pi-mega-compact 0.20.8 → 0.20.10

package/dist/config/vector-cortex.js

@@ -208,6 +208,35 @@ export const VC5C_ENABLED = () => sprintFlag("MEGACOMPACT_VC5C");
  * EXCLUDED_SETTINGS), mirroring VC4A/VC4B/VC4C/VC5A/VC5B/VC5C.
  */
 export const VC6A_ENABLED = () => sprintFlag("MEGACOMPACT_VC6A");
+/**
+ * VC6B — exact source restoration. Default ON. `MEGACOMPACT_VC6B=0` disables and
+ * is byte-identical to the predecessor (VC6A): the `restoreSources` /
+ * `verifyRestored` arithmetic STILL RUNS (it is PURE — an exact-source read plus
+ * a SHA-256 comparison, with no clock, storage, or network), but the
+ * `vector_cortex_source_restored` / `vector_cortex_restore_digest_rejected`
+ * events are never emitted and the dashboard restoration diagnostics seam is
+ * suppressed. Flag OFF gates the reporter + dashboard seam, never the
+ * restore/verify arithmetic, so flag-off outbound/predecessor golden bytes match
+ * exactly. This flag MUST also be a dashboard SETTINGS toggle (visible in config
+ * UI, never in EXCLUDED_SETTINGS), mirroring VC4A/VC4B/VC4C/VC5A/VC5B/VC5C/VC6A.
+ */
+export const VC6B_ENABLED = () => sprintFlag("MEGACOMPACT_VC6B");
+/**
+ * VC6C — self-healing derived controller. Default ON. `MEGACOMPACT_VC6C=0`
+ * disables and is byte-identical to the predecessor (VC6B): the `detectGaps` /
+ * `planRebuild` / `rebuildGeneration` / `switchPointer` arithmetic STILL RUNS (it
+ * is PURE — a high-water comparison plus a SHA-256 root-digest check, with an
+ * INJECTED clock and no storage or network), but the
+ * `vector_cortex_repair_planned` / `vector_cortex_repair_pointer_switched` /
+ * `vector_cortex_repair_backoff` events are never emitted and the dashboard
+ * repair diagnostics seam is suppressed. Flag OFF gates the reporter + dashboard
+ * seam, never the gap-detection/rebuild arithmetic (in particular, an unverified
+ * pointer switch stays refused with the flag off), so flag-off
+ * outbound/predecessor golden bytes match exactly. This flag MUST also be a
+ * dashboard SETTINGS toggle (visible in config UI, never in EXCLUDED_SETTINGS),
+ * mirroring VC4A/VC4B/VC4C/VC5A/VC5B/VC5C/VC6A/VC6B.
+ */
+export const VC6C_ENABLED = () => sprintFlag("MEGACOMPACT_VC6C");
 // ---------------------------------------------------------------------------
 // Breaker state machine constants (TRIAD_RESILIENCE.md §breaker).
 // Rolled numbers for one 60s window; VC0C consumes these at its breaker seam.

package/dist/config.js

@@ -114,4 +114,4 @@ export const NEW_UI = () => ragEnabled("MEGACOMPACT_NEW_UI");
 // default ON, `=0`/`_DISABLED` off. Re-exported from src/config/vector-cortex.ts
 // so root consumers share one source of truth.
 // ---------------------------------------------------------------------------
-export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";
+export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";

package/dist/extensions/dashboard-server/route-dispatch.js

@@ -8,7 +8,10 @@
  * PREVENT-PI-004: local filesystem read only, no network.
  * PREVENT-011: no `any` type.
  */
-import { handleIndex, handleRepoIndex, handleEvents, handleGameState, handleGameScores, handlePerfSamples, handlePerf, handleAchievements, handleSessions, handleTopics, handleTurns, handleMaintenance, handleProviderCache, handleMemoryStatus, handleCacheStripes, handleSetupStatus, handleSetupDetect, handleSetupConfigure, handleMemoryMap, handleRaptorTree, handleRaptorBuildHistory, handleContextHealth, handleCachePoison, handleHealthSettings, handleEmbedderHealth, handleRagSettings, handleRagMetrics, handleModelThresholds, handleWiki, handleVectorCortexEvaluation, handleVectorCortexHealth, handleVectorCortexBreakersReset, handleVectorCortexLedger, handleVectorCortexTopology, handleVectorCortexQuery, handleVectorCortexShards, handleVectorCortexResidual, handleVectorCortexReconstruct, handleVectorCortexPlans, handleVectorCortexRender, handleVectorCortexRollout, handleVectorCortexClosureProof, } from "./routes.js";
+import { handleIndex, handleRepoIndex, handleEvents, handleGameState, handleGameScores, handlePerfSamples, handlePerf, handleAchievements, handleSessions, handleTopics, handleTurns, handleMaintenance, handleProviderCache, handleMemoryStatus, handleCacheStripes, handleSetupStatus, handleSetupDetect, handleSetupConfigure, handleMemoryMap, handleRaptorTree, handleRaptorBuildHistory, handleContextHealth, handleCachePoison, handleHealthSettings, handleEmbedderHealth, handleRagSettings, handleRagMetrics, handleModelThresholds, handleWiki, handleVectorCortexEvaluation, handleVectorCortexHealth, handleVectorCortexBreakersReset, handleVectorCortexLedger, handleVectorCortexTopology, handleVectorCortexQuery, handleVectorCortexShards, handleVectorCortexResidual, handleVectorCortexReconstruct, handleVectorCortexPlans, handleVectorCortexRender, handleVectorCortexRollout, handleVectorCortexClosureProof, handleVectorCortexRestore, } from "./routes.js";
+// VC6C repair lives in its own module (routes-vector-cortex-repair.ts) so the
+// heal route file stays well under the 400-line extension soft limit.
+import { handleVectorCortexRepair } from "./routes-vector-cortex-repair.js";
 /**
  * Dispatch a request through every registered route handler.
  * Returns true if a handler claimed the request (ended the response).
@@ -98,5 +101,9 @@ export function dispatchRoutes(req, res, ctx) {
         return true;
     if (handleVectorCortexClosureProof(req, res, ctx))
         return true;
+    if (handleVectorCortexRestore(req, res, ctx))
+        return true;
+    if (handleVectorCortexRepair(req, res, ctx))
+        return true;
     return false;
 }

