@remnic/core 9.3.751 → 9.3.753

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { PluginEntryResolverOptions, resolvePluginEntry } from './plugin-entry-resolver.js';
 export { isOpenaiApiKeyDisabled, parseConfig, resolveEnvVars } from './config.js';
 export { MigrationOptions, MigrationResult, RollbackResult, migrateFromEngram, rollbackFromEngramMigration } from './migrate/from-engram.js';
-import { b as SpeakerRegistry, W as WearablesService } from './orchestrator-D7bb8ZGp.js';
-export { D as DEFAULT_SELF_NAME, O as Orchestrator, c as ResolvedSpeaker, d as SpeakerOverride, e as WEARABLE_SOURCE_PREFIX, f as WearableDayTranscriptView, g as WearableMemoryGenDeps, h as WearableMemoryGenResult, i as WearableMemorySearchResult, j as WearableMemoryWriter, k as WearableSearchBackend, l as WearableStorageIo, m as WearableSyncDeps, n as WearableSyncOptions, o as WearableTranscriptSearchResult, p as WearablesServiceDeps, q as buildExtractionTurns, r as dateInTimezone, s as defaultTimezone, t as defaultWorkspaceDir, u as distinctSpeakerLabels, v as emptySpeakerRegistry, w as generateWearableMemories, x as importNativeMemories, y as loadSpeakerRegistry, z as locateTranscriptPath, A as memoryStatusForMode, B as resolveSpeaker, C as resolveSyncDates, E as sanitizeSessionKeyForFilename, F as saveSpeakerRegistry, H as speakerRegistryKey, J as speakersFilePath, K as syncWearableSource, L as wearableDayTag, M as wearableSourceLabel, N as writeDailyDigestMemory } from './orchestrator-D7bb8ZGp.js';
+import { b as SpeakerRegistry, W as WearablesService } from './orchestrator-D7ZGOQLX.js';
+export { D as DEFAULT_SELF_NAME, O as Orchestrator, c as ResolvedSpeaker, d as SpeakerOverride, e as WEARABLE_SOURCE_PREFIX, f as WearableDayTranscriptView, g as WearableMemoryGenDeps, h as WearableMemoryGenResult, i as WearableMemorySearchResult, j as WearableMemoryWriter, k as WearableSearchBackend, l as WearableStorageIo, m as WearableSyncDeps, n as WearableSyncOptions, o as WearableTranscriptSearchResult, p as WearablesServiceDeps, q as buildExtractionTurns, r as dateInTimezone, s as defaultTimezone, t as defaultWorkspaceDir, u as distinctSpeakerLabels, v as emptySpeakerRegistry, w as generateWearableMemories, x as importNativeMemories, y as loadSpeakerRegistry, z as locateTranscriptPath, A as memoryStatusForMode, B as resolveSpeaker, C as resolveSyncDates, E as sanitizeSessionKeyForFilename, F as saveSpeakerRegistry, H as speakerRegistryKey, J as speakersFilePath, K as syncWearableSource, L as wearableDayTag, M as wearableSourceLabel, N as writeDailyDigestMemory } from './orchestrator-D7ZGOQLX.js';
 export { normalizeProjectionPreview, normalizeProjectionTags } from './memory-projection-format.js';
 export { ModelCapabilities, ModelRegistry } from './model-registry.js';
 export { ACTIVE_STATUSES, ContradictionFilter, ContradictionJudgeBatchResult, ContradictionJudgeInput, ContradictionJudgeResult, ContradictionListResult, ContradictionVerdict, ResolutionResult, ResolutionVerb, ScanDependencies, ScanResult, computePairId, executeResolution, isCoolingDown, isValidResolutionVerb, judgeContradictionPairs, listPairs, readPair, resolvePair, runContradictionScan, writePair, writePairs } from './contradiction/index.js';
@@ -20,11 +20,11 @@ export { CodexCliFallbackConfig, CodexCliFallbackMessage, CodexCliFallbackOption
 export { BufferSurpriseProbe, SmartBuffer, TriggerDecision } from './buffer.js';
 export { ComputeSurpriseOptions, DEFAULT_SURPRISE_K, RecentMemoryLike, computeSurprise } from './buffer-surprise.js';
 export { BufferSurpriseDistribution, BufferSurpriseReader, BufferSurpriseReportOptions, reportBufferSurpriseDistribution } from './buffer-surprise-report.js';
-import { ax as CodingContext, aS as CodingModeConfig, P as PluginConfig, aT as CodingKnowledgeConfig, M as MemoryCategory, aU as WearableCleanupSettings, aF as WearableSourceSettings, aJ as WearablesConfig, aI as WearableSourceConnector, aE as WearableConversation, aN as WearableCorrectionRule, aV as WearableDayTranscriptMeta, aM as WearableDayTranscript } from './types-D4NYDtXI.js';
-export { X as AgentAccessAuthToken, r as BriefingActiveThread, aW as BriefingConfig, p as BriefingFocus, o as BriefingFollowup, aX as BriefingOpenCommitment, t as BriefingRecentEntity, s as BriefingResult, n as BriefingSections, aY as BriefingWindow, U as BufferSurpriseEvent, q as CalendarEvent, C as CalendarSource, aZ as CodexCompatConfig, aR as ConsolidationObservation, a9 as ContinuityImprovementLoop, a_ as DEFAULT_RECALL_DISCLOSURE, E as EntityFile, a5 as EntityStructuredSection, a$ as ExtractedFact, G as GatewayConfig, af as MemoryActionEligibilityContext, b0 as MemoryActionEligibilitySource, $ as MemoryActionType, g as MemoryFile, k as MemoryFrontmatter, b1 as MemoryObservation, b2 as MemoryScope, b3 as RECALL_DISCLOSURE_LEVELS, i as RecallDisclosure, W as SecretRef, b4 as WearableAuthCheck, b5 as WearableFetchOptions, b6 as WearableFetchPage, aH as WearableMemoryMode, aG as WearableNativeMemory, b7 as WearableNativeMemoryPage, aL as WearableSourceStatus, aK as WearableSyncSummary, b8 as WearableTranscriptSegment, b9 as isRecallDisclosure } from './types-D4NYDtXI.js';
+import { az as CodingContext, aS as CodingModeConfig, P as PluginConfig, aT as CodingKnowledgeConfig, h as MemoryCategory, aU as WearableCleanupSettings, aF as WearableSourceSettings, aJ as WearablesConfig, aI as WearableSourceConnector, aE as WearableConversation, aN as WearableCorrectionRule, aV as WearableDayTranscriptMeta, aM as WearableDayTranscript } from './types-DTEFxFuL.js';
+export { Z as AgentAccessAuthToken, m as BriefingActiveThread, aW as BriefingConfig, k as BriefingFocus, j as BriefingFollowup, aX as BriefingOpenCommitment, o as BriefingRecentEntity, n as BriefingResult, i as BriefingSections, aY as BriefingWindow, X as BufferSurpriseEvent, l as CalendarEvent, C as CalendarSource, aZ as CodexCompatConfig, aR as ConsolidationObservation, ab as ContinuityImprovementLoop, a_ as DEFAULT_RECALL_DISCLOSURE, E as EntityFile, a7 as EntityStructuredSection, a$ as ExtractedFact, G as GatewayConfig, ah as MemoryActionEligibilityContext, b0 as MemoryActionEligibilitySource, a1 as MemoryActionType, M as MemoryFile, q as MemoryFrontmatter, b1 as MemoryObservation, b2 as MemoryScope, b3 as RECALL_DISCLOSURE_LEVELS, R as RecallDisclosure, Y as SecretRef, b4 as WearableAuthCheck, b5 as WearableFetchOptions, b6 as WearableFetchPage, aH as WearableMemoryMode, aG as WearableNativeMemory, b7 as WearableNativeMemoryPage, aL as WearableSourceStatus, aK as WearableSyncSummary, b8 as WearableTranscriptSegment, b9 as isRecallDisclosure } from './types-DTEFxFuL.js';
 export { JudgeBatchResult, JudgeCandidate, JudgeVerdict, JudgeVerdictKind, clearVerdictCache, createVerdictCache, getVerdictKind, isDurableVerdict, isValidCachedVerdict, judgeFactDurability, normalizeCachedVerdict, verdictCacheSize } from './extraction-judge.js';
 export { hasBroadGraphIntent, inferIntentFromText, intentCompatibilityScore, isTaskInitiationIntent, planRecallMode } from './intent.js';
-export { i as EngramAccessInputError, g as EngramAccessService, P as ProcedureStatsConfigSnapshot, j as ProcedureStatsRecent, k as ProcedureStatsReport, l as ProcedureStatusCounts, m as computeProcedureStats, n as formatProcedureStatsText } from './access-service-DmAEOJdJ.js';
+export { q as EngramAccessInputError, p as EngramAccessService, P as ProcedureStatsConfigSnapshot, r as ProcedureStatsRecent, s as ProcedureStatsReport, t as ProcedureStatusCounts, u as computeProcedureStats, v as formatProcedureStatsText } from './access-service-MitduesD.js';
 export { FILTER_LABELS as DIRECT_ANSWER_FILTER_LABELS, DirectAnswerCandidate, DirectAnswerConfig, DirectAnswerInput, DirectAnswerReason, DirectAnswerResult, isDirectAnswerEligible } from './direct-answer.js';
 export { MemoryTier, TierRoutingPolicy, TierTransitionDecision, computeTierValueScore, decideTierTransition } from './tier-routing.js';
 export { ApplyReasoningTraceBoostOptions, BoostableResult, DEFAULT_REASONING_TRACE_BOOST, applyReasoningTraceBoost, isReasoningTracePath, looksLikeProblemSolvingQuery } from './reasoning-trace-recall.js';
@@ -38,7 +38,7 @@ export { OramaBackend } from './search/orama-backend.js';
 export { MeilisearchBackend } from './search/meilisearch-backend.js';
 export { buildEntityRecallSection } from './entity-retrieval.js';
 export { resolvePrincipal } from './namespaces/principal.js';
-export { N as NamespaceCatalog, c as NamespaceCatalogFilter, d as NamespaceCatalogRebuildResult, e as NamespaceCatalogSkippedRoot, f as NamespaceDiscoverySource, b as NamespaceKind, a as NamespaceRecord, g as NamespaceTouchMetadata } from './catalog-BpOcwHdE.js';
+export { N as NamespaceCatalog, c as NamespaceCatalogFilter, d as NamespaceCatalogRebuildResult, e as NamespaceCatalogSkippedRoot, f as NamespaceDiscoverySource, b as NamespaceKind, a as NamespaceRecord, g as NamespaceTouchMetadata } from './catalog-BEmNVRN0.js';
 export { SESSION_CHANNEL_TYPE, SessionIdentity, SessionStoragePaths, legacyParserReadbackDir, parseSessionIdentity, sessionStoragePaths } from './session-identity.js';
 export { storagePathHash } from './storage-paths.js';
 export { TrustZoneName, TrustZoneRecord, TrustZoneRecordKind, TrustZoneSourceClass, isTrustZoneName } from './trust-zones.js';
@@ -62,8 +62,8 @@ export { CitationBlock, CitationEntry, CitationMetadata, buildCitationGuidance,
 export { initLogger, log } from './logger.js';
 export { b as SemanticDedupDecision, a as SemanticDedupHit, S as SemanticDedupLookup, c as SemanticDedupOptions, d as decideSemanticDedup } from './semantic-DJR8_DMQ.js';
 export { OFFLINE_SYNC_APPLY_MAX_BODY_BYTES, OFFLINE_SYNC_CHANGESET_FORMAT, OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES, OFFLINE_SYNC_FILE_CONTENT_TRANSFER_CHUNK_BYTES, OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES, OFFLINE_SYNC_SNAPSHOT_FORMAT, OFFLINE_SYNC_STATE_VERSION, OfflineSyncApplyChangesetResult, OfflineSyncApplyFileContentChunkResult, OfflineSyncApplySnapshotResult, OfflineSyncChange, OfflineSyncChangeset, OfflineSyncConflict, OfflineSyncFileContentChunk, OfflineSyncFileDigest, OfflineSyncFileRecord, OfflineSyncFileState, OfflineSyncFileTarget, OfflineSyncFileWriteTarget, OfflineSyncSnapshot, OfflineSyncState, applyOfflineSyncChangeset, applyOfflineSyncFileContentChunk, applyOfflineSyncSnapshot, buildOfflineSyncChangeset, buildOfflineSyncChangesetFromSnapshot, buildOfflineSyncSnapshot, buildOfflineSyncSnapshotForPaths, buildOfflineSyncSnapshotFromBase, compileOfflineSyncExcludeGlobs, defaultOfflineSyncStatePath, fileStatesFromSnapshot, globToRegExp, iterateOfflineSyncSnapshotFileRecords, normalizeOfflineSyncChangeset, normalizeOfflineSyncSnapshot, offlineSyncStateFromSnapshot, readOfflineSyncFileContentChunk, readOfflineSyncState, shouldPreferIncomingOfflineRuntimeFile, summarizeOfflineSyncChangeset, summarizeOfflineSyncPendingChanges, summarizeOfflineSyncPendingFiles, writeOfflineSyncState } from './offline-sync.js';
-import { D as DiscoveredExtension } from './semantic-consolidation-CTfbVwCA.js';
-export { E as ExtensionSchema, R as REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT, b as buildExtensionsBlockForConsolidation, d as discoverMemoryExtensions, r as resolveExtensionsRoot } from './semantic-consolidation-CTfbVwCA.js';
+import { D as DiscoveredExtension } from './semantic-consolidation-7Sndms2M.js';
+export { E as ExtensionSchema, R as REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT, b as buildExtensionsBlockForConsolidation, d as discoverMemoryExtensions, r as resolveExtensionsRoot } from './semantic-consolidation-7Sndms2M.js';
 export { ConnectorCapability, ConnectorInstance, ConnectorManifest, ConnectorRegistry, DoctorCheck, DoctorResult, InstallOptions, InstallResult, MARKETPLACE_MANIFEST_FILENAME, MARKETPLACE_SCHEMA_VERSION, MarketplaceConfig, MarketplaceEntry, MarketplaceInstallResult, MarketplaceInstallType, MarketplaceLogger, MarketplaceManifest, MarketplaceValidation, RemoveResult, checkMarketplaceManifest, coerceInstallExtension, doctorConnector, generateMarketplaceManifest, getConnectorToken, installConnector, installFromMarketplace, listConnectors, loadRegistry, removeConnector, saveRegistry, validateMarketplaceManifest, writeMarketplaceManifest } from './connectors/index.js';
 import { L as LiveConnector, S as SyncIncrementalResult } from './framework-CNDn2164.js';
 export { c as CONNECTOR_ID_PATTERN, C as ConnectorConfig, b as ConnectorCursor, a as ConnectorDocument, d as ConnectorDocumentSource, e as SyncIncrementalArgs, i as isValidConnectorId, p as persistableConnectorConfig, r as redactConnectorConfigSecrets } from './framework-CNDn2164.js';
@@ -79,7 +79,7 @@ export { EnrichmentAuditEntry, EnrichmentCandidate, EnrichmentCostTier, Enrichme
 export { d as BulkImportError, B as BulkImportOptions, b as BulkImportResult, a as BulkImportSource, e as BulkImportSourceAdapter, f as ImportSourceRole, I as ImportTurn, g as ImportTurnValidationIssue, i as isImportRole, p as parseIsoTimestamp, v as validateImportTurn } from './types-gb_SNtjR.js';
 export { clearBulkImportSources, getBulkImportSource, listBulkImportSources, registerBulkImportSource } from './bulk-import/index.js';
 export { a as ProcessBatchContext, P as ProcessBatchFn, b as ProcessBatchResult, f as formatBatchTranscript, r as resolveBulkImportContext, c as runBulkImportPipeline, v as validateBatchSize } from './pipeline-DmqtvION.js';
-export { B as BulkImportCliCommandOptions, p as parseStrictCliDate, r as runBulkImportCliCommand } from './cli-lmf5RGyQ.js';
+export { B as BulkImportCliCommandOptions, p as parseStrictCliDate, r as runBulkImportCliCommand } from './cli-DqonYBZ0.js';
 export { DEFAULT_IMPORT_BATCH_SIZE, ImportProgress, ImportedMemory, ImporterAdapter, ImporterParseOptions, ImporterTransformOptions, ImporterWriteResult, ImporterWriteTarget, RunImportOptions, RunImporterResult, defaultWriteMemoriesToOrchestrator, importedMemoryToTurn, runImporter, validateImportBatchSize, validateImportRateLimit } from './importers/index.js';
 export { FallbackLlmClient, FallbackLlmOptions, FallbackLlmResponse, FallbackLlmRuntimeContext } from './fallback-llm.js';
 export { ComputeMemoryWorthInput, MemoryWorthResult, computeMemoryWorth } from './memory-worth.js';
@@ -342,1473 +342,1473 @@ declare function buildProcedureMarkdownBody(steps: ProcedureStep[]): string;
  */
 declare function parseProcedureStepsFromBody(content: string): ProcedureStep[] | null;
 
