@remnic/core 1.1.1 → 1.1.3

package/dist/{chunk-INXV5JBT.js → chunk-ZGXSCMQN.js}

@@ -1,14 +1,26 @@
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-VDX363PS.js";
+} from "./chunk-34F3PLWZ.js";
+import {
+  resolveAgentAccessAuthToken
+} from "./chunk-MXC3AP5I.js";
 import {
   buildResumeBundleFromState,
   getResumeBundleStatus,
   recordResumeBundle
-} from "./chunk-KUB6JU6H.js";
+} from "./chunk-47WOM4YW.js";
 import {
   parseXrayCliOptions
-} from "./chunk-PVPWZSSI.js";
+} from "./chunk-SMA4IMHV.js";
+import {
+  collectPatternMemories,
+  explainPatternMemory,
+  parsePatternsExplainOptions,
+  parsePatternsListOptions,
+  parseStrictCliDate,
+  renderPatternExplain,
+  renderPatternsList
+} from "./chunk-AJA46VX5.js";
 import {
   listNamespaces,
   runBenchmarkRecall,
@@ -19,7 +31,7 @@ import {
   runOperatorRepair,
   runOperatorSetup,
   verifyNamespaces
-} from "./chunk-B5WXLVDY.js";
+} from "./chunk-7GCMLT7J.js";
 import {
   compareVersions
 } from "./chunk-HL4DB7TO.js";
@@ -28,14 +40,13 @@ import {
 } from "./chunk-ZPKBYX2F.js";
 import {
   RoutingRulesStore,
-  expandTildePath,
   isReplayRole,
   isReplaySource,
   normalizeReplaySessionKey,
   parseIsoOffsetTimestamp,
   parseIsoTimestamp,
   validateReplayTurn
-} from "./chunk-EPQJM2GC.js";
+} from "./chunk-VTJVUHRK.js";
 import {
   getUtilityLearningStatus,
   learnUtilityPromotionWeights
@@ -46,18 +57,25 @@ import {
 } from "./chunk-3QKK7QOS.js";
 import {
   searchVerifiedEpisodes
-} from "./chunk-CUPFXL3J.js";
+} from "./chunk-DHRQHX36.js";
 import {
   ThreadingManager
 } from "./chunk-JRNQ3RNA.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-SPI27QT6.js";
+} from "./chunk-L5IIGA5V.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
   searchWorkProductLedgerEntries
 } from "./chunk-CULXMQJH.js";
+import {
+  readRuntimePolicySnapshot,
+  sanitizeRuntimePolicyValues
+} from "./chunk-EABGC2TL.js";
+import {
+  getObjectiveStateStoreStatus
+} from "./chunk-LOBRX7VD.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -68,24 +86,22 @@ import {
   PLUGIN_ID
 } from "./chunk-U66YHYC7.js";
 import {
-  readRuntimePolicySnapshot,
-  sanitizeRuntimePolicyValues
-} from "./chunk-EABGC2TL.js";
+  GOOGLE_DRIVE_CONNECTOR_ID,
+  NOTION_CONNECTOR_ID,
+  createGoogleDriveConnector,
+  createNotionConnector,
+  validateGoogleDriveConfig,
+  validateNotionConfig
+} from "./chunk-L2IO2QPY.js";
 import {
-  getObjectiveStateStoreStatus
-} from "./chunk-LOBRX7VD.js";
+  listConnectorStates
+} from "./chunk-6TBWYBJ3.js";
 import {
   searchHarmonicRetrieval
 } from "./chunk-HMDCOMYU.js";
 import {
   rescoreMemoryImportance
 } from "./chunk-JXS5PDQ7.js";
-import {
-  launchProcess
-} from "./chunk-LK6SGL53.js";
-import {
-  loadPersistedNativeKnowledgeChunks
-} from "./chunk-7SEAZFFB.js";
 import {
   createEvalBaselineSnapshot,
   getEvalHarnessStatus,
@@ -95,15 +111,23 @@ import {
   runEvalStoredBaselineCiGate,
   validateEvalBenchmarkPack
 } from "./chunk-K6WK37A6.js";
+import {
+  loadPersistedNativeKnowledgeChunks
+} from "./chunk-7SEAZFFB.js";
 import {
   parseConfig
-} from "./chunk-BK2EFTE2.js";
+} from "./chunk-JWSENLQI.js";
+import {
+  parseConnectorsListOptions,
+  parseConnectorsRunName,
+  parseConnectorsStatusOptions,
+  renderConnectorsList,
+  renderConnectorsRunResult,
+  runConnectorPollOnce
+} from "./chunk-OZHRDTDX.js";
 import {
   getCueAnchorStoreStatus
 } from "./chunk-C6QPK5GG.js";
-import {
-  analyzeGraphHealth
-} from "./chunk-C2EFFULQ.js";
 import {
   applyCommitmentLedgerLifecycle,
   getCommitmentLedgerStatus,
@@ -118,50 +142,60 @@ import {
 } from "./chunk-NGAVDO7E.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-DFTTJYSO.js";
+} from "./chunk-AKUCB2OG.js";
 import {
   EngramMcpServer
-} from "./chunk-HK3FGIEW.js";
-import {
-  resolveHomeDir
-} from "./chunk-MARWOCVP.js";
+} from "./chunk-4PLGJRBV.js";
 import {
   EngramAccessService,
   WorkStorage
-} from "./chunk-GKFXUTJ2.js";
+} from "./chunk-DR7MCMPS.js";
 import {
   parseRecallExplainFormat,
   renderRecallExplain,
   renderXray
-} from "./chunk-ZAIM4TUE.js";
+} from "./chunk-LW2NMHDW.js";
+import {
+  getTrustZoneStoreStatus,
+  promoteTrustZoneRecord,
+  seedTrustZoneDemoDataset
+} from "./chunk-EQINRHYR.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "./chunk-3OGMS3PE.js";
+} from "./chunk-LZRYQK6L.js";
 import {
-  getTrustZoneStoreStatus,
-  promoteTrustZoneRecord,
-  seedTrustZoneDemoDataset
-} from "./chunk-EQINRHYR.js";
+  expandTildePath
+} from "./chunk-IXEJRKCZ.js";
 import {
   selectRouteRule,
   validateRouteTarget
 } from "./chunk-2LGMW3DJ.js";
+import {
+  launchProcess
+} from "./chunk-OR64ZGRZ.js";
+import {
+  analyzeGraphHealth
+} from "./chunk-RK2Y4XOM.js";
 import {
   getCausalTrajectoryStoreStatus
-} from "./chunk-RBBWYEFJ.js";
+} from "./chunk-G2WADRQ3.js";
 import {
   StorageManager
-} from "./chunk-F5VP6YCB.js";
+} from "./chunk-DCE6SQLA.js";
+import {
+  RECALL_DISCLOSURE_LEVELS,
+  isRecallDisclosure
+} from "./chunk-43EKP2UK.js";
 import {
   MEMORY_LIFECYCLE_EVENT_SORT_ORDER,
   buildLifecycleEventsForMemory,
   inferMemoryStatus,
   sortMemoryLifecycleEvents,
   toMemoryPathRel
-} from "./chunk-TP4FZJIZ.js";
+} from "./chunk-RULE4VG5.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -178,75 +212,38 @@ import {
   readProjectedGovernanceRecord,
   readProjectedNativeKnowledgeChunks
 } from "./chunk-BOUYNNYD.js";
+import {
+  resolveHomeDir
+} from "./chunk-MARWOCVP.js";
+import {
+  EXPORT_FORMAT,
+  EXPORT_SCHEMA_VERSION
+} from "./chunk-IYY4MCPG.js";
+import {
+  fileExists,
+  fromPosixRelPath,
+  listFilesRecursive,
+  readJsonFile,
+  sha256File,
+  sha256String,
+  toPosixRelPath,
+  writeJsonFile
+} from "./chunk-457A4P3L.js";
+import {
+  ExportBundleV1Schema
+} from "./chunk-OA3L7BFR.js";
+import {
+  encryptCapsuleFile
+} from "./chunk-KNKUID7G.js";
 
 // src/cli.ts
-import path19 from "path";
-import { access as access2, readFile as readFile12, readdir as readdir8, unlink as unlink2 } from "fs/promises";
-import { createHash as createHash2 } from "crypto";
-
-// src/transfer/export-json.ts
-import path2 from "path";
-import { mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
-
-// src/transfer/constants.ts
-var EXPORT_FORMAT = "openclaw-engram-export";
-var EXPORT_SCHEMA_VERSION = 1;
-
-// src/transfer/fs-utils.ts
+import path18 from "path";
+import { access as access2, readFile as readFile11, readdir as readdir7, unlink as unlink3 } from "fs/promises";
 import { createHash } from "crypto";
-import { mkdir, readdir, readFile, stat, writeFile } from "fs/promises";
-import path from "path";
-async function sha256File(filePath) {
-  const buf = await readFile(filePath);
-  const sha256 = createHash("sha256").update(buf).digest("hex");
-  return { sha256, bytes: buf.byteLength };
-}
-function sha256String(content) {
-  const buf = Buffer.from(content, "utf-8");
-  const sha256 = createHash("sha256").update(buf).digest("hex");
-  return { sha256, bytes: buf.byteLength };
-}
-async function writeJsonFile(filePath, value) {
-  await mkdir(path.dirname(filePath), { recursive: true });
-  await writeFile(filePath, JSON.stringify(value, null, 2) + "\n", "utf-8");
-}
-async function readJsonFile(filePath) {
-  const raw = await readFile(filePath, "utf-8");
-  return JSON.parse(raw);
-}
-async function listFilesRecursive(rootDir) {
-  const out = [];
-  async function walk(dir) {
-    const entries = await readdir(dir, { withFileTypes: true });
-    for (const ent of entries) {
-      const fp = path.join(dir, ent.name);
-      if (ent.isDirectory()) {
-        await walk(fp);
-      } else if (ent.isFile()) {
-        out.push(fp);
-      }
-    }
-  }
-  await walk(rootDir);
-  return out.sort();
-}
-async function fileExists(filePath) {
-  try {
-    await stat(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function toPosixRelPath(absPath, rootDir) {
-  const rel = path.relative(rootDir, absPath);
-  return rel.split(path.sep).join("/");
-}
-function fromPosixRelPath(relPath) {
-  return relPath.split("/").join(path.sep);
-}
 
 // src/transfer/export-json.ts
+import path from "path";
+import { mkdir, readFile } from "fs/promises";
 var DEFAULT_EXCLUDES = /* @__PURE__ */ new Set([
   "node_modules",
   ".git"
@@ -259,24 +256,24 @@ function shouldExclude(relPosix, includeTranscripts) {
 }
 async function exportJsonBundle(opts) {
   const includeTranscripts = opts.includeTranscripts === true;
-  const outDirAbs = path2.resolve(opts.outDir);
-  await mkdir2(outDirAbs, { recursive: true });
-  const memoryDirAbs = path2.resolve(opts.memoryDir);
+  const outDirAbs = path.resolve(opts.outDir);
+  await mkdir(outDirAbs, { recursive: true });
+  const memoryDirAbs = path.resolve(opts.memoryDir);
   const filesAbs = await listFilesRecursive(memoryDirAbs);
   const records = [];
   const manifestFiles = [];
   for (const abs of filesAbs) {
     const relPosix = toPosixRelPath(abs, memoryDirAbs);
     if (shouldExclude(relPosix, includeTranscripts)) continue;
-    const content = await readFile2(abs, "utf-8");
+    const content = await readFile(abs, "utf-8");
     records.push({ path: relPosix, content });
     const { sha256, bytes } = await sha256File(abs);
     manifestFiles.push({ path: relPosix, sha256, bytes });
   }
   if (opts.includeWorkspaceIdentity !== false && opts.workspaceDir) {
-    const identityPath = path2.join(opts.workspaceDir, "IDENTITY.md");
+    const identityPath = path.join(opts.workspaceDir, "IDENTITY.md");
     try {
-      const content = await readFile2(identityPath, "utf-8");
+      const content = await readFile(identityPath, "utf-8");
       const relPath = "workspace/IDENTITY.md";
       records.push({ path: relPath, content });
       const { sha256, bytes } = sha256String(content);
@@ -293,13 +290,13 @@ async function exportJsonBundle(opts) {
     files: manifestFiles.sort((a, b) => a.path.localeCompare(b.path))
   };
   const bundle = { manifest, records };
-  await writeJsonFile(path2.join(outDirAbs, "manifest.json"), manifest);
-  await writeJsonFile(path2.join(outDirAbs, "bundle.json"), bundle);
+  await writeJsonFile(path.join(outDirAbs, "manifest.json"), manifest);
+  await writeJsonFile(path.join(outDirAbs, "bundle.json"), bundle);
 }
 
 // src/transfer/export-md.ts
-import path3 from "path";
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import path2 from "path";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
 function shouldExclude2(relPosix, includeTranscripts) {
   const parts = relPosix.split("/");
   if (!includeTranscripts && parts[0] === "transcripts") return true;
@@ -307,18 +304,18 @@ function shouldExclude2(relPosix, includeTranscripts) {
 }
 async function exportMarkdownBundle(opts) {
   const includeTranscripts = opts.includeTranscripts === true;
-  const outDirAbs = path3.resolve(opts.outDir);
-  await mkdir3(outDirAbs, { recursive: true });
-  const memDirAbs = path3.resolve(opts.memoryDir);
+  const outDirAbs = path2.resolve(opts.outDir);
+  await mkdir2(outDirAbs, { recursive: true });
+  const memDirAbs = path2.resolve(opts.memoryDir);
   const filesAbs = await listFilesRecursive(memDirAbs);
   const manifestFiles = [];
   for (const abs of filesAbs) {
     const relPosix = toPosixRelPath(abs, memDirAbs);
     if (shouldExclude2(relPosix, includeTranscripts)) continue;
-    const dstAbs = path3.join(outDirAbs, ...relPosix.split("/"));
-    await mkdir3(path3.dirname(dstAbs), { recursive: true });
-    const content = await readFile3(abs);
-    await writeFile2(dstAbs, content);
+    const dstAbs = path2.join(outDirAbs, ...relPosix.split("/"));
+    await mkdir2(path2.dirname(dstAbs), { recursive: true });
+    const content = await readFile2(abs);
+    await writeFile(dstAbs, content);
     const { sha256, bytes } = await sha256File(abs);
     manifestFiles.push({ path: relPosix, sha256, bytes });
   }
@@ -330,12 +327,12 @@ async function exportMarkdownBundle(opts) {
     includesTranscripts: includeTranscripts,
     files: manifestFiles.sort((a, b) => a.path.localeCompare(b.path))
   };
-  await writeJsonFile(path3.join(outDirAbs, "manifest.json"), manifest);
+  await writeJsonFile(path2.join(outDirAbs, "manifest.json"), manifest);
 }
 async function looksLikeEngramMdExport(fromDir) {
-  const dirAbs = path3.resolve(fromDir);
+  const dirAbs = path2.resolve(fromDir);
   try {
-    const raw = await readFile3(path3.join(dirAbs, "manifest.json"), "utf-8");
+    const raw = await readFile2(path2.join(dirAbs, "manifest.json"), "utf-8");
     const parsed = JSON.parse(raw);
     return parsed.format === EXPORT_FORMAT && parsed.schemaVersion === EXPORT_SCHEMA_VERSION;
   } catch {
@@ -344,16 +341,52 @@ async function looksLikeEngramMdExport(fromDir) {
 }
 
 // src/transfer/backup.ts
-import path4 from "path";
-import { mkdir as mkdir4, readdir as readdir2, rm } from "fs/promises";
+import path3 from "path";
+import { mkdir as mkdir3, readdir, rm, unlink, writeFile as writeFile2 } from "fs/promises";
+import { gzipSync } from "zlib";
 function timestampDirName(now) {
   return now.toISOString().replace(/[:.]/g, "-");
 }
 async function backupMemoryDir(opts) {
-  const outDirAbs = path4.resolve(opts.outDir);
-  await mkdir4(outDirAbs, { recursive: true });
+  const outDirAbs = path3.resolve(opts.outDir);
+  await mkdir3(outDirAbs, { recursive: true });
   const ts = timestampDirName(/* @__PURE__ */ new Date());
-  const backupDir = path4.join(outDirAbs, ts);
+  if (opts.encrypt === true) {
+    const { listFilesRecursive: listFilesRecursive3, toPosixRelPath: toPosixRelPath2 } = await import("./fs-utils-IRVUFB6G.js");
+    const { readFile: readFile12 } = await import("fs/promises");
+    const memoryDirAbs = path3.resolve(opts.memoryDir);
+    const filesAbs = await listFilesRecursive3(memoryDirAbs);
+    const includeTranscripts = opts.includeTranscripts === true;
+    const records = [];
+    for (const abs of filesAbs) {
+      const relPosix = toPosixRelPath2(abs, memoryDirAbs);
+      const parts = relPosix.split("/");
+      if (parts.some((p) => p === "node_modules" || p === ".git" || p === ".secure-store" || p === ".capsules")) continue;
+      if (!includeTranscripts && parts[0] === "transcripts") continue;
+      const content = await readFile12(abs, "utf-8");
+      records.push({ path: relPosix, content });
+    }
+    records.sort((a, b) => a.path.localeCompare(b.path));
+    const bundle = {
+      format: "remnic.backup.v1",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      pluginVersion: opts.pluginVersion,
+      records
+    };
+    const tempGzPath = path3.join(outDirAbs, `${ts}.backup.json.gz`);
+    const gz = gzipSync(Buffer.from(JSON.stringify(bundle), "utf-8"));
+    await writeFile2(tempGzPath, gz);
+    const { encPath } = await encryptCapsuleFile({
+      sourceGzPath: tempGzPath,
+      memoryDir: opts.memoryDir
+    });
+    await unlink(tempGzPath);
+    if (opts.retentionDays && opts.retentionDays > 0) {
+      await enforceRetention(outDirAbs, opts.retentionDays);
+    }
+    return encPath;
+  }
+  const backupDir = path3.join(outDirAbs, ts);
   await exportMarkdownBundle({
     memoryDir: opts.memoryDir,
     outDir: backupDir,
@@ -366,26 +399,39 @@ async function backupMemoryDir(opts) {
   return backupDir;
 }
 async function enforceRetention(outDirAbs, retentionDays) {
-  const entries = await readdir2(outDirAbs, { withFileTypes: true });
+  const entries = await readdir(outDirAbs, { withFileTypes: true });
   const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1e3;
   for (const ent of entries) {
-    if (!ent.isDirectory()) continue;
     const name = ent.name;
-    const m = name.match(
-      /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/
-    );
-    const iso = m ? `${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z` : null;
-    const tsMs = iso ? Date.parse(iso) : NaN;
-    if (!Number.isFinite(tsMs)) continue;
-    if (tsMs < cutoffMs) {
-      await rm(path4.join(outDirAbs, name), { recursive: true, force: true });
+    if (ent.isDirectory()) {
+      const m = name.match(
+        /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/
+      );
+      const iso = m ? `${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z` : null;
+      const tsMs = iso ? Date.parse(iso) : NaN;
+      if (!Number.isFinite(tsMs)) continue;
+      if (tsMs < cutoffMs) {
+        await rm(path3.join(outDirAbs, name), { recursive: true, force: true });
+      }
+      continue;
+    }
+    if (ent.isFile() && name.endsWith(".backup.json.gz.enc")) {
+      const m = name.match(
+        /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z/
+      );
+      const iso = m ? `${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z` : null;
+      const tsMs = iso ? Date.parse(iso) : NaN;
+      if (!Number.isFinite(tsMs)) continue;
+      if (tsMs < cutoffMs) {
+        await rm(path3.join(outDirAbs, name), { force: true });
+      }
     }
   }
 }
 