package/dist/extensions/dashboard-server/routes-rag-settings-vector-cortex.js

@@ -40,5 +40,7 @@ export const VECTOR_CORTEX_SETTINGS = {
         boolDirect("MEGACOMPACT_VC5B", "VC5B Validated Renderer + Provider Profiles", "Validated prompt renderer: replays VC5A's stable Kahn order verbatim, preserves exact tool bytes (PREVENT-PI-002), places compacted context via the host before_agent_start prepend seam — never role:system (PREVENT-PI-003) — and SHA-256 hashes the entire canonical outbound request before provider invocation. Unknown provider/model cleanly bypasses to the predecessor prompt path. OFF = byte-identical predecessor (VC5A).", true),
         boolDirect("MEGACOMPACT_VC5C", "VC5C Live Graduated Rollout", "Live graduated rollout: deterministically hashes each session into a stable 10,000-bucket cohort and advances the exposure gate (1/5/25/50/100%) only after a 72h monotonic residency, a powered sample, >=10,000 events, and >=200 sessions — advancing ONE gate at a time. A hard causal/tool/anchor/exact failure freezes promotion and selects the pre-VC path. OFF = byte-identical predecessor (VC5B).", true),
         boolDirect("MEGACOMPACT_VC6A", "VC6A Advanced Closure Optimization", "Advanced closure optimization: deterministically reduces the already-mandatory VC4C closure by transitive reduction over depends edges, emitting a ClosureProofV2 receipt per closure and a verifier that replays reductions against the conservative oracle (HEAL_PROOF_SET_MISMATCH on selected-set divergence). Protected edges (tool-pair / anchor / contradiction / sole-dependency) are never removed. The optimized selected set is byte-identical to the conservative closure. OFF = byte-identical predecessor (VC5C); arithmetic runs, only the reporter + dashboard seam is suppressed.", true),
+        boolDirect("MEGACOMPACT_VC6B", "VC6B Exact Source Restoration", "Exact source restoration: restores the original bytes of closure spans ONLY from an exact shard (mode A) or a verified ledger range scan (mode B) — never inferred, reconstructed, or paraphrased from embeddings or semantic text. Requests are hard-bounded at 64 spans / 4MiB (HEAL_RESTORE_LIMIT); every span's SHA-256 is recomputed and bytes are inserted only after all requested span metadata validates, so a single bad span fails the whole request closed (HEAL_RESTORE_DIGEST_MISMATCH, HEAL_RESTORE_RANGE_MISMATCH). When no exact source exists (HEAL_RESTORE_SOURCE_MISSING) the old context is omitted and the loss is disclosed (mode C) rather than filled in. OFF = byte-identical predecessor (VC6A).", true),
+        boolDirect("MEGACOMPACT_VC6C", "VC6C Self-Healing Derived State", "Self-healing derived-state controller: detects gaps between each derived subsystem's high-water mark and the durable authority high-water, then rebuilds derived state by copy -> root-digest verification -> atomic pointer switch, so a partially rebuilt subsystem is never made visible. A targeted single-subsystem rebuild is mode A; an ambiguous gap escalates to a full deterministic rebuild (mode B); if both rebuild paths fail the derived state is disabled rather than served stale (mode C). Rebuilds are rate-limited to one per subsystem per 5 minutes with deterministic exponential backoff, so a persistently failing subsystem cannot spin. OFF = byte-identical predecessor (VC6B); no controller runs, so the dashboard reports mode C.", true),
     ],
 };