-interface GitContext {
+/**
+ * @remnic/core — Live Connectors Registry (issue #683 PR 1/N)
+ *
+ * Pure in-memory registry. No I/O. Concrete connectors register themselves at
+ * orchestrator boot (later PRs); the maintenance scheduler asks the registry
+ * for the active set when running due syncs.
+ */
+
+/**
+ * Thrown when registering a duplicate id or an id that fails validation.
+ *
+ * Distinct error class so callers can distinguish framework-level mistakes
+ * (which are programmer errors) from connector-runtime failures.
+ */
+declare class LiveConnectorRegistryError extends Error {
+    constructor(message: string);
+}
+/**
+ * In-memory registry of live connectors. One instance per orchestrator. Not
+ * safe for cross-process sharing — wire each process to its own registry.
+ */
+declare class LiveConnectorRegistry {
+    private readonly connectors;
     /**
-     * Stable identifier for the project. Derived from `git remote get-url origin`
-     * when an origin remote is configured, otherwise from the repo root path.
+     * Register a connector. Throws `LiveConnectorRegistryError` if the id is
+     * malformed or already registered.
      *
-     * Formatted as `origin:<hex>` or `root:<hex>` so that the source is visible
-     * to operators (see `remnic doctor`, issue #569 acceptance criteria).
+     * Re-registration is rejected (rather than silently overwriting) because
+     * silent overwrites mask plugin loading bugs in development and could let
+     * a malicious extension shadow a built-in connector.
      */
-    projectId: string;
+    register(connector: LiveConnector): void;
     /**
-     * Current branch, e.g. `main`, `feat/foo`. `null` only in detached-HEAD
-     * state (e.g. rebase in progress). Callers should treat `null` as "no
-     * branch-scope overlay applies" without erroring.
+     * Look up a connector by id. Returns `undefined` if not registered.
      */
-    branch: string | null;
+    get(id: string): LiveConnector | undefined;
     /**
-     * Absolute path to the repository root (the directory containing `.git`).
-     * Tilde-expanded per CLAUDE.md #17.
+     * Return all registered connectors, sorted by id for stable enumeration.
      */
-    rootPath: string;
+    list(): LiveConnector[];
     /**
-     * Best-effort default branch (usually `main` or `master`). Derived from the
-     * `refs/remotes/origin/HEAD` symbolic ref. `null` when not available (e.g.
-     * fresh clone without a default branch symref, or no origin remote).
+     * Remove a connector. Returns `true` if a connector was removed, `false`
+     * otherwise. The cursor / state file on disk is **not** touched — callers
+     * who want to fully decommission a connector must also delete its state
+     * file via the `state-store` module.
      */
-    defaultBranch: string | null;
-}
-/**
- * Injectable git-invocation surface. Only the commands `resolveGitContext`
- * actually needs are exposed. Tests inject a mock implementation to avoid
- * spawning a real git process.
- */
-interface GitInvoker {
+    unregister(id: string): boolean;
     /**
-     * Run `git <args>` with `cwd` as the working directory. Must return
-     * `{ stdout, exitCode }` with `stdout` trimmed by the caller as needed.
-     * Implementations should NOT throw for non-zero exit codes — they should
-     * return the exit code so the resolver can decide how to recover.
+     * Number of registered connectors. Cheap; safe to call frequently.
      */
-    (cwd: string, args: string[]): {
-        stdout: string;
-        exitCode: number;
-    };
+    size(): number;
 }
+
 /**
- * Non-cryptographic stable hash. Used only to derive a deterministic
- * `projectId` from either the origin URL or the root path. The hash does not
- * need to be collision-resistant against adversarial input — it is purely a
- * namespace discriminator.
+ * @remnic/core — Google Drive live connector (issue #683 PR 2/N)
  *
- * Uses FNV-1a 32-bit so we don't pull in `node:crypto` for a simple bucket
- * key. Output is lowercase hex, zero-padded to 8 characters.
- */
-declare function stableHash(input: string): string;
-/**
- * Normalize a git remote URL so that equivalent SSH / HTTPS forms of the
- * same repo produce the same `projectId`. Handles:
- *   - `git@github.com:foo/bar.git`  → `github.com/foo/bar`
- *   - `https://github.com/foo/bar`  → `github.com/foo/bar`
- *   - `https://github.com/foo/bar.git` → `github.com/foo/bar`
- *   - `ssh://git@github.com/foo/bar` → `github.com/foo/bar`
- *   - `ssh://git@github.com:2222/foo/bar` → `github.com/foo/bar` (port stripped)
+ * Concrete `LiveConnector` implementation that incrementally imports text
+ * content from a user's Google Drive into Remnic. Built on top of the
+ * framework shipped in PR 1/N (`framework.ts` / `registry.ts` /
+ * `state-store.ts`).
  *
- * Case-insensitive (remote hostnames and most repo paths on major forges are
- * case-insensitive in practice).
- */
-declare function normalizeOriginUrl(rawUrl: string): string;
-interface ResolveGitContextOptions {
-    /** Inject a git invoker (tests). Defaults to spawning real `git`. */
-    invoker?: GitInvoker;
-}
-/**
- * Detect the git project + branch for `cwd`.
+ * Design notes:
  *
- * Returns `null` when:
- *   - `cwd` is not an absolute path (invalid input, CLAUDE.md #51)
- *   - `cwd` is not inside a git worktree
- *   - `git` is not available on PATH
+ *   - **Cursor semantics.** We page Drive with the official `changes` API
+ *     when a `startPageToken` is available. The cursor is opaque from the
+ *     framework's POV (`{kind: "drivePageToken", value: ...}`), and on the
+ *     very first sync (cursor=null) we call `changes.getStartPageToken()`
+ *     to seed it without importing anything. This matches the documented
+ *     Drive incremental-sync recipe and means re-runs never re-ingest the
+ *     same file as long as the cursor file survives.
  *
- * Never throws.
- */
-declare function resolveGitContext(cwd: string, options?: ResolveGitContextOptions): Promise<GitContext | null>;
-
-/**
- * Structural-context provider port (issue #1548 Track A PR 5).
+ *   - **Folder scope.** When `folderIds` is non-empty, files are filtered
+ *     to those whose `parents` intersect the configured folder set. Drive
+ *     does not currently support server-side parent filtering on the
+ *     `changes.list` endpoint, so we pull the change record's `file` payload
+ *     and apply the filter on our side. Folder ids are validated up front so
+ *     a typo in config doesn't silently cause a broad import.
  *
- * The architectural boundary between Track A (durable coding-memory
- * features) and Track B (the native @remnic/coding-graph engine). A
- * structural-context provider expands a unified diff into the SYMBOLS it
- * touches (and optionally yields architecture hints), so review-intent
- * recall can boost memories that mention those symbols — not just the
- * bare file paths that `review-context.ts` already boosts on.
+ *   - **Content extraction.** Google-native MIME types
+ *     (`application/vnd.google-apps.{document,spreadsheet,presentation}`)
+ *     are exported via `files.export` to plaintext. Plain-text MIME types
+ *     are pulled with `files.get?alt=media`. Everything else is skipped —
+ *     bytes from binary formats (images, PDFs, archives) belong in the
+ *     binary-lifecycle pipeline, not in the textual ingestion path.
  *
- * Three providers satisfy this port, selected by
- * `codingKnowledge.structuralProvider`:
+ *   - **Idempotency.** Each emitted `ConnectorDocument.source` carries
+ *     `externalId = file.id` plus `externalRevision = file.modifiedTime`,
+ *     so downstream dedup (CLAUDE.md gotcha #44 — never index content that
+ *     failed to persist) can recognise repeat fetches even if the cursor is
+ *     manually rewound.
  *
- *   - `"none"`      — no provider consulted (default; review-context stays
- *                     file-path-only, byte-identical to pre-feature — rule 39).
- *   - `"subprocess"` — an external binary shelled out via `execFile` with an
- *                     argv ARRAY (never a shell string — rule 10). The
- *                     built-in adapter lives in `structural-subprocess-provider.ts`;
- *                     codebase-memory-mcp's CLI mode is the canonical target,
- *                     but the provider is command-agnostic.
- *   - `"native"`    — the in-family @remnic/coding-graph engine, adapted to
- *                     this port by a future PR (#1551/#1554). Only the enum
- *                     value and this doc note land in this PR — no engine
- *                     code. codebase-memory-mcp remains a supported
- *                     subprocess provider through this same port regardless.
+ *   - **Privacy.** No document content is ever logged. Folder ids and
+ *     counts may be logged. OAuth credentials (`clientId`,
+ *     `clientSecret`, `refreshToken`) are accepted via config but the
+ *     intent is for callers to populate them from a secret store; we never
+ *     persist credentials through the connector state-store. Per CLAUDE.md
+ *     repository-privacy rules, no real credentials may appear in tests,
+ *     fixtures, or comments.
  *
- * Every result is a tagged outcome shaped like #1536's `SearchDegradation`
- * (CLAUDE.md rule 34 — a degraded/absent provider must NEVER masquerade as
- * "no structural matches"):
- *   - `{ ok: true,  symbols }` on success
- *   - `{ ok: false, code }`    on every failure (distinct codes per mode)
+ *   - **À-la-carte packaging (CLAUDE.md gotcha #57).** `googleapis` is NOT
+ *     listed as a hard dependency of `@remnic/core`. It is loaded via a
+ *     computed-specifier dynamic import (`await import("google" + "apis")`)
+ *     so bundlers cannot statically resolve it, and it is declared as an
+ *     optional peer dependency. Operators who never enable the connector
+ *     pay nothing for it.
  *
- * No module-level mutable state (rule 11): the registry is keyed per
- * orchestrator/service instance via a `Symbol.for(...)` slot on
- * `globalThis`, mirroring `host-embedding-provider.ts`.
+ *   - **Read-only.** This connector only reads. It never marks files as
+ *     read, edits metadata, or modifies sharing settings.
  */
 
