@remnic/core 9.7.15 → 9.9.0

package/src/compounding/engine.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { log } from "../logger.js";
+import { composeSalvagedEnvelope } from "../salvage-envelope.js";
 import { sanitizeMemoryContent } from "../sanitize.js";
 import { StorageManager } from "../storage.js";
 import type { ContinuityIncidentRecord, PluginConfig } from "../types.js";
@@ -717,13 +718,12 @@ export class CompoundingEngine {
       return report;
     }
 
-    const { id, tombstoneBlocked } = await storage.writeMemory(candidate.category, persistedContent, {
-      source: "compounding-promotion",
-      tags: uniqueTags,
-      confidence,
-      lineage,
-      memoryKind: "note",
-    });
+    // Sealed-envelope write (issue #1989 PR4): synthesized machine data.
+    const promotionInput = { content: persistedContent, category: candidate.category, confidence, tags: uniqueTags };
+    const { id, tombstoneBlocked } = await storage.writeSealedMemory(
+      composeSalvagedEnvelope("compounding-promotion", promotionInput, { source: "compounding-promotion" }),
+      { lineage, memoryKind: "note" },
+    );
     // #1645: a tombstone-blocked promotion lands pending_review (no active
     // copy) — divert it to the tombstoneBlocked list so the report never
     // claims a blocked write as a successfully promoted active memory.

package/src/config-qmd.ts

@@ -0,0 +1,89 @@
+import { coerceNumber } from "./connectors/coerce.js";
+
+export function parseQmdSupportedVersion(value: unknown): string {
+  if (value === undefined || value === null) return "2.5.3";
+  if (typeof value !== "string") {
+    throw new Error(`qmdSupportedVersion must be a semantic version string; got ${JSON.stringify(value)}`);
+  }
+  const normalized = value.trim();
+  if (!/^\d+\.\d+\.\d+$/.test(normalized)) {
+    throw new Error(
+      `qmdSupportedVersion must be a semantic version string like "2.5.3"; got ${JSON.stringify(value)}`,
+    );
+  }
+  return normalized;
+}
+
+export function parseQmdGpuBackend(value: unknown): "auto" | "metal" | "cuda" | "vulkan" | "false" | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (value === false) return "false";
+  if (typeof value !== "string") {
+    throw new Error(`qmdGpuBackend must be one of "auto", "metal", "cuda", "vulkan", or false; got ${JSON.stringify(value)}`);
+  }
+  const normalized = value.trim().toLowerCase();
+  if (
+    normalized === "auto" ||
+    normalized === "metal" ||
+    normalized === "cuda" ||
+    normalized === "vulkan" ||
+    normalized === "false"
+  ) {
+    return normalized;
+  }
+  throw new Error(`qmdGpuBackend must be one of "auto", "metal", "cuda", "vulkan", or false; got ${JSON.stringify(value)}`);
+}
+
+export function parseQmdChunkStrategy(value: unknown): "auto" | "regex" {
+  if (value === undefined || value === null) return "auto";
+  if (typeof value !== "string") {
+    throw new Error(`qmdChunkStrategy must be "auto" or "regex"; got ${JSON.stringify(value)}`);
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "auto" || normalized === "regex") return normalized;
+  throw new Error(`qmdChunkStrategy must be "auto" or "regex"; got ${JSON.stringify(value)}`);
+}
+
+// Issue #1335. Default "hybrid" preserves the historical lex+vec+hyde daemon plan.
+export function parseQmdSearchStrategy(value: unknown): "hybrid" | "lex-vec" | "lex" {
+  if (value === undefined || value === null) return "hybrid";
+  if (typeof value !== "string") {
+    throw new Error(
+      `qmdSearchStrategy must be one of "hybrid", "lex-vec", or "lex"; got ${JSON.stringify(value)}`,
+    );
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "hybrid" || normalized === "lex-vec" || normalized === "lex") {
+    return normalized;
+  }
+  throw new Error(
+    `qmdSearchStrategy must be one of "hybrid", "lex-vec", or "lex"; got ${JSON.stringify(value)}`,
+  );
+}
+
+// Issue #1335. Reject non-numeric / non-integer timeouts rather than silently
+// coercing them (gotcha #51), then clamp valid integers to the documented bounds.
+export function parseQmdDaemonTimeoutMs(value: unknown): number {
+  if (value === undefined || value === null) return 8_000;
+  const coerced = coerceNumber(value);
+  if (coerced === undefined || !Number.isInteger(coerced)) {
+    throw new Error(
+      `qmdDaemonTimeoutMs must be an integer number of milliseconds between 1000 and 120000; got ${JSON.stringify(value)}`,
+    );
+  }
+  return Math.min(120_000, Math.max(1_000, coerced));
+}
+
+// Issue #1335. Default "query" keeps `qmd query` (LLM expansion + rerank) per gotcha #7.
+export function parseQmdSubprocessStrategy(value: unknown): "query" | "search" {
+  if (value === undefined || value === null) return "query";
+  if (typeof value !== "string") {
+    throw new Error(
+      `qmdSubprocessStrategy must be one of "query" or "search"; got ${JSON.stringify(value)}`,
+    );
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "query" || normalized === "search") return normalized;
+  throw new Error(
+    `qmdSubprocessStrategy must be one of "query" or "search"; got ${JSON.stringify(value)}`,
+  );
+}