package/dist/extensions/dashboard-server/routes-vector-cortex-heal.js

@@ -1,6 +1,6 @@
 /**
- * dashboard-server/routes-vector-cortex-heal.ts — VC6A closure-optimization
- * dashboard route.
+ * dashboard-server/routes-vector-cortex-heal.ts — VC6A closure-optimization and
+ * VC6B exact-source-restoration dashboard routes.
  *
  * Reader-only GET /api/vector-cortex/closure-proof returning aggregate-only
  * closure diagnostics: whether the flag is enabled, the runtime triad mode, and
@@ -12,10 +12,14 @@
  * (the conservative VC4C closure, no reduction) — that is exactly the spec's
  * fallback rule — so `mode:"B"` + `enabled:false` is the byte-stable OFF view.
  *
+ * Reader-only GET /api/vector-cortex/restore (VC6B) returns restore COUNTS and
+ * HEAL_RESTORE_* error codes only. There is NO payload endpoint for restoration,
+ * ever — no restored bytes, span ids, node ids, byte ranges, or ledger text.
+ *
  * Guardrails: PREVENT-PI-004 (local in-process state only), PREVENT-011 (no
  * `any`), reader-only aggregate (counts + mode only).
  */
-import { VC6A_ENABLED } from "../../src/config.js";
+import { VC6A_ENABLED, VC6B_ENABLED } from "../../src/config.js";
 import { sendJson } from "./routes-vector-cortex-shared.js";
 /** Reader-only GET /api/vector-cortex/closure-proof (VC6A). */
 export function handleVectorCortexClosureProof(req, res, _ctx) {
@@ -45,3 +49,38 @@ export function handleVectorCortexClosureProof(req, res, _ctx) {
     sendJson(res, 200, body);
     return true;
 }
+/**
+ * Reader-only GET /api/vector-cortex/restore (VC6B).
+ *
+ * Counts and HEAL_RESTORE_* codes only — this is a static reader-only aggregate
+ * seam (same shape as the VC6A handler): there is no payload endpoint and never
+ * will be, so no restored bytes/span ids/node ids/ledger text can leak here.
+ */
+export function handleVectorCortexRestore(req, res, _ctx) {
+    const url = req.url ?? "";
+    const path = url.split("?")[0] ?? url;
+    if (path !== "/api/vector-cortex/restore")
+        return false;
+    if (req.method !== "GET") {
+        sendJson(res, 405, { error: "method_not_allowed" });
+        return true;
+    }
+    const enabled = VC6B_ENABLED();
+    // Flag-off routes to mode C: with VC6B off there is no exact-restoration path
+    // at all, so the honest OFF view is the disclose-loss mode (old context is
+    // omitted rather than inferred) — mirroring how VC6A's OFF view reports the
+    // conservative fallback it actually takes.
+    const mode = enabled ? "A" : "C";
+    const body = {
+        enabled,
+        mode,
+        restoreAttempts: 0,
+        restoredCount: 0,
+        missingCount: 0,
+        digestRejections: 0,
+        lastRejection: null,
+        updatedAt: new Date().toISOString(),
+    };
+    sendJson(res, 200, body);
+    return true;
+}

package/dist/extensions/dashboard-server/routes-vector-cortex-repair.js

@@ -0,0 +1,63 @@
+/**
+ * dashboard-server/routes-vector-cortex-repair.ts — VC6C self-healing
+ * derived-state dashboard route.
+ *
+ * Reader-only GET /api/vector-cortex/repair returning the self-healing
+ * controller's aggregate diagnostics: whether the flag is enabled, the runtime
+ * triad mode, cumulative rebuild/pointer-switch/backoff counters, the last
+ * deterministic backoff delay, and the last HEAL_REPAIR_* failure code.
+ *
+ * COUNTS + ERROR CODES ONLY. NEVER exposes subsystem source bytes, rebuilt
+ * derived rows, per-subsystem gap ranges, high-water marks, root digests, or
+ * ledger text (reader-only, SECURITY_PRIVACY — the per-subsystem gap detail
+ * lives in the structured event log, not the dashboard). There is no mutation
+ * seam here either: rebuilds are driven by the controller's own gap detection,
+ * never by a dashboard request, so non-GET is rejected outright.
+ *
+ * Split into its own file (rather than grown into routes-vector-cortex-heal.ts)
+ * to keep every extensions/ file well under the 400-line soft-as-hard limit.
+ *
+ * Guardrails: PREVENT-PI-004 (local in-process state only), PREVENT-011 (no
+ * `any`), reader-only aggregate (counts + codes only).
+ */
+import { VC6C_ENABLED } from "../../src/config.js";
+import { sendJson } from "./routes-vector-cortex-shared.js";
+/**
+ * Reader-only GET /api/vector-cortex/repair (VC6C).
+ *
+ * Counts and HEAL_REPAIR_* codes only — this is a static reader-only aggregate
+ * seam (same shape as the VC6A/VC6B handlers): there is no payload endpoint and
+ * never will be, so no subsystem bytes, gap ranges, high-water marks, or root
+ * digests can leak here.
+ */
+export function handleVectorCortexRepair(req, res, _ctx) {
+    const url = req.url ?? "";
+    const path = url.split("?")[0] ?? url;
+    if (path !== "/api/vector-cortex/repair")
+        return false;
+    if (req.method !== "GET") {
+        sendJson(res, 405, { error: "method_not_allowed" });
+        return true;
+    }
+    const enabled = VC6C_ENABLED();
+    // Flag-off routes to mode C: with VC6C off no self-healing controller runs at
+    // all, so neither the targeted rebuild (mode A) nor the full deterministic
+    // rebuild (mode B) path is available. Mode C is exactly the spec's "derived
+    // state disabled" outcome — the honest OFF view is that derived state is not
+    // being healed, rather than implying a rebuild path that is not wired.
+    // Mirrors how VC6B's OFF view reports the disclose-loss mode it actually takes.
+    const mode = enabled ? "A" : "C";
+    const body = {
+        enabled,
+        mode,
+        repairAttempts: 0,
+        repairsPlanned: 0,
+        pointersSwitched: 0,
+        backoffs: 0,
+        lastBackoffMs: null,
+        lastFailure: null,
+        updatedAt: new Date().toISOString(),
+    };
+    sendJson(res, 200, body);
+    return true;
+}

