mirror-mind 0.36.3 → 0.38.0

package/ts/src/hooks/agy.ts

@@ -1,45 +1,49 @@
-// Antigravity hook entries (CV21.DS7.TS2).
+// Antigravity hook entries (CV21.DS7.TS2; through the one doorman since
+// CV9.DS8.TS6).
 //
 // agy runs the plugin's `hooks.json` handlers with camelCase protojson on
 // stdin and reads JSON from stdout (`injectSteps`; a `systemMessage` step
 // nests its text, an `ephemeralMessage` is a plain string). The contracts
-// are committed bytes in CV21.DS7.US1's `evidence/` (agy 1.4.2).
+// are committed bytes in CV21.DS7.US1's `evidence/` (agy 1.4.2) and in
+// TS6's `evidence/probe-20261025.md` (agy 1.4.7).
 //
-// Two handlers:
+// Three handlers:
 //
-//   * `agy:session-start` — turn conversation logging on, the posture every
-//     runtime's session-start shares, and answer `{}`. The Operating
-//     Instructions are NOT delivered here: `rules/AGENTS.md` carries them
-//     (US1), unless TS2's live route shows otherwise — the measured
-//     fallback would add an `injectSteps` `systemMessage` in this handler.
+//   * `agy:session-start` — turn conversation logging on, turn Mirror Mode
+//     on for the conversation, and answer `{}`. The Operating Instructions
+//     are NOT delivered here: `rules/AGENTS.md` carries them (US1).
 //
-//   * `agy:pre-invocation` — inject Mirror Mode context once per user turn.
-//     `PreInvocation` fires before EVERY model call (32 times over two
-//     turns, DS12.TS3 L2), with `invocationNum` resetting to 0 at each user
-//     turn; protojson omits zero-valued fields, so an ABSENT invocationNum
-//     is 0. The generated wrapper already gates on this before Node is
-//     spawned; the gate here is defense in depth. The injection is an
-//     `ephemeralMessage` — dropped after the turn — for two reasons: the
-//     adapter re-injects per turn, so a persistent step would accumulate;
-//     and the content is identity and memory, so ephemeral is the
-//     data-minimizing choice against agy's stored trajectory.
+//   * `agy:pre-invocation` — put Mirror's context before the model once per
+//     user turn. `PreInvocation` fires before EVERY model call, with
+//     `invocationNum` resetting to 0 at each user turn; protojson omits
+//     zero-valued fields, so an ABSENT invocationNum is 0. The generated
+//     wrapper already gates on this before Node is spawned; the gate here is
+//     defense in depth. At invocation 0 the hook hands the turn to the one
+//     doorman and answers its block as ONE persistent `systemMessage` step.
 //
-// agy payloads carry no prompt or reply text (L7): there is no `--query`,
-// and the explicit Mirror form reaches the model through the skill (L4),
-// never through these hooks. The quiet session — a `conversationId` no
-// runtime session binds (every session until TS3 lands), or one bound with
-// Mirror Mode off — answers `{}`: Mirror on agy is invisible until invoked.
+//   * `agy:stop` — log the turns from the transcript (agy has no SessionEnd).
 //
-// Payload fields stay inert: `conversationId` flows only through array
-// argv, never a shell, and failures recorded in hooks.log are facts, never
-// payload text.
+// Where the prompt comes from. On agy 1.4.2 no payload carried the user's
+// text (DS12.TS3 L7), so this hook could only re-inject the whole folder on
+// every turn, routed from nothing. agy 1.4.7 carries it in every payload, as
+// `lastUserInput`, verbatim -- a skill turn in its slash form (TS6's probe) --
+// so the hook reads the prompt from the payload and never from a transcript.
+// A payload without it (agy before 1.4.7) keeps the pre-TS6 injection,
+// unchanged: Navigator decision (b), 2026-10-25, removable when the runtime
+// matrix's floor for agy reaches 1.4.7.
+//
+// Payload fields stay inert: `conversationId` and the prompt flow only
+// through array argv, never a shell, and failures recorded in hooks.log are
+// facts, never payload text.
 
