topos-node 1.5.0__tar.gz → 1.5.2__tar.gz

{topos_node-1.5.0/topos_node.egg-info → topos_node-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.5.0
+Version: 1.5.2
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai

{topos_node-1.5.0 → topos_node-1.5.2}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.5.0"
+version = "1.5.2"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"

{topos_node-1.5.0 → topos_node-1.5.2}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.5.0"
-__version_info__ = (1, 5, 0)
+__version__ = "1.5.2"
+__version_info__ = (1, 5, 2)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.5.0 → topos_node-1.5.2}/topos/features/lifecycle/blackhole.py

@@ -273,12 +273,72 @@ def _identifier_pattern(identifiers: frozenset) -> Optional["re.Pattern[str]"]:
     return re.compile(rf"(?<![^\W_])(?:{body})(?![^\W_])")
 
 
+#: A name of this many letters or more is also found with an "s" glued on: a plural, or a possessive written with no
+#: apostrophe ("sams" for "Sam's"; with the apostrophe the normalisation already took the "'s" off). Shorter names
+#: are not, so "ed" is never found in "eds", nor "j" in "js".
+NAME_PLURAL_MIN_CHARS = 3
+
+
+#: Arabic and Hebrew: "and", "to", "with" are written joined to the FRONT of a name (و ل ب, ו ל ש), so a short name
+#: is rarely a whole word in running text (review R-N1-151 R2 N1). WS0's ruling: in these scripts a name is read
+#: anywhere at read time, whatever its length, as 1.5.0 read every name.
+_CLITIC_SCRIPTS = re.compile("[\u0590-\u05ff\u0600-\u06ff\u0750-\u077f\u08a0-\u08ff\ufb1d-\ufdff\ufe70-\ufeff]")
+
+
+def clitic_script(term: str) -> bool:
+    """Whether this name has a letter of the Arabic or Hebrew script (`_CLITIC_SCRIPTS`)."""
+    return bool(_CLITIC_SCRIPTS.search(term))
+
+
+def _long_name(term: str) -> bool:
+    """WS0's ruling on BL-112 (review R-N1-151 H2): the whole-word reading is for names under the share boundary's
+    short-term length (``entity_boundary.SHORT_TERM_CHARS``, 4), counted as the boundary counts it (its skeleton:
+    NFKD letters and digits, so a Hangul name counts its jamo). The owner's over-match concern was short names ("Ed",
+    "J"). A name of 4 or more is read as before and as the boundary reads a long term: anywhere in the text, so a
+    possessive with any apostrophe letter, a particle glued on (Korean), a digit glued on, an inflection and an alias
+    run into the next word are found."""
+    from ...permissions_v2.entity_boundary import SHORT_TERM_CHARS, skeleton
+
+    return len(skeleton(term)) >= SHORT_TERM_CHARS
+
+
+#: The apostrophes that are letters (U+02BC, U+02BB, U+02B9 …): the share boundary's own list. The normalisation
+#: keeps them inside a word, so "Samʼs" stays one token; a short name followed by one of them and "s" is the name.
+def _apostrophe_letters() -> str:
+    from ...permissions_v2.entity_boundary import APOSTROPHE_LETTERS
+
+    return "".join(sorted(APOSTROPHE_LETTERS))
+
+
+@functools.lru_cache(maxsize=256)
+def _name_pattern(names: frozenset) -> Optional["re.Pattern[str]"]:
+    """One pattern for the names that are matched as whole words (BL-112, the owner's ruling of 8 Oct 2026): each
+    stands where no letter or digit touches either end of it, with an "s" after it allowed from
+    ``NAME_PLURAL_MIN_CHARS`` letters, its own words apart by whitespace as written. "sam" is found in "sam", "sam's"
+    (normalised to "sam") and "sams", never in "same", "samples" or "balsam"; "al" never in "also" or "retrieval"."""
+    if not names:
+        return None
+    ordered = sorted(names, key=lambda term: (-len(term), term))
+    body = "|".join(r"\s+".join(re.escape(word) for word in term.split()) + ("s?" if len(term) >= NAME_PLURAL_MIN_CHARS
+                                                                            else "")
+                    for term in ordered)
+    possessive = rf"(?:[{re.escape(_apostrophe_letters())}]s)?"
+    return re.compile(rf"(?<![^\W_])(?:{body}){possessive}(?![^\W_])")
+
+
 class OffLimitsTerms:
     """The names and the identifiers of the Off-limits entries one reader sees, and how each is looked for in text
     that was normalised with ``normalize_entity_name``.
 
