@avantf/dsh-mem 0.8.1 → 0.10.0

package/lib/index.js

@@ -12,9 +12,9 @@ import { createHash, randomBytes } from "node:crypto";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { brotliCompressSync, brotliDecompressSync, constants, gunzipSync, gzipSync } from "node:zlib";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { fileURLToPath, pathToFileURL } from "node:url";
 //#region ../contract/lib/types.js
 /** Shared domain types for avantf-mem. Single source of truth in @avantf/mem-contract. */
 /**
@@ -167,6 +167,146 @@ const DEGRADED_WEIGHTS = {
 */
 const DEGRADED_LEG_NOTE = "本次仅词法腿，语义腿未就绪（语义后端不可用，结果只来自 FTS 与实体腿）。";
 //#endregion
+//#region ../contract/lib/trust_curve.js
+/**
+* The trust decay curve — PURE functions, no IO, no config object of its own.
+*
+* This file is the ONE implementation of "how much trust is left after N active days" and of every
+* inverse of it. `core/lifecycle/trust.ts` (read path, recall reinforcement), the tick's settle
+* statement (`db/dao/facts.ts`) and the config's load-time validation (`config.ts`) all delegate
+* here, so a change of shape cannot leave one of them behind (docs/TRUST_MODEL.md §2.2, DESIGN §18).
+*
+* It lives in the CONTRACT package because the load-time validation needs the same math, and the
+* dependency direction is core → contract, never the reverse.
+*
+* ## The two shapes
+*
+* `linear` (TRUST_MODEL D7, the P3 equivalent tier): trust falls by a constant amount per active
+* day, `slope = BASE_TRUST / base_lifetime_days` ⇒ a fact that starts at `BASE_TRUST` reaches 0
+* after exactly `base_lifetime_days` active days.
+*
+* `accelerating` (the v2 target shape): `dT/dt = −λ·(a + 1 − T)` — the closer to 1, the slower the
+* decay, so "almost permanent" facts really linger. Closed form (plan §3.1):
+*
+*     T(t) = (1 + a) − ((1 + a) − T₀)·e^(λt)      λ = ln((1 + a)/(1 + a − BASE_TRUST)) / B
+*
+* Note the POSITIVE exponent: `u = a + 1 − T` grows, so `e^(λt)` is the decay direction here (the
+* plan writes it this way, and the closed-form test pins it). `a = decay_curvature`.
+*
+* ## Units
+*
+* `days` is ALWAYS the ACTIVE-DAY counter (`avantf_stats.trust_clock`), never wall time.
+*/
+/**
+* The frozen anchor (TRUST_MODEL D20): a new fact's initial trust, the trust value the lifetime
+* anchor is defined at (`daysToZero(BASE_TRUST) === base_lifetime_days`), and the divider between
+* the two recall-reinforcement segments. One constant on purpose — the three uses must never be
+* configurable apart, or "a new fact lives 90 active days" stops being true.
+*/
+const BASE_TRUST = .5;
+/** The decay shapes `decay_shape` accepts. */
+const DECAY_SHAPES = ["linear", "accelerating"];
+/** Read the curve out of the `trust` section (the single mapping from keys to math). */
+function curveOf(trust) {
+	return {
+		shape: trust.decay_shape,
+		curvature: trust.decay_curvature,
+		baseDays: trust.base_lifetime_days
+	};
+}
+/**
+* Trust units lost per active day — the LINEAR slope, `BASE_TRUST / base_lifetime_days`.
+*
+* `linear` is the only shape with a constant slope; for `accelerating` this returns the LOCAL slope
+* at the anchor `T = BASE_TRUST` (`λ·(BASE_TRUST + a)`). It exists as the building block of the
+* `linear` branch of {@link trustAfterDays} / {@link ceilingForDays} and for the tests that pin the
+* anchor; it is deliberately NOT a scalar stand-in for the curve — anything that needs "how much
+* trust is left after N days" uses {@link trustAfterDays}, and anything that needs "N days from a
+* threshold" uses {@link ceilingForDays}. (An earlier caller — `trust_diagnose.forgetting_soon` —
+* used it as a linear rate and was wrong once `accelerating` became the default.)
+*/
+function slopeOf(shape, curvature, baseDays) {
+	if (shape === "linear") return BASE_TRUST / baseDays;
+	return lambdaFor(curvature, baseDays) * (BASE_TRUST + curvature);
+}
+/**
+* `λ = ln((1 + a) / (1 + a − BASE_TRUST)) / baseDays` — pinned so the anchor holds:
+* `λ·baseDays = ln((1 + a)/(0.5 + a))`, i.e. `daysToZero(BASE_TRUST) === baseDays` for ANY `a`.
+*/
+function lambdaFor(curvature, baseDays) {
+	return Math.log((1 + curvature) / (1 + curvature - BASE_TRUST)) / baseDays;
+}
+/**
+* `T − days·slope` (linear) or the closed form `(1 + a) − ((1 + a) − T)·e^(λ·days)`.
+*
+* UNCLAMPED on purpose: callers clamp to `[0, 1]` themselves (`effectiveTrust`'s read path and the
+* settle write both must clamp, and a shared clamp here would hide a caller that forgot).
+*/
+function trustAfterDays(T, days, cfg) {
+	if (cfg.shape === "linear") return T - days * slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	const a = cfg.curvature;
+	return 1 + a - (1 + a - T) * Math.exp(lambdaFor(a, cfg.baseDays) * days);
+}
+/**
+* Active days between two trust values, `t(T0 → T1)`.
+*
+* `linear`: `(T0 − T1) / slope`; `accelerating`: `ln((1 + a − T1)/(1 + a − T0)) / λ`. Both are
+* signed the natural way (a RISING target yields a negative number of days), so the formula is
+* usable as an inverse without special cases. Returns `NaN` only for an out-of-domain input
+* (`T > 1 + a` on the accelerating branch), which the config validation makes unreachable.
+*/
+function daysBetween(T0, T1, cfg) {
+	if (cfg.shape === "linear") return (T0 - T1) / slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	const a = cfg.curvature;
+	return Math.log((1 + a - T1) / (1 + a - T0)) / lambdaFor(a, cfg.baseDays);
+}
+/** Active days until the value reaches 0 — `remainingDays`'s whole body. */
+function daysToZero(T, cfg) {
+	return daysBetween(T, 0, cfg);
+}
+/**
+* The trust ceiling a `max_retention_days` promises: after being reinforced up to `ceiling`, a fact
+* survives `days` more active days.
+*
+* `linear`: `days · slope` (= `days / (2·baseDays)`); `accelerating`: `(1 + a)(1 − e^(−λ·days))`.
+* This is an INVERSION (`daysToZero(ceilingForDays(R)) === R`), not a configuration value — the
+* config has no `recall_ceiling` key any more (D16).
+*/
+function ceilingForDays(days, cfg) {
+	if (cfg.shape === "linear") return days * slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	const a = cfg.curvature;
+	return (1 + a) * (1 - Math.exp(-lambdaFor(a, cfg.baseDays) * days));
+}
+/**
+* The inverse of {@link ceilingForDays}: how many active days a given ceiling is worth. Used by the
+* deprecated-key warning (`config/loader.ts`) to translate an old `recall_ceiling` value, and by the
+* validation messages.
+*/
+function retentionDaysForCeiling(ceiling, cfg) {
+	if (cfg.shape === "linear") return ceiling / slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	return daysToZero(ceiling, cfg);
+}
+/**
+* `R_max` of the accelerating shape — the days at which the ceiling reaches 1 (`ceiling → ∞`).
+*
+*     R_max = baseDays · ln((1 + a)/a) / ln((1 + a)/(1 + a − BASE_TRUST))
+*
+* `max_retention_days` must stay strictly below it, or a reinforced fact would stop aging like
+* `pinned` does (D14: permanent is set only by a person).
+*/
+function RMAX(curvature, baseDays) {
+	return baseDays * Math.log((1 + curvature) / curvature) / Math.log((1 + curvature) / (1 + curvature - BASE_TRUST));
+}
+/**
+* The shape-aware upper bound on `max_retention_days`: the days at which the ceiling hits 1.
+*
+* `linear`: `2·baseDays` (the ceiling is `days/(2·baseDays)`); `accelerating`: {@link RMAX}. Both
+* are STRICT bounds — at the bound the ceiling is exactly 1, which `superRefine` rejects.
+*/
+function retentionDaysLimit(shape, curvature, baseDays) {
+	return shape === "linear" ? 2 * baseDays : RMAX(curvature, baseDays);
+}
+//#endregion
 //#region ../contract/lib/config.js
 /**
 * Upper bound on tokens handed to the embedder. 0 = auto (the loaded model's declared
@@ -174,6 +314,186 @@ const DEGRADED_LEG_NOTE = "本次仅词法腿，语义腿未就绪（语义后
 * with no error, so the adapter bounds the text first and warns once (DESIGN §20).
 */
 const maxInputTokens = z.number().int().nonnegative().default(0);
+/**
+* One registry/cache endpoint a self-heal section's attempts may name.
+*
+* SHARED by `semantic.self_heal` (transformers.js) and `semantic.native_self_heal` (the native
+* packages): the base `runtime-deps` provider takes ONE source vocabulary, and two spellings of it
+* would be two ways to get the same install wrong.
+*
+* Mirrors the provider's `DependencySource` (interface v5) without importing it: this package is
+* also used by the CLI/MCP processes, which never load the base. An empty `cache` on a source with
+* no registry means "the family root's npm cache" — the plugin fills in `<home>/cache/npm` when it
+* builds the item, because this schema does not know the family root.
+*/
+const selfHealSourceSchema = z.object({
+	id: z.string().min(1),
+	registry: z.string().default(""),
+	cache: z.string().default("")
+});
+/**
+* One install attempt, in the base provider's vocabulary. SHARED by both self-heal sections.
+*
+* `env` exists mainly for `ONNXRUNTIME_NODE_INSTALL=skip`: `onnxruntime-node`'s postinstall download
+* returns 302 on some mirrors, and skipping that check is enough for transformers.js to load its
+* WASM/CPU fallback.
+*
+* `allowScripts` is explicit in this plugin's defaults: the base provider defaults it to `false`
+* (lifecycle scripts from a registry package are a caller decision), and `onnxruntime-node` needs its
+* postinstall unless the attempt sets `ONNXRUNTIME_NODE_INSTALL=skip`. Leaving it unset here would
+* turn every default attempt into an `--ignore-scripts` install and break the native binary. The same
+* holds — more strongly — for the native section: `nodejieba` and `hnswlib-node` are node-gyp builds
+* whose ONLY artefact is produced by the install script.
+*/
+const selfHealAttemptSchema = z.object({
+	source: z.string().min(1),
+	manager: z.enum(["npm", "pnpm"]).optional(),
+	env: z.record(z.string(), z.string()).default({}),
+	allowScripts: z.boolean().optional()
+});
+/**
+* One entry of the STARTUP DEPENDENCY AUDIT (`audit:` in `res/runtime-deps.yaml`): what to observe,
+* how loud to say it, and under which condition — a session notice, plus the probe that decides
+* whether it is due.
+*
+* WHY IT IS DATA, NOT CODE. The interesting question at the end of a mount is "which of the optional
+* things this build is made of can this process actually load?" — and the set differs per RELEASE (a
+* native binding added or dropped, a mirror changed, a sentence reworded). Writing those names and
+* sentences in code would make the implementation carry a deployment's vocabulary. So the plugin
+* implements two GENERIC probe kinds, and the shipped declaration says which pieces exist and what a
+* session is told about them. No package name, body, severity or condition is written in code.
+*
+* `kind` selects the probe:
+*
+*  - `module` — resolve AND LOAD `specifier` (a `require`/`import`, so a native addon's binding is
+*    really loaded, not just found), from a ready self-heal root first and from this tree otherwise.
+*    States: `available` (loaded), `failed` (resolved, but loading it threw — the classic node-gyp
+*    build that exists and does not work), `missing` (nothing resolved).
+*  - `runtime-deps` — the STATE of the named `item` (`mem:semantic-deps`, `mem:native-deps`, or any
+*    other runtime-deps item): `available` (ready), `failed`, `missing`, `skipped`, `pending`.
+*
+* `when` is matched against that state, and the word means the same thing for both kinds:
+* `failed` → `failed`; `missing` → `missing` or `skipped`; `degraded` → any of the three. An entry
+* that is `pending` matches NOTHING: a line latched while a background install is still running would
+* outlive the success it is waiting for. (`pending` only occurs for `runtime-deps`, whose item may be
+* mid-install; a `module` probe is a single synchronous load and cannot be pending.)
+*
+* `min_vectors` (optional, `0`/omitted = every corpus) holds the line back until the live vector
+* index reaches that size — the corpus-size knob an ANN entry needs (below the switch-over point the
+* brute-force store is the intended backend, so a missing ANN binding is not a defect). It is a
+* literal in the declaration, deliberately not derived from `vectorStore.auto_thresholds.hnswlib`:
+* code that computed it would be branching on a package, which is what this section exists to avoid.
+*
+* `id` must be namespaced (`mem:…`) — it is the unit of the once-per-session latch, so an id shared
+* with another plugin would silently suppress one of the two lines. The base registry warns and
+* ignores a malformed one instead of throwing, and so this schema rejects it up front.
+*/
+const dependencyAuditFields = {
+	id: z.string().min(1),
+	severity: z.enum([
+		"info",
+		"warning",
+		"degraded"
+	]),
+	when: z.enum([
+		"failed",
+		"missing",
+		"degraded"
+	]),
+	min_vectors: z.number().int().nonnegative().optional(),
+	body: z.string().min(1)
+};
+/** One audit entry. `kind` decides which probe runs, and which of `specifier`/`item` is required. */
+const DependencyAuditEntrySchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("module"),
+	/** The npm specifier to load (`nodejieba`, `hnswlib-node`, `@huggingface/transformers`, …). */
+	specifier: z.string().min(1),
+	...dependencyAuditFields
+}), z.object({
+	kind: z.literal("runtime-deps"),
+	/** The runtime-deps item whose state is observed (`mem:semantic-deps`, `mem:native-deps`, …). */
+	item: z.string().min(1),
+	...dependencyAuditFields
+})]);
+/**
+* One `runtime-deps` declaration as SHIPPED WITH THE PLUGIN (`packages/plugin/res/runtime-deps.yaml`).
+*
+* WHY IT IS A RESOURCE AND NOT USER CONFIG. The package set, the sources, the attempts, the verify
+* list and the audit sentences are facts about THIS BUILD: which module the local backend imports,
+* which native bindings this release looks for, what a session should be told when one of them is
+* absent. Leaving them to `configs/common.yaml` made every deployment responsible for keeping that
+* list correct — a stale copy would install a module no code loads, or silently drop the audit — and
+* the shipped defaults were only ever the plugin's own declaration anyway. The operator keeps the one
+* thing that really is a per-deployment decision (the two `enabled` switches); the DATA travels in the
+* package, next to the code that reads it.
+*
+* Validation is strict on purpose: the file is read from the INSTALL directory at mount, and a
+* malformed one is a packaging bug. The plugin logs it and degrades (no self-heal item, no audit)
+* rather than throwing out of the mount — see `packages/plugin/src/runtime_deps_resource.ts`.
+*
+* The schema is the SINGLE definition of the file's shape: the loader validates with it, and the
+* plugin maps it to the base provider's objects field by field (the base never reads YAML).
+*/
+const RuntimeDepsResourceSchema = z.object({
+	/** Format version, so a future shape can be recognized instead of misread. */
+	version: z.literal(1),
+	/** `@huggingface/transformers` — the semantic leg's optional module. */
+	semantic: z.object({
+		packages: z.record(z.string(), z.string()),
+		sources: z.array(selfHealSourceSchema),
+		attempts: z.array(selfHealAttemptSchema),
+		verify: z.array(z.string())
+	}),
+	/** The native optional dependencies (`nodejieba`, `hnswlib-node`). */
+	native: z.object({
+		packages: z.record(z.string(), z.string()),
+		sources: z.array(selfHealSourceSchema),
+		attempts: z.array(selfHealAttemptSchema),
+		verify: z.array(z.string())
+	}),
+	/**
+	* What the startup dependency audit observes, and what a session is told. Each entry is one probe
+	* (`kind`) plus its delivery decision — see {@link DependencyAuditEntrySchema}.
+	*/
+	audit: z.array(DependencyAuditEntrySchema)
+});
+/**
+* Semantic dependency self-heal (`@huggingface/transformers` + transitive `onnxruntime-node`).
+*
+* **OFF by default** on purpose: enabling it means the plugin may run a package-manager install at
+* startup, i.e. network access before anyone asked for it. A profile that wants the repair opts in
+* (`semantic.self_heal.enabled: true`); without it the runtime keeps its existing optional-dependency
+* resolution and degrades to FTS+entity when the package is absent.
+*
+* The SPEC itself (packages / sources / attempts / verify) is NOT here: it ships in
+* `res/runtime-deps.yaml` (`RuntimeDepsResourceSchema`). This section is the operator's policy — the
+* only per-deployment decision left, because it costs a startup install.
+*/
+const semanticSelfHealSchema = z.object({ enabled: z.boolean().default(false) });
+/**
+* NATIVE dependency self-heal (`nodejieba`, `hnswlib-node`) — the optional npm dependencies whose
+* absence degrades a FEATURE rather than the plugin:
+*
+*  - `nodejieba` → POS tagging; without it entity/relation extraction falls back to a regex pass
+*    (weaker entity + jaccard legs, still functional),
+*  - `hnswlib-node` → the ANN vector index; without it queries stay on the brute-force store (exact,
+*    slower once the corpus grows).
+*
+* Both are node-gyp packages, so their shipped `attempts` allow install scripts (see
+* `res/runtime-deps.yaml`): an `--ignore-scripts` install of either produces a `require()` that fails
+* at run time, which is the one outcome a "self-heal" must not produce.
+*
+* One item, two packages, ONE store root per spec: the base's `runtime-deps` item is
+* content-addressed, so this spec (a different package set from the semantic one) lands in a
+* DIFFERENT immutable root under `<home>/deps/runtime/<key>/` — never the transformers root, whose
+* `node_modules` does not carry either native build.
+*
+* OFF by default, for the same reason as `self_heal`: enabling it means a package-manager install
+* (and a native compile) at startup. What a session is told about a missing package is an `audit`
+* entry in the same resource file, judged on the package itself and therefore working with or without
+* a repair.
+*/
+const nativeSelfHealSchema = z.object({ enabled: z.boolean().default(false) });
 const semanticSchema = z.object({
 	backend: z.string().default("local_bge"),
 	local_model: z.string().default("Xenova/bge-base-zh-v1.5"),
@@ -193,7 +513,14 @@ const semanticSchema = z.object({
 	* stay, but nothing re-encodes on its own. Set to `false` on a metered/embedded host that must not
 	* spend CPU on background re-encoding.
 	*/
-	auto_migrate: z.boolean().default(true)
+	auto_migrate: z.boolean().default(true),
+	/** Repair a missing `@huggingface/transformers` install through the base's shared runtime store. */
+	self_heal: semanticSelfHealSchema.prefault({}),
+	/**
+	* Repair a missing NATIVE optional dependency (`nodejieba` / `hnswlib-node`) through the same
+	* base mechanism, in its OWN store root (see {@link nativeSelfHealSchema}).
+	*/
+	native_self_heal: nativeSelfHealSchema.prefault({})
 });
 const vectorStoreSchema = z.object({
 	backend: z.string().default("auto"),
@@ -341,40 +668,83 @@ const presenceSchema = z.object({
 	/** Long-lived surfaces (plugin / MCP) tick this often; 0 = startup pass only. */
 	heartbeat_minutes: z.number().int().nonnegative().default(60)
 });
+/**
+* Trust & forgetting (TRUST_MODEL.md §2 / §7).
+*
+* The knobs are DAYS and a SHAPE, never a slope: the operator's promise is "how long does a memory
+* last", and the arithmetic that turns days into trust units lives in `trust_curve.ts` (one
+* implementation, shared with the load-time validation below). `recall_ceiling` is gone — the
+* reinforcement ceiling is an INVERSION of `max_retention_days` (D16).
+*/
 const trustSchema = z.object({
-	/** false = no presence, no decay, no reinforcement, no pinning (TTL/idle/purge keep running). */
+	/** false = no presence, no decay, no reinforcement, no pinning, no automatic archiving (purge keeps running). */
 	enabled: z.boolean().default(true),
-	/** Initial trust of a new fact. */
-	start: z.number().min(0).max(1).default(.5),
-	/** Linear decay per active day: `0.5 / 90` ⇒ 90 active days from start to 0. */
-	decay_per_day: z.number().min(0).max(1).default(.5 / 90),
+	/**
+	* The anchor: active days a fact takes to fall from `BASE_TRUST` (0.5, frozen — D20) to 0, i.e.
+	* "how long a never-recalled memory lives". `start` is NOT configurable any more: it is the same
+	* 0.5 as the anchor and the reinforcement divider, so one knob could untie all three.
+	*/
+	base_lifetime_days: z.number().int().positive().default(90),
+	/**
+	* The longest stay recall reinforcement can buy, in ACTIVE days — the ceiling is inverted from
+	* this (`ceilingForDays`), never configured (D16).
+	*
+	* P4 ships **174** with `decay_shape: 'accelerating'` ⇒ ceiling ≈ **0.7492**. That pair is a
+	* deliberate PROMISE change, not a correction: the longest stay grows 153 → 174 active days and the
+	* reinforcement ceiling falls 0.85 → 0.7492 (CHANGELOG/unreleased.md). P3's equivalent tier —
+	* `linear` + 153 ⇒ exactly 0.85 — stays legal and is the documented rollback.
+	*/
+	max_retention_days: z.number().int().positive().default(174),
+	/** `accelerating` (the v2 target shape) or `linear` (P3's equivalent tier / the rollback). */
+	decay_shape: z.enum(DECAY_SHAPES).default("accelerating"),
+	/**
+	* `a` — the accelerating shape's floor term. `a > 0` is a hard requirement: at `a = 0`, `T = 1`
+	* is a fixed point, so an `unpin`ned `trust = 1` fact would never decay again — a second kind of
+	* permanent. The `(0, 0.5]` bound is checked in the `superRefine` below (with the reason in the
+	* message). Unused by `linear`, present so both shapes share one schema.
+	*/
+	decay_curvature: z.number().default(.05),
 	/** Trust ≤ this ⇒ forgotten (archived 'forgot'). 0 = "reaching zero is forgetting". */
 	forget_threshold: z.number().min(0).max(1).default(0),
-	/** Reaching this via explicit feedback promotes to permanent (snapped to 1.0). */
-	permanent_threshold: z.number().min(0).max(1).default(.9),
-	/** A recall of something at/below this raises it straight back to this value. */
-	recall_floor: z.number().min(0).max(1).default(.5),
-	/** Per-recall gain (before marginal decay). */
-	recall_delta: z.number().min(0).max(1).default(.03),
+	/**
+	* Per-recall gain BELOW `BASE_TRUST`, capped at `BASE_TRUST` itself. `0.1` ⇒ five recalls take a
+	* fact from 0.05 back to the base (the second crossing — from exactly 0.5 up — is the above-base
+	* segment, D20).
+	*/
+	recall_gain_below_base: z.number().gt(0).max(.5).default(.1),
+	/** Per-recall gain above `BASE_TRUST` (before marginal decay), capped at the derived ceiling. */
+	recall_gain_above_base: z.number().gt(0).max(1).default(.01),
 	/** Effective reinforcement events per fact per 24h (R10: zero-gain ones don't count). */
 	recall_daily_cap: z.number().int().nonnegative().default(3),
-	/** 1 = every in-window gain is equal; 0.5 = 0.03 / 0.015 / 0.0075 … */
+	/** 1 = every in-window gain is equal; 0.5 = 0.01 / 0.005 / 0.0025 … */
 	recall_marginal_decay: z.number().min(0).max(1).default(1),
-	/** Recall alone can never exceed this (and never pins — see D11). */
-	recall_ceiling: z.number().min(0).max(1).default(.85),
-	/** Explicit `helpful` / `unhelpful` step. */
-	feedback_delta: z.number().min(0).max(1).default(.05),
-	/** 0 = unlimited; >0 also caps feedback reinforcement per fact per 24h. */
-	feedback_daily_cap: z.number().int().nonnegative().default(0),
 	/** A revised fact inherits the settled trust (and pin) of the row it replaces. */
 	inherit_trust_on_update: z.boolean().default(true),
 	/** Pinned (permanent) facts are never physically purged. */
 	purge_skips_pinned: z.boolean().default(true),
-	/** Calendar fallback: unused for this many days ⇒ archived 'idle'. */
-	idle_calendar_days: z.number().int().positive().default(365),
 	/** Per-tick budget for the settle sweep (the other sweeps only touch critical rows). */
 	tick_max_facts: z.number().int().positive().default(5e3),
 	presence: presenceSchema.prefault({})
+}).superRefine((trust, ctx) => {
+	const curve = curveOf(trust);
+	const base = trust.base_lifetime_days;
+	const days = trust.max_retention_days;
+	const a = trust.decay_curvature;
+	const fail = (path, message) => {
+		ctx.addIssue({
+			code: "custom",
+			path: [path],
+			message
+		});
+	};
+	const ceiling = () => ceilingForDays(days, curve).toFixed(4);
+	if (!(a > 0) || a > .5) fail("decay_curvature", `decay_curvature must be in (0, 0.5]; got ${String(a)} — 0 会让 T=1 永不衰减（unpin 之后仍然不老，等于第二层"永久"），>0.5 会把可配寿命区间压到默认值以下`);
+	if (days <= base) fail("max_retention_days", `max_retention_days must be > base_lifetime_days (${String(base)}); got ${String(days)} — 你这个值等价于 ceiling=${ceiling()}，召回加强不会产生任何增益；合法区间 (${String(base)}, ${retentionDaysLimit(trust.decay_shape, a, base).toFixed(1)})`);
+	const limit = retentionDaysLimit(trust.decay_shape, a, base);
+	if (!(days < limit)) {
+		const other = trust.decay_shape === "linear" ? `accelerating (a=${String(a)}): ${RMAX(a, base).toFixed(1)}` : `linear: ${(2 * base).toFixed(1)}`;
+		fail("max_retention_days", `max_retention_days must be < ${limit.toFixed(1)} (${trust.decay_shape}, a=${String(a)}, base=${String(base)}); legal range (${String(base)}, ${limit.toFixed(1)}); got ${String(days)} — 你这个值等价于 ceiling=${ceiling()}，与"永久只由人设"冲突；另一种形状的上界：${other}`);
+	}
 });
 const lifecycleSchema = z.object({
 	/** Purge window, measured in ACTIVE days since `archived_clock`. */
@@ -571,8 +941,6 @@ const KIND_FILTER_DESCRIPTION = `限定记忆层；可选（取值：${MEMORY_KI
 const SOURCE_REF_DESCRIPTION = "这条事实的来源（可选）：未给 = 未知来源，引擎不会臆造。用 `kind:` 前缀标明来源类型——`session:<会话 id>`（会话供述）、`tool:<工具名>`（工具产出）、无前缀则记为 `manual`（调用方手工给出），前缀之后的文本原样保存。可用 `mem_admin` 的 `list`（`source=`）反查同一来源产生了哪些事实。";
 /** P-13 `event_date`: the event time, written into `valid_from`. */
 const EVENT_DATE_DESCRIPTION = "这件事发生的时间（可选，ISO 日期或日期时间，如 2026-10-06 或 2026-10-06T09:30:00+08:00）：写入事实的事件时间，供时间窗检索与展示使用；不参与打分。未给 = 未知（不写）。";
-/** P-13 `valid_until`: a known end, written into `valid_to` WITHOUT archiving the row. */
-const VALID_UNTIL_DESCRIPTION = "这条事实有效到什么时候（可选，ISO 日期或日期时间）：写入有效期终点，**不会归档该事实**——「仍然有效、但已知截止于某时」的事实照常参与检索。未给 = 未知（不写）。";
 /**
 * `title`: the short, human-readable handle of a journal entry (JOURNAL_TITLE_SEARCH §2.4/§11.1).
