switchroom 0.19.23 → 0.19.24

package/dist/vault/approvals/kernel-server.js

@@ -4377,17 +4377,19 @@ var init_schema = __esm(() => {
     model: exports_external.string().min(1).optional().describe("Per-op model (upstream `HINDSIGHT_API_<OP>_LLM_MODEL`). Absent → " + "inherit the global `hindsight.llm.model`."),
     provider: exports_external.string().min(1).optional().describe("Per-op provider (upstream `HINDSIGHT_API_<OP>_LLM_PROVIDER`). " + "Absent → inherit the global `hindsight.llm.provider`."),
     base_url: exports_external.string().min(1).optional().describe("Per-op base URL (upstream `HINDSIGHT_API_<OP>_LLM_BASE_URL`). " + "Optional passthrough; absent → inherit the global."),
-    api_key: exports_external.string().min(1).optional().describe("Per-op API key (upstream `HINDSIGHT_API_<OP>_LLM_API_KEY`). Literal " + "or `vault:` reference. Optional passthrough; absent → inherit global.")
+    api_key: exports_external.string().min(1).optional().describe("Per-op API key (upstream `HINDSIGHT_API_<OP>_LLM_API_KEY`). Literal " + "or `vault:` reference. Optional passthrough; absent → inherit global."),
+    context_window: exports_external.number().int().positive().optional().describe("Context window (tokens) of the backend serving THIS op. NOT an " + "upstream env var — switchroom derives the op's token budget " + "(consolidation batch size / max-completion caps / reflect " + "max-context cap) from it so a single call can never overflow the " + "window. Absent → inherit " + "`hindsight.llm.context_window`, else a per-provider default " + "(conservative for non-`claude-code` providers, which usually mean " + "a local llama.cpp/Ollama slot; a self-hosted `base_url` — loopback, " + "RFC1918, `.local`/`.internal` — forces the conservative default too, " + "regardless of the provider NAME, since the endpoint is where the " + "traffic actually terminates). All three lanes (`retain`, " + "`reflect`, `consolidation`) are budgeted independently.")
   }).describe("Per-operation LLM override. Every field optional; an unset field (or " + "an omitted op block) inherits the global `hindsight.llm.*`, which is " + "already the engine's fallback — switchroom emits only the vars set.");
   HindsightConfigSchema = exports_external.object({
     llm: exports_external.object({
       provider: exports_external.string().min(1).optional().describe("Hindsight LLM provider (upstream `HINDSIGHT_API_LLM_PROVIDER`). " + "Defaults to `claude-code` (subscription-honest, broker-fed OAuth). " + "Any litellm-routable provider the upstream image supports is valid. " + "Serves as the GLOBAL default for every op absent a per-op override."),
       model: exports_external.string().min(1).optional().describe("Hindsight LLM model (upstream `HINDSIGHT_API_LLM_MODEL`). Defaults " + "to HINDSIGHT_DEFAULT_MODEL. Any model your LiteLLM proxy can route " + "is valid, e.g. `openrouter/z-ai/glm-5.2` when routing through the " + "fleet proxy. With provider=claude-code this value is ALSO exported " + "as `ANTHROPIC_MODEL` to the claude subprocess. Serves as the GLOBAL " + "default for every op absent a per-op override."),
+      context_window: exports_external.number().int().positive().optional().describe("GLOBAL context window (tokens) of the backend serving hindsight's " + "LLM ops — the declared size switchroom derives every token budget " + "from. Set this to the real window of whatever you point " + "`hindsight.llm` at (e.g. 32768 for a llama.cpp slot launched with " + "`-c 65536 -np 2`, 131072 for a large-window OpenRouter model). " + "Absent → a per-provider default: 200000 for `claude-code`, a " + "conservative 32768 for everything else. Overflowing a local " + "backend's window does NOT error — llama.cpp context-shift silently " + "drops the system prompt and the model answers conversationally " + "with HTTP 200 — so this value is what makes the failure " + "detectable at setup time instead of never."),
       retain: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `retain` LLM op (memory ingestion). Emits " + "`HINDSIGHT_API_RETAIN_LLM_*`. Absent → uses the global model/provider."),
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "LLM_MAX_CONCURRENT, RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -19202,6 +19204,10 @@ var HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4;
 var HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT = 1;
 var HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true";
+var HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128;
+var HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true";
+var HINDSIGHT_DEFAULT_LLM_MAX_RETRIES = 2;
+var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2;
 var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
   [
     "HINDSIGHT_API_RECALL_MAX_CANDIDATES_PER_SOURCE",
@@ -19215,10 +19221,18 @@ var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
     "HINDSIGHT_API_LINK_EXPANSION_TIMEOUT",
     String(HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S)
   ],
-  ["HINDSIGHT_API_LLM_REASONING_EFFORT", HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT]
+  ["HINDSIGHT_API_LLM_REASONING_EFFORT", HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT],
+  [
+    "HINDSIGHT_API_CONSOLIDATION_LLM_PARALLELISM",
+    String(HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM)
+  ]
 ];
 var HINDSIGHT_PERF_DEFAULTS_GPU = [
-  ["HINDSIGHT_API_RERANKER_LOCAL_FP16", HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16]
+  ["HINDSIGHT_API_RERANKER_LOCAL_FP16", HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16],
+  [
+    "HINDSIGHT_API_RERANKER_LOCAL_BATCH_SIZE",
+    String(HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE)
+  ]
 ];
 var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
   ["HINDSIGHT_API_LLM_MAX_CONCURRENT", String(HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT)],
@@ -19229,13 +19243,21 @@ var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
   [
     "HINDSIGHT_API_CONSOLIDATION_LLM_MAX_CONCURRENT",
     String(HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT)
-  ]
+  ],
+  ["HINDSIGHT_API_LLM_STRICT_SCHEMA", HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA],
+  ["HINDSIGHT_API_LLM_MAX_RETRIES", String(HINDSIGHT_DEFAULT_LLM_MAX_RETRIES)]
 ];
+var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
+  "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY"
+]);
 var HINDSIGHT_PERF_ENV_KEYS = new Set([
-  ...HINDSIGHT_PERF_DEFAULTS_UNGATED,
-  ...HINDSIGHT_PERF_DEFAULTS_GPU,
-  ...HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM
-].map(([k]) => k));
+  ...[
+    ...HINDSIGHT_PERF_DEFAULTS_UNGATED,
+    ...HINDSIGHT_PERF_DEFAULTS_GPU,
+    ...HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM
+  ].map(([k]) => k),
+  ...HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS
+]);
 
