switchroom 0.21.14 → 0.21.16

package/vendor/hindsight-memory/scripts/recall.py

@@ -54,6 +54,7 @@ import re  # noqa: E402
 import socket  # noqa: E402
 import sys  # noqa: E402
 import urllib.error  # noqa: E402
+from datetime import datetime  # noqa: E402
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
@@ -81,6 +82,7 @@ from lib.directives import (
 )
 from lib.gateway_ipc import extract_chat_id_from_prompt, extract_topic_from_prompt, extract_user_from_prompt, update_placeholder
 from lib.parallel_recall import run_parallel
+from lib import recall_buffer
 from lib.state import read_state, write_state
 
 # Cost of everything above, charged against the hook ceiling (see
@@ -394,6 +396,148 @@ def _emit_cached_context(context: str) -> None:
     )
 
 
+_PREFETCH_DEGRADED_NOTICE = (
+    "⏳ prefetch not ready and no prior recall is cached for this session — "
+    "proceeding without injected memory this turn."
+)
+
+
+def stale_recall_notice(memories_context: str) -> str:
+    """Wrap a PRIOR turn's cached memories-only block in an explicit
+    staleness marker for the M4 prefetch-buffer fallback path.
+
+    M4 P-REC Fix B (red-team BINDING, MUST NOT regress): `memories_context`
+    must NEVER contain a directives block — the caller is required to pass
+    `LAST_RECALL_STATE`'s `memories_context` field (directives-free by
+    construction, see the write site near `context_message`), never its
+    sibling `context` field (which bundles `directives_block`). Directives
+    stay on the synchronous, always-current fetch path only (M3's
+    directive-decoupling rule) — a stale directives block re-injected from a
+    prior turn could resurrect a rule the user rescinded moments ago.
+    """
+    if not memories_context:
+        return ""
+    return (
+        "⏳ stale (prefetch not ready this turn) — the memories below are "
+        "from the PREVIOUS turn's recall, not this turn's. Treat them as a "
+        "hint, not a confirmed current fact.\n\n" + memories_context
+    )
+
+
+def _handle_prefetch_buffer(config: dict, hook_input: dict, prompt: str) -> bool:
+    """M4 P-REC Fix C (consumer side) — join the Stop-hook producer's
+    prefetch buffer for this session instead of running recall
+    synchronously.
+
+    Gated entirely by `config.get("memoryPrefetchEnabled", False)` at the
+    caller; this function assumes the flag is already on. Returns True iff
+    it emitted an `additionalContext` payload (fresh hit, stale fallback, or
+    the explicit degraded notice) and the caller should return without
+    running the synchronous path. Returns False on a clean no-op miss (flag
+    effectively off / nothing to say) so the caller falls through.
+
+    Never raises past this function's own boundary in normal operation —
+    every internal step is wrapped so a bug here degrades to "fall through
+    to synchronous recall", never a broken turn. (The caller additionally
+    wraps this call in its own try/except as defence in depth.)
+    """
+    session_id = hook_input.get("session_id") or "unknown"
+
+    # Cold-start short-circuit (red-team MAJOR finding): if this session has
+    # NEVER produced a sentinel, polling the full cap on every single
+    # session-open turn would cost ~the poll cap on every fresh session —
+    # the opposite of M4's latency goal. Only poll when a sentinel already
+    # exists (a producer has run at least once for this session).
+    if not recall_buffer.sentinel_exists(session_id):
+        debug_log(config, "Prefetch buffer: no sentinel ever written for this session, cold-start skip")
+    else:
+        cap_ms = int(config.get("memoryPrefetchPollCapMs", 400))
+        recall_buffer.poll_for_sentinel(session_id, last_consumed_token=None, cap_ms=cap_ms)
+
+    payload, _token = recall_buffer.read_if_fresh(session_id, last_consumed_token=None)
+
+    # Directives stay on the synchronous, always-fresh path (M3 rule) even
+    # in the fast path — fetched here directly, never from the buffer.
+    directives_block = None
+    try:
+        bank_id = derive_bank_id(hook_input, config)
+        api_url = get_api_url(config)
+        client = HindsightClient(api_url)
+        directives = fetch_active_directives_cached(
+            client, bank_id, ttl_seconds=config.get("directivesCacheTtlSeconds", DIRECTIVES_CACHE_TTL_SECONDS)
+        )
+        directives_block = format_active_directives_block(directives) if directives else None
+    except Exception as exc:  # pragma: no cover - defensive, directives are best-effort here
+        debug_log(config, f"Prefetch buffer: directive fetch failed: {exc}")
+        directives_block = None
+
+    if payload is not None:
+        memories_block = payload.get("context") or ""
+        parts = [b for b in (directives_block, memories_block) if b]
+        if not parts:
+            return False
+        _emit_cached_context("\n\n".join(parts))
+        return True
+
+    # Miss: no fresh buffer. Fall back to the LAST_RECALL_STATE's
+    # directives-FREE `memories_context` field (Fix B) if one exists for
+    # this session, explicitly marked stale. Never `context` (directive-
+    # contaminated).
+    last = read_state(LAST_RECALL_STATE) or {}
+    stale_memories = last.get("memories_context") or ""
+    stale_block = stale_recall_notice(stale_memories)
+    parts = [b for b in (directives_block, stale_block) if b]
+    if parts:
+        _emit_cached_context("\n\n".join(parts))
+        return True
+
+    if directives_block:
+        _emit_cached_context(directives_block)
+        return True
+
+    # Nothing fresh, nothing stale, nothing cached — say so explicitly
+    # rather than silently emitting no context (so a degraded turn is
+    # legible, matching the #3619 degraded-disclosure precedent).
+    _emit_cached_context(_PREFETCH_DEGRADED_NOTICE)
+    return True
+
+
+def _emit_directives_only(config: dict, hook_input: dict) -> None:
+    """#4756 F2 — directive exemption for the task-notification junk gate.
+
+    The M4 P-REC junk gate skips synchronous recall on synthetic
+    `<task-notification>` turns to avoid burning latency/cost on
+    machine-generated noise. But DIRECTIVES are the one memory class that must
+    survive that gate: an agent's standing rules apply on EVERY turn, synthetic
+    or not, and suppressing them on a sub-agent-handback turn is a behavior
+    change that should not ride along with the noise gate. So the gate drops
+    the non-directive classes (observations/world/etc. — the whole `recall`
+    result set) but still fetches and injects the active directives block,
+    exactly as the prefetch fast path does (M3 directive-decoupling rule).
+
+    Emits nothing when the bank has no active directives (no empty wrapper).
+    Failure-safe: any error → emit nothing rather than break the turn, matching
+    `fetch_active_directives_cached`'s never-raise contract. Deliberately does
+    NOT run the memory `recall` HTTP call — only `list_directives` is touched.
+    """
+    try:
+        bank_id = derive_bank_id(hook_input, config)
+        api_url = get_api_url(config)
+        client = HindsightClient(api_url, config.get("hindsightApiToken"))
+        directives = fetch_active_directives_cached(
+            client,
+            bank_id,
+            ttl_seconds=config.get("directivesCacheTtlSeconds", DIRECTIVES_CACHE_TTL_SECONDS),
+        )
+        directives_block = format_active_directives_block(directives) if directives else None
+    except Exception as exc:  # pragma: no cover - defensive, directives are best-effort here
+        debug_log(config, f"Task-notification skip: directive fetch failed: {exc}")
+        return
+
+    if directives_block:
+        _emit_cached_context(directives_block)
+
+
 def _is_demoted_memory(memory) -> bool:
     """Return True if the memory has any demote-from-recall tag.
 
@@ -1578,6 +1722,257 @@ def looks_like_standing_rule(text) -> bool:
     return bool(_DIRECTIVE_NUDGE_RE.search(scrubbed))
 
