R3-FIX-1: both queries `ORDER BY julianday(...) DESC LIMIT 1001` lacked a
PK tiebreaker. Deterministic within a single SQLite instance via rowid
stability, but breaks across `.dump | sqlite3 newdb` reimport — two rows
with identical timestamps flip ordering after the round-trip.

Adds `, summary_id ASC` to the summaries fallback query and
`, m.message_id ASC` to the messages fallback query. Mirrors the
c192ee8 fix for listConversationsBySessionKey (P1-9).

Exposes getRecentSummaryFallback via __lcmRecentTestInternals so the
regression test can drive it directly.

Adds a regression test that inserts two summaries with identical
latest_at/created_at in reverse alphabetical insertion order and
asserts the ASC tiebreak puts the lexicographically smaller summary_id
first across repeated invocations.

…TE tx

R3-FIX-2: P1-8 closed the FK-consistency hole in buildAggregateRollup
and the non-empty buildDayRollup path, but the empty-day cleanup
branches still ran `getRollup` + `deleteRollup` outside any transaction.
A concurrent rebuild that upserts a fresh rollup at the same
(conversation, kind, key) slot had its work destroyed by a
stale-empty-snapshot delete from a racing caller. Self-healing via
pending_rebuild=1, but transient data loss until next maintain.

Wraps both empty-day cleanup sites — one in buildDailyRollups' main
loop, one in buildDayRollup itself — in
`withDatabaseTransaction(this.store.db, "BEGIN IMMEDIATE", …)` and
reads getRollup INSIDE the transaction so the decision to delete is
made against the row that's actually there at lock time.

Adds a structural regression test (mirrors P1-8's source-text scan)
asserting that in both empty-day branches `getRollup(` and
`deleteRollup(` appear AFTER `withDatabaseTransaction(`. Per Round-1
spec, deterministic concurrency repros are hard; the structural
assertion is the accepted approach.

R3-FIX-3: the original assertion `details.tokenCount <= 500` would also
pass on the pre-R2-FIX-2 code because the outer enforceResponseBudget
at lcm-recent-tool.ts:2133 unconditionally clamps responses to budget.
The fix is correct; the test was tautological (R3-H ⚠ from
audit/pr516/SUMMARY_R3.md).

Strengthens the test in three ways:

1. Bulks the fixture to six prior-day digests + four live-fallback
   leaves so combinedContent (the inner index assembly) genuinely
   overflows the 500-token budget — the post-R2-FIX-2 re-truncation
   path at lcm-recent-tool.ts:1944 actually fires, rather than the
   test silently passing because the synthetic content fit.
2. Adds structural assertions that the rollup-index header is
   well-formed, the period count in the header matches the number of
   `#### ` entries (R2-FIX-3 invariant cross-check), and the
   live-fallback section header is present — so a future refactor
   that drops the live-fallback merge or breaks the count-matching
   would now fail this test.
3. Asserts `details.truncated` is true, which is the externally
   observable signal callers act on; under-reporting was R2-H's
   concern about the pre-fix path.

A truly black-box discriminator (response text differs pre- vs
post-fix) is not achievable here because the outer enforceResponseBudget
clamps both pipelines down to the same length whenever combinedContent
overflows. The test now defends the structural integrity of the
combined-output pipeline rather than a tautological budget check.

No production change.

P0-2: Wire a synchronous, replay-clean resolver that walks
runtimeConfig.models.providers[*].models[*] for {id, contextWindow}
and returns a closure mapped to the registration-time snapshot.
Optionally seeds gaps from the pi-ai catalog (mod.getModels) at
lower precedence. Exposes via createLcmDependencies as
getModelContextWindow so lcm-recent's auto-detail-level can drop
its live-RPC tiers (Tier 2/3) in a follow-up commit.

Replay-determinism analysis: result is a pure function over the
snapshot; rebuild-per-process matches replay-machine guarantees;
no wall-clock or live RPC reads.

Finding ID: P0-2 (round2-C-design.md Item 1)

P0-2: Delete the unreachable Tier 2 (status RPC) and Tier 3
(models.list RPC) ladders from computeAutoDetailLevel. The
investigation confirmed both have never returned non-null:

- Tier 2's pickFirstNumber walked response paths
  (sessions.byAgent[].entries[].usage.{promptTokens,...}) that
  don't match openclaw's actual StatusSummary shape (which uses
  recent[].totalTokens / recent[].contextTokens keyed by key).
- Tier 3 is unreachable because plugin-sdk doesn't expose
  gateway-RPC invocation; callGateway throws on models.list.