 // src/transfer/export-sqlite.ts
-import path5 from "path";
-import { readFile as readFile4 } from "fs/promises";
+import path4 from "path";
+import { readFile as readFile3 } from "fs/promises";
 
 // src/transfer/sqlite-schema.ts
 var SQLITE_SCHEMA_VERSION = 1;
@@ -411,8 +457,8 @@ function shouldExclude3(relPosix, includeTranscripts) {
 }
 async function exportSqlite(opts) {
   const includeTranscripts = opts.includeTranscripts === true;
-  const memDirAbs = path5.resolve(opts.memoryDir);
-  const outAbs = path5.resolve(opts.outFile);
+  const memDirAbs = path4.resolve(opts.memoryDir);
+  const outAbs = path4.resolve(opts.outFile);
   const filesAbs = await listFilesRecursive(memDirAbs);
   const db = openBetterSqlite3(outAbs);
   try {
@@ -433,7 +479,7 @@ async function exportSqlite(opts) {
     for (const abs of filesAbs) {
       const relPosix = toPosixRelPath(abs, memDirAbs);
       if (shouldExclude3(relPosix, includeTranscripts)) continue;
-      const content = await readFile4(abs, "utf-8");
+      const content = await readFile3(abs, "utf-8");
       const { sha256, bytes } = await sha256File(abs);
       rows.push({ rel: relPosix, bytes, sha256, content });
     }
@@ -444,55 +490,28 @@ async function exportSqlite(opts) {
 }
 
 // src/transfer/import-json.ts
-import path6 from "path";
-import { mkdir as mkdir5, writeFile as writeFile3 } from "fs/promises";
-
-// src/transfer/types.ts
-import { z } from "zod";
-var ExportManifestV1Schema = z.object({
-  format: z.literal("openclaw-engram-export"),
-  schemaVersion: z.literal(1),
-  createdAt: z.string(),
-  pluginVersion: z.string(),
-  includesTranscripts: z.boolean(),
-  files: z.array(
-    z.object({
-      path: z.string(),
-      sha256: z.string(),
-      bytes: z.number().int().nonnegative()
-    })
-  )
-});
-var ExportMemoryRecordV1Schema = z.object({
-  path: z.string(),
-  content: z.string()
-});
-var ExportBundleV1Schema = z.object({
-  manifest: ExportManifestV1Schema,
-  records: z.array(ExportMemoryRecordV1Schema)
-});
-
-// src/transfer/import-json.ts
+import path5 from "path";
+import { mkdir as mkdir4, writeFile as writeFile3 } from "fs/promises";
 function normalizeForDedupe(s) {
   return s.replace(/\s+/g, " ").trim();
 }
 async function importJsonBundle(opts) {
   const conflict = opts.conflict ?? "skip";
-  const fromDirAbs = path6.resolve(opts.fromDir);
-  const bundlePath = path6.join(fromDirAbs, "bundle.json");
+  const fromDirAbs = path5.resolve(opts.fromDir);
+  const bundlePath = path5.join(fromDirAbs, "bundle.json");
   const bundle = ExportBundleV1Schema.parse(await readJsonFile(bundlePath));
-  const memDirAbs = path6.resolve(opts.targetMemoryDir);
+  const memDirAbs = path5.resolve(opts.targetMemoryDir);
   const written = [];
   let skipped = 0;
   for (const rec of bundle.records) {
     const isWorkspace = rec.path.startsWith("workspace/");
-    const targetBase = isWorkspace ? opts.workspaceDir ? path6.resolve(opts.workspaceDir) : null : memDirAbs;
+    const targetBase = isWorkspace ? opts.workspaceDir ? path5.resolve(opts.workspaceDir) : null : memDirAbs;
     if (isWorkspace && !targetBase) {
       skipped += 1;
       continue;
     }
     const relFs = fromPosixRelPath(isWorkspace ? rec.path.replace(/^workspace\//, "") : rec.path);
-    const absTarget = path6.join(targetBase, relFs);
+    const absTarget = path5.join(targetBase, relFs);
     const exists2 = await fileExists(absTarget);
     if (exists2) {
       if (conflict === "skip") {
@@ -516,29 +535,29 @@ async function importJsonBundle(opts) {
     return { written: 0, skipped };
   }
   for (const w of written) {
-    await mkdir5(path6.dirname(w.abs), { recursive: true });
+    await mkdir4(path5.dirname(w.abs), { recursive: true });
     await writeFile3(w.abs, w.content, "utf-8");
   }
   return { written: written.length, skipped };
 }
 function looksLikeEngramJsonExport(fromDir) {
-  const dir = path6.resolve(fromDir);
+  const dir = path5.resolve(fromDir);
   return Promise.all([
-    fileExists(path6.join(dir, "manifest.json")),
-    fileExists(path6.join(dir, "bundle.json"))
+    fileExists(path5.join(dir, "manifest.json")),
+    fileExists(path5.join(dir, "bundle.json"))
   ]).then(([m, b]) => m && b);
 }
 
 // src/transfer/import-sqlite.ts
-import path7 from "path";
-import { mkdir as mkdir6, writeFile as writeFile4 } from "fs/promises";
+import path6 from "path";
+import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
 function normalizeForDedupe2(s) {
   return s.replace(/\s+/g, " ").trim();
 }
 async function importSqlite(opts) {
   const conflict = opts.conflict ?? "skip";
-  const memDirAbs = path7.resolve(opts.targetMemoryDir);
-  const fromAbs = path7.resolve(opts.fromFile);
+  const memDirAbs = path6.resolve(opts.targetMemoryDir);
+  const fromAbs = path6.resolve(opts.fromFile);
   const db = openBetterSqlite3(fromAbs, { readonly: true });
   const written = [];
   let skipped = 0;
@@ -551,7 +570,7 @@ async function importSqlite(opts) {
     const rows = db.prepare("SELECT path_rel, content FROM files").all();
     for (const r of rows) {
       const relFs = fromPosixRelPath(r.path_rel);
-      const absTarget = path7.join(memDirAbs, relFs);
+      const absTarget = path6.join(memDirAbs, relFs);
       const exists2 = await fileExists(absTarget);
       if (exists2) {
         if (conflict === "skip") {
@@ -576,30 +595,30 @@ async function importSqlite(opts) {
   }
   if (opts.dryRun) return { written: 0, skipped };
   for (const w of written) {
-    await mkdir6(path7.dirname(w.abs), { recursive: true });
+    await mkdir5(path6.dirname(w.abs), { recursive: true });
     await writeFile4(w.abs, w.content, "utf-8");
   }
   return { written: written.length, skipped };
 }
 
 // src/transfer/import-md.ts
-import path8 from "path";
-import { mkdir as mkdir7, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import path7 from "path";
+import { mkdir as mkdir6, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
 function normalizeForDedupe3(s) {
   return s.replace(/\s+/g, " ").trim();
 }
 async function importMarkdownBundle(opts) {
   const conflict = opts.conflict ?? "skip";
-  const fromAbs = path8.resolve(opts.fromDir);
-  const targetAbs = path8.resolve(opts.targetMemoryDir);
+  const fromAbs = path7.resolve(opts.fromDir);
+  const targetAbs = path7.resolve(opts.targetMemoryDir);
   const filesAbs = await listFilesRecursive(fromAbs);
   const writes = [];
   let skipped = 0;
   for (const abs of filesAbs) {
     const relPosix = toPosixRelPath(abs, fromAbs);
     if (relPosix === "manifest.json") continue;
-    const dstAbs = path8.join(targetAbs, fromPosixRelPath(relPosix));
-    const content = await readFile5(abs, "utf-8");
+    const dstAbs = path7.join(targetAbs, fromPosixRelPath(relPosix));
+    const content = await readFile4(abs, "utf-8");
     const exists2 = await fileExists(dstAbs);
     if (exists2) {
       if (conflict === "skip") {
@@ -621,20 +640,20 @@ async function importMarkdownBundle(opts) {
   }
   if (opts.dryRun) return { written: 0, skipped };
   for (const w of writes) {
-    await mkdir7(path8.dirname(w.abs), { recursive: true });
+    await mkdir6(path7.dirname(w.abs), { recursive: true });
     await writeFile5(w.abs, w.content, "utf-8");
   }
   return { written: writes.length, skipped };
 }
 
 // src/transfer/autodetect.ts
-import path9 from "path";
-import { stat as stat2 } from "fs/promises";
+import path8 from "path";
+import { stat } from "fs/promises";
 async function detectImportFormat(fromPath) {
-  const abs = path9.resolve(fromPath);
+  const abs = path8.resolve(fromPath);
   let st;
   try {
-    st = await stat2(abs);
+    st = await stat(abs);
   } catch {
     return null;
   }
@@ -1059,8 +1078,8 @@ function gatherCandidates(input, warnings) {
       const record = rec;
       const content = typeof record.content === "string" ? record.content : null;
       if (!content) continue;
-      const path20 = typeof record.path === "string" ? record.path : "";
-      if (!path20.startsWith("transcripts/") && !path20.includes("/transcripts/")) continue;
+      const path19 = typeof record.path === "string" ? record.path : "";
+      if (!path19.startsWith("transcripts/") && !path19.includes("/transcripts/")) continue;
       rows.push(...parseJsonl(content, warnings));
     }
     return rows;
@@ -1277,8 +1296,8 @@ async function runBulkImportPipeline(source, options = {}, processBatch) {
 }
 
 // src/maintenance/archive-observations.ts
-import path10 from "path";
-import { mkdir as mkdir8, readdir as readdir3, readFile as readFile6, unlink, writeFile as writeFile6 } from "fs/promises";
+import path9 from "path";
+import { mkdir as mkdir7, readdir as readdir2, readFile as readFile5, unlink as unlink2, writeFile as writeFile6 } from "fs/promises";
 var DATE_FILE_PATTERN = /^(\d{4})-(\d{2})-(\d{2})\.(jsonl|md)$/;
 function normalizeRetentionDays(value) {
   if (!Number.isFinite(value)) return 30;
@@ -1299,13 +1318,13 @@ async function listFilesRecursive2(root, relPrefix = "") {
   const out = [];
   let entries;
   try {
-    entries = await readdir3(root, { withFileTypes: true });
+    entries = await readdir2(root, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const entry of entries) {
-    const rel = relPrefix ? path10.join(relPrefix, entry.name) : entry.name;
-    const full = path10.join(root, entry.name);
+    const rel = relPrefix ? path9.join(relPrefix, entry.name) : entry.name;
+    const full = path9.join(root, entry.name);
     if (entry.isDirectory()) {
       out.push(...await listFilesRecursive2(full, rel));
       continue;
@@ -1315,19 +1334,19 @@ async function listFilesRecursive2(root, relPrefix = "") {
   return out;
 }
 async function collectArchiveCandidates(memoryDir, cutoffTimeMs) {
-  const roots = ["transcripts", path10.join("state", "tool-usage"), path10.join("summaries", "hourly")];
+  const roots = ["transcripts", path9.join("state", "tool-usage"), path9.join("summaries", "hourly")];
   const out = [];
   for (const relRoot of roots) {
-    const absRoot = path10.join(memoryDir, relRoot);
+    const absRoot = path9.join(memoryDir, relRoot);
     const files = await listFilesRecursive2(absRoot);
     for (const fileRel of files) {
-      const filename = path10.basename(fileRel);
+      const filename = path9.basename(fileRel);
       const parsedDate = extractDateFromFilename(filename);
       if (!parsedDate) continue;
       if (parsedDate.getTime() >= cutoffTimeMs) continue;
       out.push({
-        absolutePath: path10.join(absRoot, fileRel),
-        relativePath: path10.join(relRoot, fileRel)
+        absolutePath: path9.join(absRoot, fileRel),
+        relativePath: path9.join(relRoot, fileRel)
       });
     }
   }
@@ -1342,7 +1361,7 @@ async function archiveObservations(options) {
     new Date(now.getTime() - retentionDays * 24 * 60 * 60 * 1e3)
   );
   const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
-  const archiveRoot = path10.join(options.memoryDir, "archive", "observations", stamp);
+  const archiveRoot = path9.join(options.memoryDir, "archive", "observations", stamp);
   const candidates = retentionDays === 0 ? [] : await collectArchiveCandidates(
     options.memoryDir,
     cutoffDayStartUtc
@@ -1351,14 +1370,14 @@ async function archiveObservations(options) {
   let archivedBytes = 0;
   const archivedRelativePaths = [];
   if (!dryRun && candidates.length > 0) {
-    await mkdir8(archiveRoot, { recursive: true });
+    await mkdir7(archiveRoot, { recursive: true });
     for (const candidate of candidates) {
-      const archivePath = path10.join(archiveRoot, candidate.relativePath);
-      const archiveDir = path10.dirname(archivePath);
-      await mkdir8(archiveDir, { recursive: true });
-      const raw = await readFile6(candidate.absolutePath);
+      const archivePath = path9.join(archiveRoot, candidate.relativePath);
+      const archiveDir = path9.dirname(archivePath);
+      await mkdir7(archiveDir, { recursive: true });
+      const raw = await readFile5(candidate.absolutePath);
       await writeFile6(archivePath, raw);
-      await unlink(candidate.absolutePath);
+      await unlink2(candidate.absolutePath);
       archivedFiles += 1;
       archivedBytes += raw.byteLength;
       archivedRelativePaths.push(candidate.relativePath);
@@ -1378,8 +1397,8 @@ async function archiveObservations(options) {
 }
 
 // src/maintenance/rebuild-memory-lifecycle-ledger.ts
-import path11 from "path";
-import { mkdir as mkdir9, rename, stat as stat3, writeFile as writeFile7 } from "fs/promises";
+import path10 from "path";
+import { mkdir as mkdir8, rename, stat as stat2, writeFile as writeFile7 } from "fs/promises";
 
 // src/maintenance/backup-stamp.ts
 function toBackupStamp(now) {
@@ -1389,11 +1408,11 @@ function toBackupStamp(now) {
 // src/maintenance/rebuild-memory-lifecycle-ledger.ts
 async function backupExistingLedger(memoryDir, outputPath, now) {
   try {
-    await stat3(outputPath);
+    await stat2(outputPath);
   } catch {
     return void 0;
   }
-  const backupPath = path11.join(
+  const backupPath = path10.join(
     memoryDir,
     "archive",
     "memory-lifecycle-ledger",
@@ -1401,14 +1420,14 @@ async function backupExistingLedger(memoryDir, outputPath, now) {
     "state",
     "memory-lifecycle-ledger.jsonl"
   );
-  await mkdir9(path11.dirname(backupPath), { recursive: true });
+  await mkdir8(path10.dirname(backupPath), { recursive: true });
   await rename(outputPath, backupPath);
   return backupPath;
 }
 async function rebuildMemoryLifecycleLedger(options) {
   const dryRun = options.dryRun !== false;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const outputPath = path11.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
+  const outputPath = path10.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
   const storage = new StorageManager(options.memoryDir);
   const allMemories = [...await storage.readAllMemories(), ...await storage.readArchivedMemories()].sort((a, b) => a.frontmatter.id.localeCompare(b.frontmatter.id));
   const events = sortMemoryLifecycleEvents(
@@ -1417,7 +1436,7 @@ async function rebuildMemoryLifecycleLedger(options) {
   let backupPath;
   if (!dryRun) {
     backupPath = await backupExistingLedger(options.memoryDir, outputPath, now);
-    await mkdir9(path11.dirname(outputPath), { recursive: true });
+    await mkdir8(path10.dirname(outputPath), { recursive: true });
     const payload = events.map((event) => JSON.stringify(event)).join("\n");
     await writeFile7(outputPath, payload.length > 0 ? `${payload}
 ` : "", "utf-8");
@@ -1432,15 +1451,15 @@ async function rebuildMemoryLifecycleLedger(options) {
 }
 