 import { readAgyTurns } from "#conversation/agyTranscript.ts";
 import { isCommandTurn } from "#conversation/commandTurn.ts";
 import { logAssistantMessage, logUserMessage } from "#conversation/logger.ts";
 import { resolveDbPath } from "#frontDoor/dbPath.ts";
 import { openLiveWriteDatabase } from "#frontDoor/liveBackup.ts";
+import { forgetDoormanDelivery } from "#mirror/doorman.ts";
 import { decodeMetadata, getRuntimeSession, upsertRuntimeSession } from "#mirror/runtimeSession.ts";
+import { activateOperatingMode } from "#mode/operatingMode.ts";
 import { newId, nowIso } from "#util/pyGenerators.ts";
 import { readMirrorState } from "./mirrorState.ts";
 import { noteHookFailure, runFrontDoor, runFrontDoorQuietly } from "./runtime.ts";
@@ -51,8 +55,21 @@ interface AgyPayload {
   readonly conversationId: string;
   readonly invocationNum: number;
   readonly transcriptPath: string;
+  /**
+   * The turn's prompt, verbatim (agy 1.4.7, every payload), or null: absent
+   * before 1.4.7, and protojson omits an empty string, so absent and empty
+   * are one case.
+   */
+  readonly lastUserInput: string | null;
 }
 
+const EMPTY_PAYLOAD: AgyPayload = {
+  conversationId: "",
+  invocationNum: 0,
+  transcriptPath: "",
+  lastUserInput: null,
+};
+
 /** The key under which the Stop handler stores its high-water step_index. */
 const HIGH_WATER_KEY = "agy_last_step_index";
 
@@ -63,35 +80,45 @@ const HIGH_WATER_KEY = "agy_last_step_index";
 export function parseAgyPayload(stdin: string): AgyPayload {
   try {
     const raw: unknown = JSON.parse(stdin);
-    if (typeof raw !== "object" || raw === null) {
-      return { conversationId: "", invocationNum: 0, transcriptPath: "" };
-    }
+    if (typeof raw !== "object" || raw === null) return EMPTY_PAYLOAD;
     const record = raw as Record<string, unknown>;
     return {
       conversationId: typeof record.conversationId === "string" ? record.conversationId : "",
       // protojson omits zero-valued fields: absent IS 0.
       invocationNum: typeof record.invocationNum === "number" ? record.invocationNum : 0,
       transcriptPath: typeof record.transcriptPath === "string" ? record.transcriptPath : "",
+      lastUserInput:
+        typeof record.lastUserInput === "string" && record.lastUserInput.trim()
+          ? record.lastUserInput
+          : null,
     };
   } catch {
-    return { conversationId: "", invocationNum: 0, transcriptPath: "" };
+    return EMPTY_PAYLOAD;
   }
 }
 
