superlocalmemory 3.6.5 → 3.6.7

package/src/superlocalmemory/core/ingest_gate.py

@@ -0,0 +1,133 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 — Ingest Gate (v3.6.6)
+
+"""Ingest gate for the remember/store write path (v3.6.6 F-4).
+
+Responsibilities:
+  1. Hard reject content > 1MB (nobody's memory is a megabyte).
+  2. Clamp content > 24000 chars to head 70% + tail 30% + truncation marker.
+     Head+tail (not head-only) preserves OPEN ITEMS that session-close facts put
+     at the END. Only pathological pastes (167KB JSON, 50KB logs) are touched;
+     normal dense memories (6-15K session handoffs) pass through intact.
+     Full original preserved in result.full_content for storage in memories table.
+  3. Prompt-template firewall: reject content matching _PROMPT_TEMPLATE_PATTERNS
+     (extends v3.6.4 remember-write-02 quality gate).
+
+Kill-switch: SLM_INGEST_NO_GATE=1 bypasses rules 2 and 3 (but NOT the 1MB hard cap).
+
+Usage::
+    from superlocalmemory.core.ingest_gate import apply_ingest_gate
+    result = apply_ingest_gate(content)
+    if result.rejected:
+        return {"success": False, "error": result.rejection_reason}
+    store(result.fact_content, full_content=result.full_content)
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+
+# v3.6.6: clamp only pathological monsters; preserve normal dense memories.
+# 24K chars ≈ 6K tokens — well beyond any legitimate single memory.
+_MAX_VERBATIM_CHARS = 24000
+_HEAD_FRACTION = 0.70  # head 70% + tail 30% so OPEN ITEMS at the end survive
+_MAX_INGEST_BYTES = 1_048_576  # 1MB — hard cap, NOT bypassed by kill-switch
+_TRUNCATION_MARKER = "\n…[content truncated at ingest; full text in source memory]…\n"
+
+
+@dataclass
+class IngestGateResult:
+    """Result of applying the ingest gate to content.
+
+    fact_content:     Content to store in atomic_facts.content (may be truncated).
+    full_content:     Original unmodified content (for memories table storage).
+    rejected:         True if content should be rejected outright.
+    rejection_reason: Human-readable reason for rejection (when rejected=True).
+    truncated:        True if fact_content was head-sliced.
+    """
+    fact_content: str
+    full_content: str
+    rejected: bool = False
+    rejection_reason: str = ""
+    truncated: bool = False
+
+
+def apply_ingest_gate(
+    content: str,
+    max_verbatim_chars: int = _MAX_VERBATIM_CHARS,
+    max_ingest_bytes: int = _MAX_INGEST_BYTES,
+) -> IngestGateResult:
+    """Apply the ingest quality gate to content before storing.
+
+    Returns IngestGateResult. Callers MUST check result.rejected before
+    proceeding with storage.
+
+    Kill-switch SLM_INGEST_NO_GATE=1 bypasses the verbatim size clamp and
+    template firewall but NOT the 1MB hard cap (safety boundary).
+    """
+    gate_active = os.environ.get("SLM_INGEST_NO_GATE", "0") != "1"
+
+    # --- Hard cap: 1MB regardless of kill-switch ---
+    try:
+        byte_len = len(content.encode("utf-8", errors="replace"))
+    except Exception:
+        byte_len = len(content)
+    if byte_len > max_ingest_bytes:
+        return IngestGateResult(
+            fact_content=content,
+            full_content=content,
+            rejected=True,
+            rejection_reason=(
+                f"Content size {byte_len} bytes exceeds maximum "
+                f"{max_ingest_bytes} bytes (1MB). "
+                "Nobody's memory is a megabyte."
+            ),
+        )
+
+    # --- Gate bypassed ---
+    if not gate_active:
+        return IngestGateResult(
+            fact_content=content,
+            full_content=content,
+            rejected=False,
+            truncated=False,
+        )
+
+    # --- Prompt-template firewall ---
+    # Extends the v3.6.4 remember-write-02 quality gate.
+    try:
+        from superlocalmemory.core.injection import is_prompt_template
+        if is_prompt_template(content):
+            return IngestGateResult(
+                fact_content=content,
+                full_content=content,
+                rejected=True,
+                rejection_reason=(
+                    "Content matches internal prompt-template patterns "
+                    "(low-quality gate). Prompt machinery must not be stored as memory."
+                ),
+            )
+    except Exception:
+        pass  # Defensive: gate failure must never block a store
+
+    # --- Verbatim size clamp (head 70% + tail 30%) ---
+    if len(content) > max_verbatim_chars:
+        budget = max_verbatim_chars - len(_TRUNCATION_MARKER)
+        head_len = int(budget * _HEAD_FRACTION)
+        tail_len = budget - head_len
+        fact_content = content[:head_len] + _TRUNCATION_MARKER + content[-tail_len:]
+        return IngestGateResult(
+            fact_content=fact_content,
+            full_content=content,
+            rejected=False,
+            truncated=True,
+        )
+
+    return IngestGateResult(
+        fact_content=content,
+        full_content=content,
+        rejected=False,
+        truncated=False,
+    )

