switchroom 0.21.15 → 0.21.17

package/dist/host-control/main.js

@@ -11143,6 +11143,11 @@ var init_schema = __esm(() => {
       }
     }).optional().describe("Operator-declared, per-specialist Hindsight mental models (RFC " + "Phase 5). Named, opt-in curated reflections this agent's bank should " + "carry — e.g. a coach's 'training-plan-state' or a lawyer's " + "'open-matters'. Ensured idempotently at scaffold/reconcile: NOTHING " + "is created unless declared here (zero declarations = zero models, " + "matching post-#2447 behaviour), and no fixed identity model is " + "reintroduced — 'who the user is' stays owned by dedicated profile " + "banks (users.*.profile_bank), never a per-agent model. Per-agent " + "ONLY: intentionally not accepted at the defaults/profile tier, so a " + "model can never be fleet-seeded — each specialist opts in on its own " + "(the invariant-clean inverse of the retired blind auto-seeding)."),
     observations_mission: exports_external.string().optional().describe("Steers what the observation-consolidation LLM synthesises from raw " + "facts (the higher-order 'what patterns matter' lens). Cascade: override."),
+    rules_block: exports_external.boolean().default(false).describe("Memory v2 M3 go-live flag (M1 only DEFINES this, default false; " + "M3 flips it per agent). When true, the sanctioned rules/index " + "blocks render live in this agent's CLAUDE.md (marker-delimited, " + "below the `# --- Yours ---` line) AND the permission deny for " + "direct Edit/Write of the agent's own CLAUDE.md is seeded — the " + "flag couples deny + tools together so a live deny never orphans " + "the invited free-text edit path (the `memory_edit_yours` verb is " + "the only sanctioned writer once flipped). Unset/false ⇒ byte-" + "identical to pre-M1 behaviour: no blocks, no deny, dark build. " + "Cascade: override (per-agent wins over default; never fleet-" + "seeded — each agent's flip is a deliberate M3 rollout step)."),
+    orientation: exports_external.boolean().optional().describe("Memory v2 M5 go-live flag (Surface B: orientation-at-boot), " + "effective default false — dark build (unset ⇒ OFF, applied by the " + "scaffold resolver, NOT a Zod .default() — a hard default here would " + "shadow the per-agent value in the cascade the way it does every other " + "memory knob). When true, the orientation SessionStart " + "hook injects this agent's cron-refreshed `orientation` mental model " + "into context at boot AND re-seats it after every compaction (E-88), " + "deterministically and with zero tool call. Unset/false ⇒ byte-" + "identical to pre-M5 behaviour: the hook no-ops before any bank " + "resolve or network call. Per-agent ONLY (never fleet-seeded — a " + "flip is a deliberate canary/rollout step gated on the agent's " + "m2-residue measurement + operator-created model, carve-M5 §7). " + "Cascade: override (per-agent wins over default)."),
+    orientation_reinject_turns: exports_external.number().int().min(0).optional().describe("Memory v2 M5 optional per-turn re-inject cadence, effective default " + "0 = off (unset ⇒ 0, applied by the scaffold resolver, not a Zod " + ".default() — same cascade-shadowing reason as `orientation`). At 0 the " + "briefing is injected only at SessionStart + compaction (the cheap " + "path). N>0 " + "would additionally re-inject the orientation briefing every N turns; " + "priced at ~55M tok/30d at every-turn, which is WHY it defaults off " + "(carve-M5 §2/§4). Only late-session context loss should ever set it, " + "per-agent, measured. A stripped/absent value fails to 0 (fail-safe " + "AND fail-cheap). Per-agent ONLY. Cascade: override."),
+    orientation_cadence_hours: exports_external.number().int().min(1).optional().describe("Memory v2 M5 per-agent refresh cadence tier (hours), effective " + "default 48 (unset ⇒ 48, applied by the scaffold resolver, not a Zod " + ".default() — a hard default would shadow a `defaults.memory." + "orientation_cadence_hours` fleet value in the cascade). " + "The fast-churning agents (klanker, overlord) set 24; everyone else " + "inherits 48 (carve-M5 §6, Ken's locked tiered cadence). Drives BOTH " + "the out-of-session refresh scheduler AND the staleness guard's " + "per-tier thresholds (stale prefix at 1.5× cadence, cold degrade at " + "3×) — so a fixed 36h can never mislabel a 48h-tier agent as stale a " + "day early. Modelled as an explicit int (not a hard-coded name list) " + "so the tiering is data-driven and auditable. A cost knob, not an " + "enablement knob: a stripped/absent value failing to 48 is safe " + "(the cheaper tier). Cascade: override (per-agent wins over default); " + "unlike `orientation`/`_reinject_turns` it IS accepted at the " + "defaults/profile tier."),
+    inject_directives: exports_external.boolean().optional().describe("Memory v2 M3 Surface-A directive-injection switch (default TRUE — " + "on-by-default via the plugin settings.json stamp + config.py " + "DEFAULTS). When left unset the agent keeps injecting the " + "`<active_directives>` block on every turn, byte-identical to pre-M3. " + "Set FALSE to SUPPRESS that injection for this agent — its standing " + "rules are then served from the live rules block (memory.rules_block) " + "instead of re-injected directives, which is the change that collapses " + "the always-on directive-token spend (E-41). The suppression is " + "fail-safe and re-checked every turn in recall.py: it fires ONLY when " + "a non-empty rules block is physically present in the agent's " + "CLAUDE.md — a false flag with an empty/absent block keeps injecting " + "AND emits a degraded-canary notice, so a zero-standing-rules turn is " + "unreachable. Requires memory.rules_block=true first (the block must " + "be live before injection is turned off — enforce the ordering with " + "`switchroom memory flip`, never a bare flag flip). Coordinates with " + "M4's memory.recall prefetch (memoryPrefetchEnabled): the same guard " + "gates all three recall.py emit sites so a flipped agent leaks no " + "directive on a cache/prefetch hit. Cascade: override, per-agent ONLY " + "(never fleet-seeded from the defaults/profile tier — each flip is a " + "deliberate staggered M3 rollout step, same darkness safeguard as " + "rules_block). Default-true is the fail-safe direction under the " + "Zod-strip footgun: a stripped/misread key keeps the agent injecting."),
     disposition: exports_external.object({
       skepticism: exports_external.number().int().min(1).max(5).optional().describe("How much the bank doubts unverified claims (1-5; engine default 3)."),
       literalism: exports_external.number().int().min(1).max(5).optional().describe("How literally the bank reads statements vs inferring intent (1-5; engine default 3)."),
@@ -11588,6 +11593,7 @@ var init_schema = __esm(() => {
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
       profile_capture_nudge: exports_external.boolean().optional(),
+      orientation_cadence_hours: exports_external.number().int().min(1).optional(),
       anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,
@@ -21592,7 +21598,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.21.15";
+var VERSION = "0.21.17";
 
