switchroom 0.19.2 → 0.19.3

package/vendor/hindsight-memory/scripts/recall.py

@@ -43,8 +43,10 @@ import hashlib
 import json
 import os
 import re
+import socket
 import sys
 import time
+import urllib.error
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
@@ -52,19 +54,32 @@ from lib.bank import derive_bank_id, ensure_bank_mission
 from lib.client import HindsightClient
 from lib.config import debug_log, load_config
 from lib.content import (
+    _extract_text_content,
     compose_recall_query,
     format_current_time,
     format_memories,
+    strip_channel_envelope,
+    strip_memory_tags,
     truncate_recall_query,
 )
 from lib.daemon import get_api_url
-from lib.directives import fetch_active_directives, format_active_directives_block
+from lib.directives import (
+    DIRECTIVES_CACHE_TTL_SECONDS,
+    fetch_active_directives_cached,
+    format_active_directives_block,
+)
 from lib.gateway_ipc import extract_chat_id_from_prompt, extract_topic_from_prompt, extract_user_from_prompt, update_placeholder
+from lib.parallel_recall import run_parallel
 from lib.state import read_state, write_state
 
 LAST_RECALL_STATE = "last_recall.json"
 RECALL_CACHE_STATE = "recall_cache.json"
 
+# Switchroom hindsight-leverage A3 — label for the directives fetch slot in the
+# parallel fan-out. Distinct from any bank_id (banks can't start with "__") so a
+# bank named "directives" never collides with the directives slot.
+DIRECTIVES_SLOT = "__directives__"
+
 # Switchroom #424 phase 4.1 — per-session recall cache.
 #
 # Caching is opt-in via env var: HINDSIGHT_RECALL_CACHE_TTL_SECS=N. Set N
@@ -173,6 +188,15 @@ def _summarise_source_topics(results: list) -> dict:
 # `switchroom memory recall-log <agent>`.
 RECALL_LOG_FILE = "recall_log.jsonl"
 RECALL_LOG_MAX_LINES = 5000
+# Honest per-line upper-bound estimate for the size-gated trim (hindsight-
+# leverage PR 1, review finding 5). The A3-telemetry row (bounded query
+# excerpt ≤200 chars + bank_timings + memory_ids) runs ~700-900 bytes worst
+# case; 1024 is a safe upper bound. The size gate only reads+trims the file
+# when it plausibly exceeds the line cap, so it must OVER-estimate row size
+# (threshold = cap × upper-bound) — otherwise a file over the old 250 B/line
+# threshold but still under the line cap triggers a full-file read on every
+# hook (critical-path thrash) that never actually trims.
+RECALL_LOG_BYTES_PER_LINE_EST = 1024
 
 
 def _cache_ttl_secs() -> int:
@@ -509,6 +533,124 @@ def _sort_by_final_score(results):
     return results
 
 
+def _is_timeout_error(exc: BaseException) -> bool:
+    """True if `exc` is (or wraps) a network read/connect timeout.
+
+    Switchroom A3 stage-1 telemetry (hindsight-leverage PR 1). The recall
+    HTTP path is `urllib.request.urlopen(..., timeout=8)`. On a hard timeout
+    urlopen raises either a bare ``socket.timeout`` / ``TimeoutError`` or a
+    ``urllib.error.URLError`` whose ``.reason`` is one of those. We classify
+    both so the per-bank ``timed_out`` flag (and the derived ``deadline_hit``)
+    distinguishes a bank that hit its deadline from one that failed fast
+    (5xx, connection refused, malformed response). Best-effort: anything we
+    can't positively identify as a timeout is treated as a non-timeout error.
+    """
+    if isinstance(exc, (socket.timeout, TimeoutError)):
+        return True
+
+    # An HTTP status response is NEVER a client-side read deadline, even when
+    # its body says "upstream timed out" / "gateway timeout" (502/504). Rule
+    # these out BEFORE the message sniff below (review finding 4), both when
+    # the HTTPError is raised directly and when lib.client wraps it as
+    # `RuntimeError(f"HTTP {code} from {url}: {body}")` — whose body can carry
+    # a proxy's "timed out" text and would otherwise be misclassified.
+    cause = getattr(exc, "__cause__", None)
+    if isinstance(exc, urllib.error.HTTPError) or isinstance(cause, urllib.error.HTTPError):
+        return False
+    if re.match(r"HTTP \d+ from ", str(exc)):
+        return False
+
+    # A non-HTTP URLError (DNS, connection, read timeout) — inspect the reason.
+    if isinstance(exc, urllib.error.URLError):
+        reason = getattr(exc, "reason", None)
+        if isinstance(reason, (socket.timeout, TimeoutError)):
+            return True
+        # Some stdlib versions stringify the timeout into the reason.
+        if isinstance(reason, str) and "timed out" in reason.lower():
+            return True
+
+    # Fall back to a message sniff for RuntimeError wrappers from lib.client
+    # (non-HTTP failures — the HTTP-wrapper shape was ruled out above).
+    return "timed out" in str(exc).lower()
+
+
+def _apply_tag_weights(results, tag_weights) -> int:
+    """Multiply each result's ``scores.final`` by a per-tag weight in place.
+
+    Switchroom hindsight-leverage PR5 — the recall-side counterpart to the
+    ``sidechain`` retain tag. A NEW mechanism, deliberately distinct from the
+    demote-tag DROP filter (`_is_demoted_memory`): that path removes a tagged
+    memory from recall entirely, which cannot express "keep it, but rank it
+    lower". This step DOWN-WEIGHTS a memory's engine relevance score so a
+    penalised memory sorts below an equal-scoring un-penalised one at the sort
+    below, yet is still returned when it is the only relevant hit (the cap sees
+    the full penalised set, not a filtered one).
+
+    ``tag_weights`` is a ``{tag: multiplier}`` map. For each result, the
+    multipliers of ALL its tags that appear in the map are multiplied together
+    and applied to ``scores.final`` (so a memory carrying two penalised tags is
+    penalised compoundly — intended). Tags are matched case-sensitively after
+    ``strip()`` (consistent with ``_is_demoted_memory``). Results whose
+    ``scores.final`` is absent or non-numeric are left untouched — a score-less
+    entry already sorts last and there is nothing to scale. A weight of exactly
+    1.0 (or a non-positive / non-numeric weight) is a no-op for that tag.
+
+    Returns the number of results whose score was actually changed (for the
+    debug log). Mutation is intentional: the effective (post-weight) score is
+    what the sort, the cap, and the recall-log ranking should all reflect.
+    """
+    if not isinstance(tag_weights, dict) or not tag_weights:
+        return 0
+    changed = 0
+    for m in results:
+        if not isinstance(m, dict):
+            continue
+        tags = m.get("tags")
+        if not isinstance(tags, list):
+            continue
+        factor = 1.0
+        for tag in tags:
+            if not isinstance(tag, str):
+                continue
+            w = tag_weights.get(tag.strip())
+            if isinstance(w, (int, float)) and not isinstance(w, bool) and w > 0:
+                factor *= float(w)
+        if factor == 1.0:
+            continue
+        scores = m.get("scores")
+        if not isinstance(scores, dict):
+            continue
+        val = scores.get("final")
+        if isinstance(val, (int, float)) and not isinstance(val, bool):
+            scores["final"] = float(val) * factor
+            changed += 1
+    return changed
+
+
+def _effective_tag_weights(config) -> dict:
+    """Merge the built-in lesson/anti-pattern demotion weights UNDER the operator's
+    ``recallTagWeights`` (switchroom E2 / PR9, #398).
+
+    The retain side (``detect_lesson_tags``) tags failure-mode-adjacent transcripts
+    ``lesson`` / ``anti-pattern``; this composes those tags into the same PR5
+    score-penalty map so they are DEMOTED out of the box. Precedence: an explicit
+    ``recallTagWeights`` entry WINS over the built-in for the same tag (operator
+    override), and the PR5 ``sidechain`` seed still composes cleanly since it lives
+    only in ``recallTagWeights``. When ``lessonDemotion`` is false the built-ins are
+    dropped entirely (rollback lever) and only ``recallTagWeights`` applies.
+    """
+    configured = config.get("recallTagWeights")
+    configured = configured if isinstance(configured, dict) else {}
+    if not config.get("lessonDemotion", True):
+        return configured
+    builtin = config.get("lessonDemotionWeights")
+    builtin = builtin if isinstance(builtin, dict) else {}
+    if not builtin:
+        return configured
+    # builtin first, operator override wins on key conflict.
+    return {**builtin, **configured}
+
+
 def _write_recall_log(entry: dict) -> None:
     """Append a JSONL line to recall_log.jsonl. Bounded by line count.
 