package/dist/extensions/dashboard-server/routes-vector-cortex.js

@@ -9,6 +9,8 @@
  *   VC0C health/reset-> routes-vector-cortex-health.ts(GET  /health, POST /breakers/reset)
  *   VC1B ledger      -> routes-vector-cortex-ledger.ts (GET  /ledger)
  *   VC3A topology    -> routes-vector-cortex-topology.ts(GET /topology)
+ *   VC6A closure     -> routes-vector-cortex-heal.ts   (GET  /closure-proof)
+ *   VC6B restore     -> routes-vector-cortex-heal.ts   (GET  /restore)
  *
  * Guardrails: PREVENT-PI-004 (local filesystem read only), PREVENT-011 (no
  * `any`), reader-only aggregates (never payloads/prompts/ledger text).
@@ -24,4 +26,4 @@ export { handleVectorCortexReconstruct } from "./routes-vector-cortex-reconstruc
 export { handleVectorCortexPlans } from "./routes-vector-cortex-plans.js";
 export { handleVectorCortexRender } from "./routes-vector-cortex-render.js";
 export { handleVectorCortexRollout } from "./routes-vector-cortex-rollout.js";
-export { handleVectorCortexClosureProof } from "./routes-vector-cortex-heal.js";
+export { handleVectorCortexClosureProof, handleVectorCortexRestore, } from "./routes-vector-cortex-heal.js";

package/dist/extensions/dashboard-server/routes.js

@@ -23,4 +23,4 @@ export { handleRagSettings } from "./routes-rag-settings.js";
 export { handleRagMetrics } from "./routes-rag-metrics.js";
 export { handleModelThresholds } from "./routes-model-thresholds.js";
 export { handleWiki } from "./routes-wiki.js";
-export { handleVectorCortexEvaluation, handleVectorCortexHealth, handleVectorCortexBreakersReset, handleVectorCortexLedger, handleVectorCortexTopology, handleVectorCortexQuery, handleVectorCortexShards, handleVectorCortexResidual, handleVectorCortexReconstruct, handleVectorCortexPlans, handleVectorCortexRender, handleVectorCortexRollout, handleVectorCortexClosureProof, } from "./routes-vector-cortex.js";
+export { handleVectorCortexEvaluation, handleVectorCortexHealth, handleVectorCortexBreakersReset, handleVectorCortexLedger, handleVectorCortexTopology, handleVectorCortexQuery, handleVectorCortexShards, handleVectorCortexResidual, handleVectorCortexReconstruct, handleVectorCortexPlans, handleVectorCortexRender, handleVectorCortexRollout, handleVectorCortexClosureProof, handleVectorCortexRestore, } from "./routes-vector-cortex.js";