 *
@@ -696,9 +1064,12 @@ function modelFacingToolResult(toolKey, action, value) {
 *  - `source_ref` — the citation the answer must carry;
 *  - `created_at` / `updated_at` — memory MAINTENANCE: when it was written and when it was last
 *    changed is what tells the model whether a fact is fresh enough to act on (and `updated_at`
-*    differing from `created_at` is the only visible sign that it was revised);
-*  - `valid_from` / `valid_to` — when the fact was true (P-07), which is what an "as of when"
-*    question needs;
+*    differing from `created_at` is the only visible sign that it was revised). Both are INSTANTS
+*    rendered as ISO-8601 WITH the host's offset (`2026-10-28T19:58:48+08:00`), so the model does no
+*    timezone arithmetic and cannot read them as local time;
+*  - `valid_from` — the event time (P-07/P-13), which is what an "as of when" question needs. A
+*    CALENDAR DATE (`YYYY-MM-DD`) with no zone — deliberately a different shape from the two
+*    instants above, because it answers a different question;
 *  - `title` — the journal entry's short handle, for recognition and for the follow-up write flow
 *    (an update inherits it). Display only: it never moved this hit's `score`;
 *  - `scores` / `final` — only ever present when the caller explicitly asked for the evidence.
@@ -718,7 +1089,6 @@ const MODEL_HIT_FIELDS = [
 	"created_at",
 	"updated_at",
 	"valid_from",
-	"valid_to",
 	"scores",
 	"final"
 ];
@@ -726,14 +1096,17 @@ const MODEL_HIT_FIELDS = [
 const NULLABLE_HIT_FIELDS = /* @__PURE__ */ new Set([
 	"updated_at",
 	"valid_from",
-	"valid_to",
 	"title"
 ]);
 /**
 * The envelope a recall result carries besides its rows. Two of these are only meaningful in one
-* mode — `total`/`offset`/`limit`/`truncated` describe an EXACT page, `degraded` describes a fuzzy
-* pass — and the projection keeps whichever are present, so one function serves both shapes
-* (RECALL_INTERFACE §5).
+* mode — `total`/`offset`/`limit`/`remaining`/`truncated` describe a paged answer (`remaining` only
+* exists on a pure time window, which pages at 50), `degraded` describes a fuzzy pass — and the
+* projection keeps whichever are present, so one function serves every shape (RECALL_INTERFACE §5).
+*
+* `remaining` is here for a specific reason: "how much of the window did I not see" is a fact the
+* model must act on (narrow the window, or page on), and leaving it out left only `truncated: true`
+* with the size of the gap to be guessed.
 *
 * `weights`, `floors`, `dropped_by_floor` and `used_tokens` are the operator's diagnostics: a
 * threshold the caller cannot set and a drop count it cannot act on are pure tokens in the model's
@@ -744,6 +1117,7 @@ const RESULT_ENVELOPE_FIELDS = [
 	"total",
 	"offset",
 	"limit",
+	"remaining",
 	"truncated"
 ];
 /** Copy the envelope fields a payload actually carries, in a fixed order. */
@@ -975,10 +1349,8 @@ const RememberUnion = z.discriminatedUnion("action", [
 		content: z.string().min(1).describe("要写入或替换的事实内容：一句自包含的陈述。action=add 时必填。"),
 		kind: z.enum(MEMORY_KINDS).optional().describe(KIND_WRITE_DESCRIPTION),
 		title: z.string().min(1).max(120).optional().describe(TITLE_WRITE_DESCRIPTION),
-		ttl_days: z.number().int().nonnegative().optional().describe("有效期天数（0 或省略 = 不设有效期；正整数 = 自写入起该天数后自动归档）。update 未给则继承被改写事实的 TTL。"),
 		source_ref: z.string().min(1).optional().describe(SOURCE_REF_DESCRIPTION),
 		event_date: z.string().min(1).optional().describe(EVENT_DATE_DESCRIPTION),
-		valid_until: z.string().min(1).optional().describe(VALID_UNTIL_DESCRIPTION),
 		relations: z.array(RelationInputSchema).max(20).optional().describe(RELATIONS_DESCRIPTION)
 	}),
 	z.object({
@@ -988,24 +1360,14 @@ const RememberUnion = z.discriminatedUnion("action", [
 		kind: z.enum(MEMORY_KINDS).optional().describe(`改写后的${KIND_WRITE_DESCRIPTION}`),
 		title: z.string().min(1).max(120).optional().describe(`改写后的${TITLE_WRITE_DESCRIPTION}`),
 		retitle: z.literal(true).optional().describe(RETITLE_DESCRIPTION),
-		ttl_days: z.number().int().nonnegative().optional().describe("新的有效期天数（0 = 取消有效期）；可选，未给则继承被改写事实的 TTL。"),
 		source_ref: z.string().min(1).optional().describe(SOURCE_REF_DESCRIPTION),
 		event_date: z.string().min(1).optional().describe(EVENT_DATE_DESCRIPTION),
-		valid_until: z.string().min(1).optional().describe(VALID_UNTIL_DESCRIPTION),
 		relations: z.array(RelationInputSchema).max(20).optional().describe(`改写后的${RELATIONS_DESCRIPTION}`)
 	}),
 	z.object({
 		action: z.literal("remove"),
 		fact_id: z.number().int().positive().describe("要删除的事实 ID。action=remove 时必填。"),
 		reason: z.string().optional().describe("删除原因；可选。")
-	}),
-	z.object({
-		action: z.literal("helpful"),
-		fact_id: z.number().int().positive().describe("对回答有帮助的事实 ID。action=helpful 时必填。")
-	}),
-	z.object({
-		action: z.literal("unhelpful"),
-		fact_id: z.number().int().positive().describe("对回答无帮助的事实 ID。action=unhelpful 时必填。")
 	})
 ]);
 /**
@@ -1028,9 +1390,13 @@ function modelSubset(union, actions) {
 	return z.discriminatedUnion("action", options);
 }
 /**
-* The writes the model may make. `helpful` / `unhelpful` are operator feedback: the model cannot
-* observe the retention clocks they move, and a model that could would be able to "refresh" a fact by
-* voting on it — the exact behaviour the retention policy exists to prevent.
+* The writes the model may make — `MODEL_REMEMBER_ACTIONS` and `REMEMBER_ACTIONS` are the same three
+* again since the operator-side `helpful` / `unhelpful` actions were removed: a vote on a fact was a
+* way to move its retention clock, and a model able to vote could "refresh" a fact by voting on it.
+*
+* Permanent is set by ONE route only: an explicit `pin` from a human (`mem_admin` / CLI / settings
+* page). Do NOT re-add an action that promotes or demotes a fact from a write path — that is the
+* behaviour the retention policy exists to prevent.
 */
 const MODEL_REMEMBER_ACTIONS = [
 	"add",
@@ -1068,9 +1434,16 @@ const TITLE_INCLUDE_EXCERPT_DESCRIPTION = "是否返回内容摘要（可选，
 * The exact page's own field descriptions. Their numbers are the documented ones (page 10, cap 50)
 * and they apply ONLY to an exact result — the fuzzy pass is a fixed shortlist of five, so a caller
 * that got no exact hit cannot page it.
+*
+* `limit`'s DEFAULT is the one place the pure time window differs: a window is a LIST, so it is
+* paged at the contract's maximum (50) instead of the exact page's ten (core `timePage`,
+* `TIME_DEFAULT_LIMIT`), and its result reports `remaining` — how much of the window the page does
+* not show. The schema's `.max(50)` is unchanged: an omitted `limit` never goes through it, so the
+* default is a number the ENGINE picks, not a value the caller could send. `titles` keeps its own
+* description (unchanged).
 */
 const SEARCH_OFFSET_DESCRIPTION = "分页偏移（从 0 开始）；可选，默认 0。只作用于分页类结果（search 的 exact/time/facts）；模糊检索不接受分页。";
-const SEARCH_LIMIT_DESCRIPTION = "返回条数上限（1-50）；可选，默认 10。只作用于分页类结果（search 的 exact/time/facts）；模糊检索固定返回 5 条。";
+const SEARCH_LIMIT_DESCRIPTION = "返回条数上限（1-50）；可选，默认 10（纯时间召回即只给 `time` 时默认 50；该方法的结果另带 `remaining`＝窗口内还有多少条未显示）。只作用于分页类结果（search 的 exact/time/facts）；模糊检索固定返回 5 条。";
 const TITLES_LIMIT_DESCRIPTION = "返回条数上限（1-50）；可选，默认 10。只作用于标题完整相等的精确结果；模糊标题检索固定返回 5 条。";
 const SEARCH_QUERY_DESCRIPTION = "检索文本（1–" + String(MAX_QUERY_CHARS) + " 字符）。已给 `time` 时可省略——只给 `time` 就是纯时间召回（`mode=time`：按 `time.field` 从新到旧，不再做字面/事实/关系/模糊检索）。";
 /**
@@ -1089,7 +1462,7 @@ const SearchRequestSchema = z.object({
 	source: z.string().optional().describe("限定来源（`fact_sources.ref`）：来源等于该值的事实才参与本次检索；可选，不参与打分（未给 = 不过滤）。"),
 	offset: z.number().int().nonnegative().optional().describe(SEARCH_OFFSET_DESCRIPTION),
 	limit: z.number().int().positive().max(50).optional().describe(SEARCH_LIMIT_DESCRIPTION),
-	max_tokens: z.number().int().nonnegative().optional().describe("本次结果的总 token 上限；0=不限制。缺省用配置 retrieval.max_output_tokens。"),
+	max_tokens: z.number().int().nonnegative().optional().describe("本次结果的总 token 上限；0=不限制。缺省：exact/facts/模糊用配置 retrieval.max_output_tokens；纯时间召回不套预算。"),
 	floors: z.enum(FLOOR_PROFILES).optional().describe(FLOORS_FIELD_DESCRIPTION),
 	include_scores: z.boolean().optional().describe(INCLUDE_SCORES_DESCRIPTION),
 	time: TimeFilterSchema.optional().describe("时间过滤（可选）：内容 ∩ 时间。硬过滤——窗口内的事实不会被窗口外的高分结果挤掉；给了它就按它，不再叠隐式时间窗。没给 `query` 时必填：时间窗就是整个问题（纯时间召回）。")
@@ -1194,7 +1567,7 @@ const ModelAdminUnion = modelSubset(AdminUnion, [
 const REMEMBER_TOOL = {
 	key: "remember",
 	name: "mem_remember",
-	description: "写入/更新/删除长期记忆事实。add=新增一条简洁的独立陈述；update=改写已有事实；remove=删除。写入没有改变任何状态时是静默 no-op（add 命中完全重复的内容、update 重存同一内容）。`kind` 必填，两层：`journal`=做了什么/聊了什么/想了什么（必须同时给 `event_date`，写事情发生的日期而不是写入日期，缺了会被拒绝）；`note`=稳定事实/偏好/决策/坑。只记会改变后续行为的摘要，不抄全文；不要把每段聊天都写成 journal；`note` 可用 `relations` 写出稳定关系（`{subject, predicate, object}` 三个名字）；`journal` 不写 relations，需要留关系时另写一条 note；journal 的 add 必须给 `title`（短标题，见下），总结覆盖目标/关键动作/结论/产出位置/未决项；从 journal 提炼为 note 时用 `source_ref` 指回来源。标题流程：写 journal 前标题不确定时，用 `mem_recall` 的 `titles`（2–4 个主题关键词）找候选，读候选的 title/event_date/摘要判断是否同一事务——同一事务用 `update` 该 fact_id 并省略 title（继承），不同事务 `add` 并给新的 title。同一事务复用同一 title；后续轮次都用上一次 update 返回的新 fact_id；title 在一条 revision 链内不可变，显式换 title 会被拒绝（标题为 NULL 的旧 journal 可一次性回填）；发现标题写错时，用 `update` 带 `retitle: true` 与正确的 title 纠正一次——旧标题保留为别名，用旧标题检索仍能命中。`ttl_days` 规则：显式给定的值一定生效，未给则保留该事实原有的值——update 未给时继承被改写事实的 ttl_days。",
+	description: "写入/更新/删除长期记忆事实。add=新增一条简洁的独立陈述；update=改写已有事实；remove=删除。写入没有改变任何状态时是静默 no-op（add 命中完全重复的内容、update 重存同一内容）。`kind` 必填，两层：`journal`=做了什么/聊了什么/想了什么（必须同时给 `event_date`，写事情发生的日期而不是写入日期，缺了会被拒绝）；`note`=稳定事实/偏好/决策/坑。只记会改变后续行为的摘要，不抄全文；不要把每段聊天都写成 journal；`note` 可用 `relations` 写出稳定关系（`{subject, predicate, object}` 三个名字）；`journal` 不写 relations，需要留关系时另写一条 note；journal 的 add 必须给 `title`（短标题，见下），总结覆盖目标/关键动作/结论/产出位置/未决项；从 journal 提炼为 note 时用 `source_ref` 指回来源。标题流程：写 journal 前标题不确定时，用 `mem_recall` 的 `titles`（2–4 个主题关键词）找候选，读候选的 title/event_date/摘要判断是否同一事务——同一事务用 `update` 该 fact_id 并省略 title（继承），不同事务 `add` 并给新的 title。同一事务复用同一 title；后续轮次都用上一次 update 返回的新 fact_id；title 在一条 revision 链内不可变，显式换 title 会被拒绝（标题为 NULL 的旧 journal 可一次性回填）；发现标题写错时，用 `update` 带 `retitle: true` 与正确的 title 纠正一次——旧标题保留为别名，用旧标题检索仍能命中。",
 	input: ModelRememberUnion
 };
 const RECALL_TOOL = {
@@ -1220,7 +1593,7 @@ Number.MAX_SAFE_INTEGER, -Number.MAX_SAFE_INTEGER;
 *
 * Descriptions are authored per action ("action=update 时必填"), so taking the
 * first branch's text verbatim told a model that `fact_id` only matters for
-* `update` although `remove/helpful/unhelpful` require it too. The action-clause
+* `update` although `remove` requires it too. The action-clause
 * is stripped and replaced by the derived set of actions that make the field
 * required.
 *
@@ -1534,6 +1907,96 @@ function adoptWellFormed(kit) {
 	};
 }
 //#endregion
+//#region ../contract/lib/time.js
+/**
+* The ONE place a stored timestamp turns into a string a human (or a model) reads.
+*
+* ── THE BUG THIS MODULE EXISTS FOR ───────────────────────────────────────────────────────────────
+*
+* `facts.created_at` / `updated_at` / `archived_at` (and `contradiction_log.detected_at`, and the
+* retrieval-health stamp) are written by SQLite's `DEFAULT CURRENT_TIMESTAMP`, which is **UTC**, and
+* `store/memory.ts` used to hand the raw text up to every surface. Two consequences, both reported as
+* "记忆时间显示不对":
+*
+*  1. the UI printed `2026-10-28 11:58:48` as if it were a local wall clock (Asia/Shanghai really
+*     meant `19:58:48`), because a zone-less string cannot say otherwise;
+*  2. the MODEL received the same zone-less string next to `event_date`, which is a calendar DATE
+*     with no time and no zone. Two different kinds of value, one shape — the model had to guess
+*     which one it was looking at, and it cannot.
+*
+* ── THE SPLIT THIS MODULE ENFORCES ───────────────────────────────────────────────────────────────
+*
+* Storage stays UTC and stays byte-identical (`facts_io` export/import/snapshot is a compatibility
+* surface and is deliberately NOT routed through here). The fix is in the two DISPLAY faces:
+*
+*  - {@link formatOffsetIso} — the MODEL face (`mem_recall` hits, `mem_admin list/detail/
+*    contradictions`, `mem_admin stats`, the CLI and MCP that print those payloads): an ISO-8601
+*    instant **with an explicit offset**, e.g. `2026-10-28T19:58:48+08:00`, rendered in the host's
+*    local zone. The offset is part of the string, so the model needs no conversion and the value is
+*    never ambiguous again — while `event_date` stays `2026-10-28`, a calendar date with no zone.
+*  - {@link formatLocalHuman} — the HUMAN face (the 记忆 tab): `2026-10-28 19:58`, the same instant,
+*    local, to the minute.
+*
+* Both read the input through the SAME parser ({@link parseUtcTs}) and the same instant, so the two
+* faces cannot disagree. The UI deliberately formats the model face's OWN string rather than
+* re-deriving one from the raw column: the input it gets already carries an offset, `parseUtcTs`
+* leaves an explicit offset alone, and there is therefore exactly ONE parse rule and ONE pair of
+* renderers in the repository — not a second opinion in the browser.
+*
+* Dependency-free on purpose: this module is reachable from the DSH client bundle through the
+* `@avantf/mem-contract/time` subpath (the bundle must not pull in the tool schemas / zod). It has no
+* DSH host and no DB, so the engine, the CLI and the MCP face can all use it.
+*
+* @module contract/time
+*/
+/** Two-digit, zero-padded — the only formatting primitive the two renderers share. */
+function pad2$2(value) {
+	return String(value).padStart(2, "0");
+}
+/**
+* `'YYYY-MM-DD HH:MM:SS'` (SQLite UTC) or ISO → epoch ms; null/garbage → null.
+*
+* A stamp with NO zone designator is read as UTC, not as local time. `Date.parse` treats a zone-less
+* ISO string as LOCAL, and everything in this store is written in UTC (`CURRENT_TIMESTAMP`, and
+* {@link formatUtcTs}), so handing one over as-is would shift every quota window and every decay
+* measurement by the host's UTC offset — a fact reinforced at 23:00 UTC+8 would look reinforced 8
+* hours earlier, and the 24h cap would open or close at the wrong moment. An explicit `Z` or
+* `±HH:MM` is left alone (that is what makes a `formatOffsetIso` output safe to feed back in).
+*/
+function parseUtcTs(ts) {
+	if (ts === null || ts === void 0 || ts === "") return null;
+	const iso = ts.includes("T") ? ts : ts.replace(" ", "T");
+	const zoned = /(?:Z|[+-]\d{2}:?\d{2})$/i.test(iso) ? iso : `${iso}Z`;
+	const ms = Date.parse(zoned);
+	return Number.isFinite(ms) ? ms : null;
+}
+/** Epoch ms → `'YYYY-MM-DD HH:MM:SS'` (the SQLite `CURRENT_TIMESTAMP` shape, UTC). */
+function formatUtcTs(ms) {
+	return new Date(ms).toISOString().slice(0, 19).replace("T", " ");
+}
+/** The host's offset at that instant, as `+HH:MM` / `-HH:MM` (DST-correct: read from the Date). */
+function offsetSuffix(at) {
+	const minutesEast = -at.getTimezoneOffset();
+	const sign = minutesEast < 0 ? "-" : "+";
+	const abs = Math.abs(minutesEast);
+	return `${sign}${pad2$2(Math.floor(abs / 60))}:${pad2$2(abs % 60)}`;
+}
+/**
+* The MODEL face: an instant as ISO-8601 with an explicit offset, in the host's local zone
+* (`2026-10-28T19:58:48+08:00`).
+*
+* `null` — never `''` and never a fabricated stamp — when the value is absent or unreadable, so a
+* caller keeps its own "unknown" spelling (`''` for `created_at`, `null` for `updated_at`) instead of
+* rendering an empty time. `+00:00` (not `Z`) on a UTC host: the shape MUST carry a sign, which is
+* what a caller regex-checks.
+*/
+function formatOffsetIso(ts) {
+	const ms = parseUtcTs(ts);
+	if (ms === null) return null;
+	const at = new Date(ms);
+	return `${String(at.getFullYear())}-${pad2$2(at.getMonth() + 1)}-${pad2$2(at.getDate())}T${pad2$2(at.getHours())}:${pad2$2(at.getMinutes())}:${pad2$2(at.getSeconds())}` + offsetSuffix(at);
+}
+//#endregion
 //#region lib/types/prompt.js
 /**
 * The one system-prompt section this plugin contributes (DESIGN §10).
@@ -1743,7 +2206,7 @@ function warn$1(log, message) {
 		log?.warn(message);
 	} catch {}
 }
-function reasonOf$1(error) {
+function reasonOf$3(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 /**
@@ -1775,7 +2238,7 @@ async function loadGuarded(options, loadOnce, log, words) {
 	try {
 		return await loadOnce(options);
 	} catch (error) {
-		warn$1(log, `${words.prefix} WARNING — environment initialisation failed (${reasonOf$1(error)}); ${words.loadFailure}`);
+		warn$1(log, `${words.prefix} WARNING — environment initialisation failed (${reasonOf$3(error)}); ${words.loadFailure}`);
 		return;
 	}
 }
@@ -1844,6 +2307,12 @@ function stillActive(ctx) {
 * `agent/pre-step` listener), and the harness shows such a message in the trace as coming from the
 * user. Without an author, a line like "记忆里有相关内容" reads as something the user said. The
 * `[avantf-mem]` prefix is what keeps the provenance honest.
+*
+* The step's injection is not only this hint: the plugin's DEPENDENCY NOTICES (the `audit` entries of
+* the shipped `res/runtime-deps.yaml`) ride in the same message ({@link stepInjection}). They are a
+* different producer of text with the same delivery rule — at most once per owner session, only on a
+* step that already carried a user message — so merging them keeps ONE message per step instead of
+* two competing ones.
 */
 const RELEVANCE_HINT = "[avantf-mem] 记忆里有与上条用户消息相关的内容；需要时用 `mem_recall` 检索。";
 /**
@@ -1879,6 +2348,92 @@ function messageText(message) {
 		return b?.type === "text" && typeof b.text === "string" ? b.text : "";
 	}).filter(Boolean).join("\n");
 }
+/**
+* The text of the ONE message this step injects: the session notices, then the memory hint.
+*
+* `''` means "inject nothing" — the loop's turn-end guard is `decision.messages.length === 0`, so an
+* empty injection has to stay empty rather than become an empty user message.
+*
+* Order: notices first. They report a capability that is not working (a repair the operator asked for
+* did not finish), which is the louder statement; the hint is an invitation. Neither repeats within a
+* session: the notice registry latches per session id, and the hint is one line by construction.
+*
+* Each body is used AS CONFIGURED, with one exception that is about YAML and not about editing: a
+* block scalar (`body: |`) ends with a newline, and keeping it would insert a blank line between the
+* notice and the hint. Trailing whitespace is therefore dropped; nothing else is rewritten, and a
+* whitespace-only body is skipped rather than rendered as an empty paragraph.
+*/
+function stepInjection(hint, notices) {
+	const lines = [];
+	for (const line of notices) {
+		if (typeof line !== "string") continue;
+		const body = line.trimEnd();
+		if (body.trim() === "") continue;
+		lines.push(body);
+	}
+	if (hint) lines.push(RELEVANCE_HINT);
+	return lines.join("\n");
+}
+/**
+* The session-notice lines for this step, or `[]` when there are none to deliver.
+*
+* Three rules, all of them the caller's to make and this plugin's to keep:
+*
+*  1. **`ownerOnly` is a CLAIM, not a lookup.** The base registry cannot know which session owns the
+*     plugin, so it serves only a call that claims it ({@link isOwnerSession} decides), and a
+*     non-claiming call latches nothing — a worker/subagent session therefore never consumes the line
+*     out from under the owner session.
+*  2. **Nothing is cached here.** `consume()` re-reads the item's real state on every step, so a
+*     dependency that healed stops matching and a NEW session simply sees nothing — "fixed ⇒ silent"
+*     needs no invalidation of its own.
+*  3. **Never throws.** This runs on the prompt path of a live agent: a hostile/mismatched registry
+*     costs one skipped line, never the step.
+*/
+function noticeLines(registry, sessionId, owner) {
+	if (registry === void 0 || sessionId === "") return [];
+	try {
+		const lines = registry.consume(sessionId, { ownerOnly: owner });
+		if (!Array.isArray(lines)) return [];
+		return lines.filter((line) => typeof line === "string");
+	} catch {
+		return [];
+	}
+}
+/**
+* Whether `sessionId` is the OWNER session — a TOP-LEVEL agent, not a worker/subagent.
+*
+* Read STRUCTURALLY off the host's agent registry (`ctx.agents`), deliberately without a dependency
+* on `@deepseek-ai/dsh-agent`: the only question is "is this id one of the roots", and the answer
+* decides a claim the base registry would otherwise have to invent a role for. A subagent session is
+* created under its parent's context, so it is never a root — and a mission executor is a subagent
+* too. Those sessions keep working (memory tools, retrieval), they just do not receive the owner's
+* repair notice.
+*
+* "Cannot tell" DELIVERS (`true`): a host with no agent registry, an older registry without `roots()`,
+* a throwing read — none of those prove the session is a worker, and swallowing a real notice on a
+* guess would be the worse failure. This mirrors the family rule that only a PROVEN condition may
+* take a capability away.
+*/
+function isOwnerSession(agents, sessionId) {
+	if (sessionId === "") return false;
+	let roots;
+	try {
+		roots = agents?.roots;
+	} catch {
+		return true;
+	}
+	if (typeof roots !== "function") return true;
+	try {
+		const list = roots.call(agents);
+		if (!Array.isArray(list)) return true;
+		return list.some((agent) => {
+			const id = agent?.id;
+			return id !== void 0 && id !== null && String(id) === sessionId;
+		});
+	} catch {
+		return true;
+	}
+}
 //#endregion
 //#region ../core/lib/config/paths.js
 /**
@@ -1966,6 +2521,11 @@ const DEFAULT_COMMON_CONFIG = `# avantf-mem 公共配置（分层第②层）。
 #   dim: 768
 #   auto_download: true
 #   auto_migrate: true                # 换模型/宽度后自动分批重算旧空间的向量（默认开）；关掉只剩启动告警 + vectors --fix
+#   self_heal:                        # 语义依赖自愈（默认关）：允许启动期安装缺失的 @huggingface/transformers
+#     enabled: false                  # 打开后走底座 runtime-deps 共享根（base ≥ 0.7.0 / interface v6）；失败只降级到 FTS+实体
+#                                     # 装哪个包 / 从哪装 / 提示说什么：见插件自带的 res/runtime-deps.yaml（随包发布）
+#   native_self_heal:                 # 原生可选依赖自愈：nodejieba / hnswlib-node（默认关）
+#     enabled: false                  # 装哪个包、从哪装、提示说什么，都由插件自带的 res/runtime-deps.yaml 决定
 #   ⚠️ cache_dir / mirror 由家族底座 @avantf/dsh-plugin-base 管理：写在这里会被忽略并告警。
 #      缓存目录用环境变量 AVANTF_MEM_MODEL_CACHE，镜像用 AVANTF_MEM_MODEL_MIRROR（或 HF_ENDPOINT）。
 
@@ -2003,8 +2563,13 @@ const DEFAULT_COMMON_CONFIG = `# avantf-mem 公共配置（分层第②层）。
 #   purge_after_archived_days: 365    # 归档事实的物理清理窗口（活跃日）
 #   contradiction_threshold: 0.6
 
-# trust:
-#   decay_per_day: 0.0055…
+# trust:                              # 信任与遗忘：旋钮是「天数 + 形状」，不是斜率
+#   base_lifetime_days: 90            # 锚点：0.5 起点 → 0 的活跃日数（新事实不被召回时的寿命）
+#   max_retention_days: 174           # 召回加强最多能换来的活跃日数；ceiling 由它反解（accelerating 下 ≈ 0.7492）
+#   decay_shape: accelerating         # accelerating（默认）| linear（回滚档：配 153 时 ceiling 回到 0.85）
+#   decay_curvature: 0.05             # accelerating 的下限项 a，合法区间 (0, 0.5]；linear 下不参与
+#   recall_gain_below_base: 0.1       # 低于基准 0.5 时每次召回加多少（封顶基准：0.05 起 5 次到 0.5）
+#   recall_gain_above_base: 0.01      # 高于基准 0.5 时每次召回加多少（封顶上面反解出的 ceiling）
 #   presence:
 #     heartbeat_minutes: 60           # 常驻进程的心跳（活跃日时钟与生命周期扫描）
 
@@ -2107,16 +2672,60 @@ function zodShape(schema) {
 	}
 }
 /**
+* The `trust.*` keys the v2 key replacement deleted (plan §4.1/§4.3), each with the sentence that
+* tells the operator what to write instead.
+*
+* They are still "unknown keys" — the config loader's existing channel — but the generic
+* `unknown config key(s) ignored: trust.decay_per_day` would silently change a lifetime the operator
+* had computed on purpose (`decay_per_day` → "how many days is my memory good for?" is exactly the
+* number that must not drift). Each message therefore names the replacement AND the conversion, computed
+* from the SHIPPED defaults (`base_lifetime_days: 90`, `decay_curvature: 0.05`) with the same
+* `trust_curve` functions the runtime uses.
+*
+* The default curve is read from `defaultConfig`, not written out as literals: if the shipped
+* anchor/curvature moves, these messages move with it instead of quoting stale numbers.
