@remnic/core 9.7.15 → 9.9.0

package/src/trust-score-stage.ts

@@ -1,3 +1,18 @@
+import type { QmdSearchResult } from "./types.js";
+
+/** Stable key for a recall result whose path may repeat across namespaces. */
+export function trustResultKey(result: Pick<QmdSearchResult, "path" | "namespace">): string {
+  return JSON.stringify([result.namespace ?? "", result.path]);
+}
+
+/** Read trust metadata while accepting pre-namespace path-only maps. */
+export function trustResultFor(
+  trustByPath: ReadonlyMap<string, TrustStageResultItem>,
+  result: Pick<QmdSearchResult, "path" | "namespace">,
+): TrustStageResultItem | undefined {
+  return trustByPath.get(trustResultKey(result)) ?? trustByPath.get(result.path);
+}
+
 /**
  * trust-score-stage.ts — signal adapters + recall pipeline stage (issue #1577 PR 2).
  *
@@ -133,11 +148,15 @@ export function buildTrustSignalMap(
 export interface TrustStageCandidate {
   path: string;
   score: number;
+  /** Namespace-aware result key used to preserve result identity through rerank. */
+  key?: string;
 }
 
 /** One candidate after the TrustScore stage. */
 export interface TrustStageResultItem {
   path: string;
+  /** Namespace-aware result key used to preserve result identity through rerank. */
+  key?: string;
   /** Final score after the trust multiplier is applied. */
   score: number;
   /** The untouched input score — for telemetry / X-ray. */
@@ -210,7 +229,9 @@ export function applyTrustScoreStage(
 
   for (let i = 0; i < candidates.length; i += 1) {
     const c = candidates[i]!;
-    const signals = options.signals.get(c.path);
+    // Prefer the namespace-aware composite key; fall back to path for callers
+    // (and tests) that key signals by bare path (#2020).
+    const signals = options.signals.get(c.key ?? c.path) ?? options.signals.get(c.path);
     const trust = computeTrustScore(signals, options.weights);
     const isQuarantined = quarantine && trust.band === "quarantine";
     // Quarantined items are excluded from injection. Keep their score unchanged
@@ -224,6 +245,7 @@ export function applyTrustScoreStage(
     const scored = safeBase * multiplier;
     const item: TrustStageResultItem = {
       path: c.path,
+      ...(c.key === undefined ? {} : { key: c.key }),
       score: scored,
       originalScore: c.score,
       multiplier,
@@ -305,28 +327,68 @@ export interface TrustScoreRerankDeps {
   readNamespaceMemories(
     namespace: string,
   ): Promise<ReadonlyArray<{ path: string; frontmatter: TrustFrontmatterProjection }>>;
-  /** Read one memory's frontmatter by path (cold-tier direct fallback). */
-  readMemoryFrontmatter(path: string): Promise<TrustFrontmatterProjection | null>;
+  /** Read one memory's frontmatter by path (cold-tier direct fallback). The
+   * owning namespace is passed so a relative path resolves against the correct
+   * namespace store instead of the first fallback (#2020). */
+  readMemoryFrontmatter(
+    path: string,
+    preferredNamespace?: string,
+  ): Promise<TrustFrontmatterProjection | null>;
+  /**
+   * Current cross-process corpus version for a namespace (issue #1905). Used
+   * to key the per-namespace corpus-fallback cache so it invalidates on the
+   * next memory mutation instead of on a wall-clock timer that is shorter than
+   * recall latency (which produced a permanent steady-state miss).
+   */
+  getNamespaceVersion(namespace: string): Promise<number>;
 }
 
