switchroom 0.19.42 → 0.19.44

package/dist/vault/approvals/kernel-server.js

@@ -4434,7 +4434,7 @@ var init_observation_scopes = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -4551,6 +4551,7 @@ var init_schema = __esm(() => {
   }).optional();
   ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Operator PIN for the per-row observation scope, overriding the " + 'default `curated` strategy (see docs/configuration.md). "shared" ' + "forces Hindsight's consolidation to write EVERY observation into ONE " + "global untagged scope — what several agents pooling one bank want so " + "their observations merge rather than sitting in parallel silos. " + '"combined" is the pin form of opting out (restores the pre-#4035 ' + "engine default). UNSET does NOT mean 'nothing on the wire': the " + "`curated` strategy still computes a scope per retain. Applies to " + "every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
   ObservationScopeStrategySchema = exports_external.enum(OBSERVATION_SCOPE_STRATEGIES).optional().describe("Per-retain strategy that decides how the observation scope is " + 'computed when no `observation_scopes` pin is set. "curated" ' + "(the default since #4035) strips volatile per-session provenance " + "tags from each retain's consolidation scope — keeping the stable " + "semantic ones on the source fact — so an agent's observations dedup " + "and merge across sessions instead of pocketing one-per-session. " + '"shared" sends every retain to the one global untagged scope. ' + '"combined" / "off" opt OUT: no per-row scope goes on the wire, ' + "restoring the pre-feature engine default (byte-identical to an " + "unconfigured client). OMITTED BY DEFAULT: unset leaves the plugin's " + "own default (`curated`) in force. A manual `observation_scopes` pin " + "wins over this strategy. Accepted values: " + `${OBSERVATION_SCOPE_STRATEGIES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
+  AntiConfabulationDirectiveSchema = exports_external.union([exports_external.boolean(), exports_external.string().min(1)]).optional().describe("The seeded anti-confabulation directive: reflect has no relevance " + "floor (`min_scores` is a /recall-only parameter), so a bank holding " + "nothing relevant still yields a confident answer, and a question that " + "presupposes a decision reliably produces one. Directives ARE applied " + "during reflect, so this is the lever. Unset or true (the default) " + "seeds and maintains switchroom's own text; false disables seeding and " + "leaves any existing directive untouched; a string is operator-authored " + "text that wins outright. Switchroom only ever upgrades directive text " + "byte-equal to a default it shipped, so editing the directive in the " + "bank is also a permanent override. " + "Cascade: override (per-agent wins over default).");
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
@@ -4586,6 +4587,7 @@ var init_schema = __esm(() => {
       empathy: exports_external.number().int().min(1).max(5).optional().describe("How much the bank weights emotional/relational context (1-5; engine default 3).")
     }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis — a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
     directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true — Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never …", "from now on …", ' + `"stop doing …", a stated preference, "that's wrong, it's …") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex — the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
+    anti_confabulation_directive: AntiConfabulationDirectiveSchema,
     observation_scopes: ObservationScopesSchema,
     observation_scope_strategy: ObservationScopeStrategySchema,
     recall: exports_external.object({
@@ -4856,7 +4858,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_MAX_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_MAX_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_MAX_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -4990,6 +4992,7 @@ var init_schema = __esm(() => {
       isolation: exports_external.enum(["default", "strict"]).optional(),
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
+      anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,
       recall: exports_external.object({
@@ -12763,8 +12766,8 @@ var require_dist = __commonJS((exports) => {
 });
 
