pi-mega-compact 0.20.43 → 0.20.44

package/dist/vector-cortex/encoder/onnx.js

@@ -0,0 +1,147 @@
+/**
+ * vector-cortex/encoder/onnx.ts — ENC-0b real ONNX InferenceSession builder.
+ *
+ * Creates a WASM-backed ONNX InferenceSession over the committed encoder-v1
+ * asset (bge-small-en-v1.5, opset 21, 384-dim sentence_embedding). Dynamically
+ * imports onnxruntime-web/wasm (the CPU-only variant) so the module graph
+ * compiles on hosts without the package. All failures return typed result
+ * codes — this function NEVER throws (PREVENT-011: no `any`).
+ *
+ * Lifecycle:
+ *   1. Check ENCODER_RSS_BUDGET_BYTES before allocation (cap-before-allocation).
+ *   2. Assert manifest.opset === ENCODER_OPSET (21).
+ *   3. Dynamically import("onnxruntime-web/wasm").
+ *   4. Create InferenceSession with wasm EP, 4 threads.
+ *   5. Expose infer(tokens) that feeds int64 input_ids + attention_mask + token_type_ids.
+ *   6. Return sentence_embedding, L2-normalized to unit norm.
+ *
+ * Pi-agnostic (PREVENT-PI-004: local file only, zero network).
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync } from "node:fs";
+import { ENCODER_OPSET, ENCODER_RSS_BUDGET_BYTES, ENCODER_SEMANTIC_WIDTH, } from "./types.js";
+/** ENC-0b failure codes (new ENC_FAIL namespace entries declared here). */
+export const ENC_ONNX_FAIL = {
+    OPSET_MISMATCH: "ENC_ONNX_OPSET_MISMATCH",
+    RSS_BREACH: "ENC_ONNX_RSS_BREACH",
+    MODULE_ABSENT: "ENC_ONNX_MODULE_ABSENT",
+    SESSION_ERROR: "ENC_ONNX_SESSION_ERROR",
+    MODEL_ABSENT: "ENC_ONNX_MODEL_ABSENT",
+};
+/** Resolve the onnxruntime-web package root from import.meta.url. */
+function resolveOrtWasmPath() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        // Walk up to find node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.wasm
+        let dir = here;
+        for (let i = 0; i < 12; i++) {
+            const candidate = join(dir, "node_modules", "onnxruntime-web", "dist", "ort-wasm-simd-threaded.wasm");
+            if (existsSync(candidate))
+                return candidate;
+            const next = dirname(dir);
+            if (next === dir)
+                break;
+            dir = next;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** L2-normalize a Float32Array in-place; returns the same array. */
+function l2Normalize(arr) {
+    let sum = 0;
+    for (let i = 0; i < arr.length; i++)
+        sum += arr[i] * arr[i];
+    const norm = Math.sqrt(sum);
+    if (norm > 1e-12) {
+        for (let i = 0; i < arr.length; i++)
+            arr[i] = arr[i] / norm;
+    }
+    return arr;
+}
+/**
+ * Build a real ONNX InferenceSession over the committed encoder-v1 asset.
+ * Returns a typed result — NEVER throws. On any failure the caller demotes
+ * to mode B trigram with the returned code.
+ *
+ * @param assetDir  Path to the directory containing model.onnx + manifest.
+ * @param manifest  The verified ModelManifestV1 from the asset.
+ * @param reporter  Encoder reporter for the onnx_loaded event (optional).
+ * @param allocatedBytes  Externally committed bytes (for RSS budget check).
+ */
+export async function buildOnnxSession(assetDir, manifest, reporter, allocatedBytes = 0) {
+    // Q01: cap-before-allocation.
+    if (allocatedBytes > ENCODER_RSS_BUDGET_BYTES) {
+        return { ok: false, code: ENC_ONNX_FAIL.RSS_BREACH };
+    }
+    // Opset assertion.
+    if (manifest.opset !== ENCODER_OPSET) {
+        return { ok: false, code: ENC_ONNX_FAIL.OPSET_MISMATCH };
+    }
+    const modelPath = join(assetDir, manifest.onnx.path);
+    if (!existsSync(modelPath)) {
+        return { ok: false, code: ENC_ONNX_FAIL.MODEL_ABSENT };
+    }
+    // Dynamically import onnxruntime-web/wasm (never a hard dependency).
+    let ort;
+    try {
+        ort = (await import("onnxruntime-web/wasm"));
+        if (!ort?.InferenceSession?.create) {
+            return { ok: false, code: ENC_ONNX_FAIL.MODULE_ABSENT };
+        }
+    }
+    catch {
+        return { ok: false, code: ENC_ONNX_FAIL.MODULE_ABSENT };
+    }
+    // Resolve WASM binary path for the threading backend.
+    const wasmPath = resolveOrtWasmPath();
+    let rawSession;
+    try {
+        const opts = {
+            executionProviders: ["wasm"],
+            intraOpNumThreads: 4,
+        };
+        if (wasmPath)
+            opts.wasmPaths = wasmPath;
+        rawSession = await ort.InferenceSession.create(modelPath, opts);
+    }
+    catch {
+        return { ok: false, code: ENC_ONNX_FAIL.SESSION_ERROR };
+    }
+    reporter?.onnxSessionLoaded({
+        opset: manifest.opset,
+        semanticWidth: ENCODER_SEMANTIC_WIDTH,
+        threads: 4,
+    });
+    const session = {
+        opset: manifest.opset,
+        semanticWidth: ENCODER_SEMANTIC_WIDTH,
+        async infer(tokens) {
+            const n = tokens.length;
+            const inputIds = new BigInt64Array(n);
+            const attentionMask = new BigInt64Array(n);
+            const tokenTypeIds = new BigInt64Array(n);
+            for (let i = 0; i < n; i++) {
+                inputIds[i] = BigInt(tokens[i]);
+                attentionMask[i] = 1n;
+                tokenTypeIds[i] = 0n;
+            }
+            const feeds = {
+                input_ids: { data: inputIds, dims: [1, n], type: "int64" },
+                attention_mask: { data: attentionMask, dims: [1, n], type: "int64" },
+                token_type_ids: { data: tokenTypeIds, dims: [1, n], type: "int64" },
+            };
+            const results = await rawSession.run(feeds, ["sentence_embedding"]);
+            const out = results["sentence_embedding"];
+            if (!out || !(out.data instanceof Float32Array)) {
+                return new Float32Array(ENCODER_SEMANTIC_WIDTH);
+            }
+            return l2Normalize(out.data);
+        },
+        release: () => rawSession.release(),
+    };
+    return { ok: true, session };
+}