-    A NAME is looked for as it always was by these read-time scans: anywhere in the text, inside a longer word too.
-    That scan is the deliberate second net behind the id join, and this round does not narrow it.
+    A NAME of an entry the owner made, or of a carried entry he has made fully Off-limits, that is SHORT (under the
+    share boundary's 4: ``_long_name``) is looked for as whole words (BL-112, the owner's ruling of 8 Oct 2026, and
+    WS0's of 9 Oct on its reach, ``_name_pattern``): found anywhere it hid a great deal ("Ed" dropped 42% of the
+    outside client's query results). Its plural or possessive with no apostrophe ("sams"), and its possessive with an
+    apostrophe letter ("Samʼs", U+02BC, U+02BB, U+02B9 …), are found too. It is looked for in the text and in
+    ``values`` both, so a name that a serialisation glued to an escape ("\\nSam") is still found. A name of 4 or more
+    is looked for anywhere in the text, as before and as the boundary reads a long term; so is a name that is carried
+    and WAITING (``loose``: the whole entry, or a name the upgrade added to a full one), and one written in a script
+    with no spaces. A caller that names no ``loose`` set gets every name read anywhere, as before.
 
     An IDENTIFIER (a handle, a username, a contact id, an address, a number: ``IDENTIFIERS_COLUMN``) matches only as
     itself, by the owner's decision of 7 Oct 2026: one with a digit or an ``@`` keeps the same reading as a name
@@ -294,11 +354,16 @@ class OffLimitsTerms:
     such a term the same way (``_in_a_run``).
     """
 
-    __slots__ = ("names", "identifiers", "_anywhere", "_whole")
+    __slots__ = ("names", "identifiers", "_loose", "_named", "_anywhere", "_whole")
 
-    def __init__(self, names: Set[str] = frozenset(), identifiers: Set[str] = frozenset()) -> None:
+    def __init__(self, names: Set[str] = frozenset(), identifiers: Set[str] = frozenset(), *,
+                 loose: Optional[Set[str]] = None) -> None:
         self.names = frozenset(term for term in names if term)
         self.identifiers = frozenset(term for term in identifiers if term) - self.names
+        # The names found anywhere, inside a longer word too: carried and waiting, or written with no spaces.
+        self._loose = (self.names if loose is None else frozenset(term for term in loose if term) & self.names) | \
+            frozenset(term for term in self.names if _in_a_run(term) or _long_name(term) or clitic_script(term))
+        self._named = _name_pattern(self.names - self._loose)
         self._anywhere = frozenset(term for term in self.identifiers
                                    if "@" in term or any(ch.isdigit() for ch in term) or _in_a_run(term))
         self._whole = _identifier_pattern(self.identifiers - self._anywhere)
@@ -322,9 +387,14 @@ class OffLimitsTerms:
         if not text and not values:
             return None
         text = text or ""
-        for term in self.names:
+        for term in self._loose:
             if term in text:
                 return term
+        if self._named is not None:
+            for named in (text,) if values is None or values == text else (text, values):
+                hit = self._named.search(named)
+                if hit is not None:
+                    return hit.group(0)
         scanned = text if values is None else values
         if not scanned:
             return None
@@ -340,6 +410,15 @@ class OffLimitsTerms:
     def found_in(self, text: Optional[str], *, values: Optional[str] = None) -> bool:
         return self.found(text, values=values) is not None
 
