prism-mcp-server 20.21.24 → 20.21.26

package/README.md

@@ -61,6 +61,12 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ## Get started
 
+Memory search automatically applies ACT-R ranking: relevance plus recency,
+frequency and memory associations. No upvote or prompt instruction is required.
+To opt out, use **Account & Settings → Preferences → Automatic Memory Ranking
+(ACT-R)**, then restart your AI client. `PRISM_ACTR_ENABLED=false` also disables
+it. This ranking is separate from the neural graph's stored importance filter.
+
 ```bash
 npm install -g prism-mcp-server
 prism connect
@@ -164,6 +170,69 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.26
+
+**Why it matters:** routine wording no longer lets a mixed request skip
+Layer 1, the safety screen that decides whether a request may run on your
+device. A BCBA who asks in one message for an operational
+definition and how many mL of a drug to give, or a developer who asks for a
+code review and then authentication code, now has that request screened by
+Layer 1's rules and, unless the request or conversation is already marked
+reserved, a classifier read. Before, it could be answered by a local model
+with no classifier read.
+
+- **Rules no longer clear requests.** Before, one routine clause let Layer 1's
+  rules clear the whole request, so it skipped the classifier. "Write an
+  operational definition for tantrums and tell me how many mL of Benadryl to
+  give at bedtime" was answered locally with no classifier read, and so was
+  "review the dashboard component for hook order and then write the JWT
+  validation middleware". Now rules can only mark a request reserved. The
+  routine shortcut is gone for a single prompt and for the current prompt of a
+  follow-up; the prompt's classifier read is skipped only if the request or
+  conversation is already marked reserved. A long prompt that reaches the
+  classifier is read as excerpts, as before.
+- **What happens to a flagged request.** A text request that a rule marks
+  reserved, or that the classifier flags, goes to a stronger cloud model when
+  your plan includes cloud and the call does not pass `cloud_fallback: false`.
+  Otherwise it is refused, and the refusal says why. Requests the classifier
+  clears remain eligible to run locally, so routine drafting (operational
+  definitions, data sheets, antecedent strategies) and routine code work still
+  run on your device when the local model can answer.
+- **Seclusion by another name.** Placement phrases such as "put him in the
+  quiet room until he calms down" (also isolation, time-out, padded and
+  calm-down rooms) are now marked reserved by rule. This catches placement
+  requests of that shape (him, her, them, or the client, student or child
+  placed into the room) that never use the word "seclusion". Other wording,
+  and other mentions of these rooms, are left to the classifier.
+- **Measured:** of 46 mixed requests built to test this bypass, which should
+  never be answered locally, 41 were cleared to run locally before this
+  release and 9 after: 32 fewer sensitive requests reaching a local model. Of
+  294 routine requests, 2 more than before are escalated (or refused, without
+  cloud).
+- **Limits, unchanged in this release.** Keep them in mind when deciding
+  whether a local answer needs your review:
+  - The classifier can miss a request, and a missed request still runs
+    locally. The 9 above are such misses.
+  - Some classifier failures fall back to a keyword check, and text that
+    passes it can still run locally.
+  - A request with images is processed on this device even when flagged, and
+    is never sent to the cloud.
+- **Cost:** requests that used the shortcut now need a classifier read, unless
+  screening has already marked them reserved. That added check is the price of
+  closing the bypass; in our tests the read took about 0.3 s at the 95th
+  percentile.
+
+## What's New in v20.21.25
+
+Semantic memory search now automatically applies ACT-R ranking, combining
+relevance with recency, frequency and associations. **Account & Settings →
+Preferences → Automatic Memory Ranking (ACT-R)** lets you opt out after an AI
+client restart; an explicit environment value takes precedence.
+
+Synalux Cloud uses authenticated, owner-scoped access-history and candidate-link
+APIs. Cloud deployment requires the matching Portal history migration. Stored
+importance thresholds remain separate, and HRR drift detection remains independent.
+
 ## What's New in v20.21.24
 
 - Synalux cloud preserves initial importance and handles votes, graduated

package/dist/backgroundScheduler.js

@@ -17,7 +17,7 @@
  * storage backends during maintenance windows.
  */
 import { getStorage } from "./storage/index.js";
-import { PRISM_USER_ID, PRISM_SCHOLAR_ENABLED, PRISM_SCHOLAR_INTERVAL_MS, PRISM_GRAPH_PRUNING_ENABLED, PRISM_GRAPH_PRUNE_MIN_STRENGTH, PRISM_GRAPH_PRUNE_PROJECT_COOLDOWN_MS, PRISM_GRAPH_PRUNE_SWEEP_BUDGET_MS, PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP, PRISM_ACTR_ENABLED, PRISM_ACTR_ACCESS_LOG_RETENTION_DAYS, } from "./config.js";
+import { PRISM_USER_ID, PRISM_SCHOLAR_ENABLED, PRISM_SCHOLAR_INTERVAL_MS, PRISM_GRAPH_PRUNING_ENABLED, PRISM_GRAPH_PRUNE_MIN_STRENGTH, PRISM_GRAPH_PRUNE_PROJECT_COOLDOWN_MS, PRISM_GRAPH_PRUNE_SWEEP_BUDGET_MS, PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP, PRISM_ACTR_ACCESS_LOG_RETENTION_DAYS, } from "./config.js";
 import { randomBytes } from "node:crypto";
 import { debugLog } from "./utils/logger.js";
 import { runWebScholar } from "./scholar/webScholar.js";
@@ -103,7 +103,9 @@ export const DEFAULT_SCHEDULER_CONFIG = {
     graphPruneProjectCooldownMs: PRISM_GRAPH_PRUNE_PROJECT_COOLDOWN_MS,
     graphPruneSweepBudgetMs: PRISM_GRAPH_PRUNE_SWEEP_BUDGET_MS,
     graphPruneMaxProjectsPerSweep: PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP,
-    enableAccessLogPrune: PRISM_ACTR_ENABLED,
+    // Default-on retrieval must not silently opt users into destructive maintenance.
+    // Preserve the existing explicit environment opt-in for access-log pruning.
+    enableAccessLogPrune: process.env.PRISM_ACTR_ENABLED === "true",
     accessLogRetentionDays: PRISM_ACTR_ACCESS_LOG_RETENTION_DAYS,
 };
 // ─── Scheduler State ─────────────────────────────────────────

package/dist/config.js

@@ -275,7 +275,7 @@ export const PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP = parseInt(process.env.PRI
 // cognitive architecture. Replaces simple Ebbinghaus decay with
 // a composite similarity + activation model.
