@remnic/core 9.69.39 → 9.69.41

package/dist/{chunk-TNZNSMVJ.js → chunk-NYWCFC3K.js}

@@ -1,3 +1,6 @@
+import {
+  chatgptReplayNormalizer
+} from "./chunk-MMACM5G2.js";
 import {
   claudeReplayNormalizer
 } from "./chunk-54BGIBCR.js";
@@ -5,21 +8,21 @@ import {
   openclawReplayNormalizer
 } from "./chunk-H4CKS5B2.js";
 import {
-  chatgptReplayNormalizer
-} from "./chunk-MMACM5G2.js";
+  importMarkdownBundle
+} from "./chunk-HDDRVXX4.js";
+import {
+  importSqlite
+} from "./chunk-PYHOAXTI.js";
+import {
+  exportJsonBundle
+} from "./chunk-UP6MOYCB.js";
 import {
   exportOkfBundle,
   parseIncludeStatus
-} from "./chunk-VBSNUH4J.js";
+} from "./chunk-ND7MAIJC.js";
 import {
   exportSqlite
 } from "./chunk-BV2TIZ4F.js";
-import {
-  importMarkdownBundle
-} from "./chunk-HDDRVXX4.js";
-import {
-  importSqlite
-} from "./chunk-PYHOAXTI.js";
 import {
   detectImportFormat
 } from "./chunk-OZKVVUJB.js";
@@ -28,13 +31,10 @@ import {
 } from "./chunk-2DL3OFLD.js";
 import {
   backupMemoryDir
-} from "./chunk-2NLLXCJG.js";
+} from "./chunk-BXLOS5AJ.js";
 import {
   exportMarkdownBundle
 } from "./chunk-765K3SAT.js";
-import {
-  exportJsonBundle
-} from "./chunk-UP6MOYCB.js";
 import {
   buildReplayNormalizerRegistry,
   clampBatchSize,
@@ -53,9 +53,12 @@ import {
 import {
   WebDavServer
 } from "./chunk-PYIFUBRK.js";
+import {
+  migrateObservations
+} from "./chunk-IIFFC3RL.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-TA4C3XB7.js";
+} from "./chunk-PFKIOYJH.js";
 import {
   rebuildObservations
 } from "./chunk-DQTCGVFK.js";
@@ -63,8 +66,11 @@ import {
   archiveObservations
 } from "./chunk-YLBE6PLR.js";
 import {
-  migrateObservations
-} from "./chunk-IIFFC3RL.js";
+  getBulkImportSource,
+  listBulkImportSources,
+  registerBulkImportSource,
+  runBulkImportPipeline
+} from "./chunk-HSSERO3E.js";
 import {
   lintOkfDir
 } from "./chunk-UJX4I26O.js";
@@ -72,11 +78,8 @@ import {
   runCompatChecks
 } from "./chunk-2524MOWK.js";
 import {
-  getBulkImportSource,
-  listBulkImportSources,
-  registerBulkImportSource,
-  runBulkImportPipeline
-} from "./chunk-HSSERO3E.js";
+  searchVerifiedEpisodes
+} from "./chunk-IYIPXAIJ.js";
 import {
   getUtilityLearningStatus,
   learnUtilityPromotionWeights
@@ -85,23 +88,20 @@ import {
   getUtilityTelemetryStatus,
   recordUtilityTelemetryEvent
 } from "./chunk-EBA5DA77.js";
-import {
-  searchVerifiedEpisodes
-} from "./chunk-AAZEKXUP.js";
 import {
   ThreadingManager
 } from "./chunk-OJP3N7UK.js";
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-ENBPQEVU.js";
+} from "./chunk-JSD7Q7LD.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-AENM6GKU.js";
+} from "./chunk-E4LMQTST.js";
 import {
   buildResumeBundleFromState,
   getResumeBundleStatus,
   recordResumeBundle
-} from "./chunk-WBM2MVBK.js";
+} from "./chunk-A4OIJYCV.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
@@ -112,7 +112,7 @@ import {
 } from "./chunk-AM4T6CHX.js";
 import {
   parseXrayCliOptions
-} from "./chunk-4BCHFSC7.js";
+} from "./chunk-GWNSKQDA.js";
 import {
   collectPatternMemories,
   explainPatternMemory,
@@ -134,7 +134,7 @@ import {
   runOperatorInventory,
   runOperatorRepair,
   runOperatorSetup
-} from "./chunk-MUTVRKKY.js";
+} from "./chunk-EMSYMYXO.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -169,20 +169,14 @@ import {
   runEvalStoredBaselineCiGate,
   validateEvalBenchmarkPack
 } from "./chunk-4IHBN6WU.js";
-import {
-  GraphDashboardServer
-} from "./chunk-YNDLCWXS.js";
 import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "./chunk-UHRZ324M.js";
+} from "./chunk-E3I3NDUP.js";
 import {
-  applyCommitmentLedgerLifecycle,
-  getCommitmentLedgerStatus,
-  recordCommitmentLedgerEntry,
-  transitionCommitmentLedgerEntryState
-} from "./chunk-NHLLKEKK.js";
+  GraphDashboardServer
+} from "./chunk-EZ25VE3G.js";
 import {
   buildConnectorRowsFromDefinitions,
   parseConnectorsListOptions,
@@ -192,21 +186,31 @@ import {
   renderConnectorsRunResult,
   runConnectorPollOnce
 } from "./chunk-OKTXM5H4.js";
+import {
+  applyCommitmentLedgerLifecycle,
+  getCommitmentLedgerStatus,
+  recordCommitmentLedgerEntry,
+  transitionCommitmentLedgerEntryState
+} from "./chunk-NHLLKEKK.js";
 import {
   chunkContent
 } from "./chunk-6TBIWIAG.js";
 import {
   parseConfig
-} from "./chunk-FWWWUPOE.js";
+} from "./chunk-MCMS4VUK.js";
 import {
+  applyManagedRegion,
   expandVaultTemplateTokens,
+  fileLines,
+  headingSurvivesRoundTrip,
+  parseAtxHeading,
   resolveVaultNotePath,
   validateRegionName
-} from "./chunk-5HYUUFMQ.js";
+} from "./chunk-XCPNH2MG.js";
 import {
   EngramAccessHttpServer,
   MeetingsInputError
-} from "./chunk-EYKIDK33.js";
+} from "./chunk-GMH5QPUU.js";
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
@@ -216,10 +220,13 @@ import {
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal
-} from "./chunk-5SPCMAUC.js";
+} from "./chunk-N6XTC56E.js";
+import {
+  parseDeepRecallMaxSteps
+} from "./chunk-2EYZ32LH.js";
 import {
   EngramAccessService
-} from "./chunk-UZEHHXYC.js";
+} from "./chunk-S4MJTIPG.js";
 import {
   WorkStorage
 } from "./chunk-MPC7TYTZ.js";
@@ -234,44 +241,44 @@ import {
 } from "./chunk-P5FPO2BR.js";
 import {
   journalPath
-} from "./chunk-UZZ7SQT3.js";
+} from "./chunk-JMWUPUE6.js";
 import {
   parseRecallExplainFormat,
   renderRecallExplain,
   renderXray
-} from "./chunk-M6HBPLBA.js";
+} from "./chunk-AUSRUOMQ.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-O4M4BDIJ.js";
+} from "./chunk-563X6JJX.js";
 import {
   getObjectiveStateStoreStatus
 } from "./chunk-HM7RHKS4.js";
 import {
   searchHarmonicRetrieval
-} from "./chunk-4RZLTZVM.js";
+} from "./chunk-AKABVXFS.js";
+import {
+  listMemoryGovernanceRuns,
+  readMemoryGovernanceRunArtifact,
+  restoreMemoryGovernanceRun,
