@remnic/cli 9.41.0 → 9.43.0

package/dist/index.js

@@ -18,15 +18,15 @@ async function persistEnrichmentCandidate(storage, entityName, candidate) {
 }
 
 // src/index.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import os from "os";
-import path14 from "path";
-import { createHash as createHash2 } from "crypto";
+import path15 from "path";
+import { createHash as createHash3 } from "crypto";
 import * as childProcess2 from "child_process";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { gzipSync } from "zlib";
 import {
-  parseConfig as parseConfig4,
+  parseConfig as parseConfig5,
   isOpenaiApiKeyDisabled,
   resolveEnvVars,
   resolveRemnicConfigRecord as resolveRemnicConfigRecord4,
@@ -110,15 +110,15 @@ import {
   parseXrayCliOptions,
   renderXray,
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
-  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
-  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2,
+  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES2,
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES3,
   OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES,
-  applyOfflineSyncFileContentChunk,
+  applyOfflineSyncFileContentChunk as applyOfflineSyncFileContentChunk2,
   applyOfflineSyncSnapshot,
   buildOfflineSyncChangesetFromSnapshot,
   drainPendingLifecycleForOfflineSync,
   compileOfflineSyncExcludeGlobs,
-  buildOfflineSyncSnapshotFromBase,
+  buildOfflineSyncSnapshotFromBase as buildOfflineSyncSnapshotFromBase2,
   defaultOfflineSyncStatePath,
   normalizeOfflineSyncSnapshot,
   offlineSyncStateFromSnapshot,
@@ -238,121 +238,1115 @@ async function loadWecloneExportModule() {
   return cached;
 }
 
