@remnic/core 9.3.726 → 9.3.728

package/src/orchestrator.ts

@@ -269,8 +269,10 @@ import { tryDirectAnswer, type DirectAnswerSources } from "./direct-answer-wirin
 import {
   resolveCapabilities,
   resolveGraphConstructionCapabilities,
+  resolveMemoryLifecycleCapabilities,
   type CapabilitySet,
   type GraphConstructionCapabilitySet,
+  type MemoryLifecycleCapabilitySet,
 } from "./capabilities.js";
 import { DEFAULT_TAXONOMY } from "./taxonomy/index.js";
 import {
@@ -2771,16 +2773,28 @@ export class Orchestrator {
     dedupContent: string,
     bounds: {
       invalidAt?: string;
+      // #1707 thread 2 — per-fact start bound (valid_at). Carried so a
+      // re-extracted duplicate whose event time yields only a start bound
+      // ("since 2024", "yesterday", an absolute date) gets the corrected
+      // per-fact anchoring onto the existing copy.
+      validFrom?: string;
       observedAt?: string;
       eventTimeSource?: "extracted" | "assumed";
     },
     entityRef?: string,
   ): Promise<void> {
-    // I/O gate: only scan when there is an end bound to backfill. Without
-    // invalidAt there is nothing that changes recall behavior — observedAt
-    // and eventTimeSource alone do not expire a fact. This avoids a full
-    // readAllMemories on every dedup short-circuit under biTemporal.
-    if (!bounds.invalidAt) return;
+    // I/O gate: scan when there is a recall-relevant bound to backfill —
+    // either an end bound (invalidAt, which expires the fact) or a corrected
+    // EXTRACTED start bound. A start bound only changes recall when it is
+    // extracted (the as-of filter excludes facts whose valid_at is after the
+    // as-of instant); an "assumed" validFrom is just the ingestion anchor
+    // (resolveFactEventTime sets one for every fact), so scanning on it would
+    // run a full readAllMemories on every bi-temporal dedup hit for no benefit
+    // (review cursor PRRT_OvHk / codex PRRT_OvHxVH). observedAt and
+    // eventTimeSource alone never change recall.
+    const hasExtractedStart =
+      bounds.validFrom !== undefined && bounds.eventTimeSource === "extracted";
+    if (!bounds.invalidAt && !hasExtractedStart) return;
     try {
       const incomingHash = ContentHashIndex.computeHash(dedupContent);
       const normalizedIncoming = ContentHashIndex.normalizeContent(dedupContent);
@@ -2839,6 +2853,37 @@ export class Orchestrator {
       ) {
         patch.eventTimeSource = bounds.eventTimeSource;
       }
+      // #1707 thread 2 — per-fact-anchored start bound. A re-extracted
+      // duplicate whose event time resolves a real start bound must carry
+      // that anchor onto the existing copy so as-of recall uses the corrected
+      // valid_at instead of a stale batch-anchored value. Only an EXTRACTED
+      // bound corrects; an "assumed" bound is just the ingestion anchor.
+      //
+      // No-clobber via equality, not provenance inference: exact-content dedup
+      // re-extracts the SAME event-time expression, which #1670 per-fact
+      // anchoring resolves deterministically to the same validFrom — so for
+      // stable content the incoming validFrom EQUALS the copy's valid_at and
+      // we skip the redundant write (the only no-clobber that holds without a
+      // fragile provenance heuristic — review codex PRRT_Ov7LKC). When they
+      // differ (a prior batch/assumed anchor, end-only assumed start, or a
+      // non-deterministic re-resolution), the extracted validFrom is the
+      // authoritative correction and overwrites. The eventTimeSource upgrade
+      // below records that the start is now extracted-anchored.
+      if (
+        bounds.validFrom &&
+        bounds.eventTimeSource === "extracted" &&
+        fm.valid_at !== bounds.validFrom
+      ) {
+        patch.valid_at = bounds.validFrom;
+        // Mark the copy extracted-anchored in the SAME patch so its provenance
+        // reflects the correction (review cursor PRRT_OvHM / codex PRRT_OvHxVD):
+        // without this, a copy upgraded from "assumed" would keep "assumed"
+        // provenance while carrying an extracted start. (The earlier
+        // eventTimeSource block only fills an EMPTY source.)
+        if (fm.eventTimeSource !== "extracted") {
+          patch.eventTimeSource = "extracted";
+        }
+      }
       if (Object.keys(patch).length === 0) return;
       const ok = await targetStorage.writeMemoryFrontmatter(existing, patch);
       if (ok) {
@@ -3051,9 +3096,10 @@ export class Orchestrator {
     );
     // BoxBuilders are created per-namespace on first use in runExtraction().
 
