@jossuealcala/madre 0.3.3 → 0.4.1

package/src/cold.mjs

@@ -0,0 +1,56 @@
+// Cold zones: the part of the archive nothing has ever reached for.
+//
+// A memory is cold when three things are true at once, and the three together are what make the
+// claim strong enough to act on:
+//
+//   · no turn has ever carried it
+//   · it shares a subject with no other memory, so nothing can reach it sideways either
+//   · the room has reached into the archive often enough since it was written that it has plainly
+//     had its chances
+//
+// That third one is the whole point. Never-recalled is not cold; never-recalled is what every
+// memory is on the day it is written. What makes a memory cold is opportunity that went by: the
+// archive was opened forty times and it was never the answer. Chances are counted in turns that
+// actually reached into the archive, because those are the only chances that existed.
+//
+// Pure functions. The room hands in what it already has.
+
+export const COLD_CHANCES = 12;   // turns that went into the archive without ever taking it
+
+// How many of `times` (ascending) are at or after `from`.
+function after(times, from) {
+  let low = 0;
+  let high = times.length;
+  while (low < high) {
+    const middle = (low + high) >> 1;
+    if (times[middle] < from) low = middle + 1; else high = middle;
+  }
+  return times.length - low;
+}
+
+// Which memories are adrift, and how many chances each one has had. `since` is the day this room
+// started keeping the trail: a memory older than that is only counted from there, because what
+// happened before it was never written down and must not be held against the note.
+export function coldNotes({ notes = [], links = [], batches = [], since = null, chances = COLD_CHANCES } = {}) {
+  const linked = new Set(links.flatMap((link) => [link.a, link.b]));
+  const times = batches.map((at) => Date.parse(at)).filter((at) => Number.isFinite(at)).sort((a, b) => a - b);
+  const floor = since ? Date.parse(since) : 0;
+  const cold = new Map();
+  for (const note of notes) {
+    if (!note || note.kind === 'aberration' || note.refutedBy) continue;   // a refutation is not a cold memory
+    if (Number(note.recalled ?? 0) > 0) continue;
+    if (linked.has(note.id)) continue;
+    const written = Date.parse(note.created);
+    const from = Math.max(Number.isFinite(written) ? written : 0, Number.isFinite(floor) ? floor : 0);
+    const had = after(times, from);
+    if (had >= chances) cold.set(note.id, { chances: had });
+  }
+  return cold;
+}
+
+// What the room should say about it. Never a number on its own: a count of cold memories means
+// nothing without what it is a count of.
+export function coldReading(cold, notes = []) {
+  const standing = notes.filter((note) => note && note.kind !== 'aberration' && !note.refutedBy).length;
+  return { count: cold.size, standing, share: standing > 0 ? Number((cold.size / standing).toFixed(3)) : 0 };
+}

package/src/commands.mjs

@@ -52,6 +52,12 @@ export const COMMANDS = [
         // The human commits what the room produced. Everything in the tree, one message, local: reversible with git.
         const message = args.slice(1).join(' ').replace(/^["'“]+|["'”]+$/g, '').trim();
         if (!message) return { ok: false, title: 'Git Pulse · commit', text: 'Give the commit a message: /git commit "what and why".' };
+        // Without an identity git refuses the commit with a wall of advice; say the one thing to do.
+        const email = await run('git', ['config', '--get', 'user.email'], projectRoot);
+        const who = await run('git', ['config', '--get', 'user.name'], projectRoot);
+        if (!email.text.trim() || !who.text.trim()) {
+          return { ok: false, title: 'Git Pulse · commit', text: 'This computer has no git identity, so the commit would have no author. Set it once in your terminal:\n\n  git config --global user.name "Your Name"\n  git config --global user.email you@example.com' };
+        }
         const staged = await run('git', ['add', '-A', '--', '.'], projectRoot);
         if (!staged.ok) return { ok: false, title: 'Git Pulse · commit', text: staged.text };
         const committed = await run('git', ['-c', 'color.ui=never', 'commit', '-m', message], projectRoot);

