@remnic/cli 9.7.15 → 9.9.0

package/dist/index.js

@@ -1,19 +1,38 @@
+// src/enrichment-persist.ts
+import { composeSalvagedEnvelope } from "@remnic/core/salvage-envelope";
+async function persistEnrichmentCandidate(storage, entityName, candidate) {
+  await storage.writeSealedMemory(
+    composeSalvagedEnvelope(
+      "enrichment",
+      {
+        content: candidate.text,
+        category: candidate.category,
+        confidence: candidate.confidence,
+        tags: [...candidate.tags ?? [], "enrichment", candidate.source],
+        entityRef: entityName
+      },
+      { source: `enrichment:${candidate.source}` }
+    ),
+    {}
+  );
+}
+
 // src/index.ts
-import fs7 from "fs";
+import fs10 from "fs";
 import os from "os";
-import path11 from "path";
-import { createDecipheriv, createHash } from "crypto";
+import path12 from "path";
+import { createHash as createHash2 } from "crypto";
 import * as childProcess2 from "child_process";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { gzipSync } from "zlib";
 import {
-  parseConfig,
+  parseConfig as parseConfig3,
   isOpenaiApiKeyDisabled,
   resolveEnvVars,
-  resolveRemnicConfigRecord,
-  Orchestrator,
-  EngramAccessService,
-  initLogger,
+  resolveRemnicConfigRecord as resolveRemnicConfigRecord3,
+  Orchestrator as Orchestrator2,
+  EngramAccessService as EngramAccessService2,
+  initLogger as initLogger2,
   onboard,
   curate,
   listReviewItems,
@@ -85,18 +104,19 @@ import {
   discoverMemoryExtensions,
   resolveExtensionsRoot,
   coerceInstallExtension,
-  StorageManager,
+  StorageManager as StorageManager2,
   computeProcedureStats,
   formatProcedureStatsText,
   parseXrayCliOptions,
   renderXray,
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
-  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES,
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES as OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2,
   OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES,
   applyOfflineSyncFileContentChunk,
   applyOfflineSyncSnapshot,
   buildOfflineSyncChangesetFromSnapshot,
+  drainPendingLifecycleForOfflineSync,
   compileOfflineSyncExcludeGlobs,
   buildOfflineSyncSnapshotFromBase,
   defaultOfflineSyncStatePath,
@@ -118,24 +138,6 @@ import {
   OPERATION_NAMES,
   validateCapabilitiesForMint
 } from "@remnic/core";
-import {
-  AUTH_TAG_LENGTH,
-  ENVELOPE_HEADER_SIZE,
-  ENVELOPE_LAYOUT,
-  ENVELOPE_SALT_LENGTH,
-  ENVELOPE_VERSION,
-  FILE_FORMAT_FLAGS,
-  FILE_FORMAT_VERSION,
-  IV_LENGTH,
-  MAGIC_BYTES,
-  MAGIC_HEADER_SIZE,
-  SecureStoreLockedError,
-  filePathAad,
-  isEncryptedFile,
-  keyring,
-  readHeader,
-  secureStoreDir
-} from "@remnic/core/secure-store";
 
 // src/optional-module-loader.ts
 function isSpecifierNotFoundError(err, specifier) {
@@ -171,38 +173,574 @@ async function tryImportWecloneExport() {
     if (isSpecifierNotFoundError(err, SPECIFIER)) {
       return null;
     }
-    throw err;
+    throw err;
+  }
+}
+async function loadWecloneExportModule() {
+  if (cached === void 0) {
+    cached = await tryImportWecloneExport();
+  }
+  if (!cached) {
+    throw new Error(
+      "The weclone training-export adapter requires the optional @remnic/export-weclone package.\n\nInstall it alongside the CLI:\n  npm install -g @remnic/export-weclone\n\nOr add it to a project:\n  pnpm add @remnic/export-weclone\n"
+    );
+  }
+  return cached;
+}
+
+// src/doctor-namespace-lint.ts
+import { isNamespacePolicyCovered } from "@remnic/core";
+function readConfiguredNamespace(remnicCfg) {
+  if (!("namespace" in remnicCfg)) return { invalid: false };
+  const value = remnicCfg.namespace;
+  if (typeof value === "string" && value.trim().length > 0) {
+    return { configuredNamespace: value.trim(), invalid: false };
+  }
+  return { invalid: true };
+}
+function buildNamespacePolicyCheck(args) {
+  if (args.invalid) {
+    return {
+      name: "Namespace policy",
+      ok: false,
+      detail: "config `namespace` is set but is not a non-empty string",
+      remediation: "Set `namespace` to a non-empty string (a namespacePolicies name or the default namespace), or remove it."
+    };
+  }
+  if (!args.config || !args.configuredNamespace) return void 0;
+  const covered = isNamespacePolicyCovered(args.configuredNamespace, args.config);
+  return {
+    name: "Namespace policy",
+    ok: covered,
+    warn: !covered,
+    detail: covered ? `configured namespace "${args.configuredNamespace}" is writable` : `configured namespace "${args.configuredNamespace}" is writable by no one \u2014 its namespacePolicies entry grants no writer, or it has no entry and is not the default namespace`,
+    remediation: covered ? void 0 : `Give "${args.configuredNamespace}" a namespacePolicies entry with a non-blank writePrincipals value, or set namespace to a writable one \u2014 otherwise every write is rejected and dead-lettered.`
+  };
+}
+
+// src/index.ts
+import { WriteQuarantineStore as WriteQuarantineStore2 } from "@remnic/core/write-quarantine.js";
+
+// src/quarantine-cli.ts
+import { basename } from "path";
+function renderQuarantineList(records, format) {
+  if (format === "json") {
+    const summary = records.map((record) => ({
+      timestamp: record.timestamp,
+      operation: record.operation,
+      principal: record.principal,
+      attemptedNamespace: record.attemptedNamespace
+    }));
+    return JSON.stringify(summary, null, 2);
+  }
+  if (format !== "text") {
+    throw new Error(`Unsupported quarantine format: ${String(format)}`);
+  }
+  if (records.length === 0) return "No quarantined writes.";
+  const lines = [`Quarantined writes (${records.length}):`, ""];
+  for (const record of records) {
+    lines.push(
+      `  ${record.timestamp}  ${record.operation}  principal=${record.principal ?? "-"}  attemptedNamespace=${record.attemptedNamespace}`
+    );
+  }
+  return lines.join("\n");
+}
+async function replayQuarantine(opts) {
+  const result = { replayed: 0, failures: [], deleteFailures: [] };
+  for (const entry of await opts.store.entries()) {
+    const { record } = entry;
+    const basePayload = record.payload;
+    const principal = opts.principal ?? record.principal ?? void 0;
+    const idempotencyKey = typeof basePayload.idempotencyKey === "string" && basePayload.idempotencyKey.length > 0 ? basePayload.idempotencyKey : `quarantine-replay:${basename(entry.path)}`;
+    const request = {
+      ...basePayload,
+      namespace: opts.targetNamespace,
+      suppressQuarantine: true,
+      idempotencyKey,
+      ...principal ? { authenticatedPrincipal: principal } : {}
+    };
+    try {
+      await opts.submit(record.operation, request);
+    } catch (err) {
+      result.failures.push({
+        operation: record.operation,
+        attemptedNamespace: opts.targetNamespace,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      continue;
+    }
+    try {
+      const removed = await opts.store.removeEntry(entry.path);
+      if (removed) {
+        result.replayed += 1;
+      } else {
+        result.deleteFailures.push({
+          path: entry.path,
+          error: "entry not removed (outside quarantine root or already absent)"
+        });
+      }
+    } catch (err) {
+      result.deleteFailures.push({
+        path: entry.path,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return result;
+}
+function renderReplayResult(result, targetNamespace, format) {
+  if (format === "json") {
+    return JSON.stringify(
+      {
+        targetNamespace,
+        replayed: result.replayed,
+        failures: result.failures,
+        deleteFailures: result.deleteFailures
+      },
+      null,
+      2
+    );
+  }
+  if (format !== "text") {
+    throw new Error(`Unsupported quarantine format: ${String(format)}`);
+  }
+  const lines = [`Replayed ${result.replayed} quarantined write(s) into namespace ${targetNamespace}.`];
+  if (result.failures.length > 0) {
+    lines.push("", `Failures (${result.failures.length}); left parked:`);
+    for (const failure of result.failures) {
+      lines.push(`  ${failure.operation}  attemptedNamespace=${failure.attemptedNamespace}  error=${failure.error}`);
+    }
+  }
+  if (result.deleteFailures.length > 0) {
+    lines.push("", `Delete failures (${result.deleteFailures.length}); re-submitted but still parked:`);
+    for (const del of result.deleteFailures) {
+      lines.push(`  ${del.path}  error=${del.error}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/quarantine-replay.ts
+import * as fs from "fs";
+import { EngramAccessService, Orchestrator, initLogger, parseConfig, resolveRemnicConfigRecord } from "@remnic/core";
+import { WriteQuarantineStore } from "@remnic/core/write-quarantine.js";
+function valueFlag(args, flag) {
+  const occurrences = args.filter((a) => a === flag).length;
+  if (occurrences === 0) return void 0;
+  if (occurrences > 1) {
+    throw new Error(`${flag} may be given at most once.`);
+  }
+  const value = args[args.indexOf(flag) + 1];
+  if (value === void 0 || value.startsWith("--")) {
+    throw new Error(`${flag} requires a value. Provide it as \`${flag} <value>\`, not a bare flag.`);
+  }
+  if (value.trim().length === 0) {
+    throw new Error(`${flag} requires a non-empty value.`);
+  }
+  return value;
+}
+async function runQuarantineReplay(rest, format, resolveConfigPath2) {
+  let targetNamespace;
+  let principal;
+  try {
+    targetNamespace = valueFlag(rest, "--namespace");
+    principal = valueFlag(rest, "--principal");
+  } catch (err) {
+    process.stderr.write(`quarantine replay: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  if (!targetNamespace || targetNamespace.trim().length === 0) {
+    process.stderr.write("quarantine replay: --namespace <ns> is required.\n");
+    process.exitCode = 2;
+    return;
+  }
+  const valued = /* @__PURE__ */ new Set(["--namespace", "--principal"]);
+  const bad = rest.filter((a, i) => a.startsWith("--") ? a !== "--json" && !valued.has(a) : !valued.has(rest[i - 1]));
+  if (bad.length > 0) {
+    process.stderr.write(
+      `quarantine replay: unexpected argument(s): ${bad.join(", ")}. Use: replay --namespace <ns> [--principal <p>] [--json].
+`
+    );
+    process.exitCode = 2;
+    return;
+  }
+  initLogger();
+  let orchestrator;
+  try {
+    const configPath = resolveConfigPath2();
+    const raw = fs.existsSync(configPath) ? JSON.parse(fs.readFileSync(configPath, "utf8")) : {};
+    const config = parseConfig(resolveRemnicConfigRecord(raw));
+    orchestrator = new Orchestrator(config);
+    await orchestrator.initialize();
+    await orchestrator.deferredReady;
+    const service = new EngramAccessService(orchestrator);
+    const store = new WriteQuarantineStore(config.memoryDir);
+    const result = await replayQuarantine({
+      store,
+      targetNamespace,
+      principal,
+      submit: async (operation, request) => {
+        if (operation === "observe") {
+          await service.observe(request);
+        } else if (operation === "memory_store") {
+          await service.memoryStore(request);
+        } else {
+          await service.suggestionSubmit(request);
+        }
+      }
+    });
+    console.log(renderReplayResult(result, targetNamespace, format));
+    if (result.failures.length > 0 || result.deleteFailures.length > 0) process.exitCode = 1;
+  } catch {
+    process.stderr.write("quarantine replay: unable to replay quarantine store\n");
+    process.exitCode = 2;
+  } finally {
+    if (orchestrator) await orchestrator.destroy();
+  }
+}
+
+// src/offline-impression-rotation.ts
+import fs2 from "fs";
+import { parseConfig as parseConfig2, resolveRemnicConfigRecord as resolveRemnicConfigRecord2, drainPendingImpressionsForOfflineSync } from "@remnic/core";
+import { LastRecallStore } from "@remnic/core/recall-state";
+function parseConfigQuietly(raw) {
+  const originalWarn = console.warn;
+  console.warn = () => {
+  };
+  try {
+    return parseConfig2(resolveRemnicConfigRecord2(raw));
+  } finally {
+    console.warn = originalWarn;
+  }
+}
+var OFFLINE_CONFIG_KEYS = [
+  "offlineSyncExcludes",
+  "secureStoreEncryptOnWrite",
+  "recallImpressionsRotateBytes",
+  "recallImpressionsRotateKeep"
+];
+function pickOfflineConfigRecord(raw) {
+  let resolved;
+  try {
+    resolved = resolveRemnicConfigRecord2(raw);
+  } catch {
+    resolved = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  }
+  const picked = {};
+  for (const key of OFFLINE_CONFIG_KEYS) {
+    if (key in resolved) picked[key] = resolved[key];
+  }
+  return picked;
+}
+function resolveOfflineImpressionRotation(configPath) {
+  let raw;
+  try {
+    raw = fs2.existsSync(configPath) ? JSON.parse(fs2.readFileSync(configPath, "utf8")) : {};
+  } catch {
+    throw new Error(
+      `cannot read recall-impression rotation from ${configPath}: config file could not be read as JSON`
+    );
+  }
+  let config;
+  try {
+    config = parseConfigQuietly(pickOfflineConfigRecord(raw));
+  } catch {
+    throw new Error(
+      `cannot read recall-impression rotation from ${configPath}: config failed validation`
+    );
+  }
+  return {
+    impressionsRotateBytes: config.recallImpressionsRotateBytes,
+    impressionsRotateKeep: config.recallImpressionsRotateKeep
+  };
+}
+async function drainOfflineSyncImpressions(memoryDir, rotation) {
+  await drainPendingImpressionsForOfflineSync(
+    () => new LastRecallStore(memoryDir, {
+      impressionsRotateBytes: rotation.impressionsRotateBytes,
+      impressionsRotateKeep: rotation.impressionsRotateKeep
+    }).drainPendingImpressions()
+  );
+}
+
+// src/offline-storage-io.ts
+import { mkdtemp, readdir, lstat, rm } from "fs/promises";
+import fs3 from "fs";
+import path from "path";
+import { createHash, createDecipheriv } from "crypto";
+import {
+  OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES,
+  StorageManager
+} from "@remnic/core";
+import { OFFLINE_DECRYPT_STAGING_DIR_PREFIX } from "@remnic/core/offline-sync-exclude-globs";
+import {
+  AUTH_TAG_LENGTH,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  IV_LENGTH,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  SecureStoreLockedError,
+  filePathAad,
+  isEncryptedFile,
+  keyring,
+  readHeader,
+  secureStoreDir
+} from "@remnic/core/secure-store";
+async function createConfiguredOfflineStorage(memoryDir, secureStoreEncryptOnWrite = true) {
+  const storage = new StorageManager(memoryDir);
+  const header = await readHeader(memoryDir);
+  let secureStoreKey = null;
+  let secureStoreRequired = false;
+  if (header) {
+    secureStoreRequired = true;
+    storage.setSecureStoreRequired(true);
+    const key = keyring.getKey(secureStoreDir(memoryDir));
+    if (key) {
+      storage.setSecureStoreKey(key, secureStoreEncryptOnWrite);
+      secureStoreKey = key;
+    }
+  }
+  return { storage, secureStoreKey, secureStoreRequired };
+}
+function createOfflineStorageForPath(memoryDir, filePath, configured, secureStoreEncryptOnWrite) {
+  const memoryRoot = path.resolve(memoryDir);
+  const stateDir = path.dirname(filePath);
+  if (path.basename(stateDir) !== "state" || path.basename(filePath) !== "memory-lifecycle-ledger.jsonl") {
+    throw new Error(`invalid lifecycle ledger path: ${filePath}`);
+  }
+  const storageRoot = path.resolve(path.dirname(stateDir));
+  if (storageRoot !== memoryRoot && !storageRoot.startsWith(`${memoryRoot}${path.sep}`)) {
+    throw new Error(`lifecycle ledger path is outside the offline memory directory: ${filePath}`);
+  }
+  const storage = new StorageManager(storageRoot);
+  if (configured.secureStoreRequired) {
+    storage.setSecureStoreRequired(true);
+  }
+  if (configured.secureStoreKey) {
+    storage.setSecureStoreKey(configured.secureStoreKey, secureStoreEncryptOnWrite);
+  }
+  return storage;
+}
+async function createOfflineStorageIo(memoryDir, configuredStorage) {
+  await cleanupOrphanedOfflineDecryptStaging(memoryDir);
+  const { storage, secureStoreKey } = configuredStorage ?? await createConfiguredOfflineStorage(memoryDir);
+  return {
+    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
+    readFileDigest: async ({ filePath }) => {
+      const hash = createHash("sha256");
+      let bytes = 0;
+      for await (const rawChunk of readOfflineSyncFileChunks({
+        filePath,
+        memoryDir,
+        secureStoreKey,
+        chunkSize: OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES
+      })) {
+        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+        hash.update(chunk);
+        bytes += chunk.length;
+      }
+      return {
+        sha256: hash.digest("hex"),
+        bytes
+      };
+    },
+    readFileChunks: ({ filePath, chunkSize }) => readOfflineSyncFileChunks({
+      filePath,
+      memoryDir,
+      secureStoreKey,
+      chunkSize
+    }),
+    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
+    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
+    writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
+    deleteFile: async ({ filePath }) => storage.deleteOfflineSyncFile(filePath)
+  };
+}
+var OFFLINE_DECRYPT_STAGING_ORPHAN_MS = 60 * 60 * 1e3;
+async function cleanupOrphanedOfflineDecryptStaging(memoryDir) {
+  let entries;
+  try {
+    entries = await readdir(memoryDir);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const name of entries) {
+    if (!name.startsWith(OFFLINE_DECRYPT_STAGING_DIR_PREFIX)) continue;
+    const dir = path.join(memoryDir, name);
+    try {
+      const info = await lstat(dir);
+      if (!info.isDirectory() || info.isSymbolicLink()) continue;
+      if (now - info.mtimeMs < OFFLINE_DECRYPT_STAGING_ORPHAN_MS) continue;
+      await rm(dir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function* readOfflineSyncFileChunks(options) {
+  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE);
+  if (!isEncryptedFile(header)) {
+    yield* readPlainOfflineFileChunks(options.filePath, options.chunkSize);
+    return;
+  }
+  if (!options.secureStoreKey) {
+    throw new SecureStoreLockedError(
+      `secure-store is locked \u2014 cannot read encrypted file at ${options.filePath}. Run \`remnic secure-store unlock\` to decrypt.`
+    );
+  }
+  yield* readEncryptedOfflineFileChunks({
+    filePath: options.filePath,
+    memoryDir: options.memoryDir,
+    key: options.secureStoreKey,
+    chunkSize: options.chunkSize
+  });
+}
+async function readFilePrefix(filePath, length) {
+  const handle = await fs3.promises.open(filePath, "r");
+  try {
+    const out = Buffer.alloc(length);
+    const { bytesRead } = await handle.read(out, 0, length, 0);
+    return out.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+async function* readPlainOfflineFileChunks(filePath, chunkSize) {
+  const stream = fs3.createReadStream(filePath, { highWaterMark: chunkSize });
+  for await (const chunk of stream) {
+    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+  }
+}
+async function* readEncryptedOfflineFileChunks(options) {
+  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);
+  if (header.length < MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE || !isEncryptedFile(header)) {
+    throw new Error(`secure-store encrypted file is truncated: ${options.filePath}`);
+  }
+  const version = header.readUInt8(MAGIC_BYTES.length);
+  const flags = header.readUInt8(MAGIC_BYTES.length + 1);
+  if (version !== FILE_FORMAT_VERSION) {
+    throw new Error(`secure-store file has unsupported version ${version}: ${options.filePath}`);
+  }
+  if (flags !== FILE_FORMAT_FLAGS) {
+    throw new Error(`secure-store file has unsupported flags 0x${flags.toString(16)}: ${options.filePath}`);
+  }
+  const envelopeHeader = header.subarray(MAGIC_HEADER_SIZE);
+  const envelopeVersion = envelopeHeader.readUInt8(ENVELOPE_LAYOUT.version);
+  if (envelopeVersion !== ENVELOPE_VERSION) {
+    throw new Error(`secure-store envelope has unsupported version ${envelopeVersion}: ${options.filePath}`);
+  }
+  const salt = envelopeHeader.subarray(
+    ENVELOPE_LAYOUT.salt,
+    ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH
+  );
+  const iv = envelopeHeader.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);
+  const authTag = envelopeHeader.subarray(
+    ENVELOPE_LAYOUT.authTag,
+    ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH
+  );
+  const aadCandidates = offlineFileAadCandidates(options.filePath, options.memoryDir);
+  let lastError;
+  for (const aad of aadCandidates) {
+    const tempDir = await mkdtemp(path.join(options.memoryDir, OFFLINE_DECRYPT_STAGING_DIR_PREFIX));
+    const tempPath = path.join(tempDir, "content");
+    try {
+      const decipher = createDecipheriv("aes-256-gcm", options.key, iv, {
+        authTagLength: AUTH_TAG_LENGTH
+      });
+      decipher.setAuthTag(authTag);
+      decipher.setAAD(Buffer.concat([secureStoreEnvelopeHeaderAad(salt), aad]));
+      const output = fs3.createWriteStream(tempPath, { mode: 384 });
+      try {
+        const stream = fs3.createReadStream(options.filePath, {
+          start: MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE,
+          highWaterMark: options.chunkSize
+        });
+        for await (const encryptedChunk of stream) {
+          const plain = decipher.update(
+            Buffer.isBuffer(encryptedChunk) ? encryptedChunk : Buffer.from(encryptedChunk)
+          );
+          if (plain.length > 0 && !output.write(plain)) {
+            await new Promise((resolve, reject) => {
+              output.once("drain", resolve);
+              output.once("error", reject);
+            });
+          }
+        }
+        const finalPlain = decipher.final();
+        if (finalPlain.length > 0 && !output.write(finalPlain)) {
+          await new Promise((resolve, reject) => {
+            output.once("drain", resolve);
+            output.once("error", reject);
+          });
+        }
+      } finally {
+        await closeWriteStream(output);
+      }
+      yield* readPlainOfflineFileChunks(tempPath, options.chunkSize);
+      return;
+    } catch (error) {
+      lastError = error;
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
   }
+  throw lastError instanceof Error ? lastError : new Error(`secure-store could not decrypt file: ${options.filePath}`);
 }
-async function loadWecloneExportModule() {
-  if (cached === void 0) {
-    cached = await tryImportWecloneExport();
+function offlineFileAadCandidates(filePath, memoryDir) {
+  const candidates = [filePathAad(filePath, memoryDir)];
+  const relative = path.relative(memoryDir, filePath);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return candidates;
+  const parts = relative.split(path.sep);
+  if (parts[0] === "namespaces" && parts.length >= 3 && parts[1]) {
+    candidates.push(filePathAad(filePath, path.join(memoryDir, "namespaces", parts[1])));
   }
-  if (!cached) {
-    throw new Error(
-      "The weclone training-export adapter requires the optional @remnic/export-weclone package.\n\nInstall it alongside the CLI:\n  npm install -g @remnic/export-weclone\n\nOr add it to a project:\n  pnpm add @remnic/export-weclone\n"
-    );
+  const memoryParts = path.resolve(memoryDir).split(path.sep);
+  if (memoryParts.length >= 3 && memoryParts.at(-2) === "namespaces" && memoryParts.at(-1)) {
+    const topLevelRoot = memoryParts.slice(0, -2).join(path.sep) || path.sep;
+    const topRelative = path.relative(topLevelRoot, filePath);
+    if (topRelative && !topRelative.startsWith("..") && !path.isAbsolute(topRelative) && topRelative.split(path.sep)[0] === "namespaces" && topRelative.split(path.sep)[1] === memoryParts.at(-1)) {
+      candidates.push(filePathAad(filePath, topLevelRoot));
+    }
   }
-  return cached;
+  return candidates;
+}
+async function closeWriteStream(stream) {
+  await new Promise((resolve, reject) => {
+    stream.once("error", reject);
+    stream.end(() => resolve());
+  });
+}
+function secureStoreEnvelopeHeaderAad(salt) {
+  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);
+  out.writeUInt8(ENVELOPE_VERSION, 0);
+  Buffer.from(salt).copy(out, 1);
+  return out;
 }
 
