@avantf/dsh-mem 0.3.0 → 0.4.0

package/lib/index.js

@@ -12,7 +12,7 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { createInflateRaw } from "node:zlib";
-import Database from "better-sqlite3";
+import { readdir } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 //#region ../contract/lib/types.js
 /** Shared domain types for avantf-mem. Single source of truth in @avantf/mem-contract. */
@@ -66,6 +66,27 @@ function withoutRetentionDiagnostics(value) {
 	return project(value);
 }
 /**
+* The floor profiles a retrieval CALL may ask for. There is deliberately no numeric per-call
+* override: the two profiles are named policies, and their values live in ONE place
+* (`@avantf/mem-retrieval`'s `store/floors.ts`), so a caller cannot invent a third calibration.
+*
+*  - **omitted** — the default policy: the configured (strict) floors, and if they empty the result
+*    while having dropped candidates, ONE relaxed pass over the absolute bottom line before
+*    answering. `RecallResult.relaxed` marks that second pass.
+*  - **`strict`** — the configured floors with NO fallback. This is what the UI's 严格 mode sends, so
+*    the panel can show the honest strict outcome plus how many candidates the floors removed.
+*  - **`loose`** — the relaxed floors outright (never "no floors": it still answers "nothing
+*    relevant" for an unrelated question).
+*
+* Why a second pass exists at all. The floors are calibrated for paraphrase-style relevance, and
+* there is a band where no threshold separates "answers the question" from "unrelated": measured on
+* the live store, the fact answering 「我是谁」 scored cosine 0.444 while four unrelated queries
+* topped out at 0.384 — a 0.06 margin, and the answering fact was the query's own top-1. A relaxed
+* PASS is bounded (it runs only on an empty strict result and keeps its own floor); a lower default,
+* or exempting the user's `pinned` archive from the floors, trades precision on every query.
+*/
+const FLOOR_PROFILES = ["strict", "loose"];
+/**
 * Weights reported when the semantic leg is unavailable (FTS+entity rebalance).
 * Single source for both stores and the cross-retrieval router — previously the
 * same literal lived in three files and could silently desync.
@@ -115,13 +136,7 @@ const vectorStoreSchema = z.object({
 	* sub-millisecond. At 8000 recall falls to 0.89, so for a larger corpus raise
 	* `hnswlib_ef_search` (or accept the loss) instead of moving this threshold.
 	*/
-	auto_thresholds: z.object({
-		hnswlib: z.number().int().positive().default(2e3),
-		faiss: z.number().int().positive().default(1e5)
-	}).default({
-		hnswlib: 2e3,
-		faiss: 1e5
-	}),
+	auto_thresholds: z.object({ hnswlib: z.number().int().positive().default(2e3) }).default({ hnswlib: 2e3 }),
 	/**
 	* ANN search beam width (`ef`). This is the recall/speed knob of the hnswlib index, and it is
 	* NOT optional in practice: the library's own default (10) returned 0.45 of the true top-10 in
@@ -144,6 +159,33 @@ const retrieverSchema = z.object({
 	max_output_tokens: z.number().int().nonnegative().default(8e3),
 	over_fetch_factor: z.number().int().positive().default(5),
 	/**
+	* Relevance floor for the SEMANTIC leg, in cosine units (`0` = off).
+	*
+	* Applied to the leg's RAW score BEFORE `fuse()`: fusion scales each leg by its own maximum, so
+	* the fused number is relative to the query and cannot carry an absolute cutoff (DESIGN §7 /
+	* §20.19). A score EQUAL to the floor is kept — only strictly-lower candidates are dropped.
+	*
+	* The default is calibrated for the shipped embedder (`Xenova/bge-small-zh-v1.5`, dim 512,
+	* mean-pooled AND normalized). A different model is a different cosine scale: re-measure before
+	* keeping 0.5 (see DESIGN §20.19).
+	*/
+	min_semantic_similarity: z.number().min(0).max(1).default(.5),
+	/**
+	* Relevance floor for the FTS leg: the minimum number of DISTINCT query terms a row must hit
+	* (`0` = off). Judged PER ROW — the terms are `store/lexical.ts`'s `relevanceTerms()` (latin words
+	* ≥ 5 chars + every CJK 3-gram), and a row that hits fewer is dropped.
+	*
+	* `bm25` itself is unbounded and query-relative, so it cannot host an absolute floor. With the
+	* semantic leg unavailable this value is relaxed to 1 by the orchestration (FTS + entity are then
+	* the only evidence a short query has); a configured `0` stays off either way.
+	*/
+	min_fts_terms: z.number().int().nonnegative().default(2),
+	/**
+	* Relevance floor for the entity-overlap (Jaccard) leg, as a ratio of the union (`0` = off).
+	* A score EQUAL to the floor is kept.
+	*/
+	min_jaccard: z.number().min(0).max(1).default(.2),
+	/**
 	* Rows one non-semantic retrieval leg may hand to fusion (`0` = derived: `max(200, 4×overFetch)`).
 	*
 	* The legs used to return the whole matching corpus — a common phrase matched every fact — and
@@ -236,7 +278,7 @@ const toolsSchema = z.object({
 });
 /** The merged runtime config shared by memory and knowledge stores. */
 const ConfigSchema = z.object({
-	dataHome: z.string().default("~/.avantf"),
+	dataHome: z.string().default("~/.avantf").describe("数据根的配置层载体（解析次序的第 ② 层）：只承载 profile 传进来的配置值——`resolveDataHome` 在合并 `configs/common.yaml` 之前就要定根，所以这个文件里的同一键**不参与**解析。属历史遗留键，保留是为了让既有配置继续可用（见 AGENTS.md「边界与路径」）。"),
 	semantic: semanticSchema.prefault({}),
 	rerank: rerankSchema.prefault({}),
 	vectorStore: vectorStoreSchema.prefault({}),
@@ -324,6 +366,56 @@ const KnowledgeConfigSchema = z.object({
 	ingest: ingestSchema.prefault({})
 });
 //#endregion
+//#region ../contract/lib/env.js
+/**
+* Tiny env/path helpers shared by every package — the single source of truth for
+* `~/` expansion and boolean env parsing (previously duplicated in core paths,
+* both model adapters, and the config loader).
+*/
+/** Expand `~/…` (and a BARE `~`) against the USER home directory.
+*
+* The bare form matters: `AVANTF_HOME=~` used to come back verbatim, i.e. as the RELATIVE path `~`,
+* and everything built on it was written into the current working directory. The base kit's own
+* `expandHome` always expanded it, so the two copies disagreed on exactly the input a shell makes
+* easy to type. */
+function expandHome$1(p) {
+	if (p === "~") return homedir();
+	return p.startsWith("~/") ? join(homedir(), p.slice(2)) : p;
+}
+/** Parse a boolean env var: `0`/`false` → false, unset/empty → undefined, else true. */
+function envFlag(name) {
+	const raw = process.env[name];
+	if (raw === void 0 || raw === "") return void 0;
+	return raw !== "0" && raw.toLowerCase() !== "false";
+}
+/**
+* The global model-download kill switch.
+*
+* TWO switches, either of which turns downloads off:
+*
+*   - `AVANTF_MEM_AUTO_DOWNLOAD` — this project's switch (CLI, MCP server, tests);
+*   - `AVANTF_ENVINIT_AUTO_DOWNLOAD` — the family framework's switch, a MASTER gate: the operator
+*     turns the whole family's provisioning off in one place, so the engine must stop fetching too
+*     (otherwise the framework skips its item while the runtime silently downloads the same model).
+*
+* Deliberately honored in the config loader (env layer ④, so `rt.config` reflects reality) and in
+* the model adapters themselves, so even a directly constructed backend (tests, third-party
+* embedders) can never reach the network. As an ops/test kill switch it intentionally overrides the
+* configured/passed `autoDownload`.
+*
+* Three-valued on purpose: either switch `0`/`false` → `false`; the project switch `1`/`true` →
+* `true`; otherwise (including the family switch merely being `1`, which only means "the family did
+* not disable anything") → `undefined`, so the configured value stands. The family switch is a
+* master GATE, not a force-on: it must be able to stop the runtime, never to override
+* `semantic.auto_download: false`.
+*/
+function envAutoDownload() {
+	const project = envFlag("AVANTF_MEM_AUTO_DOWNLOAD");
+	const family = envFlag("AVANTF_ENVINIT_AUTO_DOWNLOAD");
+	if (project === false || family === false) return false;
+	return project;
+}
+//#endregion
 //#region ../contract/lib/family.js
 /**
 * The family root and the two managed directories under it — ONE definition of a convention that
@@ -334,16 +426,20 @@ const KnowledgeConfigSchema = z.object({
 * (pandoc), `models` the downloaded embedding/rerank weights in the flat layout the transformers.js
 * cache reads. The engine's built-in defaults point HERE, not at the pre-framework
 * `~/.avantf/{tools,models}`: those legacy directories are no longer a fallback anywhere, so a
-* machine that never creates them loses nothing, and no process resolves a path that only works
+* machine that never creates them loses nothing, and no process resolves a path that only missions
 * because somebody left a compatibility symlink behind.
 *
 * `provision` mirrors {@link familyHome} (it is deliberately dependency-free, so it cannot import
 * this module); `packages/core/test/family_paths.spec.ts` pins the two copies together so the
 * convention cannot drift.
+*
+* The `~/` expansion is NOT a private copy any more: this module and `env.ts` used to carry two
+* literally identical `expandTilde`/`expandHome` bodies in the same package, and only the exported
+* one was pinned — so the un-pinned copy could drift silently. It now calls {@link expandHome}.
 */
 function familyHome$1(env = process.env) {
 	const configured = env["AVANTF_HOME"]?.trim() ?? "";
-	return configured !== "" ? expandTilde(configured) : join(homedir(), ".avantf", "env");
+	return configured !== "" ? expandHome$1(configured) : join(homedir(), ".avantf", "env");
 }
 /** The managed external-binary root (`<family root>/tools`). */
 function familyToolsDir$1(env = process.env) {
@@ -353,11 +449,6 @@ function familyToolsDir$1(env = process.env) {
 function familyModelsDir(env = process.env) {
 	return join(familyHome$1(env), "models");
 }
-/** `~/x` → `<home>/x`, `~` → `<home>`; anything else is used as given. */
-function expandTilde(path) {
-	if (path === "~") return homedir();
-	return path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
-}
 //#endregion
 //#region ../contract/lib/tools.js
 /**
@@ -384,6 +475,13 @@ const QUERY_KINDS = [
 	"doc_chunk"
 ];
 /**
+* The one description both retrieval entry points use for `floors`.
+*
+* Written once because `mem_recall.search` and `kb_query` accept the same override, and a second
+* copy is how the two surfaces drift (the model then reads two different meanings for one field).
+*/
+const FLOORS_FIELD_DESCRIPTION = "相关性门槛档位（可选）。不传=默认策略：严格门槛，严格门槛一条都没命中而确有条目被门槛丢弃时自动再跑一次宽松门槛；strict=只用严格门槛，无自动放宽；loose=直接用宽松门槛（仍有绝对底线，代词式提问如「我是谁」「我司」属于这一类）。";
+/**
 * The longest retrieval query the contract accepts, in characters.
 *
 * There is no useful query beyond this, and there IS a cost: a CJK query is expanded into one trigram
@@ -465,7 +563,8 @@ const RecallUnion = z.discriminatedUnion("action", [
 		query: z.string().min(1).max(MAX_QUERY_CHARS, QUERY_TOO_LONG).describe("检索文本。action=search 时必填。"),
 		category: z.string().optional().describe("限定分类；可选。"),
 		limit: z.number().int().positive().max(50).optional().describe("返回条数上限（1-50）；可选。"),
-		max_tokens: z.number().int().nonnegative().optional().describe("本次结果的总 token 上限；0=不限制。缺省用配置 retrieval.max_output_tokens。")
+		max_tokens: z.number().int().nonnegative().optional().describe("本次结果的总 token 上限；0=不限制。缺省用配置 retrieval.max_output_tokens。"),
+		floors: z.enum(FLOOR_PROFILES).optional().describe(FLOORS_FIELD_DESCRIPTION)
 	}),
 	z.object({
 		action: z.literal("ask"),
@@ -603,7 +702,8 @@ const QueryUnion = z.object({
 	max_tokens: z.number().int().nonnegative().optional().describe("本次结果的总 token 上限；0=不限制。缺省用配置 retrieval.max_output_tokens。"),
 	domain: z.string().optional().describe("限定知识域；可选。"),
 	source: z.string().optional().describe("限定来源；可选。"),
-	limit: z.number().int().positive().max(50).default(10).describe("返回条数上限（1-50）；可选，默认 10。")
+	limit: z.number().int().positive().max(50).default(10).describe("返回条数上限（1-50）；可选，默认 10。"),
+	floors: z.enum(FLOOR_PROFILES).optional().describe(FLOORS_FIELD_DESCRIPTION)
 });
 const REMEMBER_TOOL = {
 	key: "remember",
@@ -723,6 +823,14 @@ function mergedFieldDescription(base, requiredIn) {
 * `unwrapRemoteEnvelope` peels both, in order, and also tolerates a bare payload
 * (a gateway that returns raw values, or a future protocol change), so the pages
 * never render an envelope as if it were data.
+*
+* The application envelope also carries the **wire revision** (`wire`, optional): the host stamps
+* the revision of the Remote FACE it publishes onto every answer (see `@avantf/dsh-mem`'s
+* `remote.ts` `WIRE_VERSION`), and the client half reads it back to tell a rebuilt browser bundle
+* from the host process that `dsh web` loaded before it. It rides the envelope rather than one
+* method's payload because this plugin has no single entry point — each tab makes its own first
+* call — while the envelope is the one object every answer shares. Absent means "a host older
+* than the marker": still readable, but the client may not assume a method it knows about exists.
 */
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -854,54 +962,146 @@ function errorCode(error) {
 	}
 }
 //#endregion
-//#region ../contract/lib/env.js
+//#region ../contract/lib/text.js
+/**
+* Well-formedness of every string mem stores or shows a model — the mem-side MIRROR.
+*
+* The defect this module exists for is ONE shape: a lone surrogate — a UTF-16 code unit in the
+* `D800–DFFF` range with no partner. A string carrying one is not a valid Unicode scalar sequence,
+* and `JSON.stringify` happily emits it as the escape `"\ud800"`: JavaScript's own `JSON.parse`
+* accepts that, so the defect passes every check inside this repository, while a strict parser
+* (Rust's `serde_json`, JSON Schema validators, most non-JS consumers) rejects the whole document.
+* The same half-code-unit also poisons FTS, embeddings and the UI. `String.prototype.toWellFormed`
+* (Node ≥20, present in this repo's Node ≥22.15) replaces each lone surrogate with U+FFFD, which is
+* exactly the repair wanted.
+*
+* ── THE ORIGINAL IS THE BASE KIT ──────────────────────────────────────────────────────────────
+*
+* `base/plugin-base/src/kit/wellformed.ts` owns `wellFormedText` / `wellFormedDeep` (interface v2)
+* and is the copy ONE base release fixes for the whole family. This module is its **deliberate
+* mirror**, in the same sense as `./family.ts` (whose original is the base's `kit/family.ts`): the
+* engine (`@avantf/mem`) and the CLI / MCP faces have **no DSH host and never load the base**
+* (`AGENTS.md`), so they cannot reach the original and keep a dependency-free copy as their
+* documented degradation path. The cross-tree test
+* `mem/packages/plugin/test/wellformed_pin.spec.ts` takes the REAL linked base and compares it with
+* this mirror on one set of samples (the precedent is `family_pin.spec.ts`); **do not change one
+* side without the other**.
+*
+* ── WHO RUNS: the base when a host installed it, the mirror otherwise ─────────────────────────
+*
+* This module is also the ONE place the DSH plugin can hand the base's implementation in:
+* {@link adoptWellFormed} takes the module the bootstrap loaded and swaps the two functions for the
+* base's, falling back per member when it does not carry them. The switch is deliberately
+* **"does the loaded module HAVE the function"** (a `typeof` read of each member, guarded against a
+* hostile getter) — never an interface-generation check, so a base that predates the v2 helpers
+* (generation v1) simply keeps the mirror and the plugin still mounts completely. Nothing here can
+* throw or refuse a mount.
+*
+* Two directions, two functions, deliberately NOT one:
+*
+*  - {@link toWellFormedText} is the WRITE side. It additionally applies `normalize('NFC')`, because
+*    Unicode equivalence is a persistence concern: two spellings of the same text must not become
+*    two rows, two FTS terms or two entities. Every store write and every derived string (entity
+*    names, SPO slots) goes through it BEFORE it is persisted. **NFC is mem's policy, not the
+*    well-formed layer's**: the base's `wellFormedText` does NOT normalize, and when it is adopted
+*    the write wrapper here is exactly `base.wellFormedText(value).normalize('NFC')`.
+*  - {@link toWellFormedDeep} is the READ side. It never changes anything except lone surrogates,
+*    and it walks the result value so that data this process did not just write — a row written by
+*    an older build or a foreign driver, a string the tokenizer derived — still serializes to JSON
+*    every strict parser accepts. Applying NFC here would silently rewrite history for display, so
+*    it does not.
+*
+* @module contract/text
+*/
+/**
+* The engine's own well-formed layer, and the default: `String.prototype.toWellFormed()` — the
+* exact call this module has always made (Node ≥20; the repo floor is ≥22.15).
+*/
+const nativeText = (value) => value.toWellFormed();
+/** The well-formed layer in force. {@link adoptWellFormed} replaces it with the base's. */
+let repairText = nativeText;
+/**
+* The local recursion behind {@link toWellFormedDeep} — the mirror's read side.
+*
+* Recursion rules, and they are deliberately narrow: only strings are touched
+* ({@link repairText} — no NFC, see the module note), arrays are mapped, and objects that carry no
+* `toJSON` are rebuilt with well-formed keys and values. Everything else — numbers, booleans,
+* `null`, `undefined`, functions, symbols — is returned as-is, so this can never change a value's
+* JSON meaning. An object WITH a `toJSON` method (`Date`, `Buffer`, `RegExp`, …) is handed back
+* untouched, because `JSON.stringify` itself would serialize it through that method; cloning its
+* enumerable own properties instead would turn a `Date` into `{}`.
+*
+* Object KEYS are normalized too: a lone surrogate in a property name is emitted verbatim by
+* `JSON.stringify` (the replacer form of this fix cannot repair it, which is why this clones),
+* and it breaks a strict parser just the same.
+*
+* It reads {@link repairText} at every call, so a host that installs a well-formed string layer
+* without a recursive one still gets it used throughout the walk.
+*/
+function mirrorDeep(value) {
+	if (typeof value === "string") return repairText(value);
+	if (Array.isArray(value)) return value.map((item) => mirrorDeep(item));
+	if (value !== null && typeof value === "object" && typeof value.toJSON !== "function") {
+		const out = {};
+		for (const [key, item] of Object.entries(value)) out[repairText(key)] = mirrorDeep(item);
+		return out;
+	}
+	return value;
+}
+/** The recursive repair in force. {@link adoptWellFormed} replaces it with the base's. */
+let repairDeep = mirrorDeep;
 /**
-* Tiny env/path helpers shared by every package — the single source of truth for
-* `~/` expansion and boolean env parsing (previously duplicated in core paths,
-* both model adapters, and the config loader).
+* The ONE write-side normalization: well-formed, and NFC.
+*
+* Called at the store write entries (never at each individual string field), so a fix here lands
+* everywhere at once.
 */
-/** Expand `~/…` (and a BARE `~`) against the USER home directory.
+function toWellFormedText(value) {
+	return repairText(value).normalize("NFC");
+}
+/**
+* The read-side twin: a structurally identical value in which every string is well-formed.
 *
-* The bare form matters: `AVANTF_HOME=~` used to come back verbatim, i.e. as the RELATIVE path `~`,
-* and everything built on it was written into the current working directory. The base kit's own
-* `expandHome` always expanded it, so the two copies disagreed on exactly the input a shell makes
-* easy to type. */
-function expandHome$1(p) {
-	if (p === "~") return homedir();
-	return p.startsWith("~/") ? join(homedir(), p.slice(2)) : p;
+* Delegates to {@link repairDeep}: the local {@link mirrorDeep} until a host installs the base's
+* `wellFormedDeep` through {@link adoptWellFormed}, which is the same walk (see the module note).
+*/
+function toWellFormedDeep(value) {
+	return repairDeep(value);
 }
-/** Parse a boolean env var: `0`/`false` → false, unset/empty → undefined, else true. */
-function envFlag(name) {
-	const raw = process.env[name];
-	if (raw === void 0 || raw === "") return void 0;
-	return raw !== "0" && raw.toLowerCase() !== "false";
+/** Read one member without letting a hostile module's getter escape. */
+function member$1(module, name) {
+	try {
+		return module?.[name];
+	} catch {
+		return;
+	}
 }
 /**
-* The global model-download kill switch.
+* Prefer the loaded base's well-formed helpers; fall back to this mirror for whatever it lacks.
 *
-* TWO switches, either of which turns downloads off:
+* The plugin calls this ONCE at mount with the module the bootstrap loaded (`env?.kit`). The
+* decision per member is a `typeof` check — the v2 members are an OPTIONAL capability, and a base
+* that predates them (interface v1) or a module with none of them leaves both repairs on the mirror.
+* It is total: a hostile module reads as "reports none", nothing throws, and a mount is never
+* refused or changed by the outcome.
 *
-*   - `AVANTF_MEM_AUTO_DOWNLOAD` — this project's switch (CLI, MCP server, tests);
-*   - `AVANTF_ENVINIT_AUTO_DOWNLOAD` — the family framework's switch, a MASTER gate: the operator
-*     turns the whole family's provisioning off in one place, so the engine must stop fetching too
-*     (otherwise the framework skips its item while the runtime silently downloads the same model).
-*
-* Deliberately honored in the config loader (env layer ④, so `rt.config` reflects reality) and in
-* the model adapters themselves, so even a directly constructed backend (tests, third-party
-* embedders) can never reach the network. As an ops/test kill switch it intentionally overrides the
-* configured/passed `autoDownload`.
+* Calling it AGAIN replaces whatever was installed before, so passing `undefined` restores the
+* mirror (the CLI / MCP faces never call it at all and keep the mirror for their whole life).
 *
-* Three-valued on purpose: either switch `0`/`false` → `false`; the project switch `1`/`true` →
-* `true`; otherwise (including the family switch merely being `1`, which only means "the family did
-* not disable anything") → `undefined`, so the configured value stands. The family switch is a
-* master GATE, not a force-on: it must be able to stop the runtime, never to override
-* `semantic.auto_download: false`.
+* @param kit - the loaded base module (or anything else; only the two members are read).
+* @returns which repair each side came from, for the caller's log line.
