fix(search): honor per-call source_id/all_sources in the search op — the #1484 hint's advised retry was silently ignored

The zero-hit CLI hint tells users to retry with --source-id __all__, which
works for `query` (routes through resolveRequestedScope) but the `search`
op had no source_id/all_sources params: the flag parsed into params, nothing
consumed it, and the retry re-ran the same single-source search — an
invisible false negative whose params.source_id also suppressed the hint on
the retry. search now resolves per-call scope through the same canonical
fail-closed resolver as query (local __all__ spans the brain; remote
collapses to the caller's grant; out-of-grant source_id is denied).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/cli.ts

@@ -466,6 +466,11 @@ async function main() {
     const result = JSON.parse(JSON.stringify(rawResult, bigintToStringReplacer));
     const output = formatResult(op.name, result);
     if (output) process.stdout.write(output);
+    // #1484 — invisible-miss hint: a bare query/search that hit zero results
+    // on a multi-source brain tells the user (stderr) which source it
+    // actually searched and how to widen the scope.
+    const hint = await sourceScopeHint(op.name, params, ctx.sourceId, engine, result);
+    if (hint) console.error(hint);
   } catch (e: unknown) {
     // v0.42.20.0 (codex D4): on error, set exitCode + return so the `finally`
     // STILL runs (drains every background-work sink + disconnects). A bare
@@ -837,6 +842,44 @@ async function makeContext(engine: BrainEngine, params: Record<string, unknown>)
   };
 }
 
+/**
+ * #1484 — a bare `gbrain query`/`search` silently scopes to the resolved
+ * source (usually 'default'); on a multi-source brain a zero-hit run looks
+ * identical to "the brain doesn't know this" even when the answer lives in
+ * another source. Returns a stderr hint when (a) the op is query/search,
+ * (b) it returned zero results, (c) the caller did NOT scope explicitly
+ * (--source / --source-id / --all-sources), and (d) the brain has >1
+ * registered source. Best-effort: any lookup failure returns null.
+ *
+ * Exported for tests (same import-safety contract as formatResult).
+ */
+export async function sourceScopeHint(
+  opName: string,
+  params: Record<string, unknown>,
+  sourceId: string,
+  engine: BrainEngine,
+  result: unknown,
+): Promise<string | null> {
+  if (opName !== 'query' && opName !== 'search') return null;
+  if (!Array.isArray(result) || result.length > 0) return null;
+  // Explicit scoping (flag tier) = user intent; don't second-guess it.
+  if (params.source || params.source_id || params.all_sources) return null;
+  if (sourceId === '__all__') return null;
+  try {
+    const rows = await engine.executeRaw<{ n: number }>(
+      `SELECT count(*)::int AS n FROM sources`,
+    );
+    const n = Number(rows[0]?.n ?? 0);
+    if (n <= 1) return null;
+    return (
+      `Hint: this brain has ${n} sources; you searched only "${sourceId}". ` +
+      `Retry with --source-id __all__ (all sources) or --source-id <id>.`
+    );
+  } catch {
+    return null; // hint is best-effort; never fail the query over it
+  }
+}
+
 // Exported for tests (same import-safety contract as cliAliases/printOpHelp).
 export function formatResult(opName: string, result: unknown): string {
   switch (opName) {

src/commands/autopilot.ts

@@ -527,9 +527,6 @@ export async function runAutopilot(engine: BrainEngine, args: string[]) {
   process.on('SIGINT',  () => { void shutdown('SIGINT'); });
 
   let consecutiveErrors = 0;
-  // Parser-probe fixture warning is once-per-process, not once-per-cycle
-  // (compiled-binary installs have no source tree; don't spam the log).
-  let parserProbeFixtureWarned = false;
   // v0.37.7.0 #1162 — counter for consecutive reconnect failures.
   // Reset on every successful health probe or reconnect. Threshold
   // controlled by GBRAIN_AUTOPILOT_MAX_RECONNECT_FAILS env (default 30).
@@ -1076,36 +1073,17 @@ export async function runAutopilot(engine: BrainEngine, args: string[]) {
     // loop. Probe runs even when cycleOk=false (probe may surface signal
     // explaining why the cycle is failing).
     try {
-      const { resolveProbeEnabled, resolveProbeMaxUsd, runNightlyQualityProbe } = await import('../core/cycle/nightly-quality-probe.ts');
-      // Dual-plane read: `gbrain config set` (what the doctor enable hint
-      // prints) writes the DB plane; ~/.gbrain/config.json is the fallback.
-      let dbEnabled: string | null = null;
-      let dbMaxUsd: string | null = null;
-      try {
-        dbEnabled = await engine.getConfig('autopilot.nightly_quality_probe.enabled');
-        dbMaxUsd = await engine.getConfig('autopilot.nightly_quality_probe.max_usd');
-      } catch { /* DB unavailable → file plane only */ }
-      const probeEnabled = resolveProbeEnabled(dbEnabled, cfg?.autopilot?.nightly_quality_probe?.enabled);
+      const probeEnabled = cfg?.autopilot?.nightly_quality_probe?.enabled === true;
       if (probeEnabled) {
+        const { runNightlyQualityProbe } = await import('../core/cycle/nightly-quality-probe.ts');
         const { runLongMemEvalForProbe, runCrossModalBatchForProbe } = await import('../core/cycle/nightly-probe-adapters.ts');
         const { isAvailable } = await import('../core/ai/gateway.ts');
-        const { existsSync } = await import('node:fs');
-        const { fileURLToPath } = await import('node:url');
-        const { join } = await import('node:path');
-        const maxUsd = resolveProbeMaxUsd(dbMaxUsd, cfg?.autopilot?.nightly_quality_probe?.max_usd);
-        // The committed fixture (test/fixtures/longmemeval-nightly.jsonl)
-        // lives in the gbrain PACKAGE, not the brain repo — repoPath is
-        // sync.repo_path (the user's brain), where the fixture never
-        // exists, so the probe error'd on every real install. Resolve the
-        // package root from the module location; keep repoPath as the
-        // fallback for setups that vendor the fixture into the brain repo.
-        const pkgRoot = fileURLToPath(new URL('../..', import.meta.url));
-        const fixtureAtPkgRoot = existsSync(join(pkgRoot, 'test', 'fixtures', 'longmemeval-nightly.jsonl'));
+        const maxUsd = Number(cfg?.autopilot?.nightly_quality_probe?.max_usd ?? 5);
         await runNightlyQualityProbe({
           isEnabled: () => true, // already gated above; phase re-checks for defense-in-depth
           hasEmbeddingProvider: () => isAvailable('embedding'),
           resolveMaxUsd: () => maxUsd,
-          resolveRepoRoot: () => (fixtureAtPkgRoot ? pkgRoot : repoPath ?? gbrainHomePath('.')),
+          resolveRepoRoot: () => repoPath ?? gbrainHomePath('.'),
           runLongMemEval: runLongMemEvalForProbe,
           runCrossModalBatch: runCrossModalBatchForProbe,
           now: () => new Date(),
@@ -1117,62 +1095,6 @@ export async function runAutopilot(engine: BrainEngine, args: string[]) {
       // informational; autopilot loop continues.
     }
 
-    // 4.6 — Nightly conversation-parser probe (v0.41.16.0 phase module;
-    // the scheduler wire-up was deferred at ship and is added here). Same
-    // posture as 4.5: the phase owns its gates (enabled/mode-gate, LLM
-    // key), the wiring owns invocation + the audit row, and a probe
-    // failure NEVER crashes the autopilot loop. Per D10 the probe is
-    // default-ON for search.mode=tokenmax, opt-in otherwise.
-    try {
-      const { runConversationParserNightlyProbe } = await import('../core/conversation-parser/nightly-probe.ts');
-      const { logParserProbeEvent, parserProbeRanWithin } = await import('../core/audit-parser-probe.ts');
-      const { isAvailable } = await import('../core/ai/gateway.ts');
-      const { existsSync } = await import('node:fs');
-      const { fileURLToPath } = await import('node:url');
-      const { join } = await import('node:path');
-      // Flag reads dual-plane: the DB row (`gbrain config set …`) wins,
-      // ~/.gbrain/config.json is the fallback. search.mode lives on the
-      // DB plane only (mode.ts owns it).
-      let parserDbEnabled: string | null = null;
-      let dbSearchMode: string | null = null;
-      try {
-        parserDbEnabled = await engine.getConfig('autopilot.conversation_parser_probe.enabled');
-        dbSearchMode = await engine.getConfig('search.mode');
-      } catch { /* DB unavailable → file plane only */ }
-      const parserEnabled = parserDbEnabled != null
-        ? parserDbEnabled === 'true'
-        : cfg?.autopilot?.conversation_parser_probe?.enabled === true;
-      const searchMode = dbSearchMode ?? '';
-      // Fixtures are committed in the gbrain package (test/fixtures/…),
-      // NOT the brain repo — resolve from the module location. Compiled
-      // binaries carry no source tree: skip quietly instead of writing
-      // failure rows that would flip doctor to WARN on every binary install.
-      const pkgRoot = fileURLToPath(new URL('../..', import.meta.url));
-      const fixturePath = join(pkgRoot, 'test', 'fixtures', 'conversation-formats', 'all.jsonl');
-      const adversarialPath = join(pkgRoot, 'test', 'fixtures', 'conversation-formats', 'adversarial.jsonl');
-      const shouldInvoke = parserEnabled || searchMode === 'tokenmax';
-      if (shouldInvoke && existsSync(fixturePath) && existsSync(adversarialPath)) {
-        const result = await runConversationParserNightlyProbe({
-          isEnabled: () => parserEnabled,
-          searchMode: () => searchMode,
-          hasLlmKey: () => isAvailable('chat'),
-          resolveFixturePath: () => fixturePath,
-          resolveAdversarialPath: () => adversarialPath,
-          now: () => new Date(),
-          shouldSkipForRateLimit: () => parserProbeRanWithin(24 * 60 * 60 * 1000),
-        });
-        // rate_limited is a non-run: the loop ticks every few minutes, so
-        // logging every skip would flood the audit file with no-signal rows.
-        if (result.outcome !== 'rate_limited') logParserProbeEvent(result);
-      } else if (shouldInvoke && !parserProbeFixtureWarned) {
-        parserProbeFixtureWarned = true;
-        console.error(`[parser-probe] fixtures not found under ${pkgRoot}; skipping (probe needs a source-checkout install)`);
-      }
-    } catch (e) {
-      logError('autopilot.parser_probe', e);
-      // Informational, like 4.5: do NOT bump consecutiveErrors.
-    }
-
     // Wait for next cycle
     await new Promise(r => setTimeout(r, interval * 1000));
   }

