@remnic/core 9.3.752 → 9.3.753

package/dist/{chunk-VX2RYM2K.js → chunk-ZECLLIMX.js}

@@ -56,10 +56,10 @@ import {
   resolveScopeProfilePlan,
   resolveWritableNamespaceValue,
   sanitizeFragment
-} from "./chunk-GECEETQ3.js";
+} from "./chunk-W3M34XT4.js";
 import {
   namespaceCollectionName
-} from "./chunk-5DXUE7GB.js";
+} from "./chunk-HAZVVOYT.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
@@ -70,7 +70,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-JHZ3LEM7.js";
+} from "./chunk-YNBEHUZH.js";
 import {
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
@@ -91,7 +91,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-XKAOT4ZB.js";
+} from "./chunk-K5LLP4CY.js";
 import {
   CrossNamespaceBudget
 } from "./chunk-ODPLEWB6.js";
@@ -102,29 +102,57 @@ import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
 } from "./chunk-V5UV7BOA.js";
+import {
+  canReadNamespace,
+  canWriteNamespace,
+  defaultNamespaceForPrincipal,
+  recallNamespacesForPrincipal,
+  resolvePrincipal
+} from "./chunk-PE6XR4GG.js";
+import {
+  resolveAccessSetupCapabilities,
+  resolveCompressionCapabilities,
+  resolveConsolidationCapabilities,
+  resolveGraphConstructionCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveIndexingCapabilities,
+  resolveMemoryLifecycleCapabilities,
+  resolveNamespaceCapabilities,
+  resolveObjectiveStateCapabilities,
+  resolveQmdCapabilities,
+  resolveRecallAuxiliaryCapabilities,
+  resolveRecallEnhancementCapabilities,
+  resolveSecurityCapabilities
+} from "./chunk-VSF7AAGE.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-MTN2G4DT.js";
+} from "./chunk-E6LENGYV.js";
 import {
   parseEntityFile
-} from "./chunk-YGNQG4Q6.js";
+} from "./chunk-34THARMH.js";
+import {
+  supersessionKeysForFact
+} from "./chunk-TKZ3AL5V.js";
 import {
   stripAttributesSuffix
 } from "./chunk-SVOZFLIQ.js";
 import {
   serializeMutations
 } from "./chunk-LTJAMRGI.js";
-import {
-  supersessionKeysForFact
-} from "./chunk-TKZ3AL5V.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
 } from "./chunk-JS2HKKOK.js";
+import {
+  getMemoryProjectionPath
+} from "./chunk-MB5RSUW6.js";
+import {
+  displayErrorDetail
+} from "./chunk-6KYMPV2O.js";
 import {
   inferMemoryStatus,
   toMemoryPathRel
@@ -133,12 +161,6 @@ import {
   normalizeProjectionPreview,
   normalizeProjectionTags
 } from "./chunk-SCU65EZI.js";
-import {
-  getMemoryProjectionPath
-} from "./chunk-MB5RSUW6.js";
-import {
-  displayErrorDetail
-} from "./chunk-6KYMPV2O.js";
 import {
   createVersion
 } from "./chunk-VF4XKTX3.js";
@@ -151,12 +173,15 @@ import {
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
+import {
+  isHandleToken
+} from "./chunk-JAKIDQB2.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
 import {
   exportCapsule
-} from "./chunk-FLVL4L3L.js";
+} from "./chunk-OUXPVWTZ.js";
 import {
   OFFLINE_SYNC_SNAPSHOT_FORMAT,
   applyOfflineSyncChangeset,
@@ -174,31 +199,6 @@ import {
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
-import {
-  canReadNamespace,
-  canWriteNamespace,
-  defaultNamespaceForPrincipal,
-  recallNamespacesForPrincipal,
-  resolvePrincipal
-} from "./chunk-PE6XR4GG.js";
-import {
-  resolveAccessSetupCapabilities,
-  resolveCompressionCapabilities,
-  resolveConsolidationCapabilities,
-  resolveGraphConstructionCapabilities,
-  resolveIdentityContinuityCapabilities,
-  resolveIndexingCapabilities,
-  resolveMemoryLifecycleCapabilities,
-  resolveNamespaceCapabilities,
-  resolveObjectiveStateCapabilities,
-  resolveQmdCapabilities,
-  resolveRecallAuxiliaryCapabilities,
-  resolveRecallEnhancementCapabilities,
-  resolveSecurityCapabilities
-} from "./chunk-VSF7AAGE.js";
-import {
-  isHandleToken
-} from "./chunk-JAKIDQB2.js";
 import {
   AccessAuditAdapter
 } from "./chunk-TVVEYCNW.js";
@@ -209,11 +209,11 @@ import {
 
 // src/access-recall-surface.ts
 import { createHash as createHash5 } from "crypto";
-import * as nodePath2 from "path";
+import * as nodePath3 from "path";
 
 // src/access-service.ts
 import { stat as stat2 } from "fs/promises";
-import * as nodeFs from "fs/promises";
+import * as nodeFs2 from "fs/promises";
 import { constants as fsConstants } from "fs";
 import { readdirSync, unlinkSync } from "fs";
 import { createHash as createHash4 } from "crypto";
@@ -1193,12 +1193,12 @@ async function findArchitectureCardMemory(storage) {
   });
   return cards[0] ?? null;
 }
-function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile5, writeVersion) {
+function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile6, writeVersion) {
   return {
     async snapshotIfExists(memory) {
       if (!enabled) return;
       try {
-        const fullContent = await readFile5(memory.path);
+        const fullContent = await readFile6(memory.path);
         await writeVersion(
           memory.path,
           fullContent,
@@ -4055,7 +4055,7 @@ function isErrnoCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function acquireClusterWriteLock(memoryDir, clusterHash) {
   const lockRoot = path6.join(path6.resolve(memoryDir), "state", "procedure-miner-locks");
@@ -4094,8 +4094,8 @@ async function withClusterWriteLock(memoryDir, clusterHash, fn) {
   const previous = inProcessClusterWriteLocks.get(inProcessKey) ?? Promise.resolve();
   let releaseInProcess;
   const current = previous.catch(() => void 0).then(
-    () => new Promise((resolve3) => {
-      releaseInProcess = resolve3;
+    () => new Promise((resolve4) => {
+      releaseInProcess = resolve4;
     })
   );
   inProcessClusterWriteLocks.set(inProcessKey, current);
@@ -4750,78 +4750,662 @@ async function promoteMemory(options) {
 }
 
 // src/access-service.ts
-import * as nodePath from "path";
-
-// src/orchestration/self-deps.ts
-function selfDeps(self) {
-  const source = self;
-  return new Proxy(/* @__PURE__ */ Object.create(null), {
-    get(_target, prop) {
-      const value = source[prop];
-      return typeof value === "function" ? value.bind(self) : value;
-    },
-    set(_target, prop, value) {
-      if (!(prop in source)) return false;
-      source[prop] = value;
-      return true;
-    },
-    has(_target, prop) {
-      return prop in source;
-    }
-  });
-}
+import * as nodePath2 from "path";
 
-// src/access-service.ts
-var EngramAccessInputError = class extends Error {
-};
-var cachedPackageVersion = null;
-async function getPackageVersion() {
-  if (cachedPackageVersion !== null) return cachedPackageVersion;
-  try {
-    const raw = await nodeFs.readFile(new URL("../package.json", import.meta.url), "utf-8");
-    const parsed = JSON.parse(raw);
-    cachedPackageVersion = typeof parsed.version === "string" && parsed.version.length > 0 ? parsed.version : "unknown";
-  } catch {
-    cachedPackageVersion = "unknown";
+// src/access-admin-ops-surface.ts
+import * as nodeFs from "fs/promises";
+import * as nodePath from "path";
+var AccessAdminOpsSurface = class {
+  constructor(deps) {
+    this.deps = deps;
   }
-  return cachedPackageVersion;
-}
-function normalizeTrustZoneInputError(error) {
-  const message = error instanceof Error ? error.message : null;
-  if (!message) {
-    return null;
+  deps;
+  async reviewQueue(runId, namespace, principal) {
+    const resolvedNamespace = this.deps.resolveReadableNamespace(namespace, principal);
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const projected = await storage.getProjectedGovernanceRecord();
+    if (projected && (!runId || projected.runId === runId.trim())) {
+      const projectedAppliedActions = projected.appliedActionRows.map((row) => ({
+        action: row.action,
+        memoryId: row.memoryId,
+        reasonCode: row.reasonCode,
+        beforeStatus: row.beforeStatus,
+        afterStatus: row.afterStatus,
+        originalPath: row.originalPath,
+        currentPath: row.currentPath
+      }));
+      const projectedProposedActions = await buildProjectedGovernanceProposedActions(storage, projected);
+      const projectedArtifact = await (async () => {
+        try {
+          return await readMemoryGovernanceRunArtifact(storage.dir, projected.runId);
+        } catch {
+          return null;
+        }
+      })();
+      const metrics = projected.metrics;
+      const fallbackTransitionReport = {
+        proposed: groupActionsByStatus(projectedProposedActions),
+        applied: groupActionsByStatus(projectedAppliedActions)
+      };