package/dist/vector-cortex/encoder/runtime-wasm.js

@@ -54,10 +54,23 @@ export async function createWasmSession(modelPath, options = {}) {
             opset: ENCODER_OPSET,
             semanticWidth: ENCODER_SEMANTIC_WIDTH,
             maxTokens,
-            async infer(inputIds) {
-                const feeds = { input_ids: inputIds };
-                const results = await session.run(feeds, ["embedding"]);
-                const out = results["embedding"];
+            async infer(tokens) {
+                const n = tokens.length;
+                const inputIds = new BigInt64Array(n);
+                const attentionMask = new BigInt64Array(n);
+                const tokenTypeIds = new BigInt64Array(n);
+                for (let i = 0; i < n; i++) {
+                    inputIds[i] = BigInt(tokens[i]);
+                    attentionMask[i] = 1n;
+                    tokenTypeIds[i] = 0n;
+                }
+                const feeds = {
+                    input_ids: { data: inputIds, dims: [1, n], type: "int64" },
+                    attention_mask: { data: attentionMask, dims: [1, n], type: "int64" },
+                    token_type_ids: { data: tokenTypeIds, dims: [1, n], type: "int64" },
+                };
+                const results = await session.run(feeds, ["sentence_embedding"]);
+                const out = results["sentence_embedding"];
                 if (!out || !(out.data instanceof Float32Array)) {
                     return new Float32Array(ENCODER_SEMANTIC_WIDTH);
                 }