@@ -531,13 +673,15 @@ def _write_recall_log(entry: dict) -> None:
         # under the cap and the trim path is a no-op.
         with open(log_path, "a", encoding="utf-8") as f:
             f.write(line)
-        # Cheap rolling trim every ~50 writes (estimated by file size
-        # vs. 200 bytes/line average) to amortize the read cost.
+        # Size-gated trim: only pay the full-file read when the byte size
+        # says we plausibly exceed the line cap. The estimate is a per-line
+        # UPPER bound (see RECALL_LOG_BYTES_PER_LINE_EST) so we don't read on
+        # every hook once rows grew past the old 200 B/line assumption.
         try:
             size = os.path.getsize(log_path)
         except OSError:
             return
-        if size > RECALL_LOG_MAX_LINES * 250:
+        if size > RECALL_LOG_MAX_LINES * RECALL_LOG_BYTES_PER_LINE_EST:
             try:
                 with open(log_path, "r", encoding="utf-8") as f:
                     lines = f.readlines()
@@ -552,40 +696,213 @@ def _write_recall_log(entry: dict) -> None:
         pass
 
 
-def read_transcript_messages(transcript_path: str) -> list:
+def _read_transcript_lines(transcript_path: str, tail_bytes: int):
+    """Yield the transcript's trailing lines, byte-bounded.
+
+    Switchroom hindsight-leverage A2 (PR2): the latency bound for multi-turn
+    recall. When ``tail_bytes > 0`` we seek to ``EOF - tail_bytes`` and read
+    forward, discarding the first (possibly partial) line so every yielded line
+    is complete JSON. This caps the read+parse cost at O(tail_bytes) regardless
+    of how large the session ``.jsonl`` has grown — the last few human turns we
+    slice for context always live at the very tail. ``tail_bytes <= 0`` reads
+    the whole file (pre-A2 behaviour / rollback lever).
+
+    Reads bytes (not text) so the seek offset is exact; decodes with
+    ``errors="ignore"`` so a multi-byte character split by the tail boundary
+    can't crash the read (that byte lands in the discarded partial first line
+    anyway when the file exceeds the bound).
+    """
+    if tail_bytes and tail_bytes > 0:
+        size = os.path.getsize(transcript_path)
+        if size > tail_bytes:
+            with open(transcript_path, "rb") as f:
+                f.seek(size - tail_bytes)
+                chunk = f.read()
+            text = chunk.decode("utf-8", errors="ignore")
+            # Drop the first line — it may be a partial record from mid-file.
+            newline = text.find("\n")
+            if newline != -1:
+                text = text[newline + 1 :]
+            yield from text.splitlines()
+            return
+    with open(transcript_path, encoding="utf-8") as f:
+        yield from f
+
+
+def read_transcript_messages(transcript_path: str, tail_bytes: int = 0) -> list:
     """Read messages from a JSONL transcript file for multi-turn context.
 
     Claude Code transcript format nests messages:
       {type: "user", message: {role: "user", content: "..."}, uuid: "...", ...}
     Also supports flat format for testing:
       {role: "user", content: "..."}
+
+    ``tail_bytes`` (Switchroom A2) byte-bounds the read: when > 0 and the file
+    is larger, only the trailing ``tail_bytes`` (complete lines) are parsed, so
+    the added per-recall transcript read stays cheap on long sessions. 0 reads
+    the whole file. The #3369 grep fallback reuses this same tail-reader (see
+    ``_transcript_grep_fallback``) rather than shipping its own seek logic, so
+    there is a single byte-bounded transcript reader.
     """
     if not transcript_path or not os.path.isfile(transcript_path):
         return []
     messages = []
     try:
-        with open(transcript_path, encoding="utf-8") as f:
-            for line in f:
-                line = line.strip()
-                if not line:
-                    continue
-                try:
-                    entry = json.loads(line)
-                    # Claude Code nested format: {type: "user", message: {role, content}}
-                    if entry.get("type") in ("user", "assistant"):
-                        msg = entry.get("message", {})
-                        if isinstance(msg, dict) and msg.get("role"):
-                            messages.append(msg)
-                    # Flat format (testing / future compatibility)
-                    elif "role" in entry and "content" in entry:
-                        messages.append(entry)
-                except json.JSONDecodeError:
-                    continue
+        for line in _read_transcript_lines(transcript_path, tail_bytes):
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                entry = json.loads(line)
+                # Claude Code nested format: {type: "user", message: {role, content}}
+                if entry.get("type") in ("user", "assistant"):
+                    msg = entry.get("message", {})
+                    if isinstance(msg, dict) and msg.get("role"):
+                        messages.append(msg)
+                # Flat format (testing / future compatibility)
+                elif "role" in entry and "content" in entry:
+                    messages.append(entry)
+            except json.JSONDecodeError:
+                continue
     except OSError:
         pass
     return messages
 
