memhtml 0.3.0 → 0.5.0

package/dist/{dist-B3yDga97.mjs → dist-D5DlgqH2.mjs}

@@ -1,4 +1,4 @@
-import { $ as INBOX_DIR, B as ModelUnavailable, Ct as filenameFor, H as StorageFailure, J as relClassFor, L as DirtyTree, Q as ARCS_DIR, R as InvalidMemory, St as SLUG_FALLBACK, Tt as withCollisionOrdinal, U as WriteConflict, V as PathNotFound, W as EdgeRel, X as relTokenFor, Y as relForToken, Z as ARCHIVE_BUCKET, _t as TASK_STATUSES, at as isValidMemoryPath, bt as isTaskStatus, ct as paraBucketOf, dt as Importance, et as MEMORY_EXTENSION, ft as MEMORY_TYPES, gt as PERSON_ENTITY_PREFIX, ht as PARA_BUCKETS, it as isArchivePath, lt as placementFor, mt as MemoryType, ot as memoryPathFor, pt as MemoryStatus, q as isEdgeRel, rt as archivePathFor, st as normalizePath, tt as PEOPLE_DIR, ut as Confidence, vt as TaskStatus, wt as slugify, xt as parseEntity, yt as WRITABLE_MEMORY_TYPES, z as LlmContractViolation } from "./dist-CSo_XRfz.mjs";
+import { At as filenameFor, Ct as PERSON_ENTITY_PREFIX, Dt as isTaskStatus, Et as WRITABLE_MEMORY_TYPES, G as InvalidMemory, J as PathNotFound, K as LlmContractViolation, Mt as withCollisionOrdinal, Ot as parseEntity, St as PARA_BUCKETS, Tt as TaskStatus, W as DirtyTree, X as WriteConflict, Y as StorageFailure, Z as EdgeRel, _t as Confidence, at as ARCS_DIR, bt as MemoryStatus, ct as PEOPLE_DIR, dt as isArchivePath, et as isEdgeRel, ft as isValidMemoryPath, gt as placementFor, ht as paraBucketOf, it as ARCHIVE_BUCKET, jt as slugify, kt as SLUG_FALLBACK, mt as normalizePath, nt as relForToken, ot as INBOX_DIR, pt as memoryPathFor, q as ModelUnavailable, rt as relTokenFor, st as MEMORY_EXTENSION, tt as relClassFor, ut as archivePathFor, vt as Importance, wt as TASK_STATUSES, xt as MemoryType, yt as MEMORY_TYPES } from "./dist-BCsav-EP.mjs";
 import { createRequire } from "node:module";
 import { Config, Context, Effect, Layer, Result, Schedule, Schema } from "effect";
 import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -1673,7 +1673,7 @@ const articleFor = (spec) => {
 * ordinals a multiple of 180 apart state facts about different environments. It carries no digit, so
 * the numeric divergence family still compares exactly the quantity the claim asserts.
 */
-const claimFor = (topic, type, ordinal) => {
+const claimFor$1 = (topic, type, ordinal) => {
 	const noun = topic.nouns[nounIndexOf(ordinal, topic.nouns.length)] ?? "surface";
 	const verb = topic.verbs[ordinal % topic.verbs.length] ?? "settles";
 	const scope = scopeFor(ordinal);
@@ -1859,8 +1859,8 @@ const buildBase = (count, seed) => {
 		const topic = TOPICS[ordinal % TOPICS.length];
 		const type = TYPES[ordinal % TYPES.length];
 		const day = 30 + ordinal % 240;
-		const claim = claimFor(topic, type, ordinal);
-		const title = titleFor$1(topic, type, ordinal);
+		const claim = claimFor$1(topic, type, ordinal);
+		const title = titleFor$2(topic, type, ordinal);
 		const kit = KITS[ordinal % KITS.length];
 		const jitter = next();
 		specs.push({
@@ -1890,7 +1890,7 @@ const buildBase = (count, seed) => {
 * one subject. `title` is the first field of `fts_text`, and a title naming a different noun than the
 * claim would put a term into the lexical arm that the memory does not assert.
 */
-const titleFor$1 = (topic, type, ordinal) => {
+const titleFor$2 = (topic, type, ordinal) => {
 	const noun = topic.nouns[nounIndexOf(ordinal, topic.nouns.length)] ?? "surface";
 	return `${topic.service} ${noun} ${scopeFor(ordinal)} ${type.replace("_", " ")} ${ordinal}`;
 };
@@ -3624,6 +3624,26 @@ const setMeta = (html, name, value) => {
 	return offset === void 0 ? html : insertAt(html, offset, `${metaLine$1(name, value)}\n`);
 };
 /**
+* Append another `<meta>` of a repeatable name, a new `memhtml-entity` or `memhtml-tag`, after the
+* last one already present. Adding a value that is already there is a no-op, so the operation
+* is idempotent and a re-run of a sleep phase cannot grow the head.
+*/
+const addMeta = (html, name, value) => {
+	if (!isMemoryMetaName(name)) return html;
+	const document = parseDocument(html);
+	const head = headOf$1(document);
+	if (head === void 0) return html;
+	const present = memhtmlMetas(head).filter((meta) => meta.name === name);
+	if (present.some((meta) => attr(meta.element, "content") === value)) return html;
+	const last = present.at(-1);
+	if (last !== void 0) {
+		const span = spanOf(last.element);
+		if (span !== void 0) return insertAt(html, lineEndAt(html, span.end), `${metaLine$1(name, value)}\n`);
+	}
+	const offset = insertionOffsetForMeta(html, head, name);
+	return offset === void 0 ? html : insertAt(html, offset, `${metaLine$1(name, value)}\n`);
+};
+/**
 * Append a `<link rel="memhtml-…">` edge. Idempotent on the `(rel, href)` pair, because the sleep
 * conflict phase promotes the same corroborated edge on every run and a duplicated `<link>`
 * would become a duplicated `edges` row.
@@ -5998,7 +6018,7 @@ const MEMORY_BODY_BUDGET = 16e3;
 */
 const MAX_PER_ENTITY = 2;
 /** `arc` memories take {@link ARC_BODY_BUDGET}; everything else takes {@link MEMORY_BODY_BUDGET}. */
-const budgetFor = (memoryType) => memoryType === "arc" ? ARC_BODY_BUDGET : MEMORY_BODY_BUDGET;
+const budgetFor$1 = (memoryType) => memoryType === "arc" ? ARC_BODY_BUDGET : MEMORY_BODY_BUDGET;
 /**
 * Fold ranked candidates into quotes and index lines under one character budget.
 *
@@ -7746,7 +7766,7 @@ const makeRetrieval = (deps) => {
 		* every concrete memory behind it. The pack would then explain the pattern and cite none of the
 		* evidence.
 		*/
-		const arcs = foldDisclosure(candidates.filter((candidate) => candidate.memoryType === "arc"), budgetFor("arc"));
+		const arcs = foldDisclosure(candidates.filter((candidate) => candidate.memoryType === "arc"), budgetFor$1("arc"));
 		const memories = foldDisclosure(candidates.filter((candidate) => candidate.memoryType !== "arc"), budget);
 		return {
 			arcs,
@@ -8247,12 +8267,23 @@ const EmbeddingsLive = Layer.effect(Embeddings, Effect.gen(function* () {
 //#endregion
 //#region packages/llm/dist/models.js
 /**
-* The three Claude 5 models the sleep phases run on, and the wire rules that differ
-* between them. The set is Anthropic-only on purpose, because the four LLM phases need one
-* call shape. A second vendor would add a second set of truncation and structured-output
-* semantics that no phase asks for.
+* The models the sleep phases run on, and the wire rules that differ between them.
+*
+* Two providers, two call shapes, one decode. The Anthropic lane speaks the native
+* Messages body with a forced `emit` tool; the OpenAI lane speaks the chat-completions
+* body with `response_format: {type: "json_schema", strict: true}`. The OpenAI lane
+* exists for exactly one property the Anthropic lane cannot offer on Bedrock today:
+* constrained decoding, which makes an off-schema structured answer impossible at
+* generation time instead of repaired after (probed live 2026-08-22 — the Claude 5
+* models reject `strict` and `output_config.format` on every Bedrock surface, while
+* `global.openai.gpt-5.6-sol` honors strict JSON schema on InvokeModel). Both lanes
+* converge on the same response shape before `decodeToolInput`, so every phase and
+* every test sees one contract.
+*/
+/**
+* Reasoning effort. The Anthropic lane passes it as `output_config.effort`, the OpenAI
+* lane as `reasoning_effort`; both accept all four values (sol probed live 2026-08-22).
 */
-/** Reasoning effort, passed as `output_config.effort`. Accepted by all three models. */
 const Effort = Schema.Literals([
 	"low",
 	"medium",
@@ -8262,27 +8293,39 @@ const Effort = Schema.Literals([
 const ModelKey = Schema.Literals([
 	"sonnet-5",
 	"opus-5",
-	"fable-5"
+	"fable-5",
+	"gpt-5.6-sol"
 ]);
 /**
 * Bedrock ids use the `global.` inference profiles, which makes them reachable from a
-* single region without provisioning per-region throughput.
+* single region without provisioning per-region throughput. The OpenAI models REQUIRE
+* the profile: the bare `openai.gpt-5.6-*` ids reject on-demand invocation outright
+* (probed live 2026-08-22).
 */
 const MODELS = [
 	{
 		key: "sonnet-5",
 		label: "Claude Sonnet 5",
-		modelId: "global.anthropic.claude-sonnet-5"
+		modelId: "global.anthropic.claude-sonnet-5",
+		provider: "anthropic"
 	},
 	{
 		key: "opus-5",
 		label: "Claude Opus 5",
-		modelId: "global.anthropic.claude-opus-5"
+		modelId: "global.anthropic.claude-opus-5",
+		provider: "anthropic"
 	},
 	{
 		key: "fable-5",
 		label: "Claude Fable 5",
-		modelId: "global.anthropic.claude-fable-5"
+		modelId: "global.anthropic.claude-fable-5",
+		provider: "anthropic"
+	},
+	{
+		key: "gpt-5.6-sol",
+		label: "GPT-5.6 Sol",
+		modelId: "global.openai.gpt-5.6-sol",
+		provider: "openai"
 	}
 ];
 const BY_KEY = new Map(MODELS.map((model) => [model.key, model]));
@@ -8297,12 +8340,13 @@ const modelByKey = (key) => {
 	return found;
 };
 /**
-* The `thinking` object per model. Opus 5 and Fable 5 take `{type: "adaptive"}` (Fable is
-* adaptive-only). Sonnet 5 reasons unconditionally and takes NO thinking key. Sending one
-* to Sonnet 5 raises a validation error instead of being ignored.
+* The `thinking` object per Anthropic model. Opus 5 and Fable 5 take `{type: "adaptive"}`
+* (Fable is adaptive-only). Sonnet 5 reasons unconditionally and takes NO thinking key.
+* Sending one to Sonnet 5 raises a validation error instead of being ignored. The OpenAI
+* lane never consults this: its reasoning dial is `reasoning_effort` alone.
 *
-* Verified live 2026-08-02: all three accept this shape alongside a forced `tool_choice`,
-* so structured output and adaptive thinking compose.
+* Verified live 2026-08-02: all three Claude models accept this shape alongside a forced
+* `tool_choice`, so structured output and adaptive thinking compose.
 */
 const thinkingFor = (key) => key === "opus-5" || key === "fable-5" ? { type: "adaptive" } : null;
 
@@ -8317,6 +8361,13 @@ const thinkingFor = (key) => key === "opus-5" || key === "fable-5" ? { type: "ad
 * default for an omitted field, and no accepted extra key. Downstream code cannot tell a
 * coerced object from a real one, and the phases that consume these objects archive and
 * rewrite files.
+*
+* ONE repair is the exception, because it recovers the payload the model meant rather than
+* inventing one: a top-level field the schema declares as an array or object sometimes
+* arrives double-encoded as a JSON STRING. That string is parsed once and the SAME strict
+* decode re-runs on the result, so nothing an off-schema answer carries can slip through —
+* a payload the repair cannot make satisfy the schema still fails with the original
+* violation. See {@link decodeToolInput}.
 */
 /** Cap on the raw payload carried on a violation, so a runaway response cannot bloat it. */
 const MAX_RAW = 800;
@@ -8351,6 +8402,50 @@ const preview = (payload) => {
 	})();
 	return rendered.length <= 800 ? rendered : `${rendered.slice(0, 800)}…`;
 };
+/** True when a property's derived JSON schema declares a container: an array, an object, or a
+* `$ref` (every hoisted definition is a struct). A string-typed property is NOT a container,
+* which is what keeps a field that legitimately holds JSON-looking text out of the repair. */
+const expectsContainer = (property) => {
+	if (typeof property !== "object" || property === null) return false;
+	const record = property;
+	return typeof record.$ref === "string" || record.type === "array" || record.type === "object";
+};
+/**
+* Undo ONE level of JSON-string double-encoding on the top-level fields of a tool payload.
+*
+* The shape this repairs was observed on the wire: a field the schema declares as an array
+* arrives as `"{\"groups\":[…]}"` — the whole answer serialized as a string under its own
+* key — or as the array itself serialized. So a string sitting where the derived
+* `input_schema` declares a container is parsed once; when the parsed value is an object
+* carrying the SAME key, the value at that key is taken, otherwise the parsed value stands.
+*
+* Returns `undefined` when there is nothing to repair: no field qualified, or no parse
+* succeeded. The caller then reports the ORIGINAL violation, and a repaired payload still
+* re-runs the same strict decode, so this never widens what the schema accepts.
+*/
+const unwrapDoubleEncoded = (schema, input) => {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+	const properties = toInputSchema(schema).properties;
+	if (properties === void 0) return void 0;
+	let repairedAField = false;
+	const repaired = {};
+	for (const [key, received] of Object.entries(input)) {
+		repaired[key] = received;
+		if (typeof received !== "string" || !expectsContainer(properties[key])) continue;
+		const parsed = (() => {
+			try {
+				return { value: JSON.parse(received) };
+			} catch {
+				return;
+			}
+		})();
+		if (parsed === void 0) continue;
+		const wrapper = typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : void 0;
+		repaired[key] = wrapper !== void 0 && key in wrapper ? wrapper[key] : parsed.value;
+		repairedAField = true;
+	}
+	return repairedAField ? repaired : void 0;
+};
 /**
 * Decode a forced-tool payload against its schema.
 *
@@ -8359,13 +8454,29 @@ const preview = (payload) => {
 * would let a model answer a schema next to the one it was given and have the extra field
 * vanish. croq's judge rules out the same drift by enumerating its allowed keys.
 *
+* One failure shape is repaired before the violation is constructed: a top-level container
+* field double-encoded as a JSON string ({@link unwrapDoubleEncoded}). The repaired payload
+* goes through the SAME strict decode, and a repair that still does not satisfy the schema
+* reports the original payload's violation, so the repair cannot mask a genuinely off-schema
+* answer.
+*
 * `undefined` input means the model produced no `emit` call at all. That is the same class
 * of failure as a malformed one, and the reason text names it so a caller can tell the two
 * apart in a log without a second error type.
 */
 const decodeToolInput = (schema, input) => input === void 0 ? Effect.fail(LlmContractViolation.make({ reason: "model returned no tool_use block for the forced tool" })) : Effect.gen(function* () {
-	const decoded = yield* Effect.result(Schema.decodeUnknownEffect(schema, { onExcessProperty: "error" })(input));
-	return Result.isSuccess(decoded) ? decoded.success : yield* Effect.fail(LlmContractViolation.make({ reason: `tool payload does not satisfy its schema: ${String(decoded.failure)} (raw: ${preview(input)})` }));
+	const strictDecode = Schema.decodeUnknownEffect(schema, { onExcessProperty: "error" });
+	const decoded = yield* Effect.result(strictDecode(input));
+	if (Result.isSuccess(decoded)) return decoded.success;
+	const repaired = unwrapDoubleEncoded(schema, input);
+	if (repaired !== void 0) {
+		const redecoded = yield* Effect.result(strictDecode(repaired));
+		if (Result.isSuccess(redecoded)) {
+			yield* Effect.logWarning("llm.structured repaired a double-encoded tool field before decoding");
+			return redecoded.success;
+		}
+	}
+	return yield* Effect.fail(LlmContractViolation.make({ reason: `tool payload does not satisfy its schema: ${String(decoded.failure)} (raw: ${preview(input)})` }));
 });
 
 //#endregion
@@ -8377,16 +8488,18 @@ const decodeToolInput = (schema, input) => input === void 0 ? Effect.fail(LlmCon
 */
 const clampTokens = (requested) => Math.min(requested ?? 16384, MAX_TOKENS_CEILING);
 /**
-* Build the request body. The `tool` argument selects the lane. When it is absent the model
-* answers in prose. When it is present, `tool_choice` forces the model into exactly one
-* `emit` call, and that is the whole structured-output mechanism.
+* Build the request body in the model's own dialect. The `tool` argument selects the lane.
+* When it is absent the model answers in prose. When it is present the request constrains
+* the model to exactly one schema-shaped answer: a forced `emit` tool call on the
+* Anthropic dialect, a strict `json_schema` response format on the OpenAI one.
 *
 * `system` is omitted rather than sent empty, because an empty system block is a distinct
 * (and rejected) input from no system block at all. An omitted system also has nothing to cache, so
 * `cacheSystem` over an absent or empty system emits no `system` key at all instead of an empty
 * cached block.
 */
-const buildInvokeBody = (key, prompt, options, tool) => {
+const buildInvokeBody = (key, prompt, options, tool) => modelByKey(key).provider === "openai" ? buildOpenAiBody(prompt, options, tool) : buildAnthropicBody(key, prompt, options, tool);
+const buildAnthropicBody = (key, prompt, options, tool) => {
 	const body = {
 		anthropic_version: ANTHROPIC_VERSION,
 		max_tokens: clampTokens(options.maxTokens),
@@ -8417,6 +8530,51 @@ const buildInvokeBody = (key, prompt, options, tool) => {
 	return JSON.stringify(body);
 };
 /**
+* The OpenAI chat-completions body (probed live 2026-08-22 against
+* `global.openai.gpt-5.6-sol` — every field here is one the probe exercised).
+*
+* Differences from the Anthropic dialect, each one deliberate:
+*
+* - The token budget is `max_completion_tokens` and it bounds reasoning and answer
+*   together, so the same clamp applies. 128k accepted at the ceiling.
+* - Effort is `reasoning_effort`, taking the same four values.
+* - `system` rides as a leading `{role: "system"}` message; there is no `system` field.
+*   `cacheSystem` has no OpenAI-side marker — Bedrock reports `cache_write_tokens` in
+*   this dialect's usage without an opt-in field — so the flag is accepted and unused
+*   rather than rejected, keeping the option surface identical across lanes.
+* - The structured mechanism is `response_format.json_schema` with `strict: true`, named
+*   `emit` so logs read the same across providers. `description` becomes the schema's
+*   own `description`, the closest surface this dialect has to a tool description.