+  runMemoryGovernance
+} from "./chunk-KLUC2GSG.js";
 import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "./chunk-GI4ZBWPQ.js";
+} from "./chunk-W7UV2ZCA.js";
 import {
   getCueAnchorStoreStatus
 } from "./chunk-BMWN7B3Y.js";
 import {
-  listMemoryGovernanceRuns,
-  readMemoryGovernanceRunArtifact,
-  restoreMemoryGovernanceRun,
-  runMemoryGovernance
-} from "./chunk-JTQR6L2N.js";
+  resolveNamespaceChildRoot
+} from "./chunk-3UXOZBHV.js";
 import {
   analyzeGraphHealth
 } from "./chunk-5FAGCOZD.js";
-import {
-  resolveNamespaceChildRoot
-} from "./chunk-3UXOZBHV.js";
 import {
   meetingIdDate
-} from "./chunk-CZTPU65V.js";
+} from "./chunk-ICN37XHG.js";
 import {
   isValidTranscriptDate
 } from "./chunk-UHVXE24Y.js";
@@ -282,7 +289,7 @@ import {
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-IYKZJVL5.js";
+} from "./chunk-WN2OXGGH.js";
 import {
   normalizeProjectionPreview
 } from "./chunk-SCU65EZI.js";
@@ -303,10 +310,6 @@ import {
 import {
   renderExtractionLivenessStats
 } from "./chunk-3SG4FGDV.js";
-import {
-  activityDateInTimezone,
-  isValidActivityDate
-} from "./chunk-353C5UNV.js";
 import {
   SKILL_FILE_NAME,
   SKILL_IMPORT_SOURCE,
@@ -321,6 +324,10 @@ import {
 import {
   buildProcedurePersistBody
 } from "./chunk-QDW3E4RD.js";
+import {
+  activityDateInTimezone,
+  isValidActivityDate
+} from "./chunk-353C5UNV.js";
 import {
   getCausalTrajectoryStoreStatus
 } from "./chunk-L63GFNKL.js";
@@ -328,6 +335,11 @@ import {
   padEndDisplay,
   truncateGraphemeSafe
 } from "./chunk-PJKTFXE2.js";
+import {
+  buildActionConfidenceInputFromOptions,
+  evaluateActionConfidence,
+  renderActionConfidenceText
+} from "./chunk-Z2YFLXHU.js";
 import {
   writeFileAtomically
 } from "./chunk-AW4QUFQF.js";
@@ -340,7 +352,7 @@ import {
 } from "./chunk-C7HJ3NEI.js";
 import {
   isSupportPassportPrivateMemory
-} from "./chunk-37CAEC7E.js";
+} from "./chunk-PWPIERBM.js";
 import {
   inferMemoryStatus,
   isArchivedMemoryPath,
@@ -367,11 +379,6 @@ import {
   resolveSecurityCapabilities,
   resolveUtilityLearningCapabilities
 } from "./chunk-JUOZ62Y7.js";
-import {
-  buildActionConfidenceInputFromOptions,
-  evaluateActionConfidence,
-  renderActionConfidenceText
-} from "./chunk-Z2YFLXHU.js";
 import {
   expandTildePath
 } from "./chunk-6KH5NLQS.js";
@@ -393,9 +400,9 @@ import {
 } from "./chunk-3WCASNQZ.js";
 
 // src/cli.ts
-import path8 from "path";
+import path7 from "path";
 import { access, lstat as lstat3, readFile as readFile2, readdir as readdir3, realpath as realpath3, unlink } from "fs/promises";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 
 // src/wearables/registry.ts
 var registrations = /* @__PURE__ */ new Map();
@@ -1201,32 +1208,28 @@ function registerMeetingsCommands(cmd, orchestrator) {
 }
 
 // src/cli/deep-recall-commands.ts
-function parseMaxSteps(raw) {
-  if (raw === void 0 || raw === null) return void 0;
-  const value = typeof raw === "string" ? Number(raw) : raw;
-  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
-    throw new Error(`--max-steps must be a non-negative integer; got ${JSON.stringify(raw)}`);
-  }
-  return value;
-}
 function registerDeepRecallCommands(cmd, orchestrator) {
-  cmd.command("deep-recall <query>").description("Budgeted multi-hop retrieval over the anchor graph (slow, thorough; issue #2332)").option("--max-steps <n>", "Policy-step ceiling (cannot exceed the configured deepRecall.maxSteps)").option("--namespace <ns>", "Namespace to scope the retrieval to").option("--json", "JSON output (full entries + trace)").action(async (...args) => {
+  cmd.command("deep-recall <query>").description("Budgeted multi-hop retrieval over the anchor graph (slow, thorough; issue #2332)").option("--max-steps <n>", "Policy-step ceiling (cannot exceed the configured deepRecall.maxSteps)").option("--namespace <ns>", "Namespace to scope the retrieval to").option("--session-key <key>", "Session key for principal/namespace resolution (namespaces enabled)").option("--principal <principal>", "Authenticated principal for namespace authorization (namespaces enabled)").option("--json", "JSON output (full entries + trace)").action(async (...args) => {
     const query = String(args[0] ?? "");
     const options = args[args.length - 1] ?? {};
     let maxSteps;
     try {
-      maxSteps = parseMaxSteps(options.maxSteps);
+      maxSteps = parseDeepRecallMaxSteps(options.maxSteps);
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));
       process.exitCode = 1;
       return;
     }
+    const sessionKey = typeof options.sessionKey === "string" && options.sessionKey.trim().length > 0 ? options.sessionKey.trim() : void 0;
+    const principal = typeof options.principal === "string" && options.principal.trim().length > 0 ? options.principal.trim() : void 0;
     const service = new EngramAccessService(orchestrator);
     try {
       const result = await service.deepRecall({
         query,
         ...maxSteps !== void 0 ? { maxSteps } : {},
-        ...typeof options.namespace === "string" && options.namespace.length > 0 ? { namespace: options.namespace } : {}
+        ...typeof options.namespace === "string" && options.namespace.length > 0 ? { namespace: options.namespace } : {},
+        ...sessionKey !== void 0 ? { sessionKey } : {},
+        ...principal !== void 0 ? { authenticatedPrincipal: principal } : {}
       });
       if (options.json === true) {
         console.log(JSON.stringify(result, null, 2));
@@ -2082,215 +2085,122 @@ function registerCreationLedgerCommands(cmd, orchestrator) {
 }
 
 // src/activity/timeline/publish-cli.ts
-import { existsSync, readFileSync as readFileSync4 } from "fs";
+import { existsSync, readFileSync as readFileSync3 } from "fs";
 