 /**
- * `SessionStart`: logging on, activate Mirror Mode for the session, answer
- * the contract.
+ * `SessionStart`: logging on, turn Mirror Mode on for the conversation,
+ * answer the contract.
+ *
+ * Mirror Mode activation (CV21.DS7.US4 scope change). The `/mirror-mind:mm:*`
+ * skill runs `mirror load` as an agent command that cannot name the agy
+ * session, and on agy 1.4.2 no hook carried the prompt to detect the Mirror
+ * form by. So SessionStart — the one hook that carries the `conversationId`
+ * at the start of a conversation — turns Mirror Mode on, always: Gemini CLI's
+ * always-on per-turn injection, the runtime Antigravity replaces.
  *
- * Mirror Mode activation (CV21.DS7.US4 scope change). agy's `PreInvocation`
- * carries no prompt text (DS12.TS3 L7), so the injection hook cannot detect
- * the Mirror form to self-activate, and the `/mirror-mind:mm:*` skill runs
- * `mirror load` as an agent command that cannot bind the agy session id. So
- * SessionStart — the one hook that carries the `conversationId` at the start
- * of the session — sets `mirror_active`, and the per-turn `PreInvocation`
- * injection (built in TS2, gated on that flag) fires from then on. This
- * matches Gemini CLI's always-on per-turn injection, the runtime Antigravity
- * replaces; a session that never ran SessionStart stays quiet, which the
- * negative probe pins.
+ * Three writes since CV9.DS8.TS6, because the doorman reads more than the
+ * flag. `mirror_active`, as before. The session's OWN operating-mode stamp,
+ * Mirror Mode: the doorman treats a session as in Mirror Mode only while its
+ * mode says so -- its own stamp, else the global one -- so without it a new
+ * conversation would answer to whatever mode was last stamped globally, and a
+ * home last switched to Builder would leave agy silent. And the doorman's
+ * refresh (`forgetDoormanDelivery`): nothing is in this conversation's
+ * transcript yet, so its first ordinary turn is the full folder, routed from
+ * that turn's prompt, and the deltas follow. agy fires SessionStart for a new
+ * conversation, not a resumed one (TS6's probe): a resumed conversation keeps
+ * the folder its persistent steps already hold.
  */
 export async function agySessionStart(stdin: string): Promise<number> {
   await runFrontDoorQuietly("agy:session-start", ["conversation-logger", "session-start"]);
@@ -102,12 +129,15 @@ export async function agySessionStart(stdin: string): Promise<number> {
       const dbPath = resolveDbPath([], process.env);
       const db = openLiveWriteDatabase(dbPath);
       try {
+        const now = nowIso();
         upsertRuntimeSession(
           db,
           conversationId,
           { interface: "antigravity", mirrorActive: true },
-          nowIso(),
+          now,
         );
+        activateOperatingMode(db, { mode: "Mirror Mode", sessionId: conversationId }, now);
+        forgetDoormanDelivery(db, conversationId, now);
       } finally {
         db.close();
       }
@@ -190,40 +220,87 @@ export async function agyStop(stdin: string): Promise<number> {
   return 0;
 }
 
-/** `PreInvocation`: one ephemeral context step per user turn, when owed. */
+/** One step of agy's `injectSteps`: the persistent kind, or the ephemeral one. */
+type AgyStep = { systemMessage: { systemMessage: string } } | { ephemeralMessage: string };
+
+const PRE_INVOCATION = "agy:pre-invocation";
+
+/**
+ * `PreInvocation`: at a user turn's first model call, Mirror's context as ONE
+ * step, when one is owed.
+ */
 export async function agyPreInvocation(stdin: string): Promise<number> {
   const payload = parseAgyPayload(stdin);
 
   // Defense in depth behind the wrapper's shell gate: only the turn's first
-  // invocation injects; the other ~30 answer instantly.
+  // invocation injects; the others answer instantly and touch nothing.
   if (payload.invocationNum !== 0 || !payload.conversationId) {
     process.stdout.write(EMPTY);
     return 0;
   }
 
+  const step =
+    payload.lastUserInput === null
+      ? await contextWithoutPrompt(payload.conversationId)
+      : await doormanStep(payload.conversationId, payload.lastUserInput);
+  process.stdout.write(step ? `${JSON.stringify({ injectSteps: [step] })}\n` : EMPTY);
+  return 0;
+}
+
+/**
+ * The turn through the one doorman (CV9.DS8.TS6), handed over as
+ * `claudeInject` hands Claude's: in-process, through the front door, the hook
+ * deciding nothing. `mirror doorman` answers the full folder on the explicit
+ * form -- even in a conversation no SessionStart activated -- a delta on an
+ * ordinary turn in Mirror Mode, and nothing on a skill turn or outside it; the
+ * session writes, the one embedding per delta turn, and the handle discipline
+ * are its own. The hook reads no transcript: the prompt goes to the doorman
+ * and nowhere else.
+ *
+ * The block rides in a `systemMessage` step, which agy keeps before the model
+ * on later turns; the pre-TS6 `ephemeralMessage` would drop the folder after
+ * this one, and every delta stands on the folder still being there. Ephemeral
+ * never kept identity off disk either: agy writes the step into the stored
+ * transcript all the same (TS6's probe, TS2's observation).
+ */
+async function doormanStep(conversationId: string, prompt: string): Promise<AgyStep | null> {
+  // `--session-id` before `--prompt`: the route reads a flag's FIRST
+  // occurrence, so a prompt that is exactly `--session-id` stays the prompt.
+  const argv = ["mirror", "doorman", "--session-id", conversationId, "--prompt", prompt];
+  try {
+    const result = await runFrontDoor(argv);
+    if (result.code !== 0)
+      noteHookFailure(PRE_INVOCATION, `\`mirror doorman\` exited ${result.code}`);
+    return result.stdout.trim() ? { systemMessage: { systemMessage: result.stdout } } : null;
+  } catch (error) {
+    noteHookFailure(PRE_INVOCATION, error instanceof Error ? error.message : String(error));
+    return null;
+  }
+}
+
+/**
+ * agy before 1.4.7, whose payload carries no prompt: the injection this hook
+ * made before TS6, unchanged (Navigator decision (b)). The quiet session --
+ * unbound, or bound with Mirror Mode off -- gets nothing; an active one gets
+ * the whole folder with its session's persona and journey, re-injected each
+ * turn as an `ephemeralMessage`. Removable when the runtime matrix's floor
+ * for agy reaches 1.4.7.
+ */
+async function contextWithoutPrompt(conversationId: string): Promise<AgyStep | null> {
   let dbPath: string;
   try {
     dbPath = resolveDbPath([], process.env);
   } catch {
-    process.stdout.write(EMPTY);
-    return 0;
+    return null;
   }
 
-  // The quiet session: unbound, or bound with Mirror Mode off.
-  const state = readMirrorState(dbPath, payload.conversationId);
-  if (!state.active) {
-    process.stdout.write(EMPTY);
-    return 0;
-  }
+  const state = readMirrorState(dbPath, conversationId);
+  if (!state.active) return null;
 
-  const argv = ["mirror", "load", "--context-only", "--session-id", payload.conversationId];
+  const argv = ["mirror", "load", "--context-only", "--session-id", conversationId];
   if (state.persona) argv.push("--persona", state.persona);
   if (state.journey) argv.push("--journey", state.journey);
 
   const result = await runFrontDoor(argv);
-  const context = result.stdout.trim() ? result.stdout : "";
-  process.stdout.write(
-    context ? `${JSON.stringify({ injectSteps: [{ ephemeralMessage: context }] })}\n` : EMPTY,
-  );
-  return 0;
+  return result.stdout.trim() ? { ephemeralMessage: result.stdout } : null;
 }

package/ts/src/hooks/claude.ts

@@ -12,10 +12,6 @@
 // loud, and every failure is still non-fatal to the user's turn.
 
 import { runtimeReadsPromptContext } from "#conversation/runtimePolicy.ts";
-import { resolveDbPath } from "#frontDoor/dbPath.ts";
-import { openLiveWriteDatabase } from "#frontDoor/liveBackup.ts";
-import { mirrorForm } from "#mirror/mirrorForm.ts";
-import { markInjected, needsInject, readMirrorState } from "./mirrorState.ts";
 import { parseHookPayload, readStdin } from "./payload.ts";
 import {
   noteHookFailure,
@@ -108,105 +104,48 @@ export async function claudeSessionEnd(stdin: string): Promise<number> {
 }
 
