@remnic/cli 9.69.32 → 9.69.34

package/dist/index.js

@@ -31,7 +31,7 @@ import {
   isOpenaiApiKeyDisabled,
   resolveEnvVars,
   resolveRemnicConfigRecord as resolveRemnicConfigRecord16,
-  Orchestrator as Orchestrator10,
+  Orchestrator as Orchestrator11,
   EngramAccessService as EngramAccessService2,
   initLogger as initLogger5,
   onboard,
@@ -105,7 +105,7 @@ import {
   discoverMemoryExtensions,
   resolveExtensionsRoot,
   coerceInstallExtension,
-  StorageManager as StorageManager3,
+  StorageManager as StorageManager4,
   parseXrayCliOptions,
   renderXray,
   extractWhoKnowsRawArgs,
@@ -204,10 +204,46 @@ async function runMeetingsBinaryCommand(rest) {
 // src/commands/timeline.ts
 import fs2 from "fs";
 import {
+  ActivityStore,
+  activityDateInTimezone,
+  listPersistedTimelineDates,
   parseConfig as parseConfig2,
+  regenerateTimelineDay,
   resolveRemnicConfigRecord as resolveRemnicConfigRecord2,
+  resolveTimelineLoadDates,
   runTimelineCliCommand
 } from "@remnic/core";
+async function loadProductionTimelineCards(config, window, now = () => /* @__PURE__ */ new Date()) {
+  const timeline = config.activity.timeline;
+  if (!timeline.enabled) return null;
+  const timezone = config.activity.timezone;
+  const store = ActivityStore.open(config.memoryDir);
+  try {
+    const dates = resolveTimelineLoadDates({
+      window,
+      timezone,
+      today: activityDateInTimezone(now(), timezone),
+      store,
+      persistedDates: listPersistedTimelineDates(config.memoryDir)
+    });
+    const cards = [];
+    for (const date of dates) {
+      const result = await regenerateTimelineDay({
+        date,
+        timezone,
+        memoryDir: config.memoryDir,
+        store,
+        timelineEnabled: true,
+        analysis: timeline.analysis,
+        pluginConfig: config
+      });
+      cards.push(...result.cards);
+    }
+    return cards;
+  } finally {
+    store.close();
+  }
+}
 async function runTimelineBinaryCommand(rest) {
   const timelineArgs = rest.length === 0 || rest[0] === "--help" || rest[0] === "-h" ? ["help"] : rest;
   try {
@@ -228,7 +264,13 @@ async function runTimelineBinaryCommand(rest) {
       return;
     }
     const code = await runTimelineCliCommand(
-      { cards: null, qa, timelineEnabled, config },
+      {
+        cards: null,
+        qa,
+        timelineEnabled,
+        config,
+        loadCards: (window) => loadProductionTimelineCards(config, window)
+      },
       timelineArgs,
       { stdout: process.stdout, stderr: process.stderr }
     );
@@ -548,12 +590,44 @@ async function runStandupBinaryCommand(rest) {
 // src/commands/journal.ts
 import fs9 from "fs";
 import {
+  ExtractionEngine,
+  Orchestrator as Orchestrator7,
+  activityDateInTimezone as activityDateInTimezone2,
+  commitJournalHash,
+  createJournalMemoryWriter,
+  hashJournalText,
   journalPath,
+  journalUnchanged,
   parseConfig as parseConfig9,
+  readJournalForDate,
+  readTimelineState,
   resolveRemnicConfigRecord as resolveRemnicConfigRecord9,
+  runJournalReviewExtraction,
   seedJournal,
-  todayJournalDate
+  withJournalDateLock
 } from "@remnic/core";
+function defaultDeps(config, storage) {
+  return {
+    readJournal: readJournalForDate,
+    async extractionDeps() {
+      if (!storage) {
+        throw new Error(
+          "journal extract requires a resolved StorageManager from the orchestrator; constructing StorageManager(memoryDir) is not permitted"
+        );
+      }
+      await storage.ensureDirectories();
+      const engine = new ExtractionEngine(config, void 0, void 0, config.gatewayConfig);
+      return {
+        extract: (turns) => engine.extract(turns),
+        writer: createJournalMemoryWriter(storage)
+      };
+    },
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+function createJournalCommandDeps(config, storage) {
+  return defaultDeps(config, storage);
+}
 function takeFlag4(rest, name) {
   const index = rest.indexOf(name);
   if (index < 0) return void 0;
@@ -562,26 +636,156 @@ function takeFlag4(rest, name) {
   return value;
 }
 function journalHelp() {
-  return `Usage: remnic journal <show|edit-path|seed> [--date YYYY-MM-DD] [--force]
+  return `Usage: remnic journal <show|edit-path|seed|extract> [--date YYYY-MM-DD] [--force]
 
-  show       Print the journal file for the date (default: today).
-  edit-path  Print the journal file path.
-  seed       Write the file only if it is absent. --force overwrites.
+  show       Print the journal for the date (default: today in
+             activity.timezone). Vault mode prints a provenance header
+             naming the vault note first.
+  edit-path  Print the journal file path (vault mode: the vault note path).
+  seed       Write the file only if it is absent (memoryDir mode only).
+  extract    Run the review-only extraction pass (requires
+             activity.timeline.journal.extractionMode "review").
+             Candidates land pending_review only \u2014 never auto-approved;
+             an unchanged day is hash-skipped.
 `;
 }
-function loadMemoryDir() {
-  const configPath = resolveConfigPath();
-  const raw = fs9.existsSync(configPath) ? JSON.parse(fs9.readFileSync(configPath, "utf8")) : {};
-  return parseConfig9(resolveRemnicConfigRecord9(raw)).memoryDir;
+async function runJournalCommand(config, rest, io, deps = defaultDeps(config)) {
+  if (rest.length === 0 || rest[0] === "--help" || rest[0] === "-h" || rest[0] === "help") {
+    io.out(journalHelp().trimEnd());
+    return 0;
+  }
+  const action = rest[0];
+  const journalConfig = config.activity.timeline.journal;
+  if (!journalConfig.enabled) {
+    io.err("journal: timeline.journal.enabled is false \u2014 enable the journal first.");
+    return 1;
+  }
+  const date = takeFlag4(rest, "--date") ?? activityDateInTimezone2(deps.now(), config.activity.timezone);
+  const force = rest.includes("--force");
+  const vaultMode = journalConfig.source === "vault";
+  if (action === "edit-path") {
+    if (vaultMode) {
+      const read = deps.readJournal({
+        vault: config.activity.timeline.vault,
+        date,
+        timezone: config.activity.timezone
+      });
+      io.out(read.filePath);
+      return 0;
+    }
+    io.out(journalPath(config.memoryDir, date));
+    return 0;
+  }
+  if (action === "show") {
+    if (vaultMode) {
+      const read = deps.readJournal({
+        vault: config.activity.timeline.vault,
+        date,
+        timezone: config.activity.timezone
+      });
+      if (!read.ok) {
+        io.err(`journal: cannot read the vault note (${read.reason}): ${read.filePath}`);
+        return 1;
+      }
+      if (!read.exists) {
+        io.out(`exists:false (${read.reason})`);
+        return 0;
+      }
+      io.out(`# journal source: ${read.filePath} :: ${read.heading}`);
+      io.out(read.text);
+      return 0;
+    }
+    const filePath = journalPath(config.memoryDir, date);
+    if (!fs9.existsSync(filePath)) {
+      io.err(`journal: no file at ${filePath}. Run remnic journal seed --date ${date}.`);
+      return 1;
+    }
+    io.out(fs9.readFileSync(filePath, "utf8").trimEnd());
+    return 0;
+  }
+  if (action === "seed") {
+    if (vaultMode) {
+      io.err(
+        'journal: seed is not available when activity.timeline.journal.source is "vault" \u2014 the vault daily note owns the journal section and Remnic never writes to it. Create the note/section in your vault (or your vault note template) instead.'
+      );
+      return 1;
+    }
+    const result = seedJournal({ memoryDir: config.memoryDir, date, force });
+    io.out(result.wrote ? `wrote ${result.path}` : `unchanged ${result.path}`);
+    return 0;
+  }
+  if (action === "extract") {
+    if (journalConfig.extractionMode !== "review") {
+      io.err(
+        `journal: extract requires activity.timeline.journal.extractionMode "review" (currently "${journalConfig.extractionMode}") \u2014 extraction is opt-in and review-only by design.`
+      );
+      return 1;
+    }
+    let text;
+    if (vaultMode) {
+      const read = deps.readJournal({
+        vault: config.activity.timeline.vault,
+        date,
+        timezone: config.activity.timezone
+      });
+      if (!read.ok) {
+        io.err(`journal: cannot read the vault note (${read.reason}): ${read.filePath}`);
+        return 1;
+      }
+      if (!read.exists) {
+        io.out(`no journal ${date} (${read.reason})`);
+        return 0;
+      }
+      text = read.text;
+    } else {
+      const filePath = journalPath(config.memoryDir, date);
+      if (!fs9.existsSync(filePath)) {
+        io.out(`no journal ${date} (missing_file)`);
+        return 0;
+      }
+      text = fs9.readFileSync(filePath, "utf8");
+    }
+    return withJournalDateLock(config.memoryDir, date, async () => {
+      const state = readTimelineState(config.memoryDir);
+      if (journalUnchanged(state, date, text)) {
+        io.out(`unchanged ${date} (hash-skip)`);
+        return 0;
+      }
+      const result = await runJournalReviewExtraction({
+        date,
+        journalText: text,
+        source: vaultMode ? "vault" : "memoryDir",
+        journalConfig,
+        deps: await deps.extractionDeps()
+      });
+      if (!result.completed) {
+        io.err(`journal: extraction did not complete for ${date} \u2014 the day retries on the next run.`);
+        return 1;
+      }
+      await commitJournalHash(config.memoryDir, date, hashJournalText(text));
+      io.out(`pending_review: ${result.pendingReview}`);
+      io.out(`rejected_by_judge: ${result.rejectedByJudge}`);
+      io.out(`skipped: ${result.skipped}`);
+      for (const warning of result.warnings) {
+        io.err(`journal: ${warning}`);
+      }
+      return 0;
+    });
+  }
+  io.err(`journal: unknown action "${action}".`);
+  io.err(journalHelp().trimEnd());
+  return 1;
 }
 async function runJournalBinaryCommand(rest) {
   if (rest.length === 0 || rest[0] === "--help" || rest[0] === "-h" || rest[0] === "help") {
-    console.log(journalHelp());
+    console.log(journalHelp().trimEnd());
     return;
   }
-  let memoryDir;
+  let config;
   try {
-    memoryDir = loadMemoryDir();
+    const configPath = resolveConfigPath();
+    const raw = fs9.existsSync(configPath) ? JSON.parse(fs9.readFileSync(configPath, "utf8")) : {};
+    config = parseConfig9(resolveRemnicConfigRecord9(raw));
   } catch {
     console.error(
       "journal: failed to load the Remnic config \u2014 run `remnic doctor` and check the config file for errors"
@@ -589,35 +793,32 @@ async function runJournalBinaryCommand(rest) {
     process.exitCode = 1;
     return;
   }
+  const action = rest[0];
+  let orchestrator;
   try {
-    const action = rest[0];
-    const date = takeFlag4(rest, "--date") ?? todayJournalDate();
-    const force = rest.includes("--force");
-    const filePath = journalPath(memoryDir, date);
-    if (action === "edit-path") {
-      console.log(filePath);
-      return;
-    }
-    if (action === "show") {
-      if (!fs9.existsSync(filePath)) {
-        console.error(`journal: no file at ${filePath}. Run remnic journal seed --date ${date}.`);
-        process.exitCode = 1;
-        return;
-      }
-      process.stdout.write(fs9.readFileSync(filePath, "utf8"));
-      return;
-    }
-    if (action === "seed") {
-      const result = seedJournal({ memoryDir, date, force });
-      console.log(result.wrote ? `wrote ${result.path}` : `unchanged ${result.path}`);
-      return;
+    let deps;
+    if (action === "extract") {
+      orchestrator = new Orchestrator7(config);
+      await orchestrator.initialize();
+      await orchestrator.deferredReady;
+      const storage = await orchestrator.getStorageForNamespace(config.defaultNamespace);
+      deps = createJournalCommandDeps(config, storage);
     }
-    console.error(`journal: unknown action "${action}".`);
-    console.error(journalHelp());
-    process.exitCode = 1;
+    const code = await runJournalCommand(
+      config,
+      rest,
+      {
+        out: (line) => console.log(line),
+        err: (line) => console.error(line)
+      },
+      deps ?? defaultDeps(config)
+    );
+    if (code !== 0) process.exitCode = code;
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
     process.exitCode = 1;
+  } finally {
+    await orchestrator?.destroy();
   }
 }
 
@@ -990,7 +1191,7 @@ async function runExternalWikiBinaryCommand(rest) {
 // src/commands/procedural.ts
 import fs13 from "fs";
 import {
-  StorageManager,
+  StorageManager as StorageManager2,
   computeProcedureStats,
   formatProcedureStatsText,
   initLogger,
@@ -1075,7 +1276,7 @@ Shared with:
   const memoryDir = expandTilde(
     typeof memoryDirOverride === "string" && memoryDirOverride.length > 0 ? memoryDirOverride : config.memoryDir ?? resolveMemoryDir()
   );
-  const storage = new StorageManager(memoryDir);
+  const storage = new StorageManager2(memoryDir);
   if (subcommand === "maintain") {
     const report2 = await runProcedureLibraryMaintenance({
       memoryDir,
@@ -1128,7 +1329,7 @@ function formatProcedureMaintenanceText(report) {
 // src/commands/drift.ts
 import fs14 from "fs";
 import {
-  Orchestrator as Orchestrator7,
+  Orchestrator as Orchestrator8,
   initLogger as initLogger2,
   parseConfig as parseConfig12,
   resolveRemnicConfigRecord as resolveRemnicConfigRecord12,
@@ -1197,7 +1398,7 @@ Resolve a drifted item with the existing review surface:
   const memoryDir = expandTilde(
     memoryDirOverridden ? memoryDirOverride : config.memoryDir ?? resolveMemoryDir()
   );
-  const orchestrator = new Orchestrator7(
+  const orchestrator = new Orchestrator8(
     memoryDirOverridden ? { ...config, memoryDir } : config
   );
   await orchestrator.initialize();
@@ -1403,418 +1604,205 @@ async function loadWecloneExportModule() {
 }
 