 // src/activity/vault-publisher.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { chmodSync, chownSync, lstatSync, mkdirSync, readFileSync as readFileSync3, realpathSync, renameSync as renameSync2, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
-import path5 from "path";
-
-// src/activity/vault-publish.ts
 import { createHash, randomBytes } from "crypto";
-import { readFileSync as readFileSync2, renameSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "fs";
+import { chmodSync, chownSync, lstatSync, mkdirSync, readFileSync as readFileSync2, realpathSync, renameSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "fs";
 import path4 from "path";
-function applyManagedRegion(fileText, opts) {
-  if (opts.strategy === "heading") return applyHeadingRegion(fileText, opts.name, opts.content);
-  const startMarker = `<!-- remnic:${opts.name}:start -->`;
-  const endMarker = `<!-- remnic:${opts.name}:end -->`;
-  const rows = fileLines(fileText);
-  let startRow;
-  let endRow;
-  for (const row of rows) {
-    if (row.fenced) continue;
-    const trimmed = row.line.trim();
-    if (startRow === void 0) {
-      if (trimmed === startMarker) startRow = row;
-    } else if (endRow === void 0 && trimmed === endMarker) {
-      endRow = row;
-      break;
-    }
+
+// src/activity/vault-frontmatter.ts
+function assertNoNewlineKey(key) {
+  if (key.includes("\n") || key.includes("\r")) {
+    throw new RangeError("Vault frontmatter keys must not contain newlines.");
+  }
+}
+function applyVaultFrontmatter(existingYaml, updates) {
+  const entries = Object.entries(updates);
+  if (entries.length === 0) return existingYaml;
+  const merged = /* @__PURE__ */ new Map();
+  for (const line of existingYaml.split("\n")) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim();
+    if (key.length === 0) continue;
+    assertNoNewlineKey(key);
+    merged.set(key, line.slice(idx + 1).trim());
   }
-  if (startRow === void 0 || endRow === void 0) {
-    return { ok: false, reason: "no_marker", text: fileText };
+  for (const [key, value] of entries) {
+    assertNoNewlineKey(key);
+    merged.set(key, value);
   }
-  const { body, eol } = ownedBody(fileText, opts.content);
-  return {
-    ok: true,
-    text: `${fileText.slice(0, startRow.start + startRow.line.length)}${eol}${body}${eol}${fileText.slice(endRow.start)}`
-  };
+  return [...merged.keys()].sort((a, b) => a < b ? -1 : a > b ? 1 : 0).map((key) => `${key}: ${merged.get(key)}`).join("\n");
 }
-function applyHeadingRegion(fileText, name, content) {
-  const wanted = name.trim();
-  const rows = fileLines(fileText);
-  const hits = [];
-  for (const row of rows) {
-    if (row.fenced) continue;
-    const heading = parseAtxHeading(row.line);
-    if (heading && heading.text === wanted) {
-      hits.push({ line: row.number, level: heading.level, next: row.next });
-    }
+var VAULT_PROPERTY_KEY_MAX_CHARS = 64;
+var VAULT_PROPERTY_SCALAR_MAX_CHARS = 200;
+var VAULT_PROPERTY_LIST_MAX_ITEMS = 20;
+var VAULT_PROPERTY_TOTAL_MAX_CHARS = 2e3;
+var CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/;
+var INDICATOR_CHARS = ",[]{}#&*!|>'\"%@`";
+var INJECTION_RE = /: | #/;
+var FLOW_ITEM_DELIM_RE = /[[\]{},]/;
+function renderVaultPropertyValue(value) {
+  return typeof value === "string" ? value : `[${value.join(", ")}]`;
+}
+function hasLeadingYamlIndicator(text) {
+  const first = text[0];
+  if (first === void 0) return false;
+  return INDICATOR_CHARS.includes(first) || "-?:".includes(first) && text[1] === " ";
+}
+function validateScalar(value, label) {
+  if (value.length === 0) {
+    return { ok: false, reason: `${label} must not be empty` };
   }
-  if (hits.length === 0) return { ok: false, reason: "no_heading", text: fileText };
-  if (hits.length > 1) {
-    return { ok: false, reason: "duplicate_heading", lines: hits.map((hit2) => hit2.line), text: fileText };
+  if (value.length > VAULT_PROPERTY_SCALAR_MAX_CHARS) {
+    return { ok: false, reason: `${label} exceeds ${VAULT_PROPERTY_SCALAR_MAX_CHARS} characters` };
   }
-  const hit = hits[0];
-  let sectionEnd = fileText.length;
-  for (const row of rows) {
-    if (row.start < hit.next || row.fenced) continue;
-    const heading = parseAtxHeading(row.line);
-    if (heading && heading.level <= hit.level) {
-      sectionEnd = row.start;
-      break;
-    }
+  if (CONTROL_RE.test(value)) {
+    return { ok: false, reason: `${label} must not contain control characters or line breaks` };
   }
-  const { body, eol } = ownedBody(fileText, demoteOwnedHeadings(content, hit.level));
-  const prefix = hit.next === fileText.length && !fileText.endsWith("\n") && !fileText.endsWith("\r") ? `${fileText}${eol}` : fileText.slice(0, hit.next);
-  return { ok: true, text: `${prefix}${body}${eol}${fileText.slice(sectionEnd)}` };
-}
-function demoteOwnedHeadings(content, owningLevel) {
-  const rows = fileLines(content);
-  let out = "";
-  let cursor = 0;
-  for (const row of rows) {
-    const heading = row.fenced ? null : parseAtxHeading(row.line);
-    if (heading === null) continue;
-    const level = Math.min(owningLevel + heading.level, 6);
-    const replacement = level > owningLevel ? `${"#".repeat(level)} ${heading.text}` : `**${heading.text}**`;
-    out += content.slice(cursor, row.start) + replacement;
-    cursor = row.start + row.line.length;
+  if (value !== value.trim()) {
+    return { ok: false, reason: `${label} must not carry leading or trailing whitespace` };
+  }
+  if (hasLeadingYamlIndicator(value)) {
+    return { ok: false, reason: `${label} must be a plain scalar (leading "${value[0]}" changes its YAML shape)` };
   }
-  return out + content.slice(cursor);
+  if (INJECTION_RE.test(value)) {
+    return { ok: false, reason: `${label} must not contain ": " or " #"` };
+  }
+  if (value.endsWith(":")) {