package/dist/src/config/vector-cortex.js

@@ -208,6 +208,35 @@ export const VC5C_ENABLED = () => sprintFlag("MEGACOMPACT_VC5C");
  * EXCLUDED_SETTINGS), mirroring VC4A/VC4B/VC4C/VC5A/VC5B/VC5C.
  */
 export const VC6A_ENABLED = () => sprintFlag("MEGACOMPACT_VC6A");
+/**
+ * VC6B — exact source restoration. Default ON. `MEGACOMPACT_VC6B=0` disables and
+ * is byte-identical to the predecessor (VC6A): the `restoreSources` /
+ * `verifyRestored` arithmetic STILL RUNS (it is PURE — an exact-source read plus
+ * a SHA-256 comparison, with no clock, storage, or network), but the
+ * `vector_cortex_source_restored` / `vector_cortex_restore_digest_rejected`
+ * events are never emitted and the dashboard restoration diagnostics seam is
+ * suppressed. Flag OFF gates the reporter + dashboard seam, never the
+ * restore/verify arithmetic, so flag-off outbound/predecessor golden bytes match
+ * exactly. This flag MUST also be a dashboard SETTINGS toggle (visible in config
+ * UI, never in EXCLUDED_SETTINGS), mirroring VC4A/VC4B/VC4C/VC5A/VC5B/VC5C/VC6A.
+ */
+export const VC6B_ENABLED = () => sprintFlag("MEGACOMPACT_VC6B");
+/**
+ * VC6C — self-healing derived controller. Default ON. `MEGACOMPACT_VC6C=0`
+ * disables and is byte-identical to the predecessor (VC6B): the `detectGaps` /
+ * `planRebuild` / `rebuildGeneration` / `switchPointer` arithmetic STILL RUNS (it
+ * is PURE — a high-water comparison plus a SHA-256 root-digest check, with an
+ * INJECTED clock and no storage or network), but the
+ * `vector_cortex_repair_planned` / `vector_cortex_repair_pointer_switched` /
+ * `vector_cortex_repair_backoff` events are never emitted and the dashboard
+ * repair diagnostics seam is suppressed. Flag OFF gates the reporter + dashboard
+ * seam, never the gap-detection/rebuild arithmetic (in particular, an unverified
+ * pointer switch stays refused with the flag off), so flag-off
+ * outbound/predecessor golden bytes match exactly. This flag MUST also be a
+ * dashboard SETTINGS toggle (visible in config UI, never in EXCLUDED_SETTINGS),
+ * mirroring VC4A/VC4B/VC4C/VC5A/VC5B/VC5C/VC6A/VC6B.
+ */
+export const VC6C_ENABLED = () => sprintFlag("MEGACOMPACT_VC6C");
 // ---------------------------------------------------------------------------
 // Breaker state machine constants (TRIAD_RESILIENCE.md §breaker).
 // Rolled numbers for one 60s window; VC0C consumes these at its breaker seam.

package/dist/src/config.js

@@ -114,4 +114,4 @@ export const NEW_UI = () => ragEnabled("MEGACOMPACT_NEW_UI");
 // default ON, `=0`/`_DISABLED` off. Re-exported from src/config/vector-cortex.ts
 // so root consumers share one source of truth.
 // ---------------------------------------------------------------------------
-export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";
+export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";

package/dist/src/vector-cortex/heal/_repair-fixture.js

@@ -0,0 +1,70 @@
+/**
+ * heal/_repair-fixture.ts — conformance fixture I/O for VC6C healing-controller rows.
+ *
+ * Sibling of `_restore-fixture.ts` (VC6B) and `_acceptance-fixture.ts` (VC6A);
+ * split out so no loader approaches the 300-line soft limit and so the
+ * BigInt/base64 decoding lives next to the contract it reconstitutes.
+ *
+ * DECODING IS THE POINT. Fixtures are canonical JSON, which cannot express
+ * bigints or bytes, so the corpus stores numeric `nowMs` / high-waters and
+ * base64 source bytes. These loaders turn those back into the REAL `RepairState`
+ * / `RebuildInput` objects the production controller consumes — no mocks, no
+ * stubs, no parallel "test shape". A lossy decode would make the digests or the
+ * planned ranges disagree and the acceptance test would fail loudly.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import assert from "node:assert/strict";
+import { V2, readManifest } from "./_acceptance-fixture.js";
+/** Read one registered healing-controller fixture (asserting it IS registered). */
+export function repairFixture(id) {
+    const m = readManifest();
+    const row = m.fixtures.find((f) => f.id === id && f.path.startsWith("healing-controller/"));
+    assert.ok(row, `fixture ${id} registered under healing-controller/ in manifest`);
+    return JSON.parse(readFileSync(join(V2, row.path), "utf8"));
+}
+/** JSON numbers -> the bigint fields `RepairState` declares. */
+export function decodeState(s) {
+    return {
+        subsystem: s.subsystem,
+        derivedHighWater: BigInt(s.derivedHighWater),
+        authorityHighWater: BigInt(s.authorityHighWater),
+        lastRebuildAt: s.lastRebuildAt === null ? null : BigInt(s.lastRebuildAt),
+        generation: s.generation,
+        mode: s.mode,
+        ...(s.failedAttempts !== undefined ? { failedAttempts: s.failedAttempts } : {}),
+        ...(s.authorityFrozen !== undefined ? { authorityFrozen: s.authorityFrozen } : {}),
+    };
+}
+/** Reconstitute a real `RebuildInput` from its fixture row. */
+export function decodeRebuild(r) {
+    return {
+        subsystem: r.subsystem,
+        range: {
+            sessionId: r.subsystem,
+            seqStart: 0n,
+            seqEnd: 0n,
+            byteStart: 0,
+            byteEnd: 0,
+        },
+        generation: r.generation,
+        sourceBytes: new Uint8Array(Buffer.from(r.sourceBytesBase64, "base64")),
+        expectedDigest: r.expectedDigest,
+    };
+}
+/** Flag-pinned wrapper: VC6C gated by MEGACOMPACT_VC6C (defaults ON). */
+export function withVc6cFlagsOn(fn) {
+    return () => {
+        const saved = process.env.MEGACOMPACT_VC6C;
+        process.env.MEGACOMPACT_VC6C = "1";
+        try {
+            fn();
+        }
+        finally {
+            if (saved === undefined)
+                delete process.env.MEGACOMPACT_VC6C;
+            else
+                process.env.MEGACOMPACT_VC6C = saved;
+        }
+    };
+}

