@avantf/dsh-mem 0.9.0 → 0.10.0

package/lib/index.js

@@ -167,6 +167,146 @@ const DEGRADED_WEIGHTS = {
 */
 const DEGRADED_LEG_NOTE = "本次仅词法腿，语义腿未就绪（语义后端不可用，结果只来自 FTS 与实体腿）。";
 //#endregion
+//#region ../contract/lib/trust_curve.js
+/**
+* The trust decay curve — PURE functions, no IO, no config object of its own.
+*
+* This file is the ONE implementation of "how much trust is left after N active days" and of every
+* inverse of it. `core/lifecycle/trust.ts` (read path, recall reinforcement), the tick's settle
+* statement (`db/dao/facts.ts`) and the config's load-time validation (`config.ts`) all delegate
+* here, so a change of shape cannot leave one of them behind (docs/TRUST_MODEL.md §2.2, DESIGN §18).
+*
+* It lives in the CONTRACT package because the load-time validation needs the same math, and the
+* dependency direction is core → contract, never the reverse.
+*
+* ## The two shapes
+*
+* `linear` (TRUST_MODEL D7, the P3 equivalent tier): trust falls by a constant amount per active
+* day, `slope = BASE_TRUST / base_lifetime_days` ⇒ a fact that starts at `BASE_TRUST` reaches 0
+* after exactly `base_lifetime_days` active days.
+*
+* `accelerating` (the v2 target shape): `dT/dt = −λ·(a + 1 − T)` — the closer to 1, the slower the
+* decay, so "almost permanent" facts really linger. Closed form (plan §3.1):
+*
+*     T(t) = (1 + a) − ((1 + a) − T₀)·e^(λt)      λ = ln((1 + a)/(1 + a − BASE_TRUST)) / B
+*
+* Note the POSITIVE exponent: `u = a + 1 − T` grows, so `e^(λt)` is the decay direction here (the
+* plan writes it this way, and the closed-form test pins it). `a = decay_curvature`.
+*
+* ## Units
+*
+* `days` is ALWAYS the ACTIVE-DAY counter (`avantf_stats.trust_clock`), never wall time.
+*/
+/**
+* The frozen anchor (TRUST_MODEL D20): a new fact's initial trust, the trust value the lifetime
+* anchor is defined at (`daysToZero(BASE_TRUST) === base_lifetime_days`), and the divider between
+* the two recall-reinforcement segments. One constant on purpose — the three uses must never be
+* configurable apart, or "a new fact lives 90 active days" stops being true.
+*/
+const BASE_TRUST = .5;
+/** The decay shapes `decay_shape` accepts. */
+const DECAY_SHAPES = ["linear", "accelerating"];
+/** Read the curve out of the `trust` section (the single mapping from keys to math). */
+function curveOf(trust) {
+	return {
+		shape: trust.decay_shape,
+		curvature: trust.decay_curvature,
+		baseDays: trust.base_lifetime_days
+	};
+}
+/**
+* Trust units lost per active day — the LINEAR slope, `BASE_TRUST / base_lifetime_days`.
+*
+* `linear` is the only shape with a constant slope; for `accelerating` this returns the LOCAL slope
+* at the anchor `T = BASE_TRUST` (`λ·(BASE_TRUST + a)`). It exists as the building block of the
+* `linear` branch of {@link trustAfterDays} / {@link ceilingForDays} and for the tests that pin the
+* anchor; it is deliberately NOT a scalar stand-in for the curve — anything that needs "how much
+* trust is left after N days" uses {@link trustAfterDays}, and anything that needs "N days from a
+* threshold" uses {@link ceilingForDays}. (An earlier caller — `trust_diagnose.forgetting_soon` —
+* used it as a linear rate and was wrong once `accelerating` became the default.)
+*/
+function slopeOf(shape, curvature, baseDays) {
+	if (shape === "linear") return BASE_TRUST / baseDays;
+	return lambdaFor(curvature, baseDays) * (BASE_TRUST + curvature);
+}
+/**
+* `λ = ln((1 + a) / (1 + a − BASE_TRUST)) / baseDays` — pinned so the anchor holds:
+* `λ·baseDays = ln((1 + a)/(0.5 + a))`, i.e. `daysToZero(BASE_TRUST) === baseDays` for ANY `a`.
+*/
+function lambdaFor(curvature, baseDays) {
+	return Math.log((1 + curvature) / (1 + curvature - BASE_TRUST)) / baseDays;
+}
+/**
+* `T − days·slope` (linear) or the closed form `(1 + a) − ((1 + a) − T)·e^(λ·days)`.
+*
+* UNCLAMPED on purpose: callers clamp to `[0, 1]` themselves (`effectiveTrust`'s read path and the
+* settle write both must clamp, and a shared clamp here would hide a caller that forgot).
+*/
+function trustAfterDays(T, days, cfg) {
+	if (cfg.shape === "linear") return T - days * slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	const a = cfg.curvature;
+	return 1 + a - (1 + a - T) * Math.exp(lambdaFor(a, cfg.baseDays) * days);
+}
+/**
+* Active days between two trust values, `t(T0 → T1)`.
+*
+* `linear`: `(T0 − T1) / slope`; `accelerating`: `ln((1 + a − T1)/(1 + a − T0)) / λ`. Both are
+* signed the natural way (a RISING target yields a negative number of days), so the formula is
+* usable as an inverse without special cases. Returns `NaN` only for an out-of-domain input
+* (`T > 1 + a` on the accelerating branch), which the config validation makes unreachable.
+*/
+function daysBetween(T0, T1, cfg) {
+	if (cfg.shape === "linear") return (T0 - T1) / slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	const a = cfg.curvature;
+	return Math.log((1 + a - T1) / (1 + a - T0)) / lambdaFor(a, cfg.baseDays);
+}
+/** Active days until the value reaches 0 — `remainingDays`'s whole body. */
+function daysToZero(T, cfg) {
+	return daysBetween(T, 0, cfg);
+}
+/**
+* The trust ceiling a `max_retention_days` promises: after being reinforced up to `ceiling`, a fact
+* survives `days` more active days.
+*
+* `linear`: `days · slope` (= `days / (2·baseDays)`); `accelerating`: `(1 + a)(1 − e^(−λ·days))`.
+* This is an INVERSION (`daysToZero(ceilingForDays(R)) === R`), not a configuration value — the
+* config has no `recall_ceiling` key any more (D16).
+*/
+function ceilingForDays(days, cfg) {
+	if (cfg.shape === "linear") return days * slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	const a = cfg.curvature;
+	return (1 + a) * (1 - Math.exp(-lambdaFor(a, cfg.baseDays) * days));
+}
+/**
+* The inverse of {@link ceilingForDays}: how many active days a given ceiling is worth. Used by the
+* deprecated-key warning (`config/loader.ts`) to translate an old `recall_ceiling` value, and by the
+* validation messages.
+*/
+function retentionDaysForCeiling(ceiling, cfg) {
+	if (cfg.shape === "linear") return ceiling / slopeOf(cfg.shape, cfg.curvature, cfg.baseDays);
+	return daysToZero(ceiling, cfg);
+}
+/**
+* `R_max` of the accelerating shape — the days at which the ceiling reaches 1 (`ceiling → ∞`).
+*
+*     R_max = baseDays · ln((1 + a)/a) / ln((1 + a)/(1 + a − BASE_TRUST))
+*
+* `max_retention_days` must stay strictly below it, or a reinforced fact would stop aging like
+* `pinned` does (D14: permanent is set only by a person).
+*/
+function RMAX(curvature, baseDays) {
+	return baseDays * Math.log((1 + curvature) / curvature) / Math.log((1 + curvature) / (1 + curvature - BASE_TRUST));
+}
+/**
+* The shape-aware upper bound on `max_retention_days`: the days at which the ceiling hits 1.
+*
+* `linear`: `2·baseDays` (the ceiling is `days/(2·baseDays)`); `accelerating`: {@link RMAX}. Both
+* are STRICT bounds — at the bound the ceiling is exactly 1, which `superRefine` rejects.
+*/
+function retentionDaysLimit(shape, curvature, baseDays) {
+	return shape === "linear" ? 2 * baseDays : RMAX(curvature, baseDays);
+}
+//#endregion
 //#region ../contract/lib/config.js
 /**
 * Upper bound on tokens handed to the embedder. 0 = auto (the loaded model's declared
@@ -528,40 +668,83 @@ const presenceSchema = z.object({
 	/** Long-lived surfaces (plugin / MCP) tick this often; 0 = startup pass only. */
 	heartbeat_minutes: z.number().int().nonnegative().default(60)
 });
+/**
+* Trust & forgetting (TRUST_MODEL.md §2 / §7).
+*
+* The knobs are DAYS and a SHAPE, never a slope: the operator's promise is "how long does a memory
+* last", and the arithmetic that turns days into trust units lives in `trust_curve.ts` (one
+* implementation, shared with the load-time validation below). `recall_ceiling` is gone — the
+* reinforcement ceiling is an INVERSION of `max_retention_days` (D16).
+*/
 const trustSchema = z.object({
-	/** false = no presence, no decay, no reinforcement, no pinning (TTL/idle/purge keep running). */
+	/** false = no presence, no decay, no reinforcement, no pinning, no automatic archiving (purge keeps running). */
 	enabled: z.boolean().default(true),
-	/** Initial trust of a new fact. */
-	start: z.number().min(0).max(1).default(.5),
-	/** Linear decay per active day: `0.5 / 90` ⇒ 90 active days from start to 0. */
-	decay_per_day: z.number().min(0).max(1).default(.5 / 90),
+	/**
+	* The anchor: active days a fact takes to fall from `BASE_TRUST` (0.5, frozen — D20) to 0, i.e.
+	* "how long a never-recalled memory lives". `start` is NOT configurable any more: it is the same
+	* 0.5 as the anchor and the reinforcement divider, so one knob could untie all three.
+	*/
+	base_lifetime_days: z.number().int().positive().default(90),
+	/**
+	* The longest stay recall reinforcement can buy, in ACTIVE days — the ceiling is inverted from
+	* this (`ceilingForDays`), never configured (D16).
+	*
+	* P4 ships **174** with `decay_shape: 'accelerating'` ⇒ ceiling ≈ **0.7492**. That pair is a
+	* deliberate PROMISE change, not a correction: the longest stay grows 153 → 174 active days and the
+	* reinforcement ceiling falls 0.85 → 0.7492 (CHANGELOG/unreleased.md). P3's equivalent tier —
+	* `linear` + 153 ⇒ exactly 0.85 — stays legal and is the documented rollback.
+	*/
+	max_retention_days: z.number().int().positive().default(174),
+	/** `accelerating` (the v2 target shape) or `linear` (P3's equivalent tier / the rollback). */
+	decay_shape: z.enum(DECAY_SHAPES).default("accelerating"),
+	/**
+	* `a` — the accelerating shape's floor term. `a > 0` is a hard requirement: at `a = 0`, `T = 1`
+	* is a fixed point, so an `unpin`ned `trust = 1` fact would never decay again — a second kind of
+	* permanent. The `(0, 0.5]` bound is checked in the `superRefine` below (with the reason in the
+	* message). Unused by `linear`, present so both shapes share one schema.
+	*/
+	decay_curvature: z.number().default(.05),
 	/** Trust ≤ this ⇒ forgotten (archived 'forgot'). 0 = "reaching zero is forgetting". */
 	forget_threshold: z.number().min(0).max(1).default(0),
-	/** Reaching this via explicit feedback promotes to permanent (snapped to 1.0). */
-	permanent_threshold: z.number().min(0).max(1).default(.9),
-	/** A recall of something at/below this raises it straight back to this value. */
-	recall_floor: z.number().min(0).max(1).default(.5),
-	/** Per-recall gain (before marginal decay). */
-	recall_delta: z.number().min(0).max(1).default(.03),
+	/**
+	* Per-recall gain BELOW `BASE_TRUST`, capped at `BASE_TRUST` itself. `0.1` ⇒ five recalls take a
+	* fact from 0.05 back to the base (the second crossing — from exactly 0.5 up — is the above-base
+	* segment, D20).
+	*/
+	recall_gain_below_base: z.number().gt(0).max(.5).default(.1),
+	/** Per-recall gain above `BASE_TRUST` (before marginal decay), capped at the derived ceiling. */
+	recall_gain_above_base: z.number().gt(0).max(1).default(.01),
 	/** Effective reinforcement events per fact per 24h (R10: zero-gain ones don't count). */
 	recall_daily_cap: z.number().int().nonnegative().default(3),
-	/** 1 = every in-window gain is equal; 0.5 = 0.03 / 0.015 / 0.0075 … */
+	/** 1 = every in-window gain is equal; 0.5 = 0.01 / 0.005 / 0.0025 … */
 	recall_marginal_decay: z.number().min(0).max(1).default(1),
-	/** Recall alone can never exceed this (and never pins — see D11). */
-	recall_ceiling: z.number().min(0).max(1).default(.85),
-	/** Explicit `helpful` / `unhelpful` step. */
-	feedback_delta: z.number().min(0).max(1).default(.05),
-	/** 0 = unlimited; >0 also caps feedback reinforcement per fact per 24h. */
-	feedback_daily_cap: z.number().int().nonnegative().default(0),
 	/** A revised fact inherits the settled trust (and pin) of the row it replaces. */
 	inherit_trust_on_update: z.boolean().default(true),
 	/** Pinned (permanent) facts are never physically purged. */
 	purge_skips_pinned: z.boolean().default(true),
-	/** Calendar fallback: unused for this many days ⇒ archived 'idle'. */
-	idle_calendar_days: z.number().int().positive().default(365),
 	/** Per-tick budget for the settle sweep (the other sweeps only touch critical rows). */
 	tick_max_facts: z.number().int().positive().default(5e3),
 	presence: presenceSchema.prefault({})
+}).superRefine((trust, ctx) => {
+	const curve = curveOf(trust);
+	const base = trust.base_lifetime_days;
+	const days = trust.max_retention_days;
+	const a = trust.decay_curvature;
+	const fail = (path, message) => {
+		ctx.addIssue({
+			code: "custom",
+			path: [path],
+			message
+		});
+	};
+	const ceiling = () => ceilingForDays(days, curve).toFixed(4);
+	if (!(a > 0) || a > .5) fail("decay_curvature", `decay_curvature must be in (0, 0.5]; got ${String(a)} — 0 会让 T=1 永不衰减（unpin 之后仍然不老，等于第二层"永久"），>0.5 会把可配寿命区间压到默认值以下`);
+	if (days <= base) fail("max_retention_days", `max_retention_days must be > base_lifetime_days (${String(base)}); got ${String(days)} — 你这个值等价于 ceiling=${ceiling()}，召回加强不会产生任何增益；合法区间 (${String(base)}, ${retentionDaysLimit(trust.decay_shape, a, base).toFixed(1)})`);
+	const limit = retentionDaysLimit(trust.decay_shape, a, base);
+	if (!(days < limit)) {
+		const other = trust.decay_shape === "linear" ? `accelerating (a=${String(a)}): ${RMAX(a, base).toFixed(1)}` : `linear: ${(2 * base).toFixed(1)}`;
+		fail("max_retention_days", `max_retention_days must be < ${limit.toFixed(1)} (${trust.decay_shape}, a=${String(a)}, base=${String(base)}); legal range (${String(base)}, ${limit.toFixed(1)}); got ${String(days)} — 你这个值等价于 ceiling=${ceiling()}，与"永久只由人设"冲突；另一种形状的上界：${other}`);
+	}
 });
 const lifecycleSchema = z.object({
 	/** Purge window, measured in ACTIVE days since `archived_clock`. */
@@ -758,8 +941,6 @@ const KIND_FILTER_DESCRIPTION = `限定记忆层；可选（取值：${MEMORY_KI
 const SOURCE_REF_DESCRIPTION = "这条事实的来源（可选）：未给 = 未知来源，引擎不会臆造。用 `kind:` 前缀标明来源类型——`session:<会话 id>`（会话供述）、`tool:<工具名>`（工具产出）、无前缀则记为 `manual`（调用方手工给出），前缀之后的文本原样保存。可用 `mem_admin` 的 `list`（`source=`）反查同一来源产生了哪些事实。";
 /** P-13 `event_date`: the event time, written into `valid_from`. */
 const EVENT_DATE_DESCRIPTION = "这件事发生的时间（可选，ISO 日期或日期时间，如 2026-10-06 或 2026-10-06T09:30:00+08:00）：写入事实的事件时间，供时间窗检索与展示使用；不参与打分。未给 = 未知（不写）。";
-/** P-13 `valid_until`: a known end, written into `valid_to` WITHOUT archiving the row. */
-const VALID_UNTIL_DESCRIPTION = "这条事实有效到什么时候（可选，ISO 日期或日期时间）：写入有效期终点，**不会归档该事实**——「仍然有效、但已知截止于某时」的事实照常参与检索。未给 = 未知（不写）。";
 /**
 * `title`: the short, human-readable handle of a journal entry (JOURNAL_TITLE_SEARCH §2.4/§11.1).
