@remnic/core 9.69.28 → 9.69.30

package/dist/who-knows.d.ts

@@ -1,4 +1,4 @@
-export { bA as WHO_KNOWS_AUTHORSHIP_BONUS, bB as WHO_KNOWS_DEFAULT_LIMIT, bC as WHO_KNOWS_MAX_EVIDENCE, bD as WHO_KNOWS_MAX_LIMIT, bE as WHO_KNOWS_MCP_TOOLS, bF as WhoKnowsEntity, bG as WhoKnowsEvidence, bH as WhoKnowsHit, bI as WhoKnowsHttpOutcome, W as WhoKnowsResult, bJ as WhoKnowsStorage, bT as computeWhoKnows, bZ as handleWhoKnowsHttpQuery, c2 as loadWhoKnowsEntities, c9 as tokenizeTopic, ca as validateWhoKnowsInput } from './access-service-GrdVg_-Z.js';
+export { bA as WHO_KNOWS_AUTHORSHIP_BONUS, bB as WHO_KNOWS_DEFAULT_LIMIT, bC as WHO_KNOWS_MAX_EVIDENCE, bD as WHO_KNOWS_MAX_LIMIT, bE as WHO_KNOWS_MCP_TOOLS, bF as WhoKnowsEntity, bG as WhoKnowsEvidence, bH as WhoKnowsHit, bI as WhoKnowsHttpOutcome, W as WhoKnowsResult, bJ as WhoKnowsStorage, bT as computeWhoKnows, bZ as handleWhoKnowsHttpQuery, c2 as loadWhoKnowsEntities, c9 as tokenizeTopic, ca as validateWhoKnowsInput } from './access-service-DWdY9Mlk.js';
 import './types-YY-eKKU7.js';
 import './orchestrator-DgyvFfPR.js';
 import './recall-state.js';

package/dist/who-knows.js

@@ -9,25 +9,25 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-INBOGQ3E.js";
-import "./chunk-UY2RORVF.js";
+} from "./chunk-EZZV7OQL.js";
+import "./chunk-GVG3JYBI.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-ZMNT26KV.js";
-import "./chunk-RFWEDCRC.js";
-import "./chunk-BD7JTBYP.js";
-import "./chunk-OB3XMWX5.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-TNSCIPBQ.js";
+import "./chunk-FHQSPTPZ.js";
+import "./chunk-7VJXIDOC.js";
 import "./chunk-YQNNHLCG.js";
-import "./chunk-4O6WRBGE.js";
 import "./chunk-6KTXE6A3.js";
+import "./chunk-PSPABFN2.js";
+import "./chunk-MKWKYHXJ.js";
+import "./chunk-CYEPCZN5.js";
+import "./chunk-ZNJSBIP4.js";
 import "./chunk-GUMZC2BO.js";
-import "./chunk-7RZJWZ46.js";
+import "./chunk-4O6WRBGE.js";
+import "./chunk-LEPOP46W.js";
+import "./chunk-72A4L5JJ.js";
 import "./chunk-A7Q43EUZ.js";
 import "./chunk-ET356KSB.js";
-import "./chunk-72A4L5JJ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-SO7SV523.js";
 import "./chunk-SCU65EZI.js";
@@ -35,11 +35,11 @@ import "./chunk-MRPOZBJC.js";
 import "./chunk-S2HLHAZ4.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-XSTNGNJP.js";
+import "./chunk-DCJ3YFIC.js";
 import "./chunk-AAD2ZS6P.js";
 import "./chunk-H272ZPQ3.js";
-import "./chunk-YXZG5TVN.js";
 import "./chunk-3ONXXHQO.js";
+import "./chunk-YXZG5TVN.js";
 import "./chunk-5GINB5LC.js";
 import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
@@ -49,7 +49,7 @@ import "./chunk-RBOJCG4T.js";
 import "./chunk-R7QY5ZVB.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
-import "./chunk-C24UZSFW.js";
+import "./chunk-DBQWVT2H.js";
 import "./chunk-JXN77SGO.js";
 import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
@@ -57,13 +57,13 @@ import "./chunk-3QQTXYZ6.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-JALOAKSZ.js";
-import "./chunk-QIEUU4UK.js";
+import "./chunk-TLPZ6MKZ.js";
+import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
-import "./chunk-NXH34IPL.js";
+import "./chunk-353KGBKY.js";
 import "./chunk-ZIKENA2C.js";
 import "./chunk-VYCOJKSX.js";
 import "./chunk-6Q3ZTEF6.js";
@@ -94,8 +94,8 @@ import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
 import "./chunk-JUOZ62Y7.js";
 import "./chunk-O75CRYGF.js";
-import "./chunk-EYIEWJNI.js";
-import "./chunk-JUC24CTX.js";
+import "./chunk-6KH5NLQS.js";
+import "./chunk-P2QRMMVQ.js";
 import "./chunk-2Z24E5W2.js";
 import "./chunk-BTTPKDIL.js";
 import "./chunk-FF4KLI5W.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.69.28",
+  "version": "9.69.30",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3247,7 +3247,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.69.28"
+    "@remnic/coding-graph": "^9.69.30"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/activity/digest.test.ts

