@totalreclaw/totalreclaw 3.3.1-rc.21 → 3.3.1-rc.22

package/dist/embedding.js

@@ -1,26 +1,38 @@
 /**
- * TotalReclaw Plugin - Local Embedding via @huggingface/transformers
+ * TotalReclaw Plugin - Local Embedding via lazy GitHub-Releases bundle
  *
- * Generates text embeddings locally using an ONNX model. No API key needed,
- * no data leaves the machine. Preserves the E2EE guarantee.
+ * Generates text embeddings locally using an ONNX model. Preserves the
+ * E2EE guarantee — embeddings are computed on the user's machine and
+ * never leave it. The model itself, plus the heavy native dependencies
+ * (`@huggingface/transformers`, `onnxruntime-node`), is fetched on
+ * first use from a versioned GitHub Release tarball rather than shipped
+ * inside the npm/ClawHub plugin tarball.
  *
- * Locked to Harrier-OSS-v1-270M (640d, q4, ~344MB, pre-pooled). Changing the
- * embedding model breaks search across an existing vault, so the
- * `TOTALRECLAW_EMBEDDING_MODEL` user-facing env var was removed in v1.
+ * Why lazy retrieval (rc.22):
+ *   rc.21 OOM-killed the OpenClaw gateway during `openclaw plugins install`
+ *   on a 3.7 GB Hetzner VPS — the heavy native deps required ~700 MB+
+ *   peak install RAM, and a partial install left orphaned
+ *   `~/.openclaw/extensions/.openclaw-install-stage-*` directories that
+ *   the loader then auto-discovered on every boot, crashing the CLI.
+ *   rc.22 splits the heavy bits out of the install path: the plugin
+ *   tarball stays ~5-10 MB (ClawHub-friendly), the model + native deps
+ *   are downloaded lazily when the user actually invokes a memory tool,
+ *   and per-turn OOM is recoverable in a way install-time OOM is not.
  *
- * Dependencies: @huggingface/transformers
+ * Locked to Harrier-OSS-v1-270M (640d, q4, ~344MB, pre-pooled). Changing
+ * the embedding model breaks search across an existing vault, so the
+ * `TOTALRECLAW_EMBEDDING_MODEL` user-facing env var was removed in v1.
  *
- * Download UX (rc.16, fixes #92):
- *   First-call download is wrapped via `downloadWithUX` from `download-ux.ts`
- *   — configurable timeout (`TOTALRECLAW_ONNX_INSTALL_TIMEOUT`, default 600s),
- *   60s keep-alive, 3-attempt exponential-backoff retry, loud actionable
- *   failure. Slow-bandwidth hosts no longer see a silent freeze.
+ * Forward-compat (rc.22): every claim is tagged with `embedding_model_id`
+ * (see `getEmbeddingModelId()`) so a future distillation can be detected
+ * and rescoped per claim without breaking the active vault.
  */
-// @ts-ignore - @huggingface/transformers types may not be perfect
-import { AutoTokenizer, AutoModel, pipeline } from '@huggingface/transformers';
-import { downloadWithUX, getDownloadTimeoutMs } from './download-ux.js';
+import os from 'node:os';
+import path from 'node:path';
+import { loadEmbedder } from './embedder-loader.js';
 const HARRIER_MODEL = {
-    id: 'onnx-community/harrier-oss-v1-270m-ONNX',
+    semanticId: 'harrier-oss-270m-q4',
+    hfId: 'onnx-community/harrier-oss-v1-270m-ONNX',
     dims: 640,
     pooling: 'sentence_embedding',
     size: '~344MB',
@@ -29,7 +41,24 @@ const HARRIER_MODEL = {
 function getModelConfig() {
     return HARRIER_MODEL;
 }
-/** Lazily initialized model instances. */
+let runtimeConfig = null;
+export function configureEmbedder(cfg) {
+    runtimeConfig = cfg;
+}
+/**
+ * Default cache root. Used when `configureEmbedder()` was not called —
+ * production code always calls it from index.ts; tests may rely on this
+ * default.