 *
@@ -883,9 +1064,12 @@ function modelFacingToolResult(toolKey, action, value) {
 *  - `source_ref` — the citation the answer must carry;
 *  - `created_at` / `updated_at` — memory MAINTENANCE: when it was written and when it was last
 *    changed is what tells the model whether a fact is fresh enough to act on (and `updated_at`
-*    differing from `created_at` is the only visible sign that it was revised);
-*  - `valid_from` / `valid_to` — when the fact was true (P-07), which is what an "as of when"
-*    question needs;
+*    differing from `created_at` is the only visible sign that it was revised). Both are INSTANTS
+*    rendered as ISO-8601 WITH the host's offset (`2026-10-28T19:58:48+08:00`), so the model does no
+*    timezone arithmetic and cannot read them as local time;
+*  - `valid_from` — the event time (P-07/P-13), which is what an "as of when" question needs. A
+*    CALENDAR DATE (`YYYY-MM-DD`) with no zone — deliberately a different shape from the two
+*    instants above, because it answers a different question;
 *  - `title` — the journal entry's short handle, for recognition and for the follow-up write flow
 *    (an update inherits it). Display only: it never moved this hit's `score`;
 *  - `scores` / `final` — only ever present when the caller explicitly asked for the evidence.
@@ -905,7 +1089,6 @@ const MODEL_HIT_FIELDS = [
 	"created_at",
 	"updated_at",
 	"valid_from",
-	"valid_to",
 	"scores",
 	"final"
 ];
@@ -913,7 +1096,6 @@ const MODEL_HIT_FIELDS = [
 const NULLABLE_HIT_FIELDS = /* @__PURE__ */ new Set([
 	"updated_at",
 	"valid_from",
-	"valid_to",
 	"title"
 ]);
 /**
@@ -1167,10 +1349,8 @@ const RememberUnion = z.discriminatedUnion("action", [
 		content: z.string().min(1).describe("要写入或替换的事实内容：一句自包含的陈述。action=add 时必填。"),
 		kind: z.enum(MEMORY_KINDS).optional().describe(KIND_WRITE_DESCRIPTION),
 		title: z.string().min(1).max(120).optional().describe(TITLE_WRITE_DESCRIPTION),
-		ttl_days: z.number().int().nonnegative().optional().describe("有效期天数（0 或省略 = 不设有效期；正整数 = 自写入起该天数后自动归档）。update 未给则继承被改写事实的 TTL。"),
 		source_ref: z.string().min(1).optional().describe(SOURCE_REF_DESCRIPTION),
 		event_date: z.string().min(1).optional().describe(EVENT_DATE_DESCRIPTION),
-		valid_until: z.string().min(1).optional().describe(VALID_UNTIL_DESCRIPTION),
 		relations: z.array(RelationInputSchema).max(20).optional().describe(RELATIONS_DESCRIPTION)
 	}),
 	z.object({
@@ -1180,24 +1360,14 @@ const RememberUnion = z.discriminatedUnion("action", [
 		kind: z.enum(MEMORY_KINDS).optional().describe(`改写后的${KIND_WRITE_DESCRIPTION}`),
 		title: z.string().min(1).max(120).optional().describe(`改写后的${TITLE_WRITE_DESCRIPTION}`),
 		retitle: z.literal(true).optional().describe(RETITLE_DESCRIPTION),
-		ttl_days: z.number().int().nonnegative().optional().describe("新的有效期天数（0 = 取消有效期）；可选，未给则继承被改写事实的 TTL。"),
 		source_ref: z.string().min(1).optional().describe(SOURCE_REF_DESCRIPTION),
 		event_date: z.string().min(1).optional().describe(EVENT_DATE_DESCRIPTION),
-		valid_until: z.string().min(1).optional().describe(VALID_UNTIL_DESCRIPTION),
 		relations: z.array(RelationInputSchema).max(20).optional().describe(`改写后的${RELATIONS_DESCRIPTION}`)
 	}),
 	z.object({
 		action: z.literal("remove"),
 		fact_id: z.number().int().positive().describe("要删除的事实 ID。action=remove 时必填。"),
 		reason: z.string().optional().describe("删除原因；可选。")
-	}),
-	z.object({
-		action: z.literal("helpful"),
-		fact_id: z.number().int().positive().describe("对回答有帮助的事实 ID。action=helpful 时必填。")
-	}),
-	z.object({
-		action: z.literal("unhelpful"),
-		fact_id: z.number().int().positive().describe("对回答无帮助的事实 ID。action=unhelpful 时必填。")
 	})
 ]);
 /**
@@ -1220,9 +1390,13 @@ function modelSubset(union, actions) {
 	return z.discriminatedUnion("action", options);
 }
 /**
-* The writes the model may make. `helpful` / `unhelpful` are operator feedback: the model cannot
-* observe the retention clocks they move, and a model that could would be able to "refresh" a fact by
-* voting on it — the exact behaviour the retention policy exists to prevent.
+* The writes the model may make — `MODEL_REMEMBER_ACTIONS` and `REMEMBER_ACTIONS` are the same three
+* again since the operator-side `helpful` / `unhelpful` actions were removed: a vote on a fact was a
+* way to move its retention clock, and a model able to vote could "refresh" a fact by voting on it.
+*
+* Permanent is set by ONE route only: an explicit `pin` from a human (`mem_admin` / CLI / settings
+* page). Do NOT re-add an action that promotes or demotes a fact from a write path — that is the
+* behaviour the retention policy exists to prevent.
 */
 const MODEL_REMEMBER_ACTIONS = [
 	"add",
@@ -1393,7 +1567,7 @@ const ModelAdminUnion = modelSubset(AdminUnion, [
 const REMEMBER_TOOL = {
 	key: "remember",
 	name: "mem_remember",
-	description: "写入/更新/删除长期记忆事实。add=新增一条简洁的独立陈述；update=改写已有事实；remove=删除。写入没有改变任何状态时是静默 no-op（add 命中完全重复的内容、update 重存同一内容）。`kind` 必填，两层：`journal`=做了什么/聊了什么/想了什么（必须同时给 `event_date`，写事情发生的日期而不是写入日期，缺了会被拒绝）；`note`=稳定事实/偏好/决策/坑。只记会改变后续行为的摘要，不抄全文；不要把每段聊天都写成 journal；`note` 可用 `relations` 写出稳定关系（`{subject, predicate, object}` 三个名字）；`journal` 不写 relations，需要留关系时另写一条 note；journal 的 add 必须给 `title`（短标题，见下），总结覆盖目标/关键动作/结论/产出位置/未决项；从 journal 提炼为 note 时用 `source_ref` 指回来源。标题流程：写 journal 前标题不确定时，用 `mem_recall` 的 `titles`（2–4 个主题关键词）找候选，读候选的 title/event_date/摘要判断是否同一事务——同一事务用 `update` 该 fact_id 并省略 title（继承），不同事务 `add` 并给新的 title。同一事务复用同一 title；后续轮次都用上一次 update 返回的新 fact_id；title 在一条 revision 链内不可变，显式换 title 会被拒绝（标题为 NULL 的旧 journal 可一次性回填）；发现标题写错时，用 `update` 带 `retitle: true` 与正确的 title 纠正一次——旧标题保留为别名，用旧标题检索仍能命中。`ttl_days` 规则：显式给定的值一定生效，未给则保留该事实原有的值——update 未给时继承被改写事实的 ttl_days。",
+	description: "写入/更新/删除长期记忆事实。add=新增一条简洁的独立陈述；update=改写已有事实；remove=删除。写入没有改变任何状态时是静默 no-op（add 命中完全重复的内容、update 重存同一内容）。`kind` 必填，两层：`journal`=做了什么/聊了什么/想了什么（必须同时给 `event_date`，写事情发生的日期而不是写入日期，缺了会被拒绝）；`note`=稳定事实/偏好/决策/坑。只记会改变后续行为的摘要，不抄全文；不要把每段聊天都写成 journal；`note` 可用 `relations` 写出稳定关系（`{subject, predicate, object}` 三个名字）；`journal` 不写 relations，需要留关系时另写一条 note；journal 的 add 必须给 `title`（短标题，见下），总结覆盖目标/关键动作/结论/产出位置/未决项；从 journal 提炼为 note 时用 `source_ref` 指回来源。标题流程：写 journal 前标题不确定时，用 `mem_recall` 的 `titles`（2–4 个主题关键词）找候选，读候选的 title/event_date/摘要判断是否同一事务——同一事务用 `update` 该 fact_id 并省略 title（继承），不同事务 `add` 并给新的 title。同一事务复用同一 title；后续轮次都用上一次 update 返回的新 fact_id；title 在一条 revision 链内不可变，显式换 title 会被拒绝（标题为 NULL 的旧 journal 可一次性回填）；发现标题写错时，用 `update` 带 `retitle: true` 与正确的 title 纠正一次——旧标题保留为别名，用旧标题检索仍能命中。",
 	input: ModelRememberUnion
 };
 const RECALL_TOOL = {
@@ -1419,7 +1593,7 @@ Number.MAX_SAFE_INTEGER, -Number.MAX_SAFE_INTEGER;
 *
 * Descriptions are authored per action ("action=update 时必填"), so taking the
 * first branch's text verbatim told a model that `fact_id` only matters for
-* `update` although `remove/helpful/unhelpful` require it too. The action-clause
+* `update` although `remove` requires it too. The action-clause
 * is stripped and replaced by the derived set of actions that make the field
 * required.
 *
@@ -1733,6 +1907,96 @@ function adoptWellFormed(kit) {
 	};
 }
 //#endregion
+//#region ../contract/lib/time.js
+/**
+* The ONE place a stored timestamp turns into a string a human (or a model) reads.
+*
+* ── THE BUG THIS MODULE EXISTS FOR ───────────────────────────────────────────────────────────────
+*
+* `facts.created_at` / `updated_at` / `archived_at` (and `contradiction_log.detected_at`, and the
+* retrieval-health stamp) are written by SQLite's `DEFAULT CURRENT_TIMESTAMP`, which is **UTC**, and
+* `store/memory.ts` used to hand the raw text up to every surface. Two consequences, both reported as
+* "记忆时间显示不对":
+*
+*  1. the UI printed `2026-10-28 11:58:48` as if it were a local wall clock (Asia/Shanghai really
+*     meant `19:58:48`), because a zone-less string cannot say otherwise;
+*  2. the MODEL received the same zone-less string next to `event_date`, which is a calendar DATE
+*     with no time and no zone. Two different kinds of value, one shape — the model had to guess
+*     which one it was looking at, and it cannot.
+*
+* ── THE SPLIT THIS MODULE ENFORCES ───────────────────────────────────────────────────────────────
+*
+* Storage stays UTC and stays byte-identical (`facts_io` export/import/snapshot is a compatibility
+* surface and is deliberately NOT routed through here). The fix is in the two DISPLAY faces:
+*
+*  - {@link formatOffsetIso} — the MODEL face (`mem_recall` hits, `mem_admin list/detail/
+*    contradictions`, `mem_admin stats`, the CLI and MCP that print those payloads): an ISO-8601
+*    instant **with an explicit offset**, e.g. `2026-10-28T19:58:48+08:00`, rendered in the host's
+*    local zone. The offset is part of the string, so the model needs no conversion and the value is
+*    never ambiguous again — while `event_date` stays `2026-10-28`, a calendar date with no zone.
+*  - {@link formatLocalHuman} — the HUMAN face (the 记忆 tab): `2026-10-28 19:58`, the same instant,
+*    local, to the minute.
+*
+* Both read the input through the SAME parser ({@link parseUtcTs}) and the same instant, so the two
+* faces cannot disagree. The UI deliberately formats the model face's OWN string rather than
+* re-deriving one from the raw column: the input it gets already carries an offset, `parseUtcTs`
+* leaves an explicit offset alone, and there is therefore exactly ONE parse rule and ONE pair of
+* renderers in the repository — not a second opinion in the browser.
+*
+* Dependency-free on purpose: this module is reachable from the DSH client bundle through the
+* `@avantf/mem-contract/time` subpath (the bundle must not pull in the tool schemas / zod). It has no
+* DSH host and no DB, so the engine, the CLI and the MCP face can all use it.
+*
+* @module contract/time
+*/
+/** Two-digit, zero-padded — the only formatting primitive the two renderers share. */
+function pad2$2(value) {
+	return String(value).padStart(2, "0");
+}
+/**
+* `'YYYY-MM-DD HH:MM:SS'` (SQLite UTC) or ISO → epoch ms; null/garbage → null.
+*
+* A stamp with NO zone designator is read as UTC, not as local time. `Date.parse` treats a zone-less
+* ISO string as LOCAL, and everything in this store is written in UTC (`CURRENT_TIMESTAMP`, and
+* {@link formatUtcTs}), so handing one over as-is would shift every quota window and every decay
+* measurement by the host's UTC offset — a fact reinforced at 23:00 UTC+8 would look reinforced 8
+* hours earlier, and the 24h cap would open or close at the wrong moment. An explicit `Z` or
+* `±HH:MM` is left alone (that is what makes a `formatOffsetIso` output safe to feed back in).
+*/
+function parseUtcTs(ts) {
+	if (ts === null || ts === void 0 || ts === "") return null;
+	const iso = ts.includes("T") ? ts : ts.replace(" ", "T");
+	const zoned = /(?:Z|[+-]\d{2}:?\d{2})$/i.test(iso) ? iso : `${iso}Z`;
+	const ms = Date.parse(zoned);
+	return Number.isFinite(ms) ? ms : null;
+}
+/** Epoch ms → `'YYYY-MM-DD HH:MM:SS'` (the SQLite `CURRENT_TIMESTAMP` shape, UTC). */
+function formatUtcTs(ms) {
+	return new Date(ms).toISOString().slice(0, 19).replace("T", " ");
+}
+/** The host's offset at that instant, as `+HH:MM` / `-HH:MM` (DST-correct: read from the Date). */
+function offsetSuffix(at) {
+	const minutesEast = -at.getTimezoneOffset();
+	const sign = minutesEast < 0 ? "-" : "+";
+	const abs = Math.abs(minutesEast);
+	return `${sign}${pad2$2(Math.floor(abs / 60))}:${pad2$2(abs % 60)}`;
+}
+/**
+* The MODEL face: an instant as ISO-8601 with an explicit offset, in the host's local zone
+* (`2026-10-28T19:58:48+08:00`).
