recallnest 2.3.0 → 2.6.0

package/src/access-tracker.ts

@@ -38,10 +38,18 @@ export const DEFAULT_ACCESS_TRACKER_CONFIG: AccessTrackerConfig = {
   reinforcementFactor: 0.5,
   maxMultiplier: 3.0,
   accessFreshnessHalfLifeDays: 30,
-  noveltyThreshold: 0.35,
+  // 0 = novelty gate off. 生产实测（2026-07-23）：0.35 要求命中的 cosine ≤0.65 才打点，
+  // 真实相关命中几乎都 >0.65，导致 accessCount 在生产库全空——"最被用到"的记忆
+  // 恰好全被排除，方向与"用进废退"相反。防刷由 cooldown 承担；要恢复旧行为显式传 0.35。
+  noveltyThreshold: 0,
   cooldownMs: 300_000, // 5 minutes
 };
 
+/** readerIds 在 metadata 里的存储上限。distinctReaderCount 到达上限后饱和不再涨。 */
+// simplified: capped array + saturating count instead of Artel's exact memory_reads
+// ledger table — promotion thresholds are ≤4 distinct readers, so saturation at 8 is harmless.
+export const READER_ID_CAP = 8;
+
 // ============================================================================
 // Core
 // ============================================================================
@@ -52,11 +60,36 @@ export class AccessTracker {
   private flushPromise: Promise<void> | null = null;
   /** Cooldown map: entryId → last reinforced timestamp */
   private cooldownMap = new Map<string, number>();
+  /** Distinct-reader identity: one stdio MCP server process ≈ one CC session.
+   *  Used to maintain readerIds / distinctReaderCount on flush (Artel-style read fan-out). */
+  readonly readerId: string;
+  private exitFlushRegistered = false;
 
   constructor(
     private store: MemoryStore,
     private config: AccessTrackerConfig = DEFAULT_ACCESS_TRACKER_CONFIG,
-  ) {}
+    readerId?: string,
+  ) {
+    this.readerId = readerId ?? `r-${crypto.randomUUID().slice(0, 8)}`;
+  }
+
+  /**
+   * Best-effort flush on normal process exit (stdin close → clean shutdown).
+   * Covers the "retrieval happened <flushIntervalMs before exit" window where the
+   * debounce timer would otherwise drop pending deltas. Opt-in so tests creating
+   * many trackers don't leak process listeners. Not wired to SIGTERM on purpose —
+   * an async handler there isn't guaranteed to complete and we don't want to own
+   * the server's exit semantics.
+   */
+  registerExitFlush(): void {
+    if (this.exitFlushRegistered) return;
+    this.exitFlushRegistered = true;
+    process.once("beforeExit", () => {
+      this.flush().catch(err => {
+        logWarn("AccessTracker exit flush failed:", err);
+      });
+    });
+  }
 
   /**
    * Determine whether a retrieval result should trigger access reinforcement.
@@ -163,43 +196,66 @@ export class AccessTracker {
 
