mempalace-code 1.15.1__tar.gz → 1.16.0__tar.gz

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/AGENTS.md

@@ -17,6 +17,16 @@ credential-free hosted workflows. An optional interoperability exercise with an
 AI client requires separate explicit owner authorization, runs outside the
 release gate, and cannot block a release.
 
+**Direct functional release boundary.** Before release candidate publication,
+run the exact installed wheel through its real CLI and credential-free stdio MCP
+interfaces in disposable environments. Reconcile every discovered command and
+subcommand, every enabled tool in every profile, and supported runtime extras
+with concrete success or documented refusal evidence and relevant failure/retry
+postconditions. Help, parser errors, tool listings, handler-only calls and source
+pytest counts do not prove functional execution. Missing required coverage blocks
+release even when CI passes. Record confirmed problems through backlog-utility
+and retain a public-safe acceptance report. Follow `docs/RELEASING.md` section 1a.
+
 **Commit attribution boundary.** Commits in this repository must not contain a
 Claude `Co-Authored-By` trailer. Configure automation to omit it; do not add it
 and clean it up later.
@@ -241,6 +251,15 @@ Edits still require admitted authority and no conflicting writer.
 ## Operational Lessons
 
 - **Keep this file and public docs public-safe.** `AGENTS.md` is the canonical public instruction file; `CLAUDE.md` is only its pointer. Public docs may name package ranges, workflow categories, advisory IDs, and reproducible commands. Private remotes, hostnames, tokens, credentials, local machine paths, customer/project details, incident specifics, and non-public operational history never go here or in other public docs; put private or machine-local lessons only in an ignored local-only note outside the published tree, such as `.codex-local/LESSONS.md`.
+- **Audit privacy before every public delivery.** Follow the privacy audit in
+  `docs/RELEASING.md` section 2. Inspect the exact tracked/staged/committed tree,
+  including hidden LLM instructions, prompts, settings, examples and sealed backlog
+  history, then both distribution archives and the history reachable from the
+  outgoing ref. Secret scanning alone cannot establish that operational or personal
+  information is public-safe. Retain redacted findings and the reviewed identities;
+  a confirmed private disclosure or consequential unresolved classification blocks
+  its public delivery. Preserve private local evidence and sealed records; never
+  rewrite history, scrub canonical JSON or weaken detectors to pass this gate.
 - **Record reusable lessons only when they are public knowledge.** When a session exposes a project gotcha, publish step, verification boundary, or agent-behavior correction that is safe for public readers and useful to future contributors, rewrite the matching lesson here in place, or add one when none matches.
 - **Verify on the surface that will run the change, and name what was not run.** Python tests alone do not prove GitHub Actions runtime changes: use local YAML/static checks such as `actionlint`, then verify the real hosted workflow run when action runtime behavior matters. Direct handler calls are useful for MCP compatibility but do not prove a separate stdio MCP client, and CLI help does not prove the command executes. A release-readiness summary must distinguish unit tests, focused integration tests, direct API smoke, real CLI execution, and hosted/daemon behavior that was not run; a tag-only or release-only workflow without a real trigger run is reported as syntax-checked and version-checked, not execution-tested. Never imply full local coverage for hosted-only behavior.
 - **Check the intended public release target.** Before publishing, verify the repository, branch, tag, and workflow that public users will see. Do not assume local remote names or private mirrors represent public release truth.

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## Unreleased
 
+## v1.16.0 — 2026-10-05
+
+### Added
+
+- Configure `backup_dir` independently of the palace location, with the existing
+  environment override mechanism. Manual, scheduled, pre-watch and pre-optimize
+  backups share the selected managed directory for creation, listing and rotation.
+  Each palace has an isolated directory under the selected root.
+
+### Fixed
+
+- Measure managed backup storage in the selected directory and check available
+  space on the archive destination. Invalid or inaccessible configured paths fail
+  without falling back. Existing archives stay in place, and explicit `--out`
+  keeps its rotation bypass and priority.
+- Release acceptance now executes every enabled MCP tool in every profile, checks
+  both protocol handshakes, and discovers all delegated migration actions. Help
+  and parser guidance do not count as functional execution.
+- Release socket fixtures use a short owned path on platforms with limited Unix
+  socket path lengths, with checked cleanup and explicit unsupported-platform handling.
+
 ## v1.15.1 — 2026-10-04
 
 Includes the v1.15.0 changes and the corrections below.

