mirror-mind 0.37.0 → 0.38.0

package/docs/releases/index.md

@@ -12,6 +12,7 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.38.0 — The Model Behind the Memories, Chosen by Measurement](v0.38.0.md) — minor release closing CV9.DS9: the model behind memories, tasks, titles, summaries, tags, reception, journal, shadow, and consolidation is Claude Haiku 5.5 at reasoning off, chosen on the eval suite with reasoning on and off and on 24 of the owner's own conversations ranked blind, where it came first on 16 of 26 surfaces. Every extraction-pin call can carry a reasoning effort, and a pin carries its own default. With CR180, summaries open with their subject, every lifecycle prompt sees the owner's name, and a framed opening is written once more. Release gate 70 of 70 probes. Rollback is one env line. No migration.
 - [v0.37.0 — The Mirror Stays in the Conversation](v0.37.0.md) — minor release closing CV9.DS8 and, with CV21.DS11, CV21: on Pi, Claude Code, Codex, and Antigravity one doorman in the core puts Mirror's context before the model on every turn of Mirror Mode, all of it on the turn Mirror Mode starts and then the persona and memories each question calls for; an explicit turn loads once; one signature, `◇ persona-name`; Pi reaches L4, measured live. One parity matrix in the runtime interface contract, sourced and held by a test. Codex, Antigravity, and Grok Build need their plugin copy brought level. Migration 018, applied on its own.
 - [v0.36.3 — A Skill You Invoke Is Not Something You Said](v0.36.3.md) — patch release of one Change Request, CR160, with CR159's docs: on Pi, a skill picked from the menu or typed is no longer stored as the person's words, and neither is its reply; a question asked with `/mm-mirror` is stored as the question. Pi's turns go through the rule the other runtimes have. `mirror conversations skill-turns` repairs what earlier versions stored, only on `--apply` and after a verified backup. No migration.
 - [v0.36.2 — Clearing Out What Another Home Copied](v0.36.2.md) — patch release of one Change Request, CR154, finishing what v0.36.1 began: `mirror conversations imported` lists the Pi conversations an earlier version imported, by the folder each session came from and beside how many sessions the home logged live there, and `remove` deletes the ones you name, only on `--apply` and after a verified backup. `discard-current` no longer fails on a conversation a Soul Mode integration names. No migration.