 // src/maintenance/rebuild-memory-projection.ts
-import path12 from "path";
-import { mkdir as mkdir10, rename as rename2, rm as rm2, stat as stat4 } from "fs/promises";
+import path11 from "path";
+import { mkdir as mkdir9, rename as rename2, rm as rm2, stat as stat3 } from "fs/promises";
 async function backupExistingProjection(memoryDir, outputPath, now) {
   try {
-    await stat4(outputPath);
+    await stat3(outputPath);
   } catch {
     return void 0;
   }
-  const backupPath = path12.join(
+  const backupPath = path11.join(
     memoryDir,
     "archive",
     "memory-projection",
@@ -1448,7 +1467,7 @@ async function backupExistingProjection(memoryDir, outputPath, now) {
     "state",
     "memory-projection.sqlite"
   );
-  await mkdir10(path12.dirname(backupPath), { recursive: true });
+  await mkdir9(path11.dirname(backupPath), { recursive: true });
   await rename2(outputPath, backupPath);
   return backupPath;
 }
@@ -2132,7 +2151,7 @@ async function rebuildMemoryProjection(options) {
       }
     }
     const tempPath = `${outputPath}.tmp`;
-    await mkdir10(path12.dirname(outputPath), { recursive: true });
+    await mkdir9(path11.dirname(outputPath), { recursive: true });
     await rm2(tempPath, { force: true });
     writeProjectionDb(
       tempPath,
@@ -2304,12 +2323,12 @@ async function repairMemoryProjection(options) {
 }
 
 // src/maintenance/rebuild-observations.ts
-import path14 from "path";
-import { readdir as readdir4, readFile as readFile8 } from "fs/promises";
+import path13 from "path";
+import { readdir as readdir3, readFile as readFile7 } from "fs/promises";
 
 // src/maintenance/observation-ledger-utils.ts
-import path13 from "path";
-import { mkdir as mkdir11, readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
+import path12 from "path";
+import { mkdir as mkdir10, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
 function toHourBucketIso(timestamp) {
   const normalized = /(?:Z|[+-]\d{2}:\d{2})$/u.test(timestamp) ? timestamp : `${timestamp}Z`;
   const ms = Date.parse(normalized);
@@ -2320,16 +2339,16 @@ function toHourBucketIso(timestamp) {
 }
 async function backupAndWriteRebuiltObservations(options) {
   const stamp = options.now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
-  const archiveRoot = path13.join(options.memoryDir, "archive", "observations", stamp);
-  let backupPath = path13.join(
+  const archiveRoot = path12.join(options.memoryDir, "archive", "observations", stamp);
+  let backupPath = path12.join(
     archiveRoot,
     "state",
     "observation-ledger",
     "rebuilt-observations.jsonl"
   );
   try {
-    const existing = await readFile7(options.outputPath, "utf-8");
-    await mkdir11(path13.dirname(backupPath), { recursive: true });
+    const existing = await readFile6(options.outputPath, "utf-8");
+    await mkdir10(path12.dirname(backupPath), { recursive: true });
     await writeFile8(backupPath, existing, "utf-8");
   } catch (err) {
     const code = err.code;
@@ -2346,7 +2365,7 @@ async function backupAndWriteRebuiltObservations(options) {
       rebuiltAt
     })
   );
-  await mkdir11(path13.dirname(options.outputPath), { recursive: true });
+  await mkdir10(path12.dirname(options.outputPath), { recursive: true });
   await writeFile8(options.outputPath, lines.length > 0 ? `${lines.join("\n")}
 ` : "", "utf-8");
   return backupPath;
@@ -2360,7 +2379,7 @@ async function listTranscriptFiles(root) {
   const out = [];
   let entries;
   try {
-    entries = await readdir4(root, { withFileTypes: true });
+    entries = await readdir3(root, { withFileTypes: true });
   } catch (err) {
     const code = err.code;
     if (code && code === "ENOENT") return out;
@@ -2369,7 +2388,7 @@ async function listTranscriptFiles(root) {
   for (const entry of entries) {
     if (entry.name === "." || entry.name === "..") continue;
     if (entry.isSymbolicLink()) continue;
-    const full = path14.join(root, entry.name);
+    const full = path13.join(root, entry.name);
     if (entry.isDirectory()) {
       out.push(...await listTranscriptFiles(full));
       continue;
@@ -2429,8 +2448,8 @@ function buildLedgerRows(linesByFile) {
 async function rebuildObservations(options) {
   const dryRun = options.dryRun !== false;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const transcriptsRoot = path14.join(options.memoryDir, "transcripts");
-  const outputPath = path14.join(
+  const transcriptsRoot = path13.join(options.memoryDir, "transcripts");
+  const outputPath = path13.join(
     options.memoryDir,
     "state",
     "observation-ledger",
@@ -2440,7 +2459,7 @@ async function rebuildObservations(options) {
   const contents = [];
   for (const file of transcriptFiles) {
     try {
-      contents.push(await readFile8(file, "utf-8"));
+      contents.push(await readFile7(file, "utf-8"));
     } catch {
     }
   }
@@ -2466,8 +2485,8 @@ async function rebuildObservations(options) {
 }
 
 // src/maintenance/migrate-observations.ts
-import path15 from "path";
-import { readdir as readdir5, readFile as readFile9 } from "fs/promises";
+import path14 from "path";
+import { readdir as readdir4, readFile as readFile8 } from "fs/promises";
 function toNonNegativeInt(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return null;
   const normalized = Math.floor(value);
@@ -2518,7 +2537,7 @@ function toCounts(row) {
 async function listLegacyObservationFiles(root) {
   let entries;
   try {
-    entries = await readdir5(root, { withFileTypes: true });
+    entries = await readdir4(root, { withFileTypes: true });
   } catch (err) {
     const code = err.code;
     if (code && code === "ENOENT") return [];
@@ -2530,16 +2549,16 @@ async function listLegacyObservationFiles(root) {
 async function migrateObservations(options) {
   const dryRun = options.dryRun !== false;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const ledgerRoot = path15.join(options.memoryDir, "state", "observation-ledger");
-  const outputPath = path15.join(ledgerRoot, "rebuilt-observations.jsonl");
+  const ledgerRoot = path14.join(options.memoryDir, "state", "observation-ledger");
+  const outputPath = path14.join(ledgerRoot, "rebuilt-observations.jsonl");
   const legacyFiles = await listLegacyObservationFiles(ledgerRoot);
-  const sourceRelativePaths = legacyFiles.map((name) => path15.join("state", "observation-ledger", name));
+  const sourceRelativePaths = legacyFiles.map((name) => path14.join("state", "observation-ledger", name));
   const byKey = /* @__PURE__ */ new Map();
   let parsedRows = 0;
   let malformedLines = 0;
   for (const file of legacyFiles) {
-    const full = path15.join(ledgerRoot, file);
-    const raw = await readFile9(full, "utf-8");
+    const full = path14.join(ledgerRoot, file);
+    const raw = await readFile8(full, "utf-8");
     for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
       let parsed;
@@ -2616,7 +2635,7 @@ async function migrateObservations(options) {
 }
 
 // src/network/tailscale.ts
-import { stat as stat5 } from "fs/promises";
+import { stat as stat4 } from "fs/promises";
 var TailscaleHelper = class {
   tailscaleBinary;
   rsyncBinary;
@@ -2680,7 +2699,7 @@ var TailscaleHelper = class {
   }
 };
 async function assertReadableDirectory(dir) {
-  const info = await stat5(dir);
+  const info = await stat4(dir);
   if (!info.isDirectory()) {
     throw new Error(`sourceDir must be a directory: ${dir}`);
   }
@@ -2731,10 +2750,10 @@ var defaultCommandRunner = (command, args, options) => {
 
 // src/network/webdav.ts
 import { createReadStream } from "fs";
-import { mkdir as mkdir12, readdir as readdir6, realpath, stat as stat6 } from "fs/promises";
+import { mkdir as mkdir11, readdir as readdir5, realpath, stat as stat5 } from "fs/promises";
 import { createServer } from "http";
 import { timingSafeEqual } from "crypto";
-import path16 from "path";
+import path15 from "path";
 import { pipeline } from "stream/promises";
 import { URL as URL2 } from "url";
 function hostToUrlAuthority(host) {
@@ -2770,10 +2789,10 @@ var WebDavServer = class _WebDavServer {
     const allowedRoots = [];
     const aliasSet = /* @__PURE__ */ new Set();
     for (const dir of options.allowlistDirs) {
-      const resolved = path16.resolve(dir);
-      await mkdir12(resolved, { recursive: true });
+      const resolved = path15.resolve(dir);
+      await mkdir11(resolved, { recursive: true });
       const canonical = await realpath(resolved);
-      const alias = path16.basename(canonical) || "root";
+      const alias = path15.basename(canonical) || "root";
       if (aliasSet.has(alias)) {
         throw new Error(`duplicate webdav allowlist alias: ${alias}`);
       }
@@ -2929,7 +2948,7 @@ var WebDavServer = class _WebDavServer {
     if (decodedPath.includes("\0")) {
       return { ok: false, code: 400, message: "invalid path" };
     }
-    const normalized = path16.posix.normalize(decodedPath);
+    const normalized = path15.posix.normalize(decodedPath);
     const segments = normalized.split("/").filter((segment) => segment.length > 0);
     if (segments.length === 0) {
       return { ok: false, code: 403, message: "root listing is not allowed" };
@@ -2943,7 +2962,7 @@ var WebDavServer = class _WebDavServer {
     if (relative.some((segment) => segment === ".." || segment.includes("\\"))) {
       return { ok: false, code: 403, message: "path traversal is not allowed" };
     }
-    const candidate = path16.resolve(root.absolute, ...relative);
+    const candidate = path15.resolve(root.absolute, ...relative);
     if (!this.isPathInside(root.absolute, candidate)) {
       return { ok: false, code: 403, message: "path escaped allowlist" };
     }
@@ -2967,7 +2986,7 @@ var WebDavServer = class _WebDavServer {
   async handleRead(method, absolutePath, res) {
     let info;
     try {
-      info = await stat6(absolutePath);
+      info = await stat5(absolutePath);
     } catch {
       res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
       res.end("not found");
@@ -2991,7 +3010,7 @@ var WebDavServer = class _WebDavServer {
   async handlePropfind(absolutePath, displayPath, res) {
     let info;
     try {
-      info = await stat6(absolutePath);
+      info = await stat5(absolutePath);
     } catch {
       res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
       res.end("not found");
@@ -2999,7 +3018,7 @@ var WebDavServer = class _WebDavServer {
     }
     const entries = [];
     if (info.isDirectory()) {
-      const children = await readdir6(absolutePath, { withFileTypes: true });
+      const children = await readdir5(absolutePath, { withFileTypes: true });
       for (const child of children) {
         const childHref = toEncodedHref(`${displayPath.replace(/\/$/, "")}/${child.name}`);
         entries.push(`
@@ -3021,10 +3040,10 @@ var WebDavServer = class _WebDavServer {
   }
   isPathInside(root, target) {
     if (target === root) return true;
-    if (root === path16.parse(root).root) {
+    if (root === path15.parse(root).root) {
       return target.startsWith(root);
     }
-    return target.startsWith(`${root}${path16.sep}`);
+    return target.startsWith(`${root}${path15.sep}`);
   }
 };
 function xmlEscape(value) {
@@ -3035,8 +3054,8 @@ function toEncodedHref(pathname) {
 }
 
 // src/compat/checks.ts
-import { access, readFile as readFile10 } from "fs/promises";
-import path17 from "path";
+import { access, readFile as readFile9 } from "fs/promises";
+import path16 from "path";
 var REQUIRED_HOOKS_LEGACY = ["before_agent_start", "agent_end"];
 var REQUIRED_HOOKS_NEW = ["before_prompt_build", "agent_end"];
 function isSafeCommandToken(command) {
@@ -3211,13 +3230,13 @@ function parseCurrentNodeVersion(raw) {
 async function runCompatChecks(options) {
   const checks = [];
   const runner = options.runner ?? defaultRunner;
-  const pluginJsonPath = path17.join(options.repoRoot, "openclaw.plugin.json");
-  const packageJsonPath = path17.join(options.repoRoot, "package.json");
-  const indexPath = path17.join(options.repoRoot, "src", "index.ts");
+  const pluginJsonPath = path16.join(options.repoRoot, "openclaw.plugin.json");
+  const packageJsonPath = path16.join(options.repoRoot, "package.json");
+  const indexPath = path16.join(options.repoRoot, "src", "index.ts");
   let pluginRaw = "";
   let pluginManifestPresent = false;
   try {
-    pluginRaw = await readFile10(pluginJsonPath, "utf-8");
+    pluginRaw = await readFile9(pluginJsonPath, "utf-8");
     pluginManifestPresent = true;
     checks.push({
       id: "plugin-manifest-present",
@@ -3267,7 +3286,7 @@ async function runCompatChecks(options) {
   let packageRaw = "";
   let packageJsonPresent = false;
   try {
-    packageRaw = await readFile10(packageJsonPath, "utf-8");
+    packageRaw = await readFile9(packageJsonPath, "utf-8");
     packageJsonPresent = true;
   } catch {
     checks.push({
@@ -3338,7 +3357,7 @@ async function runCompatChecks(options) {
   }
   try {
     await access(indexPath);
-    const indexRaw = await readFile10(indexPath, "utf-8");
+    const indexRaw = await readFile9(indexPath, "utf-8");
     const structuralSource = stripCommentsAndStrings(indexRaw);
     const hooks = parseHookRegistrations(indexRaw);
     const missingLegacy = REQUIRED_HOOKS_LEGACY.filter((hook) => !hooks.has(hook));
@@ -3405,8 +3424,8 @@ async function runCompatChecks(options) {
 }
 
 // src/training-export/converter.ts
-import { lstat, readdir as readdir7, readFile as readFile11, realpath as realpath2 } from "fs/promises";
-import path18 from "path";
+import { lstat, readdir as readdir6, readFile as readFile10, realpath as realpath2 } from "fs/promises";
+import path17 from "path";
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
   if (!match) return null;
@@ -3457,13 +3476,13 @@ async function collectMarkdownFiles(dir, containmentRoot) {
     if (dStat.isSymbolicLink()) return;
     let entries;
     try {
-      entries = await readdir7(d, { withFileTypes: true });
+      entries = await readdir6(d, { withFileTypes: true });
     } catch {
       return;
     }
     const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of sorted) {
-      const full = path18.join(d, entry.name);
+      const full = path17.join(d, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         await walk(full);
@@ -3477,7 +3496,7 @@ async function collectMarkdownFiles(dir, containmentRoot) {
         if (st.nlink > 1) continue;
         const real = await safeRealpath(full);
         if (!real) continue;
-        if (real !== containmentRoot && !real.startsWith(containmentRoot + path18.sep)) {
+        if (real !== containmentRoot && !real.startsWith(containmentRoot + path17.sep)) {
           continue;
         }
         files.push(full);
@@ -3527,11 +3546,11 @@ async function convertMemoriesToRecords(options) {
   const { memoryDir } = options;
   const containmentRoot = await safeRealpath(memoryDir);
   if (!containmentRoot) return [];
-  const factsDir = path18.join(memoryDir, "facts");
-  const correctionsDir = path18.join(memoryDir, "corrections");
+  const factsDir = path17.join(memoryDir, "facts");
+  const correctionsDir = path17.join(memoryDir, "corrections");
   const dirs = [factsDir, correctionsDir];
   if (options.includeEntities) {
-    dirs.push(path18.join(memoryDir, "entities"));
+    dirs.push(path17.join(memoryDir, "entities"));
   }
   const allFiles = [];
   for (const dir of dirs) {
@@ -3542,7 +3561,7 @@ async function convertMemoriesToRecords(options) {
   for (const filePath of allFiles) {
     let raw;
     try {
-      raw = await readFile11(filePath, "utf-8");
+      raw = await readFile10(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -3580,55 +3599,6 @@ async function convertMemoriesToRecords(options) {
   return records;
 }
 