+ */
+function defaultCacheRoot() {
+    return path.join(os.homedir(), '.totalreclaw', 'embedder');
+}
+function activeRuntimeConfig() {
+    if (runtimeConfig)
+        return runtimeConfig;
+    return { cacheRoot: defaultCacheRoot(), rcTag: '0.0.0-dev' };
+}
+/** Lazily initialized state. */
 let pipelineExtractor = null;
 let autoTokenizer = null;
 let autoModel = null;
@@ -37,39 +66,53 @@ let activeModel = null;
 /**
  * Generate an embedding vector for the given text.
  *
- * On first call, downloads and loads the ONNX model (cached after download).
- * Subsequent calls reuse the loaded model and run in ~100ms.
+ * On first call, downloads the embedder bundle (transformers + onnxruntime
+ * + the q4 ONNX model) from the pinned GitHub Release, verifies the
+ * tarball SHA-256 against the manifest, extracts to
+ * `~/.totalreclaw/embedder/v1/`, then loads the model into memory.
+ * Subsequent calls reuse the loaded model and run in ~100 ms.
  */
 export async function generateEmbedding(text, options) {
     if (!activeModel) {
         activeModel = getModelConfig();
-        const timeoutSec = Math.floor(getDownloadTimeoutMs() / 1000);
-        console.error(`[TotalReclaw] Downloading embedding model (${activeModel.size}) — this may take a few minutes on slower connections. Please wait.`);
-        console.error(`[TotalReclaw] One-time setup. Per-attempt timeout: ${timeoutSec}s (configurable via TOTALRECLAW_ONNX_INSTALL_TIMEOUT). Cached after first download.`);
+        const cfg = activeRuntimeConfig();
+        console.error(`[TotalReclaw] Embedding model first-call: fetching bundle ${activeModel.size} from GitHub Releases for v${cfg.rcTag} (cached at ${cfg.cacheRoot}).`);
+        const loaded = await loadEmbedder({
+            cacheRoot: cfg.cacheRoot,
+            rcTag: cfg.rcTag,
+        });
+        if (loaded.manifest.dimension !== activeModel.dims) {
+            throw new Error(`embedder bundle dimension ${loaded.manifest.dimension} does not match plugin-expected ${activeModel.dims}. ` +
+                `Refusing to use mismatched embedder — vector space drift would corrupt cosine search.`);
+        }
+        if (loaded.manifest.model_id !== activeModel.semanticId) {
+            console.error(`[TotalReclaw] WARNING: bundled model_id "${loaded.manifest.model_id}" != plugin-expected "${activeModel.semanticId}". Continuing — distillation forward-compat path.`);
+        }
+        // Resolve the transformers entrypoint via the cache-bound require.
+        // The bundled package was generated by `scripts/build-embedder-bundle.mjs`
+        // and lives at `<cache>/v1/node_modules/@huggingface/transformers`.
+        const transformers = loaded.cacheRequire('@huggingface/transformers');
+        const { AutoTokenizer, AutoModel, pipeline } = transformers;
         if (activeModel.pooling === 'sentence_embedding') {
-            // Harrier: use AutoModel (pipeline doesn't support sentence_embedding output)
-            autoTokenizer = await downloadWithUX('tokenizer', () => AutoTokenizer.from_pretrained(activeModel.id));
-            autoModel = await downloadWithUX('embedding model', () => AutoModel.from_pretrained(activeModel.id, {
+            autoTokenizer = await AutoTokenizer.from_pretrained(activeModel.hfId);
+            autoModel = await AutoModel.from_pretrained(activeModel.hfId, {
                 dtype: activeModel.dtype,
-            }));
+            });
         }
         else {
-            // e5-small / Qwen: use pipeline
-            pipelineExtractor = await downloadWithUX('embedding pipeline', () => pipeline('feature-extraction', activeModel.id, {
+            pipelineExtractor = await pipeline('feature-extraction', activeModel.hfId, {
                 dtype: activeModel.dtype,
-            }));
+            });
         }
-        console.error('[TotalReclaw] Embedding model ready. Future startups will be instant.');
+        console.error('[TotalReclaw] Embedding model ready. Future calls are in-memory.');
     }
     const model = activeModel;
     if (model.pooling === 'sentence_embedding') {
-        // Harrier: pre-pooled, pre-normalized output
         const inputs = await autoTokenizer(text, { return_tensors: 'pt', padding: true });
         const output = await autoModel(inputs);
         return Array.from(output.sentence_embedding.data);
     }
     else {
-        // Pipeline models: use pooling option
         const input = model.pooling === 'mean' && options?.isQuery
             ? `query: ${text}`
             : text;
@@ -79,8 +122,20 @@ export async function generateEmbedding(text, options) {
 }
 /**
  * Get the embedding vector dimensionality.