 // src/converge.ts
-import * as fs17 from "fs";
 import { createHash as createHash3 } from "crypto";
-import * as path2 from "path";
+import * as fs18 from "fs";
+import * as path3 from "path";
 import {
   CONVERGE_CONFLICT_POLICIES,
   DEFAULT_CONVERGE_CONFLICT_POLICY,
-  parseConfig as parseConfig13,
-  envConvergePeerRequestTimeoutMs as envConvergePeerRequestTimeoutMs2,
-  normalizeConvergePeerRequestTimeoutMs,
-  buildOfflineSyncSnapshotFromBase,
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES3,
   applyOfflineSyncFileContentChunk,
+  buildOfflineSyncSnapshotFromBase,
+  envConvergePeerRequestTimeoutMs as envConvergePeerRequestTimeoutMs2,
   isInternalRemnicStatePath as isInternalRemnicStatePath3,
-  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES3
+  normalizeConvergePeerRequestTimeoutMs,
+  parseConfig as parseConfig13
 } from "@remnic/core";
-import { parseFrontmatter } from "@remnic/core/storage.js";
 import { resolveCorpusNamespaceRoots } from "@remnic/core/corpus-watermark.js";
 import { listNamespaces } from "@remnic/core/namespaces/migrate.js";
 import {
-  planReconciliation
-} from "@remnic/core/reconcile/plan.js";
-import {
+  convergeIdentityCachePath,
   defaultConvergeCursorPath,
   deriveConvergeCursorBase,
+  normalizeConvergePeerUrl as normalizeConvergePeerUrl2,
   readConvergeCursor,
-  writeConvergeCursor,
-  normalizeConvergePeerUrl as normalizeConvergePeerUrl2
+  writeConvergeCursor
 } from "@remnic/core/reconcile/cursor.js";
 import {
   buildReconcileManifest,
   collapseActiveFactDuplicates
 } from "@remnic/core/reconcile/manifest.js";
-
-// src/offline-storage-io.ts
-import { createDecipheriv, createHash } from "crypto";
-import fs15 from "fs";
-import { lstat, mkdtemp, readdir, rm } from "fs/promises";
-import path from "path";
 import {
-  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES,
-  StorageManager as StorageManager2,
-  createSupportPassportPrivateFileExclusion
-} from "@remnic/core";
-import { OFFLINE_DECRYPT_STAGING_DIR_PREFIX } from "@remnic/core/offline-sync-exclude-globs";
+  planReconciliation
+} from "@remnic/core/reconcile/plan.js";
+import { resolveAgentAccessAuthToken } from "@remnic/core/resolve-auth-token.js";
+import { parseFrontmatter } from "@remnic/core/storage.js";
+
+// src/converge-identity-cache.ts
+import * as fs15 from "fs";
+import * as path from "path";
 import {
-  AUTH_TAG_LENGTH,
-  ENVELOPE_HEADER_SIZE,
-  ENVELOPE_LAYOUT,
-  ENVELOPE_SALT_LENGTH,
-  ENVELOPE_VERSION,
-  FILE_FORMAT_FLAGS,
-  FILE_FORMAT_VERSION,
-  IV_LENGTH,
-  MAGIC_BYTES,
-  MAGIC_HEADER_SIZE,
-  SecureStoreLockedError,
-  filePathAad,
-  isEncryptedFile,
-  keyring,
-  readHeader,
-  secureStoreDir
-} from "@remnic/core/secure-store";
-var OFFLINE_SYNC_EXCLUSION_CONCURRENCY = 16;
-function resolveOfflineDirectHydrationPath(memoryDir, relPath) {
-  const base = path.resolve(memoryDir);
-  const target = path.resolve(base, relPath);
-  const relative = path.relative(base, target);
-  if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-    throw new Error(`offline sync direct hydration path escapes memory dir: ${relPath}`);
-  }
-  return target;
-}
-async function filterOfflineSyncBaseFiles(memoryDir, files, excludeFile) {
-  const excluded = new Array(files.length);
-  for (let offset = 0; offset < files.length; offset += OFFLINE_SYNC_EXCLUSION_CONCURRENCY) {
-    await Promise.all(
-      files.slice(offset, offset + OFFLINE_SYNC_EXCLUSION_CONCURRENCY).map(async (file, index) => {
-        const filePath = resolveOfflineDirectHydrationPath(memoryDir, file.path);
-        excluded[offset + index] = await excludeFile({ root: memoryDir, path: file.path, filePath });
-      })
-    );
+  citationTemplateFingerprint,
+  isReconcileMemoryIdentity
+} from "@remnic/core/reconcile/manifest.js";
+var cacheWriteLocks = /* @__PURE__ */ new Map();
+async function withCacheWriteLock(cachePath, write) {
+  const previous = cacheWriteLocks.get(cachePath) ?? Promise.resolve();
+  const next = previous.then(write, write);
+  cacheWriteLocks.set(cachePath, next);
+  try {
+    await next;
+  } finally {
+    if (cacheWriteLocks.get(cachePath) === next) cacheWriteLocks.delete(cachePath);
   }
-  return files.filter((_file, index) => excluded[index] === false);
 }
-async function createConfiguredOfflineStorage(memoryDir, secureStoreEncryptOnWrite = true) {
-  const storage = new StorageManager2(memoryDir);
-  const header = await readHeader(memoryDir);
-  let secureStoreKey = null;
-  let secureStoreRequired = false;
-  if (header) {
-    secureStoreRequired = true;
-    storage.setSecureStoreRequired(true);
-    const key = keyring.getKey(secureStoreDir(memoryDir));
-    if (key) {
-      await storage.setSecureStoreKeyAndWait(key, secureStoreEncryptOnWrite);
-      secureStoreKey = key;
+async function loadConvergeIdentityCache(cachePath, citationTemplate) {
+  const cache = /* @__PURE__ */ new Map();
+  if (!cachePath) return cache;
+  try {
+    const raw = JSON.parse(await fs15.promises.readFile(cachePath, "utf8"));
+    if (raw.citationTemplate !== citationTemplateFingerprint(citationTemplate)) return cache;
+    for (const candidate of raw.files ?? []) {
+      const entry = candidate;
+      if (typeof entry?.path !== "string" || typeof entry.sha256 !== "string") continue;
+      if (entry.memory !== void 0 && !isReconcileMemoryIdentity(entry.memory)) continue;
+      if (entry.statIdentity !== void 0 && typeof entry.statIdentity !== "string") continue;
+      if (entry.excluded !== void 0 && typeof entry.excluded !== "boolean") continue;
+      if (entry.normalizerVersion !== void 0 && typeof entry.normalizerVersion !== "number") continue;
+      if (entry.identityResolutionVersion !== void 0 && typeof entry.identityResolutionVersion !== "number") {
+        continue;
+      }
+      cache.set(entry.path, {
+        path: entry.path,
+        sha256: entry.sha256,
+        ...entry.memory ? { memory: entry.memory } : {},
+        ...entry.memory ? {} : {
+          ...typeof entry.normalizerVersion === "number" ? { normalizerVersion: entry.normalizerVersion } : {},
+          ...typeof entry.identityResolutionVersion === "number" ? { identityResolutionVersion: entry.identityResolutionVersion } : {}
+        },
+        ...entry.statIdentity !== void 0 && entry.excluded !== void 0 ? { statIdentity: entry.statIdentity, excluded: entry.excluded } : {}
+      });
     }
+  } catch {
   }
-  return { storage, secureStoreKey, secureStoreRequired };
+  return cache;
 }
-async function createOfflineStorageForPath(memoryDir, filePath, configured, secureStoreEncryptOnWrite) {
-  const memoryRoot = path.resolve(memoryDir);
-  const stateDir = path.dirname(filePath);
-  if (path.basename(stateDir) !== "state" || path.basename(filePath) !== "memory-lifecycle-ledger.jsonl") {
-    throw new Error(`invalid lifecycle ledger path: ${filePath}`);
-  }
-  const storageRoot = path.resolve(path.dirname(stateDir));
-  if (storageRoot !== memoryRoot && !storageRoot.startsWith(`${memoryRoot}${path.sep}`)) {
-    throw new Error(`lifecycle ledger path is outside the offline memory directory: ${filePath}`);
-  }
-  const storage = new StorageManager2(storageRoot);
-  if (configured.secureStoreRequired) {
-    storage.setSecureStoreRequired(true);
-  }
-  if (configured.secureStoreKey) {
-    await storage.setSecureStoreKeyAndWait(configured.secureStoreKey, secureStoreEncryptOnWrite);
+async function saveConvergeIdentityCache(cachePath, manifest, citationTemplate, loaded, classifications) {
+  if (!cachePath) return;
+  const files = manifest.files.map((file) => ({
+    path: file.path,
+    sha256: file.sha256,
+    ...file.memory !== void 0 ? { memory: file.memory } : file.normalizerVersion !== void 0 && file.identityResolutionVersion !== void 0 ? {
+      normalizerVersion: file.normalizerVersion,
+      identityResolutionVersion: file.identityResolutionVersion
+    } : {}
+  }));
+  for (const entry of files) {
+    const classification = classifications?.get(entry.path);
+    if (classification === void 0) continue;
+    entry.statIdentity = classification.statIdentity;
+    entry.excluded = classification.excluded;
+  }
+  if (loaded !== void 0 && loaded.size === files.length && files.every((entry) => {
+    const previous = loaded.get(entry.path);
+    if (previous === void 0) return false;
+    if (previous.sha256 !== entry.sha256) return false;
+    if (previous.memory !== entry.memory) return false;
+    if ((previous.normalizerVersion ?? void 0) !== (entry.normalizerVersion ?? void 0)) return false;
+    if ((previous.identityResolutionVersion ?? void 0) !== (entry.identityResolutionVersion ?? void 0)) {
+      return false;
+    }
+    if ((previous.statIdentity ?? void 0) !== (entry.statIdentity ?? void 0)) return false;
+    return (previous.excluded ?? void 0) === (entry.excluded ?? void 0);
+  })) {
+    return;
   }
-  return storage;
-}
-async function createOfflineStorageIo(memoryDir, configuredStorage) {
-  await cleanupOrphanedOfflineDecryptStaging(memoryDir);
-  const { storage, secureStoreKey } = configuredStorage ?? await createConfiguredOfflineStorage(memoryDir);
-  return {
-    excludeFile: createSupportPassportPrivateFileExclusion(storage),
-    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-    readDeletionRevisions: () => storage.readDeletionRevisions(),
-    readFileDigest: async ({ filePath }) => {
-      const hash = createHash("sha256");
-      let bytes = 0;
-      for await (const rawChunk of readOfflineSyncFileChunks({
-        filePath,
-        memoryDir,
-        secureStoreKey,
-        chunkSize: OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES
-      })) {
-        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
-        hash.update(chunk);
-        bytes += chunk.length;
-      }
-      return {
-        sha256: hash.digest("hex"),
-        bytes
-      };
-    },
-    readFileChunks: ({ filePath, chunkSize }) => readOfflineSyncFileChunks({
-      filePath,
-      memoryDir,
-      secureStoreKey,
-      chunkSize
-    }),
-    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
-    writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
-    deleteFile: async ({ filePath, mtimeMs }) => storage.deleteOfflineSyncFile(filePath, mtimeMs ?? null),
-    recordDeletionRevision: async ({ filePath, mtimeMs }) => storage.recordReplicatedDeletionRevision(filePath, mtimeMs)
-  };
-}
-var OFFLINE_DECRYPT_STAGING_ORPHAN_MS = 60 * 60 * 1e3;
-async function cleanupOrphanedOfflineDecryptStaging(memoryDir) {
-  let entries;
   try {
-    entries = await readdir(memoryDir);
+    await withCacheWriteLock(cachePath, async () => {
+      const merged = new Map(files.map((entry) => [entry.path, entry]));
+      const dropped = new Set(
+        [...loaded?.keys() ?? []].filter((pathName) => !merged.has(pathName))
+      );
+      try {
+        const raw = JSON.parse(await fs15.promises.readFile(cachePath, "utf8"));
+        if (raw.citationTemplate === citationTemplateFingerprint(citationTemplate)) {
+          for (const candidate of raw.files ?? []) {
+            const entry = candidate;
+            if (typeof entry?.path !== "string" || typeof entry.sha256 !== "string") continue;
+            if (entry.memory !== void 0 && !isReconcileMemoryIdentity(entry.memory)) continue;
+            if (dropped.has(entry.path) || merged.has(entry.path)) continue;
+            merged.set(entry.path, {
+              path: entry.path,
+              sha256: entry.sha256,
+              ...entry.memory ? { memory: entry.memory } : {},
+              ...entry.memory ? {} : {
+                ...typeof entry.normalizerVersion === "number" ? { normalizerVersion: entry.normalizerVersion } : {},
+                ...typeof entry.identityResolutionVersion === "number" ? { identityResolutionVersion: entry.identityResolutionVersion } : {}
+              }
+            });
+          }
+        }
+      } catch {
+      }
+      const tmp = `${cachePath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+      await fs15.promises.mkdir(path.dirname(cachePath), { recursive: true });
+      await fs15.promises.writeFile(
+        tmp,
+        JSON.stringify({
+          citationTemplate: citationTemplateFingerprint(citationTemplate),
+          files: [...merged.values()]
+        })
+      );
+      await fs15.promises.rename(tmp, cachePath);
+    });
   } catch {
-    return;
-  }
-  const now = Date.now();
-  for (const name of entries) {
-    if (!name.startsWith(OFFLINE_DECRYPT_STAGING_DIR_PREFIX)) continue;
-    const dir = path.join(memoryDir, name);
-    try {
-      const info = await lstat(dir);
-      if (!info.isDirectory() || info.isSymbolicLink()) continue;
-      if (now - info.mtimeMs < OFFLINE_DECRYPT_STAGING_ORPHAN_MS) continue;
-      await rm(dir, { recursive: true, force: true });
-    } catch {
-    }
   }
 }
-async function* readOfflineSyncFileChunks(options) {
-  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE);
-  if (!isEncryptedFile(header)) {
-    yield* readPlainOfflineFileChunks(options.filePath, options.chunkSize);
-    return;
-  }
-  if (!options.secureStoreKey) {
-    throw new SecureStoreLockedError(
-      `secure-store is locked \u2014 cannot read encrypted file at ${options.filePath}. Run \`remnic secure-store unlock\` to decrypt.`
-    );
-  }
-  yield* readEncryptedOfflineFileChunks({
-    filePath: options.filePath,
-    memoryDir: options.memoryDir,
-    key: options.secureStoreKey,
-    chunkSize: options.chunkSize
-  });
-}
-async function readFilePrefix(filePath, length) {
-  const handle = await fs15.promises.open(filePath, "r");
-  try {
-    const out = Buffer.alloc(length);
-    const { bytesRead } = await handle.read(out, 0, length, 0);
-    return out.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
-async function* readPlainOfflineFileChunks(filePath, chunkSize) {
-  const stream = fs15.createReadStream(filePath, { highWaterMark: chunkSize });
-  for await (const chunk of stream) {
-    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-  }
-}
-async function* readEncryptedOfflineFileChunks(options) {
-  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);
-  if (header.length < MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE || !isEncryptedFile(header)) {
-    throw new Error(`secure-store encrypted file is truncated: ${options.filePath}`);
-  }
-  const version = header.readUInt8(MAGIC_BYTES.length);
-  const flags = header.readUInt8(MAGIC_BYTES.length + 1);
-  if (version !== FILE_FORMAT_VERSION) {
-    throw new Error(`secure-store file has unsupported version ${version}: ${options.filePath}`);
-  }
-  if (flags !== FILE_FORMAT_FLAGS) {
-    throw new Error(`secure-store file has unsupported flags 0x${flags.toString(16)}: ${options.filePath}`);
-  }
-  const envelopeHeader = header.subarray(MAGIC_HEADER_SIZE);
-  const envelopeVersion = envelopeHeader.readUInt8(ENVELOPE_LAYOUT.version);
-  if (envelopeVersion !== ENVELOPE_VERSION) {
-    throw new Error(`secure-store envelope has unsupported version ${envelopeVersion}: ${options.filePath}`);
-  }
-  const salt = envelopeHeader.subarray(ENVELOPE_LAYOUT.salt, ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH);
-  const iv = envelopeHeader.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);
-  const authTag = envelopeHeader.subarray(ENVELOPE_LAYOUT.authTag, ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH);
-  const aadCandidates = offlineFileAadCandidates(options.filePath, options.memoryDir);
-  let lastError;
-  for (const aad of aadCandidates) {
-    const tempDir = await mkdtemp(path.join(options.memoryDir, OFFLINE_DECRYPT_STAGING_DIR_PREFIX));
-    const tempPath = path.join(tempDir, "content");
-    try {
-      const decipher = createDecipheriv("aes-256-gcm", options.key, iv, {
-        authTagLength: AUTH_TAG_LENGTH
-      });
-      decipher.setAuthTag(authTag);
-      decipher.setAAD(Buffer.concat([secureStoreEnvelopeHeaderAad(salt), aad]));
-      const output = fs15.createWriteStream(tempPath, { mode: 384 });
-      try {
-        const stream = fs15.createReadStream(options.filePath, {
-          start: MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE,
-          highWaterMark: options.chunkSize
-        });
-        for await (const encryptedChunk of stream) {
-          const plain = decipher.update(Buffer.isBuffer(encryptedChunk) ? encryptedChunk : Buffer.from(encryptedChunk));
-          if (plain.length > 0 && !output.write(plain)) {
-            await new Promise((resolve2, reject) => {
-              output.once("drain", resolve2);
-              output.once("error", reject);
-            });
-          }
-        }
-        const finalPlain = decipher.final();
-        if (finalPlain.length > 0 && !output.write(finalPlain)) {
-          await new Promise((resolve2, reject) => {
-            output.once("drain", resolve2);
-            output.once("error", reject);
-          });
-        }
-      } finally {
-        await closeWriteStream(output);
-      }
-      yield* readPlainOfflineFileChunks(tempPath, options.chunkSize);
-      return;
-    } catch (error) {
-      lastError = error;
-    } finally {
-      await rm(tempDir, { recursive: true, force: true });
-    }
-  }
-  throw lastError instanceof Error ? lastError : new Error(`secure-store could not decrypt file: ${options.filePath}`);
-}
-function offlineFileAadCandidates(filePath, memoryDir) {
-  const candidates = [filePathAad(filePath, memoryDir)];
-  const relative = path.relative(memoryDir, filePath);
-  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return candidates;
-  const parts = relative.split(path.sep);
-  if (parts[0] === "namespaces" && parts.length >= 3 && parts[1]) {
-    candidates.push(filePathAad(filePath, path.join(memoryDir, "namespaces", parts[1])));
-  }
-  const memoryParts = path.resolve(memoryDir).split(path.sep);
-  if (memoryParts.length >= 3 && memoryParts.at(-2) === "namespaces" && memoryParts.at(-1)) {
-    const topLevelRoot = memoryParts.slice(0, -2).join(path.sep) || path.sep;
-    const topRelative = path.relative(topLevelRoot, filePath);
-    if (topRelative && !topRelative.startsWith("..") && !path.isAbsolute(topRelative) && topRelative.split(path.sep)[0] === "namespaces" && topRelative.split(path.sep)[1] === memoryParts.at(-1)) {
-      candidates.push(filePathAad(filePath, topLevelRoot));
-    }
-  }
-  return candidates;
-}
-async function closeWriteStream(stream) {
-  await new Promise((resolve2, reject) => {
-    stream.once("error", reject);
-    stream.end(() => resolve2());
-  });
-}
-function secureStoreEnvelopeHeaderAad(salt) {
-  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);
-  out.writeUInt8(ENVELOPE_VERSION, 0);
-  Buffer.from(salt).copy(out, 1);
-  return out;
-}
 