package/src/superlocalmemory/core/injection.py

@@ -35,6 +35,33 @@ _LOW_QUALITY_PATTERNS = (
     re.compile(r"the first line must be exactly", re.IGNORECASE),
 )
 
+# v3.6.6: Prompt-template firewall patterns (F-3, F-4).
+# These patterns identify content that is internal LLM prompt machinery,
+# not genuine user memories. Used at ingest (F-4) and recall serialization (F-3).
+# Stdlib-only (re module) so hooks import chain stays light.
+_PROMPT_TEMPLATE_PATTERNS = (
+    re.compile(r"you are summarizing a claude code session", re.IGNORECASE),
+    re.compile(r"you are a memory consolidation agent", re.IGNORECASE),
+    re.compile(r"apply maximum non-destructive compression", re.IGNORECASE),
+    re.compile(r"<task-notification\b", re.IGNORECASE),
+)
+
+
+def is_prompt_template(content: str) -> bool:
+    """True if *content* matches internal prompt-template patterns.
+
+    Used by:
+      - F-3: drop source_content that is prompt machinery
+      - F-4: reject template content at ingest (extends v3.6.4 quality gate)
+
+    Separate from is_low_quality() so the firewall can be applied without
+    the full quality-check heuristics (e.g. at raw ingest before any
+    other processing).
+    """
+    if not content:
+        return False
+    return any(pat.search(content) for pat in _PROMPT_TEMPLATE_PATTERNS)
+
 # Leading category tag like "[active_decisions] " / "[learned_preferences] ".
 _CATEGORY_TAG_RE = re.compile(r"^\s*\[[a-z0-9_]+\]\s*", re.IGNORECASE)
 

package/src/superlocalmemory/core/maintenance_scheduler.py

@@ -124,6 +124,15 @@ class MaintenanceScheduler:
         except Exception as exc:
             logger.debug("Pending cleanup skipped: %s", exc)
 
+        # v3.6.6 F-5: Daily core-block recompile with hygiene (dedup + char cap).
+        # Ensures blocks stay clean even when purge or new facts arrive between
+        # session-init recompiles.
+        try:
+            from superlocalmemory.core.block_hygiene import _recompile_core_blocks
+            _recompile_core_blocks(self._db, self._config, self._profile_id)
+        except Exception as exc:
+            logger.debug("Core-block recompile skipped: %s", exc)
+
         self._schedule_next()
 
     def _sync_cloud_destinations(self, manager: object) -> None:

package/src/superlocalmemory/core/recall_pipeline.py

@@ -324,6 +324,8 @@ def apply_adaptive_ranking(
         channel_weights=response.channel_weights,
         total_candidates=response.total_candidates,
         retrieval_time_ms=response.retrieval_time_ms,
+        # v3.6.6: preserve evidence-floor signal across reranking rebuilds.
+        no_confident_match=(len(new_results) == 0) and response.no_confident_match,
     )
 