@@ -106,7 +106,12 @@ test("isValidActivityDate rejects impossible and malformed calendar days", () =>
   assert.equal(isValidActivityDate("2026-00-10"), false);
   assert.equal(isValidActivityDate("not-a-date"), false);
   assert.equal(isValidActivityDate("2026-3-10"), false); // wrong shape
-});
+  // Astronomical year zero: Intl formats it as 1 BC, so day windows would
+  // pad it to 0001 and land on the wrong boundary. Validation rejects it.
+  assert.equal(isValidActivityDate("0000-01-01"), false);
+  assert.equal(isValidActivityDate("0001-01-01"), true); // first supported year
+  assert.equal(isValidActivityDate("0999-01-01"), true); // unpadded Intl year, still correct
+ });
 
 test("activityDigestPath rejects path-traversal / invalid dates", () => {
   assert.equal(activityDigestPath("/mem", "2026-03-10"), "/mem/activity/2026-03-10.md");
@@ -117,6 +122,13 @@ test("activityDigestPath rejects path-traversal / invalid dates", () => {
 test("activityDayWindow rejects an impossible date", () => {
   assert.throws(() => activityDayWindow("2026-02-30", "UTC"), RangeError);
   assert.throws(() => activityDayWindow("../evil", "UTC"), RangeError);
+  assert.throws(() => activityDayWindow("0000-01-01", "UTC"), RangeError);
+});
+
+test("activityDayWindow keeps year 0001 boundaries correct", () => {
+  const w = activityDayWindow("0001-01-01", "UTC");
+  assert.equal(w.startUtc, "0001-01-01T00:00:00.000Z");
+  assert.equal(w.endUtc, "0001-01-02T00:00:00.000Z");
 });
 
 test("parseActivityDigest rejects a non-numeric snapshotCount/formatVersion", () => {
@@ -196,6 +208,100 @@ test("activityDayWindow gives an entirely skipped civil date no interval", () =>
   assert.notDeepEqual(w, dec31);
 });
 
