Preserve publisher provenance and applicability when official guidance differs

ROADMAP.md

@@ -1,6 +1,6 @@
 # Mira roadmap
 
-**Latest October26 direction:** #91 is narrowed to original reviewed16ff136/generated3ad91ff. Its22/24 versus main21/24, shared final next-step failures and unchanged required-person controls meet the corrected relative comparison gate. The later policy/selection expansion and its candidate-only final factual error are withdrawn and preserved. Source parity, all96 saved request hashes/stages,1,244 full and8 no-model checks pass without quota. Final restored-diff review/current-head CI precede the authorized merge commit. Then integrate#90: frozen mapping finds shared custody/cloud families but candidate-only staff flagging, rejected by#91 in offline replay. No date-order cause is established; the conditional96-request grant is inactive. Livea9c9508/914a38f0 is operator-confirmed fromOctober26 18:52IST; earliest next releaseOctober27 18:52:34IST, with fresh rollback/off-state checks. Scores64/100 implementation and56/100 delivery remain unchanged; no new memory capability or customer resolution is claimed.
+**Current October28:** #91 merged a461f86. Its exact rollout c42efc65 passed startup and the normal how-to smoke. The broken-device reply preserved earlier restarts and delivered the full case privately, but applied Limitless-specific guidance without identifying the hardware. Independent review classified that as failed source applicability; rollback toa9c9508/a6ef6b22 is verified healthy and the third smoke held. #90 integrates #91:1,258/offline8 and independent240-check review pass; final-head review/CI precede merge. This does not fix unknown source applicability or produce a new generated score. Hold further releases while #83 receives a general offline repair and required review; no paid run, memory enablement or customer-resolution claim. Scores64/100 implementation and56/100 delivery remain unchanged.
 
 **Earlier October26 checkpoint:** #86 merged647b549 after1202/no-model8, exact-head hosted Node20/24/real PostgreSQL, independent review and merged-main CI. [Lifecycle details](docs/GITHUB_NOTICE_LIFECYCLE.md). The old PR backlog is cleared; new work is Mira repository presentation and local #83 source provenance/conflict handling. #62 stays open for reproduced narration/context loss despite merged diagnostics. Production stays c6f482d; no paid run, public Omi test issue or memory enablement. Main implementation64/100; delivery56/100;44 left. Technical identifiers remain unchanged under the Mira product name.
 

commandcode.js

@@ -8,6 +8,7 @@ const { SUPPORT_VOICE } = require('./supportVoice');
 const { normalizeSubQuestions } = require('./retrieval');
 const { isPreviousPost, splitHistory, previousContextBlock } = require('./supportContextFormat');
 const { recordStage } = require('./answerStageEvidence');
+const { SOURCE_DATE_POLICY } = require('./sourceProvenance');
 const { stripPingNarration } = require('./utils');
 const { removedAnswerUnits, rememberRemovalAudit } = require('./answerFilterAudit');
 
@@ -668,6 +669,7 @@ async function reviewAnswer({ question, threadHistory = [], draft, removedBySafe
           content: `${SUPPORT_VOICE}\n\nClarification: the ban on steps from static fallback applies only to troubleshooting a tech or firmware symptom. For a how-to FAQ, the Omi team static product facts are usable below the Help Center and docs when not contradicted; do not invent a source URL. For refund, billing, subscription, account, and data requests, answer any supported policy or procedure from official pages while keeping escalation for the human action. General policy pages cannot verify a specific order status, location, tracking, or delivery date; remove or reject any such claim unless a verified order lookup tool fact supports it. If understanding.dataLossRisk is true, retain a brief warning in the customer language not to reinstall, log out, or clear local recordings while staff checks; do not add an English warning to a non-English reply. Use the customer language and script throughout, including a localized source label; romanized Hindi stays romanized. Do not append an English Source line to an existing localized citation.${handoffPlanned ? ` ${PLANNED_HANDOFF_GUIDANCE}` : ''}`,
         },
         { role: 'system', content: PUBLIC_REPLY_PRIVACY_POLICY },
+        { role: 'system', content: SOURCE_DATE_POLICY },
         ...(safetyAuditTruncated ? [{ role: 'system', content: 'Some removed draft text exceeded the bounded audit budget and is unavailable. Do not infer its contents or assume the draft covered every requested point. Use only the supplied conversation and official evidence.' }] : []),
         ...(citationLimit === 4 ? [{
           role: 'system',

db.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const { Pool } = require('pg');
 const { chunkDocument, cleanDocument, queryTerms, sourceAuthority } = require('./retrieval');
+const { normalizeProvenance } = require('./sourceProvenance');
 
 function sslFor(connectionString) {
   const value = String(connectionString || '');
@@ -51,6 +52,7 @@ async function initSchema() {
         body TEXT NOT NULL DEFAULT '',
         fetched_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
       );
+      ALTER TABLE doc_pages ADD COLUMN IF NOT EXISTS provenance JSONB NOT NULL DEFAULT '{}'::jsonb;
 