-// src/training-export/date-parse.ts
-var DAYS_IN_MONTH = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-function isLeapYear(year) {
-  return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
-}
-function isCalendarDateValid(year, month, day) {
-  if (!Number.isInteger(year) || !Number.isInteger(month) || !Number.isInteger(day)) {
-    return false;
-  }
-  if (month < 1 || month > 12) return false;
-  if (day < 1) return false;
-  const maxDay = month === 2 && isLeapYear(year) ? 29 : DAYS_IN_MONTH[month];
-  return day <= maxDay;
-}
-function parseStrictCliDate(value, flagName) {
-  const shape = /^(\d{4})-(\d{2})-(\d{2})(?:T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|[+-]\d{2}:\d{2})?)?$/;
-  const match = value.match(shape);
-  if (!match) {
-    throw new Error(
-      `Invalid ${flagName} value "${value}": expected ISO 8601 format (YYYY-MM-DD or YYYY-MM-DDTHH:mm:ss[.sss][Z|\xB1HH:MM]).`
-    );
-  }
-  const year = Number(match[1]);
-  const month = Number(match[2]);
-  const day = Number(match[3]);
-  if (!isCalendarDateValid(year, month, day)) {
-    throw new Error(
-      `Invalid ${flagName} value "${value}": date components overflow (e.g. month has fewer days). Provide a valid calendar date.`
-    );
-  }
-  if (match[4] !== void 0) {
-    const hour = Number(match[4]);
-    const minute = Number(match[5]);
-    const second = match[6] !== void 0 ? Number(match[6]) : 0;
-    if (hour > 23 || minute > 59 || second > 59) {
-      throw new Error(
-        `Invalid ${flagName} value "${value}": time components out of range.`
-      );
-    }
-  }
-  const d = new Date(value);
-  if (!Number.isFinite(d.getTime())) {
-    throw new Error(
-      `Invalid ${flagName} value "${value}". Provide an ISO 8601 date string (YYYY-MM-DD or YYYY-MM-DDTHH:mm:ss).`
-    );
-  }
-  return d;
-}
-
 // src/training-export/registry.ts
 var adapters2 = /* @__PURE__ */ new Map();
 function registerTrainingExportAdapter(adapter) {
@@ -4114,6 +4084,19 @@ async function runVerifiedRecallSearchCliCommand(options) {
     boxRecallDays: options.boxRecallDays
   });
 }
+function isNormalRetrievalVisibleMemory(memory) {
+  return memory.frontmatter.status !== "forgotten";
+}
+async function filterNormalMemorySearchResults(results, storage) {
+  const filtered = [];
+  for (const result of results) {
+    if (!result.path) continue;
+    const memory = await storage.readMemoryByPath(result.path);
+    if (!memory || !isNormalRetrievalVisibleMemory(memory)) continue;
+    filtered.push(result);
+  }
+  return filtered;
+}
 async function runSemanticRulePromoteCliCommand(options) {
   return promoteSemanticRuleFromMemory({
     memoryDir: options.memoryDir,
@@ -4123,7 +4106,7 @@ async function runSemanticRulePromoteCliCommand(options) {
   });
 }
 async function runCompoundingPromoteCliCommand(options) {
-  const { CompoundingEngine } = await import("./engine-F3GOXGE5.js");
+  const { CompoundingEngine } = await import("./engine-ICC2DSQF.js");
   const config = parseConfig({
     memoryDir: options.memoryDir,
     qmdEnabled: false,
@@ -4537,10 +4520,10 @@ function effectivePolicyValuesForVersion(values, config) {
 }
 function policyVersionForValues(values, config) {
   const normalized = effectivePolicyValuesForVersion(values, config);
-  return createHash2("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 12);
+  return createHash("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 12);
 }
 async function readRuntimePolicySnapshot2(config, fileName) {
-  const filePath = path19.join(config.memoryDir, "state", fileName);
+  const filePath = path18.join(config.memoryDir, "state", fileName);
   const snapshot = await readRuntimePolicySnapshot(filePath, {
     maxStaleDecayThreshold: config.lifecycleArchiveDecayThreshold
   });
@@ -4568,6 +4551,38 @@ function parseSinceDurationMs(since) {
   if (unit === "h") return amount * 60 * 60 * 1e3;
   return amount * 24 * 60 * 60 * 1e3;
 }
+function parseDurationToMs(raw) {
+  const trimmed = raw.trim();
+  if (/^\d+$/.test(trimmed)) {
+    const days = Number.parseInt(trimmed, 10);
+    return Number.isFinite(days) && days > 0 ? days * 864e5 : null;
+  }
+  const iso = trimmed.toUpperCase();
+  if (!iso.startsWith("P")) return null;
+  const match = /^P(?:(\d+)Y)?(?:(\d+)M)?(?:(\d+)W)?(?:(\d+)D)?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?)?$/.exec(iso);
+  if (!match || match[1] === void 0 && match[2] === void 0 && match[3] === void 0 && match[4] === void 0 && match[5] === void 0 && match[6] === void 0 && match[7] === void 0) {
+    return null;
+  }
+  if (iso.includes("T") && match[5] === void 0 && match[6] === void 0 && match[7] === void 0) {
+    return null;
+  }
+  let totalMs = 0;
+  if (match[1]) totalMs += Number.parseInt(match[1], 10) * 365 * 864e5;
+  if (match[2]) totalMs += Number.parseInt(match[2], 10) * 30 * 864e5;
+  if (match[3]) totalMs += Number.parseInt(match[3], 10) * 7 * 864e5;
+  if (match[4]) totalMs += Number.parseInt(match[4], 10) * 864e5;
+  if (match[5]) totalMs += Number.parseInt(match[5], 10) * 60 * 60 * 1e3;
+  if (match[6]) totalMs += Number.parseInt(match[6], 10) * 60 * 1e3;
+  if (match[7]) totalMs += Number.parseInt(match[7], 10) * 1e3;
+  return Number.isFinite(totalMs) && totalMs > 0 ? totalMs : null;
+}
+var NON_FATAL_PURGE_ERROR_IDS = /* @__PURE__ */ new Set([
+  "(purge-audit)",
+  "(fact-hash-index)"
+]);
+function hasDestructivePurgeFailures(errors) {
+  return errors.some((error) => !NON_FATAL_PURGE_ERROR_IDS.has(error.id));
+}
 function resolvePolicySignalNamespaces(orchestrator) {
   const names = /* @__PURE__ */ new Set([orchestrator.config.defaultNamespace]);
   if (orchestrator.config.namespacesEnabled) {
@@ -5097,7 +5112,7 @@ async function withTimeout(promise, timeoutMs, timeoutMessage) {
 }
 async function runReplayCliCommand(orchestrator, options) {
   const extractionIdleTimeoutMs = Number.isFinite(options.extractionIdleTimeoutMs) ? Math.max(1e3, Math.floor(options.extractionIdleTimeoutMs)) : 15 * 6e4;
-  const inputRaw = await readFile12(options.inputPath, "utf-8");
+  const inputRaw = await readFile11(options.inputPath, "utf-8");
   const registry = buildReplayNormalizerRegistry([
     openclawReplayNormalizer,
     claudeReplayNormalizer,
@@ -5189,7 +5204,7 @@ async function runBulkImportCliCommand(opts) {
       "Bulk import persistence is not wired: no ingestBatch callback was provided by the host CLI. Use --dry-run to validate without persisting, or invoke via `openclaw engram bulk-import` which supplies the orchestrator-backed ingestion path."
     );
   }
-  const inputRaw = await readFile12(opts.file, "utf-8");
+  const inputRaw = await readFile11(opts.file, "utf-8");
   let inputParsed;
   try {
     inputParsed = JSON.parse(inputRaw);
@@ -5253,7 +5268,7 @@ async function runBulkImportCliCommand(opts) {
 async function getPluginVersion() {
   try {
     const pkgPath = new URL("../package.json", import.meta.url);
-    const raw = await readFile12(pkgPath, "utf-8");
+    const raw = await readFile11(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     return parsed.version ?? "unknown";
   } catch {
@@ -5277,24 +5292,24 @@ async function resolveMemoryDirForNamespace(orchestrator, namespace, options) {
     }
     return orchestrator.config.memoryDir;
   }
-  const candidate = path19.join(orchestrator.config.memoryDir, "namespaces", ns);
+  const candidate = path18.join(orchestrator.config.memoryDir, "namespaces", ns);
   if (ns === orchestrator.config.defaultNamespace) {
     return await exists(candidate) ? candidate : orchestrator.config.memoryDir;
   }
   return candidate;
 }
 async function walkMemoryMarkdownFiles(memoryDir, visit) {
-  const roots = [path19.join(memoryDir, "facts"), path19.join(memoryDir, "corrections")];
+  const roots = [path18.join(memoryDir, "facts"), path18.join(memoryDir, "corrections")];
   const walk = async (dir) => {
     let entries;
     try {
-      entries = await readdir8(dir, { withFileTypes: true });
+      entries = await readdir7(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       const entryName = typeof entry.name === "string" ? entry.name : entry.name.toString("utf-8");
-      const fullPath = path19.join(dir, entryName);
+      const fullPath = path18.join(dir, entryName);
       if (entry.isDirectory()) {
         await walk(fullPath);
         continue;
@@ -5318,7 +5333,7 @@ async function readAllMemoryFiles(memoryDir) {
   const out = [];
   await walkMemoryMarkdownFiles(memoryDir, async (fullPath) => {
     try {
-      const raw = await readFile12(fullPath, "utf-8");
+      const raw = await readFile11(fullPath, "utf-8");
       const parsed = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
       if (!parsed) return;
       const fmRaw = parsed[1];
@@ -5502,7 +5517,7 @@ function buildConversationIndexRebuildAction(orchestrator) {
     console.log("OK");
   };
 }
-function registerCli(api, orchestrator) {
+function registerCli(api, orchestrator, registerOptions = {}) {
   api.registerCli(
     ({ program }) => {
       const cmd = program.command("engram").description("Engram local memory commands");
@@ -5628,55 +5643,258 @@ function registerCli(api, orchestrator) {
         }
         if (!reportHasMachineReadableOutput(options)) console.log("OK");
       });
-      cmd.command("config-review").description("Review Engram config defaults, recommendations, and contradictory settings").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+      const tierCmd = cmd.command("tier").description(
+        "Tier-distribution visibility (issue #686). `tier list` summarizes hot/cold counts and per-status breakdown; `tier explain <id>` shows the value-score components and tier-transition decision for a single memory."
+      );
+      tierCmd.command("list").description("Summarize tier distribution across all memories").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
-        const report = await runOperatorConfigReview({ orchestrator });
+        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-62ZVDFKS.js");
+        const summary = await summarizeTiers(orchestrator.storage);
         if (reportHasMachineReadableOutput(options)) {
-          console.log(JSON.stringify(report, null, 2));
+          console.log(JSON.stringify(summary, null, 2));
         } else {
-          console.log(formatOperatorConfigReviewCli(report));
+          console.log(formatTierSummaryText(summary));
         }
-        if (!report.ok) {
+      });
+      tierCmd.command("explain").description("Explain the tier-transition decision for a single memory").argument("<id>", "Memory id to explain").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const idArg = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-62ZVDFKS.js");
+        try {
+          const explain = await explainTierForMemory(
+            orchestrator.storage,
+            idArg,
+            orchestrator.config
+          );
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify(explain, null, 2));
+          } else {
+            console.log(formatTierExplainText(explain));
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+          } else {
+            console.error(
+              message.startsWith("tier explain:") ? message : `tier explain: ${message}`
+            );
+          }
           process.exitCode = 1;
-          return;
         }
-        if (!reportHasMachineReadableOutput(options)) console.log("OK");
       });
-      cmd.command("inventory").description("Report namespace, memory, review, and storage inventory").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
-        const options = args[0] ?? {};
-        const report = await runOperatorInventory({ orchestrator });
-        if (reportHasMachineReadableOutput(options)) {
-          console.log(JSON.stringify(report, null, 2));
-        } else {
-          console.log(formatOperatorInventoryCli(report));
+      cmd.command("forget").description(
+        "Forget a memory by id (issue #686 PR 4/6). Soft-delete: sets status='forgotten' and stamps forgottenAt; the file stays on disk and the act is reversible by editing the YAML directly. Forgotten memories are excluded from recall, browse, and entity attribution."
+      ).argument("<id>", "Memory id (frontmatter `id`) to forget").option(
+        "--reason <text>",
+        "Optional human-readable reason captured in YAML and the lifecycle ledger"
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const idArg = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        const reason = typeof options.reason === "string" && options.reason.trim().length > 0 ? options.reason.trim() : void 0;
+        const { forgetMemory } = await import("./forget-PLR6J5DN.js");
+        try {
+          const result = await forgetMemory(orchestrator.storage, {
+            id: idArg,
+            ...reason !== void 0 ? { reason } : {}
+          });
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify(result, null, 2));
+          } else {
+            console.log(`forgot ${result.id}`);
+            console.log(`  path: ${result.path}`);
+            console.log(`  prior status: ${result.priorStatus}`);
+            console.log(`  forgotten at: ${result.forgottenAt}`);
+            if (result.reason.length > 0) {
+              console.log(`  reason: ${result.reason}`);
+            }
+            console.log(
+              "Forgotten memories are excluded from recall + browse. Edit the YAML to restore."
+            );
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+          } else {
+            console.error(`forget: ${message}`);
+          }
+          process.exitCode = 1;
         }
-        if (!reportHasMachineReadableOutput(options)) console.log("OK");
       });
-      const namespacesCmd = cmd.command("namespaces").description("Manage namespace roots, migration, and verification");
-      namespacesCmd.command("ls").description("List configured namespaces and their storage roots").action(async () => {
-        const namespaces = await listNamespaces({ config: orchestrator.config });
-        if (namespaces.length === 0) {
-          console.log("No namespaces configured.");
+      cmd.command("purge").description(
+        "Hard-delete memories by age + tier (issue #686 retention-completion). Removes files from disk, removes from QMD index, and logs to the observation ledger. Requires --confirm yes to execute. Defaults to --dry-run when --confirm is absent."
+      ).option(
+        "--older-than <duration>",
+        "Delete memories older than this duration. Accepts ISO 8601 durations (e.g. P1Y, P90D) or plain numbers of days (e.g. 365)."
+      ).option(
+        "--tier <tier>",
+        "Which tier to purge: 'cold' (default) or 'all'"
+      ).option(
+        "--forgotten-only",
+        "Only purge memories with status=forgotten"
+      ).option("--dry-run", "Report candidates without deleting (default when --confirm absent)").option(
+        "--confirm <value>",
+        "Must be the literal string 'yes' to execute mutations"
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const olderThanRaw = options.olderThan ?? options["older-than"];
+        if (typeof olderThanRaw !== "string" || olderThanRaw.trim().length === 0) {
+          const msg = "purge: --older-than <duration> is required (e.g. --older-than P1Y or --older-than 365)";
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+          } else {
+            console.error(msg);
+          }
+          process.exitCode = 1;
           return;
         }
-        console.log("=== Engram Namespaces ===\n");
-        for (const entry of namespaces) {
-          console.log(
-            `${entry.namespace}
-  root: ${entry.rootDir}
-  exists: ${entry.exists ? "yes" : "no"}
-  legacy-root: ${entry.usesLegacyRoot ? "yes" : "no"}
-  has-data: ${entry.hasMemoryData ? "yes" : "no"}
-  collection: ${entry.collection}`
-          );
+        const olderThanMs = parseDurationToMs(olderThanRaw.trim());
+        if (olderThanMs === null || olderThanMs <= 0) {
+          const msg = `purge: cannot parse duration '${olderThanRaw}'. Use ISO 8601 (P1Y, P90D, P30D) or plain days (365).`;
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+          } else {
+            console.error(msg);
+          }
+          process.exitCode = 1;
+          return;
         }
-      });
-      namespacesCmd.command("verify").description("Verify namespace roots and detect legacy root drift").action(async () => {
-        const report = await verifyNamespaces({ config: orchestrator.config });
-        console.log("=== Namespace Verification ===\n");
-        for (const entry of report.namespaces) {
-          console.log(
-            `${entry.namespace}
+        const tierRaw = typeof options.tier === "string" ? options.tier.trim() : "cold";
+        if (tierRaw !== "cold" && tierRaw !== "all") {
+          const msg = `purge: invalid --tier '${tierRaw}'. Valid values: cold, all`;
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+          } else {
+            console.error(msg);
+          }
+          process.exitCode = 1;
+          return;
+        }
+        const confirmValue = options.confirm;
+        const hasDryRunFlag = options.dryRun === true || options["dry-run"] === true;
+        if (confirmValue !== void 0 && confirmValue !== "yes") {
+          const msg = 'purge: --confirm must be exactly "yes" to execute mutations. Run with --dry-run to preview candidates without deleting.';
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+          } else {
+            console.error(msg);
+          }
+          process.exitCode = 1;
+          return;
+        }
+        const confirmed = confirmValue === "yes";
+        const dryRun = hasDryRunFlag || !confirmed;
+        const { purgeMemories } = await import("./purge-6ATBGT77.js");
+        try {
+          const result = await purgeMemories({
+            storage: orchestrator.storage,
+            olderThanMs,
+            tier: tierRaw,
+            forgottenOnly: options.forgottenOnly === true || options["forgotten-only"] === true,
+            dryRun,
+            qmd: confirmed ? orchestrator.qmd : void 0,
+            hotCollection: orchestrator.config.qmdCollection,
+            coldCollection: orchestrator.config.qmdColdCollection,
+            afterFactHashRemoval: () => orchestrator.invalidateLiveContentHashIndex()
+          });
+          const hasDeleteFailures = hasDestructivePurgeFailures(result.errors);
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify(result, null, 2));
+            if (!result.dryRun && hasDeleteFailures) {
+              process.exitCode = 1;
+            }
+          } else {
+            if (result.dryRun) {
+              console.log(`=== Purge dry-run: ${result.candidates.length} candidate(s) would be deleted ===`);
+            } else {
+              const absentPart = result.alreadyAbsentCount > 0 ? `, ${result.alreadyAbsentCount} already absent` : "";
+              console.log(`=== Purge complete: ${result.purgedCount} deleted${absentPart}, ${result.errorCount} error(s) ===`);
+            }
+            console.log(`  tier:       ${result.tier}`);
+            console.log(`  older-than: ${olderThanRaw} (${Math.round(olderThanMs / 864e5)}d)`);
+            if (result.candidates.length === 0) {
+              console.log("  No candidates found.");
+            } else {
+              for (const c of result.candidates.slice(0, 20)) {
+                console.log(`  ${c.id}  [${c.tier}] status=${c.status}  age=${Math.round(c.ageMs / 864e5)}d  ${c.path}`);
+              }
+              if (result.candidates.length > 20) {
+                console.log(`  ... and ${result.candidates.length - 20} more`);
+              }
+            }
+            if (!result.dryRun && result.errors.length > 0) {