+// Read the local wall clock and offset directly through Intl so these
+// historical-LMT tests derive every expectation from the runtime's own tzdata
+// instead of hard-coding one tzdata release's seconds: ICU bundles differ
+// (Asia/Manila's 1844 LMT is −15:56:08 on recent tzdata, −15:56:00 on older
+// ones), and a hard-coded instant fails the bundle that lacks it.
+function localStampAt(ms: number, timezone: string): string {
+  const parts = new Intl.DateTimeFormat("en-CA", {
+    timeZone: timezone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hourCycle: "h23",
+  }).formatToParts(new Date(ms));
+  const get = (type: string): string => parts.find((part) => part.type === type)?.value ?? "";
+  return `${get("year").padStart(4, "0")}-${get("month")}-${get("day")}T${get("hour")}:${get("minute")}:${get("second")}`;
+}
+
+function offsetMsAt(ms: number, timezone: string): number {
+  return Date.parse(`${localStampAt(ms, timezone)}Z`) - ms;
+}
+
+test("activityDayWindow resolves second-granularity transitions exactly (Asia/Manila 1844)", () => {
+  // Manila's 1844 date-line change carried seconds where tzdata records them
+  // (LMT −15:56:08 on recent ICU bundles): the wall clock jumped from
+  // 1844-12-31T00:00:00 straight to 1845-01-01, so civil 1844-12-31 never
+  // existed and no midnight of it occurred. Offsets with a seconds component
+  // must not truncate to whole minutes: pre-fix, the skipped date owned a
+  // 60000 ms window starting locally on 1844-12-30.
+  const tz = "Asia/Manila";
+  const lmt = offsetMsAt(Date.parse("1844-12-15T12:00:00Z"), tz); // LMT in force mid-December
+  const after = offsetMsAt(Date.parse("1845-06-01T12:00:00Z"), tz); // post-change LMT in force mid-1845
+  const iso = (ms: number): string => new Date(ms).toISOString();
+  const skip = activityDayWindow("1844-12-31", tz);
+  assert.equal(skip.endUtc, skip.startUtc); // zero-width: the day never existed, syncs nothing
+  assert.equal(skip.startUtc, iso(Date.parse("1844-12-31T00:00:00Z") - lmt)); // the transition instant this tzdata carries
+  const before = activityDayWindow("1844-12-30", tz);
+  assert.equal(before.startUtc, iso(Date.parse("1844-12-30T00:00:00Z") - lmt)); // exact local midnight at the seconds-carrying LMT
+  assert.equal(Date.parse(before.endUtc) - Date.parse(before.startUtc), 24 * 3_600_000); // one LMT offset the whole day
+  assert.equal(before.endUtc, skip.startUtc); // contiguous into the skip
+  const next = activityDayWindow("1845-01-01", tz);
+  assert.equal(next.startUtc, skip.startUtc); // no interval shared with the skip
+  assert.equal(next.endUtc, iso(Date.parse("1845-01-02T00:00:00Z") - after));
+  // Consistency at the skip instant: the transition is the first instant of
+  // 1845-01-01, and the last pre-transition instant still belongs to Dec 30.
+  assert.equal(activityDateInTimezone(new Date(skip.startUtc), tz), "1845-01-01");
+  assert.equal(activityDateInTimezone(new Date(Date.parse(skip.startUtc) - 1), tz), "1844-12-30");
+  assert.equal(activityDateInTimezone(new Date(Date.parse(before.endUtc) - 1), tz), "1844-12-30");
+});
+
+test("activityDayWindow keeps the first midnight across a rollback that repeats it", () => {
+  // America/Cancun dropped LMT −05:47:04 for −06:00 exactly at local midnight
+  // 1922-01-01T00:00:00, rolling the clock back to 1921-12-31T23:47:04: local
+  // midnight occurred twice. The day must start at the FIRST one, not at the
+  // later repeated midnight under the new whole-minute offset — pre-fix, the
+  // minute-truncated LMT candidate failed the exact-stamp check and 12m56s of
+  // the day were misattributed to the prior date.
+  const tz = "America/Cancun";
+  const lmt = offsetMsAt(Date.parse("1921-12-15T12:00:00Z"), tz); // LMT in force mid-December
+  const after = offsetMsAt(Date.parse("1922-06-01T12:00:00Z"), tz); // whole-minute offset in force mid-1922
+  const iso = (ms: number): string => new Date(ms).toISOString();
+  const firstMidnight = Date.parse("1922-01-01T00:00:00Z") - lmt;
+  const repeatedMidnight = Date.parse("1922-01-01T00:00:00Z") - after;
+  const w = activityDayWindow("1922-01-01", tz);
+  // The start is an exact local midnight whichever occurrence this tzdata renders.
+  assert.equal(localStampAt(Date.parse(w.startUtc), tz), "1922-01-01T00:00:00");
+  // When this tzdata carries the seconds-exact LMT midnight (it exists as a
+  // real instant), it is the earlier occurrence and must win.
+  if (localStampAt(firstMidnight, tz) === "1922-01-01T00:00:00") {
+    assert.equal(w.startUtc, iso(firstMidnight));
+    assert.ok(Date.parse(w.startUtc) < repeatedMidnight); // not the later repeated midnight
+  }
+  assert.equal(w.endUtc, iso(Date.parse("1922-01-02T00:00:00Z") - after));
+  // The rolled-back stretch stays inside Jan 1, and Dec 31 keeps its own day,
+  // ending at the first instant whose local stamp reaches Jan 1.
+  const dec31 = activityDayWindow("1921-12-31", tz);
+  assert.equal(dec31.endUtc, w.startUtc);
+  assert.equal(Date.parse(dec31.endUtc) - Date.parse(dec31.startUtc), 24 * 3_600_000);
+});
+
+test("activityDayWindow pads pre-1000 years before the local-date comparison", () => {
+  // Intl.DateTimeFormat formats years before 1000 unpadded: the year 0999
+  // comes back as "999". Pre-fix, `localStamp` rejected the valid midnight
+  // ("999-01-01T00:00:00" ≠ "0999-01-01T00:00:00") and the fallback's
+  // lexicographic comparison treated "998-12-31" as ≥ "0999-01-01", so
+  // activityDayWindow("0999-01-01", "UTC") resolved its start to
+  // 0998-12-31T00:00:00.000Z — fetching and attributing an extra day.
+  const w = activityDayWindow("0999-01-01", "UTC");
+  assert.equal(w.startUtc, "0999-01-01T00:00:00.000Z");
+  assert.equal(w.endUtc, "0999-01-02T00:00:00.000Z");
+});
+
 test("timeline keeps a second machine's span even with the same app/window", () => {
   const a = snap({ machine: "A", capturedAtUtc: "2026-03-10T14:00:00.000Z", app: "Chrome", windowTitle: "Doc", contentHash: "a1", text: "" });
   const b = snap({ machine: "B", capturedAtUtc: "2026-03-10T14:00:30.000Z", app: "Chrome", windowTitle: "Doc", contentHash: "b1", text: "" });