+      const transitionReport = projectedArtifact?.transitionReport ? {
+        proposed: hasGroupedGovernanceActions(projectedArtifact.transitionReport.proposed) || projectedProposedActions.length === 0 ? projectedArtifact.transitionReport.proposed : fallbackTransitionReport.proposed,
+        applied: hasGroupedGovernanceActions(projectedArtifact.transitionReport.applied) || projectedAppliedActions.length === 0 ? projectedArtifact.transitionReport.applied : fallbackTransitionReport.applied
+      } : fallbackTransitionReport;
+      const qualityScore = projectedArtifact?.qualityScore ?? metrics?.qualityScore ?? buildQualityScore(metrics?.reviewReasons ?? {
+        exact_duplicate: 0,
+        semantic_duplicate_candidate: 0,
+        disputed_memory: 0,
+        speculative_low_confidence: 0,
+        archive_candidate: 0,
+        explicit_capture_review: 0,
+        malformed_import: 0
+      });
+      const effectiveMetrics = metrics ? { ...metrics, qualityScore: metrics.qualityScore ?? qualityScore } : metrics;
+      return {
+        found: true,
+        namespace: resolvedNamespace,
+        runId: projected.runId,
+        summary: projected.summary,
+        metrics: effectiveMetrics,
+        qualityScore,
+        reviewQueue: projected.reviewQueueRows.map((row) => ({
+          entryId: row.entryId,
+          memoryId: row.memoryId,
+          path: row.path,
+          reasonCode: row.reasonCode,
+          severity: row.severity,
+          suggestedAction: row.suggestedAction,
+          suggestedStatus: row.suggestedStatus,
+          relatedMemoryIds: row.relatedMemoryIds
+        })),
+        appliedActions: projectedAppliedActions,
+        transitionReport,
+        report: projected.report
+      };
+    }
+    const resolvedRunId = runId?.trim() || (await listMemoryGovernanceRuns(storage.dir))[0];
+    if (!resolvedRunId) return { found: false, namespace: resolvedNamespace };
+    const artifact = await readMemoryGovernanceRunArtifact(storage.dir, resolvedRunId);
+    return {
+      found: true,
+      namespace: resolvedNamespace,
+      runId: resolvedRunId,
+      summary: artifact.summary,
+      metrics: artifact.metrics,
+      qualityScore: artifact.qualityScore,
+      reviewQueue: artifact.reviewQueue,
+      appliedActions: artifact.appliedActions,
+      transitionReport: artifact.transitionReport,
+      report: artifact.report
+    };
   }
-  if (/^sourceRecordId must /.test(message) || /^promotionReason must /.test(message) || /^recordedAt must /.test(message) || /^trust zone promotion requires /.test(message) || /^source trust-zone record not found: /.test(message) || /^trust-zone promotion denied: /.test(message) || /^trust zone demo seed requires /.test(message) || /^unsupported trust-zone demo scenario: /.test(message)) {
-    return new EngramAccessInputError(message);
+  async governanceRun(request, principal) {
+    const deepSleep = this.deps.orchestrator.config.dreamsPhases.deepSleep;
+    if (deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
+      throw new Error("memory governance is disabled by dreams.phases.deepSleep.enabled=false");
+    }
+    const resolvedNamespace = this.deps.writableNamespaceFor(
+      request.namespace,
+      void 0,
+      request.authenticatedPrincipal ?? principal
+    );
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const mode = request.mode === "apply" ? "apply" : "shadow";
+    const boundedBatchSize = typeof request.batchSize === "number" && Number.isFinite(request.batchSize) ? Math.max(1, Math.floor(request.batchSize)) : void 0;
+    const result = await runMemoryGovernance({
+      memoryDir: storage.dir,
+      mode,
+      recentDays: typeof request.recentDays === "number" && Number.isFinite(request.recentDays) ? Math.max(1, Math.floor(request.recentDays)) : void 0,
+      maxMemories: typeof request.maxMemories === "number" && Number.isFinite(request.maxMemories) ? Math.max(1, Math.floor(request.maxMemories)) : void 0,
+      batchSize: boundedBatchSize
+    });
+    if (mode === "apply") {
+      try {
+        await this.deps.orchestrator.processEntitySynthesisQueue(
+          resolvedNamespace,
+          Math.min(boundedBatchSize ?? 5, 5)
+        );
+      } catch (error) {
+        log.debug(`governanceRun: entity synthesis refresh failed after governance apply: ${error}`);
+      }
+    }
+    return {
+      namespace: resolvedNamespace,
+      runId: result.runId,
+      traceId: result.traceId,
+      mode: result.mode,
+      reviewQueueCount: result.reviewQueue.length,
+      proposedActionCount: result.proposedActions.length,
+      appliedActionCount: result.appliedActions.length,
+      summaryPath: result.summaryPath,
+      reportPath: result.reportPath
+    };
   }
-  return null;
-}
-var ENGRAM_ACCESS_WRITE_SCHEMA_VERSION = 1;
-async function buildProjectedGovernanceProposedActions(storage, projected) {
-  const reviewQueue = projected.reviewQueueRows.map((row) => ({
-    entryId: row.entryId,
-    memoryId: row.memoryId,
-    path: row.path,
-    reasonCode: row.reasonCode,
-    severity: row.severity,
-    suggestedAction: row.suggestedAction,
-    suggestedStatus: row.suggestedStatus,
-    relatedMemoryIds: row.relatedMemoryIds
-  }));
-  const memories = (await Promise.all(projected.reviewQueueRows.map((row) => storage.getMemoryById(row.memoryId)))).filter((memory) => Boolean(memory));
-  return buildProposedActions(reviewQueue, memories);
-}
-function hasGroupedGovernanceActions(grouped) {
-  if (!grouped) return false;
-  return Object.values(grouped).some((actions) => Array.isArray(actions) && actions.length > 0);
-}
-function normalizePagination(limit, offset) {
-  const normalizedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(200, Math.floor(limit ?? 50))) : 50;
-  const normalizedOffset = Number.isFinite(offset) ? Math.max(0, Math.floor(offset ?? 0)) : 0;
-  return { limit: normalizedLimit, offset: normalizedOffset };
-}
-function normalizeBrowseSort(sort) {
-  switch (sort) {
+  async conversationIndexUpdate(request = {}) {
+    if (!resolveIndexingCapabilities(this.deps.orchestrator.config).conversationIndex) {
+      return {
+        enabled: false,
+        sessions: 0,
+        chunks: 0,
+        skipped: 0,
+        skippedSessionKeys: [],
+        embeddedRuns: 0,
+        reason: "disabled"
+      };
+    }
+    const hours = typeof request.hours === "number" && Number.isFinite(request.hours) ? Math.max(1, Math.floor(request.hours)) : 24;
+    let sessionKey;
+    if (request.sessionKey !== void 0) {
+      if (typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
+        throw new EngramAccessInputError("sessionKey must be a non-empty string when provided");
+      }
+      sessionKey = request.sessionKey.trim();
+    }
+    if (sessionKey) {
+      const result = await this.deps.orchestrator.updateConversationIndex(
+        sessionKey,
+        hours,
+        { embed: request.embed }
+      );
+      return {
+        enabled: true,
+        sessionKey,
+        sessions: 1,
+        chunks: result.chunks,
+        skipped: result.skipped ? 1 : 0,
+        skippedSessionKeys: result.skipped ? [sessionKey] : [],
+        embeddedRuns: result.embedded ? 1 : 0,
+        reason: result.reason,
+        retryAfterMs: result.retryAfterMs
+      };
+    }
+    const sessionKeys = await this.deps.orchestrator.transcript.listSessionKeys();
+    let chunks = 0;
+    let skipped = 0;
+    const skippedSessionKeys = [];
+    let embeddedRuns = 0;
+    for (const sessionKey2 of sessionKeys) {
+      const result = await this.deps.orchestrator.updateConversationIndex(
+        sessionKey2,
+        hours,
+        { embed: request.embed }
+      );
+      chunks += result.chunks;
+      if (result.skipped) {
+        skipped += 1;
+        skippedSessionKeys.push(sessionKey2);
+      }
+      if (result.embedded) {
+        embeddedRuns += 1;
+      }
+    }
+    return {
+      enabled: true,
+      sessions: sessionKeys.length,
+      chunks,
+      skipped,
+      skippedSessionKeys,
+      embeddedRuns
+    };
+  }
+  async profilingReport(request = {}) {
+    const profiler = this.deps.orchestrator.profiler;
+    if (!profiler.isEnabled) {
+      return {
+        enabled: false,
+        reason: "disabled",
+        message: "Profiling is disabled. Set profilingEnabled: true in your plugin config to enable."