+    return { ok: false, reason: `${label} must not end with ":"` };
+  }
+  return { ok: true };
 }
-function ownedBody(fileText, content) {
-  const eol = fileText.includes("\r\n") ? "\r\n" : "\n";
-  let body = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-  if (eol === "\r\n") body = body.replace(/\n/g, "\r\n");
-  if (body.endsWith(eol)) body = body.slice(0, -eol.length);
-  return { body, eol };
-}
-function fileLines(fileText) {
-  const rows = [];
-  let start = 0;
-  let number = 1;
-  let fence = null;
-  while (start < fileText.length) {
-    let i = start;
-    while (i < fileText.length && fileText[i] !== "\n" && fileText[i] !== "\r") i++;
-    let next = i;
-    if (fileText[i] === "\r" && fileText[i + 1] === "\n") next = i + 2;
-    else if (fileText[i] === "\n" || fileText[i] === "\r") next = i + 1;
-    else next = fileText.length;
-    const line = fileText.slice(start, i);
-    const indentedCode = indentColumn(line) >= 4;
-    const run = indentedCode ? null : fenceRun(line);
-    let fenced;
-    if (fence === null) {
-      if (run !== null && !(run.char === "`" && run.info.includes("`"))) {
-        fence = { char: run.char, len: run.len };
-      }
-      fenced = fence !== null || indentedCode;
+function validateVaultProperties(entries) {
+  let total = 0;
+  for (const { key, value } of entries) {
+    if (key.length === 0) {
+      return { ok: false, reason: "property keys must not be empty" };
+    }
+    if (key.length > VAULT_PROPERTY_KEY_MAX_CHARS) {
+      return { ok: false, reason: `property key exceeds ${VAULT_PROPERTY_KEY_MAX_CHARS} characters` };
+    }
+    if (CONTROL_RE.test(key) || key !== key.trim() || key.includes(":") || key.includes("#") || hasLeadingYamlIndicator(key)) {
+      return { ok: false, reason: `property key ${JSON.stringify(key)} is not a plain mapping key` };
+    }
+    if (typeof value === "string") {
+      const scalar = validateScalar(value, `property ${key}`);
+      if (!scalar.ok) return scalar;
     } else {
-      fenced = true;
-      if (run !== null && run.char === fence.char && run.len >= fence.len && run.info.length === 0) {
-        fence = null;
+      if (!Array.isArray(value) || value.length === 0) {
+        return { ok: false, reason: `property ${key} must be a scalar string or a non-empty list of scalar strings` };
+      }
+      if (value.length > VAULT_PROPERTY_LIST_MAX_ITEMS) {
+        return { ok: false, reason: `property ${key} exceeds ${VAULT_PROPERTY_LIST_MAX_ITEMS} list items` };
+      }
+      for (const item of value) {
+        if (typeof item !== "string") {
+          return { ok: false, reason: `property ${key} must be a scalar string or a list of scalar strings` };
+        }
+        const scalar = validateScalar(item, `property ${key} list item`);
+        if (!scalar.ok) return scalar;
+        if (FLOW_ITEM_DELIM_RE.test(item)) {
+          return {
+            ok: false,
+            reason: `property ${key} list item must not contain flow delimiters "[", "]", "{", "}", or ","`
+          };
+        }
       }
     }
-    rows.push({ line, start, next, number, fenced });
-    number += 1;
-    start = next;
-  }
-  return rows;
-}
-function indentColumn(line) {
-  let col = 0;
-  for (let i = 0; i < line.length; i += 1) {
-    const ch = line[i];
-    if (ch === " ") col += 1;
-    else if (ch === "	") col += 4 - col % 4;
-    else break;
-  }
-  return col;
-}
-function fenceRun(line) {
-  const body = line.trimStart();
-  const char = body[0];
-  if (char !== "`" && char !== "~") return null;
-  let len = 0;
-  while (len < body.length && body[len] === char) len++;
-  if (len < 3) return null;
-  return { char, len, info: body.slice(len).trim() };
-}
-function parseAtxHeading(line) {
-  let at = 0;
-  let indent = 0;
-  while (at < line.length && (line[at] === " " || line[at] === "	")) {
-    indent += line[at] === " " ? 1 : 4 - indent % 4;
-    if (indent >= 4) return null;
-    at += 1;
-  }
-  let level = 0;
-  while (level < 6 && line[at + level] === "#") level++;
-  if (level === 0) return null;
-  const after = line[at + level];
-  if (after !== " " && after !== "	") return null;
-  let start = at + level + 1;
-  let end = line.length;
-  while (start < end && (line[start] === " " || line[start] === "	")) start++;
-  while (end > start && (line[end - 1] === " " || line[end - 1] === "	")) end--;
-  let hashEnd = end;
-  while (hashEnd > start && line[hashEnd - 1] === "#") hashEnd--;
-  if (hashEnd < end && hashEnd > start && (line[hashEnd - 1] === " " || line[end - 1] === "	")) {
-    end = hashEnd;
-    while (end > start && (line[end - 1] === " " || line[end - 1] === "	")) end--;
-  }
-  return { level, text: line.slice(start, end) };
-}
-function publishVaultRegion(input) {
-  const vault = expandTildePath(input.vaultPath);
-  try {
-    if (!statSync2(vault).isDirectory()) return { ok: false, reason: "not_directory" };
-  } catch {
-    return { ok: false, reason: "not_directory" };
-  }
-  if (input.relativeFile.length === 0 || path4.isAbsolute(input.relativeFile)) {
-    return { ok: false, reason: "missing_file" };
-  }
-  const root = path4.resolve(vault);
-  const dest = path4.resolve(root, input.relativeFile);
-  const rel = path4.relative(root, dest);
-  if (rel.length === 0 || rel.startsWith("..") || path4.isAbsolute(rel)) {
-    return { ok: false, reason: "missing_file" };
-  }
-  let existing;
-  try {
-    if (!statSync2(dest).isFile()) return { ok: false, reason: "missing_file" };
-    existing = readFileSync2(dest, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return { ok: false, reason: "missing_file" };
-    throw err;
-  }
-  const applied = applyManagedRegion(existing, {
-    strategy: "markers",
-    name: input.name,
-    content: input.content