       CREATE TABLE IF NOT EXISTS doc_chunks (
         url TEXT NOT NULL REFERENCES doc_pages(url) ON DELETE CASCADE,
@@ -110,7 +112,7 @@ async function initSchema() {
     const chunks = await client.query(`SELECT count(*)::int AS n FROM doc_chunks`);
     const pages = await client.query(`SELECT count(*)::int AS n FROM doc_pages`);
     if ((chunks.rows[0]?.n || 0) === 0 && (pages.rows[0]?.n || 0) > 0) {
-      const existing = await client.query(`SELECT url, title, body FROM doc_pages`);
+      const existing = await client.query(`SELECT url, title, body, provenance FROM doc_pages`);
       for (const page of existing.rows) {
         await replaceDocChunks(client, page);
       }
@@ -232,21 +234,22 @@ async function replaceDocChunks(client, page) {
   return chunks.length;
 }
 
-async function saveDocPage({ url, title, body }) {
+async function saveDocPage({ url, title, body, provenance }) {
   if (!url) return;
   const page = {
     url: String(url),
     title: String(title || ''),
     body: cleanDocument(body),
+    provenance: normalizeProvenance(provenance),
   };
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
     await client.query(
-      `INSERT INTO doc_pages (url, title, body, fetched_at)
-       VALUES ($1, $2, $3, NOW())
-       ON CONFLICT (url) DO UPDATE SET title = $2, body = $3, fetched_at = NOW()`,
-      [page.url, page.title, page.body]
+      `INSERT INTO doc_pages (url, title, body, fetched_at, provenance)
+       VALUES ($1, $2, $3, NOW(), $4::jsonb)
+       ON CONFLICT (url) DO UPDATE SET title = $2, body = $3, fetched_at = NOW(), provenance = $4::jsonb`,
+      [page.url, page.title, page.body, JSON.stringify(page.provenance)]
     );
     await replaceDocChunks(client, page);
     await client.query('COMMIT');
@@ -265,9 +268,9 @@ async function searchDocPages(question, limit = 8, sources = []) {
   const wantedSources = Array.isArray(sources) ? sources.map(String).filter(Boolean) : [];
   const { rows } = await pool.query(
     `WITH query AS (SELECT websearch_to_tsquery('english', $1) AS value)
-     SELECT title, url, section, source, authority, body, chunk_index,
+     SELECT c.title, c.url, c.section, c.source, c.authority, c.body, c.chunk_index, p.provenance,
             ts_rank_cd(search_vector, query.value, 32) AS rank
-     FROM doc_chunks, query
+     FROM doc_chunks c JOIN doc_pages p ON p.url=c.url CROSS JOIN query
      WHERE search_vector @@ query.value
        AND (cardinality($3::text[]) = 0 OR source = ANY($3::text[]))
      ORDER BY (ts_rank_cd(search_vector, query.value, 32) * (1 + authority * 0.06)) DESC,

docs/ANSWER_QUALITY_CONTRACT.md

@@ -4,7 +4,7 @@ Updated October 26, 2026. This is an implementation contract, **not a claim that
 
 ## Priority and status
 
-The [master plan](SUPPORT_MASTER_PLAN.md) takes precedence. The old PR queue is cleared; #71/#75/#82 closed unmerged with unresolved requirements retained. #90 remains draft on accuracy HOLD after one approved controlled comparison. The local [#62 narration-context repair](NARRATION_CONTEXT.md) has passing offline checks but still needs final independent review/current CI and separately approved generated quality. Preserve the maximum of three open PRs; do not treat a repeated one-run approval as new quota authority.
+The [master plan](SUPPORT_MASTER_PLAN.md) takes precedence. The old PR queue is cleared; #71/#75/#82 closed unmerged with unresolved requirements retained. #91 context preservation is merged at a461f86; its rollout failed source applicability and was rolled back. Context/delivery passed, but that does not waive the failed grounding check. #90 provenance integrates that main and awaits final review/CI; the frozen staff-flagging defect is rejected by both integrated #90 and current main. Shared unresolved-next-step/applicability weaknesses remain #83; no new paid run is authorized by these implementation checks. Preserve the maximum of three open PRs.
 