-/** Per-namespace signal cache the host owns and the builder mutates. */
+/**
+ * Per-namespace signal cache the host owns and the builder mutates. Keyed on
+ * the shared corpus version (issue #1905): an entry is valid iff its `version`
+ * still equals the namespace's current corpus version AND it is younger than
+ * TRUST_SIGNAL_CACHE_MAX_AGE_MS. The age bound is required because trust
+ * signals bake wall-clock time into their values (ageDays,
+ * computeMemoryWorth(..., now) with recency half-life) — pure version
+ * invalidation would serve stale decay on a read-only corpus (#1905, Codex).
+ */
 export interface TrustScoreSignalCache {
-  cache: Map<string, { at: number; signals: ReadonlyMap<string, TrustSignals> }>;
-  ttlMs: number;
+  cache: Map<string, { version: number; cachedAt: number; signals: ReadonlyMap<string, TrustSignals> }>;
+}
+
+/** See TrustScoreSignalCache — bounds time-based staleness of cached signals. */
+export const TRUST_SIGNAL_CACHE_MAX_AGE_MS = 300_000;
+
+/** Bound on distinct namespaces retained; overflow evicts the oldest. */
+export const TRUST_SIGNAL_CACHE_MAX_NAMESPACES = 64;
+
+/** Insert-ordered bounded set: evict the oldest namespace on overflow. */
+function capTrustSignalCache(cache: TrustScoreSignalCache["cache"], max: number): void {
+  while (cache.size > max) {
+    const oldest = cache.keys().next().value;
+    if (oldest === undefined) break;
+    cache.delete(oldest);
+  }
 }
 
 /**
- * Build the `path → TrustSignals` map for recall candidates using a
- * per-namespace cache plus a direct-path fallback for cold-tier candidates
- * absent from the hot scan. Extracted from the orchestrator (issue #1577) so
- * the god file carries only thin wiring — the scoring itself is
- * {@link applyTrustScoreStage}.
+ * Build the `path → TrustSignals` map for recall candidates.
+ *
+ * O(candidates) inversion (issue #1905): when the host passes
+ * `preloadedFrontmatter` (frontmatter already loaded on the hot recall path),
+ * candidate signals are seeded directly from it — no corpus scan. Only
+ * candidates still missing fall back to the corpus-level per-namespace map
+ * (config-gated, version-keyed so it actually hits in steady state) and then
+ * to a bounded-parallel direct per-path read.
  *
  * Fail-open: a single unreadable namespace or memory is logged and skipped so
  * a storage hiccup never breaks recall (mirrors `memory-worth-filter.ts`).
  */
 export async function buildTrustSignalsForRerank(
-  candidatePaths: readonly string[],
+  candidates: readonly (
+    | string
+    | { path: string; signalKey?: string; lookupKey?: string; namespace?: string }
+  )[],
   namespaces: readonly string[],
   deps: TrustScoreRerankDeps,
   signalCache: TrustScoreSignalCache,
@@ -334,63 +396,164 @@ export async function buildTrustSignalsForRerank(
   options: {
     recencyHalfLifeDays?: number;
     logDebug?: (message: string, context: Record<string, unknown>) => void;
+    /**
+     * Candidate frontmatter already loaded on the hot recall path (issue
+     * #1905). When present, candidate signals are seeded from it before any
+     * corpus scan, so the common warm-candidate recall does zero
+     * `readNamespaceMemories` calls. Structural — a `MemoryFile` map satisfies
+     * `{ frontmatter: TrustFrontmatterProjection }` without importing it.
+     */
+    preloadedFrontmatter?: ReadonlyMap<string, { frontmatter: TrustFrontmatterProjection }>;
+    /**
+     * When false, skip the corpus-level `readNamespaceMemories` fallback
+     * entirely (candidates-first + direct-read only). Defaults to true so the
+     * corpus path stays reachable. See `recallTrustStageCorpusFallbackEnabled`.
+     */
+    corpusFallbackEnabled?: boolean;
+    /**
+     * Cooperative cancellation (issue #1905, Codex): when the recall's shared
+     * enrichment-assembly deadline wins the race, the host aborts this signal
+     * so an orphaned corpus scan / direct-read loop stops at the next loop
+     * boundary instead of continuing to burn I/O after recall already returned.
+     */
+    abortSignal?: AbortSignal;
   } = {},
 ): Promise<Map<string, TrustSignals>> {
-  const nowMs = now.getTime();
   const logDebug = options.logDebug ?? (() => {});
   const signals = new Map<string, TrustSignals>();
+  const corpusFallbackEnabled = options.corpusFallbackEnabled ?? true;
+  const halfLife = { recencyHalfLifeDays: options.recencyHalfLifeDays };
 
