@remnic/core 9.7.15 → 9.8.0

package/dist/{chunk-7N2RUBAP.js → chunk-DDA47TES.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-RL6NEVXT.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/lcm/schema.ts
 import path from "path";
@@ -131,4 +131,4 @@ export {
   ensureLcmStateDir,
   applyLcmSchema
 };
-//# sourceMappingURL=chunk-7N2RUBAP.js.map
+//# sourceMappingURL=chunk-DDA47TES.js.map

package/dist/{chunk-64SE4X5G.js → chunk-DEBHXHJR.js}

@@ -10,7 +10,7 @@ import {
   unlock,
   verifyKey,
   writeHeader
-} from "./chunk-GWTFLF2P.js";
+} from "./chunk-BJMBJZ2Y.js";
 import {
   DEFAULT_ARGON2ID_PARAMS,
   DEFAULT_SCRYPT_PARAMS,
@@ -19,7 +19,7 @@ import {
 import {
   decryptMemoryDirToPlaintext,
   migrateMemoryDirToEncrypted
-} from "./chunk-J2HSAU72.js";
+} from "./chunk-AIK5W3IW.js";
 import {
   generateSalt
 } from "./chunk-A6XUJE5D.js";
@@ -499,4 +499,4 @@ export {
   renderStatusReport,
   createPassphraseReader
 };
-//# sourceMappingURL=chunk-64SE4X5G.js.map
+//# sourceMappingURL=chunk-DEBHXHJR.js.map

package/dist/{chunk-EHK6KZHK.js → chunk-DNHVPZOD.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-6CIAGZ6X.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/temporal-supersession.ts
 function normalizeSupersessionKey(raw) {
@@ -257,4 +257,4 @@ export {
   applyTemporalSupersession,
   shouldFilterSupersededFromRecall
 };
-//# sourceMappingURL=chunk-EHK6KZHK.js.map
+//# sourceMappingURL=chunk-DNHVPZOD.js.map

package/dist/{chunk-437S3G37.js → chunk-DQEMWVMT.js}

@@ -2,7 +2,7 @@ import {
   getKey,
   readHeader,
   secureStoreDir
-} from "./chunk-GWTFLF2P.js";
+} from "./chunk-BJMBJZ2Y.js";
 import {
   KDF_SALT_LENGTH,
   deriveKey
@@ -246,4 +246,4 @@ export {
   decryptCapsuleFile,
   decryptCapsuleFileInMemory
 };
-//# sourceMappingURL=chunk-437S3G37.js.map
+//# sourceMappingURL=chunk-DQEMWVMT.js.map

package/dist/{chunk-LZZNTPLR.js → chunk-DX3XRGLH.js}

@@ -1,7 +1,7 @@
 import {
   backupAndWriteRebuiltObservations,
   toHourBucketIso
-} from "./chunk-JCK7V6SN.js";
+} from "./chunk-P65YJEEL.js";
 
 // src/maintenance/rebuild-observations.ts
 import path from "path";
@@ -124,4 +124,4 @@ async function rebuildObservations(options) {
 export {
   rebuildObservations
 };
-//# sourceMappingURL=chunk-LZZNTPLR.js.map
+//# sourceMappingURL=chunk-DX3XRGLH.js.map

package/dist/chunk-EA2H5LML.js

@@ -0,0 +1,72 @@
+import {
+  canReadNamespace,
+  defaultNamespaceForPrincipal
+} from "./chunk-755Q3DGF.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
+
+// src/access-memory-search-fanout.ts
+async function resolveMemorySearchDefaultFallback(options) {
+  const { profilePlan, config, principal } = options;
+  const principalSelfIsDefault = defaultNamespaceForPrincipal(principal, config) === config.defaultNamespace;
+  const profileIntendsUserGlobal = profilePlan.profile.readOrder.includes("userGlobal");
+  const userGlobalLayerReadable = profilePlan.layers.some(
+    (layer) => layer.id === "userGlobal" && layer.readable && Boolean(layer.namespace)
+  );
+  const selfResolvedAwayFromDefault = profilePlan.baseNamespace !== config.defaultNamespace;
+  if (!(profileIntendsUserGlobal && userGlobalLayerReadable && principalSelfIsDefault && selfResolvedAwayFromDefault && canReadNamespace(principal, config.defaultNamespace, config))) {
+    return null;
+  }
+  const defaultAtFlatRoot = await options.defaultAtFlatRootProvider();
+  return defaultAtFlatRoot ? config.defaultNamespace : null;
+}
+async function defaultNamespaceAtFlatRoot(getStorage, config) {
+  const storage = await getStorage(config.defaultNamespace);
+  return storage.dir === config.memoryDir;
+}
+function mergeMemorySearchDefaultFallback(profileNamespaces, fallback) {
+  if (!fallback || profileNamespaces.includes(fallback)) return profileNamespaces;
+  return [...profileNamespaces, fallback];
+}
+async function runMemorySearchFanout(options) {
+  const { query, namespaces, maxResults, principal, requestedNamespace, collection } = options;
+  if (namespaces.length === 0) {
