switchroom 0.19.43 → 0.19.44

package/dist/host-control/main.js

@@ -10994,7 +10994,7 @@ var init_observation_scopes = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -11111,6 +11111,7 @@ var init_schema = __esm(() => {
   }).optional();
   ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Operator PIN for the per-row observation scope, overriding the " + 'default `curated` strategy (see docs/configuration.md). "shared" ' + "forces Hindsight's consolidation to write EVERY observation into ONE " + "global untagged scope — what several agents pooling one bank want so " + "their observations merge rather than sitting in parallel silos. " + '"combined" is the pin form of opting out (restores the pre-#4035 ' + "engine default). UNSET does NOT mean 'nothing on the wire': the " + "`curated` strategy still computes a scope per retain. Applies to " + "every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
   ObservationScopeStrategySchema = exports_external.enum(OBSERVATION_SCOPE_STRATEGIES).optional().describe("Per-retain strategy that decides how the observation scope is " + 'computed when no `observation_scopes` pin is set. "curated" ' + "(the default since #4035) strips volatile per-session provenance " + "tags from each retain's consolidation scope — keeping the stable " + "semantic ones on the source fact — so an agent's observations dedup " + "and merge across sessions instead of pocketing one-per-session. " + '"shared" sends every retain to the one global untagged scope. ' + '"combined" / "off" opt OUT: no per-row scope goes on the wire, ' + "restoring the pre-feature engine default (byte-identical to an " + "unconfigured client). OMITTED BY DEFAULT: unset leaves the plugin's " + "own default (`curated`) in force. A manual `observation_scopes` pin " + "wins over this strategy. Accepted values: " + `${OBSERVATION_SCOPE_STRATEGIES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
+  AntiConfabulationDirectiveSchema = exports_external.union([exports_external.boolean(), exports_external.string().min(1)]).optional().describe("The seeded anti-confabulation directive: reflect has no relevance " + "floor (`min_scores` is a /recall-only parameter), so a bank holding " + "nothing relevant still yields a confident answer, and a question that " + "presupposes a decision reliably produces one. Directives ARE applied " + "during reflect, so this is the lever. Unset or true (the default) " + "seeds and maintains switchroom's own text; false disables seeding and " + "leaves any existing directive untouched; a string is operator-authored " + "text that wins outright. Switchroom only ever upgrades directive text " + "byte-equal to a default it shipped, so editing the directive in the " + "bank is also a permanent override. " + "Cascade: override (per-agent wins over default).");
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
@@ -11146,6 +11147,7 @@ var init_schema = __esm(() => {
       empathy: exports_external.number().int().min(1).max(5).optional().describe("How much the bank weights emotional/relational context (1-5; engine default 3).")
     }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis — a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
     directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true — Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never …", "from now on …", ' + `"stop doing …", a stated preference, "that's wrong, it's …") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex — the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
+    anti_confabulation_directive: AntiConfabulationDirectiveSchema,
     observation_scopes: ObservationScopesSchema,
     observation_scope_strategy: ObservationScopeStrategySchema,
     recall: exports_external.object({
@@ -11416,7 +11418,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -11550,6 +11552,7 @@ var init_schema = __esm(() => {
       isolation: exports_external.enum(["default", "strict"]).optional(),
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
+      anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,
       recall: exports_external.object({
@@ -18379,13 +18382,13 @@ var require_lib = __commonJS((exports, module) => {
 
 // src/vault/flock.ts
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   openSync as openSync2,
   closeSync as closeSync2,
   writeSync as writeSync2,
   fsyncSync as fsyncSync2,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   readdirSync as readdirSync3,
   rmdirSync,
   statSync as statSync3,
@@ -18418,8 +18421,8 @@ function pidStartTimeMs(pid) {
   if (process.platform !== "linux")
     return null;
   try {
-    const statLine = readFileSync5(`/proc/${pid}/stat`, "utf8");
-    const procStat = readFileSync5("/proc/stat", "utf8");
+    const statLine = readFileSync6(`/proc/${pid}/stat`, "utf8");
+    const procStat = readFileSync6("/proc/stat", "utf8");
     return parseProcStartTimeMs(statLine, procStat, Date.now());
   } catch {
     return null;
@@ -18815,13 +18818,13 @@ async function rpcRaw(req, opts) {
 async function rpc(req, opts) {
   const socketPath = resolveBrokerSocketPath(opts);
   const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let settled = false;
     const settle = (val) => {
       if (settled)
         return;
       settled = true;
-      resolve5(val);
+      resolve6(val);
     };
     const client = new net.Socket;
     const timer = setTimeout(() => {
@@ -20931,8 +20934,8 @@ var require_commander = __commonJS((exports2) => {
 // src/host-control/main.ts
 init_loader();
 import { homedir as homedir8 } from "node:os";
-import { existsSync as existsSync16, readdirSync as readdirSync7 } from "node:fs";
-import { join as join14, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync7 } from "node:fs";
+import { join as join13, resolve as resolve10 } from "node:path";
 