-// src/converge-watch.ts
-var CONVERGE_WATCH_MIN_INTERVAL_MS = 1e3;
-var CONVERGE_WATCH_DEFAULT_INTERVAL_MS = 3e5;
-var CONVERGE_WATCH_MAX_INTERVAL_MS = 2147483647;
-function sleepAborted(ms, signal) {
-  return new Promise((resolve2) => {
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve2(true);
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve2(false);
-    };
-    if (signal.aborted) {
-      clearTimeout(timer);
-      resolve2(false);
-      return;
-    }
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function convergeWatch(options) {
-  const intervalMs = Math.min(
-    CONVERGE_WATCH_MAX_INTERVAL_MS,
-    Math.max(CONVERGE_WATCH_MIN_INTERVAL_MS, options.intervalMs ?? CONVERGE_WATCH_DEFAULT_INTERVAL_MS)
-  );
-  const { apply, intervalMs: _intervalMs, maxCycles, onCycle, signal, ...applyOptions } = options;
-  const outcome = {
-    cycles: 0,
-    convergedCycles: 0,
-    appliedCycles: 0,
-    failedCycles: 0,
-    lastStatus: "aborted"
-  };
-  while (maxCycles === void 0 || outcome.cycles < maxCycles) {
-    if (signal?.aborted) break;
-    try {
-      const result = await apply(applyOptions);
-      outcome.cycles += 1;
-      if (result.status === "converged") outcome.convergedCycles += 1;
-      else if (result.status === "stopped_unresolved_conflicts" || result.status === "applied" && result.transfers.failed > 0) {
-        outcome.failedCycles += 1;
-      } else outcome.appliedCycles += 1;
-      outcome.lastStatus = result.status;
-      onCycle?.(outcome.cycles, { result });
-    } catch (err) {
-      outcome.cycles += 1;
-      outcome.failedCycles += 1;
-      outcome.lastStatus = "error";
-      onCycle?.(outcome.cycles, { error: err });
+// src/converge-report.ts
+function formatConvergeReport(plan) {
+  const lines = [];
+  lines.push(`Convergence Status: ${plan.converged ? "CONVERGED" : "DIVERGED"}`);
+  lines.push("");
+  lines.push("Per-Namespace Summary:");
+  if (plan.byNamespace.length === 0) {
+    lines.push("  (no namespaces evaluated)");
+  } else {
+    for (const report of plan.byNamespace) {
+      lines.push(`  [${report.namespace}]`);
+      lines.push(`    identical:  ${report.identical}`);
+      lines.push(`    pull:       ${report.pull}`);
+      lines.push(`    push:       ${report.push}`);
+      lines.push(`    conflict:   ${report.conflict}`);
+      lines.push(`    suppress:   ${report.suppress}`);
+      lines.push(`    unresolved: ${report.unresolved}`);
     }
-    if (maxCycles !== void 0 && outcome.cycles >= maxCycles) break;
-    const slept = await sleepAborted(intervalMs, signal ?? new AbortController().signal);
-    if (!slept) break;
   }
-  return outcome;
-}
-
-// src/converge-token-channel.ts
-import * as fs16 from "fs";
-function parseConvergeTokenFileFlag(raw) {
-  return raw !== void 0 && raw.length > 0 ? raw : null;
+  return lines.join("\n");
 }
-function resolveConvergeTokenChannel(input, env) {
-  if (input.argvToken !== void 0 && input.argvToken.length === 0) {
-    return { ok: false, error: "--token requires a non-empty value" };
-  }
-  const tokenFromArgv = input.argvToken !== void 0;
-  if (!tokenFromArgv && input.tokenFile !== void 0) {
-    try {
-      const stat2 = fs16.statSync(input.tokenFile);
-      if (process.platform !== "win32" && stat2.mode & 63) {
-        return { ok: false, error: `--token-file ${input.tokenFile} must not be group- or world-readable (chmod 600)` };
-      }
-      const token = fs16.readFileSync(input.tokenFile, "utf8").trim();
-      if (token.length === 0) {
-        return { ok: false, error: `--token-file ${input.tokenFile} is empty` };
-      }
-      return { ok: true, token, tokenFromArgv };
-    } catch (err) {
-      return { ok: false, error: `--token-file ${input.tokenFile} could not be read: ${err}` };
-    }
-  }
-  if (!tokenFromArgv && input.tokenFile === void 0 && env.REMNIC_CONVERGE_PEER_TOKEN !== void 0) {
-    if (env.REMNIC_CONVERGE_PEER_TOKEN.length === 0) {
-      return { ok: false, error: "REMNIC_CONVERGE_PEER_TOKEN is set but empty" };
-    }
-    return { ok: true, token: env.REMNIC_CONVERGE_PEER_TOKEN, tokenFromArgv: false };
-  }
-  return { ok: true, token: input.argvToken, tokenFromArgv };
+function formatConvergeApplyReport(result) {
+  const lines = [];
+  lines.push(`Convergence Execution Status: ${result.status.toUpperCase()}`);
+  lines.push(`Converged: ${result.converged ? "YES" : "NO"}`);
+  lines.push("");
+  lines.push("Transfers Executed:");
+  lines.push(`  pulled:             ${result.transfers.pulled}`);
+  lines.push(`  pushed:             ${result.transfers.pushed}`);
+  lines.push(`  conflictsResolved:  ${result.transfers.conflictsResolved}`);
+  lines.push(`  suppressed:         ${result.transfers.suppressed}`);
+  lines.push(`  failed:             ${result.transfers.failed}`);
+  lines.push("");
+  lines.push(formatConvergeReport(result.plan));
+  return lines.join("\n");
 }
 
-// src/converge.ts
-import { resolveAgentAccessAuthToken } from "@remnic/core/resolve-auth-token.js";
-
 // src/converge-peer-transport.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 import {
   isInternalRemnicStatePath as isInternalRemnicStatePath2,
   OFFLINE_SYNC_CHANGESET_FORMAT,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
-  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES
 } from "@remnic/core";
 import { normalizeConvergePeerUrl } from "@remnic/core/reconcile/cursor.js";
 
@@ -2101,7 +2089,7 @@ async function streamPeerFileContent(peerUrl, namespace, filePath, onChunk, toke
     "content-type": "application/json",
     ...token ? { authorization: `Bearer ${token}` } : {}
   };
-  const hash = createHash2("sha256");
+  const hash = createHash("sha256");
   let offset = 0;
   let expectedBytes;
   let expectedSha256;
@@ -2202,7 +2190,7 @@ async function postPeerFileContent(peerUrl, namespace, filePath, source, token,
   for (const route of routes) {
     let restartedRoute = false;
     while (offset < source.bytes || source.bytes === 0 && offset === 0) {
-      const length = Math.min(OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2, source.bytes - offset);
+      const length = Math.min(OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES, source.bytes - offset);
       let chunk;
       try {
         chunk = await source.readChunk(offset, length);
@@ -2241,92 +2229,531 @@ async function postPeerFileContent(peerUrl, namespace, filePath, source, token,
           restartedRoute = true;
           continue;
         }
-        previousAttemptFailed = true;
-        break;
-      }
-      const result = await response.json().catch(() => null);
-      if (!result || typeof result !== "object" || !("done" in result) || typeof result.done !== "boolean" || !("applied" in result) || typeof result.applied !== "boolean" || !("skipped" in result) || typeof result.skipped !== "boolean" || "conflict" in result && result.conflict) {
-        return false;
-      }
-      if (result.done) {
-        if (result.skipped) return previousAttemptFailed ? "applied" : "skipped";
-        return result.applied && offset + chunk.length === source.bytes ? "applied" : false;
+        previousAttemptFailed = true;
+        break;
+      }
+      const result = await response.json().catch(() => null);
+      if (!result || typeof result !== "object" || !("done" in result) || typeof result.done !== "boolean" || !("applied" in result) || typeof result.applied !== "boolean" || !("skipped" in result) || typeof result.skipped !== "boolean" || "conflict" in result && result.conflict) {
+        return false;
+      }
+      if (result.done) {
+        if (result.skipped) return previousAttemptFailed ? "applied" : "skipped";
+        return result.applied && offset + chunk.length === source.bytes ? "applied" : false;
+      }
+      if (result.applied || result.skipped || chunk.length === 0) return false;
+      offset += chunk.length;
+    }
+  }
+  return false;
+}
+async function postPeerConvergenceComplete(peerUrl, namespaces, token, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_PEER_REQUEST_TIMEOUT_MS) {
+  const base = normalizePeerBaseUrl(peerUrl);
+  const query = namespaces.map((namespace) => `namespace=${encodeURIComponent(namespace)}`).join("&");
+  const routes = ["/remnic/v1/offline-sync/convergence-complete", "/engram/v1/offline-sync/convergence-complete"];
+  for (const route of routes) {
+    const response = await fetchPeerRequest(
+      fetchImpl,
+      `${base}${route}?${query}`,
+      {
+        method: "POST",
+        headers: {
+          "x-remnic-source-id": encodeURIComponent("remnic-converge"),
+          ...token ? { authorization: `Bearer ${token}` } : {}
+        }
+      },
+      timeoutMs
+    ).catch(() => null);
+    if (!response?.ok) continue;
+    const result = await response.json().catch(() => null);
+    if (result && typeof result === "object" && "namespaces" in result && Array.isArray(result.namespaces) && result.namespaces.length === namespaces.length && result.namespaces.every((namespace, index) => namespace === namespaces[index]) && "refreshed" in result && result.refreshed === true) {
+      return true;
+    }
+  }
+  return false;
+}
+async function postPeerFileDeletion(peerUrl, namespace, filePath, baseSha256, token, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_PEER_REQUEST_TIMEOUT_MS) {
+  assertTransferablePeerPath(filePath);
+  const base = normalizePeerBaseUrl(peerUrl);
+  const routes = ["/remnic/v1/offline-sync/apply", "/engram/v1/offline-sync/apply"];
+  const headers = {
+    "content-type": "application/json",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+  let previousAttemptFailed = false;
+  for (const route of routes) {
+    try {
+      const response = await fetchPeerRequest(
+        fetchImpl,
+        `${base}${route}`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            namespace,
+            changeset: {
+              format: OFFLINE_SYNC_CHANGESET_FORMAT,
+              schemaVersion: 1,
+              createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+              sourceId: "remnic-converge",
+              includeTranscripts: false,
+              changes: [{ type: "delete", path: filePath, baseSha256 }]
+            }
+          })
+        },
+        timeoutMs
+      );
+      if (!response.ok) throw new Error(`offline apply request failed: ${response.status}`);
+      const result = await response.json().catch(() => null);
+      if (!result || typeof result !== "object" || !("appliedDeletes" in result) || typeof result.appliedDeletes !== "number" || !("skipped" in result) || typeof result.skipped !== "number" || !("conflicts" in result) || !Array.isArray(result.conflicts) || result.conflicts.length > 0) {
+        return false;
+      }
+      if (result.appliedDeletes === 1) return "applied";
+      if (result.skipped === 1) return previousAttemptFailed ? "applied" : "skipped";
+      return false;
+    } catch {
+      previousAttemptFailed = true;
+    }
+  }
+  return false;
+}
+
+// src/credential-channel.ts
+import * as fs16 from "fs";
+function parseTokenFileFlag(raw) {
+  return raw !== void 0 && raw.length > 0 ? raw : null;
+}
+function readTokenFileSameInode(tokenFile, afterValidate) {
+  let fd;
+  try {
+    if (process.platform === "win32") {
+      const pre = fs16.lstatSync(tokenFile);
+      if (pre.isSymbolicLink()) {
+        return { ok: false, error: `--token-file ${tokenFile} must be a regular file, not a symlink` };
+      }
+      if (!pre.isFile()) {
+        return { ok: false, error: `--token-file ${tokenFile} must be a regular file` };
+      }
+    }
+    fd = fs16.openSync(
+      tokenFile,
+      fs16.constants.O_RDONLY | (fs16.constants.O_NOFOLLOW ?? 0) | (fs16.constants.O_NONBLOCK ?? 0)
+    );
+  } catch (err) {
+    const code = err.code;
+    if (code === "ELOOP") {
+      return { ok: false, error: `--token-file ${tokenFile} must be a regular file, not a symlink` };
+    }
+    if (code === "EISDIR" || code === "ENOTDIR" || code === "ENXIO" || code === "EAGAIN" || code === "EWOULDBLOCK" || code === "EOPNOTSUPP" || code === "ENOTSUP") {
+      return { ok: false, error: `--token-file ${tokenFile} must be a regular file` };
+    }
+    return { ok: false, error: `--token-file ${tokenFile} could not be read: ${err}` };
+  }
+  try {
+    const opened = fs16.fstatSync(fd);
+    if (!opened.isFile()) {
+      return { ok: false, error: `--token-file ${tokenFile} must be a regular file` };
+    }
+    if (process.platform !== "win32" && opened.mode & 63) {
+      return { ok: false, error: `--token-file ${tokenFile} must not be group- or world-readable (chmod 600)` };
+    }
+    if (process.platform === "win32" || (fs16.constants.O_NOFOLLOW ?? 0) === 0) {
+      const pathStat = fs16.lstatSync(tokenFile);
+      if (pathStat.isSymbolicLink()) {
+        return { ok: false, error: `--token-file ${tokenFile} must be a regular file, not a symlink` };
+      }
+      if (!pathStat.isFile() || pathStat.dev !== opened.dev || pathStat.ino !== opened.ino) {
+        return { ok: false, error: `--token-file ${tokenFile} must be a regular file` };
+      }
+    }
+    afterValidate?.();
+    const size = opened.size;
+    const buf = Buffer.alloc(size);
+    const got = size > 0 ? fs16.readSync(fd, buf, 0, size, 0) : 0;
+    const token = buf.subarray(0, got).toString("utf8").trim();
+    const after = fs16.fstatSync(fd);
+    if (opened.dev !== after.dev || opened.ino !== after.ino || !after.isFile()) {
+      return { ok: false, error: `--token-file ${tokenFile} could not be read: file changed during read` };
+    }
+    if (token.length === 0) {
+      return { ok: false, error: `--token-file ${tokenFile} is empty` };
+    }
+    return { ok: true, token, tokenFromArgv: false };
+  } catch (err) {
+    return { ok: false, error: `--token-file ${tokenFile} could not be read: ${err}` };
+  } finally {
+    if (fd !== void 0) {
+      try {
+        fs16.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function resolveCredentialChannel(input, env, hooks) {
+  if (input.argvToken !== void 0 && input.argvToken.trim().length === 0) {
+    return { ok: false, error: "--token requires a non-empty value" };
+  }
+  if (input.argvToken !== void 0) {
+    return { ok: true, token: input.argvToken, tokenFromArgv: true };
+  }
+  if (input.tokenFile !== void 0) {
+    if (input.tokenFile.length === 0) {
+      return { ok: false, error: "--token-file requires a non-empty path" };
+    }
+    return readTokenFileSameInode(input.tokenFile, hooks?.afterTokenFileValidated);
+  }
+  for (const name of input.envNames) {
+    const value = env[name];
+    if (value === void 0) continue;
+    if (value.trim().length === 0) {
+      return { ok: false, error: `${name} is set but empty` };
+    }
+    return { ok: true, token: value, tokenFromArgv: false };
+  }
+  return { ok: true, token: void 0, tokenFromArgv: false };
+}
+
+// src/converge-watch.ts
+var CONVERGE_WATCH_MIN_INTERVAL_MS = 1e3;
+var CONVERGE_WATCH_DEFAULT_INTERVAL_MS = 3e5;
+var CONVERGE_WATCH_MAX_INTERVAL_MS = 2147483647;
+function sleepAborted(ms, signal) {
+  return new Promise((resolve2) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve2(true);
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve2(false);
+    };
+    if (signal.aborted) {
+      clearTimeout(timer);
+      resolve2(false);
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function convergeWatch(options) {
+  const intervalMs = Math.min(
+    CONVERGE_WATCH_MAX_INTERVAL_MS,
+    Math.max(CONVERGE_WATCH_MIN_INTERVAL_MS, options.intervalMs ?? CONVERGE_WATCH_DEFAULT_INTERVAL_MS)
+  );
+  const { apply, intervalMs: _intervalMs, maxCycles, onCycle, signal, ...applyOptions } = options;
+  const outcome = {
+    cycles: 0,
+    convergedCycles: 0,
+    appliedCycles: 0,
+    failedCycles: 0,
+    lastStatus: "aborted"
+  };
+  while (maxCycles === void 0 || outcome.cycles < maxCycles) {
+    if (signal?.aborted) break;
+    try {
+      const result = await apply(applyOptions);
+      outcome.cycles += 1;
+      if (result.status === "converged") outcome.convergedCycles += 1;
+      else if (result.status === "stopped_unresolved_conflicts" || result.status === "applied" && result.transfers.failed > 0) {
+        outcome.failedCycles += 1;
+      } else outcome.appliedCycles += 1;
+      outcome.lastStatus = result.status;
+      onCycle?.(outcome.cycles, { result });
+    } catch (err) {
+      outcome.cycles += 1;
+      outcome.failedCycles += 1;
+      outcome.lastStatus = "error";
+      onCycle?.(outcome.cycles, { error: err });
+    }
+    if (maxCycles !== void 0 && outcome.cycles >= maxCycles) break;
+    const slept = await sleepAborted(intervalMs, signal ?? new AbortController().signal);
+    if (!slept) break;
+  }
+  return outcome;
+}
+
+// src/offline-storage-io.ts
+import { createDecipheriv, createHash as createHash2 } from "crypto";
+import fs17 from "fs";
+import { lstat, mkdtemp, readdir, rm } from "fs/promises";
+import path2 from "path";
+import {
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2,
+  StorageManager as StorageManager3,
+  createPersistedSupportPassportPrivateFileExclusion,
+  createSupportPassportPrivateFileExclusion
+} from "@remnic/core";
+import { OFFLINE_DECRYPT_STAGING_DIR_PREFIX } from "@remnic/core/offline-sync-exclude-globs";
+import {
+  AUTH_TAG_LENGTH,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  IV_LENGTH,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  SecureStoreLockedError,
+  filePathAad,
+  isEncryptedFile,
+  keyring,
+  readHeader,
+  secureStoreDir
+} from "@remnic/core/secure-store";
+var OFFLINE_SYNC_EXCLUSION_CONCURRENCY = 16;
+function resolveOfflineDirectHydrationPath(memoryDir, relPath) {
+  const base = path2.resolve(memoryDir);
+  const target = path2.resolve(base, relPath);
+  const relative = path2.relative(base, target);
+  if (relative === "" || relative === ".." || relative.startsWith(`..${path2.sep}`) || path2.isAbsolute(relative)) {
+    throw new Error(`offline sync direct hydration path escapes memory dir: ${relPath}`);
+  }
+  return target;
+}
+async function filterOfflineSyncBaseFiles(memoryDir, files, excludeFile) {
+  const excluded = new Array(files.length);
+  for (let offset = 0; offset < files.length; offset += OFFLINE_SYNC_EXCLUSION_CONCURRENCY) {
+    await Promise.all(
+      files.slice(offset, offset + OFFLINE_SYNC_EXCLUSION_CONCURRENCY).map(async (file, index) => {
+        const filePath = resolveOfflineDirectHydrationPath(memoryDir, file.path);
+        excluded[offset + index] = await excludeFile({ root: memoryDir, path: file.path, filePath });
+      })
+    );
+  }
+  return files.filter((_file, index) => excluded[index] === false);
+}
+async function createConfiguredOfflineStorage(memoryDir, secureStoreEncryptOnWrite = true) {
+  const storage = new StorageManager3(memoryDir);
+  const header = await readHeader(memoryDir);
+  let secureStoreKey = null;
+  let secureStoreRequired = false;
+  if (header) {
+    secureStoreRequired = true;
+    storage.setSecureStoreRequired(true);
+    const key = keyring.getKey(secureStoreDir(memoryDir));
+    if (key) {
+      await storage.setSecureStoreKeyAndWait(key, secureStoreEncryptOnWrite);
+      secureStoreKey = key;
+    }
+  }
+  return { storage, secureStoreKey, secureStoreRequired };
+}
+async function createOfflineStorageForPath(memoryDir, filePath, configured, secureStoreEncryptOnWrite) {
+  const memoryRoot = path2.resolve(memoryDir);
+  const stateDir = path2.dirname(filePath);
+  if (path2.basename(stateDir) !== "state" || path2.basename(filePath) !== "memory-lifecycle-ledger.jsonl") {
+    throw new Error(`invalid lifecycle ledger path: ${filePath}`);
+  }
+  const storageRoot = path2.resolve(path2.dirname(stateDir));
+  if (storageRoot !== memoryRoot && !storageRoot.startsWith(`${memoryRoot}${path2.sep}`)) {
+    throw new Error(`lifecycle ledger path is outside the offline memory directory: ${filePath}`);
+  }
+  const storage = new StorageManager3(storageRoot);
+  if (configured.secureStoreRequired) {
+    storage.setSecureStoreRequired(true);
+  }
+  if (configured.secureStoreKey) {
+    await storage.setSecureStoreKeyAndWait(configured.secureStoreKey, secureStoreEncryptOnWrite);
+  }
+  return storage;
+}
+async function createOfflineStorageIo(memoryDir, configuredStorage, persistedExclusion) {
+  await cleanupOrphanedOfflineDecryptStaging(memoryDir);
+  const { storage, secureStoreKey } = configuredStorage ?? await createConfiguredOfflineStorage(memoryDir);
+  return {
+    // With persisted classifications the warm path skips the per-file
+    // read+parse the plain exclusion performs for every candidate.
+    excludeFile: persistedExclusion ? createPersistedSupportPassportPrivateFileExclusion(
+      storage,
+      persistedExclusion.persisted,
+      persistedExclusion.updates
+    ) : createSupportPassportPrivateFileExclusion(storage),
+    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
+    readDeletionRevisions: () => storage.readDeletionRevisions(),
+    readFileDigest: async ({ filePath }) => {
+      const hash = createHash2("sha256");
+      let bytes = 0;
+      for await (const rawChunk of readOfflineSyncFileChunks({
+        filePath,
+        memoryDir,
+        secureStoreKey,
+        chunkSize: OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2
+      })) {
+        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+        hash.update(chunk);
+        bytes += chunk.length;
+      }
+      return {
+        sha256: hash.digest("hex"),
+        bytes
+      };
+    },
+    readFileChunks: ({ filePath, chunkSize }) => readOfflineSyncFileChunks({
+      filePath,
+      memoryDir,
+      secureStoreKey,
+      chunkSize
+    }),
+    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
+    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
+    writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
+    deleteFile: async ({ filePath, mtimeMs }) => storage.deleteOfflineSyncFile(filePath, mtimeMs ?? null),
+    recordDeletionRevision: async ({ filePath, mtimeMs }) => storage.recordReplicatedDeletionRevision(filePath, mtimeMs)
+  };
+}
+var OFFLINE_DECRYPT_STAGING_ORPHAN_MS = 60 * 60 * 1e3;
+async function cleanupOrphanedOfflineDecryptStaging(memoryDir) {
+  let entries;
+  try {
+    entries = await readdir(memoryDir);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const name of entries) {
+    if (!name.startsWith(OFFLINE_DECRYPT_STAGING_DIR_PREFIX)) continue;
+    const dir = path2.join(memoryDir, name);
+    try {
+      const info = await lstat(dir);
+      if (!info.isDirectory() || info.isSymbolicLink()) continue;
+      if (now - info.mtimeMs < OFFLINE_DECRYPT_STAGING_ORPHAN_MS) continue;
+      await rm(dir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function* readOfflineSyncFileChunks(options) {
+  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE);
+  if (!isEncryptedFile(header)) {
+    yield* readPlainOfflineFileChunks(options.filePath, options.chunkSize);
+    return;
+  }
+  if (!options.secureStoreKey) {
+    throw new SecureStoreLockedError(
+      `secure-store is locked \u2014 cannot read encrypted file at ${options.filePath}. Run \`remnic secure-store unlock\` to decrypt.`
+    );
+  }
+  yield* readEncryptedOfflineFileChunks({
+    filePath: options.filePath,
+    memoryDir: options.memoryDir,
+    key: options.secureStoreKey,
+    chunkSize: options.chunkSize
+  });
+}
+async function readFilePrefix(filePath, length) {
+  const handle = await fs17.promises.open(filePath, "r");
+  try {
+    const out = Buffer.alloc(length);
+    const { bytesRead } = await handle.read(out, 0, length, 0);
+    return out.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+async function* readPlainOfflineFileChunks(filePath, chunkSize) {
+  const stream = fs17.createReadStream(filePath, { highWaterMark: chunkSize });
+  for await (const chunk of stream) {
+    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+  }
+}
+async function* readEncryptedOfflineFileChunks(options) {
+  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);
+  if (header.length < MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE || !isEncryptedFile(header)) {
+    throw new Error(`secure-store encrypted file is truncated: ${options.filePath}`);
+  }
+  const version = header.readUInt8(MAGIC_BYTES.length);
+  const flags = header.readUInt8(MAGIC_BYTES.length + 1);
+  if (version !== FILE_FORMAT_VERSION) {
+    throw new Error(`secure-store file has unsupported version ${version}: ${options.filePath}`);
+  }
+  if (flags !== FILE_FORMAT_FLAGS) {
+    throw new Error(`secure-store file has unsupported flags 0x${flags.toString(16)}: ${options.filePath}`);
+  }
+  const envelopeHeader = header.subarray(MAGIC_HEADER_SIZE);
+  const envelopeVersion = envelopeHeader.readUInt8(ENVELOPE_LAYOUT.version);
+  if (envelopeVersion !== ENVELOPE_VERSION) {
+    throw new Error(`secure-store envelope has unsupported version ${envelopeVersion}: ${options.filePath}`);
+  }
+  const salt = envelopeHeader.subarray(ENVELOPE_LAYOUT.salt, ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH);
+  const iv = envelopeHeader.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);
+  const authTag = envelopeHeader.subarray(ENVELOPE_LAYOUT.authTag, ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH);
+  const aadCandidates = offlineFileAadCandidates(options.filePath, options.memoryDir);
+  let lastError;
+  for (const aad of aadCandidates) {
+    const tempDir = await mkdtemp(path2.join(options.memoryDir, OFFLINE_DECRYPT_STAGING_DIR_PREFIX));
+    const tempPath = path2.join(tempDir, "content");
+    try {
+      const decipher = createDecipheriv("aes-256-gcm", options.key, iv, {
+        authTagLength: AUTH_TAG_LENGTH
+      });
+      decipher.setAuthTag(authTag);
+      decipher.setAAD(Buffer.concat([secureStoreEnvelopeHeaderAad(salt), aad]));
+      const output = fs17.createWriteStream(tempPath, { mode: 384 });
+      try {
+        const stream = fs17.createReadStream(options.filePath, {
+          start: MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE,
+          highWaterMark: options.chunkSize
+        });
+        for await (const encryptedChunk of stream) {
+          const plain = decipher.update(Buffer.isBuffer(encryptedChunk) ? encryptedChunk : Buffer.from(encryptedChunk));
+          if (plain.length > 0 && !output.write(plain)) {
+            await new Promise((resolve2, reject) => {
+              output.once("drain", resolve2);
+              output.once("error", reject);
+            });
+          }
+        }
+        const finalPlain = decipher.final();
+        if (finalPlain.length > 0 && !output.write(finalPlain)) {
+          await new Promise((resolve2, reject) => {
+            output.once("drain", resolve2);
+            output.once("error", reject);
+          });
+        }
+      } finally {
+        await closeWriteStream(output);
       }
-      if (result.applied || result.skipped || chunk.length === 0) return false;
-      offset += chunk.length;
+      yield* readPlainOfflineFileChunks(tempPath, options.chunkSize);
+      return;
+    } catch (error) {
+      lastError = error;
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
     }
   }
-  return false;
+  throw lastError instanceof Error ? lastError : new Error(`secure-store could not decrypt file: ${options.filePath}`);
 }
-async function postPeerConvergenceComplete(peerUrl, namespaces, token, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_PEER_REQUEST_TIMEOUT_MS) {
-  const base = normalizePeerBaseUrl(peerUrl);
-  const query = namespaces.map((namespace) => `namespace=${encodeURIComponent(namespace)}`).join("&");
-  const routes = ["/remnic/v1/offline-sync/convergence-complete", "/engram/v1/offline-sync/convergence-complete"];
-  for (const route of routes) {
-    const response = await fetchPeerRequest(
-      fetchImpl,
-      `${base}${route}?${query}`,
-      {
-        method: "POST",
-        headers: {
-          "x-remnic-source-id": encodeURIComponent("remnic-converge"),
-          ...token ? { authorization: `Bearer ${token}` } : {}
-        }
-      },
-      timeoutMs
-    ).catch(() => null);
-    if (!response?.ok) continue;
-    const result = await response.json().catch(() => null);
-    if (result && typeof result === "object" && "namespaces" in result && Array.isArray(result.namespaces) && result.namespaces.length === namespaces.length && result.namespaces.every((namespace, index) => namespace === namespaces[index]) && "refreshed" in result && result.refreshed === true) {
-      return true;
-    }
+function offlineFileAadCandidates(filePath, memoryDir) {
+  const candidates = [filePathAad(filePath, memoryDir)];
+  const relative = path2.relative(memoryDir, filePath);
+  if (!relative || relative.startsWith("..") || path2.isAbsolute(relative)) return candidates;
+  const parts = relative.split(path2.sep);
+  if (parts[0] === "namespaces" && parts.length >= 3 && parts[1]) {
+    candidates.push(filePathAad(filePath, path2.join(memoryDir, "namespaces", parts[1])));
   }
-  return false;
-}
-async function postPeerFileDeletion(peerUrl, namespace, filePath, baseSha256, token, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_PEER_REQUEST_TIMEOUT_MS) {
-  assertTransferablePeerPath(filePath);
-  const base = normalizePeerBaseUrl(peerUrl);
-  const routes = ["/remnic/v1/offline-sync/apply", "/engram/v1/offline-sync/apply"];
-  const headers = {
-    "content-type": "application/json",
-    ...token ? { authorization: `Bearer ${token}` } : {}
-  };
-  let previousAttemptFailed = false;
-  for (const route of routes) {
-    try {
-      const response = await fetchPeerRequest(
-        fetchImpl,
-        `${base}${route}`,
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify({
-            namespace,
-            changeset: {
-              format: OFFLINE_SYNC_CHANGESET_FORMAT,
-              schemaVersion: 1,
-              createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-              sourceId: "remnic-converge",
-              includeTranscripts: false,
-              changes: [{ type: "delete", path: filePath, baseSha256 }]
-            }
-          })
-        },
-        timeoutMs
-      );
-      if (!response.ok) throw new Error(`offline apply request failed: ${response.status}`);
-      const result = await response.json().catch(() => null);
-      if (!result || typeof result !== "object" || !("appliedDeletes" in result) || typeof result.appliedDeletes !== "number" || !("skipped" in result) || typeof result.skipped !== "number" || !("conflicts" in result) || !Array.isArray(result.conflicts) || result.conflicts.length > 0) {
-        return false;
-      }
-      if (result.appliedDeletes === 1) return "applied";
-      if (result.skipped === 1) return previousAttemptFailed ? "applied" : "skipped";
-      return false;
-    } catch {
-      previousAttemptFailed = true;
+  const memoryParts = path2.resolve(memoryDir).split(path2.sep);
+  if (memoryParts.length >= 3 && memoryParts.at(-2) === "namespaces" && memoryParts.at(-1)) {
+    const topLevelRoot = memoryParts.slice(0, -2).join(path2.sep) || path2.sep;
+    const topRelative = path2.relative(topLevelRoot, filePath);
+    if (topRelative && !topRelative.startsWith("..") && !path2.isAbsolute(topRelative) && topRelative.split(path2.sep)[0] === "namespaces" && topRelative.split(path2.sep)[1] === memoryParts.at(-1)) {
+      candidates.push(filePathAad(filePath, topLevelRoot));
     }
   }
-  return false;
+  return candidates;
+}
+async function closeWriteStream(stream) {
+  await new Promise((resolve2, reject) => {
+    stream.once("error", reject);
+    stream.end(() => resolve2());
+  });
+}
+function secureStoreEnvelopeHeaderAad(salt) {
+  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);
+  out.writeUInt8(ENVELOPE_VERSION, 0);
+  Buffer.from(salt).copy(out, 1);
+  return out;
 }
 
