@remnic/core 9.7.14 → 9.8.0

package/dist/profiling.js

@@ -1,8 +1,8 @@
 import {
   ProfilingCollector,
   formatProfileTraceAscii
-} from "./chunk-MTWKDOVO.js";
-import "./chunk-37CTGERM.js";
+} from "./chunk-NLE6TSLG.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ProfilingCollector,

package/dist/provenance.d.ts

@@ -1,5 +1,7 @@
-import { N as ProvenanceSource, as as ProvenanceConfig, p as MemoryFrontmatter } from './types-Bl4BWDM8.js';
+import { U as ProvenanceSource, ap as ProvenanceConfig, o as MemoryFrontmatter } from './types-D_fG2ix8.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 
 /**
  * Claim-level provenance spans (issue #1575 PR 1).

package/dist/provenance.js

@@ -5,12 +5,13 @@ import {
   parseProvenanceTag,
   reconcileProvenanceRead,
   serializeProvenanceFields
-} from "./chunk-OEHCMALU.js";
-import "./chunk-PHK3HARR.js";
+} from "./chunk-5I4M26Q7.js";
 import "./chunk-5GKPFL3S.js";
+import "./chunk-PQVCH2AE.js";
 import "./chunk-JUC24CTX.js";
 import "./chunk-6MKAMLQL.js";
 import "./chunk-JAKIDQB2.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   buildFactProvenance,

package/dist/{purge-NDWV6WYD.js → purge-IRF47ZTX.js}

@@ -1,8 +1,8 @@
 import {
   markProjectedMemoryPathInvalid
-} from "./chunk-RHOZ5LLO.js";
+} from "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
-import "./chunk-37CTGERM.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/maintenance/purge.ts
@@ -209,4 +209,4 @@ async function purgeMemories(options) {
 export {
   purgeMemories
 };
-//# sourceMappingURL=purge-NDWV6WYD.js.map
+//# sourceMappingURL=purge-IRF47ZTX.js.map

package/dist/{qmd-xJRrHFbA.d.ts → qmd-oh9VXz1d.d.ts}

@@ -1,5 +1,6 @@
-import { Q as QmdSearchResult, aw as QmdSearchExplain } from './types-Bl4BWDM8.js';
+import { Q as QmdSearchResult, at as QmdSearchExplain } from './types-D_fG2ix8.js';
 import { SearchBackend, SearchExecutionOptions, SearchQueryOptions } from './search/port.js';
+import { QmdStatusReport } from './qmd-status.js';
 
 declare const QMD_PROBE_TIMEOUT_MS = 8000;
 declare const QMD_PROBE_RETRY_BACKOFF_MS: number[];
@@ -132,6 +133,7 @@ interface QmdDoctorReport {
     raw?: string;
     error?: string;
 }
+
 type QmdRuntimeEnv = Record<string, string | undefined>;
 /**
  * Build the structured sub-queries the daemon `query` tool runs in one request.
@@ -240,6 +242,12 @@ declare class QmdClient implements SearchBackend {
     debugStatus(): string;
     getVersionStatus(): QmdVersionStatus;
     doctor(): Promise<QmdDoctorReport>;
+    /**
+     * Query QMD collection status for embedding backlog metrics.
+     * Runs `qmd status -c <collection>` and parses the text output.
+     * Returns null fields when the command fails or output is unparseable.
+     */
+    status(): Promise<QmdStatusReport>;
     isDaemonMode(): boolean;
     dispose(): Promise<void>;
     /**
@@ -322,6 +330,8 @@ declare class QmdClient implements SearchBackend {
     embedStrict(): Promise<void>;
     embedCollection(collection: string): Promise<void>;
     embedCollectionStrict(collection: string): Promise<void>;
+    /** Trigger a collection-level embed for fresh writes (debounced by prioritized-embed). */
+    embedFiles(filePaths: string[]): Promise<boolean>;
     private runEmbedForCollection;
     checkCollection(collectionOrExecution?: string | SearchExecutionOptions, execution?: SearchExecutionOptions): Promise<"present" | "missing" | "unknown" | "skipped">;
     ensureCollection(memoryDir: string, collectionOrExecution?: string | SearchExecutionOptions, execution?: SearchExecutionOptions): Promise<"present" | "missing" | "unknown" | "skipped">;

