@remnic/core 9.7.15 → 9.9.0

package/dist/orchestration/maintenance.d.ts

@@ -1,8 +1,19 @@
-import { P as PluginConfig } from '../types-Cg8q7W7_.js';
+import { P as PluginConfig } from '../types-D_fG2ix8.js';
 import { SearchBackend } from '../search/port.js';
+import { S as StorageManager } from '../storage-NIyKYD8g.js';
+import { N as NamespaceCatalog } from '../catalog-BWqHb5HT.js';
 import { NamespaceSearchRouter } from '../namespaces/search.js';
-import { N as NamespaceCatalog } from '../catalog-C9444P10.js';
 import '../message-parts/index.js';
+import '../bounded-jsonl-state.js';
+import '../types-continuity.js';
+import '../page-versioning.js';
+import '../consolidation-operator.js';
+import '../memory-projection-store.js';
+import '../maintenance/memory-governance.js';
+import '../runtime/better-sqlite.js';
+import 'better-sqlite3';
+import '../write-envelope.js';
+import '../structured-attributes.js';
 
 /**
  * Maintenance scheduler — extracted from the orchestrator (issue #1526 PR1).
@@ -34,6 +45,21 @@ interface MaintenanceSchedulerDeps {
     getQmd: () => SearchBackend;
     namespaceSearchRouter: NamespaceSearchRouter;
     namespaceCatalog: NamespaceCatalog;
+    /**
+     * Root storage (secure-store configured). Threaded so lifecycle-ledger
+     * auto-compaction (#1910) rebuilds through the live secure context: encrypted
+     * memories stay decryptable and the rewritten ledger stays encrypted at rest.
+     * Omitted in focused tests, where compaction falls back to a fresh plaintext
+     * StorageManager (the CLI-equivalent path).
+     */
+    getStorage?: () => StorageManager;
+    /**
+     * Resolve a namespace's (secure-store aware) storage. Threaded so
+     * auto-compaction also bounds per-namespace lifecycle ledgers under
+     * `memoryDir/namespaces/<token>/state/`, not just the root state path
+     * (#1910). Consulted only when namespaces are enabled.
+     */
+    storageForNamespace?: (namespace: string) => Promise<StorageManager>;
 }
 /**
  * Schedules and debounces memory maintenance work. Owns the cadence +
@@ -53,6 +79,9 @@ declare class MaintenanceScheduler {
     private qmdMaintenanceInFlight;
     private lastQmdEmbedAtMs;
     private lastQmdEmbedAtMsByNamespace;
+    private lifecycleCompactionInFlight;
+    private lastLifecycleCompactionAtMs;
+    private lifecycleLedgerMaxBytes;
     constructor(deps: MaintenanceSchedulerDeps);
     /**
      * Register every cron job the daemon should run, gated by its config flag.
@@ -99,6 +128,96 @@ declare class MaintenanceScheduler {
     requestQmdMaintenanceForTool(reason: string): void;
     /** Internal: run a single QMD maintenance pass under singleflight guard. */
     runQmdMaintenance(): Promise<void>;
+    /**
+     * Size-gated, throttled, single-flighted auto-compaction of the lifecycle
+     * ledger (issue #1910). Compacts the root ledger AND every namespace ledger
+     * (`memoryDir/namespaces/<token>/state/`) when namespaces are enabled, each
+     * through the existing `rebuildMemoryLifecycleLedger` so the
+     * archive-then-atomic-write discipline is reused verbatim. `0` disables.
+     *
+     * Before compacting, drain EVERY target's durable pending-append spill (the
+     * root ledger AND each namespace ledger) so a lifecycle event that spilled
+     * while a prior long rewrite held the lock is folded back into its ledger and
+     * cannot be silently lost (issue #2033). Draining is independent of both the
+     * compaction threshold and the min-interval throttle: targets are enumerated
+     * through the same safe (symlink/containment-checked) resolver and every
+     * eligible queue is drained BEFORE any throttle return, so a namespace spill
+     * created after the previous pass never waits out the whole interval.
+     * Encrypted-store safety is preserved — a keyed target drains through its
+     * secure StorageManager, a filesystem-fallback target only through a plaintext
+     * context that refuses encrypted ledgers/spills. Work stays bounded: one
+     * target enumeration plus a bounded per-queue drain.
+     *
+     * The min-interval throttle timestamp advances ONLY after real, fully
+     * successful compaction work: a failed OR deferred target leaves the throttle
+     * un-advanced so it stays eligible on the next maintenance pass, while
+     * `lifecycleCompactionInFlight` still prevents overlapping runs. A "deferred"
+     * target is oversized but could not be compacted because its encrypted ledger
+     * has no unlocked secure store — arming the throttle for it would suppress the
+     * retry of that still-oversized ledger for the whole interval (#2033).
+     *
+     * The min-interval throttle is bypassed for one case: an encrypted ledger
+     * already at/over the whole-file decrypt cap is unreadable, so it must be
+     * clamped on the next pass rather than wait out the interval. Ordinary
+     * below-cap (or plaintext) targets stay throttled (#2033).
+     */
+    private maybeCompactMemoryLifecycleLedger;
+    /**
+     * True when any lifecycle target's ledger is encrypted at rest AND its
+     * on-disk size is at/over the whole-file decrypt cap. Such a ledger is already
+     * unreadable (the secure reader refuses at/over the cap), so it must reach the
+     * bounded compaction path on the next maintenance pass regardless of the
+     * global min-interval throttle — otherwise the throttle could keep an
+     * unreadable ledger un-clamped for a whole interval (#2033). Ordinary
+     * below-cap or plaintext targets never match, so the throttle still governs
+     * them. A stat/probe failure yields "no forced target" and is left to the
+     * normal compaction path, which classifies it as failed and retries.