 */
-function envAutoDownload() {
-	const project = envFlag("AVANTF_MEM_AUTO_DOWNLOAD");
-	const family = envFlag("AVANTF_ENVINIT_AUTO_DOWNLOAD");
-	if (project === false || family === false) return false;
-	return project;
+function adoptWellFormed(kit) {
+	const kitText = member$1(kit, "wellFormedText");
+	const kitDeep = member$1(kit, "wellFormedDeep");
+	const text = typeof kitText === "function";
+	const deep = typeof kitDeep === "function";
+	repairText = text ? kitText : nativeText;
+	repairDeep = deep ? kitDeep : mirrorDeep;
+	return {
+		text,
+		deep
+	};
 }
 //#endregion
 //#region lib/types/prompt.js
@@ -947,7 +1147,7 @@ function envAutoDownload() {
 const MEMORY_PROMPT_SECTION = {
 	name: "avantf:memory-usage",
 	order: 3e3,
-	text: "记忆（`mem_remember`）：把**重要且跨会话仍成立**的事实主动记下来——用户偏好、项目决策、环境约束、接口约定、踩过的坑。同一事实的修正用 `update`，一句自包含的陈述。不要记录临时聊天内容、一次性任务的中间状态、能直接从代码或文档读到的内容。"
+	text: "记忆（`mem_remember`）：只主动记录跨会话稳定、能影响未来决策的信息：用户偏好、长期约束、约定与术语、反复踩的坑、可复用判断。优先写成自包含的一条——事实型写「谁 / 什么范围 / 偏好或要求或术语是什么」，规则型写「当……时，应……，附条件与例外」。留下未来可检索的位置（路径 / 来源 / 名称），不抄全文；同一主题用 `update` 修正，不同事实新增。不要记录临时聊天、一次性任务的中间状态、能从权威来源轻易查到且无需跨会话记住的内容；敏感信息只记存放位置、不记明文。记录前自检：忘掉它，未来同类情境下我会不会做错、重走弯路或再问一遍？离开当前上下文还懂吗？还稳定吗？与已有记忆重复吗？通用判断再问跨任务/领域是否成立，领域记忆只要求同类任务可复用。"
 };
 /**
 * WHEN to consult the document knowledge base. See the module comment for why this is a separate
@@ -964,10 +1164,15 @@ const KNOWLEDGE_PROMPT_SECTION = {
 * directory (`<data_home>/prompts`, see {@link PromptFiles}).
 *
 * Every avantf plugin writes its prompts into that one directory and owns a prefix — `mem-*` here,
-* `work-*` in the work engine — so a deployment can find and diff all of its model-facing text in
+* `mission-*` in the mission engine — so a deployment can find and diff all of its model-facing text in
 * one place without any plugin having to guess which files belong to it. This manifest is that
 * ownership: a `.md` it does not list is ignored (never read, never written, never deleted).
 *
+* Since interface v3 the prefix is machine-checked, not a convention: every `file` below is a bare
+* name starting with `mem-`, and the loader is built with `namespace: 'mem'`
+* ({@link PROMPT_NAMESPACE}), so the base refuses — with a warning, without touching disk — any spec
+* that names a file outside this plugin's prefix.
+*
 * The FILE owns the text; the CODE keeps the identity. Mapping a file name to a section HERE is what
 * makes that true: no edit to the directory can move a section to a different point in the prompt
 * (order) or change the name the harness dedupes on — and no file another plugin owns can be
@@ -1211,10 +1416,15 @@ const DEFAULT_COMMON_CONFIG = `# avantf-mem 公共配置（分层第②层）。
 #     hnswlib: 2000
 #   hnswlib_ef_search: 256            # ANN 的召回/速度旋钮，语料变大先调它
 
-# retriever:                          # 三条检索腿在融合里的权重
+# retriever:                          # 三条检索腿在融合里的权重与"相关性门槛"
 #   weight_semantic: 0.55
 #   weight_fts: 0.30
 #   weight_jaccard: 0.15
+#   # 绝对门槛打在每条腿的原始分上、fuse() 之前（融合分只在一次查询内可比，不能当门槛）。
+#   # 0 = 关闭该门槛；分数等于门槛保留。语义后端不可用时 min_fts_terms 的生效值放宽到 1。
+#   min_semantic_similarity: 0.5      # 语义腿余弦；0.5 只对 bge-small-zh-v1.5/512 标定过，换模型要重标
+#   min_fts_terms: 2                  # FTS 腿：这一行命中几个不同的查询词元（拉丁词≥5字符 + CJK 3-gram）
+#   min_jaccard: 0.2                  # 实体腿 Jaccard 比值
 
 # lifecycle:
 #   purge_after_archived_days: 365    # 归档事实的物理清理窗口（活跃日）
@@ -1271,12 +1481,27 @@ function resolveStorePath(raw, fallback) {
 	if (!raw) return fallback;
 	return expandHome$1(raw);
 }
-function readYamlOrNull(path) {
+/**
+* Read one config YAML, or `null` when it is absent / unreadable / not a mapping.
+*
+* A PARSE FAILURE IS NOT SILENT. Treating a broken file as "no configuration" is the right behaviour
+* — the process must keep starting — but the settings it silently drops include the security knobs
+* (`knowledge.ingest.local_roots`, `allow_outside_workspace`, `allow_private_network`, `trust.*`), so
+* one bad indent used to change the ingestion boundary with no trace anywhere. `warnUnknownKeys`
+* below calls itself "the one message that tells an operator their config file is partly ignored";
+* the branch where the WHOLE file is ignored was the one with no message at all.
+*
+* Still returns `null` (behaviour unchanged, every value falls back to its default). This is a
+* warning, deliberately not a fail-closed: refusing to start on a syntax error is a host-behaviour
+* change that needs a user decision, not a drive-by fix.
+*/
+function readYamlOrNull(path, logger) {
 	try {
 		if (!existsSync(path)) return null;
 		const parsed = parse(readFileSync(path, "utf8"));
 		return parsed && typeof parsed === "object" ? parsed : null;
-	} catch {
+	} catch (error) {
+		logger.warn(`${path}: YAML parse failed (${error instanceof Error ? error.message : String(error)}) — the WHOLE file is ignored and every setting falls back to its default`);
 		return null;
 	}
 }
@@ -1478,14 +1703,14 @@ function loadConfig(opts) {
 	});
 	ensureDataLayout(home);
 	ensureCommonConfigFile(commonConfigPath(home), logger);
-	const commonYaml = readYamlOrNull(commonConfigPath(home));
+	const commonYaml = readYamlOrNull(commonConfigPath(home), logger);
 	if (commonYaml) {
 		stripManagedModelKeys(commonYaml, commonConfigPath(home), logger);
 		warnUnknownKeys(commonConfigPath(home), commonYaml, zodShape(ConfigSchema) ?? {}, logger);
 		common = ConfigSchema.parse(mergeConfig(common, commonYaml));
 	}
 	common = ConfigSchema.parse(applyEnvLayer(common));
-	const memYaml = readYamlOrNull(memoryConfigPath(home));
+	const memYaml = readYamlOrNull(memoryConfigPath(home), logger);
 	if (memYaml) warnUnknownKeys(memoryConfigPath(home), memYaml, zodShape(MemoryConfigSchema) ?? {}, logger);
 	let memory = MemoryConfigSchema.parse(memYaml ?? {});
 	memory = {
@@ -1495,7 +1720,7 @@ function loadConfig(opts) {
 			path: resolveStorePath(memory.db.path, memoryDbPath(home))
 		}
 	};
-	const kbYaml = readYamlOrNull(knowledgeConfigPath(home));
+	const kbYaml = readYamlOrNull(knowledgeConfigPath(home), logger);
 	if (kbYaml) warnUnknownKeys(knowledgeConfigPath(home), kbYaml, zodShape(KnowledgeConfigSchema) ?? {}, logger);
 	let knowledge = KnowledgeConfigSchema.parse(kbYaml ?? {});
 	knowledge = {
@@ -1729,7 +1954,7 @@ function safeDestination(root, name, artifact) {
 	if (destination !== root && !destination.startsWith(root + sep)) throw new ProvisionError("extract", artifact, `归档条目超出目标目录：${name}`);
 	return destination;
 }
-/** Extract one entry's bytes to `destination`, verifying both sizes. */
+/** Extract one entry's bytes to `destination`, verifying both sizes on BOTH methods. */
 async function writeEntry(data, view, entry, destination, artifact) {
 	const localOffset = entry.localOffset;
 	if (localOffset + 30 > data.byteLength || view.getUint32(localOffset, true) !== LOCAL_SIGNATURE) throw new ProvisionError("extract", artifact, `条目「${entry.name}」的本地文件头损坏`);
@@ -1739,19 +1964,29 @@ async function writeEntry(data, view, entry, destination, artifact) {
 	const dataEnd = dataStart + entry.compressedSize;
 	if (dataEnd > data.byteLength) throw new ProvisionError("extract", artifact, `条目「${entry.name}」的数据被截断`);
 	const compressed = data.subarray(dataStart, dataEnd);
+	if (entry.method === 0) {
+		if (entry.compressedSize !== entry.uncompressedSize) throw new ProvisionError("extract", artifact, `条目「${entry.name}」声明 STORE 但两个大小不一致`);
+	} else if (entry.method !== 8) throw new ProvisionError("extract", artifact, `条目「${entry.name}」的压缩方式 ${String(entry.method)} 不受支持（只支持 STORE/DEFLATE）`);
 	mkdirSync(dirname(destination), { recursive: true });
 	const out = createWriteStream(destination);
 	if (entry.method === 0) {
-		if (entry.compressedSize !== entry.uncompressedSize) throw new ProvisionError("extract", artifact, `条目「${entry.name}」声明 STORE 但两个大小不一致`);
 		await pipeline(async function* () {
 			yield compressed;
 		}(), out);
 		return;
 	}
-	if (entry.method !== 8) throw new ProvisionError("extract", artifact, `条目「${entry.name}」的压缩方式 ${String(entry.method)} 不受支持（只支持 STORE/DEFLATE）`);
+	const expected = entry.uncompressedSize;
+	let written = 0;
 	await pipeline(async function* () {
 		yield compressed;
-	}(), createInflateRaw(), out);
+	}(), createInflateRaw(), async function* (source) {
+		for await (const chunk of source) {
+			written += chunk.length;
+			if (written > expected) throw new ProvisionError("extract", artifact, `条目「${entry.name}」解压后超过声明大小 ${String(expected)} 字节`);
+			yield chunk;
+		}
+	}, out);
+	if (written !== expected) throw new ProvisionError("extract", artifact, `条目「${entry.name}」解压大小与声明不一致（声明 ${String(expected)}，实际 ${String(written)} 字节）`);
 }
 /** On-disk size of a directory tree, for the "did anything land" check and the install log. */
 function treeBytes(dir) {
@@ -1872,7 +2107,7 @@ async function fetchToFile(url, dest, expected, artifact) {
 * Download from the first working source into `dest`.
 *
 * Failures are ACCUMULATED, not swallowed: every candidate is tried because the point of a mirror
-* list is that one of them may be down, but if none works the error carries the whole list of
+* list is that one of them may be down, but if none missions the error carries the whole list of
 * `url → reason` so the operator sees whether it was DNS, a TLS interception, or a 404.
 */
 async function downloadAnySource(pack, config, dest, artifact) {
@@ -1939,6 +2174,13 @@ async function extractArchive(pack, archive, destination, artifact) {
 * to detect its own stale holders and would have to tell the waiter when the winner is done, which is
 * a coordination protocol rather than a rename — out of scope here, and recorded instead of implied.
 *
+* This two-rename publish (over the sha256 verification in {@link fetchToFile}) IS the guarantee
+* level of `@avantf/mem-provision`: strictly below the base's envinit framework, which adds a
+* family-root lock with pid authority, slow-hold warnings and cross-device rejection. The CLI, the
+* MCP server and the plugin's degraded mount run on THIS stack, and base hardening does not reach it
+* — the full boundary and the reason both stacks coexist are in the module doc
+* (`@avantf/mem-provision`, `src/index.ts`).
+*
 * A crash between the two renames leaves the old tree under `<target>.old-<pid>-<rand>` beside the
 * version directory. Nothing enumerates that parent, so the residue is inert; the next install of the
 * same version replaces the target normally.
@@ -2845,7 +3087,7 @@ const INTERROGATIVES = /* @__PURE__ */ new Set([
 *
 * Exists so one write can drive BOTH extractors from a single `jieba.tag()` call: `add`/`update`
 * used to tag the same content twice (once for entities, once for triples), which is pure repeated
-* work — measured ~1.1 ms per 1000 characters per pass.
+* mission — measured ~1.1 ms per 1000 characters per pass.
 */
 async function tagText(text) {
 	const jieba = await loadJieba();
@@ -3103,7 +3345,7 @@ async function parseQueryPattern(query) {
 const COMPAT_PREFIX = "compat:";
 /** Hard cap on the host-readiness wait (see {@link WarmOptions.waitForCapMs}). */
 const WAIT_FOR_HOST_MS = 3e4;
-/** A timer-based delay, the only await in this module that is not tied to real work. */
+/** A timer-based delay, the only await in this module that is not tied to real mission. */
 function delay(ms) {
 	return new Promise((resolve) => {
 		setTimeout(resolve, ms);
@@ -3155,6 +3397,30 @@ async function warmSemantic(rt, reportFinal = true) {
 	return semanticReady;
 }
 /**
+* Wait out the startup gate — the host readiness signal (bounded by {@link WAIT_FOR_HOST_MS}) and,
+* when asked, one quiet turn of the event loop.
+*
+* Extracted so there is exactly ONE definition of "a job that must not run inside the host's boot
+* window". The tokenizer warm below uses it, and so does the plugin's mount-time entity sweep:
+* `reindexEntities` tags stale rows through nodejieba, whose dictionary parse is the same ~1.2 s
+* SYNCHRONOUS mission the warm defers, so a sweep fired at mount (before this) could pull that parse
+* back into the startup window through a second door (performance review §7.5 / P5).
+*
+* The waits are NOT preconditions: a host whose boot failed still resolves them, and a host whose
+* boot hung is bounded here rather than trusted (see {@link WarmOptions.waitForCapMs}).
+*
+* @param options - the same options the tokenizer warm takes (the idle gate is opt-in).
+* @returns how long the idle gate waited (ms), or `0` when it was not requested.
+*/
+async function awaitStartupGate(options = {}) {
+	if (options.waitFor !== void 0) {
+		const cap = options.waitForCapMs ?? WAIT_FOR_HOST_MS;
+		await Promise.race([options.waitFor.catch(() => void 0), delay(cap)]);
+	}
+	if (options.deferTokenizerUntilIdle !== true) return 0;
+	return await whenEventLoopIdle();
+}
+/**
 * Warm ONLY the tokenizer, after the host-readiness signal and (when asked) an idle event loop.
 *
 * nodejieba loads its dictionary lazily on the FIRST `tag()` (measured ~950 ms, after which a call
@@ -3166,15 +3432,9 @@ async function warmSemantic(rt, reportFinal = true) {
 * @param options - the host-readiness signal and the idle gate (see {@link WarmOptions}).
 */
 async function warmTokenizer(rt, options = {}) {
-	if (options.waitFor !== void 0) {
-		rt.logger.info("model bootstrap: tokenizer warm waits for the host readiness signal");
-		const cap = options.waitForCapMs ?? WAIT_FOR_HOST_MS;
-		await Promise.race([options.waitFor.catch(() => void 0), delay(cap)]);
-	}
-	if (options.deferTokenizerUntilIdle === true) {
-		const waited = await whenEventLoopIdle();
-		if (waited >= 200) rt.logger.info(`model bootstrap: tokenizer warm waited ${waited}ms for an idle event loop`);
-	}
+	if (options.waitFor !== void 0) rt.logger.info("model bootstrap: tokenizer warm waits for the host readiness signal");
+	const waited = await awaitStartupGate(options);
+	if (options.deferTokenizerUntilIdle === true && waited >= 200) rt.logger.info(`model bootstrap: tokenizer warm waited ${waited}ms for an idle event loop`);
 	const jiebaStarted = Date.now();
 	if (await jiebaAvailable()) rt.logger.info(`model bootstrap: tokenizer ready in ${Date.now() - jiebaStarted}ms (nodejieba)`);
 	else rt.logger.warn(`model bootstrap: nodejieba unavailable in ${Date.now() - jiebaStarted}ms — entity/triple extraction falls back to the regex path (weaker entity + jaccard legs)`);
@@ -3213,13 +3473,13 @@ function warmTokenizerAsync(rt, options = {}) {
 * The ONE startup initialization for this plugin: register every artifact this build needs, then run
 * the provisioning sweep (non-blocking).
 *
-* It replaced a `warmModelsAsync(rt, …)` call that sat beside a separate tools sweep, which meant two
+* It replaced a one-shot model warm-up that sat beside a separate tools sweep, which meant two
 * initialization paths, two logging vocabularies, and no single answer to "is this host fully
 * provisioned?". Callers (the DSH plugin mount, the MCP entry) now make one call, and the per-artifact
 * result lines in the host log come from the same mechanism that installs pandoc.
 *
 * The FIRST step is the dsh compatibility gate: an incompatible host means NOTHING is resolved,
-* installed or warmed — preparing an environment for an API we cannot drive is wasted work.
+* installed or warmed — preparing an environment for an API we cannot drive is wasted mission.
 *
 * @param rt - the runtime, whose resolved `tools` config and logger the sweep uses.
 * @param options - the host's readiness signal and the dsh compatibility evidence.
@@ -3256,7 +3516,7 @@ async function provisionToolchainAsync(rt, options = {}) {
 	});
 	return { skipped: false };
 }
-/** The artifact id, used in the startup log and in `ensureModelArtifact`'s errors. */
+/** The artifact id, used in the startup log and in the model artifact's errors. */
 const MODEL_ARTIFACT_ID = "model";
 /** Read the runtime out of the per-call env, or fail with an explanation of what is missing. */
 function runtimeOf(artifactEnv) {
@@ -3268,7 +3528,7 @@ function runtimeOf(artifactEnv) {
 * The embedding model (plus the nodejieba tokenizer it shares its warm-up budget with) as an
 * ARTIFACT, so the startup sweep in `@avantf/mem-provision` is the only initialization path.
 *
-* It used to be a parallel `warmModelsAsync(...)` call beside the tools sweep, which meant two
+* It used to be a parallel model warm-up call beside the tools sweep, which meant two
 * startup mechanisms with two logging vocabularies and no single place that answered "is this host
 * fully provisioned?". The model has no pinned version and no managed directory of its own ON THIS
 * (the flat `<repo>/<file>` layout the transformers.js cache reads), so it
@@ -3409,6 +3669,7 @@ function empty() {
 		rerank_truncated: 0,
 		output_truncated: 0,
 		legs_capped: 0,
+		candidates_dropped_by_floor: 0,
 		updated_at: null,
 		by_kind: {}
 	};
@@ -3426,6 +3687,11 @@ function recordRetrieval(event) {
 	else active.semantic_degraded += 1;
 	if (event.rerankUsed) active.rerank_used += 1;
 	if (event.rerankFallback) active.rerank_fallback += 1;
+	const drops = event.droppedByFloor;
+	if (drops !== void 0) {
+		const total = drops.semantic + drops.fts + drops.jaccard + drops.hrr;
+		if (Number.isFinite(total) && total > 0) active.candidates_dropped_by_floor += total;
+	}
 	const bucket = active.by_kind[event.kind] ??= {
 		queries: 0,
 		zero_results: 0,
@@ -3485,6 +3751,7 @@ function retrievalHealthSummary() {
 		rerank_truncated: h.rerank_truncated,
 		output_truncated: h.output_truncated,
 		legs_capped: h.legs_capped,
+		candidates_dropped_by_floor: h.candidates_dropped_by_floor,
 		updated_at: h.updated_at,
 		by_kind: h.by_kind
 	};
@@ -4170,7 +4437,8 @@ function blankToFamilyModels(configured) {
 /**
 * `local_numpy` — in-memory brute-force vector store.
 * Default / dev backend; persists via the caller (the store DB owns the vectors).
-* For M0 this is the only implemented VectorStore; ANN backends (hnswlib/faiss) land in M4.
+* The fallback every backend without a real adapter resolves to; `hnswlib` is the implemented ANN
+* store, while `faiss`/`pgvector`/`qdrant` warn and land here.
 */
 var LocalNumpyVectorStore = class {
 	name = "local_numpy";
@@ -4735,6 +5003,12 @@ function unimplementedVStore(name) {
 * Pluggable backend registries. The DSH plugin does NOT expose these as Cordis
 * services; replacement happens inside avantf-mem by config + registry (DESIGN §5).
 * The business flow resolves backends only through these factories.
+*
+* The three `register*` functions below are the whole pluggability contract: register a name, put
+* that name in `config.<semantic|rerank|vectorStore>.backend`, and the resolver picks it up — no
+* business-flow change. They are re-exported on the PUBLISHED plugin face (`@avantf/dsh-mem`) so a
+* consumer OUTSIDE this repo can actually use the promise DESIGN §5 makes; see `packages/core/src/index.ts`
+* and `packages/plugin/src/index.ts`. Resolution stays a registry lookup, never duck-typing.
 */
 const semanticRegistry = { local_bge: (cfg, opts) => new LocalBgeBackend(cfg.semantic.local_model, cfg.semantic.dim, {
 	mirror: cfg.semantic.mirror,
@@ -4760,6 +5034,15 @@ const vstoreRegistry = {
 	pgvector: unimplementedVStore("pgvector"),
 	qdrant: unimplementedVStore("qdrant")
 };
+function registerSemanticBackend(name, factory) {
+	semanticRegistry[name] = factory;
+}
+function registerReranker(name, factory) {
+	rerankRegistry[name] = factory;
+}
+function registerVectorStore(name, factory) {
+	vstoreRegistry[name] = factory;
+}
 function resolveSemantic(cfg, opts) {
 	const f = semanticRegistry[cfg.semantic.backend];
 	if (!f) throw new Error(`未知的语义后端：${cfg.semantic.backend}`);
@@ -4972,7 +5255,7 @@ function zipEntryNames(bytes) {
 * is the ordinary bomb shape — a few megabytes on the wire declaring gigabytes of sheet XML — before
 * a reader library inflates any of it into the host's heap. Catching a lying archive would mean
 * inflating it ourselves under a running cap instead of handing it to the library, which is a
-* different (and much larger) piece of work; see the note at the xlsx call site.
+* different (and much larger) piece of mission; see the note at the xlsx call site.
 */
 function zipDeclaredCost(bytes) {
 	const directory = centralDirectory(bytes);
@@ -5314,7 +5597,7 @@ function pandocClaim(input) {
 	if (byExtension !== void 0) return { read: byExtension };
 	return looksLikeHtml(input.bytes) ? { read: "html+native_divs" } : void 0;
 }
-/** How long pandoc may run on one document. Generous: a large ODT is a few seconds of work. */
+/** How long pandoc may run on one document. Generous: a large ODT is a few seconds of mission. */
 const CONVERT_TIMEOUT_MS = 12e4;
 /** Cap on the Markdown pandoc may emit, so a pathological document cannot exhaust memory. */
 const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
@@ -5372,8 +5655,9 @@ const pandocConverter = {
 /**
 * A rectangular grid of strings → a GitHub-flavored Markdown table.
 *
-* Shared by the CSV and XLSX converters because the two decisions are the same in both: what the
-* header row IS, and how a cell's content survives inside a `|`-delimited row. GFM tables have no
+* The grid renderer behind the XLSX converter (CSV reaches a table through pandoc's own reader).
+* Two decisions matter: what the header row IS, and how a cell's content survives inside a
+* `|`-delimited row. GFM tables have no
 * "no header" form, so a first row that is plainly data (every cell numeric) is treated as data and
 * a synthetic `列1…列N` header is emitted above it — the alternative would be promoting the first
 * data row to a header and losing it from the body.
