Sealed twin predictions, decision-case context, and eval export (roadmap Phase 0+1)

[WKJBryan]

Summary

Implements Phase 0 + Phase 1 of TWIN_ACCURACY_ROADMAP.md.

Phase 0 — context assembly hygiene

• Twin context is budgeted (4000-token greedy fill) and case-first: past decision episodes are retrieved into the prompt as verbatim behavioral cases (new ## Past Decision Cases section, lexical kNN for now)
• Approved records are relevance-gated (cap 12) with a top-confidence fallback instead of unconditionally included
• Every assembled context is tagged context_version (ctx-v2-cases-lexical) in trace events and on the episode, so accuracy deltas are externally attributable

Phase 1 — sealed predictions (capture + export only, no in-app scoring)

• Decision tiles with 2+ options fire one hidden non-streaming LLM call predicting the user's choice; fire-and-forget, never blocks the visible streaming flow
• The prediction is sealed: redacted from IPC responses, trace payloads, and exports until the user records their choice; then revealed with computed agreement
• Misses capture an optional "why was the twin wrong?" correction note — surfaced as a lesson by future case retrieval
• Prediction lifecycle (requested / sealed / failed / outcome_recorded_first) exports so the external harness can model missingness instead of overcounting hits
• Parsing fallback chain: strict JSON → normalized option/label match → raw (manual adjudication); 1-based index convention with text-wins disambiguation
• Prediction prompts are first-person immersed when Twin Identity is configured ("I am {name}… which option do I choose?") — no meta-framing anywhere in model-facing prompts
• New OllamaService::chat() non-streaming variant (visible responses keep streaming)
• Export bundle schema v2: adds decision_episodes.jsonl (pre-outcome predictions redacted to a sealed stub) and feedback_events.jsonl (privacy-filtered against Rejected/Private/NoTrain records)
• Twin Workspace reveal UX: sealed badge, chosen-option select with free-text fallback, agreement badge, correction input on miss — no accuracy aggregates or dashboards (external-eval policy)

Test plan

• cargo test — 200 passed (22 new: serde migration, redaction, selection/budget, adversarial parser suite, agreement, export redaction + privacy)
• npm run test:run — 432 passed (5 new in TwinReviewDecisions.spec.js)
• cargo clippy --all-targets -- -D warnings — no new warnings introduced (36 pre-existing, CI step is continue-on-error)

🤖 Generated with Claude Code