+      };
+    }
+    const format = request.format ?? "ascii";
+    if (format !== "ascii" && format !== "json") {
+      throw new EngramAccessInputError("format must be one of: ascii, json");
+    }
+    const limit = request.limit ?? 5;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 20) {
+      throw new EngramAccessInputError("limit must be an integer between 1 and 20");
+    }
+    const traces = profiler.getRecentTraces(limit);
+    const stats = profiler.getStats();
+    const bottleneck = profiler.identifyBottleneck();
+    if (format === "json") {
+      return {
+        enabled: true,
+        format,
+        traces,
+        stats,
+        bottleneck
+      };
+    }
+    const lines = [];
+    lines.push("Engram Profiling Report");
+    lines.push("=".repeat(60));
+    lines.push("");
+    const allBuckets = [
+      ["byKind", stats.byKind],
+      ["bySpan", stats.bySpan]
+    ];
+    const hasStats = allBuckets.some(([, entries]) => Object.keys(entries).length > 0);
+    if (hasStats) {
+      lines.push("Aggregate Stats (all retained traces):");
+      for (const [bucket, entries] of allBuckets) {
+        for (const [key, summary] of Object.entries(entries)) {
+          lines.push(
+            `  ${bucket}/${key}: avg=${summary.avgMs}ms p50=${summary.p50Ms}ms p95=${summary.p95Ms}ms max=${summary.maxMs}ms (n=${summary.count})`
+          );
+        }
+      }
+      lines.push("");
+    }
+    if (bottleneck) {
+      lines.push(`Bottleneck: ${bottleneck}`);
+      lines.push("");
+    }
+    if (traces.length === 0) {
+      lines.push("No traces recorded yet. Trigger a recall or extraction to see timing data.");
+    } else {
+      for (const trace of traces) {
+        lines.push(formatProfileTraceAscii(trace));
+        lines.push("");
+      }
+    }
+    return {
+      enabled: true,
+      format,
+      report: lines.join("\n")
+    };
+  }
+  /**
+   * Read-only graph snapshot for the admin pane (issue #691 PR 2/5).
+   *
+   * Reads adjacency from the JSONL edge store written by `GraphIndex` and
+   * resolves node metadata via the namespaced storage manager.  Namespace
+   * resolution mirrors the read-side path used by `recall` /
+   * `procedureStats`, so multi-principal deployments can't leak edges from
+   * a peer namespace (CLAUDE.md rule 42).
+   */
+  async graphSnapshot(request, authenticatedPrincipal) {
+    const namespace = this.deps.resolveReadableNamespace(
+      request.namespace,
+      authenticatedPrincipal
+    );
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    const cfg = this.deps.orchestrator.config;
+    const graphCaps = resolveGraphConstructionCapabilities(cfg);
+    let namespaceRootReal;
+    try {
+      namespaceRootReal = await nodeFs.realpath(storage.dir);
+    } catch {
+      namespaceRootReal = nodePath.resolve(storage.dir);
+    }
+    const namespaceRootWithSep = namespaceRootReal.endsWith(nodePath.sep) ? namespaceRootReal : namespaceRootReal + nodePath.sep;
+    const loadNode = async (relPath) => {
+      if (nodePath.isAbsolute(relPath)) {
+        log.warn(
+          `graphSnapshot: rejected absolute edge endpoint (len=${relPath.length}) outside namespace root`
+        );
+        return null;
+      }
+      const candidate = nodePath.resolve(namespaceRootReal, relPath);
+      if (candidate !== namespaceRootReal && !candidate.startsWith(namespaceRootWithSep)) {
+        log.warn(
+          `graphSnapshot: rejected traversing edge endpoint (len=${relPath.length}) outside namespace root`
+        );
+        return null;
+      }
+      let canonical;
+      try {
+        canonical = await nodeFs.realpath(candidate);
+      } catch {
+        canonical = candidate;
+      }
+      if (canonical !== namespaceRootReal && !canonical.startsWith(namespaceRootWithSep)) {
+        log.warn(
+          `graphSnapshot: rejected symlinked edge endpoint (len=${relPath.length}) that resolved outside namespace root`
+        );
+        return null;
+      }
+      const memory = await storage.readMemoryByPath(canonical);
+      if (!memory) return null;
+      const fm = memory.frontmatter;
+      return {
+        category: fm.category ?? "unknown",
+        label: fm.id ?? nodePath.basename(canonical, nodePath.extname(canonical)),
+        updated: fm.updated
+      };
+    };
+    return buildGraphSnapshot({
+      memoryDir: namespaceRootReal,
+      graphConfig: {
+        entityGraph: graphCaps.entityGraph,
+        timeGraph: graphCaps.timeGraph,
+        causalGraph: graphCaps.causalGraph
+      },
+      request: {
+        limit: request.limit,
+        since: request.since,
+        focusNodeId: request.focusNodeId,
+        categories: request.categories
+      },
+      loadNode
+    });
+  }
+  /**
+   * List capsule archives in the namespace-scoped capsule store.
+   *
+   * MCP uses this access-layer method instead of reading arbitrary paths so
+   * capsule discovery remains bound to the same namespace ACLs as export and
+   * import.
+   */
+  async capsuleList(options) {
+    const resolvedNamespace = this.deps.resolveReadableNamespace(options?.namespace, options?.principal);
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const capsulesDir = defaultCapsulesDir(storage.dir);
+    let dirEntries;
+    try {
+      const capsulesDirStat = await nodeFs.lstat(capsulesDir);
+      if (capsulesDirStat.isSymbolicLink()) {
+        throw new EngramAccessInputError("capsule list failed: capsule store directory must not be a symlink");
+      }
+      if (!capsulesDirStat.isDirectory()) {
+        throw new EngramAccessInputError("capsule list failed: capsule store path must be a directory");
+      }
+      dirEntries = await nodeFs.readdir(capsulesDir, { withFileTypes: true });
+    } catch (err) {
+      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+      if (code === "ENOENT") {
+        return { namespace: resolvedNamespace, capsulesDir, capsules: [] };
+      }
+      throw err;
+    }
+    const archiveNames = dirEntries.filter(
+      (entry) => entry.isFile() && (entry.name.endsWith(".capsule.json.gz") || entry.name.endsWith(".capsule.json.gz.enc"))
+    ).map((entry) => entry.name).sort();
+    const capsules = [];
+    for (const archiveName of archiveNames) {
+      const archivePath = nodePath.join(capsulesDir, archiveName);
+      const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
+      const manifestPath = nodePath.join(capsulesDir, `${id}.manifest.json`);
+      let createdAt = null;
+      let pluginVersion = null;
+      let fileCount = null;
+      let description = null;
+      let manifestPathOrNull = manifestPath;
+      try {
+        const manifestStat = await nodeFs.lstat(manifestPath);
+        if (manifestStat.isSymbolicLink() || !manifestStat.isFile()) {
+          capsules.push({
+            id,
+            archivePath,
+            manifestPath: manifestPathOrNull,
+            createdAt,
+            pluginVersion,
+            fileCount,
+            description
+          });
+          continue;
+        }
+        const raw = await nodeFs.readFile(manifestPath, "utf-8");
+        const sidecar = JSON.parse(raw);
+        createdAt = typeof sidecar.createdAt === "string" ? sidecar.createdAt : null;
+        pluginVersion = typeof sidecar.pluginVersion === "string" ? sidecar.pluginVersion : null;
+        fileCount = Array.isArray(sidecar.files) ? sidecar.files.length : null;
+        const capsule = sidecar.capsule;
+        description = capsule && typeof capsule.description === "string" ? capsule.description : null;
+      } catch (err) {
+        const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+        if (code === "ENOENT") {
+          manifestPathOrNull = null;
+        }
+      }
+      capsules.push({
+        id,
+        archivePath,
+        manifestPath: manifestPathOrNull,
+        createdAt,
+        pluginVersion,
+        fileCount,
+        description
+      });
+    }
+    return { namespace: resolvedNamespace, capsulesDir, capsules };
+  }
+  /**
+   * Manually invoke a single Dreams phase pass (PR 4/4).
+   *
+   * Deep-sleep delegates to memory governance (shadow → dry-run, apply → live).
+   * Light-sleep and REM scan the observation ledger and memory corpus
+   * respectively, returning the same telemetry shape as a scheduled run.