+              console.error(`  ${hasDeleteFailures ? "Errors" : "Warnings"} (${result.errors.length}):`);
+              for (const e of result.errors) {
+                console.error(`    ${e.id}: ${e.error}`);
+              }
+              if (hasDeleteFailures) {
+                process.exitCode = 1;
+              }
+            }
+            if (result.dryRun) {
+              console.log("\nRe-run with --confirm yes to execute.");
+            }
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          if (reportHasMachineReadableOutput(options)) {
+            console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+          } else {
+            console.error(`purge: ${message}`);
+          }
+          process.exitCode = 1;
+        }
+      });
+      cmd.command("config-review").description("Review Engram config defaults, recommendations, and contradictory settings").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const report = await runOperatorConfigReview({ orchestrator });
+        if (reportHasMachineReadableOutput(options)) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(formatOperatorConfigReviewCli(report));
+        }
+        if (!report.ok) {
+          process.exitCode = 1;
+          return;
+        }
+        if (!reportHasMachineReadableOutput(options)) console.log("OK");
+      });
+      cmd.command("inventory").description("Report namespace, memory, review, and storage inventory").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const report = await runOperatorInventory({ orchestrator });
+        if (reportHasMachineReadableOutput(options)) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(formatOperatorInventoryCli(report));
+        }
+        if (!reportHasMachineReadableOutput(options)) console.log("OK");
+      });
+      const namespacesCmd = cmd.command("namespaces").description("Manage namespace roots, migration, and verification");
+      namespacesCmd.command("ls").description("List configured namespaces and their storage roots").action(async () => {
+        const namespaces = await listNamespaces({ config: orchestrator.config });
+        if (namespaces.length === 0) {
+          console.log("No namespaces configured.");
+          return;
+        }
+        console.log("=== Engram Namespaces ===\n");
+        for (const entry of namespaces) {
+          console.log(
+            `${entry.namespace}
+  root: ${entry.rootDir}
+  exists: ${entry.exists ? "yes" : "no"}
+  legacy-root: ${entry.usesLegacyRoot ? "yes" : "no"}
+  has-data: ${entry.hasMemoryData ? "yes" : "no"}
+  collection: ${entry.collection}`
+          );
+        }
+      });
+      namespacesCmd.command("verify").description("Verify namespace roots and detect legacy root drift").action(async () => {
+        const report = await verifyNamespaces({ config: orchestrator.config });
+        console.log("=== Namespace Verification ===\n");
+        for (const entry of report.namespaces) {
+          console.log(
+            `${entry.namespace}
   root: ${entry.rootDir}
   exists: ${entry.exists ? "yes" : "no"}
   legacy-root: ${entry.usesLegacyRoot ? "yes" : "no"}
@@ -5712,7 +5930,7 @@ function registerCli(api, orchestrator) {
         if (plan.moved.length > 0) {
           console.log("\nEntries:");
           for (const move of plan.moved) {
-            console.log(`- ${path19.basename(move.from)}`);
+            console.log(`- ${path18.basename(move.from)}`);
           }
         }
         if (dryRun) {
@@ -5809,12 +6027,13 @@ function registerCli(api, orchestrator) {
         }
         console.log("OK");
       });
-      cmd.command("backup").description("Create a timestamped backup of the Remnic memory directory").option("--out-dir <dir>", "Backup root directory").option("--retention-days <n>", "Delete backups older than N days", "0").option("--include-transcripts", "Include transcripts (default false)").option("--namespace <ns>", "Namespace to back up (v3.0+, default: config defaultNamespace)", "").action(async (...args) => {
+      cmd.command("backup").description("Create a timestamped backup of the Remnic memory directory").option("--out-dir <dir>", "Backup root directory").option("--retention-days <n>", "Delete backups older than N days", "0").option("--include-transcripts", "Include transcripts (default false)").option("--namespace <ns>", "Namespace to back up (v3.0+, default: config defaultNamespace)", "").option("--encrypt", "Encrypt the backup archive with the secure-store master key (must be unlocked)").action(async (...args) => {
         const options = args[0] ?? {};
         const outDir = options.outDir ? String(options.outDir) : "";
         const retentionDays = parseInt(String(options.retentionDays ?? "0"), 10);
         const includeTranscripts = options.includeTranscripts === true;
         const namespace = options.namespace ? String(options.namespace) : "";
+        const doEncrypt = options.encrypt === true;
         if (!outDir) {
           console.log("Missing --out-dir. Example: openclaw engram backup --out-dir /tmp/engram-backups");
           return;
@@ -5823,15 +6042,374 @@ function registerCli(api, orchestrator) {
         const memoryDir = await resolveMemoryDirForNamespace(orchestrator, namespace, {
           rejectUnsupportedOverride: true
         });
-        await backupMemoryDir({
+        const outPath = await backupMemoryDir({
           memoryDir,
           outDir,
           retentionDays: Number.isFinite(retentionDays) ? retentionDays : void 0,
           includeTranscripts,
-          pluginVersion
+          pluginVersion,
+          encrypt: doEncrypt
+        });
+        if (doEncrypt) {
+          console.log(`Encrypted backup: ${outPath}`);
+        } else {
+          console.log(`Backup: ${outPath}`);
+        }
+        console.log("OK");
+      });
+      const capsuleCmd = cmd.command("capsule").description("Portable capsule archive export / import (issue #676, #690)");
+      capsuleCmd.command("export").description(
+        "Export the memory directory as a portable .capsule.json.gz archive. Pass --encrypt to seal the archive with the secure-store master key."
+      ).option("--name <id>", "Capsule id (alphanumeric + dashes, \u2264 64 chars)").option("--out-dir <dir>", "Output directory (default: <memoryDir>/.capsules)").option("--since <iso8601>", "Only include files modified on or after this date").option("--include-kinds <kinds>", "Comma-separated top-level dir allow-list (e.g. facts,entities)").option("--peer-ids <ids>", "Comma-separated peer id allow-list for the peers/ subtree").option("--include-transcripts", "Include transcripts (excluded by default)").option("--encrypt", "Encrypt the output archive with the secure-store master key (must be unlocked)").option("--namespace <ns>", "Namespace (v3.0+, default: config defaultNamespace)", "").action(async (...args) => {
+        const options = args[0] ?? {};
+        const name = options.name ? String(options.name) : "";
+        if (!name) {
+          console.error("--name is required. Example: remnic capsule export --name my-capsule");
+          process.exitCode = 1;
+          return;
+        }
+        const namespace = options.namespace ? String(options.namespace) : "";
+        const doEncrypt = options.encrypt === true;
+        const outDir = options.outDir ? String(options.outDir) : void 0;
+        const since = options.since ? String(options.since) : void 0;
+        const includeKinds = options.includeKinds ? String(options.includeKinds).split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+        const peerIds = options.peerIds ? String(options.peerIds).split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+        const includeTranscripts = options.includeTranscripts === true;
+        const pluginVersion = await getPluginVersion();
+        const memoryDir = await resolveMemoryDirForNamespace(orchestrator, namespace, {
+          rejectUnsupportedOverride: true
+        });
+        const { exportCapsule } = await import("./capsule-export-NZQPOTQ4.js");
+        const result = await exportCapsule({
+          name,
+          root: memoryDir,
+          since,
+          // Pass `includeKinds` only when the user explicitly provided it.
+          // Do NOT merge transcripts into an explicit list here: doing so would
+          // produce a hard-coded allow-list that silently drops other valid
+          // memory dirs (peers/, forks/, etc.). Instead, use `includeTranscripts`
+          // so the exporter adds transcripts while keeping the default "all dirs"
+          // walk. (Cursor / #747)
+          includeKinds,
+          includeTranscripts,
+          peerIds,
+          outDir,
+          pluginVersion,
+          encrypt: doEncrypt,
+          memoryDir: doEncrypt ? memoryDir : void 0
         });
+        console.log(`Archive:  ${result.archivePath}`);
+        console.log(`Manifest: ${result.manifestPath}`);
+        if (result.encryptedArchivePath) {
+          console.log(`Encrypted: yes`);
+        }
+        console.log("OK");
+      });
+      capsuleCmd.command("import").description(
+        "Import a capsule archive into the memory directory. Auto-detects encrypted archives (REMNIC-ENC header); requires --encrypt-key-dir or the memory dir to have an unlocked secure-store."
+      ).argument("<archive>", "Path to the .capsule.json.gz (or .enc) archive").option("--mode <mode>", "Conflict mode: skip (default), overwrite, fork", "skip").option("--namespace <ns>", "Target namespace (v3.0+, default: config defaultNamespace)", "").action(async (...args) => {
+        const archivePath = args[0] ? String(args[0]) : "";
+        const options = args[1] ?? {};
+        if (!archivePath) {
+          console.error("Usage: remnic capsule import <archive>");
+          process.exitCode = 1;
+          return;
+        }
+        const mode = options.mode ? String(options.mode) : "skip";
+        if (mode !== "skip" && mode !== "overwrite" && mode !== "fork") {
+          console.error(`Invalid --mode '${mode}'. Expected: skip, overwrite, fork`);
+          process.exitCode = 1;
+          return;
+        }
+        const namespace = options.namespace ? String(options.namespace) : "";
+        const memoryDir = await resolveMemoryDirForNamespace(orchestrator, namespace, {
+          rejectUnsupportedOverride: true
+        });
+        const { importCapsule } = await import("./capsule-import-SDCUXLEV.js");
+        const result = await importCapsule({
+          archivePath: expandTildePath(archivePath),
+          root: memoryDir,
+          mode,
+          memoryDir
+        });
+        console.log(`Imported: ${result.imported.length} record(s)`);
+        if (result.skipped.length > 0) {
+          console.log(`Skipped:  ${result.skipped.length} (mode=${mode})`);
+        }
         console.log("OK");
       });
+      capsuleCmd.command("merge").description(
+        "Three-way merge of a capsule archive into the memory directory. New files are always written; conflicts are resolved by --conflict-mode."
+      ).argument("<archive>", "Path to a .capsule.json.gz archive").option(
+        "--conflict-mode <mode>",
+        "Conflict mode: skip-conflicts (default) | prefer-source | prefer-local"
+      ).action(async (...args) => {
+        const archiveArg = args[0];
+        const opts = args[1] ?? {};
+        const {
+          parseCapsuleMergeOptions,
+          defaultCapsulesDir
+        } = await import("./capsule-cli.js");
+        const parsed = parseCapsuleMergeOptions(archiveArg, opts);
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const capsulesDir = defaultCapsulesDir(memoryDir);
+        const { stat: statMerge } = await import("fs/promises");
+        let sourceArchive = expandTildePath(parsed.archive);
+        const looksLikePath = sourceArchive.startsWith("/") || sourceArchive.startsWith("./") || sourceArchive.startsWith("../") || sourceArchive.includes(path18.sep);
+        if (!looksLikePath) {
+          const cwdResolved = path18.resolve(sourceArchive);
+          const cwdSt = await statMerge(cwdResolved).catch(() => null);
+          if (cwdSt && cwdSt.isFile()) {
+            sourceArchive = cwdResolved;
+          } else {
+            const byId = path18.join(capsulesDir, `${sourceArchive}.capsule.json.gz`);
+            const byIdEnc = path18.join(capsulesDir, `${sourceArchive}.capsule.json.gz.enc`);
+            const stId = await statMerge(byId).catch(() => null);
+            if (stId && stId.isFile()) {
+              sourceArchive = byId;
+            } else {
+              const stEnc = await statMerge(byIdEnc).catch(() => null);
+              if (stEnc && stEnc.isFile()) {
+                sourceArchive = byIdEnc;
+              }
+            }
+          }
+        }
+        if (sourceArchive.endsWith(".enc")) {
+          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-5CYAGVC5.js");
+          const encDetected = await isEncryptedCapsuleFile(sourceArchive).catch(() => true);
+          if (encDetected) {
+            throw new Error(
+              `capsule merge: encrypted archives (.enc) are not supported by merge. Decrypt the archive first with "remnic capsule import" (requires unlocked secure-store), then use the decrypted .capsule.json.gz.`
+            );
+          }
+        }
+        const { mergeCapsule } = await import("./capsule-merge-DI7PNQ2H.js");
+        const result = await mergeCapsule({
+          sourceArchive,
+          targetRoot: memoryDir,
+          conflictMode: parsed.conflictMode
+        });
+        const mergedCount = result.merged.length;
+        const skippedCount = result.skipped.length;
+        const conflictCount = result.conflicts.length;
+        console.log(
+          `Capsule merged: ${result.manifest.capsule.id}
+  conflict-mode: ${parsed.conflictMode}
+  merged:        ${mergedCount}
+  conflicts:     ${conflictCount}
+  skipped:       ${skippedCount}`
+        );
+      });
+      capsuleCmd.command("list").description(
+        "List all capsule archives in the capsule store directory (<memoryDir>/.capsules by default). Reads the sidecar manifest.json for metadata."
+      ).option(
+        "--dir <path>",
+        "Override the capsule store directory to list"
+      ).option(
+        "--format <fmt>",
+        "Output format: text (default) | markdown | json"
+      ).action(async (...args) => {
+        const opts = args[0] ?? {};
+        const {
+          parseCapsuleListOptions,
+          renderCapsuleList,
+          defaultCapsulesDir
+        } = await import("./capsule-cli.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const defaultDir = defaultCapsulesDir(memoryDir);
+        const dirWasExplicit = typeof opts.dir === "string" && opts.dir.trim() !== "";
+        const parsed = parseCapsuleListOptions(opts, defaultDir);
+        const capsulesDir = expandTildePath(parsed.capsulesDir);
+        const { readdir: readdir8, readFile: readFile12, stat: stat6 } = await import("fs/promises");
+        let dirEntries;
+        try {
+          dirEntries = await readdir8(capsulesDir);
+        } catch (err) {
+          const code = err.code;
+          if (dirWasExplicit) {
+            throw new Error(
+              `capsule list: cannot read --dir ${capsulesDir}: ${err.message}`
+            );
+          }
+          if (code !== "ENOENT") {
+            throw new Error(
+              `capsule list: cannot read capsule store directory ${capsulesDir}: ${err.message}`
+            );
+          }
+          dirEntries = [];
+        }
+        const archives = dirEntries.filter(
+          (e) => e.endsWith(".capsule.json.gz") || e.endsWith(".capsule.json.gz.enc")
+        ).sort();
+        const entries = [];
+        for (const archiveName of archives) {
+          const archivePath = path18.join(capsulesDir, archiveName);
+          const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
+          const manifestName = `${id}.manifest.json`;
+          const manifestPath = path18.join(capsulesDir, manifestName);
+          let createdAt = null;
+          let pluginVersion = null;
+          let fileCount = null;
+          let description = null;
+          let hasManifest = false;
+          try {
+            await stat6(manifestPath);
+            hasManifest = true;
+          } catch {
+          }
+          if (hasManifest) {
+            try {
+              const raw = await readFile12(manifestPath, "utf-8");
+              const sidecar = JSON.parse(raw);
+              createdAt = typeof sidecar.createdAt === "string" ? sidecar.createdAt : null;
+              pluginVersion = typeof sidecar.pluginVersion === "string" ? sidecar.pluginVersion : null;
+              fileCount = Array.isArray(sidecar.files) ? sidecar.files.length : null;
+              const capsule = sidecar.capsule;
+              if (capsule && typeof capsule.description === "string") {
+                description = capsule.description;
+              }
+            } catch {
+            }
+          }
+          entries.push({
+            id,
+            archivePath,
+            manifestPath: hasManifest ? manifestPath : null,
+            createdAt,
+            pluginVersion,
+            fileCount,
+            description
+          });
+        }
+        console.log(renderCapsuleList(entries, parsed.format));
+      });
+      capsuleCmd.command("inspect").description(
+        "Show capsule archive manifest without unpacking. Reads the sidecar .manifest.json when present; otherwise decompresses the archive."
+      ).argument("<archive>", "Path to a .capsule.json.gz archive (or its id in the capsule store)").option(
+        "--format <fmt>",
+        "Output format: text (default) | markdown | json"
+      ).action(async (...args) => {
+        const archiveArg = args[0];
+        const opts = args[1] ?? {};
+        const {
+          parseCapsuleInspectOptions,
+          renderCapsuleInspect,
+          defaultCapsulesDir
+        } = await import("./capsule-cli.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const capsulesDir = defaultCapsulesDir(memoryDir);
+        const parsed = parseCapsuleInspectOptions(archiveArg, opts);
+        const { stat: stat6 } = await import("fs/promises");
+        let archivePath = expandTildePath(parsed.archive);
+        const looksLikePath = archivePath.startsWith("/") || archivePath.startsWith("./") || archivePath.startsWith("../") || archivePath.includes(path18.sep);
+        if (!looksLikePath) {
+          const cwdResolved = path18.resolve(archivePath);
+          const cwdSt = await stat6(cwdResolved).catch(() => null);
+          if (cwdSt && cwdSt.isFile()) {
+            archivePath = cwdResolved;
+          } else {
+            const byId = path18.join(capsulesDir, `${archivePath}.capsule.json.gz`);
+            const byIdEnc = path18.join(capsulesDir, `${archivePath}.capsule.json.gz.enc`);
+            const st = await stat6(byId).catch(() => null);
+            if (st && st.isFile()) {
+              archivePath = byId;
+            } else {
+              const stEnc = await stat6(byIdEnc).catch(() => null);
+              if (stEnc && stEnc.isFile()) {
+                archivePath = byIdEnc;
+              }
+            }
+          }
+        }
+        const isEncrypted = archivePath.endsWith(".capsule.json.gz.enc");
+        const sidecarPath = archivePath.replace(/\.enc$/, "").replace(/\.capsule\.json\.gz$/, ".manifest.json");
+        let sidecar = null;
+        try {
+          const { readFile: readFile12 } = await import("fs/promises");
+          const raw = await readFile12(sidecarPath, "utf-8");
+          sidecar = JSON.parse(raw);
+        } catch {
+        }
+        let manifest;
+        if (sidecar !== null) {
+          manifest = sidecar;
+        } else if (isEncrypted) {