+    def identifiers_found(self, text: Optional[str]) -> Optional[str]:
+        """The first IDENTIFIER found in this normalised text of values (no keys), as `found` reads identifiers."""
+        return OffLimitsTerms(identifiers=self.identifiers).found(text, values=text) if self.identifiers else None
+
+    @property
+    def loose(self) -> frozenset:
+        """The names looked for anywhere in the text (carried and waiting, or written with no spaces)."""
+        return self._loose
+
 
 def terms_of(record: Dict[str, Any]) -> OffLimitsTerms:
     """The names and identifiers of ONE entry as the store returns it (``BlackholeStore.list``): its stored name, a
@@ -350,7 +429,11 @@ def terms_of(record: Dict[str, Any]) -> OffLimitsTerms:
     fresh = normalize_entity_name(str(record.get("canonical_name") or ""))
     if fresh and not (record.get("normalized_name") in identifiers):
         names.add(fresh)
-    return OffLimitsTerms(names - identifiers - {""}, identifiers)
+    names -= identifiers | {""}
+    # Carried and waiting (BL-112 left them as they were): the whole entry, or the names the upgrade added to one
+    # the owner made. Only the entries the owner made, and carried ones he made fully Off-limits, read whole words.
+    loose = names if record.get("carried_waiting") else names & set(record.get("carried_waiting_aliases") or [])
+    return OffLimitsTerms(names, identifiers, loose=loose)
 
 
 class BlackholeStore:
@@ -482,11 +565,13 @@ class BlackholeStore:
         """Every name and identifier this view sees, for a reader that scans text (``OffLimitsTerms``)."""
         names: Set[str] = set()
         identifiers: Set[str] = set()
+        loose: Set[str] = set()
         for record in self.list(view=view):
             one = terms_of(record)
             names |= one.names
             identifiers |= one.identifiers
-        return OffLimitsTerms(names, identifiers)
+            loose |= one.loose
+        return OffLimitsTerms(names, identifiers, loose=loose)
 
     @staticmethod
     def _row_to_dict(row: Sequence[Any]) -> Dict[str, Any]:

{topos_node-1.5.0 → topos_node-1.5.2}/topos/features/lifecycle/blackhole_guard.py

@@ -350,19 +350,27 @@ class BlackholeGuard:
     # ------------------------------------------------- free-text egress scan
 
     def text_mentions_blackholed(self, text: Optional[str]) -> bool:
-        """Substring scan for any protected name or alias.
+        """Scan for any protected name or alias.
 
         The belt to the id-join's suspenders: a mention the resolver never bound
         (a new nickname, a misspelling it did not fuzzy-match) carries no
         entity_id to filter on, so high-stakes egress — routine email, grantee
         answers — scans the rendered text as well.
 
-        A name is looked for anywhere in the text, as it always was. A handle, a
-        username or an id is looked for only as itself (`OffLimitsTerms`).
+        A name as `OffLimitsTerms` reads it (BL-112: a name under 4 characters as
+        whole words, a longer one anywhere); a handle, a username or an id only as
+        itself. A value that is not a string (a dict, a list) is read by its string
+        VALUES joined, never by its `str()` (review R-N1-151 L6: that turns a
+        newline into the letters "\\n" glued to the next word).
         """
         if self.sees_everything or not text:
             return False
-        haystack = normalize_entity_name(str(text))
+        if not isinstance(text, str):
+            from .blackhole_llm import text_of
+
+            # Values only, not keys (review R-N1-151 R2 N5): no caller passes a dict keyed by a person's name today.
+            text = text_of(text)
+        haystack = normalize_entity_name(text)
         if not haystack:
             return False
         return self._blocked_terms().found_in(haystack)
@@ -433,23 +441,27 @@ class CarriedItems:
     taken on the word of a catalog read inside a read. A caller that is itself inside a transaction, and a
     database with no file, are read through the caller's own connection. `close()` ends the read."""
 