 // src/host-control/config-degraded.ts
 init_loader();
@@ -21323,9 +21326,66 @@ async function waitForConfigRecovery(opts) {
 init_schema();
 
 // src/agents/scaffold.ts
-import { dirname, isAbsolute, join as join5, relative, resolve as resolve5 } from "node:path";
 init_atomic();
 
+// src/util/shipped-assets.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, realpathSync } from "node:fs";
+import { dirname, resolve as resolve4 } from "node:path";
+var FHS_SHARE_ROOTS = [
+  "/usr/local/share/switchroom",
+  "/usr/share/switchroom"
+];
+var PROFILES_ASSET = {
+  asset: "profiles",
+  envVar: "SWITCHROOM_PROFILES_ROOT"
+};
+function orderedCandidates(spec, probe) {
+  const out = [];
+  const push = (path, source) => {
+    if (!out.some((c) => c.path === path))
+      out.push({ path, source });
+  };
+  if (probe.bundleDir) {
+    push(resolve4(probe.bundleDir, "../..", spec.asset), "npm");
+    push(resolve4(probe.bundleDir, spec.asset), "image");
+  }
+  if (probe.execPath) {
+    push(resolve4(dirname(probe.execPath), "../share/switchroom", spec.asset), "sea-sibling");
+  }
+  for (const root of FHS_SHARE_ROOTS) {
+    push(resolve4(root, spec.asset), "fhs");
+  }
+  return out;
+}
+function resolveShippedAsset(spec, probe) {
+  const env = probe.env ?? process.env;
+  const override = env[spec.envVar]?.trim();
+  if (override) {
+    const path = canonicalise(resolve4(override), probe);
+    return { path, candidates: [path], source: "env" };
+  }
+  const exists = probe.exists ?? existsSync5;
+  const candidates = orderedCandidates(spec, probe);
+  for (const c of candidates) {
+    if (exists(c.path)) {
+      return {
+        path: canonicalise(c.path, probe),
+        candidates: candidates.map((x) => x.path),
+        source: c.source
+      };
+    }
+  }
+  return { path: null, candidates: candidates.map((x) => x.path), source: "none" };
+}
+function canonicalise(path, probe) {
+  const realpath = probe.realpath ?? realpathSync;
+  try {
+    return realpath(path);
+  } catch {
+    return path;
+  }
+}
+
 // src/agents/agent-uid.ts
 init_peercred();
 import { createHash } from "node:crypto";
@@ -21342,7 +21402,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.19.43";
+var VERSION = "0.19.44";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
@@ -21387,37 +21447,29 @@ var AUDIT_ROOT = join2(homedir2(), ".switchroom", "audit");
 
 // src/agents/profiles.ts
 var import_handlebars = __toESM(require_lib(), 1);
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync as mkdirSync2, realpathSync } from "node:fs";
-import { resolve as resolve4, join as join3, sep as pathSep } from "node:path";
-function resolveProfilesRoot() {
-  const envOverride = process.env.SWITCHROOM_PROFILES_ROOT?.trim();
-  if (envOverride) {
-    return resolve4(envOverride);
-  }
-  const candidates = [
-    resolve4(import.meta.dirname, "../../profiles"),
-    resolve4(import.meta.dirname, "profiles")
-  ];
-  for (const candidate of candidates) {
-    if (existsSync5(candidate)) {
-      return candidate;
-    }
-  }
-  return candidates[0];
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync6, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync as mkdirSync2, realpathSync as realpathSync2 } from "node:fs";
+import { resolve as resolve5, join as join3, sep as pathSep } from "node:path";
+function resolveProfilesRootDetailed() {
+  return resolveShippedAsset(PROFILES_ASSET, {
+    bundleDir: import.meta.dirname,
+    execPath: process.execPath
+  });
 }
-var PROFILES_ROOT = resolveProfilesRoot();
+var PROFILES_RESOLUTION = resolveProfilesRootDetailed();
+var PROFILES_ROOT = PROFILES_RESOLUTION.path ?? PROFILES_RESOLUTION.candidates[0];
+var PROFILES_ROOT_SEARCH = PROFILES_RESOLUTION.candidates;
 import_handlebars.default.registerHelper("json", (value) => {
   return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
 });
 import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
-var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
+var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
 var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join3(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
-  if (existsSync5(fragPath)) {
-    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
+  if (existsSync6(fragPath)) {
+    import_handlebars.default.registerPartial(name, readFileSync5(fragPath, "utf-8"));
   }
 }
 