+   */
+  async dreamsRun(options) {
+    const { runDreamsPhase } = await import("./dreams-ledger-6UODQOX6.js");
+    const validPhases = ["lightSleep", "rem", "deepSleep"];
+    if (!validPhases.includes(options.phase)) {
+      throw new EngramAccessInputError(
+        `Invalid phase: ${String(options.phase)}. Must be one of: ${validPhases.join(", ")}`
+      );
+    }
+    const deepSleep = this.deps.orchestrator.config.dreamsPhases.deepSleep;
+    if (options.phase === "deepSleep" && deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
+      throw new EngramAccessInputError(
+        "memory governance is disabled by dreams.phases.deepSleep.enabled=false"
+      );
+    }
+    const dryRun = options.dryRun === true;
+    const resolvedNamespace = this.deps.writableNamespaceFor(
+      options.namespace,
+      void 0,
+      options.authenticatedPrincipal
+    );
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const memoryDir = storage.dir;
+    const phaseRunner = dryRun || options.phase === "deepSleep" ? void 0 : async (_opts) => {
+      if (_opts.phase === "lightSleep") {
+        const result3 = await this.deps.orchestrator.runLifecyclePolicyNow(storage);
+        return {
+          itemsProcessed: result3.memoriesAssessed,
+          notes: `scored ${result3.memoriesAssessed} memories`
+        };
+      }
+      const result2 = await this.deps.orchestrator.runSemanticConsolidationNow({
+        dryRun: false,
+        storage
+      });
+      const itemsProcessed = result2.clusters.reduce(
+        (sum, cluster) => sum + cluster.memories.length,
+        0
+      );
+      return {
+        itemsProcessed,
+        notes: `REM consolidation found ${result2.clustersFound} clusters`
+      };
+    };
+    const governanceRunner = options.phase === "deepSleep" ? async (_opts) => {
+      return this.deps.orchestrator.runDeepSleepGovernanceNow({
+        storage,
+        dryRun: _opts.dryRun
+      });
+    } : void 0;
+    const result = await runDreamsPhase(
+      { memoryDir, phase: options.phase, dryRun },
+      governanceRunner,
+      phaseRunner
+    );
+    return {
+      phase: result.phase,
+      dryRun: result.dryRun,
+      durationMs: result.durationMs,
+      itemsProcessed: result.itemsProcessed,
+      notes: result.notes
+    };
+  }
+  /**
+   * Manually promote a memory into one or more authorized targets. Requires
+   * a non-empty reason (audit-logged). Reuses the scope-profile promotion
+   * resolution and `canWriteNamespace` gate — there is no dashboard-only
+   * write path.
+   */
+  async adminPromoteMemory(request) {
+    const config = this.deps.orchestrator.config;
+    const namespacesEnabled = resolveNamespaceCapabilities(config).namespaces === true;
+    let sourceNamespace;
+    if (request.namespace) {
+      sourceNamespace = this.deps.resolveReadableNamespace(
+        request.namespace,
+        request.principal
+      );
+    } else {
+      const codingContext2 = request.sessionKey ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
+      const plan = resolveScopePlan({
+        config,
+        sessionKey: request.sessionKey,
+        principalOverride: request.principal,
+        codingContext: codingContext2,
+        namespacesEnabled
+      });
+      sourceNamespace = this.deps.resolveReadableNamespace(
+        plan.baseNamespace,
+        request.principal
+      );
+    }
+    const codingContext = request.sessionKey ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
+    const codingOverlay = codingContext ? resolveCodingNamespaceOverlay(
+      codingContext,
+      config.codingMode,
+      config.defaultNamespace
+    ) : null;
+    const scopeProfilePlan = resolveScopeProfilePlan({
+      config,
+      principal: request.principal,
+      codingContext,
+      codingOverlay
+    });
+    const storage = {
+      readMemory: async (namespace, memoryId) => {
+        const resolved = await this.deps.orchestrator.getStorage(namespace);
+        const memory = await resolved.getMemoryById(memoryId);
+        if (!memory) return null;
+        return {
+          category: memory.frontmatter.category,
+          content: memory.content,
+          frontmatter: memory.frontmatter
+        };
+      },
+      writePromotedMemory: async (namespace, memory) => {
+        const resolved = await this.deps.orchestrator.getStorage(namespace);
+        const { id, tombstoneBlocked } = await resolved.writeMemory(
+          memory.category,
+          memory.content,
+          {
+            confidence: memory.confidence,
+            tags: memory.tags,
+            entityRef: memory.entityRef,
+            source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}`,
+            lineage: memory.lineage,
+            sourceMemoryId: memory.sourceMemoryId,
+            actor: memory.actor,
+            validAt: memory.validAt
+          }
+        );
+        if (tombstoneBlocked) {
+          throw new Error(
+            "target namespace tombstone-blocked the promoted content (pending_review)"
+          );
+        }
+        return id;
+      }
+    };
+    try {
+      return await promoteMemory({
+        config,
+        sourceMemoryId: request.sourceMemoryId,
+        sourceNamespace,
+        principal: request.principal,
+        targets: request.targets,
+        reason: request.reason,
+        actor: request.principal ?? "admin-console",
+        storage,
+        scopeProfilePlan
+      });
+    } catch (err) {
+      if (err instanceof AdminPromotionError) {
+        throw new EngramAccessInputError(err.message);
+      }
+      throw err;
+    }
+  }
+};
+
+// src/orchestration/self-deps.ts
+function selfDeps(self) {
+  const source = self;
+  return new Proxy(/* @__PURE__ */ Object.create(null), {
+    get(_target, prop) {
+      const value = source[prop];
+      return typeof value === "function" ? value.bind(self) : value;
+    },
+    set(_target, prop, value) {
+      if (!(prop in source)) return false;
+      source[prop] = value;
+      return true;
+    },
+    has(_target, prop) {
+      return prop in source;
+    }
+  });
+}
+
+// src/access-service.ts
+var EngramAccessInputError = class extends Error {
+};
+var cachedPackageVersion = null;
+async function getPackageVersion() {
+  if (cachedPackageVersion !== null) return cachedPackageVersion;
+  try {
+    const raw = await nodeFs2.readFile(new URL("../package.json", import.meta.url), "utf-8");
+    const parsed = JSON.parse(raw);
+    cachedPackageVersion = typeof parsed.version === "string" && parsed.version.length > 0 ? parsed.version : "unknown";
+  } catch {
+    cachedPackageVersion = "unknown";
+  }
+  return cachedPackageVersion;
+}
+function normalizeTrustZoneInputError(error) {
+  const message = error instanceof Error ? error.message : null;
+  if (!message) {
+    return null;
+  }
+  if (/^sourceRecordId must /.test(message) || /^promotionReason must /.test(message) || /^recordedAt must /.test(message) || /^trust zone promotion requires /.test(message) || /^source trust-zone record not found: /.test(message) || /^trust-zone promotion denied: /.test(message) || /^trust zone demo seed requires /.test(message) || /^unsupported trust-zone demo scenario: /.test(message)) {
+    return new EngramAccessInputError(message);
+  }
+  return null;
+}
+var ENGRAM_ACCESS_WRITE_SCHEMA_VERSION = 1;
+async function buildProjectedGovernanceProposedActions(storage, projected) {
+  const reviewQueue = projected.reviewQueueRows.map((row) => ({
+    entryId: row.entryId,
+    memoryId: row.memoryId,
+    path: row.path,
+    reasonCode: row.reasonCode,
+    severity: row.severity,
+    suggestedAction: row.suggestedAction,
+    suggestedStatus: row.suggestedStatus,
+    relatedMemoryIds: row.relatedMemoryIds
+  }));
+  const memories = (await Promise.all(projected.reviewQueueRows.map((row) => storage.getMemoryById(row.memoryId)))).filter((memory) => Boolean(memory));
+  return buildProposedActions(reviewQueue, memories);
+}
+function hasGroupedGovernanceActions(grouped) {
+  if (!grouped) return false;
+  return Object.values(grouped).some((actions) => Array.isArray(actions) && actions.length > 0);
+}
+function normalizePagination(limit, offset) {
+  const normalizedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(200, Math.floor(limit ?? 50))) : 50;
+  const normalizedOffset = Number.isFinite(offset) ? Math.max(0, Math.floor(offset ?? 0)) : 0;
+  return { limit: normalizedLimit, offset: normalizedOffset };
+}
+function normalizeBrowseSort(sort) {
+  switch (sort) {
     case "updated_asc":
     case "created_desc":
     case "created_asc":
@@ -4954,6 +5538,16 @@ var EngramAccessService = class {
   budgetLocks = /* @__PURE__ */ new Map();
   budget;
   auditAdapter;
+  /** AccessAdminOpsSurface (access-service decomposition). Lazy; selfDeps live wiring. */
+  _accessAdminOpsSurface;
+  get accessAdminOpsSurface() {
+    if (!this._accessAdminOpsSurface) {
+      this._accessAdminOpsSurface = new AccessAdminOpsSurface(