package/dist/qmd-preflight.d.ts

@@ -1,4 +1,7 @@
-export { a as QMD_PROBE_RETRY_BACKOFF_MS, b as QMD_PROBE_TIMEOUT_MS, c as QMD_SUPPORTED_VERSION, d as QmdProbeFailureKind, e as classifyProbeFailure, f as compareQmdVersions, g as getQmdPostInstallProbeTargets, p as parseQmdVersion, h as parseQmdVersionOutput, q as qmdVersionToString, r as resolveQmdCapabilities, s as shouldAutoUpgradeQmd, v as versionAtLeast } from './qmd-xJRrHFbA.js';
-import './types-Bl4BWDM8.js';
+export { a as QMD_PROBE_RETRY_BACKOFF_MS, b as QMD_PROBE_TIMEOUT_MS, c as QMD_SUPPORTED_VERSION, d as QmdProbeFailureKind, e as classifyProbeFailure, f as compareQmdVersions, g as getQmdPostInstallProbeTargets, p as parseQmdVersion, h as parseQmdVersionOutput, q as qmdVersionToString, r as resolveQmdCapabilities, s as shouldAutoUpgradeQmd, v as versionAtLeast } from './qmd-oh9VXz1d.js';
+import './types-D_fG2ix8.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 import './search/port.js';
+import './qmd-status.js';

package/dist/qmd-recall-cache.d.ts

@@ -1,6 +1,8 @@
-import { b as RecallPlanMode } from './types-Bl4BWDM8.js';
+import { R as RecallPlanMode } from './types-D_fG2ix8.js';
 import { SearchQueryOptions } from './search/port.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 
 type QmdRecallCacheSource = "fresh" | "stale";
 interface QmdRecallCacheHit<T> {

package/dist/qmd-status.d.ts

@@ -0,0 +1,57 @@
+/**
+ * QMD status parsing and backlog reporting helpers.
+ *
+ * Extracted from qmd.ts to keep that module under its structural ceiling.
+ * Issue #2019: expose embedding backlog metrics in health and CLI surfaces.
+ */
+interface QmdStatusReport {
+    totalFiles: number | null;
+    embeddedFiles: number | null;
+    pendingEmbeddings: number | null;
+    /** Age in ms of the oldest file still pending embedding, or null if unavailable. */
+    oldestPendingAgeMs: number | null;
+    /** Raw text output from `qmd status` for debugging. */
+    raw: string;
+    /** Error message when the status command fails, if any. */
+    error?: string;
+}
+/** Minimal interface for backends that expose QMD status. */
+interface QmdStatusCapable {
+    status(): Promise<QmdStatusReport>;
+}
+declare function parseQmdStatusOutput(stdout: string): QmdStatusReport;
+/** Empty status report returned when QMD is unavailable or the command fails. */
+declare const EMPTY_QMD_STATUS: QmdStatusReport;
+/**
+ * Format backlog lines from a pre-resolved status report.
+ * Returns display strings for CLI output; empty array when unavailable.
+ */
+declare function formatBacklogLinesFromReport(report: QmdStatusReport | null | undefined, threshold: number): string[];
+/**
+ * Fetch QMD status and format backlog lines for CLI output.
+ * Returns empty array when the backend lacks status() or the call fails.
+ */
+declare function renderQmdBacklogStatus(qmd: unknown, threshold: number): Promise<string[]>;
+type QmdCommandRunner = (args: string[], timeoutMs: number) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Fetch QMD collection status via the `qmd status` command. Returns an
+ * unavailable report (with `error` set) when the command fails.
+ */
+declare function fetchQmdStatus(runQmdCommand: QmdCommandRunner, collection: string, timeoutMs: number): Promise<QmdStatusReport>;
+/**
+ * Trigger a collection-level embed run via `qmd embed -c <collection>`.
+ * The QMD CLI does not support per-file embed targeting; this triggers
+ * embedding for all pending files in the collection. The prioritized-embed
+ * module debounces and batches these triggers so fresh writes become
+ * searchable within minutes without hammering the CLI on every write.
+ * Returns `{ ok: false }` on failure so callers can reschedule without crashing.
+ */
+declare function embedQmdFiles(runQmdCommand: QmdCommandRunner, collection: string, _filePaths: string[], timeoutMs: number, embedArgs?: string[]): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+
+export { EMPTY_QMD_STATUS, type QmdCommandRunner, type QmdStatusCapable, type QmdStatusReport, embedQmdFiles, fetchQmdStatus, formatBacklogLinesFromReport, parseQmdStatusOutput, renderQmdBacklogStatus };