package/src/conversation-context.mjs

@@ -19,14 +19,44 @@ export function messageEntry(event) {
 
 // `omitSynthetic` drops MADRE's own canned replies (identity, refusals, round-table plans):
 // @madre must never read them back, or a small model starts echoing them.
-export function buildConversationContext(events, { excludeMessageId, maxChars = 16000, omitSynthetic = false } = {}) {
+// How much of the budget a window is cut back to when it finally has to let go of its oldest
+// messages. Dropping one message per turn would move the start of the transcript on every turn;
+// dropping a chunk at once and then holding still is what lets a CLI read most of it back from
+// its own cache. Lower means longer stretches of stability and a leaner average window.
+export const CONTEXT_KEEP = 0.62;
+
+export function buildConversationContext(events, { excludeMessageId, maxChars = 16000, omitSynthetic = false, anchor = null } = {}) {
   const messages = events
     .map((event) => (omitSynthetic && event?.payload?.synthetic ? null : messageEntry(event)))
     .filter((message) => message && message.messageId !== excludeMessageId);
+  const budget = Math.max(0, Number(maxChars) || 0);
+
+  // The window is anchored, not sliding. A sliding window starts one message later on every
+  // turn, so the transcript an agent reads begins with different words every time and none of
+  // it can be matched against what it read last turn. Held still, the whole of it but the tail
+  // is the same bytes as before, which is the difference between paying for it once and paying
+  // for it every turn. It only ever moves when what has been said since no longer fits.
+  const weigh = (from) => {
+    let used = 0;
+    for (let i = from; i < messages.length; i += 1) used += messages[i].sender.length + messages[i].role.length + messages[i].text.length + 4;
+    return used;
+  };
+  let start = 0;
+  if (Number.isInteger(anchor)) {
+    const held = messages.findIndex((message) => message.sequence >= anchor);
+    if (held >= 0 && weigh(held) <= budget) start = held;
+  }
+  if (!start || weigh(start) > budget) {
+    // Let go of a chunk and then hold: back off until the window sits well under its budget, so
+    // there is room for many turns of new words before it has to move again.
+    start = messages.length;
+    while (start > 0 && weigh(start - 1) <= budget * CONTEXT_KEEP) start -= 1;
+  }
+
   const selected = [];
-  let remaining = Math.max(0, Number(maxChars) || 0);
+  let remaining = budget;
 
-  for (let index = messages.length - 1; index >= 0 && remaining > 0; index -= 1) {
+  for (let index = messages.length - 1; index >= start && remaining > 0; index -= 1) {
     const message = messages[index];
     const label = `${message.sender} (${message.role})`;
     const allowance = Math.max(0, remaining - label.length - 2);
@@ -42,6 +72,8 @@ export function buildConversationContext(events, { excludeMessageId, maxChars =
 
   return {
     messages: selected,
+    // Where this window begins, for the next turn to hold on to.
+    anchor: selected[0]?.sequence ?? null,
     omittedMessages: messages.length - selected.length,
     firstSequence: selected[0]?.sequence ?? null,
     throughSequence: selected.at(-1)?.sequence ?? null,