+*/
+const buildOpenAiBody = (prompt, options, tool) => {
+	const messages = [];
+	if (options.system !== void 0 && options.system.length > 0) messages.push({
+		role: "system",
+		content: options.system
+	});
+	messages.push({
+		role: "user",
+		content: prompt
+	});
+	const body = {
+		max_completion_tokens: clampTokens(options.maxTokens),
+		messages,
+		reasoning_effort: options.effort
+	};
+	if (tool !== void 0) body.response_format = {
+		type: "json_schema",
+		json_schema: {
+			name: STRUCTURED_TOOL_NAME,
+			strict: true,
+			schema: tool.description === void 0 ? tool.inputSchema : {
+				description: tool.description,
+				...tool.inputSchema
+			}
+		}
+	};
+	return JSON.stringify(body);
+};
+/**
 * `stop_reason` values that mean the content is not a complete answer. Both become typed
 * failures. A response cut off at `max_tokens` may never have reached the point that made
 * it a judgment, and a refusal carries no judgment at all. Reading either as a finished
@@ -8425,6 +8583,55 @@ const buildInvokeBody = (key, prompt, options, tool) => {
 const INCOMPLETE_STOP_REASONS = /* @__PURE__ */ new Set(["max_tokens", "refusal"]);
 /** The parsed payload, read defensively, since every field on the wire is optional. */
 const asResponseBody = (payload) => payload ?? {};
+/**
+* Fold an OpenAI chat-completions payload into {@link InvokeResponseBody}, so one read
+* side serves both dialects.
+*
+* `finish_reason` maps onto the Anthropic vocabulary this module already gates on:
+* `length` is `max_tokens` and `content_filter` is `refusal`, both of which
+* {@link INCOMPLETE_STOP_REASONS} already refuses; everything else passes through as a
+* complete answer. `structured` says how the caller asked, which decides how the content
+* is presented: a structured request's content is the schema-constrained JSON, parsed
+* here and presented as the `emit` tool's input, and a prose request's content is a text
+* block. Content that fails to parse on the structured path yields NO tool block, which
+* downstream reports as the existing "no tool_use block" violation — the right class,
+* since constrained decoding makes that a broken response rather than an off-schema one.
+*/
+const normalizeOpenAiResponse = (payload, structured) => {
+	const body = payload ?? {};
+	const choice = body.choices?.[0];
+	const finish = choice?.finish_reason ?? null;
+	const stopReason = finish === "length" ? "max_tokens" : finish === "content_filter" ? "refusal" : finish;
+	const text = choice?.message?.content;
+	const content = [];
+	if (typeof text === "string" && text.length > 0) {
+		if (structured) {
+			const input = (() => {
+				try {
+					return { value: JSON.parse(text) };
+				} catch {
+					return;
+				}
+			})();
+			if (input !== void 0) content.push({
+				type: "tool_use",
+				name: STRUCTURED_TOOL_NAME,
+				input: input.value
+			});
+		} else content.push({
+			type: "text",
+			text
+		});
+	}
+	return {
+		stop_reason: stopReason,
+		content,
+		usage: {
+			...body.usage?.prompt_tokens === void 0 ? {} : { input_tokens: body.usage.prompt_tokens },
+			...body.usage?.completion_tokens === void 0 ? {} : { output_tokens: body.usage.completion_tokens }
+		}
+	};
+};
 /** The incomplete `stop_reason`, or null when the response ran to a natural end. */
 const incompleteReason = (parsed) => {
 	const stop = parsed.stop_reason ?? null;
@@ -8463,7 +8670,7 @@ const makeModelClient = (client) => {
 			description: tool.description
 		}));
 		const finished = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-		const parsed = asResponseBody(payload);
+		const parsed = model.provider === "openai" ? normalizeOpenAiResponse(payload, tool !== void 0) : asResponseBody(payload);
 		const incomplete = incompleteReason(parsed);
 		if (incomplete !== null) return yield* Effect.fail(ModelUnavailable.make({
 			modelId: model.modelId,
@@ -8949,12 +9156,21 @@ const batchCall = (model, label, request) => isolate(label, model.generateObject
 * `sleep_phases` row, and in a `--phases` flag, and three copies of the string would drift.
 */
 /**
-* The fifteen phases, in execution order.
+* The sixteen phases, in execution order.
 *
 * The order encodes the predecessor memory system's dependencies (design §6): entity resolution precedes person
 * links so aliases have already merged, confidence decay precedes retention triage so triage
 * scores the decayed value, and dedup-merge precedes compress and retention because both operate
 * on the post-merge set.
+*
+* `task-detection` is sixteenth-in-list and thirteenth-in-order, sitting after `trace-consolidation`
+* and before `integrity`, and both edges are deliberate. It scans the ACTIVE corpus for unresolved
+* commitments, so it has to run after every phase that changes what is active — after dedup's folds,
+* after retention's evictions, after compress's canonicals, and after trace consolidation's newly
+* distilled memories, which are the freshest text of the night and the likeliest to carry one. And it
+* WRITES files, so it must precede `integrity`, which repairs dangling hrefs and regenerates the
+* directory artifacts: a task minted afterwards would be absent from its directory's `index.html`
+* until the next night.
 */
 const SLEEP_PHASES = [
 	"preflight",
@@ -8969,6 +9185,7 @@ const SLEEP_PHASES = [
 	"compress",
 	"reprieve",
 	"trace-consolidation",
+	"task-detection",
 	"integrity",
 	"state-export",
 	"report"
@@ -9116,6 +9333,18 @@ const meta = (name, value) => ({
 	name,
 	value
 });
+/**
+* An APPEND to a repeatable meta, as a value. `setMeta` writes the first value of a name and cannot
+* express a second, so a phase adding one more `memhtml-tag` needs this constructor.
+*
+* Idempotent, because `addMeta` returns the input unchanged when the value is already present — which is
+* what keeps a re-run of a phase that appends a tag free, the same property `stampFile` reads.
+*/
+const addTag = (value) => ({
+	kind: "addMeta",
+	name: "memhtml-tag",
+	value
+});
 /** A link addition, as a value. */
 const link = (rel, href) => ({
 	kind: "addLink",
@@ -9135,6 +9364,7 @@ const unlink = (rel, href) => href === void 0 ? {
 const applyHeadEdits = (html, edits) => {
 	let out = html;
 	for (const edit of edits) if (edit.kind === "meta") out = setMeta(out, edit.name, edit.value);
+	else if (edit.kind === "addMeta") out = addMeta(out, edit.name, edit.value);
 	else if (edit.kind === "addLink") out = addLink(out, edit.rel, edit.href);
 	else out = removeLink(out, edit.rel, edit.href);
 	return out;
@@ -9179,12 +9409,43 @@ const stampFile = (env, path, edits) => Effect.gen(function* () {
 * `R100` similarity score. Rename similarity is computed tree-to-tree, so a head stamp in the same
 * commit lowers it (measured R059-R087 on real memory files). `originalPathFor` is the authoritative
 * inverse of the archive mapping, and no correctness path here reads the score.
+*
+* **The destination is PROBED, and a taken one gets an ordinal.** `git mv` onto a path that already
+* holds a file exits 128 (`fatal: destination exists`, measured 2026-08-19), which fails the whole
+* phase rather than the one file. That is reachable — not hypothetically — because one live path can be
+* archived TWICE INSIDE ONE YEAR, and the year is the only partition the mapping has:
+*
+* - A DETECTED task's path is deliberately deterministic (`tasks.ts`: the digest keys the finding, so a
+*   finding restated tomorrow lands on the same path on purpose). Mint, sweep-close, the finding
+*   reappears, sweep-close again — and the second close aims at the first close's archive path.
+* - Any path a human restores out of the archive and lets a later night evict again is the same shape
+*   with no detector involved.
+*
+* So the fix is here rather than in `tasks.ts`: the collision is a property of the ARCHIVE mapping, and
+* every phase that archives — retention triage, reprieve, dedup's drops, compress's members — has the
+* same exposure. The ordinal is `-2`, `-3`, … at the first FREE candidate, deterministic given the tree,
+* and it goes through `withCollisionOrdinal` so it lands inside `SLUG_MAX_LENGTH` exactly as
+* `trace-consolidation`'s `freePath` and the store's own collision loop do.
+*
+* **A suffixed destination is no longer `originalPathFor`'s inverse, and that is the stated cost.** The
+* first archiving of a path keeps the unsuffixed name, so `integrity`'s dangling-href repair still finds
+* it and every existing inverse assertion holds; a SECOND archiving of one path is a second file whose
+* name says so. Nothing reads the inverse to decide a write — `integrity` searches a known-path set and
+* falls back to dropping the edge — so the alternative (failing the phase) is strictly worse.
+*
+* Exhausting the ordinals logs and answers `null`, which leaves the file at its live path. `null`
+* already means "not archived" to every caller, so an exhausted probe is counted as a file that did not
+* move rather than one that was destroyed.
 */
 const archiveFile = (env, path, extraEdits = []) => Effect.gen(function* () {
 	const normalized = normalizePath(path);
-	const target = archivePathFor(normalized, yearOf(env.date));
 	const html = yield* readFileBytes(env, normalized);
 	if (html === void 0) return null;
+	const target = yield* freeArchivePath(env, normalized);
+	if (target === void 0) {
+		yield* Effect.logWarning(`sleep.archive refused ${normalized}: every archive ordinal is taken, so the file stays live`);
+		return null;
+	}
 	yield* attemptIo(`sleep.archive.mkdir:${target}`, async () => {
 		const { mkdir } = await import("node:fs/promises");
 		const { dirname } = await import("node:path");
@@ -9201,6 +9462,43 @@ const archiveFile = (env, path, extraEdits = []) => Effect.gen(function* () {
 	yield* env.deps.git.add([target]);
 	return target;
 });
+/**
+* Archive ordinals tried before a file is left where it is. The store's own ceiling and
+* `trace-consolidation`'s, verbatim, so the three collision loops in this repo agree on the number.
+*/
+const ARCHIVE_ORDINAL_LIMIT = 1e3;
+/**
+* The lowest free archive path for a live path, or `undefined` when every ordinal is taken.
+*
+* DISK is the only authority, and it is enough: a phase archiving one path twice in one run cannot
+* happen, because the first `git mv` takes the file away and `archiveFile`'s own missing-source read
+* answers `null` for the second. So there is no in-run `claimed` set to union in, which is the one
+* half `trace-consolidation`'s `freePath` needs and this does not.
+*/
+const freeArchivePath = (env, normalized) => Effect.gen(function* () {
+	const year = yearOf(env.date);
+	for (let ordinal = 1; ordinal <= ARCHIVE_ORDINAL_LIMIT; ordinal += 1) {
+		const candidate = withArchiveOrdinal(archivePathFor(normalized, year), ordinal);
+		if ((yield* readFileBytes(env, candidate)) === void 0) return candidate;
+	}
+});
+/**
+* A path with a collision ordinal spliced into its filename STEM, before the extension.
+*
+* Before the extension rather than after, so the result is still an `.html` path the indexer reads and
+* the parser accepts. Ordinal 1 is the bare path, matching `withCollisionOrdinal`'s own convention, so
+* the ordinary single-archiving case produces byte-identical paths to what this function replaced.
+*/
+const withArchiveOrdinal = (path, ordinal) => {
+	if (ordinal <= 1) return path;
+	const cut = path.lastIndexOf("/");
+	const directory = path.slice(0, cut + 1);
+	const filename = path.slice(cut + 1);
+	const dot = filename.lastIndexOf(".");
+	const stem = dot <= 0 ? filename : filename.slice(0, dot);
+	const extension = dot <= 0 ? "" : filename.slice(dot);
+	return `${directory}${withCollisionOrdinal(stem, ordinal)}${extension}`;
+};
 /** The calendar year an archive path partitions under, from the run's own injected date. */
 const yearOf = (date) => {
 	const year = Number(date.slice(0, 4));
@@ -9230,7 +9528,16 @@ const datePlusDays = (date, days) => {
 //#endregion
 //#region packages/sleep/dist/env.js
 /**
-* Model assignments per LLM phase: the cheap judge for classification, the strong one for synthesis.
+* Model assignments per LLM phase.
+*
+* Every structured phase names `gpt-5.6-sol`, and the reason is one wire property rather
+* than a model-quality judgment: its strict `json_schema` mode does constrained decoding
+* on Bedrock today, so an off-schema answer — including the double-encoded-string shape
+* that skipped 13 batches in one Claude-5 run (issue #53) — cannot be generated at all.
+* The Claude 5 models reject `strict` and `output_config.format` on every Bedrock surface
+* (probed live 2026-08-22), so with them the schema is a request the decode enforces
+* after the fact, and a violated batch is work lost. When Claude 5 structured outputs
+* land on Bedrock, re-deciding this map is a quality question again; today it is not.
 *
 * `trace-consolidation` names `opus-5` and does not thereby choose it. The consolidator is an eve
 * agent that pins its own model in `apps/consolidator/agent/agent.ts`, and this map cannot reach that
@@ -9239,25 +9546,13 @@ const datePlusDays = (date, days) => {
 * the Bedrock global endpoint, high reasoning effort, no cost ceiling.)
 */
 const DEFAULT_MODELS = {
-	/**
-	* `dedup-merge` names sonnet for the same reason the edge-typing judge does: the question is a
-	* classification over text the model is shown, not a synthesis it has to write. It partitions a
-	* component into "these are the same memory" groups, and every consequence of that answer — which
-	* file survives, whether the pair diverges, whether either path is already claimed — is decided by
-	* code afterwards. The strong model is spent where prose gets written.
-	*/
-	"dedup-merge": "sonnet-5",
-	/**
-	* Sonnet, and one or two calls a night: the whole of one entity type's name list goes in one call.
-	* The question is a partition over short strings with their evidence inline, not a synthesis, so
-	* the strong model would buy nothing the deterministic floors around the answer do not already
-	* supply.
-	*/
-	"entity-resolution": "sonnet-5",
-	"edge-typing": "sonnet-5",
-	"arc-synthesis": "opus-5",
-	compress: "sonnet-5",
-	"trace-consolidation": "opus-5"
+	"dedup-merge": "gpt-5.6-sol",
+	"entity-resolution": "gpt-5.6-sol",
+	"edge-typing": "gpt-5.6-sol",
+	"arc-synthesis": "gpt-5.6-sol",
+	compress: "gpt-5.6-sol",
+	"trace-consolidation": "opus-5",
+	"task-detection": "gpt-5.6-sol"
 };
 /** The model a phase calls: the caller's override, else {@link DEFAULT_MODELS}, else sonnet. */
 const modelFor = (deps, phase) => deps.models?.[phase] ?? DEFAULT_MODELS[phase] ?? "sonnet-5";
@@ -9615,6 +9910,94 @@ than once, in different words.
   own dates afterwards, and a proposed group is still checked for contradicting claims, differing
   numbers, and differing product variants before anything is written. Answer only the question of
   sameness.`;
+/**
+* What a detected finding is: a commitment somebody made, or a follow-up nobody closed.
+*
+* Two values and not more. Issue #44 names both — "an open commitment or unresolved follow-up" — and
+* they are genuinely different work: a commitment has an actor who said they would do something, and a
+* follow-up is a question or a defect the text leaves open with nobody attached. The phase renders a
+* different claim for each, and the pair is closed because a third value would be a category whose
+* reading nothing downstream could state.
+*/
+const TaskFindingKind = Schema.Literals(["commitment", "followup"]);
+/** One finding about one offered member. */
+const TaskFinding = Schema.Struct({
+	/** The offered key, e.g. `m3`. A key the batch never held resolves to nothing and is dropped. */
+	memberKey: Schema.String,
+	/**
+	* The sentence that carries the finding, copied VERBATIM from the member's text.
+	*
+	* Verbatim is a checked requirement and not a request: the phase looks the sentence up in the cited
+	* file's own article text and refuses the mint when it is not there. So a paraphrase costs the
+	* finding, which is why the system prompt says so in those words.
+	*/
+	sentence: Schema.String,
+	kind: TaskFindingKind,
+	/** Unitless in `[0, 1]`. The mint gate is deterministic and reads this, not the prose. */
+	confidence: Schema.Finite.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 1
+	}))
+});
+/**
+* One batch's whole answer: the findings across every member it was shown.
+*
+* `findings: []` is a refusal and the correct answer for most batches. Most memories record a fact and
+* carry no open work at all, and a model that felt obliged to fill the list would mint tasks out of
+* ordinary prose — which is precisely the noise the volume cap exists to bound and the reviewer's
+* attention cannot absorb.
+*/
+const TaskDetection = Schema.Struct({ findings: Schema.Array(TaskFinding) });
+/**
+* The task-detection system prompt.
+*
+* The conservative posture every other judge in this file carries, aimed at the one thing this phase
+* can get wrong at scale: a memory that MENTIONS work is not a memory that carries an open
+* commitment. An `error_pattern` describing a defect somebody already fixed reads exactly like one
+* describing a defect nobody has, and the difference is in whether the text says it was resolved.
+*
+* The verbatim rule is stated as a consequence rather than as a style note, because it IS one: the
+* phase looks the sentence up in the file and drops the finding when it is absent.
+*/
+const TASK_DETECT_SYSTEM = `You find OPEN WORK recorded in an AI agent's long-term memory system. You are given a NUMBERED LIST
+of memories. For each one, decide whether its text records work that is still open, and if so quote
+the sentence that says so.
+
+Two kinds:
+
+- commitment: somebody stated they would do something and the text does not say it happened. "I'll
+  fix that tomorrow", "we need to wire capture before the next release", "leaving the merge until you
+  review it".
+- followup: the text leaves something unresolved with nobody attached. An unfixed defect a memory
+  describes, a question it ends on, a decision it says is blocked pending something else.
+
+Rules:
+
+- sentence must be copied VERBATIM from the member's own text, character for character. The system
+  looks it up in the file and DISCARDS the finding when it is not found, so a paraphrase, a
+  correction, a stitched-together sentence, or a summary loses the finding entirely.
+- Return findings: [] when nothing here carries open work. That is the ordinary answer: most memories
+  record a fact, not a task. Refusing is correct whenever you are unsure.
+- A memory that DESCRIBES completed work is not open work. "we fixed the flaky teardown by pinning
+  the port" is a record, not a task. Look for work the text leaves undone.
+- Never report a hypothetical, an option considered and rejected, or a general principle. "if the
+  cache misses we would need to warm it" names no work anybody owes.
+- One finding per memory at most, and only for the memories that have one. Omitting a member is
+  always allowed.
+- Rate confidence honestly. A finding above the floor becomes a task file a human is asked to review,
+  and a queue full of things that were never work is a queue nobody reads.`;
+/** The instruction that closes a task-detection batch's user turn, after the member list. */
+const TASK_DETECT_INSTRUCTION = "Which of these memories carry open work? For each one that does, name it by its offered key, quote the sentence verbatim, say whether it is a commitment or a followup, and rate your confidence. Return findings: [] if none of them do.";
+/**
+* The task-detection user turn for one batch: every member's text under its offered key.
+*
+* `batchPrompt` from the kernel builds the list and appends the instruction, so
+* {@link TASK_DETECT_SYSTEM} plus the tool schema form the cache-eligible prefix and only the member
+* list is new bytes per batch. The label is `memory` rather than `member`, because what the model is
+* asked about is whether a MEMORY records open work, and the wrapper's label is the only place the
+* prompt names the thing.
+*/
+const taskDetectPrompt = (members) => batchPrompt(members, TASK_DETECT_INSTRUCTION, { label: "memory" });
 /** One labelled corpus block, delimited so its prose cannot be read as an instruction. */
 const dataBlock = (label, text) => wrapAsData(label, text);
 /**
@@ -9698,7 +10081,7 @@ const dedupPrompt = (components) => {
 /**
 * The memory type no phase of a sleep cycle touches.
 *
-* A task is live working state, and every one of the fifteen phases is a judgment about REMEMBERED
+* A task is live working state, and every one of the sixteen phases is a judgment about REMEMBERED
 * FACTS: decay says a claim is fading, dedup says two claims are one, edge typing says one claim
 * caused or contradicts another, retention says a claim has stopped earning its place. None of those hold for
 * a thing an agent intends to do, and each would be wrong applied to one. A task the agent has
@@ -9725,6 +10108,33 @@ const isSleepExcluded = (memoryType) => SLEEP_EXCLUDED_TYPES.includes(memoryType
 const activeCorpus = (db) => db.all(`SELECT path, memory_type, title, gist, body_text, content_hash, confidence, importance,
             word_count, created_at, updated_at, valid_until, reprieves
      FROM files WHERE archived = 0 ORDER BY created_at ASC, path ASC`);
+/**
+* The most recently touched active NON-TASK memories, newest first, capped.