 | Order | Customer failure to prevent | Required regression / acceptance | State |
 | --- | --- | --- | --- |

docs/ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # Mira architecture
 
-**Current restored #62 boundary, October26:** restore the bounded transient first-filter audit→existing reviewer→existing second-look pipeline exactly to reviewed16ff136/generated3ad91ff. The later unknown-answer policy/shared-selection expansion is withdrawn, not an established factual-applicability remedy. Runtime/config identity and all96 saved request bodies plus selected stages/decisions match;1,244 full/offline8 pass. Original22/24 versus main21/24 meets the adopted relative comparison gate: no candidate-only material final failure, no tested protected-person regression and no lower pass count. Shared next-step weakness remains#83; v2's23/24 belongs only to the withdrawn expansion. Current-head review/CI precede merge. Livea9c9508/914a38f0 is operator-confirmed fromOctober26 18:52IST, optional/automatic deploy off. Earliest new releaseOctober27 18:52:34IST with fresh rollback/identity checks. No new private capability, model stage, provider quota or memory enablement.
+**Current October28:** #91 merged a461f86. Its exact rollout c42efc65 passed startup and the normal how-to smoke. The broken-device reply preserved earlier restarts and delivered the full case privately, but applied Limitless-specific guidance without identifying the hardware. Independent review classified that as failed source applicability; rollback toa9c9508/a6ef6b22 is verified healthy and the third smoke held. #90 integrates #91:1,258/offline8 and independent240-check review pass; final-head review/CI precede merge. This does not fix unknown source applicability or produce a new generated score. Hold further releases while #83 receives a general offline repair and required review; no paid run, memory enablement or customer-resolution claim. Scores64/100 implementation and56/100 delivery remain unchanged.
 
 **Earlier October26 checkpoint:** #86 merged647b549 after1202/no-model8, exact-head hosted Node20/24/real PostgreSQL, final independent review and merged-main CI. Its30-day subject-time replay guard, customer erasure and non-starvable cleanup are on main, awaiting release. [Lifecycle details](GITHUB_NOTICE_LIFECYCLE.md). Production stays c6f482d; no paid run, public Omi test issue or memory enablement. The product name is Mira; technical identifiers are stable. Separate #83 source-provenance work is local and not an accuracy claim.
 

docs/IMPLEMENTATION_PLAN.md

@@ -1,6 +1,15 @@
 # Mira implementation checklist
 
-**October26 current state:** #86 merged647b549 after1202/no-model8, exact-head hosted Node20/24/real PostgreSQL, independent review and merged-main CI. Release/smoke remain pending. [Lifecycle details](GITHUB_NOTICE_LIFECYCLE.md). Production stays c6f482d. Mira repository presentation and #83 source provenance are separate new work; no paid run, public Omi test issue or memory enablement.
+**October 26 current state:** Aryan deployed647b549 as `dba28f7d`; health/schema/Discord startup pass, one running instance, optional features/automatic deploy off. #86's authorized existing-synthetic reopen/close smoke passes with one notice per event and the issue closed again; this does not finish #51 or #85. Main `a9c9508` adds only the reviewed Mira repository guide. #83 source provenance/conflict handling is a separate draft; no paid run, new public Omi test issue, agent deployment or memory enablement.
+
+## #83 source provenance and conflict handling — draft
+
+- [x] Observe missing publisher provenance across ingestion/chunks/evidence before implementation; preserve fetch time as a separate operational field.
+- [x] Carry bounded publisher dates and explicit product/surface/version scope through production persistence/search/formatting; unknown/invalid/ambiguous metadata remains unknown and an undated refresh clears stale provenance.
+- [x] Add source/article-title/section/explicit-scope/date ordering only for equivalent relevance/corroboration, plus one shared applicability/conflict policy in answer and both reviewer attempts. Preserve identifier punctuation and complementary safety details; the independent generic-heading displacement is reproduced and repaired.
+- [x] Fourteen original synthetic regressions pass, including full-cap topic separation, stronger-match/query-corroboration guards, policy transport and six simultaneous fetches with10-second deadlines for two-/three-part questions. No provider call or protected case.
+- [x] Runtime `42619cf` passes full 1,216/no-model 8/isolated SQL, exact-head hosted Node 20/24/real PostgreSQL and independent 69-check code review plus all four original reproduction assertions. Later documentation-only heads still need their required CI/review; unchanged runtime evidence is reusable.
+- [ ] Obtain authorization before the necessary generated-answer checks. A policy reaching a model is not proof of compliance. Keep #83 open and draft until its actual accuracy gates pass.
 