 // src/setup/hindsight-recall-passthrough.ts
 var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });

package/dist/vault/approvals/kernel-server.js

@@ -4583,6 +4583,11 @@ var init_schema = __esm(() => {
       }
     }).optional().describe("Operator-declared, per-specialist Hindsight mental models (RFC " + "Phase 5). Named, opt-in curated reflections this agent's bank should " + "carry — e.g. a coach's 'training-plan-state' or a lawyer's " + "'open-matters'. Ensured idempotently at scaffold/reconcile: NOTHING " + "is created unless declared here (zero declarations = zero models, " + "matching post-#2447 behaviour), and no fixed identity model is " + "reintroduced — 'who the user is' stays owned by dedicated profile " + "banks (users.*.profile_bank), never a per-agent model. Per-agent " + "ONLY: intentionally not accepted at the defaults/profile tier, so a " + "model can never be fleet-seeded — each specialist opts in on its own " + "(the invariant-clean inverse of the retired blind auto-seeding)."),
     observations_mission: exports_external.string().optional().describe("Steers what the observation-consolidation LLM synthesises from raw " + "facts (the higher-order 'what patterns matter' lens). Cascade: override."),
+    rules_block: exports_external.boolean().default(false).describe("Memory v2 M3 go-live flag (M1 only DEFINES this, default false; " + "M3 flips it per agent). When true, the sanctioned rules/index " + "blocks render live in this agent's CLAUDE.md (marker-delimited, " + "below the `# --- Yours ---` line) AND the permission deny for " + "direct Edit/Write of the agent's own CLAUDE.md is seeded — the " + "flag couples deny + tools together so a live deny never orphans " + "the invited free-text edit path (the `memory_edit_yours` verb is " + "the only sanctioned writer once flipped). Unset/false ⇒ byte-" + "identical to pre-M1 behaviour: no blocks, no deny, dark build. " + "Cascade: override (per-agent wins over default; never fleet-" + "seeded — each agent's flip is a deliberate M3 rollout step)."),
+    orientation: exports_external.boolean().optional().describe("Memory v2 M5 go-live flag (Surface B: orientation-at-boot), " + "effective default false — dark build (unset ⇒ OFF, applied by the " + "scaffold resolver, NOT a Zod .default() — a hard default here would " + "shadow the per-agent value in the cascade the way it does every other " + "memory knob). When true, the orientation SessionStart " + "hook injects this agent's cron-refreshed `orientation` mental model " + "into context at boot AND re-seats it after every compaction (E-88), " + "deterministically and with zero tool call. Unset/false ⇒ byte-" + "identical to pre-M5 behaviour: the hook no-ops before any bank " + "resolve or network call. Per-agent ONLY (never fleet-seeded — a " + "flip is a deliberate canary/rollout step gated on the agent's " + "m2-residue measurement + operator-created model, carve-M5 §7). " + "Cascade: override (per-agent wins over default)."),
+    orientation_reinject_turns: exports_external.number().int().min(0).optional().describe("Memory v2 M5 optional per-turn re-inject cadence, effective default " + "0 = off (unset ⇒ 0, applied by the scaffold resolver, not a Zod " + ".default() — same cascade-shadowing reason as `orientation`). At 0 the " + "briefing is injected only at SessionStart + compaction (the cheap " + "path). N>0 " + "would additionally re-inject the orientation briefing every N turns; " + "priced at ~55M tok/30d at every-turn, which is WHY it defaults off " + "(carve-M5 §2/§4). Only late-session context loss should ever set it, " + "per-agent, measured. A stripped/absent value fails to 0 (fail-safe " + "AND fail-cheap). Per-agent ONLY. Cascade: override."),
+    orientation_cadence_hours: exports_external.number().int().min(1).optional().describe("Memory v2 M5 per-agent refresh cadence tier (hours), effective " + "default 48 (unset ⇒ 48, applied by the scaffold resolver, not a Zod " + ".default() — a hard default would shadow a `defaults.memory." + "orientation_cadence_hours` fleet value in the cascade). " + "The fast-churning agents (klanker, overlord) set 24; everyone else " + "inherits 48 (carve-M5 §6, Ken's locked tiered cadence). Drives BOTH " + "the out-of-session refresh scheduler AND the staleness guard's " + "per-tier thresholds (stale prefix at 1.5× cadence, cold degrade at " + "3×) — so a fixed 36h can never mislabel a 48h-tier agent as stale a " + "day early. Modelled as an explicit int (not a hard-coded name list) " + "so the tiering is data-driven and auditable. A cost knob, not an " + "enablement knob: a stripped/absent value failing to 48 is safe " + "(the cheaper tier). Cascade: override (per-agent wins over default); " + "unlike `orientation`/`_reinject_turns` it IS accepted at the " + "defaults/profile tier."),
+    inject_directives: exports_external.boolean().optional().describe("Memory v2 M3 Surface-A directive-injection switch (default TRUE — " + "on-by-default via the plugin settings.json stamp + config.py " + "DEFAULTS). When left unset the agent keeps injecting the " + "`<active_directives>` block on every turn, byte-identical to pre-M3. " + "Set FALSE to SUPPRESS that injection for this agent — its standing " + "rules are then served from the live rules block (memory.rules_block) " + "instead of re-injected directives, which is the change that collapses " + "the always-on directive-token spend (E-41). The suppression is " + "fail-safe and re-checked every turn in recall.py: it fires ONLY when " + "a non-empty rules block is physically present in the agent's " + "CLAUDE.md — a false flag with an empty/absent block keeps injecting " + "AND emits a degraded-canary notice, so a zero-standing-rules turn is " + "unreachable. Requires memory.rules_block=true first (the block must " + "be live before injection is turned off — enforce the ordering with " + "`switchroom memory flip`, never a bare flag flip). Coordinates with " + "M4's memory.recall prefetch (memoryPrefetchEnabled): the same guard " + "gates all three recall.py emit sites so a flipped agent leaks no " + "directive on a cache/prefetch hit. Cascade: override, per-agent ONLY " + "(never fleet-seeded from the defaults/profile tier — each flip is a " + "deliberate staggered M3 rollout step, same darkness safeguard as " + "rules_block). Default-true is the fail-safe direction under the " + "Zod-strip footgun: a stripped/misread key keeps the agent injecting."),
     disposition: exports_external.object({
       skepticism: exports_external.number().int().min(1).max(5).optional().describe("How much the bank doubts unverified claims (1-5; engine default 3)."),
       literalism: exports_external.number().int().min(1).max(5).optional().describe("How literally the bank reads statements vs inferring intent (1-5; engine default 3)."),
@@ -5028,6 +5033,7 @@ var init_schema = __esm(() => {
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
       profile_capture_nudge: exports_external.boolean().optional(),
+      orientation_cadence_hours: exports_external.number().int().min(1).optional(),
       anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,