+*
+* Task detection's candidate slice. Issue #44 asks for "recent/high-salience", and this is the RECENT
+* half alone, which is the deliberate cut. The salience half would mean a retention pass — label
+* propagation plus PageRank over the whole edge list plus the access plane — for a scan whose job is
+* to notice text nobody has resolved yet, and salience measures the opposite: how much a memory has
+* been leaned on since it was written. A commitment made last night has no access history at all, so
+* ranking by salience would systematically rank the phase's best candidates last.
+*
+* `updated_at DESC` and not `created_at`, because a memory CORRECTED yesterday carries yesterday's
+* text, which is the text a commitment would be in. `path ASC` breaks the tie, so the slice — and
+* therefore the batch boundaries and the `m1`..`mN` keys — is a function of the corpus rather than of
+* the order rows came back in.
+*
+* Tasks are excluded here, in the statement, matching every other read in this module. That is the
+* no-self-referential-loop guard issue #44 names, and putting it in SQL rather than in the phase means
+* a detected task cannot become evidence of another task even if a caller forgot to filter. The phase
+* carries a second, path-level check for the same invariant, because this one is keyed on a projected
+* column and the projection is refreshed once per night.
+*/
+const recentActiveMemories = (db, options) => db.all(`SELECT path, memory_type, title, gist, body_text, content_hash, confidence, importance,
+            word_count, created_at, updated_at, valid_until, reprieves
+     FROM files
+     WHERE archived = 0 AND memory_type NOT IN (${typePlaceholders()})
+     ORDER BY updated_at DESC, path ASC
+     LIMIT ?`, [...SLEEP_EXCLUDED_TYPES, options.limit]);
 /** A `memory_type NOT IN (…)` clause against alias `f`, or nothing when nothing is excluded. */
 const typeFilterFor = (alias, excluded) => excluded.length === 0 ? "" : ` AND ${alias}.memory_type NOT IN (${excluded.map(() => "?").join(", ")})`;
 /**
@@ -10803,6 +11213,609 @@ const confidenceDecay = (env) => Effect.gen(function* () {
 	};
 });
 
+//#endregion
+//#region packages/sleep/dist/tasks.js
+/**
+* The minting discipline for a DETECTED task: one home for idempotence, evidence verification, the
+* nightly cap, and self-cleaning.
+*
+* Issue #44's shape is three detection surfaces sharing one discipline. The surfaces differ in what
+* they notice — a review band entity-resolution declined to merge, a near-duplicate pair the
+* divergence veto refused, a commitment a model found in a memory's own prose — and they agree on
+* everything that happens after: the finding becomes a `task` file authored `agent:sleep`, keyed on a
+* stable digest so a second night refreshes rather than duplicates, carrying its evidence verbatim,
+* inside a nightly volume cap, and closed when the finding stops appearing. That agreement is what
+* lives here. A copy of it per surface would be three chances to mint a task nobody can trust.
+*
+* ## A detected task is a `task`, and inherits every firewall by being one
+*
+* Nothing below teaches sleep about a new kind of file. `task` is already a memory type with its own
+* lifecycle (`todo/doing/blocked/done`, and `done` archives), its own edge class, its own placement
+* rule, and — the part that matters here — a standing exclusion from every sleep phase
+* (`SLEEP_EXCLUDED_TYPES`), from retrieval by default, from the salience arm, and from the
+* `files_content_hash_active` dedup index. So a file this module writes is invisible to dedup,
+* compress, retention, edge typing, entity resolution, and person links from the moment it lands,
+* with no phase needing to learn about it. That is the whole reason detection mints a task instead of
+* a new artifact class.
+*
+* ## The KEY is the path, not a meta and not the content hash
+*
+* A detected task's idempotence surface is its PATH: `areas/inbox/tasks/det-<12 hex>-<slug>.html`,
+* where the digest is {@link detectionKey} over the detector's name and a canonical finding string.
+* Three properties follow, and each is why the alternatives were declined:
+*
+* - **Not the content hash.** `files_content_hash_active` deliberately carves out open tasks — two
+*   open tasks with identical bodies are two real work items — so the structural dedup key cannot
+*   answer "have I already minted this finding". A detection that relied on it would mint a second
+*   task every night and the index would admit every one of them.
+* - **Not a new `memhtml-detection` meta.** The meta vocabulary is CLOSED and ordered
+*   (`packages/html/src/vocabulary.ts`), so a new name is a format change plus a parse change plus a
+*   projection plus a migration plus an index, and the lookup it would buy is a lookup the path
+*   already answers. A path also survives `rm index.db && rebuild` with no projection at all, which a
+*   queryable column does not.
+* - **Collision-free by construction, at the LIVE path.** Every stem begins with a distinct digest, so
+*   two different findings cannot land on one live path however their titles slug. This module therefore
+*   needs none of the ordinal-suffix search `trace-consolidation`'s `freePath` performs, and cannot
+*   silently overwrite a file the way that probe exists to prevent: a live path that is already taken is
+*   BY DEFINITION the same finding, which is the refresh case rather than a collision.
+*
+*   The ARCHIVE path is the one place that reasoning inverts, and `archiveFile` owns it. Determinism is
+*   what makes a mint idempotent and is exactly what makes two archivings of one key collide, because
+*   `archivePathFor` partitions only by YEAR: mint → sweep-close → the finding reappears → sweep-close
+*   again lands both closures on one archive path inside one year, and `git mv` exits 128 on a
+*   destination that exists. So the ordinal search lives in `edits.ts`, where every archiving phase gets
+*   it, and the dismissal scan below is a PREFIX scan rather than a derived path because of it.
+*
+* ## The TREE is read, never the index
+*
+* Every lookup here is a `readdir` plus a file read under {@link DETECTED_TASK_DIR}. The index is
+* refreshed once, in preflight, and not again, so a task minted earlier in the same night is absent
+* from it — and two detectors reaching one finding in one night is exactly the case idempotence has
+* to cover. Reading the tree makes a mint see the mints before it. The cost is bounded by
+* {@link DETECTED_TASK_CAP} reads of one directory per phase, because self-cleaning keeps that
+* directory the size of the OPEN detected queue rather than of the corpus.
+*
+* ## A human's closure is a STANDING DISMISSAL, and it is durable
+*
+* A detected task a human closed is a proposal they ANSWERED. `done` archives, so the file leaves the
+* open queue — and the open queue was the only thing a mint used to consult, so the same finding minted
+* a fresh task the next night, and the night after, forever. There was no way to say no. That is worse
+* than noise: a queue whose items cannot be dismissed is a queue a human stops reading, which is the
+* failure {@link DETECTED_TASK_CAP} and the sweep both exist to prevent from the other direction.
+*
+* So {@link mintDetectedTask} also reads the ARCHIVE, and a `done`-stamped detected task under the same
+* key with NO {@link MACHINE_CLOSED_TAG} is a standing dismissal: the mint is declined and counted
+* `dismissed`. Three properties of the shape:
+*
+* - **The discriminator is a tag on the file, because nothing else told the two closures apart.** See
+*   {@link MACHINE_CLOSED_TAG}. A SWEPT task must not read as a dismissal — the finding vanishing and a
+*   human declining it are opposite facts, and a finding that reappears after vanishing is new
+*   information a reviewer should see.
+* - **It is a PREFIX SCAN of the year buckets, not a derived path.** `archiveFile`'s ordinal suffixing
+*   means one key can own `det-<key>-<slug>.html` and `det-<key>-<slug>-2.html` in one year, so there is
+*   no single path to probe. The scan is a `readdir` per year over
+*   `archive/<YYYY>/areas/inbox/tasks/`, the same TREE read `openDetections` performs, bounded by
+*   {@link DISMISSAL_LOOKBACK_YEARS}.
+* - **Dismissal is durable within the archive's VISIBILITY.** A human who wants the review back deletes
+*   the archived file (or moves it out of the year buckets), and the next night mints it again. Nothing
+*   else undoes it, which is the point: a dismissal that expired on a timer would be a queue item that
+*   came back for no reason a human could name.
+*
+* ## What the code verifies, and what it cannot
+*
+* A quote is checked against the cited file's own article text and a mint whose quote is not there is
+* REFUSED ({@link mintDetectedTask} answers `unverified`). That is the issue's "proposal with
+* evidence, never an assertion", enforced rather than asked for: the one detector whose evidence a
+* model supplies is surface 3, and a fabricated sentence must not reach a file a human then reads as
+* a citation.
+*
+* A MEASUREMENT is a different thing and {@link DetectionEvidence} says so in the type. The evidence
+* behind an entity-resolution review candidate is a character-similarity ratio and two file counts —
+* a fact about the corpus that no sentence anywhere states — so there is nothing to verify it
+* against, and pretending otherwise by quoting an arbitrary claiming memory would manufacture a
+* citation to satisfy a check. The union keeps the difference visible at every call site instead of
+* leaving it to convention.
+*
+* A SESSION is the third, and it is the one place issue #44's "body must quote its source verbatim"
+* is deliberately NOT satisfied, because a stronger invariant refuses it. Surface 2's evidence is a
+* transcript line, and `.memhtml` holds no session content: the trace plane is a read-only index over
+* `~/.claude/projects`, and `phases/trace-consolidation.ts` states — with a byte-level test behind it —
+* that a distilled claim reaches the corpus and its verbatim quote does not. A quote copied into a
+* task body would be exactly the leak that test exists to catch. So the `session` arm carries the
+* session ID and no quote: the ID becomes a `memhtml-session` stamp (a projected column, so
+* `files.session_id` answers "which session opened this"), the body names the session as the place to
+* look, and the verbatim line goes where every other trace-consolidation quote goes, into the COMMIT
+* MESSAGE, which is not indexed, not chunked, not embedded, and not retrievable.
+*
+* What verifies a `session` quote is therefore not code in this file but the client boundary:
+* `ungroundedCommitmentReason` (`apps/consolidator/src/contract.ts`) refuses the whole turn when a
+* commitment cites a session the run did not make readable, and the phase additionally drops a
+* commitment whose session is outside the batch it asked about. Re-verifying the quote against
+* transcript bytes here was considered and declined: it would require `MEMHTML_TRACE_ROOT` in
+* `PhaseEnv`, which `consolidator.ts` records as the thing deliberately kept out of the environment
+* all sixteen phases share, and it would buy a check against a file that may have rotated away since
+* the consolidator read it.
+*/
+/**
+* Where a detected task lands: the ordinary task placement, asked of `@memhtml/contracts` rather than
+* retyped.
+*
+* A detected task is an ordinary task and files where one files. `placementFor` routes a workspaceless
+* task to `areas/inbox/tasks`, and `memhtml doctor` reports inbox depth, so a noisy detector shows up
+* as a health signal on the surface built to carry one. A parallel `detected/` tree would be a second
+* place to look for the same work and would sit outside the four PARA buckets the indexer reads.
+*/
+const DETECTED_TASK_DIR = placementFor({ memoryType: "task" });
+/** The filename prefix that makes a detected task recognizable from its path alone. */
+const DETECTION_PREFIX = "det-";
+/**
+* Hex characters of the digest carried in a path.
+*
+* Twelve, which is git's own abbreviated-sha width and the same width the report renderer prints. It
+* leaves 48 bits against a queue whose size the cap and the sweep hold in the tens, and it costs 17
+* characters of the 80-character slug budget rather than 68.
+*/
+const DETECTION_DIGEST_CHARS = 12;
+/** The tag every detected task carries first, so `task list` can filter the machine's queue. */
+const DETECTED_TAG = "detected";
+/**
+* The tag a MACHINE closure appends, which is the only thing that tells one apart from a human's.
+*
+* **It had to be added, because nothing in a file distinguished the two.** Both closure paths write
+* exactly `memhtml-task-status: done` plus the three archive stamps — `closeVanishedDetections` here and
+* `memhtml task status done` in `apps/cli/src/operations.ts`, deliberately, so a detected task closes the
+* same way a human's does. The differing REASON ("no longer detected" against "task done") lives only in
+* the commit message, and a commit message is not a queryable fact about a file: reading it would mean a
+* `git log --follow` per archived path per mint, and it says nothing at all after a rebase or a
+* `git filter-repo`. So the discriminator is a `memhtml-tag`, which is already repeatable, already in the
+* closed vocabulary, already projects to `file_tags`, and travels with the file's bytes.
+*
+* The value of the distinction is {@link mintDetectedTask}'s dismissal check. A HUMAN closing a detected
+* task is answering the proposal — "I looked, and I do not want this review" — and re-minting it the next
+* night makes the queue un-dismissable. A MACHINE closing it means the finding stopped appearing or the
+* system resolved it, and a finding that comes back later is genuinely new information. Without the tag
+* the two are one archived `done` task, and the check would have to pick one reading and be wrong about
+* the other half.
+*
+* Appended, never set, so it lands AFTER the detector tag and {@link openDetections}' positional read of
+* `tags[0]`/`tags[1]` is untouched.
+*/
+const MACHINE_CLOSED_TAG = "machine-closed";
+/**
+* Archive year partitions searched for a standing dismissal.
+*
+* Ten, the same span `integrity`'s `ARCHIVE_LOOKBACK_YEARS` chases a dangling href over, and stated here
+* rather than imported because a module may not depend on a phase. The number is what bounds a
+* dismissal's DURABILITY: a task dismissed eleven years ago can be re-minted, which is the honest
+* reading of "durable within the archive's visibility" rather than a promise the code cannot keep.
+*/
+const DISMISSAL_LOOKBACK_YEARS = 10;
+/**
+* Detected tasks one night may mint, across every detector.
+*
+* Ten, from issue #44 verbatim: "a noisy detector that mints 200 tasks destroys the working set it
+* exists to serve". The budget is SHARED rather than per-detector, because the number a human can
+* review is a property of the human and not of how many detectors sleep happens to run. Overflow is
+* counted, never silently dropped — a detector pressing against the cap every night is a detector
+* whose threshold is wrong, and that is only visible in the counts.
+*
+* A REFRESH costs nothing. The cap bounds new work arriving in the queue, and re-stamping a task a
+* human has already been shown adds none.
+*/
+const DETECTED_TASK_CAP = 10;
+/** Characters of a detected task's title. The same 90 a distilled memory's title is cut to. */
+const TITLE_CHARS = 90;
+/**
+* The slug budget left for a title once the prefix and digest are spent.
+*
+* Derived, not chosen, so the two cannot drift into a stem that breaches `SLUG_MAX_LENGTH` — which
+* `isSlug` rejects, and every other path in the corpus satisfies it.
+*/
+const STEM_SLUG_CHARS = 80 - 4 - 12 - 1;
+/**
+* A finding's stable key: `det-<12 hex>` over the detector's name and a canonical finding string.
+*
+* The finding string is the CALLER's canonical form of what it noticed — an entity type plus two
+* sorted names, two sorted paths, a rel plus two sorted paths — and sorting is the caller's job
+* because only the caller knows which of its fields are unordered. What this adds is the
+* normalization every caller would otherwise repeat: NFC, lowercase, collapsed whitespace. So a
+* finding restated with different spacing on a later night keys the same, and a night that saw
+* `(a, b)` keys with a night that saw `(b, a)` provided the caller sorted.
+*
+* The detector's name is INSIDE the digest, so two detectors that happen to canonicalize one finding
+* identically still own separate tasks. They noticed different things about it, and a sweep is
+* per-detector: sharing a key would let one detector's sweep close the other's task.
+*/
+const detectionKey = (detector, finding) => `${DETECTION_PREFIX}${createHash("sha256").update(`${normalizeFinding(detector)}${normalizeFinding(finding)}`, "utf8").digest("hex").slice(0, 12)}`;
+/** NFC, lowercase, collapsed whitespace, trimmed. The pre-digest form. */
+const normalizeFinding = (text) => text.normalize("NFC").toLowerCase().replace(/\s+/g, " ").trim();
+/** The path a key and a title name. Total, and unique per key whatever the title slugs to. */
+const detectedTaskPath = (key, title) => {
+	const stem = slugify(title).slice(0, STEM_SLUG_CHARS).replace(/-+$/, "");
+	return `${DETECTED_TASK_DIR}/${key}-${stem === "" ? SLUG_FALLBACK : stem}.html`;
+};
+/** The key a detected task's path carries, or `undefined` when the path is not one. */
+const detectionKeyOf = (path) => {
+	const filename = path.slice(path.lastIndexOf("/") + 1);
+	return new RegExp(`^(${DETECTION_PREFIX}[0-9a-f]{${String(12)}})-`).exec(filename)?.[1];
+};
+/** True when a path is a detected task's. The self-scan guard surface-3 reads. */
+const isDetectedTaskPath = (path) => detectionKeyOf(path) !== void 0;
+/** A fresh budget at the nightly cap. */
+const makeDetectionBudget = (cap = 10) => ({
+	remaining: Math.max(0, Math.trunc(cap)),
+	overflow: 0
+});
+/**
+* The run's shared budget, or a fresh one when the run did not supply it.
+*
+* `PhaseEnv.detectionBudget` is optional so the five existing construction sites keep compiling, and
+* the fallback is what makes a phase driven directly by a test behave like one inside a run: it gets
+* the full cap to itself. A caller must call this ONCE per phase invocation and thread the result,
+* because calling it per mint against an absent field would hand out a fresh cap every time.
+*/
+const budgetFor = (env) => env.detectionBudget ?? makeDetectionBudget();
+/**
+* Mint a detected task, or refresh the one this finding already owns.
+*
+* Order matters and is stated once here, because each step's position is what makes it mean
+* something:
+*
+* 1. **The existing open detections are read from the tree.** A key already present is the refresh
+*    case, and refreshing costs no budget.
+* 2. **The archive is read for a standing dismissal**, and a human's closure of this key declines the
+*    mint. Second rather than first because the open queue is one `readdir` and this is up to
+*    {@link DISMISSAL_LOOKBACK_YEARS} of them, so the common case — the key is open, refresh it — pays
+*    for none of them. See the module header for what makes a dismissal durable.
+* 3. **The evidence is verified before anything is written.** A quote absent from the file it cites
+*    refuses the whole mint. Checking after the write would leave a task in the tree asserting a
+*    citation the corpus does not support, and a later commit removing it would still be in the log.
+* 4. **The frame-key check runs against the OPEN queue only.** Two detectors describing one work
+*    item in different words key differently, so the digest cannot catch them; a shared claim slot
+*    can. It fires rarely by construction, because `frameKeyOf`'s guards fail closed on ordinary
+*    prose — which is the honest scope of this check and the reason it is the second net rather than
+*    the first. **Every caller's claim must be frame-DISTINCT per finding**: a claim whose frame key is
+*    a constant makes this check cap that detector's whole queue at one task, which is the defect the
+*    five minters' claim shapes are now measured against.
+* 5. **The budget is spent last**, so a refusal at any earlier step does not consume a night's
+*    allowance.
+*
+* Staging only. The phase that called this commits, so a detected task lands in the SAME commit as
+* the work that found it, which is what puts it behind the discrimination gate and what makes the
+* commit reviewable as one decision.
+*/
+const mintDetectedTask = (env, budget, request) => Effect.gen(function* () {
+	const key = detectionKey(request.detector, request.finding);
+	const open = yield* openDetections(env);
+	const existing = open.find((detected) => detected.key === key);
+	if (existing !== void 0) {
+		/**
+		* A second night refreshes the stamp and writes nothing else. Not the claim, not the evidence,
+		* not the detail: a human may have edited the body or moved the status to `doing`, and a
+		* detector overwriting that would take the queue away from the person it exists to serve.