+          const { gunzipSync } = await import("zlib");
+          const { parseExportBundle } = await import("./types-V3FJ26TF.js");
+          let decryptedBuf;
+          try {
+            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-5CYAGVC5.js");
+            decryptedBuf = await decryptCapsuleFileInMemory(archivePath, memoryDir);
+          } catch (decErr) {
+            const msg = decErr instanceof Error ? decErr.message : String(decErr);
+            const isLocked = msg.includes("locked") || msg.includes("no key");
+            process.stderr.write(
+              isLocked ? `capsule inspect: secure-store is locked \u2014 unlock it first (remnic secure-store unlock) or provide the sidecar .manifest.json to inspect without decrypting.
+` : `capsule inspect: failed to decrypt archive \u2014 ${msg}
+`
+            );
+            process.exitCode = 1;
+            return;
+          }
+          const json = gunzipSync(decryptedBuf).toString("utf-8");
+          const parsed2 = parseExportBundle(JSON.parse(json));
+          if (parsed2.capsuleVersion !== 2) {
+            process.stderr.write(
+              `capsule inspect: only V2 capsule archives are supported
+`
+            );
+            process.exitCode = 1;
+            return;
+          }
+          manifest = parsed2.bundle.manifest;
+        } else {
+          const { readFile: readFile12 } = await import("fs/promises");
+          const { gunzipSync } = await import("zlib");
+          const { parseExportBundle } = await import("./types-V3FJ26TF.js");
+          const buf = await readFile12(archivePath);
+          const json = gunzipSync(buf).toString("utf-8");
+          const parsed2 = parseExportBundle(JSON.parse(json));
+          if (parsed2.capsuleVersion !== 2) {
+            process.stderr.write(
+              `capsule inspect: only V2 capsule archives are supported
+`
+            );
+            process.exitCode = 1;
+            return;
+          }
+          manifest = parsed2.bundle.manifest;
+        }
+        const capsule = manifest.capsule ?? {};
+        const files = Array.isArray(manifest.files) ? manifest.files : [];
+        const TOP_N = 20;
+        const topFiles = files.slice(0, TOP_N).map((f) => f.path ?? "");
+        const retrievalPolicy = capsule.retrievalPolicy ?? {};
+        const includes = capsule.includes ?? {};
+        const data = {
+          capsuleId: typeof capsule.id === "string" ? capsule.id : "(unknown)",
+          version: typeof capsule.version === "string" ? capsule.version : "\u2014",
+          schemaVersion: typeof capsule.schemaVersion === "string" ? capsule.schemaVersion : "\u2014",
+          createdAt: typeof manifest.createdAt === "string" ? manifest.createdAt : null,
+          pluginVersion: typeof manifest.pluginVersion === "string" ? manifest.pluginVersion : null,
+          fileCount: files.length,
+          includesTranscripts: manifest.includesTranscripts === true,
+          description: typeof capsule.description === "string" ? capsule.description : "",
+          parentCapsule: typeof capsule.parentCapsule === "string" ? capsule.parentCapsule : null,
+          retrievalPolicy: {
+            tierWeights: retrievalPolicy.tierWeights != null && typeof retrievalPolicy.tierWeights === "object" ? retrievalPolicy.tierWeights : {},
+            directAnswerEnabled: retrievalPolicy.directAnswerEnabled === true
+          },
+          includes: {
+            taxonomy: includes.taxonomy === true,
+            identityAnchors: includes.identityAnchors === true,
+            peerProfiles: includes.peerProfiles === true,
+            procedural: includes.procedural === true
+          },
+          topFiles
+        };
+        console.log(renderCapsuleInspect(data, parsed.format));
+      });
       cmd.command("compat").description("Run local compatibility diagnostics for Engram plugin wiring").option("--json", "Emit JSON output for automation").option("--strict", "Exit non-zero when warnings or errors are present").option("--repo-root <path>", "Repository root to inspect", process.cwd()).action(async (...args) => {
         const options = args[0] ?? {};
         const strict = options.strict === true;
@@ -6014,6 +6592,166 @@ function registerCli(api, orchestrator) {
         }
         if (!reportHasMachineReadableOutput(options)) console.log("OK");
       });
+      cmd.command("recall").description(
+        "Run a recall against memory.  Pass --disclosure to control payload depth (chunk|section|raw).  Part of #677."
+      ).argument("<query>", "Query to recall against").option(
+        "--disclosure <level>",
+        `Disclosure depth (one of: ${RECALL_DISCLOSURE_LEVELS.join(", ")}).  Defaults to chunk.`
+      ).option(
+        "--namespace <ns>",
+        "Namespace to scope the recall to (defaults to configured namespace)"
+      ).option(
+        "--session <key>",
+        "Session key (used for session-scoped raw transcript excerpts when --disclosure=raw)"
+      ).option(
+        "--top-k <n>",
+        "Maximum number of memory results to include (positive integer)"
+      ).option(
+        "--format <fmt>",
+        "Output format: text (default) or json",
+        "text"
+      ).option(
+        "--as-of <iso>",
+        "Historical recall pin (issue #680). ISO 8601 timestamp; returns the corpus as it existed at this instant."
+      ).option(
+        "--tag <tag>",
+        "Filter recall results by tag. Repeatable; alternatively pass a comma-separated list (issue #689).",
+        (val, prev) => Array.isArray(prev) ? [...prev, val] : [val]
+      ).option(
+        "--tag-match <mode>",
+        "Tag-filter match mode: any (default) or all. Ignored when --tag is absent."
+      ).option(
+        "--include-low-confidence",
+        "Include graph edges below the configured graphTraversalConfidenceFloor in traversal (issue #681). Default off."
+      ).action(async (...args) => {
+        const query = typeof args[0] === "string" ? args[0] : String(args[0] ?? "");
+        if (!query || query.trim().length === 0) {
+          throw new Error("missing required argument: <query>");
+        }
+        const options = args[1] ?? {};
+        let disclosure;
+        if (options.disclosure !== void 0) {
+          if (typeof options.disclosure !== "string" || !isRecallDisclosure(options.disclosure)) {
+            throw new Error(
+              `invalid --disclosure value: ${String(options.disclosure)} (expected one of: ${RECALL_DISCLOSURE_LEVELS.join(", ")})`
+            );
+          }
+          disclosure = options.disclosure;
+        }
+        let topK;
+        if (options.topK !== void 0) {
+          const raw = String(options.topK);
+          if (!/^\d+$/.test(raw)) {
+            throw new Error(`invalid --top-k value: ${raw} (expected positive integer)`);
+          }
+          const parsed = Number.parseInt(raw, 10);
+          if (!Number.isFinite(parsed) || parsed <= 0) {
+            throw new Error(`invalid --top-k value: ${raw} (expected positive integer)`);
+          }
+          topK = parsed;
+        }
+        const namespace = typeof options.namespace === "string" && options.namespace.length > 0 ? options.namespace : void 0;
+        const sessionKey = typeof options.session === "string" && options.session.length > 0 ? options.session : void 0;
+        let format = "text";
+        if (options.format !== void 0) {
+          const raw = String(options.format).toLowerCase();
+          if (raw !== "text" && raw !== "json") {
+            throw new Error(
+              `invalid --format value: ${String(options.format)} (expected one of: text, json)`
+            );
+          }
+          format = raw;
+        }
+        let asOf;
+        if (options.asOf !== void 0) {
+          const raw = String(options.asOf).trim();
+          if (raw.length === 0) {
+            throw new Error("--as-of requires a non-empty ISO 8601 timestamp");
+          }
+          const parsedAsOf = Date.parse(raw);
+          if (!Number.isFinite(parsedAsOf)) {
+            throw new Error(
+              `invalid --as-of value: ${raw} (expected an ISO 8601 timestamp parseable by Date.parse)`
+            );
+          }
+          asOf = raw;
+        }
+        let tags;
+        if (options.tag !== void 0) {
+          const raw = Array.isArray(options.tag) ? options.tag : [options.tag];
+          const cleaned = [];
+          const seen = /* @__PURE__ */ new Set();
+          for (const entry of raw) {
+            if (typeof entry !== "string") continue;
+            for (const part of entry.split(",")) {
+              const trimmed = part.trim();
+              if (trimmed.length === 0) continue;
+              if (seen.has(trimmed)) continue;
+              seen.add(trimmed);
+              cleaned.push(trimmed);
+            }
+          }
+          tags = cleaned.length > 0 ? cleaned : void 0;
+        }
+        let tagMatch;
+        if (options.tagMatch !== void 0) {
+          const raw = String(options.tagMatch).trim();
+          if (raw !== "any" && raw !== "all") {
+            throw new Error(
+              `invalid --tag-match value: ${String(options.tagMatch)} (expected one of: any, all)`
+            );
+          }
+          tagMatch = raw;
+        }
+        const includeLowConfidence = options.includeLowConfidence === true;
+        const accessService2 = new EngramAccessService(orchestrator);
+        const response = await accessService2.recall({
+          query,
+          ...sessionKey !== void 0 ? { sessionKey } : {},
+          ...namespace !== void 0 ? { namespace } : {},
+          ...topK !== void 0 ? { topK } : {},
+          ...disclosure !== void 0 ? { disclosure } : {},
+          ...asOf !== void 0 ? { asOf } : {},
+          ...tags !== void 0 ? { tags } : {},
+          ...tagMatch !== void 0 ? { tagMatch } : {},
+          ...includeLowConfidence ? { includeLowConfidence: true } : {}
+        });
+        if (format === "json") {
+          console.log(JSON.stringify(response, null, 2));
+          return;
+        }
+        console.log(`=== Recall: "${query}" ===`);
+        console.log(`namespace: ${response.namespace}`);
+        console.log(`disclosure: ${response.disclosure}`);
+        console.log(`results: ${response.count}`);
+        if (response.results.length === 0) {
+          console.log("(no results)");
+          return;
+        }
+        for (const r of response.results) {
+          console.log("");
+          console.log(`- ${r.path}`);
+          console.log(`  category: ${r.category}`);
+          if (r.tags.length > 0) {
+            console.log(`  tags: ${r.tags.join(", ")}`);
+          }
+          console.log(`  preview: ${r.preview}`);
+          if (r.content) {
+            console.log(`  content (${r.content.length} chars):`);
+            console.log(
+              r.content.split("\n").map((line) => `    ${line}`).join("\n")
+            );
+          }
+          if (r.rawExcerpts && r.rawExcerpts.length > 0) {
+            console.log(`  raw excerpts (${r.rawExcerpts.length}):`);
+            for (const ex of r.rawExcerpts) {
+              console.log(
+                `    [turn ${ex.turnIndex}, ${ex.role}] ${ex.content.slice(0, 200)}`
+              );
+            }
+          }
+        }
+      });
       cmd.command("recall-explain").description(
         "Show tier explain for the most recent recall (or a specific session)"
       ).option(
@@ -6047,6 +6785,9 @@ function registerCli(api, orchestrator) {
       ).option(
         "--out <path>",
         "Write the rendered snapshot to a file instead of stdout"
+      ).option(
+        "--disclosure <level>",
+        "Disclosure depth (chunk | section | raw). Populates the per-disclosure token-spend summary."
       ).action(async (...args) => {
         const parsed = parseXrayCliOptions(
           args[0],
@@ -6056,17 +6797,289 @@ function registerCli(api, orchestrator) {
         const response = await xrayService.recallXray({
           query: parsed.query,
           ...parsed.namespace ? { namespace: parsed.namespace } : {},
-          ...parsed.budget !== void 0 ? { budget: parsed.budget } : {}
+          ...parsed.budget !== void 0 ? { budget: parsed.budget } : {},
+          ...parsed.disclosure !== void 0 ? { disclosure: parsed.disclosure } : {}
+        });
+        const snapshot = response.snapshotFound ? response.snapshot ?? null : null;
+        const rendered = renderXray(snapshot, parsed.format);
+        if (parsed.outPath) {
+          const { writeFile: fsWriteFile } = await import("fs/promises");
+          await fsWriteFile(expandTildePath(parsed.outPath), rendered, "utf8");
+        } else {
+          console.log(rendered);
+        }
+      });
+      const patternsCmd = cmd.command("patterns").description(
+        "Inspect reinforced pattern memories produced by the pattern-reinforcement job (#687 PR 2/4)."
+      );
+      patternsCmd.command("list").description(
+        "List memories with reinforcement_count > 0, sorted by count desc.  Part of #687."
+      ).option(
+        "--limit <N>",
+        "Maximum number of rows to show (default 50, positive integer)"
+      ).option(
+        "--category <list>",
+        "Comma-separated category filter (e.g. fact,preference)"
+      ).option(
+        "--since <ISO>",
+        "Only include memories reinforced on or after this ISO 8601 timestamp"
+      ).option(
+        "--format <fmt>",
+        "Output format: text (default), markdown, or json"
+      ).action(async (...args) => {
+        const options = args[0] ?? {};
+        const parsed = parsePatternsListOptions(options);
+        const memories = await orchestrator.storage.readAllMemories();
+        const rows = collectPatternMemories(memories, parsed);
+        console.log(renderPatternsList(rows, parsed.format));
+      });
+      patternsCmd.command("explain").description(
+        "Show reinforcement detail for a single pattern canonical: count, provenance chain, and cluster members.  Part of #687."
+      ).argument("<memoryId>", "ID of the canonical memory to explain").option(
+        "--format <fmt>",
+        "Output format: text (default), markdown, or json"
+      ).action(async (...args) => {
+        const rawId = args[0];
+        const options = args[1] ?? {};
+        const parsed = parsePatternsExplainOptions(rawId, options);
+        const memories = await orchestrator.storage.readAllMemories();
+        const detail = explainPatternMemory(memories, parsed.id);
+        if (detail === null) {
+          process.stderr.write(
+            `patterns explain: "${parsed.id}" was not found or has no reinforcement_count > 0.
+`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        console.log(renderPatternExplain(detail, parsed.format));
+      });
+      {
+        async function buildConnectorRows() {
+          const states = await listConnectorStates(
+            orchestrator.config.memoryDir
+          );
+          const stateMap = new Map(states.map((s) => [s.id, s]));
+          const builtIn = [
+            {
+              id: GOOGLE_DRIVE_CONNECTOR_ID,
+              displayName: "Google Drive",
+              enabled: orchestrator.config.connectors.googleDrive.enabled
+            },
+            {
+              id: NOTION_CONNECTOR_ID,
+              displayName: "Notion",
+              enabled: orchestrator.config.connectors.notion.enabled
+            }
+          ];
+          return builtIn.map((c) => ({
+            id: c.id,
+            displayName: c.displayName,
+            enabled: c.enabled,
+            state: stateMap.get(c.id) ?? null
+          }));
+        }
+        const connectorsCmd = cmd.command("connectors").description(
+          "Manage live connectors (Google Drive, Notion, \u2026). Subcommands: list, status, run. See docs/live-connectors.md."
+        );
+        connectorsCmd.command("list").description(
+          "List all configured live connectors with their enabled state, last poll time, and last error."
+        ).option(
+          "--format <fmt>",
+          "Output format: text (default), markdown, or json"
+        ).action(async (...args) => {
+          const options = args[0] ?? {};
+          let parsed;
+          try {
+            parsed = parseConnectorsListOptions(options);
+          } catch (err) {
+            process.stderr.write(
+              `connectors list: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+            process.exitCode = 2;
+            return;
+          }
+          const rows = await buildConnectorRows();
+          console.log(renderConnectorsList(rows, parsed.format));
+        });
+        connectorsCmd.command("status").description(
+          "Print connector status. Defaults to JSON output for scripting. Use --format text|markdown to override."
+        ).option(
+          "--format <fmt>",
+          "Output format: json (default), text, or markdown"
+        ).action(async (...args) => {
+          const options = args[0] ?? {};
+          let parsed;
+          try {
+            parsed = parseConnectorsStatusOptions(options);
+          } catch (err) {
+            process.stderr.write(
+              `connectors status: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+            process.exitCode = 2;
+            return;
+          }
+          const rows = await buildConnectorRows();
+          console.log(renderConnectorsList(rows, parsed.format));
+        });
+        connectorsCmd.command("run").description(
+          "Manually trigger one incremental sync pass for the named connector. Operator debug surface."
+        ).argument("<name>", "Connector id (e.g. google-drive, notion)").option(
+          "--format <fmt>",
+          "Output format: text (default), markdown, or json"
+        ).action(async (...args) => {
+          const rawName = args[0];
+          const options = args[1] ?? {};
+          let name;
+          try {
+            name = parseConnectorsRunName(rawName);
+          } catch (err) {
+            process.stderr.write(
+              `connectors run: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+            process.exitCode = 2;
+            return;
+          }
+          let format;
+          try {
+            format = parseConnectorsListOptions({ format: options.format }).format;
+          } catch (err) {
+            process.stderr.write(
+              `connectors run: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+            process.exitCode = 2;
+            return;
+          }
+          const cfg = orchestrator.config.connectors;
+          const { readConnectorState, writeConnectorState } = await import("./state-store-3EH7HYIN.js");
+          const sharedIngestFn = async (docs) => {
+            const fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+            const turns = docs.map((doc) => ({
+              role: "assistant",
+              content: doc.title ? `# ${doc.title}
+
+${doc.content}` : doc.content,
+              timestamp: fetchedAt
+            }));
+            await orchestrator.ingestBulkImportBatch(turns);
+          };
+          const makeWriteCursorFn = (connectorName) => async ({
+            cursor,
+            lastSyncStatus,
+            lastSyncError,
+            totalDocsImported
+          }) => {
+            await writeConnectorState(
+              orchestrator.config.memoryDir,
+              connectorName,
+              {
+                id: connectorName,
+                cursor,
+                lastSyncAt: (/* @__PURE__ */ new Date()).toISOString(),
+                lastSyncStatus,
+                ...lastSyncError !== void 0 ? { lastSyncError } : {},
+                totalDocsImported
+              }
+            );
+          };
+          let runResult;