 // src/bench-build-freshness.ts
 import {
-  existsSync,
+  existsSync as existsSync2,
   lstatSync,
   readdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   statSync
 } from "fs";
-import path from "path";
+import path2 from "path";
 import { fileURLToPath } from "url";
 var STALE_BUILD_TOLERANCE_MS = 1e3;
 function assertLocalBenchBuildFreshForDevelopment(currentModuleUrl) {
   if (isTruthyEnv(process.env.REMNIC_BENCH_ALLOW_STALE_DIST)) {
     return;
   }
-  const currentDir = path.dirname(fileURLToPath(currentModuleUrl));
-  const benchPackageDir = path.resolve(currentDir, "../../bench");
+  const currentDir = path2.dirname(fileURLToPath(currentModuleUrl));
+  const benchPackageDir = path2.resolve(currentDir, "../../bench");
   const freshness = checkBenchBuildFreshness(benchPackageDir);
   if (!freshness.stale) {
     return;
@@ -219,31 +757,31 @@ function assertLocalBenchBuildFreshForDevelopment(currentModuleUrl) {
   );
 }
 function checkBenchBuildFreshness(benchPackageDir) {
-  const packageJsonPath = path.join(benchPackageDir, "package.json");
-  if (!existsSync(packageJsonPath)) {
+  const packageJsonPath = path2.join(benchPackageDir, "package.json");
+  if (!existsSync2(packageJsonPath)) {
     return { stale: false };
   }
   let packageName;
   try {
-    packageName = JSON.parse(readFileSync(packageJsonPath, "utf8")).name;
+    packageName = JSON.parse(readFileSync2(packageJsonPath, "utf8")).name;
   } catch {
     return { stale: false };
   }
   if (packageName !== "@remnic/bench") {
     return { stale: false };
   }
-  const srcDir = path.join(benchPackageDir, "src");
+  const srcDir = path2.join(benchPackageDir, "src");
   if (!isDirectory(srcDir)) {
     return { stale: false };
   }
   const sourceRoots = [
     srcDir,
     packageJsonPath,
-    path.join(benchPackageDir, "tsup.config.ts"),
-    path.join(benchPackageDir, "tsconfig.json")
+    path2.join(benchPackageDir, "tsup.config.ts"),
+    path2.join(benchPackageDir, "tsconfig.json")
   ];
-  const distPath = path.join(benchPackageDir, "dist", "index.js");
-  if (!existsSync(distPath)) {
+  const distPath = path2.join(benchPackageDir, "dist", "index.js");
+  if (!existsSync2(distPath)) {
     return {
       stale: true,
       reason: `Missing build output: ${distPath}`,
@@ -276,7 +814,7 @@ function checkBenchBuildFreshness(benchPackageDir) {
 function newestMtime(roots) {
   let newest;
   const visit = (entryPath) => {
-    if (!existsSync(entryPath)) {
+    if (!existsSync2(entryPath)) {
       return;
     }
     const stat = lstatSync(entryPath);
@@ -285,7 +823,7 @@ function newestMtime(roots) {
     }
     if (stat.isDirectory()) {
       for (const child of readdirSync(entryPath)) {
-        visit(path.join(entryPath, child));
+        visit(path2.join(entryPath, child));
       }
       return;
     }
@@ -317,19 +855,19 @@ function isTruthyEnv(value) {
 }
 
 // src/optional-bench.ts
-import { existsSync as existsSync2 } from "fs";
-import path2 from "path";
+import { existsSync as existsSync3 } from "fs";
+import path3 from "path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 var SPECIFIER2 = "@remnic/bench";
 var TSX_ESM_API_SPECIFIER = "tsx/esm/api";
 var cached2;
 var cachedFromLocalWorkspaceBenchSource = false;
 function resolveLocalWorkspaceBenchPaths() {
-  const currentDir = path2.dirname(fileURLToPath2(import.meta.url));
-  const benchPackageDir = path2.resolve(currentDir, "../../bench");
+  const currentDir = path3.dirname(fileURLToPath2(import.meta.url));
+  const benchPackageDir = path3.resolve(currentDir, "../../bench");
   return {
-    distEntry: path2.join(benchPackageDir, "dist", "index.js"),
-    sourceEntry: path2.join(benchPackageDir, "src", "index.ts")
+    distEntry: path3.join(benchPackageDir, "dist", "index.js"),
+    sourceEntry: path3.join(benchPackageDir, "src", "index.ts")
   };
 }
 async function tryImportLocalWorkspaceBenchSource(err) {
@@ -337,7 +875,7 @@ async function tryImportLocalWorkspaceBenchSource(err) {
     return null;
   }
   const { sourceEntry } = resolveLocalWorkspaceBenchPaths();
-  if (!existsSync2(sourceEntry)) {
+  if (!existsSync3(sourceEntry)) {
     return null;
   }
   const { tsImport } = await import(TSX_ESM_API_SPECIFIER);
@@ -355,7 +893,7 @@ function isMissingLocalWorkspaceBenchDistError(err) {
     return false;
   }
   const { distEntry, sourceEntry } = resolveLocalWorkspaceBenchPaths();
-  if (existsSync2(distEntry) || !existsSync2(sourceEntry)) {
+  if (existsSync3(distEntry) || !existsSync3(sourceEntry)) {
     return false;
   }
   const message = err.message;
@@ -416,8 +954,8 @@ function assertBenchModuleFreshForDevelopment() {
 }
 
 // src/daemon-service-candidates.ts
-import fs from "fs";
-import path3 from "path";
+import fs4 from "fs";
+import path4 from "path";
 var LAUNCHD_LABEL = "ai.remnic.daemon";
 var LEGACY_REMNIC_SERVER_LAUNCHD_LABEL = "ai.remnic.server";
 var LEGACY_LAUNCHD_LABEL = "ai.engram.daemon";
@@ -430,15 +968,15 @@ var SYSTEMD_SERVICE = "remnic.service";
 var LEGACY_SYSTEMD_SERVICE = "engram.service";
 var SYSTEMD_SERVICE_CANDIDATES = [SYSTEMD_SERVICE, LEGACY_SYSTEMD_SERVICE];
 function launchdPlistPaths(homeDir) {
-  return LAUNCHD_LABEL_CANDIDATES.map((label) => path3.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));
+  return LAUNCHD_LABEL_CANDIDATES.map((label) => path4.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));
 }
 function systemdUnitPaths(homeDir) {
-  return SYSTEMD_SERVICE_CANDIDATES.map((service) => path3.join(homeDir, ".config", "systemd", "user", service));
+  return SYSTEMD_SERVICE_CANDIDATES.map((service) => path4.join(homeDir, ".config", "systemd", "user", service));
 }
 function anyFileExists(paths) {
   return paths.some((candidate) => {
     try {
-      return fs.statSync(candidate).isFile();
+      return fs4.statSync(candidate).isFile();
     } catch {
       return false;
     }
@@ -450,7 +988,7 @@ function commandNames(command) {
 }
 function isRunnableNodeScript(filePath) {
   try {
-    const text = fs.readFileSync(filePath, "utf8").slice(0, 4096);
+    const text = fs4.readFileSync(filePath, "utf8").slice(0, 4096);
     const firstLine = text.split(/\r?\n/, 1)[0] ?? "";
     if (/^#!.*\bnode\b/.test(firstLine)) return true;
     if (firstLine.startsWith("#!")) return false;
@@ -463,20 +1001,20 @@ function isRunnableNodeScript(filePath) {
 function resolveShimNodeScript(filePath) {
   let text;
   try {
-    text = fs.readFileSync(filePath, "utf8").slice(0, 16384);
+    text = fs4.readFileSync(filePath, "utf8").slice(0, 16384);
   } catch {
     return void 0;
   }
-  const basedir = path3.dirname(filePath);
+  const basedir = path4.dirname(filePath);
   const jsReferencePattern = /"([^"]+\.js)"|'([^']+\.js)'|([^\s"'`]+\.js)/g;
   for (const match of text.matchAll(jsReferencePattern)) {
     const raw = match[1] ?? match[2] ?? match[3];
     if (!raw) continue;
     const candidate = raw.replaceAll("${basedir}", basedir).replaceAll("$basedir", basedir).replaceAll("\\ ", " ");
-    const resolved = path3.isAbsolute(candidate) ? candidate : path3.resolve(basedir, candidate);
+    const resolved = path4.isAbsolute(candidate) ? candidate : path4.resolve(basedir, candidate);
     try {
-      if (fs.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
-        return fs.realpathSync(resolved);
+      if (fs4.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
+        return fs4.realpathSync(resolved);
       }
     } catch {
     }
@@ -484,19 +1022,19 @@ function resolveShimNodeScript(filePath) {
   return void 0;
 }
 function resolveRunnableNodeScript(filePath) {
-  const realPath = fs.realpathSync(filePath);
+  const realPath = fs4.realpathSync(filePath);
   if (isRunnableNodeScript(realPath)) return realPath;
   return resolveShimNodeScript(realPath);
 }
 function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
-  for (const dir of pathEnv.split(path3.delimiter)) {
+  for (const dir of pathEnv.split(path4.delimiter)) {
     if (!dir) continue;
     for (const name of commandNames(command)) {
-      const candidate = path3.join(dir, name);
+      const candidate = path4.join(dir, name);
       try {
-        const stat = fs.statSync(candidate);
+        const stat = fs4.statSync(candidate);
         if (!stat.isFile()) continue;
-        if (process.platform !== "win32") fs.accessSync(candidate, fs.constants.X_OK);
+        if (process.platform !== "win32") fs4.accessSync(candidate, fs4.constants.X_OK);
         const runnable = resolveRunnableNodeScript(candidate);
         if (runnable) return runnable;
       } catch {
@@ -506,11 +1044,11 @@ function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
   return void 0;
 }
 function serverBinWrapperRequiredPath(candidate) {
-  const filename = path3.basename(candidate);
+  const filename = path4.basename(candidate);
   if (filename !== "remnic-server.js" && filename !== "engram-server.js") return void 0;
-  const binDir = path3.dirname(candidate);
-  if (path3.basename(binDir) !== "bin") return void 0;
-  return path3.join(path3.dirname(binDir), "dist", "index.js");
+  const binDir = path4.dirname(candidate);
+  if (path4.basename(binDir) !== "bin") return void 0;
+  return path4.join(path4.dirname(binDir), "dist", "index.js");
 }
 
 // src/service-candidates.ts
@@ -532,7 +1070,7 @@ function firstSuccessfulCandidate(candidates, attempt) {
 }
 
 // src/bench-args.ts
-import path4 from "path";
+import path5 from "path";
 
 // src/path-utils.ts
 function resolveHomeDir() {
@@ -1632,13 +2170,13 @@ function parseBenchArgs(argv) {
     mcpUrl,
     mcpToolMap,
     mcpDemo,
-    datasetDir: datasetDir ? path4.resolve(expandTilde(datasetDir)) : void 0,
-    resultsDir: resultsDir ? path4.resolve(expandTilde(resultsDir)) : void 0,
-    baselinesDir: baselinesDir ? path4.resolve(expandTilde(baselinesDir)) : void 0,
+    datasetDir: datasetDir ? path5.resolve(expandTilde(datasetDir)) : void 0,
+    resultsDir: resultsDir ? path5.resolve(expandTilde(resultsDir)) : void 0,
+    baselinesDir: baselinesDir ? path5.resolve(expandTilde(baselinesDir)) : void 0,
     runtimeProfile,
     matrixProfiles,
-    remnicConfigPath: remnicConfigRaw ? path4.resolve(expandTilde(remnicConfigRaw)) : void 0,
-    openclawConfigPath: openclawConfigRaw ? path4.resolve(expandTilde(openclawConfigRaw)) : void 0,
+    remnicConfigPath: remnicConfigRaw ? path5.resolve(expandTilde(remnicConfigRaw)) : void 0,
+    openclawConfigPath: openclawConfigRaw ? path5.resolve(expandTilde(openclawConfigRaw)) : void 0,
     modelSource,
     gatewayAgentId,
     fastGatewayAgentId,
@@ -1661,13 +2199,13 @@ function parseBenchArgs(argv) {
     internalDisableThinking: args.includes("--internal-disable-thinking"),
     internalCodexReasoningEffort,
     threshold,
-    custom: customRaw ? path4.resolve(expandTilde(customRaw)) : void 0,
+    custom: customRaw ? path5.resolve(expandTilde(customRaw)) : void 0,
     baselineAction,
     datasetAction,
     providerAction,
     runAction,
     format,
-    output: output ? path4.resolve(expandTilde(output)) : void 0,
+    output: output ? path5.resolve(expandTilde(output)) : void 0,
     target,
     publishedName,
     publishedSeed,
@@ -1677,24 +2215,24 @@ function parseBenchArgs(argv) {
     publishedIngestConcurrency,
     publishedTaskFilter,
     memcorrectAdapter,
-    publishedOut: publishedOutRaw ? path4.resolve(expandTilde(publishedOutRaw)) : void 0,
+    publishedOut: publishedOutRaw ? path5.resolve(expandTilde(publishedOutRaw)) : void 0,
     publishedDryRun: args.includes("--dry-run"),
     requestTimeout,
     localJudgeRequestTimeout,
     frontierJudgeRequestTimeout,
-    calibrationDir: calibrationDirRaw ? path4.resolve(expandTilde(calibrationDirRaw)) : void 0,
+    calibrationDir: calibrationDirRaw ? path5.resolve(expandTilde(calibrationDirRaw)) : void 0,
     calibrationLocalConfigSha256,
     calibrationFrontierConfigSha256,
     sourceResultId,
     expectedAnswerSetSha256,
     expectedQuestionIdListSha256,
-    taskIdsFile: taskIdsFileRaw ? path4.resolve(expandTilde(taskIdsFileRaw)) : void 0,
+    taskIdsFile: taskIdsFileRaw ? path5.resolve(expandTilde(taskIdsFileRaw)) : void 0,
     expectedTaskIdListSha256,
     drainTimeout,
     // Issue #1573 PR1: surface judge-cache flags into the runner options.
     noJudgeCache: args.includes("--no-judge-cache"),
-    judgeCacheDir: judgeCacheDirRaw ? path4.resolve(expandTilde(judgeCacheDirRaw)) : void 0,
-    localLabManifestPath: localLabManifestRaw ? path4.resolve(expandTilde(localLabManifestRaw)) : void 0,
+    judgeCacheDir: judgeCacheDirRaw ? path5.resolve(expandTilde(judgeCacheDirRaw)) : void 0,
+    localLabManifestPath: localLabManifestRaw ? path5.resolve(expandTilde(localLabManifestRaw)) : void 0,
     max429WaitMs,
     disableThinking: args.includes("--disable-thinking"),
     amaBenchJudgeProtocol,
@@ -1709,23 +2247,23 @@ function parseBenchArgs(argv) {
 }
 
 // src/bench-status.ts
-import { mkdir, readFile, readdir, rename, writeFile } from "fs/promises";
-import path5 from "path";
+import { mkdir, readFile, readdir as readdir2, rename, writeFile } from "fs/promises";
+import path6 from "path";
 function createBenchStatusPath(resultsDir, pid, startedAtMs = Date.now()) {
-  return path5.join(resultsDir, `bench-status-${startedAtMs}-${pid}.json`);
+  return path6.join(resultsDir, `bench-status-${startedAtMs}-${pid}.json`);
 }
 var BENCH_STATUS_FILENAME = /^bench-status-\d+-\d+\.json$/;
 var VALID_BENCH_ENTRY_STATUSES = /* @__PURE__ */ new Set(["pending", "running", "complete", "failed"]);
 async function findLatestBenchStatusFile(resultsDir) {
   let entries;
   try {
-    entries = await readdir(resultsDir);
+    entries = await readdir2(resultsDir);
   } catch {
     return null;
   }
   const candidates = entries.filter((name) => BENCH_STATUS_FILENAME.test(name)).sort().reverse();
   for (const name of candidates) {
-    const filePath = path5.join(resultsDir, name);
+    const filePath = path6.join(resultsDir, name);
     const status = await readBenchStatus(filePath);
     if (status) {
       return filePath;
@@ -1734,7 +2272,7 @@ async function findLatestBenchStatusFile(resultsDir) {
   return null;
 }
 async function atomicWriteJSON(filePath, data) {
-  await mkdir(path5.dirname(filePath), { recursive: true });
+  await mkdir(path6.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`;
   await writeFile(tmp, JSON.stringify(data, null, 2) + "\n");
   await rename(tmp, filePath);
@@ -1851,8 +2389,8 @@ function finalizeBenchStatus(filePath) {
 }
 