 /** Master switch for ACT-R activation-based re-ranking. */
-export const PRISM_ACTR_ENABLED = process.env.PRISM_ACTR_ENABLED === "true";
+export const PRISM_ACTR_ENABLED = process.env.PRISM_ACTR_ENABLED !== "false";
 /** ACT-R decay parameter d in t^(-d). Higher = faster forgetting. (Paper default: 0.5) */
 export const PRISM_ACTR_DECAY = parseFloat(process.env.PRISM_ACTR_DECAY || "0.5");
 /** Weight of cosine similarity in composite score. (Default: 0.7 — similarity dominates) */

package/dist/dashboard/server.js

@@ -41,6 +41,7 @@ import { DASHBOARD_READ_MESSAGES } from "./readMessages.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
 import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
 import { darkFactoryEnablementState, DARK_FACTORY_SETTINGS_UNAVAILABLE } from "../darkfactory/enablement.js";
+import { actrEnablementState } from "../utils/actrEnablement.js";
 import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, isDashboardTokenProtectedPath, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
@@ -730,10 +731,11 @@ return false;}
             // ─── API: Settings — GET (v3.0 Dashboard Settings) ───
             if (url.pathname === "/api/settings" && req.method === "GET") {
                 try {
-                    const { getAllSettings } = await import("../storage/configStorage.js");
+                    const { getAllSettings, initConfigStorage } = await import("../storage/configStorage.js");
+                    await initConfigStorage();
                     const settings = await getAllSettings();
                     res.writeHead(200, { "Content-Type": "application/json" });
-                    return res.end(JSON.stringify({ settings, darkFactory: darkFactoryEnablementState() }));
+                    return res.end(JSON.stringify({ settings, darkFactory: darkFactoryEnablementState(), actr: actrEnablementState() }));
                 }
                 catch {
                     res.writeHead(503, { "Content-Type": "application/json" });

package/dist/dashboard/settingsPolicy.js

@@ -29,7 +29,7 @@ export function isDashboardSettingValueAllowed(key, value) {
     if (["auto_capture", "hivemind_enabled", "task_router_enabled"].includes(key)) {
         return value === "true" || value === "false";
     }
-    if (key === "PRISM_DARK_FACTORY_ENABLED")
+    if (key === "PRISM_DARK_FACTORY_ENABLED" || key === "PRISM_ACTR_ENABLED")
         return value === "true" || value === "false";
     if (key === "agent_name")
         return value.length <= 80 && !/[<>]/.test(value);

package/dist/dashboard/ui.js

@@ -15,6 +15,7 @@
  */
 import { ANALYTICS_DATE_PATTERN, ANALYTICS_METRIC_IDS, DASHBOARD_READ_MESSAGES } from './readMessages.js';
 import { DARK_FACTORY_SETTINGS_UNAVAILABLE } from '../darkfactory/enablement.js';
+import { ACTR_SETTINGS_UNAVAILABLE, ACTR_UI } from '../utils/actrEnablement.js';
 export function renderDashboardLocalOpenHTML() {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -1302,6 +1303,15 @@ export function renderDashboardHTML(version) {
 
         <div class="setting-section">Boot Settings <span class="boot-badge">Restart Required</span></div>
 
+        <div class="setting-row">
+          <div>
+            <div class="setting-label">${ACTR_UI.label}</div>
+            <div class="setting-desc">${ACTR_UI.description}</div>
+            <div id="actr-state" style="color:var(--text-muted);font-size:0.78rem;margin-top:0.25rem">${ACTR_UI.loading}</div>
+          </div>
+          <button class="toggle" id="toggle-actr" type="button" role="switch" aria-label="${ACTR_UI.label}" aria-checked="false" disabled onclick="toggleBootSetting('PRISM_ACTR_ENABLED', this)"></button>
+        </div>
+
         <div class="setting-row">
           <div>
             <div class="setting-label">Hivemind Mode</div>
@@ -4009,6 +4019,7 @@ function loadSettings() {
                 case 2:
                     data = _a.sent();
                     if (!data.darkFactory) throw new Error(DARK_FACTORY_SETTINGS_UNAVAILABLE_MESSAGE);
+                    loadActrSettingState(data.actr);
                     s = data.settings || {};
                     // Runtime toggles
                     if (s.auto_capture === 'true')
@@ -4069,6 +4080,8 @@ function loadSettings() {
                 case 3:
                     e_19 = _a.sent();
                     console.warn('Settings load failed:', e_19);
+                    document.getElementById('actr-state').textContent = ACTR_SETTINGS_UNAVAILABLE_MESSAGE;
+                    document.getElementById('toggle-actr').disabled = true;
                     document.getElementById('dark-factory-state').textContent = DARK_FACTORY_SETTINGS_UNAVAILABLE_MESSAGE;
                     document.getElementById('toggle-dark-factory').disabled = true;
                     document.getElementById('toggle-dark-factory').setAttribute('aria-disabled', 'true');
@@ -4122,11 +4135,30 @@ function toggleSetting(key, el) {
             el.classList.toggle('active'); // rollback on failure
     });
 }
+function loadActrSettingState(ar) {
+    var toggle = document.getElementById('toggle-actr');
+    if (!ar) {
+        toggle.disabled = true;
+        document.getElementById('actr-state').textContent = ACTR_SETTINGS_UNAVAILABLE_MESSAGE;
+        return;
+    }
+    var effective = ar.envOverride === null ? ar.saved : ar.envOverride;
+    toggle.disabled = ar.envOverride !== null;
+    toggle.setAttribute('aria-disabled', toggle.disabled ? 'true' : 'false');
+    toggle.classList.toggle('active', effective);
+    toggle.setAttribute('aria-checked', effective ? 'true' : 'false');
+    document.getElementById('actr-state').textContent = ar.envOverride === null
+        ? 'Saved: ' + (ar.saved ? 'on' : 'off') + ' · Active in this process: ' + (ar.active ? 'on' : 'off') + (ar.pendingRestart ? ' · restart required' : '')
+        : 'Environment override: ' + (ar.envOverride ? 'on' : 'off') + ' · saved preference: ' + (ar.saved ? 'on' : 'off');
+}
 function toggleBootSetting(key, el) {
+    if (el.disabled) return;
+    if (key === 'PRISM_ACTR_ENABLED') el.disabled = true;
     var isActive = el.classList.toggle('active');
     el.setAttribute('aria-checked', isActive ? 'true' : 'false');
     saveSetting(key, isActive ? 'true' : 'false').then(function (ok) {
         if (!ok) {
+            if (key === 'PRISM_ACTR_ENABLED') el.disabled = false;
             el.classList.toggle('active'); // rollback on failure
             el.setAttribute('aria-checked', isActive ? 'false' : 'true');
         }
@@ -4137,6 +4169,7 @@ function toggleBootSetting(key, el) {
     });
 }
 var DARK_FACTORY_SETTINGS_UNAVAILABLE_MESSAGE = ${JSON.stringify(DARK_FACTORY_SETTINGS_UNAVAILABLE)};
+var ACTR_SETTINGS_UNAVAILABLE_MESSAGE = ${JSON.stringify(ACTR_SETTINGS_UNAVAILABLE)};
 var DARK_FACTORY_RESTART_MESSAGE = 'Saved. Restart your AI client for this to take effect.';
 function saveBootSetting(key, value) {
     saveSetting(key, value).then(function (ok) {

package/dist/server.js

@@ -62,6 +62,7 @@ ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequ
 SubscribeRequestSchema, UnsubscribeRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { SERVER_CONFIG, SESSION_MEMORY_ENABLED, PRISM_USER_ID, PRISM_ENABLE_HIVEMIND, WATCHDOG_INTERVAL_MS, WATCHDOG_STALE_MIN, WATCHDOG_FROZEN_MIN, WATCHDOG_OFFLINE_MIN, WATCHDOG_LOOP_THRESHOLD, PRISM_SCHEDULER_ENABLED, PRISM_SCHEDULER_INTERVAL_MS, PRISM_HDC_ENABLED, PRISM_TASK_ROUTER_ENABLED_ENV, YDC_API_KEY, } from "./config.js";
 import { initializeDarkFactoryEnabled, isDarkFactoryEnabled } from "./darkfactory/enablement.js";
+import { initializeActrEnabled } from "./utils/actrEnablement.js";
 import { startWatchdog, drainAlerts } from "./hivemindWatchdog.js";
 import { startScheduler } from "./backgroundScheduler.js";
 import { startDarkFactoryRunner } from "./darkfactory/runner.js";
@@ -1290,6 +1291,7 @@ export async function startServer() {
     // initConfigStorage() is local SQLite only (~5ms), safe to await.