package/dist/src/vector-cortex/heal/_restore-fixture.js

@@ -0,0 +1,96 @@
+/**
+ * heal/_restore-fixture.ts — conformance fixture I/O for VC6B restoration rows.
+ *
+ * Sibling of `_acceptance-fixture.ts` (which owns the VC6A closure-optimization
+ * rows); split out so neither file approaches the 300-line soft limit and so the
+ * base64/BigInt decoding lives next to the contract it reconstitutes.
+ *
+ * DECODING IS THE POINT. Fixtures are canonical JSON, which cannot express bytes
+ * or bigints, so the corpus stores `originalBytesBase64` + numeric `seq`. These
+ * loaders turn those back into the REAL `ExactShardV1` / `EventV2` objects the
+ * production readers consume — no mocks, no stubs, no parallel "test shape". If
+ * the decode were lossy the digests would not match and the acceptance test would
+ * fail loudly, which is exactly the guarantee we want from a byte-identity sprint.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import assert from "node:assert/strict";
+import { V2, readManifest } from "./_acceptance-fixture.js";
+/** Read one registered restoration fixture (asserting it IS registered). */
+export function restorationFixture(id) {
+    const m = readManifest();
+    const row = m.fixtures.find((f) => f.id === id && f.path.startsWith("restoration/"));
+    assert.ok(row, `fixture ${id} registered under restoration/ in manifest`);
+    return JSON.parse(readFileSync(join(V2, row.path), "utf8"));
+}
+/** base64 -> exact bytes, byte-for-byte (invalid UTF-8 included). */
+export function decodeBytes(base64) {
+    return new Uint8Array(Buffer.from(base64, "base64"));
+}
+/** JSON number seq bounds -> the bigint bounds `ShardRange` declares. */
+export function decodeRange(r) {
+    return {
+        sessionId: r.sessionId,
+        seqStart: BigInt(r.seqStart),
+        seqEnd: BigInt(r.seqEnd),
+        byteStart: r.byteStart,
+        byteEnd: r.byteEnd,
+    };
+}
+/** Reconstitute a real `ExactShardV1` from its fixture row. */
+export function decodeShard(s) {
+    return {
+        schema: "exact-shard-v1",
+        sessionId: s.sessionId,
+        range: decodeRange(s.range),
+        kind: "exact",
+        originalBytes: decodeBytes(s.originalBytesBase64),
+        digest: s.digest,
+        byteCount: s.byteCount,
+        case: s.case,
+    };
+}
+/**
+ * Reconstitute a real `EventV2`. `utf8` is re-derived by strict classification
+ * (never lossy replacement) so an invalid-UTF-8 fixture produces the
+ * `{valid:false, base64}` discriminant the VC1A contract requires.
+ */
+export function decodeEvent(e) {
+    const bytes = decodeBytes(e.originalBytesBase64);
+    let utf8;
+    try {
+        utf8 = { valid: true, text: new TextDecoder("utf-8", { fatal: true }).decode(bytes) };
+    }
+    catch {
+        utf8 = { valid: false, base64: e.originalBytesBase64 };
+    }
+    return {
+        schema: "event-v2",
+        sessionId: e.sessionId,
+        seq: BigInt(e.seq),
+        eventId: e.eventId,
+        role: e.role,
+        kind: e.kind,
+        originalBytes: bytes,
+        bytesDigest: e.bytesDigest,
+        utf8,
+        ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}),
+        occurredAtMs: BigInt(e.occurredAtMs),
+    };
+}
+/** Flag-pinned wrapper: VC6B gated by MEGACOMPACT_VC6B (defaults ON). */
+export function withVc6bFlagsOn(fn) {
+    return () => {
+        const saved = process.env.MEGACOMPACT_VC6B;
+        process.env.MEGACOMPACT_VC6B = "1";
+        try {
+            fn();
+        }
+        finally {
+            if (saved === undefined)
+                delete process.env.MEGACOMPACT_VC6B;
+            else
+                process.env.MEGACOMPACT_VC6B = saved;
+        }
+    };
+}