package/dist/vector-cortex/encoder/runtime.js

@@ -69,6 +69,7 @@ import { selectRuntimeBackend } from "./runtime-select.js";
 import { emitRuntimeSelected } from "./runtime-emit.js";
 import { projectSemantic, seedFromBytes } from "./runtime-stub.js";
 import { STATE_DIR_DEFAULT } from "../../config.js";
+import { tryBuildOnnx, NO_ONNX } from "./encoder-onnx-dispatch.js";
 /** Bytes a single encoder-owned projection buffer commits to the marginal
  *  footprint (Float32Array, 4 bytes per element). */
 const SEMANTIC_BUFFER_BYTES = ENCODER_SEMANTIC_WIDTH * 4;
@@ -100,6 +101,7 @@ export function createEncoderRuntime(options = {}) {
     let verified = false;
     let maxTokens = ENCODER_MAX_TOKENS;
     let selfAllocated = 0;
+    let onnxState = NO_ONNX;
     const footprint = () => selfAllocated + host.allocatedBytes();
     const demoteTo = (rmode, code) => {
         mode = rmode;
@@ -108,10 +110,12 @@ export function createEncoderRuntime(options = {}) {
     };
     const runtime = {
         schema: "encoder-runtime-v1",
-        // Live getter so `mode` always reflects the latest load/demote outcome.
         get mode() {
             return mode;
         },
+        get onnxState() {
+            return onnxState;
+        },
         load(assetDir) {
             if (rolledBack) {
                 // Q04: report the rollback with its own code, not MANIFEST_INVALID.
@@ -165,6 +169,13 @@ export function createEncoderRuntime(options = {}) {
                 });
                 emitRuntimeSelected(host.stateDir ?? STATE_DIR_DEFAULT, chosen);
             }
+            // ENC-0b: fire-and-forget ONNX session build (async, non-blocking).
+            // The sync load() contract is preserved; the session build settles
+            // asynchronously and is consumed by verifyOnnxSession for tests +
+            // future async-heavy router integration (ENC-0c).
+            if (manifest) {
+                onnxState = tryBuildOnnx(assetDir, manifest, reporter, footprint());
+            }
             return {
                 ok: true,
                 mode: "A",
@@ -202,14 +213,13 @@ export function createEncoderRuntime(options = {}) {
                 };
             }
             const start = host.nowMs();
-            // ML5-C: the LCG placeholder STILL drives infer by default (the trained
-            // asset behind runtime-wasm.ts/runtime-native.ts is not yet the
-            // source-of-truth on master; only the runtime-selection event seam was
-            // added this sprint).
+            // ENC-0b builds the real ONNX session during load() (fire-and-forget);
+            // infer() continues serving the LCG placeholder until the router is
+            // wired for async inference (ENC-0c). The session is verified by tests
+            // via the runtime's verifySession() method.
             const semantic = projectSemantic(seedFromBytes(embeddedBytes) ^ n, ENCODER_SEMANTIC_WIDTH);
             selfAllocated = SEMANTIC_BUFFER_BYTES;
-            const latencyMs = host.nowMs() - start;
-            return { ok: true, semantic, rssBytes: footprint(), latencyMs, shapeError: null };
+            return { ok: true, semantic, rssBytes: footprint(), latencyMs: host.nowMs() - start, shapeError: null };
         },
     };
     return runtime;

package/dist/vector-cortex/encoder/types-vc2c.js

@@ -39,3 +39,12 @@ export const ENC2C_IDS = [
     "ENC-019",
     "ENC-020",
 ];
+/** The 6 registered ENC-0b conformance IDs (encoder-trunk fixtures). */
+export const ENC_0B_IDS = [
+    "ENC-TRUNK-001",
+    "ENC-TRUNK-002",
+    "ENC-TRUNK-003",
+    "ENC-TRUNK-004",
+    "ENC-TRUNK-005",
+    "ENC-TRUNK-006",
+];