+        selfDeps(this)
+      );
+    }
+    return this._accessAdminOpsSurface;
+  }
   /** AccessRecallSurface (access-service decomposition). Lazy; selfDeps live wiring. */
   _accessRecallSurface;
   get accessRecallSurface() {
@@ -5464,9 +6058,9 @@ var EngramAccessService = class {
     );
   }
   async storageForAbsoluteRecallPath(memoryPath, primaryNamespace, recallNamespaces = []) {
-    const resolvedPath = nodePath.resolve(memoryPath);
-    const memoryRoot = nodePath.resolve(this.orchestrator.config.memoryDir);
-    const namespacesRoot = nodePath.join(memoryRoot, "namespaces");
+    const resolvedPath = nodePath2.resolve(memoryPath);
+    const memoryRoot = nodePath2.resolve(this.orchestrator.config.memoryDir);
+    const namespacesRoot = nodePath2.join(memoryRoot, "namespaces");
     const configuredNamespaces = /* @__PURE__ */ new Set();
     configuredNamespaces.add(primaryNamespace);
     for (const namespace of recallNamespaces) {
@@ -5475,7 +6069,7 @@ var EngramAccessService = class {
     configuredNamespaces.add(this.orchestrator.config.defaultNamespace);
     configuredNamespaces.add(this.orchestrator.config.sharedNamespace);
     if (isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
-      const relativeToNamespaces = nodePath.relative(namespacesRoot, resolvedPath);
+      const relativeToNamespaces = nodePath2.relative(namespacesRoot, resolvedPath);
       const [namespaceSegment] = relativeToNamespaces.split(/[\\/]/);
       if (namespaceSegment) {
         configuredNamespaces.add(
@@ -5495,7 +6089,7 @@ var EngramAccessService = class {
       } catch {
         continue;
       }
-      const candidateRoot = nodePath.resolve(candidateStorage.dir);
+      const candidateRoot = nodePath2.resolve(candidateStorage.dir);
       if (!isPathInsideStorageRoot(candidateRoot, resolvedPath)) continue;
       if (candidateRoot === memoryRoot && isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
         continue;
@@ -5595,8 +6189,8 @@ var EngramAccessService = class {
   async withIdempotencyLock(key, fn) {
     const previous = this.idempotencyLocks.get(key) ?? Promise.resolve();
     let release;
-    const current = new Promise((resolve3) => {
-      release = resolve3;
+    const current = new Promise((resolve4) => {
+      release = resolve4;
     });
     const queued = previous.then(() => current, () => current);
     this.idempotencyLocks.set(key, queued);
@@ -5615,8 +6209,8 @@ var EngramAccessService = class {
     const key = principal || "__anonymous__";
     const previous = this.budgetLocks.get(key) ?? Promise.resolve();
     let release;
-    const current = new Promise((resolve3) => {
-      release = resolve3;
+    const current = new Promise((resolve4) => {
+      release = resolve4;
     });
     const queued = previous.then(() => current, () => current);
     this.budgetLocks.set(key, queued);
@@ -5806,14 +6400,14 @@ var EngramAccessService = class {
     const timer = setTimeout(() => controller.abort(), 2e3);
     timer.unref?.();
     try {
-      return await new Promise((resolve3) => {
+      return await new Promise((resolve4) => {
         const onAbort = () => {
           controller.signal.removeEventListener("abort", onAbort);
-          resolve3(false);
+          resolve4(false);
         };
         controller.signal.addEventListener("abort", onAbort, { once: true });
         const probe = typeof qmd.checkAvailability === "function" ? qmd.checkAvailability({ signal: controller.signal }) : qmd.probe();
-        probe.then(resolve3, () => resolve3(false)).finally(() => {
+        probe.then(resolve4, () => resolve4(false)).finally(() => {
           controller.signal.removeEventListener("abort", onAbort);
         });
       });
@@ -6460,7 +7054,7 @@ var EngramAccessService = class {
         resolvedConfig.versioningMaxPerPage,
         resolvedConfig.versioningSidecarDir,
         resolvedConfig.memoryDir,
-        (p) => nodeFs.readFile(p, "utf-8"),
+        (p) => nodeFs2.readFile(p, "utf-8"),
         createVersion
       ),
       throwInputError: (msg) => {
@@ -6723,83 +7317,11 @@ var EngramAccessService = class {
     };
   }
   async reviewQueue(runId, namespace, principal) {
-    const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
-    const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const projected = await storage.getProjectedGovernanceRecord();
-    if (projected && (!runId || projected.runId === runId.trim())) {
-      const projectedAppliedActions = projected.appliedActionRows.map((row) => ({
-        action: row.action,
-        memoryId: row.memoryId,
-        reasonCode: row.reasonCode,
-        beforeStatus: row.beforeStatus,
-        afterStatus: row.afterStatus,
-        originalPath: row.originalPath,
-        currentPath: row.currentPath
-      }));
-      const projectedProposedActions = await buildProjectedGovernanceProposedActions(storage, projected);
-      const projectedArtifact = await (async () => {
-        try {
-          return await readMemoryGovernanceRunArtifact(storage.dir, projected.runId);
-        } catch {
-          return null;
-        }
-      })();
-      const metrics = projected.metrics;
-      const fallbackTransitionReport = {
-        proposed: groupActionsByStatus(projectedProposedActions),
-        applied: groupActionsByStatus(projectedAppliedActions)
-      };
-      const transitionReport = projectedArtifact?.transitionReport ? {
-        proposed: hasGroupedGovernanceActions(projectedArtifact.transitionReport.proposed) || projectedProposedActions.length === 0 ? projectedArtifact.transitionReport.proposed : fallbackTransitionReport.proposed,
-        applied: hasGroupedGovernanceActions(projectedArtifact.transitionReport.applied) || projectedAppliedActions.length === 0 ? projectedArtifact.transitionReport.applied : fallbackTransitionReport.applied
-      } : fallbackTransitionReport;
-      const qualityScore = projectedArtifact?.qualityScore ?? metrics?.qualityScore ?? buildQualityScore(metrics?.reviewReasons ?? {
-        exact_duplicate: 0,
-        semantic_duplicate_candidate: 0,
-        disputed_memory: 0,
-        speculative_low_confidence: 0,
-        archive_candidate: 0,
-        explicit_capture_review: 0,
-        malformed_import: 0
-      });
-      const effectiveMetrics = metrics ? { ...metrics, qualityScore: metrics.qualityScore ?? qualityScore } : metrics;
-      return {
-        found: true,
-        namespace: resolvedNamespace,
-        runId: projected.runId,
-        summary: projected.summary,
-        metrics: effectiveMetrics,
-        qualityScore,
-        reviewQueue: projected.reviewQueueRows.map((row) => ({
-          entryId: row.entryId,
-          memoryId: row.memoryId,
-          path: row.path,
-          reasonCode: row.reasonCode,
-          severity: row.severity,
-          suggestedAction: row.suggestedAction,
-          suggestedStatus: row.suggestedStatus,
-          relatedMemoryIds: row.relatedMemoryIds
-        })),
-        appliedActions: projectedAppliedActions,
-        transitionReport,
-        report: projected.report
-      };
-    }
-    const resolvedRunId = runId?.trim() || (await listMemoryGovernanceRuns(storage.dir))[0];
-    if (!resolvedRunId) return { found: false, namespace: resolvedNamespace };
-    const artifact = await readMemoryGovernanceRunArtifact(storage.dir, resolvedRunId);
-    return {
-      found: true,
-      namespace: resolvedNamespace,
-      runId: resolvedRunId,
-      summary: artifact.summary,
-      metrics: artifact.metrics,
-      qualityScore: artifact.qualityScore,
-      reviewQueue: artifact.reviewQueue,
-      appliedActions: artifact.appliedActions,
-      transitionReport: artifact.transitionReport,
-      report: artifact.report
-    };
+    return this.accessAdminOpsSurface.reviewQueue(
+      runId,
+      namespace,
+      principal
+    );
   }
   async maintenance(namespace, principal) {
     const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
@@ -6828,76 +7350,40 @@ var EngramAccessService = class {
       incrementCount(statusCounts, status);
       incrementCount(categoryCounts, memory.frontmatter.category);
       incrementCount(confidenceTierCounts, confidenceTier);
-      incrementCount(ageBucketCounts, ageBucket);
-      if (status === "active") {
-        if (ageBucket === "91_plus_days") staleActive += 1;
-        if ((memory.frontmatter.confidence ?? 0) < 0.6) lowConfidenceActive += 1;
-      }
-    }
-    return {
-      namespace: resolvedNamespace,
-      totalMemories: memories.length,
-      statusCounts,
-      categoryCounts,
-      confidenceTierCounts,
-      ageBucketCounts,
-      archivePressure: {
-        pendingReview: statusCounts.pending_review ?? 0,
-        quarantined: statusCounts.quarantined ?? 0,
-        archived: statusCounts.archived ?? 0,
-        staleActive,
-        lowConfidenceActive
-      },
-      latestGovernanceRun: {
-        found: governance.found,
-        runId: governance.runId,