 // src/config/paths.ts
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 function home() {
   return process.env.HOME ?? "/root";
 }
@@ -12779,12 +12782,12 @@ function resolveDualPath(pathStr) {
   const h = home();
   if (pathStr.startsWith("~/")) {
     const rest = pathStr.slice(2);
-    const absolute = resolve(h, rest);
+    const absolute = resolve2(h, rest);
     if (rest.startsWith(`${DEFAULT_STATE_DIR}/`)) {
       const frag = rest.slice(DEFAULT_STATE_DIR.length + 1);
-      if (!existsSync(absolute)) {
-        const legacy = resolve(h, LEGACY_STATE_DIR, frag);
-        if (existsSync(legacy)) {
+      if (!existsSync2(absolute)) {
+        const legacy = resolve2(h, LEGACY_STATE_DIR, frag);
+        if (existsSync2(legacy)) {
           warnLegacyStateOnce(legacy);
           return legacy;
         }
@@ -12792,7 +12795,7 @@ function resolveDualPath(pathStr) {
     }
     return absolute;
   }
-  return resolve(pathStr);
+  return resolve2(pathStr);
 }
 var DEFAULT_STATE_DIR = ".switchroom", LEGACY_STATE_DIR = ".clerk", _legacyStateWarned = false;
 var init_paths = () => {};
@@ -12809,8 +12812,8 @@ var init_overlay_schema = __esm(() => {
 });
 
 // src/config/overlay-loader.ts
-import { existsSync as existsSync2, readFileSync, readdirSync, statSync } from "node:fs";
-import { basename, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
+import { basename, resolve as resolve3 } from "node:path";
 function deriveOverlayTitle(raw, fileName) {
   const titleFromComment = raw.match(/^#[^\S\n]*name:[^\S\n]*(\S.*?)[^\S\n]*$/m)?.[1];
   if (titleFromComment)
@@ -12822,10 +12825,10 @@ function deriveOverlayTitle(raw, fileName) {
 }
 function overlayDirFor(agentName, subdir) {
   const base = resolveDualPath(`~/.switchroom/agents/${agentName}/${subdir}`);
-  return resolve2(base);
+  return resolve3(base);
 }
 function listYamlFiles(dir) {
-  if (!existsSync2(dir))
+  if (!existsSync3(dir))
     return [];
   let entries;
   try {
@@ -12837,7 +12840,7 @@ function listYamlFiles(dir) {
   for (const name of entries) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = resolve2(dir, name);
+    const full = resolve3(dir, name);
     try {
       if (statSync(full).isFile())
         out.push(full);
@@ -12873,7 +12876,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
           try {
-            const raw = readFileSync(file, "utf-8");
+            const raw = readFileSync2(file, "utf-8");
             const parsed = import_yaml.parse(raw);
             const doc = OverlayDocSchema.parse(parsed);
             const title = deriveOverlayTitle(raw, basename(file));
@@ -12914,7 +12917,7 @@ function applyAgentOverlays(config) {
         const seen = new Set(merged);
         for (const file of skillFiles) {
           try {
-            const raw = readFileSync(file, "utf-8");
+            const raw = readFileSync2(file, "utf-8");
             const parsed = import_yaml.parse(raw);
             const doc = OverlayDocSchema.parse(parsed);
             for (const skillName of doc.skills ?? []) {
@@ -12989,9 +12992,9 @@ __export(exports_loader, {
   findConfigFile: () => findConfigFile,
   ConfigError: () => ConfigError
 });
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "node:fs";
 import { homedir } from "node:os";
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 function formatZodErrors(error) {
   return error.errors.map((e) => {
     const path = e.path.join(".");
@@ -13039,24 +13042,24 @@ function coerceLegacyGoogleWorkspaceKeys(parsed, filePath) {
 function findConfigFile(startDir) {
   const envPath = process.env.SWITCHROOM_CONFIG;
   const home2 = homedir();
-  const userDir = resolve3(home2, ".switchroom");
+  const userDir = resolve4(home2, ".switchroom");
   const searchPaths = [
-    envPath ? resolve3(envPath) : null,
-    startDir ? resolve3(startDir, "switchroom.yaml") : null,
-    startDir ? resolve3(startDir, "switchroom.yml") : null,
-    startDir ? resolve3(startDir, "clerk.yaml") : null,
-    startDir ? resolve3(startDir, "clerk.yml") : null,
-    resolve3(process.cwd(), "switchroom.yaml"),
-    resolve3(process.cwd(), "switchroom.yml"),
-    resolve3(process.cwd(), "clerk.yaml"),
-    resolve3(process.cwd(), "clerk.yml"),
-    resolve3(userDir, "switchroom.yaml"),
-    resolve3(userDir, "switchroom.yml"),
-    resolve3(userDir, "clerk.yaml"),
-    resolve3(userDir, "clerk.yml")
+    envPath ? resolve4(envPath) : null,
+    startDir ? resolve4(startDir, "switchroom.yaml") : null,
+    startDir ? resolve4(startDir, "switchroom.yml") : null,
+    startDir ? resolve4(startDir, "clerk.yaml") : null,
+    startDir ? resolve4(startDir, "clerk.yml") : null,
+    resolve4(process.cwd(), "switchroom.yaml"),
+    resolve4(process.cwd(), "switchroom.yml"),
+    resolve4(process.cwd(), "clerk.yaml"),
+    resolve4(process.cwd(), "clerk.yml"),
+    resolve4(userDir, "switchroom.yaml"),
+    resolve4(userDir, "switchroom.yml"),
+    resolve4(userDir, "clerk.yaml"),
+    resolve4(userDir, "clerk.yml")
   ].filter(Boolean);
   for (const path of searchPaths) {
-    if (existsSync3(path)) {
+    if (existsSync4(path)) {
       return path;
     }
   }
@@ -13064,12 +13067,12 @@ function findConfigFile(startDir) {
 }
 function loadConfig(configPath) {
   const filePath = configPath ?? findConfigFile();
-  if (!existsSync3(filePath)) {
+  if (!existsSync4(filePath)) {
     throw new ConfigError(`Config file not found: ${filePath}`);
   }
   let raw;
   try {
-    raw = readFileSync2(filePath, "utf-8");
+    raw = readFileSync3(filePath, "utf-8");
   } catch (err) {
     throw new ConfigError(`Failed to read config file: ${filePath}`, [
       `  ${err.message}`
@@ -18783,7 +18786,7 @@ var init_resolver = __esm(() => {
 // src/vault/approvals/kernel-server.ts
 init_protocol();
 import * as net from "node:net";
-import { mkdirSync as mkdirSync2, chmodSync, chownSync, existsSync as existsSync5, unlinkSync, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
+import { mkdirSync as mkdirSync2, chmodSync, chownSync, existsSync as existsSync6, unlinkSync, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
 import { dirname as dirname2, resolve as resolve6, basename as basename2 } from "node:path";
 import { Database } from "bun:sqlite";
 