     await initConfigStorage();
     initializeDarkFactoryEnabled();
+    initializeActrEnabled();
     // v4.6.0: Initialize OTel AFTER the settings cache is warm so that
     // initTelemetry() can read otel_enabled/otel_endpoint from getSettingSync()
     // synchronously. This is a synchronous call — no await needed.

package/dist/storage/actrSupabaseMigration.js

@@ -0,0 +1,79 @@
+// Canonical runtime SQL; parity with migration 040 is checked by a unit test.
+export const ACTR_AUTH_SQL = String.raw `
+-- Bind legacy self-hosted access history to signed identity. Preserve legitimate own-user access.
+-- The automatic upgrader must never execute caller-supplied SQL for tenant clients.
+CREATE OR REPLACE FUNCTION public.prism_apply_ddl(p_version integer, p_name text, p_sql text)
+RETURNS json LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp
+AS $$
+DECLARE existing_name text;
+BEGIN
+    IF p_version IS NULL OR p_version < 1 OR p_name IS NULL OR length(btrim(p_name)) = 0
+       OR p_sql IS NULL OR length(btrim(p_sql)) = 0 THEN
+        RAISE EXCEPTION 'Invalid migration identity or SQL' USING ERRCODE = '22023';
+    END IF;
+    PERFORM pg_advisory_xact_lock(hashtext('prism_apply_ddl'));
+    SELECT name INTO existing_name FROM public.prism_schema_versions WHERE version = p_version;
+    IF FOUND THEN
+        IF existing_name IS DISTINCT FROM p_name THEN
+            RAISE EXCEPTION 'Migration version/name conflict' USING ERRCODE = '22023';
+        END IF;
+        RETURN json_build_object('status','already_applied','version',p_version,'name',p_name);
+    END IF;
+    EXECUTE p_sql;
+    INSERT INTO public.prism_schema_versions(version,name) VALUES (p_version,p_name);
+    RETURN json_build_object('status','applied','version',p_version,'name',p_name);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.prism_apply_ddl(integer,text,text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.prism_apply_ddl(integer,text,text) TO service_role;
+CREATE OR REPLACE FUNCTION public.prism_log_access(
+    p_user_id text, p_entry_id uuid, p_accessed_at timestamptz DEFAULT now(), p_context_hash text DEFAULT NULL
+)
+RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp
+AS $$
+BEGIN
+    IF p_context_hash IS NOT NULL AND p_context_hash !~ '^[a-f0-9]{1,64}$' THEN
+        RAISE EXCEPTION 'Access context must be a hash' USING ERRCODE = '22023';
+    END IF;
+    INSERT INTO public.memory_access_log(entry_id,accessed_at,context_hash)
+    SELECT ledger.id, clock_timestamp(), p_context_hash FROM public.session_ledger AS ledger
+    WHERE ledger.id = p_entry_id AND ledger.user_id = p_user_id
+      AND ledger.deleted_at IS NULL AND (to_jsonb(ledger)->>'archived_at') IS NULL
+      AND (auth.role() = 'service_role' OR (p_user_id = auth.uid()::text
+        AND ((to_jsonb(ledger)->>'workspace_id') IS NULL
+          OR to_jsonb(ledger)->>'workspace_id' = auth.jwt()->>'workspace_id')));
+END;
+$$;
+CREATE OR REPLACE FUNCTION public.prism_get_access_log(
+    p_user_id text, p_entry_ids uuid[], p_max_per_entry integer DEFAULT 50
+)
+RETURNS TABLE (entry_id uuid, accessed_at timestamptz)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp
+AS $$
+BEGIN
+    IF p_entry_ids IS NULL OR cardinality(p_entry_ids) NOT BETWEEN 1 AND 50
+       OR p_max_per_entry IS NULL OR p_max_per_entry NOT BETWEEN 1 AND 50 THEN
+        RAISE EXCEPTION 'Invalid access history bounds' USING ERRCODE = '22023';
+    END IF;
+    RETURN QUERY
+        SELECT ledger.id, history.accessed_at FROM public.session_ledger AS ledger
+        CROSS JOIN LATERAL (
+            SELECT access.accessed_at FROM public.memory_access_log AS access
+            WHERE access.entry_id = ledger.id ORDER BY access.accessed_at DESC LIMIT p_max_per_entry
+        ) AS history
+        WHERE ledger.id = ANY(p_entry_ids) AND ledger.user_id = p_user_id
+          AND ledger.deleted_at IS NULL AND (to_jsonb(ledger)->>'archived_at') IS NULL
+          AND (auth.role() = 'service_role' OR (p_user_id = auth.uid()::text
+            AND ((to_jsonb(ledger)->>'workspace_id') IS NULL
+              OR to_jsonb(ledger)->>'workspace_id' = auth.jwt()->>'workspace_id')));
+END;
+$$;
+REVOKE ALL ON FUNCTION public.prism_log_access(text,uuid,timestamptz,text) FROM PUBLIC, anon;
+REVOKE ALL ON FUNCTION public.prism_get_access_log(text,uuid[],integer) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.prism_log_access(text,uuid,timestamptz,text) TO service_role, authenticated;
+GRANT EXECUTE ON FUNCTION public.prism_get_access_log(text,uuid[],integer) TO service_role, authenticated;
+-- Global retention cannot be a permission held by ordinary tenant clients.