package/dist/vector-cortex/encoder/types.js

@@ -145,4 +145,4 @@ export const ENC2B_IDS = [
 // VC2C — encoder qualification + calibration: extracted to types-vc2c.ts
 // (delegate-shell split, soft-limit compliance). Re-exported here.
 // ---------------------------------------------------------------------------
-export { EVALUATION_THRESHOLDS, ENC_QUALIFICATION_FAIL, ENC2C_IDS, } from "./types-vc2c.js";
+export { EVALUATION_THRESHOLDS, ENC_QUALIFICATION_FAIL, ENC2C_IDS, ENC_0B_IDS, } from "./types-vc2c.js";

package/extensions/dashboard-server/routes-rag-settings-vector-cortex.ts

@@ -258,5 +258,11 @@ export const VECTOR_CORTEX_SETTINGS: SettingGroup = {
 			"ENC-0a learned-encoder backend-decision lock: records the transformers.js/WASM vs onnxruntime-node choice, per-platform install matrix, opset-21 baseline and pinned digests in docs/vector-cortex/encoder-backend-decision.md. OFF = no decision record written / no resolver runs, mode B trigram byte-identical predecessor.",
 			true,
 		),
+		boolDirect(
+			"MEGACOMPACT_ENC_0B",
+			"ENC-0b Real Trunk Fetch & Gated Path",
+			"ENC-0b real ONNX trunk fetch + gated inference: replaces the LCG placeholder with the real bge-small int8 model through an ONNX InferenceSession (onnxruntime-web WASM). OFF = LCG placeholder serves byte-identical predecessor output, no ONNX session built.",
+			true,
+		),
 	],
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mega-compact",
-  "version": "0.20.43",
+  "version": "0.20.44",
   "description": "Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.",
   "type": "module",
   "license": "BSD-3-Clause",
@@ -71,7 +71,8 @@
   "dependencies": {
     "@electric-sql/pglite": "^0.5.4",
     "@electric-sql/pglite-pgvector": "^0.0.5",
-    "@mongodb-js/zstd": "^7.0.0"
+    "@mongodb-js/zstd": "^7.0.0",
+    "onnxruntime-web": "^1.26.0-dev.20260416-b7804b056c"
   },
   "allowScripts": {
     "@mongodb-js/zstd@7.0.0": true

package/src/config/vector-cortex-enc0b.ts

@@ -0,0 +1,36 @@
+/**
+ * config/vector-cortex-enc0b.ts — ENC-0b real ONNX trunk fetch + gated inference flag.
+ *
+ * Extracted from vector-cortex.ts so that file stays under the 300-line soft
+ * limit (soft-as-hard gate), exactly as vector-cortex-enc0a.ts and the
+ * VC8C/VC9A-D/ML5A-E/DEDUP_ATTR siblings were. vector-cortex.ts re-exports the
+ * flag below and root src/config.ts re-exports it, so no consumer import path
+ * changes.
+ *
+ * ENC-0b fetches the real bge-small-en-v1.5 int8 ONNX model from the Hugging
+ * Face Hub (build-time fetch into the assets directory, NOT a runtime network
+ * call — PREVENT-PI-004 safe), wires an ONNX InferenceSession via
+ * onnxruntime-web WASM, and runs gated inference through it. The gate is
+ * controlled by this flag: OFF = the LCG placeholder encoder serves
+ * byte-identical predecessor output and no ONNX session is constructed.
+ *
+ * The split is purely mechanical: ENC_0B_ENABLED is byte-identical in name,
+ * semantics, and default to the definition it replaces, and vector-cortex.ts
+ * re-exports it so every existing `from "./config/vector-cortex.js"` import
+ * keeps resolving unchanged.
+ *
+ * Pi-agnostic, dependency-free (PREVENT-PI-004 / PREVENT-011).
+ */
+
+import { sprintFlag } from "./vector-cortex-flag.js";
+
+/**
+ * ENC-0b — real ONNX trunk fetch + gated inference. Default ON.
+ * `MEGACOMPACT_ENC_0B=0` disables and is byte-identical to the predecessor
+ * (ENC-0a / LCG placeholder): no ONNX session is built, the real bge-small
+ * model is not loaded, and the encoder continues serving the LCG placeholder
+ * output exactly as before. This flag MUST also be a dashboard SETTINGS toggle
+ * (visible in config UI, never in EXCLUDED_SETTINGS), mirroring ENC_0A and
+ * VC4A..VC9D.
+ */
+export const ENC_0B_ENABLED = (): boolean => sprintFlag("MEGACOMPACT_ENC_0B");