 // src/converge.ts
@@ -2365,7 +2792,7 @@ async function readLocalTombstoneEvidence(rootDir) {
   for (const relativePath of TOMBSTONE_PATHS) {
     let content;
     try {
-      content = await fs17.promises.readFile(path2.join(rootDir, relativePath), "utf-8");
+      content = await fs18.promises.readFile(path3.join(rootDir, relativePath), "utf-8");
     } catch (error) {
       if (error.code === "ENOENT") continue;
       throw error;
@@ -2377,20 +2804,20 @@ async function readLocalTombstoneEvidence(rootDir) {
   return merged;
 }
 async function discoverCursorNamespaces(memoryDir, peerUrl) {
-  const cursorDir = path2.join(path2.resolve(memoryDir), ".remnic", "state", "converge-cursors");
+  const cursorDir = path3.join(path3.resolve(memoryDir), ".remnic", "state", "converge-cursors");
   let entries;
   try {
-    entries = await fs17.promises.readdir(cursorDir, { withFileTypes: true });
+    entries = await fs18.promises.readdir(cursorDir, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
   }
   const namespaces = /* @__PURE__ */ new Set();
   for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const cursor = await readConvergeCursor(path2.join(cursorDir, entry.name));
+    if (!entry.isFile() || !entry.name.endsWith(".json") || entry.name.startsWith("identity-")) continue;
+    const cursor = await readConvergeCursor(path3.join(cursorDir, entry.name));
     if (!cursor) throw new Error(`invalid converge cursor: ${entry.name}`);
-    if (path2.basename(defaultConvergeCursorPath(memoryDir, peerUrl, cursor.namespace)) !== entry.name) continue;
+    if (path3.basename(defaultConvergeCursorPath(memoryDir, peerUrl, cursor.namespace)) !== entry.name) continue;
     namespaces.add(cursor.namespace);
   }
   return [...namespaces].sort();
@@ -2480,7 +2907,13 @@ async function computeConvergePlan(options = {}) {
     for (const rootInfo of roots) {
       const ns = rootInfo.namespace;
       namespacesToPlan.add(ns);
-      const io = await createOfflineStorageIo(rootInfo.rootDir);
+      const identityCachePath = memoryDir ? convergeIdentityCachePath(memoryDir, options.peerUrl ?? "local", ns) : void 0;
+      const identityCache = await loadConvergeIdentityCache(identityCachePath, config.inlineSourceAttributionFormat);
+      const classificationUpdates = /* @__PURE__ */ new Map();
+      const io = await createOfflineStorageIo(rootInfo.rootDir, void 0, {
+        persisted: identityCache,
+        updates: classificationUpdates
+      });
       const snapshot = await buildOfflineSyncSnapshotFromBase({
         root: rootInfo.rootDir,
         sourceId: "local",
@@ -2502,17 +2935,18 @@ async function computeConvergePlan(options = {}) {
         files,
         parseMemory: parseFrontmatter,
         citationTemplate: config.inlineSourceAttributionFormat,
+        ...identityCache.size > 0 ? { cachedFiles: [...identityCache.values()] } : {},
         readFile: async (file) => {
           const readFile3 = io.readFile;
           if (!readFile3) {
             manifestReadFailed = true;
-            throw new Error("offline storage cannot read reconciliation manifest files");
+            throw new Error("offline storage io cannot read manifest files");
           }
           try {
             return await readFile3({
               root: rootInfo.rootDir,
               path: file.path,
-              filePath: path2.join(rootInfo.rootDir, file.path)
+              filePath: path3.join(rootInfo.rootDir, file.path)
             });
           } catch (error) {
             manifestReadFailed = true;
@@ -2525,6 +2959,13 @@ async function computeConvergePlan(options = {}) {
       }
       localManifests.set(ns, manifest);
       localTombstones.set(ns, tombstonedFileDigests(evidence, manifest));
+      await saveConvergeIdentityCache(
+        identityCachePath,
+        manifest,
+        config.inlineSourceAttributionFormat,
+        identityCache,
+        classificationUpdates
+      );
     }
   }
   const peerUrl = options.peerUrl;
@@ -2873,13 +3314,13 @@ async function executeConvergeApply(options = {}) {
         const rootDir = rootMap.get(entry.namespace);
         if (rootDir) {
           try {
-            const filePath = path2.join(rootDir, localPath);
+            const filePath = path3.join(rootDir, localPath);
             const io = await createOfflineStorageIo(rootDir);
             const current = await io.readFileDigest({ root: rootDir, path: localPath, filePath });
             if (current.sha256 !== entry.localSha256) {
               throw new Error(`local file changed during push: ${localPath}`);
             }
-            const stat2 = await fs17.promises.stat(filePath);
+            const stat2 = await fs18.promises.stat(filePath);
             let chunks;
             let chunkOffset = 0;
             const resetChunks = async () => {
@@ -2970,7 +3411,7 @@ async function executeConvergeApply(options = {}) {
         if (rootDir && entry.localSha256) {
           try {
             const io = await createOfflineStorageIo(rootDir);
-            const filePath = path2.join(rootDir, localPath);
+            const filePath = path3.join(rootDir, localPath);
             const current = await io.readFileDigest({ root: rootDir, path: localPath, filePath });
             if (current.sha256 === entry.localSha256) {
               await io.deleteFile({ root: rootDir, path: localPath, filePath });
@@ -3023,7 +3464,7 @@ async function executeConvergeApply(options = {}) {
           if (rootDir) {
             try {
               const io = await createOfflineStorageIo(rootDir);
-              const filePath = path2.join(rootDir, localPath);
+              const filePath = path3.join(rootDir, localPath);
               const current = await io.readFileDigest({ root: rootDir, path: localPath, filePath });
               if (current.sha256 === entry.localSha256) {
                 await io.deleteFile({ root: rootDir, path: localPath, filePath });
@@ -3117,41 +3558,6 @@ async function updateCursorsForPlan(plan, options) {
     }
   }
 }
-function formatConvergeReport(plan) {
-  const lines = [];
-  lines.push(`Convergence Status: ${plan.converged ? "CONVERGED" : "DIVERGED"}`);
-  lines.push("");
-  lines.push("Per-Namespace Summary:");
-  if (plan.byNamespace.length === 0) {
-    lines.push("  (no namespaces evaluated)");
-  } else {
-    for (const report of plan.byNamespace) {
-      lines.push(`  [${report.namespace}]`);
-      lines.push(`    identical:  ${report.identical}`);
-      lines.push(`    pull:       ${report.pull}`);
-      lines.push(`    push:       ${report.push}`);
-      lines.push(`    conflict:   ${report.conflict}`);
-      lines.push(`    suppress:   ${report.suppress}`);
-      lines.push(`    unresolved: ${report.unresolved}`);
-    }
-  }
-  return lines.join("\n");
-}
-function formatConvergeApplyReport(result) {
-  const lines = [];
-  lines.push(`Convergence Execution Status: ${result.status.toUpperCase()}`);
-  lines.push(`Converged: ${result.converged ? "YES" : "NO"}`);
-  lines.push("");
-  lines.push("Transfers Executed:");
-  lines.push(`  pulled:             ${result.transfers.pulled}`);
-  lines.push(`  pushed:             ${result.transfers.pushed}`);
-  lines.push(`  conflictsResolved:  ${result.transfers.conflictsResolved}`);
-  lines.push(`  suppressed:         ${result.transfers.suppressed}`);
-  lines.push(`  failed:             ${result.transfers.failed}`);
-  lines.push("");
-  lines.push(formatConvergeReport(result.plan));
-  return lines.join("\n");
-}
 function convergeTimeoutFlagToMs(seconds) {
   return normalizeConvergePeerRequestTimeoutMs(Math.round(seconds * 1e3), "--timeout");
 }
@@ -3189,7 +3595,7 @@ Subcommands:
   for (let i = 0; i < rest.length; i += 1) {
     const arg = rest[i];
     if (arg === "--token-file") {
-      tokenFile = parseConvergeTokenFileFlag(rest[i + 1]);
+      tokenFile = parseTokenFileFlag(rest[i + 1]);
       if (tokenFile === null) {
         process.stderr.write("converge: --token-file requires a path.\n");
         process.exitCode = 2;
@@ -3237,8 +3643,8 @@ Subcommands:
       i += 1;
     }
   }
-  const tokenChannel = resolveConvergeTokenChannel(
-    { argvToken: peerToken, tokenFile: tokenFile ?? void 0 },
+  const tokenChannel = resolveCredentialChannel(
+    { argvToken: peerToken, tokenFile: tokenFile ?? void 0, envNames: ["REMNIC_CONVERGE_PEER_TOKEN"] },
     process.env
   );
   if (!tokenChannel.ok) {
@@ -3462,8 +3868,8 @@ function renderReplayResult(result, targetNamespace, format) {
 }
 
 // src/quarantine-replay.ts
-import * as fs18 from "fs";
-import { EngramAccessService, Orchestrator as Orchestrator8, initLogger as initLogger3, parseConfig as parseConfig14, resolveRemnicConfigRecord as resolveRemnicConfigRecord13 } from "@remnic/core";
+import * as fs19 from "fs";
+import { EngramAccessService, Orchestrator as Orchestrator9, initLogger as initLogger3, parseConfig as parseConfig14, resolveRemnicConfigRecord as resolveRemnicConfigRecord13 } from "@remnic/core";
 import { WriteQuarantineStore } from "@remnic/core/write-quarantine.js";
 function valueFlag(args, flag) {
   const occurrences = args.filter((a) => a === flag).length;
@@ -3511,9 +3917,9 @@ async function runQuarantineReplay(rest, format, resolveConfigPath2) {
   let orchestrator;
   try {
     const configPath = resolveConfigPath2();
-    const raw = fs18.existsSync(configPath) ? JSON.parse(fs18.readFileSync(configPath, "utf8")) : {};
+    const raw = fs19.existsSync(configPath) ? JSON.parse(fs19.readFileSync(configPath, "utf8")) : {};
     const config = parseConfig14(resolveRemnicConfigRecord13(raw));
-    orchestrator = new Orchestrator8(config);
+    orchestrator = new Orchestrator9(config);
     await orchestrator.initialize();
     await orchestrator.deferredReady;
     const service = new EngramAccessService(orchestrator);
@@ -3543,7 +3949,7 @@ async function runQuarantineReplay(rest, format, resolveConfigPath2) {
 }
 