 /**
- * Distinct failure codes for the structural-context port. Every code is
- * load-bearing: callers (review-context, `remnic doctor`, xray) switch on
- * `code` to distinguish "binary not installed" from "timed out" from
- * "protocol violation" so a silent provider failure can never look like an
- * empty-but-healthy result.
+ * Stable connector id. Lives in the registry under this exact string.
  */
-type StructuralContextErrorCode = 
-/** Probe failed: binary missing / not executable, or native package absent. */
-"provider_unavailable"
-/** The provider exceeded its deadline. */
- | "provider_timeout"
-/** Output was present but not a valid JSON object/array (rule 18). */
- | "provider_malformed"
-/** Provider ran but returned an explicit error or threw. */
- | "provider_error";
+declare const GOOGLE_DRIVE_CONNECTOR_ID = "google-drive";
 /**
- * A single symbol touched by a diff. The `symbol` name is the load-bearing
- * field — it is what review-context adds to its match set. `path`/`kind`
- * are informational and surface in xray when present.
+ * Cursor `kind` we emit. Treated as opaque by the framework; documented
+ * here so tests can assert on it.
  */
-interface StructuralSymbol {
-    /** Qualified or bare symbol name, e.g. `"AuthService.login"` or `"login"`. */
-    readonly symbol: string;
-    /** Source file the symbol lives in (forward-slashed, repo-relative when possible). */
-    readonly path?: string;
-    /** Coarse kind if the provider knows it (`function`/`method`/`class`/...). */
-    readonly kind?: string;
-}
-interface SymbolsForDiffOk {
-    readonly ok: true;
-    readonly symbols: StructuralSymbol[];
-    /** Provider-reported latency in ms, when available. */
-    readonly latencyMs?: number;
-}
-interface SymbolsForDiffErr {
-    readonly ok: false;
-    readonly code: StructuralContextErrorCode;
-    readonly detail?: string;
-}
-type SymbolsForDiffResult = SymbolsForDiffOk | SymbolsForDiffErr;
-interface ArchitectureHintsOk {
-    readonly ok: true;
-    readonly hints: string[];
-}
-interface ArchitectureHintsErr {
-    readonly ok: false;
-    readonly code: StructuralContextErrorCode;
-    readonly detail?: string;
-}
-type ArchitectureHintsResult = ArchitectureHintsOk | ArchitectureHintsErr;
+declare const GOOGLE_DRIVE_CURSOR_KIND = "drivePageToken";
 /**
- * The port contract. Both the built-in subprocess adapter
- * (`structural-subprocess-provider.ts`) and the future native engine
- * adapter (#1551) implement this. Registry callers retrieve an instance by
- * scope; never construct one inline at a call site.
+ * Default poll interval (5 minutes). Surfaced in `openclaw.plugin.json`
+ * defaults and in the documented config schema. Drive's `changes.list`
+ * endpoint is cheap, but polling sub-minute is wasteful for a personal
+ * memory layer.
  */
-interface StructuralContextProvider {
-    /** Stable identifier for registry logging / `remnic doctor`. */
-    readonly id: string;
-    /**
-     * Probe availability. Resolves to a tagged result so a missing binary
-     * (subprocess) or absent package (native) is surfaced, never thrown
-     * (rule 34). Implementations SHOULD cache the outcome per instance
-     * (rule 11).
-     */
-    probe(): Promise<{
-        available: boolean;
-        detail?: string;
-    }>;
-    /**
-     * Expand a unified diff to the symbols it touches. NEVER throws — every
-     * failure path returns a tagged `{ ok: false, code }`. The optional
-     * `signal` lets the caller cancel an in-flight subprocess (rule 40).
-     */
-    symbolsForDiff(diff: string, options?: {
-        signal?: AbortSignal;
-    }): Promise<SymbolsForDiffResult>;
-    /**
-     * Optional architecture hints for a repo root. Used by the architecture
-     * card composition (#1548 Track A PR 3 + #1554). Implementations MAY omit
-     * this; callers MUST handle its absence.
-     */
-    architectureHints?(root: string, options?: {
-        signal?: AbortSignal;
-    }): Promise<ArchitectureHintsResult>;
-    /** Release any resources the provider holds (subprocess handles, etc.). */
-    close?(): Promise<void> | void;
-}
+declare const DEFAULT_POLL_INTERVAL_MS: number;
 /**
- * Backend tag is a literal so consumers can switch on it programmatically
- * alongside `SearchDegradation` (`backend: "qmd"`). `detail` is optional
- * and never load-bearing — `code` is the signal.
+ * Validated, frozen view of `connectors.googleDrive.*`.
  */
-interface StructuralContextDegradation {
-    readonly backend: "structural-context";
-    readonly code: StructuralContextErrorCode;
-    readonly detail?: string;
+interface GoogleDriveConnectorConfig {
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly refreshToken: string;
+    /** Poll interval surfaced to the scheduler. */
+    readonly pollIntervalMs: number;
+    /** Folder ids to scope import to. Empty = "all accessible". */
+    readonly folderIds: readonly string[];
 }
 /**
- * Coerce a {@link SymbolsForDiffErr} into the degradation record consumers
- * attach to recall snapshots / xray. Centralised so the `{ backend: ... }`
- * tag is set in one place (rule 22 spirit).
+ * Optional injection point for tests. The real connector dynamically imports
+ * `googleapis`; tests pass a stub here to avoid the optional-peer-dep
+ * machinery and to keep the test suite hermetic.
+ *
+ * The shape only covers the tiny slice of the SDK we actually use.
  */
-declare function toStructuralContextDegradation(err: SymbolsForDiffErr): StructuralContextDegradation;
+interface GoogleDriveClientFactory {
+    (config: GoogleDriveConnectorConfig): Promise<GoogleDriveClient>;
+}
 /**
- * Register a provider for a scope (typically an orchestrator `serviceId`).
- * Overwriting a previous registration closes the old provider. Returns an
- * unregister function — callers SHOULD invoke it on service teardown so a
- * hot-reloaded host does not leak subprocess handles.
+ * Minimal Drive client surface. Tests provide a fake; production wraps
+ * `googleapis` to fit. Method shapes mirror the upstream API where it
+ * matters (`startPageToken` / `nextPageToken` / `newStartPageToken`,
+ * `files.modifiedTime` ISO 8601 strings).
  */
-declare function registerStructuralContextProvider(scope: string, provider: StructuralContextProvider): () => void;
-/** Look up the provider registered for a scope, if any. */
-declare function getStructuralContextProvider(scope: string): StructuralContextProvider | undefined;
-/** Test-only: clear every registered provider. */
-declare function clearStructuralContextProvidersForTest(): void;
+interface GoogleDriveClient {
+    /** Mirrors `drive.changes.getStartPageToken()`. */
+    getStartPageToken(): Promise<{
+        startPageToken: string;
+    }>;
+    /**
+     * Mirrors `drive.changes.list(...)`. We page until the response yields a
+     * `newStartPageToken` (i.e., no more pages). Each `change.file`, when
+     * present, includes the metadata we need to decide whether to ingest.
+     */
+    listChanges(args: {
+        pageToken: string;
+        pageSize: number;
+    }): Promise<DriveChangesPage>;
+    /**
+     * Export a Google-native doc to plaintext. Returns the body as a string.
+     */
+    exportFile(args: {
+        fileId: string;
+        mimeType: string;
+    }): Promise<string>;
+    /**
+     * Download a non-Google-native file as a string. Used for `text/*` MIME
+     * types; binary formats are filtered out before we get here.
+     */
+    getFileMedia(args: {
+        fileId: string;
+    }): Promise<string>;
+}
+interface DriveChangesPage {
+    readonly changes: readonly DriveChange[];
+    readonly newStartPageToken?: string;
+    readonly nextPageToken?: string;
+}
+interface DriveChange {
+    readonly removed?: boolean;
+    readonly fileId?: string;
+    readonly file?: DriveFileMetadata;
+}
+interface DriveFileMetadata {
+    readonly id: string;
+    readonly name?: string;
+    readonly mimeType?: string;
+    readonly modifiedTime?: string;
+    readonly trashed?: boolean;
+    readonly parents?: readonly string[];
+    readonly webViewLink?: string;
+    readonly size?: string | number;
+}
 /**
- * The single gate every review-context consumer consults before consulting a
- * provider. Returns `true` iff the master `codingKnowledge.enabled` switch is
- * on AND `structuralProvider` is not `"none"`. When this returns `false`,
- * review-context runs its pure file-path-only ranker — byte-identical to
- * pre-feature behaviour on every path.
+ * Result of a single sync pass — exposed for richer test assertions.
+ * Strict superset of `SyncIncrementalResult`.
  */
-declare function structuralProviderActive(config: PluginConfig): boolean;
+interface GoogleDriveSyncResult extends SyncIncrementalResult {
+    readonly skippedBinary: number;
+    readonly skippedFolderScope: number;
+    readonly skippedTooLarge: number;
+}
 /**
- * Config-only structural provider status. `remnic doctor` and xray render
- * this; an async sibling in `structural-subprocess-provider.ts` augments it
- * with a live `probed` field.
+ * Validate and normalise raw config. Throws with a concrete message on any
+ * malformed input — never silently defaults (CLAUDE.md gotcha #51).
  */
-interface StructuralProviderStatus {
-    readonly active: boolean;
-    readonly mode: CodingKnowledgeConfig["structuralProvider"];
-    /** Command path when mode is `"subprocess"` and a command is configured. */
-    readonly command?: string;
-    /** Provider id when one is registered for the scope. */
-    readonly providerId?: string;
-    /** Live probe outcome — set only by the async doctor probe. */
-    probed?: {
-        available: boolean;
-        detail?: string;
-    };
-}
+declare function validateGoogleDriveConfig(raw: unknown): GoogleDriveConnectorConfig;
 /**
- * Summarise the structural provider status from config ALONE (no probe, no
- * I/O). Pure — safe to call from any context, including the recall hot path
- * for xray labels.
+ * Construct the connector. The `clientFactory` argument is the test hook —
+ * production callers omit it and the connector lazy-loads `googleapis`.
  */
-declare function describeStructuralProviderStatus(config: PluginConfig, scope?: string): StructuralProviderStatus;
+declare function createGoogleDriveConnector(options?: {
+    clientFactory?: GoogleDriveClientFactory;
+}): LiveConnector;
 /**
- * Render a single human-readable line for `remnic doctor`. Pure.
+ * Production client factory. Lazy-loads `googleapis` via a computed-specifier
+ * dynamic import so bundlers never statically resolve it (CLAUDE.md gotcha
+ * #57). Surfaces a precise install hint on miss.
  *
- *   `structural-context provider: none (inactive — review-context stays file-path-only)`
- *   `structural-context provider: subprocess, command=/usr/local/bin/cbm, probed=available`
- *   `structural-context provider: subprocess, command=/usr/local/bin/cbm, probed=unavailable (binary not found)`
+ * Exported only for the `index.ts` barrel; consumers that already inject a
+ * test factory don't need to touch this.
  */
-declare function renderStructuralProviderStatusLine(status: StructuralProviderStatus): string;
+declare const defaultGoogleDriveClientFactory: GoogleDriveClientFactory;
 
 /**
- * Diff-aware review-context packer (issue #569 PR 4).
+ * @remnic/core — Notion live connector (issue #683 PR 3/N)
  *
- * When an agent is asked "review this PR" / "what changed in this diff" /
- * "look at this diff", the prompt that reaches recall is short and generic
- * — the real signal is the diff itself. This module:
+ * Concrete `LiveConnector` implementation that incrementally imports text
+ * content from Notion database pages into Remnic. Built on top of the
+ * framework shipped in PR 1/N (`framework.ts` / `registry.ts` /
+ * `state-store.ts`) and mirrors the structure of the Google Drive connector
+ * (PR 2/N).
  *
- *   1. Detects review-intent prompts via `isReviewPrompt`.
- *   2. Extracts the touched file list from a unified diff via
- *      `parseTouchedFiles`.
- *   3. Re-ranks a set of candidate memories so that memories whose
- *      `entityRefs` mention a touched path float to the top. The boost is
- *      additive and bounded so it doesn't obliterate the original ranking —
- *      it's a bias, not a filter.
+ * Design notes:
  *
- * Pure — no orchestrator, no storage. Callers inject the candidate memories
- * they already have from their normal recall pipeline. This keeps the
- * module easy to test and integrates cleanly with the existing tiered-recall
- * code in `orchestrator.ts` (the tier itself can be wired later; the pure
- * surface is what PRs 5/6/7 will call).
+ *   - **Auth.** Integration token from config (`connectors.notion.token`).
+ *     The token is accepted at config-parse time but never logged. Operators
+ *     must populate it from a secret store; per the repo-wide privacy policy
+ *     no real value may appear in tests or comments.
+ *
+ *   - **Scope.** `databaseIds` in config limits the import to the listed
+ *     Notion databases. The connector queries each database for pages whose
+ *     `last_edited_time` is after a per-page high-water mark stored in the
+ *     cursor. When `databaseIds` is empty the connector does nothing (safe
+ *     default — no credentials → no import).
+ *
+ *   - **Cursor semantics.** The cursor is a JSON string encoding a
+ *     `NotionCursorPayload`: a map from page-id to last-seen
+ *     `last_edited_time` ISO string. On the first sync (cursor=null) we
+ *     seed the payload from the current state of each database WITHOUT
+ *     importing any content, so "first install" doesn't re-ingest history.
+ *     Each subsequent pass only imports pages edited after the stored
+ *     watermark.
+ *
+ *   - **Block extraction.** Page content is fetched via
+ *     `blocks.children.list` recursively up to `MAX_BLOCK_DEPTH` levels.
+ *     Block text is extracted to Markdown-ish plain text (no raw JSON blobs).
+ *     Only text-bearing block types are included; unsupported types are
+ *     silently skipped.
+ *
+ *   - **Raw `fetch`.** We call the Notion REST API directly rather than using
+ *     `@notionhq/client` — there is no optional-peer-dep machinery needed and
+ *     the API surface we consume is tiny. The `fetchFn` argument is the test
+ *     hook allowing stubbing without network access.
+ *
+ *   - **Idempotency.** `ConnectorDocument.source.externalId` is the page id
+ *     and `externalRevision` is `last_edited_time`, so downstream dedup can
+ *     recognise repeat fetches if the cursor is rewound.
+ *
+ *   - **Privacy.** No page content is ever logged. Database ids and counts
+ *     may be logged. The integration token is never exposed in logs, state,
+ *     or error messages.
+ *
+ *   - **Read-only.** This connector only reads. It never modifies pages,
+ *     databases, or any other Notion resource.
  */
 
+/** Stable connector id. Lives in the registry under this exact string. */
+declare const NOTION_CONNECTOR_ID = "notion";
 /**
- * A memory candidate as fed into review-context ranking. The shape is a
- * deliberate subset of the core `MemorySummary` / recall result — only the
- * fields we actually need — so this module stays decoupled from the rest of
- * the codebase and can be reused by CLI tools, bench fixtures, etc.
+ * Cursor `kind` we emit. Opaque to the framework; documented here so
+ * tests can assert on it.
  */
-interface ReviewCandidate {
-    /** Opaque identifier. Echoed unchanged in the output. */
-    id: string;
-    /**
-     * Pre-review relevance score from the upstream recall pipeline. Higher is
-     * better. `0` is treated as "no prior signal" and gets the full review
-     * boost when a path match is found.
-     */
-    score: number;
-    /**
-     * References the memory mentions (file paths, entity names, etc.). Used
-     * to decide whether any touched file appears in the memory's scope.
-     *
-     * Accepts `undefined`/missing so callers can pass sparse records from
-     * legacy storage without pre-filling.
-     */
-    entityRefs?: string[];
-}
-interface ReviewContext {
-    /**
-     * Normalized file paths touched by the diff. Each entry is forward-slashed
-     * and relative to the repo root when possible.
-     */
-    touchedFiles: string[];
-    /**
-     * Candidates re-sorted so memories whose `entityRefs` mention a touched
-     * path are boosted. Shape matches the input `ReviewCandidate[]` — the
-     * boost is recorded on each entry as `boost` for observability.
-     */
-    rankedRecall: Array<ReviewCandidate & {
-        boost: number;
-    }>;
-    /**
-     * Structural-context provider degradation observed while expanding the
-     * diff to touched symbols (issue #1548 Track A PR 5, #1536 pattern).
-     * Present only when a provider was consulted AND it failed — a silent
-     * provider failure must never look like "no structural matches"
-     * (CLAUDE.md rule 34). Undefined when no provider was consulted (the
-     * pure {@link packReviewContext} path) or when the provider succeeded.
-     */
-    structuralDegradation?: StructuralContextDegradation;
-}
-/**
- * `true` when the prompt looks like a review / diff-explanation request.
- *
- * Empty / non-string input → `false` (the caller shouldn't branch on an
- * invalid prompt).
- */
-declare function isReviewPrompt(prompt: string | null | undefined): boolean;
+declare const NOTION_CURSOR_KIND = "notionWatermark";
 /**
- * Parse a unified diff and return the set of files touched. Accepts both the
- * `diff --git` form (`diff --git a/foo b/bar`) and the `--- / +++` form
- * (`--- a/foo\n+++ b/bar`). Returns deduplicated, repo-root-relative paths
- * (with the conventional `a/` / `b/` prefixes stripped).
- *
- * Path entries of `/dev/null` (used in adds/deletes) are excluded.
+ * Default poll interval (5 minutes). Notion's API has no push capability;
+ * polling sub-minute wastes quota for a personal memory layer.
  */
-declare function parseTouchedFiles(diff: string | null | undefined): string[];
+declare const NOTION_DEFAULT_POLL_INTERVAL_MS: number;
 /**
- * Build a review-context ranking for a set of candidate memories.
- *
- * Contract:
- *   - `touchedFiles` is the parsed diff file list.
- *   - `candidates` is passed through unchanged when no boost applies.
- *   - When a boost applies, the result is sorted by `(score + boost)` desc,
- *     with a stable secondary sort on the original `id` for determinism
- *     (CLAUDE.md #19 — comparators must return 0 for equal items).
+ * Validated, frozen view of `connectors.notion.*`.
  */
-declare function rankReviewCandidates(candidates: ReviewCandidate[], touchedFiles: string[]): Array<ReviewCandidate & {
-    boost: number;
-}>;
-interface PackReviewContextInput {
-    /** Unified diff, as produced by `git diff`. */
-    diff: string | null | undefined;
-    /** Candidate memories from the upstream recall pipeline. */
-    candidates: ReviewCandidate[];
+interface NotionConnectorConfig {
+    /** Notion integration token. Starts with `secret_`. */
+    readonly token: string;
+    /** Database ids to import pages from. Empty = connector is a no-op. */
+    readonly databaseIds: readonly string[];
+    /** Poll interval surfaced to the scheduler (ms). */
+    readonly pollIntervalMs: number;
 }
 /**
- * Top-level entry point used by the orchestrator (and CLI / bench) when a
- * review-intent prompt is detected.
- *
- * Parses the diff, re-ranks the candidates, and returns both artefacts so
- * the caller can surface `touchedFiles` as context and `rankedRecall` as
- * the recall result.
+ * Minimal fetch-compatible surface we use. The real connector delegates to
+ * the global `fetch`; tests inject a stub factory.
  */
-declare function packReviewContext(input: PackReviewContextInput): ReviewContext;
+type NotionFetchFn = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
 /**
- * Input for the structural-context-aware review-context packer. The pure
- * {@link packReviewContext} stays unchanged (gate-off parity); this async
- * variant consults a {@link StructuralContextProvider} to expand the diff's
- * touched FILE paths into touched SYMBOL names, widening the match set so
- * memories that mention a changed symbol — not just the file path — float
- * up. The gate (`structuralProvider !== "none"`) is checked ONCE by the
- * caller, never inside this function (rule 39).
+ * Validate and normalise raw config. Throws with a concrete message on any
+ * malformed input — never silently defaults (CLAUDE.md gotcha #51).
  */
-interface PackReviewContextStructuralInput extends PackReviewContextInput {
-    /** A probed structural-context provider. Never undefined here. */
-    provider: StructuralContextProvider;
-    /** Cancellation forwarded to the provider subprocess (rule 40). */
-    signal?: AbortSignal;
-}
+declare function validateNotionConfig(raw: unknown): NotionConnectorConfig;
 /**
- * Structural-context-aware packer.
- *
- * Contract (issue #1548 Track A PR 5, prove-fail-before characterization):
- *   - Provider returns symbols (`ok: true`) → symbol names are ADDED to the
- *     match set alongside touched files; memories mentioning a symbol get the
- *     same bounded additive boost as a file-path match.
- *   - Provider fails (`ok: false`, any code) → ranking falls back to
- *     FILE-PATH-ONLY boosting, BYTE-IDENTICAL to {@link packReviewContext}
- *     (the match set is exactly the touched files), AND `structuralDegradation`
- *     is populated so xray/doctor can surface the failure (rule 34).
- *
- * The underlying ranker ({@link rankReviewCandidates}) is reused unchanged,
- * so the deterministic ordering, boost cap, and tie-break are identical to
- * the pure path.
+ * Construct the connector. The `fetchFn` argument is the test hook —
+ * production callers omit it and the connector uses the global `fetch`.
  */
-declare function packReviewContextStructural(input: PackReviewContextStructuralInput): Promise<ReviewContext>;
+declare function createNotionConnector(options?: {
+    fetchFn?: NotionFetchFn;
+}): LiveConnector;
 