-    def __init__(self, conn: sqlite3.Connection) -> None:
+    def __init__(self, conn: sqlite3.Connection, *, waiting: Any = None) -> None:
+        """`waiting` is the boundary's own (`EntityBoundary(waiting=...)`): the entries that are carried and waiting
+        (the default, ONLY_WAITING), every entry (True), or the entries as the owner's own client reads them (False);
+        the last two are the query pipeline's rule for the entries one request reads (BL-112, `entries_items`)."""
         from urllib.parse import quote
 
         from ...permissions_v2.entity_boundary import ONLY_WAITING, EntityBoundary
 
+        waiting = ONLY_WAITING if waiting is None else waiting
         self._own: Optional[sqlite3.Connection] = None
         path = conn.execute("PRAGMA database_list").fetchone()[2]
         if path and not conn.in_transaction:
             self._own = sqlite3.connect("file:" + quote(path, safe="/") + "?mode=ro", uri=True)
             try:
                 self._own.execute("BEGIN")
-                self._boundary = EntityBoundary(self._own, waiting=ONLY_WAITING)
+                self._boundary = EntityBoundary(self._own, waiting=waiting)
             except BaseException:
                 self.close()
                 raise
         else:
-            self._boundary = EntityBoundary(conn, waiting=ONLY_WAITING)
+            self._boundary = EntityBoundary(conn, waiting=waiting)
 
     def close(self) -> None:
         """End this rule's own read. Safe to call twice; a rule that read through its caller's connection has
@@ -583,6 +595,26 @@ def carried_items_for_routine(conn: Optional[sqlite3.Connection], principal: Any
     return carried
 
 
+def entries_items(conn: Optional[sqlite3.Connection], view: str) -> Optional[CarriedItems]:
+    """The query pipeline's rule for the Off-limits entries one request reads, applied to EACH ITEM of its answer
+    (BL-112 (2), the owner's ruling of 8 Oct 2026: an entry hides its items and releases the rest). Until then any
+    entry the owner made closed the derived modes to every caller but his app: his outside AI client and his
+    routines got no summaries at all. Built on the share boundary itself, as the routine lane's rule for what is
+    carried (`CarriedItems`): by the ids an item carries and the records the person is mentioned in, and in its text
+    the way the boundary reads names; an item it cannot judge is withheld.
+
+    The entries are those of `view`: the owner's own client reads them without what is carried and waiting (OWNER),
+    every other reader reads every entry. None when there is none. RAISES when there is one and the boundary over it
+    cannot be built: every caller treats that as the floor, never as "nothing is Off-limits"."""
+    if conn is None:
+        return None
+    rule = CarriedItems(conn, waiting=view != OWNER)
+    if not rule.active:
+        rule.close()
+        return None
+    return rule
+
+
 def guard_for(
     conn: sqlite3.Connection,
     *,

{topos_node-1.5.0 → topos_node-1.5.2}/topos/features/lifecycle/blackhole_llm.py

@@ -15,7 +15,8 @@ own data — the protected entity's records would silently rot while every other
 record improved. Refusal is reserved for the case where no secure provider can
 serve the task at all.
 
-**Taint is a substring scan, and that is a floor, not a ceiling.** Structured
+**Taint is a text scan, and that is a floor, not a ceiling.** (Names as the share boundary reads them: a
+short name as a whole token with its forms, a long one anywhere; BL-112.) Structured
 taint (record ids joined through `entity_mentions`) is exact and belongs at the
 call sites that have ids to hand; this module catches the rest — free text
 assembled from who-knows-where. A scan cannot see a paraphrase or a nickname the
@@ -96,6 +97,35 @@ def _blackhole_rows(conn: sqlite3.Connection):
     return BlackholeStore(conn).list(view=for_own_processing())
 
