@fgv/ts-agent-memory 5.1.0-47 → 5.1.0-49

package/lib/packlets/store/vectorMaintenance.d.ts

@@ -0,0 +1,149 @@
+import { Result } from '@fgv/ts-utils';
+import { MemoryEmbedOutcome } from '../observe';
+import { IEdgeTarget, IMemoryRecord, Kind, MemoryId, MemoryScopeKey } from '../types';
+import { FragmentEmbedder, IFragmentVectorIndex, IVectorIndex, MemoryEmbedder } from '../vector';
+/**
+ * The internal outcome of record-level embed-on-write: the record to persist,
+ * plus — only when the embedder declined a record that already carried an
+ * `embeddingRef` — the index entry that reference superseded.
+ *
+ * `stale` is carried out to the caller rather than acted on in place because the
+ * prune belongs on the far side of `_persist`: a persist that fails leaves the
+ * PREVIOUS content on disk, and the superseded vector is still an accurate
+ * embedding of that content.
+ * @internal
+ */
+export interface IEmbedOnWriteOutcome {
+    readonly record: IMemoryRecord<string>;
+    readonly stale?: {
+        readonly index: IVectorIndex;
+        readonly target: IEdgeTarget;
+    };
+    /**
+     * What the record-granular index did, surfaced on the write observation.
+     * `undefined` when the question does not apply (nothing wired).
+     */
+    readonly embed?: MemoryEmbedOutcome;
+}
+/**
+ * What {@link VectorMaintenance} needs from the store it serves. Every field is
+ * the store's own, passed in rather than reached for, so this collaborator holds
+ * no reference back to the store and cannot quietly grow one.
+ * @internal
+ */
+export interface IVectorMaintenanceParams {
+    readonly vectorIndex?: IVectorIndex;
+    readonly embed?: MemoryEmbedder;
+    readonly fragmentIndex?: IFragmentVectorIndex;
+    readonly fragmentEmbedder?: FragmentEmbedder;
+    /** The store's swallowed-failure logger; every vector fault is best-effort. */
+    readonly warn: (message: string) => void;
+    /**
+     * The store's per-kind record-index participation predicate
+     * (`IMemoryStore.embedsKind`). Passed in rather than re-derived so the store's
+     * declaration and the gate that enforces it cannot disagree.
+     */
+    readonly embedsKind: (kind: Kind) => boolean;
+}
+/**
+ * The store's record- and fragment-vector maintenance, extracted from
+ * {@link FileTreeMemoryStore} as a collaborator.
+ *
+ * @remarks
+ * Everything here is **best-effort by contract**: the durable record store is
+ * authoritative and both indexes are derived, rebuildable views, so a failed
+ * embed, add or remove is logged and the write still succeeds. Nothing in this
+ * class can turn a committed write into a `Failure` — which is exactly why it
+ * separates cleanly from the store's write path, where every step is fallible
+ * and fatal.
+ *
+ * The split is behavior-preserving: these are the same methods the store used to
+ * carry as privates, with the same call order and the same logging. What moved is
+ * where they live, not what they do.
+ * @internal
+ */
+export declare class VectorMaintenance {
+    private readonly _vectorIndex;
+    private readonly _embed;
+    private readonly _fragmentIndex;
+    private readonly _fragmentEmbedder;
+    private readonly _warn;
+    private readonly _embedsKind;
+    constructor(params: IVectorMaintenanceParams);
+    /**
+     * Best-effort removal of everything the two indexes hold for one record. Used
+     * by the delete path and by cull-oldest eviction, both of which have already
+     * committed by the time they call it.
+     */
+    removeAll(target: IEdgeTarget): Promise<void>;
+    /**
+     * Best-effort embed-on-write. When a vector index AND an embedder are wired,
+     * embeds the built record, `add`s the vector (replace semantics handle a same-id
+     * re-embed — no explicit remove), and stamps the returned `embeddingRef`. A
+     * failure (returned `fail` OR a thrown/rejected hook) is logged and the
+     * unembedded record is returned unchanged — the put still persists, and the
+     * derived index is reconciled by a later `rebuild`. A pass-through no-op when
+     * unwired (byte-identical record).
+     *
+     * A **decline** is not a failure and is handled differently: see
+     * `declineEmbedding`.
+     *
+     * Always succeeds (`Result` is the chain's shape, never a vector-induced
+     * failure).
+     */
+    embedOnWrite(built: IMemoryRecord<string>, scope: MemoryScopeKey): Promise<Result<IEmbedOnWriteOutcome>>;
+    /**
+     * Prune the vector a decline superseded. Best-effort like the rest of the
+     * vector path: a failed `remove` is logged and the (already-persisted) record
+     * still carries no `embeddingRef`, because the record's own claim about itself
+     * should be true even when the derived index is momentarily stale — that is
+     * exactly what a later `rebuild` reconciles.
+     *
+     * The index travels with the target rather than being re-read from the instance
+     * so the prune lands on the same index the decline was made against, and so
+     * there is no second "is a vector index wired?" check whose false branch cannot
+     * be reached.
+     */
+    pruneStaleVector(stale: IEmbedOnWriteOutcome['stale']): Promise<void>;
+    /**
+     * Best-effort fragment-embed-on-write. When a fragment index AND a fragment
+     * embedder are wired, chunks + embeds the built record and replaces its
+     * fragments in the index (`addFragments` is whole-record-replace, so a re-authored
+     * document never leaves stale fragments behind — no explicit remove needed). A
+     * failure (returned `fail` OR a thrown/rejected hook) is logged and the record is
+     * returned unchanged — the put still persists, and the fragment index is a derived
+     * view a later `rebuild` reconciles. Unlike `embedOnWrite`
+     * it stamps nothing on the record (fragments have no per-record `embeddingRef`
+     * analog). A pass-through no-op when unwired (byte-identical record).
+     */
+    embedFragmentsOnWrite(built: IMemoryRecord<string>, scope: MemoryScopeKey): Promise<Result<IMemoryRecord<string>>>;
+    /**
+     * Best-effort fragment removal. A no-op unless the full fragment lifecycle is
+     * wired (both an index AND an embedder), so an unwired store does no fragment
+     * work and behaves byte-identically. Failures are logged, never surfaced — a
+     * committed delete/eviction must not fail because a derived fragment index could
+     * not be pruned.
+     */
+    private _removeFragmentsBestEffort;
+    /**
+     * Best-effort vector removal for each evicted record (never fails the put).
+     * Every evicted record is in the same `scope` as the incoming write (the
+     * cull-oldest cohort is the incoming record's `(scope, kind)` cohort), so that
+     * scope qualifies each removal target.
+     */
+    removeEvictedVectors(evicted: ReadonlyArray<MemoryId>, scope: MemoryScopeKey): Promise<void>;
+    /**
+     * Run a consumer-supplied vector hook, normalizing a thrown/rejected hook into a
+     * `Failure` and logging any failure at `warn`. Best-effort: the caller proceeds
+     * regardless, since the index is rebuildable.
+     */
+    private _tryVectorOp;
+    /**
+     * Best-effort vector removal. A no-op unless the full vector lifecycle is wired
+     * (both an index AND an embedder), so an unwired store does no vector work and
+     * behaves byte-identically. Failures are logged, never surfaced — a committed
+     * delete/eviction must not fail because a derived index could not be pruned.
+     */
+    private _removeVectorBestEffort;
+}
+//# sourceMappingURL=vectorMaintenance.d.ts.map

package/lib/packlets/store/vectorMaintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vectorMaintenance.d.ts","sourceRoot":"","sources":["../../../src/packlets/store/vectorMaintenance.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACf,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;CACrC;AA4CD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmC;IAClE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA+B;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;gBAEnC,MAAM,EAAE,wBAAwB;IASnD;;;;OAIG;IACU,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D;;;;;;;;;;;;;;OAcG;IACU,YAAY,CACvB,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAC5B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAuDxC;;;;;;;;;;;OAWG;IACU,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlF;;;;;;;;;;OAUG;IACU,qBAAqB,CAChC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAC5B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAqBzC;;;;;;OAMG;YACW,0BAA0B;IAQxC;;;;;OAKG;IACU,oBAAoB,CAAC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzG;;;;OAIG;YACW,YAAY;IAa1B;;;;;OAKG;YACW,uBAAuB;CAOtC"}

package/lib/packlets/store/vectorMaintenance.js

@@ -0,0 +1,255 @@
+"use strict";
+/*
+ * Copyright (c) 2026 Erik Fortune
+ * SPDX-License-Identifier: MIT
+ */
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VectorMaintenance = void 0;
+const ts_utils_1 = require("@fgv/ts-utils");
+/**
+ * Project a record the embedder **declined** into its written form: the same
+ * record with no `embeddingRef`, plus the vector (if any) that reference
+ * superseded, for the caller to prune after the commit.
+ *
+ * @remarks
+ * A decline says "this record is intentionally not embedded". A re-put of a
+ * record that *was* embedded (or a caller who supplied an `embeddingRef` — the
+ * field is store-derived by contract but nothing strips it) arrives here
+ * carrying an inherited reference, so returning it unchanged would persist
+ * `embeddingRef` on a record the store just decided not to embed.
+ *
+ * Clearing the reference alone would be cosmetic and arguably worse: the index
+ * entry keyed on this target would survive, so a semantic query would keep
+ * returning the record — scored on its **previous** content — while the record
+ * itself claimed not to be indexed. So the vector goes too, via
+ * `pruneStaleVector` once the write has committed.
+ * `stale` is set only when a reference was actually inherited, which keeps the
+ * common decline (a record that was never embedded) free of an index round
+ * trip.
+ *
+ * Pure and static: the decision needs nothing from the instance, and deferring
+ * the index call to the caller is what lets it run on the far side of
+ * `_persist`.
+ */
+function declineEmbedding(built, index, target, embed) {
+    if (built.envelope.embeddingRef === undefined) {
+        return { record: built, embed };
+    }
+    // Rest-spread rather than `embeddingRef: undefined`: the envelope is YAML-
+    // serialized, and an explicitly-undefined key is a serializer-dependent way
+    // to say "absent" where dropping the key is not.
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const _a = built.envelope, { embeddingRef } = _a, envelope = __rest(_a, ["embeddingRef"]);
+    return { record: { envelope, body: built.body }, stale: { index, target }, embed };
+}
+/**
+ * The store's record- and fragment-vector maintenance, extracted from
+ * {@link FileTreeMemoryStore} as a collaborator.
+ *
+ * @remarks
+ * Everything here is **best-effort by contract**: the durable record store is
+ * authoritative and both indexes are derived, rebuildable views, so a failed
+ * embed, add or remove is logged and the write still succeeds. Nothing in this
+ * class can turn a committed write into a `Failure` — which is exactly why it
+ * separates cleanly from the store's write path, where every step is fallible
+ * and fatal.
+ *
+ * The split is behavior-preserving: these are the same methods the store used to
+ * carry as privates, with the same call order and the same logging. What moved is
+ * where they live, not what they do.
+ * @internal
+ */
+class VectorMaintenance {
+    constructor(params) {
+        this._vectorIndex = params.vectorIndex;
+        this._embed = params.embed;
+        this._fragmentIndex = params.fragmentIndex;
+        this._fragmentEmbedder = params.fragmentEmbedder;
+        this._warn = params.warn;
+        this._embedsKind = params.embedsKind;
+    }
+    /**
+     * Best-effort removal of everything the two indexes hold for one record. Used
+     * by the delete path and by cull-oldest eviction, both of which have already
+     * committed by the time they call it.
+     */
+    async removeAll(target) {
+        await this._removeVectorBestEffort(target);
+        await this._removeFragmentsBestEffort(target);
+    }
+    /**
+     * Best-effort embed-on-write. When a vector index AND an embedder are wired,
+     * embeds the built record, `add`s the vector (replace semantics handle a same-id
+     * re-embed — no explicit remove), and stamps the returned `embeddingRef`. A
+     * failure (returned `fail` OR a thrown/rejected hook) is logged and the
+     * unembedded record is returned unchanged — the put still persists, and the
+     * derived index is reconciled by a later `rebuild`. A pass-through no-op when
+     * unwired (byte-identical record).
+     *
+     * A **decline** is not a failure and is handled differently: see
+     * `declineEmbedding`.
+     *
+     * Always succeeds (`Result` is the chain's shape, never a vector-induced
+     * failure).
+     */
+    async embedOnWrite(built, scope) {
+        if (this._vectorIndex === undefined || this._embed === undefined) {
+            // No outcome: with nothing wired there is no index for the record to be
+            // absent from, so reporting one would invent a coverage question the
+            // deployment has not asked.
+            return (0, ts_utils_1.succeed)({ record: built });
+        }
+        const vectorIndex = this._vectorIndex;
+        const embed = this._embed;
+        const target = { scope, id: built.envelope.id };
+        // Gate BEFORE the embedder call, which is the whole point: a `MemoryEmbedder`
+        // decline still pays the round trip, and on a locally-hosted model that round
+        // trip IS the cost. A kind excluded here is never handed to the embedder.
+        //
+        // An exclusion reaches the same conclusion as a decline — this record is
+        // intentionally not embedded — so it takes the same path: an inherited
+        // `embeddingRef` is dropped and the vector it named is pruned after the
+        // commit. Otherwise narrowing `embedKinds` on an existing vault would leave
+        // every previously-embedded record of the excluded kind claiming an
+        // embedding the store no longer maintains.
+        if (!this._embedsKind(built.envelope.kind)) {
+            return (0, ts_utils_1.succeed)(declineEmbedding(built, vectorIndex, target, 'excluded'));
+        }
+        const embedded = await this._tryVectorOp(() => embed(built), `embedding '${built.envelope.id}'`);
+        if (embedded.isFailure()) {
+            return (0, ts_utils_1.succeed)({ record: built, embed: 'failed' });
+        }
+        // A deliberate decline (`undefined`) stores the record with no embedding
+        // reference. Deliberately NOT logged, unlike the failure path above: a warning
+        // per write would make routine policy look like a recurring fault, which is
+        // the confusion this return value exists to end. It is still *reported* — as
+        // `embed: 'declined'` on the write observation — because saying nothing at all
+        // is what left `embeddingRef` absence three-ways ambiguous.
+        if (embedded.value === undefined) {
+            return (0, ts_utils_1.succeed)(declineEmbedding(built, vectorIndex, target, 'declined'));
+        }
+        // Hoisted: the `undefined` check above does not narrow across the callback
+        // boundary below, and a local keeps the non-null assertion out of the code.
+        const vector = embedded.value;
+        const added = await this._tryVectorOp(() => vectorIndex.add(target, vector), `vector add for '${built.envelope.id}'`);
+        if (added.isFailure()) {
+            return (0, ts_utils_1.succeed)({ record: built, embed: 'failed' });
+        }
+        return (0, ts_utils_1.succeed)({
+            record: { envelope: Object.assign(Object.assign({}, built.envelope), { embeddingRef: added.value }), body: built.body },
+            embed: 'embedded'
+        });
+    }
+    /**
+     * Prune the vector a decline superseded. Best-effort like the rest of the
+     * vector path: a failed `remove` is logged and the (already-persisted) record
+     * still carries no `embeddingRef`, because the record's own claim about itself
+     * should be true even when the derived index is momentarily stale — that is
+     * exactly what a later `rebuild` reconciles.
+     *
+     * The index travels with the target rather than being re-read from the instance
+     * so the prune lands on the same index the decline was made against, and so
+     * there is no second "is a vector index wired?" check whose false branch cannot
+     * be reached.
+     */
+    async pruneStaleVector(stale) {
+        if (stale === undefined) {
+            return;
+        }
+        await this._tryVectorOp(() => stale.index.remove(stale.target), `vector remove for declined '${stale.target.id}'`);
+    }
+    /**
+     * Best-effort fragment-embed-on-write. When a fragment index AND a fragment
+     * embedder are wired, chunks + embeds the built record and replaces its
+     * fragments in the index (`addFragments` is whole-record-replace, so a re-authored
+     * document never leaves stale fragments behind — no explicit remove needed). A
+     * failure (returned `fail` OR a thrown/rejected hook) is logged and the record is
+     * returned unchanged — the put still persists, and the fragment index is a derived
+     * view a later `rebuild` reconciles. Unlike `embedOnWrite`
+     * it stamps nothing on the record (fragments have no per-record `embeddingRef`
+     * analog). A pass-through no-op when unwired (byte-identical record).
+     */
+    async embedFragmentsOnWrite(built, scope) {
+        if (this._fragmentIndex === undefined || this._fragmentEmbedder === undefined) {
+            return (0, ts_utils_1.succeed)(built);
+        }
+        const fragmentIndex = this._fragmentIndex;
+        const fragmentEmbedder = this._fragmentEmbedder;
+        const target = { scope, id: built.envelope.id };
+        const embedded = await this._tryVectorOp(() => fragmentEmbedder(built), `fragment embedding '${built.envelope.id}'`);
+        if (embedded.isFailure()) {
+            return (0, ts_utils_1.succeed)(built);
+        }
+        await this._tryVectorOp(() => fragmentIndex.addFragments(target, embedded.value), `fragment add for '${built.envelope.id}'`);
+        return (0, ts_utils_1.succeed)(built);
+    }
+    /**
+     * Best-effort fragment removal. A no-op unless the full fragment lifecycle is
+     * wired (both an index AND an embedder), so an unwired store does no fragment
+     * work and behaves byte-identically. Failures are logged, never surfaced — a
+     * committed delete/eviction must not fail because a derived fragment index could
+     * not be pruned.
+     */
+    async _removeFragmentsBestEffort(target) {
+        if (this._fragmentIndex === undefined || this._fragmentEmbedder === undefined) {
+            return;
+        }
+        const fragmentIndex = this._fragmentIndex;
+        await this._tryVectorOp(() => fragmentIndex.remove(target), `fragment removal for '${target.id}'`);
+    }
+    /**
+     * Best-effort vector removal for each evicted record (never fails the put).
+     * Every evicted record is in the same `scope` as the incoming write (the
+     * cull-oldest cohort is the incoming record's `(scope, kind)` cohort), so that
+     * scope qualifies each removal target.
+     */
+    async removeEvictedVectors(evicted, scope) {
+        for (const id of evicted) {
+            await this.removeAll({ scope, id });
+        }
+    }
+    /**
+     * Run a consumer-supplied vector hook, normalizing a thrown/rejected hook into a
+     * `Failure` and logging any failure at `warn`. Best-effort: the caller proceeds
+     * regardless, since the index is rebuildable.
+     */
+    async _tryVectorOp(op, label) {
+        let result;
+        try {
+            result = await op();
+        }
+        catch (err) {
+            result = (0, ts_utils_1.fail)(`${label} threw: ${String(err)}`);
+        }
+        if (result.isFailure()) {
+            this._warn(`memory: ${label} failed (best-effort; derived index left for rebuild): ${result.message}`);
+        }
+        return result;
+    }
+    /**
+     * Best-effort vector removal. A no-op unless the full vector lifecycle is wired
+     * (both an index AND an embedder), so an unwired store does no vector work and
+     * behaves byte-identically. Failures are logged, never surfaced — a committed
+     * delete/eviction must not fail because a derived index could not be pruned.
+     */
+    async _removeVectorBestEffort(target) {
+        if (this._vectorIndex === undefined || this._embed === undefined) {
+            return;
+        }
+        const vectorIndex = this._vectorIndex;
+        await this._tryVectorOp(() => vectorIndex.remove(target), `vector removal for '${target.id}'`);
+    }
+}
+exports.VectorMaintenance = VectorMaintenance;
+//# sourceMappingURL=vectorMaintenance.js.map

package/lib/packlets/store/vectorMaintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vectorMaintenance.js","sourceRoot":"","sources":["../../../src/packlets/store/vectorMaintenance.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;AAEH,4CAAsD;AAgCtD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,gBAAgB,CACvB,KAA4B,EAC5B,KAAmB,EACnB,MAAmB,EACnB,KAAyB;IAEzB,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,iDAAiD;IACjD,6DAA6D;IAC7D,MAAM,KAAgC,KAAK,CAAC,QAAQ,EAA9C,EAAE,YAAY,OAAgC,EAA3B,QAAQ,cAA3B,gBAA6B,CAAiB,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;AACrF,CAAC;AAuBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,iBAAiB;IAQ5B,YAAmB,MAAgC;QACjD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,SAAS,CAAC,MAAmB;QACxC,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,YAAY,CACvB,KAA4B,EAC5B,KAAqB;QAErB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjE,wEAAwE;YACxE,qEAAqE;YACrE,4BAA4B;YAC5B,OAAO,IAAA,kBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,WAAW,GAAiB,IAAI,CAAC,YAAY,CAAC;QACpD,MAAM,KAAK,GAAmB,IAAI,CAAC,MAAM,CAAC;QAC1C,MAAM,MAAM,GAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7D,8EAA8E;QAC9E,8EAA8E;QAC9E,0EAA0E;QAC1E,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,oEAAoE;QACpE,2CAA2C;QAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAA,kBAAO,EAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,QAAQ,GAAqC,MAAM,IAAI,CAAC,YAAY,CACxE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAClB,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CACnC,CAAC;QACF,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAA,kBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,yEAAyE;QACzE,+EAA+E;QAC/E,4EAA4E;QAC5E,6EAA6E;QAC7E,+EAA+E;QAC/E,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAA,kBAAO,EAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,MAAM,GAAiB,QAAQ,CAAC,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAmB,MAAM,IAAI,CAAC,YAAY,CACnD,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,mBAAmB,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CACxC,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO,IAAA,kBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAA,kBAAO,EAAC;YACb,MAAM,EAAE,EAAE,QAAQ,kCAAO,KAAK,CAAC,QAAQ,KAAE,YAAY,EAAE,KAAK,CAAC,KAAK,GAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YACxF,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAAoC;QAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CACrB,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EACtC,+BAA+B,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,qBAAqB,CAChC,KAA4B,EAC5B,KAAqB;QAErB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,IAAA,kBAAO,EAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,aAAa,GAAyB,IAAI,CAAC,cAAc,CAAC;QAChE,MAAM,gBAAgB,GAAqB,IAAI,CAAC,iBAAiB,CAAC;QAClE,MAAM,MAAM,GAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAA6C,MAAM,IAAI,CAAC,YAAY,CAChF,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAC7B,uBAAuB,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAC5C,CAAC;QACF,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAA,kBAAO,EAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CACrB,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EACxD,qBAAqB,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAC1C,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,0BAA0B,CAAC,MAAmB;QAC1D,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAyB,IAAI,CAAC,cAAc,CAAC;QAChE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,yBAAyB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,OAAgC,EAAE,KAAqB;QACvF,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,YAAY,CAAI,EAA4B,EAAE,KAAa;QACvE,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,IAAA,eAAI,EAAC,GAAG,KAAK,WAAW,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,0DAA0D,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,uBAAuB,CAAC,MAAmB;QACvD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAiB,IAAI,CAAC,YAAY,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,uBAAuB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;CACF;AAvND,8CAuNC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\nimport { Result, fail, succeed } from '@fgv/ts-utils';\nimport { MemoryEmbedOutcome } from '../observe';\nimport { IEdgeTarget, IMemoryRecord, Kind, MemoryId, MemoryScopeKey } from '../types';\nimport {\n  FragmentEmbedder,\n  IEmbeddedFragment,\n  IFragmentVectorIndex,\n  IVectorIndex,\n  MemoryEmbedder\n} from '../vector';\n\n/**\n * The internal outcome of record-level embed-on-write: the record to persist,\n * plus — only when the embedder declined a record that already carried an\n * `embeddingRef` — the index entry that reference superseded.\n *\n * `stale` is carried out to the caller rather than acted on in place because the\n * prune belongs on the far side of `_persist`: a persist that fails leaves the\n * PREVIOUS content on disk, and the superseded vector is still an accurate\n * embedding of that content.\n * @internal\n */\nexport interface IEmbedOnWriteOutcome {\n  readonly record: IMemoryRecord<string>;\n  readonly stale?: { readonly index: IVectorIndex; readonly target: IEdgeTarget };\n  /**\n   * What the record-granular index did, surfaced on the write observation.\n   * `undefined` when the question does not apply (nothing wired).\n   */\n  readonly embed?: MemoryEmbedOutcome;\n}\n\n/**\n * Project a record the embedder **declined** into its written form: the same\n * record with no `embeddingRef`, plus the vector (if any) that reference\n * superseded, for the caller to prune after the commit.\n *\n * @remarks\n * A decline says \"this record is intentionally not embedded\". A re-put of a\n * record that *was* embedded (or a caller who supplied an `embeddingRef` — the\n * field is store-derived by contract but nothing strips it) arrives here\n * carrying an inherited reference, so returning it unchanged would persist\n * `embeddingRef` on a record the store just decided not to embed.\n *\n * Clearing the reference alone would be cosmetic and arguably worse: the index\n * entry keyed on this target would survive, so a semantic query would keep\n * returning the record — scored on its **previous** content — while the record\n * itself claimed not to be indexed. So the vector goes too, via\n * `pruneStaleVector` once the write has committed.\n * `stale` is set only when a reference was actually inherited, which keeps the\n * common decline (a record that was never embedded) free of an index round\n * trip.\n *\n * Pure and static: the decision needs nothing from the instance, and deferring\n * the index call to the caller is what lets it run on the far side of\n * `_persist`.\n */\nfunction declineEmbedding(\n  built: IMemoryRecord<string>,\n  index: IVectorIndex,\n  target: IEdgeTarget,\n  embed: MemoryEmbedOutcome\n): IEmbedOnWriteOutcome {\n  if (built.envelope.embeddingRef === undefined) {\n    return { record: built, embed };\n  }\n  // Rest-spread rather than `embeddingRef: undefined`: the envelope is YAML-\n  // serialized, and an explicitly-undefined key is a serializer-dependent way\n  // to say \"absent\" where dropping the key is not.\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const { embeddingRef, ...envelope } = built.envelope;\n  return { record: { envelope, body: built.body }, stale: { index, target }, embed };\n}\n\n/**\n * What {@link VectorMaintenance} needs from the store it serves. Every field is\n * the store's own, passed in rather than reached for, so this collaborator holds\n * no reference back to the store and cannot quietly grow one.\n * @internal\n */\nexport interface IVectorMaintenanceParams {\n  readonly vectorIndex?: IVectorIndex;\n  readonly embed?: MemoryEmbedder;\n  readonly fragmentIndex?: IFragmentVectorIndex;\n  readonly fragmentEmbedder?: FragmentEmbedder;\n  /** The store's swallowed-failure logger; every vector fault is best-effort. */\n  readonly warn: (message: string) => void;\n  /**\n   * The store's per-kind record-index participation predicate\n   * (`IMemoryStore.embedsKind`). Passed in rather than re-derived so the store's\n   * declaration and the gate that enforces it cannot disagree.\n   */\n  readonly embedsKind: (kind: Kind) => boolean;\n}\n\n/**\n * The store's record- and fragment-vector maintenance, extracted from\n * {@link FileTreeMemoryStore} as a collaborator.\n *\n * @remarks\n * Everything here is **best-effort by contract**: the durable record store is\n * authoritative and both indexes are derived, rebuildable views, so a failed\n * embed, add or remove is logged and the write still succeeds. Nothing in this\n * class can turn a committed write into a `Failure` — which is exactly why it\n * separates cleanly from the store's write path, where every step is fallible\n * and fatal.\n *\n * The split is behavior-preserving: these are the same methods the store used to\n * carry as privates, with the same call order and the same logging. What moved is\n * where they live, not what they do.\n * @internal\n */\nexport class VectorMaintenance {\n  private readonly _vectorIndex: IVectorIndex | undefined;\n  private readonly _embed: MemoryEmbedder | undefined;\n  private readonly _fragmentIndex: IFragmentVectorIndex | undefined;\n  private readonly _fragmentEmbedder: FragmentEmbedder | undefined;\n  private readonly _warn: (message: string) => void;\n  private readonly _embedsKind: (kind: Kind) => boolean;\n\n  public constructor(params: IVectorMaintenanceParams) {\n    this._vectorIndex = params.vectorIndex;\n    this._embed = params.embed;\n    this._fragmentIndex = params.fragmentIndex;\n    this._fragmentEmbedder = params.fragmentEmbedder;\n    this._warn = params.warn;\n    this._embedsKind = params.embedsKind;\n  }\n\n  /**\n   * Best-effort removal of everything the two indexes hold for one record. Used\n   * by the delete path and by cull-oldest eviction, both of which have already\n   * committed by the time they call it.\n   */\n  public async removeAll(target: IEdgeTarget): Promise<void> {\n    await this._removeVectorBestEffort(target);\n    await this._removeFragmentsBestEffort(target);\n  }\n\n  /**\n   * Best-effort embed-on-write. When a vector index AND an embedder are wired,\n   * embeds the built record, `add`s the vector (replace semantics handle a same-id\n   * re-embed — no explicit remove), and stamps the returned `embeddingRef`. A\n   * failure (returned `fail` OR a thrown/rejected hook) is logged and the\n   * unembedded record is returned unchanged — the put still persists, and the\n   * derived index is reconciled by a later `rebuild`. A pass-through no-op when\n   * unwired (byte-identical record).\n   *\n   * A **decline** is not a failure and is handled differently: see\n   * `declineEmbedding`.\n   *\n   * Always succeeds (`Result` is the chain's shape, never a vector-induced\n   * failure).\n   */\n  public async embedOnWrite(\n    built: IMemoryRecord<string>,\n    scope: MemoryScopeKey\n  ): Promise<Result<IEmbedOnWriteOutcome>> {\n    if (this._vectorIndex === undefined || this._embed === undefined) {\n      // No outcome: with nothing wired there is no index for the record to be\n      // absent from, so reporting one would invent a coverage question the\n      // deployment has not asked.\n      return succeed({ record: built });\n    }\n    const vectorIndex: IVectorIndex = this._vectorIndex;\n    const embed: MemoryEmbedder = this._embed;\n    const target: IEdgeTarget = { scope, id: built.envelope.id };\n    // Gate BEFORE the embedder call, which is the whole point: a `MemoryEmbedder`\n    // decline still pays the round trip, and on a locally-hosted model that round\n    // trip IS the cost. A kind excluded here is never handed to the embedder.\n    //\n    // An exclusion reaches the same conclusion as a decline — this record is\n    // intentionally not embedded — so it takes the same path: an inherited\n    // `embeddingRef` is dropped and the vector it named is pruned after the\n    // commit. Otherwise narrowing `embedKinds` on an existing vault would leave\n    // every previously-embedded record of the excluded kind claiming an\n    // embedding the store no longer maintains.