-/** Injectable spawn shape so tests substitute a stub (rule 33). */
-type StructuralSpawnFn = (command: string, argv: readonly string[], options: {
-    timeout: number;
-    signal?: AbortSignal;
-}) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;
-interface SubprocessProviderOptions {
-    /** Absolute path to the binary (rule 24 — statSync at probe time). */
-    readonly command: string;
+interface GitContext {
     /**
-     * Extra argv appended after the symbols-for-diff subcommand
-     * (rule 10 — array, never a shell string).
+     * Stable identifier for the project. Derived from `git remote get-url origin`
+     * when an origin remote is configured, otherwise from the repo root path.
+     *
+     * Formatted as `origin:<hex>` or `root:<hex>` so that the source is visible
+     * to operators (see `remnic doctor`, issue #569 acceptance criteria).
      */
-    readonly args?: readonly string[];
-    /** Per-call deadline in ms. Default 5000. */
-    readonly timeoutMs?: number;
+    projectId: string;
     /**
-     * Subcommand the provider invokes for symbol expansion.
-     * Default `"symbols-for-diff"`.
+     * Current branch, e.g. `main`, `feat/foo`. `null` only in detached-HEAD
+     * state (e.g. rebase in progress). Callers should treat `null` as "no
+     * branch-scope overlay applies" without erroring.
      */
-    readonly symbolsSubcommand?: string;
-    /** Test seam — defaults to promisified `execFile`. */
-    readonly spawn?: StructuralSpawnFn;
+    branch: string | null;
+    /**
+     * Absolute path to the repository root (the directory containing `.git`).
+     * Tilde-expanded per CLAUDE.md #17.
+     */
+    rootPath: string;
+    /**
+     * Best-effort default branch (usually `main` or `master`). Derived from the
+     * `refs/remotes/origin/HEAD` symbolic ref. `null` when not available (e.g.
+     * fresh clone without a default branch symref, or no origin remote).
+     */
+    defaultBranch: string | null;
 }
 /**
- * Construct a structural-context provider backed by an external subprocess.
- * The instance is self-contained: callers register it via
- * `registerStructuralContextProvider(scope, provider)` and dispose via the
- * returned unregister handle.
+ * Injectable git-invocation surface. Only the commands `resolveGitContext`
+ * actually needs are exposed. Tests inject a mock implementation to avoid
+ * spawning a real git process.
  */
-declare function createSubprocessStructuralProvider(options: SubprocessProviderOptions): StructuralContextProvider;
+interface GitInvoker {
+    /**
+     * Run `git <args>` with `cwd` as the working directory. Must return
+     * `{ stdout, exitCode }` with `stdout` trimmed by the caller as needed.
+     * Implementations should NOT throw for non-zero exit codes — they should
+     * return the exit code so the resolver can decide how to recover.
+     */
+    (cwd: string, args: string[]): {
+        stdout: string;
+        exitCode: number;
+    };
+}
 /**
- * Augment the pure {@link describeStructuralProviderStatus} with a LIVE probe
- * so `remnic doctor` can render "configured / probed / last error code".
- *
- *   - `"none"`     → inactive (no probe).
- *   - `"subprocess"` → builds a throwaway provider from
- *                    `structuralProviderCommand`, probes it, disposes it.
- *   - `"native"`   → asks `isCodingGraphInstalled()` whether the optional
- *                    @remnic/coding-graph peer is present (the adapter that
- *                    turns the engine into a provider lands in #1551).
+ * Non-cryptographic stable hash. Used only to derive a deterministic
+ * `projectId` from either the origin URL or the root path. The hash does not
+ * need to be collision-resistant against adversarial input — it is purely a
+ * namespace discriminator.
  *
- * Never throws — a probe failure populates `probed.available = false`.
+ * Uses FNV-1a 32-bit so we don't pull in `node:crypto` for a simple bucket
+ * key. Output is lowercase hex, zero-padded to 8 characters.
  */
-declare function probeStructuralProviderForDoctor(config: PluginConfig): Promise<StructuralProviderStatus>;
-
+declare function stableHash(input: string): string;
 /**
- * Binary file lifecycle management types.
+ * Normalize a git remote URL so that equivalent SSH / HTTPS forms of the
+ * same repo produce the same `projectId`. Handles:
+ *   - `git@github.com:foo/bar.git`  → `github.com/foo/bar`
+ *   - `https://github.com/foo/bar`  → `github.com/foo/bar`
+ *   - `https://github.com/foo/bar.git` → `github.com/foo/bar`
+ *   - `ssh://git@github.com/foo/bar` → `github.com/foo/bar`
+ *   - `ssh://git@github.com:2222/foo/bar` → `github.com/foo/bar` (port stripped)
  *
- * Defines the configuration, manifest, and record structures for the
- * three-stage binary lifecycle pipeline: mirror, redirect, clean.
+ * Case-insensitive (remote hostnames and most repo paths on major forges are
+ * case-insensitive in practice).
  */
-interface BinaryLifecycleConfig {
-    /** Master toggle. Default: false. */
-    enabled: boolean;
-    /** Days after mirror before local copy is eligible for cleanup. Default: 7. */
-    gracePeriodDays: number;
-    /** Files larger than this are skipped during scan. Default: 50 MB. */
-    maxBinarySizeBytes: number;
-    /** Glob patterns for binary file types to manage. */
-    scanPatterns: string[];
-    /** Backend configuration for binary storage. */
-    backend: BinaryStorageBackendConfig;
-}
-interface BinaryStorageBackendConfig {
-    /** Backend type. "filesystem" copies to a local directory. "none" is a no-op (dry-run/testing). */
-    type: "filesystem" | "s3" | "none";
-    /** Destination directory for the filesystem backend. */
-    basePath?: string;
-    /** S3 bucket name (future). */
-    s3Bucket?: string;
-    /** S3 region (future). */
-    s3Region?: string;
-    /** S3 key prefix (future). */
-    s3Prefix?: string;
+declare function normalizeOriginUrl(rawUrl: string): string;
+interface ResolveGitContextOptions {
+    /** Inject a git invoker (tests). Defaults to spawning real `git`. */
+    invoker?: GitInvoker;
 }
-type BinaryAssetStatus = "pending" | "mirrored" | "redirected" | "cleaned" | "error";
-interface BinaryAssetRecord {
-    /** Relative path from memoryDir to the original file. */
-    originalPath: string;
-    /** Path (or URL) in the backend storage. */
-    mirroredPath: string;
-    /** Optional user-resolvable target to write into markdown links. */
-    redirectPath?: string;
-    /** SHA-256 hex digest of file content. */
-    contentHash: string;
-    /** File size in bytes. */
-    sizeBytes: number;
-    /** MIME type (e.g. "image/png"). */
-    mimeType: string;
-    /** ISO 8601 timestamp when the file was mirrored. */
-    mirroredAt: string;
-    /** ISO 8601 timestamp when markdown references were rewritten. */
-    redirectedAt?: string;
-    /** ISO 8601 timestamp when the local copy was deleted. */
-    cleanedAt?: string;
-    /** Current lifecycle status. */
-    status: BinaryAssetStatus;
-}
-interface BinaryLifecycleManifest {
-    version: 1;
-    assets: BinaryAssetRecord[];
-    lastScanAt?: string;
-}
-interface PipelineResult {
-    scanned: number;
-    mirrored: number;
-    redirected: number;
-    cleaned: number;
-    errors: string[];
-    dryRun: boolean;
-}
-declare const DEFAULT_SCAN_PATTERNS: string[];
-declare const DEFAULT_MAX_BINARY_SIZE_BYTES: number;
-declare const DEFAULT_GRACE_PERIOD_DAYS = 7;
-
 /**
- * Binary storage backend interface and implementations.
+ * Detect the git project + branch for `cwd`.
  *
- * Backends handle the actual persistence of binary files to an external
- * location. The pipeline calls upload/exists/delete through this interface
- * so swapping storage providers requires no pipeline changes.
- */
-
-interface BinaryStorageBackend {
-    /** Discriminator for the backend type. */
-    readonly type: string;
-    /**
-     * Upload a local file to the backend.
-     * @returns The backend path or URL where the file was stored.
-     */
-    upload(localPath: string, remotePath: string): Promise<string>;
-    /** Check whether a remote path already exists in the backend. */
-    exists(remotePath: string): Promise<boolean>;
-    /** Delete a file from the backend. */
-    delete(remotePath: string): Promise<void>;
-    /** Return the user-resolvable markdown target for a stored backend path. */
-    getRedirectTarget?(remotePath: string): string;
-}
-declare class FilesystemBackend implements BinaryStorageBackend {
-    readonly type = "filesystem";
-    private readonly basePath;
-    constructor(basePath: string);
-    private resolveRemotePath;
-    private isInsideBase;
-    private realBasePathIfExists;
-    private ensureBaseDirectory;
-    private ensureSafeParentDirectory;
-    private resolveExistingRemotePath;
-    upload(localPath: string, remotePath: string): Promise<string>;
-    exists(remotePath: string): Promise<boolean>;
-    delete(remotePath: string): Promise<void>;
-    getRedirectTarget(remotePath: string): string;
-}
-declare class NoneBackend implements BinaryStorageBackend {
-    readonly type = "none";
-    upload(_localPath: string, remotePath: string): Promise<string>;
-    exists(_remotePath: string): Promise<boolean>;
-    delete(_remotePath: string): Promise<void>;
-}
-declare function createBackend(cfg: BinaryStorageBackendConfig): BinaryStorageBackend;
-
-/**
- * Binary file scanner.
+ * Returns `null` when:
+ *   - `cwd` is not an absolute path (invalid input, CLAUDE.md #51)
+ *   - `cwd` is not inside a git worktree
+ *   - `git` is not available on PATH
  *
- * Recursively walks the memory directory, matches files against configured
- * glob patterns, skips files already tracked in the manifest, and respects
- * the max-size limit.
- */
-
-/**
- * Test whether a filename matches any of the provided glob patterns.
- * Supports simple `*.ext` patterns (the default scan patterns).
- * For more complex globs a proper library should be used; this covers
- * the 95% case without adding a dependency.
- */
-declare function matchesPatterns(filename: string, patterns: string[]): boolean;
-/**
- * Scan memoryDir recursively for binary files matching the configured patterns.
- * Returns relative paths (relative to memoryDir) for files not yet tracked.
+ * Never throws.
  */
-declare function scanForBinaries(memoryDir: string, config: BinaryLifecycleConfig, manifest: BinaryLifecycleManifest): Promise<string[]>;
+declare function resolveGitContext(cwd: string, options?: ResolveGitContextOptions): Promise<GitContext | null>;
 
 /**
- * Binary lifecycle manifest — read/write operations.
+ * Structural-context provider port (issue #1548 Track A PR 5).
  *
- * The manifest lives at `${memoryDir}/.binary-lifecycle/manifest.json`.
- * Writes use the atomic temp-then-rename pattern (CLAUDE.md #54).
+ * The architectural boundary between Track A (durable coding-memory
+ * features) and Track B (the native @remnic/coding-graph engine). A
+ * structural-context provider expands a unified diff into the SYMBOLS it
+ * touches (and optionally yields architecture hints), so review-intent
+ * recall can boost memories that mention those symbols — not just the
+ * bare file paths that `review-context.ts` already boosts on.
+ *
+ * Three providers satisfy this port, selected by
+ * `codingKnowledge.structuralProvider`:
+ *
+ *   - `"none"`      — no provider consulted (default; review-context stays
+ *                     file-path-only, byte-identical to pre-feature — rule 39).
+ *   - `"subprocess"` — an external binary shelled out via `execFile` with an
+ *                     argv ARRAY (never a shell string — rule 10). The
+ *                     built-in adapter lives in `structural-subprocess-provider.ts`;
+ *                     codebase-memory-mcp's CLI mode is the canonical target,
+ *                     but the provider is command-agnostic.
+ *   - `"native"`    — the in-family @remnic/coding-graph engine, adapted to
+ *                     this port by a future PR (#1551/#1554). Only the enum
+ *                     value and this doc note land in this PR — no engine
+ *                     code. codebase-memory-mcp remains a supported
+ *                     subprocess provider through this same port regardless.
+ *
+ * Every result is a tagged outcome shaped like #1536's `SearchDegradation`
+ * (CLAUDE.md rule 34 — a degraded/absent provider must NEVER masquerade as
+ * "no structural matches"):
+ *   - `{ ok: true,  symbols }` on success
+ *   - `{ ok: false, code }`    on every failure (distinct codes per mode)
+ *
+ * No module-level mutable state (rule 11): the registry is keyed per
+ * orchestrator/service instance via a `Symbol.for(...)` slot on
+ * `globalThis`, mirroring `host-embedding-provider.ts`.
  */
 