+*
+* `null` — never `''` and never a fabricated stamp — when the value is absent or unreadable, so a
+* caller keeps its own "unknown" spelling (`''` for `created_at`, `null` for `updated_at`) instead of
+* rendering an empty time. `+00:00` (not `Z`) on a UTC host: the shape MUST carry a sign, which is
+* what a caller regex-checks.
+*/
+function formatOffsetIso(ts) {
+	const ms = parseUtcTs(ts);
+	if (ms === null) return null;
+	const at = new Date(ms);
+	return `${String(at.getFullYear())}-${pad2$2(at.getMonth() + 1)}-${pad2$2(at.getDate())}T${pad2$2(at.getHours())}:${pad2$2(at.getMinutes())}:${pad2$2(at.getSeconds())}` + offsetSuffix(at);
+}
+//#endregion
 //#region lib/types/prompt.js
 /**
 * The one system-prompt section this plugin contributes (DESIGN §10).
@@ -2299,8 +2563,13 @@ const DEFAULT_COMMON_CONFIG = `# avantf-mem 公共配置（分层第②层）。
 #   purge_after_archived_days: 365    # 归档事实的物理清理窗口（活跃日）
 #   contradiction_threshold: 0.6
 
-# trust:
-#   decay_per_day: 0.0055…
+# trust:                              # 信任与遗忘：旋钮是「天数 + 形状」，不是斜率
+#   base_lifetime_days: 90            # 锚点：0.5 起点 → 0 的活跃日数（新事实不被召回时的寿命）
+#   max_retention_days: 174           # 召回加强最多能换来的活跃日数；ceiling 由它反解（accelerating 下 ≈ 0.7492）
+#   decay_shape: accelerating         # accelerating（默认）| linear（回滚档：配 153 时 ceiling 回到 0.85）
+#   decay_curvature: 0.05             # accelerating 的下限项 a，合法区间 (0, 0.5]；linear 下不参与
+#   recall_gain_below_base: 0.1       # 低于基准 0.5 时每次召回加多少（封顶基准：0.05 起 5 次到 0.5）
+#   recall_gain_above_base: 0.01      # 高于基准 0.5 时每次召回加多少（封顶上面反解出的 ceiling）
 #   presence:
 #     heartbeat_minutes: 60           # 常驻进程的心跳（活跃日时钟与生命周期扫描）
 
@@ -2403,16 +2672,60 @@ function zodShape(schema) {
 	}
 }
 /**
+* The `trust.*` keys the v2 key replacement deleted (plan §4.1/§4.3), each with the sentence that
+* tells the operator what to write instead.
+*
+* They are still "unknown keys" — the config loader's existing channel — but the generic
+* `unknown config key(s) ignored: trust.decay_per_day` would silently change a lifetime the operator
+* had computed on purpose (`decay_per_day` → "how many days is my memory good for?" is exactly the
+* number that must not drift). Each message therefore names the replacement AND the conversion, computed
+* from the SHIPPED defaults (`base_lifetime_days: 90`, `decay_curvature: 0.05`) with the same
+* `trust_curve` functions the runtime uses.
+*
+* The default curve is read from `defaultConfig`, not written out as literals: if the shipped
+* anchor/curvature moves, these messages move with it instead of quoting stale numbers.
+*/
+const trustKeyWarning = (() => {
+	const shipped = curveOf(defaultConfig.trust);
+	const asDays = (shape, ceiling) => {
+		const days = retentionDaysForCeiling(ceiling, {
+			...shipped,
+			shape
+		});
+		return Number.isFinite(days) ? String(Math.round(days)) : "?";
+	};
+	return {
+		start: () => "trust.start is gone (v2): 起点冻结为 0.5（它与锚点 base_lifetime_days、召回基准是同一个数，不再可配，D20）。这一行删掉即可。",
+		decay_per_day: () => "trust.decay_per_day is gone (v2): 衰减形状由 trust.decay_shape 决定，\"能记多久\"用 trust.base_lifetime_days 与 trust.max_retention_days 表达。默认配置下一条 0.5 起点的事实仍然是 90 个活跃日归零——如果你的旧值就是为了这个，删掉即可。",
+		recall_floor: () => "trust.recall_floor is gone (v2): 基准 0.5 冻结；\"低于基准先爬回基准\"由 trust.recall_gain_below_base 表达（默认 0.1 ⇒ 0.05 起五次召回回到 0.5，不是一次）。这一行删掉即可。",
+		recall_delta: () => "trust.recall_delta is gone (v2): 召回加强改成分段增益——低于基准用 trust.recall_gain_below_base（默认 0.1，封顶基准）、高于基准用 trust.recall_gain_above_base（默认 0.01，仍乘 trust.recall_marginal_decay）；两者都不再等于旧的 0.03 一档。",
+		recall_ceiling: (value) => {
+			const ceiling = Number(value);
+			return `trust.recall_ceiling is gone (v2): 召回上限现在用"寿命"表达。你写的 ${String(value)} 等价于 trust.max_retention_days: ${asDays("linear", ceiling)}（decay_shape: linear） / ${asDays("accelerating", ceiling)}（decay_shape: accelerating，默认 a=0.05）；ceiling 由 max_retention_days 反解，不再可配。`;
+		}
+	};
+})();
+/** `trust.<key>` → the version-specific message, or `undefined` for a genuine typo. */
+function deprecatedTrustKey(key, value) {
+	if (!key.startsWith("trust.")) return void 0;
+	const explain = trustKeyWarning[key.slice(6)];
+	return explain === void 0 ? void 0 : explain(value);
+}
+/**
 * Warn once about unknown config keys — at the ROOT level and inside known sections
 * (TRUST_MODEL.md §7 / review R15+R23). This is generic typo protection, not legacy
 * compatibility: `vector_store` or `semantics` are exactly the mistakes it catches.
 *
+* A DELETED key earns its own sentence ({@link trustKeyWarning}): it is not a typo, and the operator
+* needs the replacement + the conversion, not "check the spelling".
+*
 * Goes to the injected logger, not the process-wide default: this is the one message
 * that tells an operator their config file is being partly ignored, and the DSH host
 * only surfaces what the plugin's logger carries.
 */
 function warnUnknownKeys(source, raw, rootShape, logger) {
 	const unknown = [];
+	const explained = [];
 	for (const [key, value] of Object.entries(raw)) {
 		const section = rootShape[key];
 		if (section === void 0) {
@@ -2421,8 +2734,15 @@ function warnUnknownKeys(source, raw, rootShape, logger) {
 		}
 		const childShape = zodShape(section);
 		if (childShape === void 0 || !isPlainObject(value)) continue;
-		for (const childKey of Object.keys(value)) if (childShape[childKey] === void 0) unknown.push(`${key}.${childKey}`);
+		for (const childKey of Object.keys(value)) {
+			const full = `${key}.${childKey}`;
+			if (childShape[childKey] !== void 0) continue;
+			const message = deprecatedTrustKey(full, value[childKey]);
+			if (message === void 0) unknown.push(full);
+			else explained.push(message);
+		}
 	}
+	for (const message of explained) logger.warn(`${source}: ${message}`);
 	if (unknown.length > 0) logger.warn(`${source}: unknown config key(s) ignored: ${unknown.join(", ")} — check the spelling against docs/DESIGN.md §3`);
 }
 /** Section-aware merge: top-level sections merge one level deep, scalars/arrays replace. */
@@ -3503,7 +3823,7 @@ async function runToolSpec$1(rt, spec, args) {
 //#region ../core/lib/trustHeartbeat.js
 /**
 * The trust heartbeat: the interval beat that advances the active-day clock and performs the
-* settle / forget / idle / purge sweeps (TRUST_MODEL.md §5), shared by the DSH plugin and the MCP
+* settle / forget / purge sweeps (TRUST_MODEL.md §5), shared by the DSH plugin and the MCP
 * server.
 *
 * The two surfaces used to install it separately, and the copies drifted in exactly the places a
@@ -5492,12 +5812,18 @@ const DDL = [
     conflict_checked  INTEGER NOT NULL DEFAULT 0,
     archived_at       TIMESTAMP,
     archive_reason    TEXT,
+    -- DEPRECATED (v2, D18): the per-fact TTL is gone. The column is kept so export / import /
+    -- snapshot formats stay readable and a rollback still finds its data, but nothing reads or
+    -- writes it any more (new rows keep the DEFAULT 0).
     ttl_days          INTEGER DEFAULT 0,
     -- P-07/P-13: when the fact became true and when it stopped being true. NULL = unknown, and no
-    -- retrieval leg reads either column (the envelope only carries them, and only when non-null).
-    -- valid_to is written by mem_remember valid_until WITHOUT archiving the row, which is what
-    -- makes "still active, known to end at T" representable at all; the two archival paths
-    -- (supersede, contradiction verdict) also stamp it for audit.
+    -- retrieval leg reads either column (the envelope only carries valid_from now, and only when
+    -- non-null). valid_from is the caller's event time (event_date, the event filter axis).
+    -- DEPRECATED (v2, D19): valid_to is no longer written (valid_until is gone, and so is the
+    -- archival audit stamp). UNLIKE ttl_days it does NOT round-trip: export writes valid_to: null
+    -- and restore ignores the field, deliberately, so an old "known end" cannot be resurrected as a
+    -- validity window. The column survives only so old exports/files stay readable and the DDL does
+    -- not churn; do not read a rollback guarantee into it.
     valid_from        TIMESTAMP,
     valid_to          TIMESTAMP,
     -- The INSTANTS those two bounds name, in epoch milliseconds (migration 12).
@@ -5524,10 +5850,8 @@ const DDL = [
 	`CREATE INDEX IF NOT EXISTS idx_facts_supersedes ON facts(supersedes_id)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_trust ON facts(status, pinned, settle_clock)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_updated ON facts(status, updated_at)`,
-	`CREATE INDEX IF NOT EXISTS idx_facts_ttl ON facts(status, ttl_days)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_purge ON facts(status, pinned, archived_clock)`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_forget ON facts(status, pinned, trust_score)`,
-	`CREATE INDEX IF NOT EXISTS idx_facts_idle_cutoff ON facts(status, pinned, julianday(COALESCE(last_retrieved_at, created_at)))`,
 	`CREATE INDEX IF NOT EXISTS idx_facts_bonus_window ON facts(bonus_window_at)`,
 	`CREATE TABLE IF NOT EXISTS fact_sources (
     fact_id INTEGER NOT NULL REFERENCES facts(fact_id) ON DELETE CASCADE,
@@ -7868,7 +8192,7 @@ function timeParams(range) {
 	return timeSql(range)?.params ?? [];
 }
 /**
-* One stored `valid_from`/`valid_to` string → epoch ms, using the SAME grammar as the filters.
+* One stored event-time (`valid_from`) string → epoch ms, using the SAME grammar as the filters.
 *
 * This is what the write path stamps into `valid_from_ms` and what migration 12's backfill applies to
 * existing rows, so "the event time a caller wrote" and "the event time a window compares" can never
@@ -8762,6 +9086,14 @@ const MEMORY_SCHEMA = {
 				db.exec(TITLE_ALIASES_TABLE_DDL);
 				for (const sql of TITLE_ALIASES_INDEXES) db.exec(sql);
 			}
+		},
+		{
+			version: 18,
+			name: "retire-ttl-and-valid-to",
+			up: (db) => {
+				db.exec("DROP INDEX IF EXISTS idx_facts_idle_cutoff");
+				db.exec("DROP INDEX IF EXISTS idx_facts_ttl");
+			}
 		}
 	]
 };
@@ -9014,6 +9346,102 @@ function entityBags(db, ids, q) {
 	return out;
 }
 //#endregion
+//#region ../core/lib/lifecycle/trust.js
+const DAY_MS$1 = 864e5;
+/** The reinforcement quota window is a CALENDAR day ("每天" is a calendar notion, §2.3). */
+const QUOTA_WINDOW_MS = DAY_MS$1;
+function clamp01(v) {
+	if (!Number.isFinite(v)) return 0;
+	return Math.min(1, Math.max(0, v));
+}
+/** The curve of one `trust` section — the single mapping from config keys to the math. */
+function trustCurveOf(cfg) {
+	return curveOf(cfg);
+}
+function isPinned(row) {
+	return Number(row.pinned) === 1;
+}
+/** eff(f) — the trust a caller should act on right now (spec §2.2). */
+function effectiveTrust(row, clock, cfg, enabled = cfg.enabled) {
+	if (!enabled) return clamp01(row.trust_score);
+	if (isPinned(row)) return 1;
+	return clamp01(trustAfterDays(row.trust_score, clock - row.settle_clock, trustCurveOf(cfg)));
+}
+/**
+* What a caller should SEE for a row — the R11 display rule (spec §6):
+* `active` → `eff()`; **non-active → the stored value verbatim** (the decay
+* formula keeps running mathematically for archived rows, so the projection must
+* not use it), and `enabled=false` → stored value (D12).
+*/
+function displayTrust(row, clock, cfg, enabled = cfg.enabled) {
+	if (row.status !== "active") return clamp01(row.trust_score);
+	return effectiveTrust(row, clock, cfg, enabled);
+}
+/**
+* Remaining active days: the inverse of the curve at the current eff (`daysToZero`).
+* `null` for pinned rows, non-active rows and when trust is disabled — the contract's
+* `remaining_days` (spec §6 / R11).
+*/
+function remainingDays(row, clock, cfg, enabled = cfg.enabled) {
+	if (row.status !== "active" || isPinned(row) || !enabled) return null;
+	return daysToZero(effectiveTrust(row, clock, cfg, enabled), trustCurveOf(cfg));
+}
+function rollWindow(row, nowMs) {
+	const at = row.bonus_window_at;
+	const started = parseUtcTs(at);
+	if (at === null || started === null || nowMs - started >= QUOTA_WINDOW_MS) return {
+		count: 0,
+		at: formatUtcTs(nowMs),
+		reset: true
+	};
+	return {
+		count: row.bonus_count ?? 0,
+		at,
+		reset: false
+	};
+}
+/**
+* Apply one recall to a fact: settle, then grant a bonus inside the daily quota.
+* Returns `next === settled` when the quota is exhausted, the ceiling is reached,
+* the fact is pinned, or the gain would be zero (R2/R10/D11).
+*
+* The gain is SEGMENTED at the frozen anchor `BASE_TRUST` (D20):
+*  - strictly below the base: `min(BASE_TRUST, T + recall_gain_below_base)`, so the shipped
+*    `recall_gain_below_base: 0.1` takes 0.05 → 0.5 in five recalls and never past the base;
+*  - AT OR ABOVE the base: `recall_gain_above_base × marginal_decay^count`, capped at the ceiling
+*    INVERTED from `max_retention_days` (there is no `recall_ceiling` key any more, D16). The
+*    boundary is strictly `<` on purpose: a fact sitting exactly on the base (a fresh one, on the
+*    first recall after it has finished settling) takes the above-base branch and starts climbing.
+*/
+function grantRecallBonus(row, clock, nowMs, cfg, enabled = cfg.enabled) {
+	const settled = effectiveTrust(row, clock, cfg, enabled);
+	const window = rollWindow(row, nowMs);
+	if (row.status !== "active" || isPinned(row) || !enabled || window.count >= cfg.recall_daily_cap) return {
+		settled,
+		next: settled,
+		granted: false,
+		bonusCount: window.count,
+		windowAt: window.at
+	};
+	const gain = cfg.recall_gain_above_base * Math.pow(cfg.recall_marginal_decay, window.count);
+	const ceiling = ceilingForDays(cfg.max_retention_days, trustCurveOf(cfg));
+	const next = settled < .5 ? Math.max(settled, Math.min(BASE_TRUST, settled + cfg.recall_gain_below_base)) : Math.max(settled, Math.min(ceiling, settled + gain));
+	if (next <= settled + 1e-9) return {
+		settled,
+		next: settled,
+		granted: false,
+		bonusCount: window.count,
+		windowAt: window.at
+	};
+	return {
+		settled,
+		next,
+		granted: true,
+		bonusCount: window.count + 1,
+		windowAt: window.at
+	};
+}
+//#endregion
 //#region ../core/lib/db/dao/facts.js
 /**
 * The column a pure time window orders by — the axis the caller filtered on.