@@ -5481,9 +5765,9 @@ const xlsxConverter = {
 		return zipEntries(input.bytes)?.includes(WORKBOOK_ENTRY) === true;
 	},
 	async convert(input) {
-		const label = input.path ?? "xlsx 工作簿";
+		const label = input.path ?? "xlsx 任务簿";
 		const declared = zipDeclaredCost(input.bytes);
-		if (declared !== null && declared.uncompressed > MAX_DECLARED_BYTES) throw new Error(`${label}：工作簿声明解压后 ${Math.round(declared.uncompressed / 1024 / 1024)} MB（${String(declared.entries)} 个条目），超过 ${String(MAX_DECLARED_BYTES / 1024 / 1024)} MB 上限，已拒绝转换。请先在原文件里删掉不需要的工作表或行，或导出为 CSV 后入库。`);
+		if (declared !== null && declared.uncompressed > MAX_DECLARED_BYTES) throw new Error(`${label}：任务簿声明解压后 ${Math.round(declared.uncompressed / 1024 / 1024)} MB（${String(declared.entries)} 个条目），超过 ${String(MAX_DECLARED_BYTES / 1024 / 1024)} MB 上限，已拒绝转换。请先在原文件里删掉不需要的任务表或行，或导出为 CSV 后入库。`);
 		const { default: ExcelJS } = await import("exceljs");
 		const workbook = new ExcelJS.Workbook();
 		const data = Buffer.from(input.bytes.buffer, input.bytes.byteOffset, input.bytes.byteLength);
@@ -5494,7 +5778,7 @@ const xlsxConverter = {
 			const rowCount = worksheet.rowCount;
 			const columnCount = worksheet.columnCount;
 			if (rowCount === 0 || columnCount === 0) {
-				warnings.push(`工作表「${worksheet.name}」为空，未产出表格`);
+				warnings.push(`任务表「${worksheet.name}」为空，未产出表格`);
 				continue;
 			}
 			const rows = [];
@@ -5506,13 +5790,13 @@ const xlsxConverter = {
 				for (let c = 1; c <= Math.min(columnCount, MAX_COLS); c++) cells.push(formatCell(values[c]));
 				rows.push(cells);
 			}
-			if (rowCount > MAX_ROWS) warnings.push(`工作表「${worksheet.name}」共 ${String(rowCount)} 行，只转换前 ${String(MAX_ROWS)} 行`);
-			if (columnCount > MAX_COLS) warnings.push(`工作表「${worksheet.name}」共 ${String(columnCount)} 列，只转换前 ${String(MAX_COLS)} 列`);
-			const table = renderTable(rows, `工作表「${worksheet.name}」`);
-			if (table.synthesizedHeader) warnings.push(`工作表「${worksheet.name}」首行是数值，已按数据行处理并合成列名`);
+			if (rowCount > MAX_ROWS) warnings.push(`任务表「${worksheet.name}」共 ${String(rowCount)} 行，只转换前 ${String(MAX_ROWS)} 行`);
+			if (columnCount > MAX_COLS) warnings.push(`任务表「${worksheet.name}」共 ${String(columnCount)} 列，只转换前 ${String(MAX_COLS)} 列`);
+			const table = renderTable(rows, `任务表「${worksheet.name}」`);
+			if (table.synthesizedHeader) warnings.push(`任务表「${worksheet.name}」首行是数值，已按数据行处理并合成列名`);
 			sections.push(`## ${worksheet.name}\n\n${table.markdown}`);
 		}
-		if (sections.length === 0) throw new Error(`${label}：转换后没有可入库的表格（工作簿里没有非空工作表）`);
+		if (sections.length === 0) throw new Error(`${label}：转换后没有可入库的表格（任务簿里没有非空任务表）`);
 		return {
 			markdown: sections.join("\n\n"),
 			converter: ID,
@@ -5799,49 +6083,210 @@ function migrate(db, migrations, ctx) {
 //#endregion
 //#region ../core/lib/db/sqlite.js
 /**
-* The ONLY module that imports the concrete SQLite binding (`better-sqlite3`).
+* The SQLite adapter — the runtime's OWN `node:sqlite`, and the only database implementation this
+* engine has.
+*
+* WHY THE BUILTIN AND NOT A BINDING: `better-sqlite3` is a NAN addon, so its `.node` file is tied to
+* ONE `NODE_MODULE_VERSION`. A dsh host that runs plugin code inside Electron (DSH Desktop does: the
+* profile host is `DeepSeek Harness.exe` with `ELECTRON_RUN_AS_NODE=1`, i.e. NODE_MODULE_VERSION 149
+* on Electron 44) cannot load a binding built for plain Node, and the upstream prebuilds stop well
+* short of that ABI — `new Database(path)` throws "Could not locate the bindings file", and the whole
+* memory store used to be unavailable there. The builtin is already inside the runtime that runs the
+* plugin (unflagged from Node 22.13 / 23.4; Electron 44 carries it), FTS5 included, so ONE
+* implementation serves every host instead of two code paths whose behaviour must be proven equal.
+* The parity this file owes the engine is therefore written down as a CONTRACT, not as a comparison:
+*
+*  - statements are cached per SQL text (compiling one costs ~19x a reuse on this driver: measured
+*    6.03 µs vs 0.31 µs per `SELECT` in a 20k-iteration loop) — the DAOs prepare on every call;
+*  - `run/get/all` take positional parameters OR one object of named parameters, with or without the
+*    `:`/`@`/`$` prefix, and a named parameter the statement does not use is IGNORED (see
+*    {@link NodeSqliteStatement}: the DAOs hand one params object to statements that use subsets of
+*    it, and `FactsDao.purgeArchived` is the call site that made this load-bearing);
+*  - BLOBs are returned as `Buffer` (the builtin hands back a plain `Uint8Array`) — the DAOs and
+*    `hrr/encode.ts` read vector blobs through `buf.buffer`/`byteOffset`, and `Buffer.isBuffer`
+*    checks exist in callers, so the adapter normalizes rather than teaching every reader two shapes;
+*  - `pragma()` returns the pragma's rows (`[]` for a write), `transaction()` is `BEGIN
+*    DEFERRED/IMMEDIATE/EXCLUSIVE` with `SAVEPOINT` nesting and rollback-on-throw — the presence
+*    clock and the lifecycle tick depend on `immediate()` taking the write lock up front.
+*
+* The module is loaded through `createRequire`, never a static `import`: `node:sqlite` does not exist
+* before Node 22.5, and a static import would make THIS FILE unloadable there, failing the plugin's
+* loader row instead of degrading. A missing builtin has to be a PROBE failure (the runtime then
+* mounts DEGRADED and every tool answers with the reason), never a module-load failure.
+* @module @avantf/mem/db/sqlite
+*/
+/** Upper bound on the prepared-statement cache — see {@link NodeSqliteDb.prepare} for its key space. */
+const MAX_CACHED_STATEMENTS = 2e3;
+/** One line of an error, for a probe's report: the callers log it, they never rethrow the object. */
+function messageOf(error) {
+	const text = error instanceof Error ? error.message : String(error);
+	const first = text.split("\n")[0] ?? text;
+	return first.length > 300 ? `${first.slice(0, 297)}…` : first;
+}
+/**
+* Load the builtin synchronously, or explain why this runtime cannot.
 *
-* Everything else talks to the {@link Db} port, so replacing the binding (the npm package,
-* `node:sqlite`, a bundled build with a different FTS5) is an edit here — not a sweep
-* through the stores. The SQL itself stays SQLite's: see `port.ts`.
+* `createRequire` (not `import`) because the port is synchronous by design: the stores open inside a
+* synchronous `buildRuntime`. The specifier is passed to the resolved `require` rather than written
+* as a `require(...)` literal, so a bundler leaves it as a runtime call instead of trying to resolve
+* (or inline) a builtin that may not exist on the target.
 */
-var SqliteStatement = class {
+function loadNodeSqlite() {
+	try {
+		const loaded = createRequire(import.meta.url)("node:sqlite");
+		if (loaded === null || typeof loaded !== "object" || typeof loaded.DatabaseSync !== "function") return { reason: "the runtime exposes no node:sqlite DatabaseSync" };
+		return { module: loaded };
+	} catch (error) {
+		return { reason: `node:sqlite is unavailable (${messageOf(error)}) — it needs Node >= 22.5, and is unflagged from Node 22.13 / 23.4` };
+	}
+}
+/**
+* Whether this runtime can actually SERVE the stores through `node:sqlite`, or why it cannot.
+*
+* Constructing a throwaway `:memory:` handle is only the first half. A runtime can expose the module
+* and still be unusable for this engine in two ways that would otherwise surface much later, as a DDL
+* error or as a broken lifecycle tick in production:
+*
+*  - **no FTS5** — both schemas create `fts5` virtual tables the moment a store is opened, so a build
+*    without the module cannot hold a store at all;
+*  - **no `setAllowUnknownNamedParameters`** (Node v22.15 / v23.11) — `node:sqlite` throws on a named
+*    parameter the statement does not use, while the DAOs deliberately pass one params object to
+*    statements that use subsets of it. Without the switch, `FactsDao.purgeArchived` takes the whole
+*    lifecycle tick down.
+*
+* The probe reports the FIRST of these that applies as one line; `undefined` means "this runtime can
+* serve a store". It is NOT a dry run of the caller's database: a file that is corrupt, locked or
+* written by a newer schema must still fail loudly in {@link openSqlite} (and mount DEGRADED with its
+* own reason) rather than being reported as a driver problem.
+*/
+function sqliteProbe() {
+	const loaded = loadNodeSqlite();
+	if (loaded.module === void 0) return loaded.reason;
+	return probeModule(loaded.module);
+}
+/**
+* The capability half of {@link sqliteProbe}: what a loaded `node:sqlite` module must be able to do.
+*
+* Exported — and taking the module as an argument — so the contract spec can hand it a FAKE and
+* assert each refusal by name. That is not a driver seam: it is the only way to exercise "this
+* runtime's builtin cannot serve a store" on a machine whose builtin can, and the failure path is
+* exactly the one nobody sees until it happens on a user's host.
+*/
+function probeModule(module) {
+	let probe;
+	try {
+		probe = new module.DatabaseSync(":memory:");
+		probe.exec("CREATE VIRTUAL TABLE probe_fts USING fts5(body)");
+		const statement = probe.prepare("SELECT :value AS value");
+		if (typeof statement.setAllowUnknownNamedParameters !== "function") return "node:sqlite has no setAllowUnknownNamedParameters (needs Node >= 22.15 / >= 23.11)";
+		statement.setAllowUnknownNamedParameters(true);
+		statement.get({
+			value: 1,
+			unused: 2
+		});
+		return;
+	} catch (error) {
+		return `node:sqlite cannot serve a store (${messageOf(error)})`;
+	} finally {
+		probe?.close();
+	}
+}
+/**
+* This process's verdict on the builtin, decided on first use and then fixed.
+*
+* Memoized because it is a property of the RUNTIME, not of a database: re-probing at every store open
+* would spend an in-memory database per open (memory, knowledge, and the tokenizer self-check) to
+* re-learn something that cannot change. The first open pays for it; every later open reuses the
+* answer — including a refusal, which keeps failing with the same reason.
+*/
+let serveVerdict;
+let served = false;
+function serveReason() {
+	if (!served) {
+		served = true;
+		serveVerdict = sqliteProbe();
+	}
+	return serveVerdict;
+}
+/**
+* A one-line, NEVER-THROWING description for the startup log.
+*
+* The runtime logs this before it opens the stores, so it must not be the thing that turns "this
+* runtime cannot serve the builtin" into a crash before the caller's own error handling runs. The
+* version is part of the line on purpose: the store files stay per-host (a Desktop HOME and a WSL
+* HOME are different machines' worth of data), so the SQLite version is the one fact that tells an
+* operator WHICH build is answering — and the fact to quote when a query behaves differently across
+* two hosts. A refused runtime is reported as such, so this line and the later DEGRADED mount agree.
+*/
+function describeSqlite() {
+	const refused = serveReason();
+	if (refused !== void 0) return `unavailable: ${refused}`;
+	const loaded = loadNodeSqlite();
+	if (loaded.module === void 0) return `unavailable: ${loaded.reason}`;
+	try {
+		const db = new loaded.module.DatabaseSync(":memory:");
+		try {
+			const row = db.prepare("SELECT sqlite_version() AS version").get();
+			return `node:sqlite ${String(row?.version ?? "unknown")}`;
+		} finally {
+			db.close();
+		}
+	} catch (error) {
+		return `unavailable: ${messageOf(error)}`;
+	}
+}
+/**
+* One row as the port promises it: a BLOB is a `Buffer`.
+*
+* The copy is a VIEW over the same bytes (`Buffer.from(arrayBuffer, offset, length)`), so it costs no
+* data movement; the row object is only rebuilt when it actually carries a `Uint8Array`.
+*/
+function normalizeRow(row) {
+	if (row === null || typeof row !== "object") return row;
+	const source = row;
+	let mapped;
+	for (const key of Object.keys(source)) {
+		const value = source[key];
+		if (value instanceof Uint8Array && !Buffer.isBuffer(value)) {
+			mapped ??= { ...source };
+			mapped[key] = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+		}
+	}
+	return mapped ?? source;
+}
+var NodeSqliteStatement = class {
 	stmt;
 	constructor(stmt) {
 		this.stmt = stmt;
+		this.stmt.setAllowUnknownNamedParameters?.(true);
 	}
 	all(...params) {
-		return this.stmt.all(...params);
+		return this.stmt.all(...params).map((row) => normalizeRow(row));
 	}
 	get(...params) {
-		return this.stmt.get(...params);
+		const row = this.stmt.get(...params);
+		return row === void 0 ? void 0 : normalizeRow(row);
 	}
 	run(...params) {
 		const result = this.stmt.run(...params);
 		return {
-			changes: result.changes,
+			changes: Number(result.changes),
 			lastInsertRowid: result.lastInsertRowid
 		};
 	}
 };
-/** Upper bound on the prepared-statement cache (see `SqliteDb.prepare`). */
-const MAX_CACHED_STATEMENTS = 2e3;
-var SqliteDb = class {
+var NodeSqliteDb = class {
 	db;
 	/**
-	* Prepared-statement cache, keyed by SQL text.
-	*
-	* better-sqlite3 has NO statement cache of its own: every `prepare()` builds a `Statement` and
-	* runs `sqlite3_prepare_v3` (measured 6–8 µs against 0.4 µs for a reused statement). The DAOs
-	* prepare at every call — one search is ~20 statements, one write 15–22 — so the compile cost
-	* was a real, per-call tax (~65–95 µs per write, plus the same again per search).
-	*
-	* One cache here covers every DAO without touching them, and the key space is bounded by the
-	* SQL TEXT the code contains (~40 `.prepare(` sites, plus the handful of distinct `IN (...)`
-	* widths `batches()` produces). Statements are reusable and re-entrant for `all`/`get`/`run`
-	* (this port exposes no cursor API), and invalidated wholesale on `close()`.
+	* Prepared-statement cache, keyed by SQL text. See the module doc for the measured cost of not
+	* caching. The key space is NOT just the ~40 literal statements: `batches()` emits a different
+	* `IN (?, …)` text per arity, and the arity follows the DATA (measured: 20 adds opened 17 keys, 15
+	* of them one statement at different widths), so a resident process would otherwise grow this map
+	* indefinitely — hence the same bound, and the same wholesale clear, as everywhere else here.
 	*/
 	statements = /* @__PURE__ */ new Map();
+	/** Nesting depth, so a transaction inside a transaction becomes a SAVEPOINT. */
+	depth = 0;
 	constructor(db) {
 		this.db = db;
 	}
@@ -5849,7 +6294,7 @@ var SqliteDb = class {
 		let cached = this.statements.get(sql);
 		if (cached === void 0) {
 			if (this.statements.size >= MAX_CACHED_STATEMENTS) this.statements.clear();
-			cached = new SqliteStatement(this.db.prepare(sql));
+			cached = new NodeSqliteStatement(this.db.prepare(sql));
 			this.statements.set(sql, cached);
 		}
 		return cached;
@@ -5857,20 +6302,77 @@ var SqliteDb = class {
 	exec(sql) {
 		this.db.exec(sql);
 	}
-	transaction(fn) {
-		return this.db.transaction(fn);
-	}
+	/**
+	* `PRAGMA` through a prepared statement: `node:sqlite` has no `pragma()` of its own, and preparing
+	* the statement is what returns the rows a reader (`user_version`, `journal_mode`) asks for — a
+	* write pragma simply returns `[]`.
+	*/
 	pragma(source) {
-		return this.db.pragma(source);
+		return this.db.prepare(`PRAGMA ${source}`).all().map((row) => normalizeRow(row));
+	}
+	transaction(fn) {
+		const runner = (mode) => () => this.atomic(fn, mode);
+		const tx = runner("DEFERRED");
+		tx.immediate = runner("IMMEDIATE");
+		tx.deferred = runner("DEFERRED");
+		tx.exclusive = runner("EXCLUSIVE");
+		return tx;
 	}
 	close() {
 		this.statements.clear();
 		this.db.close();
 	}
+	atomic(fn, mode) {
+		if (this.depth > 0) {
+			const savepoint = `avantf_nested_${String(this.depth)}`;
+			this.depth += 1;
+			this.db.exec(`SAVEPOINT ${savepoint}`);
+			try {
+				const value = fn();
+				this.db.exec(`RELEASE ${savepoint}`);
+				return value;
+			} catch (error) {
+				this.db.exec(`ROLLBACK TO ${savepoint}`);
+				this.db.exec(`RELEASE ${savepoint}`);
+				throw error;
+			} finally {
+				this.depth -= 1;
+			}
+		}
+		this.depth = 1;
+		this.db.exec(`BEGIN ${mode}`);
+		try {
+			const value = fn();
+			this.db.exec("COMMIT");
+			return value;
+		} catch (error) {
+			try {
+				this.db.exec("ROLLBACK");
+			} catch {}
+			throw error;
+		} finally {
+			this.depth = 0;
+		}
+	}
 };
-/** Open (or create) a SQLite database behind the port. `':memory:'` is a valid path. */
-function openSqlite(path) {
-	return new SqliteDb(new Database(path));
+/**
+* Open (or create) a SQLite database behind the port. `':memory:'` is a valid path.
+*
+* The runtime's verdict is checked HERE, not only by the startup log: a runtime whose builtin cannot
+* serve a store (no FTS5, or no tolerance for unused named parameters — see {@link sqliteProbe}) must
+* fail this open, so the caller's own error handling degrades the plugin with that reason instead of
+* the engine discovering it half-way through a schema migration or a lifecycle tick.
+*
+* `verdict` is a TEST seam, and deliberately not a driver seam: there is one implementation and it
+* cannot be replaced at runtime. It exists so the refusal path can be asserted on a machine whose
+* builtin missions — the path nobody sees until a user hits it.
+*/
+function openSqlite(path, verdict = serveReason) {
+	const refused = verdict();
+	if (refused !== void 0) throw new Error(refused);
+	const loaded = loadNodeSqlite();
+	if (loaded.module === void 0) throw new Error(loaded.reason);
+	return new NodeSqliteDb(new loaded.module.DatabaseSync(path));
 }
 //#endregion
 //#region ../core/lib/db/store.js
@@ -5911,8 +6413,8 @@ function wasUpgraded(migration) {
 }
 /**
 * Open (or create) a store database: directory, PRAGMAs, then every migration newer than
-* the file's `user_version`. A failure closes the handle — better-sqlite3 keeps the file
-* locked otherwise, and a half-open store would be worse than none.
+* the file's `user_version`. A failure closes the handle — an open handle keeps the WAL and
+* its locks alive, and a half-open store would be worse than none.
 */
 function openStoreDb(opts) {
 	mkdirSync(dirname(opts.path), { recursive: true });
@@ -6231,6 +6733,202 @@ function probeTerms(text, holds, stopAt = Number.POSITIVE_INFINITY) {
 		matched
 	};
 }
+//#endregion
+//#region ../core/lib/store/floors.js
+/**
+* What the RELAXED pass lowers each floor TO, as absolute values.
+*
+*  - semantic **0.40**: strictly BETWEEN the measured unrelated-query ceiling (0.384) and the
+*    pronoun-query top-1 (0.444). Both bounds are load-bearing. Above 0.384, so a genuinely
+*    unrelated question still comes back EMPTY from the relaxed pass — the four measured samples
+*    topped out at 0.300/0.384/0.315/0.351, and a 0.35 bar would already admit two of them. Below
+*    0.444, so 「我是谁」 finds its fact. 0.40 keeps the larger margin on the noise side, which is
+*    where a false positive costs the caller a wrong answer rather than a missing one.
+*  - fts: NOT a constant — {@link looseTermFloor}, half the query's distinct terms with a floor of
+*    1. `1` here is the "no terms to scale by" baseline (the previously constant value); a query
+*    that cannot produce terms is not graded at all, and one that produces a single term (every
+*    3-char CJK query) is already graded against that one term by the reachability clamp.
+*  - jaccard **0.15** (positive — the previous `0` was the ungated hole this closes). Measured, not
+*    guessed, on two corpora: (a) the live store, 64 active facts, the common-entity questions a
+*    real user asks about this repo ("插件怎么安装" / "任务怎么拆分" / "知识库在哪里" …) put their
+*    TOP non-answering entity candidate at Jaccard 0.0909 and most at 0.02–0.07, so 0.15 removes that
+*    whole tail; (b) the gold-labelled 35-query eval set, where the LOWEST Jaccard any answering pair
+*    reached is 0.25 (「老王喜欢什么风格」) — a bottom line above 0.25 starts dropping gold pairs,
+*    while 0.15 filters none. The entity leg cannot fully separate the two classes on short queries
+*    (a one-entity query against a one-entity fact is 1.0 by construction, and non-gold pairs reach
+*    0.667), so this is deliberately a "no incidental small overlap" line, not a relevance classifier.
+*/
+const LOOSE_FLOORS = {
+	semantic: .4,
+	fts: 1,
+	jaccard: .15
+};
+/**
+* The FTS bar the RELAXED pass applies to a query carrying `termCount` distinct terms.
+*
+* Positive on purpose: "Relaxed" must never mean "ungated", and the old constant of `1` let a single
+* incidental trigram become a leg's head (per-leg max normalization makes it 1.0) on any query long
+* enough to produce several terms. Half the query's terms — `ceil(termCount / 2)`, at least 1 — keeps
+* a real fraction of what the query asked for while still relaxing the configured bar of 2 to 1 for
+* a two-term query. `termCount` 0/omitted keeps the baseline of 1 (such a query is not graded by
+* {@link applyTermFloor} at all). The `min(configured, …)` in {@link resolveFloors} means this can
+* only relax, never raise.
+*/
+function looseTermFloor(termCount) {
+	const half = termCount === void 0 || termCount <= 0 ? 0 : Math.ceil(termCount / 2);
+	return Math.max(1, half);
+}
+/** The floor every leg's drops start from. */
+function emptyFloorDrops() {
+	return {
+		semantic: 0,
+		fts: 0,
+		jaccard: 0,
+		hrr: 0
+	};
+}
+/**
+* The FTS bar actually applied to a query carrying `termCount` distinct terms.
+*
+* A query cannot be graded against more terms than it has (see the module comment: a 3-char CJK
+* query has one trigram), so the configured bar is CLAMPED to the reachable maximum. `termCount`
+* `0`/omitted leaves the value alone — such a query is not graded at all by {@link applyTermFloor},
+* and changing the REPORTED value there would misdescribe what the caller is reading. `0` stays `0`
+* (the operator's off switch).