@@ -19221,9 +19224,66 @@ function getNonce(db, request_id) {
 init_schema();
 
 // src/agents/scaffold.ts
-import { dirname, isAbsolute, join as join4, relative, resolve as resolve5 } from "node:path";
 init_atomic();
 
+// src/util/shipped-assets.ts
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+var FHS_SHARE_ROOTS = [
+  "/usr/local/share/switchroom",
+  "/usr/share/switchroom"
+];
+var PROFILES_ASSET = {
+  asset: "profiles",
+  envVar: "SWITCHROOM_PROFILES_ROOT"
+};
+function orderedCandidates(spec, probe) {
+  const out = [];
+  const push = (path, source) => {
+    if (!out.some((c) => c.path === path))
+      out.push({ path, source });
+  };
+  if (probe.bundleDir) {
+    push(resolve(probe.bundleDir, "../..", spec.asset), "npm");
+    push(resolve(probe.bundleDir, spec.asset), "image");
+  }
+  if (probe.execPath) {
+    push(resolve(dirname(probe.execPath), "../share/switchroom", spec.asset), "sea-sibling");
+  }
+  for (const root of FHS_SHARE_ROOTS) {
+    push(resolve(root, spec.asset), "fhs");
+  }
+  return out;
+}
+function resolveShippedAsset(spec, probe) {
+  const env = probe.env ?? process.env;
+  const override = env[spec.envVar]?.trim();
+  if (override) {
+    const path = canonicalise(resolve(override), probe);
+    return { path, candidates: [path], source: "env" };
+  }
+  const exists = probe.exists ?? existsSync;
+  const candidates = orderedCandidates(spec, probe);
+  for (const c of candidates) {
+    if (exists(c.path)) {
+      return {
+        path: canonicalise(c.path, probe),
+        candidates: candidates.map((x) => x.path),
+        source: c.source
+      };
+    }
+  }
+  return { path: null, candidates: candidates.map((x) => x.path), source: "none" };
+}
+function canonicalise(path, probe) {
+  const realpath = probe.realpath ?? realpathSync;
+  try {
+    return realpath(path);
+  } catch {
+    return path;
+  }
+}
+
 // src/agents/agent-uid.ts
 init_peercred();
 import { createHash } from "node:crypto";
@@ -19282,37 +19342,29 @@ var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
 