+    log.warn("memory_search resolved zero readable namespaces", {
+      principal: principal ?? null,
+      requestedNamespace: requestedNamespace ?? null,
+      collection: collection ?? null
+    });
+    return [];
+  }
+  log.debug("memory_search fanout", {
+    principal: principal ?? null,
+    namespaces,
+    collection: collection ?? null
+  });
+  const degradations = [];
+  const results = await options.search({
+    query,
+    namespaces,
+    maxResults,
+    mode: "search",
+    execution: {
+      onDegradation: (degradation) => degradations.push(degradation)
+    }
+  });
+  if (degradations.length > 0) {
+    log.warn("memory_search backend degradation", {
+      principal: principal ?? null,
+      degradations
+    });
+  }
+  return results;
+}
+
+export {
+  resolveMemorySearchDefaultFallback,
+  defaultNamespaceAtFlatRoot,
+  mergeMemorySearchDefaultFallback,
+  runMemorySearchFanout
+};
+//# sourceMappingURL=chunk-EA2H5LML.js.map

package/dist/chunk-EA2H5LML.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-memory-search-fanout.ts"],"sourcesContent":["import { canReadNamespace, defaultNamespaceForPrincipal } from \"./namespaces/principal.js\";\nimport type { ResolvedScopeProfilePlan } from \"./namespaces/scope-profiles.js\";\nimport { log } from \"./logger.js\";\nimport type { SearchDegradation, SearchExecutionOptions } from \"./search/port.js\";\nimport type { PluginConfig } from \"./types.js\";\n\n/**\n * Issue #2018: `memory_search` has no sessionKey, so — unlike recall — it\n * cannot resolve a coding overlay. With scope profiles active and no overlay,\n * `expandScopeProfileReadNamespaces` derives a per-principal self namespace.\n * On a legacy flat-root deployment the corpus still lives under the configured\n * DEFAULT namespace's base collection, which that derived set excludes, so\n * every query silently returned 0.\n *\n * Returns the configured default namespace to merge into the profile read set\n * when the base collection must stay reachable, or `null` otherwise. ALL of:\n *\n *   - the default namespace is THIS principal's own self store — i.e. the\n *     principal has no dedicated namespace policy, so\n *     `defaultNamespaceForPrincipal` resolves to the configured default. On a\n *     multi-tenant scope-profile deployment every principal has its own\n *     policy; reaching into the default would read ANOTHER namespace, so the\n *     fallback must not fire (#2056 r2 / #1501 privateOnly);\n *   - the profile resolved `userGlobal` as a READABLE layer (not just listed\n *     it in `readOrder`). `serverShared` maps to `sharedNamespace`, not the\n *     default, and an unreadable resolved layer is a deliberate omission —\n *     neither may trigger this fallback (#2056 r2);\n *   - the profile's resolved self namespace is NOT already the default\n *     (otherwise it is already in the set);\n *   - the principal is authorized to read the default namespace.\n *\n * The flat-root signal is resolved lazily via {@link defaultAtFlatRootProvider}\n * — the provider is only invoked once the cheap gates (readOrder consent,\n * resolved-layer readability, principal-self, self-resolved-away, ACL) all\n * pass, so a project-only / serverShared-only / unreadable-userGlobal\n * profile never touches the default store (#2056 r6).\n */\nexport async function resolveMemorySearchDefaultFallback(options: {\n  profilePlan: ResolvedScopeProfilePlan;\n  config: PluginConfig;\n  principal: string | undefined;\n  /**\n   * True only when the configured default namespace's storage root equals\n   * `config.memoryDir` (the legacy flat-root layout). Invoked ONLY after the\n   * cheap gates pass, so ineligible profiles never probe the default store.\n   */\n  defaultAtFlatRootProvider: () => Promise<boolean>;\n}): Promise<string | null> {\n  const { profilePlan, config, principal } = options;\n  // Defense-in-depth: principalSelfIsDefault is only ever true alongside a\n  // flat-root default on legacy deployments (a hosted scope-profile principal\n  // with its own policy fails this even when default is at the flat root). It\n  // is NOT redundant — it keeps a policy-having principal isolated from the\n  // flat default corpus.