- * Returns 640 (default/Harrier), 384 (small), or 1024 (large) depending on model selection.
+ * Returns 640 for Harrier-OSS-270M-q4.
  */
 export function getEmbeddingDims() {
     return getModelConfig().dims;
 }
+/**
+ * Get the semantic embedding-model id stamped on each new claim (rc.22+).
+ *
+ * Forward-compat marker: if a future plugin version distills to a smaller
+ * model, claims tagged with the prior id can be re-embedded selectively
+ * instead of forcing a vault-wide rebuild. Defaults to the v1 Harrier id —
+ * plugin code always tags new claims via this constant, never trusts the
+ * model id from a downloaded bundle for write-time tagging.
+ */
+export function getEmbeddingModelId() {
+    return getModelConfig().semanticId;
+}

package/dist/fs-helpers.js

@@ -295,6 +295,168 @@ export function cleanupInstallStagingDirs(pluginDir, _now = Date.now) {
     return removed;
 }
 // ---------------------------------------------------------------------------
+// Partial-install detection (rc.22 finding #5)
+// ---------------------------------------------------------------------------
+/**
+ * Marker filename written into the plugin directory at register-time. Its
+ * presence means a prior install was interrupted before the plugin successfully
+ * loaded — a confirmed-broken half-state that the next `openclaw plugins
+ * install` retry can detect and clean.
+ *
+ * Conceptually the marker is dropped BEFORE npm install completes (the
+ * complementary npm script removes it on success) and additionally
+ * re-asserted at register-time as a second-line check. If you see this file
+ * in `<extensionsDir>/totalreclaw/`, the install never reached register()
+ * AND the marker drop wasn't undone.
+ *
+ * Constants are exported so the npm preinstall/cleanup scripts in
+ * `package.json` use the same name as the runtime detector.
+ */
+export const PARTIAL_INSTALL_MARKER = '.tr-partial-install';
+/** Package name we own — used to confirm a directory is OUR plugin, not a stray. */
+export const PLUGIN_PACKAGE_NAME = '@totalreclaw/totalreclaw';
+/**
+ * Inspect a plugin install directory to decide whether it is fully installed,
+ * a corrupted half-state from an interrupted install, or someone else's
+ * plugin. Pure filesystem inspection; never deletes anything.
+ *
+ * Background — rc.22 finding #5
+ * ------------------------------
+ * After a partial `openclaw plugins install @totalreclaw/totalreclaw` (e.g.
+ * the auto-gateway-restart kills npm mid-build), `extensions/totalreclaw/`
+ * survives with a populated package.json but a missing or empty `dist/`. The
+ * agent's recovery retry then fires another install; OpenClaw's plugin
+ * loader scans `extensions/` and tries to register the half-state as a "hook
+ * pack", failing with the cryptic "package.json missing openclaw.hooks". The
+ * fix: detect the partial state up-front so the retry can wipe + reinstall
+ * instead of cargo-culting a confused error.
+ *
+ * Decision rules
+ * --------------
+ *   1. `pluginRootDir` does not exist → `'absent'`.
+ *   2. package.json missing or unparsable → `'foreign'` (don't touch).
+ *   3. package.json `name !== '@totalreclaw/totalreclaw'` → `'foreign'`.
+ *   4. `<root>/.tr-partial-install` exists → `'partial'` (the canonical signal).
+ *   5. `<root>/dist/index.js` missing → `'partial'` (build never finished).
+ *   6. otherwise → `'clean'`.
+ *
+ * The function is intentionally conservative: it returns `'foreign'` on any
+ * ambiguous read. Callers should NEVER auto-wipe a `'foreign'` directory.
+ *
+ * @param pluginRootDir Absolute path to the suspect plugin dir, e.g.
+ *                      `~/.openclaw/extensions/totalreclaw`.
+ */
+export function detectPartialInstall(pluginRootDir) {
+    const reasons = [];
+    // Rule 1 — absent dir.
+    let rootStat;
+    try {
+        rootStat = fs.statSync(pluginRootDir);
+    }
+    catch {
+        return { status: 'absent', reasons: ['directory does not exist'] };
+    }
+    if (!rootStat.isDirectory()) {
+        return { status: 'foreign', reasons: ['path exists but is not a directory'] };
+    }
+    // Rules 2-3 — package.json must claim our name.
+    const pkgJsonPath = path.join(pluginRootDir, 'package.json');
+    let pkgRaw;
+    try {
+        pkgRaw = fs.readFileSync(pkgJsonPath, 'utf-8');
+    }
+    catch {
+        return { status: 'foreign', reasons: ['package.json missing or unreadable'] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(pkgRaw);
+    }
+    catch {
+        return { status: 'foreign', reasons: ['package.json is not valid JSON'] };
+    }
+    if (parsed.name !== PLUGIN_PACKAGE_NAME) {
+        return {
+            status: 'foreign',
+            reasons: [`package.json declares "${String(parsed.name)}" not "${PLUGIN_PACKAGE_NAME}"`],
+        };
+    }
+    // Rule 4 — explicit partial marker wins.
+    const markerPath = path.join(pluginRootDir, PARTIAL_INSTALL_MARKER);
+    if (fs.existsSync(markerPath)) {
+        reasons.push(`${PARTIAL_INSTALL_MARKER} marker present (preinstall fired, postinstall did not)`);
+    }
+    // Rule 5 — dist/index.js must exist for the loader to register.
+    const distIndex = path.join(pluginRootDir, 'dist', 'index.js');
+    if (!fs.existsSync(distIndex)) {
+        reasons.push('dist/index.js missing (build artifact absent)');
+    }
+    if (reasons.length > 0) {
+        return { status: 'partial', reasons };
+    }
+    return { status: 'clean', reasons: [] };
+}
+/**
+ * Wipe a partial-install directory so the next `openclaw plugins install`
+ * starts from a blank slate. Only acts when `detectPartialInstall(...)`
+ * returns `'partial'` — `'foreign'` and `'clean'` are no-ops by design.
+ *
+ * Returns `true` if the directory was wiped, `false` otherwise.
+ *
+ * SAFETY: this helper is the only place that recursively deletes a plugin
+ * dir. It refuses to act on `'foreign'` and `'clean'` results so a
+ * misconfigured caller can never wipe a healthy install or someone else's
+ * plugin.
+ */
+export function wipePartialInstall(pluginRootDir) {
+    const detection = detectPartialInstall(pluginRootDir);
+    if (detection.status !== 'partial')
+        return false;
+    try {
+        fs.rmSync(pluginRootDir, { recursive: true, force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Drop the `.tr-partial-install` marker into `pluginRootDir`. Idempotent
+ * (overwrites any existing marker) and best-effort — returns `true` on
+ * success, `false` if the dir doesn't exist or write fails. Used by the
+ * `preinstall` npm script and (defensively) by the runtime if the npm
+ * preinstall/cleanup script pair did not fire.
+ */
+export function writePartialInstallMarker(pluginRootDir) {
+    try {
+        if (!fs.existsSync(pluginRootDir))
+            return false;
+        fs.writeFileSync(path.join(pluginRootDir, PARTIAL_INSTALL_MARKER), '');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Remove the partial-install marker. Called by the `postinstall` script and
+ * (defensively) at register-time once we've confirmed the load succeeded.
+ * Returns `true` if a marker was removed, `false` if there was nothing to
+ * remove.