+		* `stampFile` returns false when the instant is already stamped, so a same-date re-run is free.
+		*/
+		yield* stampFile(env, existing.path, [meta("memhtml-updated", env.at)]);
+		return "refreshed";
+	}
+	if (yield* humanDismissed(env, key)) {
+		yield* Effect.logInfo(`sleep.tasks ${request.detector} declined a mint: a human closed ${key} and the dismissal stands`);
+		return "dismissed";
+	}
+	if (!(yield* evidenceHolds(env, request.evidence))) {
+		yield* Effect.logWarning(`sleep.tasks ${request.detector} refused a mint: evidence not found in the source it cites`);
+		return "unverified";
+	}
+	const frame = frameKeyOf(request.claim);
+	if (frame !== null && open.some((detected) => frameKeyOf(detected.claim) === frame)) return "framed";
+	if (budget.remaining <= 0) {
+		budget.overflow += 1;
+		return "capped";
+	}
+	const title = titleOf(request.title);
+	const path = detectedTaskPath(key, title);
+	yield* writeFileBytes(env, path, renderTemplate({
+		title,
+		/**
+		* `claim` is required by `NewMemoryInput` and UNREAD when `articleHtml` is present, since
+		* `articleHtmlFor` returns the pre-authored markup verbatim. It is stated anyway rather than
+		* stubbed, so the two never disagree about what this file's claim is: {@link detectedArticle}
+		* builds the `<mark>` from this same value.
+		*/
+		claim: request.claim,
+		articleHtml: detectedArticle(env, request),
+		memoryType: "task",
+		taskStatus: "todo",
+		at: env.at,
+		/**
+		* `agent:sleep`, which is the author separation issue #44 asks for: a human's queue and the
+		* machine's are told apart by `memhtml-author` rather than by where they sit, so both live in
+		* one list and `task list` can filter.
+		*/
+		author: "agent:sleep",
+		/**
+		* The generic tag first and the detector second, so the pair reads as "detected, by this".
+		* The ORDER is load-bearing: `memhtml-tag` is repeatable, the serializer emits repeatables in
+		* the order given, and {@link openDetections} reads the detector back off the second value.
+		*/
+		tags: [DETECTED_TAG, request.detector],
+		/**
+		* `from_session` provenance, per issue #44, as the ordinary `memhtml-session` meta rather than
+		* anything new. It is already in the closed vocabulary, already projects to
+		* `files.session_id`, and already carries exactly this meaning on a memory an agent wrote
+		* during a session — so a detected task minted from a transcript answers "which session is
+		* this from" through the same column every other provenance query reads. Only the `session`
+		* evidence arm has one; a measurement and a corpus quote are not from a session, and stamping
+		* the run's id there would make the column mean two things.
+		*/
+		...request.evidence.kind === "session" ? { sessionId: request.evidence.sessionId.trim() } : {},
+		...dueOf(request.dueHint) === void 0 ? {} : { dueAt: dueOf(request.dueHint) }
+	}));
+	yield* env.deps.git.add([path]);
+	budget.remaining -= 1;
+	return "minted";
+});
+/**
+* Close every open detection of one detector whose key is not in `liveKeys`: stamp `done` and archive.
+*
+* Self-cleaning, per issue #44: "a finding that stops appearing closes its task with reason
+* `no longer detected`". A queue that only grows is a queue a human abandons, and the finding is the
+* only thing that can say a review is no longer wanted — the human declining to act on it cannot,
+* because that is indistinguishable from not having got to it yet.
+*
+* **`done` plus archive, matching `memhtml task status done` exactly.** `apps/cli/src/operations.ts`
+* stamps the status and then routes through `store.archiveMemory`, and this does the same two things
+* through sleep's staging discipline instead of through the store's own commit: the stamp goes on
+* first so it travels with the `git mv`, and `archiveFile` re-writes the stamped bytes at the
+* destination. `done` is not a resting state on its own; the archive tree plus `git log` is what
+* answers "what did I close".
+*
+* **The prose reason lives in the commit; the MACHINE/HUMAN distinction lives in a tag.** There is no
+* `memhtml-*` name for a closing reason and the vocabulary is closed, so the caller's `commitPhase` body
+* carries `no longer detected` — which is also where `store.archiveMemory` puts its own reason. But that
+* text is not readable as a fact about the file, and {@link mintDetectedTask}'s dismissal check needs one
+* bit of it: was this closed by the system or by a person. So every closure here also appends
+* {@link MACHINE_CLOSED_TAG}, which makes a swept task re-mintable when its finding comes back while a
+* human's closure stands. See {@link MACHINE_CLOSED_TAG}.
+*
+* **`liveKeys` must be every finding the detector SAW, not every finding it minted.** A finding
+* turned away by the cap is still live, and closing its task because a busy night declined to
+* refresh it would delete a real review the moment the queue got full. A finding below a phase's own
+* CONFIDENCE floor was also seen, so it belongs there too.
+*
+* **Call this only on the night's full-strength path.** A phase that degraded — no model bound, a
+* batch whose call failed, an early return before its scan finished — did not evaluate the candidate
+* set, so its `liveKeys` describes what it managed to look at rather than what exists. Sweeping there
+* would close a human's queue every credential-free night. Each caller states the condition it
+* sweeps under, and a caller whose degraded arm mines at a DIFFERENT floor than its full-strength one
+* is degraded even when no call failed — `dedup-merge`'s no-model arm records that reading.
+*/
+const closeVanishedDetections = (env, detector, liveKeys) => Effect.gen(function* () {
+	const open = yield* openDetections(env);
+	let closed = 0;
+	for (const detected of open) {
+		if (detected.detector !== detector) continue;
+		if (liveKeys.has(detected.key)) continue;
+		yield* stampFile(env, detected.path, [
+			meta("memhtml-task-status", "done"),
+			meta("memhtml-updated", env.at),
+			addTag(MACHINE_CLOSED_TAG)
+		]);
+		if ((yield* archiveFile(env, detected.path)) !== null) closed += 1;
+	}
+	return closed;
+});
+/**
+* Close ONE detected task by path: stamp `done` and archive, exactly as {@link closeVanishedDetections}
+* does per file. Answers `false` and writes nothing when the path is not a detected task's.
+*
+* The refusal is the point, and it is a HARD guard rather than a convention. Surface 2 closes a task
+* because a transcript says the work is done, which is a model's reading of somebody's prose — so this
+* is the one closure path whose trigger is not a fact the corpus can check. A human-opened task closed
+* on that basis is work silently taken out of somebody's queue by a sentence they did not write, and
+* `done` ARCHIVES, so the file also leaves the directory they look in. {@link isDetectedTaskPath} is
+* the discriminator because it reads the PATH: it needs no parse, no index row, and no meta, so it
+* cannot be defeated by a file whose head a model influenced.
+*
+* A caller that found its path through {@link openDetections} is already inside the guard, since that
+* function only returns detected paths. The check runs anyway, here, at the write: a second caller
+* arriving with a path from a query, a report, or a match on a title is the case this exists for, and a
+* guard that lived at the lookup instead would not cover it.
+*
+* The closing REASON goes in the caller's commit body, for the reason
+* {@link closeVanishedDetections} records: there is no `memhtml-*` name for it and the vocabulary is
+* closed. {@link MACHINE_CLOSED_TAG} rides on the file here too, and it is if anything MORE load-bearing
+* on this path: a completion detected in a transcript is the machine's reading, so if the commitment is
+* restated on a later night the task must be re-mintable rather than read as a human's dismissal.
+*/
+const closeDetectedTask = (env, path) => Effect.gen(function* () {
+	if (!isDetectedTaskPath(path)) {
+		yield* Effect.logWarning(`sleep.tasks refused to close ${path}: not a detected task, so no detector may close it`);
+		return false;
+	}
+	yield* stampFile(env, path, [
+		meta("memhtml-task-status", "done"),
+		meta("memhtml-updated", env.at),
+		addTag(MACHINE_CLOSED_TAG)
+	]);
+	return (yield* archiveFile(env, path)) !== null;
+});
+/**
+* Every OPEN detected task, read from the tree, path-ordered.
+*
+* Open means present under {@link DETECTED_TASK_DIR} and not stamped `done`. Both halves are needed
+* and neither is redundant: closing archives the file out of the directory, so presence is almost
+* sufficient — but a human may stamp `done` by hand through `memhtml task status`, or a run may be
+* interrupted between the stamp and the `git mv`, and a detector must not refresh or re-close a task
+* somebody already finished.
+*
+* **Parsed, not scanned for meta lines.** `memhtml-tag` is repeatable and the surgical `readMeta`
+* returns only the first value of a name, so the detector tag is unreachable without the real parser
+* — the same reason `entity-resolution`'s alias oracle parses person files. A file that does not
+* parse is skipped: it is not indexed either, so no detection is keyed on it.
+*/
+const openDetections = (env) => Effect.gen(function* () {
+	const filenames = yield* detectedFilenames(env, DETECTED_TASK_DIR);
+	const out = [];
+	for (const filename of filenames) {
+		const path = `${DETECTED_TASK_DIR}/${filename}`;
+		const key = detectionKeyOf(path);
+		if (key === void 0) continue;
+		const html = yield* readFileBytes(env, path);
+		if (html === void 0) continue;
+		const doc = yield* parseMemory(html).pipe(Effect.orElseSucceed(() => void 0));
+		if (doc === void 0) continue;
+		if (doc.metas.memoryType !== "task" || doc.metas.taskStatus === "done") continue;
+		const [first, second] = doc.tags;
+		if (first !== "detected" || second === void 0) continue;
+		out.push({
+			path,
+			key,
+			detector: second,
+			title: doc.title,
+			claim: doc.article.gist
+		});
+	}
+	return out;
+});
+/**
+* True when a HUMAN closed a detected task of this key and the archive still holds it: a standing
+* dismissal. See the module header for what makes it durable and how a human takes it back.
+*
+* A match requires all four, and each rules out a different false positive:
+*
+* - the filename carries this exact key, which is a prefix match on the stem rather than one derived
+*   path, because `archiveFile`'s ordinal suffixing lets one key own several archived files;
+* - the file parses as a `task` stamped `done`, so an archived task somebody left `todo` (a file moved
+*   by hand, or a run interrupted between the stamp and the `git mv`) is not read as an answer;
+* - the first tag is {@link DETECTED_TAG}, so a hand-written task that happened to land on a `det-` name
+*   cannot dismiss a detector's finding;
+* - and {@link MACHINE_CLOSED_TAG} is ABSENT, which is the whole discriminator: a swept task carries it
+*   and must stay re-mintable.
+*
+* The scan STOPS at the first match, so the common case on a corpus with archives costs one `readdir`
+* of the current year. Every year is a separate `readdir` and a missing one is empty, so a corpus with no
+* archive at all pays {@link DISMISSAL_LOOKBACK_YEARS} ENOENTs and reads no file.
+*/
+const humanDismissed = (env, key) => Effect.gen(function* () {
+	const year = yearOf(env.date);
+	for (let back = 0; back <= 10; back += 1) {
+		const directory = archivePathFor(DETECTED_TASK_DIR, year - back);
+		for (const filename of yield* detectedFilenames(env, directory)) {
+			if (!filename.startsWith(`${key}-`)) continue;
+			const html = yield* readFileBytes(env, `${directory}/${filename}`);
+			if (html === void 0) continue;
+			const doc = yield* parseMemory(html).pipe(Effect.orElseSucceed(() => void 0));
+			if (doc === void 0) continue;
+			if (doc.metas.memoryType !== "task" || doc.metas.taskStatus !== "done") continue;
+			if (doc.tags[0] !== "detected") continue;
+			if (doc.tags.includes("machine-closed")) continue;
+			return true;
+		}
+	}
+	return false;
+});
+/**
+* The `.html` filenames under one directory carrying the detection prefix, sorted.
+*
+* A missing directory is `[]`, not a failure: a corpus that has never had a detected task has no
+* `areas/inbox/tasks` at all, and that is the state every first night starts from. It is the normal case
+* for the archive year buckets too, where most of the lookback window will never exist. Any OTHER errno
+* still fails, because a permission error on the queue directory is a real fault that must not read
+* as an empty queue and take a sweep through every open detection.
+*/
+const detectedFilenames = (env, directory) => attemptIo(`sleep.tasks.list:${directory}`, async () => {
+	const { readdir } = await import("node:fs/promises");
+	try {
+		return (await readdir(absoluteIn(env, directory))).filter((name) => name.startsWith("det-") && name.endsWith(".html")).sort();
+	} catch (cause) {
+		if (cause.code === "ENOENT") return [];
+		throw cause;
+	}
+});
+/**
+* True when the evidence is admissible: a quote only when the cited file's own article text carries it,
+* a measurement or a session citation whenever it is non-empty.
+*
+* Compared with whitespace collapsed on BOTH sides, and case-sensitively. Whitespace is not content
+* here — the same sentence read out of a `body_text` projection, out of a re-wrapped paragraph, and
+* out of the file's markup differ only in spacing, and refusing on that would refuse true quotes.
+* Case IS content: "the deploy is safe" and "the deploy is SAFE" are the same words and a citation
+* that changed the emphasis is not verbatim.
+*
+* The check reads the FILE, not the index row the caller found the sentence in. The tree is the
+* system of record and the index is refreshed once per night, so a row can name text an earlier
+* phase's commit has already replaced. A missing file refuses, which is the same posture every
+* other phase takes toward a path the tree no longer holds.
+*
+* A `session` citation has no file to read and this function says so rather than pretending to check
+* one. What stands behind it is `ungroundedCommitmentReason` at the client boundary plus the phase's
+* own batch-membership check; the module header records why re-reading the transcript here was
+* declined. The non-empty test is not the guard, it is the same floor the other two arms carry.
+*/
+const evidenceHolds = (env, evidence) => Effect.gen(function* () {
+	if (evidence.kind === "measurement") return evidence.detail.trim() !== "";
+	if (evidence.kind === "session") return evidence.sessionId.trim() !== "" && evidence.statement.trim() !== "";
+	const quote = flatten(evidence.quote);
+	if (quote === "") return false;
+	const html = yield* readFileBytes(env, evidence.sourcePath);
+	if (html === void 0) return false;
+	const doc = yield* parseMemory(html).pipe(Effect.orElseSucceed(() => void 0));
+	if (doc === void 0) return false;
+	return flatten(doc.article.bodyText).includes(quote);
+});
+/** Whitespace collapsed to single spaces and trimmed. The comparison form for a quote. */
+const flatten = (text) => text.replace(/\s+/g, " ").trim();
+/** A title: one line, sentence punctuation kept, cut to {@link TITLE_CHARS}. */
+const titleOf = (title) => flatten(title).slice(0, TITLE_CHARS).trim();
+/**
+* A due hint the format accepts, or `undefined`.
+*
+* `memhtml-due` is compared and ordered AS A STRING by the overdue query, so a value that does not
+* sort alongside the others would corrupt it. `isValidDatetime` is the format's own predicate, so a
+* hint a model supplied is dropped rather than written and the task simply has no due date.
+*/
+const dueOf = (hint) => hint !== void 0 && isValidDatetime(hint.trim()) ? hint.trim() : void 0;
+/**
+* A detected task's article: the claim, the detail, the evidence, and the provenance line.
+*
+* Authored as MARKUP rather than through the template's prose path, because the evidence needs
+* `<q cite>` — the vocabulary's own quotation element, which carries its source URI and projects into
+* `file_citations(text, href)`. That is what makes issue #44's "the parser can verify the quote still
+* exists in the cited source" a single query rather than a re-read of every task. `<blockquote>` is
+* NOT in the closed vocabulary, so the quote is inline in its own paragraph.
+*
+* Using `articleHtml` means this function owns constraint 1, so the `<mark>` is placed in the first
+* `<p>` here and nowhere else. Every interpolation goes through `escapeText`/`escapeAttribute`: a
+* model-supplied sentence reaches this string on surface 3, and the source path reaches it on all of
+* them.
+*/
+const detectedArticle = (env, request) => {
+	const paragraphs = [`<p><mark>${escapeText(flatten(request.claim))}</mark></p>`];
+	if (request.detail !== void 0 && request.detail.trim() !== "") paragraphs.push(`<p>${escapeText(flatten(request.detail))}</p>`);
+	paragraphs.push(evidenceParagraph(request.evidence));
+	paragraphs.push(`<p>Detected by <code>${escapeText(request.detector)}</code> on run <code>${escapeText(env.runId)}</code>. This is a proposal for a human to decide, not a finding the corpus asserts. It closes itself when the detector stops seeing it.</p>`);
+	return paragraphs.join("\n");
+};
+/**
+* The one paragraph that states what the finding rests on, per evidence kind.
+*
+* Split out of {@link detectedArticle} once the third arm arrived, so the three readings sit beside
+* each other and the difference between them is legible. Each says out loud what a reader can do with
+* it: open the file and find the sentence, take the number on the corpus's word, or go back to the
+* session and read the line in the commit that opened this.
+*
+* The `session` arm carries NO quote, which is the trace-plane invariant and not an omission. See the
+* module header. It also carries no `<q cite>`, because there is nothing to cite: a session is not a
+* corpus path and `hrefFor` over an id would produce a link that resolves nowhere, which
+* `integrity`'s dangling-edge repair exists to prevent.
+*/
+const evidenceParagraph = (evidence) => {
+	if (evidence.kind === "quote") return `<p>Evidence, verbatim from <code>${escapeText(evidence.sourcePath)}</code>: <q cite="${escapeAttribute(hrefFor(evidence.sourcePath))}">${escapeText(flatten(evidence.quote))}</q></p>`;
+	if (evidence.kind === "session") return `<p>Evidence, from session <code>${escapeText(evidence.sessionId)}</code>: ${escapeText(flatten(evidence.statement))} The verbatim line is in the commit that opened this task; a transcript span is not stored in the corpus.</p>`;
+	return `<p>Evidence, measured over the corpus: ${escapeText(flatten(evidence.detail))}</p>`;
+};
+
 //#endregion
 //#region packages/sleep/dist/phases/dedup-merge.js
 /**
@@ -10861,6 +11874,16 @@ const confidenceDecay = (env) => Effect.gen(function* () {
 * One commit for the whole batch, not one per pair. A keeper's `memhtml-supersedes` points at its
 * dropped file's ARCHIVE path, which is where that file lives only after this commit lands.
 * Splitting them would create a dangling href in the commit that made it dangle.
+*
+* ## A vetoed pair becomes a review task
+*
+* Surface 1 of issue #44, second detector. The veto is the phase's strongest signal that something
+* needs a HUMAN rather than a merge: two memories a cosine says are the same and a divergence
+* predicate says cannot both be true is either a correction the corpus has not recorded as one, or a
+* pair of facts about different things that read alike. Neither resolution is a nightly job's to make —
+* choosing the winner of a contradiction is a one-way door on stored belief — and the count alone told
+* nobody. {@link mintVetoTasks} opens one task per vetoed pair NAMING THE PREDICATE that fired, in the
+* same commit as the folds.
 */
 /**
 * The mining floor when a model is bound. RECALL-oriented, and deliberately below the merge floor.
@@ -11002,12 +12025,41 @@ const dedupMerge = (env) => Effect.gen(function* () {
 		* could call a model, which is what makes the existing dedup tests an oracle for the rest.
 		*/
 		const decisions = mergeCandidates(oriented);
-		return yield* commitMerges(env, decisions, {
-			candidates: oriented.length,
-			components: 0,
-			llmGroups: 0,
-			vetoed: oriented.length - decisions.length
-		});
+		return yield* commitMerges(
+			env,
+			decisions,
+			{
+				candidates: oriented.length,
+				components: 0,
+				llmGroups: 0,
+				vetoed: oriented.length - decisions.length
+			},
+			/**
+			* Every mined pair on this arm cleared 0.92, so a vetoed one here is a near-certain duplicate
+			* the divergence predicates refused — which is exactly the pair issue #44 wants a human to
+			* look at.