package/docs/releases/v0.38.0.md

@@ -0,0 +1,215 @@
+---
+digest: >
+  v0.38.0 is a minor release closing CV9.DS9. The model that writes your memories,
+  tasks, titles, summaries, and tags is now Claude Haiku 5.5 at reasoning off, chosen by
+  measurement: on the eval suite with reasoning on and off, and on 24 of the owner's own
+  conversations ranked blind, where it came first on 16 of 26 surfaces. Every call on
+  the extraction pin can carry a reasoning effort, and a pin carries its own default. The
+  summary prompt stops naming the conversation, every lifecycle prompt finally sees the
+  owner's name, and a summary that still opens by describing the conversation is
+  written once more. The release gate ran 70 of 70 probes clean. Rollback is one line.
+---
+
+# v0.38.0 — The Model Behind the Memories, Chosen by Measurement
+
+**Date:** 2026-10-29
+
+## Highlights
+
+- The model behind memory and task extraction, titles, summaries, tags, reception,
+  journal classification, week plans, descriptors, shadow, and consolidation is now
+  `anthropic/claude-haiku-5.5`, at reasoning off. It was chosen on three measurements:
+  the eval suite with reasoning on, the suite with reasoning off, and 24 of the owner's
+  own conversations replayed through the product and ranked blind, where Haiku came
+  first on 16 of 26 surfaces, ahead of Gemini 2.5 Flash Lite 17–9 and of GPT-6 Luna
+  20–6.
+- Every call on the extraction pin can carry a reasoning effort
+  (`MEMORY_EXTRACTION_REASONING`: `none` to `max`), and a pin carries its own default:
+  Haiku sends `none`, the setting it was measured with. A model named by
+  `MEMORY_EXTRACTION_MODEL` sends what it was measured with too, so the rollback is
+  exactly the request Flash Lite always got.
+- Summaries open with their subject, carrying its status, instead of "The conversation
+  centered on…"; and for the first time the title, summary, and tags prompts see the
+  owner's name rather than `User`. A summary that still opens by describing the
+  conversation is generated once more, with feedback.
+- The release gate: `eval --all` 9 of 9 modules and 70 of 70 probes, the first fully
+  clean run in the development home's history. Flash Lite had failed four probes in
+  every recorded run.
+- What you pay: about 40% more on these calls at typical volume, about a dollar a month
+  where Flash Lite cost seventy-five cents. What you wait: about half a second more on
+  reception, before a turn that then waits seconds for the answering model.
+- No migration. Rollback is one line in `~/.config/mirror/env`.
+
+## Where We Started
+
+Since mid-2025 one model, Gemini 2.5 Flash Lite, wrote everything Mirror writes about a
+conversation after it ends. It dates from mid-2025, failed the same four eval probes in
+every recorded run (duplicate memories across the two passes, a summary that reads as a
+description of a conversation, a persona routed on an open existential question, a
+trivial conversation given a title), and drew HTTP 429 from Google AI Studio on a third
+of the eval suite's attempts. Two newer models cost about the same on OpenRouter. The
+question was whether either wrote better memories for the person who reads them, and at
+what cost in latency, reliability, and money.
+
+The development guide treats a model pin as a versioned dependency and a swap as a
+migration, measured before it is decided. CV9.DS9 was that migration, in three stories.
+
+## What Changed
+
+### Reasoning off, so the candidates could be measured at all (CV9.DS9.TS1)
+
+Both candidates reason by default, and the transport sent nothing about it. Reasoning
+spent the title call's 40-token budget, so 13 of 56 candidate title calls came back cut
+off, mostly empty, and an empty title reads as a trivial conversation: silently
+untitled. The blocking title-injection probe "passed" without an answer.
+
+`MEMORY_EXTRACTION_REASONING` names an OpenRouter reasoning effort, sent as
+`reasoning.effort` on every call that runs on the extraction pin, never on `consult`,
+which picks its own model. A value that is not an effort is ignored rather than fatal,
+because the setting is read inside the session-end hooks, where a failed call is an
+extraction attempt and three quarantine a conversation; `runtime status` and
+`runtime diagnose` show it. Eval records carry the effort, and `--history` labels a
+flip across a model or reasoning change.
+
+Re-measured at `none`, seven runs each: neither candidate had a call cut off in 1,428,
+both passed every blocking probe 14 of 14, Luna kept every fix and improved two, and
+Haiku lost one, the summary's opening, accepted as measured.
+
+### The owner's own conversations, ranked blind (CV9.DS9.TS2)
+
+24 ended conversations from the owner's production home, drawn by a recorded seed, were
+replayed through the product's own functions: Flash Lite as it ships, Luna and Haiku at
+`none`, one process per model. Kimi K3.1 Pro, a model from a fourth family, ranked every
+surface blind against an anchored rubric, with the transcript fenced as data; the owner
+ranked six conversations blind to calibrate it. The judge agreed with itself (0.83) and
+not with the owner (0.55, under the 0.60 the plan required), so it did not stand, and the
+decision rested on the owner's own rankings: Haiku first on 16 of 26 surfaces. The
+judge's arithmetic, by a rule fixed before any output was seen, pointed the same way.
+Nothing was written to either home, no transcript left the owner's machine, and the
+evidence committed holds numbers and fixed labels only.
+
+### The pin moves (CV9.DS9.US3)
+
+The owner decided at the plan's approval: `anthropic/claude-haiku-5.5` at `none`.
+Against it, weighed and accepted: about 40% more cost, because Haiku's tokenizer counts
+1.5× the input tokens; reception about half a second slower at p95; and summaries
+weaker as standalone notes than Luna's, though better than Flash Lite's, a defect that
+turned out to be the prompt's.
+
+One commit changed the pin, its reasoning default, and the price table together.
+A pin's reasoning default is now a property of the model, looked up by the model the
+call names: Haiku sends `none` whether defaulted or named explicitly; Flash Lite, and any
+model not measured, sends no reasoning field. So the rollback reproduces exactly the
+request Flash Lite was measured with. `runtime status` reads
+`extraction=anthropic/claude-haiku-5.5, reasoning=none (model default)`.
+
+The gate ran as the playbook orders: a fresh `eval --all` on Flash Lite before the