package/dist/qmd-status.js

@@ -0,0 +1,18 @@
+import {
+  EMPTY_QMD_STATUS,
+  embedQmdFiles,
+  fetchQmdStatus,
+  formatBacklogLinesFromReport,
+  parseQmdStatusOutput,
+  renderQmdBacklogStatus
+} from "./chunk-IUM3VSHI.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  EMPTY_QMD_STATUS,
+  embedQmdFiles,
+  fetchQmdStatus,
+  formatBacklogLinesFromReport,
+  parseQmdStatusOutput,
+  renderQmdBacklogStatus
+};
+//# sourceMappingURL=qmd-status.js.map

package/dist/qmd-status.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/qmd.d.ts

@@ -1,4 +1,7 @@
-import './types-Bl4BWDM8.js';
+import './types-D_fG2ix8.js';
 import './search/port.js';
-export { c as QMD_SUPPORTED_VERSION, i as QmdCapabilities, j as QmdChunkStrategy, Q as QmdClient, k as QmdClientOptions, l as QmdDoctorReport, m as QmdSearchStrategy, n as QmdStructuredSearch, o as QmdStructuredSearchType, t as QmdSubprocessStrategy, u as QmdVersionStatus, w as QmdVersionTuple, x as buildDefaultStructuredSearches, f as compareQmdVersions, y as getQmdCommandName, g as getQmdPostInstallProbeTargets, z as parseQmdExplain, p as parseQmdVersion, h as parseQmdVersionOutput, A as releaseSharedDaemonSessionForTest, r as resolveQmdCapabilities, B as retainSharedDaemonSessionForTest, C as sharedDaemonSessionCountForTest, s as shouldAutoUpgradeQmd, v as versionAtLeast } from './qmd-xJRrHFbA.js';
+export { c as QMD_SUPPORTED_VERSION, i as QmdCapabilities, j as QmdChunkStrategy, Q as QmdClient, k as QmdClientOptions, l as QmdDoctorReport, m as QmdSearchStrategy, n as QmdStructuredSearch, o as QmdStructuredSearchType, t as QmdSubprocessStrategy, u as QmdVersionStatus, w as QmdVersionTuple, x as buildDefaultStructuredSearches, f as compareQmdVersions, y as getQmdCommandName, g as getQmdPostInstallProbeTargets, z as parseQmdExplain, p as parseQmdVersion, h as parseQmdVersionOutput, A as releaseSharedDaemonSessionForTest, r as resolveQmdCapabilities, B as retainSharedDaemonSessionForTest, C as sharedDaemonSessionCountForTest, s as shouldAutoUpgradeQmd, v as versionAtLeast } from './qmd-oh9VXz1d.js';
+export { QmdStatusReport, parseQmdStatusOutput } from './qmd-status.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';

