@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added cache-only, registry-pinned MLX summarization with capability, memory,
+  prompt-digest and source-token leakage guards. The deterministic CPU baseline
+  now requires explicit `model="extractive"`; missing runtime or artifacts fail
+  closed instead of silently changing backends (#3234).
 - Added offline benchmark suite listing and description, explicit task metadata,
   and aggregate report comparison with missing-evidence and regression verdicts
   (#286).
 
@@ -2,13 +2,15 @@
 
 OpenMed's clinical summarization stage is generative-last. The public
 `openmed.clinical.summarize()` entry point de-identifies a note first, then
-passes only the de-identified text to a summarizer backend. A deterministic
-extractive fallback is used when no backend is supplied.
+passes only the de-identified text to a summarizer backend. The default `mlx`
+backend resolves the reviewed, revision-pinned Maple alias through the registry.
+It loads cached artifacts only, with outbound Python sockets blocked. It never
+downloads a model or silently falls back to extraction.
 
 ```python
 from openmed.clinical import summarize
 
-result = summarize(note)
+result = summarize(note, model="extractive")  # explicit, offline CPU baseline
 assert result.leakage_check.passed
 print(result.summary)
 ```
@@ -22,7 +24,36 @@ Pipeline code that already performed de-identification may call
 `summarize_deidentified()` with its `DeidentificationResult`. Passing a plain
 string to that guarded stage raises an ordering error.
 
-The default path is local and deterministic. A trained SLM backend is a
-separate task and must be supplied as a local or on-device callable; this
-stage never selects a cloud model or sends raw PHI to one. Summaries are
-assistive outputs and require qualified clinical review.
+Use `model="mlx"` (or `"maple"`) on Apple Silicon after separately installing
+`openmed[mlx]` and downloading the pinned artifact. Raw-note input also requires
+the cached `OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1-mlx` artifact and its
+source model's tokenizer. Download these separately before offline inference;
+no conversion, dependency installation or download runs inside `summarize()`.
+With the default cache locations, provision once using:
+
+```bash
+hf download deepgrove/maple-preview-2bit-mlx --revision 361db5da5e74ff6fcdd852d478e1f266ce11013a
+hf download OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1-mlx --cache-dir ~/.cache/openmed
+hf download OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1 --cache-dir ~/.cache/openmed --include '*.json' --include '*.txt' --include '*.model'
+```
+
+Missing dependencies raise
+`MissingOptionalDependencyError`; missing weights, context overflow, insufficient
+estimated memory, and malformed responses fail closed with content-free errors.
+The adapter runs the shared `summarize` Maple task, template digest, offline
+capability probe and conservative memory preflight before model construction.
+The default memory estimate is capped at 16 GiB; applications can pass an
+`MLXSummarizerBackend(memory_budget_bytes=...)` with an explicit device budget.
+This estimate is not a measured peak-memory guarantee.
+The bounded generation allowance is 2,048 tokens, including internal reasoning;
+it is reserved before model loading. Final summary text is limited to 8 KiB.
+
+`result.metadata` contains only a fixed backend ID and template digest. Do not
+log `result.summary` or `result.to_dict()`: the explicit output contains clinical
+text. Custom callables are trusted local application code, not sandboxed plugins;
+they run with OpenMed's Python socket guard but must not spawn remote tools.
+
+Migration: callers relying on the former implicit sentence-picker must now use
+`model="extractive"`. Maple is a general model, not a released clinical SLM or
+clinically validated summarizer. Summaries require qualified clinical review;
+the source-token leakage check cannot prove that every identifier was detected.
@@ -2,13 +2,12 @@
 
 Summarization is deliberately the last generative stage in the clinical
 pipeline.  :func:`summarize` accepts a raw note, de-identifies it locally, and
-then sends only the de-identified text to a caller-supplied backend or the
-deterministic extractive fallback.  :func:`summarize_deidentified` exposes the
+then sends only the de-identified text to a local backend or explicitly selected
+deterministic extraction. :func:`summarize_deidentified` exposes the
 guarded stage for callers that already own a :class:`DeidentificationResult`.
 
-The default backend is intentionally small and deterministic.  A trained
-on-device SLM, including an MLX implementation, can be supplied through the
-``model`` argument without changing the privacy boundary.
+The default is a cache-only MLX backend. Missing artifacts or runtime fail
+closed; use ``model="extractive"`` for the deterministic CPU baseline.
 """
 
 from __future__ import annotations
@@ -17,7 +16,7 @@
 import inspect
 import re
 from collections.abc import Iterator, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from typing import Any, Protocol
 
 from openmed.core.pii import DeidentificationResult, deidentify
@@ -122,10 +121,11 @@ class SummarizationResult:
     ``result.leakage_check`` or unpack ``summary, leakage_check``.
     """
 
-    summary: str
+    summary: str = field(repr=False)
     leakage_check: LeakageCheck
     mode: str = DEFAULT_SUMMARIZATION_MODE
     backend: str = "deterministic-extractive"
+    template_digest: str | None = None
 
     def __post_init__(self) -> None:
         if not isinstance(self.summary, str):
@@ -136,13 +136,23 @@ def __post_init__(self) -> None:
             raise ValueError("mode must be a non-empty string")
         if not isinstance(self.backend, str) or not self.backend:
             raise ValueError("backend must be a non-empty string")
+        if self.template_digest is not None and (
+            not isinstance(self.template_digest, str)
+            or re.fullmatch(r"sha256:[0-9a-f]{64}", self.template_digest) is None
+        ):
+            raise ValueError("invalid template digest")
 
     def __iter__(self) -> Iterator[str | LeakageCheck]:
         """Yield the summary and leakage check for tuple-style consumers."""
 
         yield self.summary
         yield self.leakage_check
 
+    @property
+    def metadata(self) -> dict[str, Any]:
+        """Return value-free backend and template provenance for audit logging."""
+        return {"backend_id": self.backend, "template_digest": self.template_digest}
+
     def to_dict(self) -> dict[str, Any]:
         """Return a JSON-compatible result without source PHI metadata."""
 