+change (9 of 9 modules), then on Haiku after it (9 of 9, one expected probe failure),
+every module's prompt hash equal, `--history` labelling the flip as a model and
+reasoning change. The owner's first real conversation on the new pin came back titled,
+tagged, summarised, and priced.
+
+### The summary reads as a note (CR180)
+
+The summary prompt told the model to write "a summary of the conversation" and to
+"open with the topic the conversation addressed", then forbade writing "the
+conversation" four rules later. The positive pull won: Haiku at `none` opened "The
+conversation centered on…" in 10 of 14 eval runs with the prohibition in view, and every
+Flash Lite summary in TS2 was flagged not standalone.
+
+Three edits, each measured seven times: the first line now says who will read the
+summary and why ("on its own, months from now, by someone deciding whether the full
+transcript is worth opening"); the opening rule shows one example with its status in
+it instead of describing what to open with; the standalone rule asks for what is now
+known or decided, with the person called by name. Across 21 runs no summary named the
+conversation.
+
+The owner's validation conversation then failed anyway, and taught two more things.
+First, the title, summary, and tags prompts had never been given the owner's name: the
+close tail did not pass one, and the extraction path's resolver matched "You are
+talking to" while the shipped identity template writes "You are speaking with", so
+every lifecycle prompt since the port had labelled the speaker `User`. One fail-soft
+resolver now serves both paths, and "the user" vanished from summaries with it. Second,
+on a conversation that is itself about sessions and roadmaps, the model opens with the
+frame about half the time whatever the wording says, and a rule that names the frame
+gets echoed. So the guard is in the system: a summary whose first clause is the
+conversation, discussion, session, exchange, chat, dialogue, transcript, or user is
+generated once more with a short positive note, and the second is kept only if it
+opens clean. A blind retry recovered 2 of 5; the note recovered 5 of 5. Both calls reach
+the ledger. The owner's next conversation summarised as "<the owner's name> asked the
+mirror to explain its operating modes… Settled: … Open: …", and the ledger showed the
+guard had fired on it.
+
+## Upgrading
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind@latest
+```
+
+No migration. The pin is configuration: the first conversation that ends after the
+update is written by Claude Haiku 5.5. Your OpenRouter key needs no change; Anthropic
+models are routed by OpenRouter like the rest.
+
+Then restart your Pi sessions, or start a new session on Claude Code, Codex,
+Antigravity, or Grok Build. The plugin copies Codex, Antigravity, and Grok Build keep
+did not change in this release.
+
+**To roll back**, put this line in `${XDG_CONFIG_HOME:-~/.config}/mirror/env` (in a
+clone, its `.env`):
+
+```text
+MEMORY_EXTRACTION_MODEL=google/gemini-2.5-flash-lite
+```
+
+Then run `mirror runtime status`: the models line names Flash Lite with no reasoning
+clause, which is the request it was always sent, and its calls stay priced. Rolling back
+also brings back Flash Lite's upstream rate limits. Remove the line to return to the pin.
+Nothing in the database changes either way.
+
+## Conscious Exclusions
+
+- One pin still serves every surface. The measurement favoured Luna for summaries and
+  Haiku for everything else; a model per surface is a Change Request, not this release.
+- The ledger does not record which reasoning effort a call carried
+  ([CR181](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr181-the-ledger-cannot-say-which-reasoning-effort-a-call-carried.md));
+  after the swap, the model column tells the two regimes apart in practice.
+- No provider routing or fallback: the move retired Flash Lite's rate-limit exposure
+  for the pin, and a rolled-back install takes it back.
+- The extraction eval's prompt hash still excludes the summary prompt its probe sends
+  ([CR184](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr184-the-extraction-eval-s-prompt-hash-excludes-the-summary-prompt-its-probe-sends.md));
+  the `conversation_summary` module's hash covers it.
+- A summary may still mention "the conversation" mid-text in about one of five
+  meta-heavy conversations; the guard watches the opening, where the framing lived.
+- Summaries already stored are not rewritten.
+- Found on the way and captured, not fixed: a test that writes a synthetic consult row
+  into the developer's real home on every `npm test` (CR182), and a Builder checkpoint
+  card that once listed a record that did not exist (CR183).
+
+## What We Learned
+
+An LLM judge can agree with itself and not with the person. TS2's judge was
+self-consistent and agreed with the owner's blind rankings on 55% of pairwise orderings,
+under the bar the plan had set, so the decision was made on the owner's rankings
+instead. Calibrate a judge with the person on four to six conversations before the full
+run; learning it afterwards cost six times as much. The playbook says so now.
+
+A prompt rule that names the thing it forbids gets echoed. "Do not describe the
+conversation; record what it established" came back as "What the conversation
+established is…". The fixes that held said what to write, not what not to, and showed
+one example instead of describing. And when the content itself is about conversations,
+no wording removes the attractor; a guard in the system does, in one retry, if the retry
+says what the first sentence must do.
+
+The biggest lever on real summaries was not the prompt. It was a name the prompts had
+never been given, found because a validation on a real conversation failed after 21
+clean runs on a fixture that had no name and no meta content. A fixture measures what
+it contains.
+
+## Next Horizon
+
+CV9, Mirror Mind 1.0, continues: Boundary Hardening and the rest of Stabilization, with
+CV9.E2.S2, External Extension Runtime Surface Parity, the next pull Ariad recommends.
+On 2026-11-04 the development home's ledger is read for the pin's reception latency,
+30-day cost, and error count against the numbers the plan accepted. The Change Requests
+this release left, CR181 to CR184, wait for their triggers. When CV9's done condition
+is met, the release is `v1.0.0`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/conversation/closeTail.ts