+     */
+    private hasOverCapEncryptedLifecycleLedger;
+    /**
+     * Drain one compaction target's durable pending spill. A catalog-backed
+     * target folds through its secure StorageManager; a filesystem-fallback
+     * target (no storage) folds through a path-scoped plaintext context that
+     * refuses encrypted ledgers/spills so a keyless drain never downgrades an
+     * encrypted ledger (issue #2033).
+     */
+    private drainPendingForTarget;
+    /** Drain a target's durable pending lifecycle-append spill into its ledger
+     *  (issue #2033); non-fatal and a fast no-op when nothing is pending. */
+    private drainPendingLifecycleAppends;
+    /**
+     * Drain a filesystem-fallback target's pending lifecycle-append spill when no
+     * secure StorageManager is available (catalog-disabled namespace; issue
+     * #2033). Uses the safe path-scoped PLAINTEXT context this fallback already
+     * operates in: a keyless drain can only fold plaintext spills into a plaintext
+     * ledger, so it refuses when the ledger or ANY spill is encrypted at rest,
+     * leaving those pending for a keyed (catalog-path) drain — exactly mirroring
+     * the fallback compaction's encrypted-ledger deferral. Non-fatal; a fast
+     * no-op when nothing is pending. The shared spill lister enforces the symlink/
+     * containment guard on every spill file it reads or deletes.
+     */
+    private drainPendingLifecycleAppendsForPath;
+    /**
+     * Enumerate the lifecycle ledgers to consider for compaction: the root
+     * (through the secure-configured root storage when available) plus every
+     * cataloged namespace ledger when namespaces are enabled. Deduplicated by
+     * resolved storage dir so a namespace that collapses onto the root is not
+     * compacted twice. Namespace resolution failures are non-fatal.
+     */
+    private resolveLifecycleCompactionTargets;
+    /**
+     * Compact one lifecycle ledger when it is at/over `threshold`. Returns
+     * `"skipped"` (absent or below threshold — nothing to do), `"compacted"`
+     * (rewritten and verified under the read/decrypt cap), `"failed"`
+     * (rebuild/probe threw, or the rewritten ledger is STILL over the cap — an
+     * ineffective compaction — non-fatal, retried next pass), or `"deferred"`
+     * (oversized but its encrypted ledger cannot be rewritten because no unlocked
+     * secure store is available — real work still pending, so the caller must NOT
+     * arm the throttle). #2033: a deferred/failed target is distinct from a genuine
+     * no-op so one namespace compacting cannot suppress retries for another, and
+     * an over-cap rewrite never arms the throttle.
+     */
+    private compactLifecycleLedgerTarget;
     /** Build the namespace-aware maintenance plan for one job. */
     private namespaceMaintenancePlan;
     /**

package/dist/orchestration/maintenance.js

@@ -1,31 +1,38 @@
 import {
   MaintenanceScheduler
-} from "../chunk-QQGPUKMT.js";
+} from "../chunk-MC5Q3J7S.js";
 import "../chunk-666A3MOW.js";
-import "../chunk-HF77M34J.js";
-import "../chunk-3IY64MV6.js";
-import "../chunk-7PND4PUC.js";
-import "../chunk-EGGE52UU.js";
+import "../chunk-7RNBVZZO.js";
+import "../chunk-KJTKLXTH.js";
+import "../chunk-GFPZS3F5.js";
+import "../chunk-44XZ75OQ.js";
+import "../chunk-R6YJI3HE.js";
+import "../chunk-MMGGVZ4Q.js";
 import "../chunk-O75CRYGF.js";
-import "../chunk-K7LOWSLU.js";
-import "../chunk-L2B3EE7B.js";
+import "../chunk-4BJQODZF.js";
 import "../chunk-B3ABVQ36.js";
-import "../chunk-5UZXUTVO.js";
-import "../chunk-VSMRDBFT.js";
-import "../chunk-LTJAMRGI.js";
-import "../chunk-EHK6KZHK.js";
+import "../chunk-2QMKMVHH.js";
+import "../chunk-DEBHXHJR.js";
+import "../chunk-DNHVPZOD.js";
 import "../chunk-6CIAGZ6X.js";
 import "../chunk-J6A3CX5N.js";
-import "../chunk-4KJLYTLS.js";
-import "../chunk-SVOZFLIQ.js";
-import "../chunk-PBSAPHHA.js";
-import "../chunk-RULE4VG5.js";
-import "../chunk-SCU65EZI.js";
-import "../chunk-RHOZ5LLO.js";
+import "../chunk-V57NLO5P.js";
+import "../chunk-FF4KLI5W.js";
+import "../chunk-YVKF3HEW.js";
+import "../chunk-AVPXXV6J.js";
+import "../chunk-EGGE52UU.js";
+import "../chunk-GCASGYIO.js";
+import "../chunk-WL5EBRDH.js";
+import "../chunk-347WD2LE.js";
 import "../chunk-RL6NEVXT.js";
+import "../chunk-ILGC6JH6.js";
+import "../chunk-SCU65EZI.js";
 import "../chunk-DM2T26WE.js";
 import "../chunk-LDXUBPMO.js";
-import "../chunk-VA4WSW54.js";
+import "../chunk-CGASUJVP.js";
+import "../chunk-R3DJVOSM.js";
+import "../chunk-BT7NVCML.js";
+import "../chunk-JYIJNNN3.js";