package/dist/vault/broker/server.js

@@ -4179,6 +4179,11 @@ var init_schema = __esm(() => {
       }
     }).optional().describe("Operator-declared, per-specialist Hindsight mental models (RFC " + "Phase 5). Named, opt-in curated reflections this agent's bank should " + "carry — e.g. a coach's 'training-plan-state' or a lawyer's " + "'open-matters'. Ensured idempotently at scaffold/reconcile: NOTHING " + "is created unless declared here (zero declarations = zero models, " + "matching post-#2447 behaviour), and no fixed identity model is " + "reintroduced — 'who the user is' stays owned by dedicated profile " + "banks (users.*.profile_bank), never a per-agent model. Per-agent " + "ONLY: intentionally not accepted at the defaults/profile tier, so a " + "model can never be fleet-seeded — each specialist opts in on its own " + "(the invariant-clean inverse of the retired blind auto-seeding)."),
     observations_mission: exports_external.string().optional().describe("Steers what the observation-consolidation LLM synthesises from raw " + "facts (the higher-order 'what patterns matter' lens). Cascade: override."),
+    rules_block: exports_external.boolean().default(false).describe("Memory v2 M3 go-live flag (M1 only DEFINES this, default false; " + "M3 flips it per agent). When true, the sanctioned rules/index " + "blocks render live in this agent's CLAUDE.md (marker-delimited, " + "below the `# --- Yours ---` line) AND the permission deny for " + "direct Edit/Write of the agent's own CLAUDE.md is seeded — the " + "flag couples deny + tools together so a live deny never orphans " + "the invited free-text edit path (the `memory_edit_yours` verb is " + "the only sanctioned writer once flipped). Unset/false ⇒ byte-" + "identical to pre-M1 behaviour: no blocks, no deny, dark build. " + "Cascade: override (per-agent wins over default; never fleet-" + "seeded — each agent's flip is a deliberate M3 rollout step)."),
+    orientation: exports_external.boolean().optional().describe("Memory v2 M5 go-live flag (Surface B: orientation-at-boot), " + "effective default false — dark build (unset ⇒ OFF, applied by the " + "scaffold resolver, NOT a Zod .default() — a hard default here would " + "shadow the per-agent value in the cascade the way it does every other " + "memory knob). When true, the orientation SessionStart " + "hook injects this agent's cron-refreshed `orientation` mental model " + "into context at boot AND re-seats it after every compaction (E-88), " + "deterministically and with zero tool call. Unset/false ⇒ byte-" + "identical to pre-M5 behaviour: the hook no-ops before any bank " + "resolve or network call. Per-agent ONLY (never fleet-seeded — a " + "flip is a deliberate canary/rollout step gated on the agent's " + "m2-residue measurement + operator-created model, carve-M5 §7). " + "Cascade: override (per-agent wins over default)."),
+    orientation_reinject_turns: exports_external.number().int().min(0).optional().describe("Memory v2 M5 optional per-turn re-inject cadence, effective default " + "0 = off (unset ⇒ 0, applied by the scaffold resolver, not a Zod " + ".default() — same cascade-shadowing reason as `orientation`). At 0 the " + "briefing is injected only at SessionStart + compaction (the cheap " + "path). N>0 " + "would additionally re-inject the orientation briefing every N turns; " + "priced at ~55M tok/30d at every-turn, which is WHY it defaults off " + "(carve-M5 §2/§4). Only late-session context loss should ever set it, " + "per-agent, measured. A stripped/absent value fails to 0 (fail-safe " + "AND fail-cheap). Per-agent ONLY. Cascade: override."),
+    orientation_cadence_hours: exports_external.number().int().min(1).optional().describe("Memory v2 M5 per-agent refresh cadence tier (hours), effective " + "default 48 (unset ⇒ 48, applied by the scaffold resolver, not a Zod " + ".default() — a hard default would shadow a `defaults.memory." + "orientation_cadence_hours` fleet value in the cascade). " + "The fast-churning agents (klanker, overlord) set 24; everyone else " + "inherits 48 (carve-M5 §6, Ken's locked tiered cadence). Drives BOTH " + "the out-of-session refresh scheduler AND the staleness guard's " + "per-tier thresholds (stale prefix at 1.5× cadence, cold degrade at " + "3×) — so a fixed 36h can never mislabel a 48h-tier agent as stale a " + "day early. Modelled as an explicit int (not a hard-coded name list) " + "so the tiering is data-driven and auditable. A cost knob, not an " + "enablement knob: a stripped/absent value failing to 48 is safe " + "(the cheaper tier). Cascade: override (per-agent wins over default); " + "unlike `orientation`/`_reinject_turns` it IS accepted at the " + "defaults/profile tier."),
+    inject_directives: exports_external.boolean().optional().describe("Memory v2 M3 Surface-A directive-injection switch (default TRUE — " + "on-by-default via the plugin settings.json stamp + config.py " + "DEFAULTS). When left unset the agent keeps injecting the " + "`<active_directives>` block on every turn, byte-identical to pre-M3. " + "Set FALSE to SUPPRESS that injection for this agent — its standing " + "rules are then served from the live rules block (memory.rules_block) " + "instead of re-injected directives, which is the change that collapses " + "the always-on directive-token spend (E-41). The suppression is " + "fail-safe and re-checked every turn in recall.py: it fires ONLY when " + "a non-empty rules block is physically present in the agent's " + "CLAUDE.md — a false flag with an empty/absent block keeps injecting " + "AND emits a degraded-canary notice, so a zero-standing-rules turn is " + "unreachable. Requires memory.rules_block=true first (the block must " + "be live before injection is turned off — enforce the ordering with " + "`switchroom memory flip`, never a bare flag flip). Coordinates with " + "M4's memory.recall prefetch (memoryPrefetchEnabled): the same guard " + "gates all three recall.py emit sites so a flipped agent leaks no " + "directive on a cache/prefetch hit. Cascade: override, per-agent ONLY " + "(never fleet-seeded from the defaults/profile tier — each flip is a " + "deliberate staggered M3 rollout step, same darkness safeguard as " + "rules_block). Default-true is the fail-safe direction under the " + "Zod-strip footgun: a stripped/misread key keeps the agent injecting."),
     disposition: exports_external.object({
       skepticism: exports_external.number().int().min(1).max(5).optional().describe("How much the bank doubts unverified claims (1-5; engine default 3)."),
       literalism: exports_external.number().int().min(1).max(5).optional().describe("How literally the bank reads statements vs inferring intent (1-5; engine default 3)."),
@@ -4624,6 +4629,7 @@ var init_schema = __esm(() => {
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
       profile_capture_nudge: exports_external.boolean().optional(),
+      orientation_cadence_hours: exports_external.number().int().min(1).optional(),
       anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.21.15",
+  "version": "0.21.17",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/start.sh.hbs