+*
+* This is the ONE place the clamp lives; `resolveFloors` (what the result reports) and
+* `applyTermFloor` (what the leg does) both call it, so the number the caller reads is the number
+* the leg used.
+*/
+function effectiveTermFloor(floor, termCount) {
+	if (!(floor > 0)) return floor;
+	if (termCount === void 0 || termCount <= 0) return floor;
+	return Math.min(floor, termCount);
+}
+/**
+* The legs a pass actually dropped candidates on — the only ones a relaxed pass can help.
+*
+* A leg that dropped nothing has no candidate below its strict floor, so lowering that floor admits
+* nothing new; including it in the relaxed `floors` would just misreport which leg was the problem.
+* `hrr` maps onto `jaccard` because the probe shares the entity leg's candidate set and floor (see
+* `HybridLeg.leg`).
+*/
+function droppedLegs(drops) {
+	const legs = [];
+	if (drops.semantic > 0) legs.push("semantic");
+	if (drops.fts > 0) legs.push("fts");
+	if (drops.jaccard > 0 || drops.hrr > 0) legs.push("jaccard");
+	return legs;
+}
+/**
+* Resolve the effective floors for one query (see the module comment for the rules).
+*
+* Exported so both stores and the tests read the SAME rule rather than re-deriving it — the whole
+* point of hosting the orchestration in one file was that a per-store copy of a rule drifts.
+*
+* The relaxed profile takes `min(configured, relaxed)` per leg: it can only RELAX. A leg the
+* operator disabled (`0` = off) stays disabled, a floor the operator already set below the relaxed
+* value is left alone, and {@link FloorResolution.relaxLegs} can only narrow WHICH legs move.
+* "Relaxed" never means "ungated" — otherwise the pass could not answer "nothing relevant".
+*/
+function resolveFloors(retriever, semAvail, resolution = {}) {
+	const configured = {
+		semantic: retriever.min_semantic_similarity,
+		fts: semAvail ? retriever.min_fts_terms : retriever.min_fts_terms > 0 ? 1 : 0,
+		jaccard: retriever.min_jaccard
+	};
+	const mayRelax = (leg) => resolution.profile === "loose" && (resolution.relaxLegs === void 0 || resolution.relaxLegs.includes(leg));
+	const lowered = {
+		semantic: mayRelax("semantic") ? Math.min(configured.semantic, LOOSE_FLOORS.semantic) : configured.semantic,
+		fts: mayRelax("fts") ? Math.min(configured.fts, looseTermFloor(resolution.termCount)) : configured.fts,
+		jaccard: mayRelax("jaccard") ? Math.min(configured.jaccard, LOOSE_FLOORS.jaccard) : configured.jaccard
+	};
+	return {
+		...lowered,
+		fts: effectiveTermFloor(lowered.fts, resolution.termCount)
+	};
+}
+/** `0` = off; a score EQUAL to the floor passes (the floor drops strictly-lower candidates only). */
+function passesFloor(score, floor) {
+	return !(floor > 0) || score >= floor;
+}
+/** Drop the entries of one leg's raw score map that fall below `floor`, counting them. */
+function applyScoreFloor(scores, floor) {
+	if (!(floor > 0) || scores.size === 0) return {
+		scores,
+		dropped: 0
+	};
+	const out = /* @__PURE__ */ new Map();
+	let dropped = 0;
+	for (const [id, score] of scores) if (passesFloor(score, floor)) out.set(id, score);
+	else dropped += 1;
+	return {
+		scores: out,
+		dropped
+	};
+}
+/**
+* How many distinct query terms `text` carries.
+*
+* Substring containment, case-insensitively: FTS5's trigram tokenizer matches a quoted phrase by
+* consecutive trigrams and is ASCII-case-insensitive, which is the same predicate as "the term
+* occurs in the text". `relevanceTerms` lowercases its latin words, so the comparison has to.
+*/
+function countMatchedTerms(text, terms) {
+	if (text === "") return 0;
+	const haystack = text.toLowerCase();
+	let matched = 0;
+	for (const term of terms) if (haystack.includes(term)) matched += 1;
+	return matched;
+}
+/**
+* Apply the per-row FTS floor to one FTS leg's scores.
+*
+* The terms come from `relevanceTerms(query)` (latin words ≥ 5 chars + every CJK 3-gram) — the same
+* tokenisation the conditional-hint probe uses, so "relevant enough" means one thing in this repo.
+* A query with NO such term is not graded at all: there is nothing to count, and dropping every row
+* on a technicality would turn a 3–4 char latin query (`buildFtsQuery` still emits it) into silence.
+*
+* The bar itself is {@link effectiveTermFloor}: a query that can only produce one term (a 3-char CJK
+* query is one trigram) is measured against that one term, not against a configured 2 it could never
+* reach.
+*/
+function applyTermFloor(scores, texts, query, floor) {
+	if (!(floor > 0) || scores.size === 0) return {
+		scores,
+		dropped: 0
+	};
+	const terms = relevanceTerms(query);
+	if (terms.length === 0) return {
+		scores,
+		dropped: 0
+	};
+	const effective = effectiveTermFloor(floor, terms.length);
+	const out = /* @__PURE__ */ new Map();
+	let dropped = 0;
+	for (const [id, score] of scores) if (passesFloor(countMatchedTerms(texts.get(id) ?? "", terms), effective)) out.set(id, score);
+	else dropped += 1;
+	return {
+		scores: out,
+		dropped
+	};
+}
+/** Sum per-leg drop counts (the cross-store result merges both stores' reports). */
+function mergeFloorDrops(...parts) {
+	const out = emptyFloorDrops();
+	for (const part of parts) {
+		if (part === void 0) continue;
+		out.semantic += part.semantic;
+		out.fts += part.fts;
+		out.jaccard += part.jaccard;
+		out.hrr += part.hrr;
+	}
+	return out;
+}
+/** Sum every leg of one drop report (the retry decision and the health counter both read it). */
+function totalFloorDrops(drops) {
+	return drops.semantic + drops.fts + drops.jaccard + drops.hrr;
+}
 /**
 * A retrieval input the CALLER got wrong, as opposed to a backend that failed at runtime.
 *
@@ -6308,42 +7006,99 @@ async function hybridSearch(deps, plan) {
 		jaccard: retriever.weight_jaccard
 	} : DEGRADED_WEIGHTS;
 	const overFetch = Math.max(limit, plan.overFetch ?? limit * (retriever.over_fetch_factor || 5));
-	const legs = await runLegs(deps, {
-		query,
-		limit,
-		overFetch,
-		legCap: legCapFor(deps.config, overFetch),
-		semAvail,
-		weights,
-		...plan.queryVector === void 0 ? {} : { queryVector: plan.queryVector }
-	});
-	for (const leg of legs) if (leg.capped === true) recordLegCapped();
-	const fused = fuse(legs.map((leg) => ({
-		weight: leg.weight,
-		scores: leg.scores
-	})), overFetch);
-	const texts = deps.texts(fused.map((h) => h.id));
-	const live = fused.filter((h) => texts.has(h.id));
-	const ranked = (await rerankHits(deps.reranker, query, live, (id) => texts.get(id) ?? "")).slice(0, limit);
-	const hits = deps.hits(ranked, texts);
-	const budgeted = applyOutputBudget(deps.config, hits, plan.maxTokens);
-	deps.onReturn?.(budgeted.kept);
+	const legCap = legCapFor(deps.config, overFetch);
+	const termCount = relevanceTerms(query).length;
+	/**
+	* The query vector in force, ACROSS both passes.
+	*
+	* The single-store path is handed no vector by its caller (only the cross-store router encodes
+	* once), so before this the relaxed retry re-encoded the same query — ~4 ms on a warm model, paid
+	* every time the strict pass emptied with floor drops. A store publishes what it encoded through
+	* {@link HybridContext.onQueryVector}, and the retry below reuses it. A caller-supplied vector
+	* (cross-store) is already here and is passed through unchanged.
+	*/
+	let passVector = plan.queryVector;
+	/**
+	* One full pass under ONE floor profile: legs → fuse → live filter → rerank → slice → budget.
+	*
+	* `onReturn` (the store's reinforcement) is deliberately NOT called here: the strict pass is a
+	* probe whenever a relaxed pass may follow, and reinforcing text the caller never receives is
+	* exactly the defect `onReturn`'s doc calls out. The chosen pass is delivered by the caller below.
+	*
+	* `passVector` is read at call time and updated through `onQueryVector` while the pass runs, so the
+	* relaxed retry starts with whatever the strict pass encoded (see the variable's own comment).
+	*/
+	const runPass = async (profile, relaxLegs) => {
+		const floors = resolveFloors(retriever, semAvail, {
+			profile,
+			termCount,
+			...relaxLegs === void 0 ? {} : { relaxLegs }
+		});
+		const legs = await runLegs(deps, {
+			query,
+			limit,
+			overFetch,
+			legCap,
+			semAvail,
+			weights,
+			floors,
+			...passVector === void 0 ? {} : { queryVector: passVector },
+			onQueryVector: (vec) => {
+				passVector = vec;
+			}
+		});
+		let capped = 0;
+		for (const leg of legs) if (leg.capped === true) capped += 1;
+		const droppedByFloor = emptyFloorDrops();
+		for (const leg of legs) if (leg.leg !== void 0 && leg.droppedByFloor !== void 0) droppedByFloor[leg.leg] += leg.droppedByFloor;
+		const fused = fuse(legs.map((leg) => ({
+			weight: leg.weight,
+			scores: leg.scores
+		})), overFetch);
+		const texts = deps.texts(fused.map((h) => h.id));
+		const live = fused.filter((h) => texts.has(h.id));
+		const ranked = (await rerankHits(deps.reranker, query, live, (id) => texts.get(id) ?? "")).slice(0, limit);
+		const hits = deps.hits(ranked, texts);
+		const budgeted = applyOutputBudget(deps.config, hits, plan.maxTokens);
+		return {
+			hits: budgeted.kept,
+			used_tokens: budgeted.used_tokens,
+			floors,
+			dropped_by_floor: droppedByFloor,
+			capped
+		};
+	};
+	let chosen = await runPass(plan.floors === "loose" ? "loose" : "strict", plan.relaxLegs);
+	let relaxed = false;
+	if (plan.floors === void 0 && chosen.hits.length === 0 && totalFloorDrops(chosen.dropped_by_floor) > 0) {
+		const loosened = await runPass("loose", droppedLegs(chosen.dropped_by_floor));
+		if (loosened.hits.length > 0) {
+			chosen = loosened;
+			relaxed = true;
+		}
+	}
+	for (let i = 0; i < chosen.capped; i += 1) recordLegCapped();
+	deps.onReturn?.(chosen.hits);
 	if (plan.recordStats !== false) {
 		const rerank = rerankState(deps.reranker);
 		recordRetrieval({
 			kind: deps.kind,
-			results: budgeted.kept.length,
+			results: chosen.hits.length,
 			latencyMs: Date.now() - startedAt,
 			semanticLive: semAvail,
 			rerankUsed: rerank.used,
-			rerankFallback: rerank.fallback
+			rerankFallback: rerank.fallback,
+			droppedByFloor: chosen.dropped_by_floor
 		});
 	}
 	return {
-		hits: budgeted.kept,
+		hits: chosen.hits,
 		degraded: !semAvail,
 		weights,
-		used_tokens: budgeted.used_tokens
+		used_tokens: chosen.used_tokens,
+		floors: chosen.floors,
+		dropped_by_floor: chosen.dropped_by_floor,
+		...relaxed ? { relaxed: true } : {}
 	};
 }
 /**
@@ -6458,6 +7213,23 @@ function vectorCachePath(dbPath, space) {
 //#endregion
 //#region ../core/lib/store/common.js
 /**
+* The ONE write-side normalization both stores call before anything reaches the database.
+*
+* `@avantf/mem-contract`'s `toWellFormedText` is the implementation (well-formed + NFC); this name
+* is the store-layer entry, so the write paths say WHAT they are doing ("normalize this for a
+* write") rather than repeating a Unicode recipe. Every text field a store persists — fact content,
+* category, archive reason, a document's domain/source/title/uri, entity names and the SPO slots of
+* extracted triples — goes through here, which is what keeps a lone surrogate (and the strict-JSON
+* failure it causes downstream) out of the database in the first place.
+*/
+function normalizeWrite(value) {
+	return toWellFormedText(value);
+}
+/** {@link normalizeWrite} over a batch (entity names, caller paths, …). */
+function normalizeWrites(values) {
+	return values.map(normalizeWrite);
+}
+/**
 * Identity of the vector space a store currently writes into.
 *
 * A change of backend, model or width makes every stored vector stale, and the point of recording
@@ -6494,6 +7266,36 @@ function reportForeignVectors(kind, space, foreign, fix) {
 	if (foreign <= 0) return;
 	retrievalLogger().warn(`${kind} index: ${String(foreign)} vector(s) were written in another space than ${space} — they are still ranked; run ${fix} to re-encode them`);
 }
+/**
+* Hand the event loop back between two synchronous batches.
+*
+* The mount-time corpus reconcile reads and hashes EVERY managed document (and then walks the tree
+* again for orphans), all of it synchronous `node:fs`; at 10k documents that is a >0.6 s block of the
+* host's event loop (measured — see the performance review §7.5 / P6). `setImmediate` (a macrotask),
+* not a resolved-promise microtask: yielding to the microtask queue would let other JS continuations
+* run while timers and I/O queued behind the batch still waited.
+*/
+function yieldToEventLoop() {
+	return new Promise((resolve) => {
+		setImmediate(() => {
+			resolve();
+		});
+	});
+}
+/**
+* Visit `items` in order, yielding the event loop every `every` items.
+*
+* Use this INSTEAD of a bare `for` loop whenever the per-item mission is synchronous filesystem or
+* hashing work whose item count follows the corpus (not the request): the caller's whole loop used to
+* be one uninterrupted block, so the host could not serve a timer or an I/O callback until it was
+* over. An empty list does nothing (and never yields).
+*/
+async function forEachYielding(items, visit, every = 200) {
+	for (let index = 0; index < items.length; index += 1) {
+		visit(items[index], index);
+		if ((index + 1) % every === 0) await yieldToEventLoop();
+	}
+}
 //#endregion
 //#region ../core/lib/hrr/atoms.js
 /** 2π (float64, cross-platform stable). */
@@ -6664,7 +7466,8 @@ function hrrToBytes(vec) {
 *
 * Reads through a `DataView` instead of `new Float64Array(buf.buffer, buf.byteOffset, …)`:
 * that constructor requires an 8-byte-ALIGNED `byteOffset`, and nothing about a SQLite
-* BLOB promises one (better-sqlite3 happens to hand back offset-0 buffers today, but the
+* BLOB promises one (the driver happens to hand back offset-0 views today, and the adapter passes
+* that offset through unchanged, but the
 * callers here also pass plain `Uint8Array`s — a subarray or a pooled `Buffer` slice
 * would throw a RangeError from deep inside retrieval). A trailing partial element is
 * ignored, as before.
@@ -6688,12 +7491,72 @@ function hrrFromBytes(buf) {
 	}
 	return out;
 }
+//#endregion
+//#region ../core/lib/db/chunk.js
+/**
+* Batch an id list for a SQL `IN (...)` clause.
+*
+* SQLite caps the number of bound parameters in one statement (SQLITE_MAX_VARIABLE_NUMBER,
+* 32 766 in the bundled build). A query whose id list can grow with the CORPUS rather than
+* with the request — `entityBags` on the write-path contradiction check, `filterActive` on
+* the catch-up sweep — will therefore hit "too many SQL variables" on a large store. The
+* write path swallows that as best-effort, so the symptom is a detection feature that
+* silently stops running instead of an error anyone notices.
+*/
+/** Parameters per statement — far below the engine limit, still one round trip per batch. */
+const SQL_PARAM_BATCH = 500;
 /** Split `items` into consecutive batches of at most `size` (an empty list yields none). */
-function batches(items, size = 500) {
+function batches(items, size = SQL_PARAM_BATCH) {
 	const out = [];
 	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
 	return out;
 }
+/**
+* The `IN (…)` placeholder LADDER.
+*
+* The text of an `IN (?,?,…)` clause is part of the prepared-statement CACHE KEY (see
+* `db/sqlite.ts`), and the arity follows the DATA: a batched id list's last batch can be any width,
+* and the unbatched hit-set queries take whatever the caller passes. Left exact, those widths turn the
+* cache key space into thousands of one-use statements, and the cache's wholesale clear at its bound
+* then throws away the ~40 hot literal statements along with them (performance review §7.9 / P10).
+*
+* A key can only collapse if BOTH the placeholder text and the bound-parameter count are fixed for a
+* whole rung — padding the SQL with NULL literals would leave the text varying with the real arity.
+* So {@link inList} fixes the width to the next rung and pads the BOUND VALUES by repeating the last
+* one. Duplicates are inert in an `IN (…)`: `x IN (1,2,2)` is `x IN (1,2)`. The caller binds
+* `values`, not its original array.
+*
+* Above the last rung the exact width is used: those sites (a hit set, a predicate list) are bounded
+* by the caller, and padding an already-large list would only widen it.
+*/
+const IN_WIDTH_RUNGS = [
+	8,
+	16,
+	32,
+	64,
+	128,
+	256,
+	512
+];
+/**
+* Prepare a value list for an `IN (…)` clause at a ladder-rounded, cache-stable width.
+*
+* `count <= 0` yields `NULL` (matches nothing) rather than `IN ()`, a syntax error — callers guard
+* empty lists anyway; this is belt-and-braces.
+*/
+function inList(values) {
+	const count = values.length;
+	if (count === 0) return {
+		placeholders: "NULL",
+		values: []
+	};
+	const rung = IN_WIDTH_RUNGS.find((width) => width >= count) ?? count;
+	const padded = rung === count ? [...values] : [...values, ...Array.from({ length: rung - count }, () => values[count - 1])];
+	return {
+		placeholders: Array.from({ length: rung }, () => "?").join(","),
+		values: padded
+	};
+}
 //#endregion
 //#region ../core/lib/db/dao/entities.js
 var EntitiesDao = class {
@@ -6739,10 +7602,10 @@ var EntitiesDao = class {
 		if (!ids.length) return out;
 		for (const id of ids) out.set(id, []);
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
+			const { placeholders, values } = inList(batch);
 			const rows = this.db.prepare(`SELECT fe.fact_id AS fact_id, e.name AS name FROM fact_entities fe
            JOIN entities e ON e.entity_id = fe.entity_id
-           WHERE fe.fact_id IN (${placeholders})`).all(...batch);
+           WHERE fe.fact_id IN (${placeholders})`).all(...values);
 			for (const row of rows) out.get(row.fact_id)?.push(row.name);
 		}
 		return out;
@@ -6784,12 +7647,12 @@ var EntitiesDao = class {
 	/** Active facts linked to ALL of `names` (AND-join, `reason` leg). */
 	activeFactsForAllEntities(names) {
 		if (!names.length) return [];
-		const placeholders = names.map(() => "?").join(",");
+		const { placeholders, values } = inList(names);
 		return this.db.prepare(`SELECT fe.fact_id AS fact_id FROM fact_entities fe
            JOIN entities e ON e.entity_id = fe.entity_id
            JOIN facts fa ON fa.fact_id = fe.fact_id
           WHERE e.name IN (${placeholders}) AND fa.status = 'active'
-          GROUP BY fe.fact_id HAVING COUNT(DISTINCT e.name) = ?`).all(...names, names.length).map((row) => row.fact_id);
+          GROUP BY fe.fact_id HAVING COUNT(DISTINCT e.name) = ?`).all(...values, names.length).map((row) => row.fact_id);
 	}
 	/** Active facts sharing ANY of `names`, in one category (`jaccard` leg). */
 	/**
@@ -6808,7 +7671,7 @@ var EntitiesDao = class {
 	*/
 	candidateFactsForAnyEntity(names, category, limit) {
 		if (!names.length || limit <= 0) return [];
-		const placeholders = names.map(() => "?").join(",");
+		const { placeholders, values } = inList(names);
 		return this.db.prepare(`SELECT fa.fact_id AS id, COUNT(*) AS shared,
                 (SELECT COUNT(*) FROM fact_entities x WHERE x.fact_id = fa.fact_id) AS total
            FROM facts fa
@@ -6817,7 +7680,7 @@ var EntitiesDao = class {
           WHERE e.name IN (${placeholders}) AND fa.status = 'active' AND (? IS NULL OR fa.category = ?)
           GROUP BY fa.fact_id
           ORDER BY (CAST(shared AS REAL) / (total + ? - shared)) DESC, fa.fact_id ASC
-          LIMIT ?`).all(...names, category ?? null, category ?? null, names.length, limit).map((row) => row.id);
+          LIMIT ?`).all(...values, category ?? null, category ?? null, names.length, limit).map((row) => row.id);
 	}
 };
 //#endregion
@@ -6857,6 +7720,42 @@ const FACT_COLUMNS_NO_BLOB = `fact_id, content, category, tags, trust_score, set
     retrieval_count, helpful_count, last_retrieved_at, embedding_model, vector_store, status,
     supersedes_id, entities_version, conflict_checked, archived_at, archive_reason, ttl_days,
     mirror_source, mirror_target, created_at, updated_at`;
+/**
+* The FTS leg's exact SQL, exported so the plan guard (`test/fts_plan.spec.ts`) and the bench
+* control group EXPLAIN the production text itself instead of a copy that can silently drift.
+*
+* `NOT INDEXED` on the `facts` join is LOAD-BEARING, not decoration — this query is the one place
+* where a healthy-looking covering index (`idx_facts_status_category (status, category)`) is the
+* WRONG drive. Without planner statistics SQLite cannot know that `MATCH` is the selective access
+* path, so it drives from `facts` and RE-RUNS the whole external-content MATCH once per row:
+*
+*   bad : SEARCH fa USING COVERING INDEX idx_facts_status_category (status=?)
+*         | SCAN f VIRTUAL TABLE INDEX 0:=M1        <- the inner `=M1`
+*   good: SCAN f VIRTUAL TABLE INDEX 0:M1
+*         | SEARCH fa USING INTEGER PRIMARY KEY (rowid=?)
+*
+* Measured on the synthetic corpus at n=1000 (selective query, ~10 hits) in the fresh-session
+* shape: 574 ms → 4.6 ms for the leg; the hint's `LIMIT 1` shape is the SAME statement, 568 ms
+* → 1.9 ms.
+*
+* Why the missing statistics are not a startup-only blip: the open tick's `PRAGMA optimize` writes
+* no stats for an EMPTY database, so on a fresh install the whole first session runs without them
+* while the corpus grows in it; the next tick (≤60 min heartbeat) or a restart is what writes them.
+* `bench-memory` used to hide this because it seeds, then REOPENS the runtime (whose open tick
+* analyzes). Hence "ANALYZE facts at open when `sqlite_stat1` lacks a `facts` row and `facts` has
+* rows" does NOT close the window either: at open the fresh database has zero rows (the guard is
+* false), and once rows exist the next optimize is up to an hour away. `NOT INDEXED` pins the
+* FTS-driven plan independently of `sqlite_stat1`, so there is no window at all. It cannot change
+* results — only the join order — because the rowid join to `facts` is an INTEGER PRIMARY KEY
+* lookup (still available under `NOT INDEXED`), and `status`/`category` stay residual filters on
+* that one joined row, exactly as in the good plan above. Same spirit as §19 `page()`'s
+* `INDEXED BY`, which pins the plan against `PRAGMA optimize` flipping it back.