+			*
+			* **`judged: false`, so a modelless night MINTS but never SWEEPS.** No model call failed here,
+			* so an earlier reading called this arm full-strength — and that reading closed human queues.
+			* The two arms mine at DIFFERENT floors: this one at `NEAR_DUPLICATE_THRESHOLD` (0.92) and the
+			* model arm at `DEDUP_COMPONENT_FLOOR` (0.86). A pair vetoed between 0.86 and 0.92 on a night
+			* with credentials is INVISIBLE to this arm — not gone, just below the floor it can see — so its
+			* `liveKeys` omits that pair's key and the sweep would archive a real review because the run
+			* happened to have no credentials. That is exactly what `tasks.ts`'s
+			* `closeVanishedDetections` contract forbids: "sweeping there would close a human's queue every
+			* credential-free night."
+			*
+			* The asymmetry is stated rather than repaired, because it cannot be repaired here: mining this
+			* arm at 0.86 would widen what a no-model night MERGES, and the deterministic floor is the one
+			* number this phase's safety rests on. So the degraded night does the half it can do honestly —
+			* open a task for every divergence it can see — and leaves closure to a night that evaluated the
+			* whole candidate set.
+			*/
+			{
+				vetoed: vetoedPairs(oriented),
+				judged: false
+			}
+		);
 	}
 	/**
 	* The component graph: the mined edges at the recall floor, unioned with the frame-key exact
@@ -11131,16 +12183,159 @@ const dedupMerge = (env) => Effect.gen(function* () {
 	const proposed = [...groupPairs, ...remaining];
 	const decisions = mergeCandidates(proposed, { threshold: 0 });
 	return {
-		...yield* commitMerges(env, decisions, {
-			candidates: proposed.length,
-			components: components.length,
-			llmGroups,
-			vetoed: proposed.length - decisions.length,
-			skipped
-		}),
+		...yield* commitMerges(
+			env,
+			decisions,
+			{
+				candidates: proposed.length,
+				components: components.length,
+				llmGroups,
+				vetoed: proposed.length - decisions.length,
+				skipped
+			},
+			/**
+			* On this arm a vetoed pair is one the MODEL grouped as the same memory, or one that cleared
+			* 0.92 with no group claiming it, and the veto then refused it for a divergence. Both readings
+			* are the issue's case: a semantic reader said "same" and a deterministic predicate said "these
+			* differ in a way that matters", and the resolution — is one a correction of the other? — is a
+			* human's.
+			*
+			* `judged` is false when a batch's call failed, because those components were never partitioned:
+			* their pairs reach the veto only through the mined arm, so a night that lost a call cannot say
+			* whether a pair it did not see is still a candidate.
+			*/
+			{
+				vetoed: vetoedPairs(proposed),
+				judged: skipped === 0
+			}
+		),
 		llmCalls
 	};
 });
+/** The detector name every near-duplicate review task is keyed and swept under. */
+const DEDUP_REVIEW_DETECTOR = "dedup-merge";
+/**
+* The proposed pairs the divergence veto refused, with WHICH predicate fired.
+*
+* The three predicates are pure, exported, and independently callable, so the phase can name the one
+* that fired instead of reporting "vetoed". That distinction is the whole value of the task: "these two
+* carry different numbers" tells a reviewer to compare the numbers, "exactly one of them is negated"
+* tells them one is probably a correction of the other, and "vetoed" tells them to read both files from
+* scratch.
+*
+* Re-running the predicates rather than threading a reason out of `mergeCandidates` keeps the domain
+* filter's signature alone: it returns the decisions it made, and asking it to also return a
+* per-refusal reason would make every caller carry a channel one caller reads. The predicates are pure
+* token-set comparisons over text already in memory, and this runs over the proposed set once.
+*
+* A pair with either text missing is NOT vetoed — the filter skips the veto for it too, since it cannot
+* evaluate one — so those are absent here, which is correct: an unevaluated pair is not a divergence
+* anyone found.
+*/
+const vetoedPairs = (proposed) => proposed.flatMap((pair) => {
+	const keepText = pair.keepText;
+	const dropText = pair.dropText;
+	if (keepText === void 0 || dropText === void 0) return [];
+	const predicates = [
+		...negationDivergent(keepText, dropText) ? ["one side is negated and the other is not"] : [],
+		...numericTokenDivergent(keepText, dropText) ? ["the two carry different numbers"] : [],
+		...variantQualifierDivergent(keepText, dropText) ? ["the two name different product variants"] : []
+	];
+	if (predicates.length === 0) return [];
+	return [{
+		keepPath: pair.keepPath,
+		dropPath: pair.dropPath,
+		similarity: pair.similarity,
+		predicates
+	}];
+});
+/**
+* Mint one review task per vetoed pair, and sweep the ones that stopped diverging.
+*
+* **The key is the two PATHS sorted.** A path is the id of a memory in this corpus, and the question is
+* about these two files — so unlike the merge itself, which orients keeper-then-drop from corpus dates,
+* the review question is unordered and sorting is what makes tomorrow's `(b, a)` key with today's
+* `(a, b)`.
+*
+* **The evidence is a MEASUREMENT.** The predicate that fired is a fact about the two token sets, and
+* no sentence in either file states it. The paths ride in the detail so a reviewer can open both.
+*
+* A pair whose veto STOPS firing — because a human corrected one of the two, or because one was
+* archived — is closed by the sweep, which is right: the divergence was the finding, and it is gone.
+*
+* **The claim NAMES THE TWO PATHS, and that is a correctness requirement rather than a nicety.** See
+* {@link vetoClaim}.
+*/
+const mintVetoTasks = (env, vetoed, judged) => Effect.gen(function* () {
+	const budget = budgetFor(env);
+	/**
+	* Keyed and de-duplicated before minting, then walked in key order, so which pairs a budget-capped
+	* night surfaces is a function of the pairs rather than of the arm that proposed them.
+	*/
+	const byKey = /* @__PURE__ */ new Map();
+	for (const pair of vetoed) {
+		const key = detectionKey(DEDUP_REVIEW_DETECTOR, vetoFinding(pair));
+		if (!byKey.has(key)) byKey.set(key, pair);
+	}
+	let minted = 0;
+	let refreshed = 0;
+	let framed = 0;
+	let dismissed = 0;
+	for (const key of [...byKey.keys()].sort()) {
+		const pair = byKey.get(key);
+		if (pair === void 0) continue;
+		const outcome = yield* mintDetectedTask(env, budget, {
+			detector: DEDUP_REVIEW_DETECTOR,
+			finding: vetoFinding(pair),
+			title: `Review near-duplicates vetoed for divergence: ${basenameOf$1(pair.keepPath)} and ${basenameOf$1(pair.dropPath)}`,
+			claim: vetoClaim(pair),
+			detail: "Sleep refused to fold them because folding keeps the OLDER file, so a blind merge of a correction into the memory it corrects would restore the error the correction was written to fix.",
+			evidence: {
+				kind: "measurement",
+				detail: vetoEvidence(pair)
+			}
+		});
+		if (outcome === "minted") minted += 1;
+		else if (outcome === "refreshed") refreshed += 1;
+		else if (outcome === "framed") framed += 1;
+		else if (outcome === "dismissed") dismissed += 1;
+	}
+	const closed = judged ? yield* closeVanishedDetections(env, DEDUP_REVIEW_DETECTOR, new Set(byKey.keys())) : 0;
+	return {
+		minted,
+		refreshed,
+		framed,
+		dismissed,
+		closed
+	};
+});
+/**
+* The claim a vetoed pair becomes: the work stated as work, with THE TWO PATHS IN IT.
+*
+* The paths are in the claim because `mintDetectedTask`'s frame-key proximity check reads it, and a
+* CONSTANT claim caps this detector's queue at one task. The previous wording — "review:
+* near-duplicates vetoed for divergence — is one a correction of the other?" — keys (measured against
+* `frameKeyOf`) on `review: near-duplicates vetoed for divergence — is one a correction of`, a non-null
+* key EVERY vetoed pair shares. So the first pair minted, the second answered `framed`, and a night that
+* vetoed nine pairs surfaced one. The check exists to catch two DETECTORS describing one work item in
+* different words; it must never fire between two findings of one detector, which the digest already
+* separates.
+*
+* With the paths in the value position each pair's frame is its own (measured: three pairs, three
+* distinct keys), so the check still fires against a differently-worded task about the SAME two files
+* and no longer fires between different pairs. That is the same shape `entity-resolution` and
+* `edge-typing` already have — both measured `null`, because their claims put the identities in a
+* position the rule reads as the frame rather than the value.
+*
+* The paths left the `detail` when they arrived here, so a reviewer reads them once.
+*/
+const vetoClaim = (pair) => `review: ${pair.keepPath} and ${pair.dropPath} are near-duplicates the divergence veto refused to fold.`;
+/** The canonical finding string: the two paths, sorted. See {@link mintVetoTasks}. */
+const vetoFinding = (pair) => pair.keepPath < pair.dropPath ? `${pair.keepPath} ${pair.dropPath}` : `${pair.dropPath} ${pair.keepPath}`;
+/** The evidence line: which predicates fired, and how near the two bodies measured. */
+const vetoEvidence = (pair) => `${pair.predicates.join("; ")} — at cosine ${pair.similarity.toFixed(3)}, at or above the ${String(DEDUP_COMPONENT_FLOOR)} candidate floor`;
+/** A path's filename without its extension, for a title that fits `ls` and a commit subject. */
+const basenameOf$1 = (path) => path.slice(path.lastIndexOf("/") + 1).replace(/\.html$/, "");
 /**
 * Archive each drop, stamp each keeper, and commit once.
 *
@@ -11160,16 +12355,20 @@ const dedupMerge = (env) => Effect.gen(function* () {
 * night two, and a counter bumped by a run that wrote nothing is a night of evidence the corpus never
 * saw.
 */
-const commitMerges = (env, decisions, base) => Effect.gen(function* () {
-	if (decisions.length === 0) return emptyOutcome({
-		...base,
-		merged: 0,
-		vanished: 0
-	});
+const commitMerges = (env, decisions, base, review) => Effect.gen(function* () {
+	/**
+	* A dry run counts the folds and the vetoes and mints nothing. Every count above is already real on
+	* a dry run because an operator sizing a night needs them; a TASK is a write, so it waits for a
+	* real night the same way the archives do.
+	*/
 	if (env.dryRun) return emptyOutcome({
 		...base,
 		merged: decisions.length,
-		vanished: 0
+		vanished: 0,
+		tasksMinted: 0,
+		tasksFramed: 0,
+		tasksDismissed: 0,
+		tasksClosed: 0
 	});
 	let merged = 0;
 	let vanished = 0;
@@ -11182,14 +12381,26 @@ const commitMerges = (env, decisions, base) => Effect.gen(function* () {
 		yield* stampFile(env, decision.keepPath, [link("supersedes", hrefFor(archived)), meta("memhtml-updated", env.at)]);
 		merged += 1;
 	}
+	/**
+	* The vetoed pairs become tasks in the SAME commit as the folds, and the mint runs even when
+	* nothing folded — which is why the old `decisions.length === 0` early return is gone. A night
+	* whose every candidate was vetoed is precisely the night with the most for a human to decide, and
+	* returning early on it would have made surface 1 unreachable on exactly that night.
+	*/
+	const tasks = yield* mintVetoTasks(env, review.vetoed, review.judged);
 	const final = {
 		...base,
 		merged,
-		vanished
+		vanished,
+		tasksMinted: tasks.minted,
+		tasksFramed: tasks.framed,
+		tasksDismissed: tasks.dismissed,
+		tasksClosed: tasks.closed
 	};
+	if (merged === 0 && tasks.minted === 0 && tasks.refreshed === 0 && tasks.closed === 0) return emptyOutcome(final);
 	return {
 		counts: final,
-		commitSha: yield* commitPhase(env, "dedup-merge", `fold ${merged} near-duplicates into canonicals`, final),
+		commitSha: yield* commitPhase(env, "dedup-merge", `fold ${merged} near-duplicates into canonicals`, final, tasks.minted + tasks.closed === 0 ? void 0 : `deferred ${tasks.minted} vetoed pairs to review tasks` + (tasks.closed === 0 ? "" : `; closed ${tasks.closed}: no longer detected`)),
 		llmCalls: 0
 	};
 });
@@ -11249,6 +12460,13 @@ const commitMerges = (env, decisions, base) => Effect.gen(function* () {
 * contradiction is a one-way door on stored belief, and it belongs to an agent or a human, not to a
 * nightly job.
 *
+* **A single-detection contradiction becomes a TASK.** Surface 1 of issue #44, third detector, and the
+* one whose gap was widest: a contradiction at `detections = 1` is written nowhere at all, so a real
+* conflict is invisible for a night and one the model never repeats is invisible forever. The task
+* names both files and carries the model's confidence and rationale, and it CLOSES on the second night
+* when the edge is promoted — the corpus then records the conflict where a reader will find it, which
+* is a better home for it than a to-do item.
+*
 * This phase replaced `conflict-detection`, which asked one `generateObject` per pair for a stance
 * verdict over `{contradicts, entails, neutral}`. Contradiction is now one more verdict in the same
 * list, with the same corroboration gate. A run whose commits predate the rename carries
@@ -11414,7 +12632,11 @@ const edgeTyping = (env) => Effect.gen(function* () {
 		promoted: 0,
 		skipped: 0,
 		capped: 0,
-		duplicates: 0
+		duplicates: 0,
+		tasksMinted: 0,
+		tasksFramed: 0,
+		tasksDismissed: 0,
+		tasksClosed: 0
 	};
 	if (candidates.length === 0) return emptyOutcome(zero);
 	if (env.dryRun) return emptyOutcome({
@@ -11476,6 +12698,14 @@ const edgeTyping = (env) => Effect.gen(function* () {
 	/** Second-and-later verdicts naming a key their batch had already answered for. */
 	let duplicates = 0;
 	let llmCalls = 0;
+	/**
+	* Contradictions this night detected for the FIRST time, so below the promotion gate.
+	*
+	* A value rather than a count, for the same reason `entity-resolution` keeps its review pairs: a
+	* conflict the gate declined to write is a conflict nobody is told about, and a human deciding
+	* which of two claims survives is exactly what the gate is holding the decision open for.
+	*/
+	const deferred = [];
 	for (const batch of batches) {
 		/** Opaque keys again, so a verdict cannot name a path. Each SIDE is sliced to its budget. */
 		const keyed = keyMembers(batch, (candidate) => pairText(candidate.srcText.slice(0, EDGE_PAIR_SIDE_CHARS), candidate.dstText.slice(0, EDGE_PAIR_SIDE_CHARS)));
@@ -11529,6 +12759,22 @@ const edgeTyping = (env) => Effect.gen(function* () {
 					dstPath: candidate.pair.dst,
 					at: env.at
 				}))[0];
+				/**
+				* A first detection is the case issue #44 asks for a task about: the model asserts these two
+				* claims cannot both be true, and the corroboration gate correctly refuses to write it into
+				* the files on one night's evidence — so a real contradiction sits invisible for a night,
+				* and one the model will not see again sits invisible forever. Deferring it to a human is
+				* the third detector on surface 1, and it is the ONLY one of the three where a second night
+				* resolves the finding on its own: at `detections >= 2` the edge is promoted and the task
+				* closes, because the corpus now records the conflict where a reader will find it.
+				*/
+				if (row !== void 0 && row.detections < 2) deferred.push({
+					src: candidate.pair.src,
+					dst: candidate.pair.dst,
+					confidence: verdict.confidence,
+					detections: row.detections,
+					...verdict.rationale === void 0 ? {} : { rationale: verdict.rationale }
+				});
 				if (row === void 0 || row.detections < 2 || row.promoted === 1) continue;
 				if (promoted + typed >= 50) {
 					capped += 1;
@@ -11606,6 +12852,13 @@ const edgeTyping = (env) => Effect.gen(function* () {
 			if (yield* stampFile(env, subject, [link(verdict.rel, hrefFor(object)), meta("memhtml-updated", env.at)])) typed += 1;
 		}
 	}
+	/**
+	* The single-detection contradictions become tasks in the SAME commit as the promotions. The
+	* sweep is gated on a night that judged its whole candidate set: `skipped` counts pairs whose
+	* batch's call failed as well as pairs whose endpoint the tree no longer holds, and a pair the
+	* model was never asked about must not read as a pair the model stopped contradicting.
+	*/
+	const tasks = yield* mintContradictionTasks(env, deferred, skipped === 0);
 	const counts = {
 		candidates: candidates.length,
 		judged,
@@ -11614,19 +12867,91 @@ const edgeTyping = (env) => Effect.gen(function* () {
 		promoted,
 		skipped,
 		capped,
-		duplicates
+		duplicates,
+		tasksMinted: tasks.minted,
+		tasksFramed: tasks.framed,
+		tasksDismissed: tasks.dismissed,
+		tasksClosed: tasks.closed
 	};
-	if (promoted === 0 && typed === 0) return {
+	if (promoted === 0 && typed === 0 && tasks.minted === 0 && tasks.refreshed === 0 && tasks.closed === 0) return {
 		counts,
 		commitSha: null,
 		llmCalls
 	};
 	return {
 		counts,
-		commitSha: yield* commitPhase(env, "edge-typing", `promote ${typed} typed edges and ${promoted} corroborated contradictions`, counts),
+		commitSha: yield* commitPhase(env, "edge-typing", `promote ${typed} typed edges and ${promoted} corroborated contradictions`, counts, tasks.minted + tasks.closed === 0 ? void 0 : `deferred ${tasks.minted} single-detection contradictions to review tasks` + (tasks.closed === 0 ? "" : `; closed ${tasks.closed}: no longer detected`)),
 		llmCalls
 	};
 });
+/** The detector name every contradiction review task is keyed and swept under. */
+const EDGE_REVIEW_DETECTOR = "edge-typing";
+/**
+* Mint one review task per held-back contradiction, and sweep the ones that stopped being held back.
+*
+* **The key is the REL plus the two paths sorted.** The rel is in it because `contradicts` is one of
+* several verdicts a pair could earn and each would be a different question; the paths are sorted
+* because a contradiction is symmetric — that symmetry is the phase's own stated reason for promoting
+* it into both files — so the question is unordered and tonight's `(b, a)` must key with last night's
+* `(a, b)`.
+*
+* **The evidence is a MEASUREMENT even though the model supplied a rationale.** The rationale is prose
+* ABOUT the two claims, not a span copied out of either, so it would fail the verbatim check on every
+* mint — and rightly, since the check exists to stop a model's sentence from being presented as a
+* citation. It rides in the measurement's own text, attributed to the model, where a reader can weigh
+* it as an opinion.
+*
+* **The sweep here is the one whose closure is a good outcome.** A pair promoted on its second night
+* leaves `deferred`, so the task closes — and the corpus now carries the `contradicts` edge in both
+* files, which is a better place for the conflict to live than a to-do item. The other two detectors
+* close when a finding evaporates; this one also closes when the system resolves it.