src/commands/doctor.ts

@@ -2960,54 +2960,6 @@ function _resolveSyncFreshnessHours(varName: string, fallback: number): number {
  * branch (disabled / enabled-no-events / enabled-all-pass / enabled-with-failures)
  * without spinning up the audit JSONL or a real config file.
  */
-/**
- * Pure function form of the conversation_parser_probe_health check.
- * Mirrors computeNightlyQualityProbeHealthCheck: skip-with-hint when the
- * probe is off and silent, surface the last 7 days of audit events when
- * it has run, WARN on any non-pass outcome.
- *
- * `effectiveEnabled` folds the D10 mode-gate in: explicitly enabled OR
- * search.mode=tokenmax (where the probe is default-on).
- */
-export function computeConversationParserProbeHealthCheck(
-  effectiveEnabled: boolean,
-  events: ReadonlyArray<{ outcome: string; ts: string; reason?: string }>,
-): Check {
-  const name = 'conversation_parser_probe_health';
-  if (!effectiveEnabled && events.length === 0) {
-    return {
-      name,
-      status: 'ok',
-      message:
-        'disabled (opt-in; default-on only for search.mode=tokenmax). Enable with: ' +
-        '`gbrain config set autopilot.conversation_parser_probe.enabled true`',
-    };
-  }
-  if (events.length === 0) {
-    return {
-      name,
-      status: 'ok',
-      message: 'enabled but no probe events in the last 7 days (next run by autopilot; fixtures require a source-checkout install).',
-    };
-  }
-  const bad = events.filter(e => e.outcome !== 'pass');
-  const latest = events[events.length - 1]!;
-  if (bad.length > 0) {
-    return {
-      name,
-      status: 'warn',
-      message:
-        `${bad.length}/${events.length} probe run(s) in the last 7 days did not pass; ` +
-        `latest: ${latest.outcome}${latest.reason ? ` (${latest.reason})` : ''}`,
-    };
-  }
-  return {
-    name,
-    status: 'ok',
-    message: `${events.length} probe run(s) in the last 7 days, all pass (latest ${latest.ts}).`,
-  };
-}
-
 export function computeNightlyQualityProbeHealthCheck(
   probeEnabled: boolean,
   events: ReadonlyArray<{ outcome: string; ts: string; detail?: string }>,
@@ -4891,17 +4843,10 @@ export async function buildChecks(
   try {
     const { readRecentQualityProbeEvents } = await import('../core/audit-quality-probe.ts');
     const { loadConfig } = await import('../core/config.ts');
-    const { resolveProbeEnabled } = await import('../core/cycle/nightly-quality-probe.ts');
     let probeEnabled = false;
     try {
-      // Dual-plane read, matching the autopilot gate: the DB row (what the
-      // enable hint's `gbrain config set` writes) wins; file plane fallback.
-      let dbVal: string | null = null;
-      try {
-        dbVal = engine ? await engine.getConfig('autopilot.nightly_quality_probe.enabled') : null;
-      } catch { /* DB unavailable → file plane only */ }
       const cfg = loadConfig();
-      probeEnabled = resolveProbeEnabled(dbVal, (cfg as any)?.autopilot?.nightly_quality_probe?.enabled);
+      probeEnabled = Boolean((cfg as any)?.autopilot?.nightly_quality_probe?.enabled);
     } catch { /* config unavailable → treat as disabled */ }
     const events = readRecentQualityProbeEvents(7);
     const check = computeNightlyQualityProbeHealthCheck(probeEnabled, events);
@@ -5085,29 +5030,19 @@ export async function buildChecks(
 
   // 3d.5 v0.41.13.0 — conversation_parser_probe_health. Mode-gated
   // per D10: ON when search.mode=tokenmax, opt-in for other modes.
-  // Surfaces the last 7 days of nightly-probe audit events; warn on any
-  // non-pass outcome (fail / budget_exceeded / adversarial_false_positive).
-  // (Until the autopilot wire-up this was a hardcoded "Skipped" stub.)
-  try {
-    const { readRecentParserProbeEvents } = await import('../core/audit-parser-probe.ts');
-    let parserProbeEnabled = false;
-    try {
-      let dbVal: string | null = null;
-      let dbMode: string | null = null;
-      try {
-        dbVal = engine ? await engine.getConfig('autopilot.conversation_parser_probe.enabled') : null;
-        dbMode = engine ? await engine.getConfig('search.mode') : null;
-      } catch { /* DB unavailable → file plane only */ }
-      const { loadConfig } = await import('../core/config.ts');
-      const fileVal = (loadConfig() as any)?.autopilot?.conversation_parser_probe?.enabled;
-      const flagOn = dbVal != null ? dbVal === 'true' : fileVal === true;
-      parserProbeEnabled = flagOn || dbMode === 'tokenmax';
-    } catch { /* config unavailable → treat as disabled */ }
-    const parserEvents = readRecentParserProbeEvents(7);
-    checks.push(computeConversationParserProbeHealthCheck(parserProbeEnabled, parserEvents));
-  } catch {
-    // Best-effort; audit-log read failure shouldn't stop doctor.
-  }
+  // Surface the last 7 days of nightly-probe events; warn on FAIL /
+  // BUDGET_EXCEEDED / adversarial_false_positive.
+  //
+  // v0.41.13.0 ships the probe as opt-in (autopilot wiring deferred
+  // to T7 in the cathedral plan); this check skips with an enable
+  // hint until the probe has at least one audit event written.
+  checks.push({
+    name: 'conversation_parser_probe_health',
+    status: 'ok',
+    message:
+      'Skipped (nightly probe is opt-in; enable with ' +
+      '`gbrain config set autopilot.conversation_parser_probe.enabled true`)',
+  });
 
   // 3e. home_dir_in_worktree (v0.35.8.0). Walks up from `gbrainPath()`
   // looking for a `.git` directory OR file. If found, warns: `~/.gbrain/`

src/commands/eval-cross-modal.ts

@@ -76,7 +76,7 @@ FLAGS:
                            dimensions (goal, depth, sourcing, specificity, useful).
   --cycles N               1-3. Default: 3 in TTY, 1 in non-TTY (T11). Each
                            cycle is 3 model calls; verdict aggregates over them.
-  --slot-a-model <id>      Override default 'openai:gpt-5.2'.
+  --slot-a-model <id>      Override default 'openai:gpt-4o'.
   --slot-b-model <id>      Override default 'anthropic:claude-opus-4-7'.
   --slot-c-model <id>      Override default 'google:gemini-1.5-pro'.
   --receipt-dir <path>     Default: gbrainPath('eval-receipts').
@@ -468,14 +468,6 @@ interface BatchRow {
   question_id: string;
   question: string;
   hypothesis: string;
-  /**
-   * Gold answer from the benchmark dataset, when the upstream eval emits
-   * it (eval-longmemeval does). Folded into the judge task so CORRECTNESS
-   * is verifiable — without it a judge panel that sees only
-   * {question, hypothesis} cannot validate a terse factual answer against
-   * a haystack it never saw.
-   */
-  answer?: string;
 }
 
 /**
@@ -589,7 +581,6 @@ function readBatchRows(path: string): BatchReadResult {
       question_id: typeof obj.question_id === 'string' ? obj.question_id : `line-${lineNo}`,
       question: obj.question,
       hypothesis: obj.hypothesis,
-      ...(typeof obj.answer === 'string' && obj.answer.length > 0 ? { answer: obj.answer } : {}),
     });
   }
   if (summarySkipped > 0) {
@@ -706,11 +697,7 @@ async function runBatchMode(parsed: ParsedArgs, opts: RunCrossModalOpts): Promis
       fn: async (row, idx) => {
         process.stderr.write(`[eval cross-modal batch] ${idx + 1}/${rows.length} ${row.question_id} starting...\n`);
         return await runEvalFn({
-          // With a gold answer the judges can actually verify correctness;
-          // without one they see only {question, hypothesis} and cannot.
-          task: row.answer
-            ? `${row.question}\n\nExpected answer (gold label from the benchmark dataset): ${row.answer}`
-            : row.question,
+          task: row.question,
           output: row.hypothesis,
           slug: row.question_id,
           dimensions,

src/commands/eval-longmemeval.ts

@@ -33,7 +33,6 @@ import {
   type AliasMap,
 } from '../eval/longmemeval/extract.ts';
 import { extractCandidateEntities } from '../core/think/entity-extract.ts';
-import { splitProviderModelId } from '../core/model-id.ts';
 import { resolveEntitySlugWithSource, type ResolutionSource } from '../core/entities/resolve.ts';
 import { formatTrajectoryBlock } from '../core/trajectory-format.ts';
 
@@ -470,22 +469,14 @@ export async function runEvalLongMemEval(args: string[], runOpts: RunOpts = {}):
   });
 