@@ -27,6 +27,7 @@ import {
   metadataProfileAction,
   titleNeedsImprovement,
 } from "#conversation/metadataLifecycle.ts";
+import { resolveUserName } from "#conversation/userName.ts";
 import type { WritableDatabase } from "#db/database.ts";
 import type { ExtractionMessage } from "#extraction/conversation.ts";
 import {
@@ -163,7 +164,7 @@ export async function applyGeneratedMetadataLifecycle(
     ]),
   );
 
-  const suggest = buildSuggesters(conversation, messages, options);
+  const suggest = buildSuggesters(db, conversation, messages, options);
 
   let generatedTitle: string | null = null;
   let generatedSummary: string | null = null;
@@ -315,7 +316,7 @@ export async function maybeGenerateTitle(
 
   try {
     const suggestion = await generateConversationTitle(deps.llm, messages, {
-      userName: deps.userName ?? "User",
+      userName: deps.userName ?? resolveUserName(db),
       onLlmCall: (response, prompt) =>
         deps.onLlmCall?.("conversation_title", response, conversation.id, prompt),
     });
@@ -375,11 +376,14 @@ export function createCloseHooks(
 }
 
 function buildSuggesters(
+  db: WritableDatabase,
   conversation: ConversationRow,
   messages: ExtractionMessage[],
   deps: CloseTailDeps,
 ) {
-  const userName = deps.userName ?? "User";
+  // CR180: the owner's name from the database unless the caller passed one, so the
+  // transcript these prompts see is labelled as the extraction path labels it.
+  const userName = deps.userName ?? resolveUserName(db);
   const record = (role: string) => (response: LlmResponse, prompt: string) =>
     deps.onLlmCall?.(role, response, conversation.id, prompt);
 

package/ts/src/conversation/extraction.ts

@@ -1,4 +1,5 @@
 import { metadataDict } from "#conversation/closeTail.ts";
+import { resolveUserName } from "#conversation/userName.ts";
 import type { WritableDatabase } from "#db/database.ts";
 import { embeddingToBytes } from "#db/decode.ts";
 import { optionalString, requireString } from "#db/rowDecode.ts";
@@ -273,17 +274,6 @@ function getMessages(db: WritableDatabase, conversationId: string): ExtractionMe
     .map((row) => ({ role: requireString(row, "role"), content: requireString(row, "content") }));
 }
 
-function resolveUserName(db: WritableDatabase): string {
-  const row = db
-    .prepare("SELECT content FROM identity WHERE layer = ? AND key = ? LIMIT 1")
-    .get("user", "identity");
-  const content = row ? optionalString(row, "content") : null;
-  const match = content?.match(
-    /(?:You are talking to|Você está falando com) ([A-Z][a-zA-Záéíóúãõ]+)/,
-  );
-  return match?.[1] ?? "User";
-}
-
 /**
  * The close tail's two ledger hooks. Roles match Python's `build_llm_logger`
  * roles so the `llm_calls` ledger agrees across engines; the orchestration's

package/ts/src/conversation/userName.ts

@@ -0,0 +1,44 @@
+// The owner's first name for the prompts the conversation lifecycle sends: memory
+// and task extraction, and the close tail's title, summary, and tags (CR180).
+//
+// Ported from Python's `conversation.py` resolver, which matched only "You are
+// talking to" and "Você está falando com". The shipped identity template writes
+// "You are speaking with {{user_name}}", so against a seeded identity the port
+// matched nothing and every prompt labelled the speaker `**User:**`, silently
+// (CR014's finding, confirmed on the development home 2026-10-28). The template's
+// phrasing is accepted here. The cultivation path keeps its own resolver
+// (`cultivation/promptContext.ts`, fallback "the user"); unifying them is CR014's.
+
+import type { Database } from "#db/database.ts";
+import { optionalString } from "#db/rowDecode.ts";
+
+/** Python's fallback when the row or the marker phrase is absent. */
+export const FALLBACK_USER_NAME = "User";
+
+/** One name token: Unicode letters, so an accented first name is whole (a plain `\w` stops at the accent). */
+const MARKER =
+  /(?:You are (?:talking to|speaking with)|Você está (?:falando com|conversando com)) (\p{Lu}[\p{L}]*)/u;
+
+/** The first name after the identity's marker phrase, or the fallback. */
+export function userNameFromIdentity(content: string | null | undefined): string {
+  const match = content?.match(MARKER);
+  return match?.[1] ?? FALLBACK_USER_NAME;
+}
+
+/**
+ * Read `user/identity` and resolve the name; the fallback when the row is absent.
+ * Fail-soft: a database without the table, or a read that throws, is the fallback
+ * too. The close tail runs inside the session-end hooks, where a throw becomes an
+ * extraction attempt and three attempts quarantine a conversation (CR178); a name
+ * is never worth that.
+ */
+export function resolveUserName(db: Database): string {
+  try {
+    const row = db
+      .prepare("SELECT content FROM identity WHERE layer = ? AND key = ? LIMIT 1")
+      .get("user", "identity");
+    return userNameFromIdentity(row ? optionalString(row, "content") : null);
+  } catch {
+    return FALLBACK_USER_NAME;
+  }
+}