-  // Evict expired cache entries (mirrors the worth-cache discipline).
-  for (const [key, entry] of signalCache.cache) {
-    if (nowMs - entry.at >= signalCache.ttlMs) signalCache.cache.delete(key);
-  }
+  // Paths examined via preloaded frontmatter (issue #1905, Cursor/Codex).
+  // buildTrustSignalMap deliberately OMITS neutral memories (no trust fields),
+  // so a preloaded candidate can be examined yet absent from `signals` — it
+  // must NOT be treated as missing, or the corpus fallback + direct read fire
+  // for every uninstrumented hot candidate, defeating the O(candidates) path.
+  // Absent-from-signals still means multiplier 1.0 downstream, exactly what a
+  // corpus scan would have produced for the same neutral memory.
+  const preloadedKeys = new Set<string>();
 
-  // Per-namespace hot scan with cache.
-  const seenNamespaces = new Set<string>();
-  for (const ns of namespaces) {
-    if (seenNamespaces.has(ns)) continue;
-    seenNamespaces.add(ns);
-    try {
-      const cached = signalCache.cache.get(ns);
-      let nsMap: ReadonlyMap<string, TrustSignals> | undefined;
-      if (cached && nowMs - cached.at < signalCache.ttlMs) {
-        nsMap = cached.signals;
-      } else {
-        const memories = await deps.readNamespaceMemories(ns);
-        nsMap = buildTrustSignalMap(memories, now, {
-          recencyHalfLifeDays: options.recencyHalfLifeDays,
-        });
-        signalCache.cache.set(ns, { at: nowMs, signals: nsMap });
-      }
-      for (const [path, s] of nsMap) signals.set(path, s);
-    } catch (err) {
-      logDebug("trust-score: failed to read namespace, skipping", {
-        namespace: ns,
-        error: (err as Error).message,
-      });
+  // Normalize candidates to a composite identity: `signalKey` is what the
+  // trust stage looks up (namespace-aware), `lookupKey` matches the preloaded
+  // frontmatter map's key, `path` is the raw store path used for corpus/direct
+  // reads. A bare string keeps the legacy path-only behavior (#2020).
+  const normalized = candidates.map((c) =>
+    typeof c === "string"
+      ? { path: c, signalKey: c, lookupKey: c, namespace: undefined as string | undefined }
+      : {
+          path: c.path,
+          signalKey: c.signalKey ?? c.path,
+          lookupKey: c.lookupKey ?? c.path,
+          namespace: c.namespace,
+        },
+  );
+
+  // O(candidates) fast path: seed signals from candidate frontmatter already
+  // loaded on the hot recall path. Reuses the exact `buildTrustSignalMap`
+  // computation so a candidate's signals equal what a corpus scan produced.
+  if (options.preloadedFrontmatter) {
+    const preloaded: Array<{ path: string; frontmatter: TrustFrontmatterProjection }> = [];
+    for (const c of normalized) {
+      // Composite lookupKey is authoritative; the bare-path fallback keeps
+      // path-keyed preloaded maps (e.g. the recent-scan branch) hitting the
+      // fast path and is inert in production composite-keyed maps (#2020).
+      const mem =
+        options.preloadedFrontmatter.get(c.lookupKey) ??
+        options.preloadedFrontmatter.get(c.path);
+      if (!mem) continue;
+      preloadedKeys.add(c.signalKey);
+      preloaded.push({ path: c.signalKey, frontmatter: mem.frontmatter });
+    }
+    if (preloaded.length > 0) {
+      const seeded = buildTrustSignalMap(preloaded, now, halfLife);
+      for (const [key, s] of seeded) signals.set(key, s);
     }
   }
 