 import "../chunk-AAD2ZS6P.js";
 import "../chunk-G7D6GZ5J.js";
 import "../chunk-5VQJBH2G.js";
@@ -34,28 +41,34 @@ import "../chunk-XMMESCPD.js";
 import "../chunk-42JKGUFJ.js";
 import "../chunk-PDJTHRAW.js";
 import "../chunk-W5H6ZRPT.js";
-import "../chunk-UXKMMNJD.js";
-import "../chunk-K2ZLHESQ.js";
-import "../chunk-VFSP73LP.js";
+import "../chunk-C23BYTJV.js";
+import "../chunk-QIEUU4UK.js";
 import "../chunk-L2EXJQJP.js";
+import "../chunk-45GF7Y3V.js";
 import "../chunk-RGMVMVMF.js";
 import "../chunk-N7RWREIQ.js";
-import "../chunk-IKQTFQMI.js";
-import "../chunk-U3PN77QT.js";
-import "../chunk-BFPETA3S.js";
-import "../chunk-OEHCMALU.js";
-import "../chunk-PHK3HARR.js";
-import "../chunk-4DJQYKMN.js";
+import "../chunk-7AMFUATK.js";
+import "../chunk-5I4M26Q7.js";
 import "../chunk-5GKPFL3S.js";
+import "../chunk-4DJQYKMN.js";
+import "../chunk-PQVCH2AE.js";
 import "../chunk-EYIEWJNI.js";
 import "../chunk-JUC24CTX.js";
-import "../chunk-37CTGERM.js";
-import "../chunk-J2HSAU72.js";
+import "../chunk-6MKAMLQL.js";
+import "../chunk-JAKIDQB2.js";
+import "../chunk-BJMBJZ2Y.js";
+import "../chunk-UKJAGEXH.js";
+import "../chunk-FP2373TW.js";
+import "../chunk-AIK5W3IW.js";
 import "../chunk-A6XUJE5D.js";
+import "../chunk-5UZXUTVO.js";
 import "../chunk-P7FMDTKL.js";
 import "../chunk-VS2IYZRU.js";
-import "../chunk-6MKAMLQL.js";
-import "../chunk-JAKIDQB2.js";
+import "../chunk-755Q3DGF.js";
+import "../chunk-U3PN77QT.js";
+import "../chunk-SCCO46KZ.js";
+import "../chunk-3WCASNQZ.js";
+import "../chunk-2Z24E5W2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MaintenanceScheduler

package/dist/{orchestrator-Bp_jeBHK.d.ts → orchestrator-CQJ8U7En.d.ts}

@@ -1,19 +1,19 @@
+import { TierMigrationStatusStore, TierMigrationStatusSnapshot, TierMigrationCycleSummary, LastRecallBudgetSummary, GraphRecallExpandedEntry, LastRecallStore, RecallHandleHistoryStore, LastRecallSnapshot, DrainPendingImpressionsResult } from './recall-state.js';
 import { BriefingFollowupGenerator } from './briefing.js';
 import { SmartBuffer } from './buffer.js';
 import { FaithfulnessGateCounters } from './extraction-faithfulness.js';
 import { SearchBackend, SearchQueryOptions, SearchExecutionOptions } from './search/port.js';
-import { M as MemoryWriteResult, F as FusionArtifactStore, a as FusedWearableConversation, S as StorageManager } from './storage-hr_Y2z5R.js';
+import { M as MemoryWriteResult, F as FusionArtifactStore, a as FusedWearableConversation, S as StorageManager } from './storage-NIyKYD8g.js';
 import { TranscriptManager } from './transcript.js';
 import { HourlySummarizer } from './summarizer.js';
 import { LocalLlmClient } from './local-llm.js';
 import { FallbackLlmClient } from './fallback-llm.js';
 import { MaintenanceScheduler } from './orchestration/maintenance.js';
-import { aI as ScopeProfileConfig, aJ as ScopeProfileLayerId, aK as ScopeProfilePromotionTarget, o as BufferTurn, y as ExtractionResult, u as MemoryCategory, ak as ImportanceScore, v as MemoryStatus, aL as WearableConversation, aM as WearableSourceSettings, aN as WearableNativeMemory, aO as WearableMemoryMode, aP as WearableSourceConnector, aQ as WearablesConfig, aR as WearableSyncSummary, aS as WearableSourceStatus, aT as WearableDayTranscript, aU as WearableCorrectionRule, P as PluginConfig, M as MemoryFile, a8 as MemoryActionEvent, Q as QmdSearchResult, ae as ContinuityIncidentRecord, b as RecallPlanMode, I as IdentityInjectionMode, aV as RecallSectionConfig, ax as MemoryLink, aG as CodingContext, t as SourceConnectorProvenance, al as MemoryIntent, p as MemoryFrontmatter, g as BehaviorLoopPolicyState, aW as BootstrapOptions, aX as BootstrapResult, aY as ConsolidationObservation, J as DaySummaryResult, _ as ImportTurn } from './types-Cg8q7W7_.js';
-import { TierMigrationStatusStore, TierMigrationStatusSnapshot, TierMigrationCycleSummary, LastRecallBudgetSummary, GraphRecallExpandedEntry, LastRecallStore, RecallHandleHistoryStore, LastRecallSnapshot } from './recall-state.js';
+import { n as BufferTurn, J as ExtractionResult, ah as ImportanceScore, x as MemoryStatus, aF as WearableConversation, aG as WearableSourceSettings, aH as WearableNativeMemory, aI as WearableMemoryMode, aJ as WearableSourceConnector, aK as WearablesConfig, aL as WearableSyncSummary, aM as WearableSourceStatus, aN as WearableDayTranscript, aO as WearableCorrectionRule, P as PluginConfig, M as MemoryFile, ab as MemoryActionEvent, Q as QmdSearchResult, R as RecallPlanMode, I as IdentityInjectionMode, aP as RecallSectionConfig, av as MemoryLink, aD as CodingContext, r as SourceConnectorProvenance, ai as MemoryIntent, o as MemoryFrontmatter, v as BehaviorLoopPolicyState, aQ as BootstrapOptions, aR as BootstrapResult, aS as ConsolidationObservation, N as DaySummaryResult, a1 as ImportTurn } from './types-D_fG2ix8.js';