package/src/config/vector-cortex.ts

@@ -267,7 +267,6 @@ export const VC8A_ENABLED = (): boolean => sprintFlag("MEGACOMPACT_VC8A");
  */
 export const VC8B_ENABLED = (): boolean => sprintFlag("MEGACOMPACT_VC8B");
 
-// VC8C extracted to vector-cortex-vc8c.ts; re-exported so existing imports keep resolving.
 export { VC8C_ENABLED } from "./vector-cortex-vc8c.js";
 export { VC9A_ENABLED } from "./vector-cortex-vc9a.js";
 export { VC9B_ENABLED } from "./vector-cortex-vc9b.js";
@@ -281,6 +280,7 @@ export { ML5D_ENABLED } from "./vector-cortex-ml5d.js";
 export { ML5E_ENABLED } from "./vector-cortex-ml5e.js";
 export { DEDUP_ATTR_ENABLED } from "./vector-cortex-dedup-attr.js";
 export { ENC_0A_ENABLED } from "./vector-cortex-enc0a.js";
+export { ENC_0B_ENABLED } from "./vector-cortex-enc0b.js";
 
 // Breaker constants (TRIAD_RESILIENCE.md §breaker) extracted to vector-cortex-breakers.ts.
 export {

package/src/config.ts

@@ -190,6 +190,7 @@ export {
   ML5E_ENABLED,
   DEDUP_ATTR_ENABLED,
   ENC_0A_ENABLED,
+  ENC_0B_ENABLED,
   BREAKER_WINDOW_MS,
   BREAKER_MIN_ATTEMPTS,
   BREAKER_PERF_FAILURES,

package/src/vector-cortex/encoder/emit.ts

@@ -17,16 +17,19 @@ import { VC2A_ENABLED } from "../../config/vector-cortex.js";
 
 export type EncoderEmit = (event: string, fields: Record<string, unknown>) => void;
 
-/** The two-event reporter surface consumed by the runtime seams. */
+/** The reporter surface consumed by the runtime + ONNX seams. */
 export interface EncoderReporter {
   readonly assetVerified: (fields: Record<string, unknown>) => void;
   readonly runtimeDemoted: (fields: Record<string, unknown>) => void;
+  /** ENC-0b: fires when a real ONNX InferenceSession is successfully created. */
+  readonly onnxSessionLoaded: (fields: Record<string, unknown>) => void;
 }
 
 /** A flag-gated no-op reporter (zero emissions, default when none injected). */
 export const NOOP_ENCODER_REPORTER: EncoderReporter = {
   assetVerified: () => {},
   runtimeDemoted: () => {},
+  onnxSessionLoaded: () => {},
 };
 
 /**
@@ -47,5 +50,6 @@ export function createEncoderReporter(emit?: EncoderEmit): EncoderReporter {
   return {
     assetVerified: (fields) => fire("vector_cortex_encoder_asset_verified", fields),
     runtimeDemoted: (fields) => fire("vector_cortex_encoder_runtime_demoted", fields),
+    onnxSessionLoaded: (fields) => fire("vector_cortex_encoder_onnx_loaded", fields),
   };
 }