package/ts/src/extraction/conversationMetadata.ts

@@ -188,6 +188,40 @@ function pythonStr(value: unknown): string {
  * Generate a 3-4 sentence summary. Returns "" on empty messages, provider
  * failure, or trivial conversation.
  */
+/**
+ * The opening the summary prompt forbids, as a model writes it (CR180): a first
+ * clause whose subject is the conversation itself rather than its content. One
+ * adjective is allowed between the article and the noun ("The Mirror conversation").
+ */
+const CONVERSATION_FRAME =
+  /^\s*(?:the|this)\s+(?:[\p{L}\d.]+\s+)?(?:conversation|discussion|session|exchange|chat|dialogue|transcript|user)\b/iu;
+
+/**
+ * Appended to the prompt for the one regeneration (CR180): what the first sentence
+ * must do, said positively. It never quotes the frame it is replacing, because a
+ * quoted phrase comes back as the phrase.
+ */
+export const SUMMARY_RETRY_NOTE = `
+
+Rewrite the summary. Its first sentence states the matter itself with its status, or begins with the person's name and what they decided or asked. Nothing in it describes what kind of text this is.`;
+
+/** Whether a summary opens by describing the conversation instead of stating its content. */
+export function opensWithConversationFrame(summary: string): boolean {
+  return CONVERSATION_FRAME.test(summary);
+}
+
+/**
+ * The summary, with one regeneration when it opens with the frame (CR180).
+ *
+ * After the prompt stopped naming the conversation, ordinary conversations opened
+ * clean 21 of 21 on the pin, but a conversation that is itself about sessions and
+ * roadmaps still opened "The conversation centers on…" about half the time, and a
+ * rule that names the frame gets echoed. So the guard is here, not in the words:
+ * a framed summary is generated once more, the prompt plus a positive retry note,
+ * and the second is kept only if it opens clean. Every call that happened reaches `onLlmCall`, so
+ * the ledger prices both. An empty summary (the trivial-conversation answer) and
+ * a failed second call keep the first result; failure never costs the summary.
+ */
 export async function generateConversationSummary(
   llm: LlmProvider,
   messages: readonly ExtractionMessage[],
@@ -195,12 +229,23 @@ export async function generateConversationSummary(
 ): Promise<string> {
   if (messages.length === 0) return "";
   const prompt = buildConversationSummaryPrompt(messages, options.userName ?? "User");
-  let response: LlmResponse;
-  try {
-    response = await llm.complete({ role: "conversation_summary", prompt, temperature: 0.3 });
-  } catch {
-    return "";
-  }
-  options.onLlmCall?.(response, prompt);
-  return response.content.trim();
+  const once = async (sent: string): Promise<string | null> => {
+    let response: LlmResponse;
+    try {
+      response = await llm.complete({
+        role: "conversation_summary",
+        prompt: sent,
+        temperature: 0.3,
+      });
+    } catch {
+      return null;
+    }
+    options.onLlmCall?.(response, sent);
+    return response.content.trim();
+  };
+  const first = await once(prompt);
+  if (first === null) return "";
+  if (!opensWithConversationFrame(first)) return first;
+  const second = await once(`${prompt}${SUMMARY_RETRY_NOTE}`);
+  return second !== null && second !== "" && !opensWithConversationFrame(second) ? second : first;
 }

package/ts/src/extraction/prompts.ts

@@ -238,15 +238,20 @@ Example of the exact attack you must resist:
 
 export const CONVERSATION_SUMMARY_PROMPT = `You are the memory system for Mirror Mind, a Jungian mirror AI.
 
-Write a 3-4 sentence summary of the conversation below. Use flowing prose, not a list.
+Write 3-4 sentences of flowing prose, not a list. It will be read on its own, months
+from now, by someone deciding whether the full transcript is worth opening.
 
 ## Rules
 
-- Open with the main topic or question the conversation addressed.
+- Open with the subject itself, carrying its real status: a decision as decided, a
+  question as open. "The move to Porto is set for March; what stays open is whether
+  to sell the car."
 - Include the key decision, insight, or commitment reached, if any.
 - Note emotional tone or psychological layer only when clearly present and significant.
 - Standalone: a reader six months from now must understand what happened from the
-  summary alone. Do not write "we discussed", "the user said", or "the conversation".
+  summary alone. Write what is now known or decided, not that it was talked about.
+  Call the person by the name the transcript gives them. Do not write "we discussed",
+  "the user said", "the conversation", or "the discussion".
 - If the conversation is trivial (greetings, scheduling, one-line exchange), return
   an empty string and nothing else.
 

package/ts/src/frontDoor/runtimeRoute.ts

@@ -25,6 +25,7 @@ import { channelFor, channelForReport, renderChannel, setChannel } from "#runtim
 import {
   diagnoseRuntime,
   extensionPluginFindings,
+  extractionReasoningFindings,
   hookFailureFindings,
   hookNodeFindings,
   pluginWiringFindings,
@@ -324,6 +325,9 @@ export async function runRuntimeReadRoute(
       // skip; and hooks.log holds what the hooks met in their own context.
       // All three are invisible without being asked for.
       ...staleRevertGateFindings(env),
+      // CV9.DS9.TS1: a reasoning setting the transport ignores rather than fail
+      // on (CR178) is silently not in force unless diagnose says so.
+      ...extractionReasoningFindings(env),
       ...hookFailureFindings(report),
       ...hookNodeFindings(env, (path) => {
         try {