 // src/offline-impression-rotation.ts
-import fs19 from "fs";
+import fs20 from "fs";
 import { parseConfig as parseConfig15, resolveRemnicConfigRecord as resolveRemnicConfigRecord14, drainPendingImpressionsForOfflineSync } from "@remnic/core";
 import { LastRecallStore } from "@remnic/core/recall-state";
 function parseConfigQuietly(raw) {
@@ -3578,7 +3984,7 @@ function pickOfflineConfigRecord(raw) {
 function resolveOfflineImpressionRotation(configPath) {
   let raw;
   try {
-    raw = fs19.existsSync(configPath) ? JSON.parse(fs19.readFileSync(configPath, "utf8")) : {};
+    raw = fs20.existsSync(configPath) ? JSON.parse(fs20.readFileSync(configPath, "utf8")) : {};
   } catch {
     throw new Error(
       `cannot read recall-impression rotation from ${configPath}: config file could not be read as JSON`
@@ -3609,20 +4015,20 @@ async function drainOfflineSyncImpressions(memoryDir, rotation) {
 // src/bench-build-freshness.ts
 import {
   existsSync as existsSync2,
-  lstatSync,
+  lstatSync as lstatSync2,
   readdirSync,
-  readFileSync as readFileSync3,
-  statSync as statSync2
+  readFileSync as readFileSync2,
+  statSync
 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { fileURLToPath } from "url";
 var STALE_BUILD_TOLERANCE_MS = 1e3;
 function assertLocalBenchBuildFreshForDevelopment(currentModuleUrl) {
   if (isTruthyEnv(process.env.REMNIC_BENCH_ALLOW_STALE_DIST)) {
     return;
   }
-  const currentDir = path3.dirname(fileURLToPath(currentModuleUrl));
-  const benchPackageDir = path3.resolve(currentDir, "../../bench");
+  const currentDir = path4.dirname(fileURLToPath(currentModuleUrl));
+  const benchPackageDir = path4.resolve(currentDir, "../../bench");
   const freshness = checkBenchBuildFreshness(benchPackageDir);
   if (!freshness.stale) {
     return;
@@ -3639,30 +4045,30 @@ function assertLocalBenchBuildFreshForDevelopment(currentModuleUrl) {
   );
 }
 function checkBenchBuildFreshness(benchPackageDir) {
-  const packageJsonPath = path3.join(benchPackageDir, "package.json");
+  const packageJsonPath = path4.join(benchPackageDir, "package.json");
   if (!existsSync2(packageJsonPath)) {
     return { stale: false };
   }
   let packageName;
   try {
-    packageName = JSON.parse(readFileSync3(packageJsonPath, "utf8")).name;
+    packageName = JSON.parse(readFileSync2(packageJsonPath, "utf8")).name;
   } catch {
     return { stale: false };
   }
   if (packageName !== "@remnic/bench") {
     return { stale: false };
   }
-  const srcDir = path3.join(benchPackageDir, "src");
+  const srcDir = path4.join(benchPackageDir, "src");
   if (!isDirectory(srcDir)) {
     return { stale: false };
   }
   const sourceRoots = [
     srcDir,
     packageJsonPath,
-    path3.join(benchPackageDir, "tsup.config.ts"),
-    path3.join(benchPackageDir, "tsconfig.json")
+    path4.join(benchPackageDir, "tsup.config.ts"),
+    path4.join(benchPackageDir, "tsconfig.json")
   ];
-  const distPath = path3.join(benchPackageDir, "dist", "index.js");
+  const distPath = path4.join(benchPackageDir, "dist", "index.js");
   if (!existsSync2(distPath)) {
     return {
       stale: true,
@@ -3674,7 +4080,7 @@ function checkBenchBuildFreshness(benchPackageDir) {
   if (!newestSource) {
     return { stale: false };
   }
-  const distMtimeMs = statSync2(distPath).mtimeMs;
+  const distMtimeMs = statSync(distPath).mtimeMs;
   if (newestSource.mtimeMs > distMtimeMs + STALE_BUILD_TOLERANCE_MS) {
     return {
       stale: true,
@@ -3699,13 +4105,13 @@ function newestMtime(roots) {
     if (!existsSync2(entryPath)) {
       return;
     }
-    const stat2 = lstatSync(entryPath);
+    const stat2 = lstatSync2(entryPath);
     if (stat2.isSymbolicLink()) {
       return;
     }
     if (stat2.isDirectory()) {
       for (const child of readdirSync(entryPath)) {
-        visit(path3.join(entryPath, child));
+        visit(path4.join(entryPath, child));
       }
       return;
     }
@@ -3723,7 +4129,7 @@ function newestMtime(roots) {
 }
 function isDirectory(entryPath) {
   try {
-    return statSync2(entryPath).isDirectory();
+    return statSync(entryPath).isDirectory();
   } catch {
     return false;
   }
@@ -3738,18 +4144,18 @@ function isTruthyEnv(value) {
 
 // src/optional-bench.ts
 import { existsSync as existsSync3 } from "fs";
-import path4 from "path";
+import path5 from "path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 var SPECIFIER2 = "@remnic/bench";
 var TSX_ESM_API_SPECIFIER = "tsx/esm/api";
 var cached2;
 var cachedFromLocalWorkspaceBenchSource = false;
 function resolveLocalWorkspaceBenchPaths() {
-  const currentDir = path4.dirname(fileURLToPath2(import.meta.url));
-  const benchPackageDir = path4.resolve(currentDir, "../../bench");
+  const currentDir = path5.dirname(fileURLToPath2(import.meta.url));
+  const benchPackageDir = path5.resolve(currentDir, "../../bench");
   return {
-    distEntry: path4.join(benchPackageDir, "dist", "index.js"),
-    sourceEntry: path4.join(benchPackageDir, "src", "index.ts")
+    distEntry: path5.join(benchPackageDir, "dist", "index.js"),
+    sourceEntry: path5.join(benchPackageDir, "src", "index.ts")
   };
 }
 async function tryImportLocalWorkspaceBenchSource(err) {
@@ -3836,9 +4242,9 @@ function assertBenchModuleFreshForDevelopment() {
 }
 
 // src/cmd-security.ts
-import fs20 from "fs";
+import fs21 from "fs";
 import {
-  Orchestrator as Orchestrator9,
+  Orchestrator as Orchestrator10,
   parseConfig as parseConfig16,
   initLogger as initLogger4,
   resolveRemnicConfigRecord as resolveRemnicConfigRecord15,
@@ -3856,9 +4262,9 @@ async function cmdSecurity(rest) {
   }
   initLogger4();
   const configPath = resolveConfigPath();
-  const raw = fs20.existsSync(configPath) ? JSON.parse(fs20.readFileSync(configPath, "utf8")) : {};
+  const raw = fs21.existsSync(configPath) ? JSON.parse(fs21.readFileSync(configPath, "utf8")) : {};
   const config = parseConfig16(resolveRemnicConfigRecord15(raw));
-  const orchestrator = new Orchestrator9(config);
+  const orchestrator = new Orchestrator10(config);
   await orchestrator.initialize();
   try {
     const sinceFlag = rest.indexOf("--since");
@@ -3881,8 +4287,8 @@ async function cmdSecurity(rest) {
 }
 
 // src/daemon-service-candidates.ts
-import fs21 from "fs";
-import path5 from "path";
+import fs22 from "fs";
+import path6 from "path";
 var LAUNCHD_LABEL = "ai.remnic.daemon";
 var LEGACY_REMNIC_SERVER_LAUNCHD_LABEL = "ai.remnic.server";
 var LEGACY_LAUNCHD_LABEL = "ai.engram.daemon";
@@ -3895,15 +4301,15 @@ var SYSTEMD_SERVICE = "remnic.service";
 var LEGACY_SYSTEMD_SERVICE = "engram.service";
 var SYSTEMD_SERVICE_CANDIDATES = [SYSTEMD_SERVICE, LEGACY_SYSTEMD_SERVICE];
 function launchdPlistPaths(homeDir) {
-  return LAUNCHD_LABEL_CANDIDATES.map((label) => path5.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));
+  return LAUNCHD_LABEL_CANDIDATES.map((label) => path6.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));
 }
 function systemdUnitPaths(homeDir) {
-  return SYSTEMD_SERVICE_CANDIDATES.map((service) => path5.join(homeDir, ".config", "systemd", "user", service));
+  return SYSTEMD_SERVICE_CANDIDATES.map((service) => path6.join(homeDir, ".config", "systemd", "user", service));
 }
 function anyFileExists(paths) {
   return paths.some((candidate) => {
     try {
-      return fs21.statSync(candidate).isFile();
+      return fs22.statSync(candidate).isFile();
     } catch {
       return false;
     }
@@ -3915,7 +4321,7 @@ function commandNames(command) {
 }
 function isRunnableNodeScript(filePath) {
   try {
-    const text = fs21.readFileSync(filePath, "utf8").slice(0, 4096);
+    const text = fs22.readFileSync(filePath, "utf8").slice(0, 4096);
     const firstLine = text.split(/\r?\n/, 1)[0] ?? "";
     if (/^#!.*\bnode\b/.test(firstLine)) return true;
     if (firstLine.startsWith("#!")) return false;
@@ -3928,20 +4334,20 @@ function isRunnableNodeScript(filePath) {
 function resolveShimNodeScript(filePath) {
   let text;
   try {
-    text = fs21.readFileSync(filePath, "utf8").slice(0, 16384);
+    text = fs22.readFileSync(filePath, "utf8").slice(0, 16384);
   } catch {
     return void 0;
   }
-  const basedir = path5.dirname(filePath);
+  const basedir = path6.dirname(filePath);
   const jsReferencePattern = /"([^"]+\.js)"|'([^']+\.js)'|([^\s"'`]+\.js)/g;
   for (const match of text.matchAll(jsReferencePattern)) {
     const raw = match[1] ?? match[2] ?? match[3];
     if (!raw) continue;
     const candidate = raw.replaceAll("${basedir}", basedir).replaceAll("$basedir", basedir).replaceAll("\\ ", " ");
-    const resolved = path5.isAbsolute(candidate) ? candidate : path5.resolve(basedir, candidate);
+    const resolved = path6.isAbsolute(candidate) ? candidate : path6.resolve(basedir, candidate);
     try {
-      if (fs21.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
-        return fs21.realpathSync(resolved);
+      if (fs22.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
+        return fs22.realpathSync(resolved);
       }
     } catch {
     }
@@ -3949,19 +4355,19 @@ function resolveShimNodeScript(filePath) {
   return void 0;
 }
 function resolveRunnableNodeScript(filePath) {
-  const realPath = fs21.realpathSync(filePath);
+  const realPath = fs22.realpathSync(filePath);
   if (isRunnableNodeScript(realPath)) return realPath;
   return resolveShimNodeScript(realPath);
 }
 function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
-  for (const dir of pathEnv.split(path5.delimiter)) {
+  for (const dir of pathEnv.split(path6.delimiter)) {
     if (!dir) continue;
     for (const name of commandNames(command)) {
-      const candidate = path5.join(dir, name);
+      const candidate = path6.join(dir, name);
       try {
-        const stat2 = fs21.statSync(candidate);
+        const stat2 = fs22.statSync(candidate);
         if (!stat2.isFile()) continue;
-        if (process.platform !== "win32") fs21.accessSync(candidate, fs21.constants.X_OK);
+        if (process.platform !== "win32") fs22.accessSync(candidate, fs22.constants.X_OK);
         const runnable = resolveRunnableNodeScript(candidate);
         if (runnable) return runnable;
       } catch {
@@ -3971,11 +4377,11 @@ function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
   return void 0;
 }
 function serverBinWrapperRequiredPath(candidate) {
-  const filename = path5.basename(candidate);
+  const filename = path6.basename(candidate);
   if (filename !== "remnic-server.js" && filename !== "engram-server.js") return void 0;
-  const binDir = path5.dirname(candidate);
-  if (path5.basename(binDir) !== "bin") return void 0;
-  return path5.join(path5.dirname(binDir), "dist", "index.js");
+  const binDir = path6.dirname(candidate);
+  if (path6.basename(binDir) !== "bin") return void 0;
+  return path6.join(path6.dirname(binDir), "dist", "index.js");
 }
 
 // src/service-candidates.ts
@@ -3997,7 +4403,7 @@ function firstSuccessfulCandidate(candidates, attempt) {
 }
 
 // src/bench-args.ts
-import path7 from "path";
+import path8 from "path";
 
 // src/bench-flags.ts
 function readBenchOptionValue(argv, flag) {
@@ -4362,7 +4768,7 @@ function collectBenchmarks(argv) {
 }
 