 import { CompoundingEngine } from './compounding/engine.js';
 import { UtilityRuntimeValues } from './utility-runtime.js';
 import { CompressionGuidelineCoordinator } from './orchestration/compression-guideline-coordinator.js';
-import { S as SemanticConsolidationResult } from './semantic-consolidation-C2m5eHHE.js';
+import { S as SemanticConsolidationResult } from './semantic-consolidation-DILZEQq3.js';
 import { EmbeddingFallback } from './embedding-fallback.js';
 import { ExtractionEngine } from './extraction.js';
 import { ObjectiveStateSearchResult } from './objective-state.js';
@@ -24,6 +24,7 @@ import { VerifiedEpisodeResult } from './verified-recall.js';
 import { VerifiedSemanticRuleResult } from './semantic-rule-verifier.js';
 import { WorkProductLedgerSearchResult } from './work-product-ledger.js';
 import { TrustStageResultItem } from './trust-score-stage.js';
+import { ContinuityIncidentRecord } from './types-continuity.js';
 import { ConversationChunk } from './conversation-index/chunker.js';
 import { ConversationIndexBackend, ConversationIndexBackendInspection } from './conversation-index/backend.js';
 import { C as ConversationSearchResult } from './faiss-adapter-BHecI1fF.js';
@@ -31,6 +32,7 @@ import { CapabilitySet, GraphConstructionCapabilitySet, MemoryLifecycleCapabilit
 import { BoxBuilder } from './boxes.js';
 import { NamespaceStorageRouter } from './namespaces/storage.js';
 import { ThreadingManager } from './threading.js';
+import { R as ResolvedScopeProfilePlan } from './scope-profiles-EpJG7yKP.js';
 import { GraphIndex } from './graph.js';
 import { RecallXrayServedBy, RecallXraySnapshot } from './recall-xray.js';
 import { LiveConnectorsRunSummary } from './live-connectors-runner.js';
@@ -40,41 +42,15 @@ import { NegativeExampleStore } from './negative.js';
 import { SessionObserverState } from './session-observer-state.js';
 import { a as SemanticDedupHit } from './semantic-TddhF0y7.js';
 import { ReplayTurn } from './replay/types.js';
+import { SealedMemoryEnvelope } from './write-envelope.js';
 import { JudgeCandidate, JudgeBatchResult } from './extraction-judge.js';
 import { LcmEngine } from './lcm/engine.js';
-import { b as NamespaceKind, N as NamespaceCatalog } from './catalog-C9444P10.js';
+import { b as NamespaceKind, N as NamespaceCatalog } from './catalog-BWqHb5HT.js';
 import { NamespaceSearchHealth } from './namespaces/search.js';
 import { SharedContextManager } from './shared-context/manager.js';
 import { RuntimePolicyValues } from './policy-runtime.js';
 import { ProfilingCollector } from './profiling.js';
 
-interface ScopeProfileLayerResolution {
-    id: ScopeProfileLayerId;
-    kind: "user-project" | "team-project" | "user-global" | "server-shared";
-    namespace?: string;
-    readable: boolean;
-    writable: boolean;
-    promotable: boolean;
-    reason: string;
-}
-interface ScopeProfilePromotionResolution {
-    target: ScopeProfilePromotionTarget;
-    namespace?: string;
-    authorized: boolean;
-    reason: string;
-}
-interface ResolvedScopeProfilePlan {
-    profileId: string;
-    profile: ScopeProfileConfig;
-    baseNamespace: string;
-    writeLayer: ScopeProfileLayerId;
-    writeNamespace: string;
-    readNamespaces: string[];
-    layers: ScopeProfileLayerResolution[];
-    promotionTargets: ScopeProfilePromotionResolution[];
-    warnings: string[];
-}
-
 /**
  * Wearable speaker registry — maps provider diarization labels to
  * human names, persistently, per source.
@@ -234,21 +210,15 @@ interface CorroborationContext {
  * standalone engines alike.
  */
 
-/**
- * Memory status used for a given memory mode. Least-privilege default:
- * anything that is not explicitly "auto" lands in the review queue
- * rather than active recall.
- */
 declare function memoryStatusForMode(mode: WearableMemoryMode): Extract<MemoryStatus, "active" | "pending_review">;
 /** Narrow writer interface satisfied by `StorageManager`. */
 interface WearableMemoryWriter {
-    writeMemory(category: MemoryCategory, content: string, options: {
-        confidence?: number;
-        tags?: string[];
-        source?: string;
+    /**
+     * Sealed-envelope write entry point (issue #1989 PR4): cross-cutting
+     * fields ride the composed envelope; per-write extras stay explicit.