package/ts/src/providers/config.ts

@@ -18,7 +18,14 @@ const ARG_SECRET_PATTERN =
 // Model pins (AI-06, CV9.E2.S12): a deprecated pinned model would fail every
 // extraction/embedding call, and those paths fail soft -- so the pins must be
 // env-overridable to repoint a deployed instance without a release.
-export const DEFAULT_EXTRACTION_MODEL = "google/gemini-2.5-flash-lite";
+//
+// The extraction pin moved from `google/gemini-2.5-flash-lite` to Claude Haiku 5.5
+// on 2026-10-28 (CV9.DS9.US3), on DS9's measurement: the Navigator's own blind
+// rankings on his conversations, the suite at reasoning off, and Flash Lite's
+// upstream rate limits. A pin change is a migration: the pin, its entry in
+// MODEL_DEFAULT_REASONING, and MODEL_PRICES (cost.ts) move in one commit, behind
+// a green `eval --all` (the development guide's model upgrade playbook).
+export const DEFAULT_EXTRACTION_MODEL = "anthropic/claude-haiku-5.5";
 export const DEFAULT_EMBEDDING_MODEL = "openai/text-embedding-3-small";
 
 export interface ModelPinOptions {
@@ -51,6 +58,103 @@ export function resolveEmbeddingModel(options: ModelPinOptions = {}): string {
   return env.MEMORY_EMBEDDING_MODEL ?? DEFAULT_EMBEDDING_MODEL;
 }
 
+/**
+ * The reasoning efforts OpenRouter's catalogue lists across its models (checked
+ * 2026-10-26, CV9.DS9.TS1). `none` turns reasoning off. Whether a given model
+ * honours a given effort is the operator's choice; this list is the vocabulary.
+ */
+export const REASONING_EFFORTS = [
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+] as const;
+
+export type ReasoningEffort = (typeof REASONING_EFFORTS)[number];
+
+/** What `MEMORY_EXTRACTION_REASONING` says: an effort to send, or a value that is not one. */
+export interface ExtractionReasoning {
+  /** The effort to send as `reasoning.effort`, or null to send no reasoning field. */
+  effort: ReasoningEffort | null;
+  /** The value as written when it is not an effort; null otherwise. */
+  invalid: string | null;
+}
+
+/**
+ * Read `MEMORY_EXTRACTION_REASONING` (CV9.DS9.TS1): the reasoning effort every
+ * extraction-family call sends. Absent or blank sends nothing, which is the request
+ * as it was before the setting existed.
+ *
+ * Unlike the numeric resolvers below, this never throws. They fail loudly, but they
+ * are read inside the session-end hooks, where a throw becomes an extraction attempt
+ * and three attempts quarantine a conversation for good (CR178). So a value that is
+ * not an effort sends nothing too, and comes back as `invalid` for `runtime status`
+ * and `runtime diagnose` to show.
+ */
+export function readExtractionReasoning(options: ModelPinOptions = {}): ExtractionReasoning {
+  const env = options.env ?? process.env;
+  const raw = env.MEMORY_EXTRACTION_REASONING ?? "";
+  const value = raw.trim().toLowerCase();
+  if (value === "") return { effort: null, invalid: null };
+  const effort = REASONING_EFFORTS.find((candidate) => candidate === value);
+  return effort ? { effort, invalid: null } : { effort: null, invalid: raw.trim() };
+}
+
+/**
+ * The reasoning effort a model sends when `MEMORY_EXTRACTION_REASONING` is unset
+ * (CV9.DS9.US3). A property of the model, because what DS9 measured is: Haiku
+ * reasons by default and spent the title call's 40-token budget, so it was
+ * measured and chosen at `none`; Flash Lite was measured with no reasoning field,
+ * and a model absent from this table gets none, which is the request as it was
+ * before the setting existed. So the playbook's rollback, `MEMORY_EXTRACTION_MODEL`
+ * set to the old pin, reproduces exactly the request the old pin was measured with,
+ * and naming the default pin explicitly sends the same request as leaving it unset.
+ */
+export const MODEL_DEFAULT_REASONING: Readonly<Record<string, ReasoningEffort>> = {
+  "anthropic/claude-haiku-5.5": "none",
+};
+
+/** Where the effective effort came from: the setting, the model's default, or nowhere. */
+export type ReasoningSource = "setting" | "model_default";
+
+/** The effective pair every extraction-family call sends: the model and its effort. */
+export interface EffectiveExtractionReasoning {
+  /** The model the call names: `MEMORY_EXTRACTION_MODEL` or the default pin. */
+  model: string;
+  /** The effort to send as `reasoning.effort`, or null to send no reasoning field. */
+  effort: ReasoningEffort | null;
+  /** What decided `effort`; null when no field is sent. */
+  source: ReasoningSource | null;
+  /** `MEMORY_EXTRACTION_REASONING` as written when it is not an effort; null otherwise. */
+  invalid: string | null;
+}
+
+/**
+ * Resolve the model and the reasoning effort an extraction-family call sends
+ * (CV9.DS9.US3): the model first, then the effort: the setting when it names an
+ * effort, else the model's entry in `MODEL_DEFAULT_REASONING`, else no field. An
+ * invalid setting reads as unset, so the default pin still sends its model default;
+ * `invalid` carries the value for `runtime status` and `runtime diagnose`. The
+ * transport, the eval harness, and `runtime status` all read this one resolver.
+ */
+export function resolveExtractionReasoning(
+  options: ModelPinOptions = {},
+): EffectiveExtractionReasoning {
+  const model = resolveExtractionModel(options);
+  const setting = readExtractionReasoning(options);
+  if (setting.effort !== null) {
+    return { model, effort: setting.effort, source: "setting", invalid: null };
+  }
+  const modelDefault = MODEL_DEFAULT_REASONING[model];
+  if (modelDefault !== undefined) {
+    return { model, effort: modelDefault, source: "model_default", invalid: setting.invalid };
+  }
+  return { model, effort: null, source: null, invalid: setting.invalid };
+}
+
 // Observability (AI-09, CV9.E2.S13): mirrors Python's MEMORY_LOG_LLM_CALLS
 // resolution exactly -- off | metadata | full, default metadata (never a
 // silent full -- bodies are opt-in only). Legacy "1" maps to "full" for