-declare function manifestDir(memoryDir: string): string;
-declare function manifestPath(memoryDir: string): string;
 /**
- * Read the manifest from disk. Returns a fresh empty manifest if the file
- * does not exist. Existing invalid manifests fail closed so the pipeline does
- * not overwrite state needed for safe cleanup.
+ * Distinct failure codes for the structural-context port. Every code is
+ * load-bearing: callers (review-context, `remnic doctor`, xray) switch on
+ * `code` to distinguish "binary not installed" from "timed out" from
+ * "protocol violation" so a silent provider failure can never look like an
+ * empty-but-healthy result.
  */
-declare function readManifest(memoryDir: string): Promise<BinaryLifecycleManifest>;
+type StructuralContextErrorCode = 
+/** Probe failed: binary missing / not executable, or native package absent. */
+"provider_unavailable"
+/** The provider exceeded its deadline. */
+ | "provider_timeout"
+/** Output was present but not a valid JSON object/array (rule 18). */
+ | "provider_malformed"
+/** Provider ran but returned an explicit error or threw. */
+ | "provider_error";
 /**
- * Write the manifest atomically: write to a temp file, then rename.
- * CLAUDE.md #54: never delete before write. Write temp first, rename atomically.
+ * A single symbol touched by a diff. The `symbol` name is the load-bearing
+ * field — it is what review-context adds to its match set. `path`/`kind`
+ * are informational and surface in xray when present.
  */
-declare function writeManifest(memoryDir: string, manifest: BinaryLifecycleManifest): Promise<void>;
-declare function emptyManifest(): BinaryLifecycleManifest;
-
+interface StructuralSymbol {
+    /** Qualified or bare symbol name, e.g. `"AuthService.login"` or `"login"`. */
+    readonly symbol: string;
+    /** Source file the symbol lives in (forward-slashed, repo-relative when possible). */
+    readonly path?: string;
+    /** Coarse kind if the provider knows it (`function`/`method`/`class`/...). */
+    readonly kind?: string;
+}
+interface SymbolsForDiffOk {
+    readonly ok: true;
+    readonly symbols: StructuralSymbol[];
+    /** Provider-reported latency in ms, when available. */
+    readonly latencyMs?: number;
+}
+interface SymbolsForDiffErr {
+    readonly ok: false;
+    readonly code: StructuralContextErrorCode;
+    readonly detail?: string;
+}
+type SymbolsForDiffResult = SymbolsForDiffOk | SymbolsForDiffErr;
+interface ArchitectureHintsOk {
+    readonly ok: true;
+    readonly hints: string[];
+}
+interface ArchitectureHintsErr {
+    readonly ok: false;
+    readonly code: StructuralContextErrorCode;
+    readonly detail?: string;
+}
+type ArchitectureHintsResult = ArchitectureHintsOk | ArchitectureHintsErr;
 /**
- * Binary lifecycle pipeline — mirror, redirect, clean.
- *
- * Three-stage pipeline:
- * 1. Mirror:   upload binary to backend, record in manifest
- * 2. Redirect: scan markdown for inline refs, replace with redirect path
- * 3. Clean:    after grace period, delete local copy
+ * The port contract. Both the built-in subprocess adapter
+ * (`structural-subprocess-provider.ts`) and the future native engine
+ * adapter (#1551) implement this. Registry callers retrieve an instance by
+ * scope; never construct one inline at a call site.
  */
-
-/** Minimal logger interface so we don't depend on the full logger module. */
-interface PipelineLogger {
-    info(msg: string): void;
-    warn(msg: string): void;
-    error(msg: string): void;
+interface StructuralContextProvider {
+    /** Stable identifier for registry logging / `remnic doctor`. */
+    readonly id: string;
+    /**
+     * Probe availability. Resolves to a tagged result so a missing binary
+     * (subprocess) or absent package (native) is surfaced, never thrown
+     * (rule 34). Implementations SHOULD cache the outcome per instance
+     * (rule 11).
+     */
+    probe(): Promise<{
+        available: boolean;
+        detail?: string;
+    }>;
+    /**
+     * Expand a unified diff to the symbols it touches. NEVER throws — every
+     * failure path returns a tagged `{ ok: false, code }`. The optional
+     * `signal` lets the caller cancel an in-flight subprocess (rule 40).
+     */
+    symbolsForDiff(diff: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SymbolsForDiffResult>;
+    /**
+     * Optional architecture hints for a repo root. Used by the architecture
+     * card composition (#1548 Track A PR 3 + #1554). Implementations MAY omit
+     * this; callers MUST handle its absence.
+     */
+    architectureHints?(root: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<ArchitectureHintsResult>;
+    /** Release any resources the provider holds (subprocess handles, etc.). */
+    close?(): Promise<void> | void;
 }
-type ReadMarkdownFile = (filePath: string) => Promise<string>;
-type WriteMarkdownFile = (filePath: string, content: string) => Promise<void>;
-interface PipelineOptions {
-    dryRun?: boolean;
-    /** Force-clean all files past grace period, ignoring redirect status. */
-    forceClean?: boolean;
-    /** Test hook for deterministic markdown read failures. */
-    readMarkdownFile?: ReadMarkdownFile;
-    /** Test hook for deterministic markdown write failures. */
-    writeMarkdownFile?: WriteMarkdownFile;
+/**
+ * Backend tag is a literal so consumers can switch on it programmatically
+ * alongside `SearchDegradation` (`backend: "qmd"`). `detail` is optional
+ * and never load-bearing — `code` is the signal.
+ */
+interface StructuralContextDegradation {
+    readonly backend: "structural-context";
+    readonly code: StructuralContextErrorCode;
+    readonly detail?: string;
 }
 /**
- * Run the binary lifecycle pipeline: scan, mirror, redirect, clean.
+ * Coerce a {@link SymbolsForDiffErr} into the degradation record consumers
+ * attach to recall snapshots / xray. Centralised so the `{ backend: ... }`
+ * tag is set in one place (rule 22 spirit).
  */
-declare function runBinaryLifecyclePipeline(memoryDir: string, config: BinaryLifecycleConfig, backend: BinaryStorageBackend, log: PipelineLogger, opts?: PipelineOptions): Promise<PipelineResult>;
-
+declare function toStructuralContextDegradation(err: SymbolsForDiffErr): StructuralContextDegradation;
 /**
- * @remnic/core — Workspace Tree Projection
- *
- * Generates a human-readable `.engram/context-tree/` from canonical memory.
- * Each node is a `.md` file with rich metadata, * (provenance, trust, confidence, source anchors).
- * Manual edits are preserved in fenced blocks.
+ * Register a provider for a scope (typically an orchestrator `serviceId`).
+ * Overwriting a previous registration closes the old provider. Returns an
+ * unregister function — callers SHOULD invoke it on service teardown so a
+ * hot-reloaded host does not leak subprocess handles.
  */
-interface TreeNode {
-    /** Relative path from context-tree root, e.g. "entities/claude.md" */
-    path: string;
-    /** Category from canonical memory */
-    category: string;
-    /** Human-readable title */
-    title: string;
-    /** File content (rendered markdown) */
-    content: string;
-    /** Source memory IDs that contributed to this node */
-    sourceAnchors: string[];
-    /** Confidence (0-1) */
-    confidence: number;
-    /** Trust zone classification */
-    confidenceTier: string;
-    /** When this node was generated */
-    generatedAt: string;
-    /** Provenance chain */
-    provenance: ProvenanceEntry[];
-}
-interface ProvenanceEntry {
-    memoryId: string;
-    source: string;
-    extracted: string;
-}
-interface GenerateOptions {
-    /** Memory root directory (e.g. ~/.openclaw/workspace/memory/local) */
-    memoryDir: string;
-    /** Output directory (e.g. .engram/context-tree) */
-    outputDir: string;
-    /** Categories to include (default: all) */
-    categories?: string[];
-    /** Whether to include entity graph */
-    includeEntities?: boolean;
-    /** Whether to include orphaned questions */
-    includeQuestions?: boolean;
-    /** Max nodes per category (default: unlimited) */
-    maxPerCategory?: number;
-    /** Whether to watch for changes and regenerate incrementally */
-    watch?: boolean;
-}
-interface GenerateResult {
-    nodesGenerated: number;
-    nodesSkipped: number;
-    categories: Record<string, number>;
-    durationMs: number;
-    outputDir: string;
+declare function registerStructuralContextProvider(scope: string, provider: StructuralContextProvider): () => void;
+/** Look up the provider registered for a scope, if any. */
+declare function getStructuralContextProvider(scope: string): StructuralContextProvider | undefined;
+/** Test-only: clear every registered provider. */
+declare function clearStructuralContextProvidersForTest(): void;
+/**
+ * The single gate every review-context consumer consults before consulting a
+ * provider. Returns `true` iff the master `codingKnowledge.enabled` switch is
+ * on AND `structuralProvider` is not `"none"`. When this returns `false`,
+ * review-context runs its pure file-path-only ranker — byte-identical to
+ * pre-feature behaviour on every path.
+ */
+declare function structuralProviderActive(config: PluginConfig): boolean;
+/**
+ * Config-only structural provider status. `remnic doctor` and xray render
+ * this; an async sibling in `structural-subprocess-provider.ts` augments it
+ * with a live `probed` field.
+ */
+interface StructuralProviderStatus {
+    readonly active: boolean;
+    readonly mode: CodingKnowledgeConfig["structuralProvider"];
+    /** Command path when mode is `"subprocess"` and a command is configured. */
+    readonly command?: string;
+    /** Provider id when one is registered for the scope. */
+    readonly providerId?: string;
+    /** Live probe outcome — set only by the async doctor probe. */
+    probed?: {
+        available: boolean;
+        detail?: string;
+    };
 }
 /**
- * Generate a context tree from canonical memory.
+ * Summarise the structural provider status from config ALONE (no probe, no
+ * I/O). Pure — safe to call from any context, including the recall hot path
+ * for xray labels.
+ */
+declare function describeStructuralProviderStatus(config: PluginConfig, scope?: string): StructuralProviderStatus;
+/**
+ * Render a single human-readable line for `remnic doctor`. Pure.
  *
- * Reads memory `.md` files from the source directory, * and projects them into a clean, * human-readable tree structure at `outputDir`.
+ *   `structural-context provider: none (inactive — review-context stays file-path-only)`
+ *   `structural-context provider: subprocess, command=/usr/local/bin/cbm, probed=available`
+ *   `structural-context provider: subprocess, command=/usr/local/bin/cbm, probed=unavailable (binary not found)`
  */
-declare function generateContextTree(options: GenerateOptions): Promise<GenerateResult>;
+declare function renderStructuralProviderStatusLine(status: StructuralProviderStatus): string;
 
 /**
- * @remnic/core — Onboarding
+ * Diff-aware review-context packer (issue #569 PR 4).
  *
- * Detects project language, shape, and documentation to produce
- * an onboarding plan for memory ingestion.
+ * When an agent is asked "review this PR" / "what changed in this diff" /
+ * "look at this diff", the prompt that reaches recall is short and generic
+ * — the real signal is the diff itself. This module:
+ *
+ *   1. Detects review-intent prompts via `isReviewPrompt`.
+ *   2. Extracts the touched file list from a unified diff via
+ *      `parseTouchedFiles`.
+ *   3. Re-ranks a set of candidate memories so that memories whose
+ *      `entityRefs` mention a touched path float to the top. The boost is
+ *      additive and bounded so it doesn't obliterate the original ranking —
+ *      it's a bias, not a filter.
+ *
+ * Pure — no orchestrator, no storage. Callers inject the candidate memories
+ * they already have from their normal recall pipeline. This keeps the
+ * module easy to test and integrates cleanly with the existing tiered-recall
+ * code in `orchestrator.ts` (the tier itself can be wired later; the pure
+ * surface is what PRs 5/6/7 will call).
  */
-interface OnboardOptions {
-    /** Directory to scan (defaults to cwd) */
-    directory?: string;
-    /** Max depth to walk (default: 6) */
-    maxDepth?: number;
-    /** Directories to skip */
-    excludeDirs?: string[];
-}
-interface LanguageInfo {
-    /** Language name (e.g. "TypeScript", "Python") */
-    language: string;
-    /** Confidence in detection (0-1) */
-    confidence: number;
-    /** Evidence (e.g. ["package.json", "tsconfig.json", "*.ts files"]) */
-    evidence: string[];
-}
-interface DocFile {
-    /** Absolute path */
-    path: string;
-    /** Relative path from project root */
-    relativePath: string;
-    /** Estimated type */
-    kind: "readme" | "changelog" | "contributing" | "license" | "config" | "docs" | "other";
-    /** File size in bytes */
-    size: number;
-}
-type ProjectShape = "app" | "library" | "monorepo" | "workspace" | "script" | "unknown";
-interface OnboardResult {
-    /** Project root */
-    directory: string;
-    /** Detected languages (sorted by confidence) */
-    languages: LanguageInfo[];
-    /** Detected project shape */
-    shape: ProjectShape;
-    /** Shape evidence */
-    shapeEvidence: string[];
-    /** Discovered documentation files */
-    docs: DocFile[];
-    /** Total files scanned */
-    totalFiles: number;
-    /** Duration in ms */
-    durationMs: number;
-    /** Suggested ingestion plan */
-    plan: IngestionPlan;
-}
-interface IngestionPlan {
-    /** Priority files to ingest first */
-    priorityFiles: DocFile[];
-    /** Estimated total files to ingest */
-    estimatedFiles: number;
-    /** Recommended categories */
-    categories: string[];
-    /** Suggested memory namespace */
-    suggestedNamespace: string;
-}
-declare function onboard(options: OnboardOptions): OnboardResult;
 