 
+def _boundary_names_hit(names, raw_text: str) -> bool:
+    """Whether the share boundary's own matcher (`entity_boundary.text_hits`) finds any of these names in this raw
+    text, in ONE pass over all of them (review R-N1-151 R2 N3: one pass per name cost 0.80 s on a 115 KB payload with
+    24 names). Any text the boundary cannot read is a hit (its own rule: fail closed)."""
+    if not names or not raw_text:
+        return False
+    from ...permissions_v2.entity_boundary import skeleton, split_terms, text_hits
+
+    keys = {skeleton(name) for name in names} - {""}
+    if not keys:
+        return False
+    short, long_terms = split_terms(keys)
+    try:
+        return bool(text_hits(raw_text, short, long_terms))
+    except Exception:  # noqa: BLE001 -- a text the boundary cannot read is treated as protected
+        return True
+
+
+def _names_hit(terms, raw_text: str, haystack: str) -> bool:
+    """One entry's names at the gate: as the share boundary reads them, and (WS0's ruling on N1) a name in the Arabic
+    or Hebrew script also anywhere, as 1.5.0 read it (a clitic is written joined to the front of a name)."""
+    from .blackhole import OffLimitsTerms, clitic_script
+
+    clitic = {name for name in terms.names if clitic_script(name)}
+    if clitic and OffLimitsTerms(names=clitic).found(haystack) is not None:
+        return True
+    return _boundary_names_hit(terms.names, raw_text)
+
+
 def evaluate(
     conn: Optional[sqlite3.Connection],
     payload: Any,
@@ -120,7 +150,8 @@ def evaluate(
     if not rows and not record_floor:
         return EgressVerdict(False, frozenset(), (), provider=configured)
 
-    haystack = normalize_entity_name(text_of(payload))
+    raw_text = text_of(payload)
+    haystack = normalize_entity_name(raw_text)
     if not haystack and not record_floor:
         return EgressVerdict(False, frozenset(), (), provider=configured)
 
@@ -132,10 +163,25 @@ def evaluate(
     allowed: Optional[Set[str]] = set(LOCAL_PROVIDERS) if record_floor else None
     from .blackhole import terms_of
 
-    for row in rows:
-        # A name anywhere in the text, as before; a handle, a username or an id only as itself. The text is the
-        # payload's values (`text_of`): it has no keys to leave out.
-        hit = terms_of(row).found(haystack, values=haystack)
+    # A NAME as the share boundary itself reads one (WS0's rulings on BL-112, review R-N1-151 H2 and R2 N1-N3): a term
+    # under 4 characters as a whole token with its forms, a longer one anywhere separator-free, a name in the Arabic or
+    # Hebrew script anywhere; a handle, a username or an id only as itself (`OffLimitsTerms`). First ONE pass over every
+    # entry's names together, as a fast "no" (N3); per entry only on a hit, to take the strictest tier.
+    every = [(row, terms_of(row)) for row in rows]
+    names = {name for _row, terms in every for name in terms.names}
+    any_hit = (_boundary_names_hit(names, raw_text)
+               or any(_names_hit(terms, "", haystack) for _row, terms in every)
+               or any(terms.identifiers_found(haystack) for _row, terms in every))
+    tiers = {row["processing_tier"] for row in rows}
+    if any_hit and len(tiers) == 1:
+        # Every entry has the one tier: which entry hit changes nothing, so no pass per entry.
+        matched.append("off_limits_name")
+        tier = TIER_PROVIDERS.get(next(iter(tiers)), TIER_PROVIDERS["local_only"])
+        allowed = set(tier) if allowed is None else (allowed & set(tier))
+        any_hit = False
+    for row, terms in every if any_hit else ():
+        hit = (next(iter(sorted(terms.names)), None) if terms.names and _names_hit(terms, raw_text, haystack)
+               else terms.identifiers_found(haystack))
         if hit is None:
             continue
         matched.append(hit)
@@ -143,6 +189,10 @@ def evaluate(
         # Several protected entities in one payload means the strictest wins:
         # the intersection, never the union.
         allowed = set(tier) if allowed is None else (allowed & set(tier))
+    # Not read here (WS0's ruling on review R-N1-151 R2 N2): the boundary's closure (an entry's name parts, linked
+    # aliases and learned spellings, contacts and their handles). `EntityBoundary.mentions_protected` once per call cost
+    # 0.107 s on a 115 KB payload with 24 entries, over the gate's 0.12 s budget with the names' pass (0.024 s). As in
+    # 1.5.0, a payload naming the person only by a first name or a surname goes to the configured provider.
 