 // src/bench-args-research.ts
-import path6 from "path";
+import path7 from "path";
 function readPositiveInteger(args, flag) {
   const raw = readBenchOptionValue(args, flag);
   if (raw === void 0) return void 0;
@@ -4408,7 +4814,7 @@ function parseBenchResearchArgs(action, args) {
     }
     const outRaw = readBenchOptionValue(args, "--out");
     if (outRaw !== void 0) {
-      out = path6.resolve(expandTilde(outRaw));
+      out = path7.resolve(expandTilde(outRaw));
     }
   }
   const epochs = readPositiveInteger(args, "--epochs");
@@ -4422,8 +4828,8 @@ function parseBenchResearchArgs(action, args) {
   }
   return {
     runRef,
-    memoryDir: memoryDirRaw ? path6.resolve(expandTilde(memoryDirRaw)) : void 0,
-    qmdPath: qmdPathRaw ? path6.resolve(expandTilde(qmdPathRaw)) : void 0,
+    memoryDir: memoryDirRaw ? path7.resolve(expandTilde(memoryDirRaw)) : void 0,
+    qmdPath: qmdPathRaw ? path7.resolve(expandTilde(qmdPathRaw)) : void 0,
     collection,
     users: readPositiveInteger(args, "--users"),
     epochs,
@@ -4643,7 +5049,7 @@ function parseBenchArgs(argv) {
   }
   validateBenchFlags(action, args);
   const driftGenPositionals = action === "drift-gen" && driftGenAction === "validate" ? collectBenchmarks(args.slice(1)) : [];
-  const driftGenDir = driftGenPositionals[0] ? path7.resolve(expandTilde(driftGenPositionals[0])) : void 0;
+  const driftGenDir = driftGenPositionals[0] ? path8.resolve(expandTilde(driftGenPositionals[0])) : void 0;
   const benchmarkArgs = action === "baseline" || action === "datasets" || action === "providers" || action === "runs" || action === "drift-gen" && (args[0] === "validate" || args[0] === "generate") ? args.slice(1) : args;
   const benchmarks = collectBenchmarks(benchmarkArgs);
   const datasetDir = readBenchOptionValue(args, "--dataset-dir") ?? readBenchOptionValue(args, "--dataset");
@@ -5193,13 +5599,13 @@ function parseBenchArgs(argv) {
     mcpUrl,
     mcpToolMap,
     mcpDemo,
-    datasetDir: datasetDir ? path7.resolve(expandTilde(datasetDir)) : void 0,
-    resultsDir: resultsDir ? path7.resolve(expandTilde(resultsDir)) : void 0,
-    baselinesDir: baselinesDir ? path7.resolve(expandTilde(baselinesDir)) : void 0,
+    datasetDir: datasetDir ? path8.resolve(expandTilde(datasetDir)) : void 0,
+    resultsDir: resultsDir ? path8.resolve(expandTilde(resultsDir)) : void 0,
+    baselinesDir: baselinesDir ? path8.resolve(expandTilde(baselinesDir)) : void 0,
     runtimeProfile,
     matrixProfiles,
-    remnicConfigPath: remnicConfigRaw ? path7.resolve(expandTilde(remnicConfigRaw)) : void 0,
-    openclawConfigPath: openclawConfigRaw ? path7.resolve(expandTilde(openclawConfigRaw)) : void 0,
+    remnicConfigPath: remnicConfigRaw ? path8.resolve(expandTilde(remnicConfigRaw)) : void 0,
+    openclawConfigPath: openclawConfigRaw ? path8.resolve(expandTilde(openclawConfigRaw)) : void 0,
     modelSource,
     gatewayAgentId,
     fastGatewayAgentId,
@@ -5222,13 +5628,13 @@ function parseBenchArgs(argv) {
     internalDisableThinking: args.includes("--internal-disable-thinking"),
     internalCodexReasoningEffort,
     threshold,
-    custom: customRaw ? path7.resolve(expandTilde(customRaw)) : void 0,
+    custom: customRaw ? path8.resolve(expandTilde(customRaw)) : void 0,
     baselineAction,
     datasetAction,
     providerAction,
     runAction,
     format,
-    output: output ? path7.resolve(expandTilde(output)) : void 0,
+    output: output ? path8.resolve(expandTilde(output)) : void 0,
     target,
     publishedName,
     publishedSeed,
@@ -5238,24 +5644,24 @@ function parseBenchArgs(argv) {
     publishedIngestConcurrency,
     publishedTaskFilter,
     memcorrectAdapter,
-    publishedOut: publishedOutRaw ? path7.resolve(expandTilde(publishedOutRaw)) : void 0,
+    publishedOut: publishedOutRaw ? path8.resolve(expandTilde(publishedOutRaw)) : void 0,
     publishedDryRun: args.includes("--dry-run"),
     requestTimeout,
     localJudgeRequestTimeout,
     frontierJudgeRequestTimeout,
-    calibrationDir: calibrationDirRaw ? path7.resolve(expandTilde(calibrationDirRaw)) : void 0,
+    calibrationDir: calibrationDirRaw ? path8.resolve(expandTilde(calibrationDirRaw)) : void 0,
     calibrationLocalConfigSha256,
     calibrationFrontierConfigSha256,
     sourceResultId,
     expectedAnswerSetSha256,
     expectedQuestionIdListSha256,
-    taskIdsFile: taskIdsFileRaw ? path7.resolve(expandTilde(taskIdsFileRaw)) : void 0,
+    taskIdsFile: taskIdsFileRaw ? path8.resolve(expandTilde(taskIdsFileRaw)) : void 0,
     expectedTaskIdListSha256,
     drainTimeout,
     // Issue #1573 PR1: surface judge-cache flags into the runner options.
     noJudgeCache: args.includes("--no-judge-cache"),
-    judgeCacheDir: judgeCacheDirRaw ? path7.resolve(expandTilde(judgeCacheDirRaw)) : void 0,
-    localLabManifestPath: localLabManifestRaw ? path7.resolve(expandTilde(localLabManifestRaw)) : void 0,
+    judgeCacheDir: judgeCacheDirRaw ? path8.resolve(expandTilde(judgeCacheDirRaw)) : void 0,
+    localLabManifestPath: localLabManifestRaw ? path8.resolve(expandTilde(localLabManifestRaw)) : void 0,
     max429WaitMs,
     disableThinking: args.includes("--disable-thinking"),
     amaBenchJudgeProtocol,
@@ -5293,9 +5699,9 @@ function assertCalibrationProvenanceMatches(binding, state, benchmarkId) {
 
 // src/bench-status.ts
 import { mkdir, readFile, readdir as readdir2, rename, writeFile } from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 function createBenchStatusPath(resultsDir, pid, startedAtMs = Date.now()) {
-  return path8.join(resultsDir, `bench-status-${startedAtMs}-${pid}.json`);
+  return path9.join(resultsDir, `bench-status-${startedAtMs}-${pid}.json`);
 }
 var BENCH_STATUS_FILENAME = /^bench-status-\d+-\d+\.json$/;
 var VALID_BENCH_ENTRY_STATUSES = /* @__PURE__ */ new Set(["pending", "running", "complete", "failed"]);
@@ -5308,7 +5714,7 @@ async function findLatestBenchStatusFile(resultsDir) {
   }
   const candidates = entries.filter((name) => BENCH_STATUS_FILENAME.test(name)).sort().reverse();
   for (const name of candidates) {
-    const filePath = path8.join(resultsDir, name);
+    const filePath = path9.join(resultsDir, name);
     const status = await readBenchStatus(filePath);
     if (status) {
       return filePath;
@@ -5317,7 +5723,7 @@ async function findLatestBenchStatusFile(resultsDir) {
   return null;
 }
 async function atomicWriteJSON(filePath, data) {
-  await mkdir(path8.dirname(filePath), { recursive: true });
+  await mkdir(path9.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`;
   await writeFile(tmp, JSON.stringify(data, null, 2) + "\n");
   await rename(tmp, filePath);
@@ -5433,86 +5839,6 @@ function finalizeBenchStatus(filePath) {
   });
 }
 
-// src/bench-fallback.ts
-import fs22 from "fs";
-import path9 from "path";
-var FALLBACK_RESULTS_DIRNAME = "fallback-runs";
-function buildBenchRunnerArgs(parsed, benchmarkId, outputDir) {
-  const args = ["--benchmark", benchmarkId];
-  if (parsed.quick) {
-    args.push("--lightweight");
-  }
-  if (parsed.publishedLimit !== void 0) {
-    args.push("--limit", String(parsed.publishedLimit));
-  } else if (parsed.quick) {
-    args.push("--limit", "1");
-  }
-  if (parsed.datasetDir) {
-    args.push("--dataset-dir", parsed.datasetDir);
-  }
-  if (outputDir) {
-    args.push("--output-dir", outputDir);
-  }
-  return args;
-}
-function findUnsupportedFallbackBenchOptions(parsed) {
-  const unsupported = [];
-  const add = (condition, flag) => {
-    if (condition) unsupported.push(flag);
-  };
-  add(parsed.modelSource !== void 0, "--model-source");
-  add(parsed.gatewayAgentId !== void 0, "--gateway-agent-id");
-  add(parsed.fastGatewayAgentId !== void 0, "--fast-gateway-agent-id");
-  add(parsed.systemProvider !== void 0, "--system-provider/--provider");
-  add(parsed.systemModel !== void 0, "--system-model/--model");
-  add(parsed.systemBaseUrl !== void 0, "--system-base-url/--base-url");
-  add(parsed.systemApiKey !== void 0, "--system-api-key");
-  add(parsed.systemCodexReasoningEffort !== void 0, "--system-codex-reasoning-effort");
-  add(parsed.systemResponderContextBudgetChars !== void 0, "--system-responder-context-budget-chars");
-  add(parsed.systemResponderPromptBudgetChars !== void 0, "--system-responder-prompt-budget-chars");
-  add(parsed.judgeProvider !== void 0, "--judge-provider");
-  add(parsed.judgeModel !== void 0, "--judge-model");
-  add(parsed.judgeBaseUrl !== void 0, "--judge-base-url");
-  add(parsed.judgeApiKey !== void 0, "--judge-api-key");
-  add(parsed.judgeCodexReasoningEffort !== void 0, "--judge-codex-reasoning-effort");
-  add(parsed.internalProvider !== void 0, "--internal-provider");
-  add(parsed.internalModel !== void 0, "--internal-model");
-  add(parsed.internalBaseUrl !== void 0, "--internal-base-url");
-  add(parsed.internalApiKey !== void 0, "--internal-api-key");
-  add(parsed.internalDisableThinking === true, "--internal-disable-thinking");
-  add(parsed.internalCodexReasoningEffort !== void 0, "--internal-codex-reasoning-effort");
-  add(parsed.amaBenchJudgeProtocol !== void 0, "--ama-bench-judge-protocol");
-  add(parsed.amaBenchCrossJudgeProvider !== void 0, "--ama-bench-cross-judge-provider");
-  add(parsed.amaBenchCrossJudgeModel !== void 0, "--ama-bench-cross-judge-model");
-  add(parsed.amaBenchCrossJudgeBaseUrl !== void 0, "--ama-bench-cross-judge-base-url");
-  add(parsed.amaBenchCrossJudgeApiKey !== void 0, "--ama-bench-cross-judge-api-key");
-  add(parsed.amaBenchCrossJudgeCodexReasoningEffort !== void 0, "--ama-bench-cross-judge-codex-reasoning-effort");
-  add(parsed.disableThinking === true, "--disable-thinking");
-  add(parsed.requestTimeout !== void 0, "--request-timeout");
-  add(parsed.drainTimeout !== void 0, "--drain-timeout");
-  add(parsed.max429WaitMs !== void 0, "--max-429-wait");
-  add(parsed.publishedTrialLimit !== void 0, "--trial-limit");
-  add(parsed.publishedTrialConcurrency !== void 0, "--trial-concurrency");
-  add(parsed.publishedIngestConcurrency !== void 0, "--ingest-concurrency");
-  add(parsed.publishedTaskFilter !== void 0, "--task-filter");
-  add(parsed.publishedSeed !== void 0, "--seed");
-  return unsupported;
-}
-function createFallbackBenchOutputDir(resultsDir, benchmarkId, pid, startedAtMs = Date.now()) {
-  return path9.join(
-    resultsDir,
-    FALLBACK_RESULTS_DIRNAME,
-    `${benchmarkId}-${startedAtMs}-${pid}`
-  );
-}
-function resolveFallbackBenchResultPath(outputDir) {
-  const entries = fs22.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
-  if (entries.length === 0) {
-    throw new Error(`Fallback benchmark runner did not write a JSON result artifact in ${outputDir}`);
-  }
-  return path9.join(outputDir, entries[0]);
-}
-
 // src/openclaw-upgrade-swap.ts
 import fs23 from "fs";
 import path10 from "path";
@@ -6254,7 +6580,7 @@ function resolveServerBin(options = {}) {
   return resolveServerBinDetails(options).path;
 }
 function readVerifiedDaemonPid(options) {
-  const readFileSync5 = options.readFileSync ?? fs26.readFileSync;
+  const readFileSync4 = options.readFileSync ?? fs26.readFileSync;
   const unlinkSync = options.unlinkSync ?? fs26.unlinkSync;
   const processKill = options.processKill ?? process.kill;
   const platform = options.platform ?? process.platform;
@@ -6262,7 +6588,7 @@ function readVerifiedDaemonPid(options) {
   for (const file of options.pidFiles) {
     let pid;
     try {
-      pid = parseDaemonPid(readFileSync5(file, "utf8"));
+      pid = parseDaemonPid(readFileSync4(file, "utf8"));
     } catch {
       continue;
     }
@@ -6356,7 +6682,7 @@ function removePidFileBestEffort(file, unlinkSync) {
 }
 function inspectLaunchdPlist(plistPath, options = {}) {
   const existsSync4 = options.existsSync ?? fs26.existsSync;
-  const readFileSync5 = options.readFileSync ?? fs26.readFileSync;
+  const readFileSync4 = options.readFileSync ?? fs26.readFileSync;
   if (!existsSync4(plistPath)) {
     return {
       installed: false,
@@ -6367,7 +6693,7 @@ function inspectLaunchdPlist(plistPath, options = {}) {
   }
   let content;
   try {
-    content = readFileSync5(plistPath, "utf8");
+    content = readFileSync4(plistPath, "utf8");
   } catch {
     return {
       installed: true,
@@ -6542,7 +6868,7 @@ import {
 } from "@remnic/core";
 