+*/
+const FTS_SEARCH_SQL = `SELECT f.rowid AS id, bm25(facts_fts) AS rank FROM facts_fts f
+         JOIN facts fa NOT INDEXED ON fa.fact_id = f.rowid
+         WHERE facts_fts MATCH ? AND fa.status = 'active' AND (? IS NULL OR fa.category = ?)
+         ORDER BY rank ASC
+         LIMIT ?`;
 var FactsDao = class FactsDao {
 	db;
 	constructor(db) {
@@ -6871,8 +7770,8 @@ var FactsDao = class FactsDao {
 	activeIds(ids) {
 		const out = [];
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			const rows = this.db.prepare(`SELECT fact_id FROM facts WHERE status = 'active' AND fact_id IN (${placeholders})`).all(...batch);
+			const { placeholders, values } = inList(batch);
+			const rows = this.db.prepare(`SELECT fact_id FROM facts WHERE status = 'active' AND fact_id IN (${placeholders})`).all(...values);
 			for (const row of rows) out.push(row.fact_id);
 		}
 		return out;
@@ -6917,15 +7816,15 @@ var FactsDao = class FactsDao {
 	*/
 	rowsByIds(ids) {
 		if (!ids.length) return [];
-		const placeholders = ids.map(() => "?").join(",");
-		return this.db.prepare(`SELECT ${FACT_COLUMNS_NO_BLOB} FROM facts WHERE fact_id IN (${placeholders})`).all(...ids);
+		const { placeholders, values } = inList(ids);
+		return this.db.prepare(`SELECT ${FACT_COLUMNS_NO_BLOB} FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
 	}
 	/** `fact_id → content` for a hit set (never N+1). */
 	textsByIds(ids) {
 		const out = /* @__PURE__ */ new Map();
 		if (!ids.length) return out;
-		const placeholders = ids.map(() => "?").join(",");
-		const rows = this.db.prepare(`SELECT fact_id, content FROM facts WHERE fact_id IN (${placeholders})`).all(...ids);
+		const { placeholders, values } = inList(ids);
+		const rows = this.db.prepare(`SELECT fact_id, content FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
 		for (const row of rows) out.set(row.fact_id, row.content);
 		return out;
 	}
@@ -6933,8 +7832,8 @@ var FactsDao = class FactsDao {
 	timesByIds(ids) {
 		const out = /* @__PURE__ */ new Map();
 		if (!ids.length) return out;
-		const placeholders = ids.map(() => "?").join(",");
-		const rows = this.db.prepare(`SELECT fact_id, created_at, updated_at FROM facts WHERE fact_id IN (${placeholders})`).all(...ids);
+		const { placeholders, values } = inList(ids);
+		const rows = this.db.prepare(`SELECT fact_id, created_at, updated_at FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
 		for (const row of rows) out.set(row.fact_id, {
 			created_at: row.created_at === null ? "" : String(row.created_at),
 			updated_at: row.updated_at === null ? null : String(row.updated_at)
@@ -7007,8 +7906,8 @@ var FactsDao = class FactsDao {
 	setEntitiesVersion(ids, version) {
 		let changes = 0;
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			changes += this.db.prepare(`UPDATE facts SET entities_version = ? WHERE fact_id IN (${placeholders})`).run(version, ...batch).changes;
+			const { placeholders, values } = inList(batch);
+			changes += this.db.prepare(`UPDATE facts SET entities_version = ? WHERE fact_id IN (${placeholders})`).run(version, ...values).changes;
 		}
 		return changes;
 	}
@@ -7066,8 +7965,8 @@ var FactsDao = class FactsDao {
 	markConflictChecked(ids) {
 		let changes = 0;
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			changes += this.db.prepare(`UPDATE facts SET conflict_checked = 1 WHERE fact_id IN (${placeholders})`).run(...batch).changes;
+			const { placeholders, values } = inList(batch);
+			changes += this.db.prepare(`UPDATE facts SET conflict_checked = 1 WHERE fact_id IN (${placeholders})`).run(...values).changes;
 		}
 		return changes;
 	}
@@ -7083,8 +7982,8 @@ var FactsDao = class FactsDao {
 	requeueConflictCheck(ids) {
 		let changes = 0;
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			changes += this.db.prepare(`UPDATE facts SET conflict_checked = 0 WHERE fact_id IN (${placeholders})`).run(...batch).changes;
+			const { placeholders, values } = inList(batch);
+			changes += this.db.prepare(`UPDATE facts SET conflict_checked = 0 WHERE fact_id IN (${placeholders})`).run(...values).changes;
 		}
 		return changes;
 	}
@@ -7228,7 +8127,7 @@ var FactsDao = class FactsDao {
 	/**
 	* The two "reinforcement quota" numbers of `trust_diagnose`, from ONE statement.
 	*
-	* They share a predicate and used to run it twice — twice the work for two columns of the same
+	* They share a predicate and used to run it twice — twice the mission for two columns of the same
 	* rows. It is now also sargable (`bonus_window_at > datetime('now', '-1 day')`, a plain string
 	* comparison on the stored UTC-ISO format) and served by `idx_facts_bonus_window`, instead of
 	* calling `julianday` on every row of `facts` (measured 13.4–16.2 ms at 20k, per query).
@@ -7276,8 +8175,8 @@ var FactsDao = class FactsDao {
 	clearVectors(ids) {
 		let changes = 0;
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			changes += this.db.prepare(`UPDATE facts SET semantic_vector = NULL, embedding_model = NULL, conflict_checked = 0 WHERE fact_id IN (${placeholders})`).run(...batch).changes;
+			const { placeholders, values } = inList(batch);
+			changes += this.db.prepare(`UPDATE facts SET semantic_vector = NULL, embedding_model = NULL, conflict_checked = 0 WHERE fact_id IN (${placeholders})`).run(...values).changes;
 		}
 		return changes;
 	}
@@ -7312,24 +8211,24 @@ var FactsDao = class FactsDao {
 		if (!ids.length) return [];
 		const out = [];
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
+			const { placeholders, values } = inList(batch);
 			out.push(...this.db.prepare(`SELECT fact_id, hrr_vector FROM facts
               WHERE fact_id IN (${placeholders}) AND status = 'active' AND hrr_vector IS NOT NULL
-                AND (? IS NULL OR category = ?)`).all(...batch, category ?? null, category ?? null));
+                AND (? IS NULL OR category = ?)`).all(...values, category ?? null, category ?? null));
 		}
 		return out;
 	}
 	/** ACTIVE subset of `ids` in one category (`null` = any) — the semantic leg's filter. */
 	activeIdsIn(ids, category) {
 		if (!ids.length) return [];
-		const placeholders = ids.map(() => "?").join(",");
-		return this.db.prepare(`SELECT fact_id FROM facts WHERE fact_id IN (${placeholders}) AND status = 'active' AND (? IS NULL OR category = ?)`).all(...ids, category ?? null, category ?? null).map((row) => row.fact_id);
+		const { placeholders, values } = inList(ids);
+		return this.db.prepare(`SELECT fact_id FROM facts WHERE fact_id IN (${placeholders}) AND status = 'active' AND (? IS NULL OR category = ?)`).all(...values, category ?? null, category ?? null).map((row) => row.fact_id);
 	}
 	/** `retrieval_count` + the "last used" clock (spec §2.5), batched. */
 	touchUsage(ids) {
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			this.db.prepare(`UPDATE facts SET retrieval_count = retrieval_count + 1, last_retrieved_at = CURRENT_TIMESTAMP WHERE fact_id IN (${placeholders})`).run(...batch);
+			const { placeholders, values } = inList(batch);
+			this.db.prepare(`UPDATE facts SET retrieval_count = retrieval_count + 1, last_retrieved_at = CURRENT_TIMESTAMP WHERE fact_id IN (${placeholders})`).run(...values);
 		}
 	}
 	/** Recall bonus not granted: only the settled trust moved. */
@@ -7347,14 +8246,12 @@ var FactsDao = class FactsDao {
 	* FTS5 leg over the external-content `facts_fts`.
 	*
 	* `bm25()` is negative (more negative = better), so the caller negates; a JOIN back to
-	* `facts` keeps archived rows and other categories out of the leg.
+	* `facts` keeps archived rows and other categories out of the leg — and `NOT INDEXED` keeps
+	* that JOIN from becoming the drive (see {@link FTS_SEARCH_SQL}, which carries the plans and
+	* measurements).
 	*/
 	ftsSearch(ftsQuery, category, limit) {
-		return this.db.prepare(`SELECT f.rowid AS id, bm25(facts_fts) AS rank FROM facts_fts f
-         JOIN facts fa ON fa.fact_id = f.rowid
-         WHERE facts_fts MATCH ? AND fa.status = 'active' AND (? IS NULL OR fa.category = ?)
-         ORDER BY rank ASC
-         LIMIT ?`).all(ftsQuery, category ?? null, category ?? null, limit ?? -1);
+		return this.db.prepare(FTS_SEARCH_SQL).all(ftsQuery, category ?? null, category ?? null, limit ?? -1);
 	}
 	/**
 	* ①'s predicate: the active-day counter crossed an integer boundary since the last settle.
@@ -7471,17 +8368,24 @@ var FactsDao = class FactsDao {
 	*/
 	purgeArchived(p) {
 		const baseParams = FactsDao.purgeParams(p);
+		const bounded = p.budget !== void 0 && p.budget > 0;
+		let remaining = bounded ? Math.floor(p.budget) : 0;
 		const purged = /* @__PURE__ */ new Set();
 		for (const branch of FactsDao.purgeBranches(p)) {
-			const bounded = p.budget !== void 0 && p.budget > 0;
+			if (bounded && remaining <= 0) break;
 			const predicate = bounded ? `${branch} AND fact_id IN (SELECT fact_id FROM facts WHERE ${branch} LIMIT :budget)` : branch;
 			const params = bounded ? {
 				...baseParams,
-				budget: Math.floor(p.budget)
+				budget: remaining
 			} : baseParams;
 			this.db.prepare(`UPDATE facts SET supersedes_id = NULL
             WHERE supersedes_id IN (SELECT fact_id FROM facts WHERE ${predicate})`).run(params);
-			for (const row of this.db.prepare(`DELETE FROM facts WHERE ${predicate} RETURNING fact_id`).all(params)) purged.add(row.fact_id);
+			let deleted = 0;
+			for (const row of this.db.prepare(`DELETE FROM facts WHERE ${predicate} RETURNING fact_id`).all(params)) {
+				purged.add(row.fact_id);
+				deleted += 1;
+			}
+			remaining -= deleted;
 		}
 		return [...purged];
 	}
@@ -7584,9 +8488,9 @@ var TriplesDao = class {
 	*/
 	activeFactsBySubject(subjs, secondPred) {
 		if (!subjs.length) return [];
-		const placeholders = subjs.map(() => "?").join(",");
+		const { placeholders, values } = inList(subjs);
 		const secondClause = secondPred ? "AND t.pred = ?" : "";
-		const params = secondPred ? [...subjs, secondPred] : [...subjs];
+		const params = secondPred ? [...values, secondPred] : [...values];
 		return this.db.prepare(`SELECT DISTINCT t.fact_id AS fact_id FROM triples t
            JOIN facts fa ON fa.fact_id = t.fact_id
           WHERE fa.status = 'active' AND t.subj IN (${placeholders}) ${secondClause}`).all(...params).map((row) => row.fact_id);
@@ -7726,7 +8630,7 @@ var ContradictionsDao = class {
 	* {@link resolveForFact} for a BATCH of ids leaving the corpus — the lifecycle tick path.
 	*
 	* The per-id loop cost O(archived × log) plus one statement compile per id: measured 6.3 s for
-	* 999 ids at 99k open pairs. Two statements PER BATCH (one per side) do the same work: each is
+	* 999 ids at 99k open pairs. Two statements PER BATCH (one per side) do the same mission: each is
 	* an index seek on the plain `fact_a`/`fact_b` index, and the side that matched supplies the
 	* loser (the fact that actually left the corpus), so the recorded verdict is unchanged.
 	*/
@@ -7735,15 +8639,15 @@ var ContradictionsDao = class {
 		if (ids.length === 0) return 0;
 		let changes = 0;
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
+			const { placeholders, values } = inList(batch);
 			changes += this.db.prepare(`UPDATE contradiction_log
               SET resolved = 1, resolution = ?, resolved_at = CURRENT_TIMESTAMP, loser_fact_id = fact_a,
                   resolved_by = 'auto'
-            WHERE resolved = 0 AND fact_a IN (${placeholders})`).run(resolution, ...batch).changes;
+            WHERE resolved = 0 AND fact_a IN (${placeholders})`).run(resolution, ...values).changes;
 			changes += this.db.prepare(`UPDATE contradiction_log
               SET resolved = 1, resolution = ?, resolved_at = CURRENT_TIMESTAMP, loser_fact_id = fact_b,
                   resolved_by = 'auto'
-            WHERE resolved = 0 AND fact_b IN (${placeholders})`).run(resolution, ...batch).changes;
+            WHERE resolved = 0 AND fact_b IN (${placeholders})`).run(resolution, ...values).changes;
 		}
 		return changes;
 	}
@@ -7785,7 +8689,9 @@ var ContradictionsDao = class {
 const POLARITY_CONFLICT_SCORE = .95;
 const OBJECT_CONFLICT_SCORE = .5;
 const DEFAULT_CONTRADICT_THRESHOLD = .6;
+const EMBED_MIN_ENTITIES = 2;
 const EMBED_OVERLAP_MIN = .5;
+const EMBED_SIM_MIN = .75;
 const EMBED_SIM_DUP_MAX = .97;
 /**
 * Embedding-fallback contradiction score: `entity_overlap * semantic_sim`, only
@@ -7796,10 +8702,10 @@ const EMBED_SIM_DUP_MAX = .97;
 function detectContradictionEmbedding(entitiesA, entitiesB, vecA, vecB, opts) {
 	const a = new Set(entitiesA);
 	const b = new Set(entitiesB);
-	const minEntities = opts?.minEntities ?? 2;
-	const overlapMin = opts?.overlapMin ?? .5;
-	const simMin = opts?.simMin ?? .75;
-	const simDupMax = opts?.simDupMax ?? .97;
+	const minEntities = opts?.minEntities ?? EMBED_MIN_ENTITIES;
+	const overlapMin = opts?.overlapMin ?? EMBED_OVERLAP_MIN;
+	const simMin = opts?.simMin ?? EMBED_SIM_MIN;
+	const simDupMax = opts?.simDupMax ?? EMBED_SIM_DUP_MAX;
 	if (Math.min(a.size, b.size) < minEntities) return 0;
 	const union = /* @__PURE__ */ new Set([...a, ...b]);
 	if (union.size === 0) return 0;
@@ -7986,11 +8892,11 @@ var ContradictDetector = class {
 	*/
 	findEntitySharing(factId) {
 		const mineCount = this.entities.countForFact(factId);
-		if (mineCount < 2) return [];
+		if (mineCount < EMBED_MIN_ENTITIES) return [];
 		const p = Math.max(EMBED_OVERLAP_MIN, this.threshold / EMBED_SIM_DUP_MAX);
 		const minShared = Math.ceil(p * mineCount);
 		const maxEntities = Math.floor(mineCount / p);
-		if (minShared > mineCount || maxEntities < 2) return [];
+		if (minShared > mineCount || maxEntities < EMBED_MIN_ENTITIES) return [];
 		return this.entities.candidateFacts(factId, minShared, maxEntities);
 	}
 	/**
@@ -8032,7 +8938,7 @@ var ContradictDetector = class {
 			if (!vecC) continue;
 			complete.push(c);
 			const entC = entFor(c);
-			if (entC.size < 2) continue;
+			if (entC.size < EMBED_MIN_ENTITIES) continue;
 			for (const t of candidates.get(c) ?? []) {
 				if (t === c) continue;
 				const key = c < t ? `${c}|${t}` : `${t}|${c}`;
@@ -8061,6 +8967,8 @@ var ContradictDetector = class {
 //#endregion
 //#region ../core/lib/lifecycle/trust.js
 const DAY_MS = 864e5;
+/** The reinforcement quota window is a CALENDAR day ("每天" is a calendar notion, §2.3). */
+const QUOTA_WINDOW_MS = DAY_MS;
 function clamp01(v) {
 	if (!Number.isFinite(v)) return 0;
 	return Math.min(1, Math.max(0, v));
@@ -8116,7 +9024,7 @@ function remainingDays(row, clock, cfg, enabled = cfg.enabled) {
 function rollWindow(row, nowMs) {
 	const at = row.bonus_window_at;
 	const started = parseUtcTs(at);
-	if (at === null || started === null || nowMs - started >= 864e5) return {
+	if (at === null || started === null || nowMs - started >= QUOTA_WINDOW_MS) return {
 		count: 0,
 		at: formatUtcTs(nowMs),
 		reset: true
@@ -8372,7 +9280,7 @@ const NO_CHECK = {
 /**
 * Facts one derived-state sweep pass may rebuild (`reindexEntities`'s default budget).
 *
-* Bounds MEMORY, not only work: the pass selects `content` for every row it takes, so an
+* Bounds MEMORY, not only mission: the pass selects `content` for every row it takes, so an
 * "unbounded" pass (the CLI used to ask for `Number.MAX_SAFE_INTEGER`) builds an array of every
 * stale fact's text before rebuilding the first one. Callers that want the corpus drained loop
 * until `deferred === 0` instead.
@@ -8494,12 +9402,12 @@ var MemoryStore = class {
 		reportForeignVectors("memory", space, persisted.filter((r) => r.embedding_model !== space).length, "mem_admin vectors_fix (dry_run=true previews the count)");
 	}
 	async add(content, category, ttlDays) {
-		const normalized = content.trim();
+		const normalized = normalizeWrite(content).trim();
 		if (!normalized) throw new Error("内容不能为空");
 		const tokens = await tagText(normalized);
-		const entities = entitiesFromTokens(tokens, normalized).map((e) => e.name);
-		const triples = triplesFromTokens(tokens);
-		const { fact_id, is_new, revived } = this.persistFact(normalized, category, ttlDays, entities, triples);
+		const entities = normalizeWrites(entitiesFromTokens(tokens, normalized).map((e) => e.name));
+		const triples = this.normalizeTriples(triplesFromTokens(tokens));
+		const { fact_id, is_new, revived } = this.persistFact(normalized, category === void 0 ? void 0 : normalizeWrite(category), ttlDays, entities, triples);
 		if (is_new || revived) await this.maybeIndexSemantic(fact_id, normalized);
 		const check = is_new || revived ? this.detectContradictions(fact_id) : NO_CHECK;
 		if (check.complete) this.facts.markConflictChecked([fact_id]);
@@ -8563,12 +9471,12 @@ var MemoryStore = class {
 	}
 	async update(fact_id, content, category, ttlDays) {
 		if (!this.getRow(fact_id)) throw new Error(`找不到 fact_id=${fact_id}`);
-		const normalized = content.trim();
+		const normalized = normalizeWrite(content).trim();
 		if (!normalized) throw new Error("内容不能为空");
 		const tokens = await tagText(normalized);
-		const entities = entitiesFromTokens(tokens, normalized).map((e) => e.name);
-		const triples = triplesFromTokens(tokens);
-		const { fact_id: newId, is_new, revived } = this.persistFact(normalized, category, ttlDays, entities, triples, {
+		const entities = normalizeWrites(entitiesFromTokens(tokens, normalized).map((e) => e.name));
+		const triples = this.normalizeTriples(triplesFromTokens(tokens));
+		const { fact_id: newId, is_new, revived } = this.persistFact(normalized, category === void 0 ? void 0 : normalizeWrite(category), ttlDays, entities, triples, {
 			supersedesId: fact_id,
 			archiveOldIfActive: true
 		});
@@ -8590,7 +9498,7 @@ var MemoryStore = class {
 		const status = this.facts.statusOf(fact_id);
 		if (status === void 0) return false;
 		if (status === "archived") return true;
-		const changed = this.facts.archive(fact_id, readClock(this.db), reason);
+		const changed = this.facts.archive(fact_id, readClock(this.db), normalizeWrite(reason));
 		if (changed > 0) {
 			this.vstore.remove(fact_id);
 			this.contradictions.resolveForFact(fact_id);
@@ -9028,13 +9936,13 @@ var MemoryStore = class {
 	*
 	* Awaited by `maintenance` (one batch), so the caller knows the batch is done when it returns;
 	* `deferred` is what the next pass still has to do. Callers that want the whole corpus drained
-	* loop until `deferred === 0` — `budget` bounds MEMORY as well as work, since the pass reads
+	* loop until `deferred === 0` — `budget` bounds MEMORY as well as mission, since the pass reads
 	* every selected row's `content` before rebuilding the first one.
 	*
 	* The in-flight guard is here rather than at the callers because the callers CAN overlap: the
 	* plugin's heartbeat and `maintenance` are both periodic, and `staleEntityRows` is ORDERED, so
 	* two concurrent passes would select the same rows and re-tag them twice. Overlap is not
-	* corruption (each fact is stamped in its own transaction) — it is duplicated work in a
+	* corruption (each fact is stamped in its own transaction) — it is duplicated mission in a
 	* single-threaded process. A pass that finds one running reports `skipped` and does nothing.
 	*
 	* `budget` is clamped at 0: SQLite reads a negative LIMIT as "no limit" (`LIMIT -1`), so a
@@ -9051,8 +9959,8 @@ var MemoryStore = class {
 			const rows = this.facts.staleEntityRows(1, Math.max(0, Math.floor(budget)));
 			for (const row of rows) {
 				const tokens = await tagText(row.content);
-				const entities = entitiesFromTokens(tokens, row.content).map((e) => e.name);
-				const triples = triplesFromTokens(tokens);
+				const entities = normalizeWrites(entitiesFromTokens(tokens, row.content).map((e) => e.name));
+				const triples = this.normalizeTriples(triplesFromTokens(tokens));
 				const hrr = hrrToBytes(encodeHrrEntityVector(entities));
 				this.db.transaction(() => {
 					this.entities.unlinkFact(row.fact_id);
@@ -9138,12 +10046,17 @@ var MemoryStore = class {
 			limit: input.limit,
 			maxTokens: input.maxTokens,
 			queryVector: input.queryVector,
-			recordStats: input.recordStats
+			recordStats: input.recordStats,
+			floors: input.floors,
+			...input.relaxLegs === void 0 ? {} : { relaxLegs: input.relaxLegs }
 		});
 		return {
 			hits: result.hits,
 			degraded: result.degraded,
-			weights: result.weights
+			weights: result.weights,
+			floors: result.floors,
+			dropped_by_floor: result.dropped_by_floor,
+			...result.relaxed === true ? { relaxed: true } : {}
 		};
 	}
 	/**
@@ -9180,30 +10093,54 @@ var MemoryStore = class {
 	* rescale the survivors. That covers the Jaccard and FTS legs. It does NOT cover the HRR leg, whose
 	* candidates arrive in the JACCARD leg's order (or by recency in its fallback), so its cap can
 	* remove its own highest scorer and `v / max` really does move. Accepted — the cap bounds per-query
-	* work and the pool is reranked afterwards — but do not read these scores as comparable across
+	* mission and the pool is reranked afterwards — but do not read these scores as comparable across
 	* different cap/over-fetch settings; see `docs/PROVENANCE_REVIEW.md` N5 for the missing differential.