+*/
+const trustKeyWarning = (() => {
+	const shipped = curveOf(defaultConfig.trust);
+	const asDays = (shape, ceiling) => {
+		const days = retentionDaysForCeiling(ceiling, {
+			...shipped,
+			shape
+		});
+		return Number.isFinite(days) ? String(Math.round(days)) : "?";
+	};
+	return {
+		start: () => "trust.start is gone (v2): 起点冻结为 0.5（它与锚点 base_lifetime_days、召回基准是同一个数，不再可配，D20）。这一行删掉即可。",
+		decay_per_day: () => "trust.decay_per_day is gone (v2): 衰减形状由 trust.decay_shape 决定，\"能记多久\"用 trust.base_lifetime_days 与 trust.max_retention_days 表达。默认配置下一条 0.5 起点的事实仍然是 90 个活跃日归零——如果你的旧值就是为了这个，删掉即可。",
+		recall_floor: () => "trust.recall_floor is gone (v2): 基准 0.5 冻结；\"低于基准先爬回基准\"由 trust.recall_gain_below_base 表达（默认 0.1 ⇒ 0.05 起五次召回回到 0.5，不是一次）。这一行删掉即可。",
+		recall_delta: () => "trust.recall_delta is gone (v2): 召回加强改成分段增益——低于基准用 trust.recall_gain_below_base（默认 0.1，封顶基准）、高于基准用 trust.recall_gain_above_base（默认 0.01，仍乘 trust.recall_marginal_decay）；两者都不再等于旧的 0.03 一档。",
+		recall_ceiling: (value) => {
+			const ceiling = Number(value);
+			return `trust.recall_ceiling is gone (v2): 召回上限现在用"寿命"表达。你写的 ${String(value)} 等价于 trust.max_retention_days: ${asDays("linear", ceiling)}（decay_shape: linear） / ${asDays("accelerating", ceiling)}（decay_shape: accelerating，默认 a=0.05）；ceiling 由 max_retention_days 反解，不再可配。`;
+		}
+	};
+})();
+/** `trust.<key>` → the version-specific message, or `undefined` for a genuine typo. */
+function deprecatedTrustKey(key, value) {
+	if (!key.startsWith("trust.")) return void 0;
+	const explain = trustKeyWarning[key.slice(6)];
+	return explain === void 0 ? void 0 : explain(value);
+}
+/**
 * Warn once about unknown config keys — at the ROOT level and inside known sections
 * (TRUST_MODEL.md §7 / review R15+R23). This is generic typo protection, not legacy
 * compatibility: `vector_store` or `semantics` are exactly the mistakes it catches.
 *
+* A DELETED key earns its own sentence ({@link trustKeyWarning}): it is not a typo, and the operator
+* needs the replacement + the conversion, not "check the spelling".
+*
 * Goes to the injected logger, not the process-wide default: this is the one message
 * that tells an operator their config file is being partly ignored, and the DSH host
 * only surfaces what the plugin's logger carries.
 */
 function warnUnknownKeys(source, raw, rootShape, logger) {
 	const unknown = [];
+	const explained = [];
 	for (const [key, value] of Object.entries(raw)) {
 		const section = rootShape[key];
 		if (section === void 0) {
@@ -2125,8 +2734,15 @@ function warnUnknownKeys(source, raw, rootShape, logger) {
 		}
 		const childShape = zodShape(section);
 		if (childShape === void 0 || !isPlainObject(value)) continue;
-		for (const childKey of Object.keys(value)) if (childShape[childKey] === void 0) unknown.push(`${key}.${childKey}`);
+		for (const childKey of Object.keys(value)) {
+			const full = `${key}.${childKey}`;
+			if (childShape[childKey] !== void 0) continue;
+			const message = deprecatedTrustKey(full, value[childKey]);
+			if (message === void 0) unknown.push(full);
+			else explained.push(message);
+		}
 	}
+	for (const message of explained) logger.warn(`${source}: ${message}`);
 	if (unknown.length > 0) logger.warn(`${source}: unknown config key(s) ignored: ${unknown.join(", ")} — check the spelling against docs/DESIGN.md §3`);
 }
 /** Section-aware merge: top-level sections merge one level deep, scalars/arrays replace. */
@@ -2688,6 +3304,49 @@ function ensureAllAsync(options) {
 //#endregion
 //#region ../core/lib/entities/extract.js
 /**
+* Entity extraction: POS tagging and the noun-ish names that become `entities` rows.
+*
+* Uses nodejieba (optional dependency) for POS; degrades gracefully to a character/regex fallback
+* when unavailable, exactly like the `jieba_available()` guard.
+*
+* Note: nodejieba's `tag()` returns `{ word, tag }` objects, and its POS flag set
+* differs from Python jieba (e.g. proper nouns → `nr`, 名动词 → `vn`).
+*
+* WHAT THIS MODULE IS NOT. It owns what is an entity NAME — nothing about relations. The relation
+* half (SVO candidate triples, explicit patterns, the name/statement/confidence gates and the
+* predicate vocabulary) lives in `relations/`; the two halves share exactly one thing, the tagging
+* pass ({@link tagText}), so a write pays for the dictionary once and drives both.
+*
+* WHERE THE MODULE COMES FROM. `nodejieba` is an optional npm dependency, so it is normally resolved
+* from this tree. A host that provisions it instead (the DSH plugin's `runtime-deps` self-heal) sets
+* the shared root with {@link useTokenizerModuleDir}; the load then resolves from THAT root first and
+* falls back to this tree, which is the pre-existing behaviour and also the recovery path for a root
+* that was garbage-collected or damaged. Nothing here decides whether a root should exist.
+*/
+/**
+* The shared module root the tokenizer should be loaded from, when the caller provisioned one.
+*
+* `undefined` (the default, and every CLI/MCP/test caller) = this tree's own optional dependency.
+* Set by {@link useTokenizerModuleDir} from the DSH plugin once the native self-heal item is READY;
+* a failed resolution from it falls back to this tree rather than degrading the tokenizer.
+*/
+let moduleRoot$1;
+/**
+* Point the optional tokenizer at a shared module root (the base `runtime-deps` handle's directory).
+*
+* The memo follows the ROOT: changing it forgets whatever the previous root produced, so the next
+* load resolves from the new one — that is the whole point of setting a root. The cost is at most one
+* extra dictionary parse (~1 s, once) when a root arrives after a lazily loaded copy from this tree;
+* Node's own module cache keeps the import itself cheap. The plugin only sets this once, when its
+* native self-heal item settles.
+*/
+function useTokenizerModuleDir(dir) {
+	const next = dir === "" ? void 0 : dir;
+	if (next === moduleRoot$1) return;
+	moduleRoot$1 = next;
+	jiebaLoad = void 0;
+}
+/**
 * The load, memoized as a PROMISE — not as its result.
 *
 * `mod.load()` parses nodejieba's dictionary synchronously on the main thread (~1 s measured), and
@@ -2698,28 +3357,67 @@ function ensureAllAsync(options) {
 * time — measured 2143 ms for two concurrent callers against 1000 ms for one.
 *
 * A FAILED load is cached too (the same one-attempt policy as before): a process whose jieba cannot
-* be imported uses the regex fallback for its lifetime rather than retrying on every write.
+* be imported uses the regex fallback for its lifetime rather than retrying on every write. The one
+* exception is a module root that arrives afterwards — see {@link useTokenizerModuleDir}.
 */
 let jiebaLoad;
 /** How many times the dictionary was actually parsed in this process (see `jiebaLoadAttempts`). */
 let jiebaAttempts = 0;
+/** The root the LAST attempt resolved from (`undefined` = this tree); reported by {@link jiebaStatus}. */
+let jiebaAttemptedRoot;
+/** Why the last attempt failed, one short line — what makes an "unavailable" log line diagnosable. */
+let jiebaError;
 function loadJieba() {
 	jiebaLoad ??= loadJiebaOnce();
 	return jiebaLoad;
 }
+/**
+* Import `nodejieba` from the shared root, else from this tree.
+*
+* The shared root's own `package.json` is the resolution anchor (the same rule the semantic adapter
+* uses for transformers.js): its `node_modules` is what the provider installed, and importing by FILE
+* URL means this root's copy is the one loaded even when this tree also carries the package. A root
+* that no longer resolves is not an error to report here — the fallback below is the behaviour, and
+* the caller's dependency audit is what tells an operator about it.
+*/
+async function importTokenizer(root) {
+	if (root !== void 0) try {
+		return await import(pathToFileURL(createRequire(join(root, "package.json")).resolve("nodejieba")).href);
+	} catch {}
+	return await import("nodejieba");
+}
+/** nodejieba's export shape, normalised (CJS through `import()` may land on `default`). */
+function tokenizerOf(raw) {
+	const mod = typeof raw?.tag === "function" ? raw : raw?.default ?? raw;
+	return mod !== null && typeof mod?.tag === "function" ? mod : null;
+}
 async function loadJiebaOnce() {
 	jiebaAttempts += 1;
+	const root = moduleRoot$1;
+	jiebaAttemptedRoot = root;
 	try {
-		const raw = await import("nodejieba");
-		const mod = typeof raw.tag === "function" ? raw : raw.default ?? raw;
+		const mod = tokenizerOf(await importTokenizer(root));
+		if (mod === null) throw new Error("nodejieba 的 tag() 不可用");
 		if (typeof mod.load === "function") mod.load();
+		jiebaError = void 0;
 		return mod;
-	} catch {
+	} catch (error) {
+		jiebaError = error instanceof Error ? error.message : String(error);
+		if (moduleRoot$1 !== root) jiebaLoad = void 0;
 		return null;
 	}
 }
-async function jiebaAvailable() {
-	return await loadJieba() !== null;
+/** The status of the memoized load, starting one only when none has run yet. */
+async function jiebaProbe() {
+	await loadJieba();
+	const load = jiebaLoad;
+	return {
+		available: load !== void 0 && await load !== null,
+		attempts: jiebaAttempts,
+		attemptedRoot: jiebaAttemptedRoot,
+		root: moduleRoot$1,
+		error: jiebaError
+	};
 }
 const NOUN_FLAGS = /* @__PURE__ */ new Set([
 	"n",
@@ -2899,6 +3597,32 @@ async function awaitStartupGate(options = {}) {
 	return await whenEventLoopIdle();
 }
 /**
+* The line one tokenizer observation deserves.
+*
+* `previous` is what makes the pair readable: a `ready` after a `degraded` is a RECOVERY (the
+* earlier probe ran before a loadable copy existed — the provisioned root had not been handed over,
+* or the package was not installed yet), not a change of story. A `degraded` line never claims more
+* than it knows: it names the reason and the two ways to fix it, and says that a loadable copy
+* arriving later is picked up automatically.
+*
+* Exported for the test that pins those transitions; it has no side effects.
+*/
+function tokenizerReport(status, elapsedMs, previous) {
+	if (status.available) return {
+		level: "info",
+		message: `model bootstrap: tokenizer ready in ${elapsedMs}ms (nodejieba${status.attemptedRoot === void 0 ? "" : ", provisioned root"})${previous === "degraded" ? " — recovered: the earlier \"unavailable\" line described a probe that ran before a loadable copy existed, not this state" : ""}`,
+		next: "ready"
+	};
+	const reason = status.error === void 0 || status.error === "" ? "nodejieba could not be loaded" : status.error;
+	return {
+		level: "warn",
+		message: `model bootstrap: nodejieba unavailable in ${elapsedMs}ms — ${status.attemptedRoot === void 0 ? `no loadable nodejieba in this tree (${reason})` : `the provisioned root ${status.attemptedRoot} cannot load nodejieba (${reason})`}${previous === "ready" ? " (the copy that was loadable earlier is no longer resolvable — a provisioned root replaced it, or it was removed)" : ""}; entity/triple extraction runs on the regex path (weaker entity + jaccard legs) until a loadable copy exists — install nodejieba, or enable semantic.native_self_heal to have the native item provision it (a provisioned root that arrives later is picked up automatically)`,
+		next: "degraded"
+	};
+}
+/** The last verdict reported in THIS process; see {@link TokenizerVerdict}. */
+let tokenizerVerdict = "unknown";
+/**
 * Warm ONLY the tokenizer, after the host-readiness signal and (when asked) an idle event loop.
 *
 * nodejieba loads its dictionary lazily on the FIRST `tag()` (measured ~950 ms, after which a call
@@ -2914,8 +3638,10 @@ async function warmTokenizer(rt, options = {}) {
 	const waited = await awaitStartupGate(options);
 	if (options.deferTokenizerUntilIdle === true && waited >= 200) rt.logger.info(`model bootstrap: tokenizer warm waited ${waited}ms for an idle event loop`);
 	const jiebaStarted = Date.now();
-	if (await jiebaAvailable()) rt.logger.info(`model bootstrap: tokenizer ready in ${Date.now() - jiebaStarted}ms (nodejieba)`);
-	else rt.logger.warn(`model bootstrap: nodejieba unavailable in ${Date.now() - jiebaStarted}ms — entity/triple extraction falls back to the regex path (weaker entity + jaccard legs)`);
+	const report = tokenizerReport(await jiebaProbe(), Date.now() - jiebaStarted, tokenizerVerdict);
+	tokenizerVerdict = report.next;
+	if (report.level === "warn") rt.logger.warn(report.message);
+	else rt.logger.info(report.message);
 }
 /**
 * Non-blocking embedding warm, for a caller that knows the model files are already on disk.
@@ -3097,7 +3823,7 @@ async function runToolSpec$1(rt, spec, args) {
 //#region ../core/lib/trustHeartbeat.js
 /**
 * The trust heartbeat: the interval beat that advances the active-day clock and performs the
-* settle / forget / idle / purge sweeps (TRUST_MODEL.md §5), shared by the DSH plugin and the MCP
+* settle / forget / purge sweeps (TRUST_MODEL.md §5), shared by the DSH plugin and the MCP
 * server.
 *
 * The two surfaces used to install it separately, and the copies drifted in exactly the places a
@@ -3525,6 +4251,69 @@ function truncateToTokens(text, maxTokens, opts = {}) {
 	};
 }
 /**
+* Slice `text` into windows of at most `maxTokens` estimated tokens instead of truncating it.
+*
+* WHY THIS EXISTS. The window belongs to the loaded model and the call site cannot widen it, so a
+* text past it has exactly one of two fates: cut (what {@link truncateToTokens} does, and what
+* transformers.js does silently on its own) or split. A knowledge chunk of ~1000 characters against
+* a 512-token model lost half its content from the vector that way — measured in production as
+* "503 tokens dropped here". Splitting keeps every token in the representation; the adapter that
+* can only return ONE vector then pools the window vectors (`LocalBgeBackend.encode`).
+*
+* Every returned window satisfies `estimate(window) <= maxTokens` (a one-character window is the
+* floor; the estimator cannot exceed a limit of 1 token for a single character). Cuts land on a
+* sentence/clause boundary when one is in the window's final quarter, so a window does not start or
+* end mid-word.
+*
+* @param text - the input.
+* @param maxTokens - the per-window budget (already net of special tokens, as the adapter computes it).
+* @param opts - estimator override (tests use a flat one); defaults to {@link estimateTokens}.
+*/
+function splitToWindows(text, maxTokens, opts = {}) {
+	const estimate = opts.estimate ?? estimateTokens;
+	const limit = Math.max(1, Math.floor(maxTokens));
+	const tokens = estimate(text);
+	const chars = Array.from(text);
+	if (chars.length === 0) return {
+		windows: [text],
+		tokens,
+		windowTokens: [tokens]
+	};
+	if (tokens <= limit) return {
+		windows: [text],
+		tokens,
+		windowTokens: [tokens]
+	};
+	const windows = [];
+	const windowTokens = [];
+	let start = 0;
+	while (start < chars.length) {
+		let used = 0;
+		let end = start;
+		while (end < chars.length) {
+			const cost = CJK.test(chars[end]) ? 1 : chars[end].trim() === "" ? 0 : .25;
+			if (used + cost > limit && end > start) break;
+			used += cost;
+			end += 1;
+		}
+		const floor = start + Math.floor((end - start) * .75);
+		for (let i = end - 1; i >= floor; i--) if (BREAK.has(chars[i])) {
+			end = i + 1;
+			break;
+		}
+		while (end - start > 1 && estimate(chars.slice(start, end).join("")) > limit) end -= 1;
+		const window = chars.slice(start, end).join("");
+		windows.push(window);
+		windowTokens.push(estimate(window));
+		start = end;
+	}
+	return {
+		windows,
+		tokens,
+		windowTokens
+	};
+}
+/**
 * Resolve the effective input window for a loaded model.
 *
 * @param configured - `0` (or negative) means "auto: use the model's declared window".
@@ -3548,6 +4337,14 @@ function declaredWindowOf(pipe) {
 	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > SENTINEL_WINDOW) return void 0;
 	return Math.floor(value);
 }
+/**
+* Characters of a chunk that fit the window for `window` tokens, minus the per-chunk
+* overhead (`specialTokens` for CLS/SEP). Used to derive `knowledge.chunk_size` so the
+* default chunking is justified by the shipped model's window instead of by feel.
+*/
+function windowChars(window, specialTokens = 2) {
+	return Math.max(1, Math.floor((window - specialTokens) / 1));
+}
 //#endregion
 //#region ../retrieval-core/lib/budget.js
 /**
@@ -3760,6 +4557,10 @@ var LocalBgeBackend = class {
 		};
 		return this._representation;
 	}
+	/** Point the loader at a shared runtime-dependency root before the first warmup. */
+	useModuleDir(dir) {
+		this.env.moduleDir = dir;
+	}
 	/**
 	* Fire-and-forget retry for call sites that only observe availability. No-op
 	* while the model is ready or an attempt is already in flight; otherwise
@@ -3808,42 +4609,118 @@ var LocalBgeBackend = class {
 		return this._window;
 	}
 	/**
-	* Bound `text` to the window BEFORE it reaches transformers.js.
+	* The window-sized slices `text` is encoded in (see `text_budget.splitToWindows`).
 	*
-	* This is the only place the guard can live: the feature-extraction pipeline's `_call`
-	* accepts `{pooling, normalize, quantize, precision}` and nothing else, so `max_length`
-	* cannot be raised or lowered from the call site — past `model_max_length` the tokenizer
-	* truncates and says nothing.
+	* WHERE THE BOUNDARY CAN LIVE. The feature-extraction pipeline's `_call` accepts
+	* `{pooling, normalize, quantize, precision}` and nothing else, so `max_length` cannot be raised
+	* from the call site — past `model_max_length` transformers.js truncates and says nothing. This
+	* adapter is therefore the only place that can apply the model's own window, and it SPLITS rather
+	* than cuts: a text past the window is a document chunk (or a long fact) whose tail is content,
+	* and cutting it dropped 503 of ~1015 tokens out of the vector in production.
 	*/
-	bound(text) {
-		const out = truncateToTokens(text, Math.max(1, this.window() - SPECIAL_TOKENS));
-		if (out.truncated) {
-			recordTruncation("embedding");
-			if (!this._lengthWarned) {
-				this._lengthWarned = true;
-				retrievalLogger().warn(`semantic: input exceeded the ${this.window()}-token window of ${this.model} — text is truncated before encoding (${out.omittedTokens} tokens dropped here); check knowledge.chunk_size and semantic.max_input_tokens`);
-			}
-		}
-		return out;
+	windows(text) {
+		return splitToWindows(text, Math.max(1, this.window() - SPECIAL_TOKENS));
 	}
-	async encode(text) {
-		await this.warmUp();
-		if (!this._available || !this._pipe) throw new Error("local_bge：语义后端不可用（请安装 @huggingface/transformers 并等模型下载完成）");
-		const bounded = this.bound(text);
-		const out = await this._pipe(bounded.text, {
-			pooling: this.pooling,
-			normalize: this.normalize
-		});
-		const arr = Array.from(out.data);
-		if (arr.length !== this.dim && !this._dimWarned) {
+	/**
+	* Report an input that needed more than one window — once per process, and as an INFO line.
+	*
+	* Not a warning any more: nothing is lost (every window is pooled into the one vector), so the
+	* line is a tuning hint, not a degradation. It carries the actionable number: `chunk_size` is
+	* measured in CHARACTERS and {@link windowChars} converts the model's token window into exactly
+	* that, which is the thing an operator (or a chunker's default) has to change to keep one window
+	* per input. `semantic.max_input_tokens` is deliberately NOT suggested: `resolveWindow` clamps it
+	* to the model's declared window, so raising it cannot buy a single extra token.
+	*/
+	reportSplit(count, tokens) {
+		recordTruncation("embedding");
+		if (this._lengthWarned) return;
+		this._lengthWarned = true;
+		retrievalLogger().info(`semantic: input of ~${tokens} tokens exceeds the ${this.window()}-token window of ${this.model} — encoded as ${count} windows and pooled, nothing dropped (one pass per input needs knowledge.chunk_size within ${windowChars(this.window())} characters for this model)`);
+	}
+	/** The configured width's vector: model output padded/truncated, with the one-shot dim warning. */
+	toVector(values) {
+		if (values.length !== this.dim && !this._dimWarned) {
 			this._dimWarned = true;
-			retrievalLogger().warn(`semantic: model ${this.model} outputs dim=${arr.length} but config semantic.dim=${this.dim} — vectors are truncated/padded; set semantic.dim to ${arr.length} and reindex`);
+			retrievalLogger().warn(`semantic: model ${this.model} outputs dim=${values.length} but config semantic.dim=${this.dim} — vectors are truncated/padded; set semantic.dim to ${values.length} and reindex`);
 		}
 		const vec = new Float32Array(this.dim);
-		for (let i = 0; i < this.dim && i < arr.length; i++) vec[i] = arr[i];
+		for (let i = 0; i < this.dim && i < values.length; i++) vec[i] = values[i];
 		return vec;
 	}
 	/**
+	* ONE vector for several windows: token-weighted mean of the window vectors, re-normalized when the
+	* representation normalizes.
+	*
+	* Weighted rather than a plain mean because the last window is usually short, and a plain mean
+	* would over-represent a fragment. Mean-of-normalized-vectors then re-normalized is the mean
+	* DIRECTION of the windows — the same coordinate space the model's own mean pooling produces, so
+	* `representationKey` (`pooling`/`normalize`/window) does not move and stored vectors stay
+	* comparable with the ones this writes.
+	*/
+	pool(vectors, weights) {
+		const width = vectors[0]?.length ?? 0;
+		if (width === 0 || vectors.length === 0) return new Float32Array(this.dim);
+		const total = weights.reduce((sum, w) => sum + Math.max(0, w), 0);
+		const out = new Float64Array(width);
+		for (let i = 0; i < vectors.length; i++) {
+			const weight = total > 0 ? Math.max(0, weights[i] ?? 0) / total : 1 / vectors.length;
+			const vec = vectors[i];
+			for (let d = 0; d < width; d++) out[d] += (vec[d] ?? 0) * weight;
+		}
+		if (this.normalize) {
+			let norm = 0;
+			for (let d = 0; d < width; d++) norm += out[d] * out[d];
+			norm = Math.sqrt(norm);
+			if (norm > 0) for (let d = 0; d < width; d++) out[d] /= norm;
+		}
+		return this.toVector(Array.from(out));
+	}
+	/** Encode the windows of one text in ONE model call, falling back to one call per window. */
+	async encodeWindows(pipe, windows, weights) {
+		const opts = {
+			pooling: this.pooling,
+			normalize: this.normalize
+		};
+		try {
+			const out = await pipe(windows, opts);
+			const rows = out.dims?.[0];
+			const flat = out.data;
+			if (rows === windows.length) {
+				const width = Math.floor(flat.length / rows);
+				if (width > 0) {
+					const vecs = [];
+					for (let i = 0; i < rows; i++) vecs.push(Array.from(flat.slice(i * width, (i + 1) * width), Number));
+					return this.pool(vecs, weights);
+				}
+			}
+		} catch {}
+		const vecs = [];
+		for (const window of windows) {
+			const out = await pipe(window, opts);
+			vecs.push(Array.from(out.data));
+		}
+		return this.pool(vecs, weights);
+	}
+	/** Encode one plan: a single window verbatim, several pooled. */
+	async encodePlan(pipe, plan) {
+		const first = plan.windows[0];
+		if (plan.windows.length <= 1) {
+			const out = await pipe(first ?? "", {
+				pooling: this.pooling,
+				normalize: this.normalize
+			});
+			return this.toVector(Array.from(out.data));
+		}
+		this.reportSplit(plan.windows.length, plan.tokens);
+		return await this.encodeWindows(pipe, plan.windows, plan.windowTokens);
+	}
+	async encode(text) {
+		await this.warmUp();
+		const pipe = this._pipe;
+		if (!this._available || pipe === null) throw new Error("local_bge：语义后端不可用（请安装 @huggingface/transformers 并等模型下载完成）");
+		return await this.encodePlan(pipe, this.windows(text));
+	}
+	/**
 	* Encode several texts in ONE model call.
 	*
 	* This used to be a serial loop over `encode()`, and production code never called it — so
@@ -3856,11 +4733,22 @@ var LocalBgeBackend = class {
 		if (texts.length === 0) return [];
 		if (texts.length === 1) return [await this.encode(texts[0])];
 		await this.warmUp();
-		if (!this._available || !this._pipe) throw new Error("local_bge：语义后端不可用（请安装 @huggingface/transformers 并等模型下载完成）");
-		const sorted = texts.map((text, index) => ({
-			text,
-			index
-		})).sort((a, b) => a.text.length - b.text.length);
+		const pipe = this._pipe;
+		if (!this._available || pipe === null) throw new Error("local_bge：语义后端不可用（请安装 @huggingface/transformers 并等模型下载完成）");
+		const plans = texts.map((text) => this.windows(text));
+		const singles = [];
+		const longs = [];
+		plans.forEach((plan, index) => {
+			if (plan.windows.length <= 1) singles.push({
+				text: plan.windows[0] ?? texts[index],
+				index
+			});
+			else longs.push({
+				plan,
+				index
+			});
+		});
+		const sorted = singles.sort((a, b) => a.text.length - b.text.length);
 		const result = new Array(texts.length);
 		for (let i = 0; i < sorted.length; i += BATCH_WINDOW) {
 			const group = sorted.slice(i, i + BATCH_WINDOW);
@@ -3869,15 +4757,15 @@ var LocalBgeBackend = class {
 				result[g.index] = vecs[j];
 			});
 		}
+		for (const { plan, index } of longs) result[index] = await this.encodePlan(pipe, plan);
 		return result;
 	}
 	/** One model call for a length-homogeneous group; falls back to per-text calls on failure. */
 	async encodeGroup(texts) {
 		const pipe = this._pipe;
 		if (pipe === null) throw new Error("local_bge：语义后端不可用");
-		const bounded = texts.map((t) => this.bound(t).text);
 		try {
-			const out = await pipe(bounded, {
+			const out = await pipe(texts, {
 				pooling: this.pooling,
 				normalize: this.normalize
 			});
@@ -3904,12 +4792,32 @@ var LocalBgeBackend = class {
 	}
 };
 async function createFeatureExtraction(model, env) {
-	const mod = await import("@huggingface/transformers");
+	const mod = await loadTransformers(env.moduleDir);
 	if (!mod.pipeline) throw new Error("transformers.js 的 pipeline 不可用");
 	applyModelEnv(mod, env);
 	return await mod.pipeline("feature-extraction", model);
 }
 /**
+* Load transformers.js from the shared runtime-dependency root, else from this tree.
+*
+* The shared root is the base provider's content-addressed install (`<home>/deps/runtime/<key>`), and
+* its `package.json` is the anchor `createRequire` needs: resolving `@huggingface/transformers` from
+* there picks the copy the provider verified, together with its transitive `onnxruntime-node` — no
+* second copy, and no dependence on this bundle's own node_modules. The import is by file URL because
+* the resolved entry is an ESM file inside the root, not a bare specifier this module could resolve.
+*
+* A root that no longer resolves (GC, damaged tree, a package whose entry moved) is a WARNING and the
+* pre-existing optional resolution: a broken self-heal must not be worse than no self-heal.
+*/
+async function loadTransformers(moduleDir) {
+	if (moduleDir !== void 0 && moduleDir.trim() !== "") try {
+		return await import(pathToFileURL(createRequire(join(moduleDir, "package.json")).resolve("@huggingface/transformers")).href);
+	} catch (error) {
+		retrievalLogger().warn(`semantic: could not load @huggingface/transformers from the shared runtime root ${moduleDir} (${describeError$1(error)}); falling back to this tree's optional dependency`);
+	}
+	return await import("@huggingface/transformers");
+}
+/**
 * Apply this project's cache/mirror policy to transformers.js.
 *
 * `mod.env` is PROCESS-GLOBAL and last-writer-wins. Setting the keys from a single place is what
@@ -4007,6 +4915,60 @@ function dot(a, b) {
 //#region ../retrieval-core/lib/adapters/hnswlib.js
 const require = createRequire(import.meta.url);
 /**
+* The shared module root `hnswlib-node` should be loaded from, when the caller provisioned one.