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(config);
     // Temporal Memory Tree (v8.2) — lazy build during consolidation
     this.tmtBuilder = new TmtBuilder(config.memoryDir, {
-      temporalMemoryTreeEnabled: config.temporalMemoryTreeEnabled,
+      temporalMemoryTreeEnabled: lifecycleCaps.temporalMemoryTree,
       tmtHourlyMinMemories: config.tmtHourlyMinMemories,
       tmtSummaryMaxTokens: config.tmtSummaryMaxTokens,
     });
@@ -3611,6 +3657,7 @@ export class Orchestrator {
   }
 
   private async deferredInitialize(signal: AbortSignal): Promise<void> {
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
 
     // Sync QMD index with current disk state so recall finds recently-written
     // facts. Without this, the index stays stale from the last extraction-
@@ -3664,7 +3711,7 @@ export class Orchestrator {
           }),
       );
     }
-    if (this.config.embeddingFallbackEnabled) {
+    if (resolveMemoryLifecycleCapabilities(this.config).embeddingFallback) {
       warmupPromises.push(
         this.embeddingFallback
           .isAvailable()
@@ -3749,7 +3796,7 @@ export class Orchestrator {
     // sweep (capped at 50 demotions) so the hot tier isn't flooded on the
     // first real cron pass. Non-fatal — a failure here must not break init.
     if (signal.aborted) return;
-    if (this.config.lifecyclePolicyEnabled && this.config.qmdTierMigrationEnabled) {
+    if (lifecycleCaps.lifecyclePolicy && this.config.qmdTierMigrationEnabled) {
       try {
         const { runFirstStartMigration } = await import(
           "./maintenance/first-start-migration.js"
@@ -4074,6 +4121,7 @@ export class Orchestrator {
    * default storage.
    */
   async runLifecyclePolicyFanout(): Promise<NamespaceMaintenanceSummary> {
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
     return this.runNamespaceMaintenanceFanoutForJob(
       "lifecycle",
       async (ctx) => {
@@ -4082,7 +4130,7 @@ export class Orchestrator {
         const assessed = await this.runLifecyclePolicyPass(corpus, storage);
         return { itemCount: assessed };
       },
-      { enabled: this.config.lifecyclePolicyEnabled },
+      { enabled: lifecycleCaps.lifecyclePolicy },
     );
   }
 