 
+# Switchroom hindsight-leverage E1 / PR8 (#3369) — bounded transcript-grep
+# fallback telemetry shape. A zeroed record is the "did not fire" default,
+# emitted on the recall_log row whenever the fallback is gated off, skipped, or
+# produced no match — so the log schema is uniform and a downstream query can
+# always read `transcript_fallback` without a KeyError.
+_FALLBACK_TELEMETRY_ZERO = {
+    "fired": False,
+    "matched_turns": 0,
+    "chars": 0,
+    "elapsed_ms": 0,
+    "bytes_read": 0,
+    "truncated": False,
+}
+
+_FALLBACK_BLOCK_PREAMBLE = (
+    "No stored memories matched this query — the fact layer may not have "
+    "reconciled this session yet (e.g. an abrupt session death before boot "
+    "reconciliation). The following are VERBATIM excerpts from recent turns of "
+    "THIS session that mention related terms. Treat them as lower-confidence "
+    "than stored memory — they are raw transcript, not synthesized fact:"
+)
+
+
+def _transcript_grep_fallback(transcript_path, query, config):
+    """Bounded transcript-grep fallback for the empty-fact-layer window (#3369).
+
+    Reads the CURRENT session transcript's tail (bounded bytes), keeps the most
+    recent user/assistant turns whose terms lexically overlap the recall query,
+    and returns a clearly-labelled, size-bounded fallback context block plus a
+    telemetry dict. Every dimension is bounded: bytes read
+    (``recallTranscriptFallbackMaxBytes``), matched turns
+    (``recallTranscriptFallbackMaxTurns``), emitted characters
+    (``recallTranscriptFallbackMaxChars``), and grep wall-time
+    (``recallTranscriptFallbackDeadlineMs``). The caller only invokes this when
+    all banks returned zero AND no slot hit its deadline, so a timed-out bank can
+    never masquerade as a genuinely empty fact layer.
+
+    Returns ``(block_or_None, telemetry)``. Failure-safe: any error path returns
+    ``(None, zeroed-telemetry)`` so the fallback can never break recall.
+    """
+    telemetry = dict(_FALLBACK_TELEMETRY_ZERO)
+    start = time.monotonic()
+
+    if not transcript_path or not os.path.isfile(transcript_path):
+        return None, telemetry
+
+    def _int_cfg(key, default):
+        try:
+            val = int(config.get(key, default))
+        except (TypeError, ValueError):
+            return default
+        return val
+
+    max_bytes = _int_cfg("recallTranscriptFallbackMaxBytes", 262144)
+    max_turns = _int_cfg("recallTranscriptFallbackMaxTurns", 6)
+    max_chars = _int_cfg("recallTranscriptFallbackMaxChars", 2000)
+    deadline_ms = _int_cfg("recallTranscriptFallbackDeadlineMs", 1500)
+
+    if max_turns <= 0 or max_chars <= 0 or max_bytes <= 0:
+        return None, telemetry
+
+    query_tokens = _overlap_tokens(query)
+    if not query_tokens:
+        return None, telemetry
+
+    # TODO(consolidation, #3450 / epic #3430): two bounded transcript tail-readers now
+    # coexist post-merge — retain's, and recall's shared ``_read_transcript_lines``
+    # (#3443, which this #3369 fallback now reuses via ``read_transcript_messages``).
+    # They each re-implement "read the last N bytes of the session JSONL and parse
+    # turns". Consolidate onto a single shared bounded tail-reader helper. Tracked
+    # in follow-up #3450 (tied to epic #3430).
+    messages = read_transcript_messages(transcript_path, tail_bytes=max_bytes)
+
+    # Review finding — record bytes_read only AFTER the read succeeds, so a
+    # failed/partial read doesn't report bytes we never actually consumed.
+    try:
+        telemetry["bytes_read"] = min(os.path.getsize(transcript_path), max_bytes)
+    except OSError:
+        pass
+
+    matched = []
+    total_chars = 0
+    # Newest-first so, under the turn/char/time bounds, we keep the MOST RECENT
+    # relevant turns; the collected list is reversed back to chronological order
+    # before formatting.
+    for msg in reversed(messages):
+        if (time.monotonic() - start) * 1000.0 > deadline_ms:
+            telemetry["truncated"] = True
+            break
+        if not isinstance(msg, dict):
+            continue
+        role = msg.get("role")
+        if role not in ("user", "assistant"):
+            continue
+        text = _extract_text_content(msg.get("content", ""), role=role)
+        text = strip_memory_tags(strip_channel_envelope(text)).strip()
+        if not text:
+            continue
+        if not (_overlap_tokens(text) & query_tokens):
+            continue
+        entry = f"[{role}] {text}"
+        remaining = max_chars - total_chars
+        if remaining <= 0:
+            telemetry["truncated"] = True
+            break
+        if len(entry) > remaining:
+            # Review finding — reserve 1 char for the ellipsis so the emitted
+            # entry is EXACTLY `remaining` chars, not remaining+1 (the "…" is a
+            # single code point). Keeps the char budget an exact bound.
+            entry = entry[:remaining - 1].rstrip() + "…"
+            telemetry["truncated"] = True
+        matched.append(entry)
+        total_chars += len(entry)
+        if len(matched) >= max_turns:
+            break
+
+    telemetry["elapsed_ms"] = int((time.monotonic() - start) * 1000)
+
+    if not matched:
+        return None, telemetry
+
+    matched.reverse()  # restore chronological order for the model
+    block = (
+        "<hindsight_transcript_fallback>\n"
+        f"{_FALLBACK_BLOCK_PREAMBLE}\n\n"
+        + "\n".join(matched)
+        + "\n</hindsight_transcript_fallback>"
+    )
+    telemetry["fired"] = True
+    telemetry["matched_turns"] = len(matched)
+    telemetry["chars"] = len(block)
+    return block, telemetry
+
+
 # Switchroom Phase 6a — stateless-prompt classifier for the recall skip.
 # Returns True ONLY for prompts that provably never need user memory: the
 # current time/date/day, or a bare greeting. Biased hard toward False —
@@ -959,11 +1276,30 @@ def main():
                 "bank_id": bank_id,
                 "additional_banks": additional_banks,
                 "query_chars": len(prompt),
+                "query": None,  # no recall query composed on a cache hit
                 "result_count": None,  # not known on cache hit
                 "directive_count": None,
                 "demoted_count": 0,
                 "capped": False,
                 "cache_hit": True,
+                # A3 stage-1 telemetry keys kept present for a uniformly
+                # queryable schema; a cache hit issues no bank HTTP, so there
+                # is no per-bank timing and no deadline pressure to record.
+                # All are None/[] (NOT False) so a cache-hit row is never
+                # miscounted as an observed no-timeout recall in the breach
+                # baseline — `deadline_hit is False` means "banks ran, none
+                # timed out"; `deadline_hit is None` means "no banks ran"
+                # (review finding 3).
+                "total_elapsed_ms": None,
+                "directives_elapsed_ms": None,
+                "bank_timings": [],
+                "deadline_hit": None,
+                # A3 — no banks ran on a cache hit, so mode/deadline are null
+                # for a uniformly queryable schema (never "serial"/"parallel").
+                "recall_mode": None,
+                "deadline_budget_ms": None,
+                "deadline_effective_ms": None,
+                "directives_timed_out": None,
                 # PR6 — record the active topic on cache hits too so the
                 # log is uniformly queryable (cache_key now includes
                 # active_thread_id, so a hit means the prior recall was
@@ -972,10 +1308,30 @@ def main():
                 "active_topic_alias": active_topic_alias,
                 "topic_filter_mode": _topic_filter_mode(),
                 "directive_nudge": bool(nudge_block),
+                # E1 / PR8 (#3369) — no banks ran on a cache hit, so the
+                # transcript fallback never fires; carry the zeroed fields for a
+                # uniformly queryable schema.
+                "transcript_fallback": False,
+                "transcript_fallback_turns": 0,
+                "transcript_fallback_chars": 0,
+                "transcript_fallback_bytes_read": 0,
+                "transcript_fallback_elapsed_ms": 0,
+                "transcript_fallback_truncated": False,
+                # PR8 (#3369) — no banks ran on a cache hit, so no bank raised a
+                # hard error. None (NOT False) so a cache-hit row is never
+                # miscounted as an observed no-error recall — matching the
+                # deadline_hit / directives_timed_out convention above.
+                "bank_errored": None,
             })
             return
         debug_log(config, f"Recall cache MISS (key={cache_key[:12]}…)")
 