+*
+* `undefined` (every CLI/MCP/direct caller) = this tree's own optional dependency. The DSH plugin
+* sets it from the native self-heal item's `handle.dir` once that item is ready; a root that no
+* longer resolves falls back to this tree, which is the pre-existing behaviour and must never be
+* worse than no self-heal.
+*/
+let moduleRoot;
+/**
+* The loaded binding, memoized (`undefined` = not attempted, `null` = the last attempt failed).
+*
+* Native addons are expensive to `dlopen` and there is exactly one per process; memoizing also makes
+* every store in the process shares one load. The cache follows the ROOT (see
+* {@link useHnswlibModuleDir}), because a root that arrives later is the one event that can turn a
+* failed load into a working index.
+*/
+let loaded;
+/**
+* Point the loader at a shared module root (the base `runtime-deps` handle's directory).
+*
+* The cache follows the ROOT: a change forgets what was loaded, because the next `require` must come
+* from the new root (that is the whole point of setting one). It costs nothing in practice — Node's
+* own `require` cache makes re-entering the same file cheap, and a live native index is untouched
+* (see `HnswlibVectorStore.useModuleDir`, which only rebuilds when it has no native index at all).
+*/
+function useHnswlibModuleDir(dir) {
+	const next = dir === "" ? void 0 : dir;
+	if (next === moduleRoot) return;
+	moduleRoot = next;
+	loaded = void 0;
+}
+/** Does this module actually carry the constructor this adapter needs? */
+function usable(mod) {
+	return typeof mod?.HierarchicalNSW === "function";
+}
+/** `require('hnswlib-node')` from the shared root, else from this tree; `null` when neither works. */
+function loadHnswlib() {
+	if (loaded !== void 0) return loaded;
+	let mod = null;
+	if (moduleRoot !== void 0) try {
+		const entry = createRequire(join(moduleRoot, "package.json")).resolve("hnswlib-node");
+		const candidate = require(entry);
+		if (usable(candidate)) mod = candidate;
+	} catch {}
+	if (mod === null) try {
+		const candidate = require("hnswlib-node");
+		mod = usable(candidate) ? candidate : null;
+	} catch {
+		mod = null;
+	}
+	loaded = mod;
+	return mod;
+}
+/**
 * When to COMPACT tombstones away, as a fraction of the live count.
 *
 * Deleted points stay in the graph (excluded from results, but still traversed), so they cost
@@ -4065,15 +5027,41 @@ var HnswlibVectorStore = class {
 		this.dim = dim;
 		this.efSearch = Math.max(16, Math.floor(efSearch));
 		this.fallback = new LocalNumpyVectorStore(dim);
+		this.lib = this.openNative(Math.max(1024, dim * 2));
+	}
+	/**
+	* Build a native index at `max` capacity, or `null` when the binding cannot be loaded.
+	*
+	* One place for "make an index": the constructor, `reindex()` and `rebuild()` each used to spell
+	* the `require` out themselves, which is how a module root set after construction could never
+	* reach them. `null` is the caller's signal to serve from {@link fallback} — a missing binding
+	* degrades, it never throws.
+	*/
+	openNative(max) {
+		const mod = loadHnswlib();
+		if (mod === null) return null;
 		try {
-			const { HierarchicalNSW } = require("hnswlib-node");
-			const lib = new HierarchicalNSW("cosine", dim);
-			lib.initIndex(Math.max(1024, dim * 2), 16, 100);
-			this.lib = lib;
+			const lib = new mod.HierarchicalNSW("cosine", this.dim);
+			lib.initIndex(Math.max(1024, max), 16, 100);
+			return lib;
 		} catch {
-			this.lib = null;
+			return null;
 		}
 	}
+	/**
+	* Point this store's native side at a shared module root and, when the binding was unavailable
+	* until now, rebuild the index from the tracked vectors under it.
+	*
+	* This is the case the whole hook exists for: `mem` builds its vector store during mount, while the
+	* native self-heal item is still installing, so the constructor may have fallen back. When the item
+	* settles, the plugin calls this — and a store that already serves natively is left alone (the
+	* binding is the same one).
+	*/
+	useModuleDir(dir) {
+		useHnswlibModuleDir(dir);
+		if (this.lib !== null) return;
+		this.rebuild(this.liveRows());
+	}
 	add(id, vec) {
 		if (vec.length !== this.dim) throw new Error(`向量维度不匹配：得到 ${vec.length}，需要 ${this.dim}`);
 		if (this.lib) try {
@@ -4229,10 +5217,8 @@ var HnswlibVectorStore = class {
 	/** Recreate the serving index (native when possible) from the tracked vectors. */
 	reindex() {
 		const stored = [...this.vectors.entries()];
-		if (this.lib) try {
-			const { HierarchicalNSW } = require("hnswlib-node");
-			const lib = new HierarchicalNSW("cosine", this.dim);
-			lib.initIndex(Math.max(1024, (stored.length || 1) * 2), 16, 100);
+		const lib = this.openNative(Math.max(1024, (stored.length || 1) * 2));
+		if (lib !== null) {
 			this.lib = lib;
 			this.efOn = null;
 			for (const [i, v] of stored) this.lib.addPoint(Array.from(v), i, false);
@@ -4240,9 +5226,8 @@ var HnswlibVectorStore = class {
 			this.rebuilds += 1;
 			this.persist();
 			return;
-		} catch {
-			this.lib = null;
 		}
+		this.lib = null;
 		this.fallback = new LocalNumpyVectorStore(this.dim);
 		for (const [i, v] of stored) this.fallback.add(i, v);
 		this.graphElements = stored.length;
@@ -4268,15 +5253,8 @@ var HnswlibVectorStore = class {
 			for (const r of list) this.vectors.set(r.id, r.vec);
 			return;
 		}
-		if (this.lib) try {
-			const { HierarchicalNSW } = require("hnswlib-node");
-			const lib = new HierarchicalNSW("cosine", this.dim);
-			lib.initIndex(Math.max(1024, (list.length || 1) * 2), 16, 100);
-			this.lib = lib;
-			this.efOn = null;
-		} catch {
-			this.lib = null;
-		}
+		this.lib = this.openNative(Math.max(1024, (list.length || 1) * 2));
+		if (this.lib !== null) this.efOn = null;
 		for (const r of list) this.add(r.id, r.vec);
 		this.rebuilds += 1;
 		this.persist();
@@ -4454,6 +5432,19 @@ var AutoVectorStore = class {
 		this.pendingPersistence = path;
 		this.delegate.attachPersistence?.(path);
 	}
+	/**
+	* Point the ANN side at a shared module root (the plugin's native self-heal item) — for THIS store
+	* when it already migrated, and for the one it may migrate to later.
+	*
+	* The delegate call covers the first case; the module-level root (set by
+	* `HnswlibVectorStore.useModuleDir` / `useHnswlibModuleDir`) is what a FUTURE
+	* `new HnswlibVectorStore` in `maybeUpgrade` reads. Below the threshold nothing changes: an
+	* unmigrated store keeps serving from brute force, which is the intended backend at that size.
+	*/
+	useModuleDir(dir) {
+		if (this.delegate.useModuleDir !== void 0) this.delegate.useModuleDir(dir);
+		else useHnswlibModuleDir(dir);
+	}
 	flush() {
 		this.delegate.flush?.();
 	}
@@ -4821,12 +5812,18 @@ const DDL = [
     conflict_checked  INTEGER NOT NULL DEFAULT 0,
     archived_at       TIMESTAMP,
     archive_reason    TEXT,
+    -- DEPRECATED (v2, D18): the per-fact TTL is gone. The column is kept so export / import /
+    -- snapshot formats stay readable and a rollback still finds its data, but nothing reads or
+    -- writes it any more (new rows keep the DEFAULT 0).
     ttl_days          INTEGER DEFAULT 0,
     -- P-07/P-13: when the fact became true and when it stopped being true. NULL = unknown, and no
-    -- retrieval leg reads either column (the envelope only carries them, and only when non-null).
-    -- valid_to is written by mem_remember valid_until WITHOUT archiving the row, which is what
-    -- makes "still active, known to end at T" representable at all; the two archival paths
-    -- (supersede, contradiction verdict) also stamp it for audit.
+    -- retrieval leg reads either column (the envelope only carries valid_from now, and only when
+    -- non-null). valid_from is the caller's event time (event_date, the event filter axis).
+    -- DEPRECATED (v2, D19): valid_to is no longer written (valid_until is gone, and so is the
+    -- archival audit stamp). UNLIKE ttl_days it does NOT round-trip: export writes valid_to: null
+    -- and restore ignores the field, deliberately, so an old "known end" cannot be resurrected as a
+    -- validity window. The column survives only so old exports/files stay readable and the DDL does
+    -- not churn; do not read a rollback guarantee into it.
     valid_from        TIMESTAMP,
     valid_to          TIMESTAMP,
     -- The INSTANTS those two bounds name, in epoch milliseconds (migration 12).
@@ -4853,10 +5850,8 @@ const DDL = [
 	`CREATE INDEX IF NOT EXISTS idx_facts_supersedes ON facts(supersedes_id)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_trust ON facts(status, pinned, settle_clock)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_updated ON facts(status, updated_at)`,
-	`CREATE INDEX IF NOT EXISTS idx_facts_ttl ON facts(status, ttl_days)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_purge ON facts(status, pinned, archived_clock)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_forget ON facts(status, pinned, trust_score)`,
-	`CREATE INDEX IF NOT EXISTS idx_facts_idle_cutoff ON facts(status, pinned, julianday(COALESCE(last_retrieved_at, created_at)))`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_bonus_window ON facts(bonus_window_at)`,
 	`CREATE TABLE IF NOT EXISTS fact_sources (
     fact_id INTEGER NOT NULL REFERENCES facts(fact_id) ON DELETE CASCADE,
@@ -7197,7 +8192,7 @@ function timeParams(range) {
 	return timeSql(range)?.params ?? [];
 }
 /**
-* One stored `valid_from`/`valid_to` string → epoch ms, using the SAME grammar as the filters.
+* One stored event-time (`valid_from`) string → epoch ms, using the SAME grammar as the filters.
 *
 * This is what the write path stamps into `valid_from_ms` and what migration 12's backfill applies to
 * existing rows, so "the event time a caller wrote" and "the event time a window compares" can never
@@ -8091,6 +9086,14 @@ const MEMORY_SCHEMA = {
 				db.exec(TITLE_ALIASES_TABLE_DDL);
 				for (const sql of TITLE_ALIASES_INDEXES) db.exec(sql);
 			}
+		},
+		{
+			version: 18,
+			name: "retire-ttl-and-valid-to",
+			up: (db) => {
+				db.exec("DROP INDEX IF EXISTS idx_facts_idle_cutoff");
+				db.exec("DROP INDEX IF EXISTS idx_facts_ttl");
+			}
 		}
 	]
 };
@@ -8343,6 +9346,102 @@ function entityBags(db, ids, q) {
 	return out;
 }
 //#endregion
+//#region ../core/lib/lifecycle/trust.js
+const DAY_MS$1 = 864e5;
+/** The reinforcement quota window is a CALENDAR day ("每天" is a calendar notion, §2.3). */
+const QUOTA_WINDOW_MS = DAY_MS$1;
+function clamp01(v) {
+	if (!Number.isFinite(v)) return 0;
+	return Math.min(1, Math.max(0, v));
+}
+/** The curve of one `trust` section — the single mapping from config keys to the math. */
+function trustCurveOf(cfg) {
+	return curveOf(cfg);
+}
+function isPinned(row) {
+	return Number(row.pinned) === 1;
+}
+/** eff(f) — the trust a caller should act on right now (spec §2.2). */
+function effectiveTrust(row, clock, cfg, enabled = cfg.enabled) {
+	if (!enabled) return clamp01(row.trust_score);
+	if (isPinned(row)) return 1;
+	return clamp01(trustAfterDays(row.trust_score, clock - row.settle_clock, trustCurveOf(cfg)));
+}
+/**
+* What a caller should SEE for a row — the R11 display rule (spec §6):
+* `active` → `eff()`; **non-active → the stored value verbatim** (the decay
+* formula keeps running mathematically for archived rows, so the projection must
+* not use it), and `enabled=false` → stored value (D12).
+*/
+function displayTrust(row, clock, cfg, enabled = cfg.enabled) {
+	if (row.status !== "active") return clamp01(row.trust_score);
+	return effectiveTrust(row, clock, cfg, enabled);
+}
+/**
+* Remaining active days: the inverse of the curve at the current eff (`daysToZero`).
+* `null` for pinned rows, non-active rows and when trust is disabled — the contract's
+* `remaining_days` (spec §6 / R11).
+*/
+function remainingDays(row, clock, cfg, enabled = cfg.enabled) {
+	if (row.status !== "active" || isPinned(row) || !enabled) return null;
+	return daysToZero(effectiveTrust(row, clock, cfg, enabled), trustCurveOf(cfg));
+}
+function rollWindow(row, nowMs) {
+	const at = row.bonus_window_at;
+	const started = parseUtcTs(at);
+	if (at === null || started === null || nowMs - started >= QUOTA_WINDOW_MS) return {
+		count: 0,
+		at: formatUtcTs(nowMs),
+		reset: true
+	};
+	return {
+		count: row.bonus_count ?? 0,
+		at,
+		reset: false
+	};
+}
+/**
+* Apply one recall to a fact: settle, then grant a bonus inside the daily quota.
+* Returns `next === settled` when the quota is exhausted, the ceiling is reached,
+* the fact is pinned, or the gain would be zero (R2/R10/D11).
+*
+* The gain is SEGMENTED at the frozen anchor `BASE_TRUST` (D20):
+*  - strictly below the base: `min(BASE_TRUST, T + recall_gain_below_base)`, so the shipped
+*    `recall_gain_below_base: 0.1` takes 0.05 → 0.5 in five recalls and never past the base;
+*  - AT OR ABOVE the base: `recall_gain_above_base × marginal_decay^count`, capped at the ceiling
+*    INVERTED from `max_retention_days` (there is no `recall_ceiling` key any more, D16). The
+*    boundary is strictly `<` on purpose: a fact sitting exactly on the base (a fresh one, on the
+*    first recall after it has finished settling) takes the above-base branch and starts climbing.
+*/
+function grantRecallBonus(row, clock, nowMs, cfg, enabled = cfg.enabled) {
+	const settled = effectiveTrust(row, clock, cfg, enabled);
+	const window = rollWindow(row, nowMs);
+	if (row.status !== "active" || isPinned(row) || !enabled || window.count >= cfg.recall_daily_cap) return {
+		settled,
+		next: settled,
+		granted: false,
+		bonusCount: window.count,
+		windowAt: window.at
+	};
+	const gain = cfg.recall_gain_above_base * Math.pow(cfg.recall_marginal_decay, window.count);
+	const ceiling = ceilingForDays(cfg.max_retention_days, trustCurveOf(cfg));
+	const next = settled < .5 ? Math.max(settled, Math.min(BASE_TRUST, settled + cfg.recall_gain_below_base)) : Math.max(settled, Math.min(ceiling, settled + gain));
+	if (next <= settled + 1e-9) return {
+		settled,
+		next: settled,
+		granted: false,
+		bonusCount: window.count,
+		windowAt: window.at
+	};
+	return {
+		settled,
+		next,
+		granted: true,
+		bonusCount: window.count + 1,
+		windowAt: window.at
+	};
+}
+//#endregion
 //#region ../core/lib/db/dao/facts.js
 /**
 * The column a pure time window orders by — the axis the caller filtered on.
@@ -8380,7 +9479,7 @@ const FACT_COLUMNS_NO_BLOB = `fact_id, content, kind, title, tags, trust_score,
     pinned, pinned_at, bonus_count, bonus_window_at, last_reinforced_at, archived_clock,
     retrieval_count, helpful_count, last_retrieved_at, embedding_model, vector_store, status,
     supersedes_id, entities_version, conflict_checked, archived_at, archive_reason, ttl_days,
-    valid_from, valid_to, valid_from_ms, valid_to_ms, assert_count, created_at, updated_at`;
+    valid_from, valid_from_ms, assert_count, created_at, updated_at`;
 /**
 * The FTS leg's exact SQL, exported so the plan guard (`test/fts_plan.spec.ts`) and the bench
 * control group EXPLAIN the production text itself instead of a copy that can silently drift.
@@ -8698,12 +9797,11 @@ var FactsDao = class FactsDao {
 		const out = /* @__PURE__ */ new Map();
 		if (!ids.length) return out;
 		const { placeholders, values } = inList(ids);
-		const rows = this.db.prepare(`SELECT fact_id, created_at, updated_at, valid_from, valid_to, title FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
+		const rows = this.db.prepare(`SELECT fact_id, created_at, updated_at, valid_from, title FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
 		for (const row of rows) out.set(row.fact_id, {
 			created_at: row.created_at === null ? "" : String(row.created_at),
 			updated_at: row.updated_at === null ? null : String(row.updated_at),
 			valid_from: row.valid_from === null || row.valid_from === void 0 ? null : String(row.valid_from),
-			valid_to: row.valid_to === null || row.valid_to === void 0 ? null : String(row.valid_to),
 			title: row.title === null || row.title === void 0 || row.title === "" ? null : String(row.title)
 		});
 		return out;
@@ -8743,31 +9841,33 @@ var FactsDao = class FactsDao {
 	* `createdAt` is named EXPLICITLY rather than left to the column DEFAULT, because a
 	* superseding revision must INHERIT the archived row's `created_at` (the memory's first
 	* assertion date, distinct from when its text was rewritten). `updated_at` and
-	* `last_retrieved_at` are stamped `CURRENT_TIMESTAMP` in the same statement: a revision
-	* whose `created_at` is old must not be judged idle by the next tick, where "idle" reads
-	* `COALESCE(last_retrieved_at, created_at)`.
+	* `last_retrieved_at` are stamped `CURRENT_TIMESTAMP` in the same statement, so a revision
+	* carries a fresh "last used" observation like the row it replaces (that column no longer
+	* feeds any decision — see TRUST_MODEL.md §2.6).
+	*
+	* `ttl_days` is NOT named: TTL is gone (v2), the column keeps its DEFAULT 0 and nothing
+	* reads or writes it any more.
 	*/
 	insertRevision(v) {
 		return this.db.prepare(`INSERT OR IGNORE INTO facts
-           (content, kind, title, ttl_days, supersedes_id, hrr_vector,
+           (content, kind, title, supersedes_id, hrr_vector,
             trust_score, settle_clock, pinned, pinned_at, bonus_count, bonus_window_at,
-            entities_version, conflict_checked, valid_from, valid_to, valid_from_ms, valid_to_ms,
+            entities_version, conflict_checked, valid_from, valid_from_ms,
             created_at, updated_at, last_retrieved_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, 0, ?, ?, ?, ?,
-                 ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`).run(v.content, v.kind, v.title ?? null, v.ttlDays, v.supersedesId, v.hrr, v.trust, v.clock, v.pinned, v.pinnedAt, v.windowAt, 3, v.validFrom ?? null, v.validTo ?? null, v.validFromMs ?? null, v.validToMs ?? null, v.createdAt);
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, 0, ?, ?,
+                 ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`).run(v.content, v.kind, v.title ?? null, v.supersedesId, v.hrr, v.trust, v.clock, v.pinned, v.pinnedAt, v.windowAt, 3, v.validFrom ?? null, v.validFromMs ?? null, v.createdAt);
 	}
 	/**
-	* P-10: land an explicitly given validity on a row that already exists (a duplicate `add` whose
-	* caller named `event_date` / `valid_until`). Omitted arguments keep what the row has, exactly
-	* like `kind`/`ttl_days` (see `add`'s doc).
+	* P-10: land an explicitly given event time on a row that already exists (a duplicate `add`
+	* whose caller named `event_date`). An omitted argument keeps what the row has, exactly like
+	* `kind` (see `add`'s doc).
 	*/
-	applyValidity(factId, validFrom, validTo) {
-		if (validFrom === void 0 && validTo === void 0) return;
+	applyValidity(factId, validFrom) {
+		if (validFrom === void 0) return;
 		this.db.prepare(`UPDATE facts
             SET valid_from = COALESCE(?, valid_from), valid_from_ms = COALESCE(?, valid_from_ms),
-                valid_to = COALESCE(?, valid_to), valid_to_ms = COALESCE(?, valid_to_ms),
                 updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(validFrom?.text ?? null, validFrom?.ms ?? null, validTo?.text ?? null, validTo?.ms ?? null, factId);
+          WHERE fact_id = ?`).run(validFrom.text, validFrom.ms, factId);
 	}
 	/** P-10: the row's assertion counter (`1` when the column is somehow NULL on a legacy row). */
 	assertCount(factId) {
@@ -8787,17 +9887,6 @@ var FactsDao = class FactsDao {
 		return Number(row?.n ?? 1);
 	}
 	/**
-	* P-07 audit: stamp `valid_to` on a row that is leaving the active corpus (supersede / a
-	* contradiction verdict). `COALESCE` keeps an end the caller already declared (`valid_until`):
-	* overwriting it with the archival instant would replace a real answer with an administrative one.
-	*/
-	markValidTo(factId, at, atMs = null) {
-		this.db.prepare(`UPDATE facts
-            SET valid_to = COALESCE(valid_to, ?),
-                valid_to_ms = CASE WHEN valid_to IS NULL THEN ? ELSE valid_to_ms END
-          WHERE fact_id = ?`).run(at, atMs, factId);
-	}
-	/**
 	* P-07: "who superseded this fact", derived from the existing `supersedes_id` link — no
 	* redundant column. `MIN` is deterministic when several revisions named the same predecessor
 	* (which a merge can produce); the caller renders it as a single direct successor.
@@ -8958,17 +10047,22 @@ var FactsDao = class FactsDao {
 		}
 		return changes;
 	}
-	/** Revive an archived row (R18/R19: refresh the idle clock, clear the archive bookkeeping). */
-	revive(factId, kind, ttlDays, trust, clock) {
+	/**
+	* Revive an archived row (R19: clear the archive bookkeeping / refresh `last_retrieved_at`).
+	*
+	* `ttl_days` is deliberately NOT named any more: an omitted column keeps whatever the row has
+	* (the old writing value is preserved as data), and there is no TTL left to inherit.
+	*/
+	revive(factId, kind, trust, clock) {
 		return this.db.prepare(`UPDATE facts
             SET status = 'active', archived_at = NULL, archive_reason = NULL, archived_clock = NULL,
-                kind = ?, ttl_days = ?, trust_score = ?, settle_clock = ?,
+                kind = ?, trust_score = ?, settle_clock = ?,
                 last_retrieved_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ? AND status = 'archived'`).run(kind, ttlDays, trust, clock, factId).changes;
+          WHERE fact_id = ? AND status = 'archived'`).run(kind, trust, clock, factId).changes;
 	}
-	/** Land explicit kind/TTL on a row that already exists (pure duplicate). */
-	applyValues(factId, kind, ttlDays) {
-		this.db.prepare("UPDATE facts SET kind = ?, ttl_days = ?, updated_at = CURRENT_TIMESTAMP WHERE fact_id = ?").run(kind, ttlDays, factId);
+	/** Land an explicit kind on a row that already exists (pure duplicate). */
+	applyValues(factId, kind) {
+		this.db.prepare("UPDATE facts SET kind = ?, updated_at = CURRENT_TIMESTAMP WHERE fact_id = ?").run(kind, factId);
 	}
 	/**
 	* Land a title on a row that already exists — the ONE write behind every "backfill" path
@@ -9045,13 +10139,12 @@ var FactsDao = class FactsDao {
 		this.db.prepare("UPDATE facts SET supersedes_id = ? WHERE fact_id = ? AND supersedes_id IS NULL").run(supersedesId, factId);
 	}
 	/**
-	* Restore an archived fact, settling its trust and refreshing the idle clock (spec §2.6).
+	* Restore an archived fact, settling its trust and refreshing `last_retrieved_at` (spec §2.6).
 	*
 	* `AND status = 'archived'` is load-bearing, like the guard on every sibling above: this UPDATE
 	* clears the archive bookkeeping and refreshes `last_retrieved_at`, so ungated it would take an
-	* ACTIVE row and (a) push its idle clock forward — silently extending the life of a fact the next
-	* tick was about to re-archive — and (b) reset `trust_score` to the settled value it computed. It
-	* returned `1` either way, so the caller could not tell that a row it never asked about had moved.
+	* ACTIVE row and reset `trust_score` to the settled value it computed. It returned `1` either
+	* way, so the caller could not tell that a row it never asked about had moved.
 	*/
 	restore(factId, trust, clock) {
 		return this.db.prepare(`UPDATE facts
@@ -9059,32 +10152,6 @@ var FactsDao = class FactsDao {
                 trust_score = ?, settle_clock = ?, last_retrieved_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
           WHERE fact_id = ? AND status = 'archived'`).run(trust, clock, factId).changes;
 	}
-	bumpHelpful(factId, delta) {
-		this.db.prepare("UPDATE facts SET helpful_count = MAX(0, helpful_count + ?) WHERE fact_id = ?").run(delta, factId);
-	}
-	/** Feedback outcome: pin at the permanent threshold (trust snaps to 1). */
-	pinOutcome(factId, clock, bonusCount, windowAt) {
-		this.db.prepare(`UPDATE facts
-            SET trust_score = 1, pinned = 1, pinned_at = COALESCE(pinned_at, CURRENT_TIMESTAMP),
-                settle_clock = ?, bonus_count = ?, bonus_window_at = ?, archived_clock = NULL,
-                last_reinforced_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(clock, bonusCount, windowAt, factId);
-	}
-	/** Feedback outcome: the forget line was reached — archive in the same statement. */
-	forgetOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.db.prepare(`UPDATE facts
-            SET trust_score = ?, settle_clock = ?, bonus_count = ?, bonus_window_at = ?,
-                status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = ?,
-                archive_reason = 'forgot', updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(trust, clock, bonusCount, windowAt, clock, factId);
-	}
-	/** Feedback outcome: reinforced (or decayed) but still active. */
-	reinforceOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.db.prepare(`UPDATE facts
-            SET trust_score = ?, settle_clock = ?, bonus_count = ?, bonus_window_at = ?,
-                last_reinforced_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(trust, clock, bonusCount, windowAt, factId);
-	}
 	pin(factId, clock) {
 		return this.db.prepare(`UPDATE facts
             SET pinned = 1, pinned_at = COALESCE(pinned_at, CURRENT_TIMESTAMP), trust_score = 1,
@@ -9173,17 +10240,25 @@ var FactsDao = class FactsDao {
 		return Number(this.db.prepare("SELECT COUNT(*) AS n FROM facts WHERE status = 'active' AND pinned = 1").get()?.n ?? 0);
 	}
 	/**
-	* ACTIVE facts whose decayed trust would reach zero within `withinDays` ACTIVE days —
-	* i.e. `trust_score - step × (clock - settle_clock) <= step × withinDays`.
+	* ACTIVE, unpinned facts whose decayed trust reaches zero within `withinDays` ACTIVE days.
+	*
+	* EXACT for every shape, not a linear approximation: the predicate is
+	* `trustAfterDays(eff(now), withinDays, curve) <= 0`, which is the same question the tick asks
+	* when it archives a row. The caller passes the THRESHOLD (`ceilingForDays(withinDays, curve)`)
+	* because "days until zero" is no longer `trust ÷ slope` under `decay_shape: 'accelerating'`;
+	* a slope-based SQL predicate under-reported every fact in `(slope × 7, ceilingForDays(7)]`
+	* (0.0277 … 0.0515 at the shipped defaults) once accelerating became the default.
+	*
+	* COST: one row per active unpinned fact, evaluated in JS — the predicate needs `exp`, which the
+	* SQL layer cannot express portably. `trust_diagnose` is an operator-only diagnostic and the
+	* active set is what `mem_admin list` already walks; if it ever shows up in a profile, prefilter
+	* with an index-friendly bound rather than going back to a slope approximation.
 	*/
 	countForgettingWithin(p) {
-		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts
-            WHERE status = 'active' AND pinned = 0
-              AND (trust_score - :step * (:clock - settle_clock)) <= :step * :soon`).get({
-			step: p.step,
-			clock: p.clock,
-			soon: p.withinDays
-		})?.n ?? 0);
+		const rows = this.db.prepare(`SELECT trust_score, settle_clock FROM facts WHERE status = 'active' AND pinned = 0`).all();
+		let n = 0;
+		for (const row of rows) if (trustAfterDays(Number(row.trust_score), p.clock - Number(row.settle_clock), p.curve) <= p.threshold) n += 1;
+		return n;
 	}
 	/** Facts with a still-live (calendar 24h) reinforcement window — the per-fact quota. */
 	/**
@@ -9203,31 +10278,15 @@ var FactsDao = class FactsDao {
 			granted: Number(row?.granted ?? 0)
 		};
 	}
-	/** ACTIVE, unpinned facts unused for `days` CALENDAR days (the idle-archival fallback). */
-	countIdleCandidates(days) {
-		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts
-            WHERE status = 'active' AND pinned = 0
-              AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :modifier)`).get({ modifier: `-${days} days` })?.n ?? 0);
-	}
 	/**
-	* Rows still due for ②③④ after a budgeted tick — what the NEXT pass will archive.