package/src/credentials.mjs

@@ -0,0 +1,145 @@
+// Handing a provider key to a CLI that signs in from its own prompt.
+//
+// MADRE keeps its promise: it never stores a credential of its own. The key the human pastes is
+// written where that CLI looks for it, with the file locked to the owner, and MADRE keeps no
+// copy: not in ~/.pulse/config.json, not in the room's ledger, not in a log line. What the room
+// records is that a key was set, never the key.
+//
+// Every write is verified on the spot by asking the CLI (or MADRE's own probe) whether it is
+// signed in now. If it is not, the previous files are put back, so a format MADRE guessed wrong
+// leaves nothing behind.
+
+import { execFile } from 'node:child_process';
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const OWNER_ONLY = 0o600;
+
+// A key is one opaque token: no spaces, no newlines, and long enough to be one.
+export function normalizeKey(value) {
+  const key = String(value ?? '').trim();
+  if (!key) return { ok: false, error: 'Paste the key first.' };
+  if (/\s/.test(key)) return { ok: false, error: 'That does not look like a key: it has spaces or line breaks.' };
+  if (key.length < 12 || key.length > 400) return { ok: false, error: 'That does not look like a key: check you copied all of it and nothing else.' };
+  return { ok: true, key };
+}
+
+// OpenCode brings no model of its own. These are the providers MADRE can wire with a key;
+// any other still works through `opencode auth login` in a terminal.
+export const OPENCODE_PROVIDERS = [
+  { id: 'anthropic', label: 'Anthropic', keyUrl: 'https://console.anthropic.com/settings/keys' },
+  { id: 'openai', label: 'OpenAI', keyUrl: 'https://platform.openai.com/api-keys' },
+  { id: 'openrouter', label: 'OpenRouter', keyUrl: 'https://openrouter.ai/keys' },
+  { id: 'google', label: 'Google AI Studio', keyUrl: 'https://aistudio.google.com/app/apikey' },
+];
+
+// What the room offers for each agent that cannot be signed in with a click.
+export function keyPlanFor(id) {
+  if (id === 'gemini') {
+    return {
+      agent: 'gemini',
+      label: 'Gemini API key',
+      keyUrl: 'https://aistudio.google.com/app/apikey',
+      writesTo: '~/.gemini/.env',
+      note: 'The key is written where the Gemini CLI looks for it, readable only by you. MADRE keeps no copy.',
+      providers: null,
+    };
+  }
+  if (id === 'opencode') {
+    return {
+      agent: 'opencode',
+      label: 'Provider key',
+      keyUrl: null,
+      writesTo: '~/.local/share/opencode/auth.json',
+      note: 'OpenCode brings no model of its own: pick the provider whose key you are pasting. The key is written where OpenCode looks for it, readable only by you. MADRE keeps no copy.',
+      providers: OPENCODE_PROVIDERS,
+    };
+  }
+  return null;
+}
+
+async function readIfThere(path) {
+  try { return await readFile(path, 'utf8'); } catch { return null; }
+}
+async function restore(path, previous) {
+  if (previous === null) await rm(path, { force: true });
+  else await writeFile(path, previous, { mode: OWNER_ONLY });
+}
+
+// ---- Gemini: a line in ~/.gemini/.env, plus the auth type its settings must select.
+async function applyGeminiKey(key, { home, probe }) {
+  const dir = join(home, '.gemini');
+  const envFile = join(dir, '.env');
+  const settingsFile = join(dir, 'settings.json');
+  await mkdir(dir, { recursive: true });
+  const beforeEnv = await readIfThere(envFile);
+  const beforeSettings = await readIfThere(settingsFile);
+  try {
+    const kept = (beforeEnv ?? '').split('\n').filter((line) => line.trim() && !/^\s*(GEMINI_API_KEY|GOOGLE_API_KEY)\s*=/.test(line));
+    await writeFile(envFile, `${[...kept, `GEMINI_API_KEY=${key}`].join('\n')}\n`, { mode: OWNER_ONLY });
+    await chmod(envFile, OWNER_ONLY).catch(() => {});
+    let settings = {};
+    try { settings = JSON.parse(beforeSettings ?? '{}') ?? {}; } catch { settings = {}; }
+    settings.security = { ...(settings.security ?? {}), auth: { ...(settings.security?.auth ?? {}), selectedType: 'gemini-api-key' } };
+    await writeFile(settingsFile, `${JSON.stringify(settings, null, 2)}\n`, { mode: OWNER_ONLY });
+    const state = await probe();
+    if (state?.state !== 'signed-in') {
+      await restore(envFile, beforeEnv);
+      await restore(settingsFile, beforeSettings);
+      return { ok: false, error: `The key was written but Gemini still reads as ${state?.state ?? 'unknown'}${state?.detail ? ` (${state.detail})` : ''}. Nothing was changed.` };
+    }
+    return { ok: true, detail: state.detail ?? 'via API key' };
+  } catch (error) {
+    await restore(envFile, beforeEnv);
+    await restore(settingsFile, beforeSettings);
+    return { ok: false, error: `The key could not be written: ${error.message}` };
+  }
+}
+
+// ---- OpenCode: an entry in its auth.json, confirmed by asking `opencode auth list`.
+async function applyOpenCodeKey(key, { home, provider, executable, run }) {
+  const known = OPENCODE_PROVIDERS.some((item) => item.id === provider);
+  if (!known) return { ok: false, error: 'Pick the provider this key belongs to.' };
+  const file = join(home, '.local', 'share', 'opencode', 'auth.json');
+  await mkdir(join(home, '.local', 'share', 'opencode'), { recursive: true });
+  const before = await readIfThere(file);
+  try {
+    let auth = {};
+    try { auth = JSON.parse(before ?? '{}') ?? {}; } catch { auth = {}; }
+    auth[provider] = { type: 'api', key };
+    await writeFile(file, `${JSON.stringify(auth, null, 2)}\n`, { mode: OWNER_ONLY });
+    await chmod(file, OWNER_ONLY).catch(() => {});
+    // OpenCode itself is the judge: if its own listing does not show the provider, the shape
+    // MADRE wrote is not the shape it reads, and nothing should be left behind.
+    const listed = await run(executable, ['auth', 'list']);
+    if (!new RegExp(provider, 'i').test(listed)) {
+      await restore(file, before);
+      return { ok: false, error: `OpenCode does not list ${provider} after the key was written, so MADRE put the file back. Run \`opencode auth login\` in a terminal for this one.` };
+    }
+    return { ok: true, detail: `${provider} (api)` };
+  } catch (error) {
+    await restore(file, before);
+    return { ok: false, error: `The key could not be written: ${error.message}` };
+  }
+}
+
+const runOpenCode = async (executable, args) => {
+  try {
+    const { stdout, stderr } = await execFileAsync(executable, args, { timeout: 15000, env: { ...process.env, NO_COLOR: '1' } });
+    return `${stdout}\n${stderr}`;
+  } catch (error) {
+    return `${error.stdout ?? ''}\n${error.stderr ?? error.message}`;
+  }
+};
+
+// Writes the key for one agent and answers whether that agent is signed in now.
+export async function applyKey({ agent, key, provider = null, home = homedir(), probe, executable = 'opencode', run = runOpenCode }) {
+  const checked = normalizeKey(key);
+  if (!checked.ok) return checked;
+  if (agent === 'gemini') return applyGeminiKey(checked.key, { home, probe });
+  if (agent === 'opencode') return applyOpenCodeKey(checked.key, { home, provider, executable, run });
+  return { ok: false, error: `${agent} does not take a key here: it signs in with a click.` };
+}