Removed: runtimeStatusCache, modelContextWindowCache,
modelCatalogFetchPromise, runtimeStatusFetchPromise,
RUNTIME_STATUS_CACHE_TTL_MS, fetchRuntimeStatus,
ensureModelCatalogLoaded, pickFirstNumber. computeAutoDetailLevel
loses its callGateway and sessionKey parameters and is now
synchronous. Updated the single call site in the tool body.

Net diff: -215 / +21. Output is a pure function of (telemetry-row,
registry-snapshot) — replay-clean by construction. See
audit/pr516/INVESTIGATION-design-calls.md Question 1 for the full
reachability analysis.

Finding ID: P0-2 (round2-C-design.md Item 1)

P1-3: The post-build state-update block at the end of
buildDailyRollups read latestState / latestSummaryCreatedAt /
latestSummaryFingerprint OUTSIDE any transaction, decided
shouldClearPending, then wrote pending_rebuild=0 — a concurrent
ingest writer that flipped pending_rebuild=1 between our read and
our write was silently clobbered, leaving rollup state stale until
the next ingest re-armed.

Fix: wrap the read-decide-write in
withDatabaseTransaction(this.store.db, "BEGIN IMMEDIATE", ...) and
re-read all three fields INSIDE the txn body. With BEGIN IMMEDIATE,
SQLite blocks any concurrent writer until our COMMIT; our reads
observe the freshest committed value.

Tests: structural pin (P1-8 / R3-FIX-2 pattern) asserting all
three reads + the upsertState write appear AFTER
withDatabaseTransaction("BEGIN IMMEDIATE", ...), plus a runtime
race test that hooks getState to simulate a concurrent
last_message_at advance and asserts the builder re-arms
pending_rebuild=1 instead of clobbering to 0.

Finding ID: P1-3 (round2-C-design.md Item 3)

Adds `Clock { now(): Date }` interface to `LcmDependencies` as a REQUIRED
field. Plugin's `createLcmDependencies` populates it with a live-clock
impl (`{ now: () => new Date() }`). Tests inject a frozen clock for
deterministic windows.

This is the contract that read-path wall-clock reads will switch to in
follow-up commits — replacing direct `new Date()` / `Date.now()` calls
in `engine.ts` and `lcm-recent-tool.ts`. Object-with-method shape
matches the `subagent` convention in `PluginRuntime`, future-extensible
to `monotonic()` without breaking callers.

Updated `createTestDeps` in 4 test files (engine, bootstrap-flood,
session-operation-queues, lcm-command) so the typed return matches the
new required field. `*.test.ts` factories that cast `as unknown as
LcmDependencies` are unaffected.

Finding ID: P0-3 (B1, B2)

Replaces three direct \`new Date()\` reads in \`lcm-recent-tool.ts\` with
\`deps.clock.now()\`:

- \`resolveWindowPeriod\` (line ~424): \`last Nh\` / \`last Nm\` window end
- \`resolvePeriod\` (line ~482): \`today\` anchor day-key resolution
- \`assembleAcrossConversations\` (line ~1466): \`currentDayKey\`

\`resolvePeriod\` and \`resolveWindowPeriod\` gain a required \`clock: Clock\`
parameter, threaded from the tool's main \`execute\` via \`input.deps.clock\`.
The new test \"anchors 'today' off the injected clock — B3 regression\" pins
the contract: with a frozen clock, \`resolvePeriod(\"today\", ...)\` produces
the expected day-key independent of the wall clock.

\`new Date(value)\` calls that wrap a recorded value (\`row.built_at\`,
\`rollup.period_start\`, etc.) are deterministic by construction and not
changed.

Existing \`__lcmRecentTestInternals.resolvePeriod\` callers updated to pass
a live-clock third arg. \`makeRecentDeps()\` factory in
\`rollup-store-builder.test.ts\` populated \`clock\` so the tool can find it
at runtime.

Finding ID: P0-3 (B3)

…sBack

Removes the \`now = new Date()\` default arg on
\`computeRollupMaintenanceDaysBack\` and threads the clock through the
single caller in \`maintain()\` via \`this.deps.clock.now()\`. This is the
last read-path wall-clock site in \`engine.ts\` related to rollup
maintenance, bundling R3-D-1.

Adds the regression test \"maintain() uses deps.clock.now() to compute
rollup-maintenance daysBack — B4 regression\" that injects a frozen
clock at engine construction (not via vi.setSystemTime) and asserts the
computed daysBack uses the injected time, not the wall clock. With
last_rollup_check_at at frozenAt - 2d 2h, daysBack must be 4 (ceil 2.083
+ 1).