\n  const principalSelfIsDefault =\n    defaultNamespaceForPrincipal(principal, config) === config.defaultNamespace;\n  // readOrder must explicitly intend userGlobal (resolveScopeProfilePlan\n  // always materializes a userGlobal layer even when readOrder omits it, so\n  // the layer's presence alone is not consent), AND that layer must have\n  // resolved readable (a listed-but-unreadable layer is a deliberate\n  // omission). serverShared maps to sharedNamespace, not the default.\n  const profileIntendsUserGlobal =\n    profilePlan.profile.readOrder.includes(\"userGlobal\");\n  const userGlobalLayerReadable = profilePlan.layers.some(\n    (layer) => layer.id === \"userGlobal\" && layer.readable && Boolean(layer.namespace),\n  );\n  const selfResolvedAwayFromDefault =\n    profilePlan.baseNamespace !== config.defaultNamespace;\n  if (\n    !(\n      profileIntendsUserGlobal &&\n      userGlobalLayerReadable &&\n      principalSelfIsDefault &&\n      selfResolvedAwayFromDefault &&\n      canReadNamespace(principal, config.defaultNamespace, config)\n    )\n  ) {\n    // Cheap gates failed — never probe the default store.\n    return null;\n  }\n  const defaultAtFlatRoot = await options.defaultAtFlatRootProvider();\n  return defaultAtFlatRoot ? config.defaultNamespace : null;\n}\n\n/**\n * Issue #2018 r4: the explicit legacy-flat-root signal — the configured\n * default namespace's storage root equals `config.memoryDir`. Resolved from\n * storage (not inferred from config/policy shape) so a hosted scope-profile\n * deployment never reaches into the default corpus.\n */\nexport async function defaultNamespaceAtFlatRoot(\n  getStorage: (namespace: string) => Promise<{ dir: string }>,\n  config: { defaultNamespace: string; memoryDir: string },\n): Promise<boolean> {\n  const storage = await getStorage(config.defaultNamespace);\n  return storage.dir === config.memoryDir;\n}\n\n/**\n * Merge the {@link resolveMemorySearchDefaultFallback} result into a profile\n * read-namespace set without duplicates. Returns the original set unchanged\n * when no fallback applies.\n */\nexport function mergeMemorySearchDefaultFallback(\n  profileNamespaces: string[],\n  fallback: string | null,\n): string[] {\n  if (!fallback || profileNamespaces.includes(fallback)) return profileNamespaces;\n  return [...profileNamespaces, fallback];\n}\n\n\n/**\n * Run a memory_search namespace fanout with the observability required by\n * issue #2018: a silent empty fanout is surfaced as a warning (never silently\n * empty), and per-namespace backend degradations — which memory_search\n * previously swallowed — are collected and warned so a missing collection\n * looks different from a genuine no-matches.\n *\n * `search` is injected so this stays free of the orchestrator type.\n */\nexport async function runMemorySearchFanout<TResult>(options: {\n  query: string;\n  namespaces: string[];\n  maxResults?: number;\n  principal?: string;\n  requestedNamespace?: string;\n  collection?: string;\n  search(params: {\n    query: string;\n    namespaces: string[];\n    maxResults?: number;\n    mode: \"search\";\n    execution: SearchExecutionOptions;\n  }): Promise<TResult[]>;\n}): Promise<TResult[]> {\n  const { query, namespaces, maxResults, principal, requestedNamespace, collection } = options;\n  if (namespaces.length === 0) {\n    log.warn(\"memory_search resolved zero readable namespaces\", {\n      principal: principal ?? null,\n      requestedNamespace: requestedNamespace ?? null,\n      collection: collection ?? null,\n    });\n    return [];\n  }\n  log.debug(\"memory_search fanout\", {\n    principal: principal ?? null,\n    namespaces,\n    collection: collection ?? null,\n  });\n  const degradations: SearchDegradation[] = [];\n  const