-  // Direct per-path fallback for cold-tier candidates absent from the hot scan.
-  const missing = candidatePaths.filter((p) => !signals.has(p));
-  if (missing.length > 0) {
-    const fallbackMemories: Array<{ path: string; frontmatter: TrustFrontmatterProjection }> = [];
-    for (const path of missing) {
+  // Corpus-level fallback (config-gated): candidates still missing probe a
+  // per-namespace signal map, cached and invalidated by the shared
+  // cross-process corpus version. Only candidate rows are copied out — never
+  // the whole map (issue #1905, no per-recall full-map union).
+  if (corpusFallbackEnabled) {
+    const seenNamespaces = new Set<string>();
+    for (const ns of namespaces) {
+      // Cooperative cancellation: the recall's assembly deadline may have won
+      // the race — stop before starting another namespace scan (#1905, Codex).
+      if (options.abortSignal?.aborted) break;
+      if (seenNamespaces.has(ns)) continue;
+      seenNamespaces.add(ns);
+      if (normalized.every((c) => signals.has(c.signalKey) || preloadedKeys.has(c.signalKey))) break;
       try {
-        const frontmatter = await deps.readMemoryFrontmatter(path);
-        if (frontmatter) fallbackMemories.push({ path, frontmatter });
+        const version = await deps.getNamespaceVersion(ns);
+        const cached = signalCache.cache.get(ns);
+        const nowMs = now.getTime();
+        let nsMap: ReadonlyMap<string, TrustSignals>;
+        // Valid iff the corpus version still matches AND the entry is younger
+        // than the max age: trust signals bake `now` into their values, so an
+        // unchanged corpus still goes stale as wall-clock advances (#1905, Codex).
+        if (
+          cached &&
+          cached.version === version &&
+          nowMs - cached.cachedAt < TRUST_SIGNAL_CACHE_MAX_AGE_MS
+        ) {
+          nsMap = cached.signals;
+        } else {
+          const memories = await deps.readNamespaceMemories(ns);
+          nsMap = buildTrustSignalMap(memories, now, halfLife);
+          signalCache.cache.set(ns, { version, cachedAt: nowMs, signals: nsMap });
+          capTrustSignalCache(signalCache.cache, TRUST_SIGNAL_CACHE_MAX_NAMESPACES);
+        }
+        for (const c of normalized) {
+          // Preloaded keys were already examined — absent-from-signals means
+          // neutral (multiplier 1.0), identical to what the corpus map holds.
+          if (signals.has(c.signalKey) || preloadedKeys.has(c.signalKey)) continue;
+          // A namespaced candidate belongs to exactly one namespace: never seed
+          // its signals from a different namespace's corpus map, or two
+          // same-path candidates in different namespaces collapse (#2020).
+          if (c.namespace !== undefined && c.namespace !== ns) continue;
+          const s = nsMap.get(c.path);
+          if (s) signals.set(c.signalKey, s);
+        }
       } catch (err) {
-        logDebug("trust-score: direct path lookup failed", {
-          path,
+        logDebug("trust-score: failed to read namespace, skipping", {
+          namespace: ns,
           error: (err as Error).message,
         });
       }
     }
+  }
+
+  // Direct per-path fallback for candidates still absent (cold-tier / archive).
+  // Preloaded paths are excluded — they were examined and are neutral priors.
+  // Bounded-parallel (≤16) to match loadSearchResultMemoryMap's batch size.
+  const missing = normalized.filter(
+    (c) => !signals.has(c.signalKey) && !preloadedKeys.has(c.signalKey),
+  );
+  if (missing.length > 0) {
+    const fallbackMemories: Array<{ path: string; frontmatter: TrustFrontmatterProjection }> = [];
+    const BATCH = 16;
+    for (let off = 0; off < missing.length; off += BATCH) {
+      // Cooperative cancellation between batches (#1905, Codex).
+      if (options.abortSignal?.aborted) break;
+      const batch = await Promise.all(
+        missing.slice(off, off + BATCH).map(async (c) => {
+          try {
+            const frontmatter = await deps.readMemoryFrontmatter(c.path, c.namespace);
+            return frontmatter ? { path: c.signalKey, frontmatter } : null;
+          } catch (err) {
+            logDebug("trust-score: direct path lookup failed", {
+              path: c.path,
+              error: (err as Error).message,
+            });
+            return null;
+          }
+        }),
+      );
+      for (const item of batch) if (item) fallbackMemories.push(item);
+    }
     if (fallbackMemories.length > 0) {
-      const fallbackSignals = buildTrustSignalMap(fallbackMemories, now, {
-        recencyHalfLifeDays: options.recencyHalfLifeDays,
-      });
-      for (const [path, s] of fallbackSignals) signals.set(path, s);
+      const fallbackSignals = buildTrustSignalMap(fallbackMemories, now, halfLife);
+      for (const [key, s] of fallbackSignals) signals.set(key, s);
     }
   }
 