@@ -21620,7 +21672,8 @@ var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY",
   "HINDSIGHT_MCP_RECALL_BUDGET_MODE",
   "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT",
-  "HINDSIGHT_API_RETAIN_WALL_TIMEOUT"
+  "HINDSIGHT_API_RETAIN_WALL_TIMEOUT",
+  "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT"
 ]);
 var HINDSIGHT_WORKER_SLOT_TYPES = [
   "consolidation",
@@ -21715,6 +21768,15 @@ var DEFAULT_RETAIN_MISSION = `Extract durable facts that will still be true and
 ` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
 ` + `  system's self-reports are not memories.
 ` + `- Restatements of the user's current request or the task in progress.
+` + `- The assistant's own answers, summaries, recaps, or reflect output. Before
+` + `  extracting, ask: does anything in this transcript support this claim OTHER
+` + `  than the assistant having asserted it? If not, drop it — a model's own
+` + `  synthesis re-extracted as a fact is how a guess becomes permanent.
+` + `  Concretely, never produce a fact whose only support is the assistant
+` + `  stating a date, a version, an attribution, a total, or a decision that the
+` + `  user never confirmed and no tool output shows. An unverified claim recalls
+` + `  later as though it had been established, which is worse than not
+` + `  remembering it at all.
 ` + `- Volatile state written as a timeless assertion. A version, count, size,
 ` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
 ` + `  claim is true only at the instant it was said. Concretely, never produce a
@@ -21870,6 +21932,64 @@ var SUPERSEDED_RETAIN_MISSIONS = [
 ` + `
 ` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
 ` + `nothing durable remains, return an empty facts list.
+`,
+  `Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.
+` + `
+` + `DURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:
+` + `- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.
+` + `- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.
+` + `- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.
+` + `- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.
+` + `- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.
+` + `If a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.
+` + `
+` + `A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it — it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- The act of delegating, dispatching, spawning, launching, steering or merging
+` + `  work — including when it succeeded. "X was dispatched and completed" is the
+` + `  session describing itself. Record only what the work LEARNED or CHANGED.
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) — retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Volatile state written as a timeless assertion. A version, count, size,
+` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
+` + `  claim is true only at the instant it was said. Concretely, never produce a
+` + `  fact whose text resembles any of these: "Switchroom fleet is running image
+` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
+` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
+` + `  currently green". If the claim is worth keeping, put the date INSIDE the
+` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
+` + `  cannot date it, drop it. An undated one is recalled forever as though it
+` + `  were still true, which is worse than not remembering it at all.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `Write each fact so it stands alone: name the thing, the number, and the date. A
+` + `sentence that only makes sense while reading this transcript is not durable.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + `nothing durable remains, return an empty facts list.
 `
 ];
 var DEFAULT_OBSERVATIONS_MISSION = `Synthesise durable, standing knowledge about the people, projects, and systems this agent works with: preferences and standing rules, roles and relationships, skills and recurring patterns, technical and operational decisions with their rationale, and the state of long-running work once it lands.
@@ -21947,6 +22067,22 @@ var PROFILE_MEMORY_DEFAULTS = {
 var warnedMissingPool = new Set;
 var warnedMissingDefault = new Set;
 
+// src/memory/hindsight-retain-provenance.ts
+var RETAIN_PROVENANCE_TAG = "source:transcript";
+var RETAIN_TAGS_DEFAULT = Object.freeze([
+  "{session_id}",
+  RETAIN_PROVENANCE_TAG
+]);
+
+// src/memory/hindsight-seed-directives.ts
+var ANTI_CONFABULATION_DIRECTIVE = `When the retrieved memories do not support an answer, say so instead of composing one.
+` + `
+` + `- If nothing retrieved scores meaningfully above zero, or what came back is off-topic, the honest answer is that the bank does not know. Say that plainly, and say what would settle it.
+` + `- Never assert a date, a version, a number, an attribution, a decision, or an outcome that no retrieved memory states. A question that presupposes something is not evidence for it: asked when a decision was made, when the bank records no such decision, answer that none is recorded — do not supply one.
+` + `- Keep what the bank RECORDED separate from what you INFER. State inferences as inferences, and say which memory a recorded fact came from.
+` + `- Treat a memory that was extracted from a conversation transcript as an unverified claim, not an established fact — it may be an assistant's own earlier guess. If it is the only support for an answer, say that it is.
+` + "- Partial knowledge with its gaps named is more useful than a fluent answer that fills them in.";
+
 // src/telegram/state.ts
 init_paths();
 
@@ -21984,7 +22120,6 @@ var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
 init_paths();
 
 // src/agents/scaffold.ts
-var REPO_ROOT = resolve5(import.meta.dirname, "../..");
 var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var pendingBankOps = new Set;
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
@@ -22016,8 +22151,8 @@ import { spawn as spawn2, spawnSync as spawnSync4 } from "node:child_process";
 import { mkdir as mkdir2, chmod, chown, unlink, appendFile } from "node:fs/promises";
 import {
   readdirSync as readdirSync6,
-  existsSync as existsSync15,
-  readFileSync as readFileSync11,
+  existsSync as existsSync16,
+  readFileSync as readFileSync12,
   writeFileSync as writeFileSync6,
   renameSync as renameSync5,
   mkdirSync as mkdirSync5,
@@ -22029,7 +22164,7 @@ import {
   copyFileSync as copyFileSync3,
   unlinkSync as unlinkSync5
 } from "node:fs";
-import { join as join13, dirname as dirname9, resolve as resolve9 } from "node:path";
+import { join as join12, dirname as dirname9, resolve as resolve9 } from "node:path";
 import { createHash as createHash6, randomUUID as randomUUID2, randomBytes } from "node:crypto";
 