     for (const [id, delta] of batch) {
       try {
-        const entry = await this.store.getById(id);
-        if (!entry) continue;
-
-        const meta = safeParseMetadata(entry.metadata);
-        const prevCount = typeof meta.accessCount === "number" ? meta.accessCount : 0;
-        const newCount = prevCount + delta;
-        const importance = entry.importance ?? 0.6;
-        const lastAccessedAt = now;
-
-        // Evaluate tier change
-        const currentTier = resolveTier(entry.metadata);
-        const newTier = evaluateTierChange(
-          currentTier,
-          newCount,
-          importance,
-          lastAccessedAt,
-        );
-
-        const tierChanged = newTier !== currentTier;
-        if (tierChanged) {
-          if (TIER_ORDER[newTier] > TIER_ORDER[currentTier]) {
+        // Read-modify-write goes through the store's per-id patch queue so a
+        // concurrent usage/confidence patch can't overwrite this delta (or
+        // vice versa). patchFn stays pure — logging happens after settle.
+        let tierChange: { from: MemoryTier; to: MemoryTier; newCount: number } | null = null;
+        const result = await this.store.patchMetadata(id, (meta, entry) => {
+          const prevCount = typeof meta.accessCount === "number" ? meta.accessCount : 0;
+          const newCount = prevCount + delta;
+          const importance = entry.importance ?? 0.6;
+          const lastAccessedAt = now;
+
+          const currentTier = resolveTier(entry.metadata, importance);
+          const newTier = evaluateTierChange(
+            currentTier,
+            newCount,
+            importance,
+            lastAccessedAt,
+          );
+          tierChange = newTier !== currentTier
+            ? { from: currentTier, to: newTier, newCount }
+            : null;
+
+          // Distinct-reader bookkeeping (Artel read fan-out, lightweight form):
+          // dedup by readerId in a capped array; count saturates at cap (under-
+          // counting is safer than over-counting for promotion gating).
+          const rawReaders = Array.isArray(meta.readerIds)
+            ? (meta.readerIds as unknown[]).filter((x): x is string => typeof x === "string")
+            : [];
+          let readerIds = rawReaders;
+          let distinctReaderCount = typeof meta.distinctReaderCount === "number"
+            ? meta.distinctReaderCount
+            : rawReaders.length;
+          if (!rawReaders.includes(this.readerId) && rawReaders.length < READER_ID_CAP) {
+            readerIds = [...rawReaders, this.readerId];
+            distinctReaderCount = readerIds.length;
+          }
+
+          return {
+            ...meta,
+            accessCount: newCount,
+            lastAccessedAt,
+            readerIds,
+            distinctReaderCount,
+            ...(tierChange ? { tier: tierChange.to } : {}),
+          };
+        });
+
+        // Entry vanished mid-flight → drop the delta (same as the old
+        // getById-null path). A patch failure throws and is re-queued below.
+        if (!result) continue;
+
+        if (tierChange !== null) {
+          const change: { from: MemoryTier; to: MemoryTier; newCount: number } = tierChange;
+          if (TIER_ORDER[change.to] > TIER_ORDER[change.from]) {
             promotions++;
-            logInfo(`[INFO] Tier promotion: ${id.slice(0, 8)} ${currentTier} → ${newTier} (access=${newCount})`);
+            logInfo(`[INFO] Tier promotion: ${id.slice(0, 8)} ${change.from} → ${change.to} (access=${change.newCount})`);
           } else {
             demotions++;
-            logInfo(`[INFO] Tier demotion: ${id.slice(0, 8)} ${currentTier} → ${newTier}`);
+            logInfo(`[INFO] Tier demotion: ${id.slice(0, 8)} ${change.from} → ${change.to}`);
           }
         }
-
-        const updatedMeta = {
-          ...meta,
-          accessCount: newCount,
-          lastAccessedAt,
-          ...(tierChanged ? { tier: newTier } : {}),
-        };
-
-        await this.store.update(id, { metadata: JSON.stringify(updatedMeta) });
       } catch {
         // Re-queue failed entries for next flush
         this.pending.set(id, (this.pending.get(id) || 0) + delta);

package/src/activity-counter.ts

@@ -11,6 +11,7 @@ import {
   mkdirSync,
 } from "node:fs";
 import { join, dirname } from "node:path";
+import * as envConfig from "./env-config.js";
 
 // ---------------------------------------------------------------------------
 // Config
@@ -29,7 +30,7 @@ export interface ActivityCounterConfig {
 
 export const DEFAULT_ACTIVITY_CONFIG: ActivityCounterConfig = {
   statsPath: join(
-    process.env.RECALLNEST_DATA_DIR || "data",
+    envConfig.dataDir(),
     "activity-stats.json",
   ),
   lightThreshold: 15,
@@ -44,8 +45,8 @@ export type DistillTier = "none" | "light" | "standard" | "deep";
 // ---------------------------------------------------------------------------
 
 interface ActivityStats {
-  writesSinceLastDistill: number;
-  lastResetAt: number;
+  /** Per-scope write counts since that scope's last dream/distill reset. */
+  scopes: Record<string, number>;
 }
 