package/dist/src/vector-cortex/heal/_vc6b-helpers.js

@@ -0,0 +1,35 @@
+/**
+ * heal/_vc6b-helpers.ts — shared decode/run helpers for VC6B acceptance tests.
+ *
+ * Extracted from vc6b-acceptance.test.ts so no single test file crosses the
+ * 300-line soft limit (soft-as-hard gate). Each sibling test file imports from
+ * here rather than duplicating the decode/runReal logic.
+ */
+import { createHash } from "node:crypto";
+import { restoreSources } from "./restore.js";
+import { verifyRestored } from "./verify.js";
+import { decodeRange, decodeShard, decodeEvent } from "./_restore-fixture.js";
+export const enc = (s) => new Uint8Array(Buffer.from(s));
+export const hex = (b) => createHash("sha256").update(b).digest("hex");
+export function decodeFx(fx) {
+    return {
+        request: {
+            schema: "restore-request-v1",
+            sessionId: fx.input.sessionId,
+            spans: fx.input.request.spans.map((s) => ({
+                nodeId: s.nodeId,
+                range: decodeRange(s.range),
+                digest: s.digest,
+            })),
+        },
+        reader: {
+            exactShards: fx.input.exactShards.map(decodeShard),
+            ledgerEvents: fx.input.ledgerEvents.map(decodeEvent),
+        },
+    };
+}
+export function runReal(fx) {
+    const { request, reader } = decodeFx(fx);
+    const result = restoreSources(request, reader);
+    return { request, reader, result, verification: verifyRestored(result, request) };
+}