 
@@ -426,6 +428,8 @@ def apply_v2_adaptive_ranking(
             channel_weights=response.channel_weights,
             total_candidates=response.total_candidates,
             retrieval_time_ms=response.retrieval_time_ms,
+            # v3.6.6: preserve evidence-floor signal across reranking rebuilds.
+            no_confident_match=(len(new_results) == 0) and response.no_confident_match,
         )
     except Exception as exc:  # pragma: no cover — defensive
         logger.debug("apply_v2_adaptive_ranking skipped: %s", exc)
@@ -554,6 +558,8 @@ def apply_v2_bandit_ensemble(
             channel_weights=response.channel_weights,
             total_candidates=response.total_candidates,
             retrieval_time_ms=response.retrieval_time_ms,
+            # v3.6.6: preserve evidence-floor signal across ensemble rebuilds.
+            no_confident_match=(len(final_results) == 0) and response.no_confident_match,
         )
     except Exception as exc:  # pragma: no cover — defensive top-level
         logger.debug("apply_v2_bandit_ensemble skipped: %s", exc)
@@ -675,6 +681,9 @@ def run_recall(
                         channel_weights=response.channel_weights,
                         total_candidates=response.total_candidates + len(enhanced_facts),
                         retrieval_time_ms=response.retrieval_time_ms,
+                        # v3.6.6: agentic round-2 may add facts; recompute flag.
+                        no_confident_match=(len(enhanced_results[:limit]) == 0)
+                        and response.no_confident_match,
                     )
             except Exception as exc:
                 logger.debug("Agentic sufficiency skipped: %s", exc)

package/src/superlocalmemory/core/recall_worker.py

@@ -71,26 +71,17 @@ def _handle_recall(
     memory_ids = list({r.fact.memory_id for r in response.results[:limit] if r.fact.memory_id})
     memory_map = engine._db.get_memory_content_batch(memory_ids) if memory_ids else {}
 
-    results = []
-    for r in response.results[:limit]:
-        fact_type = getattr(r.fact, "fact_type", None)
-        lifecycle = getattr(r.fact, "lifecycle", None)
-        results.append({
-            "fact_id": r.fact.fact_id,
-            "memory_id": r.fact.memory_id,
-            "content": r.fact.content[:300],
-            "source_content": memory_map.get(r.fact.memory_id, ""),
-            "score": round(r.score, 4),
-            "confidence": round(r.confidence, 4),
-            "trust_score": round(r.trust_score, 4),
-            "channel_scores": {
-                k: round(v, 4) for k, v in (r.channel_scores or {}).items()
-            },
-            "fact_type": fact_type.value if fact_type and hasattr(fact_type, "value") else "",
-            "lifecycle": lifecycle.value if lifecycle and hasattr(lifecycle, "value") else "",
-            "access_count": getattr(r.fact, "access_count", 0),
-            "evidence_chain": list(getattr(r, "evidence_chain", []) or []),
-        })
+    # v3.6.6: same shared chokepoint as the daemon HTTP route + CLI fallback,
+    # so the MCP WorkerPool subprocess path returns identical budgeted output.
+    from superlocalmemory.server.recall_serializer import serialize_recall_response
+    _rc = getattr(engine._config, "retrieval", None)
+    results, no_confident_match = serialize_recall_response(
+        response,
+        limit=limit,
+        memory_map=memory_map,
+        per_fact_max=getattr(_rc, "recall_per_fact_max_chars", 2400),
+        total_max=getattr(_rc, "recall_total_max_chars", 12000),
+    )
     return {
         "ok": True,
         "query": query,
@@ -102,6 +93,7 @@ def _handle_recall(
         },
         "total_candidates": getattr(response, "total_candidates", 0),
         "results": results,
+        "no_confident_match": no_confident_match,
     }
 
 

package/src/superlocalmemory/mcp/server.py

@@ -237,8 +237,19 @@ def _eager_warmup() -> None:
         _logger.warning("Mesh auto-register failed: %s", exc)
 
 import threading
-_warmup_thread = threading.Thread(target=_eager_warmup, daemon=True, name="mcp-warmup")
-_warmup_thread.start()
+
+# v3.6.7: Suppress standalone-process behaviours when the MCP server is
+# imported inside the daemon (SLM_MCP_EMBEDDED=1). Three threads are safe
+# to run in a dedicated `slm mcp` subprocess but harmful inside the daemon:
+#   mcp-warmup      — creates a LIGHT engine duplicate; daemon has a FULL one.
+#   parent-watchdog — calls os._exit(0) if its parent IDE quits, which would
+#                     kill the daemon along with it.
+#   stdin-eof-monitor — monitors stdin pipe; meaningless inside the daemon.
+_embedded_in_daemon = _os.environ.get("SLM_MCP_EMBEDDED") == "1"
+
+if not _embedded_in_daemon:
+    _warmup_thread = threading.Thread(target=_eager_warmup, daemon=True, name="mcp-warmup")
+    _warmup_thread.start()
 