+	* Rows still due for ② after a budgeted tick — what the NEXT pass will archive.
 	*
-	* One statement over the three predicates (they are alternatives, and the sets are disjoint:
-	* a row has either a TTL, a forgotten trust score, or an idle clock). Only called when a step
-	* actually filled its budget, so the common tick pays nothing for it.
+	* The same predicate the archival statement runs (`FORGET_PREDICATE`), so "backlog" and "what
+	* `archiveForgotten` will do next" cannot disagree. Only called when ② actually filled its
+	* budget, so the common tick pays nothing for it.
 	*/
 	countArchiveBacklog(p) {
-		const params = {
-			forgetThreshold: p.forgetThreshold,
-			idleModifier: `-${p.idleCalendarDays} days`
-		};
-		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM (
-             SELECT fact_id FROM facts WHERE status = 'active' AND ttl_days > 0
-               AND julianday('now') - julianday(created_at) > ttl_days
-             UNION SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold
-             UNION SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0
-               AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :idleModifier)
-           )`).get(params)?.n ?? 0);
+		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts WHERE ${FactsDao.FORGET_PREDICATE}`).get({ forgetThreshold: p.forgetThreshold })?.n ?? 0);
 	}
 	/**
 	* Drop unusable (stale-dim) vectors so a re-encode can replace them — and re-queue the same
@@ -9566,48 +10625,60 @@ var FactsDao = class FactsDao {
 	* row, and `settle_clock < c` is a seek + range scan of exactly the pending rows.
 	*/
 	static SETTLE_PREDICATE = "status = 'active' AND pinned = 0 AND settle_clock < CAST(:clock AS INTEGER)";
-	/** ① materialize decay, bounded to `budget` rows. */
+	/**
+	* The ONE forgetting predicate, shared by the archival statement and its backlog count.
+	*
+	* Kept as a constant for the same reason as {@link SETTLE_PREDICATE}: the count answers "how many
+	* will the next pass archive", so it must be the same WHERE body the archival itself runs —
+	* otherwise `archived_deferred` and the actual sweep would drift apart.
+	*/
+	static FORGET_PREDICATE = "status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold";
+	/**
+	* ① materialize decay, bounded to `budget` rows.
+	*
+	* PER ROW, through `trustAfterDays` — not one UPDATE with an inline `trust_score − step·Δ`. The
+	* formula lives in `contract/src/trust_curve.ts` and nowhere else; the `linear` branch of that
+	* function is bit-identical to the statement this replaced (`T − days·slope`, the same two
+	* operations in the same order), so P3's equivalent tier materializes exactly the same numbers.
+	*
+	* The SELECT is the old UPDATE's WHERE body with the old subquery's ORDER/LIMIT, so the row SET is
+	* the same one the statement would have touched (and `settled` still counts rows matched, not rows
+	* whose value happened to move).
+	*
+	* COST: one `UPDATE` PER ROW inside the tick's single `IMMEDIATE` transaction (the accelerating
+	* formula needs `exp`, which SQL cannot express here, and a second SQL implementation would
+	* drift). That is why every caller is budgeted by `trust.tick_max_facts` (5000 by default) and
+	* `admin maintenance` is the only unbudgeted pass — measured ~22 ms per 5000 rows, inside the
+	* tick's budget; it is a deliberate trade, not a regression.
+	*/
 	settleBudgeted(p) {
-		return this.db.prepare(`UPDATE facts
-            SET trust_score = MAX(0, MIN(1, trust_score - :step * (:clock - settle_clock))),
-                settle_clock = :clock
+		const rows = this.db.prepare(`SELECT fact_id, trust_score, settle_clock FROM facts
           WHERE ${FactsDao.SETTLE_PREDICATE}
-            AND fact_id IN (SELECT fact_id FROM facts WHERE ${FactsDao.SETTLE_PREDICATE} ORDER BY settle_clock ASC LIMIT :budget)`).run(p).changes;
+          ORDER BY settle_clock ASC LIMIT :budget`).all({
+			clock: p.clock,
+			budget: p.budget
+		});
+		return this.settleRows(rows, p.clock, p.curve);
 	}
 	/** ① materialize decay for every pending row (no budget). */
 	settleAll(p) {
-		return this.db.prepare(`UPDATE facts
-            SET trust_score = MAX(0, MIN(1, trust_score - :step * (:clock - settle_clock))),
-                settle_clock = :clock
-          WHERE ${FactsDao.SETTLE_PREDICATE}`).run(p).changes;
+		const rows = this.db.prepare(`SELECT fact_id, trust_score, settle_clock FROM facts
+          WHERE ${FactsDao.SETTLE_PREDICATE}
+          ORDER BY settle_clock ASC`).all({ clock: p.clock });
+		return this.settleRows(rows, p.clock, p.curve);
+	}
+	/** The shared per-row write of ①: settle the curve at `clock`, then stamp `settle_clock`. */
+	settleRows(rows, clock, curve) {
+		const stmt = this.db.prepare("UPDATE facts SET trust_score = ?, settle_clock = ? WHERE fact_id = ?");
+		for (const row of rows) stmt.run(clamp01(trustAfterDays(Number(row.trust_score), clock - Number(row.settle_clock), curve)), clock, row.fact_id);
+		return rows.length;
 	}
 	/** Rows still awaiting ① (the budget ran out). */
 	countPendingSettle(p) {
 		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts WHERE ${FactsDao.SETTLE_PREDICATE}`).get(p)?.n ?? 0);
 	}
 	/**
-	* ② calendar TTL — explicit instruction, so `pinned` is NOT exempt.
-	*
-	* `budget` (0 = none) caps how many rows ONE tick may archive: the tick is a single IMMEDIATE
-	* transaction shared by several processes, so an unbudgeted pass over a large backlog held the
-	* write lock for as long as it took (measured 14400 rows in one tick). The remainder stays due
-	* and is reported as a deferred count, then archived by the next tick.
-	*/
-	archiveExpiredByTtl(p) {
-		return this.db.prepare(`UPDATE facts
-            SET status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = :clock, archive_reason = 'ttl'
-          WHERE status = 'active' AND ttl_days > 0
-            AND julianday('now') - julianday(created_at) > ttl_days
-            AND (:budget = 0 OR fact_id IN (
-                  SELECT fact_id FROM facts WHERE status = 'active' AND ttl_days > 0
-                    AND julianday('now') - julianday(created_at) > ttl_days LIMIT :budget))
-          RETURNING fact_id`).all({
-			clock: p.clock,
-			budget: p.budget ?? 0
-		}).map((row) => row.fact_id);
-	}
-	/**
-	* ③ trust-driven forgetting (① already clamped trust to the threshold).
+	* ② trust-driven forgetting (① already clamped trust to the threshold).
 	*
 	* Sargable as written (`status`/`pinned` equality + `trust_score <= ?`), and served by
 	* `idx_facts_forget(status, pinned, trust_score)`: before that index this statement read every
@@ -9616,9 +10687,9 @@ var FactsDao = class FactsDao {
 	archiveForgotten(p) {
 		return this.db.prepare(`UPDATE facts
             SET status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = :clock, archive_reason = 'forgot'
-          WHERE status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold
+          WHERE ${FactsDao.FORGET_PREDICATE}
             AND (:budget = 0 OR fact_id IN (
-                  SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold LIMIT :budget))
+                  SELECT fact_id FROM facts WHERE ${FactsDao.FORGET_PREDICATE} LIMIT :budget))
           RETURNING fact_id`).all({
 			clock: p.clock,
 			forgetThreshold: p.forgetThreshold,
@@ -9626,29 +10697,7 @@ var FactsDao = class FactsDao {
 		}).map((row) => row.fact_id);
 	}
 	/**
-	* ④ calendar fallback: never touched for `idle_calendar_days`.
-	*
-	* The comparison is written as `<expression> < julianday('now', :modifier)` — the same
-	* expression `idx_facts_idle_cutoff` indexes — so it is a range seek. The old form
-	* (`julianday('now') - <expression> > :days`) called `julianday` on EVERY active row and could
-	* not use any index (measured 33–212 ms at 180k).
-	*/
-	archiveIdle(p) {
-		return this.db.prepare(`UPDATE facts
-            SET status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = :clock, archive_reason = 'idle'
-          WHERE status = 'active' AND pinned = 0
-            AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :idleModifier)
-            AND (:budget = 0 OR fact_id IN (
-                  SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0
-                    AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :idleModifier) LIMIT :budget))
-          RETURNING fact_id`).all({
-			clock: p.clock,
-			idleModifier: `-${p.idleCalendarDays} days`,
-			budget: p.budget ?? 0
-		}).map((row) => row.fact_id);
-	}
-	/**
-	* ⑤ physical delete of archived rows past the retention window.
+	* ③ physical delete of archived rows past the retention window.
 	*
 	* TWO statements in this order, sharing one predicate:
 	*
@@ -9657,7 +10706,7 @@ var FactsDao = class FactsDao {
 	*      DELETE below failed with `SQLITE_CONSTRAINT_FOREIGNKEY` whenever a revision chain
 	*      crossed `purge_after_archived_days`. Because the whole tick is ONE transaction and it
 	*      runs from the store's constructor, that failure did not merely skip the purge: it rolled
-	*      back settle/TTL/idle with it and left the process unable to start, permanently.
+	*      back settle/forget with it and left the process unable to start, permanently.
 	*   2. delete them.
 	*
 	* The predicate is built once and interpolated into both statements, so "which rows are
@@ -9702,7 +10751,7 @@ var FactsDao = class FactsDao {
 			purgeModifier: `-${p.purgeAfterDays} days`
 		};
 	}
-	/** Archived rows still due for ⑤ after a budgeted pass (0 when the pass finished them). */
+	/** Archived rows still due for ③ after a budgeted pass (0 when the pass finished them). */
 	countPurgeBacklog(p) {
 		const [a, b] = FactsDao.purgeBranches(p);
 		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM (
@@ -9795,7 +10844,7 @@ function pathRecency(path) {
 	for (const edge of path.edges) newest = Math.max(newest, edgeTime(edge));
 	return newest;
 }
-/** Dedup key of a path: the ordered edge ids (§5 "路径去重按 (edge ids)"). */
+/** Dedup key of a path: the ordered edge ids ("路径去重按 (edge ids)"). */
 function pathKey(path) {
 	return path.edges.map((edge) => edge.id).join("\0");
 }
@@ -10799,156 +11848,6 @@ var FactSourcesDao = class {
 	}
 };
 //#endregion
-//#region ../core/lib/lifecycle/trust.js
-const DAY_MS$1 = 864e5;
-/** The reinforcement quota window is a CALENDAR day ("每天" is a calendar notion, §2.3). */
-const QUOTA_WINDOW_MS = DAY_MS$1;
-function clamp01(v) {
-	if (!Number.isFinite(v)) return 0;
-	return Math.min(1, Math.max(0, v));
-}
-function isPinned(row) {
-	return Number(row.pinned) === 1;
-}
-/**
-* `'YYYY-MM-DD HH:MM:SS'` (SQLite UTC) or ISO → epoch ms; null/garbage → null.
-*
-* A stamp with NO zone designator is read as UTC, not as local time. `Date.parse` treats a zone-less
-* ISO string as LOCAL, and everything in this store is written in UTC (`CURRENT_TIMESTAMP`, and
-* {@link formatUtcTs}), so handing one over as-is would shift every quota window and every decay
-* measurement by the host's UTC offset — a fact reinforced at 23:00 UTC+8 would look reinforced 8
-* hours earlier, and the 24h cap would open or close at the wrong moment. An explicit `Z` or
-* `±HH:MM` is left alone.
-*/
-function parseUtcTs(ts) {
-	if (ts === null || ts === void 0 || ts === "") return null;
-	const iso = ts.includes("T") ? ts : ts.replace(" ", "T");
-	const zoned = /(?:Z|[+-]\d{2}:?\d{2})$/i.test(iso) ? iso : `${iso}Z`;
-	const ms = Date.parse(zoned);
-	return Number.isFinite(ms) ? ms : null;
-}
-/** Epoch ms → `'YYYY-MM-DD HH:MM:SS'` (the SQLite `CURRENT_TIMESTAMP` shape, UTC). */
-function formatUtcTs(ms) {
-	return new Date(ms).toISOString().slice(0, 19).replace("T", " ");
-}
-/** eff(f) — the trust a caller should act on right now (spec §2.2). */
-function effectiveTrust(row, clock, cfg, enabled = cfg.enabled) {
-	if (!enabled) return clamp01(row.trust_score);
-	if (isPinned(row)) return 1;
-	return clamp01(row.trust_score - cfg.decay_per_day * (clock - row.settle_clock));
-}
-/**
-* What a caller should SEE for a row — the R11 display rule (spec §6):
-* `active` → `eff()`; **non-active → the stored value verbatim** (the decay
-* formula keeps running mathematically for archived rows, so the projection must
-* not use it), and `enabled=false` → stored value (D12).
-*/
-function displayTrust(row, clock, cfg, enabled = cfg.enabled) {
-	if (row.status !== "active") return clamp01(row.trust_score);
-	return effectiveTrust(row, clock, cfg, enabled);
-}
-/**
-* Remaining active days: `eff / step`. `null` for pinned rows, non-active rows and
-* when trust is disabled — the contract's `remaining_days` (spec §6 / R11).
-*/
-function remainingDays(row, clock, cfg, enabled = cfg.enabled) {
-	if (row.status !== "active" || isPinned(row) || !enabled || cfg.decay_per_day <= 0) return null;
-	return effectiveTrust(row, clock, cfg, enabled) / cfg.decay_per_day;
-}
-function rollWindow(row, nowMs) {
-	const at = row.bonus_window_at;
-	const started = parseUtcTs(at);
-	if (at === null || started === null || nowMs - started >= QUOTA_WINDOW_MS) return {
-		count: 0,
-		at: formatUtcTs(nowMs),
-		reset: true
-	};
-	return {
-		count: row.bonus_count ?? 0,
-		at,
-		reset: false
-	};
-}
-/**
-* Apply one recall to a fact: settle, then grant a bonus inside the daily quota.
-* Returns `next === settled` when the quota is exhausted, the ceiling is reached,
-* the fact is pinned, or the gain would be zero (R2/R10/D11).
-*/
-function grantRecallBonus(row, clock, nowMs, cfg, enabled = cfg.enabled) {
-	const settled = effectiveTrust(row, clock, cfg, enabled);
-	const window = rollWindow(row, nowMs);
-	if (row.status !== "active" || isPinned(row) || !enabled || window.count >= cfg.recall_daily_cap) return {
-		settled,
-		next: settled,
-		granted: false,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	const gain = cfg.recall_delta * Math.pow(cfg.recall_marginal_decay, window.count);
-	const next = settled <= cfg.recall_floor ? Math.max(settled, cfg.recall_floor) : Math.max(settled, Math.min(cfg.recall_ceiling, settled + gain));
-	if (next <= settled + 1e-9) return {
-		settled,
-		next: settled,
-		granted: false,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	return {
-		settled,
-		next,
-		granted: true,
-		bonusCount: window.count + 1,
-		windowAt: window.at
-	};
-}
-/**
-* Apply one explicit `helpful` (+1) / `unhelpful` (-1) step.
-*
-* Pinned and archived rows are untouched (R7): only `helpful_count` changes for
-* them, so a pinned fact can never end up storing 0.95 while displaying 1.0.
-* When `feedback_daily_cap > 0` feedback shares the per-fact 24h window counter.
-*/
-function applyFeedbackDelta(row, clock, delta, nowMs, cfg, enabled = cfg.enabled) {
-	const settled = effectiveTrust(row, clock, cfg, enabled);
-	const shared = cfg.feedback_daily_cap > 0;
-	const window = shared ? rollWindow(row, nowMs) : {
-		count: row.bonus_count ?? 0,
-		at: row.bonus_window_at ?? formatUtcTs(nowMs),
-		reset: false
-	};
-	if (row.status !== "active" || isPinned(row) || !enabled) return {
-		settled,
-		next: row.trust_score,
-		pin: false,
-		forget: false,
-		untouched: true,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	if (shared && window.count >= cfg.feedback_daily_cap) return {
-		settled,
-		next: settled,
-		pin: false,
-		forget: false,
-		untouched: false,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	let next = clamp01(settled + delta * cfg.feedback_delta);
-	const pin = next >= cfg.permanent_threshold;
-	const forget = !pin && next <= cfg.forget_threshold + 1e-9;
-	if (forget) next = cfg.forget_threshold;
-	return {
-		settled,
-		next,
-		pin,
-		forget,
-		untouched: false,
-		bonusCount: shared ? window.count + 1 : window.count,
-		windowAt: window.at
-	};
-}
-//#endregion
 //#region ../core/lib/lifecycle/presence.js
 const CLOCK_KEY = "trust_clock";
 const LAST_SEEN_KEY = "trust_last_seen";
@@ -10996,39 +11895,27 @@ function advancePresence(db, opts) {
 function runTrustTick(db, cfg, opts) {
 	const clock = opts.clock;
 	const budget = opts.budget ?? cfg.trust.tick_max_facts;
-	const step = cfg.trust.decay_per_day;
+	const curve = trustCurveOf(cfg.trust);
 	const enabled = cfg.trust.enabled ? 1 : 0;
 	const trustEnabled = cfg.trust.enabled;
 	const facts = new FactsDao(db);
 	return db.transaction(() => {
 		const settled = !trustEnabled ? 0 : budget > 0 ? facts.settleBudgeted({
-			step,
+			curve,
 			clock,
 			budget
 		}) : facts.settleAll({
-			step,
+			curve,
 			clock
 		});
 		const skipped = trustEnabled && budget > 0 ? facts.countPendingSettle({ clock }) : 0;
 		const archiveBudget = budget > 0 ? budget : 0;
-		const ttlIds = facts.archiveExpiredByTtl({
-			clock,
-			budget: archiveBudget
-		});
 		const forgotIds = trustEnabled ? facts.archiveForgotten({
 			clock,
 			forgetThreshold: cfg.trust.forget_threshold,
 			budget: archiveBudget
 		}) : [];
-		const idleIds = facts.archiveIdle({
-			clock,
-			idleCalendarDays: cfg.trust.idle_calendar_days,
-			budget: archiveBudget
-		});
-		const deferred = archiveBudget > 0 && (ttlIds.length === archiveBudget || forgotIds.length === archiveBudget || idleIds.length === archiveBudget) ? facts.countArchiveBacklog({
-			forgetThreshold: cfg.trust.forget_threshold,
-			idleCalendarDays: cfg.trust.idle_calendar_days
-		}) : 0;
+		const deferred = archiveBudget > 0 && forgotIds.length === archiveBudget ? facts.countArchiveBacklog({ forgetThreshold: cfg.trust.forget_threshold }) : 0;
 		const purgeArgs = {
 			clock,
 			enabled,
@@ -11043,16 +11930,10 @@ function runTrustTick(db, cfg, opts) {
 		return {
 			clock,
 			settled,
-			archived_ttl: ttlIds.length,
 			archived_forgot: forgotIds.length,
-			archived_idle: idleIds.length,
 			purged: purgedIds.length,
 			purged_ids: purgedIds,
-			archived_ids: [
-				...ttlIds,
-				...forgotIds,
-				...idleIds
-			],
+			archived_ids: [...forgotIds],
 			skipped,
 			archived_deferred: deferred,
 			purged_deferred: purgedDeferred
@@ -11076,15 +11957,15 @@ function runMaintenance(db, cfg, opts) {
 	});
 	return {
 		decayed: tick.settled,
-		archived_ttl: tick.archived_ttl,
-		archived_age: tick.archived_forgot + tick.archived_idle,
+		archived_ttl: 0,
+		archived_age: tick.archived_forgot,
 		purged: tick.purged,
 		purged_ids: tick.purged_ids,
 		archived_ids: tick.archived_ids,
 		settled: tick.settled,
 		clock: tick.clock,
 		archived_forgot: tick.archived_forgot,
-		archived_idle: tick.archived_idle,
+		archived_idle: 0,
 		skipped: tick.skipped,
 		archived_deferred: tick.archived_deferred,
 		purged_deferred: tick.purged_deferred
@@ -11483,7 +12364,6 @@ const RESTORE_METADATA_FIELDS = [
 	"last_reinforced_at",
 	"ttl_days",
 	"valid_from",
-	"valid_to",
 	"supersedes_source_id",
 	"archive",
 	"sources",
@@ -11629,9 +12509,7 @@ function rowOf(raw, metadataMissing, nowSql) {
 		lastRetrievedAt: textOrNull$1(row["last_retrieved_at"]),
 		ttlDays: Math.max(0, integerOrNull(row["ttl_days"]) ?? 0),
 		validFrom: textOrNull$1(row["valid_from"]),
-		validTo: textOrNull$1(row["valid_to"]),
 		validFromMs: eventTimeMs(textOrNull$1(row["valid_from"])) ?? null,
-		validToMs: eventTimeMs(textOrNull$1(row["valid_to"])) ?? null,
 		supersedesId: integerOrNull(row["supersedes_source_id"]),
 		mirrorSource: textOrNull$1(row["mirror_source"]),
 		mirrorTarget: textOrNull$1(row["mirror_target"]),
@@ -11674,10 +12552,11 @@ const INSERT_FACT_SQL = `INSERT INTO facts (
   fact_id, content, kind, title, legacy_category, status, archived_at, archive_reason,
   created_at, updated_at, trust_score, settle_clock, assert_count, helpful_count,
   pinned, pinned_at, last_reinforced_at, bonus_count, bonus_window_at,
-  retrieval_count, last_retrieved_at, ttl_days, valid_from, valid_to, valid_from_ms, valid_to_ms,
-  supersedes_id, mirror_source, mirror_target,
+  retrieval_count, last_retrieved_at, ttl_days, valid_from, valid_from_ms,
+  valid_to, valid_to_ms, supersedes_id, mirror_source, mirror_target,
   hrr_vector, semantic_vector, embedding_model, entities_version, conflict_checked
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, 0, 1)`;
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?,
+         NULL, NULL, NULL, 0, 1)`;
 function countOf(db, sql) {
 	return Number(db.prepare(sql).get()?.n ?? 0);
 }
@@ -11728,7 +12607,7 @@ async function restoreFactsDocument(target, doc, options = {}) {
 			const insertSource = target.db.prepare("INSERT INTO fact_sources (fact_id, kind, ref) VALUES (?, ?, ?)");
 			for (const row of rows) {
 				try {
-					insertFact.run(row.factId, row.content, row.kind, row.title, row.legacyCategory, row.status, row.archivedAt, row.archiveReason, row.createdAt, row.updatedAt, row.trustScore, row.settleClock ?? clock, row.assertCount, row.helpfulCount, row.pinned ? 1 : 0, row.pinnedAt, row.lastReinforcedAt, row.bonusCount, row.bonusWindowAt, row.retrievalCount, row.lastRetrievedAt, row.ttlDays, row.validFrom, row.validTo, row.validFromMs, row.validToMs, row.supersedesId, row.mirrorSource, row.mirrorTarget);
+					insertFact.run(row.factId, row.content, row.kind, row.title, row.legacyCategory, row.status, row.archivedAt, row.archiveReason, row.createdAt, row.updatedAt, row.trustScore, row.settleClock ?? clock, row.assertCount, row.helpfulCount, row.pinned ? 1 : 0, row.pinnedAt, row.lastReinforcedAt, row.bonusCount, row.bonusWindowAt, row.retrievalCount, row.lastRetrievedAt, row.ttlDays, row.validFrom, row.validFromMs, row.supersedesId, row.mirrorSource, row.mirrorTarget);
 					for (const source of row.sources) insertSource.run(row.factId, source.kind, source.ref);
 					if (row.relations.length > 0) {
 						const report = writeExplicitEdgesForFact(target.db, row.factId, row.relations);
@@ -11826,9 +12705,6 @@ var SqliteMemoryRepository = class {
 	countForgettingWithin(p) {
 		return this.dao.countForgettingWithin(p);
 	}
-	countIdleCandidates(days) {
-		return this.dao.countIdleCandidates(days);
-	}
 	countArchiveBacklog(p) {
 		return this.dao.countArchiveBacklog(p);
 	}
@@ -11911,11 +12787,11 @@ var SqliteMemoryRepository = class {
 			factId: Number(existing.fact_id)
 		};
 	}
-	applyValidity(factId, validFrom, validTo) {
-		this.dao.applyValidity(factId, validFrom, validTo);
+	applyValidity(factId, validFrom) {
+		this.dao.applyValidity(factId, validFrom);
 	}
-	applyValues(factId, kind, ttlDays) {
-		this.dao.applyValues(factId, kind, ttlDays);
+	applyValues(factId, kind) {
+		this.dao.applyValues(factId, kind);
 	}
 	setTitle(factId, title) {
 		this.dao.setTitle(factId, title);
@@ -11932,17 +12808,14 @@ var SqliteMemoryRepository = class {
 	incrementAssertCount(factId) {
 		return this.dao.incrementAssertCount(factId);
 	}
-	markValidTo(factId, at, atMs) {
-		this.dao.markValidTo(factId, at, atMs);
-	}
 	linkSupersede(factId, supersedesId) {
 		this.dao.linkSupersede(factId, supersedesId);
 	}
 	archiveSuperseded(factId, clock) {
 		return this.dao.archiveSuperseded(factId, clock);
 	}
-	revive(factId, kind, ttlDays, trust, clock) {
-		return this.dao.revive(factId, kind, ttlDays, trust, clock);
+	revive(factId, kind, trust, clock) {
+		return this.dao.revive(factId, kind, trust, clock);
 	}
 	archive(factId, clock, reason) {
 		return this.dao.archive(factId, clock, reason);
@@ -11950,24 +12823,12 @@ var SqliteMemoryRepository = class {
 	restore(factId, trust, clock) {
 		return this.dao.restore(factId, trust, clock);
 	}
-	bumpHelpful(factId, delta) {
-		this.dao.bumpHelpful(factId, delta);
-	}
 	pin(factId, clock) {
 		return this.dao.pin(factId, clock);
 	}
 	unpin(factId, clock) {
 		return this.dao.unpin(factId, clock);
 	}
-	pinOutcome(factId, clock, bonusCount, windowAt) {
-		this.dao.pinOutcome(factId, clock, bonusCount, windowAt);
-	}
-	forgetOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.dao.forgetOutcome(factId, trust, clock, bonusCount, windowAt);
-	}
-	reinforceOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.dao.reinforceOutcome(factId, trust, clock, bonusCount, windowAt);
-	}
 	touchUsage(ids) {
 		this.dao.touchUsage(ids);
 	}
@@ -15618,6 +16479,22 @@ const NO_CHECK = {
 */
 const RETRIEVAL_HEALTH_KEY = "retrieval_health";
 /**
+* The MODEL face's ONE instant renderer: a stored stamp → ISO-8601 **with the host's offset**
+* (`2026-10-28T19:58:48+08:00`), via `@avantf/mem-contract/time`'s `formatOffsetIso`.
+*
+* Every timestamp this store hands UP goes through here, and none of them is localized anywhere
+* else: the DB column stays UTC (`CURRENT_TIMESTAMP`) and the export document stays byte-identical
+* (`facts_io` reads rows directly), while the model receives an unambiguous instant and needs no
+* timezone arithmetic of its own. `null` means "absent/unreadable" — the CALLER keeps its existing
+* spelling (`''` for `created_at`, `null` for the nullable ones) instead of an empty time.
+*
+* NOT applied to `valid_from` / `event_date`: that is a calendar DATE the caller wrote, with no time
+* and no zone, and rendering it through a clock would invent a midnight.
+*/
+function modelInstant(value) {
+	return formatOffsetIso(value === null || value === void 0 ? null : String(value));
+}
+/**
 * The ONE stored-title-row → `TitleCandidate` mapper, shared by the exact page and the fuzzy
 * shortlist so a candidate cannot describe the same row two ways.