\n    if (!this._embedsKind(built.envelope.kind)) {\n      return succeed(declineEmbedding(built, vectorIndex, target, 'excluded'));\n    }\n    const embedded: Result<Float32Array | undefined> = await this._tryVectorOp(\n      () => embed(built),\n      `embedding '${built.envelope.id}'`\n    );\n    if (embedded.isFailure()) {\n      return succeed({ record: built, embed: 'failed' });\n    }\n    // A deliberate decline (`undefined`) stores the record with no embedding\n    // reference. Deliberately NOT logged, unlike the failure path above: a warning\n    // per write would make routine policy look like a recurring fault, which is\n    // the confusion this return value exists to end. It is still *reported* — as\n    // `embed: 'declined'` on the write observation — because saying nothing at all\n    // is what left `embeddingRef` absence three-ways ambiguous.\n    if (embedded.value === undefined) {\n      return succeed(declineEmbedding(built, vectorIndex, target, 'declined'));\n    }\n    // Hoisted: the `undefined` check above does not narrow across the callback\n    // boundary below, and a local keeps the non-null assertion out of the code.\n    const vector: Float32Array = embedded.value;\n    const added: Result<string> = await this._tryVectorOp(\n      () => vectorIndex.add(target, vector),\n      `vector add for '${built.envelope.id}'`\n    );\n    if (added.isFailure()) {\n      return succeed({ record: built, embed: 'failed' });\n    }\n    return succeed({\n      record: { envelope: { ...built.envelope, embeddingRef: added.value }, body: built.body },\n      embed: 'embedded'\n    });\n  }\n\n  /**\n   * Prune the vector a decline superseded. Best-effort like the rest of the\n   * vector path: a failed `remove` is logged and the (already-persisted) record\n   * still carries no `embeddingRef`, because the record's own claim about itself\n   * should be true even when the derived index is momentarily stale — that is\n   * exactly what a later `rebuild` reconciles.\n   *\n   * The index travels with the target rather than being re-read from the instance\n   * so the prune lands on the same index the decline was made against, and so\n   * there is no second \"is a vector index wired?\" check whose false branch cannot\n   * be reached.\n   */\n  public async pruneStaleVector(stale: IEmbedOnWriteOutcome['stale']): Promise<void> {\n    if (stale === undefined) {\n      return;\n    }\n    await this._tryVectorOp(\n      () => stale.index.remove(stale.target),\n      `vector remove for declined '${stale.target.id}'`\n    );\n  }\n\n  /**\n   * Best-effort fragment-embed-on-write. When a fragment index AND a fragment\n   * embedder are wired, chunks + embeds the built record and replaces its\n   * fragments in the index (`addFragments` is whole-record-replace, so a re-authored\n   * document never leaves stale fragments behind — no explicit remove needed). A\n   * failure (returned `fail` OR a thrown/rejected hook) is logged and the record is\n   * returned unchanged — the put still persists, and the fragment index is a derived\n   * view a later `rebuild` reconciles. Unlike `embedOnWrite`\n   * it stamps nothing on the record (fragments have no per-record `embeddingRef`\n   * analog). A pass-through no-op when unwired (byte-identical record).\n   */\n  public async embedFragmentsOnWrite(\n    built: IMemoryRecord<string>,\n    scope: MemoryScopeKey\n  ): Promise<Result<IMemoryRecord<string>>> {\n    if (this._fragmentIndex === undefined || this._fragmentEmbedder === undefined) {\n      return succeed(built);\n    }\n    const fragmentIndex: IFragmentVectorIndex = this._fragmentIndex;\n    const fragmentEmbedder: FragmentEmbedder = this._fragmentEmbedder;\n    const target: IEdgeTarget = { scope, id: built.envelope.id };\n    const embedded: Result<ReadonlyArray<IEmbeddedFragment>> = await this._tryVectorOp(\n      () => fragmentEmbedder(built),\n      `fragment embedding '${built.envelope.id}'`\n    );\n    if (embedded.isFailure()) {\n      return succeed(built);\n    }\n    await this._tryVectorOp(\n      () => fragmentIndex.addFragments(target, embedded.value),\n      `fragment add for '${built.envelope.id}'`\n    );\n    return succeed(built);\n  }\n\n  /**\n   * Best-effort fragment removal. A no-op unless the full fragment lifecycle is\n   * wired (both an index AND an embedder), so an unwired store does no fragment\n   * work and behaves byte-identically. Failures are logged, never surfaced — a\n   * committed delete/eviction must not fail because a derived fragment index could\n   * not be pruned.\n   */\n  private async _removeFragmentsBestEffort(target: IEdgeTarget): Promise<void> {\n    if (this._fragmentIndex === undefined || this._fragmentEmbedder === undefined) {\n      return;\n    }\n    const fragmentIndex: IFragmentVectorIndex = this._fragmentIndex;\n    await this._tryVectorOp(() => fragmentIndex.remove(target), `fragment removal for '${target.id}'`);\n  }\n\n  /**\n   * Best-effort vector removal for each evicted record (never fails the put).\n   * Every evicted record is in the same `scope` as the incoming write (the\n   * cull-oldest cohort is the incoming record's `(scope, kind)` cohort), so that\n   * scope qualifies each removal target.\n   */\n  public async removeEvictedVectors(evicted: ReadonlyArray<MemoryId>, scope: MemoryScopeKey): Promise<void> {\n    for (const id of evicted) {\n      await this.removeAll({ scope, id });\n    }\n  }\n\n  /**\n   * Run a consumer-supplied vector hook, normalizing a thrown/rejected hook into a\n   * `Failure` and logging any failure at `warn`. Best-effort: the caller proceeds\n   * regardless, since the index is rebuildable.\n   */\n  private async _tryVectorOp<T>(op: () => Promise<Result<T>>, label: string): Promise<Result<T>> {\n    let result: Result<T>;\n    try {\n      result = await op();\n    } catch (err) {\n      result = fail(`${label} threw: ${String(err)}`);\n    }\n    if (result.isFailure()) {\n      this._warn(`memory: ${label} failed (best-effort; derived index left for rebuild): ${result.message}`);\n    }\n    return result;\n  }\n\n  /**\n   * Best-effort vector removal. A no-op unless the full vector lifecycle is wired\n   * (both an index AND an embedder), so an unwired store does no vector work and\n   * behaves byte-identically. Failures are logged, never surfaced — a committed\n   * delete/eviction must not fail because a derived index could not be pruned.\n   */\n  private async _removeVectorBestEffort(target: IEdgeTarget): Promise<void> {\n    if (this._vectorIndex === undefined || this._embed === undefined) {\n      return;\n    }\n    const vectorIndex: IVectorIndex = this._vectorIndex;\n    await this._tryVectorOp(() => vectorIndex.remove(target), `vector removal for '${target.id}'`);\n  }\n}\n"]}

package/lib/packlets/types/envelope.d.ts

@@ -133,6 +133,14 @@ export interface IMemoryEnvelope {
      * Absent when the kind has no registered projector (or the projector threw on
      * this record). Ordered retrieval (`orderBy: 'rank'`) and the index's rank view
      * sort by this value descending, placing records with an absent `rank` last.
+     *
+     * **The projector runs on the write path only — registering one does not rank
+     * records already in the store.** Because absent sorts last, those records land
+     * below every subsequently-written one regardless of what the projector would
+     * have scored them, so the result is not a partial ordering but one inverted
+     * with respect to the projector's intent, with nothing failing to say so. Call
+     * `IMemoryStore.reconcileRank` after registering a projector against a
+     * populated store.
      */
     readonly rank?: number;
     /** Structured provenance (never a flat enum). */
@@ -166,6 +174,9 @@ export interface IMemoryRecord<TBody = unknown> {
  * {@link IMemoryEnvelope.rank}. The store never interprets the body — the host
  * owns what the number means. A projector that throws is treated as "no rank
  * for this record" (logged at `warn`), never failing the write.
+ *
+ * Runs on writes only. To apply a newly-registered projector to records that
+ * already exist, call `IMemoryStore.reconcileRank`.