 // src/host-control/protocol.ts
@@ -26721,9 +26856,9 @@ class PostHog extends PostHogBackendClient {
 // src/analytics/posthog.ts
 init_paths();
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
@@ -26742,8 +26877,8 @@ function getDistinctId() {
     return cachedDistinctId;
   const path = resolveStatePath("analytics-id");
   try {
-    if (existsSync8(path)) {
-      const existing = readFileSync7(path, "utf-8").trim();
+    if (existsSync9(path)) {
+      const existing = readFileSync8(path, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
         return existing;
@@ -27952,8 +28087,8 @@ function releaseBlockIsCommented(doc) {
 
 // src/cli/rollout-pin-journal.ts
 import {
-  existsSync as existsSync11,
-  readFileSync as readFileSync8,
+  existsSync as existsSync12,
+  readFileSync as readFileSync9,
   writeFileSync as writeFileSync4,
   renameSync as renameSync4,
   unlinkSync as unlinkSync4,
@@ -27962,7 +28097,7 @@ import {
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { createHash as createHash4 } from "node:crypto";
-import { join as join8, basename as basename3, resolve as resolve7, dirname as dirname6 } from "node:path";
+import { join as join7, basename as basename3, resolve as resolve7, dirname as dirname6 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -27975,15 +28110,15 @@ function pinJournalDir(configPath) {
     if (basename3(dir) === STATE_DIR_NAME)
       return dir;
   }
-  return join8(homedir5(), STATE_DIR_NAME);
+  return join7(homedir5(), STATE_DIR_NAME);
 }
 function pinJournalPath(configPath) {
   const abs = resolve7(configPath);
   const key = createHash4("sha256").update(abs).digest("hex").slice(0, 12);
-  return join8(pinJournalDir(abs), `.rollout-pin-journal.${basename3(abs)}.${key}.json`);
+  return join7(pinJournalDir(abs), `.rollout-pin-journal.${basename3(abs)}.${key}.json`);
 }
 function hasPinJournal(configPath) {
-  return existsSync11(pinJournalPath(configPath));
+  return existsSync12(pinJournalPath(configPath));
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0)
@@ -28017,9 +28152,9 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   const p = pinJournalPath(configPath);
   let raw;
   try {
-    raw = readFileSync8(p, "utf8");
+    raw = readFileSync9(p, "utf8");
   } catch (e) {
-    if (existsSync11(p)) {
+    if (existsSync12(p)) {
       warn(`⚠️  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted — verify it host-side before the next reconcile.
 `);
     }
@@ -28064,7 +28199,7 @@ function commitPinPersist(configPath) {
     unlinkSync4(p);
     return null;
   } catch (e) {
-    if (!existsSync11(p))
+    if (!existsSync12(p))
       return null;
     return `rollout pin journal: FAILED to clear ${p} after a SUCCESSFUL roll ` + `(${e.message}). Delete it host-side — while it exists, ` + `recovery may revert a proven \`release.pin\`.`;
   }
@@ -28086,7 +28221,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     }
   }
   try {
-    const current = readFileSync8(configPath, "utf8");
+    const current = readFileSync9(configPath, "utf8");
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
@@ -28137,14 +28272,14 @@ function recoverPinJournal(configPath, opts = {}) {
 // src/cli/operator-uid.ts
 import {
   chownSync,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   lstatSync as lstatSync2,
   readdirSync as readdirSync5,
-  realpathSync as realpathSync2,
+  realpathSync as realpathSync3,
   statSync as statSync7
 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join8 } from "node:path";
 var CONTAINER_OPERATOR_HOME = "/host-home";
 var SWITCHROOM_HOME_MARKER = "switchroom.yaml";
 function operatorHomeCandidates(env, home2) {
@@ -28153,7 +28288,7 @@ function operatorHomeCandidates(env, home2) {
   for (const r of roots) {
     if (!r || r.length === 0)
       continue;
-    const dir = join9(r, ".switchroom");
+    const dir = join8(r, ".switchroom");
     if (!out.includes(dir))
       out.push(dir);
   }
@@ -28162,7 +28297,7 @@ function operatorHomeCandidates(env, home2) {
 function resolveOperatorUidFromOwnership(deps = {}) {
   const env = deps.env ?? process.env;
   const home2 = deps.home ?? homedir6();
-  const exists = deps.exists ?? ((p) => existsSync12(p));
+  const exists = deps.exists ?? ((p) => existsSync13(p));
   const statUid = deps.statUid ?? ((p) => {
     try {
       return statSync7(p).uid;
@@ -28171,7 +28306,7 @@ function resolveOperatorUidFromOwnership(deps = {}) {
     }
   });
   for (const dir of operatorHomeCandidates(env, home2)) {
-    if (!exists(join9(dir, SWITCHROOM_HOME_MARKER)))
+    if (!exists(join8(dir, SWITCHROOM_HOME_MARKER)))
       continue;
     const uid = statUid(dir);
     if (uid !== undefined && Number.isFinite(uid) && uid > 0)
@@ -28204,15 +28339,15 @@ function resolveOperatorUid(ownershipDeps = {}) {
 init_atomic();
 