@@ -151,6 +161,7 @@ def to_dict(self) -> dict[str, Any]:
             "leakage_check": self.leakage_check.to_dict(),
             "mode": self.mode,
             "backend": self.backend,
+            "metadata": self.metadata,
         }
 
 
@@ -171,8 +182,8 @@ def summarize(
             :func:`openmed.core.pii.deidentify`.
         mode: Summarization mode forwarded to compatible backends. ``"bhc"``
             denotes a brief hospital-course style summary.
-        model: Optional local/on-device backend. It may be callable with the
-            de-identified text or expose ``summarize(text, *, mode=...)``.
+        model: Registry alias (default ``mlx``), explicit ``extractive``, or
+            a caller-owned local callable accepting de-identified text.
 
     Returns:
         A summary and a passing :class:`LeakageCheck`.
@@ -191,8 +202,31 @@ def summarize(
         return summarize_deidentified(text, mode=normalized_mode, model=model)
     if not isinstance(text, str):
         raise TypeError("text must be a string or DeidentificationResult")
-    result = deidentify(text, method="mask")
-    return summarize_deidentified(result, mode=normalized_mode, model=model)
+    from openmed.clinical.summarize_backends import (
+        LocalSummarizerError,
+        MLXSummarizerBackend,
+        _require_runtime,
+        resolve_summarizer_backend,
+    )
+    from openmed.core.config import OpenMedConfig
+    from openmed.core.offline import network_blocked_if_offline
+
+    backend = resolve_summarizer_backend(model)
+    if isinstance(backend, MLXSummarizerBackend):
+        _require_runtime()
+    failed = False
+    try:
+        with network_blocked_if_offline(local_only=True):
+            result = deidentify(
+                text, method="mask", config=OpenMedConfig(local_only=True)
+            )
+    except Exception:
+        failed = True
+    if failed:
+        raise LocalSummarizerError(
+            "local de-identification failed; prepare cached PII artifacts"
+        )
+    return summarize_deidentified(result, mode=normalized_mode, model=backend)
 
 
 def summarize_deidentified(
@@ -230,7 +264,10 @@ def summarize_deidentified(
             "the de-identified text still contains a source token"
         )
 
-    summary = _invoke_backend(model, source.deidentified_text, normalized_mode)
+    from openmed.clinical.summarize_backends import resolve_summarizer_backend
+
+    backend = resolve_summarizer_backend(model)
+    summary = _invoke_backend(backend, source.deidentified_text, normalized_mode)
     leakage_check = _build_leakage_check(source, summary)
     if not leakage_check.passed:
         raise SummarizationLeakageError(leakage_check)
@@ -239,7 +276,12 @@ def summarize_deidentified(
         summary=summary,
         leakage_check=leakage_check,
         mode=normalized_mode,
-        backend=_backend_name(model),
+        backend=_backend_name(backend),
+        template_digest=(
+            backend.template_digest
+            if _backend_name(backend) != "caller-supplied-local"
+            else None
+        ),
     )
 
 
@@ -274,6 +316,29 @@ def _require_deidentification_result(value: object) -> DeidentificationResult:
 
 
 def _invoke_backend(model: object | None, text: str, mode: str) -> str:
+    from openmed.clinical.summarize_backends import (
+        LocalSummarizerError,
+        MLXSummarizerBackend,
+    )
+    from openmed.core.capabilities import MissingOptionalDependencyError
+    from openmed.core.offline import network_blocked_if_offline
+
+    failed = False
+    try:
+        with network_blocked_if_offline(local_only=True):
+            return _call_backend(model, text, mode)
+    except MissingOptionalDependencyError:
+        if type(model) is MLXSummarizerBackend:
+            raise
+        failed = True
+    except Exception:
+        failed = True
+    if failed:
+        raise LocalSummarizerError("local summarizer execution failed")
+    raise AssertionError("unreachable summarizer state")
+
+
+def _call_backend(model: object | None, text: str, mode: str) -> str:
     if model is None:
         return _extractive_summary(text)
 
@@ -303,7 +368,7 @@ def _invoke_backend(model: object | None, text: str, mode: str) -> str:
         else:
             output = callback(text)
 
-    if not isinstance(output, str):
+    if not isinstance(output, str) or len(output.encode("utf-8")) > 8192:
         raise TypeError("summarizer backend must return a string")
     return output.strip()
 
@@ -319,11 +384,16 @@ def _extractive_summary(text: str) -> str:
 
 
 def _backend_name(model: object | None) -> str:
-    if model is None:
+    from openmed.clinical.summarize_backends import (
+        ExtractiveSummarizerBackend,
+        MLXSummarizerBackend,
+    )
+
+    if type(model) is ExtractiveSummarizerBackend:
         return "deterministic-extractive"
-    if hasattr(model, "summarize"):
-        return f"{type(model).__name__}.summarize"
-    return type(model).__name__
+    if type(model) is MLXSummarizerBackend:
+        return "local-mlx"
+    return "caller-supplied-local"
 
 
 def _source_phi_surfaces(deidentified: Any) -> tuple[str, ...]: