memleaf 0.2.66__tar.gz → 0.2.67__tar.gz

{memleaf-0.2.66 → memleaf-0.2.67}/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to memleaf are documented here.
 
 ## Unreleased
 
+## 0.2.67 — 2026-09-20
+
+### Incremental-only processing and release integrity
+
+- Remove the executable legacy processing/remember engine. New Vaults use the
+  incremental runner for automatic processing, explicit remember, MCP/CLI and
+  detached jobs; retained legacy settings/jobs remain inspectable but fail closed.
+- Fix the v0.2.66 Hermes Provider manifest drift by aligning Core and Provider at
+  0.2.67 and rejecting an internally inconsistent package before host/Vault changes.
+- Gate source and wheel/sdist verification on one version identity across package
+  metadata, Core `__version__`, Hermes `plugin.yaml` and sdist project metadata.
+
+
 ## 0.2.66 — 2026-09-20
 
 ### Reconcile divergent local candidates

{memleaf-0.2.66/src/memleaf.egg-info → memleaf-0.2.67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memleaf
-Version: 0.2.66
+Version: 0.2.67
 Summary: A local-first Markdown memory core for AI agents
 Author: memleaf contributors
 License-Expression: MIT

{memleaf-0.2.66 → memleaf-0.2.67}/docs/acceptance-evidence-guide.md

@@ -24,16 +24,17 @@ the suite count or from module-name references.
 
 ## Current route semantics
 
-Both `process.automatic_pipeline` and `process.remember_pipeline` default to
-`legacy`. Selecting one does not switch the other. A successfully installed
-candidate is not proof that either new route is active. Use the exact installed
-configuration and returned route/state when recording acceptance; no instructions
-here modify production defaults or grant a production switch.
-
-After isolation and authorization, the supported opt-in values are `incremental`
-for both keys. They are test configuration choices, not edits to package defaults.
-Existing queued work retains its route/authority contract. Do not erase old work,
-failed receipts or request counters to get a clean-looking preflight result.
+The v0.2.67 candidate has one processing engine: incremental. New Vaults default
+both `process.automatic_pipeline` and `process.remember_pipeline` to
+`incremental`. A retained `legacy` value from an older Vault is not executable;
+migration preflight reports it as `legacy_pipeline_configuration`, and runtime
+entry points reject it with `legacy_pipeline_removed`.
+
+A successfully installed candidate is still not proof that production migration is
+safe. Existing legacy queue/control records retain their identity for diagnosis and
+must be settled or explicitly reviewed; they are not reinterpreted as incremental
+work. Do not erase old work, failed receipts or request counters to obtain a clean
+preflight result.
 
 ## Preparation with no paid calls
 

{memleaf-0.2.66 → memleaf-0.2.67}/docs/automatic-processing-route.md

@@ -1,31 +1,29 @@
-# Automatic processing route integration (G4a, opt-in)
+# Automatic processing on the incremental engine
 
-This increment routes the **existing** `Memleaf.process()`, CLI `process`, MCP
-`process` and detached job worker to the already implemented incremental runner.
-It does not add another planner, model review, job queue or writer. Existing
-`process_incremental` and selected `remember_incremental` remain single-turn
-facades on that same runner, budget and commit journal.
+As of the v0.2.67 candidate, `Memleaf.process()`, CLI `process`, MCP `process`
+and the detached job worker all execute through the existing incremental runner.
+There is no executable legacy processing engine and no runtime fallback to it.
+`process_incremental` and selected `remember_incremental` remain facades on the
+same runner, request budget and commit journal.
 
-The default is still `legacy`. This is an integration for isolated evaluation,
-not live Flash/Hermes acceptance, a release, or permission to change a production
-Vault. No existing config, memory, model route or version is automatically migrated.
-Text `remember()` has a separate, default-legacy `process.remember_pipeline`
-selection; see `remember-incremental-route.md`. Switching automatic processing
-alone does not enable the text route. Both use the same incremental runner.
+New Vaults default to incremental processing. Existing Vaults that still contain a
+`legacy` pipeline setting remain readable for migration inspection, but processing
+fails closed with `legacy_pipeline_removed` until the operator explicitly updates
+the configuration after the required stop/backup/preflight procedure.
 
-## Select the route, not a second pipeline
+## One engine, compatibility selector only
 
-The optional configuration field is:
+The configuration field is retained for migration visibility:
 
 ```yaml
 process:
-  automatic_pipeline: legacy   # legacy | incremental; default remains legacy
+  automatic_pipeline: incremental
 ```
 
-A missing field preserves legacy behavior. Unknown names, nonstrings and malformed
-configuration fail explicitly; they do not fall back to a different model pipeline.
-After operator-controlled preparation on an isolated copy, `incremental` may be
-selected in that copy's configuration. No command in this batch switches it for you.
+A missing field resolves to incremental. `incremental` is the only executable
+value. A retained `legacy` value is a migration blocker; unknown names, nonstrings
+and malformed configuration fail explicitly. Nothing silently reinterprets an old
+legacy queue or configuration as new incremental work.
 
 The optional per-call override affects that call only:
 
@@ -134,9 +132,11 @@ concurrent planners and stale responses.
 
 ## Queue binding and cutover
 
-An accepted job binds effective route, configured default, normalized scope and
-recover flag. A same-session request with different controls cannot silently
-coalesce into it. Legacy queue records missing these fields keep legacy semantics.
+An accepted job binds the incremental engine, normalized scope and recover flag.
+A same-session request with different controls cannot silently coalesce into it.
+Historical queue records that are missing the incremental route, or explicitly
+name `legacy`, are retained for diagnosis but blocked with
+`legacy_pipeline_removed`; they are never executed by a compatibility engine.
 Malformed stored controls fail validation without resetting the queue.
 
 A waiting job refuses execution when the configured default has changed since its
@@ -185,8 +185,8 @@ model configuration absent. Queue errors do not become successful NO_MEMORY.
 
 ## Validation and outstanding work
 
-Public tests cover legacy defaults, route overrides, exact scope, source ordering,
-batch caps, redacted ID selection, CLI/MCP/queue controls, captured-route conflicts,
+Public tests cover incremental defaults, explicit rejection of legacy execution,
+exact scope, source ordering, batch caps, redacted ID selection, CLI/MCP/queue controls,
 old queue compatibility, safe summaries, native NO_CHANGE, index/cleanup failures,
 source/target edits, Forget, concurrent dispatch, and a real child process exiting
 after its saved response. All Vaults and model responses in tests are synthetic.
@@ -207,8 +207,8 @@ Native installed-artifact results must come from the exact candidate's CI
 reports, not from a phase document or a prior green build. A native package test
 with a host-interface stub is not actual host acceptance.
 
-The automatic and text-remember routes both remain default-legacy and are
-selected independently. `--dry-run` may still call the configured model;
+Automatic processing and text remember both use the incremental engine by default.
+`--dry-run` may still call the configured model;
 acceptance plan-only mode is the no-model preparation path. See
 [the acceptance evidence guide](acceptance-evidence-guide.md) for the remaining
 gates. The fixed 1,861-codepoint/3,587-byte main prompt is unchanged.

{memleaf-0.2.66 → memleaf-0.2.67}/docs/migration-preflight.md

@@ -1,10 +1,11 @@
 # Migration preflight and private local backup (G4e)
 
-This increment implements the preparation portion of the controlled migration
-contract (FS178-179, FS188, FS192 and FS196). It neither switches a pipeline nor
-stops processes, rewrites business records, resets budgets or restores a Vault.
-A verified backup is not permission to activate the new routes. The fixed model
-prompt, request allowance, `legacy` defaults and package version are unchanged.
+This command implements the preparation portion of the controlled migration
+contract (FS178-179, FS188, FS192 and FS196). It does not stop processes, rewrite
+business records, reset budgets, restore a Vault, or rewrite pipeline settings.
+The v0.2.67 candidate itself has only the incremental engine; a retained
+`legacy` setting is reported as `legacy_pipeline_configuration` and must be
+handled explicitly after writers are stopped and a verified backup exists.
 
 ## Inspect before changing anything
 

{memleaf-0.2.66 → memleaf-0.2.67}/docs/remember-incremental-route.md

@@ -1,10 +1,10 @@
-# Existing text remember route (G4b, opt-in)
+# Text remember on the incremental engine
 
-The existing `Memleaf.remember()` and MCP `remember` tool can explicitly select
-incremental execution. This is an adapter to the same selected-retention runner,
-budget, native comparator, compiler and shared MemoryWriter; not another planner.
-The already implemented automatic route is independent. Neither route is enabled
-on an existing Vault by this change. Package version and fixed prompts are unchanged.
+As of the v0.2.67 candidate, `Memleaf.remember()` and the MCP `remember` tool use
+incremental execution as their only engine. This remains an adapter to the same
+selected-retention runner, budget, native comparator, compiler and shared
+MemoryWriter; it does not create a second planner. There is no executable legacy
+remember path and no fallback to it.
 
 ## Selection and compatibility
 
@@ -26,13 +26,13 @@ if result["retry_available"]:
     )
 ```
 
-The optional `process.remember_pipeline` is `legacy` by default and accepts only
-`legacy` or `incremental`. The per-call `pipeline` overrides it. Selecting
-`process.automatic_pipeline=incremental` alone does not change text remember.
-Unknown values fail explicitly, not by falling back to another semantic pipeline.
-The MCP tool adds only the same optional `pipeline`, `recover` and `source_time`
-fields. There is no new MCP tool, CLI command, daemon or automatic live migration.
-A supplied model/router still must meet the existing single-dispatch contract.
+The retained `process.remember_pipeline` field defaults to `incremental`.
+`incremental` is the only executable value; an old `legacy` value is preserved
+for migration inspection but is rejected with `legacy_pipeline_removed`. The
+per-call `pipeline` argument is now only a compatibility selector for
+`incremental`. Unknown values fail explicitly. The MCP tool exposes only
+`incremental` plus the existing `recover` and `source_time` controls. A
+supplied model/router still must meet the existing single-dispatch contract.
 
 `content` and its `text` alias contain the actual submitted user material. Supplying
 both with different values is rejected on the incremental route. One text request
@@ -145,12 +145,12 @@ consent or report a damaged state as NO_MEMORY.
 
 ## Cutover and validation
 
-Keep legacy defaults until controlled stop/backup/upgrade/restart and the planned
-live acceptance. Older code does not understand the standalone marker and cannot
-be expected to enforce its cleanup semantics. Changing a config key does not kill
-an old process or grant safe mixed-version writes. No default activation, production
-Vault mutation, release, real Flash calls or native Hermes/Windows/macOS acceptance
-was performed by this increment.
+Production migration still requires controlled stop/backup/upgrade/restart and
+live acceptance. Older binaries must be stopped before changing a retained legacy
+configuration; changing a config key does not kill an old process or make
+mixed-version writes safe. This candidate changes the package default to
+incremental but does not itself mutate a production Vault, run a real model, or
+prove native Hermes lifecycle acceptance.
 
 Deterministic tests cover one-user projection, origin provenance, same/new intents,
 legacy-route collisions, explicit and configured selection, unchanged originating

{memleaf-0.2.66 → memleaf-0.2.67}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memleaf"
-version = "0.2.66"
+version = "0.2.67"
 description = "A local-first Markdown memory core for AI agents"
 readme = "README.md"
 requires-python = ">=3.11"

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/__init__.py

@@ -1,6 +1,6 @@
 """Local-first Markdown memory core for AI agents."""
 
-__version__ = "0.2.66"
+__version__ = "0.2.67"
 
 from .config import DEFAULT_CONFIG, default_config, load_config, save_config
 from .frontmatter import FrontmatterError, dump_frontmatter, dump_yaml, load_yaml, parse_frontmatter

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/cli.py

@@ -94,8 +94,8 @@ def build_parser() -> argparse.ArgumentParser:
     process.add_argument("--source", default=None)
     process.add_argument("--session-id", default=None)
     process.add_argument("--scope", default=None)
-    process.add_argument("--pipeline", choices=("legacy", "incremental"), default=None,
-                         help="explicit automatic pipeline; otherwise use Vault configuration")
+    process.add_argument("--pipeline", choices=("incremental",), default=None,
+                         help="compatibility override; incremental is the only processing engine")
     process.add_argument("--recover", action="store_true",
                          help="allow remaining incremental transport recovery, not partial replan")
     process.add_argument("--dry-run", action="store_true", help="no source Vault writes; may call the configured model")

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/config.py

@@ -89,8 +89,8 @@ DEFAULT_CONFIG: dict[str, Any] = {
         "memory_compact_threshold_tokens": 100000,
         "memory_compact_candidate_ratio": 0.30,
         "inbox_cleanup_hours": 24,
-        "automatic_pipeline": "legacy",
-        "remember_pipeline": "legacy",
+        "automatic_pipeline": "incremental",
+        "remember_pipeline": "incremental",
         # Compatibility key: closed todo heads remain current identities.
         "closed_todo_retention_days": 30,
         "model_concurrency": DEFAULT_MODEL_CONCURRENCY,
@@ -225,10 +225,12 @@ def load_config(path: Path | str, *, vault: Path | str | None = None) -> dict[st
     cleanup_hours = process.get("inbox_cleanup_hours") if isinstance(process, Mapping) else None
     if type(cleanup_hours) is not int or cleanup_hours < 0:
         raise ValueError("invalid memleaf process.inbox_cleanup_hours")
-    automatic_pipeline = process.get("automatic_pipeline", "legacy")
+    # Legacy values remain parseable only so old Vaults can be inspected and migrated.
+    # Runtime selection rejects them; new/default configurations are incremental-only.
+    automatic_pipeline = process.get("automatic_pipeline", "incremental")
     if not isinstance(automatic_pipeline, str) or automatic_pipeline not in {"legacy", "incremental"}:
         raise ValueError("invalid memleaf process.automatic_pipeline")
-    remember_pipeline = process.get("remember_pipeline", "legacy")
+    remember_pipeline = process.get("remember_pipeline", "incremental")
     if not isinstance(remember_pipeline, str) or remember_pipeline not in {"legacy", "incremental"}:
         raise ValueError("invalid memleaf process.remember_pipeline")
     closed_todo_days = process.get("closed_todo_retention_days") if isinstance(process, Mapping) else None
@@ -296,11 +298,11 @@ def save_config(path: Path | str, config: Mapping[str, Any]) -> None:
     if not isinstance(process, Mapping):
         raise ValueError("invalid memleaf process settings")
     normalized_process = dict(process)
-    pipeline = normalized_process.get("automatic_pipeline", "legacy")
+    pipeline = normalized_process.get("automatic_pipeline", "incremental")
     if not isinstance(pipeline, str) or pipeline not in {"legacy", "incremental"}:
         raise ValueError("invalid memleaf process.automatic_pipeline")
     normalized_process["automatic_pipeline"] = pipeline
-    remember_pipeline = normalized_process.get("remember_pipeline", "legacy")
+    remember_pipeline = normalized_process.get("remember_pipeline", "incremental")
     if not isinstance(remember_pipeline, str) or remember_pipeline not in {"legacy", "incremental"}:
         raise ValueError("invalid memleaf process.remember_pipeline")
     normalized_process["remember_pipeline"] = remember_pipeline

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/hermes_provider/plugin.yaml

@@ -1,5 +1,5 @@
 name: memleaf
-version: 0.2.65
+version: 0.2.67
 description: "Hermes-native external MemoryProvider for local-first Markdown memory shared with the memleaf MCP server."
 hooks:
   - prefetch

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/installer.py

@@ -902,6 +902,44 @@ _MODEL_ROUTE_INCOMPATIBLE_ACTION = (
 )
 
 
+_PIPELINE_MIGRATION_REQUIRED_ACTION = (
+    "This Vault still selects the removed legacy processing engine. Stop all supported "
+    "writers, run migration-check, create and verify a migration backup, then set both "
+    "process.automatic_pipeline and process.remember_pipeline to incremental before "
+    "relying on automatic extraction or remember."
+)
+
+_PIPELINE_CONFIGURATION_INVALID_ACTION = (
+    "Repair the Vault process configuration before relying on memory processing. "
+    "v0.2.67 supports only the incremental execution engine."
+)
+
+
+def _pipeline_route_outcome(vault: Any) -> tuple[bool, str, str | None]:
+    """Report whether this Vault can execute the sole incremental engine."""
+    try:
+        config = vault.config()
+    except Exception:
+        return False, "pipeline_configuration_invalid", _PIPELINE_CONFIGURATION_INVALID_ACTION
+    process = config.get("process") if isinstance(config, Mapping) else None
+    if not isinstance(process, Mapping):