 // src/cli/resolve-version.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join9 } from "node:path";
 function readPackageVersion() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 12 && dir && dir !== "/"; i++) {
-    const p = join10(dir, "package.json");
-    if (existsSync13(p)) {
+    const p = join9(dir, "package.json");
+    if (existsSync14(p)) {
       try {
-        const pkg = JSON.parse(readFileSync9(p, "utf-8"));
+        const pkg = JSON.parse(readFileSync10(p, "utf-8"));
         if (pkg?.name === "switchroom" && typeof pkg.version === "string") {
           return pkg.version;
         }
@@ -28613,7 +28748,7 @@ var import__2 = __toESM(require_commander(), 1);
 
 // src/cli/update.ts
 init_loader();
-import { join as join11, dirname as dirname8, resolve as resolve8 } from "node:path";
+import { join as join10, dirname as dirname8 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 
 // src/agents/lifecycle.ts
@@ -28716,7 +28851,12 @@ function getAllAgentStatuses(config) {
 
 // src/cli/update.ts
 init_atomic();
-var DEFAULT_COMPOSE_PATH = join11(homedir7(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join10(homedir7(), ".switchroom", "compose", "docker-compose.yml");
+var PACKAGED_INSTALL_KINDS = new Set([
+  "static-binary",
+  "npm-global",
+  "container"
+]);
 var UPDATE_RESULT_SENTINEL = "SWITCHROOM_UPDATE_RESULT:";
 function parseUpdateResultLine(stdout) {
   const idx = stdout.lastIndexOf(UPDATE_RESULT_SENTINEL);
@@ -28802,9 +28942,9 @@ function resolvePriorPinFromFleet(components, target, scope) {
 // src/host-control/config-edit-validator.ts
 init_schema();
 var import_yaml5 = __toESM(require_dist(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync5, rmSync as rmSync2, existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync5, rmSync as rmSync2, existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join12, isAbsolute as isAbsolute3, normalize, basename as basename4 } from "node:path";
+import { join as join11, isAbsolute as isAbsolute2, normalize, basename as basename4 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { isDeepStrictEqual } from "node:util";
 var MAX_PATCH_BYTES = 1024 * 1024;
@@ -28817,12 +28957,12 @@ function isTargetPathHeader(headerPath, targetBasename) {
   let p = headerPath;
   if (p.startsWith("a/") || p.startsWith("b/"))
     p = p.slice(2);
-  if (isAbsolute3(p))
+  if (isAbsolute2(p))
     return false;
   if (p.includes(".."))
     return false;
   const norm = normalize(p);
-  if (norm.includes("..") || isAbsolute3(norm))
+  if (norm.includes("..") || isAbsolute2(norm))
     return false;
   return norm === targetBasename || basename4(norm) === targetBasename;
 }
@@ -28944,21 +29084,21 @@ function validateShape(unifiedDiff, targetPath) {
   return null;
 }
 function applyPatch(unifiedDiff, configPath, gitBin) {
-  if (!existsSync14(configPath)) {
+  if (!existsSync15(configPath)) {
     return {
       ok: false,
       code: "E_PATCH_APPLY_FAILED",
       detail: `target config not found at ${configPath}`
     };
   }
-  const liveContent = readFileSync10(configPath, "utf8");
-  const scratchDir = mkdtempSync(join12(tmpdir(), "config-propose-edit-"));
+  const liveContent = readFileSync11(configPath, "utf8");
+  const scratchDir = mkdtempSync(join11(tmpdir(), "config-propose-edit-"));
   try {
     const targetBasename = configPath.split("/").pop() ?? "switchroom.yaml";
-    const scratchFile = join12(scratchDir, targetBasename);
+    const scratchFile = join11(scratchDir, targetBasename);
     writeFileSync5(scratchFile, liveContent);
     const normalizedDiff = normalizeDiffHeadersToBasename(unifiedDiff, targetBasename);
-    const patchFile = join12(scratchDir, "proposal.patch");
+    const patchFile = join11(scratchDir, "proposal.patch");
     writeFileSync5(patchFile, normalizedDiff);
     const bin = gitBin ?? "git";
     const baseArgs = [
@@ -28988,7 +29128,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
         detail: `git apply failed: ${(real.stderr || "").trim().slice(0, 500)}`
       };
     }
-    const after = readFileSync10(scratchFile, "utf8");
+    const after = readFileSync11(scratchFile, "utf8");
     return { ok: true, after };
   } finally {
     rmSync2(scratchDir, { recursive: true, force: true });
@@ -29186,7 +29326,7 @@ function validateConfigEdit(opts) {
     return schemaErr;
   let beforeData = {};
   try {
-    const beforeRaw = existsSync14(opts.configPath) ? readFileSync10(opts.configPath, "utf8") : "";
+    const beforeRaw = existsSync15(opts.configPath) ? readFileSync11(opts.configPath, "utf8") : "";
     const beforeDoc = import_yaml5.parseDocument(beforeRaw, { merge: false, strict: false });
     beforeData = beforeDoc.toJS();
   } catch {
@@ -29770,11 +29910,11 @@ function resolveDigests(imageRefs) {
   return out;
 }
 function readCachedInstallType(bindRoot) {
-  const cacheDir = join13(bindRoot, ".switchroom");
-  const cachePath = join13(cacheDir, "install-type.json");
-  if (existsSync15(cachePath)) {
+  const cacheDir = join12(bindRoot, ".switchroom");
+  const cachePath = join12(cacheDir, "install-type.json");
+  if (existsSync16(cachePath)) {
     try {
-      const raw = readFileSync11(cachePath, "utf-8");