 function resolveConfig(
@@ -56,12 +57,24 @@ function resolveConfig(
 
 function readStats(statsPath: string): ActivityStats {
   if (!existsSync(statsPath)) {
-    return { writesSinceLastDistill: 0, lastResetAt: Date.now() };
+    return { scopes: {} };
   }
   try {
-    return JSON.parse(readFileSync(statsPath, "utf-8"));
+    const parsed: unknown = JSON.parse(readFileSync(statsPath, "utf-8"));
+    // Robust against the legacy global format ({writesSinceLastDistill}) — no migration,
+    // just treat anything without a `scopes` map as empty (counts restart per scope).
+    if (
+      parsed !== null &&
+      typeof parsed === "object" &&
+      "scopes" in parsed &&
+      typeof (parsed as { scopes?: unknown }).scopes === "object" &&
+      (parsed as { scopes?: unknown }).scopes !== null
+    ) {
+      return { scopes: (parsed as { scopes: Record<string, number> }).scopes };
+    }
+    return { scopes: {} };
   } catch {
-    return { writesSinceLastDistill: 0, lastResetAt: Date.now() };
+    return { scopes: {} };
   }
 }
 
@@ -74,34 +87,49 @@ function writeStats(statsPath: string, stats: ActivityStats): void {
 // Public API
 // ---------------------------------------------------------------------------
 
-/** Increment write counter by n (default 1). Returns new count. */
+/** Increment a scope's write counter by n (default 1). Returns the scope's new count. */
 export function incrementWriteCount(
+  scope: string,
   n = 1,
   cfg?: Partial<ActivityCounterConfig>,
 ): number {
   const { statsPath } = resolveConfig(cfg);
   const stats = readStats(statsPath);
-  stats.writesSinceLastDistill += n;
+  stats.scopes[scope] = (stats.scopes[scope] ?? 0) + n;
   writeStats(statsPath, stats);
-  return stats.writesSinceLastDistill;
+  return stats.scopes[scope];
 }
 
-/** Read current write count without modifying. */
-export function getWriteCount(cfg?: Partial<ActivityCounterConfig>): number {
+/** Read a scope's current write count without modifying (0 if never written). */
+export function getWriteCount(scope: string, cfg?: Partial<ActivityCounterConfig>): number {
   const { statsPath } = resolveConfig(cfg);
-  return readStats(statsPath).writesSinceLastDistill;
+  return readStats(statsPath).scopes[scope] ?? 0;
 }
 
-/** Reset counter after successful distill. */
-export function resetWriteCount(cfg?: Partial<ActivityCounterConfig>): void {
+/** Reset one scope's counter after its successful dream/distill (leaves other scopes untouched). */
+export function resetWriteCount(scope: string, cfg?: Partial<ActivityCounterConfig>): void {
   const { statsPath } = resolveConfig(cfg);
-  writeStats(statsPath, { writesSinceLastDistill: 0, lastResetAt: Date.now() });
+  const stats = readStats(statsPath);
+  delete stats.scopes[scope];
+  writeStats(statsPath, stats);
+}
+
+/** Scopes whose write count is at or above `threshold` — the dream scheduler's work list. */
+export function listScopesAboveThreshold(
+  threshold: number,
+  cfg?: Partial<ActivityCounterConfig>,
+): string[] {
+  const { statsPath } = resolveConfig(cfg);
+  const stats = readStats(statsPath);
+  return Object.entries(stats.scopes)
+    .filter(([, count]) => count >= threshold)
+    .map(([scope]) => scope);
 }
 
-/** Determine which distill tier the current write count warrants. */
-export function getDistillTier(cfg?: Partial<ActivityCounterConfig>): DistillTier {
+/** Determine which distill tier a scope's write count warrants. */
+export function getDistillTier(scope: string, cfg?: Partial<ActivityCounterConfig>): DistillTier {
   const config = resolveConfig(cfg);
-  const count = getWriteCount(cfg);
+  const count = getWriteCount(scope, cfg);
   if (count >= config.deepThreshold) return "deep";
   if (count >= config.standardThreshold) return "standard";
   if (count >= config.lightThreshold) return "light";

package/src/adaptive-retrieval.ts

@@ -55,8 +55,19 @@ export function shouldSkipRetrieval(query: string, minLength?: number): boolean
 
   const effectiveMinLength = minLength ?? (hasCJK ? 2 : 15);
 