-// src/doctor-namespace-lint.ts
-import { isNamespacePolicyCovered } from "@remnic/core";
-function readConfiguredNamespace(remnicCfg) {
-  if (!("namespace" in remnicCfg)) return { invalid: false };
-  const value = remnicCfg.namespace;
-  if (typeof value === "string" && value.trim().length > 0) {
-    return { configuredNamespace: value.trim(), invalid: false };
+// src/converge.ts
+import * as fs3 from "fs";
+import { createHash as createHash2 } from "crypto";
+import * as path2 from "path";
+import {
+  parseConfig as parseConfig2,
+  buildOfflineSyncSnapshotFromBase,
+  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2,
+  applyOfflineSyncFileContentChunk
+} from "@remnic/core";
+import { resolveCorpusNamespaceRoots } from "@remnic/core/corpus-watermark.js";
+import { listNamespaces } from "@remnic/core/namespaces/migrate.js";
+import {
+  planReconciliation
+} from "@remnic/core/reconcile/plan.js";
+import {
+  defaultConvergeCursorPath,
+  readConvergeCursor,
+  writeConvergeCursor
+} from "@remnic/core/reconcile/cursor.js";
+
+// src/offline-storage-io.ts
+import { mkdtemp, readdir, lstat, rm } from "fs/promises";
+import fs2 from "fs";
+import path from "path";
+import { createHash, createDecipheriv } from "crypto";
+import {
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES,
+  StorageManager
+} from "@remnic/core";
+import { OFFLINE_DECRYPT_STAGING_DIR_PREFIX } from "@remnic/core/offline-sync-exclude-globs";
+import {
+  AUTH_TAG_LENGTH,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  IV_LENGTH,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  SecureStoreLockedError,
+  filePathAad,
+  isEncryptedFile,
+  keyring,
+  readHeader,
+  secureStoreDir
+} from "@remnic/core/secure-store";
+async function createConfiguredOfflineStorage(memoryDir, secureStoreEncryptOnWrite = true) {
+  const storage = new StorageManager(memoryDir);
+  const header = await readHeader(memoryDir);
+  let secureStoreKey = null;
+  let secureStoreRequired = false;
+  if (header) {
+    secureStoreRequired = true;
+    storage.setSecureStoreRequired(true);
+    const key = keyring.getKey(secureStoreDir(memoryDir));
+    if (key) {
+      await storage.setSecureStoreKeyAndWait(key, secureStoreEncryptOnWrite);
+      secureStoreKey = key;
+    }
   }
-  return { invalid: true };
+  return { storage, secureStoreKey, secureStoreRequired };
 }
-function buildNamespacePolicyCheck(args) {
-  if (args.invalid) {
-    return {
-      name: "Namespace policy",
-      ok: false,
-      detail: "config `namespace` is set but is not a non-empty string",
-      remediation: "Set `namespace` to a non-empty string (a namespacePolicies name or the default namespace), or remove it."
-    };
+async function createOfflineStorageForPath(memoryDir, filePath, configured, secureStoreEncryptOnWrite) {
+  const memoryRoot = path.resolve(memoryDir);
+  const stateDir = path.dirname(filePath);
+  if (path.basename(stateDir) !== "state" || path.basename(filePath) !== "memory-lifecycle-ledger.jsonl") {
+    throw new Error(`invalid lifecycle ledger path: ${filePath}`);
   }
-  if (!args.config || !args.configuredNamespace) return void 0;
-  const covered = isNamespacePolicyCovered(args.configuredNamespace, args.config);
+  const storageRoot = path.resolve(path.dirname(stateDir));
+  if (storageRoot !== memoryRoot && !storageRoot.startsWith(`${memoryRoot}${path.sep}`)) {
+    throw new Error(`lifecycle ledger path is outside the offline memory directory: ${filePath}`);
+  }
+  const storage = new StorageManager(storageRoot);
+  if (configured.secureStoreRequired) {
+    storage.setSecureStoreRequired(true);
+  }
+  if (configured.secureStoreKey) {
+    await storage.setSecureStoreKeyAndWait(configured.secureStoreKey, secureStoreEncryptOnWrite);
+  }
+  return storage;
+}
+async function createOfflineStorageIo(memoryDir, configuredStorage) {
+  await cleanupOrphanedOfflineDecryptStaging(memoryDir);
+  const { storage, secureStoreKey } = configuredStorage ?? await createConfiguredOfflineStorage(memoryDir);
   return {
-    name: "Namespace policy",
-    ok: covered,
-    warn: !covered,
-    detail: covered ? `configured namespace "${args.configuredNamespace}" is writable` : `configured namespace "${args.configuredNamespace}" is writable by no one \u2014 its namespacePolicies entry grants no writer, or it has no entry and is not the default namespace`,
-    remediation: covered ? void 0 : `Give "${args.configuredNamespace}" a namespacePolicies entry with a non-blank writePrincipals value, or set namespace to a writable one \u2014 otherwise every write is rejected and dead-lettered.`
+    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
+    readFileDigest: async ({ filePath }) => {
+      const hash = createHash("sha256");
+      let bytes = 0;
+      for await (const rawChunk of readOfflineSyncFileChunks({
+        filePath,
+        memoryDir,
+        secureStoreKey,
+        chunkSize: OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES
+      })) {
+        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+        hash.update(chunk);
+        bytes += chunk.length;
+      }
+      return {
+        sha256: hash.digest("hex"),
+        bytes
+      };
+    },
+    readFileChunks: ({ filePath, chunkSize }) => readOfflineSyncFileChunks({
+      filePath,
+      memoryDir,
+      secureStoreKey,
+      chunkSize
+    }),
+    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
+    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
+    writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
+    deleteFile: async ({ filePath }) => storage.deleteOfflineSyncFile(filePath)
   };
 }
-
-// src/index.ts
-import { WriteQuarantineStore as WriteQuarantineStore2 } from "@remnic/core/write-quarantine.js";
-
-// src/quarantine-cli.ts
-import { basename } from "path";
-function renderQuarantineList(records, format) {
-  if (format === "json") {
-    const summary = records.map((record) => ({
-      timestamp: record.timestamp,
-      operation: record.operation,
-      principal: record.principal,
-      attemptedNamespace: record.attemptedNamespace
-    }));
-    return JSON.stringify(summary, null, 2);
+var OFFLINE_DECRYPT_STAGING_ORPHAN_MS = 60 * 60 * 1e3;
+async function cleanupOrphanedOfflineDecryptStaging(memoryDir) {
+  let entries;
+  try {
+    entries = await readdir(memoryDir);
+  } catch {
+    return;
   }
-  if (format !== "text") {
-    throw new Error(`Unsupported quarantine format: ${String(format)}`);
+  const now = Date.now();
+  for (const name of entries) {
+    if (!name.startsWith(OFFLINE_DECRYPT_STAGING_DIR_PREFIX)) continue;
+    const dir = path.join(memoryDir, name);
+    try {
+      const info = await lstat(dir);
+      if (!info.isDirectory() || info.isSymbolicLink()) continue;
+      if (now - info.mtimeMs < OFFLINE_DECRYPT_STAGING_ORPHAN_MS) continue;
+      await rm(dir, { recursive: true, force: true });
+    } catch {
+    }
   }
-  if (records.length === 0) return "No quarantined writes.";
-  const lines = [`Quarantined writes (${records.length}):`, ""];
-  for (const record of records) {
-    lines.push(
-      `  ${record.timestamp}  ${record.operation}  principal=${record.principal ?? "-"}  attemptedNamespace=${record.attemptedNamespace}`
+}
+async function* readOfflineSyncFileChunks(options) {
+  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE);
+  if (!isEncryptedFile(header)) {
+    yield* readPlainOfflineFileChunks(options.filePath, options.chunkSize);
+    return;
+  }
+  if (!options.secureStoreKey) {
+    throw new SecureStoreLockedError(
+      `secure-store is locked \u2014 cannot read encrypted file at ${options.filePath}. Run \`remnic secure-store unlock\` to decrypt.`
     );
   }
-  return lines.join("\n");
+  yield* readEncryptedOfflineFileChunks({
+    filePath: options.filePath,
+    memoryDir: options.memoryDir,
+    key: options.secureStoreKey,
+    chunkSize: options.chunkSize
+  });
 }
-async function replayQuarantine(opts) {
-  const result = { replayed: 0, failures: [], deleteFailures: [] };
-  for (const entry of await opts.store.entries()) {
-    const { record } = entry;
-    const basePayload = record.payload;
-    const principal = opts.principal ?? record.principal ?? void 0;
-    const idempotencyKey = typeof basePayload.idempotencyKey === "string" && basePayload.idempotencyKey.length > 0 ? basePayload.idempotencyKey : `quarantine-replay:${basename(entry.path)}`;
-    const request = {
-      ...basePayload,
-      namespace: opts.targetNamespace,
-      suppressQuarantine: true,
-      idempotencyKey,
-      ...principal ? { authenticatedPrincipal: principal } : {}
-    };
-    try {
-      await opts.submit(record.operation, request);
-    } catch (err) {
-      result.failures.push({
-        operation: record.operation,
-        attemptedNamespace: opts.targetNamespace,
-        error: err instanceof Error ? err.message : String(err)
-      });
-      continue;
-    }
-    try {
-      const removed = await opts.store.removeEntry(entry.path);
-      if (removed) {
-        result.replayed += 1;
-      } else {
-        result.deleteFailures.push({
-          path: entry.path,
-          error: "entry not removed (outside quarantine root or already absent)"
-        });
-      }
-    } catch (err) {
-      result.deleteFailures.push({
-        path: entry.path,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
+async function readFilePrefix(filePath, length) {
+  const handle = await fs2.promises.open(filePath, "r");
+  try {
+    const out = Buffer.alloc(length);
+    const { bytesRead } = await handle.read(out, 0, length, 0);
+    return out.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
   }
-  return result;
 }
-function renderReplayResult(result, targetNamespace, format) {
-  if (format === "json") {
-    return JSON.stringify(
-      {
-        targetNamespace,
-        replayed: result.replayed,
-        failures: result.failures,
-        deleteFailures: result.deleteFailures
-      },
-      null,
-      2
-    );
+async function* readPlainOfflineFileChunks(filePath, chunkSize) {
+  const stream = fs2.createReadStream(filePath, { highWaterMark: chunkSize });
+  for await (const chunk of stream) {
+    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
   }
-  if (format !== "text") {
-    throw new Error(`Unsupported quarantine format: ${String(format)}`);
+}
+async function* readEncryptedOfflineFileChunks(options) {
+  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);
+  if (header.length < MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE || !isEncryptedFile(header)) {
+    throw new Error(`secure-store encrypted file is truncated: ${options.filePath}`);
+  }
+  const version = header.readUInt8(MAGIC_BYTES.length);
+  const flags = header.readUInt8(MAGIC_BYTES.length + 1);
+  if (version !== FILE_FORMAT_VERSION) {
+    throw new Error(`secure-store file has unsupported version ${version}: ${options.filePath}`);
+  }
+  if (flags !== FILE_FORMAT_FLAGS) {
+    throw new Error(`secure-store file has unsupported flags 0x${flags.toString(16)}: ${options.filePath}`);
+  }
+  const envelopeHeader = header.subarray(MAGIC_HEADER_SIZE);
+  const envelopeVersion = envelopeHeader.readUInt8(ENVELOPE_LAYOUT.version);
+  if (envelopeVersion !== ENVELOPE_VERSION) {
+    throw new Error(`secure-store envelope has unsupported version ${envelopeVersion}: ${options.filePath}`);
+  }
+  const salt = envelopeHeader.subarray(
+    ENVELOPE_LAYOUT.salt,
+    ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH
+  );
+  const iv = envelopeHeader.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);
+  const authTag = envelopeHeader.subarray(
+    ENVELOPE_LAYOUT.authTag,
+    ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH
+  );
+  const aadCandidates = offlineFileAadCandidates(options.filePath, options.memoryDir);
+  let lastError;
+  for (const aad of aadCandidates) {
+    const tempDir = await mkdtemp(path.join(options.memoryDir, OFFLINE_DECRYPT_STAGING_DIR_PREFIX));
+    const tempPath = path.join(tempDir, "content");
+    try {
+      const decipher = createDecipheriv("aes-256-gcm", options.key, iv, {
+        authTagLength: AUTH_TAG_LENGTH
+      });
+      decipher.setAuthTag(authTag);
+      decipher.setAAD(Buffer.concat([secureStoreEnvelopeHeaderAad(salt), aad]));
+      const output = fs2.createWriteStream(tempPath, { mode: 384 });
+      try {
+        const stream = fs2.createReadStream(options.filePath, {
+          start: MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE,
+          highWaterMark: options.chunkSize
+        });
+        for await (const encryptedChunk of stream) {
+          const plain = decipher.update(
+            Buffer.isBuffer(encryptedChunk) ? encryptedChunk : Buffer.from(encryptedChunk)
+          );
+          if (plain.length > 0 && !output.write(plain)) {
+            await new Promise((resolve, reject) => {
+              output.once("drain", resolve);
+              output.once("error", reject);
+            });
+          }
+        }
+        const finalPlain = decipher.final();
+        if (finalPlain.length > 0 && !output.write(finalPlain)) {
+          await new Promise((resolve, reject) => {
+            output.once("drain", resolve);
+            output.once("error", reject);
+          });
+        }
+      } finally {
+        await closeWriteStream(output);
+      }
+      yield* readPlainOfflineFileChunks(tempPath, options.chunkSize);
+      return;
+    } catch (error) {
+      lastError = error;
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(`secure-store could not decrypt file: ${options.filePath}`);
+}
+function offlineFileAadCandidates(filePath, memoryDir) {
+  const candidates = [filePathAad(filePath, memoryDir)];
+  const relative = path.relative(memoryDir, filePath);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return candidates;
+  const parts = relative.split(path.sep);
+  if (parts[0] === "namespaces" && parts.length >= 3 && parts[1]) {
+    candidates.push(filePathAad(filePath, path.join(memoryDir, "namespaces", parts[1])));
+  }
+  const memoryParts = path.resolve(memoryDir).split(path.sep);
+  if (memoryParts.length >= 3 && memoryParts.at(-2) === "namespaces" && memoryParts.at(-1)) {
+    const topLevelRoot = memoryParts.slice(0, -2).join(path.sep) || path.sep;
+    const topRelative = path.relative(topLevelRoot, filePath);
+    if (topRelative && !topRelative.startsWith("..") && !path.isAbsolute(topRelative) && topRelative.split(path.sep)[0] === "namespaces" && topRelative.split(path.sep)[1] === memoryParts.at(-1)) {
+      candidates.push(filePathAad(filePath, topLevelRoot));
+    }
+  }
+  return candidates;
+}
+async function closeWriteStream(stream) {
+  await new Promise((resolve, reject) => {
+    stream.once("error", reject);
+    stream.end(() => resolve());
+  });
+}
+function secureStoreEnvelopeHeaderAad(salt) {
+  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);
+  out.writeUInt8(ENVELOPE_VERSION, 0);
+  Buffer.from(salt).copy(out, 1);
+  return out;
+}
+
+// src/converge.ts
+import { resolveAgentAccessAuthToken } from "@remnic/core/resolve-auth-token.js";
+async function readLocalTombstones(rootDir) {
+  const shaSet = /* @__PURE__ */ new Set();
+  const candidates = [
+    path2.join(rootDir, "state", "tombstones.jsonl"),
+    path2.join(rootDir, "tombstones.jsonl")
+  ];
+  for (const tombPath of candidates) {
+    try {
+      const content = await fs3.promises.readFile(tombPath, "utf-8");
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        try {
+          const record = JSON.parse(trimmed);
+          if (typeof record.contentHash === "string" && /^[0-9a-f]{64}$/i.test(record.contentHash)) {
+            shaSet.add(record.contentHash.toLowerCase());
+          }
+          if (typeof record.fileSha256 === "string" && /^[0-9a-f]{64}$/i.test(record.fileSha256)) {
+            shaSet.add(record.fileSha256.toLowerCase());
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  return shaSet;
+}
+async function fetchPeerSnapshot(peerUrl, namespace, token, fetchImpl = globalThis.fetch) {
+  let base = peerUrl;
+  while (base.endsWith("/")) {
+    base = base.slice(0, -1);
+  }
+  const routes = [
+    `/remnic/v1/offline-sync/snapshot?namespace=${encodeURIComponent(namespace)}&content=false`,
+    `/engram/v1/offline-sync/snapshot?namespace=${encodeURIComponent(namespace)}&content=false`
+  ];
+  const headers = token ? { authorization: `Bearer ${token}` } : {};
+  let lastFailure = "no snapshot route responded";
+  for (const route of routes) {
+    let response;
+    try {
+      response = await fetchImpl(`${base}${route}`, { headers });
+    } catch (error) {
+      lastFailure = error instanceof Error ? error.message : String(error);
+      continue;
+    }
+    if (!response.ok) {
+      lastFailure = `HTTP ${response.status}`;
+      continue;
+    }
+    let data;
+    try {
+      data = await response.json();
+    } catch {
+      throw new Error(`invalid peer snapshot for namespace ${namespace}: response was not JSON`);
+    }
+    if (!data || typeof data !== "object" || !("files" in data) || !Array.isArray(data.files)) {
+      throw new Error(`invalid peer snapshot for namespace ${namespace}: files must be an array`);
+    }
+    const files = data.files.map((item, index) => {
+      if (!item || typeof item !== "object" || !("path" in item) || typeof item.path !== "string" || !("sha256" in item) || typeof item.sha256 !== "string") {
+        throw new Error(`invalid peer snapshot for namespace ${namespace}: malformed file at index ${index}`);
+      }
+      return {
+        path: item.path,
+        sha256: item.sha256,
+        mtimeMs: "mtimeMs" in item && typeof item.mtimeMs === "number" ? item.mtimeMs : void 0,
+        bytes: "bytes" in item && typeof item.bytes === "number" ? item.bytes : void 0
+      };
+    });
+    const rawTombstones = "tombstones" in data ? data.tombstones : void 0;
+    if (rawTombstones !== void 0 && !Array.isArray(rawTombstones)) {
+      throw new Error(`invalid peer snapshot for namespace ${namespace}: tombstones must be an array`);
+    }
+    const tombstones = /* @__PURE__ */ new Set();
+    for (const tombstone of rawTombstones ?? []) {
+      if (typeof tombstone !== "string" || !/^[0-9a-f]{64}$/i.test(tombstone)) {
+        throw new Error(`invalid peer snapshot for namespace ${namespace}: malformed tombstone`);
+      }
+      tombstones.add(tombstone.toLowerCase());
+    }
+    return { files, tombstones };
+  }
+  throw new Error(`failed to fetch peer snapshot for namespace ${namespace}: ${lastFailure}`);
+}
+function requiredResponseNumber(response, name) {
+  const raw = response.headers.get(name);
+  const value = raw === null ? Number.NaN : Number(raw);
+  if (!Number.isFinite(value) || value < 0) {
+    throw new Error(`offline file content response had invalid ${name}`);
+  }
+  return value;
+}
+async function fetchPeerFileContent(peerUrl, namespace, filePath, token, fetchImpl = globalThis.fetch) {
+  const base = peerUrl.replace(/\/+$/, "");
+  const routes = [
+    "/remnic/v1/offline-sync/file-content",
+    "/engram/v1/offline-sync/file-content"
+  ];
+  const headers = {
+    "content-type": "application/json",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+  for (const route of routes) {
+    try {
+      const chunks = [];
+      const hash = createHash2("sha256");
+      let offset = 0;
+      let expectedBytes;
+      let expectedSha256;
+      let mtimeMs;
+      do {
+        const response = await fetchImpl(`${base}${route}`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            namespace,
+            includeTranscripts: false,
+            path: filePath,
+            offset,
+            length: OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES
+          })
+        });
+        if (!response.ok) throw new Error(`offline file content request failed: ${response.status}`);
+        const content = Buffer.from(await response.arrayBuffer());
+        const chunkOffset = requiredResponseNumber(response, "x-remnic-chunk-offset");
+        const chunkBytes = requiredResponseNumber(response, "x-remnic-chunk-bytes");
+        const totalBytes = requiredResponseNumber(response, "x-remnic-file-bytes");
+        const responseMtimeMs = requiredResponseNumber(response, "x-remnic-file-mtime-ms");
+        const sha256 = response.headers.get("x-remnic-file-sha256");
+        const encodedPath = response.headers.get("x-remnic-file-path");
+        if (!sha256 || chunkOffset !== offset || chunkBytes !== content.length || encodedPath !== null && decodeURIComponent(encodedPath) !== filePath || expectedBytes !== void 0 && expectedBytes !== totalBytes || expectedSha256 !== void 0 && expectedSha256 !== sha256) {
+          throw new Error(`offline file content response changed during transfer: ${filePath}`);
+        }
+        if (content.length === 0 && offset < totalBytes) {
+          throw new Error(`offline file content chunk was empty before EOF: ${filePath}`);
+        }
+        expectedBytes = totalBytes;
+        expectedSha256 = sha256;
+        mtimeMs = responseMtimeMs;
+        chunks.push(content);
+        hash.update(content);
+        offset += content.length;
+      } while (expectedBytes === void 0 || offset < expectedBytes);
+      if (expectedBytes === void 0 || expectedSha256 === void 0 || mtimeMs === void 0 || offset !== expectedBytes || hash.digest("hex") !== expectedSha256) {
+        throw new Error(`offline file content checksum mismatch: ${filePath}`);
+      }
+      return {
+        content: Buffer.concat(chunks, expectedBytes),
+        sha256: expectedSha256,
+        bytes: expectedBytes,
+        mtimeMs
+      };
+    } catch {
+    }
+  }
+  return null;
+}
+async function postPeerFileContent(peerUrl, namespace, filePath, content, metadata, token, fetchImpl = globalThis.fetch) {
+  const base = peerUrl.replace(/\/+$/, "");
+  const routes = [
+    `/remnic/v1/offline-sync/apply-file-content?namespace=${encodeURIComponent(namespace)}`,
+    `/engram/v1/offline-sync/apply-file-content?namespace=${encodeURIComponent(namespace)}`
+  ];
+  for (const route of routes) {
+    try {
+      let offset = 0;
+      do {
+        const chunk = content.subarray(
+          offset,
+          Math.min(content.length, offset + OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2)
+        );
+        const headers = {
+          "content-type": "application/octet-stream",
+          "x-remnic-include-transcripts": "false",
+          "x-remnic-source-id": encodeURIComponent("remnic-converge"),
+          "x-remnic-file-path": encodeURIComponent(filePath),
+          "x-remnic-file-sha256": metadata.sha256,
+          "x-remnic-file-bytes": String(content.length),
+          "x-remnic-file-mtime-ms": String(metadata.mtimeMs),
+          "x-remnic-chunk-offset": String(offset),
+          ...metadata.baseSha256 ? { "x-remnic-base-sha256": metadata.baseSha256 } : {},
+          ...token ? { authorization: `Bearer ${token}` } : {}
+        };
+        const response = await fetchImpl(`${base}${route}`, {
+          method: "POST",
+          headers,
+          body: new Uint8Array(chunk)
+        });
+        if (!response.ok) throw new Error(`offline apply-file-content request failed: ${response.status}`);
+        const result = await response.json().catch(() => null);
+        if (!result || typeof result !== "object" || !("done" in result) || typeof result.done !== "boolean" || !("applied" in result) || typeof result.applied !== "boolean" || !("skipped" in result) || typeof result.skipped !== "boolean" || "conflict" in result && result.conflict) {
+          return false;
+        }
+        if (result.done) {
+          return result.skipped || result.applied && offset + chunk.length === content.length;
+        }
+        if (result.applied || result.skipped || chunk.length === 0) {
+          return false;
+        }
+        offset += chunk.length;
+      } while (offset < content.length);
+      return false;
+    } catch {
+    }
+  }
+  return false;
+}
+async function computeConvergePlan(options = {}) {
+  const baseMap = /* @__PURE__ */ new Map();
+  const namespacesToPlan = /* @__PURE__ */ new Set();
+  const localMap = /* @__PURE__ */ new Map();
+  const localTombstones = /* @__PURE__ */ new Map();
+  const peerMap = /* @__PURE__ */ new Map();
+  const peerTombstones = /* @__PURE__ */ new Map();
+  if (options.baseFilesByNamespace) {
+    for (const [ns, files] of options.baseFilesByNamespace) {
+      namespacesToPlan.add(ns);
+      baseMap.set(ns, files);
+    }
+  }
+  if (options.localFilesByNamespace) {
+    for (const [ns, files] of options.localFilesByNamespace) {
+      namespacesToPlan.add(ns);
+      localMap.set(ns, files);
+    }
+  }
+  if (options.localTombstonesByNamespace) {
+    for (const [ns, tombstones] of options.localTombstonesByNamespace) {
+      localTombstones.set(ns, new Set(tombstones));
+    }
+  }
+  if (options.peerFilesByNamespace) {
+    for (const [ns, files] of options.peerFilesByNamespace) {
+      namespacesToPlan.add(ns);
+      peerMap.set(ns, files);
+    }
+  }
+  if (options.peerTombstonesByNamespace) {
+    for (const [ns, tombstones] of options.peerTombstonesByNamespace) {
+      peerTombstones.set(ns, new Set(tombstones));
+    }
+  }
+  let config = options.config;
+  if (!config) {
+    try {
+      config = parseConfig2({});
+    } catch {
+    }
+  }
+  if (!options.localFilesByNamespace && config) {
+    const roots = await resolveCorpusNamespaceRoots({ config });
+    const discovered = await listNamespaces({ config });
+    for (const entry of discovered) {
+      namespacesToPlan.add(entry.namespace);
+    }
+    for (const rootInfo of roots) {
+      const ns = rootInfo.namespace;
+      namespacesToPlan.add(ns);
+      try {
+        const snapshot = await buildOfflineSyncSnapshotFromBase({
+          root: rootInfo.rootDir,
+          sourceId: "local",
+          includeContent: false
+        });
+        const files = snapshot.files.map((record) => ({
+          path: record.path,
+          sha256: record.sha256,
+          mtimeMs: record.mtimeMs,
+          bytes: record.bytes
+        }));
+        localMap.set(ns, files);
+        const tombstones = await readLocalTombstones(rootInfo.rootDir);
+        localTombstones.set(ns, tombstones);
+      } catch {
+        localMap.set(ns, []);
+      }
+    }
+  }
+  if (!options.peerFilesByNamespace && options.peerUrl) {
+    let resolvedToken;
+    if (options.peerToken) {
+      try {
+        resolvedToken = await resolveAgentAccessAuthToken(options.peerToken, {
+          resolveSecretRef: options.resolveSecretRef
+        });
+      } catch {
+        resolvedToken = options.peerToken;
+      }
+    }
+    const fetchFn = options.fetchImpl ?? globalThis.fetch;
+    for (const ns of namespacesToPlan) {
+      const peerData = await fetchPeerSnapshot(options.peerUrl, ns, resolvedToken, fetchFn);
+      peerMap.set(ns, peerData.files);
+      peerTombstones.set(ns, peerData.tombstones);
+    }
+  }
+  const memoryDir = options.cursorDir ?? config?.memoryDir;
+  if (!options.baseFilesByNamespace && memoryDir && options.peerUrl) {
+    for (const ns of namespacesToPlan) {
+      const cursorPath = defaultConvergeCursorPath(memoryDir, options.peerUrl, ns);
+      const cursor = await readConvergeCursor(cursorPath);
+      if (cursor?.baseFiles && cursor.baseFiles.length > 0) {
+        baseMap.set(ns, cursor.baseFiles);
+      }
+    }
+  }
+  const inputs = [];
+  for (const ns of [...namespacesToPlan].sort()) {
+    inputs.push({
+      namespace: ns,
+      local: localMap.get(ns) ?? [],
+      peer: peerMap.get(ns) ?? [],
+      base: baseMap.get(ns),
+      tombstonedFileSha256: localTombstones.get(ns) ?? [],
+      peerTombstonedFileSha256: peerTombstones.get(ns) ?? []
+    });
+  }
+  return planReconciliation(inputs, { conflictPolicy: options.conflictPolicy });
+}
+async function executeConvergeApply(options = {}) {
+  const conflictPolicy = options.conflictPolicy ?? "manual";
+  const plan = await computeConvergePlan({ ...options, conflictPolicy });
+  if (plan.converged && !options.dryRun) {
+    await updateCursorsForPlan(plan, options);
+    return {
+      converged: true,
+      status: "converged",
+      plan,
+      transfers: { pulled: 0, pushed: 0, conflictsResolved: 0, suppressed: 0, failed: 0 },
+      cursorUpdated: true
+    };
+  }
+  const unresolvedCount = plan.byNamespace.reduce((acc, report) => acc + report.unresolved, 0);
+  if (unresolvedCount > 0 && conflictPolicy === "manual") {
+    return {
+      converged: false,
+      status: "stopped_unresolved_conflicts",
+      plan,
+      transfers: { pulled: 0, pushed: 0, conflictsResolved: 0, suppressed: 0, failed: 0 },
+      cursorUpdated: false
+    };
+  }
+  const plannedTransfers = {
+    pulled: 0,
+    pushed: 0,
+    conflictsResolved: 0,
+    suppressed: 0,
+    failed: 0
+  };
+  for (const entry of plan.entries) {
+    if (entry.action === "pull") plannedTransfers.pulled += 1;
+    else if (entry.action === "push") plannedTransfers.pushed += 1;
+    else if (entry.action === "conflict") plannedTransfers.conflictsResolved += 1;
+    else if (entry.action === "suppress") plannedTransfers.suppressed += 1;
+  }
+  if (options.dryRun) {
+    return {
+      converged: false,
+      status: "dry_run",
+      plan,
+      transfers: plannedTransfers,
+      cursorUpdated: false
+    };
+  }
+  const actualTransfers = {
+    pulled: 0,
+    pushed: 0,
+    conflictsResolved: 0,
+    suppressed: 0,
+    failed: 0
+  };
+  let resolvedToken;
+  if (options.peerToken) {
+    try {
+      resolvedToken = await resolveAgentAccessAuthToken(options.peerToken, {
+        resolveSecretRef: options.resolveSecretRef
+      });
+    } catch {
+      resolvedToken = options.peerToken;
+    }
+  }
+  const fetchFn = options.fetchImpl ?? globalThis.fetch;
+  let config = options.config;
+  if (!config) {
+    try {
+      config = parseConfig2({});
+    } catch {
+    }
+  }
+  const rootMap = /* @__PURE__ */ new Map();
+  if (config) {
+    try {
+      const roots = await resolveCorpusNamespaceRoots({ config });
+      for (const r of roots) {
+        rootMap.set(r.namespace, r.rootDir);
+      }
+    } catch {
+    }
+  }
+  for (const entry of plan.entries) {
+    if (entry.action === "identical") continue;
+    let transferType = "none";
+    if (entry.action === "pull") {
+      transferType = "pull";
+    } else if (entry.action === "push") {
+      transferType = "push";
+    } else if (entry.action === "suppress") {
+      transferType = "suppress";
+    } else if (entry.action === "conflict") {
+      if (entry.resolution === "peer-wins") {
+        transferType = "pull";
+      } else if (entry.resolution === "local-wins") {
+        transferType = "push";
+      } else if (entry.resolution === "supersede-link") {
+        if (entry.newerSide === "peer") transferType = "pull";
+        else if (entry.newerSide === "local") transferType = "push";
+      }
+    }
+    if (transferType === "pull") {
+      let remoteFile = null;
+      const buffered = options.peerFileBuffers?.get(entry.namespace)?.get(entry.path);
+      if (buffered) {
+        const state = options.peerFilesByNamespace?.get(entry.namespace)?.find((file) => file.path === entry.path);
+        remoteFile = {
+          content: buffered,
+          sha256: state?.sha256 ?? entry.peerSha256 ?? createHash2("sha256").update(buffered).digest("hex"),
+          bytes: buffered.length,
+          mtimeMs: state?.mtimeMs ?? 0
+        };
+      } else if (options.peerUrl) {
+        remoteFile = await fetchPeerFileContent(
+          options.peerUrl,
+          entry.namespace,
+          entry.path,
+          resolvedToken,
+          fetchFn
+        );
+      }
+      if (remoteFile !== null && (!entry.peerSha256 || remoteFile.sha256 === entry.peerSha256)) {
+        if (options.localFileBuffers) {
+          let nsMap = options.localFileBuffers.get(entry.namespace);
+          if (!nsMap) {
+            nsMap = /* @__PURE__ */ new Map();
+            options.localFileBuffers.set(entry.namespace, nsMap);
+          }
+          nsMap.set(entry.path, remoteFile.content);
+          if (entry.action === "conflict") actualTransfers.conflictsResolved += 1;
+          else actualTransfers.pulled += 1;
+        } else {
+          const rootDir = rootMap.get(entry.namespace);
+          if (rootDir) {
+            const io = await createOfflineStorageIo(rootDir);
+            const expectedLocalSha256 = entry.action === "conflict" ? entry.localSha256 : entry.baseSha256;
+            let offset = 0;
+            let transferComplete = false;
+            do {
+              const chunk = remoteFile.content.subarray(
+                offset,
+                Math.min(
+                  remoteFile.content.length,
+                  offset + OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2
+                )
+              );
+              const chunkResult = await applyOfflineSyncFileContentChunk({
+                root: rootDir,
+                sourceId: "remnic-converge",
+                path: entry.path,
+                sha256: remoteFile.sha256,
+                bytes: remoteFile.bytes,
+                mtimeMs: remoteFile.mtimeMs,
+                offset,
+                content: chunk,
+                ...expectedLocalSha256 ? { baseSha256: expectedLocalSha256 } : {},
+                readFile: io.readFile,
+                readFileDigest: io.readFileDigest,
+                writeFile: io.writeFile,
+                writeStagingFile: io.writeStagingFile,
+                writeFileChunks: io.writeFileChunks
+              });
+              if (chunkResult.conflict) {
+                break;
+              }
+              if (chunkResult.done) {
+                transferComplete = chunkResult.applied || chunkResult.skipped;
+                break;
+              }
+              if (chunkResult.applied || chunkResult.skipped || chunk.length === 0) {
+                break;
+              }
+              offset += chunk.length;
+            } while (offset < remoteFile.content.length);
+            if (transferComplete) {
+              if (entry.action === "conflict") actualTransfers.conflictsResolved += 1;
+              else actualTransfers.pulled += 1;
+            } else {
+              actualTransfers.failed += 1;
+            }
+          } else {
+            actualTransfers.failed += 1;
+          }
+        }
+      } else {
+        actualTransfers.failed += 1;
+      }
+    } else if (transferType === "push") {
+      let content = null;
+      let mtimeMs = options.localFilesByNamespace?.get(entry.namespace)?.find((file) => file.path === entry.path)?.mtimeMs;
+      if (options.localFileBuffers?.get(entry.namespace)?.has(entry.path)) {
+        content = options.localFileBuffers.get(entry.namespace).get(entry.path);
+      } else {
+        const rootDir = rootMap.get(entry.namespace);
+        if (rootDir) {
+          const filePath = path2.join(rootDir, entry.path);
+          try {
+            const io = await createOfflineStorageIo(rootDir);
+            content = await io.readFile({ root: rootDir, path: entry.path, filePath });
+            mtimeMs ??= (await fs3.promises.stat(filePath)).mtimeMs;
+          } catch {
+            content = null;
+          }
+        }
+      }
+      if (content !== null) {
+        if (options.peerFileBuffers) {
+          let nsMap = options.peerFileBuffers.get(entry.namespace);
+          if (!nsMap) {
+            nsMap = /* @__PURE__ */ new Map();
+            options.peerFileBuffers.set(entry.namespace, nsMap);
+          }
+          nsMap.set(entry.path, content);
+          if (entry.action === "conflict") actualTransfers.conflictsResolved += 1;
+          else actualTransfers.pushed += 1;
+        } else if (options.peerUrl && entry.localSha256) {
+          const expectedPeerSha256 = entry.action === "conflict" ? entry.peerSha256 : entry.baseSha256;
+          const ok = await postPeerFileContent(
+            options.peerUrl,
+            entry.namespace,
+            entry.path,
+            content,
+            {
+              sha256: entry.localSha256,
+              mtimeMs: mtimeMs ?? 0,
+              ...expectedPeerSha256 ? { baseSha256: expectedPeerSha256 } : {}
+            },
+            resolvedToken,
+            fetchFn
+          );
+          if (ok) {
+            if (entry.action === "conflict") actualTransfers.conflictsResolved += 1;
+            else actualTransfers.pushed += 1;
+          } else {
+            actualTransfers.failed += 1;
+          }
+        } else {
+          actualTransfers.failed += 1;
+        }
+      } else {
+        actualTransfers.failed += 1;
+      }
+    } else if (transferType === "suppress") {
+      actualTransfers.suppressed += 1;
+    }
+  }
+  let cursorUpdated = false;
+  if (actualTransfers.failed === 0) {
+    await updateCursorsForPlan(plan, options);
+    cursorUpdated = true;
+  }
+  return {
+    converged: actualTransfers.failed === 0,
+    status: "applied",
+    plan,
+    transfers: actualTransfers,
+    cursorUpdated
+  };
+}
+async function updateCursorsForPlan(plan, options) {
+  const peerUrl = options.peerUrl ?? "local";
+  let memoryDir;
+  if (options.cursorDir) {
+    memoryDir = options.cursorDir;
+  } else if (options.config) {
+    memoryDir = options.config.memoryDir;
+  }
+  if (!memoryDir) return;
+  const namespaces = new Set(plan.byNamespace.map((n) => n.namespace));
+  for (const ns of namespaces) {
+    const cursorPath = defaultConvergeCursorPath(memoryDir, peerUrl, ns);
+    const nsEntries = plan.entries.filter((e) => e.namespace === ns);
+    const baseFiles = nsEntries.map((e) => ({
+      path: e.path,
+      sha256: e.localSha256 ?? e.peerSha256 ?? "unknown"
+    }));
+    const cursorState = {
+      version: 1,
+      peerUrl,
+      namespace: ns,
+      lastConvergedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      baseFiles
+    };
+    try {
+      await writeConvergeCursor(cursorPath, cursorState);
+    } catch {
+    }
+  }
+}
+function formatConvergeReport(plan) {
+  const lines = [];
+  lines.push(`Convergence Status: ${plan.converged ? "CONVERGED" : "DIVERGED"}`);
+  lines.push("");
+  lines.push("Per-Namespace Summary:");
+  if (plan.byNamespace.length === 0) {
+    lines.push("  (no namespaces evaluated)");
+  } else {
+    for (const report of plan.byNamespace) {
+      lines.push(`  [${report.namespace}]`);
+      lines.push(`    identical:  ${report.identical}`);
+      lines.push(`    pull:       ${report.pull}`);
+      lines.push(`    push:       ${report.push}`);
+      lines.push(`    conflict:   ${report.conflict}`);
+      lines.push(`    suppress:   ${report.suppress}`);
+      lines.push(`    unresolved: ${report.unresolved}`);
+    }
+  }
+  return lines.join("\n");
+}
+function formatConvergeApplyReport(result) {
+  const lines = [];
+  lines.push(`Convergence Execution Status: ${result.status.toUpperCase()}`);
+  lines.push(`Converged: ${result.converged ? "YES" : "NO"}`);
+  lines.push("");
+  lines.push("Transfers Executed:");
+  lines.push(`  pulled:             ${result.transfers.pulled}`);
+  lines.push(`  pushed:             ${result.transfers.pushed}`);
+  lines.push(`  conflictsResolved:  ${result.transfers.conflictsResolved}`);
+  lines.push(`  suppressed:         ${result.transfers.suppressed}`);
+  lines.push(`  failed:             ${result.transfers.failed}`);
+  lines.push("");
+  lines.push(formatConvergeReport(result.plan));
+  return lines.join("\n");
+}
+async function cmdConverge(action, rest, json) {
+  if (action === "help" || action === "--help" || action === "-h" || rest.includes("--help") || rest.includes("-h")) {
+    console.log(`Usage: remnic converge <plan|apply> [options]
+
+Subcommands:
+  plan              Compute and display reconciliation plan
+  apply             Execute bidirectional converge transport (alias: transport, sync)
+
+Options:
+  --peer <url>      Peer server URL (or --remote-url / --remote)
+  --token <token>   Bearer token or SecretRef for peer authentication
+  --conflict-policy <policy>
+                    Conflict resolution policy (manual|newest-wins|keep-both)
+  --dry-run         Simulate transfers without mutating disk or remote peer
+  --json            Output detailed JSON plan report
+`);
+    return;
+  }
+  if (action !== "plan" && action !== "apply" && action !== "transport" && action !== "sync") {
+    process.stderr.write(`converge: unknown action "${action}". Use: plan or apply [options].
+`);
+    process.exitCode = 2;
+    return;
+  }
+  let peerUrl;
+  let peerToken;
+  let dryRun = false;
+  let conflictPolicy;
+  for (let i = 0; i < rest.length; i += 1) {
+    const arg = rest[i];
+    if ((arg === "--peer" || arg === "--remote-url" || arg === "--remote") && rest[i + 1]) {
+      peerUrl = rest[i + 1];
+      i += 1;
+    } else if (arg === "--token" && rest[i + 1]) {
+      peerToken = rest[i + 1];
+      i += 1;
+    } else if (arg === "--dry-run") {
+      dryRun = true;
+    } else if (arg === "--conflict-policy" && rest[i + 1]) {
+      const pol = rest[i + 1];
+      if (pol === "manual" || pol === "newest-wins" || pol === "keep-both") {
+        conflictPolicy = pol;
+      }
+      i += 1;
+    }
+  }
+  if (action === "plan") {
+    const plan = await computeConvergePlan({ peerUrl, peerToken, conflictPolicy });
+    if (json) {
+      console.log(JSON.stringify(plan, null, 2));
+    } else {
+      console.log(formatConvergeReport(plan));
+    }
+    return;
+  }
+  const result = await executeConvergeApply({
+    peerUrl,
+    peerToken,
+    dryRun,
+    conflictPolicy
+  });
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(formatConvergeApplyReport(result));
+  }
+}
+
+// src/doctor-namespace-lint.ts
+import { isNamespacePolicyCovered } from "@remnic/core";
+function readConfiguredNamespace(remnicCfg) {
+  if (!("namespace" in remnicCfg)) return { invalid: false };
+  const value = remnicCfg.namespace;
+  if (typeof value === "string" && value.trim().length > 0) {
+    return { configuredNamespace: value.trim(), invalid: false };
+  }
+  return { invalid: true };
+}
+function buildNamespacePolicyCheck(args) {
+  if (args.invalid) {
+    return {
+      name: "Namespace policy",
+      ok: false,
+      detail: "config `namespace` is set but is not a non-empty string",
+      remediation: "Set `namespace` to a non-empty string (a namespacePolicies name or the default namespace), or remove it."
+    };
+  }
+  if (!args.config || !args.configuredNamespace) return void 0;
+  const covered = isNamespacePolicyCovered(args.configuredNamespace, args.config);
+  return {
+    name: "Namespace policy",
+    ok: covered,
+    warn: !covered,
+    detail: covered ? `configured namespace "${args.configuredNamespace}" is writable` : `configured namespace "${args.configuredNamespace}" is writable by no one \u2014 its namespacePolicies entry grants no writer, or it has no entry and is not the default namespace`,
+    remediation: covered ? void 0 : `Give "${args.configuredNamespace}" a namespacePolicies entry with a non-blank writePrincipals value, or set namespace to a writable one \u2014 otherwise every write is rejected and dead-lettered.`
+  };
+}
+
+// src/index.ts
+import { WriteQuarantineStore as WriteQuarantineStore2 } from "@remnic/core/write-quarantine.js";
+
+// src/quarantine-cli.ts
+import { basename } from "path";
+function renderQuarantineList(records, format) {
+  if (format === "json") {
+    const summary = records.map((record) => ({
+      timestamp: record.timestamp,
+      operation: record.operation,
+      principal: record.principal,
+      attemptedNamespace: record.attemptedNamespace
+    }));
+    return JSON.stringify(summary, null, 2);
+  }
+  if (format !== "text") {
+    throw new Error(`Unsupported quarantine format: ${String(format)}`);
+  }
+  if (records.length === 0) return "No quarantined writes.";
+  const lines = [`Quarantined writes (${records.length}):`, ""];
+  for (const record of records) {
+    lines.push(
+      `  ${record.timestamp}  ${record.operation}  principal=${record.principal ?? "-"}  attemptedNamespace=${record.attemptedNamespace}`
+    );
+  }
+  return lines.join("\n");
+}
+async function replayQuarantine(opts) {
+  const result = { replayed: 0, failures: [], deleteFailures: [] };
+  for (const entry of await opts.store.entries()) {
+    const { record } = entry;
+    const basePayload = record.payload;
+    const principal = opts.principal ?? record.principal ?? void 0;
+    const idempotencyKey = typeof basePayload.idempotencyKey === "string" && basePayload.idempotencyKey.length > 0 ? basePayload.idempotencyKey : `quarantine-replay:${basename(entry.path)}`;
+    const request = {
+      ...basePayload,
+      namespace: opts.targetNamespace,
+      suppressQuarantine: true,
+      idempotencyKey,
+      ...principal ? { authenticatedPrincipal: principal } : {}
+    };
+    try {
+      await opts.submit(record.operation, request);
+    } catch (err) {
+      result.failures.push({
+        operation: record.operation,
+        attemptedNamespace: opts.targetNamespace,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      continue;
+    }
+    try {
+      const removed = await opts.store.removeEntry(entry.path);
+      if (removed) {
+        result.replayed += 1;
+      } else {
+        result.deleteFailures.push({
+          path: entry.path,
+          error: "entry not removed (outside quarantine root or already absent)"
+        });
+      }
+    } catch (err) {
+      result.deleteFailures.push({
+        path: entry.path,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return result;
+}
+function renderReplayResult(result, targetNamespace, format) {
+  if (format === "json") {
+    return JSON.stringify(
+      {
+        targetNamespace,
+        replayed: result.replayed,
+        failures: result.failures,
+        deleteFailures: result.deleteFailures
+      },
+      null,
+      2
+    );
+  }
+  if (format !== "text") {
+    throw new Error(`Unsupported quarantine format: ${String(format)}`);
   }
   const lines = [`Replayed ${result.replayed} quarantined write(s) into namespace ${targetNamespace}.`];
   if (result.failures.length > 0) {
@@ -371,8 +1365,8 @@ function renderReplayResult(result, targetNamespace, format) {
 }
 