 
+# ── Temporal-expression detection for the recall `query_timestamp` anchor ──
+# Switchroom P2 (memory-redesign RFC §5). When the inbound prompt asks a
+# time-relative question ("what did we work on last week", "on the 12th"),
+# the recall body carries an explicit `query_timestamp` anchor so the engine
+# resolves the relative expression and anchors recency scoring against the
+# real ask-time. The anchor is ALWAYS the current wall clock — that is the
+# documented semantics ("when the query is being asked, from the user's
+# perspective", https://hindsight.vectorize.io/developer/api/recall) — the
+# regex only GATES whether the field is sent, it does not resolve the phrase
+# itself (the engine does that server-side against the anchor we supply).
+#
+# Deterministic regex only — NO model call (claude-native invariant, same as
+# the directive-capture nudge above). The match is a cheap substring scan on
+# the already-stripped prompt, so it never extends the recall hook's critical
+# path (the 12s ceiling / parallel deadline live entirely on the network I/O
+# below). Detection is deliberately conservative: it requires a preposition or
+# quantifier around ambiguous tokens (bare weekday / month / "may") so an
+# ordinary sentence does not fire the field. A false negative merely omits an
+# anchor the server would default to anyway; a false positive sends the true
+# ask-time, which is the correct anchor regardless — so both error directions
+# degrade to today's behaviour.
+_TEMPORAL_EXPRESSION_RE = re.compile(
+    r"""(?ix)
+    (?:
+      # --- absolute-relative day words ---
+        \b (?: yesterday | tonight | tomorrow ) \b
+      | \b last \s+ night \b
+      # --- this/last/next + period ---
+      | \b (?: this | last | next | past ) \s+
+            (?: week | month | year | quarter | fortnight | weekend
+              | morning | afternoon | evening | night | decade ) \b
+      # --- earlier / other-day framings ---
+      | \b the \s+ other \s+ (?: day | week | night ) \b
+      | \b earlier \s+ (?: today | this \s+ (?: week | month | year ) ) \b
+      | \b a \s+ (?: while | moment ) \s+ ago \b
+      # --- "<N> <unit> ago" (worded or digit quantifier) ---
+      | \b (?: a | an | one | two | three | four | five | six | seven | eight
+            | nine | ten | \d+ | couple \s+ of | few ) \s+
+            (?: second | minute | hour | day | week | month | year ) s? \s+ ago \b
+      # --- weekday, only with a temporal preposition/qualifier ---
+      | \b (?: this | last | next | on | since | by ) \s+
+            (?: monday | tuesday | wednesday | thursday | friday
+              | saturday | sunday ) \b
+      # --- ordinal day-of-month ("on the 12th", "by the 3rd") ---
+      | \b (?: on | by | since | before | after | around ) \s+ the \s+
+            \d{1,2} (?: st | nd | rd | th ) \b
+      # --- month name, only with a temporal preposition ---
+      | \b (?: in | on | since | during | back \s+ in | early | late ) \s+
+            (?: january | february | march | april | may | june | july
+              | august | september | october | november | december ) \b
+    )
+    """
+)
+
+
+# RFC phase4 P3 — deterministic operator-profile capture nudge.
+#
+# Ken's first stated want is "save memories about him" (RFC §0 constraint 5a).
+# Auto-retain does store transcript facts, but there is no deterministic signal
+# that a durable *profile fact* about the operator himself just went by, so
+# capture-as-profile is left to model discretion — the same per-agent lottery
+# Stage A measured for directives. This mirrors the shipped directive-capture
+# nudge (recall.py #2848): a POSITIVE regex detects a first-person durable
+# self-statement ("I prefer …", "my … is …", "I always …", "remind me that
+# I …"); a NEGATIVE regex scrubs the two shapes that would otherwise misfire —
+# questions ("do I prefer …?", "what's my …?") and third-/second-party
+# attributions ("you said I prefer …", "she claims my …") — BEFORE the positive
+# match. On a hit the hook appends a terse advisory telling the model to persist
+# the fact with an explicit mcp__hindsight__retain carrying a `profile:ken` tag
+# into THIS AGENT'S OWN bank. Pure regex — NO model callsite (the claude-native
+# invariant forbids a classifier call); the model makes the judgment in-session
+# and calls retain itself (chat-legible). The hook NEVER writes on its own.
+#
+# On by default; operators opt out per-agent via memory.profile_capture_nudge
+# =false → HINDSIGHT_PROFILE_CAPTURE_NUDGE (recall.py falls back to True).
+#
+# ROUTING CONSTRAINT (RFC §0 constraint 2, §7 Q3): the fact goes to the agent's
+# OWN bank, NOT a shared/cross-agent person bank (ken-profile/lisa-profile).
+# The tag makes the facts cheap to find and retire later if Q3 is answered
+# differently. The `profile:ken` operator identity is intentionally literal —
+# this fleet has a single named operator (Ken); a multi-operator deployment
+# would parameterise the tag, which is out of scope for P3.
+#
+# CONSERVATISM (RFC §7 Q1, unanswered): the RFC flags that this regex set is
+# derived from an ASSUMPTION that the profile facts Ken wants are
+# preference-/identity-shaped. Until Q1 is answered from a real instance, the
+# positive set is deliberately TIGHT (favouring false negatives) — only clearly
+# durable first-person framings, not bare "I like"/"I use" reactions that are
+# usually one-off. If Q1's answer is not preference-shaped, this set is wrong
+# and should be re-derived before it is relied on.
+_PROFILE_NUDGE_NEGATIVE_RE = re.compile(
+    r"""(?ix)
+    (?:
+      # --- interrogatives: a question ABOUT the operator is not a statement
+      #     OF a durable fact. Scrub the "<wh|aux> [do] I" / "<aux> my" lead so
+      #     the following "I prefer" / "my X is" can't fire. ---
+        \b (?: what | which | where | when | why | how | do | did | does
+             | should | would | could | can | are | is | was | were )
+          \s+ (?: do \s+ )? i \b
+      | \b what (?: ['’]? s | \s+ is | \s+ are ) \s+ my \b
+      | \b (?: where | when | is | are | was | were ) \s+ my \b
+      | \b remind \s+ me \s+ what \b
+      # --- attributions: a fact the operator ascribes to someone else (or to
+      #     the agent) is not the operator stating his own profile. Scrub the
+      #     attributed clause up to the next clause boundary. Stop at a comma as
+      #     well as sentence-enders so a trailing real fact in the SAME sentence
+      #     ("she said X, my timezone is Melbourne") still reaches the positive
+      #     matcher instead of being swallowed. ---
+      | \b (?: he | she | they | you | who | someone | everyone | nobody )
+          \s+ (?: said | says | say | claimed | claims | thinks? | thought
+                | told | mentions? | mentioned | asks? | asked | wants? | wanted
+                | wrote | believes? | reckons? )
+          \b [^.?!,]*
+      # --- pleasantries that embed a bare always/never after "I". ---
+      | \b i \s+ (?: always | never )
+          \s+ (?: appreciate | enjoy | 'm \s+ happy | am \s+ happy | love \s+ working ) \b
+      # --- "I'm a <hedge>" is a transient mood/quantifier, not "I'm a <noun>"
+      #     identity ("I'm a bit tired", "I'm a little confused"). Scrub the
+      #     "I'm a/an" lead so the identity arm can't fire on it. ---
+      | \b i (?: \s+ am | \s* ['’] m ) \s+ (?: a | an )
+          \s+ (?: bit | little | lot | tad | touch | bunch | couple | few
+                | fan \b | big \s+ fan ) \b
+      # --- "call me <phone-phrasing>" is a request, not a name form
+      #     ("call me back", "call me later"). Scrub so the name arm ("call me
+      #     Ken") is the only thing left that can fire. ---
+      | \b call \s+ me \s+ (?: back | later | tomorrow | tonight | soon | again
+                | when | if | once | after | before | at | on | in | asap ) \b
+    )
+    """
+)
+
+
+def detect_query_timestamp(text, now=None) -> "str | None":
+    """Return an ISO 8601 ask-time anchor when ``text`` carries a temporal
+    expression, else ``None``.
+
+    Deterministic and IO-free — a single regex scan, no model call and no
+    clock dependency the caller cannot control (``now`` is injectable so the
+    behaviour is unit-testable to the exact output string). When a temporal
+    phrase is present the anchor returned is the CURRENT time, because
+    ``query_timestamp`` is defined by the engine as *when the query is asked*,
+    not the period the phrase names — the engine resolves the phrase against
+    this anchor. ``None`` means "send no field", which keeps the recall body
+    byte-identical to a pre-P2 client.
+
+    The anchor carries the LOCAL wall-clock offset (``datetime.now()`` +
+    ``.astimezone()``), NOT UTC. This matters precisely on the dimension P2
+    serves: for a Melbourne evening query "what did we do yesterday", a
+    UTC-stamped anchor (``+00:00``) can be a calendar day ahead of the
+    operator's real day, so the engine would resolve "yesterday"/"last
+    week"/"on the 12th" against the wrong day. ``.astimezone()`` with no
+    argument attaches the process TZ (the container clock is already
+    Australia/Melbourne), which is the operator's actual day. Never
+    ``timezone.utc`` here — that would re-introduce the off-by-one this fix
+    removes.
+
+    Returns ``None`` on empty / non-string input so a caller can pass a raw
+    prompt without a guard.
+    """
+    if not isinstance(text, str) or not text.strip():
+        return None