+          if (name === GOOGLE_DRIVE_CONNECTOR_ID) {
+            if (!cfg.googleDrive.enabled) {
+              process.stderr.write(
+                `connectors run: connector "${name}" is disabled. Set connectors.googleDrive.enabled=true in config.
+`
+              );
+              process.exitCode = 1;
+              return;
+            }
+            let validatedCfg;
+            try {
+              validatedCfg = validateGoogleDriveConfig(cfg.googleDrive);
+            } catch (err) {
+              process.stderr.write(
+                `connectors run: invalid config for "${name}": ${err instanceof Error ? err.message : String(err)}
+`
+              );
+              process.exitCode = 1;
+              return;
+            }
+            const connector = createGoogleDriveConnector();
+            const state = await readConnectorState(
+              orchestrator.config.memoryDir,
+              name
+            );
+            runResult = await runConnectorPollOnce({
+              connectorId: name,
+              priorState: state,
+              syncFn: (cursor) => connector.syncIncremental({
+                cursor,
+                // GoogleDriveConnectorConfig is narrower than ConnectorConfig
+                // (no index signature) but is structurally compatible at
+                // runtime. Double-cast via unknown to satisfy the interface.
+                config: validatedCfg
+              }),
+              ingestFn: sharedIngestFn,
+              writeCursorFn: makeWriteCursorFn(name)
+            });
+          } else if (name === NOTION_CONNECTOR_ID) {
+            if (!cfg.notion.enabled) {
+              process.stderr.write(
+                `connectors run: connector "${name}" is disabled. Set connectors.notion.enabled=true in config.
+`
+              );
+              process.exitCode = 1;
+              return;
+            }
+            let validatedCfg;
+            try {
+              validatedCfg = validateNotionConfig(cfg.notion);
+            } catch (err) {
+              process.stderr.write(
+                `connectors run: invalid config for "${name}": ${err instanceof Error ? err.message : String(err)}
+`
+              );
+              process.exitCode = 1;
+              return;
+            }
+            const connector = createNotionConnector();
+            const state = await readConnectorState(
+              orchestrator.config.memoryDir,
+              name
+            );
+            runResult = await runConnectorPollOnce({
+              connectorId: name,
+              priorState: state,
+              syncFn: (cursor) => connector.syncIncremental({
+                cursor,
+                // NotionConnectorConfig is narrower than ConnectorConfig (no
+                // index signature) but is structurally compatible at runtime.
+                // Double-cast via unknown to satisfy the interface boundary.
+                config: validatedCfg
+              }),
+              ingestFn: sharedIngestFn,
+              writeCursorFn: makeWriteCursorFn(name)
+            });
+          } else {
+            process.stderr.write(
+              `connectors run: unknown connector "${name}". Known connectors: ${GOOGLE_DRIVE_CONNECTOR_ID}, ${NOTION_CONNECTOR_ID}.
+`
+            );
+            process.exitCode = 1;
+            return;
+          }
+          const output = renderConnectorsRunResult(name, runResult, format);
+          if (runResult.error !== void 0) {
+            process.stderr.write(output + "\n");
+            process.exitCode = 1;
+          } else {
+            console.log(output);
+          }
         });
-        const snapshot = response.snapshotFound ? response.snapshot ?? null : null;
-        const rendered = renderXray(snapshot, parsed.format);
-        if (parsed.outPath) {
-          const { writeFile: fsWriteFile } = await import("fs/promises");
-          await fsWriteFile(expandTildePath(parsed.outPath), rendered, "utf8");
-        } else {
-          console.log(rendered);
-        }
-      });
+      }
       cmd.command("benchmark-validate").description("Validate a benchmark manifest file or pack directory without importing it").argument("<path>", "Path to a benchmark manifest JSON file or a directory with manifest.json").action(async (...args) => {
         const inputPath = args[0];
         const summary = await runBenchmarkValidateCliCommand({
@@ -6769,12 +7782,18 @@ function registerCli(api, orchestrator) {
         const options = args[0] ?? {};
         const portRaw = parseInt(String(options.port ?? "4318"), 10);
         const maxBodyBytesRaw = parseInt(String(options.maxBodyBytes ?? "131072"), 10);
+        const cliTokenOverride = typeof options.token === "string" && options.token.trim().length > 0 ? options.token : void 0;
+        const resolveSecretRef = registerOptions.resolveSecretRef ?? (registerOptions.loadResolveSecretRef ? await registerOptions.loadResolveSecretRef() : null);
+        const resolvedConfigAuthToken = cliTokenOverride ? void 0 : await resolveAgentAccessAuthToken(
+          orchestrator.config.agentAccessHttp.authToken,
+          { resolveSecretRef }
+        );
         const status = await runAccessHttpServeCliCommand({
           service: accessService,
           enabled: true,
           host: typeof options.host === "string" ? options.host : "127.0.0.1",
           port: Number.isFinite(portRaw) ? portRaw : 4318,
-          authToken: typeof options.token === "string" && options.token.trim().length > 0 ? options.token : orchestrator.config.agentAccessHttp.authToken,
+          authToken: cliTokenOverride ?? resolvedConfigAuthToken,
           principal: resolveAccessPrincipalOverride(options.principal, orchestrator.config.agentAccessHttp.principal),
           maxBodyBytes: Number.isFinite(maxBodyBytesRaw) ? maxBodyBytesRaw : 131072,
           trustPrincipalHeader: options.trustPrincipalHeader === true,
@@ -7043,6 +8062,10 @@ function registerCli(api, orchestrator) {
         const memoryDir = await resolveMemoryDirForNamespace(orchestrator, namespace, {
           rejectUnsupportedOverride: true
         });
+        const deepSleep = orchestrator.config.dreamsPhases.deepSleep;
+        if (deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
+          throw new Error("memory governance is disabled by dreams.phases.deepSleep.enabled=false");
+        }
         const result = await runMemoryGovernanceCliCommand({
           memoryDir,
           mode,
@@ -7223,7 +8246,7 @@ function registerCli(api, orchestrator) {
         let deleted = 0;
         for (const filePath of plan.deletePaths) {
           try {
-            await unlink2(filePath);
+            await unlink3(filePath);
             deleted += 1;
           } catch (err) {
             console.log(`  failed to delete ${filePath}: ${String(err)}`);
@@ -7271,7 +8294,7 @@ function registerCli(api, orchestrator) {
         let deleted = 0;
         for (const filePath of plan.deletePaths) {
           try {
-            await unlink2(filePath);
+            await unlink3(filePath);
             deleted += 1;
           } catch (err) {
             console.log(`  failed to delete ${filePath}: ${String(err)}`);
@@ -7299,11 +8322,15 @@ function registerCli(api, orchestrator) {
         }
         await orchestrator.qmd.probe();
         if (orchestrator.qmd.isAvailable()) {
-          const results = await orchestrator.qmd.search(
+          const rawResults = await orchestrator.qmd.search(
             query,
             void 0,
             maxResults
           );
+          const results = await filterNormalMemorySearchResults(
+            rawResults,
+            orchestrator.storage
+          );
           if (results.length === 0) {
             console.log(`No results for: "${query}"`);
             return;
@@ -7324,7 +8351,7 @@ function registerCli(api, orchestrator) {
           const memories = await orchestrator.storage.readAllMemories();
           const lowerQuery = query.toLowerCase();
           const matches = memories.filter(
-            (m) => m.content.toLowerCase().includes(lowerQuery) || m.frontmatter.tags.some((t) => t.includes(lowerQuery))
+            (m) => isNormalRetrievalVisibleMemory(m) && (m.content.toLowerCase().includes(lowerQuery) || m.frontmatter.tags.some((t) => t.includes(lowerQuery)))
           );
           const qmdStatus = orchestrator.qmd.debugStatus();
           if (matches.length === 0) {
@@ -7465,7 +8492,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           return;
         }
         const expandedTarget = expandTildePath(rawTarget);
-        const targetPath = path19.isAbsolute(expandedTarget) ? expandedTarget : path19.join(orchestrator.config.memoryDir, expandedTarget);
+        const targetPath = path18.isAbsolute(expandedTarget) ? expandedTarget : path18.join(orchestrator.config.memoryDir, expandedTarget);
         const { runConsolidationUndo, formatConsolidationUndoResult } = await import("./consolidation-undo.js");
         const result = await runConsolidationUndo({
           storage: orchestrator.storage,
@@ -7503,7 +8530,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         }
       });
       cmd.command("identity").description("Show agent identity reflections").action(async () => {
-        const workspaceDir = path19.join(resolveHomeDir(), ".openclaw", "workspace");
+        const workspaceDir = path18.join(resolveHomeDir(), ".openclaw", "workspace");
         const identity = await orchestrator.storage.readIdentity(workspaceDir);
         if (!identity) {
           console.log("No identity file found.");
@@ -7726,8 +8753,8 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         const options = args[0] ?? {};
         const threadId = options.thread;
         const top = parseInt(options.top ?? "10", 10);
-        const memoryDir = path19.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
-        const threading = new ThreadingManager(path19.join(memoryDir, "threads"));
+        const memoryDir = path18.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+        const threading = new ThreadingManager(path18.join(memoryDir, "threads"));
         if (threadId) {
           const thread = await threading.loadThread(threadId);
           if (!thread) {
@@ -7889,7 +8916,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           process.exit(1);
         }
         const limit = parseInt(options.limit ?? "50", 10);
-        const { listPairs } = await import("./contradiction-review-WIUBAR52.js");
+        const { listPairs } = await import("./contradiction-review-5LTTVDQV.js");
         const result = listPairs(orchestrator.config.memoryDir, {
           filter,
           namespace: options.namespace,
@@ -7916,7 +8943,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("pairId is required");
           process.exit(1);
         }
-        const { readPair } = await import("./contradiction-review-WIUBAR52.js");
+        const { readPair } = await import("./contradiction-review-5LTTVDQV.js");
         const pair = readPair(orchestrator.config.memoryDir, pairId);
         if (!pair) {
           console.error(`Pair ${pairId} not found.`);
@@ -7936,7 +8963,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("--verb is required. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context");
           process.exit(1);
         }
-        const { isValidResolutionVerb, executeResolution } = await import("./resolution-QBTDHTG7.js");
+        const { isValidResolutionVerb, executeResolution } = await import("./resolution-YGIBORXI.js");
         if (!isValidResolutionVerb(verb)) {
           console.error(`Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context`);
           process.exit(1);
@@ -7949,7 +8976,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
       });
       reviewCmd.command("scan").description("Run an on-demand contradiction scan").option("--namespace <ns>", "Namespace to scan").action(async (...args) => {
         const options = args[0] ?? {};
-        const { runContradictionScan } = await import("./contradiction-scan-E3GJTI4F.js");
+        const { runContradictionScan } = await import("./contradiction-scan-3Z6YW7YA.js");
         console.log("Running contradiction scan...");
         const result = await runContradictionScan({
           storage: orchestrator.storage,
@@ -7976,6 +9003,558 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         console.log(`  Queued: ${result.queued}`);
         console.log(`  Cooled down: ${result.cooledDown}`);
       });
+      const dreamsCmd = cmd.command("dreams").description("Inspect and manually trigger Dreams consolidation pipeline phases");
+      dreamsCmd.command("status").description("Show per-phase Dreams telemetry for the last N hours").option("--window-hours <n>", "Look-back window in hours (default 24)", "24").option("--format <fmt>", "Output format: text, json, markdown (default text)", "text").option("--namespace <ns>", "Namespace to inspect (default: current default namespace)").option("--principal <principal>", "Trusted principal for namespace ACLs (defaults to config/env)").action(async (...args) => {
+        const options = args[0] ?? {};
+        const fmt = options.format ?? "text";
+        if (fmt !== "text" && fmt !== "json" && fmt !== "markdown") {
+          console.error(`Invalid --format '${fmt}'. Must be one of: text, json, markdown`);
+          process.exit(1);
+        }
+        const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-LR2NBAZE.js");
+        let windowHours;
+        const rawWindowHours = options.windowHours;
+        try {
+          if (typeof rawWindowHours !== "string" || rawWindowHours.trim() === "") {
+            throw new Error("missing window");
+          }
+          windowHours = normalizeDreamsStatusWindowHours(Number(rawWindowHours));
+        } catch {
+          console.error("--window-hours must be a positive integer");
+          process.exit(1);
+        }
+        const accessService2 = new EngramAccessService(orchestrator);
+        const result = await accessService2.dreamsStatus({
+          windowHours,
+          namespace: typeof options.namespace === "string" ? options.namespace : void 0,
+          principal: resolveAccessPrincipalOverride(
+            options.principal,
+            orchestrator.config.agentAccessHttp.principal
+          )
+        });
+        if (fmt === "json") {
+          console.log(JSON.stringify(result, null, 2));
+          return;
+        }
+        const phaseLabels = {
+          lightSleep: "Light Sleep",
+          rem: "REM",
+          deepSleep: "Deep Sleep"
+        };
+        if (fmt === "markdown") {
+          console.log(`## Dreams Status (last ${windowHours}h)
+`);
+          console.log(`Window: ${result.windowStart} \u2192 ${result.windowEnd}
+`);
+          console.log("| Phase | Runs | Total Duration | Items Processed | Last Run |");
+          console.log("|-------|------|----------------|-----------------|----------|");
+          for (const phase of ["lightSleep", "rem", "deepSleep"]) {
+            const p = result.phases[phase];
+            const lastRun = p.lastRunAt ? p.lastRunAt.slice(0, 19).replace("T", " ") : "\u2014";
+            console.log(
+              `| ${phaseLabels[phase]} | ${p.runCount} | ${p.totalDurationMs}ms | ${p.totalItemsProcessed} | ${lastRun} |`
+            );
+          }
+          return;
+        }
+        console.log(`Dreams status (last ${windowHours}h):`);
+        console.log(`  Window: ${result.windowStart} \u2192 ${result.windowEnd}
+`);
+        for (const phase of ["lightSleep", "rem", "deepSleep"]) {
+          const p = result.phases[phase];
+          const label = phaseLabels[phase];
+          console.log(`  ${label}:`);
+          console.log(`    Runs:            ${p.runCount}`);
+          console.log(`    Total duration:  ${p.totalDurationMs}ms`);
+          console.log(`    Items processed: ${p.totalItemsProcessed}`);
+          console.log(`    Last run:        ${p.lastRunAt ?? "\u2014"}`);
+          console.log();
+        }
+      });
+      dreamsCmd.command("run").description("Manually invoke a single Dreams phase pass").requiredOption("--phase <phase>", "Phase to run: light-sleep, rem, deep-sleep").option("--dry-run", "Preview without committing writes").option("--format <fmt>", "Output format: text, json (default text)", "text").option("--namespace <ns>", "Namespace to run in (default: current default namespace)").option("--principal <principal>", "Trusted principal for namespace ACLs (defaults to config/env)").action(async (...args) => {
+        const options = args[0] ?? {};
+        const phaseInput = typeof options.phase === "string" ? options.phase : "";
+        if ("dryRun" in options && options.dryRun !== void 0 && typeof options.dryRun !== "boolean") {
+          console.error("--dry-run must be a boolean flag");
+          process.exit(1);
+        }
+        const dryRun = options.dryRun === true;
+        const fmt = typeof options.format === "string" ? options.format : "text";
+        if (fmt !== "text" && fmt !== "json") {
+          console.error(`Invalid --format '${fmt}'. Must be one of: text, json`);
+          process.exit(1);
+        }
+        const phaseMap = {
+          "light-sleep": "lightSleep",
+          lightsleep: "lightSleep",
+          lightSleep: "lightSleep",
+          rem: "rem",
+          REM: "rem",
+          "deep-sleep": "deepSleep",
+          deepsleep: "deepSleep",
+          deepSleep: "deepSleep"
+        };
+        const phase = phaseMap[phaseInput];
+        if (!phase) {
+          console.error(
+            `Invalid --phase '${phaseInput}'. Must be one of: light-sleep, rem, deep-sleep`
+          );
+          process.exit(1);
+        }
+        const accessService2 = new EngramAccessService(orchestrator);
+        const result = await accessService2.dreamsRun({
+          phase,
+          dryRun,
+          namespace: typeof options.namespace === "string" ? options.namespace : void 0,
+          authenticatedPrincipal: resolveAccessPrincipalOverride(
+            options.principal,
+            orchestrator.config.agentAccessHttp.principal
+          )
+        });
+        if (fmt === "json") {
+          console.log(JSON.stringify(result, null, 2));
+          return;
+        }
+        const phaseLabel = { lightSleep: "Light Sleep", rem: "REM", deepSleep: "Deep Sleep" }[phase];
+        console.log(`Dreams run: ${phaseLabel}${dryRun ? " (dry-run)" : ""}`);
+        console.log(`  Duration:   ${result.durationMs}ms`);
+        console.log(`  Items:      ${result.itemsProcessed}`);
+        if (result.notes) {
+          console.log(`  Notes:      ${result.notes}`);
+        }
+      });
+      const secureStoreCmd = cmd.command("secure-store").description(
+        "At-rest encryption keyring (issue #690). Manage the secure-store header and the in-memory master key used by the running daemon."
+      );
+      secureStoreCmd.command("init").description(
+        "Initialize a new secure-store header. Prompts for a passphrase, derives a master key via Argon2id by default, and writes the verifier to <memoryDir>/.secure-store/header.json. Refuses to overwrite an existing header."
+      ).option("--kdf <algorithm>", "KDF algorithm: argon2id (default) or scrypt", "argon2id").option("--note <text>", "Optional human-readable note recorded in metadata. Never include secrets.").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const {
+          runSecureStoreInit,
+          createPassphraseReader,
+          renderInitReport
+        } = await import("./secure-store-4R2GSO7S.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const kdf = typeof options.kdf === "string" ? options.kdf.trim() : "argon2id";
+        if (kdf !== "argon2id" && kdf !== "scrypt") {
