@avantf/dsh-mem 0.9.0 → 0.10.0

package/lib/engine/mem/db/dao/facts.d.ts

@@ -2,12 +2,13 @@
  * `facts` — the memory store's main table.
  *
  * Started with the READ paths the detector, the diagnostics and the clock self-heal need;
- * the write path (`persistFact`, archive/restore/feedback, vector repair) moves here next, so
+ * the write path (`persistFact`, archive/restore, vector repair) moves here next, so
  * the store ends up holding business rules only and no SQL. See DESIGN §19.
  */
 import type { Db } from '../port.js';
 import { type TimeRange, type TimeSql } from '../../store/time_filter.js';
 import type { MemoryKind } from '../../../mem-contract/index.js';
+import { type TrustCurve } from '../../../mem-contract/index.js';
 /**
  * Every `facts` column EXCEPT the two BLOBs (`hrr_vector` ~8 KB, `semantic_vector` ~2 KB per row)
  * and the two DEPRECATED provenance columns (`mirror_source` / `mirror_target`, see below).
@@ -28,7 +29,7 @@ import type { MemoryKind } from '../../../mem-contract/index.js';
  * `test/db_lifecycle.spec.ts` asserts this list against `PRAGMA table_info(facts)` MINUS those
  * two deprecations, so a new column fails a test instead of silently vanishing from these reads.
  */
-export declare const FACT_COLUMNS_NO_BLOB = "fact_id, content, kind, title, tags, trust_score, settle_clock,\n    pinned, pinned_at, bonus_count, bonus_window_at, last_reinforced_at, archived_clock,\n    retrieval_count, helpful_count, last_retrieved_at, embedding_model, vector_store, status,\n    supersedes_id, entities_version, conflict_checked, archived_at, archive_reason, ttl_days,\n    valid_from, valid_to, valid_from_ms, valid_to_ms, assert_count, created_at, updated_at";
+export declare const FACT_COLUMNS_NO_BLOB = "fact_id, content, kind, title, tags, trust_score, settle_clock,\n    pinned, pinned_at, bonus_count, bonus_window_at, last_reinforced_at, archived_clock,\n    retrieval_count, helpful_count, last_retrieved_at, embedding_model, vector_store, status,\n    supersedes_id, entities_version, conflict_checked, archived_at, archive_reason, ttl_days,\n    valid_from, valid_from_ms, assert_count, created_at, updated_at";
 export declare const FTS_SEARCH_SQL: string;
 /**
  * {@link FTS_SEARCH_SQL} with the P-08 source predicate, as a SEPARATE statement rather than one
@@ -191,7 +192,6 @@ export declare class FactsDao {
         created_at: string;
         updated_at: string | null;
         valid_from: string | null;
-        valid_to: string | null;
         title: string | null;
     }>;
     /** Active rows that carry a persisted vector (index classification). */
@@ -233,14 +233,16 @@ export declare class FactsDao {
      * `createdAt` is named EXPLICITLY rather than left to the column DEFAULT, because a
      * superseding revision must INHERIT the archived row's `created_at` (the memory's first
      * assertion date, distinct from when its text was rewritten). `updated_at` and
-     * `last_retrieved_at` are stamped `CURRENT_TIMESTAMP` in the same statement: a revision
-     * whose `created_at` is old must not be judged idle by the next tick, where "idle" reads
-     * `COALESCE(last_retrieved_at, created_at)`.
+     * `last_retrieved_at` are stamped `CURRENT_TIMESTAMP` in the same statement, so a revision
+     * carries a fresh "last used" observation like the row it replaces (that column no longer
+     * feeds any decision — see TRUST_MODEL.md §2.6).
+     *
+     * `ttl_days` is NOT named: TTL is gone (v2), the column keeps its DEFAULT 0 and nothing
+     * reads or writes it any more.
      */
     insertRevision(v: {
         content: string;
         kind: MemoryKind;
-        ttlDays: number;
         supersedesId: number | null;
         hrr: Uint8Array;
         trust: number;
@@ -256,37 +258,32 @@ export declare class FactsDao {
          */
         title?: string | null;
         /**
-         * P-13: the caller's event time / known end, written straight onto the new row. `null` means
-         * "unknown" and is what an omitted argument leaves (the column has no default on purpose).
+         * P-13: the caller's event time, written straight onto the new row. `null` means "unknown" and
+         * is what an omitted argument leaves (the column has no default on purpose).
          * `assert_count` is deliberately NOT named: the column default (1) is the semantics — "this
          * content has been asserted once" — and naming it here would be a second place to keep in step.
          */
         validFrom?: string | null;
-        validTo?: string | null;
         /**
-         * The INSTANTS the two text bounds name (`valid_from_ms`/`valid_to_ms`).