 // src/bench-fallback.ts
-import fs2 from "fs";
-import path6 from "path";
+import fs5 from "fs";
+import path7 from "path";
 var FALLBACK_RESULTS_DIRNAME = "fallback-runs";
 function buildBenchRunnerArgs(parsed, benchmarkId, outputDir) {
   const args = ["--benchmark", benchmarkId];
@@ -1916,34 +2454,34 @@ function findUnsupportedFallbackBenchOptions(parsed) {
   return unsupported;
 }
 function createFallbackBenchOutputDir(resultsDir, benchmarkId, pid, startedAtMs = Date.now()) {
-  return path6.join(
+  return path7.join(
     resultsDir,
     FALLBACK_RESULTS_DIRNAME,
     `${benchmarkId}-${startedAtMs}-${pid}`
   );
 }
 function resolveFallbackBenchResultPath(outputDir) {
-  const entries = fs2.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
+  const entries = fs5.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
   if (entries.length === 0) {
     throw new Error(`Fallback benchmark runner did not write a JSON result artifact in ${outputDir}`);
   }
-  return path6.join(outputDir, entries[0]);
+  return path7.join(outputDir, entries[0]);
 }
 
 // src/openclaw-upgrade-swap.ts
-import fs3 from "fs";
-import path7 from "path";
+import fs6 from "fs";
+import path8 from "path";
 function describeError(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function createSiblingTempFilePath(targetPath, label) {
   const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2, 10)}`;
-  return path7.join(path7.dirname(targetPath), `.${path7.basename(targetPath)}.${label}.${nonce}.tmp`);
+  return path8.join(path8.dirname(targetPath), `.${path8.basename(targetPath)}.${label}.${nonce}.tmp`);
 }
 function resolveAtomicWriteMode(targetPath, explicitMode) {
   if (explicitMode !== void 0) return explicitMode;
   try {
-    return fs3.statSync(targetPath).mode & 4095;
+    return fs6.statSync(targetPath).mode & 4095;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return 384;
@@ -1953,8 +2491,8 @@ function resolveAtomicWriteMode(targetPath, explicitMode) {
 }
 function resolveAtomicReplacementPath(targetPath) {
   try {
-    if (fs3.lstatSync(targetPath).isSymbolicLink()) {
-      return fs3.realpathSync(targetPath);
+    if (fs6.lstatSync(targetPath).isSymbolicLink()) {
+      return fs6.realpathSync(targetPath);
     }
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -1966,12 +2504,12 @@ function resolveAtomicReplacementPath(targetPath) {
 }
 function createSiblingSwapPath(targetDir, label) {
   const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2, 10)}`;
-  return path7.join(path7.dirname(targetDir), `.${path7.basename(targetDir)}.${label}.${nonce}`);
+  return path8.join(path8.dirname(targetDir), `.${path8.basename(targetDir)}.${label}.${nonce}`);
 }
 function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
   if (!displacedDir) return void 0;
   try {
-    fs3.rmSync(displacedDir, { recursive: true, force: true });
+    fs6.rmSync(displacedDir, { recursive: true, force: true });
     return void 0;
   } catch (error) {
     return `Warning: ${context}, but failed to remove the displaced plugin copy at ${displacedDir}: ${describeError(error)}`;
@@ -1979,55 +2517,55 @@ function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
 }
 function atomicWriteFileSync(targetPath, data, options = {}) {
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs3.mkdirSync(path7.dirname(resolvedTargetPath), { recursive: true });
+  fs6.mkdirSync(path8.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "write");
   const mode = resolveAtomicWriteMode(resolvedTargetPath, options.mode);
   try {
     if (options.hooks?.writeTempFileSync) {
       options.hooks.writeTempFileSync(tempPath);
     } else {
-      fs3.writeFileSync(tempPath, data, { mode });
+      fs6.writeFileSync(tempPath, data, { mode });
     }
-    fs3.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs3.renameSync;
+    fs6.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs6.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs3.rmSync(tempPath, { force: true });
+    fs6.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function atomicCopyFileSync(sourcePath, targetPath, options = {}) {
-  if (!fs3.existsSync(sourcePath)) return;
+  if (!fs6.existsSync(sourcePath)) return;
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs3.mkdirSync(path7.dirname(resolvedTargetPath), { recursive: true });
+  fs6.mkdirSync(path8.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "copy");
-  const mode = fs3.statSync(sourcePath).mode & 4095;
+  const mode = fs6.statSync(sourcePath).mode & 4095;
   try {
-    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs3.copyFileSync;
+    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs6.copyFileSync;
     copyTempFileSync(sourcePath, tempPath);
-    fs3.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs3.renameSync;
+    fs6.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs6.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs3.rmSync(tempPath, { force: true });
+    fs6.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function swapDirectoryWithRollback(stagedDir, targetDir, rollbackDir) {
   let hasRollbackCopy = false;
-  fs3.mkdirSync(path7.dirname(targetDir), { recursive: true });
-  fs3.rmSync(rollbackDir, { recursive: true, force: true });
-  if (fs3.existsSync(targetDir)) {
-    fs3.renameSync(targetDir, rollbackDir);
+  fs6.mkdirSync(path8.dirname(targetDir), { recursive: true });
+  fs6.rmSync(rollbackDir, { recursive: true, force: true });
+  if (fs6.existsSync(targetDir)) {
+    fs6.renameSync(targetDir, rollbackDir);
     hasRollbackCopy = true;
   }
   try {
-    fs3.renameSync(stagedDir, targetDir);
+    fs6.renameSync(stagedDir, targetDir);
   } catch (swapError) {
-    fs3.rmSync(targetDir, { recursive: true, force: true });
-    if (hasRollbackCopy && fs3.existsSync(rollbackDir)) {
+    fs6.rmSync(targetDir, { recursive: true, force: true });
+    if (hasRollbackCopy && fs6.existsSync(rollbackDir)) {
       try {
-        fs3.renameSync(rollbackDir, targetDir);
+        fs6.renameSync(rollbackDir, targetDir);
         hasRollbackCopy = false;
       } catch (restoreError) {
         throw new AggregateError(
@@ -2042,7 +2580,7 @@ function swapDirectoryWithRollback(stagedDir, targetDir, rollbackDir) {
 }
 function cleanupRollbackDirectory(rollbackDir) {
   if (!rollbackDir) return;
-  fs3.rmSync(rollbackDir, { recursive: true, force: true });
+  fs6.rmSync(rollbackDir, { recursive: true, force: true });
 }
 function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   if (!rollbackDir) return void 0;
@@ -2054,20 +2592,20 @@ function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   }
 }
 function restoreDirectoryFromRollback(targetDir, rollbackDir) {
-  if (!fs3.existsSync(rollbackDir)) {
+  if (!fs6.existsSync(rollbackDir)) {
     throw new Error(`Rollback directory is missing: ${rollbackDir}`);
   }
-  fs3.mkdirSync(path7.dirname(targetDir), { recursive: true });
-  const displacedDir = fs3.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
+  fs6.mkdirSync(path8.dirname(targetDir), { recursive: true });
+  const displacedDir = fs6.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
   if (displacedDir) {
-    fs3.renameSync(targetDir, displacedDir);
+    fs6.renameSync(targetDir, displacedDir);
   }
   try {
-    fs3.renameSync(rollbackDir, targetDir);
+    fs6.renameSync(rollbackDir, targetDir);
   } catch (restoreError) {
-    if (displacedDir && fs3.existsSync(displacedDir)) {
+    if (displacedDir && fs6.existsSync(displacedDir)) {
       try {
-        fs3.renameSync(displacedDir, targetDir);
+        fs6.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -2086,23 +2624,23 @@ function restoreDirectoryFromRollback(targetDir, rollbackDir) {
   );
 }
 function restoreDirectoryFromBackup(targetDir, backupDir) {
-  if (!fs3.existsSync(backupDir)) {
+  if (!fs6.existsSync(backupDir)) {
     throw new Error(`Plugin backup directory is missing: ${backupDir}`);
   }
-  fs3.mkdirSync(path7.dirname(targetDir), { recursive: true });
+  fs6.mkdirSync(path8.dirname(targetDir), { recursive: true });
   const stagedDir = createSiblingSwapPath(targetDir, "backup-restore");
-  const displacedDir = fs3.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
-  fs3.cpSync(backupDir, stagedDir, { recursive: true });
+  const displacedDir = fs6.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
+  fs6.cpSync(backupDir, stagedDir, { recursive: true });
   if (displacedDir) {
-    fs3.renameSync(targetDir, displacedDir);
+    fs6.renameSync(targetDir, displacedDir);
   }
   try {
-    fs3.renameSync(stagedDir, targetDir);
+    fs6.renameSync(stagedDir, targetDir);
   } catch (restoreError) {
-    fs3.rmSync(targetDir, { recursive: true, force: true });
-    if (displacedDir && fs3.existsSync(displacedDir)) {
+    fs6.rmSync(targetDir, { recursive: true, force: true });
+    if (displacedDir && fs6.existsSync(displacedDir)) {
       try {
-        fs3.renameSync(displacedDir, targetDir);
+        fs6.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -2110,7 +2648,7 @@ function restoreDirectoryFromBackup(targetDir, backupDir) {
         );
       }
     }
-    fs3.rmSync(stagedDir, { recursive: true, force: true });
+    fs6.rmSync(stagedDir, { recursive: true, force: true });
     throw new Error(
       `Failed to restore the plugin backup into ${targetDir}. The durable backup remains preserved at ${backupDir}.`,
       { cause: restoreError }
@@ -2136,7 +2674,7 @@ function rollbackOpenclawUpgrade({
   let rollbackRestoreError;
   let pluginRestored = false;
   try {
-    if (rollbackDir && fs3.existsSync(rollbackDir)) {
+    if (rollbackDir && fs6.existsSync(rollbackDir)) {
       const cleanupWarning = restoreDirectoryFromRollback(pluginDir, rollbackDir);
       notes.push(`Restored previous plugin from rollback copy at ${rollbackDir}`);
       if (cleanupWarning) notes.push(cleanupWarning);
@@ -2146,7 +2684,7 @@ function rollbackOpenclawUpgrade({
     rollbackRestoreError = error instanceof Error ? error.message : String(error);
   }
   try {
-    if (!pluginRestored && pluginBackupDir && fs3.existsSync(pluginBackupDir)) {
+    if (!pluginRestored && pluginBackupDir && fs6.existsSync(pluginBackupDir)) {
       const cleanupWarning = restoreDirectoryFromBackup(pluginDir, pluginBackupDir);
       if (rollbackRestoreError) {
         notes.push(
@@ -2173,7 +2711,7 @@ function rollbackOpenclawUpgrade({
     notes.push("No previous plugin copy was available for automatic restore");
   }
   try {
-    if (configBackupPath && fs3.existsSync(configBackupPath)) {
+    if (configBackupPath && fs6.existsSync(configBackupPath)) {
       restoreFileFromBackup(configPath, configBackupPath);
       notes.push(`Restored OpenClaw config from backup at ${configBackupPath}`);
     }
@@ -2213,11 +2751,11 @@ Run this manually when you're ready:
 }
 
 // src/daemon-service.ts
-import fs4 from "fs";
-import path8 from "path";
+import fs7 from "fs";
+import path9 from "path";
 import * as childProcess from "child_process";
 import { fileURLToPath as fileURLToPath3 } from "url";
-var thisModuleDir = path8.dirname(fileURLToPath3(import.meta.url));
+var thisModuleDir = path9.dirname(fileURLToPath3(import.meta.url));
 function launchdLoadPlist(plistPath, processApi = childProcess) {
   processApi.execFileSync("launchctl", ["load", "-w", plistPath], { stdio: "pipe" });
 }
@@ -2225,7 +2763,7 @@ function launchdUnloadPlist(plistPath, processApi = childProcess) {
   processApi.execFileSync("launchctl", ["unload", plistPath], { stdio: "pipe" });
 }
 function resolveServerBinDetails(options = {}) {
-  const existsSync3 = options.existsSync ?? fs4.existsSync;
+  const existsSync4 = options.existsSync ?? fs7.existsSync;
   const findCommandOnPath2 = options.findCommandOnPath ?? findCommandOnPath;
   const moduleDir = options.moduleDir ?? thisModuleDir;
   const packageResolve = options.packageResolve ?? resolveImportSpecifier;
@@ -2239,8 +2777,8 @@ function resolveServerBinDetails(options = {}) {
     });
   } catch {
   }
-  const workspaceServerBin = path8.resolve(moduleDir, "../../remnic-server/bin/remnic-server.js");
-  const workspaceDistIndex = path8.resolve(moduleDir, "../../remnic-server/dist/index.js");
+  const workspaceServerBin = path9.resolve(moduleDir, "../../remnic-server/bin/remnic-server.js");
+  const workspaceDistIndex = path9.resolve(moduleDir, "../../remnic-server/dist/index.js");
   candidates.push(
     {
       path: workspaceServerBin,
@@ -2261,15 +2799,15 @@ function resolveServerBinDetails(options = {}) {
     });
   }
   candidates.push({
-    path: path8.resolve(moduleDir, "../../remnic-server/src/index.ts"),
+    path: path9.resolve(moduleDir, "../../remnic-server/src/index.ts"),
     source: "workspace-source"
   });
-  const selected = candidates.find((candidate) => isCandidateReady(candidate, existsSync3)) ?? candidates.find((candidate) => existsSync3(candidate.path)) ?? candidates[0] ?? {
-    path: path8.resolve(moduleDir, "../../remnic-server/dist/index.js"),
+  const selected = candidates.find((candidate) => isCandidateReady(candidate, existsSync4)) ?? candidates.find((candidate) => existsSync4(candidate.path)) ?? candidates[0] ?? {
+    path: path9.resolve(moduleDir, "../../remnic-server/dist/index.js"),
     source: "workspace-dist"
   };
-  const exists = existsSync3(selected.path);
-  const requiredExists = selected.requiredPath ? existsSync3(selected.requiredPath) : true;
+  const exists = existsSync4(selected.path);
+  const requiredExists = selected.requiredPath ? existsSync4(selected.requiredPath) : true;
   const { requiredPath: _requiredPath, ...publicSelected } = selected;
   return {
     ...publicSelected,
@@ -2277,22 +2815,22 @@ function resolveServerBinDetails(options = {}) {
     loadableByNode: exists && requiredExists && !selected.path.endsWith(".ts")
   };
 }
-function isCandidateReady(candidate, existsSync3) {
-  return existsSync3(candidate.path) && (candidate.requiredPath ? existsSync3(candidate.requiredPath) : true);
+function isCandidateReady(candidate, existsSync4) {
+  return existsSync4(candidate.path) && (candidate.requiredPath ? existsSync4(candidate.requiredPath) : true);
 }
 function resolveServerBin(options = {}) {
   return resolveServerBinDetails(options).path;
 }
 function readVerifiedDaemonPid(options) {
-  const readFileSync3 = options.readFileSync ?? fs4.readFileSync;
-  const unlinkSync = options.unlinkSync ?? fs4.unlinkSync;
+  const readFileSync4 = options.readFileSync ?? fs7.readFileSync;
+  const unlinkSync = options.unlinkSync ?? fs7.unlinkSync;
   const processKill = options.processKill ?? process.kill;
   const platform = options.platform ?? process.platform;
   const execFileSync3 = options.execFileSync ?? ((command, args, execOptions) => childProcess.execFileSync(command, args, execOptions));
   for (const file of options.pidFiles) {
     let pid;
     try {
-      pid = parseDaemonPid(readFileSync3(file, "utf8"));
+      pid = parseDaemonPid(readFileSync4(file, "utf8"));
     } catch {
       continue;
     }
@@ -2320,7 +2858,7 @@ function readVerifiedDaemonPid(options) {
 }
 function doesProcessCommandLookLikeRemnicDaemon(command, expectedServerBin) {
   const normalizedCommand = command.trim();
-  const normalizedExpected = path8.resolve(expandTilde(expectedServerBin));
+  const normalizedExpected = path9.resolve(expandTilde(expectedServerBin));
   return normalizedCommand.includes(normalizedExpected) || /(?:^|\s|[/\\])(?:remnic-server|engram-server)(?:\.js)?(?:\s|$)/.test(normalizedCommand) || /@remnic[/\\]server[/\\]/.test(normalizedCommand) || /packages[/\\]remnic-server[/\\](?:bin[/\\]remnic-server\.js|dist[/\\]index\.js|src[/\\]index\.ts)/.test(normalizedCommand);
 }
 function parseDaemonPid(raw) {
@@ -2385,9 +2923,9 @@ function removePidFileBestEffort(file, unlinkSync) {
   }
 }
 function inspectLaunchdPlist(plistPath, options = {}) {
-  const existsSync3 = options.existsSync ?? fs4.existsSync;
-  const readFileSync3 = options.readFileSync ?? fs4.readFileSync;
-  if (!existsSync3(plistPath)) {
+  const existsSync4 = options.existsSync ?? fs7.existsSync;
+  const readFileSync4 = options.readFileSync ?? fs7.readFileSync;
+  if (!existsSync4(plistPath)) {
     return {
       installed: false,
       ok: true,
@@ -2397,7 +2935,7 @@ function inspectLaunchdPlist(plistPath, options = {}) {
   }
   let content;
   try {
-    content = readFileSync3(plistPath, "utf8");
+    content = readFileSync4(plistPath, "utf8");
   } catch {
     return {
       installed: true,
@@ -2425,7 +2963,7 @@ function inspectLaunchdPlist(plistPath, options = {}) {
     };
   }
   const expandedServerArg = expandTilde(serverArg);
-  if (!path8.isAbsolute(expandedServerArg)) {
+  if (!path9.isAbsolute(expandedServerArg)) {
     return {
       installed: true,
       ok: false,
@@ -2433,7 +2971,7 @@ function inspectLaunchdPlist(plistPath, options = {}) {
       remediation: "Run `remnic daemon install` so launchd uses an absolute Remnic server path."
     };
   }
-  if (!existsSync3(expandedServerArg)) {
+  if (!existsSync4(expandedServerArg)) {
     return {
       installed: true,
       ok: false,
@@ -2497,8 +3035,8 @@ function normalizeResolvedPath(resolved) {
   return resolved;
 }
 function packageServerBinFromEntry(packageEntry) {
-  if (path8.basename(packageEntry) === "index.js" && path8.basename(path8.dirname(packageEntry)) === "dist") {
-    return path8.join(path8.dirname(path8.dirname(packageEntry)), "bin", "remnic-server.js");
+  if (path9.basename(packageEntry) === "index.js" && path9.basename(path9.dirname(packageEntry)) === "dist") {
+    return path9.join(path9.dirname(path9.dirname(packageEntry)), "bin", "remnic-server.js");
   }
   return packageEntry;
 }
@@ -2620,7 +3158,7 @@ function stripConfigArgv(args) {
 }
 
 // src/import-dispatch.ts
-import fs5 from "fs";
+import fs8 from "fs";
 import {
   runImporter,
   validateImportBatchSize,
@@ -2628,10 +3166,10 @@ import {
 } from "@remnic/core";
 