-        qualityScore: governance.qualityScore ?? governance.metrics?.qualityScore,
-        reviewQueueCount: governance.reviewQueue?.length ?? 0
-      }
-    };
-  }
-  async governanceRun(request, principal) {
-    const deepSleep = this.orchestrator.config.dreamsPhases.deepSleep;
-    if (deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
-      throw new Error("memory governance is disabled by dreams.phases.deepSleep.enabled=false");
-    }
-    const resolvedNamespace = this.writableNamespaceFor(
-      request.namespace,
-      void 0,
-      request.authenticatedPrincipal ?? principal
-    );
-    const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const mode = request.mode === "apply" ? "apply" : "shadow";
-    const boundedBatchSize = typeof request.batchSize === "number" && Number.isFinite(request.batchSize) ? Math.max(1, Math.floor(request.batchSize)) : void 0;
-    const result = await runMemoryGovernance({
-      memoryDir: storage.dir,
-      mode,
-      recentDays: typeof request.recentDays === "number" && Number.isFinite(request.recentDays) ? Math.max(1, Math.floor(request.recentDays)) : void 0,
-      maxMemories: typeof request.maxMemories === "number" && Number.isFinite(request.maxMemories) ? Math.max(1, Math.floor(request.maxMemories)) : void 0,
-      batchSize: boundedBatchSize
-    });
-    if (mode === "apply") {
-      try {
-        await this.orchestrator.processEntitySynthesisQueue(
-          resolvedNamespace,
-          Math.min(boundedBatchSize ?? 5, 5)
-        );
-      } catch (error) {
-        log.debug(`governanceRun: entity synthesis refresh failed after governance apply: ${error}`);
+      incrementCount(ageBucketCounts, ageBucket);
+      if (status === "active") {
+        if (ageBucket === "91_plus_days") staleActive += 1;
+        if ((memory.frontmatter.confidence ?? 0) < 0.6) lowConfidenceActive += 1;
       }
     }
     return {
       namespace: resolvedNamespace,
-      runId: result.runId,
-      traceId: result.traceId,
-      mode: result.mode,
-      reviewQueueCount: result.reviewQueue.length,
-      proposedActionCount: result.proposedActions.length,
-      appliedActionCount: result.appliedActions.length,
-      summaryPath: result.summaryPath,
-      reportPath: result.reportPath
+      totalMemories: memories.length,
+      statusCounts,
+      categoryCounts,
+      confidenceTierCounts,
+      ageBucketCounts,
+      archivePressure: {
+        pendingReview: statusCounts.pending_review ?? 0,
+        quarantined: statusCounts.quarantined ?? 0,
+        archived: statusCounts.archived ?? 0,
+        staleActive,
+        lowConfidenceActive
+      },
+      latestGovernanceRun: {
+        found: governance.found,
+        runId: governance.runId,
+        qualityScore: governance.qualityScore ?? governance.metrics?.qualityScore,
+        reviewQueueCount: governance.reviewQueue?.length ?? 0
+      }
     };
   }
+  async governanceRun(request, principal) {
+    return this.accessAdminOpsSurface.governanceRun(
+      request,
+      principal
+    );
+  }
   async procedureMiningRun(request, principal) {
     const resolvedNamespace = this.writableNamespaceFor(
       request.namespace,
@@ -7002,138 +7488,14 @@ var EngramAccessService = class {
     };
   }
   async conversationIndexUpdate(request = {}) {
-    if (!resolveIndexingCapabilities(this.orchestrator.config).conversationIndex) {
-      return {
-        enabled: false,
-        sessions: 0,
-        chunks: 0,
-        skipped: 0,
-        skippedSessionKeys: [],
-        embeddedRuns: 0,
-        reason: "disabled"
-      };
-    }
-    const hours = typeof request.hours === "number" && Number.isFinite(request.hours) ? Math.max(1, Math.floor(request.hours)) : 24;
-    let sessionKey;
-    if (request.sessionKey !== void 0) {
-      if (typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
-        throw new EngramAccessInputError("sessionKey must be a non-empty string when provided");
-      }
-      sessionKey = request.sessionKey.trim();
-    }
-    if (sessionKey) {
-      const result = await this.orchestrator.updateConversationIndex(
-        sessionKey,
-        hours,
-        { embed: request.embed }
-      );
-      return {
-        enabled: true,
-        sessionKey,
-        sessions: 1,
-        chunks: result.chunks,
-        skipped: result.skipped ? 1 : 0,
-        skippedSessionKeys: result.skipped ? [sessionKey] : [],
-        embeddedRuns: result.embedded ? 1 : 0,
-        reason: result.reason,
-        retryAfterMs: result.retryAfterMs
-      };
-    }
-    const sessionKeys = await this.orchestrator.transcript.listSessionKeys();
-    let chunks = 0;
-    let skipped = 0;
-    const skippedSessionKeys = [];
-    let embeddedRuns = 0;
-    for (const sessionKey2 of sessionKeys) {
-      const result = await this.orchestrator.updateConversationIndex(
-        sessionKey2,
-        hours,
-        { embed: request.embed }
-      );
-      chunks += result.chunks;
-      if (result.skipped) {
-        skipped += 1;
-        skippedSessionKeys.push(sessionKey2);
-      }
-      if (result.embedded) {
-        embeddedRuns += 1;
-      }
-    }
-    return {
-      enabled: true,
-      sessions: sessionKeys.length,
-      chunks,
-      skipped,
-      skippedSessionKeys,
-      embeddedRuns
-    };
+    return this.accessAdminOpsSurface.conversationIndexUpdate(
+      request
+    );
   }
   async profilingReport(request = {}) {
-    const profiler = this.orchestrator.profiler;
-    if (!profiler.isEnabled) {
-      return {
-        enabled: false,
-        reason: "disabled",
-        message: "Profiling is disabled. Set profilingEnabled: true in your plugin config to enable."
-      };
-    }
-    const format = request.format ?? "ascii";
-    if (format !== "ascii" && format !== "json") {
-      throw new EngramAccessInputError("format must be one of: ascii, json");
-    }
-    const limit = request.limit ?? 5;
-    if (!Number.isInteger(limit) || limit < 1 || limit > 20) {
-      throw new EngramAccessInputError("limit must be an integer between 1 and 20");
-    }
-    const traces = profiler.getRecentTraces(limit);
-    const stats = profiler.getStats();
-    const bottleneck = profiler.identifyBottleneck();
-    if (format === "json") {
-      return {
-        enabled: true,
-        format,
-        traces,
-        stats,
-        bottleneck
-      };
-    }
-    const lines = [];
-    lines.push("Engram Profiling Report");
-    lines.push("=".repeat(60));
-    lines.push("");
-    const allBuckets = [
-      ["byKind", stats.byKind],
-      ["bySpan", stats.bySpan]
-    ];
-    const hasStats = allBuckets.some(([, entries]) => Object.keys(entries).length > 0);
-    if (hasStats) {
-      lines.push("Aggregate Stats (all retained traces):");
-      for (const [bucket, entries] of allBuckets) {
-        for (const [key, summary] of Object.entries(entries)) {
-          lines.push(
-            `  ${bucket}/${key}: avg=${summary.avgMs}ms p50=${summary.p50Ms}ms p95=${summary.p95Ms}ms max=${summary.maxMs}ms (n=${summary.count})`
-          );
-        }
-      }
-      lines.push("");
-    }
-    if (bottleneck) {
-      lines.push(`Bottleneck: ${bottleneck}`);
-      lines.push("");
-    }
-    if (traces.length === 0) {
-      lines.push("No traces recorded yet. Trigger a recall or extraction to see timing data.");
-    } else {
-      for (const trace of traces) {
-        lines.push(formatProfileTraceAscii(trace));
-        lines.push("");
-      }
-    }
-    return {
-      enabled: true,
-      format,
-      report: lines.join("\n")
-    };
+    return this.accessAdminOpsSurface.profilingReport(
+      request
+    );
   }
   async trustZoneStatus(namespace, principal) {
     const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
@@ -8473,100 +8835,31 @@ ${next}`);
     const storage = await this.orchestrator.getStorage(resolvedNs);
     const questions = await storage.readQuestions();
     return {
-      questions: questions.map((q) => ({ id: q.id, question: q.question, resolved: q.resolved })),
-      count: questions.length
-    };
-  }
-  async lastRecallSnapshot(sessionKey) {
-    const snapshot = sessionKey ? this.orchestrator.lastRecall.get(sessionKey) : this.orchestrator.lastRecall.getMostRecent();
-    return snapshot ?? { message: "No recall snapshot available" };
-  }
-  async intentDebug(namespace) {
-    const snapshot = await this.orchestrator.getLastIntentSnapshot(namespace);
-    return snapshot ?? { message: "No intent debug snapshot available" };
-  }
-  async qmdDebug(namespace) {
-    const snapshot = await this.orchestrator.getLastQmdRecallSnapshot(namespace);
-    return snapshot ?? { message: "No QMD debug snapshot available" };
-  }
-  async graphExplainLastRecall(namespace) {
-    const explanation = await this.orchestrator.explainLastGraphRecall({ namespace });
-    return { explanation };
-  }
-  /**
-   * Read-only graph snapshot for the admin pane (issue #691 PR 2/5).