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mempalace-code
-Version: 1.15.1
+Version: 1.16.0
 Summary: Developer memory tool — mine codebases and conversations into a LanceDB-backed searchable palace. No API key required.
 Project-URL: Homepage, https://github.com/rergards/mempalace-code
 Project-URL: Repository, https://github.com/rergards/mempalace-code
@@ -624,14 +624,17 @@ export MEMPALACE_DISK_MIN_FREE_BYTES=1GiB          # global floor (watcher + bac
 Or set byte values in `~/.mempalace/config.json`. This example keeps the 1 GiB global default
 and raises the watcher and backup floors to 2 GiB each. The file must be a plain JSON object
 without comments; a file that fails to parse, or whose top level is not an object, is ignored as
-a whole with a one-line warning. A single value that cannot be parsed (for example `"lots"`) is
-reported on stderr and the next setting in precedence order applies instead.
+a whole with a one-line warning. A size value that cannot be parsed (for example `"lots"`)
+is reported on stderr and the next size setting in precedence order applies instead.
+An invalid `backup_dir` fails the managed backup operation without a fallback;
+see [Backup directory configuration](https://github.com/rergards/mempalace-code/blob/main/docs/BACKUP_RESTORE.md#choosing-the-managed-backup-directory).
 
 ```json
 {
   "disk_min_free_bytes": 1073741824,
   "watch_disk_min_free_bytes": 2147483648,
-  "backup_disk_min_free_bytes": 2147483648
+  "backup_disk_min_free_bytes": 2147483648,
+  "backup_dir": null
 }
 ```
 
@@ -1115,6 +1118,31 @@ leading `NAME=value` assignments) carries `HF_HOME` and every `MEMPALACE_*` sett
 rendering shell, such as `MEMPALACE_BACKUP_RETAIN_COUNT`; re-render after changing them.
 `schedule` warns when no palace exists at the target path yet.
 
+**Backup directory:** Set `backup_dir` in `~/.mempalace/config.json` to put managed
+archives on another disk, for example `{"backup_dir": "/mnt/backup/mempalace"}`.
+`MEMPALACE_BACKUP_DIR` overrides that setting. Paths expand `~`; relative paths
+resolve against the current directory and produce a warning. Use an absolute path
+for scheduled jobs. An absent setting or JSON `null` keeps the default
+`<palace_parent>/backups/<palace_name>/` directory.
+
+The configured directory is a root. Each palace uses a child named
+`<palace_name>-<hash>`, where the hash comes from its canonical source path, so
+palaces with the same name keep separate archives and retention. Manual,
+scheduled, pre-watch and pre-optimize backups, listing and footprint accounting
+use that child. Free space is checked on the archive destination filesystem.
+Missing directories are created during backup; listing creates no directories.
+Invalid or inaccessible settings fail without writing to the default directory.
+Managed children must be outside the palace and cannot be symbolic links.
+New backup roots and managed children have owner-only access; an existing
+configured root keeps its permissions. Archives remain owner-only.
+
+Changing this setting moves or deletes no existing archives. Previous managed
+archives remain at their old path; use `backup list --dir /previous/managed/path`
+to list them. Explicit `--out` takes priority and keeps its existing behavior,
+including no managed retention, even when `backup_dir` is invalid.
+See [Backup directory configuration](https://github.com/rergards/mempalace-code/blob/main/docs/BACKUP_RESTORE.md#choosing-the-managed-backup-directory)
+for inspection commands, permissions and existing-archive behavior.
+
 **Retention (automatic pruning):**
 
 `pre_optimize` and `pre_watch` archives are **bounded by default** to the newest 5 per kind (implicit safe default for repeated mine/optimize cycles and watcher restarts).
@@ -1127,7 +1155,11 @@ export MEMPALACE_BACKUP_RETAIN_COUNT=5   # explicit limit for all kinds; overrid
 export MEMPALACE_BACKUP_RETAIN_COUNT=0   # 0 disables pruning for every kind
 ```
 
-Or in `~/.mempalace/config.json`: `{"backup_retain_count": 5}`. Each palace has its own managed directory, `<palace_parent>/backups/<palace_name>/`, and retention only affects archives there, so palaces that share a parent directory never prune each other's backups. Explicit `--out` archives are never pruned, and `backup create --out` refuses to overwrite an existing file.
+Or in `~/.mempalace/config.json`: `{"backup_retain_count": 5}`. Retention affects only
+the palace's selected managed directory. With `backup_dir` unset, that directory is
+`<palace_parent>/backups/<palace_name>/`; a configured root uses the isolated child
+described above. Explicit `--out` archives are never pruned, and `backup create --out`
+refuses to overwrite an existing file.
 
 `backup list` (`--json` for scripts) prints `stale` in its FLAGS column for archives that would be pruned at the current retain count, `oversized` for archives larger than `MEMPALACE_BACKUP_WARN_SIZE_BYTES`, `degraded` for a snapshot of a damaged palace, and `shared` for archives an older release wrote into the shared `<palace_parent>/backups/` directory (they may belong to a sibling palace; check their wings before restoring, and retention never deletes them).
 
@@ -1164,7 +1196,9 @@ Set the backup-specific floor to `0` to disable the backup guard.
 
 **Auto-backup before optimize (on by default):**
 
-`backup_before_optimize` is **`true` by default**. A backup is created under `<palace_parent>/backups/<palace_name>/pre_optimize_*.tar.gz` before every `optimize()` call (runs after mining).
+`backup_before_optimize` is **`true` by default**. Before every `optimize()` call
+(runs after mining), a `pre_optimize_*.tar.gz` backup is created in the selected managed
+directory. With `backup_dir` unset, this is `<palace_parent>/backups/<palace_name>/`.
 
 To opt out, add to `~/.mempalace/config.json`:
 ```json
@@ -1681,7 +1715,7 @@ python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')
 Apache 2.0 — see [LICENSE](https://github.com/rergards/mempalace-code/blob/main/LICENSE) and [NOTICE](https://github.com/rergards/mempalace-code/blob/main/NOTICE).
 
 <!-- Link Definitions -->
-[version-shield]: https://img.shields.io/badge/version-1.15.1-4dc9f6?style=flat-square&labelColor=0a0e14
+[version-shield]: https://img.shields.io/badge/version-1.16.0-4dc9f6?style=flat-square&labelColor=0a0e14
 [release-link]: https://github.com/rergards/mempalace-code/releases
 [python-shield]: https://img.shields.io/badge/python-3.11+-7dd8f8?style=flat-square&labelColor=0a0e14&logo=python&logoColor=7dd8f8
 [python-link]: https://www.python.org/

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/README.md

@@ -564,14 +564,17 @@ export MEMPALACE_DISK_MIN_FREE_BYTES=1GiB          # global floor (watcher + bac
 Or set byte values in `~/.mempalace/config.json`. This example keeps the 1 GiB global default
 and raises the watcher and backup floors to 2 GiB each. The file must be a plain JSON object
 without comments; a file that fails to parse, or whose top level is not an object, is ignored as
-a whole with a one-line warning. A single value that cannot be parsed (for example `"lots"`) is
-reported on stderr and the next setting in precedence order applies instead.
+a whole with a one-line warning. A size value that cannot be parsed (for example `"lots"`)
+is reported on stderr and the next size setting in precedence order applies instead.
+An invalid `backup_dir` fails the managed backup operation without a fallback;
+see [Backup directory configuration](https://github.com/rergards/mempalace-code/blob/main/docs/BACKUP_RESTORE.md#choosing-the-managed-backup-directory).
 
 ```json
 {
   "disk_min_free_bytes": 1073741824,
   "watch_disk_min_free_bytes": 2147483648,
-  "backup_disk_min_free_bytes": 2147483648
+  "backup_disk_min_free_bytes": 2147483648,
+  "backup_dir": null
 }
 ```
 
@@ -1055,6 +1058,31 @@ leading `NAME=value` assignments) carries `HF_HOME` and every `MEMPALACE_*` sett
 rendering shell, such as `MEMPALACE_BACKUP_RETAIN_COUNT`; re-render after changing them.
 `schedule` warns when no palace exists at the target path yet.
 
+**Backup directory:** Set `backup_dir` in `~/.mempalace/config.json` to put managed
+archives on another disk, for example `{"backup_dir": "/mnt/backup/mempalace"}`.
+`MEMPALACE_BACKUP_DIR` overrides that setting. Paths expand `~`; relative paths
+resolve against the current directory and produce a warning. Use an absolute path
+for scheduled jobs. An absent setting or JSON `null` keeps the default
+`<palace_parent>/backups/<palace_name>/` directory.
+
+The configured directory is a root. Each palace uses a child named
+`<palace_name>-<hash>`, where the hash comes from its canonical source path, so
+palaces with the same name keep separate archives and retention. Manual,
+scheduled, pre-watch and pre-optimize backups, listing and footprint accounting
+use that child. Free space is checked on the archive destination filesystem.
+Missing directories are created during backup; listing creates no directories.
+Invalid or inaccessible settings fail without writing to the default directory.
+Managed children must be outside the palace and cannot be symbolic links.
+New backup roots and managed children have owner-only access; an existing
+configured root keeps its permissions. Archives remain owner-only.
+
+Changing this setting moves or deletes no existing archives. Previous managed
+archives remain at their old path; use `backup list --dir /previous/managed/path`
+to list them. Explicit `--out` takes priority and keeps its existing behavior,
+including no managed retention, even when `backup_dir` is invalid.
+See [Backup directory configuration](https://github.com/rergards/mempalace-code/blob/main/docs/BACKUP_RESTORE.md#choosing-the-managed-backup-directory)
+for inspection commands, permissions and existing-archive behavior.
+
 **Retention (automatic pruning):**
 