+        return False, "pipeline_configuration_invalid", _PIPELINE_CONFIGURATION_INVALID_ACTION
+    values = (
+        process.get("automatic_pipeline", "incremental"),
+        process.get("remember_pipeline", "incremental"),
+    )
+    if any(value == "legacy" for value in values):
+        return False, "pipeline_migration_required", _PIPELINE_MIGRATION_REQUIRED_ACTION
+    if any(value != "incremental" for value in values):
+        return False, "pipeline_configuration_invalid", _PIPELINE_CONFIGURATION_INVALID_ACTION
+    return True, "ready", None
+
+
+def _join_user_actions(*actions: str | None) -> str | None:
+    values = [action.strip() for action in actions if isinstance(action, str) and action.strip()]
+    return " ".join(values) if values else None
+
+
 def _route_can_extract(vault: Any) -> bool:
     """Ask the production router whether this Vault's route can speak B3.
 
@@ -965,6 +1003,22 @@ def install_hermes(
     if mcp_runtime not in _MCP_RUNTIME_POLICIES:
         raise ValueError(f"unsupported Hermes MCP runtime policy: {mcp_runtime}")
 
+    # Reject an internally inconsistent package before reading or changing any
+    # Hermes/Vault state.  The post-copy check below remains as defense in depth.
+    packaged_provider = Path(__file__).with_name("hermes_provider")
+    packaged_provider_version = _provider_manifest_version(packaged_provider)
+    if packaged_provider_version != core_version:
+        return _failure_result(
+            stage="provider_version",
+            reason=(
+                "packaged Hermes provider version mismatch: "
+                f"core={core_version}, provider={packaged_provider_version or 'unknown'}"
+            ),
+            core_version=core_version,
+            provider_version=packaged_provider_version,
+            vault=None,
+        )
+
     home = _home_from_environment()
     hermes_home = _hermes_home(home)
     try:
@@ -1082,11 +1136,16 @@ def install_hermes(
     # here used to leave core and provider versions out of step.  A *present*
     # route that cannot speak B3 is reported separately, because advertising
     # ``ready`` for it would promise extraction that can never run.
-    model_ready, processing_status, model_action = _model_route_outcome(
+    model_ready, model_processing_status, model_action = _model_route_outcome(
         model, can_extract=_route_can_extract(vault)
     )
-    # ``model_ready`` is reported through ``processing_status`` below; the host
-    # integration itself is configured either way.
+    pipeline_ready, pipeline_processing_status, pipeline_action = _pipeline_route_outcome(vault)
+    processing_status = (
+        model_processing_status if pipeline_ready else pipeline_processing_status
+    )
+    install_action = _join_user_actions(pipeline_action, model_action)
+    # Host integration is configured even when processing still needs an explicit
+    # model route or a controlled legacy->incremental Vault migration.
 
     provider_target = hermes_home / "plugins" / "memleaf"
     provider_config = hermes_home / "memleaf.json"
@@ -1298,8 +1357,8 @@ def install_hermes(
         "native_sources": native_registration,
         "capture": capture_policy_status(vault.config()),
         "processing_status": processing_status,
-        "user_action_required": bool(model_action),
-        "user_action": model_action,
+        "user_action_required": bool(install_action),
+        "user_action": install_action,
     }
 
 
@@ -1357,9 +1416,12 @@ def install_codex(*, vault_path: Path | None = None) -> dict[str, Any]:
             "codex": configured.to_dict(),
         }
     model_ready = model.get("status") in {"configured", "already_configured"}
+    pipeline_ready, pipeline_processing_status, pipeline_action = _pipeline_route_outcome(vault)
     actions: list[str] = []
     if configured.user_action_required and configured.user_action:
         actions.append(configured.user_action)
+    if pipeline_action:
+        actions.append(pipeline_action)
     if not model_ready:
         actions.append(
             "Configure an independent memleaf Model Route for this Vault before relying on "
@@ -1372,7 +1434,10 @@ def install_codex(*, vault_path: Path | None = None) -> dict[str, Any]:
         "vault": str(vault.root),
         "vault_source": vault_source,
         "model": model,
-        "processing_status": "ready" if model_ready else "model_route_required",
+        "processing_status": (
+            ("ready" if model_ready else "model_route_required")
+            if pipeline_ready else pipeline_processing_status
+        ),
         "codex": configured.to_dict(),
         "user_action_required": bool(actions),