 
 # V3.4.57: Parent watchdog — self-terminate when the IDE/Claude session dies.
@@ -274,8 +285,9 @@ def _parent_watchdog() -> None:
             pass  # Transient errors — keep watching
 
 
-_watchdog_thread = threading.Thread(target=_parent_watchdog, daemon=True, name="parent-watchdog")
-_watchdog_thread.start()
+if not _embedded_in_daemon:
+    _watchdog_thread = threading.Thread(target=_parent_watchdog, daemon=True, name="parent-watchdog")
+    _watchdog_thread.start()
 
 
 # V3.5.9: Stdin EOF monitor — complements the parent watchdog for the case where
@@ -337,8 +349,9 @@ def _stdin_eof_monitor() -> None:
         _mlog.debug("stdin EOF monitor error: %s — watchdog will cover", exc)
 
 
-_stdin_monitor_thread = threading.Thread(target=_stdin_eof_monitor, daemon=True, name="stdin-eof-monitor")
-_stdin_monitor_thread.start()
+if not _embedded_in_daemon:
+    _stdin_monitor_thread = threading.Thread(target=_stdin_eof_monitor, daemon=True, name="stdin-eof-monitor")
+    _stdin_monitor_thread.start()
 
 
 if __name__ == "__main__":

package/src/superlocalmemory/mcp/tools_core.py

@@ -236,6 +236,8 @@ def register_core_tools(server, get_engine: Callable) -> None:
                     "query_type": result.get("query_type", "unknown"),
                     "channel_weights": result.get("channel_weights", {}),
                     "retrieval_time_ms": result.get("retrieval_time_ms", 0),
+                    # v3.6.6: surface evidence-floor signal to MCP clients.
+                    "no_confident_match": result.get("no_confident_match", False),
                 }
             return {"success": False, "error": result.get("error", "Recall failed")}
         except Exception as exc:

package/src/superlocalmemory/retrieval/engine.py

@@ -295,15 +295,73 @@ class RetrievalEngine:
         if len(final_top) > len(top[:effective_limit]):
             facts = self._load_facts(final_top, profile_id)
 
+        # v3.6.6: Evidence floor — gate on per-channel scores (NOT fused/RRF score).
+        # Nonsense queries fuse at 0.75-0.78 because RRF is rank-derived and
+        # uncalibrated. The discriminator is EARNED CHANNEL EVIDENCE:
+        #   semantic >= min_semantic_evidence (0.60) OR bm25 > 0
+        #   OR entity_graph > 0 OR temporal > 0 OR fact is pinned.
+        # spreading_activation and hopfield do NOT count — they are associative
+        # amplifiers that fabricated the nonsense results in calibration tests.
+        # Kill-switch: SLM_RECALL_NO_FLOOR=1 bypasses the floor.
+        import os as _os_floor
+        floor_enabled = (
+            getattr(self._config, "evidence_floor_enabled", True)
+            and _os_floor.environ.get("SLM_RECALL_NO_FLOOR", "0") != "1"
+        )
+        if floor_enabled:
+            min_sem = getattr(self._config, "min_semantic_evidence", 0.60)
+            final_top = self._apply_evidence_floor(final_top, facts, min_sem)
+            # Trim facts dict to match filtered final_top
+            filtered_ids = {fr.fact_id for fr in final_top}
+            facts = {fid: f for fid, f in facts.items() if fid in filtered_ids}
+
         # 6. Build response
         results = self._build_results(final_top, facts, strat)
         ms = (time.monotonic() - t0) * 1000.0
+        no_match = floor_enabled and len(results) == 0
         return RecallResponse(
             query=query, mode=mode, results=results,
             query_type=strat.query_type, channel_weights=strat.weights,
             total_candidates=total, retrieval_time_ms=ms,
+            no_confident_match=no_match,
         )
 