+    if not _TEMPORAL_EXPRESSION_RE.search(text):
+        return None
+    anchor = now if now is not None else datetime.now().astimezone()
+    return anchor.isoformat()
+
+
+_PROFILE_NUDGE_RE = re.compile(
+    r"""(?ix)
+    (?:
+      # --- stated preferences / tastes ---
+        \b i \s+ prefer \b
+      | \b i['’]? d \s+ prefer \b
+      | \b my \s+ preference \s+ (?: is | are ) \b
+      | \b i \s+ (?: hate | love | despise | adore | dislike
+                  | can ['’]? t \s+ stand ) \b
+      # --- durable self-facts: "my <ATTRIBUTE> is/are/'s <value>".
+      #     ATTRIBUTE is a TIGHT allow-list of durable identity attributes.
+      #     A free noun ("my build is failing", "my container is down", "my PR
+      #     is ready") is transient dev state, not a profile fact — firing on
+      #     it inverts the RFC's favour-false-negatives constraint on this very
+      #     agent (klanker), so the free-`\w+` arm is deliberately NOT used. ---
+      | \b my \s+
+          (?: name | e-?mail | timezone | time \s+ zone | address
+            | (?: phone | mobile | cell ) (?: \s+ number )? | number
+            | birthday | birthdate | dob | anniversary | age | pronouns?
+            | handle | username | nickname | initials
+            | employer | company | partner | wife | husband | spouse
+            | girlfriend | boyfriend | kids? | children | child | son
+            | daughter | sister | brother | mother | father | mom | dad
+            | parents | dog | cat | pet | diet | allerg(?: y | ies )
+            | location | city | country | hometown )
+          (?: \s+ \w+ )?
+          (?: \s+ (?: is | are ) | \s* ['’] s ) \b
+      # --- identity / situation ---
+      | \b i \s+ live \s+ (?: in | at | near ) \b
+      | \b i \s+ work \s+ (?: at | as | for | in ) \b
+      | \b i (?: \s+ am | \s* ['’] m ) \s+ (?: allergic \s+ to
+            | based \s+ (?: in | at ) | from | located \s+ in
+            | vegetarian | vegan | pescatarian | teetotal ) \b
+      | \b i (?: \s+ am | \s* ['’] m ) \s+ (?: a | an ) \s+ \w+
+      # --- dietary / abstention identity ("I don't eat meat") ---
+      | \b i \s+ (?: do \s* n['’]? t | don['’]? t | do \s+ not )
+            \s+ (?: eat | drink | use | own | drive ) \b
+      # --- name / address form ("call me Ken") ---
+      | \b call \s+ me \b
+      # --- durable habits (first person; questions pre-scrubbed) ---
+      | \b i \s+ always \b
+      | \b i \s+ usually \b
+      | \b i \s+ normally \b
+      | \b i \s+ never \b
+      # --- explicit memory framing about the operator himself ---
+      | \b remember \s+ that \s+ i \b
+      | \b remind \s+ me \s+ that \s+ i \b
+    )
+    """
+)
+
+# Terse, advisory. The model decides IN-SESSION whether this is a durable
+# operator-profile fact and, if so, calls retain itself (chat-legible),
+# tagging it `profile:ken` and routing it to the agent's OWN bank. Kept short
+# so it costs a handful of tokens on a false positive.
+_PROFILE_CAPTURE_NUDGE = (
+    "<profile_capture_check>\n"
+    "The latest user message states a durable fact about the operator himself "
+    '(e.g. a preference "I prefer …", an identity/situation fact "my … is …", '
+    'a habit "I always …", or "remind me that I …") — NOT an instruction about '
+    "how you should behave (that is the directive path). If it is a DURABLE "
+    "fact worth remembering about him across sessions — not a one-off for this "
+    "task — persist it NOW with mcp__hindsight__retain, in his own words, "
+    'tagged ["profile:ken"], into THIS AGENT\'S OWN bank (the default bank — do '
+    "NOT route it to a shared or cross-agent person bank). If an equivalent "
+    "fact is already stored, do not duplicate it. If it is only a passing "
+    "remark, ignore this note and just answer.\n"
+    "</profile_capture_check>"
+)
+
+
+def looks_like_profile_statement(text) -> bool:
+    """Deterministic (regex-only) test for an operator durable-profile shape.
+
+    Question and attribution shapes ("do I prefer …?", "what's my …?", "you
+    said I prefer …") are scrubbed BEFORE the positive match so they can't trip
+    the first-person signals. Returns False on empty / non-string input. No
+    model call — the model does the actual judgment in-session (RFC P3)."""
+    if not isinstance(text, str) or not text.strip():
+        return False
+    scrubbed = _PROFILE_NUDGE_NEGATIVE_RE.sub(" ", text)
+    return bool(_PROFILE_NUDGE_RE.search(scrubbed))
+
+
 def _combine_context(base, nudge) -> str:
     """Join the recall/directives context with the directive-capture nudge,
     skipping empties. Either may be None/empty. The nudge is kept OUT of the
@@ -1719,6 +2114,38 @@ def main():
         debug_log(config, "Prompt too short for recall, skipping")
         return
 
