Errata retracts on two votes and a flag, alignment shortlists its candidates, and each task thinks as hard as it needs

[WaylandYang]

The first measured typed-graph runs (#893's README) spent 136,000 tokens per 200-word document and the errata agent retracted mostly what the document did say. This PR is the set of cuts that followed, each measured on the same 20 documents (numbers in the bench README, "第二次真跑"), landing at about 56,000 tokens per document with precision back where the thinking model puts it.

Errata agent (0044 decision 7)

• A retraction or revision needs a structural flag and two votes: an unflagged fact is never retracted by the agent alone (held for a person as unflagged), and a flagged one is asked about a second time, alone with the document; only an explicit not stated retracts. On 100 documents the agent went from 34/37 wrong retractions to zero (2 retractions, 8 revisions, all confirmed).
• Additions opened the other way: a name the document contains but the base lacks becomes a new entity with its name fact; a document that came out of extraction with no typed facts is reviewed once with an empty list. Recall on 100 documents 9.3% → 18.4% (same-sentence 13.1% → 26.5%); full-set judged precision 90.2%.
• The errata prompt carries only the 24 properties nearest the document plus those its facts use (4.7k → ~1k prompt tokens a call).

Alignment cost (0044 decision 3)

• Shortlist: when the structure fits more than ten properties, the signature's phrase and an example are embedded and the ten nearest properties are shown (label matches always kept); the shortlist is part of the decision's basis. Kind words get the same for rule proposals. 18k → 4k tokens a call.
• The candidate glossary is written once per batch in both the alignment and the rule prompts; items list keys.
• A label the model answers instead of a key counts when unique: with p569-style keys the model answers dateOfBirth, and 586 of 1189 signatures in the first run were counted as malformed for it. A key the shortlist hid still counts if it fits structurally.
• Rule proposals ask only bound signatures (the 1121 none signatures produced under 1% of proposals and half the calls).
• Batches run four at a time (alignment, rule proposals, the bench judge); 20 documents' alignment 29 min → 5 min.

Reasoning effort

• llm_settings.chat_reasoning_effort (migration 0075; minimal | low | medium | high, empty = endpoint default) rides as reasoning_effort in every chat body; settings API and page in both languages. Extraction, readings and errata use it (minimal turns thinking off without changing the answer).
• Judgement tasks think on their own: alignment at low (JUDGEMENT_EFFORT), rule proposals at low. All-minimal alignment judged 31% misworded, endpoint default 12%, low 76% precision on the small sample, so the constant is a measured choice and one line to change.
• The ontology embedding job fails (and so retries) when a batch fails instead of leaving vectors missing; the alignment reply that carried malformed votes is logged.

Bench: --corpus redocred-20 smoke corpus, governance off in the bench base, embedding model configured in setup with property vectors built before extraction.

Verified against pgvector/pgvector:pg16 on a fresh database, after rebasing onto #894/#895:

cargo fmt --all --check / clippy --workspace --all-targets -D warnings    clean
cargo test -p utopia-store                                                344 passed, 0 failed
cargo test -p utopia-server                                               407 passed, 0 failed
cargo test -p utopia-extract / utopia-llm / utopia-cli                    84 / 37 / 13 passed
cd web && pnpm build && pnpm test                                         tsc clean, 132 passed

Plus the measured runs: round 3 (100 documents) and smoke5/6/8b/9/10 (20 documents) as tabled in the README.

🤖 Generated with Claude Code

[WaylandYang]

Reviewed the code diff in full (the bench data aside) and landed two maintainer edits so this can merge:

• The web job failed on the style guard: the reasoning-effort choice was a native <select> with rounded-md and py-1.5. It is a Dropdown now, as web/DESIGN.md rule 5 asks; style guard, tsc and the 132 web tests pass.
• Merged dev (Materialization reconciles the rows it writes, and a version keeps the date it was pushed with #911 and A rule's definition has a history, and a conclusion names the version it was drawn under #913 landed meanwhile, both with a migration) and set CURRENT_SCHEMA_VERSION to 78: 0075, 0076 and 0090 all count.

On the substance: the two-votes-and-a-flag rule for retractions, the once-per-batch glossary with keys per item, the label-as-key fallback, the shortlist as part of the decision basis, and the per-task reasoning effort all read as the measured cuts the README describes, and each has a test at the layer it changes. One thing to keep an eye on rather than block: documents_due now sends every extracted document with no typed facts through errata once, which is the right call for recall but means a large base's first errata pass touches every document; the errata_runs row keeps it to once.

Locally on a fresh database after the merge: CLI 13, server errata 4, phrase alignment 13, store errata 6, extract 84 tests pass; clippy clean. Merging once CI agrees.