-  });
-  if (!applied.ok) return { ok: false, reason: "no_marker" };
-  const prevHash = createHash("sha256").update(existing, "utf8").digest("hex");
-  const nextHash = createHash("sha256").update(applied.text, "utf8").digest("hex");
-  if (prevHash === nextHash) return { ok: true, status: "unchanged" };
-  const tmpPath = path4.join(path4.dirname(dest), `.remnic-vault-${randomBytes(8).toString("hex")}.tmp`);
-  writeFileSync(tmpPath, applied.text);
-  try {
-    renameSync(tmpPath, dest);
-  } catch (renameErr) {
-    try {
-      unlinkSync2(tmpPath);
-    } catch {
+    total += key.length + 2 + renderVaultPropertyValue(value).length;
+    if (total > VAULT_PROPERTY_TOTAL_MAX_CHARS) {
+      return {
+        ok: false,
+        reason: `frontmatter properties exceed the ${VAULT_PROPERTY_TOTAL_MAX_CHARS}-character total`
+      };
     }
-    throw renameErr;
   }
-  return { ok: true, status: "updated" };
+  return { ok: true };
 }
 
 // src/activity/vault-insert.ts
@@ -2420,6 +2330,32 @@ function publishVaultNote(input) {
       throw new RangeError(`Section name ${JSON.stringify(section.name)} is not a valid region name.`);
     }
   }
+  const headingsToProbe = strategy === "heading" ? input.sections.map((section) => section.name) : [];
+  if (typeof input.insertUnderHeading === "string" && input.insertUnderHeading.length > 0) {
+    headingsToProbe.push(input.insertUnderHeading);
+  }
+  for (const headingName of headingsToProbe) {
+    if (!headingSurvivesRoundTrip(headingName)) {
+      throw new RangeError(
+        `Section name ${JSON.stringify(headingName)} is not matchable by the heading parser; it must survive a render-and-parse round trip.`
+      );
+    }
+  }
+  const propertyEntries = [];
+  for (const section of input.sections) {
+    if (!section.properties) continue;
+    for (const key of Object.keys(section.properties)) {
+      const value = section.properties[key];
+      if (value === void 0) continue;
+      propertyEntries.push({ key: `${prefix}${key}`, value });
+    }
+  }
+  if (propertyEntries.length > 0) {
+    const checked = validateVaultProperties(propertyEntries);
+    if (!checked.ok) {
+      throw new RangeError(`Vault publish properties rejected: ${checked.reason}.`);
+    }
+  }
   const relative = resolveVaultNotePath(input.notePathTemplate, input.date);
   const result = publishRelative(input, relative, { strategy, propertiesMode, prefix });
   return summarizeVaultPublish(result);
@@ -2432,10 +2368,10 @@ function publishRelative(input, relative, opts) {
   } catch {
     return refuse(relative, "error", "not_directory");
   }
-  const root = path5.resolve(vault);
-  const dest = path5.resolve(root, relative);
-  const lexical = path5.relative(root, dest);
-  if (lexical.length === 0 || lexical === ".." || lexical.startsWith(`..${path5.sep}`) || path5.isAbsolute(lexical)) {
+  const root = path4.resolve(vault);
+  const dest = path4.resolve(root, relative);
+  const lexical = path4.relative(root, dest);
+  if (lexical.length === 0 || lexical === ".." || lexical.startsWith(`..${path4.sep}`) || path4.isAbsolute(lexical)) {
     return refuse(relative, "error", "path_escape");
   }
   if (!containedBySymlinks(root, dest)) {
@@ -2447,14 +2383,14 @@ function publishRelative(input, relative, opts) {
     if (lstatSync(dest).isSymbolicLink()) {
       return refuse(relative, "error", "symlinked_note");
     }
-    const st = statSync3(dest);
+    const st = statSync2(dest);
     if (st.isFile()) {
-      currentText = readFileSync3(dest, "utf8");
+      currentText = readFileSync2(dest, "utf8");
       expected = {
         ino: st.ino,
         mtimeMs: st.mtimeMs,
         size: st.size,
-        sha256: createHash2("sha256").update(currentText, "utf8").digest("hex")
+        sha256: createHash("sha256").update(currentText, "utf8").digest("hex")
       };
     } else return refuse(relative, "error", "not_a_file");
   } catch (err) {
@@ -2463,13 +2399,13 @@ function publishRelative(input, relative, opts) {
   let created = false;
   if (currentText === null) {
     if (input.createMissingNotes === true && typeof input.noteTemplate === "string" && input.noteTemplate.length > 0) {
-      const templatePath = path5.resolve(root, input.noteTemplate);
-      const templateRel = path5.relative(root, templatePath);
-      if (templateRel === ".." || templateRel.startsWith(`..${path5.sep}`) || path5.isAbsolute(templateRel) || templateRel.length === 0 || !containedBySymlinks(root, templatePath)) {
+      const templatePath = path4.resolve(root, input.noteTemplate);
+      const templateRel = path4.relative(root, templatePath);
+      if (templateRel === ".." || templateRel.startsWith(`..${path4.sep}`) || path4.isAbsolute(templateRel) || templateRel.length === 0 || !containedBySymlinks(root, templatePath)) {
         return refuse(relative, "error", "template_escape");
       }
       try {
-        const templateText = readFileSync3(templatePath, "utf8");
+        const templateText = readFileSync2(templatePath, "utf8");
         currentText = expandVaultTemplateTokens(templateText, input.date);
         if (!currentText.endsWith("\n")) currentText += "\n";
         created = true;
@@ -2516,8 +2452,8 @@ function publishRelative(input, relative, opts) {
       text = merged.text;
     }
   }
-  const prevHash = createHash2("sha256").update(original, "utf8").digest("hex");
-  const nextHash = createHash2("sha256").update(text, "utf8").digest("hex");
+  const prevHash = createHash("sha256").update(original, "utf8").digest("hex");
+  const nextHash = createHash("sha256").update(text, "utf8").digest("hex");
   if (prevHash === nextHash) {
     return withSkipped([{ path: relative, outcome: "unchanged" }]);
   }
@@ -2526,7 +2462,7 @@ function publishRelative(input, relative, opts) {