package/dist/qmd.js

@@ -6,8 +6,8 @@ import {
   releaseSharedDaemonSession,
   retainSharedDaemonSession,
   sharedDaemonSessionCountForTest
-} from "./chunk-AHLPZ2SF.js";
-import "./chunk-WU46YPY6.js";
+} from "./chunk-QJAQNXWI.js";
+import "./chunk-YV32N67O.js";
 import {
   QMD_SUPPORTED_VERSION,
   compareQmdVersions,
@@ -18,12 +18,15 @@ import {
   shouldAutoUpgradeQmd,
   versionAtLeast
 } from "./chunk-64UDOIMI.js";
+import {
+  parseQmdStatusOutput
+} from "./chunk-IUM3VSHI.js";
 import "./chunk-O75CRYGF.js";
-import "./chunk-X47LWMKA.js";
+import "./chunk-XMMESCPD.js";
 import "./chunk-42JKGUFJ.js";
 import "./chunk-JUC24CTX.js";
-import "./chunk-37CTGERM.js";
 import "./chunk-PVGDJXVK.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   QMD_SUPPORTED_VERSION,
@@ -33,6 +36,7 @@ export {
   getQmdCommandName,
   getQmdPostInstallProbeTargets,
   parseQmdExplain,
+  parseQmdStatusOutput,
   parseQmdVersion,
   parseQmdVersionOutput,
   releaseSharedDaemonSession as releaseSharedDaemonSessionForTest,

package/dist/recall-concurrency-config.d.ts

@@ -0,0 +1,16 @@
+import { P as PluginConfig } from './types-D_fG2ix8.js';
+import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
+
+/**
+ * Parse the per-principal recall concurrency knobs from raw config.
+ *
+ * `recallMaxConcurrentPerPrincipal` accepts only finite integers >= 0 so `0`
+ * means "unlimited" deliberately. A fractional typo like `0.5` must NOT floor to
+ * `0` (which would silently disable the cap); it falls back to the default 4
+ * (AGENTS.md #1/#17).
+ */
+declare function parseRecallConcurrencyConfig(cfg: Record<string, unknown>): Pick<PluginConfig, "recallMaxConcurrentPerPrincipal" | "recallSingleFlightEnabled">;
+
+export { parseRecallConcurrencyConfig };

package/dist/recall-concurrency-config.js

@@ -0,0 +1,10 @@
+import {
+  parseRecallConcurrencyConfig
+} from "./chunk-6ZMAMSHS.js";
+import "./chunk-PQVCH2AE.js";
+import "./chunk-3WCASNQZ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  parseRecallConcurrencyConfig
+};
+//# sourceMappingURL=recall-concurrency-config.js.map

package/dist/recall-concurrency-config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/recall-disclosure-escalation.d.ts

@@ -1,5 +1,7 @@
-import { R as RecallDisclosure } from './types-Bl4BWDM8.js';
+import { b as RecallDisclosure } from './types-D_fG2ix8.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 
 /**
  * Recall disclosure auto-escalation policy (issue #677 PR 4/4).

package/dist/recall-explain-renderer.d.ts

@@ -1,8 +1,11 @@
 import { LastRecallSnapshot } from './recall-state.js';
-import { s as RecallTierExplain } from './types-Bl4BWDM8.js';
+import { g as RecallTierExplain } from './types-D_fG2ix8.js';
 import { RecallXraySnapshot } from './recall-xray.js';
+import './utils/serialize-mutations.js';
 import './search/port.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 import './memory-provenance.js';
 import './user-model.js';
 

package/dist/recall-explain-renderer.js

@@ -5,10 +5,10 @@ import {
   toRecallExplainJson,
   toRecallExplainText,
   toRecallXraySnapshotFromLegacy
-} from "./chunk-DDGV7NAX.js";
+} from "./chunk-CQMEM5CC.js";
 import "./chunk-SOBJ6NEY.js";
-import "./chunk-PK5XBDA6.js";
-import "./chunk-B3F4CWQR.js";
+import "./chunk-U3ZAVRP3.js";
+import "./chunk-YVKF3HEW.js";
 import "./chunk-I4WBNM3M.js";
 import "./chunk-SOAU2OE2.js";
 import "./chunk-PZ5AY32C.js";