package/src/activity/digest.ts

@@ -28,6 +28,10 @@ const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
 
 export function isValidActivityDate(date: string): boolean {
   if (typeof date !== "string" || !DATE_PATTERN.test(date)) return false;
+  // Year 0000 passes the round-trip below but Intl formats it as astronomical
+  // year 1 BC, so zonedDayStartIso's padded year yields 0001 and day windows
+  // land on the wrong boundary. Reject it here, at validation.
+  if (date.startsWith("0000-")) return false;
   // Reject impossible calendar days (e.g. 2026-02-30, 2026-13-01): the UTC
   // round-trip must reproduce the same Y-M-D, else Date normalized an overflow.
   const parsed = new Date(`${date}T00:00:00Z`);
@@ -65,68 +69,89 @@ export function assertValidTimezone(timezone: string): void {
 
 function zonedDayStartIso(date: string, timezone: string): string {
   // The first UTC instant whose local wall-clock is this date at 00:00. Probe
-  // several instants across the day to collect every offset in play; keep an
-  // offset only if constructing local midnight with it lands back on that same
-  // offset (so it is genuinely local midnight, not a wall-clock that never
-  // occurred), then take the EARLIEST such instant — the FIRST 00:00 across a
-  // DST fall-back that repeats local midnight.
+  // several instants across the day to collect every offset in play, keep an
+  // offset only if constructing local midnight with it lands on an exact
+  // local midnight, then take the EARLIEST such instant — the FIRST 00:00
+  // across a rollback that repeats local midnight (America/Cancun dropped
+  // LMT −05:47:04 for −06:00 exactly at local midnight 1922-01-01, so 00:00
+  // occurred twice; the day must start at the first one).
   // Probe the previous UTC day too: for zones east of UTC the requested date's
   // UTC instants all fall after local midnight, so the pre-transition offset
   // valid at the real local 00:00 is only observable on the prior UTC day.
+  const wall = new Intl.DateTimeFormat("en-CA", {
+    timeZone: timezone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hourCycle: "h23",
+  });
+  const localStamp = (ms: number): string => {
+    const parts = wall.formatToParts(new Date(ms));
+    const get = (type: string): string => parts.find((part) => part.type === type)?.value ?? "";
+    // Intl formats pre-1000 years unpadded ("999" for 0999). Pad back to the
+    // four-digit form the equality and ordering comparisons below assume,
+    // or "998-12-31" compares greater than "0999-01-01".
+    const year = get("year").padStart(4, "0");
+    return `${year}-${get("month")}-${get("day")}T${get("hour")}:${get("minute")}:${get("second")}`;
+  };
+  const localDate = (ms: number): string => localStamp(ms).slice(0, 10);
+  // Derive each probe's offset at FULL precision (seconds included) from the
+  // rendered wall clock, never from a longOffset string: those strings
+  // truncate to whole minutes while historical LMT offsets carry seconds
+  // (America/Cancun was −05:47:04; Asia/Manila −15:56:08). A candidate built
+  // from a truncated offset lands off the true midnight instant, the
+  // exact-stamp check below rejects it, and a midnight repeated by a
+  // rollback silently resolves to the later occurrence under the new
+  // whole-minute offset — misattributing the gap between the two.
+  const offsetMs = (ms: number): number | null => {
+    const wallAsUtc = Date.parse(`${localStamp(ms)}Z`);
+    return Number.isFinite(wallAsUtc) ? wallAsUtc - ms : null;
+  };
+  const midnightUtc = Date.parse(`${date}T00:00:00Z`);
   const prevDate = shiftIsoDate(date, -1);
-  const probeOffsets = new Set(
-    [
-      `${prevDate}T12:00:00Z`,
-      `${prevDate}T23:00:00Z`,
-      `${date}T00:00:00Z`,
-      `${date}T12:00:00Z`,
-      `${date}T23:00:00Z`,
-    ].map((iso) => timezoneOffsetIso(new Date(iso), timezone)),
-  );
   let best: number | null = null;
-  for (const offset of probeOffsets) {
-    const candidate = Date.parse(`${date}T00:00:00${offset}`);
+  for (const iso of [
+    `${prevDate}T12:00:00Z`,
+    `${prevDate}T23:00:00Z`,