 // src/import-bundle-detect.ts
-import { lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { lstatSync as lstatSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
 import path13 from "path";
 function detectBundleEntries(bundleDir, options = {}) {
   const readdir3 = options.readdirImpl ?? defaultReaddir;
@@ -6551,7 +6877,7 @@ function detectBundleEntries(bundleDir, options = {}) {
   const isRegularFile = options.isRegularFileImpl ?? (options.readdirImpl !== void 0 || options.isDirectoryImpl !== void 0 ? (p) => !isDirectory2(p) : defaultIsRegularFile);
   if (options.readdirImpl === void 0 && options.isDirectoryImpl === void 0) {
     try {
-      const rootStat = lstatSync2(bundleDir);
+      const rootStat = lstatSync3(bundleDir);
       if (rootStat.isSymbolicLink()) {
         throw new Error(
           `Bundle directory '${bundleDir}' is a symbolic link. Pass the resolved directory path instead.`
@@ -6664,11 +6990,11 @@ function defaultReaddir(dir) {
   return readdirSync2(dir);
 }
 function defaultReadFile(p) {
-  return readFileSync4(p, "utf-8");
+  return readFileSync3(p, "utf-8");
 }
 function defaultIsDirectory(p) {
   try {
-    const s = lstatSync2(p);
+    const s = lstatSync3(p);
     if (s.isSymbolicLink()) return false;
     return s.isDirectory();
   } catch {
@@ -6677,7 +7003,7 @@ function defaultIsDirectory(p) {
 }
 function defaultIsRegularFile(p) {
   try {
-    const s = lstatSync2(p);
+    const s = lstatSync3(p);
     if (s.isSymbolicLink()) return false;
     return s.isFile();
   } catch {
@@ -8506,7 +8832,6 @@ var LOG_FILE = path18.join(PID_DIR, "server.log");
 var LEGACY_LOG_FILE = path18.join(LEGACY_PID_DIR, "server.log");
 var CLI_MODULE_DIR = path18.dirname(fileURLToPath5(import.meta.url));
 var CLI_REPO_ROOT = path18.resolve(CLI_MODULE_DIR, "../../..");
-var EVAL_RUNNER_PATH = path18.join(CLI_REPO_ROOT, "evals", "run.ts");
 var OPENCLAW_GATEWAY_LABEL = "ai.openclaw.gateway";
 var CLI_SUCCESS_EXIT_GRACE_MS = 5e3;
 var CLI_OUTPUT_FLUSH_GRACE_MS = 250;
@@ -8666,15 +8991,13 @@ async function loadBenchDefinitionsFromPackage() {
   const result = benchModule.listBenchmarks();
   return Array.isArray(result) ? result : void 0;
 }
+var MISSING_BENCH_RUNTIME_HINT = "@remnic/bench. Build the workspace packages (or install @remnic/bench) and retry.";
 async function resolveAllBenchmarks() {
   const packageBenchmarks = await loadBenchDefinitionsFromPackage();
   if (packageBenchmarks) {
     return packageBenchmarks.filter((entry) => entry.runnerAvailable).map((entry) => entry.id);
   }
-  if (!fs29.existsSync(EVAL_RUNNER_PATH)) {
-    return [];
-  }
-  return BENCHMARK_CATALOG.filter((entry) => entry.category !== "ingestion").map((entry) => entry.id);
+  return [];
 }
 async function resolveKnownBenchmarkIds() {
   const knownIds = new Set(BENCHMARK_IDS);
@@ -8686,65 +9009,6 @@ async function resolveKnownBenchmarkIds() {
   }
   return knownIds;
 }
-async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
-  if (parsed.taskIdsFile) {
-    throw new Error(
-      "Fallback benchmark runner does not support hash-pinned LoCoMo task selection. Build/install @remnic/bench to use --task-ids-file."
-    );
-  }
-  if (runtimeProfile === "real" && parsed.remnicConfigPath) {
-    resolveExistingBenchRemnicConfigPath(parsed.remnicConfigPath);
-  }
-  if (runtimeProfile === "openclaw-chain" && parsed.openclawConfigPath) {
-    resolveExistingBenchOpenclawConfigPath(parsed.openclawConfigPath);
-  }
-  if (runtimeProfile === "real") {
-    throw new Error(
-      'Fallback benchmark runner does not support --runtime-profile "real". Build/install @remnic/bench to use package-backed runtime profiles.'
-    );
-  }
-  if (runtimeProfile === "openclaw-chain") {
-    throw new Error(
-      'Fallback benchmark runner does not support --runtime-profile "openclaw-chain". Build/install @remnic/bench to use package-backed runtime profiles.'
-    );
-  }
-  if (runtimeProfile === "local-lab") {
-    throw new Error(
-      'Fallback benchmark runner does not support --runtime-profile "local-lab". Build/install @remnic/bench to use package-backed runtime profiles with local-lab manifests.'
-    );
-  }
-  const unsupportedOptions = findUnsupportedFallbackBenchOptions(parsed);
-  if (unsupportedOptions.length > 0) {
-    throw new Error(
-      `Fallback benchmark runner does not support provider-backed, gateway, or thinking/timeout flags (${unsupportedOptions.join(", ")}). Build/install @remnic/bench to use those options.`
-    );
-  }
-  if (!fs29.existsSync(EVAL_RUNNER_PATH)) {
-    console.error(
-      "Benchmark runner not found. Expected eval runner at evals/run.ts or a phase-1 @remnic/bench runtime export."
-    );
-    process.exit(1);
-  }
-  const tsxCandidates = [
-    path18.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
-    path18.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
-  ];
-  const tsxCmd = tsxCandidates.find((candidate) => fs29.existsSync(candidate)) ?? "tsx";
-  const fallbackOutputDir = createFallbackBenchOutputDir(
-    parsed.resultsDir ?? resolveBenchOutputDir(),
-    benchmarkId,
-    process.pid
-  );
-  const fallbackArgs = [
-    EVAL_RUNNER_PATH,
-    ...buildBenchRunnerArgs(parsed, benchmarkId, fallbackOutputDir)
-  ];
-  childProcess2.execFileSync(tsxCmd, fallbackArgs, {
-    stdio: "inherit",
-    env: process.env
-  });
-  return resolveFallbackBenchResultPath(fallbackOutputDir);
-}
 function resolveBenchOutputDir() {
   return path18.join(resolveHomeDir(), ".remnic", "bench", "results");
 }
@@ -9099,13 +9363,7 @@ async function launchBenchUi(resultsDir) {
     });
   });
 }
-function resolveRepoDatasetRoot() {
-  const repoCandidate = path18.join(CLI_REPO_ROOT, "evals", "datasets");
-  if (isRepoCheckout()) {
-    return repoCandidate;
-  }
-  return path18.join(resolveHomeDir(), ".remnic", "bench", "datasets");
-}
+var BENCH_DATASET_ROOT = path18.join(resolveHomeDir(), ".remnic", "bench", "datasets");
 function listDownloadableBenchmarks() {
   return [...DOWNLOADABLE_BENCHMARK_DATASETS];
 }
@@ -9114,10 +9372,7 @@ function resolveDatasetDownloadScriptPath() {
   if (fs29.existsSync(bundled)) {
     return bundled;
   }
-  return path18.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
-}
-function isRepoCheckout() {
-  return fs29.existsSync(path18.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs29.existsSync(path18.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
+  return path18.join(CLI_REPO_ROOT, "packages", "remnic-cli", "assets", "download-datasets.sh");
 }
 function runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, jsonMode) {
   const stdio = jsonMode ? ["inherit", process.stderr, "inherit"] : "inherit";
@@ -9168,7 +9423,7 @@ function resolveBenchDatasetDir(benchmarkId, quick, datasetDirOverride) {
   if (quick) {
     return void 0;
   }
-  const datasetDir = path18.join(resolveRepoDatasetRoot(), benchmarkId);
+  const datasetDir = path18.join(BENCH_DATASET_ROOT, benchmarkId);
   if (isDatasetDownloaded(datasetDir, benchmarkId)) {
     return datasetDir;
   }
@@ -9438,7 +9693,7 @@ async function exportBenchPackageResult(parsed) {
   process.stdout.write(rendered);
 }
 async function manageBenchDatasets(parsed) {
-  const datasetRoot = resolveRepoDatasetRoot();
+  const datasetRoot = BENCH_DATASET_ROOT;
   const supported = listDownloadableBenchmarks();
   if (parsed.datasetAction === "status") {
     if (parsed.benchmarks.length > 0 || parsed.all) {
@@ -10187,7 +10442,7 @@ async function loadPublishedPromotionHelpers() {
   const benchModule = await loadBenchModule();
   return {
     async promoteArtifactsToPublished(args) {
-      const { mkdirSync, readFileSync: readFileSync5, writeFileSync } = await import("fs");
+      const { mkdirSync, readFileSync: readFileSync4, writeFileSync } = await import("fs");
       const path19 = await import("path");
       mkdirSync(args.publishedOutDir, { recursive: true });
       if (args.artifactPaths.length === 0) {
@@ -10197,7 +10452,7 @@ async function loadPublishedPromotionHelpers() {
         return;
       }
       for (const artifactPath of args.artifactPaths) {
-        const raw = readFileSync5(artifactPath, "utf8");
+        const raw = readFileSync4(artifactPath, "utf8");
         const parsedUnknown = JSON.parse(raw);
         const parsedObj = parsedUnknown !== null && typeof parsedUnknown === "object" && !Array.isArray(parsedUnknown) ? parsedUnknown : {};
         const gitShaShort = (parsedObj.meta?.gitSha ?? "unknown").slice(0, 7);
@@ -11596,7 +11851,7 @@ async function cmdQuery(queryText, json, explain) {
   const raw = fs29.existsSync(configPath) ? JSON.parse(fs29.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord16(raw);
   const config = parseConfig17(remnicCfg);
-  const orchestrator = new Orchestrator10(config);
+  const orchestrator = new Orchestrator11(config);
   await orchestrator.initialize();
   const service = new EngramAccessService2(orchestrator);
   const recallRequest = buildQueryRecallRequest(queryText);
@@ -11776,7 +12031,7 @@ async function cmdXray(rest) {
   const raw = fs29.existsSync(configPath) ? JSON.parse(fs29.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord16(raw);
   const config = parseConfig17(remnicCfg);
-  const orchestrator = new Orchestrator10(config);
+  const orchestrator = new Orchestrator11(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const service = new EngramAccessService2(orchestrator);
@@ -11807,7 +12062,7 @@ async function withLocalService(fn) {
   initLogger5();
   const configPath = resolveConfigPath();
   const raw = fs29.existsSync(configPath) ? JSON.parse(fs29.readFileSync(configPath, "utf8")) : {};
-  const orchestrator = new Orchestrator10(parseConfig17(resolveRemnicConfigRecord16(raw)));
+  const orchestrator = new Orchestrator11(parseConfig17(resolveRemnicConfigRecord16(raw)));
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const service = new EngramAccessService2(orchestrator);
@@ -11985,7 +12240,7 @@ async function cmdEnrich(rest) {
     pipelineConfig2.providers = [
       { id: "web-search", enabled: true, costTier: "cheap" }
     ];
-    const orchestrator2 = new Orchestrator10(config);
+    const orchestrator2 = new Orchestrator11(config);
     await orchestrator2.initialize();
     await orchestrator2.deferredReady;
     const searchBackend2 = orchestrator2.qmd;
@@ -12021,7 +12276,7 @@ Registered providers:`);
     console.error("Usage: remnic enrich <entity-name> | --all | --dry-run | audit | providers");
     process.exit(1);
   }
-  const orchestrator = new Orchestrator10(config);
+  const orchestrator = new Orchestrator11(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const storage = await orchestrator.getStorage(config.defaultNamespace);
@@ -12298,7 +12553,7 @@ async function cmdBriefing(rest) {
     process.exit(1);
   }
   const format = effectiveFormatFlag === "json" ? "json" : effectiveFormatFlag === "markdown" ? "markdown" : config.briefing.defaultFormat;
-  const orchestrator = new Orchestrator10(config);
+  const orchestrator = new Orchestrator11(config);
   await orchestrator.initialize();
   const storage = await orchestrator.getStorage(config.defaultNamespace);
   const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
@@ -12751,7 +13006,7 @@ async function cmdReview(action, rest) {
       console.error("Usage: remnic review <approve|dismiss|flag> <id>");
       process.exit(1);
     }
-    const storage = new StorageManager3(memoryDir);
+    const storage = new StorageManager4(memoryDir);
     const configPath = resolveConfigPath();
     let tombstonesConfig = null;
     try {
@@ -12877,14 +13132,25 @@ function resolveOfflineRemoteUrl(args) {
   }
   return parsed;
 }
+var OFFLINE_TOKEN_ENV_NAMES = ["REMNIC_OFFLINE_TOKEN", "REMNIC_AUTH_TOKEN", "ENGRAM_AUTH_TOKEN"];
 function resolveOfflineToken(args) {
-  const token = resolveRequiredValueFlag(args, "--token") ?? process.env.REMNIC_OFFLINE_TOKEN ?? process.env.REMNIC_AUTH_TOKEN ?? process.env.ENGRAM_AUTH_TOKEN;
-  if (!token || token.trim().length === 0) {
-    throw new Error(
-      "offline mode requires --token <token>, REMNIC_OFFLINE_TOKEN, or REMNIC_AUTH_TOKEN"
+  const channel = resolveCredentialChannel(
+    {
+      argvToken: resolveRequiredValueFlag(args, "--token"),
+      tokenFile: resolveRequiredValueFlag(args, "--token-file"),
+      envNames: OFFLINE_TOKEN_ENV_NAMES
+    },
+    process.env
+  );
+  if (!channel.ok) {
+    throw new Error(`offline: ${channel.error}`);
+  }
+  if (channel.tokenFromArgv) {
+    process.stderr.write(
+      "offline: note: --token is argv-visible; prefer --token-file or REMNIC_OFFLINE_TOKEN\n"
     );
   }
-  return token.trim();
+  return channel.token?.trim();
 }
 function offlineEndpoint(remoteUrl, pathname, params = {}) {
   const url = new URL(remoteUrl);
@@ -14600,7 +14866,9 @@ async function cmdOffline(action, rest, json) {
 
 Options:
   --remote-url <url>       Remote Remnic server URL, e.g. http://home:4242 (--remote alias accepted)
-  --token <token>          Bearer token for the remote server
+  --token <token>          Bearer token for the remote server (argv-visible;
+                           prefer --token-file or the env fallbacks)
+  --token-file <path>      Read the bearer token from a 0600 regular file
   --namespace <name>       Namespace to sync
   --memory-dir <dir>       Local memory dir (defaults to resolved memoryDir)
   --state <path>           Override offline sync state file
@@ -14612,7 +14880,9 @@ Options:
   --json                   JSON output
 
 Environment fallbacks:
-  REMNIC_OFFLINE_REMOTE_URL, REMNIC_OFFLINE_TOKEN, REMNIC_AUTH_TOKEN`);
+  REMNIC_OFFLINE_REMOTE_URL, REMNIC_OFFLINE_TOKEN, REMNIC_AUTH_TOKEN,
+  ENGRAM_AUTH_TOKEN (legacy). Token precedence: --token > --token-file >
+  REMNIC_OFFLINE_TOKEN > REMNIC_AUTH_TOKEN > ENGRAM_AUTH_TOKEN.`);
     return;
   }
   const memoryDir = path18.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
@@ -14634,7 +14904,8 @@ Environment fallbacks:
   const impressionRotation = resolveOfflineImpressionRotation(configPath);
   const needsRemote = action === "prepare" || action === "sync" || action === "watch";
   const remoteUrl = needsRemote ? resolveOfflineRemoteUrl(rest) : resolveOptionalOfflineRemoteUrl(rest);
-  const token = needsRemote ? resolveOfflineToken(rest) : void 0;
+  const knownAction = needsRemote || action === "status";
+  const token = knownAction ? resolveOfflineToken(rest) : void 0;
   const statePath = statePathExplicit ? path18.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
   if (action === "prepare") {
     if (!remoteUrl || !token || !statePath) throw new Error("offline prepare requires remote URL and token");
@@ -15206,7 +15477,7 @@ async function cmdConnectors(action, rest, json) {
     const raw = fs29.existsSync(configPath) ? JSON.parse(fs29.readFileSync(configPath, "utf8")) : {};
     const remnicCfg = resolveRemnicConfigRecord16(raw);
     const config = parseConfig17(remnicCfg);
-    const orchestrator = new Orchestrator10(config);
+    const orchestrator = new Orchestrator11(config);
     try {
       await orchestrator.initialize();
       await orchestrator.deferredReady;
@@ -15562,7 +15833,7 @@ async function cmdLegacyBenchmark(action, rest, json) {
   const raw = fs29.existsSync(configPath) ? JSON.parse(fs29.readFileSync(configPath, "utf8")) : {};
   const remnicCfg = resolveRemnicConfigRecord16(raw);
   const config = parseConfig17(remnicCfg);
-  const orchestrator = new Orchestrator10(config);
+  const orchestrator = new Orchestrator11(config);
   const service = new EngramAccessService2(orchestrator);
   const { runBenchSuite, loadBaseline, checkRegression } = await loadBenchModule();
   const benchConfig = {
@@ -15729,6 +16000,10 @@ async function cmdBench(rest) {
     }
     return;
   }
+  if (parsed.all && !await tryLoadBenchModule()) {
+    console.error(`ERROR: bench run --all requires ${MISSING_BENCH_RUNTIME_HINT}`);
+    process.exit(1);
+  }
   let selectedBenchmarks = parsed.all ? await resolveAllBenchmarks() : parsed.benchmarks;
   if (selectedBenchmarks.length === 0) {
     console.error(
@@ -15839,12 +16114,9 @@ async function cmdBench(rest) {
           } catch {
           }
         } else {
-          const fallbackResultPath = await runBenchViaFallback(parsed, benchmarkId, runtimeProfile);
-          writtenPaths.push(fallbackResultPath);
-          try {
-            await updateBenchmarkCompleted(benchStatusPath, statusId, fallbackResultPath);
-          } catch {
-          }
+          throw new Error(
+            `Benchmark "${benchmarkId}" requires ${MISSING_BENCH_RUNTIME_HINT}`
+          );
         }
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -17783,7 +18055,7 @@ Other:
           const raw = fs29.existsSync(configPath) ? JSON.parse(fs29.readFileSync(configPath, "utf8")) : {};
           const remnicCfg = resolveRemnicConfigRecord16(raw);
           const config = parseConfig17(remnicCfg);
-          orchestratorSingleton = new Orchestrator10(config);
+          orchestratorSingleton = new Orchestrator11(config);
           await orchestratorSingleton.initialize();
           await orchestratorSingleton.deferredReady;
         }