 /**
- * @remnic/core — Curation
- *
- * Deliberate ingestion of files into memory with provenance tracking.
- * Supports statement-level extraction, dedup, and contradiction checks.
+ * A memory candidate as fed into review-context ranking. The shape is a
+ * deliberate subset of the core `MemorySummary` / recall result — only the
+ * fields we actually need — so this module stays decoupled from the rest of
+ * the codebase and can be reused by CLI tools, bench fixtures, etc.
  */
-interface CurateOptions {
-    /** File or directory path to curate */
-    targetPath: string;
-    /** Memory root directory for writing */
-    memoryDir: string;
-    /** Source label (e.g. "manual", "docs", "onboarding") */
-    source?: string;
-    /** Category override (default: auto-detect) */
-    category?: string;
-    /** Confidence to assign (default: 0.9 for curated items) */
-    confidence?: number;
-    /** Entity reference to attach */
-    entityRef?: string;
-    /** Tags to add */
-    tags?: string[];
-    /** Whether to perform dedup check against existing memories */
-    checkDuplicates?: boolean;
-    /** Whether to detect contradictions */
-    checkContradictions?: boolean;
-    /** Whether to write files (default: true). False = dry run */
-    write?: boolean;
-}
-interface CuratedStatement {
-    /** Unique ID for this statement */
+interface ReviewCandidate {
+    /** Opaque identifier. Echoed unchanged in the output. */
     id: string;
-    /** The extracted statement text */
-    content: string;
-    /** Category */
-    category: string;
-    /** Confidence */
-    confidence: number;
-    /** Provenance info */
-    provenance: StatementProvenance;
-    /** Hash of content for dedup */
-    contentHash: string;
-    /** Tags */
-    tags: string[];
-    /** Entity reference */
-    entityRef?: string;
-}
-interface StatementProvenance {
-    /** Source file path */
-    sourcePath: string;
-    /** Relative path from project root */
-    relativePath: string;
-    /** Source label */
-    source: string;
-    /** Line number if extractable (0 = unknown) */
-    lineNumber: number;
-    /** Timestamp of ingestion */
-    ingestedAt: string;
-    /** Hash of the source file for diff tracking */
-    sourceFileHash: string;
+    /**
+     * Pre-review relevance score from the upstream recall pipeline. Higher is
+     * better. `0` is treated as "no prior signal" and gets the full review
+     * boost when a path match is found.
+     */
+    score: number;
+    /**
+     * References the memory mentions (file paths, entity names, etc.). Used
+     * to decide whether any touched file appears in the memory's scope.
+     *
+     * Accepts `undefined`/missing so callers can pass sparse records from
+     * legacy storage without pre-filling.
+     */
+    entityRefs?: string[];
 }
-interface CurateResult {
-    /** Statements extracted */
-    statements: CuratedStatement[];
-    /** Files processed */
-    filesProcessed: number;
-    /** Files skipped (empty, binary, etc.) */
-    filesSkipped: number;
-    /** Duplicate statements found (if checkDuplicates) */
-    duplicates: DuplicateResult[];
-    /** Contradictions found (if checkContradictions) */
-    contradictions: ContradictionResult$1[];
-    /** Memory files written */
-    written: string[];
-    /** Duration in ms */
-    durationMs: number;
-}
-interface DuplicateResult {
-    /** New statement */
-    newStatement: CuratedStatement;
-    /** Existing memory ID that matches */
-    existingId: string;
-    /** Similarity score (0-1) */
-    similarity: number;
-    /** Recommended action */
-    action: "skip" | "merge" | "keep";
-}
-interface ContradictionResult$1 {
-    /** New statement */
-    newStatement: CuratedStatement;
-    /** Conflicting memory ID */
-    conflictingId: string;
-    /** The conflicting content */
-    conflictingContent: string;
-    /** Severity */
-    severity: "high" | "medium" | "low";
+interface ReviewContext {
+    /**
+     * Normalized file paths touched by the diff. Each entry is forward-slashed
+     * and relative to the repo root when possible.
+     */
+    touchedFiles: string[];
+    /**
+     * Candidates re-sorted so memories whose `entityRefs` mention a touched
+     * path are boosted. Shape matches the input `ReviewCandidate[]` — the
+     * boost is recorded on each entry as `boost` for observability.
+     */
+    rankedRecall: Array<ReviewCandidate & {
+        boost: number;
+    }>;
+    /**
+     * Structural-context provider degradation observed while expanding the
+     * diff to touched symbols (issue #1548 Track A PR 5, #1536 pattern).
+     * Present only when a provider was consulted AND it failed — a silent
+     * provider failure must never look like "no structural matches"
+     * (CLAUDE.md rule 34). Undefined when no provider was consulted (the
+     * pure {@link packReviewContext} path) or when the provider succeeded.
+     */
+    structuralDegradation?: StructuralContextDegradation;
 }
-declare function curate(options: CurateOptions): Promise<CurateResult>;
-
 /**
- * @remnic/core — Dedup & Contradiction Detection
+ * `true` when the prompt looks like a review / diff-explanation request.
  *
- * Statement-level deduplication and contradiction detection
- * against existing memories. Can be used standalone or via curation.
+ * Empty / non-string input → `false` (the caller shouldn't branch on an
+ * invalid prompt).
  */
-interface MemoryEntry {
-    /** Memory ID */
-    id: string;
-    /** Content text */
-    content: string;
-    /** Category */
-    category: string;
-    /** File path (if known) */
-    filePath?: string;
-}
-interface DedupOptions {
-    /** Memory root directory */
-    memoryDir: string;
-    /** Categories to scan (default: all) */
-    categories?: string[];
-    /** Similarity threshold for fuzzy matching (0-1, default: 0.85) */
-    threshold?: number;
-    /** Max memories to load (default: 10000) */
-    maxLoad?: number;
-}
-interface DedupResult {
-    /** Total memories scanned */
-    scanned: number;
-    /** Duplicate pairs found */
-    duplicates: DuplicatePair[];
-    /** Duration in ms */
-    durationMs: number;
-}
-interface DuplicatePair {
-    /** First memory */
-    left: MemoryEntry;
-    /** Second memory */
-    right: MemoryEntry;
-    /** Similarity score */
-    similarity: number;
-    /** Recommended action */
-    action: "merge" | "keep_left" | "keep_right";
-}
-interface ContradictionOptions {
-    /** Memory root directory */
-    memoryDir: string;
-    /** Categories to scan (default: all) */
-    categories?: string[];
-    /** Max memories to load (default: 10000) */
-    maxLoad?: number;
-}
-interface ContradictionResult {
-    /** Total memories scanned */
-    scanned: number;
-    /** Contradictions found */
-    contradictions: ContradictionPair[];
-    /** Duration in ms */
-    durationMs: number;
-}
-interface ContradictionPair {
-    /** First statement */
-    left: MemoryEntry;
-    /** Contradicting statement */
-    right: MemoryEntry;
-    /** Severity */
-    severity: "high" | "medium" | "low";
-    /** Reason */
-    reason: string;
-}
-declare function findDuplicates(options: DedupOptions): DedupResult;
-declare function findContradictions(options: ContradictionOptions): ContradictionResult;
-
+declare function isReviewPrompt(prompt: string | null | undefined): boolean;
 /**
- * @remnic/core — Review Inbox
+ * Parse a unified diff and return the set of files touched. Accepts both the
+ * `diff --git` form (`diff --git a/foo b/bar`) and the `--- / +++` form
+ * (`--- a/foo\n+++ b/bar`). Returns deduplicated, repo-root-relative paths
+ * (with the conventional `a/` / `b/` prefixes stripped).
  *
- * Manages low-confidence memories and suggestions pending review.
- * Integrates with the existing review-queue system.
+ * Path entries of `/dev/null` (used in adds/deletes) are excluded.
  */
-interface ReviewItem {
-    /** Memory ID */
-    id: string;
-    /** Content text */
-    content: string;
-    /** Category */
-    category: string;
-    /** Confidence score (0-1) */
-    confidence: number;
-    /** Confidence tier */
-    confidenceTier: string;
-    /** Source */
-    source: string;
-    /** File path if available */
-    filePath?: string;
-    /** Created date */
-    created: string;
-    /** Reason it's in review */
-    reviewReason: "low_confidence" | "suggestion" | "contradiction" | "duplicate" | "tombstone_blocked";
-    /** Additional context */
-    context?: string;
-}
-type ReviewAction = "approve" | "dismiss" | "flag";
-interface ReviewResult {
-    /** Item acted upon */
-    itemId: string;
-    /** Action taken */
-    action: ReviewAction;
-    /** Updated file path (if modified) */
-    updatedPath?: string;
-    /** Status message */
-    message: string;
-    /** Tombstone id cleared by an approve action (for the caller to revoke). */
-    clearedTombstoneId?: string;
-}
-interface ReviewListResult {
-    /** Items pending review */
-    items: ReviewItem[];
-    /** Total count */
-    total: number;
-    /** Duration in ms */
-    durationMs: number;
-}
-interface ReviewOptions {
-    /** Memory root directory */
-    memoryDir: string;
-    /** Filter by reason */
-    reason?: ReviewItem["reviewReason"];
-    /** Max items to return (default: 50) */
-    limit?: number;
-    /** Include items with confidence below this threshold (default: 0.7) */
-    confidenceThreshold?: number;
-}
-interface ReviewActionOptions {
-    /** Match the threshold used when listing review items (default: 0.7) */
-    confidenceThreshold?: number;
-    /**
-     * Revocation hook (issue #1579). When approving a memory whose frontmatter
-     * carries `blockedBy: <tombstoneId>`, the hook fires so the caller (CLI /
-     * orchestrator) can append a `kind: "revocation"` tombstone entry —
-     * re-allowing the content. Fire-and-forget: a revocation failure MUST NOT
-     * fail the approval (gotcha #13). The hook receives the tombstone id and
-     * the memory id.
-     */
-    onApproveBlockedMemory?: (tombstoneId: string, memoryId: string) => void | Promise<void>;
+declare function parseTouchedFiles(diff: string | null | undefined): string[];
+/**
+ * Build a review-context ranking for a set of candidate memories.
+ *
+ * Contract:
+ *   - `touchedFiles` is the parsed diff file list.
+ *   - `candidates` is passed through unchanged when no boost applies.
+ *   - When a boost applies, the result is sorted by `(score + boost)` desc,
+ *     with a stable secondary sort on the original `id` for determinism
+ *     (CLAUDE.md #19 — comparators must return 0 for equal items).
+ */
+declare function rankReviewCandidates(candidates: ReviewCandidate[], touchedFiles: string[]): Array<ReviewCandidate & {
+    boost: number;
+}>;
+interface PackReviewContextInput {
+    /** Unified diff, as produced by `git diff`. */
+    diff: string | null | undefined;
+    /** Candidate memories from the upstream recall pipeline. */
+    candidates: ReviewCandidate[];
 }
 /**
- * List items pending review.
+ * Top-level entry point used by the orchestrator (and CLI / bench) when a
+ * review-intent prompt is detected.
+ *
+ * Parses the diff, re-ranks the candidates, and returns both artefacts so
+ * the caller can surface `touchedFiles` as context and `rankedRecall` as
+ * the recall result.
  */
-declare function listReviewItems(options: ReviewOptions): ReviewListResult;
+declare function packReviewContext(input: PackReviewContextInput): ReviewContext;
 /**
- * Perform a review action on an item.
+ * Input for the structural-context-aware review-context packer. The pure
+ * {@link packReviewContext} stays unchanged (gate-off parity); this async
+ * variant consults a {@link StructuralContextProvider} to expand the diff's
+ * touched FILE paths into touched SYMBOL names, widening the match set so
+ * memories that mention a changed symbol — not just the file path — float
+ * up. The gate (`structuralProvider !== "none"`) is checked ONCE by the
+ * caller, never inside this function (rule 39).
  */
-declare function performReview(memoryDir: string, itemId: string, action: ReviewAction, options?: ReviewActionOptions): ReviewResult;
-
+interface PackReviewContextStructuralInput extends PackReviewContextInput {
+    /** A probed structural-context provider. Never undefined here. */
+    provider: StructuralContextProvider;
+    /** Cancellation forwarded to the provider subprocess (rule 40). */
+    signal?: AbortSignal;
+}
 /**
- * @remnic/core — Diff-Aware Sync
+ * Structural-context-aware packer.
  *
- * Watches source files for changes and triggers re-ingestion
- * only for changed content. Uses file hashing to detect changes.
- */
-interface SyncOptions {
-    /** Source directory to watch */
-    sourceDir: string;
-    /** Memory root directory */
-    memoryDir: string;
-    /** State file path (stores hashes). Default: memoryDir/.sync-state.json */
-    stateFile?: string;
-    /** File extensions to watch (default: .md, .txt, .mdx) */
-    extensions?: string[];
-    /** Directories to exclude */
-    excludeDirs?: string[];
-    /** Poll interval for watchForChanges. Default: 5000ms */
-    pollIntervalMs?: number;
-    /** Whether to actually write changes (default: true) */
-    dryRun?: boolean;
-}
-interface SyncResult {
-    /** Files scanned */
-    scanned: number;
-    /** Files changed since last sync */
-    changed: FileChange[];
-    /** Files unchanged */
-    unchanged: number;
-    /** Files deleted since last sync */
-    deleted: string[];
-    /** Files newly added */
-    added: string[];
-    /** Duration in ms */
-    durationMs: number;
-    /** State file path */
-    stateFile: string;
-}
-interface FileChange {
-    /** Absolute file path */
-    filePath: string;
-    /** Relative path from source root */
-    relativePath: string;
-    /** Change type */
-    type: "added" | "modified" | "deleted";
-    /** Current content hash */
-    currentHash: string;
-    /** Previous content hash (if modified) */
-    previousHash?: string;
-    /** File size in bytes */
-    size: number;
-}
-interface SyncState {
-    /** Map of relative path → content hash */
-    fileHashes: Record<string, string>;
-    /** Last sync timestamp */
-    lastSyncAt: string;
-    /** Version of state format */
-    version: number;
+ * Contract (issue #1548 Track A PR 5, prove-fail-before characterization):
+ *   - Provider returns symbols (`ok: true`) → symbol names are ADDED to the
+ *     match set alongside touched files; memories mentioning a symbol get the
+ *     same bounded additive boost as a file-path match.
+ *   - Provider fails (`ok: false`, any code) → ranking falls back to
+ *     FILE-PATH-ONLY boosting, BYTE-IDENTICAL to {@link packReviewContext}
+ *     (the match set is exactly the touched files), AND `structuralDegradation`
+ *     is populated so xray/doctor can surface the failure (rule 34).
+ *
+ * The underlying ranker ({@link rankReviewCandidates}) is reused unchanged,
+ * so the deterministic ordering, boost cap, and tie-break are identical to
+ * the pure path.
+ */
+declare function packReviewContextStructural(input: PackReviewContextStructuralInput): Promise<ReviewContext>;
+
+/** Injectable spawn shape so tests substitute a stub (rule 33). */
+type StructuralSpawnFn = (command: string, argv: readonly string[], options: {
+    timeout: number;
+    signal?: AbortSignal;
+}) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+interface SubprocessProviderOptions {
+    /** Absolute path to the binary (rule 24 — statSync at probe time). */
+    readonly command: string;
+    /**
+     * Extra argv appended after the symbols-for-diff subcommand
+     * (rule 10 — array, never a shell string).
+     */
+    readonly args?: readonly string[];
+    /** Per-call deadline in ms. Default 5000. */
+    readonly timeoutMs?: number;
+    /**
+     * Subcommand the provider invokes for symbol expansion.
+     * Default `"symbols-for-diff"`.
+     */
+    readonly symbolsSubcommand?: string;
+    /** Test seam — defaults to promisified `execFile`. */
+    readonly spawn?: StructuralSpawnFn;
 }
-declare function syncChanges(options: SyncOptions): SyncResult;
 /**
- * Watch for changes and call callback on file changes.
- * Returns a stop function.
+ * Construct a structural-context provider backed by an external subprocess.
+ * The instance is self-contained: callers register it via
+ * `registerStructuralContextProvider(scope, provider)` and dispose via the
+ * returned unregister handle.
  */
-declare function watchForChanges(options: SyncOptions, onChange: (changes: FileChange[]) => void | Promise<void>): {
-    stop: () => void;
-};
-
+declare function createSubprocessStructuralProvider(options: SubprocessProviderOptions): StructuralContextProvider;
 /**
- * memory-extension-host/render-extensions-block.ts — Render discovered extensions
- * into a markdown block for injection into consolidation prompts.
+ * Augment the pure {@link describeStructuralProviderStatus} with a LIVE probe
+ * so `remnic doctor` can render "configured / probed / last error code".
  *
- * Respects the global token budget (REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT) and
- * truncates with a footer listing omitted extensions when over budget.
+ *   - `"none"`     → inactive (no probe).
+ *   - `"subprocess"` → builds a throwaway provider from
+ *                    `structuralProviderCommand`, probes it, disposes it.
+ *   - `"native"`   → asks `isCodingGraphInstalled()` whether the optional
+ *                    @remnic/coding-graph peer is present (the adapter that
+ *                    turns the engine into a provider lands in #1551).
+ *
+ * Never throws — a probe failure populates `probed.available = false`.
  */
+declare function probeStructuralProviderForDoctor(config: PluginConfig): Promise<StructuralProviderStatus>;
 
 /**
- * Render a markdown block containing extension instructions for injection
- * into consolidation prompts.
+ * Binary file lifecycle management types.
  *
- * If the list is empty, returns "".
- * Inlines extensions in name order until the token budget is exhausted.
- * If the budget is exceeded, appends a truncation footer listing omitted extensions.
+ * Defines the configuration, manifest, and record structures for the
+ * three-stage binary lifecycle pipeline: mirror, redirect, clean.
  */
-declare function renderExtensionsBlock(extensions: DiscoveredExtension[]): string;
+interface BinaryLifecycleConfig {
+    /** Master toggle. Default: false. */
+    enabled: boolean;
+    /** Days after mirror before local copy is eligible for cleanup. Default: 7. */
+    gracePeriodDays: number;
+    /** Files larger than this are skipped during scan. Default: 50 MB. */
+    maxBinarySizeBytes: number;
+    /** Glob patterns for binary file types to manage. */
+    scanPatterns: string[];
+    /** Backend configuration for binary storage. */
+    backend: BinaryStorageBackendConfig;
+}
+interface BinaryStorageBackendConfig {
+    /** Backend type. "filesystem" copies to a local directory. "none" is a no-op (dry-run/testing). */
+    type: "filesystem" | "s3" | "none";
+    /** Destination directory for the filesystem backend. */
+    basePath?: string;
+    /** S3 bucket name (future). */
+    s3Bucket?: string;
+    /** S3 region (future). */
+    s3Region?: string;
+    /** S3 key prefix (future). */
+    s3Prefix?: string;
+}
+type BinaryAssetStatus = "pending" | "mirrored" | "redirected" | "cleaned" | "error";
+interface BinaryAssetRecord {
+    /** Relative path from memoryDir to the original file. */
+    originalPath: string;
+    /** Path (or URL) in the backend storage. */
+    mirroredPath: string;
+    /** Optional user-resolvable target to write into markdown links. */
+    redirectPath?: string;
+    /** SHA-256 hex digest of file content. */
+    contentHash: string;
+    /** File size in bytes. */
+    sizeBytes: number;
+    /** MIME type (e.g. "image/png"). */
+    mimeType: string;
+    /** ISO 8601 timestamp when the file was mirrored. */
+    mirroredAt: string;
+    /** ISO 8601 timestamp when markdown references were rewritten. */
+    redirectedAt?: string;
+    /** ISO 8601 timestamp when the local copy was deleted. */
+    cleanedAt?: string;
+    /** Current lifecycle status. */
+    status: BinaryAssetStatus;
+}
+interface BinaryLifecycleManifest {
+    version: 1;
+    assets: BinaryAssetRecord[];
+    lastScanAt?: string;
+}
+interface PipelineResult {
+    scanned: number;
+    mirrored: number;
+    redirected: number;
+    cleaned: number;
+    errors: string[];
+    dryRun: boolean;
+}
+declare const DEFAULT_SCAN_PATTERNS: string[];
+declare const DEFAULT_MAX_BINARY_SIZE_BYTES: number;
+declare const DEFAULT_GRACE_PERIOD_DAYS = 7;
+
 /**
- * Render a compact one-line footer listing active extension names.
- * Used by day-summary and summary-snapshot where full instructions are not needed.
+ * Binary storage backend interface and implementations.
+ *
+ * Backends handle the actual persistence of binary files to an external
+ * location. The pipeline calls upload/exists/delete through this interface
+ * so swapping storage providers requires no pipeline changes.
  */
-declare function renderExtensionsFooter(extensions: DiscoveredExtension[]): string;
+
+interface BinaryStorageBackend {
+    /** Discriminator for the backend type. */
+    readonly type: string;
+    /**
+     * Upload a local file to the backend.
+     * @returns The backend path or URL where the file was stored.
+     */
+    upload(localPath: string, remotePath: string): Promise<string>;
+    /** Check whether a remote path already exists in the backend. */
+    exists(remotePath: string): Promise<boolean>;
+    /** Delete a file from the backend. */
+    delete(remotePath: string): Promise<void>;
+    /** Return the user-resolvable markdown target for a stored backend path. */
+    getRedirectTarget?(remotePath: string): string;
+}
+declare class FilesystemBackend implements BinaryStorageBackend {
+    readonly type = "filesystem";
+    private readonly basePath;
+    constructor(basePath: string);
+    private resolveRemotePath;
+    private isInsideBase;
+    private realBasePathIfExists;
+    private ensureBaseDirectory;
+    private ensureSafeParentDirectory;
+    private resolveExistingRemotePath;
+    upload(localPath: string, remotePath: string): Promise<string>;
+    exists(remotePath: string): Promise<boolean>;
+    delete(remotePath: string): Promise<void>;
+    getRedirectTarget(remotePath: string): string;
+}
+declare class NoneBackend implements BinaryStorageBackend {
+    readonly type = "none";
+    upload(_localPath: string, remotePath: string): Promise<string>;
+    exists(_remotePath: string): Promise<boolean>;
+    delete(_remotePath: string): Promise<void>;
+}
+declare function createBackend(cfg: BinaryStorageBackendConfig): BinaryStorageBackend;
 