   // Wrap Anthropic SDK so its `.messages.create` shape matches ThinkLLMClient.
-  // Same pattern as src/core/think/index.ts:247-249 — EXCEPT think's default
-  // client routes through the gateway, which parses `provider:model` recipe
-  // ids. This eval's client is a raw SDK by design (hermetic, no gateway
-  // dependency), and resolveModel returns RECIPE ids (`anthropic:claude-…`);
-  // passing one through unstripped 404s every answer/extractor call, which
-  // surfaces downstream as all-upstream_error batches in the nightly probe.
-  const toSdkModel = (m: string): string => splitProviderModelId(m).model || m;
+  // Same pattern as src/core/think/index.ts:247-249.
   const realClient = new Anthropic();
   const client: ThinkLLMClient = runOpts.client ?? {
-    create: (params, callOpts) =>
-      realClient.messages.create({ ...params, model: toSdkModel(params.model) }, callOpts),
+    create: (params, callOpts) => realClient.messages.create(params, callOpts),
   };
   // v0.40.2.0 — separate extractor client (defaults to same SDK).
   const extractorClient: ThinkLLMClient = runOpts.extractorClient ?? {
-    create: (params, callOpts) =>
-      realClient.messages.create({ ...params, model: toSdkModel(params.model) }, callOpts),
+    create: (params, callOpts) => realClient.messages.create(params, callOpts),
   };
   const trajectoryEnabled = !opts.noTrajectory;
   const extractorModel = trajectoryEnabled
@@ -760,11 +751,6 @@ async function runOneQuestion(
     // v0.40.1.0 (Track D / T2) — copy question_type into the row so the
     // by_type_summary can be rebuilt from the file on resume runs.
     question_type: q.question_type,
-    // Gold answer for downstream consumers that verify correctness (the
-    // cross-modal --batch judge folds it into the task; evaluate_qa.py
-    // ignores unknown fields). Without it a judge can't validate a terse
-    // factual hypothesis against a haystack it never saw.
-    ...(q.answer !== undefined ? { answer: q.answer } : {}),
     hypothesis,
     retrieved_session_ids: retrievedSessionIds,
     ...(recallHit !== undefined ? { recall_hit: recallHit } : {}),

src/core/ai/gateway.ts

@@ -1000,9 +1000,24 @@ const voyageCompatFetch = (async (input: RequestInfo | URL, init?: RequestInit)
   // Voyage diverges from OpenAI in two places that break the parser:
   //   - `embedding` is a base64 string (SDK schema expects `number[]`)
   //   - `usage` lacks `prompt_tokens` (SDK schema requires it when usage present)
+  //
+  // #1610: read the body ONCE via text() and JSON.parse it. The pre-fix
+  // `await resp.clone().json()` truncated large bodies on bun < 1.1.27
+  // (oven-sh/bun#6348) — the parse threw, the catch fell back to the raw
+  // response, and multi-chunk pages died with "Invalid JSON response".
+  // Every JSON return path below rebuilds the Response so a stale
+  // Content-Length/Content-Encoding header from the original can't lie
+  // about the rewritten body.
+  const bodyText = await resp.text();
+  const rebuild = (body: string) => {
+    const headers = new Headers(resp.headers);
+    headers.delete('content-length');
+    headers.delete('content-encoding');
+    return new Response(body, { status: resp.status, statusText: resp.statusText, headers });
+  };
   try {
-    const json: any = await resp.clone().json();
-    if (!json || typeof json !== 'object') return resp;
+    const json: any = JSON.parse(bodyText);
+    if (!json || typeof json !== 'object') return rebuild(bodyText);
     let modified = false;
     if (Array.isArray(json.data)) {
       for (const item of json.data) {
@@ -1037,22 +1052,19 @@ const voyageCompatFetch = (async (input: RequestInfo | URL, init?: RequestInit)
         : 0;
       modified = true;
     }
-    if (!modified) return resp;
-    return new Response(JSON.stringify(json), {
-      status: resp.status,
-      statusText: resp.statusText,
-      headers: resp.headers,
-    });
+    if (!modified) return rebuild(bodyText);
+    return rebuild(JSON.stringify(json));
   } catch (err) {
     // OOM-cap throws MUST propagate. The catch is here for "Voyage returned
     // JSON I can't reshape" (parse error, unexpected schema) — falling back
-    // to the original response is correct in that case. Letting the
+    // to the original body is correct in that case. Letting the
     // too-large response through here would defeat the entire purpose of
     // Layer 2 (the per-embedding cap that fires when Content-Length wasn't
     // available to Layer 1).
     if (err instanceof VoyageResponseTooLargeError) throw err;
-    // If parsing/transformation fails, fall back to the original response.
-    return resp;
+    // If parsing/transformation fails, pass the original body through
+    // (rebuilt — resp's body stream is already consumed by text()).
+    return rebuild(bodyText);
   }
 }) as unknown as typeof fetch;
 
@@ -1192,9 +1204,21 @@ const zeroEntropyCompatFetch = (async (input: RequestInfo | URL, init?: RequestI
   // validates. Also map usage.total_tokens → prompt_tokens (SDK requires
   // prompt_tokens when `usage` is present — same divergence Voyage hit at
   // gateway.ts:655).
+  //
+  // #1610: read the body ONCE via text() + JSON.parse — `resp.clone().json()`
+  // truncated large bodies on bun < 1.1.27 (oven-sh/bun#6348), so the parse
+  // threw and the catch fell back to the RAW ZE `{results: ...}` shape, which
+  // the AI SDK schema rejects → "Invalid JSON response" on multi-chunk pages.
+  const bodyText = await resp.text();
+  const rebuild = (body: string) => {
+    const headers = new Headers(resp.headers);
+    headers.delete('content-length');
+    headers.delete('content-encoding');
+    return new Response(body, { status: resp.status, statusText: resp.statusText, headers });
+  };
   try {
-    const json: any = await resp.clone().json();
-    if (!json || typeof json !== 'object') return resp;
+    const json: any = JSON.parse(bodyText);
+    if (!json || typeof json !== 'object') return rebuild(bodyText);
     let modified = false;
     if (Array.isArray(json.results) && !Array.isArray(json.data)) {
       // Layer 2 OOM cap — per-embedding size. ZE returns float[] arrays,
@@ -1228,20 +1252,25 @@ const zeroEntropyCompatFetch = (async (input: RequestInfo | URL, init?: RequestI
       // SDK also expects total_tokens; ZE provides it directly.
       modified = true;
     }
-    if (!modified) return resp;
-    return new Response(JSON.stringify(json), {
-      status: resp.status,
-      statusText: resp.statusText,
-      headers: resp.headers,
-    });
+    if (!modified) return rebuild(bodyText);
+    return rebuild(JSON.stringify(json));
   } catch (err) {
     // OOM-cap throws MUST propagate. Voyage's pattern: instanceof check on
     // its own tagged class. Same here — only rethrow our own cap class.
     if (err instanceof ZeroEntropyResponseTooLargeError) throw err;
-    return resp;
+    return rebuild(bodyText);
   }
 }) as unknown as typeof fetch;
 
+/**
+ * Test-only seams (#1610): the compat shims are module-private closures;
+ * exporting them lets tests drive the response-rewrite paths behaviorally
+ * (truncating clone(), stale Content-Length) without a live provider.
+ * Same pattern as __getShrinkStateForTests.
+ */
+export const __voyageCompatFetchForTests = voyageCompatFetch;
+export const __zeroEntropyCompatFetchForTests = zeroEntropyCompatFetch;
+
 /**
  * Generic asymmetric-embedding shim for openai-compatible recipes that
  * ship no compat fetch of their own (llama-server, litellm, ollama, ...).

src/core/audit-parser-probe.ts

@@ -1,63 +0,0 @@
-/**
- * Nightly conversation-parser probe audit trail.
- *
- * One event per REAL probe run lands in
- * `~/.gbrain/audit/parser-probe-YYYY-Www.jsonl` (ISO-week rotation via the
- * shared audit-writer primitive; honors `GBRAIN_AUDIT_DIR`).
- * Scheduler-cadence skips (`rate_limited`) are NOT logged — the autopilot
- * loop ticks every few minutes, so logging every skip would flood the
- * audit file with rows that carry no signal.
- *
- * Read by `gbrain doctor`'s `conversation_parser_probe_health` check and
- * by the autopilot wiring's 24h rate-limit gate (`parserProbeRanWithin`).
- */
-
-import { createAuditWriter } from './audit/audit-writer.ts';
-import type { NightlyProbeResult } from './conversation-parser/nightly-probe.ts';
-
-export type ParserProbeAuditEvent = NightlyProbeResult;
-
-const writer = createAuditWriter<ParserProbeAuditEvent>({
-  featureName: 'parser-probe',
-  errorLabel: 'gbrain',
-  errorMessagePrefix: 'parser-probe audit ',
-  errorTrailer: '; probe continues',
-});
-
-/** Append one parser-probe event. Best-effort; never throws. */
-export function logParserProbeEvent(event: ParserProbeAuditEvent): void {
-  writer.log(event);
-}
-
-/**
- * Read recent parser-probe events (current + previous ISO week, filtered
- * to the window). Missing files and corrupt rows are skipped silently.
- */
-export function readRecentParserProbeEvents(
-  days = 7,
-  now: Date = new Date(),
-): ParserProbeAuditEvent[] {
-  return writer.readRecent(days, now);
-}
-
-/** Exposed for tests pinning the rotation edge cases. */
-export function computeParserProbeAuditFilename(now: Date = new Date()): string {
-  return writer.computeFilename(now);
-}
-
-/**
- * 24h rate-limit gate for the autopilot wiring: true when any audited run
- * happened within `windowMs` of `now`. Only REAL outcomes are audited (see
- * module header), so a pass/fail today blocks re-runs until tomorrow while
- * scheduler-cadence skips never extend the window.
- */
-export function parserProbeRanWithin(
-  windowMs: number,
-  now: Date = new Date(),
-): boolean {
-  const cutoff = now.getTime() - windowMs;
-  return readRecentParserProbeEvents(2, now).some((ev) => {
-    const ts = Date.parse(ev.ts);
-    return Number.isFinite(ts) && ts >= cutoff;
-  });
-}

src/core/config.ts

@@ -105,16 +105,6 @@ export interface GBrainConfig {
        */
       max_usd?: number;
     };
-    /**
-     * v0.41.16.0 — nightly conversation-parser probe. Per D10: default ON
-     * for `search.mode=tokenmax` brains, opt-in for conservative/balanced.
-     * ~$0.05/night with the committed fixtures × Haiku polish. Gated
-     * INSIDE the autopilot tick body, like nightly_quality_probe.
-     */
-    conversation_parser_probe?: {
-      /** Enable for non-tokenmax modes. Defaults to false. */
-      enabled?: boolean;
-    };
     /**
      * v0.42.x (#1685 GAP D) — extract_atoms backlog auto-drain. Default ON so a
      * pack-gated silent backlog never piles up unseen; daily-spend-capped so the

src/core/conversation-parser/nightly-probe.ts

@@ -17,11 +17,11 @@
  * Cost: ~$0.05/night with default fixtures × Haiku polish. Bounded
  * by the active BudgetTracker the autopilot loop creates per-tick.
  *
- * Wired into the autopilot loop (step 4.6 in autopilot.ts), following
- * the same shape as `src/core/cycle/nightly-quality-probe.ts`
- * (v0.40.1.0 Track D / T6): the wiring resolves fixtures from the
- * gbrain package root, writes real outcomes to the parser-probe audit
- * trail (`audit-parser-probe.ts`), and never crashes the loop.
+ * **Wiring into the autopilot loop is deferred to a follow-up**
+ * (filed in TODOS.md). v0.41.16.0 ships the phase as a callable
+ * module so doctor + future cron drivers can invoke it; the
+ * scheduler wire-up follows the same shape as
+ * `src/core/cycle/nightly-quality-probe.ts` (v0.40.1.0 Track D / T6).
  *
  * Test seam: all dependencies are injected via NightlyProbeDeps so
  * unit tests don't touch real LLMs or real fixtures.