+REVOKE ALL ON FUNCTION public.prism_prune_access_log(integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.prism_prune_access_log(integer) TO service_role;
+NOTIFY pgrst, 'reload schema';
+`;

package/dist/storage/supabase.js

@@ -1250,7 +1250,7 @@ export class SupabaseStorage {
         }
         catch (e) {
             debugLog(`[SupabaseStorage] getAccessLog fallback/no-op: ${e.message}`);
-            return result;
+            throw e;
         }
     }
     async pruneAccessLog(olderThanDays) {

package/dist/storage/supabaseMigrations.js

@@ -21,6 +21,7 @@
  * ═══════════════════════════════════════════════════════════════════
  */
 import { supabaseRpc } from "../utils/supabaseApi.js";
+import { ACTR_AUTH_SQL } from "./actrSupabaseMigration.js";
 /**
  * All Supabase DDL migrations.
  *
@@ -805,6 +806,7 @@ export const MIGRATIONS = [
       CREATE INDEX IF NOT EXISTS idx_research_tasks_status ON public.research_tasks(status, created_at ASC);
       `
     },
+    { version: 40, name: "actr_authenticated_history", sql: ACTR_AUTH_SQL },
 ];
 /**
  * Current schema version — derived from the MIGRATIONS array.

package/dist/storage/synalux.js

@@ -22,6 +22,8 @@
  *     - adjustImportance  → POST /api/v1/prism/memory  action=adjust_importance
  *     - getGraduatedInsights → POST /api/v1/prism/memory  action=graduated_insights
  *     - decayImportance   → POST /api/v1/prism/memory  action=decay_importance
+ *     - logAccess / recordAccesses / updateLastAccessed → action=record_access
+ *     - getAccessLog      → POST /api/v1/prism/memory  action=get_access_log
  *     - saveHandoff       → POST /api/v1/prism/memory  action=save_handoff
  *     - saveHistorySnapshot → POST /api/v1/prism/memory  action=save_history_snapshot
  *     - loadContext       → POST /api/v1/prism/memory  action=load_context
@@ -69,10 +71,85 @@ function resolveKnowledgeScope(callerScope) {
 }
 /** Refresh JWT this many ms before expiry to avoid edge-case 401s. */
 const JWT_REFRESH_LEEWAY_MS = 60_000;
+const ACCESS_BATCH_LIMIT = 50;
+const ACCESS_ID_RE = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/i;
+const ACCESS_MESSAGES = {
+    invalid: "Invalid memory access batch",
+    write: "Invalid memory access response",
+    read: "Invalid memory access history response",
+    failed: "[SynaluxStorage] Memory access recording failed",
+};
+function accessIds(ids) {
+    if (!Array.isArray(ids) || ids.some(id => typeof id !== "string" || !ACCESS_ID_RE.test(id))) {
+        throw new Error(ACCESS_MESSAGES.invalid);
+    }
+    return [...new Set(ids.map(id => id.toLowerCase()))];
+}
 function buildContextLoadKey(project, level, userId, role) {
     return JSON.stringify({ project, level, userId, role: role ?? "" });
 }
 export class SynaluxStorage extends SupabaseStorage {
+    logAccess(entryId, contextHash) {
+        void this.recordAccesses([entryId], contextHash).catch(() => console.error(ACCESS_MESSAGES.failed));
+    }
+    async getCandidateLinks(entryIds) {
+        const ids = accessIds(entryIds);
+        if (ids.length === 0)
+            return [];
+        if (ids.length > ACCESS_BATCH_LIMIT)
+            throw new Error(ACCESS_MESSAGES.invalid);
+        const response = await this.portalPost("/api/v1/prism/memory", { action: "get_candidate_links", entry_ids: ids });
+        if (!Array.isArray(response.links) || response.links.length > ids.length * 20
+            || response.links.some(row => !row || !ids.includes(row.source_id) || !ids.includes(row.target_id)
+                || !Number.isFinite(row.strength) || row.strength < 0 || row.strength > 1))
+            throw new Error(ACCESS_MESSAGES.read);
+        return response.links;
+    }
+    async recordAccesses(entryIds, contextHash) {
+        await this.writeAccesses(entryIds, contextHash, true);
+    }
+    async updateLastAccessed(entryIds) {
+        await this.writeAccesses(entryIds, undefined, false);
+    }
+    async writeAccesses(entryIds, contextHash, recordHistory) {
+        const ids = accessIds(entryIds);
+        if (contextHash !== undefined && !/^[a-f0-9]{1,64}$/.test(contextHash))
+            throw new Error(ACCESS_MESSAGES.invalid);
+        for (let offset = 0; offset < ids.length; offset += ACCESS_BATCH_LIMIT) {
+            const batch = ids.slice(offset, offset + ACCESS_BATCH_LIMIT);
+            const response = await this.portalPost("/api/v1/prism/memory", {
+                action: "record_access", entry_ids: batch, context_hash: contextHash ?? null, record_history: recordHistory,
+            });
+            if (!Number.isInteger(response.recorded) || Number(response.recorded) < 0 || Number(response.recorded) > batch.length) {
+                throw new Error(ACCESS_MESSAGES.write);
+            }
+        }
+    }
+    async getAccessLog(entryIds, maxPerEntry = ACCESS_BATCH_LIMIT) {
+        const ids = accessIds(entryIds);
+        if (!Number.isInteger(maxPerEntry) || maxPerEntry < 1 || maxPerEntry > ACCESS_BATCH_LIMIT)
+            throw new Error(ACCESS_MESSAGES.invalid);
+        const result = new Map();
+        for (let offset = 0; offset < ids.length; offset += ACCESS_BATCH_LIMIT) {
+            const batch = ids.slice(offset, offset + ACCESS_BATCH_LIMIT);
+            const response = await this.portalPost("/api/v1/prism/memory", { action: "get_access_log", entry_ids: batch, max_per_entry: maxPerEntry });
+            if (!Array.isArray(response.accesses) || response.accesses.length > batch.length * maxPerEntry)
+                throw new Error(ACCESS_MESSAGES.read);
+            for (const row of response.accesses) {
+                if (!row || !batch.includes(row.entry_id) || typeof row.accessed_at !== "string")
+                    throw new Error(ACCESS_MESSAGES.read);
+                const timestamp = new Date(row.accessed_at);
+                if (!Number.isFinite(timestamp.getTime()))
+                    throw new Error(ACCESS_MESSAGES.read);
+                const history = result.get(row.entry_id) ?? [];
+                if (history.length >= maxPerEntry)
+                    throw new Error(ACCESS_MESSAGES.read);
+                history.push(timestamp);
+                result.set(row.entry_id, history);
+            }
+        }
+        return result;
+    }
     baseUrl;
     refreshToken;
     cachedJwt = null;

package/dist/tools/graphHandlers.js

@@ -51,7 +51,9 @@ const activeCompactions = new Set();
  */