@@ -1198,6 +1198,17 @@ export HINDSIGHT_DIRECTIVE_CAPTURE_NUDGE={{hindsightDirectiveCaptureNudge}}
 {{#if hindsightProfileCaptureNudge}}
 export HINDSIGHT_PROFILE_CAPTURE_NUDGE={{hindsightProfileCaptureNudge}}
 {{/if}}
+# Memory v2 M3 Surface-A — directive-injection switch (memory.inject_directives
+# cascade). On by default (plugin settings.json): recall.py injects the
+# <active_directives> block every turn. Export only when the operator overrode
+# it; set false to SUPPRESS injection for this agent (a flipped M3 canary) — its
+# standing rules then come from the live rules block instead. recall.py keeps
+# the suppression fail-safe: it drops injection ONLY when a non-empty rules
+# block is physically present in CLAUDE.md, else it keeps injecting and emits a
+# degraded-canary notice. Flip via `switchroom memory flip`, never a bare edit.
+{{#if hindsightInjectDirectives}}
+export HINDSIGHT_INJECT_DIRECTIVES={{hindsightInjectDirectives}}
+{{/if}}
 # Per-row observation scope (memory.observation_scopes cascade). Stamped on
 # every retain — Stop hook, sidechain, boot reconcile, queue drain, backfill.
 # "shared" makes consolidation pool this agent's observations into ONE global

package/profiles/_shared/delegation-golden-rule.md.hbs

@@ -7,3 +7,5 @@ Acting in-turn and delegating are the same move: for an execution-class task the
 If the user amends in-flight delegated work mid-turn, steer the running worker now (`SendMessage` by worker name or agent id) rather than holding it for handback — and say in your reply which you did ("folded your update into the running worker" / "queued as a separate task"); never classify silently, never inferred. Unsure? Queue it and say so — queue is the default. If the worker is effectively done and the steer lands too late, say so and apply the update yourself in the parent.
 
 If no sub-agents are configured, do the work yourself.
+
+A worker has no auto-recall of its own — it can only PULL its own bank read-only (`mcp__hindsight__recall` / `get_mental_model` / `get_knowledge_tree` / `get_knowledge_page` / `search_knowledge_pages`; M6/E-86). When you dispatch, put the orientation you already hold — the relevant roster, bank names, or prior findings — into the Task prompt as your deliberate context selection. Share orientation, not secrets: never paste a credential or another agent's private fact into a dispatch prompt.

package/skills/mental-model-curator/SKILL.md

@@ -9,11 +9,12 @@ description: >
   "review my memory bank", "what standing models should I have", "bootstrap
   mental models", "suggest mental models from my bank", "audit my mental models",
   "what recurring questions do I keep re-deriving", and typos like "propose
-  knowlege models". ALSO owns the directive merge/retire pass — triggers like
-  "audit my directives", "merge my directives", "retire stale directives", "my
-  directives are overlapping", "too many active directives", "clean up my
-  guardrails", and when switchroom doctor FLAGs a bank over the directive WARN/FAIL
-  threshold. Do NOT use for storing a single fact/preference/decision —
+  knowlege models". ALSO owns the directive TRIAGE pass (Memory v2 M2) —
+  triggers like "audit my directives", "triage my directives", "merge my
+  directives", "retire stale directives", "my directives are overlapping", "too
+  many active directives", "clean up my guardrails", and when switchroom doctor
+  FLAGs a bank over the directive WARN/FAIL threshold. Do NOT use for storing a
+  single fact/preference/decision —
   that is retain, not a mental model. Do NOT use for identity or "who is the
   user" — that lives in profile banks, so never propose an identity model here
   (the operator's review of the card, not any code guard, is the only gate — so
@@ -22,7 +23,7 @@ description: >
   whose shape you know, PROPOSE it through the approve/deny card — never call
   create_mental_model directly (it is not pre-approved; the propose card is the
   only sanctioned write path, Fix 1.2 / #2903).
-allowed-tools: mcp__hindsight__list_banks mcp__hindsight__get_bank_stats mcp__hindsight__list_mental_models mcp__hindsight__get_mental_model mcp__hindsight__list_directives mcp__hindsight__reflect mcp__hindsight__recall mcp__switchroom-telegram__mental_model_propose
+allowed-tools: mcp__hindsight__list_banks mcp__hindsight__get_bank_stats mcp__hindsight__list_mental_models mcp__hindsight__get_mental_model mcp__hindsight__list_directives mcp__hindsight__deactivate_directive mcp__hindsight__reactivate_directive mcp__hindsight__reflect mcp__hindsight__recall mcp__switchroom-telegram__mental_model_propose Bash(switchroom memory directive mark-rules-block *)
 ---
 
 # mental-model-curator — Propose standing knowledge models from your own bank
@@ -58,9 +59,11 @@ models. Propose the few that are earned; let the operator ratify.
   (name + source_query + one-line reason) and STOP. Do NOT call
   `mental_model_propose` in this mode. This is the safe way to run against any
   bank.
-- **Directive merge/retire pass:** a separate job — see "Directive merge/retire
-  pass" below. It is always proposal-only (text out; the operator taps to enact),
-  and runs independently of the mental-model modes above.
+- **Directive triage pass:** a separate job — see "Directive triage pass (Memory
+  v2 M2)" below. It renders one consolidated card as text, then requires an
+  explicit operator go-ahead before ANY deactivation executes — never enacts on
+  the same turn the card is shown — and runs independently of the mental-model
+  modes above.
 
 ## Workflow
 
@@ -152,23 +155,87 @@ empty topic at 3am is useless and noisy. If invoked from a scheduled sweep,
 the next interactive turn instead of firing cards unattended. Treat live-turn,
 operator-present proposing as the only supported path for now.
 