+    # M4 P-REC junk gate: `<task-notification>` is the CLI-native envelope a
+    # sub-agent's own scheduler/harness prepends on a synthetic follow-up
+    # turn — distinct from the gateway's `<channel source=...>` wrapper
+    # (a real user message) and from `is_synthetic_inbound`. Recall on a
+    # task-notification turn burns latency/cost on a turn no human is
+    # waiting on and whose "query" is machine-generated noise, not intent.
+    # Deterministic prefix check only — never a content classifier. On by
+    # default (`recallSkipTaskNotification`); flips off for an agent that
+    # deliberately wants recall on these turns.
+    if config.get("recallSkipTaskNotification", True) and prompt.startswith("<task-notification"):
+        # #4756 F2: skip the noisy NON-directive recall, but directives are
+        # exempt — they are HARD RULES that apply on every turn, synthetic or
+        # not, so still fetch + inject the active directives block. Only the
+        # observation/world memory classes (the `recall` result set) are
+        # suppressed here; `_emit_directives_only` never touches `recall`.
+        debug_log(config, "Prompt is a task-notification envelope, skipping recall (directives exempt)")
+        _emit_directives_only(config, hook_input)
+        return
+
+    # M4 P-REC Fix C (consumer side) — the whole prefetch-buffer mechanism
+    # is gated by `memoryPrefetchEnabled`, default OFF/falsy. When on, try
+    # the buffer-join fast path first; on any hit (fresh or stale-fallback)
+    # it emits and returns, short-circuiting the synchronous recall below.
+    # A miss (disabled, cold-start, buffer absent, or any internal error)
+    # falls through to the existing synchronous path untouched.
+    if config.get("memoryPrefetchEnabled", False):
+        try:
+            if _handle_prefetch_buffer(config, hook_input, prompt):
+                return
+        except Exception as exc:  # pragma: no cover - defensive, never break recall
+            debug_log(config, f"Prefetch buffer join failed, falling back to sync recall: {exc}")
+
     # Switchroom-local: skip recall on conversational acks.
     #
     # The 5-char short-circuit catches `ok`/`yes`/`no`/`ty` but passes
@@ -1780,6 +2207,42 @@ def main():
         nudge_block = _DIRECTIVE_CAPTURE_NUDGE
         debug_log(config, "Directive-capture nudge: inbound looks like a standing rule")
 