results = await options.search({\n    query,\n    namespaces,\n    maxResults,\n    mode: \"search\",\n    execution: {\n      onDegradation: (degradation) => degradations.push(degradation),\n    },\n  });\n  if (degradations.length > 0) {\n    log.warn(\"memory_search backend degradation\", {\n      principal: principal ?? null,\n      degradations,\n    });\n  }\n  return results;\n}\n"],"mappings":";;;;;;;;;AAqCA,eAAsB,mCAAmC,SAU9B;AACzB,QAAM,EAAE,aAAa,QAAQ,UAAU,IAAI;AAM3C,QAAM,yBACJ,6BAA6B,WAAW,MAAM,MAAM,OAAO;AAM7D,QAAM,2BACJ,YAAY,QAAQ,UAAU,SAAS,YAAY;AACrD,QAAM,0BAA0B,YAAY,OAAO;AAAA,IACjD,CAAC,UAAU,MAAM,OAAO,gBAAgB,MAAM,YAAY,QAAQ,MAAM,SAAS;AAAA,EACnF;AACA,QAAM,8BACJ,YAAY,kBAAkB,OAAO;AACvC,MACE,EACE,4BACA,2BACA,0BACA,+BACA,iBAAiB,WAAW,OAAO,kBAAkB,MAAM,IAE7D;AAEA,WAAO;AAAA,EACT;AACA,QAAM,oBAAoB,MAAM,QAAQ,0BAA0B;AAClE,SAAO,oBAAoB,OAAO,mBAAmB;AACvD;AAQA,eAAsB,2BACpB,YACA,QACkB;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,gBAAgB;AACxD,SAAO,QAAQ,QAAQ,OAAO;AAChC;AAOO,SAAS,iCACd,mBACA,UACU;AACV,MAAI,CAAC,YAAY,kBAAkB,SAAS,QAAQ,EAAG,QAAO;AAC9D,SAAO,CAAC,GAAG,mBAAmB,QAAQ;AACxC;AAYA,eAAsB,sBAA+B,SAc9B;AACrB,QAAM,EAAE,OAAO,YAAY,YAAY,WAAW,oBAAoB,WAAW,IAAI;AACrF,MAAI,WAAW,WAAW,GAAG;AAC3B,QAAI,KAAK,mDAAmD;AAAA,MAC1D,WAAW,aAAa;AAAA,MACxB,oBAAoB,sBAAsB;AAAA,MAC1C,YAAY,cAAc;AAAA,IAC5B,CAAC;AACD,WAAO,CAAC;AAAA,EACV;AACA,MAAI,MAAM,wBAAwB;AAAA,IAChC,WAAW,aAAa;AAAA,IACxB;AAAA,IACA,YAAY,cAAc;AAAA,EAC5B,CAAC;AACD,QAAM,eAAoC,CAAC;AAC3C,QAAM,UAAU,MAAM,QAAQ,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,WAAW;AAAA,MACT,eAAe,CAAC,gBAAgB,aAAa,KAAK,WAAW;AAAA,IAC/D;AAAA,EACF,CAAC;AACD,MAAI,aAAa,SAAS,GAAG;AAC3B,QAAI,KAAK,qCAAqC;AAAA,MAC5C,WAAW,aAAa;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-INELTPRG.js → chunk-EEC7UJPX.js}

@@ -5,28 +5,43 @@ import {
 import {
   cloneDefaultSessionObserverBands
 } from "./chunk-Z5LAYHGJ.js";
+import {
+  parseRecallConcurrencyConfig
+} from "./chunk-6ZMAMSHS.js";
 import {
   parseCorrectionIntentConfig,
   parseFaithfulnessGateConfig
-} from "./chunk-G6NKALRN.js";
+} from "./chunk-H4WG3UQZ.js";
 import {
   resolveEmitLegacyTools,
   resolveNamespaceCatalogEnabled
 } from "./chunk-OO42R444.js";
+import {
+  parseQmdChunkStrategy,
+  parseQmdDaemonTimeoutMs,
+  parseQmdGpuBackend,
+  parseQmdSearchStrategy,
+  parseQmdSubprocessStrategy,
+  parseQmdSupportedVersion
+} from "./chunk-PIG4WJFQ.js";
+import {
+  parseBoundedJsonlStateConfig
+} from "./chunk-KFZY2OFH.js";
 import {
   TIER_1_LANGUAGES
 } from "./chunk-P32IDSHD.js";
 import {
   parseProvenanceConfig
-} from "./chunk-OEHCMALU.js";
+} from "./chunk-5I4M26Q7.js";
+import {
+  normalizeEntitySchemas
+} from "./chunk-4DJQYKMN.js";
 import {
   coerceBool,
+  coerceBooleanLike,
   coerceInstallExtension,
   coerceNumber
-} from "./chunk-PHK3HARR.js";
-import {
-  normalizeEntitySchemas
-} from "./chunk-4DJQYKMN.js";
+} from "./chunk-PQVCH2AE.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -34,12 +49,12 @@ import {
   readEnvVar,
   resolveHomeDir
 } from "./chunk-JUC24CTX.js";
-import {
-  log
-} from "./chunk-37CTGERM.js";
 import {
   parseOfflineSyncExcludes
-} from "./chunk-X64YLC24.js";
+} from "./chunk-72VAXGEI.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
 
 // src/config.ts
 import path from "path";
@@ -899,77 +914,15 @@ function parseBoundedPositiveInteger(value, min, max, keyName) {
   if (parsed === void 0) return void 0;
   return Math.max(min, Math.min(max, parsed));
 }
-function parseQmdSupportedVersion(value) {
-  if (value === void 0 || value === null) return "2.5.3";
-  if (typeof value !== "string") {
-    throw new Error(`qmdSupportedVersion must be a semantic version string; got ${JSON.stringify(value)}`);
-  }
-  const normalized = value.trim();
-  if (!/^\d+\.\d+\.\d+$/.test(normalized)) {
-    throw new Error(
-      `qmdSupportedVersion must be a semantic version string like "2.5.3"; got ${JSON.stringify(value)}`
-    );
-  }
-  return normalized;
-}
-function parseQmdGpuBackend(value) {