+ */
+export function clearPartialInstallMarker(pluginRootDir) {
+    try {
+        const markerPath = path.join(pluginRootDir, PARTIAL_INSTALL_MARKER);
+        if (!fs.existsSync(markerPath))
+            return false;
+        fs.unlinkSync(markerPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ---------------------------------------------------------------------------
 // Auto-bootstrap of credentials.json (3.1.0 first-run UX)
 // ---------------------------------------------------------------------------
 /**

package/dist/index.js

@@ -48,13 +48,14 @@
 import { deriveKeys, deriveLshSeed, computeAuthKeyHash, encrypt, decrypt, generateBlindIndices, generateContentFingerprint, } from './crypto.js';
 import { createApiClient } from './api-client.js';
 import { extractFacts, extractDebrief, isValidMemoryType, parseEntity, VALID_MEMORY_TYPES, LEGACY_V0_MEMORY_TYPES, VALID_MEMORY_SOURCES, VALID_MEMORY_SCOPES, EXTRACTION_SYSTEM_PROMPT, extractFactsForCompaction, } from './extractor.js';
-import { initLLMClient, resolveLLMConfig, chatCompletion, generateEmbedding, getEmbeddingDims } from './llm-client.js';
+import { initLLMClient, resolveLLMConfig, chatCompletion, generateEmbedding, getEmbeddingDims, getEmbeddingModelId, configureEmbedder, } from './llm-client.js';
 import { defaultAuthProfilesRoot, readAllProfileKeys, dedupeByProvider, } from './llm-profile-reader.js';
 import { LSHHasher } from './lsh.js';
-import { rerank, cosineSimilarity, detectQueryIntent, INTENT_WEIGHTS, passesRelevanceGate } from './reranker.js';
+import { rerank, cosineSimilarity, detectQueryIntent, INTENT_WEIGHTS } from './reranker.js';
 import { deduplicateBatch } from './semantic-dedup.js';
 import { findNearDuplicate, shouldSupersede, clusterFacts, getStoreDedupThreshold, getConsolidationThreshold, STORE_DEDUP_MAX_CANDIDATES, } from './consolidation.js';
 import { isSubgraphMode, getSubgraphConfig, encodeFactProtobuf, submitFactBatchOnChain, deriveSmartAccountAddress, PROTOBUF_VERSION_V4 } from './subgraph-store.js';
+import { confirmIndexed } from './confirm-indexed.js';
 import { DIGEST_TRAPDOOR, buildCanonicalClaim, computeEntityTrapdoor, computeEntityTrapdoors, isDigestBlob, normalizeToV1Type, readClaimFromBlob, resolveDigestMode, } from './claims-helper.js';
 import { maybeInjectDigest, recompileDigest, fetchAllActiveClaims, isRecompileInProgress, tryBeginRecompile, endRecompile, } from './digest-sync.js';
 import { detectAndResolveContradictions, runWeightTuningLoop, } from './contradiction-sync.js';
@@ -65,7 +66,7 @@ import { PluginHotCache } from './hot-cache-wrapper.js';
 import { CONFIG, setRecoveryPhraseOverride } from './config.js';
 import { buildRelayHeaders } from './relay-headers.js';
 import { readBillingCache, writeBillingCache, BILLING_CACHE_PATH, } from './billing-cache.js';
-import { ensureMemoryHeaderFile, loadCredentialsJson, writeCredentialsJson, deleteCredentialsFile, isRunningInDocker, deleteFileIfExists, resolveOnboardingState, writeOnboardingState, readPluginVersion, cleanupInstallStagingDirs, } from './fs-helpers.js';
+import { ensureMemoryHeaderFile, loadCredentialsJson, writeCredentialsJson, deleteCredentialsFile, isRunningInDocker, deleteFileIfExists, resolveOnboardingState, writeOnboardingState, readPluginVersion, cleanupInstallStagingDirs, clearPartialInstallMarker, } from './fs-helpers.js';
 import { isRcBuild } from './qa-bug-report.js';
 import { decideToolGate, isGatedToolName } from './tool-gating.js';
 import { detectFirstRun, buildWelcomePrepend } from './first-run.js';
@@ -1548,6 +1549,11 @@ async function storeExtractedFacts(facts, logger, sourceOverride) {
                 fact: factForBlob,
                 importance: effectiveImportance,
                 sourceAgent: factSource,
+                // 3.3.1-rc.22 — tag every new claim with the active embedder id
+                // so future distillation can rescore selectively. Plugin-only
+                // field; survives the core validator strip via re-attach in
+                // `buildCanonicalClaimV1`.