 *
@@ -15635,8 +16512,8 @@ function titleCandidatesOf(rows, includeExcerpt) {
 		matched_title: row.matched_title === null || row.matched_title === void 0 ? String(row.title) : String(row.matched_title),
 		memory_kind: mapLegacyKind(row.kind),
 		status: row.status === "archived" ? "archived" : "active",
-		created_at: row.created_at === null ? "" : String(row.created_at),
-		updated_at: row.updated_at === null ? null : String(row.updated_at),
+		created_at: modelInstant(row.created_at) ?? "",
+		updated_at: modelInstant(row.updated_at),
 		...row.valid_from === null || row.valid_from === void 0 ? {} : { event_date: String(row.valid_from) },
 		...includeExcerpt && row.excerpt !== null ? { excerpt: String(row.excerpt) } : {}
 	}));
@@ -15663,8 +16540,8 @@ function factEvidenceOf(row) {
 		status: row["status"] === "archived" ? "archived" : "active",
 		...title === null || title === void 0 || title === "" ? {} : { title: String(title) },
 		...row["valid_from"] === null || row["valid_from"] === void 0 ? {} : { event_date: String(row["valid_from"]) },
-		created_at: row["created_at"] === null || row["created_at"] === void 0 ? "" : String(row["created_at"]),
-		updated_at: row["updated_at"] === null || row["updated_at"] === void 0 ? null : String(row["updated_at"])
+		created_at: modelInstant(row["created_at"]) ?? "",
+		updated_at: modelInstant(row["updated_at"])
 	};
 }
 var MemoryStore = class {
@@ -15816,7 +16693,7 @@ var MemoryStore = class {
 			dim: this.vstore.dim
 		});
 	}
-	async add(content, kind, ttlDays, opts) {
+	async add(content, kind, opts) {
 		const normalized = normalizeWrite(content).trim();
 		if (!normalized) throw new Error("内容不能为空");
 		const secret = detectSecretShape(normalized);
@@ -15829,7 +16706,7 @@ var MemoryStore = class {
 		if (checkedKind !== void 0 && requiresEventDate(checkedKind) && opts?.eventDate === void 0) throw new Error(JOURNAL_NEEDS_EVENT_DATE);
 		const explicitTriples = opts?.relations === void 0 ? void 0 : await this.relations.explicitRelationTriples(checkedKind ?? "note", opts.relations);
 		const title = this.resolveWriteTitle(opts?.title, checkedKind);
-		const { fact_id, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, ttlDays, entityWrites, triples, {
+		const { fact_id, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, entityWrites, triples, {
 			...opts,
 			title,
 			relations: void 0
@@ -15920,7 +16797,7 @@ var MemoryStore = class {
 		}], this.vectorWriteTarget(this.vectorSpace()));
 		return encoded === 1;
 	}
-	async update(fact_id, content, kind, ttlDays, opts) {
+	async update(fact_id, content, kind, opts) {
 		const row = await this.getRow(fact_id);
 		if (!row) throw new Error(`找不到 fact_id=${fact_id}`);
 		const normalized = normalizeWrite(content).trim();
@@ -15936,7 +16813,7 @@ var MemoryStore = class {
 		if (requiresEventDate(effectiveKind) && opts?.eventDate === void 0 && row.valid_from == null) throw new Error(JOURNAL_NEEDS_EVENT_DATE);
 		const title = this.resolveWriteTitle(opts?.title, effectiveKind);
 		const explicitTriples = opts?.relations === void 0 ? void 0 : await this.relations.explicitRelationTriples(effectiveKind, opts.relations);
-		const { fact_id: newId, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, ttlDays, entityWrites, triples, {
+		const { fact_id: newId, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, entityWrites, triples, {
 			...opts,
 			supersedesId: fact_id,
 			archiveOldIfActive: true,
@@ -15970,9 +16847,9 @@ var MemoryStore = class {
 		return changed > 0;
 	}
 	/**
-	* Bring an archived fact back (spec §2.6): a `forgot` fact is lifted to
-	* `recall_floor` (otherwise the very next tick would re-archive it, R4), the
-	* idle clock is refreshed (otherwise an `idle`-archived fact dies again, R18),
+	* Bring an archived fact back (spec §2.6): a `forgot` fact is lifted to the frozen base
+	* `BASE_TRUST` (otherwise the very next tick would re-archive it, R4),
+	* `last_retrieved_at` is refreshed (observation only — no clock reads it any more),
 	* and `settle_clock` moves to now so the downtime is not charged.
 	*/
 	async restore(fact_id) {
@@ -15981,7 +16858,7 @@ var MemoryStore = class {
 		const trust = this.config.trust;
 		const clock = await this.lifecycle.clock();
 		const stored = Number(row.trust_score);
-		const next = String(row.archive_reason) === "forgot" || stored <= trust.forget_threshold ? Math.max(stored, trust.recall_floor) : stored;
+		const next = String(row.archive_reason) === "forgot" || stored <= trust.forget_threshold ? Math.max(stored, BASE_TRUST) : stored;
 		if (await this.facts.restore(fact_id, next, clock) === 0) return false;
 		const vec = bytesToFloat32(row.semantic_vector ?? null);
 		if (vec && vec.length === this.vstore.dim) this.vstore.add(fact_id, vec);
@@ -15989,42 +16866,6 @@ var MemoryStore = class {
 		if ((await this.detectContradictions(fact_id)).complete) await this.facts.markConflictChecked([fact_id]);
 		return true;
 	}
-	async helpful(fact_id) {
-		return await this.applyFeedback(fact_id, 1);
-	}
-	async unhelpful(fact_id) {
-		return await this.applyFeedback(fact_id, -1);
-	}
-	/**
-	* Explicit feedback (spec §2.4). Pinned/archived rows only move `helpful_count`
-	* (R7); otherwise the decay is settled first, then `±feedback_delta`, pin at the
-	* permanent threshold (snap to 1.0) or archive immediately at the forget line.
-	*/
-	async applyFeedback(fact_id, delta) {
-		if (await this.getRow(fact_id) === void 0) return null;
-		const trust = this.config.trust;
-		const evict = await this.lifecycle.immediateTransaction(async () => {
-			const row = await this.getRow(fact_id);
-			if (!row) return null;
-			const clock = await this.lifecycle.clock();
-			const outcome = applyFeedbackDelta(asTrustRow(row), clock, delta, Date.now(), trust);
-			await this.facts.bumpHelpful(fact_id, delta);
-			if (outcome.untouched) return null;
-			if (outcome.pin) {
-				await this.facts.pinOutcome(fact_id, clock, outcome.bonusCount, outcome.windowAt);
-				return null;
-			}
-			if (outcome.forget) {
-				await this.facts.forgetOutcome(fact_id, outcome.next, clock, outcome.bonusCount, outcome.windowAt);
-				await this.contradictions.resolveForFact(fact_id);
-				return fact_id;
-			}
-			await this.facts.reinforceOutcome(fact_id, outcome.next, clock, outcome.bonusCount, outcome.windowAt);
-			return null;
-		});
-		if (evict !== null) evictVectors(this.vstore, [evict]);
-		return (await this.getRow(fact_id))?.helpful_count ?? 0;
-	}
 	/** Permanent-memory administration (spec §6). */
 	async pin(fact_id) {
 		return await this.facts.pin(fact_id, await this.lifecycle.clock()) > 0;
@@ -16042,15 +16883,15 @@ var MemoryStore = class {
 		const clock = await this.lifecycle.clock();
 		const active = await this.facts.countActive();
 		const pinned = await this.facts.countPinnedActive();
-		const forgettingSoon = trust.decay_per_day > 0 ? await this.facts.countForgettingWithin({
-			step: trust.decay_per_day,
+		const curve = curveOf(trust);
+		const forgettingSoon = await this.facts.countForgettingWithin({
+			threshold: ceilingForDays(FORGETTING_SOON_DAYS, curve),
 			clock,
-			withinDays: FORGETTING_SOON_DAYS
-		}) : 0;
+			curve
+		});
 		const bonus = await this.facts.bonusStatedToday();
 		const reinforcedToday = bonus.count;
 		const grantedToday = bonus.granted;
-		const idleCandidates = await this.facts.countIdleCandidates(trust.idle_calendar_days);
 		const reasons = await this.facts.archivedByReason();
 		const oldest = await this.facts.minSettleClock();
 		return {
@@ -16061,7 +16902,6 @@ var MemoryStore = class {
 			forgetting_soon: forgettingSoon,
 			reinforced_today: reinforcedToday,
 			bonus_granted_today: grantedToday,
-			idle_candidates: idleCandidates,
 			conflict_pending: await this.facts.countPendingConflicts(),
 			entities_stale: await this.facts.countStaleEntities(3),
 			archived_by_reason: Object.fromEntries(reasons.map((r) => [r.reason ?? "unknown", r.n])),
@@ -16194,9 +17034,48 @@ var MemoryStore = class {
 		await (this.semantic.warmUp?.() ?? Promise.resolve());
 		return this.semantic.isAvailable();
 	}
-	/** List contradiction candidates (`resolved` 0 = open, 1 = closed with a recorded verdict). */
+	/**
+	* Point the semantic backend at a shared runtime-dependency root (the base provider's
+	* `runtime-deps` handle) before it warms. Best-effort by contract: a backend without external
+	* module resolution ignores it, and a missing root is reported by the backend itself.
+	*/
+	useSemanticModuleDir(dir) {
+		this.semantic.useModuleDir?.(dir);
+	}
+	/**
+	* Point the vector store at a shared runtime-dependency root for its NATIVE binding
+	* (`hnswlib-node`), after the DSH plugin's native self-heal item is ready.
+	*
+	* Same best-effort contract as {@link useSemanticModuleDir}: a store with no native binding (the
+	* brute-force backend, or an `auto` store still on it) ignores it, and a store that already fell
+	* back to brute force rebuilds its tracked vectors under the new root. Nothing here decides whether
+	* a root should exist — the caller's dependency audit does.
+	*/
+	useNativeModuleDir(dir) {
+		this.vstore.useModuleDir?.(dir);
+	}
+	/**
+	* Vectors currently in the LIVE index (sync, one map read).
+	*
+	* Exposed for the plugin's dependency audit: an `hnswlib-node` notice is conditioned on the corpus
+	* actually being large enough for an ANN index to matter (`min_vectors`), and a session line that
+	* asks "how big is the store right now" must not run a database query to answer.
+	*/
+	liveVectorCount() {
+		return this.vstore.count();
+	}
+	/**
+	* List contradiction candidates (`resolved` 0 = open, 1 = closed with a recorded verdict).
+	*
+	* `detected_at` is mapped to the model face's instant shape here (the DAO hands back the raw UTC
+	* column): this payload is what the 记忆 tab's 未处理矛盾 table and the CLI both render, and it must
+	* not be the one surface still printing a zone-less stamp.
+	*/
 	async listContradictions(opts) {
-		return await this.contradictions.list(opts?.resolved ?? 0, opts?.kind, opts?.threshold, opts?.limit ?? 10);
+		return (await this.contradictions.list(opts?.resolved ?? 0, opts?.kind, opts?.threshold, opts?.limit ?? 10)).map((row) => ({
+			...row,
+			detected_at: modelInstant(row.detected_at) ?? row.detected_at
+		}));
 	}
 	/**
 	* Adjudicate one logged conflict — the outlet the detector never had.
@@ -16242,7 +17121,6 @@ var MemoryStore = class {
 				reason: "loser_not_in_pair"
 			};
 			await this.archive(loserFactId, "contradiction");
-			await this.facts.markValidTo(loserFactId, formatUtcTs(Date.now()), Date.now());
 			await this.contradictions.resolve(id, resolution, loserFactId);
 			return {
 				resolved: true,
@@ -16629,10 +17507,21 @@ var MemoryStore = class {
 	* ({@link timePage}, `mode:"time"`): the window is the whole question, so there is nothing to
 	* match, plan or rank.
 	*
-	* The exact, facts and relation passes reinforce the facts they return, exactly like the fuzzy
-	* pass does for its hits: all are recalls the caller actually reads. A caller that must stay
-	* read-only passes `track: false` (the conditional hint's probe does). Exact, facts, relation and
-	* time also honour the caller's output budget (their text is the caller's to bound).
+	* What a pass does to the rows it returns is one decision, and it is deliberately NOT uniform:
+	*
+	*  - the RELATION and FUZZY passes REINFORCE them ({@link reinforce}): each answers a question
+	*    the caller asked, so the rows are what it read;
+	*  - the TIME, EXACT and FACTS passes record USAGE ONLY ({@link touchOnly}): they hand back a
+	*    LIST the caller browses — page 2 of a listing is not a second recall — so "it was looked
+	*    at" still moves `retrieval_count` / `last_retrieved_at` (the dormancy clock) while
+	*    `trust_score` / `bonus_count` stay where they are.
+	*
+	* A caller that must stay read-only passes `track: false` (the conditional hint's probe does);
+	* that branch writes nothing at all, usage included. Exact, facts, relation and time also honour
+	* the caller's output budget (their text is the caller's to bound). The one difference is the
+	* DEFAULT: a time window applies no budget unless the caller names one — its page size (`limit`)
+	* is what bounds the list, and the budget would only rewrite rows the caller asked for (see
+	* {@link timePage}).
 	*
 	* It does NOT emit a retrieval-health event. Those counters describe the retrieval PIPELINE
 	* (legs, fusion, semantic-live rate); none of an exact, facts, relation or time answer ran a leg,
@@ -16678,32 +17567,47 @@ var MemoryStore = class {
 	* happened that day" reads in the order it happened; `score` is the constant 1 exactly like the
 	* exact page's, because there is no relevance number here for the model to compare.
 	*
-	* It honours `kind`/`source`, pages with the same `offset`/`limit` (default 10, cap 50) and the
-	* same `max_tokens` budget as every other recall, and reinforces the rows it returns unless
-	* `track: false` — a window the caller reads is a recall like any other.
+	* The PAGE is the contract's, not the caller's guess: `limit` omitted means one page of
+	* {@link TIME_DEFAULT_LIMIT} rows (the same 50 the contract caps an explicit page at), and an
+	* explicit `limit` (1-50) still wins. A window that holds more than one page is the normal case
+	* for a busy day, so the envelope does not leave the caller to infer the shortfall: it reports
+	* `remaining = total - (offset + hits.length)`, the count still unseen.
+	*
+	* The output budget is honoured only when the caller names it (`max_tokens`). Falling back to the
+	* configured `retrieval.max_output_tokens` here would rewrite the text of a window's rows behind a
+	* page the caller already bounded with `limit` — the page size is the knob for "how much of the
+	* list", and the budget stays a knob for a RANKED result (exact/facts/relation/hybrid unchanged).
+	* `max_tokens` (including the contract's `0` = unlimited) is passed through unchanged.
+	*
+	* It honours `kind`/`source`, and records usage ONLY for the rows it returns unless `track: false`
+	* ({@link touchOnly}). A window is listed so the caller can look through it, not recalled into an
+	* answer: the dormancy clock (`retrieval_count` / `last_retrieved_at`) moves, trust does not.
 	*/
 	async timePage(input) {
 		if (input.time === void 0) throw new Error("mem_recall.search 需要 `query`，或只给 `time`（纯时间召回）；两者都没有时无法检索。");
 		const time = normalizeTimeFilter(input.time);
-		const { offset, limit } = exactPage(input.offset, input.limit);
+		const page = exactPage(input.offset, input.limit);
 		const filters = {
 			time,
 			...input.kind === void 0 ? {} : { kind: input.kind },
 			...input.source === void 0 ? {} : { source: input.source }
 		};
 		const total = await this.searchIndex.countInTimeWindow(filters);
+		const limit = input.limit === void 0 ? 50 : page.limit;
+		const offset = page.offset;
 		const ids = total === 0 ? [] : await this.searchIndex.timeWindowRows({
 			...filters,
 			limit,
 			offset
 		});
-		const { kept } = applyOutputBudget(this.config, await this.factHits(ids, () => 1), input.maxTokens);
-		if (input.track !== false) await this.reinforce(kept.map((hit) => hit.ref_id));
+		const { kept } = applyOutputBudget(this.config, await this.factHits(ids, () => 1), input.maxTokens ?? 0);
+		if (input.track !== false) await this.touchOnly(kept.map((hit) => hit.ref_id));
 		return {
 			mode: "time",
 			total,
 			offset,
 			limit,
+			remaining: Math.max(0, total - (offset + kept.length)),
 			truncated: offset + kept.length < total,
 			hits: kept
 		};
@@ -16735,7 +17639,7 @@ var MemoryStore = class {
 			offset
 		});
 		const { kept } = applyOutputBudget(this.config, await this.factHits(ids, () => 1), input.maxTokens);
-		if (input.track !== false) await this.reinforce(kept.map((hit) => hit.ref_id));
+		if (input.track !== false) await this.touchOnly(kept.map((hit) => hit.ref_id));
 		return {
 			mode: "exact",
 			total,
@@ -16772,8 +17676,8 @@ var MemoryStore = class {
 	*    malformed window is the caller's error exactly as it is in the exact page;
 	*  - the page is FACT-level (`total`/`offset`/`limit`/`truncated`), and the caller's output budget
 	*    only shortens `content` — dropping a row would make `total` disagree with the page;
-	*  - the returned facts are reinforced unless `track: false`, like every other recall the caller
-	*    actually reads.
+	*  - the returned facts get usage recorded but NO reinforcement unless `track: false`: a facts
+	*    page is a list the caller browses, so only the dormancy clock moves ({@link touchOnly}).
 	*/
 	async factPage(input, rawQuery) {
 		const query = rawQuery.trim();
@@ -16792,7 +17696,7 @@ var MemoryStore = class {
 		});
 		if (page.total === 0) return null;
 		const facts = this.budgetFactEvidence(page.rows.map(factEvidenceOf), input.maxTokens);
-		if (input.track !== false) await this.reinforce(facts.map((entry) => entry.fact_id));
+		if (input.track !== false) await this.touchOnly(facts.map((entry) => entry.fact_id));
 		return {
 			mode: "facts",
 			total: page.total,
@@ -16889,8 +17793,8 @@ var MemoryStore = class {
 				text: String(row["content"] ?? ""),
 				memory_kind: mapLegacyKind(String(row["kind"] ?? "note")),
 				...title === void 0 ? {} : { title },
-				created_at: row["created_at"] === null || row["created_at"] === void 0 ? "" : String(row["created_at"]),
-				updated_at: row["updated_at"] === null || row["updated_at"] === void 0 ? null : String(row["updated_at"])
+				created_at: modelInstant(row["created_at"]) ?? "",
+				updated_at: modelInstant(row["updated_at"])
 			});
 		}
 		return evidence;
@@ -17118,10 +18022,9 @@ var MemoryStore = class {
 				score: scoreOf(id),
 				source_ref: factSourceRef(id),
 				entities: bags.get(id) ?? [],
-				created_at: time?.created_at ?? "",
-				updated_at: time?.updated_at ?? null,
+				created_at: modelInstant(time?.created_at) ?? "",
+				updated_at: modelInstant(time?.updated_at),
 				...time?.valid_from === null || time?.valid_from === void 0 ? {} : { valid_from: time.valid_from },
-				...time?.valid_to === null || time?.valid_to === void 0 ? {} : { valid_to: time.valid_to },
 				...time?.title === null || time?.title === void 0 ? {} : { title: time.title }
 			};
 		});
@@ -17186,6 +18089,19 @@ var MemoryStore = class {
 		} catch {}
 	}
 	/**
+	* Record the USAGE of these facts and nothing else — no trust bonus, no quota, no
+	* `last_reinforced_at`.
+	*
+	* This is the paginated passes' half of {@link reinforce}: `timePage` / `exactContentPage` /
+	* `factPage` return a list the caller browses rather than a recall it acted on, so "someone
+	* looked at this row" still moves `retrieval_count` / `last_retrieved_at` (observation and
+	* export only — no lifecycle step reads that clock) while `trust_score` / `bonus_count` stay
+	* put.
+	*/
+	async touchOnly(ids) {
+		if (ids.length) await this.touchUsage(ids);
+	}
+	/**
 	* Semantic leg. `queryVector` short-circuits the encode when the caller already
 	* encoded this exact query (the cross-store router does, for both stores at once);
 	* `onVector` publishes the vector this leg actually used, so the relaxed retry pass can reuse it
@@ -17294,25 +18210,22 @@ var MemoryStore = class {
 	/**
 	* Insert (or resolve to) a fact row.
 	*
-	* `kind` / `ttlDays` are `undefined` when the CALLER specified nothing — the
-	* distinction is load-bearing. A duplicate-content hit must not clobber the existing
-	* row's values with the insert defaults: re-adding a fact without a kind used to
-	* reset it to `general`, and reviving an archived one silently cleared an explicit TTL.
-	* The rule for all three branches is therefore: an explicitly provided value lands, an
-	* omitted one keeps what the row already has, and a brand-new row falls back to the
-	* defaults (`general` / `0`).
+	* `kind` is `undefined` when the CALLER specified nothing — the distinction is load-bearing.
+	* A duplicate-content hit must not clobber the existing row's value with the insert default:
+	* re-adding a fact without a kind used to reset it to `general`. The rule for all three
+	* branches is therefore: an explicitly provided value lands, an omitted one keeps what the row
+	* already has, and a brand-new row falls back to the default (`note`).
 	*/
-	async persistFact(content, kind, ttlDays, entities, triples, opts, explicitEdges = void 0) {
+	async persistFact(content, kind, entities, triples, opts, explicitEdges = void 0) {
 		const hrr = hrrToBytes(encodeHrrEntityVector(entities.map((e) => e.name)));
 		const trust = this.config.trust;
 		const clock = await this.lifecycle.clock();
 		const nowIso = formatUtcTs(Date.now());
 		const replaced = opts?.supersedesId === void 0 ? void 0 : await this.getRow(opts.supersedesId);
 		const superseded = trust.inherit_trust_on_update ? replaced : void 0;
-		const startTrust = superseded === void 0 ? trust.start : effectiveTrust(asTrustRow(superseded), clock, trust);
+		const startTrust = superseded === void 0 ? BASE_TRUST : effectiveTrust(asTrustRow(superseded), clock, trust);
 		const startPinned = superseded !== void 0 && isPinned(asTrustRow(superseded)) ? 1 : 0;
 		const newKind = kind ?? (replaced === void 0 ? "note" : mapLegacyKind(replaced.kind));
-		const newTtl = ttlDays ?? (replaced === void 0 ? 0 : Number(replaced.ttl_days ?? 0));
 		/**
 		* The title this revision would carry (JOURNAL_TITLE_SEARCH §2.2/§11.2, v17's correction).
 		*
@@ -17344,13 +18257,11 @@ var MemoryStore = class {
 		}
 		const createdAt = replaced === void 0 || replaced.created_at === null ? nowIso : String(replaced.created_at);
 		const validFrom = opts?.eventDate === void 0 ? replaced === void 0 ? null : nullableEventTime(replaced.valid_from, replaced.valid_from_ms) : normalizeEventTime(opts.eventDate, "event_date");
-		const validTo = opts?.validUntil === void 0 ? replaced === void 0 ? null : nullableEventTime(replaced.valid_to, replaced.valid_to_ms) : normalizeEventTime(opts.validUntil, "valid_until");
 		const { supersededId, ...result } = await this.lifecycle.transaction(async () => {
 			const cur = await this.facts.insertRevision({
 				content,
 				kind: newKind,
 				title: desiredTitle,
-				ttlDays: newTtl,
 				supersedesId: opts?.supersedesId ?? null,
 				hrr,
 				trust: clamp01(startTrust),
@@ -17360,9 +18271,7 @@ var MemoryStore = class {
 				windowAt: nowIso,
 				createdAt,
 				validFrom: validFrom?.text ?? null,
-				validTo: validTo?.text ?? null,
-				validFromMs: validFrom?.ms ?? null,
-				validToMs: validTo?.ms ?? null
+				validFromMs: validFrom?.ms ?? null
 			});
 			let fact_id;
 			let is_new;
@@ -17372,18 +18281,16 @@ var MemoryStore = class {
 				fact_id = Number(row.fact_id);
 				is_new = false;
 				const rowKind = mapLegacyKind(row.kind);
-				const rowTtl = Number(row.ttl_days ?? 0);
 				const keepKind = kind ?? rowKind;
-				const keepTtl = ttlDays ?? rowTtl;
 				const rowTitle = storedTitle(row.title);
 				const selfRetitle = retitle && opts?.supersedesId !== void 0 && Number(opts.supersedesId) === fact_id;
 				if (opts?.title !== void 0 && opts.title !== null && rowTitle !== null && opts.title !== rowTitle && !selfRetitle) throw new Error(TITLE_CONFLICT);
 				const keepTitle = selfRetitle ? desiredTitle : rowTitle ?? desiredTitle;
 				if (opts?.requireJournalTitle === true && keepKind === "journal" && keepTitle === null) throw new Error(TITLE_REQUIRED);
-				await this.facts.applyValidity(fact_id, opts?.eventDate === void 0 ? void 0 : validFrom ?? void 0, opts?.validUntil === void 0 ? void 0 : validTo ?? void 0);
+				await this.facts.applyValidity(fact_id, opts?.eventDate === void 0 ? void 0 : validFrom ?? void 0);
 				const settled = effectiveTrust(asTrustRow(row), clock, trust);
-				const revived = await this.facts.revive(fact_id, keepKind, keepTtl, Math.max(settled, trust.recall_floor), clock) > 0;
-				if (!revived && (keepKind !== rowKind || keepTtl !== rowTtl)) await this.facts.applyValues(fact_id, keepKind, keepTtl);
+				const revived = await this.facts.revive(fact_id, keepKind, Math.max(settled, BASE_TRUST), clock) > 0;
+				if (!revived && keepKind !== rowKind) await this.facts.applyValues(fact_id, keepKind);
 				if (keepTitle !== null && keepTitle !== rowTitle) {
 					await this.facts.setTitle(fact_id, keepTitle);
 					if (selfRetitle) {
@@ -17471,10 +18378,7 @@ var MemoryStore = class {
 		if (!opts?.supersedesId || opts.supersedesId === fact_id) return null;
 		await this.facts.linkSupersede(fact_id, opts.supersedesId);
 		if (opts.archiveOldIfActive) {
-			if (await this.facts.archiveSuperseded(opts.supersedesId, await this.lifecycle.clock()) > 0) {
-				await this.contradictions.resolveForFact(opts.supersedesId);
-				await this.facts.markValidTo(opts.supersedesId, formatUtcTs(Date.now()), Date.now());
-			}
+			if (await this.facts.archiveSuperseded(opts.supersedesId, await this.lifecycle.clock()) > 0) await this.contradictions.resolveForFact(opts.supersedesId);
 		}
 		await this.triples.deleteForFact(opts.supersedesId);
 		await this.relations.deleteEdgesForFact(opts.supersedesId);
@@ -17631,8 +18535,8 @@ var MemoryStore = class {
 			pinned: isPinned(row),
 			remaining_days: remainingDays(row, clock, this.config.trust),
 			helpful_count: Number(r.helpful_count),
-			created_at: String(r.created_at),
-			archived_at: r.archived_at ? String(r.archived_at) : null,
+			created_at: modelInstant(r.created_at) ?? "",
+			archived_at: modelInstant(r.archived_at),
 			archive_reason: r.archive_reason ? String(r.archive_reason) : null
 		};
 	}
@@ -17645,14 +18549,13 @@ var MemoryStore = class {
 			entities,
 			triples,
 			settle_clock: Number(r.settle_clock),
-			pinned_at: r.pinned_at ? String(r.pinned_at) : null,
-			last_reinforced_at: r.last_reinforced_at ? String(r.last_reinforced_at) : null,
-			updated_at: r.updated_at ? String(r.updated_at) : null,
+			pinned_at: modelInstant(r.pinned_at),
+			last_reinforced_at: modelInstant(r.last_reinforced_at),
+			updated_at: modelInstant(r.updated_at),
 			bonus_count: Number(r.bonus_count ?? 0),
-			bonus_window_at: r.bonus_window_at ? String(r.bonus_window_at) : null,
+			bonus_window_at: modelInstant(r.bonus_window_at),
 			sources: await this.sources.listForFact(factId),
 			valid_from: nullableString(r.valid_from),
-			valid_to: nullableString(r.valid_to),
 			superseded_by: await this.facts.supersededBy(factId),
 			assert_count: Number(r.assert_count ?? 1),
 			relations: await this.relations.explicitRelationsForFact(factId)
@@ -17758,10 +18661,11 @@ function nullableEventTime(text, ms) {
 * inserts SQL rows.
