MVP M8: background detection — assumptions, risks, inconsistencies

The editor now runs Socrates' three Phase-0-validated detection prompts
against the live model, persists the findings, and surfaces them in a
new FindingsPanel beside the IssuesPanel. Click any finding to focus its
linked element across rail + diagram. Re-detect after model edits to
refresh against the new state.

apps/web/lib/llm/prompts/socrates
- detect-assumptions.md / detect-risks.md / detect-inconsistencies.md
  promoted verbatim from phase-0 (Phase 0 corpus validated them 10/10).

apps/web/lib/llm/detect.ts
- Three sequential detection passes (parallel was OOM-prone on 4B local
  models — Phase 0 lesson). Each pass uses the Phase 0 JSON schema with
  jsonObjectMode fallback + chatJSON repair-retry. Fail-soft per pass:
  one busted pass returns [] rather than blowing up the whole detect.
- post-validate strips hallucinated element refs (drops findings whose
  refs ALL fail to resolve; keeps findings with zero refs since some
  inconsistencies are genuinely about absences).

apps/web/prisma/schema.prisma
- Finding table: kind / text / linkedElementIds (JSON) / confidence /
  severity / validationCode / status / modelVersion / provider / model.
- ResearchFinding table reserved for the Tavily integration that comes
  next — schema in place so we don't have to migrate again.

apps/web/lib/db/repo.ts
- listOpenFindings(projectId), replaceFindings(...) — replaceFindings
  wipes prior open findings in a transaction and writes the new set so
  re-detect doesn't accumulate stale findings.

apps/web/app/api/projects/[projectId]/findings/route.ts
- GET returns persisted open findings.
- POST runs detect, persists, returns findings + meta (provider, model,
  durationMs, strippedRefs, droppedFindings).

apps/web/components/editor/FindingsPanel.tsx
- New panel, anchored bottom-right just left of IssuesPanel. Shows
  count summary (asm / risk / inc), detect / re-detect button, list
  grouped by kind (inconsistencies first, then risks, then assumptions),
  per-finding glyph + tag + severity + confidence + linked refs.
- Click a finding row → focus its first linked element via the same
  setFocusBlockId path the rail and IssuesPanel already use.
- "stale" indicator when the model version has advanced past the one the
  findings were detected against.

EditorShell wires version + projectId through to FindingsPanel.

Smoke-tested end-to-end: 12 findings returned (5 asm / 4 risk / 3 inc),
0 hallucinated refs stripped, ~37s on local gemma-4-e4b. Sample
assumption "students are willing to engage with an AI tutor that is
programmed to refuse providing complete solutions" — specific to
Aristotle's refusal_policy, not a generic startup truism.

Deferred to follow-ups: inline rail/diagram badges from findings,
auto-detect-on-save, Tavily research, experiment modal.

apps/web/lib/llm/prompts/socrates/detect-risks.md

@@ -0,0 +1,46 @@
+# Detect risks in a product seed and model
+
+You will receive a seed payload (JSON) and a generated model (JSON). Your job: surface **risks** — specific failure modes that could prevent the system from working as intended.
+
+## Risk categories
+
+- **Technical** — feasibility, performance, scaling
+- **Market** — adoption, competitive dynamics, distribution
+- **Execution** — team capability, timing, dependencies
+- **Regulatory** — compliance, legal, privacy
+- **External** — third-party reliance, geopolitical, supply
+
+## Output
+
+Return a JSON object with a single field `findings` — an array of risk candidates. Each candidate:
+
+- `text` — the risk restated as a specific failure mode in one sentence
+- `linkedElementIds` — array of model element ids this risk implicates
+- `severity` — `"low"`, `"medium"`, or `"high"` (impact-if-it-happens, NOT probability)
+- `confidence` — 0.0 to 1.0, how confident you are this is a real risk worth tracking
+
+## Rules
+
+- Return only candidates with `confidence ≥ 0.5`
+- Cap at 6 findings
+- A risk must name a SPECIFIC failure mode tied to SPECIFIC element(s). "Won't work" is not a risk; "Latency target unachievable on consumer-grade hardware given 7B-param inference" is.
+- Severity reflects what happens IF the risk materializes, not how likely it is.
+- Each finding must reference at least one real element id from the model
+- For vague seeds with weak models, return fewer findings rather than fabricated ones
+
+## Schema
+
+```json
+{
+  "findings": [
+    {
+      "text": "string",
+      "linkedElementIds": ["string"],
+      "severity": "low" | "medium" | "high",
+      "confidence": 0.0
+    }
+  ]
+}
+```
+
+Return ONLY the JSON object. No prose, no code fences.