@@ -9051,7 +9479,7 @@ const FACT_COLUMNS_NO_BLOB = `fact_id, content, kind, title, tags, trust_score,
     pinned, pinned_at, bonus_count, bonus_window_at, last_reinforced_at, archived_clock,
     retrieval_count, helpful_count, last_retrieved_at, embedding_model, vector_store, status,
     supersedes_id, entities_version, conflict_checked, archived_at, archive_reason, ttl_days,
-    valid_from, valid_to, valid_from_ms, valid_to_ms, assert_count, created_at, updated_at`;
+    valid_from, valid_from_ms, assert_count, created_at, updated_at`;
 /**
 * The FTS leg's exact SQL, exported so the plan guard (`test/fts_plan.spec.ts`) and the bench
 * control group EXPLAIN the production text itself instead of a copy that can silently drift.
@@ -9369,12 +9797,11 @@ var FactsDao = class FactsDao {
 		const out = /* @__PURE__ */ new Map();
 		if (!ids.length) return out;
 		const { placeholders, values } = inList(ids);
-		const rows = this.db.prepare(`SELECT fact_id, created_at, updated_at, valid_from, valid_to, title FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
+		const rows = this.db.prepare(`SELECT fact_id, created_at, updated_at, valid_from, title FROM facts WHERE fact_id IN (${placeholders})`).all(...values);
 		for (const row of rows) out.set(row.fact_id, {
 			created_at: row.created_at === null ? "" : String(row.created_at),
 			updated_at: row.updated_at === null ? null : String(row.updated_at),
 			valid_from: row.valid_from === null || row.valid_from === void 0 ? null : String(row.valid_from),
-			valid_to: row.valid_to === null || row.valid_to === void 0 ? null : String(row.valid_to),
 			title: row.title === null || row.title === void 0 || row.title === "" ? null : String(row.title)
 		});
 		return out;
@@ -9414,31 +9841,33 @@ var FactsDao = class FactsDao {
 	* `createdAt` is named EXPLICITLY rather than left to the column DEFAULT, because a
 	* superseding revision must INHERIT the archived row's `created_at` (the memory's first
 	* assertion date, distinct from when its text was rewritten). `updated_at` and
-	* `last_retrieved_at` are stamped `CURRENT_TIMESTAMP` in the same statement: a revision
-	* whose `created_at` is old must not be judged idle by the next tick, where "idle" reads
-	* `COALESCE(last_retrieved_at, created_at)`.
+	* `last_retrieved_at` are stamped `CURRENT_TIMESTAMP` in the same statement, so a revision
+	* carries a fresh "last used" observation like the row it replaces (that column no longer
+	* feeds any decision — see TRUST_MODEL.md §2.6).
+	*
+	* `ttl_days` is NOT named: TTL is gone (v2), the column keeps its DEFAULT 0 and nothing
+	* reads or writes it any more.
 	*/
 	insertRevision(v) {
 		return this.db.prepare(`INSERT OR IGNORE INTO facts
-           (content, kind, title, ttl_days, supersedes_id, hrr_vector,
+           (content, kind, title, supersedes_id, hrr_vector,
             trust_score, settle_clock, pinned, pinned_at, bonus_count, bonus_window_at,
-            entities_version, conflict_checked, valid_from, valid_to, valid_from_ms, valid_to_ms,
+            entities_version, conflict_checked, valid_from, valid_from_ms,
             created_at, updated_at, last_retrieved_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, 0, ?, ?, ?, ?,
-                 ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`).run(v.content, v.kind, v.title ?? null, v.ttlDays, v.supersedesId, v.hrr, v.trust, v.clock, v.pinned, v.pinnedAt, v.windowAt, 3, v.validFrom ?? null, v.validTo ?? null, v.validFromMs ?? null, v.validToMs ?? null, v.createdAt);
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, 0, ?, ?,
+                 ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`).run(v.content, v.kind, v.title ?? null, v.supersedesId, v.hrr, v.trust, v.clock, v.pinned, v.pinnedAt, v.windowAt, 3, v.validFrom ?? null, v.validFromMs ?? null, v.createdAt);
 	}
 	/**
-	* P-10: land an explicitly given validity on a row that already exists (a duplicate `add` whose
-	* caller named `event_date` / `valid_until`). Omitted arguments keep what the row has, exactly
-	* like `kind`/`ttl_days` (see `add`'s doc).
+	* P-10: land an explicitly given event time on a row that already exists (a duplicate `add`
+	* whose caller named `event_date`). An omitted argument keeps what the row has, exactly like
+	* `kind` (see `add`'s doc).
 	*/
-	applyValidity(factId, validFrom, validTo) {
-		if (validFrom === void 0 && validTo === void 0) return;
+	applyValidity(factId, validFrom) {
+		if (validFrom === void 0) return;
 		this.db.prepare(`UPDATE facts
             SET valid_from = COALESCE(?, valid_from), valid_from_ms = COALESCE(?, valid_from_ms),
-                valid_to = COALESCE(?, valid_to), valid_to_ms = COALESCE(?, valid_to_ms),
                 updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(validFrom?.text ?? null, validFrom?.ms ?? null, validTo?.text ?? null, validTo?.ms ?? null, factId);
+          WHERE fact_id = ?`).run(validFrom.text, validFrom.ms, factId);
 	}
 	/** P-10: the row's assertion counter (`1` when the column is somehow NULL on a legacy row). */
 	assertCount(factId) {
@@ -9458,17 +9887,6 @@ var FactsDao = class FactsDao {
 		return Number(row?.n ?? 1);
 	}
 	/**
-	* P-07 audit: stamp `valid_to` on a row that is leaving the active corpus (supersede / a
-	* contradiction verdict). `COALESCE` keeps an end the caller already declared (`valid_until`):
-	* overwriting it with the archival instant would replace a real answer with an administrative one.
-	*/
-	markValidTo(factId, at, atMs = null) {
-		this.db.prepare(`UPDATE facts
-            SET valid_to = COALESCE(valid_to, ?),
-                valid_to_ms = CASE WHEN valid_to IS NULL THEN ? ELSE valid_to_ms END
-          WHERE fact_id = ?`).run(at, atMs, factId);
-	}
-	/**
 	* P-07: "who superseded this fact", derived from the existing `supersedes_id` link — no
 	* redundant column. `MIN` is deterministic when several revisions named the same predecessor
 	* (which a merge can produce); the caller renders it as a single direct successor.
@@ -9629,17 +10047,22 @@ var FactsDao = class FactsDao {
 		}
 		return changes;
 	}
-	/** Revive an archived row (R18/R19: refresh the idle clock, clear the archive bookkeeping). */
-	revive(factId, kind, ttlDays, trust, clock) {
+	/**
+	* Revive an archived row (R19: clear the archive bookkeeping / refresh `last_retrieved_at`).
+	*
+	* `ttl_days` is deliberately NOT named any more: an omitted column keeps whatever the row has
+	* (the old writing value is preserved as data), and there is no TTL left to inherit.
+	*/
+	revive(factId, kind, trust, clock) {
 		return this.db.prepare(`UPDATE facts
             SET status = 'active', archived_at = NULL, archive_reason = NULL, archived_clock = NULL,
-                kind = ?, ttl_days = ?, trust_score = ?, settle_clock = ?,
+                kind = ?, trust_score = ?, settle_clock = ?,
                 last_retrieved_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ? AND status = 'archived'`).run(kind, ttlDays, trust, clock, factId).changes;
+          WHERE fact_id = ? AND status = 'archived'`).run(kind, trust, clock, factId).changes;
 	}
-	/** Land explicit kind/TTL on a row that already exists (pure duplicate). */
-	applyValues(factId, kind, ttlDays) {
-		this.db.prepare("UPDATE facts SET kind = ?, ttl_days = ?, updated_at = CURRENT_TIMESTAMP WHERE fact_id = ?").run(kind, ttlDays, factId);
+	/** Land an explicit kind on a row that already exists (pure duplicate). */
+	applyValues(factId, kind) {
+		this.db.prepare("UPDATE facts SET kind = ?, updated_at = CURRENT_TIMESTAMP WHERE fact_id = ?").run(kind, factId);
 	}
 	/**
 	* Land a title on a row that already exists — the ONE write behind every "backfill" path
@@ -9716,13 +10139,12 @@ var FactsDao = class FactsDao {
 		this.db.prepare("UPDATE facts SET supersedes_id = ? WHERE fact_id = ? AND supersedes_id IS NULL").run(supersedesId, factId);
 	}
 	/**
-	* Restore an archived fact, settling its trust and refreshing the idle clock (spec §2.6).
+	* Restore an archived fact, settling its trust and refreshing `last_retrieved_at` (spec §2.6).
 	*
 	* `AND status = 'archived'` is load-bearing, like the guard on every sibling above: this UPDATE
 	* clears the archive bookkeeping and refreshes `last_retrieved_at`, so ungated it would take an
-	* ACTIVE row and (a) push its idle clock forward — silently extending the life of a fact the next
-	* tick was about to re-archive — and (b) reset `trust_score` to the settled value it computed. It
-	* returned `1` either way, so the caller could not tell that a row it never asked about had moved.
+	* ACTIVE row and reset `trust_score` to the settled value it computed. It returned `1` either
+	* way, so the caller could not tell that a row it never asked about had moved.
 	*/
 	restore(factId, trust, clock) {
 		return this.db.prepare(`UPDATE facts
@@ -9730,32 +10152,6 @@ var FactsDao = class FactsDao {
                 trust_score = ?, settle_clock = ?, last_retrieved_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
           WHERE fact_id = ? AND status = 'archived'`).run(trust, clock, factId).changes;
 	}
-	bumpHelpful(factId, delta) {
-		this.db.prepare("UPDATE facts SET helpful_count = MAX(0, helpful_count + ?) WHERE fact_id = ?").run(delta, factId);
-	}
-	/** Feedback outcome: pin at the permanent threshold (trust snaps to 1). */
-	pinOutcome(factId, clock, bonusCount, windowAt) {
-		this.db.prepare(`UPDATE facts
-            SET trust_score = 1, pinned = 1, pinned_at = COALESCE(pinned_at, CURRENT_TIMESTAMP),
-                settle_clock = ?, bonus_count = ?, bonus_window_at = ?, archived_clock = NULL,
-                last_reinforced_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(clock, bonusCount, windowAt, factId);
-	}
-	/** Feedback outcome: the forget line was reached — archive in the same statement. */
-	forgetOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.db.prepare(`UPDATE facts
-            SET trust_score = ?, settle_clock = ?, bonus_count = ?, bonus_window_at = ?,
-                status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = ?,
-                archive_reason = 'forgot', updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(trust, clock, bonusCount, windowAt, clock, factId);
-	}
-	/** Feedback outcome: reinforced (or decayed) but still active. */
-	reinforceOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.db.prepare(`UPDATE facts
-            SET trust_score = ?, settle_clock = ?, bonus_count = ?, bonus_window_at = ?,
-                last_reinforced_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
-          WHERE fact_id = ?`).run(trust, clock, bonusCount, windowAt, factId);
-	}
 	pin(factId, clock) {
 		return this.db.prepare(`UPDATE facts
             SET pinned = 1, pinned_at = COALESCE(pinned_at, CURRENT_TIMESTAMP), trust_score = 1,
@@ -9844,17 +10240,25 @@ var FactsDao = class FactsDao {
 		return Number(this.db.prepare("SELECT COUNT(*) AS n FROM facts WHERE status = 'active' AND pinned = 1").get()?.n ?? 0);
 	}
 	/**
-	* ACTIVE facts whose decayed trust would reach zero within `withinDays` ACTIVE days —
-	* i.e. `trust_score - step × (clock - settle_clock) <= step × withinDays`.
+	* ACTIVE, unpinned facts whose decayed trust reaches zero within `withinDays` ACTIVE days.
+	*
+	* EXACT for every shape, not a linear approximation: the predicate is
+	* `trustAfterDays(eff(now), withinDays, curve) <= 0`, which is the same question the tick asks
+	* when it archives a row. The caller passes the THRESHOLD (`ceilingForDays(withinDays, curve)`)
+	* because "days until zero" is no longer `trust ÷ slope` under `decay_shape: 'accelerating'`;
+	* a slope-based SQL predicate under-reported every fact in `(slope × 7, ceilingForDays(7)]`
+	* (0.0277 … 0.0515 at the shipped defaults) once accelerating became the default.
+	*
+	* COST: one row per active unpinned fact, evaluated in JS — the predicate needs `exp`, which the
+	* SQL layer cannot express portably. `trust_diagnose` is an operator-only diagnostic and the
+	* active set is what `mem_admin list` already walks; if it ever shows up in a profile, prefilter
+	* with an index-friendly bound rather than going back to a slope approximation.
 	*/
 	countForgettingWithin(p) {
-		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts
-            WHERE status = 'active' AND pinned = 0
-              AND (trust_score - :step * (:clock - settle_clock)) <= :step * :soon`).get({
-			step: p.step,
-			clock: p.clock,
-			soon: p.withinDays
-		})?.n ?? 0);
+		const rows = this.db.prepare(`SELECT trust_score, settle_clock FROM facts WHERE status = 'active' AND pinned = 0`).all();
+		let n = 0;
+		for (const row of rows) if (trustAfterDays(Number(row.trust_score), p.clock - Number(row.settle_clock), p.curve) <= p.threshold) n += 1;
+		return n;
 	}
 	/** Facts with a still-live (calendar 24h) reinforcement window — the per-fact quota. */
 	/**
@@ -9874,31 +10278,15 @@ var FactsDao = class FactsDao {
 			granted: Number(row?.granted ?? 0)
 		};
 	}
-	/** ACTIVE, unpinned facts unused for `days` CALENDAR days (the idle-archival fallback). */
-	countIdleCandidates(days) {
-		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts
-            WHERE status = 'active' AND pinned = 0
-              AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :modifier)`).get({ modifier: `-${days} days` })?.n ?? 0);
-	}
 	/**
-	* Rows still due for ②③④ after a budgeted tick — what the NEXT pass will archive.
+	* Rows still due for ② after a budgeted tick — what the NEXT pass will archive.
 	*
-	* One statement over the three predicates (they are alternatives, and the sets are disjoint:
-	* a row has either a TTL, a forgotten trust score, or an idle clock). Only called when a step
-	* actually filled its budget, so the common tick pays nothing for it.
+	* The same predicate the archival statement runs (`FORGET_PREDICATE`), so "backlog" and "what
+	* `archiveForgotten` will do next" cannot disagree. Only called when ② actually filled its
+	* budget, so the common tick pays nothing for it.
 	*/
 	countArchiveBacklog(p) {
-		const params = {
-			forgetThreshold: p.forgetThreshold,
-			idleModifier: `-${p.idleCalendarDays} days`
-		};
-		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM (
-             SELECT fact_id FROM facts WHERE status = 'active' AND ttl_days > 0
-               AND julianday('now') - julianday(created_at) > ttl_days
-             UNION SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold
-             UNION SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0
-               AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :idleModifier)
-           )`).get(params)?.n ?? 0);
+		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts WHERE ${FactsDao.FORGET_PREDICATE}`).get({ forgetThreshold: p.forgetThreshold })?.n ?? 0);
 	}
 	/**
 	* Drop unusable (stale-dim) vectors so a re-encode can replace them — and re-queue the same
@@ -10237,48 +10625,60 @@ var FactsDao = class FactsDao {
 	* row, and `settle_clock < c` is a seek + range scan of exactly the pending rows.