 	*/
 	async searchLegs(input, ctx) {
 		const qEntities = Array.from(new Set((await extractEntities(ctx.query)).map((e) => e.name)));
 		const candidates = qEntities.length > 0 ? this.entities.candidateFactsForAnyEntity(qEntities, input.category, ctx.legCap) : [];
-		const leg = (scores, weight) => ({
+		/**
+		* Wrap one leg's raw scores. `capped` must be measured on the RAW set (before the relevance
+		* floor): the floor removes the tail anyway, and deriving the flag from the floored size would
+		* erase the "this leg was cut at legCap" signal exactly when it bound.
+		*/
+		const leg = (scores, weight, raw) => ({
 			weight,
 			scores,
-			capped: scores.size === ctx.legCap
+			capped: (raw ?? scores).size === ctx.legCap
 		});
-		const fts = this.ftsPath(ctx.query, input.category, ctx.legCap);
+		const ftsRaw = this.ftsPath(ctx.query, input.category, ctx.legCap);
+		const ftsFloored = applyTermFloor(ftsRaw, this.loadTexts([...ftsRaw.keys()]), ctx.query, ctx.floors.fts);
+		const jaccardRaw = this.jaccardPath(qEntities, candidates);
+		const jaccardFloored = applyScoreFloor(jaccardRaw, ctx.floors.jaccard);
+		const jaccardLeg = {
+			...leg(jaccardFloored.scores, ctx.weights.jaccard, jaccardRaw),
+			leg: "jaccard",
+			droppedByFloor: jaccardFloored.dropped
+		};
 		const legs = [
-			ctx.semAvail ? this.semanticPath(ctx.query, input.category, ctx.overFetch, ctx.queryVector).then((scores) => ({
-				weight: ctx.weights.semantic,
-				scores
-			})) : {
+			ctx.semAvail ? this.semanticPath(ctx.query, input.category, ctx.overFetch, ctx.queryVector, ctx.onQueryVector).then((raw) => {
+				const floored = applyScoreFloor(raw, ctx.floors.semantic);
+				return {
+					weight: ctx.weights.semantic,
+					scores: floored.scores,
+					leg: "semantic",
+					droppedByFloor: floored.dropped
+				};
+			}) : {
 				weight: ctx.weights.semantic,
-				scores: /* @__PURE__ */ new Map()
+				scores: /* @__PURE__ */ new Map(),
+				leg: "semantic",
+				droppedByFloor: 0
 			},
-			Promise.resolve(leg(this.jaccardPath(qEntities, candidates), ctx.weights.jaccard)),
-			leg(fts, ctx.weights.fts)
+			Promise.resolve(jaccardLeg),
+			{
+				...leg(ftsFloored.scores, ctx.weights.fts, ftsRaw),
+				leg: "fts",
+				droppedByFloor: ftsFloored.dropped
+			}
 		];
-		if (input.includeHrr) legs.push(Promise.resolve(leg(this.hrrPath(ctx.query, qEntities, candidates, input.category, ctx.legCap), ctx.weights.jaccard)));
+		if (input.includeHrr) legs.push(Promise.resolve(leg(this.hrrPath(ctx.query, qEntities, [...jaccardFloored.scores.keys()], input.category, ctx.legCap, candidates.length === 0), ctx.weights.jaccard)));
 		return legs;
 	}
 	/**
@@ -9300,11 +10237,14 @@ var MemoryStore = class {
 	}
 	/**
 	* Semantic leg. `queryVector` short-circuits the encode when the caller already
-	* encoded this exact query (the cross-store router does, for both stores at once).
+	* encoded this exact query (the cross-store router does, for both stores at once);
+	* `onVector` publishes the vector this leg actually used, so the relaxed retry pass can reuse it
+	* instead of re-encoding (performance review §7.7 / P8).
 	*/
-	async semanticPath(query, category, k, queryVector) {
+	async semanticPath(query, category, k, queryVector, onVector) {
 		const vec = queryVector ?? await this.semantic.encode(query);
 		if (vec.length !== this.vstore.dim) throw new RetrievalInputError(`queryVector 维度不符：${vec.length} != ${this.vstore.dim}`);
+		onVector?.(vec);
 		const topk = this.vstore.topk(vec, Math.max(50, k));
 		if (!topk.length) return /* @__PURE__ */ new Map();
 		const allowed = new Set(this.facts.activeIdsIn(topk.map((t) => t.id), category));
@@ -9317,10 +10257,11 @@ var MemoryStore = class {
 	* each active fact's persisted HRR vector. Recalls facts whose entities relate to
 	* the probe even when surface text shares no FTS trigrams.
 	*/
-	hrrPath(query, entityNames, candidates, category, cap) {
+	hrrPath(query, entityNames, candidates, category, cap, allowRecencyFallback = candidates.length === 0) {
 		if (entityNames.length === 0 && !query.trim()) return /* @__PURE__ */ new Map();
+		if (candidates.length === 0 && !allowRecencyFallback) return /* @__PURE__ */ new Map();
 		const probe = encodeHrrEntityVector(entityNames.length ? entityNames : [query.trim()]);
-		const truncatedFallback = candidates.length === 0;
+		const truncatedFallback = allowRecencyFallback;
 		const rows = truncatedFallback ? this.facts.activeHrrRows(category, cap) : this.facts.hrrRowsForFacts(candidates, category);
 		if (truncatedFallback && rows.length === cap && !this.hrrFallbackWarned) {
 			this.hrrFallbackWarned = true;
@@ -9502,6 +10443,21 @@ var MemoryStore = class {
 	linkEntities(fact_id, entities) {
 		this.entities.linkFact(fact_id, entities);
 	}
+	/**
+	* Normalize the SPO slots of extracted triples through the same write entry as fact content.
+	*
+	* The triples are DERIVED (from an already-normalized content string, in `add`/`update`), but a
+	* tokenizer is free to hand back a half code unit, and a future truncation rule could split a
+	* surrogate pair — so the derived rows cross the same entry instead of trusting the producer.
+	*/
+	normalizeTriples(triples) {
+		return triples.map((t) => ({
+			...t,
+			subj: normalizeWrite(t.subj),
+			pred: normalizeWrite(t.pred),
+			obj: normalizeWrite(t.obj)
+		}));
+	}
 	insertTriples(fact_id, triples) {
 		this.triples.insertMany(fact_id, triples);
 	}
@@ -9725,8 +10681,8 @@ var ChunksDao = class {
 	texts(ids) {
 		const out = [];
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			out.push(...this.db.prepare(`SELECT chunk_id, text FROM doc_chunks WHERE chunk_id IN (${placeholders})`).all(...batch));
+			const { placeholders, values } = inList(batch);
+			out.push(...this.db.prepare(`SELECT chunk_id, text FROM doc_chunks WHERE chunk_id IN (${placeholders})`).all(...values));
 		}
 		return out;
 	}
@@ -9770,8 +10726,8 @@ var ChunksDao = class {
 	/** Record which extraction rules produced a chunk's entity rows (see `ENTITY_EXTRACTOR_VERSION`). */
 	setEntitiesVersion(ids, version) {
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			this.db.prepare(`UPDATE doc_chunks SET entities_version = ? WHERE chunk_id IN (${placeholders})`).run(version, ...batch);
+			const { placeholders, values } = inList(batch);
+			this.db.prepare(`UPDATE doc_chunks SET entities_version = ? WHERE chunk_id IN (${placeholders})`).run(version, ...values);
 		}
 	}
 	/** Every persisted chunk vector, for rebuilding the in-memory index at open. */
@@ -9806,8 +10762,8 @@ var ChunksDao = class {
 	entityBags(ids) {
 		const out = /* @__PURE__ */ new Map();
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
-			const rows = this.db.prepare(`SELECT chunk_id, name FROM chunk_entities WHERE chunk_id IN (${placeholders})`).all(...batch);
+			const { placeholders, values } = inList(batch);
+			const rows = this.db.prepare(`SELECT chunk_id, name FROM chunk_entities WHERE chunk_id IN (${placeholders})`).all(...values);
 			for (const r of rows) {
 				const list = out.get(r.chunk_id);
 				if (list) list.push(r.name);
@@ -9820,12 +10776,12 @@ var ChunksDao = class {
 	hits(ids) {
 		const out = [];
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
+			const { placeholders, values } = inList(batch);
 			out.push(...this.db.prepare(`SELECT dc.chunk_id AS chunk_id, dc.text AS text, dc.source_ref AS source_ref,
                     d.domain AS domain, d.source AS source,
                     d.created_at AS created_at, d.updated_at AS updated_at
              FROM doc_chunks dc JOIN documents d ON d.doc_id = dc.doc_id
-             WHERE dc.chunk_id IN (${placeholders})`).all(...batch));
+             WHERE dc.chunk_id IN (${placeholders})`).all(...values));
 		}
 		return out;
 	}
@@ -9833,10 +10789,10 @@ var ChunksDao = class {
 	meta(ids) {
 		const out = [];
 		for (const batch of batches(ids)) {
-			const placeholders = batch.map(() => "?").join(",");
+			const { placeholders, values } = inList(batch);
 			out.push(...this.db.prepare(`SELECT dc.chunk_id AS chunk_id, d.domain AS domain, d.source AS source
              FROM doc_chunks dc JOIN documents d ON d.doc_id = dc.doc_id
-             WHERE dc.chunk_id IN (${placeholders})`).all(...batch));
+             WHERE dc.chunk_id IN (${placeholders})`).all(...values));
 		}
 		return out;
 	}
@@ -9873,7 +10829,7 @@ var ChunksDao = class {
 		if (limit <= 0) return [];
 		const out = /* @__PURE__ */ new Set();
 		for (const batch of batches(names)) {
-			const placeholders = batch.map(() => "?").join(",");
+			const { placeholders, values } = inList(batch);
 			const rows = this.db.prepare(`SELECT ce.chunk_id AS chunk_id, COUNT(*) AS shared,
                   (SELECT COUNT(*) FROM chunk_entities x WHERE x.chunk_id = ce.chunk_id) AS total
              FROM chunk_entities ce
@@ -9887,7 +10843,7 @@ var ChunksDao = class {
               AND (? IS NULL OR d.domain = ?) AND (? IS NULL OR d.source = ?)
             GROUP BY ce.chunk_id
             ORDER BY (CAST(shared AS REAL) / (total + ? - shared)) DESC, ce.chunk_id ASC
-            LIMIT ?`).all(...batch, domain ?? null, domain ?? null, source ?? null, source ?? null, batch.length, limit);
+            LIMIT ?`).all(...values, domain ?? null, domain ?? null, source ?? null, source ?? null, batch.length, limit);
 			for (const r of rows) out.add(r.chunk_id);
 		}
 		return [...out];
@@ -10889,22 +11845,26 @@ var DocFiles = class {
 	/**
 	* Every `.md` under the root, with the `doc_id` its frontmatter names (when it names one).
 	* Used to report orphans — files left behind by a document that no longer exists.
+	*
+	* ASYNC and batched: the walk itself is an async recursive `readdir` (a `readdirSync` gathers
+	* every entry in one ~41 ms call at 10k files), and the per-file parse is a `read` — at 10k
+	* documents that is a second full read of the corpus on top of `sync`'s staleness pass, and it
+	* used to be one uninterrupted synchronous block (performance review §7.5 / P6).
 	*/
-	scan() {
+	async scan() {
 		if (!existsSync(this.root)) return [];
 		const found = [];
-		for (const entry of readdirSync(this.root, {
+		await forEachYielding((await readdir(this.root, {
 			recursive: true,
 			withFileTypes: true
-		})) {
-			if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+		})).filter((entry) => entry.isFile() && entry.name.endsWith(".md")), (entry) => {
 			const path = join(entry.parentPath ?? this.root, entry.name);
 			const parsed = this.read(path);
 			found.push({
 				path: relative(this.root, path).split(sep).join("/"),
 				...parsed?.meta.doc_id === void 0 ? {} : { doc_id: parsed.meta.doc_id }
 			});
-		}
+		});
 		return found;
 	}
 };
@@ -11302,7 +12262,7 @@ var KnowledgeStore = class {
 	* list would silently turn it into a restricted one.
 	*/
 	addDomain(raw) {
-		const domain = raw.trim();
+		const domain = normalizeWrite(raw).trim();
 		if (domain === "") throw new Error("知识域不能为空");
 		if (domain.includes("/") || domain.includes("\\")) throw new Error(`知识域不能包含 “/” 或 “\\”：${domain}（它会成为受管目录的一级目录名）`);
 		if (this.allowedDomains.has(domain)) return this.domainCatalog();
@@ -11334,15 +12294,23 @@ var KnowledgeStore = class {
 	*    request. All-or-nothing, so a partial write can never sit behind a confirmation dialog.
 	*/
 	async ingestRequest(req, mode) {
-		const source = req.source ?? "default";
-		const plan = this.planIngest({
+		const normalized = {
 			...req,
+			domain: normalizeWrite(req.domain),
+			...req.source === void 0 ? {} : { source: normalizeWrite(req.source) },
+			...req.title === void 0 ? {} : { title: normalizeWrite(req.title) },
+			...req.source_uri === void 0 ? {} : { source_uri: normalizeWrite(req.source_uri) },
+			...req.paths === void 0 ? {} : { paths: normalizeWrites(req.paths) }
+		};
+		const source = normalized.source ?? "default";
+		const plan = this.planIngest({
+			...normalized,
 			source
 		});
 		const conflicts = plan.targets.flatMap((target) => target.existing === void 0 ? [] : [target.existing]);
-		if (mode === "add") return this.runAdd(plan, req.domain, source);
-		if (conflicts.length > 0 && req.overwrite !== true) return this.conflictReport(conflicts, plan.targets.length - conflicts.length);
-		return this.runReplace(plan, req.domain, source);
+		if (mode === "add") return this.runAdd(plan, normalized.domain, source);
+		if (conflicts.length > 0 && normalized.overwrite !== true) return this.conflictReport(conflicts, plan.targets.length - conflicts.length);
+		return this.runReplace(plan, normalized.domain, source);
 	}
 	/**
 	* Stage ①/②: resolve the request to its targets without reading anything.
@@ -11359,14 +12327,15 @@ var KnowledgeStore = class {
 	}
 	/** One target's identity plus whatever document already owns it. */
 	target(title, path, domain, source) {
-		const row = this.docs.find(domain, source, title);
+		const safeTitle = normalizeWrite(title);
+		const row = this.docs.find(domain, source, safeTitle);
 		const existing = row === null ? void 0 : {
 			doc_id: row.doc_id,
 			title: row.title,
 			path: this.docFilePathOf(row)
 		};
 		return {
-			title,
+			title: safeTitle,
 			...path === void 0 ? {} : { path },
 			...existing === void 0 ? {} : { existing }
 		};
@@ -11507,16 +12476,19 @@ var KnowledgeStore = class {
 	* searchable through every path (FTS, entity, semantic).
 	*/
 	async ingest(text, domain, source = DEFAULT_KB_SOURCE, title, sourceUri, encoding, gitAction = "ingest", converter, warnings) {
-		this.assertDomainAllowed(domain);
+		const safeDomain = normalizeWrite(domain);
+		const safeSource = normalizeWrite(source);
+		const safeSourceUri = sourceUri === void 0 ? void 0 : normalizeWrite(sourceUri);
+		this.assertDomainAllowed(safeDomain);
 		if (text.length > MAX_DOC_CHARS) throw new Error(`文档过大：${text.length} 字符（上限 ${MAX_DOC_CHARS}）`);
 		const chunks = chunkText(text, this.kbConfig.chunk_size, this.kbConfig.chunk_overlap);
-		const docTitle = title ?? deriveDocTitle(text);
+		const docTitle = normalizeWrite(title ?? deriveDocTitle(text));
 		const result = this.db.transaction(() => {
-			const docId = this.docs.upsert(domain, source, docTitle, sourceUri);
+			const docId = this.docs.upsert(safeDomain, safeSource, docTitle, safeSourceUri);
 			const oldChunkIds = this.chunks.idsForDoc(docId);
 			const reusable = this.reusableByHash(docId, this.vectorSpace());
 			this.chunks.deleteForDoc(docId);
-			this.docs.touch(docId, sourceUri);
+			this.docs.touch(docId, safeSourceUri);
 			return {
 				doc_id: docId,
 				oldChunkIds,
@@ -11524,13 +12496,13 @@ var KnowledgeStore = class {
 					idx,
 					text: chunk.text,
 					headingsPath: chunk.headingsPath,
-					sourceRef: `${domain}:${source}:${docId}:${idx}`,
+					sourceRef: `${safeDomain}:${safeSource}:${docId}:${idx}`,
 					charStart: chunk.start,
 					charEnd: chunk.end
 				}))),
 				reusable
 			};
-		})();
+		}).immediate();
 		this.evictVectors(result.oldChunkIds);
 		const indexed = await this.indexChunks(result.newChunkIds, result.reusable);
 		return {
@@ -11541,10 +12513,10 @@ var KnowledgeStore = class {
 			...converter === void 0 ? {} : { converter },
 			...warnings === void 0 || warnings.length === 0 ? {} : { warnings },
 			...this.writeManagedFile(result.doc_id, {
-				domain,
-				source,
+				domain: safeDomain,
+				source: safeSource,
 				title: docTitle,
-				sourceUri,
+				sourceUri: safeSourceUri,
 				converter
 			}, text, gitAction)
 		};
@@ -11891,24 +12863,30 @@ var KnowledgeStore = class {
 	* document. A stamp is a TRIGGER, not a judgement: the caller re-ingests through `sync`, which
 	* hashes the body and decides. The first call only seeds the baseline and reports nothing —
 	* use `sync` once at startup if a process may have been down while the corpus changed.
+	*
+	* ASYNC because one `stat` per document is exactly the cost that has to leave the event loop to
+	* something else once in a while: at 10k documents the walk blocked the host for >0.1 s per trip
+	* (measured — performance review §7.5 / P7), and this runs after every tool result behind a 2 s
+	* throttle. The baseline is still taken ATOMICALLY at the end, so a caller sees the same
+	* all-or-nothing update as before.
 	*/
-	corpusDrift() {
+	async corpusDrift() {
 		const fileSet = this.docFiles.listPaths().join("\n");
 		const previous = this.corpusStamps;
 		const previousSet = this.corpusFileSet;
 		const stamps = /* @__PURE__ */ new Map();
 		const changed = [];
 		const missing = [];
-		for (const doc of this.docs.list()) {
+		await forEachYielding(this.docs.list(), (doc) => {
 			const path = this.docFiles.basePath(doc.domain, doc.source, doc.title);
 			const stamp = this.docFiles.stamp(path);
 			if (stamp === null) {
 				if (previous?.has(path) === true) missing.push(doc.doc_id);
-				continue;
+				return;
 			}
 			stamps.set(path, stamp);
 			if (previous !== null && previous.get(path) !== stamp) changed.push(doc.doc_id);
-		}
+		});
 		this.corpusStamps = stamps;
 		this.corpusFileSet = fileSet;
 		return {
@@ -11961,7 +12939,7 @@ var KnowledgeStore = class {
 		const docs = opts.docId === void 0 ? all : all.filter((doc) => doc.doc_id === opts.docId);
 		const stale = [];
 		const missing = [];
-		for (const doc of docs) {
+		await forEachYielding(docs, (doc) => {
 			const state = this.docFiles.state(doc.doc_id, doc.domain, doc.source, doc.title);
 			const entry = {
 				doc_id: doc.doc_id,
@@ -11972,26 +12950,27 @@ var KnowledgeStore = class {
 			};
 			if (state.missing) missing.push(entry);
 			else if (state.stale) stale.push(entry);
-		}
+		});
 		const known = new Set(all.map((doc) => doc.doc_id));
-		const orphans = opts.docId !== void 0 ? [] : this.docFiles.scan().filter((file) => file.doc_id === void 0 || !known.has(file.doc_id)).map((file) => file.path).sort();
+		const orphans = opts.docId !== void 0 ? [] : (await this.docFiles.scan()).filter((file) => file.doc_id === void 0 || !known.has(file.doc_id)).map((file) => file.path).sort();
 		const baseCounts = /* @__PURE__ */ new Map();
 		for (const doc of all) {
 			const base = this.docFiles.basePath(doc.domain, doc.source, doc.title);
 			baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
 		}
-		const unclaimed = missing.flatMap((entry) => {
+		const unclaimed = [];
+		await forEachYielding(missing, (entry) => {
 			const doc = docs.find((candidate) => candidate.doc_id === entry.doc_id);
-			if (doc === void 0) return [];
+			if (doc === void 0) return;
 			const base = this.docFiles.basePath(doc.domain, doc.source, doc.title);
-			if ((baseCounts.get(base) ?? 0) !== 1) return [];
+			if ((baseCounts.get(base) ?? 0) !== 1) return;
 			const parsed = this.docFiles.read(base);
-			if (parsed === null || parsed.meta.doc_id !== void 0 || parsed.body.trim() === "") return [];
-			return [{
+			if (parsed === null || parsed.meta.doc_id !== void 0 || parsed.body.trim() === "") return;
+			unclaimed.push({
 				doc_id: doc.doc_id,
 				title: doc.title,
 				path: base
-			}];
+			});
 		});
 		if (opts.dryRun === true) return {
 			checked: docs.length,
@@ -12031,7 +13010,7 @@ var KnowledgeStore = class {
 	* `domain` scopes the rebuild to one knowledge domain. One corpus SELECT feeds both legs, and
 	* each row is skipped when its derivation is provably still valid (same text digest, same
 	* vector space, same extractor version). Without that, the only way to know whether a chunk
-	* needed work was to redo the work: an ONNX forward pass plus a jieba pass per chunk over the
+	* needed mission was to redo the mission: an ONNX forward pass plus a jieba pass per chunk over the
 	* whole corpus, every time.
 	*
 	* `dryRun` answers "how much would this cost?" without writing anything — including without
@@ -12074,14 +13053,18 @@ var KnowledgeStore = class {
 	}
 	/** Chunk search over the knowledge corpus (semantic + FTS + entity, joint fusion). */
 	async search(query, opts) {
-		return (await hybridSearch(this.hybridDeps(opts), {
+		const result = await hybridSearch(this.hybridDeps(opts), {
 			query,
 			limit: opts?.limit,
 			overFetch: opts?.overFetch,
 			maxTokens: opts?.maxTokens,
 			queryVector: opts?.queryVector,
-			recordStats: opts?.recordStats
-		})).hits;
+			recordStats: opts?.recordStats,
+			floors: opts?.floors,
+			...opts?.relaxLegs === void 0 ? {} : { relaxLegs: opts.relaxLegs }
+		});
+		opts?.onResult?.(result);
+		return result.hits;
 	}
 	/**
 	* This store's half of the shared orchestration (`store/hybrid.ts`): the legs, the chunk-row load
@@ -12135,30 +13118,57 @@ var KnowledgeStore = class {
 	* matching corpus only makes `fuse` normalize and sort it (see `MemoryStore.searchLegs`).