 /**
- * @remnic/core — Live Connectors Registry (issue #683 PR 1/N)
+ * Binary file scanner.
  *
- * Pure in-memory registry. No I/O. Concrete connectors register themselves at
- * orchestrator boot (later PRs); the maintenance scheduler asks the registry
- * for the active set when running due syncs.
+ * Recursively walks the memory directory, matches files against configured
+ * glob patterns, skips files already tracked in the manifest, and respects
+ * the max-size limit.
  */
 
 /**
- * Thrown when registering a duplicate id or an id that fails validation.
- *
- * Distinct error class so callers can distinguish framework-level mistakes
- * (which are programmer errors) from connector-runtime failures.
+ * Test whether a filename matches any of the provided glob patterns.
+ * Supports simple `*.ext` patterns (the default scan patterns).
+ * For more complex globs a proper library should be used; this covers
+ * the 95% case without adding a dependency.
  */
-declare class LiveConnectorRegistryError extends Error {
-    constructor(message: string);
-}
+declare function matchesPatterns(filename: string, patterns: string[]): boolean;
 /**
- * In-memory registry of live connectors. One instance per orchestrator. Not
- * safe for cross-process sharing — wire each process to its own registry.
+ * Scan memoryDir recursively for binary files matching the configured patterns.
+ * Returns relative paths (relative to memoryDir) for files not yet tracked.
  */
-declare class LiveConnectorRegistry {
-    private readonly connectors;
-    /**
-     * Register a connector. Throws `LiveConnectorRegistryError` if the id is
-     * malformed or already registered.
-     *
-     * Re-registration is rejected (rather than silently overwriting) because
-     * silent overwrites mask plugin loading bugs in development and could let
-     * a malicious extension shadow a built-in connector.
-     */
-    register(connector: LiveConnector): void;
-    /**
-     * Look up a connector by id. Returns `undefined` if not registered.
-     */
-    get(id: string): LiveConnector | undefined;
-    /**
-     * Return all registered connectors, sorted by id for stable enumeration.
-     */
-    list(): LiveConnector[];
-    /**
-     * Remove a connector. Returns `true` if a connector was removed, `false`
-     * otherwise. The cursor / state file on disk is **not** touched — callers
-     * who want to fully decommission a connector must also delete its state
-     * file via the `state-store` module.
-     */
-    unregister(id: string): boolean;
-    /**
-     * Number of registered connectors. Cheap; safe to call frequently.
-     */
-    size(): number;
-}
+declare function scanForBinaries(memoryDir: string, config: BinaryLifecycleConfig, manifest: BinaryLifecycleManifest): Promise<string[]>;
 
 /**
- * @remnic/core — Google Drive live connector (issue #683 PR 2/N)
- *
- * Concrete `LiveConnector` implementation that incrementally imports text
- * content from a user's Google Drive into Remnic. Built on top of the
- * framework shipped in PR 1/N (`framework.ts` / `registry.ts` /
- * `state-store.ts`).
- *
- * Design notes:
- *
- *   - **Cursor semantics.** We page Drive with the official `changes` API
- *     when a `startPageToken` is available. The cursor is opaque from the
- *     framework's POV (`{kind: "drivePageToken", value: ...}`), and on the
- *     very first sync (cursor=null) we call `changes.getStartPageToken()`
- *     to seed it without importing anything. This matches the documented
- *     Drive incremental-sync recipe and means re-runs never re-ingest the
- *     same file as long as the cursor file survives.
- *
- *   - **Folder scope.** When `folderIds` is non-empty, files are filtered
- *     to those whose `parents` intersect the configured folder set. Drive
- *     does not currently support server-side parent filtering on the
- *     `changes.list` endpoint, so we pull the change record's `file` payload
- *     and apply the filter on our side. Folder ids are validated up front so
- *     a typo in config doesn't silently cause a broad import.
- *
- *   - **Content extraction.** Google-native MIME types
- *     (`application/vnd.google-apps.{document,spreadsheet,presentation}`)
- *     are exported via `files.export` to plaintext. Plain-text MIME types
- *     are pulled with `files.get?alt=media`. Everything else is skipped —
- *     bytes from binary formats (images, PDFs, archives) belong in the
- *     binary-lifecycle pipeline, not in the textual ingestion path.
- *
- *   - **Idempotency.** Each emitted `ConnectorDocument.source` carries
- *     `externalId = file.id` plus `externalRevision = file.modifiedTime`,
- *     so downstream dedup (CLAUDE.md gotcha #44 — never index content that
- *     failed to persist) can recognise repeat fetches even if the cursor is
- *     manually rewound.
- *
- *   - **Privacy.** No document content is ever logged. Folder ids and
- *     counts may be logged. OAuth credentials (`clientId`,
- *     `clientSecret`, `refreshToken`) are accepted via config but the
- *     intent is for callers to populate them from a secret store; we never
- *     persist credentials through the connector state-store. Per CLAUDE.md
- *     repository-privacy rules, no real credentials may appear in tests,
- *     fixtures, or comments.
+ * Binary lifecycle manifest — read/write operations.
  *
- *   - **À-la-carte packaging (CLAUDE.md gotcha #57).** `googleapis` is NOT
- *     listed as a hard dependency of `@remnic/core`. It is loaded via a
- *     computed-specifier dynamic import (`await import("google" + "apis")`)
- *     so bundlers cannot statically resolve it, and it is declared as an
- *     optional peer dependency. Operators who never enable the connector
- *     pay nothing for it.
+ * The manifest lives at `${memoryDir}/.binary-lifecycle/manifest.json`.
+ * Writes use the atomic temp-then-rename pattern (CLAUDE.md #54).
+ */
+
+declare function manifestDir(memoryDir: string): string;
+declare function manifestPath(memoryDir: string): string;
+/**
+ * Read the manifest from disk. Returns a fresh empty manifest if the file
+ * does not exist. Existing invalid manifests fail closed so the pipeline does
+ * not overwrite state needed for safe cleanup.
+ */
+declare function readManifest(memoryDir: string): Promise<BinaryLifecycleManifest>;
+/**
+ * Write the manifest atomically: write to a temp file, then rename.
+ * CLAUDE.md #54: never delete before write. Write temp first, rename atomically.
+ */
+declare function writeManifest(memoryDir: string, manifest: BinaryLifecycleManifest): Promise<void>;
+declare function emptyManifest(): BinaryLifecycleManifest;
+
+/**
+ * Binary lifecycle pipeline — mirror, redirect, clean.
  *
- *   - **Read-only.** This connector only reads. It never marks files as
- *     read, edits metadata, or modifies sharing settings.
+ * Three-stage pipeline:
+ * 1. Mirror:   upload binary to backend, record in manifest
+ * 2. Redirect: scan markdown for inline refs, replace with redirect path
+ * 3. Clean:    after grace period, delete local copy
  */
 