+     */
+    writeSealedMemory(envelope: SealedMemoryEnvelope, extras: {
         importance?: ImportanceScore;
-        validAt?: string;
-        structuredAttributes?: Record<string, string>;
         contentHashSource?: string;
         status?: MemoryStatus;
         memoryKind?: "episode" | "note" | "box" | "dream" | "procedural";
@@ -449,7 +419,7 @@ interface WearableStorageIo {
         };
         content: string;
     }>>;
-    writeMemory: WearableMemoryGenDeps["writer"]["writeMemory"];
+    writeSealedMemory: WearableMemoryGenDeps["writer"]["writeSealedMemory"];
     hasFactContentHash(content: string): Promise<boolean>;
     findWearableMemoryByContent(content: string): Promise<{
         id: string;
@@ -1091,6 +1061,10 @@ declare function resolveEffectiveIdentityInjectionMode(options: {
 declare class RecallResultFormatter {
     private readonly config;
     constructor(config: PluginConfig);
+    formatQmdResultEntries(title: string, results: QmdSearchResult[], sessionKey?: string, trustByPath?: Map<string, TrustStageResultItem> | null): {
+        heading: string;
+        entries: string[];
+    };
     formatQmdResults(title: string, results: QmdSearchResult[], sessionKey?: string, trustByPath?: Map<string, TrustStageResultItem> | null): string;
     formatObjectiveStateResults(results: ObjectiveStateSearchResult[]): string;
     formatCausalTrajectoryResults(results: CausalTrajectorySearchResult[]): string;
@@ -1146,15 +1120,22 @@ declare class RecallRerankCoordinator {
     private readonly getStorage;
     private readonly readQmdResultMemory;
     private readonly memoryWorthCounterCache;
-    private static readonly MEMORY_WORTH_CACHE_TTL_MS;
     private readonly trustSignalCache;
-    private static readonly TRUST_SIGNAL_CACHE_TTL_MS;
+    /**
+     * Cap on distinct namespaces retained in the corpus-fallback caches. Each
+     * entry holds a derived per-namespace map; on high-cardinality namespace
+     * workloads an unbounded map would grow without limit (#1905, Cursor). Map
+     * preserves insertion order, so overflow evicts the oldest namespace.
+     */
+    private static readonly CORPUS_FALLBACK_CACHE_MAX_NAMESPACES;
+    /** Insert-ordered bounded set: evict the oldest namespace on overflow. */
+    private static capCache;
     constructor(options: {
         getConfig: () => PluginConfig;
         getStorage: (namespace: string) => Promise<StorageManager>;
-        readQmdResultMemory: (resultPath: string, fallbackStorage: StorageManager, recallNamespaces: readonly string[]) => Promise<MemoryFile | null>;
+        readQmdResultMemory: (resultPath: string, fallbackStorage: StorageManager, recallNamespaces: readonly string[], preferredNamespace?: string) => Promise<MemoryFile | null>;
     });
-    applyMemoryWorthRerank(results: QmdSearchResult[], namespaces: string[]): Promise<QmdSearchResult[]>;
+    applyMemoryWorthRerank(results: QmdSearchResult[], namespaces: string[], preloadedFrontmatter?: ReadonlyMap<string, MemoryFile>, abortSignal?: AbortSignal): Promise<QmdSearchResult[]>;
     /**
      * Issue #1577 — unified TrustScore recall stage. Thin wiring over the pure
      * {@link applyTrustScoreStage} scorer + the {@link buildTrustSignalsForRerank}
@@ -1169,7 +1150,7 @@ declare class RecallRerankCoordinator {
      * per-recall local — never instance state — so concurrent recalls cannot
      * race on it (review: shared-trust-map concurrency).
      */
-    applyTrustScoreRerank(results: QmdSearchResult[], namespaces: string[]): Promise<{
+    applyTrustScoreRerank(results: QmdSearchResult[], namespaces: string[], preloadedFrontmatter?: ReadonlyMap<string, MemoryFile>, abortSignal?: AbortSignal): Promise<{
         results: QmdSearchResult[];
         trustByPath: Map<string, TrustStageResultItem> | null;
     }>;
@@ -1183,7 +1164,7 @@ declare class RecallRerankCoordinator {
      * subsumes Memory Worth; exactly one runs (rule 39). Fail-open on lookup
      * errors so a storage hiccup never breaks a fallback path.
      */
-    applyTrustScoreToBranch(results: QmdSearchResult[], namespaces: string[], caps: CapabilitySet, label: string): Promise<{
+    applyTrustScoreToBranch(results: QmdSearchResult[], namespaces: string[], caps: CapabilitySet, label: string, preloadedFrontmatter?: ReadonlyMap<string, MemoryFile>, abortSignal?: AbortSignal): Promise<{
         results: QmdSearchResult[];
         trustByPath: Map<string, TrustStageResultItem> | null;
     }>;
@@ -1218,6 +1199,20 @@ declare class RecallRerankCoordinator {
  * TierMigrationCoordinator accessor pattern.
  */
 
+interface RecallSectionAppendOptions {
+    atomic?: boolean;
+    memoryId?: string;
+    memoryPath?: string;
+    memoryNamespace?: string;
+}
+interface RecallSectionChunk {
+    content: string;
+    atomic?: boolean;
+    memoryId?: string;
+    memoryPath?: string;
+    memoryNamespace?: string;
+}
+type RecallSectionBuckets = Map<string, Array<string | RecallSectionChunk>>;
 /**
  * Coordinator for the recall section budgeting + assembly subsystem.