+    # -- Evidence floor (v3.6.6) -------------------------------------------
+
+    @staticmethod
+    def _apply_evidence_floor(
+        final_top: list[FusionResult],
+        facts: dict[str, AtomicFact],
+        min_semantic: float,
+    ) -> list[FusionResult]:
+        """Filter results that earned no channel evidence.
+
+        Keep a result only if it earned:
+          - semantic cosine >= min_semantic (default 0.60), OR
+          - bm25 > 0, OR entity_graph > 0, OR temporal > 0, OR
+          - the underlying fact is pinned.
+
+        spreading_activation and hopfield do NOT count as primary evidence.
+        Empty result after filtering is a success (no_confident_match=True).
+        """
+        kept: list[FusionResult] = []
+        for fr in final_top:
+            cs = fr.channel_scores or {}
+            # Primary channel evidence check
+            if (
+                cs.get("semantic", 0.0) >= min_semantic
+                or cs.get("bm25", 0.0) > 0.0
+                or cs.get("entity_graph", 0.0) > 0.0
+                or cs.get("temporal", 0.0) > 0.0
+            ):
+                kept.append(fr)
+                continue
+            # Pinned fact bypass — always pass regardless of channel scores
+            fact = facts.get(fr.fact_id)
+            if fact is not None and getattr(fact, "pinned", False):
+                kept.append(fr)
+        return kept
+
     # -- Cross-channel intersection boost -----------------------------------
 