package/dist/recall-memory-map.d.ts

@@ -0,0 +1,26 @@
+import { Q as QmdSearchResult, M as MemoryFile } from './types-D_fG2ix8.js';
+import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
+
+declare function memoryMapKey(result: Pick<QmdSearchResult, "namespace" | "path">): string;
+declare function memoryForResult(memoryByPath: ReadonlyMap<string, MemoryFile>, result: Pick<QmdSearchResult, "namespace" | "path">): MemoryFile | undefined;
+declare function hasMemoryForResult(memoryByPath: ReadonlyMap<string, MemoryFile>, result: Pick<QmdSearchResult, "namespace" | "path">): boolean;
+declare function markResultKey(keys: Set<string>, result: Pick<QmdSearchResult, "namespace" | "path">): void;
+declare function resultHasKey(keys: ReadonlySet<string>, result: Pick<QmdSearchResult, "namespace" | "path">): boolean;
+/**
+ * Merge recall results from multiple producers, deduplicating by the composite
+ * (namespace, path) identity so the same memory found by a fanout hit and a
+ * seed/hybrid/archive hit collapses to ONE entry instead of being injected and
+ * access-tracked twice (#2020). The namespace is resolved the SAME way on every
+ * producer — carried when present, else derived from the path — and stamped on
+ * the surviving result. Highest score wins; a surviving result keeps its own
+ * snippet, falling back to the displaced entry's snippet when empty. Results are
+ * returned sorted by descending score and capped to `limit`.
+ */
+declare function dedupeResultsByNamespace(results: readonly QmdSearchResult[], namespaceFromPath: (path: string) => string, limit: number, options?: {
+    transportFallback?: QmdSearchResult["transport"];
+    filter?: (result: QmdSearchResult) => boolean;
+}): QmdSearchResult[];
+
+export { dedupeResultsByNamespace, hasMemoryForResult, markResultKey, memoryForResult, memoryMapKey, resultHasKey };

package/dist/recall-memory-map.js

@@ -0,0 +1,18 @@
+import {
+  dedupeResultsByNamespace,
+  hasMemoryForResult,
+  markResultKey,
+  memoryForResult,
+  memoryMapKey,
+  resultHasKey
+} from "./chunk-D3V3UMET.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dedupeResultsByNamespace,
+  hasMemoryForResult,
+  markResultKey,
+  memoryForResult,
+  memoryMapKey,
+  resultHasKey
+};
+//# sourceMappingURL=recall-memory-map.js.map

package/dist/recall-memory-map.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/recall-planner-llm.d.ts

@@ -1,7 +1,9 @@
-import { b as RecallPlanMode, P as PluginConfig } from './types-Bl4BWDM8.js';
+import { R as RecallPlanMode, P as PluginConfig } from './types-D_fG2ix8.js';
 import { CapabilitySet } from './capabilities.js';
 import { FallbackLlmClient, FallbackLlmOptions } from './fallback-llm.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 import './resolve-provider-secret.js';
 
 /**

package/dist/recall-planner-llm.js

@@ -5,17 +5,17 @@ import {
   FallbackLlmClient,
   fallbackLlmRuntimeContextFromConfig,
   gatewayTaskChainOptions
-} from "./chunk-UXKMMNJD.js";
-import "./chunk-K2ZLHESQ.js";
-import "./chunk-VFSP73LP.js";
+} from "./chunk-C23BYTJV.js";
+import "./chunk-QIEUU4UK.js";
 import "./chunk-L2EXJQJP.js";
+import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/recall-planner-llm.ts

package/dist/recall-qos.js

@@ -1,8 +1,8 @@
 import {
   createRecallSectionMetricRecorder,
   formatRecallSectionMetric
-} from "./chunk-JZHHREBL.js";
-import "./chunk-37CTGERM.js";
+} from "./chunk-C3AKM55W.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   createRecallSectionMetricRecorder,

package/dist/recall-state.d.ts

@@ -1,6 +1,9 @@
+import { HeldFileLockOptions } from './utils/serialize-mutations.js';
 import { SearchDegradation } from './search/port.js';
-import { b as RecallPlanMode, I as IdentityInjectionMode, s as RecallTierExplain } from './types-Bl4BWDM8.js';
+import { R as RecallPlanMode, I as IdentityInjectionMode, g as RecallTierExplain } from './types-D_fG2ix8.js';
 import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
 