  * @public
  */
 export type RankProjector = (record: IMemoryRecord<unknown>) => number;

package/lib/packlets/types/envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../src/packlets/types/envelope.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,iFAAiF;IACjF,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEzD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,KAAK;IACpB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IAEH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IAEjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAGrC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IAGjC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAEnC;;;OAGG;IAEH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa,CAAC,KAAK,GAAG,OAAO;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC"}
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../src/packlets/types/envelope.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,iFAAiF;IACjF,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEzD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,KAAK;IACpB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IAEH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IAEjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAGrC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IAGjC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAEnC;;;OAGG;IAEH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa,CAAC,KAAK,GAAG,OAAO;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC"}

package/lib/packlets/types/envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/packlets/types/envelope.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAmEH,sCAEC;AAZD;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,MAAmB;IAC/C,OAAO,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;AACzC,CAAC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\nimport { EntityId, Kind, LinkType, MemoryId, MemoryScopeKey, Tag } from './ids';\n\n/**\n * Origin of a provenance attribution. Open vocabulary: the three named\n * sources are conventional, but the `(string & {})` arm admits any other\n * source string without resignature.\n * @public\n */\nexport type ProvenanceSource = 'agent' | 'host-ingest' | 'human' | (string & {});\n\n/**\n * Structured provenance for a record or an edge. Never a flat enum — the\n * `[key: string]: unknown` index signature lets a consumer attach an opaque\n * domain payload (e.g. PersonAIlity's sentiment / epistemic blocks) without\n * changing this interface, while still satisfying the no-`any` rule.\n * @public\n */\nexport interface IProvenance {\n  /** Where the attribution came from. */\n  readonly source: ProvenanceSource;\n  /** Optional human or agent identifier responsible for the write. */\n  readonly by?: string;\n  /** Optional model identifier, when a model produced the content. */\n  readonly model?: string;\n  /** Optional confidence in `[0, 1]`. */\n  readonly confidence?: number;\n  /**\n   * Scope-qualified back-link to the source record. Enables the cross-kind\n   * provenance spine. A scope-qualified {@link IEdgeTarget} (not a bare\n   * {@link MemoryId}) because per-scope codecs (e.g. the MTM codec's `turn-<n>`\n   * stems) legally reuse a stem across scopes, so a bare id would be ambiguous —\n   * the same reason {@link IEdge.target} is scope-qualified.\n   */\n  readonly derivedFrom?: IEdgeTarget;\n  /** Opaque extension payload — consumer-owned, never interpreted by the store. */\n  readonly [key: string]: unknown;\n}\n\n/**\n * The physical address of a linked-to record: the `(scope, id)` pair that\n * uniquely identifies it. Both components are required because a bare\n * {@link MemoryId} is NOT unique across scopes — per-scope codecs (e.g. the\n * medium-term codec's `turn-<n>` stems) legally mint the same stem under\n * different scopes, so an edge that carried only the id would be ambiguous.\n * `(scope, id)` matches the store's `getById(scope, id)` addressing and the\n * index's composite primary key.\n * @public\n */\nexport interface IEdgeTarget {\n  /** The scope the target record lives under. */\n  readonly scope: MemoryScopeKey;\n  /** The target record's stable file-stem id (unique WITHIN {@link IEdgeTarget.scope}). */\n  readonly id: MemoryId;\n}\n\n/**\n * The canonical composite-key string for an {@link IEdgeTarget}: scope + id,\n * NUL-separated. NUL is excluded from both components (scope segments are\n * filename-safe; {@link MemoryId} is portable-filename-safe), so it is a\n * collision-proof separator. This is the ONE canonicalization every consumer\n * that keys on a scoped target uses — the backlink index, the cycle guard, and\n * the ingest edge-validation path all route through it so their notions of\n * \"same target\" cannot drift.\n * @public\n */\nexport function edgeTargetKey(target: IEdgeTarget): string {\n  return `${target.scope}\\0${target.id}`;\n}\n\n/**\n * An attributed link between two records. Carries the relation type, the\n * scope-qualified {@link IEdgeTarget | target}, and optional confidence /\n * provenance / world-truth validity. Replaces bare string references (e.g.\n * PersonAIlity's `IMtmRef` becomes an `IEdge` with `type: LinkType('mtm-ref')`).\n * @public\n */\nexport interface IEdge {\n  /** Open-vocabulary relation type. */\n  readonly type: LinkType;\n  /** The scope-qualified address of the linked-to record. */\n  readonly target: IEdgeTarget;\n  /** Optional confidence in `[0, 1]`. */\n  readonly confidence?: number;\n  /** Optional structured provenance for the link itself. */\n  readonly provenance?: IProvenance;\n  /** World-truth validity start (epoch ms). Present only on temporal edges. */\n  readonly valid_at?: number;\n  /**\n   * World-truth validity end (epoch ms). `null` = still valid; absent = no\n   * temporal extent.\n   */\n  // eslint-disable-next-line @rushstack/no-new-null -- null is a meaningful value here (still-valid) distinct from absent (no temporal extent); design-lock §2.3\n  readonly invalid_at?: number | null;\n}\n\n/**\n * Optional bi-temporal validity block on an envelope. Present only on\n * temporal kinds; absent = zero cost for atemporal kinds.\n * @public\n */\nexport interface ITemporalBlock {\n  /** World-truth validity start (epoch ms). */\n  readonly valid_at?: number;\n  /** World-truth validity end (epoch ms). `null` = still valid. */\n  // eslint-disable-next-line @rushstack/no-new-null -- null is a meaningful value here (still-valid) distinct from absent; design-lock §2.4\n  readonly invalid_at?: number | null;\n}\n\n/**\n * The invariant identity + transaction-time envelope carried by every memory\n * record, independent of the per-kind body.\n * @public\n */\nexport interface IMemoryEnvelope {\n  // --- Core identity ---\n  /** Stable file-stem identifier. MUST equal the on-disk filename stem. */\n  readonly id: MemoryId;\n  /** Consumer-supplied domain key. Equals {@link IMemoryEnvelope.id | id} for non-temporal kinds. */\n  readonly entityId: EntityId;\n  /** Consumer-registered kind; dispatches the body Converter. */\n  readonly kind: Kind;\n  /** Open-vocabulary tags. */\n  readonly tags: ReadonlyArray<Tag>;\n  /** Attributed outbound edges. */\n  readonly links: ReadonlyArray<IEdge>;\n\n  // --- Transaction-time metadata (always present) ---\n  /** Epoch ms of the first write. Immutable after creation. */\n  readonly created: number;\n  /** Epoch ms of the most recent write. */\n  readonly updated: number;\n  /**\n   * Monotonic write counter within the store instance, assigned by the store\n   * on every successful put. Enables stable cursor paging over observation\n   * records without a full walk.\n   */\n  readonly seq: number;\n  /**\n   * Content hash over the canonical `{ kind, body, links }`. The dedup key:\n   * an exact match is a no-op upsert that returns the existing record.\n   */\n  readonly contentHash: string;\n  /**\n   * Store-computed host-defined ordering value, produced by the kind's\n   * {@link RankProjector} on every put/update and stamped into the envelope in\n   * the same pass that recomputes {@link IMemoryEnvelope.contentHash | contentHash}.\n   * Absent when the kind has no registered projector (or the projector threw on\n   * this record). Ordered retrieval (`orderBy: 'rank'`) and the index's rank view\n   * sort by this value descending, placing records with an absent `rank` last.