+          console.error(`Invalid --kdf '${String(options.kdf)}'. Must be one of: argon2id, scrypt`);
+          process.exit(1);
+        }
+        const initOpts = {
+          memoryDir,
+          readPassphrase: createPassphraseReader(),
+          algorithm: kdf
+        };
+        if (typeof options.note === "string") initOpts.note = options.note;
+        const report = await runSecureStoreInit(initOpts);
+        if (options.json === true) {
+          console.log(JSON.stringify(report, null, 2));
+          return;
+        }
+        console.log(renderInitReport(report));
+      });
+      secureStoreCmd.command("unlock").description(
+        "Unlock the secure-store. Prompts for the passphrase, validates it against the header verifier, and registers the master key in the daemon's in-memory keyring. The key is cleared on `lock`, daemon restart, or process exit."
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const {
+          runSecureStoreUnlock,
+          createPassphraseReader,
+          renderUnlockReport
+        } = await import("./secure-store-4R2GSO7S.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const report = await runSecureStoreUnlock({
+          memoryDir,
+          readPassphrase: createPassphraseReader()
+        });
+        if (options.json === true) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(renderUnlockReport(report));
+        }
+        if (!report.ok) {
+          process.exitCode = 1;
+        }
+      });
+      secureStoreCmd.command("lock").description(
+        "Lock the secure-store. Clears the master key from the daemon's in-memory keyring. Idempotent \u2014 succeeds even if the store is already locked."
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const { runSecureStoreLock, renderLockReport } = await import("./secure-store-4R2GSO7S.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const report = runSecureStoreLock({ memoryDir });
+        if (options.json === true) {
+          console.log(JSON.stringify(report, null, 2));
+          return;
+        }
+        console.log(renderLockReport(report));
+      });
+      secureStoreCmd.command("migrate").description(
+        "Encrypt existing plaintext storage-managed memory files in an initialized, unlocked secure-store. Idempotent; already-encrypted files are skipped."
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const { runSecureStoreMigrate, renderMigrateReport } = await import("./secure-store-4R2GSO7S.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const report = await runSecureStoreMigrate({ memoryDir });
+        if (options.json === true) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(renderMigrateReport(report));
+        }
+        if (!report.ok) {
+          process.exitCode = 1;
+        }
+      });
+      async function runSecureStoreDisableCommand(options) {
+        const { runSecureStoreDisable, renderDisableReport } = await import("./secure-store-4R2GSO7S.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const report = await runSecureStoreDisable({ memoryDir });
+        if (options.json === true) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(renderDisableReport(report));
+        }
+        if (!report.ok) {
+          process.exitCode = 1;
+        }
+      }
+      secureStoreCmd.command("disable").description(
+        "Decrypt storage-managed secure-store files back to plaintext. Requires an initialized, unlocked secure-store and keeps .secure-store metadata in place."
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        await runSecureStoreDisableCommand(options);
+      });
+      secureStoreCmd.command("decrypt").description("Alias for `secure-store disable`.").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        await runSecureStoreDisableCommand(options);
+      });
+      secureStoreCmd.command("status").description(
+        "Report secure-store status: whether a header exists, whether the daemon currently holds the key, KDF parameters, and last-unlock timestamp."
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const { runSecureStoreStatus, renderStatusReport } = await import("./secure-store-4R2GSO7S.js");
+        const memoryDir = expandTildePath(orchestrator.config.memoryDir);
+        const report = await runSecureStoreStatus({ memoryDir });
+        if (options.json === true) {
+          console.log(JSON.stringify(report, null, 2));
+          return;
+        }
+        console.log(renderStatusReport(report));
+      });
+      const peerCmd = cmd.command("peer").description("Manage the peer registry (issue #679).");
+      peerCmd.command("list").description("List all registered peers").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const options = args[0] ?? {};
+        const { listPeers } = await import("./peers-6OSQ3NK6.js");
+        const peers = await listPeers(orchestrator.config.memoryDir);
+        if (options.json === true) {
+          console.log(JSON.stringify({ peers }, null, 2));
+          return;
+        }
+        if (peers.length === 0) {
+          console.log("No peers registered.");
+          return;
+        }
+        console.log(`${peers.length} peer(s):
+`);
+        for (const p of peers) {
+          console.log(`  ${p.id} (${p.kind})  ${p.displayName}`);
+          console.log(`    created: ${p.createdAt}  updated: ${p.updatedAt}`);
+        }
+      });
+      peerCmd.command("show <id>").description("Show a peer's identity record").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const id = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        if (!id) {
+          console.error("peer id is required");
+          process.exit(1);
+        }
+        const peersShow = await import("./peers-6OSQ3NK6.js");
+        const validateIdShow = peersShow.assertValidPeerId;
+        try {
+          validateIdShow(id);
+        } catch (err) {
+          console.error(`Invalid peer id: ${err.message}`);
+          process.exit(1);
+        }
+        const peer = await peersShow.readPeer(orchestrator.config.memoryDir, id);
+        if (!peer) {
+          console.error(`Peer "${id}" not found.`);
+          process.exit(1);
+        }
+        if (options.json === true) {
+          console.log(JSON.stringify(peer, null, 2));
+          return;
+        }
+        console.log(`Peer: ${peer.id}`);
+        console.log(`  Kind:         ${peer.kind}`);
+        console.log(`  Display name: ${peer.displayName}`);
+        console.log(`  Created:      ${peer.createdAt}`);
+        console.log(`  Updated:      ${peer.updatedAt}`);
+        if (peer.notes) {
+          console.log(`  Notes:
+${peer.notes.split("\n").map((l) => `    ${l}`).join("\n")}`);
+        }
+      });
+      peerCmd.command("set <id>").description("Create or update a peer identity record").option("--kind <kind>", "Peer kind: self | human | agent | integration (only on first write)").option("--display-name <name>", "Human-readable display name").option("--notes <text>", "Optional free-form markdown notes").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const id = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        if (!id) {
+          console.error("peer id is required");
+          process.exit(1);
+        }
+        const peerSetService = new EngramAccessService(orchestrator);
+        try {
+          const result = await peerSetService.peerSet({
+            id,
+            ...typeof options.kind === "string" ? { kind: options.kind } : {},
+            ...typeof options.displayName === "string" ? { displayName: options.displayName } : {},
+            ...typeof options.notes === "string" ? { notes: options.notes } : {}
+          });
+          if (options.json === true) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+          }
+          console.log(`${result.created ? "Created" : "Updated"} peer "${id}".`);
+        } catch (err) {
+          console.error(`Failed to set peer: ${err.message}`);
+          process.exit(1);
+        }
+      });
+      peerCmd.command("delete <id>").description("Delete a peer's identity record (idempotent; directory and profile are preserved)").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const id = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        if (!id) {
+          console.error("peer id is required");
+          process.exit(1);
+        }
+        const peerDeleteService = new EngramAccessService(orchestrator);
+        try {
+          const result = await peerDeleteService.peerDelete(id);
+          if (options.json === true) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+          }
+          console.log(result.deleted ? `Deleted peer "${id}".` : `Peer "${id}" not found (no-op).`);
+        } catch (err) {
+          console.error(`Failed to delete peer: ${err.message}`);
+          process.exit(1);
+        }
+      });
+      peerCmd.command("forget <id>").description(
+        "DESTRUCTIVELY purge the entire peer directory (identity.md + profile.md + interactions.log.md and any other companion files). Requires --confirm yes. Idempotent: safe to run twice."
+      ).option(
+        "--confirm <value>",
+        'Confirmation guard \u2014 must be exactly "yes" to proceed'
+      ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const id = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        if (!id) {
+          console.error("peer id is required");
+          process.exit(1);
+        }
+        const confirm = typeof options.confirm === "string" ? options.confirm : "";
+        if (confirm !== "yes") {
+          console.error(
+            `peer forget: refuses to run without --confirm yes (got ${confirm.length > 0 ? JSON.stringify(confirm) : "<not provided>"}). This operation permanently removes all peer data.`
+          );
+          process.exit(1);
+        }
+        const peerForgetService = new EngramAccessService(orchestrator);
+        try {
+          const result = await peerForgetService.peerForget(id, { confirm: "yes" });
+          if (options.json === true) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+          }
+          console.log(
+            result.purged ? `Purged all data for peer "${id}".` : `Peer "${id}" directory not found (no-op).`
+          );
+        } catch (err) {
+          console.error(`Failed to forget peer: ${err.message}`);
+          process.exit(1);
+        }
+      });
+      peerCmd.command("profile <id>").description("Show the evolving cognitive profile for a peer").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
+        const id = typeof args[0] === "string" ? args[0] : "";
+        const options = args[1] ?? {};
+        if (!id) {
+          console.error("peer id is required");
+          process.exit(1);
+        }
+        const peersProfile = await import("./peers-6OSQ3NK6.js");
+        const validateIdProfile = peersProfile.assertValidPeerId;
+        try {
+          validateIdProfile(id);
+        } catch (err) {
+          console.error(`Invalid peer id: ${err.message}`);
+          process.exit(1);
+        }
+        const profile = await peersProfile.readPeerProfile(orchestrator.config.memoryDir, id);
+        if (!profile) {
+          console.error(`No profile found for peer "${id}". The profile is written by the async reasoner.`);
+          process.exit(1);
+        }
+        if (options.json === true) {
+          console.log(JSON.stringify(profile, null, 2));
+          return;
+        }
+        console.log(`Profile for peer: ${id}`);
+        console.log(`  Updated: ${profile.updatedAt}`);
+        const fieldKeys = Object.keys(profile.fields);
+        if (fieldKeys.length === 0) {
+          console.log("  No profile fields yet.");
+        } else {
+          for (const k of fieldKeys) {
+            console.log(`  ${k}:`);
+            console.log(`    ${profile.fields[k]}`);
+          }
+        }
+      });
+      peerCmd.command("migrate").description(
+        "Migrate legacy identity-anchor data into peers/self/identity.md (issue #679 PR 5/5). Idempotent: safe to run multiple times. Use --dry-run to preview without writing."
+      ).option("--dry-run", "Preview the proposed peer record without writing anything to disk").option("--display-name <name>", 'Override the default display name for the self peer (default: "Self")').option("--json", "Emit machine-readable JSON result").action(async (...args) => {
+        const options = args[0] ?? {};
+        const isDryRun = options.dryRun === true;
+        const displayName = typeof options.displayName === "string" && options.displayName.length > 0 ? options.displayName : void 0;
+        const { migrateFromIdentityAnchor } = await import("./migrate-from-identity-anchor-TTEDEJGX.js");
+        let result;
+        try {
+          result = await migrateFromIdentityAnchor({
+            memoryDir: orchestrator.config.memoryDir,
+            dryRun: isDryRun,
+            ...displayName !== void 0 ? { displayName } : {}
+          });
+        } catch (err) {
+          console.error(`Migration failed: ${err.message}`);
+          process.exit(1);
+        }
+        if (options.json === true) {
+          console.log(JSON.stringify(result, null, 2));
+          return;
+        }
+        if (result.skipped) {
+          console.log(`Peer "self" already exists \u2014 migration skipped (idempotent).`);
+          console.log(`  peers/self/identity.md is unchanged.`);
+          return;
+        }
+        if (result.dryRun) {
+          console.log(`[dry-run] Migration preview \u2014 nothing was written.`);
+          console.log(`  Proposed peer id:   ${result.peer.id}`);
+          console.log(`  Proposed kind:      ${result.peer.kind}`);
+          console.log(`  Proposed name:      ${result.peer.displayName}`);
+          if (result.identityAnchorSource) {
+            console.log(`  Would read anchor:  ${result.identityAnchorSource}`);
+          }
+          if (result.identityMdSource) {
+            console.log(`  Would read identity:${result.identityMdSource}`);
+          }
+          if (!result.identityAnchorSource && !result.identityMdSource) {
+            console.log(`  No legacy source files found \u2014 self peer would be created with no notes.`);
+          }
+          return;
+        }
+        console.log(`Migrated identity-anchor data to peers/self/identity.md.`);
+        if (result.identityAnchorSource) {
+          console.log(`  Read anchor:  ${result.identityAnchorSource}`);
+        }
+        if (result.identityMdSource) {
+          console.log(`  Read identity:${result.identityMdSource}`);
+        }
+        if (!result.identityAnchorSource && !result.identityMdSource) {
+          console.log(`  No legacy source files found \u2014 self peer created with no notes.`);
+        }
+        console.log(`
+Legacy identity-anchor files are untouched. Verify the migration result`);
+        console.log(`with \`remnic peer show self\` before archiving legacy files.`);
+      });
+      cmd.command("console").description(
+        "Operator console (issue #688). With no flags: launches the interactive TUI. With --state-only: prints a single JSON snapshot. With --record-trace <path>: appends every snapshot to a JSONL file. With --trace <path>: replays a recorded trace at the original cadence (or --speed N)."
+      ).option(
+        "--state-only",
+        "Print a single console-state snapshot as JSON and exit"
+      ).option(
+        "--record-trace <path>",
+        "Append every snapshot to <path> as JSONL while the TUI runs"
+      ).option(
+        "--trace <path>",
+        "Replay a recorded JSONL trace file frame-by-frame at the original cadence"
+      ).option(
+        "--speed <multiplier>",
+        "Replay speed multiplier (default 1.0). 2.0 = twice as fast; 0.5 = half speed."
+      ).action(async (...args) => {
+        const options = args[0] ?? {};
+        if (options.stateOnly === true) {
+          const { gatherConsoleState } = await import("./state-NCHQ4TRG.js");
+          const snapshot = await gatherConsoleState(orchestrator);
+          console.log(JSON.stringify(snapshot, null, 2));
+          return;
+        }
+        if (typeof options.trace === "string" && options.trace.length > 0) {
+          const { replayTrace, parseSpeedFlag } = await import("./trace-C5ETWBEF.js");
+          const { expandTildePath: expandTildePath2 } = await import("./path-RMTY5Y5A.js");
+          const tracePath = expandTildePath2(options.trace);
+          let speed;
+          try {
+            speed = parseSpeedFlag(options.speed);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`remnic console: ${msg}`);
+            process.exitCode = 2;
+            return;
+          }
+          const replayAbort = new AbortController();
+          const replaySigintHandler = () => replayAbort.abort();
+          process.on("SIGINT", replaySigintHandler);
+          try {
+            await replayTrace(tracePath, {
+              speed,
+              signal: replayAbort.signal
+            });
+          } finally {
+            try {
+              process.removeListener("SIGINT", replaySigintHandler);
+            } catch {
+            }
+          }
+          return;
+        }
+        const { runConsoleTui } = await import("./tui-RI7P6PBS.js");
+        let recorder = null;
+        if (typeof options.recordTrace === "string" && options.recordTrace.length > 0) {
+          const { openTraceRecorder } = await import("./trace-C5ETWBEF.js");
+          const { expandTildePath: expandTildePath2 } = await import("./path-RMTY5Y5A.js");
+          recorder = await openTraceRecorder(
+            expandTildePath2(options.recordTrace)
+          );
+        }
+        const handle = runConsoleTui(orchestrator, {
+          traceRecorder: recorder ?? void 0
+        });
+        try {
+          await handle.done;
+        } finally {
+          if (recorder) {
+            const CLOSE_TIMEOUT_MS = 2e3;
+            const { flushWithTimeout } = await import("./trace-C5ETWBEF.js");
+            const flushResult = await flushWithTimeout(
+              (signal) => recorder.close(signal),
+              CLOSE_TIMEOUT_MS
+            );
+            if (flushResult.timedOut) {
+              console.warn(
+                `[remnic console] trace flush timed out after ${CLOSE_TIMEOUT_MS}ms; some final frames may be lost`
+              );
+            }
+            if (flushResult.error != null) {
+              const msg = flushResult.error instanceof Error ? flushResult.error.message : String(flushResult.error);
+              console.warn(
+                `[remnic console] trace flush error: ${msg}`
+              );
+            }
+          }
+        }
+      });
     },
     { commands: ["engram"] }
   );
@@ -8007,7 +9586,6 @@ export {
   formatBatchTranscript,
   runBulkImportPipeline,
   convertMemoriesToRecords,
-  parseStrictCliDate,
   registerTrainingExportAdapter,
   getTrainingExportAdapter,
   listTrainingExportAdapters,
@@ -8046,6 +9624,8 @@ export {
   runCueAnchorStatusCliCommand,
   runHarmonicSearchCliCommand,
   runVerifiedRecallSearchCliCommand,
+  isNormalRetrievalVisibleMemory,
+  filterNormalMemorySearchResults,
   runSemanticRulePromoteCliCommand,
   runCompoundingPromoteCliCommand,
   runSemanticRuleVerifyCliCommand,
@@ -8073,7 +9653,9 @@ export {
   runMigrateRescoreImportanceCliCommand,
   runMigrateRechunkCliCommand,
   runMigrateReextractCliCommand,
-  parseStrictCliDate2,
+  parseStrictCliDate2 as parseStrictCliDate,
+  parseDurationToMs,
+  hasDestructivePurgeFailures,
   runPolicyStatusCliCommand,
   runPolicyDiffCliCommand,
   runPolicyRollbackCliCommand,
@@ -8098,4 +9680,4 @@ export {
   resolveMemoryDirForNamespace,
   registerCli
 };
-//# sourceMappingURL=chunk-INXV5JBT.js.map
+//# sourceMappingURL=chunk-ZGXSCMQN.js.map