+    `${date}T00:00:00Z`,
+    `${date}T12:00:00Z`,
+    `${date}T23:00:00Z`,
+  ]) {
+    const offset = offsetMs(Date.parse(iso));
+    if (offset === null) continue;
+    const candidate = midnightUtc - offset;
     if (!Number.isFinite(candidate)) continue;
-    // Reject an offset whose local midnight does not actually occur (the wall
-    // clock skipped by a spring-forward): the offset in effect at the candidate
-    // instant must be the same offset we used to build it.
-    if (timezoneOffsetIso(new Date(candidate), timezone) !== offset) continue;
+    // Accept only an EXACT local midnight. This rejects a wall-clock midnight
+    // that never occurred (spring-forward at 00:00, Egypt 2026) and one whose
+    // instant the transition already carried past (Asia/Manila's LMT midnight
+    // of 1844-12-31 lands on the post-transition clock as 1845-01-01).
+    if (localStamp(candidate) !== `${date}T00:00:00`) continue;
     if (best === null || candidate < best) best = candidate;
   }
   if (best === null) {
-    // Local midnight was skipped by a spring-forward at 00:00. Advance to the
-    // first local wall-clock minute on this date that actually exists (never
-    // backdating to a 00:00 that never occurred), scanning forward up to 3h.
-    for (let minute = 1; minute <= 180 && best === null; minute++) {
-      const hh = String(Math.floor(minute / 60)).padStart(2, "0");
-      const mm = String(minute % 60).padStart(2, "0");
-      for (const offset of probeOffsets) {
-        const candidate = Date.parse(`${date}T${hh}:${mm}:00${offset}`);
-        if (!Number.isFinite(candidate)) continue;
-        if (timezoneOffsetIso(new Date(candidate), timezone) !== offset) continue;
-        if (best === null || candidate < best) best = candidate;
-      }
-    }
-  }
-  if (best === null) {
-    // The ENTIRE civil date was skipped — no local wall-clock time on it
-    // exists (Pacific/Apia 2011-12-30 is the canonical case: the date-line
-    // jump went 2011-12-29 23:59:59-10:00 → 2011-12-31 00:00:00+14:00).
-    // Extending the never-backdate convention above, resolve the day start
-    // to the transition instant: the earliest instant whose local calendar
-    // date reaches `date`. Local date is monotone non-decreasing in the UTC
-    // instant (a fall-back never crosses local midnight backwards), so
-    // binary-search a 48h bracket at minute granularity. The bracket is
-    // safe: `<date>T00:00Z − 24h` is always locally before `date`, and
-    // `<date>T00:00Z + 24h` is always locally on/after it.
-    let lo = Date.parse(`${date}T00:00:00Z`) - 24 * 3_600_000;
+    // No exact local midnight: either local midnight was skipped by a
+    // spring-forward (00:00 → 01:00) or the ENTIRE civil date never existed
+    // (Pacific/Apia 2011-12-30; Asia/Manila 1844-12-31). Extending the
+    // never-backdate convention, resolve the day start to the first instant
+    // whose local calendar date reaches `date`. Local date is monotone
+    // non-decreasing in the UTC instant (a fall-back never crosses local
+    // midnight backwards), so binary-search a 48h bracket down to the
+    // millisecond — transitions can carry seconds (Manila's landed at
+    // :56:08, not on a minute boundary), so minute granularity mis-resolves
+    // by up to 59s and hands the skipped date a window of its own. The
+    // bracket is safe: `<date>T00:00Z − 24h` is always locally before
+    // `date`, and `<date>T00:00Z + 24h` is always locally on/after it.
+    let lo = midnightUtc - 24 * 3_600_000;
     let hi = lo + 48 * 3_600_000;
-    while (hi - lo > 60_000) {
-      const mid = lo + Math.floor((hi - lo) / 2 / 60_000) * 60_000;
-      if (activityDateInTimezone(new Date(mid), timezone) >= date) hi = mid;
-      else lo = mid;
+    while (lo < hi) {
+      const mid = lo + Math.floor((hi - lo) / 2);
+      if (localDate(mid) >= date) hi = mid;
+      else lo = mid + 1;
     }
-    best = hi;
+    best = lo;
   }
   if (best === null || !Number.isFinite(best)) {
     throw new RangeError(`activity: could not resolve a local day start for "${date}" in "${timezone}".`);