@@ -7395,6 +7443,7 @@ export class Orchestrator {
     options: RecallInvocationOptions = {},
     caps: CapabilitySet = resolveCapabilities(this.config),
     graphCaps: GraphConstructionCapabilitySet = resolveGraphConstructionCapabilities(this.config),
+    lifecycleCaps: MemoryLifecycleCapabilitySet = resolveMemoryLifecycleCapabilities(this.config),
   ): Promise<string> {
     const recallStart = Date.now();
     // Backend degradations observed by this recall's QMD searches (#1536):
@@ -10802,9 +10851,9 @@ export class Orchestrator {
     if (
       this.isRecallSectionEnabled(
         "temporal-memory-tree",
-        this.config.temporalMemoryTreeEnabled === true,
+        lifecycleCaps.temporalMemoryTree,
       ) &&
-      this.config.temporalMemoryTreeEnabled &&
+      lifecycleCaps.temporalMemoryTree &&
       recallMode !== "minimal" &&
       (recallMode as RecallPlanMode) !== "no_recall"
     ) {
@@ -11664,7 +11713,7 @@ export class Orchestrator {
           // Using the shared gate fixes both Finding 2 and Finding 3 from
           // PR #402 (round 6).
           const supersessionOptions = {
-            enabled: this.config.temporalSupersessionEnabled,
+            enabled: lifecycleCaps.temporalSupersession,
             includeInRecall: this.config.temporalSupersessionIncludeInRecall,
           };
           // Cursor Medium on PR #713: when `as_of` is active, the
@@ -13188,7 +13237,8 @@ export class Orchestrator {
     turns: BufferTurn[],
     options: { commit?: boolean; bufferKey?: string } = {},
   ): boolean {
-    if (!this.config.extractionDedupeEnabled) return true;
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
+    if (!lifecycleCaps.extractionDedupe) return true;
     if (!Array.isArray(turns) || turns.length === 0) return false;
 