+    # Switchroom A3 stage-1 telemetry (hindsight-leverage PR 1). Wall-clock
+    # start for the recall critical path (mission ensure + transcript read +
+    # directives fetch + every bank recall). Feeds `total_elapsed_ms` in the
+    # log so a fresh pre-parallelism (pre-A3) breach baseline can accrue.
+    recall_start_monotonic = time.monotonic()
+
     # Set bank mission on first use
     ensure_bank_mission(client, bank_id, config, debug_fn=_dbg)
 
@@ -984,15 +1340,29 @@ def main():
     recall_max_query_chars = config.get("recallMaxQueryChars", 800)
     recall_roles = config.get("recallRoles", ["user", "assistant"])
 
+    # Switchroom A1 (hindsight-leverage PR 1) — strip the <channel …> transport
+    # envelope from the prompt ONCE, before both the single-turn and multi-turn
+    # branches, so ~100-200 chars of chat_id/ts/user XML noise never reach the
+    # embedding or consume the recallMaxQueryChars cap. `prompt` itself is left
+    # untouched (the ack/nudge gates and cache-hit log-length field still want
+    # the raw form); only the value fed to the recall query is stripped.
+    # compose_recall_query also strips its latest_query internally (defence in
+    # depth), but we strip here too so the single-turn path and
+    # truncate_recall_query's latest_query arg are both envelope-free.
+    recall_query_text = strip_channel_envelope(prompt)
+
     if recall_context_turns > 1:
         transcript_path = hook_input.get("transcript_path", "")
-        messages = read_transcript_messages(transcript_path)
+        # A2 latency bound: only parse the transcript tail (last N bytes) —
+        # the human turns we slice for context live at the end.
+        recall_transcript_tail_bytes = config.get("recallTranscriptTailBytes", 262144)
+        messages = read_transcript_messages(transcript_path, recall_transcript_tail_bytes)
         debug_log(config, f"Multi-turn context: {recall_context_turns} turns, {len(messages)} messages from transcript")
-        query = compose_recall_query(prompt, messages, recall_context_turns, recall_roles)
+        query = compose_recall_query(recall_query_text, messages, recall_context_turns, recall_roles)
     else:
-        query = prompt
+        query = recall_query_text
 
-    query = truncate_recall_query(query, prompt, recall_max_query_chars)
+    query = truncate_recall_query(query, recall_query_text, recall_max_query_chars)
 