-## Directive merge/retire pass
-
-A second, independent job of this skill: keep the bank's **active directives**
-lean. Directives are hard rules applied on every `reflect` — but the bank caps
-active directives at **`MAX_DIRECTIVES=30`**. Past the cap, the lowest-priority
-directives are **truncated** from the `<active_directives>` recall block and never
-reach the agent (recorded as `directives_omitted` on the recall_log row — the
-recall hook's stderr warning is swallowed by Claude Code, so don't look there) — so an
-overloaded, overlapping, or stale directive set doesn't just add noise, it drops
-your real guardrails. Fleet doctor WARNs at >24 active and FAILs at >30
-(workstream C2), and its fix text points
-here — this pass is the durable path it names.
-
-**You PROPOSE; you never delete.** `delete_directive` is deliberately NOT
-pre-approved (#2911) — it falls through to a per-call operator approval card, and
-that human tap is the only gate that retires a standing guardrail. So this pass
-outputs a plan; it does not enact retirements itself.
+## Directive triage pass (Memory v2 M2)
+
+A second, independent job of this skill: sort the bank's **active directives**
+into E-45's five categories and clear the four heavy banks off the WARN line.
+Directives are hard rules applied on every `reflect` — but the bank caps active
+directives at **`MAX_DIRECTIVES=30`**. Past the cap, the lowest-priority
+directives are **truncated** from the `<active_directives>` recall block and
+never reach the agent (recorded as `directives_omitted` on the recall_log row
+— the recall hook's stderr warning is swallowed by Claude Code, so don't look
+there). Fleet doctor WARNs at >24 active and FAILs at >30 (`doctor-memory.ts`,
+`DIRECTIVE_WARN_THRESHOLD`), and its fix text points here.
+
+**Honest framing (do not oversell):** as of the M2 measurement pass, NOTHING is
+currently being silently dropped fleet-wide — zero directives have ever been
+retired, and `directives_omitted` has fired zero times. This is a **budget +
+hygiene** pass, not a rescue from silent drops. Say it that way; overstating the
+urgency is its own failure.
+
+**The five categories every active directive sorts into (E-45):**
+
+| Category | Meaning | What happens in THIS pass |
+|---|---|---|
+| `reflect-directive` | A genuine compliance guardrail (§4.2's designed role) | KEEP — no change |
+| `rules-block` | A standing preference that belongs in the CLAUDE.md rules block (M1) | **STAGE ONLY — stays ACTIVE.** See the hard rule below. |
+| `disposition` | Better expressed as `disposition_*` bank config (E-40) | Deactivate; note the config change separately for the operator — do NOT auto-apply it |
+| `retire` | Superseded or mechanized — dead weight | Deactivate (record `superseded_by` when a winner exists) |
+| `retain-as-memory` | A fact filed as a directive by mistake (category error) | Deactivate — verify the fact already exists as a memory in the bank BEFORE proposing this; don't assert it, check it |
+
+**Retirement signals are deterministic and bounded (E-45).** A directive is
+ONLY a retirement candidate when you can point to one of: (a) it is tagged
+`superseded-by:<name>` (or you would tag it that way, naming the winner), or
+(b) a mechanization reference (a named commit/PR/scaffold rule that now does
+this automatically), or (c) a documented category error you can verify against
+the bank's own memories/config. **Citation counts are NEVER a signal** (a rule
+that works quietly gets zero citations). **Age alone is NEVER sufficient.** A
+directive with none of these signals is `reflect-directive` — KEEP — by
+default. Never propose retiring a directive because it "seems old" or "looks
+unused."
+
+### HARD RULE — never deactivate a `rules-block`-category directive in this pass
+
+If a directive's behaviour is destined for the CLAUDE.md rules block (M1), its
+migration happens at **M3 flip time**, when that surface goes live for this
+agent — not now. M1 shipped dark (`memory.rules_block` off on every agent
+today); deactivating a `rules-block`-category directive before that flip would
+leave the agent with **neither** the directive (deactivated) **nor** the rule
+(block not live) — a silent guardrail gap for however long the M2→M3 interval
+runs. So: **for every directive you categorise `rules-block`, call
+`list_directives` to confirm it, but do NOT call `deactivate_directive` on it
+in this pass, ever** — only stage its text (mention it in the card as staged,
+count it, and leave it exactly as-is) for the M3 flip to pick up later
+(`rule add`, once `memory.rules_block` is on for this agent).
+
+**This is not just a prose rule you have to remember — it is now also code-
+enforced, but ONLY once you complete the mandatory step below.**
+`DirectiveAdmin` (`src/memory/hindsight-directive-admin.ts` —
+`deactivate`/`deactivateById`/`deactivateByIdWithTag`) refuses to deactivate
+ANY directive carrying the persisted `triage-category:rules-block` marker
+tag, on every call path, including this skill's own `deactivate_directive`
+calls. But that refusal only ever fires for a directive that actually
+CARRIES the tag — and nothing stamps the tag automatically just because you,
+in your own reasoning, decided a directive is `rules-block`. **You must
+stamp it yourself, immediately, as part of classification — not as an
+afterthought before presenting the card:**
+
+> For every directive you classify `rules-block` in step 2 below, before you
+> move on to the next directive, run:
+> ```
+> switchroom memory directive mark-rules-block <agent> <id>
+> ```
+> (`src/cli/memory-directive.ts` — this calls the exact same
+> `DirectiveAdmin.markRulesBlock` write the batch triage executor uses, so
+> the chokepoint above keys off it identically). Idempotent — re-running it
+> on an already-marked directive is a no-op, so it is always safe to call
+> even if you are not sure whether a prior pass already marked this one.
+
+Do this for EVERY rules-block row before step 3's card renders, not just the
+ones you personally plan to leave alone — the whole point is that the code
+guard, not your own discipline in this pass or a future one, is what refuses
+a later deactivation attempt (including a mistaken one, or one made by a
+different pass that never saw this reasoning).
 
 ### When to run it
 
@@ -178,40 +245,104 @@ outputs a plan; it does not enact retirements itself.
 