-   *
-   * Reads adjacency from the JSONL edge store written by `GraphIndex` and
-   * resolves node metadata via the namespaced storage manager.  Namespace
-   * resolution mirrors the read-side path used by `recall` /
-   * `procedureStats`, so multi-principal deployments can't leak edges from
-   * a peer namespace (CLAUDE.md rule 42).
-   */
-  async graphSnapshot(request, authenticatedPrincipal) {
-    const namespace = this.resolveReadableNamespace(
-      request.namespace,
-      authenticatedPrincipal
-    );
-    const storage = await this.orchestrator.getStorage(namespace);
-    const cfg = this.orchestrator.config;
-    const graphCaps = resolveGraphConstructionCapabilities(cfg);
-    let namespaceRootReal;
-    try {
-      namespaceRootReal = await nodeFs.realpath(storage.dir);
-    } catch {
-      namespaceRootReal = nodePath.resolve(storage.dir);
-    }
-    const namespaceRootWithSep = namespaceRootReal.endsWith(nodePath.sep) ? namespaceRootReal : namespaceRootReal + nodePath.sep;
-    const loadNode = async (relPath) => {
-      if (nodePath.isAbsolute(relPath)) {
-        log.warn(
-          `graphSnapshot: rejected absolute edge endpoint (len=${relPath.length}) outside namespace root`
-        );
-        return null;
-      }
-      const candidate = nodePath.resolve(namespaceRootReal, relPath);
-      if (candidate !== namespaceRootReal && !candidate.startsWith(namespaceRootWithSep)) {
-        log.warn(
-          `graphSnapshot: rejected traversing edge endpoint (len=${relPath.length}) outside namespace root`
-        );
-        return null;
-      }
-      let canonical;
-      try {
-        canonical = await nodeFs.realpath(candidate);
-      } catch {
-        canonical = candidate;
-      }
-      if (canonical !== namespaceRootReal && !canonical.startsWith(namespaceRootWithSep)) {
-        log.warn(
-          `graphSnapshot: rejected symlinked edge endpoint (len=${relPath.length}) that resolved outside namespace root`
-        );
-        return null;
-      }
-      const memory = await storage.readMemoryByPath(canonical);
-      if (!memory) return null;
-      const fm = memory.frontmatter;
-      return {
-        category: fm.category ?? "unknown",
-        label: fm.id ?? nodePath.basename(canonical, nodePath.extname(canonical)),
-        updated: fm.updated
-      };
-    };
-    return buildGraphSnapshot({
-      memoryDir: namespaceRootReal,
-      graphConfig: {
-        entityGraph: graphCaps.entityGraph,
-        timeGraph: graphCaps.timeGraph,
-        causalGraph: graphCaps.causalGraph
-      },
-      request: {
-        limit: request.limit,
-        since: request.since,
-        focusNodeId: request.focusNodeId,
-        categories: request.categories
-      },
-      loadNode
-    });
+      questions: questions.map((q) => ({ id: q.id, question: q.question, resolved: q.resolved })),
+      count: questions.length
+    };
+  }
+  async lastRecallSnapshot(sessionKey) {
+    const snapshot = sessionKey ? this.orchestrator.lastRecall.get(sessionKey) : this.orchestrator.lastRecall.getMostRecent();
+    return snapshot ?? { message: "No recall snapshot available" };
+  }
+  async intentDebug(namespace) {
+    const snapshot = await this.orchestrator.getLastIntentSnapshot(namespace);
+    return snapshot ?? { message: "No intent debug snapshot available" };
+  }
+  async qmdDebug(namespace) {
+    const snapshot = await this.orchestrator.getLastQmdRecallSnapshot(namespace);
+    return snapshot ?? { message: "No QMD debug snapshot available" };
+  }
+  async graphExplainLastRecall(namespace) {
+    const explanation = await this.orchestrator.explainLastGraphRecall({ namespace });
+    return { explanation };
+  }
+  async graphSnapshot(request, authenticatedPrincipal) {
+    return this.accessAdminOpsSurface.graphSnapshot(
+      request,
+      authenticatedPrincipal
+    );
   }
   async memoryFeedback(request) {
     if (!resolveRecallEnhancementCapabilities(this.orchestrator.config).feedback) {
@@ -8689,17 +8982,17 @@ ${next}`);
     const storage = await this.orchestrator.getStorage(resolvedNs);
     const storageDir = storage.dir;
     const { writeFile: writeFile4, mkdir: mkdir5 } = await import("fs/promises");
-    const { join: join3, resolve: resolve3 } = await import("path");
+    const { join: join4, resolve: resolve4 } = await import("path");
     const safeKey = request.sessionKey.replace(/[^a-zA-Z0-9_-]/g, "_");
     if (!safeKey) throw new EngramAccessInputError("sessionKey is required");
-    const checkpointDir = join3(storageDir, "checkpoints", safeKey);
-    const resolved = resolve3(checkpointDir);
-    if (!resolved.startsWith(resolve3(storageDir))) {
+    const checkpointDir = join4(storageDir, "checkpoints", safeKey);
+    const resolved = resolve4(checkpointDir);
+    if (!resolved.startsWith(resolve4(storageDir))) {
       throw new EngramAccessInputError("Invalid sessionKey");
     }
     await mkdir5(checkpointDir, { recursive: true });
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = join3(checkpointDir, `checkpoint-${ts}.md`);
+    const filePath = join4(checkpointDir, `checkpoint-${ts}.md`);
     await writeFile4(filePath, request.context, "utf-8");
     return { saved: true };
   }
@@ -9030,7 +9323,7 @@ ${next}`);
       throw new EngramAccessInputError("capsule import failed: archivePath must point to a file");
     }
     try {
-      await nodeFs.access(archivePath, fsConstants.R_OK);
+      await nodeFs2.access(archivePath, fsConstants.R_OK);
     } catch (err) {
       if (!this.isCapsuleImportPathInputFsError(err)) throw err;
       const message = err instanceof Error ? err.message : String(err);
@@ -9069,85 +9362,10 @@ ${next}`);
       memoryDir: exportOptions.encrypt === true ? memoryDir : void 0
     });
   }
-  /**
-   * List capsule archives in the namespace-scoped capsule store.
-   *
-   * MCP uses this access-layer method instead of reading arbitrary paths so
-   * capsule discovery remains bound to the same namespace ACLs as export and
-   * import.
-   */
   async capsuleList(options) {
-    const resolvedNamespace = this.resolveReadableNamespace(options?.namespace, options?.principal);
-    const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const capsulesDir = defaultCapsulesDir(storage.dir);
-    let dirEntries;
-    try {
-      const capsulesDirStat = await nodeFs.lstat(capsulesDir);
-      if (capsulesDirStat.isSymbolicLink()) {
-        throw new EngramAccessInputError("capsule list failed: capsule store directory must not be a symlink");
-      }
-      if (!capsulesDirStat.isDirectory()) {
-        throw new EngramAccessInputError("capsule list failed: capsule store path must be a directory");
-      }
-      dirEntries = await nodeFs.readdir(capsulesDir, { withFileTypes: true });
-    } catch (err) {
-      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-      if (code === "ENOENT") {
-        return { namespace: resolvedNamespace, capsulesDir, capsules: [] };
-      }
-      throw err;
-    }
-    const archiveNames = dirEntries.filter(
-      (entry) => entry.isFile() && (entry.name.endsWith(".capsule.json.gz") || entry.name.endsWith(".capsule.json.gz.enc"))
-    ).map((entry) => entry.name).sort();
-    const capsules = [];
-    for (const archiveName of archiveNames) {
-      const archivePath = nodePath.join(capsulesDir, archiveName);
-      const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
-      const manifestPath = nodePath.join(capsulesDir, `${id}.manifest.json`);
-      let createdAt = null;
-      let pluginVersion = null;
-      let fileCount = null;
-      let description = null;
-      let manifestPathOrNull = manifestPath;
-      try {
-        const manifestStat = await nodeFs.lstat(manifestPath);
-        if (manifestStat.isSymbolicLink() || !manifestStat.isFile()) {
-          capsules.push({
-            id,
-            archivePath,
-            manifestPath: manifestPathOrNull,
-            createdAt,
-            pluginVersion,
-            fileCount,
-            description
-          });
-          continue;
-        }
-        const raw = await nodeFs.readFile(manifestPath, "utf-8");
-        const sidecar = JSON.parse(raw);
-        createdAt = typeof sidecar.createdAt === "string" ? sidecar.createdAt : null;
-        pluginVersion = typeof sidecar.pluginVersion === "string" ? sidecar.pluginVersion : null;
-        fileCount = Array.isArray(sidecar.files) ? sidecar.files.length : null;
-        const capsule = sidecar.capsule;
-        description = capsule && typeof capsule.description === "string" ? capsule.description : null;
-      } catch (err) {
-        const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-        if (code === "ENOENT") {
-          manifestPathOrNull = null;
-        }
-      }
-      capsules.push({
-        id,
-        archivePath,
-        manifestPath: manifestPathOrNull,
-        createdAt,
-        pluginVersion,
-        fileCount,
-        description
-      });
-    }
-    return { namespace: resolvedNamespace, capsulesDir, capsules };
+    return this.accessAdminOpsSurface.capsuleList(
+      options
+    );
   }
   /**
    * Operator-configured offline-sync excludes (#1786), compiled once per
@@ -9340,74 +9558,10 @@ ${next}`);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     return getDreamsStatus(storage.dir, windowHours);
   }
-  /**
-   * Manually invoke a single Dreams phase pass (PR 4/4).