package/src/config-discovery.test.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared config discovery (issue #2796).
+ *
+ * The server and CLI resolve their config through `discoverConfigPath`; the
+ * OpenClaw bridge probes `configPathCandidates` directly. These tests pin the
+ * identity the P1 fix restored: for every home-reference form, both surfaces
+ * must land on the same file.
+ */
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { configPathCandidates, discoverConfigPath } from "./config-discovery.js";
+
+const ORIGINAL_ENV = {
+  HOME: process.env.HOME,
+  REMNIC_CONFIG_PATH: process.env.REMNIC_CONFIG_PATH,
+  ENGRAM_CONFIG_PATH: process.env.ENGRAM_CONFIG_PATH,
+};
+
+function restoreEnv(): void {
+  for (const [key, value] of Object.entries(ORIGINAL_ENV)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+}
+
+test("env config paths expand every home-reference form on both surfaces", async () => {
+  const home = await mkdtemp(path.join(os.tmpdir(), "remnic-discovery-home-"));
+  try {
+    process.env.HOME = home;
+    delete process.env.ENGRAM_CONFIG_PATH;
+    const expected = path.join(home, "opt", "remnic.json");
+    for (const form of ["$HOME/opt/remnic.json", "${HOME}/opt/remnic.json", "~/opt/remnic.json"]) {
+      process.env.REMNIC_CONFIG_PATH = form;
+      // The bridge probes candidates[0]; the server/CLI resolver returns the
+      // explicit path. Same form in, same file out — a daemon the server can
+      // discover is never invisible to the bridge.
+      assert.equal(configPathCandidates()[0], expected, `configPathCandidates: ${form}`);
+      assert.equal(discoverConfigPath().path, expected, `discoverConfigPath: ${form}`);
+      assert.equal(discoverConfigPath().explicit, true, `explicit: ${form}`);
+    }
+  } finally {
+    restoreEnv();
+    await rm(home, { recursive: true, force: true });
+  }
+});
+test("no env override leaves auto-discovery candidates only", () => {
+  try {
+    delete process.env.REMNIC_CONFIG_PATH;
+    delete process.env.ENGRAM_CONFIG_PATH;
+    const candidates = configPathCandidates();
+    assert.equal(candidates[0], path.join(process.cwd(), "remnic.config.json"));
+    assert.ok(!candidates[0].includes("$HOME"));
+  } finally {
+    restoreEnv();
+  }
+});