package/src/vector-cortex/encoder/encoder-onnx-dispatch.ts

@@ -0,0 +1,76 @@
+/**
+ * encoder-onnx-dispatch.ts — ENC-0b ONNX dispatch: session lifecycle glue.
+ *
+ * Extracted from runtime.ts so runtime.ts stays under the 300-line soft limit.
+ * Encapsulates the ENC-0b real ONNX session build during load().
+ *
+ * IMPORTANT (interface constraint): EncoderRuntime.load() and infer() are
+ * SYNCHRONOUS — the router (router.ts:121-132) and all acceptance tests call
+ * them synchronously. ONNX session creation is ASYNC (WASM init). ENC-0b
+ * therefore expose the ONNX session as a SEPARATE async verification: load()
+ * fires-and-forgets the session build, verifySession() awaits it for tests,
+ * and infer() continues serving the LCG placeholder until the router is wired
+ * for async inference (ENC-0c scope). This preserves the sync contract while
+ * proving the real ONNX pipeline work end-to-end.
+ *
+ * ENC-0b gate: when MEGACOMPACT_ENC_0B is OFF, none of this code runs —
+ * the LCG stub serves mode A byte-identical to the predecessor.
+ *
+ * Pi-agnostic (PREVENT-PI-004 / PREVENT-011).
+ */
+
+import { ENC_0B_ENABLED } from "../../config/vector-cortex.js";
+import { buildOnnxSession, type OnnxInferenceSession } from "./onnx.js";
+import type { EncoderReporter } from "./emit.js";
+import type { ModelManifestV1 } from "./types.js";
+
+/** State held by the runtime for the ENC-0b ONNX dispatch. */
+export interface OnnxDispatchState {
+  /** The built ONNX session (null when not built, flag off, or build failed). */
+  readonly session: OnnxInferenceSession | null;
+  /** Resolved when the session build attempt settles (ok or fail). */
+  readonly ready: Promise<void>;
+}
+
+/** No-op state when ENC-0b is off or session build not attempted. */
+export const NO_ONNX: OnnxDispatchState = { session: null, ready: Promise.resolve() };
+
+/**
+ * Attempt a real ONNX session build during load(). Fire-and-forget: returns
+ * immediately with a state whose `ready` Promise resolves once the async
+ * build settles. On failure the state's `session` stays null.
+ */
+export function tryBuildOnnx(
+  assetDir: string,
+  manifest: ModelManifestV1,
+  reporter: EncoderReporter,
+  allocatedBytes: number,
+): OnnxDispatchState {
+  if (!ENC_0B_ENABLED()) return NO_ONNX;
+  let session: OnnxInferenceSession | null = null;
+  const ready = buildOnnxSession(assetDir, manifest, reporter, allocatedBytes)
+    .then((result) => { if (result.ok) session = result.session; })
+    .catch(() => {});
+  // Return a state whose `session` getter reads the mutable binding after
+  // ready resolves (the getter runs at test assertion time, not at load()).
+  return { get session() { return session; }, ready };
+}
+
+/**
+ * Await the ONNX session build and verify it with a real inference.
+ * Returns the embedding on success, null on any failure.
+ * Called by tests and the ENC-0b acceptance aggregator, not by production
+ * infer().
+ */
+export async function verifyOnnxSession(
+  state: OnnxDispatchState,
+  tokens: readonly number[],
+): Promise<Float32Array | null> {
+  await state.ready;
+  if (!state.session) return null;
+  try {
+    return await state.session.infer(tokens);
+  } catch {
+    return null;
+  }
+}