+                embeddingModelId: getEmbeddingModelId(),
             });
             const factId = crypto.randomUUID();
             // Phase 2 Slice 2d: contradiction detection + auto-resolution.
@@ -2342,6 +2348,47 @@ const plugin = {
                 // Best-effort — already swallowed inside the helper, but keep this
                 // outer try as belt-and-braces against future helper changes.
             }
+            // 3.3.1-rc.22 — wire the lazy-embedder runtime config so the first
+            // `generateEmbedding()` call knows where to cache the bundle and
+            // which RC's GitHub Release to fetch from. `pluginVersion` may be
+            // `null` if package.json is unreadable; the embedder defaults to
+            // a "0.0.0-dev" tag in that case.
+            try {
+                configureEmbedder({
+                    cacheRoot: CONFIG.embedderCachePath,
+                    rcTag: pluginVersion ?? '0.0.0-dev',
+                });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                api.logger.warn(`TotalReclaw: configureEmbedder failed (will use defaults): ${msg}`);
+            }
+            // 3.3.1-rc.22 (rc.21 finding #5): self-heal partial-install marker.
+            // The `preinstall` npm script writes `.tr-partial-install`; the
+            // `postinstall` script removes it on a successful install. If we
+            // have gotten this far the loader did register us — meaning the
+            // install succeeded enough to be useful — so any lingering marker
+            // (e.g. npm ran preinstall but postinstall misfired) is stale.
+            // Clear it so the next retry's detector does not see a false positive.
+            //
+            // 3.3.1-rc.22 (rc.21 finding #6) — gateway/reload upstream caveat:
+            // OpenClaw's config-watcher fires `gateway/reload` when
+            // `plugins.entries.totalreclaw` mutates (e.g. mid-install). In-flight
+            // CLI clients see `1006 abnormal closure` and start a 600-second wait.
+            // Proper fix is upstream OpenClaw FR. Plugin-side mitigation = these
+            // helper calls MUST be idempotent under repeated register() calls
+            // triggered by reload chatter. Asserted by
+            // `install-reload-idempotency.test.ts`.
+            try {
+                const pluginRoot = nodePath.resolve(pluginDir, '..');
+                const cleared = clearPartialInstallMarker(pluginRoot);
+                if (cleared) {
+                    api.logger.info(`TotalReclaw: cleared stale .tr-partial-install marker (rc.22 finding #5)`);
+                }
+            }
+            catch {
+                // Best-effort. Helper logs internally and never throws.
+            }
         }
         catch {
             rcMode = false;
@@ -2994,21 +3041,10 @@ const plugin = {
                             details: { count: 0, memories: [] },
                         };
                     }
-                    // 6b. Relevance gate — surface results when EITHER the top match
-                    //     clears the cosine threshold OR every meaningful query token
-                    //     appears in the top result's text (lexical override).
-                    //     Issue #116 (rc.18 finding F1): short queries like
-                    //     "favorite color" produce embeddings with low cosine sim
-                    //     against the local Harrier-OSS-270m model even when the
-                    //     stored fact text contains every query token.
-                    if (!passesRelevanceGate(params.query, reranked, COSINE_THRESHOLD)) {
-                        const maxCosine = Math.max(...reranked.map((r) => r.cosineSimilarity ?? 0));
-                        api.logger.info(`Recall: relevance gate filtered results (max cosine=${maxCosine.toFixed(3)}, threshold=${COSINE_THRESHOLD}, no lexical override)`);
-                        return {
-                            content: [{ type: 'text', text: 'No relevant memories found for this query.' }],
-                            details: { count: 0, memories: [] },
-                        };
-                    }
+                    // 6b. Relevance gate removed in rc.22 -- core's intent-weighted
+                    //     RRF + Tier 1 source weighting handles short queries via the
+                    //     BM25 component, making the rc.18 cosine + lexical-override
+                    //     band-aid (issue #116) redundant.
