
@@ -365,17 +543,92 @@ export class JevSignalShadow {
         }
     }
 }
+/** True while the shadow itself is measuring: enabled and inside its soak window. */
+function shadowMeasuring(cfg, nowMs) {
+    const endsAt = cfg.soakEndsAt ? Date.parse(cfg.soakEndsAt) : NaN;
+    return cfg.enabled === true && Number.isFinite(endsAt) && nowMs < endsAt;
+}
+/** The plain detector path, for every live fallback. Never throws. */
+function detectorOnly(text) {
+    try {
+        return { signals: detectGateSignals(text), jevUsed: false };
+    }
+    catch {
+        // @silent-fallback-ok — detectGateSignals already contains its own throws; this only guards the impossible.
+        return { signals: [], jevUsed: false };
+    }
+}
+/**
+ * Merge Jev's answers into the detector signals (docs/specs/jev-signal-live.md).
+ * Per kind:
+ *   - Jev confident YES (p > band.hi): detected. The detector's signal is kept
+ *     (its spans + sample still anchor the judge); if the detector missed it, a
+ *     sample-less model signal is added.
+ *   - Jev confident NO (p < band.lo) against a detector match: the detection
+ *     STANDS (detected:true, so every B1–B7 rule can still fire on it) and is
+ *     annotated with Jev's disagreement for the judge to weigh. Jev never hides
+ *     or overrides an observation; it can only add to or comment on the list.
+ *   - Unsure or no answer: the detector's output, unchanged.
+ * Pure. Output order follows GATE_SIGNAL_KINDS.
+ */
+export function mergeLiveSignals(detected, jev, opts = {}) {
+    const byKind = new Map();
+    for (const sig of detected)
+        if (sig.detected)
+            byKind.set(sig.kind, sig);
+    const signals = [];
+    const sources = {};
+    for (const kind of GATE_SIGNAL_KINDS) {
+        const rule = SHADOW_QUESTIONS.find((q) => q.signalKind === kind)?.rule;
+        const det = byKind.get(kind);
+        const p = rule ? jev[rule] : undefined;
+        const band = rule ? bandFor(rule, opts) : undefined;
+        const confident = typeof p === 'number' && Number.isFinite(p) && !!band && (p < band.lo || p > band.hi);
+        if (!rule || !confident) {
+            if (rule)
+                sources[rule] = 'detector-fallback';
+            if (det)
+                signals.push(det.source ? det : { ...det, source: 'detector' });
+            continue;
+        }
+        const prob = Math.max(0, Math.min(1, p));
+        if (prob > band.hi) {
+            sources[rule] = 'jev';
+            signals.push(det ? { ...det, source: 'jev', modelProbability: prob } : { kind, detected: true, source: 'jev', modelProbability: prob });
+        }
+        else if (det) {
+            sources[rule] = 'disputed';
+            signals.push({ ...det, source: 'detector', modelProbability: prob });
+        }
+        else {
+            sources[rule] = 'jev';
+        }
+    }
+    // Nothing Jev-sourced reached the list (all unsure, or only agreed "nothing
+    // here") ⇒ hand back the detector list untouched, so the prompt and its
+    // promptId stay exactly today's.
+    const jevUsed = signals.some((sig) => sig.modelProbability !== undefined);
+    return jevUsed ? { signals, sources, jevUsed } : { signals: detected, sources, jevUsed };
+}
 /**
  * The production wiring, shared by server.ts and the E2E test so the test
  * exercises the same config resolution, key lookup and log location the server
  * uses. The live `intelligence` block wins; the boot config is the fallback.
  */
 export function buildJevSignalShadow(opts) {
+    const liveBlock = (key) => {
+        const intel = opts.readLiveIntelligence();
+        const block = intel && typeof intel === 'object' ? intel[key] : undefined;
+        return block && typeof block === 'object' ? block : undefined;
+    };
     return new JevSignalShadow({
-        getConfig: () => {
-            const intel = opts.readLiveIntelligence();
-            const block = intel && typeof intel === 'object' ? intel.jevSignalShadow : undefined;
-            return (block && typeof block === 'object' ? block : opts.bootBlock);
+        getConfig: () => (liveBlock('jevSignalShadow') ?? opts.bootBlock),
+        getLiveConfig: () => {
+            const block = (liveBlock('jevSignalLive') ?? opts.bootLiveBlock ?? {});
+            // Dev-gated: an omitted `enabled` is live on a development agent, dark on the fleet.
+            // And never while decision-quality recording is off (the route would harden the advisory).
+            const gated = resolveDevAgentGate(typeof block.enabled === 'boolean' ? block.enabled : undefined, { developmentAgent: opts.developmentAgent });
+            return { ...block, enabled: gated && (opts.recordingLive ?? decisionQualityRecordingLive)() };
         },
         readKey: () => {
             const v = opts.readSecret('typesafe_api_key');