+    # Switchroom P2 (memory-redesign RFC §5) — anchor recall to the ask-time
+    # when the inbound prompt is time-relative, so the engine resolves "last
+    # week"/"yesterday"/"on the 12th" against the real now and scores recency
+    # from it. Deterministic regex on `_stripped` (same channel-stripped text
+    # the nudge uses); no model call, microsecond cost, off the network path.
+    # `None` when the prompt has no temporal phrase → the field is never added
+    # to the recall body (byte-identical to pre-P2). The `recallQueryTimestamp`
+    # key is an IN-CODE guard only — it has NO schema/scaffold/env surface, so
+    # a settings.json edit would be clobbered on the next `switchroom apply`
+    # (the plugin dir is re-copied from vendor/). Per RFC P2 the rollback is
+    # "stop sending the field" = revert the commit; if a runtime knob is ever
+    # wanted, wire it the full schema->scaffold->config->env way
+    # `directiveCaptureNudge` is, not by hand-editing settings.json.
+    query_timestamp = None
+    if config.get("recallQueryTimestamp", True):
+        query_timestamp = detect_query_timestamp(_stripped)
+        if query_timestamp:
+            debug_log(config, "Recall query_timestamp anchor: inbound is time-relative")
+
+    # RFC phase4 P3 — operator-profile capture nudge. Independent second nudge
+    # class: deterministic (regex) detection of a first-person durable
+    # self-statement by the operator; when it fires we append a terse advisory
+    # telling the model to persist it with an explicit retain carrying a
+    # `profile:ken` tag into the agent's OWN bank (RFC §0 constraint 2 forbids a
+    # cross-agent person bank). Computed on `_stripped` like the directive
+    # nudge, so the `<channel …>` wrapper never trips it. Both nudges may fire
+    # on one turn (e.g. "I prefer …" is both preference and profile-shaped) —
+    # they give different advice (create_directive vs profile:ken retain) and
+    # are combined independently at emit time. On by default;
+    # HINDSIGHT_PROFILE_CAPTURE_NUDGE=false (or memory.profile_capture_nudge:
+    # false) turns it off. No model callsite (claude-native invariant).
+    profile_nudge_block = None
+    if config.get("profileCaptureNudge", True) and looks_like_profile_statement(_stripped):
+        profile_nudge_block = _PROFILE_CAPTURE_NUDGE
+        debug_log(config, "Profile-capture nudge: inbound states a durable operator fact")
+
     session_id = hook_input.get("session_id") or ""
 