 	*/
 	async searchLegs(opts, ctx) {
-		const leg = (scores, weight) => ({
+		/**
+		* Wrap one leg's floored scores. `raw` is the PRE-floor set: `capped` must be measured there,
+		* because the relevance floor removes the tail anyway and re-deriving the flag afterwards would
+		* erase the "cut at legCap" signal exactly when it bound.
+		*/
+		const leg = (scores, weight, name, dropped, raw) => ({
 			weight,
 			scores,
-			capped: scores.size === ctx.legCap
+			capped: (raw ?? scores).size === ctx.legCap,
+			leg: name,
+			droppedByFloor: dropped
 		});
+		const ftsRaw = this.ftsPath(ctx.query, opts?.domain, opts?.source, ctx.legCap);
+		const ftsFloored = applyTermFloor(ftsRaw, this.chunkTexts([...ftsRaw.keys()]), ctx.query, ctx.floors.fts);
 		return [
-			ctx.semAvail ? this.semanticPath(ctx.query, ctx.overFetch, opts, ctx.queryVector).then((scores) => ({
-				weight: ctx.weights.semantic,
-				scores
-			})) : {
+			ctx.semAvail ? this.semanticPath(ctx.query, ctx.overFetch, opts, ctx.queryVector, ctx.onQueryVector).then((raw) => {
+				const floored = applyScoreFloor(raw, ctx.floors.semantic);
+				return {
+					weight: ctx.weights.semantic,
+					scores: floored.scores,
+					leg: "semantic",
+					droppedByFloor: floored.dropped
+				};
+			}) : {
 				weight: ctx.weights.semantic,
-				scores: /* @__PURE__ */ new Map()
+				scores: /* @__PURE__ */ new Map(),
+				leg: "semantic",
+				droppedByFloor: 0
 			},
-			leg(this.ftsPath(ctx.query, opts?.domain, opts?.source, ctx.legCap), ctx.weights.fts),
-			this.jaccardPath(ctx.query, opts?.domain, opts?.source, ctx.legCap).then((scores) => leg(scores, ctx.weights.jaccard))
+			leg(ftsFloored.scores, ctx.weights.fts, "fts", ftsFloored.dropped, ftsRaw),
+			this.jaccardPath(ctx.query, opts?.domain, opts?.source, ctx.legCap).then((raw) => {
+				const floored = applyScoreFloor(raw, ctx.floors.jaccard);
+				return leg(floored.scores, ctx.weights.jaccard, "jaccard", floored.dropped, raw);
+			})
 		];
 	}
+	/** The texts of a candidate set, for the per-row FTS floor (one batched query). */
+	chunkTexts(ids) {
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		return new Map(this.chunks.hits(ids).map((row) => [row.chunk_id, row.text]));
+	}
 	/**
 	* Semantic leg. `queryVector` short-circuits the encode when the caller already
-	* encoded this exact query (the cross-store router does, for both stores at once).
+	* encoded this exact query (the cross-store router does, for both stores at once); `onVector`
+	* publishes the vector this leg actually used, so the relaxed retry pass can reuse it instead of
+	* re-encoding (performance review §7.7 / P8).
 	*/
-	async semanticPath(query, k, opts, queryVector) {
+	async semanticPath(query, k, opts, queryVector, onVector) {
 		const vec = queryVector ?? await this.semantic.encode(query);
 		if (vec.length !== this.vstore.dim) throw new RetrievalInputError(`queryVector 维度不符：${vec.length} != ${this.vstore.dim}`);
+		onVector?.(vec);
 		const topk = this.vstore.topk(vec, Math.max(50, k));
 		if (!topk.length) return /* @__PURE__ */ new Map();
 		if (!opts?.domain && !opts?.source) return new Map(topk.map((t) => [t.id, t.score]));
@@ -12355,6 +13365,8 @@ function normalizeMergedScores(pool) {
 function crossQuery(memory, kb, opts) {
 	const limit = opts?.limit ?? 10;
 	const weights = memory.weights ?? DEGRADED_WEIGHTS;
+	const floors = memory.floors;
+	const droppedByFloor = mergeFloorDrops(memory.dropped_by_floor, opts?.kbDroppedByFloor);
 	let pool = [...memory.hits, ...kb];
 	if (opts?.kind === "fact") pool = pool.filter((h) => h.kind === "fact");
 	if (opts?.kind === "doc_chunk") pool = pool.filter((h) => h.kind === "doc_chunk");
@@ -12363,7 +13375,9 @@ function crossQuery(memory, kb, opts) {
 	if (pool.length === 0) return {
 		hits: [],
 		degraded: memory.degraded,
-		weights
+		weights,
+		floors,
+		dropped_by_floor: droppedByFloor
 	};
 	const scaled = normalizeMergedScores(pool);
 	scaled.sort((a, b) => b.score - a.score);
@@ -12371,19 +13385,25 @@ function crossQuery(memory, kb, opts) {
 	if (opts?.maxTokens === void 0) return {
 		hits,
 		degraded: memory.degraded,
-		weights
+		weights,
+		floors,
+		dropped_by_floor: droppedByFloor
 	};
 	if (!Number.isFinite(opts.maxTokens) || opts.maxTokens <= 0) return {
 		hits,
 		degraded: memory.degraded,
-		weights
+		weights,
+		floors,
+		dropped_by_floor: droppedByFloor
 	};
 	const budgeted = fitToTokenBudget(hits, { maxTokens: opts.maxTokens });
 	if (budgeted.truncated > 0) recordTruncation("output");
 	return {
 		hits: budgeted.kept,
 		degraded: memory.degraded,
-		weights
+		weights,
+		floors,
+		dropped_by_floor: droppedByFloor
 	};
 }
 //#endregion
@@ -12406,7 +13426,7 @@ function buildRuntime(opts) {
 		autoInstall: config.common.tools.auto_install,
 		logger
 	});
-	logger.info(`runtime init: dataHome=${config.home} memory.db=${memDb} knowledge.db=${config.knowledge.db.path} semantic=${config.common.semantic.backend}/${config.common.semantic.local_model} rerank=${config.common.rerank.backend} vectorStore=${config.common.vectorStore.backend}`);
+	logger.info(`runtime init: dataHome=${config.home} memory.db=${memDb} knowledge.db=${config.knowledge.db.path} semantic=${config.common.semantic.backend}/${config.common.semantic.local_model} rerank=${config.common.rerank.backend} vectorStore=${config.common.vectorStore.backend} sqlite=${describeSqlite()}`);
 	const memoryStore = openMemoryStore(memDb);
 	if (wasUpgraded(memoryStore.migration)) logger.info(`memory: ${describeMigrationOutcome(MEMORY_SCHEMA, memoryStore.migration)}`);
 	const db = memoryStore.db;
@@ -12418,6 +13438,12 @@ function buildRuntime(opts) {
 	const memory = new MemoryStore(db, config.common, semantic, vstore, reranker, memDb);
 	const knowledge = new KnowledgeStore(config.knowledge.db.path, config.common, config.knowledge, semantic, kbVstore, reranker, knowledgeConfigPath(config.home), logger);
 	logger.info(`runtime ready in ${Date.now() - started}ms (embeddings warm asynchronously)`);
+	/**
+	* Set by {@link AvantfRuntime.shutdown}. Exposed because a background job that the plugin starts
+	* behind a startup gate (the entity sweep) can otherwise fire after the databases are closed and
+	* log a spurious failure.
+	*/
+	let closed = false;
 	const api = {
 		config,
 		db,
@@ -12442,7 +13468,8 @@ function buildRuntime(opts) {
 					query: req.query,
 					category: req.category,
 					limit: req.limit,
-					maxTokens: req.max_tokens
+					maxTokens: req.max_tokens,
+					floors: req.floors
 				});
 				case "ask": {
 					if (req.query) return this.memory.ask(req.query, req.limit ?? 10);
@@ -12534,28 +13561,62 @@ function buildRuntime(opts) {
 			const startedAt = Date.now();
 			const limit = req.limit ?? 10;
 			const queryVector = semantic.isAvailable() ? await semantic.encode(req.query) : void 0;
-			const [memory, kb] = await Promise.all([this.memory.search({
-				query: req.query,
-				limit: limit * 3,
-				track: false,
-				recordStats: false,
-				queryVector,
-				maxTokens: 0
-			}), this.knowledge.search(req.query, {
-				domain: req.domain,
-				source: req.source,
-				limit: limit * 3,
-				recordStats: false,
-				queryVector,
-				maxTokens: 0
-			})]);
-			const result = crossQuery(memory, kb, {
-				limit,
-				kind: req.kind ?? "all",
-				domain: req.domain,
-				source: req.source,
-				maxTokens: req.max_tokens ?? config.common.retriever.max_output_tokens
-			});
+			/**
+			* ONE cross-store pass under ONE floor policy.
+			*
+			* The profile is pinned on both store calls (`'strict'` / `'loose'`) so neither store runs its
+			* own relaxed fallback: only the MERGED result may decide whether relaxing is warranted,
+			* otherwise a store that happens to be empty would inject its relaxed tail into an answer the
+			* other store filled strictly.
+			*
+			* `relaxLegs` is the same "only the legs that actually dropped" rule the single-store retry
+			* applies (`store/floors.ts`'s `droppedLegs`), read off the MERGED strict pass — relaxing a leg
+			* that dropped nothing admits no candidate, so this only keeps the reported `floors` honest.
+			*/
+			const crossPass = async (profile, relaxLegs) => {
+				let kbDroppedByFloor;
+				const [memory, kb] = await Promise.all([this.memory.search({
+					query: req.query,
+					limit: limit * 3,
+					track: false,
+					recordStats: false,
+					queryVector,
+					maxTokens: 0,
+					floors: profile,
+					...relaxLegs === void 0 ? {} : { relaxLegs }
+				}), this.knowledge.search(req.query, {
+					domain: req.domain,
+					source: req.source,
+					limit: limit * 3,
+					recordStats: false,
+					queryVector,
+					maxTokens: 0,
+					floors: profile,
+					...relaxLegs === void 0 ? {} : { relaxLegs },
+					onResult: (r) => {
+						kbDroppedByFloor = r.dropped_by_floor;
+					}
+				})]);
+				return crossQuery(memory, kb, {
+					limit,
+					kind: req.kind ?? "all",
+					domain: req.domain,
+					source: req.source,
+					maxTokens: req.max_tokens ?? config.common.retriever.max_output_tokens,
+					...kbDroppedByFloor === void 0 ? {} : { kbDroppedByFloor }
+				});
+			};
+			let result = await crossPass(req.floors === "loose" ? "loose" : "strict");
+			if (req.floors === void 0 && result.hits.length === 0) {
+				const dropped = result.dropped_by_floor ?? emptyFloorDrops();
+				if (totalFloorDrops(dropped) > 0) {
+					const loosened = await crossPass("loose", droppedLegs(dropped));
+					if (loosened.hits.length > 0) result = {
+						...loosened,
+						relaxed: true
+					};
+				}
+			}
 			const rerank = this.memory.rerankState();
 			recordRetrieval({
 				kind: "cross",
@@ -12563,12 +13624,15 @@ function buildRuntime(opts) {
 				latencyMs: Date.now() - startedAt,
 				semanticLive: semantic.isAvailable(),
 				rerankUsed: rerank.used,
-				rerankFallback: rerank.fallback
+				rerankFallback: rerank.fallback,
+				...result.dropped_by_floor === void 0 ? {} : { droppedByFloor: result.dropped_by_floor }
 			});
 			this.memory.reinforce(result.hits.filter((h) => h.kind === "fact").map((h) => h.ref_id));
 			return result;
 		},
 		shutdown() {
+			if (closed) return;
+			closed = true;
 			memory.flushHealth();
 			vstore.flush?.();
 			kbVstore.flush?.();
@@ -12578,6 +13642,9 @@ function buildRuntime(opts) {
 	};
 	return {
 		...api,
+		get closed() {
+			return closed;
+		},
 		remember: api.remember,
 		recall: api.recall,
 		admin: api.admin,
@@ -12682,7 +13749,8 @@ const descriptors = [
 		second_pred: optionalText.optional(),
 		category: optionalText.optional(),
 		limit: count.optional(),
-		max_tokens: count.optional()
+		max_tokens: count.optional(),
+		floors: optionalText.optional()
 	})),
 	direct("admin", z.object({
 		action: optionalText.optional(),
@@ -12718,7 +13786,8 @@ const descriptors = [
 		domain: optionalText.optional(),
 		source: optionalText.optional(),
 		limit: count.optional(),
-		max_tokens: count.optional()
+		max_tokens: count.optional(),
+		floors: optionalText.optional()
 	})),
 	direct("classifySource", z.object({ text: optionalText.optional() })),
 	direct("browseDir", z.object({ path: optionalText.optional() })),
@@ -12729,6 +13798,33 @@ const descriptors = [
 		target: optionalText.optional()
 	}))
 ];
+/**
+* The successful application envelope, with the wire revision stamped on.
+*
+* A helper rather than a literal at each return site (the shared `call` covers the five tool-backed
+* methods; the five UI-only methods return directly): "every answer carries the marker" is then a
+* property of the code, not of six copies staying in step. The result is structurally the contract's
+* `RemoteOk`.
+*/
+function wireOk(value) {
+	return {
+		ok: true,
+		value,
+		wire: 1
+	};
+}
+/**
+* The failed application envelope, with the wire revision stamped on.
+*
+* Takes the failure body already built (`{ok:false, error}` / validation's `{ok:false,error,violations}`)
+* so the message and violations keep coming from their existing single sources.
+*/
+function wireErr(failure) {
+	return {
+		...failure,
+		wire: 1
+	};
+}
 /** The zod schema a strict codec carries, whichever generation's codec type is in play. */
 function codecSchema(codec) {
 	return codec.schema;
@@ -12792,13 +13888,13 @@ const hostContribution = {
 * caller value → ④ `$AVANTF_HOME` → ② this configured value → `~/.avantf`. Handing it straight to the
 * engine's explicit slot instead — which is what this plugin used to do — promotes ② above ④, and the
 * same profile then resolves to two different directories depending on which half of the family reads
-* it: the work plugin resolves the same knob through its configured layer, so with `$AVANTF_HOME` set
-* work read `<env>/prompts` while this plugin read `<config>/prompts`. That directory is SHARED (both
+* it: the mission plugin resolves the same knob through its configured layer, so with `$AVANTF_HOME` set
+* mission read `<env>/prompts` while this plugin read `<config>/prompts`. That directory is SHARED (both
 * plugins' editable prompt files live in it), so "the file you edited is read by one plugin and not
 * the other" is a real failure, not a nuance. `AGENTS.md` 「边界与路径」 states the rule this
 * implements: the configured value travels in the config layer, never in the explicit one.
 *
-* The engine's own copy of the rule does the work (it is the one the CLI and MCP resolve with, and
+* The engine's own copy of the rule does the mission (it is the one the CLI and MCP resolve with, and
 * `test/family_pin.spec.ts` pins it against the base kit's). This module exists so the plugin's USE of
 * it is testable without the DSH harness: the entry module imports `@deepseek-ai/*` at load, which
 * resolves only inside a harness workspace.
@@ -12973,7 +14069,7 @@ function registerCompatMegaphone(ctx, verdict, log, compat) {
 			heading: "记忆插件未加载：与当前 dsh 的兼容性检查未通过，插件已拒绝加载（不注册服务、工具、prompt 段与真实 typert face）。",
 			warningsLabel: "风险提示：",
 			warnings: verdict.warnings,
-			fix: "修复：在本仓库重建（`pnpm build:dsh`），或把 `@deepseek-ai/dsh` 换回本构建声明的版本。",
+			fix: "修复：换到本插件声明兼容的 dsh 版本，或升级本插件到与当前 dsh 匹配的版本。",
 			logPointer: (prefix) => `完整诊断见宿主日志里 ${prefix} 开头的行。`
 		})
 	});
@@ -12995,6 +14091,94 @@ function verifyRegisteredFaces(input) {
 		toolNames: input.toolNames
 	});
 }
+//#endregion
+//#region lib/types/reconcile.js
+/**
+* Corpus reconciliation: the throttled "did anything under `knowledge.docs.dir` change?" sweep behind
+* `tools/result`.
+*
+* WHY IT IS ITS OWN MODULE. The plugin reaches the corpus through tool calls, so a finished tool call
+* is the moment to ask the question — and the answer is cheap (`corpusDrift()` is one `stat` per
+* document, reading nothing), which is what makes it affordable after EVERY tool result. Two things
+* about it are easy to get wrong and are pinned by `test/reconcile.spec.ts` instead of by a mounted
+* plugin: the THROTTLE (with a trailing run — skipping alone would drop the LAST edit, the one that
+* matters) and the STOP rule (an in-flight pass must not keep writing after the plugin unmounted and
+* its databases closed). `index.ts` is the assembly hub; this is the rule.
+*
+* @module @avantf/dsh-mem/reconcile
+*/
+/**
+* Build the reconciler. All state is closed over here, so a fresh mount gets a fresh one — the
+* plugin can be unmounted and mounted again in one process.
+*/
+function createCorpusReconciler(deps) {
+	const now = deps.now ?? Date.now;
+	const schedule = deps.schedule ?? ((fn, ms) => setTimeout(fn, ms));
+	const cancel = deps.cancel ?? ((handle) => {
+		clearTimeout(handle);
+	});
+	let stopped = false;
+	let running = false;
+	let lastDriftAt = 0;
+	let trailing = null;
+	const request = async (full) => {
+		if (stopped) return;
+		if (running) return;
+		if (!full) {
+			const wait = deps.minIntervalMs - (now() - lastDriftAt);
+			if (wait > 0) {
+				if (trailing === null) {
+					trailing = schedule(() => {
+						trailing = null;
+						request(false);
+					}, wait);
+					const unref = trailing.unref;
+					if (typeof unref === "function") unref.call(trailing);
+				}
+				return;
+			}
+			lastDriftAt = now();
+		}
+		running = true;
+		try {
+			if (full) {
+				await deps.corpus.sync({});
+				if (stopped) return;
+				await deps.corpus.corpusDrift();
+				return;
+			}
+			const drift = await deps.corpus.corpusDrift();
+			if (stopped) return;
+			if (drift.changed.length === 0 && drift.missing.length === 0 && !drift.fileSetChanged) return;
+			if (drift.fileSetChanged || drift.missing.length > 0) {
+				await deps.corpus.sync({});
+				if (stopped) return;
+				return;
+			}
+			for (const docId of drift.changed) {
+				await deps.corpus.sync({ docId });
+				if (stopped) return;
+			}
+		} catch (error) {
+			deps.onError(error);
+		} finally {
+			running = false;
+		}
+	};
+	return {
+		request,
+		stop() {
+			stopped = true;
+			if (trailing !== null) {
+				cancel(trailing);
+				trailing = null;
+			}
+		},
+		get running() {
+			return running;
+		}
+	};
+}
 const PACKAGE = "@avantf/dsh-plugin-base";
 function parseVersion(input) {
 	const match = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(input.trim());
@@ -13443,6 +14627,12 @@ const PLUGIN = "mem";
 const PANDOC_ITEM = "mem:pandoc";
 const MODEL_ITEM = "mem:model";
 /**
+* The default ONNX embedding repository — the one `semantic.local_model` defaults to and the one
+* {@link MODEL_FILES} describes. A DIFFERENT repo is a different file set, which is why the item
+* omits `spec.files` for it (see {@link managedModelSpec}).
+*/
+const DEFAULT_MODEL_REPO = "Xenova/bge-small-zh-v1.5";
+/**
 * The files the local embedding runtime actually requests for the DEFAULT ONNX model.
 *
 * Measured, not guessed: with an empty cache, `@huggingface/transformers@4.x` resolving
@@ -13460,6 +14650,22 @@ const MODEL_FILES = [
 ];
 /** Startup budget for the blocking set; the framework's default is the same. */
 const DEADLINE_MS = 15e3;
+/**
+* The `mem:model` item's per-request download budget, declared explicitly on the item.
+*
+* It is the base's own default (`net.ts`'s `DEFAULT_REQUEST_TIMEOUT_MS`) made VISIBLE: an item that
+* declares no `timeoutMs` silently inherits it, which is exactly the state the review flagged (the
+* mechanism existed, no item used it, and a multi-gigabyte model on a slow link had no documented
+* budget). `0` would mean "no timeout"; that is not this plugin's call to make by default.
+*
+* WHY THE DEADLINE BELOW IS RAISED TO MATCH IT. The base checks every declaration for an INVERSION
+* (`timeoutMs > deadlineMs`): a per-request budget larger than the ensure deadline means a request
+* could outlive the budget that is supposed to bound it. Both mem items are `startup: 'background'`,
+* so they spend no part of the startup budget and the larger deadline costs no wall clock — but the
+* declaration has to be consistent, and a caller that sets its own (smaller) deadline must enlarge it
+* rather than ship the inversion.
+*/
+const MODEL_REQUEST_TIMEOUT_MS = 3e5;
 /** This module's warning token, so one grep finds every environment-initialisation line. */
 const OWN_PREFIX = "envinit:";
 /**
@@ -13484,7 +14690,7 @@ function managedModelSpec(semantic, modelsRoot) {
 	if (!sameDir(semantic.cache_dir, modelsRoot)) return void 0;
 	return {
 		repo: semantic.local_model,
-		files: semantic.local_model === "Xenova/bge-small-zh-v1.5" ? MODEL_FILES : [],
+		files: semantic.local_model === DEFAULT_MODEL_REPO ? MODEL_FILES : [],
 		endpoint: semantic.mirror
 	};
 }
@@ -13499,10 +14705,18 @@ function sameDir(a, b) {
 * and that is deliberate: setting it redirects a whole tree (data AND managed resources), which is
 * exactly what a test or a sandboxed host needs. Unset — the normal case — the family root is the
 * framework's documented default and the data home stays `~/.avantf`.
+*
+* The value is TRIMMED and `~`-EXPANDED, exactly like the family kit's `familyHome()` and the
+* engine's own `expandHome`. Returning the raw string was a silent divergence from the other three
+* copies of this rule: `AVANTF_HOME=~/x` reached the base's layout verbatim, so the provisioner
+* wrote pandoc/models into the RELATIVE path `<cwd>/~/x/…` (a directory literally named `~`) while
+* the engine expanded the same string and read `/home/<user>/x/…` — model re-downloaded, semantic
+* leg degraded, pandoc not found. The kit is loaded dynamically (never a static import, see the
+* module header), so the local `expandHome` from the contract is the one used here.
 */
 function resolveHome() {
-	const configured = process.env["AVANTF_HOME"];
-	return configured !== void 0 && configured.trim() !== "" ? configured : join(homedir(), ".avantf", "env");
+	const configured = process.env["AVANTF_HOME"]?.trim() ?? "";
+	return configured !== "" ? expandHome$1(configured) : join(homedir(), ".avantf", "env");
 }
 /**
 * The download gate. Off when EITHER switch is off:
@@ -13585,6 +14799,9 @@ function pandocItem(framework) {
 *
 * A missing model is a degraded semantic path, NOT a refused mount: both `onMissing` axes are
 * `degrade`, and the engine falls back to FTS+entity.
+*
+* `policy.timeoutMs` is the per-request budget (see {@link MODEL_REQUEST_TIMEOUT_MS}); it rides into
+* the provider through the base's `policyFor` and is what `signalFor` reads.