 /**
- * `mirror-inject.sh`: inject identity context before the model answers.
+ * `mirror-inject.sh`: put Mirror's context before the model, by the one
+ * doorman (CV9.DS8.US4).
  *
- * Two cases, exactly as the shell had them:
+ * Until US4 this hook carried a policy of its own -- the explicit Mirror form
+ * loaded the folder; a session in Mirror Mode was loaded once more and marked
+ * `hook_injected` -- and neither block carried the line the `mm-mirror` skill
+ * reads (TS3), so every explicit turn loaded twice, and once the one injection
+ * was spent a follow-up in another domain re-routed nothing (CR165).
  *
- *   1. an explicit Mirror form -- `/mm:mirror [query]`, or the same skill in
- *      any runtime's spelling (`#mirror/mirrorForm.ts`; CV21.DS2.US7) -- load context
- *      for that query;
- *   2. Mirror Mode already active for this session with context not yet
- *      injected -- load it with the session's persona and journey, then mark
- *      it injected so it happens once.
+ * Now the hook decides nothing. It hands the prompt and the session to
+ * `mirror doorman` (TS2), in-process through the front door, and writes back
+ * what it delivers: the full folder on the explicit form, opened by the
+ * delivered line; a delta -- the newly routed persona, the memories and
+ * attachments for this prompt -- on an ordinary turn while the session is in
+ * Mirror Mode; nothing otherwise. The session writes, the one embedding per
+ * delta turn, the memory-score log, and the handle discipline (a quiet turn
+ * opens no writable handle) are the doorman's. The Pi extension reaches the
+ * same route (US5).
  *
- * `--context-only` matters in both: it loads context WITHOUT starting a
- * conversation session, because the model does that. A hook that silently
- * opened conversations would fork every session in two.
+ * Two things from before are kept on purpose. CR143: on a runtime that
+ * discards what this hook returns (Grok), return before any load. CR100: a
+ * payload with no session id is reported on stderr rather than passed over in
+ * silence -- it is the difference between "Mirror Mode is off" and "this hook
+ * is misconfigured" -- and the doorman still runs, so an explicit turn delivers
+ * its folder unnamed, as `mirror doorman` does without `--session-id`.
  */
 export async function claudeInject(stdin: string): Promise<number> {
   const payload = parseHookPayload(stdin);
-  // CR143: on a runtime that discards what this hook returns (Grok), neither
-  // case is worth its load — nor the state read below, nor the "injected"
-  // mark, which would say the model received what it did not. Detected the
-  // way the sibling hooks detect it, from the payload and the environment.
   if (!runtimeReadsPromptContext(detectHookRuntime(payload.raw))) return 0;
-  const sessionId = payload.sessionId;
-
-  // Case 1: the explicit invocation.
-  const explicit = mirrorForm(payload.prompt);
-  if (explicit) {
-    const argv = ["mirror", "load", "--context-only", "--query", explicit.query];
-    if (sessionId) argv.push("--session-id", sessionId);
-    const result = await runFrontDoor(argv);
-    if (result.stdout.trim()) process.stdout.write(result.stdout);
-    return 0;
-  }
 
-  // Case 2: active Mirror Mode owed an injection.
+  const sessionId = payload.sessionId;
   if (!sessionId) {
-    // Python's `mirror_state` warned on stderr rather than no-op'ing silently,
-    // so a hook wired without a session id is visible. Kept: it is the
-    // difference between "Mirror Mode is off" and "this hook is misconfigured".
     process.stderr.write("warning: mirror inject hook received no session_id; no state read.\n");
-    return 0;
-  }
-
-  let dbPath: string;
-  try {
-    dbPath = resolveDbPath([], process.env);
-  } catch (error) {
-    noteHookFailure("claude:inject", error instanceof Error ? error.message : String(error));
-    return 0;
   }
 