 // src/agents/profiles.ts
 var import_handlebars = __toESM(require_lib(), 1);
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
-import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
-function resolveProfilesRoot() {
-  const envOverride = process.env.SWITCHROOM_PROFILES_ROOT?.trim();
-  if (envOverride) {
-    return resolve4(envOverride);
-  }
-  const candidates = [
-    resolve4(import.meta.dirname, "../../profiles"),
-    resolve4(import.meta.dirname, "profiles")
-  ];
-  for (const candidate of candidates) {
-    if (existsSync4(candidate)) {
-      return candidate;
-    }
-  }
-  return candidates[0];
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync as realpathSync2 } from "node:fs";
+import { resolve as resolve5, join as join2, sep as pathSep } from "node:path";
+function resolveProfilesRootDetailed() {
+  return resolveShippedAsset(PROFILES_ASSET, {
+    bundleDir: import.meta.dirname,
+    execPath: process.execPath
+  });
 }
-var PROFILES_ROOT = resolveProfilesRoot();
+var PROFILES_RESOLUTION = resolveProfilesRootDetailed();
+var PROFILES_ROOT = PROFILES_RESOLUTION.path ?? PROFILES_RESOLUTION.candidates[0];
+var PROFILES_ROOT_SEARCH = PROFILES_RESOLUTION.candidates;
 import_handlebars.default.registerHelper("json", (value) => {
   return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
 });
 import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
-var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
+var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
 var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
-  if (existsSync4(fragPath)) {
-    import_handlebars.default.registerPartial(name, readFileSync3(fragPath, "utf-8"));
+  if (existsSync5(fragPath)) {
+    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
   }
 }
 
@@ -19413,7 +19465,9 @@ var HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8;
 var HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 250;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_SLOT_LIMIT = 6;
-var HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1;
+var HINDSIGHT_DEFAULT_CONSOLIDATION_RESERVED_SLOTS = 1;
+var HINDSIGHT_DEFAULT_GRAPH_SEED_MIN_SIMILARITY = 0.3;
+var HINDSIGHT_DEFAULT_LLM_SUPPORTS_MAX_ITEMS = "false";
 var HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION = "exponential";
 var HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS = 30;
 var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
@@ -19459,8 +19513,8 @@ var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
     String(HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S)
   ],
   [
-    "HINDSIGHT_API_WORKER_CONSOLIDATION_MAX_SLOTS",
-    String(HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS)
+    "HINDSIGHT_API_WORKER_CONSOLIDATION_RESERVED_SLOTS",
+    String(HINDSIGHT_DEFAULT_CONSOLIDATION_RESERVED_SLOTS)
   ],
   [
     "HINDSIGHT_API_WORKER_CONSOLIDATION_SLOT_LIMIT",
@@ -19477,6 +19531,10 @@ var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
   [
     "HINDSIGHT_API_RECENCY_DECAY_HALFLIFE_DAYS",
     String(HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS)
+  ],
+  [
+    "HINDSIGHT_API_GRAPH_SEED_MIN_SIMILARITY",
+    String(HINDSIGHT_DEFAULT_GRAPH_SEED_MIN_SIMILARITY)
   ]
 ];
 var HINDSIGHT_PERF_DEFAULTS_GPU = [
@@ -19497,22 +19555,42 @@ var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
     String(HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT)
   ],
   ["HINDSIGHT_API_LLM_STRICT_SCHEMA", HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA],
-  ["HINDSIGHT_API_LLM_MAX_RETRIES", String(HINDSIGHT_DEFAULT_LLM_MAX_RETRIES)]
+  ["HINDSIGHT_API_LLM_MAX_RETRIES", String(HINDSIGHT_DEFAULT_LLM_MAX_RETRIES)],
+  ["HINDSIGHT_API_LLM_SUPPORTS_MAX_ITEMS", HINDSIGHT_DEFAULT_LLM_SUPPORTS_MAX_ITEMS]
 ];
 var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY",
   "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP",
   "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS",
   "HINDSIGHT_API_WORKER_MAX_SLOTS",
-  "HINDSIGHT_API_WORKER_RETAIN_MAX_SLOTS"
+  "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS",
+  "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY",
+  "HINDSIGHT_MCP_RECALL_BUDGET_MODE",
+  "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT",
+  "HINDSIGHT_API_RETAIN_WALL_TIMEOUT",
+  "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT"
 ]);
+var HINDSIGHT_WORKER_SLOT_TYPES = [
+  "consolidation",
+  "file_convert_retain",
+  "graph_maintenance",
+  "import_documents",
+  "refresh_mental_model",
+  "retain"
+];
+var HINDSIGHT_WORKER_RESERVED_SLOT_ALIASES = new Map(HINDSIGHT_WORKER_SLOT_TYPES.map((type) => [
+  `HINDSIGHT_API_WORKER_${type.toUpperCase()}_MAX_SLOTS`,
+  `HINDSIGHT_API_WORKER_${type.toUpperCase()}_RESERVED_SLOTS`
+]));
 var HINDSIGHT_PERF_ENV_KEYS = new Set([
   ...[
     ...HINDSIGHT_PERF_DEFAULTS_UNGATED,
     ...HINDSIGHT_PERF_DEFAULTS_GPU,
     ...HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM
   ].map(([k]) => k),
-  ...HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS
+  ...HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS,
+  ...HINDSIGHT_WORKER_RESERVED_SLOT_ALIASES.keys(),
+  ...HINDSIGHT_WORKER_RESERVED_SLOT_ALIASES.values()
 ]);
 