 import { computeEffectiveImportance, recordMemoryAccess } from "../utils/cognitiveMemory.js";
 import { baseLevelActivation, candidateScopedSpreadingActivation, compositeRetrievalScore, } from "../utils/actrActivation.js";
-import { PRISM_ACTR_ENABLED, PRISM_ACTR_DECAY, PRISM_ACTR_WEIGHT_SIMILARITY, PRISM_ACTR_WEIGHT_ACTIVATION, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, PRISM_ACTR_MAX_ACCESSES_PER_ENTRY, } from "../config.js";
+import { PRISM_ACTR_DECAY, PRISM_ACTR_WEIGHT_SIMILARITY, PRISM_ACTR_WEIGHT_ACTIVATION, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, PRISM_ACTR_MAX_ACCESSES_PER_ENTRY, } from "../config.js";
+import { isActrEnabled } from "../utils/actrEnablement.js";
+import { createHash } from "node:crypto";
 import { HdcStateMachine } from "../sdm/stateMachine.js";
 import { ConceptDictionary } from "../sdm/conceptDictionary.js";
 import { PolicyGateway } from "../sdm/policyGateway.js";
@@ -361,7 +363,7 @@ export async function sessionSearchMemoryHandler(args) {
     enable_trace = false, 
     // v5.2: Context-Weighted Retrieval — biases search toward active work context
     context_boost = false, activation, } = args;
-    debugLog(`[session_search_memory] Semantic search: query="${query}", ` +
+    debugLog(`[session_search_memory] Semantic search: queryHash=${createHash("sha256").update(query).digest("hex")}, ` +
         `project=${project || "all"}, limit=${limit}, threshold=${similarity_threshold}` +
         `${context_boost ? ", context_boost=ON" : ""}`);
     // Phase 1: Start total latency timer BEFORE any work (embedding + storage)
@@ -395,7 +397,7 @@ export async function sessionSearchMemoryHandler(args) {
             }
             if (contextParts.length > 0) {
                 effectiveQuery = `[${contextParts.join("; ")}] ${query}`;
-                debugLog(`[session_search_memory] Context boost applied: "${effectiveQuery.substring(0, 100)}..."`);
+                debugLog(`[session_search_memory] Context boost applied (${effectiveQuery.length} characters)`);
             }
         }
         catch {
@@ -435,7 +437,8 @@ export async function sessionSearchMemoryHandler(args) {
         // If we only fetch `limit` rows, the re-ranker can only shuffle those exact
         // results — a memory at rank #(limit+1) by similarity but accessed 500 times
         // would never surface. Fetch 4× or minimum 20, then slice after re-ranking.
-        const candidateLimit = PRISM_ACTR_ENABLED
+        const actrEnabled = isActrEnabled();
+        const candidateLimit = actrEnabled
             ? Math.min(Math.max(limit * 4, 20), 50)
             : Math.min(limit, 20);
         const results = await storage.searchMemory({
@@ -483,28 +486,38 @@ export async function sessionSearchMemoryHandler(args) {
         }
         // ── v7.0: ACT-R Re-Ranking Pipeline ──────────────────────────
         const resultIds = results.map((r) => r.id).filter(Boolean);
+        const policyCandidates = [...results].sort((a, b) => (b.similarity ?? 0) - (a.similarity ?? 0)).slice(0, limit);
         const now = new Date();
         // Accumulate ACT-R metrics for trace output
         let actrMetrics = null;
-        if (PRISM_ACTR_ENABLED && resultIds.length > 0) {
+        if (actrEnabled && resultIds.length > 0) {
             try {
                 // Step A: Bulk-fetch access logs for all candidate IDs
                 const accessLogMap = await storage.getAccessLog(resultIds, PRISM_ACTR_MAX_ACCESSES_PER_ENTRY);
                 // Step B: Fetch outbound links for spreading activation
                 const candidateIdSet = new Set(resultIds);
                 const linksMap = new Map();
-                for (const id of resultIds) {
-                    try {
-                        const links = await storage.getLinksFrom(id, PRISM_USER_ID, 0.0, 20);
-                        linksMap.set(id, links.map((l) => ({
-                            target_id: l.target_id,
-                            strength: l.strength ?? 1.0,
-                        })));
-                    }
-                    catch {
-                        linksMap.set(id, []);
+                if (storage.getCandidateLinks) {
+                    const links = await storage.getCandidateLinks(resultIds);
+                    for (const link of links) {
+                        const outgoing = linksMap.get(link.source_id) ?? [];
+                        outgoing.push({ target_id: link.target_id, strength: link.strength });
+                        linksMap.set(link.source_id, outgoing);
                     }
                 }
+                else
+                    for (const id of resultIds) {
+                        try {
+                            const links = await storage.getLinksFrom(id, PRISM_USER_ID, 0.0, 20);
+                            linksMap.set(id, links.map((l) => ({
+                                target_id: l.target_id,
+                                strength: l.strength ?? 1.0,
+                            })));
+                        }
+                        catch {
+                            linksMap.set(id, []);
+                        }
+                    }
                 // Step C: Compute activation for each result and re-rank
                 actrMetrics = { baseLevels: [], spreadings: [], sigmoids: [], composites: [] };
                 for (const r of results) {
@@ -541,6 +554,7 @@ export async function sessionSearchMemoryHandler(args) {
                     `mean composite=${(actrMetrics.composites.reduce((a, b) => a + b, 0) / actrMetrics.composites.length).toFixed(3)}`);
             }
             catch (actrErr) {
+                actrMetrics = null;
                 // ACT-R failures are non-fatal — degrade to similarity-only ordering
                 debugLog(`[session_search_memory] ACT-R re-ranking failed (non-fatal): ${actrErr instanceof Error ? actrErr.message : String(actrErr)}`);
             }
@@ -550,13 +564,15 @@ export async function sessionSearchMemoryHandler(args) {
         // so we only log access for results actually delivered to the LLM.
         results.splice(limit);
         if (PRISM_HDC_ENABLED && results.length > 0) {
-            const topScore = PRISM_ACTR_ENABLED ? results[0]._actr_composite : results[0].similarity;
-            const secondScore = results.length > 1 ? (PRISM_ACTR_ENABLED ? results[1]._actr_composite : results[1].similarity) : 0;
+            // Policy thresholds are calibrated to semantic relevance, not activation.