     @staticmethod

package/src/superlocalmemory/server/recall_serializer.py

@@ -0,0 +1,225 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 — Recall Serializer (v3.6.6)
+
+"""Recall output budget and source_content discipline helpers (v3.6.6).
+
+F-2: Per-fact content clamp + total budget stubs.
+F-3: source_content preview + template firewall.
+
+THE single shared serialization chokepoint. Every surface that turns a
+RecallResponse into transport dicts goes through ``serialize_recall_response``
+so MCP, CLI, the daemon HTTP route, the in-process queue adapter, and the
+WorkerPool fallback all return byte-for-byte identical output (parity across
+surfaces AND modes A/B). The evidence floor lives upstream in
+RetrievalEngine.recall (also shared); this layer owns presentation only.
+
+Pure functions — no side effects, no DB access. Stdlib-only at import
+(hooks import chain must stay light).
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+
+# ---------------------------------------------------------------------------
+# F-2: Per-fact content clamp
+# ---------------------------------------------------------------------------
+
+def clamp_fact_content(
+    content: str,
+    max_chars: int = 2400,
+) -> tuple[str, bool]:
+    """Clamp a single fact's content to max_chars.
+
+    Strategy: head 70% + "\\n…[truncated N chars]…\\n" + tail 30%.
+    The tail is kept because session-close facts put OPEN ITEMS at the end.
+
+    Returns:
+        (clamped_content, was_truncated)
+    """
+    if not content or len(content) <= max_chars:
+        return content, False
+
+    head_len = int(max_chars * 0.70)
+    tail_len = max_chars - head_len
+    dropped = len(content) - max_chars
+    marker = f"\n…[truncated {dropped} chars]…\n"
+
+    result = content[:head_len] + marker + content[-tail_len:]
+    return result, True
+
+
+def apply_recall_budget(
+    results: list[dict],
+    per_fact_max: int = 2400,
+    total_max: int = 12000,
+    full: bool = False,
+) -> list[dict]:
+    """Apply per-fact clamp and total budget to a list of result dicts.
+
+    Args:
+        results: List of result dicts (must have at minimum 'fact_id',
+                 'score', 'content' keys).
+        per_fact_max: Maximum chars for a single fact's content.
+        total_max: Maximum total content chars before remaining results
+                   become stubs.
+        full: If True, bypasses all clamping (escape hatch for tools/CLI
+              that need full content — additive backward-compat param).
+
+    Returns:
+        New list of result dicts with potentially clamped/stubbed content.
+        Mutates nothing — returns new dicts.
+    """
+    if not results:
+        return []
+
+    if full:
+        # full=True: return everything as-is, no clamping, no stubs
+        return [dict(r) for r in results]
+
+    out: list[dict] = []
+    cumulative_chars = 0
+
+    for r in results:
+        content = r.get("content", "") or ""
+
+        # Check if we're already over total budget
+        if cumulative_chars >= total_max:
+            # Emit stub: fact_id, score, first 120 chars + "…"
+            stub_content = content[:120] + ("…" if len(content) > 120 else "")
+            stub = {k: v for k, v in r.items() if k not in ("content",)}
+            stub["content"] = stub_content
+            stub["stub"] = True
+            out.append(stub)
+            continue
+
+        # Per-fact clamp
+        clamped, was_truncated = clamp_fact_content(content, max_chars=per_fact_max)
+        new_r = dict(r)
+        new_r["content"] = clamped
+        if was_truncated:
+            new_r["truncated"] = True
+
+        cumulative_chars += len(clamped)
+        out.append(new_r)
+
+    return out
+
+
+# ---------------------------------------------------------------------------
+# F-3: source_content discipline
+# ---------------------------------------------------------------------------
+
+def apply_source_content_discipline(
+    result: dict,
+    include_source: bool = False,
+) -> dict:
+    """Apply source_content discipline to a single result dict.
+
+    Default behavior:
+      - Trim source_content to ≤ 280 chars
+      - Drop entirely if it matches prompt-template patterns
+
+    include_source=True:
+      - Returns full source_content (unless it's a template, always dropped)
+
+    Returns a new dict — never mutates input.
+    """
+    from superlocalmemory.core.injection import is_prompt_template
+
+    if "source_content" not in result:
+        return dict(result)
+
+    src = result.get("source_content") or ""
+
+    # Template firewall: drop regardless of include_source
+    if src and is_prompt_template(src):
+        new_r = dict(result)
+        new_r["source_content"] = ""
+        return new_r
+
+    # Empty source: return unchanged
+    if not src:
+        return dict(result)
+
+    if include_source:
+        return dict(result)
+
+    # Default: preview ≤ 280 chars
+    new_r = dict(result)
+    new_r["source_content"] = src[:280]
+    return new_r
+
+
+# ---------------------------------------------------------------------------
+# THE shared chokepoint: RecallResponse -> transport dicts (all surfaces)
+# ---------------------------------------------------------------------------
+
+def serialize_recall_response(
+    response: Any,
+    *,
+    limit: int = 10,
+    memory_map: dict[str, str] | None = None,
+    per_fact_max: int = 2400,
+    total_max: int = 12000,
+    full: bool = False,
+    include_source: bool = False,
+) -> tuple[list[dict], bool]:
+    """Convert a RecallResponse into budgeted, source-disciplined dicts.
+
+    This is the ONE function every recall surface calls (daemon HTTP route,
+    in-process queue adapter, CLI direct-fallback, WorkerPool). Guarantees
+    identical output regardless of surface or mode.
+
+    Args:
+        response:       A RecallResponse (engine result objects in .results).
+        limit:          Max results to serialize.
+        memory_map:     fact.memory_id -> source memory content (optional).
+        per_fact_max:   Per-fact content char cap (config-driven).
+        total_max:      Total content char budget before stubs (config-driven).
+        full:           Bypass clamping/stubs (additive escape hatch).
+        include_source: Return full source_content (else ≤280-char preview).
+
+    Returns:
+        (results, no_confident_match) — results is a list of dicts; the bool
+        is the evidence-floor signal lifted from the response (additive).
+    """
+    memory_map = memory_map or {}
+    raw: list[dict] = []
+    for r in (response.results or [])[:limit]:
+        fact = r.fact
+        fact_type = getattr(fact, "fact_type", None)
+        lifecycle = getattr(fact, "lifecycle", None)
+        raw.append({
+            "fact_id": fact.fact_id,
+            "memory_id": fact.memory_id,
+            "content": fact.content or "",
+            "source_content": memory_map.get(fact.memory_id, "") or "",
+            "score": round(r.score, 4),
+            "confidence": round(getattr(r, "confidence", 0.0), 4),
+            "trust_score": round(getattr(r, "trust_score", 0.0), 4),
+            "channel_scores": {
+                k: round(v, 4) for k, v in (getattr(r, "channel_scores", None) or {}).items()
+            },
+            "fact_type": fact_type.value
+                if fact_type is not None and hasattr(fact_type, "value")
+                else (getattr(fact, "fact_type", "") or ""),
+            "lifecycle": lifecycle.value
+                if lifecycle is not None and hasattr(lifecycle, "value")
+                else (lifecycle or ""),
+            "access_count": getattr(fact, "access_count", 0),
+            "created_at": getattr(fact, "created_at", "") or "",
+            "evidence_chain": list(getattr(r, "evidence_chain", []) or []),
+        })
+
+    # F-3 source discipline, then F-2 budget — order matters (discipline first
+    # so the template firewall runs before any preview slicing).
+    disciplined = [apply_source_content_discipline(d, include_source=include_source) for d in raw]
+    budgeted = apply_recall_budget(
+        disciplined, per_fact_max=per_fact_max, total_max=total_max, full=full,
+    )
+    no_confident_match = bool(getattr(response, "no_confident_match", False))
+    return budgeted, no_confident_match