package/src/config.test.ts

@@ -405,6 +405,55 @@ test("parseConfig coerces boolean-like strings for all recallPlanner gates (issu
   assert.equal(parseConfig({}).recallPlannerEnabled, true);
 });
 
+test("parseConfig recall concurrency + single-flight knobs (issue #1906)", () => {
+  // Defaults: cap 4, single-flight on.
+  assert.equal(parseConfig({}).recallMaxConcurrentPerPrincipal, 4);
+  assert.equal(parseConfig({}).recallSingleFlightEnabled, true);
+  // 0 (unlimited) is honored, not coerced to the default.
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: 0 }).recallMaxConcurrentPerPrincipal,
+    0,
+  );
+  // 1 restores exact serialization.
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: 1 }).recallMaxConcurrentPerPrincipal,
+    1,
+  );
+  // CLI/env surfaces pass strings — integer-like strings are accepted.
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: "8" }).recallMaxConcurrentPerPrincipal,
+    8,
+  );
+  // Fractional values are NOT floored (a typo like 0.5 must not become 0 =
+  // unlimited): they fall back to the default 4 (issue #1906 review round 3 #4).
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: 0.5 }).recallMaxConcurrentPerPrincipal,
+    4,
+  );
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: 3.9 }).recallMaxConcurrentPerPrincipal,
+    4,
+  );
+  // Negative / NaN fall back to the default 4.
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: -1 }).recallMaxConcurrentPerPrincipal,
+    4,
+  );
+  assert.equal(
+    parseConfig({ recallMaxConcurrentPerPrincipal: "abc" }).recallMaxConcurrentPerPrincipal,
+    4,
+  );
+  // Single-flight disable via boolean and boolean-like string.
+  assert.equal(
+    parseConfig({ recallSingleFlightEnabled: false }).recallSingleFlightEnabled,
+    false,
+  );
+  assert.equal(
+    parseConfig({ recallSingleFlightEnabled: "false" }).recallSingleFlightEnabled,
+    false,
+  );
+});
+
 test("parseConfig dreaming.maxEntries=0 preserves the runtime disable switch", () => {
   const result = parseConfig({ dreaming: { maxEntries: 0 } });
   assert.equal(result.dreaming.maxEntries, 0);
@@ -430,6 +479,41 @@ test("parseConfig activeRecallCacheTtlMs=500 preserves the explicit positive ttl
   assert.equal(result.activeRecallCacheTtlMs, 500);
 });
 