     const bufferKey = options.bufferKey ?? turns[0]?.sessionKey ?? "default";
@@ -14047,6 +14097,7 @@ export class Orchestrator {
     /** Verbatim source turn text the facts were extracted from (faithfulness gate #1576). */
     sourceText?: string,
     graphCaps: GraphConstructionCapabilitySet = resolveGraphConstructionCapabilities(this.config),
+    lifecycleCaps: MemoryLifecycleCapabilitySet = resolveMemoryLifecycleCapabilities(this.config),
   ): Promise<string[]> {
     // Inline source attribution (issue #369). When enabled, every extracted
     // fact is rewritten to carry a compact provenance tag inside its body so
@@ -14302,12 +14353,14 @@ export class Orchestrator {
             // lacks (re-extraction with a now-resolved invalidAt). Best-effort,
             // fail-open; the helper gates on invalidAt to avoid I/O when no
             // end bound is present.
-            if (options.invalidAt) {
+            if (options.invalidAt || options.validAt) {
               await this.backfillTemporalBoundsOnDedupHit(
                 targetStorage,
                 dedupContent,
                 {
                   invalidAt: options.invalidAt,
+                  // #1707 thread 2 — carry the corrected start bound.
+                  validFrom: options.validAt,
                   ...(options.observedAt ? { observedAt: options.observedAt } : {}),
                   ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
                 },
@@ -14343,7 +14396,7 @@ export class Orchestrator {
             },
           );
           if (
-            this.config.temporalSupersessionEnabled &&
+            lifecycleCaps.temporalSupersession &&
             options.category === "fact" &&
             options.entityRef &&
             options.structuredAttributes &&
@@ -14481,12 +14534,14 @@ export class Orchestrator {
           // before the supersession short-circuit. Covers all return paths below
           // (supersession-hit, catch-skip, and the no-supersession short-circuit)
           // in one shot. Best-effort / fail-open; the helper gates on invalidAt.
-          if (options.invalidAt) {
+          if (options.invalidAt || options.validAt) {
             await this.backfillTemporalBoundsOnDedupHit(
               sharedStorage,
               dedupContent,
               {
                 invalidAt: options.invalidAt,
+                // #1707 thread 2 — carry the corrected start bound.
+                validFrom: options.validAt,
                 ...(options.observedAt ? { observedAt: options.observedAt } : {}),
                 ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
               },
@@ -14505,7 +14560,7 @@ export class Orchestrator {
           // would have run post-writeMemory.  This is a best-effort / fail-open
           // step — if the lookup fails we skip silently (same as the normal path).
           if (
-            this.config.temporalSupersessionEnabled &&
+            lifecycleCaps.temporalSupersession &&
             options.entityRef &&
             options.structuredAttributes &&
             Object.keys(options.structuredAttributes).length > 0
@@ -14667,7 +14722,7 @@ export class Orchestrator {
         // shared recall continues returning the stale state.  Reuses the same
         // applyTemporalSupersession helper — no logic duplication.
         if (
-          this.config.temporalSupersessionEnabled &&
+          lifecycleCaps.temporalSupersession &&
           options.entityRef &&
           options.structuredAttributes &&
           Object.keys(options.structuredAttributes).length > 0
@@ -14717,6 +14772,116 @@ export class Orchestrator {
         );
       }
     };
+    // #1707 thread 1 — backfill temporal bounds onto promotion copies when the
+    // SOURCE-namespace dedup short-circuit fires. That branch patches the
+    // source copy then `continue`s before the promotion dedup paths run, so
+    // promoted shared/profile copies written before the source fact carried
+    // resolved bounds stay stale (cross-namespace recall surfaces an expired
+    // fact). This mirrors the promotion-target resolution used by the two
+    // promote closures above and calls the same fail-open helper against each
+    // target storage. Backfill-only: never writes a new promoted copy.
+    const backfillTemporalBoundsOnPromotionCopies = async (args: {
+      sourceStorage: StorageManager;