package/src/types-continuity.ts

@@ -0,0 +1,57 @@
+export type ContinuityIncidentState = "open" | "closed";
+
+export interface ContinuityIncidentRecord {
+  id: string;
+  state: ContinuityIncidentState;
+  openedAt: string;
+  updatedAt: string;
+  triggerWindow?: string;
+  symptom: string;
+  suspectedCause?: string;
+  fixApplied?: string;
+  verificationResult?: string;
+  preventiveRule?: string;
+  closedAt?: string;
+  filePath?: string;
+}
+
+export interface ContinuityIncidentOpenInput {
+  triggerWindow?: string;
+  symptom: string;
+  suspectedCause?: string;
+}
+
+export interface ContinuityIncidentCloseInput {
+  fixApplied: string;
+  verificationResult: string;
+  preventiveRule?: string;
+}
+
+export type ContinuityLoopCadence = "daily" | "weekly" | "monthly" | "quarterly";
+export type ContinuityLoopStatus = "active" | "paused" | "retired";
+
+export interface ContinuityImprovementLoop {
+  id: string;
+  cadence: ContinuityLoopCadence;
+  purpose: string;
+  status: ContinuityLoopStatus;
+  killCondition: string;
+  lastReviewed: string;
+  notes?: string;
+}
+
+export interface ContinuityLoopUpsertInput {
+  id: string;
+  cadence: ContinuityLoopCadence;
+  purpose: string;
+  status: ContinuityLoopStatus;
+  killCondition: string;
+  lastReviewed?: string;
+  notes?: string;
+}
+
+export interface ContinuityLoopReviewInput {
+  status?: ContinuityLoopStatus;
+  notes?: string;
+  reviewedAt?: string;
+}

package/src/types.ts

@@ -1,3 +1,5 @@
+import type { BoundedJsonlStateConfig } from "./bounded-jsonl-state.js";
+
 export type ReasoningEffort = "none" | "low" | "medium" | "high";
 export type TriggerMode = "smart" | "every_n" | "time_based";
 export type SignalLevel = "none" | "low" | "medium" | "high";
@@ -38,14 +40,7 @@ export type ActiveRecallPromptStyle =
   | "recall-heavy"
   | "precision-heavy"
   | "preference-only";
-export type ActiveRecallThinking =
-  | "off"
-  | "minimal"
-  | "low"
-  | "medium"
-  | "high"
-  | "xhigh"
-  | "adaptive";
+export type ActiveRecallThinking = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "adaptive";
 export type ActiveRecallChatType = "direct" | "group" | "channel";
 export type ActiveRecallModelFallbackPolicy = "default-remote" | "resolved-only";
 
@@ -668,7 +663,7 @@ export interface SemanticChunkingConfigShape {
   fallbackToRecursive: boolean;
 }
 