     if not matched:
         return EgressVerdict(False, frozenset(), (), provider=configured)

{topos_node-1.5.0 → topos_node-1.5.2}/topos/permissions_v2/answer_checks.py

@@ -9,7 +9,7 @@ import re
 import unicodedata
 from dataclasses import dataclass
 
-TEMPLATE_VERSION = "topos-answer-template/v3"
+TEMPLATE_VERSION = "topos-answer-template/v6"
 _CITATION = re.compile(r"\[(\d+(?:\s*[,;]\s*\d+)*)\]")
 _SENTENCE_END = re.compile(r'''[.!?]+["'”’)]*(?:\s*\[\d+(?:\s*[,;]\s*\d+)*\])*(?=\s|$)''')
 _BULLET = re.compile(r"^([-*•]|\d+[.)])\s+")
@@ -22,6 +22,35 @@ _NSFW_TOKENS = ("nsfw", "xxx")
 _QUESTION_SCAFFOLD = frozenset({"happened", "anything", "according", "available", "describe", "discussed",
     "explain", "information", "mentioned", "meaning", "reference", "references", "regarding", "remember",
     "specific", "something", "summarize", "summary", "updated", "updates", "yesterday", "tomorrow"})
+# BL-146 (A2A-4 amendment 4): request words of the recipients' question shapes (the eval catalog's) that never name a
+# subject an item could carry. Each was a subject before, so every such question abstained or dropped every sentence:
+# - whose share it is: every item a share releases is its owner's own, written in the first person, so no item says
+#   "owner" (the reason "shared" is a question word); nor a pronoun for the owner (round 2; the shorter pronouns,
+#   "she", "him", "they", are never subjects at all, being under five letters). The owner's own names are per node:
+#   answer_generation.owner_party_words;
+# - the share's own record forms: a message, chat, record or entry is what every item is, not what it is about;
+# - how to answer: "Cite the supporting evidence", "described", "mentioned", "discussed", "written", and
+#   "question(s)" ("Quick question: ..."; round 4 add-on, WS0);
+# - when: "lately", "recently"; the share's window already bounds every item's time.
+# A subject word stays one: "trips", "glass", "Olympics", "holidays", "relationships", "projects", "career",
+# "statements". Both rules read this list after the fold: the anchor rule (8 letters or more) and the subject check.
+FORM_WORDS = frozenset({"owner", "owners", "herself", "himself", "theirs", "themself", "themselves",
+    "message", "messages", "chat", "chats", "record", "records", "entry", "entries",
+    "cite", "evidence", "support", "supporting", "supported", "describe", "described", "mention", "mentioned",
+    "discuss", "discussed", "written", "question", "questions",
+    "lately", "recent", "recently"})
+# A2A-4 amendment 5 (AR152 class I, 1.5.2): the catalog templates' own instruction words, a second closed list read
+# exactly like FORM_WORDS by the anchor rule (`_SCAFFOLD_FOLDS`) and the subject check
+# (answer_generation._GENERIC_QUESTION_TERMS), after the fold. They say how to answer ("Separate stated facts from
+# inference", "Only report what the messages state", "Do not connect unrelated messages or infer chronology", "Name
+# topics only, never pages", "going by their browsing"), never what an item is about; a supported sentence for every
+# fact, goal, relationship and interest template, and the goals, home and family questions, was dropped for want of
+# one. It only stops requiring words no item can carry: names still bind, an unknown word still echoes, every other
+# subject word still binds. Not in it, by WS0's ruling: "relationships", "people", "spend", "goal", "topic"
+# (singular). Pinned by an exact-set test; adding a word is an amendment.
+INSTRUCTION_WORDS = frozenset({"stated", "state", "states", "report", "guess", "inference", "infer", "separate",
+    "statement", "statements", "explicit", "explicitly", "connect", "unrelated", "chronology", "establish",
+    "establishes", "around", "pursue", "going", "browsing", "browse", "topics", "never", "pages", "page"})
 
 
 def _redact_phone(match: re.Match[str]) -> str:
@@ -109,13 +138,24 @@ _UNDOUBLED = frozenset("bdgmnprt")
 