 *
 * TWO CONSUMERS, TWO SEMANTICS. `import`/`merge` remain a CONTENT-IDENTITY UNION and consume only
-* a subset: kind, ttl_days, embedded source ref, valid_from → event_date and valid_to →
-* valid_until. They do NOT restore created_at/updated_at/trust_score/assert_count/helpful_count/
-* pinned, archived status or the supersedes chain — `metadata_dropped` counts each value they
-* knowingly drop instead of pretending. `restore` is the REBUILD (see `store/facts_restore.ts`):
+* a subset: kind, embedded source ref and valid_from → event_date. They do NOT restore
+* created_at/updated_at/trust_score/assert_count/helpful_count/pinned, archived status, the
+* supersedes chain, or the retired `ttl_days` / `valid_to` values (v2: the columns stay in the
+* document for format stability, but nothing reads them on the way in) — `metadata_dropped` counts
+* each value they knowingly drop instead of pretending. `restore` is the REBUILD (see `store/facts_restore.ts`):
 * only into an EMPTY facts table, keeping fact_id, status, timestamps, trust, pin, counters, every
 * provenance row and the supersedes chain, then re-deriving entities. The union path never revives
 * an archived row; restore is the only path that brings archived rows back. The vector, entity,
@@ -17857,7 +18761,6 @@ const FACT_COLUMNS = [
 	"helpful_count",
 	"last_reinforced_at",
 	"valid_from",
-	"valid_to",
 	"supersedes_id",
 	"archived_at",
 	"archive_reason",
@@ -18007,7 +18910,7 @@ function readFactsDocument(dbPath, options) {
 				last_reinforced_at: textOrNull(cell(row, "last_reinforced_at")),
 				sources: sources.get(sourceId) ?? [],
 				valid_from: textOrNull(cell(row, "valid_from")),
-				valid_to: textOrNull(cell(row, "valid_to")),
+				valid_to: null,
 				supersedes_source_id: supersedes === null || supersedes === void 0 ? null : numberOf(supersedes, 0),
 				archive: status === "archived" ? {
 					at: textOrNull(cell(row, "archived_at")),
@@ -18203,7 +19106,9 @@ function emptyMetadataDropped() {
 		assert_count: 0,
 		helpful_count: 0,
 		pinned: 0,
-		supersedes: 0
+		supersedes: 0,
+		ttl_days: 0,
+		valid_to: 0
 	};
 }
 /** What a Phase-2 restore WOULD have carried but v1 does not. */
@@ -18214,7 +19119,9 @@ function metadataDroppedOf(row) {
 		assert_count: numberOf(cell(row, "assert_count"), 1) > 1 ? 1 : 0,
 		helpful_count: numberOf(cell(row, "helpful_count"), 0) > 0 ? 1 : 0,
 		pinned: boolOf(cell(row, "pinned")) ? 1 : 0,
-		supersedes: cell(row, "supersedes_source_id") === null || cell(row, "supersedes_source_id") === void 0 ? 0 : 1
+		supersedes: cell(row, "supersedes_source_id") === null || cell(row, "supersedes_source_id") === void 0 ? 0 : 1,
+		ttl_days: numberOf(cell(row, "ttl_days"), 0) > 0 ? 1 : 0,
+		valid_to: cell(row, "valid_to") === null || cell(row, "valid_to") === void 0 ? 0 : 1
 	};
 }
 function accumulateMetadataDropped(total, one) {
@@ -18224,6 +19131,8 @@ function accumulateMetadataDropped(total, one) {
 	total.helpful_count += one.helpful_count;
 	total.pinned += one.pinned;
 	total.supersedes += one.supersedes;
+	total.ttl_days += one.ttl_days;
+	total.valid_to += one.valid_to;
 }
 function sourceIdOf(row) {
 	const value = cell(row, "source_id");
@@ -18235,12 +19144,6 @@ function optionalString(row, key, label) {
 	if (typeof value !== "string") throw new Error(`${label} 不是字符串`);
 	return value === "" ? void 0 : value;
 }
-function optionalTtlDays(row) {
-	const value = cell(row, "ttl_days");
-	if (value === null || value === void 0) return void 0;
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error("ttl_days 无效（需要非负整数）");
-	return value;
-}
 function optionalDate(row, key, label) {
 	const value = cell(row, key);
 	if (value === null || value === void 0) return void 0;
@@ -18302,19 +19205,15 @@ function addRequestFor(identity, row, fallbackSourceRef, preferEmbeddedSources)
 	const sourceRef = (preferEmbeddedSources ? embeddedSourceRef(row) : void 0) ?? fallbackSourceRef;
 	const kind = mapLegacyKind(optionalString(row, "kind", "kind") ?? optionalString(row, "category", "category"));
 	const title = optionalString(row, "title", "title");
-	const ttlDays = optionalTtlDays(row);
 	const eventDate = optionalDate(row, "valid_from", "valid_from");
-	const validUntil = optionalDate(row, "valid_to", "valid_to");
 	const relations = relationsOf(row, kind);
 	return {
 		action: "add",
 		content: identity,
 		kind,
 		...title === void 0 ? {} : { title },
-		...ttlDays === void 0 ? {} : { ttl_days: ttlDays },
 		...sourceRef === void 0 ? {} : { source_ref: sourceRef },
 		...eventDate === void 0 ? {} : { event_date: eventDate },
-		...validUntil === void 0 ? {} : { valid_until: validUntil },
 		...relations === void 0 ? {} : { relations }
 	};
 }
@@ -18709,13 +19608,12 @@ function walHealth(dbPath) {
 * P-08 / P-13 / JOURNAL_TITLE_SEARCH: the `mem_remember` extras, lifted off the request and onto the
 * store's write options. Only the keys actually present are carried, so an omitted argument stays
 * "omitted" all the way down (the store's "unset keeps what the row has" rule — an update inherits
-* an omitted title, TTL, event time — depends on that distinction).
+* an omitted title or event time — depends on that distinction).
 */
 function writeOptions(req, rules) {
 	return {
 		...req.source_ref === void 0 ? {} : { sourceRef: req.source_ref },
 		...req.event_date === void 0 ? {} : { eventDate: req.event_date },
-		...req.valid_until === void 0 ? {} : { validUntil: req.valid_until },
 		...req.title === void 0 ? {} : { title: req.title },
 		...req.retitle === true ? { retitle: true } : {},
 		...req.relations === void 0 ? {} : { relations: req.relations },
@@ -18839,11 +19737,9 @@ async function buildRuntime(opts) {
 		},
 		async remember(req, rules) {
 			switch (req.action) {
-				case "add": return this.memory.add(req.content, req.kind, req.ttl_days, writeOptions(req, rules));
-				case "update": return this.memory.update(req.fact_id, req.content, req.kind, req.ttl_days, writeOptions(req, rules));
+				case "add": return this.memory.add(req.content, req.kind, writeOptions(req, rules));
+				case "update": return this.memory.update(req.fact_id, req.content, req.kind, writeOptions(req, rules));
 				case "remove": return this.memory.remove(req.fact_id, req.reason);
-				case "helpful": return this.memory.helpful(req.fact_id);
-				case "unhelpful": return this.memory.unhelpful(req.fact_id);
 			}
 		},
 		async recall(req) {
@@ -18873,14 +19769,19 @@ async function buildRuntime(opts) {
 		},
 		async admin(req) {
 			switch (req.action) {
-				case "stats": return {
-					...await this.memory.countByStatus(),
-					retrieval: retrievalHealthSummary(),
-					vectors: await this.memory.vectorSpaceHealth(),
-					wal: walHealth(memDb),
-					sources: await this.memory.sourceCoverage(),
-					validity: await this.memory.validityCoverage()
-				};
+				case "stats":
+					const retrieval = retrievalHealthSummary();
+					return {
+						...await this.memory.countByStatus(),
+						retrieval: {
+							...retrieval,
+							updated_at: formatOffsetIso(retrieval.updated_at)
+						},
+						vectors: await this.memory.vectorSpaceHealth(),
+						wal: walHealth(memDb),
+						sources: await this.memory.sourceCoverage(),
+						validity: await this.memory.validityCoverage()
+					};
 				case "list": return await this.memory.list(req.kind, req.status ?? "active", req.limit ?? 50, req.offset ?? 0, req.source, req.time);
 				case "detail": return await this.memory.get(req.fact_id) ?? { error: `fact_id=${req.fact_id} not found` };
 				case "archive": return await this.memory.archive(req.fact_id, req.reason);
@@ -19031,11 +19932,9 @@ const descriptors = [
 		content: optionalText.optional(),
 		fact_id: count.optional(),
 		kind: optionalText.optional(),
-		ttl_days: count.optional(),
 		reason: optionalText.optional(),
 		source_ref: optionalText.optional(),
 		event_date: optionalText.optional(),
-		valid_until: optionalText.optional(),
 		title: optionalText.optional(),
 		retitle: bool.optional(),
 		relations: z.array(z.object({
@@ -19254,7 +20153,7 @@ const VERSION_PACKAGES = [
 /** This plugin's npm package id, which names the probe and verification keys. */
 const PACKAGE_ID = String(hostContribution.package ?? "@avantf/dsh-mem");
 /** Best-effort one-line reason for a caught value. */
-function reasonOf(error) {
+function reasonOf$2(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 /** Emit a warning without ever letting the logger turn it into a crash. */
@@ -19294,7 +20193,7 @@ function runtimeFromCompat(module) {
 }
 /** The "the check itself failed" outcome: keep loading, say why. */
 function cannotDetermine(error, log, prefix) {
-	const message = `${prefix} WARNING — the compatibility check itself failed (${reasonOf(error)}); loading anyway`;
+	const message = `${prefix} WARNING — the compatibility check itself failed (${reasonOf$2(error)}); loading anyway`;
 	warn(log, message);
 	return { verdict: {
 		load: true,
@@ -19378,6 +20277,290 @@ function verifyRegisteredFaces(input) {
 		toolNames: input.toolNames
 	});
 }
+//#endregion
+//#region lib/types/deps_audit.js
+/**
+* The STARTUP DEPENDENCY AUDIT: one cached, synchronous answer per CONFIGURED entry to "can this
+* process actually load that piece right now?", recorded at the end of the mount and refreshed when a
+* self-heal item settles.
+*
+* WHY IT EXISTS. A session notice is the last step of the fallback chain
+* `npm optional → self-heal → notice`, and the decision "is this really missing?" cannot be made on
+* the prompt path: `pre-step` runs on every user message, and resolving a package there would be a
+* filesystem hit (and, for a native addon, a `dlopen`) per step. So the expensive half happens ONCE,
+* off the mount path, and `pre-step` only consumes the registry, whose predicates read this snapshot.
+*
+* CONFIG-DRIVEN, NOT PACKAGE-DRIVEN. This module knows two probe KINDS and nothing about which
+* packages exist:
+*
+*  - {@link moduleProbe} — resolve AND load one specifier (a real `require`/`import`, so a native
+*    addon's binding is loaded rather than merely found), trying the ready shared roots first and
+*    this tree last;
+*  - {@link itemProbe} — the state of one runtime-deps item, through a caller-supplied lookup (the
+*    provisioner's own `resolve`, with the "declared but not settled" gate on top).
+*
+* Which entries exist, how loud each one is, and what it says come from the plugin's SHIPPED
+* `res/runtime-deps.yaml` (`RuntimeDepsResourceSchema` in the contract). No package name, sentence or
+* severity is written here.
+*
+* WHAT IT IS NOT:
+*
+*  - **Not a retry loop.** `run()` at startup, `run()` again when a self-heal item settles. A package
+*    installed by hand afterwards is picked up on the next restart, not polled for.
+*  - **Not throwing.** It runs beside a live host: a probe that fails is a recorded state plus a log
+*    line, never an exception out of the mount.
+*  - **Not a second source of truth about an item.** `itemProbe` ASKS the caller; the states here are
+*    only a cache of that answer, refreshed on every settlement.
+*/
+/** The states this build understands (a JS caller can hand over anything). */
+const STATES = [
+	"available",
+	"failed",
+	"missing",
+	"skipped",
+	"pending",
+	"unknown"
+];
+/** Reason text for a thrown value, without trusting it. */
+function reasonOf$1(error) {
+	try {
+		if (error instanceof Error && typeof error.message === "string" && error.message !== "") return error.message;
+		return String(error);
+	} catch {
+		return "unknown";
+	}
+}
+/**
+* Build the audit.
+*
+* Every configured entry starts `unknown`; nothing is assumed about an entry that has not been
+* checked. The caller runs it once (fire-and-forget) and again for the entries a settlement could
+* change — that ordering is what makes a session line appear only after there is an observation.
+*/
+function createDependencyAudit(options) {
+	const states = /* @__PURE__ */ new Map();
+	const pending = /* @__PURE__ */ new Map();
+	const probes = /* @__PURE__ */ new Map();
+	for (const probe of options.probes) {
+		probes.set(probe.id, probe);
+		states.set(probe.id, "unknown");
+	}
+	const warn = (message) => {
+		try {
+			options.logger?.warn(message);
+		} catch {}
+	};
+	const info = (message) => {
+		try {
+			options.logger?.info(message);
+		} catch {}
+	};
+	const runId = (id) => {
+		const running = pending.get(id);
+		if (running !== void 0) return running;
+		const probe = probes.get(id);
+		if (probe === void 0) return Promise.resolve();
+		const task = (async () => {
+			let next;
+			try {
+				next = await probe.check();
+			} catch (error) {
+				warn(`deps audit: probing ${id} failed (${reasonOf$1(error)}); its state stays unknown`);
+				next = "unknown";
+			}
+			if (!STATES.includes(next)) next = "unknown";
+			const before = states.get(id);
+			states.set(id, next);
+			if (before !== next) info(`deps audit: ${id} is ${next}`);
+		})().finally(() => {
+			pending.delete(id);
+		});
+		pending.set(id, task);
+		return task;
+	};
+	return {
+		state(id) {
+			return states.get(id) ?? "unknown";
+		},
+		vectors() {
+			try {
+				return options.vectors();
+			} catch {
+				return 0;
+			}
+		},
+		async run() {
+			await Promise.all([...probes.keys()].map((id) => runId(id)));
+		},
+		runId
+	};
+}
+/**
+* Resolve and LOAD one specifier, from the first root that can serve it and then from this tree.
+*
+* The `createRequire(<root>/package.json)` anchor is the same rule the semantic adapter uses: a
+* shared runtime-deps root's `package.json` is what makes `resolve` look in THAT root's
+* `node_modules`, so the audit observes the copy the runtime would load. The import is by FILE URL
+* because the resolved entry is inside the root, not a bare specifier this module could resolve.
+*
+* The three answers are deliberately distinct, because they lead to different repairs:
+*
+*  - `available` — it loaded;
+*  - `failed` — something RESOLVED but loading it threw (the node-gyp build that exists and does not
+*    work: the case a bare `resolve()` check would report as healthy);
+*  - `missing` — nothing resolved anywhere.
+*
+* A root that cannot serve the specifier is not an error: the next candidate is tried, which is what
+* makes a garbage-collected store no worse than no self-heal. Never throws.
+*/
+async function moduleProbe(id, specifier, roots) {
+	const candidates = [];
+	for (const root of roots()) {
+		if (root === "") continue;
+		try {
+			candidates.push(createRequire(join(root, "package.json")).resolve(specifier));
+		} catch {}
+	}
+	try {
+		candidates.push(createRequire(import.meta.url).resolve(specifier));
+	} catch {}
+	if (candidates.length === 0) return "missing";
+	let resolvedButBroken = false;
+	for (const entry of candidates) try {
+		await import(pathToFileURL(entry).href);
+		return "available";
+	} catch {
+		resolvedButBroken = true;
+	}
+	return resolvedButBroken ? "failed" : "missing";
+}
+/**
+* Observe one runtime-deps ITEM's state through the caller's own lookup.
+*
+* The caller owns the mapping (its provisioner's `resolve` plus the "declared but not settled" gate),
+* so this probe adds nothing but a defensive boundary: a throwing lookup is `unknown`, not a failure
+* claim. `pending` is passed through because it is a MEANINGFUL state — an install in flight — and the
+* notice predicate treats it as "not reportable yet".
+*/
+function itemProbe(id, itemId, stateOf) {
+	return {
+		id,
+		check: async () => {
+			try {
+				return stateOf(itemId);
+			} catch {
+				return "unknown";
+			}
+		}
+	};
+}
+//#endregion
+//#region lib/types/runtime_deps_resource.js
+/**
+* The plugin's OWN dependency declaration: `res/runtime-deps.yaml`, read from the INSTALL directory.
+*
+* WHY A SHIPPED RESOURCE. The package set, the sources, the attempts, the verify list and the audit
+* sentences describe THIS BUILD — which module the local backend imports, which native bindings this
+* release looks for, what a session should be told when one of them is missing. Keeping them in a
+* user's `configs/common.yaml` made every deployment responsible for a list only the package can know
+* (and made a stale copy install a module no code loads). The operator keeps the one real policy
+* decision — the two `enabled` switches — and the DATA travels with the code that depends on it.
+*
+* WHERE IT IS READ FROM. `<package>/res/runtime-deps.yaml`, located from `import.meta.url`:
+* `lib/index.js` (bundled) and `src/*.ts` (tests, dev) are both one level below the package root, so
+* the same relative URL resolves to the SAME file in the checkout and in an installed tarball. It is
+* deliberately NOT resolved through `node_modules` lookups, `~/.avantf`, or the cwd: a host may mount
+* the plugin from a linked checkout, a global install or a packed tarball, and all three must read
+* their own copy.
+*
+* FAILURE IS EXPLICIT AND NON-FATAL. A missing/unreadable/malformed file is a PACKAGING bug, not an
+* environment one, so the answer is a structured failure with the path and the reason — never a
+* throw out of the mount and never a silent "no dependencies declared". The caller logs it as an
+* ERROR and degrades (no self-heal item, no audit): the plugin keeps its tools, service, prompt and
+* Remote face, and the runtime stays on its optional-dependency resolution.
+*
+* The base never sees this file: `envinit` maps the validated object onto the provider's own
+* `RuntimeDepsSpec` field by field (see `runtimeDepsSpecOf`).
+*/
+/**
+* `res/runtime-deps.yaml` next to the package that owns this module.
+*
+* `import.meta.url` is the anchor (not `process.cwd()`, not a config path): the file ships beside the
+* code, and an installed plugin must read the copy its own package manager put there.
+*/
+function runtimeDepsResourceUrl() {
+	return new URL("../res/runtime-deps.yaml", import.meta.url);
+}
+/** Reason text for a thrown value, without trusting it. */
+function reasonOf(error) {
+	try {
+		if (error instanceof Error && typeof error.message === "string" && error.message !== "") return error.message;
+		return String(error);
+	} catch {
+		return "unknown";
+	}
+}
+/**
+* Read and validate the shipped declaration.
+*
+* Synchronous on purpose: it is a few kilobytes next to the entry module, read once at mount, and the
+* caller's plan (the item specs and the audit entries) has to exist before anything is declared.
+*
+* `url` is injectable so a test can point at a scratch install directory; production always uses
+* {@link runtimeDepsResourceUrl}.
+*/
+function loadRuntimeDepsResource(url = runtimeDepsResourceUrl()) {
+	let path;
+	try {
+		path = fileURLToPath(url);
+	} catch (error) {
+		return {
+			ok: false,
+			path: String(url),
+			reason: `不是可读的文件 URL（${reasonOf(error)}）`
+		};
+	}
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (error) {
+		return {
+			ok: false,
+			path,
+			reason: `无法读取（${reasonOf(error)}）`
+		};
+	}
+	let raw;
+	try {
+		raw = parse(text);
+	} catch (error) {
+		return {
+			ok: false,
+			path,
+			reason: `YAML 解析失败（${reasonOf(error)}）`
+		};
+	}
+	if (raw === null || raw === void 0) return {
+		ok: false,
+		path,
+		reason: "文件是空的（没有任何声明）"
+	};
+	const parsed = RuntimeDepsResourceSchema.safeParse(raw);
+	if (!parsed.success) {
+		const issue = parsed.error.issues[0];
+		const where = issue === void 0 ? "" : `${issue.path.join(".") === "" ? "" : `${issue.path.join(".")}: `}`;
+		return {
+			ok: false,
+			path,
+			reason: `声明不符合 RuntimeDepsResourceSchema（${where}${issue?.message ?? "invalid"}）`
+		};
+	}
+	return {
+		ok: true,
+		path,
+		resource: parsed.data
+	};
+}
 const PACKAGE = "@avantf/dsh-plugin-base";
 function parseVersion(input) {
 	const match = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(input.trim());
@@ -19761,6 +20944,25 @@ function rangeOf(value) {
 *      models elsewhere (`AVANTF_MEM_MODEL_CACHE`) — that would install a second, never-read copy.
 *      A model that cannot be fetched is a WARNING: the semantic path degrades to FTS+entity, it
 *      never refuses the mount.
+*   3. **`mem:semantic-deps`** (`runtime-deps`, `startup: 'background'`) — optional: repair a missing
+*      `@huggingface/transformers` install through the base's shared runtime-dependency store. It is
+*      OFF unless `semantic.self_heal.enabled` says otherwise (that is a network decision, not a
+*      startup default), needs base >= 0.7.0 / interface v6 (the `createRuntimeDeps` helper), and is
+*      declared against the SAME content-addressed root any other family plugin would reuse. The
+*      item, the shared root handle and the operator's configured session notices all come from that
+*      one handle. The handle directory is handed back to the caller, which points the embedding
+*      backend at it before the semantic warm.
+*   4. **`mem:native-deps`** (`runtime-deps`, `startup: 'background'`) — optional: repair the NATIVE
+*      optional dependencies (`nodejieba`, `hnswlib-node`) when `semantic.native_self_heal.enabled`
+*      is on. A SEPARATE item on purpose: a different package set is a different content key, so the
+*      base's store gives it its own immutable root instead of mixing two node-gyp builds into the
+*      transformers install. The handle directory is handed back to the caller, which points the
+*      tokenizer and the vector store's ANN binding at it.
+*
+* Sessions are told about a missing package by NOTICES, and a notice is judged on two observations
+* that this module neither owns alone: the item's live state (below) and the startup dependency
+* audit's cached answer (`deps_audit.ts`, supplied in the plan). A repair that is still installing
+* matches nothing, and a failed repair whose package is loadable stays silent.
 *
 * Two hard rules:
 *
@@ -19783,6 +20985,26 @@ const PLUGIN = "mem";
 */
 const MODEL_ITEM = "mem:model";
 /**
+* The shared runtime-dependency item: `@huggingface/transformers` repaired through the base's
+* content-addressed store when `semantic.self_heal.enabled` is on. Same root as every other family
+* plugin's item for the same package set.
+*/
+const SEMANTIC_DEPS_ITEM = "mem:semantic-deps";
+/**
+* The NATIVE runtime-dependency item: `nodejieba` + `hnswlib-node`, repaired through the same base
+* mechanism when `semantic.native_self_heal.enabled` is on.
+*
+* A SEPARATE item, not a third package in {@link SEMANTIC_DEPS_ITEM}, for two reasons that both
+* matter:
+*
+*  - the store is content-addressed, so this spec's package set (two node-gyp builds) keys a
+*    DIFFERENT immutable root under `<home>/deps/runtime/` — these packages are never installed into
+*    the transformers root, and vice versa;
+*  - the two have independent failure modes and independent consequences (semantic leg vs.
+*    entity/jaccard legs vs. ANN index), so one install failing must not report the other as broken.
+*/
+const NATIVE_DEPS_ITEM = "mem:native-deps";
+/**
 * The default ONNX embedding repository — the one `semantic.local_model` defaults to and the one
 * {@link MODEL_FILES} describes. A DIFFERENT repo is a different file set, which is why the item
 * omits `spec.files` for it (see {@link managedModelSpec}).
@@ -19824,6 +21046,23 @@ const DEADLINE_MS = 15e3;
 * rather than ship the inversion.
 */
 const MODEL_REQUEST_TIMEOUT_MS = 3e5;
+/**
+* Per-attempt budget for the `mem:semantic-deps` install. A package-manager install of
+* transformers.js + onnxruntime-node is tens of MB; the base's 30 s network default would time out on
+* a slow link and report a failure the next attempt could have avoided. The item is `background`, so
+* this budget spends none of the startup allowance; it only bounds one attempt.
+*/
+const SEMANTIC_DEPS_ATTEMPT_TIMEOUT_MS = 6e5;
+/**
+* Per-attempt budget for the `mem:native-deps` install.
+*
+* Longer than the semantic one on purpose: `nodejieba` and `hnswlib-node` are node-gyp packages, so
+* the attempt includes downloading a toolchain-compatible source tree and COMPILING it — measured
+* minutes on a cold cache, and slower on a laptop that is also running the host. A budget that
+* expires mid-compile would report a failure the very next attempt (with the compiler cache warm)
+* would have avoided, and the item is `background`, so this spends no startup allowance.
+*/
+const NATIVE_DEPS_ATTEMPT_TIMEOUT_MS = 9e5;
 /** This module's warning token, so one grep finds every environment-initialisation line. */
 const OWN_PREFIX = "envinit:";
 /**
@@ -19858,6 +21097,104 @@ function sameDir(a, b) {
 	return resolve(expandHome$1(a)) === resolve(expandHome$1(b));
 }
 /**
+* The `runtime-deps` spec the base's shared store should own, or `undefined` when it should not.
+*
+* Refused when:
+*
+*   1. **self-heal is off** — the shipped default. Enabling it is a network decision the operator
+*      makes (`semantic.self_heal.enabled`), never a startup surprise.
+*   2. **the backend is not `local_bge`** — this item repairs the module the local ONNX adapter
+*      loads; a third-party backend owns its own dependencies.
+*   3. **no package was declared** — `spec.packages` must be non-empty (the base rejects an empty
+*      map); declaring nothing is cleaner than a guaranteed `invalid-option`.
+*
+* The config layers are copied field by field, not passed through: the schema's defaults include an
+* empty `cache` placeholder that has to become the family root here (`<home>/cache/npm`), because
+* the schema cannot know which family root the host will resolve. An explicitly configured cache is
+* `~`-expanded, exactly like every other path in this plugin.
+*/
+function managedSemanticDepsSpec(semantic, declaration, home) {
+	if (!semantic.self_heal.enabled) return void 0;
+	if (semantic.backend !== "local_bge") return void 0;
+	if (Object.keys(declaration.packages).length === 0) return void 0;
+	return runtimeDepsSpecOf(declaration, home);
+}
+/**
+* The `runtime-deps` spec for the NATIVE packages, or `undefined` when nothing should be declared.
+*
+* Refused only when `semantic.native_self_heal.enabled` is off or the package map is empty. There is
+* no backend condition here (unlike the semantic spec): the tokenizer and the vector store are used
+* by every backend, and a `vectorStore.backend: local_numpy` deployment still pays for `nodejieba`.
+*/
+function managedNativeDepsSpec(semantic, declaration, home) {
+	if (!semantic.native_self_heal.enabled) return void 0;
+	if (Object.keys(declaration.packages).length === 0) return void 0;
+	return runtimeDepsSpecOf(declaration, home);
+}
+/**
+* The shared shape of both `runtime-deps` specs: packages, sources, attempts, verify.
+*
+* One implementation, because the two sections use ONE provider vocabulary — a second copy of the
+* cache/`~` rules is how a private registry ends up working in one section and not the other. The
+* config layers are copied field by field, not passed through: the schema's defaults include an empty
+* `cache` placeholder that has to become the family root here (`<home>/cache/npm`), because the
+* schema cannot know which family root the host will resolve.
+*/
+function runtimeDepsSpecOf(heal, home) {
+	const packages = {};
+	for (const [name, range] of Object.entries(heal.packages)) packages[name] = range;
+	return {
+		packages,
+		sources: heal.sources.map((source) => {
+			const registry = source.registry.trim();
+			const configuredCache = source.cache.trim();
+			const cache = registry === "" && configuredCache === "" ? join(home, "cache", "npm") : configuredCache === "" ? "" : expandHome$1(configuredCache);
+			return {
+				id: source.id,
+				...registry === "" ? {} : { registry },
+				...cache === "" ? {} : { cache }
+			};
+		}),
+		attempts: heal.attempts.map((attempt) => ({
+			source: attempt.source,
+			...attempt.manager === void 0 ? {} : { manager: attempt.manager },
+			...Object.keys(attempt.env).length === 0 ? {} : { env: { ...attempt.env } },
+			...attempt.allowScripts === void 0 ? {} : { allowScripts: attempt.allowScripts }
+		})),
+		verify: [...heal.verify]
+	};
+}
+/**
+* The configured dependency-audit entries, copied field by field and resolved for execution.
+*
+* Why this is not part of a self-heal spec: the spec is what the base INSTALLS (and part of the shared
+* root's content key, so it has to be exactly the provider's vocabulary), while an audit entry is a
+* PROMPT line plus the observation behind it. Two consumers, two lifetimes — editing a sentence must
+* not look like a new dependency set.
+*
+* The entries are returned VERBATIM (text, severity, condition) and no default is invented: the
+* config's default is the empty array, so a profile that never wrote one gets no injection at all.
+* `min_vectors` is defaulted to `0` here, and to nothing else — this section names no package, so it
+* also invents no package-specific threshold.