+         * The INSTANT the text bound names (`valid_from_ms`).
          *
          * Written in the same statement as the text, never computed later: the text is what a reader
          * displays and the epoch is what an `event` window compares, so writing them apart would let the
          * two describe different times. `null` = "no event time" (the axis then excludes the row, D5).
          */
         validFromMs?: number | null;
-        validToMs?: number | null;
     }): {
         changes: number;
         lastInsertRowid: number | bigint;
     };
     /**
-     * P-10: land an explicitly given validity on a row that already exists (a duplicate `add` whose
-     * caller named `event_date` / `valid_until`). Omitted arguments keep what the row has, exactly
-     * like `kind`/`ttl_days` (see `add`'s doc).
+     * P-10: land an explicitly given event time on a row that already exists (a duplicate `add`
+     * whose caller named `event_date`). An omitted argument keeps what the row has, exactly like
+     * `kind` (see `add`'s doc).
      */
     applyValidity(factId: number, validFrom: {
         text: string;
         ms: number;
-    } | undefined, validTo: {
-        text: string;
-        ms: number;
     } | undefined): void;
     /** P-10: the row's assertion counter (`1` when the column is somehow NULL on a legacy row). */
     assertCount(factId: number): number;
@@ -299,12 +296,6 @@ export declare class FactsDao {
      * two processes cannot interleave between them.
      */
     incrementAssertCount(factId: number): number;
-    /**
-     * P-07 audit: stamp `valid_to` on a row that is leaving the active corpus (supersede / a
-     * contradiction verdict). `COALESCE` keeps an end the caller already declared (`valid_until`):
-     * overwriting it with the archival instant would replace a real answer with an administrative one.
-     */
-    markValidTo(factId: number, at: string, atMs?: number | null): void;
     /**
      * P-07: "who superseded this fact", derived from the existing `supersedes_id` link — no
      * redundant column. `MIN` is deterministic when several revisions named the same predecessor
@@ -418,10 +409,15 @@ export declare class FactsDao {
      * reported zero behind. Same rule as {@link setSemanticVector}: what the check SAW changed.
      */
     requeueConflictCheck(ids: readonly number[]): number;
-    /** Revive an archived row (R18/R19: refresh the idle clock, clear the archive bookkeeping). */
-    revive(factId: number, kind: MemoryKind, ttlDays: number, trust: number, clock: number): number;
-    /** Land explicit kind/TTL on a row that already exists (pure duplicate). */
-    applyValues(factId: number, kind: MemoryKind, ttlDays: number): void;
+    /**
+     * Revive an archived row (R19: clear the archive bookkeeping / refresh `last_retrieved_at`).
+     *
+     * `ttl_days` is deliberately NOT named any more: an omitted column keeps whatever the row has
+     * (the old writing value is preserved as data), and there is no TTL left to inherit.
+     */
+    revive(factId: number, kind: MemoryKind, trust: number, clock: number): number;
+    /** Land an explicit kind on a row that already exists (pure duplicate). */
+    applyValues(factId: number, kind: MemoryKind): void;
     /**
      * Land a title on a row that already exists — the ONE write behind every "backfill" path
      * (JOURNAL_TITLE_SEARCH §11.2/§11.3): a duplicate `add` that names a title for an existing
@@ -478,22 +474,14 @@ export declare class FactsDao {
     archiveSuperseded(factId: number, clock: number): number;
     linkSupersede(factId: number, supersedesId: number): void;
     /**
-     * Restore an archived fact, settling its trust and refreshing the idle clock (spec §2.6).
+     * Restore an archived fact, settling its trust and refreshing `last_retrieved_at` (spec §2.6).
      *
      * `AND status = 'archived'` is load-bearing, like the guard on every sibling above: this UPDATE
      * clears the archive bookkeeping and refreshes `last_retrieved_at`, so ungated it would take an
-     * ACTIVE row and (a) push its idle clock forward — silently extending the life of a fact the next
-     * tick was about to re-archive — and (b) reset `trust_score` to the settled value it computed. It
-     * returned `1` either way, so the caller could not tell that a row it never asked about had moved.
+     * ACTIVE row and reset `trust_score` to the settled value it computed. It returned `1` either
+     * way, so the caller could not tell that a row it never asked about had moved.