 // src/quarantine-replay.ts
-import * as fs2 from "fs";
-import { EngramAccessService, Orchestrator as Orchestrator2, initLogger, parseConfig as parseConfig2, resolveRemnicConfigRecord as resolveRemnicConfigRecord2 } from "@remnic/core";
+import * as fs4 from "fs";
+import { EngramAccessService, Orchestrator as Orchestrator2, initLogger, parseConfig as parseConfig3, resolveRemnicConfigRecord as resolveRemnicConfigRecord2 } from "@remnic/core";
 import { WriteQuarantineStore } from "@remnic/core/write-quarantine.js";
 function valueFlag(args, flag) {
   const occurrences = args.filter((a) => a === flag).length;
@@ -394,384 +1388,125 @@ async function runQuarantineReplay(rest, format, resolveConfigPath2) {
   let principal;
   try {
     targetNamespace = valueFlag(rest, "--namespace");
-    principal = valueFlag(rest, "--principal");
-  } catch (err) {
-    process.stderr.write(`quarantine replay: ${err instanceof Error ? err.message : String(err)}
-`);
-    process.exitCode = 2;
-    return;
-  }
-  if (!targetNamespace || targetNamespace.trim().length === 0) {
-    process.stderr.write("quarantine replay: --namespace <ns> is required.\n");
-    process.exitCode = 2;
-    return;
-  }
-  const valued = /* @__PURE__ */ new Set(["--namespace", "--principal"]);
-  const bad = rest.filter((a, i) => a.startsWith("--") ? a !== "--json" && !valued.has(a) : !valued.has(rest[i - 1]));
-  if (bad.length > 0) {
-    process.stderr.write(
-      `quarantine replay: unexpected argument(s): ${bad.join(", ")}. Use: replay --namespace <ns> [--principal <p>] [--json].
-`
-    );
-    process.exitCode = 2;
-    return;
-  }
-  initLogger();
-  let orchestrator;
-  try {
-    const configPath = resolveConfigPath2();
-    const raw = fs2.existsSync(configPath) ? JSON.parse(fs2.readFileSync(configPath, "utf8")) : {};
-    const config = parseConfig2(resolveRemnicConfigRecord2(raw));
-    orchestrator = new Orchestrator2(config);
-    await orchestrator.initialize();
-    await orchestrator.deferredReady;
-    const service = new EngramAccessService(orchestrator);
-    const store = new WriteQuarantineStore(config.memoryDir);
-    const result = await replayQuarantine({
-      store,
-      targetNamespace,
-      principal,
-      submit: async (operation, request) => {
-        if (operation === "observe") {
-          await service.observe(request);
-        } else if (operation === "memory_store") {
-          await service.memoryStore(request);
-        } else {
-          await service.suggestionSubmit(request);
-        }
-      }
-    });
-    console.log(renderReplayResult(result, targetNamespace, format));
-    if (result.failures.length > 0 || result.deleteFailures.length > 0) process.exitCode = 1;
-  } catch {
-    process.stderr.write("quarantine replay: unable to replay quarantine store\n");
-    process.exitCode = 2;
-  } finally {
-    if (orchestrator) await orchestrator.destroy();
-  }
-}
-
-// src/offline-impression-rotation.ts
-import fs3 from "fs";
-import { parseConfig as parseConfig3, resolveRemnicConfigRecord as resolveRemnicConfigRecord3, drainPendingImpressionsForOfflineSync } from "@remnic/core";
-import { LastRecallStore } from "@remnic/core/recall-state";
-function parseConfigQuietly(raw) {
-  const originalWarn = console.warn;
-  console.warn = () => {
-  };
-  try {
-    return parseConfig3(resolveRemnicConfigRecord3(raw));
-  } finally {
-    console.warn = originalWarn;
-  }
-}
-var OFFLINE_CONFIG_KEYS = [
-  "offlineSyncExcludes",
-  "secureStoreEncryptOnWrite",
-  "recallImpressionsRotateBytes",
-  "recallImpressionsRotateKeep"
-];
-function pickOfflineConfigRecord(raw) {
-  let resolved;
-  try {
-    resolved = resolveRemnicConfigRecord3(raw);
-  } catch {
-    resolved = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-  }
-  const picked = {};
-  for (const key of OFFLINE_CONFIG_KEYS) {
-    if (key in resolved) picked[key] = resolved[key];
-  }
-  return picked;
-}
-function resolveOfflineImpressionRotation(configPath) {
-  let raw;
-  try {
-    raw = fs3.existsSync(configPath) ? JSON.parse(fs3.readFileSync(configPath, "utf8")) : {};
-  } catch {
-    throw new Error(
-      `cannot read recall-impression rotation from ${configPath}: config file could not be read as JSON`
-    );
-  }
-  let config;
-  try {
-    config = parseConfigQuietly(pickOfflineConfigRecord(raw));
-  } catch {
-    throw new Error(
-      `cannot read recall-impression rotation from ${configPath}: config failed validation`
-    );
-  }
-  return {
-    impressionsRotateBytes: config.recallImpressionsRotateBytes,
-    impressionsRotateKeep: config.recallImpressionsRotateKeep
-  };
-}
-async function drainOfflineSyncImpressions(memoryDir, rotation) {
-  await drainPendingImpressionsForOfflineSync(
-    () => new LastRecallStore(memoryDir, {
-      impressionsRotateBytes: rotation.impressionsRotateBytes,
-      impressionsRotateKeep: rotation.impressionsRotateKeep
-    }).drainPendingImpressions()
-  );
-}
-
-// src/offline-storage-io.ts
-import { mkdtemp, readdir, lstat, rm } from "fs/promises";
-import fs4 from "fs";
-import path from "path";
-import { createHash, createDecipheriv } from "crypto";
-import {
-  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES,
-  StorageManager
-} from "@remnic/core";
-import { OFFLINE_DECRYPT_STAGING_DIR_PREFIX } from "@remnic/core/offline-sync-exclude-globs";
-import {
-  AUTH_TAG_LENGTH,
-  ENVELOPE_HEADER_SIZE,
-  ENVELOPE_LAYOUT,
-  ENVELOPE_SALT_LENGTH,
-  ENVELOPE_VERSION,
-  FILE_FORMAT_FLAGS,
-  FILE_FORMAT_VERSION,
-  IV_LENGTH,
-  MAGIC_BYTES,
-  MAGIC_HEADER_SIZE,
-  SecureStoreLockedError,
-  filePathAad,
-  isEncryptedFile,
-  keyring,
-  readHeader,
-  secureStoreDir
-} from "@remnic/core/secure-store";
-async function createConfiguredOfflineStorage(memoryDir, secureStoreEncryptOnWrite = true) {
-  const storage = new StorageManager(memoryDir);
-  const header = await readHeader(memoryDir);
-  let secureStoreKey = null;
-  let secureStoreRequired = false;
-  if (header) {
-    secureStoreRequired = true;
-    storage.setSecureStoreRequired(true);
-    const key = keyring.getKey(secureStoreDir(memoryDir));
-    if (key) {
-      await storage.setSecureStoreKeyAndWait(key, secureStoreEncryptOnWrite);
-      secureStoreKey = key;
-    }
-  }
-  return { storage, secureStoreKey, secureStoreRequired };
-}
-async function createOfflineStorageForPath(memoryDir, filePath, configured, secureStoreEncryptOnWrite) {
-  const memoryRoot = path.resolve(memoryDir);
-  const stateDir = path.dirname(filePath);
-  if (path.basename(stateDir) !== "state" || path.basename(filePath) !== "memory-lifecycle-ledger.jsonl") {
-    throw new Error(`invalid lifecycle ledger path: ${filePath}`);
-  }
-  const storageRoot = path.resolve(path.dirname(stateDir));
-  if (storageRoot !== memoryRoot && !storageRoot.startsWith(`${memoryRoot}${path.sep}`)) {
-    throw new Error(`lifecycle ledger path is outside the offline memory directory: ${filePath}`);
-  }
-  const storage = new StorageManager(storageRoot);
-  if (configured.secureStoreRequired) {
-    storage.setSecureStoreRequired(true);
-  }
-  if (configured.secureStoreKey) {
-    await storage.setSecureStoreKeyAndWait(configured.secureStoreKey, secureStoreEncryptOnWrite);
-  }
-  return storage;
-}
-async function createOfflineStorageIo(memoryDir, configuredStorage) {
-  await cleanupOrphanedOfflineDecryptStaging(memoryDir);
-  const { storage, secureStoreKey } = configuredStorage ?? await createConfiguredOfflineStorage(memoryDir);
-  return {
-    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-    readFileDigest: async ({ filePath }) => {
-      const hash = createHash("sha256");
-      let bytes = 0;
-      for await (const rawChunk of readOfflineSyncFileChunks({
-        filePath,
-        memoryDir,
-        secureStoreKey,
-        chunkSize: OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES
-      })) {
-        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
-        hash.update(chunk);
-        bytes += chunk.length;
-      }
-      return {
-        sha256: hash.digest("hex"),
-        bytes
-      };
-    },
-    readFileChunks: ({ filePath, chunkSize }) => readOfflineSyncFileChunks({
-      filePath,
-      memoryDir,
-      secureStoreKey,
-      chunkSize
-    }),
-    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
-    writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
-    deleteFile: async ({ filePath }) => storage.deleteOfflineSyncFile(filePath)
-  };
-}
-var OFFLINE_DECRYPT_STAGING_ORPHAN_MS = 60 * 60 * 1e3;
-async function cleanupOrphanedOfflineDecryptStaging(memoryDir) {
-  let entries;
-  try {
-    entries = await readdir(memoryDir);
-  } catch {
-    return;
-  }
-  const now = Date.now();
-  for (const name of entries) {
-    if (!name.startsWith(OFFLINE_DECRYPT_STAGING_DIR_PREFIX)) continue;
-    const dir = path.join(memoryDir, name);
-    try {
-      const info = await lstat(dir);
-      if (!info.isDirectory() || info.isSymbolicLink()) continue;
-      if (now - info.mtimeMs < OFFLINE_DECRYPT_STAGING_ORPHAN_MS) continue;
-      await rm(dir, { recursive: true, force: true });
-    } catch {
-    }
+    principal = valueFlag(rest, "--principal");
+  } catch (err) {
+    process.stderr.write(`quarantine replay: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exitCode = 2;
+    return;
   }
-}
-async function* readOfflineSyncFileChunks(options) {
-  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE);
-  if (!isEncryptedFile(header)) {
-    yield* readPlainOfflineFileChunks(options.filePath, options.chunkSize);
+  if (!targetNamespace || targetNamespace.trim().length === 0) {
+    process.stderr.write("quarantine replay: --namespace <ns> is required.\n");
+    process.exitCode = 2;
     return;
   }
-  if (!options.secureStoreKey) {
-    throw new SecureStoreLockedError(
-      `secure-store is locked \u2014 cannot read encrypted file at ${options.filePath}. Run \`remnic secure-store unlock\` to decrypt.`
+  const valued = /* @__PURE__ */ new Set(["--namespace", "--principal"]);
+  const bad = rest.filter((a, i) => a.startsWith("--") ? a !== "--json" && !valued.has(a) : !valued.has(rest[i - 1]));
+  if (bad.length > 0) {
+    process.stderr.write(
+      `quarantine replay: unexpected argument(s): ${bad.join(", ")}. Use: replay --namespace <ns> [--principal <p>] [--json].
+`
     );
+    process.exitCode = 2;
+    return;
   }
-  yield* readEncryptedOfflineFileChunks({
-    filePath: options.filePath,
-    memoryDir: options.memoryDir,
-    key: options.secureStoreKey,
-    chunkSize: options.chunkSize
-  });
-}
-async function readFilePrefix(filePath, length) {
-  const handle = await fs4.promises.open(filePath, "r");
+  initLogger();
+  let orchestrator;
   try {
-    const out = Buffer.alloc(length);
-    const { bytesRead } = await handle.read(out, 0, length, 0);
-    return out.subarray(0, bytesRead);
+    const configPath = resolveConfigPath2();
+    const raw = fs4.existsSync(configPath) ? JSON.parse(fs4.readFileSync(configPath, "utf8")) : {};
+    const config = parseConfig3(resolveRemnicConfigRecord2(raw));
+    orchestrator = new Orchestrator2(config);
+    await orchestrator.initialize();
+    await orchestrator.deferredReady;
+    const service = new EngramAccessService(orchestrator);
+    const store = new WriteQuarantineStore(config.memoryDir);
+    const result = await replayQuarantine({
+      store,
+      targetNamespace,
+      principal,
+      submit: async (operation, request) => {
+        if (operation === "observe") {
+          await service.observe(request);
+        } else if (operation === "memory_store") {
+          await service.memoryStore(request);
+        } else {
+          await service.suggestionSubmit(request);
+        }
+      }
+    });
+    console.log(renderReplayResult(result, targetNamespace, format));
+    if (result.failures.length > 0 || result.deleteFailures.length > 0) process.exitCode = 1;
+  } catch {
+    process.stderr.write("quarantine replay: unable to replay quarantine store\n");
+    process.exitCode = 2;
   } finally {
-    await handle.close();
+    if (orchestrator) await orchestrator.destroy();
   }
 }
-async function* readPlainOfflineFileChunks(filePath, chunkSize) {
-  const stream = fs4.createReadStream(filePath, { highWaterMark: chunkSize });
-  for await (const chunk of stream) {
-    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+
+// src/offline-impression-rotation.ts
+import fs5 from "fs";
+import { parseConfig as parseConfig4, resolveRemnicConfigRecord as resolveRemnicConfigRecord3, drainPendingImpressionsForOfflineSync } from "@remnic/core";
+import { LastRecallStore } from "@remnic/core/recall-state";
+function parseConfigQuietly(raw) {
+  const originalWarn = console.warn;
+  console.warn = () => {
+  };
+  try {
+    return parseConfig4(resolveRemnicConfigRecord3(raw));
+  } finally {
+    console.warn = originalWarn;
   }
 }
-async function* readEncryptedOfflineFileChunks(options) {
-  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);
-  if (header.length < MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE || !isEncryptedFile(header)) {
-    throw new Error(`secure-store encrypted file is truncated: ${options.filePath}`);
-  }
-  const version = header.readUInt8(MAGIC_BYTES.length);
-  const flags = header.readUInt8(MAGIC_BYTES.length + 1);
-  if (version !== FILE_FORMAT_VERSION) {
-    throw new Error(`secure-store file has unsupported version ${version}: ${options.filePath}`);
-  }
-  if (flags !== FILE_FORMAT_FLAGS) {
-    throw new Error(`secure-store file has unsupported flags 0x${flags.toString(16)}: ${options.filePath}`);
-  }
-  const envelopeHeader = header.subarray(MAGIC_HEADER_SIZE);
-  const envelopeVersion = envelopeHeader.readUInt8(ENVELOPE_LAYOUT.version);
-  if (envelopeVersion !== ENVELOPE_VERSION) {
-    throw new Error(`secure-store envelope has unsupported version ${envelopeVersion}: ${options.filePath}`);
+var OFFLINE_CONFIG_KEYS = [
+  "offlineSyncExcludes",
+  "secureStoreEncryptOnWrite",
+  "recallImpressionsRotateBytes",
+  "recallImpressionsRotateKeep"
+];
+function pickOfflineConfigRecord(raw) {
+  let resolved;
+  try {
+    resolved = resolveRemnicConfigRecord3(raw);
+  } catch {
+    resolved = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   }
-  const salt = envelopeHeader.subarray(
-    ENVELOPE_LAYOUT.salt,
-    ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH
-  );
-  const iv = envelopeHeader.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);
-  const authTag = envelopeHeader.subarray(
-    ENVELOPE_LAYOUT.authTag,
-    ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH
-  );
-  const aadCandidates = offlineFileAadCandidates(options.filePath, options.memoryDir);
-  let lastError;
-  for (const aad of aadCandidates) {
-    const tempDir = await mkdtemp(path.join(options.memoryDir, OFFLINE_DECRYPT_STAGING_DIR_PREFIX));
-    const tempPath = path.join(tempDir, "content");
-    try {
-      const decipher = createDecipheriv("aes-256-gcm", options.key, iv, {
-        authTagLength: AUTH_TAG_LENGTH
-      });
-      decipher.setAuthTag(authTag);
-      decipher.setAAD(Buffer.concat([secureStoreEnvelopeHeaderAad(salt), aad]));
-      const output = fs4.createWriteStream(tempPath, { mode: 384 });
-      try {
-        const stream = fs4.createReadStream(options.filePath, {
-          start: MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE,
-          highWaterMark: options.chunkSize
-        });
-        for await (const encryptedChunk of stream) {
-          const plain = decipher.update(
-            Buffer.isBuffer(encryptedChunk) ? encryptedChunk : Buffer.from(encryptedChunk)
-          );
-          if (plain.length > 0 && !output.write(plain)) {
-            await new Promise((resolve, reject) => {
-              output.once("drain", resolve);
-              output.once("error", reject);
-            });
-          }
-        }
-        const finalPlain = decipher.final();
-        if (finalPlain.length > 0 && !output.write(finalPlain)) {
-          await new Promise((resolve, reject) => {
-            output.once("drain", resolve);
-            output.once("error", reject);
-          });
-        }
-      } finally {
-        await closeWriteStream(output);
-      }
-      yield* readPlainOfflineFileChunks(tempPath, options.chunkSize);
-      return;
-    } catch (error) {
-      lastError = error;
-    } finally {
-      await rm(tempDir, { recursive: true, force: true });
-    }
+  const picked = {};
+  for (const key of OFFLINE_CONFIG_KEYS) {
+    if (key in resolved) picked[key] = resolved[key];
   }
-  throw lastError instanceof Error ? lastError : new Error(`secure-store could not decrypt file: ${options.filePath}`);
+  return picked;
 }
-function offlineFileAadCandidates(filePath, memoryDir) {
-  const candidates = [filePathAad(filePath, memoryDir)];
-  const relative = path.relative(memoryDir, filePath);
-  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return candidates;
-  const parts = relative.split(path.sep);
-  if (parts[0] === "namespaces" && parts.length >= 3 && parts[1]) {
-    candidates.push(filePathAad(filePath, path.join(memoryDir, "namespaces", parts[1])));
+function resolveOfflineImpressionRotation(configPath) {
+  let raw;
+  try {
+    raw = fs5.existsSync(configPath) ? JSON.parse(fs5.readFileSync(configPath, "utf8")) : {};
+  } catch {
+    throw new Error(
+      `cannot read recall-impression rotation from ${configPath}: config file could not be read as JSON`
+    );
   }
-  const memoryParts = path.resolve(memoryDir).split(path.sep);
-  if (memoryParts.length >= 3 && memoryParts.at(-2) === "namespaces" && memoryParts.at(-1)) {
-    const topLevelRoot = memoryParts.slice(0, -2).join(path.sep) || path.sep;
-    const topRelative = path.relative(topLevelRoot, filePath);
-    if (topRelative && !topRelative.startsWith("..") && !path.isAbsolute(topRelative) && topRelative.split(path.sep)[0] === "namespaces" && topRelative.split(path.sep)[1] === memoryParts.at(-1)) {
-      candidates.push(filePathAad(filePath, topLevelRoot));
-    }
+  let config;
+  try {
+    config = parseConfigQuietly(pickOfflineConfigRecord(raw));
+  } catch {
+    throw new Error(
+      `cannot read recall-impression rotation from ${configPath}: config failed validation`
+    );
   }
-  return candidates;
-}
-async function closeWriteStream(stream) {
-  await new Promise((resolve, reject) => {
-    stream.once("error", reject);
-    stream.end(() => resolve());
-  });
+  return {
+    impressionsRotateBytes: config.recallImpressionsRotateBytes,
+    impressionsRotateKeep: config.recallImpressionsRotateKeep
+  };
 }
-function secureStoreEnvelopeHeaderAad(salt) {
-  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);
-  out.writeUInt8(ENVELOPE_VERSION, 0);
-  Buffer.from(salt).copy(out, 1);
-  return out;
+async function drainOfflineSyncImpressions(memoryDir, rotation) {
+  await drainPendingImpressionsForOfflineSync(
+    () => new LastRecallStore(memoryDir, {
+      impressionsRotateBytes: rotation.impressionsRotateBytes,
+      impressionsRotateKeep: rotation.impressionsRotateKeep
+    }).drainPendingImpressions()
+  );
 }
 