 interface LastRecallBudgetSummary {
     requestedTopK?: number;
@@ -13,6 +16,10 @@ interface LastRecallBudgetSummary {
     truncated?: boolean;
     includedSections?: string[];
     omittedSections?: string[];
+    includedMemoryIds?: string[];
+    includedMemoryPaths?: string[];
+    includedMemoryNamespaces?: Array<string | undefined>;
+    omittedMemoryIds?: string[];
 }
 interface LastRecallSnapshot {
     sessionKey: string;
@@ -31,6 +38,7 @@ interface LastRecallSnapshot {
     budgetsApplied?: LastRecallBudgetSummary;
     latencyMs?: number;
     resultPaths?: string[];
+    resultNamespaces?: Array<string | undefined>;
     policyVersion?: string;
     identityInjectionMode?: IdentityInjectionMode | "none";
     identityInjectedChars?: number;
@@ -101,14 +109,42 @@ interface TierMigrationStatusSnapshot {
         errors: number;
     };
 }
+/**
+ * Outcome of {@link LastRecallStore.drainPendingImpressions}. Distinguishes a
+ * completed drain (or nothing pending) from a DEFERRED drain that left durable
+ * spills in the offline-sync-EXCLUDED queue, so the caller can tell the
+ * data-safe cases apart from the one where an offline-sync snapshot would
+ * silently omit recorded impressions (#2033).
+ */
+interface DrainPendingImpressionsResult {
+    /** Pending spill rows were folded into the synced active file this call. */
+    folded: boolean;
+    /**
+     * Durable spill rows remain in the offline-sync-EXCLUDED pending queue after
+     * this drain: the rotation lock could not be acquired, a spill could not be
+     * claimed, or the drain-only fold left rows that would only fit by rotating
+     * into a sync-excluded archive. A snapshot taken now would silently omit them
+     * (#2033): the caller MUST treat the active file as INCOMPLETE and retry or
+     * abort the snapshot rather than report success. `false` means the active file
+     * is complete — every pending row was folded or nothing was pending.
+     */
+    pendingDeferred: boolean;
+}
 declare class LastRecallStore {
     private readonly statePath;
     private readonly impressionsPath;
     private readonly writeStateFile;
+    private readonly impressionsRotateBytes;
+    private readonly impressionsRotateKeep;
+    private readonly impressionsLockOptions?;
     private state;
     private stateWriteChain;
+    private impressionsWriteChain;
     constructor(memoryDir: string, options?: {
         writeStateFile?: StateFileWriter;
+        impressionsRotateBytes?: number;
+        impressionsRotateKeep?: number;
+        impressionsLockOptions?: Pick<HeldFileLockOptions, "maxWaitMs" | "pollMs">;
     });
     load(): Promise<void>;
     get(sessionKey: string): LastRecallSnapshot | null;
@@ -132,6 +168,7 @@ declare class LastRecallStore {
         budgetsApplied?: LastRecallBudgetSummary;
         latencyMs?: number;
         resultPaths?: string[];
+        resultNamespaces?: Array<string | undefined>;
         policyVersion?: string;
         appendImpression?: boolean;
         identityInjection?: {
@@ -153,6 +190,130 @@ declare class LastRecallStore {
          */
         backendDegradations?: SearchDegradation[];
     }): Promise<void>;
+    /**
+     * Drain pending spills, rotate (best-effort, sized to the projected payload),
+     * then append one impression line under ONE shared cross-process lock (#1910,
+     * #2033). Both the archive-shift renames AND the append run inside the same
+     * held lock so a peer process holding the lock can never rename the active
+     * inode to `.1` between our open and write — which would land the impression in
+     * a rotated archive that offline-sync excludes, silently dropping it from
+     * active-state/sync consumers.
+     *
+     * On lock-acquisition timeout the impression is NEVER written to the active
+     * file unlocked (#2033): a peer holding the lock is likely mid-rotation, so an
+     * unlocked append can land in the inode it is about to rename to `.1` — the
+     * exact silent-drop this lock prevents. Instead the row is spilled to a
+     * durable node-local per-event file under `<impressions>.pending.d/` and