+      const raw = readFileSync12(cachePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed.install_type === "string" && typeof parsed.detected_at === "string") {
         return parsed;
@@ -29826,7 +29966,7 @@ function writeFileInPlacePreservingInode(targetPath, content) {
   } finally {
     closeSync5(fd);
   }
-  const readBack = readFileSync11(targetPath);
+  const readBack = readFileSync12(targetPath);
   if (readBack.length !== buf.length) {
     throw new Error(`in-place write short: wrote ${buf.length} bytes but read back ${readBack.length}`);
   }
@@ -29861,11 +30001,11 @@ class HostdServer {
   fleetMutationInFlight = null;
   lastAutoRolloutFailedPin = null;
   autoRolloutLatchPath() {
-    return join13(this.hostdDirPath(), AUTO_ROLLOUT_LATCH_FILENAME);
+    return join12(this.hostdDirPath(), AUTO_ROLLOUT_LATCH_FILENAME);
   }
   readAutoRolloutLatch() {
     try {
-      const raw = readFileSync11(this.autoRolloutLatchPath(), "utf-8");
+      const raw = readFileSync12(this.autoRolloutLatchPath(), "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && parsed.v === 1 && typeof parsed.pin === "string" && parsed.pin.length > 0 && (parsed.outcome === "attempting" || parsed.outcome === "failed")) {
         return parsed;
@@ -29904,7 +30044,7 @@ class HostdServer {
     return resolveHostdConfigPath(this.opts.configPath);
   }
   fleetComposePath() {
-    return join13(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+    return join12(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
   }
   recoverRolloutPinJournal(context) {
     let note = null;
@@ -29943,7 +30083,7 @@ class HostdServer {
     return note;
   }
   async start() {
-    const hostdDir = join13(this.opts.homeDir, ".switchroom", "hostd");
+    const hostdDir = join12(this.opts.homeDir, ".switchroom", "hostd");
     await mkdir2(hostdDir, { recursive: true });
     await chmod(hostdDir, 493).catch(() => {
       return;
@@ -29964,13 +30104,13 @@ class HostdServer {
     }
     try {
       for (const name of agentNames) {
-        const dir = join13(hostdDir, name);
-        const sockPath = join13(dir, "sock");
+        const dir = join12(hostdDir, name);
+        const sockPath = join12(dir, "sock");
         await mkdir2(dir, { recursive: true });
         await chmod(dir, 493).catch(() => {
           return;
         });
-        if (existsSync15(sockPath))
+        if (existsSync16(sockPath))
           await unlink(sockPath).catch(() => {
             return;
           });
@@ -30001,13 +30141,13 @@ class HostdServer {
           process.stderr.write(`hostd: SWITCHROOM_HOSTD_OPERATOR_UID='${opUidStr}' is not a positive integer; skipping operator listener
 `);
         } else {
-          const dir = join13(hostdDir, "operator");
-          const sockPath = join13(dir, "sock");
+          const dir = join12(hostdDir, "operator");
+          const sockPath = join12(dir, "sock");
           await mkdir2(dir, { recursive: true });
           await chmod(dir, 493).catch(() => {
             return;
           });
-          if (existsSync15(sockPath))
+          if (existsSync16(sockPath))
             await unlink(sockPath).catch(() => {
               return;
             });
@@ -30043,11 +30183,11 @@ class HostdServer {
   }
   async reconcileOrphanedFleetMutations() {
     const path3 = this.auditLogPath();
-    if (!existsSync15(path3))
+    if (!existsSync16(path3))
       return;
     let raw;
     try {
-      raw = readFileSync11(path3, "utf-8");
+      raw = readFileSync12(path3, "utf-8");
     } catch {
       return;
     }
@@ -30446,11 +30586,11 @@ class HostdServer {
   missingApplyAssets() {
     const root = this.opts.applyAssetsRoot ?? resolve9(import.meta.dirname, "../..");
     return [
-      join13(root, "profiles"),
-      join13(root, "profiles", "default"),
-      join13(root, "vendor", "hindsight-memory"),
-      join13(root, "skills")
-    ].filter((p) => !existsSync15(p));
+      join12(root, "profiles"),
+      join12(root, "profiles", "default"),
+      join12(root, "vendor", "hindsight-memory"),
+      join12(root, "skills")
+    ].filter((p) => !existsSync16(p));
   }
   applyAssetPreflight(request_id, started) {
     const missing = this.missingApplyAssets();
@@ -30708,19 +30848,19 @@ class HostdServer {
     return entry;
   }
   hostdDirPath() {
-    return join13(this.opts.homeDir, ".switchroom", "hostd");
+    return join12(this.opts.homeDir, ".switchroom", "hostd");
   }
   hostdDirHostPath() {
     const hostHome = this.opts.hostHomeDir ?? process.env.SWITCHROOM_HOST_HOME?.trim() ?? this.opts.homeDir;
-    return join13(hostHome, ".switchroom", "hostd");
+    return join12(hostHome, ".switchroom", "hostd");
   }
   async beginSelfBump(req, caller, started) {
     const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
-    const composePath = join13(this.hostdDirPath(), "docker-compose.yml");
-    if (!existsSync15(composePath)) {
+    const composePath = join12(this.hostdDirPath(), "docker-compose.yml");
+    if (!existsSync16(composePath)) {
       return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
     }
-    const before = readFileSync11(composePath, "utf8");
+    const before = readFileSync12(composePath, "utf8");
     const bumped = bumpHostdComposeImageTag(before, req.args.pin);
     if (!bumped) {