 // src/import-bundle-detect.ts
-import { lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
-import path9 from "path";
+import { lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import path10 from "path";
 function detectBundleEntries(bundleDir, options = {}) {
-  const readdir2 = options.readdirImpl ?? defaultReaddir;
+  const readdir3 = options.readdirImpl ?? defaultReaddir;
   const readFileImpl = options.readFileImpl ?? defaultReadFile;
   const isDirectory2 = options.isDirectoryImpl ?? defaultIsDirectory;
   const isRegularFile = options.isRegularFileImpl ?? (options.readdirImpl !== void 0 || options.isDirectoryImpl !== void 0 ? (p) => !isDirectory2(p) : defaultIsRegularFile);
@@ -2651,7 +3189,7 @@ function detectBundleEntries(bundleDir, options = {}) {
   }
   const roots = collectCandidatePaths(
     bundleDir,
-    readdir2,
+    readdir3,
     isDirectory2,
     isRegularFile
   );
@@ -2660,7 +3198,7 @@ function detectBundleEntries(bundleDir, options = {}) {
   for (const filePath of roots) {
     if (seenFiles.has(filePath)) continue;
     seenFiles.add(filePath);
-    const name = path9.basename(filePath);
+    const name = path10.basename(filePath);
     const match = classifyFile(name, filePath, readFileImpl);
     if (match) entries.push(match);
   }
@@ -2680,9 +3218,9 @@ function detectBundleEntries(bundleDir, options = {}) {
   return entries;
 }
 var MAX_WALK_DEPTH = 4;
-function collectCandidatePaths(root, readdir2, isDirectory2, isRegularFile) {
+function collectCandidatePaths(root, readdir3, isDirectory2, isRegularFile) {
   try {
-    readdir2(root);
+    readdir3(root);
   } catch {
     throw new Error(
       `Bundle directory '${root}' could not be read. Pass an existing directory.`
@@ -2693,12 +3231,12 @@ function collectCandidatePaths(root, readdir2, isDirectory2, isRegularFile) {
     if (depth > MAX_WALK_DEPTH) return;
     let entries;
     try {
-      entries = readdir2(dir);
+      entries = readdir3(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path9.join(dir, entry);
+      const full = path10.join(dir, entry);
       if (isDirectory2(full)) {
         walk(full, depth + 1);
       } else if (isRegularFile(full)) {
@@ -2750,7 +3288,7 @@ function defaultReaddir(dir) {
   return readdirSync2(dir);
 }
 function defaultReadFile(p) {
-  return readFileSync2(p, "utf-8");
+  return readFileSync3(p, "utf-8");
 }
 function defaultIsDirectory(p) {
   try {
@@ -3134,7 +3672,7 @@ async function cmdImport(rest, targetFactory, disposeTarget, ioOverrides = {}) {
   let materializedTarget;
   let materializePromise;
   const io = {
-    readFile: ioOverrides.readFile ?? (async (p) => fs5.promises.readFile(p, "utf-8")),
+    readFile: ioOverrides.readFile ?? (async (p) => fs8.promises.readFile(p, "utf-8")),
     loadAdapter: ioOverrides.loadAdapter ?? (async (name) => (await loadImporterModule(name)).adapter),
     runImporter: ioOverrides.runImporter ?? runImporter,
     getWriteTarget: async () => {
@@ -3207,8 +3745,8 @@ function takeOptionalValue(args, flag) {
 }
 
 // src/import-lossless-claw-cmd.ts
-import fs6 from "fs";
-import path10 from "path";
+import fs9 from "fs";
+import path11 from "path";
 import {
   applyLcmSchema,
   ensureLcmStateDir,
@@ -3319,15 +3857,15 @@ async function loadImportLosslessClawModule() {
 