 // src/setup/hindsight-pg-defaults.ts
 var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION = 8 * 1024;
@@ -19258,6 +19280,10 @@ var HINDSIGHT_PG_DEFAULTS = [
 ];
 var HINDSIGHT_PG_ENV_KEYS = new Set(HINDSIGHT_PG_DEFAULTS.map(([k]) => k));
 
+// src/setup/hindsight-context-budget.ts
+var HINDSIGHT_UPSTREAM_RETAIN_CHUNK_SIZE = 3000;
+var HINDSIGHT_RETAIN_MAX_COMPLETION_FLOOR = HINDSIGHT_UPSTREAM_RETAIN_CHUNK_SIZE + 72;
+
 // src/setup/hindsight.ts
 var HINDSIGHT_DEFAULT_API_PORT = 18888;
 var HINDSIGHT_DEFAULT_MCP_URL = `http://127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}/mcp/`;

package/dist/vault/broker/server.js

@@ -4377,17 +4377,19 @@ var init_schema = __esm(() => {
     model: exports_external.string().min(1).optional().describe("Per-op model (upstream `HINDSIGHT_API_<OP>_LLM_MODEL`). Absent → " + "inherit the global `hindsight.llm.model`."),
     provider: exports_external.string().min(1).optional().describe("Per-op provider (upstream `HINDSIGHT_API_<OP>_LLM_PROVIDER`). " + "Absent → inherit the global `hindsight.llm.provider`."),
     base_url: exports_external.string().min(1).optional().describe("Per-op base URL (upstream `HINDSIGHT_API_<OP>_LLM_BASE_URL`). " + "Optional passthrough; absent → inherit the global."),
-    api_key: exports_external.string().min(1).optional().describe("Per-op API key (upstream `HINDSIGHT_API_<OP>_LLM_API_KEY`). Literal " + "or `vault:` reference. Optional passthrough; absent → inherit global.")
+    api_key: exports_external.string().min(1).optional().describe("Per-op API key (upstream `HINDSIGHT_API_<OP>_LLM_API_KEY`). Literal " + "or `vault:` reference. Optional passthrough; absent → inherit global."),
+    context_window: exports_external.number().int().positive().optional().describe("Context window (tokens) of the backend serving THIS op. NOT an " + "upstream env var — switchroom derives the op's token budget " + "(consolidation batch size / max-completion caps / reflect " + "max-context cap) from it so a single call can never overflow the " + "window. Absent → inherit " + "`hindsight.llm.context_window`, else a per-provider default " + "(conservative for non-`claude-code` providers, which usually mean " + "a local llama.cpp/Ollama slot; a self-hosted `base_url` — loopback, " + "RFC1918, `.local`/`.internal` — forces the conservative default too, " + "regardless of the provider NAME, since the endpoint is where the " + "traffic actually terminates). All three lanes (`retain`, " + "`reflect`, `consolidation`) are budgeted independently.")
   }).describe("Per-operation LLM override. Every field optional; an unset field (or " + "an omitted op block) inherits the global `hindsight.llm.*`, which is " + "already the engine's fallback — switchroom emits only the vars set.");
   HindsightConfigSchema = exports_external.object({
     llm: exports_external.object({
       provider: exports_external.string().min(1).optional().describe("Hindsight LLM provider (upstream `HINDSIGHT_API_LLM_PROVIDER`). " + "Defaults to `claude-code` (subscription-honest, broker-fed OAuth). " + "Any litellm-routable provider the upstream image supports is valid. " + "Serves as the GLOBAL default for every op absent a per-op override."),
       model: exports_external.string().min(1).optional().describe("Hindsight LLM model (upstream `HINDSIGHT_API_LLM_MODEL`). Defaults " + "to HINDSIGHT_DEFAULT_MODEL. Any model your LiteLLM proxy can route " + "is valid, e.g. `openrouter/z-ai/glm-5.2` when routing through the " + "fleet proxy. With provider=claude-code this value is ALSO exported " + "as `ANTHROPIC_MODEL` to the claude subprocess. Serves as the GLOBAL " + "default for every op absent a per-op override."),