-  if (value === void 0 || value === null) return void 0;
-  if (value === false) return "false";
-  if (typeof value !== "string") {
-    throw new Error(`qmdGpuBackend must be one of "auto", "metal", "cuda", "vulkan", or false; got ${JSON.stringify(value)}`);
-  }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "auto" || normalized === "metal" || normalized === "cuda" || normalized === "vulkan" || normalized === "false") {
-    return normalized;
-  }
-  throw new Error(`qmdGpuBackend must be one of "auto", "metal", "cuda", "vulkan", or false; got ${JSON.stringify(value)}`);
-}
-function parseQmdChunkStrategy(value) {
-  if (value === void 0 || value === null) return "auto";
-  if (typeof value !== "string") {
-    throw new Error(`qmdChunkStrategy must be "auto" or "regex"; got ${JSON.stringify(value)}`);
-  }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "auto" || normalized === "regex") return normalized;
-  throw new Error(`qmdChunkStrategy must be "auto" or "regex"; got ${JSON.stringify(value)}`);
-}
-function parseQmdSearchStrategy(value) {
-  if (value === void 0 || value === null) return "hybrid";
-  if (typeof value !== "string") {
-    throw new Error(
-      `qmdSearchStrategy must be one of "hybrid", "lex-vec", or "lex"; got ${JSON.stringify(value)}`
-    );
-  }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "hybrid" || normalized === "lex-vec" || normalized === "lex") {
-    return normalized;
-  }
-  throw new Error(
-    `qmdSearchStrategy must be one of "hybrid", "lex-vec", or "lex"; got ${JSON.stringify(value)}`
-  );
-}
-function parseQmdDaemonTimeoutMs(value) {
-  if (value === void 0 || value === null) return 8e3;
+function parseIntegerInClosedRange(value, min, max, fallback, keyName) {
+  if (value === void 0) return fallback;
   const coerced = coerceNumber(value);
-  if (coerced === void 0 || !Number.isInteger(coerced)) {
-    throw new Error(
-      `qmdDaemonTimeoutMs must be an integer number of milliseconds between 1000 and 120000; got ${JSON.stringify(value)}`
-    );
-  }
-  return Math.min(12e4, Math.max(1e3, coerced));
-}
-function parseQmdSubprocessStrategy(value) {
-  if (value === void 0 || value === null) return "query";
-  if (typeof value !== "string") {
+  if (coerced === void 0 || !Number.isFinite(coerced) || !Number.isInteger(coerced) || coerced < min || coerced > max) {
     throw new Error(
-      `qmdSubprocessStrategy must be one of "query" or "search"; got ${JSON.stringify(value)}`
+      `${keyName} must be an integer in [${min}, ${max}]; got ${JSON.stringify(value)}`
     );
   }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "query" || normalized === "search") return normalized;
-  throw new Error(
-    `qmdSubprocessStrategy must be one of "query" or "search"; got ${JSON.stringify(value)}`
-  );
+  return coerced;
 }
 function parseOptionalNonEmptyString(value) {
   if (typeof value !== "string") return void 0;
@@ -1006,24 +959,6 @@ function parsePortNumber(value, fallback, keyName) {
   }
   return coerced;
 }
-function coerceBooleanLike(value) {
-  if (typeof value === "boolean") return value;
-  if (typeof value === "number") {
-    if (value === 1) return true;
-    if (value === 0) return false;
-    return void 0;
-  }
-  if (typeof value === "string") {
-    const normalized = value.trim().toLowerCase();
-    if (normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on") {
-      return true;
-    }
-    if (normalized === "false" || normalized === "0" || normalized === "no" || normalized === "off") {
-      return false;
-    }
-  }
-  return void 0;
-}
 function readNestedConfig(cfg, blockName, key) {
   const block = validateNestedConfigBlock(cfg, blockName);
   if (!block) return void 0;
@@ -1215,6 +1150,7 @@ var DEFAULT_BEHAVIOR_LOOP_PROTECTED_PARAMS = [
   "maxMemoryTokens",
   "qmdMaxResults",
   "qmdColdMaxResults",
+  "qmdEmbeddingBacklogThreshold",
   "recallPlannerMaxQmdResultsMinimal",
   "verbatimArtifactsMaxRecall"
 ];