+  // 【本地分叉点 · 2026-08-08 · 勿在同步上游时覆盖回去】
+  // 单 token（不含空格）= 实体查找意图，与问号一样豁免长度闸。
+  // 上游的 ASCII 阈值 15 是按「英文自然语句」定的（挡 "hello there" 这类闲聊），
+  // 但项目名/工具名几乎都短于 15：cobbler=7 / slidesmith=10 / hippo-wiki=10 / recallnest=10，
+  // 于是「甩一个名字过去」这种最自然的查法一律返回空——库里明明有。
+  // 红绿实测：`cobbler` → No results；`cobbler?` → 100% 命中 12 条，只差一个问号豁免。
+  // 中文不受影响（阈值 2），所以该缺陷只在英文实体名上暴露，一直没被发现。
+  // 安全性：本条排在 SKIP_PATTERNS 之后，hi / ok / ping / test / ls / git 等单词仍被挡住。
+  const isSingleToken = !/\s/.test(trimmed);
+
   // Short non-question messages are skipped; questions (? ？) are always worth checking
   if (trimmed.length < effectiveMinLength &&
+      !isSingleToken &&
       !trimmed.includes('?') && !trimmed.includes('？')) {
     return true;
   }

package/src/aliases.ts

@@ -0,0 +1,133 @@
+/**
+ * Alias dictionary for query rewriting.
+ *
+ * Manually maintained — do NOT use LLM expansion (risks precision pollution).
+ * Each rule appends entity tokens to the query when the pattern matches,
+ * giving BM25/vector search more anchor points without losing the original wording.
+ *
+ * Why expand (append) rather than replace:
+ * - Preserves the user's exact wording for vector embedding fidelity.
+ * - BM25 gets extra keyword anchors to find the right entity.
+ * - Reversible via inspecting the expanded vs. original query.
+ *
+ * Add new rules sparingly. Each entry should solve a real failure
+ * documented in FAILURES.md, not a hypothetical.
+ */
+
+export interface AliasRule {
+  pattern: RegExp;
+  expansion: string;
+  comment?: string;
+}
+
+export const ALIAS_RULES: AliasRule[] = [
+  // Entity aliases — colloquial → canonical name
+  {
+    pattern: /(?:我的)?记忆项目/,
+    expansion: "recallnest",
+    comment: "FAILURES 2026-04-25: '我的记忆项目' → recallnest",
+  },
+  {
+    pattern: /我的桥/,
+    expansion: "telegram-ai-bridge",
+    comment: "Alice 用'我的桥'指 telegram-ai-bridge",
+  },
+
+  // Operations vocabulary — operator wording → canonical entities
+  {
+    pattern: /aws\s*(?:bot|ssh|podcast)/i,
+    expansion: "aws-bot hermes-aws aws-podcast-daily",
+    comment: "FAILURES 2026-03-06: aws bot/ssh/podcast → aws-bot hermes-aws entities",
+  },
+  {
+    pattern: /bot\s*(?:挂|崩|不能用|跑不起|失联|down)/i,
+    expansion: "bot-doctor hermes docker launchd 排查 重启",
+    comment: "Operator bot-crash debugging vocabulary",
+  },
+
+  // Cross-window / continuity hints — these strengthen recall of session state.
+  // Pattern 必须明确出现"隔壁/另一窗口/session"才扩；纯"之前说过"太宽会污染
+  // 普通话题（如 fuzzy_ai_feelings 的 "之前聊过 AI 感受" 被错误归类成 cross-window）。
+  {
+    pattern: /(?:刚刚|刚才|之前)(?:.{0,10})(?:隔壁|另一个|其他)(?:.{0,10})(?:窗口|session)/,
+    expansion: "checkpoint session resume_context 跨窗口",
+    comment: "FAILURES 2026-05-10: cross-window real-time sync hint",
+  },
+