      */
     restore(factId: number, trust: number, clock: number): number;
-    bumpHelpful(factId: number, delta: number): void;
-    /** Feedback outcome: pin at the permanent threshold (trust snaps to 1). */
-    pinOutcome(factId: number, clock: number, bonusCount: number, windowAt: string): void;
-    /** Feedback outcome: the forget line was reached — archive in the same statement. */
-    forgetOutcome(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): void;
-    /** Feedback outcome: reinforced (or decayed) but still active. */
-    reinforceOutcome(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): void;
     pin(factId: number, clock: number): number;
     unpin(factId: number, clock: number): number;
     /**
@@ -534,13 +522,24 @@ export declare class FactsDao {
     /** ACTIVE and permanent — pinned facts are exempt from decay (the report's `pinned`). */
     countPinnedActive(): number;
     /**
-     * ACTIVE facts whose decayed trust would reach zero within `withinDays` ACTIVE days —
-     * i.e. `trust_score - step × (clock - settle_clock) <= step × withinDays`.
+     * ACTIVE, unpinned facts whose decayed trust reaches zero within `withinDays` ACTIVE days.
+     *
+     * EXACT for every shape, not a linear approximation: the predicate is
+     * `trustAfterDays(eff(now), withinDays, curve) <= 0`, which is the same question the tick asks
+     * when it archives a row. The caller passes the THRESHOLD (`ceilingForDays(withinDays, curve)`)
+     * because "days until zero" is no longer `trust ÷ slope` under `decay_shape: 'accelerating'`;
+     * a slope-based SQL predicate under-reported every fact in `(slope × 7, ceilingForDays(7)]`
+     * (0.0277 … 0.0515 at the shipped defaults) once accelerating became the default.
+     *
+     * COST: one row per active unpinned fact, evaluated in JS — the predicate needs `exp`, which the
+     * SQL layer cannot express portably. `trust_diagnose` is an operator-only diagnostic and the
+     * active set is what `mem_admin list` already walks; if it ever shows up in a profile, prefilter
+     * with an index-friendly bound rather than going back to a slope approximation.
      */
     countForgettingWithin(p: {
-        step: number;
+        threshold: number;
         clock: number;
-        withinDays: number;
+        curve: TrustCurve;
     }): number;
     /** Facts with a still-live (calendar 24h) reinforcement window — the per-fact quota. */
     /**
@@ -555,18 +554,15 @@ export declare class FactsDao {
         count: number;
         granted: number;
     };
-    /** ACTIVE, unpinned facts unused for `days` CALENDAR days (the idle-archival fallback). */
-    countIdleCandidates(days: number): number;
     /**
-     * Rows still due for ②③④ after a budgeted tick — what the NEXT pass will archive.
+     * Rows still due for ② after a budgeted tick — what the NEXT pass will archive.
      *
-     * One statement over the three predicates (they are alternatives, and the sets are disjoint:
-     * a row has either a TTL, a forgotten trust score, or an idle clock). Only called when a step
-     * actually filled its budget, so the common tick pays nothing for it.
+     * The same predicate the archival statement runs (`FORGET_PREDICATE`), so "backlog" and "what
+     * `archiveForgotten` will do next" cannot disagree. Only called when ② actually filled its
+     * budget, so the common tick pays nothing for it.
      */
     countArchiveBacklog(p: {
         forgetThreshold: number;
-        idleCalendarDays: number;
     }): number;
     /**
      * Drop unusable (stale-dim) vectors so a re-encode can replace them — and re-queue the same
@@ -753,35 +749,50 @@ export declare class FactsDao {
      * row, and `settle_clock < c` is a seek + range scan of exactly the pending rows.
      */
     private static readonly SETTLE_PREDICATE;
-    /** ① materialize decay, bounded to `budget` rows. */
+    /**
+     * The ONE forgetting predicate, shared by the archival statement and its backlog count.
+     *
+     * Kept as a constant for the same reason as {@link SETTLE_PREDICATE}: the count answers "how many
+     * will the next pass archive", so it must be the same WHERE body the archival itself runs —
+     * otherwise `archived_deferred` and the actual sweep would drift apart.
+     */
+    private static readonly FORGET_PREDICATE;
+    /**
+     * ① materialize decay, bounded to `budget` rows.
+     *
+     * PER ROW, through `trustAfterDays` — not one UPDATE with an inline `trust_score − step·Δ`. The
+     * formula lives in `contract/src/trust_curve.ts` and nowhere else; the `linear` branch of that
+     * function is bit-identical to the statement this replaced (`T − days·slope`, the same two
+     * operations in the same order), so P3's equivalent tier materializes exactly the same numbers.
+     *
+     * The SELECT is the old UPDATE's WHERE body with the old subquery's ORDER/LIMIT, so the row SET is
+     * the same one the statement would have touched (and `settled` still counts rows matched, not rows
+     * whose value happened to move).