package/src/config-discovery.ts

@@ -0,0 +1,90 @@
+/**
+ * Shared Remnic config-file discovery (issue #2796).
+ *
+ * One implementation of the candidate order every surface uses: explicit
+ * `--config` path, then `REMNIC_CONFIG_PATH`/`ENGRAM_CONFIG_PATH`, then the
+ * first existing candidate under cwd, then the home default. The standalone
+ * server boots from this order and the CLI resolves `--config`-less commands
+ * through it, so the two can never drift onto different files.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+import { readCompatEnv, resolveHomeDir } from "./runtime/env.js";
+
+export interface DiscoveredConfigPath {
+  path: string;
+  explicit: boolean;
+  source: string;
+}
+
+/**
+ * Expand a leading home reference — `~`, `~\`, `$HOME`, or `${HOME}` — to the
+ * resolved home directory. Union of the historical server (tilde only) and
+ * CLI (tilde plus `$HOME` forms) behaviors; every other path passes through
+ * unchanged.
+ */
+function expandHomeReference(p: string): string {
+  if (p === "~" || p.startsWith("~/") || p.startsWith("~\\")) {
+    return resolveHomeDir() + p.slice(1);
+  }
+  const home = resolveHomeDir();
+  if (p === "$HOME" || p.startsWith("$HOME/") || p.startsWith("$HOME\\")) {
+    return home + p.slice(5);
+  }
+  if (p === "${HOME}" || p.startsWith("${HOME}/") || p.startsWith("${HOME}\\")) {
+    return home + p.slice(7);
+  }
+  return p;
+}
+
+/**
+ * The ordered candidates every probing surface walks: the expanded
+ * `REMNIC_CONFIG_PATH`/`ENGRAM_CONFIG_PATH` value (if set), then the cwd
+ * files, then the home defaults. The standalone server and the CLI resolve to
+ * the single file `discoverConfigPath` picks; the OpenClaw bridge probes each
+ * candidate's endpoint. One list, so a daemon the server can discover is never
+ * invisible to the bridge.
+ */
+export function configPathCandidates(): string[] {
+  const envPath = readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH");
+  return [
+    ...(envPath ? [path.resolve(expandHomeReference(envPath))] : []),
+    ...autoDiscoveryCandidates(),
+  ];
+}
+
+function autoDiscoveryCandidates(): string[] {
+  const homeDir = resolveHomeDir();
+  return [
+    path.join(process.cwd(), "remnic.config.json"),
+    path.join(process.cwd(), "engram.config.json"),
+    path.join(homeDir, ".config", "remnic", "config.json"),
+    path.join(homeDir, ".config", "engram", "config.json"),
+  ];
+}
+
+export function discoverConfigPath(cliPath?: string): DiscoveredConfigPath {
+  if (cliPath) {
+    return { path: path.resolve(expandHomeReference(cliPath)), explicit: true, source: "--config" };
+  }
+
+  const envPath = readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH");
+  if (envPath) {
+    return {
+      path: path.resolve(expandHomeReference(envPath)),
+      explicit: true,
+      source: "REMNIC_CONFIG_PATH/ENGRAM_CONFIG_PATH",
+    };
+  }
+
+  const candidates = autoDiscoveryCandidates();
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
+      return { path: candidate, explicit: false, source: "auto-discovery" };
+    }
+  }
+
+  return { path: candidates[2], explicit: false, source: "auto-discovery" };
+}

package/src/index.ts

@@ -18,6 +18,8 @@ export { resolvePluginEntry, type PluginEntryResolverOptions } from "./plugin-en
 
 export { parseConfig, isOpenaiApiKeyDisabled, resolveEnvVars } from "./config.js";
 export { resolveRemnicConfigRecord } from "./config-record.js";
+export { readCompatEnv } from "./runtime/env.js";
+export { configPathCandidates, discoverConfigPath, type DiscoveredConfigPath } from "./config-discovery.js";
 export * from "./external-wiki.js";
 export * from "./external-wiki-cli.js";
 export {