       return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but no ` + `switchroom-hostd image line was found in ${composePath} ` + `(hand-edited compose?). Run \`switchroom hostd install --tag ` + `${req.args.pin}\` on the host, then re-run the roll. Nothing ` + `was changed.`, Date.now() - started);
@@ -30741,10 +30881,10 @@ class HostdServer {
     try {
       const baks = readdirSync6(this.hostdDirPath()).filter((f) => f.startsWith("docker-compose.yml.bak-selfbump-")).sort();
       for (const f of baks.slice(0, Math.max(0, baks.length - 4))) {
-        unlinkSync5(join13(this.hostdDirPath(), f));
+        unlinkSync5(join12(this.hostdDirPath(), f));
       }
     } catch {}
-    const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
     const marker = {
       v: 1,
       request_id: req.request_id,
@@ -30828,7 +30968,7 @@ class HostdServer {
       rollbackBump();
       entry.result = "error";
       entry.finished_at = Date.now();
-      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join13(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
+      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join12(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
       if (this.fleetMutationInFlight && this.fleetMutationInFlight.request_id === entry.request_id) {
         this.fleetMutationInFlight = null;
       }
@@ -30855,10 +30995,10 @@ class HostdServer {
     try {
       if (!Number.isInteger(messageId) || messageId <= 0)
         return;
-      const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-      if (!existsSync15(markerPath))
+      const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+      if (!existsSync16(markerPath))
         return;
-      const marker = parsePendingRolloutMarker(readFileSync11(markerPath, "utf8"));
+      const marker = parsePendingRolloutMarker(readFileSync12(markerPath, "utf8"));
       if (!marker)
         return;
       if (marker.request_id !== requestId)
@@ -30873,12 +31013,12 @@ class HostdServer {
     } catch {}
   }
   async resumePendingSelfBumpRollout() {
-    const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-    if (!existsSync15(markerPath))
+    const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    if (!existsSync16(markerPath))
       return;
     let raw;
     try {
-      raw = readFileSync11(markerPath, "utf8");
+      raw = readFileSync12(markerPath, "utf8");
     } finally {
       try {
         unlinkSync5(markerPath);
@@ -30929,7 +31069,7 @@ class HostdServer {
       return;
     }
     if (needsSelfBump(ownVersion, marker.pin)) {
-      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join13(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
+      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join12(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
       return;
     }
     process.stderr.write(`hostd: resuming rollout ${marker.request_id} → ${marker.pin} after ` + `self-bump (v${marker.prior_hostd_version} → v${ownVersion})
@@ -31037,7 +31177,7 @@ class HostdServer {
     }
     let beforeContent;
     try {
-      beforeContent = readFileSync11(configPath, "utf-8");
+      beforeContent = readFileSync12(configPath, "utf-8");
     } catch {
       beforeContent = "";
     }
@@ -31157,7 +31297,7 @@ class HostdServer {
     try {
       let snapshot;
       try {
-        snapshot = readFileSync11(configPath, "utf-8");
+        snapshot = readFileSync12(configPath, "utf-8");
       } catch (e) {
         await approval.finalize({
           outcome: "reconcile_failed_rolled_back",
@@ -31455,8 +31595,8 @@ ${output.recovery.stderr}` : "";
     if (this.opts.imageRefsForDigests)
       return this.opts.imageRefsForDigests();
     try {
-      const composePath = join13(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
-      if (!existsSync15(composePath))
+      const composePath = join12(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+      if (!existsSync16(composePath))
         return [];
       const r = spawnSync4("docker", [
         "compose",
@@ -31714,10 +31854,10 @@ ${pinNote}`.trim();
   }
   rolloutRowExistsInLog(targetRequestId) {
     const path3 = this.auditLogPath();
-    if (!existsSync15(path3))
+    if (!existsSync16(path3))
       return false;
     try {
-      const raw = readFileSync11(path3, "utf-8");
+      const raw = readFileSync12(path3, "utf-8");
       return latestRolloutRowForRequest(raw, targetRequestId) !== null;
     } catch {
       return false;
@@ -31725,11 +31865,11 @@ ${pinNote}`.trim();
   }
   rolloutStatusFromLog(responseRequestId, targetRequestId, started) {
     const path3 = this.auditLogPath();
-    if (!existsSync15(path3))
+    if (!existsSync16(path3))
       return null;
     let raw;
     try {
-      raw = readFileSync11(path3, "utf-8");
+      raw = readFileSync12(path3, "utf-8");
     } catch {
       return null;
     }
@@ -31811,7 +31951,7 @@ ${pinNote}`.trim();
     }
   }
   auditLogPath() {
-    return this.opts.auditLogPath ?? join13(this.opts.homeDir, ".switchroom", "host-control-audit.log");
+    return this.opts.auditLogPath ?? join12(this.opts.homeDir, ".switchroom", "host-control-audit.log");
   }
   maybeRotateAuditLog(path3) {
     const { maxBytes, maxFiles } = resolveRotationConfig({
@@ -33295,7 +33435,7 @@ function makeRestart(switchroomBin) {
 }
 