+     *
+     * COST: one `UPDATE` PER ROW inside the tick's single `IMMEDIATE` transaction (the accelerating
+     * formula needs `exp`, which SQL cannot express here, and a second SQL implementation would
+     * drift). That is why every caller is budgeted by `trust.tick_max_facts` (5000 by default) and
+     * `admin maintenance` is the only unbudgeted pass — measured ~22 ms per 5000 rows, inside the
+     * tick's budget; it is a deliberate trade, not a regression.
+     */
     settleBudgeted(p: {
-        step: number;
+        curve: TrustCurve;
         clock: number;
         budget: number;
     }): number;
     /** ① materialize decay for every pending row (no budget). */
     settleAll(p: {
-        step: number;
+        curve: TrustCurve;
         clock: number;
     }): number;
+    /** The shared per-row write of ①: settle the curve at `clock`, then stamp `settle_clock`. */
+    private settleRows;
     /** Rows still awaiting ① (the budget ran out). */
     countPendingSettle(p: {
         clock: number;
     }): number;
     /**
-     * ② calendar TTL — explicit instruction, so `pinned` is NOT exempt.
-     *
-     * `budget` (0 = none) caps how many rows ONE tick may archive: the tick is a single IMMEDIATE
-     * transaction shared by several processes, so an unbudgeted pass over a large backlog held the
-     * write lock for as long as it took (measured 14400 rows in one tick). The remainder stays due
-     * and is reported as a deferred count, then archived by the next tick.
-     */
-    archiveExpiredByTtl(p: {
-        clock: number;
-        budget?: number;
-    }): number[];
-    /**
-     * ③ trust-driven forgetting (① already clamped trust to the threshold).
+     * ② trust-driven forgetting (① already clamped trust to the threshold).
      *
      * Sargable as written (`status`/`pinned` equality + `trust_score <= ?`), and served by
      * `idx_facts_forget(status, pinned, trust_score)`: before that index this statement read every
@@ -793,20 +804,7 @@ export declare class FactsDao {
         budget?: number;
     }): number[];
     /**
-     * ④ calendar fallback: never touched for `idle_calendar_days`.
-     *
-     * The comparison is written as `<expression> < julianday('now', :modifier)` — the same
-     * expression `idx_facts_idle_cutoff` indexes — so it is a range seek. The old form
-     * (`julianday('now') - <expression> > :days`) called `julianday` on EVERY active row and could
-     * not use any index (measured 33–212 ms at 180k).
-     */
-    archiveIdle(p: {
-        clock: number;
-        idleCalendarDays: number;
-        budget?: number;
-    }): number[];
-    /**
-     * ⑤ physical delete of archived rows past the retention window.
+     * ③ physical delete of archived rows past the retention window.
      *
      * TWO statements in this order, sharing one predicate:
      *
@@ -815,7 +813,7 @@ export declare class FactsDao {
      *      DELETE below failed with `SQLITE_CONSTRAINT_FOREIGNKEY` whenever a revision chain
      *      crossed `purge_after_archived_days`. Because the whole tick is ONE transaction and it
      *      runs from the store's constructor, that failure did not merely skip the purge: it rolled
-     *      back settle/TTL/idle with it and left the process unable to start, permanently.
+     *      back settle/forget with it and left the process unable to start, permanently.
      *   2. delete them.
      *
      * The predicate is built once and interpolated into both statements, so "which rows are
@@ -832,7 +830,7 @@ export declare class FactsDao {
     /** The two mutually exclusive purge branches (see `purgeArchived` for why they are split). */
     private static purgeBranches;
     private static purgeParams;
-    /** Archived rows still due for ⑤ after a budgeted pass (0 when the pass finished them). */
+    /** Archived rows still due for ③ after a budgeted pass (0 when the pass finished them). */
     countPurgeBacklog(p: {
         clock: number;
         enabled: number;

package/lib/engine/mem/dbdrivers/sqlite/facts.d.ts

@@ -8,7 +8,7 @@
  *
  * @module dbdrivers/sqlite/facts
  */
-import type { MemoryKind } from '../../../mem-contract/index.js';
+import type { MemoryKind, TrustCurve } from '../../../mem-contract/index.js';
 import { type TimeRange } from '../../store/time_filter.js';