 // src/import-lossless-claw-cmd.ts
 function assertDirectoryOrAbsent(p, label) {
-  if (fs6.existsSync(p) && !fs6.statSync(p).isDirectory()) {
+  if (fs9.existsSync(p) && !fs9.statSync(p).isDirectory()) {
     throw new Error(`${label} is not a directory: ${p}`);
   }
 }
 function assertFile(p, label) {
-  if (!fs6.existsSync(p)) {
+  if (!fs9.existsSync(p)) {
     throw new Error(`${label} does not exist: ${p}`);
   }
-  if (!fs6.statSync(p).isFile()) {
+  if (!fs9.statSync(p).isFile()) {
     throw new Error(`${label} is not a file: ${p}`);
   }
 }
@@ -3358,8 +3896,8 @@ async function cmdImportLosslessClaw(argv, io, deps = {}) {
     let destDb;
     try {
       if (parsed.dryRun) {
-        const lcmPath = path10.join(memoryDir, "state", "lcm.sqlite");
-        if (fs6.existsSync(lcmPath)) {
+        const lcmPath = path11.join(memoryDir, "state", "lcm.sqlite");
+        if (fs9.existsSync(lcmPath)) {
           destDb = mod.openExistingLcmDatabaseReadOnly(lcmPath);
         } else {
           destDb = mod.openInMemoryDestinationDatabase();
@@ -3451,15 +3989,15 @@ registerPublisher("omp", () => new LazyPluginPiPublisher("omp", (mod) => mod.Omp
 function readCompatEnv(primary, legacy) {
   return process.env[primary] ?? process.env[legacy];
 }
-var PID_DIR = path11.join(resolveHomeDir(), ".remnic");
-var LEGACY_PID_DIR = path11.join(resolveHomeDir(), ".engram");
-var PID_FILE = path11.join(PID_DIR, "server.pid");
-var LEGACY_PID_FILE = path11.join(LEGACY_PID_DIR, "server.pid");
-var LOG_FILE = path11.join(PID_DIR, "server.log");
-var LEGACY_LOG_FILE = path11.join(LEGACY_PID_DIR, "server.log");
-var CLI_MODULE_DIR = path11.dirname(fileURLToPath4(import.meta.url));
-var CLI_REPO_ROOT = path11.resolve(CLI_MODULE_DIR, "../../..");
-var EVAL_RUNNER_PATH = path11.join(CLI_REPO_ROOT, "evals", "run.ts");
+var PID_DIR = path12.join(resolveHomeDir(), ".remnic");
+var LEGACY_PID_DIR = path12.join(resolveHomeDir(), ".engram");
+var PID_FILE = path12.join(PID_DIR, "server.pid");
+var LEGACY_PID_FILE = path12.join(LEGACY_PID_DIR, "server.pid");
+var LOG_FILE = path12.join(PID_DIR, "server.log");
+var LEGACY_LOG_FILE = path12.join(LEGACY_PID_DIR, "server.log");
+var CLI_MODULE_DIR = path12.dirname(fileURLToPath4(import.meta.url));
+var CLI_REPO_ROOT = path12.resolve(CLI_MODULE_DIR, "../../..");
+var EVAL_RUNNER_PATH = path12.join(CLI_REPO_ROOT, "evals", "run.ts");
 var OPENCLAW_GATEWAY_LABEL = "ai.openclaw.gateway";
 var CLI_SUCCESS_EXIT_GRACE_MS = 5e3;
 var CLI_OUTPUT_FLUSH_GRACE_MS = 250;
@@ -3792,7 +4330,7 @@ async function resolveAllBenchmarks() {
   if (packageBenchmarks) {
     return packageBenchmarks.filter((entry) => entry.runnerAvailable).map((entry) => entry.id);
   }
-  if (!fs7.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs10.existsSync(EVAL_RUNNER_PATH)) {
     return [];
   }
   return BENCHMARK_CATALOG.filter((entry) => entry.category !== "ingestion").map((entry) => entry.id);
@@ -3840,17 +4378,17 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
       `Fallback benchmark runner does not support provider-backed, gateway, or thinking/timeout flags (${unsupportedOptions.join(", ")}). Build/install @remnic/bench to use those options.`
     );
   }
-  if (!fs7.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs10.existsSync(EVAL_RUNNER_PATH)) {
     console.error(
       "Benchmark runner not found. Expected eval runner at evals/run.ts or a phase-1 @remnic/bench runtime export."
     );
     process.exit(1);
   }
   const tsxCandidates = [
-    path11.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
-    path11.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
+    path12.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
+    path12.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
   ];
-  const tsxCmd = tsxCandidates.find((candidate) => fs7.existsSync(candidate)) ?? "tsx";
+  const tsxCmd = tsxCandidates.find((candidate) => fs10.existsSync(candidate)) ?? "tsx";
   const fallbackOutputDir = createFallbackBenchOutputDir(
     parsed.resultsDir ?? resolveBenchOutputDir(),
     benchmarkId,
@@ -3867,7 +4405,7 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
   return resolveFallbackBenchResultPath(fallbackOutputDir);
 }
 function resolveBenchOutputDir() {
-  return path11.join(resolveHomeDir(), ".remnic", "bench", "results");
+  return path12.join(resolveHomeDir(), ".remnic", "bench", "results");
 }
 var DOWNLOADABLE_BENCHMARK_DATASETS = [
   "ama-bench",
@@ -3912,8 +4450,8 @@ var MEMORY_AGENT_BENCH_SPLIT_FILENAMES = [
 ];
 var MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES = [
   "entity2id.json",
-  path11.join("processed_data", "Recsys_Redial", "entity2id.json"),
-  path11.join("Recsys_Redial", "entity2id.json")
+  path12.join("processed_data", "Recsys_Redial", "entity2id.json"),
+  path12.join("Recsys_Redial", "entity2id.json")
 ];
 var DOWNLOADED_DATASET_MARKERS = {
   "ama-bench": { anyOf: ["open_end_qa_set.jsonl"] },
@@ -3988,18 +4526,18 @@ var PERSONAMEM_DATASET_FILE_CANDIDATES = [
   "benchmark/benchmark.csv",
   "benchmark.csv"
 ];
-var PERSONAMEM_COMPLETION_MARKER = path11.join(
+var PERSONAMEM_COMPLETION_MARKER = path12.join(
   "data",
   "chat_history_32k",
   ".download-complete"
 );
 function resolveRealpathWithinDataset(datasetPath, relativePath) {
   try {
-    const datasetRoot = fs7.realpathSync(datasetPath);
-    const candidatePath = path11.resolve(datasetRoot, relativePath);
-    const candidateRealPath = fs7.realpathSync(candidatePath);
-    const relativeToRoot = path11.relative(datasetRoot, candidateRealPath);
-    if (relativeToRoot.startsWith("..") || path11.isAbsolute(relativeToRoot)) {
+    const datasetRoot = fs10.realpathSync(datasetPath);
+    const candidatePath = path12.resolve(datasetRoot, relativePath);
+    const candidateRealPath = fs10.realpathSync(candidatePath);
+    const relativeToRoot = path12.relative(datasetRoot, candidateRealPath);
+    if (relativeToRoot.startsWith("..") || path12.isAbsolute(relativeToRoot)) {
       return null;
     }
     return candidateRealPath;
@@ -4055,15 +4593,15 @@ function parseCsvRows(raw) {
 }
 function isPersonaMemDatasetComplete(datasetPath) {
   try {
-    const completionMarkerPath = path11.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
-    if (fs7.statSync(completionMarkerPath).isFile()) {
+    const completionMarkerPath = path12.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
+    if (fs10.statSync(completionMarkerPath).isFile()) {
       return true;
     }
   } catch {
   }
   const datasetFile = PERSONAMEM_DATASET_FILE_CANDIDATES.find((candidate) => {
     try {
-      return fs7.statSync(path11.join(datasetPath, candidate)).isFile();
+      return fs10.statSync(path12.join(datasetPath, candidate)).isFile();
     } catch {
       return false;
     }
@@ -4072,7 +4610,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     return false;
   }
   try {
-    const rows = parseCsvRows(fs7.readFileSync(path11.join(datasetPath, datasetFile), "utf8"));
+    const rows = parseCsvRows(fs10.readFileSync(path12.join(datasetPath, datasetFile), "utf8"));
     if (rows.length < 2) {
       return false;
     }
@@ -4087,7 +4625,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     }
     return historyPaths.every((relativePath) => {
       const resolvedPath = resolveRealpathWithinDataset(datasetPath, relativePath);
-      return resolvedPath !== null && fs7.statSync(resolvedPath).isFile();
+      return resolvedPath !== null && fs10.statSync(resolvedPath).isFile();
     });
   } catch {
     return false;
@@ -4095,14 +4633,14 @@ function isPersonaMemDatasetComplete(datasetPath) {
 }
 function hasDatasetFile(datasetPath, relativePath) {
   try {
-    return fs7.statSync(path11.join(datasetPath, relativePath)).isFile();
+    return fs10.statSync(path12.join(datasetPath, relativePath)).isFile();
   } catch {
     return false;
   }
 }
 function hasMemoryAgentBenchEntityMapping(datasetPath) {
-  const absoluteDatasetPath = path11.resolve(datasetPath);
-  const roots = [absoluteDatasetPath, path11.dirname(absoluteDatasetPath)];
+  const absoluteDatasetPath = path12.resolve(datasetPath);
+  const roots = [absoluteDatasetPath, path12.dirname(absoluteDatasetPath)];
   return hasDatasetFile(absoluteDatasetPath, "entity2id.json") || roots.some(
     (root) => MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES.filter((relativePath) => relativePath !== "entity2id.json").some((relativePath) => hasDatasetFile(root, relativePath))
   );
@@ -4113,12 +4651,12 @@ function memoryAgentBenchDatasetHasRecSysSamples(datasetPath) {
     ...MEMORY_AGENT_BENCH_SPLIT_FILENAMES
   ];
   return candidateFilenames.some((filename) => {
-    const filePath = path11.join(datasetPath, filename);
+    const filePath = path12.join(datasetPath, filename);
     try {
-      if (!fs7.statSync(filePath).isFile()) {
+      if (!fs10.statSync(filePath).isFile()) {
         return false;
       }
-      const raw = fs7.readFileSync(filePath, "utf8");
+      const raw = fs10.readFileSync(filePath, "utf8");
       return /"source"\s*:\s*"recsys[_-]/i.test(raw);
     } catch {
       return false;
@@ -4134,7 +4672,7 @@ function isMemoryAgentBenchDatasetComplete(datasetPath) {
 function isDatasetDownloaded(datasetPath, benchmarkId) {
   let stats;
   try {
-    stats = fs7.statSync(datasetPath);
+    stats = fs10.statSync(datasetPath);
   } catch {
     return false;
   }
@@ -4144,7 +4682,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   const marker = DOWNLOADED_DATASET_MARKERS[benchmarkId];
   if (!marker) {
     try {
-      return fs7.readdirSync(datasetPath).length > 0;
+      return fs10.readdirSync(datasetPath).length > 0;
     } catch {
       return false;
     }
@@ -4152,7 +4690,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.allOf) {
     const hasAllRequiredFiles = marker.allOf.every((name) => {
       try {
-        return fs7.statSync(path11.join(datasetPath, name)).isFile();
+        return fs10.statSync(path12.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -4164,7 +4702,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.anyOf) {
     const hasMarkerFile = marker.anyOf.some((name) => {
       try {
-        return fs7.statSync(path11.join(datasetPath, name)).isFile();
+        return fs10.statSync(path12.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -4182,7 +4720,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   }
   if (marker.ext) {
     try {
-      return fs7.readdirSync(datasetPath).some(
+      return fs10.readdirSync(datasetPath).some(
         (name) => name.endsWith(marker.ext) && !marker.exclude?.includes(name)
       );
     } catch {
@@ -4192,9 +4730,9 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   return false;
 }
 async function launchBenchUi(resultsDir) {
-  const benchUiDir = path11.join(CLI_REPO_ROOT, "packages", "bench-ui");
+  const benchUiDir = path12.join(CLI_REPO_ROOT, "packages", "bench-ui");
   const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
-  if (!fs7.existsSync(path11.join(benchUiDir, "package.json"))) {
+  if (!fs10.existsSync(path12.join(benchUiDir, "package.json"))) {
     console.error("ERROR: @remnic/bench-ui is not available in this checkout.");
     process.exit(1);
   }
@@ -4221,24 +4759,24 @@ async function launchBenchUi(resultsDir) {
   });
 }
 function resolveRepoDatasetRoot() {
-  const repoCandidate = path11.join(CLI_REPO_ROOT, "evals", "datasets");
+  const repoCandidate = path12.join(CLI_REPO_ROOT, "evals", "datasets");
   if (isRepoCheckout()) {
     return repoCandidate;
   }
-  return path11.join(resolveHomeDir(), ".remnic", "bench", "datasets");
+  return path12.join(resolveHomeDir(), ".remnic", "bench", "datasets");
 }
 function listDownloadableBenchmarks() {
   return [...DOWNLOADABLE_BENCHMARK_DATASETS];
 }
 function resolveDatasetDownloadScriptPath() {
-  const bundled = path11.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
-  if (fs7.existsSync(bundled)) {
+  const bundled = path12.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
+  if (fs10.existsSync(bundled)) {
     return bundled;
   }
-  return path11.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
+  return path12.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
 }
 function isRepoCheckout() {
-  return fs7.existsSync(path11.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs7.existsSync(path11.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
+  return fs10.existsSync(path12.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs10.existsSync(path12.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
 }
 function runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, jsonMode) {
   const stdio = jsonMode ? ["inherit", process.stderr, "inherit"] : "inherit";
@@ -4289,7 +4827,7 @@ function resolveBenchDatasetDir(benchmarkId, quick, datasetDirOverride) {
   if (quick) {
     return void 0;
   }
-  const datasetDir = path11.join(resolveRepoDatasetRoot(), benchmarkId);
+  const datasetDir = path12.join(resolveRepoDatasetRoot(), benchmarkId);
   if (isDatasetDownloaded(datasetDir, benchmarkId)) {
     return datasetDir;
   }
@@ -4607,13 +5145,13 @@ async function exportBenchPackageResult(parsed) {
     process.exit(1);
   }
   const result = await loadBenchmarkResult(summary.path);
-  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path11.dirname(summary.path), result.meta.id) : void 0;
+  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path12.dirname(summary.path), result.meta.id) : void 0;
   const rendered = renderBenchmarkResultExport(result, parsed.format, {
     ...reportCardProvenance ? { reportCardProvenance } : {}
   });
   if (parsed.output) {
-    fs7.mkdirSync(path11.dirname(parsed.output), { recursive: true });
-    fs7.writeFileSync(parsed.output, rendered);
+    fs10.mkdirSync(path12.dirname(parsed.output), { recursive: true });
+    fs10.writeFileSync(parsed.output, rendered);
     console.log(`Exported ${summary.id} as ${parsed.format} to ${parsed.output}`);
     return;
   }
@@ -4630,7 +5168,7 @@ async function manageBenchDatasets(parsed) {
       process.exit(1);
     }
     const status = supported.map((benchmarkId) => {
-      const datasetPath = path11.join(datasetRoot, benchmarkId);
+      const datasetPath = path12.join(datasetRoot, benchmarkId);
       return {
         benchmark: benchmarkId,
         downloaded: isDatasetDownloaded(datasetPath, benchmarkId),
@@ -4658,7 +5196,7 @@ async function manageBenchDatasets(parsed) {
     process.exit(1);
   }
   const scriptPath = resolveDatasetDownloadScriptPath();
-  if (!fs7.existsSync(scriptPath)) {
+  if (!fs10.existsSync(scriptPath)) {
     console.error(`ERROR: dataset download script not found: ${scriptPath}`);
     process.exit(1);
   }
@@ -4668,7 +5206,7 @@ async function manageBenchDatasets(parsed) {
     runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, parsed.json === true);
     downloaded.push({
       benchmark: benchmarkId,
-      path: path11.join(datasetRoot, benchmarkId)
+      path: path12.join(datasetRoot, benchmarkId)
     });
   }
   if (parsed.json) {
@@ -4807,10 +5345,10 @@ async function calibrateBenchJudges(parsed, rawArgs) {
   }
   const bench = await loadBenchModule();
   const resultsDir = expandTilde(
-    parsed.resultsDir ?? path11.join(resolveHomeDir(), ".remnic", "bench", "results")
+    parsed.resultsDir ?? path12.join(resolveHomeDir(), ".remnic", "bench", "results")
   );
   const calibrationDir = expandTilde(
-    parsed.calibrationDir ?? path11.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    parsed.calibrationDir ?? path12.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const stored = await bench.listBenchmarkResults(resultsDir);
   const allForBenchmark = stored.filter((entry) => entry.benchmark === benchmarkId);
@@ -4858,7 +5396,7 @@ async function calibrateBenchJudges(parsed, rawArgs) {
     );
     process.exit(1);
   }
-  const sourceResultSha256 = createHash("sha256").update(fs7.readFileSync(latest.path)).digest("hex");
+  const sourceResultSha256 = createHash2("sha256").update(fs10.readFileSync(latest.path)).digest("hex");
   const expandedManifestPath = expandTilde(manifestPath);
   if (!bench.resolveLocalLabJudgeProviderConfig) {
     console.error(
@@ -5266,7 +5804,7 @@ function loadPinnedLoCoMoTaskSelector(parsed) {
   }
   let decoded;
   try {
-    decoded = JSON.parse(fs7.readFileSync(parsed.taskIdsFile, "utf8"));
+    decoded = JSON.parse(fs10.readFileSync(parsed.taskIdsFile, "utf8"));
   } catch (error) {
     throw new Error(
       `Unable to read --task-ids-file ${parsed.taskIdsFile}: ${error instanceof Error ? error.message : String(error)}`
@@ -5362,8 +5900,8 @@ async function loadPublishedPromotionHelpers() {
   const benchModule = await loadBenchModule();
   return {
     async promoteArtifactsToPublished(args) {
-      const { mkdirSync, readFileSync: readFileSync3, writeFileSync } = await import("fs");
-      const path12 = await import("path");
+      const { mkdirSync, readFileSync: readFileSync4, writeFileSync } = await import("fs");
+      const path13 = await import("path");
       mkdirSync(args.publishedOutDir, { recursive: true });
       if (args.artifactPaths.length === 0) {
         console.warn(
@@ -5372,7 +5910,7 @@ async function loadPublishedPromotionHelpers() {
         return;
       }
       for (const artifactPath of args.artifactPaths) {
-        const raw = readFileSync3(artifactPath, "utf8");
+        const raw = readFileSync4(artifactPath, "utf8");
         const parsedUnknown = JSON.parse(raw);
         const parsedObj = parsedUnknown !== null && typeof parsedUnknown === "object" && !Array.isArray(parsedUnknown) ? parsedUnknown : {};
         const gitShaShort = (parsedObj.meta?.gitSha ?? "unknown").slice(0, 7);
@@ -5380,13 +5918,13 @@ async function loadPublishedPromotionHelpers() {
         const modelSlug = args.model.replace(/[^a-zA-Z0-9_.-]/g, "-");
         const rawProfile = parsedObj.config?.runtimeProfile;
         const profileSlug = typeof rawProfile === "string" && rawProfile.length > 0 ? `-${rawProfile.replace(/[^a-zA-Z0-9_.-]/g, "-")}` : "";
-        const target = path12.join(
+        const target = path13.join(
           args.publishedOutDir,
           `${today}-${args.benchmarkId}-${modelSlug}${profileSlug}-${gitShaShort}.json`
         );
         writeFileSync(target, raw, "utf8");
         console.log(
-          `[bench published] Promoted ${path12.basename(artifactPath)} \u2192 ${target}`
+          `[bench published] Promoted ${path13.basename(artifactPath)} \u2192 ${target}`
         );
       }
       void benchModule;
@@ -5471,7 +6009,7 @@ async function runBenchViaPackage(parsed, benchmarkId, runtimeProfile, benchStat
   const previousCodexDiagnosticsDir = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV];
   const previousCodexDiagnosticsMode = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_MODE_ENV];
   if (!previousCodexDiagnosticsDir) {
-    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path11.join(
+    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path12.join(
       outputDir,
       "codex-cli-diagnostics"
     );
@@ -5609,7 +6147,7 @@ async function preparePersistedJudgeCalibrationAttachment(benchModule, benchmark
     );
   }
   const calibrationDir = expandTilde(
-    calibrationBinding.calibrationDir ?? path11.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    calibrationBinding.calibrationDir ?? path12.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const state = await benchModule.loadJudgeCalibrationState?.(benchmarkId, calibrationDir);
   if (!state) {
@@ -5683,7 +6221,7 @@ function attachPreparedJudgeCalibration(result, judgeCalibration) {
 function hashCalibrationProviderConfig(config) {
   const canonicalize = (value, key = "") => {
     if (typeof value === "string" && /(?:api.?key|authorization|token|secret)/i.test(key)) {
-      return { secretSha256: createHash("sha256").update(value).digest("hex") };
+      return { secretSha256: createHash2("sha256").update(value).digest("hex") };
     }
     if (Array.isArray(value)) return value.map((item) => canonicalize(item));
     if (value && typeof value === "object") {
@@ -5694,7 +6232,7 @@ function hashCalibrationProviderConfig(config) {
     }
     return value;
   };
-  return createHash("sha256").update(JSON.stringify(canonicalize(config))).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(canonicalize(config))).digest("hex");
 }
 function restoreOptionalEnv(key, previousValue) {
   if (previousValue === void 0) {
@@ -5906,7 +6444,7 @@ function resolveBenchReproDatasetDir(datasetDir) {
     return void 0;
   }
   try {
-    return fs7.realpathSync(datasetDir);
+    return fs10.realpathSync(datasetDir);
   } catch {
     return datasetDir;
   }
@@ -5959,23 +6497,23 @@ async function writeBenchReproManifestForPackageRun(args) {
   }
 }
 function resolveConfigPath(cliPath) {
-  if (cliPath) return path11.resolve(expandTilde(cliPath));
+  if (cliPath) return path12.resolve(expandTilde(cliPath));
   const envPath = readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH");
-  if (envPath) return path11.resolve(expandTilde(envPath));
+  if (envPath) return path12.resolve(expandTilde(envPath));
   const candidates = [
-    path11.join(process.cwd(), "remnic.config.json"),
-    path11.join(process.cwd(), "engram.config.json"),
-    path11.join(resolveHomeDir(), ".config", "remnic", "config.json"),
-    path11.join(resolveHomeDir(), ".config", "engram", "config.json")
+    path12.join(process.cwd(), "remnic.config.json"),
+    path12.join(process.cwd(), "engram.config.json"),
+    path12.join(resolveHomeDir(), ".config", "remnic", "config.json"),
+    path12.join(resolveHomeDir(), ".config", "engram", "config.json")
   ];
   for (const candidate of candidates) {
-    if (fs7.existsSync(candidate)) return candidate;
+    if (fs10.existsSync(candidate)) return candidate;
   }
-  return path11.join(resolveHomeDir(), ".config", "remnic", "config.json");
+  return path12.join(resolveHomeDir(), ".config", "remnic", "config.json");
 }
 function resolveExistingBenchRemnicConfigPath(cliPath) {
   const configPath = resolveConfigPath(cliPath);
-  if (fs7.existsSync(configPath)) {
+  if (fs10.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -5985,7 +6523,7 @@ function resolveExistingBenchRemnicConfigPath(cliPath) {
 }
 function resolveExistingBenchOpenclawConfigPath(cliPath) {
   const configPath = resolveOpenclawConfigPath(cliPath);
-  if (fs7.existsSync(configPath)) {
+  if (fs10.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -6085,34 +6623,34 @@ async function resolvePackageBenchRuntime(benchModule, parsed, runtimeProfile) {
   );
 }
 function normalizeMemoryDirPath(memoryDir) {
-  return path11.resolve(expandTilde(memoryDir));
+  return path12.resolve(expandTilde(memoryDir));
 }
 function resolveMemoryDir() {
   const configMemoryDir = (() => {
     const envMemoryDir = readCompatEnv("REMNIC_MEMORY_DIR", "ENGRAM_MEMORY_DIR");
     if (envMemoryDir) return normalizeMemoryDirPath(envMemoryDir);
     const configPath = resolveConfigPath();
-    const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord(raw);
+    const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord3(raw);
     if (typeof remnicCfg.memoryDir === "string" && remnicCfg.memoryDir.length > 0) {
       return normalizeMemoryDirPath(remnicCfg.memoryDir);
     }
     const home = resolveHomeDir();
-    const standalonePath = path11.join(home, ".remnic", "memory");
-    const legacyStandalonePath = path11.join(home, ".engram", "memory");
-    const openclawPath = path11.join(home, ".openclaw", "workspace", "memory", "local");
-    if (fs7.existsSync(standalonePath)) return standalonePath;
-    if (fs7.existsSync(legacyStandalonePath)) return legacyStandalonePath;
+    const standalonePath = path12.join(home, ".remnic", "memory");
+    const legacyStandalonePath = path12.join(home, ".engram", "memory");
+    const openclawPath = path12.join(home, ".openclaw", "workspace", "memory", "local");
+    if (fs10.existsSync(standalonePath)) return standalonePath;
+    if (fs10.existsSync(legacyStandalonePath)) return legacyStandalonePath;
     return openclawPath;
   })();
   const manifestPath = getManifestPath();
-  if (fs7.existsSync(manifestPath)) {
+  if (fs10.existsSync(manifestPath)) {
     try {
       const active = getActiveSpace();
       if (active?.memoryDir) {
         const activeMemoryDir = normalizeMemoryDirPath(active.memoryDir);
-        if (!fs7.existsSync(activeMemoryDir)) {
-          fs7.mkdirSync(activeMemoryDir, { recursive: true });
+        if (!fs10.existsSync(activeMemoryDir)) {
+          fs10.mkdirSync(activeMemoryDir, { recursive: true });