\n   */\n  readonly rank?: number;\n  /** Structured provenance (never a flat enum). */\n  readonly provenance: IProvenance;\n\n  // --- Optional temporal block ---\n  /** Bi-temporal validity. Present only on temporal kinds. */\n  readonly temporal?: ITemporalBlock;\n\n  /**\n   * Vector-index entry reference, set by the vector index on write. `null` =\n   * not embedded; absent = same as `null` (backwards-compat seam).\n   */\n  // eslint-disable-next-line @rushstack/no-new-null -- null is the explicit \"not embedded\" sentinel distinct from absent (backwards-compat seam); design-lock §2.5\n  readonly embeddingRef?: string | null;\n}\n\n/**\n * A complete memory record: the invariant {@link IMemoryEnvelope} plus the\n * typed, per-kind body. The store's public surface uses\n * `IMemoryRecord<unknown>`; consumers narrow `TBody` by checking\n * `envelope.kind` and validating through the registered Converter.\n * @public\n */\nexport interface IMemoryRecord<TBody = unknown> {\n  /** The invariant identity + transaction-time envelope. */\n  readonly envelope: IMemoryEnvelope;\n  /** The per-kind, Converter-validated body. */\n  readonly body: TBody;\n}\n\n/**\n * A per-kind host projection from a fully-resolved (post-merge) memory record\n * to a numeric ordering value. Registered per kind at store construction (see\n * `rankProjectors`); the store runs it on every put/update over the same\n * resolved record whose `contentHash` it computes, stamping the result into\n * {@link IMemoryEnvelope.rank}. The store never interprets the body — the host\n * owns what the number means. A projector that throws is treated as \"no rank\n * for this record\" (logged at `warn`), never failing the write.\n * @public\n */\nexport type RankProjector = (record: IMemoryRecord<unknown>) => number;\n"]}
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/packlets/types/envelope.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAmEH,sCAEC;AAZD;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,MAAmB;IAC/C,OAAO,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;AACzC,CAAC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\nimport { EntityId, Kind, LinkType, MemoryId, MemoryScopeKey, Tag } from './ids';\n\n/**\n * Origin of a provenance attribution. Open vocabulary: the three named\n * sources are conventional, but the `(string & {})` arm admits any other\n * source string without resignature.\n * @public\n */\nexport type ProvenanceSource = 'agent' | 'host-ingest' | 'human' | (string & {});\n\n/**\n * Structured provenance for a record or an edge. Never a flat enum — the\n * `[key: string]: unknown` index signature lets a consumer attach an opaque\n * domain payload (e.g. PersonAIlity's sentiment / epistemic blocks) without\n * changing this interface, while still satisfying the no-`any` rule.\n * @public\n */\nexport interface IProvenance {\n  /** Where the attribution came from. */\n  readonly source: ProvenanceSource;\n  /** Optional human or agent identifier responsible for the write. */\n  readonly by?: string;\n  /** Optional model identifier, when a model produced the content. */\n  readonly model?: string;\n  /** Optional confidence in `[0, 1]`. */\n  readonly confidence?: number;\n  /**\n   * Scope-qualified back-link to the source record. Enables the cross-kind\n   * provenance spine. A scope-qualified {@link IEdgeTarget} (not a bare\n   * {@link MemoryId}) because per-scope codecs (e.g. the MTM codec's `turn-<n>`\n   * stems) legally reuse a stem across scopes, so a bare id would be ambiguous —\n   * the same reason {@link IEdge.target} is scope-qualified.\n   */\n  readonly derivedFrom?: IEdgeTarget;\n  /** Opaque extension payload — consumer-owned, never interpreted by the store. */\n  readonly [key: string]: unknown;\n}\n\n/**\n * The physical address of a linked-to record: the `(scope, id)` pair that\n * uniquely identifies it. Both components are required because a bare\n * {@link MemoryId} is NOT unique across scopes — per-scope codecs (e.g. the\n * medium-term codec's `turn-<n>` stems) legally mint the same stem under\n * different scopes, so an edge that carried only the id would be ambiguous.\n * `(scope, id)` matches the store's `getById(scope, id)` addressing and the\n * index's composite primary key.\n * @public\n */\nexport interface IEdgeTarget {\n  /** The scope the target record lives under. */\n  readonly scope: MemoryScopeKey;\n  /** The target record's stable file-stem id (unique WITHIN {@link IEdgeTarget.scope}). */\n  readonly id: MemoryId;\n}\n\n/**\n * The canonical composite-key string for an {@link IEdgeTarget}: scope + id,\n * NUL-separated. NUL is excluded from both components (scope segments are\n * filename-safe; {@link MemoryId} is portable-filename-safe), so it is a\n * collision-proof separator. This is the ONE canonicalization every consumer\n * that keys on a scoped target uses — the backlink index, the cycle guard, and\n * the ingest edge-validation path all route through it so their notions of\n * \"same target\" cannot drift.\n * @public\n */\nexport function edgeTargetKey(target: IEdgeTarget): string {\n  return `${target.scope}\\0${target.id}`;\n}\n\n/**\n * An attributed link between two records. Carries the relation type, the\n * scope-qualified {@link IEdgeTarget | target}, and optional confidence /\n * provenance / world-truth validity. Replaces bare string references (e.g.\n * PersonAIlity's `IMtmRef` becomes an `IEdge` with `type: LinkType('mtm-ref')`).\n * @public\n */\nexport interface IEdge {\n  /** Open-vocabulary relation type. */\n  readonly type: LinkType;\n  /** The scope-qualified address of the linked-to record. */\n  readonly target: IEdgeTarget;\n  /** Optional confidence in `[0, 1]`. */\n  readonly confidence?: number;\n  /** Optional structured provenance for the link itself. */\n  readonly provenance?: IProvenance;\n  /** World-truth validity start (epoch ms). Present only on temporal edges. */\n  readonly valid_at?: number;\n  /**\n   * World-truth validity end (epoch ms). `null` = still valid; absent = no\n   * temporal extent.\n   */\n  // eslint-disable-next-line @rushstack/no-new-null -- null is a meaningful value here (still-valid) distinct from absent (no temporal extent); design-lock §2.3\n  readonly invalid_at?: number | null;\n}\n\n/**\n * Optional bi-temporal validity block on an envelope. Present only on\n * temporal kinds; absent = zero cost for atemporal kinds.\n * @public\n */\nexport interface ITemporalBlock {\n  /** World-truth validity start (epoch ms). */\n  readonly valid_at?: number;\n  /** World-truth validity end (epoch ms). `null` = still valid. */\n  // eslint-disable-next-line @rushstack/no-new-null -- null is a meaningful value here (still-valid) distinct from absent; design-lock §2.4\n  readonly invalid_at?: number | null;\n}\n\n/**\n * The invariant identity + transaction-time envelope carried by every memory\n * record, independent of the per-kind body.\n * @public\n */\nexport interface IMemoryEnvelope {\n  // --- Core identity ---\n  /** Stable file-stem identifier. MUST equal the on-disk filename stem. */\n  readonly id: MemoryId;\n  /** Consumer-supplied domain key. Equals {@link IMemoryEnvelope.id | id} for non-temporal kinds. */\n  readonly entityId: EntityId;\n  /** Consumer-registered kind; dispatches the body Converter. */\n  readonly kind: Kind;\n  /** Open-vocabulary tags. */\n  readonly tags: ReadonlyArray<Tag>;\n  /** Attributed outbound edges. */\n  readonly links: ReadonlyArray<IEdge>;\n\n  // --- Transaction-time metadata (always present) ---\n  /** Epoch ms of the first write. Immutable after creation. */\n  readonly created: number;\n  /** Epoch ms of the most recent write. */\n  readonly updated: number;\n  /**\n   * Monotonic write counter within the store instance, assigned by the store\n   * on every successful put. Enables stable cursor paging over observation\n   * records without a full walk.\n   */\n  readonly seq: number;\n  /**\n   * Content hash over the canonical `{ kind, body, links }`. The dedup key:\n   * an exact match is a no-op upsert that returns the existing record.\n   */\n  readonly contentHash: string;\n  /**\n   * Store-computed host-defined ordering value, produced by the kind's\n   * {@link RankProjector} on every put/update and stamped into the envelope in\n   * the same pass that recomputes {@link IMemoryEnvelope.contentHash | contentHash}.