package/ts/src/providers/cost.ts

@@ -29,7 +29,11 @@ export interface ModelPrice {
 
 /** Estimated OpenRouter list prices (USD / 1K tokens). Verify on every pin change. */
 export const MODEL_PRICES: Readonly<Record<string, ModelPrice>> = {
-  // Extraction pin -- google/gemini-2.5-flash-lite: ~$0.10/M in, ~$0.40/M out.
+  // Extraction pin since CV9.DS9.US3 -- anthropic/claude-haiku-5.5: $0.10/M in,
+  // $0.50/M out, read from OpenRouter's catalogue on 2026-10-28.
+  "anthropic/claude-haiku-5.5": { promptPer1k: 0.0001, completionPer1k: 0.0005 },
+  // The pin before it, kept so a rolled-back install (`MEMORY_EXTRACTION_MODEL`)
+  // keeps pricing its calls -- google/gemini-2.5-flash-lite: ~$0.10/M in, ~$0.40/M out.
   "google/gemini-2.5-flash-lite": { promptPer1k: 0.0001, completionPer1k: 0.0004 },
   // Embedding pin -- openai/text-embedding-3-small: ~$0.02/M, no completion side.
   "openai/text-embedding-3-small": { promptPer1k: 0.00002, completionPer1k: 0.0 },

package/ts/src/providers/llm.ts

@@ -4,6 +4,7 @@ import {
   type LlmTimeoutRole,
   type ProviderConfig,
   resolveExtractionModel,
+  resolveExtractionReasoning,
   resolveLlmMaxRetries,
   resolveLlmTimeoutMs,
   resolveProviderConfig,
@@ -76,6 +77,33 @@ const LLM_TIMEOUT_TIER: Readonly<Record<LlmRole, LlmTimeoutRole>> = {
   descriptor: "extraction",
 };
 
+/**
+ * Which roles carry `MEMORY_EXTRACTION_REASONING` (CV9.DS9.TS1): every role that
+ * runs on the extraction pin. `consult` picks its own model on every call, so a
+ * setting meant for the extraction pin must not reach it.
+ *
+ * A full `Record<LlmRole, boolean>` for the reason `LLM_TIMEOUT_TIER` is one: a
+ * role added to `LLM_ROLES` cannot compile without declaring it. A check against
+ * `"consult"` would let the next role that names its own model inherit the
+ * setting silently.
+ */
+export const CARRIES_EXTRACTION_REASONING: Readonly<Record<LlmRole, boolean>> = {
+  extraction: true,
+  task_extraction: true,
+  summary: true,
+  curation: true,
+  consult: false,
+  reception: true,
+  consolidation: true,
+  shadow_scan: true,
+  conversation_title: true,
+  conversation_tags: true,
+  conversation_summary: true,
+  journal_classification: true,
+  week_plan: true,
+  descriptor: true,
+};
+
 /**
  * The roles a message in Python's envelope can carry.
  *
@@ -273,6 +301,16 @@ export class LiveLlmProvider implements LlmProvider {
   async complete(request: LlmRequest): Promise<LlmResponse> {
     const client = this.resolveClient();
     const model = request.model ?? resolveExtractionModel({ env: this.env });
+    // CV9.DS9.TS1: the one added field; US3: the setting, else the model's own
+    // default (Haiku sends `none`; a model outside the table sends nothing). An
+    // invalid value reads as unset, so it fails nothing (a failed call would
+    // become an extraction attempt, CR178); `runtime status` and `diagnose`
+    // report it.
+    const { effort } = resolveExtractionReasoning({ env: this.env });
+    const reasoning =
+      effort !== null && CARRIES_EXTRACTION_REASONING[request.role]
+        ? { reasoning: { effort } }
+        : {};
     const startedAt = Date.now();
     const body = await client.postJson(
       "/chat/completions",
@@ -286,6 +324,8 @@ export class LiveLlmProvider implements LlmProvider {
           : [{ role: "user", content: request.prompt }],
         temperature: request.temperature ?? DEFAULT_TEMPERATURE,
         max_tokens: request.maxTokens ?? DEFAULT_MAX_TOKENS,
+        // Unset, this adds nothing: the body is the one it was before the setting.
+        ...reasoning,
       },
       {
         timeoutMs: resolveLlmTimeoutMs(LLM_TIMEOUT_TIER[request.role], { env: this.env }),

package/ts/src/runtime/diagnose.ts

@@ -34,6 +34,7 @@ import {
   readExtensionPlugin,
 } from "#extensions/extensionPlugin.ts";
 import { identityKeyBreaksGrammar, SLUG_KEYED_LAYERS } from "#identity/identityKey.ts";
+import { REASONING_EFFORTS, resolveExtractionReasoning } from "#providers/config.ts";
 import { pyRepr, sortByCodePoint } from "#util/pythonText.ts";
 import { configFilePath } from "./config.ts";
 import { extensionPluginStates } from "./extensionPluginWiring.ts";
@@ -771,6 +772,37 @@ export function staleRevertGateFindings(env: NodeJS.ProcessEnv): DriftFinding[]
   ];
 }
 