 // src/bench-build-freshness.ts
@@ -782,15 +1517,15 @@ import {
   readFileSync as readFileSync2,
   statSync
 } from "fs";
-import path2 from "path";
+import path3 from "path";
 import { fileURLToPath } from "url";
 var STALE_BUILD_TOLERANCE_MS = 1e3;
 function assertLocalBenchBuildFreshForDevelopment(currentModuleUrl) {
   if (isTruthyEnv(process.env.REMNIC_BENCH_ALLOW_STALE_DIST)) {
     return;
   }
-  const currentDir = path2.dirname(fileURLToPath(currentModuleUrl));
-  const benchPackageDir = path2.resolve(currentDir, "../../bench");
+  const currentDir = path3.dirname(fileURLToPath(currentModuleUrl));
+  const benchPackageDir = path3.resolve(currentDir, "../../bench");
   const freshness = checkBenchBuildFreshness(benchPackageDir);
   if (!freshness.stale) {
     return;
@@ -807,7 +1542,7 @@ function assertLocalBenchBuildFreshForDevelopment(currentModuleUrl) {
   );
 }
 function checkBenchBuildFreshness(benchPackageDir) {
-  const packageJsonPath = path2.join(benchPackageDir, "package.json");
+  const packageJsonPath = path3.join(benchPackageDir, "package.json");
   if (!existsSync2(packageJsonPath)) {
     return { stale: false };
   }
@@ -820,17 +1555,17 @@ function checkBenchBuildFreshness(benchPackageDir) {
   if (packageName !== "@remnic/bench") {
     return { stale: false };
   }
-  const srcDir = path2.join(benchPackageDir, "src");
+  const srcDir = path3.join(benchPackageDir, "src");
   if (!isDirectory(srcDir)) {
     return { stale: false };
   }
   const sourceRoots = [
     srcDir,
     packageJsonPath,
-    path2.join(benchPackageDir, "tsup.config.ts"),
-    path2.join(benchPackageDir, "tsconfig.json")
+    path3.join(benchPackageDir, "tsup.config.ts"),
+    path3.join(benchPackageDir, "tsconfig.json")
   ];
-  const distPath = path2.join(benchPackageDir, "dist", "index.js");
+  const distPath = path3.join(benchPackageDir, "dist", "index.js");
   if (!existsSync2(distPath)) {
     return {
       stale: true,
@@ -873,7 +1608,7 @@ function newestMtime(roots) {
     }
     if (stat.isDirectory()) {
       for (const child of readdirSync(entryPath)) {
-        visit(path2.join(entryPath, child));
+        visit(path3.join(entryPath, child));
       }
       return;
     }
@@ -906,18 +1641,18 @@ function isTruthyEnv(value) {
 
 // src/optional-bench.ts
 import { existsSync as existsSync3 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 var SPECIFIER2 = "@remnic/bench";
 var TSX_ESM_API_SPECIFIER = "tsx/esm/api";
 var cached2;
 var cachedFromLocalWorkspaceBenchSource = false;
 function resolveLocalWorkspaceBenchPaths() {
-  const currentDir = path3.dirname(fileURLToPath2(import.meta.url));
-  const benchPackageDir = path3.resolve(currentDir, "../../bench");
+  const currentDir = path4.dirname(fileURLToPath2(import.meta.url));
+  const benchPackageDir = path4.resolve(currentDir, "../../bench");
   return {
-    distEntry: path3.join(benchPackageDir, "dist", "index.js"),
-    sourceEntry: path3.join(benchPackageDir, "src", "index.ts")
+    distEntry: path4.join(benchPackageDir, "dist", "index.js"),
+    sourceEntry: path4.join(benchPackageDir, "src", "index.ts")
   };
 }
 async function tryImportLocalWorkspaceBenchSource(err) {
@@ -1004,8 +1739,8 @@ function assertBenchModuleFreshForDevelopment() {
 }
 
 // src/daemon-service-candidates.ts
-import fs5 from "fs";
-import path4 from "path";
+import fs6 from "fs";
+import path5 from "path";
 var LAUNCHD_LABEL = "ai.remnic.daemon";
 var LEGACY_REMNIC_SERVER_LAUNCHD_LABEL = "ai.remnic.server";
 var LEGACY_LAUNCHD_LABEL = "ai.engram.daemon";
@@ -1018,15 +1753,15 @@ var SYSTEMD_SERVICE = "remnic.service";
 var LEGACY_SYSTEMD_SERVICE = "engram.service";
 var SYSTEMD_SERVICE_CANDIDATES = [SYSTEMD_SERVICE, LEGACY_SYSTEMD_SERVICE];
 function launchdPlistPaths(homeDir) {
-  return LAUNCHD_LABEL_CANDIDATES.map((label) => path4.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));
+  return LAUNCHD_LABEL_CANDIDATES.map((label) => path5.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));
 }
 function systemdUnitPaths(homeDir) {
-  return SYSTEMD_SERVICE_CANDIDATES.map((service) => path4.join(homeDir, ".config", "systemd", "user", service));
+  return SYSTEMD_SERVICE_CANDIDATES.map((service) => path5.join(homeDir, ".config", "systemd", "user", service));
 }
 function anyFileExists(paths) {
   return paths.some((candidate) => {
     try {
-      return fs5.statSync(candidate).isFile();
+      return fs6.statSync(candidate).isFile();
     } catch {
       return false;
     }
@@ -1038,7 +1773,7 @@ function commandNames(command) {
 }
 function isRunnableNodeScript(filePath) {
   try {
-    const text = fs5.readFileSync(filePath, "utf8").slice(0, 4096);
+    const text = fs6.readFileSync(filePath, "utf8").slice(0, 4096);
     const firstLine = text.split(/\r?\n/, 1)[0] ?? "";
     if (/^#!.*\bnode\b/.test(firstLine)) return true;
     if (firstLine.startsWith("#!")) return false;
@@ -1051,20 +1786,20 @@ function isRunnableNodeScript(filePath) {
 function resolveShimNodeScript(filePath) {
   let text;
   try {
-    text = fs5.readFileSync(filePath, "utf8").slice(0, 16384);
+    text = fs6.readFileSync(filePath, "utf8").slice(0, 16384);
   } catch {
     return void 0;
   }
-  const basedir = path4.dirname(filePath);
+  const basedir = path5.dirname(filePath);
   const jsReferencePattern = /"([^"]+\.js)"|'([^']+\.js)'|([^\s"'`]+\.js)/g;
   for (const match of text.matchAll(jsReferencePattern)) {
     const raw = match[1] ?? match[2] ?? match[3];
     if (!raw) continue;
     const candidate = raw.replaceAll("${basedir}", basedir).replaceAll("$basedir", basedir).replaceAll("\\ ", " ");
-    const resolved = path4.isAbsolute(candidate) ? candidate : path4.resolve(basedir, candidate);
+    const resolved = path5.isAbsolute(candidate) ? candidate : path5.resolve(basedir, candidate);
     try {
-      if (fs5.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
-        return fs5.realpathSync(resolved);
+      if (fs6.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
+        return fs6.realpathSync(resolved);
       }
     } catch {
     }
@@ -1072,19 +1807,19 @@ function resolveShimNodeScript(filePath) {
   return void 0;
 }
 function resolveRunnableNodeScript(filePath) {
-  const realPath = fs5.realpathSync(filePath);
+  const realPath = fs6.realpathSync(filePath);
   if (isRunnableNodeScript(realPath)) return realPath;
   return resolveShimNodeScript(realPath);
 }
 function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
-  for (const dir of pathEnv.split(path4.delimiter)) {
+  for (const dir of pathEnv.split(path5.delimiter)) {
     if (!dir) continue;
     for (const name of commandNames(command)) {
-      const candidate = path4.join(dir, name);
+      const candidate = path5.join(dir, name);
       try {
-        const stat = fs5.statSync(candidate);
+        const stat = fs6.statSync(candidate);
         if (!stat.isFile()) continue;
-        if (process.platform !== "win32") fs5.accessSync(candidate, fs5.constants.X_OK);
+        if (process.platform !== "win32") fs6.accessSync(candidate, fs6.constants.X_OK);
         const runnable = resolveRunnableNodeScript(candidate);
         if (runnable) return runnable;
       } catch {
@@ -1094,11 +1829,11 @@ function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
   return void 0;
 }
 function serverBinWrapperRequiredPath(candidate) {
-  const filename = path4.basename(candidate);
+  const filename = path5.basename(candidate);
   if (filename !== "remnic-server.js" && filename !== "engram-server.js") return void 0;
-  const binDir = path4.dirname(candidate);
-  if (path4.basename(binDir) !== "bin") return void 0;
-  return path4.join(path4.dirname(binDir), "dist", "index.js");
+  const binDir = path5.dirname(candidate);
+  if (path5.basename(binDir) !== "bin") return void 0;
+  return path5.join(path5.dirname(binDir), "dist", "index.js");
 }
 
 // src/service-candidates.ts
@@ -1120,7 +1855,7 @@ function firstSuccessfulCandidate(candidates, attempt) {
 }
 
 // src/bench-args.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/bench-flags.ts
 function readBenchOptionValue(argv, flag) {
@@ -1498,7 +2233,7 @@ function expandTilde(p) {
 }
 
 // src/bench-args-research.ts
-import path5 from "path";
+import path6 from "path";
 function readPositiveInteger(args, flag) {
   const raw = readBenchOptionValue(args, flag);
   if (raw === void 0) return void 0;
@@ -1536,7 +2271,7 @@ function parseBenchResearchArgs(action, args) {
     }
     const outRaw = readBenchOptionValue(args, "--out");
     if (outRaw !== void 0) {
-      out = path5.resolve(expandTilde(outRaw));
+      out = path6.resolve(expandTilde(outRaw));
     }
   }
   const epochs = readPositiveInteger(args, "--epochs");
@@ -1550,7 +2285,7 @@ function parseBenchResearchArgs(action, args) {
   }
   return {
     runRef,
-    memoryDir: memoryDirRaw ? path5.resolve(expandTilde(memoryDirRaw)) : void 0,
+    memoryDir: memoryDirRaw ? path6.resolve(expandTilde(memoryDirRaw)) : void 0,
     users: readPositiveInteger(args, "--users"),
     epochs,
     seed,
@@ -1769,7 +2504,7 @@ function parseBenchArgs(argv) {
   }
   validateBenchFlags(action, args);
   const driftGenPositionals = action === "drift-gen" && driftGenAction === "validate" ? collectBenchmarks(args.slice(1)) : [];
-  const driftGenDir = driftGenPositionals[0] ? path6.resolve(expandTilde(driftGenPositionals[0])) : void 0;
+  const driftGenDir = driftGenPositionals[0] ? path7.resolve(expandTilde(driftGenPositionals[0])) : void 0;
   const benchmarkArgs = action === "baseline" || action === "datasets" || action === "providers" || action === "runs" || action === "drift-gen" && (args[0] === "validate" || args[0] === "generate") ? args.slice(1) : args;
   const benchmarks = collectBenchmarks(benchmarkArgs);
   const datasetDir = readBenchOptionValue(args, "--dataset-dir") ?? readBenchOptionValue(args, "--dataset");
@@ -2319,13 +3054,13 @@ function parseBenchArgs(argv) {
     mcpUrl,
     mcpToolMap,
     mcpDemo,
-    datasetDir: datasetDir ? path6.resolve(expandTilde(datasetDir)) : void 0,
-    resultsDir: resultsDir ? path6.resolve(expandTilde(resultsDir)) : void 0,
-    baselinesDir: baselinesDir ? path6.resolve(expandTilde(baselinesDir)) : void 0,
+    datasetDir: datasetDir ? path7.resolve(expandTilde(datasetDir)) : void 0,
+    resultsDir: resultsDir ? path7.resolve(expandTilde(resultsDir)) : void 0,
+    baselinesDir: baselinesDir ? path7.resolve(expandTilde(baselinesDir)) : void 0,
     runtimeProfile,
     matrixProfiles,
-    remnicConfigPath: remnicConfigRaw ? path6.resolve(expandTilde(remnicConfigRaw)) : void 0,
-    openclawConfigPath: openclawConfigRaw ? path6.resolve(expandTilde(openclawConfigRaw)) : void 0,
+    remnicConfigPath: remnicConfigRaw ? path7.resolve(expandTilde(remnicConfigRaw)) : void 0,
+    openclawConfigPath: openclawConfigRaw ? path7.resolve(expandTilde(openclawConfigRaw)) : void 0,
     modelSource,
     gatewayAgentId,
     fastGatewayAgentId,
@@ -2348,13 +3083,13 @@ function parseBenchArgs(argv) {
     internalDisableThinking: args.includes("--internal-disable-thinking"),
     internalCodexReasoningEffort,
     threshold,
-    custom: customRaw ? path6.resolve(expandTilde(customRaw)) : void 0,
+    custom: customRaw ? path7.resolve(expandTilde(customRaw)) : void 0,
     baselineAction,
     datasetAction,
     providerAction,
     runAction,
     format,
-    output: output ? path6.resolve(expandTilde(output)) : void 0,
+    output: output ? path7.resolve(expandTilde(output)) : void 0,
     target,
     publishedName,
     publishedSeed,
@@ -2364,24 +3099,24 @@ function parseBenchArgs(argv) {
     publishedIngestConcurrency,
     publishedTaskFilter,
     memcorrectAdapter,
-    publishedOut: publishedOutRaw ? path6.resolve(expandTilde(publishedOutRaw)) : void 0,
+    publishedOut: publishedOutRaw ? path7.resolve(expandTilde(publishedOutRaw)) : void 0,
     publishedDryRun: args.includes("--dry-run"),
     requestTimeout,
     localJudgeRequestTimeout,
     frontierJudgeRequestTimeout,
-    calibrationDir: calibrationDirRaw ? path6.resolve(expandTilde(calibrationDirRaw)) : void 0,
+    calibrationDir: calibrationDirRaw ? path7.resolve(expandTilde(calibrationDirRaw)) : void 0,
     calibrationLocalConfigSha256,
     calibrationFrontierConfigSha256,
     sourceResultId,
     expectedAnswerSetSha256,
     expectedQuestionIdListSha256,
-    taskIdsFile: taskIdsFileRaw ? path6.resolve(expandTilde(taskIdsFileRaw)) : void 0,
+    taskIdsFile: taskIdsFileRaw ? path7.resolve(expandTilde(taskIdsFileRaw)) : void 0,
     expectedTaskIdListSha256,
     drainTimeout,
     // Issue #1573 PR1: surface judge-cache flags into the runner options.
     noJudgeCache: args.includes("--no-judge-cache"),
-    judgeCacheDir: judgeCacheDirRaw ? path6.resolve(expandTilde(judgeCacheDirRaw)) : void 0,
-    localLabManifestPath: localLabManifestRaw ? path6.resolve(expandTilde(localLabManifestRaw)) : void 0,
+    judgeCacheDir: judgeCacheDirRaw ? path7.resolve(expandTilde(judgeCacheDirRaw)) : void 0,
+    localLabManifestPath: localLabManifestRaw ? path7.resolve(expandTilde(localLabManifestRaw)) : void 0,
     max429WaitMs,
     disableThinking: args.includes("--disable-thinking"),
     amaBenchJudgeProtocol,
@@ -2400,9 +3135,9 @@ function parseBenchArgs(argv) {
 
 // src/bench-status.ts
 import { mkdir, readFile, readdir as readdir2, rename, writeFile } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function createBenchStatusPath(resultsDir, pid, startedAtMs = Date.now()) {
-  return path7.join(resultsDir, `bench-status-${startedAtMs}-${pid}.json`);
+  return path8.join(resultsDir, `bench-status-${startedAtMs}-${pid}.json`);
 }
 var BENCH_STATUS_FILENAME = /^bench-status-\d+-\d+\.json$/;
 var VALID_BENCH_ENTRY_STATUSES = /* @__PURE__ */ new Set(["pending", "running", "complete", "failed"]);
@@ -2415,7 +3150,7 @@ async function findLatestBenchStatusFile(resultsDir) {
   }
   const candidates = entries.filter((name) => BENCH_STATUS_FILENAME.test(name)).sort().reverse();
   for (const name of candidates) {
-    const filePath = path7.join(resultsDir, name);
+    const filePath = path8.join(resultsDir, name);
     const status = await readBenchStatus(filePath);
     if (status) {
       return filePath;
@@ -2424,7 +3159,7 @@ async function findLatestBenchStatusFile(resultsDir) {
   return null;
 }
 async function atomicWriteJSON(filePath, data) {
-  await mkdir(path7.dirname(filePath), { recursive: true });
+  await mkdir(path8.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`;
   await writeFile(tmp, JSON.stringify(data, null, 2) + "\n");
   await rename(tmp, filePath);
@@ -2541,8 +3276,8 @@ function finalizeBenchStatus(filePath) {
 }
 
 // src/bench-fallback.ts
-import fs6 from "fs";
-import path8 from "path";
+import fs7 from "fs";
+import path9 from "path";
 var FALLBACK_RESULTS_DIRNAME = "fallback-runs";
 function buildBenchRunnerArgs(parsed, benchmarkId, outputDir) {
   const args = ["--benchmark", benchmarkId];
@@ -2606,34 +3341,34 @@ function findUnsupportedFallbackBenchOptions(parsed) {
   return unsupported;
 }
 function createFallbackBenchOutputDir(resultsDir, benchmarkId, pid, startedAtMs = Date.now()) {
-  return path8.join(
+  return path9.join(
     resultsDir,
     FALLBACK_RESULTS_DIRNAME,
     `${benchmarkId}-${startedAtMs}-${pid}`
   );
 }
 function resolveFallbackBenchResultPath(outputDir) {
-  const entries = fs6.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
+  const entries = fs7.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
   if (entries.length === 0) {
     throw new Error(`Fallback benchmark runner did not write a JSON result artifact in ${outputDir}`);
   }
-  return path8.join(outputDir, entries[0]);
+  return path9.join(outputDir, entries[0]);
 }
 
 // src/openclaw-upgrade-swap.ts
-import fs7 from "fs";
-import path9 from "path";
+import fs8 from "fs";
+import path10 from "path";
 function describeError(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function createSiblingTempFilePath(targetPath, label) {
   const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2, 10)}`;
-  return path9.join(path9.dirname(targetPath), `.${path9.basename(targetPath)}.${label}.${nonce}.tmp`);
+  return path10.join(path10.dirname(targetPath), `.${path10.basename(targetPath)}.${label}.${nonce}.tmp`);
 }
 function resolveAtomicWriteMode(targetPath, explicitMode) {
   if (explicitMode !== void 0) return explicitMode;
   try {
-    return fs7.statSync(targetPath).mode & 4095;
+    return fs8.statSync(targetPath).mode & 4095;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return 384;
@@ -2643,8 +3378,8 @@ function resolveAtomicWriteMode(targetPath, explicitMode) {
 }
 function resolveAtomicReplacementPath(targetPath) {
   try {
-    if (fs7.lstatSync(targetPath).isSymbolicLink()) {
-      return fs7.realpathSync(targetPath);
+    if (fs8.lstatSync(targetPath).isSymbolicLink()) {
+      return fs8.realpathSync(targetPath);
     }
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -2656,12 +3391,12 @@ function resolveAtomicReplacementPath(targetPath) {
 }
 function createSiblingSwapPath(targetDir, label) {
   const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2, 10)}`;
-  return path9.join(path9.dirname(targetDir), `.${path9.basename(targetDir)}.${label}.${nonce}`);
+  return path10.join(path10.dirname(targetDir), `.${path10.basename(targetDir)}.${label}.${nonce}`);
 }
 function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
   if (!displacedDir) return void 0;
   try {
-    fs7.rmSync(displacedDir, { recursive: true, force: true });
+    fs8.rmSync(displacedDir, { recursive: true, force: true });
     return void 0;
   } catch (error) {
     return `Warning: ${context}, but failed to remove the displaced plugin copy at ${displacedDir}: ${describeError(error)}`;
@@ -2669,55 +3404,55 @@ function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
 }
 function atomicWriteFileSync(targetPath, data, options = {}) {
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs7.mkdirSync(path9.dirname(resolvedTargetPath), { recursive: true });
+  fs8.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "write");
   const mode = resolveAtomicWriteMode(resolvedTargetPath, options.mode);
   try {
     if (options.hooks?.writeTempFileSync) {
       options.hooks.writeTempFileSync(tempPath);
     } else {
-      fs7.writeFileSync(tempPath, data, { mode });
+      fs8.writeFileSync(tempPath, data, { mode });
     }
-    fs7.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs7.renameSync;
+    fs8.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs8.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs7.rmSync(tempPath, { force: true });
+    fs8.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function atomicCopyFileSync(sourcePath, targetPath, options = {}) {
-  if (!fs7.existsSync(sourcePath)) return;
+  if (!fs8.existsSync(sourcePath)) return;
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs7.mkdirSync(path9.dirname(resolvedTargetPath), { recursive: true });
+  fs8.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "copy");
-  const mode = fs7.statSync(sourcePath).mode & 4095;
+  const mode = fs8.statSync(sourcePath).mode & 4095;
   try {
-    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs7.copyFileSync;
+    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs8.copyFileSync;
     copyTempFileSync(sourcePath, tempPath);
-    fs7.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs7.renameSync;
+    fs8.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs8.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs7.rmSync(tempPath, { force: true });
+    fs8.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function swapDirectoryWithRollback(stagedDir, targetDir, rollbackDir) {
   let hasRollbackCopy = false;
-  fs7.mkdirSync(path9.dirname(targetDir), { recursive: true });
-  fs7.rmSync(rollbackDir, { recursive: true, force: true });
-  if (fs7.existsSync(targetDir)) {
-    fs7.renameSync(targetDir, rollbackDir);
+  fs8.mkdirSync(path10.dirname(targetDir), { recursive: true });
+  fs8.rmSync(rollbackDir, { recursive: true, force: true });
+  if (fs8.existsSync(targetDir)) {
+    fs8.renameSync(targetDir, rollbackDir);
     hasRollbackCopy = true;
   }
   try {
-    fs7.renameSync(stagedDir, targetDir);
+    fs8.renameSync(stagedDir, targetDir);
   } catch (swapError) {
-    fs7.rmSync(targetDir, { recursive: true, force: true });
-    if (hasRollbackCopy && fs7.existsSync(rollbackDir)) {
+    fs8.rmSync(targetDir, { recursive: true, force: true });
+    if (hasRollbackCopy && fs8.existsSync(rollbackDir)) {
       try {
-        fs7.renameSync(rollbackDir, targetDir);
+        fs8.renameSync(rollbackDir, targetDir);
         hasRollbackCopy = false;
       } catch (restoreError) {
         throw new AggregateError(
@@ -2732,7 +3467,7 @@ function swapDirectoryWithRollback(stagedDir, targetDir, rollbackDir) {
 }
 function cleanupRollbackDirectory(rollbackDir) {
   if (!rollbackDir) return;
-  fs7.rmSync(rollbackDir, { recursive: true, force: true });
+  fs8.rmSync(rollbackDir, { recursive: true, force: true });
 }
 function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   if (!rollbackDir) return void 0;
@@ -2744,20 +3479,20 @@ function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   }
 }
 function restoreDirectoryFromRollback(targetDir, rollbackDir) {
-  if (!fs7.existsSync(rollbackDir)) {
+  if (!fs8.existsSync(rollbackDir)) {
     throw new Error(`Rollback directory is missing: ${rollbackDir}`);
   }
-  fs7.mkdirSync(path9.dirname(targetDir), { recursive: true });
-  const displacedDir = fs7.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
+  fs8.mkdirSync(path10.dirname(targetDir), { recursive: true });
+  const displacedDir = fs8.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
   if (displacedDir) {
-    fs7.renameSync(targetDir, displacedDir);
+    fs8.renameSync(targetDir, displacedDir);
   }
   try {
-    fs7.renameSync(rollbackDir, targetDir);
+    fs8.renameSync(rollbackDir, targetDir);
   } catch (restoreError) {
-    if (displacedDir && fs7.existsSync(displacedDir)) {
+    if (displacedDir && fs8.existsSync(displacedDir)) {
       try {
-        fs7.renameSync(displacedDir, targetDir);
+        fs8.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -2776,23 +3511,23 @@ function restoreDirectoryFromRollback(targetDir, rollbackDir) {
   );
 }
 function restoreDirectoryFromBackup(targetDir, backupDir) {
-  if (!fs7.existsSync(backupDir)) {
+  if (!fs8.existsSync(backupDir)) {
     throw new Error(`Plugin backup directory is missing: ${backupDir}`);
   }
-  fs7.mkdirSync(path9.dirname(targetDir), { recursive: true });
+  fs8.mkdirSync(path10.dirname(targetDir), { recursive: true });
   const stagedDir = createSiblingSwapPath(targetDir, "backup-restore");
-  const displacedDir = fs7.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
-  fs7.cpSync(backupDir, stagedDir, { recursive: true });
+  const displacedDir = fs8.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
+  fs8.cpSync(backupDir, stagedDir, { recursive: true });
   if (displacedDir) {
-    fs7.renameSync(targetDir, displacedDir);
+    fs8.renameSync(targetDir, displacedDir);
   }
   try {
-    fs7.renameSync(stagedDir, targetDir);
+    fs8.renameSync(stagedDir, targetDir);
   } catch (restoreError) {
-    fs7.rmSync(targetDir, { recursive: true, force: true });
-    if (displacedDir && fs7.existsSync(displacedDir)) {
+    fs8.rmSync(targetDir, { recursive: true, force: true });
+    if (displacedDir && fs8.existsSync(displacedDir)) {
       try {
-        fs7.renameSync(displacedDir, targetDir);
+        fs8.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -2800,7 +3535,7 @@ function restoreDirectoryFromBackup(targetDir, backupDir) {
         );
       }
     }
-    fs7.rmSync(stagedDir, { recursive: true, force: true });
+    fs8.rmSync(stagedDir, { recursive: true, force: true });
     throw new Error(
       `Failed to restore the plugin backup into ${targetDir}. The durable backup remains preserved at ${backupDir}.`,
       { cause: restoreError }
@@ -2826,7 +3561,7 @@ function rollbackOpenclawUpgrade({
   let rollbackRestoreError;
   let pluginRestored = false;
   try {
-    if (rollbackDir && fs7.existsSync(rollbackDir)) {
+    if (rollbackDir && fs8.existsSync(rollbackDir)) {
       const cleanupWarning = restoreDirectoryFromRollback(pluginDir, rollbackDir);
       notes.push(`Restored previous plugin from rollback copy at ${rollbackDir}`);
       if (cleanupWarning) notes.push(cleanupWarning);
@@ -2836,7 +3571,7 @@ function rollbackOpenclawUpgrade({
     rollbackRestoreError = error instanceof Error ? error.message : String(error);
   }
   try {
-    if (!pluginRestored && pluginBackupDir && fs7.existsSync(pluginBackupDir)) {
+    if (!pluginRestored && pluginBackupDir && fs8.existsSync(pluginBackupDir)) {
       const cleanupWarning = restoreDirectoryFromBackup(pluginDir, pluginBackupDir);
       if (rollbackRestoreError) {
         notes.push(
@@ -2863,7 +3598,7 @@ function rollbackOpenclawUpgrade({
     notes.push("No previous plugin copy was available for automatic restore");
   }
   try {
-    if (configBackupPath && fs7.existsSync(configBackupPath)) {
+    if (configBackupPath && fs8.existsSync(configBackupPath)) {
       restoreFileFromBackup(configPath, configBackupPath);
       notes.push(`Restored OpenClaw config from backup at ${configBackupPath}`);
     }
@@ -2903,11 +3638,11 @@ Run this manually when you're ready:
 }
 