 	*/
 	static SETTLE_PREDICATE = "status = 'active' AND pinned = 0 AND settle_clock < CAST(:clock AS INTEGER)";
-	/** ① materialize decay, bounded to `budget` rows. */
+	/**
+	* The ONE forgetting predicate, shared by the archival statement and its backlog count.
+	*
+	* Kept as a constant for the same reason as {@link SETTLE_PREDICATE}: the count answers "how many
+	* will the next pass archive", so it must be the same WHERE body the archival itself runs —
+	* otherwise `archived_deferred` and the actual sweep would drift apart.
+	*/
+	static FORGET_PREDICATE = "status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold";
+	/**
+	* ① materialize decay, bounded to `budget` rows.
+	*
+	* PER ROW, through `trustAfterDays` — not one UPDATE with an inline `trust_score − step·Δ`. The
+	* formula lives in `contract/src/trust_curve.ts` and nowhere else; the `linear` branch of that
+	* function is bit-identical to the statement this replaced (`T − days·slope`, the same two
+	* operations in the same order), so P3's equivalent tier materializes exactly the same numbers.
+	*
+	* The SELECT is the old UPDATE's WHERE body with the old subquery's ORDER/LIMIT, so the row SET is
+	* the same one the statement would have touched (and `settled` still counts rows matched, not rows
+	* whose value happened to move).
+	*
+	* COST: one `UPDATE` PER ROW inside the tick's single `IMMEDIATE` transaction (the accelerating
+	* formula needs `exp`, which SQL cannot express here, and a second SQL implementation would
+	* drift). That is why every caller is budgeted by `trust.tick_max_facts` (5000 by default) and
+	* `admin maintenance` is the only unbudgeted pass — measured ~22 ms per 5000 rows, inside the
+	* tick's budget; it is a deliberate trade, not a regression.
+	*/
 	settleBudgeted(p) {
-		return this.db.prepare(`UPDATE facts
-            SET trust_score = MAX(0, MIN(1, trust_score - :step * (:clock - settle_clock))),
-                settle_clock = :clock
+		const rows = this.db.prepare(`SELECT fact_id, trust_score, settle_clock FROM facts
           WHERE ${FactsDao.SETTLE_PREDICATE}
-            AND fact_id IN (SELECT fact_id FROM facts WHERE ${FactsDao.SETTLE_PREDICATE} ORDER BY settle_clock ASC LIMIT :budget)`).run(p).changes;
+          ORDER BY settle_clock ASC LIMIT :budget`).all({
+			clock: p.clock,
+			budget: p.budget
+		});
+		return this.settleRows(rows, p.clock, p.curve);
 	}
 	/** ① materialize decay for every pending row (no budget). */
 	settleAll(p) {
-		return this.db.prepare(`UPDATE facts
-            SET trust_score = MAX(0, MIN(1, trust_score - :step * (:clock - settle_clock))),
-                settle_clock = :clock
-          WHERE ${FactsDao.SETTLE_PREDICATE}`).run(p).changes;
+		const rows = this.db.prepare(`SELECT fact_id, trust_score, settle_clock FROM facts
+          WHERE ${FactsDao.SETTLE_PREDICATE}
+          ORDER BY settle_clock ASC`).all({ clock: p.clock });
+		return this.settleRows(rows, p.clock, p.curve);
+	}
+	/** The shared per-row write of ①: settle the curve at `clock`, then stamp `settle_clock`. */
+	settleRows(rows, clock, curve) {
+		const stmt = this.db.prepare("UPDATE facts SET trust_score = ?, settle_clock = ? WHERE fact_id = ?");
+		for (const row of rows) stmt.run(clamp01(trustAfterDays(Number(row.trust_score), clock - Number(row.settle_clock), curve)), clock, row.fact_id);
+		return rows.length;
 	}
 	/** Rows still awaiting ① (the budget ran out). */
 	countPendingSettle(p) {
 		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM facts WHERE ${FactsDao.SETTLE_PREDICATE}`).get(p)?.n ?? 0);
 	}
 	/**
-	* ② calendar TTL — explicit instruction, so `pinned` is NOT exempt.
-	*
-	* `budget` (0 = none) caps how many rows ONE tick may archive: the tick is a single IMMEDIATE
-	* transaction shared by several processes, so an unbudgeted pass over a large backlog held the
-	* write lock for as long as it took (measured 14400 rows in one tick). The remainder stays due
-	* and is reported as a deferred count, then archived by the next tick.
-	*/
-	archiveExpiredByTtl(p) {
-		return this.db.prepare(`UPDATE facts
-            SET status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = :clock, archive_reason = 'ttl'
-          WHERE status = 'active' AND ttl_days > 0
-            AND julianday('now') - julianday(created_at) > ttl_days
-            AND (:budget = 0 OR fact_id IN (
-                  SELECT fact_id FROM facts WHERE status = 'active' AND ttl_days > 0
-                    AND julianday('now') - julianday(created_at) > ttl_days LIMIT :budget))
-          RETURNING fact_id`).all({
-			clock: p.clock,
-			budget: p.budget ?? 0
-		}).map((row) => row.fact_id);
-	}
-	/**
-	* ③ trust-driven forgetting (① already clamped trust to the threshold).
+	* ② trust-driven forgetting (① already clamped trust to the threshold).
 	*
 	* Sargable as written (`status`/`pinned` equality + `trust_score <= ?`), and served by
 	* `idx_facts_forget(status, pinned, trust_score)`: before that index this statement read every
@@ -10287,9 +10687,9 @@ var FactsDao = class FactsDao {
 	archiveForgotten(p) {
 		return this.db.prepare(`UPDATE facts
             SET status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = :clock, archive_reason = 'forgot'
-          WHERE status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold
+          WHERE ${FactsDao.FORGET_PREDICATE}
             AND (:budget = 0 OR fact_id IN (
-                  SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0 AND trust_score <= :forgetThreshold LIMIT :budget))
+                  SELECT fact_id FROM facts WHERE ${FactsDao.FORGET_PREDICATE} LIMIT :budget))
           RETURNING fact_id`).all({
 			clock: p.clock,
 			forgetThreshold: p.forgetThreshold,
@@ -10297,29 +10697,7 @@ var FactsDao = class FactsDao {
 		}).map((row) => row.fact_id);
 	}
 	/**
-	* ④ calendar fallback: never touched for `idle_calendar_days`.
-	*
-	* The comparison is written as `<expression> < julianday('now', :modifier)` — the same
-	* expression `idx_facts_idle_cutoff` indexes — so it is a range seek. The old form
-	* (`julianday('now') - <expression> > :days`) called `julianday` on EVERY active row and could
-	* not use any index (measured 33–212 ms at 180k).
-	*/
-	archiveIdle(p) {
-		return this.db.prepare(`UPDATE facts
-            SET status = 'archived', archived_at = CURRENT_TIMESTAMP, archived_clock = :clock, archive_reason = 'idle'
-          WHERE status = 'active' AND pinned = 0
-            AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :idleModifier)
-            AND (:budget = 0 OR fact_id IN (
-                  SELECT fact_id FROM facts WHERE status = 'active' AND pinned = 0
-                    AND julianday(COALESCE(last_retrieved_at, created_at)) < julianday('now', :idleModifier) LIMIT :budget))
-          RETURNING fact_id`).all({
-			clock: p.clock,
-			idleModifier: `-${p.idleCalendarDays} days`,
-			budget: p.budget ?? 0
-		}).map((row) => row.fact_id);
-	}
-	/**
-	* ⑤ physical delete of archived rows past the retention window.
+	* ③ physical delete of archived rows past the retention window.
 	*
 	* TWO statements in this order, sharing one predicate:
 	*
@@ -10328,7 +10706,7 @@ var FactsDao = class FactsDao {
 	*      DELETE below failed with `SQLITE_CONSTRAINT_FOREIGNKEY` whenever a revision chain
 	*      crossed `purge_after_archived_days`. Because the whole tick is ONE transaction and it
 	*      runs from the store's constructor, that failure did not merely skip the purge: it rolled
-	*      back settle/TTL/idle with it and left the process unable to start, permanently.
+	*      back settle/forget with it and left the process unable to start, permanently.
 	*   2. delete them.
 	*
 	* The predicate is built once and interpolated into both statements, so "which rows are
@@ -10373,7 +10751,7 @@ var FactsDao = class FactsDao {
 			purgeModifier: `-${p.purgeAfterDays} days`
 		};
 	}
-	/** Archived rows still due for ⑤ after a budgeted pass (0 when the pass finished them). */
+	/** Archived rows still due for ③ after a budgeted pass (0 when the pass finished them). */
 	countPurgeBacklog(p) {
 		const [a, b] = FactsDao.purgeBranches(p);
 		return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM (
@@ -11470,156 +11848,6 @@ var FactSourcesDao = class {
 	}
 };
 //#endregion
-//#region ../core/lib/lifecycle/trust.js
-const DAY_MS$1 = 864e5;
-/** The reinforcement quota window is a CALENDAR day ("每天" is a calendar notion, §2.3). */
-const QUOTA_WINDOW_MS = DAY_MS$1;
-function clamp01(v) {
-	if (!Number.isFinite(v)) return 0;
-	return Math.min(1, Math.max(0, v));
-}
-function isPinned(row) {
-	return Number(row.pinned) === 1;
-}
-/**
-* `'YYYY-MM-DD HH:MM:SS'` (SQLite UTC) or ISO → epoch ms; null/garbage → null.
-*
-* A stamp with NO zone designator is read as UTC, not as local time. `Date.parse` treats a zone-less
-* ISO string as LOCAL, and everything in this store is written in UTC (`CURRENT_TIMESTAMP`, and
-* {@link formatUtcTs}), so handing one over as-is would shift every quota window and every decay
-* measurement by the host's UTC offset — a fact reinforced at 23:00 UTC+8 would look reinforced 8
-* hours earlier, and the 24h cap would open or close at the wrong moment. An explicit `Z` or
-* `±HH:MM` is left alone.
-*/
-function parseUtcTs(ts) {
-	if (ts === null || ts === void 0 || ts === "") return null;
-	const iso = ts.includes("T") ? ts : ts.replace(" ", "T");
-	const zoned = /(?:Z|[+-]\d{2}:?\d{2})$/i.test(iso) ? iso : `${iso}Z`;
-	const ms = Date.parse(zoned);
-	return Number.isFinite(ms) ? ms : null;
-}
-/** Epoch ms → `'YYYY-MM-DD HH:MM:SS'` (the SQLite `CURRENT_TIMESTAMP` shape, UTC). */
-function formatUtcTs(ms) {
-	return new Date(ms).toISOString().slice(0, 19).replace("T", " ");
-}
-/** eff(f) — the trust a caller should act on right now (spec §2.2). */
-function effectiveTrust(row, clock, cfg, enabled = cfg.enabled) {
-	if (!enabled) return clamp01(row.trust_score);
-	if (isPinned(row)) return 1;
-	return clamp01(row.trust_score - cfg.decay_per_day * (clock - row.settle_clock));
-}
-/**
-* What a caller should SEE for a row — the R11 display rule (spec §6):
-* `active` → `eff()`; **non-active → the stored value verbatim** (the decay
-* formula keeps running mathematically for archived rows, so the projection must
-* not use it), and `enabled=false` → stored value (D12).
-*/
-function displayTrust(row, clock, cfg, enabled = cfg.enabled) {
-	if (row.status !== "active") return clamp01(row.trust_score);
-	return effectiveTrust(row, clock, cfg, enabled);
-}
-/**
-* Remaining active days: `eff / step`. `null` for pinned rows, non-active rows and
-* when trust is disabled — the contract's `remaining_days` (spec §6 / R11).
-*/
-function remainingDays(row, clock, cfg, enabled = cfg.enabled) {
-	if (row.status !== "active" || isPinned(row) || !enabled || cfg.decay_per_day <= 0) return null;
-	return effectiveTrust(row, clock, cfg, enabled) / cfg.decay_per_day;
-}
-function rollWindow(row, nowMs) {
-	const at = row.bonus_window_at;
-	const started = parseUtcTs(at);
-	if (at === null || started === null || nowMs - started >= QUOTA_WINDOW_MS) return {
-		count: 0,
-		at: formatUtcTs(nowMs),
-		reset: true
-	};
-	return {
-		count: row.bonus_count ?? 0,
-		at,
-		reset: false
-	};
-}
-/**
-* Apply one recall to a fact: settle, then grant a bonus inside the daily quota.
-* Returns `next === settled` when the quota is exhausted, the ceiling is reached,
-* the fact is pinned, or the gain would be zero (R2/R10/D11).
-*/
-function grantRecallBonus(row, clock, nowMs, cfg, enabled = cfg.enabled) {
-	const settled = effectiveTrust(row, clock, cfg, enabled);
-	const window = rollWindow(row, nowMs);
-	if (row.status !== "active" || isPinned(row) || !enabled || window.count >= cfg.recall_daily_cap) return {
-		settled,
-		next: settled,
-		granted: false,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	const gain = cfg.recall_delta * Math.pow(cfg.recall_marginal_decay, window.count);
-	const next = settled <= cfg.recall_floor ? Math.max(settled, cfg.recall_floor) : Math.max(settled, Math.min(cfg.recall_ceiling, settled + gain));
-	if (next <= settled + 1e-9) return {
-		settled,
-		next: settled,
-		granted: false,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	return {
-		settled,
-		next,
-		granted: true,
-		bonusCount: window.count + 1,
-		windowAt: window.at
-	};
-}
-/**
-* Apply one explicit `helpful` (+1) / `unhelpful` (-1) step.
-*
-* Pinned and archived rows are untouched (R7): only `helpful_count` changes for
-* them, so a pinned fact can never end up storing 0.95 while displaying 1.0.
-* When `feedback_daily_cap > 0` feedback shares the per-fact 24h window counter.