     # Final defensive cap (mirrors Openclaw)
     if len(query) > recall_max_query_chars:
@@ -1005,58 +1375,71 @@ def main():
     # surfaced every turn). Workaround for upstream bug
     # vectorize-io/hindsight#1269 (tagged directives silently dropped from
     # `reflect`); `list_directives` itself works correctly upstream, so this
-    # is a pure client-side surface. fetch_active_directives is failure-safe
-    # and returns [] on any error.
-    directives = fetch_active_directives(client, bank_id)
-    directives_block = format_active_directives_block(directives) if directives else None
-    if directives_block:
-        debug_log(config, f"Injecting {len(directives)} active directives")
-
-    # Call Hindsight recall API
-    results = []
-    try:
-        response = client.recall(
-            bank_id=bank_id,
-            query=query,
-            max_tokens=config.get("recallMaxTokens", 1024),
-            budget=config.get("recallBudget", "mid"),
-            types=config.get("recallTypes"),
-            # Upstream 962140eef — optional tag filters (resolved above the
-            # cache check; part of the cache key).
-            tags=recall_tags,
-            tags_match=tags_match,
-            tag_groups=tag_groups,
-            # Switchroom Phase-1 precision — prefer deduped observation
-            # statements over the raw facts they supersede, backfilling freed
-            # slots for denser coverage inside the same budget. On by default;
-            # operators can pin off via `recallPreferObservations: false`.
-            prefer_observations=config.get("recallPreferObservations", True),
-            # 8s in-script timeout leaves 4s headroom inside the 12s
-            # UserPromptSubmit hook ceiling (see hooks.json:20) for cache
-            # write + block formatting. Tightened from 10s in switchroom
-            # v0.13.22: the 2026-05-24 audit showed 17-26% of turns
-            # breaching the 12s hook timeout on heavy agents (finn /
-            # gymbro / klanker), which dropped the recall entirely; an
-            # earlier-hard-timeout failure returns cleanly with no
-            # memories instead of blowing past the hook ceiling.
-            timeout=8,
+    # is a pure client-side surface. fetch_active_directives_cached is
+    # failure-safe and returns [] on any error.
+    #
+    # A4: cache the directives list with a short TTL (invalidated in-session by
+    # directive_verify.py on a directive write) so the common no-write turn
+    # skips the HTTP round-trip. TTL=0 disables the cache (live every turn).
+    #
+    # Switchroom hindsight-leverage A3 — the directives fetch and every bank
+    # recall run CONCURRENTLY (daemon threads) under ONE shared deadline instead
+    # of serially. Serially their latencies SUM (own bank + N extra banks +
+    # directives), and a heavy multi-bank agent can breach the 12s
+    # UserPromptSubmit ceiling — dropping recall for the turn. Parallel makes the
+    # critical path the SLOWEST slot, bounded by `recallParallelDeadlineSeconds`
+    # (the hook ceiling minus 2s headroom). A slot still running at the deadline
+    # is abandoned (daemon thread, reaped on process exit) and marked timed_out —
+    # a straggler bank can never push the hook past its ceiling.
+    # HINDSIGHT_RECALL_PARALLEL=false restores the serial path (rollback lever).
+    # The directives slot composes with the A4 cache: on a cache HIT it returns
+    # near-instantly with no HTTP, so directives_elapsed_ms reads ~0.
+
+    def _directives_task():
+        return fetch_active_directives_cached(
+            client,
+            bank_id,
+            ttl_seconds=config.get("directivesCacheTtlSeconds", DIRECTIVES_CACHE_TTL_SECONDS),
         )
-        results = response.get("results", [])
-    except Exception as e:
-        print(f"[Hindsight] Recall failed: {e}", file=sys.stderr)
-        # Fall through — we still want to emit the directives block if we
-        # have one, so a recall API failure doesn't blind the agent to
-        # its own active directives.
-
-    # Also recall from any additional banks (e.g. shared user profile bank).
-    # `additional_banks` was already extracted above the cache check so the
-    # cache key reflects every bank queried; reuse that local instead of
-    # re-reading config.
+
+    def _make_bank_task(target_bank_id, b_tags, b_tags_match, b_tag_groups):
+        def _bank_task():
+            return client.recall(
+                bank_id=target_bank_id,
+                query=query,
+                max_tokens=config.get("recallMaxTokens", 1024),
+                budget=config.get("recallBudget", "mid"),
+                types=config.get("recallTypes"),
+                # Upstream 962140eef — optional per-bank tag filters (resolved
+                # above the cache check; part of the cache key).
+                tags=b_tags,
+                tags_match=b_tags_match,
+                tag_groups=b_tag_groups,
+                # Switchroom Phase-1 precision — prefer deduped observation
+                # statements over the raw facts they supersede, backfilling freed
+                # slots for denser coverage inside the same budget. On by default;
+                # operators can pin off via `recallPreferObservations: false`.
+                prefer_observations=config.get("recallPreferObservations", True),
+                # 8s in-script per-request timeout: even parallelised, each bank
+                # carries its own hard deadline so a single hung bank returns
+                # cleanly with no memories rather than sitting on the shared
+                # deadline. Tightened from 10s in v0.13.22 (2026-05-24 breach
+                # audit); the shared deadline below is the outer ceiling guard.
+                timeout=8,
+            )
+        return _bank_task
+
+    # Resolve (bank_id, tags, tags_match, tag_groups) for every bank we query —
+    # own bank first, then each additional bank in config order. This order is
+    # preserved for bank_timings and the result-merge sequence regardless of
+    # thread completion order, so the emitted telemetry is deterministic.
+    # `additional_banks` was extracted above the cache check (so the cache key
+    # reflects every bank queried); reuse that local.
+    bank_specs = [(bank_id, recall_tags, tags_match, tag_groups)]
     for extra_bank_id in additional_banks:
-        # Upstream 962140eef — per-bank tag-filter overrides; fall back to
-        # the global filters when the bank has no entry. Applies uniformly
-        # to config-listed banks and sender banks appended by
-        # _resolve_sender_bank (both flow through `additional_banks`).
+        # Upstream 962140eef — per-bank tag-filter overrides; fall back to the
+        # global filters when the bank has no entry. Applies uniformly to
+        # config-listed banks and sender banks appended by _resolve_sender_bank.
         extra_filter = additional_bank_filters.get(extra_bank_id, {})
         if not isinstance(extra_filter, dict):
             extra_filter = {}
@@ -1066,36 +1449,154 @@ def main():
             "recallTagsMatch",
             tags_match if extra_tags or extra_tag_groups else None,
         )
-        try:
-            extra_response = client.recall(
-                bank_id=extra_bank_id,
-                query=query,
-                max_tokens=config.get("recallMaxTokens", 1024),
-                budget=config.get("recallBudget", "mid"),
-                types=config.get("recallTypes"),
-                tags=extra_tags,
-                tags_match=extra_tags_match,
-                tag_groups=extra_tag_groups,
-                # Switchroom Phase-1 precision — prefer deduped observation
-                # statements here too so additional banks contribute their
-                # densest statements to the merged, score-sorted set.
-                prefer_observations=config.get("recallPreferObservations", True),
-                # 8s in-script timeout leaves 4s headroom inside the 12s
-                # UserPromptSubmit hook ceiling (see hooks.json:20) for cache
-                # write + block formatting. Tightened from 10s in switchroom
-                # v0.13.22: the 2026-05-24 audit showed 17-26% of turns
-                # breaching the 12s hook timeout on heavy agents (finn /
-                # gymbro / klanker), which dropped the recall entirely; an
-                # earlier-hard-timeout failure returns cleanly with no
-                # memories instead of blowing past the hook ceiling.
-                timeout=8,
+        bank_specs.append((extra_bank_id, extra_tags, extra_tags_match, extra_tag_groups))
+
+    recall_parallel = bool(config.get("recallParallel", True))
+    try:
+        deadline_seconds = float(config.get("recallParallelDeadlineSeconds", 10))
+    except (TypeError, ValueError):
+        deadline_seconds = 10.0
+
+    directives = []
+    directives_timed_out = False
+    bank_timings = []
+    results = []
+
+    if recall_parallel:
+        recall_mode = "parallel"
+        deadline_budget_ms = int(deadline_seconds * 1000)
+        # The shared deadline is measured from recall_start_monotonic (the top
+        # of the critical path), so mission-ensure + transcript read already
+        # spent budget: subtract what elapsed so the remaining wait still
+        # respects the ceiling-minus-2s guarantee.
+        already_spent = time.monotonic() - recall_start_monotonic
+        remaining_deadline = max(0.0, deadline_seconds - already_spent)
+        # `deadline_budget_ms` is the CONFIGURED budget; the wait the slots
+        # actually get is `remaining_deadline` after pre-fan-out spend. Log both
+        # so the breach baseline can tell "configured" from "effectively granted".
+        deadline_effective_ms = int(remaining_deadline * 1000)
+
+        tasks = {DIRECTIVES_SLOT: _directives_task}
+        for spec in bank_specs:
+            tasks[spec[0]] = _make_bank_task(spec[0], spec[1], spec[2], spec[3])
+        outcomes = run_parallel(tasks, remaining_deadline)
+
+        # Directives slot. A slot that hit the deadline OR raised yields [] —
+        # the same failure-safe contract fetch_active_directives_cached honours.
+        d_outcome = outcomes[DIRECTIVES_SLOT]
+        directives_elapsed_ms = d_outcome.elapsed_ms if d_outcome.elapsed_ms is not None else 0
+        directives_timed_out = not d_outcome.completed
+        if d_outcome.completed and isinstance(d_outcome.value, list):
+            directives = d_outcome.value
+        elif directives_timed_out:
+            debug_log(config, "Directives slot hit the shared recall deadline")
+        elif d_outcome.error is not None:
+            debug_log(config, f"Directives fetch failed: {d_outcome.error}")
+
+        # Bank slots, own-bank first in config order. A bank is timed_out if it
+        # did not complete before the shared deadline OR completed by raising a
+        # hard timeout error (the finalized `deadline_hit` semantics — an
+        # abandoned straggler now counts, which the serial-era per-request-only
+        # flag could not express).
+        for spec in bank_specs:
+            b_id = spec[0]
+            b_outcome = outcomes[b_id]
+            b_timed_out = (not b_outcome.completed) or (
+                b_outcome.error is not None and _is_timeout_error(b_outcome.error)
             )
-            extra_results = extra_response.get("results", [])
-            if extra_results:
-                debug_log(config, f"Got {len(extra_results)} memories from additional bank '{extra_bank_id}'")
-                results = results + extra_results
-        except Exception as e:
-            debug_log(config, f"Recall from additional bank '{extra_bank_id}' failed: {e}")
+            # Switchroom review finding (PR8 gating hole) — a bank that raised a
+            # HARD (non-timeout) error: connection refused, 5xx, daemon down,
+            # malformed response. Distinct from `timed_out` so the transcript
+            # fallback can be suppressed on a genuine outage (the fact layer was
+            # unreachable, not "empty because nothing reconciled yet").
+            b_errored = b_outcome.error is not None and not _is_timeout_error(b_outcome.error)
+            if b_outcome.completed and b_outcome.error is None:
+                bank_results = (
+                    b_outcome.value.get("results", [])
+                    if isinstance(b_outcome.value, dict)
+                    else []
+                )
+                if bank_results:
+                    debug_log(config, f"Got {len(bank_results)} memories from bank '{b_id}'")
+                    results = results + bank_results
+            elif b_outcome.error is not None:
+                # Own bank failure surfaces on stderr (journald signal); extra
+                # banks are debug-only, matching the pre-A3 serial behaviour.
+                if b_id == bank_id:
+                    print(f"[Hindsight] Recall failed: {b_outcome.error}", file=sys.stderr)
+                else:
+                    debug_log(config, f"Recall from additional bank '{b_id}' failed: {b_outcome.error}")
+            elif not b_outcome.completed:
+                debug_log(config, f"Recall from bank '{b_id}' hit the shared deadline")
+            bank_timings.append({
+                "bank_id": b_id,
+                "elapsed_ms": b_outcome.elapsed_ms if b_outcome.elapsed_ms is not None else 0,
+                "timed_out": b_timed_out,
+                "errored": b_errored,
+            })
+    else:
+        # Pre-A3 serial path (rollback lever, HINDSIGHT_RECALL_PARALLEL=false).
+        # Directives first, then each bank in turn — total latency is the SUM of
+        # the round-trips. Behaviourally equivalent to the pre-parallelism path
+        # (log rows stay comparable), NOT byte-for-byte: this path emits an extra
+        # own-bank debug line, logs the directives block after the bank loop
+        # rather than before, and __main__ still os._exit(0)s on completion.
+        recall_mode = "serial"
+        deadline_budget_ms = None
+        deadline_effective_ms = None
+        _directives_start = time.monotonic()
+        directives = fetch_active_directives_cached(
+            client,
+            bank_id,
+            ttl_seconds=config.get("directivesCacheTtlSeconds", DIRECTIVES_CACHE_TTL_SECONDS),
+        )
+        directives_elapsed_ms = int((time.monotonic() - _directives_start) * 1000)
+        for spec in bank_specs:
+            b_id, b_tags, b_tags_match, b_tag_groups = spec
+            _bank_start = time.monotonic()
+            _bank_timed_out = False
+            _bank_errored = False
+            try:
+                response = _make_bank_task(b_id, b_tags, b_tags_match, b_tag_groups)()
+                bank_results = response.get("results", []) if isinstance(response, dict) else []
+                if bank_results:
+                    debug_log(config, f"Got {len(bank_results)} memories from bank '{b_id}'")
+                    results = results + bank_results
+            except Exception as e:
+                _bank_timed_out = _is_timeout_error(e)
+                # Non-timeout error → hard outage (see parallel-path note above).
+                _bank_errored = not _bank_timed_out
+                if b_id == bank_id:
+                    print(f"[Hindsight] Recall failed: {e}", file=sys.stderr)
+                else:
+                    debug_log(config, f"Recall from additional bank '{b_id}' failed: {e}")
+            bank_timings.append({
+                "bank_id": b_id,
+                "elapsed_ms": int((time.monotonic() - _bank_start) * 1000),
+                "timed_out": _bank_timed_out,
+                "errored": _bank_errored,
+            })
+
+    # Switchroom hindsight-leverage A3 — FINALIZED `deadline_hit`: True when ANY
+    # slot on the critical path hit its deadline (a bank that raised a hard
+    # per-request timeout, or — parallel mode — a bank/directives slot abandoned
+    # at the shared deadline). Hoisted here (was inline in the recall_log write)
+    # so the E1 / PR8 transcript fallback can gate on it: the #3369 fallback must
+    # NOT fire when a bank timed out, only when the fact layer is genuinely empty.
+    deadline_hit = any(bt["timed_out"] for bt in bank_timings) or directives_timed_out
+
+    # Switchroom review finding (PR8 gating hole) — True when ANY bank raised a
+    # HARD (non-timeout) error. A connection-refused / 5xx / daemon-down outage
+    # contributes zero results with `deadline_hit` False, which would otherwise
+    # let the empty-fact-layer transcript fallback fire on every turn for the
+    # whole outage — mislabelling "fact layer unreachable" as "nothing
+    # reconciled yet" and flooding telemetry. Gated on below so the fallback
+    # only fires when all banks genuinely returned zero: no timeout AND no error.
+    bank_errored = any(bt.get("errored") for bt in bank_timings)
+
+    directives_block = format_active_directives_block(directives) if directives else None
+    if directives_block:
+        debug_log(config, f"Injecting {len(directives)} active directives")
 
     # Switchroom #432 phase 4.4 — drop demote-tagged memories before
     # the cap. Filtering early means the cap kicks in over the
@@ -1148,6 +1649,17 @@ def main():
     else:
         overlap_dropped = 0
 
+    # Switchroom hindsight-leverage PR5 — per-tag score penalty. Applied
+    # IMMEDIATELY before the relevance sort so a down-weighted tag (e.g.
+    # `sidechain: 0.8`) reorders the merged set without dropping anything. This
+    # is the "reduced weight" the demote-tag DROP filter above cannot express:
+    # a penalised memory ranks below equal-scoring untagged memories yet still
+    # survives the cap when it is the only relevant hit. See _apply_tag_weights.
+    tag_weights = _effective_tag_weights(config)
+    weighted = _apply_tag_weights(results, tag_weights)
+    if weighted > 0:
+        debug_log(config, f"Applied recallTagWeights to {weighted} memories: {tag_weights}")
+
     # Switchroom Phase-1 precision — sort the merged primary + additional-bank
     # result set by the engine's relevance score (`scores.final`) descending
     # BEFORE the head-slice cap below. Previously additional-bank results were
@@ -1216,6 +1728,47 @@ def main():
     else:
         debug_log(config, "No memories found")
 
+    # Switchroom hindsight-leverage E1 / PR8 (#3369) — bounded transcript-grep
+    # fallback. Fires ONLY when every bank returned zero results (pre_filter_count
+    # == 0 — the merged pre-demote bank count) AND no slot hit its deadline
+    # (deadline_hit False, so a timed-out bank can't masquerade as an empty fact
+    # layer — the #3369 sequencing constraint on A3's telemetry) AND no bank
+    # raised a hard error (bank_errored False, so a connection-refused / 5xx /
+    # daemon-down outage can't masquerade as an empty fact layer either — the
+    # PR8 gating-hole fix). This recovers
+    # the crash-loss window between an abrupt session death and the next boot
+    # reconciliation, where live recall would otherwise return nothing for the
+    # lost turns. Everything is bounded inside the helper (bytes/turns/chars/time).
+    # On by default; HINDSIGHT_RECALL_TRANSCRIPT_FALLBACK=false is the rollback
+    # lever. Mutually exclusive with memories_block by construction: a non-empty
+    # memories_block requires results, which requires pre_filter_count > 0.
+    transcript_fallback_block = None
+    transcript_fallback_telemetry = dict(_FALLBACK_TELEMETRY_ZERO)
+    if (
+        config.get("recallTranscriptFallback", True)
+        and pre_filter_count == 0
+        and not deadline_hit
+        and not bank_errored
+    ):
+        transcript_fallback_block, transcript_fallback_telemetry = _transcript_grep_fallback(
+            hook_input.get("transcript_path", ""),
+            query,
+            config,
+        )
+        if transcript_fallback_block:
+            debug_log(
+                config,
+                f"Transcript-grep fallback fired: {transcript_fallback_telemetry}",
+            )
+    elif pre_filter_count == 0 and bank_errored:
+        # Suppressed: a bank outage (hard error), not a genuinely empty fact
+        # layer. Logged so the gate decision is visible during an outage.
+        debug_log(
+            config,
+            "Transcript-grep fallback suppressed: bank_errored (hard bank error, "
+            "not an empty fact layer)",
+        )
+
     # Switchroom #303 — recall is done, model is about to start the long
     # TTFT. Update the placeholder so the user doesn't keep staring at
     # `📚 recalling memories` for the next 15–20 s of opus thinking.
@@ -1224,22 +1777,134 @@ def main():
     if placeholder_chat_id:
         update_placeholder(placeholder_chat_id, "💭 thinking")
 
+    # Switchroom #432 phase 4.3 — telemetry log. memory IDs (when
+    # available) let an operator confirm what was injected on a given turn.
+    # Failure-tolerant.
+    #
+    # Hoisted ABOVE the empty-block early-return (hindsight-leverage PR 1,
+    # review finding 1): a turn where every bank times out AND directives
+    # fail produces no directives_block and no memories_block — precisely the
+    # breach event the A3 baseline counts. Logging here (not after the return)
+    # guarantees every cache-MISS recall attempt records bank_timings /
+    # deadline_hit / total_elapsed_ms.
+    #
+    # NOTE on the PR-3 baseline denominator (review finding 2): a hook the
+    # Claude Code UserPromptSubmit ceiling *kills* mid-flight (sequential
+    # worst case ~18s > the 12s ceiling) never reaches this line, so a true
+    # ceiling breach manifests as a MISSING row, not a logged one. The
+    # baseline method is therefore two-signal: (a) ceiling-breach (total-drop)
+    # rate = recall-log rows-missing vs the UserPromptSubmit turn count over
+    # the window; (b) `deadline_hit` here = per-bank hard-timeout among the
+    # hooks that survived long enough to log. Neither number alone is the
+    # breach rate; PR 3's before/after must cite both.
+    _write_recall_log({
+        "ts": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        "session_id": (session_id or "")[:32],
+        "bank_id": bank_id,
+        "additional_banks": additional_banks,
+        "query_chars": len(query),
+        # Switchroom A1 (hindsight-leverage PR 1) — a BOUNDED excerpt (≤200
+        # chars, review finding 5) of the envelope-stripped, truncated query
+        # actually sent to recall. Enough to assert no `<channel` substring
+        # reaches the embedding and to pair queries with hits (D2) without
+        # bloating each row (which would thrash the size-based trim below).
+        # `query_chars` above carries the full untruncated length.
+        "query": query[:200],
+        "result_count": len(results),
+        "directive_count": len(directives),
+        "demoted_count": demoted_count,
+        "overlap_dropped": overlap_dropped,
+        "capped": capped,
+        "pre_cap_count": pre_cap_count,
+        "memory_ids": [
+            m.get("id") for m in results
+            if isinstance(m, dict) and m.get("id")
+        ],
+        "cache_hit": False,
+        # Switchroom A3 stage-1 telemetry (hindsight-leverage PR 1) — per-bank
+        # latency + timeout breakdown, directives-fetch latency, total
+        # critical-path wall time, and a derived `deadline_hit` (any bank hit
+        # its hard per-request timeout). Accrues the fresh pre-A3 baseline the
+        # parallelism change measures against; the 17-26% figure it replaces is
+        # the stale 2026-05-24 pre-fix audit.
+        "total_elapsed_ms": int((time.monotonic() - recall_start_monotonic) * 1000),
+        "directives_elapsed_ms": directives_elapsed_ms,
+        "bank_timings": bank_timings,
+        # Switchroom hindsight-leverage A3 — FINALIZED `deadline_hit` semantics
+        # (PR 1 shipped the interim per-bank-only form pending this PR). It is
+        # now True when ANY slot on the critical path hit its deadline: a bank
+        # that raised a hard per-request timeout OR (parallel mode) a bank/
+        # directives slot abandoned when the shared deadline elapsed. In serial
+        # (rollback) mode `directives_timed_out` is always False and each bank's
+        # `timed_out` is per-request only, so this reduces to the pre-A3 form —
+        # keeping the two modes' rows directly comparable in the breach baseline.
+        "deadline_hit": deadline_hit,
+        # Switchroom review finding (PR8 gating hole) — True when any bank raised
+        # a hard (non-timeout) error this turn. Gates the transcript fallback
+        # (suppressed on a real outage) and makes the outage visible per-row so a
+        # spike in empty-result turns can be attributed to unreachable banks
+        # rather than a genuinely empty fact layer.
+        "bank_errored": bank_errored,
+        # A3 — recall execution mode ("parallel"/"serial") and the shared
+        # deadline budget (ms; None in serial mode). These distinguish pre-A3
+        # (serial) from post-A3 (parallel) rows so the ≥3-day breach baseline
+        # can segment by mode without guessing from timing.
+        "recall_mode": recall_mode,
+        "deadline_budget_ms": deadline_budget_ms,
+        # A3 — effective deadline actually granted to the slots after pre-fan-out
+        # spend (mission-ensure + transcript read). `deadline_budget_ms` is the
+        # configured ceiling; this is the smaller wait the slots really got.
+        # None in serial mode and on cache hits (no fan-out).
+        "deadline_effective_ms": deadline_effective_ms,
+        "directives_timed_out": directives_timed_out,
+        # PR6 — instrumentation for binding-failure analysis.
+        # `active_thread_id`: the current prompt's topic (null on
+        # DM / fleet-shared). `source_topics`: distribution of
+        # source thread_ids in the recall set (before optional
+        # hard-filter). `topic_filter_mode`: "soft-preamble" or
+        # "hard-filter". `topic_dropped`: count dropped by hard
+        # filter. From these fields we can derive the cross-topic
+        # recall rate over time and decide whether to flip to
+        # hard-filter mode based on real data.
+        "active_thread_id": active_thread_id,
+        "active_topic_alias": active_topic_alias,
+        "source_topics": source_topic_summary,
+        "topic_filter_mode": topic_filter_mode,
+        "topic_dropped": topic_dropped,
+        "directive_nudge": bool(nudge_block),
+        # Switchroom hindsight-leverage E1 / PR8 (#3369) — transcript-grep
+        # fallback telemetry so its firing (and its bounds) are visible per turn
+        # in recall_log.jsonl. `transcript_fallback` True only on an all-zero,
+        # no-deadline-hit turn where the grep found ≥1 matching session turn.
+        "transcript_fallback": transcript_fallback_telemetry["fired"],
+        "transcript_fallback_turns": transcript_fallback_telemetry["matched_turns"],
+        "transcript_fallback_chars": transcript_fallback_telemetry["chars"],
+        "transcript_fallback_bytes_read": transcript_fallback_telemetry["bytes_read"],
+        "transcript_fallback_elapsed_ms": transcript_fallback_telemetry["elapsed_ms"],
+        "transcript_fallback_truncated": transcript_fallback_telemetry["truncated"],
+    })
+
     # If neither block has content, there's nothing to inject — exit
     # silently to avoid emitting an empty hookSpecificOutput. #2848: unless
     # the directive-capture nudge fired, in which case emit the nudge alone
     # (a correction with no memories/directives still needs the reminder).
-    if not directives_block and not memories_block:
+    if not directives_block and not memories_block and not transcript_fallback_block:
         if nudge_block:
             _emit_cached_context(nudge_block)
         return
 
     # Compose final context. Directives block goes ABOVE memories so the
-    # agent reads HARD RULES before low-signal recall traces.
+    # agent reads HARD RULES before low-signal recall traces. The E1/PR8
+    # transcript fallback (#3369) goes LAST — it is the lowest-confidence
+    # signal (raw transcript, not synthesized fact) and only present when
+    # memories_block is empty by construction.
     parts = []
     if directives_block:
         parts.append(directives_block)
     if memories_block:
         parts.append(memories_block)
+    if transcript_fallback_block:
+        parts.append(transcript_fallback_block)
     context_message = "\n\n".join(parts)
 
     # Save last recall to state for diagnostics
@@ -1262,42 +1927,8 @@ def main():
         except Exception as e:
             debug_log(config, f"Recall cache write failed (non-fatal): {e}")
 
-    # Switchroom #432 phase 4.3 — telemetry log. memory IDs (when
-    # available) let an operator confirm what was injected on a given
-    # turn. Failure-tolerant.
-    _write_recall_log({
-        "ts": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-        "session_id": (session_id or "")[:32],
-        "bank_id": bank_id,
-        "additional_banks": additional_banks,
-        "query_chars": len(query),
-        "result_count": len(results),
-        "directive_count": len(directives),
-        "demoted_count": demoted_count,
-        "overlap_dropped": overlap_dropped,
-        "capped": capped,
-        "pre_cap_count": pre_cap_count,
-        "memory_ids": [
-            m.get("id") for m in results
-            if isinstance(m, dict) and m.get("id")
-        ],
-        "cache_hit": False,
-        # PR6 — instrumentation for binding-failure analysis.
-        # `active_thread_id`: the current prompt's topic (null on
-        # DM / fleet-shared). `source_topics`: distribution of
-        # source thread_ids in the recall set (before optional
-        # hard-filter). `topic_filter_mode`: "soft-preamble" or
-        # "hard-filter". `topic_dropped`: count dropped by hard
-        # filter. From these fields we can derive the cross-topic
-        # recall rate over time and decide whether to flip to
-        # hard-filter mode based on real data.
-        "active_thread_id": active_thread_id,
-        "active_topic_alias": active_topic_alias,
-        "source_topics": source_topic_summary,
-        "topic_filter_mode": topic_filter_mode,
-        "topic_dropped": topic_dropped,
-        "directive_nudge": bool(nudge_block),
-    })
+    # (Telemetry log already written above, before the empty-block return, so
+    # total-failure turns are recorded — hindsight-leverage PR 1 finding 1.)
 
     # Output JSON for Claude Code hook system. #2848: append the
     # directive-capture nudge (if it fired) at emit time — it's kept out of
@@ -1396,6 +2027,21 @@ def _record_issue_safely(detail: str, class_name: str) -> None:
 if __name__ == "__main__":
     try:
         main()
+        # Switchroom hindsight-leverage A3 — hard, immediate process exit.
+        #
+        # The parallel recall path spawns daemon threads. Daemon threads already
+        # do not block a normal interpreter shutdown, but two things still can:
+        # (a) a non-daemon thread a client library might spawn, and (b) atexit /
+        # interpreter-shutdown thread-join bookkeeping. A straggler bank still
+        # blocked on an 8s socket read must NEVER hold the UserPromptSubmit hook
+        # open past its 12s ceiling. os._exit skips all of that and returns
+        # control to Claude Code immediately — but it also skips stdout buffer
+        # flushing, so flush FIRST or the hookSpecificOutput JSON is lost.
+        try:
+            sys.stdout.flush()
+        except Exception:
+            pass
+        os._exit(0)
     except Exception as e:
         # Switchroom #1070 (redo per #1085 review).
         #