 // src/daemon-service.ts
-import fs8 from "fs";
-import path10 from "path";
+import fs9 from "fs";
+import path11 from "path";
 import * as childProcess from "child_process";
 import { fileURLToPath as fileURLToPath3 } from "url";
-var thisModuleDir = path10.dirname(fileURLToPath3(import.meta.url));
+var thisModuleDir = path11.dirname(fileURLToPath3(import.meta.url));
 function launchdLoadPlist(plistPath, processApi = childProcess) {
   processApi.execFileSync("launchctl", ["load", "-w", plistPath], { stdio: "pipe" });
 }
@@ -2915,7 +3650,7 @@ function launchdUnloadPlist(plistPath, processApi = childProcess) {
   processApi.execFileSync("launchctl", ["unload", plistPath], { stdio: "pipe" });
 }
 function resolveServerBinDetails(options = {}) {
-  const existsSync4 = options.existsSync ?? fs8.existsSync;
+  const existsSync4 = options.existsSync ?? fs9.existsSync;
   const findCommandOnPath2 = options.findCommandOnPath ?? findCommandOnPath;
   const moduleDir = options.moduleDir ?? thisModuleDir;
   const packageResolve = options.packageResolve ?? resolveImportSpecifier;
@@ -2929,8 +3664,8 @@ function resolveServerBinDetails(options = {}) {
     });
   } catch {
   }
-  const workspaceServerBin = path10.resolve(moduleDir, "../../remnic-server/bin/remnic-server.js");
-  const workspaceDistIndex = path10.resolve(moduleDir, "../../remnic-server/dist/index.js");
+  const workspaceServerBin = path11.resolve(moduleDir, "../../remnic-server/bin/remnic-server.js");
+  const workspaceDistIndex = path11.resolve(moduleDir, "../../remnic-server/dist/index.js");
   candidates.push(
     {
       path: workspaceServerBin,
@@ -2951,11 +3686,11 @@ function resolveServerBinDetails(options = {}) {
     });
   }
   candidates.push({
-    path: path10.resolve(moduleDir, "../../remnic-server/src/index.ts"),
+    path: path11.resolve(moduleDir, "../../remnic-server/src/index.ts"),
     source: "workspace-source"
   });
   const selected = candidates.find((candidate) => isCandidateReady(candidate, existsSync4)) ?? candidates.find((candidate) => existsSync4(candidate.path)) ?? candidates[0] ?? {
-    path: path10.resolve(moduleDir, "../../remnic-server/dist/index.js"),
+    path: path11.resolve(moduleDir, "../../remnic-server/dist/index.js"),
     source: "workspace-dist"
   };
   const exists = existsSync4(selected.path);
@@ -2974,8 +3709,8 @@ function resolveServerBin(options = {}) {
   return resolveServerBinDetails(options).path;
 }
 function readVerifiedDaemonPid(options) {
-  const readFileSync4 = options.readFileSync ?? fs8.readFileSync;
-  const unlinkSync = options.unlinkSync ?? fs8.unlinkSync;
+  const readFileSync4 = options.readFileSync ?? fs9.readFileSync;
+  const unlinkSync = options.unlinkSync ?? fs9.unlinkSync;
   const processKill = options.processKill ?? process.kill;
   const platform = options.platform ?? process.platform;
   const execFileSync3 = options.execFileSync ?? ((command, args, execOptions) => childProcess.execFileSync(command, args, execOptions));
@@ -3010,7 +3745,7 @@ function readVerifiedDaemonPid(options) {
 }
 function doesProcessCommandLookLikeRemnicDaemon(command, expectedServerBin) {
   const normalizedCommand = command.trim();
-  const normalizedExpected = path10.resolve(expandTilde(expectedServerBin));
+  const normalizedExpected = path11.resolve(expandTilde(expectedServerBin));
   return normalizedCommand.includes(normalizedExpected) || /(?:^|\s|[/\\])(?:remnic-server|engram-server)(?:\.js)?(?:\s|$)/.test(normalizedCommand) || /@remnic[/\\]server[/\\]/.test(normalizedCommand) || /packages[/\\]remnic-server[/\\](?:bin[/\\]remnic-server\.js|dist[/\\]index\.js|src[/\\]index\.ts)/.test(normalizedCommand);
 }
 function parseDaemonPid(raw) {
@@ -3075,8 +3810,8 @@ function removePidFileBestEffort(file, unlinkSync) {
   }
 }
 function inspectLaunchdPlist(plistPath, options = {}) {
-  const existsSync4 = options.existsSync ?? fs8.existsSync;
-  const readFileSync4 = options.readFileSync ?? fs8.readFileSync;
+  const existsSync4 = options.existsSync ?? fs9.existsSync;
+  const readFileSync4 = options.readFileSync ?? fs9.readFileSync;
   if (!existsSync4(plistPath)) {
     return {
       installed: false,
@@ -3115,7 +3850,7 @@ function inspectLaunchdPlist(plistPath, options = {}) {
     };
   }
   const expandedServerArg = expandTilde(serverArg);
-  if (!path10.isAbsolute(expandedServerArg)) {
+  if (!path11.isAbsolute(expandedServerArg)) {
     return {
       installed: true,
       ok: false,
@@ -3187,8 +3922,8 @@ function normalizeResolvedPath(resolved) {
   return resolved;
 }
 function packageServerBinFromEntry(packageEntry) {
-  if (path10.basename(packageEntry) === "index.js" && path10.basename(path10.dirname(packageEntry)) === "dist") {
-    return path10.join(path10.dirname(path10.dirname(packageEntry)), "bin", "remnic-server.js");
+  if (path11.basename(packageEntry) === "index.js" && path11.basename(path11.dirname(packageEntry)) === "dist") {
+    return path11.join(path11.dirname(path11.dirname(packageEntry)), "bin", "remnic-server.js");
   }
   return packageEntry;
 }
@@ -3310,7 +4045,7 @@ function stripConfigArgv(args) {
 }
 
 // src/import-dispatch.ts
-import fs9 from "fs";
+import fs10 from "fs";
 import {
   runImporter,
   validateImportBatchSize,
@@ -3319,7 +4054,7 @@ import {
 
 // src/import-bundle-detect.ts
 import { lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import path11 from "path";
+import path12 from "path";
 function detectBundleEntries(bundleDir, options = {}) {
   const readdir3 = options.readdirImpl ?? defaultReaddir;
   const readFileImpl = options.readFileImpl ?? defaultReadFile;
@@ -3350,7 +4085,7 @@ function detectBundleEntries(bundleDir, options = {}) {
   for (const filePath of roots) {
     if (seenFiles.has(filePath)) continue;
     seenFiles.add(filePath);
-    const name = path11.basename(filePath);
+    const name = path12.basename(filePath);
     const match = classifyFile(name, filePath, readFileImpl);
     if (match) entries.push(match);
   }
@@ -3388,7 +4123,7 @@ function collectCandidatePaths(root, readdir3, isDirectory2, isRegularFile) {
       return;
     }
     for (const entry of entries) {
-      const full = path11.join(dir, entry);
+      const full = path12.join(dir, entry);
       if (isDirectory2(full)) {
         walk(full, depth + 1);
       } else if (isRegularFile(full)) {
@@ -3824,7 +4559,7 @@ async function cmdImport(rest, targetFactory, disposeTarget, ioOverrides = {}) {
   let materializedTarget;
   let materializePromise;
   const io = {
-    readFile: ioOverrides.readFile ?? (async (p) => fs9.promises.readFile(p, "utf-8")),
+    readFile: ioOverrides.readFile ?? (async (p) => fs10.promises.readFile(p, "utf-8")),
     loadAdapter: ioOverrides.loadAdapter ?? (async (name) => (await loadImporterModule(name)).adapter),
     runImporter: ioOverrides.runImporter ?? runImporter,
     getWriteTarget: async () => {
@@ -3937,8 +4672,8 @@ async function cmdCapture(rest, io) {
 }
 
 // src/import-lossless-claw-cmd.ts
-import fs10 from "fs";
-import path12 from "path";
+import fs11 from "fs";
+import path13 from "path";
 import {
   applyLcmSchema,
   ensureLcmStateDir,
@@ -4049,15 +4784,15 @@ async function loadImportLosslessClawModule() {
 
 // src/import-lossless-claw-cmd.ts
 function assertDirectoryOrAbsent(p, label) {
-  if (fs10.existsSync(p) && !fs10.statSync(p).isDirectory()) {
+  if (fs11.existsSync(p) && !fs11.statSync(p).isDirectory()) {
     throw new Error(`${label} is not a directory: ${p}`);
   }
 }
 function assertFile(p, label) {
-  if (!fs10.existsSync(p)) {
+  if (!fs11.existsSync(p)) {
     throw new Error(`${label} does not exist: ${p}`);
   }
-  if (!fs10.statSync(p).isFile()) {
+  if (!fs11.statSync(p).isFile()) {
     throw new Error(`${label} is not a file: ${p}`);
   }
 }
@@ -4088,8 +4823,8 @@ async function cmdImportLosslessClaw(argv, io, deps = {}) {
     let destDb;
     try {
       if (parsed.dryRun) {
-        const lcmPath = path12.join(memoryDir, "state", "lcm.sqlite");
-        if (fs10.existsSync(lcmPath)) {
+        const lcmPath = path13.join(memoryDir, "state", "lcm.sqlite");
+        if (fs11.existsSync(lcmPath)) {
           destDb = mod.openExistingLcmDatabaseReadOnly(lcmPath);
         } else {
           destDb = mod.openInMemoryDestinationDatabase();
@@ -4207,7 +4942,7 @@ function printBenchComparisonSummary(comparison, baseline, candidate) {
 }
 