-*/
-function applyFeedbackDelta(row, clock, delta, nowMs, cfg, enabled = cfg.enabled) {
-	const settled = effectiveTrust(row, clock, cfg, enabled);
-	const shared = cfg.feedback_daily_cap > 0;
-	const window = shared ? rollWindow(row, nowMs) : {
-		count: row.bonus_count ?? 0,
-		at: row.bonus_window_at ?? formatUtcTs(nowMs),
-		reset: false
-	};
-	if (row.status !== "active" || isPinned(row) || !enabled) return {
-		settled,
-		next: row.trust_score,
-		pin: false,
-		forget: false,
-		untouched: true,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	if (shared && window.count >= cfg.feedback_daily_cap) return {
-		settled,
-		next: settled,
-		pin: false,
-		forget: false,
-		untouched: false,
-		bonusCount: window.count,
-		windowAt: window.at
-	};
-	let next = clamp01(settled + delta * cfg.feedback_delta);
-	const pin = next >= cfg.permanent_threshold;
-	const forget = !pin && next <= cfg.forget_threshold + 1e-9;
-	if (forget) next = cfg.forget_threshold;
-	return {
-		settled,
-		next,
-		pin,
-		forget,
-		untouched: false,
-		bonusCount: shared ? window.count + 1 : window.count,
-		windowAt: window.at
-	};
-}
-//#endregion
 //#region ../core/lib/lifecycle/presence.js
 const CLOCK_KEY = "trust_clock";
 const LAST_SEEN_KEY = "trust_last_seen";
@@ -11667,39 +11895,27 @@ function advancePresence(db, opts) {
 function runTrustTick(db, cfg, opts) {
 	const clock = opts.clock;
 	const budget = opts.budget ?? cfg.trust.tick_max_facts;
-	const step = cfg.trust.decay_per_day;
+	const curve = trustCurveOf(cfg.trust);
 	const enabled = cfg.trust.enabled ? 1 : 0;
 	const trustEnabled = cfg.trust.enabled;
 	const facts = new FactsDao(db);
 	return db.transaction(() => {
 		const settled = !trustEnabled ? 0 : budget > 0 ? facts.settleBudgeted({
-			step,
+			curve,
 			clock,
 			budget
 		}) : facts.settleAll({
-			step,
+			curve,
 			clock
 		});
 		const skipped = trustEnabled && budget > 0 ? facts.countPendingSettle({ clock }) : 0;
 		const archiveBudget = budget > 0 ? budget : 0;
-		const ttlIds = facts.archiveExpiredByTtl({
-			clock,
-			budget: archiveBudget
-		});
 		const forgotIds = trustEnabled ? facts.archiveForgotten({
 			clock,
 			forgetThreshold: cfg.trust.forget_threshold,
 			budget: archiveBudget
 		}) : [];
-		const idleIds = facts.archiveIdle({
-			clock,
-			idleCalendarDays: cfg.trust.idle_calendar_days,
-			budget: archiveBudget
-		});
-		const deferred = archiveBudget > 0 && (ttlIds.length === archiveBudget || forgotIds.length === archiveBudget || idleIds.length === archiveBudget) ? facts.countArchiveBacklog({
-			forgetThreshold: cfg.trust.forget_threshold,
-			idleCalendarDays: cfg.trust.idle_calendar_days
-		}) : 0;
+		const deferred = archiveBudget > 0 && forgotIds.length === archiveBudget ? facts.countArchiveBacklog({ forgetThreshold: cfg.trust.forget_threshold }) : 0;
 		const purgeArgs = {
 			clock,
 			enabled,
@@ -11714,16 +11930,10 @@ function runTrustTick(db, cfg, opts) {
 		return {
 			clock,
 			settled,
-			archived_ttl: ttlIds.length,
 			archived_forgot: forgotIds.length,
-			archived_idle: idleIds.length,
 			purged: purgedIds.length,
 			purged_ids: purgedIds,
-			archived_ids: [
-				...ttlIds,
-				...forgotIds,
-				...idleIds
-			],
+			archived_ids: [...forgotIds],
 			skipped,
 			archived_deferred: deferred,
 			purged_deferred: purgedDeferred
@@ -11747,15 +11957,15 @@ function runMaintenance(db, cfg, opts) {
 	});
 	return {
 		decayed: tick.settled,
-		archived_ttl: tick.archived_ttl,
-		archived_age: tick.archived_forgot + tick.archived_idle,
+		archived_ttl: 0,
+		archived_age: tick.archived_forgot,
 		purged: tick.purged,
 		purged_ids: tick.purged_ids,
 		archived_ids: tick.archived_ids,
 		settled: tick.settled,
 		clock: tick.clock,
 		archived_forgot: tick.archived_forgot,
-		archived_idle: tick.archived_idle,
+		archived_idle: 0,
 		skipped: tick.skipped,
 		archived_deferred: tick.archived_deferred,
 		purged_deferred: tick.purged_deferred
@@ -12154,7 +12364,6 @@ const RESTORE_METADATA_FIELDS = [
 	"last_reinforced_at",
 	"ttl_days",
 	"valid_from",
-	"valid_to",
 	"supersedes_source_id",
 	"archive",
 	"sources",
@@ -12300,9 +12509,7 @@ function rowOf(raw, metadataMissing, nowSql) {
 		lastRetrievedAt: textOrNull$1(row["last_retrieved_at"]),
 		ttlDays: Math.max(0, integerOrNull(row["ttl_days"]) ?? 0),
 		validFrom: textOrNull$1(row["valid_from"]),
-		validTo: textOrNull$1(row["valid_to"]),
 		validFromMs: eventTimeMs(textOrNull$1(row["valid_from"])) ?? null,
-		validToMs: eventTimeMs(textOrNull$1(row["valid_to"])) ?? null,
 		supersedesId: integerOrNull(row["supersedes_source_id"]),
 		mirrorSource: textOrNull$1(row["mirror_source"]),
 		mirrorTarget: textOrNull$1(row["mirror_target"]),
@@ -12345,10 +12552,11 @@ const INSERT_FACT_SQL = `INSERT INTO facts (
   fact_id, content, kind, title, legacy_category, status, archived_at, archive_reason,
   created_at, updated_at, trust_score, settle_clock, assert_count, helpful_count,
   pinned, pinned_at, last_reinforced_at, bonus_count, bonus_window_at,
-  retrieval_count, last_retrieved_at, ttl_days, valid_from, valid_to, valid_from_ms, valid_to_ms,
-  supersedes_id, mirror_source, mirror_target,
+  retrieval_count, last_retrieved_at, ttl_days, valid_from, valid_from_ms,
+  valid_to, valid_to_ms, supersedes_id, mirror_source, mirror_target,
   hrr_vector, semantic_vector, embedding_model, entities_version, conflict_checked
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, 0, 1)`;
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?,
+         NULL, NULL, NULL, 0, 1)`;
 function countOf(db, sql) {
 	return Number(db.prepare(sql).get()?.n ?? 0);
 }
@@ -12399,7 +12607,7 @@ async function restoreFactsDocument(target, doc, options = {}) {
 			const insertSource = target.db.prepare("INSERT INTO fact_sources (fact_id, kind, ref) VALUES (?, ?, ?)");
 			for (const row of rows) {
 				try {
-					insertFact.run(row.factId, row.content, row.kind, row.title, row.legacyCategory, row.status, row.archivedAt, row.archiveReason, row.createdAt, row.updatedAt, row.trustScore, row.settleClock ?? clock, row.assertCount, row.helpfulCount, row.pinned ? 1 : 0, row.pinnedAt, row.lastReinforcedAt, row.bonusCount, row.bonusWindowAt, row.retrievalCount, row.lastRetrievedAt, row.ttlDays, row.validFrom, row.validTo, row.validFromMs, row.validToMs, row.supersedesId, row.mirrorSource, row.mirrorTarget);
+					insertFact.run(row.factId, row.content, row.kind, row.title, row.legacyCategory, row.status, row.archivedAt, row.archiveReason, row.createdAt, row.updatedAt, row.trustScore, row.settleClock ?? clock, row.assertCount, row.helpfulCount, row.pinned ? 1 : 0, row.pinnedAt, row.lastReinforcedAt, row.bonusCount, row.bonusWindowAt, row.retrievalCount, row.lastRetrievedAt, row.ttlDays, row.validFrom, row.validFromMs, row.supersedesId, row.mirrorSource, row.mirrorTarget);
 					for (const source of row.sources) insertSource.run(row.factId, source.kind, source.ref);
 					if (row.relations.length > 0) {
 						const report = writeExplicitEdgesForFact(target.db, row.factId, row.relations);
@@ -12497,9 +12705,6 @@ var SqliteMemoryRepository = class {
 	countForgettingWithin(p) {
 		return this.dao.countForgettingWithin(p);
 	}
-	countIdleCandidates(days) {
-		return this.dao.countIdleCandidates(days);
-	}
 	countArchiveBacklog(p) {
 		return this.dao.countArchiveBacklog(p);
 	}
@@ -12582,11 +12787,11 @@ var SqliteMemoryRepository = class {
 			factId: Number(existing.fact_id)
 		};
 	}
-	applyValidity(factId, validFrom, validTo) {
-		this.dao.applyValidity(factId, validFrom, validTo);
+	applyValidity(factId, validFrom) {
+		this.dao.applyValidity(factId, validFrom);
 	}
-	applyValues(factId, kind, ttlDays) {
-		this.dao.applyValues(factId, kind, ttlDays);
+	applyValues(factId, kind) {
+		this.dao.applyValues(factId, kind);
 	}
 	setTitle(factId, title) {
 		this.dao.setTitle(factId, title);
@@ -12603,17 +12808,14 @@ var SqliteMemoryRepository = class {
 	incrementAssertCount(factId) {
 		return this.dao.incrementAssertCount(factId);
 	}
-	markValidTo(factId, at, atMs) {
-		this.dao.markValidTo(factId, at, atMs);
-	}
 	linkSupersede(factId, supersedesId) {
 		this.dao.linkSupersede(factId, supersedesId);
 	}
 	archiveSuperseded(factId, clock) {
 		return this.dao.archiveSuperseded(factId, clock);
 	}
-	revive(factId, kind, ttlDays, trust, clock) {
-		return this.dao.revive(factId, kind, ttlDays, trust, clock);
+	revive(factId, kind, trust, clock) {
+		return this.dao.revive(factId, kind, trust, clock);
 	}
 	archive(factId, clock, reason) {
 		return this.dao.archive(factId, clock, reason);
@@ -12621,24 +12823,12 @@ var SqliteMemoryRepository = class {
 	restore(factId, trust, clock) {
 		return this.dao.restore(factId, trust, clock);
 	}
-	bumpHelpful(factId, delta) {
-		this.dao.bumpHelpful(factId, delta);
-	}
 	pin(factId, clock) {
 		return this.dao.pin(factId, clock);
 	}
 	unpin(factId, clock) {
 		return this.dao.unpin(factId, clock);
 	}
-	pinOutcome(factId, clock, bonusCount, windowAt) {
-		this.dao.pinOutcome(factId, clock, bonusCount, windowAt);
-	}
-	forgetOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.dao.forgetOutcome(factId, trust, clock, bonusCount, windowAt);
-	}
-	reinforceOutcome(factId, trust, clock, bonusCount, windowAt) {
-		this.dao.reinforceOutcome(factId, trust, clock, bonusCount, windowAt);
-	}
 	touchUsage(ids) {
 		this.dao.touchUsage(ids);
 	}
@@ -16289,6 +16479,22 @@ const NO_CHECK = {
 */
 const RETRIEVAL_HEALTH_KEY = "retrieval_health";
 /**
+* The MODEL face's ONE instant renderer: a stored stamp → ISO-8601 **with the host's offset**
+* (`2026-10-28T19:58:48+08:00`), via `@avantf/mem-contract/time`'s `formatOffsetIso`.
+*
+* Every timestamp this store hands UP goes through here, and none of them is localized anywhere
+* else: the DB column stays UTC (`CURRENT_TIMESTAMP`) and the export document stays byte-identical
+* (`facts_io` reads rows directly), while the model receives an unambiguous instant and needs no
+* timezone arithmetic of its own. `null` means "absent/unreadable" — the CALLER keeps its existing
+* spelling (`''` for `created_at`, `null` for the nullable ones) instead of an empty time.
+*
+* NOT applied to `valid_from` / `event_date`: that is a calendar DATE the caller wrote, with no time
+* and no zone, and rendering it through a clock would invent a midnight.
+*/
+function modelInstant(value) {
+	return formatOffsetIso(value === null || value === void 0 ? null : String(value));
+}
+/**
 * The ONE stored-title-row → `TitleCandidate` mapper, shared by the exact page and the fuzzy
 * shortlist so a candidate cannot describe the same row two ways.
 *
@@ -16306,8 +16512,8 @@ function titleCandidatesOf(rows, includeExcerpt) {
 		matched_title: row.matched_title === null || row.matched_title === void 0 ? String(row.title) : String(row.matched_title),
 		memory_kind: mapLegacyKind(row.kind),
 		status: row.status === "archived" ? "archived" : "active",
-		created_at: row.created_at === null ? "" : String(row.created_at),
-		updated_at: row.updated_at === null ? null : String(row.updated_at),
+		created_at: modelInstant(row.created_at) ?? "",
+		updated_at: modelInstant(row.updated_at),
 		...row.valid_from === null || row.valid_from === void 0 ? {} : { event_date: String(row.valid_from) },
 		...includeExcerpt && row.excerpt !== null ? { excerpt: String(row.excerpt) } : {}
 	}));
@@ -16334,8 +16540,8 @@ function factEvidenceOf(row) {
 		status: row["status"] === "archived" ? "archived" : "active",
 		...title === null || title === void 0 || title === "" ? {} : { title: String(title) },
 		...row["valid_from"] === null || row["valid_from"] === void 0 ? {} : { event_date: String(row["valid_from"]) },
-		created_at: row["created_at"] === null || row["created_at"] === void 0 ? "" : String(row["created_at"]),
-		updated_at: row["updated_at"] === null || row["updated_at"] === void 0 ? null : String(row["updated_at"])
+		created_at: modelInstant(row["created_at"]) ?? "",
+		updated_at: modelInstant(row["updated_at"])
 	};
 }
 var MemoryStore = class {
@@ -16487,7 +16693,7 @@ var MemoryStore = class {
 			dim: this.vstore.dim
 		});
 	}
-	async add(content, kind, ttlDays, opts) {
+	async add(content, kind, opts) {
 		const normalized = normalizeWrite(content).trim();
 		if (!normalized) throw new Error("内容不能为空");
 		const secret = detectSecretShape(normalized);
@@ -16500,7 +16706,7 @@ var MemoryStore = class {
 		if (checkedKind !== void 0 && requiresEventDate(checkedKind) && opts?.eventDate === void 0) throw new Error(JOURNAL_NEEDS_EVENT_DATE);
 		const explicitTriples = opts?.relations === void 0 ? void 0 : await this.relations.explicitRelationTriples(checkedKind ?? "note", opts.relations);
 		const title = this.resolveWriteTitle(opts?.title, checkedKind);
-		const { fact_id, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, ttlDays, entityWrites, triples, {
+		const { fact_id, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, entityWrites, triples, {
 			...opts,
 			title,
 			relations: void 0
@@ -16591,7 +16797,7 @@ var MemoryStore = class {
 		}], this.vectorWriteTarget(this.vectorSpace()));
 		return encoded === 1;
 	}
-	async update(fact_id, content, kind, ttlDays, opts) {
+	async update(fact_id, content, kind, opts) {
 		const row = await this.getRow(fact_id);
 		if (!row) throw new Error(`找不到 fact_id=${fact_id}`);
 		const normalized = normalizeWrite(content).trim();
@@ -16607,7 +16813,7 @@ var MemoryStore = class {
 		if (requiresEventDate(effectiveKind) && opts?.eventDate === void 0 && row.valid_from == null) throw new Error(JOURNAL_NEEDS_EVENT_DATE);
 		const title = this.resolveWriteTitle(opts?.title, effectiveKind);
 		const explicitTriples = opts?.relations === void 0 ? void 0 : await this.relations.explicitRelationTriples(effectiveKind, opts.relations);
-		const { fact_id: newId, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, ttlDays, entityWrites, triples, {
+		const { fact_id: newId, is_new, revived, assert_count } = await this.persistFact(normalized, checkedKind, entityWrites, triples, {
 			...opts,
 			supersedesId: fact_id,
 			archiveOldIfActive: true,
@@ -16641,9 +16847,9 @@ var MemoryStore = class {
 		return changed > 0;
 	}
 	/**
-	* Bring an archived fact back (spec §2.6): a `forgot` fact is lifted to
-	* `recall_floor` (otherwise the very next tick would re-archive it, R4), the
-	* idle clock is refreshed (otherwise an `idle`-archived fact dies again, R18),
+	* Bring an archived fact back (spec §2.6): a `forgot` fact is lifted to the frozen base
+	* `BASE_TRUST` (otherwise the very next tick would re-archive it, R4),
+	* `last_retrieved_at` is refreshed (observation only — no clock reads it any more),
 	* and `settle_clock` moves to now so the downtime is not charged.