-export interface PluginConfig {
+export interface PluginConfig extends BoundedJsonlStateConfig {
   openaiApiKey: string | undefined;
   openaiBaseUrl: string | undefined;
   model: string;
@@ -676,6 +671,14 @@ export interface PluginConfig {
   triggerMode: TriggerMode;
   bufferMaxTurns: number;
   bufferMaxMinutes: number;
+  /**
+   * Debounce window (ms) for persisting the smart buffer to `state/buffer.json`
+   * (issue #1909). Steady-state buffering coalesces the whole-state serialize
+   * onto a trailing-edge timer instead of rewriting on every turn; extraction
+   * trigger/clear and shutdown still force an immediate flush. Default 3000.
+   * `0` restores the legacy save-every-turn behavior exactly.
+   */
+  bufferSaveDebounceMs: number;
   /**
    * Surprise-gated buffer flush (issue #563, D-MEM).
    *
@@ -724,6 +727,7 @@ export interface PluginConfig {
   qmdEnabled: boolean;
   qmdCollection: string;
   qmdMaxResults: number;
+  qmdEmbeddingBacklogThreshold: number;
   qmdColdTierEnabled?: boolean;
   qmdColdCollection?: string;
   qmdColdMaxResults?: number;
@@ -1000,12 +1004,8 @@ export interface PluginConfig {
    * whose resolved taxonomy category is not in this list never qualify.
    */
   recallDirectAnswerEligibleTaxonomyBuckets: string[];
-  /**
-   * Cross-namespace query-budget limiter (issue #565 PR 4/5). When true,
-   * a principal that issues a burst of recalls against namespaces other
-   * than their own is throttled once its per-window count crosses
-   * `recallCrossNamespaceBudgetHardLimit`. Default false — ships disabled.
-   */
+  /** Cross-namespace query-budget limiter (issue #565 PR 4/5): throttle a
+   *  principal's cross-namespace recall burst past the hard limit. Default false. */
   recallCrossNamespaceBudgetEnabled: boolean;
   /** Rolling window in milliseconds over which cross-namespace reads are counted. */
   recallCrossNamespaceBudgetWindowMs: number;
@@ -1017,6 +1017,10 @@ export interface PluginConfig {
   recallCrossNamespaceBudgetSoftLimit: number;
   /** Hard threshold — calls past this count are denied in the window. */
   recallCrossNamespaceBudgetHardLimit: number;
+  /** Max concurrent recalls per principal; `0` = unlimited. Default 4 (#1906). */
+  recallMaxConcurrentPerPrincipal: number;
+  /** Coalesce identical concurrent recalls per principal; each caller gets its own clone. Default true. */
+  recallSingleFlightEnabled: boolean;
   // Memory Worth recall filter (issue #560 PR 4)
   /**
    * When true, recall multiplies candidate scores by the Memory Worth
@@ -1027,6 +1031,14 @@ export interface PluginConfig {
    * once the benchmark shows precision tie-or-win.
    */
   recallMemoryWorthFilterEnabled: boolean;
+  /**
+   * When false, the Trust/Memory-Worth recall stage skips its corpus-level
+   * fallback (a per-namespace `readAllMemories`-derived counter/signal map)
+   * and relies only on frontmatter already loaded on the hot recall path plus
+   * a bounded-parallel per-candidate direct read — fully O(candidates)
+   * (issue #1905). Default true keeps the corpus fallback reachable.
+   */
+  recallTrustStageCorpusFallbackEnabled: boolean;
   /**
    * Serve `StorageManager.readAllMemories()` from a version-keyed in-process
    * cache of the full parsed corpus (issue #1902). Default true. When on, a
@@ -1163,6 +1175,8 @@ export interface PluginConfig {
   activeRecallQueryMode: ActiveRecallQueryMode;
   activeRecallPromptStyle: ActiveRecallPromptStyle;
   activeRecallCustomInstruction: string | null;
+  activeRecallPromptReplacement: string | null;
+  activeRecallPromptOverride: string | null;
   activeRecallPromptAppend: string | null;
   activeRecallMaxSummaryChars: number;
   activeRecallRecentUserTurns: number;
@@ -1850,6 +1864,8 @@ export interface PluginConfig {
   entitySchemas?: Record<string, EntitySchemaDefinition>;
   // Recall assembly controls
   recallBudgetChars: number;
+  /** Maximum fraction of the total recall budget that the behavioral profile may consume. */
+  recallProfileMaxRatio: number;
   recallOuterTimeoutMs: number;
   recallCoreDeadlineMs: number;
   recallEnrichmentDeadlineMs: number;
@@ -1932,6 +1948,7 @@ export interface PluginConfig {
   compressionGuidelineSemanticTimeoutMs: number;
   maxProactiveQuestionsPerExtraction: number;
   proactiveExtractionTimeoutMs: number;
+  proactiveExtractionSkipWhenLocalLlmBusy: boolean;
   proactiveExtractionMaxTokens: number;
   extractionMaxOutputTokens: number;
   proactiveExtractionCategoryAllowlist?: MemoryCategory[];
@@ -2096,11 +2113,9 @@ export interface PluginConfig {
   graphEdgeDecayVisibilityThreshold: number;
 