+      content: string;
+      category: string;
+      confidence: number;
+      entityRef?: string;
+      structuredAttributes?: Record<string, string>;
+      bounds: {
+        invalidAt?: string;
+        validFrom?: string;
+        observedAt?: string;
+        eventTimeSource?: "extracted" | "assumed";
+      };
+    }): Promise<void> => {
+      // Mirror the helper's I/O gate: only resolve promotion targets when
+      // there is an end bound OR an EXTRACTED start bound. An "assumed"
+      // validFrom is just the ingestion anchor (no recall effect), so
+      // skipping it avoids resolving target storages on every bi-temporal
+      // duplicate (review cursor PRRT_OvHk).
+      const hasExtractedStart =
+        args.bounds.validFrom !== undefined &&
+        args.bounds.eventTimeSource === "extracted";
+      if (!args.bounds.invalidAt && !hasExtractedStart) return;
+      // Build the same dedupContent the promotion functions hash on so the
+      // content-hash lookup in the helper matches what was stored.
+      const rawContent =
+        citationEnabled && hasCitationForTemplate(args.content, citationTemplate)
+          ? stripCitationForTemplate(args.content, citationTemplate)
+          : args.content;
+      const sanitizedBase = sanitizeMemoryContent(rawContent);
+      const dedupContent =
+        args.category === "fact" &&
+        args.structuredAttributes &&
+        Object.keys(args.structuredAttributes).length > 0
+          ? `${sanitizedBase.text}\n[Attributes: ${normalizeAttributePairs(args.structuredAttributes)}]`
+          : sanitizedBase.text;
+      // Profile targets. NOTE: we do NOT gate on profileAutoPromotionAllows —
+      // a promoted profile copy may exist from an EARLIER extraction with
+      // higher confidence or older auto-promote settings, so the current
+      // duplicate's confidence must not skip backfilling an already-existing
+      // promoted copy (review codex PRRT_Ov7LKF). The helper no-ops when no
+      // matching copy is found, so resolving all configured auto-promote
+      // targets is safe.
+      if (scopeProfileWritePlan) {
+        const autoTargets = new Set(
+          scopeProfileWritePlan.profile.autoPromote.targets,
+        );
+        const profileTargets = scopeProfileWritePlan.promotionTargets.filter(
+          (target) =>
+            target.target !== "serverShared" &&
+            autoTargets.has(target.target) &&
+            target.authorized &&
+            target.namespace,
+        );
+        for (const target of profileTargets) {
+          if (!target.namespace) continue;
+          try {
+            const targetStorage = await this.storageRouter.storageFor(
+              target.namespace,
+            );
+            if (targetStorage.dir === args.sourceStorage.dir) continue;
+            await this.backfillTemporalBoundsOnDedupHit(
+              targetStorage,
+              dedupContent,
+              args.bounds,
+              args.entityRef,
+            );
+          } catch (err) {
+            log.warn(
+              `bitemporal-backfill: profile-target backfill failed open for ${target.target}: ${err}`,
+            );
+          }
+        }
+      }
+      // Shared target. A shared copy may exist from an earlier extraction
+      // regardless of the current confidence, so do not gate on
+      // shouldPromoteToShared (review codex PRRT_Ov7LKF) — BUT still respect
+      // shared-write AUTHORIZATION: a scoped profile that does not authorize
+      // serverShared writes must not have its shared namespace backfilled
+      // (review codex PRRT_Ov7dHR). profileAllowsSharedWrites is true for the
+      // legacy no-scope case and encodes the readable/writable/authorized
+      // checks under a scope profile.
+      if (profileAllowsSharedWrites) {
+        try {
+          const sharedStorage = await this.storageRouter.storageFor(
+            this.config.sharedNamespace,
+          );
+          if (sharedStorage.dir !== args.sourceStorage.dir) {
+            await this.backfillTemporalBoundsOnDedupHit(
+              sharedStorage,
+              dedupContent,
+              args.bounds,
+              args.entityRef,
+            );
+          }
+        } catch (err) {
+          log.warn(
+            `bitemporal-backfill: shared-target backfill failed open: ${err}`,
+          );
+        }
+      }
+    };
 