+            const topScore = policyCandidates[0]?.similarity;
+            const secondScore = policyCandidates.length > 1 ? policyCandidates[1].similarity : 0;
             const gapDistance = (topScore || 0) - (secondScore || 0);
             const fallbackThreshold = PRISM_HDC_POLICY_FALLBACK_THRESHOLD || 0.85;
             const clarifyThreshold = PRISM_HDC_POLICY_CLARIFY_THRESHOLD || 0.95;
             const gapThreshold = clarifyThreshold - fallbackThreshold;
-            if ((topScore || 0) < fallbackThreshold || (results.length > 1 && gapDistance < gapThreshold)) {
+            if ((topScore || 0) < fallbackThreshold || (policyCandidates.length > 1 && gapDistance < gapThreshold)
+                || (results[0].similarity ?? 0) < fallbackThreshold) {
                 return {
                     content: [{
                             type: "text",
@@ -576,7 +592,7 @@ export async function sessionSearchMemoryHandler(args) {
         // v7.0: Writes to both access_log buffer AND legacy last_accessed_at
         const finalIds = results.map((r) => r.id).filter(Boolean);
         if (finalIds.length > 0) {
-            const queryHash = query.substring(0, 64);
+            const queryHash = createHash("sha256").update(query).digest("hex");
             recordMemoryAccess(finalIds, queryHash);
         }
         // Format results with similarity scores + effective importance + ACT-R
@@ -605,6 +621,9 @@ export async function sessionSearchMemoryHandler(args) {
                 type: "text",
                 text: `${searchResultsHeader(results.length, isHybridSearchResults(results))}\n\n${formatted}`,
             }];
+        if (actrEnabled && resultIds.length > 0 && !actrMetrics) {
+            contentBlocks.push({ type: "text", text: "Automatic memory ranking unavailable for this search; returning relevance ordering." });
+        }
         // Phase 1: content[1] = machine-readable MemoryTrace (only when enable_trace=true)
         // topScore is read from results[0].similarity — this is the cosine distance
         // already returned by SemanticSearchResult in the storage interface.
@@ -626,7 +645,7 @@ export async function sessionSearchMemoryHandler(args) {
                 totalMs,
                 project: project || null,
                 // v7.0: ACT-R observability
-                actrEnabled: PRISM_ACTR_ENABLED,
+                actrEnabled: actrMetrics !== null,
                 actrBaseLevelMean: actrMetrics ? mean(actrMetrics.baseLevels) : undefined,
                 actrSpreadingMean: actrMetrics ? mean(actrMetrics.spreadings) : undefined,
                 actrCompositeMean: actrMetrics ? mean(actrMetrics.composites) : undefined,
@@ -682,6 +701,9 @@ export async function sessionSearchMemoryHandler(args) {
                         text: contentBlocks[0].text +
                             `\n\n🔗 Graph-connected memories (${enrichedEntries.length} via 1-hop expansion):\n\n${graphFormatted}`,
                     };
+                    const deliveredGraphIds = enrichedEntries.map((entry) => entry.id).filter(Boolean);
+                    if (deliveredGraphIds.length > 0)
+                        recordMemoryAccess(deliveredGraphIds, createHash("sha256").update(query).digest("hex"));
                     // Fire-and-forget: reinforce traversed links
                     for (const directId of directIds) {
                         storage.getLinksFrom(directId, PRISM_USER_ID, 0.3, 5)

package/dist/tools/prismInferHandler.js

@@ -318,7 +318,6 @@ export async function layer1HedgeSecondRead(o) {
     const tier = MODEL_TIERS.find(t => t.tag === "prism-coder:9b");
     if (!o.installed.has(big) || big === o.guardModel || tier === undefined)
         return skip("no_9b");
-    const readPrompt = !o.promptFastPath;
     const messages = o.args.messages ?? [];
     const turnReads = messages.flatMap((m, index) => historyTurnWindows(m.content).filter(w => w.trim()).map(text => ({ text, index, role: m.role })));
     const turnTexts = turnReads.map(t => t.text);
@@ -333,7 +332,7 @@ export async function layer1HedgeSecondRead(o) {
         if (excluded)
             return skip(excluded);
     }
-    if (readPrompt && o.args.prompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
+    if (o.args.prompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
         return skip("prompt_oversize");
     const reads = [];
     const seen = new Set();
@@ -341,8 +340,7 @@ export async function layer1HedgeSecondRead(o) {
         seen.add(k);
         reads.push(r);
     } };
-    if (readPrompt)
-        add({ model: big, text: o.args.prompt, kind: "prompt", label: "9b:prompt" });
+    add({ model: big, text: o.args.prompt, kind: "prompt", label: "9b:prompt" });
     for (let i = turnReads.length - 1; i >= 0; i--)
         add({ model: big, text: turnReads[i].text, kind: "turn", label: `9b:turn:${turnReads[i].index}:${turnReads[i].role}` });
     for (let i = ctxTexts.length - 1; i >= 0; i--)
@@ -388,7 +386,7 @@ export async function layer1HedgeSecondRead(o) {
     if (!known(ctxBig) || !known(ctxSmall) || !known(overBig) || !known(overSmall))
         return skip("unprobeable");
     const fitsIn = (ctx, over) => (t) => Buffer.byteLength(layer1ClassifierContent(t), "utf8") + over + LAYER1_CLASSIFIER_OUTPUT_TOKENS <= ctx;
-    if (![...turnTexts, ...(readPrompt ? [o.args.prompt] : []), ...ctxTexts].every(fitsIn(ctxBig, overBig)))
+    if (![...turnTexts, o.args.prompt, ...ctxTexts].every(fitsIn(ctxBig, overBig)))
         return skip("unfit");
     if (!ctxTexts.every(fitsIn(ctxSmall, overSmall)))
         return skip("unfit");
@@ -2242,27 +2240,18 @@ export async function runInfer(args, deps) {
             // The current prompt is a request: its deterministic floor runs
             // here explicitly (not only inside the classifier entry point, so
             // an injected classifier cannot skip it), in the same proximity
-            // slices as a turn; then, unless the routine fast path below
-            // applies, it is read alone with its images and that verdict is
-            // kept like a turn's.
-            let promptRoutine = true;
+            // slices as a turn; then it is read alone with its images and that
+            // verdict is kept like a turn's. The floor only refuses, so there is
+            // no fast path: a prompt a rule does not refuse is always read.
             for (const slice of windowsOf(args.prompt, DETERMINISTIC_FLOOR_WINDOW_CHARS, DETERMINISTIC_FLOOR_WINDOW_OVERLAP)) {
                 const promptDet = classifyDeterministicLayer1(slice);
                 if (promptDet)
                     l1 = raise(l1, promptDet, "rules");
-                if (promptDet !== "OBVIOUS_NOT_RESERVED")
-                    promptRoutine = false;
             }
             // The classifier entry point's own whole-prompt deterministic pass
             // is switched off here — it would undo the slicing above (words
-            // 14k chars apart firing one rule; review round 18). The routine
-            // fast path it provided is kept explicitly and on ITS boundary: a
-            // prompt of at most 4,000 chars whose rules verdict is routine,
-            // with no images, skips the model. Longer prompts always reach
-            // the entry point, whose full-text keyword floor must run
-            // (review round 19: skipping it there bypassed that floor).