 
 def _vowel(word: str, i: int) -> bool:
-    """A vowel letter: "y" after a consonant is one ("story"), "u" after "q" is not ("quite")."""
+    """A vowel letter: "y" after a consonant is one ("story"), "u" after "q" is not ("quite").
+
+    A run of "y" alternates (consonant, vowel, consonant…) from the letter before it, counted without recursion, so
+    a long run in a question folds like any word instead of ending the answer as `model_error` (BL-144)."""
     letter = word[i]
     if letter in "aeio":
         return True
     if letter == "u":
         return i == 0 or word[i - 1] != "q"
-    return letter == "y" and i > 0 and not _vowel(word, i - 1)
+    if letter != "y":
+        return False
+    start = i
+    while start > 0 and word[start - 1] == "y":
+        start -= 1
+    # word[start] is the run's first "y": a vowel when a consonant comes before it, a consonant at the start or after
+    # a vowel. Each later "y" in the run is the opposite of the one before it.
+    first = start > 0 and not _vowel(word, start - 1)
+    return first if (i - start) % 2 == 0 else not first
 
 
 def _measure(stem: str) -> int:
@@ -176,31 +216,78 @@ def _stem(word: str) -> str:
 
 
 # A word is scaffold when its fold is the fold of a scaffold word ("explained" is "explain", "happening" "happen").
-_SCAFFOLD_FOLDS = frozenset(_stem(word) for word in _QUESTION_SCAFFOLD)
+_SCAFFOLD_FOLDS = frozenset(_stem(word) for word in _QUESTION_SCAFFOLD | FORM_WORDS | INSTRUCTION_WORDS)
 
 
 def question_anchors(question: str) -> frozenset[str]:
     return frozenset(word for word in _tokens(question) if len(word) >= 8 and _stem(word) not in _SCAFFOLD_FOLDS)
 
 
+def _suffix_step(word: str) -> str:
+    """One suffix off: the fold's first step, with "-es" after a hiss taken as one suffix ("lunches" to "lunch",
+    "classes" to "class"), never two ("cannings" to "canning", never "can")."""
+    step = _fold_once(word)
+    if word.endswith("es") and step == word[:-1] and (after := _fold_once(step)) == step[:-1]:
+        return after
+    return step
+
+
+def _forms_within_one_suffix(words) -> set[str]:
+    """Each word as written and with one suffix off."""
+    return {form for word in words for form in (word, _suffix_step(word))}
+
+
+def _within_one_suffix(word: str, forms: set[str]) -> bool:
+    """`word` and some word of `forms` (built by `_forms_within_one_suffix`) are at most one suffix apart each:
+    "meetings" and "meeting", "compilers" and "compiler", "stories" and "story", "updating" and "update"."""
+    return word in forms or _suffix_step(word) in forms
+
+
 def question_only_anchors(question: str, raw_texts: tuple[str, ...]) -> frozenset[str]:
     """Distinctive question words absent, in every form, from every item the model may see.
 
     An invented or protected word supplied by the asker is not evidence that
     the share contains it. A short common question word is not an anchor. A
-    word is present when its fold is the fold of an item's word ("meetings"
-    and "meeting").
+    word is present when it and an item's word are at most one suffix apart
+    ("meetings" and "meeting"). The whole fold is not enough (BL-144): it takes
+    two suffixes off a name shaped as a word plus "-ings" ("cannings" to "can",
+    "herrings" to "her"), so a supplied name no item carries would count as
+    present wherever an item says the short word, the model would run on it,
+    and its echo of the name would be kept.
     """
-    item_words = {_stem(word) for raw in raw_texts for word in _tokens(raw)}
-    return frozenset(word for word in question_anchors(question) if _stem(word) not in item_words)
+    item_forms = _forms_within_one_suffix(word for raw in raw_texts for word in _tokens(raw))
+    return frozenset(word for word in question_anchors(question) if not _within_one_suffix(word, item_forms))
 
 
 def echoes_question_only_word(sentence: str, echoes: frozenset[str]) -> bool:
-    """The sentence uses a question-only anchor in any of its forms."""
+    """The sentence uses a question-only anchor in any of its forms (the whole fold: the safe side drops more)."""
     folds = {_stem(word) for word in echoes}
     return any(_stem(word) in folds for word in _tokens(sentence))
 