 // src/setup/hindsight-context-budget.ts
@@ -19585,6 +19663,15 @@ var DEFAULT_RETAIN_MISSION = `Extract durable facts that will still be true and
 ` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
 ` + `  system's self-reports are not memories.
 ` + `- Restatements of the user's current request or the task in progress.
+` + `- The assistant's own answers, summaries, recaps, or reflect output. Before
+` + `  extracting, ask: does anything in this transcript support this claim OTHER
+` + `  than the assistant having asserted it? If not, drop it — a model's own
+` + `  synthesis re-extracted as a fact is how a guess becomes permanent.
+` + `  Concretely, never produce a fact whose only support is the assistant
+` + `  stating a date, a version, an attribution, a total, or a decision that the
+` + `  user never confirmed and no tool output shows. An unverified claim recalls
+` + `  later as though it had been established, which is worse than not
+` + `  remembering it at all.
 ` + `- Volatile state written as a timeless assertion. A version, count, size,
 ` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
 ` + `  claim is true only at the instant it was said. Concretely, never produce a
@@ -19740,6 +19827,64 @@ var SUPERSEDED_RETAIN_MISSIONS = [
 ` + `
 ` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
 ` + `nothing durable remains, return an empty facts list.
+`,
+  `Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.
+` + `
+` + `DURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:
+` + `- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.
+` + `- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.
+` + `- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.
+` + `- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.
+` + `- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.
+` + `If a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.
+` + `
+` + `A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it — it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- The act of delegating, dispatching, spawning, launching, steering or merging
+` + `  work — including when it succeeded. "X was dispatched and completed" is the
+` + `  session describing itself. Record only what the work LEARNED or CHANGED.
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) — retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Volatile state written as a timeless assertion. A version, count, size,
+` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
+` + `  claim is true only at the instant it was said. Concretely, never produce a
+` + `  fact whose text resembles any of these: "Switchroom fleet is running image
+` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
+` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
+` + `  currently green". If the claim is worth keeping, put the date INSIDE the
+` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
+` + `  cannot date it, drop it. An undated one is recalled forever as though it
+` + `  were still true, which is worse than not remembering it at all.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `Write each fact so it stands alone: name the thing, the number, and the date. A
+` + `sentence that only makes sense while reading this transcript is not durable.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + `nothing durable remains, return an empty facts list.
 `
 ];
 var DEFAULT_OBSERVATIONS_MISSION = `Synthesise durable, standing knowledge about the people, projects, and systems this agent works with: preferences and standing rules, roles and relationships, skills and recurring patterns, technical and operational decisions with their rationale, and the state of long-running work once it lands.
@@ -19817,6 +19962,22 @@ var PROFILE_MEMORY_DEFAULTS = {
 var warnedMissingPool = new Set;
 var warnedMissingDefault = new Set;
 