 ### Workflow
 
-1. **List the active set.** `mcp__hindsight__list_directives` (active only). If
-   the count is comfortably under the WARN threshold (≤24) AND nothing reads
+1. **List every directive, active and inactive context.** `mcp__hindsight__list_directives`
+   (active only is fine for triage — inactive ones are already off). If the
+   active count is comfortably under the WARN threshold (≤24) AND nothing reads
    stale/overlapping, STOP and report "directive set is healthy (N active) —
-   nothing to merge or retire." Don't manufacture churn.
-2. **Cluster for overlap.** Group directives that encode substantially the same
-   rule (even reworded) or that are strict specializations of a broader one. Each
-   cluster of 2+ is a **merge candidate**: one crisp consolidated directive that
-   subsumes the group, with the retirements it replaces named.
-3. **Flag the stale.** A directive is a **retire candidate** when it's obsoleted
-   by a newer rule, references a decision/tool/project that no longer exists, or
-   contradicts a directive you're keeping. Contradictions are the priority — a
-   live contradictory pair makes `reflect` nondeterministic.
-4. **Present the plan as text — do NOT enact.** Output, ranked by how much it
-   reduces the active count and risk:
-   - **Merges:** the proposed consolidated directive text + the exact directives
-     (by name/id) it would retire.
-   - **Retirements:** each stale directive (name/id) + one-line reason.
-   - The resulting active count vs `MAX_DIRECTIVES`, so the operator sees whether
-     the plan clears the cap.
-   Then STOP. The operator decides. Enacting a merge is a follow-up: the
-   consolidated `create_directive` is autonomous, but **each** retirement fires
-   its own `delete_directive` approval card — that per-card human tap is the
-   deterministic backstop, not something this skill routes around.
+   nothing to triage." Don't manufacture churn.
+2. **Classify every directive — no drops.** For each one, assign exactly one of
+   the five categories above, with the deterministic signal that justifies it
+   (or "no signal — KEEP" for the default case). Do this for the FULL set —
+   the card is worthless if a directive silently doesn't appear on it.
+   **The moment you classify a directive `rules-block`, run
+   `switchroom memory directive mark-rules-block <agent> <id>` for it right
+   then** (see the HARD RULE above) — do not defer this to a later step or
+   batch it at the end; every rules-block row must be stamped before you move
+   to step 3.
+3. **Render ONE consolidated card as text.** Two sections, KEEP/staged first,
+   retirement candidates second — never interleaved, so a skim of "the bottom
+   half" cannot land on a live guardrail:
+   - **Keep / staged (N):** every `reflect-directive` and `rules-block` row,
+     each showing priority + category + signal (or "no signal — default KEEP").
+   - **Retirement candidates (N):** every `disposition` / `retire` /
+     `retain-as-memory` row, each showing priority + category + the
+     deterministic signal — never a bare category with no rationale.
+   - The resulting active count vs `MAX_DIRECTIVES` if the retirements land.
+4. **STOP. Get an explicit operator go-ahead before touching anything.** Do not
+   deactivate on the same turn the card is shown. The card is the operator's
+   one look before a batch of guardrails changes state.
+5. **On go-ahead, retire ONE AT A TIME with a human tap PER retirement — never
+   a single blanket go-ahead for the whole batch.** `deactivate_directive` is
+   pre-approved fleet-wide (`scaffold.ts`'s 2026-07-29 amendment,
+   `HINDSIGHT_MCP_TOOLS`) — unlike `delete_directive`, calling it does NOT
+   raise a Telegram permission card by itself. That is exactly why this skill
+   must supply the per-call gate `delete_directive`'s card would otherwise
+   have given: present the NEXT retirement candidate (name, priority, signal,
+   proposed `superseded_by`) on its own, then **STOP and end the turn** —
+   do not proceed to it, and do not queue the next one, until the operator's
+   reply for THIS ONE arrives. Only after an explicit per-row confirmation do
+   you call `mcp__hindsight__deactivate_directive` for that single directive.
+   Then present the next candidate the same way. A single "yes, go ahead" that
+   covers the whole retirement list is NOT sufficient — that collapses back
+   to the batch-level prose go-ahead this per-row loop exists to replace, and
+   silently trades away the human tap `delete_directive`'s approval card used
+   to guarantee for every one of these retirements (see PR #4760 review B2).
+   Pass `superseded_by` when you named a winner. After the LAST retirement in
+   the plan lands, `list_directives` again and report the new active count
+   against `MAX_DIRECTIVES`, plus which directives moved where.
+6. **Disposition rows are a note, not an auto-edit.** When you deactivate a
+   `disposition`-category directive, separately flag to the operator which
+   `disposition_*` bank config change it corresponds to — do NOT edit bank
+   config yourself in this pass (E-40: audit before leaning on it).
+
+### windows-boxes-class fixes (a drifted directive with a peer's superset text) — special-cased, rare
+
+Do NOT attempt this as an ordinary retirement. If a directive on this bank has
+drifted from a peer agent's superset/reconciled version of the "same" rule
+(content differs but the two should say the same thing), that is NOT
+expressible as a `content`-PATCH — the shim deliberately refuses to PATCH
+directive `content` (`hindsight-directive-admin.ts` — a directive body is the
+guardrail itself; there is no history table to recover a bad rewrite from).
+It is also NOT safely expressible as plain `create_directive` +
+`deactivate_directive` calls from this skill: once the new copy is created
+carrying the SAME name, `deactivate_directive`'s name-resolution sees two
+directives sharing that name and refuses as ambiguous. Use
+`reconcileDirectiveSuperset` (`src/memory/directive-triage-executor.ts`) for
+this instead — it resolves the old copy's id BEFORE creating the new one and
+retires it by id, so the name collision never becomes an ambiguity error. This
+is NOT a bare MCP tool call from this skill (no MCP tool exposes an
+id-targeted deactivate) — it runs via
+`switchroom memory directive reconcile <agent> <name> <content...>`
+(`src/cli/memory-directive.ts`), an operator or repo-authorized CLI/script
+invocation, not something this skill invokes autonomously. Flag any drift you
+notice to the operator rather than improvising a fix.
 