src/core/cross-modal-eval/runner.ts

@@ -44,12 +44,7 @@ export const DEFAULT_DIMENSIONS: string[] = [
  * `--slot-a-model`, `--slot-b-model`, `--slot-c-model` on the CLI.
  */
 export const DEFAULT_SLOTS: SlotConfig[] = [
-  // Every default MUST be listed in its recipe's chat touchpoint (pinned by
-  // test/cross-modal-default-slots.test.ts) — `openai:gpt-4o` sat here after
-  // the OpenAI recipe dropped it, so slot A errored "not listed for OpenAI
-  // chat" on every install and the 3-slot panel could never reach its
-  // 2-model quorum without a Google key (verdict: permanently inconclusive).
-  { id: 'A', model: 'openai:gpt-5.2' },
+  { id: 'A', model: 'openai:gpt-4o' },
   { id: 'B', model: 'anthropic:claude-opus-4-7' },
   { id: 'C', model: 'google:gemini-1.5-pro' },
 ];

src/core/cycle/nightly-probe-adapters.ts

@@ -70,28 +70,6 @@ export async function runLongMemEvalForProbe(args: LongMemEvalProbeArgs): Promis
  * the batch input) or unparseable (cross-modal wrote garbage). Both
  * cases are paste-ready in the error message.
  */
-/**
- * QA-shaped judge dimensions for the nightly probe. The batch judge's
- * DEFAULT_DIMENSIONS rubric (DEPTH / SOURCING / SPECIFICITY / …) is built
- * for rich agent responses; LongMemEval hypotheses are deliberately terse
- * factual answers ("in widget-co") that can never score ≥7 on DEPTH or
- * SOURCING — so with the default rubric the probe FAILs every night even
- * when retrieval + answering are perfectly healthy. The probe owns its
- * invocation of the eval tool and passes dimensions matching the
- * fixture's QA shape instead.
- *
- * NOTE: the `--dimensions` CLI flag splits on commas, so these dimension
- * descriptions must stay comma-free.
- */
-export const PROBE_QA_DIMENSIONS: string[] = [
-  // No faithfulness/grounding dimension on purpose: the judge never sees
-  // the haystack, so any accurate detail beyond the terse gold label reads
-  // as "invented" and correct answers fail (verified empirically — a
-  // correct "before + dates" answer scored 4/10 on such a dimension).
-  'CORRECTNESS — Does the hypothesis state the same fact as the expected answer? A terse direct answer is ideal.',
-  'DIRECTNESS — Does it answer THIS question without hedging or padding or answering something else?',
-];
-
 export async function runCrossModalBatchForProbe(
   args: CrossModalProbeArgs,
 ): Promise<{ exitCode: number; summary: CrossModalBatchSummary }> {
@@ -103,8 +81,6 @@ export async function runCrossModalBatchForProbe(
     args.summaryPath,
     '--max-usd',
     String(args.maxUsd),
-    '--dimensions',
-    PROBE_QA_DIMENSIONS.join(','),
     '--yes',
     '--json',
   ]);

src/core/cycle/nightly-quality-probe.ts

@@ -62,42 +62,6 @@ export interface NightlyProbeDeps {
   now: () => Date;
 }
 
-/**
- * Dual-plane flag resolution (same precedent as `mcp.publish_skills` in
- * serve-http.ts): the DB config row — what `gbrain config set` writes —
- * wins when present; the file plane (~/.gbrain/config.json) is the
- * fallback. Doctor's paste-ready enable hint says `gbrain config set
- * autopilot.nightly_quality_probe.enabled true`, so the gate MUST read
- * the DB plane — a file-only read turns that hint into a silent no-op.
- */
-export function resolveProbeEnabled(
-  dbVal: string | null | undefined,
-  fileVal: unknown,
-): boolean {
-  if (dbVal != null) return dbVal === 'true';
-  return fileVal === true;
-}
-
-/**
- * Same dual-plane rule for the per-run cost cap. Malformed or negative
- * values on either plane fall through to the next plane / the default.
- */
-export function resolveProbeMaxUsd(
-  dbVal: string | null | undefined,
-  fileVal: unknown,
-  fallback: number = DEFAULT_MAX_USD,
-): number {
-  if (dbVal != null) {
-    const n = Number(dbVal);
-    if (Number.isFinite(n) && n >= 0) return n;
-  }
-  if (fileVal != null) {
-    const n = Number(fileVal);
-    if (Number.isFinite(n) && n >= 0) return n;
-  }
-  return fallback;
-}
-
 /**
  * Pure function: decide whether the probe should run given the audit
  * history. Returns reason when skipping.
@@ -137,17 +101,21 @@ export async function runNightlyQualityProbe(deps: NightlyProbeDeps): Promise<Ni
     return { outcome: 'disabled', exit_code: 0, detail: 'feature flag off' };
   }
 
-  // 24h rate limit — skip WITHOUT an audit row. The autopilot loop invokes
-  // the probe every cycle (~5-10 min), so all but one invocation per day
-  // lands here; logging each skip floods the audit file (~hundreds of
-  // rows/day) and — because doctor treats any non-pass outcome as bad
-  // signal — flips nightly_quality_probe_health to a permanent WARN the
-  // moment the probe is enabled. A skip is a non-event: the real runs are
-  // the signal, and their rows are what gates the next 24h window.
+  // 24h rate limit — skip + audit "rate_limited".
   const now = deps.now();
   const recent = readRecentQualityProbeEvents(2, now); // 2-day window is enough for 24h check
   const decision = shouldRunNightly(now, recent);
   if (!decision.run) {
+    logQualityProbeEvent({
+      outcome: 'rate_limited',
+      exit_code: 0,
+      pass_count: 0,
+      fail_count: 0,
+      inconclusive_count: 0,
+      error_count: 0,
+      est_cost_usd: 0,
+      detail: 'already ran within 24h window',
+    });
     return { outcome: 'rate_limited', exit_code: 0, detail: 'already ran within 24h' };
   }
 

src/core/model-pricing.ts

@@ -75,11 +75,6 @@ export const CANONICAL_PRICING: Record<string, ModelPricing> = {
   'openai:gpt-4o':                        { input:  2.50, output: 10.00 },
   'openai:gpt-4o-mini':                   { input:  0.15, output:  0.60 },
   'openai:gpt-5':                         { input:  5.00, output: 20.00 },
-  // gpt-5.2: rates from the OpenAI recipe chat touchpoint (verified
-  // 2026-04-20). Needed here because it's the cross-modal DEFAULT_SLOTS
-  // slot-A model — without a canonical entry estimateCost silently drops
-  // slot A from the --max-usd pre-flight and est_cost_usd audit rows.
-  'openai:gpt-5.2':                       { input:  1.25, output: 10.00 },
   'openai:gpt-5.5':                       { input:  4.00, output: 16.00 },
 
   // ── Google ─────────────────────────────────────────────────────────────

src/core/operations.ts

@@ -499,7 +499,7 @@ export function linkReadScopeOpts(ctx: OperationContext): { sourceId?: string; s
  * FAIL-CLOSED: anything not strictly `ctx.remote === false` is untrusted.
  *
  * This is the SINGLE resolver for every read op that accepts a per-call
- * `source_id` / `all_sources` parameter (query, code_callers, code_callees,
+ * `source_id` / `all_sources` parameter (query, search, code_callers, code_callees,
  * get_page, search_by_image, code_blast, code_flow). Inlining the `__all__`
  * branch per handler is the bug class that leaked cross-source reads (#1924,
  * #1371): a remote client could pass `source_id: '__all__'` to opt out of its
@@ -1442,13 +1442,24 @@ const search: Operation = {
     limit: { type: 'number', description: 'Max results (default 20)' },
     offset: { type: 'number', description: 'Skip first N results (for pagination)' },
     mode: { type: 'string', description: 'Search mode (conservative|balanced|tokenmax). Local callers only.' },
+    source_id: {
+      type: 'string',
+      description:
+        "Scope search to a single source. Defaults to OperationContext.sourceId. Pass '__all__' to span every source for trusted local callers; for remote callers '__all__' spans only your granted sources.",
+    },
+    all_sources: { type: 'boolean', description: "Span sources (equivalent to source_id=__all__): every source locally, your grant remotely." },
   },
   handler: async (ctx, p) => {
     const startedAt = Date.now();
     const queryText = p.query as string;
     const limit = (p.limit as number) || 20;
     const offset = (p.offset as number) || 0;
-    const scope = sourceScopeOpts(ctx);
+    // #1484 follow-up: route through the canonical fail-closed resolver so
+    // `--source-id __all__` / `all_sources` behave the same as on `query`
+    // (the zero-hit CLI hint advises exactly that retry). Without a per-call
+    // param, `search` silently ignored --source-id — the retry looked like
+    // a genuine miss.
+    const scope = resolveRequestedScope(ctx, p.source_id as string | undefined, p.all_sources === true);
 