+  // Tool provenance — common ambiguous tool references
+  {
+    pattern: /taobao.{0,5}(?:mcp|官方)/i,
+    expansion: "MCP server provenance source",
+    comment: "FAILURES 2026-05-01: taobao MCP official-vs-third-party",
+  },
+
+  // RecallNest self-introspection — capability queries
+  {
+    pattern: /recallnest.{0,15}(?:有哪些|工具|能做|功能|tool)/i,
+    expansion: "search_memory store_memory resume_context checkpoint_session MCP",
+    comment: "FAILURES 2026-04-20: RN self-introspection capability digest",
+  },
+  {
+    pattern: /recallnest.{0,10}(?:ingest|跑了|跑过|状态|telemetry)/i,
+    expansion: "import_conversations weekly-distill ingest telemetry 成功 失败",
+    comment: "FAILURES 2026-04-20: RN ingest telemetry queries",
+  },
+
+  // Personal-life recall — subscription / friends provenance
+  {
+    pattern: /(?:chatgpt|订阅).{0,10}(?:谁|怎么|哪里|帮|顶)/i,
+    expansion: "ChatGPT Plus 群友 加拿大 堂姐 澳洲 代订 aliceljyalice",
+    comment: "FAILURES 2026-05-12: ChatGPT subscription provenance chain",
+  },
+];
+
+/** 超过此长度的 query 不做别名扩展——长 query 是粘贴文档场景,扩展只添噪声 (P1-B)。 */
+export const ALIAS_QUERY_MAX_LENGTH = 100;
+
+/**
+ * Expand a query by appending alias tokens for matching patterns.
+ * Returns the original query unchanged if no rules match.
+ *
+ * 注意分工:本模块只承载**静态 builtin 规则**,作用于 retrieve() 全通道
+ * (vector + BM25)。**用户级** alias(data/alias-map.json)由
+ * query-expander.ts 加载,只作用于 BM25 通道(hybridRetrieval 内部)——
+ * 用户别名不进 vector embedding,避免随手加的别名造成语义向量漂移。
+ *
+ * Example:
+ *   expandQueryWithAliases("帮我看我的记忆项目")
+ *     → "帮我看我的记忆项目 recallnest"
+ *   expandQueryWithAliases("aws ssh 怎么连")
+ *     → "aws ssh 怎么连 aws-bot hermes-aws aws-podcast-daily"
+ */
+export function expandQueryWithAliases(query: string): string {
+  if (!query || typeof query !== "string") return query;
+  if (query.length > ALIAS_QUERY_MAX_LENGTH) return query;
+
+  const additions: string[] = [];
+  const seen = new Set<string>();
+
+  for (const rule of ALIAS_RULES) {
+    if (rule.pattern.test(query)) {
+      for (const token of rule.expansion.split(/\s+/)) {
+        if (token && !seen.has(token) && !query.includes(token)) {
+          additions.push(token);
+          seen.add(token);
+        }
+      }
+    }
+  }
+
+  return additions.length > 0 ? `${query} ${additions.join(" ")}` : query;
+}
+
+/**
+ * Inspection helper — return which builtin rules matched a query, for debugging.
+ * 用户级规则(BM25-only)的检视走 query-expander.ts 的 explainUserAliases。
+ */
+export function explainAliasExpansion(query: string): Array<{ pattern: string; expansion: string; comment?: string }> {
+  return ALIAS_RULES.filter((rule) => rule.pattern.test(query)).map((rule) => ({
+    pattern: rule.pattern.source,
+    expansion: rule.expansion,
+    comment: rule.comment,
+  }));
+}