 `pre_optimize` and `pre_watch` archives are **bounded by default** to the newest 5 per kind (implicit safe default for repeated mine/optimize cycles and watcher restarts).
@@ -1067,7 +1095,11 @@ export MEMPALACE_BACKUP_RETAIN_COUNT=5   # explicit limit for all kinds; overrid
 export MEMPALACE_BACKUP_RETAIN_COUNT=0   # 0 disables pruning for every kind
 ```
 
-Or in `~/.mempalace/config.json`: `{"backup_retain_count": 5}`. Each palace has its own managed directory, `<palace_parent>/backups/<palace_name>/`, and retention only affects archives there, so palaces that share a parent directory never prune each other's backups. Explicit `--out` archives are never pruned, and `backup create --out` refuses to overwrite an existing file.
+Or in `~/.mempalace/config.json`: `{"backup_retain_count": 5}`. Retention affects only
+the palace's selected managed directory. With `backup_dir` unset, that directory is
+`<palace_parent>/backups/<palace_name>/`; a configured root uses the isolated child
+described above. Explicit `--out` archives are never pruned, and `backup create --out`
+refuses to overwrite an existing file.
 
 `backup list` (`--json` for scripts) prints `stale` in its FLAGS column for archives that would be pruned at the current retain count, `oversized` for archives larger than `MEMPALACE_BACKUP_WARN_SIZE_BYTES`, `degraded` for a snapshot of a damaged palace, and `shared` for archives an older release wrote into the shared `<palace_parent>/backups/` directory (they may belong to a sibling palace; check their wings before restoring, and retention never deletes them).
 
@@ -1104,7 +1136,9 @@ Set the backup-specific floor to `0` to disable the backup guard.
 
 **Auto-backup before optimize (on by default):**
 
-`backup_before_optimize` is **`true` by default**. A backup is created under `<palace_parent>/backups/<palace_name>/pre_optimize_*.tar.gz` before every `optimize()` call (runs after mining).
+`backup_before_optimize` is **`true` by default**. Before every `optimize()` call
+(runs after mining), a `pre_optimize_*.tar.gz` backup is created in the selected managed
+directory. With `backup_dir` unset, this is `<palace_parent>/backups/<palace_name>/`.
 
 To opt out, add to `~/.mempalace/config.json`:
 ```json
@@ -1621,7 +1655,7 @@ python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')
 Apache 2.0 — see [LICENSE](https://github.com/rergards/mempalace-code/blob/main/LICENSE) and [NOTICE](https://github.com/rergards/mempalace-code/blob/main/NOTICE).
 
 <!-- Link Definitions -->
-[version-shield]: https://img.shields.io/badge/version-1.15.1-4dc9f6?style=flat-square&labelColor=0a0e14
+[version-shield]: https://img.shields.io/badge/version-1.16.0-4dc9f6?style=flat-square&labelColor=0a0e14
 [release-link]: https://github.com/rergards/mempalace-code/releases
 [python-shield]: https://img.shields.io/badge/python-3.11+-7dd8f8?style=flat-square&labelColor=0a0e14&logo=python&logoColor=7dd8f8
 [python-link]: https://www.python.org/

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/docs/AGENT_INSTALL.md

@@ -1072,7 +1072,19 @@ Same as above — likely fragment corruption. Run
 
 ### "Table unreadable" or LanceDB errors
 
-Storage corruption. Use `"$MEMPALACE_BIN" --palace "$PALACE_PATH" repair --rollback`. Data added after corruption point is lost. This is why auto-backup exists (`~/.mempalace/backups/palace/pre_optimize_*.tar.gz`). Pre-optimize archives are bounded by default (newest 5 kept); scheduled archives are bounded by default (newest 14 kept); set `MEMPALACE_BACKUP_RETAIN_COUNT=0` to keep all kinds unbounded. Successful optimize runs also perform best-effort verified stale-version cleanup; use `"$MEMPALACE_BIN" cleanup` manually for older accumulations or emergency disk recovery after stopping writers.
+Storage corruption. Follow the inspected recovery procedure in
+[BACKUP_RESTORE.md](BACKUP_RESTORE.md#health-check-and-repair) before rollback; data
+added after the selected recovery point is lost. Automatic backups use the selected
+managed directory. `~/.mempalace/backups/palace/pre_optimize_*.tar.gz` is the default
+when `backup_dir` is unset. To choose another disk, follow
+[backup directory configuration](BACKUP_RESTORE.md#choosing-the-managed-backup-directory),
+merge the key into the existing config, and use an absolute path. Preserve existing
+archives, mounts and services; setting `backup_dir` does not migrate them.
+Pre-optimize archives are bounded by default (newest 5 kept); scheduled archives are
+bounded by default (newest 14 kept); set `MEMPALACE_BACKUP_RETAIN_COUNT=0` to keep all
+kinds unbounded. Successful optimize runs also perform best-effort verified
+stale-version cleanup; use `"$MEMPALACE_BIN" cleanup` manually for older accumulations
+or emergency disk recovery after stopping writers.
 
 ### Re-mine doesn't fix the issue
 

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/docs/BACKUP_RESTORE.md

@@ -667,9 +667,57 @@ tarball. Do not run that suggestion
 directly. Set its palace as `RESTORE_TARGET`, set the tarball as `ARCHIVE`, and
 follow the inspected force-restore procedure in [Tarball Backup](#tarball-backup-full-snapshot).
 
+### Choosing the managed backup directory
+
+Set `backup_dir` in `~/.mempalace/config.json` to select a backup root independently
+of the palace. Merge this key into the existing JSON object; preserve other settings:
+
+```json
+{
+  "backup_dir": "/mnt/backup/mempalace"
+}
+```
+
+`MEMPALACE_BACKUP_DIR` overrides the JSON setting. Paths expand `~`; a relative path
+resolves against the process's current directory and emits a warning. Use an absolute
+path for scheduled jobs and services. An absent key or JSON `null` keeps the default
+`<palace_parent>/backups/<palace_name>/` layout.
+
+The setting selects a root. Each palace uses
+`<backup_dir>/<palace_name>-<hash>/`, where `<hash>` is the first 16 hexadecimal digits
+of SHA-256 of its canonical palace path. Palaces with the same name have separate
+directories and retention. Manual, scheduled, pre-watch and pre-optimize archives,
+listing, rotation and managed-backup size accounting use this selected directory.
+The backup guard checks free space on the archive's destination filesystem.
+
+Creating a backup creates missing directories; listing creates none. Blank, malformed,
+non-directory or inaccessible configured paths fail with an error. MemPalace never
+switches to the default directory after such an error. The managed child must be
+outside the palace and cannot be a symbolic link. New roots and managed children use
+owner-only access (`0700`); an existing configured root keeps its permissions. Archives
+use `0600`.
+
+Changing `backup_dir` moves or deletes no archives. Earlier managed archives remain
+at their previous path and leave the selected retention set. To inspect them:
+
+```bash
+mempalace-code backup list --json
+mempalace-code backup list --dir /previous/managed/path --json
+```
+
+Inspect the archive paths returned by `backup list` before any manual removal. Listing
+an extra directory does not enroll it in managed rotation. Legacy shared archives
+remain listed with the `shared` flag and are never pruned.
+
+Explicit `backup create --out /path/archive.tar.gz` takes priority over `backup_dir`,
+even when that setting is invalid. It keeps the existing no-overwrite behavior and
+disables managed rotation for that operation. The disk guard uses the explicit
+destination. See [Retention](#retention-automatic-pruning) for per-kind limits.
+
 ### Auto-Backup Before Optimize
 
-Enabled by default. Every `mempalace-code mine` creates a backup before compacting storage:
+Enabled by default. Every `mempalace-code mine` creates a backup before compacting storage.
+With `backup_dir` unset, the default palace uses:
 
 ```
 ~/.mempalace/backups/palace/pre_optimize_YYYYMMDD_HHMMSS_ffffff.tar.gz
@@ -704,7 +752,8 @@ export MEMPALACE_BACKUP_RETAIN_COUNT=10
 export MEMPALACE_BACKUP_RETAIN_COUNT=0
 ```
 
-Each palace has its own managed backups directory, `<palace_parent>/backups/<palace_name>/`
+Each palace has its own [selected managed directory](#choosing-the-managed-backup-directory).
+With `backup_dir` unset, it is `<palace_parent>/backups/<palace_name>/`
 (the default palace `~/.mempalace/palace` uses `~/.mempalace/backups/palace/`). Retention prunes
 **only that directory**, so palaces that share a parent directory never prune each other's
 archives. Archives written with explicit `--out` paths are never pruned, and `backup create
@@ -915,6 +964,11 @@ The last sentence names the setting that actually set the floor, for example
 
 The projection is conservative: it assumes the archive size equals the uncompressed palace + KG size. Actual compressed archives are usually smaller, but the guard refuses when even the worst-case estimate would leave insufficient headroom.
 