 import type { FactHitMeta, FactRow, FactVectorRow, FactVectorSpaceRow, HrrVectorRow, InsertRevisionOutcome, MemoryRepository } from '../../interfaces/repositories.js';
 import type { FactsDao } from './dao/index.js';
@@ -31,14 +31,12 @@ export declare class SqliteMemoryRepository implements MemoryRepository {
     countInStatus(status: string, kind?: MemoryKind, source?: string): number;
     countActiveWithValidFrom(): number;
     countForgettingWithin(p: {
-        step: number;
+        threshold: number;
         clock: number;
-        withinDays: number;
+        curve: TrustCurve;
     }): number;
-    countIdleCandidates(days: number): number;
     countArchiveBacklog(p: {
         forgetThreshold: number;
-        idleCalendarDays: number;
     }): number;
     countPendingConflicts(): number;
     countStaleEntities(version: number): number;
@@ -86,25 +84,20 @@ export declare class SqliteMemoryRepository implements MemoryRepository {
     hrrRowsForFacts(ids: readonly number[], kind?: MemoryKind, source?: string): HrrVectorRow[];
     activeIdsIn(ids: readonly number[], kind?: MemoryKind, source?: string, time?: TimeRange): number[];
     insertRevision(v: Parameters<FactsDao['insertRevision']>[0]): InsertRevisionOutcome;
-    applyValidity(factId: number, validFrom: Parameters<FactsDao['applyValidity']>[1], validTo: Parameters<FactsDao['applyValidity']>[2]): void;
-    applyValues(factId: number, kind: MemoryKind, ttlDays: number): void;
+    applyValidity(factId: number, validFrom: Parameters<FactsDao['applyValidity']>[1]): void;
+    applyValues(factId: number, kind: MemoryKind): void;
     setTitle(factId: number, title: string): void;
     insertTitleAlias(factId: number, title: string): void;
     copyTitleAliases(fromFactId: number, toFactId: number, currentTitle: string): void;
     dropTitleAlias(factId: number, title: string): void;
     incrementAssertCount(factId: number): number;
-    markValidTo(factId: number, at: string, atMs?: number | null): void;
     linkSupersede(factId: number, supersedesId: number): void;
     archiveSuperseded(factId: number, clock: number): number;
-    revive(factId: number, kind: MemoryKind, ttlDays: number, trust: number, clock: number): number;
+    revive(factId: number, kind: MemoryKind, trust: number, clock: number): number;
     archive(factId: number, clock: number, reason: string): number;
     restore(factId: number, trust: number, clock: number): number;
-    bumpHelpful(factId: number, delta: number): void;
     pin(factId: number, clock: number): number;
     unpin(factId: number, clock: number): number;
-    pinOutcome(factId: number, clock: number, bonusCount: number, windowAt: string): void;
-    forgetOutcome(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): void;
-    reinforceOutcome(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): void;
     touchUsage(ids: readonly number[]): void;
     settleTrust(factId: number, trust: number, clock: number): void;
     reinforce(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): void;

package/lib/engine/mem/facts_io.d.ts

@@ -181,6 +181,10 @@ export interface MetadataDropped {
     helpful_count: number;
     pinned: number;
     supersedes: number;
+    /** v2: the imported row carried a `ttl_days` value; TTL is gone, so it is not written back. */
+    ttl_days: number;
+    /** v2: the imported row carried a `valid_to` value; the known end is gone. */
+    valid_to: number;
 }
 /** The single JSON object `import` prints (`file` is added by the CLI, which knows the argument). */
 export interface ImportReport {

package/lib/engine/mem/interfaces/repositories.d.ts

@@ -14,7 +14,7 @@
  *
  * @module interfaces/repositories
  */
-import type { ContradictionRecord, FactSourceView, MemoryKind, RelationInput } from '../../mem-contract/index.js';
+import type { ContradictionRecord, FactSourceView, MemoryKind, RelationInput, TrustCurve } from '../../mem-contract/index.js';
 import type { GraphReader } from '../../graph-recall/index.js';
 import type { RelationVocabulary, SurfaceMatch } from '../store/relation_planner.js';
 import type { ExtractedEntity } from '../entities/extract.js';
@@ -36,7 +36,6 @@ export interface FactHitMeta {
     created_at: string;
     updated_at: string | null;
     valid_from: string | null;
-    valid_to: string | null;
     title: string | null;