+     * folded back into the active file by the next append that DOES hold the lock,
+     * preserving durability without racing rotation. Rotation failure under the
+     * held lock is logged and the append still runs. Callers invoke this only
+     * through `impressionsWriteChain` so the sequence is serialized in-process.
+     */
+    private get impressionsPendingDir();
+    private spillImpression;
+    /**
+     * Recover a claim a crashed drain left mid-flight (#2033): the crash-safe
+     * drain renames `<uuid>.jsonl` -> `<uuid>.jsonl.claimed` BEFORE committing, so
+     * a `.claimed` file with no matching commit is the ONLY durable copy of those
+     * rows. Rename each orphan back to `<uuid>.jsonl` so it re-enters the normal
+     * collect+claim+commit flow. MUST run under the held rotation lock, before
+     * collecting. listContainedSpillFiles skips symlinked/escaping entries.
+     */
+    private recoverOrphanedImpressionClaims;
+    /**
+     * Recover a crash-orphaned spill temp after its write completed but before
+     * the atomic `.tmp` → `.jsonl` rename. Valid JSONL temps are promoted back
+     * into the normal queue; incomplete temps remain pending and keep offline sync
+     * deferred rather than being discarded.
+     */
+    private recoverOrphanedImpressionTemps;
+    private appendImpressionSerialized;
+    /**
+     * Fold any durable pending recall-impression spills into the synced active
+     * `recall_impressions.jsonl` WITHOUT recording a new impression (#2033).
+     *
+     * The pending spill dir is offline-sync-excluded, so an impression that a
+     * lock-timed-out `record()` spilled there is absent from an offline-sync
+     * snapshot and lost if this node is discarded before the next `record()`
+     * folds it back. Offline sync calls this before building a snapshot so a
+     * recorded impression always reaches the remote. Fast no-op — no lock and no
+     * dir/lock-file creation — when nothing is pending.
+     *
+     * Returns a {@link DrainPendingImpressionsResult}: `folded` is true when rows
+     * were folded into the active file; `pendingDeferred` is true when durable
+     * spills still remain in the offline-sync-EXCLUDED queue after this call —
+     * because the rotation lock could not be acquired, a spill could not be
+     * claimed, or the drain-only fold deferred rows that would only fit by
+     * rotating into a sync-excluded archive (#2033). A snapshot taken while
+     * `pendingDeferred` is true would silently drop those rows, so the caller MUST
+     * NOT report a clean snapshot — it either retries or aborts.
+     */
+    drainPendingImpressions(): Promise<DrainPendingImpressionsResult>;
+    /**
+     * Claim/commit fold of durable pending impression spills into the active file
+     * under the held rotation lock (#2033). `line` is a new impression to append
+     * after the drained rows, or null for a drain-only pre-sync fold.
+     *
+     * Each spill is folded as an INDEPENDENT claim -> append -> finalize unit
+     * rather than materializing the whole queue as one joined payload and
+     * splitting it in a single synchronous pass (#2033). A multi-hundred-MB drain
+     * done as one join/split blocks the event loop long enough for
+     * `withHeldFileLock`'s ownership-refresh timer to miss its window, so a peer
+     * stale-breaks the 30s lock and rotates/appends concurrently — defeating the
+     * rotation lock this drain relies on. The per-file `await`s keep the payload
+     * bounded to one spill at a time and let the refresh timer fire between files.
+     *
+     * The DRAIN-ONLY path (`line === null`, run before an offline-sync snapshot)
+     * NEVER rotates a drained row into an archive. `recall_impressions.jsonl.*`
+     * is offline-sync-EXCLUDED, so rotating a just-drained row into `.1`/`.2` and
+     * then deleting its spill would leave that row only in a path sync omits —
+     * silently lost when the node is discarded after a "successful" sync (#2033).