   /**
-   * Issue #681 PR 3/3 — minimum edge confidence required for an edge to be
-   * traversed during spreading activation. Edges with `confidence` below this
-   * floor are pruned and contribute neither activation nor downstream
-   * neighbors. Legacy edges without `confidence` are treated as 1.0 so they
-   * always pass the floor. Range `[0, 1]`; default `0.2`.
+   * Issue #681 PR 3/3 — minimum edge confidence to traverse during spreading
+   * activation. Edges below are pruned (no activation, no downstream neighbors);
+   * legacy edges without `confidence` are treated as 1.0. Range `[0, 1]`; default `0.2`.
    */
   graphTraversalConfidenceFloor: number;
   /**
@@ -3409,6 +3424,8 @@ export interface QmdSearchResult {
   line?: number;
   explain?: QmdSearchExplain;
   transport?: "daemon" | "subprocess" | "hybrid" | "scoped_prefilter";
+  /** Namespace that owned this result when returned by a namespace fanout search. */
+  namespace?: string;
 }
 
 export interface QmdSearchExplain {
@@ -3614,67 +3631,24 @@ export interface CompressionGuidelineOptimizerState {
   ruleUpdates?: CompressionGuidelineOptimizerRuleUpdate[];
 }
 
-export type ContinuityIncidentState = "open" | "closed";
-
-export interface ContinuityIncidentRecord {
-  id: string;
-  state: ContinuityIncidentState;
-  openedAt: string;
-  updatedAt: string;
-  triggerWindow?: string;
-  symptom: string;
-  suspectedCause?: string;
-  fixApplied?: string;
-  verificationResult?: string;
-  preventiveRule?: string;
-  closedAt?: string;
-  filePath?: string;
-}
-
-export interface ContinuityIncidentOpenInput {
-  triggerWindow?: string;
-  symptom: string;
-  suspectedCause?: string;
-}
-
-export interface ContinuityIncidentCloseInput {
-  fixApplied: string;
-  verificationResult: string;
-  preventiveRule?: string;
-}
-
-export type ContinuityLoopCadence = "daily" | "weekly" | "monthly" | "quarterly";
-export type ContinuityLoopStatus = "active" | "paused" | "retired";
-
-export interface ContinuityImprovementLoop {
-  id: string;
-  cadence: ContinuityLoopCadence;
-  purpose: string;
-  status: ContinuityLoopStatus;
-  killCondition: string;
-  lastReviewed: string;
-  notes?: string;
-}
-
-export interface ContinuityLoopUpsertInput {
-  id: string;
-  cadence: ContinuityLoopCadence;
-  purpose: string;
-  status: ContinuityLoopStatus;
-  killCondition: string;
-  lastReviewed?: string;
-  notes?: string;
-}
-
-export interface ContinuityLoopReviewInput {
-  status?: ContinuityLoopStatus;
-  notes?: string;
-  reviewedAt?: string;
-}
+// Continuity incident + improvement-loop types live in a sibling module to keep
+// types.ts under its size ceiling; re-exported so `./types.js` imports resolve.
+export type {
+  ContinuityIncidentState,
+  ContinuityIncidentRecord,
+  ContinuityIncidentOpenInput,
+  ContinuityIncidentCloseInput,
+  ContinuityLoopCadence,
+  ContinuityLoopStatus,
+  ContinuityImprovementLoop,
+  ContinuityLoopUpsertInput,
+  ContinuityLoopReviewInput,
+} from "./types-continuity.js";
 
 /** Entry in the access tracking buffer (batched updates) */
 export interface AccessTrackingEntry {
   memoryId: string;
+  memoryPath?: string;
   newCount: number;
   lastAccessed: string;
 }