+/** Minimal logger interface so we don't depend on the full logger module. */
+interface PipelineLogger {
+    info(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+}
+type ReadMarkdownFile = (filePath: string) => Promise<string>;
+type WriteMarkdownFile = (filePath: string, content: string) => Promise<void>;
+interface PipelineOptions {
+    dryRun?: boolean;
+    /** Force-clean all files past grace period, ignoring redirect status. */
+    forceClean?: boolean;
+    /** Test hook for deterministic markdown read failures. */
+    readMarkdownFile?: ReadMarkdownFile;
+    /** Test hook for deterministic markdown write failures. */
+    writeMarkdownFile?: WriteMarkdownFile;
+}
 /**
- * Stable connector id. Lives in the registry under this exact string.
+ * Run the binary lifecycle pipeline: scan, mirror, redirect, clean.
  */
-declare const GOOGLE_DRIVE_CONNECTOR_ID = "google-drive";
+declare function runBinaryLifecyclePipeline(memoryDir: string, config: BinaryLifecycleConfig, backend: BinaryStorageBackend, log: PipelineLogger, opts?: PipelineOptions): Promise<PipelineResult>;
+
 /**
- * Cursor `kind` we emit. Treated as opaque by the framework; documented
- * here so tests can assert on it.
+ * @remnic/core — Workspace Tree Projection
+ *
+ * Generates a human-readable `.engram/context-tree/` from canonical memory.
+ * Each node is a `.md` file with rich metadata, * (provenance, trust, confidence, source anchors).
+ * Manual edits are preserved in fenced blocks.
  */
-declare const GOOGLE_DRIVE_CURSOR_KIND = "drivePageToken";
+interface TreeNode {
+    /** Relative path from context-tree root, e.g. "entities/claude.md" */
+    path: string;
+    /** Category from canonical memory */
+    category: string;
+    /** Human-readable title */
+    title: string;
+    /** File content (rendered markdown) */
+    content: string;
+    /** Source memory IDs that contributed to this node */
+    sourceAnchors: string[];
+    /** Confidence (0-1) */
+    confidence: number;
+    /** Trust zone classification */
+    confidenceTier: string;
+    /** When this node was generated */
+    generatedAt: string;
+    /** Provenance chain */
+    provenance: ProvenanceEntry[];
+}
+interface ProvenanceEntry {
+    memoryId: string;
+    source: string;
+    extracted: string;
+}
+interface GenerateOptions {
+    /** Memory root directory (e.g. ~/.openclaw/workspace/memory/local) */
+    memoryDir: string;
+    /** Output directory (e.g. .engram/context-tree) */
+    outputDir: string;
+    /** Categories to include (default: all) */
+    categories?: string[];
+    /** Whether to include entity graph */
+    includeEntities?: boolean;
+    /** Whether to include orphaned questions */
+    includeQuestions?: boolean;
+    /** Max nodes per category (default: unlimited) */
+    maxPerCategory?: number;
+    /** Whether to watch for changes and regenerate incrementally */
+    watch?: boolean;
+}
+interface GenerateResult {
+    nodesGenerated: number;
+    nodesSkipped: number;
+    categories: Record<string, number>;
+    durationMs: number;
+    outputDir: string;
+}
 /**
- * Default poll interval (5 minutes). Surfaced in `openclaw.plugin.json`
- * defaults and in the documented config schema. Drive's `changes.list`
- * endpoint is cheap, but polling sub-minute is wasteful for a personal
- * memory layer.
+ * Generate a context tree from canonical memory.
+ *
+ * Reads memory `.md` files from the source directory, * and projects them into a clean, * human-readable tree structure at `outputDir`.
  */
-declare const DEFAULT_POLL_INTERVAL_MS: number;
+declare function generateContextTree(options: GenerateOptions): Promise<GenerateResult>;
+
 /**
- * Validated, frozen view of `connectors.googleDrive.*`.
+ * @remnic/core — Onboarding
+ *
+ * Detects project language, shape, and documentation to produce
+ * an onboarding plan for memory ingestion.
  */
-interface GoogleDriveConnectorConfig {
-    readonly clientId: string;
-    readonly clientSecret: string;
-    readonly refreshToken: string;
-    /** Poll interval surfaced to the scheduler. */
-    readonly pollIntervalMs: number;
-    /** Folder ids to scope import to. Empty = "all accessible". */
-    readonly folderIds: readonly string[];
+interface OnboardOptions {
+    /** Directory to scan (defaults to cwd) */
+    directory?: string;
+    /** Max depth to walk (default: 6) */
+    maxDepth?: number;
+    /** Directories to skip */
+    excludeDirs?: string[];
+}
+interface LanguageInfo {
+    /** Language name (e.g. "TypeScript", "Python") */
+    language: string;
+    /** Confidence in detection (0-1) */
+    confidence: number;
+    /** Evidence (e.g. ["package.json", "tsconfig.json", "*.ts files"]) */
+    evidence: string[];
+}
+interface DocFile {
+    /** Absolute path */
+    path: string;
+    /** Relative path from project root */
+    relativePath: string;
+    /** Estimated type */
+    kind: "readme" | "changelog" | "contributing" | "license" | "config" | "docs" | "other";
+    /** File size in bytes */
+    size: number;
+}
+type ProjectShape = "app" | "library" | "monorepo" | "workspace" | "script" | "unknown";
+interface OnboardResult {
+    /** Project root */
+    directory: string;
+    /** Detected languages (sorted by confidence) */
+    languages: LanguageInfo[];
+    /** Detected project shape */
+    shape: ProjectShape;
+    /** Shape evidence */
+    shapeEvidence: string[];
+    /** Discovered documentation files */
+    docs: DocFile[];
+    /** Total files scanned */
+    totalFiles: number;
+    /** Duration in ms */
+    durationMs: number;
+    /** Suggested ingestion plan */
+    plan: IngestionPlan;
+}
+interface IngestionPlan {
+    /** Priority files to ingest first */
+    priorityFiles: DocFile[];
+    /** Estimated total files to ingest */
+    estimatedFiles: number;
+    /** Recommended categories */
+    categories: string[];
+    /** Suggested memory namespace */
+    suggestedNamespace: string;
 }
+declare function onboard(options: OnboardOptions): OnboardResult;
+
 /**
- * Optional injection point for tests. The real connector dynamically imports
- * `googleapis`; tests pass a stub here to avoid the optional-peer-dep
- * machinery and to keep the test suite hermetic.
+ * @remnic/core — Curation
  *
- * The shape only covers the tiny slice of the SDK we actually use.
+ * Deliberate ingestion of files into memory with provenance tracking.
+ * Supports statement-level extraction, dedup, and contradiction checks.
  */
-interface GoogleDriveClientFactory {
-    (config: GoogleDriveConnectorConfig): Promise<GoogleDriveClient>;
+interface CurateOptions {
+    /** File or directory path to curate */
+    targetPath: string;
+    /** Memory root directory for writing */
+    memoryDir: string;
+    /** Source label (e.g. "manual", "docs", "onboarding") */
+    source?: string;
+    /** Category override (default: auto-detect) */
+    category?: string;
+    /** Confidence to assign (default: 0.9 for curated items) */
+    confidence?: number;
+    /** Entity reference to attach */
+    entityRef?: string;
+    /** Tags to add */
+    tags?: string[];
+    /** Whether to perform dedup check against existing memories */
+    checkDuplicates?: boolean;
+    /** Whether to detect contradictions */
+    checkContradictions?: boolean;
+    /** Whether to write files (default: true). False = dry run */
+    write?: boolean;
+}
+interface CuratedStatement {
+    /** Unique ID for this statement */
+    id: string;
+    /** The extracted statement text */
+    content: string;
+    /** Category */
+    category: string;
+    /** Confidence */
+    confidence: number;
+    /** Provenance info */
+    provenance: StatementProvenance;
+    /** Hash of content for dedup */
+    contentHash: string;
+    /** Tags */
+    tags: string[];
+    /** Entity reference */
+    entityRef?: string;
+}
+interface StatementProvenance {
+    /** Source file path */
+    sourcePath: string;
+    /** Relative path from project root */
+    relativePath: string;
+    /** Source label */
+    source: string;
+    /** Line number if extractable (0 = unknown) */
+    lineNumber: number;
+    /** Timestamp of ingestion */
+    ingestedAt: string;
+    /** Hash of the source file for diff tracking */
+    sourceFileHash: string;
 }
+interface CurateResult {
+    /** Statements extracted */
+    statements: CuratedStatement[];
+    /** Files processed */
+    filesProcessed: number;
+    /** Files skipped (empty, binary, etc.) */
+    filesSkipped: number;
+    /** Duplicate statements found (if checkDuplicates) */
+    duplicates: DuplicateResult[];
+    /** Contradictions found (if checkContradictions) */
+    contradictions: ContradictionResult$1[];
+    /** Memory files written */
+    written: string[];
+    /** Duration in ms */
+    durationMs: number;
+}
+interface DuplicateResult {
+    /** New statement */
+    newStatement: CuratedStatement;
+    /** Existing memory ID that matches */
+    existingId: string;
+    /** Similarity score (0-1) */
+    similarity: number;
+    /** Recommended action */
+    action: "skip" | "merge" | "keep";
+}
+interface ContradictionResult$1 {
+    /** New statement */
+    newStatement: CuratedStatement;
+    /** Conflicting memory ID */
+    conflictingId: string;
+    /** The conflicting content */
+    conflictingContent: string;
+    /** Severity */
+    severity: "high" | "medium" | "low";
+}
+declare function curate(options: CurateOptions): Promise<CurateResult>;
+
 /**
- * Minimal Drive client surface. Tests provide a fake; production wraps
- * `googleapis` to fit. Method shapes mirror the upstream API where it
- * matters (`startPageToken` / `nextPageToken` / `newStartPageToken`,
- * `files.modifiedTime` ISO 8601 strings).
+ * @remnic/core — Dedup & Contradiction Detection
+ *
+ * Statement-level deduplication and contradiction detection
+ * against existing memories. Can be used standalone or via curation.
  */
-interface GoogleDriveClient {
-    /** Mirrors `drive.changes.getStartPageToken()`. */
-    getStartPageToken(): Promise<{
-        startPageToken: string;
-    }>;
-    /**
-     * Mirrors `drive.changes.list(...)`. We page until the response yields a
-     * `newStartPageToken` (i.e., no more pages). Each `change.file`, when
-     * present, includes the metadata we need to decide whether to ingest.
-     */
-    listChanges(args: {
-        pageToken: string;
-        pageSize: number;
-    }): Promise<DriveChangesPage>;
-    /**
-     * Export a Google-native doc to plaintext. Returns the body as a string.
-     */
-    exportFile(args: {
-        fileId: string;
-        mimeType: string;
-    }): Promise<string>;
-    /**
-     * Download a non-Google-native file as a string. Used for `text/*` MIME
-     * types; binary formats are filtered out before we get here.
-     */
-    getFileMedia(args: {
-        fileId: string;
-    }): Promise<string>;
+interface MemoryEntry {
+    /** Memory ID */
+    id: string;
+    /** Content text */
+    content: string;
+    /** Category */
+    category: string;
+    /** File path (if known) */
+    filePath?: string;
+}
+interface DedupOptions {
+    /** Memory root directory */
+    memoryDir: string;
+    /** Categories to scan (default: all) */
+    categories?: string[];
+    /** Similarity threshold for fuzzy matching (0-1, default: 0.85) */
+    threshold?: number;
+    /** Max memories to load (default: 10000) */
+    maxLoad?: number;
+}
+interface DedupResult {
+    /** Total memories scanned */
+    scanned: number;
+    /** Duplicate pairs found */
+    duplicates: DuplicatePair[];
+    /** Duration in ms */
+    durationMs: number;
+}
+interface DuplicatePair {
+    /** First memory */
+    left: MemoryEntry;
+    /** Second memory */
+    right: MemoryEntry;
+    /** Similarity score */
+    similarity: number;
+    /** Recommended action */
+    action: "merge" | "keep_left" | "keep_right";
+}
+interface ContradictionOptions {
+    /** Memory root directory */
+    memoryDir: string;
+    /** Categories to scan (default: all) */
+    categories?: string[];
+    /** Max memories to load (default: 10000) */
+    maxLoad?: number;
+}
+interface ContradictionResult {
+    /** Total memories scanned */
+    scanned: number;
+    /** Contradictions found */
+    contradictions: ContradictionPair[];
+    /** Duration in ms */
+    durationMs: number;
+}
+interface ContradictionPair {
+    /** First statement */
+    left: MemoryEntry;
+    /** Contradicting statement */
+    right: MemoryEntry;
+    /** Severity */
+    severity: "high" | "medium" | "low";
+    /** Reason */
+    reason: string;
+}
+declare function findDuplicates(options: DedupOptions): DedupResult;
+declare function findContradictions(options: ContradictionOptions): ContradictionResult;
+
+/**
+ * @remnic/core — Review Inbox
+ *
+ * Manages low-confidence memories and suggestions pending review.
+ * Integrates with the existing review-queue system.
+ */
+interface ReviewItem {
+    /** Memory ID */
+    id: string;
+    /** Content text */
+    content: string;
+    /** Category */
+    category: string;
+    /** Confidence score (0-1) */
+    confidence: number;
+    /** Confidence tier */
+    confidenceTier: string;
+    /** Source */
+    source: string;
+    /** File path if available */
+    filePath?: string;
+    /** Created date */
+    created: string;
+    /** Reason it's in review */
+    reviewReason: "low_confidence" | "suggestion" | "contradiction" | "duplicate" | "tombstone_blocked";
+    /** Additional context */
+    context?: string;
+}
+type ReviewAction = "approve" | "dismiss" | "flag";
+interface ReviewResult {
+    /** Item acted upon */
+    itemId: string;
+    /** Action taken */
+    action: ReviewAction;
+    /** Updated file path (if modified) */
+    updatedPath?: string;
+    /** Status message */
+    message: string;
+    /** Tombstone id cleared by an approve action (for the caller to revoke). */
+    clearedTombstoneId?: string;
 }
-interface DriveChangesPage {
-    readonly changes: readonly DriveChange[];
-    readonly newStartPageToken?: string;
-    readonly nextPageToken?: string;
+interface ReviewListResult {
+    /** Items pending review */
+    items: ReviewItem[];
+    /** Total count */
+    total: number;
+    /** Duration in ms */
+    durationMs: number;
 }
-interface DriveChange {
-    readonly removed?: boolean;
-    readonly fileId?: string;
-    readonly file?: DriveFileMetadata;
+interface ReviewOptions {
+    /** Memory root directory */
+    memoryDir: string;
+    /** Filter by reason */
+    reason?: ReviewItem["reviewReason"];
+    /** Max items to return (default: 50) */
+    limit?: number;
+    /** Include items with confidence below this threshold (default: 0.7) */
+    confidenceThreshold?: number;
 }
-interface DriveFileMetadata {
-    readonly id: string;
-    readonly name?: string;
-    readonly mimeType?: string;
-    readonly modifiedTime?: string;
-    readonly trashed?: boolean;
-    readonly parents?: readonly string[];
-    readonly webViewLink?: string;
-    readonly size?: string | number;
+interface ReviewActionOptions {
+    /** Match the threshold used when listing review items (default: 0.7) */
+    confidenceThreshold?: number;
+    /**
+     * Revocation hook (issue #1579). When approving a memory whose frontmatter
+     * carries `blockedBy: <tombstoneId>`, the hook fires so the caller (CLI /
+     * orchestrator) can append a `kind: "revocation"` tombstone entry —
+     * re-allowing the content. Fire-and-forget: a revocation failure MUST NOT
+     * fail the approval (gotcha #13). The hook receives the tombstone id and
+     * the memory id.
+     */
+    onApproveBlockedMemory?: (tombstoneId: string, memoryId: string) => void | Promise<void>;
 }
 /**
- * Result of a single sync pass — exposed for richer test assertions.
- * Strict superset of `SyncIncrementalResult`.
+ * List items pending review.
  */
-interface GoogleDriveSyncResult extends SyncIncrementalResult {
-    readonly skippedBinary: number;
-    readonly skippedFolderScope: number;
-    readonly skippedTooLarge: number;
-}
+declare function listReviewItems(options: ReviewOptions): ReviewListResult;
 /**
- * Validate and normalise raw config. Throws with a concrete message on any
- * malformed input — never silently defaults (CLAUDE.md gotcha #51).
+ * Perform a review action on an item.
  */
-declare function validateGoogleDriveConfig(raw: unknown): GoogleDriveConnectorConfig;
+declare function performReview(memoryDir: string, itemId: string, action: ReviewAction, options?: ReviewActionOptions): ReviewResult;
+
 /**
- * Construct the connector. The `clientFactory` argument is the test hook —
- * production callers omit it and the connector lazy-loads `googleapis`.
+ * @remnic/core — Diff-Aware Sync
+ *
+ * Watches source files for changes and triggers re-ingestion
+ * only for changed content. Uses file hashing to detect changes.
  */
-declare function createGoogleDriveConnector(options?: {
-    clientFactory?: GoogleDriveClientFactory;
-}): LiveConnector;
+interface SyncOptions {
+    /** Source directory to watch */
+    sourceDir: string;
+    /** Memory root directory */
+    memoryDir: string;
+    /** State file path (stores hashes). Default: memoryDir/.sync-state.json */
+    stateFile?: string;
+    /** File extensions to watch (default: .md, .txt, .mdx) */
+    extensions?: string[];
+    /** Directories to exclude */
+    excludeDirs?: string[];
+    /** Poll interval for watchForChanges. Default: 5000ms */
+    pollIntervalMs?: number;
+    /** Whether to actually write changes (default: true) */
+    dryRun?: boolean;
+}
+interface SyncResult {
+    /** Files scanned */
+    scanned: number;
+    /** Files changed since last sync */
+    changed: FileChange[];
+    /** Files unchanged */
+    unchanged: number;
+    /** Files deleted since last sync */
+    deleted: string[];
+    /** Files newly added */
+    added: string[];
+    /** Duration in ms */
+    durationMs: number;
+    /** State file path */
+    stateFile: string;
+}
+interface FileChange {
+    /** Absolute file path */
+    filePath: string;
+    /** Relative path from source root */
+    relativePath: string;
+    /** Change type */
+    type: "added" | "modified" | "deleted";
+    /** Current content hash */
+    currentHash: string;
+    /** Previous content hash (if modified) */
+    previousHash?: string;
+    /** File size in bytes */
+    size: number;
+}
+interface SyncState {
+    /** Map of relative path → content hash */
+    fileHashes: Record<string, string>;
+    /** Last sync timestamp */
+    lastSyncAt: string;
+    /** Version of state format */
+    version: number;
+}
+declare function syncChanges(options: SyncOptions): SyncResult;
 /**
- * Production client factory. Lazy-loads `googleapis` via a computed-specifier
- * dynamic import so bundlers never statically resolve it (CLAUDE.md gotcha
- * #57). Surfaces a precise install hint on miss.
- *
- * Exported only for the `index.ts` barrel; consumers that already inject a
- * test factory don't need to touch this.
+ * Watch for changes and call callback on file changes.
+ * Returns a stop function.
  */
-declare const defaultGoogleDriveClientFactory: GoogleDriveClientFactory;
+declare function watchForChanges(options: SyncOptions, onChange: (changes: FileChange[]) => void | Promise<void>): {
+    stop: () => void;
+};
 
 /**
- * @remnic/core — Notion live connector (issue #683 PR 3/N)
- *
- * Concrete `LiveConnector` implementation that incrementally imports text
- * content from Notion database pages into Remnic. Built on top of the
- * framework shipped in PR 1/N (`framework.ts` / `registry.ts` /
- * `state-store.ts`) and mirrors the structure of the Google Drive connector
- * (PR 2/N).
- *
- * Design notes:
- *
- *   - **Auth.** Integration token from config (`connectors.notion.token`).
- *     The token is accepted at config-parse time but never logged. Operators
- *     must populate it from a secret store; per the repo-wide privacy policy
- *     no real value may appear in tests or comments.
- *
- *   - **Scope.** `databaseIds` in config limits the import to the listed
- *     Notion databases. The connector queries each database for pages whose
- *     `last_edited_time` is after a per-page high-water mark stored in the
- *     cursor. When `databaseIds` is empty the connector does nothing (safe
- *     default — no credentials → no import).
- *
- *   - **Cursor semantics.** The cursor is a JSON string encoding a
- *     `NotionCursorPayload`: a map from page-id to last-seen
- *     `last_edited_time` ISO string. On the first sync (cursor=null) we
- *     seed the payload from the current state of each database WITHOUT
- *     importing any content, so "first install" doesn't re-ingest history.
- *     Each subsequent pass only imports pages edited after the stored
- *     watermark.
- *
- *   - **Block extraction.** Page content is fetched via
- *     `blocks.children.list` recursively up to `MAX_BLOCK_DEPTH` levels.
- *     Block text is extracted to Markdown-ish plain text (no raw JSON blobs).
- *     Only text-bearing block types are included; unsupported types are
- *     silently skipped.
- *
- *   - **Raw `fetch`.** We call the Notion REST API directly rather than using
- *     `@notionhq/client` — there is no optional-peer-dep machinery needed and
- *     the API surface we consume is tiny. The `fetchFn` argument is the test
- *     hook allowing stubbing without network access.
- *
- *   - **Idempotency.** `ConnectorDocument.source.externalId` is the page id
- *     and `externalRevision` is `last_edited_time`, so downstream dedup can
- *     recognise repeat fetches if the cursor is rewound.
- *
- *   - **Privacy.** No page content is ever logged. Database ids and counts
- *     may be logged. The integration token is never exposed in logs, state,
- *     or error messages.
+ * memory-extension-host/render-extensions-block.ts — Render discovered extensions
+ * into a markdown block for injection into consolidation prompts.
  *
- *   - **Read-only.** This connector only reads. It never modifies pages,
- *     databases, or any other Notion resource.
+ * Respects the global token budget (REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT) and
+ * truncates with a footer listing omitted extensions when over budget.
  */
 
-/** Stable connector id. Lives in the registry under this exact string. */
-declare const NOTION_CONNECTOR_ID = "notion";
-/**
- * Cursor `kind` we emit. Opaque to the framework; documented here so
- * tests can assert on it.
- */
-declare const NOTION_CURSOR_KIND = "notionWatermark";
-/**
- * Default poll interval (5 minutes). Notion's API has no push capability;
- * polling sub-minute wastes quota for a personal memory layer.
- */
-declare const NOTION_DEFAULT_POLL_INTERVAL_MS: number;
-/**
- * Validated, frozen view of `connectors.notion.*`.
- */
-interface NotionConnectorConfig {
-    /** Notion integration token. Starts with `secret_`. */
-    readonly token: string;
-    /** Database ids to import pages from. Empty = connector is a no-op. */
-    readonly databaseIds: readonly string[];
-    /** Poll interval surfaced to the scheduler (ms). */
-    readonly pollIntervalMs: number;
-}
 /**
- * Minimal fetch-compatible surface we use. The real connector delegates to
- * the global `fetch`; tests inject a stub factory.
- */
-type NotionFetchFn = (url: string, init: {
-    method: string;
-    headers: Record<string, string>;
-    body?: string;
-    signal?: AbortSignal;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    json(): Promise<unknown>;
-}>;
-/**
- * Validate and normalise raw config. Throws with a concrete message on any
- * malformed input — never silently defaults (CLAUDE.md gotcha #51).
+ * Render a markdown block containing extension instructions for injection
+ * into consolidation prompts.
+ *
+ * If the list is empty, returns "".
+ * Inlines extensions in name order until the token budget is exhausted.
+ * If the budget is exceeded, appends a truncation footer listing omitted extensions.
  */
-declare function validateNotionConfig(raw: unknown): NotionConnectorConfig;
+declare function renderExtensionsBlock(extensions: DiscoveredExtension[]): string;
 /**
- * Construct the connector. The `fetchFn` argument is the test hook —
- * production callers omit it and the connector uses the global `fetch`.
+ * Render a compact one-line footer listing active extension names.
+ * Used by day-summary and summary-snapshot where full instructions are not needed.
  */
-declare function createNotionConnector(options?: {
-    fetchFn?: NotionFetchFn;
-}): LiveConnector;
+declare function renderExtensionsFooter(extensions: DiscoveredExtension[]): string;
 
 /**
  * @remnic/core — Spaces + Collaboration