-            const promptFastPath = promptRoutine && args.prompt.length <= MAX_CLASSIFIER_PROMPT_LENGTH && (resolvedImages?.length ?? 0) === 0;
-            if (l1 !== "OBVIOUS_RESERVED" && !promptFastPath) {
+            // 14k chars apart firing one rule; review round 18).
+            if (l1 !== "OBVIOUS_RESERVED") {
                 l1 = raise(l1, await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages, { deterministic: false, ...(classifierInput ? { classifierInput } : {}) }), "prompt");
             }
             // 3. Context, raise only: one window per turn and one for the
@@ -2328,7 +2317,7 @@ export async function runInfer(args, deps) {
             else if (modelHedgeOnly) {
                 const second = await layer1HedgeSecondRead({
                     l1fn, args, installed, listLoaded: deps.listLoaded, freeBytes: deps.freemem(), ollamaUrl: deps.ollamaUrl,
-                    guardModel: l1Model, promptFastPath,
+                    guardModel: l1Model,
                     probeClassifierLimits: deps.probeClassifierLimits ?? probeClassifierLimits,
                     policy: await (deps.secondReadPolicy ?? getSecondReadPolicy)().catch(() => null),
                 });

package/dist/utils/actrEnablement.js

@@ -0,0 +1,29 @@
+import { getSettingSync } from "../storage/configStorage.js";
+const SETTING_KEY = "PRISM_ACTR_ENABLED";
+const DEFAULT_ENABLED = true;
+export const ACTR_SETTINGS_UNAVAILABLE = "Automatic memory ranking settings unavailable. Retry when the server is reachable.";
+export const ACTR_UI = {
+    label: "Automatic Memory Ranking (ACT-R)",
+    description: "Rank retrieved memories by relevance, recency, frequency and associations. Enabled by default. Restart your AI client after changing this setting.",
+    loading: "Loading ranking state…",
+};
+let startupDecision;
+export function resolveActrEnabled(env, saved) {
+    if (env === "true" || env === "false")
+        return env === "true";
+    return saved === "true" || saved === "false" ? saved === "true" : DEFAULT_ENABLED;
+}
+export function initializeActrEnabled() {
+    startupDecision = resolveActrEnabled(process.env.PRISM_ACTR_ENABLED, getSettingSync(SETTING_KEY, String(DEFAULT_ENABLED)));
+    return startupDecision;
+}
+export function isActrEnabled() {
+    return startupDecision ?? initializeActrEnabled();
+}
+export function actrEnablementState() {
+    const env = process.env.PRISM_ACTR_ENABLED;
+    const envOverride = env === "true" || env === "false" ? env === "true" : null;
+    const saved = resolveActrEnabled(undefined, getSettingSync(SETTING_KEY, String(DEFAULT_ENABLED)));
+    const active = isActrEnabled();
+    return { saved, active, envOverride, pendingRestart: envOverride === null && saved !== active };
+}

package/dist/utils/cognitiveMemory.js

@@ -23,7 +23,8 @@
 import { getStorage } from "../storage/index.js";
 import { debugLog } from "./logger.js";
 import { baseLevelActivation, parameterizedSigmoid, } from "./actrActivation.js";
-import { PRISM_ACTR_ENABLED, PRISM_ACTR_DECAY, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, } from "../config.js";
+import { PRISM_ACTR_DECAY, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, } from "../config.js";
+import { isActrEnabled } from "./actrEnablement.js";
 /**
  * Computes the effective importance of a memory, combining the semantic
  * importance score with a recency-based activation factor.
@@ -53,7 +54,7 @@ export function computeEffectiveImportance(baseImportance, lastAccessedStr, crea
     // Fallback to creation date if it has never been accessed
     const referenceDateStr = lastAccessedStr || createdAtStr;
     const referenceDate = new Date(referenceDateStr);
-    if (!PRISM_ACTR_ENABLED) {
+    if (!isActrEnabled()) {
         // ── Legacy Ebbinghaus Decay (v5.2, deprecated) ──
         const diffMs = Math.max(0, now.getTime() - referenceDate.getTime());
         const daysSinceAccess = diffMs / (1000 * 60 * 60 * 24);
@@ -89,6 +90,9 @@ export function recordMemoryAccess(ids, contextHash) {
         return;
     // Fire and forget, don't block execution
     getStorage().then(storage => {
+        if (storage.recordAccesses) {
+            return storage.recordAccesses(ids, contextHash);
+        }
         // v7.0: Log access events to memory_access_log via buffer
         for (const id of ids) {
             storage.logAccess(id, contextHash);

package/dist/utils/layer1.js

@@ -150,7 +150,12 @@ const all = (...rules) => (prompt) => rules.every((rule) => rule(prompt));
  *  restraint, self-harm, suicide, medication or diagnosis. */
 const CLINICAL_RESERVED_RULES = [
     all(has(/\b(?:de[- ]?escalat\w*|meltdown\w*|rage\s+episode|violent\w*)\b/i), has(/\b(?:draft|write|plan|procedure|protocol|manag\w*|what\s+(?:do|should)\b|respond\w*)\b/i)),
-    all(has(/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i), has(/\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i)),
+    (prompt) => (/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i.test(prompt)
+        && /\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i.test(prompt)) || (
+    // Seclusion by another name: someone placed IN a room ("put him in the
+    // quiet room", "walk the student into the calm-down room"). A room
+    // named as a setting, a schedule, or a room used by choice is not one.