package/src/api-server.ts

@@ -17,19 +17,25 @@ import { ConflictStatusSchema } from "./conflict-schema.js";
 import { resolveConflictCandidate } from "./conflict-engine.js";
 import { escalateConflicts } from "./conflict-escalation.js";
 import { ConflictCandidateStore } from "./conflict-store.js";
+import { createAuditLogger } from "./audit-log.js";
 import { parseConflictAttention, summarizeConflictLifecycle } from "./conflict-lifecycle.js";
 import { buildConflictAuditSummary, clusterConflicts, summarizeConflictAdvice } from "./conflict-advisor.js";
 import { buildWorkflowEvidence, buildWorkflowObservationRecord, inspectWorkflowDashboard, inspectWorkflowHealth } from "./workflow-observation-engine.js";
+import { recordSkillOutcome } from "./skill-engine.js";
 import { WorkflowObservationStore } from "./workflow-observation-store.js";
 import { buildManagedCheckpointObservation, buildManagedResumeObservation } from "./workflow-observation-managed.js";
 import { runAutoRecall } from "./auto-recall.js";
 import { buildRetrievalContext, resolveScopeSelection } from "./scope-policy.js";
 import { runMemoryLint } from "./memory-lint.js";
+import { enforceLocalHttpRequestPolicy, LOCAL_HTTP_HOSTNAME } from "./http-request-policy.js";
+import * as envConfig from "./env-config.js";
+import { PACKAGE_VERSION } from "./version.js";
 
 const config = (loadDotEnv(), loadConfig());
 const getComponents = createComponentResolver(config);
 const checkpointStore = new SessionCheckpointStore();
 const conflictStore = new ConflictCandidateStore();
+const auditLogger = createAuditLogger();
 const workflowObservationStore = new WorkflowObservationStore();
 
 // ============================================================================
@@ -235,7 +241,7 @@ async function handleStore(request: Request): Promise<Response> {
   const body = await readJson(request);
   try {
     const { store, embedder } = getComponents();
-    const stored = await persistMemory({ store, embedder, conflictStore }, body);
+    const stored = await persistMemory({ store, embedder, conflictStore, auditLogger }, body);
 
     return jsonResponse({
       id: stored.id,
@@ -284,7 +290,7 @@ async function handlePattern(request: Request): Promise<Response> {
   const body = await readJson(request);
   try {
     const { store, embedder } = getComponents();
-    const stored = await persistWorkflowPattern({ store, embedder, conflictStore }, body);
+    const stored = await persistWorkflowPattern({ store, embedder, conflictStore, auditLogger }, body);
     return jsonResponse({
       id: stored.id,
       stored: stored.disposition !== "conflict",
@@ -308,7 +314,7 @@ async function handleCase(request: Request): Promise<Response> {
   const body = await readJson(request);
   try {
     const { store, embedder } = getComponents();
-    const stored = await persistCaseMemory({ store, embedder, conflictStore }, body);
+    const stored = await persistCaseMemory({ store, embedder, conflictStore, auditLogger }, body);
     return jsonResponse({
       id: stored.id,
       stored: stored.disposition !== "conflict",
@@ -332,7 +338,7 @@ async function handlePromote(request: Request): Promise<Response> {
   const body = await readJson(request);
   try {
     const { store, embedder } = getComponents();
-    const stored = await promoteMemory({ store, embedder, conflictStore }, body);
+    const stored = await promoteMemory({ store, embedder, conflictStore, auditLogger }, body);
     return jsonResponse({
       id: stored.id,
       stored: stored.disposition !== "conflict",
@@ -455,13 +461,29 @@ async function handleCheckpoint(request: Request): Promise<Response> {
   }
 }
 