@@ -1744,6 +1680,11 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     qmdEnabled: cfg.qmdEnabled !== false,
     qmdCollection: typeof cfg.qmdCollection === "string" ? cfg.qmdCollection : "openclaw-engram",
     qmdMaxResults: typeof cfg.qmdMaxResults === "number" ? cfg.qmdMaxResults : 8,
+    qmdEmbeddingBacklogThreshold: (() => {
+      const raw2 = cfg.qmdEmbeddingBacklogThreshold;
+      const n = typeof raw2 === "number" ? raw2 : typeof raw2 === "string" && raw2.trim() !== "" ? Number(raw2) : NaN;
+      return Number.isFinite(n) && Number.isInteger(n) && n >= 0 ? n : 1e3;
+    })(),
     qmdColdTierEnabled: cfg.qmdColdTierEnabled === true,
     qmdColdCollection: typeof cfg.qmdColdCollection === "string" && cfg.qmdColdCollection.length > 0 ? cfg.qmdColdCollection : "openclaw-engram-cold",
     qmdColdMaxResults: typeof cfg.qmdColdMaxResults === "number" ? cfg.qmdColdMaxResults : 8,
@@ -1800,6 +1741,16 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     continuityAuditEnabled: cfg.continuityAuditEnabled === true,
     sessionObserverEnabled: cfg.sessionObserverEnabled === true,
     sessionObserverDebounceMs: typeof cfg.sessionObserverDebounceMs === "number" ? Math.max(0, Math.floor(cfg.sessionObserverDebounceMs)) : 12e4,
+    // Explicit validation (issue #1909 review round 8): reject invalid input
+    // rather than flooring/clamping. Must be an integer in [0, 2^31-1] (Node's
+    // setTimeout ceiling); 0 = save every turn; undefined → 3000.
+    bufferSaveDebounceMs: parseIntegerInClosedRange(
+      cfg.bufferSaveDebounceMs,
+      0,
+      2147483647,
+      3e3,
+      "bufferSaveDebounceMs"
+    ),
     sessionObserverBands,
     injectQuestions: cfg.injectQuestions === true,
     commitmentDecayDays: parseIntegerAtLeast(
@@ -2047,10 +1998,8 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     ) ? cfg.recallDirectAnswerEligibleTaxonomyBuckets.filter(
       (v) => typeof v === "string" && v.length > 0
     ) : ["decisions", "principles", "conventions", "runbooks", "entities"],
-    // Cross-namespace query-budget limiter (issue #565 PR 4/5).
-    // Defaults to false — ships disabled so existing deployments are
-    // unaffected. When enabled, the read path throttles a principal that
-    // issues a burst of recalls against namespaces other than their own.
+    // Cross-namespace query-budget limiter (issue #565 PR 4/5). Defaults to
+    // false — ships disabled; when enabled, throttles cross-namespace recall bursts.
     recallCrossNamespaceBudgetEnabled: coerceBool(cfg.recallCrossNamespaceBudgetEnabled) ?? false,
     recallCrossNamespaceBudgetWindowMs: (() => {
       const n = coerceNumber(cfg.recallCrossNamespaceBudgetWindowMs);
@@ -2064,6 +2013,7 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
       const n = coerceNumber(cfg.recallCrossNamespaceBudgetHardLimit);
       return n !== void 0 && n > 0 ? Math.floor(n) : 30;
     })(),
+    ...parseRecallConcurrencyConfig(cfg),
     // Recall-audit anomaly detector (issue #565 PR 5/5). Defaults off so
     // existing deployments are unaffected; enable explicitly to let the
     // access surfaces flag suspicious query patterns derived from the
@@ -2108,6 +2058,14 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     // `runMemoryWorthBench` in memory-worth-bench.ts. Operators can still
     // opt out with recallMemoryWorthFilterEnabled=false.
     recallMemoryWorthFilterEnabled: coerceBool(cfg.recallMemoryWorthFilterEnabled) ?? true,
+    // Trust/Memory-Worth recall stage corpus-level fallback (issue #1905).
+    // Default true: when a candidate is missing from the frontmatter already
+    // loaded on the hot recall path, the stage may fall back to a per-namespace
+    // corpus counter/signal map (version-keyed, so it hits in steady state).
+    // Set false to disable that O(corpus) fallback entirely — the stage then
+    // uses only the preloaded frontmatter plus a bounded-parallel per-candidate
+    // direct read (fully O(candidates)). coerceBool handles "false"/"0" forms.