 */
 function modelItem(framework, model) {
 	return {
@@ -13603,7 +14820,8 @@ function modelItem(framework, model) {
 			atUse: "degrade"
 		},
 		startup: "background",
-		schemaVersion: framework.ITEM_SCHEMA_VERSION
+		schemaVersion: framework.ITEM_SCHEMA_VERSION,
+		policy: { timeoutMs: MODEL_REQUEST_TIMEOUT_MS }
 	};
 }
 let loaded;
@@ -13692,13 +14910,14 @@ async function loadOnce(options) {
 			if (plan.pandoc) items.push(pandocItem(framework));
 			if (plan.model !== void 0) items.push(modelItem(framework, plan.model));
 			if (items.length === 0) return;
+			const maxItemTimeoutMs = items.reduce((max, item) => Math.max(max, item.policy?.timeoutMs ?? 0), 0);
 			const resources = framework.createProvisioner({
 				home,
 				envinitRange: range,
 				logger: provisionLogger(options.log),
 				policy: {
 					autoDownload: autoDownload ? { [framework.MODEL_CACHE_KIND]: plan.modelAutoDownload } : false,
-					deadlineMs,
+					deadlineMs: Math.max(deadlineMs, maxItemTimeoutMs),
 					mirrors: { archive: [...plan.archiveMirrors] }
 				}
 			});
@@ -13752,6 +14971,15 @@ async function loadOnce(options) {
 * that outlives the host (or a browser window that closes immediately) is normal. The returned
 * `opener` is what the UI shows, so a wrong editor is diagnosable without reading the host log.
 *
+* WINDOWS. `code` is `code.cmd` there, and Node refuses to spawn a `.cmd`/`.bat` without a shell
+* (CVE-2024-27980). That refusal is a synchronous `EINVAL`; the old `catch {}` swallowed it, so the
+* documented "prefer VS Code" step silently demoted every launch to the `cmd /c start` fallback and
+* the user was never told. Two things changed: the command is resolved to the file that actually
+* exists (`code` → `code.cmd`) and a batch shim goes through `shell: true`; and the catch now
+* SEPARATES "the editor is not installed here" (normal fallback — silent) from "the launch was
+* refused" (a defect — warned through the injectable `warn`, default stderr). A refused launch is
+* also carried in the thrown message, which the `openDoc` Remote returns to the UI.
+*
 * @module open
 */
 /**
@@ -13761,31 +14989,103 @@ async function loadOnce(options) {
 * bare name silently loses the editor and falls back to the OS default application. `PATHEXT` is
 * what the shell itself uses; the default list is the fallback when it is not exported.
 */
-function commandFileNames(command, platform = process.platform) {
+function commandFileNames(command, platform = process.platform, pathext = process.env["PATHEXT"]) {
 	if (platform !== "win32") return [command];
-	const exts = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((ext) => ext !== "");
+	const exts = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((ext) => ext !== "");
 	return [
 		command,
 		...exts.map((ext) => `${command}${ext.toLowerCase()}`),
 		...exts.map((ext) => `${command}${ext}`)
 	];
 }
-/** True when `command` is an executable on PATH (any of its platform file names). */
-function onPath(command) {
-	const path = process.env["PATH"];
-	if (path === void 0 || path === "") return false;
+/**
+* The file name of `command` that actually exists on `env.PATH`, or `undefined`.
+*
+* Returning the NAME (not a boolean) is what lets the launcher see `code.cmd` and know it holds a
+* batch shim. `[win]` — the win32 form is asserted from Linux with an injected platform/env.
+*/
+function resolveOnPath(command, platform = process.platform, env = process.env) {
+	const path = env["PATH"];
+	if (path === void 0 || path === "") return void 0;
 	for (const dir of path.split(delimiter)) {
 		if (dir === "") continue;
-		for (const name of commandFileNames(command)) try {
+		for (const name of commandFileNames(command, platform, env["PATHEXT"])) try {
 			accessSync(join(dir, name), constants.X_OK);
-			return true;
+			return name;
 		} catch {}
 	}
-	return false;
+}
+/** True for a Windows batch shim — the one shape Node will not spawn without a shell. */
+function isWindowsBatchShim(command, platform = process.platform) {
+	return platform === "win32" && /\.(cmd|bat)$/iu.test(command);
+}
+/**
+* Classify a synchronous spawn failure.
+*
+* `ENOENT` means the command is not there after all — the documented priority order just moves on,
+* with no warning. Everything else (the `EINVAL` a `.cmd` gets without a shell, `EACCES`, a bad
+* argument) is a wiring defect, and swallowing it is exactly how "open in VS Code" disappeared.
+*/
+function classifyLaunchFailure(error) {
+	return error?.code === "ENOENT" ? "missing" : "refused";
+}
+/**
+* `cmd.exe` builds the line for `shell: true`, so anything that would split it has to be quoted.
+*
+* Wrapping alone is not enough: an embedded `"` would END the quoted run early and hand the rest of
+* the value to cmd as syntax (a `$EDITOR` like `C:\Program "Files"\ed.exe`, or a document under a
+* folder whose name holds a quote, breaks the launch). cmd's convention for a literal quote inside a
+* quoted argument is to DOUBLE it, so `a"b` becomes `"a""b"` — the same shape
+* `mission/scripts/build.mjs` `quoteForCmd` produces for its own `shell: true` line.
+* A value with nothing to quote is returned verbatim.
+*/
+function cmdQuote(value) {
+	return /[\s"&|<>^()]/u.test(value) ? `"${value.replace(/"/gu, "\"\"")}"` : value;
+}
+/**
+* The concrete spawn shape for one candidate on `platform`.
+*
+* TWO Windows-only rules, both from the same root cause (CVE-2024-27980): a `.cmd`/`.bat` shim is
+* spawned through `shell: true`; and the last-resort fallback is `cmd /c start`, whose quoted path
+* must follow its own title argument or cmd treats the path AS the title. The plan is pure and
+* takes the platform, so the win32 shapes are asserted on Linux (`[win]`, real-machine re-check
+* still owed).
+*/
+function launchPlan(command, arg, platform = process.platform) {
+	if (isWindowsBatchShim(command, platform)) return {
+		command: cmdQuote(command),
+		args: [cmdQuote(arg)],
+		options: {
+			detached: true,
+			stdio: "ignore",
+			shell: true
+		}
+	};
+	if (command === "cmd") return {
+		command: "cmd",
+		args: [
+			"/c",
+			"start",
+			"",
+			`"${arg}"`
+		],
+		options: {
+			detached: true,
+			stdio: "ignore"
+		}
+	};
+	return {
+		command,
+		args: [arg],
+		options: {
+			detached: true,
+			stdio: "ignore"
+		}
+	};
 }
 /** Is this a WSL process (where a Windows-side opener is often the only one that works)? */
-function isWsl() {
-	return process.platform === "linux" && (process.env["WSL_DISTRO_NAME"] !== void 0 || process.env["WSL_INTEROP"] !== void 0);
+function isWsl(platform, env) {
+	return platform === "linux" && (env["WSL_DISTRO_NAME"] !== void 0 || env["WSL_INTEROP"] !== void 0);
 }
 /** The Windows form of a WSL path, or `undefined` when `wslpath` cannot answer. */
 function windowsPath(path) {
@@ -13797,79 +15097,104 @@ function windowsPath(path) {
 		return;
 	}
 }
-/** Candidates in the order above, resolved against this machine. */
-function candidates(configured) {
+/** Candidates in the order above, resolved against the given machine. */
+function candidates(configured, platform, env) {
 	const list = [];
-	const explicit = configured !== "" ? configured : process.env["AVANTF_EDITOR"] ?? "";
+	const explicit = configured !== "" ? configured : env["AVANTF_EDITOR"] ?? "";
 	if (explicit !== "") list.push({
 		command: explicit,
 		arg: (path) => path
 	});
-	const shellEditor = process.env["VISUAL"] ?? process.env["EDITOR"] ?? "";
+	const shellEditor = env["VISUAL"] ?? env["EDITOR"] ?? "";
 	if (shellEditor !== "") list.push({
 		command: shellEditor,
 		arg: (path) => path
 	});
-	for (const editor of ["code", "cursor"]) if (onPath(editor)) list.push({
+	for (const editor of ["code", "cursor"]) if (resolveOnPath(editor, platform, env) !== void 0) list.push({
 		command: editor,
 		arg: (path) => path
 	});
-	if (process.platform === "darwin") list.push({
+	if (platform === "darwin") list.push({
 		command: "open",
 		arg: (path) => path
 	});
-	if (process.platform === "linux") {
-		if (onPath("xdg-open")) list.push({
+	if (platform === "linux") {
+		if (resolveOnPath("xdg-open", platform, env) !== void 0) list.push({
 			command: "xdg-open",
 			arg: (path) => path
 		});
-		if (isWsl()) list.push({
+		if (isWsl(platform, env)) list.push({
 			command: "explorer.exe",
 			arg: (path) => windowsPath(path)
 		});
 	}
-	if (process.platform === "win32") list.push({
+	if (platform === "win32") list.push({
 		command: "cmd",
+		raw: true,
 		arg: (path) => path
 	});
 	return list;
 }
 /**
+* The file that will actually be spawned for `command`: a bare name is resolved on PATH (so
+* `code` becomes `code.cmd` on Windows), an explicit path is kept when it exists — and `undefined`
+* means the editor is simply not installed here.
+*/
+function resolveCommand(command, platform, env) {
+	if (command.includes("/") || command.includes("\\")) return existsSync(command) ? command : void 0;
+	return resolveOnPath(command, platform, env);
+}
+/**
 * Launch the configured/detected tool on one document path.
 *
 * @param documentPath - the managed `.md` path.
 * @param target - `file` opens the document, `dir` opens the directory that holds it.
 * @param configured - `knowledge.open.editor` from config (empty ⇒ auto-detect).
+* @param deps - platform / env / spawn / warning sink, for tests.
 * @throws when no candidate is available or every one of them fails to start.
 */
-function openDocumentPath(documentPath, target, configured) {
+function openDocumentPath(documentPath, target, configured, deps = {}) {
+	const platform = deps.platform ?? process.platform;
+	const env = deps.env ?? process.env;
+	const launch = deps.spawn ?? ((command, args, options) => spawn(command, args, options));
+	const warn = deps.warn ?? ((message) => {
+		console.warn(message);
+	});
 	const wanted = target === "dir" ? dirname(documentPath) : documentPath;
 	const tried = [];
-	for (const candidate of candidates(configured)) {
+	const missing = [];
+	const refused = [];
+	for (const candidate of candidates(configured, platform, env)) {
 		const arg = candidate.arg(wanted);
 		if (arg === void 0) continue;
-		tried.push(candidate.command);
+		const command = candidate.raw === true ? candidate.command : resolveCommand(candidate.command, platform, env);
+		if (command === void 0) {
+			missing.push(candidate.command);
+			continue;
+		}
+		tried.push(command);
+		const plan = launchPlan(command, arg, platform);
 		try {
-			(candidate.command === "cmd" ? spawn("cmd", [
-				"/c",
-				"start",
-				"",
-				`"${arg}"`
-			], {
-				detached: true,
-				stdio: "ignore"
-			}) : spawn(candidate.command, [arg], {
-				detached: true,
-				stdio: "ignore"
-			})).unref();
+			launch(plan.command, plan.args, plan.options).unref();
 			return {
 				path: wanted,
 				target,
-				opener: candidate.command
+				opener: command
 			};
-		} catch {}
+		} catch (error) {
+			if (classifyLaunchFailure(error) === "missing") {
+				tried.pop();
+				missing.push(command);
+				continue;
+			}
+			const reason = error instanceof Error ? error.message : String(error);
+			refused.push(`${command}（${reason}）`);
+			warn(`[avantf-mem] 无法用 ${command} 打开「${wanted}」：${reason}；改用下一个候选`);
+		}
 	}
-	throw new Error(tried.length === 0 ? "没有可用的编辑器：设置 knowledge.open.editor（或 $EDITOR / $AVANTF_EDITOR），或安装 code / xdg-open" : `无法启动编辑器（试过：${tried.join("、")}）`);
+	if (tried.length === 0) throw new Error(missing.length === 0 ? "没有可用的编辑器：设置 knowledge.open.editor（或 $EDITOR / $AVANTF_EDITOR），或安装 code / xdg-open" : `没有可用的编辑器：${missing.join("、")} 不存在（PATH 上没有该命令，或该路径不可用）`);
+	const detail = refused.length === 0 ? "" : `；启动被拒绝：${refused.join("、")}`;
+	throw new Error(`无法启动编辑器（试过：${tried.join("、")}${detail}）`);
 }
 //#endregion
 //#region lib/types/tool_schema.js
@@ -14008,6 +15333,19 @@ function flattenToolSpec(spec) {
 	return properties;
 }
 //#endregion
+//#region lib/types/render.js
+/** The tool output spec registered on every mem tool. */
+const OUTPUT = {
+	schema: {
+		type: "object",
+		additionalProperties: true
+	},
+	render: (_args, value) => [{
+		type: "text",
+		text: JSON.stringify(toWellFormedDeep(value), null, 2)
+	}]
+};
+//#endregion
 //#region lib/types/inject.js
 /**
 * The services this plugin injects.
@@ -14092,16 +15430,6 @@ async function runToolSpec(spec, rt, args) {
 		return toolErr(error);
 	}
 }
-const OUTPUT = {
-	schema: {
-		type: "object",
-		additionalProperties: true
-	},
-	render: (_args, value) => [{
-		type: "text",
-		text: JSON.stringify(value, null, 2)
-	}]
-};
 function present(spec, args) {
 	return {
 		card: "generic",
@@ -14119,6 +15447,11 @@ function defined(args) {
 * re-validated with the contract zod union before dispatch (same guarantee the
 * tools give the model), and results are wrapped in the contract's
 * `{ok:true,value}` / `{ok:false,error,violations}` RemoteEnvelope the client decodes.
+*
+* Every envelope — success and failure, tool-backed and UI-only — is built through `wireOk`/`wireErr`
+* so it carries this build's `WIRE_VERSION`. That is what lets a freshly reloaded browser half tell
+* whether the host process predates a method it is about to call, instead of reading the gateway's
+* 404 as "the record is gone" (see `remote.ts`).
 */
 let AvantfMemGateway = (() => {
 	let _classSuper = TypertRemoteService;
@@ -14280,17 +15613,14 @@ let AvantfMemGateway = (() => {
 		*/
 		async call(key, spec, payload) {
 			const parsed = spec.input.safeParse(payload);
-			if (!parsed.success) return validationError(spec.name, parsed.error.issues);
+			if (!parsed.success) return wireErr(validationError(spec.name, parsed.error.issues));
 			try {
-				return {
-					ok: true,
-					value: await dispatchToolKey(this.rt, key, parsed.data) ?? null
-				};
+				return wireOk(await dispatchToolKey(this.rt, key, parsed.data) ?? null);
 			} catch (error) {
-				return {
+				return wireErr({
 					ok: false,
 					error: remoteErrorText(error)
-				};
+				});
 			}
 		}
 		/**
@@ -14339,30 +15669,24 @@ let AvantfMemGateway = (() => {
 		async classifySource(args) {
 			try {
 				const payload = defined(args);
-				return {
-					ok: true,
-					value: classifySource(typeof payload.text === "string" ? payload.text : "", this.rt.config.knowledge.ingest)
-				};
+				return wireOk(classifySource(typeof payload.text === "string" ? payload.text : "", this.rt.config.knowledge.ingest));
 			} catch (error) {
-				return {
+				return wireErr({
 					ok: false,
 					error: remoteErrorText(error)
-				};
+				});
 			}
 		}
 		/** UI-only: one directory listing for the 选择 picker (same boundary as ingestion). */
 		async browseDir(args) {
 			try {
 				const payload = defined(args);
-				return {
-					ok: true,
-					value: browseDirectory(typeof payload.path === "string" && payload.path !== "" ? payload.path : void 0, this.rt.config.knowledge.ingest)
-				};
+				return wireOk(browseDirectory(typeof payload.path === "string" && payload.path !== "" ? payload.path : void 0, this.rt.config.knowledge.ingest));
 			} catch (error) {
-				return {
+				return wireErr({
 					ok: false,
 					error: remoteErrorText(error)
-				};
+				});
 			}
 		}
 		/**
@@ -14372,15 +15696,12 @@ let AvantfMemGateway = (() => {
 		*/
 		async kbDomains(_args) {
 			try {
-				return {
-					ok: true,
-					value: this.rt.knowledge.domainCatalog()
-				};
+				return wireOk(this.rt.knowledge.domainCatalog());
 			} catch (error) {
-				return {
+				return wireErr({
 					ok: false,
 					error: remoteErrorText(error)
-				};
+				});
 			}
 		}
 		/**
@@ -14392,15 +15713,12 @@ let AvantfMemGateway = (() => {
 			try {
 				const payload = defined(args);
 				const domain = typeof payload.domain === "string" ? payload.domain : "";
-				return {
-					ok: true,
-					value: this.rt.knowledge.addDomain(domain)
-				};
+				return wireOk(this.rt.knowledge.addDomain(domain));
 			} catch (error) {
-				return {
+				return wireErr({
 					ok: false,
 					error: remoteErrorText(error)
-				};
+				});
 			}
 		}
 		/**
@@ -14413,29 +15731,26 @@ let AvantfMemGateway = (() => {
 			try {
 				const payload = defined(args);
 				const docId = typeof payload.doc_id === "number" ? payload.doc_id : void 0;
-				if (docId === void 0) return {
+				if (docId === void 0) return wireErr({
 					ok: false,
 					error: "openDoc 需要 doc_id"
-				};
+				});
 				const path = this.rt.knowledge.docFilePath(docId);
-				if (path === null) return {
+				if (path === null) return wireErr({
 					ok: false,
 					error: `文档 #${String(docId)} 不存在`
-				};
+				});
 				const target = payload.target === "dir" ? "dir" : "file";
-				if (target === "file" && !existsSync(path)) return {
+				if (target === "file" && !existsSync(path)) return wireErr({
 					ok: false,
 					error: `受管文件不存在：${path}（重新摄入会重建它）`
-				};
-				return {
-					ok: true,
-					value: openDocumentPath(path, target, this.rt.config.knowledge.open.editor)
-				};
+				});
+				return wireOk(openDocumentPath(path, target, this.rt.config.knowledge.open.editor));
 			} catch (error) {
-				return {
+				return wireErr({
 					ok: false,
 					error: remoteErrorText(error)
-				};
+				});
 			}
 		}
 	};
@@ -14552,6 +15867,8 @@ async function apply(ctx, config) {
 		logger.warn("unmounted while preparing the environment; stopping before registering anything");
 		return;
 	}
+	const wellFormed = adoptWellFormed(env?.kit);
+	logger.info(wellFormed.text && wellFormed.deep ? "well-formed repair: the base kit's wellFormedText/wellFormedDeep (interface v2)" : "well-formed repair: the mem mirror (the base is absent, or predates the v2 helpers)");
 	const compat = env?.compat;
 	let verdict;
 	if (compat === void 0) logger.warn("plugin mount: the dsh compatibility gate is ABSENT (@avantf/dsh-plugin-base unavailable — see the WARNING above); mounting the full plugin anyway");
@@ -14559,7 +15876,7 @@ async function apply(ctx, config) {
 		const run = provision(ctx, logger, compat);
 		if (!run.verdict.load) {
 			registerCompatMegaphone(ctx, run.verdict, logger, compat);
-			logger.warn("plugin not loaded: the host dsh API is incompatible (compat check above) — nothing was registered; rebuild with `pnpm build:dsh`");
+			logger.warn("plugin not loaded: the host dsh API is incompatible (compat check above) — nothing was registered; switch to a dsh version this package declares compatible, or upgrade this plugin");
 			return;
 		}
 		verdict = run.verdict;
@@ -14612,7 +15929,14 @@ async function apply(ctx, config) {
 			logger.warn(`entity sweep failed: ${error instanceof Error ? error.message : String(error)}`);
 		});
 	};
-	sweepEntities();
+	awaitStartupGate({
+		...waitFor === void 0 ? {} : { waitFor },
+		deferTokenizerUntilIdle: true
+	}).then(() => {
+		if (!rt.closed && stillActive(ctx)) sweepEntities();
+	}).catch((error) => {
+		logger.warn(`entity sweep gate failed: ${error instanceof Error ? error.message : String(error)}`);
+	});
 	const heartbeatMinutes = rt.config.common.trust.presence.heartbeat_minutes;
 	if (heartbeatMinutes > 0) ctx.effect(() => {
 		const timer = setInterval(() => {
@@ -14638,7 +15962,8 @@ async function apply(ctx, config) {
 		wrote: false
 	})) : new kit.PromptFiles({
 		dir: promptDir,
-		logger
+		logger,
+		namespace: "mem"
 	}).load(promptFileSpecs());
 	const promptSections = buildPromptSections(loadedPrompts);
 	for (const section of promptSections) {
@@ -14668,45 +15993,20 @@ async function apply(ctx, config) {
 		}
 	});
 	logger.info("prompt context registered: avantf:mem-hint (order 130)");
-	let reconciling = false;
-	let lastDriftAt = 0;
-	let trailingDrift = null;
-	const reconcile = async (full) => {
-		if (reconciling) return;
-		if (!full) {
-			const wait = RECONCILE_MIN_INTERVAL_MS - (Date.now() - lastDriftAt);
-			if (wait > 0) {
-				if (trailingDrift === null) trailingDrift = setTimeout(() => {
-					trailingDrift = null;
-					reconcile(false);
-				}, wait);
-				return;
-			}
-			lastDriftAt = Date.now();
-		}
-		reconciling = true;
-		try {
-			if (full) {
-				await rt.knowledge.sync({});
-				rt.knowledge.corpusDrift();
-				return;
-			}
-			const drift = rt.knowledge.corpusDrift();
-			if (drift.changed.length === 0 && drift.missing.length === 0 && !drift.fileSetChanged) return;
-			if (drift.fileSetChanged || drift.missing.length > 0) {
-				await rt.knowledge.sync({});
-				return;
-			}
-			for (const docId of drift.changed) await rt.knowledge.sync({ docId });
-		} catch (error) {
+	const reconciler = createCorpusReconciler({
+		corpus: {
+			sync: (options) => rt.knowledge.sync(options),
+			corpusDrift: () => rt.knowledge.corpusDrift()
+		},
+		minIntervalMs: RECONCILE_MIN_INTERVAL_MS,
+		onError: (error) => {
 			logger.warn(`知识库自动同步失败（不影响已有内容）：${error instanceof Error ? error.message : String(error)}`);
-		} finally {
-			reconciling = false;
 		}
-	};
-	reconcile(true);
+	});
+	ctx.effect(() => () => reconciler.stop());
+	reconciler.request(true);
 	ctx.on("tools/result", () => {
-		reconcile(false);
+		reconciler.request(false);
 	});
 	for (const spec of toolSpecs) {
 		ctx.tools.register(defineTool({
@@ -14739,4 +16039,4 @@ async function apply(ctx, config) {
 	logger.info(`plugin ready: ${toolSpecs.length} tools + avantfMemory service + avantfMem remote`);
 }
 //#endregion
-export { AvantfMemGateway, Config, KNOWLEDGE_PROMPT_SECTION, MEMORY_PROMPT_SECTION, apply, inject, name };
+export { AvantfMemGateway, Config, KNOWLEDGE_PROMPT_SECTION, MEMORY_PROMPT_SECTION, apply, inject, name, registerReranker, registerSemanticBackend, registerVectorStore };