 
 ## Current audited execution — October 26, 2026
@@ -10,7 +19,7 @@
 - [x] Audit12 open issues; close only speculative stored summaries #52 not planned. Preserve11 unresolved issues, existing assignments and closed-branch evidence. [Disposition](SUPPORT_ISSUE_AUDIT_2026-10-25.md).
 - [x] #86 lifecycle implemented locally:30-day bounded/non-starvable expiry, payload subject-time rejection, erasure of owned receipt rows with a minimal replay cutoff; red-before synthetic checks,1202/no-model8/isolated SQL pass.
 - [x] #86 hosted real PostgreSQL/Node20/24 CI, final independent85-test/signed HTTP/SQL/two-migration-probe review and merge647b549; merged-main CI passes.
-- [ ] #86 later approved-release smoke on an existing linked synthetic issue/thread. No memory enablement or new public test issue.
+- [x] #86 authorized existing-synthetic reopen/close smoke passes on `647b549` / `dba28f7d`: one notice per event, ordered open checkpoint then closure, and no extra notice at the follow-up read. Issue #23602 ends closed not planned. No memory enablement or new public test issue; [limits](GITHUB_NOTICE_LIFECYCLE.md).
 - [x] #88 merged884fb46 with1174/offline8/current CI/independent35 checks and unchanged reply bytes; #62 remains separate from deployment/customer resolution.
 - [x] Step5 preparation and revised AI-provider-disclosing notice wording approved. Publication, processor/backups and explicit enablement remain unchecked; no memory flag changed.
 - [ ] Then #83 general source conflicts and #65 accuracy; remaining C/D/E and #51/#53/#56 operational reliability stay required. No automatic paid evaluation, customer data use, issue assignment, merge or deployment.

docs/README.md

@@ -10,6 +10,7 @@ Start with the [master plan](SUPPORT_MASTER_PLAN.md). It is the current product
 | [Architecture](ARCHITECTURE.md) | Customer → evidence → answer/review → delivery → staff/engineering workflow |
 | [Implementation checklist](IMPLEMENTATION_PLAN.md) · [Roadmap](../ROADMAP.md) | Implemented boundaries, checks and next work |
 | [Mira’s voice](MIRA_PERSONALITY.md) · [Answer-quality contract](ANSWER_QUALITY_CONTRACT.md) | Considerate, useful and truthful support behavior |
+| [Source conflicts](SOURCE_CONFLICTS.md) | Draft publisher provenance, applicability-aware ordering and unresolved-conflict policy |
 
 ## Operations, privacy and verification
 

docs/RUNBOOK.md

@@ -1,6 +1,6 @@
 # Mira operations runbook
 
-**Current operator receipt, October26:** successful active deployment `914a38f0-1aa6-4d69-8059-34c84a2fcd9a` of `a9c9508`, created at18:52:34 IST, is confirmed operator-triggered by Aryan. One active deployment, complete automatic-trigger reads showing off, and optional memory/context/fix-inbox controls off were checked. This is metadata verification, not a new health/smoke observation. The change since647b549 is the repository guide only. Next release must be **no earlier thanOctober27 at18:52:34 IST**, with fresh live/rollback/optional-off checks and the pinned approved GitHub commit. #91 restoration/review precedes merge; no deployment is ready now. Aryan performs the three post-deploy smokes; a failure uses the verified rollback. [Current master plan](SUPPORT_MASTER_PLAN.md) controls status.
+**Current October28 operator receipt:** #91 mergeda461f868ad097ec93512aeaf111d63f4e4c96997 and was deployed asc42efc65-0efb-4ca2-adca-f5f93627b37f, created20:05:37IST. Exact merged-main CI, rollback availability/cadence/source/off-state preflight, startup/health/schema/login and one running instance passed. Normal phone-only how-to smoke passed. The second smoke preserved the symptom/earlier attempts and delivered one matching private staff card, but improperly applied Limitless-specific guidance to unidentified hardware. Independent review called this a grounding failure. Under Aryan's failure rule, deploymentRollback of verified914a38f0/a9c9508 returnedtrue. Replacementa6ef6b22-26b3-4744-ab8d-e067311ff7da/a9c9508, createdOctober28 at20:27:42IST, is SUCCESS/latest/one running; health/schema/login pass with zero matched startup failures and optional/automatic deployment controls off. Earliest cadence-only window isOctober29 at20:27:42IST; applicability repair/review remains a separate release hold. Third smoke and further releases are held. #90 is not deployed. No environment/settings changes, paid rerun, memory enablement or agent Discord posts. [Master plan](SUPPORT_MASTER_PLAN.md) controls current status.
 
 Do not delete receipt/cutoff rows to force webhook replay. The candidate ignores stale payload subject times, holds uncertain outcomes and retains a minimal customer/time cutoff after owner erasure; cleanup is mandatory even with optional features off. Fixed notice-retention errors mean pending cleanup, not erased records. An unexpected populated pre-lifecycle schema fails closed for review. Use an existing linked synthetic issue/thread for the next approved-release smoke; no new public issue.