+*/
+function managedDependencyAudit(audit) {
+	if (!Array.isArray(audit)) return [];
+	return audit.map((entry) => ({
+		id: entry.id,
+		severity: entry.severity,
+		when: entry.when,
+		minVectors: entry.min_vectors ?? 0,
+		body: entry.body,
+		probe: entry.kind === "module" ? {
+			kind: "module",
+			specifier: entry.specifier
+		} : {
+			kind: "runtime-deps",
+			item: entry.item
+		}
+	}));
+}
+/**
 * The family root: `$AVANTF_HOME`, else `~/.avantf/env`.
 *
 * `AVANTF_HOME` is the same variable the engine uses for its DATA home (`memory/`),
@@ -19947,6 +21284,121 @@ function modelItem(framework, model) {
 	};
 }
 /**
+* A `runtime-deps` item with the DELIVERY policy this plugin owns (the helper supplies only the
+* shape): both `onMissing` axes `degrade` — a failed install may not refuse the mount — `background`
+* (an install may take minutes and spends no startup budget), and the caller's per-attempt budget.
+*
+* `target.root: 'deps/runtime'` is the base's canonical store, already set by the helper. Two items
+* with different package sets are different content keys and therefore different immutable roots
+* inside it, which is what keeps `mem:semantic-deps` and `mem:native-deps` from sharing an install.
+*/
+function runtimeDepsItem(item, timeoutMs) {
+	return {
+		...item,
+		onMissing: {
+			atStartup: "degrade",
+			atUse: "degrade"
+		},
+		startup: "background",
+		policy: { timeoutMs }
+	};
+}
+/** The provisioner's five states in the audit's vocabulary. */
+function dependencyStateOf(state) {
+	switch (state?.state) {
+		case "ready": return "available";
+		case "failed": return "failed";
+		case "missing": return "missing";
+		case "skipped": return "skipped";
+		case "pending": return "pending";
+		default: return "unknown";
+	}
+}
+/**
+* Which observed audit state one configured `when` covers.
+*
+* The same word means the same thing for both probe KINDS, so one mapping serves both:
+* `failed` → a load that threw / an item that failed; `missing` → nothing resolved, or the item is
+* missing/skipped; `degraded` → any of those three. `available`, `pending` and `unknown` match
+* NOTHING: a background install still in flight and an unobserved entry are both "not reportable
+* yet", and a healthy dependency is not a finding.
+*/
+function matchesWhen(when, state) {
+	switch (when) {
+		case "failed": return state === "failed";
+		case "missing": return state === "missing" || state === "skipped";
+		case "degraded": return state === "failed" || state === "missing" || state === "skipped";
+	}
+}
+/**
+* Register one session notice per configured audit entry, judged on the AUDIT's cached state.
+*
+* The predicate is a pure read of two snapshots (`state()` is a map read, `vectors()` is the live
+* index count), so the prompt path never probes anything — the expensive half ran once at startup and
+* again on each settlement (`startDependencyAudit` / the `onSettled` path). A line is delivered when:
+*
+*  - the entry's recorded state matches the configured `when` (see {@link matchesWhen}), and
+*  - the live vector index has reached `minVectors` (0 = no threshold).
+*
+* Registration itself is total: the base registry warns and ignores a duplicate/malformed id, and an
+* id that is already taken costs one line, never the step.
+*/
+function registerDependencyNotices(input) {
+	for (const notice of input.notices) input.registry.register({
+		id: notice.id,
+		severity: notice.severity,
+		when: notice.when,
+		body: notice.body
+	}, () => matchesWhen(notice.when, input.audit.state(notice.id)) && input.audit.vectors() >= notice.minVectors);
+}
+/** Build the probes an audit entry needs — one per configured KIND, no package named here. */
+function probesOf(notices, roots, itemState) {
+	return notices.map((notice) => {
+		switch (notice.probe.kind) {
+			case "module": {
+				const { specifier } = notice.probe;
+				return {
+					id: notice.id,
+					check: () => moduleProbe(notice.id, specifier, roots)
+				};
+			}
+			case "runtime-deps": {
+				const { item } = notice.probe;
+				return itemProbe(notice.id, item, itemState);
+			}
+		}
+	});
+}
+/**
+* Whether the loaded base can serve the shared `runtime-deps` item AND observe it.
+*
+* Three members are required, and all three are one capability here: `RUNTIME_DEPS_KIND` /
+* `runtimeDepsProvider` (interface v5, base 0.6.0) install the root, and `createRuntimeDeps`
+* (interface v6, base 0.7.0) is what DECLARES the item and binds the notices to its state. Since the
+* item is now built by that helper, a base with the provider but not the helper cannot serve this
+* plugin at all — so the predicate answers the caller's real question ("may I declare, wait for and
+* translate this item?") instead of a narrower one that would let a half-wired declaration through.
+*
+* An OLDER generation does not normally reach this point — the interface gate withholds the whole
+* base first (`gateOrDegrade`), so the plugin takes its legacy path. This guard covers the remaining
+* shape: a module that reports a current generation but does not actually carry the members (a
+* partial/hostile module, or a packaging mistake). Enabling self-heal must then degrade to the
+* runtime's optional-dependency path, not throw from `declare`. It is also what lets the fake
+* framework in the tests exercise that degradation instead of a TypeError.
+*
+* Exported because the startup caller asks the same question: a skipped item will never settle, so
+* `startManagedResources` must not wait for it (see `packages/plugin/src/index.ts`). One predicate,
+* two readers — the loader's skip and the caller's "do not wait" can never disagree.
+*
+* `undefined` (the test seam's partial framework, or no module at all) answers `false`: nothing is
+* served, so nothing may be awaited.
+*/
+function supportsRuntimeDeps(framework) {
+	if (framework === void 0) return false;
+	const candidate = framework;
+	return typeof candidate.RUNTIME_DEPS_KIND === "string" && typeof candidate.runtimeDepsProvider === "function" && typeof candidate.createRuntimeDeps === "function";
+}
+/**
 * The plugin-specific halves of the shared loader's sentences: mem says the FRAMEWORK is skipped and
 * names the legacy provisioning path among the withheld capabilities. The mechanism is the shim's
 * (`interface_gate.ts`), the wording is this plugin's.
@@ -19980,6 +21432,8 @@ function loadEnvinit(options = {}) {
 /** The body of {@link loadEnvinit}; the cache above makes it run at most once per process. */
 async function loadOnce(options) {
 	const home = options.home ?? resolveHome();
+	const declaration = loadRuntimeDepsResource(options.depsResourceUrl);
+	if (!declaration.ok) options.log?.error(`${OWN_PREFIX} ERROR — ${declaration.path} is unusable (${declaration.reason}); self-heal and the startup dependency audit are SKIPPED for this run (the plugin mounts, and every optional dependency keeps its own fallback)`);
 	const range = await readDependencyRange(fileURLToPath(import.meta.url));
 	const autoDownload = options.autoDownload ?? envDownloadsAllowed();
 	const deadlineMs = options.deadlineMs ?? DEADLINE_MS;
@@ -20001,9 +21455,15 @@ async function loadOnce(options) {
 	try {
 		compat = runtimeFromCompat(options.compatModule ?? framework);
 	} catch (error) {
-		warn(options.log, `${OWN_PREFIX} WARNING — the ${COMPAT_PACKAGE} compatibility gate could not be initialised (${reasonOf(error)}); the compatibility gate is SKIPPED and the plugin will mount anyway`);
+		warn(options.log, `${OWN_PREFIX} WARNING — the ${COMPAT_PACKAGE} compatibility gate could not be initialised (${reasonOf$2(error)}); the compatibility gate is SKIPPED and the plugin will mount anyway`);
 	}
 	let disposed = false;
+	/** The shared `runtime-deps` handles: set when `provisionResources` declares each item. */
+	let deps;
+	let native;
+	/** The startup dependency audit and its notice registry; both exist once `provisionResources` ran. */
+	let audit;
+	let noticeRegistry;
 	return {
 		home,
 		kit: framework,
@@ -20012,40 +21472,148 @@ async function loadOnce(options) {
 			tools: join(home, "tools"),
 			models: join(home, "models")
 		},
-		provisionResources(plan, onSettled) {
+		runtimeDeps() {
+			return deps;
+		},
+		nativeDeps() {
+			return native;
+		},
+		depsResource() {
+			return declaration;
+		},
+		notices() {
+			return noticeRegistry;
+		},
+		async startDependencyAudit() {
+			if (audit === void 0) return;
+			try {
+				await audit.run();
+			} catch (error) {
+				warn(options.log, `${OWN_PREFIX} WARNING — the dependency audit failed (${reasonOf$2(error)}); notices stay silent`);
+			}
+		},
+		provisionResources(plan, onSettled, onFailure) {
 			if (disposed) return;
+			const canServe = supportsRuntimeDeps(framework);
+			const wantedDeps = plan.semanticDeps;
+			const wantedNative = plan.nativeDeps;
+			if (wantedDeps !== void 0 && !canServe) warn(options.log, `${OWN_PREFIX} WARNING — semantic self-heal is enabled but the loaded ${FRAMEWORK_PACKAGE} has no runtime-deps helper (it needs base >= 0.7.0 / interface v6); the item is SKIPPED and the plugin will mount anyway`);
+			if (wantedNative !== void 0 && !canServe) warn(options.log, `${OWN_PREFIX} WARNING — native self-heal is enabled but the loaded ${FRAMEWORK_PACKAGE} has no runtime-deps helper (it needs base >= 0.7.0 / interface v6); the item is SKIPPED and the plugin will mount anyway`);
 			const items = [];
 			if (plan.model !== void 0) items.push(modelItem(framework, plan.model));
-			if (items.length === 0) return;
+			/**
+			* Declare one shared item through the helper.
+			*
+			* The spec fields are forwarded verbatim (the helper copies them, so the content key cannot
+			* move under a mutating caller). Notices are NOT passed in: the helper's registry binds a line
+			* to its ITEM's state alone, while an audit entry may observe a package that no item
+			* of ours installs — so every notice is registered below, on one registry, from the audit.
+			*/
+			const declare = (itemId, spec, timeoutMs, label) => {
+				try {
+					const handle = framework.createRuntimeDeps({
+						namespace: PLUGIN,
+						itemId,
+						...spec
+					});
+					items.push(runtimeDepsItem(handle.item, timeoutMs));
+					return handle;
+				} catch (error) {
+					warn(options.log, `${OWN_PREFIX} WARNING — the shared ${label} runtime-deps item could not be declared (${reasonOf$2(error)}); self-heal for it is SKIPPED and the plugin will mount anyway`);
+					return;
+				}
+			};
+			if (wantedDeps !== void 0 && canServe) deps = declare(SEMANTIC_DEPS_ITEM, wantedDeps.spec, SEMANTIC_DEPS_ATTEMPT_TIMEOUT_MS, "semantic");
+			if (wantedNative !== void 0 && canServe) native = declare(NATIVE_DEPS_ITEM, wantedNative.spec, NATIVE_DEPS_ATTEMPT_TIMEOUT_MS, "native");
+			const handles = [deps, native].filter((handle) => handle !== void 0);
 			const maxItemTimeoutMs = items.reduce((max, item) => Math.max(max, item.policy?.timeoutMs ?? 0), 0);
-			const resources = framework.createProvisioner({
-				home,
-				envinitRange: range,
-				logger: provisionLogger(options.log),
-				policy: {
-					autoDownload: autoDownload ? { [framework.MODEL_CACHE_KIND]: plan.modelAutoDownload } : false,
-					deadlineMs: Math.max(deadlineMs, maxItemTimeoutMs),
-					mirrors: { archive: [...plan.archiveMirrors] }
+			/** The shared roots a module probe may resolve from, in declaration order (ready ones only). */
+			const roots = () => handles.map((handle) => handle.resolve()?.dir).filter((dir) => dir !== void 0 && dir !== "");
+			let resources;
+			if (items.length > 0) {
+				resources = framework.createProvisioner({
+					home,
+					envinitRange: range,
+					logger: provisionLogger(options.log),
+					policy: {
+						autoDownload: autoDownload ? {
+							[framework.MODEL_CACHE_KIND]: plan.modelAutoDownload,
+							...handles.length === 0 ? {} : { [framework.RUNTIME_DEPS_KIND]: true }
+						} : false,
+						deadlineMs: Math.max(deadlineMs, maxItemTimeoutMs),
+						mirrors: { archive: [...plan.archiveMirrors] }
+					}
+				});
+				resources.register(framework.binaryArchiveProvider());
+				resources.register(framework.modelCacheProvider());
+				if (handles.length > 0) resources.register(framework.runtimeDepsProvider());
+				resources.declare({
+					plugin: PLUGIN,
+					items
+				});
+				disposers.push(resources);
+			}
+			const inflight = new Set(items.map((item) => item.id));
+			const itemState = (id) => {
+				if (inflight.has(id)) return "pending";
+				if (resources === void 0) return "missing";
+				return dependencyStateOf(resources.resolve(id));
+			};
+			const notices = plan.dependencyAudit ?? [];
+			if (notices.length > 0) {
+				const createRegistry = framework.createSessionNotices;
+				if (typeof createRegistry !== "function") warn(options.log, `${OWN_PREFIX} WARNING — ${notices.length} dependency-audit entr(y/ies) are declared but the loaded ${FRAMEWORK_PACKAGE} has no session-notice registry (it needs base >= 0.7.0 / interface v6); no notice will be delivered`);
+				audit = createDependencyAudit({
+					probes: probesOf(notices, roots, itemState),
+					vectors: plan.vectorCount ?? (() => 0),
+					logger: {
+						info: (message) => {
+							options.log?.info(`${OWN_PREFIX} ${message}`);
+						},
+						warn: (message) => {
+							options.log?.warn(`${OWN_PREFIX} ${message}`);
+						}
+					}
+				});
+				if (typeof createRegistry === "function") {
+					noticeRegistry = createRegistry.call(framework, provisionLogger(options.log));
+					registerDependencyNotices({
+						registry: noticeRegistry,
+						notices,
+						audit
+					});
 				}
+			}
+			if (resources === void 0) return;
+			for (const handle of handles) handle.ensure(resources).catch((error) => {
+				warn(options.log, `${OWN_PREFIX} WARNING — the shared runtime-deps item could not be dispatched (${reasonOf$2(error)}); the plugin continues`);
 			});
-			resources.register(framework.binaryArchiveProvider());
-			resources.register(framework.modelCacheProvider());
-			resources.declare({
-				plugin: PLUGIN,
-				items
-			});
-			disposers.push(resources);
 			resources.ensure({
 				only: items.map((item) => item.id),
 				onSettled: (entry) => {
 					try {
-						onSettled(entry);
+						inflight.delete(entry.id);
+						const shared = handles.find((handle) => handle.item.id === entry.id)?.resolve();
+						const state = resources.resolve(entry.id);
+						onSettled(entry, shared !== void 0 ? shared.dir : state !== void 0 && state.state === "ready" ? state.handle.dir : void 0);
+						if (audit !== void 0) audit.run().catch((error) => {
+							warn(options.log, `${OWN_PREFIX} WARNING — the dependency audit after ${entry.id} failed (${reasonOf$2(error)})`);
+						});
 					} catch (error) {
-						warn(options.log, `${OWN_PREFIX} WARNING — the onSettled callback failed (${reasonOf(error)})`);
+						warn(options.log, `${OWN_PREFIX} WARNING — the onSettled callback failed (${reasonOf$2(error)})`);
 					}
 				}
 			}).catch((error) => {
-				warn(options.log, `${OWN_PREFIX} WARNING — declaring the background resources failed (${reasonOf(error)}); the plugin continues (tools stay registered)`);
+				warn(options.log, `${OWN_PREFIX} WARNING — declaring the background resources failed (${reasonOf$2(error)}); the plugin continues (tools stay registered)`);
+				inflight.clear();
+				if (audit !== void 0) audit.run().catch((auditError) => {
+					warn(options.log, `${OWN_PREFIX} WARNING — the dependency audit after a dispatch failure failed (${reasonOf$2(auditError)})`);
+				});
+				try {
+					onFailure?.(error);
+				} catch (callbackError) {
+					warn(options.log, `${OWN_PREFIX} WARNING — the onFailure callback failed (${reasonOf$2(callbackError)})`);
+				}
 			});
 		},
 		dispose() {
@@ -20190,7 +21758,7 @@ function tokenize(rawInput) {
 	return tokens;
 }
 function metadataDroppedLine(dropped) {
-	return "  metadata_dropped: timestamps=" + String(dropped.timestamps) + ", trust=" + String(dropped.trust) + ", assert_count=" + String(dropped.assert_count) + ", helpful_count=" + String(dropped.helpful_count) + ", pinned=" + String(dropped.pinned) + ", supersedes=" + String(dropped.supersedes);
+	return "  metadata_dropped: timestamps=" + String(dropped.timestamps) + ", trust=" + String(dropped.trust) + ", assert_count=" + String(dropped.assert_count) + ", helpful_count=" + String(dropped.helpful_count) + ", pinned=" + String(dropped.pinned) + ", supersedes=" + String(dropped.supersedes) + ", ttl_days=" + String(dropped.ttl_days) + ", valid_to=" + String(dropped.valid_to);
 }
 /** Failures are rendered in full up to {@link FAILURES_SHOWN}; the rest is a count, never silence. */
 const FAILURES_SHOWN = 5;
@@ -20682,6 +22250,26 @@ function degradedLegNote(value) {
 	const result = value?.result;
 	return result !== null && typeof result === "object" && result.degraded === true ? DEGRADED_LEG_NOTE : void 0;
 }
+/**
+* The paging sentence of a PURE TIME window (`mode:"time"`, RECALL_INTERFACE §2.4), as one line the
+* model can read without doing arithmetic: 「共 N 条，已显示 M 条，还有 K 条未显示」.
+*
+* The fields it spells out (`total` / `hits.length` / `remaining`) are already in the JSON block; the
+* sentence exists because a page of 50 out of a 286-row day otherwise looks like the whole day unless
+* the reader stops to compare four numbers. Emitted ONLY when something is left unseen — a window that
+* fits on its page needs no note, and `remaining` is 0 exactly then.
+*
+* Same rules as {@link degradedLegNote}: a SECOND block, appended after the parseable JSON one, and
+* absent whenever the payload is not a time result (including older hosts, which send no `remaining`).
+*/
+function timePageNote(value) {
+	const result = value?.result;
+	if (result === null || typeof result !== "object" || result.mode !== "time") return void 0;
+	const { total, remaining, hits } = result;
+	if (typeof total !== "number" || typeof remaining !== "number" || remaining <= 0) return void 0;
+	if (!Array.isArray(hits)) return void 0;
+	return `时间窗口共 ${String(total)} 条，已显示 ${String(hits.length)} 条，还有 ${String(remaining)} 条未显示。`;
+}
 /** The tool output spec registered on every mem tool. */
 const OUTPUT = {
 	schema: {
@@ -20693,10 +22281,15 @@ const OUTPUT = {
 			type: "text",
 			text: JSON.stringify(toWellFormedDeep(value), null, 2)
 		}];
-		const note = degradedLegNote(value);
-		if (note !== void 0) blocks.push({
+		const degraded = degradedLegNote(value);
+		if (degraded !== void 0) blocks.push({
+			type: "text",
+			text: degraded
+		});
+		const paging = timePageNote(value);
+		if (paging !== void 0) blocks.push({
 			type: "text",
-			text: note
+			text: paging
 		});
 		return blocks;
 	}
@@ -20954,6 +22547,22 @@ function hostLogger(ctx) {
 	};
 }
 /**
+* The host's agent registry (`ctx.agents`), read defensively.
+*
+* It is the one place this plugin learns whether a session is a top-level (owner) agent or a
+* worker/subagent, and that decision only decides whether a session NOTICE is delivered. The read is
+* deliberately structural ({@link isOwnerSession} takes `unknown`): a host may not load the agent
+* registry at all, and `agent/pre-step` itself is emitted by the agent loop, so an absent registry is
+* "cannot tell" — never a reason to throw on the prompt path.
+*/
+function agentRegistry(ctx) {
+	try {
+		return ctx.agents;
+	} catch {
+		return;
+	}
+}
+/**
 * Declare the expensive resources through the family framework, warm the tokenizer and the embedding
 * model, and continue initialisation as each item settles.
 *
@@ -20970,12 +22579,37 @@ function hostLogger(ctx) {
 * — `managedModelSpec` decides): the framework's root would then collect a copy nothing reads. In
 * that case, and whenever no item will warm the model, the warm is started here directly.
 *
+* **Optional dependency repair.** `mem:semantic-deps` (shared `runtime-deps` store) is declared only
+* when `semantic.self_heal.enabled` is on (`managedSemanticDepsSpec` decides). When it is present, the
+* semantic warm waits for BOTH items: the shared root has to exist before the backend chooses it, and
+* the model files have to be on disk before the pipeline opens them. On success the handle directory
+* is handed to the backend (`useSemanticModuleDir`) so the import comes from the verified shared root;
+* on failure the backend keeps its own optional-dependency resolution.
+*
+* SESSION NOTICES are NOT carried by these handles: they are the `audit` entries of the plugin's own
+* `res/runtime-deps.yaml`, registered on one registry (`env.notices()`) whose predicates read the
+* startup dependency audit's cached state (`deps_audit.ts`). That is why a repair that is still
+* installing cannot be reported as a failure, and why an entry about a PACKAGE (rather than an item)
+* can be delivered at all.
+*
+* **NATIVE optional dependency repair.** `mem:native-deps` (a SEPARATE `runtime-deps` item: different
+* package set ⇒ different content-addressed root) repairs `nodejieba` and `hnswlib-node` when
+* `semantic.native_self_heal.enabled` is on. When it is present the TOKENIZER warm is deferred to its
+* settlement: the dictionary parse (~1 s, synchronous) has to happen once, from the root the process
+* will actually use, not from a tree that is about to be superseded. On success both module roots are
+* handed to their loaders (`useTokenizerModuleDir`, `MemoryStore.useNativeModuleDir`).
+*
 * Outcomes handled below:
 *
 *   - `mem:model` settles (present/installed) → warm the semantic path from the managed root, now
 *     that the files are on disk. That ordering is the whole point: the runtime's constructor warm is
 *     deferred while the framework is up (`deferWarm`), so nothing can race the install, and the
 *     explicit warm here is what starts the model.
+*   - `mem:semantic-deps` settles (present/installed) → point the backend at the shared root, then
+*     warm. failed/skipped → keep the optional path and still warm. Either way the package's audit
+*     entry is refreshed, because the notice's other half is "is it loadable NOW".
+*   - `mem:native-deps` settles → hand both module roots over, refresh the two native audit entries,
+*     then warm the tokenizer (or retry it, when an earlier lazy write already failed).
 *   - `mem:model` failed/skipped → one WARNING, then STILL warm: with `semantic.auto_download` on the
 *     runtime takes its own download path, and with it off the semantic leg degrades to FTS+entity.
 *     Either way the mount is untouched.
@@ -20989,20 +22623,65 @@ function hostLogger(ctx) {
 function startManagedResources(env, rt, logger, waitFor) {
 	const { semantic, tools } = rt.config.common;
 	const model = managedModelSpec(semantic, env.roots.models);
+	const loaded = env.depsResource();
+	const spec = loaded.ok ? loaded.resource : void 0;
+	const depsSpec = spec === void 0 ? void 0 : managedSemanticDepsSpec(semantic, spec.semantic, env.home);
+	const semanticDeps = depsSpec === void 0 ? void 0 : { spec: depsSpec };
+	const nativeSpec = spec === void 0 ? void 0 : managedNativeDepsSpec(semantic, spec.native, env.home);
+	const nativeDeps = nativeSpec === void 0 ? void 0 : { spec: nativeSpec };
 	const plan = {
 		archiveMirrors: tools.mirror,
 		modelAutoDownload: semantic.auto_download,
-		model
+		model,
+		semanticDeps,
+		nativeDeps,
+		dependencyAudit: managedDependencyAudit(spec?.audit),
+		vectorCount: () => rt.memory.liveVectorCount()
+	};
+	const waitsForNative = nativeDeps !== void 0 && supportsRuntimeDeps(env.kit);
+	let tokenizerWarmStarted = false;
+	const warmTokenizer = () => {
+		if (tokenizerWarmStarted) return;
+		tokenizerWarmStarted = true;
+		warmTokenizerAsync(rt, { ...waitFor === void 0 ? {} : { waitFor } });
+	};
+	if (!waitsForNative) warmTokenizer();
+	const pending = /* @__PURE__ */ new Set();
+	if (model !== void 0) pending.add(MODEL_ITEM);
+	if (semanticDeps !== void 0 && supportsRuntimeDeps(env.kit)) pending.add(SEMANTIC_DEPS_ITEM);
+	const warmOnce = () => {
+		if (pending.size === 0) warmSemanticAsync(rt);
 	};
-	warmTokenizerAsync(rt, { ...waitFor === void 0 ? {} : { waitFor } });
-	if (model === void 0 && semantic.backend === "local_bge") warmSemanticAsync(rt);
-	env.provisionResources(plan, (entry) => {
-		if (entry.id === "mem:model") warmSemanticAsync(rt);
+	if (pending.size === 0 && semantic.backend === "local_bge") warmSemanticAsync(rt);
+	env.provisionResources(plan, (entry, handleDir) => {
+		if (entry.id === "mem:model" || entry.id === "mem:semantic-deps") {
+			if (entry.id === "mem:semantic-deps" && handleDir !== void 0) {
+				rt.memory.useSemanticModuleDir(handleDir);
+				logger.info(`envinit: semantic deps root ${handleDir}`);
+			}
+			pending.delete(entry.id);
+			warmOnce();
+		}
+		if (entry.id === "mem:native-deps") {
+			if (handleDir !== void 0) {
+				useTokenizerModuleDir(handleDir);
+				rt.memory.useNativeModuleDir(handleDir);
+				logger.info(`envinit: native deps root ${handleDir}`);
+			}
+			warmTokenizer();
+		}
 		if (entry.action === "failed" || entry.action === "skipped") {
 			logger.warn(`envinit: ${entry.id} is ${entry.action} (${String(entry.code)}${entry.reason === void 0 ? "" : ` — ${entry.reason}`})`);
+			if (entry.id === "mem:semantic-deps") logger.warn("envinit: semantic self-heal did not complete — the runtime keeps its own optional-dependency resolution, and retrieval degrades to FTS+entity if that is absent too");
+			if (entry.id === "mem:native-deps") logger.warn("envinit: native self-heal did not complete — the runtime keeps its own optional-dependency resolution; entity/triple extraction falls back to the regex path and the vector store stays brute-force");
 			return;
 		}
 		logger.info(`envinit: ${entry.id} ${entry.action} (${entry.source}${entry.version === void 0 ? "" : ` ${entry.version}`})`);
+	}, (error) => {
+		logger.warn(`envinit: dispatching the background resources failed (${describeError$1(error)}); warming from the runtime's own paths`);
+		pending.clear();
+		warmOnce();
+		warmTokenizer();
 	});
 }
 async function apply(ctx, config) {
@@ -21130,7 +22809,7 @@ async function apply(ctx, config) {
 	}
 	for (const warning of promptTextWarnings(promptSections)) logger.warn(`prompt text: ${warning}`);
 	logger.info(`prompt files: ${promptDir} (${loadedPrompts.map((entry) => `${entry.file}:${entry.source}`).join(", ")})`);
-	ctx.on("agent/pre-step", async ({ signal }, next) => {
+	ctx.on("agent/pre-step", async ({ agent, signal }, next) => {
 		const decision = await next();
 		if (decision.kind === "reject" || signal.aborted) return decision;
 		const text = freshUserText(decision.messages);
@@ -21141,18 +22820,22 @@ async function apply(ctx, config) {
 		} catch {
 			hit = false;
 		}
-		if (!hit) return decision;
+		const sessionId = String(agent.id);
+		const owner = isOwnerSession(agentRegistry(ctx), sessionId);
+		const notices = noticeLines(env?.notices(), sessionId, owner);
+		const injection = stepInjection(hit, notices);
+		if (injection === "") return decision;
 		return {
 			...decision,
 			messages: [...decision.messages, createUserMessage({
 				content: [{
 					type: "text",
-					text: RELEVANCE_HINT
+					text: injection
 				}],
 				source: {
 					kind: "mem-hint",
 					form: "notice",
-					summary: RELEVANCE_HINT
+					summary: injection
 				}
 			})]
 		};
@@ -21179,6 +22862,7 @@ async function apply(ctx, config) {
 		log: logger,
 		compat
 	});
+	env?.startDependencyAudit();
 	ctx.effect(() => async () => {
 		logger.info("plugin unmount: disposing runtime (closing databases)");
 		await rt.shutdown();