     // T4/D5 — per-call mode honored ONLY for trusted/local callers so a remote
     // OAuth client can't escalate to the costly tokenmax bundle. Local + unknown

src/core/search/hybrid.ts

@@ -1323,8 +1323,18 @@ export async function hybridSearch(
       if (effectiveModality === 'both' && imageVectorList !== null) {
         vectorLists = [...vectorLists, imageVectorList];
       }
-    } catch {
-      // Embedding failure is non-fatal, fall back to keyword-only
+    } catch (err) {
+      // Embedding/vector failure is non-fatal — fall back to keyword-only —
+      // but say WHY (#1626): this arm only runs when the embedding provider
+      // probed available, so a throw here is a real failure (embed timeout,
+      // transient pooler error on the searchVector fan-out). Pre-fix the bare
+      // catch made a cross-source `--source __all__` run silently collapse to
+      // keyword-only/"No results" with zero diagnostics.
+      warnOncePerProcess(
+        'hybrid-vector-arm-failed',
+        `[gbrain] vector arm failed (fail-open, keyword-only fallback): ` +
+          `${err instanceof Error ? err.message : String(err)}`,
+      );
     }
   }
 

test/ai/compat-fetch-body-read.serial.test.ts

@@ -0,0 +1,115 @@
+/**
+ * #1610 — Voyage/ZeroEntropy compat shims must read the response body ONCE
+ * via text() instead of `resp.clone().json()`.
+ *
+ * On bun < 1.1.27, Response.clone() truncates large bodies (oven-sh/bun#6348):
+ * the clone().json() parse threw, the shim's catch fell back to the ORIGINAL
+ * response — whose wire shape (ZE `{results: ...}`, Voyage base64 embeddings)
+ * the AI SDK's openai-compatible Zod schema rejects — and multi-chunk pages
+ * failed with "Invalid JSON response".
+ *
+ * These tests simulate the truncating clone() and assert the shims still
+ * return the fully rewritten body. They also pin that the rewritten Response
+ * does NOT carry the original (now stale) Content-Length header, which lied
+ * about the rewritten body's size (gateway.ts previously copied
+ * `headers: resp.headers` verbatim).
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import {
+  __voyageCompatFetchForTests,
+  __zeroEntropyCompatFetchForTests,
+} from '../../src/core/ai/gateway.ts';
+
+const origFetch = globalThis.fetch;
+afterEach(() => {
+  globalThis.fetch = origFetch;
+});
+
+/** Build a Response whose clone() truncates the body (bun < 1.1.27 behavior). */
+function truncatingCloneResponse(body: string): Response {
+  const headers = {
+    'content-type': 'application/json',
+    // Deliberately stale after any rewrite: the original wire body's length.
+    'content-length': String(Buffer.byteLength(body)),
+  };
+  const resp = new Response(body, { status: 200, headers });
+  (resp as any).clone = () =>
+    new Response(body.slice(0, 32), { status: 200, headers });
+  return resp;
+}
+
+describe('voyageCompatFetch — single body read (#1610)', () => {
+  test('rewrites base64 embeddings even when clone() truncates the body', async () => {
+    const floats = new Float32Array([0.5, 0.25, -1]);
+    const b64 = Buffer.from(floats.buffer).toString('base64');
+    const wireBody = JSON.stringify({
+      object: 'list',
+      data: [{ object: 'embedding', embedding: b64, index: 0 }],
+      model: 'voyage-3',
+      usage: { total_tokens: 7 },
+    });
+    globalThis.fetch = (async () => truncatingCloneResponse(wireBody)) as unknown as typeof fetch;
+
+    const out = await __voyageCompatFetchForTests('https://api.voyageai.com/v1/embeddings', {
+      method: 'POST',
+      body: JSON.stringify({ input: ['hello'], model: 'voyage-3' }),
+      headers: { 'content-type': 'application/json' },
+    });
+
+    const json: any = await out.json();
+    expect(Array.from(json.data[0].embedding)).toEqual([0.5, 0.25, -1]);
+    expect(json.usage.prompt_tokens).toBe(7);
+    // Stale Content-Length from the wire body must not survive the rewrite.
+    expect(out.headers.get('content-length')).toBeNull();
+    expect(out.headers.get('content-encoding')).toBeNull();
+  });
+});
+
+describe('zeroEntropyCompatFetch — single body read (#1610)', () => {
+  test('rewrites {results} → {data} even when clone() truncates the body', async () => {
+    const wireBody = JSON.stringify({
+      results: [{ embedding: [0.1, 0.2] }, { embedding: [0.3, 0.4] }],
+      usage: { total_bytes: 42, total_tokens: 9 },
+    });
+    let fetchedUrl = '';
+    globalThis.fetch = (async (url: string | URL | Request) => {
+      fetchedUrl = String(url);
+      return truncatingCloneResponse(wireBody);
+    }) as unknown as typeof fetch;
+
+    const out = await __zeroEntropyCompatFetchForTests('https://api.zeroentropy.dev/v1/embeddings', {
+      method: 'POST',
+      body: JSON.stringify({ input: ['hello'], model: 'zembed-1' }),
+      headers: { 'content-type': 'application/json' },
+    });
+
+    expect(fetchedUrl.endsWith('/v1/models/embed')).toBe(true);
+    const json: any = await out.json();
+    // The AI SDK schema requires {data: [{embedding, index}]} — the raw ZE
+    // {results} fallback is exactly the pre-fix "Invalid JSON response".
+    expect(json.results).toBeUndefined();
+    expect(json.data).toHaveLength(2);
+    expect(json.data[0]).toEqual({ object: 'embedding', embedding: [0.1, 0.2], index: 0 });
+    expect(json.data[1].index).toBe(1);
+    expect(json.usage.prompt_tokens).toBe(9);
+    expect(out.headers.get('content-length')).toBeNull();
+  });
+
+  test('non-JSON body falls back to the original bytes (rebuilt, still readable)', async () => {
+    const wireBody = 'plain text, not json';
+    globalThis.fetch = (async () =>
+      new Response(wireBody, {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })) as unknown as typeof fetch;
+
+    const out = await __zeroEntropyCompatFetchForTests('https://api.zeroentropy.dev/v1/embeddings', {
+      method: 'POST',
+      body: JSON.stringify({ input: ['hello'] }),
+    });
+    // Body was consumed by the shim's single read; the fallback must
+    // rebuild a readable Response rather than return the drained original.
+    expect(await out.text()).toBe(wireBody);
+  });
+});

test/ai/zeroentropy-compat-fetch.test.ts

@@ -98,16 +98,18 @@ describe('zeroEntropyCompatFetch — OOM caps', () => {
     expect(src).toMatch(/MAX_ZEROENTROPY_RESPONSE_BYTES\s*=\s*256\s*\*\s*1024\s*\*\s*1024/);
   });
 
-  test('Layer 1: Content-Length pre-check before resp.clone().json()', async () => {
+  test('Layer 1: Content-Length pre-check before the body is read', async () => {
     const src = await Bun.file(GATEWAY_PATH).text();
     // Find the zeroEntropyCompatFetch block bounds, then assert ordering
-    // within it (mirroring the voyage cap test pattern).
+    // within it (mirroring the voyage cap test pattern). #1610 moved the
+    // body read from `resp.clone().json()` to a single `resp.text()` (bun
+    // < 1.1.27 truncates clone()d bodies, oven-sh/bun#6348).
     const zeFetchStart = src.indexOf('const zeroEntropyCompatFetch');
     expect(zeFetchStart).toBeGreaterThan(0);
-    const block = src.slice(zeFetchStart, zeFetchStart + 8000);
+    const block = src.slice(zeFetchStart, zeFetchStart + 9000);
 
     const preCheckIdx = block.indexOf("resp.headers.get('content-length')");
-    const jsonParseIdx = block.indexOf('await resp.clone().json()');
+    const jsonParseIdx = block.indexOf('const bodyText = await resp.text()');
     expect(preCheckIdx).toBeGreaterThan(0);
     expect(jsonParseIdx).toBeGreaterThan(0);
     // The pre-check MUST appear before the JSON parse — Voyage's lesson