         "user_action": " ".join(actions) if actions else None,

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/mcp_server.py

@@ -303,7 +303,7 @@ _TOOLS: tuple[dict[str, Any], ...] = (
                 "session_id": {"type": "string"},
                 "scope": _text_or_texts_schema(),
                 "background": {"type": "boolean"},
-                "pipeline": {"type": "string", "enum": ["legacy", "incremental"]},
+                "pipeline": {"type": "string", "enum": ["incremental"]},
                 "recover": {"type": "boolean"},
             }
         ),
@@ -332,7 +332,7 @@ _TOOLS: tuple[dict[str, Any], ...] = (
                 "event_id": {"type": "string"},
                 "intent_id": {"type": "string"},
                 "scopes": _text_or_texts_schema(),
-                "pipeline": {"type": "string", "enum": ["legacy", "incremental"]},
+                "pipeline": {"type": "string", "enum": ["incremental"]},
                 "recover": {"type": "boolean"},
                 "source_time": {"type": "string"},
             },

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/migration.py

@@ -12,7 +12,7 @@ import os
 from pathlib import Path
 import platform
 import re
-from typing import Any
+from typing import Any, Mapping
 
 from . import __version__
 from .inspection import _checked_snapshot, _snapshot, _fingerprint, existing_root
@@ -94,6 +94,7 @@ def _checks(service: Any, snapshot: dict[str, bytes]) -> dict:
     warnings: set[str] = set()
     counts: dict[str, int] = {}
     config = None
+    configured: dict[str, Any] = {}
     binding = {"status": "unknown"}
     try:
         binding = service.vault.identity_status()
@@ -106,6 +107,14 @@ def _checks(service: Any, snapshot: dict[str, bytes]) -> dict:
     except (OSError, ValueError, UnicodeError, TypeError):
         blockers.add("invalid_configuration")
     if config is not None:
+        process_config = config.get("process", {}) if isinstance(config, Mapping) else {}
+        configured = {
+            key: process_config.get(key, "incremental") if isinstance(process_config, Mapping) else None
+            for key in ("automatic_pipeline", "remember_pipeline")
+        }
+        counts["legacy_pipeline_settings"] = sum(value == "legacy" for value in configured.values())
+        if counts["legacy_pipeline_settings"]:
+            blockers.add("legacy_pipeline_configuration")
         native_unavailable, native_blockers = _native_source_readiness(service, config)
         counts["unavailable_native_sources"] = native_unavailable
         blockers.update(native_blockers)
@@ -187,10 +196,8 @@ def _checks(service: Any, snapshot: dict[str, bytes]) -> dict:
     elif progress["status"] != "current":
         blockers.add("unsettled_sources_require_review")
     warnings.update(_EXTERNAL_CHECKS)
-    # Even a disabled stage does not prove that an older installed binary will
-    # never run. Report facts; never automatically flip either route.
-    configured = {k: config["process"].get(k, "legacy") for k in
-                  ("automatic_pipeline", "remember_pipeline")} if config else {}
+    # Historical route settings are reported as migration facts. They are not
+    # executable by this release and are never silently rewritten here.
     return {"local_status": "blocked" if blockers else "clear",
             "blockers": sorted(blockers),
             "backup_blockers": sorted(blockers & {"processing_owner_live", "queue_not_quiescent"}),

{memleaf-0.2.66 → memleaf-0.2.67}/src/memleaf/process_jobs.py

@@ -141,8 +141,9 @@ def _valid_state(value: Any) -> dict[str, Any]:
         if not _valid_job_id(job_id) or not isinstance(raw, Mapping):
             raise ProcessJobStateError("invalid process job record")
         from .processing_route import PIPELINES
+        persisted_pipelines = PIPELINES | {"legacy"}
         for field in ("pipeline", "configured_pipeline"):
-            if field in raw and (not isinstance(raw[field], str) or raw[field] not in PIPELINES):
+            if field in raw and (not isinstance(raw[field], str) or raw[field] not in persisted_pipelines):
                 raise ProcessJobStateError("invalid process job pipeline")
         if "recover" in raw and type(raw["recover"]) is not bool:
             raise ProcessJobStateError("invalid process job recovery")
@@ -523,8 +524,8 @@ def _aggregate_attempt_results(attempts: list[Any]) -> dict[str, Any]:
         if type(value) is int and value >= 0:
             aggregate["pending_inbox_turns"] = value
             break
-    # Route-change refusals can also originate from an old legacy job. Keep
-    # its safe reason in the top-level result, not only in attempt history.