                     // 7. Format results.
                     const lines = reranked.map((m, i) => {
                         const meta = metaMap.get(m.id);
@@ -3132,13 +3168,29 @@ const plugin = {
                             throw new Error(`On-chain tombstone failed (tx=${result.txHash?.slice(0, 10) || 'none'}…)`);
                         }
                         api.logger.info(`Tombstone written for ${factId}: tx=${result.txHash}`);
+                        // Read-after-write: poll the subgraph until the original fact id
+                        // is no longer active (forget flips isActive=false). On timeout
+                        // surface `partial: true` so the agent can explain the chain
+                        // write succeeded but the subgraph is still propagating.
+                        const confirm = await confirmIndexed(factId, {
+                            expect: 'inactive',
+                            authKeyHex: authKeyHex,
+                        });
                         return {
                             content: [{
                                     type: 'text',
-                                    text: `Memory ${factId} deleted on-chain (tx: ${result.txHash}). ` +
-                                        'The subgraph will reflect isActive=false within ~30 seconds.',
+                                    text: confirm.indexed
+                                        ? `Memory ${factId} deleted on-chain and confirmed by the subgraph (tx: ${result.txHash}).`
+                                        : `Memory ${factId} deleted on-chain (tx: ${result.txHash}). ` +
+                                            'The subgraph indexer is still propagating the change — ' +
+                                            'recall/export may briefly show the memory as still active.',
                                 }],
-                            details: { deleted: true, txHash: result.txHash, factId },
+                            details: {
+                                deleted: true,
+                                txHash: result.txHash,
+                                factId,
+                                ...(confirm.indexed ? {} : { partial: true }),
+                            },
                         };
                     }
                     else {
@@ -5019,13 +5071,7 @@ const plugin = {
                     lastQueryEmbedding = queryEmbedding;
                     if (reranked.length === 0)
                         return undefined;
-                    // 6b. Relevance gate — see recall tool above for the cosine +
-                    //     lexical-override rule (issue #116).
-                    if (!passesRelevanceGate(evt.prompt, reranked, COSINE_THRESHOLD)) {
-                        const hookMaxCosine = Math.max(...reranked.map((r) => r.cosineSimilarity ?? 0));
-                        api.logger.info(`Hook: relevance gate filtered results (max cosine=${hookMaxCosine.toFixed(3)}, threshold=${COSINE_THRESHOLD}, no lexical override)`);
-                        return undefined;
-                    }
+                    // Relevance gate removed in rc.22 (see recall tool comment).
                     // 7. Build context string.
                     const lines = reranked.map((m, i) => {
                         const meta = hookMetaMap.get(m.id);
@@ -5108,13 +5154,7 @@ const plugin = {
                 /* applySourceWeights (Retrieval v2 Tier 1) */ true);
                 if (reranked.length === 0)
                     return undefined;
-                // Relevance gate — see recall tool for the cosine + lexical-override
-                // rule (issue #116).
-                if (!passesRelevanceGate(evt.prompt, reranked, COSINE_THRESHOLD)) {
-                    const srvMaxCosine = Math.max(...reranked.map((r) => r.cosineSimilarity ?? 0));
-                    api.logger.info(`Hook: relevance gate filtered results (max cosine=${srvMaxCosine.toFixed(3)}, threshold=${COSINE_THRESHOLD}, no lexical override)`);
-                    return undefined;
-                }
+                // Relevance gate removed in rc.22 (see recall tool comment).