-  const state = readMirrorState(dbPath, sessionId);
-  if (!needsInject(state)) return 0;
-
-  const argv = [
-    "mirror",
-    "load",
-    "--context-only",
-    "--query",
-    payload.prompt,
-    "--session-id",
-    sessionId,
-  ];
-  if (state.persona) argv.push("--persona", state.persona);
-  if (state.journey) argv.push("--journey", state.journey);
-
-  const result = await runFrontDoor(argv);
-  if (!result.stdout.trim()) return 0;
-
-  process.stdout.write(result.stdout);
-  // Only after the context actually reached the model: the shell marked it
-  // inside `if [ -n "$CONTEXT" ]` for the same reason. Marking first would
-  // lose the injection whenever the load produced nothing.
+  const argv = ["mirror", "doorman", "--prompt", payload.prompt];
+  if (sessionId) argv.push("--session-id", sessionId);
   try {
-    // The sanctioned live-write path: a verified pre-write snapshot, same as
-    // every other routed write.
-    //
-    // Python's `mark_injected` wrote UNGATED, so this adds a `VACUUM INTO`
-    // that the old hook did not pay. Measured on a real 53 MB database:
-    // **95 ms**, once per Mirror Mode session -- only the single prompt that
-    // owes an injection reaches this line, and that turn is already loading
-    // identity and memories. The ordinary turn returns above without opening
-    // a writable handle at all (114 ms end to end, nothing written).
-    //
-    // Paying the front door's own safety contract for a real write to a real
-    // user database beat inventing a second narrowed write handle inside a
-    // deletion story. Recorded with the number so the trade is visible.
-    //
-    // This hook runs AT THE SAME TIME as `log-user-prompt`, which writes too.
-    // Until finding F21 the two snapshots collided on one fixed file and one
-    // write was lost -- in the Navigator walk, two injections in three
-    // prompts. `openLiveWriteDatabase` gives each writer its own staging
-    // snapshot, so concurrent hooks no longer race.
-    const db = openLiveWriteDatabase(dbPath);
-    try {
-      markInjected(db, sessionId, new Date().toISOString());
-    } finally {
-      db.close();
-    }
+    const result = await runFrontDoor(argv);
+    if (result.code !== 0)
+      noteHookFailure("claude:inject", `\`mirror doorman\` exited ${result.code}`);
+    if (result.stdout) process.stdout.write(result.stdout);
   } catch (error) {
     noteHookFailure("claude:inject", error instanceof Error ? error.message : String(error));
   }

package/ts/src/hooks/mirrorState.ts

@@ -1,4 +1,8 @@
-// Mirror Mode state for one runtime session, as the inject hook needs it.
+// Mirror Mode state for one runtime session, as Antigravity's PreInvocation
+// hook needs it on agy before 1.4.7, whose payload carries no prompt. The
+// Claude-family inject hook stopped reading it in CV9.DS8.US4, and agy's hook
+// stopped on 1.4.7 in CV9.DS8.TS6: both hand the turn to `mirror doorman`,
+// which reads for itself.
 //
 // The TypeScript replacement for the Python hook module `mirror_state` (144
 // lines, deleted with the core at CV22.DS10.TS5), which
@@ -11,24 +15,21 @@
 // adding two commands whose sole consumer is a hook would widen the command
 // surface this story exists to shrink.
 //
-// One Python behavior is deliberately kept, because it is a real safeguard:
-// a missing session id FAILS LOUD on stderr rather than silently answering
-// "nothing to do". A hook integration that forgets to pass one would otherwise
-// look like a user who simply has Mirror Mode off.
+// `needs_inject` and `mark_injected` -- the once-injection the inject hook
+// used to owe a Mirror Mode session -- left with US4, and the `hook_injected`
+// column they read left with US5 (migration 018).
 
-import { openDatabaseReadOnly, type WritableDatabase } from "#db/database.ts";
-import { getRuntimeSession, upsertRuntimeSession } from "#mirror/runtimeSession.ts";
+import { openDatabaseReadOnly } from "#db/database.ts";
+import { getRuntimeSession } from "#mirror/runtimeSession.ts";
 
 export interface MirrorHookState {
   readonly active: boolean;
-  readonly hookInjected: boolean;
   readonly persona: string;
   readonly journey: string;
 }
 