package/src/dataset.mjs

@@ -8,6 +8,7 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { redact } from './sentinel-errors.mjs';
+import { ABERRATION } from './memory.mjs';
 
 const MIN_ANSWER_CHARS = 40;
 
@@ -82,14 +83,22 @@ export function readiness(events, notes = [], { target = DATASET_TARGET } = {})
   const turns = pairs.filter((pair) => pair.kind === 'turn').length;
   const delegated = pairs.length - turns;
   const good = pairs.filter((pair) => pair.rating === 'good').length;
-  const total = pairs.length + notes.length;
-  return { pairs: total, turns, delegated, notes: notes.length, good, bad, target, ready: total >= target };
+  // Aberrations are counted apart: they never become one of the pairs the model learns to
+  // answer with, so counting them toward readiness would say the room is further along than it is.
+  const standing = notes.filter((note) => note.kind !== ABERRATION && !note.refutedBy);
+  const aberrations = notes.filter((note) => note.kind === ABERRATION).length;
+  const total = pairs.length + standing.length;
+  return { pairs: total, turns, delegated, notes: standing.length, aberrations, good, bad, target, ready: total >= target };
 }
 
 // Distilled notes become recall pairs: "what does the room remember about …" → the note.
+// Two kinds of note never come through here. An aberration is a claim the room decided is false,
+// and teaching a model to recall it would be teaching it the hallucination. A note that has been
+// refuted is no longer what the room believes. Both are still exported, as preference pairs
+// below, where being wrong is the point.
 export function pairsFromNotes(notes, { project = 'project', home, user, privacy = null } = {}) {
   const clean = guard(privacy);
-  return notes.map((note) => ({
+  return notes.filter((note) => note.kind !== ABERRATION && !note.refutedBy).map((note) => ({
     kind: 'note',
     agent: 'madre',
     mode: 1,
@@ -103,6 +112,45 @@ export function pairsFromNotes(notes, { project = 'project', home, user, privacy
   }));
 }
 