 }
 /** One persisted semantic vector, as the reload/repair flows read it. */
@@ -87,14 +86,12 @@ export interface MemoryRepository {
     countInStatus(status: string, kind?: MemoryKind, source?: string): Awaitable<number>;
     countActiveWithValidFrom(): Awaitable<number>;
     countForgettingWithin(p: {
-        step: number;
+        threshold: number;
         clock: number;
-        withinDays: number;
+        curve: TrustCurve;
     }): Awaitable<number>;
-    countIdleCandidates(days: number): Awaitable<number>;
     countArchiveBacklog(p: {
         forgetThreshold: number;
-        idleCalendarDays: number;
     }): Awaitable<number>;
     countPendingConflicts(): Awaitable<number>;
     countStaleEntities(version: number): Awaitable<number>;
@@ -146,7 +143,6 @@ export interface MemoryRepository {
     insertRevision(v: {
         content: string;
         kind: MemoryKind;
-        ttlDays: number;
         supersedesId: number | null;
         hrr: Uint8Array;
         trust: number;
@@ -157,18 +153,13 @@ export interface MemoryRepository {
         createdAt: string;
         title?: string | null;
         validFrom?: string | null;
-        validTo?: string | null;
         validFromMs?: number | null;
-        validToMs?: number | null;
     }): Awaitable<InsertRevisionOutcome>;
     applyValidity(factId: number, validFrom: {
         text: string;
         ms: number;
-    } | undefined, validTo: {
-        text: string;
-        ms: number;
     } | undefined): Awaitable<void>;
-    applyValues(factId: number, kind: MemoryKind, ttlDays: number): Awaitable<void>;
+    applyValues(factId: number, kind: MemoryKind): Awaitable<void>;
     setTitle(factId: number, title: string): Awaitable<void>;
     /** v17: record a handle this fact used to carry, so an old title search still finds it. */
     insertTitleAlias(factId: number, title: string): Awaitable<void>;
@@ -177,18 +168,13 @@ export interface MemoryRepository {
     /** v17: drop an alias that has become the row's current title (a correction back to it). */
     dropTitleAlias(factId: number, title: string): Awaitable<void>;
     incrementAssertCount(factId: number): Awaitable<number>;
-    markValidTo(factId: number, at: string, atMs?: number | null): Awaitable<void>;
     linkSupersede(factId: number, supersedesId: number): Awaitable<void>;
     archiveSuperseded(factId: number, clock: number): Awaitable<number>;
-    revive(factId: number, kind: MemoryKind, ttlDays: number, trust: number, clock: number): Awaitable<number>;
+    revive(factId: number, kind: MemoryKind, trust: number, clock: number): Awaitable<number>;
     archive(factId: number, clock: number, reason: string): Awaitable<number>;
     restore(factId: number, trust: number, clock: number): Awaitable<number>;
-    bumpHelpful(factId: number, delta: number): Awaitable<void>;
     pin(factId: number, clock: number): Awaitable<number>;
     unpin(factId: number, clock: number): Awaitable<number>;
-    pinOutcome(factId: number, clock: number, bonusCount: number, windowAt: string): Awaitable<void>;
-    forgetOutcome(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): Awaitable<void>;
-    reinforceOutcome(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): Awaitable<void>;
     touchUsage(ids: readonly number[]): Awaitable<void>;
     settleTrust(factId: number, trust: number, clock: number): Awaitable<void>;
     reinforce(factId: number, trust: number, clock: number, bonusCount: number, windowAt: string): Awaitable<void>;

package/lib/engine/mem/lifecycle/maintenance.d.ts

@@ -4,8 +4,10 @@
  *
  * Surface stability (D10): the original report keys are all preserved
  * (`decayed / archived_ttl / archived_age / purged / purged_ids / archived_ids`)
- * and the new detail is purely additive. `archived_age` now means "non-TTL
- * automatic archival" = `forgot + idle`.
+ * and the new detail is purely additive. `archived_ttl` / `archived_idle` are kept as
+ * CONSTANT 0 and marked `@deprecated`: TTL and idle archival are gone (v2), but a report key
+ * is a surface scripts read — deleting it would break them for nothing. `archived_age` now
+ * means "the automatic archival that still exists" = `forgot`.
  *
  * The `maintenance` action forces a FULL pass (no settle budget); the automatic
  * startup/heartbeat passes use `tick_max_facts`.