 const NO_STATE: MirrorHookState = {
   active: false,
-  hookInjected: false,
   persona: "",
   journey: "",
 };
@@ -47,7 +48,6 @@ export function readMirrorState(dbPath: string, sessionId: string): MirrorHookSt
     if (!session) return NO_STATE;
     return {
       active: session.mirrorActive,
-      hookInjected: session.hookInjected,
       persona: session.persona ?? "",
       journey: session.journey ?? "",
     };
@@ -57,15 +57,3 @@ export function readMirrorState(dbPath: string, sessionId: string): MirrorHookSt
     db.close();
   }
 }
-
-/** Python `needs_inject`: Mirror Mode is on and context has not been injected. */
-export function needsInject(state: MirrorHookState): boolean {
-  return state.active && !state.hookInjected;
-}
-
-/** Python `mark_injected`, over an already-open writable connection. */
-export function markInjected(db: WritableDatabase, sessionId: string, nowIso: string): void {
-  if (!sessionId) return;
-  if (!getRuntimeSession(db, sessionId)) return;
-  upsertRuntimeSession(db, sessionId, { hookInjected: true }, nowIso);
-}

package/ts/src/mirror/context.ts

@@ -116,15 +116,19 @@ export async function relevantAttachments(
   journey: string | null,
   provider?: EmbeddingProvider,
   embeddingLedger?: (info: EmbeddingAttemptInfo) => void,
+  /**
+   * The query's embedding, already generated (CV9.DS8.TS2): the doorman embeds
+   * a turn once and shares the vector with the memory search. When given, the
+   * provider is not called and no ledger row is written here.
+   */
+  precomputedEmbedding?: readonly number[],
 ): Promise<{ row: AttachmentRow; score: number }[]> {
   const rows = attachmentRows(db, journey);
   // No attachments, no embedding: the early return is why a query against a database
   // without attachments records no spend -- there is none.
   if (rows.length === 0) return [];
-  if (!provider) throw new Error("attachment embedding replay provider is required");
-  const queryEmbedding = await generateEmbeddingSafely(provider, query, {
-    ...(embeddingLedger ? { onAttempt: embeddingLedger } : {}),
-  });
+  const queryEmbedding =
+    precomputedEmbedding ?? (await embedQuery(query, provider, embeddingLedger));
   const queryTokens = (query.match(/[\p{L}\p{N}_]+/gu) ?? [])
     .filter((token) => [...token].length >= 2 || /^\p{N}+$/u.test(token))
     .map((token) => stripAccents(token.toLowerCase()));
@@ -146,6 +150,17 @@ export async function relevantAttachments(
   return scored.slice(0, journey ? 5 : 8).filter((item) => item.score > 0.4);
 }
 
+async function embedQuery(
+  query: string,
+  provider: EmbeddingProvider | undefined,
+  embeddingLedger: ((info: EmbeddingAttemptInfo) => void) | undefined,
+): Promise<readonly number[]> {
+  if (!provider) throw new Error("attachment embedding replay provider is required");
+  return generateEmbeddingSafely(provider, query, {
+    ...(embeddingLedger ? { onAttempt: embeddingLedger } : {}),
+  });
+}
+
 function attachmentRows(db: Database, journey: string | null): AttachmentRow[] {
   const sql = journey
     ? "SELECT journey_id, name, description, content, embedding FROM attachments WHERE journey_id = ? AND embedding IS NOT NULL ORDER BY created_at"

package/ts/src/mirror/defaultResolution.ts

@@ -177,7 +177,8 @@ function descriptorMap(db: Database, layer: string): Map<string, string> {
   return new Map(descriptorsByLayer(db, layer).map((row) => [row.key, row.descriptor]));
 }
 
-function personaRoutingRows(db: Database): PersonaRoutingRow[] {
+/** Every persona's routing table, as `detectPersona` scores it. Shared with the doorman (CV9.DS8.TS2). */
+export function personaRoutingRows(db: Database): PersonaRoutingRow[] {
   return identityRoutingRows(db, "persona").map((row) => ({
     key: row.key,
     routing_keywords: routingKeywords(row.metadata),