-/** POST /v1/workflow-observe — persist a workflow observation outside durable memory */
+/** POST /v1/workflow-observe — persist a workflow observation outside durable memory; bumps skill counters when `skillId` is present */
 async function handleWorkflowObserve(request: Request): Promise<Response> {
   const body = await readJson(request);
   try {
     const record = buildWorkflowObservationRecord(body);
     const stored = await workflowObservationStore.save(record);
-    return jsonResponse(stored, 201);
+
+    let skillOutcome: unknown = undefined;
+    if (record.skillId) {
+      try {
+        const { store } = getComponents();
+        const result = await recordSkillOutcome(store, record.skillId, record.outcome);
+        skillOutcome = result;
+        if (!result.updated) {
+          console.warn(`[api /v1/workflow-observe] skillId=${record.skillId} update skipped: ${result.reason}`);
+        }
+      } catch (err) {
+        console.warn(`[api /v1/workflow-observe] recordSkillOutcome threw for skillId=${record.skillId}:`, err);
+        skillOutcome = { updated: false, reason: "exception" };
+      }
+    }
+
+    return jsonResponse({ observation: stored, ...(skillOutcome !== undefined ? { skillOutcome } : {}) }, 201);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return errorResponse(400, message);
@@ -605,7 +627,7 @@ async function handleHealth(): Promise<Response> {
     const stats = await store.stats();
     return jsonResponse({
       status: "ok",
-      version: "1.0.0",
+      version: PACKAGE_VERSION,
       totalMemories: stats.totalCount,
       timestamp: new Date().toISOString(),
     });
@@ -625,12 +647,17 @@ async function handleHealth(): Promise<Response> {
 // Server
 // ============================================================================
 
-const port = clampInt(process.env.RECALLNEST_API_PORT, 4318, 1, 65535);
+const port = clampInt(envConfig.apiPortRaw(), 4318, 1, 65535);
 
 const server = Bun.serve({
   port,
-  hostname: "127.0.0.1",
+  hostname: LOCAL_HTTP_HOSTNAME,
   async fetch(request) {
+    const policy = await enforceLocalHttpRequestPolicy(request);
+    if (!policy.allowed) {
+      return errorResponse(policy.status, policy.message);
+    }
+
     const url = new URL(request.url);
     const { pathname } = url;
     const method = request.method;

package/src/audit-log.ts

@@ -7,6 +7,7 @@
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import * as envConfig from "./env-config.js";
 
 export type AuditOperation =
   | "store"
@@ -17,7 +18,8 @@ export type AuditOperation =
   | "supersede"
   | "consolidate"
   | "forget"
-  | "cascade_forget";
+  | "cascade_forget"
+  | "reject";
 
 export interface AuditEntry {
   timestamp: string; // ISO 8601
@@ -59,7 +61,7 @@ function parseLines(raw: string): AuditEntry[] {
 export function createAuditLogger(logPath?: string): AuditLogger {
   const resolvedPath =
     logPath ??
-    join(process.env.RECALLNEST_DATA_DIR || "data", "audit.jsonl");
+    join(envConfig.dataDir(), "audit.jsonl");
 
   // Ensure directory exists (silent on failure)
   try {

package/src/auto-consolidation.ts

@@ -10,7 +10,8 @@
  * reason is operational hygiene.
  */
 
-import type { MemoryStore } from "./store.js";
+import type { MemoryEntry } from "./store.js";
+import type { MemoryStorePort } from "./memory-store-port.js";
 import { ConsolidationEngine, type ConsolidationConfig, type ConsolidationResult, DEFAULT_CONSOLIDATION_CONFIG } from "./consolidation-engine.js";
 import type { LLMClient } from "./llm-client.js";
 import { isLLMConsolidationEnabled, evaluateCluster, executeMergeDecisions } from "./llm-consolidation.js";
@@ -54,16 +55,20 @@ export interface AutoConsolidationResult {
 /**
  * Check conditions and run consolidation if thresholds are met.
  * Returns immediately if conditions not met (no-op).
+ *
+ * @deprecated Prefer dream-pipeline.ts for full maintenance. This module is
+ * kept for compatibility with callers that only need count/time-gated
+ * consolidation.
  */
 export async function maybeConsolidate(
-  store: MemoryStore,
+  store: MemoryStorePort,
   scope: string,
   config: AutoConsolidationConfig = DEFAULT_AUTO_CONSOLIDATION_CONFIG,
   /** Tier 3.7: Optional LLM client for semantic consolidation decisions */
   llm?: LLMClient | null,
 ): Promise<AutoConsolidationResult> {
   const stats = await store.stats([scope]);
-  const currentCount = stats.total ?? 0;
+  const currentCount = stats.totalCount ?? 0;
 
   // Condition 1: enough new memories since last run
   const newSinceLastRun = currentCount - lastRunMemoryCount;