test/audit-parser-probe.serial.test.ts

@@ -1,102 +0,0 @@
-/**
- * Tests for the parser-probe audit trail + the 24h rate-limit gate.
- *
- * Uses GBRAIN_AUDIT_DIR override pointed at a tmpdir for hermeticity
- * (same pattern as audit-slug-fallback.serial.test.ts). Serial because
- * the env override is process-global.
- */
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync, readdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import {
-  computeParserProbeAuditFilename,
-  logParserProbeEvent,
-  parserProbeRanWithin,
-  readRecentParserProbeEvents,
-  type ParserProbeAuditEvent,
-} from '../src/core/audit-parser-probe.ts';
-
-let auditDir: string;
-let savedEnv: string | undefined;
-
-beforeEach(() => {
-  auditDir = mkdtempSync(join(tmpdir(), 'parser-probe-audit-'));
-  savedEnv = process.env.GBRAIN_AUDIT_DIR;
-  process.env.GBRAIN_AUDIT_DIR = auditDir;
-});
-
-afterEach(() => {
-  if (savedEnv === undefined) delete process.env.GBRAIN_AUDIT_DIR;
-  else process.env.GBRAIN_AUDIT_DIR = savedEnv;
-  rmSync(auditDir, { recursive: true, force: true });
-});
-
-function makeEvent(overrides: Partial<ParserProbeAuditEvent> = {}): ParserProbeAuditEvent {
-  return {
-    schema_version: 1,
-    ts: new Date().toISOString(),
-    outcome: 'pass',
-    fixtures_total: 12,
-    fixtures_passed: 12,
-    recall_mean: 0.98,
-    participants_recall_mean: 0.97,
-    adversarial_false_positives: 0,
-    failed_fixture_ids: [],
-    ...overrides,
-  };
-}
-
-describe('parser-probe audit trail', () => {
-  test('log + readRecent round-trip', () => {
-    logParserProbeEvent(makeEvent({ outcome: 'fail', reason: '2 fixture(s) failed' }));
-    const events = readRecentParserProbeEvents(7);
-    expect(events.length).toBe(1);
-    expect(events[0]!.outcome).toBe('fail');
-    expect(events[0]!.reason).toBe('2 fixture(s) failed');
-    const files = readdirSync(auditDir);
-    expect(files.length).toBe(1);
-    expect(files[0]).toMatch(/^parser-probe-\d{4}-W\d{2}\.jsonl$/);
-  });
-
-  test('filename uses ISO-week rotation with the parser-probe prefix', () => {
-    // Year-boundary edge pinned by the shared writer's own tests; here we
-    // pin the prefix wiring.
-    expect(computeParserProbeAuditFilename(new Date('2026-07-06T12:00:00Z'))).toBe(
-      'parser-probe-2026-W28.jsonl',
-    );
-  });
-
-  test('readRecent filters by window', () => {
-    const old = new Date(Date.now() - 10 * 86400000).toISOString();
-    logParserProbeEvent(makeEvent({ ts: old }));
-    expect(readRecentParserProbeEvents(7).length).toBe(0);
-  });
-});
-
-describe('parserProbeRanWithin — 24h rate-limit gate', () => {
-  const DAY_MS = 24 * 60 * 60 * 1000;
-
-  test('false when no runs are audited', () => {
-    expect(parserProbeRanWithin(DAY_MS)).toBe(false);
-  });
-
-  test('true when a run landed within the window', () => {
-    logParserProbeEvent(makeEvent({ ts: new Date(Date.now() - 60_000).toISOString() }));
-    expect(parserProbeRanWithin(DAY_MS)).toBe(true);
-  });
-
-  test('false when the last run is older than the window', () => {
-    logParserProbeEvent(makeEvent({ ts: new Date(Date.now() - 25 * 3600_000).toISOString() }));
-    expect(parserProbeRanWithin(DAY_MS)).toBe(false);
-  });
-
-  test('non-pass outcomes also hold the window (mirrors quality-probe semantics)', () => {
-    logParserProbeEvent(makeEvent({
-      outcome: 'no_embedding_key',
-      ts: new Date(Date.now() - 3600_000).toISOString(),
-    }));
-    expect(parserProbeRanWithin(DAY_MS)).toBe(true);
-  });
-});

test/autopilot-nightly-probe-wiring.test.ts

@@ -31,15 +31,10 @@ describe('autopilot wiring: nightly quality probe', () => {
     expect(SOURCE).toContain(`runCrossModalBatchForProbe`);
   });
 
-  test('feature flag gate present: dual-plane read (DB row wins, file plane fallback)', () => {
+  test('feature flag gate present: cfg.autopilot.nightly_quality_probe.enabled', () => {
     // Per D10: the scheduler ONLY checks the feature flag. The 24h rate-limit
     // lives inside runNightlyQualityProbe itself (no scheduler-side precheck).
-    // The flag resolves through resolveProbeEnabled so `gbrain config set
-    // autopilot.nightly_quality_probe.enabled true` (the doctor hint, DB
-    // plane) and ~/.gbrain/config.json (file plane) BOTH work — a file-only
-    // read made the printed hint a silent no-op.
-    expect(SOURCE).toContain(`getConfig('autopilot.nightly_quality_probe.enabled')`);
-    expect(SOURCE).toMatch(/resolveProbeEnabled\(dbEnabled,\s*cfg\?\.autopilot\?\.nightly_quality_probe\?\.enabled\)/);
+    expect(SOURCE).toContain(`nightly_quality_probe?.enabled === true`);
   });
 
   test('NO scheduler-side rate-limit check (D10 simplification)', () => {
@@ -69,23 +64,12 @@ describe('autopilot wiring: nightly quality probe', () => {
     expect(SOURCE).toContain(`now:`);
   });
 
-  test('resolveRepoRoot prefers the gbrain package root (committed fixture home), not the brain repoPath', () => {
-    // The DI harness in nightly-quality-probe.test.ts passes process.cwd()
-    // (= the gbrain repo in CI), which papered over the wiring passing
-    // repoPath (= sync.repo_path, the user's BRAIN repo, where the fixture
-    // never exists). Pin the package-root resolution + existence check.
-    expect(SOURCE).toMatch(/fileURLToPath\(new URL\('\.\.\/\.\.', import\.meta\.url\)\)/);
-    expect(SOURCE).toContain(`'longmemeval-nightly.jsonl'`);
-    expect(SOURCE).toMatch(/fixtureAtPkgRoot \? pkgRoot : repoPath/);
-  });
-
   test('hasEmbeddingProvider reads from gateway.isAvailable("embedding") (codex round-2 #12 — in-process, not subprocess)', () => {
     expect(SOURCE).toContain(`isAvailable('embedding')`);
     expect(SOURCE).toContain(`gateway`);
   });
 
-  test('max_usd resolves dual-plane (default = 5 pinned by resolveProbeMaxUsd unit tests)', () => {
-    expect(SOURCE).toContain(`getConfig('autopilot.nightly_quality_probe.max_usd')`);
-    expect(SOURCE).toMatch(/resolveProbeMaxUsd\(dbMaxUsd,\s*cfg\?\.autopilot\?\.nightly_quality_probe\?\.max_usd\)/);
+  test('max_usd default = 5 when config unset (matches plan default per D10)', () => {
+    expect(SOURCE).toMatch(/max_usd\s*\?\?\s*5/);
   });
 });

test/autopilot-parser-probe-wiring.test.ts

@@ -1,77 +0,0 @@
-/**
- * Source-shape regression tests for the autopilot wiring of
- * `runConversationParserNightlyProbe` (step 4.6).
- *
- * Same rationale as autopilot-nightly-probe-wiring.test.ts: the loop is
- * hard to drive end-to-end, so these pin the structural protections —
- * the dual-plane flag read, the D10 tokenmax mode-gate, the package-root
- * fixture resolution, the audit-flood guard, and the try/catch posture.
- *
- * The probe's own gate/scoring logic is pinned by the module's unit
- * tests; the audit trail by audit-parser-probe.serial.test.ts.
- */
-
-import { describe, test, expect } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-
-const AUTOPILOT_SRC = resolve('src/commands/autopilot.ts');
-const SOURCE = readFileSync(AUTOPILOT_SRC, 'utf-8');
-
-describe('autopilot wiring: conversation-parser probe', () => {
-  test('invokes the phase module and the audit trail', () => {
-    expect(SOURCE).toContain(`runConversationParserNightlyProbe`);
-    expect(SOURCE).toContain(`conversation-parser/nightly-probe`);
-    expect(SOURCE).toContain(`logParserProbeEvent`);
-    expect(SOURCE).toContain(`audit-parser-probe`);
-  });
-
-  test('flag reads dual-plane: DB row (gbrain config set) wins, file plane fallback', () => {
-    expect(SOURCE).toContain(`getConfig('autopilot.conversation_parser_probe.enabled')`);
-    expect(SOURCE).toContain(`cfg?.autopilot?.conversation_parser_probe?.enabled === true`);
-  });
-
-  test('D10 mode-gate present: tokenmax brains run the probe by default', () => {
-    expect(SOURCE).toMatch(/parserEnabled \|\| searchMode === 'tokenmax'/);
-  });
-
-  test('fixtures resolve from the gbrain package root, NOT the brain repoPath', () => {
-    // The committed fixtures live in the gbrain source tree; resolving
-    // them against sync.repo_path would point into the user's brain repo.
-    expect(SOURCE).toMatch(/fileURLToPath\(new URL\('\.\.\/\.\.', import\.meta\.url\)\)/);
-    expect(SOURCE).toContain(`'conversation-formats', 'all.jsonl'`);
-    expect(SOURCE).toContain(`'conversation-formats', 'adversarial.jsonl'`);
-  });
-
-  test('missing fixtures skip quietly (no audit row, once-per-process stderr note)', () => {
-    // Compiled-binary installs carry no source tree; writing failure rows
-    // would flip doctor to WARN on every binary install.
-    expect(SOURCE).toContain(`parserProbeFixtureWarned`);
-  });
-
-  test('rate_limited outcomes are NOT audit-logged (flood guard)', () => {
-    expect(SOURCE).toMatch(/outcome !== 'rate_limited'\) logParserProbeEvent\(result\)/);
-  });
-
-  test('rate-limit gate delegates to the audit module, not inline event reads', () => {
-    expect(SOURCE).toContain(`parserProbeRanWithin(24 * 60 * 60 * 1000)`);
-  });
-
-  test('LLM-key gate reads gateway.isAvailable("chat") in-process', () => {
-    expect(SOURCE).toContain(`isAvailable('chat')`);
-  });
-
-  test('probe call wrapped in try/catch that does NOT bump consecutiveErrors', () => {
-    expect(SOURCE).toMatch(/catch[\s\S]*?autopilot\.parser_probe[\s\S]*?do NOT bump consecutiveErrors/);
-  });
-
-  test('DI shape: the exact 7 fields of the parser probe NightlyProbeDeps', () => {
-    expect(SOURCE).toContain(`isEnabled:`);
-    expect(SOURCE).toContain(`searchMode:`);
-    expect(SOURCE).toContain(`hasLlmKey:`);
-    expect(SOURCE).toContain(`resolveFixturePath:`);
-    expect(SOURCE).toContain(`resolveAdversarialPath:`);
-    expect(SOURCE).toContain(`shouldSkipForRateLimit:`);
-    expect(SOURCE).toContain(`now:`);
-  });
-});

