feat: migrate to API v5 with legacy server compatibility

CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 2.1.19
+
+- Use official `supermemory@5.0.1` for the hosted API. Existing container tags become namespace paths without changing their values, configuration, credentials, or six-hour document IDs. Repeated saves use POST append/diff, not source replacement. Processing stays `memory` / `dynamic`; an accepted save is not proof that extraction has finished.
+- Preserve memories-only search with threshold 0.6, no reranking or query rewriting, and existing tool limits. Queried profiles now run profile and search concurrently; profile facts become strings and result timestamps are read from `system.updatedAt`. Split profile search requests return up to ten results; parity with the legacy profile endpoint's undocumented server-side search limit/ranking has not been verified.
+- Keep custom endpoints on official `supermemory@4.15.0` through the `supermemory-legacy` runtime dependency, including servers before 0.0.9. Set `apiVersion: "v5"` (or `SUPERMEMORY_API_VERSION=v5`) only after upgrading your custom server. Explicit configuration takes precedence over the environment. `"legacy"` selects v3/v4 where the server still supports it. There is no failed-write fallback or hosted rerouting.
+- Reject malformed or failed save acknowledgments, unconfirmed v5 exact-ID forgetting, and incomplete document wipes instead of reporting success. V5 wipes require consistent pagination totals, exact page sizes and complete unique document enumeration before any delete; exact forgetting requires documented arrays and match fields. Partial successful deletions are not rolled back. No bulk semantic forgetting was introduced. Legacy forget behavior and the separate proposed search/forget hardening in PR #25 are unchanged.
+- Retain the existing 60-second per-attempt SDK timeout and two retries. The SDK timeout bounds receipt of response headers, not a stalled response body; no new whole-operation deadline was added. Stable document IDs do not guarantee exactly-once ingestion or billing after an ambiguous transport failure. A 409 is surfaced by the v5 SDK rather than automatically retried.
+
+Upgrade through your existing plugin installation/update flow; do not rerun setup to migrate. Setup replaces advanced plugin options. This release does not rewrite local configuration, migrate backend data, rename namespaces, or backfill conversations. Historical-data availability, backend ranking, eventual processing, and server-upgrade rollback still require validation on your own authorized nonproduction deployment.

README.md

@@ -93,6 +93,7 @@ Or configure in `~/.openclaw/openclaw.json`:
 | ----------------------------- | --------- | --------------------- | --------------------------------------------------------- |
 | `apiKey`                      | `string`  | —                       | Supermemory API key.                                      |
 | `baseUrl`                     | `string`  | `https://api.supermemory.ai` | API endpoint. Set to a self-hosted / local URL to point at your own instance; leave blank for the cloud. |
+| `apiVersion`                  | `"v5" \| "legacy"` | Auto-selected | Protocol override. The hosted root URL uses v5; custom endpoints default to legacy. |
 | `containerTag`                | `string`  | `openclaw_{hostname}` | Root memory namespace.                                    |
 | `autoRecall`                  | `boolean` | `true`                | Inject relevant memories before every AI turn.            |
 | `autoCapture`                 | `boolean` | `true`                | Store conversations after every turn.                     |