         }
         return activeMemoryDir;
       }
@@ -6151,20 +6689,20 @@ var REMNIC_OPENCLAW_LEGACY_PLUGIN_ID = "openclaw-engram";
 var DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR = [
   process.env.OPENCLAW_CONFIG_PATH,
   process.env.OPENCLAW_ENGRAM_CONFIG_PATH,
-  path11.join(resolveHomeDir(), ".openclaw", "openclaw.json")
+  path12.join(resolveHomeDir(), ".openclaw", "openclaw.json")
 ].filter(Boolean);
 function resolveOpenclawConfigPath(cliPath) {
-  if (cliPath) return path11.resolve(expandTilde(cliPath));
+  if (cliPath) return path12.resolve(expandTilde(cliPath));
   const envPath = process.env.OPENCLAW_CONFIG_PATH || process.env.OPENCLAW_ENGRAM_CONFIG_PATH;
-  if (envPath) return path11.resolve(expandTilde(envPath));
+  if (envPath) return path12.resolve(expandTilde(envPath));
   for (const candidate of DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR) {
-    if (fs7.existsSync(candidate)) return candidate;
+    if (fs10.existsSync(candidate)) return candidate;
   }
-  return path11.join(resolveHomeDir(), ".openclaw", "openclaw.json");
+  return path12.join(resolveHomeDir(), ".openclaw", "openclaw.json");
 }
 function readOpenclawConfig(configPath) {
-  if (!fs7.existsSync(configPath)) return {};
-  const raw = fs7.readFileSync(configPath, "utf-8");
+  if (!fs10.existsSync(configPath)) return {};
+  const raw = fs10.readFileSync(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -6219,10 +6757,10 @@ function buildRemnicOpenclawHooksPolicy(legacyHooks, existingHooks) {
 function resolveOpenclawInstallMemoryDir(args) {
   const existingMemoryDir = (typeof args.existingNewEntryConfig.memoryDir === "string" ? args.existingNewEntryConfig.memoryDir : void 0) || (args.migrateLegacy && typeof args.legacyConfigToMerge.memoryDir === "string" ? args.legacyConfigToMerge.memoryDir : void 0);
   if (args.requestedMemoryDir) {
-    return path11.resolve(expandTilde(args.requestedMemoryDir));
+    return path12.resolve(expandTilde(args.requestedMemoryDir));
   }
   if (existingMemoryDir) {
-    return path11.resolve(expandTilde(existingMemoryDir));
+    return path12.resolve(expandTilde(existingMemoryDir));
   }
   return args.fallbackMemoryDir;
 }
@@ -6240,18 +6778,18 @@ function resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir) {
     if (!config || typeof config !== "object" || Array.isArray(config)) continue;
     const memoryDir = config.memoryDir;
     if (typeof memoryDir === "string" && memoryDir.trim().length > 0) {
-      return path11.resolve(expandTilde(memoryDir));
+      return path12.resolve(expandTilde(memoryDir));
     }
   }
   return fallbackMemoryDir;
 }
 function resolveOpenclawPluginDir(cliPath) {
-  if (cliPath) return path11.resolve(expandTilde(cliPath));
-  return path11.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  if (cliPath) return path12.resolve(expandTilde(cliPath));
+  return path12.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
 }
 function resolveOpenclawLegacyPluginDir(cliPath) {
-  if (cliPath) return path11.resolve(expandTilde(cliPath));
-  return path11.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
+  if (cliPath) return path12.resolve(expandTilde(cliPath));
+  return path12.join(resolveHomeDir(), ".openclaw", "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
 }
 function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   const yyyy = now.getFullYear().toString();
@@ -6263,14 +6801,14 @@ function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   return `${yyyy}${mm}${dd}-${hh}${min}${ss}`;
 }
 function backupPathIfPresent(sourcePath, backupPath) {
-  if (!fs7.existsSync(sourcePath)) return false;
-  fs7.mkdirSync(path11.dirname(backupPath), { recursive: true });
-  fs7.cpSync(sourcePath, backupPath, { recursive: true });
+  if (!fs10.existsSync(sourcePath)) return false;
+  fs10.mkdirSync(path12.dirname(backupPath), { recursive: true });
+  fs10.cpSync(sourcePath, backupPath, { recursive: true });
   return true;
 }
 function assertDirectoryPathOrMissing(targetPath, label) {
-  if (!fs7.existsSync(targetPath)) return;
-  const stat = fs7.statSync(targetPath);
+  if (!fs10.existsSync(targetPath)) return;
+  const stat = fs10.statSync(targetPath);
   if (!stat.isDirectory()) {
     throw new Error(`${label} must be a directory when it already exists: ${targetPath}`);
   }
@@ -6295,7 +6833,7 @@ var PublishedOpenclawPluginInstallError = class extends Error {
   }
 };
 function installPublishedOpenclawPlugin(spec, pluginDir) {
-  const tempRoot = fs7.mkdtempSync(path11.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
+  const tempRoot = fs10.mkdtempSync(path12.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
   const stagedDir = `${pluginDir}.next-${process.pid}-${Date.now()}`;
   const rollbackDir = `${pluginDir}.rollback-${process.pid}-${Date.now()}`;
   let swapRollbackDir;
@@ -6310,17 +6848,17 @@ function installPublishedOpenclawPlugin(spec, pluginDir) {
     if (!tarballName) {
       throw new Error(`npm pack ${spec} did not return a tarball name`);
     }
-    const unpackDir = path11.join(tempRoot, "unpacked");
-    fs7.mkdirSync(unpackDir, { recursive: true });
-    childProcess2.execFileSync("tar", ["-xzf", path11.join(tempRoot, tarballName), "-C", unpackDir], {
+    const unpackDir = path12.join(tempRoot, "unpacked");
+    fs10.mkdirSync(unpackDir, { recursive: true });
+    childProcess2.execFileSync("tar", ["-xzf", path12.join(tempRoot, tarballName), "-C", unpackDir], {
       stdio: ["ignore", "pipe", "pipe"]
     });
-    const packagedDir = path11.join(unpackDir, "package");
-    if (!fs7.existsSync(packagedDir)) {
+    const packagedDir = path12.join(unpackDir, "package");
+    if (!fs10.existsSync(packagedDir)) {
       throw new Error(`npm pack ${spec} did not contain a package/ directory`);
     }
-    fs7.rmSync(stagedDir, { recursive: true, force: true });
-    fs7.cpSync(packagedDir, stagedDir, { recursive: true });
+    fs10.rmSync(stagedDir, { recursive: true, force: true });
+    fs10.cpSync(packagedDir, stagedDir, { recursive: true });
     childProcess2.execFileSync("npm", ["install", "--omit=dev"], {
       cwd: stagedDir,
       stdio: ["ignore", "pipe", "pipe"]
@@ -6335,8 +6873,8 @@ function installPublishedOpenclawPlugin(spec, pluginDir) {
       }
     })();
     swapRollbackDir = swapResult.rollbackDir;
-    const installedPackageJsonPath = path11.join(pluginDir, "package.json");
-    const installedPackage = fs7.existsSync(installedPackageJsonPath) ? JSON.parse(fs7.readFileSync(installedPackageJsonPath, "utf8")) : {};
+    const installedPackageJsonPath = path12.join(pluginDir, "package.json");
+    const installedPackage = fs10.existsSync(installedPackageJsonPath) ? JSON.parse(fs10.readFileSync(installedPackageJsonPath, "utf8")) : {};
     return {
       rollbackDir: swapRollbackDir,
       version: typeof installedPackage.version === "string" ? installedPackage.version : void 0
@@ -6351,8 +6889,8 @@ function installPublishedOpenclawPlugin(spec, pluginDir) {
       }
     );
   } finally {
-    fs7.rmSync(stagedDir, { recursive: true, force: true });
-    fs7.rmSync(tempRoot, { recursive: true, force: true });
+    fs10.rmSync(stagedDir, { recursive: true, force: true });
+    fs10.rmSync(tempRoot, { recursive: true, force: true });
   }
 }
 function restartOpenclawGateway() {
@@ -6370,15 +6908,15 @@ function restartOpenclawGateway() {
   });
 }
 function cmdInit() {
-  const configPath = path11.join(process.cwd(), "remnic.config.json");
-  if (fs7.existsSync(configPath)) {
+  const configPath = path12.join(process.cwd(), "remnic.config.json");
+  if (fs10.existsSync(configPath)) {
     console.log(`Config already exists: ${configPath}`);
     return;
   }
   const template = {
     remnic: {
       openaiApiKey: "${OPENAI_API_KEY}",
-      memoryDir: path11.join(process.cwd(), ".remnic", "memory"),
+      memoryDir: path12.join(process.cwd(), ".remnic", "memory"),
       memoryOsPreset: "balanced"
     },
     server: {
@@ -6387,7 +6925,7 @@ function cmdInit() {
       authToken: "${REMNIC_AUTH_TOKEN}"
     }
   };
-  fs7.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
+  fs10.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
   console.log(`Created ${configPath}`);
   console.log("\nSet these environment variables:");
   console.log("  export OPENAI_API_KEY=sk-...");
@@ -6396,6 +6934,18 @@ function cmdInit() {
   console.log("\nThen start the server:");
   console.log("  npx --package @remnic/server remnic-server");
 }
+function resolveStatusProbeToken() {
+  const operatorToken = oauthResolveOperatorToken();
+  if (operatorToken) return operatorToken;
+  try {
+    const usable = listTokens().find(
+      (t) => t.connector !== "chatgpt" && typeof t.token === "string" && t.token.length > 0
+    );
+    if (usable) return usable.token;
+  } catch {
+  }
+}
+var __statusHealthTestHooks = { resolveStatusProbeToken };
 async function cmdStatus(json) {
   const { running, pid } = isServiceRunning();
   if (json) {
@@ -6408,18 +6958,34 @@ async function cmdStatus(json) {
   }
   console.log(`Remnic server: running${pid ? ` (pid ${pid})` : ""}`);
   const port = inferPort();
+  const probeToken = resolveStatusProbeToken();
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 3e3);
   try {
     const response = await fetch(`http://127.0.0.1:${port}/engram/v1/health`, {
-      signal: controller.signal
+      signal: controller.signal,
+      ...probeToken ? { headers: { Authorization: `Bearer ${probeToken}` } } : {}
     });
     if (!response.ok) {
-      console.log(`Health: server responded with ${response.status} ${response.statusText}`);
+      const hint = response.status === 401 && !probeToken ? " (daemon requires auth and no local token was found \u2014 set REMNIC_AUTH_TOKEN, configure server.authToken, or run 'remnic token generate')" : response.status === 401 ? " (local token rejected by the daemon)" : "";
+      console.log(`Health: server responded with ${response.status} ${response.statusText}${hint}`);
     } else {
       const health = await response.json();
       const status = typeof health.status === "string" ? health.status : "ok";
       console.log(`Health: ${status}`);
+      const qmd = health.qmd;
+      if (qmd?.pendingEmbeddings != null) {
+        console.log(`  Pending embeddings: ${qmd.pendingEmbeddings}`);
+        if (qmd.oldestPendingAgeMs != null) {
+          console.log(`  Oldest pending: ${Math.round(qmd.oldestPendingAgeMs / 6e4)}m`);
+        }
+        if (qmd.embeddingBacklogThreshold != null) {
+          console.log(`  Backlog threshold: ${qmd.embeddingBacklogThreshold}`);
+        }
+      }
+      if (qmd?.degradedReason) {
+        console.log(`  Degraded: ${qmd.degradedReason}`);
+      }
     }
   } catch {
     console.log("Health: unable to reach server");
@@ -6429,7 +6995,7 @@ async function cmdStatus(json) {
 }
 function oauthReadConfigRecord(configPath) {
   try {
-    const parsed = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs10.readFileSync(configPath, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -6480,14 +7046,14 @@ function oauthResolveOperatorToken() {
     const server = raw.server;
     if (server && typeof server === "object" && "authToken" in server) {
       const candidate = server.authToken;
-      if (typeof candidate === "string" && candidate.length > 0) {
+      if (typeof candidate === "string" && candidate.length > 0 && !candidate.includes("${")) {
         return candidate;
       }
     }
   }
   return void 0;
 }
-async function oauthFetch(method, path12, token, body) {
+async function oauthFetch(method, path13, token, body) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 5e3);
   try {
@@ -6506,7 +7072,7 @@ async function oauthFetch(method, path12, token, body) {
     if (body !== void 0) {
       init.body = JSON.stringify(body);
     }
-    const response = await fetch(`${oauthResolveBaseUrl()}${path12}`, init);
+    const response = await fetch(`${oauthResolveBaseUrl()}${path13}`, init);
     if (response.status === 401) {
       throw new Error(
         "operator token rejected by remnic-server (HTTP 401). Update `server.authToken` or `REMNIC_AUTH_TOKEN` to match the running daemon."
@@ -6843,14 +7409,14 @@ async function cmdQuery(queryText, json, explain) {
     console.error("Usage: remnic query <text>");
     process.exit(1);
   }
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
-  const orchestrator = new Orchestrator(config);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
+  const orchestrator = new Orchestrator2(config);
   await orchestrator.initialize();
-  const service = new EngramAccessService(orchestrator);
+  const service = new EngramAccessService2(orchestrator);
   const recallRequest = buildQueryRecallRequest(queryText);
   try {
     if (explain) {
@@ -7014,15 +7580,15 @@ async function runXrayCommand(rest, io) {
 async function cmdXray(rest) {
   const { rawQuery, options } = extractXrayRawArgs(rest);
   parseXrayCliOptions(rawQuery, options);
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
-  const orchestrator = new Orchestrator(config);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
+  const orchestrator = new Orchestrator2(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
-  const service = new EngramAccessService(orchestrator);
+  const service = new EngramAccessService2(orchestrator);
   try {
     await runXrayCommand(rest, {
       recallXray: (request) => service.recallXray(request),
@@ -7037,11 +7603,11 @@ async function cmdXray(rest) {
   }
 }
 async function cmdVersions(rest) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   if (!config.versioningEnabled) {
     console.error("Page versioning is disabled (versioningEnabled = false).");
     process.exit(1);
@@ -7061,7 +7627,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions list <page-path>");
         process.exit(1);
       }
-      const absPath = path11.resolve(pagePath);
+      const absPath = path12.resolve(pagePath);
       const history = await listVersions(absPath, versioningConfig, memDir);
       if (json) {
         console.log(JSON.stringify(history, null, 2));
@@ -7086,7 +7652,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions show <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path11.resolve(pagePath);
+      const absPath = path12.resolve(pagePath);
       try {
         const content = await getVersion(absPath, versionId, versioningConfig, memDir);
         console.log(content);
@@ -7104,7 +7670,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions diff <page-path> <v1> <v2>");
         process.exit(1);
       }
-      const absPath = path11.resolve(pagePath);
+      const absPath = path12.resolve(pagePath);
       try {
         const diffOutput = await diffVersions(absPath, v1, v2, versioningConfig, memDir);
         console.log(diffOutput);
@@ -7121,7 +7687,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions revert <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path11.resolve(pagePath);
+      const absPath = path12.resolve(pagePath);
       try {
         const version = await revertToVersion(absPath, versionId, versioningConfig, void 0, memDir);
         if (json) {
@@ -7153,15 +7719,15 @@ Options:
   }
 }
 async function cmdEnrich(rest) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   const subcommand = rest[0];
   if (subcommand === "audit") {
     const memoryDir2 = expandTilde(config.memoryDir);
-    const auditDir2 = path11.join(memoryDir2, "enrichment");
+    const auditDir2 = path12.join(memoryDir2, "enrichment");
     const sinceFlag = resolveFlag(rest.slice(1), "--since");
     const entries = await readAuditLog(auditDir2, sinceFlag ?? void 0);
     if (entries.length === 0) {
@@ -7185,7 +7751,7 @@ async function cmdEnrich(rest) {
     pipelineConfig2.providers = [
       { id: "web-search", enabled: true, costTier: "cheap" }
     ];
-    const orchestrator2 = new Orchestrator(config);
+    const orchestrator2 = new Orchestrator2(config);
     await orchestrator2.initialize();
     await orchestrator2.deferredReady;
     const searchBackend2 = orchestrator2.qmd;
@@ -7221,7 +7787,7 @@ Registered providers:`);
     console.error("Usage: remnic enrich <entity-name> | --all | --dry-run | audit | providers");
     process.exit(1);
   }
-  const orchestrator = new Orchestrator(config);
+  const orchestrator = new Orchestrator2(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const storage = await orchestrator.getStorage(config.defaultNamespace);
@@ -7286,18 +7852,13 @@ Registered providers:`);
     return;
   }
   const memoryDir = expandTilde(config.memoryDir);
-  const auditDir = path11.join(memoryDir, "enrichment");
+  const auditDir = path12.join(memoryDir, "enrichment");
   let totalPersisted = 0;
   for (const result of results) {
     for (const candidate of result.acceptedCandidates) {
       let persisted = false;
       try {
-        await storage.writeMemory(candidate.category, candidate.text, {
-          confidence: candidate.confidence,
-          tags: [...candidate.tags ?? [], "enrichment", candidate.source],
-          entityRef: result.entityName,
-          source: `enrichment:${candidate.source}`
-        });
+        await persistEnrichmentCandidate(storage, result.entityName, candidate);
         persisted = true;
         totalPersisted++;
       } catch (err) {
@@ -7352,7 +7913,7 @@ Registered providers:`);
   }
 }
 async function cmdProcedural(rest) {
-  initLogger();
+  initLogger2();
   const subcommand = rest[0];
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
     console.log(`remnic procedural \u2014 Procedural memory operations (issue #567)
@@ -7405,13 +7966,13 @@ Shared with:
     process.exit(1);
   }
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   const memoryDir = expandTilde(
     typeof memoryDirOverride === "string" && memoryDirOverride.length > 0 ? memoryDirOverride : config.memoryDir ?? resolveMemoryDir()
   );
-  const storage = new StorageManager(memoryDir);
+  const storage = new StorageManager2(memoryDir);
   const report = await computeProcedureStats({ storage, config });
   if (format === "json") {
     process.stdout.write(JSON.stringify(report, null, 2) + "\n");
@@ -7420,11 +7981,11 @@ Shared with:
   process.stdout.write(formatProcedureStatsText(report));
 }
 async function cmdExtensions(action, rest) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   const root = resolveExtensionsRoot(config);
   const noopLog = { warn: () => {
   }, debug: () => {
@@ -7473,7 +8034,7 @@ Root: ${root}`);
       const extensions = await discoverMemoryExtensions(root, warnLog);
       let entries = [];
       try {
-        entries = fs7.readdirSync(root);
+        entries = fs10.readdirSync(root);
       } catch {
         console.log(`Extensions root does not exist: ${root}`);
         process.exitCode = 0;
@@ -7482,9 +8043,9 @@ Root: ${root}`);
       const validNames = new Set(extensions.map((e) => e.name));
       let errors = 0;
       for (const entry of entries) {
-        const entryPath = path11.join(root, entry);
+        const entryPath = path12.join(root, entry);
         try {
-          if (!fs7.statSync(entryPath).isDirectory()) continue;
+          if (!fs10.statSync(entryPath).isDirectory()) continue;
         } catch {
           continue;
         }
@@ -7514,11 +8075,11 @@ Root: ${root}`);
   }
 }
 async function cmdBriefing(rest) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   if (!config.briefing.enabled) {
     console.error("Briefing is disabled in config (briefing.enabled = false).");
     process.exit(1);
@@ -7571,7 +8132,7 @@ async function cmdBriefing(rest) {
     process.exit(1);
   }
   const format = effectiveFormatFlag === "json" ? "json" : effectiveFormatFlag === "markdown" ? "markdown" : config.briefing.defaultFormat;
-  const orchestrator = new Orchestrator(config);
+  const orchestrator = new Orchestrator2(config);
   await orchestrator.initialize();
   const storage = await orchestrator.getStorage(config.defaultNamespace);
   const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
@@ -7596,10 +8157,10 @@ async function cmdBriefing(rest) {
   if (save) {
     try {
       const saveDir = resolveBriefingSaveDir(config.briefing.saveDir);
-      fs7.mkdirSync(saveDir, { recursive: true });
+      fs10.mkdirSync(saveDir, { recursive: true });
       const filename = briefingFilename(new Date(result.window.to), format);
-      const filePath = path11.join(saveDir, filename);
-      fs7.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
+      const filePath = path12.join(saveDir, filename);
+      fs10.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
       console.error(`Saved briefing: ${filePath}`);
     } catch (err) {
       console.error(`Failed to save briefing: ${err instanceof Error ? err.message : String(err)}`);
@@ -7617,17 +8178,19 @@ async function cmdDoctor() {
     detail: `${nodeVersion} (requires >= 22.12.0)`
   });
   const configPath = resolveConfigPath();
-  const configExists = fs7.existsSync(configPath);
+  const configExists = fs10.existsSync(configPath);
   checks.push({ name: "Config file", ok: configExists, detail: configPath });
   let standaloneConfig;
   let standaloneConfigError;
   let standaloneOpenaiApiKeyExplicitlyFalse = false;
+  let configuredNs = { invalid: false };
   if (configExists) {
     try {
-      const raw = JSON.parse(fs7.readFileSync(configPath, "utf8"));
-      const remnicCfg = resolveRemnicConfigRecord(raw);
+      const raw = JSON.parse(fs10.readFileSync(configPath, "utf8"));
+      const remnicCfg = resolveRemnicConfigRecord3(raw);
       standaloneOpenaiApiKeyExplicitlyFalse = isOpenaiApiKeyDisabled(remnicCfg.openaiApiKey);
-      standaloneConfig = parseConfig(remnicCfg);
+      configuredNs = readConfiguredNamespace(remnicCfg);
+      standaloneConfig = parseConfig3(remnicCfg);
     } catch (err) {
       standaloneConfigError = err instanceof Error ? err.message : String(err);
     }
@@ -7636,16 +8199,39 @@ async function cmdDoctor() {
   try {
     memoryDir = resolveMemoryDir();
   } catch {
-    memoryDir = parseConfig({}).memoryDir;
+    memoryDir = parseConfig3({}).memoryDir;
   }
   try {
-    fs7.mkdirSync(memoryDir, { recursive: true });
+    fs10.mkdirSync(memoryDir, { recursive: true });
     checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
   } catch {
     checks.push({ name: "Memory directory", ok: false, detail: `cannot create ${memoryDir}` });
   }
+  try {
+    const quarantined = await new WriteQuarantineStore2(memoryDir).count();
+    checks.push({
+      name: "Quarantined writes",
+      ok: quarantined === 0,
+      warn: quarantined > 0,
+      detail: quarantined === 0 ? "none" : `${quarantined} parked`,
+      remediation: quarantined > 0 ? "Inspect with `remnic quarantine list`, then fix the client's namespace config so writes are stored instead of parked." : void 0
+    });
+  } catch {
+    checks.push({
+      name: "Quarantined writes",
+      ok: false,
+      warn: true,
+      detail: "unable to inspect quarantine store"
+    });
+  }
+  const nsPolicyCheck = buildNamespacePolicyCheck({
+    invalid: configuredNs.invalid,
+    configuredNamespace: configuredNs.configuredNamespace,
+    config: standaloneConfig
+  });
+  if (nsPolicyCheck) checks.push(nsPolicyCheck);
   const openclawConfigPath = resolveOpenclawConfigPath();
-  const openclawConfigExists = fs7.existsSync(openclawConfigPath);
+  const openclawConfigExists = fs10.existsSync(openclawConfigPath);
   let openclawConfig = {};
   let openclawConfigValid = false;
   let openclawPluginModeConfigured = false;
@@ -7653,7 +8239,7 @@ async function cmdDoctor() {
   let activeOpenclawEntryConfig = null;
   if (openclawConfigExists) {
     try {
-      const parsed = JSON.parse(fs7.readFileSync(openclawConfigPath, "utf-8"));
+      const parsed = JSON.parse(fs10.readFileSync(openclawConfigPath, "utf-8"));
       if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
         openclawConfig = parsed;
         openclawConfigValid = true;
@@ -7729,13 +8315,13 @@ async function cmdDoctor() {
       const rawMemoryDir = entryConfig?.memoryDir;
       const configuredMemoryDir = typeof rawMemoryDir === "string" ? rawMemoryDir : void 0;
       if (configuredMemoryDir) {
-        const resolvedMemDir = path11.resolve(expandTilde(configuredMemoryDir));
+        const resolvedMemDir = path12.resolve(expandTilde(configuredMemoryDir));
         let memDirOk = false;
         let memDirDetail = `${resolvedMemDir} (not found)`;
         let memDirRemediation = `Run \`remnic openclaw install --memory-dir "${resolvedMemDir}"\` to create the directory.`;
-        if (fs7.existsSync(resolvedMemDir)) {