+    /\b(?:put|puts|putting|plac(?:e|es|ed|ing)|sen(?:d|ds|t|ding)|tak(?:e|es|en|ing)|took|walk\w*|mov(?:e|es|ed|ing)|bring\w*|brought|escort\w*|carr(?:y|ies|ied|ying)|drag\w*|lock\w*|confin\w*|keep\w*|kept)\s+(?:him|her|them|(?:the|a|an|this|that)\s+(?:client|student|child|kid|learner|resident|patient))\s+(?:back\s+)?(?:in|into|to|inside)\s+(?:the\s+|a\s+|an\s+)?(?:quiet|isolation|time[- ]?out|padded|calm[- ]?down|seclusion)\s+rooms?\b/i.test(prompt)),
     all(has(/\b(?:self[- ]?(?:harm|injur\w*)|bites?\s+(?:him|her|them)self|bites?\s+(?:his|her|their)\s+own\b|scratches?\s+(?:him|her|them)self|scratches?\s+(?:his|her|their)\s+own\b|bangs?\s+(?:his|her|their)\s+head|harm\s+(?:himself|herself|themselves))\b/i), has(/\b(?:bleed\w*|blood|concrete|head\s+impact|medical\s+attention|risk(?:\s+of\s+injury)?|causes?\s+injury|actual\s+injury|assess\w*|screen\w*|want\w*)\b/i)),
     (prompt) => (/\b(?:punch\w*|attack\w*|aggress\w*|hit\s+staff)\b/i.test(prompt)
         && /\b(?:last\s+(?:week|month|year)|prior|previous|history|injur\w*)\b/i.test(prompt)
@@ -173,17 +178,6 @@ const RESERVED_INTENT_RULES = [
     ...CLINICAL_RESERVED_RULES,
     ...OPERATIONAL_RESERVED_RULES,
 ];
-const ROUTINE_BCBA_INTENT_RULES = [
-    has(/\boperational\s+definition\b/i),
-    all(has(/\bdefin\w*\b/i), has(/\b(?:onset|offset|observers?|score|measur\w*)\b/i)),
-    all(has(/\b(?:abc|fba|functional\s+behavior)\b/i), has(/\b(?:hypothes\w*|tentative|summari[sz]\w*)\b/i)),
-    all(has(/\b(?:what\s+data|data\s+(?:should|to)\s+(?:be\s+)?gather\w*|collect\s+data)\b/i), has(/\bbefore\s+(?:select\w*|choos\w*|design\w*)\s+(?:an?\s+)?intervention\b/i)),
-    all(has(/\b(?:aac|augmentative\s+communication)\b/i), has(/\b(?:replacement[- ]response|replacement\s+(?:skill|behavior)|function[- ]matched)\b/i), has(/\b(?:bcba|clinician)\s+review\b/i)),
-    all(has(/\b(?:explain|educat\w*|why)\b/i), has(/\b(?:dro|differential\s+reinforcement|function[- ]matched|maintain\w+\s+by|escape\s+from)\b/i)),
-    all(has(/\b(?:caregiver|staff|parent)\s+training\b/i), has(/\b(?:aac|replacement|break[- ]request|communication)\b/i)),
-    all(has(/\b(?:rewrite|rephrase)\b/i), has(/\b(?:stigmat\w*|dignity|objective|tentative|function[- ]based)\b/i)),
-    all(has(/\b(?:aac|communication\s+device)\b/i), has(/\b(?:remain|keep)\s+available\b/i), has(/\bno\s+injur(?:y|ies)\b/i), has(/\bnonrestrictive\b/i)),
-];
 function matchesAny(prompt, rules) {
     return rules.some((rule) => rule(prompt));
 }
@@ -235,11 +229,11 @@ export function reservedCategory(prompt) {
     // The artifact exemption sits BETWEEN the two groups in
     // classifyDeterministicLayer1, and omitting it here made the label disagree
     // with the verdict: "add numeric validation fields to the auth token
-    // verification handler" classifies OBVIOUS_NOT_RESERVED, while this reported
-    // "auth / session / token code". Harmless when the deterministic verdict is
-    // used directly, but the label is also read on paths that skip that fast
-    // path — prompts over MAX_CLASSIFIER_PROMPT_LENGTH, and image requests — so
-    // it could name a rule that did not fire.
+    // verification handler" is never refused by a rule (the classifier reads
+    // it), while this reported "auth / session / token code". Harmless when the
+    // deterministic verdict is used directly, but the label is also read on
+    // paths that skip that fast path — prompts over MAX_CLASSIFIER_PROMPT_LENGTH,
+    // and image requests — so it could name a rule that did not fire.
     if (NON_OPERATIONAL_ARTIFACT_CONTEXT.test(prompt) &&
         NON_OPERATIONAL_ARTIFACT_ACTION.test(prompt)) {
         return null;
@@ -255,9 +249,8 @@ const NON_OPERATIONAL_ARTIFACT_ACTION = /\b(?:review\b[\s\S]{0,120}\bhook\s+orde
 /**
  * Deterministic policy floor for unambiguous intents.
  *
- * Routing is code, not model judgment: clear reserved work fails closed and
- * clear routine BCBA work reaches local inference. Ambiguous prompts return
- * null and continue to the semantic classifier below.
+ * Clear reserved work fails closed by rule. Everything else returns null and
+ * is read by the semantic classifier below: the floor never clears.
  */
 /** The non-operational artifact exemption over a text. classifyDeterministic
  *  Layer1 applies it to the text it is given; prism_infer's history screen
@@ -281,19 +274,25 @@ export function classifyDeterministicLayer1(userPrompt, opts) {
     // the crisis form" escaping the restraint rule, and a wrong answer there
     // costs more than an unnecessary escalation. Clinical intent still fails
     // closed first, before anything can exempt it.
+    //
+    // The floor only refuses; it never clears. Every bypass found in review was
+    // a rule clearing a request no model read: a routine or artifact clause
+    // beside "a prone hold protocol for staff", "how many mL of Benadryl to
+    // give" or "find paths allowing unauthenticated access" was served in
+    // 0 ms, and each word-list patch was followed by new wording. Anything a
+    // rule does not refuse is read by the classifier.
     const clinicalReserved = matchesAny(userPrompt, CLINICAL_RESERVED_RULES);
     if (clinicalReserved)
         return "OBVIOUS_RESERVED";
-    if (opts?.operational === false) {
-        return matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES) ? "OBVIOUS_NOT_RESERVED" : null;
-    }
-    if (isNonOperationalArtifact(userPrompt)) {
-        return "OBVIOUS_NOT_RESERVED";
-    }
+    if (opts?.operational === false)
+        return null;
+    // A non-operational artifact edit is never refused by an operational rule
+    // (an auth_bypass fixture label is not reserved work); the classifier
+    // reads it.
+    if (isNonOperationalArtifact(userPrompt))
+        return null;
     if (matchesAny(userPrompt, RESERVED_INTENT_RULES))
         return "OBVIOUS_RESERVED";
-    if (matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES))
-        return "OBVIOUS_NOT_RESERVED";
     return null;
 }
 /**
@@ -451,13 +450,6 @@ images, opts) {
     const deterministic = opts?.deterministic === false ? null : classifyDeterministicLayer1(userPrompt);
     if (deterministic === "OBVIOUS_RESERVED")
         return deterministic;
-    // The routine-work fast path may only skip the model when there is nothing
-    // to look at. It reads the PROMPT, so with an image attached it is a free
-    // bypass: pair "write an operational definition" — or any ROUTINE_BCBA
-    // phrasing — with a clinical screenshot and the gate returns NOT_RESERVED
-    // without a single call. Text keeps the shortcut; images earn the screen.
-    if (!oversize && !hasImages && deterministic === "OBVIOUS_NOT_RESERVED")
-        return deterministic;
     if (oversize && keywordBackstop(userPrompt) === "OBVIOUS_RESERVED") {
         // The regex floor has no length limit — reserved vocabulary anywhere
         // in the full text (including the middle the excerpt can't see)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.24",
+  "version": "20.21.26",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",