@@ -15,8 +17,9 @@ import type { Db } from '../db/conn.js';
 export interface MaintenanceResult {
     /** Rows whose trust was materialized by the settle sweep (see tick.ts). */
     decayed: number;
+    /** @deprecated TTL archival is gone (v2); always 0, kept so existing report readers keep working. */
     archived_ttl: number;
-    /** Non-TTL automatic archival = `forgot + idle` (kept name, widened meaning). */
+    /** The automatic archival this pass performed = `forgot` (name kept, D10). */
     archived_age: number;
     purged: number;
     /** Fact ids physically deleted by the purge — callers evict their vectors from the live index. */
@@ -26,10 +29,11 @@ export interface MaintenanceResult {
     settled: number;
     clock: number;
     archived_forgot: number;
+    /** @deprecated Idle archival is gone (v2); always 0, kept for the same reason as `archived_ttl`. */
     archived_idle: number;
     /** Rows still pending settle because the budget ran out (always 0 for a forced pass). */
     skipped: number;
-    /** Rows still due for TTL/forgot/idle because the budget ran out (0 for a forced pass). */
+    /** Rows still due for forgot because the budget ran out (0 for a forced pass). */
     archived_deferred: number;
     /** Rows still due for purge when the budget ran out (0 for a forced pass). */
     purged_deferred: number;

package/lib/engine/mem/lifecycle/tick.d.ts

@@ -1,16 +1,19 @@
 /**
- * One trust/lifecycle tick (spec docs/TRUST_MODEL.md §4) — five ordered statements:
+ * One trust/lifecycle tick (spec docs/TRUST_MODEL.md §4) — three ordered statements:
  *
  *   ① settle   — materialize decay for every row whose ACTIVE DAY changed
- *   ② TTL      — calendar expiry (explicit instruction; pinned is not exempt)
- *   ③ forgot   — trust ≤ forget_threshold after settling (pinned exempt)
- *   ④ idle     — calendar fallback: unused for `idle_calendar_days`
- *   ⑤ purge    — physical delete of archived rows past the window
+ *   ② forgot   — trust ≤ forget_threshold after settling (pinned exempt)
+ *   ③ purge    — physical delete of archived rows past the window
+ *
+ * The calendar clocks are GONE (v2): there is no TTL step and no idle fallback, so a fact's
+ * lifetime is decided by the active-day curve alone and "expired" is expressed by an explicit
+ * `update` / `archive` (docs/TRUST_MODEL.md §3.4). `pinned` is therefore never archived by an
+ * automatic pass.
  *
  * EVERY step is budgeted by the same `tick_max_facts`, not just ①.
  *
  * It used to say "only ① is budgeted; ②③④⑤ only ever touch critical rows", and that reading is
- * wrong in the direction that matters: ②③④⑤ each run inside the tick's ONE `IMMEDIATE` transaction,
+ * wrong in the direction that matters: every step runs inside the tick's ONE `IMMEDIATE` transaction,
  * which holds the write lock for its whole duration, so an unbounded archive or purge pass over a
  * large corpus blocks every other process (and the startup path, which is where the tick runs) for
  * as long as it takes. Bounding each step is what keeps that lock short; `archived_deferred` and
@@ -24,17 +27,15 @@ export interface TickResult {
     clock: number;
     /** Rows materialized by ① (equals "trust actually changed" — see the note in runTrustTick). */
     settled: number;
-    archived_ttl: number;
     archived_forgot: number;
-    archived_idle: number;
     purged: number;
     purged_ids: number[];
     archived_ids: number[];
     /** Rows still awaiting ① when the budget ran out (0 for a full pass). */
     skipped: number;
-    /** Rows still due for ②③④ when the budget ran out (0 when the pass finished them). */
+    /** Rows still due for ② when the budget ran out (0 when the pass finished them). */
     archived_deferred: number;
-    /** Rows still due for ⑤ when the budget ran out (0 when the pass finished them). */
+    /** Rows still due for ③ when the budget ran out (0 when the pass finished them). */
     purged_deferred: number;
 }
 export declare function runTrustTick(db: Db, cfg: Config, opts: {

package/lib/engine/mem/lifecycle/trust.d.ts

@@ -3,13 +3,22 @@
  * (`clock` / `nowMs` are always injected, so every rule is unit-testable).
  *
  * Spec: docs/TRUST_MODEL.md §2. Key rules encoded here:
- *  - `eff = pinned ? 1 : clamp(trust − step × (clock − settle_clock), 0, 1)` (§2.2)
+ *  - `eff = pinned ? 1 : clamp(T(clock − settle_clock), 0, 1)` (§2.2), where `T(days)` is the decay
+ *    curve of `contract/src/trust_curve.ts` — the ONE implementation of the formula
  *  - recall only ever RAISES trust (`max(eff, …)`, R2) and never pins (D11)
  *  - zero-gain recalls neither consume quota nor stamp `last_reinforced_at` (R10)
- *  - explicit feedback can pin (snap to 1.0) or forget immediately (§2.4)
+ *  - permanent is set ONLY by an explicit `pin`; no write path moves a fact across that line (§2.4)
  *  - `enabled=false` degrades `eff()` to the stored value (D12)
  */
 import type { Config } from '../../mem-contract/index.js';
+import { formatUtcTs, parseUtcTs, type TrustCurve } from '../../mem-contract/index.js';
+/**
+ * The UTC stamp parse/render pair is `@avantf/mem-contract/time` — ONE implementation, shared with
+ * the two display faces (`formatOffsetIso` for the model, `formatLocalHuman` for the UI), so the
+ * "a zone-less stamp means UTC" rule cannot drift between the trust math and what a reader sees.
+ * Re-exported here because this module is where the trust code (and its specs) have always found it.