+// What the room got wrong, in the shape that trains against it. Each aberration becomes one
+// preference pair: the same ask, the false claim as what to avoid, the correction as what to say
+// instead. A negative on its own teaches a model very little; a pair tells it which of two
+// answers to prefer, which is what DPO and ORPO are built to read.
+export function preferencesFromAberrations(notes, { project = 'project', home, user, privacy = null } = {}) {
+  const clean = guard(privacy);
+  const say = (text) => clean(redact(String(text ?? ''), { home, user }));
+  const byId = new Map(notes.map((note) => [note.id, note]));
+  const pairs = [];
+  for (const note of notes) {
+    if (note.kind !== ABERRATION) continue;
+    // Without something true to put in its place there is nothing to prefer, so it is left out.
+    const truth = note.correction || (note.contradicts && byId.get(note.contradicts)?.text) || null;
+    if (!truth) continue;
+    const claim = say(note.text);
+    const better = say(truth);
+    if (!claim || !better) continue;
+    // A correction that restates the claim teaches nothing, and a model asked to prefer one of
+    // two near-identical answers learns the wrong lesson from the noise between them. A weak
+    // archivist writes these, so they are caught here rather than shipped.
+    const words = (text) => new Set(String(text).toLowerCase().normalize('NFKD').replace(/[\u0300-\u036f]/g, '').replace(/[^\p{L}\p{N}]+/gu, ' ').trim().split(' ').filter((word) => word.length > 2));
+    const [left, right] = [words(claim), words(better)];
+    if (!left.size || !right.size) continue;
+    let shared = 0;
+    for (const word of right) if (left.has(word)) shared += 1;
+    if (shared / Math.min(left.size, right.size) > 0.8) continue;
+    pairs.push({
+      kind: 'aberration',
+      sequence: note.throughSequence,
+      at: note.created,
+      detector: note.detector ?? null,
+      prompt: `Is this true of the project "${project}"? ${claim}`,
+      rejected: claim,
+      chosen: better,
+    });
+  }
+  return pairs;
+}
+
 // Deterministic split: the sequence decides, so re-exports keep lines on the same side.
 export function split(pairs, { validEvery = 10 } = {}) {
   const train = [];
@@ -114,14 +162,18 @@ export function split(pairs, { validEvery = 10 } = {}) {
 
 export async function exportDataset({ events, notes = [], dir, project = 'project', home, user, privacy = null }) {
   const pairs = [...pairsFromEvents(events, { project, home, user, privacy }), ...pairsFromNotes(notes, { project, home, user, privacy })].sort((a, b) => a.sequence - b.sequence);
+  const preferences = preferencesFromAberrations(notes, { project, home, user, privacy });
   const { train, valid } = split(pairs);
   await mkdir(dir, { recursive: true });
   const line = (pair) => JSON.stringify({ messages: pair.messages });
   await writeFile(join(dir, 'train.jsonl'), train.map(line).join('\n') + (train.length ? '\n' : ''));
   await writeFile(join(dir, 'valid.jsonl'), valid.map(line).join('\n') + (valid.length ? '\n' : ''));
+  // Kept in a file of its own: it is a different shape and a different kind of training, and
+  // nothing that reads the chat files should ever pick it up by accident.
+  await writeFile(join(dir, 'preferences.jsonl'), preferences.map((pair) => JSON.stringify({ prompt: pair.prompt, chosen: pair.chosen, rejected: pair.rejected })).join('\n') + (preferences.length ? '\n' : ''));
   const byAgent = {};
   for (const pair of pairs) byAgent[pair.agent] = (byAgent[pair.agent] ?? 0) + 1;
-  const manifest = { project, exportedAt: new Date().toISOString(), pairs: pairs.length, turns: pairs.filter((p) => p.kind === 'turn').length, delegated: pairs.filter((p) => p.kind === 'delegated').length, good: pairs.filter((p) => p.rating === 'good').length, notes: pairs.filter((p) => p.kind === 'note').length, train: train.length, valid: valid.length, byAgent, files: ['train.jsonl', 'valid.jsonl'], format: 'chat · {"messages":[{role,content}]} · mlx-lm / llama-factory / axolotl' };
+  const manifest = { project, exportedAt: new Date().toISOString(), pairs: pairs.length, turns: pairs.filter((p) => p.kind === 'turn').length, delegated: pairs.filter((p) => p.kind === 'delegated').length, good: pairs.filter((p) => p.rating === 'good').length, notes: pairs.filter((p) => p.kind === 'note').length, aberrations: preferences.length, train: train.length, valid: valid.length, byAgent, files: ['train.jsonl', 'valid.jsonl', 'preferences.jsonl'], format: 'chat · {"messages":[{role,content}]} · mlx-lm / llama-factory / axolotl', preferenceFormat: 'preference · {"prompt","chosen","rejected"} · DPO / ORPO' };
   await writeFile(join(dir, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`);
   return { dir, ...manifest };
 }

package/src/distiller.mjs

@@ -3,7 +3,7 @@
 // keeping for every later turn. Pure functions here; the room schedules and
 // invokes. Nothing in this file talks to a model.
 