  *
@@ -1238,21 +1233,20 @@ declare class RecallSectionCoordinator {
     isSpecializedRecallSectionEnabled(sectionId: string, topLevelEnabled: boolean): boolean;
     getRecallSectionMaxChars(sectionId: string): number | null | undefined;
     getRecallSectionNumber(sectionId: string, key: keyof RecallSectionConfig): number | undefined;
-    appendRecallSection(sectionBuckets: Map<string, string[]>, sectionId: string, content: string): boolean;
+    appendRecallSection(sectionBuckets: RecallSectionBuckets, sectionId: string, content: string, options?: RecallSectionAppendOptions): boolean;
+    truncateProfileToBoundary(content: string, maxChars: number): string;
     truncateRecallSectionToBudget(content: string, maxChars: number): string;
-    protectedRecallSectionIds(sectionBuckets: Map<string, string[]>): Set<string>;
-    protectedRecallReservationChars(content: string): number;
-    estimateReservedRecallBudget(entries: Array<{
-        id: string;
-        content: string;
-    }>, startIndex: number, protectedIds: Set<string>, alreadyIncludedCount: number): number;
     getRecallBudgetChars(override?: number): number;
-    assembleRecallSections(sectionBuckets: Map<string, string[]>, budgetOverride?: number): {
+    assembleRecallSections(sectionBuckets: RecallSectionBuckets, budgetOverride?: number): {
         sections: string[];
         includedIds: string[];
         omittedIds: string[];
         truncated: boolean;
         finalChars: number;
+        includedMemoryIds: string[];
+        includedMemoryPaths: string[];
+        includedMemoryNamespaces: Array<string | undefined>;
+        omittedMemoryIds: string[];
     };
     buildLastRecallBudgetSummary(options: {
         requestedTopK?: number;
@@ -1262,9 +1256,13 @@ declare class RecallSectionCoordinator {
         finalContextChars?: number;
         truncated?: boolean;
         includedSections?: string[];
+        includedMemoryIds?: string[];
+        includedMemoryPaths?: string[];
+        includedMemoryNamespaces?: Array<string | undefined>;
+        omittedMemoryIds?: string[];
         omittedSections?: string[];
     }): LastRecallBudgetSummary;
-    collectLastRecallSources(sectionBuckets: Map<string, string[]>, recallSource: "none" | "hot_qmd" | "hot_embedding" | "cold_fallback" | "recent_scan"): string[];
+    collectLastRecallSources(sectionBuckets: RecallSectionBuckets, recallSource: "none" | "hot_qmd" | "hot_embedding" | "cold_fallback" | "recent_scan"): string[];
 }
 
 /**
@@ -1312,7 +1310,7 @@ declare class QmdResultResolver {
         qmdCollectionNamespaceFromPrefix: (collectionPrefix: string) => string | null;
         namespaceFromPath: (p: string) => string;
     });
-    readQmdResultMemory(resultPath: string, fallbackStorage: StorageManager, recallNamespaces?: readonly string[]): Promise<MemoryFile | null>;
+    readQmdResultMemory(resultPath: string, fallbackStorage: StorageManager, recallNamespaces?: readonly string[], preferredNamespace?: string): Promise<MemoryFile | null>;
     resolveColdQmdResultForRecall(result: QmdSearchResult, fallbackStorage: StorageManager, recallNamespaces?: readonly string[]): Promise<{
         namespace: string;
         result: QmdSearchResult;
@@ -1457,7 +1455,10 @@ interface ExtractionRunCoordinatorDeps {
         principal?: string;
         validAt?: string;
         sourceConnector?: string;
-    }, baseNamespace?: string, scopeProfileWritePlan?: ResolvedScopeProfilePlan | null, sourceText?: string, graphCaps?: GraphConstructionCapabilitySet, lifecycleCaps?: MemoryLifecycleCapabilitySet) => Promise<string[]>;
+    }, baseNamespace?: string, scopeProfileWritePlan?: ResolvedScopeProfilePlan | null, sourceText?: string, graphCaps?: GraphConstructionCapabilitySet, lifecycleCaps?: MemoryLifecycleCapabilitySet) => Promise<{
+        persistedIds: string[];
+        memoryPathById: Map<string, string>;
+    }>;
     maybeCapturePassiveCorrections: (turns: readonly BufferTurn[], opts: {
         sessionKey: string;
         principal?: string;
@@ -1663,7 +1664,7 @@ declare class GraphRecallCoordinator {
             dir: string;
             namespace: string;
         } | null>;
-        readQmdResultMemory: (resultPath: string, fallbackStorage: StorageManager, recallNamespaces: readonly string[]) => Promise<MemoryFile | null>;
+        readQmdResultMemory: (resultPath: string, fallbackStorage: StorageManager, recallNamespaces: readonly string[], preferredNamespace?: string) => Promise<MemoryFile | null>;
     });
     expandResultsViaGraph(options: {
         memoryResults: QmdSearchResult[];
@@ -1987,6 +1988,13 @@ interface RecallInvocationOptions {
      * against the caller's real context.
      */
     currentContextScopes?: readonly unknown[];
+    /**
+     * Wall-clock ms the caller waited to begin execution — per-principal
+     * semaphore queue + single-flight wait (issue #1906). Folded into
+     * recall-timings additively as `queueWaitMs`; omitted phases are simply
+     * absent, so existing timing consumers are unaffected.