+*/
+const mintContradictionTasks = (env, deferred, judged) => Effect.gen(function* () {
+	const budget = budgetFor(env);
+	const byKey = /* @__PURE__ */ new Map();
+	for (const pending of deferred) {
+		const key = detectionKey(EDGE_REVIEW_DETECTOR, contradictionFinding(pending));
+		if (!byKey.has(key)) byKey.set(key, pending);
+	}
+	let minted = 0;
+	let refreshed = 0;
+	let framed = 0;
+	let dismissed = 0;
+	/** Key order, so which pairs a budget-capped night surfaces is a function of the pairs. */
+	for (const key of [...byKey.keys()].sort()) {
+		const pending = byKey.get(key);
+		if (pending === void 0) continue;
+		const outcome = yield* mintDetectedTask(env, budget, {
+			detector: EDGE_REVIEW_DETECTOR,
+			finding: contradictionFinding(pending),
+			title: `Decide a contradiction between ${basenameOf(pending.src)} and ${basenameOf(pending.dst)}`,
+			claim: `decide: ${pending.src} and ${pending.dst} make claims that cannot both be true.`,
+			detail: `Detected once. The edge is written into both files only at ${String(2)} detections, so nothing in the corpus records this conflict yet. Sleep never picks the winner of a contradiction: that is a one-way door on stored belief.`,
+			evidence: {
+				kind: "measurement",
+				detail: contradictionEvidence(pending)
+			}
+		});
+		if (outcome === "minted") minted += 1;
+		else if (outcome === "refreshed") refreshed += 1;
+		else if (outcome === "framed") framed += 1;
+		else if (outcome === "dismissed") dismissed += 1;
+	}
+	const closed = judged ? yield* closeVanishedDetections(env, EDGE_REVIEW_DETECTOR, new Set(byKey.keys())) : 0;
+	return {
+		minted,
+		refreshed,
+		framed,
+		dismissed,
+		closed
+	};
+});
+/** The canonical finding string: the rel and the two paths, sorted. */
+const contradictionFinding = (pending) => pending.src < pending.dst ? `contradicts ${pending.src} ${pending.dst}` : `contradicts ${pending.dst} ${pending.src}`;
+/** The evidence line: the confidence, the detection count, and the model's rationale if it gave one. */
+const contradictionEvidence = (pending) => `the model judged this a contradiction at confidence ${pending.confidence.toFixed(2)}, detection ${String(pending.detections)} of ${String(2)}` + (pending.rationale === void 0 || pending.rationale.trim() === "" ? "" : `; it said: ${pending.rationale.replace(/\s+/g, " ").trim()}`);
+/** A path's filename without its extension, for a title that fits `ls` and a commit subject. */
+const basenameOf = (path) => path.slice(path.lastIndexOf("/") + 1).replace(/\.html$/, "");
 
 //#endregion
 //#region packages/sleep/dist/phases/entity-resolution.js
@@ -11670,6 +12995,15 @@ const edgeTyping = (env) => Effect.gen(function* () {
 * not cluster, and a cluster below {@link ENTITY_CONFIDENCE_FLOOR}, both land in `reviewCandidates`. An
 * entity merge is a one-way door on stored identity: no later commit separates two subjects whose
 * memories were fused, and the failure mode of an over-eager gate is silent and permanent.
+*
+* **And every one of them now also becomes a TASK.** `reviewCandidates: 2` in a report is issue #44's
+* motivating example of the failure this phase had: a decision the night deliberately deferred to a
+* human, reported as a number and then never seen again. A deferred decision IS a task, so
+* {@link mintReviewTasks} opens one per pair with the band, the score, and each name's file count as
+* its evidence, keyed so tomorrow refreshes rather than duplicates, and closed when the pair stops
+* being a candidate — because the pair merging, or the names disappearing, means the question is
+* answered. The counter survives beside it: the count says how many pairs the night deferred and the
+* tasks are the ones a human can act on.
 */
 /** At or above this ratio two names are the same entity. Auto-merged with no model call. */
 const AUTO_MERGE_THRESHOLD = .85;
@@ -12045,6 +13379,18 @@ const entityResolution = (env) => Effect.gen(function* () {
 	let pendingCorroboration = 0;
 	let reviewCandidates = 0;
 	let llmCalls = 0;
+	/** Model calls that came back malformed. The sweep's precondition reads this; see below. */
+	let callsFailed = 0;
+	/**
+	* Every pair this night deferred to a human, as a value rather than only a count.
+	*
+	* This is issue #44's motivating case in one variable. The phase used to report
+	* `reviewCandidates: 2` and the number was never seen again: a decision the night deliberately
+	* declined to make evaporated, and the human it was deferred TO was never told. Keeping the pairs
+	* lets the phase mint one task per pair after the loop, with the evidence that made it a
+	* candidate.
+	*/
+	const deferred = [];
 	/**
 	* The model core is skipped entirely on a dry run and when no model is bound, and both leave the
 	* deterministic passes running. A dry run must make no model call and bump no counter, because a
@@ -12136,7 +13482,17 @@ const entityResolution = (env) => Effect.gen(function* () {
 					effort: "medium",
 					toolDescription: "Emit one cluster per subject, naming the members that are the same subject."
 				});
-				if (clustering === void 0) continue;
+				if (clustering === void 0) {
+					/**
+					* Counted, because the detected-task sweep's precondition reads it. A shard whose call
+					* came back malformed left every one of its names unclustered, so the band pairs among
+					* them are counted as review candidates by the pass below — which is correct for the
+					* REPORT and would be wrong as the sweep's input, since the phase did not actually judge
+					* them. See the sweep's own comment.
+					*/
+					callsFailed += 1;
+					continue;
+				}
 				for (const cluster of clustering.clusters) {
 					/**
 					* A key the batch never offered resolves to nothing, so an invented member cannot become a
@@ -12171,6 +13527,15 @@ const entityResolution = (env) => Effect.gen(function* () {
 						}
 						if (cluster.confidence < .7) {
 							reviewCandidates += 1;
+							deferred.push({
+								entityType,
+								left: merge.alias,
+								right: merge.canonical,
+								reason: "below-floor",
+								score: cluster.confidence,
+								leftFiles: counts.get(merge.alias) ?? 0,
+								rightFiles: counts.get(merge.canonical) ?? 0
+							});
 							continue;
 						}
 						const row = (yield* bumpEntityCorroboration(env.deps.db, {
@@ -12200,7 +13565,17 @@ const entityResolution = (env) => Effect.gen(function* () {
 		* the decision is recorded either as a merge or as a below-floor review candidate already counted
 		* above. Counting it here as well would report one pair twice.
 		*/
-		reviewCandidates += character.review.filter(([left, right]) => !clusteredPairs.has(pairKey(left, right))).length;
+		const bandPairs = character.review.filter(([left, right]) => !clusteredPairs.has(pairKey(left, right)));
+		reviewCandidates += bandPairs.length;
+		for (const [left, right] of bandPairs) deferred.push({
+			entityType,
+			left,
+			right,
+			reason: "character-band",
+			score: nameSimilarity(left, right),
+			leftFiles: counts.get(left) ?? 0,
+			rightFiles: counts.get(right) ?? 0
+		});
 		/** One union-find over every accepted pair, so the three sources cannot disagree on a root. */
 		const aliasToCanonical = unionPairs(counts, accepted);
 		for (const entity of bucket) {
@@ -12220,12 +13595,32 @@ const entityResolution = (env) => Effect.gen(function* () {
 		aliasMerges,
 		pendingCorroboration,
 		reviewCandidates,
+		tasksMinted: 0,
+		tasksFramed: 0,
+		tasksDismissed: 0,
+		tasksClosed: 0,
 		filesRewritten: rewrites.size
 	};
-	if (rewrites.size === 0 || env.dryRun) return {
+	/**
+	* A dry run stops here and mints nothing, matching what the rest of this phase already declines
+	* to do on one. `reviewCandidates` is real on a dry run; the tasks it would open are not.
+	*/
+	if (env.dryRun) return {
 		...emptyOutcome(counts),
 		llmCalls
 	};
+	/**
+	* The deferred decisions become task files, keyed and capped, in the SAME commit as the merges.
+	*
+	* One commit rather than two, because the two halves are one night's answer to the same question:
+	* these pairs merged, those the phase declined to merge and handed to you. A reviewer reads the
+	* pair together, and `commitPhase` commits whatever is staged, so the mints ride along.
+	*
+	* Mints happen even when nothing was rewritten, and that reordering is the whole point of surface
+	* 1. The old early return on `rewrites.size === 0` would have skipped exactly the night this
+	* feature exists for: a night whose only outcome was deferrals is a night with no rewrites.
+	*/
+	const tasks = yield* mintReviewTasks(env, deferred, model !== void 0 && callsFailed === 0);
 	let rewritten = 0;
 	for (const [path, pairs] of [...rewrites.entries()].sort(([left], [right]) => left < right ? -1 : 1)) {
 		const html = yield* readFileBytes(env, path);
@@ -12240,14 +13635,113 @@ const entityResolution = (env) => Effect.gen(function* () {
 	}
 	const final = {
 		...counts,
+		tasksMinted: tasks.minted,
+		tasksFramed: tasks.framed,
+		tasksDismissed: tasks.dismissed,
+		tasksClosed: tasks.closed,
 		filesRewritten: rewritten
 	};
+	/**
+	* Nothing staged, no commit. `commitPhase` already no-ops on an empty index, so this only spares
+	* git the call — and it now has to consider the MINTS as well as the rewrites, because a night
+	* whose only output is deferred-decision tasks must still commit them.
+	*/
+	if (rewritten === 0 && tasks.minted === 0 && tasks.refreshed === 0 && tasks.closed === 0) return {
+		...emptyOutcome(final),
+		llmCalls
+	};
 	return {
 		counts: final,
-		commitSha: yield* commitPhase(env, "entity-resolution", `normalize ${normalized} entity names, merge ${fuzzyMerges} aliases`, final),
+		commitSha: yield* commitPhase(env, "entity-resolution", `normalize ${normalized} entity names, merge ${fuzzyMerges} aliases`, final, tasks.minted + tasks.closed === 0 ? void 0 : `deferred ${tasks.minted} alias decisions to review tasks` + (tasks.closed === 0 ? "" : `; closed ${tasks.closed}: no longer detected`)),
 		llmCalls
 	};
 });
+/** The detector name every alias review task is keyed and swept under. */
+const ENTITY_REVIEW_DETECTOR = "entity-resolution";
+/**
+* Mint one review task per deferred pair, and sweep the ones that stopped being deferred.
+*
+* **The key is the entity TYPE plus the two names sorted**, and not the reason. A pair the character
+* band deferred last night and the model deferred below the floor tonight is ONE question a human has
+* to answer once — are these the same subject — so it must key the same however the night arrived at
+* it. Sorting is what makes `(laith, laith al-saadoon)` and the reverse one key; the pair is
+* unordered, because neither name is the subject of the question.
+*
+* **The evidence is a MEASUREMENT and says so.** There is no sentence anywhere in the corpus stating
+* that two names scored 0.79 against each other, so a quote would have to be manufactured. The
+* `DetectionEvidence` union makes that difference explicit rather than leaving it to a convention this
+* function could quietly break.
+*
+* **The sweep is gated on a night that had a MODEL and lost no call**, which `judged` carries.
+* `deferred` holds what the phase actually decided to defer, and a shard whose model call failed left
+* its names unclustered — so its band pairs are reported as review candidates without having been
+* judged. They ARE still live, so they belong in `liveKeys`; but a night that lost a call cannot
+* distinguish "the model decided this pair is fine" from "the model was never asked", and closing on
+* that reading would take a real review out of a human's queue because Bedrock throttled.
+*
+* **`callsFailed === 0` alone was the bug, because it is VACUOUSLY TRUE with no model bound.** The
+* caller now requires `model !== undefined` as well. A credential-free night runs only the two
+* deterministic passes, so it produces `character-band` deferrals and CANNOT produce a `below-floor`
+* one — a below-floor deferral is by definition a merge the model proposed under
+* `ENTITY_CONFIDENCE_FLOOR`, and there was no model to propose it. Its `deferred` therefore omits every
+* below-floor pair a model night opened, and sweeping against that closed those tasks on the first
+* night without credentials. `tasks.ts`'s `closeVanishedDetections` states this precondition as
+* "a phase that degraded — no model bound, a batch whose call failed — did not evaluate the candidate
+* set", and no-model is the arm that check had missed.
+*/
+const mintReviewTasks = (env, deferred, judged) => Effect.gen(function* () {
+	const budget = budgetFor(env);
+	/**
+	* Sorted and de-duplicated by key before minting, so the order tasks are opened in is a function
+	* of the pairs and not of which entity type happened to be walked first — which matters once the
+	* budget bites, because then the ORDER decides which pairs a human sees.
+	*/
+	const byKey = /* @__PURE__ */ new Map();
+	for (const candidate of [...deferred].sort(compareCandidates)) {
+		const key = detectionKey(ENTITY_REVIEW_DETECTOR, findingFor(candidate));
+		if (!byKey.has(key)) byKey.set(key, candidate);
+	}
+	let minted = 0;
+	let refreshed = 0;
+	let framed = 0;
+	let dismissed = 0;
+	for (const candidate of byKey.values()) {
+		const outcome = yield* mintDetectedTask(env, budget, {
+			detector: ENTITY_REVIEW_DETECTOR,
+			finding: findingFor(candidate),
+			title: `Confirm whether ${candidate.left} and ${candidate.right} are one ${candidate.entityType}`,
+			claim: `confirm: are "${candidate.left}" and "${candidate.right}" the same ${candidate.entityType}?`,
+			detail: "Sleep declined to merge them and deferred the decision. Merging two entities is a one-way door: no later commit separates two subjects whose memories were fused.",
+			evidence: {
+				kind: "measurement",
+				detail: evidenceFor(candidate)
+			}
+		});
+		if (outcome === "minted") minted += 1;
+		else if (outcome === "refreshed") refreshed += 1;
+		else if (outcome === "framed") framed += 1;
+		else if (outcome === "dismissed") dismissed += 1;
+	}
+	const closed = judged ? yield* closeVanishedDetections(env, ENTITY_REVIEW_DETECTOR, new Set(byKey.keys())) : 0;
+	return {
+		minted,
+		refreshed,
+		framed,
+		dismissed,
+		closed
+	};
+});
+/** The canonical finding string: the type and the two names, sorted. See {@link mintReviewTasks}. */
+const findingFor = (candidate) => candidate.left < candidate.right ? `${candidate.entityType} ${candidate.left} ${candidate.right}` : `${candidate.entityType} ${candidate.right} ${candidate.left}`;
+/** The evidence line: which band deferred it, at what number, and how much corpus is behind each name. */
+const evidenceFor = (candidate) => (candidate.reason === "character-band" ? `character overlap ${candidate.score.toFixed(2)}, inside the ${String(REVIEW_THRESHOLD)}-${String(AUTO_MERGE_THRESHOLD)} review band` : `the model proposed the merge at confidence ${candidate.score.toFixed(2)}, below the ${String(ENTITY_CONFIDENCE_FLOOR)} floor`) + `; "${candidate.left}" is claimed by ${String(candidate.leftFiles)} active memories and "${candidate.right}" by ${String(candidate.rightFiles)}`;
+/** Type, then the two names, then the reason. A total order, so the mint sequence is reproducible. */
+const compareCandidates = (left, right) => {
+	const leftFinding = findingFor(left);
+	const rightFinding = findingFor(right);
+	if (leftFinding !== rightFinding) return leftFinding < rightFinding ? -1 : 1;
+	return left.reason < right.reason ? -1 : left.reason > right.reason ? 1 : 0;
+};
 
 //#endregion
 //#region packages/sleep/dist/publish.js
@@ -12988,6 +14482,275 @@ const parseSidecar = (contents) => {
 };
 const numberOr = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
 
+//#endregion
+//#region packages/sleep/dist/phases/task-detection.js
+/**
+* Phase 13, task detection. A batched scan over the recent active corpus for work the text records
+* and nobody opened. ONE commit for the night's mints.
+*
+* Surface 3 of issue #44, and the only one that is net-new model spend. Surfaces 1 and 2 ride on
+* decisions other phases were already making — a review band entity resolution declined, a pair the
+* divergence veto refused, a commitment the consolidator's existing call can also report — so they
+* cost tokens the night was already spending. This one asks a question nobody was asking, which is why
+* it is capped, floored, and last of the four: the issue explicitly sizes it as the surface that could
+* ship last or never.
+*
+* Four stages, and the separation is what keeps a model's sentence from becoming an assertion:
+*
+* 1. **Scan (SQL, no model).** {@link TASK_SCAN_LIMIT} most-recently-updated active non-task
+*    memories, newest first, ties by path. Deterministic, so the batches and the `m1`..`mN` keys are a
+*    function of the corpus.
+* 2. **Batch (deterministic).** Sliced at {@link TASK_DETECT_BATCH_SIZE} on the shared kernel, each
+*    member cut to {@link TASK_DETECT_MEMBER_CHARS}. One call per batch, never one per memory: 200
+*    candidates is 10 calls, and per-memory judging is 200.
+* 3. **Ask (one isolated call per batch).** A failure skips its batch and is counted. A night that
+*    scanned nine batches and lost the tenth has done nine batches of work.
+* 4. **Mint (deterministic, and this is where the guards are).** The key must resolve to an offered
+*    member; the confidence must clear {@link TASK_DETECT_FLOOR}; the sentence must exist VERBATIM in
+*    the cited file's own article text, which `mintDetectedTask` checks by reading the file; the
+*    nightly budget must have room. Everything the file says is derived from the member the model was
+*    shown plus its own quoted sentence — the model never names a path, a title, or a status.
+*
+* **No self-referential loops, and ONE guard rather than two.** `recentActiveMemories` excludes `task`
+* in SQL, and that is the whole mechanism: a task is not evidence of another task, and a detector that
+* scanned its own output would restate its own queue every night. A path-prefix check on top of it was
+* written and then removed, because it could not be made to fire — the index is refreshed once in
+* preflight, so a task minted earlier in the same night is ABSENT from the projection rather than
+* present with the wrong type, and either way the statement does not return it. Mutation-verified:
+* deleting the SQL filter fails `tests/task-detection.test.ts`, and deleting the path filter did not.
+*
+* **Self-cleaning, and only from a full-strength scan.** {@link closeVanishedDetections} runs when the
+* night reached every batch — no skips — because `liveKeys` then genuinely describes the findings that
+* still exist. On a night that lost a batch it describes what the phase managed to look at, and
+* sweeping against that would close a human's review because a call was throttled.
+*
+* **Degrades and never fails.** No model bound, no candidate, a dry run, or a night where nothing
+* clears the floor all produce `ok` with counts. A credential-free run is not a broken run.
+*/
+/**
+* Memories scanned per night.
+*
+* 200, matching `EDGE_TYPING_CANDIDATE_LIMIT`'s posture rather than `COMPRESS_CANDIDATE_LIMIT`'s: this
+* is a bound on what the phase READS INTO PROMPTS, and every candidate costs tokens whether or not it
+* yields a finding. At {@link TASK_DETECT_BATCH_SIZE} that is ten calls a night, which sits inside the
+* envelope issue #43 measured for the whole batching direction. Newest-first ordering is what makes
+* 200 a moving window rather than a truncation: a corpus of 2,907 is scanned in the region where
+* unresolved work actually lives, and last month's settled memories are not re-read every night.
+*/
+const TASK_SCAN_LIMIT = 200;
+/**
+* Memories offered per model call.
+*
+* Twenty. The question is per member and the answer is a short list, so the batch can be wider than
+* compress's 8 (which has to hold every member's facts in the answer's generative attention) and
+* narrower than dedup's 40 (whose members are pre-grouped, so most of a batch needs no independent
+* judgment). Twenty memories at {@link TASK_DETECT_MEMBER_CHARS} is 24k characters of member text, and
+* the model has to read each one for a distinct verbatim sentence.
+*/
+const TASK_DETECT_BATCH_SIZE = 20;
+/** Characters of each member shown. The house per-member budget, the same 1200 four phases use. */
+const TASK_DETECT_MEMBER_CHARS = 1200;
+/**
+* The confidence a finding must clear before a task is minted.