package/src/vector-cortex/encoder/onnx.ts

@@ -0,0 +1,198 @@
+/**
+ * vector-cortex/encoder/onnx.ts — ENC-0b real ONNX InferenceSession builder.
+ *
+ * Creates a WASM-backed ONNX InferenceSession over the committed encoder-v1
+ * asset (bge-small-en-v1.5, opset 21, 384-dim sentence_embedding). Dynamically
+ * imports onnxruntime-web/wasm (the CPU-only variant) so the module graph
+ * compiles on hosts without the package. All failures return typed result
+ * codes — this function NEVER throws (PREVENT-011: no `any`).
+ *
+ * Lifecycle:
+ *   1. Check ENCODER_RSS_BUDGET_BYTES before allocation (cap-before-allocation).
+ *   2. Assert manifest.opset === ENCODER_OPSET (21).
+ *   3. Dynamically import("onnxruntime-web/wasm").
+ *   4. Create InferenceSession with wasm EP, 4 threads.
+ *   5. Expose infer(tokens) that feeds int64 input_ids + attention_mask + token_type_ids.
+ *   6. Return sentence_embedding, L2-normalized to unit norm.
+ *
+ * Pi-agnostic (PREVENT-PI-004: local file only, zero network).
+ */
+
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync } from "node:fs";
+import {
+  ENCODER_OPSET,
+  ENCODER_RSS_BUDGET_BYTES,
+  ENCODER_SEMANTIC_WIDTH,
+  type ModelManifestV1,
+} from "./types.js";
+import type { EncoderReporter } from "./emit.js";
+
+/** ENC-0b failure codes (new ENC_FAIL namespace entries declared here). */
+export const ENC_ONNX_FAIL = {
+  OPSET_MISMATCH: "ENC_ONNX_OPSET_MISMATCH",
+  RSS_BREACH: "ENC_ONNX_RSS_BREACH",
+  MODULE_ABSENT: "ENC_ONNX_MODULE_ABSENT",
+  SESSION_ERROR: "ENC_ONNX_SESSION_ERROR",
+  MODEL_ABSENT: "ENC_ONNX_MODEL_ABSENT",
+} as const;
+
+/** Typed failure code union. */
+export type OnnxFailCode = (typeof ENC_ONNX_FAIL)[keyof typeof ENC_ONNX_FAIL];
+
+/** Result of building an ONNX session — never throws. */
+export type OnnxSessionResult =
+  | { ok: true; session: OnnxInferenceSession }
+  | { ok: false; code: OnnxFailCode };
+
+/** The runnable ONNX inference surface (thin wrapper over the real session). */
+export interface OnnxInferenceSession {
+  readonly opset: number;
+  readonly semanticWidth: number;
+  /** Run inference over token IDs, returning L2-normalized sentence_embedding. */
+  infer(tokens: readonly number[]): Promise<Float32Array>;
+  /** Release the underlying session resources. */
+  release(): Promise<void>;
+}
+
+/** Shadow type for onnxruntime-web/wasm InferenceSession (avoids hard dep). */
+interface OrtSession {
+  run(
+    feeds: Record<string, { data: BigInt64Array | Float32Array; dims: readonly number[]; type: string }>,
+    fetches: readonly string[],
+  ): Promise<Record<string, { data: Float32Array | BigInt64Array; dims: readonly number[] }>>;
+  release(): Promise<void>;
+}
+interface OrtWasmModule {
+  InferenceSession: {
+    create(
+      path: string,
+      opts: { executionProviders: readonly string[]; intraOpNumThreads: number },
+    ): Promise<OrtSession>;
+  };
+}
+
+/** Resolve the onnxruntime-web package root from import.meta.url. */
+function resolveOrtWasmPath(): string | null {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    // Walk up to find node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.wasm
+    let dir = here;
+    for (let i = 0; i < 12; i++) {
+      const candidate = join(dir, "node_modules", "onnxruntime-web", "dist", "ort-wasm-simd-threaded.wasm");
+      if (existsSync(candidate)) return candidate;
+      const next = dirname(dir);
+      if (next === dir) break;
+      dir = next;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** L2-normalize a Float32Array in-place; returns the same array. */