+      context_window: exports_external.number().int().positive().optional().describe("GLOBAL context window (tokens) of the backend serving hindsight's " + "LLM ops — the declared size switchroom derives every token budget " + "from. Set this to the real window of whatever you point " + "`hindsight.llm` at (e.g. 32768 for a llama.cpp slot launched with " + "`-c 65536 -np 2`, 131072 for a large-window OpenRouter model). " + "Absent → a per-provider default: 200000 for `claude-code`, a " + "conservative 32768 for everything else. Overflowing a local " + "backend's window does NOT error — llama.cpp context-shift silently " + "drops the system prompt and the model answers conversationally " + "with HTTP 200 — so this value is what makes the failure " + "detectable at setup time instead of never."),
       retain: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `retain` LLM op (memory ingestion). Emits " + "`HINDSIGHT_API_RETAIN_LLM_*`. Absent → uses the global model/provider."),
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "LLM_MAX_CONCURRENT, RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -18875,6 +18877,10 @@ var HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4;
 var HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT = 1;
 var HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true";
+var HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128;
+var HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true";
+var HINDSIGHT_DEFAULT_LLM_MAX_RETRIES = 2;
+var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2;
 var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
   [
     "HINDSIGHT_API_RECALL_MAX_CANDIDATES_PER_SOURCE",
@@ -18888,10 +18894,18 @@ var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
     "HINDSIGHT_API_LINK_EXPANSION_TIMEOUT",
     String(HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S)
   ],
-  ["HINDSIGHT_API_LLM_REASONING_EFFORT", HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT]
+  ["HINDSIGHT_API_LLM_REASONING_EFFORT", HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT],
+  [
+    "HINDSIGHT_API_CONSOLIDATION_LLM_PARALLELISM",
+    String(HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM)
+  ]
 ];
 var HINDSIGHT_PERF_DEFAULTS_GPU = [
-  ["HINDSIGHT_API_RERANKER_LOCAL_FP16", HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16]
+  ["HINDSIGHT_API_RERANKER_LOCAL_FP16", HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16],
+  [
+    "HINDSIGHT_API_RERANKER_LOCAL_BATCH_SIZE",
+    String(HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE)
+  ]
 ];
 var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
   ["HINDSIGHT_API_LLM_MAX_CONCURRENT", String(HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT)],
@@ -18902,13 +18916,21 @@ var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
   [
     "HINDSIGHT_API_CONSOLIDATION_LLM_MAX_CONCURRENT",
     String(HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT)
-  ]
+  ],
+  ["HINDSIGHT_API_LLM_STRICT_SCHEMA", HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA],
+  ["HINDSIGHT_API_LLM_MAX_RETRIES", String(HINDSIGHT_DEFAULT_LLM_MAX_RETRIES)]
 ];
+var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
+  "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY"
+]);
 var HINDSIGHT_PERF_ENV_KEYS = new Set([
-  ...HINDSIGHT_PERF_DEFAULTS_UNGATED,
-  ...HINDSIGHT_PERF_DEFAULTS_GPU,
-  ...HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM
-].map(([k]) => k));
+  ...[
+    ...HINDSIGHT_PERF_DEFAULTS_UNGATED,
+    ...HINDSIGHT_PERF_DEFAULTS_GPU,
+    ...HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM
+  ].map(([k]) => k),
+  ...HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS
+]);
 
 // src/setup/hindsight-pg-defaults.ts
 var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION = 8 * 1024;
@@ -18931,6 +18953,10 @@ var HINDSIGHT_PG_DEFAULTS = [
 ];
 var HINDSIGHT_PG_ENV_KEYS = new Set(HINDSIGHT_PG_DEFAULTS.map(([k]) => k));
 
+// src/setup/hindsight-context-budget.ts
+var HINDSIGHT_UPSTREAM_RETAIN_CHUNK_SIZE = 3000;
+var HINDSIGHT_RETAIN_MAX_COMPLETION_FLOOR = HINDSIGHT_UPSTREAM_RETAIN_CHUNK_SIZE + 72;
+
 // src/setup/hindsight.ts
 var HINDSIGHT_DEFAULT_API_PORT = 18888;
 var HINDSIGHT_DEFAULT_MCP_URL = `http://127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}/mcp/`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.19.23",
+  "version": "0.19.24",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_shared/dev-protocol.md.hbs

@@ -1,15 +1,14 @@
 ## Development Protocol
 
-Judgement criteria for substantive coding, infra, or debugging work. The long-form playbook — task classification, design-report shape, adversarial-review dispatch, re-review verdict format — is the bundled `dev-protocol` skill; load it before starting.
+Judgement criteria for substantive coding, infra, or debugging work.
 
 This governs HOW delegated work is done, and is **not a license to do it inline**: dispatch first (see Delegation), then these bind the worker.
 
 - **Orient before you build — validate, don't assume.** Root-cause in real source — the repo's files at HEAD, not `dist/`, caches, or generated output. If the evidence contradicts your theory, the plan, or the task description, report the contradiction rather than force-fitting it. Cite `file:line`, commits, PRs.
 - **Infer before you ask.** Most questions are answerable from the code and history. If genuinely unsure, ask ONE question at a time, during planning; act autonomously during execution — make the reasonable call and note the assumption.
 - **Design report before implementation, when the change is large.** Architecturally significant, cross-cutting, or ambiguous-approach work earns an evidence-grounded design report and a red-team pass before code, and ships as focused single-concern PRs.
-- **Branch off fresh main. Scoped tests + lint locally; CI is the full-suite authority. Merge only on CI green.**
+- **Run `git fetch origin` first, then branch off `origin/main`.** Never branch off the working copy as-is: you do not start in the repo you are coding in, and the checkout on disk may be many commits stale. Scoped tests + lint locally; CI is the full-suite authority.
 - **Adversarial review of the diff.** Read every change as an adversary would: what breaks, what's untested, what's inconsistent.
-- **Blockers and mediums block the merge; lows don't** — fix a low inline if it's a one-liner, else file a follow-up issue and merge. Filing is mandatory.
-- **Re-review only a behavioural fix** — a docs/comment/log/test-only commit doesn't earn one. Prefix a fix commit `review-fix:`; two rounds is the cap, and CI enforces it.
+- **Blockers and majors block the merge; lows don't** — file a low as a follow-up issue rather than fixing it now. Filing is mandatory. Fix what blocks, then merge on CI green. Do not count review rounds and do not run a mandatory re-review pass: verifying your own fix is part of making it, not a separate step.
 - **Durable fixes over hack patches. Deterministic mechanisms over model-dependent behaviour** — if code can enforce a guarantee, don't leave it to prompt discipline. **Tests assert outcomes, not just code paths:** one that wouldn't fail on the bug it guards is not a test.
 - **Communicate as you go.** Consolidated messages — one substantive update beats five fragments; never go dark; no foreground watch over 30 seconds (background it); max 15 parallel sub-agents.

package/skills/dev-protocol/SKILL.md

@@ -80,29 +80,36 @@ fixing lows produces a new diff, and a new diff earned another re-review. It
 produced PRs going four rounds where the last round's only finding was an
 inaccurate doc comment. So:
 
-- **Blockers and mediums block the merge.** Fix them.
-- **Lows do NOT block.** Fix a low inline only if it's a genuine one-liner;
-  otherwise **file a follow-up issue and merge**. Filing is mandatory — an
-  unfiled low is a dropped bug, and there is no human team to catch it later.
-- **A re-review is earned only by a behavioural fix.** A docs-, comment-,
-  log-, or test-only fix commit does not earn another pass.
-- **Two rounds is the cap.** Prefix every commit answering a review round
-  `review-fix:` — `scripts/check-review-rounds.mjs` counts them and the
-  `review-rounds` check fails past two, unless a `review-cap-override` label
-  is on the PR.
+- **Blockers and majors block the merge.** Fix them.
+- **Lows do NOT block.** File a low as a follow-up issue rather than fixing it
+  now. Filing is mandatory — an unfiled low is a dropped bug, and there is no
+  human team to catch it later.
+- **Fix what blocks, then merge on CI green.**
+- **Do not count review rounds, and do not run a mandatory re-review pass.**
+  Verifying your own fix is part of making it, not a separate step. Counting
+  rounds was itself a loop driver: it made the review process the subject of
+  the work instead of the change.
 
 If a finding is genuinely invalid, rebut it with evidence in writing; silence
 is not a rebuttal.
 
-When you do re-review, the verdict states per original finding: the finding
-ID, what changed (`file:line` of the fix), whether it fully resolves the
-finding (`RESOLVED` / `PARTIAL` / `REBUTTED` with evidence), and whether the
-fix introduced anything new. A bare "fixed" is not a verdict.
-
 ## 5. Non-obvious pipeline rules
 
 - **CI is the full-suite authority.** Local scoped tests are a fast filter,
   never the merge evidence. Never claim done off a local run alone.
+- **`main` is behind a merge queue: `gh pr merge` ENQUEUES, it does not
+  merge.** The command exits 0 and the PR stays `OPEN`. The queue then re-runs
+  all seven required contexts on its own `gh-readonly-queue/main/pr-<n>-<sha>`
+  ref before landing anything, so "green on the PR" is necessary but not
+  sufficient. Never report a PR merged off that exit code — poll until its
+  state is `MERGED` and the commit is an ancestor of `origin/main`. Two flags
+  to know: `--delete-branch` is **rejected outright** while the queue is on
+  (delete the branch after it lands), and `--subject` is ignored, since the
+  queue composes the merge commit from the PR title plus `(#<pr>)` — so the PR
+  title is the commit title, write it accordingly. An entry stuck in
+  `AWAITING_CHECKS` means a required workflow is not listening for
+  `merge_group`; `.github/MERGE-QUEUE.md` owns that failure mode and the
+  invariants that prevent it.
 - **A test that wouldn't fail on the bug it guards is not a test.** Assert the
   observable outcome, not that the code path executed.
 - **Prefer a deterministic mechanism over prompt discipline.** If a check, a

package/skills/switchroom-release/SKILL.md

@@ -100,7 +100,8 @@ The tag push triggers `docker-images` and `release`. `release` internally waits
 
 ### Gate B — the release pipeline (`release.yml`)
 - `gh run list --workflow=release.yml --limit 1` — wait for `completed` / `success`. Expect ~25-30 minutes: four native build legs plus the wait on `docker-images`.
-- Its jobs, in order: `guard` (release exists + held out of `latest`) → `build` ×4 → `bundle` → `publish` (attach) → `images-gate` (wait on docker-images) → `npm` → `finalize` (un-draft). A red job anywhere leaves the release a **draft** and npm **unpublished** — which is the correct, recoverable state.
+- Its jobs, in order: `guard` (release exists + held out of `latest`) → `build` ×4 → `bundle` → `publish` (attach) → `images-gate` (wait on docker-images) → `npm` → `finalize` (un-draft) → `images-latest` (promote `:vX.Y.Z` → `:latest`). A red job anywhere leaves the release a **draft** and npm **unpublished** — which is the correct, recoverable state.
+- `images-latest` is why a tag push no longer moves the `:latest` image tag by itself (#3685). If that last job is the one that failed, every other leg shipped and only the image tag lags: re-run it with `gh workflow run promote.yml -f from=vX.Y.Z -f to=latest`. Don't roll the fleet off `:latest` until it is green — `docker manifest inspect ghcr.io/switchroom/switchroom-agent:latest` should report the same digest as `:vX.Y.Z`.
 - Verify the release page actually has assets **and is no longer a draft**:
   ```bash
   gh release view vX.Y.Z -R switchroom/switchroom --json isDraft,assets \