+    # Historical legacy jobs can still produce a blocked migration result. Keep
+    # that safe reason in the top-level result, not only in attempt history.
     for attempt in reversed(attempts):
         value = attempt.get("result", {}) if isinstance(attempt, Mapping) else {}
         if not isinstance(value, Mapping):
@@ -691,8 +692,7 @@ def enqueue(vault_path: Path | str, *, source: str, session_id: str, scope: Any
     with vault.lock():
         config = vault.config()
         chosen = select_pipeline(config, pipeline)
-        configured = select_pipeline(config)
-        if type(recover) is not bool or (chosen == "legacy" and recover):
+        if type(recover) is not bool:
             raise ValueError("invalid_process_recovery")
         state = _read_state(vault)
         recovered = _recover_dead_active(state)
@@ -707,8 +707,7 @@ def enqueue(vault_path: Path | str, *, source: str, session_id: str, scope: Any
             if job.get("status") in _ACTIVE | {"pending"}:
                 old_scope = normalize_scopes(job.get("scope")) if job.get("scope") is not None else None
                 if (job.get("pipeline", "legacy") != chosen or old_scope != scope
-                        or job.get("recover", False) != recover
-                        or job.get("configured_pipeline", "legacy") != configured):
+                        or job.get("recover", False) != recover):
                     return {"accepted": False, "completed": False, "status": "blocked", "job_id": job_id,
                             "reason": "process_arguments_changed"}
             if job.get("status") in _ACTIVE:
@@ -728,7 +727,7 @@ def enqueue(vault_path: Path | str, *, source: str, session_id: str, scope: Any
         job_id = f"job-{uuid.uuid4().hex}"
         job = {
             "job_id": job_id, "source": source, "session_id": session_id,
-            "scope": scope, "pipeline": chosen, "configured_pipeline": configured, "recover": recover,
+            "scope": scope, "pipeline": chosen, "configured_pipeline": "incremental", "recover": recover,
             "status": "pending", "accepted_at": _now(),
             "updated_at": _now(), "owner_pid": None, "rerun_requested": False,
         }
@@ -815,13 +814,20 @@ def run_worker(vault_path: Path | str, job_id: str) -> int:
         try:
             service = Memleaf(vault)
             from .processing_route import select_pipeline
-            if select_pipeline(vault.config()) != job.get("configured_pipeline", "legacy"):
-                result = {"pipeline": job.get("pipeline", "legacy"), "execution_status": "blocked",
+            stored_pipeline = job.get("pipeline")
+            try:
+                select_pipeline(vault.config())
+                configured_code = None
+            except ValueError as error:
+                configured_code = str(error)
+            if stored_pipeline != "incremental" or configured_code is not None:
+                result = {"pipeline": "incremental", "execution_status": "blocked",
                           "coverage_status": "partial", "deferred_inbox_turns": 1,
-                          "results": [{"execution_status": "blocked", "code": "processing_pipeline_changed"}]}
+                          "results": [{"execution_status": "blocked",
+                                       "code": configured_code or "legacy_pipeline_removed"}]}
             else:
                 result = service.process(source=job["source"], session_id=job["session_id"], scope=job.get("scope"),
-                                         pipeline=job.get("pipeline", "legacy"), recover=job.get("recover", False))
+                                         pipeline="incremental", recover=job.get("recover", False))
             terminal = _result_status(result if isinstance(result, Mapping) else {})
             rerun = _finish(vault, job_id, status_value=terminal, result=result)
         except Exception as error:

memleaf-0.2.67/src/memleaf/processing.py

@@ -0,0 +1,22 @@
+"""Compatibility tombstone for the removed legacy processing engine.
+
+memleaf v0.2.67 and later execute memory extraction only through the
+incremental runtime.  This module remains importable so older integrations fail
+with an explicit migration error instead of a ModuleNotFoundError, but it no
+longer contains or executes the legacy engine.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from .process_common import ProcessingError
+
+
+class Processor:
+    """Removed legacy processor compatibility surface."""
+
+    def __init__(self, service: Any):
+        raise ProcessingError("legacy_pipeline_removed")
+
+
+__all__ = ["Processor", "ProcessingError"]