 // src/bench-research-commands.ts
-import path13 from "path";
+import path14 from "path";
 function emit(result) {
   if (result.output) {
     console.log(result.output);
@@ -4225,7 +4960,7 @@ async function runBenchResearchCommand(parsed) {
     emit(
       await runAttributeCliCommand({
         runRef: parsed.runRef,
-        resultsDir: parsed.resultsDir ?? path13.join(resolveHomeDir(), ".remnic", "bench", "results"),
+        resultsDir: parsed.resultsDir ?? path14.join(resolveHomeDir(), ".remnic", "bench", "results"),
         memoryDir: parsed.memoryDir,
         threshold: parsed.threshold,
         json: parsed.json
@@ -4480,15 +5215,15 @@ registerPublisher("omp", () => new LazyPluginPiPublisher("omp", (mod) => mod.Omp
 function readCompatEnv(primary, legacy) {
   return process.env[primary] ?? process.env[legacy];
 }
-var PID_DIR = path14.join(resolveHomeDir(), ".remnic");
-var LEGACY_PID_DIR = path14.join(resolveHomeDir(), ".engram");
-var PID_FILE = path14.join(PID_DIR, "server.pid");
-var LEGACY_PID_FILE = path14.join(LEGACY_PID_DIR, "server.pid");
-var LOG_FILE = path14.join(PID_DIR, "server.log");
-var LEGACY_LOG_FILE = path14.join(LEGACY_PID_DIR, "server.log");
-var CLI_MODULE_DIR = path14.dirname(fileURLToPath4(import.meta.url));
-var CLI_REPO_ROOT = path14.resolve(CLI_MODULE_DIR, "../../..");
-var EVAL_RUNNER_PATH = path14.join(CLI_REPO_ROOT, "evals", "run.ts");
+var PID_DIR = path15.join(resolveHomeDir(), ".remnic");
+var LEGACY_PID_DIR = path15.join(resolveHomeDir(), ".engram");
+var PID_FILE = path15.join(PID_DIR, "server.pid");
+var LEGACY_PID_FILE = path15.join(LEGACY_PID_DIR, "server.pid");
+var LOG_FILE = path15.join(PID_DIR, "server.log");
+var LEGACY_LOG_FILE = path15.join(LEGACY_PID_DIR, "server.log");
+var CLI_MODULE_DIR = path15.dirname(fileURLToPath4(import.meta.url));
+var CLI_REPO_ROOT = path15.resolve(CLI_MODULE_DIR, "../../..");
+var EVAL_RUNNER_PATH = path15.join(CLI_REPO_ROOT, "evals", "run.ts");
 var OPENCLAW_GATEWAY_LABEL = "ai.openclaw.gateway";
 var CLI_SUCCESS_EXIT_GRACE_MS = 5e3;
 var CLI_OUTPUT_FLUSH_GRACE_MS = 250;
@@ -4653,7 +5388,7 @@ async function resolveAllBenchmarks() {
   if (packageBenchmarks) {
     return packageBenchmarks.filter((entry) => entry.runnerAvailable).map((entry) => entry.id);
   }
-  if (!fs11.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs12.existsSync(EVAL_RUNNER_PATH)) {
     return [];
   }
   return BENCHMARK_CATALOG.filter((entry) => entry.category !== "ingestion").map((entry) => entry.id);
@@ -4701,17 +5436,17 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
       `Fallback benchmark runner does not support provider-backed, gateway, or thinking/timeout flags (${unsupportedOptions.join(", ")}). Build/install @remnic/bench to use those options.`
     );
   }
-  if (!fs11.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs12.existsSync(EVAL_RUNNER_PATH)) {
     console.error(
       "Benchmark runner not found. Expected eval runner at evals/run.ts or a phase-1 @remnic/bench runtime export."
     );
     process.exit(1);
   }
   const tsxCandidates = [
-    path14.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
-    path14.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
+    path15.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
+    path15.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
   ];
-  const tsxCmd = tsxCandidates.find((candidate) => fs11.existsSync(candidate)) ?? "tsx";
+  const tsxCmd = tsxCandidates.find((candidate) => fs12.existsSync(candidate)) ?? "tsx";
   const fallbackOutputDir = createFallbackBenchOutputDir(
     parsed.resultsDir ?? resolveBenchOutputDir(),
     benchmarkId,
@@ -4728,7 +5463,7 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
   return resolveFallbackBenchResultPath(fallbackOutputDir);
 }
 function resolveBenchOutputDir() {
-  return path14.join(resolveHomeDir(), ".remnic", "bench", "results");
+  return path15.join(resolveHomeDir(), ".remnic", "bench", "results");
 }
 var DOWNLOADABLE_BENCHMARK_DATASETS = [
   "ama-bench",
@@ -4773,8 +5508,8 @@ var MEMORY_AGENT_BENCH_SPLIT_FILENAMES = [
 ];
 var MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES = [
   "entity2id.json",
-  path14.join("processed_data", "Recsys_Redial", "entity2id.json"),
-  path14.join("Recsys_Redial", "entity2id.json")
+  path15.join("processed_data", "Recsys_Redial", "entity2id.json"),
+  path15.join("Recsys_Redial", "entity2id.json")
 ];
 var DOWNLOADED_DATASET_MARKERS = {
   "ama-bench": { anyOf: ["open_end_qa_set.jsonl"] },
@@ -4849,18 +5584,18 @@ var PERSONAMEM_DATASET_FILE_CANDIDATES = [
   "benchmark/benchmark.csv",
   "benchmark.csv"
 ];
-var PERSONAMEM_COMPLETION_MARKER = path14.join(
+var PERSONAMEM_COMPLETION_MARKER = path15.join(
   "data",
   "chat_history_32k",
   ".download-complete"
 );
 function resolveRealpathWithinDataset(datasetPath, relativePath) {
   try {
-    const datasetRoot = fs11.realpathSync(datasetPath);
-    const candidatePath = path14.resolve(datasetRoot, relativePath);
-    const candidateRealPath = fs11.realpathSync(candidatePath);
-    const relativeToRoot = path14.relative(datasetRoot, candidateRealPath);
-    if (relativeToRoot.startsWith("..") || path14.isAbsolute(relativeToRoot)) {
+    const datasetRoot = fs12.realpathSync(datasetPath);
+    const candidatePath = path15.resolve(datasetRoot, relativePath);
+    const candidateRealPath = fs12.realpathSync(candidatePath);
+    const relativeToRoot = path15.relative(datasetRoot, candidateRealPath);
+    if (relativeToRoot.startsWith("..") || path15.isAbsolute(relativeToRoot)) {
       return null;
     }
     return candidateRealPath;
@@ -4916,15 +5651,15 @@ function parseCsvRows(raw) {
 }
 function isPersonaMemDatasetComplete(datasetPath) {
   try {
-    const completionMarkerPath = path14.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
-    if (fs11.statSync(completionMarkerPath).isFile()) {
+    const completionMarkerPath = path15.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
+    if (fs12.statSync(completionMarkerPath).isFile()) {
       return true;
     }
   } catch {
   }
   const datasetFile = PERSONAMEM_DATASET_FILE_CANDIDATES.find((candidate) => {
     try {
-      return fs11.statSync(path14.join(datasetPath, candidate)).isFile();
+      return fs12.statSync(path15.join(datasetPath, candidate)).isFile();
     } catch {
       return false;
     }
@@ -4933,7 +5668,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     return false;
   }
   try {
-    const rows = parseCsvRows(fs11.readFileSync(path14.join(datasetPath, datasetFile), "utf8"));
+    const rows = parseCsvRows(fs12.readFileSync(path15.join(datasetPath, datasetFile), "utf8"));
     if (rows.length < 2) {
       return false;
     }
@@ -4948,7 +5683,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     }
     return historyPaths.every((relativePath) => {
       const resolvedPath = resolveRealpathWithinDataset(datasetPath, relativePath);
-      return resolvedPath !== null && fs11.statSync(resolvedPath).isFile();
+      return resolvedPath !== null && fs12.statSync(resolvedPath).isFile();
     });
   } catch {
     return false;
@@ -4956,14 +5691,14 @@ function isPersonaMemDatasetComplete(datasetPath) {
 }
 function hasDatasetFile(datasetPath, relativePath) {
   try {
-    return fs11.statSync(path14.join(datasetPath, relativePath)).isFile();
+    return fs12.statSync(path15.join(datasetPath, relativePath)).isFile();
   } catch {
     return false;
   }
 }
 function hasMemoryAgentBenchEntityMapping(datasetPath) {
-  const absoluteDatasetPath = path14.resolve(datasetPath);
-  const roots = [absoluteDatasetPath, path14.dirname(absoluteDatasetPath)];
+  const absoluteDatasetPath = path15.resolve(datasetPath);
+  const roots = [absoluteDatasetPath, path15.dirname(absoluteDatasetPath)];
   return hasDatasetFile(absoluteDatasetPath, "entity2id.json") || roots.some(
     (root) => MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES.filter((relativePath) => relativePath !== "entity2id.json").some((relativePath) => hasDatasetFile(root, relativePath))
   );
@@ -4974,12 +5709,12 @@ function memoryAgentBenchDatasetHasRecSysSamples(datasetPath) {
     ...MEMORY_AGENT_BENCH_SPLIT_FILENAMES
   ];
   return candidateFilenames.some((filename) => {
-    const filePath = path14.join(datasetPath, filename);
+    const filePath = path15.join(datasetPath, filename);
     try {
-      if (!fs11.statSync(filePath).isFile()) {
+      if (!fs12.statSync(filePath).isFile()) {
         return false;
       }
-      const raw = fs11.readFileSync(filePath, "utf8");
+      const raw = fs12.readFileSync(filePath, "utf8");
       return /"source"\s*:\s*"recsys[_-]/i.test(raw);
     } catch {
       return false;
@@ -4995,7 +5730,7 @@ function isMemoryAgentBenchDatasetComplete(datasetPath) {
 function isDatasetDownloaded(datasetPath, benchmarkId) {
   let stats;
   try {
-    stats = fs11.statSync(datasetPath);
+    stats = fs12.statSync(datasetPath);
   } catch {
     return false;
   }
@@ -5005,7 +5740,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   const marker = DOWNLOADED_DATASET_MARKERS[benchmarkId];
   if (!marker) {
     try {
-      return fs11.readdirSync(datasetPath).length > 0;
+      return fs12.readdirSync(datasetPath).length > 0;
     } catch {
       return false;
     }
@@ -5013,7 +5748,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.allOf) {
     const hasAllRequiredFiles = marker.allOf.every((name) => {
       try {
-        return fs11.statSync(path14.join(datasetPath, name)).isFile();
+        return fs12.statSync(path15.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -5025,7 +5760,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.anyOf) {
     const hasMarkerFile = marker.anyOf.some((name) => {
       try {
-        return fs11.statSync(path14.join(datasetPath, name)).isFile();
+        return fs12.statSync(path15.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -5043,7 +5778,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   }
   if (marker.ext) {
     try {
-      return fs11.readdirSync(datasetPath).some(
+      return fs12.readdirSync(datasetPath).some(
         (name) => name.endsWith(marker.ext) && !marker.exclude?.includes(name)
       );
     } catch {
@@ -5053,9 +5788,9 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   return false;
 }
 async function launchBenchUi(resultsDir) {
-  const benchUiDir = path14.join(CLI_REPO_ROOT, "packages", "bench-ui");
+  const benchUiDir = path15.join(CLI_REPO_ROOT, "packages", "bench-ui");
   const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
-  if (!fs11.existsSync(path14.join(benchUiDir, "package.json"))) {
+  if (!fs12.existsSync(path15.join(benchUiDir, "package.json"))) {
     console.error("ERROR: @remnic/bench-ui is not available in this checkout.");
     process.exit(1);
   }
@@ -5082,24 +5817,24 @@ async function launchBenchUi(resultsDir) {
   });
 }
 function resolveRepoDatasetRoot() {
-  const repoCandidate = path14.join(CLI_REPO_ROOT, "evals", "datasets");
+  const repoCandidate = path15.join(CLI_REPO_ROOT, "evals", "datasets");
   if (isRepoCheckout()) {
     return repoCandidate;
   }
-  return path14.join(resolveHomeDir(), ".remnic", "bench", "datasets");
+  return path15.join(resolveHomeDir(), ".remnic", "bench", "datasets");
 }
 function listDownloadableBenchmarks() {
   return [...DOWNLOADABLE_BENCHMARK_DATASETS];
 }
 function resolveDatasetDownloadScriptPath() {
-  const bundled = path14.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
-  if (fs11.existsSync(bundled)) {
+  const bundled = path15.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
+  if (fs12.existsSync(bundled)) {
     return bundled;
   }
-  return path14.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
+  return path15.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
 }
 function isRepoCheckout() {
-  return fs11.existsSync(path14.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs11.existsSync(path14.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
+  return fs12.existsSync(path15.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs12.existsSync(path15.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
 }
 function runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, jsonMode) {
   const stdio = jsonMode ? ["inherit", process.stderr, "inherit"] : "inherit";
@@ -5150,7 +5885,7 @@ function resolveBenchDatasetDir(benchmarkId, quick, datasetDirOverride) {
   if (quick) {
     return void 0;
   }
-  const datasetDir = path14.join(resolveRepoDatasetRoot(), benchmarkId);
+  const datasetDir = path15.join(resolveRepoDatasetRoot(), benchmarkId);
   if (isDatasetDownloaded(datasetDir, benchmarkId)) {
     return datasetDir;
   }
@@ -5407,13 +6142,13 @@ async function exportBenchPackageResult(parsed) {
     process.exit(1);
   }
   const result = await loadBenchmarkResult(summary.path);
-  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path14.dirname(summary.path), result.meta.id) : void 0;
+  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path15.dirname(summary.path), result.meta.id) : void 0;
   const rendered = renderBenchmarkResultExport(result, parsed.format, {
     ...reportCardProvenance ? { reportCardProvenance } : {}
   });
   if (parsed.output) {
-    fs11.mkdirSync(path14.dirname(parsed.output), { recursive: true });
-    fs11.writeFileSync(parsed.output, rendered);
+    fs12.mkdirSync(path15.dirname(parsed.output), { recursive: true });
+    fs12.writeFileSync(parsed.output, rendered);
     console.log(`Exported ${summary.id} as ${parsed.format} to ${parsed.output}`);
     return;
   }
@@ -5430,7 +6165,7 @@ async function manageBenchDatasets(parsed) {
       process.exit(1);
     }
     const status = supported.map((benchmarkId) => {
-      const datasetPath = path14.join(datasetRoot, benchmarkId);
+      const datasetPath = path15.join(datasetRoot, benchmarkId);
       return {
         benchmark: benchmarkId,
         downloaded: isDatasetDownloaded(datasetPath, benchmarkId),
@@ -5458,7 +6193,7 @@ async function manageBenchDatasets(parsed) {
     process.exit(1);
   }
   const scriptPath = resolveDatasetDownloadScriptPath();
-  if (!fs11.existsSync(scriptPath)) {
+  if (!fs12.existsSync(scriptPath)) {
     console.error(`ERROR: dataset download script not found: ${scriptPath}`);
     process.exit(1);
   }
@@ -5468,7 +6203,7 @@ async function manageBenchDatasets(parsed) {
     runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, parsed.json === true);
     downloaded.push({
       benchmark: benchmarkId,
-      path: path14.join(datasetRoot, benchmarkId)
+      path: path15.join(datasetRoot, benchmarkId)
     });
   }
   if (parsed.json) {
@@ -5607,10 +6342,10 @@ async function calibrateBenchJudges(parsed, rawArgs) {
   }
   const bench = await loadBenchModule();
   const resultsDir = expandTilde(
-    parsed.resultsDir ?? path14.join(resolveHomeDir(), ".remnic", "bench", "results")
+    parsed.resultsDir ?? path15.join(resolveHomeDir(), ".remnic", "bench", "results")
   );
   const calibrationDir = expandTilde(
-    parsed.calibrationDir ?? path14.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    parsed.calibrationDir ?? path15.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const stored = await bench.listBenchmarkResults(resultsDir);
   const allForBenchmark = stored.filter((entry) => entry.benchmark === benchmarkId);
@@ -5658,7 +6393,7 @@ async function calibrateBenchJudges(parsed, rawArgs) {
     );
     process.exit(1);
   }
-  const sourceResultSha256 = createHash2("sha256").update(fs11.readFileSync(latest.path)).digest("hex");
+  const sourceResultSha256 = createHash3("sha256").update(fs12.readFileSync(latest.path)).digest("hex");
   const expandedManifestPath = expandTilde(manifestPath);
   if (!bench.resolveLocalLabJudgeProviderConfig) {
     console.error(
@@ -6073,7 +6808,7 @@ function loadPinnedLoCoMoTaskSelector(parsed) {
   }
   let decoded;
   try {
-    decoded = JSON.parse(fs11.readFileSync(parsed.taskIdsFile, "utf8"));
+    decoded = JSON.parse(fs12.readFileSync(parsed.taskIdsFile, "utf8"));
   } catch (error) {
     throw new Error(
       `Unable to read --task-ids-file ${parsed.taskIdsFile}: ${error instanceof Error ? error.message : String(error)}`
@@ -6170,7 +6905,7 @@ async function loadPublishedPromotionHelpers() {
   return {
     async promoteArtifactsToPublished(args) {
       const { mkdirSync, readFileSync: readFileSync4, writeFileSync } = await import("fs");
-      const path15 = await import("path");
+      const path16 = await import("path");
       mkdirSync(args.publishedOutDir, { recursive: true });
       if (args.artifactPaths.length === 0) {
         console.warn(
@@ -6187,13 +6922,13 @@ async function loadPublishedPromotionHelpers() {
         const modelSlug = args.model.replace(/[^a-zA-Z0-9_.-]/g, "-");
         const rawProfile = parsedObj.config?.runtimeProfile;
         const profileSlug = typeof rawProfile === "string" && rawProfile.length > 0 ? `-${rawProfile.replace(/[^a-zA-Z0-9_.-]/g, "-")}` : "";
-        const target = path15.join(
+        const target = path16.join(
           args.publishedOutDir,
           `${today}-${args.benchmarkId}-${modelSlug}${profileSlug}-${gitShaShort}.json`
         );
         writeFileSync(target, raw, "utf8");
         console.log(
-          `[bench published] Promoted ${path15.basename(artifactPath)} \u2192 ${target}`
+          `[bench published] Promoted ${path16.basename(artifactPath)} \u2192 ${target}`
         );
       }
       void benchModule;
@@ -6300,7 +7035,7 @@ async function runBenchViaPackage(parsed, benchmarkId, runtimeProfile, benchStat
   const previousCodexDiagnosticsDir = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV];
   const previousCodexDiagnosticsMode = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_MODE_ENV];
   if (!previousCodexDiagnosticsDir) {
-    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path14.join(
+    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path15.join(
       outputDir,
       "codex-cli-diagnostics"
     );
@@ -6448,7 +7183,7 @@ async function preparePersistedJudgeCalibrationAttachment(benchModule, benchmark
     );
   }
   const calibrationDir = expandTilde(
-    calibrationBinding.calibrationDir ?? path14.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    calibrationBinding.calibrationDir ?? path15.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const state = await benchModule.loadJudgeCalibrationState?.(benchmarkId, calibrationDir);
   if (!state) {
@@ -6522,7 +7257,7 @@ function attachPreparedJudgeCalibration(result, judgeCalibration) {
 function hashCalibrationProviderConfig(config) {
   const canonicalize = (value, key = "") => {
     if (typeof value === "string" && /(?:api.?key|authorization|token|secret)/i.test(key)) {
-      return { secretSha256: createHash2("sha256").update(value).digest("hex") };
+      return { secretSha256: createHash3("sha256").update(value).digest("hex") };
     }
     if (Array.isArray(value)) return value.map((item) => canonicalize(item));
     if (value && typeof value === "object") {
@@ -6533,7 +7268,7 @@ function hashCalibrationProviderConfig(config) {
     }
     return value;
   };
-  return createHash2("sha256").update(JSON.stringify(canonicalize(config))).digest("hex");
+  return createHash3("sha256").update(JSON.stringify(canonicalize(config))).digest("hex");
 }
 function restoreOptionalEnv(key, previousValue) {
   if (previousValue === void 0) {
@@ -6745,7 +7480,7 @@ function resolveBenchReproDatasetDir(datasetDir) {
     return void 0;
   }
   try {
-    return fs11.realpathSync(datasetDir);
+    return fs12.realpathSync(datasetDir);
   } catch {
     return datasetDir;
   }
@@ -6798,23 +7533,23 @@ async function writeBenchReproManifestForPackageRun(args) {
   }
 }
 function resolveConfigPath(cliPath) {
-  if (cliPath) return path14.resolve(expandTilde(cliPath));
+  if (cliPath) return path15.resolve(expandTilde(cliPath));
   const envPath = readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH");
-  if (envPath) return path14.resolve(expandTilde(envPath));
+  if (envPath) return path15.resolve(expandTilde(envPath));
   const candidates = [
-    path14.join(process.cwd(), "remnic.config.json"),
-    path14.join(process.cwd(), "engram.config.json"),
-    path14.join(resolveHomeDir(), ".config", "remnic", "config.json"),
-    path14.join(resolveHomeDir(), ".config", "engram", "config.json")
+    path15.join(process.cwd(), "remnic.config.json"),
+    path15.join(process.cwd(), "engram.config.json"),
+    path15.join(resolveHomeDir(), ".config", "remnic", "config.json"),
+    path15.join(resolveHomeDir(), ".config", "engram", "config.json")
   ];
   for (const candidate of candidates) {
-    if (fs11.existsSync(candidate)) return candidate;
+    if (fs12.existsSync(candidate)) return candidate;
   }
-  return path14.join(resolveHomeDir(), ".config", "remnic", "config.json");
+  return path15.join(resolveHomeDir(), ".config", "remnic", "config.json");
 }
 function resolveExistingBenchRemnicConfigPath(cliPath) {
   const configPath = resolveConfigPath(cliPath);
-  if (fs11.existsSync(configPath)) {
+  if (fs12.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -6824,7 +7559,7 @@ function resolveExistingBenchRemnicConfigPath(cliPath) {
 }
 function resolveExistingBenchOpenclawConfigPath(cliPath) {
   const configPath = resolveOpenclawConfigPath(cliPath);
-  if (fs11.existsSync(configPath)) {
+  if (fs12.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -6924,34 +7659,34 @@ async function resolvePackageBenchRuntime(benchModule, parsed, runtimeProfile) {
   );
 }
 function normalizeMemoryDirPath(memoryDir) {
-  return path14.resolve(expandTilde(memoryDir));
+  return path15.resolve(expandTilde(memoryDir));
 }
 function resolveMemoryDir() {
   const configMemoryDir = (() => {
     const envMemoryDir = readCompatEnv("REMNIC_MEMORY_DIR", "ENGRAM_MEMORY_DIR");
     if (envMemoryDir) return normalizeMemoryDirPath(envMemoryDir);
     const configPath = resolveConfigPath();
-    const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+    const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
     const remnicCfg = resolveRemnicConfigRecord4(raw);
     if (typeof remnicCfg.memoryDir === "string" && remnicCfg.memoryDir.length > 0) {
       return normalizeMemoryDirPath(remnicCfg.memoryDir);
     }
     const home = resolveHomeDir();
-    const standalonePath = path14.join(home, ".remnic", "memory");
-    const legacyStandalonePath = path14.join(home, ".engram", "memory");
-    const openclawPath = path14.join(home, ".openclaw", "workspace", "memory", "local");
-    if (fs11.existsSync(standalonePath)) return standalonePath;
-    if (fs11.existsSync(legacyStandalonePath)) return legacyStandalonePath;
+    const standalonePath = path15.join(home, ".remnic", "memory");
+    const legacyStandalonePath = path15.join(home, ".engram", "memory");
+    const openclawPath = path15.join(home, ".openclaw", "workspace", "memory", "local");
+    if (fs12.existsSync(standalonePath)) return standalonePath;
+    if (fs12.existsSync(legacyStandalonePath)) return legacyStandalonePath;
     return openclawPath;
   })();
   const manifestPath = getManifestPath();
-  if (fs11.existsSync(manifestPath)) {
+  if (fs12.existsSync(manifestPath)) {
     try {
       const active = getActiveSpace();
       if (active?.memoryDir) {
         const activeMemoryDir = normalizeMemoryDirPath(active.memoryDir);
-        if (!fs11.existsSync(activeMemoryDir)) {
-          fs11.mkdirSync(activeMemoryDir, { recursive: true });
+        if (!fs12.existsSync(activeMemoryDir)) {
+          fs12.mkdirSync(activeMemoryDir, { recursive: true });
         }
         return activeMemoryDir;
       }
@@ -6990,20 +7725,20 @@ var REMNIC_OPENCLAW_LEGACY_PLUGIN_ID = "openclaw-engram";
 var DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR = [
   process.env.OPENCLAW_CONFIG_PATH,
   process.env.OPENCLAW_ENGRAM_CONFIG_PATH,
-  path14.join(resolveHomeDir(), ".openclaw", "openclaw.json")
+  path15.join(resolveHomeDir(), ".openclaw", "openclaw.json")
 ].filter(Boolean);
 function resolveOpenclawConfigPath(cliPath) {
-  if (cliPath) return path14.resolve(expandTilde(cliPath));
+  if (cliPath) return path15.resolve(expandTilde(cliPath));
   const envPath = process.env.OPENCLAW_CONFIG_PATH || process.env.OPENCLAW_ENGRAM_CONFIG_PATH;
-  if (envPath) return path14.resolve(expandTilde(envPath));
+  if (envPath) return path15.resolve(expandTilde(envPath));
   for (const candidate of DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR) {
-    if (fs11.existsSync(candidate)) return candidate;
+    if (fs12.existsSync(candidate)) return candidate;
   }
-  return path14.join(resolveHomeDir(), ".openclaw", "openclaw.json");
+  return path15.join(resolveHomeDir(), ".openclaw", "openclaw.json");
 }
 function readOpenclawConfig(configPath) {
-  if (!fs11.existsSync(configPath)) return {};
-  const raw = fs11.readFileSync(configPath, "utf-8");
+  if (!fs12.existsSync(configPath)) return {};
+  const raw = fs12.readFileSync(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -7058,10 +7793,10 @@ function buildRemnicOpenclawHooksPolicy(legacyHooks, existingHooks) {
 function resolveOpenclawInstallMemoryDir(args) {
   const existingMemoryDir = (typeof args.existingNewEntryConfig.memoryDir === "string" ? args.existingNewEntryConfig.memoryDir : void 0) || (args.migrateLegacy && typeof args.legacyConfigToMerge.memoryDir === "string" ? args.legacyConfigToMerge.memoryDir : void 0);
   if (args.requestedMemoryDir) {
-    return path14.resolve(expandTilde(args.requestedMemoryDir));
+    return path15.resolve(expandTilde(args.requestedMemoryDir));
   }
   if (existingMemoryDir) {
-    return path14.resolve(expandTilde(existingMemoryDir));
+    return path15.resolve(expandTilde(existingMemoryDir));
   }
   return args.fallbackMemoryDir;
 }
@@ -7079,18 +7814,18 @@ function resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir) {
     if (!config || typeof config !== "object" || Array.isArray(config)) continue;
     const memoryDir = config.memoryDir;
     if (typeof memoryDir === "string" && memoryDir.trim().length > 0) {
-      return path14.resolve(expandTilde(memoryDir));