   }
   if (created) {
     try {
-      mkdirSync(path5.dirname(dest), { recursive: true });
+      mkdirSync(path4.dirname(dest), { recursive: true });
     } catch {
       return refuse(relative, "error", "mkdir_failed");
     }
@@ -2547,7 +2483,7 @@ function decorate(section, prefixed, mode) {
   const parts = [section.content];
   if (prefixed !== void 0 && mode === "dataview-inline") {
     for (const [key, value] of Object.entries(prefixed)) {
-      parts.push(`${key}:: ${value}`);
+      parts.push(`${key}:: ${renderVaultPropertyValue(value)}`);
     }
   }
   if (section.provenance !== void 0) {
@@ -2641,17 +2577,21 @@ function frontmatterUpdates(sections, prefix) {
 function mergeFrontmatterKeys(noteText, updates) {
   const entries = Object.entries(updates);
   if (entries.length === 0) return { ok: true, text: noteText };
-  for (const [key] of entries) {
-    if (key.includes("\n") || key.includes("\r") || key.trim() !== key || key.length === 0) {
-      return { ok: false, reason: "invalid_property_key" };
-    }
+  const checked = validateVaultProperties(entries.map(([key, value]) => ({ key, value })));
+  if (!checked.ok) {
+    return { ok: false, reason: "invalid_property" };
   }
   const eol = noteText.includes("\r\n") ? "\r\n" : "\n";
   const openRe = /^---\r?$/;
   const firstLineEnd = noteText.indexOf("\n");
   const firstLine = firstLineEnd === -1 ? noteText : noteText.slice(0, firstLineEnd);
   if (!openRe.test(firstLine)) {
-    const block = ["---", ...entries.map(([key, value]) => `${key}: ${value}`), "---", ""].join(eol);
+    const block = [
+      "---",
+      ...entries.map(([key, value]) => `${key}: ${renderVaultPropertyValue(value)}`),
+      "---",
+      ""
+    ].join(eol);
     return { ok: true, text: block + eol + noteText };
   }
   const lines = noteText.split(eol);
@@ -2674,13 +2614,13 @@ function mergeFrontmatterKeys(noteText, updates) {
     if (rawKey !== rawKey.trimStart()) continue;
     const key = rawKey.trimEnd();
     if (!pending.has(key)) continue;
-    lines[i] = `${rawKey}: ${pending.get(key)}`;
+    lines[i] = `${rawKey}: ${renderVaultPropertyValue(pending.get(key))}`;
     pending.delete(key);
   }
   const insertAt = closeIdx;
   const added = [];
   for (const [key, value] of pending.entries()) {
-    added.push(`${key}: ${value}`);
+    added.push(`${key}: ${renderVaultPropertyValue(value)}`);
   }
   lines.splice(insertAt, 0, ...added);
   return { ok: true, text: lines.join(eol) };
@@ -2690,13 +2630,13 @@ function containedBySymlinks(root, dest) {
   let probe = dest;
   for (; ; ) {
     try {
-      if (lstatSync(probe).isSymbolicLink() || statSync3(probe).isFile() || statSync3(probe).isDirectory()) {
+      if (lstatSync(probe).isSymbolicLink() || statSync2(probe).isFile() || statSync2(probe).isDirectory()) {
         const real = realpathSync(probe);
-        return real === realRoot || real.startsWith(`${realRoot}${path5.sep}`);
+        return real === realRoot || real.startsWith(`${realRoot}${path4.sep}`);
       }
     } catch {
     }
-    const parent = path5.dirname(probe);
+    const parent = path4.dirname(probe);
     if (parent === probe) return false;
     probe = parent;
   }
@@ -2706,11 +2646,11 @@ function setVaultPublisherTestHooks(hooks) {
   vaultPublisherTestHooks = hooks;
 }
 function writeAtomic(dest, text, expect) {
-  const tmpPath = path5.join(path5.dirname(dest), `.remnic-vault-${randomBytes2(8).toString("hex")}.tmp`);
-  writeFileSync2(tmpPath, text);
+  const tmpPath = path4.join(path4.dirname(dest), `.remnic-vault-${randomBytes(8).toString("hex")}.tmp`);
+  writeFileSync(tmpPath, text);
   let prev = null;
   try {
-    prev = statSync3(dest);
+    prev = statSync2(dest);
   } catch {
     prev = null;
   }
@@ -2724,30 +2664,30 @@ function writeAtomic(dest, text, expect) {
   vaultPublisherTestHooks?.beforeReplaceVerify?.(dest);
   try {
     const concurrent = expect === null ? prev !== null : prev === null || // the note vanished since it was read
-    prev.ino !== expect.ino || prev.mtimeMs !== expect.mtimeMs || prev.size !== expect.size || createHash2("sha256").update(readFileSync3(dest, "utf8"), "utf8").digest("hex") !== expect.sha256;
+    prev.ino !== expect.ino || prev.mtimeMs !== expect.mtimeMs || prev.size !== expect.size || createHash("sha256").update(readFileSync2(dest, "utf8"), "utf8").digest("hex") !== expect.sha256;
     if (concurrent) {
       try {
-        unlinkSync3(tmpPath);
+        unlinkSync2(tmpPath);
       } catch {
       }
       return "concurrent";
     }
   } catch {
     try {
-      unlinkSync3(tmpPath);
+      unlinkSync2(tmpPath);
     } catch {
     }
     return "concurrent";
   }
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      renameSync2(tmpPath, dest);
+      renameSync(tmpPath, dest);
       return "written";
     } catch (err) {
       const code = err.code;
       if (attempt === 1 || code !== "EBUSY" && code !== "EPERM") {
         try {
-          unlinkSync3(tmpPath);
+          unlinkSync2(tmpPath);
         } catch {
         }
         if (code === "EBUSY" || code === "EPERM") return "failed";
@@ -2778,6 +2718,11 @@ function runTimelinePublishCli(config, options, io) {
     );
     return 1;
   }
+  if (options.date !== void 0 && (typeof options.date !== "string" || options.date.length === 0)) {
+    io.stderr.write(`Invalid --date ${JSON.stringify(options.date ?? "")}; expected YYYY-MM-DD.
+`);
+    return 1;
+  }
   const date = typeof options.date === "string" && options.date.length > 0 ? options.date : activityDateInTimezone(/* @__PURE__ */ new Date(), config.activity?.timezone ?? "UTC");
   if (!isValidActivityDate(date)) {
     io.stderr.write(`Invalid --date "${date}"; expected YYYY-MM-DD.