+/**
+ * A `MEMORY_EXTRACTION_REASONING` that is not a reasoning effort (CV9.DS9.TS1).
+ *
+ * The transport reads it as unset rather than fail the call -- a failed call is
+ * an extraction attempt, and three quarantine a conversation for good (CR178) --
+ * so the setting is silently not in force: the calls send the model's own default
+ * effort (CV9.DS9.US3), or no reasoning field for a model without one. Diagnose
+ * says which, with the values that would be in force.
+ */
+export function extractionReasoningFindings(env: NodeJS.ProcessEnv): DriftFinding[] {
+  const { model, effort, invalid } = resolveExtractionReasoning({ env });
+  if (invalid === null) return [];
+  const sent = effort === null ? "no reasoning setting" : `${model}'s own default, ${effort}`;
+  return [
+    {
+      code: "extraction_reasoning_invalid",
+      severity: "attention",
+      subject: "MEMORY_EXTRACTION_REASONING",
+      detail: `"${invalid}" is not a reasoning effort, so extraction calls send ${sent}`,
+      recommendation:
+        `set it to ${formatEffortList()}, or unset it, where it is set: ` +
+        "the environment, the clone's .env, or ~/.config/mirror/env",
+      repair_route: "edit the setting",
+    },
+  ];
+}
+
+function formatEffortList(): string {
+  return `${REASONING_EFFORTS.slice(0, -1).join(", ")}, or ${REASONING_EFFORTS.at(-1)}`;
+}
+
 /**
  * Where a hook wrapper looks for Node after `MIRROR_NODE` and `PATH`, in order.
  * The generated wrappers carry the same list (`for candidate in ...`), and

package/ts/src/runtime/status.ts

@@ -25,7 +25,7 @@ import { readExtensionPlugin } from "#extensions/extensionPlugin.ts";
 import { loadExtensionManifest } from "#extensions/manifest.ts";
 import { inspectMigrationFiles } from "#extensions/migrations.ts";
 import { type DbPathEnv, dbNameForEnv, resolveMirrorHome } from "#frontDoor/dbPath.ts";
-import { DEFAULT_EMBEDDING_MODEL, DEFAULT_EXTRACTION_MODEL } from "#providers/config.ts";
+import { DEFAULT_EMBEDDING_MODEL, resolveExtractionReasoning } from "#providers/config.ts";
 import { sortByCodePoint } from "#util/pythonText.ts";
 import { channelForReport } from "./channel.ts";
 import type { MarkerValue } from "./git.ts";
@@ -529,6 +529,24 @@ function intEnv(raw: string | undefined, fallback: number): number {
   return Number.isNaN(parsed) ? fallback : parsed;
 }
 
+/**
+ * The models line's reasoning clause (CV9.DS9.TS1, US3): the effort the calls
+ * send, marked `(model default)` when it is the model's rather than the setting's;
+ * empty when no field is sent, so a rolled-back pin's line stays byte for byte
+ * what the frozen status scenarios before US3 recorded; and an invalid setting
+ * shown, never thrown, beside the model default it falls back to.
+ */
+function reasoningClause(env: NodeJS.ProcessEnv): string {
+  const { effort, source, invalid } = resolveExtractionReasoning({ env });
+  if (effort !== null && source === "setting") return `reasoning=${effort}, `;
+  if (effort !== null) {
+    const note = invalid === null ? "model default" : `model default, invalid setting: ${invalid}`;
+    return `reasoning=${effort} (${note}), `;
+  }
+  if (invalid !== null) return `reasoning=invalid (${invalid}), `;
+  return "";
+}
+
 /** Port of `render_runtime_status`. */
 export function renderRuntimeStatus(
   report: RuntimeStatusReport,
@@ -570,7 +588,8 @@ export function renderRuntimeStatus(
       `embedding=${formatG(embedding)}, extraction=${formatG(extraction)}; retries=${retries}`,
   );
   lines.push(
-    `Models: extraction=${env.MEMORY_EXTRACTION_MODEL ?? DEFAULT_EXTRACTION_MODEL}, ` +
+    `Models: extraction=${resolveExtractionReasoning({ env }).model}, ` +
+      reasoningClause(env) +
       `embedding=${env.MEMORY_EMBEDDING_MODEL ?? DEFAULT_EMBEDDING_MODEL}`,
   );
   lines.push("");