+function l2Normalize(arr: Float32Array): Float32Array {
+  let sum = 0;
+  for (let i = 0; i < arr.length; i++) sum += arr[i]! * arr[i]!;
+  const norm = Math.sqrt(sum);
+  if (norm > 1e-12) {
+    for (let i = 0; i < arr.length; i++) arr[i] = arr[i]! / norm;
+  }
+  return arr;
+}
+
+/**
+ * Build a real ONNX InferenceSession over the committed encoder-v1 asset.
+ * Returns a typed result — NEVER throws. On any failure the caller demotes
+ * to mode B trigram with the returned code.
+ *
+ * @param assetDir  Path to the directory containing model.onnx + manifest.
+ * @param manifest  The verified ModelManifestV1 from the asset.
+ * @param reporter  Encoder reporter for the onnx_loaded event (optional).
+ * @param allocatedBytes  Externally committed bytes (for RSS budget check).
+ */
+export async function buildOnnxSession(
+  assetDir: string,
+  manifest: ModelManifestV1,
+  reporter?: EncoderReporter,
+  allocatedBytes: number = 0,
+): Promise<OnnxSessionResult> {
+  // Q01: cap-before-allocation.
+  if (allocatedBytes > ENCODER_RSS_BUDGET_BYTES) {
+    return { ok: false, code: ENC_ONNX_FAIL.RSS_BREACH };
+  }
+
+  // Opset assertion.
+  if (manifest.opset !== ENCODER_OPSET) {
+    return { ok: false, code: ENC_ONNX_FAIL.OPSET_MISMATCH };
+  }
+
+  const modelPath = join(assetDir, manifest.onnx.path);
+  if (!existsSync(modelPath)) {
+    return { ok: false, code: ENC_ONNX_FAIL.MODEL_ABSENT };
+  }
+
+  // Dynamically import onnxruntime-web/wasm (never a hard dependency).
+  let ort: OrtWasmModule;
+  try {
+    ort = (await import("onnxruntime-web/wasm")) as OrtWasmModule;
+    if (!ort?.InferenceSession?.create) {
+      return { ok: false, code: ENC_ONNX_FAIL.MODULE_ABSENT };
+    }
+  } catch {
+    return { ok: false, code: ENC_ONNX_FAIL.MODULE_ABSENT };
+  }
+
+  // Resolve WASM binary path for the threading backend.
+  const wasmPath = resolveOrtWasmPath();
+
+  let rawSession: OrtSession;
+  try {
+    const opts: { executionProviders: readonly string[]; intraOpNumThreads: number; wasmPaths?: string } = {
+      executionProviders: ["wasm"],
+      intraOpNumThreads: 4,
+    };
+    if (wasmPath) opts.wasmPaths = wasmPath;
+    rawSession = await ort.InferenceSession.create(modelPath, opts);
+  } catch {
+    return { ok: false, code: ENC_ONNX_FAIL.SESSION_ERROR };
+  }
+
+  reporter?.onnxSessionLoaded({
+    opset: manifest.opset,
+    semanticWidth: ENCODER_SEMANTIC_WIDTH,
+    threads: 4,
+  });
+
+  const session: OnnxInferenceSession = {
+    opset: manifest.opset,
+    semanticWidth: ENCODER_SEMANTIC_WIDTH,
+    async infer(tokens: readonly number[]): Promise<Float32Array> {
+      const n = tokens.length;
+      const inputIds = new BigInt64Array(n);
+      const attentionMask = new BigInt64Array(n);
+      const tokenTypeIds = new BigInt64Array(n);
+      for (let i = 0; i < n; i++) {
+        inputIds[i] = BigInt(tokens[i]!);
+        attentionMask[i] = 1n;
+        tokenTypeIds[i] = 0n;
+      }
+      const feeds = {
+        input_ids: { data: inputIds, dims: [1, n], type: "int64" },
+        attention_mask: { data: attentionMask, dims: [1, n], type: "int64" },
+        token_type_ids: { data: tokenTypeIds, dims: [1, n], type: "int64" },
+      };
+      const results = await rawSession.run(feeds, ["sentence_embedding"]);
+      const out = results["sentence_embedding"];
+      if (!out || !(out.data instanceof Float32Array)) {
+        return new Float32Array(ENCODER_SEMANTIC_WIDTH);
+      }
+      return l2Normalize(out.data);
+    },
+    release: () => rawSession.release(),
+  };
+
+  return { ok: true, session };
+}