+Free space comes from the filesystem of the selected managed directory or explicit
+`--out` destination. The palace and backup root can be on different disks. Watcher
+write thresholds still check the palace filesystem; `watch <dir> status` accounts
+for archives in the selected managed directory.
+
 ### Configuring the backup floor
 
 ```bash
@@ -956,13 +1010,18 @@ If the backup guard refuses because disk is nearly full:
 
 1. Check what is taking space:
    ```bash
-   du -sh ~/.mempalace/palace ~/.mempalace/backups
+   mempalace-code backup list --json
+   # Set BACKUP_PATH to a listed archive's containing directory after inspection.
+   : "${BACKUP_PATH:?set BACKUP_PATH to the inspected backup directory}"
+   du -sh ~/.mempalace/palace "$BACKUP_PATH"
    ```
 2. List existing backups and remove stale ones manually if immediate space is needed:
    ```bash
    mempalace-code backup list
-   ls -lh ~/.mempalace/backups/palace/
-   rm ~/.mempalace/backups/palace/<stale_archive>.tar.gz
+   ls -lh "$BACKUP_PATH"
+   : "${BACKUP_PATH:?set BACKUP_PATH to the inspected backup directory}"
+   # Remove only an inspected archive that you intend to discard.
+   rm -i "$BACKUP_PATH/<stale_archive>.tar.gz"
    ```
 3. Re-run the backup once enough space is freed.
 

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/docs/LLM_USAGE_RULES.md

@@ -243,6 +243,22 @@ in human mode or `recovery_command` in the single JSON object on stdout. Review
 target, and mutation authority before using the exact emitted command. Do not add flags, change the
 action, or invent a nearby retry.
 
+## Backup configuration and recovery
+
+Backup operations use the direct CLI; the minimal memory profile exposes no backup
+tool. Follow [BACKUP_RESTORE.md](BACKUP_RESTORE.md#choosing-the-managed-backup-directory)
+when the owner requests backup configuration or recovery. `backup_dir` selects a root
+with a separate managed child for each palace; `MEMPALACE_BACKUP_DIR` takes precedence.
+Use an absolute path for services and scheduled jobs. Preserve existing configuration
+keys and inspect `mempalace-code backup list --json` to confirm archive paths.
+
+Changing the setting moves or deletes no existing archives. An invalid or inaccessible
+configured path fails; retain the requested destination and report the error. Do not
+unset it, change mounts, or add `--out` as an unapproved recovery. An owner-selected
+`--out` destination bypasses managed rotation. Backup permission does not authorize
+archive deletion, restore over an existing palace, or service changes. Use the inspected
+restore procedure in the linked guide within the current authority.
+
 ## Ambiguous Write Outcome
 
 On timeout, lost response, restart, or context loss after calling `mempalace_add_drawer`, `mempalace_kg_add`, `mempalace_kg_invalidate`, or `mempalace_diary_write`, do not immediately repeat the write. Reconcile observable poststate before any retry.

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/docs/RELEASING.md

@@ -50,7 +50,28 @@ Update the version, changelog, public documentation, and generated scorecard in
 one reviewable change. Keep `## Unreleased` at the top of `CHANGELOG.md`; move
 the completed items into the new version heading when cutting the release.
 
-Run the local checks from the release commit. None of them needs the candidate
+Resolve existing authorization before asking for another approval. Preparation,
+disposable-platform testing, candidate push, public promotion, publication and
+live deployment are separate effects; apply the active request to each. A missing
+permission blocks only its dependent effect. Qualification remains credential-free.
+
+Check each changed behavior's public routes: README, its feature guide, agent
+installation and LLM rules, CLI/MCP examples, and packaged instructions when the
+capability belongs there. Update current claims, defaults, environment precedence,
+failure recovery and preservation guarantees against source. Keep dated historical
+evidence intact. Do not add backup operations to the minimal memory plugin, which
+exposes only its declared memory tools.
+
+Inspect every path selected for the public commit, including newly staged backlog
+records. Private journals and machine-bound task histories remain local. Use the
+existing ignore owner and supported backlog operations; preserve sealed records and
+validate the store. An index-only exclusion preserves files at that moment, but a
+later branch switch or merge can remove them if another ref still tracks them.
+Before such integration, retain verified sealed bytes through the supported backup
+or validated export route; compare their hashes and run native backlog validation
+afterward. A clean Git tree proves no uncommitted diff, not preservation of ignored data.
+
+Run source and documentation checks before building the installed candidate. None needs the candidate
 SHA or public `main`; the exact-SHA public admission runs in section 3c, after
 public `main` carries the candidate:
 
@@ -59,11 +80,7 @@ python scripts/docs_drift_guard.py
 python scripts/public_safety_scan.py --tracked --staged
 python scripts/quality_scorecard.py --check
 python scripts/gen_code_intelligence_packet.py --check
-python scripts/release_preflight.py --tag vX.Y.Z --require-clean
-python scripts/release_install_metadata_smoke.py --all-installers --install-spec . --json
-python -m build --wheel --outdir dist
-WHEEL=dist/mempalace_code-X.Y.Z-py3-none-any.whl
-python scripts/release_readiness_gate.py --installed-golden-wheel "$WHEEL" --json
+python scripts/release_preflight.py --json
 python -m pytest tests/ -x -q -m "not needs_network"
 python -m pytest tests/test_mcp_protocol_compat.py -q
 python -m pytest tests/test_cli_golden_scenarios.py -q
@@ -73,9 +90,41 @@ python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')
 python -m pyright -p pyrightconfig.strict.json
 ```
 
-With `--tag`, the preflight also reports an `acceptance_report` row. It fails until
-section 1a's report for this exact package tree is committed, so run section 1a
-once the other checks pass, then rerun the preflight.
+Then build both distribution formats into an owned output directory, check their
+members and metadata, and use one exact wheel for all installed checks:
+
+```bash
+python -m build --outdir dist
+WHEEL="$(pwd)/dist/mempalace_code-X.Y.Z-py3-none-any.whl"
+python scripts/release_artifact_gate.py --dist dist --require-wheel --require-sdist --json
+python scripts/release_install_metadata_smoke.py --all-installers --install-spec "$WHEEL" --json
+python scripts/release_readiness_gate.py --installed-golden-wheel "$WHEEL" --json
+```
+
+Use the pending version in place of `X.Y.Z`; retain the wheel digest and the source
+objects it represents. On a supported Linux fixture run the same exact-wheel
+installer command with `MEMPALACE_RELEASE_SYSTEMD_USER=1`, as described below.
+An unavailable Linux user manager leaves that receipt `UNRUN`; it does not invalidate
+already passing platform rows or authorize a live service change.
+
+Write section 1a's report after installed qualification, then commit the reviewed
+source, report and public-safe metadata within the active authority. Scan the full
+staged tree again before committing so new files are included. Finally run:
+
+```bash
+python scripts/release_preflight.py --tag vX.Y.Z --require-clean --json
+```
+
+With `--tag`, the preflight verifies the committed `acceptance_report` for the
+exact package objects. A pending report or dirty tree is a prerequisite during
+preparation, not a reason to ask again for an already authorized source commit.
+Rebuild distribution archives after a documentation-only source change. Compare
+their members with the tested wheel: runtime/plugin files, dependency and entrypoint
+metadata, and accepted package source objects must match before reusing application
+evidence. A README-only change in the wheel's metadata requires a new artifact check
+and installed metadata smoke; record both wheel identities and the exact difference.
+Other package changes require rerunning the affected installed acceptance and
+updating its report. Archive timestamps alone do not prove a runtime change.
 