+test("parseConfig separates legacy custom instruction from full prompt replacement", () => {
+  assert.equal(
+    parseConfig({ activeRecallPromptOverride: "  legacy guidance  " }).activeRecallCustomInstruction,
+    "legacy guidance",
+  );
+  assert.equal(
+    parseConfig({ activeRecallPromptOverride: "  legacy guidance  " }).activeRecallPromptOverride,
+    "legacy guidance",
+  );
+  assert.equal(
+    parseConfig({ activeRecallPromptReplacement: "  Use the evidence.  " })
+      .activeRecallPromptReplacement,
+    "Use the evidence.",
+  );
+  const combined = parseConfig({
+    activeRecallPromptOverride: "legacy guidance",
+    activeRecallPromptReplacement: "replacement prompt",
+  });
+  assert.equal(combined.activeRecallCustomInstruction, "legacy guidance");
+  assert.equal(combined.activeRecallPromptOverride, "legacy guidance");
+  assert.equal(combined.activeRecallPromptReplacement, "replacement prompt");
+  for (const [key, value] of [
+    ["activeRecallPromptOverride", false],
+    ["activeRecallPromptReplacement", 0],
+    ["activeRecallPromptReplacement", {}],
+    ["activeRecallPromptOverride", []],
+  ] as const) {
+    assert.throws(
+      () => parseConfig({ [key]: value } as never),
+      new RegExp(`${key} must be a string`),
+      `invalid ${key} ${JSON.stringify(value)} must be rejected`,
+    );
+  }
+});
+
 test("parseConfig validates commitmentDecayDays as a positive integer", () => {
   assert.equal(parseConfig({}).commitmentDecayDays, 90);
   assert.equal(parseConfig({ commitmentDecayDays: 30 }).commitmentDecayDays, 30);
@@ -2205,3 +2289,55 @@ test("parseConfig namespace-catalog touch-path knobs: defaults, 0-accepting nume
     /namespacesCatalogTouchStateWrites must be a boolean-like value/,
   );
 });
+
+test("parseConfig bounded-state knobs coerce valid strings, preserve 0, and reject malformed/fractional (#1910)", () =>
+  withIsolatedConnectorsDir(false, () => {
+    // Defaults when absent.
+    const defaults = parseConfig({});
+    assert.equal(defaults.memoryLifecycleLedgerCompactBytes, 64 * 1024 * 1024);
+    assert.equal(defaults.memoryLifecycleLedgerCompactMinIntervalMs, 6 * 60 * 60 * 1000);
+    assert.equal(defaults.recallImpressionsRotateBytes, 32 * 1024 * 1024);
+    assert.equal(defaults.recallImpressionsRotateKeep, 5);
+
+    // Valid string forms (CLI `--config x=…` arrives as strings, Gotcha #28) parse.
+    const strings = parseConfig({
+      memoryLifecycleLedgerCompactBytes: "2048",
+      memoryLifecycleLedgerCompactMinIntervalMs: "120000",
+      recallImpressionsRotateBytes: "4096",
+      recallImpressionsRotateKeep: "3",
+    });
+    assert.equal(strings.memoryLifecycleLedgerCompactBytes, 2048);
+    assert.equal(strings.memoryLifecycleLedgerCompactMinIntervalMs, 120000);
+    assert.equal(strings.recallImpressionsRotateBytes, 4096);
+    assert.equal(strings.recallImpressionsRotateKeep, 3);
+
+    // The documented `0` disable stays effective on the byte thresholds (min 0),
+    // as both a string and a real number, instead of being rejected.
+    const disabledStr = parseConfig({
+      memoryLifecycleLedgerCompactBytes: "0",
+      recallImpressionsRotateBytes: "0",
+    });
+    assert.equal(disabledStr.memoryLifecycleLedgerCompactBytes, 0);
+    assert.equal(disabledStr.recallImpressionsRotateBytes, 0);
+    const disabledNum = parseConfig({
+      memoryLifecycleLedgerCompactBytes: 0,
+      recallImpressionsRotateBytes: 0,
+    });
+    assert.equal(disabledNum.memoryLifecycleLedgerCompactBytes, 0);
+    assert.equal(disabledNum.recallImpressionsRotateBytes, 0);
+
+    // Present-but-malformed values are REJECTED (throw), not silently defaulted.
+    assert.throws(() => parseConfig({ memoryLifecycleLedgerCompactBytes: "abc" }), /must be an integer/);
+    // Fractional present values are rejected on every surface (number and string).
+    assert.throws(() => parseConfig({ recallImpressionsRotateBytes: 2.5 }), /must be an integer/);
+    assert.throws(() => parseConfig({ recallImpressionsRotateKeep: "3.5" }), /must be an integer/);
+    // Below-min values are rejected rather than clamped up.
+    assert.throws(() => parseConfig({ memoryLifecycleLedgerCompactMinIntervalMs: "1000" }), /greater than or equal to 60000/);
+    assert.throws(() => parseConfig({ recallImpressionsRotateKeep: "0" }), /greater than or equal to 1/);
+    assert.throws(() => parseConfig({ memoryLifecycleLedgerCompactBytes: -5 }), /greater than or equal to 0/);
+    // An accidentally huge keep count (a typo like 1000000) is REJECTED before it
+    // can drive a rename storm under the held impressions lock (#2033).
+    assert.equal(parseConfig({ recallImpressionsRotateKeep: 1000 }).recallImpressionsRotateKeep, 1000);
+    assert.throws(() => parseConfig({ recallImpressionsRotateKeep: 1001 }), /between 1 and 1000/);
+    assert.throws(() => parseConfig({ recallImpressionsRotateKeep: "1000000" }), /between 1 and 1000/);
+  }));

package/src/config.ts

@@ -35,14 +35,24 @@ import { expandTildePath } from "./utils/path.js";
 // boolean-coercion logic that connectors/index.ts already exports. The helper
 // lives in connectors/coerce.ts (a tiny, dependency-free module) so neither
 // config.ts → connectors/index.ts nor the reverse circular import arises.
-import { coerceBool, coerceInstallExtension, coerceNumber } from "./connectors/coerce.js";
+import { coerceBool, coerceBooleanLike, coerceInstallExtension, coerceNumber } from "./connectors/coerce.js";
+import { parseRecallConcurrencyConfig } from "./recall-concurrency-config.js";
 import { hasLegacyConnectorEntries } from "./connectors/paths.js";
+import {
+  parseQmdChunkStrategy,
+  parseQmdDaemonTimeoutMs,
+  parseQmdGpuBackend,
+  parseQmdSearchStrategy,
+  parseQmdSubprocessStrategy,
+  parseQmdSupportedVersion,
+} from "./config-qmd.js";
 import {
   resolveEmitLegacyTools,
   resolveNamespaceCatalogEnabled,
 } from "./emit-legacy-tools.js";
 import { parseWearablesConfig } from "./wearables/config.js";
 import { parseProvenanceConfig } from "./provenance.js";
+import { parseBoundedJsonlStateConfig } from "./bounded-jsonl-state.js";
 import { parseCodingKnowledgeConfig } from "./coding/coding-knowledge-config.js";
 import { parseChatConfig } from "./chat/chat-config.js";
 import { parseCorrectionIntentConfig, parseFaithfulnessGateConfig } from "./faithfulness-config.js";
@@ -188,92 +198,35 @@ function parseBoundedPositiveInteger(
   return Math.max(min, Math.min(max, parsed));
 }
 
-function parseQmdSupportedVersion(value: unknown): string {
-  if (value === undefined || value === null) return "2.5.3";
-  if (typeof value !== "string") {
-    throw new Error(`qmdSupportedVersion must be a semantic version string; got ${JSON.stringify(value)}`);
-  }
-  const normalized = value.trim();
-  if (!/^\d+\.\d+\.\d+$/.test(normalized)) {
-    throw new Error(
-      `qmdSupportedVersion must be a semantic version string like "2.5.3"; got ${JSON.stringify(value)}`,
-    );
-  }
-  return normalized;
-}
-
-function parseQmdGpuBackend(value: unknown): "auto" | "metal" | "cuda" | "vulkan" | "false" | undefined {
-  if (value === undefined || value === null) return undefined;
-  if (value === false) return "false";
-  if (typeof value !== "string") {
-    throw new Error(`qmdGpuBackend must be one of "auto", "metal", "cuda", "vulkan", or false; got ${JSON.stringify(value)}`);
-  }
-  const normalized = value.trim().toLowerCase();
+/**
+ * Validate a closed-range integer config knob, coercing CLI numeric strings
+ * first (issue #1909 review round 8). `undefined`/`null` → `fallback`. Anything
+ * provided must coerce to a FINITE INTEGER in `[min, max]`; otherwise THROW
+ * (AGENTS.md #1/#39: reject invalid user input, never silently floor/clamp).
+ */
+function parseIntegerInClosedRange(
+  value: unknown,
+  min: number,
+  max: number,
+  fallback: number,
+  keyName: string,
+): number {
+  // Only an absent key (undefined) falls back to the default; an explicit `null`
+  // is invalid input and proceeds to validation → throw (round 9 finding 1).
+  if (value === undefined) return fallback;
+  const coerced = coerceNumber(value);
   if (
-    normalized === "auto" ||
-    normalized === "metal" ||
-    normalized === "cuda" ||
-    normalized === "vulkan" ||
-    normalized === "false"
+    coerced === undefined ||
+    !Number.isFinite(coerced) ||
+    !Number.isInteger(coerced) ||
+    coerced < min ||
+    coerced > max
   ) {
-    return normalized;
-  }
-  throw new Error(`qmdGpuBackend must be one of "auto", "metal", "cuda", "vulkan", or false; got ${JSON.stringify(value)}`);
-}
-
-function parseQmdChunkStrategy(value: unknown): "auto" | "regex" {
-  if (value === undefined || value === null) return "auto";
-  if (typeof value !== "string") {
-    throw new Error(`qmdChunkStrategy must be "auto" or "regex"; got ${JSON.stringify(value)}`);
-  }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "auto" || normalized === "regex") return normalized;
-  throw new Error(`qmdChunkStrategy must be "auto" or "regex"; got ${JSON.stringify(value)}`);
-}
-
-// Issue #1335. Default "hybrid" preserves the historical lex+vec+hyde daemon plan.
-function parseQmdSearchStrategy(value: unknown): "hybrid" | "lex-vec" | "lex" {
-  if (value === undefined || value === null) return "hybrid";
-  if (typeof value !== "string") {
-    throw new Error(
-      `qmdSearchStrategy must be one of "hybrid", "lex-vec", or "lex"; got ${JSON.stringify(value)}`,
-    );
-  }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "hybrid" || normalized === "lex-vec" || normalized === "lex") {
-    return normalized;
-  }
-  throw new Error(
-    `qmdSearchStrategy must be one of "hybrid", "lex-vec", or "lex"; got ${JSON.stringify(value)}`,
-  );
-}
-
-// Issue #1335. Reject non-numeric / non-integer timeouts rather than silently
-// coercing them (gotcha #51), then clamp valid integers to the documented bounds.
-function parseQmdDaemonTimeoutMs(value: unknown): number {
-  if (value === undefined || value === null) return 8_000;
-  const coerced = coerceNumber(value);
-  if (coerced === undefined || !Number.isInteger(coerced)) {
     throw new Error(
-      `qmdDaemonTimeoutMs must be an integer number of milliseconds between 1000 and 120000; got ${JSON.stringify(value)}`,
+      `${keyName} must be an integer in [${min}, ${max}]; got ${JSON.stringify(value)}`,
     );
   }
-  return Math.min(120_000, Math.max(1_000, coerced));
-}
-
-// Issue #1335. Default "query" keeps `qmd query` (LLM expansion + rerank) per gotcha #7.
-function parseQmdSubprocessStrategy(value: unknown): "query" | "search" {
-  if (value === undefined || value === null) return "query";
-  if (typeof value !== "string") {
-    throw new Error(
-      `qmdSubprocessStrategy must be one of "query" or "search"; got ${JSON.stringify(value)}`,
-    );
-  }
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "query" || normalized === "search") return normalized;
-  throw new Error(
-    `qmdSubprocessStrategy must be one of "query" or "search"; got ${JSON.stringify(value)}`,
-  );
+  return coerced;
 }
 
 function parseOptionalNonEmptyString(value: unknown): string | undefined {
@@ -343,30 +296,6 @@ function parsePortNumber(
   return coerced;
 }
 
-// Coerce common string/number representations of a boolean to a real boolean.
-// Returns `undefined` when the value cannot be interpreted, so callers can
-// fall back to their own default. Guards against the "string `false` is
-// truthy" footgun (CLAUDE.md gotcha #36) when config values arrive from
-// CLI/env/JSON sources where booleans are sometimes string-typed.
-function coerceBooleanLike(value: unknown): boolean | undefined {
-  if (typeof value === "boolean") return value;
-  if (typeof value === "number") {
-    if (value === 1) return true;
-    if (value === 0) return false;
-    return undefined;
-  }
-  if (typeof value === "string") {
-    const normalized = value.trim().toLowerCase();
-    if (normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on") {
-      return true;
-    }
-    if (normalized === "false" || normalized === "0" || normalized === "no" || normalized === "off") {
-      return false;
-    }
-  }
-  return undefined;
-}
-
 function readNestedConfig(
   cfg: Record<string, unknown>,
   blockName: string,
@@ -658,6 +587,7 @@ const DEFAULT_BEHAVIOR_LOOP_PROTECTED_PARAMS = [
   "maxMemoryTokens",
   "qmdMaxResults",
   "qmdColdMaxResults",
+  "qmdEmbeddingBacklogThreshold",
   "recallPlannerMaxQmdResultsMinimal",
   "verbatimArtifactsMaxRecall",
 ];
@@ -1683,6 +1613,15 @@ export function parseConfig(
         : "openclaw-engram",
     qmdMaxResults:
       typeof cfg.qmdMaxResults === "number" ? cfg.qmdMaxResults : 8,
+    qmdEmbeddingBacklogThreshold: (() => {
+      const raw = cfg.qmdEmbeddingBacklogThreshold;
+      const n = typeof raw === "number"
+        ? raw
+        : typeof raw === "string" && raw.trim() !== ""
+          ? Number(raw)
+          : NaN;
+      return Number.isFinite(n) && Number.isInteger(n) && n >= 0 ? n : 1000;
+    })(),
     qmdColdTierEnabled: cfg.qmdColdTierEnabled === true,
     qmdColdCollection:
       typeof cfg.qmdColdCollection === "string" && cfg.qmdColdCollection.length > 0
@@ -1780,6 +1719,16 @@ export function parseConfig(
       typeof cfg.sessionObserverDebounceMs === "number"
         ? Math.max(0, Math.floor(cfg.sessionObserverDebounceMs))
         : 120_000,
+    // Explicit validation (issue #1909 review round 8): reject invalid input
+    // rather than flooring/clamping. Must be an integer in [0, 2^31-1] (Node's
+    // setTimeout ceiling); 0 = save every turn; undefined → 3000.
+    bufferSaveDebounceMs: parseIntegerInClosedRange(
+      cfg.bufferSaveDebounceMs,
+      0,
+      2_147_483_647,
+      3_000,
+      "bufferSaveDebounceMs",
+    ),
     sessionObserverBands,
     injectQuestions: cfg.injectQuestions === true,
     commitmentDecayDays: parseIntegerAtLeast(
@@ -2061,10 +2010,8 @@ export function parseConfig(
           (v): v is string => typeof v === "string" && v.length > 0,
         )
       : ["decisions", "principles", "conventions", "runbooks", "entities"],
-    // Cross-namespace query-budget limiter (issue #565 PR 4/5).
-    // Defaults to false — ships disabled so existing deployments are
-    // unaffected. When enabled, the read path throttles a principal that
-    // issues a burst of recalls against namespaces other than their own.
+    // Cross-namespace query-budget limiter (issue #565 PR 4/5). Defaults to
+    // false — ships disabled; when enabled, throttles cross-namespace recall bursts.
     recallCrossNamespaceBudgetEnabled:
       coerceBool(cfg.recallCrossNamespaceBudgetEnabled) ?? false,
     recallCrossNamespaceBudgetWindowMs: (() => {
@@ -2079,6 +2026,7 @@ export function parseConfig(
       const n = coerceNumber(cfg.recallCrossNamespaceBudgetHardLimit);
       return n !== undefined && n > 0 ? Math.floor(n) : 30;
     })(),
+    ...parseRecallConcurrencyConfig(cfg),
     // Recall-audit anomaly detector (issue #565 PR 5/5). Defaults off so
     // existing deployments are unaffected; enable explicitly to let the
     // access surfaces flag suspicious query patterns derived from the
@@ -2126,6 +2074,15 @@ export function parseConfig(
     // opt out with recallMemoryWorthFilterEnabled=false.
     recallMemoryWorthFilterEnabled:
       coerceBool(cfg.recallMemoryWorthFilterEnabled) ?? true,
+    // Trust/Memory-Worth recall stage corpus-level fallback (issue #1905).
+    // Default true: when a candidate is missing from the frontmatter already
+    // loaded on the hot recall path, the stage may fall back to a per-namespace
+    // corpus counter/signal map (version-keyed, so it hits in steady state).