Finding ID: P0-3 (B4) / R3-D-1

Removes \`Intl.DateTimeFormat().resolvedOptions().timeZone\` from the
\`engine.timezone\` getter. The fallback caused read-path output to vary
by host machine, defeating reproducibility — a workstation in Pacific
time and a server in UTC produced different day-keys for the same
recorded conversation.

Behavior now:
- If \`config.timezone\` is non-empty, return it as-is.
- Otherwise return 'UTC' and emit a one-time \`log.warn\` at engine
  construction telling the operator to set the config. Subsequent
  getter calls do NOT re-warn (debounced by emitting only in the
  constructor).

Adds two regression tests (B5):
- empty config.timezone returns 'UTC' and warns exactly once across
  repeated getter calls
- non-empty config.timezone returns it without warning

Finding ID: P0-4 (B5)

Adds \`RollupStore.getTimezone(conversationId): string | null\` that reads
the \`lcm_rollup_state.timezone\` column for one conversation (returning
null if no row exists). \`upsertState\` already wrote this column;
this is just the read path.

\`lcm_recent\` now resolves timezone as
\`store.getTimezone(conversationId) ?? engine.timezone\`, with the rollup
state row winning over the engine-wide default. This means a conversation
recorded in \`America/Los_Angeles\` keeps its day-keys / sub-day windows
even if the operator later changes the plugin-level config or runs the
engine on a host with a different default. Brand-new conversations
without state rows still fall back to the engine default.

Adds two B6 regression tests in \`rollup-store-builder.test.ts\`:
- \`RollupStore.getTimezone\` returns null pre-state and the persisted tz
  post-\`upsertState\`
- \`lcm_recent\` reads the persisted LA tz over engine UTC default —
  proven by a sub-day window that only intersects the seed under LA tz

Finding ID: P0-4 (B6)

The strict-UTC getter and construction-time warning gated on
`config.timezone.length === 0`, so a whitespace-only string
("   ", a tab, etc.) bypassed BOTH the warning and the UTC
fallback. The getter returned the whitespace verbatim and
RollupBuilder threaded it into Intl.DateTimeFormat, which
throws RangeError on the first rollup-maintenance pass.

Switch both gates to `!config.timezone?.trim()` so empty,
whitespace, null and undefined all fall through to UTC and
emit the one-time warning.

Finding: RD-FIX-1 (P2) from audit/pr516/round-design-B-new-bugs.md.

…olver

The optional pi-ai catalog seeding via mod.getModels was wired into
the resolver signature but the production call site always passed
undefined — pi-ai catalog seeding cannot run synchronously inside
createLcmDependencies. The mod-only branch is dead code that adds
function-surface noise.

Remove the parameter from the signature, the seeding branch from
the body, and the undefined arg from the call site. Drop the two
mod-specific tests (they were testing dead behavior). Add a
regression test pinning last-write-wins precedence across
cross-provider model-id collisions and document it in the JSDoc.

Finding: RD-FIX-2 (P3) from audit/pr516/round-design-B-new-bugs.md.
Also addresses RD-FIX (P3-2) precedence-undocumented gap.

Batch A added \`export\` to computeAutoDetailLevel so the test file
could import it directly. That widened the public API surface for
what is genuinely internal logic — a downstream consumer importing
it would lock in the signature and turn future changes into
breaking ones.

Drop the export keyword and add the function to the existing
__lcmRecentTestInternals namespace alongside the other test hooks
(resolvePeriod, extractRollupDigest, ...). Update the test to
import via that namespace. Behavior is unchanged.

Finding: RD-FIX-3 (P3) from audit/pr516/round-design-B-new-bugs.md.

…y drift

execute() observed wall-clock at two independent sites: resolvePeriod
(via deps.clock.now() → today day-key) and the currentDayKey gate at
the rollup-state-vs-current-day check. With a live clock, two reads a
few ms apart could land on different sides of local midnight,
producing an inconsistent view of "today" within a single tool call.

Capture deps.clock.now() exactly once at execute() entry as callTime
and thread the captured Date through both sites. To keep
resolvePeriod a pure function of its inputs, its signature changes
from (period, timezone, clock: Clock) to (period, timezone, now: Date)
— resolveWindowPeriod likewise. Tests in test/rollup-store-builder.test.ts
update accordingly.

Add a regression test pinning the contract: a stepping clock that
crosses local midnight between calls is consumed exactly ONCE per
lcm_recent invocation.

Finding: RD-FIX-4 (P3) from audit/pr516/round-design-B-new-bugs.md.