+*
+* 0.7, the same floor `EDGE_CONFIDENCE_FLOOR` and `ENTITY_CONFIDENCE_FLOOR` set, and for the
+* comparable reason: a false positive costs a reviewer's attention, which is the resource this whole
+* surface spends, and the failure mode of a low floor is a queue nobody reads. One number rather than
+* one per kind, because a second would be a knob nobody could state the meaning of.
+*/
+const TASK_DETECT_FLOOR = .7;
+/** The detector's name: the key's namespace, the task's second tag, and the sweep's scope. */
+const TASK_DETECT_DETECTOR = "task-detection";
+/** The text a member is offered under: its title, claim, and body, the join compress and dedup use. */
+const memberText = (row) => `${row.title}\n${row.gist}\n${row.body_text}`;
+/**
+* The claim a finding becomes, by kind.
+*
+* Derived here and never asked of the model, the same decision every other phase makes about a value
+* that reaches a file. A model-written claim would be the `<mark>` span, `files.gist`, and the frame
+* key the proximity check reads — so the one sentence that decides how this task is de-duplicated
+* against the rest of the queue would be prose a model chose.
+*
+* The verbs are the imperative a reviewer acts on: a commitment is confirmed or closed, a follow-up is
+* resolved or dismissed. Both name the SOURCE, because a task whose subject a reader has to go
+* looking for is a task they skip.
+*/
+const claimFor = (kind, path) => kind === "commitment" ? `confirm: ${path} records a commitment with nothing saying it was done.` : `resolve: ${path} leaves a follow-up open.`;
+/** The title a finding becomes. Same two shapes, without the trailing sentence punctuation. */
+const titleFor$1 = (kind, row) => kind === "commitment" ? `Confirm the commitment recorded in ${row.title}` : `Resolve the follow-up left open by ${row.title}`;
+const taskDetection = (env) => Effect.gen(function* () {
+	const model = env.deps.model;
+	if (model === void 0) return {
+		...emptyOutcome(ZERO),
+		detail: "no model bound"
+	};
+	/**
+	* The candidate slice, with the self-scan exclusion inside the statement. See the phase header:
+	* `recentActiveMemories` filters `memory_type` in SQL, and no second path-level filter is added
+	* here on purpose — a detected task's row either carries `memory_type = 'task'` and the statement
+	* excludes it, or is absent from the index entirely and the statement never sees it. A path-prefix
+	* check would be a guard with no reachable input, which is worse than no guard: it reads as the
+	* thing standing between a task and the prompt while the statement is what actually does it.
+	*/
+	const candidates = yield* recentActiveMemories(env.deps.db, { limit: 200 });
+	if (candidates.length === 0) return emptyOutcome(ZERO);
+	/**
+	* A dry run stops after the deterministic half, before the calls. The candidate count is the
+	* number an operator sizing a night wants, and a preview that spent the tokens to then discard
+	* every answer would be the most expensive way to produce it. `entity-resolution` makes the same
+	* choice for a stronger reason (its dry run would have to manufacture a night of corroboration);
+	* here it is simply that nothing the calls buy survives a dry run.
+	*/
+	if (env.dryRun) return emptyOutcome({
+		...ZERO,
+		candidates: candidates.length
+	});
+	const batches = assembleBatches([candidates], { maxMembers: 20 });
+	const modelKey = modelFor(env.deps, "task-detection");
+	const budget = budgetFor(env);
+	let llmCalls = 0;
+	let findings = 0;
+	let minted = 0;
+	let refreshed = 0;
+	let unverified = 0;
+	let framed = 0;
+	let dismissed = 0;
+	let skipped = 0;
+	/**
+	* Every key this night's scan SAW, whether or not it minted and whether or not it cleared the floor.
+	* The sweep's input; see the `liveKeys.add` below for why the floor is not a filter here.
+	*/
+	const liveKeys = /* @__PURE__ */ new Set();
+	for (const batch of batches) {
+		const keyed = keyMembers(batch, memberText, { charBudget: TASK_DETECT_MEMBER_CHARS });
+		llmCalls += 1;
+		const answer = yield* batchCall(model, `task-detection batch of ${batch.length}`, {
+			schema: TaskDetection,
+			system: TASK_DETECT_SYSTEM,
+			prompt: taskDetectPrompt(keyed.keyed),
+			modelKey,
+			effort: "medium",
+			toolDescription: "Emit one finding per memory that records open work, quoting the sentence verbatim."
+		});
+		if (answer === void 0) {
+			skipped += 1;
+			continue;
+		}
+		/**
+		* The keys this batch has already yielded a finding for, so a SECOND finding naming one is
+		* dropped. Same guard `edge-typing` carries and the same reason: nothing in the schema stops a
+		* model from emitting two findings for one member, and acting on both would mint two tasks about
+		* one memory whose only difference is which sentence was quoted. `resolveKeys` does not help,
+		* because it is called one key at a time here — a finding names one member.
+		*/
+		const answered = /* @__PURE__ */ new Set();
+		for (const finding of answer.findings) {
+			const [row] = resolveKeys(keyed, [finding.memberKey]);
+			if (row === void 0) continue;
+			if (answered.has(finding.memberKey)) continue;
+			answered.add(finding.memberKey);
+			findings += 1;
+			/**
+			* The key is the SOURCE PATH plus the normalized sentence, so the same commitment found again
+			* tomorrow keys the same and refreshes. The path is in the key rather than only the sentence
+			* because one sentence can legitimately appear in two memories — a corrected memory and its
+			* correction share most of their prose — and those are two findings a reviewer decides
+			* separately. `detectionKey` normalizes, so a member whose whitespace the chunker changed keys
+			* the same.
+			*/
+			const key = detectionKey(TASK_DETECT_DETECTOR, `${row.path} ${finding.sentence}`);
+			/**
+			* The key is live BEFORE the floor gate, which is `closeVanishedDetections`' contract verbatim:
+			* `liveKeys` is every finding the detector SAW, not every finding it minted.
+			*
+			* A below-floor finding was SEEN. The sentence is still in the file and the model still reported
+			* it; only the confidence moved. Adding the key after the gate makes a task's life a function of
+			* confidence JITTER across nights — minted at 0.72, swept at 0.68, re-minted at 0.71 — and the
+			* sweep archives, so each cycle takes the file out of the human's directory and back into it
+			* with a fresh `memhtml-created`. The finding VANISHING is what closure is for, and a confidence
+			* that dipped one hundredth is not that.
+			*
+			* A below-floor finding therefore keeps its task open without ever being able to open one, which
+			* is the asymmetry the floor is supposed to buy: the floor guards what enters a human's queue,
+			* not what stays there once they have been shown it.
+			*/
+			liveKeys.add(key);
+			if (finding.confidence < .7) continue;
+			const outcome = yield* mintDetectedTask(env, budget, {
+				detector: TASK_DETECT_DETECTOR,
+				finding: `${row.path} ${finding.sentence}`,
+				title: titleFor$1(finding.kind, row),
+				claim: claimFor(finding.kind, row.path),
+				detail: `Detected as ${finding.kind === "commitment" ? "a commitment" : "an unresolved follow-up"} at confidence ${finding.confidence.toFixed(2)} in a ${row.memory_type} memory last updated ${row.updated_at}.`,
+				evidence: {
+					kind: "quote",
+					quote: finding.sentence,
+					sourcePath: row.path
+				}
+			});
+			if (outcome === "minted") minted += 1;
+			else if (outcome === "refreshed") refreshed += 1;
+			else if (outcome === "unverified") unverified += 1;
+			else if (outcome === "framed") framed += 1;
+			else if (outcome === "dismissed") dismissed += 1;
+		}
+	}
+	/**
+	* The sweep, only from a full-strength scan. `skipped > 0` means at least one batch's memories
+	* went unread, so a finding of theirs is missing from `liveKeys` because the phase could not look
+	* rather than because it is gone.
+	*/
+	const closed = skipped === 0 ? yield* closeVanishedDetections(env, TASK_DETECT_DETECTOR, liveKeys) : 0;
+	const counts = {
+		candidates: candidates.length,
+		batches: batches.length,
+		findings,
+		minted,
+		refreshed,
+		unverified,
+		framed,
+		dismissed,
+		closed,
+		capped: budget.overflow,
+		skipped
+	};
+	/**
+	* A refresh writes a `memhtml-updated` stamp, which is a staged file, so it commits — the queue's
+	* "last seen" is a fact worth a diff. Nothing staged at all leaves `commitSha: null`, which
+	* `commitPhase` already produces on an empty index; the early return only spares git the call.
+	*/
+	if (minted === 0 && refreshed === 0 && closed === 0) return {
+		counts,
+		commitSha: null,
+		llmCalls
+	};
+	return {
+		counts,
+		commitSha: yield* commitPhase(env, "task-detection", `open ${minted} detected tasks, close ${closed} no longer detected`, counts, closed === 0 ? void 0 : "closing reason: no longer detected"),
+		llmCalls
+	};
+});
+/**
+* The full count SHAPE, at zero.
+*
+* Every key the phase can report is present on every path, because a report reader comparing two
+* nights reads a missing key as a phase that does not have that concept rather than as a night that
+* did none of it. Same rule `edge-typing`'s `zero` states.
+*/
+const ZERO = {
+	candidates: 0,
+	batches: 0,
+	findings: 0,
+	minted: 0,
+	refreshed: 0,
+	unverified: 0,
+	framed: 0,
+	dismissed: 0,
+	closed: 0,
+	capped: 0,
+	skipped: 0
+};
+
 //#endregion
 //#region packages/sleep/dist/phases/trace-consolidation.js
 /**
@@ -13029,6 +14792,48 @@ const numberOr = (value, fallback) => typeof value === "number" && Number.isFini
 * (missing credentials, an unreachable agent, an off-contract answer), and a candidate this phase
 * refuses all produce `ok` with counts and a reason. INV-3 in full: a night with no Bedrock
 * credentials is not a broken night, and a run that lost this phase stays green.
+*
+* ## Surface 2: the same answer also carries COMMITMENTS
+*
+* The consolidator's turn now reports two lists, and the second is issue #44's surface 2. The marginal
+* cost is tokens in a call this phase was already making — no new model call, which is what makes this
+* surface cheap enough to run every night and is the reason the issue sizes it above the net-new scan.
+*
+* A commitment is not a candidate memory and does not travel through the candidate loop.
+* {@link CONSOLIDATION_KINDS} excludes `task` deliberately ("task is work to do, not something observed
+* to have happened"), and that exclusion still holds: the model reports what a transcript SAYS, and the
+* decision to open a task is made HERE, deterministically, by {@link commitmentRefusalFor} plus
+* {@link COMMITMENT_FLOOR}.
+*
+* Two arms, from one list:
+*
+* - **Unresolved** commitments mint detected tasks, sharing the night's `DETECTED_TASK_CAP` budget with
+*   every other detector, keyed on a normalized digest of the STATEMENT so the same promise restated on
+*   a later night refreshes rather than duplicating.
+* - **Resolved** commitments — a session showing the work done — close an OPEN detected task whose key
+*   matches. That is the issue's "closure is also detected", and it is the reason a commitment that
+*   arrives already-done is still worth reporting: a night that opens a task and a later night that
+*   closes it are two readings of the same commitment.
+*
+* The key carries the statement and NOT the session, which is the one place surface 2 departs from
+* `task-detection`'s keying, and it is forced by what closure has to reach across. See
+* {@link commitmentKey}.
+*
+* **Only a DETECTED task is ever closed, and the guard is `closeDetectedTask`'s, on the path.** A
+* human-opened task must not be archived because a model read "shipped it" in somebody's scrollback.
+*
+* **A commitment's evidence quote never enters the corpus, exactly like a candidate's.** The task body
+* carries the model's own restatement plus the session id as a `memhtml-session` stamp; the verbatim
+* line goes in the commit message. `packages/sleep/src/tasks.ts`' `DetectionEvidence` `session` arm is
+* where that split is enforced, and its header records why the quote is not re-verified against
+* transcript bytes.
+*
+* **One commit for the batch of commitment tasks**, not one per task, and that is the one place this
+* phase departs from its one-commit-per-candidate discipline. The reason the discipline exists is that
+* a distilled memory is a standalone ASSERTION about the world a reviewer weighs on its own. A detected
+* task asserts nothing — it is a proposal, and the reviewer's decision is made in the task file rather
+* than at the commit. What the commit has to do is be reviewable, and "the night found four
+* commitments, here they are with their quotes" is one reviewable decision about one model answer.
 */
 /**
 * The smallest transcript worth a model's attention, in bytes.
@@ -13076,6 +14881,270 @@ const COMMIT_QUOTE_CHARS = 200;
 /** Where a consolidated memory lands: by kind and tag, exactly as an agent's own write is placed. */
 const CONSOLIDATION_TAG = "trace-consolidation";
 /**
+* The confidence a commitment must clear before it mints a task or closes one.
+*
+* 0.7, the same floor `TASK_DETECT_FLOOR`, `EDGE_CONFIDENCE_FLOOR`, and `ENTITY_CONFIDENCE_FLOOR` set,
+* and one number rather than one per arm. The mint arm and the closure arm read it identically on
+* purpose: they are the same judgement about the same sentence, made once, and a lower floor on closure
+* would mean a commitment too weak to open a task was strong enough to close one.
+*
+* The resource this bounds is a reviewer's attention, which is a property of the human rather than of
+* how the finding was reached — the reasoning `DETECTED_TASK_CAP` records for being shared.
+*/
+const COMMITMENT_FLOOR = .7;
+/** The detector name every commitment task is keyed, tagged, and closed under. */
+const COMMITMENT_DETECTOR = "trace-commitment";
+/** The actors whose commitments are FIRST-PERSON, and therefore the only ones minted. */
+const FIRST_PERSON_ACTORS = /* @__PURE__ */ new Set(["user", "agent"]);
+/**
+* A commitment this phase will act on, or the reason it was refused.
+*
+* Deterministic and between the model and the tree, the same position {@link refusalFor} occupies for a
+* candidate memory, and every clause is a real failure mode rather than a restatement of the schema:
+*
+* - **An actor outside `user`/`agent`.** Issue #44 asks for first-person commitments only, and the
+*   contract's third value exists so a model has somewhere honest to put a third party's commitment
+*   instead of mislabelling it. Dropping `other` HERE rather than refusing it in the schema is what
+*   makes that honesty free: the model can report "a colleague said they'd ship it" accurately, and the
+*   phase declines to open a task nobody in this store owes.
+* - **An empty statement.** It becomes the task's `<mark>` claim and therefore `files.gist`, so a
+*   whitespace claim is a file the parser accepts and no search can find.
+* - **An empty quote or session id.** The quote is the reviewer's receipt in the commit message, and
+*   the session is the task's `from_session` provenance. Neither is optional in the contract; this is
+*   the redundancy every model-facing gate in this package carries, so a scripted or future
+*   consolidator that skipped the schema still does not get past here.
+* - **Below the floor.** Counted separately by the caller rather than folded into the refusals,
+*   because a night pressing against the floor is a different signal from a night sending malformed
+*   commitments — the first says the threshold may be wrong and the second says the agent is.
+*
+* A session id OUTSIDE the batch is not checked here and is checked by the caller, which holds the
+* batch. See {@link commitmentSession}.
+*/
+const commitmentRefusalFor = (commitment) => {
+	if (!FIRST_PERSON_ACTORS.has(commitment.actor)) return `actor ${commitment.actor} is not first-person`;
+	if (commitment.statement.trim() === "") return "empty statement";
+	if (commitment.evidence.quote.trim() === "") return "empty evidence quote";
+	if (commitment.evidence.sessionId.trim() === "") return "empty evidence session";
+	return null;
+};
+/**
+* A commitment's stable key: a normalized digest of the STATEMENT, and deliberately NOT of the session.
+*
+* This is the one place surface 2's keying departs from `task-detection`'s, which puts the source path
+* in its key, and the difference is forced by what closure has to do. The issue's requirement is that
+* "a commitment whose completion appears in A LATER SESSION can propose `task status done`" — so the
+* task a Monday session opened has to be findable from a Friday session's completion, and any key
+* carrying the session id makes those two keys different by construction. A session-keyed design cannot
+* close anything across nights, which is the only span closure is for.
+*
+* The consequence is that one sentence said in two sessions is ONE task, refreshed rather than
+* duplicated. That is the right reading for a commitment and the wrong one for `task-detection`'s
+* findings, and the asymmetry is not an inconsistency. A commitment is a piece of WORK: "wire the
+* capture path" promised on Monday and again on Wednesday is one thing to do, and two rows in the queue
+* would be one task and one duplicate. `task-detection`'s findings are per-MEMORY review decisions —
+* a corrected memory and its correction share most of their prose — and those are two files a reviewer
+* looks at separately, which is why the path belongs in that key.
+*
+* `detectionKey` normalizes (NFC, lowercase, collapsed whitespace), so a restatement whose spacing or
+* casing differs keys the same. It does not survive the model REWORDING the statement, which is the
+* honest limit of a digest over prose: `mintDetectedTask`'s frame-key check is the second net, the
+* volume cap is the third, and a completion whose wording moved is what `completionsUnmatched` counts.
+*/
+const commitmentKey = (commitment) => detectionKey(COMMITMENT_DETECTOR, commitment.statement);
+/**
+* The claim a commitment becomes: the work, stated as work, with the actor who owes it.
+*
+* **The STATEMENT leads, and that is a correctness requirement rather than a style choice.** The claim
+* is what `mintDetectedTask`'s frame-key proximity check reads, and the earlier wording — `confirm: the
+* <actor> committed to <statement>` — puts the statement in the rule's VALUE position: measured against
+* `frameKeyOf`, every commitment whose statement is six tokens or fewer keys on
+* `confirm: the agent committed to`, so "add the guard" and "ship the fix" shared a frame and the second
+* one answered `framed` and vanished. Only long statements escaped, by overflowing `MAX_VALUE_TOKENS` to
+* `null`, which made the collapse depend on statement length.
+*
+* With the statement in the frame the key carries it (measured: twelve statements across both actors,
+* twelve distinct keys, none null), so the check still fires between two DIFFERENT detectors describing
+* one commitment and never between two commitments of this one — which the statement digest in
+* {@link commitmentKey} already separates.
+*/
+const commitmentClaim = (commitment) => `confirm: ${flattenOne(commitment.statement)} is a commitment the ${commitment.actor} recorded and nothing says it is done.`;
+/** The title. The statement itself, which is already one sentence; `mintDetectedTask` cuts it to 90. */
+const commitmentTitle = (commitment) => `Commitment: ${flattenOne(commitment.statement)}`;
+/** Whitespace collapsed and one trailing sentence period dropped, so the claim reads as one clause. */
+const flattenOne = (text) => text.replace(/\s+/g, " ").trim().replace(/[.!?]+$/, "");
+/** The session a commitment cites, trimmed. The value the batch check and the key both read. */
+const commitmentSession = (commitment) => commitment.evidence.sessionId.trim();
+/**
+* The commit body for a batch of commitment tasks: one `commitment <session>: <quote>` line each.
+*
+* This is where a commitment's verbatim quote is allowed to go and nowhere else, the same rule
+* {@link commitContextFor} states for a candidate's evidence. A reviewer deciding whether a proposed
+* task is real needs the line it was read from, and a commit message is not part of the corpus: not
+* indexed, not chunked, not embedded, not retrievable. `commitPhase` indents the body, which is the
+* trailer-injection guard, and it matters here for the same reason it matters there — the text is a
+* model's, read out of a transcript nobody wrote for this system.