-import { MEMORY_KINDS } from './memory.mjs';
+import { ABERRATION, MEMORY_KINDS } from './memory.mjs';
 
 // Cheapest first, by the models these CLIs run by default.
 // Ollama, when the room has it, is the cheapest of all: local and free.
@@ -42,11 +42,12 @@ export function distillPrompt({ entries, projectName = 'the project', existing =
     `- fact: a verified statement about the project or its environment that is not obvious from the code`,
     `- preference: how the human wants things done or said`,
     `- question: something left open that a later turn should not forget`,
+    `- aberration: a claim the exchanges themselves showed to be false. Only when it was refuted out loud: someone stated something about this project and someone else corrected it, or the exchanges proved it wrong. Put the false claim in "text" and what turned out to be true in "correction". Never guess, never file a disagreement of opinion, and never file something merely unverified.`,
     'Skip greetings, restatements, transient status, anything a reader of the code would see anyway, and anything the exchanges do not actually establish.',
     json
-      ? `Output one JSON object and nothing else: {"memories":[...]} with at most ${MAX_MEMORIES_PER_RUN} items, each {"kind":"decision|fact|preference|question","text":"one self-contained sentence in the language the room uses, at most ${MAX_MEMORY_CHARS} characters, naming files, agents and numbers exactly","sources":[sequence numbers it comes from]}. If nothing durable was said: {"memories":[]}`
+      ? `Output one JSON object and nothing else: {"memories":[...]} with at most ${MAX_MEMORIES_PER_RUN} items, each {"kind":"${MEMORY_KINDS.join('|')}","text":"one self-contained sentence in the language the room uses, at most ${MAX_MEMORY_CHARS} characters, naming files, agents and numbers exactly","correction":"only on an aberration: what is true instead","sources":[sequence numbers it comes from]}. If nothing durable was said: {"memories":[]}`
       : `Output only JSON lines, one object per memory, at most ${MAX_MEMORIES_PER_RUN}, nothing else:`,
-    json ? null : `{"kind":"decision|fact|preference|question","text":"one self-contained sentence in the language the room uses, at most ${MAX_MEMORY_CHARS} characters, naming files, agents and numbers exactly","sources":[sequence numbers it comes from]}`,
+    json ? null : `{"kind":"${MEMORY_KINDS.join('|')}","text":"one self-contained sentence in the language the room uses, at most ${MAX_MEMORY_CHARS} characters, naming files, agents and numbers exactly","correction":"only on an aberration: what is true instead","sources":[sequence numbers it comes from]}`,
     json ? null : 'If nothing durable was said, output exactly: NONE',
     known,
     '<exchanges>',
@@ -76,13 +77,19 @@ export function parseDistillation(text, { fromSequence, throughSequence } = {})
     if (!parsed || typeof parsed !== 'object') continue;
     const memoryText = String(parsed.text ?? '').replace(/\s+/g, ' ').trim();
     if (!memoryText) continue;
-    const kind = MEMORY_KINDS.includes(parsed.kind) ? parsed.kind : 'fact';
+    // An unknown kind used to be filed as a fact. That was harmless while every kind was
+    // knowledge; now the list has one that is not, and a typo would turn a hallucination into
+    // something the room believes. Anything unrecognised is dropped instead.
+    if (!MEMORY_KINDS.includes(parsed.kind)) continue;
+    const kind = parsed.kind;
     const inRange = (n) => Number.isInteger(n) && (fromSequence == null || n >= fromSequence) && (throughSequence == null || n <= throughSequence);
     const sources = (Array.isArray(parsed.sources) ? parsed.sources : []).map(Number).filter(inRange);
     const key = memoryText.toLowerCase();
     if (seen.has(key)) continue;
     seen.add(key);
-    memories.push({ kind, text: memoryText.length > MAX_MEMORY_CHARS ? `${memoryText.slice(0, MAX_MEMORY_CHARS - 1)}…` : memoryText, sources });
+    const clip = (value) => (value.length > MAX_MEMORY_CHARS ? `${value.slice(0, MAX_MEMORY_CHARS - 1)}…` : value);
+    const correction = kind === ABERRATION ? clip(String(parsed.correction ?? '').replace(/\s+/g, ' ').trim()) : '';
+    memories.push({ kind, text: clip(memoryText), sources, ...(correction ? { correction } : {}) });
     if (memories.length >= MAX_MEMORIES_PER_RUN) break;
   }
   return memories;

package/src/event-store.mjs

@@ -8,16 +8,22 @@ export class EventStore {
   #nextSequence = 1;
   #writeQueue = Promise.resolve();
   #lockDirectory;
+  #floor = 0;
 
-  constructor(file) {
+  // `floor` is the highest sequence the rest of the project has already used. A project keeps one
+  // numbering across all of its conversations, so #1411 means one exchange in this project and
+  // not one in each thread — the memory index, every citation and NOSTROMO all lean on that.
+  // Gaps in a single ledger are fine: sequences are an order, not a count.
+  constructor(file, { floor = 0 } = {}) {
     this.#file = file;
+    this.#floor = Number.isFinite(floor) ? floor : 0;
     this.#lockDirectory = `${file}.lock`;
   }
 
   async initialize() {
     await mkdir(dirname(this.#file), { recursive: true });
     const existing = await this.readAll();
-    this.#nextSequence = (existing.at(-1)?.sequence ?? 0) + 1;
+    this.#nextSequence = Math.max(existing.at(-1)?.sequence ?? 0, this.#floor) + 1;
     return this;
   }
 
@@ -85,14 +91,14 @@ export class EventStore {
         return async () => {
           try {
             const owner = JSON.parse(await readFile(ownerFile, 'utf8'));
-            if (owner.token === token) await rm(this.#lockDirectory, { recursive: true, force: true });
+            if (owner.token === token) await rm(this.#lockDirectory, { recursive: true, force: true, maxRetries: 6, retryDelay: 60 });
           } catch (error) {
             if (error.code !== 'ENOENT') throw error;
           }
         };
       } catch (error) {
         if (created) {
-          await rm(this.#lockDirectory, { recursive: true, force: true });
+          await rm(this.#lockDirectory, { recursive: true, force: true, maxRetries: 6, retryDelay: 60 });
           throw error;
         }
         if (error.code !== 'EEXIST') throw error;
@@ -102,7 +108,7 @@ export class EventStore {
             process.kill(owner.pid, 0);
           } catch (ownerError) {
             if (ownerError.code === 'ESRCH') {
-              await rm(this.#lockDirectory, { recursive: true, force: true });
+              await rm(this.#lockDirectory, { recursive: true, force: true, maxRetries: 6, retryDelay: 60 });
               continue;
             }
           }
@@ -110,7 +116,7 @@ export class EventStore {
           if (ownerError.code !== 'ENOENT' && !(ownerError instanceof SyntaxError)) throw ownerError;
           const lock = await stat(this.#lockDirectory).catch(() => null);
           if (lock && Date.now() - lock.mtimeMs > 10000) {
-            await rm(this.#lockDirectory, { recursive: true, force: true });
+            await rm(this.#lockDirectory, { recursive: true, force: true, maxRetries: 6, retryDelay: 60 });
             continue;
           }
         }
@@ -138,7 +144,7 @@ export class EventStore {
         const temp = `${this.#file}.rewrite-${process.pid}`;
         await writeFile(temp, next.map((event) => JSON.stringify(event)).join('\n') + (next.length ? '\n' : ''));
         await rename(temp, this.#file);
-        this.#nextSequence = (next.at(-1)?.sequence ?? 0) + 1;
+        this.#nextSequence = Math.max(next.at(-1)?.sequence ?? 0, this.#floor) + 1;
         return { total: next.length, changed };
       } finally {
         await release();
@@ -153,7 +159,7 @@ export class EventStore {
       const release = await this.#acquireLock();
       try {
         const existing = await this.#readAllUnlocked();
-        const sequence = (existing.at(-1)?.sequence ?? 0) + 1;
+        const sequence = Math.max(existing.at(-1)?.sequence ?? 0, this.#floor) + 1;
         const event = {
           id: randomUUID(),
           sequence,