+     */
+    queueWaitMs?: number;
 }
 type QueryAwarePrefilter = {
     candidatePaths: Set<string> | null;
@@ -2226,6 +2234,7 @@ declare class Orchestrator {
      * runners (consolidation/pattern-reinforcement/governance) stay here.
      */
     readonly maintenanceScheduler: MaintenanceScheduler;
+    private prioritizedEmbedding?;
     private readonly conversationQmd?;
     private readonly conversationFaiss?;
     private readonly conversationIndexBackend?;
@@ -2897,7 +2906,17 @@ declare class Orchestrator {
      * Delegates to the maintenance scheduler (issue #1526 PR1).
      */
     requestQmdMaintenanceForTool(reason: string): void;
-    private persistExtraction;
+    persistExtraction(result: ExtractionResult, storage: StorageManager, threadIdForExtraction?: string | null, sourceContext?: {
+        sessionKey?: string;
+        principal?: string;
+        validAt?: string;
+        sourceConnector?: string;
+    }, baseNamespace?: string, scopeProfileWritePlan?: ResolvedScopeProfilePlan | null, 
+    /** Verbatim source turn text the facts were extracted from (faithfulness gate #1576). */
+    sourceText?: string, graphCaps?: GraphConstructionCapabilitySet, lifecycleCaps?: MemoryLifecycleCapabilitySet): Promise<{
+        persistedIds: string[];
+        memoryPathById: Map<string, string>;
+    }>;
     /**
      * Append persisted ids to the thread episode set, excluding pending_review
      * fact ids (#1635) so they don't re-seed predecessor edges. Fail-open like
@@ -2938,17 +2957,6 @@ declare class Orchestrator {
     private emitTrace;
     private queueEvalShadowRecall;
     private publishRecallResults;
-    /**
-     * Apply MMR over the pre-truncation recall candidate pool and then slice
-     * the result to `limit`. This is the single place in the pipeline where
-     * MMR runs, and it must be called *before* callers throw away candidates
-     * that would otherwise sit below the final cutoff. Running MMR post-slice
-     * is a no-op in the cases we care about — diverse candidates just below
-     * the cutoff are already gone and can never be promoted.
-     *
-     * Callers must pass the full candidate pool (post-rerank, pre-slice).
-     */
-    private qmdCollectionNamespaceFromPrefix;
     private readQmdResultMemory;
     private resolveColdQmdResultForRecall;
     private storageForAbsoluteQmdResultPath;
@@ -2982,19 +2990,17 @@ declare class Orchestrator {
      * Record that memories were accessed (retrieved).
      * Updates are batched in memory and flushed during consolidation.
      */
-    trackMemoryAccess(memoryIds: string[]): void;
+    trackMemoryAccess(memoryIds: string[], memoryPaths?: string[], memoryNamespaces?: Array<string | undefined>): void;
     flushAccessTracking(): Promise<void>;
     private loadSearchResultMemoryMap;
     private filterSearchResultsByRecallSafety;
     private filterSearchResultsForRecall;
     private boostSearchResults;
-    /**
-     * Extract memory IDs from QMD search results for access tracking.
-     */
     private extractMemoryIdsFromResults;
     recordMemoryFeedback(memoryId: string, vote: "up" | "down", note?: string): Promise<void>;
     recordNotUsefulMemories(memoryIds: string[], note?: string): Promise<void>;
     getLastRecall(sessionKey: string): LastRecallSnapshot | null;
+    drainPendingRecallImpressions(): Promise<DrainPendingImpressionsResult>;
     /**
      * Issue #1582 — resolve a memory handle (`[m:4f2a]` / bare hex) to its memory
      * id against THIS session's recent recall history. Returns the id on a unique
@@ -3049,4 +3055,4 @@ declare class Orchestrator {
     private readArchivedMemoriesForNamespaces;
 }
 
-export { type GraphRecallShadowComparison as $, memoryStatusForMode as A, resolveSpeaker as B, ConversationIndexCoordinator as C, DEFAULT_SELF_NAME as D, resolveSyncDates as E, sanitizeSessionKeyForFilename as F, type GraphRecallSnapshot as G, saveSpeakerRegistry as H, type IntentDebugSnapshot as I, speakerRegistryKey as J, speakersFilePath as K, syncWearableSource as L, wearableDayTag as M, wearableSourceLabel as N, Orchestrator as O, type PatternReinforcementResult as P, writeDailyDigestMemory as Q, type ResolvedScopeProfilePlan as R, type ScopeProfileLayerResolution as S, TierMigrationCoordinator as T, type BulkImportBatchIngestResult as U, BulkImportBatchPartialFailureError as V, WearablesService as W, COMPACTION_SIGNAL_MAX_AGE_MS as X, type DaySummaryGatherOptions as Y, type ExtractionRunResult as Z, type GraphRecallRankedResult as _, type ScopeProfilePromotionResolution as a, type QmdRecallSnapshot as a0, type QueryAwarePrefilter as a1, type RecallInvocationOptions as a2, type RecallModeDecision as a3, appendMemoryToGraphContext as a4, applyQueryAwareCandidateFilter as a5, blendGraphExpandedRecallScore as a6, buildCompressionGuidelinesMarkdown as a7, buildMemoryPathById as