+    // Set false to disable that O(corpus) fallback entirely — the stage then
+    // uses only the preloaded frontmatter plus a bounded-parallel per-candidate
+    // direct read (fully O(candidates)). coerceBool handles "false"/"0" forms.
+    recallTrustStageCorpusFallbackEnabled:
+      coerceBool(cfg.recallTrustStageCorpusFallbackEnabled) ?? true,
     // Hot-memories result cache (issue #1902). Default on: readAllMemories()
     // serves from the version-keyed in-process corpus cache. coerceBool
     // handles "false"/"0" string forms; set false to force disk scans.
@@ -2274,15 +2231,31 @@ export function parseConfig(
         ? cfg.activeRecallPromptStyle
         : "balanced",
     activeRecallCustomInstruction: (() => {
-      const customInstruction =
+      const raw =
         typeof cfg.activeRecallCustomInstruction === "string"
           ? cfg.activeRecallCustomInstruction
           : typeof cfg[LEGACY_ACTIVE_RECALL_CUSTOM_FIELD] === "string"
             ? cfg[LEGACY_ACTIVE_RECALL_CUSTOM_FIELD]
             : "";
-      return customInstruction.trim().length > 0
-        ? customInstruction.trim()
-        : null;
+      return raw.trim().length > 0 ? raw.trim() : null;
+    })(),
+    activeRecallPromptReplacement: (() => {
+      const raw = cfg.activeRecallPromptReplacement;
+      if (raw !== undefined && raw !== null && typeof raw !== "string") {
+        throw new Error(
+          `activeRecallPromptReplacement must be a string; got ${JSON.stringify(raw)}`,
+        );
+      }
+      return typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : null;
+    })(),
+    activeRecallPromptOverride: (() => {
+      const raw = cfg.activeRecallPromptOverride;
+      if (raw !== undefined && raw !== null && typeof raw !== "string") {
+        throw new Error(
+          `activeRecallPromptOverride must be a string; got ${JSON.stringify(raw)}`,
+        );
+      }
+      return typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : null;
     })(),
     activeRecallPromptAppend:
       typeof cfg.activeRecallPromptAppend === "string" &&
@@ -3131,6 +3104,7 @@ export function parseConfig(
       typeof cfg.entityRetrievalRecentTurns === "number" ? cfg.entityRetrievalRecentTurns : 6,
     entitySchemas,
     recallBudgetChars: recallPipelineConfig.recallBudgetChars,
+    recallProfileMaxRatio: parseRecallProfileMaxRatio(cfg.recallProfileMaxRatio),
     recallOuterTimeoutMs:
       typeof cfg.recallOuterTimeoutMs === "number" ? Math.max(0, Math.floor(cfg.recallOuterTimeoutMs)) : 75_000,
     recallCoreDeadlineMs:
@@ -3305,6 +3279,17 @@ export function parseConfig(
       typeof cfg.proactiveExtractionTimeoutMs === "number"
         ? Math.max(0, Math.floor(cfg.proactiveExtractionTimeoutMs))
         : 2500,
+    proactiveExtractionSkipWhenLocalLlmBusy: ((): boolean => {
+      const raw = cfg.proactiveExtractionSkipWhenLocalLlmBusy;
+      if (raw === undefined || raw === null) return true;
+      const value = coerceBooleanLike(raw, "proactiveExtractionSkipWhenLocalLlmBusy");
+      if (value === undefined) {
+        throw new Error(
+          `proactiveExtractionSkipWhenLocalLlmBusy must be boolean-like (true|false|1|0|yes|no|on|off); got ${JSON.stringify(raw)}`,
+        );
+      }
+      return value;
+    })(),
     proactiveExtractionMaxTokens:
       typeof cfg.proactiveExtractionMaxTokens === "number"
         ? Math.max(0, Math.floor(cfg.proactiveExtractionMaxTokens))
@@ -3572,10 +3557,9 @@ export function parseConfig(
       Number.isFinite(cfg.graphEdgeDecayVisibilityThreshold)
         ? Math.max(0, Math.min(1, cfg.graphEdgeDecayVisibilityThreshold))
         : 0.2,
-    // Issue #681 PR 3/3 — confidence-aware traversal & PageRank refinement.
-    // Floor clamps to [0, 1] so misconfigured input cannot accept negative
-    // confidences or reject every edge. Iterations floors at 0 so a
-    // documented 0 disables PageRank refinement and BFS scores pass through.
+    ...parseBoundedJsonlStateConfig(cfg, parseIntegerAtLeast),
+    // Issue #681 PR 3/3 — confidence-aware traversal. Floor clamps to [0,1]; a
+    // documented 0 iterations disables PageRank refinement (BFS scores pass through).
     graphTraversalConfidenceFloor:
       typeof cfg.graphTraversalConfidenceFloor === "number" &&
       Number.isFinite(cfg.graphTraversalConfidenceFloor)
@@ -4136,6 +4120,17 @@ function clampNonNegativeNumber(value: unknown): number | undefined {
   return Math.max(0, Math.floor(value));
 }
 