     # Switchroom #303 — push a "📚 recalling memories" status to the
@@ -1889,7 +2352,11 @@ def main():
             # #2848 — append the nudge to the cached context at emit time
             # (the cache stores nudge-free context; the nudge is re-derived
             # from the current prompt, so a hit can't replay a stale one).
-            _emit_cached_context(_combine_context(cached_context, nudge_block))
+            _emit_cached_context(
+                _combine_context(
+                    _combine_context(cached_context, nudge_block), profile_nudge_block
+                )
+            )
             _write_recall_log({
                 "ts": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
                 "session_id": (session_id or "")[:32],
@@ -1962,6 +2429,15 @@ def main():
                 "active_topic_alias": active_topic_alias,
                 "topic_filter_mode": _topic_filter_mode(),
                 "directive_nudge": bool(nudge_block),
+                # Switchroom P2 — the ISO ask-time anchor sent to recall, or
+                # null when the inbound had no temporal phrase. Logged on cache
+                # hits too (no bank ran, so nothing was sent this turn) for a
+                # uniformly queryable schema and to measure the firing rate
+                # from day one (precedent: `directive_nudge` above).
+                "query_timestamp": query_timestamp,
+                # RFC P3 — profile-capture nudge firing rate, measurable from
+                # day one (mirrors the directive_nudge precedent).
+                "profile_nudge": bool(profile_nudge_block),
                 # E1 / PR8 (#3369) — no banks ran on a cache hit, so the
                 # transcript fallback never fires; carry the zeroed fields for a
                 # uniformly queryable schema.
@@ -2107,6 +2583,12 @@ def main():
 