-   *
-   * Deep-sleep delegates to memory governance (shadow → dry-run, apply → live).
-   * Light-sleep and REM scan the observation ledger and memory corpus
-   * respectively, returning the same telemetry shape as a scheduled run.
-   */
   async dreamsRun(options) {
-    const { runDreamsPhase } = await import("./dreams-ledger-6UODQOX6.js");
-    const validPhases = ["lightSleep", "rem", "deepSleep"];
-    if (!validPhases.includes(options.phase)) {
-      throw new EngramAccessInputError(
-        `Invalid phase: ${String(options.phase)}. Must be one of: ${validPhases.join(", ")}`
-      );
-    }
-    const deepSleep = this.orchestrator.config.dreamsPhases.deepSleep;
-    if (options.phase === "deepSleep" && deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
-      throw new EngramAccessInputError(
-        "memory governance is disabled by dreams.phases.deepSleep.enabled=false"
-      );
-    }
-    const dryRun = options.dryRun === true;
-    const resolvedNamespace = this.writableNamespaceFor(
-      options.namespace,
-      void 0,
-      options.authenticatedPrincipal
-    );
-    const storage = await this.orchestrator.getStorage(resolvedNamespace);
-    const memoryDir = storage.dir;
-    const phaseRunner = dryRun || options.phase === "deepSleep" ? void 0 : async (_opts) => {
-      if (_opts.phase === "lightSleep") {
-        const result3 = await this.orchestrator.runLifecyclePolicyNow(storage);
-        return {
-          itemsProcessed: result3.memoriesAssessed,
-          notes: `scored ${result3.memoriesAssessed} memories`
-        };
-      }
-      const result2 = await this.orchestrator.runSemanticConsolidationNow({
-        dryRun: false,
-        storage
-      });
-      const itemsProcessed = result2.clusters.reduce(
-        (sum, cluster) => sum + cluster.memories.length,
-        0
-      );
-      return {
-        itemsProcessed,
-        notes: `REM consolidation found ${result2.clustersFound} clusters`
-      };
-    };
-    const governanceRunner = options.phase === "deepSleep" ? async (_opts) => {
-      return this.orchestrator.runDeepSleepGovernanceNow({
-        storage,
-        dryRun: _opts.dryRun
-      });
-    } : void 0;
-    const result = await runDreamsPhase(
-      { memoryDir, phase: options.phase, dryRun },
-      governanceRunner,
-      phaseRunner
+    return this.accessAdminOpsSurface.dreamsRun(
+      options
     );
-    return {
-      phase: result.phase,
-      dryRun: result.dryRun,
-      durationMs: result.durationMs,
-      itemsProcessed: result.itemsProcessed,
-      notes: result.notes
-    };
   }
   // ---------------------------------------------------------------------------
   // Wearables (Limitless / Bee / Omi transcript ingestion)
@@ -9517,100 +9671,10 @@ ${next}`);
     const result = await auditTranscripts(this.orchestrator.config.memoryDir);
     return redactSensitive(result);
   }
-  /**
-   * Manually promote a memory into one or more authorized targets. Requires
-   * a non-empty reason (audit-logged). Reuses the scope-profile promotion
-   * resolution and `canWriteNamespace` gate — there is no dashboard-only
-   * write path.
-   */
   async adminPromoteMemory(request) {
-    const config = this.orchestrator.config;
-    const namespacesEnabled = resolveNamespaceCapabilities(config).namespaces === true;
-    let sourceNamespace;
-    if (request.namespace) {
-      sourceNamespace = this.resolveReadableNamespace(
-        request.namespace,
-        request.principal
-      );
-    } else {
-      const codingContext2 = request.sessionKey ? this.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
-      const plan = resolveScopePlan({
-        config,
-        sessionKey: request.sessionKey,
-        principalOverride: request.principal,
-        codingContext: codingContext2,
-        namespacesEnabled
-      });
-      sourceNamespace = this.resolveReadableNamespace(
-        plan.baseNamespace,
-        request.principal
-      );
-    }
-    const codingContext = request.sessionKey ? this.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
-    const codingOverlay = codingContext ? resolveCodingNamespaceOverlay(
-      codingContext,
-      config.codingMode,
-      config.defaultNamespace
-    ) : null;
-    const scopeProfilePlan = resolveScopeProfilePlan({
-      config,
-      principal: request.principal,
-      codingContext,
-      codingOverlay
-    });
-    const storage = {
-      readMemory: async (namespace, memoryId) => {
-        const resolved = await this.orchestrator.getStorage(namespace);
-        const memory = await resolved.getMemoryById(memoryId);
-        if (!memory) return null;
-        return {
-          category: memory.frontmatter.category,
-          content: memory.content,
-          frontmatter: memory.frontmatter
-        };
-      },
-      writePromotedMemory: async (namespace, memory) => {
-        const resolved = await this.orchestrator.getStorage(namespace);
-        const { id, tombstoneBlocked } = await resolved.writeMemory(
-          memory.category,
-          memory.content,
-          {
-            confidence: memory.confidence,
-            tags: memory.tags,
-            entityRef: memory.entityRef,
-            source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}`,
-            lineage: memory.lineage,
-            sourceMemoryId: memory.sourceMemoryId,
-            actor: memory.actor,
-            validAt: memory.validAt
-          }
-        );
-        if (tombstoneBlocked) {
-          throw new Error(
-            "target namespace tombstone-blocked the promoted content (pending_review)"
-          );
-        }
-        return id;
-      }
-    };
-    try {
-      return await promoteMemory({
-        config,
-        sourceMemoryId: request.sourceMemoryId,
-        sourceNamespace,
-        principal: request.principal,
-        targets: request.targets,
-        reason: request.reason,
-        actor: request.principal ?? "admin-console",
-        storage,
-        scopeProfilePlan
-      });
-    } catch (err) {
-      if (err instanceof AdminPromotionError) {
-        throw new EngramAccessInputError(err.message);
-      }
-      throw err;
-    }
+    return this.accessAdminOpsSurface.adminPromoteMemory(
+      request
+    );
   }
 };
 
@@ -9970,7 +10034,7 @@ var AccessRecallSurface = class {
         const storages = [];
         const seenStorageDirs = /* @__PURE__ */ new Set();
         const addStorage = (candidateStorage) => {
-          const candidateDir = nodePath2.resolve(candidateStorage.dir);
+          const candidateDir = nodePath3.resolve(candidateStorage.dir);
           if (seenStorageDirs.has(candidateDir)) return;
           seenStorageDirs.add(candidateDir);
           storages.push({ storage: candidateStorage, dir: candidateDir });
@@ -9985,7 +10049,7 @@ var AccessRecallSurface = class {
         }
         for (const candidateStorage of storages) {
           try {
-            const coldRoot = nodePath2.join(candidateStorage.dir, "cold");
+            const coldRoot = nodePath3.join(candidateStorage.dir, "cold");
             for (const candidatePath of qmdResultPathCandidates(
               coldRoot,
               parts.relativePath
@@ -10017,7 +10081,7 @@ var AccessRecallSurface = class {
           return null;
         }
       }
-      if (nodePath2.isAbsolute(memoryPath)) {
+      if (nodePath3.isAbsolute(memoryPath)) {
         const ownerStorage = await this.deps.storageForAbsoluteRecallPath(
           memoryPath,
           namespace,
@@ -10469,8 +10533,8 @@ var AccessRecallSurface = class {
     const previousQueue = this.deps.xrayQueue;
     let release = () => {
     };
-    this.deps.xrayQueue = new Promise((resolve3) => {
-      release = resolve3;
+    this.deps.xrayQueue = new Promise((resolve4) => {
+      release = resolve4;
     });
     await previousQueue;
     const recallStartedAt = Date.now();
@@ -10665,7 +10729,10 @@ export {
   selfDeps,
   EngramAccessInputError,
   ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
+  buildProjectedGovernanceProposedActions,
+  hasGroupedGovernanceActions,
   shapeMemorySummary,
-  EngramAccessService
+  EngramAccessService,
+  AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-VX2RYM2K.js.map
+//# sourceMappingURL=chunk-ZECLLIMX.js.map