+     * It folds only the rows that fit the synced active file under the cap and
+     * leaves the rest durable in the pending queue; {@link drainPendingImpressions}
+     * then reports the drain DEFERRED so the caller retries or aborts. The
+     * record() path (`line !== null`) keeps rotating normally — its archives stay
+     * on a live node that is not being discarded.
+     *
+     * Recovers any crash-orphaned claim first. Each impression carries a unique
+     * writeNonce, so a crash-recovered re-commit is a collapsible duplicate, never
+     * a lost row. listContainedSpillFiles rejects symlinked/escaping entries; a
+     * spill that cannot be claimed is skipped this pass. An append failure rolls
+     * that spill's claim back so the row retries on the next lock holder's drain.
+     * Returns true when the active file was written. MUST run under the held
+     * rotation lock.
+     */
+    private foldPendingImpressionsAndAppend;
+    /**
+     * Append one whole JSONL unit (a claimed spill's rows or a fresh impression
+     * line) to the active impressions file, returning the resulting active-file
+     * byte size. On the rotating (record) path, when the unit would push the
+     * current active generation to/over `impressionsRotateBytes`, the full active
+     * file is rotated aside FIRST so no generation exceeds the cap (#2033); a lone
+     * unit larger than the cap on an empty active file is written whole because
+     * splitting a JSONL row would corrupt it. `drainOnly` and disabled rotation
+     * (`impressionsRotateBytes <= 0`) both skip rotation — drain-only defers its
+     * overflow in {@link foldPendingImpressionsAndAppend} rather than rotating into
+     * a sync-excluded archive. A rotation error is logged and the append still
+     * runs so a row is never lost; an append failure propagates so the caller
+     * rolls its claim back. MUST run under the held rotation lock.
+     */
+    private appendImpressionUnit;
+    /**
+     * True when any live `<uuid>.jsonl` spill, crash-orphaned `.claimed` file,
+     * or crash-orphaned `.jsonl.tmp` spill remains in the offline-sync-EXCLUDED
+     * pending queue (#2033). After a drain acquires the rotation lock, a spill
+     * the fold could not claim (rename race / read-only dir) or a `.claimed`
+     * orphan a failed commit left behind means durable rows are STILL excluded
+     * from a snapshot — the drain must report itself INCOMPLETE so the caller
+     * retries or aborts rather than snapshotting an active file that omits them.
+     */
+    private pendingSpillsRemain;
+    /**
+     * Shift `.1..N` archives down one slot and move the active file to `.1`,
+     * dropping anything beyond `keep`. Callers invoke this only while holding the
+     * cross-process rotation lock (issue #1910).
+     */
+    private shiftImpressionArchives;
     /**
      * Attach a RecallTierExplain block to the existing snapshot for a
      * session without rewriting the entire snapshot.  Used by the
@@ -218,4 +379,4 @@ declare class RecallHandleHistoryStore {
     private flush;
 }
 
-export { type GraphRecallExpandedEntry, type LastRecallBudgetSummary, type LastRecallSnapshot, LastRecallStore, RecallHandleHistoryStore, type TierMigrationCycleSummary, type TierMigrationStatusSnapshot, TierMigrationStatusStore, clampGraphRecallExpandedEntries };
+export { type DrainPendingImpressionsResult, type GraphRecallExpandedEntry, type LastRecallBudgetSummary, type LastRecallSnapshot, LastRecallStore, RecallHandleHistoryStore, type TierMigrationCycleSummary, type TierMigrationStatusSnapshot, TierMigrationStatusStore, clampGraphRecallExpandedEntries };

package/dist/recall-state.js

@@ -3,9 +3,12 @@ import {
   RecallHandleHistoryStore,
   TierMigrationStatusStore,
   clampGraphRecallExpandedEntries
-} from "./chunk-E5BK6CGV.js";
-import "./chunk-SFQ6QNL7.js";
-import "./chunk-37CTGERM.js";
+} from "./chunk-FMLKOL2Z.js";
+import "./chunk-R6YJI3HE.js";
+import "./chunk-GCASGYIO.js";
+import "./chunk-WL5EBRDH.js";
+import "./chunk-5UZXUTVO.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LastRecallStore,