 ### Directive-pass anti-patterns
 
-- ❌ Calling `delete_directive` from this skill — it proposes; the operator's tap
-  on the per-call card is the only sanctioned retire path.
-- ❌ Merging directives that only look similar — a merge that drops a real
-  distinction silently weakens a guardrail. When unsure, propose retire-nothing.
-- ❌ Manufacturing merges on a healthy small set just to "tidy" — run the pass
-  when it's earned (bloat, overlap, staleness, or a doctor flag), not reflexively.
-- ❌ Leaving a live contradictory pair in place — surface it as the top retire
-  candidate; it's what makes `reflect` nondeterministic.
+- ❌ Deactivating a `rules-block`-category directive before M3 flips this
+  agent — opens a guardrail gap; see the hard rule above.
+- ❌ Classifying a directive `rules-block` without immediately calling
+  `switchroom memory directive mark-rules-block <agent> <id>` for it — an
+  unmarked directive gets NO code-level protection from the
+  `DirectiveAdmin` chokepoint; the classification in your head is not
+  enough.
+- ❌ Retiring on age or citation count alone — E-45 refuses both as signals.
+- ❌ Calling `deactivate_directive` in parallel / without awaiting each one —
+  sequential only (tag-write race).
+- ❌ Executing on the same turn the card is shown — the card review is the
+  gate; always stop for an explicit go-ahead first.
+- ❌ Treating one blanket "yes, go ahead" as clearance for the whole
+  retirement list — `deactivate_directive` is pre-approved (no Telegram card
+  per call), so this skill's own per-retirement stop-and-confirm loop IS the
+  human tap; batching it away silently weakens the guardrail (review B2).
+- ❌ Auto-editing bank config for a `disposition` row — flag it, don't apply it.
+- ❌ Treating a drifted/superset-text directive as an ordinary retirement —
+  see the windows-boxes-class section above.
+- ❌ Manufacturing retirements on a healthy small set just to "tidy" — run the
+  pass when it's earned (bloat, overlap, staleness, or a doctor flag), not
+  reflexively.
+- ❌ Leaving a live contradictory pair in place — surface it as the top
+  retirement candidate; it's what makes `reflect` nondeterministic.
 
 ## Anti-patterns
 

package/telegram-plugin/dist/gateway/gateway.js

@@ -21797,6 +21797,11 @@ var init_schema = __esm(() => {
       }
     }).optional().describe("Operator-declared, per-specialist Hindsight mental models (RFC " + "Phase 5). Named, opt-in curated reflections this agent's bank should " + "carry \u2014 e.g. a coach's 'training-plan-state' or a lawyer's " + "'open-matters'. Ensured idempotently at scaffold/reconcile: NOTHING " + "is created unless declared here (zero declarations = zero models, " + "matching post-#2447 behaviour), and no fixed identity model is " + "reintroduced \u2014 'who the user is' stays owned by dedicated profile " + "banks (users.*.profile_bank), never a per-agent model. Per-agent " + "ONLY: intentionally not accepted at the defaults/profile tier, so a " + "model can never be fleet-seeded \u2014 each specialist opts in on its own " + "(the invariant-clean inverse of the retired blind auto-seeding)."),
     observations_mission: exports_external.string().optional().describe("Steers what the observation-consolidation LLM synthesises from raw " + "facts (the higher-order 'what patterns matter' lens). Cascade: override."),
+    rules_block: exports_external.boolean().default(false).describe("Memory v2 M3 go-live flag (M1 only DEFINES this, default false; " + "M3 flips it per agent). When true, the sanctioned rules/index " + "blocks render live in this agent's CLAUDE.md (marker-delimited, " + "below the `# --- Yours ---` line) AND the permission deny for " + "direct Edit/Write of the agent's own CLAUDE.md is seeded \u2014 the " + "flag couples deny + tools together so a live deny never orphans " + "the invited free-text edit path (the `memory_edit_yours` verb is " + "the only sanctioned writer once flipped). Unset/false \u21d2 byte-" + "identical to pre-M1 behaviour: no blocks, no deny, dark build. " + "Cascade: override (per-agent wins over default; never fleet-" + "seeded \u2014 each agent's flip is a deliberate M3 rollout step)."),
+    orientation: exports_external.boolean().optional().describe("Memory v2 M5 go-live flag (Surface B: orientation-at-boot), " + "effective default false \u2014 dark build (unset \u21d2 OFF, applied by the " + "scaffold resolver, NOT a Zod .default() \u2014 a hard default here would " + "shadow the per-agent value in the cascade the way it does every other " + "memory knob). When true, the orientation SessionStart " + "hook injects this agent's cron-refreshed `orientation` mental model " + "into context at boot AND re-seats it after every compaction (E-88), " + "deterministically and with zero tool call. Unset/false \u21d2 byte-" + "identical to pre-M5 behaviour: the hook no-ops before any bank " + "resolve or network call. Per-agent ONLY (never fleet-seeded \u2014 a " + "flip is a deliberate canary/rollout step gated on the agent's " + "m2-residue measurement + operator-created model, carve-M5 \u00a77). " + "Cascade: override (per-agent wins over default)."),
+    orientation_reinject_turns: exports_external.number().int().min(0).optional().describe("Memory v2 M5 optional per-turn re-inject cadence, effective default " + "0 = off (unset \u21d2 0, applied by the scaffold resolver, not a Zod " + ".default() \u2014 same cascade-shadowing reason as `orientation`). At 0 the " + "briefing is injected only at SessionStart + compaction (the cheap " + "path). N>0 " + "would additionally re-inject the orientation briefing every N turns; " + "priced at ~55M tok/30d at every-turn, which is WHY it defaults off " + "(carve-M5 \u00a72/\u00a74). Only late-session context loss should ever set it, " + "per-agent, measured. A stripped/absent value fails to 0 (fail-safe " + "AND fail-cheap). Per-agent ONLY. Cascade: override."),
+    orientation_cadence_hours: exports_external.number().int().min(1).optional().describe("Memory v2 M5 per-agent refresh cadence tier (hours), effective " + "default 48 (unset \u21d2 48, applied by the scaffold resolver, not a Zod " + ".default() \u2014 a hard default would shadow a `defaults.memory." + "orientation_cadence_hours` fleet value in the cascade). " + "The fast-churning agents (klanker, overlord) set 24; everyone else " + "inherits 48 (carve-M5 \u00a76, Ken's locked tiered cadence). Drives BOTH " + "the out-of-session refresh scheduler AND the staleness guard's " + "per-tier thresholds (stale prefix at 1.5\u00d7 cadence, cold degrade at " + "3\u00d7) \u2014 so a fixed 36h can never mislabel a 48h-tier agent as stale a " + "day early. Modelled as an explicit int (not a hard-coded name list) " + "so the tiering is data-driven and auditable. A cost knob, not an " + "enablement knob: a stripped/absent value failing to 48 is safe " + "(the cheaper tier). Cascade: override (per-agent wins over default); " + "unlike `orientation`/`_reinject_turns` it IS accepted at the " + "defaults/profile tier."),
+    inject_directives: exports_external.boolean().optional().describe("Memory v2 M3 Surface-A directive-injection switch (default TRUE \u2014 " + "on-by-default via the plugin settings.json stamp + config.py " + "DEFAULTS). When left unset the agent keeps injecting the " + "`<active_directives>` block on every turn, byte-identical to pre-M3. " + "Set FALSE to SUPPRESS that injection for this agent \u2014 its standing " + "rules are then served from the live rules block (memory.rules_block) " + "instead of re-injected directives, which is the change that collapses " + "the always-on directive-token spend (E-41). The suppression is " + "fail-safe and re-checked every turn in recall.py: it fires ONLY when " + "a non-empty rules block is physically present in the agent's " + "CLAUDE.md \u2014 a false flag with an empty/absent block keeps injecting " + "AND emits a degraded-canary notice, so a zero-standing-rules turn is " + "unreachable. Requires memory.rules_block=true first (the block must " + "be live before injection is turned off \u2014 enforce the ordering with " + "`switchroom memory flip`, never a bare flag flip). Coordinates with " + "M4's memory.recall prefetch (memoryPrefetchEnabled): the same guard " + "gates all three recall.py emit sites so a flipped agent leaks no " + "directive on a cache/prefetch hit. Cascade: override, per-agent ONLY " + "(never fleet-seeded from the defaults/profile tier \u2014 each flip is a " + "deliberate staggered M3 rollout step, same darkness safeguard as " + "rules_block). Default-true is the fail-safe direction under the " + "Zod-strip footgun: a stripped/misread key keeps the agent injecting."),
     disposition: exports_external.object({
       skepticism: exports_external.number().int().min(1).max(5).optional().describe("How much the bank doubts unverified claims (1-5; engine default 3)."),
       literalism: exports_external.number().int().min(1).max(5).optional().describe("How literally the bank reads statements vs inferring intent (1-5; engine default 3)."),
@@ -22242,6 +22247,7 @@ var init_schema = __esm(() => {
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
       profile_capture_nudge: exports_external.boolean().optional(),
+      orientation_cadence_hours: exports_external.number().int().min(1).optional(),
       anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,
@@ -105870,10 +105876,10 @@ function startOutboxSweep(deps) {
 }
 