+      return path15.resolve(expandTilde(memoryDir));
     }
   }
   return fallbackMemoryDir;
 }
 function resolveOpenclawPluginDir(cliPath) {
-  if (cliPath) return path14.resolve(expandTilde(cliPath));
-  return path14.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  if (cliPath) return path15.resolve(expandTilde(cliPath));
+  return path15.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
 }
 function resolveOpenclawLegacyPluginDir(cliPath) {
-  if (cliPath) return path14.resolve(expandTilde(cliPath));
-  return path14.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
+  if (cliPath) return path15.resolve(expandTilde(cliPath));
+  return path15.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
 }
 function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   const yyyy = now.getFullYear().toString();
@@ -7102,14 +7837,14 @@ function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   return `${yyyy}${mm}${dd}-${hh}${min}${ss}`;
 }
 function backupPathIfPresent(sourcePath, backupPath) {
-  if (!fs11.existsSync(sourcePath)) return false;
-  fs11.mkdirSync(path14.dirname(backupPath), { recursive: true });
-  fs11.cpSync(sourcePath, backupPath, { recursive: true });
+  if (!fs12.existsSync(sourcePath)) return false;
+  fs12.mkdirSync(path15.dirname(backupPath), { recursive: true });
+  fs12.cpSync(sourcePath, backupPath, { recursive: true });
   return true;
 }
 function assertDirectoryPathOrMissing(targetPath, label) {
-  if (!fs11.existsSync(targetPath)) return;
-  const stat = fs11.statSync(targetPath);
+  if (!fs12.existsSync(targetPath)) return;
+  const stat = fs12.statSync(targetPath);
   if (!stat.isDirectory()) {
     throw new Error(`${label} must be a directory when it already exists: ${targetPath}`);
   }
@@ -7134,7 +7869,7 @@ var PublishedOpenclawPluginInstallError = class extends Error {
   }
 };
 function installPublishedOpenclawPlugin(spec, pluginDir) {
-  const tempRoot = fs11.mkdtempSync(path14.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
+  const tempRoot = fs12.mkdtempSync(path15.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
   const stagedDir = `${pluginDir}.next-${process.pid}-${Date.now()}`;
   const rollbackDir = `${pluginDir}.rollback-${process.pid}-${Date.now()}`;
   let swapRollbackDir;
@@ -7149,17 +7884,17 @@ function installPublishedOpenclawPlugin(spec, pluginDir) {
     if (!tarballName) {
       throw new Error(`npm pack ${spec} did not return a tarball name`);
     }
-    const unpackDir = path14.join(tempRoot, "unpacked");
-    fs11.mkdirSync(unpackDir, { recursive: true });
-    childProcess2.execFileSync("tar", ["-xzf", path14.join(tempRoot, tarballName), "-C", unpackDir], {
+    const unpackDir = path15.join(tempRoot, "unpacked");
+    fs12.mkdirSync(unpackDir, { recursive: true });
+    childProcess2.execFileSync("tar", ["-xzf", path15.join(tempRoot, tarballName), "-C", unpackDir], {
       stdio: ["ignore", "pipe", "pipe"]
     });
-    const packagedDir = path14.join(unpackDir, "package");
-    if (!fs11.existsSync(packagedDir)) {
+    const packagedDir = path15.join(unpackDir, "package");
+    if (!fs12.existsSync(packagedDir)) {
       throw new Error(`npm pack ${spec} did not contain a package/ directory`);
     }
-    fs11.rmSync(stagedDir, { recursive: true, force: true });
-    fs11.cpSync(packagedDir, stagedDir, { recursive: true });
+    fs12.rmSync(stagedDir, { recursive: true, force: true });
+    fs12.cpSync(packagedDir, stagedDir, { recursive: true });
     childProcess2.execFileSync("npm", ["install", "--omit=dev"], {
       cwd: stagedDir,
       stdio: ["ignore", "pipe", "pipe"]
@@ -7174,8 +7909,8 @@ function installPublishedOpenclawPlugin(spec, pluginDir) {
       }
     })();
     swapRollbackDir = swapResult.rollbackDir;
-    const installedPackageJsonPath = path14.join(pluginDir, "package.json");
-    const installedPackage = fs11.existsSync(installedPackageJsonPath) ? JSON.parse(fs11.readFileSync(installedPackageJsonPath, "utf8")) : {};
+    const installedPackageJsonPath = path15.join(pluginDir, "package.json");
+    const installedPackage = fs12.existsSync(installedPackageJsonPath) ? JSON.parse(fs12.readFileSync(installedPackageJsonPath, "utf8")) : {};
     return {
       rollbackDir: swapRollbackDir,
       version: typeof installedPackage.version === "string" ? installedPackage.version : void 0
@@ -7190,8 +7925,8 @@ function installPublishedOpenclawPlugin(spec, pluginDir) {
       }
     );
   } finally {
-    fs11.rmSync(stagedDir, { recursive: true, force: true });
-    fs11.rmSync(tempRoot, { recursive: true, force: true });
+    fs12.rmSync(stagedDir, { recursive: true, force: true });
+    fs12.rmSync(tempRoot, { recursive: true, force: true });
   }
 }
 function restartOpenclawGateway() {
@@ -7209,15 +7944,15 @@ function restartOpenclawGateway() {
   });
 }
 function cmdInit() {
-  const configPath = path14.join(process.cwd(), "remnic.config.json");
-  if (fs11.existsSync(configPath)) {
+  const configPath = path15.join(process.cwd(), "remnic.config.json");
+  if (fs12.existsSync(configPath)) {
     console.log(`Config already exists: ${configPath}`);
     return;
   }
   const template = {
     remnic: {
       openaiApiKey: "${OPENAI_API_KEY}",
-      memoryDir: path14.join(process.cwd(), ".remnic", "memory"),
+      memoryDir: path15.join(process.cwd(), ".remnic", "memory"),
       memoryOsPreset: "balanced"
     },
     server: {
@@ -7226,7 +7961,7 @@ function cmdInit() {
       authToken: "${REMNIC_AUTH_TOKEN}"
     }
   };
-  fs11.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
+  fs12.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
   console.log(`Created ${configPath}`);
   console.log("\nSet these environment variables:");
   console.log("  export OPENAI_API_KEY=sk-...");
@@ -7296,7 +8031,7 @@ async function cmdStatus(json) {
 }
 function oauthReadConfigRecord(configPath) {
   try {
-    const parsed = JSON.parse(fs11.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs12.readFileSync(configPath, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -7354,7 +8089,7 @@ function oauthResolveOperatorToken() {
   }
   return void 0;
 }
-async function oauthFetch(method, path15, token, body) {
+async function oauthFetch(method, path16, token, body) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 5e3);
   try {
@@ -7373,7 +8108,7 @@ async function oauthFetch(method, path15, token, body) {
     if (body !== void 0) {
       init.body = JSON.stringify(body);
     }
-    const response = await fetch(`${oauthResolveBaseUrl()}${path15}`, init);
+    const response = await fetch(`${oauthResolveBaseUrl()}${path16}`, init);
     if (response.status === 401) {
       throw new Error(
         "operator token rejected by remnic-server (HTTP 401). Update `server.authToken` or `REMNIC_AUTH_TOKEN` to match the running daemon."
@@ -7712,9 +8447,9 @@ async function cmdQuery(queryText, json, explain) {
   }
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const orchestrator = new Orchestrator3(config);
   await orchestrator.initialize();
   const service = new EngramAccessService2(orchestrator);
@@ -7883,9 +8618,9 @@ async function cmdXray(rest) {
   parseXrayCliOptions(rawQuery, options);
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const orchestrator = new Orchestrator3(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
@@ -7906,9 +8641,9 @@ async function cmdXray(rest) {
 async function cmdVersions(rest) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   if (!config.versioningEnabled) {
     console.error("Page versioning is disabled (versioningEnabled = false).");
     process.exit(1);
@@ -7928,7 +8663,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions list <page-path>");
         process.exit(1);
       }
-      const absPath = path14.resolve(pagePath);
+      const absPath = path15.resolve(pagePath);
       const history = await listVersions(absPath, versioningConfig, memDir);
       if (json) {
         console.log(JSON.stringify(history, null, 2));
@@ -7953,7 +8688,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions show <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path14.resolve(pagePath);
+      const absPath = path15.resolve(pagePath);
       try {
         const content = await getVersion(absPath, versionId, versioningConfig, memDir);
         console.log(content);
@@ -7971,7 +8706,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions diff <page-path> <v1> <v2>");
         process.exit(1);
       }
-      const absPath = path14.resolve(pagePath);
+      const absPath = path15.resolve(pagePath);
       try {
         const diffOutput = await diffVersions(absPath, v1, v2, versioningConfig, memDir);
         console.log(diffOutput);
@@ -7988,7 +8723,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions revert <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path14.resolve(pagePath);
+      const absPath = path15.resolve(pagePath);
       try {
         const version = await revertToVersion(absPath, versionId, versioningConfig, void 0, memDir);
         if (json) {
@@ -8022,13 +8757,13 @@ Options:
 async function cmdEnrich(rest) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const subcommand = rest[0];
   if (subcommand === "audit") {
     const memoryDir2 = expandTilde(config.memoryDir);
-    const auditDir2 = path14.join(memoryDir2, "enrichment");
+    const auditDir2 = path15.join(memoryDir2, "enrichment");
     const sinceFlag = resolveFlag(rest.slice(1), "--since");
     const entries = await readAuditLog(auditDir2, sinceFlag ?? void 0);
     if (entries.length === 0) {
@@ -8153,7 +8888,7 @@ Registered providers:`);
     return;
   }
   const memoryDir = expandTilde(config.memoryDir);
-  const auditDir = path14.join(memoryDir, "enrichment");
+  const auditDir = path15.join(memoryDir, "enrichment");
   let totalPersisted = 0;
   for (const result of results) {
     for (const candidate of result.acceptedCandidates) {
@@ -8267,9 +9002,9 @@ Shared with:
     process.exit(1);
   }
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const memoryDir = expandTilde(
     typeof memoryDirOverride === "string" && memoryDirOverride.length > 0 ? memoryDirOverride : config.memoryDir ?? resolveMemoryDir()
   );
@@ -8284,9 +9019,9 @@ Shared with:
 async function cmdExtensions(action, rest) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const root = resolveExtensionsRoot(config);
   const noopLog = { warn: () => {
   }, debug: () => {
@@ -8335,7 +9070,7 @@ Root: ${root}`);
       const extensions = await discoverMemoryExtensions(root, warnLog);
       let entries = [];
       try {
-        entries = fs11.readdirSync(root);
+        entries = fs12.readdirSync(root);
       } catch {
         console.log(`Extensions root does not exist: ${root}`);
         process.exitCode = 0;
@@ -8344,9 +9079,9 @@ Root: ${root}`);
       const validNames = new Set(extensions.map((e) => e.name));
       let errors = 0;
       for (const entry of entries) {
-        const entryPath = path14.join(root, entry);
+        const entryPath = path15.join(root, entry);
         try {
-          if (!fs11.statSync(entryPath).isDirectory()) continue;
+          if (!fs12.statSync(entryPath).isDirectory()) continue;
         } catch {
           continue;
         }
@@ -8378,9 +9113,9 @@ Root: ${root}`);
 async function cmdBriefing(rest) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   if (!config.briefing.enabled) {
     console.error("Briefing is disabled in config (briefing.enabled = false).");
     process.exit(1);
@@ -8458,10 +9193,10 @@ async function cmdBriefing(rest) {
   if (save) {
     try {
       const saveDir = resolveBriefingSaveDir(config.briefing.saveDir);
-      fs11.mkdirSync(saveDir, { recursive: true });
+      fs12.mkdirSync(saveDir, { recursive: true });
       const filename = briefingFilename(new Date(result.window.to), format);
-      const filePath = path14.join(saveDir, filename);
-      fs11.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
+      const filePath = path15.join(saveDir, filename);
+      fs12.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
       console.error(`Saved briefing: ${filePath}`);
     } catch (err) {
       console.error(`Failed to save briefing: ${err instanceof Error ? err.message : String(err)}`);
@@ -8479,7 +9214,7 @@ async function cmdDoctor() {
     detail: `${nodeVersion} (requires >= 22.12.0)`
   });
   const configPath = resolveConfigPath();
-  const configExists = fs11.existsSync(configPath);
+  const configExists = fs12.existsSync(configPath);
   checks.push({ name: "Config file", ok: configExists, detail: configPath });
   let standaloneConfig;
   let standaloneConfigError;
@@ -8487,11 +9222,11 @@ async function cmdDoctor() {
   let configuredNs = { invalid: false };
   if (configExists) {
     try {
-      const raw = JSON.parse(fs11.readFileSync(configPath, "utf8"));
+      const raw = JSON.parse(fs12.readFileSync(configPath, "utf8"));
       const remnicCfg = resolveRemnicConfigRecord4(raw);
       standaloneOpenaiApiKeyExplicitlyFalse = isOpenaiApiKeyDisabled(remnicCfg.openaiApiKey);
       configuredNs = readConfiguredNamespace(remnicCfg);
-      standaloneConfig = parseConfig4(remnicCfg);
+      standaloneConfig = parseConfig5(remnicCfg);
     } catch (err) {
       standaloneConfigError = err instanceof Error ? err.message : String(err);
     }
@@ -8500,10 +9235,10 @@ async function cmdDoctor() {
   try {
     memoryDir = resolveMemoryDir();
   } catch {
-    memoryDir = parseConfig4({}).memoryDir;
+    memoryDir = parseConfig5({}).memoryDir;
   }
   try {
-    fs11.mkdirSync(memoryDir, { recursive: true });
+    fs12.mkdirSync(memoryDir, { recursive: true });
     checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
   } catch {
     checks.push({ name: "Memory directory", ok: false, detail: `cannot create ${memoryDir}` });
@@ -8532,7 +9267,7 @@ async function cmdDoctor() {
   });
   if (nsPolicyCheck) checks.push(nsPolicyCheck);
   const openclawConfigPath = resolveOpenclawConfigPath();
-  const openclawConfigExists = fs11.existsSync(openclawConfigPath);
+  const openclawConfigExists = fs12.existsSync(openclawConfigPath);
   let openclawConfig = {};
   let openclawConfigValid = false;
   let openclawPluginModeConfigured = false;
@@ -8540,7 +9275,7 @@ async function cmdDoctor() {
   let activeOpenclawEntryConfig = null;
   if (openclawConfigExists) {
     try {
-      const parsed = JSON.parse(fs11.readFileSync(openclawConfigPath, "utf-8"));
+      const parsed = JSON.parse(fs12.readFileSync(openclawConfigPath, "utf-8"));
       if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
         openclawConfig = parsed;
         openclawConfigValid = true;
@@ -8616,13 +9351,13 @@ async function cmdDoctor() {
       const rawMemoryDir = entryConfig?.memoryDir;
       const configuredMemoryDir = typeof rawMemoryDir === "string" ? rawMemoryDir : void 0;
       if (configuredMemoryDir) {
-        const resolvedMemDir = path14.resolve(expandTilde(configuredMemoryDir));
+        const resolvedMemDir = path15.resolve(expandTilde(configuredMemoryDir));
         let memDirOk = false;
         let memDirDetail = `${resolvedMemDir} (not found)`;
         let memDirRemediation = `Run \`remnic openclaw install --memory-dir "${resolvedMemDir}"\` to create the directory.`;
-        if (fs11.existsSync(resolvedMemDir)) {
+        if (fs12.existsSync(resolvedMemDir)) {
           try {
-            const stat = fs11.statSync(resolvedMemDir);
+            const stat = fs12.statSync(resolvedMemDir);
             if (stat.isDirectory()) {
               memDirOk = true;
               memDirDetail = resolvedMemDir;
@@ -8764,12 +9499,12 @@ async function cmdDoctor() {
 }
 function cmdConfig() {
   const configPath = resolveConfigPath();
-  if (!fs11.existsSync(configPath)) {
+  if (!fs12.existsSync(configPath)) {
     console.log("No config file found. Run `remnic init` to create one.");
     return;
   }
   console.log(`Config: ${configPath}`);
-  const rawConfig = fs11.readFileSync(configPath, "utf8");
+  const rawConfig = fs12.readFileSync(configPath, "utf8");
   const redacted = rawConfig.replace(
     /("(?:openaiApiKey|localLlmApiKey|authToken|apiKey|remoteSearchApiKey|meilisearchApiKey|opikApiKey)"\s*:\s*")([^"]*)(")/g,
     "$1[REDACTED]$3"
@@ -8816,7 +9551,7 @@ async function cmdMigrate(json, rollback) {
   console.log(`  Rollback: ${result.rollbackCommand}`);
 }
 function cmdOnboard(dirPath, json) {
-  const directory = path14.resolve(dirPath || process.cwd());
+  const directory = path15.resolve(dirPath || process.cwd());
   const result = onboard({ directory });
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -8835,7 +9570,7 @@ Suggested namespace: ${result.plan.suggestedNamespace}`);
 async function cmdCurate(targetPath, json) {
   const memoryDir = resolveMemoryDir();
   const result = await curate({
-    targetPath: path14.resolve(targetPath),
+    targetPath: path15.resolve(targetPath),
     memoryDir,
     source: "curation",
     checkDuplicates: true,
@@ -8877,9 +9612,9 @@ async function cmdReview(action, rest) {
     const configPath = resolveConfigPath();
     let tombstonesConfig = null;
     try {
-      const rawCfg = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+      const rawCfg = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
       const remnicCfg = resolveRemnicConfigRecord4(rawCfg);
-      const config = parseConfig4(remnicCfg);
+      const config = parseConfig5(remnicCfg);
       tombstonesConfig = {
         enabled: config.tombstonesEnabled,
         semanticMatch: config.tombstonesSemanticMatch,
@@ -8965,7 +9700,7 @@ async function cmdSync(action, rest, json) {
 }
 function localOfflineSourceId(memoryDir) {
   const host = os.hostname() || "unknown-host";
-  const dirHash = createHash2("sha256").update(path14.resolve(memoryDir)).digest("hex").slice(0, 16);
+  const dirHash = createHash3("sha256").update(path15.resolve(memoryDir)).digest("hex").slice(0, 16);
   return `remnic-local:${host}:${dirHash}`;
 }
 function normalizeOfflineRemoteUrl(raw) {
@@ -9363,10 +10098,10 @@ var OFFLINE_SYNC_CONTENT_MISSING_RETRY_MAX = 3;
 var OFFLINE_SYNC_CONTENT_MISSING_RETRY_DELAY_MS = 250;
 var OfflineRemoteFileChangedError = class extends Error {
   path;
-  constructor(path15) {
-    super(`remote file changed while fetching offline content: ${path15}`);
+  constructor(path16) {
+    super(`remote file changed while fetching offline content: ${path16}`);
     this.name = "OfflineRemoteFileChangedError";
-    this.path = path15;
+    this.path = path16;
   }
 };
 function isOfflineRemoteFileChangedError(error) {
@@ -9557,15 +10292,15 @@ function offlineDirectPushFiles(options) {
   }).sort((left, right) => right.bytes - left.bytes || left.path.localeCompare(right.path));
 }
 function resolveOfflineDirectHydrationPath(memoryDir, relPath) {
-  const base = path14.resolve(memoryDir);
-  const target = path14.resolve(base, relPath);
-  const relative = path14.relative(base, target);
-  if (relative === "" || relative === ".." || relative.startsWith(`..${path14.sep}`) || path14.isAbsolute(relative)) {
+  const base = path15.resolve(memoryDir);
+  const target = path15.resolve(base, relPath);
+  const relative = path15.relative(base, target);
+  if (relative === "" || relative === ".." || relative.startsWith(`..${path15.sep}`) || path15.isAbsolute(relative)) {
     throw new Error(`offline sync direct hydration path escapes memory dir: ${relPath}`);
   }
   return target;
 }
-var OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES = OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2;
+var OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES = OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES3;
 async function pushOfflineFileContent(args) {
   if (args.readFileChunks) {
     return pushOfflineFileContentFromChunkReader(args);
@@ -9573,7 +10308,7 @@ async function pushOfflineFileContent(args) {
   let offset = 0;
   let finalResult = null;
   let remoteSatisfiedResult = null;
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   let bytes = 0;
   while (offset < args.file.bytes || args.file.bytes === 0 && offset === 0) {
     const chunk = await readOfflineSyncFileContentChunk({
@@ -9630,13 +10365,13 @@ async function pushOfflineFileContent(args) {
 }
 async function pushOfflineFileContentFromChunkReader(args) {
   const filePath = resolveOfflineDirectHydrationPath(args.memoryDir, args.file.path);
-  const stat = fs11.statSync(filePath);
+  const stat = fs12.statSync(filePath);
   if (stat.mtimeMs !== args.file.mtimeMs) {
     throw new Error(`local file changed while pushing offline content: ${args.file.path}`);
   }
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   const chunks = args.readFileChunks({
-    root: path14.resolve(args.memoryDir),
+    root: path15.resolve(args.memoryDir),
     path: args.file.path,
     filePath,
     chunkSize: OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES
@@ -9648,7 +10383,7 @@ async function pushOfflineFileContentFromChunkReader(args) {
   for await (const rawChunk of chunks) {
     const chunk = Buffer.from(rawChunk);
     if (chunk.length === 0) continue;
-    if (chunk.length > OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES) {
+    if (chunk.length > OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES2) {
       throw new Error(`local offline content chunk exceeds max size: ${args.file.path}`);
     }
     if (pending) {
@@ -9733,7 +10468,7 @@ async function hydrateOfflineFileContent(args) {
       path: args.expected.path,
       offset,
       length: Math.min(
-        OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
+        OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES2,
         Math.max(1, args.expected.bytes - offset)
       )
     });
@@ -9744,7 +10479,7 @@ async function hydrateOfflineFileContent(args) {
       throw new Error(`remote offline content chunk was empty before EOF: ${args.expected.path}`);
     }
     try {
-      finalResult = await applyOfflineSyncFileContentChunk({
+      finalResult = await applyOfflineSyncFileContentChunk2({
         root: args.memoryDir,
         sourceId: args.sourceId,
         path: args.expected.path,
@@ -10121,7 +10856,7 @@ function advanceOfflineBaseFilesForSuccessfulPush(options) {
   return [...next.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
 async function runOfflineSyncOnce(options) {
-  fs11.mkdirSync(options.memoryDir, { recursive: true });
+  fs12.mkdirSync(options.memoryDir, { recursive: true });
   let activeStatePath = options.statePath;
   let priorState = await readOfflineSyncState(activeStatePath);
   let syncNamespace = options.namespace ?? priorState?.namespace;
@@ -10175,7 +10910,7 @@ async function runOfflineSyncOnce(options) {
       options.secureStoreEncryptOnWrite ?? true
     )).drainPendingMemoryLifecycleEventsForSyncAt(ledgerPath)
   );
-  const currentSnapshotForPush = await buildOfflineSyncSnapshotFromBase({
+  const currentSnapshotForPush = await buildOfflineSyncSnapshotFromBase2({
     root: options.memoryDir,
     sourceId: localSourceId,
     baseFiles,
@@ -10324,7 +11059,7 @@ async function runOfflineSyncOnce(options) {
     if (pushed) return writePartialPushState(error);
     throw error;
   }
-  let currentSnapshotForChangeset = directPushedPaths.size > 0 ? await buildOfflineSyncSnapshotFromBase({
+  let currentSnapshotForChangeset = directPushedPaths.size > 0 ? await buildOfflineSyncSnapshotFromBase2({
     root: options.memoryDir,
     sourceId: localSourceId,
     baseFiles,
@@ -10377,7 +11112,7 @@ async function runOfflineSyncOnce(options) {
       }
       changesetRetryCount += 1;
       directPushDeferredPaths.add(changedPath);
-      currentSnapshotForChangeset = await buildOfflineSyncSnapshotFromBase({
+      currentSnapshotForChangeset = await buildOfflineSyncSnapshotFromBase2({
         root: options.memoryDir,
         sourceId: localSourceId,
         baseFiles,
@@ -10432,7 +11167,7 @@ async function runOfflineSyncOnce(options) {
   }
   let currentSnapshot;
   try {
-    currentSnapshot = await buildOfflineSyncSnapshotFromBase({
+    currentSnapshot = await buildOfflineSyncSnapshotFromBase2({
       root: options.memoryDir,
       sourceId: localSourceId,
       baseFiles,
@@ -10495,7 +11230,7 @@ async function runOfflineSyncOnce(options) {
     resolvedNamespace: resolvedOfflineSnapshotNamespace(remoteSnapshotMetadata, syncNamespace),
     remoteFileCount: remoteSnapshotMetadata.files.length
   };
-  const buildCurrentSnapshotForApply = async () => buildOfflineSyncSnapshotFromBase({
+  const buildCurrentSnapshotForApply = async () => buildOfflineSyncSnapshotFromBase2({
     root: options.memoryDir,
     sourceId: localSourceId,
     baseFiles,
@@ -10739,7 +11474,7 @@ Environment fallbacks:
   REMNIC_OFFLINE_REMOTE_URL, REMNIC_OFFLINE_TOKEN, REMNIC_AUTH_TOKEN`);
     return;
   }
-  const memoryDir = path14.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
+  const memoryDir = path15.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
   const namespace = resolveRequiredValueFlag(rest, "--namespace");
   const includeTranscripts = !hasFlag(rest, "--no-transcripts");
   const stateOverride = resolveRequiredValueFlag(rest, "--state");
@@ -10747,7 +11482,7 @@ Environment fallbacks:
   const configPath = resolveConfigPath();
   let config;
   try {
-    const rawConfig = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+    const rawConfig = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
     config = parseConfigQuietly(pickOfflineConfigRecord(rawConfig));
   } catch {
     throw new Error(
@@ -10759,10 +11494,10 @@ Environment fallbacks:
   const needsRemote = action === "prepare" || action === "sync" || action === "watch";
   const remoteUrl = needsRemote ? resolveOfflineRemoteUrl(rest) : resolveOptionalOfflineRemoteUrl(rest);
   const token = needsRemote ? resolveOfflineToken(rest) : void 0;
-  const statePath = statePathExplicit ? path14.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
+  const statePath = statePathExplicit ? path15.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
   if (action === "prepare") {
     if (!remoteUrl || !token || !statePath) throw new Error("offline prepare requires remote URL and token");