+        if (fs10.existsSync(resolvedMemDir)) {
           try {
-            const stat = fs7.statSync(resolvedMemDir);
+            const stat = fs10.statSync(resolvedMemDir);
             if (stat.isDirectory()) {
               memDirOk = true;
               memDirDetail = resolvedMemDir;
@@ -7877,12 +8463,12 @@ async function cmdDoctor() {
 }
 function cmdConfig() {
   const configPath = resolveConfigPath();
-  if (!fs7.existsSync(configPath)) {
+  if (!fs10.existsSync(configPath)) {
     console.log("No config file found. Run `remnic init` to create one.");
     return;
   }
   console.log(`Config: ${configPath}`);
-  const rawConfig = fs7.readFileSync(configPath, "utf8");
+  const rawConfig = fs10.readFileSync(configPath, "utf8");
   const redacted = rawConfig.replace(
     /("(?:openaiApiKey|localLlmApiKey|authToken|apiKey|remoteSearchApiKey|meilisearchApiKey|opikApiKey)"\s*:\s*")([^"]*)(")/g,
     "$1[REDACTED]$3"
@@ -7929,7 +8515,7 @@ async function cmdMigrate(json, rollback) {
   console.log(`  Rollback: ${result.rollbackCommand}`);
 }
 function cmdOnboard(dirPath, json) {
-  const directory = path11.resolve(dirPath || process.cwd());
+  const directory = path12.resolve(dirPath || process.cwd());
   const result = onboard({ directory });
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -7948,7 +8534,7 @@ Suggested namespace: ${result.plan.suggestedNamespace}`);
 async function cmdCurate(targetPath, json) {
   const memoryDir = resolveMemoryDir();
   const result = await curate({
-    targetPath: path11.resolve(targetPath),
+    targetPath: path12.resolve(targetPath),
     memoryDir,
     source: "curation",
     checkDuplicates: true,
@@ -7986,13 +8572,13 @@ async function cmdReview(action, rest) {
       console.error("Usage: remnic review <approve|dismiss|flag> <id>");
       process.exit(1);
     }
-    const storage = new StorageManager(memoryDir);
+    const storage = new StorageManager2(memoryDir);
     const configPath = resolveConfigPath();
     let tombstonesConfig = null;
     try {
-      const rawCfg = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-      const remnicCfg = resolveRemnicConfigRecord(rawCfg);
-      const config = parseConfig(remnicCfg);
+      const rawCfg = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+      const remnicCfg = resolveRemnicConfigRecord3(rawCfg);
+      const config = parseConfig3(remnicCfg);
       tombstonesConfig = {
         enabled: config.tombstonesEnabled,
         semanticMatch: config.tombstonesSemanticMatch,
@@ -8078,7 +8664,7 @@ async function cmdSync(action, rest, json) {
 }
 function localOfflineSourceId(memoryDir) {
   const host = os.hostname() || "unknown-host";
-  const dirHash = createHash("sha256").update(path11.resolve(memoryDir)).digest("hex").slice(0, 16);
+  const dirHash = createHash2("sha256").update(path12.resolve(memoryDir)).digest("hex").slice(0, 16);
   return `remnic-local:${host}:${dirHash}`;
 }
 function normalizeOfflineRemoteUrl(raw) {
@@ -8442,8 +9028,8 @@ var APPEND_TOLERANT_RUNTIME_STATE_FILES = /* @__PURE__ */ new Set([
 function isAppendTolerantOfflineRuntimeFile(relPath) {
   if (!shouldPreferIncomingOfflineRuntimeFile(relPath)) return false;
   const parts = relPath.split("/");
-  const basename = parts[parts.length - 1] ?? "";
-  return APPEND_TOLERANT_RUNTIME_STATE_FILES.has(basename);
+  const basename2 = parts[parts.length - 1] ?? "";
+  return APPEND_TOLERANT_RUNTIME_STATE_FILES.has(basename2);
 }
 function offlineFileContentChunkMatchesExpected(options) {
   const { chunk, expected, offset } = options;
@@ -8476,10 +9062,10 @@ var OFFLINE_SYNC_CONTENT_MISSING_RETRY_MAX = 3;
 var OFFLINE_SYNC_CONTENT_MISSING_RETRY_DELAY_MS = 250;
 var OfflineRemoteFileChangedError = class extends Error {
   path;
-  constructor(path12) {
-    super(`remote file changed while fetching offline content: ${path12}`);
+  constructor(path13) {
+    super(`remote file changed while fetching offline content: ${path13}`);
     this.name = "OfflineRemoteFileChangedError";
-    this.path = path12;
+    this.path = path13;
   }
 };
 function isOfflineRemoteFileChangedError(error) {
@@ -8670,15 +9256,15 @@ function offlineDirectPushFiles(options) {
   }).sort((left, right) => right.bytes - left.bytes || left.path.localeCompare(right.path));
 }
 function resolveOfflineDirectHydrationPath(memoryDir, relPath) {
-  const base = path11.resolve(memoryDir);
-  const target = path11.resolve(base, relPath);
-  const relative = path11.relative(base, target);
-  if (relative === "" || relative === ".." || relative.startsWith(`..${path11.sep}`) || path11.isAbsolute(relative)) {
+  const base = path12.resolve(memoryDir);
+  const target = path12.resolve(base, relPath);
+  const relative = path12.relative(base, target);
+  if (relative === "" || relative === ".." || relative.startsWith(`..${path12.sep}`) || path12.isAbsolute(relative)) {
     throw new Error(`offline sync direct hydration path escapes memory dir: ${relPath}`);
   }
   return target;
 }
-var OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES = OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES;
+var OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES = OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES2;
 async function pushOfflineFileContent(args) {
   if (args.readFileChunks) {
     return pushOfflineFileContentFromChunkReader(args);
@@ -8686,7 +9272,7 @@ async function pushOfflineFileContent(args) {
   let offset = 0;
   let finalResult = null;
   let remoteSatisfiedResult = null;
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   let bytes = 0;
   while (offset < args.file.bytes || args.file.bytes === 0 && offset === 0) {
     const chunk = await readOfflineSyncFileContentChunk({
@@ -8743,13 +9329,13 @@ async function pushOfflineFileContent(args) {
 }
 async function pushOfflineFileContentFromChunkReader(args) {
   const filePath = resolveOfflineDirectHydrationPath(args.memoryDir, args.file.path);
-  const stat = fs7.statSync(filePath);
+  const stat = fs10.statSync(filePath);
   if (stat.mtimeMs !== args.file.mtimeMs) {
     throw new Error(`local file changed while pushing offline content: ${args.file.path}`);
   }
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   const chunks = args.readFileChunks({
-    root: path11.resolve(args.memoryDir),
+    root: path12.resolve(args.memoryDir),
     path: args.file.path,
     filePath,
     chunkSize: OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES
@@ -9187,147 +9773,6 @@ function waitForOfflineInterval(ms, setCancel) {
     });
   });
 }
-async function createOfflineStorageIo(memoryDir) {
-  const storage = new StorageManager(memoryDir);
-  const header = await readHeader(memoryDir);
-  let secureStoreKey = null;
-  if (header) {
-    storage.setSecureStoreRequired(true);
-    const key = keyring.getKey(secureStoreDir(memoryDir));
-    if (key) {
-      storage.setSecureStoreKey(key);
-      secureStoreKey = key;
-    }
-  }
-  return {
-    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-    readFileDigest: async ({ filePath }) => {
-      const hash = createHash("sha256");
-      let bytes = 0;
-      for await (const rawChunk of readOfflineSyncFileChunks({
-        filePath,
-        memoryDir,
-        secureStoreKey,
-        chunkSize: OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES
-      })) {
-        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
-        hash.update(chunk);
-        bytes += chunk.length;
-      }
-      return {
-        sha256: hash.digest("hex"),
-        bytes
-      };
-    },
-    readFileChunks: ({ filePath, chunkSize }) => readOfflineSyncFileChunks({
-      filePath,
-      memoryDir,
-      secureStoreKey,
-      chunkSize
-    }),
-    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
-    writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
-    deleteFile: async ({ filePath }) => storage.deleteOfflineSyncFile(filePath)
-  };
-}
-async function* readOfflineSyncFileChunks(options) {
-  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE);
-  if (!isEncryptedFile(header)) {
-    yield* readPlainOfflineFileChunks(options.filePath, options.chunkSize);
-    return;
-  }
-  if (!options.secureStoreKey) {
-    throw new SecureStoreLockedError(
-      `secure-store is locked \u2014 cannot read encrypted file at ${options.filePath}. Run \`remnic secure-store unlock\` to decrypt.`
-    );
-  }
-  yield* readEncryptedOfflineFileChunks({
-    filePath: options.filePath,
-    memoryDir: options.memoryDir,
-    key: options.secureStoreKey,
-    chunkSize: options.chunkSize
-  });
-}
-async function readFilePrefix(filePath, length) {
-  const handle = await fs7.promises.open(filePath, "r");
-  try {
-    const out = Buffer.alloc(length);
-    const { bytesRead } = await handle.read(out, 0, length, 0);
-    return out.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
-async function* readPlainOfflineFileChunks(filePath, chunkSize) {
-  const stream = fs7.createReadStream(filePath, { highWaterMark: chunkSize });
-  for await (const chunk of stream) {
-    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-  }
-}
-async function* readEncryptedOfflineFileChunks(options) {
-  const header = await readFilePrefix(options.filePath, MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);
-  if (header.length < MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE || !isEncryptedFile(header)) {
-    throw new Error(`secure-store encrypted file is truncated: ${options.filePath}`);
-  }
-  const version = header.readUInt8(MAGIC_BYTES.length);
-  const flags = header.readUInt8(MAGIC_BYTES.length + 1);
-  if (version !== FILE_FORMAT_VERSION) {
-    throw new Error(`secure-store file has unsupported version ${version}: ${options.filePath}`);
-  }
-  if (flags !== FILE_FORMAT_FLAGS) {
-    throw new Error(`secure-store file has unsupported flags 0x${flags.toString(16)}: ${options.filePath}`);
-  }
-  const envelopeHeader = header.subarray(MAGIC_HEADER_SIZE);
-  const envelopeVersion = envelopeHeader.readUInt8(ENVELOPE_LAYOUT.version);
-  if (envelopeVersion !== ENVELOPE_VERSION) {
-    throw new Error(`secure-store envelope has unsupported version ${envelopeVersion}: ${options.filePath}`);
-  }
-  const salt = envelopeHeader.subarray(
-    ENVELOPE_LAYOUT.salt,
-    ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH
-  );
-  const iv = envelopeHeader.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);
-  const authTag = envelopeHeader.subarray(
-    ENVELOPE_LAYOUT.authTag,
-    ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH
-  );
-  const decipher = createDecipheriv("aes-256-gcm", options.key, iv, {
-    authTagLength: AUTH_TAG_LENGTH
-  });
-  decipher.setAuthTag(authTag);
-  decipher.setAAD(Buffer.concat([secureStoreEnvelopeHeaderAad(salt), filePathAad(options.filePath, options.memoryDir)]));
-  let pending = Buffer.alloc(0);
-  const stream = fs7.createReadStream(options.filePath, {
-    start: MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE,
-    highWaterMark: options.chunkSize
-  });
-  for await (const encryptedChunk of stream) {
-    const plain = decipher.update(Buffer.isBuffer(encryptedChunk) ? encryptedChunk : Buffer.from(encryptedChunk));
-    if (plain.length > 0) {
-      pending = Buffer.concat([pending, plain], pending.length + plain.length);
-    }
-    while (pending.length >= options.chunkSize) {
-      yield pending.subarray(0, options.chunkSize);
-      pending = pending.subarray(options.chunkSize);
-    }
-  }
-  const finalPlain = decipher.final();
-  if (finalPlain.length > 0) {
-    pending = Buffer.concat([pending, finalPlain], pending.length + finalPlain.length);
-  }
-  while (pending.length >= options.chunkSize) {
-    yield pending.subarray(0, options.chunkSize);
-    pending = pending.subarray(options.chunkSize);
-  }
-  if (pending.length > 0) yield pending;
-}
-function secureStoreEnvelopeHeaderAad(salt) {
-  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);
-  out.writeUInt8(ENVELOPE_VERSION, 0);
-  Buffer.from(salt).copy(out, 1);
-  return out;
-}
 function formatOfflineLargeFilePushFailureMessage(failures) {
   const paths = failures.slice(0, 5).map((failure) => `${failure.path}: ${failure.error}`).join("; ");
   const suffix = failures.length > 5 ? `; +${failures.length - 5} more` : "";
@@ -9375,7 +9820,7 @@ function advanceOfflineBaseFilesForSuccessfulPush(options) {
   return [...next.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
 async function runOfflineSyncOnce(options) {
-  fs7.mkdirSync(options.memoryDir, { recursive: true });
+  fs10.mkdirSync(options.memoryDir, { recursive: true });
   let activeStatePath = options.statePath;
   let priorState = await readOfflineSyncState(activeStatePath);
   let syncNamespace = options.namespace ?? priorState?.namespace;
@@ -9413,8 +9858,22 @@ async function runOfflineSyncOnce(options) {
   }
   const baseFiles = priorState?.baseFiles ?? [];
   const baseCapturedAt = priorState ? new Date(priorState.lastSyncedAt) : void 0;
-  const storageIo = await createOfflineStorageIo(options.memoryDir);
+  const offlineStorage = await createConfiguredOfflineStorage(
+    options.memoryDir,
+    options.secureStoreEncryptOnWrite
+  );
+  const storageIo = await createOfflineStorageIo(options.memoryDir, offlineStorage);
   const localSourceId = localOfflineSourceId(options.memoryDir);
+  await drainOfflineSyncImpressions(options.memoryDir, options);
+  await drainPendingLifecycleForOfflineSync(
+    options.memoryDir,
+    (ledgerPath) => createOfflineStorageForPath(
+      options.memoryDir,
+      ledgerPath,
+      offlineStorage,
+      options.secureStoreEncryptOnWrite ?? true
+    ).drainPendingMemoryLifecycleEventsForSyncAt(ledgerPath)
+  );
   const currentSnapshotForPush = await buildOfflineSyncSnapshotFromBase({
     root: options.memoryDir,
     sourceId: localSourceId,
@@ -9933,7 +10392,7 @@ function advanceOfflineLargeFileFailureCounts(options) {
   }
   return { counts: next, newlySkipped };
 }
-function resolveOfflineSyncUserExcludes(rest) {
+function resolveOfflineSyncUserExcludes(rest, config) {
   const globs = [];
   for (let i = 0; i < rest.length; i += 1) {
     if (rest[i] !== "--exclude") continue;
@@ -9944,27 +10403,17 @@ function resolveOfflineSyncUserExcludes(rest) {
     globs.push(value.trim());
     i += 1;
   }
-  const configPath = resolveConfigPath();
-  try {
-    const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord(raw);
-    const configured = remnicCfg.offlineSyncExcludes;
-    if (configured !== void 0 && configured !== null) {
-      if (!Array.isArray(configured)) {
-        throw new Error("offlineSyncExcludes config must be an array of non-empty glob strings");
-      }
-      for (const entry of configured) {
-        if (typeof entry !== "string" || entry.trim().length === 0) {
-          throw new Error("offlineSyncExcludes config must contain only non-empty glob strings");
-        }
-        globs.push(entry.trim());
-      }
+  const configured = config.offlineSyncExcludes;
+  if (configured !== void 0 && configured !== null) {
+    if (!Array.isArray(configured)) {
+      throw new Error("offlineSyncExcludes config must be an array of non-empty glob strings");
     }
-  } catch (error) {
-    if (error instanceof SyntaxError) {
-      throw new Error(`cannot read offlineSyncExcludes from ${configPath}: ${error.message}`);
+    for (const entry of configured) {
+      if (typeof entry !== "string" || entry.trim().length === 0) {
+        throw new Error("offlineSyncExcludes config must contain only non-empty glob strings");
+      }
+      globs.push(entry.trim());
     }
-    throw error;
   }
   return compileOfflineSyncExcludeGlobs(globs);
 }
@@ -9989,19 +10438,30 @@ Environment fallbacks:
   REMNIC_OFFLINE_REMOTE_URL, REMNIC_OFFLINE_TOKEN, REMNIC_AUTH_TOKEN`);
     return;
   }
-  const memoryDir = path11.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
+  const memoryDir = path12.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
   const namespace = resolveRequiredValueFlag(rest, "--namespace");
   const includeTranscripts = !hasFlag(rest, "--no-transcripts");
   const stateOverride = resolveRequiredValueFlag(rest, "--state");
   const statePathExplicit = stateOverride !== void 0;
-  const userExcludeRegexps = resolveOfflineSyncUserExcludes(rest);
+  const configPath = resolveConfigPath();
+  let config;
+  try {
+    const rawConfig = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+    config = parseConfigQuietly(pickOfflineConfigRecord(rawConfig));
+  } catch {
+    throw new Error(
+      "offline sync: failed to load the Remnic config \u2014 run `remnic doctor` and check the config file for errors"
+    );
+  }
+  const userExcludeRegexps = resolveOfflineSyncUserExcludes(rest, config);
+  const impressionRotation = resolveOfflineImpressionRotation(configPath);
   const needsRemote = action === "prepare" || action === "sync" || action === "watch";
   const remoteUrl = needsRemote ? resolveOfflineRemoteUrl(rest) : resolveOptionalOfflineRemoteUrl(rest);
   const token = needsRemote ? resolveOfflineToken(rest) : void 0;
-  const statePath = statePathExplicit ? path11.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
+  const statePath = statePathExplicit ? path12.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
   if (action === "prepare") {
     if (!remoteUrl || !token || !statePath) throw new Error("offline prepare requires remote URL and token");
-    fs7.mkdirSync(memoryDir, { recursive: true });
+    fs10.mkdirSync(memoryDir, { recursive: true });
     const remoteSnapshot = await fetchOfflineSnapshot({
       remoteUrl,
       token,
@@ -10027,7 +10487,10 @@ Environment fallbacks:
         statePath: existingState.statePath
       });
     }
-    const storageIo = await createOfflineStorageIo(memoryDir);
+    const storageIo = await createOfflineStorageIo(
+      memoryDir,
+      await createConfiguredOfflineStorage(memoryDir, config.secureStoreEncryptOnWrite)
+    );
     const pull = await applyOfflineSyncSnapshot({
       root: memoryDir,
       snapshot: remoteSnapshot,
@@ -10072,7 +10535,9 @@ Environment fallbacks:
       includeTranscripts,
       statePath,
       statePathExplicit,
-      userExcludeRegexps
+      userExcludeRegexps,
+      secureStoreEncryptOnWrite: config.secureStoreEncryptOnWrite,
+      ...impressionRotation
     });
     if (json) {
       console.log(JSON.stringify(offlineSyncResultJsonSummary(result), null, 2));
@@ -10094,7 +10559,7 @@ Environment fallbacks:
     return;
   }
   if (action === "status") {
-    fs7.mkdirSync(memoryDir, { recursive: true });
+    fs10.mkdirSync(memoryDir, { recursive: true });
     const state = statePath ? await readOfflineSyncState(statePath) : null;
     if (state && remoteUrl && statePath) {
       assertOfflineStateMatches({
@@ -10105,7 +10570,18 @@ Environment fallbacks:
         statePath
       });
     }
-    const storageIo = await createOfflineStorageIo(memoryDir);
+    const configuredStorage = await createConfiguredOfflineStorage(memoryDir, config.secureStoreEncryptOnWrite);
+    const storageIo = await createOfflineStorageIo(memoryDir, configuredStorage);
+    await drainOfflineSyncImpressions(memoryDir, impressionRotation);
+    await drainPendingLifecycleForOfflineSync(
+      memoryDir,
+      (ledgerPath) => createOfflineStorageForPath(
+        memoryDir,
+        ledgerPath,
+        configuredStorage,
+        config.secureStoreEncryptOnWrite ?? true
+      ).drainPendingMemoryLifecycleEventsForSyncAt(ledgerPath)
+    );
     const summary = await summarizeOfflineSyncPendingChanges({
       root: memoryDir,
       sourceId: localOfflineSourceId(memoryDir),
@@ -10154,6 +10630,8 @@ Environment fallbacks:
           statePath,
           statePathExplicit,
           userExcludeRegexps,
+          secureStoreEncryptOnWrite: config.secureStoreEncryptOnWrite,
+          ...impressionRotation,
           skipLargeFilePaths: skippedLargeFiles
         });
         const advanced = advanceOfflineLargeFileFailureCounts({
@@ -10161,11 +10639,11 @@ Environment fallbacks:
           failures: result.largeFilePushFailures
         });
         largeFileFailureCounts = advanced.counts;
-        for (const path12 of advanced.newlySkipped) {
-          if (skippedLargeFiles.has(path12)) continue;
-          skippedLargeFiles.add(path12);
+        for (const path13 of advanced.newlySkipped) {
+          if (skippedLargeFiles.has(path13)) continue;
+          skippedLargeFiles.add(path13);
           console.warn(
-            `offline sync: permanently skipping ${path12} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+            `offline sync: permanently skipping ${path13} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
           );
         }
         const pulled = result.pull ? result.pull.upserted + result.pull.deleted : 0;
@@ -10180,11 +10658,11 @@ Environment fallbacks:
             failures: error.failures
           });
           largeFileFailureCounts = advanced.counts;
-          for (const path12 of advanced.newlySkipped) {
-            if (skippedLargeFiles.has(path12)) continue;
-            skippedLargeFiles.add(path12);
+          for (const path13 of advanced.newlySkipped) {
+            if (skippedLargeFiles.has(path13)) continue;
+            skippedLargeFiles.add(path13);
             console.warn(
-              `offline sync: permanently skipping ${path12} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+              `offline sync: permanently skipping ${path13} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
             );
           }
         }
@@ -10219,7 +10697,7 @@ function cmdDedup(json) {
 function readInstalledConnectorConfig(configPath, fallback) {
   if (!configPath) return fallback;
   try {
-    const parsed = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs10.readFileSync(configPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return fallback;
     const { token: _token, ...config } = parsed;
     return config;
@@ -10231,6 +10709,33 @@ function snapshotConnectorTokenEntry(connectorId) {
   const entry = listTokens().find((candidate) => candidate.connector === connectorId);
   return entry ? { ...entry } : null;
 }
+async function cmdQuarantine(action, rest, json) {
+  if (action !== "list" && action !== "replay") {
+    process.stderr.write(`quarantine: unknown action "${action}". Use: list|replay [--namespace <ns>] [--principal <p>] [--json].
+`);
+    process.exitCode = 2;
+    return;
+  }
+  const format = json ? "json" : "text";
+  if (action === "list") {
+    const extra = rest.filter((a) => !a.startsWith("--"));
+    if (extra.length > 0) {
+      process.stderr.write(`quarantine list: unexpected argument(s): ${extra.join(", ")}. Use: list [--json].
+`);
+      process.exitCode = 2;
+      return;
+    }
+    try {
+      const store = new WriteQuarantineStore2(resolveMemoryDir());
+      console.log(renderQuarantineList(await store.list(), format));
+    } catch {
+      process.stderr.write("quarantine list: unable to inspect quarantine store\n");
+      process.exitCode = 2;
+    }
+    return;
+  }
+  await runQuarantineReplay(rest, format, resolveConfigPath);
+}
 async function cmdConnectors(action, rest, json) {
   const rawNonFlagArgs = rest.filter((a) => !a.startsWith("--"));
   const resolveConfigStrippedNonFlagArgs = () => {
@@ -10298,7 +10803,7 @@ async function cmdConnectors(action, rest, json) {
             const connectorDaemonUrl = typeof effectiveConnectorConfig.remnicDaemonUrl === "string" && effectiveConnectorConfig.remnicDaemonUrl.trim().length > 0 ? effectiveConnectorConfig.remnicDaemonUrl.trim() : void 0;
             const pubResult = await pub.publish({
               config: { memoryDir, namespace: connectorNamespace, daemonUrl: connectorDaemonUrl },
-              skillsRoot: path11.join(memoryDir, "skills"),
+              skillsRoot: path12.join(memoryDir, "skills"),
               rollbackTokenEntry: preInstallTokenEntry,
               log: { info: console.log, warn: console.warn, error: console.error }
             });
@@ -10370,7 +10875,7 @@ async function cmdConnectors(action, rest, json) {
           const pub = factory();
           const available = await pub.isHostAvailable();
           const extRoot = available ? await pub.resolveExtensionRoot() : "(host not installed)";
-          const extensionExists = available && extRoot ? fs7.existsSync(extRoot) : false;
+          const extensionExists = available && extRoot ? fs10.existsSync(extRoot) : false;
           publisherChecks.push({
             name: `Publisher: ${targetHostId}`,
             ok: !available || extensionExists,