 	*/
 	async restore(fact_id) {
@@ -16652,7 +16858,7 @@ var MemoryStore = class {
 		const trust = this.config.trust;
 		const clock = await this.lifecycle.clock();
 		const stored = Number(row.trust_score);
-		const next = String(row.archive_reason) === "forgot" || stored <= trust.forget_threshold ? Math.max(stored, trust.recall_floor) : stored;
+		const next = String(row.archive_reason) === "forgot" || stored <= trust.forget_threshold ? Math.max(stored, BASE_TRUST) : stored;
 		if (await this.facts.restore(fact_id, next, clock) === 0) return false;
 		const vec = bytesToFloat32(row.semantic_vector ?? null);
 		if (vec && vec.length === this.vstore.dim) this.vstore.add(fact_id, vec);
@@ -16660,42 +16866,6 @@ var MemoryStore = class {
 		if ((await this.detectContradictions(fact_id)).complete) await this.facts.markConflictChecked([fact_id]);
 		return true;
 	}
-	async helpful(fact_id) {
-		return await this.applyFeedback(fact_id, 1);
-	}
-	async unhelpful(fact_id) {
-		return await this.applyFeedback(fact_id, -1);
-	}
-	/**
-	* Explicit feedback (spec §2.4). Pinned/archived rows only move `helpful_count`
-	* (R7); otherwise the decay is settled first, then `±feedback_delta`, pin at the
-	* permanent threshold (snap to 1.0) or archive immediately at the forget line.
-	*/
-	async applyFeedback(fact_id, delta) {
-		if (await this.getRow(fact_id) === void 0) return null;
-		const trust = this.config.trust;
-		const evict = await this.lifecycle.immediateTransaction(async () => {
-			const row = await this.getRow(fact_id);
-			if (!row) return null;
-			const clock = await this.lifecycle.clock();
-			const outcome = applyFeedbackDelta(asTrustRow(row), clock, delta, Date.now(), trust);
-			await this.facts.bumpHelpful(fact_id, delta);
-			if (outcome.untouched) return null;
-			if (outcome.pin) {
-				await this.facts.pinOutcome(fact_id, clock, outcome.bonusCount, outcome.windowAt);
-				return null;
-			}
-			if (outcome.forget) {
-				await this.facts.forgetOutcome(fact_id, outcome.next, clock, outcome.bonusCount, outcome.windowAt);
-				await this.contradictions.resolveForFact(fact_id);
-				return fact_id;
-			}
-			await this.facts.reinforceOutcome(fact_id, outcome.next, clock, outcome.bonusCount, outcome.windowAt);
-			return null;
-		});
-		if (evict !== null) evictVectors(this.vstore, [evict]);
-		return (await this.getRow(fact_id))?.helpful_count ?? 0;
-	}
 	/** Permanent-memory administration (spec §6). */
 	async pin(fact_id) {
 		return await this.facts.pin(fact_id, await this.lifecycle.clock()) > 0;
@@ -16713,15 +16883,15 @@ var MemoryStore = class {
 		const clock = await this.lifecycle.clock();
 		const active = await this.facts.countActive();
 		const pinned = await this.facts.countPinnedActive();
-		const forgettingSoon = trust.decay_per_day > 0 ? await this.facts.countForgettingWithin({
-			step: trust.decay_per_day,
+		const curve = curveOf(trust);
+		const forgettingSoon = await this.facts.countForgettingWithin({
+			threshold: ceilingForDays(FORGETTING_SOON_DAYS, curve),
 			clock,
-			withinDays: FORGETTING_SOON_DAYS
-		}) : 0;
+			curve
+		});
 		const bonus = await this.facts.bonusStatedToday();
 		const reinforcedToday = bonus.count;
 		const grantedToday = bonus.granted;
-		const idleCandidates = await this.facts.countIdleCandidates(trust.idle_calendar_days);
 		const reasons = await this.facts.archivedByReason();
 		const oldest = await this.facts.minSettleClock();
 		return {
@@ -16732,7 +16902,6 @@ var MemoryStore = class {
 			forgetting_soon: forgettingSoon,
 			reinforced_today: reinforcedToday,
 			bonus_granted_today: grantedToday,
-			idle_candidates: idleCandidates,
 			conflict_pending: await this.facts.countPendingConflicts(),
 			entities_stale: await this.facts.countStaleEntities(3),
 			archived_by_reason: Object.fromEntries(reasons.map((r) => [r.reason ?? "unknown", r.n])),
@@ -16895,9 +17064,18 @@ var MemoryStore = class {
 	liveVectorCount() {
 		return this.vstore.count();
 	}
-	/** List contradiction candidates (`resolved` 0 = open, 1 = closed with a recorded verdict). */
+	/**
+	* List contradiction candidates (`resolved` 0 = open, 1 = closed with a recorded verdict).
+	*
+	* `detected_at` is mapped to the model face's instant shape here (the DAO hands back the raw UTC
+	* column): this payload is what the 记忆 tab's 未处理矛盾 table and the CLI both render, and it must
+	* not be the one surface still printing a zone-less stamp.
+	*/
 	async listContradictions(opts) {
-		return await this.contradictions.list(opts?.resolved ?? 0, opts?.kind, opts?.threshold, opts?.limit ?? 10);
+		return (await this.contradictions.list(opts?.resolved ?? 0, opts?.kind, opts?.threshold, opts?.limit ?? 10)).map((row) => ({
+			...row,
+			detected_at: modelInstant(row.detected_at) ?? row.detected_at
+		}));
 	}
 	/**
 	* Adjudicate one logged conflict — the outlet the detector never had.
@@ -16943,7 +17121,6 @@ var MemoryStore = class {
 				reason: "loser_not_in_pair"
 			};
 			await this.archive(loserFactId, "contradiction");
-			await this.facts.markValidTo(loserFactId, formatUtcTs(Date.now()), Date.now());
 			await this.contradictions.resolve(id, resolution, loserFactId);
 			return {
 				resolved: true,
@@ -17330,13 +17507,21 @@ var MemoryStore = class {
 	* ({@link timePage}, `mode:"time"`): the window is the whole question, so there is nothing to
 	* match, plan or rank.
 	*
-	* The exact, facts and relation passes reinforce the facts they return, exactly like the fuzzy
-	* pass does for its hits: all are recalls the caller actually reads. A caller that must stay
-	* read-only passes `track: false` (the conditional hint's probe does). Exact, facts, relation and
-	* time also honour the caller's output budget (their text is the caller's to bound). The one
-	* difference is the DEFAULT: a time window applies no budget unless the caller names one — its
-	* page size (`limit`) is what bounds the list, and the budget would only rewrite rows the caller
-	* asked for (see {@link timePage}).
+	* What a pass does to the rows it returns is one decision, and it is deliberately NOT uniform:
+	*
+	*  - the RELATION and FUZZY passes REINFORCE them ({@link reinforce}): each answers a question
+	*    the caller asked, so the rows are what it read;
+	*  - the TIME, EXACT and FACTS passes record USAGE ONLY ({@link touchOnly}): they hand back a
+	*    LIST the caller browses — page 2 of a listing is not a second recall — so "it was looked
+	*    at" still moves `retrieval_count` / `last_retrieved_at` (the dormancy clock) while
+	*    `trust_score` / `bonus_count` stay where they are.
+	*
+	* A caller that must stay read-only passes `track: false` (the conditional hint's probe does);
+	* that branch writes nothing at all, usage included. Exact, facts, relation and time also honour
+	* the caller's output budget (their text is the caller's to bound). The one difference is the
+	* DEFAULT: a time window applies no budget unless the caller names one — its page size (`limit`)
+	* is what bounds the list, and the budget would only rewrite rows the caller asked for (see
+	* {@link timePage}).
 	*
 	* It does NOT emit a retrieval-health event. Those counters describe the retrieval PIPELINE
 	* (legs, fusion, semantic-live rate); none of an exact, facts, relation or time answer ran a leg,
@@ -17394,8 +17579,9 @@ var MemoryStore = class {
 	* list", and the budget stays a knob for a RANKED result (exact/facts/relation/hybrid unchanged).
 	* `max_tokens` (including the contract's `0` = unlimited) is passed through unchanged.
 	*
-	* It honours `kind`/`source`, and reinforces the rows it returns unless `track: false` — a window
-	* the caller reads is a recall like any other.
+	* It honours `kind`/`source`, and records usage ONLY for the rows it returns unless `track: false`
+	* ({@link touchOnly}). A window is listed so the caller can look through it, not recalled into an
+	* answer: the dormancy clock (`retrieval_count` / `last_retrieved_at`) moves, trust does not.
 	*/
 	async timePage(input) {
 		if (input.time === void 0) throw new Error("mem_recall.search 需要 `query`，或只给 `time`（纯时间召回）；两者都没有时无法检索。");
@@ -17415,7 +17601,7 @@ var MemoryStore = class {
 			offset
 		});
 		const { kept } = applyOutputBudget(this.config, await this.factHits(ids, () => 1), input.maxTokens ?? 0);
-		if (input.track !== false) await this.reinforce(kept.map((hit) => hit.ref_id));
+		if (input.track !== false) await this.touchOnly(kept.map((hit) => hit.ref_id));
 		return {
 			mode: "time",
 			total,
@@ -17453,7 +17639,7 @@ var MemoryStore = class {
 			offset
 		});
 		const { kept } = applyOutputBudget(this.config, await this.factHits(ids, () => 1), input.maxTokens);
-		if (input.track !== false) await this.reinforce(kept.map((hit) => hit.ref_id));
+		if (input.track !== false) await this.touchOnly(kept.map((hit) => hit.ref_id));
 		return {
 			mode: "exact",
 			total,
@@ -17490,8 +17676,8 @@ var MemoryStore = class {
 	*    malformed window is the caller's error exactly as it is in the exact page;
 	*  - the page is FACT-level (`total`/`offset`/`limit`/`truncated`), and the caller's output budget
 	*    only shortens `content` — dropping a row would make `total` disagree with the page;
-	*  - the returned facts are reinforced unless `track: false`, like every other recall the caller
-	*    actually reads.
+	*  - the returned facts get usage recorded but NO reinforcement unless `track: false`: a facts
+	*    page is a list the caller browses, so only the dormancy clock moves ({@link touchOnly}).
 	*/
 	async factPage(input, rawQuery) {
 		const query = rawQuery.trim();
@@ -17510,7 +17696,7 @@ var MemoryStore = class {
 		});
 		if (page.total === 0) return null;
 		const facts = this.budgetFactEvidence(page.rows.map(factEvidenceOf), input.maxTokens);
-		if (input.track !== false) await this.reinforce(facts.map((entry) => entry.fact_id));
+		if (input.track !== false) await this.touchOnly(facts.map((entry) => entry.fact_id));
 		return {
 			mode: "facts",
 			total: page.total,
@@ -17607,8 +17793,8 @@ var MemoryStore = class {
 				text: String(row["content"] ?? ""),
 				memory_kind: mapLegacyKind(String(row["kind"] ?? "note")),
 				...title === void 0 ? {} : { title },
-				created_at: row["created_at"] === null || row["created_at"] === void 0 ? "" : String(row["created_at"]),
-				updated_at: row["updated_at"] === null || row["updated_at"] === void 0 ? null : String(row["updated_at"])
+				created_at: modelInstant(row["created_at"]) ?? "",
+				updated_at: modelInstant(row["updated_at"])
 			});
 		}
 		return evidence;
@@ -17836,10 +18022,9 @@ var MemoryStore = class {
 				score: scoreOf(id),
 				source_ref: factSourceRef(id),
 				entities: bags.get(id) ?? [],
-				created_at: time?.created_at ?? "",
-				updated_at: time?.updated_at ?? null,
+				created_at: modelInstant(time?.created_at) ?? "",
+				updated_at: modelInstant(time?.updated_at),
 				...time?.valid_from === null || time?.valid_from === void 0 ? {} : { valid_from: time.valid_from },
-				...time?.valid_to === null || time?.valid_to === void 0 ? {} : { valid_to: time.valid_to },
 				...time?.title === null || time?.title === void 0 ? {} : { title: time.title }
 			};
 		});
@@ -17904,6 +18089,19 @@ var MemoryStore = class {
 		} catch {}
 	}
 	/**
+	* Record the USAGE of these facts and nothing else — no trust bonus, no quota, no
+	* `last_reinforced_at`.
+	*
+	* This is the paginated passes' half of {@link reinforce}: `timePage` / `exactContentPage` /
+	* `factPage` return a list the caller browses rather than a recall it acted on, so "someone
+	* looked at this row" still moves `retrieval_count` / `last_retrieved_at` (observation and
+	* export only — no lifecycle step reads that clock) while `trust_score` / `bonus_count` stay
+	* put.
+	*/
+	async touchOnly(ids) {
+		if (ids.length) await this.touchUsage(ids);
+	}
+	/**
 	* Semantic leg. `queryVector` short-circuits the encode when the caller already
 	* encoded this exact query (the cross-store router does, for both stores at once);
 	* `onVector` publishes the vector this leg actually used, so the relaxed retry pass can reuse it
@@ -18012,25 +18210,22 @@ var MemoryStore = class {
 	/**
 	* Insert (or resolve to) a fact row.
 	*
-	* `kind` / `ttlDays` are `undefined` when the CALLER specified nothing — the
-	* distinction is load-bearing. A duplicate-content hit must not clobber the existing
-	* row's values with the insert defaults: re-adding a fact without a kind used to
-	* reset it to `general`, and reviving an archived one silently cleared an explicit TTL.
-	* The rule for all three branches is therefore: an explicitly provided value lands, an
-	* omitted one keeps what the row already has, and a brand-new row falls back to the
-	* defaults (`general` / `0`).
+	* `kind` is `undefined` when the CALLER specified nothing — the distinction is load-bearing.
+	* A duplicate-content hit must not clobber the existing row's value with the insert default:
+	* re-adding a fact without a kind used to reset it to `general`. The rule for all three
+	* branches is therefore: an explicitly provided value lands, an omitted one keeps what the row
+	* already has, and a brand-new row falls back to the default (`note`).
 	*/
-	async persistFact(content, kind, ttlDays, entities, triples, opts, explicitEdges = void 0) {
+	async persistFact(content, kind, entities, triples, opts, explicitEdges = void 0) {
 		const hrr = hrrToBytes(encodeHrrEntityVector(entities.map((e) => e.name)));
 		const trust = this.config.trust;
 		const clock = await this.lifecycle.clock();
 		const nowIso = formatUtcTs(Date.now());
 		const replaced = opts?.supersedesId === void 0 ? void 0 : await this.getRow(opts.supersedesId);
 		const superseded = trust.inherit_trust_on_update ? replaced : void 0;
-		const startTrust = superseded === void 0 ? trust.start : effectiveTrust(asTrustRow(superseded), clock, trust);
+		const startTrust = superseded === void 0 ? BASE_TRUST : effectiveTrust(asTrustRow(superseded), clock, trust);
 		const startPinned = superseded !== void 0 && isPinned(asTrustRow(superseded)) ? 1 : 0;
 		const newKind = kind ?? (replaced === void 0 ? "note" : mapLegacyKind(replaced.kind));
-		const newTtl = ttlDays ?? (replaced === void 0 ? 0 : Number(replaced.ttl_days ?? 0));
 		/**
 		* The title this revision would carry (JOURNAL_TITLE_SEARCH §2.2/§11.2, v17's correction).