+    recallTrustStageCorpusFallbackEnabled: coerceBool(cfg.recallTrustStageCorpusFallbackEnabled) ?? true,
     // Hot-memories result cache (issue #1902). Default on: readAllMemories()
     // serves from the version-keyed in-process corpus cache. coerceBool
     // handles "false"/"0" string forms; set false to force disk scans.
@@ -2214,8 +2172,26 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     activeRecallQueryMode: cfg.activeRecallQueryMode === "message" || cfg.activeRecallQueryMode === "full" ? cfg.activeRecallQueryMode : "recent",
     activeRecallPromptStyle: cfg.activeRecallPromptStyle === "strict" || cfg.activeRecallPromptStyle === "contextual" || cfg.activeRecallPromptStyle === "recall-heavy" || cfg.activeRecallPromptStyle === "precision-heavy" || cfg.activeRecallPromptStyle === "preference-only" ? cfg.activeRecallPromptStyle : "balanced",
     activeRecallCustomInstruction: (() => {
-      const customInstruction = typeof cfg.activeRecallCustomInstruction === "string" ? cfg.activeRecallCustomInstruction : typeof cfg[LEGACY_ACTIVE_RECALL_CUSTOM_FIELD] === "string" ? cfg[LEGACY_ACTIVE_RECALL_CUSTOM_FIELD] : "";
-      return customInstruction.trim().length > 0 ? customInstruction.trim() : null;
+      const raw2 = typeof cfg.activeRecallCustomInstruction === "string" ? cfg.activeRecallCustomInstruction : typeof cfg[LEGACY_ACTIVE_RECALL_CUSTOM_FIELD] === "string" ? cfg[LEGACY_ACTIVE_RECALL_CUSTOM_FIELD] : "";
+      return raw2.trim().length > 0 ? raw2.trim() : null;
+    })(),
+    activeRecallPromptReplacement: (() => {
+      const raw2 = cfg.activeRecallPromptReplacement;
+      if (raw2 !== void 0 && raw2 !== null && typeof raw2 !== "string") {
+        throw new Error(
+          `activeRecallPromptReplacement must be a string; got ${JSON.stringify(raw2)}`
+        );
+      }
+      return typeof raw2 === "string" && raw2.trim().length > 0 ? raw2.trim() : null;
+    })(),
+    activeRecallPromptOverride: (() => {
+      const raw2 = cfg.activeRecallPromptOverride;
+      if (raw2 !== void 0 && raw2 !== null && typeof raw2 !== "string") {
+        throw new Error(
+          `activeRecallPromptOverride must be a string; got ${JSON.stringify(raw2)}`
+        );
+      }
+      return typeof raw2 === "string" && raw2.trim().length > 0 ? raw2.trim() : null;
     })(),
     activeRecallPromptAppend: typeof cfg.activeRecallPromptAppend === "string" && cfg.activeRecallPromptAppend.trim().length > 0 ? cfg.activeRecallPromptAppend.trim() : null,
     activeRecallMaxSummaryChars: typeof cfg.activeRecallMaxSummaryChars === "number" ? Math.min(1e3, Math.max(40, Math.floor(cfg.activeRecallMaxSummaryChars))) : 220,
@@ -2737,6 +2713,7 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     entityRetrievalRecentTurns: typeof cfg.entityRetrievalRecentTurns === "number" ? cfg.entityRetrievalRecentTurns : 6,
     entitySchemas,
     recallBudgetChars: recallPipelineConfig.recallBudgetChars,
+    recallProfileMaxRatio: parseRecallProfileMaxRatio(cfg.recallProfileMaxRatio),
     recallOuterTimeoutMs: typeof cfg.recallOuterTimeoutMs === "number" ? Math.max(0, Math.floor(cfg.recallOuterTimeoutMs)) : 75e3,
     recallCoreDeadlineMs: typeof cfg.recallCoreDeadlineMs === "number" ? Math.max(0, Math.floor(cfg.recallCoreDeadlineMs)) : 75e3,
     recallEnrichmentDeadlineMs: typeof cfg.recallEnrichmentDeadlineMs === "number" ? Math.max(0, Math.floor(cfg.recallEnrichmentDeadlineMs)) : 25e3,
@@ -2847,6 +2824,17 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     compressionGuidelineSemanticTimeoutMs: typeof cfg.compressionGuidelineSemanticTimeoutMs === "number" ? Math.max(1, Math.floor(cfg.compressionGuidelineSemanticTimeoutMs)) : 2500,