 // ../src/build-info.ts
-var VERSION2 = "0.21.15";
-var COMMIT_SHA = "efa77e51";
-var COMMIT_DATE = "2026-08-17T00:42:23Z";
-var LATEST_PR = 4753;
+var VERSION2 = "0.21.17";
+var COMMIT_SHA = "ac61272c";
+var COMMIT_DATE = "2026-08-17T16:42:58Z";
+var LATEST_PR = 4768;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts

package/vendor/hindsight-memory/hooks/hooks.json

@@ -10,6 +10,15 @@
             "timeout": 30
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/orientation.py\"",
+            "timeout": 8
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [
@@ -42,6 +51,16 @@
             "async": true
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/prefetch.py\"",
+            "timeout": 20,
+            "async": true
+          }
+        ]
       }
     ],
     "SubagentStop": [

package/vendor/hindsight-memory/scripts/directive_verify.py

@@ -64,6 +64,7 @@ from lib.directives import (  # noqa: E402
     parse_active_directives_block,
     rule_already_captured,
 )
+from lib import recall_buffer  # noqa: E402
 
 # Reuse Stage B's pleasantry scrub so "as always" / "always happy to help"
 # can't trip the high-confidence detector either. Imported lazily-safe: if
@@ -387,6 +388,37 @@ def invalidate_cache_on_directive_write(messages: list, config: dict) -> None:
         debug_log(config, f"Directives cache invalidation skipped (error): {e}")
 
 
+def invalidate_prefetch_buffer_on_directive_write(messages: list, config: dict, session_id: str) -> None:
+    """Drop this session's pending M4 prefetch buffer if this turn wrote a
+    directive (create/update/delete/retire).
+
+    red-team-M3 R2 (BLOCKER): the A4 cache invalidation above keeps the fresh
+    <active_directives> block current, but the M4 prefetch buffer carries a
+    RECALLED memories block captured at a prior turn's Stop — and a rule/
+    directive that was just retired can survive in that snapshot as recalled
+    text. Without this, a buffer prefetched while the rule was active would
+    re-inject the retired rule on the next turn (the exact §4.4 resurrection
+    failure), and `run_prefetch` bailing on an empty recall would leave that
+    stale buffer to be served on later turns too. Deleting the buffer + sentinel
+    here forces the consumer to fall to the synchronous, always-current path
+    (or the explicitly stale-marked fallback) instead of resurrecting it.
+
+    Only fires when `memoryPrefetchEnabled` is on (the buffer only exists then)
+    — a cheap no-op statting two absent files otherwise, so gated to avoid it.
+    Self-guarded; never raises (a Stop hook must not wedge a turn).
+    """
+    try:
+        if not messages or not config.get("memoryPrefetchEnabled", False):
+            return
+        idx, _text = find_last_human_turn(messages)
+        start = idx if idx is not None else -1
+        if turn_contains_directive_write(messages, start):
+            recall_buffer.invalidate(session_id or "unknown")
+            debug_log(config, "Prefetch buffer invalidated — turn wrote a directive (R2 resurrection guard)")
+    except Exception as e:  # pragma: no cover - defensive; Stop must not wedge
+        debug_log(config, f"Prefetch-buffer invalidation skipped (error): {e}")
+
+
 def read_transcript(transcript_path: str) -> list:
     """Read a JSONL transcript into a list of message dicts (role/content).
 
@@ -508,6 +540,7 @@ def main():
     #     and this is not an already-blocked re-fire.
     ttl = config.get("directivesCacheTtlSeconds", DIRECTIVES_CACHE_TTL_SECONDS)
     cache_on = isinstance(ttl, (int, float)) and ttl > 0
+    prefetch_on = bool(config.get("memoryPrefetchEnabled", False))
     verify_maybe = (
         config.get("directiveCaptureNudge", True)
         and config.get("directiveCaptureVerify", True)
@@ -515,7 +548,7 @@ def main():
     )
 
     messages: list = []
-    if cache_on or verify_maybe:
+    if cache_on or verify_maybe or prefetch_on:
         messages = read_transcript(hook_input.get("transcript_path", ""))
 
     # A4: invalidate the directives cache when this turn wrote a directive, so
@@ -524,6 +557,15 @@ def main():
     if cache_on:
         invalidate_cache_on_directive_write(messages, config)
 
+    # R2 (BLOCKER): invalidate this session's M4 prefetch buffer when this turn
+    # wrote/retired a directive, so a stale pre-retire snapshot can never
+    # resurrect the retired rule on a later turn. Self-guarded no-op when
+    # prefetch is off.
+    if prefetch_on:
+        invalidate_prefetch_buffer_on_directive_write(
+            messages, config, hook_input.get("session_id") or "unknown"
+        )
+
     try:
         reason = evaluate(hook_input, config, messages=messages)
     except Exception as e:  # never wedge a turn on a verify bug