+// src/memory/hindsight-retain-provenance.ts
+var RETAIN_PROVENANCE_TAG = "source:transcript";
+var RETAIN_TAGS_DEFAULT = Object.freeze([
+  "{session_id}",
+  RETAIN_PROVENANCE_TAG
+]);
+
+// src/memory/hindsight-seed-directives.ts
+var ANTI_CONFABULATION_DIRECTIVE = `When the retrieved memories do not support an answer, say so instead of composing one.
+` + `
+` + `- If nothing retrieved scores meaningfully above zero, or what came back is off-topic, the honest answer is that the bank does not know. Say that plainly, and say what would settle it.
+` + `- Never assert a date, a version, a number, an attribution, a decision, or an outcome that no retrieved memory states. A question that presupposes something is not evidence for it: asked when a decision was made, when the bank records no such decision, answer that none is recorded — do not supply one.
+` + `- Keep what the bank RECORDED separate from what you INFER. State inferences as inferences, and say which memory a recorded fact came from.
+` + `- Treat a memory that was extracted from a conversation transcript as an unverified claim, not an established fact — it may be an assistant's own earlier guess. If it is the only support for an answer, say that it is.
+` + "- Partial knowledge with its gaps named is more useful than a fluent answer that fills them in.";
+
 // src/telegram/state.ts
 init_paths();
 
@@ -19854,7 +20015,6 @@ var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
 init_paths();
 
 // src/agents/scaffold.ts
-var REPO_ROOT = resolve5(import.meta.dirname, "../..");
 var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var pendingBankOps = new Set;
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
@@ -19930,7 +20090,7 @@ async function bindAgentSocket(parentDir, agent, db) {
   } catch {}
   const uid = allocateAgentUid(agent);
   const socketPath = resolve6(dir, "sock");
-  if (existsSync5(socketPath)) {
+  if (existsSync6(socketPath)) {
     try {
       unlinkSync(socketPath);
     } catch (err) {
@@ -19970,7 +20130,7 @@ async function bindOperatorSocket(parentDir, operatorUid, db) {
     chmodSync(dir, 448);
   } catch {}
   const socketPath = resolve6(dir, "sock");
-  if (existsSync5(socketPath)) {
+  if (existsSync6(socketPath)) {
     try {
       unlinkSync(socketPath);
     } catch (err) {
@@ -20290,7 +20450,7 @@ async function bootstrap(opts) {
           l.server.close();
         } catch {}
         try {
-          if (existsSync5(l.socketPath))
+          if (existsSync6(l.socketPath))
             unlinkSync(l.socketPath);
         } catch {}
       }
@@ -20309,7 +20469,7 @@ async function main() {
   const operatorUid = operatorUidRaw && /^\d+$/.test(operatorUidRaw) ? Number(operatorUidRaw) : undefined;
   let agents = [];
   try {
-    if (existsSync5(socketParent)) {
+    if (existsSync6(socketParent)) {
       agents = readdirSync3(socketParent).filter((name) => {
         if (name === KERNEL_OPERATOR_NAME)
           return false;
@@ -20344,7 +20504,7 @@ async function main() {
     } catch {}
     const db = openKernelDb(dbPath);
     const socketPath = resolve6(socketEnv);
-    if (existsSync5(socketPath)) {
+    if (existsSync6(socketPath)) {
       try {
         unlinkSync(socketPath);
       } catch {}
@@ -20366,7 +20526,7 @@ async function main() {
         server.close();
       } catch {}
       try {
-        if (existsSync5(socketPath))
+        if (existsSync6(socketPath))
           unlinkSync(socketPath);
       } catch {}
       try {