 `gen_code_intelligence_packet.py --check` regenerates the code-intelligence demo
 packet in a temp directory and compares it with the committed
@@ -92,7 +141,8 @@ check. It is the canonical pre-tag command and fails closed when upstream
 python scripts/release_preflight.py --tag vX.Y.Z --require-clean --check-live-upstream
 ```
 
-`release_install_metadata_smoke.py --all-installers` installs the current checkout through
+`release_install_metadata_smoke.py --all-installers --install-spec "$WHEEL"` installs
+the exact candidate wheel through
 the canonical `venv`, `bootstrap-venv`, `pipx`, and `uv-tool` contours and proves
 `importlib.metadata.version`,
 `mempalace_code.__version__`, and `mempalace-code version-check --status`
@@ -118,7 +168,7 @@ evidence. Recovery: rerun the same aggregate command in the disposable Ubuntu jo
 
 ```bash
 MEMPALACE_RELEASE_SYSTEMD_USER=1 python scripts/release_install_metadata_smoke.py \
-  --all-installers --install-spec dist/mempalace_code-*.whl --json
+  --all-installers --install-spec "$WHEEL" --json
 ```
 
 The manager matrix above remains a lightweight metadata, recovery, plugin, and
@@ -256,7 +306,36 @@ an LLM agent would, following the public documentation literally.
    agent configuration, crontab, launchd, or systemd user units; render schedules
    and daemon files without installing them.
 3. **Exercise every area** below and record what ran in the report's coverage
-   table:
+   table. Direct functional acceptance is a mandatory release condition, separate
+   from source tests and CI. Discover commands, delegated subcommands, tools and
+   profiles from the installed package. For each supported operation, record the
+   exact public-interface invocation, accepted input, expected result, observed
+   result and relevant state after failure or retry. Exercise each enabled MCP
+   tool in each profile through a separate stdio client, including both supported
+   protocol handshakes. Listing a tool proves discovery only. `--help`, parent
+   guidance and missing-argument errors prove guidance only; they cannot replace
+   execution of the operation. A deliberately retired or unauthorized operation
+   is covered by its documented refusal and unchanged-state check, explicitly
+   labelled as refusal-only. Live operations use disposable supported fixtures;
+   never widen operational authority to satisfy coverage.
+
+   Reconcile the discovered surface with executed scenarios. An omitted required
+   case is blocking `UNRUN`; do not mark the release PASS or defer the missing
+   case as a low-severity issue. Platform-specific behavior must run on a supported
+   platform. Preserve machine-readable invocation and outcome evidence outside
+   the published tree, bound to the exact wheel SHA-256. The existing installed
+   owner remains `scripts/release_readiness_gate.py`; supplement its scenarios
+   where its aggregate evidence does not establish the required behavior.
+
+   The installed owner discovers the root parser and the delegated
+   `wing-migration` parser. It attributes checked successes, documented refusals
+   and verified daemon launches separately from guidance and discovery. A parent
+   usage message or an operation's `--help` cannot satisfy its execution case.
+   MCP scenarios use a separate disposable palace for each profile, validate each
+   enabled tool's result and mutation post-state, and check both protocol
+   handshakes with recovery after invalid modern metadata. The suite aggregate
+   fails when a discovered operation or enabled tool/profile case is missing.
+
 
    | Area | Scope |
    |---|---|
@@ -304,6 +383,61 @@ recorded in the report.
 
 ## 2. Review public repository surfaces
 
+### Privacy audit before public delivery
+
+Run this audit for each release before any public candidate push, promotion or
+publication. Reuse results only when the tree, artifacts and outgoing ancestry
+are unchanged. Enumerate files with Git, which includes hidden tracked paths;
+default filesystem searches can omit them:
+
+```bash
+git ls-files
+git diff --cached --name-only
+python scripts/public_safety_scan.py --committed --tracked --staged
+python scripts/gitleaks_scan.py full-history --artifact-dir .codex-local/release-privacy
+python scripts/release_artifact_gate.py --dist dist --require-wheel --require-sdist --json
+```
+
+Inspect `AGENTS.md`, `CLAUDE.md`, every tracked `.agents/` and `.claude/` instruction,
+prompt, shared reference and setting, `docs/LLM_USAGE_RULES.md`, packaged plugin
+instructions, examples, workflows and all newly staged metadata. Examine sealed
+backlog history as well as current task fields. Check for private remotes, hosts,
+addresses, machine identifiers, real local paths, personal/customer information,
+private project or operational context and credentials. Do not read local credential
+stores or invoke AI clients to perform qualification. Reports contain file positions,