+*/
+const commitmentContext = (minted, closed) => [...minted.slice(0, COMMIT_EVIDENCE_LIMIT).map((one) => `commitment ${commitmentSession(one)}: ${one.evidence.quote.replace(/\s+/g, " ").slice(0, COMMIT_QUOTE_CHARS)}`), ...closed.map((path) => `closed ${path}: completion detected`)].join("\n");
+/** Every count at zero, so a phase that ran no commitment pass still reports the shape. */
+const ZERO_COMMITMENTS = {
+	commitments: 0,
+	commitmentTasks: 0,
+	completionsApplied: 0,
+	completionsUnmatched: 0,
+	commitmentsSkipped: 0,
+	commitmentsBelowFloor: 0,
+	commitmentsRefreshed: 0,
+	commitmentsFramed: 0,
+	commitmentsDismissed: 0,
+	commitmentsCapped: 0,
+	staged: false,
+	mintedCommitments: [],
+	closedPaths: []
+};
+/**
+* The whole commitment pass: filter, then close what resolved and mint what did not.
+*
+* **Closures run BEFORE mints, and the order is load-bearing.** A resolved commitment and an unresolved
+* one can key the same when a model reports both readings of one sentence, and closing first means the
+* task leaves the open queue before the mint arm looks at it — so the mint opens a fresh task for a
+* commitment the same answer says is done, which reads as churn. Running mints first would instead
+* REFRESH the task and then immediately close it, which is worse: the queue loses a task in the same
+* commit that touched it, and the refresh's `memhtml-updated` stamp says a human was shown something
+* that was archived before they could look. Ordering closures first makes a same-answer contradiction
+* resolve to "closed", which is the reading that costs a reviewer nothing.
+*
+* **Only sessions in the BATCH.** The client already refuses a turn citing a session it did not make
+* readable (`ungroundedCommitmentReason`), and this narrows the same way `analyzedFrom` narrows the
+* watermark set: an id outside the batch this phase asked about is a bug in the consolidator, and it
+* must not become a task file whose provenance names a session nobody selected. Cheap, so unconditional.
+*
+* **The budget is the run's shared one**, taken once here and threaded, per `budgetFor`'s contract.
+* Overflow lands in `budget.overflow`, which the caller reports as `capped` alongside every other
+* detector's.
+*/
+const consolidateCommitments = (env, commitments, batchSessionIds) => Effect.gen(function* () {
+	if (commitments.length === 0) return ZERO_COMMITMENTS;
+	let skipped = 0;
+	let belowFloor = 0;
+	/** Resolved commitments the floor turned away: completions this night declined to apply. */
+	let belowFloorCompletions = 0;
+	const admissible = [];
+	for (const [offset, commitment] of commitments.entries()) {
+		const refusal = commitmentRefusalFor(commitment);
+		if (refusal !== null) {
+			yield* Effect.logWarning(`sleep.trace-consolidation commitment ${offset} skipped: ${refusal}`);
+			skipped += 1;
+			continue;
+		}
+		if (!batchSessionIds.has(commitmentSession(commitment))) {
+			yield* Effect.logWarning(`sleep.trace-consolidation commitment ${offset} skipped: session ${commitmentSession(commitment)} is not in this run's batch`);
+			skipped += 1;
+			continue;
+		}
+		if (commitment.confidence < .7) {
+			belowFloor += 1;
+			/**
+			* A resolved commitment below the floor is the issue's "left for review" case, so it is counted
+			* as an unapplied completion HERE rather than inferred later by subtraction.
+			*
+			* Only the ones that reached the floor. A commitment the filter refused above — a third party's,
+			* or one naming a session outside the batch — is not a completion this store declined to apply;
+			* it was never a first-person commitment at all, and counting it as an unmatched completion would
+			* report the same finding under two counters and make `completionsUnmatched` read as a keying
+			* problem on a night whose only fault was a mislabelled actor.
+			*/
+			if (commitment.resolved) belowFloorCompletions += 1;
+			continue;
+		}
+		admissible.push(commitment);
+	}
+	/**
+	* The closure arm. The open queue is read ONCE for the whole batch and then narrowed in memory:
+	* `openDetections` is a `readdir` plus a parse per file, and asking it per resolved commitment
+	* would be the round-trip-per-row shape every batch read in this package exists to avoid.
+	*/
+	const resolved = admissible.filter((commitment) => commitment.resolved);
+	const closedPaths = [];
+	let unmatched = 0;
+	if (resolved.length > 0) {
+		const open = yield* openDetections(env);
+		const byKey = new Map(open.map((detected) => [detected.key, detected]));
+		for (const commitment of resolved) {
+			const match = byKey.get(commitmentKey(commitment));
+			if (match === void 0) {
+				unmatched += 1;
+				continue;
+			}
+			/**
+			* `closeDetectedTask` re-checks the path, which is redundant with `openDetections` only
+			* returning detected paths and is kept for the reason that function's own note gives: the guard
+			* belongs at the write, not at the lookup. A `false` here means the file vanished between the
+			* read and the write, so it is counted as unmatched rather than as a closure.
+			*/
+			if (yield* closeDetectedTask(env, match.path)) closedPaths.push(match.path);
+			else unmatched += 1;
+			byKey.delete(match.key);
+		}
+	}
+	/**
+	* The completions the floor turned away, added to the ones that matched nothing.
+	*
+	* ADDED rather than derived by subtracting `resolved.length` from the resolved commitments in the
+	* whole answer, which is what an earlier version did and got wrong: that difference also swept in
+	* every resolved commitment the FILTER refused, so a night whose only fault was a third party's
+	* completion reported an unmatched completion and pointed an operator at the keying.
+	*/
+	unmatched += belowFloorCompletions;
+	const budget = budgetFor(env);
+	/** The shared counter BEFORE this pass, so `commitmentsCapped` is this pass's own delta. */
+	const overflowBefore = budget.overflow;
+	const minted = [];
+	let refreshed = 0;
+	let framed = 0;
+	let dismissed = 0;
+	for (const commitment of admissible) {
+		if (commitment.resolved) continue;
+		const outcome = yield* mintDetectedTask(env, budget, {
+			detector: COMMITMENT_DETECTOR,
+			/**
+			* The statement alone, matching {@link commitmentKey} exactly. `mintDetectedTask` re-derives the
+			* digest from `detector` + `finding`, so a `finding` that disagreed with the key this phase
+			* matches closures against would mint under one path and look for another — the arms would
+			* silently never meet. One expression rather than two is what keeps them the same key.
+			*/
+			finding: commitment.statement,
+			title: commitmentTitle(commitment),
+			claim: commitmentClaim(commitment),
+			detail: `Recorded in a consolidated session at confidence ${commitment.confidence.toFixed(2)} and never stated as done. Confirm it is still wanted, or close it.`,
+			evidence: {
+				kind: "session",
+				sessionId: commitmentSession(commitment),
+				statement: commitment.statement
+			},
+			...typeof commitment.dueHint === "string" ? { dueHint: commitment.dueHint } : {}
+		});
+		if (outcome === "minted") minted.push(commitment);
+		else if (outcome === "refreshed") refreshed += 1;
+		else if (outcome === "framed") framed += 1;
+		else if (outcome === "dismissed") dismissed += 1;
+	}
+	return {
+		commitments: commitments.length,
+		commitmentTasks: minted.length,
+		completionsApplied: closedPaths.length,
+		completionsUnmatched: unmatched,
+		commitmentsSkipped: skipped,
+		commitmentsBelowFloor: belowFloor,
+		commitmentsRefreshed: refreshed,
+		commitmentsFramed: framed,
+		commitmentsDismissed: dismissed,
+		commitmentsCapped: budget.overflow - overflowBefore,
+		staged: minted.length > 0 || refreshed > 0 || closedPaths.length > 0,
+		mintedCommitments: minted,
+		closedPaths
+	};
+});
+/**
 * A candidate the phase will write, or `null` with the reason it was refused.
 *
 * The gate is deterministic and sits between the agent and the tree, which is where every
@@ -13178,10 +15247,7 @@ const traceConsolidation = (env) => Effect.gen(function* () {
 	if (consolidator === void 0) return {
 		...emptyOutcome({
 			...base,
-			batch: 0,
-			candidates: 0,
-			written: 0,
-			consolidated: 0
+			...ZERO_COUNTS
 		}),
 		detail: "no consolidator bound"
 	};
@@ -13204,10 +15270,7 @@ const traceConsolidation = (env) => Effect.gen(function* () {
 	});
 	if (batch.length === 0) return emptyOutcome({
 		...base,
-		batch: 0,
-		candidates: 0,
-		written: 0,
-		consolidated: 0
+		...ZERO_COUNTS
 	});
 	/**
 	* A dry run stops HERE, having done the whole deterministic half: the batch is real and counted,
@@ -13217,10 +15280,8 @@ const traceConsolidation = (env) => Effect.gen(function* () {
 	*/
 	if (env.dryRun) return emptyOutcome({
 		...base,
-		batch: batch.length,
-		candidates: 0,
-		written: 0,
-		consolidated: 0
+		...ZERO_COUNTS,
+		batch: batch.length
 	});
 	/**
 	* The whole consolidator call in isolation. A failure is a VALUE here and not a phase
@@ -13253,10 +15314,8 @@ const traceConsolidation = (env) => Effect.gen(function* () {
 		return {
 			...emptyOutcome({
 				...base,
-				batch: batch.length,
-				candidates: 0,
-				written: 0,
-				consolidated: 0
+				...ZERO_COUNTS,
+				batch: batch.length
 			}),
 			detail: `consolidator unavailable: ${failure._tag}`
 		};
@@ -13337,6 +15396,29 @@ const traceConsolidation = (env) => Effect.gen(function* () {
 		written += 1;
 	}
 	/**
+	* Surface 2, AFTER every candidate commit and BEFORE the watermark.
+	*
+	* After the candidates, so a commitment task cannot ride into a `distill …` commit and confuse what
+	* that commit decided; each half of the answer gets its own reviewable commit. Before the watermark,
+	* for the reason the watermark's own note gives: it goes last, so a process killed mid-phase
+	* re-reads the batch rather than recording it read with nothing to show.
+	*
+	* The batch is the grounding set, `analyzedFrom` is not. A commitment cites a session whose
+	* TRANSCRIPT was read, and `analyzedSessionIds` is the reachable set the CLIENT computed — which is
+	* the right input for a watermark and the wrong one for this check, since a scripted or degraded
+	* consolidator could report a narrower reachable set while still having read the sessions it quotes.
+	* The batch is what this phase asked about, and it is the containment the phase can assert.
+	*/
+	const commitments = yield* consolidateCommitments(env, outcome.success.commitments, new Set(batch.map((session) => session.session_id)));
+	if (commitments.staged) {
+		const commitSha = yield* commitPhase(env, "trace-consolidation", `detect ${String(commitments.commitmentTasks)} commitments, close ${String(commitments.completionsApplied)} completed`, {
+			...base,
+			batch: batch.length,
+			...commitmentCounts(commitments)
+		}, commitmentContext(commitments.mintedCommitments, commitments.closedPaths));
+		if (commitSha !== null) lastCommit = commitSha;
+	}
+	/**
 	* The watermark is written LAST, after every commit, and covers exactly the sessions the agent
 	* ACTUALLY READ. {@link analyzedFrom} is that set, and it is not `batch`.
 	*
@@ -13394,13 +15476,52 @@ const traceConsolidation = (env) => Effect.gen(function* () {
 			skipped,
 			conflicts: conflicted,
 			consolidated: analyzed.length,
-			unreachable
+			unreachable,
+			...commitmentCounts(commitments)
 		},
 		commitSha: lastCommit,
 		llmCalls
 	};
 });
 /**
+* The commitment half of the counts, from the pass's outcome.
+*
+* One function, called by both the phase's return and the commitment commit's trailer, so a reader
+* comparing the `Memhtml-Counts` trailer against the report sees the same keys with the same meanings.
+* `capped` is the SHARED budget's overflow — every detector's, not this one's, per `DETECTED_TASK_CAP`'s
+* note — so it is read off the budget rather than counted here.
+*/
+const commitmentCounts = (outcome) => ({
+	commitments: outcome.commitments,
+	commitmentTasks: outcome.commitmentTasks,
+	completionsApplied: outcome.completionsApplied,
+	completionsUnmatched: outcome.completionsUnmatched,
+	commitmentsSkipped: outcome.commitmentsSkipped,
+	commitmentsBelowFloor: outcome.commitmentsBelowFloor,
+	commitmentsRefreshed: outcome.commitmentsRefreshed,
+	commitmentsFramed: outcome.commitmentsFramed,
+	commitmentsDismissed: outcome.commitmentsDismissed,
+	commitmentsCapped: outcome.commitmentsCapped
+});
+/**
+* The full count SHAPE, at zero, for every path that returns before the model answer.
+*
+* Every key the phase can report is present on every path, because a report reader comparing two nights
+* reads a missing key as a phase that does not have the concept rather than as a night that did none of
+* it. Same rule `task-detection`'s `ZERO` and `edge-typing`'s `zero` state. `base` is spread beside it
+* because those three counters are real on every path, including a dry run.
+*/
+const ZERO_COUNTS = {
+	batch: 0,
+	candidates: 0,
+	written: 0,
+	skipped: 0,
+	conflicts: 0,
+	consolidated: 0,
+	unreachable: 0,
+	...commitmentCounts(ZERO_COMMITMENTS)
+};
+/**
 * The sessions to watermark: those the agent reported analyzing, INTERSECTED with the batch.
 *
 * The intersection is the containment half of the invariant and it is cheap, so it is unconditional. A
@@ -13563,6 +15684,7 @@ const PHASE_BODIES = {
 	compress,
 	reprieve,
 	"trace-consolidation": traceConsolidation,
+	"task-detection": taskDetection,
 	integrity,
 	"state-export": stateExport,
 	report: reportPhase([])
@@ -13613,7 +15735,17 @@ const run = (deps, options) => Effect.gen(function* () {
 		date: options.date,
 		at: instant.at,
 		atMillis: instant.millis,
-		dryRun
+		dryRun,
+		/**
+		* ONE budget for the whole run, created here and shared by every phase that mints a detected
+		* task. `DETECTED_TASK_CAP` bounds the NIGHT and not each detector, because how many proposals a
+		* human can review is a property of the human — so a night where entity resolution finds nine
+		* review candidates leaves task detection one, first come.
+		*
+		* Created per run rather than held in a module, which is what keeps two runs in one process (and
+		* two tests in one file) from sharing a counter.
+		*/
+		detectionBudget: makeDetectionBudget()
 	};
 	if (!dryRun) yield* deps.git.checkoutBranch(runId, { create: true }).pipe(Effect.orElseSucceed(() => {}));
 	yield* ignoreFailure(recordRun(deps.db, {
@@ -13671,7 +15803,16 @@ const resume = (deps, runId, options = {}) => Effect.gen(function* () {
 		date,
 		at: instant.at,
 		atMillis: instant.millis,
-		dryRun: false
+		dryRun: false,
+		/**
+		* A resume gets a FRESH budget, deliberately. The alternative would be reconstructing how much
+		* the interrupted attempt spent by counting detected tasks in the tree, and the count would be
+		* wrong in the direction that matters: a phase that minted three and was then killed would have
+		* its own three counted against it on the retry, so a resume would mint fewer than the run it is
+		* finishing. The cost of a fresh one is bounded by the cap, and the mints a resume repeats are
+		* refreshes rather than duplicates, which cost no budget at all.
+		*/
+		detectionBudget: makeDetectionBudget()
 	};
 	const remaining = SLEEP_PHASES.filter((phase) => !completed.has(phase));
 	const executed = yield* executePhases(env, remaining, /* @__PURE__ */ new Set());
@@ -13679,7 +15820,7 @@ const resume = (deps, runId, options = {}) => Effect.gen(function* () {
 	const ended = yield* nowIso;
 	/**
 	* Skipped-because-already-done rows are reported explicitly, so a resume's report accounts for all
-	* fifteen phases. A report that showed only the eight it ran would read as a partial run.
+	* sixteen phases. A report that showed only the eight it ran would read as a partial run.
 	*/
 	const priorRows = yield* ignoreFailureWith(readPhases(deps.db, runId), []);
 	const already = [...completed].map((phase) => {
@@ -14719,5 +16860,5 @@ const earliest = (left, right) => left === null ? right : right === null ? left
 const latest = (left, right) => left === null ? right : right === null ? left : left >= right ? left : right;
 
 //#endregion
-export { STATE_SIDECAR_PATH as $, makeIndexRecorder as A, makeGitPort as B, ModelClientLive as C, EMBED_DIM as D, EmbeddingsLive as E, reinforce as F, STATE_MIGRATIONS_DIR as G, DatabaseService as H, Indexer as I, expandRoot as J, STATE_SCHEMA as K, makeIndexer as L, readWatermark as M, Retrieval as N, EMBED_WATERMARK as O, makeRetrieval as P, STATE_DB_PATH as Q, readIndexState as R, ModelClient as S, Embeddings as T, makeDatabase as U, sanitizeFtsQuery as V, MIGRATIONS_DIR as W, INDEX_DB_PATH as X, makeStore as Y, SLEEP_REPORTS_DIR as Z, unlink as _, parseSidecar as a, commitSubject as at, discriminationGate as b, generateArtifacts as c, isValidDatetime as ct, danglingEdges as d, REINFORCE_SIGNALS as dt, attemptIo as et, publishRows as f, frameKeyOf as ft, meta as g, link as h, makeSleep as i, makeGit as it, persistScanned as j, IndexRecorder as k, accessRows as l, closesFence as lt, hrefFor as m, scanTraceRoot as n, readFileOrNull as nt, renderSidecar as o, checkMemory as ot, applyHeadEdits as p, Store as q, Sleep as r, Git as rt, archivedFormOf as s, setMeta as st, mergeTailExtract as t, initRepo as tt, allPaths as u, fenceOpeningOf as ut, SLEEP_PHASES as v, wrapAsData as w, runDiscrimination as x, isSleepPhase as y, IndexGit as z };
-//# sourceMappingURL=dist-B3yDga97.mjs.map
+export { STATE_DB_PATH as $, IndexRecorder as A, IndexGit as B, ModelClient as C, EmbeddingsLive as D, Embeddings as E, makeRetrieval as F, MIGRATIONS_DIR as G, sanitizeFtsQuery as H, reinforce as I, Store as J, STATE_MIGRATIONS_DIR as K, Indexer as L, persistScanned as M, readWatermark as N, EMBED_DIM as O, Retrieval as P, SLEEP_REPORTS_DIR as Q, makeIndexer as R, runDiscrimination as S, wrapAsData as T, DatabaseService as U, makeGitPort as V, makeDatabase as W, makeStore as X, expandRoot as Y, INDEX_DB_PATH as Z, meta as _, parseSidecar as a, makeGit as at, isSleepPhase as b, generateArtifacts as c, setMeta as ct, allPaths as d, fenceOpeningOf as dt, STATE_SIDECAR_PATH as et, danglingEdges as f, REINFORCE_SIGNALS as ft, link as g, hrefFor as h, makeSleep as i, Git as it, makeIndexRecorder as j, EMBED_WATERMARK as k, DETECTION_PREFIX as l, isValidDatetime as lt, applyHeadEdits as m, scanTraceRoot as n, initRepo as nt, renderSidecar as o, commitSubject as ot, publishRows as p, frameKeyOf as pt, STATE_SCHEMA as q, Sleep as r, readFileOrNull as rt, archivedFormOf as s, checkMemory as st, mergeTailExtract as t, attemptIo as tt, accessRows as u, closesFence as ut, unlink as v, ModelClientLive as w, discriminationGate as x, SLEEP_PHASES as y, readIndexState as z };
+//# sourceMappingURL=dist-D5DlgqH2.mjs.map