-    fs11.mkdirSync(memoryDir, { recursive: true });
+    fs12.mkdirSync(memoryDir, { recursive: true });
     const remoteSnapshot = await fetchOfflineSnapshot({
       remoteUrl,
       token,
@@ -10860,7 +11595,7 @@ Environment fallbacks:
     return;
   }
   if (action === "status") {
-    fs11.mkdirSync(memoryDir, { recursive: true });
+    fs12.mkdirSync(memoryDir, { recursive: true });
     const state = statePath ? await readOfflineSyncState(statePath) : null;
     if (state && remoteUrl && statePath) {
       assertOfflineStateMatches({
@@ -10940,11 +11675,11 @@ Environment fallbacks:
           failures: result.largeFilePushFailures
         });
         largeFileFailureCounts = advanced.counts;
-        for (const path15 of advanced.newlySkipped) {
-          if (skippedLargeFiles.has(path15)) continue;
-          skippedLargeFiles.add(path15);
+        for (const path16 of advanced.newlySkipped) {
+          if (skippedLargeFiles.has(path16)) continue;
+          skippedLargeFiles.add(path16);
           console.warn(
-            `offline sync: permanently skipping ${path15} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+            `offline sync: permanently skipping ${path16} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
           );
         }
         const pulled = result.pull ? result.pull.upserted + result.pull.deleted : 0;
@@ -10959,11 +11694,11 @@ Environment fallbacks:
             failures: error.failures
           });
           largeFileFailureCounts = advanced.counts;
-          for (const path15 of advanced.newlySkipped) {
-            if (skippedLargeFiles.has(path15)) continue;
-            skippedLargeFiles.add(path15);
+          for (const path16 of advanced.newlySkipped) {
+            if (skippedLargeFiles.has(path16)) continue;
+            skippedLargeFiles.add(path16);
             console.warn(
-              `offline sync: permanently skipping ${path15} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+              `offline sync: permanently skipping ${path16} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
             );
           }
         }
@@ -10998,7 +11733,7 @@ function cmdDedup(json) {
 function readInstalledConnectorConfig(configPath, fallback) {
   if (!configPath) return fallback;
   try {
-    const parsed = JSON.parse(fs11.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs12.readFileSync(configPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return fallback;
     const { token: _token, ...config } = parsed;
     return config;
@@ -11104,7 +11839,7 @@ async function cmdConnectors(action, rest, json) {
             const connectorDaemonUrl = typeof effectiveConnectorConfig.remnicDaemonUrl === "string" && effectiveConnectorConfig.remnicDaemonUrl.trim().length > 0 ? effectiveConnectorConfig.remnicDaemonUrl.trim() : void 0;
             const pubResult = await pub.publish({
               config: { memoryDir, namespace: connectorNamespace, daemonUrl: connectorDaemonUrl },
-              skillsRoot: path14.join(memoryDir, "skills"),
+              skillsRoot: path15.join(memoryDir, "skills"),
               rollbackTokenEntry: preInstallTokenEntry,
               log: { info: console.log, warn: console.warn, error: console.error }
             });
@@ -11176,7 +11911,7 @@ async function cmdConnectors(action, rest, json) {
           const pub = factory();
           const available = await pub.isHostAvailable();
           const extRoot = available ? await pub.resolveExtensionRoot() : "(host not installed)";
-          const extensionExists = available && extRoot ? fs11.existsSync(extRoot) : false;
+          const extensionExists = available && extRoot ? fs12.existsSync(extRoot) : false;
           publisherChecks.push({
             name: `Publisher: ${targetHostId}`,
             ok: !available || extensionExists,
@@ -11250,7 +11985,7 @@ async function cmdConnectors(action, rest, json) {
     let connectorsCfg;
     const configPath = resolveConfigPath();
     try {
-      const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+      const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
       connectorsCfg = parseConfigQuietly(raw).connectors;
     } catch {
       process.stderr.write(
@@ -11326,9 +12061,9 @@ async function cmdConnectors(action, rest, json) {
     }
     initLogger2();
     const configPath = resolveConfigPath();
-    const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+    const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
     const remnicCfg = resolveRemnicConfigRecord4(raw);
-    const config = parseConfig4(remnicCfg);
+    const config = parseConfig5(remnicCfg);
     const orchestrator = new Orchestrator3(config);
     try {
       await orchestrator.initialize();
@@ -11451,9 +12186,9 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     console.error(`connectors marketplace: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  const rawConfig = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const rawConfig = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const pluginConfig = resolveRemnicConfigRecord4(rawConfig);
-  const config = parseConfig4(pluginConfig);
+  const config = parseConfig5(pluginConfig);
   if (subAction === "generate") {
     let outputDir;
     try {
@@ -11464,22 +12199,22 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     }
     const manifest = generateMarketplaceManifest();
     await writeMarketplaceManifest(outputDir, manifest);
-    const outPath = path14.join(outputDir, "marketplace.json");
+    const outPath = path15.join(outputDir, "marketplace.json");
     if (json) {
       console.log(JSON.stringify({ status: "generated", path: outPath }, null, 2));
     } else {
       console.log(`Generated marketplace.json at ${outPath}`);
     }
   } else if (subAction === "validate") {
-    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path14.join(process.cwd(), "marketplace.json");
-    const resolved = path14.resolve(targetPath);
-    if (!fs11.existsSync(resolved)) {
+    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path15.join(process.cwd(), "marketplace.json");
+    const resolved = path15.resolve(targetPath);
+    if (!fs12.existsSync(resolved)) {
       console.error(`File not found: ${resolved}`);
       process.exit(1);
     }
     let parsed;
     try {
-      parsed = JSON.parse(fs11.readFileSync(resolved, "utf8"));
+      parsed = JSON.parse(fs12.readFileSync(resolved, "utf8"));
     } catch {
       console.error(`Invalid JSON in ${resolved}`);
       process.exit(1);
@@ -11680,9 +12415,9 @@ async function cmdSpace(action, rest, json) {
 async function cmdLegacyBenchmark(action, rest, json) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const orchestrator = new Orchestrator3(config);
   const service = new EngramAccessService2(orchestrator);
   const { runBenchSuite, loadBaseline, checkRegression } = await loadBenchModule();
@@ -11880,7 +12615,7 @@ async function cmdBench(rest) {
     }
     const completeCount = prevStatus.benchmarks.filter((b) => b.status === "complete").length;
     const failedCount = prevStatus.benchmarks.filter((b) => b.status === "failed").length;
-    printBenchStatusLine(parsed.json, `Resuming from: ${path14.basename(latestStatusPath)}`);
+    printBenchStatusLine(parsed.json, `Resuming from: ${path15.basename(latestStatusPath)}`);
     printBenchStatusLine(parsed.json, `  Previous run: ${prevStatus.startedAt}`);
     printBenchStatusLine(parsed.json, `  Benchmarks: ${prevStatus.benchmarks.length} total, ${completeCount} complete, ${failedCount} failed`);
     const before = selectedBenchmarks.length;
@@ -12048,9 +12783,9 @@ Options:
     );
     process.exit(1);
   } else {
-    fixturePath = path14.resolve(expandTilde(fixturePathRaw));
+    fixturePath = path15.resolve(expandTilde(fixturePathRaw));
   }
-  const outPath = path14.resolve(expandTilde(outPathRaw));
+  const outPath = path15.resolve(expandTilde(outPathRaw));
   const benchModule = await loadBenchModule();
   const runner = benchModule.runProceduralAblationCli;
   if (typeof runner !== "function") {
@@ -12069,7 +12804,7 @@ Options:
   );
   console.log(`wrote ${outPath}`);
 }
-var LOGS_DIR = path14.join(PID_DIR, "logs");
+var LOGS_DIR = path15.join(PID_DIR, "logs");
 var LAUNCHD_PLIST_PATHS = launchdPlistPaths(resolveHomeDir());
 var [LAUNCHD_PLIST_PATH] = LAUNCHD_PLIST_PATHS;
 var SYSTEMD_UNIT_PATHS = systemdUnitPaths(resolveHomeDir());
@@ -12083,7 +12818,7 @@ function readPid() {
 function inferPort() {
   try {
     const configPath = resolveConfigPath();
-    const raw = JSON.parse(fs11.readFileSync(configPath, "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(configPath, "utf8"));
     return raw.server?.port ?? 4318;
   } catch {
     return 4318;
@@ -12146,7 +12881,7 @@ function selectLaunchdInspection(openclawPluginModeConfigured) {
   for (const plistPath of LAUNCHD_PLIST_PATHS.slice(1)) {
     const legacy = inspectLaunchdPlist(plistPath);
     if (!legacy.installed) continue;
-    const label = path14.basename(plistPath, ".plist");
+    const label = path15.basename(plistPath, ".plist");
     return legacy.ok ? {
       ...legacy,
       warn: true,
@@ -12178,13 +12913,13 @@ function daemonInstall() {
     process.exit(1);
   }
   const vars = { HOME: home, NODE_PATH: nodePath, REMNIC_SERVER_BIN: serverBin };
-  fs11.mkdirSync(LOGS_DIR, { recursive: true });
+  fs12.mkdirSync(LOGS_DIR, { recursive: true });
   if (isMacOS()) {
-    const templatePath = path14.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
-    const template = fs11.readFileSync(templatePath, "utf8");
+    const templatePath = path15.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
+    const template = fs12.readFileSync(templatePath, "utf8");
     const plist = renderTemplate(template, vars);
-    fs11.mkdirSync(path14.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
-    fs11.writeFileSync(LAUNCHD_PLIST_PATH, plist);
+    fs12.mkdirSync(path15.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
+    fs12.writeFileSync(LAUNCHD_PLIST_PATH, plist);
     try {
       launchdLoadPlist(LAUNCHD_PLIST_PATH);
     } catch (err) {
@@ -12200,11 +12935,11 @@ function daemonInstall() {
     console.log(`  RunAtLoad: true, KeepAlive: true`);
     console.log(`  Logs: ${LOGS_DIR}/daemon.log`);
   } else if (isLinux()) {
-    const templatePath = path14.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
-    const template = fs11.readFileSync(templatePath, "utf8");
+    const templatePath = path15.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
+    const template = fs12.readFileSync(templatePath, "utf8");
     const unit = renderTemplate(template, vars);
-    fs11.mkdirSync(path14.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
-    fs11.writeFileSync(SYSTEMD_UNIT_PATH, unit);
+    fs12.mkdirSync(path15.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
+    fs12.writeFileSync(SYSTEMD_UNIT_PATH, unit);
     try {
       childProcess2.execSync("systemctl --user daemon-reload", { stdio: "pipe" });
     } catch (err) {
@@ -12240,7 +12975,7 @@ function daemonUninstall() {
       } catch {
       }
       try {
-        fs11.unlinkSync(plistPath);
+        fs12.unlinkSync(plistPath);
         removed = true;
         console.log(`Removed launchd service: ${plistPath}`);
       } catch {
@@ -12260,7 +12995,7 @@ function daemonUninstall() {
     let removed = false;
     for (const unitPath of SYSTEMD_UNIT_PATHS) {
       try {
-        fs11.unlinkSync(unitPath);
+        fs12.unlinkSync(unitPath);
         removed = true;
         console.log(`Removed systemd service: ${unitPath}`);
       } catch {
@@ -12327,13 +13062,13 @@ async function daemonStatus() {
   console.log(`  Port:      ${port}`);
   console.log(`  Service:   ${serviceInstalled ? "installed" : "not installed"}`);
   console.log(`  Platform:  ${process.platform}`);
-  console.log(`  PID file:  ${fs11.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
-  console.log(`  Log file:  ${fs11.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
+  console.log(`  PID file:  ${fs12.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
+  console.log(`  Log file:  ${fs12.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
   try {
     const configPath = resolveConfigPath();
-    const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+    const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
     const remnicCfg = resolveRemnicConfigRecord4(raw);
-    const config = parseConfig4(remnicCfg);
+    const config = parseConfig5(remnicCfg);
     const extRoot = resolveExtensionsRoot(config);
     const noopLog = { warn: () => {
     }, debug: () => {
@@ -12372,9 +13107,9 @@ function daemonStart() {
       return;
     }
   }
-  fs11.mkdirSync(PID_DIR, { recursive: true });
-  fs11.mkdirSync(LOGS_DIR, { recursive: true });
-  const logStream = fs11.openSync(LOG_FILE, "a");
+  fs12.mkdirSync(PID_DIR, { recursive: true });
+  fs12.mkdirSync(LOGS_DIR, { recursive: true });
+  const logStream = fs12.openSync(LOG_FILE, "a");
   const serverBin = resolveServerBin();
   const isSource = serverBin.endsWith(".ts");
   let cmd;
@@ -12396,7 +13131,7 @@ function daemonStart() {
     }
   });
   child.unref();
-  fs11.writeFileSync(PID_FILE, String(child.pid));
+  fs12.writeFileSync(PID_FILE, String(child.pid));
   console.log(`Started remnic server (pid ${child.pid})`);
   console.log(`  Log: ${LOG_FILE}`);
 }
@@ -12430,11 +13165,11 @@ function daemonStop() {
     console.log("Process not found (cleaning up PID file)");
   }
   try {
-    fs11.unlinkSync(PID_FILE);
+    fs12.unlinkSync(PID_FILE);
   } catch {
   }
   try {
-    fs11.unlinkSync(LEGACY_PID_FILE);
+    fs12.unlinkSync(LEGACY_PID_FILE);
   } catch {
   }
 }
@@ -12562,9 +13297,9 @@ async function promptYesNo(question, defaultYes = true) {
 async function cmdBinary(rest) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   const memoryDir = resolveMemoryDir();
   const blConfig = {
     enabled: config.binaryLifecycleEnabled,
@@ -12682,7 +13417,7 @@ Clean complete: cleaned=${result.cleaned}`
 }
 async function cmdOpenclawInstall(opts) {
   const configPath = resolveOpenclawConfigPath(opts.configPath);
-  const fallbackMemoryDir = path14.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+  const fallbackMemoryDir = path15.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
   console.log(`OpenClaw config: ${configPath}`);
   const existingConfig = readOpenclawConfig(configPath);
   const { plugins, entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
@@ -12753,7 +13488,7 @@ async function cmdOpenclawInstall(opts) {
   } else if (slotIsActiveLegacy) {
     changes.push(`  Slot left as "${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}" \u2014 re-run with --yes to activate the new entry`);
   }
-  if (!fs11.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
+  if (!fs12.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
   if (hasLegacy && migrateLegacy) {
     changes.push(`~ Legacy '${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}' entry retained (safe to remove after verifying hooks fire)`);
   }
@@ -12773,8 +13508,8 @@ async function cmdOpenclawInstall(opts) {
 Resulting plugins.slots.memory: ${dryRunPlugins.slots?.memory ?? "(unset)"}`);
     return;
   }
-  if (fs11.existsSync(memoryDir)) {
-    const st = fs11.statSync(memoryDir);
+  if (fs12.existsSync(memoryDir)) {
+    const st = fs12.statSync(memoryDir);
     if (!st.isDirectory()) {
       throw new Error(
         `Cannot use ${memoryDir} as the memory directory \u2014 a file already exists at that path.
@@ -12782,12 +13517,12 @@ Remove it first and re-run, or choose a different path with --memory-dir.`
       );
     }
   } else {
-    fs11.mkdirSync(memoryDir, { recursive: true });
+    fs12.mkdirSync(memoryDir, { recursive: true });
     console.log(`Created memory directory: ${memoryDir}`);
   }
-  const configDir = path14.dirname(configPath);
-  if (!fs11.existsSync(configDir)) {
-    fs11.mkdirSync(configDir, { recursive: true });
+  const configDir = path15.dirname(configPath);
+  if (!fs12.existsSync(configDir)) {
+    fs12.mkdirSync(configDir, { recursive: true });
   }
   atomicWriteFileSync(configPath, JSON.stringify(updatedConfig, null, 2) + "\n");
   console.log("\nDone! Summary of changes:");
@@ -12813,11 +13548,11 @@ async function cmdOpenclawUpgrade(opts) {
   const configPath = resolveOpenclawConfigPath(opts.configPath);
   const pluginDir = resolveOpenclawPluginDir(opts.pluginDir);
   const legacyPluginDirForBackup = opts.legacyPluginDirForBackup ? resolveOpenclawLegacyPluginDir(opts.legacyPluginDirForBackup) : void 0;
-  const fallbackMemoryDir = path14.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+  const fallbackMemoryDir = path15.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
   const packageSpec = `@remnic/plugin-openclaw@${opts.version ?? "latest"}`;
   const existingConfig = readOpenclawConfig(configPath);
   const { entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
-  const preservedMemoryDir = opts.memoryDir ? path14.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
+  const preservedMemoryDir = opts.memoryDir ? path15.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
   assertDirectoryPathOrMissing(pluginDir, "OpenClaw plugin dir");
   if (legacyPluginDirForBackup) {
     assertDirectoryPathOrMissing(legacyPluginDirForBackup, "Legacy OpenClaw plugin dir");
@@ -12829,7 +13564,7 @@ async function cmdOpenclawUpgrade(opts) {
   }
   console.log(`Memory dir:      ${preservedMemoryDir}`);
   console.log(`Package spec:    ${packageSpec}`);
-  console.log(`Backup root:     ${path14.join(resolveHomeDir(), ".openclaw", "backups")}`);
+  console.log(`Backup root:     ${path15.join(resolveHomeDir(), ".openclaw", "backups")}`);
   const plannedActions = [
     `backup openclaw.json and the existing ${REMNIC_OPENCLAW_PLUGIN_ID} extension`,
     ...legacyPluginDirForBackup ? [`backup the existing ${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID} extension without modifying it`] : [],
@@ -12855,9 +13590,9 @@ async function cmdOpenclawUpgrade(opts) {
     }
   }
   const backupDir = createOpenclawUpgradeBackupDir();
-  const configBackupPath = path14.join(backupDir, "openclaw.json");
-  const pluginBackupDir = path14.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
-  const legacyPluginBackupDir = legacyPluginDirForBackup ? path14.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
+  const configBackupPath = path15.join(backupDir, "openclaw.json");
+  const pluginBackupDir = path15.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  const legacyPluginBackupDir = legacyPluginDirForBackup ? path15.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
   const backupNotes = [];
   if (backupPathIfPresent(configPath, configBackupPath)) {
     backupNotes.push(`+ Backed up config to ${configBackupPath}`);
@@ -12958,16 +13693,16 @@ async function cmdOpenclawMigrateEngram(opts) {
   console.log("  - Re-apply any local source patches to the new package only after verifying the published build.");
 }
 function createOpenclawUpgradeBackupDir() {
-  const backupsRoot = path14.join(resolveHomeDir(), ".openclaw", "backups");
-  fs11.mkdirSync(backupsRoot, { recursive: true });
-  return fs11.mkdtempSync(path14.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
+  const backupsRoot = path15.join(resolveHomeDir(), ".openclaw", "backups");
+  fs12.mkdirSync(backupsRoot, { recursive: true });
+  return fs12.mkdtempSync(path15.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
 }
 async function cmdTaxonomy(rest) {
   initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+  const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord4(raw);
-  const config = parseConfig4(remnicCfg);
+  const config = parseConfig5(remnicCfg);
   if (!config.taxonomyEnabled) {
     console.error(
       "Taxonomy is disabled in config (taxonomyEnabled = false). Enable it to use taxonomy commands."
@@ -13002,9 +13737,9 @@ async function cmdTaxonomy(rest) {
       const doc = generateResolverDocument(taxonomy);
       console.log(doc);
       if (config.taxonomyAutoGenResolver) {
-        const resolverPath = path14.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs11.mkdirSync(path14.dirname(resolverPath), { recursive: true });
-        fs11.writeFileSync(resolverPath, doc);
+        const resolverPath = path15.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs12.mkdirSync(path15.dirname(resolverPath), { recursive: true });
+        fs12.writeFileSync(resolverPath, doc);
         console.error(`Written: ${resolverPath}`);
       }
       break;
@@ -13049,8 +13784,8 @@ async function cmdTaxonomy(rest) {
       console.log(`Added category "${id}" (${name}).`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path14.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs11.writeFileSync(resolverPath, doc);
+        const resolverPath = path15.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs12.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -13080,8 +13815,8 @@ async function cmdTaxonomy(rest) {
       console.log(`Removed category "${id}".`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path14.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs11.writeFileSync(resolverPath, doc);
+        const resolverPath = path15.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs12.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -13272,12 +14007,12 @@ async function runTrainingExport(args, stdout = process.stdout) {
       `Unknown training-export format "${args.format}". ${validList}`
     );
   }
-  if (!fs11.existsSync(args.memoryDir)) {
+  if (!fs12.existsSync(args.memoryDir)) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" does not exist. Provide the path to an existing memory directory.`
     );
   }
-  if (!fs11.statSync(args.memoryDir).isDirectory()) {
+  if (!fs12.statSync(args.memoryDir).isDirectory()) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" is not a directory. Provide the path to a memory directory, not a file.`
     );
@@ -13362,11 +14097,11 @@ async function runTrainingExport(args, stdout = process.stdout) {
     );
   }
   const formatted = adapter.formatRecords(records);
-  const outDir = path14.dirname(args.output);
-  fs11.mkdirSync(outDir, { recursive: true });
+  const outDir = path15.dirname(args.output);
+  fs12.mkdirSync(outDir, { recursive: true });
   const tmpPath = `${args.output}.tmp-${process.pid}-${Date.now()}`;
-  fs11.writeFileSync(tmpPath, formatted, "utf-8");
-  fs11.renameSync(tmpPath, args.output);
+  fs12.writeFileSync(tmpPath, formatted, "utf-8");
+  fs12.renameSync(tmpPath, args.output);
   stdout.write(
     `Exported ${records.length} records to ${args.output} (${adapter.name} format)
 `
@@ -13470,7 +14205,7 @@ async function main(argv = process.argv.slice(2)) {
     case "tree": {
       const subAction = rest[0];
       const json = rest.includes("--json");
-      const outputDir = resolveFlag(rest, "--output") ?? path14.join(process.cwd(), ".remnic", "context-tree");
+      const outputDir = resolveFlag(rest, "--output") ?? path15.join(process.cwd(), ".remnic", "context-tree");
       const categoriesFlag = resolveFlag(rest, "--categories");
       const categories = categoriesFlag ? categoriesFlag.split(",") : void 0;
       const maxPerCategoryRaw = resolveFlag(rest, "--max-per-category");
@@ -13535,7 +14270,7 @@ async function main(argv = process.argv.slice(2)) {
             }
           }, 500);
         };
-        fs11.watch(memoryDir, { recursive: true }, (_event, filename) => {
+        fs12.watch(memoryDir, { recursive: true }, (_event, filename) => {
           if (filename && filename.startsWith(".")) return;
           rebuild();
         });
@@ -13543,12 +14278,12 @@ async function main(argv = process.argv.slice(2)) {
         });
       } else if (subAction === "validate") {
         const treeDir = outputDir;
-        if (!fs11.existsSync(treeDir)) {
+        if (!fs12.existsSync(treeDir)) {
           console.error(`Context tree not found at ${treeDir}. Run 'remnic tree generate' first.`);
           process.exit(1);
         }
-        const indexPath = path14.join(treeDir, "INDEX.md");
-        if (!fs11.existsSync(indexPath)) {
+        const indexPath = path15.join(treeDir, "INDEX.md");
+        if (!fs12.existsSync(indexPath)) {
           console.error(`INDEX.md missing in ${treeDir}. Tree may be corrupt \u2014 regenerate.`);
           process.exit(1);
         }
@@ -13602,6 +14337,12 @@ Options:
       await cmdOffline(action, rest.slice(1), json);
       break;
     }
+    case "converge": {
+      const action = rest[0] ?? "plan";
+      const json = rest.includes("--json");
+      await cmdConverge(action, rest.slice(1), json);
+      break;
+    }
     case "oauth": {
       await cmdOAuth(rest);
       break;
@@ -13718,9 +14459,9 @@ Other:
         let wearablesService;
         try {
           const configPath = resolveConfigPath();
-          const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+          const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
           const remnicCfg = resolveRemnicConfigRecord4(raw);
-          const config = parseConfig4(remnicCfg);
+          const config = parseConfig5(remnicCfg);
           wearablesOrchestrator = new Orchestrator3(config);
           await wearablesOrchestrator.initialize();
           await wearablesOrchestrator.deferredReady;
@@ -13769,9 +14510,9 @@ Other:
       const targetFactory = async () => {
         if (!orchestratorSingleton) {
           const configPath = resolveConfigPath();
-          const raw = fs11.existsSync(configPath) ? JSON.parse(fs11.readFileSync(configPath, "utf8")) : {};
+          const raw = fs12.existsSync(configPath) ? JSON.parse(fs12.readFileSync(configPath, "utf8")) : {};
           const remnicCfg = resolveRemnicConfigRecord4(raw);
-          const config = parseConfig4(remnicCfg);
+          const config = parseConfig5(remnicCfg);
           orchestratorSingleton = new Orchestrator3(config);
           await orchestratorSingleton.initialize();
           await orchestratorSingleton.deferredReady;