@@ -2813,7 +2758,7 @@ function runTimelinePublishCli(config, options, io) {
       );
       return 1;
     }
-    sections.push({ name: target.section, content: readFileSync4(source, "utf8").trimEnd() });
+    sections.push({ name: target.section, content: readFileSync3(source, "utf8").trimEnd() });
   }
   const status = publishVaultNote({
     vaultPath: vault.vaultPath,
@@ -2861,6 +2806,11 @@ function parseKinds(raw) {
 function registerTimelineCommands(cmd, orchestrator) {
   const timelineCmd = cmd.command("timeline").description("Timeline artifacts: publish the day's recap into a markdown vault (issue #1985)");
   timelineCmd.command("publish").description("Publish timeline artifacts into the vault daily note via managed regions").option("--date <date>", "Local day to publish (YYYY-MM-DD; defaults to today)").option("--week <week>", "ISO week to publish (YYYY-Www)").option("--what <kinds>", "Comma-separated artifacts to publish (default: timeline)").option("--dry-run", "Report per-file outcomes without writing").action((...args) => {
+    if (args.some((arg) => typeof arg === "string")) {
+      process.stderr.write("timeline publish takes no positional arguments.\n");
+      process.exitCode = 1;
+      return;
+    }
     const options = args[0] ?? {};
     const code = runTimelinePublishCli(orchestrator.config, options, {
       stdout: process.stdout,
@@ -2871,10 +2821,10 @@ function registerTimelineCommands(cmd, orchestrator) {
 }
 
 // src/maintenance/rebuild-memory-lifecycle-ledger-cli.ts
-import path6 from "path";
+import path5 from "path";
 async function runRebuildMemoryLifecycleLedgerCliCommand(options) {
   const storage = options.storage;
-  const ledgerPath = path6.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
+  const ledgerPath = path5.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
   const encrypted = await probeEncryptedRegularFileHeader(ledgerPath);
   if (encrypted && !(storage?.isSecureStoreUnlocked() ?? false)) {
     throw new Error(
@@ -3372,7 +3322,7 @@ assistant> ${result.reply}
 // src/training-export/converter.ts
 import { constants } from "fs";
 import { lstat as lstat2, open, readdir as readdir2, realpath as realpath2 } from "fs/promises";
-import path7 from "path";
+import path6 from "path";
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
   if (!match) return null;
@@ -3412,7 +3362,7 @@ async function safeRealpath(p) {
   }
 }
 function isContainedPath(real, containmentRoot) {
-  return real === containmentRoot || real.startsWith(containmentRoot + path7.sep);
+  return real === containmentRoot || real.startsWith(containmentRoot + path6.sep);
 }
 async function collectMarkdownFiles(dir, containmentRoot) {
   const files = [];
@@ -3432,7 +3382,7 @@ async function collectMarkdownFiles(dir, containmentRoot) {
     }
     const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of sorted) {
-      const full = path7.join(d, entry.name);
+      const full = path6.join(d, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         await walk(full);
@@ -3514,9 +3464,9 @@ async function convertMemoriesToRecords(options) {
   const { memoryDir } = options;
   const containmentRoot = await safeRealpath(memoryDir);
   if (!containmentRoot) return [];
-  const dirs = RECALL_FALLBACK_DIRS.map((dir) => path7.join(memoryDir, dir));
+  const dirs = RECALL_FALLBACK_DIRS.map((dir) => path6.join(memoryDir, dir));
   if (options.includeEntities) {
-    dirs.push(path7.join(memoryDir, "entities"));
+    dirs.push(path6.join(memoryDir, "entities"));
   }
   const allFiles = [];
   for (const dir of dirs) {
@@ -3779,14 +3729,14 @@ async function runTrainingExportCliCommand(opts) {
       `Unknown training-export format "${opts.format}". ${validList}`
     );
   }
-  const { statSync: statSync4, existsSync: existsSync2 } = await import("fs");
+  const { statSync: statSync3, existsSync: existsSync2 } = await import("fs");
   if (!existsSync2(expandedMemoryDir)) {
     throw new Error(
       `--memory-dir "${opts.memoryDir}" does not exist. Provide the path to an existing memory directory.`
     );
   }
   try {
-    if (!statSync4(expandedMemoryDir).isDirectory()) {
+    if (!statSync3(expandedMemoryDir).isDirectory()) {
       throw new Error(
         `--memory-dir "${opts.memoryDir}" is not a directory. Provide the path to a memory directory, not a file.`
       );
@@ -4521,10 +4471,10 @@ function effectivePolicyValuesForVersion(values, config) {
 }
 function policyVersionForValues(values, config) {
   const normalized = effectivePolicyValuesForVersion(values, config);
-  return createHash3("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 12);
 }
 async function readRuntimePolicySnapshot2(config, fileName) {
-  const filePath = path8.join(config.memoryDir, "state", fileName);
+  const filePath = path7.join(config.memoryDir, "state", fileName);
   const snapshot = await readRuntimePolicySnapshot(filePath, {
     maxStaleDecayThreshold: config.lifecycleArchiveDecayThreshold
   });
@@ -5301,7 +5251,7 @@ async function exists(p) {
   }
 }
 function assertSafeNamespaceSegment(namespace) {
-  if (namespace.length === 0 || namespace === "." || namespace === ".." || namespace.includes("/") || namespace.includes("\\") || path8.isAbsolute(namespace) || path8.win32.isAbsolute(namespace)) {
+  if (namespace.length === 0 || namespace === "." || namespace === ".." || namespace.includes("/") || namespace.includes("\\") || path7.isAbsolute(namespace) || path7.win32.isAbsolute(namespace)) {
     throw new Error(`invalid namespace: ${namespace}`);
   }
 }
@@ -5351,7 +5301,7 @@ async function walkMemoryMarkdownFiles(memoryDir, visit) {
     for (const entry of entries) {
       if (entry.isSymbolicLink()) continue;
       const entryName = typeof entry.name === "string" ? entry.name : entry.name.toString("utf-8");
-      const fullPath = path8.join(dir, entryName);
+      const fullPath = path7.join(dir, entryName);
       try {
         assertPathInsideRoot(memoryRootReal, await realpath3(fullPath), fullPath);
       } catch (err) {
@@ -5366,7 +5316,7 @@ async function walkMemoryMarkdownFiles(memoryDir, visit) {
       await visit(fullPath);
     }
   };
-  for (const root of RECALL_FALLBACK_DIRS.map((dir) => path8.join(memoryDir, dir))) {
+  for (const root of RECALL_FALLBACK_DIRS.map((dir) => path7.join(memoryDir, dir))) {
     await walk(root);
   }
 }
@@ -5694,7 +5644,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
       );
       tierCmd.command("list").description("Summarize tier distribution across all memories").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
-        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-LUSUUNU6.js");
+        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-VK5PCO2L.js");
         const summary = await summarizeTiers(orchestrator.storage);
         if (reportHasMachineReadableOutput(options)) {
           console.log(JSON.stringify(summary, null, 2));
@@ -5705,7 +5655,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
       tierCmd.command("explain").description("Explain the tier-transition decision for a single memory").argument("<id>", "Memory id to explain").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const idArg = typeof args[0] === "string" ? args[0] : "";
         const options = args[1] ?? {};
-        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-LUSUUNU6.js");
+        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-VK5PCO2L.js");
         try {
           const explain = await explainTierForMemory(
             orchestrator.storage,
@@ -5976,7 +5926,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         if (plan.moved.length > 0) {
           console.log("\nEntries:");
           for (const move of plan.moved) {
-            console.log(`- ${path8.basename(move.from)}`);
+            console.log(`- ${path7.basename(move.from)}`);
           }
         }
         if (dryRun) {
@@ -6277,15 +6227,15 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         const capsulesDir = defaultCapsulesDir(memoryDir);
         const { stat: statMerge } = await import("fs/promises");
         let sourceArchive = expandTildePath(parsed.archive);