 // src/host-control/update-notifier.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync13, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { dirname as dirname10 } from "node:path";
 var FINALIZE_DETAIL_MAX = 450;
@@ -33412,7 +33552,7 @@ class UpdateNotifier {
   }
   readState() {
     try {
-      const raw = readFileSync12(this.opts.statePath, "utf8");
+      const raw = readFileSync13(this.opts.statePath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed === null || typeof parsed !== "object")
         return null;
@@ -33553,13 +33693,13 @@ async function loadConfigResilient() {
     } catch {
       configPath = undefined;
     }
-    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join14(homedir8(), ".switchroom", "agents");
+    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join13(homedir8(), ".switchroom", "agents");
     const listGatewayCandidates = () => {
       const out = [];
       try {
         for (const name of readdirSync7(agentsDir).sort()) {
           const sock = resolve10(agentsDir, name, "telegram", "gateway.sock");
-          if (existsSync16(sock))
+          if (existsSync17(sock))
             out.push({ agent: name, sock });
         }
       } catch {}
@@ -33606,10 +33746,10 @@ async function main() {
 `);
     process.exit(2);
   }
-  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join14(homedir8(), ".switchroom", "agents");
+  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join13(homedir8(), ".switchroom", "agents");
   const resolveGatewaySocket = (agentName) => {
     const sock = resolve10(agentsDir, agentName, "telegram", "gateway.sock");
-    return existsSync16(sock) ? sock : null;
+    return existsSync17(sock) ? sock : null;
   };
   const approvalGateway = new SocketApprovalGateway({
     resolveGatewaySocket,
@@ -33663,7 +33803,7 @@ async function main() {
   const autoRel = config.host_control?.auto_release_check;
   const watcherMode = resolveReleaseWatcherMode(config);
   if (watcherMode.mode !== "off") {
-    const eventsLog = join14(homedir8(), ".switchroom", "release-watcher-events.jsonl");
+    const eventsLog = join13(homedir8(), ".switchroom", "release-watcher-events.jsonl");
     const log = (m) => {
       process.stderr.write(`hostd: ${m}
 `);
@@ -33722,7 +33862,7 @@ async function main() {
 `);
         } else
           notifier = new UpdateNotifier({
-            statePath: join14(homedir8(), ".switchroom", "release-notify-state.json"),
+            statePath: join13(homedir8(), ".switchroom", "release-notify-state.json"),
             repostSuppressMs: cardTimeoutMs,
             isFleetMutationInFlight: () => server.isFleetMutationLocked(),
             startApply: (requestId) => {