     // Defensive: validate result and facts array
     if (!result || !Array.isArray(result.facts)) {
@@ -14867,7 +15032,7 @@ export class Orchestrator {
     // persistExtraction call so stale state from a prior call cannot leak
     // into the caller's buffer-retention decision.
     this.lastPersistExtractionDeferredCount = 0;
-    if (this.config.extractionJudgeEnabled) {
+    if (lifecycleCaps.extractionJudge) {
       // #1669 P1: pre-filter redacted facts from judge candidates so never-store
       // content is not persisted as judge training data.
       let preJudgeRedactionRules: CompiledRedactionRule[] = [];
@@ -14933,7 +15098,7 @@ export class Orchestrator {
         // off; the combined callback itself is undefined when both are
         // disabled so there is zero overhead in the default configuration.
         const judgeTelemetryOpts = {
-          enabled: this.config.extractionJudgeTelemetryEnabled === true,
+          enabled: lifecycleCaps.extractionJudgeTelemetry,
           memoryDir: this.config.memoryDir,
         };
         const judgeTrainingOpts = {
@@ -15144,7 +15309,7 @@ export class Orchestrator {
       // do not block scope routing). Rule 30: gated by
       // extractionScopeClassificationEnabled.
       if (
-        this.config.extractionScopeClassificationEnabled &&
+        lifecycleCaps.extractionScopeClassification &&
         this.config.namespacesEnabled &&
         fact.scope === "global" &&
         !routedNamespaceExplicit
@@ -15226,7 +15391,20 @@ export class Orchestrator {
         // Skip when the fact would be rejected/deferred/pending by downstream
         // gates — a non-durable candidate must not expire an active fact
         // (chatgpt-codex P1: faithfulness, requireSpans, extraction judge).
-        if (biTemporal && biTemporal.validUntil) {
+        // #1671 + #1707: backfill bi-temporal bounds onto the existing
+        // source-namespace copy if it lacks bounds the incoming fact now
+        // carries (re-extraction with a resolved bound). #1707 thread 3:
+        // gate on writeCategory === "fact" — the helper only matches facts,
+        // so a non-fact duplicate must not reach the fact-only scan.
+        // #1707 thread 2: also fire when only a corrected start bound
+        // (validFrom) is present, not just an end bound (validUntil). The
+        // downstream-gate skip still applies — a non-durable candidate must
+        // not expire an active fact (chatgpt-codex P1).
+        if (
+          biTemporal &&
+          writeCategory === "fact" &&
+          (biTemporal.validUntil || biTemporal.validFrom)
+        ) {
           const fr = faithfulnessResultsByFactIndex?.get(factLoopIndex);
           const faithfulnessWouldPending =
             faithfulnessMode === "enforce" &&
@@ -15254,11 +15432,33 @@ export class Orchestrator {
               contentHashDedupKey,
               {
                 invalidAt: biTemporal.validUntil,
+                // #1707 thread 2 — carry the corrected start bound too.
+                validFrom: biTemporal.validFrom,
                 observedAt: biTemporal.observedAt,
                 eventTimeSource: biTemporal.eventTimeSource,
               },
               fact.entityRef,
             );
+            // #1707 thread 1 — the source branch short-circuits (`continue`
+            // below) before the promotion dedup paths run, so promoted
+            // shared/profile copies written before the source fact carried
+            // resolved bounds stay stale and cross-namespace recall surfaces
+            // an expired fact. Backfill the promotion targets too (fail-open,
+            // backfill-only — never writes a new promoted copy).
+            await backfillTemporalBoundsOnPromotionCopies({
+              sourceStorage: targetStorage,
+              content: fact.content,
+              category: writeCategory,
+              confidence: fact.confidence,
+              entityRef: fact.entityRef,
+              structuredAttributes: fact.structuredAttributes,
+              bounds: {
+                invalidAt: biTemporal.validUntil,
+                validFrom: biTemporal.validFrom,
+                observedAt: biTemporal.observedAt,
+                eventTimeSource: biTemporal.eventTimeSource,
+              },
+            });
           }
         }
         log.debug(
@@ -15762,7 +15962,7 @@ export class Orchestrator {
                 // #1578 r3: an extracted end-only bound (validFrom absent) is
                 // historical, not a new authoritative state — never let it
                 // supersede a later active fact (codex P1 on :15534).
-                enabled: this.config.temporalSupersessionEnabled &&
+                enabled: lifecycleCaps.temporalSupersession &&
                   !(biTemporal && !biTemporal.validFrom),
               });
             } catch (err) {
@@ -15998,7 +16198,7 @@ export class Orchestrator {
             entityRef: supersessionEntityRef,
             structuredAttributes: fact.structuredAttributes,
             createdAt: supersessionOrderingAt(biTemporal?.validFrom ?? sourceContext?.validAt),
-            enabled: this.config.temporalSupersessionEnabled &&
+            enabled: lifecycleCaps.temporalSupersession &&
               !(biTemporal && !biTemporal.validFrom),
           });
         } catch (err) {
@@ -16365,7 +16565,7 @@ export class Orchestrator {
     storage: StorageManager,
     memoryId: string,
   ): Promise<void> {
-    if (!this.config.embeddingFallbackEnabled) return;
+    if (!resolveMemoryLifecycleCapabilities(this.config).embeddingFallback) return;
     if (!(await this.embeddingFallback.isAvailable())) return;
     const memory = await storage.getMemoryById(memoryId);
     if (!memory) return;
@@ -16557,6 +16757,7 @@ export class Orchestrator {
     merged: number;
     invalidated: number;
   }> {
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
     log.info("running consolidation pass");
     let merged = 0;
     let invalidated = 0;
@@ -16793,7 +16994,7 @@ export class Orchestrator {
     }
 