-        const looksLikePath = sourceArchive.startsWith("/") || sourceArchive.startsWith("./") || sourceArchive.startsWith("../") || sourceArchive.includes(path8.sep);
+        const looksLikePath = sourceArchive.startsWith("/") || sourceArchive.startsWith("./") || sourceArchive.startsWith("../") || sourceArchive.includes(path7.sep);
         if (!looksLikePath) {
-          const cwdResolved = path8.resolve(sourceArchive);
+          const cwdResolved = path7.resolve(sourceArchive);
           const cwdSt = await statMerge(cwdResolved).catch(() => null);
           if (cwdSt && cwdSt.isFile()) {
             sourceArchive = cwdResolved;
           } else {
-            const byId = path8.join(capsulesDir, `${sourceArchive}.capsule.json.gz`);
-            const byIdEnc = path8.join(capsulesDir, `${sourceArchive}.capsule.json.gz.enc`);
+            const byId = path7.join(capsulesDir, `${sourceArchive}.capsule.json.gz`);
+            const byIdEnc = path7.join(capsulesDir, `${sourceArchive}.capsule.json.gz.enc`);
             const stId = await statMerge(byId).catch(() => null);
             if (stId && stId.isFile()) {
               sourceArchive = byId;
@@ -6298,7 +6248,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           }
         }
         if (sourceArchive.endsWith(".enc")) {
-          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-7FJQINUR.js");
+          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-YO5QJ6L3.js");
           const encDetected = await isEncryptedCapsuleFile(sourceArchive).catch(() => true);
           if (encDetected) {
             throw new Error(
@@ -6306,7 +6256,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
             );
           }
         }
-        const { mergeCapsule } = await import("./capsule-merge-IPG4IOFP.js");
+        const { mergeCapsule } = await import("./capsule-merge-3MNURAQ3.js");
         const result = await mergeCapsule({
           sourceArchive,
           targetRoot: memoryDir,
@@ -6366,10 +6316,10 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         ).sort();
         const entries = [];
         for (const archiveName of archives) {
-          const archivePath = path8.join(capsulesDir, archiveName);
+          const archivePath = path7.join(capsulesDir, archiveName);
           const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
           const manifestName = `${id}.manifest.json`;
-          const manifestPath = path8.join(capsulesDir, manifestName);
+          const manifestPath = path7.join(capsulesDir, manifestName);
           let createdAt = null;
           let pluginVersion = null;
           let fileCount = null;
@@ -6424,15 +6374,15 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         const parsed = parseCapsuleInspectOptions(archiveArg, opts);
         const { stat } = await import("fs/promises");
         let archivePath = expandTildePath(parsed.archive);
-        const looksLikePath = archivePath.startsWith("/") || archivePath.startsWith("./") || archivePath.startsWith("../") || archivePath.includes(path8.sep);
+        const looksLikePath = archivePath.startsWith("/") || archivePath.startsWith("./") || archivePath.startsWith("../") || archivePath.includes(path7.sep);
         if (!looksLikePath) {
-          const cwdResolved = path8.resolve(archivePath);
+          const cwdResolved = path7.resolve(archivePath);
           const cwdSt = await stat(cwdResolved).catch(() => null);
           if (cwdSt && cwdSt.isFile()) {
             archivePath = cwdResolved;
           } else {
-            const byId = path8.join(capsulesDir, `${archivePath}.capsule.json.gz`);
-            const byIdEnc = path8.join(capsulesDir, `${archivePath}.capsule.json.gz.enc`);
+            const byId = path7.join(capsulesDir, `${archivePath}.capsule.json.gz`);
+            const byIdEnc = path7.join(capsulesDir, `${archivePath}.capsule.json.gz.enc`);
             const st = await stat(byId).catch(() => null);
             if (st && st.isFile()) {
               archivePath = byId;
@@ -6461,7 +6411,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           const { parseExportBundle } = await import("./transfer/types.js");
           let decryptedBuf;
           try {
-            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-7FJQINUR.js");
+            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-YO5QJ6L3.js");
             decryptedBuf = await decryptCapsuleFileInMemory(archivePath, memoryDir);
           } catch (decErr) {
             const msg = decErr instanceof Error ? decErr.message : String(decErr);
@@ -8425,7 +8375,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           return;
         }
         const expandedTarget = expandTildePath(rawTarget);
-        const targetPath = path8.isAbsolute(expandedTarget) ? expandedTarget : path8.join(orchestrator.config.memoryDir, expandedTarget);
+        const targetPath = path7.isAbsolute(expandedTarget) ? expandedTarget : path7.join(orchestrator.config.memoryDir, expandedTarget);
         const { runConsolidationUndo, formatConsolidationUndoResult } = await import("./consolidation-undo.js");
         const result = await runConsolidationUndo({
           storage: orchestrator.storage,
@@ -8463,7 +8413,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         }
       });
       cmd.command("identity").description("Show agent identity reflections").action(async () => {
-        const workspaceDir = path8.join(resolveHomeDir(), ".openclaw", "workspace");
+        const workspaceDir = path7.join(resolveHomeDir(), ".openclaw", "workspace");
         const identity = await orchestrator.storage.readIdentity(workspaceDir);
         if (!identity) {
           console.log("No identity file found.");
@@ -8686,8 +8636,8 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         const options = args[0] ?? {};
         const threadId = options.thread;
         const top = parseInt(options.top ?? "10", 10);
-        const memoryDir = path8.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
-        const threading = new ThreadingManager(path8.join(memoryDir, "threads"));
+        const memoryDir = path7.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+        const threading = new ThreadingManager(path7.join(memoryDir, "threads"));
         if (threadId) {
           const thread = await threading.loadThread(threadId);
           if (!thread) {
@@ -8949,7 +8899,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("--verb is required. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context");
           process.exit(1);
         }
-        const { isValidResolutionVerb, executeResolution } = await import("./resolution-4GG3QZRJ.js");
+        const { isValidResolutionVerb, executeResolution } = await import("./resolution-LXFQQ4AE.js");
         if (!isValidResolutionVerb(verb)) {
           console.error(`Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context`);
           process.exit(1);
@@ -8981,7 +8931,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
       });
       reviewCmd.command("scan").description("Run an on-demand contradiction scan").option("--namespace <ns>", "Namespace to scan").action(async (...args) => {
         const options = args[0] ?? {};
-        const { runContradictionScan } = await import("./contradiction-scan-BSGKZHYJ.js");
+        const { runContradictionScan } = await import("./contradiction-scan-GVD4JJ7B.js");
         console.log("Running contradiction scan...");
         const result = await runContradictionScan({
           storage: orchestrator.storage,
@@ -9621,10 +9571,13 @@ export {
   runMeetingsCliCommand,
   runOkfCliCommand,
   runHarmonicSearchCliCommand,
-  applyManagedRegion,
-  fileLines,
-  parseAtxHeading,
-  publishVaultRegion,
+  applyVaultFrontmatter,
+  VAULT_PROPERTY_KEY_MAX_CHARS,
+  VAULT_PROPERTY_SCALAR_MAX_CHARS,
+  VAULT_PROPERTY_LIST_MAX_ITEMS,
+  VAULT_PROPERTY_TOTAL_MAX_CHARS,
+  renderVaultPropertyValue,
+  validateVaultProperties,
   insertMarkersUnderHeading,
   assertBeginEndPair,
   VAULT_PUBLISH_OUTCOMES,
@@ -9730,4 +9683,4 @@ export {
   listMemoryMarkdownFilePaths,
   registerCli
 };
-//# sourceMappingURL=chunk-TNZNSMVJ.js.map
+//# sourceMappingURL=chunk-NYWCFC3K.js.map