     maxProactiveQuestionsPerExtraction: typeof cfg.maxProactiveQuestionsPerExtraction === "number" ? Math.max(0, Math.floor(cfg.maxProactiveQuestionsPerExtraction)) : 2,
     proactiveExtractionTimeoutMs: typeof cfg.proactiveExtractionTimeoutMs === "number" ? Math.max(0, Math.floor(cfg.proactiveExtractionTimeoutMs)) : 2500,
+    proactiveExtractionSkipWhenLocalLlmBusy: (() => {
+      const raw2 = cfg.proactiveExtractionSkipWhenLocalLlmBusy;
+      if (raw2 === void 0 || raw2 === null) return true;
+      const value = coerceBooleanLike(raw2, "proactiveExtractionSkipWhenLocalLlmBusy");
+      if (value === void 0) {
+        throw new Error(
+          `proactiveExtractionSkipWhenLocalLlmBusy must be boolean-like (true|false|1|0|yes|no|on|off); got ${JSON.stringify(raw2)}`
+        );
+      }
+      return value;
+    })(),
     proactiveExtractionMaxTokens: typeof cfg.proactiveExtractionMaxTokens === "number" ? Math.max(0, Math.floor(cfg.proactiveExtractionMaxTokens)) : 900,
     extractionMaxOutputTokens: typeof cfg.extractionMaxOutputTokens === "number" ? Math.max(1, Math.floor(cfg.extractionMaxOutputTokens)) : 16384,
     proactiveExtractionCategoryAllowlist: Array.isArray(cfg.proactiveExtractionCategoryAllowlist) ? cfg.proactiveExtractionCategoryAllowlist.filter(
@@ -2986,10 +2974,9 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     graphEdgeDecayPerWindow: typeof cfg.graphEdgeDecayPerWindow === "number" && Number.isFinite(cfg.graphEdgeDecayPerWindow) ? Math.max(0, Math.min(1, cfg.graphEdgeDecayPerWindow)) : 0.1,
     graphEdgeDecayFloor: typeof cfg.graphEdgeDecayFloor === "number" && Number.isFinite(cfg.graphEdgeDecayFloor) ? Math.max(0, Math.min(1, cfg.graphEdgeDecayFloor)) : 0.1,
     graphEdgeDecayVisibilityThreshold: typeof cfg.graphEdgeDecayVisibilityThreshold === "number" && Number.isFinite(cfg.graphEdgeDecayVisibilityThreshold) ? Math.max(0, Math.min(1, cfg.graphEdgeDecayVisibilityThreshold)) : 0.2,
-    // Issue #681 PR 3/3 — confidence-aware traversal & PageRank refinement.
-    // Floor clamps to [0, 1] so misconfigured input cannot accept negative
-    // confidences or reject every edge. Iterations floors at 0 so a
-    // documented 0 disables PageRank refinement and BFS scores pass through.
+    ...parseBoundedJsonlStateConfig(cfg, parseIntegerAtLeast),
+    // Issue #681 PR 3/3 — confidence-aware traversal. Floor clamps to [0,1]; a
+    // documented 0 iterations disables PageRank refinement (BFS scores pass through).
     graphTraversalConfidenceFloor: typeof cfg.graphTraversalConfidenceFloor === "number" && Number.isFinite(cfg.graphTraversalConfidenceFloor) ? Math.min(1, Math.max(0, cfg.graphTraversalConfidenceFloor)) : 0.2,
     graphTraversalPageRankIterations: typeof cfg.graphTraversalPageRankIterations === "number" && Number.isFinite(cfg.graphTraversalPageRankIterations) && cfg.graphTraversalPageRankIterations >= 0 ? Math.floor(cfg.graphTraversalPageRankIterations) : 8,
     // v8.2: Temporal Memory Tree
@@ -3337,6 +3324,16 @@ function clampNonNegativeNumber(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return void 0;
   return Math.max(0, Math.floor(value));
 }
+function parseRecallProfileMaxRatio(value) {
+  if (value === void 0) return 0.3;
+  const ratio = coerceNumber(value);
+  if (ratio === void 0 || ratio < 0 || ratio > 1) {
+    throw new Error(
+      `recallProfileMaxRatio must be a finite number in [0, 1]; got ${JSON.stringify(value)}`
+    );
+  }
+  return ratio;
+}
 function coerceNonNegativeInt(value, fallback, keyName) {
   if (value === void 0 || value === null) return fallback;
   const coerced = coerceNumber(value);
@@ -3614,4 +3611,4 @@ export {
   VALID_MEMORY_CATEGORIES,
   parseConfig
 };
-//# sourceMappingURL=chunk-INELTPRG.js.map
+//# sourceMappingURL=chunk-EEC7UJPX.js.map