 
+def protected_question_words(question: str, raw_texts: tuple[str, ...], boundary) -> frozenset[str]:
+    """The forms of the asker's own words that name someone Off-limits where the boundary does not read them.
+
+    The answer pass refuses a question the boundary reads as protected before the model runs. A name written in lower
+    case, or as an "-ies" plural of a "-y" name, is not read there (a part that is a word in lower case is a word),
+    and when no item carries it as written it can come back in the model's sentence first, in lower case, or in the
+    same plural, where the boundary does not read it either (BL-144). For each question word no item carries as
+    written, this returns the word as written and with one suffix off ("cherries", "cherry") wherever the boundary
+    reads that form, written as a name, as protected."""
+    item_words = {word for raw in raw_texts for word in _tokens(raw)}
+    forms = {form for word in _tokens(question) if len(word) >= 3 and word not in item_words
+             for form in (word, _suffix_step(word))}
+    if not forms or not boundary.mentions_protected("\n".join(sorted(form.capitalize() for form in forms))):
+        return frozenset()
+    return frozenset(form for form in forms if boundary.mentions_protected(form.capitalize()))
+
+
+def echoes_protected_word(sentence: str, forms: frozenset[str]) -> bool:
+    """The sentence uses one of `forms` (from `protected_question_words`) as written or with one suffix more, in any
+    case: "cherries" or "Cherry" for "cherry"; "fielding" or "Fieldings" for "fieldings"."""
+    return bool(forms) and any(word in forms or _suffix_step(word) in forms for word in _tokens(sentence))
+
+
 def _runs(tokens: list[str], n: int) -> set[tuple[str, ...]]:
     return {tuple(tokens[i:i+n]) for i in range(len(tokens) - n + 1)}
 

topos_node-1.5.2/topos/permissions_v2/answer_gate.py

@@ -0,0 +1,48 @@
+"""The answer model is also the labelling model (A2A-4 Q4): background assessments yield to answers.
+
+An answers-mode ask is one call of the pinned local model with a person waiting for it. The node's background
+assessments (the catch-up's message labels, the browsing-interest labels and their second tries) call the same
+model on the same host, back to back, so an ask queues behind them on the host (BL-147: 17 s p50 live, about 3 s of
+it the model's own work). Q4's rule, which 1.5.0 counted but never applied: no assessment call starts while an
+answer job is queued or running; a call already running is not interrupted.
+
+This module only counts and waits. It imports nothing of the node, so any model caller may use it. The wait is
+bounded by an answer's own deadline (`answer_release.MAX_END_SECONDS`), so a count that never came down cannot
+stop the labelling for good. Waiting changes when an assessment runs, never what it decides or what is shared.
+"""
+from __future__ import annotations
+
+import asyncio
+import threading
+import time
+
+# An answer job ends, with or without a body, by its deadline (answer_release.MAX_END_SECONDS, 110 s from acceptance).
+LIMIT_SECONDS = 110.0
+POLL_SECONDS = 0.25
+
+_lock = threading.Lock()
+_active = 0
+
+
+def active() -> bool:
+    """An answer job is queued or running in this process."""
+    with _lock:
+        return _active > 0
+
+
+def delta(change: int) -> None:
+    global _active
+    with _lock:
+        _active += change
+
+
+async def yield_to_answers(*, limit: float = LIMIT_SECONDS, poll: float = POLL_SECONDS, clock=time.monotonic) -> float:
+    """Wait, before an assessment call starts, until no answer job is queued or running, or `limit` seconds passed.
+
+    Returns the seconds waited (0.0 when no answer was in hand)."""
+    if not active():
+        return 0.0
+    started = clock()
+    while active() and clock() - started < limit:
+        await asyncio.sleep(poll)
+    return clock() - started