 		*
@@ -18062,13 +18257,11 @@ var MemoryStore = class {
 		}
 		const createdAt = replaced === void 0 || replaced.created_at === null ? nowIso : String(replaced.created_at);
 		const validFrom = opts?.eventDate === void 0 ? replaced === void 0 ? null : nullableEventTime(replaced.valid_from, replaced.valid_from_ms) : normalizeEventTime(opts.eventDate, "event_date");
-		const validTo = opts?.validUntil === void 0 ? replaced === void 0 ? null : nullableEventTime(replaced.valid_to, replaced.valid_to_ms) : normalizeEventTime(opts.validUntil, "valid_until");
 		const { supersededId, ...result } = await this.lifecycle.transaction(async () => {
 			const cur = await this.facts.insertRevision({
 				content,
 				kind: newKind,
 				title: desiredTitle,
-				ttlDays: newTtl,
 				supersedesId: opts?.supersedesId ?? null,
 				hrr,
 				trust: clamp01(startTrust),
@@ -18078,9 +18271,7 @@ var MemoryStore = class {
 				windowAt: nowIso,
 				createdAt,
 				validFrom: validFrom?.text ?? null,
-				validTo: validTo?.text ?? null,
-				validFromMs: validFrom?.ms ?? null,
-				validToMs: validTo?.ms ?? null
+				validFromMs: validFrom?.ms ?? null
 			});
 			let fact_id;
 			let is_new;
@@ -18090,18 +18281,16 @@ var MemoryStore = class {
 				fact_id = Number(row.fact_id);
 				is_new = false;
 				const rowKind = mapLegacyKind(row.kind);
-				const rowTtl = Number(row.ttl_days ?? 0);
 				const keepKind = kind ?? rowKind;
-				const keepTtl = ttlDays ?? rowTtl;
 				const rowTitle = storedTitle(row.title);
 				const selfRetitle = retitle && opts?.supersedesId !== void 0 && Number(opts.supersedesId) === fact_id;
 				if (opts?.title !== void 0 && opts.title !== null && rowTitle !== null && opts.title !== rowTitle && !selfRetitle) throw new Error(TITLE_CONFLICT);
 				const keepTitle = selfRetitle ? desiredTitle : rowTitle ?? desiredTitle;
 				if (opts?.requireJournalTitle === true && keepKind === "journal" && keepTitle === null) throw new Error(TITLE_REQUIRED);
-				await this.facts.applyValidity(fact_id, opts?.eventDate === void 0 ? void 0 : validFrom ?? void 0, opts?.validUntil === void 0 ? void 0 : validTo ?? void 0);
+				await this.facts.applyValidity(fact_id, opts?.eventDate === void 0 ? void 0 : validFrom ?? void 0);
 				const settled = effectiveTrust(asTrustRow(row), clock, trust);
-				const revived = await this.facts.revive(fact_id, keepKind, keepTtl, Math.max(settled, trust.recall_floor), clock) > 0;
-				if (!revived && (keepKind !== rowKind || keepTtl !== rowTtl)) await this.facts.applyValues(fact_id, keepKind, keepTtl);
+				const revived = await this.facts.revive(fact_id, keepKind, Math.max(settled, BASE_TRUST), clock) > 0;
+				if (!revived && keepKind !== rowKind) await this.facts.applyValues(fact_id, keepKind);
 				if (keepTitle !== null && keepTitle !== rowTitle) {
 					await this.facts.setTitle(fact_id, keepTitle);
 					if (selfRetitle) {
@@ -18189,10 +18378,7 @@ var MemoryStore = class {
 		if (!opts?.supersedesId || opts.supersedesId === fact_id) return null;
 		await this.facts.linkSupersede(fact_id, opts.supersedesId);
 		if (opts.archiveOldIfActive) {
-			if (await this.facts.archiveSuperseded(opts.supersedesId, await this.lifecycle.clock()) > 0) {
-				await this.contradictions.resolveForFact(opts.supersedesId);
-				await this.facts.markValidTo(opts.supersedesId, formatUtcTs(Date.now()), Date.now());
-			}
+			if (await this.facts.archiveSuperseded(opts.supersedesId, await this.lifecycle.clock()) > 0) await this.contradictions.resolveForFact(opts.supersedesId);
 		}
 		await this.triples.deleteForFact(opts.supersedesId);
 		await this.relations.deleteEdgesForFact(opts.supersedesId);
@@ -18349,8 +18535,8 @@ var MemoryStore = class {
 			pinned: isPinned(row),
 			remaining_days: remainingDays(row, clock, this.config.trust),
 			helpful_count: Number(r.helpful_count),
-			created_at: String(r.created_at),
-			archived_at: r.archived_at ? String(r.archived_at) : null,
+			created_at: modelInstant(r.created_at) ?? "",
+			archived_at: modelInstant(r.archived_at),
 			archive_reason: r.archive_reason ? String(r.archive_reason) : null
 		};
 	}
@@ -18363,14 +18549,13 @@ var MemoryStore = class {
 			entities,
 			triples,
 			settle_clock: Number(r.settle_clock),
-			pinned_at: r.pinned_at ? String(r.pinned_at) : null,
-			last_reinforced_at: r.last_reinforced_at ? String(r.last_reinforced_at) : null,
-			updated_at: r.updated_at ? String(r.updated_at) : null,
+			pinned_at: modelInstant(r.pinned_at),
+			last_reinforced_at: modelInstant(r.last_reinforced_at),
+			updated_at: modelInstant(r.updated_at),
 			bonus_count: Number(r.bonus_count ?? 0),
-			bonus_window_at: r.bonus_window_at ? String(r.bonus_window_at) : null,
+			bonus_window_at: modelInstant(r.bonus_window_at),
 			sources: await this.sources.listForFact(factId),
 			valid_from: nullableString(r.valid_from),
-			valid_to: nullableString(r.valid_to),
 			superseded_by: await this.facts.supersededBy(factId),
 			assert_count: Number(r.assert_count ?? 1),
 			relations: await this.relations.explicitRelationsForFact(factId)
@@ -18476,10 +18661,11 @@ function nullableEventTime(text, ms) {
 * inserts SQL rows.
 *
 * TWO CONSUMERS, TWO SEMANTICS. `import`/`merge` remain a CONTENT-IDENTITY UNION and consume only
-* a subset: kind, ttl_days, embedded source ref, valid_from → event_date and valid_to →
-* valid_until. They do NOT restore created_at/updated_at/trust_score/assert_count/helpful_count/
-* pinned, archived status or the supersedes chain — `metadata_dropped` counts each value they
-* knowingly drop instead of pretending. `restore` is the REBUILD (see `store/facts_restore.ts`):
+* a subset: kind, embedded source ref and valid_from → event_date. They do NOT restore
+* created_at/updated_at/trust_score/assert_count/helpful_count/pinned, archived status, the
+* supersedes chain, or the retired `ttl_days` / `valid_to` values (v2: the columns stay in the
+* document for format stability, but nothing reads them on the way in) — `metadata_dropped` counts
+* each value they knowingly drop instead of pretending. `restore` is the REBUILD (see `store/facts_restore.ts`):
 * only into an EMPTY facts table, keeping fact_id, status, timestamps, trust, pin, counters, every
 * provenance row and the supersedes chain, then re-deriving entities. The union path never revives
 * an archived row; restore is the only path that brings archived rows back. The vector, entity,
@@ -18575,7 +18761,6 @@ const FACT_COLUMNS = [
 	"helpful_count",
 	"last_reinforced_at",
 	"valid_from",
-	"valid_to",
 	"supersedes_id",
 	"archived_at",
 	"archive_reason",
@@ -18725,7 +18910,7 @@ function readFactsDocument(dbPath, options) {
 				last_reinforced_at: textOrNull(cell(row, "last_reinforced_at")),
 				sources: sources.get(sourceId) ?? [],
 				valid_from: textOrNull(cell(row, "valid_from")),
-				valid_to: textOrNull(cell(row, "valid_to")),
+				valid_to: null,
 				supersedes_source_id: supersedes === null || supersedes === void 0 ? null : numberOf(supersedes, 0),
 				archive: status === "archived" ? {
 					at: textOrNull(cell(row, "archived_at")),
@@ -18921,7 +19106,9 @@ function emptyMetadataDropped() {
 		assert_count: 0,
 		helpful_count: 0,
 		pinned: 0,
-		supersedes: 0
+		supersedes: 0,
+		ttl_days: 0,
+		valid_to: 0
 	};
 }
 /** What a Phase-2 restore WOULD have carried but v1 does not. */
@@ -18932,7 +19119,9 @@ function metadataDroppedOf(row) {
 		assert_count: numberOf(cell(row, "assert_count"), 1) > 1 ? 1 : 0,
 		helpful_count: numberOf(cell(row, "helpful_count"), 0) > 0 ? 1 : 0,
 		pinned: boolOf(cell(row, "pinned")) ? 1 : 0,
-		supersedes: cell(row, "supersedes_source_id") === null || cell(row, "supersedes_source_id") === void 0 ? 0 : 1
+		supersedes: cell(row, "supersedes_source_id") === null || cell(row, "supersedes_source_id") === void 0 ? 0 : 1,
+		ttl_days: numberOf(cell(row, "ttl_days"), 0) > 0 ? 1 : 0,
+		valid_to: cell(row, "valid_to") === null || cell(row, "valid_to") === void 0 ? 0 : 1
 	};
 }
 function accumulateMetadataDropped(total, one) {
@@ -18942,6 +19131,8 @@ function accumulateMetadataDropped(total, one) {
 	total.helpful_count += one.helpful_count;
 	total.pinned += one.pinned;
 	total.supersedes += one.supersedes;
+	total.ttl_days += one.ttl_days;
+	total.valid_to += one.valid_to;
 }
 function sourceIdOf(row) {
 	const value = cell(row, "source_id");
@@ -18953,12 +19144,6 @@ function optionalString(row, key, label) {
 	if (typeof value !== "string") throw new Error(`${label} 不是字符串`);
 	return value === "" ? void 0 : value;
 }
-function optionalTtlDays(row) {
-	const value = cell(row, "ttl_days");
-	if (value === null || value === void 0) return void 0;
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error("ttl_days 无效（需要非负整数）");
-	return value;
-}
 function optionalDate(row, key, label) {
 	const value = cell(row, key);
 	if (value === null || value === void 0) return void 0;
@@ -19020,19 +19205,15 @@ function addRequestFor(identity, row, fallbackSourceRef, preferEmbeddedSources)
 	const sourceRef = (preferEmbeddedSources ? embeddedSourceRef(row) : void 0) ?? fallbackSourceRef;
 	const kind = mapLegacyKind(optionalString(row, "kind", "kind") ?? optionalString(row, "category", "category"));
 	const title = optionalString(row, "title", "title");
-	const ttlDays = optionalTtlDays(row);
 	const eventDate = optionalDate(row, "valid_from", "valid_from");
-	const validUntil = optionalDate(row, "valid_to", "valid_to");
 	const relations = relationsOf(row, kind);
 	return {
 		action: "add",
 		content: identity,
 		kind,
 		...title === void 0 ? {} : { title },
-		...ttlDays === void 0 ? {} : { ttl_days: ttlDays },
 		...sourceRef === void 0 ? {} : { source_ref: sourceRef },
 		...eventDate === void 0 ? {} : { event_date: eventDate },
-		...validUntil === void 0 ? {} : { valid_until: validUntil },
 		...relations === void 0 ? {} : { relations }
 	};
 }
@@ -19427,13 +19608,12 @@ function walHealth(dbPath) {
 * P-08 / P-13 / JOURNAL_TITLE_SEARCH: the `mem_remember` extras, lifted off the request and onto the
 * store's write options. Only the keys actually present are carried, so an omitted argument stays
 * "omitted" all the way down (the store's "unset keeps what the row has" rule — an update inherits
-* an omitted title, TTL, event time — depends on that distinction).
+* an omitted title or event time — depends on that distinction).
 */
 function writeOptions(req, rules) {
 	return {
 		...req.source_ref === void 0 ? {} : { sourceRef: req.source_ref },
 		...req.event_date === void 0 ? {} : { eventDate: req.event_date },
-		...req.valid_until === void 0 ? {} : { validUntil: req.valid_until },
 		...req.title === void 0 ? {} : { title: req.title },
 		...req.retitle === true ? { retitle: true } : {},
 		...req.relations === void 0 ? {} : { relations: req.relations },
@@ -19557,11 +19737,9 @@ async function buildRuntime(opts) {
 		},
 		async remember(req, rules) {
 			switch (req.action) {
-				case "add": return this.memory.add(req.content, req.kind, req.ttl_days, writeOptions(req, rules));
-				case "update": return this.memory.update(req.fact_id, req.content, req.kind, req.ttl_days, writeOptions(req, rules));
+				case "add": return this.memory.add(req.content, req.kind, writeOptions(req, rules));
+				case "update": return this.memory.update(req.fact_id, req.content, req.kind, writeOptions(req, rules));
 				case "remove": return this.memory.remove(req.fact_id, req.reason);
-				case "helpful": return this.memory.helpful(req.fact_id);
-				case "unhelpful": return this.memory.unhelpful(req.fact_id);
 			}
 		},
 		async recall(req) {
@@ -19591,14 +19769,19 @@ async function buildRuntime(opts) {
 		},
 		async admin(req) {
 			switch (req.action) {
-				case "stats": return {
-					...await this.memory.countByStatus(),
-					retrieval: retrievalHealthSummary(),
-					vectors: await this.memory.vectorSpaceHealth(),
-					wal: walHealth(memDb),
-					sources: await this.memory.sourceCoverage(),
-					validity: await this.memory.validityCoverage()
-				};
+				case "stats":
+					const retrieval = retrievalHealthSummary();
+					return {
+						...await this.memory.countByStatus(),
+						retrieval: {
+							...retrieval,
+							updated_at: formatOffsetIso(retrieval.updated_at)
+						},
+						vectors: await this.memory.vectorSpaceHealth(),
+						wal: walHealth(memDb),
+						sources: await this.memory.sourceCoverage(),
+						validity: await this.memory.validityCoverage()
+					};
 				case "list": return await this.memory.list(req.kind, req.status ?? "active", req.limit ?? 50, req.offset ?? 0, req.source, req.time);
 				case "detail": return await this.memory.get(req.fact_id) ?? { error: `fact_id=${req.fact_id} not found` };
 				case "archive": return await this.memory.archive(req.fact_id, req.reason);
@@ -19749,11 +19932,9 @@ const descriptors = [
 		content: optionalText.optional(),
 		fact_id: count.optional(),
 		kind: optionalText.optional(),
-		ttl_days: count.optional(),
 		reason: optionalText.optional(),
 		source_ref: optionalText.optional(),
 		event_date: optionalText.optional(),
-		valid_until: optionalText.optional(),
 		title: optionalText.optional(),
 		retitle: bool.optional(),
 		relations: z.array(z.object({
@@ -21577,7 +21758,7 @@ function tokenize(rawInput) {
 	return tokens;
 }
 function metadataDroppedLine(dropped) {
-	return "  metadata_dropped: timestamps=" + String(dropped.timestamps) + ", trust=" + String(dropped.trust) + ", assert_count=" + String(dropped.assert_count) + ", helpful_count=" + String(dropped.helpful_count) + ", pinned=" + String(dropped.pinned) + ", supersedes=" + String(dropped.supersedes);
+	return "  metadata_dropped: timestamps=" + String(dropped.timestamps) + ", trust=" + String(dropped.trust) + ", assert_count=" + String(dropped.assert_count) + ", helpful_count=" + String(dropped.helpful_count) + ", pinned=" + String(dropped.pinned) + ", supersedes=" + String(dropped.supersedes) + ", ttl_days=" + String(dropped.ttl_days) + ", valid_to=" + String(dropped.valid_to);
 }
 /** Failures are rendered in full up to {@link FAILURES_SHOWN}; the rest is a count, never silence. */
 const FAILURES_SHOWN = 5;