+categories and redacted findings, never secret values or private transcripts.
+
+Review ambiguous matches against source and provenance. Generic examples, synthetic
+fixtures and intended public author/contact metadata can resemble private data;
+neither a pattern match nor an automatic PASS settles their classification. Do not
+assume an internal author label is approved for disclosure just because it is sealed
+or already tracked. Record the classification and its basis in the private evidence.
+
+Inspect member names and text contents of both wheel and sdist, including README
+metadata, internal instructions and serialized data. The artifact gate checks
+distribution shape; it does not replace content review. Retain the exact archive
+digests, source SHA, scope, findings, dispositions and any uninspected binary members.
+
+The pinned full-history scan includes reachable refs. Check the actual outgoing
+ref's parent history separately: excluding a file from the current tree leaves older
+blobs reachable. Local development history and ignored maintainer notes may contain
+retained private evidence. Keep them local. Section 3's candidate carries the reviewed
+tree with current public `main` as its parent; never send local development history
+as a substitute. Inspect the outgoing candidate and archive identities again before
+delivery. If existing public ancestry contains a confirmed disclosure, record it as
+an unresolved exposure; a new clean snapshot cannot remove it.
+
+A confirmed private disclosure or consequential unknown classification blocks its
+public delivery. Do not rename an unknown to PASS, delete evidence, edit sealed JSON,
+rewrite published history or add a scanner exemption. Preserve the finding and
+propose the smallest in-scope correction; a history rewrite or disclosure-policy
+change needs its own authority. A clean-tree or secret-scan result alone cannot be
+reported as "no private data remains in the repository". Recovery: inspect the
+retained redacted report, correct the affected surface within authority, then rerun
+the affected scan and exact-ref check.
+
+### Public presentation
+
 Before asking for tag/publish approval, inspect the public repository as a
 visitor would:
 

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/docs/quality/PALACE-SCOPE-RESOURCE-BOUNDARY.md

@@ -161,7 +161,8 @@ storage handles are closed before retained resources are measured. The `lsof` me
 counts numeric descriptors; `cwd`, `txt`, and `mem` records are excluded.
 Unavailable or incomplete descriptor measurements fail the measurement check;
 they cannot produce zero growth or a passing descriptor result.
-Managed pre-optimize backups use `backups/<palace name>/` and are included in the
+With `backup_dir` unset, managed pre-optimize backups use `backups/<palace name>/`
+and are included in the
 regression's disk measurement and retention assertion, which requires at least one
 archive. The fixture uses a disposable HOME and palace.
 
@@ -202,7 +203,8 @@ The workflow initializes a fixture project, mines it, performs a no-op mine,
 backs up and restores the palace, searches and reads mined content, and runs one
 real `--on-save` watch cycle. The no-op output includes `no changes detected`,
 creates no managed backup archive, and has zero byte growth across the palace and
-its sibling `backups/` directory. The watcher waits for `state=watch-ready`,
+its default sibling `backups/` directory (`backup_dir` is unset in this fixture).
+The watcher waits for `state=watch-ready`,
 updates one already-mined source, accepts one post-debounce retry for native
 watch registration, observes `[project: 1 change(s)]`, then exits cleanly on
 SIGTERM with `1 re-mine cycle(s), 1 event(s)`.

{mempalace_code-1.15.1 → mempalace_code-1.16.0}/docs/quality/acceptance/README.md

@@ -54,9 +54,15 @@ and complete is for the reviewer.
 The wheel digest identifies the tested artifact. The preflight binds the source ids
 instead, because the tag workflow rebuilds the distributions from the same tree.
 
-`result: PASS` is allowed only when no confirmed critical or high issue is open,
-every other finding is fixed or explicitly deferred with a reason and a follow-up,
-and every coverage row ran or states why it could not.
+`result: PASS` requires complete direct functional coverage under RELEASING
+section 1a. Every discovered supported command/subcommand and enabled MCP tool
+in every profile needs actual installed-interface execution and checked results.
+Separate success, documented refusal, failure/retry, and discovery-only evidence.
+Help, parser errors, listings, direct handler calls and source-test counts cannot
+substitute for operation coverage. Missing required coverage is blocking `UNRUN`;
+it cannot be deferred to obtain PASS. Platform-specific cases run on a supported
+platform. No confirmed critical or high issue may remain open; other product
+findings must be fixed or explicitly deferred with a reason and a backlog reference.
 
 ## Sections