package/dist/src/vector-cortex/heal/controller.js

@@ -0,0 +1,165 @@
+/**
+ * vector-cortex/heal/controller.ts — VC6C gap detection + rebuild planning.
+ *
+ * Compares each derived subsystem's high-water to the durable authority
+ * high-water and emits a `RepairPlanV1` for every gap that is real, actionable,
+ * and not rate-limited. The controller DECIDES; `rebuild.ts` executes.
+ *
+ * THE AUTHORITY IS NEVER WRITTEN. Every function here takes `RepairState` (whose
+ * `authorityHighWater` is readonly) and returns plans. There is no code path,
+ * guarded or otherwise, that mutates authority — derived state is rebuildable,
+ * authority is not, so repair is strictly one-directional.
+ *
+ * FOUR REASONS NOT TO PLAN, in priority order. The order is the contract: a
+ * frozen authority outranks a rate limit, because "the frontier is not real yet"
+ * is a statement about CORRECTNESS while "you rebuilt recently" is only about
+ * pacing. Reporting RATE_LIMITED during an outage would tell an operator to wait
+ * five minutes for a rebuild that must never happen at all.
+ *
+ *   1. AUTHORITY FROZEN. During an outage the durable high-water freezes while
+ *      the spool keeps accepting frames (TRIAD_RESILIENCE §frontier). A derived
+ *      subsystem behind a frozen frontier is CORRECT, so we refuse to plan rather
+ *      than chase the spool tail and materialize non-durable frames.
+ *   2. NO GAP. `derived >= authority` — nothing to do. Note `>`: a derived source
+ *      AHEAD of authority is not repaired by rebuilding a backwards range (that
+ *      would produce an inverted range); it is left alone for the breaker.
+ *   3. MODE C. Derived state is disabled for this subsystem. Re-planning a
+ *      subsystem whose derived tier is intentionally off is a rebuild loop.
+ *   4. RATE LIMITED. One rebuild per subsystem per 5 minutes.
+ *
+ * DETERMINISTIC JITTER. The ±10% spread comes from a SHA-256 of the subsystem
+ * name plus the attempt, never `Math.random`. Two subsystems desynchronize (no
+ * thundering herd) while a single subsystem's schedule is byte-reproducible — a
+ * fixture can pin `backoffMs` exactly, which a PRNG would make untestable.
+ *
+ * PURE. `node:crypto` is the only dependency beyond types: no storage, no
+ * console, no network, and no clock — `nowMs` is always injected, which is what
+ * makes the fake-clock restart fixtures possible (PREVENT-PI-004 / PREVENT-011).
+ */
+import { createHash } from "node:crypto";
+import { REPAIR_BACKOFF_BASE_MS, REPAIR_BACKOFF_CAP_MS, REPAIR_BACKOFF_JITTER, REPAIR_RATE_LIMIT_MS, } from "./repair-types.js";
+/**
+ * A stable fraction in [0,1) derived from the subsystem name + attempt.
+ *
+ * Uses the first 6 hex digits (24 bits) of SHA-256 — plenty of spread for a ±10%
+ * window, and small enough to stay exact in a float64 division.
+ */
+function digestFraction(subsystem, attempt) {
+    const hex = createHash("sha256")
+        .update(`${subsystem}:${attempt}`)
+        .digest("hex")
+        .slice(0, 6);
+    return parseInt(hex, 16) / 0x1000000;
+}
+/**
+ * Deterministic exponential backoff: `30s * 2^attempt`, capped at 15 minutes,
+ * then spread by ±10% seeded from the subsystem digest.
+ *
+ * The cap is applied BEFORE the jitter so the jitter is a spread around the cap
+ * rather than a way to exceed it; the result is floored to an integer ms so the
+ * value is exactly representable in JSON (a fixture pins it verbatim).
+ *
+ * `attempt` is clamped at 0 and at 30: `2^attempt` for an unclamped large attempt
+ * would reach Infinity, and `Infinity * jitter` is NaN — a NaN backoff would
+ * schedule a plan that is never eligible and silently wedge the subsystem.
+ */
+export function computeBackoff(subsystem, attempt) {
+    const safe = Math.min(Math.max(Math.floor(attempt), 0), 30);
+    const raw = REPAIR_BACKOFF_BASE_MS * 2 ** safe;
+    const capped = Math.min(raw, REPAIR_BACKOFF_CAP_MS);
+    // Map [0,1) onto [-1,+1) then scale to the ±10% window.
+    const spread = (digestFraction(subsystem, safe) * 2 - 1) * REPAIR_BACKOFF_JITTER;
+    return Math.max(0, Math.floor(capped * (1 + spread)));
+}
+/**
+ * True when this subsystem rebuilt less than 5 minutes ago.
+ *
+ * A subsystem that has NEVER rebuilt (`lastRebuildAt === null`) is never rate
+ * limited — the first repair after a restart must not be delayed by the absence
+ * of history.
+ */
+export function isRateLimited(lastRebuildAt, nowMs) {
+    if (lastRebuildAt === null)
+        return false;
+    return lastRebuildAt + BigInt(REPAIR_RATE_LIMIT_MS) > nowMs;
+}
+/**
+ * The seq window a rebuild must cover: the first UNBUILT seq through the
+ * authority frontier, inclusive.
+ *
+ * Byte bounds are intentionally 0..0. VC6C plans in SEQ space — the controller
+ * knows how far each derived tier has been built, but byte offsets belong to the
+ * shard/ledger layer that executes the rebuild. Inventing byte bounds here would
+ * be fabricating a fact the controller does not have.
+ */
+function gapRange(state) {
+    return {
+        sessionId: state.subsystem,
+        seqStart: state.derivedHighWater + 1n,
+        seqEnd: state.authorityHighWater,
+        byteStart: 0,
+        byteEnd: 0,
+    };
+}
+/**
+ * Build the plan for one subsystem's gap.
+ *
+ * Always targets `generation + 1`: a rebuild NEVER writes into the live
+ * generation, so a failed or half-written rebuild cannot corrupt what is
+ * currently being served (see `rebuild.ts` copy-then-switch).
+ *
+ * Exported for direct unit testing and for callers that have already decided a
+ * plan is warranted; `detectGaps` is the guarded entry point that applies the
+ * four refusal rules first.
+ */
+export function planRebuild(state, nowMs) {
+    const backoffMs = computeBackoff(state.subsystem, state.failedAttempts ?? 0);
+    return {
+        schema: "repair-plan-v1",
+        subsystem: state.subsystem,
+        range: gapRange(state),
+        generation: state.generation + 1,
+        backoffMs,
+        scheduledAt: nowMs + BigInt(backoffMs),
+    };
+}
+/**
+ * True when a subsystem is eligible for a rebuild plan (the four refusal rules).
+ * Ordering matters — see the file header.
+ */
+export function isPlannable(state, nowMs) {
+    if (state.authorityFrozen === true)
+        return false;
+    if (state.derivedHighWater >= state.authorityHighWater)
+        return false;
+    if (state.mode === "C")
+        return false;
+    if (isRateLimited(state.lastRebuildAt, nowMs))
+        return false;
+    return true;
+}
+/**
+ * Detect derived gaps and plan a rebuild for each eligible subsystem.
+ *
+ * Output order follows INPUT order, not subsystem name: the caller controls
+ * priority (a topology gap may matter more than a closure gap), and re-sorting
+ * here would silently override that. Never throws — an unplannable subsystem is
+ * simply absent from the result, so a single wedged tier cannot stop the others
+ * from healing (PRACTICES: non-fatal).
+ */
+export function detectGaps(states, nowMs) {
+    const plans = [];
+    for (const state of states) {
+        if (!isPlannable(state, nowMs))
+            continue;
+        plans.push(planRebuild(state, nowMs));
+    }
+    return plans;
+}
+/**
+ * The bound controller surface. A plain object (not a class): there is no
+ * instance state to hold — every input, including the clock, is injected.
+ */
+export function createRepairController() {
+    return { detectGaps, planRebuild };
+}