test/cli-source-scope-hint.test.ts

@@ -0,0 +1,61 @@
+/**
+ * #1484 — invisible-miss hint. A bare `gbrain query` resolves to a single
+ * source (usually 'default'); on a multi-source brain a zero-hit run gave no
+ * signal that the answer might live in another source. sourceScopeHint
+ * returns the stderr hint exactly when: query/search op + zero results +
+ * no explicit scoping param + >1 registered source.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { sourceScopeHint } from '../src/cli.ts';
+import type { BrainEngine } from '../src/core/engine.ts';
+
+function fakeEngine(sourceCount: number, fail = false): BrainEngine {
+  return {
+    executeRaw: async () => {
+      if (fail) throw new Error('sources table missing');
+      return [{ n: sourceCount }];
+    },
+  } as unknown as BrainEngine;
+}
+
+describe('sourceScopeHint (#1484)', () => {
+  test('fires on a bare zero-hit query against a multi-source brain', async () => {
+    const hint = await sourceScopeHint('query', {}, 'default', fakeEngine(3), []);
+    expect(hint).toContain('3 sources');
+    expect(hint).toContain('"default"');
+    expect(hint).toContain('--source-id __all__');
+  });
+
+  test('fires for search too', async () => {
+    const hint = await sourceScopeHint('search', {}, 'wiki', fakeEngine(2), []);
+    expect(hint).toContain('"wiki"');
+  });
+
+  test('silent when results were found', async () => {
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(3), [{ slug: 'a' }])).toBeNull();
+  });
+
+  test('silent when the caller scoped explicitly', async () => {
+    expect(await sourceScopeHint('query', { source_id: 'wiki' }, 'wiki', fakeEngine(3), [])).toBeNull();
+    expect(await sourceScopeHint('query', { source: 'wiki' }, 'wiki', fakeEngine(3), [])).toBeNull();
+    expect(await sourceScopeHint('query', { all_sources: true }, '__all__', fakeEngine(3), [])).toBeNull();
+  });
+
+  test('silent when the resolved scope is already __all__', async () => {
+    expect(await sourceScopeHint('query', {}, '__all__', fakeEngine(3), [])).toBeNull();
+  });
+
+  test('silent on a single-source brain', async () => {
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(1), [])).toBeNull();
+  });
+
+  test('silent for non-search ops and non-array results', async () => {
+    expect(await sourceScopeHint('get_stats', {}, 'default', fakeEngine(3), [])).toBeNull();
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(3), { rows: [] })).toBeNull();
+  });
+
+  test('best-effort: sources lookup failure returns null, never throws', async () => {
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(3, true), [])).toBeNull();
+  });
+});

test/cross-modal-default-slots.test.ts

@@ -1,47 +0,0 @@
-/**
- * Consistency guard: every cross-modal DEFAULT_SLOTS model must be listed
- * in its recipe's chat touchpoint. `openai:gpt-4o` drifted out of the
- * OpenAI recipe while remaining the slot-A default — the gateway then
- * rejected slot A ("not listed for OpenAI chat") on every install, and the
- * 3-slot judge panel could never reach its 2-model quorum without a Google
- * key, pinning every batch verdict at inconclusive (which the nightly
- * quality probe surfaces as a doctor WARN).
- */
-import { describe, expect, test } from 'bun:test';
-
-import { DEFAULT_SLOTS } from '../src/core/cross-modal-eval/runner.ts';
-import { getRecipe } from '../src/core/ai/recipes/index.ts';
-import { splitProviderModelId } from '../src/core/model-id.ts';
-import { canonicalLookup } from '../src/core/model-pricing.ts';
-
-describe('cross-modal DEFAULT_SLOTS ↔ recipe consistency', () => {
-  test('every default slot model is listed in its recipe chat touchpoint', () => {
-    for (const slot of DEFAULT_SLOTS) {
-      const { provider, model } = splitProviderModelId(slot.model);
-      expect(provider).not.toBeNull();
-      const recipe = getRecipe(provider!);
-      expect(recipe, `slot ${slot.id}: unknown recipe "${provider}"`).toBeDefined();
-      const chatModels = recipe!.touchpoints.chat?.models ?? [];
-      expect(
-        chatModels,
-        `slot ${slot.id}: "${model}" not listed for ${provider} chat — the judge slot can never run`,
-      ).toContain(model);
-    }
-  });
-
-  test('every default slot model has a canonical pricing entry', () => {
-    // Without one, estimateCost silently drops the slot from the
-    // --max-usd pre-flight and est_cost_usd audit rows (~1/3 under-count).
-    for (const slot of DEFAULT_SLOTS) {
-      expect(
-        canonicalLookup(slot.model),
-        `slot ${slot.id}: "${slot.model}" missing from CANONICAL_PRICING`,
-      ).toBeDefined();
-    }
-  });
-
-  test('slots span three distinct providers (uncorrelated blind spots)', () => {
-    const providers = new Set(DEFAULT_SLOTS.map(s => splitProviderModelId(s.model).provider));
-    expect(providers.size).toBe(3);
-  });
-});

test/doctor-parser-probe-check.test.ts

@@ -1,51 +0,0 @@
-/**
- * Tests for computeConversationParserProbeHealthCheck — the pure function
- * behind doctor's conversation_parser_probe_health check, which replaced
- * the v0.41.13.0 hardcoded "Skipped" stub when the autopilot wiring
- * landed. Mirrors the branch coverage style of the quality-probe check.
- */
-import { describe, expect, test } from 'bun:test';
-
-import { computeConversationParserProbeHealthCheck } from '../src/commands/doctor.ts';
-
-const ev = (outcome: string, reason?: string, ts = new Date().toISOString()) => ({
-  outcome,
-  ts,
-  ...(reason !== undefined ? { reason } : {}),
-});
-
-describe('computeConversationParserProbeHealthCheck', () => {
-  test('disabled + no events → ok with paste-ready enable hint', () => {
-    const check = computeConversationParserProbeHealthCheck(false, []);
-    expect(check.status).toBe('ok');
-    expect(check.message).toContain('gbrain config set autopilot.conversation_parser_probe.enabled true');
-  });
-
-  test('enabled + no events yet → ok, next run by autopilot', () => {
-    const check = computeConversationParserProbeHealthCheck(true, []);
-    expect(check.status).toBe('ok');
-    expect(check.message).toContain('no probe events');
-  });
-
-  test('disabled flag but events exist (tokenmax mode-gate ran it) → events win over the hint', () => {
-    const check = computeConversationParserProbeHealthCheck(false, [ev('pass')]);
-    expect(check.status).toBe('ok');
-    expect(check.message).toContain('all pass');
-  });
-
-  test('any non-pass outcome in the window → warn, latest surfaced with reason', () => {
-    const check = computeConversationParserProbeHealthCheck(true, [
-      ev('pass'),
-      ev('adversarial_false_positive', '1 adversarial fixture(s) parsed to non-empty'),
-    ]);
-    expect(check.status).toBe('warn');
-    expect(check.message).toContain('adversarial_false_positive');
-    expect(check.message).toContain('parsed to non-empty');
-  });
-
-  test('all pass → ok with run count', () => {
-    const check = computeConversationParserProbeHealthCheck(true, [ev('pass'), ev('pass')]);
-    expect(check.status).toBe('ok');
-    expect(check.message).toContain('2 probe run(s)');
-  });
-});

test/hybrid-vector-arm-warn.serial.test.ts

@@ -0,0 +1,77 @@
+/**
+ * #1626 — hybridSearch's text-vector arm must not fail DARK.
+ *
+ * The arm only runs when the embedding provider probed available, so a throw
+ * inside it (embed timeout, transient pooler error on searchVector) is a real
+ * failure. Pre-fix, a bare `catch {}` swallowed it and the run silently
+ * collapsed to keyword-only — under `--source __all__` on a strained pooler
+ * that read as a non-deterministic "No results". The fix logs the swallowed
+ * reason via warnOncePerProcess while keeping the keyword fallback.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { PGLiteEngine } from '../src/core/pglite-engine.ts';
+import { hybridSearch } from '../src/core/search/hybrid.ts';
+import {
+  __setEmbedTransportForTests,
+  configureGateway,
+  resetGateway,
+} from '../src/core/ai/gateway.ts';
+import { _resetWarnOnceForTests } from '../src/core/utils.ts';
+
+let engine: PGLiteEngine;
+const origWarn = console.warn;
+
+beforeAll(async () => {
+  // Pin the gateway to OpenAI with a stub key (put-page-provenance pattern):
+  // embed() runs instantiateEmbedding — which requires OPENAI_API_KEY — BEFORE
+  // the stubbed transport is reached. Without this, a keyless CI environment
+  // throws the config error instead of the transport's, and the assertion on
+  // the swallowed reason fails. The key never leaves the process.
+  configureGateway({
+    embedding_model: 'openai:text-embedding-3-large',
+    embedding_dimensions: 1536,
+    env: { ...process.env, OPENAI_API_KEY: process.env.OPENAI_API_KEY || 'sk-test-stub' },
+  });
+  engine = new PGLiteEngine();
+  await engine.connect({});
+  await engine.initSchema();
+  await engine.putPage('people/alice-example', {
+    type: 'person',
+    title: 'Alice Example',
+    compiled_truth: 'Alice Example is a test person for the vector-arm warn test.',
+  });
+});
+
+afterAll(async () => {
+  console.warn = origWarn;
+  __setEmbedTransportForTests(null);
+  resetGateway();
+  await engine.disconnect();
+});
+
+describe('hybridSearch vector-arm failure telemetry (#1626)', () => {
+  test('embed failure logs the swallowed reason and falls back to keyword', async () => {
+    _resetWarnOnceForTests();
+    // Installing a transport makes isAvailable('embedding') true (test-seam
+    // fast path), so the vector arm RUNS — and then throws.
+    __setEmbedTransportForTests(() => {
+      throw new Error('pooler exploded mid-fanout');
+    });
+    const warnings: string[] = [];
+    console.warn = (...args: unknown[]) => {
+      warnings.push(args.map(String).join(' '));
+    };
+    try {
+      const results = await hybridSearch(engine, 'alice');
+      // Keyword fallback still returns results — fail-open preserved.
+      expect(results.some((r) => r.slug === 'people/alice-example')).toBe(true);
+    } finally {
+      console.warn = origWarn;
+      __setEmbedTransportForTests(null);
+    }
+    const armWarnings = warnings.filter((w) => w.includes('vector arm failed'));
+    expect(armWarnings).toHaveLength(1);
+    expect(armWarnings[0]).toContain('pooler exploded mid-fanout');
+  });
+});