+function parseRecallProfileMaxRatio(value: unknown): number {
+  if (value === undefined) return 0.3;
+  const ratio = coerceNumber(value);
+  if (ratio === undefined || ratio < 0 || ratio > 1) {
+    throw new Error(
+      `recallProfileMaxRatio must be a finite number in [0, 1]; got ${JSON.stringify(value)}`,
+    );
+  }
+  return ratio;
+}
+
 /**
  * Cursor L on PR #736: numeric config keys must accept BOTH numbers
  * and CLI-string forms (`--config peerProfileReasonerMinInteractions=10`

package/src/connector-provenance-lifecycle.test.ts

@@ -295,9 +295,9 @@ test("runExtraction: mixed tagged+untagged turns → persistExtraction receives
             validAt?: string;
             sourceConnector?: string;
           }
-        ): Promise<string[]> => {
+        ): Promise<{ persistedIds: string[]; memoryPathById: Map<string, string> }> => {
           spy(sourceContext);
-          return ["fact-1"];
+          return { persistedIds: ["fact-1"], memoryPathById: new Map() };
         },
         maybeCapturePassiveCorrections: async () => {},
         resolveSelfNamespace: () => "default",
@@ -397,9 +397,9 @@ test("runExtraction: context-only turns without sourceConnector do not affect at
           validAt?: string;
           sourceConnector?: string;
         }
-      ): Promise<string[]> => {
+      ): Promise<{ persistedIds: string[]; memoryPathById: Map<string, string> }> => {
         capturedConnector = sourceContext?.sourceConnector;
-        return ["fact-1"];
+        return { persistedIds: ["fact-1"], memoryPathById: new Map() };
       },
       maybeCapturePassiveCorrections: async () => {},
       resolveSelfNamespace: () => "default",