     def _make_bank_task(target_bank_id, b_tags, b_tags_match, b_tag_groups, timeout_override=None):
         def _bank_task():
+            # Switchroom P2 — include the ask-time anchor ONLY when the prompt
+            # was time-relative. Passing it conditionally (not as `=None`) keeps
+            # the client CALL — not just the wire body — byte-identical on the
+            # common non-temporal turn, so a caller/fake with a narrower recall
+            # signature is never handed a kwarg it did not have before.
+            qts_kwarg = {"query_timestamp": query_timestamp} if query_timestamp else {}
             return client.recall(
                 bank_id=target_bank_id,
                 query=search_query,
@@ -2148,6 +2630,8 @@ def main():
                     if timeout_override is None
                     else timeout_override
                 ),
+                # Switchroom P2 — present only on a time-relative turn (see above).
+                **qts_kwarg,
             )
         return _bank_task
 
@@ -2735,6 +3219,14 @@ def main():
         "topic_filter_mode": topic_filter_mode,
         "topic_dropped": topic_dropped,
         "directive_nudge": bool(nudge_block),
+        # Switchroom P2 — the ISO ask-time anchor actually sent to recall this
+        # turn (null when the inbound had no temporal phrase), so the field's
+        # firing rate is measurable from day one against the RFC's falsification
+        # window (precedent: `directive_nudge` above).
+        "query_timestamp": query_timestamp,
+        # RFC P3 — profile-capture nudge firing rate, measurable from day one
+        # (mirrors the directive_nudge precedent).
+        "profile_nudge": bool(profile_nudge_block),
         # Switchroom hindsight-leverage E1 / PR8 (#3369) — transcript-grep
         # fallback telemetry so its firing (and its bounds) are visible per turn
         # in recall_log.jsonl. `transcript_fallback` True only on an all-zero,
@@ -2775,10 +3267,19 @@ def main():
     # is precisely the turn on which the agent must not assume it remembers.
     # #3837: so is a set the score floor withheld entirely.
     if not directives_block and not memories_block and not transcript_fallback_block:
-        if degraded_block or withheld_block or nudge_block:
+        if degraded_block or withheld_block or nudge_block or profile_nudge_block:
             _emit_cached_context(
                 "\n\n".join(
-                    [b for b in (degraded_block, withheld_block, nudge_block) if b]
+                    [
+                        b
+                        for b in (
+                            degraded_block,
+                            withheld_block,
+                            nudge_block,
+                            profile_nudge_block,
+                        )
+                        if b
+                    ]
                 )
             )
         return
@@ -2808,6 +3309,16 @@ def main():
         LAST_RECALL_STATE,
         {
             "context": context_message,
+            # M4 P-REC Fix B (red-team BINDING): a directives-FREE sibling of
+            # `context`, memories/transcript-fallback only. The stale-buffer
+            # fallback (`_handle_prefetch_buffer`) reads THIS field, never
+            # `context` — `context` bundles `directives_block` (M3's
+            # directive-decoupling rule forbids re-injecting stale directives
+            # from a prior turn's cache; directives stay on the synchronous,
+            # always-fresh fetch path only).
+            "memories_context": "\n\n".join(
+                [b for b in (memories_block, transcript_fallback_block) if b]
+            ),
             "saved_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
             "bank_id": bank_id,
             "result_count": len(results),
@@ -2836,9 +3347,13 @@ def main():
             "hookEventName": "UserPromptSubmit",
             "additionalContext": _combine_context(
                 _combine_context(
-                    _combine_context(degraded_block, withheld_block), context_message
+                    _combine_context(
+                        _combine_context(degraded_block, withheld_block),
+                        context_message,
+                    ),
+                    nudge_block,
                 ),
-                nudge_block,
+                profile_nudge_block,
             ),
         }
     }

package/vendor/hindsight-memory/scripts/reconcile_tail.py

@@ -109,18 +109,10 @@ def _human_turns(messages: list) -> int:
     )
 
 
-def _tail_after(messages: list, last_uuid: str | None) -> list:
-    """Return the transcript entries AFTER the watermark anchor.
-
-    No watermark, or a stale anchor compaction removed → the whole transcript is
-    the gap (a safe re-upsert, never a skip).
-    """
-    if not last_uuid:
-        return list(messages)
-    for i, m in enumerate(messages):
-        if isinstance(m, dict) and m.get("uuid") == last_uuid:
-            return messages[i + 1:]
-    return list(messages)
+# The transcript tail-slice is shared with the incremental SessionEnd sweep
+# (retain.py, memory-RFC P1); the single implementation lives in lib.watermark
+# so there is only ever one copy of this reconcile/watermark-critical slice.
+_tail_after = watermark.tail_after
 
 
 def _session_id_from_path(path: str) -> str: