@gamaze/hicortex 0.22.3 → 0.23.0

package/dist/consolidate.js

@@ -38,7 +38,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_MEMORY_SOFT_CAP = exports.DEFAULT_SUPERSESSION_MIN_SIMILARITY = exports.BudgetTracker = exports.REFLECTION_CONTRADICTION_MIN_COSINE = exports.l2ToCosine = exports.CROSS_PROJECT_LINK_THRESHOLD = exports.CONSOLIDATE_LINK_TOP_K = exports.CONSOLIDATE_LINK_THRESHOLD = exports.DEFAULT_NIGHTLY_LLM_CALL_BUDGET = void 0;
+exports.DEFAULT_MEMORY_SOFT_CAP = exports.BudgetTracker = exports.REFLECTION_CONTRADICTION_MIN_COSINE = exports.l2ToCosine = exports.CROSS_PROJECT_LINK_THRESHOLD = exports.CONSOLIDATE_LINK_TOP_K = exports.CONSOLIDATE_LINK_THRESHOLD = exports.DEFAULT_NIGHTLY_LLM_CALL_BUDGET = void 0;
 exports.resolveNightlyLlmCallBudget = resolveNightlyLlmCallBudget;
 exports.isContradictionCandidate = isContradictionCandidate;
 exports.warnUnmeteredTokensRun = warnUnmeteredTokensRun;
@@ -50,9 +50,6 @@ exports.rebuildContentModuleIndex = rebuildContentModuleIndex;
 exports.discoverLinkCandidates = discoverLinkCandidates;
 exports.classifyLinkCandidates = classifyLinkCandidates;
 exports.classifyRelationship = classifyRelationship;
-exports.buildSupersessionPrompt = buildSupersessionPrompt;
-exports.parseSupersessionReply = parseSupersessionReply;
-exports.stageSupersession = stageSupersession;
 exports.stageDecayPrune = stageDecayPrune;
 exports.applyStrengthPromotion = applyStrengthPromotion;
 exports.stagePromotion = stagePromotion;
@@ -1031,271 +1028,6 @@ function classifyRelationship(source, target, similarity) {
     return "relates_to";
 }
 // ---------------------------------------------------------------------------
-// Stage 3.7: Supersession Detection (#191 Phase B)
-// ---------------------------------------------------------------------------
-//
-// A later decision/correction can reverse, replace, or invalidate an earlier
-// one — e.g. "chose Ollama for distillation" superseded a month later by
-// "switched distillation to a local 35B model over a mesh VPN". Left
-// unlinked, retrieval and lesson selection can surface the stale one. This
-// stage links OLD → NEW with relationship `superseded_by` and accelerates the
-// old memory's decay, WITHOUT deleting it (unlike `hicortex dedup`'s merge —
-// this is a judgment call about content, not a duplicate).
-//
-// Scope: memories with `rowid > supersessionCursor` (state.json; starts 0 —
-// the corpus is back-processed gradually) whose shape suggests a
-// decision/correction. For each, KNN top-5 OLDER same-shape neighbors
-// at/above the release-managed similarity floor (calibration.ts); one constrained classify-tier LLM
-// call per pair decides `superseded: true| false`. A parse/infra error skips
-// just that PAIR (retried naturally next night since the cursor still
-// advances past the memory — see the cursor note below); it never mis-links.
-// #405: no per-stage call cap — the ONE run budget (nightlyLlmCallBudget)
-// and the run deadline are the only bounds, like every other stage.
-/** Default minimum COSINE similarity for a supersession candidate pair —
- *  RELEASE-MANAGED since #408 (calibration.ts SUPERSESSION_MIN_SIMILARITY). */
-exports.DEFAULT_SUPERSESSION_MIN_SIMILARITY = CALIBRATION.SUPERSESSION_MIN_SIMILARITY;
-/** Default multiplier applied to a superseded memory's base_strength. */
-/** Floor under which a superseded memory's base_strength never drops. */
-/** Neighbor pool size before shape/older/similarity filtering narrows to top 5. */
-const SUPERSESSION_NEIGHBOR_POOL = 15;
-/** Older-neighbor pairs kept per candidate after filtering. */
-const SUPERSESSION_NEIGHBOR_TOP_K = 5;
-/**
- * A memory whose content/type marks it as a SUPERSEDABLE claim — one a newer
- * memory about the same subject can replace. Decisions and corrections were the
- * original scope; plain facts and project-state updates were added because an
- * updated fact ("scoring model is X" → later "is Y") otherwise never gets a
- * superseded_by link and both versions compete in recall forever. Ordinary
- * episodic chatter and problem/solution history stay excluded: they record
- * events, not mutable state, so there is nothing to supersede.
- */
-function isSupersedableShape(mem) {
-    return (mem.memory_type === "decisions" ||
-        mem.content.includes("[Decisions Made]") ||
-        mem.content.includes("[Corrections & Rejections]") ||
-        mem.content.includes("[Facts Learned]") ||
-        mem.content.includes("[Project State Changes]"));
-}
-/** True when a `superseded_by` link already exists between the pair, either direction. */
-function alreadySupersedeLinked(db, oldId, newId) {
-    const row = db
-        .prepare(`SELECT 1 FROM memory_links WHERE relationship = 'superseded_by'
-       AND ((source_id = ? AND target_id = ?) OR (source_id = ? AND target_id = ?))`)
-        .get(oldId, newId, newId, oldId);
-    return !!row;
-}
-/**
- * Build the constrained supersession-check prompt. Content is truncated the
- * same width as domain-classify.ts's classifier (1500 chars) — this is a
- * classify-tier call with the same cost profile.
- */
-function buildSupersessionPrompt(oldContent, newContent) {
-    const trunc = (s) => (s.length > 1500 ? `${s.slice(0, 1500)}…` : s);
-    return (`You are checking whether a NEWER memory supersedes an OLDER one in an AI agent's long-term memory.\n\n` +
-        `OLDER MEMORY:\n${trunc(oldContent)}\n\n` +
-        `NEWER MEMORY:\n${trunc(newContent)}\n\n` +
-        `Does the NEWER memory reverse, replace, update, or invalidate the OLDER one — e.g. a later decision ` +
-        `overturns an earlier one, a correction retracts a prior claim, or a later fact updates the SAME subject's ` +
-        `value/status that has since changed (e.g. "model is X" → "model is Y")? Reply true ONLY for a genuine ` +
-        `replacement of the same fact/decision. Two memories that are merely related, or that can both still be ` +
-        `true — even about the same project or entity (different facts, an addition, an elaboration) — are NOT a ` +
-        `supersession.\n` +
-        `Reply with ONLY a JSON object, no prose: {"superseded": true} or {"superseded": false}.`);
-}
-/**
- * Parse the model's supersession verdict. Returns the boolean on a valid
- * reply, or null on anything unparseable (caller skips the pair — no retry,
- * unlike domain-classify's tag classifier; a missed pair is retried naturally
- * when this stage revisits the corpus).
- */
-function parseSupersessionReply(reply) {
-    if (!reply)
-        return null;
-    const start = reply.indexOf("{");
-    const end = reply.lastIndexOf("}");
-    if (start === -1 || end === -1 || end <= start)
-        return null;
-    try {
-        const obj = JSON.parse(reply.slice(start, end + 1));
-        return typeof obj.superseded === "boolean" ? obj.superseded : null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * ONE classify-tier LLM call judging whether `newContent` supersedes
- * `oldContent`. Returns `{verdict, usage}` — verdict is null on any infra error
- * or unparseable reply (the caller treats null as "skip this pair", never
- * mis-links on ambiguity). `usage` is the call's token accounting (#246),
- * surfaced even on a null verdict so the BudgetTracker still meters a
- * network-round-tripped attempt (the cost is real even if the parse failed).
- */
-async function classifySupersession(llm, oldContent, newContent) {
-    try {
-        const r = await llm.complete(buildSupersessionPrompt(oldContent, newContent));
-        return { verdict: parseSupersessionReply(r.text), usage: r.usage };
-    }
-    catch {
-        return { verdict: null, usage: undefined };
-    }
-}
-/**
- * Find up to SUPERSESSION_NEIGHBOR_TOP_K OLDER, same-shape neighbors for a
- * candidate, at/above minSimilarity, highest cosine first. Reuses the
- * candidate's stored embedding when available (relink-style fallback to
- * embedFn otherwise).
- */
-async function findOlderNeighbors(db, candidate, embedFn, minSimilarity) {
-    const embedding = storage.getStoredEmbedding(db, candidate.id) ?? (await embedFn(candidate.content));
-    return storage
-        .vectorSearch(db, embedding, SUPERSESSION_NEIGHBOR_POOL, [candidate.id])
-        .filter((n) => n.created_at < candidate.created_at &&
-        isSupersedableShape(n) &&
-        (0, retrieval_js_1.l2ToCosine)(n.distance) >= minSimilarity)
-        .sort((a, b) => (0, retrieval_js_1.l2ToCosine)(b.distance) - (0, retrieval_js_1.l2ToCosine)(a.distance))
-        .slice(0, SUPERSESSION_NEIGHBOR_TOP_K);
-}
-/**
- * Nightly supersession-detection stage. Scans memories/rowid > cursor whose
- * shape is supersedable (decision/correction/fact/state — isSupersedableShape),
- * checks each against its older same-shape neighbors, and links confirmed
- * supersessions. Dry-run performs discovery + the free idempotency check only —
- * no LLM calls, no writes, no
- * cursor persistence (mirrors stageImportance/stageContentDomains's dry-run
- * convention of never spending budget on a preview).
- *
- * Cursor discipline is DELIBERATELY simple (owner amendment): the cursor
- * advances past a candidate once its neighbor set has been considered,
- * REGARDLESS of whether every pair got an LLM call (call budget) or a clean
- * verdict (infra skip) — missing one pair is acceptable and self-heals next
- * time this memory's neighborhood is re-examined via a NEWER memory's own
- * candidacy. It only stops SHORT of a candidate when the budget is already
- * exhausted before that candidate starts, so the cursor never skips a
- * candidate that was never looked at.
- *
- * #405: the cursor persists after EVERY fully-considered candidate (the
- * post-#404 reconsolidation pattern), not at stage end — a run killed or
- * deadline-deferred mid-stage loses at most the candidate in flight. No
- * orphan clamp is needed (unlike reconsolidation): supersession applies each
- * verdict's link immediately, so `cursor = candidate.__rowid` always sits
- * after all of that candidate's writes.
- */
-async function stageSupersession(db, llm, budget, embedFn, dryRun, stateDir, options = {}) {
-    // Config values pass through `unknown`-typed JSON — validate rather than
-    // trust (same discipline as retrieval.ts's configureRecall).
-    const validNumber = (v, fallback, ok) => {
-        const n = Number(v);
-        return Number.isFinite(n) && ok(n) ? n : fallback;
-    };
-    const minSimilarity = validNumber(options.minSimilarity, exports.DEFAULT_SUPERSESSION_MIN_SIMILARITY, (n) => n > 0 && n <= 1);
-    const startCursor = (0, state_js_1.loadState)(stateDir).supersessionCursor ?? 0;
-    const rows = db
-        .prepare(
-    // Candidate shape must mirror isSupersedableShape() exactly — keep the two
-    // in lockstep (an inline SQL copy, so drift here silently narrows scope).
-    `SELECT rowid AS __rowid, * FROM memories
-       WHERE rowid > ?
-         AND (memory_type = 'decisions'
-              OR content LIKE '%[Decisions Made]%'
-              OR content LIKE '%[Corrections & Rejections]%'
-              OR content LIKE '%[Facts Learned]%'
-              OR content LIKE '%[Project State Changes]%')
-       ORDER BY rowid ASC`)
-        .all(startCursor);
-    let scanned = 0;
-    let evaluated = 0;
-    let superseded = 0;
-    let skippedInfra = 0;
-    let skippedIdempotent = 0;
-    let cursor = startCursor;
-    // #405: per-candidate checkpoint — persists the cursor after every fully
-    // considered candidate (updateState is an atomic temp-rename of a small
-    // file; the loop cadence is seconds per candidate, so the cost is
-    // negligible). The end-of-stage write below stays the authoritative final
-    // write.
-    const persistCursor = () => {
-        if (dryRun)
-            return;
-        (0, state_js_1.updateState)((s) => {
-            s.supersessionCursor = cursor;
-        }, stateDir);
-    };
-    for (const candidate of rows) {
-        // #405: the ONE run budget is the only call cap; the deadline stops the
-        // scan at the candidate boundary — the cursor holds at the last
-        // fully-considered candidate (persisted below).
-        if (!dryRun && budget.exhausted)
-            break;
-        if (!dryRun && options.deadline?.hit("supersession"))
-            break;
-        scanned++;
-        let neighbors;
-        try {
-            neighbors = await findOlderNeighbors(db, candidate, embedFn, minSimilarity);
-        }
-        catch (err) {
-            console.warn(`[hicortex] supersession: discovery failed for ${candidate.id.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
-            cursor = candidate.__rowid;
-            persistCursor(); // #405: every exit path persists
-            continue;
-        }
-        for (const neighbor of neighbors) {
-            if (alreadySupersedeLinked(db, neighbor.id, candidate.id)) {
-                skippedIdempotent++;
-                continue;
-            }
-            if (dryRun)
-                continue; // preview only — no LLM call, no write
-            if (!budget.use("supersession"))
-                break; // #405: the ONE run budget
-            const { verdict, usage } = await classifySupersession(llm, neighbor.content, candidate.content);
-            // Meter every round-tripped attempt (#246) — even a null verdict spent
-            // real tokens. The stage label matches the budget.use() above.
-            budget.recordUsage("supersession", usage);
-            evaluated++;
-            if (verdict === null) {
-                skippedInfra++;
-                continue;
-            }
-            if (verdict) {
-                const cosine = (0, retrieval_js_1.l2ToCosine)(neighbor.distance);
-                // The link IS the signal (0.15.2): retrieval demotes superseded
-                // memories via an explicit scoring multiplier (supersededDemotion,
-                // retrieval.ts). The old base_strength penalty was retired because it
-                // (a) fought the config-tunable strength weight and (b) leaked into
-                // prune eligibility — a reversed decision must rank lower, not edge
-                // toward deletion.
-                storage.addLink(db, neighbor.id, candidate.id, "superseded_by", cosine);
-                superseded++;
-                console.log(`[hicortex] Supersession: ${neighbor.id.slice(0, 8)} superseded_by ${candidate.id.slice(0, 8)} (cosine ${cosine.toFixed(3)})`);
-            }
-        }
-        cursor = candidate.__rowid;
-        // #405: checkpoint after every fully-considered candidate (post-#404
-        // reconsolidation pattern) — a killed or deadline-deferred run loses at
-        // most the candidate in flight.
-        persistCursor();
-    }
-    if (!dryRun) {
-        (0, state_js_1.updateState)((s) => {
-            s.supersessionCursor = cursor;
-        }, stateDir);
-    }
-    if (rows.length > 0) {
-        console.log(`[hicortex] Supersession detection: ${scanned} scanned, ${evaluated} evaluated, ${superseded} superseded, ` +
-            `${skippedIdempotent} already-linked, ${skippedInfra} infra-skipped (cursor ${cursor})`);
-    }
-    return {
-        scanned,
-        evaluated,
-        superseded,
-        skipped_infra: skippedInfra,
-        skipped_idempotent: skippedIdempotent,
-        cursor,
-    };
-}
-// ---------------------------------------------------------------------------
 // Stage 4: Decay & Prune
 // ---------------------------------------------------------------------------
 /**
@@ -1413,9 +1145,9 @@ function stagePromotion(db, dryRun) {
         });
     }
     // #459: the stage's one-line summary in the shared stage idiom (rows
-    // examined / promoted / total gain, like the supersession summary) — the
+    // examined / promoted / total gain, like the resolution-stage summary) — the
     // stage writes its report in-memory only, so the log line is the soak-time
-    // health signal. Zero examined rows stay silent (the supersession gate).
+    // health signal. Zero examined rows stay silent (the quiet-stage gate).
     if (dryRun) {
         console.log(`[hicortex] Strength promotion (dry-run): ${rows.length} examined, would promote ` +
             `${promoted} (+${totalGain.toFixed(3)} total strength, ` +
@@ -1598,8 +1330,8 @@ async function skippedRunResolutionReport(db, dryRun, stateDir, options = {}) {
             none: 0,
             merge_below_gate: 0,
             conf_sum: merges.losers_merged,
-            ...(merges.skipped_metadata_mismatch > 0
-                ? { metadata_skipped: merges.skipped_metadata_mismatch }
+            ...(merges.skipped_project_mismatch > 0
+                ? { project_skipped: merges.skipped_project_mismatch }
                 : {}),
         };
     }
@@ -1631,7 +1363,7 @@ async function skippedRunResolutionReport(db, dryRun, stateDir, options = {}) {
         merge_pairs_applied: 0,
         merge_below_gate: 0,
         skipped_above_ceiling: 0,
-        skipped_metadata_mismatch: 0,
+        skipped_project_mismatch: 0,
         conflict_flagged: 0, // guard-C: no scan on a quiet night — nothing flagged
         conflict_skipped: merges.skipped_conflict, // guard-C: the zone's guard still counts
         scout_scanned: 0, // #393 B: the scan (and its shape calls) doesn't run on a quiet night
@@ -1640,7 +1372,7 @@ async function skippedRunResolutionReport(db, dryRun, stateDir, options = {}) {
         band_stats: bandStats,
     };
 }
-async function runConsolidation(db, llm, embedFn, dryRun = false, skipReflection = false, stateDir, domainOptions, supersessionOptions, 
+async function runConsolidation(db, llm, embedFn, dryRun = false, skipReflection = false, stateDir, domainOptions, 
 /** The ONE per-run LLM-call ceiling (#405/#241). The caller resolves
  *  `nightlyLlmCallBudget` from config (consolidateMaxLlmCalls is a
  *  deprecated alias — resolveNightlyLlmCallBudget) and passes it; unset →
@@ -1652,10 +1384,9 @@ budgetMaxCalls,
 memorySoftCap, 
 /** Reconsolidation-stage knobs (#384) — eval/test seams since #408 (the
  *  values are release-managed calibration constants; nightly.ts threads
- *  NOTHING), exactly like supersessionOptions above; unset fields → the
- *  stage's calibration defaults. Appended AFTER the pre-#384 params so
- *  every existing positional caller (tests, hosted nightly) keeps its
- *  argument meaning. */
+ *  NOTHING); unset fields → the stage's calibration defaults. The
+ *  pre-#206-B supersessionOptions param that sat here is retired with its
+ *  stage — callers updated in the same change. */
 reconsolidationOptions, 
 /**
  * The run-wide pipeline deadline (#405), created at nightly start and
@@ -1826,14 +1557,13 @@ deadline) {
         if (!deadline?.hit("links")) {
             report.stages.links = await stageLinks(db, precheck.newMemories, embedFn, dryRun, llm, budget);
         }
-        // Stage 3.7: Supersession Detection (#191 Phase B)
-        if (!deadline?.hit("supersession")) {
-            report.stages.supersession = await stageSupersession(db, llm, budget, embedFn, dryRun, stateDir, { ...supersessionOptions, deadline });
-        }
         // Stage 3.8: Reconsolidation (#384) — resolve corrections: rewrite
         // fact-shaped targets in place (absorbing transition-only triggers),
-        // mark everything else. Rides the same shared budget under its own stage
-        // label + cursor (supersession-stage pattern).
+        // mark everything else. THE unified resolution stage since #392, and
+        // since #206-B (owner decision 6) also the ONLY true-update detector:
+        // the standalone supersession stage (3.7) is retired into its
+        // `supersedes` verdict action. Rides the same shared budget under its
+        // own stage label + cursor.
         if (!deadline?.hit("reconsolidation")) {
             report.stages.reconsolidation = await (0, reconsolidation_js_1.stageReconsolidation)(db, llm, budget, embedFn, dryRun, stateDir, { ...reconsolidationOptions, deadline });
         }

package/dist/db.js

@@ -742,6 +742,27 @@ const MIGRATIONS = [
             db.exec("CREATE INDEX IF NOT EXISTS idx_recall_events_memory_kind ON recall_events(memory_id, kind)");
         },
     },
+    {
+        version: 23,
+        name: "volatile_sweep_log",
+        up: (db) => {
+            // #489 — `hicortex sweep-volatile` audit trail (owner decision 3:
+            // one-shot store sweep, mark-not-delete). Every swept memory gets a row
+            // here as it is absorbed: the sweep is inspectable forever, never
+            // silent. The dedup_log precedent (a sidecar audit table, no memories
+            // FK), but with no runtime consumer — the CAPTURE-side volatility gate
+            // is the re-ingest safety net, so nothing consults this table; it is
+            // purely the durable record of what --apply retired and when.
+            // Idempotent: IF NOT EXISTS.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS volatile_sweep_log (
+          memory_id TEXT PRIMARY KEY,
+          swept_at TEXT NOT NULL,
+          preview TEXT
+        )
+      `);
+        },
+    },
 ];
 /**
  * Run all pending migrations against the database.

package/dist/dedup.d.ts

@@ -20,8 +20,9 @@
  *    consolidate.ts) so one stage report covers all resolution work.
  *
  * Per cluster (shared `planDedup`/`mergeCluster` core — no forks):
- *   - Canonical = highest access_count (tie: oldest created_at, then
- *     lexicographically smallest id — fully deterministic for audit).
+ *   - Canonical = highest access_count (tie: NEWEST created_at — newest-wins,
+ *     #206 decision 3 — then lexicographically smallest id, fully
+ *     deterministic for audit).
  *   - Losers' links are re-pointed onto the canonical (a link that would
  *     become a self-link, or one whose (canonical, target) ordered pair
  *     ALREADY holds an edge, is skipped rather than overwritten — see
@@ -44,8 +45,11 @@
  *     dedup_log (loser_id → canonical_id) + the retained loser row is the
  *     record.
  *
- * A cluster whose members disagree on project or source_agent is SKIPPED
- * entirely and listed for manual review — no --force in this release.
+ * A cluster whose members disagree on project is SKIPPED entirely and listed
+ * for manual review (reason `project_mismatch`) — no --force in this release.
+ * The source_agent rail was REMOVED (#206 decision 2, 2026-09-21): cross-agent
+ * clusters merge — attribution is preserved on the retained evidence row and
+ * no recall path filters by agent.
  *
  * Safety rails when applying (CLI and zone alike):
  *   - A full DB backup (SQLite backup API) is taken FIRST, to
@@ -219,16 +223,17 @@ export type MergeMemoryIdsResult = {
     linksRepointed: number;
 } | {
     ok: false;
-    reason: "metadata_mismatch" | "conflict_linked" | "no_members";
+    reason: "project_mismatch" | "conflict_linked" | "no_members";
 };
 /**
  * Merge an explicit set of memories (the judged-pair phase of #392: the
  * reconsolidation stage queues verdict-confirmed pairs and applies them
  * through THIS function so the merge math stays single-definition). Loads the
  * LIVE rows at apply time — members that vanished or were absorbed between
- * verdict and apply are dropped defensively; a metadata disagreement refuses
- * the merge (both memories stay live); a conflicts-linked pair refuses it
- * exactly the same way (#393 guard-C). One transaction for the whole set.
+ * verdict and apply are dropped defensively; a project disagreement refuses
+ * the merge (both memories stay live — the only metadata rail left, #206
+ * decision 2); a conflicts-linked pair refuses it exactly the same way
+ * (#393 guard-C). One transaction for the whole set.
  */
 export declare function mergeMemoryIds(db: Database.Database, ids: string[]): MergeMemoryIdsResult;
 /**
@@ -267,7 +272,7 @@ export interface DeterministicMergeZoneOptions {
  *
  * Also persists the deterministic band's cumulative statistics to state.json
  * `resolutionBandStats` (label `>=threshold`; losers count as merge verdicts
- * at confidence 1.0, mismatch clusters as metadata_skipped) — skipped
+ * at confidence 1.0, mismatch clusters as project_skipped) — skipped
  * entirely on dry-run. Called from the reconsolidation stage (main path) and
  * from runConsolidation's quiet-night skip path — exactly one of the two per
  * run.

package/dist/dedup.js

@@ -21,8 +21,9 @@
  *    consolidate.ts) so one stage report covers all resolution work.
  *
  * Per cluster (shared `planDedup`/`mergeCluster` core — no forks):
- *   - Canonical = highest access_count (tie: oldest created_at, then
- *     lexicographically smallest id — fully deterministic for audit).
+ *   - Canonical = highest access_count (tie: NEWEST created_at — newest-wins,
+ *     #206 decision 3 — then lexicographically smallest id, fully
+ *     deterministic for audit).
  *   - Losers' links are re-pointed onto the canonical (a link that would
  *     become a self-link, or one whose (canonical, target) ordered pair
  *     ALREADY holds an edge, is skipped rather than overwritten — see
@@ -45,8 +46,11 @@
  *     dedup_log (loser_id → canonical_id) + the retained loser row is the
  *     record.
  *
- * A cluster whose members disagree on project or source_agent is SKIPPED
- * entirely and listed for manual review — no --force in this release.
+ * A cluster whose members disagree on project is SKIPPED entirely and listed
+ * for manual review (reason `project_mismatch`) — no --force in this release.
+ * The source_agent rail was REMOVED (#206 decision 2, 2026-09-21): cross-agent
+ * clusters merge — attribution is preserved on the retained evidence row and
+ * no recall path filters by agent.
  *
  * Safety rails when applying (CLI and zone alike):
  *   - A full DB backup (SQLite backup API) is taken FIRST, to
@@ -160,13 +164,15 @@ function loadMembers(db, ids) {
        FROM memories WHERE id IN (${placeholders})`)
         .all(...ids);
 }
-/** Canonical = highest access_count; ties broken by oldest created_at, then lexicographically smallest id. */
+/** Canonical = highest access_count; ties broken by NEWEST created_at (newest-wins,
+ *  #206 decision 3 — most-used still wins first, newest is the tie-break), then
+ *  lexicographically smallest id. */
 function pickCanonical(members) {
     const sorted = [...members].sort((a, b) => {
         if (b.access_count !== a.access_count)
             return b.access_count - a.access_count;
         if (a.created_at !== b.created_at)
-            return a.created_at.localeCompare(b.created_at);
+            return b.created_at.localeCompare(a.created_at);
         return a.id.localeCompare(b.id);
     });
     const [canonical, ...losers] = sorted;
@@ -281,7 +287,9 @@ function planDedup(db, threshold) {
             continue;
         }
         const mismatch = (0, cluster_js_1.clusterMetadataMismatch)(members);
-        if (mismatch.projectMismatch || mismatch.sourceAgentMismatch) {
+        // #206 decision 2: project is the ONLY rail — the source_agent rail was
+        // removed (cross-agent clusters merge; the skip reason is project_mismatch).
+        if (mismatch.projectMismatch) {
             mismatchSkipped.push({ size: members.length, memberIds: members.map((m) => m.id), mismatch });
             continue;
         }
@@ -383,9 +391,10 @@ function mergeCluster(db, canonical, losers, injectFailure) {
  * reconsolidation stage queues verdict-confirmed pairs and applies them
  * through THIS function so the merge math stays single-definition). Loads the
  * LIVE rows at apply time — members that vanished or were absorbed between
- * verdict and apply are dropped defensively; a metadata disagreement refuses
- * the merge (both memories stay live); a conflicts-linked pair refuses it
- * exactly the same way (#393 guard-C). One transaction for the whole set.
+ * verdict and apply are dropped defensively; a project disagreement refuses
+ * the merge (both memories stay live — the only metadata rail left, #206
+ * decision 2); a conflicts-linked pair refuses it exactly the same way
+ * (#393 guard-C). One transaction for the whole set.
  */
 function mergeMemoryIds(db, ids) {
     const unique = [...new Set(ids)];
@@ -393,14 +402,14 @@ function mergeMemoryIds(db, ids) {
     if (members.length < 2)
         return { ok: false, reason: "no_members" };
     // #393 guard-C: a conflicts-linked pair is never blended — the mirror of the
-    // metadata rails (both memories stay live; the caller's verdict was still
+    // project rail (both memories stay live; the caller's verdict was still
     // rendered, so its cursor advances).
     if (clusterHasConflictLink(db, members.map((m) => m.id))) {
         return { ok: false, reason: "conflict_linked" };
     }
     const mismatch = (0, cluster_js_1.clusterMetadataMismatch)(members);
-    if (mismatch.projectMismatch || mismatch.sourceAgentMismatch) {
-        return { ok: false, reason: "metadata_mismatch" };
+    if (mismatch.projectMismatch) {
+        return { ok: false, reason: "project_mismatch" };
     }
     const { canonical, losers } = pickCanonical(members);
     const tx = db.transaction(() => mergeCluster(db, canonical, losers));
@@ -440,7 +449,7 @@ async function takePreDedupBackup(db, stateDir, config) {
  *
  * Also persists the deterministic band's cumulative statistics to state.json
  * `resolutionBandStats` (label `>=threshold`; losers count as merge verdicts
- * at confidence 1.0, mismatch clusters as metadata_skipped) — skipped
+ * at confidence 1.0, mismatch clusters as project_skipped) — skipped
  * entirely on dry-run. Called from the reconsolidation stage (main path) and
  * from runConsolidation's quiet-night skip path — exactly one of the two per
  * run.
@@ -462,7 +471,7 @@ async function runDeterministicMergeZone(db, opts = {}) {
             merged_clusters: 0,
             losers_merged: 0,
             links_repointed: 0,
-            skipped_metadata_mismatch: plan.mismatchSkipped.length,
+            skipped_project_mismatch: plan.mismatchSkipped.length,
             skipped_conflict: plan.conflictSkipped.length,
             capped: 0,
             failed: 0,
@@ -480,7 +489,7 @@ async function runDeterministicMergeZone(db, opts = {}) {
         // Cumulative deterministic-band stats (state.json) — one write at zone
         // end, on every apply-path exit, never when there is nothing to record.
         const persistBand = () => {
-            if (report.losers_merged === 0 && report.skipped_metadata_mismatch === 0)
+            if (report.losers_merged === 0 && report.skipped_project_mismatch === 0)
                 return;
             (0, state_js_1.updateState)((s) => {
                 const label = `>=${threshold}`;
@@ -496,7 +505,7 @@ async function runDeterministicMergeZone(db, opts = {}) {
                     // Deterministic merges carry no verdict — model confidence 1.0 each
                     // (the calibration line: measured ~100% same-memory at the ceiling).
                     conf_sum: b.conf_sum + report.losers_merged,
-                    metadata_skipped: (b.metadata_skipped ?? 0) + report.skipped_metadata_mismatch,
+                    project_skipped: (b.project_skipped ?? 0) + report.skipped_project_mismatch,
                 };
                 s.resolutionBandStats = bands;
             }, stateDir);
@@ -566,7 +575,7 @@ async function runDeterministicMergeZone(db, opts = {}) {
             }
             console.log(`[hicortex] deterministic-merge zone (>= ${threshold}): ${report.merged_clusters}/${plan.mergePlans.length} ` +
                 `cluster(s) merged, ${report.losers_merged} loser(s) absorbed, ` +
-                `${report.skipped_metadata_mismatch} skipped (metadata mismatch), ` +
+                `${report.skipped_project_mismatch} skipped (project mismatch), ` +
                 `${report.skipped_conflict} skipped (conflict-flagged)` +
                 (report.capped > 0 ? `, ${report.capped} deferred (run deadline)` : "") +
                 (report.failed > 0 ? `, ${report.failed} FAILED` : ""));
@@ -585,7 +594,7 @@ async function runDeterministicMergeZone(db, opts = {}) {
         return {
             threshold, clusters_found: 0, mergeable_clusters: 0,
             merged_clusters: 0, losers_merged: 0, links_repointed: 0,
-            skipped_metadata_mismatch: 0, skipped_conflict: 0, capped: 0, failed: 0,
+            skipped_project_mismatch: 0, skipped_conflict: 0, capped: 0, failed: 0,
         };
     }
 }
@@ -649,7 +658,7 @@ async function runDedup(options = {}) {
             linksSkippedExisting: linksSkippedExistingPreview,
         };
         console.log(`[hicortex] dedup: ${plan.clusterCount} cluster(s) found, ${mergeable.length} mergeable ` +
-            `(${plannedMerges} row(s) would be absorbed), ${plan.mismatchSkipped.length} skipped (metadata mismatch), ` +
+            `(${plannedMerges} row(s) would be absorbed), ${plan.mismatchSkipped.length} skipped (project mismatch), ` +
             `${plan.conflictSkipped.length} skipped (conflict-flagged), ` +
             `${linksSkippedExistingPreview} link(s) would be skipped (existing edge on the canonical)`);
         if (!apply) {
@@ -660,11 +669,10 @@ async function runDedup(options = {}) {
                     `${c.linksSkippedSelfLink} skipped (self-link)`);
             }
             for (const c of plan.mismatchSkipped) {
-                const reasons = Object.entries(c.mismatch)
-                    .filter(([, v]) => v)
-                    .map(([k]) => k)
-                    .join(", ");
-                console.log(`[hicortex]   SKIPPED (${reasons}): ${c.memberIds.map((id) => id.slice(0, 8)).join(", ")}`);
+                // #206 decision 2: project_mismatch is the only skip reason left on
+                // this rail (the source_agent rail was removed) — the bedrock dry run
+                // sizes the project rail alone off this line.
+                console.log(`[hicortex]   SKIPPED (project_mismatch): ${c.memberIds.map((id) => id.slice(0, 8)).join(", ")}`);
             }
             // #393 guard-C: listed for review like the mismatch clusters — a
             // conflicts-linked near-duplicate pair is deliberate, not an error.

package/dist/distiller.d.ts

@@ -78,6 +78,24 @@ export declare function isNoExtractResponse(result: string): boolean;
  * survive. Stripping affects only this gate's decision, never stored text.
  */
 export declare function hasMinimalSubstance(entry: string): boolean;
+/**
+ * True when the entry is a VOLATILE STATUS SHAPE — GH-ticket/workflow status,
+ * version-bump status, or branch/commit state — and carries no durability
+ * escape (#489, owner decisions 1+2). Runs in distillChunk's gate zone beside
+ * hasMinimalSubstance; drops ride the SAME #156 dropped[] trail. Also reused
+ * verbatim by `hicortex sweep-volatile` over the stored corpus — ONE gate,
+ * one meaning.
+ *
+ * PRECISION OVER RECALL (the substance gate's law, inherited): escapes are
+ * checked FIRST and override every trigger; entries longer than
+ * VOLATILE_GATE_MAX_CHARS are treated as mixed prose whose status clause is
+ * not the DOMINANT content (kept). Accepted false-positive mode, stated
+ * plainly: an entry pairing a status clause with a distinct durable clause
+ * and no escape word drops, losing the durable half — unless the distiller
+ * emitted that half as its own entry, which is exactly what the ephemera
+ * prompt tells it to do. Every drop is auditable via the trail.
+ */
+export declare function isVolatileStatusEntry(entry: string): boolean;
 /**
  * A parsed distillation entry: the stored content (type tag STRIPPED) plus the
  * classified memory_type. `memoryType` is one of "experience" | "knowledge" |