                 // 7. Build context string.
                 const lines = reranked.map((m, i) => {
                     const meta = hookMetaMap.get(m.id);

package/dist/llm-client.js

@@ -681,6 +681,7 @@ async function chatCompletionAnthropic(config, messages, maxTokens, temperature,
 // Embedding (re-exported from local ONNX module)
 // ---------------------------------------------------------------------------
 // Embeddings are now generated locally via @huggingface/transformers
-// (Harrier-OSS-v1-270M ONNX model). No API key needed.
-// See embedding.ts for implementation details.
-export { generateEmbedding, getEmbeddingDims } from './embedding.js';
+// (Harrier-OSS-v1-270M ONNX model). No API key needed. The native deps +
+// model are lazy-fetched from a pinned GitHub Release on first call —
+// see embedding.ts + embedder-loader.ts.
+export { generateEmbedding, getEmbeddingDims, getEmbeddingModelId, configureEmbedder } from './embedding.js';

package/dist/pin.js

@@ -14,6 +14,7 @@ import { buildV1ClaimBlob, mapTypeToCategory, readV1Blob, } from './claims-helpe
 import { findLoserClaimInDecisionLog, maybeWriteFeedbackForPin, } from './contradiction-sync.js';
 import { isValidMemoryType, V0_TO_V1_TYPE } from './extractor.js';
 import { PROTOBUF_VERSION_V4 } from './subgraph-store.js';
+import { confirmIndexed } from './confirm-indexed.js';
 // Lazy-load WASM core (mirrors claims-helper.ts pattern — plays nicely under
 // both the OpenClaw runtime (CJS-ish tsx) and bare Node ESM used by tests).
 const requireWasm = createRequire(import.meta.url);
@@ -103,6 +104,7 @@ export function parseBlobForPin(decrypted) {
                     expiresAt: v1.expiresAt,
                     id: v1.id,
                     pinStatus: v1.pinStatus,
+                    embeddingModelId: v1.embeddingModelId,
                 },
                 claim: shortProjection,
                 currentStatus: human,
@@ -228,6 +230,7 @@ function projectToV1(src, defaultSourceAgent) {
             entities: src.entities,
             importance: src.importance,
             confidence: src.confidence,
+            embeddingModelId: src.embeddingModelId,
         };
     }
     // v0 path — upgrade short-key claim to v1.
@@ -308,7 +311,7 @@ function projectToV1(src, defaultSourceAgent) {
  * chain. Matches MCP's `executePinOperation` byte-for-byte on the supersession
  * semantics (short keys, idempotent no-op, decayScore=1.0, trapdoor regen).
  */
-export async function executePinOperation(factId, targetStatus, deps, reason) {
+export async function executePinOperation(factId, targetStatus, deps, reason, confirmOpts) {
     // 1. Fetch the existing fact
     const existing = await deps.fetchFactById(factId);
     if (!existing) {
@@ -408,6 +411,11 @@ export async function executePinOperation(factId, targetStatus, deps, reason) {
             createdAt: new Date().toISOString(),
             supersededBy: factId,
             pinStatus,
+            // 3.3.1-rc.22 — preserve the source claim's embedder tag through
+            // pin mutation. The new fact reuses the same encrypted embedding
+            // as the original (re-indexed via deps.regenerateBlindIndices),
+            // so the embedder identity must round-trip too.
+            embeddingModelId: v1View.embeddingModelId,
         });
     }
     catch (err) {
@@ -502,6 +510,11 @@ export async function executePinOperation(factId, targetStatus, deps, reason) {
                 tx_hash: txHash,
             };
         }
+        // Read-after-write: poll the subgraph until the new (pinned/unpinned)
+        // fact id is indexed and active. On timeout, surface `partial: true`
+        // so a follow-up recall/export that races against indexer lag can
+        // surface a clear "still propagating" hint rather than apparent staleness.
+        const confirm = await confirmIndexed(newFactId, confirmOpts);
         return {
             success: true,
             fact_id: factId,
@@ -510,6 +523,7 @@ export async function executePinOperation(factId, targetStatus, deps, reason) {
             new_status: targetStatus,
             tx_hash: txHash,
             reason,
+            ...(confirm.indexed ? {} : { partial: true }),
         };
     }
     catch (err) {