a8, computeArtifactCandidateFetchLimit as a9, shouldFilterLifecycleRecallCandidate as aA, splitTurnsBySourceValidAt as aB, summarizeGraphShadowComparison as aC, targetSourceValidAtSortMs as aD, throwIfRecallAborted as aE, tokenizeRecallQuery as aF, utcDateKeysForLocalDay as aG, computeArtifactRecallLimit as aa, computeQmdHybridFetchLimit as ab, deriveTopicsFromExtraction as ac, filterHourlySummaryMarkdownForLocalDay as ad, filterRecallCandidates as ae, formatDateInTimeZone as af, graphPathRelativeToStorage as ag, hasIdentityRecoveryIntent as ah, isArtifactMemoryPath as ai, lifecycleRecallScoreAdjustment as aj, mapRecallSourceToXrayServedBy as ak, mergeArtifactRecallCandidates as al, mergeGraphExpandedResults as am, normalizeIanaTimeZone as an, parseFiniteDate as ao, parseGraphRecallRankedResults as ap, parseMemoryIntentSnapshot as aq, parseQmdRecallResults as ar, qmdStartupCollectionCheckWithTimeout as as, raceRecallAbort as at, resolveEffectiveIdentityInjectionMode as au, resolveEffectiveRecallMode as av, resolvePersistedMemoryRelativePath as aw, resolveRecallModeDecision as ax, resolveRecallModeDecisionAsync as ay, resolveRecentThreadMemoryPaths as az, type SpeakerRegistry as b, type ResolvedSpeaker as c, type SpeakerOverride as d, WEARABLE_SOURCE_PREFIX as e, type WearableDayTranscriptView as f, type WearableMemoryGenDeps as g, type WearableMemoryGenResult as h, type WearableMemorySearchResult as i, type WearableMemoryWriter as j, type WearableSearchBackend as k, type WearableStorageIo as l, type WearableSyncDeps as m, type WearableSyncOptions as n, type WearableTranscriptSearchResult as o, type WearablesServiceDeps as p, buildExtractionTurns as q, dateInTimezone as r, defaultTimezone as s, defaultWorkspaceDir as t, distinctSpeakerLabels as u, emptySpeakerRegistry as v, generateWearableMemories as w, importNativeMemories as x, loadSpeakerRegistry as y, locateTranscriptPath as z };
+export { type RecallInvocationOptions as $, sanitizeSessionKeyForFilename as A, saveSpeakerRegistry as B, ConversationIndexCoordinator as C, DEFAULT_SELF_NAME as D, speakerRegistryKey as E, speakersFilePath as F, type GraphRecallSnapshot as G, syncWearableSource as H, type IntentDebugSnapshot as I, wearableDayTag as J, wearableSourceLabel as K, writeDailyDigestMemory as L, type BulkImportBatchIngestResult as M, BulkImportBatchPartialFailureError as N, Orchestrator as O, type PatternReinforcementResult as P, COMPACTION_SIGNAL_MAX_AGE_MS as Q, type ResolvedSpeaker as R, type SpeakerRegistry as S, TierMigrationCoordinator as T, type DaySummaryGatherOptions as U, type ExtractionRunResult as V, WearablesService as W, type GraphRecallRankedResult as X, type GraphRecallShadowComparison as Y, type QmdRecallSnapshot as Z, type QueryAwarePrefilter as _, type SpeakerOverride as a, type RecallModeDecision as a0, appendMemoryToGraphContext as a1, applyQueryAwareCandidateFilter as a2, blendGraphExpandedRecallScore as a3, buildCompressionGuidelinesMarkdown as a4, buildMemoryPathById as a5, computeArtifactCandidateFetchLimit as a6, computeArtifactRecallLimit as a7, computeQmdHybridFetchLimit as a8, deriveTopicsFromExtraction as a9, targetSourceValidAtSortMs as aA, throwIfRecallAborted as aB, tokenizeRecallQuery as aC, utcDateKeysForLocalDay as aD, filterHourlySummaryMarkdownForLocalDay as aa, filterRecallCandidates as ab, formatDateInTimeZone as ac, graphPathRelativeToStorage as ad, hasIdentityRecoveryIntent as ae, isArtifactMemoryPath as af, lifecycleRecallScoreAdjustment as ag, mapRecallSourceToXrayServedBy as ah, mergeArtifactRecallCandidates as ai, mergeGraphExpandedResults as aj, normalizeIanaTimeZone as ak, parseFiniteDate as al, parseGraphRecallRankedResults as am, parseMemoryIntentSnapshot as an, parseQmdRecallResults as ao, qmdStartupCollectionCheckWithTimeout as ap, raceRecallAbort as aq, resolveEffectiveIdentityInjectionMode as ar, resolveEffectiveRecallMode as as, resolvePersistedMemoryRelativePath as at, resolveRecallModeDecision as au, resolveRecallModeDecisionAsync as av, resolveRecentThreadMemoryPaths as aw, shouldFilterLifecycleRecallCandidate as ax, splitTurnsBySourceValidAt as ay, summarizeGraphShadowComparison as az, WEARABLE_SOURCE_PREFIX as b, type WearableDayTranscriptView as c, type WearableMemoryGenDeps as d, type WearableMemoryGenResult as e, type WearableMemorySearchResult as f, type WearableMemoryWriter as g, type WearableSearchBackend as h, type WearableStorageIo as i, type WearableSyncDeps as j, type WearableSyncOptions as k, type WearableTranscriptSearchResult as l, type WearablesServiceDeps as m, buildExtractionTurns as n, dateInTimezone as o, defaultTimezone as p, defaultWorkspaceDir as q, distinctSpeakerLabels as r, emptySpeakerRegistry as s, generateWearableMemories as t, importNativeMemories as u, loadSpeakerRegistry as v, locateTranscriptPath as w, memoryStatusForMode as x, resolveSpeaker as y, resolveSyncDates as z };