     // v8.3 Lifecycle policy pass — deterministic promotion/decay metadata
-    if (this.config.lifecyclePolicyEnabled) {
+    if (lifecycleCaps.lifecyclePolicy) {
       try {
         const lightSleepStartedAt = new Date().toISOString();
         const lifecycleCorpus = await this.storage.readAllMemories();
@@ -16981,7 +17182,7 @@ export class Orchestrator {
     await this.storage.saveMeta(meta);
 
     // Temporal Memory Tree (v8.2) — rebuild nodes from all memories, fail-open
-    if (this.config.temporalMemoryTreeEnabled) {
+    if (lifecycleCaps.temporalMemoryTree) {
       try {
         const tmtEntries = allMemories
           .filter(
@@ -17523,6 +17724,7 @@ export class Orchestrator {
     let updatedCount = 0;
     let disputedCount = 0;
     let evaluatedCount = 0;
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
 
     const thresholds = this.effectiveLifecycleThresholds();
     const policy = {
@@ -17588,7 +17790,7 @@ export class Orchestrator {
 
     // Report how many memories had frontmatter rewritten so callers can record a
     // catalog write touch for lifecycle-only passes (codex NR-tS).
-    if (!this.config.lifecycleMetricsEnabled) return updatedCount;
+    if (!lifecycleCaps.lifecycleMetrics) return updatedCount;
 
     const total = evaluatedCount;
     const metrics = {
@@ -19034,7 +19236,7 @@ export class Orchestrator {
     //   • search() throws                 → re-throw (network/provider error).
     //   • search() returns []             → return [] (empty index, not a
     //     backend failure; decideSemanticDedup reports no_candidates).
-    if (!this.config.embeddingFallbackEnabled) {
+    if (!resolveMemoryLifecycleCapabilities(this.config).embeddingFallback) {
       throw new Error("semantic dedup: embedding backend not configured");
     }
     if (!(await this.embeddingFallback.isAvailable())) {
@@ -19108,7 +19310,7 @@ export class Orchestrator {
     query: string,
     limit: number,
   ): Promise<QmdSearchResult[]> {
-    if (!this.config.embeddingFallbackEnabled) return [];
+    if (!resolveMemoryLifecycleCapabilities(this.config).embeddingFallback) return [];
     if (!(await this.embeddingFallback.isAvailable())) return [];
     const hits = await this.embeddingFallback.search(query, limit);
     if (hits.length === 0) return [];
@@ -19818,6 +20020,7 @@ export class Orchestrator {
       blockedPaths?: Set<string>;
     },
   ): QmdSearchResult[] {
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
     let lifecycleFilteredCount = 0;
     let temporalSupersededFilteredCount = 0;
     let biTemporalExpiredFilteredCount = 0;
@@ -19851,9 +20054,9 @@ export class Orchestrator {
         if (
           options?.allowLifecycleFiltered !== true &&
           shouldFilterLifecycleRecallCandidate(memory.frontmatter, {
-            lifecyclePolicyEnabled: this.config.lifecyclePolicyEnabled,
+            lifecyclePolicyEnabled: lifecycleCaps.lifecyclePolicy,
             lifecycleFilterStaleEnabled:
-              this.config.lifecycleFilterStaleEnabled,
+              lifecycleCaps.lifecycleFilterStale,
           })
         ) {
           lifecycleFilteredCount += 1;
@@ -19887,7 +20090,7 @@ export class Orchestrator {
           // half-open `[valid_at, invalid_at)` evaluation in isValidAsOf
           // is the authoritative gate for historical recall.
           shouldFilterSupersededFromRecall(memory.frontmatter, {
-            enabled: this.config.temporalSupersessionEnabled,
+            enabled: lifecycleCaps.temporalSupersession,
             includeInRecall: this.config.temporalSupersessionIncludeInRecall,
           })
         ) {
@@ -20031,6 +20234,7 @@ export class Orchestrator {
       asOfMs?: number;
     },
   ): Promise<QmdSearchResult[]> {
+    const lifecycleCaps = resolveMemoryLifecycleCapabilities(this.config);
     if (results.length === 0) return results;
 
     const safety = await this.filterSearchResultsForRecall(
@@ -20205,7 +20409,7 @@ export class Orchestrator {
         const lifecycleDelta = lifecycleRecallScoreAdjustment(
           memory.frontmatter,
           {
-            lifecyclePolicyEnabled: this.config.lifecyclePolicyEnabled,
+            lifecyclePolicyEnabled: lifecycleCaps.lifecyclePolicy,
           },
         );
         score += applyUtilityRankingRuntimeDelta(