test/nightly-probe-config-plane.test.ts

@@ -1,74 +0,0 @@
-// Regression test for the nightly-quality-probe config-plane split-brain.
-//
-// The doctor check prints a paste-ready enable hint — `gbrain config set
-// autopilot.nightly_quality_probe.enabled true` — which writes the DB config
-// plane. But both the autopilot gate and the doctor check used to read ONLY
-// the file plane (~/.gbrain/config.json via loadConfig), so following the
-// hint was a silent no-op: the probe never ran and doctor kept reporting
-// "disabled (opt-in)".
-//
-// resolveProbeEnabled / resolveProbeMaxUsd pin the dual-plane rule (same
-// precedent as `mcp.publish_skills` in serve-http.ts): DB row wins when
-// present, file plane is the fallback.
-import { describe, expect, test } from 'bun:test';
-
-import {
-  resolveProbeEnabled,
-  resolveProbeMaxUsd,
-} from '../src/core/cycle/nightly-quality-probe.ts';
-
-describe('resolveProbeEnabled — dual-plane flag resolution', () => {
-  test('DB plane "true" enables regardless of file plane (the doctor hint path)', () => {
-    expect(resolveProbeEnabled('true', undefined)).toBe(true);
-    expect(resolveProbeEnabled('true', false)).toBe(true);
-  });
-
-  test('explicit DB "false" wins over file-plane true (config set off sticks)', () => {
-    expect(resolveProbeEnabled('false', true)).toBe(false);
-  });
-
-  test('file plane is the fallback when no DB row exists', () => {
-    expect(resolveProbeEnabled(null, true)).toBe(true);
-    expect(resolveProbeEnabled(undefined, true)).toBe(true);
-    expect(resolveProbeEnabled(null, undefined)).toBe(false);
-    expect(resolveProbeEnabled(null, false)).toBe(false);
-  });
-
-  test('file plane stays strict boolean — string "true" in config.json does not enable', () => {
-    // Matches the pre-fix autopilot gate (`=== true`); the doctor check used
-    // Boolean(...) and could disagree with autopilot on a string value.
-    // Both call sites now share this helper, so they can no longer diverge.
-    expect(resolveProbeEnabled(null, 'true')).toBe(false);
-    expect(resolveProbeEnabled(null, 1)).toBe(false);
-  });
-
-  test('non-"true" DB strings are off (mcp.publish_skills semantics)', () => {
-    expect(resolveProbeEnabled('1', true)).toBe(false);
-    expect(resolveProbeEnabled('yes', true)).toBe(false);
-    expect(resolveProbeEnabled('', true)).toBe(false);
-  });
-});
-
-describe('resolveProbeMaxUsd — dual-plane cost cap resolution', () => {
-  test('DB plane wins when parseable', () => {
-    expect(resolveProbeMaxUsd('2.5', 10)).toBe(2.5);
-    expect(resolveProbeMaxUsd('0', 10)).toBe(0);
-  });
-
-  test('malformed or negative DB value falls through to file plane', () => {
-    expect(resolveProbeMaxUsd('banana', 3)).toBe(3);
-    expect(resolveProbeMaxUsd('-1', 3)).toBe(3);
-  });
-
-  test('file plane used when no DB row; default when both absent/invalid', () => {
-    expect(resolveProbeMaxUsd(null, 7)).toBe(7);
-    expect(resolveProbeMaxUsd(null, '4')).toBe(4);
-    expect(resolveProbeMaxUsd(null, undefined)).toBe(5);
-    expect(resolveProbeMaxUsd(null, 'banana')).toBe(5);
-    expect(resolveProbeMaxUsd(undefined, -2)).toBe(5);
-  });
-
-  test('explicit fallback override is honored', () => {
-    expect(resolveProbeMaxUsd(null, undefined, 12)).toBe(12);
-  });
-});

test/nightly-quality-probe.test.ts

@@ -132,20 +132,17 @@ describe('runNightlyQualityProbe (DI stub harness)', () => {
     });
   });
 
-  test('enabled + recent run within 24h → outcome: rate_limited, NO audit row', async () => {
+  test('enabled + recent run within 24h → outcome: rate_limited', async () => {
     // Pre-seed a recent audit event by running the probe once first.
     await withEnv({ GBRAIN_AUDIT_DIR: auditTmp }, async () => {
       // First run succeeds.
       await runNightlyQualityProbe(makeDeps());
-      // Second run, same hour → rate_limited. A skip is a non-event: the
-      // autopilot loop invokes the probe every cycle (~5-10 min), so
-      // logging each skip would flood the audit file and flip doctor's
-      // any-non-pass-is-bad filter to a permanent WARN.
+      // Second run, same hour → rate_limited.
       const r2 = await runNightlyQualityProbe(makeDeps());
       expect(r2.outcome).toBe('rate_limited');
       const events = await readEvents();
-      expect(events.length).toBe(1);
-      expect(events[0].outcome).toBe('pass');
+      expect(events.length).toBe(2);
+      expect(events[1].outcome).toBe('rate_limited');
     });
   });
 

test/search-op-source-scope.test.ts

@@ -0,0 +1,87 @@
+/**
+ * #1484 follow-up — the `search` op must honor per-call `source_id` /
+ * `all_sources` through the canonical fail-closed resolver
+ * (resolveRequestedScope), exactly like `query` does.
+ *
+ * Pre-fix, `search` had no source_id param at all: the zero-hit CLI hint
+ * advised "retry with --source-id __all__", the flag parsed into params,
+ * NOTHING consumed it, and the retry silently re-ran the same single-source
+ * search — an invisible false negative (and the retry's params.source_id
+ * suppressed the hint, so the user got no second warning).
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { operationsByName } from '../src/core/operations.ts';
+import type { OperationContext } from '../src/core/operations.ts';
+import type { BrainEngine } from '../src/core/engine.ts';
+
+const searchOp = operationsByName['search'];
+
+/** Fake engine: keyword-only config so the handler's scope goes straight to
+ *  searchKeyword, where we capture the opts it was called with. */
+function makeCtx(remote: boolean, allowedSources?: string[]) {
+  const captured: { opts?: Record<string, unknown> } = {};
+  const engine = {
+    getConfig: async (key: string) => (key === 'search.mcp_keyword_only' ? 'true' : null),
+    searchKeyword: async (_q: string, opts: Record<string, unknown>) => {
+      captured.opts = opts;
+      return [];
+    },
+  } as unknown as BrainEngine;
+  const ctx = {
+    engine,
+    config: { engine: 'pglite' },
+    logger: { info: () => {}, warn: () => {}, error: () => {} },
+    dryRun: false,
+    remote,
+    sourceId: 'default',
+    ...(allowedSources ? { auth: { allowedSources } } : {}),
+  } as unknown as OperationContext;
+  return { ctx, captured };
+}
+
+describe('search op per-call source scope (#1484 follow-up)', () => {
+  test('op declares source_id + all_sources params (the CLI hint advises them)', () => {
+    expect(searchOp.params.source_id).toBeDefined();
+    expect(searchOp.params.all_sources).toBeDefined();
+  });
+
+  test('default: scopes to ctx.sourceId', async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x' });
+    expect(captured.opts?.sourceId).toBe('default');
+  });
+
+  test("local + source_id '__all__' spans the whole brain (no source filter)", async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x', source_id: '__all__' });
+    expect(captured.opts?.sourceId).toBeUndefined();
+    expect(captured.opts?.sourceIds).toBeUndefined();
+  });
+
+  test('local + all_sources=true spans the whole brain', async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x', all_sources: true });
+    expect(captured.opts?.sourceId).toBeUndefined();
+    expect(captured.opts?.sourceIds).toBeUndefined();
+  });
+
+  test('explicit source_id wins over ctx.sourceId', async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x', source_id: 'wiki' });
+    expect(captured.opts?.sourceId).toBe('wiki');
+  });
+
+  test("remote + '__all__' collapses to the caller's grant (fail-closed)", async () => {
+    const { ctx, captured } = makeCtx(true, ['wiki', 'essays']);
+    await searchOp.handler(ctx, { query: 'x', source_id: '__all__' });
+    expect(captured.opts?.sourceIds).toEqual(['wiki', 'essays']);
+  });
+
+  test('remote + out-of-grant source_id is denied', async () => {
+    const { ctx } = makeCtx(true, ['wiki']);
+    await expect(searchOp.handler(ctx, { query: 'x', source_id: 'secrets' })).rejects.toThrow(
+      /outside your granted sources/,
+    );
+  });
+});

test/voyage-response-cap.test.ts

@@ -34,7 +34,7 @@ describe('v0.31.8 — voyage Content-Length pre-check + per-item cap', () => {
     expect(source).toMatch(/MAX_VOYAGE_RESPONSE_BYTES\s*=\s*256\s*\*\s*1024\s*\*\s*1024/);
   });
 
-  test('Layer 1: Content-Length pre-check fires BEFORE resp.clone().json() (D10 OOM defense)', async () => {
+  test('Layer 1: Content-Length pre-check fires BEFORE the body is read (D10 OOM defense)', async () => {
     const source = await Bun.file(new URL('../src/core/ai/gateway.ts', import.meta.url)).text();
     // Anchor relative to the post-fetch handler block. The function declaration
     // contains an OUTBOUND request body section earlier; we want to verify
@@ -47,8 +47,10 @@ describe('v0.31.8 — voyage Content-Length pre-check + per-item cap', () => {
     // doesn't pin to comment text.
     const preCheckIdx = inboundBlock.indexOf("resp.headers.get('content-length')");
     // Use the full lvalue assignment so the match doesn't accidentally hit
-    // comment text that mentions `await resp.clone().json()` for context.
-    const jsonParseIdx = inboundBlock.indexOf('const json: any = await resp.clone().json()');
+    // comment text that mentions the body read for context. (#1610 moved the
+    // read from `resp.clone().json()` to a single `resp.text()` — bun <
+    // 1.1.27 truncates clone()d bodies, oven-sh/bun#6348.)
+    const jsonParseIdx = inboundBlock.indexOf('const bodyText = await resp.text()');
     expect(preCheckIdx).toBeGreaterThan(0);
     expect(jsonParseIdx).toBeGreaterThan(0);
     // The pre-check MUST appear before the JSON parse — otherwise the OOM