@@ -10441,17 +10946,30 @@ async function cmdConnectors(action, rest, json) {
     const memoryDir = resolveMemoryDir();
     const states = await listLiveConnectorStates(memoryDir);
     const stateMap = new Map(states.map((s) => [s.id, s]));
+    let connectorsCfg;
+    const configPath = resolveConfigPath();
+    try {
+      const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+      connectorsCfg = parseConfigQuietly(raw).connectors;
+    } catch {
+      process.stderr.write(
+        `connectors status: failed to read config at ${configPath}
+`
+      );
+      process.exitCode = 2;
+      return;
+    }
     const rows = [
       {
         id: GDRIVE_ID,
         displayName: "Google Drive",
-        enabled: true,
+        enabled: connectorsCfg.googleDrive.enabled,
         state: stateMap.get(GDRIVE_ID) ?? null
       },
       {
         id: NOTION_ID,
         displayName: "Notion",
-        enabled: true,
+        enabled: connectorsCfg.notion.enabled,
         state: stateMap.get(NOTION_ID) ?? null
       }
     ];
@@ -10505,12 +11023,12 @@ async function cmdConnectors(action, rest, json) {
       process.exitCode = 2;
       return;
     }
-    initLogger();
+    initLogger2();
     const configPath = resolveConfigPath();
-    const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord(raw);
-    const config = parseConfig(remnicCfg);
-    const orchestrator = new Orchestrator(config);
+    const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord3(raw);
+    const config = parseConfig3(remnicCfg);
+    const orchestrator = new Orchestrator2(config);
     try {
       await orchestrator.initialize();
       await orchestrator.deferredReady;
@@ -10632,9 +11150,9 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     console.error(`connectors marketplace: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  const rawConfig = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const pluginConfig = resolveRemnicConfigRecord(rawConfig);
-  const config = parseConfig(pluginConfig);
+  const rawConfig = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const pluginConfig = resolveRemnicConfigRecord3(rawConfig);
+  const config = parseConfig3(pluginConfig);
   if (subAction === "generate") {
     let outputDir;
     try {
@@ -10645,22 +11163,22 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     }
     const manifest = generateMarketplaceManifest();
     await writeMarketplaceManifest(outputDir, manifest);
-    const outPath = path11.join(outputDir, "marketplace.json");
+    const outPath = path12.join(outputDir, "marketplace.json");
     if (json) {
       console.log(JSON.stringify({ status: "generated", path: outPath }, null, 2));
     } else {
       console.log(`Generated marketplace.json at ${outPath}`);
     }
   } else if (subAction === "validate") {
-    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path11.join(process.cwd(), "marketplace.json");
-    const resolved = path11.resolve(targetPath);
-    if (!fs7.existsSync(resolved)) {
+    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path12.join(process.cwd(), "marketplace.json");
+    const resolved = path12.resolve(targetPath);
+    if (!fs10.existsSync(resolved)) {
       console.error(`File not found: ${resolved}`);
       process.exit(1);
     }
     let parsed;
     try {
-      parsed = JSON.parse(fs7.readFileSync(resolved, "utf8"));
+      parsed = JSON.parse(fs10.readFileSync(resolved, "utf8"));
     } catch {
       console.error(`Invalid JSON in ${resolved}`);
       process.exit(1);
@@ -10859,13 +11377,13 @@ async function cmdSpace(action, rest, json) {
   }
 }
 async function cmdLegacyBenchmark(action, rest, json) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
-  const orchestrator = new Orchestrator(config);
-  const service = new EngramAccessService(orchestrator);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
+  const orchestrator = new Orchestrator2(config);
+  const service = new EngramAccessService2(orchestrator);
   const { runBenchSuite, loadBaseline, checkRegression } = await loadBenchModule();
   const benchConfig = {
     queries: rest.filter((a) => !a.startsWith("--")).length > 0 ? rest.filter((a) => !a.startsWith("--")) : void 0,
@@ -11057,7 +11575,7 @@ async function cmdBench(rest) {
     }
     const completeCount = prevStatus.benchmarks.filter((b) => b.status === "complete").length;
     const failedCount = prevStatus.benchmarks.filter((b) => b.status === "failed").length;
-    printBenchStatusLine(parsed.json, `Resuming from: ${path11.basename(latestStatusPath)}`);
+    printBenchStatusLine(parsed.json, `Resuming from: ${path12.basename(latestStatusPath)}`);
     printBenchStatusLine(parsed.json, `  Previous run: ${prevStatus.startedAt}`);
     printBenchStatusLine(parsed.json, `  Benchmarks: ${prevStatus.benchmarks.length} total, ${completeCount} complete, ${failedCount} failed`);
     const before = selectedBenchmarks.length;
@@ -11219,9 +11737,9 @@ Options:
     );
     process.exit(1);
   } else {
-    fixturePath = path11.resolve(expandTilde(fixturePathRaw));
+    fixturePath = path12.resolve(expandTilde(fixturePathRaw));
   }
-  const outPath = path11.resolve(expandTilde(outPathRaw));
+  const outPath = path12.resolve(expandTilde(outPathRaw));
   const benchModule = await loadBenchModule();
   const runner = benchModule.runProceduralAblationCli;
   if (typeof runner !== "function") {
@@ -11240,7 +11758,7 @@ Options:
   );
   console.log(`wrote ${outPath}`);
 }
-var LOGS_DIR = path11.join(PID_DIR, "logs");
+var LOGS_DIR = path12.join(PID_DIR, "logs");
 var LAUNCHD_PLIST_PATHS = launchdPlistPaths(resolveHomeDir());
 var [LAUNCHD_PLIST_PATH] = LAUNCHD_PLIST_PATHS;
 var SYSTEMD_UNIT_PATHS = systemdUnitPaths(resolveHomeDir());
@@ -11254,7 +11772,7 @@ function readPid() {
 function inferPort() {
   try {
     const configPath = resolveConfigPath();
-    const raw = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+    const raw = JSON.parse(fs10.readFileSync(configPath, "utf8"));
     return raw.server?.port ?? 4318;
   } catch {
     return 4318;
@@ -11317,7 +11835,7 @@ function selectLaunchdInspection(openclawPluginModeConfigured) {
   for (const plistPath of LAUNCHD_PLIST_PATHS.slice(1)) {
     const legacy = inspectLaunchdPlist(plistPath);
     if (!legacy.installed) continue;
-    const label = path11.basename(plistPath, ".plist");
+    const label = path12.basename(plistPath, ".plist");
     return legacy.ok ? {
       ...legacy,
       warn: true,
@@ -11349,13 +11867,13 @@ function daemonInstall() {
     process.exit(1);
   }
   const vars = { HOME: home, NODE_PATH: nodePath, REMNIC_SERVER_BIN: serverBin };
-  fs7.mkdirSync(LOGS_DIR, { recursive: true });
+  fs10.mkdirSync(LOGS_DIR, { recursive: true });
   if (isMacOS()) {
-    const templatePath = path11.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
-    const template = fs7.readFileSync(templatePath, "utf8");
+    const templatePath = path12.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
+    const template = fs10.readFileSync(templatePath, "utf8");
     const plist = renderTemplate(template, vars);
-    fs7.mkdirSync(path11.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
-    fs7.writeFileSync(LAUNCHD_PLIST_PATH, plist);
+    fs10.mkdirSync(path12.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
+    fs10.writeFileSync(LAUNCHD_PLIST_PATH, plist);
     try {
       launchdLoadPlist(LAUNCHD_PLIST_PATH);
     } catch (err) {
@@ -11371,11 +11889,11 @@ function daemonInstall() {
     console.log(`  RunAtLoad: true, KeepAlive: true`);
     console.log(`  Logs: ${LOGS_DIR}/daemon.log`);
   } else if (isLinux()) {
-    const templatePath = path11.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
-    const template = fs7.readFileSync(templatePath, "utf8");
+    const templatePath = path12.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
+    const template = fs10.readFileSync(templatePath, "utf8");
     const unit = renderTemplate(template, vars);
-    fs7.mkdirSync(path11.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
-    fs7.writeFileSync(SYSTEMD_UNIT_PATH, unit);
+    fs10.mkdirSync(path12.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
+    fs10.writeFileSync(SYSTEMD_UNIT_PATH, unit);
     try {
       childProcess2.execSync("systemctl --user daemon-reload", { stdio: "pipe" });
     } catch (err) {
@@ -11411,7 +11929,7 @@ function daemonUninstall() {
       } catch {
       }
       try {
-        fs7.unlinkSync(plistPath);
+        fs10.unlinkSync(plistPath);
         removed = true;
         console.log(`Removed launchd service: ${plistPath}`);
       } catch {
@@ -11431,7 +11949,7 @@ function daemonUninstall() {
     let removed = false;
     for (const unitPath of SYSTEMD_UNIT_PATHS) {
       try {
-        fs7.unlinkSync(unitPath);
+        fs10.unlinkSync(unitPath);
         removed = true;
         console.log(`Removed systemd service: ${unitPath}`);
       } catch {
@@ -11498,13 +12016,13 @@ async function daemonStatus() {
   console.log(`  Port:      ${port}`);
   console.log(`  Service:   ${serviceInstalled ? "installed" : "not installed"}`);
   console.log(`  Platform:  ${process.platform}`);
-  console.log(`  PID file:  ${fs7.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
-  console.log(`  Log file:  ${fs7.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
+  console.log(`  PID file:  ${fs10.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
+  console.log(`  Log file:  ${fs10.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
   try {
     const configPath = resolveConfigPath();
-    const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord(raw);
-    const config = parseConfig(remnicCfg);
+    const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord3(raw);
+    const config = parseConfig3(remnicCfg);
     const extRoot = resolveExtensionsRoot(config);
     const noopLog = { warn: () => {
     }, debug: () => {
@@ -11543,9 +12061,9 @@ function daemonStart() {
       return;
     }
   }
-  fs7.mkdirSync(PID_DIR, { recursive: true });
-  fs7.mkdirSync(LOGS_DIR, { recursive: true });
-  const logStream = fs7.openSync(LOG_FILE, "a");
+  fs10.mkdirSync(PID_DIR, { recursive: true });
+  fs10.mkdirSync(LOGS_DIR, { recursive: true });
+  const logStream = fs10.openSync(LOG_FILE, "a");
   const serverBin = resolveServerBin();
   const isSource = serverBin.endsWith(".ts");
   let cmd;
@@ -11567,7 +12085,7 @@ function daemonStart() {
     }
   });
   child.unref();
-  fs7.writeFileSync(PID_FILE, String(child.pid));
+  fs10.writeFileSync(PID_FILE, String(child.pid));
   console.log(`Started remnic server (pid ${child.pid})`);
   console.log(`  Log: ${LOG_FILE}`);
 }
@@ -11601,11 +12119,11 @@ function daemonStop() {
     console.log("Process not found (cleaning up PID file)");
   }
   try {
-    fs7.unlinkSync(PID_FILE);
+    fs10.unlinkSync(PID_FILE);
   } catch {
   }
   try {
-    fs7.unlinkSync(LEGACY_PID_FILE);
+    fs10.unlinkSync(LEGACY_PID_FILE);
   } catch {
   }
 }
@@ -11731,11 +12249,11 @@ async function promptYesNo(question, defaultYes = true) {
   });
 }
 async function cmdBinary(rest) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   const memoryDir = resolveMemoryDir();
   const blConfig = {
     enabled: config.binaryLifecycleEnabled,
@@ -11853,7 +12371,7 @@ Clean complete: cleaned=${result.cleaned}`
 }
 async function cmdOpenclawInstall(opts) {
   const configPath = resolveOpenclawConfigPath(opts.configPath);
-  const fallbackMemoryDir = path11.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+  const fallbackMemoryDir = path12.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
   console.log(`OpenClaw config: ${configPath}`);
   const existingConfig = readOpenclawConfig(configPath);
   const { plugins, entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
@@ -11924,7 +12442,7 @@ async function cmdOpenclawInstall(opts) {
   } else if (slotIsActiveLegacy) {
     changes.push(`  Slot left as "${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}" \u2014 re-run with --yes to activate the new entry`);
   }
-  if (!fs7.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
+  if (!fs10.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
   if (hasLegacy && migrateLegacy) {
     changes.push(`~ Legacy '${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}' entry retained (safe to remove after verifying hooks fire)`);
   }
@@ -11944,8 +12462,8 @@ async function cmdOpenclawInstall(opts) {
 Resulting plugins.slots.memory: ${dryRunPlugins.slots?.memory ?? "(unset)"}`);
     return;
   }
-  if (fs7.existsSync(memoryDir)) {
-    const st = fs7.statSync(memoryDir);
+  if (fs10.existsSync(memoryDir)) {
+    const st = fs10.statSync(memoryDir);
     if (!st.isDirectory()) {
       throw new Error(
         `Cannot use ${memoryDir} as the memory directory \u2014 a file already exists at that path.
@@ -11953,12 +12471,12 @@ Remove it first and re-run, or choose a different path with --memory-dir.`
       );
     }
   } else {
-    fs7.mkdirSync(memoryDir, { recursive: true });
+    fs10.mkdirSync(memoryDir, { recursive: true });
     console.log(`Created memory directory: ${memoryDir}`);
   }
-  const configDir = path11.dirname(configPath);
-  if (!fs7.existsSync(configDir)) {
-    fs7.mkdirSync(configDir, { recursive: true });
+  const configDir = path12.dirname(configPath);
+  if (!fs10.existsSync(configDir)) {
+    fs10.mkdirSync(configDir, { recursive: true });
   }
   atomicWriteFileSync(configPath, JSON.stringify(updatedConfig, null, 2) + "\n");
   console.log("\nDone! Summary of changes:");
@@ -11984,11 +12502,11 @@ async function cmdOpenclawUpgrade(opts) {
   const configPath = resolveOpenclawConfigPath(opts.configPath);
   const pluginDir = resolveOpenclawPluginDir(opts.pluginDir);
   const legacyPluginDirForBackup = opts.legacyPluginDirForBackup ? resolveOpenclawLegacyPluginDir(opts.legacyPluginDirForBackup) : void 0;
-  const fallbackMemoryDir = path11.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+  const fallbackMemoryDir = path12.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
   const packageSpec = `@remnic/plugin-openclaw@${opts.version ?? "latest"}`;
   const existingConfig = readOpenclawConfig(configPath);
   const { entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
-  const preservedMemoryDir = opts.memoryDir ? path11.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
+  const preservedMemoryDir = opts.memoryDir ? path12.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
   assertDirectoryPathOrMissing(pluginDir, "OpenClaw plugin dir");
   if (legacyPluginDirForBackup) {
     assertDirectoryPathOrMissing(legacyPluginDirForBackup, "Legacy OpenClaw plugin dir");
@@ -12000,7 +12518,7 @@ async function cmdOpenclawUpgrade(opts) {
   }
   console.log(`Memory dir:      ${preservedMemoryDir}`);
   console.log(`Package spec:    ${packageSpec}`);
-  console.log(`Backup root:     ${path11.join(resolveHomeDir(), ".openclaw", "backups")}`);
+  console.log(`Backup root:     ${path12.join(resolveHomeDir(), ".openclaw", "backups")}`);
   const plannedActions = [
     `backup openclaw.json and the existing ${REMNIC_OPENCLAW_PLUGIN_ID} extension`,
     ...legacyPluginDirForBackup ? [`backup the existing ${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID} extension without modifying it`] : [],
@@ -12026,9 +12544,9 @@ async function cmdOpenclawUpgrade(opts) {
     }
   }
   const backupDir = createOpenclawUpgradeBackupDir();
-  const configBackupPath = path11.join(backupDir, "openclaw.json");
-  const pluginBackupDir = path11.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
-  const legacyPluginBackupDir = legacyPluginDirForBackup ? path11.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
+  const configBackupPath = path12.join(backupDir, "openclaw.json");
+  const pluginBackupDir = path12.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  const legacyPluginBackupDir = legacyPluginDirForBackup ? path12.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
   const backupNotes = [];
   if (backupPathIfPresent(configPath, configBackupPath)) {
     backupNotes.push(`+ Backed up config to ${configBackupPath}`);
@@ -12129,16 +12647,16 @@ async function cmdOpenclawMigrateEngram(opts) {
   console.log("  - Re-apply any local source patches to the new package only after verifying the published build.");
 }
 function createOpenclawUpgradeBackupDir() {
-  const backupsRoot = path11.join(resolveHomeDir(), ".openclaw", "backups");
-  fs7.mkdirSync(backupsRoot, { recursive: true });
-  return fs7.mkdtempSync(path11.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
+  const backupsRoot = path12.join(resolveHomeDir(), ".openclaw", "backups");
+  fs10.mkdirSync(backupsRoot, { recursive: true });
+  return fs10.mkdtempSync(path12.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
 }
 async function cmdTaxonomy(rest) {
-  initLogger();
+  initLogger2();
   const configPath = resolveConfigPath();
-  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord(raw);
-  const config = parseConfig(remnicCfg);
+  const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord3(raw);
+  const config = parseConfig3(remnicCfg);
   if (!config.taxonomyEnabled) {
     console.error(
       "Taxonomy is disabled in config (taxonomyEnabled = false). Enable it to use taxonomy commands."
@@ -12173,9 +12691,9 @@ async function cmdTaxonomy(rest) {
       const doc = generateResolverDocument(taxonomy);
       console.log(doc);
       if (config.taxonomyAutoGenResolver) {
-        const resolverPath = path11.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs7.mkdirSync(path11.dirname(resolverPath), { recursive: true });
-        fs7.writeFileSync(resolverPath, doc);
+        const resolverPath = path12.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs10.mkdirSync(path12.dirname(resolverPath), { recursive: true });
+        fs10.writeFileSync(resolverPath, doc);
         console.error(`Written: ${resolverPath}`);
       }
       break;
@@ -12220,8 +12738,8 @@ async function cmdTaxonomy(rest) {
       console.log(`Added category "${id}" (${name}).`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path11.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs7.writeFileSync(resolverPath, doc);
+        const resolverPath = path12.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs10.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -12251,8 +12769,8 @@ async function cmdTaxonomy(rest) {
       console.log(`Removed category "${id}".`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path11.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs7.writeFileSync(resolverPath, doc);
+        const resolverPath = path12.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs10.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -12443,12 +12961,12 @@ async function runTrainingExport(args, stdout = process.stdout) {
       `Unknown training-export format "${args.format}". ${validList}`
     );
   }
-  if (!fs7.existsSync(args.memoryDir)) {
+  if (!fs10.existsSync(args.memoryDir)) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" does not exist. Provide the path to an existing memory directory.`
     );
   }
-  if (!fs7.statSync(args.memoryDir).isDirectory()) {
+  if (!fs10.statSync(args.memoryDir).isDirectory()) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" is not a directory. Provide the path to a memory directory, not a file.`
     );
@@ -12533,11 +13051,11 @@ async function runTrainingExport(args, stdout = process.stdout) {
     );
   }
   const formatted = adapter.formatRecords(records);
-  const outDir = path11.dirname(args.output);
-  fs7.mkdirSync(outDir, { recursive: true });
+  const outDir = path12.dirname(args.output);
+  fs10.mkdirSync(outDir, { recursive: true });
   const tmpPath = `${args.output}.tmp-${process.pid}-${Date.now()}`;
-  fs7.writeFileSync(tmpPath, formatted, "utf-8");
-  fs7.renameSync(tmpPath, args.output);
+  fs10.writeFileSync(tmpPath, formatted, "utf-8");
+  fs10.renameSync(tmpPath, args.output);
   stdout.write(
     `Exported ${records.length} records to ${args.output} (${adapter.name} format)
 `
@@ -12641,7 +13159,7 @@ async function main(argv = process.argv.slice(2)) {
     case "tree": {
       const subAction = rest[0];
       const json = rest.includes("--json");
-      const outputDir = resolveFlag(rest, "--output") ?? path11.join(process.cwd(), ".remnic", "context-tree");
+      const outputDir = resolveFlag(rest, "--output") ?? path12.join(process.cwd(), ".remnic", "context-tree");
       const categoriesFlag = resolveFlag(rest, "--categories");
       const categories = categoriesFlag ? categoriesFlag.split(",") : void 0;
       const maxPerCategoryRaw = resolveFlag(rest, "--max-per-category");
@@ -12706,7 +13224,7 @@ async function main(argv = process.argv.slice(2)) {
             }
           }, 500);
         };
-        fs7.watch(memoryDir, { recursive: true }, (_event, filename) => {
+        fs10.watch(memoryDir, { recursive: true }, (_event, filename) => {
           if (filename && filename.startsWith(".")) return;
           rebuild();
         });
@@ -12714,12 +13232,12 @@ async function main(argv = process.argv.slice(2)) {
         });
       } else if (subAction === "validate") {
         const treeDir = outputDir;
-        if (!fs7.existsSync(treeDir)) {
+        if (!fs10.existsSync(treeDir)) {
           console.error(`Context tree not found at ${treeDir}. Run 'remnic tree generate' first.`);
           process.exit(1);
         }
-        const indexPath = path11.join(treeDir, "INDEX.md");
-        if (!fs7.existsSync(indexPath)) {
+        const indexPath = path12.join(treeDir, "INDEX.md");
+        if (!fs10.existsSync(indexPath)) {
           console.error(`INDEX.md missing in ${treeDir}. Tree may be corrupt \u2014 regenerate.`);
           process.exit(1);
         }
@@ -12788,6 +13306,12 @@ Options:
       await cmdConnectors(action, rest.slice(1), json);
       break;
     }
+    case "quarantine": {
+      const action = rest[0] ?? "list";
+      const json = rest.includes("--json");
+      await cmdQuarantine(action, rest.slice(1), json);
+      break;
+    }
     case "space": {
       const action = rest[0] ?? "list";
       const json = rest.includes("--json");
@@ -12883,10 +13407,10 @@ Other:
         let wearablesService;
         try {
           const configPath = resolveConfigPath();
-          const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-          const remnicCfg = resolveRemnicConfigRecord(raw);
-          const config = parseConfig(remnicCfg);
-          wearablesOrchestrator = new Orchestrator(config);
+          const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+          const remnicCfg = resolveRemnicConfigRecord3(raw);
+          const config = parseConfig3(remnicCfg);
+          wearablesOrchestrator = new Orchestrator2(config);
           await wearablesOrchestrator.initialize();
           await wearablesOrchestrator.deferredReady;
           wearablesService = wearablesOrchestrator.getWearablesService();
@@ -12927,10 +13451,10 @@ Other:
       const targetFactory = async () => {
         if (!orchestratorSingleton) {
           const configPath = resolveConfigPath();
-          const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
-          const remnicCfg = resolveRemnicConfigRecord(raw);
-          const config = parseConfig(remnicCfg);
-          orchestratorSingleton = new Orchestrator(config);
+          const raw = fs10.existsSync(configPath) ? JSON.parse(fs10.readFileSync(configPath, "utf8")) : {};
+          const remnicCfg = resolveRemnicConfigRecord3(raw);
+          const config = parseConfig3(remnicCfg);
+          orchestratorSingleton = new Orchestrator2(config);
           await orchestratorSingleton.initialize();
           await orchestratorSingleton.deferredReady;
         }
@@ -13143,6 +13667,7 @@ Usage:
     marketplace generate    Generate marketplace.json for Codex
     marketplace validate    Validate a marketplace.json file
     marketplace install     Install from a marketplace source
+  remnic quarantine <list|replay> [--namespace <ns>] [--principal <p>] [--json]  Inspect/replay ACL-rejected writes
   remnic extensions <list|show|validate|reload>  Manage memory extensions
   remnic space <list|switch|create|delete|push|pull|share|promote|audit>  Manage spaces
     create accepts --parent <id> to set parent-child relationship
@@ -13261,6 +13786,7 @@ export {
   TAXONOMY_RESOLVE_BOOLEAN_FLAGS,
   TAXONOMY_RESOLVE_VALUE_FLAGS,
   __benchDatasetTestHooks,
+  __statusHealthTestHooks,
   advanceOfflineBaseFilesForSuccessfulPush,
   advanceOfflineLargeFileFailureCounts,
   attachPreparedJudgeCalibration,