+ */
+export { formatUtcTs, parseUtcTs };
 export declare const DAY_MS = 86400000;
 /** Guard for "did the number actually move" comparisons. */
 export declare const EPSILON = 1e-9;
@@ -24,20 +33,9 @@ export interface TrustRow {
     status: string;
 }
 export declare function clamp01(v: number): number;
+/** The curve of one `trust` section — the single mapping from config keys to the math. */
+export declare function trustCurveOf(cfg: TrustConfig): TrustCurve;
 export declare function isPinned(row: Pick<TrustRow, 'pinned'>): boolean;
-/**
- * `'YYYY-MM-DD HH:MM:SS'` (SQLite UTC) or ISO → epoch ms; null/garbage → null.
- *
- * A stamp with NO zone designator is read as UTC, not as local time. `Date.parse` treats a zone-less
- * ISO string as LOCAL, and everything in this store is written in UTC (`CURRENT_TIMESTAMP`, and
- * {@link formatUtcTs}), so handing one over as-is would shift every quota window and every decay
- * measurement by the host's UTC offset — a fact reinforced at 23:00 UTC+8 would look reinforced 8
- * hours earlier, and the 24h cap would open or close at the wrong moment. An explicit `Z` or
- * `±HH:MM` is left alone.
- */
-export declare function parseUtcTs(ts: string | null | undefined): number | null;
-/** Epoch ms → `'YYYY-MM-DD HH:MM:SS'` (the SQLite `CURRENT_TIMESTAMP` shape, UTC). */
-export declare function formatUtcTs(ms: number): string;
 /** eff(f) — the trust a caller should act on right now (spec §2.2). */
 export declare function effectiveTrust(row: TrustRow, clock: number, cfg: TrustConfig, enabled?: boolean): number;
 /**
@@ -48,8 +46,9 @@ export declare function effectiveTrust(row: TrustRow, clock: number, cfg: TrustC
  */
 export declare function displayTrust(row: TrustRow, clock: number, cfg: TrustConfig, enabled?: boolean): number;
 /**
- * Remaining active days: `eff / step`. `null` for pinned rows, non-active rows and
- * when trust is disabled — the contract's `remaining_days` (spec §6 / R11).
+ * Remaining active days: the inverse of the curve at the current eff (`daysToZero`).
+ * `null` for pinned rows, non-active rows and when trust is disabled — the contract's
+ * `remaining_days` (spec §6 / R11).
  */
 export declare function remainingDays(row: TrustRow, clock: number, cfg: TrustConfig, enabled?: boolean): number | null;
 /** Everything a recall write needs to persist (spec §2.3). */
@@ -66,25 +65,13 @@ export interface RecallOutcome {
  * Apply one recall to a fact: settle, then grant a bonus inside the daily quota.
  * Returns `next === settled` when the quota is exhausted, the ceiling is reached,
  * the fact is pinned, or the gain would be zero (R2/R10/D11).
- */
-export declare function grantRecallBonus(row: TrustRow, clock: number, nowMs: number, cfg: TrustConfig, enabled?: boolean): RecallOutcome;
-/** Everything a feedback write needs to persist (spec §2.4). */
-interface FeedbackOutcome {
-    settled: number;
-    next: number;
-    pin: boolean;
-    forget: boolean;
-    /** true when the row was left untouched (pinned / archived). */
-    untouched: boolean;
-    bonusCount: number;
-    windowAt: string;
-}
-/**
- * Apply one explicit `helpful` (+1) / `unhelpful` (-1) step.
  *
- * Pinned and archived rows are untouched (R7): only `helpful_count` changes for
- * them, so a pinned fact can never end up storing 0.95 while displaying 1.0.
- * When `feedback_daily_cap > 0` feedback shares the per-fact 24h window counter.
+ * The gain is SEGMENTED at the frozen anchor `BASE_TRUST` (D20):
+ *  - strictly below the base: `min(BASE_TRUST, T + recall_gain_below_base)`, so the shipped
+ *    `recall_gain_below_base: 0.1` takes 0.05 → 0.5 in five recalls and never past the base;
+ *  - AT OR ABOVE the base: `recall_gain_above_base × marginal_decay^count`, capped at the ceiling
+ *    INVERTED from `max_retention_days` (there is no `recall_ceiling` key any more, D16). The
+ *    boundary is strictly `<` on purpose: a fact sitting exactly on the base (a fresh one, on the
+ *    first recall after it has finished settling) takes the above-base branch and starts climbing.
  */
-export declare function applyFeedbackDelta(row: TrustRow, clock: number, delta: number, nowMs: number, cfg: TrustConfig, enabled?: boolean): FeedbackOutcome;
-export {};
+export declare function grantRecallBonus(row: TrustRow, clock: number, nowMs: number, cfg: TrustConfig, enabled?: boolean): RecallOutcome;