\n   * Absent when the kind has no registered projector (or the projector threw on\n   * this record). Ordered retrieval (`orderBy: 'rank'`) and the index's rank view\n   * sort by this value descending, placing records with an absent `rank` last.\n   *\n   * **The projector runs on the write path only — registering one does not rank\n   * records already in the store.** Because absent sorts last, those records land\n   * below every subsequently-written one regardless of what the projector would\n   * have scored them, so the result is not a partial ordering but one inverted\n   * with respect to the projector's intent, with nothing failing to say so. Call\n   * `IMemoryStore.reconcileRank` after registering a projector against a\n   * populated store.\n   */\n  readonly rank?: number;\n  /** Structured provenance (never a flat enum). */\n  readonly provenance: IProvenance;\n\n  // --- Optional temporal block ---\n  /** Bi-temporal validity. Present only on temporal kinds. */\n  readonly temporal?: ITemporalBlock;\n\n  /**\n   * Vector-index entry reference, set by the vector index on write. `null` =\n   * not embedded; absent = same as `null` (backwards-compat seam).\n   */\n  // eslint-disable-next-line @rushstack/no-new-null -- null is the explicit \"not embedded\" sentinel distinct from absent (backwards-compat seam); design-lock §2.5\n  readonly embeddingRef?: string | null;\n}\n\n/**\n * A complete memory record: the invariant {@link IMemoryEnvelope} plus the\n * typed, per-kind body. The store's public surface uses\n * `IMemoryRecord<unknown>`; consumers narrow `TBody` by checking\n * `envelope.kind` and validating through the registered Converter.\n * @public\n */\nexport interface IMemoryRecord<TBody = unknown> {\n  /** The invariant identity + transaction-time envelope. */\n  readonly envelope: IMemoryEnvelope;\n  /** The per-kind, Converter-validated body. */\n  readonly body: TBody;\n}\n\n/**\n * A per-kind host projection from a fully-resolved (post-merge) memory record\n * to a numeric ordering value. Registered per kind at store construction (see\n * `rankProjectors`); the store runs it on every put/update over the same\n * resolved record whose `contentHash` it computes, stamping the result into\n * {@link IMemoryEnvelope.rank}. The store never interprets the body — the host\n * owns what the number means. A projector that throws is treated as \"no rank\n * for this record\" (logged at `warn`), never failing the write.\n *\n * Runs on writes only. To apply a newly-registered projector to records that\n * already exist, call `IMemoryStore.reconcileRank`.\n * @public\n */\nexport type RankProjector = (record: IMemoryRecord<unknown>) => number;\n"]}

package/lib/packlets/vector/inMemoryCosineIndex.d.ts

@@ -1,6 +1,6 @@
 import { Result } from '@fgv/ts-utils';
 import { IEdgeTarget } from '../types';
-import { IMemoryRecordSource, IVectorIndex, IVectorQueryHit, MemoryEmbedder } from './vectorIndex';
+import { IMemoryRecordSource, IVectorIndex, IVectorQueryHit, IVectorRebuildOptions, IVectorRebuildReport, MemoryEmbedder } from './vectorIndex';
 /**
  * The brute-force, in-memory cosine {@link IVectorIndex}. Stores one
  * `Float32Array` per record and answers a query by computing cosine similarity
@@ -47,17 +47,40 @@ export declare class InMemoryCosineIndex implements IVectorIndex {
     /**
      * Re-embed every record from `source` and rebuild the index from scratch.
      * Clears the current contents (and the established dimension) first, so a
-     * re-embed with a different model is supported. Returns the number of vectors
-     * indexed.
+     * re-embed with a different model is supported. Returns an
+     * {@link IVectorRebuildReport} describing what was indexed, declined and skipped.
      *
-     * On any failure (list, embed, or add) the index is rolled back to empty
-     * rather than left in a partially-rebuilt state — a caller that retries a query
-     * after a failed rebuild sees a clean empty index, never a half-populated one.
+     * @remarks
+     * **A failure to LIST is always fatal**, under either mode — and **leaves the
+     * existing index untouched**: an unreadable source says nothing about which
+     * records exist, so there is neither an honest partial to report nor any reason
+     * to discard what is already held.
+     *
+     * Per-record embed/add failures are governed by
+     * {@link IVectorRebuildOptions.onRecordError}, which defaults to `'fail'` —
+     * **the historical all-or-nothing contract, unchanged**: the index is rolled back
+     * to empty rather than left partially rebuilt, so a caller that retries a query
+     * sees a clean empty index it can reason about.
+     *
+     * `'skip'` opts into the lenient shape the store's own open already uses: the
+     * rebuild continues and every casualty is returned structurally on
+     * {@link IVectorRebuildReport.skipped}. **It reports more, it does not report
+     * less** — the point is to stop one bad record emptying an entire index, not to
+     * make failures quieter. A caller that ignores `skipped` under `'skip'` has
+     * chosen to, rather than been given no way to know.
+     *
+     * A {@link MemoryEmbedder} decline is not a failure under either mode: it is
+     * counted on {@link IVectorRebuildReport.declined} and never appears in `skipped`.
+     *
+     * Both consumer-supplied hooks are capture-wrapped, so a `source` or `embed`
+     * that throws or rejects becomes a `Failure` on the path above rather than an
+     * exception escaping mid-rebuild — which would bypass the rollback entirely.
      *
      * @param source - The scope-qualified record source to re-embed.
      * @param embed - The embedder applied to each record.
+     * @param options - Rebuild options; omit for the historical `'fail'` behavior.
      */
-    rebuild(source: IMemoryRecordSource, embed: MemoryEmbedder): Promise<Result<number>>;
+    rebuild(source: IMemoryRecordSource, embed: MemoryEmbedder, options?: IVectorRebuildOptions): Promise<Result<IVectorRebuildReport>>;
     /** Empty the index and forget the established dimension. */
     private _reset;
     /** The Euclidean magnitude (L2 norm) of a vector. */

package/lib/packlets/vector/inMemoryCosineIndex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inMemoryCosineIndex.d.ts","sourceRoot":"","sources":["../../../src/packlets/vector/inMemoryCosineIndex.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,WAAW,EAAiB,MAAM,UAAU,CAAC;AACtD,OAAO,EACL,mBAAmB,EAEnB,YAAY,EACZ,eAAe,EACf,cAAc,EACf,MAAM,eAAe,CAAC;AAQvB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IACtD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,+EAA+E;IAC/E,OAAO,CAAC,UAAU,CAAqB;IAEvC,OAAO;IAKP,4CAA4C;IAC5C,IAAW,IAAI,IAAI,MAAM,CAExB;IAED,iCAAiC;WACnB,MAAM,IAAI,MAAM,CAAC,mBAAmB,CAAC;IAInD,qCAAqC;IAC9B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAsB9E,wCAAwC;IACjC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAKhE,uCAAuC;IAChC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IAyBjG;;;;;;;;;;;;OAYG;IACU,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IA0BjG,4DAA4D;IAC5D,OAAO,CAAC,MAAM;IAKd,qDAAqD;IACrD,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,OAAO;CAWvB"}
+{"version":3,"file":"inMemoryCosineIndex.d.ts","sourceRoot":"","sources":["../../../src/packlets/vector/inMemoryCosineIndex.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAqC,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAiB,MAAM,UAAU,CAAC;AACtD,OAAO,EACL,mBAAmB,EAGnB,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACf,MAAM,eAAe,CAAC;AAkBvB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IACtD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,+EAA+E;IAC/E,OAAO,CAAC,UAAU,CAAqB;IAEvC,OAAO;IAKP,4CAA4C;IAC5C,IAAW,IAAI,IAAI,MAAM,CAExB;IAED,iCAAiC;WACnB,MAAM,IAAI,MAAM,CAAC,mBAAmB,CAAC;IAInD,qCAAqC;IAC9B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAsB9E,wCAAwC;IACjC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAKhE,uCAAuC;IAChC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IAyBjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACU,OAAO,CAClB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAwDxC,4DAA4D;IAC5D,OAAO,CAAC,MAAM;IAKd,qDAAqD;IACrD,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,OAAO;CAWvB"}